Merge master into haskell-updates

2021-12-01 00:08:48 +00:00
parent b2e4708105 537e1d6218
commit 0128395ffd
138 changed files with 2176 additions and 840 deletions
@@ -28,7 +28,7 @@ Reviewing guidelines: https://nixos.org/manual/nixpkgs/unstable/#chap-reviewing-
  - made sure NixOS tests are [linked](https://nixos.org/manual/nixpkgs/unstable/#ssec-nixos-tests-linking) to the relevant packages
 - [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage)
 - [ ] Tested basic functionality of all binary files (usually in `./result/bin/`)
- [21.11 Release Notes (or backporting 21.05 Release notes)](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#generating-2111-release-notes)
+- [22.05 Release Notes (or backporting 21.11 Release notes)](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#generating-2205-release-notes)
  - [ ] (Package updates) Added a release notes entry if the change is major or breaking
  - [ ] (Module updates) Added a release notes entry if the change is significant
  - [ ] (Module addition) Added a release notes entry if adding a new NixOS module
@@ -13,30 +13,33 @@ jobs:
    runs-on: ubuntu-latest
    if: github.repository_owner == 'NixOS'
    steps:
+    - name: Get list of changed files from PR
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        echo 'PR_DIFF<<EOF' >> $GITHUB_ENV
+        gh api \
+          repos/NixOS/nixpkgs/pulls/${{github.event.number}}/files --paginate \
+          | jq '.[] | select(.status != "removed") | .filename' \
+          >> $GITHUB_ENV
+        echo 'EOF' >> $GITHUB_ENV
    - uses: actions/checkout@v2
+      with:
+        # pull_request_target checks out the base branch by default
+        ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      if: env.PR_DIFF
    - uses: cachix/install-nix-action@v16
+      if: env.PR_DIFF
      with:
        # nixpkgs commit is pinned so that it doesn't break
        nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/f93ecc4f6bc60414d8b73dbdf615ceb6a2c604df.tar.gz
    - name: install editorconfig-checker
      run: nix-env -iA editorconfig-checker -f '<nixpkgs>'
-    - name: Get list of changed files from PR
-      run: |
-        git fetch origin --depth 1 ${{ github.event.pull_request.head.sha }}
-        git checkout ${{ github.event.pull_request.head.sha }}
-
-        git fetch origin --depth 1 ${{ github.event.pull_request.base.sha }}
-        git checkout ${{ github.event.pull_request.base.sha }}
-
-        git fetch origin --depth 1 pull/${{ github.event.pull_request.number }}/merge
-        # check this out last as editorconfig should check this commit
-        git checkout FETCH_HEAD
-
-        # everything except --diff-filter=D (deleted)
-        git diff --diff-filter=ACMRTUXB --name-only ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }} > $HOME/changed_files
+      if: env.PR_DIFF
    - name: Checking EditorConfig
+      if: env.PR_DIFF
      run: |
-        cat $HOME/changed_files | xargs -r editorconfig-checker -disable-indent-size
+        echo "$PR_DIFF" | xargs editorconfig-checker -disable-indent-size
    - if: ${{ failure() }}
      run: |
        echo "::error :: Hey! It looks like your changes don't follow our editorconfig settings. Read https://editorconfig.org/#download to configure your editor so you never see this error again."
@@ -53,10 +53,10 @@ For package version upgrades and such a one-line commit message is usually suffi
 Follow these steps to backport a change into a release branch in compliance with the [commit policy](https://nixos.org/nixpkgs/manual/#submitting-changes-stable-release-branches).

 1. Take note of the commits in which the change was introduced into `master` branch.
-2. Check out the target _release branch_, e.g. `release-20.09`. Do not use a _channel branch_ like `nixos-20.09` or `nixpkgs-20.09`.
+2. Check out the target _release branch_, e.g. `release-21.11`. Do not use a _channel branch_ like `nixos-21.11` or `nixpkgs-21.11-darwin`.
 3. Create a branch for your change, e.g. `git checkout -b backport`.
 4. When the reason to backport is not obvious from the original commit message, use `git cherry-pick -xe <original commit>` and add a reason. Otherwise use `git cherry-pick -x <original commit>`. That's fine for minor version updates that only include security and bug fixes, commits that fixes an otherwise broken package or similar. Please also ensure the commits exists on the master branch; in the case of squashed or rebased merges, the commit hash will change and the new commits can be found in the merge message at the bottom of the master pull request.
-5. Push to GitHub and open a backport pull request. Make sure to select the release branch (e.g. `release-20.09`) as the target branch of the pull request, and link to the pull request in which the original change was comitted to `master`. The pull request title should be the commit title with the release version as prefix, e.g. `[20.09]`.
+5. Push to GitHub and open a backport pull request. Make sure to select the release branch (e.g. `release-21.11`) as the target branch of the pull request, and link to the pull request in which the original change was comitted to `master`. The pull request title should be the commit title with the release version as prefix, e.g. `[21.11]`.
 6. When the backport pull request is merged and you have the necessary privileges you can also replace the label `9.needs: port to stable` with `8.has: port to stable` on the original pull request. This way maintainers can keep track of missing backports easier.

 ## Criteria for Backporting changes
@@ -68,17 +68,17 @@ Anything that does not cause user or downstream dependency regressions can be ba
 - Services which require a client to be up-to-date regardless. (E.g. `spotify`, `steam`, or `discord`)
 - Security critical applications (E.g. `firefox`)

-## Generating 21.11 Release Notes
+## Generating 22.05 Release Notes

-(This section also applies to backporting 21.05 release notes: substitute "rl-2111" for "rl-2105".)
+(This section also applies to backporting 21.11 release notes: substitute "rl-2205" for "rl-2111".)

 Documentation in nixpkgs is transitioning to a markdown-centric workflow. Release notes now require a translation step to convert from markdown to a compatible docbook document.

-Steps for updating 21.11 Release notes:
+Steps for updating 22.05 Release notes:

-1. Edit `nixos/doc/manual/release-notes/rl-2111.section.md` with the desired changes
-2. Run `./nixos/doc/manual/md-to-db.sh` to render `nixos/doc/manual/from_md/release-notes/rl-2111.section.xml`
-3. Include changes to `rl-2111.section.md` and `rl-2111.section.xml` in the same commit.
+1. Edit `nixos/doc/manual/release-notes/rl-2205.section.md` with the desired changes
+2. Run `./nixos/doc/manual/md-to-db.sh` to render `nixos/doc/manual/from_md/release-notes/rl-2205.section.xml`
+3. Include changes to `rl-2205.section.md` and `rl-2205.section.xml` in the same commit.

 ## Reviewing contributions

@@ -46,9 +46,9 @@ Nixpkgs and NixOS are built and tested by our continuous integration
 system, [Hydra](https://hydra.nixos.org/).

 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for the NixOS 21.05 release](https://hydra.nixos.org/jobset/nixos/release-21.05)
+* [Continuous package builds for the NixOS 21.11 release](https://hydra.nixos.org/jobset/nixos/release-21.11)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for the NixOS 21.05 release](https://hydra.nixos.org/job/nixos/release-21.05/tested#tabs-constituents)
+* [Tests for the NixOS 21.11 release](https://hydra.nixos.org/job/nixos/release-21.11/tested#tabs-constituents)

 Artifacts successfully built with Hydra are published to cache at
 https://cache.nixos.org/. When successful build and test criteria are
@@ -8974,12 +8974,6 @@
    githubId = 8641;
    name = "Pierre Carrier";
  };
-  pengmeiyu = {
-    email = "pengmyu@gmail.com";
-    github = "pmeiyu";
-    githubId = 8529551;
-    name = "Peng Mei Yu";
-  };
  penguwin = {
    email = "penguwin@penguwin.eu";
    github = "penguwin";
@@ -9255,6 +9249,12 @@
    githubId = 178496;
    name = "Philipp Middendorf";
  };
+  pmy = {
+    email = "pmy@xqzp.net";
+    github = "pmeiyu";
+    githubId = 8529551;
+    name = "Peng Mei Yu";
+  };
  pmyjavec = {
    email = "pauly@myjavec.com";
    github = "pmyjavec";
@@ -12,7 +12,7 @@
    <listitem>
      <para>
        <emphasis>Stable channels</emphasis>, such as
-        <link xlink:href="https://nixos.org/channels/nixos-21.05"><literal>nixos-21.05</literal></link>.
+        <link xlink:href="https://nixos.org/channels/nixos-21.11"><literal>nixos-21.11</literal></link>.
        These only get conservative bug fixes and package upgrades. For
        instance, a channel update may cause the Linux kernel on your
        system to be upgraded from 4.19.34 to 4.19.38 (a minor bug fix),
@@ -33,7 +33,7 @@
    <listitem>
      <para>
        <emphasis>Small channels</emphasis>, such as
-        <link xlink:href="https://nixos.org/channels/nixos-21.05-small"><literal>nixos-21.05-small</literal></link>
+        <link xlink:href="https://nixos.org/channels/nixos-21.11-small"><literal>nixos-21.11-small</literal></link>
        or
        <link xlink:href="https://nixos.org/channels/nixos-unstable-small"><literal>nixos-unstable-small</literal></link>.
        These are identical to the stable and unstable channels
@@ -60,8 +60,8 @@
  <para>
    When you first install NixOS, you’re automatically subscribed to the
    NixOS channel that corresponds to your installation source. For
-    instance, if you installed from a 21.05 ISO, you will be subscribed
-    to the <literal>nixos-21.05</literal> channel. To see which NixOS
+    instance, if you installed from a 21.11 ISO, you will be subscribed
+    to the <literal>nixos-21.11</literal> channel. To see which NixOS
    channel you’re subscribed to, run the following as root:
  </para>
  <programlisting>
@@ -76,17 +76,17 @@ nixos https://nixos.org/channels/nixos-unstable
 </programlisting>
  <para>
    (Be sure to include the <literal>nixos</literal> parameter at the
-    end.) For instance, to use the NixOS 21.05 stable channel:
+    end.) For instance, to use the NixOS 21.11 stable channel:
  </para>
  <programlisting>
-# nix-channel --add https://nixos.org/channels/nixos-21.05 nixos
+# nix-channel --add https://nixos.org/channels/nixos-21.11 nixos
 </programlisting>
  <para>
    If you have a server, you may want to use the <quote>small</quote>
    channel instead:
  </para>
  <programlisting>
-# nix-channel --add https://nixos.org/channels/nixos-21.05-small nixos
+# nix-channel --add https://nixos.org/channels/nixos-21.11-small nixos
 </programlisting>
  <para>
    And if you want to live on the bleeding edge:
@@ -146,7 +146,7 @@ system.autoUpgrade.allowReboot = true;
      also specify a channel explicitly, e.g.
    </para>
    <programlisting language="bash">
-system.autoUpgrade.channel = https://nixos.org/channels/nixos-21.05;
+system.autoUpgrade.channel = https://nixos.org/channels/nixos-21.11;
 </programlisting>
  </section>
 </chapter>
@@ -1,5 +1,5 @@
 <section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-release-21.11">
-  <title>Release 21.11 (“Porcupine”, 2021.11/??)</title>
+  <title>Release 21.11 (“Porcupine”, 2021/11/30)</title>
  <para>
    In addition to numerous new and upgraded packages, this release has
    the following highlights:
@@ -37,7 +37,7 @@
      </listitem>
      <listitem>
        <para>
-          kOps now defaults to 1.21.1, which uses containerd as the
+          kops now defaults to 1.21.1, which uses containerd as the
          default runtime.
        </para>
      </listitem>
@@ -84,13 +84,13 @@
      </listitem>
      <listitem>
        <para>
-          Activation scripts can now opt int to be run when running
-          <literal>nixos-rebuild dry-activate</literal> and detect the
-          dry activation by reading <literal>$NIXOS_ACTION</literal>.
-          This allows activation scripts to output what they would
-          change if the activation was really run. The users/modules
-          activation script supports this and outputs some of is
-          actions.
+          Activation scripts can now, optionally, be run during a
+          <literal>nixos-rebuild dry-activate</literal> and can detect
+          the dry activation by reading
+          <literal>$NIXOS_ACTION</literal>. This allows activation
+          scripts to output what they would change if the activation was
+          really run. The users/modules activation script supports this
+          and outputs some of is actions.
        </para>
      </listitem>
      <listitem>
@@ -6,7 +6,7 @@ expressions and associated binaries. The NixOS channels are updated
 automatically from NixOS's Git repository after certain tests have
 passed and all packages have been built. These channels are:

-   *Stable channels*, such as [`nixos-21.05`](https://nixos.org/channels/nixos-21.05).
+-   *Stable channels*, such as [`nixos-21.11`](https://nixos.org/channels/nixos-21.11).
    These only get conservative bug fixes and package upgrades. For
    instance, a channel update may cause the Linux kernel on your system
    to be upgraded from 4.19.34 to 4.19.38 (a minor bug fix), but not
@@ -19,7 +19,7 @@ passed and all packages have been built. These channels are:
    radical changes between channel updates. It's not recommended for
    production systems.

-   *Small channels*, such as [`nixos-21.05-small`](https://nixos.org/channels/nixos-21.05-small)
+-   *Small channels*, such as [`nixos-21.11-small`](https://nixos.org/channels/nixos-21.11-small)
    or [`nixos-unstable-small`](https://nixos.org/channels/nixos-unstable-small).
    These are identical to the stable and unstable channels described above,
    except that they contain fewer binary packages. This means they get updated
@@ -38,8 +38,8 @@ newest supported stable release.

 When you first install NixOS, you're automatically subscribed to the
 NixOS channel that corresponds to your installation source. For
-instance, if you installed from a 21.05 ISO, you will be subscribed to
-the `nixos-21.05` channel. To see which NixOS channel you're subscribed
+instance, if you installed from a 21.11 ISO, you will be subscribed to
+the `nixos-21.11` channel. To see which NixOS channel you're subscribed
 to, run the following as root:

 ```ShellSession
@@ -54,16 +54,16 @@ To switch to a different NixOS channel, do
 ```

 (Be sure to include the `nixos` parameter at the end.) For instance, to
-use the NixOS 21.05 stable channel:
+use the NixOS 21.11 stable channel:

 ```ShellSession
-# nix-channel --add https://nixos.org/channels/nixos-21.05 nixos
+# nix-channel --add https://nixos.org/channels/nixos-21.11 nixos
 ```

 If you have a server, you may want to use the "small" channel instead:

 ```ShellSession
-# nix-channel --add https://nixos.org/channels/nixos-21.05-small nixos
+# nix-channel --add https://nixos.org/channels/nixos-21.11-small nixos
 ```

 And if you want to live on the bleeding edge:
@@ -114,5 +114,5 @@ the new generation contains a different kernel, initrd or kernel
 modules. You can also specify a channel explicitly, e.g.

 ```nix
-system.autoUpgrade.channel = https://nixos.org/channels/nixos-21.05;
+system.autoUpgrade.channel = https://nixos.org/channels/nixos-21.11;
 ```
@@ -1,4 +1,4 @@
-# Release 21.11 (“Porcupine”, 2021.11/??) {#sec-release-21.11}
+# Release 21.11 (“Porcupine”, 2021/11/30) {#sec-release-21.11}

 In addition to numerous new and upgraded packages, this release has the following highlights:

@@ -12,7 +12,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - PHP now defaults to PHP 8.0, updated from 7.4.

- kOps now defaults to 1.21.1, which uses containerd as the default runtime.
+- kops now defaults to 1.21.1, which uses containerd as the default runtime.

 - `python3` now defaults to Python 3.9, updated from Python 3.8.

@@ -25,7 +25,7 @@ In addition to numerous new and upgraded packages, this release has the followin
  - Hadoop now defaults to Hadoop 3, updated from 2.
  - JournalNode, ZKFS and HTTPFS services have been added.

- Activation scripts can now opt int to be run when running `nixos-rebuild dry-activate` and detect the dry activation by reading `$NIXOS_ACTION`.
+- Activation scripts can now, optionally, be run during a `nixos-rebuild dry-activate` and can detect the dry activation by reading `$NIXOS_ACTION`.
  This allows activation scripts to output what they would change if the activation was really run.
  The users/modules activation script supports this and outputs some of is actions.

@@ -22,7 +22,7 @@ rec {
        else throw "Unknown QEMU serial device for system '${pkgs.stdenv.hostPlatform.system}'";

  qemuBinary = qemuPkg: {
-    x86_64-linux = "${qemuPkg}/bin/qemu-kvm -cpu max";
+    x86_64-linux = "${qemuPkg}/bin/qemu-kvm -cpu qemu64";
    armv7l-linux = "${qemuPkg}/bin/qemu-system-arm -enable-kvm -machine virt -cpu host";
    aarch64-linux = "${qemuPkg}/bin/qemu-system-aarch64 -enable-kvm -machine virt,gic-version=host -cpu host";
    powerpc64le-linux = "${qemuPkg}/bin/qemu-system-ppc64 -machine powernv";
@@ -12,6 +12,5 @@ with lib;
    boot.loader.systemd-boot.consoleMode = mkDefault "1";

    # TODO Find reasonable defaults X11 & wayland
-    services.xserver.dpi = lib.mkDefault 192;
  };
 }
@@ -179,7 +179,7 @@ in
  in mkIf enabled {
    assertions = [
      {
-        assertion = with config.services.xserver.displayManager; gdm.nvidiaWayland -> cfg.modesetting.enable;
+        assertion = with config.services.xserver.displayManager; (gdm.enable && gdm.nvidiaWayland) -> cfg.modesetting.enable;
        message = "You cannot use wayland with GDM without modesetting enabled for NVIDIA drivers, set `hardware.nvidia.modesetting.enable = true`";
      }

@@ -351,6 +351,7 @@ in
      hqplayer = 319;
      moonraker = 320;
      distcc = 321;
+      webdav = 322;

      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!

@@ -656,6 +657,7 @@ in
      hqplayer = 319;
      moonraker = 320;
      distcc = 321;
+      webdav = 322;

      # When adding a gid, make sure it doesn't match an existing
      # uid. Users and groups with the same name should have equal
@@ -84,12 +84,15 @@ in {
        "bdev"
        "binfmt"
        "binfmt_misc"
+        "ceph"
        "cgroup"
+        "cgroup2"
        "cifs"
        "coda"
        "configfs"
        "cramfs"
        "cpuset"
+        "curlftpfs"
        "debugfs"
        "devfs"
        "devpts"
@@ -101,6 +104,13 @@ in {
        "ftpfs"
        "fuse"
        "fusectl"
+        "fusesmb"
+        "fuse.ceph"
+        "fuse.glusterfs"
+        "fuse.gvfsd-fuse"
+        "fuse.mfs"
+        "fuse.rclone"
+        "fuse.rozofs"
        "fuse.sshfs"
        "gfs"
        "gfs2"
@@ -110,9 +120,15 @@ in {
        "iso9660"
        "jffs2"
        "lustre"
+        "lustre_lite"
        "misc"
+        "mfs"
        "mqueue"
        "ncpfs"
+        "nfs"
+        "NFS"
+        "nfs4"
+        "nfsd"
        "nnpfs"
        "ocfs"
        "ocfs2"
@@ -127,16 +143,14 @@ in {
        "smbfs"
        "sockfs"
        "spufs"
-        "nfs"
-        "NFS"
-        "nfs4"
-        "nfsd"
        "sshfs"
        "subfs"
        "supermount"
        "sysfs"
        "tmpfs"
+        "tracefs"
        "ubifs"
+        "udev"
        "udf"
        "usbfs"
        "vboxsf"
@@ -202,7 +216,7 @@ in {
          PRUNEFS="${lib.concatStringsSep " " cfg.pruneFS}"
          PRUNENAMES="${lib.concatStringsSep " " cfg.pruneNames}"
          PRUNEPATHS="${lib.concatStringsSep " " cfg.prunePaths}"
-          PRUNE_BIND_MOUNTSFR="${lib.boolToString cfg.pruneBindMounts}"
+          PRUNE_BIND_MOUNTS="${if cfg.pruneBindMounts then "yes" else "no"}"
        '';
      };
    };
@@ -685,6 +685,7 @@
  ./services/network-filesystems/diod.nix
  ./services/network-filesystems/u9fs.nix
  ./services/network-filesystems/webdav.nix
+  ./services/network-filesystems/webdav-server-rs.nix
  ./services/network-filesystems/yandex-disk.nix
  ./services/network-filesystems/xtreemfs.nix
  ./services/network-filesystems/ceph.nix
@@ -253,7 +253,7 @@ chmod 400 /var/lib/secrets/certs.secret
 </programlisting>

  <para>
-   Now you're all set to generate certs! You should monitor the first invokation
+   Now you're all set to generate certs! You should monitor the first invocation
   by running <literal>systemctl start acme-example.com.service &amp;
   journalctl -fu acme-example.com.service</literal> and watching its log output.
  </para>
@@ -0,0 +1,144 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.services.webdav-server-rs;
+  format = pkgs.formats.toml { };
+  settings = recursiveUpdate
+    {
+      server.uid = config.users.users."${cfg.user}".uid;
+      server.gid = config.users.groups."${cfg.group}".gid;
+    }
+    cfg.settings;
+in
+{
+  options = {
+    services.webdav-server-rs = {
+      enable = mkEnableOption "WebDAV server";
+
+      user = mkOption {
+        type = types.str;
+        default = "webdav";
+        description = "User to run under when setuid is not enabled.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "webdav";
+        description = "Group to run under when setuid is not enabled.";
+      };
+
+      settings = mkOption {
+        type = format.type;
+        default = { };
+        description = ''
+          Attrset that is converted and passed as config file. Available
+          options can be found at
+          <link xlink:href="https://github.com/miquels/webdav-server-rs/blob/master/webdav-server.toml">here</link>.
+        '';
+        example = literalExpression ''
+          {
+            server.listen = [ "0.0.0.0:4918" "[::]:4918" ];
+            accounts = {
+              auth-type = "htpasswd.default";
+              acct-type = "unix";
+            };
+            htpasswd.default = {
+              htpasswd = "/etc/htpasswd";
+            };
+            location = [
+              {
+                route = [ "/public/*path" ];
+                directory = "/srv/public";
+                handler = "filesystem";
+                methods = [ "webdav-ro" ];
+                autoindex = true;
+                auth = "false";
+              }
+              {
+                route = [ "/user/:user/*path" ];
+                directory = "~";
+                handler = "filesystem";
+                methods = [ "webdav-rw" ];
+                autoindex = true;
+                auth = "true";
+                setuid = true;
+              }
+            ];
+          }
+        '';
+      };
+
+      configFile = mkOption {
+        type = types.path;
+        default = format.generate "webdav-server.toml" settings;
+        defaultText = "Config file generated from services.webdav-server-rs.settings";
+        description = ''
+          Path to config file. If this option is set, it will override any
+          configuration done in services.webdav-server-rs.settings.
+        '';
+        example = "/etc/webdav-server.toml";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = hasAttr cfg.user config.users.users && config.users.users."${cfg.user}".uid != null;
+        message = "users.users.${cfg.user} and users.users.${cfg.user}.uid must be defined.";
+      }
+      {
+        assertion = hasAttr cfg.group config.users.groups && config.users.groups."${cfg.group}".gid != null;
+        message = "users.groups.${cfg.group} and users.groups.${cfg.group}.gid must be defined.";
+      }
+    ];
+
+    users.users = optionalAttrs (cfg.user == "webdav") {
+      webdav = {
+        description = "WebDAV user";
+        group = cfg.group;
+        uid = config.ids.uids.webdav;
+      };
+    };
+
+    users.groups = optionalAttrs (cfg.group == "webdav") {
+      webdav.gid = config.ids.gids.webdav;
+    };
+
+    systemd.services.webdav-server-rs = {
+      description = "WebDAV server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.webdav-server-rs}/bin/webdav-server -c ${cfg.configFile}";
+
+        CapabilityBoundingSet = [
+          "CAP_SETUID"
+          "CAP_SETGID"
+        ];
+
+        NoExecPaths = [ "/" ];
+        ExecPaths = [ "/nix/store" ];
+
+        # This program actively detects if it is running in root user account
+        # when it starts and uses root privilege to switch process uid to
+        # respective unix user when a user logs in.  Maybe we can enable
+        # DynamicUser in the future when it's able to detect CAP_SETUID and
+        # CAP_SETGID capabilities.
+
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = true;
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ pmy ];
+}
@@ -80,13 +80,13 @@ in
    users.users = mkIf (cfg.user == "webdav") {
      webdav = {
        description = "WebDAV daemon user";
-        isSystemUser = true;
        group = cfg.group;
+        uid = config.ids.uids.webdav;
      };
    };

    users.groups = mkIf (cfg.group == "webdav") {
-      webdav = { };
+      webdav.gid = config.ids.gids.webdav;
    };

    systemd.services.webdav = {
@@ -103,5 +103,5 @@ in
    };
  };

-  meta.maintainers = with maintainers; [ pengmeiyu ];
+  meta.maintainers = with maintainers; [ pmy ];
 }
@@ -79,6 +79,11 @@ let
      # we use a list of mime types from the mailcap package, which is also
      # used by most other Linux distributions by default.
      include ${pkgs.mailcap}/etc/nginx/mime.types;
+      # When recommendedOptimisation is disabled nginx fails to start because the mailmap mime.types database
+      # contains 1026 enries and the default is only 1024. Setting to a higher number to remove the need to
+      # overwrite it because nginx does not allow duplicated settings.
+      types_hash_max_size 4096;
+
      include ${cfg.package}/conf/fastcgi.conf;
      include ${cfg.package}/conf/uwsgi_params;

@@ -113,7 +118,6 @@ let
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
-        types_hash_max_size 4096;
      ''}

      ssl_protocols ${cfg.sslProtocols};
@@ -354,8 +354,8 @@ let
      createPartitions = ''
        machine.succeed(
            "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
-            + " mkpart primary ext2 1M 50MB"  # /boot
-            + " mkpart primary linux-swap 50M 1024M"
+            + " mkpart primary ext2 1M 100MB"  # /boot
+            + " mkpart primary linux-swap 100M 1024M"
            + " mkpart primary 1024M -1s",  # LUKS
            "udevadm settle",
            "mkswap /dev/vda2 -L swap",
@@ -456,9 +456,9 @@ in {
    createPartitions = ''
      machine.succeed(
          "flock /dev/vda parted --script /dev/vda -- mklabel gpt"
-          + " mkpart ESP fat32 1M 50MiB"  # /boot
+          + " mkpart ESP fat32 1M 100MiB"  # /boot
          + " set 1 boot on"
-          + " mkpart primary linux-swap 50MiB 1024MiB"
+          + " mkpart primary linux-swap 100MiB 1024MiB"
          + " mkpart primary ext2 1024MiB -1MiB",  # /
          "udevadm settle",
          "mkswap /dev/vda2 -L swap",
@@ -483,8 +483,8 @@ in {
    createPartitions = ''
      machine.succeed(
          "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
-          + " mkpart primary ext2 1M 50MB"  # /boot
-          + " mkpart primary linux-swap 50MB 1024M"
+          + " mkpart primary ext2 1M 100MB"  # /boot
+          + " mkpart primary linux-swap 100MB 1024M"
          + " mkpart primary ext2 1024M -1s",  # /
          "udevadm settle",
          "mkswap /dev/vda2 -L swap",
@@ -503,8 +503,8 @@ in {
    createPartitions = ''
      machine.succeed(
          "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
-          + " mkpart primary ext2 1M 50MB"  # /boot
-          + " mkpart primary linux-swap 50MB 1024M"
+          + " mkpart primary ext2 1M 100MB"  # /boot
+          + " mkpart primary linux-swap 100MB 1024M"
          + " mkpart primary ext2 1024M -1s",  # /
          "udevadm settle",
          "mkswap /dev/vda2 -L swap",
@@ -599,8 +599,8 @@ in {
    createPartitions = ''
      machine.succeed(
          "flock /dev/vda parted --script /dev/vda -- mklabel msdos"
-          + " mkpart primary ext2 1M 50MB"  # /boot
-          + " mkpart primary linux-swap 50M 1024M"
+          + " mkpart primary ext2 1M 100MB"  # /boot
+          + " mkpart primary linux-swap 100M 1024M"
          + " mkpart primary 1024M 1280M"  # LUKS with keyfile
          + " mkpart primary 1280M -1s",
          "udevadm settle",
@@ -674,8 +674,8 @@ in {
      machine.succeed(
          "flock /dev/vda parted --script /dev/vda --"
          + " mklabel msdos"
-          + " mkpart primary ext2 1M 50MB"  # /boot
-          + " mkpart primary 50MB 512MB  "  # swap
+          + " mkpart primary ext2 1M 100MB"  # /boot
+          + " mkpart primary 100MB 512MB  "  # swap
          + " mkpart primary 512MB 1024MB"  # Cache (typically SSD)
          + " mkpart primary 1024MB -1s ",  # Backing device (typically HDD)
          "modprobe bcache",
@@ -1,4 +1,4 @@
-{lib, stdenv, fetchurl, SDL, SDL_gfx, SDL_image, tremor, flac, mpg123, libmikmod
+{lib, stdenv, fetchurl, fetchpatch, SDL, SDL_gfx, SDL_image, tremor, flac, mpg123, libmikmod
 , speex, ncurses
 , keymap ? "default"
 , conf ? "unknown"
@@ -13,6 +13,24 @@ stdenv.mkDerivation rec {
    sha256 = "03x0mc0xw2if0bpf0a15yprcyx1xccki039zvl2099dagwk6xskv";
  };

+  patches = [
+     # pull pending upstream inclusion fix for ncurses-6.3:
+     #  https://github.com/jhe2/gmu/pull/7
+     (fetchpatch {
+       name = "ncurses-6.3.patch";
+       url = "https://github.com/jhe2/gmu/commit/c8b3a10afee136feb333754ef6ec26383b11072f.patch";
+       sha256 = "0xp2j3jp8pkmv6yvnzi378m2dylbfsaqrsrkw7hbxw6kglzj399r";
+     })
+
+     # pull upstream fix for -fno-common toolchains like
+     # upstream gcc-10 of clang-13.
+     (fetchpatch {
+       name = "fno-common.patch";
+       url = "https://github.com/jhe2/gmu/commit/b705209f08ddfda141ad358ccd0c3d2d099be5e6.patch";
+       sha256 = "1ci2b8kz3r58rzmivlfhqjmcgqwlkwlzzhnyxlk36vmk240a3gqq";
+     })
+  ];
+
  buildInputs = [ SDL SDL_gfx SDL_image tremor flac mpg123 libmikmod speex ncurses ];

  makeFlags = [ "PREFIX=$(out)" ];
@@ -2,11 +2,11 @@

 python3Packages.buildPythonApplication rec {
  pname = "Mopidy-Iris";
-  version = "3.59.0";
+  version = "3.60.0";

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "0llvn0khl07ni34jvb3a1r6rnkf0ljizhpqrs5bdishfhpwyhm0j";
+    sha256 = "18w6qqmxzn8psiacybryxailm826f3j1wgiv0c03fbdsy6kr5f7l";
  };

  propagatedBuildInputs = [
@@ -2,12 +2,12 @@

 let
  pname = "ledger-live-desktop";
-  version = "2.35.1";
+  version = "2.35.2";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://github.com/LedgerHQ/${pname}/releases/download/v${version}/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256:0z60c4sjq63r5rs95rbv7afliia05l1p9bgfd5zv7i51qxgzfs4a";
+    hash = "sha256-VJr1H6YcPtCzm6FeFA+rNANvYUQ3wZQalI9RdSv68cI=";
  };

  appimageContents = appimageTools.extractType2 {
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ncurses }:
+{ lib, stdenv, fetchurl, fetchpatch, ncurses }:

 stdenv.mkDerivation rec {
  pname = "bviplus";
@@ -9,6 +9,18 @@ stdenv.mkDerivation rec {
    sha256 = "08q2fdyiirabbsp5qpn3v8jxp4gd85l776w6gqvrbjwqa29a8arg";
  };

+  patches = [
+    # Fix pending upstream inclusion for ncurses-6.3 support:
+    #  https://sourceforge.net/p/bviplus/bugs/7/
+    (fetchpatch {
+      name = "ncurses-6.3.patch";
+      url = "https://sourceforge.net/p/bviplus/bugs/7/attachment/bviplus-ncurses-6.2.patch";
+      sha256 = "1g3s2fdly3qliy67f3dlb12a03a21zkjbya6gap4mqxhyyjbp46x";
+      # svn patch, rely on prefix added by fetchpatch:
+      extraPrefix = "";
+    })
+  ];
+
  buildInputs = [
    ncurses
  ];
@@ -0,0 +1,40 @@
+{ stdenv, lib, fetchgit, pkg-config, meson, ninja
+, enchant, gtkmm3, libchamplain, libgcrypt }:
+
+stdenv.mkDerivation rec {
+  pname = "lifeograph";
+  version = "2.0.2";
+
+  src = fetchgit {
+    url = "https://git.launchpad.net/lifeograph";
+    # Specific commit hash related to version
+    rev = "d635bbb30011c0d33c33643e6fa5c006f98ed7d6";
+    sha256 = "0j9wn5bj7cbfnmyyx7ikx961sksv50agnb53prymldbsq43rfgnq";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+  ];
+
+  buildInputs = [
+    libgcrypt
+    enchant
+    gtkmm3
+    libchamplain
+  ];
+
+  postInstall = ''
+    substituteInPlace $out/share/applications/net.sourceforge.Lifeograph.desktop \
+      --replace "Exec=" "Exec=$out/bin/"
+  '';
+
+  meta = with lib; {
+    homepage = "http://lifeograph.sourceforge.net/wiki/Main_Page";
+    description = "Lifeograph is an off-line and private journal and note taking application";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = platforms.linux;
+  };
+}
@@ -10,11 +10,11 @@ with lib;

 perlPackages.buildPerlPackage rec {
  pname = "gscan2pdf";
-  version = "2.12.3";
+  version = "2.12.4";

  src = fetchurl {
    url = "mirror://sourceforge/gscan2pdf/${version}/${pname}-${version}.tar.xz";
-    sha256 = "tdXTcoI7DnrBsXtXR0r07hz0lDcAjZJad+o4wwxHcOk=";
+    sha256 = "sha256-UrBt0QkSk7IP4mZYFoxFNJQ1Qmcb53CemvlYfsxjZ/s=";
  };

  nativeBuildInputs = [ wrapGAppsHook ];
@@ -12,6 +12,12 @@ stdenv.mkDerivation rec {
    sha256 = "0975j4m93s9a21pazwdzn4gqhkngwq7q6ghp0q8a75r6c4fb7aar";
  };

+  postPatch = ''
+    # Add support for ncurses-6.3. Can be dropped with 0.9 release.
+    # Fixed upstream at: https://git.2f30.org/noice/commit/53c35e6b340b7c135038e00057a198f03cb7d7cf.html
+    substituteInPlace noice.c --replace 'printw(str);' 'printw("%s", str);'
+  '';
+
  configFile = optionalString (conf!=null) (builtins.toFile "config.def.h" conf);
  preBuild = optionalString (conf!=null) "cp ${configFile} config.def.h";

@@ -13,13 +13,13 @@
 # logitech-udev-rules instead of adding this to services.udev.packages on NixOS
 python3Packages.buildPythonApplication rec {
  pname = "solaar";
-  version = "1.0.7";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "pwr-Solaar";
    repo = "Solaar";
    rev = version;
-    sha256 = "sha256-RQ7iSiw/0xbPOYhuHg4cQpuJyRcaigWKVw4Jt12T9Uw=";
+    sha256 = "sha256-rNz296pKw2/WaryxHekWHSAS1jdTviZxXDgO/L/PJCU=";
  };

  nativeBuildInputs = [ wrapGAppsHook gdk-pixbuf ];
@@ -14,11 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "viking";
-  version = "1.9";
+  version = "1.10";

  src = fetchurl {
    url = "mirror://sourceforge/viking/viking-${version}.tar.bz2";
-    sha256 = "0fybpy6k0vmjp231h5ckysl3c0rcnh2afznijwq6y78j4hywyjpy";
+    sha256 = "sha256-lFXIlfmLwT3iS9ayNM0PHV7NwbBotMvG62ZE9hJuRaw=";
  };

  nativeBuildInputs = [ docbook_xml_dtd_45 docbook_xsl intltool itstool libxslt pkg-config wrapGAppsHook yelp-tools ];
@@ -7,17 +7,18 @@
 , libressl
 , ncurses
 , autoreconfHook
+, buildPackages
 }:

 stdenv.mkDerivation rec {
  pname = "telescope";
-  version = "0.5.2";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "omar-polo";
    repo = pname;
    rev = version;
-    sha256 = "sha256-AdbFJfoicQUgJ9kesIWZ9ygttyjjDeC0UHRI98GwoZ8=";
+    sha256 = "sha256-r2+jvmnW9EeQf/2X2cOxnOa+HGuGHV6YMftT2MxbSYQ=";
  };

  nativeBuildInputs = [
@@ -32,6 +33,10 @@ stdenv.mkDerivation rec {
    ncurses
  ];

+  configureFlags = [
+    "HOSTCC=${buildPackages.stdenv.cc}/bin/${buildPackages.stdenv.cc.targetPrefix}cc"
+  ];
+
  meta = with lib; {
    description = "Telescope is a w3m-like browser for Gemini";
    homepage = "https://telescope.omarpolo.com/";
@@ -0,0 +1,65 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+, coredns
+, installShellFiles
+, isFull ? false
+, enableGateway ? false
+, pname ? "kuma"
+, components ? lib.optionals isFull [
+    "kumactl"
+    "kuma-cp"
+    "kuma-prometheus-sd"
+    "kuma-dp"
+  ]
+}:
+
+buildGoModule rec {
+  inherit pname ;
+  version = "1.4.0";
+  tags = lib.optionals enableGateway ["gateway"];
+  vendorSha256 = "1fc5psvbd9bpc6c3y2cpx5dx8cgr2fcp7nln3kwfgbryahq2y8wl";
+
+  src = fetchFromGitHub {
+    owner = "kumahq";
+    repo = "kuma";
+    rev = version;
+    sha256 = "0agib3w5s270n5rhg54m3p4f21s5fhdrhaks374j7l21njs7xhqb";
+  };
+
+  doCheck = false;
+
+  nativeBuildInputs = [installShellFiles] ++ lib.optionals isFull [coredns];
+
+  preBuild = ''
+    export HOME=$TMPDIR
+  '';
+
+  subPackages = map (p: "app/" + p) components;
+
+  postInstall = lib.concatMapStringsSep "\n" (p: ''
+    installShellCompletion --cmd ${p} \
+      --bash <($out/bin/${p} completion bash) \
+      --fish <($out/bin/${p} completion fish) \
+      --zsh <($out/bin/${p} completion zsh)
+  '') components + lib.optionalString isFull ''
+    ln -sLf ${coredns}/bin/coredns $out/bin
+  '';
+
+  ldflags = let
+    prefix = "github.com/kumahq/kuma/pkg/version";
+  in [
+    "-s" "-w"
+    "-X ${prefix}.version=${version}"
+    "-X ${prefix}.gitTag=${version}"
+    "-X ${prefix}.gitCommit=${version}"
+    "-X ${prefix}.buildDate=${version}"
+  ];
+
+  meta = with lib; {
+    description = "Service mesh controller";
+    homepage = "https://kuma.io/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ zbioe ];
+  };
+}
@@ -1,34 +0,0 @@
-{ lib, fetchFromGitHub, buildGoModule }:
-
-buildGoModule rec {
-  pname = "kumactl";
-  version = "1.3.1";
-
-  src = fetchFromGitHub {
-    owner = "kumahq";
-    repo = "kuma";
-    rev = version;
-    sha256 = "0b554cngg2j3wnadpqwhq3dv3la8vvvzyww2diw4il4gl4j6xj0j";
-  };
-
-  vendorSha256 = "0r26h4vp11wbl7nk3y7c22p60q7lspy8nr58khxyczdqjk6wrdjp";
-
-  subPackages = [ "app/kumactl" ];
-
-  ldflags = let
-    prefix = "github.com/kumahq/kuma/pkg/version";
-  in [
-    "-s" "-w"
-    "-X ${prefix}.version=${version}"
-    "-X ${prefix}.gitTag=${version}"
-    "-X ${prefix}.gitCommit=${version}"
-    "-X ${prefix}.buildDate=${version}"
-  ];
-
-  meta = with lib; {
-    description = "Kuma service mesh controller";
-    homepage = "https://kuma.io/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ zbioe ];
-  };
-}
@@ -34,11 +34,11 @@
 in
 stdenv.mkDerivation rec {
  pname = "suricata";
-  version = "6.0.3";
+  version = "6.0.4";

  src = fetchurl {
    url = "https://www.openinfosecfoundation.org/download/${pname}-${version}.tar.gz";
-    sha256 = "sha256-2vE0uy18mAA16a5g96rzEzI6gJNAAJ8m5IEQzN6B9gI=";
+    sha256 = "sha256-qPGX4z0WeGieu/e8Gr6Ek0xGXSLFBMR8LH6bdKoELQ0=";
  };

  nativeBuildInputs = [
@@ -0,0 +1,78 @@
+{ stdenv, lib, fetchurl, dpkg, autoPatchelfHook, makeWrapper
+, alsa-lib, dbus, fontconfig, freetype, glib, gst_all_1, libGL
+, libinput, libpulseaudio, libsecret, libtiff, libxkbcommon
+, mesa, openssl, systemd, xorg }:
+
+stdenv.mkDerivation rec {
+  pname = "alfaview";
+  version = "8.32.0";
+
+  src = fetchurl {
+    url = "https://production-alfaview-assets.alfaview.com/stable/linux/${pname}_${version}.deb";
+    sha256 = "sha256-cBf/9MdNXhFRYPAOhQQ8j3rpY4JYh/+NyA7Eji9/E9Q=";
+  };
+
+  nativeBuildInputs = [
+    dpkg
+    makeWrapper
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    alsa-lib
+    dbus
+    fontconfig
+    freetype
+    glib
+    gst_all_1.gst-plugins-bad
+    gst_all_1.gst-plugins-base
+    libGL
+    libinput
+    libpulseaudio
+    libsecret
+    libtiff
+    libxkbcommon
+    mesa
+    openssl
+    stdenv.cc.cc
+    systemd
+    xorg.libX11
+    xorg.xcbutilwm
+    xorg.xcbutilimage
+    xorg.xcbutilkeysyms
+    xorg.xcbutilrenderutil
+  ];
+
+  libPath = lib.makeLibraryPath buildInputs;
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  unpackPhase = ''
+    dpkg-deb -x ${src} ./
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mv usr $out
+    mv opt $out
+
+    substituteInPlace $out/share/applications/alfaview.desktop \
+      --replace "/opt/alfaview" "$out/bin" \
+      --replace "/usr/share/pixmaps/alfaview_production.png" alfaview_production
+
+    makeWrapper $out/opt/alfaview/alfaview $out/bin/alfaview \
+      --prefix LD_LIBRARY_PATH : ${libPath}
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Video-conferencing application, specialized in virtual online meetings, seminars, training sessions and conferences";
+    homepage = "https://alfaview.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
@@ -3,6 +3,7 @@
 , cmake
 , cups
 , fetchurl
+, fetchpatch
 , fontconfig
 , freetype
 , harfbuzzFull
@@ -42,6 +43,19 @@ mkDerivation rec {
    sha256 = "sha256-MYMWss/Hp2GR0+DT+MImUUfa6gVwFiAo4kPCktgm+M4=";
  };

+  patches = [
+    # For harfbuzz >= 2.9.0
+    (fetchpatch {
+      url = "https://github.com/scribusproject/scribus/commit/1b546978bc4ea0b2a73fbe4d7cf947887e865162.patch";
+      sha256 = "sha256-noRCaN63ZYFfXmAluEYXdFPNOk3s5W3KBAsLU1Syxv4=";
+    })
+    # For harfbuzz >= 3.0
+    (fetchpatch {
+      url = "https://github.com/scribusproject/scribus/commit/68ec41169eaceea4a6e1d6f359762a191c7e61d5.patch";
+      sha256 = "sha256-xhp65qVvaof0md1jb3XHZw7uFX1RtNxPfUOaVnvZV1Y=";
+    })
+  ];
+
  nativeBuildInputs = [
    cmake
    pkg-config
@@ -77,10 +91,11 @@ mkDerivation rec {
    platforms = platforms.linux;
    description = "Desktop Publishing (DTP) and Layout program for Linux";
    homepage = "https://www.scribus.net";
-    # There are a lot of licenses... https://github.com/scribusproject/scribus/blob/20508d69ca4fc7030477db8dee79fd1e012b52d2/COPYING#L15-L19
+    # There are a lot of licenses...
+    # https://github.com/scribusproject/scribus/blob/20508d69ca4fc7030477db8dee79fd1e012b52d2/COPYING#L15-L19
    license = with licenses; [
      bsd3
-      gpl2
+      gpl2Plus
      mit
      publicDomain
    ];
@@ -13,10 +13,10 @@ let
 in
 stdenv.mkDerivation rec {
  inherit pname;
-  version = "10.7.0";
+  version = "10.7.1";
  src = fetchurl {
    url = "https://github.com/betaflight/${pname}/releases/download/${version}/${pname}_${version}_linux64.zip";
-    sha256 = "07r60n9422g5sm7x5b62p044cp961l51vx0s8ig2hy24s74hkam1";
+    sha256 = "sha256-mMjy7Ve7wEmPxkAmux0WahUgJ86ylnWZP4smDZeBs8Q=";
  };

  nativeBuildInputs = [ wrapGAppsHook unzip ];
@@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "got";
-  version = "0.60";
+  version = "0.64";

  src = fetchurl {
    url =
      "https://gameoftrees.org/releases/portable/got-portable-${version}.tar.gz";
-    sha256 = "sha256-tT8F3Kx7Rcjd/tWjIXXNWygYlkMddWwrttpjnYLnBdo=";
+    sha256 = "1qigv8fnmiynrx6qrg28n2981a30n56nh3xbhmlpihl7fqxmg1sq";
  };

  nativeBuildInputs = [ pkg-config ];
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {

  installCheckPhase = ''
    runHook preInstallCheck
-    test "$($out/bin/got --version)" = '${pname} "${version}"'
+    test "$($out/bin/got --version)" = '${pname} ${version}'
    runHook postInstallCheck
  '';

@@ -1,11 +1,15 @@
 { lib, stdenv, fetchurl, makeWrapper
-, coreutils, ffmpeg, gawk, gnugrep, gnused, imagemagick, mplayer, util-linux
+, coreutils, ffmpeg, gawk, gnugrep, gnused, imagemagick, mplayer
+, util-linux, getopt
 , dejavu_fonts
 }:
 with lib;
 let
  version = "1.13.4";
-  runtimeDeps = [ coreutils ffmpeg gawk gnugrep gnused imagemagick mplayer util-linux ];
+  gopt = if stdenv.isLinux then util-linux else getopt;
+  runtimeDeps = [
+    coreutils ffmpeg gawk gnugrep gnused imagemagick mplayer gopt
+  ];
 in
 stdenv.mkDerivation {
  pname = "vcs";
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, fetchpatch, python, zlib, pkg-config, glib
 , perl, pixman, vde2, alsa-lib, texinfo, flex
 , bison, lzo, snappy, libaio, libtasn1, gnutls, nettle, curl, ninja, meson, sigtool
-, makeWrapper, autoPatchelfHook
+, makeWrapper, autoPatchelfHook, runtimeShell
 , attr, libcap, libcap_ng
 , CoreServices, Cocoa, Hypervisor, rez, setfile
 , numaSupport ? stdenv.isLinux && !stdenv.isAarch32, numactl
@@ -228,10 +228,13 @@ stdenv.mkDerivation rec {

  # Add a ‘qemu-kvm’ wrapper for compatibility/convenience.
  postInstall = ''
+    cp -- $emitKvmWarningsPath $out/libexec/emit-kvm-warnings
+    chmod a+x -- $out/libexec/emit-kvm-warnings
    if [ -x $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} ]; then
      makeWrapper $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} \
                  $out/bin/qemu-kvm \
-                  --add-flags "\$([ -e /dev/kvm ] && echo -enable-kvm)"
+                  --run $out/libexec/emit-kvm-warnings \
+                  --add-flags "\$([ -r /dev/kvm -a -w /dev/kvm ] && echo -enable-kvm)"
    fi
  '';

@@ -242,6 +245,26 @@ stdenv.mkDerivation rec {
  # Builds in ~3h with 2 cores, and ~20m with a big-parallel builder.
  requiredSystemFeatures = [ "big-parallel" ];

+  emitKvmWarnings = ''
+    #!${runtimeShell}
+    WARNCOL='\033[1;35m'
+    NEUTRALCOL='\033[0m'
+    WARNING="''${WARNCOL}warning:''${NEUTRALCOL}"
+    if [ ! -e /dev/kvm ]; then
+      echo -e "''${WARNING} KVM is not available - execution will be slow" >&2
+      echo "Consider installing KVM for hardware-accelerated execution." >&2
+      echo "If KVM is already installed make sure the kernel module is loaded." >&2
+    elif [ ! -r /dev/kvm -o ! -w /dev/kvm ]; then
+      echo -e "''${WARNING} /dev/kvm is not read-/writable - execution will be slow" >&2
+      echo "/dev/kvm needs to be read-/writable by the user executing QEMU." >&2
+      echo "" >&2
+      echo "For hardware-acceleration inside the nix build sandbox /dev/kvm" >&2
+      echo "must be world-read-/writable (rw-rw-rw-)." >&2
+    fi
+  '';
+
+  passAsFile = [ "emitKvmWarnings" ];
+
  meta = with lib; {
    homepage = "http://www.qemu.org/";
    description = "A generic and open source machine emulator and virtualizer";
@@ -15,11 +15,11 @@ with lib;

 buildGoPackage rec {
  pname = "singularity";
-  version = "3.8.4";
+  version = "3.8.5";

  src = fetchurl {
    url = "https://github.com/hpcng/singularity/releases/download/v${version}/singularity-${version}.tar.gz";
-    sha256 = "sha256-y5Xm1osNIPK4fWDyOjv3B7fT6HzuDdSqQ4D49IGlfrw=";
+    sha256 = "sha256-f/94tcB7XU0IJpvSZ6xemUOQ+TMyHlTv1rfIZoMVPOQ=";
  };

  goPackagePath = "github.com/sylabs/singularity";
@@ -0,0 +1,6 @@
+(defmacro mk-subdirs-expr (path)
+  `(setq load-path
+         (delete-dups (append '(,path)
+                              ',(let ((default-directory path))
+                                  (normal-top-level-add-subdirs-to-load-path))
+                              load-path))))
@@ -165,8 +165,13 @@ runCommand
          (add-to-list 'native-comp-eln-load-path "$out/share/emacs/native-lisp/")
        ''}
        EOF
-        # Link subdirs.el from the emacs distribution
-        ln -s $emacs/share/emacs/site-lisp/subdirs.el -T $subdirs
+
+        # Generate a subdirs.el that statically adds all subdirectories to load-path.
+        $emacs/bin/emacs \
+          --batch \
+          --load ${./mk-wrapper-subdirs.el} \
+          --eval "(prin1 (macroexpand-1 '(mk-subdirs-expr \"$out/share/emacs/site-lisp\")))" \
+          > "$subdirs"

        # Byte-compiling improves start-up time only slightly, but costs nothing.
        $emacs/bin/emacs --batch -f batch-byte-compile "$siteStart" "$subdirs"
@@ -61,6 +61,6 @@ stdenv.mkDerivation {
      # rime-cantonese
      cc-by-40
    ];
-    maintainers = [ maintainers.pengmeiyu ];
+    maintainers = with maintainers; [ pmy ];
  };
 }
@@ -1,4 +1,6 @@
-{ lib, stdenv, fetchurl, xorgproto, libX11, bison, ksh, perl, gnum4
+{ lib, stdenv, fetchurl
+, fetchpatch
+, xorgproto, libX11, bison, ksh, perl, gnum4
 , libXinerama, libXt, libXext, libtirpc, motif, libXft, xbitmaps
 , libjpeg, libXmu, libXdmcp, libXScrnSaver, symlinkJoin, bdftopcf
 , ncompress, mkfontdir, tcl, libXaw, gcc, glibcLocales, gawk
@@ -27,6 +29,13 @@ in stdenv.mkDerivation rec {
  patches = [
    ./2.3.2.patch
    ./0001-all-remove-deprecated-sys_errlist-and-replace-with-A.patch
+
+    (fetchpatch {
+      name = "binutils-2.36.patch";
+      url = "https://github.com/cdesktopenv/cde/commit/0b7849e210a99a413ddeb52a0eb5aef9a08504a0.patch";
+      sha256 = "0wlhs617hws3rwln9v74y1nw27n3pp7jkpnxlala7k5y64506ipj";
+      stripLen = 1;
+    })
  ];

  buildInputs = [
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    (python3.withPackages(p: with p; [ pygobject3 magic setproctitle ]))
+    (python3.withPackages (p: with p; [ pygobject3 magic setproctitle ]))
    gsettings-desktop-schemas
    gtk3
    glib
@@ -25,7 +25,8 @@
 , networkmanager
 , pkg-config
 , polkit
-, lib, stdenv
+, lib
+, stdenv
 , wrapGAppsHook
 , libxml2
 , gtk-doc
@@ -153,7 +154,7 @@ stdenv.mkDerivation rec {
  '';

  passthru = {
-    providedSessions = ["cinnamon" "cinnamon2d"];
+    providedSessions = [ "cinnamon" "cinnamon2d" ];
  };

  meta = with lib; {
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , pkg-config
 , glib
@@ -68,8 +69,8 @@ stdenv.mkDerivation rec {
  ];

  /* ./panels/datetime/test-timezone.c:4:#define TZ_DIR "/usr/share/zoneinfo/"
-  ./panels/datetime/tz.h:32:#  define TZ_DATA_FILE "/usr/share/zoneinfo/zone.tab"
-  ./panels/datetime/tz.h:34:#  define TZ_DATA_FILE "/usr/share/lib/zoneinfo/tab/zone_sun.tab" */
+    ./panels/datetime/tz.h:32:#  define TZ_DATA_FILE "/usr/share/zoneinfo/zone.tab"
+    ./panels/datetime/tz.h:34:#  define TZ_DATA_FILE "/usr/share/lib/zoneinfo/tab/zone_sun.tab" */

  postPatch = ''
    sed 's|TZ_DIR "/usr/share/zoneinfo/"|TZ_DIR "${tzdata}/share/zoneinfo/"|g' -i ./panels/datetime/test-timezone.c
@@ -8,7 +8,8 @@
 , pkg-config
 , pulseaudio
 , python3
-, lib, stdenv
+, lib
+, stdenv
 , xkeyboard_config
 , xorg
 , wrapGAppsHook
@@ -5,7 +5,7 @@
 , gtk3
 , gsettings-desktop-schemas
 , extraGSettingsOverrides ? ""
-, extraGSettingsOverridePackages ? []
+, extraGSettingsOverridePackages ? [ ]
 , mint-artwork

 , muffin
@@ -41,19 +41,19 @@ in
 with lib;

 # TODO: Having https://github.com/NixOS/nixpkgs/issues/54150 would supersede this
-runCommand "cinnamon-gsettings-overrides" {}
+runCommand "cinnamon-gsettings-overrides" { }
  ''
-     schema_dir=$out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas
+    schema_dir=$out/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas

-     mkdir -p $schema_dir
+    mkdir -p $schema_dir

-     ${concatMapStrings (pkg: "cp -rf ${glib.getSchemaPath pkg}/*.xml ${glib.getSchemaPath pkg}/*.gschema.override $schema_dir\n") gsettingsOverridePackages}
+    ${concatMapStrings (pkg: "cp -rf ${glib.getSchemaPath pkg}/*.xml ${glib.getSchemaPath pkg}/*.gschema.override $schema_dir\n") gsettingsOverridePackages}

-     chmod -R a+w $out/share/gsettings-schemas/nixos-gsettings-overrides
+    chmod -R a+w $out/share/gsettings-schemas/nixos-gsettings-overrides

-     cat - > $schema_dir/nixos-defaults.gschema.override <<- EOF
-     ${extraGSettingsOverrides}
-     EOF
+    cat - > $schema_dir/nixos-defaults.gschema.override <<- EOF
+    ${extraGSettingsOverrides}
+    EOF

-     ${glib.dev}/bin/glib-compile-schemas $schema_dir
+    ${glib.dev}/bin/glib-compile-schemas $schema_dir
  ''
@@ -4,7 +4,8 @@
 , meson
 , ninja
 , pkg-config
-, lib, stdenv
+, lib
+, stdenv
 , wrapGAppsHook
 }:

@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , pkg-config
 , meson
@@ -15,7 +15,8 @@
 , ninja
 , pkg-config
 , python3
-, lib, stdenv
+, lib
+, stdenv
 , systemd
 , wrapGAppsHook
 , xapps
@@ -1,19 +1,19 @@
 { pkgs, lib }:

 lib.makeScope pkgs.newScope (self: with self; {
-  iso-flags-png-320x420 = pkgs.iso-flags.overrideAttrs(p: p // {
+  iso-flags-png-320x420 = pkgs.iso-flags.overrideAttrs (p: p // {
    buildPhase = "make png-country-320x240-fancy";
    # installPhase = "mkdir -p $out/share && mv build/png-country-4x2-fancy/res-320x240 $out/share/iso-flags-png-320x420";
    installPhase = "mkdir -p $out/share && mv build/png-country-4x2-fancy/res-320x240 $out/share/iso-flags-png";
  });

-  iso-flags-svg = pkgs.iso-flags.overrideAttrs(p: p // {
+  iso-flags-svg = pkgs.iso-flags.overrideAttrs (p: p // {
    buildPhase = "mkdir -p $out/share";
    installPhase = "mv svg $out/share/iso-flags-svg";
  });

  # blueberry -> pkgs/tools/bluetooth/blueberry/default.nix
-  bulky = callPackage ./bulky {};
+  bulky = callPackage ./bulky { };
  cinnamon-common = callPackage ./cinnamon-common { };
  cinnamon-control-center = callPackage ./cinnamon-control-center { };
  cinnamon-desktop = callPackage ./cinnamon-desktop { };
@@ -1,5 +1,6 @@
 { fetchFromGitHub
-, lib, stdenv
+, lib
+, stdenv
 , python3
 , sassc
 , sass
@@ -1,5 +1,6 @@
 { fetchFromGitHub
-, lib, stdenv
+, lib
+, stdenv
 , gnome
 , gnome-icon-theme
 , hicolor-icon-theme
@@ -1,5 +1,6 @@
 { fetchFromGitHub
-, lib, stdenv
+, lib
+, stdenv
 , gnome
 , gnome-icon-theme
 , hicolor-icon-theme
@@ -14,7 +14,8 @@
 , libXtst
 , libxkbcommon
 , pkg-config
-, lib, stdenv
+, lib
+, stdenv
 , udev
 , xorg
 , wrapGAppsHook
@@ -5,7 +5,8 @@
 , meson
 , ninja
 , pkg-config
-, lib, stdenv
+, lib
+, stdenv
 , wrapGAppsHook
 , libxml2
 , gtk3
@@ -10,7 +10,8 @@
 , ninja
 , pkg-config
 , python3
-, lib, stdenv
+, lib
+, stdenv
 , vala
 , wrapGAppsHook
 , inxi
@@ -48,7 +49,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    gobject-introspection
-    (python3.withPackages(ps: with ps; [
+    (python3.withPackages (ps: with ps; [
      pygobject3
      setproctitle # mate applet
    ]))
@@ -21,7 +21,8 @@
 , shared-mime-info
 , wrapGAppsHook
 , xapps
-, yelp-tools }:
+, yelp-tools
+}:

 stdenv.mkDerivation rec {
  pname = "xviewer";
@@ -32,7 +32,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-files";
-  version = "6.0.4";
+  version = "6.1.0";

  repoName = "files";

@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "sha256-FH6EYtgKADp8jjBoCwsdRdknlKS9v3iOtPiT3CyEc/8=";
+    sha256 = "sha256-aGiFEeSvDV5rPD2Ll/BuDoWclEPhR1UuoCxUSS9CGmw=";
  };

  passthru = {
@@ -67,6 +67,7 @@ stdenv.mkDerivation rec {
    bamf
    elementary-dock
    elementary-icon-theme
+    glib
    granite
    gtk3
    libcanberra
@@ -82,16 +83,9 @@ stdenv.mkDerivation rec {
    zeitgeist
  ];

-  patches = [
-    ./filechooser-portal-hardcode-gsettings-for-nixos.patch
-  ];
-
  postPatch = ''
    chmod +x meson/post_install.py
    patchShebangs meson/post_install.py
-
-    substituteInPlace filechooser-portal/LegacyFileChooserDialog.vala \
-      --subst-var-by ELEMENTARY_FILES_GSETTINGS_PATH ${glib.makeSchemaPath "$out" "${pname}-${version}"}
  '';

  meta = with lib; {
@@ -1,24 +0,0 @@
-From 726ab4c0ab01273cb2197e4c151a5b69ff0954b6 Mon Sep 17 00:00:00 2001
-From: Bobby Rong <rjl931189261@126.com>
-Date: Fri, 16 Jul 2021 18:24:58 +0800
-Subject: [PATCH] filechooser-portal: hardcode gsettings for nixos
-
---
- filechooser-portal/LegacyFileChooserDialog.vala | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/filechooser-portal/LegacyFileChooserDialog.vala b/filechooser-portal/LegacyFileChooserDialog.vala
-index 330718f..f383bb1 100644
--- a/filechooser-portal/LegacyFileChooserDialog.vala
-+++ b/filechooser-portal/LegacyFileChooserDialog.vala
-@@ -60,7 +60,9 @@ public class Files.LegacyFileChooserDialog : Object {
-         /* If not local only during creation, strange bug occurs on fresh installs */
-         chooser_dialog.local_only = true;
- 
-        var chooser_settings = new Settings ("io.elementary.files.file-chooser");
-+        SettingsSchemaSource sss = new SettingsSchemaSource.from_directory ("@ELEMENTARY_FILES_GSETTINGS_PATH@", SettingsSchemaSource.get_default (), true);
-+        SettingsSchema chooser_schema = sss.lookup ("io.elementary.files.file-chooser", false);
-+        var chooser_settings = new Settings.full (chooser_schema, null, null);
- 
-         action_area = (Gtk.ButtonBox) chooser_dialog.get_action_area ();
- 
@@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "babashka";
-  version = "0.6.5";
+  version = "0.6.7";

  src = fetchurl {
    url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-72D/HzDIxkGD4zTPE9gHf/uFtboLbNnT7CTslSlAqjc=";
+    sha256 = "sha256-e5Mq2fPYqsPEENVGO+gBz9K79KcKOykdDtItjcXU/DI=";
  };

  executable = "bb";
@@ -238,4 +238,7 @@ stdenv.mkDerivation rec {
    platforms = platforms.unix;
    maintainers = with maintainers; [ tobim veprbl cpcloud ];
  };
+  passthru = {
+    inherit enableFlight enableJemalloc enableS3 enableGcs;
+  };
 }
@@ -105,7 +105,6 @@ stdenv.mkDerivation rec {
  patches = [
    # Use pkgconfig to inject the includedirs
    ./fix_pkgconfig_includedir.patch
-  ] ++ lib.optionals stdenv.isDarwin [
    # Fix “error: cannot initialize a parameter of type 'unsigned long *' with an rvalue of type 'typename std::remove_reference<decltype(*(&opencv_dilate_erode_type))>::type *' (aka 'volatile unsigned long *')” on Darwin.
    (fetchpatch {
      url = "https://gitlab.freedesktop.org/gstreamer/gst-plugins-bad/commit/640a65bf966df065d41a511e2d76d1f26a2e770c.patch";
@@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ldns";
-  version = "1.7.1";
+  version = "1.8.0";

  src = fetchurl {
    url = "https://www.nlnetlabs.nl/downloads/ldns/${pname}-${version}.tar.gz";
-    sha256 = "0ac242n7996fswq1a3nlh1bbbhrsdwsq4mx7xq8ffq6aplb4rj4a";
+    sha256 = "sha256-glElB2mAMcN5AulByE3so+2tjPeR58MnWi2Z1OU/jPw=";
  };

  postPatch = ''
@@ -1,10 +1,18 @@
-{ lib, stdenv, fetchFromGitHub, buildPackages
-, autoreconfHook, pkg-config, gettext
+{ lib
+, stdenv
+, fetchFromGitHub
+, buildPackages
+, autoreconfHook
+, pkg-config
+, gettext
 , libusb1
 , libtool
 , libexif
 , libgphoto2
 , libjpeg
+, curl
+, libxml2
+, gd
 }:

 stdenv.mkDerivation rec {
@@ -24,12 +32,16 @@ stdenv.mkDerivation rec {
    autoreconfHook
    gettext
    libtool
+    pkg-config
  ];

  buildInputs = [
    libjpeg
    libtool # for libltdl
    libusb1
+    curl
+    libxml2
+    gd
  ];

  # These are mentioned in the Requires line of libgphoto's pkg-config file.
@@ -37,17 +49,20 @@ stdenv.mkDerivation rec {

  hardeningDisable = [ "format" ];

-  postInstall = let
-    executablePrefix = if stdenv.buildPlatform == stdenv.hostPlatform then
-      "$out"
-    else
-      buildPackages.libgphoto2;
-  in ''
-    mkdir -p $out/lib/udev/rules.d
-    ${executablePrefix}/lib/libgphoto2/print-camera-list \
-        udev-rules version 175 group camera \
-        >$out/lib/udev/rules.d/40-gphoto2.rules
-  '';
+  postInstall =
+    let
+      executablePrefix =
+        if stdenv.buildPlatform == stdenv.hostPlatform then
+          "$out"
+        else
+          buildPackages.libgphoto2;
+    in
+    ''
+      mkdir -p $out/lib/udev/rules.d
+      ${executablePrefix}/lib/libgphoto2/print-camera-list \
+          udev-rules version 175 group camera \
+          >$out/lib/udev/rules.d/40-gphoto2.rules
+    '';

  meta = {
    homepage = "http://www.gphoto.org/proj/libgphoto2/";
@@ -0,0 +1,34 @@
+{ lib, stdenv, fetchFromGitHub
+, autoreconfHook, pkg-config
+, cunit, file
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nghttp3";
+  version = "unstable-2021-11-10";
+
+  src = fetchFromGitHub {
+    owner = "ngtcp2";
+    repo = pname;
+    rev = "270e75447ed9e2a05b78ba89d0699d076230ea60";
+    sha256 = "01cla03cv8nd2rf5p77h0xzvn9f8sfwn8pp3r2jshvqp9ipa8065";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config cunit file ];
+
+  preConfigure = ''
+    substituteInPlace ./configure --replace /usr/bin/file ${file}/bin/file
+  '';
+
+  outputs = [ "out" "dev" ];
+
+  doCheck = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/ngtcp2/nghttp3";
+    description = "nghttp3 is an implementation of HTTP/3 mapping over QUIC and QPACK in C.";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ izorkin ];
+  };
+}
@@ -0,0 +1,36 @@
+{ lib, stdenv, fetchFromGitHub
+, autoreconfHook, pkg-config
+, cunit, file
+, jemalloc, libev, nghttp3, quictls
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ngtcp2";
+  version = "unstable-2021-11-10";
+
+  src = fetchFromGitHub {
+    owner = "ngtcp2";
+    repo = pname;
+    rev = "7039808c044152c14b44046468bd16249b4d7048";
+    sha256 = "1cjsky24f6fazw9b1r6w9cgp09vi8wp99sv76gg2b1r8ic3hgq23";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config cunit file ];
+  buildInputs = [ jemalloc libev nghttp3 quictls ];
+
+  preConfigure = ''
+    substituteInPlace ./configure --replace /usr/bin/file ${file}/bin/file
+  '';
+
+  outputs = [ "out" "dev" ];
+
+  doCheck = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/ngtcp2/ngtcp2";
+    description = "ngtcp2 project is an effort to implement QUIC protocol which is now being discussed in IETF QUICWG for its standardization.";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ izorkin ];
+  };
+}
@@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "opencl-clhpp";
-  version = "2.0.12";
+  version = "2.0.15";

  src = fetchFromGitHub {
    owner = "KhronosGroup";
    repo = "OpenCL-CLHPP";
    rev = "v${version}";
-    sha256 = "04g3mg2cpbi048fxxkghra81bpxzqr4r3gspx5mvqipx1lzypsci";
+    sha256 = "sha256-A12GdevbMaO2QkGAk3VsXzwcDkF+6dEapse2xfdqzPM=";
  };

  nativeBuildInputs = [ cmake python3 ];
@@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-wThREJq+/EYjNwmJ+uOnRb9rGss8KhOolYU5gj6XTks=";
  };

+  patches = [
+    # Pull upstream fix for gcc-11
+    (fetchurl {
+      url = "https://github.com/KDE/qca/commit/32275f1a74c161d2fed8c056b2dd9555687a22f2.patch";
+      sha256 = "sha256-SUH2eyzP2vH/ZjYcX8ybwiqhoTm/QjuEpTKjb2iH1No=";
+    })
+  ];
+
  buildInputs = [ openssl qtbase ];
  nativeBuildInputs = [ cmake pkg-config ];

@@ -0,0 +1,170 @@
+{ lib, stdenv, fetchurl, buildPackages, perl, coreutils, fetchFromGitHub
+, withCryptodev ? false, cryptodev
+, enableSSL2 ? false
+, enableSSL3 ? false
+, static ? stdenv.hostPlatform.isStatic
+# Used to avoid cross compiling perl, for example, in darwin bootstrap tools.
+# This will cause c_rehash to refer to perl via the environment, but otherwise
+# will produce a perfectly functional openssl binary and library.
+, withPerl ? stdenv.hostPlatform == stdenv.buildPlatform
+}:
+
+assert (
+  lib.assertMsg (!withPerl -> stdenv.hostPlatform != stdenv.buildPlatform)
+  "withPerl should not be disabled unless cross compiling"
+);
+
+stdenv.mkDerivation rec {
+  pname = "quictls";
+  version = "3.0.0+quick_unstable-2021-11.02";
+
+  src = fetchFromGitHub {
+    owner = "quictls";
+    repo = "openssl";
+    rev = "62d4de00abfa82fc01efa2eba1982a86c4864f39";
+    sha256 = "11mi4bkkyy4qd2wml6p7xcsbps0mabk3bp537rp7n43qnhwyg1g3";
+  };
+
+  patches = [
+    ../openssl/3.0/nix-ssl-cert-file.patch
+
+    # openssl will only compile in KTLS if the current kernel supports it.
+    # This patch disables build-time detection.
+    ../openssl/3.0/openssl-disable-kernel-detection.patch
+
+    (if stdenv.hostPlatform.isDarwin
+      then ../openssl/use-etc-ssl-certs-darwin.patch
+      else ../openssl/use-etc-ssl-certs.patch)
+  ];
+
+  postPatch = ''
+    patchShebangs Configure
+  ''
+  # config is a configure script which is not installed.
+  + ''
+    substituteInPlace config --replace '/usr/bin/env' '${buildPackages.coreutils}/bin/env'
+  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
+    substituteInPlace crypto/async/arch/async_posix.h \
+      --replace '!defined(__ANDROID__) && !defined(__OpenBSD__)' \
+                '!defined(__ANDROID__) && !defined(__OpenBSD__) && 0'
+  '';
+
+  outputs = [ "bin" "dev" "out" "man" "doc" ];
+  setOutputFlags = false;
+  separateDebugInfo =
+    !stdenv.hostPlatform.isDarwin &&
+    !(stdenv.hostPlatform.useLLVM or false) &&
+    stdenv.cc.isGNU;
+
+  nativeBuildInputs = [ perl ];
+  buildInputs = lib.optional withCryptodev cryptodev
+    # perl is included to allow the interpreter path fixup hook to set the
+    # correct interpreter in c_rehash.
+    ++ lib.optional withPerl perl;
+
+  # TODO(@Ericson2314): Improve with mass rebuild
+  configurePlatforms = [];
+  configureScript = {
+      armv5tel-linux = "./Configure linux-armv4 -march=armv5te";
+      armv6l-linux = "./Configure linux-armv4 -march=armv6";
+      armv7l-linux = "./Configure linux-armv4 -march=armv7-a";
+      x86_64-darwin  = "./Configure darwin64-x86_64-cc";
+      aarch64-darwin = "./Configure darwin64-arm64-cc";
+      x86_64-linux = "./Configure linux-x86_64";
+      x86_64-solaris = "./Configure solaris64-x86_64-gcc";
+      riscv64-linux = "./Configure linux64-riscv64";
+    }.${stdenv.hostPlatform.system} or (
+      if stdenv.hostPlatform == stdenv.buildPlatform
+        then "./config"
+      else if stdenv.hostPlatform.isBSD && stdenv.hostPlatform.isx86_64
+        then "./Configure BSD-x86_64"
+      else if stdenv.hostPlatform.isBSD && stdenv.hostPlatform.isx86_32
+        then "./Configure BSD-x86" + lib.optionalString (stdenv.hostPlatform.parsed.kernel.execFormat.name == "elf") "-elf"
+      else if stdenv.hostPlatform.isBSD
+        then "./Configure BSD-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
+      else if stdenv.hostPlatform.isMinGW
+        then "./Configure mingw${lib.optionalString
+                                   (stdenv.hostPlatform.parsed.cpu.bits != 32)
+                                   (toString stdenv.hostPlatform.parsed.cpu.bits)}"
+      else if stdenv.hostPlatform.isLinux
+        then "./Configure linux-generic${toString stdenv.hostPlatform.parsed.cpu.bits}"
+      else if stdenv.hostPlatform.isiOS
+        then "./Configure ios${toString stdenv.hostPlatform.parsed.cpu.bits}-cross"
+      else
+        throw "Not sure what configuration to use for ${stdenv.hostPlatform.config}"
+    );
+
+  # OpenSSL doesn't like the `--enable-static` / `--disable-shared` flags.
+  dontAddStaticConfigureFlags = true;
+  configureFlags = [
+    "shared" # "shared" builds both shared and static libraries
+    "--libdir=lib"
+    "--openssldir=etc/ssl"
+    "enable-ktls"
+  ] ++ lib.optionals withCryptodev [
+    "-DHAVE_CRYPTODEV"
+    "-DUSE_CRYPTODEV_DIGESTS"
+  ] ++ lib.optional enableSSL2 "enable-ssl2"
+    ++ lib.optional enableSSL3 "enable-ssl3"
+    ++ lib.optional stdenv.hostPlatform.isAarch64 "no-afalgeng"
+    # OpenSSL needs a specific `no-shared` configure flag.
+    # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options
+    # for a comprehensive list of configuration options.
+    ++ lib.optional static "no-shared";
+
+  makeFlags = [
+    "MANDIR=$(man)/share/man"
+    # This avoids conflicts between man pages of openssl subcommands (for
+    # example 'ts' and 'err') man pages and their equivalent top-level
+    # command in other packages (respectively man-pages and moreutils).
+    # This is done in ubuntu and archlinux, and possiibly many other distros.
+    "MANSUFFIX=ssl"
+  ];
+
+  enableParallelBuilding = true;
+
+  postInstall = lib.optionalString (!static) ''
+    # If we're building dynamic libraries, then don't install static
+    # libraries.
+    if [ -n "$(echo $out/lib/*.so $out/lib/*.dylib $out/lib/*.dll)" ]; then
+        rm "$out/lib/"*.a
+    fi
+  '' + lib.optionalString (!stdenv.hostPlatform.isWindows)
+    # Fix bin/c_rehash's perl interpreter line
+    #
+    # - openssl 1_0_2: embeds a reference to buildPackages.perl
+    # - openssl 1_1:   emits "#!/usr/bin/env perl"
+    #
+    # In the case of openssl_1_0_2, reset the invalid reference and let the
+    # interpreter hook take care of it.
+    #
+    # In both cases, if withPerl = false, the intepreter line is expected be
+    # "#!/usr/bin/env perl"
+  ''
+    substituteInPlace $out/bin/c_rehash --replace ${buildPackages.perl}/bin/perl "/usr/bin/env perl"
+  '' + ''
+    mkdir -p $bin
+    mv $out/bin $bin/bin
+    mkdir $dev
+    mv $out/include $dev/
+    # remove dependency on Perl at runtime
+    rm -r $out/etc/ssl/misc
+    rmdir $out/etc/ssl/{certs,private}
+  '';
+
+  postFixup = lib.optionalString (!stdenv.hostPlatform.isWindows) ''
+    # Check to make sure the main output doesn't depend on perl
+    if grep -r '${buildPackages.perl}' $out; then
+      echo "Found an erroneous dependency on perl ^^^" >&2
+      exit 1
+    fi
+  '';
+
+  meta = with lib; {
+    homepage = "https://quictls.github.io/openssl/";
+    description = "TLS/SSL and crypto library with QUIC APIs";
+    license = licenses.openssl;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ izorkin ];
+  };
+}
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch }:

 stdenv.mkDerivation rec {
  pname = "re2";
@@ -11,6 +11,15 @@ stdenv.mkDerivation rec {
    sha256 = "1fyhypw345xz8zdh53gz6j1fwgrx0gszk1d349ja37dpxh4jp2jh";
  };

+  patches = [
+    # Pull upstreal fix for parallel testing.
+    (fetchpatch {
+      name = "parallel-tests.patch";
+      url = "https://github.com/google/re2/commit/9262284a7edc1b83e7172f4ec2d7967d695e7420.patch";
+      sha256 = "1knhfx9cs4841r09jw4ha6mdx9qwpvlcxvd04i8vr84kd0lilqms";
+    })
+  ];
+
  preConfigure = ''
    substituteInPlace Makefile --replace "/usr/local" "$out"
    # we're using gnu sed, even on darwin
@@ -19,6 +28,8 @@ stdenv.mkDerivation rec {

  buildFlags = lib.optionals stdenv.hostPlatform.isStatic [ "static" ];

+  enableParallelBuilding = true;
+
  preCheck = "patchShebangs runtests";
  doCheck = true;
  checkTarget = "test";
@@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "indilib";
-  version = "1.9.2";
+  version = "1.9.3";

  src = fetchFromGitHub {
    owner = "indilib";
    repo = "indi";
    rev = "v${version}";
-    sha256 = "sha256-5MaN1aNyHpZzKwQPUpp9NYRh7i+lx1N70+J1gczdtAE=";
+    sha256 = "sha256-Ik62kbOetA2vSMpnwrSiNRNJqOgmqlCB2+KNhpBo9TA=";
  };

  nativeBuildInputs = [
@@ -1,12 +1,12 @@
 { stdenv, lib, callPackage, fetchFromGitHub, indilib }:

 let
-  indi-version = "1.9.2";
+  indi-version = "1.9.3";
  indi-3rdparty-src = fetchFromGitHub {
    owner = "indilib";
    repo = "indi-3rdparty";
    rev = "v${indi-version}";
-    sha256 = "sha256-dpuJ/J5gc+kAklbvMjsWic9jusXWB4gUcT8E/1eSLXQ=";
+    sha256 = "sha256-TBccdheBEO48uIXd6tya6dytkzxaHg2+YancBkcL3bw=";
  };
  indi-firmware = callPackage ./indi-firmware.nix {
    version = indi-version;
@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, cmake }:
+{ stdenv, lib, fetchFromGitHub, cmake, llvmPackages }:

 stdenv.mkDerivation rec {
  pname = "cppe";
@@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-guM7+ZWDJLcAUJtPkKLvC4LYSA2eBvER7cgwPZ7FxHw=";
  };

-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ]
+    ++ lib.optionals stdenv.cc.isClang [ llvmPackages.openmp ];

  cmakeFlags = [ "-DCMAKE_INSTALL_LIBDIR=lib" ];

@@ -4,13 +4,15 @@
 , fetchFromGitHub
 , pbr
 , requests
+, pycryptodome
+, pyjwt
 , pytestCheckHook
 , requests-mock
 }:

 buildPythonPackage rec {
  pname = "bimmer-connected";
-  version = "0.8.0";
+  version = "0.8.2";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@@ -19,7 +21,7 @@ buildPythonPackage rec {
    owner = "bimmerconnected";
    repo = "bimmer_connected";
    rev = version;
-    sha256 = "sha256-sox24UpuIK5SP0IWVxa/NiyR5IrTzXe0SVTCd4FB6mo=";
+    hash = "sha256-/AkQ7hEjzgL4/ruXqTdchh+N8PY5q3ILNKKo43EOGg4=";
  };

  nativeBuildInputs = [
@@ -30,6 +32,8 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    requests
+    pycryptodome
+    pyjwt
  ];

  checkInputs = [
@@ -1,5 +1,6 @@
 { buildPythonPackage
 , lib
+, stdenv
 , cmake
 , cppe
 , eigen
@@ -12,6 +13,7 @@
 , pandas
 , polarizationsolver
 , pytest
+, llvmPackages
 }:

 buildPythonPackage rec {
@@ -31,7 +33,12 @@ buildPythonPackage rec {

  dontUseCmakeConfigure = true;

-  buildInputs = [ pybind11 ];
+  buildInputs = [ pybind11 ]
+    ++ lib.optional stdenv.cc.isClang llvmPackages.openmp;
+
+  NIX_CFLAGS_LINK = lib.optional stdenv.cc.isClang "-lomp";
+
+  hardeningDisable = lib.optional stdenv.cc.isClang "strictoverflow";

  checkInputs = [
    pytest
@@ -59,6 +59,7 @@ buildPythonPackage rec {
    ${stdenv.cc}/bin/c++ linux_and_mac/attach.cpp -Ilinux_and_mac -fPIC -nostartfiles ${{
      "x86_64-linux"   = "-shared -m64 -o attach_linux_amd64.so";
      "i686-linux"     = "-shared -m32 -o attach_linux_x86.so";
+      "aarch64-linux"  = "-shared -o attach_linux_arm64.so";
      "x86_64-darwin"  = "-std=c++11 -lc -D_REENTRANT -dynamiclib -arch x86_64 -o attach_x86_64.dylib";
      "i686-darwin"    = "-std=c++11 -lc -D_REENTRANT -dynamiclib -arch i386 -o attach_x86.dylib";
      "aarch64-darwin" = "-std=c++11 -lc -D_REENTRANT -dynamiclib -arch arm64 -o attach_arm64.dylib";
@@ -87,6 +88,6 @@ buildPythonPackage rec {
    homepage = "https://github.com/microsoft/debugpy";
    license = licenses.mit;
    maintainers = with maintainers; [ kira-bruneau ];
-    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "i686-darwin" "aarch64-darwin" ];
+    platforms = [ "x86_64-linux" "i686-linux" "aarch64-linux" "x86_64-darwin" "i686-darwin" "aarch64-darwin" ];
  };
 }
@@ -8,7 +8,6 @@
 , matplotlib
 , mock
 , pytorch
-, pynvml
 , scikit-learn
 , tqdm
 }:
@@ -25,7 +24,7 @@ buildPythonPackage rec {
  };

  checkInputs = [ pytestCheckHook matplotlib mock pytest-xdist torchvision ];
-  propagatedBuildInputs = [ pytorch scikit-learn tqdm pynvml ];
+  propagatedBuildInputs = [ pytorch scikit-learn tqdm ];

  # runs succesfully in 3.9, however, async isn't correctly closed so it will fail after test suite.
  doCheck = pythonOlder "3.9";
@@ -51,6 +50,7 @@ buildPythonPackage rec {
    "idist"
    "mlflow"
    "tensorboard"
+    "test_gpu_info" # needs pynvml
    "test_integration"
    "test_output_handler" # needs mlflow
    "test_pbar" # slight output differences
@@ -1,21 +1,22 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, ipykernel
 , ipywidgets
-, matplotlib
-, jupyter-packaging
 }:

 buildPythonPackage rec {
  pname = "ipympl";
-  version = "0.8.0";
+  version = "0.8.2";
+  format = "wheel";

  src = fetchPypi {
-    inherit pname version;
-    sha256 = "ef5d21820ed88a8bd6efddb884c333d0eaea7f2f7d4b3054e6d386b07a36dd9d";
+    inherit pname version format;
+    sha256 = "0509gzm5557lyxx8k3qqgp14ifnmfx796cfc8f592mv97pxkyibl";
  };

-  propagatedBuildInputs = [ ipywidgets matplotlib jupyter-packaging ];
+
+  propagatedBuildInputs = [ ipykernel ipywidgets ];

  # There are no unit tests in repository
  doCheck = false;
@@ -24,7 +25,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Matplotlib Jupyter Extension";
    homepage = "https://github.com/matplotlib/jupyter-matplotlib";
-    maintainers = with maintainers; [ jluttine ];
+    maintainers = with maintainers; [ jluttine fabiangd ];
    license = licenses.bsd3;
  };
 }
@@ -1,5 +1,6 @@
 { lib, stdenv
 , fetchFromGitHub
+, fetchpatch
 , buildPythonPackage
 , cryptography
 , click
@@ -26,10 +27,12 @@ buildPythonPackage rec {
  };

  patches = [
-    # Fix removed function in construct library
-    # https://github.com/LedgerHQ/ledgerctl/issues/17
-    # https://github.com/construct/construct/commit/8915512f53552b1493afdbce5bbf8bb6f2aa4411
-    ./remove-iterateints.patch
+    (fetchpatch {
+      # Fix removed function in construct library
+      url = "https://github.com/LedgerHQ/ledgerctl/commit/fd23d0e14721b93789071e80632e6bd9e47c1256.patch";
+      sha256 = "sha256-YNlENguPQW5FNFT7mqED+ghF3TJiKao4H+56Eu+j+Eo=";
+      excludes = [ "setup.py" ];
+    })
  ];

  buildInputs = lib.optionals stdenv.isDarwin [ AppKit ];
@@ -1,19 +0,0 @@
--- a/ledgerwallet/params.py	2021-11-17 20:31:10.488954050 -0300
-+++ b/ledgerwallet/params.py	2021-11-17 20:31:30.619477930 -0300
-@@ -19,7 +19,6 @@
- )
- from construct.core import (
-     byte2int,
-    iterateints,
-     singleton,
-     stream_read,
-     stream_write,
-@@ -40,7 +39,7 @@
-         num_bytes = byte & 0x80
-         encoded_len = stream_read(stream, num_bytes)
-         num = 0
-        for len_byte in iterateints(encoded_len):
-+        for len_byte in encoded_len:
-             num = num << 8 + len_byte
-         return num
- 
@@ -68,7 +68,7 @@ buildPythonPackage rec {
                "['pandas/src/klib', 'pandas/src', '$cpp_sdk']"
  '';

-  doCheck = !stdenv.isAarch64; # upstream doesn't test this architecture
+  doCheck = !stdenv.isAarch32 && !stdenv.isAarch64; # upstream doesn't test this architecture

  pytestFlagsArray = [
    "--skip-slow"
@@ -24,7 +24,7 @@

 buildPythonPackage rec {
  pname = "pikepdf";
-  version = "4.0.1.post1";
+  version = "4.0.2";
  disabled = ! isPy3k;

  src = fetchFromGitHub {
@@ -37,7 +37,7 @@ buildPythonPackage rec {
    extraPostFetch = ''
      rm "$out/.git_archival.txt"
    '';
-    sha256 = "sha256-s7eS7jYGohYt75/r++4v9K6BRfiQ3drdG5wbIL3WoiU=";
+    sha256 = "sha256-bUf9fef/YQsSj78kwoKl5a3zOjpeKWla9YY0azk0lIQ=";
  };

  patches = [
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pytestCheckHook
 }:

@@ -15,10 +16,13 @@ buildPythonPackage rec {
    sha256 = "13x3718if28l50474xrz1b9709kvnvdg3nzm6y8bh7mc9a4zyss5";
  };

-  postPatch = ''
-    substituteInPlace unittests.py \
-        --replace '(tmp, "test.dat")' "(\"$TMPDIR\", \"test.dat\")"
-  '';
+  patches = [
+    # Use proper temporary directory on Hydra
+    (fetchpatch {
+      url = "https://github.com/WojciechMula/pyahocorasick/commit/b6549e06f3cced7ffdf4d1b587cd7de12041f495.patch";
+      sha256 = "sha256-v3J/0aIPOnBhLlJ18r/l7O0MckqLOCtcmqIS9ZegaSI=";
+    })
+  ];

  checkInputs = [ pytestCheckHook ];

@@ -17,7 +17,11 @@ buildPythonPackage rec {
  checkInputs = [ hypothesis pandas pytestCheckHook pytest-lazy-fixture ];

  PYARROW_BUILD_TYPE = "release";
+
+  PYARROW_WITH_DATASET = true;
+  PYARROW_WITH_FLIGHT = _arrow-cpp.enableFlight;
  PYARROW_WITH_PARQUET = true;
+
  PYARROW_CMAKE_OPTIONS = [
    "-DCMAKE_INSTALL_RPATH=${ARROW_HOME}/lib"

@@ -25,9 +29,13 @@ buildPythonPackage rec {
    # ourselves
    "-DCMAKE_POLICY_DEFAULT_CMP0025=NEW"
  ];
+
  ARROW_HOME = _arrow-cpp;
  PARQUET_HOME = _arrow-cpp;

+  ARROW_TEST_DATA = lib.optionalString doCheck _arrow-cpp.ARROW_TEST_DATA;
+
+  doCheck = true;
  dontUseCmakeConfigure = true;

  preBuild = ''
@@ -62,6 +70,6 @@ buildPythonPackage rec {
    homepage = "https://arrow.apache.org/";
    license = licenses.asl20;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ veprbl ];
+    maintainers = with maintainers; [ veprbl cpcloud ];
  };
 }
@@ -22,6 +22,8 @@ buildPythonPackage rec {
    substituteInPlace vex/Makefile-gcc --replace '/usr/bin/ar' 'ar'
  '';

+  setupPyBuildFlags = lib.optionals stdenv.isLinux [ "--plat-name" "linux" ];
+
  propagatedBuildInputs = [
    archinfo
    bitstring
@@ -45,7 +47,5 @@ buildPythonPackage rec {
    homepage = "https://github.com/angr/pyvex";
    license = with licenses; [ bsd2 gpl3Plus lgpl3Plus ];
    maintainers = with maintainers; [ fab ];
-    # ERROR: pyvex-X-py3-none-manylinux1_aarch64.whl is not a supported wheel on this platform.
-    broken = stdenv.isAarch64;
  };
 }
@@ -24,7 +24,9 @@ buildPythonPackage rec {
    # disabled tests access the network
    py.test tests -k "not test_no_content_length_header \
                  and not test_read_file \
-                  and not test_reads_file_from_url_wrapper"
+                  and not test_reads_file_from_url_wrapper \
+                  and not test_x509_der \
+                  and not test_x509_pem"
  '';

  meta = {
@@ -0,0 +1,43 @@
+{ lib
+, beautifulsoup4
+, buildPythonPackage
+, fetchFromGitHub
+, python-dateutil
+, pythonOlder
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "socid-extractor";
+  version = "0.0.22";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "soxoj";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "kHF9CBlUKrD/DRVwJveenpFMr7pIrxEBNkFHHLa46KQ=";
+  };
+
+  propagatedBuildInputs = [
+    beautifulsoup4
+    python-dateutil
+    requests
+  ];
+
+  # Test require network access
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "socid_extractor"
+  ];
+
+  meta = with lib; {
+    description = "Python module to extract details from personal pages";
+    homepage = "https://github.com/soxoj/socid-extractor";
+    license = with licenses; [ gpl3Only ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
@@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "total-connect-client";
-  version = "2021.11.4";
+  version = "2021.11.5";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "craigjmidwinter";
    repo = "total-connect-client";
    rev = version;
-    sha256 = "sha256-iggxKefrVZP4ljf8jGRrCAq0/xQLsr54L42KkdjBqgI=";
+    sha256 = "sha256-6hyeU0jigQZsZtdb4E8/iD8YfQeNOKm6IK1CHBizZQs=";
  };

  propagatedBuildInputs = [
@@ -28,15 +28,6 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  preCheck = ''
-    export PYTHONPATH="total_connect_client:$PYTHONPATH"
-  '';
-
-  disabledTests = [
-    # Tests require network access
-    "tests_request"
-  ];
-
  pythonImportsCheck = [
    "total_connect_client"
  ];
@@ -10,7 +10,11 @@
 , pygments
 , numpy
 , scipy
-, scikit-learn }:
+, scikit-learn
+, spdlog
+, fmt
+, rapidjson
+}:

 buildPythonPackage rec {
  pname = "vowpalwabbit";
@@ -31,8 +35,15 @@ buildPythonPackage rec {
    pygments
    python.pkgs.boost
    zlib.dev
+    spdlog
+    fmt
+    rapidjson
  ];

+  # As we disable configure via cmake, pass explicit global options to enable
+  # spdlog and fmt packages
+  setupPyGlobalFlags = [ "--cmake-options=\"-DSPDLOG_SYS_DEP=ON;-DFMT_SYS_DEP=ON\"" ];
+
  propagatedBuildInputs = [
    numpy
    scikit-learn
@@ -0,0 +1,34 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "xmind";
+  version = "1.2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "zhuifengshen";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "xC1WpHz2eHb5+xShM/QUQAIYnJNyK1EKWbTXJKhDwbQ=";
+  };
+
+  # Projec thas no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "xmind"
+  ];
+
+  meta = with lib; {
+    description = "Python module to create mindmaps";
+    homepage = "https://github.com/zhuifengshen/xmind";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
@@ -2,17 +2,22 @@

 rustPlatform.buildRustPackage rec {
  pname = "gir";
-  version = "unstable-2021-05-05";
+  version = "unstable-2021-11-21";

  src = fetchFromGitHub {
    owner = "gtk-rs";
    repo = "gir";
-    rev = "c148542ce89b0bf7cbb9f5ef4179c96a45d022df";
-    sha256 = "0vy366ipwnn0cpp14l1v5g3dpnsr3hd8mjp3333lp0946igfqsy5";
-    leaveDotGit = true; # required for build.rs
+    rev = "a69abbe5ee1a745e554cac9433c65d2ac26a7688";
+    sha256 = "16ygy1bcbcj69x6ss72g9n62qlsd1bacr5hz91f8whw6qm9am46m";
  };

-  cargoSha256 = "11as1v88zf0f7l2ngllg5zqycvd05nb4vrsyl1dlarjvbq7fhvv8";
+  cargoSha256 = "14srs2369yryqpkklmfp64fyqxrhf91b2bjy0068nx2myr25m624";
+
+  postPatch = ''
+    rm build.rs
+    sed -i '/build = "build\.rs"/d' Cargo.toml
+    echo "pub const VERSION: &str = \"$version\";" > src/gir_version.rs
+  '';

  meta = with lib; {
    description = "Tool to generate rust bindings and user API for glib-based libraries";
@@ -0,0 +1,32 @@
+{ lib, stdenv, fetchurl, unzip, openjdk11, gradle }:
+
+stdenv.mkDerivation rec {
+  pname = "kotlin-language-server";
+  version = "1.1.2";
+  src = fetchurl {
+    url = "https://github.com/fwcd/kotlin-language-server/releases/download/${version}/server.zip";
+    sha256 = "d8850ee2be8c49e5e642c4a41f52304098ae0bcce009e4d91531a9aeecd64916";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/lib
+    mkdir -p $out/bin
+    cp -r lib/* $out/lib
+    cp -r bin/* $out/bin
+  '';
+
+  nativeBuildInputs = [ unzip gradle ];
+  buildInputs = [ openjdk11 gradle ];
+
+  meta = {
+    description = "kotlin language server";
+    longDescription = ''
+      About Kotlin code completion, linting and more for any editor/IDE
+      using the Language Server Protocol Topics'';
+    homepage = "https://github.com/fwcd/kotlin-language-server";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+  };
+}
@@ -1,17 +1,17 @@
 { lib, buildPythonApplication, fetchFromGitHub, bash, cmake, flex
 , libclang, llvm, unifdef
-, pebble, psutil, pytestCheckHook, pytest-flake8
+, chardet, pebble, psutil, pytestCheckHook, pytest-flake8
 }:

 buildPythonApplication rec {
  pname = "cvise";
-  version = "2.3.0";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "marxin";
    repo = "cvise";
    rev = "v${version}";
-    sha256 = "1x2i8nv0nncgvr07znhh2slngbrg8qcsz2zqx76bcyq9hssn6yal";
+    sha256 = "0cfzikkhp91hjgxjk3izzczb8d9p8v9zsfyk6iklk92n5qf1aakq";
  };

  patches = [
@@ -21,7 +21,7 @@ buildPythonApplication rec {

  nativeBuildInputs = [ cmake flex llvm.dev ];
  buildInputs = [ bash libclang llvm llvm.dev unifdef ];
-  propagatedBuildInputs = [ pebble psutil ];
+  propagatedBuildInputs = [ chardet pebble psutil ];
  checkInputs = [ pytestCheckHook pytest-flake8 unifdef ];

  # 'cvise --command=...' generates a script with hardcoded shebang.
@@ -2,13 +2,13 @@

 buildGoPackage rec {
  pname = "protoc-gen-twirp";
-  version = "8.1.0";
+  version = "8.1.1";

  src = fetchFromGitHub {
    owner = "twitchtv";
    repo = "twirp";
    rev = "v${version}";
-    sha256 = "sha256-ezSNrDfOE1nj4FlX7E7Z7/eGfQw1B7NP34aj8ml5pDk=";
+    sha256 = "sha256-PnL7jgxAx/Xk/wajtQ+Q1G9KLes2NVANF2YmBcGFqe0=";
  };

  goPackagePath = "github.com/twitchtv/twirp";
@@ -1,4 +1,4 @@
-{ fetchFromGitHub, ncurses, lib, stdenv,
+{ fetchFromGitHub, fetchpatch, ncurses, lib, stdenv,
  updateAutotoolsGnuConfigScriptsHook }:

 stdenv.mkDerivation rec {
@@ -12,6 +12,25 @@ stdenv.mkDerivation rec {
    sha256 = "0grkwmz9whg1vlnk6gbr0vv9i2zgbd036182pk0xj4cavaj9rpjb";
  };

+  patches = [
+    # Pull fix pending upstream inclusion for -fno-common toolchains
+    # like upstream gcc-10+ or clang-13:
+    #  https://github.com/rwestlund/freesweep/pull/8
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/rwestlund/freesweep/commit/a86245df4f3ff276a393f799d737d28a5cb0a5a8.patch";
+      sha256 = "13gs3bjb68ixyn9micza7gjd489rd2f5pdrv6sip9fsa6ya29xky";
+    })
+
+    # Pull fix pending upstream inclusion for ncurses-6.3:
+    #  https://github.com/rwestlund/freesweep/pull/10
+    (fetchpatch {
+      name = "ncurses-6.3.patch";
+      url = "https://github.com/rwestlund/freesweep/commit/b0aef2bd0b2409d1e859af7d29bf2d86fc7bcea7.patch";
+      sha256 = "1nzvmvxhjxgm8228h1zz16w62iy6lak5sibif1s1f6p1ssn659jp";
+    })
+  ];
+
  nativeBuildInputs = [ updateAutotoolsGnuConfigScriptsHook ];
  buildInputs = [ ncurses ];

@@ -7,9 +7,9 @@ stdenv.mkDerivation {
  src = fetchFromGitHub {
    owner = "frogatto";
    repo = "frogatto";
-    # master branch as of 2020-12-17
-    rev = "8b0f2bc8f9f172f6225b8e0d806552cb94f35e2a";
-    sha256 = "09nrna9l1zj2ma2bazdhdvphwy570kfz4br4xgpwq21rsjrvrqiy";
+    # master branch as of 2021-11-29
+    rev = "82d3dafa0cfeaad016a427bdbc729eb9509748f1";
+    sha256 = "0fmwn584xl0vafcsh72b4xnryfqyjxk5zhmymg5i8rzp6h03n8xq";
  };

  installPhase = ''
@@ -1,36 +0,0 @@
-#!/usr/bin/env bash
-
-set -o nounset
-
-# shellcheck source=/dev/null
-source "${stdenv}/setup"
-
-mkdir -p "${out}/share/keen4"
-unzip -j "$dist" -d "${out}/share/keen4"
-
-mkdir -p "${out}/bin"
-cat > "${out}/bin/keen4" <<EOF
-#! $SHELL -e
-if test -z "\$HOME"; then
-    echo "HOME directory not set"
-    exit 1
-fi
-
-# Game wants to write in the current directory, but of course we can't
-# let it write in the Nix store.  So create symlinks to the game files
-# in ~/.keen4 and execute game from there.
-mkdir -p \$HOME/.keen4
-cd \$HOME/.keen4
-
-ln -sf "${out}/share/keen4/"* .
-
-"${dosbox}/bin/dosbox" ./KEEN4E.EXE -fullscreen -exit || true
-
-# Cleanup the symlinks.
-for i in *; do
-    if test -L "\$i"; then
-        rm "\$i"
-    fi
-done
-EOF
-chmod +x "${out}/bin/keen4"
--- a/Show More
+++ b/Show More