Merge remote-tracking branch 'origin/master' into haskell-updates

2022-04-05 21:21:42 +02:00 · 2022-04-05 21:21:42 +02:00 · fb2fc3b4a4
commit fb2fc3b4a4
parent a964dcad73 bef07673d3
893 changed files with 9415 additions and 6864 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -242,9 +242,8 @@

 # Docker tools
 /pkgs/build-support/docker                   @roberth
-/nixos/tests/docker-tools-overlay.nix        @roberth
-/nixos/tests/docker-tools.nix                @roberth
-/doc/builders/images/dockertools.xml         @roberth
+/nixos/tests/docker-tools*                   @roberth
+/doc/builders/images/dockertools.section.md  @roberth

 # Blockchains
 /pkgs/applications/blockchains  @mmahut @RaghavSood
--- a/doc/languages-frameworks/go.section.md
+++ b/doc/languages-frameworks/go.section.md
@ -142,4 +142,8 @@ Removes the pre-existing vendor directory. This should only be used if the depen

 ### `subPackages` {#var-go-subPackages}

-Limits the builder from building child packages that have not been listed. If `subPackages` is not specified, all child packages will be built.
+Specified as a string or list of strings. Limits the builder from building child packages that have not been listed. If `subPackages` is not specified, all child packages will be built.
+
+### `excludedPackages` {#var-go-excludedPackages}
+
+Specified as a string or list of strings. Causes the builder to skip building child packages that match any of the provided values. If `excludedPackages` is not specified, all child packages will be built.
--- a/lib/strings.nix
+++ b/lib/strings.nix
@ -756,7 +756,14 @@ rec {
       sanitizeDerivationName pkgs.hello
       => "-nix-store-2g75chlbpxlrqn15zlby2dfh8hr9qwbk-hello-2.10"
  */
-  sanitizeDerivationName = string: lib.pipe string [
+  sanitizeDerivationName =
+  let okRegex = match "[[:alnum:]+_?=-][[:alnum:]+._?=-]*";
+  in
+  string:
+  # First detect the common case of already valid strings, to speed those up
+  if stringLength string <= 207 && okRegex string != null
+  then unsafeDiscardStringContext string
+  else lib.pipe string [
    # Get rid of string context. This is safe under the assumption that the
    # resulting string is only used as a derivation name
    unsafeDiscardStringContext
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -649,6 +649,11 @@ runTests {
    expected = "foo";
  };

+  testSanitizeDerivationNameUnicode = testSanitizeDerivationName {
+    name = "fö";
+    expected = "f-";
+  };
+
  testSanitizeDerivationNameAscii = testSanitizeDerivationName {
    name = " !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~";
    expected = "-+--.-0123456789-=-?-ABCDEFGHIJKLMNOPQRSTUVWXYZ-_-abcdefghijklmnopqrstuvwxyz-";
--- a/maintainers/scripts/dep-licenses.sh
+++ b/maintainers/scripts/dep-licenses.sh
@ -9,7 +9,7 @@ tmp=$(mktemp --tmpdir -d nixpkgs-dep-license.XXXXXX)
 exitHandler() {
    exitCode=$?
    rm -rf "$tmp"
-    exit $exitCode
+    return $exitCode
 }

 trap "exitHandler" EXIT
--- a/maintainers/scripts/pluginupdate.py
+++ b/maintainers/scripts/pluginupdate.py
@ -8,6 +8,7 @@
 # $ nix run nixpkgs.python3Packages.flake8 -c flake8 --ignore E501,E265 update.py

 import argparse
+import csv
 import functools
 import http
 import json
@ -28,7 +29,7 @@ from pathlib import Path
 from typing import Dict, List, Optional, Tuple, Union, Any, Callable
 from urllib.parse import urljoin, urlparse
 from tempfile import NamedTemporaryFile
-from dataclasses import dataclass
+from dataclasses import dataclass, asdict

 import git

@ -85,21 +86,30 @@ def make_request(url: str, token=None) -> urllib.request.Request:
        headers["Authorization"] = f"token {token}"
    return urllib.request.Request(url, headers=headers)

+
+Redirects = Dict['Repo', 'Repo']
+
 class Repo:
    def __init__(
-        self, uri: str, branch: str, alias: Optional[str]
+        self, uri: str, branch: str
    ) -> None:
        self.uri = uri
        '''Url to the repo'''
-        self.branch = branch
-        self.alias = alias
-        self.redirect: Dict[str, str] = {}
+        self._branch = branch
+        # {old_uri: new_uri}
+        self.redirect: Redirects = {}
        self.token = "dummy_token"

    @property
    def name(self):
        return self.uri.split('/')[-1]

+    @property
+    def branch(self):
+        return self._branch or "HEAD"
+
+    def __str__(self) -> str:
+        return f"{self.uri}"
    def __repr__(self) -> str:
        return f"Repo({self.name}, {self.uri})"

@ -109,6 +119,7 @@ class Repo:

    @retry(urllib.error.URLError, tries=4, delay=3, backoff=2)
    def latest_commit(self) -> Tuple[str, datetime]:
+        log.debug("Latest commit")
        loaded = self._prefetch(None)
        updated = datetime.strptime(loaded['date'], "%Y-%m-%dT%H:%M:%S%z")

@ -124,6 +135,7 @@ class Repo:
        return loaded

    def prefetch(self, ref: Optional[str]) -> str:
+        print("Prefetching")
        loaded = self._prefetch(ref)
        return loaded["sha256"]

@ -137,21 +149,22 @@ class Repo:

 class RepoGitHub(Repo):
    def __init__(
-        self, owner: str, repo: str, branch: str, alias: Optional[str]
+        self, owner: str, repo: str, branch: str
    ) -> None:
        self.owner = owner
        self.repo = repo
        self.token = None
        '''Url to the repo'''
-        super().__init__(self.url(""), branch, alias)
-        log.debug("Instantiating github repo %s/%s", self.owner, self.repo)
+        super().__init__(self.url(""), branch)
+        log.debug("Instantiating github repo owner=%s and repo=%s", self.owner, self.repo)

    @property
    def name(self):
        return self.repo

    def url(self, path: str) -> str:
-        return urljoin(f"https://github.com/{self.owner}/{self.name}/", path)
+        res = urljoin(f"https://github.com/{self.owner}/{self.repo}/", path)
+        return res

    @retry(urllib.error.URLError, tries=4, delay=3, backoff=2)
    def has_submodules(self) -> bool:
@ -168,6 +181,7 @@ class RepoGitHub(Repo):
    @retry(urllib.error.URLError, tries=4, delay=3, backoff=2)
    def latest_commit(self) -> Tuple[str, datetime]:
        commit_url = self.url(f"commits/{self.branch}.atom")
+        log.debug("Sending request to %s", commit_url)
        commit_req = make_request(commit_url, self.token)
        with urllib.request.urlopen(commit_req, timeout=10) as req:
            self._check_for_redirect(commit_url, req)
@ -191,12 +205,9 @@ class RepoGitHub(Repo):
            new_owner, new_name = (
                urllib.parse.urlsplit(response_url).path.strip("/").split("/")[:2]
            )
-            end_line = "\n" if self.alias is None else f" as {self.alias}\n"
-            plugin_line = "{owner}/{name}" + end_line

-            old_plugin = plugin_line.format(owner=self.owner, name=self.name)
-            new_plugin = plugin_line.format(owner=new_owner, name=new_name)
-            self.redirect[old_plugin] = new_plugin
+            new_repo = RepoGitHub(owner=new_owner, repo=new_name, branch=self.branch)
+            self.redirect[self] = new_repo


    def prefetch(self, commit: str) -> str:
@ -207,9 +218,9 @@ class RepoGitHub(Repo):
        return sha256

    def prefetch_github(self, ref: str) -> str:
-        data = subprocess.check_output(
-            ["nix-prefetch-url", "--unpack", self.url(f"archive/{ref}.tar.gz")]
-        )
+        cmd = ["nix-prefetch-url", "--unpack", self.url(f"archive/{ref}.tar.gz")]
+        log.debug("Running %s", cmd)
+        data = subprocess.check_output(cmd)
        return data.strip().decode("utf-8")

    def as_nix(self, plugin: "Plugin") -> str:
@ -239,21 +250,38 @@ class PluginDesc:
        else:
            return self.alias

+    def __lt__(self, other):
+        return self.repo.name < other.repo.name

+    @staticmethod
+    def load_from_csv(config: FetchConfig, row: Dict[str, str]) -> 'PluginDesc':
+        branch = row["branch"]
+        repo = make_repo(row['repo'], branch.strip())
+        repo.token = config.github_token
+        return PluginDesc(repo, branch.strip(), row["alias"])
+
+
+    @staticmethod
+    def load_from_string(config: FetchConfig, line: str) -> 'PluginDesc':
+        branch = "HEAD"
+        alias = None
+        uri = line
+        if " as " in uri:
+            uri, alias = uri.split(" as ")
+            alias = alias.strip()
+        if "@" in uri:
+            uri, branch = uri.split("@")
+        repo = make_repo(uri.strip(), branch.strip())
+        repo.token = config.github_token
+        return PluginDesc(repo, branch.strip(), alias)
+
+@dataclass
 class Plugin:
-    def __init__(
-        self,
-        name: str,
-        commit: str,
-        has_submodules: bool,
-        sha256: str,
-        date: Optional[datetime] = None,
-    ) -> None:
-        self.name = name
-        self.commit = commit
-        self.has_submodules = has_submodules
-        self.sha256 = sha256
-        self.date = date
+    name: str
+    commit: str
+    has_submodules: bool
+    sha256: str
+    date: Optional[datetime] = None

    @property
    def normalized_name(self) -> str:
@ -270,6 +298,17 @@ class Plugin:
        return copy


+def load_plugins_from_csv(config: FetchConfig, input_file: Path,) -> List[PluginDesc]:
+    log.debug("Load plugins from csv %s", input_file)
+    plugins = []
+    with open(input_file, newline='') as csvfile:
+        log.debug("Writing into %s", input_file)
+        reader = csv.DictReader(csvfile,)
+        for line in reader:
+            plugin = PluginDesc.load_from_csv(config, line)
+            plugins.append(plugin)
+
+    return plugins

 class Editor:
    """The configuration of the update script."""
@ -298,14 +337,8 @@ class Editor:
        return get_current_plugins(self)

    def load_plugin_spec(self, config: FetchConfig, plugin_file) -> List[PluginDesc]:
-        plugins = []
-        with open(plugin_file) as f:
-            for line in f:
-                if line.startswith("#"):
-                    continue
-                plugin = parse_plugin_line(config, line)
-                plugins.append(plugin)
-        return plugins
+        '''CSV spec'''
+        return load_plugins_from_csv(config, plugin_file)

    def generate_nix(self, plugins, outfile: str):
        '''Returns nothing for now, writes directly to outfile'''
@ -316,11 +349,11 @@ class Editor:
        _prefetch = functools.partial(prefetch, cache=cache)

        def update() -> dict:
-            plugin_names = self.load_plugin_spec(config, input_file)
+            plugins = self.load_plugin_spec(config, input_file)

            try:
                pool = Pool(processes=config.proc)
-                results = pool.map(_prefetch, plugin_names)
+                results = pool.map(_prefetch, plugins)
            finally:
                cache.store()

@ -423,6 +456,7 @@ def get_current_plugins(editor: Editor) -> List[Plugin]:
    data = json.loads(out)
    plugins = []
    for name, attr in data.items():
+        print("get_current_plugins: name %s" % name)
        p = Plugin(name, attr["rev"], attr["submodules"], attr["sha256"])
        plugins.append(p)
    return plugins
@ -431,7 +465,7 @@ def get_current_plugins(editor: Editor) -> List[Plugin]:
 def prefetch_plugin(
    p: PluginDesc,
    cache: "Optional[Cache]" = None,
-) -> Tuple[Plugin, Dict[str, str]]:
+) -> Tuple[Plugin, Redirects]:
    repo, branch, alias = p.repo, p.branch, p.alias
    name = alias or p.repo.name
    commit = None
@ -454,11 +488,6 @@ def prefetch_plugin(
    )


-def fetch_plugin_from_pluginline(config: FetchConfig, plugin_line: str) -> Plugin:
-    plugin, _ = prefetch_plugin(parse_plugin_line(config, plugin_line))
-    return plugin
-
-
 def print_download_error(plugin: str, ex: Exception):
    print(f"{plugin}: {ex}", file=sys.stderr)
    ex_traceback = ex.__traceback__
@ -468,14 +497,14 @@ def print_download_error(plugin: str, ex: Exception):
    ]
    print("\n".join(tb_lines))

-
 def check_results(
-    results: List[Tuple[PluginDesc, Union[Exception, Plugin], Dict[str, str]]]
-) -> Tuple[List[Tuple[PluginDesc, Plugin]], Dict[str, str]]:
+    results: List[Tuple[PluginDesc, Union[Exception, Plugin], Redirects]]
+) -> Tuple[List[Tuple[PluginDesc, Plugin]], Redirects]:
    ''' '''
    failures: List[Tuple[str, Exception]] = []
    plugins = []
-    redirects: Dict[str, str] = {}
+    # {old: new} plugindesc
+    redirects: Dict[Repo, Repo] = {}
    for (pdesc, result, redirect) in results:
        if isinstance(result, Exception):
            failures.append((pdesc.name, result))
@ -495,31 +524,17 @@ def check_results(

        sys.exit(1)

-def make_repo(uri, branch, alias) -> Repo:
+def make_repo(uri: str, branch) -> Repo:
    '''Instantiate a Repo with the correct specialization depending on server (gitub spec)'''
    # dumb check to see if it's of the form owner/repo (=> github) or https://...
-    res = uri.split('/')
-    if len(res) <= 2:
-        repo = RepoGitHub(res[0], res[1], branch, alias)
+    res = urlparse(uri)
+    if res.netloc in [ "github.com", ""]:
+        res = res.path.strip('/').split('/')
+        repo = RepoGitHub(res[0], res[1], branch)
    else:
-        repo = Repo(uri.strip(), branch, alias)
+        repo = Repo(uri.strip(), branch)
    return repo

-def parse_plugin_line(config: FetchConfig, line: str) -> PluginDesc:
-    branch = "HEAD"
-    alias = None
-    uri = line
-    if " as " in uri:
-        uri, alias = uri.split(" as ")
-        alias = alias.strip()
-    if "@" in uri:
-        uri, branch = uri.split("@")
-
-    repo = make_repo(uri.strip(), branch.strip(), alias)
-    repo.token = config.github_token
-
-    return PluginDesc(repo, branch.strip(), alias)
-

 def get_cache_path(cache_file_name: str) -> Optional[Path]:
    xdg_cache = os.environ.get("XDG_CACHE_HOME", None)
@ -585,27 +600,27 @@ def prefetch(
        return (pluginDesc, e, {})


+
 def rewrite_input(
    config: FetchConfig,
    input_file: Path,
    deprecated: Path,
-    redirects: Dict[str, str] = None,
-    append: Tuple = (),
+    # old pluginDesc and the new
+    redirects: Dict[PluginDesc, PluginDesc] = {},
+    append: List[PluginDesc] = [],
 ):
-    with open(input_file, "r") as f:
-        lines = f.readlines()
+    plugins = load_plugins_from_csv(config, input_file,)

-    lines.extend(append)
+    plugins.extend(append)

    if redirects:
-        lines = [redirects.get(line, line) for line in lines]

        cur_date_iso = datetime.now().strftime("%Y-%m-%d")
        with open(deprecated, "r") as f:
            deprecations = json.load(f)
        for old, new in redirects.items():
-            old_plugin = fetch_plugin_from_pluginline(config, old)
-            new_plugin = fetch_plugin_from_pluginline(config, new)
+            old_plugin, _ = prefetch_plugin(old)
+            new_plugin, _ = prefetch_plugin(new)
            if old_plugin.normalized_name != new_plugin.normalized_name:
                deprecations[old_plugin.normalized_name] = {
                    "new": new_plugin.normalized_name,
@ -615,10 +630,14 @@ def rewrite_input(
            json.dump(deprecations, f, indent=4, sort_keys=True)
            f.write("\n")

-    lines = sorted(lines, key=str.casefold)
-
    with open(input_file, "w") as f:
-        f.writelines(lines)
+        log.debug("Writing into %s", input_file)
+        # fields = dataclasses.fields(PluginDesc)
+        fieldnames = ['repo', 'branch', 'alias']
+        writer = csv.DictWriter(f, fieldnames, dialect='unix', quoting=csv.QUOTE_NONE)
+        writer.writeheader()
+        for plugin in sorted(plugins):
+            writer.writerow(asdict(plugin))


 def commit(repo: git.Repo, message: str, files: List[Path]) -> None:
@ -660,9 +679,11 @@ def update_plugins(editor: Editor, args):
            )

    for plugin_line in args.add_plugins:
-        editor.rewrite_input(fetch_config, args.input_file, editor.deprecated, append=(plugin_line + "\n",))
+        pdesc = PluginDesc.load_from_string(fetch_config, plugin_line)
+        append = [ pdesc ]
+        editor.rewrite_input(fetch_config, args.input_file, editor.deprecated, append=append)
        update()
-        plugin = fetch_plugin_from_pluginline(fetch_config, plugin_line)
+        plugin, _ = prefetch_plugin(pdesc, )
        if autocommit:
            commit(
                nixpkgs_repo,
--- a/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-1803.section.xml
@ -866,6 +866,14 @@
          package.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The vim/kakoune plugin updater now reads from a CSV file:
+          check
+          <literal>pkgs/applications/editors/vim/plugins/vim-plugin-names</literal>
+          out to see the new format
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
 </section>
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -68,6 +68,11 @@
          granular distinction between reloads and restarts.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          Systemd has been upgraded to the version 250.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <link xlink:href="https://kops.sigs.k8s.io"><literal>kops</literal></link>
@ -444,6 +449,12 @@
          relying on the insecure behaviour before upgrading.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>openssh</literal> has been update to 8.9p1, changing
+          the FIDO security key middleware interface.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>services.k3s.enable</literal> no longer implies
@ -1512,9 +1523,11 @@
        <para>
          <link linkend="opt-programs.ssh.knownHosts">programs.ssh.knownHosts</link>
          has gained an <literal>extraHostNames</literal> option to
-          replace <literal>hostNames</literal>.
-          <literal>hostNames</literal> is deprecated, but still
-          available for now.
+          augment <literal>hostNames</literal>. It is now possible to
+          use the attribute name of a <literal>knownHosts</literal>
+          entry as the primary host name and specify secondary host
+          names using <literal>extraHostNames</literal> without having
+          to duplicate the primary host name.
        </para>
      </listitem>
      <listitem>
--- a/nixos/doc/manual/release-notes/rl-1803.section.md
+++ b/nixos/doc/manual/release-notes/rl-1803.section.md
@ -282,3 +282,5 @@ When upgrading from a previous release, please be aware of the following incompa
 - The NixOS test driver supports user services declared by `systemd.user.services`. The methods `waitForUnit`, `getUnitInfo`, `startJob` and `stopJob` provide an optional `$user` argument for that purpose.

 - Enabling bash completion on NixOS, `programs.bash.enableCompletion`, will now also enable completion for the Nix command line tools by installing the [nix-bash-completions](https://github.com/hedning/nix-bash-completions) package.
+
+- The vim/kakoune plugin updater now reads from a CSV file: check `pkgs/applications/editors/vim/plugins/vim-plugin-names` out to see the new format
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -25,6 +25,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - systemd services can now set [systemd.services.\<name\>.reloadTriggers](#opt-systemd.services) instead of `reloadIfChanged` for a more granular distinction between reloads and restarts.

+- Systemd has been upgraded to the version 250.
+
 - [`kops`](https://kops.sigs.k8s.io) defaults to 1.22.4, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes 1.22. This will increase security by default, but may break some types of workloads. See the [release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) for details.

 - Module authors can use `mkRenamedOptionModuleWith` to automate the deprecation cycle without annoying out-of-tree module authors and their users.
@ -143,6 +145,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `services.kubernetes.scheduler.{port,address}` now set `--secure-port` and `--bind-address` instead of `--port` and `--address`, since the former have been deprecated and are no longer functional in kubernetes>=1.23. Ensure that you are not relying on the insecure behaviour before upgrading.

+- `openssh` has been update to 8.9p1, changing the FIDO security key middleware interface.
+
 - `services.k3s.enable` no longer implies `systemd.enableUnifiedCgroupHierarchy = false`, and will default to the 'systemd' cgroup driver when using `services.k3s.docker = true`.
  This change may require a reboot to take effect, and k3s may not be able to run if the boot cgroup hierarchy does not match its configuration.
  The previous behavior may be retained by explicitly setting `systemd.enableUnifiedCgroupHierarchy = false` in your configuration.
@ -537,7 +541,9 @@ In addition to numerous new and upgraded packages, this release has the followin
  e.g. Wayland.

 - [programs.ssh.knownHosts](#opt-programs.ssh.knownHosts) has gained an `extraHostNames`
-  option to replace `hostNames`. `hostNames` is deprecated, but still available for now.
+  option to augment `hostNames`. It is now possible to use the attribute name of a `knownHosts`
+  entry as the primary host name and specify secondary host names using `extraHostNames` without
+  having to duplicate the primary host name.

 - The `services.stubby` module was converted to a [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.

--- a/nixos/lib/make-disk-image.nix
+++ b/nixos/lib/make-disk-image.nix
@ -170,6 +170,7 @@ let format' = format; in let
      config.system.build.nixos-install
      config.system.build.nixos-enter
      nix
+      systemdMinimal
    ] ++ stdenv.initialPath);

  # I'm preserving the line below because I'm going to search for it across nixpkgs to consolidate
--- a/nixos/modules/programs/ssh.nix
+++ b/nixos/modules/programs/ssh.nix
@ -157,9 +157,13 @@ in
              default = [ name ] ++ config.extraHostNames;
              defaultText = literalExpression "[ ${name} ] ++ config.${options.extraHostNames}";
              description = ''
-                DEPRECATED, please use <literal>extraHostNames</literal>.
                A list of host names and/or IP numbers used for accessing
-                the host's ssh service.
+                the host's ssh service. This list includes the name of the
+                containing <literal>knownHosts</literal> attribute by default
+                for convenience. If you wish to configure multiple host keys
+                for the same host use multiple <literal>knownHosts</literal>
+                entries with different attribute names and the same
+                <literal>hostNames</literal> list.
              '';
            };
            extraHostNames = mkOption {
@ -167,7 +171,8 @@ in
              default = [];
              description = ''
                A list of additional host names and/or IP numbers used for
-                accessing the host's ssh service.
+                accessing the host's ssh service. This list is ignored if
+                <literal>hostNames</literal> is set explicitly.
              '';
            };
            publicKey = mkOption {
@ -198,7 +203,12 @@ in
          };
        }));
        description = ''
-          The set of system-wide known SSH hosts.
+          The set of system-wide known SSH hosts. To make simple setups more
+          convenient the name of an attribute in this set is used as a host name
+          for the entry. This behaviour can be disabled by setting
+          <literal>hostNames</literal> explicitly. You can use
+          <literal>extraHostNames</literal> to add additional host names without
+          disabling this default.
        '';
        example = literalExpression ''
          {
@ -207,6 +217,10 @@ in
              publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
            };
            "myhost2.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIRuJ8p1Fi+m6WkHV0KWnRfpM1WxoW8XAS+XvsSKsTK";
+            "myhost2.net/dsa" = {
+              hostNames = [ "myhost2.net" ];
+              publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
+            };
          }
        '';
      };
@ -279,9 +293,6 @@ in
        message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
      });

-    warnings = mapAttrsToList (name: _: ''programs.ssh.knownHosts.${name}.hostNames is deprecated, use programs.ssh.knownHosts.${name}.extraHostNames'')
-      (filterAttrs (name: {hostNames, extraHostNames, ...}: hostNames != [ name ] ++ extraHostNames) cfg.knownHosts);
-
    # SSH configuration. Slight duplication of the sshd_config
    # generation in the sshd service.
    environment.etc."ssh/ssh_config".text =
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@ -708,6 +708,14 @@ in

    systemd.packages = [ nixPackage ];

+    # Will only work once https://github.com/NixOS/nix/pull/6285 is merged
+    # systemd.tmpfiles.packages = [ nixPackage ];
+
+    # Can be dropped for Nix > https://github.com/NixOS/nix/pull/6285
+    systemd.tmpfiles.rules = [
+      "d /nix/var/nix/daemon-socket 0755 root root - -"
+    ];
+
    systemd.sockets.nix-daemon.wantedBy = [ "sockets.target" ];

    systemd.services.nix-daemon =
--- a/nixos/modules/services/network-filesystems/ipfs.nix
+++ b/nixos/modules/services/network-filesystems/ipfs.nix
@ -267,11 +267,15 @@ in
      '' + ''
        ipfs --offline config show \
          | ${pkgs.jq}/bin/jq '. * $extraConfig' --argjson extraConfig ${
-              escapeShellArg (builtins.toJSON ({
-                Addresses.API = cfg.apiAddress;
-                Addresses.Gateway = cfg.gatewayAddress;
-                Addresses.Swarm = cfg.swarmAddress;
-              } // cfg.extraConfig))
+              escapeShellArg (builtins.toJSON (
+                recursiveUpdate
+                  {
+                    Addresses.API = cfg.apiAddress;
+                    Addresses.Gateway = cfg.gatewayAddress;
+                    Addresses.Swarm = cfg.swarmAddress;
+                  }
+                  cfg.extraConfig
+              ))
            } \
          | ipfs --offline config replace -
      '';
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -281,6 +281,8 @@ let
          "PrivateKeyFile"
          "ListenPort"
          "FirewallMark"
+          "RouteTable"
+          "RouteMetric"
        ])
        (assertInt "FirewallMark")
        (assertRange "FirewallMark" 1 4294967295)
@ -296,6 +298,8 @@ let
          "AllowedIPs"
          "Endpoint"
          "PersistentKeepalive"
+          "RouteTable"
+          "RouteMetric"
        ])
        (assertInt "PersistentKeepalive")
        (assertRange "PersistentKeepalive" 0 65535)
--- a/nixos/modules/system/boot/stage-1-init.sh
+++ b/nixos/modules/system/boot/stage-1-init.sh
@ -232,7 +232,8 @@ done
 mkdir -p /lib
 ln -s @modulesClosure@/lib/modules /lib/modules
 ln -s @modulesClosure@/lib/firmware /lib/firmware
-echo @extraUtils@/bin/modprobe > /proc/sys/kernel/modprobe
+# see comment in stage-1.nix for explanation
+echo @extraUtils@/bin/modprobe-kernel > /proc/sys/kernel/modprobe
 for i in @kernelModules@; do
    info "loading module $(basename $i)..."
    modprobe $i
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -131,6 +131,26 @@ let
      copy_bin_and_libs ${pkgs.kmod}/bin/kmod
      ln -sf kmod $out/bin/modprobe

+      # Dirty hack to make sure the kernel properly loads modules
+      # such as ext4 on demand (e.g. on a `mount(2)` syscall). This is necessary
+      # because `kmod` isn't linked against `libpthread.so.0` anymore (since
+      # it was merged into `libc.so.6` since version `2.34`), but still needs
+      # to access it for some reason. This is not an issue in stage-1 itself
+      # because of the `LD_LIBRARY_PATH`-variable and anytime later because the rpath of
+      # kmod/modprobe points to glibc's `$out/lib` where `libpthread.so.6` exists.
+      # However, this is a problem when the kernel calls `modprobe` inside
+      # the initial ramdisk because it doesn't know about the
+      # `LD_LIBRARY_PATH` and the rpath was nuked.
+      #
+      # Also, we can't use `makeWrapper` here because `kmod` only does
+      # `modprobe` functionality if `argv[0] == "modprobe"`.
+      cat >$out/bin/modprobe-kernel <<EOF
+      #!$out/bin/ash
+      export LD_LIBRARY_PATH=$out/lib
+      exec $out/bin/modprobe "\$@"
+      EOF
+      chmod +x $out/bin/modprobe-kernel
+
      # Copy resize2fs if any ext* filesystems are to be resized
      ${optionalString (any (fs: fs.autoResize && (lib.hasPrefix "ext" fs.fsType)) fileSystems) ''
        # We need mke2fs in the initrd.
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -108,7 +108,7 @@ let

  fileSystems = filter utils.fsNeededForBoot config.system.build.fileSystems;

-  fstab = pkgs.writeText "fstab" (lib.concatMapStringsSep "\n"
+  fstab = pkgs.writeText "initrd-fstab" (lib.concatMapStringsSep "\n"
    ({ fsType, mountPoint, device, options, autoFormat, autoResize, ... }@fs: let
        opts = options ++ optional autoFormat "x-systemd.makefs" ++ optional autoResize "x-systemd.growfs";
      in "${device} /sysroot${mountPoint} ${fsType} ${lib.concatStringsSep "," opts}") fileSystems);
@ -128,11 +128,7 @@ let
    name = "initrd-emergency-env";
    paths = map getBin cfg.initrdBin;
    pathsToLink = ["/bin" "/sbin"];
-    # Make recovery easier
-    postBuild = ''
-      ln -s ${cfg.package.util-linux}/bin/mount $out/bin/
-      ln -s ${cfg.package.util-linux}/bin/umount $out/bin/
-    '';
+    postBuild = concatStringsSep "\n" (mapAttrsToList (n: v: "ln -s '${v}' $out/bin/'${n}'") cfg.extraBin);
  };

  initialRamdisk = pkgs.makeInitrdNG {
@ -205,6 +201,19 @@ in {
      default = [];
    };

+    extraBin = mkOption {
+      description = ''
+        Tools to add to /bin
+      '';
+      example = literalExpression ''
+        {
+          umount = ''${pkgs.util-linux}/bin/umount;
+        }
+      '';
+      type = types.attrsOf types.path;
+      default = {};
+    };
+
    suppressedStorePaths = mkOption {
      description = ''
        Store paths specified in the storePaths option that
@ -342,8 +351,15 @@ in {

  config = mkIf (config.boot.initrd.enable && cfg.enable) {
    system.build = { inherit initialRamdisk; };
+
+    boot.initrd.availableKernelModules = [ "autofs4" ]; # systemd needs this for some features
+
    boot.initrd.systemd = {
      initrdBin = [pkgs.bash pkgs.coreutils pkgs.kmod cfg.package] ++ config.system.fsPackages;
+      extraBin = {
+        mount = "${cfg.package.util-linux}/bin/mount";
+        umount = "${cfg.package.util-linux}/bin/umount";
+      };

      contents = {
        "/init".source = "${cfg.package}/lib/systemd/systemd";
--- a/nixos/modules/system/boot/timesyncd.nix
+++ b/nixos/modules/system/boot/timesyncd.nix
@ -60,15 +60,27 @@ with lib;
    };
    users.groups.systemd-timesync.gid = config.ids.gids.systemd-timesync;

-    system.activationScripts.systemd-timesyncd-migration = mkIf (versionOlder config.system.stateVersion "19.09") ''
+    system.activationScripts.systemd-timesyncd-migration =
      # workaround an issue of systemd-timesyncd not starting due to upstream systemd reverting their dynamic users changes
      #  - https://github.com/NixOS/nixpkgs/pull/61321#issuecomment-492423742
      #  - https://github.com/systemd/systemd/issues/12131
-      if [ -L /var/lib/systemd/timesync ]; then
-        rm /var/lib/systemd/timesync
-        mv /var/lib/private/systemd/timesync /var/lib/systemd/timesync
+      mkIf (versionOlder config.system.stateVersion "19.09") ''
+        if [ -L /var/lib/systemd/timesync ]; then
+          rm /var/lib/systemd/timesync
+          mv /var/lib/private/systemd/timesync /var/lib/systemd/timesync
+        fi
+      '';
+    system.activationScripts.systemd-timesyncd-init-clock =
+      # Ensure that we have some stored time to prevent systemd-timesyncd to
+      # resort back to the fallback time.
+      # If the file doesn't exist we assume that our current system clock is
+      # good enough to provide an initial value.
+      ''
+      if ! [ -f /var/lib/systemd/timesync/clock ]; then
+        test -d /var/lib/systemd/timesync || mkdir -p /var/lib/systemd/timesync
+        touch /var/lib/systemd/timesync/clock
      fi
-    '';
+      '';
  };

 }
--- a/nixos/modules/tasks/lvm.nix
+++ b/nixos/modules/tasks/lvm.nix
@ -7,17 +7,18 @@ in {
  options.services.lvm = {
    package = mkOption {
      type = types.package;
-      default = if cfg.dmeventd.enable then pkgs.lvm2_dmeventd else pkgs.lvm2;
+      default = pkgs.lvm2;
      internal = true;
      defaultText = literalExpression "pkgs.lvm2";
      description = ''
        This option allows you to override the LVM package that's used on the system
        (udev rules, tmpfiles, systemd services).
-        Defaults to pkgs.lvm2, or pkgs.lvm2_dmeventd if dmeventd is enabled.
+        Defaults to pkgs.lvm2, pkgs.lvm2_dmeventd if dmeventd or pkgs.lvm2_vdo if vdo is enabled.
      '';
    };
    dmeventd.enable = mkEnableOption "the LVM dmevent daemon";
    boot.thin.enable = mkEnableOption "support for booting from ThinLVs";
+    boot.vdo.enable = mkEnableOption "support for booting from VDOLVs";
  };

  config = mkMerge [
@ -40,6 +41,7 @@ in {
      environment.etc."lvm/lvm.conf".text = ''
        dmeventd/executable = "${cfg.package}/bin/dmeventd"
      '';
+      services.lvm.package = mkDefault pkgs.lvm2_dmeventd;
    })
    (mkIf cfg.boot.thin.enable {
      boot.initrd = {
@ -61,6 +63,32 @@ in {
      environment.etc."lvm/lvm.conf".text = concatMapStringsSep "\n"
        (bin: "global/${bin}_executable = ${pkgs.thin-provisioning-tools}/bin/${bin}")
        [ "thin_check" "thin_dump" "thin_repair" "cache_check" "cache_dump" "cache_repair" ];
+
+      environment.systemPackages = [ pkgs.thin-provisioning-tools ];
+    })
+    (mkIf cfg.boot.vdo.enable {
+      boot = {
+        initrd = {
+          kernelModules = [ "kvdo" ];
+
+          extraUtilsCommands = ''
+            ls ${pkgs.vdo}/bin/ | grep -v adaptLVMVDO | while read BIN; do
+              copy_bin_and_libs ${pkgs.vdo}/bin/$BIN
+            done
+          '';
+
+          extraUtilsCommandsTest = ''
+            ls ${pkgs.vdo}/bin/ | grep -v adaptLVMVDO | while read BIN; do
+              $out/bin/$(basename $BIN) --help > /dev/null
+            done
+          '';
+        };
+        extraModulePackages = [ config.boot.kernelPackages.kvdo ];
+      };
+
+      services.lvm.package = mkOverride 999 pkgs.lvm2_vdo;  # this overrides mkDefault
+
+      environment.systemPackages = [ pkgs.vdo ];
    })
    (mkIf (cfg.dmeventd.enable || cfg.boot.thin.enable) {
      boot.initrd.preLVMCommands = ''
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -274,6 +274,7 @@ in
  login = handleTest ./login.nix {};
  logrotate = handleTest ./logrotate.nix {};
  loki = handleTest ./loki.nix {};
+  lvm2 = handleTest ./lvm2 {};
  lxd = handleTest ./lxd.nix {};
  lxd-image = handleTest ./lxd-image.nix {};
  lxd-nftables = handleTest ./lxd-nftables.nix {};
--- a/nixos/tests/atop.nix
+++ b/nixos/tests/atop.nix
@ -182,10 +182,6 @@ in
  atopgpu = makeTest {
    name = "atop-atopgpu";
    nodes.machine = {
-      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (getName pkg) [
-        "cudatoolkit"
-      ];
-
      programs.atop = {
        enable = true;
        atopgpu.enable = true;
@ -205,10 +201,6 @@ in
  everything = makeTest {
    name = "atop-everthing";
    nodes.machine = {
-      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (getName pkg) [
-        "cudatoolkit"
-      ];
-
      programs.atop = {
        enable = true;
        settings = {
--- a/nixos/tests/docker-tools-cross.nix
+++ b/nixos/tests/docker-tools-cross.nix
@ -7,7 +7,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
 let

  remoteSystem =
-    if pkgs.system == "aarch64-linux"
+    if pkgs.stdenv.hostPlatform.system == "aarch64-linux"
    then "x86_64-linux"
    else "aarch64-linux";

@ -18,7 +18,7 @@ let

    # NOTE: Since this file can't control where the test will be _run_ we don't
    #       cross-compile _to_ a different system but _from_ a different system
-    crossSystem = pkgs.system;
+    crossSystem = pkgs.stdenv.hostPlatform.system;
  };

  hello1 = remoteCrossPkgs.dockerTools.buildImage {
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@ -315,7 +315,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
                "docker inspect ${pkgs.dockerTools.examples.cross.imageName} "
                + "| ${pkgs.jq}/bin/jq -r .[].Architecture"
            ).strip()
-            == "${if pkgs.system == "aarch64-linux" then "amd64" else "arm64"}"
+            == "${if pkgs.stdenv.hostPlatform.system == "aarch64-linux" then "amd64" else "arm64"}"
        )

    with subtest("buildLayeredImage doesn't dereference /nix/store symlink layers"):
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@ -312,6 +312,7 @@ let
            desktop-file-utils
            docbook5
            docbook_xsl_ns
+            kmod.dev
            libxml2.bin
            libxslt.bin
            nixos-artwork.wallpapers.simple-dark-gray-bottom
--- a/nixos/tests/lvm2/default.nix
+++ b/nixos/tests/lvm2/default.nix
@ -0,0 +1,27 @@
+{ system ? builtins.currentSystem
+, config ? { }
+, pkgs ? import ../../.. { inherit system config; }
+, lib ? pkgs.lib
+, kernelVersionsToTest ? [ "4.19" "5.4" "5.10" "5.15" "latest" ]
+}:
+
+# For quickly running a test, the nixosTests.lvm2.lvm-thinpool-linux-latest attribute is recommended
+let
+  tests = let callTest = p: lib.flip (import p) { inherit system pkgs; }; in {
+    thinpool = { test = callTest ./thinpool.nix; kernelFilter = lib.id; };
+    # we would like to test all versions, but the kernel module currently does not compile against the other versions
+    vdo = { test = callTest ./vdo.nix; kernelFilter = lib.filter (v: v == "5.15"); };
+  };
+in
+lib.listToAttrs (
+  lib.filter (x: x.value != {}) (
+    lib.flip lib.concatMap kernelVersionsToTest (version:
+      let
+        v' = lib.replaceStrings [ "." ] [ "_" ] version;
+      in
+      lib.flip lib.mapAttrsToList tests (name: t:
+        lib.nameValuePair "lvm-${name}-linux-${v'}" (lib.optionalAttrs (builtins.elem version (t.kernelFilter kernelVersionsToTest)) (t.test { kernelPackages = pkgs."linuxPackages_${v'}"; }))
+      )
+    )
+  )
+)
--- a/nixos/tests/lvm2/thinpool.nix
+++ b/nixos/tests/lvm2/thinpool.nix
@ -0,0 +1,32 @@
+{ kernelPackages ? null }:
+import ../make-test-python.nix ({ pkgs, ... }: {
+  name = "lvm2-thinpool";
+  meta.maintainers = with pkgs.lib.maintainers; [ ajs124 ];
+
+  nodes.machine = { pkgs, lib, ... }: {
+    virtualisation.emptyDiskImages = [ 4096 ];
+    services.lvm = {
+      boot.thin.enable = true;
+      dmeventd.enable = true;
+    };
+    environment.systemPackages = with pkgs; [ xfsprogs ];
+    environment.etc."lvm/lvm.conf".text = ''
+      activation/thin_pool_autoextend_percent = 10
+      activation/thin_pool_autoextend_threshold = 80
+    '';
+    boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+  };
+
+  testScript = ''
+    machine.succeed("vgcreate test_vg /dev/vdb")
+    machine.succeed("lvcreate -L 512M -T test_vg/test_thin_pool")
+    machine.succeed("lvcreate -n test_lv -V 16G --thinpool test_thin_pool test_vg")
+    machine.succeed("mkfs.xfs /dev/test_vg/test_lv")
+    machine.succeed("mkdir /mnt; mount /dev/test_vg/test_lv /mnt")
+    assert "/dev/mapper/test_vg-test_lv" == machine.succeed("findmnt -no SOURCE /mnt").strip()
+    machine.succeed("dd if=/dev/zero of=/mnt/empty.file bs=1M count=1024")
+    machine.succeed("journalctl -u dm-event.service | grep \"successfully resized\"")
+    machine.succeed("umount /mnt")
+    machine.succeed("vgchange -a n")
+  '';
+})
--- a/nixos/tests/lvm2/vdo.nix
+++ b/nixos/tests/lvm2/vdo.nix
@ -0,0 +1,27 @@
+{ kernelPackages ? null }:
+import ../make-test-python.nix ({ pkgs, ... }: {
+  name = "lvm2-vdo";
+  meta.maintainers = with pkgs.lib.maintainers; [ ajs124 ];
+
+  nodes.machine = { pkgs, lib, ... }: {
+    # Minimum required size for VDO volume: 5063921664 bytes
+    virtualisation.emptyDiskImages = [ 8192 ];
+    services.lvm = {
+      boot.vdo.enable = true;
+      dmeventd.enable = true;
+    };
+    environment.systemPackages = with pkgs; [ xfsprogs ];
+    boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+  };
+
+  testScript = ''
+    machine.succeed("vgcreate test_vg /dev/vdb")
+    machine.succeed("lvcreate --type vdo -n vdo_lv -L 6G -V 12G test_vg/vdo_pool_lv")
+    machine.succeed("mkfs.xfs -K /dev/test_vg/vdo_lv")
+    machine.succeed("mkdir /mnt; mount /dev/test_vg/vdo_lv /mnt")
+    assert "/dev/mapper/test_vg-vdo_lv" == machine.succeed("findmnt -no SOURCE /mnt").strip()
+    machine.succeed("umount /mnt")
+    machine.succeed("vdostats")
+    machine.succeed("vgchange -a n")
+  '';
+})
--- a/nixos/tests/nixops/default.nix
+++ b/nixos/tests/nixops/default.nix
@ -97,7 +97,7 @@ let
    derivations and all build dependency outputs, all the way down.
  */
  allDrvOutputs = pkg:
-    let name = lib.strings.sanitizeDerivationName "allDrvOutputs-${pkg.pname or pkg.name or "unknown"}";
+    let name = "allDrvOutputs-${pkg.pname or pkg.name or "unknown"}";
    in
    pkgs.runCommand name { refs = pkgs.writeReferencesToFile pkg.drvPath; } ''
      touch $out
--- a/nixos/tests/vaultwarden.nix
+++ b/nixos/tests/vaultwarden.nix
@ -113,7 +113,6 @@ let
                  driver.find_element_by_css_selector('input#masterPasswordRetype').send_keys(
                    '${userPassword}'
                  )
-                  driver.find_element_by_css_selector('input#acceptPolicies').click()

                  driver.find_element_by_xpath("//button[contains(., 'Submit')]").click()

--- a/pkgs/applications/audio/flac/default.nix
+++ b/pkgs/applications/audio/flac/default.nix
@ -2,21 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "flac";
-  version = "1.3.3";
+  version = "1.3.4";

  src = fetchurl {
    url = "http://downloads.xiph.org/releases/flac/${pname}-${version}.tar.xz";
-    sha256 = "0j0p9sf56a2fm2hkjnf7x3py5ir49jyavg4q5zdyd7bcf6yq4gi1";
+    sha256 = "0dz7am8kbc97a6afml1h4yp085274prg8j7csryds8m3fmz61w4g";
  };

-  patches = [
-    (fetchpatch {
-      name = "CVE-2020-0499.patch";
-      url = "https://github.com/xiph/flac/commit/2e7931c27eb15e387da440a37f12437e35b22dd4.patch";
-      sha256 = "160qzq9ms5addz7sx06pnyjjkqrffr54r4wd8735vy4x008z71ah";
-    })
-  ];
-
  buildInputs = [ libogg ];

  #doCheck = true; # takes lots of time
--- a/pkgs/applications/audio/sfizz/default.nix
+++ b/pkgs/applications/audio/sfizz/default.nix
@ -1,6 +1,7 @@
 { lib, stdenv, fetchFromGitHub, libjack2, libsndfile, xorg, freetype
 , libxkbcommon, cairo, glib, gnome, flac, libogg, libvorbis, libopus, cmake
-, pango, pkg-config }:
+, pango, pkg-config, catch2
+}:

 stdenv.mkDerivation rec {
  pname = "sfizz";
@ -40,6 +41,8 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake pkg-config ];

  postPatch = ''
+    cp ${catch2}/include/catch2/catch.hpp tests/catch2/catch.hpp
+
    substituteInPlace plugins/editor/external/vstgui4/vstgui/lib/platform/linux/x11fileselector.cpp \
      --replace 'zenitypath = "zenity"' 'zenitypath = "${gnome.zenity}/bin/zenity"'
    substituteInPlace plugins/editor/src/editor/NativeHelpers.cpp \
@ -48,6 +51,8 @@ stdenv.mkDerivation rec {

  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" "-DSFIZZ_TESTS=ON" ];

+  doCheck = true;
+
  meta = with lib; {
    homepage = "https://github.com/sfztools/sfizz";
    description = "SFZ jack client and LV2 plugin";
--- a/pkgs/applications/audio/sfxr-qt/default.nix
+++ b/pkgs/applications/audio/sfxr-qt/default.nix
@ -8,6 +8,7 @@
 , qtquickcontrols2
 , SDL
 , python3
+, catch2
 , callPackage
 , nixosTests
 }:
@ -24,6 +25,10 @@ mkDerivation rec {
    fetchSubmodules = true;
  };

+  postPatch = ''
+    cp ${catch2}/include/catch2/catch.hpp 3rdparty/catch2/single_include/catch2/catch.hpp
+  '';
+
  # Remove on next release
  patches = [(fetchpatch {
    name = "sfxr-qr-missing-qpainterpath-include";
@ -43,6 +48,8 @@ mkDerivation rec {
    SDL
  ];

+  doCheck = true;
+
  passthru.tests = {
    export-square-wave = callPackage ./test-export-square-wave {};
    sfxr-qt-starts = nixosTests.sfxr-qt;
--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@ -2,12 +2,12 @@

 let
  pname = "ledger-live-desktop";
-  version = "2.39.2";
+  version = "2.40.2";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://github.com/LedgerHQ/${pname}/releases/download/v${version}/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-zVefF5CsyVVMNffec/xwA3KmMtZepM51C3Xh0ZCGl0c=";
+    hash = "sha256-2L1iVPLCCIQ6qBqkg+GmiqMmknHmdDLUrysN8vcW2YQ=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/applications/blockchains/lndmanage/default.nix
+++ b/pkgs/applications/blockchains/lndmanage/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "lndmanage";
-  version = "0.14.0";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "bitromortac";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-wPr/R+WGACyhv2Qh9JeLJwvr2vQfxpqj2XjEkrRoSX4=";
+    hash = "sha256-c36AbND01bUr0Klme4fU7GrY1oYcmoEREQI9cwsK7YM=";
  };

  propagatedBuildInputs = with python3Packages; [
--- a/pkgs/applications/editors/emacs/27.nix
+++ b/pkgs/applications/editors/emacs/27.nix
@ -7,5 +7,10 @@ import ./generic.nix (rec {
      url = "https://git.savannah.gnu.org/cgit/emacs.git/patch/?id=a88f63500e475f842e5fbdd9abba4ce122cdb082";
      sha256 = "sha256-RF9b5PojFUAjh2TDUW4+HaWveV30Spy1iAXhaWf1ZVg=";
    })
+    # glibc 2.34 compat
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/emacs/raw/181aafcdb7ee2fded9fce4cfc448f27edccc927f/f/emacs-glibc-2.34.patch";
+      sha256 = "sha256-2o3C/jhZPl2OW/LmVPt/fhdwbS9NOdF9lVEF1Kn9aEk=";
+    })
  ];
 })
--- a/pkgs/applications/editors/helix/default.nix
+++ b/pkgs/applications/editors/helix/default.nix
@ -1,18 +1,18 @@
-{ fetchFromGitHub, lib, rustPlatform, makeWrapper }:
+{ fetchzip, lib, rustPlatform, makeWrapper }:

 rustPlatform.buildRustPackage rec {
  pname = "helix";
-  version = "0.6.0";
+  version = "22.03";

-  src = fetchFromGitHub {
-    owner = "helix-editor";
-    repo = pname;
-    rev = "v${version}";
-    fetchSubmodules = true;
-    sha256 = "sha256-d/USOtcPLjdgzN7TBCouBRmoSDH5LZD4R5Qq7lUrWZw=";
+  # This release tarball includes source code for the tree-sitter grammars,
+  # which is not ordinarily part of the repository.
+  src = fetchzip {
+    url = "https://github.com/helix-editor/helix/releases/download/${version}/helix-${version}-source.tar.xz";
+    sha256 = "DP/hh6JfnyHdW2bg0cvhwlWvruNDvL9bmXM46iAUQzA=";
+    stripRoot = false;
  };

-  cargoSha256 = "sha256-/EATU7HsGNB35YOBp8sofbPd1nl4d3Ggj1ay3QuHkCI=";
+  cargoSha256 = "zJQ+KvO+6iUIb0eJ+LnMbitxaqTxfqgu7XXj3j0GiX4=";

  nativeBuildInputs = [ makeWrapper ];

@ -29,6 +29,6 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://helix-editor.com";
    license = licenses.mpl20;
    mainProgram = "hx";
-    maintainers = with maintainers; [ yusdacra ];
+    maintainers = with maintainers; [ danth yusdacra ];
  };
 }
--- a/pkgs/applications/editors/kakoune/plugins/kakoune-plugin-names
+++ b/pkgs/applications/editors/kakoune/plugins/kakoune-plugin-names
@ -1,19 +1,20 @@
-alexherbo2/auto-pairs.kak
-alexherbo2/replace-mode.kak
-alexherbo2/sleuth.kak
-andreyorst/fzf.kak
-andreyorst/powerline.kak
-basbebe/pandoc.kak
-danr/kakoune-easymotion
-Delapouite/kakoune-buffers
-Delapouite/kakoune-registers
-enricozb/tabs.kak@main
-greenfork/active-window.kak
-kakoune-editor/kakoune-extra-filetypes
-kakounedotcom/connect.kak
-kakounedotcom/prelude.kak
-lePerdu/kakboard
-listentolist/kakoune-rainbow
-mayjs/openscad.kak
-occivink/kakoune-buffer-switcher
-occivink/kakoune-vertical-selection
+repo,branch,alias
+alexherbo2/auto-pairs.kak,,
+alexherbo2/replace-mode.kak,,
+alexherbo2/sleuth.kak,,
+andreyorst/fzf.kak,,
+andreyorst/powerline.kak,,
+basbebe/pandoc.kak,,
+danr/kakoune-easymotion,,
+Delapouite/kakoune-buffers,,
+Delapouite/kakoune-registers,,
+enricozb/tabs.kak@main,,
+greenfork/active-window.kak,,
+kakoune-editor/kakoune-extra-filetypes,,
+kakounedotcom/connect.kak,,
+kakounedotcom/prelude.kak,,
+lePerdu/kakboard,,
+listentolist/kakoune-rainbow,,
+mayjs/openscad.kak,,
+occivink/kakoune-buffer-switcher,,
+occivink/kakoune-vertical-selection,,
--- a/pkgs/applications/editors/poke/default.nix
+++ b/pkgs/applications/editors/poke/default.nix
@ -22,11 +22,11 @@ let
  isCross = stdenv.hostPlatform != stdenv.buildPlatform;
 in stdenv.mkDerivation rec {
  pname = "poke";
-  version = "2.2";
+  version = "2.3";

  src = fetchurl {
    url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-xF6k5xpRohhTZzhcAc65dZbsW3EDOGm+xKYLHLciWQM=";
+    sha256 = "sha256-NpDPERbafLOp7GtPcAPiU+JotRAhKiiP04qv7Q68x2Y=";
  };

  outputs = [ "out" "dev" "info" "lib" "man" ];
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
--- a/pkgs/applications/graphics/apitrace/default.nix
+++ b/pkgs/applications/graphics/apitrace/default.nix
@ -11,6 +11,12 @@ stdenv.mkDerivation rec {
    owner = "apitrace";
  };

+  patches = [
+    # glibc 2.34 compat
+    # derived from https://github.com/apitrace/apitrace/commit/d28a980802ad48568c87da02d630c8babfe163bb
+    ./glibc-2.34-compat.patch
+  ];
+
  # LD_PRELOAD wrappers need to be statically linked to work against all kinds
  # of games -- so it's fine to use e.g. bundled snappy.
  buildInputs = [ libX11 procps python2 libdwarf qtbase qtwebkit ];
--- a/pkgs/applications/graphics/apitrace/glibc-2.34-compat.patch
+++ b/pkgs/applications/graphics/apitrace/glibc-2.34-compat.patch
@ -0,0 +1,13 @@
+diff --git a/wrappers/dlsym.cpp b/wrappers/dlsym.cpp
+index 2eda082..0c0c8ee 100644
+--- a/wrappers/dlsym.cpp
+++ b/wrappers/dlsym.cpp
+@@ -34,7 +34,7 @@
+ #include "os.hpp"
+ 
+ 
+-#ifdef __GLIBC__
+#if defined(__GLIBC__) && __GLIBC__ == 2 && __GLIBC_MINOR__ < 34
+ 
+ 
+ #include <dlfcn.h>
--- a/pkgs/applications/graphics/imgbrd-grabber/default.nix
+++ b/pkgs/applications/graphics/imgbrd-grabber/default.nix
@ -33,12 +33,12 @@ stdenv.mkDerivation rec {

  buildInputs = [
    openssl
-    makeWrapper
    libpulseaudio
    typescript
  ];

  nativeBuildInputs = [
+    makeWrapper
    qtmultimedia
    qtbase
    qtdeclarative
--- a/pkgs/applications/graphics/jpegrescan/default.nix
+++ b/pkgs/applications/graphics/jpegrescan/default.nix
@ -28,8 +28,12 @@ stdenv.mkDerivation rec {

  propagatedBuildInputs = [ perlPackages.FileSlurp ];

+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
  buildInputs = [
-    perl libjpeg_turbo makeWrapper
+    perl libjpeg_turbo
  ];

  meta = with lib; {
--- a/pkgs/applications/graphics/shotwell/default.nix
+++ b/pkgs/applications/graphics/shotwell/default.nix
@ -41,11 +41,11 @@

 stdenv.mkDerivation rec {
  pname = "shotwell";
-  version = "0.30.14";
+  version = "0.30.15";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-McLkgzkI02GcssNnWgXw2lnCuqduKLkFOF/VbADBKJU=";
+    sha256 = "sha256-OlKtYLEC2g31902wMcRdTM8mNRPJVGFu4WZL9PTpvck=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/synfigstudio/default.nix
+++ b/pkgs/applications/graphics/synfigstudio/default.nix
@ -103,10 +103,10 @@ stdenv.mkDerivation {

  preConfigure = "./bootstrap.sh";

-  nativeBuildInputs = [ pkg-config autoreconfHook gettext ];
+  nativeBuildInputs = [ pkg-config autoreconfHook gettext makeWrapper ];
  buildInputs = [
    ETL boost cairo glibmm gtk3 gtkmm3 imagemagick intltool
-    libjack2 libsigcxx libxmlxx makeWrapper mlt-qt5
+    libjack2 libsigcxx libxmlxx mlt-qt5
    synfig which gnome.adwaita-icon-theme
  ];

--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/release-service/21.12.2/src -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/release-service/21.12.3/src -A '*.tar.xz' )
--- a/pkgs/applications/kde/kitinerary.nix
+++ b/pkgs/applications/kde/kitinerary.nix
@ -1,4 +1,4 @@
-{ mkDerivation, fetchpatch, lib, extra-cmake-modules
+{ mkDerivation, lib, extra-cmake-modules
 , qtdeclarative, ki18n, kmime, kpkpass
 , poppler, kcontacts, kcalendarcore
 , shared-mime-info
@ -10,15 +10,6 @@ mkDerivation {
    license = with lib.licenses; [ lgpl21 ];
    maintainers = [ lib.maintainers.bkchr ];
  };
-
-  patches = [
-    # Fix build with poppler 22.03
-    (fetchpatch {
-      url = "https://github.com/KDE/kitinerary/commit/e21d1ffc5fa81a636245f49c97fe7cda63abbb1d.patch";
-      sha256 = "1/zgq9QIOCPplqplDqgpoqzuYFf/m1Ixxawe50t2F04=";
-    })
-  ];
-
  nativeBuildInputs = [
    extra-cmake-modules
    shared-mime-info # for update-mime-database
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
--- a/pkgs/applications/misc/gnome-solanum/default.nix
+++ b/pkgs/applications/misc/gnome-solanum/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitLab
+, fetchpatch
 , rustPlatform
 , desktop-file-utils
 , meson
@ -27,6 +28,15 @@ stdenv.mkDerivation rec {
    sha256 = "0cga6cz6jfbipzp008rjznkz7844licdc34lk133fcyqil0cg0ap";
  };

+  patches = [
+    # Fix build with meson 0.61, can be removed on next update
+    # https://gitlab.gnome.org/World/Solanum/-/merge_requests/49
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/World/Solanum/-/commit/e5c5d88f95b0fe4145c9ed346b8ca98a613d7cfe.patch";
+      sha256 = "j84P9KzMr0o38u4OD4ZPst+yqw1LCRoa1awT3nelFDI=";
+    })
+  ];
+
  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
--- a/pkgs/applications/misc/pdfslicer/default.nix
+++ b/pkgs/applications/misc/pdfslicer/default.nix
@ -24,6 +24,12 @@ stdenv.mkDerivation rec {
    sha256 = "0sja0ddd9c8wjjpzk2ag8q1lxpj09adgmhd7wnsylincqnj2jyls";
  };

+  postPatch = ''
+    # Don't build tests, vendored catch doesn't build with latest glibc.
+    substituteInPlace CMakeLists.txt \
+      --replace "add_subdirectory (tests)" ""
+  '';
+
  nativeBuildInputs = [
    cmake
    gettext
--- a/pkgs/applications/misc/trenchbroom/default.nix
+++ b/pkgs/applications/misc/trenchbroom/default.nix
@ -21,6 +21,19 @@ stdenv.mkDerivation rec {
      --subst-var-by APP_VERSION_YEAR ${lib.versions.major version} \
      --subst-var-by APP_VERSION_NUMBER ${lib.versions.minor version} \
      --subst-var-by GIT_DESCRIBE v${version}
+
+    # Tests don't compile because of vendored `catch2` being incompatible with glibc-2.34.
+    # Also, no need to since we don't even run them.
+    substituteInPlace lib/CMakeLists.txt \
+      --replace "add_subdirectory(Catch2)" ""
+    substituteInPlace lib/vecmath/CMakeLists.txt \
+      --replace "add_subdirectory(test)" "" \
+      --replace "add_subdirectory(lib)" ""
+    substituteInPlace lib/kdl/CMakeLists.txt \
+      --replace "add_subdirectory(test)" ""
+    substituteInPlace common/CMakeLists.txt \
+      --replace "add_subdirectory(test)" "" \
+      --replace "add_subdirectory(benchmark)" ""
  '';

  nativeBuildInputs = [ cmake git pandoc wrapQtAppsHook copyDesktopItems ];
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.8.18";
+  version = "0.8.19";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    sha256 = "sha256-VQI2eAxOkOkwYkTM/UyyK6lnXFoLFHWE/ekm5qLN9OE=";
+    sha256 = "sha256-GbuDL0JSG0r2LVcdJgQFBMNDpAl2WbhjIX0Ls9yCDYg=";
  };

  CGO_ENABLED = 0;
--- a/pkgs/applications/networking/cluster/kube3d/default.nix
+++ b/pkgs/applications/networking/cluster/kube3d/default.nix
@ -15,7 +15,7 @@ buildGoModule rec {

  nativeBuildInputs = [ installShellFiles ];

-  excludedPackages = "\\(tools\\|docgen\\)";
+  excludedPackages = [ "tools" "docgen" ];

  ldflags =
    let t = "github.com/rancher/k3d/v5/version"; in
--- a/pkgs/applications/networking/cluster/kubeless/default.nix
+++ b/pkgs/applications/networking/cluster/kubeless/default.nix
@ -1,38 +0,0 @@
-{ lib, buildGoPackage, fetchFromGitHub, installShellFiles }:
-
-buildGoPackage rec {
-  pname = "kubeless";
-  version = "1.0.7";
-
-  src = fetchFromGitHub {
-    owner = "kubeless";
-    repo = "kubeless";
-    rev = "v${version}";
-    sha256 = "0x2hydywnnlh6arzz71p7gg9yzq5z2y2lppn1jszvkbgh11kkqfr";
-  };
-
-  goPackagePath = "github.com/kubeless/kubeless";
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  subPackages = [ "cmd/kubeless" ];
-
-  ldflags = [
-    "-s" "-w" "-X github.com/kubeless/kubeless/pkg/version.Version=${version}"
-  ];
-
-  postInstall = ''
-    for shell in bash; do
-      $out/bin/kubeless completion $shell > kubeless.$shell
-      installShellCompletion kubeless.$shell
-    done
-  '';
-
-  meta = with lib; {
-    homepage = "https://kubeless.io";
-    description = "The Kubernetes Native Serverless Framework";
-    license = licenses.asl20;
-    maintainers = with maintainers; [];
-    platforms = platforms.unix;
-  };
-}
--- a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
+++ b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
@ -19,7 +19,7 @@ buildGoModule rec {

  # third_party/VENDOR-LICENSE breaks build/check as go files are still included
  # docs is a tool for generating docs
-  excludedPackages = "\\(third_party\\|cmd/docs\\)";
+  excludedPackages = [ "third_party" "cmd/docs" ];

  preCheck = ''
    # some tests try to write to the home dir
--- a/pkgs/applications/networking/instant-messengers/alfaview/default.nix
+++ b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "alfaview";
-  version = "8.40.0";
+  version = "8.41.0";

  src = fetchurl {
    url = "https://production-alfaview-assets.alfaview.com/stable/linux/${pname}_${version}.deb";
-    sha256 = "sha256-meiIDIG7OXxF2aclHA/8FN8aSz5KWJliDbm2p/flD4k=";
+    sha256 = "sha256-qW+MB71sylKJQycSX6hiBgxAO4MuhnBaPGFjm+6y4vk=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/pond/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pond/default.nix
@ -24,7 +24,7 @@ buildGoPackage rec {
    ++ lib.optional stdenv.hostPlatform.isx86_64 dclxvi
    ++ lib.optionals gui [ wrapGAppsHook ];
  tags = lib.optionals (!gui) [ "nogui" ];
-  excludedPackages = "\\(appengine\\|bn256cgo\\)";
+  excludedPackages = [ "appengine" "bn256cgo" ];
  postPatch = lib.optionalString stdenv.hostPlatform.isx86_64 ''
    grep -r 'bn256' | awk -F: '{print $1}' | xargs sed -i \
      -e "s,golang.org/x/crypto/bn256,github.com/agl/pond/bn256cgo,g" \
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, pkg-config, pcre, perl, flex, bison, gettext, libpcap, libnl, c-ares
 , gnutls, libgcrypt, libgpg-error, geoip, openssl, lua5, python3, libcap, glib
-, libssh, nghttp2, zlib, cmake, makeWrapper
+, libssh, nghttp2, zlib, cmake, makeWrapper, wrapGAppsHook
 , withQt ? true, qt5 ? null
 , ApplicationServices, SystemConfiguration, gmp
 , asciidoctor
@ -34,7 +34,8 @@ in stdenv.mkDerivation {
  # Avoid referencing -dev paths because of debug assertions.
  NIX_CFLAGS_COMPILE = [ "-DQT_NO_DEBUG" ];

-  nativeBuildInputs = [ asciidoctor bison cmake flex makeWrapper pkg-config ] ++ optional withQt qt5.wrapQtAppsHook;
+  nativeBuildInputs = [ asciidoctor bison cmake flex makeWrapper pkg-config ]
+    ++ optionals withQt [ qt5.wrapQtAppsHook wrapGAppsHook ];

  buildInputs = [
    gettext pcre perl libpcap lua5 libssh nghttp2 openssl libgcrypt
@ -85,6 +86,12 @@ in stdenv.mkDerivation {

  dontFixCmake = true;

+  # Prevent double-wrapping, inject wrapper args manually instead.
+  dontWrapGApps = true;
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
  shellHook = ''
    # to be able to run the resulting binary
    export WIRESHARK_RUN_FROM_BUILD_DIRECTORY=1
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@ -25,14 +25,14 @@ let
  };
 in
 stdenv.mkDerivation rec {
-  version = "14.32.39";
+  version = "14.32.45";
  pname = "jmol";

  src = let
    baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
  in fetchurl {
    url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "sha256-ekwipWWGsXYECJBOmw0+uIWHDpdF8T8jZUo6LeqD6Io=";
+    sha256 = "sha256-9bcOwORHLZfn95RFur4JdP3Djpq8K8utnWIsniqKAI4=";
  };

  patchPhase = ''
--- a/pkgs/applications/science/logic/potassco/clingcon.nix
+++ b/pkgs/applications/science/logic/potassco/clingcon.nix
@ -2,6 +2,7 @@
 , fetchFromGitHub
 , cmake
 , clingo
+, catch2
 }:

 stdenv.mkDerivation rec {
@ -15,6 +16,10 @@ stdenv.mkDerivation rec {
    sha256 = "1g2xkz9nsgqnrw3fdf5jchl16f0skj5mm32va61scc2yrchll166";
   };

+  postPatch = ''
+    cp ${catch2}/include/catch2/catch.hpp libclingcon/tests/catch.hpp
+  '';
+
  nativeBuildInputs = [ cmake clingo ];

  cmakeFlags = [
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -32,7 +32,9 @@ let
 in

 stdenv.mkDerivation {
-  pname = "git";
+  pname = "git"
+    + lib.optionalString svnSupport "-with-svn"
+    + lib.optionalString (!svnSupport && !guiSupport && !sendEmailSupport && !withManual && !pythonSupport && !withpcre2) "-minimal";
  inherit version;

  src = fetchurl {
@ -166,8 +168,13 @@ stdenv.mkDerivation {
      cp -a contrib $out/share/git/
      mkdir -p $out/share/bash-completion/completions
      ln -s $out/share/git/contrib/completion/git-completion.bash $out/share/bash-completion/completions/git
-      mkdir -p $out/share/bash-completion/completions
      ln -s $out/share/git/contrib/completion/git-prompt.sh $out/share/bash-completion/completions/
+      # only readme, developed in another repo
+      rm -r contrib/hooks/multimail
+      mkdir -p $out/share/git-core/contrib
+      cp -a contrib/hooks/ $out/share/git-core/contrib/
+      substituteInPlace $out/share/git-core/contrib/hooks/pre-auto-gc-battery \
+        --replace ' grep' ' ${gnugrep}/bin/grep' \

      # grep is a runtime dependency, need to patch so that it's found
      substituteInPlace $out/libexec/git-core/git-sh-setup \
--- a/pkgs/applications/version-management/git-and-tools/hut/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/hut/default.nix
@ -2,21 +2,20 @@
 , buildGoModule
 , fetchFromSourcehut
 , scdoc
-, unstableGitUpdater
 }:

-buildGoModule {
+buildGoModule rec {
  pname = "hut";
-  version = "unstable-2022-03-02";
+  version = "0.1.0";

  src = fetchFromSourcehut {
    owner = "~emersion";
    repo = "hut";
-    rev = "55ad2fbd9ceeeb9e7dc203c15476fa785f1209e0";
-    sha256 = "sha256-j2IVwCm7iq3JKccPL8noRBhqw+V+4qfcpAwV65xhZk0=";
+    rev = "v${version}";
+    sha256 = "sha256-2YUrDPulpLQQGw31nEasHoQ/AppECg7acwwqu6JDT5U=";
  };

-  vendorSha256 = "sha256-zdQvk0M1a+Y90pnhqIpKxLJnlVJqMoSycewTep2Oux4=";
+  vendorSha256 = "sha256-EmokL3JlyM6C5/NOarCAJuqNsDO2tgHwqQdv0rAk+Xk=";

  nativeBuildInputs = [
    scdoc
@ -32,8 +31,6 @@ buildGoModule {
    make $makeFlags install
  '';

-  passthru.updateScript = unstableGitUpdater { };
-
  meta = with lib; {
    homepage = "https://sr.ht/~emersion/hut/";
    description = "A CLI tool for Sourcehut / sr.ht";
--- a/pkgs/applications/version-management/github-desktop/default.nix
+++ b/pkgs/applications/version-management/github-desktop/default.nix
@ -19,11 +19,11 @@

 stdenv.mkDerivation rec {
  pname = "github-desktop";
-  version = "2.9.9";
+  version = "2.9.12";

  src = fetchurl {
    url = "https://github.com/shiftkey/desktop/releases/download/release-${version}-linux1/GitHubDesktop-linux-${version}-linux1.deb";
-    sha256 = "sha256-LMKOxQR3Bgw00LnKqAe2hq+eASgwC7y0cxNSSt/sjWA=";
+    sha256 = "sha256-tr1u6q7sHI1Otor53d1F7J0f9eV9tKtLZx8+40I16y8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@ -21,18 +21,13 @@ let

  self = python3Packages.buildPythonApplication rec {
    pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.1";
+    version = "6.1.1";

    src = fetchurl {
      url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-hvmGReRWWpJWmR3N4it3uOfSLKb7tgwfTNvYRpo4zB8=";
+      sha256 = "sha256-V7ikYdDOE9muOBfYqL35Ay407fqsPbzLO2a4NdzpM4g=";
    };

-    patches = [
-      # Fix the type of libc buffer for aarch64-linux
-      ./fix-rhg-type-aarch64.patch
-    ];
-
    format = "other";

    passthru = { inherit python; }; # pass it so that the same version can be used in hg2git
@ -40,7 +35,7 @@ let
    cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
      inherit src;
      name = "mercurial-${version}";
-      sha256 = "sha256-+Y91gEC8vmyutNpVFAAL4MSg4KnpFbhH12CIuMRx0Mc=";
+      sha256 = "sha256-HYH7+OD11kdZdxFrx1KVle1NesS3fAgwVXJpAeiXDTo=";
      sourceRoot = "mercurial-${version}/rust";
    } else null;
    cargoRoot = if rustSupport then "rust" else null;
--- a/pkgs/applications/version-management/mercurial/fix-rhg-type-aarch64.patch
+++ b/pkgs/applications/version-management/mercurial/fix-rhg-type-aarch64.patch
@ -1,12 +0,0 @@
-diff --git a/rust/hg-core/src/lock.rs b/rust/hg-core/src/lock.rs
--- a/rust/hg-core/src/lock.rs
-+++ b/rust/hg-core/src/lock.rs
-@@ -145,7 +145,7 @@ lazy_static::lazy_static! {
- 
-         /// Same as https://github.com/python/cpython/blob/v3.10.0/Modules/socketmodule.c#L5414
-         const BUFFER_SIZE: usize = 1024;
-        let mut buffer = [0_i8; BUFFER_SIZE];
-+        let mut buffer = [0 as libc::c_char; BUFFER_SIZE];
-         let hostname_bytes = unsafe {
-             let result = libc::gethostname(buffer.as_mut_ptr(), BUFFER_SIZE);
-             if result != 0 {
--- a/pkgs/applications/version-management/rcs/default.nix
+++ b/pkgs/applications/version-management/rcs/default.nix
@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-Q93+EHJKi4XiRo9kA7YABzcYbwHmDgvWL95p2EIjTMU=";
  };

+  patches = [
+    # glibc 2.34 compat
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/rcs/raw/f8e07cd37f4abfb36e37d41852bb8f9e234d3fb1/f/rcs-5.10.0-SIGSTKSZ.patch";
+      sha256 = "sha256-mc6Uye9mdEsLBcOnf1m1TUb1BV0ncNU//iKBpLGBjho=";
+    })
+  ];
+
  ac_cv_path_ED = "${ed}/bin/ed";
  DIFF = "${diffutils}/bin/diff";
  DIFF3 = "${diffutils}/bin/diff3";
--- a/pkgs/applications/video/ani-cli/default.nix
+++ b/pkgs/applications/video/ani-cli/default.nix
@ -12,13 +12,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "ani-cli";
-  version = "1.9";
+  version = "2.0";

  src = fetchFromGitHub {
    owner = "pystardust";
    repo = "ani-cli";
    rev = "v${version}";
-    sha256 = "sha256-oYiq3Mnuhba5NELJXqVN3gY/d0RfQIqW13YtdcmYKK4=";
+    sha256 = "sha256-cDxb/IcpzR5akWnA8RN+fKQn0+QnpBV8tAbUjjPICsA=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/video/quvi/library.nix
+++ b/pkgs/applications/video/quvi/library.nix
@ -18,5 +18,6 @@ stdenv.mkDerivation rec {
    license = lib.licenses.lgpl21Plus;
    platforms = lib.platforms.linux;
    maintainers = [ ];
+    broken = true; # missing glibc-2.34 support, no upstream activity
  };
 }
--- a/pkgs/applications/video/quvi/scripts.nix
+++ b/pkgs/applications/video/quvi/scripts.nix
@ -17,5 +17,6 @@ stdenv.mkDerivation rec {
    license = lib.licenses.lgpl21Plus;
    platforms = lib.platforms.linux;
    maintainers = [ ];
+    broken = true; # missing glibc-2.34 support, no upstream activity
  };
 }
--- a/pkgs/applications/video/quvi/tool.nix
+++ b/pkgs/applications/video/quvi/tool.nix
@ -21,5 +21,6 @@ stdenv.mkDerivation rec {
    license = lib.licenses.lgpl21Plus;
    platforms = lib.platforms.linux;
    maintainers = [ ];
+    broken = true; # missing glibc-2.34 support, no upstream activity
  };
 }
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@ -16,8 +16,8 @@
 , makeWrapper
 , moreutils
 , nix
+, nixosTests
 , pigz
-, pkgs
 , rsync
 , runCommand
 , runtimeShell
@ -26,6 +26,7 @@
 , storeDir ? builtins.storeDir
 , substituteAll
 , symlinkJoin
+, tarsum
 , util-linux
 , vmTools
 , writeReferencesToFile
@ -81,6 +82,15 @@ rec {
    inherit buildImage buildLayeredImage fakeNss pullImage shadowSetup buildImageWithNixDb;
  };

+  tests = {
+    inherit (nixosTests)
+      docker-tools
+      docker-tools-overlay
+      # requires remote builder
+      # docker-tools-cross
+      ;
+  };
+
  pullImage =
    let
      fixName = name: builtins.replaceStrings [ "/" ":" ] [ "-" "-" ] name;
@ -113,7 +123,7 @@ rec {
        outputHashAlgo = "sha256";
        outputHash = sha256;

-        nativeBuildInputs = lib.singleton skopeo;
+        nativeBuildInputs = [ skopeo ];
        SSL_CERT_FILE = "${cacert.out}/etc/ssl/certs/ca-bundle.crt";

        sourceURL = "docker://${imageName}@${imageDigest}";
@ -132,7 +142,7 @@ rec {

  # We need to sum layer.tar, not a directory, hence tarsum instead of nix-hash.
  # And we cannot untar it, because then we cannot preserve permissions etc.
-  tarsum = pkgs.tarsum;
+  inherit tarsum; # pkgs.dockerTools.tarsum

  # buildEnv creates symlinks to dirs, which is hard to edit inside the overlay VM
  mergeDrvs =
@ -754,7 +764,7 @@ rec {
  # "#!/usr/bin/env executable" shebang.
  usrBinEnv = runCommand "usr-bin-env" { } ''
    mkdir -p $out/usr/bin
-    ln -s ${pkgs.coreutils}/bin/env $out/usr/bin
+    ln -s ${coreutils}/bin/env $out/usr/bin
  '';

  # This provides /bin/sh, pointing to bashInteractive.
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@ -486,7 +486,7 @@ rec {
  cross = let
    # Cross compile for x86_64 if on aarch64
    crossPkgs =
-      if pkgs.system == "aarch64-linux" then pkgsCross.gnu64
+      if pkgs.stdenv.hostPlatform.system == "aarch64-linux" then pkgsCross.gnu64
      else pkgsCross.aarch64-multiplatform;
  in crossPkgs.dockerTools.buildImage {
    name = "hello-cross";
--- a/pkgs/build-support/make-desktopitem/default.nix
+++ b/pkgs/build-support/make-desktopitem/default.nix
@ -34,11 +34,6 @@
 , extraConfig ? {} # Additional values to be added literally to the final item, e.g. vendor extensions
 }:
 let
-  # FIXME: workaround until https://github.com/NixOS/nixpkgs/pull/162246 lands
-  cleanName = if lib.hasInfix " " name
-                then throw "makeDesktopItem: name must not contain spaces!"
-                else name;
-
  # There are multiple places in the FDO spec that make "boolean" values actually tristate,
  # e.g. StartupNotify, where "unset" is literally defined as "do something reasonable".
  # So, handle null values separately.
@ -116,8 +111,8 @@ let
  content = [ mainSectionRendered ] ++ actionsRendered;
 in
 writeTextFile {
-  name = "${cleanName}.desktop";
-  destination = "/share/applications/${cleanName}.desktop";
+  name = "${name}.desktop";
+  destination = "/share/applications/${name}.desktop";
  text = builtins.concatStringsSep "\n" content;
-  checkPhase = "${buildPackages.desktop-file-utils}/bin/desktop-file-validate $target";
+  checkPhase = ''${buildPackages.desktop-file-utils}/bin/desktop-file-validate "$target"'';
 }
--- a/pkgs/build-support/test-equal-derivation.nix
+++ b/pkgs/build-support/test-equal-derivation.nix
@ -23,7 +23,7 @@ let
  drvB = builtins.unsafeDiscardOutputDependency b.drvPath or (throw "testEqualDerivation third argument must be a package");
  name =
    if a?name
-    then lib.strings.sanitizeDerivationName "testEqualDerivation-${a.name}"
+    then "testEqualDerivation-${a.name}"
    else "testEqualDerivation";
 in
 if drvA == drvB then
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@ -70,8 +70,7 @@ rec {
    # name of the resulting derivation
    }: buildCommand:
    stdenv.mkDerivation ({
-      name = lib.strings.sanitizeDerivationName name;
-      inherit buildCommand;
+      inherit buildCommand name;
      passAsFile = [ "buildCommand" ]
        ++ (derivationArgs.passAsFile or []);
    }
@ -121,7 +120,7 @@ rec {
        allowSubstitutes = false;
      }
      ''
-        target=$out${destination}
+        target=$out${lib.escapeShellArg destination}
        mkdir -p "$(dirname "$target")"

        if [ -e "$textPath" ]; then
--- a/pkgs/build-support/trivial-builders/test/write-text-file.nix
+++ b/pkgs/build-support/trivial-builders/test/write-text-file.nix
@ -0,0 +1,34 @@
+{ writeTextFile }:
+let
+  veryWeirdName = ''here's a name with some "bad" characters, like spaces and quotes'';
+in writeTextFile {
+  name = "weird-names";
+  destination = "/etc/${veryWeirdName}";
+  text = ''passed!'';
+  checkPhase = ''
+    # intentionally hardcode everything here, to make sure
+    # Nix does not mess with file paths
+
+    name="here's a name with some \"bad\" characters, like spaces and quotes"
+    fullPath="$out/etc/$name"
+
+    if [ -f "$fullPath" ]; then
+      echo "[PASS] File exists!"
+    else
+      echo "[FAIL] File was not created at expected path!"
+      exit 1
+    fi
+
+    content=$(<"$fullPath")
+    expected="passed!"
+
+    if [ "$content" = "$expected" ]; then
+      echo "[PASS] Contents match!"
+    else
+      echo "[FAIL] File contents don't match!"
+      echo "       Expected: $expected"
+      echo "       Got:      $content"
+      exit 2
+    fi
+  '';
+}
--- a/pkgs/data/icons/hicolor-icon-theme/default.nix
+++ b/pkgs/data/icons/hicolor-icon-theme/default.nix
@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl }:

 stdenv.mkDerivation rec {
-  name = "hicolor-icon-theme-0.17";
+  pname = "hicolor-icon-theme";
+  version = "0.17";

  src = fetchurl {
-    url = "https://icon-theme.freedesktop.org/releases/${name}.tar.xz";
+    url = "https://icon-theme.freedesktop.org/releases/hicolor-icon-theme-${version}.tar.xz";
    sha256 = "1n59i3al3zx6p90ff0l43gzpzmlqnzm6hf5cryxqrlbi48sq8x1i";
  };

--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@ -1,9 +1,8 @@
 { lib, fetchzip, stdenvNoCC, writeText }:

-let
+stdenvNoCC.mkDerivation rec {
+  pname = "iana-etc";
  version = "20211124";
-in stdenvNoCC.mkDerivation {
-  name = "iana-etc-${version}";
  src = fetchzip {
    url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
    sha256 = "sha256-4mM/ZeGd91e1AklGHFK5UB4llg9IgCo9DKcM0iXcBls=";
--- a/pkgs/data/misc/tzdata/default.nix
+++ b/pkgs/data/misc/tzdata/default.nix
@ -2,16 +2,16 @@

 stdenv.mkDerivation rec {
  pname = "tzdata";
-  version = "2021e";
+  version = "2022a";

  srcs =
    [ (fetchurl {
        url = "https://data.iana.org/time-zones/releases/tzdata${version}.tar.gz";
-        sha256 = "1cdjdcxl0s9xf0dg1z64kh7llm80byxqlzrkkjzcdlyh6yvl5v07";
+        sha256 = "0r0nhwpk9nyxj5kkvjy58nr5d85568m04dcb69c4y3zmykczyzzg";
      })
      (fetchurl {
        url = "https://data.iana.org/time-zones/releases/tzcode${version}.tar.gz";
-        sha256 = "0x8pcfmjvxk29yfh8bklchv2f0vpl4yih0gc4wyx292l78wncijq";
+        sha256 = "1iysv8fdkm79k8wh8jizmjmq075q4qjhk090vxjy57my6dz5wmzq";
      })
    ];

--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook-ebnf/default.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook-ebnf/default.nix
@ -1,10 +1,11 @@
 {lib, stdenv, fetchurl}:

-stdenv.mkDerivation {
-  name = "docbook-xml-ebnf-1.2b1";
+stdenv.mkDerivation rec {
+  pname = "docbook-xml-ebnf";
+  version = "1.2b1";

  dtd = fetchurl {
-    url = "http://www.docbook.org/xml/ebnf/1.2b1/dbebnf.dtd";
+    url = "https://docbook.org/xml/ebnf/${version}/dbebnf.dtd";
    sha256 = "0min5dsc53my13b94g2yd65q1nkjcf4x1dak00bsc4ckf86mrx95";
  };
  catalog = ./docbook-ebnf.cat;
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.1.2.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.1.2.nix
@ -1,27 +1,22 @@
 {lib, stdenv, fetchurl, unzip, findXMLCatalogs}:

 let
-
  # Urgh, DocBook 4.1.2 doesn't come with an XML catalog.  Use the one
  # from 4.2.
  docbook42catalog = fetchurl {
-    url = "http://www.docbook.org/xml/4.2/catalog.xml";
+    url = "https://docbook.org/xml/4.2/catalog.xml";
    sha256 = "18lhp6q2l0753s855r638shkbdwq9blm6akdjsc9nrik24k38j17";
  };
-
 in

 import ./generic.nix {
  inherit lib stdenv unzip findXMLCatalogs;
-  name = "docbook-xml-4.1.2";
+  version = "4.1.2";
  src = fetchurl {
-    url = "http://www.docbook.org/xml/4.1.2/docbkx412.zip";
+    url = "https://docbook.org/xml/4.1.2/docbkx412.zip";
    sha256 = "0wkp5rvnqj0ghxia0558mnn4c7s3n501j99q2isp3sp0ci069w1h";
  };
  postInstall = "
    sed 's|V4.2|V4.1.2|g' < ${docbook42catalog} > catalog.xml
  ";
-  meta = {
-    branch = "4.1.2";
-  };
 }
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.2.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.2.nix
@ -2,12 +2,9 @@

 import ./generic.nix {
  inherit lib stdenv unzip findXMLCatalogs;
-  name = "docbook-xml-4.2";
+  version = "4.2";
  src = fetchurl {
-    url = "http://www.docbook.org/xml/4.2/docbook-xml-4.2.zip";
+    url = "https://docbook.org/xml/4.2/docbook-xml-4.2.zip";
    sha256 = "acc4601e4f97a196076b7e64b368d9248b07c7abf26b34a02cca40eeebe60fa2";
  };
-  meta = {
-    branch = "4.2";
-  };
 }
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.3.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.3.nix
@ -2,12 +2,9 @@

 import ./generic.nix {
  inherit lib stdenv unzip findXMLCatalogs;
-  name = "docbook-xml-4.3";
+  version = "4.3";
  src = fetchurl {
-    url = "http://www.docbook.org/xml/4.3/docbook-xml-4.3.zip";
+    url = "https://docbook.org/xml/4.3/docbook-xml-4.3.zip";
    sha256 = "0r1l2if1z4wm2v664sqdizm4gak6db1kx9y50jq89m3gxaa8l1i3";
  };
-  meta = {
-    branch = "4.3";
-  };
 }
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.4.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.4.nix
@ -2,12 +2,9 @@

 import ./generic.nix {
  inherit lib stdenv unzip findXMLCatalogs;
-  name = "docbook-xml-4.4";
+  version = "4.4";
  src = fetchurl {
-    url = "http://www.docbook.org/xml/4.4/docbook-xml-4.4.zip";
+    url = "https://docbook.org/xml/4.4/docbook-xml-4.4.zip";
    sha256 = "141h4zsyc71sfi2zzd89v4bb4qqq9ca1ri9ix2als9f4i3mmkw82";
  };
-  meta = {
-    branch = "4.4";
-  };
 }
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.5.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/4.5.nix
@ -2,12 +2,9 @@

 import ./generic.nix {
  inherit lib stdenv unzip findXMLCatalogs;
-  name = "docbook-xml-4.5";
+  version = "4.5";
  src = fetchurl {
-    url = "http://www.docbook.org/xml/4.5/docbook-xml-4.5.zip";
+    url = "https://docbook.org/xml/4.5/docbook-xml-4.5.zip";
    sha256 = "1d671lcjckjri28xfbf6dq7y3xnkppa910w1jin8rjc35dx06kjf";
  };
-  meta = {
-    branch = "4.5";
-  };
 }
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/generic.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/docbook/generic.nix
@ -1,9 +1,10 @@
-{ lib, stdenv, unzip, src, name, postInstall ? "true", meta ? {}, findXMLCatalogs }:
+{ lib, stdenv, unzip, src, version, postInstall ? "true", findXMLCatalogs }:

 stdenv.mkDerivation {
-  inherit src name postInstall;
+  inherit version src postInstall;
+  pname = "docbook-xml";

-  nativeBuildInputs = [unzip];
+  nativeBuildInputs = [ unzip ];
  propagatedNativeBuildInputs = [ findXMLCatalogs ];

  unpackPhase = ''
@ -17,7 +18,8 @@ stdenv.mkDerivation {
    runHook postInstall
  '';

-  meta = meta // {
+  meta = {
+    branch = version;
    platforms = lib.platforms.unix;
  };
 }
--- a/pkgs/data/sgml+xml/schemas/xml-dtd/xhtml1/default.nix
+++ b/pkgs/data/sgml+xml/schemas/xml-dtd/xhtml1/default.nix
@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, libxml2 }:

 stdenv.mkDerivation {
-  name = "xhtml1-20020801";
+  pname = "xhtml1";
+  version = "unstable-2002-08-01";

  src = fetchurl {
-    url = "http://www.w3.org/TR/xhtml1/xhtml1.tgz";
+    url = "https://www.w3.org/TR/xhtml1/xhtml1.tgz";
    sha256 = "0rr0d89i0z75qvjbm8il93bippx09hbmjwy0y2sj44n9np69x3hl";
  };

--- a/pkgs/desktops/gnome-2/bindings/gnome-python/default.nix
+++ b/pkgs/desktops/gnome-2/bindings/gnome-python/default.nix
@ -5,11 +5,11 @@ with lib;
 let
  inherit (python2.pkgs) python pygobject2 pygtk dbus-python;
 in stdenv.mkDerivation rec {
-  version = "2.28";
-  name = "gnome-python-${version}.1";
+  pname = "gnome-python";
+  version = "2.28.1";

  src = fetchurl {
-    url = "mirror://gnome/sources/gnome-python/${version}/${name}.tar.bz2";
+    url = "mirror://gnome/sources/gnome-python/${lib.versions.majorMinor version}/gnome-python-${version}.tar.bz2";
    sha256 = "759ce9344cbf89cf7f8449d945822a0c9f317a494f56787782a901e4119b96d8";
  };

@ -20,7 +20,7 @@ in stdenv.mkDerivation rec {
  # gnome-python expects that .pth file is already installed by PyGTK in the
  # same directory. This is not the case for Nix.
  postInstall = ''
-    echo "gtk-2.0" > $out/${python2.sitePackages}/${name}.pth
+    echo "gtk-2.0" > $out/${python2.sitePackages}/gnome-python-${version}.pth
  '';

  meta = with lib; {
--- a/pkgs/desktops/gnome-2/desktop/scrollkeeper/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/scrollkeeper/default.nix
@ -1,9 +1,11 @@
-{stdenv, fetchurl, pkg-config, perlPackages, libxml2, libxslt, docbook_xml_dtd_42, automake, gettext}:
+{ lib, stdenv, fetchurl, pkg-config, perlPackages, libxml2, libxslt, docbook_xml_dtd_42, automake, gettext }:
+
+stdenv.mkDerivation rec {
+  pname = "scrollkeeper";
+  version = "0.3.14";

-stdenv.mkDerivation {
-  name = "scrollkeeper-0.3.14";
  src = fetchurl {
-    url = "mirror://gnome/sources/scrollkeeper/0.3/scrollkeeper-0.3.14.tar.bz2";
+    url = "mirror://gnome/sources/scrollkeeper/${lib.versions.majorMinor version}/scrollkeeper-${version}.tar.bz2";
    sha256 = "08n1xgj1f53zahwm0wpn3jid3rfbhi3iwby0ilaaldnid5qriqgc";
  };

--- a/pkgs/desktops/gnome-2/platform/ORBit2/default.nix
+++ b/pkgs/desktops/gnome-2/platform/ORBit2/default.nix
@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, pkg-config, glib, libIDL, libintl }:

 stdenv.mkDerivation rec {
-  name = "ORBit2-${minVer}.19";
-  minVer = "2.14";
+  pname = "ORBit2";
+  version = "2.14.19";

  src = fetchurl {
-    url = "mirror://gnome/sources/ORBit2/${minVer}/${name}.tar.bz2";
+    url = "mirror://gnome/sources/ORBit2/${lib.versions.majorMinor version}/ORBit2-${version}.tar.bz2";
    sha256 = "0l3mhpyym9m5iz09fz0rgiqxl2ym6kpkwpsp1xrr4aa80nlh1jam";
  };

--- a/pkgs/desktops/gnome-2/platform/gnome-common/default.nix
+++ b/pkgs/desktops/gnome-2/platform/gnome-common/default.nix
@ -1,11 +1,11 @@
-{ stdenv, fetchurl, which }:
+{ lib, stdenv, fetchurl, which }:

 stdenv.mkDerivation rec {
-  name = "gnome-common-${minVer}.0";
-  minVer = "2.34";
+  pname = "gnome-common";
+  version = "2.34.0";

  src = fetchurl {
-    url = "mirror://gnome/sources/gnome-common/${minVer}/${name}.tar.bz2";
+    url = "mirror://gnome/sources/gnome-common/${lib.versions.majorMinor version}/gnome-common-${version}.tar.bz2";
    sha256 = "1pz13mpp09q5s3bikm8ml92s1g0scihsm4iipqv1ql3mp6d4z73s";
  };

--- a/pkgs/desktops/gnome-2/platform/gnome-mime-data/default.nix
+++ b/pkgs/desktops/gnome-2/platform/gnome-mime-data/default.nix
@ -1,9 +1,10 @@
-{stdenv, fetchurl, intltool}:
+{ lib, stdenv, fetchurl, intltool }:

-stdenv.mkDerivation {
-  name = "gnome-mime-data-2.18.0";
+stdenv.mkDerivation rec {
+  pname = "gnome-mime-data";
+  version = "2.18.0";
  src = fetchurl {
-    url = "mirror://gnome/sources/gnome-mime-data/2.18/gnome-mime-data-2.18.0.tar.bz2";
+    url = "mirror://gnome/sources/gnome-mime-data/${lib.versions.majorMinor version}/gnome-mime-data-${version}.tar.bz2";
    sha256 = "1mvg8glb2a40yilmyabmb7fkbzlqd3i3d31kbkabqnq86xdnn69p";
  };
  nativeBuildInputs = [ intltool ];
--- a/pkgs/desktops/gnome-2/platform/gnome-vfs/default.nix
+++ b/pkgs/desktops/gnome-2/platform/gnome-vfs/default.nix
@ -1,12 +1,12 @@
-{ stdenv, fetchurl, fetchpatch, pkg-config, libxml2, bzip2, openssl, dbus-glib
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, libxml2, bzip2, openssl, dbus-glib
 , glib, gamin, cdparanoia, intltool, GConf, gnome_mime_data, avahi, acl }:

 stdenv.mkDerivation rec {
-  name = "gnome-vfs-${minVer}.4";
-  minVer = "2.24";
+  pname = "gnome-vfs";
+  version = "2.24.4";

  src = fetchurl {
-    url = "mirror://gnome/sources/gnome-vfs/${minVer}/${name}.tar.bz2";
+    url = "mirror://gnome/sources/gnome-vfs/${lib.versions.majorMinor version}/gnome-vfs-${version}.tar.bz2";
    sha256 = "1ajg8jb8k3snxc7rrgczlh8daxkjidmcv3zr9w809sq4p2sn9pk2";
  };

--- a/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
+++ b/pkgs/desktops/gnome-2/platform/gtkhtml/default.nix
@ -1,11 +1,12 @@
-{ stdenv, fetchurl, pkg-config, gtk2, intltool,
+{ lib, stdenv, fetchurl, pkg-config, gtk2, intltool,
 GConf, enchant, isocodes, gnome-icon-theme }:

 stdenv.mkDerivation rec {
-  name = "gtkhtml-3.32.2";
+  pname = "gtkhtml";
+  version = "3.32.2";

  src = fetchurl {
-    url = "mirror://gnome/sources/gtkhtml/3.32/${name}.tar.bz2";
+    url = "mirror://gnome/sources/gtkhtml/${lib.versions.majorMinor version}/gtkhtml-${version}.tar.bz2";
    sha256 = "17z3jwvpn8waz7bhwrk7a6vs9pad6sqmlxxcqwvxxq89ywy0ail7";
  };

--- a/pkgs/desktops/gnome-2/platform/libIDL/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libIDL/default.nix
@ -1,11 +1,11 @@
-{stdenv, fetchurl, flex, bison, pkg-config, glib, gettext}:
+{ lib, stdenv, fetchurl, flex, bison, pkg-config, glib, gettext }:

 stdenv.mkDerivation rec {
-  name = "libIDL-${minVer}.14";
-  minVer = "0.8";
+  pname = "libIDL";
+  version = "0.8.14";

  src = fetchurl {
-    url = "mirror://gnome/sources/libIDL/${minVer}/${name}.tar.bz2";
+    url = "mirror://gnome/sources/libIDL/${lib.versions.majorMinor version}/libIDL-${version}.tar.bz2";
    sha256 = "08129my8s9fbrk0vqvnmx6ph4nid744g5vbwphzkaik51664vln5";
  };

--- a/pkgs/desktops/gnome-2/platform/libart_lgpl/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libart_lgpl/default.nix
@ -1,9 +1,10 @@
-{stdenv, fetchurl}:
+{ lib, stdenv, fetchurl }:

 stdenv.mkDerivation rec {
-  name = "libart_lgpl-2.3.21";
+  pname = "libart_lgpl";
+  version = "2.3.21";
  src = fetchurl {
-    url = "mirror://gnome/sources/libart_lgpl/2.3/${name}.tar.bz2";
+    url = "mirror://gnome/sources/libart_lgpl/${lib.versions.majorMinor version}/libart_lgpl-${version}.tar.bz2";
    sha256 = "1yknfkyzgz9s616is0l9gp5aray0f2ry4dw533jgzj8gq5s1xhgx";
  };
 }
--- a/pkgs/desktops/gnome-2/platform/libbonobo/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libbonobo/default.nix
@ -1,12 +1,12 @@
-{ stdenv, fetchurl, flex, bison, pkg-config, glib, libxml2, popt
+{ lib, stdenv, fetchurl, flex, bison, pkg-config, glib, libxml2, popt
 , intltool, ORBit2, procps }:

 stdenv.mkDerivation rec {
-  name = "libbonobo-${minVer}.1";
-  minVer = "2.32";
+  pname = "libbonobo";
+  version = "2.32.1";

  src = fetchurl {
-    url = "mirror://gnome/sources/libbonobo/${minVer}/${name}.tar.bz2";
+    url = "mirror://gnome/sources/libbonobo/${lib.versions.majorMinor version}/libbonobo-${version}.tar.bz2";
    sha256 = "0swp4kk6x7hy1rvd1f9jba31lvfc6qvafkvbpg9h0r34fzrd8q4i";
  };

--- a/pkgs/desktops/gnome-2/platform/libbonoboui/default.nix
+++ b/pkgs/desktops/gnome-2/platform/libbonoboui/default.nix
@ -1,12 +1,12 @@
-{ stdenv, fetchurl, bison, pkg-config, popt, libxml2, gtk2, libtool
+{ lib, stdenv, fetchurl, bison, pkg-config, popt, libxml2, gtk2, libtool
 , intltool, libbonobo, GConf, libgnomecanvas, libgnome, libglade }:

 stdenv.mkDerivation rec {
-  name = "libbonoboui-${minVer}.5";
-  minVer = "2.24";
+  pname = "libbonoboui";
+  version = "2.24.5";

  src = fetchurl {
-    url = "mirror://gnome/sources/libbonoboui/${minVer}/${name}.tar.bz2";
+    url = "mirror://gnome/sources/libbonoboui/${lib.versions.majorMinor version}/libbonoboui-${version}.tar.bz2";
    sha256 = "1kbgqh7bw0fdx4f1a1aqwpff7gp5mwhbaz60c6c98bc4djng5dgs";
  };

--- a/Show More
+++ b/Show More