Merge staging-next into staging

2022-05-13 00:03:35 +00:00 · 2022-05-13 00:03:35 +00:00 · d79af4efe4
commit d79af4efe4
parent 5c5187646d 97ea1401a7
91 changed files with 3916 additions and 4615 deletions
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -1173,6 +1173,16 @@
          migration guide</link> for more details.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>teleport</literal> has been upgraded to major version
+          9. Please see upstream
+          <link xlink:href="https://goteleport.com/docs/setup/operations/upgrading/">upgrade
+          instructions</link> and
+          <link xlink:href="https://goteleport.com/docs/changelog/#900">release
+          notes</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          For <literal>pkgs.python3.pkgs.ipython</literal>, its direct
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -490,6 +490,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The `autorestic` package has been upgraded from 1.3.0 to 1.5.0 which introduces breaking changes in config file, check [their migration guide](https://autorestic.vercel.app/migration/1.4_1.5) for more details.

+- `teleport` has been upgraded to major version 9. Please see upstream [upgrade instructions](https://goteleport.com/docs/setup/operations/upgrading/) and [release notes](https://goteleport.com/docs/changelog/#900).
+
 - For `pkgs.python3.pkgs.ipython`, its direct dependency `pkgs.python3.pkgs.matplotlib-inline`
  (which is really an adapter to integrate matplotlib in ipython if it is installed) does
  not depend on `pkgs.python3.pkgs.matplotlib` anymore.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -505,6 +505,7 @@
  ./services/mail/postfixadmin.nix
  ./services/mail/postsrsd.nix
  ./services/mail/postgrey.nix
+  ./services/mail/public-inbox.nix
  ./services/mail/spamassassin.nix
  ./services/mail/rspamd.nix
  ./services/mail/rss2email.nix
--- a/nixos/modules/services/mail/public-inbox.nix
+++ b/nixos/modules/services/mail/public-inbox.nix
@ -0,0 +1,579 @@
+{ lib, pkgs, config, ... }:
+
+with lib;
+
+let
+  cfg = config.services.public-inbox;
+  stateDir = "/var/lib/public-inbox";
+
+  manref = name: vol: "<citerefentry><refentrytitle>${name}</refentrytitle><manvolnum>${toString vol}</manvolnum></citerefentry>";
+
+  gitIni = pkgs.formats.gitIni { listsAsDuplicateKeys = true; };
+  iniAtom = elemAt gitIni.type/*attrsOf*/.functor.wrapped/*attrsOf*/.functor.wrapped/*either*/.functor.wrapped 0;
+
+  useSpamAssassin = cfg.settings.publicinboxmda.spamcheck == "spamc" ||
+                    cfg.settings.publicinboxwatch.spamcheck == "spamc";
+
+  publicInboxDaemonOptions = proto: defaultPort: {
+    args = mkOption {
+      type = with types; listOf str;
+      default = [];
+      description = "Command-line arguments to pass to ${manref "public-inbox-${proto}d" 1}.";
+    };
+    port = mkOption {
+      type = with types; nullOr (either str port);
+      default = defaultPort;
+      description = ''
+        Listening port.
+        Beware that public-inbox uses well-known ports number to decide whether to enable TLS or not.
+        Set to null and use <code>systemd.sockets.public-inbox-${proto}d.listenStreams</code>
+        if you need a more advanced listening.
+      '';
+    };
+    cert = mkOption {
+      type = with types; nullOr str;
+      default = null;
+      example = "/path/to/fullchain.pem";
+      description = "Path to TLS certificate to use for connections to ${manref "public-inbox-${proto}d" 1}.";
+    };
+    key = mkOption {
+      type = with types; nullOr str;
+      default = null;
+      example = "/path/to/key.pem";
+      description = "Path to TLS key to use for connections to ${manref "public-inbox-${proto}d" 1}.";
+    };
+  };
+
+  serviceConfig = srv:
+    let proto = removeSuffix "d" srv;
+        needNetwork = builtins.hasAttr proto cfg && cfg.${proto}.port == null;
+    in {
+    serviceConfig = {
+      # Enable JIT-compiled C (via Inline::C)
+      Environment = [ "PERL_INLINE_DIRECTORY=/run/public-inbox-${srv}/perl-inline" ];
+      # NonBlocking is REQUIRED to avoid a race condition
+      # if running simultaneous services.
+      NonBlocking = true;
+      #LimitNOFILE = 30000;
+      User = config.users.users."public-inbox".name;
+      Group = config.users.groups."public-inbox".name;
+      RuntimeDirectory = [
+          "public-inbox-${srv}/perl-inline"
+        ];
+      RuntimeDirectoryMode = "700";
+      # This is for BindPaths= and BindReadOnlyPaths=
+      # to allow traversal of directories they create inside RootDirectory=
+      UMask = "0066";
+      StateDirectory = ["public-inbox"];
+      StateDirectoryMode = "0750";
+      WorkingDirectory = stateDir;
+      BindReadOnlyPaths = [
+          "/etc"
+          "/run/systemd"
+          "${config.i18n.glibcLocales}"
+        ] ++
+        mapAttrsToList (name: inbox: inbox.description) cfg.inboxes ++
+        # Without confinement the whole Nix store
+        # is made available to the service
+        optionals (!config.systemd.services."public-inbox-${srv}".confinement.enable) [
+          "${pkgs.dash}/bin/dash:/bin/sh"
+          builtins.storeDir
+        ];
+      # The following options are only for optimizing:
+      # systemd-analyze security public-inbox-'*'
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      # ProtectClock= adds DeviceAllow=char-rtc r
+      DeviceAllow = "";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      PrivateNetwork = mkDefault (!needNetwork);
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectHome = mkDefault true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectProc = "invisible";
+      #ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [ "AF_UNIX" ] ++
+        optionals needNetwork [ "AF_INET" "AF_INET6" ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      SystemCallFilter = [
+        "@system-service"
+        "~@aio" "~@chown" "~@keyring" "~@memlock" "~@resources"
+        # Not removing @setuid and @privileged because Inline::C needs them.
+        # Not removing @timer because git upload-pack needs it.
+      ];
+      SystemCallArchitectures = "native";
+
+      # The following options are redundant when confinement is enabled
+      RootDirectory = "/var/empty";
+      TemporaryFileSystem = "/";
+      PrivateMounts = true;
+      MountAPIVFS = true;
+      PrivateDevices = true;
+      PrivateTmp = true;
+      PrivateUsers = true;
+      ProtectControlGroups = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+    };
+    confinement = {
+      # Until we agree upon doing it directly here in NixOS
+      # https://github.com/NixOS/nixpkgs/pull/104457#issuecomment-1115768447
+      # let the user choose to enable the confinement with:
+      # systemd.services.public-inbox-httpd.confinement.enable = true;
+      # systemd.services.public-inbox-imapd.confinement.enable = true;
+      # systemd.services.public-inbox-init.confinement.enable = true;
+      # systemd.services.public-inbox-nntpd.confinement.enable = true;
+      #enable = true;
+      mode = "full-apivfs";
+      # Inline::C needs a /bin/sh, and dash is enough
+      binSh = "${pkgs.dash}/bin/dash";
+      packages = [
+          pkgs.iana-etc
+          (getLib pkgs.nss)
+          pkgs.tzdata
+        ];
+    };
+  };
+in
+
+{
+  options.services.public-inbox = {
+    enable = mkEnableOption "the public-inbox mail archiver";
+    package = mkOption {
+      type = types.package;
+      default = pkgs.public-inbox;
+      defaultText = literalExpression "pkgs.public-inbox";
+      description = "public-inbox package to use.";
+    };
+    path = mkOption {
+      type = with types; listOf package;
+      default = [];
+      example = literalExpression "with pkgs; [ spamassassin ]";
+      description = ''
+        Additional packages to place in the path of public-inbox-mda,
+        public-inbox-watch, etc.
+      '';
+    };
+    inboxes = mkOption {
+      description = ''
+        Inboxes to configure, where attribute names are inbox names.
+      '';
+      default = {};
+      type = types.attrsOf (types.submodule ({name, ...}: {
+        freeformType = types.attrsOf iniAtom;
+        options.inboxdir = mkOption {
+          type = types.str;
+          default = "${stateDir}/inboxes/${name}";
+          description = "The absolute path to the directory which hosts the public-inbox.";
+        };
+        options.address = mkOption {
+          type = with types; listOf str;
+          example = "example-discuss@example.org";
+          description = "The email addresses of the public-inbox.";
+        };
+        options.url = mkOption {
+          type = with types; nullOr str;
+          default = null;
+          example = "https://example.org/lists/example-discuss";
+          description = "URL where this inbox can be accessed over HTTP.";
+        };
+        options.description = mkOption {
+          type = types.str;
+          example = "user/dev discussion of public-inbox itself";
+          description = "User-visible description for the repository.";
+          apply = pkgs.writeText "public-inbox-description-${name}";
+        };
+        options.newsgroup = mkOption {
+          type = with types; nullOr str;
+          default = null;
+          description = "NNTP group name for the inbox.";
+        };
+        options.watch = mkOption {
+          type = with types; listOf str;
+          default = [];
+          description = "Paths for ${manref "public-inbox-watch" 1} to monitor for new mail.";
+          example = [ "maildir:/path/to/test.example.com.git" ];
+        };
+        options.watchheader = mkOption {
+          type = with types; nullOr str;
+          default = null;
+          example = "List-Id:<test@example.com>";
+          description = ''
+            If specified, ${manref "public-inbox-watch" 1} will only process
+            mail containing a matching header.
+          '';
+        };
+        options.coderepo = mkOption {
+          type = (types.listOf (types.enum (attrNames cfg.settings.coderepo))) // {
+            description = "list of coderepo names";
+          };
+          default = [];
+          description = "Nicknames of a 'coderepo' section associated with the inbox.";
+        };
+      }));
+    };
+    imap = {
+      enable = mkEnableOption "the public-inbox IMAP server";
+    } // publicInboxDaemonOptions "imap" 993;
+    http = {
+      enable = mkEnableOption "the public-inbox HTTP server";
+      mounts = mkOption {
+        type = with types; listOf str;
+        default = [ "/" ];
+        example = [ "/lists/archives" ];
+        description = ''
+          Root paths or URLs that public-inbox will be served on.
+          If domain parts are present, only requests to those
+          domains will be accepted.
+        '';
+      };
+      args = (publicInboxDaemonOptions "http" 80).args;
+      port = mkOption {
+        type = with types; nullOr (either str port);
+        default = 80;
+        example = "/run/public-inbox-httpd.sock";
+        description = ''
+          Listening port or systemd's ListenStream= entry
+          to be used as a reverse proxy, eg. in nginx:
+          <code>locations."/inbox".proxyPass = "http://unix:''${config.services.public-inbox.http.port}:/inbox";</code>
+          Set to null and use <code>systemd.sockets.public-inbox-httpd.listenStreams</code>
+          if you need a more advanced listening.
+        '';
+      };
+    };
+    mda = {
+      enable = mkEnableOption "the public-inbox Mail Delivery Agent";
+      args = mkOption {
+        type = with types; listOf str;
+        default = [];
+        description = "Command-line arguments to pass to ${manref "public-inbox-mda" 1}.";
+      };
+    };
+    postfix.enable = mkEnableOption "the integration into Postfix";
+    nntp = {
+      enable = mkEnableOption "the public-inbox NNTP server";
+    } // publicInboxDaemonOptions "nntp" 563;
+    spamAssassinRules = mkOption {
+      type = with types; nullOr path;
+      default = "${cfg.package.sa_config}/user/.spamassassin/user_prefs";
+      defaultText = literalExpression "\${cfg.package.sa_config}/user/.spamassassin/user_prefs";
+      description = "SpamAssassin configuration specific to public-inbox.";
+    };
+    settings = mkOption {
+      description = ''
+        Settings for the <link xlink:href="https://public-inbox.org/public-inbox-config.html">public-inbox config file</link>.
+      '';
+      default = {};
+      type = types.submodule {
+        freeformType = gitIni.type;
+        options.publicinbox = mkOption {
+          default = {};
+          description = "public inboxes";
+          type = types.submodule {
+            freeformType = with types; /*inbox name*/attrsOf (/*inbox option name*/attrsOf /*inbox option value*/iniAtom);
+            options.css = mkOption {
+              type = with types; listOf str;
+              default = [];
+              description = "The local path name of a CSS file for the PSGI web interface.";
+            };
+            options.nntpserver = mkOption {
+              type = with types; listOf str;
+              default = [];
+              example = [ "nntp://news.public-inbox.org" "nntps://news.public-inbox.org" ];
+              description = "NNTP URLs to this public-inbox instance";
+            };
+            options.wwwlisting = mkOption {
+              type = with types; enum [ "all" "404" "match=domain" ];
+              default = "404";
+              description = ''
+                Controls which lists (if any) are listed for when the root
+                public-inbox URL is accessed over HTTP.
+              '';
+            };
+          };
+        };
+        options.publicinboxmda.spamcheck = mkOption {
+          type = with types; enum [ "spamc" "none" ];
+          default = "none";
+          description = ''
+            If set to spamc, ${manref "public-inbox-watch" 1} will filter spam
+            using SpamAssassin.
+          '';
+        };
+        options.publicinboxwatch.spamcheck = mkOption {
+          type = with types; enum [ "spamc" "none" ];
+          default = "none";
+          description = ''
+            If set to spamc, ${manref "public-inbox-watch" 1} will filter spam
+            using SpamAssassin.
+          '';
+        };
+        options.publicinboxwatch.watchspam = mkOption {
+          type = with types; nullOr str;
+          default = null;
+          example = "maildir:/path/to/spam";
+          description = ''
+            If set, mail in this maildir will be trained as spam and
+            deleted from all watched inboxes
+          '';
+        };
+        options.coderepo = mkOption {
+          default = {};
+          description = "code repositories";
+          type = types.attrsOf (types.submodule {
+            freeformType = types.attrsOf iniAtom;
+            options.cgitUrl = mkOption {
+              type = types.str;
+              description = "URL of a cgit instance";
+            };
+            options.dir = mkOption {
+              type = types.str;
+              description = "Path to a git repository";
+            };
+          });
+        };
+      };
+    };
+    openFirewall = mkEnableOption "opening the firewall when using a port option";
+  };
+  config = mkIf cfg.enable {
+    assertions = [
+      { assertion = config.services.spamassassin.enable || !useSpamAssassin;
+        message = ''
+          public-inbox is configured to use SpamAssassin, but
+          services.spamassassin.enable is false.  If you don't need
+          spam checking, set `services.public-inbox.settings.publicinboxmda.spamcheck' and
+          `services.public-inbox.settings.publicinboxwatch.spamcheck' to null.
+        '';
+      }
+      { assertion = cfg.path != [] || !useSpamAssassin;
+        message = ''
+          public-inbox is configured to use SpamAssassin, but there is
+          no spamc executable in services.public-inbox.path.  If you
+          don't need spam checking, set
+          `services.public-inbox.settings.publicinboxmda.spamcheck' and
+          `services.public-inbox.settings.publicinboxwatch.spamcheck' to null.
+        '';
+      }
+    ];
+    services.public-inbox.settings =
+      filterAttrsRecursive (n: v: v != null) {
+        publicinbox = mapAttrs (n: filterAttrs (n: v: n != "description")) cfg.inboxes;
+    };
+    users = {
+      users.public-inbox = {
+        home = stateDir;
+        group = "public-inbox";
+        isSystemUser = true;
+      };
+      groups.public-inbox = {};
+    };
+    networking.firewall = mkIf cfg.openFirewall
+      { allowedTCPPorts = mkMerge
+        (map (proto: (mkIf (cfg.${proto}.enable && types.port.check cfg.${proto}.port) [ cfg.${proto}.port ]))
+        ["imap" "http" "nntp"]);
+      };
+    services.postfix = mkIf (cfg.postfix.enable && cfg.mda.enable) {
+      # Not sure limiting to 1 is necessary, but better safe than sorry.
+      config.public-inbox_destination_recipient_limit = "1";
+
+      # Register the addresses as existing
+      virtual =
+        concatStringsSep "\n" (mapAttrsToList (_: inbox:
+          concatMapStringsSep "\n" (address:
+            "${address} ${address}"
+          ) inbox.address
+        ) cfg.inboxes);
+
+      # Deliver the addresses with the public-inbox transport
+      transport =
+        concatStringsSep "\n" (mapAttrsToList (_: inbox:
+          concatMapStringsSep "\n" (address:
+            "${address} public-inbox:${address}"
+          ) inbox.address
+        ) cfg.inboxes);
+
+      # The public-inbox transport
+      masterConfig.public-inbox = {
+        type = "unix";
+        privileged = true; # Required for user=
+        command = "pipe";
+        args = [
+          "flags=X" # Report as a final delivery
+          "user=${with config.users; users."public-inbox".name + ":" + groups."public-inbox".name}"
+          # Specifying a nexthop when using the transport
+          # (eg. test public-inbox:test) allows to
+          # receive mails with an extension (eg. test+foo).
+          "argv=${pkgs.writeShellScript "public-inbox-transport" ''
+            export HOME="${stateDir}"
+            export ORIGINAL_RECIPIENT="''${2:-1}"
+            export PATH="${makeBinPath cfg.path}:$PATH"
+            exec ${cfg.package}/bin/public-inbox-mda ${escapeShellArgs cfg.mda.args}
+          ''} \${original_recipient} \${nexthop}"
+        ];
+      };
+    };
+    systemd.sockets = mkMerge (map (proto:
+      mkIf (cfg.${proto}.enable && cfg.${proto}.port != null)
+        { "public-inbox-${proto}d" = {
+            listenStreams = [ (toString cfg.${proto}.port) ];
+            wantedBy = [ "sockets.target" ];
+          };
+        }
+      ) [ "imap" "http" "nntp" ]);
+    systemd.services = mkMerge [
+      (mkIf cfg.imap.enable
+        { public-inbox-imapd = mkMerge [(serviceConfig "imapd") {
+          after = [ "public-inbox-init.service" "public-inbox-watch.service" ];
+          requires = [ "public-inbox-init.service" ];
+          serviceConfig = {
+            ExecStart = escapeShellArgs (
+              [ "${cfg.package}/bin/public-inbox-imapd" ] ++
+              cfg.imap.args ++
+              optionals (cfg.imap.cert != null) [ "--cert" cfg.imap.cert ] ++
+              optionals (cfg.imap.key != null) [ "--key" cfg.imap.key ]
+            );
+          };
+        }];
+      })
+      (mkIf cfg.http.enable
+        { public-inbox-httpd = mkMerge [(serviceConfig "httpd") {
+          after = [ "public-inbox-init.service" "public-inbox-watch.service" ];
+          requires = [ "public-inbox-init.service" ];
+          serviceConfig = {
+            ExecStart = escapeShellArgs (
+              [ "${cfg.package}/bin/public-inbox-httpd" ] ++
+              cfg.http.args ++
+              # See https://public-inbox.org/public-inbox.git/tree/examples/public-inbox.psgi
+              # for upstream's example.
+              [ (pkgs.writeText "public-inbox.psgi" ''
+                #!${cfg.package.fullperl} -w
+                use strict;
+                use warnings;
+                use Plack::Builder;
+                use PublicInbox::WWW;
+
+                my $www = PublicInbox::WWW->new;
+                $www->preload;
+
+                builder {
+                  # If reached through a reverse proxy,
+                  # make it transparent by resetting some HTTP headers
+                  # used by public-inbox to generate URIs.
+                  enable 'ReverseProxy';
+
+                  # No need to send a response body if it's an HTTP HEAD requests.
+                  enable 'Head';
+
+                  # Route according to configured domains and root paths.
+                  ${concatMapStrings (path: ''
+                  mount q(${path}) => sub { $www->call(@_); };
+                  '') cfg.http.mounts}
+                }
+              '') ]
+            );
+          };
+        }];
+      })
+      (mkIf cfg.nntp.enable
+        { public-inbox-nntpd = mkMerge [(serviceConfig "nntpd") {
+          after = [ "public-inbox-init.service" "public-inbox-watch.service" ];
+          requires = [ "public-inbox-init.service" ];
+          serviceConfig = {
+            ExecStart = escapeShellArgs (
+              [ "${cfg.package}/bin/public-inbox-nntpd" ] ++
+              cfg.nntp.args ++
+              optionals (cfg.nntp.cert != null) [ "--cert" cfg.nntp.cert ] ++
+              optionals (cfg.nntp.key != null) [ "--key" cfg.nntp.key ]
+            );
+          };
+        }];
+      })
+      (mkIf (any (inbox: inbox.watch != []) (attrValues cfg.inboxes)
+        || cfg.settings.publicinboxwatch.watchspam != null)
+        { public-inbox-watch = mkMerge [(serviceConfig "watch") {
+          inherit (cfg) path;
+          wants = [ "public-inbox-init.service" ];
+          requires = [ "public-inbox-init.service" ] ++
+            optional (cfg.settings.publicinboxwatch.spamcheck == "spamc") "spamassassin.service";
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            ExecStart = "${cfg.package}/bin/public-inbox-watch";
+            ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          };
+        }];
+      })
+      ({ public-inbox-init = let
+          PI_CONFIG = gitIni.generate "public-inbox.ini"
+            (filterAttrsRecursive (n: v: v != null) cfg.settings);
+          in mkMerge [(serviceConfig "init") {
+          wantedBy = [ "multi-user.target" ];
+          restartIfChanged = true;
+          restartTriggers = [ PI_CONFIG ];
+          script = ''
+            set -ux
+            install -D -p ${PI_CONFIG} ${stateDir}/.public-inbox/config
+            '' + optionalString useSpamAssassin ''
+              install -m 0700 -o spamd -d ${stateDir}/.spamassassin
+              ${optionalString (cfg.spamAssassinRules != null) ''
+                ln -sf ${cfg.spamAssassinRules} ${stateDir}/.spamassassin/user_prefs
+              ''}
+            '' + concatStrings (mapAttrsToList (name: inbox: ''
+              if [ ! -e ${stateDir}/inboxes/${escapeShellArg name} ]; then
+                # public-inbox-init creates an inbox and adds it to a config file.
+                # It tries to atomically write the config file by creating
+                # another file in the same directory, and renaming it.
+                # This has the sad consequence that we can't use
+                # /dev/null, or it would try to create a file in /dev.
+                conf_dir="$(mktemp -d)"
+
+                PI_CONFIG=$conf_dir/conf \
+                ${cfg.package}/bin/public-inbox-init -V2 \
+                  ${escapeShellArgs ([ name "${stateDir}/inboxes/${name}" inbox.url ] ++ inbox.address)}
+
+                rm -rf $conf_dir
+              fi
+
+              ln -sf ${inbox.description} \
+                ${stateDir}/inboxes/${escapeShellArg name}/description
+
+              export GIT_DIR=${stateDir}/inboxes/${escapeShellArg name}/all.git
+              if test -d "$GIT_DIR"; then
+                # Config is inherited by each epoch repository,
+                # so just needs to be set for all.git.
+                ${pkgs.git}/bin/git config core.sharedRepository 0640
+              fi
+            '') cfg.inboxes
+            ) + ''
+            shopt -s nullglob
+            for inbox in ${stateDir}/inboxes/*/; do
+              # This should be idempotent, but only do it for new
+              # inboxes anyway because it's only needed once, and could
+              # be slow for large pre-existing inboxes.
+              ls -1 "$inbox" | grep -q '^xap' ||
+              ${cfg.package}/bin/public-inbox-index "$inbox"
+            done
+          '';
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            StateDirectory = [
+              "public-inbox/.public-inbox"
+              "public-inbox/.public-inbox/emergency"
+              "public-inbox/inboxes"
+            ];
+          };
+        }];
+      })
+    ];
+    environment.systemPackages = with pkgs; [ cfg.package ];
+  };
+  meta.maintainers = with lib.maintainers; [ julm qyliss ];
+}
--- a/nixos/modules/services/x11/desktop-managers/default.nix
+++ b/nixos/modules/services/x11/desktop-managers/default.nix
@ -72,7 +72,7 @@ in
        apply = map (d: d // {
          manage = "desktop";
          start = d.start
-          + optionalString (needBGCond d) ''
+          + optionalString (needBGCond d) ''\n\n
            if [ -e $HOME/.background-image ]; then
              ${pkgs.feh}/bin/feh --bg-${cfg.wallpaper.mode} ${optionalString cfg.wallpaper.combineScreens "--no-xinerama"} $HOME/.background-image
            fi
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -456,6 +456,7 @@ in
  proxy = handleTest ./proxy.nix {};
  prowlarr = handleTest ./prowlarr.nix {};
  pt2-clone = handleTest ./pt2-clone.nix {};
+  public-inbox = handleTest ./public-inbox.nix {};
  pulseaudio = discoverTests (import ./pulseaudio.nix);
  qboot = handleTestOn ["x86_64-linux" "i686-linux"] ./qboot.nix {};
  quorum = handleTest ./quorum.nix {};
--- a/nixos/tests/public-inbox.nix
+++ b/nixos/tests/public-inbox.nix
@ -0,0 +1,227 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+let
+  orga = "example";
+  domain = "${orga}.localdomain";
+
+  tls-cert = pkgs.runCommand "selfSignedCert" { buildInputs = [ pkgs.openssl ]; } ''
+    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 36500 \
+      -subj '/CN=machine.${domain}'
+    install -D -t $out key.pem cert.pem
+  '';
+in
+{
+  name = "public-inbox";
+
+  meta.maintainers = with pkgs.lib.maintainers; [ julm ];
+
+  machine = { config, pkgs, nodes, ... }: let
+    inherit (config.services) gitolite public-inbox;
+    # Git repositories paths in Gitolite.
+    # Only their baseNameOf is used for configuring public-inbox.
+    repositories = [
+      "user/repo1"
+      "user/repo2"
+    ];
+  in
+  {
+    virtualisation.diskSize = 1 * 1024;
+    virtualisation.memorySize = 1 * 1024;
+    networking.domain = domain;
+
+    security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
+    # If using security.acme:
+    #security.acme.certs."${domain}".postRun = ''
+    #  systemctl try-restart public-inbox-nntpd public-inbox-imapd
+    #'';
+
+    services.public-inbox = {
+      enable = true;
+      postfix.enable = true;
+      openFirewall = true;
+      settings.publicinbox = {
+        css = [ "href=https://machine.${domain}/style/light.css" ];
+        nntpserver = [ "nntps://machine.${domain}" ];
+        wwwlisting = "match=domain";
+      };
+      mda = {
+        enable = true;
+        args = [ "--no-precheck" ]; # Allow Bcc:
+      };
+      http = {
+        enable = true;
+        port = "/run/public-inbox-http.sock";
+        #port = 8080;
+        args = ["-W0"];
+        mounts = [
+          "https://machine.${domain}/inbox"
+        ];
+      };
+      nntp = {
+        enable = true;
+        #port = 563;
+        args = ["-W0"];
+        cert = "${tls-cert}/cert.pem";
+        key = "${tls-cert}/key.pem";
+      };
+      imap = {
+        enable = true;
+        #port = 993;
+        args = ["-W0"];
+        cert = "${tls-cert}/cert.pem";
+        key = "${tls-cert}/key.pem";
+      };
+      inboxes = lib.recursiveUpdate (lib.genAttrs (map baseNameOf repositories) (repo: {
+        address = [
+          # Routed to the "public-inbox:" transport in services.postfix.transport
+          "${repo}@${domain}"
+        ];
+        description = ''
+          ${repo}@${domain} :
+          discussions about ${repo}.
+        '';
+        url = "https://machine.${domain}/inbox/${repo}";
+        newsgroup = "inbox.comp.${orga}.${repo}";
+        coderepo = [ repo ];
+      }))
+      {
+        repo2 = {
+          hide = [
+            "imap" # FIXME: doesn't work for IMAP as of public-inbox 1.6.1
+            "manifest"
+            "www"
+          ];
+        };
+      };
+      settings.coderepo = lib.listToAttrs (map (path: lib.nameValuePair (baseNameOf path) {
+        dir = "/var/lib/gitolite/repositories/${path}.git";
+        cgitUrl = "https://git.${domain}/${path}.git";
+      }) repositories);
+    };
+
+    # Use gitolite to store Git repositories listed in coderepo entries
+    services.gitolite = {
+      enable = true;
+      adminPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJmoTOQnGqX+//us5oye8UuE+tQBx9QEM7PN13jrwgqY root@localhost";
+    };
+    systemd.services.public-inbox-httpd = {
+      serviceConfig.SupplementaryGroups = [ gitolite.group ];
+    };
+
+    # Use nginx as a reverse proxy for public-inbox-httpd
+    services.nginx = {
+      enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedTlsSettings = true;
+      recommendedProxySettings = true;
+      virtualHosts."machine.${domain}" = {
+        forceSSL = true;
+        sslCertificate = "${tls-cert}/cert.pem";
+        sslCertificateKey = "${tls-cert}/key.pem";
+        locations."/".return = "302 /inbox";
+        locations."= /inbox".return = "302 /inbox/";
+        locations."/inbox".proxyPass = "http://unix:${public-inbox.http.port}:/inbox";
+        # If using TCP instead of a Unix socket:
+        #locations."/inbox".proxyPass = "http://127.0.0.1:${toString public-inbox.http.port}/inbox";
+        # Referred to by settings.publicinbox.css
+        # See http://public-inbox.org/meta/_/text/color/
+        locations."= /style/light.css".alias = pkgs.writeText "light.css" ''
+          * { background:#fff; color:#000 }
+
+          a { color:#00f; text-decoration:none }
+          a:visited { color:#808 }
+
+          *.q { color:#008 }
+
+          *.add { color:#060 }
+          *.del {color:#900 }
+          *.head { color:#000 }
+          *.hunk { color:#960 }
+
+          .hl.num { color:#f30 } /* number */
+          .hl.esc { color:#f0f } /* escape character */
+          .hl.str { color:#f30 } /* string */
+          .hl.ppc { color:#c3c } /* preprocessor */
+          .hl.pps { color:#f30 } /* preprocessor string */
+          .hl.slc { color:#099 } /* single-line comment */
+          .hl.com { color:#099 } /* multi-line comment */
+          /* .hl.opt { color:#ccc } */ /* operator */
+          /* .hl.ipl { color:#ccc } */ /* interpolation */
+
+          /* keyword groups kw[a-z] */
+          .hl.kwa { color:#f90 }
+          .hl.kwb { color:#060 }
+          .hl.kwc { color:#f90 }
+          /* .hl.kwd { color:#ccc } */
+        '';
+      };
+    };
+
+    services.postfix = {
+      enable = true;
+      setSendmail = true;
+      #sslCert = "${tls-cert}/cert.pem";
+      #sslKey = "${tls-cert}/key.pem";
+      recipientDelimiter = "+";
+    };
+
+    environment.systemPackages = [
+      pkgs.mailutils
+      pkgs.openssl
+    ];
+
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("public-inbox-init.service")
+
+    # Very basic check that Gitolite can work;
+    # Gitolite is not needed for the rest of this testScript
+    machine.wait_for_unit("gitolite-init.service")
+
+    # List inboxes through public-inbox-httpd
+    machine.wait_for_unit("nginx.service")
+    machine.succeed("curl -L https://machine.${domain} | grep repo1@${domain}")
+    # The repo2 inbox is hidden
+    machine.fail("curl -L https://machine.${domain} | grep repo2@${domain}")
+    machine.wait_for_unit("public-inbox-httpd.service")
+
+    # Send a mail and read it through public-inbox-httpd
+    # Must work too when using a recipientDelimiter.
+    machine.wait_for_unit("postfix.service")
+    machine.succeed("mail -t <${pkgs.writeText "mail" ''
+      Subject: Testing mail
+      From: root@localhost
+      To: repo1+extension@${domain}
+      Message-ID: <repo1@root-1>
+      Content-Type: text/plain; charset=utf-8
+      Content-Disposition: inline
+
+      This is a testing mail.
+    ''}")
+    machine.sleep(5)
+    machine.succeed("curl -L 'https://machine.${domain}/inbox/repo1/repo1@root-1/T/#u' | grep 'This is a testing mail.'")
+
+    # Read a mail through public-inbox-imapd
+    machine.wait_for_open_port(993)
+    machine.wait_for_unit("public-inbox-imapd.service")
+    machine.succeed("openssl s_client -ign_eof -crlf -connect machine.${domain}:993 <${pkgs.writeText "imap-commands" ''
+      tag login anonymous@${domain} anonymous
+      tag SELECT INBOX.comp.${orga}.repo1.0
+      tag FETCH 1 (BODY[HEADER])
+      tag LOGOUT
+    ''} | grep '^Message-ID: <repo1@root-1>'")
+
+    # TODO: Read a mail through public-inbox-nntpd
+    #machine.wait_for_open_port(563)
+    #machine.wait_for_unit("public-inbox-nntpd.service")
+
+    # Delete a mail.
+    # Note that the use of an extension not listed in the addresses
+    # require to use --all
+    machine.succeed("curl -L https://machine.example.localdomain/inbox/repo1/repo1@root-1/raw | sudo -u public-inbox public-inbox-learn rm --all")
+    machine.fail("curl -L https://machine.example.localdomain/inbox/repo1/repo1@root-1/T/#u | grep 'This is a testing mail.'")
+  '';
+})
--- a/pkgs/applications/audio/amberol/default.nix
+++ b/pkgs/applications/audio/amberol/default.nix
@ -19,20 +19,20 @@

 stdenv.mkDerivation rec {
  pname = "amberol";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = pname;
    rev = version;
-    hash = "sha256-7cwoP2Dvlrq44orckhCjFGrSVDuG8WdW8wbpAjD5zhI=";
+    hash = "sha256-mbRBLhnALPFoHwvx05o0lH5Ld4BN+hPY2OyajgTFsek=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-CGPDaVS8F7H/tH0lRjFloWmZmW8NHheyZRCCqEavWeo=";
+    hash = "sha256-/5AHwbolEWsj3ChLFJxQaccfookEGvSSkehw0THYnSE=";
  };

  postPatch = ''
--- a/pkgs/applications/editors/jupyter-kernels/clojupyter/default.nix
+++ b/pkgs/applications/editors/jupyter-kernels/clojupyter/default.nix
@ -20,7 +20,7 @@ let
  '';

  pname = "clojupyter";
-  version = "0.3.2";
+  version = "0.3.3";

  meta = with lib; {
    description = "A Jupyter kernel for Clojure";
@ -36,8 +36,8 @@ let
    src = fetchFromGitHub {
      owner = "clojupyter";
      repo = "clojupyter";
-      rev = "0.3.2";
-      sha256 = "1wphc7h74qlm9bcv5f95qhq1rq9gmcm5hvjblb01vffx996vr6jz";
+      rev = version;
+      sha256 = "sha256-BCzcPnLSonm+ELFU4JIIzLPlVnP0VzlrRSGxOd/LFow=";
    };

    buildInputs = [ imagemagick ];
--- a/pkgs/applications/editors/jupyter-kernels/clojupyter/deps.edn
+++ b/pkgs/applications/editors/jupyter-kernels/clojupyter/deps.edn
@ -1 +1 @@
-{:deps {clojupyter/clojupyter {:mvn/version "0.3.2"}}}
+{:deps {clojupyter/clojupyter {:mvn/version "0.3.3"}}}
--- a/pkgs/applications/editors/jupyter-kernels/clojupyter/deps.nix
+++ b/pkgs/applications/editors/jupyter-kernels/clojupyter/deps.nix
@ -31,8 +31,8 @@
      inherit repos;
      artifactId = "data.json";
      groupId = "org.clojure";
-      sha512 = "ce526bef01bedd31b772954d921a61832ae60af06121f29080853f7932326438b33d183240a9cffbe57e00dc3744700220753948da26b8973ee21c30e84227a6";
-      version = "0.2.6";
+      sha512 = "b767973db8b5b36aeb5c55f082e020a5c3f657bee1eede018e68ccaa2c535005759bc8a162fce7bb63eee1c14c6f29ec1c6080978a08817189864cbd40f154fa";
+      version = "2.3.1";
    };
  }

@ -64,8 +64,8 @@
      inherit repos;
      artifactId = "clojupyter";
      groupId = "clojupyter";
-      sha512 = "3ff95101e9031f0678c1ebd67b0f0d1b50495aa81a69c8f08deb9c2931818bbdd6bcd6f1ef25c407c6714a975c1ef853b4287725641a3fed7b93e1c27ba78709";
-      version = "0.3.2";
+      sha512 = "d030ae69cdadecbcec9a052e4ad91ba4f47cdc4bb3fb780317f337af62d8c34d12ef05d132d6c9a4ce790008c979919c22162432c1b9bcf4e0a470020d585dbe";
+      version = "0.3.3";
    };
  }

@ -86,8 +86,8 @@
      inherit repos;
      artifactId = "tools.analyzer";
      groupId = "org.clojure";
-      sha512 = "9cce94540a6fd0ae0bad915efe9a30c8fb282fbd1e225c4a5a583273e84789b3b5fc605b06f11e19d7dcc212d08bc6138477accfcde5d48839bec97daa874ce6";
-      version = "0.6.9";
+      sha512 = "e02d7baec926e0e0a7d9c71f09fee627fbde59ae7f3cbd4abcdf0533c8a87fba8c7cf4503df34bf33777063f4b6353a022552fd003fdbea9fad5752d53609bb8";
+      version = "1.0.0";
    };
  }

@ -196,8 +196,8 @@
      inherit repos;
      artifactId = "encore";
      groupId = "com.taoensso";
-      sha512 = "c4928c76378415ac504071ae4812e82efdce3b432c961b0bb9d906a468bb9c51a778f0109ac86641419b1a852ef13ca3d5c54ddde457e5aaec36a2f54f9caf8f";
-      version = "2.91.0";
+      sha512 = "bb9510a88bca86f9cfc4a2e5c8a85782bc71d961a0a639735edafb61df130422488ee40d1db4cb6ad961e40acdb07259052937391c32f1e54c71f09dd63d33e5";
+      version = "3.12.1";
    };
  }

@ -229,8 +229,8 @@
      inherit repos;
      artifactId = "tools.analyzer.jvm";
      groupId = "org.clojure";
-      sha512 = "ec1cb7638e38dfdca49c88e0b71ecf9c6ea858dccd46a2044bb37d01912ab4709b838cd2f0d1c2f201927ba4eea8f68d4d82e9fdd6da2f9943f7239bf86549f2";
-      version = "0.7.2";
+      sha512 = "ce9c7b51fa61c12c539f3c5c1c7fa1caf123497553d4e566c13895312faad2d2657fe6e54fe88110a6c87accb10c4c3b6ccfa87a035a7321da6c859da1d192d0";
+      version = "1.1.0";
    };
  }

@ -273,8 +273,8 @@
      inherit repos;
      artifactId = "jackson-dataformat-cbor";
      groupId = "com.fasterxml.jackson.dataformat";
-      sha512 = "dd49d4a154b8284620704a364ec54fb94638d68424b4f3eaa1d61cccc70959d399e539162f6ac8dcdd6efb0d3817a2edd2bba12fd2630cabd4722cd2ce9b782a";
-      version = "2.9.6";
+      sha512 = "575a00fec1760571403aaadbe0aa6c74f8bb01f40feae00741df6604e7c2bf199ac739a789bbd5d83af75ec6d9fcc55f5a1515b05aef33e0d3cc3046acad9e89";
+      version = "2.10.2";
    };
  }

@ -339,8 +339,8 @@
      inherit repos;
      artifactId = "pretty";
      groupId = "io.aviso";
-      sha512 = "2c4df86bb572cf028992a1a321178df65d0e681cbbc699db3a149fd0bcf8ad803643bf4e621a9b7793067f128934819371796468288cf5822924b2218711ccac";
-      version = "0.1.33";
+      sha512 = "512454e5296c54e2d2f3ddb3122e99edae3286b7e7f9a63dd453c96225b6aa5d0fb0972d58d7dac434b297f47a1f27d1b2021c126064af020f0c3040097226d6";
+      version = "0.1.37";
    };
  }

@ -427,8 +427,8 @@
      inherit repos;
      artifactId = "jackson-core";
      groupId = "com.fasterxml.jackson.core";
-      sha512 = "a1b9b68b67d442a47e36b46b37b6b0ad7a10c547a1cf7adb4705baec77356e1080049d310b3b530f66bbd3c0ed05cfe43c041d6ef4ffbbc6731149624df4e699";
-      version = "2.9.6";
+      sha512 = "5055943790cea2c3abbacbe91e63634e6d2e977cd59b08ce102c0ee7d859995eb5d150d530da3848235b2b1b751a8df55cff2c33d43da695659248187ddf1bff";
+      version = "2.10.2";
    };
  }

@ -443,6 +443,17 @@
    };
  }

+  {
+    name = "org.ow2.asm/asm";
+    path = pkgs.fetchMavenArtifact {
+      inherit repos;
+      artifactId = "asm";
+      groupId = "org.ow2.asm";
+      sha512 = "40614e658138f2eb95bc26999545f996794c622c4d68efb9e10093743504c4b58bf22590767bc6bd93b77cdfb202c507144ba867bbc8b54d74fe7621cbc55e3a";
+      version = "5.2";
+    };
+  }
+
  {
    name = "org.slf4j/jul-to-slf4j";
    path = pkgs.fetchMavenArtifact {
@ -537,8 +548,8 @@
      inherit repos;
      artifactId = "truss";
      groupId = "com.taoensso";
-      sha512 = "601bdac92eb0432de228717d3feb7f8a24f484eaf8b93a98c95ee42a0d57bd3dd7d2929c21dadb3a9b43d5e449821d30bbcf4e5ae198dcb8c62ec9597ff57524";
-      version = "1.5.0";
+      sha512 = "79a515306228e8e8f1c1cf5bb65ac8c979954f3a6e8461c059a7b9402967163a1eb7a70de3ad41e8195d9dbfac2d17af8cc03e09bf72f8e9f6704b842656c0b9";
+      version = "1.6.0";
    };
  }

@ -559,8 +570,8 @@
      inherit repos;
      artifactId = "hiccup";
      groupId = "hiccup";
-      sha512 = "034f15be46c35029f41869c912f82cb2929fbbb0524ea64bd98dcdb9cf09875b28c75e926fa5fff53942b0f9e543e85a73a2d03c3f2112eecae30fcef8b148f4";
-      version = "1.0.5";
+      sha512 = "419dd67281135feb31f74528907b785679066e22cf397f14a6d9439cb9c463d0db66436c214b2b1b5944be6b9d28e3fc7d9e4042de52f9633bf0825548c0f524";
+      version = "2.0.0-alpha2";
    };
  }

@ -658,8 +669,8 @@
      inherit repos;
      artifactId = "timbre";
      groupId = "com.taoensso";
-      sha512 = "cbb47d1ba312ca5f8ffdb2953401e0b37b308529c49622d4eb57e1d128ae56768051a2e01264c3a3fe8ef1c8a8785fcc29bc9336ccc70e629f2ab432280e6d7f";
-      version = "4.10.0";
+      sha512 = "2570f1d59d98034d8425598ab676f4c1e17f9da9926def2e142296377ddccf0fe3a894ba023114d614ca728c77c11d50927a709bfa896e9c5cce0854be31e32d";
+      version = "5.1.2";
    };
  }

@ -713,8 +724,8 @@
      inherit repos;
      artifactId = "cider-nrepl";
      groupId = "cider";
-      sha512 = "2c665aeb6c31eb2d11f257966f19e6127d602546a8fea2ab19eed3352469f93bd870c210250cc3f8b89d68d61f6076a614b87d1792a1ab3a3fd8f3b974842f75";
-      version = "0.21.1";
+      sha512 = "e201944e32ce9b8fa328327c84f31d11cf5507a97b4fd3189a0304f4ebfd3bd557a1886335f295831941ac30d2b2394ad79a2897cb9bce506c0cbd8e04bbc40f";
+      version = "0.26.0";
    };
  }

@ -757,8 +768,8 @@
      inherit repos;
      artifactId = "cheshire";
      groupId = "cheshire";
-      sha512 = "46d638d3e261e2debcaae9bdf912abaad4e77218ee0ba25ad0ff71dc040f579e630e593d55cd84dc9815bf84df33650295243cbeb8ff868976854544dd77de2c";
-      version = "5.8.1";
+      sha512 = "5b2a339f8d90951a80105729a080b841e0de671f576bfa164a78bccc08691d548cff6a7124224444f7b3a267c9aca69c18e347657f1d66e407167c9b5b8b52cb";
+      version = "5.10.0";
    };
  }

@ -768,8 +779,8 @@
      inherit repos;
      artifactId = "tigris";
      groupId = "tigris";
-      sha512 = "5393fe3f656521a6760d289d9549ffb9e9c1a8a72b69878205d53763802afa8778f1cb8bed6899e0b9721de231a79b8b1254cc601c84f5374467f1cc4780a987";
-      version = "0.1.1";
+      sha512 = "fdff4ef5e7175a973aaef98de4f37dee8e125fc711c495382e280aaf3e11341fe8925d52567ca60f3f1795511ade11bc23461c88959632dfae3cf50374d02bf6";
+      version = "0.1.2";
    };
  }

@ -790,8 +801,8 @@
      inherit repos;
      artifactId = "tools.reader";
      groupId = "org.clojure";
-      sha512 = "3d6d184a30cead093a158a69feaff8685a24a8089b0245f2b262d26ff46c7fd0be6940bdaccb0b5b06f87cba7ac59e677f74afff1cfbd67dc2b32e2a1ff19541";
-      version = "1.2.2";
+      sha512 = "03677c7eb85d294f878f13066bbd841e788ec1267285690e65c2eb342b02aecd028679509b7f1d192cf5631b0839a92abfe36e93237bf5e2544c14e6cebe7452";
+      version = "1.3.3";
    };
  }

@ -834,8 +845,8 @@
      inherit repos;
      artifactId = "nrepl";
      groupId = "nrepl";
-      sha512 = "f9ffc647820e772428781cb4ccd4f84a7d903afffe64418af55c95bd7bc21e1722591ac425d1be366d8f4f4596debf0c1b006957848473d3c515f4187cd5cb86";
-      version = "0.6.0";
+      sha512 = "663906ff1c8768c4a73fa9f32619da4c244cc86c93d86e8439eb8de81c79486be5a04140c1df6199ba475b3a3e7fd36304faef8b330672dd644945820cc6eb67";
+      version = "0.8.3";
    };
  }

@ -955,8 +966,8 @@
      inherit repos;
      artifactId = "core.memoize";
      groupId = "org.clojure";
-      sha512 = "e1c5104ac20a22e670ccb80c085ce225c168802829668e91c316cbea4f8982431a9e2ac7bfa5e8477ef515088e9443763f44496633c8ee1e416f7eb8ddfefb88";
-      version = "0.5.9";
+      sha512 = "37308fcbbe64d0a2802917ef5a589075f81086d63e08c71a9a1b648b73dd362e5bdc8f756084fde1f4b1964ba82a6dc06b2119460281b7949a271d82e6a47a7e";
+      version = "1.0.236";
    };
  }

@ -999,8 +1010,8 @@
      inherit repos;
      artifactId = "data.priority-map";
      groupId = "org.clojure";
-      sha512 = "450e18bddb3962aee3a110398dc3e9c25280202eb15df2f25de6c26e99982e8de5cf535fe609948d190e312a00fad3ffc0b3a78b514ef66369577a4185df0a77";
-      version = "0.0.7";
+      sha512 = "fb2d703468fb6d5f28c38f25e8e7acdaf02d2fa1ac23c14a9ff065873e88c9b74e155e73e5069436d674d7ef8547f01bc9777b7ae3b9dcde67cbd327d4a20c06";
+      version = "1.0.0";
    };
  }

@ -1032,8 +1043,8 @@
      inherit repos;
      artifactId = "core.cache";
      groupId = "org.clojure";
-      sha512 = "464c8503229dfcb5aa3c09cd74fa273ae82aff7a8f8daadb5c59a4224c7d675da4552ee9cb28d44627d5413c6f580e64df4dbfdde20d237599a46bb8f9a4bf6e";
-      version = "0.6.5";
+      sha512 = "6e4e126f23b20120c50a4dbefbe1b3b9bd98f0a7b8fa83affa267ff7f0de09542d2727243859a1ea346bda5b782d4ae0110f6c2b169c298261707a1fdadaedb0";
+      version = "1.0.207";
    };
  }

@ -1048,25 +1059,14 @@
    };
  }

-  {
-    name = "org.ow2.asm/asm-all";
-    path = pkgs.fetchMavenArtifact {
-      inherit repos;
-      artifactId = "asm-all";
-      groupId = "org.ow2.asm";
-      sha512 = "462f31f8889c5ff07f1ce7bb1d5e9e73b7ec3c31741dc2b3da8d0b1a50df171e8e72289ff13d725e80ecbd9efa7e873b09870f5e8efb547f51f680d2339f290d";
-      version = "4.2";
-    };
-  }
-
  {
    name = "org.clojure/core.async";
    path = pkgs.fetchMavenArtifact {
      inherit repos;
      artifactId = "core.async";
      groupId = "org.clojure";
-      sha512 = "f80d61b51b5278c6c8b2b81ed45fa24ebaa42ade10e495fe34c5e1d827713eab33701a86dcc226a76e334365b0bd69d0c9da1e8b337f8752cd490145d3fc98b8";
-      version = "0.4.500";
+      sha512 = "7c8640769a68256f5cf131ed2436713c3c63bba2c4167f3593a1671ef65931d67b9b43eccfa6e5a20467ca7c6f5efd9cbf58d6c14e035757714f71220a754d0b";
+      version = "1.3.618";
    };
  }

@ -1076,8 +1076,8 @@
      inherit repos;
      artifactId = "jackson-dataformat-smile";
      groupId = "com.fasterxml.jackson.dataformat";
-      sha512 = "bc0b293687b9aa6641a6983d4c09d901294010fd0710c8163b0b283f06d044cfd2d7cebdb2590b170fefdde4751406b704955f59312af27d0e1f12f0d6c81ed8";
-      version = "2.9.6";
+      sha512 = "8998346f7039df868f3387d219efa0c04fc022a948d098296f3d7ac3f7a9a82bde6ec4a8f83b11994ad50318b5aca37781faacb1f20a65ba2ecc6d6d6eb9468e";
+      version = "2.10.2";
    };
  }

--- a/pkgs/applications/graphics/image_optim/default.nix
+++ b/pkgs/applications/graphics/image_optim/default.nix
@ -39,7 +39,7 @@ bundlerApp {

  postBuild = ''
    wrapProgram $out/bin/image_optim \
-      --prefix PATH : ${makeBinPath optionalDepsPath}
+      --prefix PATH : ${lib.escapeShellArg (makeBinPath optionalDepsPath)}
  '';

  passthru.updateScript = bundlerUpdateScript "image_optim";
--- a/pkgs/applications/graphics/megapixels/default.nix
+++ b/pkgs/applications/graphics/megapixels/default.nix
@ -56,7 +56,7 @@ stdenv.mkDerivation rec {

  preFixup = optionalString (tiffSupport || jpgSupport) ''
    gappsWrapperArgs+=(
-      --prefix PATH : ${runtimePath}
+      --prefix PATH : ${lib.escapeShellArg runtimePath}
    )
  '';

--- a/pkgs/applications/kde/elisa.nix
+++ b/pkgs/applications/kde/elisa.nix
@ -21,6 +21,8 @@
 mkDerivation rec {
  pname = "elisa";

+  outputs = [ "out" "dev" ];
+
  buildInputs = [ libvlc ];

  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
--- a/pkgs/applications/misc/ssocr/default.nix
+++ b/pkgs/applications/misc/ssocr/default.nix
@ -1,17 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, imlib2, libX11 }:
+{ lib, stdenv, fetchFromGitHub, imlib2, libX11, pkg-config }:

-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "ssocr";
-  version = "unstable-2018-08-11";
+  version = "2.22.1";

  src = fetchFromGitHub {
    owner = "auerswal";
    repo = "ssocr";
-    rev = "5e47e26b125a1a13bc79de93a5e87dd0b51354ca";
-    sha256 = "0yzprwflky9a7zxa3zic7gvdwqg0zy49zvrqkdxng2k1ng78k3s7";
+    rev = "v${version}";
+    sha256 = "sha256-j1l1o1wtVQo+G9HfXZ1sJQ8amsUQhuYxFguWFQoRe/s=";
  };

-  nativeBuildInputs = [ imlib2 libX11 ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ imlib2 libX11 ];

  installFlags = [ "PREFIX=$(out)" ];

--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -219,6 +219,8 @@ let
          ln -sfT "$target" "$out/$l"
        done

+        cd "$out"
+
        # create the wrapper

        executablePrefix="$out/bin"
--- a/pkgs/applications/networking/cluster/nomad/1.2.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.2.nix
@ -6,7 +6,7 @@

 callPackage ./generic.nix {
  inherit buildGoModule nvidia_x11 nvidiaGpuSupport;
-  version = "1.2.6";
-  sha256 = "1ik8v1jznky9y4m85bzxgyba256zqmm5fs6d5xsvp5rzcylcdwgd";
-  vendorSha256 = "1mbvpssf7haaxzx6ka9qzixm49jck8i89w8ymkaddgmxhlbxjv05";
+  version = "1.2.7";
+  sha256 = "13whyjl0shr00mn46f361ybz90zwkiyab9ygcs0hrs75lgvkmfm9";
+  vendorSha256 = "177gv0h8bhxd5j78sf4is86zzq8xl9schg1hbyh0hmwg4whhqm8a";
 }
--- a/pkgs/applications/networking/cluster/nomad/1.3.nix
+++ b/pkgs/applications/networking/cluster/nomad/1.3.nix
@ -0,0 +1,12 @@
+{ callPackage
+, buildGoModule
+, nvidia_x11
+, nvidiaGpuSupport
+}:
+
+callPackage ./generic.nix {
+  inherit buildGoModule nvidia_x11 nvidiaGpuSupport;
+  version = "1.3.0";
+  sha256 = "098sg7jl257r6zfi2fsp9dwm0rrzi8m2k85bb097q14n3p4s3pna";
+  vendorSha256 = "037bdgnyv8gkm2hz7h727ss46adnkywg28j6i1canmdacpi3qv5c";
+}
--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@ -75,7 +75,7 @@ stdenv.mkDerivation rec {

  preFixup = ''
    gappsWrapperArgs+=(
-      --prefix PURPLE_PLUGIN_PATH : ${pidgin.makePluginPath plugins}
+      --prefix PURPLE_PLUGIN_PATH : ${lib.escapeShellArg (pidgin.makePluginPath plugins)}
      ${lib.concatMapStringsSep " " (p: p.wrapArgs or "") plugins}
    )
  '';
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@ -1,6 +1,7 @@
 { lib
 , mkDerivation
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , extra-cmake-modules
 , inotify-tools
@ -41,6 +42,11 @@ mkDerivation rec {
    # Explicitly move dbus configuration files to the store path rather than `/etc/dbus-1/services`.
    ./0001-Explicitly-copy-dbus-files-into-the-store-dir.patch
    ./0001-When-creating-the-autostart-entry-do-not-use-an-abso.patch
+    # don't write cacheDir into home directory
+    (fetchpatch {
+      url = "https://github.com/nextcloud/desktop/commit/3a8aa8a2a88bc9b68098b7866e2a07aa23d3a33c.patch";
+      sha256 = "sha256-OviPANvXap3mg4haxRir/CK1aq8maWZDM/IVsN+OHgk=";
+    })
  ];

  postPatch = ''
--- a/pkgs/applications/networking/p2p/tremc/default.nix
+++ b/pkgs/applications/networking/p2p/tremc/default.nix
@ -44,7 +44,7 @@ python3Packages.buildPythonApplication rec {
  dontBuild = true;
  doCheck = false;

-  makeWrapperArgs = ["--prefix PATH : ${wrapperPath}"];
+  makeWrapperArgs = ["--prefix PATH : ${lib.escapeShellArg wrapperPath}"];

  installPhase = ''
    make DESTDIR=$out install
--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
      --add-flags "-cp $out/share/java/jameica.jar:$out/share/jameica-${version}/* ${
        lib.optionalString stdenv.isDarwin ''-Xdock:name="Jameica" -XstartOnFirstThread''
      } de.willuhn.jameica.Main" \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath buildInputs} \
+      --prefix LD_LIBRARY_PATH : ${lib.escapeShellArg (lib.makeLibraryPath buildInputs)} \
      --chdir "$out/share/java/"
  '';

--- a/pkgs/applications/radio/soapysdr/default.nix
+++ b/pkgs/applications/radio/soapysdr/default.nix
@ -42,7 +42,7 @@ in stdenv.mkDerivation {
    done
    # Needed for at least the remote plugin server
    for file in $out/bin/*; do
-        wrapProgram "$file" --prefix SOAPY_SDR_PLUGIN_PATH : ${extraPackagesSearchPath}
+        wrapProgram "$file" --prefix SOAPY_SDR_PLUGIN_PATH : ${lib.escapeShellArg extraPackagesSearchPath}
    done
  '';

--- a/pkgs/applications/science/electronics/qucs-s/default.nix
+++ b/pkgs/applications/science/electronics/qucs-s/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {

  preConfigure = ''
    # Make custom kernels avaible from qucs-s
-    gappsWrapperArgs+=(--prefix PATH ":" ${lib.makeBinPath kernels})
+    gappsWrapperArgs+=(--prefix PATH ":" ${lib.escapeShellArg (lib.makeBinPath kernels)})
  '';

  QTDIR=qt4;
--- a/pkgs/applications/video/vdr/wrapper.nix
+++ b/pkgs/applications/video/vdr/wrapper.nix
@ -17,7 +17,7 @@ in symlinkJoin {
  postBuild = ''
    wrapProgram $out/bin/vdr \
      --add-flags "-L $out/lib/vdr --localedir=$out/share/locale" \
-      --prefix XINE_PLUGIN_PATH ":" ${makeXinePluginPath requiredXinePlugins}
+      --prefix XINE_PLUGIN_PATH ":" ${lib.escapeShellArg (makeXinePluginPath requiredXinePlugins)}
  '';

  meta = with vdr.meta; {
--- a/pkgs/applications/virtualization/podman/wrapper.nix
+++ b/pkgs/applications/virtualization/podman/wrapper.nix
@ -76,5 +76,5 @@ in runCommand podman.name {
  ln -s ${podman-unwrapped}/share $out/share
  makeWrapper ${podman-unwrapped}/bin/podman $out/bin/podman \
    --set CONTAINERS_HELPER_BINARY_DIR ${helpersBin}/bin \
-    --prefix PATH : ${binPath}
+    --prefix PATH : ${lib.escapeShellArg binPath}
 ''
--- a/pkgs/applications/window-managers/i3/blocks-gaps.nix
+++ b/pkgs/applications/window-managers/i3/blocks-gaps.nix
@ -28,17 +28,21 @@ stdenv.mkDerivation rec {
  buildInputs = optional (contains_any scripts perlscripts) perl;
  nativeBuildInputs = [ makeWrapper ];

-  postFixup = ''
+  postFixup = optionalString (elem "bandwidth" scripts) ''
    wrapProgram $out/libexec/i3blocks/bandwidth \
-      --prefix PATH : ${makeBinPath (optional (elem "bandwidth" scripts) iproute2)}
+      --prefix PATH : ${makeBinPath [ iproute2 ]}
+  '' + optionalString (elem "battery" scripts) ''
    wrapProgram $out/libexec/i3blocks/battery \
-      --prefix PATH : ${makeBinPath (optional (elem "battery" scripts) acpi)}
+      --prefix PATH : ${makeBinPath [ acpi ]}
+  '' + optionalString (elem "cpu_usage" scripts) ''
    wrapProgram $out/libexec/i3blocks/cpu_usage \
-      --prefix PATH : ${makeBinPath (optional (elem "cpu_usage" scripts) sysstat)}
+      --prefix PATH : ${makeBinPath [ sysstat ]}
+  '' + optionalString (elem "iface" scripts) ''
    wrapProgram $out/libexec/i3blocks/iface \
-      --prefix PATH : ${makeBinPath (optional (elem "iface" scripts) iproute2)}
+      --prefix PATH : ${makeBinPath [ iproute2 ]}
+  '' + optionalString (elem "volume" scripts) ''
    wrapProgram $out/libexec/i3blocks/volume \
-      --prefix PATH : ${makeBinPath (optional (elem "volume" scripts) alsa-utils)}
+      --prefix PATH : ${makeBinPath [ alsa-utils ]}
  '';

  meta = with lib; {
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@ -59,8 +59,8 @@ assert buildType == "release" || buildType == "debug";
 let

  cargoDeps =
-    if cargoVendorDir == null
-    then if cargoLock != null then importCargoLock cargoLock
+    if cargoVendorDir != null then null
+    else if cargoLock != null then importCargoLock cargoLock
    else fetchCargoTarball ({
      inherit src srcs sourceRoot unpackPhase cargoUpdateHook;
      name = cargoDepsName;
@ -69,8 +69,7 @@ let
      hash = args.cargoHash;
    } // lib.optionalAttrs (args ? cargoSha256) {
      sha256 = args.cargoSha256;
-    } // depsExtraArgs)
-    else null;
+    } // depsExtraArgs);

  # If we have a cargoSha256 fixed-output derivation, validate it at build time
  # against the src fixed-output derivation to check consistency.
--- a/pkgs/development/compilers/fpc/default.nix
+++ b/pkgs/development/compilers/fpc/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, gawk }:
+{ lib, stdenv, fetchurl, gawk, fetchpatch }:

 let startFPC = import ./binary.nix { inherit stdenv fetchurl; }; in

@ -17,7 +17,14 @@ stdenv.mkDerivation rec {
  # Patch paths for linux systems. Other platforms will need their own patches.
  patches = [
    ./mark-paths.patch # mark paths for later substitution in postPatch
-  ];
+  ] ++ lib.optional stdenv.isAarch64 (fetchpatch {
+    # backport upstream patch for aarch64 glibc 2.34
+    url = "https://gitlab.com/freepascal.org/fpc/source/-/commit/a20a7e3497bccf3415bf47ccc55f133eb9d6d6a0.patch";
+    hash = "sha256-xKTBwuOxOwX9KCazQbBNLhMXCqkuJgIFvlXewHY63GM=";
+    stripLen = 1;
+    extraPrefix = "fpcsrc/";
+  });
+
  postPatch = ''
    # substitute the markers set by the mark-paths patch
    substituteInPlace fpcsrc/compiler/systems/t_linux.pas --subst-var-by dynlinker-prefix "${glibc}"
--- a/pkgs/development/libraries/aravis/default.nix
+++ b/pkgs/development/libraries/aravis/default.nix
@ -1,74 +1,64 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, gtk-doc, intltool
-, audit, glib, libusb1, libxml2
-, wrapGAppsHook
-, gstreamer
-, gst-plugins-base
-, gst-plugins-good
-, gst-plugins-bad
-, libnotify
-, gnome
-, gtk3
-, enableUsb ? true
-, enablePacketSocket ? true
-, enableViewer ? true
+{ lib
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, pkg-config
+, gi-docgen
+, glib
+, libxml2
+, gobject-introspection
+
 , enableGstPlugin ? true
-, enableCppTest ? false
+, enableViewer ? true
+, gst_all_1
+, gtk3
+, wrapGAppsHook
+
+, enableUsb ? true
+, libusb1
+
+, enablePacketSocket ? true
 , enableFastHeartbeat ? false
-, enableAsan ? false
 }:

-let
-  gstreamerAtLeastVersion1 =
-    lib.all
-      (pkg: pkg != null && lib.versionAtLeast (lib.getVersion pkg) "1.0")
-      [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad ];
-in
+assert enableGstPlugin -> gst_all_1 != null;
 assert enableViewer -> enableGstPlugin;
-  assert enableViewer -> gstreamerAtLeastVersion1;
+assert enableViewer -> gtk3 != null;
+assert enableViewer -> wrapGAppsHook != null;

 stdenv.mkDerivation rec {
-
  pname = "aravis";
-    version = "0.6.4";
+  version = "0.8.21";

  src = fetchFromGitHub {
    owner = "AravisProject";
    repo = pname;
-      rev= "ARAVIS_${builtins.replaceStrings ["."] ["_"] version}";
-      sha256 = "18fnliks661kzc3g8v08hcaj18hjid8b180d6s9gwn0zgv4g374w";
+    rev = version;
+    sha256 = "sha256-z4fuo8tVyHf2Bw73ZfAEpAYmzbr9UIzEWPC5f95wnD8=";
  };

  outputs = [ "bin" "dev" "out" "lib" ];

  nativeBuildInputs = [
-      autoreconfHook
+    meson
+    ninja
    pkg-config
-      intltool
-      gtk-doc
+    gi-docgen
  ] ++ lib.optional enableViewer wrapGAppsHook;

  buildInputs =
-      [ glib libxml2 ]
+    [ glib libxml2 gobject-introspection ]
    ++ lib.optional enableUsb libusb1
-      ++ lib.optional enablePacketSocket audit
-      ++ lib.optionals (enableViewer || enableGstPlugin) [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad ]
-      ++ lib.optionals (enableViewer) [ libnotify gtk3 gnome.adwaita-icon-theme ];
+    ++ lib.optionals (enableViewer || enableGstPlugin) (with gst_all_1; [ gstreamer gst-plugins-base (gst-plugins-good.override { gtkSupport = true; }) gst-plugins-bad ])
+    ++ lib.optionals (enableViewer) [ gtk3 ];

-    preAutoreconf = "./autogen.sh";
-
-    configureFlags =
-      lib.optional enableUsb "--enable-usb"
-        ++ lib.optional enablePacketSocket "--enable-packet-socket"
-        ++ lib.optional enableViewer "--enable-viewer"
-        ++ lib.optional enableGstPlugin
-        (if gstreamerAtLeastVersion1 then "--enable-gst-plugin" else "--enable-gst-0.10-plugin")
-        ++ lib.optional enableCppTest "--enable-cpp-test"
-        ++ lib.optional enableFastHeartbeat "--enable-fast-heartbeat"
-        ++ lib.optional enableAsan "--enable-asan";
-
-    postPatch = ''
-        ln -s ${gtk-doc}/share/gtk-doc/data/gtk-doc.make .
-      '';
+  mesonFlags = [
+  ] ++ lib.optional enableFastHeartbeat "-Dfast-heartbeat=enabled"
+  ++ lib.optional (!enableGstPlugin) "-Dgst-plugin=disabled"
+  ++ lib.optional (!enableViewer) "-Dviewer=disabled"
+  ++ lib.optional (!enableUsb) "-Dviewer=disabled"
+  ++ lib.optional (!enablePacketSocket) "-Dpacket-socket=disabled";

  doCheck = true;

@ -77,9 +67,10 @@ in
    longDescription = ''
      Implements the gigabit ethernet and USB3 protocols used by industrial cameras.
    '';
-      homepage = "https://aravisproject.github.io/docs/aravis-0.5";
+    # the documentation is the best working homepage that's not the Github repo
+    homepage = "https://aravisproject.github.io/docs/aravis-0.8";
    license = lib.licenses.lgpl2;
-      maintainers = [];
+    maintainers = with lib.maintainers; [ tpw_rules ];
    platforms = lib.platforms.unix;
  };
 }
--- a/pkgs/development/libraries/fltk/common.nix
+++ b/pkgs/development/libraries/fltk/common.nix
@ -37,7 +37,7 @@
 , doxygen
 , graphviz

-, withExamples ? true
+, withExamples ? (stdenv.buildPlatform == stdenv.hostPlatform)
 , withShared ? true
 }:

@ -139,6 +139,7 @@ stdenv.mkDerivation rec {

    # Examples & Tests
    "-DFLTK_BUILD_EXAMPLES=${onOff withExamples}"
+    "-DFLTK_BUILD_TEST=${onOff withExamples}"

    # Docs
    "-DOPTION_BUILD_HTML_DOCUMENTATION=${onOff withDocs}"
--- a/pkgs/development/libraries/hunspell/wrapper.nix
+++ b/pkgs/development/libraries/hunspell/wrapper.nix
@ -7,7 +7,7 @@ stdenv.mkDerivation {
  name = (appendToName "with-dicts" hunspell).name;
  nativeBuildInputs = [ makeWrapper ];
  buildCommand = ''
-    makeWrapper ${hunspell.bin}/bin/hunspell $out/bin/hunspell --prefix DICPATH : ${searchPath}
+    makeWrapper ${hunspell.bin}/bin/hunspell $out/bin/hunspell --prefix DICPATH : ${lib.escapeShellArg searchPath}
  '';
  meta = removeAttrs hunspell.meta ["outputsToInstall"];
 }
--- a/pkgs/development/libraries/nuspell/wrapper.nix
+++ b/pkgs/development/libraries/nuspell/wrapper.nix
@ -7,7 +7,7 @@ stdenv.mkDerivation {
  name = (appendToName "with-dicts" nuspell).name;
  nativeBuildInputs = [ makeWrapper ];
  buildCommand = ''
-    makeWrapper ${nuspell}/bin/nuspell $out/bin/nuspell --prefix DICPATH : ${searchPath}
+    makeWrapper ${nuspell}/bin/nuspell $out/bin/nuspell --prefix DICPATH : ${lib.escapeShellArg searchPath}
  '';
  meta = removeAttrs nuspell.meta ["outputsToInstall"];
 }
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -194,7 +194,6 @@
 , "live-server"
 , "livedown"
 , "lodash"
-, {"lumo-build-deps": "../interpreters/clojurescript/lumo" }
 , "lua-fmt"
 , "madoko"
 , "manta"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/python-modules/aioimaplib/default.nix
+++ b/pkgs/development/python-modules/aioimaplib/default.nix
@ -1,4 +1,6 @@
 { lib
+, pythonOlder
+, pythonAtLeast
 , asynctest
 , buildPythonPackage
 , docutils
@ -15,6 +17,11 @@
 buildPythonPackage rec {
  pname = "aioimaplib";
  version = "0.9.0";
+  format = "setuptools";
+
+  # Check https://github.com/bamthomas/aioimaplib/issues/75
+  # for Python 3.10 support
+  disabled = pythonOlder "3.5" || pythonAtLeast "3.10";

  src = fetchFromGitHub {
    owner = "bamthomas";
--- a/pkgs/development/python-modules/argon2-cffi/default.nix
+++ b/pkgs/development/python-modules/argon2-cffi/default.nix
@ -13,13 +13,12 @@
 }:

 buildPythonPackage rec {
-  pname = "argon2_cffi";
+  pname = "argon2-cffi";
  version = "21.3.0";
  format = "flit";

  src = fetchPypi {
-    pname = "argon2-cffi";
-    inherit version;
+    inherit pname version;
    sha256 = "d384164d944190a7dd7ef22c6aa3ff197da12962bd04b17f64d4e93d934dba5b";
  };

--- a/pkgs/development/python-modules/autobahn/default.nix
+++ b/pkgs/development/python-modules/autobahn/default.nix
@ -1,25 +1,49 @@
 { lib
-, argon2_cffi
 , buildPythonPackage
-, cbor
+, fetchPypi
+, attrs
+, argon2-cffi
+, base58
 , cbor2
 , cffi
+, click
 , cryptography
-, fetchPypi
+, ecdsa
+  # , eth-abi
 , flatbuffers
+, jinja2
+, hkdf
+, hyperlink
+, mnemonic
 , mock
 , msgpack
 , passlib
+  # , py-ecc
+  # , py-eth-sig-utils
+, py-multihash
+, py-ubjson
 , pynacl
+, pygobject3
+, pyopenssl
+, pyqrcode
 , pytest-asyncio
+, python-snappy
 , pytestCheckHook
 , pythonOlder
+  # , pytrie
+, rlp
+, service-identity
+, spake2
 , twisted
-, py-ubjson
 , txaio
 , ujson
+  # , web3
+  # , wsaccel
+  # , xbr
+, yapf
+  # , zlmdb
 , zope_interface
-}:
+}@args:

 buildPythonPackage rec {
  pname = "autobahn";
@ -34,27 +58,18 @@ buildPythonPackage rec {
  };

  propagatedBuildInputs = [
-    argon2_cffi
-    cbor
-    cbor2
-    cffi
    cryptography
-    flatbuffers
-    msgpack
-    passlib
-    py-ubjson
+    hyperlink
    pynacl
-    twisted
    txaio
-    ujson
-    zope_interface
  ];

  checkInputs = [
    mock
    pytest-asyncio
    pytestCheckHook
-  ];
+  ] ++ passthru.extras-require.scram
+  ++ passthru.extras-require.serialization;

  postPatch = ''
    substituteInPlace setup.py \
@ -74,10 +89,23 @@ buildPythonPackage rec {
    "autobahn"
  ];

+  passthru.extras-require = rec {
+    all = accelerate ++ compress ++ encryption ++ nvx ++ serialization ++ scram ++ twisted ++ ui ++ xbr;
+    accelerate = [ /* wsaccel */ ];
+    compress = [ python-snappy ];
+    encryption = [ pynacl pyopenssl pyqrcode /* pytrie */ service-identity ];
+    nvx = [ cffi ];
+    scram = [ argon2-cffi cffi passlib ];
+    serialization = [ cbor2 flatbuffers msgpack ujson py-ubjson ];
+    twisted = [ attrs args.twisted zope_interface ];
+    ui = [ pygobject3 ];
+    xbr = [ base58 cbor2 click ecdsa /* eth-abi */ jinja2 hkdf mnemonic /* py-ecc py-eth-sig-utils */ py-multihash rlp spake2 twisted /* web3 xbr */ yapf /* zlmdb */ ];
+  };
+
  meta = with lib; {
    description = "WebSocket and WAMP in Python for Twisted and asyncio";
    homepage = "https://crossbar.io/autobahn";
    license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ SuperSandro2000 ];
  };
 }
--- a/pkgs/development/python-modules/django/4.nix
+++ b/pkgs/development/python-modules/django/4.nix
@ -17,7 +17,7 @@

 # tests
 , aiosmtpd
-, argon2_cffi
+, argon2-cffi
 , bcrypt
 , docutils
 , geoip2
@ -70,7 +70,7 @@ buildPythonPackage rec {

  checkInputs = [
    aiosmtpd
-    argon2_cffi
+    argon2-cffi
    asgiref
    bcrypt
    docutils
--- a/pkgs/development/python-modules/dlinfo/default.nix
+++ b/pkgs/development/python-modules/dlinfo/default.nix
@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, setuptools-scm
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "dlinfo";
+  version = "1.2.1";
+
+  format = "setuptools";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "5f6f43b47f3aa5fe12bd347cf536dc8fca6068c61a0a260e408bec7f6eb4bd38";
+  };
+
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "dlinfo" ];
+
+  meta = {
+    description = "Python wrapper for libc's dlinfo and dyld_find on Mac";
+    homepage = "https://github.com/cloudflightio/python-dlinfo";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+    broken = stdenv.isDarwin;
+  };
+}
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@ -32,7 +32,7 @@
 , passlib

 # tests
-, argon2_cffi
+, argon2-cffi
 , flask-mongoengine
 , mongoengine
 , mongomock
@ -86,7 +86,7 @@ buildPythonPackage rec {
  };

  checkInputs = [
-    argon2_cffi
+    argon2-cffi
    flask-mongoengine
    mongoengine
    mongomock
--- a/pkgs/development/python-modules/jupyter_server/default.nix
+++ b/pkgs/development/python-modules/jupyter_server/default.nix
@ -6,7 +6,7 @@
 , pythonOlder
 , pytestCheckHook
 , pytest-tornasync
-, argon2_cffi
+, argon2-cffi
 , jinja2
 , tornado
 , pyzmq
@ -44,7 +44,7 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
-    argon2_cffi
+    argon2-cffi
    jinja2
    tornado
    pyzmq
--- a/pkgs/development/python-modules/keyrings-cryptfile/default.nix
+++ b/pkgs/development/python-modules/keyrings-cryptfile/default.nix
@ -2,7 +2,7 @@
 , buildPythonPackage
 , fetchPypi
 , fetchpatch
-, argon2_cffi
+, argon2-cffi
 , keyring
 , pycryptodome
 , pytestCheckHook
@ -32,7 +32,7 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
-    argon2_cffi
+    argon2-cffi
    keyring
    pycryptodome
  ];
--- a/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole-mailbox-server/default.nix
@ -1,4 +1,15 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27, six, attrs, twisted, pyopenssl, service-identity, autobahn, treq, mock, pytest }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, six
+, attrs
+, twisted
+, pyopenssl
+, service-identity
+, autobahn
+, treq
+, mock
+}:

 buildPythonPackage rec {
  version = "0.4.1";
@ -9,18 +20,27 @@ buildPythonPackage rec {
    sha256 = "1af10592909caaf519c00e706eac842c5e77f8d4356215fe9c61c7b2258a88fb";
  };

-  propagatedBuildInputs = [ six attrs twisted pyopenssl service-identity autobahn ];
+  propagatedBuildInputs = [
+    attrs
+    six
+    twisted
+    autobahn
+  ] ++ autobahn.extras-require.twisted
+  ++ twisted.extras-require.tls;

-  # zope.interface import issue
-  doCheck = !isPy27;
-  checkInputs = [ treq mock pytest ];
+  checkInputs = [
+    treq
+    mock
+    twisted
+  ];
  checkPhase = ''
-    pytest
+    trial -j$NIX_BUILD_CORES wormhole_mailbox_server
  '';

  meta = with lib; {
    description = "Securely transfer data between computers";
    homepage = "https://github.com/warner/magic-wormhole-mailbox-server";
    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
  };
 }
--- a/pkgs/development/python-modules/magic-wormhole-transit-relay/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole-transit-relay/default.nix
@ -1,4 +1,10 @@
-{ lib, buildPythonPackage, fetchPypi, twisted, mock }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, autobahn
+, mock
+, twisted
+}:

 buildPythonPackage rec {
  pname = "magic-wormhole-transit-relay";
@ -9,17 +15,18 @@ buildPythonPackage rec {
    sha256 = "0ppsx2s1ysikns1h053x67z2zmficbn3y3kf52bzzslhd2s02j6b";
  };

-  propagatedBuildInputs = [ twisted ];
+  propagatedBuildInputs = [ autobahn twisted ];

-  checkInputs = [ mock ];
+  checkInputs = [ mock twisted ];

  checkPhase = ''
-    ${twisted}/bin/trial wormhole_transit_relay
+    trial -j$NIX_BUILD_CORES wormhole_transit_relay
  '';

  meta = with lib; {
    description = "Transit Relay server for Magic-Wormhole";
-    homepage = "https://github.com/warner/magic-wormhole-transit-relay";
+    homepage = "https://github.com/magic-wormhole/magic-wormhole-transit-relay";
    license = licenses.mit;
+    maintainers = with maintainers; [ SuperSandro2000 ];
  };
 }
--- a/pkgs/development/python-modules/magic-wormhole/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole/default.nix
@ -1,7 +1,7 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , buildPythonPackage
 , fetchPypi
-, isPy27
 , spake2
 , pynacl
 , six
@ -15,7 +15,6 @@
 , humanize
 , txtorcon
 , nettools
-, glibcLocales
 , mock
 , magic-wormhole-transit-relay
 , magic-wormhole-mailbox-server
@ -30,9 +29,28 @@ buildPythonPackage rec {
    sha256 = "0q41j99718y7m95zg1vaybnsp31lp6lhyqkbv4yqz5ys6jixh3qv";
  };

-  buildInputs = [ glibcLocales ];
-  propagatedBuildInputs = [ spake2 pynacl six attrs twisted autobahn automat hkdf tqdm click humanize txtorcon ];
-  checkInputs = [ mock magic-wormhole-transit-relay magic-wormhole-mailbox-server ];
+  propagatedBuildInputs = [
+    spake2
+    pynacl
+    six
+    attrs
+    twisted
+    autobahn
+    automat
+    hkdf
+    tqdm
+    click
+    humanize
+    txtorcon
+  ] ++ autobahn.extras-require.twisted
+  ++ twisted.extras-require.tls;
+
+  checkInputs = [
+    mock
+    magic-wormhole-transit-relay
+    magic-wormhole-mailbox-server
+    twisted
+  ];

  postPatch = lib.optionalString stdenv.isLinux ''
    sed -i -e "s|'ifconfig'|'${nettools}/bin/ifconfig'|" src/wormhole/ipaddrs.py
@ -42,9 +60,7 @@ buildPythonPackage rec {
    install -Dm644 docs/wormhole.1 $out/share/man/man1/wormhole.1
  '';

-  # zope.interface issue
-  doCheck = !isPy27;
-  preCheck = ''
+  checkPhase = ''
    export PATH=$out/bin:$PATH
    export LANG="en_US.UTF-8"
    export LC_ALL="en_US.UTF-8"
@ -52,16 +68,15 @@ buildPythonPackage rec {
      --replace 'getProcessOutputAndValue("locale", ["-a"])' 'getProcessOutputAndValue("locale", ["-a"], env=os.environ)' \
      --replace 'if (os.path.dirname(os.path.abspath(wormhole))' 'if not os.path.abspath(wormhole).startswith("/nix/store") and (os.path.dirname(os.path.abspath(wormhole))' \
      --replace 'locale_env = dict(LC_ALL=locale, LANG=locale)' 'locale_env = dict(LC_ALL=locale, LANG=locale, LOCALE_ARCHIVE=os.getenv("LOCALE_ARCHIVE"))'
+
+    trial -j$NIX_BUILD_CORES wormhole
  '';

  meta = with lib; {
    description = "Securely transfer data between computers";
-    homepage = "https://github.com/warner/magic-wormhole";
+    homepage = "https://github.com/magic-wormhole/magic-wormhole";
    license = licenses.mit;
-    # Currently broken on Python 2.7. See
-    # https://github.com/NixOS/nixpkgs/issues/71826
-    broken = isPy27;
-    maintainers = with maintainers; [ asymmetric ];
+    maintainers = with maintainers; [ asymmetric SuperSandro2000 ];
    mainProgram = "wormhole";
  };
 }
--- a/pkgs/development/python-modules/notebook/default.nix
+++ b/pkgs/development/python-modules/notebook/default.nix
@ -2,7 +2,7 @@
 , lib
 , buildPythonPackage
 , fetchPypi
-, argon2_cffi
+, argon2-cffi
 , nose
 , nose_warnings_filters
 , glibcLocales
@ -43,7 +43,7 @@ buildPythonPackage rec {
  propagatedBuildInputs = [
    jinja2 tornado ipython_genutils traitlets jupyter_core send2trash
    jupyter-client nbformat nbconvert ipykernel terminado requests pexpect
-    prometheus-client argon2_cffi
+    prometheus-client argon2-cffi
  ];

  # disable warning_filters
--- a/pkgs/development/python-modules/notify-py/default.nix
+++ b/pkgs/development/python-modules/notify-py/default.nix
@ -9,7 +9,8 @@
 , which
 , jeepney
 , loguru
-, pytestCheckHook
+, pytest
+, dbus
 , coreutils
 }:

@ -41,16 +42,29 @@ buildPythonPackage rec {
    })
  ];

-  propagatedBuildInputs = [ loguru ]
-    ++ lib.optionals stdenv.isLinux [ jeepney ];
+  propagatedBuildInputs = [
+    loguru
+  ] ++ lib.optionals stdenv.isLinux [
+    jeepney
+  ];

-  checkInputs = [ pytestCheckHook ];
+  checkInputs = [
+    pytest
+  ] ++ lib.optionals stdenv.isLinux [
+    dbus
+  ];

-  # Tests search for "afplay" binary which is built in to MacOS and not available in nixpkgs
-  preCheck = lib.optionalString stdenv.isDarwin ''
+  checkPhase = if stdenv.isDarwin then ''
+    # Tests search for "afplay" binary which is built in to macOS and not available in nixpkgs
    mkdir $TMP/bin
    ln -s ${coreutils}/bin/true $TMP/bin/afplay
-    export PATH="$TMP/bin:$PATH"
+    PATH="$TMP/bin:$PATH" pytest
+  '' else if stdenv.isLinux then ''
+    dbus-run-session \
+      --config-file=${dbus.daemon}/share/dbus-1/session.conf \
+      pytest
+  '' else ''
+    pytest
  '';

  pythonImportsCheck = [ "notifypy" ];
--- a/pkgs/development/python-modules/passlib/default.nix
+++ b/pkgs/development/python-modules/passlib/default.nix
@ -1,7 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, argon2_cffi
+, argon2-cffi
 , bcrypt
 , cryptography
 , pytestCheckHook
@ -17,7 +17,7 @@ buildPythonPackage rec {
  };

  passthru.extras-require = {
-    argon2 = [ argon2_cffi ];
+    argon2 = [ argon2-cffi ];
    bcrypt = [ bcrypt ];
    totp = [ cryptography ];
  };
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@ -1,31 +1,35 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, isPy3k
+, pythonOlder
 , setuptools
 , pytest
 }:

 buildPythonPackage rec {
  pname = "pglast";
-  version = "3.9";
+  version = "3.10";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-fwXOfQW+ybhROdgayOAsgaFjf8HHh5jr5xczkBnA40w=";
+    hash = "sha256-rkoCtcBe5LBTTpmd+cj6s80UWXyTpMk74FipyK0t5go=";
  };

-  disabled = !isPy3k;
-
-  # ModuleNotFoundError: No module named 'pkg_resources'
-  propagatedBuildInputs = [ setuptools ];
+  propagatedBuildInputs = [
+    setuptools
+  ];

  postPatch = ''
    substituteInPlace setup.cfg \
      --replace "--cov=pglast --cov-report term-missing" ""
  '';

-  checkInputs = [ pytest ];
+  checkInputs = [
+    pytest
+  ];

  # pytestCheckHook doesn't work
  # ImportError: cannot import name 'parse_sql' from 'pglast'
@ -38,6 +42,6 @@ buildPythonPackage rec {
    description = "PostgreSQL Languages AST and statements prettifier";
    changelog = "https://github.com/lelit/pglast/raw/v${version}/CHANGES.rst";
    license = licenses.gpl3Plus;
-    maintainers = [ maintainers.marsam ];
+    maintainers = with maintainers; [ marsam ];
  };
 }
--- a/pkgs/development/python-modules/phonemizer/backend-paths.patch
+++ b/pkgs/development/python-modules/phonemizer/backend-paths.patch
@ -1,42 +1,18 @@
-diff --git a/phonemizer/backend/espeak.py b/phonemizer/backend/espeak.py
-index b4712bf..5628fd5 100644
--- a/phonemizer/backend/espeak.py
-+++ b/phonemizer/backend/espeak.py
-@@ -82,10 +82,7 @@ class BaseEspeakBackend(BaseBackend):
-         if _ESPEAK_DEFAULT_PATH:
-             return _ESPEAK_DEFAULT_PATH
+diff --git a/phonemizer/backend/espeak/wrapper.py b/phonemizer/backend/espeak/wrapper.py
+index 84a79f5..8abcae1 100644
+--- a/phonemizer/backend/espeak/wrapper.py
+++ b/phonemizer/backend/espeak/wrapper.py
+@@ -143,12 +143,7 @@ class EspeakWrapper:
+                     f'is not a readable file')
+             return library.resolve()
 
-        espeak = distutils.spawn.find_executable('espeak-ng')
-        if not espeak:  # pragma: nocover
-            espeak = distutils.spawn.find_executable('espeak')
-        return espeak
-+        return "@espeak@"
+-        library = (
+-                ctypes.util.find_library('espeak-ng') or
+-                ctypes.util.find_library('espeak'))
+-        if not library:  # pragma: nocover
+-            raise RuntimeError(
+-                'failed to find espeak library')
+        library = '@libespeak@'
+         return library
 
-     @classmethod
-     def is_available(cls):
-diff --git a/phonemizer/backend/festival.py b/phonemizer/backend/festival.py
-index 3037be5..684ffff 100644
--- a/phonemizer/backend/festival.py
-+++ b/phonemizer/backend/festival.py
-@@ -80,7 +80,7 @@ class FestivalBackend(BaseBackend):
-         if _FESTIVAL_DEFAULT_PATH:
-             return _FESTIVAL_DEFAULT_PATH
- 
-        return distutils.spawn.find_executable('festival')
-+        return "@festival@"
- 
-     @classmethod
-     def is_available(cls):
-diff --git a/test/test_punctuation.py b/test/test_punctuation.py
-index 6ed642a..08060df 100644
--- a/test/test_punctuation.py
-+++ b/test/test_punctuation.py
-@@ -28,7 +28,7 @@ ESPEAK_143 = (EspeakBackend.version(as_tuple=True) >= (1, 49, 3))
- ESPEAK_150 = (EspeakBackend.version(as_tuple=True) >= (1, 50))
- 
- # True if we are using festival>=2.5
-FESTIVAL_25 = (FestivalBackend.version(as_tuple=True) >= (2, 5))
-+FESTIVAL_25 = False
- 
- 
- @pytest.mark.parametrize(
+     def _fetch_version_and_path(self):
--- a/pkgs/development/python-modules/phonemizer/default.nix
+++ b/pkgs/development/python-modules/phonemizer/default.nix
@ -1,10 +1,13 @@
 { lib
+, stdenv
 , substituteAll
 , buildPythonApplication
 , fetchPypi
 , joblib
 , segments
 , attrs
+, dlinfo
+, typing-extensions
 , espeak-ng
 , pytestCheckHook
 , pytest-cov
@ -26,9 +29,8 @@ buildPythonApplication rec {
  patches = [
    (substituteAll {
      src = ./backend-paths.patch;
-      espeak = "${lib.getBin espeak-ng}/bin/espeak";
-      # override festival path should you try to integrate it
-      festival = "";
+      libespeak = "${lib.getLib espeak-ng}/lib/libespeak-ng${stdenv.hostPlatform.extensions.sharedLibrary}";
+      # FIXME package festival
    })
    ./remove-intertwined-festival-test.patch
  ];
@ -37,6 +39,8 @@ buildPythonApplication rec {
    joblib
    segments
    attrs
+    dlinfo
+    typing-extensions
  ];

  preCheck = ''
@ -45,26 +49,26 @@ buildPythonApplication rec {

  checkInputs = [
    pytestCheckHook
-    pytest-cov
  ];

  # We tried to package festvial, but were unable to get the backend running,
  # so let's disable related tests.
-  pytestFlagsArray = [
-    "--ignore=test/test_festival.py"
+  disabledTestPaths = [
+    "test/test_festival.py"
  ];

  disabledTests = [
    "test_festival"
-    "test_relative"
-    "test_absolute"
+    "test_festival_path"
    "test_readme_festival_syll"
+    "test_unicode"
  ];

  meta = with lib; {
    homepage = "https://github.com/bootphon/phonemizer";
+    changelog = "https://github.com/bootphon/phonemizer/blob/v${version}/CHANGELOG.md";
    description = "Simple text to phones converter for multiple languages";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/phonemizer/drop-readme-festival-test.patch
+++ b/pkgs/development/python-modules/phonemizer/drop-readme-festival-test.patch
@ -1,12 +0,0 @@
-diff --git a/test/test_main.py b/test/test_main.py
-index 71d605a..d137cd7 100644
--- a/test/test_main.py
-+++ b/test/test_main.py
-@@ -63,7 +63,6 @@ def test_readme():
-     _test(u'hello world', u'həloʊ wɜːld ')
-     _test(u'hello world', u'həloʊ wɜːld ', '--verbose')
-     _test(u'hello world', u'həloʊ wɜːld ', '--quiet')
-    _test(u'hello world', u'hhaxlow werld', '-b festival --strip')
-     _test(u'hello world', u'həloʊ wɜːld ', '-l en-us')
-     _test(u'bonjour le monde', u'bɔ̃ʒuʁ lə mɔ̃d ', '-l fr-fr')
-     _test(u'bonjour le monde', u'b ɔ̃ ʒ u ʁ ;eword l ə ;eword m ɔ̃ d ;eword ',
--- a/pkgs/development/python-modules/phonemizer/remove-intertwined-festival-test.patch
+++ b/pkgs/development/python-modules/phonemizer/remove-intertwined-festival-test.patch
@ -1,15 +1,14 @@
 diff --git a/test/test_main.py b/test/test_main.py
-index 71d605a..0ea3c74 100644
+index b8c53e9..8f8c6d2 100644
 --- a/test/test_main.py
 +++ b/test/test_main.py
-@@ -63,17 +63,12 @@ def test_readme():
-     _test(u'hello world', u'həloʊ wɜːld ')
-     _test(u'hello world', u'həloʊ wɜːld ', '--verbose')
-     _test(u'hello world', u'həloʊ wɜːld ', '--quiet')
-    _test(u'hello world', u'hhaxlow werld', '-b festival --strip')
-     _test(u'hello world', u'həloʊ wɜːld ', '-l en-us')
-     _test(u'bonjour le monde', u'bɔ̃ʒuʁ lə mɔ̃d ', '-l fr-fr')
-     _test(u'bonjour le monde', u'b ɔ̃ ʒ u ʁ ;eword l ə ;eword m ɔ̃ d ;eword ',
+@@ -68,16 +68,11 @@ def test_readme():
+     _test('hello world', 'həloʊ wɜːld ', '--verbose')
+     _test('hello world', 'həloʊ wɜːld ', '--quiet')
+     _test('hello world', 'hello world | həloʊ wɜːld ', '--prepend-text')
+-    _test('hello world', 'hhaxlow werld', '-b festival --strip')
+     _test('bonjour le monde', 'bɔ̃ʒuʁ lə mɔ̃d ', '-l fr-fr')
+     _test('bonjour le monde', 'b ɔ̃ ʒ u ʁ ;eword l ə ;eword m ɔ̃ d ;eword ',
           '-l fr-fr -p " " -w ";eword "')
 
 
@ -18,5 +17,87 @@ index 71d605a..0ea3c74 100644
 -    reason='festival-2.1 gives different results than further versions '
 -    'for syllable boundaries')
 def test_readme_festival_syll():
-     _test(u'hello world',
-           u'hh ax ;esyll l ow ;esyll ;eword w er l d ;esyll ;eword ',
+     _test('hello world',
+           'hh ax ;esyll l ow ;esyll ;eword w er l d ;esyll ;eword ',
+diff --git a/test/test_phonemize.py b/test/test_phonemize.py
+index d156c9e..2bbe371 100644
+--- a/test/test_phonemize.py
+++ b/test/test_phonemize.py
+@@ -213,18 +213,6 @@ def test_segments(njobs):
+         ('segments', True, True, False,
+             ['achi acho?', '', 'achi acho'],
+             [u'ʌtʃɪ ʌtʃʊ?', '', u'ʌtʃɪ ʌtʃʊ ']),
+-        ('festival', False, False, False,
+-            ['hello world!', '', 'goodbye'],
+-            ['hhaxlow werld ', 'guhdbay ']),
+-        ('festival', False, True, False,
+-            ['hello world!', '', 'goodbye'],
+-            ['hhaxlow werld!', 'guhdbay ']),
+-        ('festival', True, False, False,
+-            ['hello world!', '', 'goodbye'],
+-            ['hhaxlow werld ', '', 'guhdbay ']),
+-        ('festival', True, True, False,
+-            ['hello world!', '', 'goodbye'],
+-            ['hhaxlow werld!', '', 'guhdbay ']),
+         ('espeak', False, False, True,
+             ['hello world!', '', 'goodbye'],
+             [('hello world!', 'həloʊ wɜːld '), ('goodbye', 'ɡʊdbaɪ ')]),
+@@ -248,19 +236,7 @@ def test_segments(njobs):
+             [('achi acho?', u'ʌtʃɪ ʌtʃʊ '), ('', ''), ('achi acho', u'ʌtʃɪ ʌtʃʊ ')]),
+         ('segments', True, True, True,
+             ['achi acho?', '', 'achi acho'],
+-            [('achi acho?', u'ʌtʃɪ ʌtʃʊ?'), ('', ''), ('achi acho', u'ʌtʃɪ ʌtʃʊ ')]),
+-        ('festival', False, False, True,
+-            ['hello world!', '', 'goodbye'],
+-            [('hello world!', 'hhaxlow werld '), ('goodbye', 'guhdbay ')]),
+-        ('festival', False, True, True,
+-            ['hello world!', '', 'goodbye'],
+-            [('hello world!', 'hhaxlow werld!'), ('goodbye', 'guhdbay ')]),
+-        ('festival', True, False, True,
+-            ['hello world!', '', 'goodbye'],
+-            [('hello world!', 'hhaxlow werld '), ('', ''), ('goodbye', 'guhdbay ')]),
+-        ('festival', True, True, True,
+-            ['hello world!', '', 'goodbye'],
+-            [('hello world!', 'hhaxlow werld!'), ('', ''), ('goodbye', 'guhdbay ')])])
+            [('achi acho?', u'ʌtʃɪ ʌtʃʊ?'), ('', ''), ('achi acho', u'ʌtʃɪ ʌtʃʊ ')])])
+ def test_preserve_empty_lines(backend, empty_lines, punctuation, prepend_text, text, expected):
+     language = 'cree' if backend == 'segments' else 'en-us'
+ 
+@@ -278,11 +254,7 @@ def test_preserve_empty_lines(backend, empty_lines, punctuation, prepend_text, t
+         ('segments', False, False, [''], []),
+         ('segments', False, True, [''], []),
+         ('segments', True, False, [''], ['']),
+-        ('segments', True, True, [''], ['']),
+-        ('festival', False, False, [''], []),
+-        ('festival', False, True, [''], []),
+-        ('festival', True, False, [''], ['']),
+-        ('festival', True, True, [''], [''])])
+        ('segments', True, True, [''], [''])])
+ def test_empty_input(backend, empty_lines, punctuation, text, expected):
+     language = 'cree' if backend == 'segments' else 'en-us'
+ 
+diff --git a/test/test_punctuation.py b/test/test_punctuation.py
+index b2206ac..62e31c1 100644
+--- a/test/test_punctuation.py
+++ b/test/test_punctuation.py
+@@ -28,9 +28,6 @@ ESPEAK_150 = (EspeakBackend.version() >= (1, 50))
+ # True if we are using espeak>=1.49.3
+ ESPEAK_143 = (EspeakBackend.version() >= (1, 49, 3))
+ 
+-# True if we are using festival>=2.5
+-FESTIVAL_25 = (FestivalBackend.version() >= (2, 5))
+-
+ 
+ @pytest.mark.parametrize(
+     'inp, out', [
+@@ -179,9 +176,7 @@ def test_issue_54(text):
+         ('espeak', 'default', ['! ?', 'hey!'], ['! ?', 'heɪ!']),
+         ('espeak', '!', ['! ?', 'hey!'], ['! ', 'heɪ!']),
+         ('segments', 'default', ['! ?', 'hey!'], ['! ?', 'heːj!']),
+-        ('segments', '!', ['! ?', 'hey!'], ValueError),
+-        ('festival', 'default', ['! ?', 'hey!'], ['! ?', 'hhey!']),
+-        ('festival', '!', ['! ?', 'hey!'], ['! ', 'hhey!'])])
+        ('segments', '!', ['! ?', 'hey!'], ValueError)])
+ def test_issue55(backend, marks, text, expected):
+     if marks == 'default':
+         marks = Punctuation.default_marks()
--- a/pkgs/development/python-modules/pydicom/default.nix
+++ b/pkgs/development/python-modules/pydicom/default.nix
@ -11,22 +11,22 @@

 let
  pname = "pydicom";
-  version = "2.2.2";
+  version = "2.3.0";

  src = fetchFromGitHub {
-    owner = "${pname}";
-    repo = "${pname}";
+    owner = "pydicom";
+    repo = "pydicom";
    rev = "v${version}";
-    sha256 = "sha256-p5hJAUsactv6UEvbVaF+zk4iapx98eYkC9Zo+lzFATA=";
+    hash = "sha256-CAQWaBkzecJ1VXQ5BnAUjmBMjh0I8y+gT7I4P4o2gqI=";
  };

  # Pydicom needs pydicom-data to run some tests. If these files aren't downloaded
  # before the package creation, it'll try to download during the checkPhase.
  test_data = fetchFromGitHub {
-    owner = "${pname}";
-    repo = "${pname}-data";
+    owner = "pydicom";
+    repo = "pydicom-data";
    rev = "bbb723879690bb77e077a6d57657930998e92bd5";
-    sha256 = "sha256-dCI1temvpNWiWJYVfQZKy/YJ4ad5B0e9hEKHJnEeqzk=";
+    hash = "sha256-dCI1temvpNWiWJYVfQZKy/YJ4ad5B0e9hEKHJnEeqzk=";
  };

 in
@ -34,6 +34,8 @@ buildPythonPackage {
  inherit pname version src;
  disabled = pythonOlder "3.6";

+  format = "setuptools";
+
  propagatedBuildInputs = [
    numpy
    pillow
@ -53,8 +55,8 @@ buildPythonPackage {
    ln -s ${test_data}/data_store/data $HOME/.pydicom/data
  '';

-  # This test try to remove a dicom inside $HOME/.pydicom/data/ and download it again.
  disabledTests = [
+    # tries to remove a dicom inside $HOME/.pydicom/data/ and download it again
    "test_fetch_data_files"
  ] ++ lib.optionals stdenv.isAarch64 [
    # https://github.com/pydicom/pydicom/issues/1386
--- a/pkgs/development/python-modules/pykeepass/default.nix
+++ b/pkgs/development/python-modules/pykeepass/default.nix
@ -1,6 +1,6 @@
 { lib, fetchFromGitHub, buildPythonPackage
 , lxml, pycryptodomex, construct
-, argon2_cffi, python-dateutil, future
+, argon2-cffi, python-dateutil, future
 , python
 }:

@ -21,10 +21,10 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    lxml pycryptodomex construct
-    argon2_cffi python-dateutil future
+    argon2-cffi python-dateutil future
  ];

-  propagatedNativeBuildInputs = [ argon2_cffi ];
+  propagatedNativeBuildInputs = [ argon2-cffi ];

  checkPhase = ''
    ${python.interpreter} -m unittest tests.tests
--- a/pkgs/development/tools/continuous-integration/hci/default.nix
+++ b/pkgs/development/tools/continuous-integration/hci/default.nix
@ -12,7 +12,7 @@ let
          ${o.postInstall or ""}
          mkdir -p $out/libexec
          mv $out/bin/hci $out/libexec
-          makeWrapper $out/libexec/hci $out/bin/hci --prefix PATH : ${makeBinPath bundledBins}
+          makeWrapper $out/libexec/hci $out/bin/hci --prefix PATH : ${lib.escapeShellArg (makeBinPath bundledBins)}
        '';
      })
      (addBuildDepends [ makeWrapper ] (justStaticExecutables haskellPackages.hercules-ci-cli));
--- a/pkgs/development/tools/continuous-integration/hercules-ci-agent/default.nix
+++ b/pkgs/development/tools/continuous-integration/hercules-ci-agent/default.nix
@ -12,7 +12,7 @@ let
          ${o.postInstall or ""}
          mkdir -p $out/libexec
          mv $out/bin/hercules-ci-agent $out/libexec
-          makeWrapper $out/libexec/hercules-ci-agent $out/bin/hercules-ci-agent --prefix PATH : ${makeBinPath bundledBins}
+          makeWrapper $out/libexec/hercules-ci-agent $out/bin/hercules-ci-agent --prefix PATH : ${lib.escapeShellArg (makeBinPath bundledBins)}
        '';
      })
      (addBuildDepends [ makeWrapper ] (justStaticExecutables haskellPackages.hercules-ci-agent));
--- a/pkgs/development/tools/konstraint/default.nix
+++ b/pkgs/development/tools/konstraint/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "konstraint";
-  version = "0.19.0";
+  version = "0.19.1";

  src = fetchFromGitHub {
    owner = "plexsystems";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-BoH/lT+kYiwOtW82mmhhLZY3Xk2pRZHmNrEKJzPiG54=";
+    sha256 = "sha256-MQ9Rb8U1CGbEgNtkOdK879dr8uOro6CAl4wGMbuT+wo=";
  };
-  vendorSha256 = "sha256-G6WigkkKZj/k+kYlKItSfnoXN8UZ60lFEkZcQaI9J5c=";
+  vendorSha256 = "sha256-gUuceNwOI+ss2YDiIF+zxyOj53iV6kGtVhNCd5KQomo=";

  # Exclude go within .github folder
  excludedPackages = ".github";
--- a/pkgs/development/tools/misc/netcoredbg/default.nix
+++ b/pkgs/development/tools/misc/netcoredbg/default.nix
@ -1,7 +1,7 @@
 { lib, clangStdenv, stdenvNoCC, cmake, fetchFromGitHub, dotnetCorePackages, buildDotnetModule }:
 let
  pname = "netcoredbg";
-  version = "1.2.0-825";
+  version = "2.0.0-895";

  # according to CMakeLists.txt, this should be 3.1 even when building for .NET 5
  coreclr-version = "3.1.19";
@ -12,18 +12,19 @@ let
    sha256 = "o1KafmXqNjX9axr6sSxPKrfUX0e+b/4ANiVQt4T2ybw=";
  };

-  dotnet-sdk = dotnetCorePackages.sdk_5_0;
+  dotnet-sdk = dotnetCorePackages.sdk_6_0;

  src = fetchFromGitHub {
    owner = "Samsung";
    repo = pname;
    rev = version;
-    sha256 = "JQhDI1+bVbOIFNkXixZnFB/5+dzqCbInR0zJvykcFCg=";
+    sha256 = "sha256-zOfChuNjD6py6KD1AmN5DgCGxD2YNH9gTyageoiN8PU=";
  };

  unmanaged = clangStdenv.mkDerivation rec {
    inherit src pname version;

+    patches = [ ./limits.patch ];
    nativeBuildInputs = [ cmake dotnet-sdk ];

    hardeningDisable = [ "strictoverflow" ];
--- a/pkgs/development/tools/misc/netcoredbg/limits.patch
+++ b/pkgs/development/tools/misc/netcoredbg/limits.patch
@ -0,0 +1,12 @@
+diff --git a/src/debugger/frames.cpp b/src/debugger/frames.cpp
+index 534936b..21366f9 100644
+--- a/src/debugger/frames.cpp
+++ b/src/debugger/frames.cpp
+@@ -9,6 +9,7 @@
+ #include "utils/platform.h"
+ #include "utils/logger.h"
+ #include "utils/torelease.h"
+#include <limits>
+ 
+ namespace netcoredbg
+ {
--- a/pkgs/development/tools/misc/sqitch/default.nix
+++ b/pkgs/development/tools/misc/sqitch/default.nix
@ -37,7 +37,7 @@ stdenv.mkDerivation {
  '';
  dontStrip = true;
  postFixup = ''
-    wrapProgram $out/bin/sqitch --prefix PERL5LIB : ${perlPackages.makeFullPerlPath modules}
+    wrapProgram $out/bin/sqitch --prefix PERL5LIB : ${lib.escapeShellArg (perlPackages.makeFullPerlPath modules)}
  '';

  meta = {
--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@ -16,15 +16,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "deno";
-  version = "1.21.2";
+  version = "1.21.3";

  src = fetchFromGitHub {
    owner = "denoland";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-oRlrommD84x4M+Z/F70TjFwWSlvTb26v36zxgaMBifw=";
+    sha256 = "sha256-0LjY5XBtR9uoxLOOFRebbSuH9chSdH1/9rtsY15NdCM=";
  };
-  cargoSha256 = "sha256-kVNT9B9B3Li9B8aRFkUx5WkGZH7eqSMQO0GRPTC5tgU=";
+  cargoSha256 = "sha256-8YldzUO9Jysu0w2NvGWDIr2eIWcrX9ALUodYwIykt64=";

  postPatch = ''
    # upstream uses lld on aarch64-darwin for faster builds
--- a/pkgs/games/opendungeons/default.nix
+++ b/pkgs/games/opendungeons/default.nix
@ -11,7 +11,10 @@ stdenv.mkDerivation rec {
    sha256 = "0xf7gkpy8ll1h59wyaljf0hr8prg7p4ixz80mxqwcnm9cglpgn63";
  };

-  patches = [ ./cmakepaths.patch ];
+  patches = [
+    ./cmakepaths.patch
+    ./fix_link_date_time.patch
+  ];

  nativeBuildInputs = [ cmake pkg-config ];
  buildInputs = [ ogre cegui boost sfml openal ois ];
--- a/pkgs/games/opendungeons/fix_link_date_time.patch
+++ b/pkgs/games/opendungeons/fix_link_date_time.patch
@ -0,0 +1,13 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index f8ff3c2..689c463 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -538,7 +538,7 @@ endif()
+ #This has to cover the versions not already known by CMake
+ set(Boost_ADDITIONAL_VERSIONS 1.47 1.47.0 1.47.1 1.55.0)
+ 
+-set(OD_BOOST_COMPONENTS system filesystem locale program_options thread)
+set(OD_BOOST_COMPONENTS system date_time filesystem locale program_options thread)
+ 
+ if(BUILD_TESTING AND OD_BUILD_TESTING)
+     set(OD_BOOST_COMPONENTS ${OD_BOOST_COMPONENTS} unit_test_framework)
--- a/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
+++ b/pkgs/os-specific/linux/firmware/linux-firmware/default.nix
@ -1,12 +1,11 @@
-{ stdenvNoCC, fetchgit, lib }:
+{ stdenvNoCC, fetchzip, lib }:

 stdenvNoCC.mkDerivation rec {
  pname = "linux-firmware";
  version = "20220509";

-  src = fetchgit {
-    url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git";
-    rev = "refs/tags/${version}";
+  src = fetchzip {
+    url = "https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/snapshot/linux-firmware-${version}.tar.gz";
    sha256 = "sha256-pNuKA4XigrHU9qC5Ch6HLs3/tcv0zIkAzow9VOIVKdQ=";
  };

--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@ -135,6 +135,17 @@ rec {

  };

+  gitIni = { listsAsDuplicateKeys ? false, ... }@args: {
+
+    type = with lib.types; let
+
+      iniAtom = (ini args).type/*attrsOf*/.functor.wrapped/*attrsOf*/.functor.wrapped;
+
+    in attrsOf (attrsOf (either iniAtom (attrsOf iniAtom)));
+
+    generate = name: value: pkgs.writeText name (lib.generators.toGitINI value);
+  };
+
  toml = {}: json {} // {
    type = with lib.types; let
      valueType = oneOf [
--- a/pkgs/servers/mail/public-inbox/0002-msgtime-drop-Date-Parse-for-RFC2822.patch
+++ b/pkgs/servers/mail/public-inbox/0002-msgtime-drop-Date-Parse-for-RFC2822.patch
@ -1,172 +0,0 @@
-From c9b5164c954cd0de80d971f1c4ced16bf41ea81b Mon Sep 17 00:00:00 2001
-From: Eric Wong <e@80x24.org>
-Date: Fri, 29 Nov 2019 12:25:07 +0000
-Subject: [PATCH 2/2] msgtime: drop Date::Parse for RFC2822
-
-Date::Parse is not optimized for RFC2822 dates and isn't
-packaged on OpenBSD.  It's still useful for historical
-email when email clients were less conformant, but is
-less relevant for new emails.
---
- lib/PublicInbox/MsgTime.pm | 115 ++++++++++++++++++++++++++++++++-----
- t/msgtime.t                |   6 ++
- 2 files changed, 107 insertions(+), 14 deletions(-)
-
-diff --git a/lib/PublicInbox/MsgTime.pm b/lib/PublicInbox/MsgTime.pm
-index 58e11d72..e9b27a49 100644
--- a/lib/PublicInbox/MsgTime.pm
-+++ b/lib/PublicInbox/MsgTime.pm
-@@ -7,24 +7,114 @@ use strict;
- use warnings;
- use base qw(Exporter);
- our @EXPORT_OK = qw(msg_timestamp msg_datestamp);
-use Date::Parse qw(str2time strptime);
-+use Time::Local qw(timegm);
-+my @MoY = qw(january february march april may june
-+		july august september october november december);
-+my %MoY;
-+@MoY{@MoY} = (0..11);
-+@MoY{map { substr($_, 0, 3) } @MoY} = (0..11);
-+
-+my %OBSOLETE_TZ = ( # RFC2822 4.3 (Obsolete Date and Time)
-+	EST => '-0500', EDT => '-0400',
-+	CST => '-0600', CDT => '-0500',
-+	MST => '-0700', MDT => '-0600',
-+	PST => '-0800', PDT => '-0700',
-+	UT => '+0000', GMT => '+0000', Z => '+0000',
-+
-+	# RFC2822 states:
-+	#   The 1 character military time zones were defined in a non-standard
-+	#   way in [RFC822] and are therefore unpredictable in their meaning.
-+);
-+my $OBSOLETE_TZ = join('|', keys %OBSOLETE_TZ);
- 
- sub str2date_zone ($) {
- 	my ($date) = @_;
-+	my ($ts, $zone);
-+
-+	# RFC822 is most likely for email, but we can tolerate an extra comma
-+	# or punctuation as long as all the data is there.
-+	# We'll use '\s' since Unicode spaces won't affect our parsing.
-+	# SpamAssassin ignores commas and redundant spaces, too.
-+	if ($date =~ /(?:[A-Za-z]+,?\s+)? # day-of-week
-+			([0-9]+),?\s+  # dd
-+			([A-Za-z]+)\s+ # mon
-+			([0-9]{2,})\s+ # YYYY or YY (or YYY :P)
-+			([0-9]+)[:\.] # HH:
-+				((?:[0-9]{2})|(?:\s?[0-9])) # MM
-+				(?:[:\.]((?:[0-9]{2})|(?:\s?[0-9])))? # :SS
-+			\s+	# a TZ offset is required:
-+				([\+\-])? # TZ sign
-+				[\+\-]* # I've seen extra "-" e.g. "--500"
-+				([0-9]+|$OBSOLETE_TZ)(?:\s|$) # TZ offset
-+			/xo) {
-+		my ($dd, $m, $yyyy, $hh, $mm, $ss, $sign, $tz) =
-+					($1, $2, $3, $4, $5, $6, $7, $8);
-+		# don't accept non-English months
-+		defined(my $mon = $MoY{lc($m)}) or return;
-+
-+		if (defined(my $off = $OBSOLETE_TZ{$tz})) {
-+			$sign = substr($off, 0, 1);
-+			$tz = substr($off, 1);
-+		}
-+
-+		# Y2K problems: 3-digit years, follow RFC2822
-+		if (length($yyyy) <= 3) {
-+			$yyyy += 1900;
-+
-+			# and 2-digit years from '09 (2009) (0..49)
-+			$yyyy += 100 if $yyyy < 1950;
-+		}
-+
-+		$ts = timegm($ss // 0, $mm, $hh, $dd, $mon, $yyyy);
- 
-	my $ts = str2time($date);
-	return undef unless(defined $ts);
-+		# Compute the time offset from [+-]HHMM
-+		$tz //= 0;
-+		my ($tz_hh, $tz_mm);
-+		if (length($tz) == 1) {
-+			$tz_hh = $tz;
-+			$tz_mm = 0;
-+		} elsif (length($tz) == 2) {
-+			$tz_hh = 0;
-+			$tz_mm = $tz;
-+		} else {
-+			$tz_hh = $tz;
-+			$tz_hh =~ s/([0-9]{2})\z//;
-+			$tz_mm = $1;
-+		}
-+		while ($tz_mm >= 60) {
-+			$tz_mm -= 60;
-+			$tz_hh += 1;
-+		}
-+		$sign //= '+';
-+		my $off = $sign . ($tz_mm * 60 + ($tz_hh * 60 * 60));
-+		$ts -= $off;
-+		$sign = '+' if $off == 0;
-+		$zone = sprintf('%s%02d%02d', $sign, $tz_hh, $tz_mm);
- 
-	# off is the time zone offset in seconds from GMT
-	my ($ss,$mm,$hh,$day,$month,$year,$off) = strptime($date);
-	return undef unless(defined $off);
-+	# Time::Zone and Date::Parse are part of the same distibution,
-+	# and we need Time::Zone to deal with tz names like "EDT"
-+	} elsif (eval { require Date::Parse }) {
-+		$ts = Date::Parse::str2time($date);
-+		return undef unless(defined $ts);
- 
-	# Compute the time zone from offset
-	my $sign = ($off < 0) ? '-' : '+';
-	my $hour = abs(int($off / 3600));
-	my $min  = ($off / 60) % 60;
-	my $zone = sprintf('%s%02d%02d', $sign, $hour, $min);
-+		# off is the time zone offset in seconds from GMT
-+		my ($ss,$mm,$hh,$day,$month,$year,$off) =
-+					Date::Parse::strptime($date);
-+		return undef unless(defined $off);
-+
-+		# Compute the time zone from offset
-+		my $sign = ($off < 0) ? '-' : '+';
-+		my $hour = abs(int($off / 3600));
-+		my $min  = ($off / 60) % 60;
-+
-+		$zone = sprintf('%s%02d%02d', $sign, $hour, $min);
-+	} else {
-+		warn "Date::Parse missing for non-RFC822 date: $date\n";
-+		return undef;
-+	}
- 
-+	# Note: we've already applied the offset to $ts at this point,
-+	# but we want to keep "git fsck" happy.
- 	# "-1200" is the furthest westermost zone offset,
- 	# but git fast-import is liberal so we use "-1400"
- 	if ($zone >= 1400 || $zone <= -1400) {
-@@ -59,9 +149,6 @@ sub msg_date_only ($) {
- 	my @date = $hdr->header_raw('Date');
- 	my ($ts);
- 	foreach my $d (@date) {
-		# Y2K problems: 3-digit years
-		$d =~ s!([A-Za-z]{3}) ([0-9]{3}) ([0-9]{2}:[0-9]{2}:[0-9]{2})!
-			my $yyyy = $2 + 1900; "$1 $yyyy $3"!e;
- 		$ts = eval { str2date_zone($d) } and return $ts;
- 		if ($@) {
- 			my $mid = $hdr->header_raw('Message-ID');
-diff --git a/t/msgtime.t b/t/msgtime.t
-index 6b396602..d9643b65 100644
--- a/t/msgtime.t
-+++ b/t/msgtime.t
-@@ -84,4 +84,10 @@ is_deeply(datestamp('Fri, 28 Jun 2002 12:54:40 -700'), [1025294080, '-0700']);
- is_deeply(datestamp('Sat, 12 Jan 2002 12:52:57 -200'), [1010847177, '-0200']);
- is_deeply(datestamp('Mon, 05 Nov 2001 10:36:16 -800'), [1004985376, '-0800']);
- 
-+# obsolete formats described in RFC2822
-+for (qw(UT GMT Z)) {
-+	is_deeply(datestamp('Fri, 02 Oct 1993 00:00:00 '.$_), [ 749520000, '+0000']);
-+}
-+is_deeply(datestamp('Fri, 02 Oct 1993 00:00:00 EDT'), [ 749534400, '-0400']);
-+
- done_testing();
-- 
-2.24.1
-
--- a/pkgs/servers/mail/public-inbox/default.nix
+++ b/pkgs/servers/mail/public-inbox/default.nix
@ -1,11 +1,38 @@
-{ buildPerlPackage, lib, fetchurl, fetchpatch, makeWrapper
-, DBDSQLite, EmailMIME, IOSocketSSL, IPCRun, Plack, PlackMiddlewareReverseProxy
-, SearchXapian, TimeDate, URI
-, git, highlight, openssl, xapian
+{ stdenv, lib, fetchurl, makeWrapper, nixosTests
+, buildPerlPackage
+, coreutils
+, curl
+, git
+, gnumake
+, highlight
+, libgit2
+, man
+, openssl
+, pkg-config
+, sqlite
+, xapian
+, AnyURIEscape
+, DBDSQLite
+, DBI
+, EmailAddressXS
+, EmailMIME
+, IOSocketSSL
+, IPCRun
+, Inline
+, InlineC
+, LinuxInotify2
+, MailIMAPClient
+, ParseRecDescent
+, Plack
+, PlackMiddlewareReverseProxy
+, SearchXapian
+, TimeDate
+, URI
 }:

 let

+  skippedTests = [
    # These tests would fail, and produce "Operation not permitted"
    # errors from git, because they use git init --shared.  This tries
    # to set the setgid bit, which isn't permitted inside build
@ -13,7 +40,34 @@ let
    #
    # These tests were indentified with
    #     grep -r shared t/
-  skippedTests = [ "convert-compact" "search" "v2writable" "www_listing" ];
+    "convert-compact" "search" "v2writable" "www_listing"
+    # perl5.32.0-public-inbox> t/eml.t ...................... 1/? Cannot parse parameter '=?ISO-8859-1?Q?=20charset=3D=1BOF?=' at t/eml.t line 270.
+    # perl5.32.0-public-inbox> #   Failed test 'got wide character by assuming utf-8'
+    # perl5.32.0-public-inbox> #   at t/eml.t line 272.
+    # perl5.32.0-public-inbox> Wide character in print at /nix/store/38vxlxrvg3yji3jms44qn94lxdysbj5j-perl-5.32.0/lib/perl5/5.32.0/Test2/Formatter/TAP.pm line 125.
+    "eml"
+    # Failed test 'Makefile OK'
+    # at t/hl_mod.t line 19.
+    #        got: 'makefile'
+    #   expected: 'make'
+    "hl_mod"
+    # Failed test 'clone + index v1 synced ->created_at'
+    # at t/lei-mirror.t line 175.
+    #        got: '1638378723'
+    #   expected: undef
+    # Failed test 'clone + index v1 synced ->created_at'
+    # at t/lei-mirror.t line 178.
+    #        got: '1638378723'
+    #   expected: undef
+    # May be due to the use of $ENV{HOME}.
+    "lei-mirror"
+    # Failed test 'child error (pure-Perl)'
+    # at t/spawn.t line 33.
+    #        got: '0'
+    #   expected: anything else
+    # waiting for child to reap grandchild...
+    "spawn"
+  ];

  testConditions = with lib;
    concatMapStringsSep " " (n: "! -name ${escapeShellArg n}.t") skippedTests;
@ -22,53 +76,86 @@ in

 buildPerlPackage rec {
  pname = "public-inbox";
-  version = "1.2.0";
+  version = "1.8.0";

  src = fetchurl {
-    url = "https://public-inbox.org/releases/public-inbox-${version}.tar.gz";
-    sha256 = "0sa2m4f2x7kfg3mi4im7maxqmqvawafma8f7g92nyfgybid77g6s";
+    url = "https://public-inbox.org/public-inbox.git/snapshot/public-inbox-${version}.tar.gz";
+    sha256 = "sha256-laJOOCk5NecIGWesv4D30cLGfijQHVkeo55eNqNKzew=";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://public-inbox.org/meta/20200101032822.GA13063@dcvr/raw";
-      sha256 = "0ncxqqkvi5lwi8zaa7lk7l8mf8h278raxsvbvllh3z7jhfb48r3l";
-    })
-    ./0002-msgtime-drop-Date-Parse-for-RFC2822.patch
-  ];
-
  outputs = [ "out" "devdoc" "sa_config" ];

  postConfigure = ''
    substituteInPlace Makefile --replace 'TEST_FILES = t/*.t' \
        'TEST_FILES = $(shell find t -name *.t ${testConditions})'
+    substituteInPlace lib/PublicInbox/TestCommon.pm \
+      --replace /bin/cp ${coreutils}/bin/cp
  '';

  nativeBuildInputs = [ makeWrapper ];

  buildInputs = [
-    DBDSQLite EmailMIME IOSocketSSL IPCRun Plack PlackMiddlewareReverseProxy
-    SearchXapian TimeDate URI highlight
+    AnyURIEscape
+    DBDSQLite
+    DBI
+    EmailAddressXS
+    EmailMIME
+    highlight
+    IOSocketSSL
+    IPCRun
+    Inline
+    InlineC
+    ParseRecDescent
+    Plack
+    PlackMiddlewareReverseProxy
+    SearchXapian
+    TimeDate
+    URI
+    libgit2 # For Gcf2
+    man
  ];

-  checkInputs = [ git openssl xapian ];
+  doCheck = !stdenv.isDarwin;
+  checkInputs = [
+    MailIMAPClient
+    curl
+    git
+    openssl
+    pkg-config
+    sqlite
+    xapian
+  ] ++ lib.optionals stdenv.isLinux [
+    LinuxInotify2
+  ];
  preCheck = ''
    perl certs/create-certs.perl
+    export TEST_LEI_ERR_LOUD=1
+    export HOME="$NIX_BUILD_TOP"/home
+    mkdir -p "$HOME"/.cache/public-inbox/inline-c
  '';

  installTargets = [ "install" ];
  postInstall = ''
    for prog in $out/bin/*; do
-        wrapProgram $prog --prefix PATH : ${lib.makeBinPath [ git ]}
+        wrapProgram $prog --prefix PATH : ${lib.makeBinPath [
+          git
+          /* for InlineC */
+          gnumake
+          stdenv.cc.cc
+        ]}
    done

    mv sa_config $sa_config
  '';

+  passthru.tests = {
+    nixos-public-inbox = nixosTests.public-inbox;
+  };
+
  meta = with lib; {
    homepage = "https://public-inbox.org/";
    license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ qyliss ];
+    maintainers = with maintainers; [ julm qyliss ];
    platforms = platforms.all;
  };
 }
--- a/pkgs/servers/misc/navidrome/default.nix
+++ b/pkgs/servers/misc/navidrome/default.nix
@ -32,9 +32,9 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

-  postFixup = ''
+  postFixup = optionalString ffmpegSupport ''
    wrapProgram $out/bin/navidrome \
-      --prefix PATH : ${makeBinPath (optional ffmpegSupport ffmpeg)}
+      --prefix PATH : ${makeBinPath [ ffmpeg ]}
  '';

  passthru.tests.navidrome = nixosTests.navidrome;
--- a/pkgs/servers/pufferpanel/default.nix
+++ b/pkgs/servers/pufferpanel/default.nix
@ -47,7 +47,7 @@ buildGoModule rec {
      --set PUFFER_PANEL_EMAIL_TEMPLATES $out/share/pufferpanel/templates/emails.json \
      --set GIN_MODE release \
      --set PUFFER_PANEL_WEB_FILES $out/share/pufferpanel/www \
-      --prefix PATH : ${lib.makeBinPath pathDeps}
+      --prefix PATH : ${lib.escapeShellArg (lib.makeBinPath pathDeps)}
  '';

  meta = with lib; {
--- a/pkgs/servers/pulseaudio/0001-Make-gio-2.0-optional-when-gsettings-is-disabled.patch
+++ b/pkgs/servers/pulseaudio/0001-Make-gio-2.0-optional-when-gsettings-is-disabled.patch
@ -0,0 +1,26 @@
+From 72f3fe059f031f24c5ad026cb2fc16318f227c09 Mon Sep 17 00:00:00 2001
+From: Andrew Childs <andrew.childs@bibo.com.ph>
+Date: Tue, 19 Apr 2022 16:29:58 +0900
+Subject: [PATCH 1/8] Make gio-2.0 optional when gsettings is disabled
+
+Derived from https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/merge_requests/654
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index d7e468cab..f7adf1413 100644
+--- a/meson.build
+++ b/meson.build
+@@ -614,7 +614,7 @@ if dbus_dep.found()
+   cdata.set('HAVE_DBUS', 1)
+ endif
+ 
+-gio_dep = dependency('gio-2.0', version : '>= 2.26.0')
+gio_dep = dependency('gio-2.0', version : '>= 2.26.0', required : false)
+ if get_option('gsettings').enabled()
+   assert(gio_dep.found(), 'GSettings support needs glib I/O library (GIO)')
+   cdata.set('HAVE_GSETTINGS', 1)
+-- 
+2.35.1
+
--- a/pkgs/servers/pulseaudio/0002-Ignore-SCM_CREDS-on-macOS.patch
+++ b/pkgs/servers/pulseaudio/0002-Ignore-SCM_CREDS-on-macOS.patch
@ -0,0 +1,27 @@
+From 39bef695f783614e6175477417298ddf37e2ac13 Mon Sep 17 00:00:00 2001
+From: Andrew Childs <andrew.childs@bibo.com.ph>
+Date: Tue, 19 Apr 2022 16:58:43 +0900
+Subject: [PATCH 2/8] Ignore SCM_CREDS on macOS
+
+It was added for FreeBSD support, but also enables the
+unsupported[citation needed] feature on macOS.
+---
+ src/pulsecore/creds.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/pulsecore/creds.h b/src/pulsecore/creds.h
+index b599b569c..b5b1c9f37 100644
+--- a/src/pulsecore/creds.h
+++ b/src/pulsecore/creds.h
+@@ -34,7 +34,7 @@
+ typedef struct pa_creds pa_creds;
+ typedef struct pa_cmsg_ancil_data pa_cmsg_ancil_data;
+ 
+-#if defined(SCM_CREDENTIALS) || defined(SCM_CREDS)
+#if defined(SCM_CREDENTIALS) || (defined(SCM_CREDS) && !defined(__APPLE__))
+ 
+ #define HAVE_CREDS 1
+ 
+-- 
+2.35.1
+
--- a/pkgs/servers/pulseaudio/0003-Disable-z-nodelete-on-darwin.patch
+++ b/pkgs/servers/pulseaudio/0003-Disable-z-nodelete-on-darwin.patch
@ -0,0 +1,26 @@
+From 3f1abb55f4eb985fd0715b2b2ca45dcce3a56824 Mon Sep 17 00:00:00 2001
+From: Andrew Childs <andrew.childs@bibo.com.ph>
+Date: Tue, 19 Apr 2022 17:06:50 +0900
+Subject: [PATCH 3/8] Disable `-z nodelete` on darwin
+
+Not supported[citation needed].
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index f7adf1413..d4bece11a 100644
+--- a/meson.build
+++ b/meson.build
+@@ -404,7 +404,7 @@ cdata.set('MESON_BUILD', 1)
+ # so we request the nodelete flag to be enabled.
+ # On other systems, we don't really know how to do that, but it's welcome if somebody can tell.
+ # Windows doesn't support this flag.
+-if host_machine.system() != 'windows'
+if host_machine.system() != 'windows' and host_machine.system() != 'darwin'
+   nodelete_link_args = ['-Wl,-z,nodelete']
+ else
+   nodelete_link_args = []
+-- 
+2.35.1
+
--- a/pkgs/servers/pulseaudio/0004-Prefer-clock_gettime.patch
+++ b/pkgs/servers/pulseaudio/0004-Prefer-clock_gettime.patch
@ -0,0 +1,57 @@
+From 0bd3b613ac3bf16a73b3223fa1b961da3a0db1b2 Mon Sep 17 00:00:00 2001
+From: Andrew Childs <andrew.childs@bibo.com.ph>
+Date: Tue, 19 Apr 2022 17:12:52 +0900
+Subject: [PATCH 4/8] Prefer clock_gettime
+
+Available in darwin since 10.12 (released in 2016).
+---
+ src/pulsecore/core-rtclock.c | 26 +++++++++++++-------------
+ 1 file changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/src/pulsecore/core-rtclock.c b/src/pulsecore/core-rtclock.c
+index 2c2e28631..a08d4b391 100644
+--- a/src/pulsecore/core-rtclock.c
+++ b/src/pulsecore/core-rtclock.c
+@@ -65,19 +65,7 @@ pa_usec_t pa_rtclock_age(const struct timeval *tv) {
+ 
+ struct timeval *pa_rtclock_get(struct timeval *tv) {
+ 
+-#if defined(OS_IS_DARWIN)
+-    uint64_t val, abs_time = mach_absolute_time();
+-    Nanoseconds nanos;
+-
+-    nanos = AbsoluteToNanoseconds(*(AbsoluteTime *) &abs_time);
+-    val = *(uint64_t *) &nanos;
+-
+-    tv->tv_sec = val / PA_NSEC_PER_SEC;
+-    tv->tv_usec = (val % PA_NSEC_PER_SEC) / PA_NSEC_PER_USEC;
+-
+-    return tv;
+-
+-#elif defined(HAVE_CLOCK_GETTIME)
+#if defined(HAVE_CLOCK_GETTIME)
+     struct timespec ts;
+ 
+ #ifdef CLOCK_MONOTONIC
+@@ -109,6 +97,18 @@ struct timeval *pa_rtclock_get(struct timeval *tv) {
+ 
+         return tv;
+     }
+#elif defined(OS_IS_DARWIN)
+    uint64_t val, abs_time = mach_absolute_time();
+    Nanoseconds nanos;
+
+    nanos = AbsoluteToNanoseconds(*(AbsoluteTime *) &abs_time);
+    val = *(uint64_t *) &nanos;
+
+    tv->tv_sec = val / PA_NSEC_PER_SEC;
+    tv->tv_usec = (val % PA_NSEC_PER_SEC) / PA_NSEC_PER_USEC;
+
+    return tv;
+
+ #endif /* HAVE_CLOCK_GETTIME */
+ 
+     return pa_gettimeofday(tv);
+-- 
+2.35.1
+
--- a/pkgs/servers/pulseaudio/0005-Include-poll-posix.c-on-darwin.patch
+++ b/pkgs/servers/pulseaudio/0005-Include-poll-posix.c-on-darwin.patch
@ -0,0 +1,24 @@
+From 8dee473920d3a331b73a415b37e7e0b01f014110 Mon Sep 17 00:00:00 2001
+From: Andrew Childs <andrew.childs@bibo.com.ph>
+Date: Tue, 19 Apr 2022 17:22:23 +0900
+Subject: [PATCH 5/8] Include poll-posix.c on darwin
+
+---
+ src/meson.build | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/meson.build b/src/meson.build
+index e2860811b..5bd68cb12 100644
+--- a/src/meson.build
+++ b/src/meson.build
+@@ -182,6 +182,7 @@ if host_machine.system() == 'windows'
+ else
+   libpulsecommon_sources += [
+     'pulsecore/mutex-posix.c',
+    'pulsecore/poll-posix.c',
+     'pulsecore/semaphore-posix.c',
+     'pulsecore/thread-posix.c'
+   ]
+-- 
+2.35.1
+
--- a/pkgs/servers/pulseaudio/0006-Only-use-version-script-on-GNU-ish-linkers.patch
+++ b/pkgs/servers/pulseaudio/0006-Only-use-version-script-on-GNU-ish-linkers.patch
@ -0,0 +1,29 @@
+From 419258112b9d90d149ebbd5c657a36d8532b78a2 Mon Sep 17 00:00:00 2001
+From: Andrew Childs <andrew.childs@bibo.com.ph>
+Date: Tue, 19 Apr 2022 17:31:36 +0900
+Subject: [PATCH 6/8] Only use version-script on GNU-ish linkers
+
+---
+ src/pulse/meson.build | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/pulse/meson.build b/src/pulse/meson.build
+index c2128e087..a5e47867e 100644
+--- a/src/pulse/meson.build
+++ b/src/pulse/meson.build
+@@ -74,7 +74,11 @@ run_target('update-map-file',
+   command : [ join_paths(meson.source_root(), 'scripts/generate-map-file.sh'), 'map-file',
+               [ libpulse_headers, 'simple.h', join_paths(meson.build_root(), 'src', 'pulse', 'version.h') ] ])
+ 
+-versioning_link_args = '-Wl,-version-script=' + join_paths(meson.source_root(), 'src', 'pulse', 'map-file')
+if meson.get_compiler('c').get_linker_id().startswith('ld.')
+  versioning_link_args = '-Wl,-version-script=' + join_paths(meson.source_root(), 'src', 'pulse', 'map-file')
+else
+  versioning_link_args = []
+endif
+ 
+ libpulse = shared_library('pulse',
+   libpulse_sources,
+-- 
+2.35.1
+
--- a/pkgs/servers/pulseaudio/0007-Adapt-undefined-link-args-per-linker.patch
+++ b/pkgs/servers/pulseaudio/0007-Adapt-undefined-link-args-per-linker.patch
@ -0,0 +1,44 @@
+From 6f132be835d5acb5db4301ea1818601504e47fae Mon Sep 17 00:00:00 2001
+From: Andrew Childs <andrew.childs@bibo.com.ph>
+Date: Tue, 19 Apr 2022 17:41:34 +0900
+Subject: [PATCH 7/8] Adapt undefined link args per linker
+
+TODO: Why is this required? Isn't it default?
+---
+ src/modules/meson.build | 13 ++++++++++++-
+ 1 file changed, 12 insertions(+), 1 deletion(-)
+
+diff --git a/src/modules/meson.build b/src/modules/meson.build
+index be72c3b9b..0163b583f 100644
+--- a/src/modules/meson.build
+++ b/src/modules/meson.build
+@@ -293,6 +293,17 @@ all_modules += [
+ # FIXME: meson doesn't support multiple RPATH arguments currently
+ rpath_dirs = join_paths(privlibdir) + ':' + join_paths(modlibexecdir)
+ 
+if meson.get_compiler('c').get_linker_id().startswith('ld.')
+  no_undefined_link_args = [ '-Wl,--no-undefined' ]
+elif meson.get_compiler('c').get_linker_id() == 'ld64'
+  # TODO: is this required? is this not default?
+  no_undefined_link_args = [ '-Wl,-undefined,error' ]
+else
+  # TODO: what platforms is this? what flag do they use?
+  no_undefined_link_args = []
+endif
+
+
+ foreach m : all_modules
+   name = m[0]
+   sources = m[1]
+@@ -310,7 +321,7 @@ foreach m : all_modules
+     install_rpath : rpath_dirs,
+     install_dir : modlibexecdir,
+     dependencies : [thread_dep, libpulse_dep, libpulsecommon_dep, libpulsecore_dep, libintl_dep, platform_dep, platform_socket_dep] + extra_deps,
+-    link_args : [nodelete_link_args, '-Wl,--no-undefined' ],
+    link_args : [nodelete_link_args, no_undefined_link_args ],
+     link_with : extra_libs,
+     name_prefix : '',
+     implicit_include_directories : false)
+-- 
+2.35.1
+
--- a/pkgs/servers/pulseaudio/0008-Use-correct-semaphore-on-darwin.patch
+++ b/pkgs/servers/pulseaudio/0008-Use-correct-semaphore-on-darwin.patch
@ -0,0 +1,31 @@
+From 1a840b6e517004c902dfbea3d358b344c9588978 Mon Sep 17 00:00:00 2001
+From: Andrew Childs <andrew.childs@bibo.com.ph>
+Date: Tue, 19 Apr 2022 17:49:08 +0900
+Subject: [PATCH 8/8] Use correct semaphore on darwin
+
+---
+ src/meson.build | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/src/meson.build b/src/meson.build
+index 5bd68cb12..041e2fab4 100644
+--- a/src/meson.build
+++ b/src/meson.build
+@@ -183,9 +183,13 @@ else
+   libpulsecommon_sources += [
+     'pulsecore/mutex-posix.c',
+     'pulsecore/poll-posix.c',
+-    'pulsecore/semaphore-posix.c',
+     'pulsecore/thread-posix.c'
+   ]
+  if host_machine.system() == 'darwin'
+    libpulsecommon_sources += [ 'pulsecore/semaphore-osx.c' ]
+  else
+    libpulsecommon_sources += [ 'pulsecore/semaphore-posix.c' ]
+  endif
+ endif
+ # FIXME: Do SIMD things
+ 
+-- 
+2.35.1
+
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@ -5,7 +5,7 @@
 , sbc, bluez5, udev, openssl, fftwFloat
 , soxr, speexdsp, systemd, webrtc-audio-processing
 , gst_all_1
-, check, meson, ninja, m4, wrapGAppsHook
+, check, libintl, meson, ninja, m4, wrapGAppsHook

 , x11Support ? false

@ -45,6 +45,18 @@ stdenv.mkDerivation rec {
    # Install sysconfdir files inside of the nix store,
    # but use a conventional runtime sysconfdir outside the store
    ./add-option-for-installation-sysconfdir.patch
+  ] ++ lib.optionals stdenv.isDarwin [
+    # https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/merge_requests/654
+    ./0001-Make-gio-2.0-optional-when-gsettings-is-disabled.patch
+
+    # TODO (not sent upstream)
+    ./0002-Ignore-SCM_CREDS-on-macOS.patch
+    ./0003-Disable-z-nodelete-on-darwin.patch
+    ./0004-Prefer-clock_gettime.patch
+    ./0005-Include-poll-posix.c-on-darwin.patch
+    ./0006-Only-use-version-script-on-GNU-ish-linkers.patch
+    ./0007-Adapt-undefined-link-args-per-linker.patch
+    ./0008-Use-correct-semaphore-on-darwin.patch
  ];

  outputs = [ "out" "dev" ];
@ -60,7 +72,7 @@ stdenv.mkDerivation rec {
  buildInputs =
    [ libtool libsndfile soxr speexdsp fftwFloat check ]
    ++ lib.optionals stdenv.isLinux [ glib dbus ]
-    ++ lib.optionals stdenv.isDarwin [ AudioUnit Cocoa CoreServices ]
+    ++ lib.optionals stdenv.isDarwin [ AudioUnit Cocoa CoreServices libintl ]
    ++ lib.optionals (!libOnly) (
      [ libasyncns webrtc-audio-processing ]
      ++ lib.optional jackaudioSupport libjack2
@ -86,7 +98,7 @@ stdenv.mkDerivation rec {
    "-Ddoxygen=false"
    "-Delogind=disabled"
    # gsettings does not support cross-compilation
-    "-Dgsettings=${if stdenv.buildPlatform == stdenv.hostPlatform then "enabled" else "disabled"}"
+    "-Dgsettings=${if stdenv.isLinux && (stdenv.buildPlatform == stdenv.hostPlatform) then "enabled" else "disabled"}"
    "-Dgstreamer=disabled"
    "-Dgtk=disabled"
    "-Djack=${if jackaudioSupport && !libOnly then "enabled" else "disabled"}"
@ -106,9 +118,14 @@ stdenv.mkDerivation rec {
    "-Dudevrulesdir=${placeholder "out"}/lib/udev/rules.d"
  ]
  ++ lib.optional (stdenv.isLinux && useSystemd) "-Dsystemduserunitdir=${placeholder "out"}/lib/systemd/user"
-    ;
+  ++ lib.optionals (stdenv.isDarwin) [
+    "-Ddbus=disabled"
+    "-Dglib=disabled"
+    "-Doss-output=disabled"
+  ];

-  doCheck = true;
+  # tests fail on Darwin because of timeouts
+  doCheck = !stdenv.isDarwin;
  preCheck = ''
    export HOME=$(mktemp -d)
  '';
--- a/pkgs/servers/teleport/default.nix
+++ b/pkgs/servers/teleport/default.nix
@ -3,11 +3,17 @@
 , rustPlatform
 , fetchFromGitHub
 , makeWrapper
+, symlinkJoin
+, CoreFoundation
+, openssl
+, pkg-config
 , protobuf
+, Security
 , stdenv
 , xdg-utils
 , nixosTests

+, withRdpClient ? true
 , withRoleTester ? true
 }:
 let
@ -16,17 +22,38 @@ let
    owner = "gravitational";
    repo = "teleport";
    rev = "v${version}";
-    sha256 = "sha256-ir2NMNIjSpv7l6dVNHczARg6b+doFofinsJy1smEC7o=";
+    sha256 = "sha256-KQfdeMuZ9LJHhEJLMl58Yb0+gxgDT7VcVnK1JxjVZaI=";
+  };
+  version = "9.1.2";
+
+  rdpClient = rustPlatform.buildRustPackage rec {
+    name = "teleport-rdpclient";
+    cargoSha256 = "sha256-Jz7bB/f4HRxBhSevmfELSrIm+IXUVlADIgp2qWQd5PY=";
+    inherit version src;
+
+    buildAndTestSubdir = "lib/srv/desktop/rdp/rdpclient";
+
+    buildInputs = [ openssl ]
+      ++ lib.optionals stdenv.isDarwin [ CoreFoundation Security ];
+    nativeBuildInputs = [ pkg-config ];
+
+    # https://github.com/NixOS/nixpkgs/issues/161570 ,
+    # buildRustPackage sets strictDeps = true;
+    checkInputs = buildInputs;
+
+    OPENSSL_NO_VENDOR = "1";
+
+    postInstall = ''
+      cp -r target $out
+    '';
  };
-  version = "8.1.3";

  roleTester = rustPlatform.buildRustPackage {
    name = "teleport-roletester";
-    inherit version;
+    inherit version src;

-    src = "${src}/lib/datalog";
-    cargoSha256 = "sha256-cpW7kel02t/fB2CvDvVqWlzgS3Vg2qLnemF/bW2Ii1A=";
-    sourceRoot = "datalog/roletester";
+    cargoSha256 = "sha256-gCm4ETbXy6tGJQVSzUkoAWUmKD3poYgkw133LtziASI=";
+    buildAndTestSubdir = "lib/datalog/roletester";

    PROTOC = "${protobuf}/bin/protoc";
    PROTOC_INCLUDE = "${protobuf}/include";
@ -39,20 +66,23 @@ let
  webassets = fetchFromGitHub {
    owner = "gravitational";
    repo = "webassets";
-    rev = "ea3c67c941c56cfb6c228612e88100df09fb6f9c";
-    sha256 = "sha256-oKvDXkxA73IJOi+ciBFVLkYcmeRUsTC+3rcYf64vDoY=";
+    rev = "67e608db77300d8a6cb17709be67f12c1d3271c3";
+    sha256 = "sha256-o4qjXGaNi5XDSUQrUuU+G77EdRnvJ1WUPWrryZU1CUE=";
  };
 in
 buildGoModule rec {
  pname = "teleport";

  inherit src version;
-  vendorSha256 = null;
+  vendorSha256 = "sha256-UMgWM7KHag99JR4i4mwVHa6yd9aHQ6Dy+pmUijNL4Ew=";

-  subPackages = [ "tool/tctl" "tool/teleport" "tool/tsh" ];
-  tags = [ "webassets_embed" ] ++
-    lib.optional withRoleTester "roletester";
+  subPackages = [ "tool/tbot" "tool/tctl" "tool/teleport" "tool/tsh" ];
+  tags = [ "webassets_embed" ]
+    ++ lib.optional withRdpClient "desktop_access_rdp"
+    ++ lib.optional withRoleTester "roletester";

+  buildInputs = [ openssl ]
+    ++ lib.optionals (stdenv.isDarwin && withRdpClient) [ CoreFoundation Security ];
  nativeBuildInputs = [ makeWrapper ];

  patches = [
@ -61,26 +91,31 @@ buildGoModule rec {
    # https://github.com/NixOS/nixpkgs/issues/132652
    ./test.patch
    ./0001-fix-add-nix-path-to-exec-env.patch
+    ./rdpclient.patch
  ];

  # Reduce closure size for client machines
  outputs = [ "out" "client" ];

-  preBuild = ''
+  preBuild =
+    let rustDeps = symlinkJoin {
+      name = "teleport-rust-deps";
+      paths = lib.optional withRdpClient rdpClient
+        ++ lib.optional withRoleTester roleTester;
+    };
+    in
+    ''
      mkdir -p build
      echo "making webassets"
      cp -r ${webassets}/* webassets/
      make lib/web/build/webassets

-    ${lib.optionalString withRoleTester
-      "cp -r ${roleTester}/target lib/datalog/roletester/."}
+      cp -r ${rustDeps}/. .
    '';

-  doCheck = !stdenv.isDarwin;
-
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
+  # Multiple tests fail in the build sandbox
+  # due to trying to spawn nixbld's shell (/noshell), etc.
+  doCheck = false;

  postInstall = ''
    install -Dm755 -t $client/bin $out/bin/tsh
@ -93,6 +128,7 @@ buildGoModule rec {
  installCheckPhase = ''
    $out/bin/tsh version | grep ${version} > /dev/null
    $client/bin/tsh version | grep ${version} > /dev/null
+    $out/bin/tbot version | grep ${version} > /dev/null
    $out/bin/tctl version | grep ${version} > /dev/null
    $out/bin/teleport version | grep ${version} > /dev/null
  '';
--- a/pkgs/servers/teleport/rdpclient.patch
+++ b/pkgs/servers/teleport/rdpclient.patch
@ -0,0 +1,17 @@
+diff --git a/lib/srv/desktop/rdp/rdpclient/client.go b/lib/srv/desktop/rdp/rdpclient/client.go
+index d191c768f..71117a30d 100644
+--- a/lib/srv/desktop/rdp/rdpclient/client.go
+++ b/lib/srv/desktop/rdp/rdpclient/client.go
+@@ -56,10 +56,10 @@ package rdpclient
+ #cgo linux,amd64 LDFLAGS: -L${SRCDIR}/../../../../../target/x86_64-unknown-linux-gnu/release
+ #cgo linux,arm LDFLAGS: -L${SRCDIR}/../../../../../target/arm-unknown-linux-gnueabihf/release
+ #cgo linux,arm64 LDFLAGS: -L${SRCDIR}/../../../../../target/aarch64-unknown-linux-gnu/release
+-#cgo linux LDFLAGS: -l:librdp_client.a -lpthread -ldl -lm
+#cgo linux LDFLAGS: -l:librdp_client.a -lpthread -ldl -lm -lssl -lcrypto
+ #cgo darwin,amd64 LDFLAGS: -L${SRCDIR}/../../../../../target/x86_64-apple-darwin/release
+ #cgo darwin,arm64 LDFLAGS: -L${SRCDIR}/../../../../../target/aarch64-apple-darwin/release
+-#cgo darwin LDFLAGS: -framework CoreFoundation -framework Security -lrdp_client -lpthread -ldl -lm
+#cgo darwin LDFLAGS: -framework CoreFoundation -framework Security -lrdp_client -lpthread -ldl -lm -lssl -lcrypto
+ #include <librdprs.h>
+ */
+ import "C"
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/wrapper.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/wrapper.nix
@ -20,7 +20,7 @@ symlinkJoin {
  postBuild = ''
    for i in bin/emoji-picker libexec/ibus-{setup,engine}-typing-booster; do
      wrapProgram "$out/$i" \
-        --prefix NIX_HUNSPELL_DIRS : ${hunspellDirs}
+        --prefix NIX_HUNSPELL_DIRS : ${lib.escapeShellArg hunspellDirs}
    done

    sed -i -e "s,${typing-booster},$out," $out/share/ibus/component/typing-booster.xml
--- a/pkgs/tools/networking/curl/default.nix
+++ b/pkgs/tools/networking/curl/default.nix
@ -157,6 +157,7 @@ stdenv.mkDerivation rec {
  '' + lib.optionalString stdenv.isDarwin ''
    # bad interaction with sandbox if enabled?
    rm tests/data/test1453
+    rm tests/data/test1086
  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
    # different resolving behaviour?
    rm tests/data/test1592
--- a/pkgs/tools/networking/darkstat/default.nix
+++ b/pkgs/tools/networking/darkstat/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libpcap, zlib }:
+{ lib, stdenv, fetchpatch, fetchurl, libpcap, zlib }:

 stdenv.mkDerivation rec {
  version = "3.0.719";
@ -9,6 +9,15 @@ stdenv.mkDerivation rec {
    sha256 = "1mzddlim6dhd7jhr4smh0n2fa511nvyjhlx76b03vx7phnar1bxf";
  };

+  patches = [
+    # Avoid multiple definitions of CLOCK_REALTIME on macOS 11,
+    # see https://github.com/emikulic/darkstat/pull/2
+    (fetchpatch {
+       url = "https://github.com/emikulic/darkstat/commit/d2fd232e1167dee6e7a2d88b9ab7acf2a129f697.diff";
+       sha256 = "0z5mpyc0q65qb6cn4xcrxl0vx21d8ibzaam5kjyrcw4icd8yg4jb";
+    })
+  ];
+
  buildInputs = [ libpcap zlib ];

  enableParallelBuilding = true;
--- a/pkgs/tools/security/age-plugin-yubikey/default.nix
+++ b/pkgs/tools/security/age-plugin-yubikey/default.nix
@ -5,24 +5,27 @@
 , pkg-config
 , pcsclite
 , PCSC
+, Foundation
 }:

 rustPlatform.buildRustPackage rec {
  pname = "age-plugin-yubikey";
-  version = "0.2.0";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "str4d";
    repo = pname;
-    rev = "51910edfab4006a068864602469ff7db3766bfbe"; # no tag for this release
-    sha256 = "sha256-mMqvBlGFdwe5BaC0bXZg/27BGNmFTTYbLUHWUciqxQ0=";
+    rev = "v${version}";
+    sha256 = "sha256-KXqicTZ9GZlNj1AH3tMmOrC8zjXoEnqo4JJJTBdiI4E=";
  };

-  cargoSha256 = "sha256-OCbVLSmGx51pJ/EPgPfOyVrYWdloNEbexDV1zMsmEJc=";
+  cargoSha256 = "sha256-m/v4E7KHyLIWZHX0TKpqwBVDDwLjhYpOjYMrKEtx6/4=";
+
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ pkg-config ];

-  nativeBuildInputs = [ pkg-config ];
  buildInputs =
    if stdenv.isDarwin then [
+      Foundation
      PCSC
    ] else [
      pcsclite
--- a/pkgs/tools/security/vault/default.nix
+++ b/pkgs/tools/security/vault/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "vault";
-  version = "1.10.2";
+  version = "1.10.3";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "vault";
    rev = "v${version}";
-    sha256 = "sha256-ilyS2M/VRPNz8fW2JFrP09GvX0FlOznqnxJoFvfwUVo=";
+    sha256 = "sha256-12LOYp2ffTC/IOyNyT2PMnkP4FOKT8HROZNRWyTHxhA=";
  };

-  vendorSha256 = "sha256-ZdxpsfTRscgAjrRTq0tXhHe7pGirDgoZ6vlE71oJS9w=";
+  vendorSha256 = "sha256-w5nUkCNo9xfalbc/U7uYaHZsUdyMV3tKDypQM9MnwE4=";

  subPackages = [ "." ];

--- a/pkgs/tools/security/vault/vault-bin.nix
+++ b/pkgs/tools/security/vault/vault-bin.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "vault-bin";
-  version = "1.10.2";
+  version = "1.10.3";

  src =
    let
@ -16,11 +16,11 @@ stdenv.mkDerivation rec {
        aarch64-darwin = "darwin_arm64";
      };
      sha256 = selectSystem {
-        x86_64-linux = "sha256-8DF97kpBRqKvRqCi20QdVgE5T4QugM+Hh+2e1qdZAA8=";
-        aarch64-linux = "sha256-SZ1+q4um6aFMPoF6t5ycOrG5gQQRDNC7SGFJi/JReBI=";
-        i686-linux = "sha256-AatWqF2eDOslpK5J5fyGdrrjkag9GnCJcM0DnYCSZqg=";
-        x86_64-darwin = "sha256-pFQLm967yRiAWHm7PcZRknB4H6ZoEahf4rl8CCdh5AA=";
-        aarch64-darwin = "sha256-Br6fbJUkuIe7BVJU+bGGB9UOQyn2FV+Xy4ajfdfWCcM=";
+        x86_64-linux = "sha256-hz7u6sW415h/AsGlyghImo3K54gbAS92N6L0dI8vV8Q=";
+        aarch64-linux = "sha256-DIrVgHeVvDNx0vRwXt2gzf3HDYzDeYQ2JVy+7KlrLUo=";
+        i686-linux = "sha256-B0xamHI6GnHrKLjhIBvs89keShJ45fRgyM7M214S9jY=";
+        x86_64-darwin = "sha256-ubPcl/e0nwYYw5SrN2jfrGSwLHbi99jklYMDZuVdf6s=";
+        aarch64-darwin = "sha256-4CKrelIzaXu2GccWo2ZTzGSqCMTM1qmJ0drGD8F3c0k=";
      };
    in
    fetchzip {
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -4808,7 +4808,7 @@ with pkgs;
  agebox = callPackage ../tools/security/agebox { };

  age-plugin-yubikey = callPackage ../tools/security/age-plugin-yubikey {
-    inherit (pkgs.darwin.apple_sdk.frameworks) PCSC;
+    inherit (pkgs.darwin.apple_sdk.frameworks) Foundation PCSC;
  };

  artim-dark = callPackage ../data/themes/artim-dark {};
@ -8638,6 +8638,11 @@ with pkgs;
    inherit (linuxPackages) nvidia_x11;
    nvidiaGpuSupport = config.cudaSupport or false;
  };
+  nomad_1_3 = callPackage ../applications/networking/cluster/nomad/1.3.nix {
+    buildGoModule = buildGo117Module;
+    inherit (linuxPackages) nvidia_x11;
+    nvidiaGpuSupport = config.cudaSupport or false;
+  };

  nomad-autoscaler = callPackage ../applications/networking/cluster/nomad-autoscaler { };

@ -10758,7 +10763,9 @@ with pkgs;

  telegraf = callPackage ../servers/monitoring/telegraf { };

-  teleport = callPackage ../servers/teleport {};
+  teleport = callPackage ../servers/teleport {
+    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security;
+  };

  telepresence = callPackage ../tools/networking/telepresence {
    pythonPackages = python3Packages;
@ -16518,9 +16525,7 @@ with pkgs;

  aprutil = callPackage ../development/libraries/apr-util { };

-  aravis = callPackage ../development/libraries/aravis {
-    inherit (gst_all_1) gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad;
-  };
+  aravis = callPackage ../development/libraries/aravis { };

  arb = callPackage ../development/libraries/arb {};

--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@ -36,6 +36,7 @@ mapAliases ({
  aioh2 = throw "aioh2 has been removed because it is abandoned and broken."; # Added 2022-03-30
  ansible-base = throw "ansible-base has been removed, because it is end of life"; # added 2022-03-30
  anyjson = throw "anyjson has been removed, it was using setuptools 2to3 translation feature, which has been removed in setuptools 58"; # added 2022-01-18
+  argon2_cffi = argon2-cffi; # added 2022-05-09
  asyncio-nats-client = nats-py; # added 2022-02-08
  Babel = babel; # added 2022-05-06
  bitcoin-price-api = throw "bitcoin-price-api has been removed, it was using setuptools 2to3 translation feautre, which has been removed in setuptools 58"; # added 2022-02-15
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -627,7 +627,7 @@ in {

  argh = callPackage ../development/python-modules/argh { };

-  argon2_cffi = callPackage ../development/python-modules/argon2_cffi { };
+  argon2-cffi = callPackage ../development/python-modules/argon2-cffi { };

  argon2-cffi-bindings = callPackage ../development/python-modules/argon2-cffi-bindings { };

@ -2432,6 +2432,8 @@ in {
    inherit (pkgs) dlib;
  };

+  dlinfo = callPackage ../development/python-modules/dlinfo { };
+
  dlx = callPackage ../development/python-modules/dlx { };

  dmenu-python = callPackage ../development/python-modules/dmenu { };