From 58497175be8c3046186127064ec14fc62191282d Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Mon, 10 May 2021 09:57:52 +0300
Subject: [PATCH 01/20] nixos/netdata: cgroup-network: don't use
 AmbientCapabilities

---
 nixos/modules/services/monitoring/netdata.nix | 15 ++++++++++++---
 pkgs/tools/system/netdata/default.nix         |  2 ++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index c2ee1c0df7f1..ae3bfcbbb97a 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -8,6 +8,7 @@ let
   wrappedPlugins = pkgs.runCommand "wrapped-plugins" { preferLocalBuild = true; } ''
     mkdir -p $out/libexec/netdata/plugins.d
     ln -s /run/wrappers/bin/apps.plugin $out/libexec/netdata/plugins.d/apps.plugin
+    ln -s /run/wrappers/bin/cgroup-network $out/libexec/netdata/plugins.d/cgroup-network
     ln -s /run/wrappers/bin/freeipmi.plugin $out/libexec/netdata/plugins.d/freeipmi.plugin
     ln -s /run/wrappers/bin/perf.plugin $out/libexec/netdata/plugins.d/perf.plugin
     ln -s /run/wrappers/bin/slabinfo.plugin $out/libexec/netdata/plugins.d/slabinfo.plugin
@@ -26,6 +27,9 @@ let
       "web files owner" = "root";
       "web files group" = "root";
     };
+    "plugin:cgroups" = {
+      "script to get cgroup network interfaces" = "${wrappedPlugins}/libexec/netdata/plugins.d/cgroup-network";
+    };
   };
   mkConfig = generators.toINI {} (recursiveUpdate localConfig cfg.config);
   configFile = pkgs.writeText "netdata.conf" (if cfg.configText != null then cfg.configText else mkConfig);
@@ -183,9 +187,6 @@ in {
         ConfigurationDirectory = "netdata";
         ConfigurationDirectoryMode = "0755";
         # Capabilities
-        AmbientCapabilities = [
-          "CAP_SETUID"            # is required for cgroups and cgroups-network plugins
-        ];
         CapabilityBoundingSet = [
           "CAP_DAC_OVERRIDE"      # is required for freeipmi and slabinfo plugins
           "CAP_DAC_READ_SEARCH"   # is required for apps plugin
@@ -217,6 +218,14 @@ in {
       permissions = "u+rx,g+rx,o-rwx";
     };
 
+    security.wrappers."cgroup-network" = {
+      source = "${cfg.package}/libexec/netdata/plugins.d/cgroup-network.org";
+      capabilities = "cap_setuid+ep";
+      owner = cfg.user;
+      group = cfg.group;
+      permissions = "u+rx,g+rx,o-rwx";
+    };
+
     security.wrappers."freeipmi.plugin" = {
       source = "${cfg.package}/libexec/netdata/plugins.d/freeipmi.plugin.org";
       capabilities = "cap_dac_override,cap_fowner+ep";
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 5eb39c7f6d85..4dc0d80b3b58 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -56,6 +56,8 @@ in stdenv.mkDerivation rec {
     # rename this plugin so netdata will look for setuid wrapper
     mv $out/libexec/netdata/plugins.d/apps.plugin \
        $out/libexec/netdata/plugins.d/apps.plugin.org
+    mv $out/libexec/netdata/plugins.d/cgroup-network \
+       $out/libexec/netdata/plugins.d/cgroup-network.org
     mv $out/libexec/netdata/plugins.d/perf.plugin \
        $out/libexec/netdata/plugins.d/perf.plugin.org
     mv $out/libexec/netdata/plugins.d/slabinfo.plugin \

From 859633ee4351835c0180427d34d188b489c3ca65 Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Mon, 10 May 2021 10:24:31 +0300
Subject: [PATCH 02/20] nixos/netdata: use cgroup v2

---
 nixos/modules/services/monitoring/netdata.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index ae3bfcbbb97a..2028e3875f9b 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -29,6 +29,7 @@ let
     };
     "plugin:cgroups" = {
       "script to get cgroup network interfaces" = "${wrappedPlugins}/libexec/netdata/plugins.d/cgroup-network";
+      "use unified cgroups" = "yes";
     };
   };
   mkConfig = generators.toINI {} (recursiveUpdate localConfig cfg.config);

From 85914bc01d7ba185158c0a8f3694ee81ceaf2a1b Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Mon, 10 May 2021 10:35:29 +0300
Subject: [PATCH 03/20] nixos/netdata: change wrappers permissions

---
 nixos/modules/services/monitoring/netdata.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index 2028e3875f9b..561ce3eec625 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -216,7 +216,7 @@ in {
       capabilities = "cap_dac_read_search,cap_sys_ptrace+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rwx";
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.wrappers."cgroup-network" = {
@@ -224,7 +224,7 @@ in {
       capabilities = "cap_setuid+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rwx";
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.wrappers."freeipmi.plugin" = {
@@ -232,7 +232,7 @@ in {
       capabilities = "cap_dac_override,cap_fowner+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rwx";
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.wrappers."perf.plugin" = {
@@ -240,7 +240,7 @@ in {
       capabilities = "cap_sys_admin+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rx";
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.wrappers."slabinfo.plugin" = {
@@ -248,7 +248,7 @@ in {
       capabilities = "cap_dac_override+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rx";
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.pam.loginLimits = [

From c7703958948f46d5568672a4e67187f9da3fc526 Mon Sep 17 00:00:00 2001
From: Konstantin Alekseev <mail@kalekseev.com>
Date: Mon, 10 May 2021 12:37:42 +0300
Subject: [PATCH 04/20] overmind: 2.2.0 -> 2.2.2

---
 pkgs/applications/misc/overmind/default.nix |  11 +-
 pkgs/applications/misc/overmind/deps.nix    | 129 --------------------
 2 files changed, 5 insertions(+), 135 deletions(-)
 delete mode 100644 pkgs/applications/misc/overmind/deps.nix

diff --git a/pkgs/applications/misc/overmind/default.nix b/pkgs/applications/misc/overmind/default.nix
index 537ae3741ef1..80a423a3c83c 100644
--- a/pkgs/applications/misc/overmind/default.nix
+++ b/pkgs/applications/misc/overmind/default.nix
@@ -1,9 +1,8 @@
-{ lib, buildGoPackage, fetchFromGitHub, tmux, which, makeWrapper }:
+{ lib, buildGoModule, fetchFromGitHub, tmux, which, makeWrapper }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "overmind";
-  version = "2.2.0";
-  goPackagePath = "github.com/DarthSim/overmind";
+  version = "2.2.2";
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -15,10 +14,10 @@ buildGoPackage rec {
     owner = "DarthSim";
     repo = pname;
     rev = "v${version}";
-    sha256 = "00v6l4138vv32bqfkzrhk4hfl52a00rlg9ywhp4difgrnz7zj6xb";
+    sha256 = "zDjIwnhDoUj+zTAhtBa94dx7QhYMCTxv2DNUpeP8CP0=";
   };
 
-  goDeps = ./deps.nix;
+  vendorSha256 = "KDMzR6qAruscgS6/bHTN6RnHOlLKCm9lxkr9k3oLY+Y=";
 
   meta = with lib; {
     homepage = "https://github.com/DarthSim/overmind";
diff --git a/pkgs/applications/misc/overmind/deps.nix b/pkgs/applications/misc/overmind/deps.nix
deleted file mode 100644
index b4c9211a24a1..000000000000
--- a/pkgs/applications/misc/overmind/deps.nix
+++ /dev/null
@@ -1,129 +0,0 @@
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "v0.3.1";
-      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
-    };
-  }
-  {
-    goPackagePath = "github.com/DarthSim/godotenv";
-    fetch = {
-      type = "git";
-      url = "https://github.com/DarthSim/godotenv";
-      rev = "v1.3.1";
-      sha256 = "0fb9nl5qrnv7f9w0pgg00ak34afw9kjgcql0l38z22faz2bhgl1q";
-    };
-  }
-  {
-    goPackagePath = "github.com/cpuguy83/go-md2man";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cpuguy83/go-md2man";
-      rev = "f79a8a8ca69d";
-      sha256 = "0r1f7v475dxxgzqci1mxfliwadcrk86ippflx9n411325l4g3ghv";
-    };
-  }
-  {
-    goPackagePath = "github.com/kardianos/osext";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kardianos/osext";
-      rev = "2bc1f35cddc0";
-      sha256 = "1pvrbrvmrf4mx0fxbfaphbzgqgwn8v6lkfk2vyrs0znxrs1xyc5r";
-    };
-  }
-  {
-    goPackagePath = "github.com/matoous/go-nanoid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/matoous/go-nanoid";
-      rev = "eab626deece6";
-      sha256 = "1a82lclk56y7c44jg7wn5vq733dmn0g20r5yqbchrxnpfl75dw89";
-    };
-  }
-  {
-    goPackagePath = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev = "v1.0.0";
-      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
-    };
-  }
-  {
-    goPackagePath = "github.com/russross/blackfriday";
-    fetch = {
-      type = "git";
-      url = "https://github.com/russross/blackfriday";
-      rev = "v2.0.1";
-      sha256 = "0nlz7isdd4rgnwzs68499hlwicxz34j2k2a0b8jy0y7ycd2bcr5j";
-    };
-  }
-  {
-    goPackagePath = "github.com/sevlyar/go-daemon";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sevlyar/go-daemon";
-      rev = "v0.1.5";
-      sha256 = "1y3gnxaifykcjcbzx91lz9bc93b95w3xj4rjxjbii26pm3j7gqyk";
-    };
-  }
-  {
-    goPackagePath = "github.com/shurcooL/sanitized_anchor_name";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shurcooL/sanitized_anchor_name";
-      rev = "v1.0.0";
-      sha256 = "1gv9p2nr46z80dnfjsklc6zxbgk96349sdsxjz05f3z6wb6m5l8f";
-    };
-  }
-  {
-    goPackagePath = "github.com/urfave/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/urfave/cli";
-      rev = "v1.22.2";
-      sha256 = "10mcnvi5qmn00vpyk6si8gjka7p654wr9hac4zc9w5h3ickhvbdc";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "88737f569e3a";
-      sha256 = "02vkqfd6kc28zm6lffagw8nr78sayv6jabfgk9dcifl7826vi3k7";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "81d4e9dc473e";
-      sha256 = "0074zjpkhclz5qbgjv0zmdwy6hmf5k2ri5yagnm6i12ahxaa48dr";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/check.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/check.v1";
-      rev = "20d25e280405";
-      sha256 = "0k1m83ji9l1a7ng8a7v40psbymxasmssbrrhpdv2wl4rhs0nc3np";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "v2.2.2";
-      sha256 = "01wj12jzsdqlnidpyjssmj0r4yavlqy7dwrg7adqd8dicjc4ncsa";
-    };
-  }
-]

From e4b05d9af55b403baaa6fdd738ee16c4498c4299 Mon Sep 17 00:00:00 2001
From: Henri Menke <henri@henrimenke.de>
Date: Mon, 10 May 2021 20:34:54 +0200
Subject: [PATCH 05/20] zfs: remove trace output

We cannot have trace output if the package is marked broken, because
ofborg will consider the evaluation failed if there is any output. Hence
if there is any unsupported kernel version in nixpkgs, the trace will
show up and ofborg will complain.
---
 pkgs/os-specific/linux/zfs/default.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index adfd0cda8199..e10be635b1c5 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -182,13 +182,9 @@ let
         license = licenses.cddl;
         platforms = platforms.linux;
         maintainers = with maintainers; [ hmenke jcumming jonringer wizeman fpletz globin mic92 ];
-        broken = if
-          buildKernel && (kernelCompatible != null) && !kernelCompatible
-          then builtins.trace ''
-            Linux v${kernel.version} is not yet supported by zfsonlinux v${version}.
-            ${lib.optionalString (!isUnstable) "Try zfsUnstable or set the NixOS option boot.zfs.enableUnstable."}
-          '' true
-          else false;
+        # If your Linux kernel version is not yet supported by zfs, try zfsUnstable.
+        # On NixOS set the option boot.zfs.enableUnstable.
+        broken = buildKernel && (kernelCompatible != null) && !kernelCompatible;
       };
     };
 in {

From 0e9fcd6e85bdcd09454841cdabfd9aabf979cf29 Mon Sep 17 00:00:00 2001
From: "Robert T. McGibbon" <rmcgibbo@gmail.com>
Date: Mon, 10 May 2021 17:11:52 -0400
Subject: [PATCH 06/20] python3Packages.tablib: fix build

---
 pkgs/development/python-modules/tablib/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/tablib/default.nix b/pkgs/development/python-modules/tablib/default.nix
index 5216fc7d0d92..b6754e15ad5d 100644
--- a/pkgs/development/python-modules/tablib/default.nix
+++ b/pkgs/development/python-modules/tablib/default.nix
@@ -2,6 +2,7 @@
 , odfpy
 , openpyxl
 , pandas
+, setuptools-scm
 , pytest
 , pytestcov
 , pyyaml
@@ -20,6 +21,7 @@ buildPythonPackage rec {
     sha256 = "f83cac08454f225a34a305daa20e2110d5e6335135d505f93bc66583a5f9c10d";
   };
 
+  nativeBuildInputs = [ setuptools-scm ];
   propagatedBuildInputs = [ xlwt openpyxl pyyaml xlrd odfpy ];
   checkInputs = [ pytest pytestcov unicodecsv pandas ];
 

From f4839bfc43864ded5ba47ba1adcae67e3a9e456c Mon Sep 17 00:00:00 2001
From: Andrey Kuznetsov <fear@loathing.in>
Date: Tue, 11 May 2021 00:35:08 +0300
Subject: [PATCH 07/20] nym: fix build on darwin

---
 pkgs/applications/networking/nym/default.nix | 7 +++++--
 pkgs/top-level/all-packages.nix              | 4 +++-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/nym/default.nix b/pkgs/applications/networking/nym/default.nix
index 9251862ba6ee..1dc41f3af97c 100644
--- a/pkgs/applications/networking/nym/default.nix
+++ b/pkgs/applications/networking/nym/default.nix
@@ -1,8 +1,11 @@
-{ lib
+{ stdenv
+, lib
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
 , openssl
+, Security
+, libiconv
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,7 +23,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security libiconv ];
 
   patches = [ ./ignore-networking-tests.patch ];
   checkType = "debug";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 24fbb63792be..13073bf6a9c5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7146,7 +7146,9 @@ in
 
   nylon = callPackage ../tools/networking/nylon { };
 
-  nym = callPackage ../applications/networking/nym { };
+  nym = callPackage ../applications/networking/nym {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   nzbget = callPackage ../tools/networking/nzbget { };
 

From 0d3bc3db3e5c1a72487eed9fa2b95559e874787c Mon Sep 17 00:00:00 2001
From: Andrey Kuznetsov <fear@loathing.in>
Date: Tue, 11 May 2021 02:11:49 +0300
Subject: [PATCH 08/20] nym: all platforms

---
 pkgs/applications/networking/nym/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/nym/default.nix b/pkgs/applications/networking/nym/default.nix
index 1dc41f3af97c..b7bffcd694e1 100644
--- a/pkgs/applications/networking/nym/default.nix
+++ b/pkgs/applications/networking/nym/default.nix
@@ -39,6 +39,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://nymtech.net";
     license = licenses.asl20;
     maintainers = [ maintainers.ehmry ];
-    platforms = with platforms; intersectLists (linux ++ darwin) (concatLists [ x86 x86_64 aarch64 arm ]);
+    platforms = platforms.all;
   };
 }

From 81310256a99929d2f65f5198aad6503e4e2e855f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 10 May 2021 23:16:19 +0200
Subject: [PATCH 09/20] home-assistant: 2021.5.1 -> 2021.5.2

---
 pkgs/servers/home-assistant/component-packages.nix | 4 ++--
 pkgs/servers/home-assistant/default.nix            | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 923e18bd5867..afaef82d3725 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2021.5.1";
+  version = "2021.5.2";
   components = {
     "abode" = ps: with ps; [ abodepy ];
     "accuweather" = ps: with ps; [ accuweather ];
@@ -375,7 +375,7 @@
     "hvv_departures" = ps: with ps; [ ]; # missing inputs: pygti
     "hydrawise" = ps: with ps; [ hydrawiser ];
     "hyperion" = ps: with ps; [ hyperion-py ];
-    "ialarm" = ps: with ps; [ ]; # missing inputs: pyialarm
+    "ialarm" = ps: with ps; [ pyialarm ];
     "iammeter" = ps: with ps; [ ]; # missing inputs: iammeter
     "iaqualink" = ps: with ps; [ iaqualink ];
     "icloud" = ps: with ps; [ pyicloud ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 5383ae33d136..11bf2c744d30 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -114,7 +114,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2021.5.1";
+  hassVersion = "2021.5.2";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -133,7 +133,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    sha256 = "0bipjfkz4zqhy84jgrn3qxvs4nxya3j08lcsq3xa31xfz8wnpxwj";
+    sha256 = "1v1ah0kdkhx0pkma2qnk56iv00r2lb4i3sfpwlcr64gfkpzpakv8";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling

From 206f155928ca63ff297ce50bedb6c8198483e8a0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 11 May 2021 01:03:29 +0200
Subject: [PATCH 10/20] python3Packages.pysonos: 0.0.44 -> 0.0.45

---
 pkgs/development/python-modules/pysonos/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pysonos/default.nix b/pkgs/development/python-modules/pysonos/default.nix
index 3219bd53ac1f..e4296a4f0b54 100644
--- a/pkgs/development/python-modules/pysonos/default.nix
+++ b/pkgs/development/python-modules/pysonos/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pysonos";
-  version = "0.0.44";
+  version = "0.0.45";
 
   disabled = !isPy3k;
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "amelchio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "108818mkb037zs4ikilrskfppcbmqslsm6zaxmy8pphjh7c299mz";
+    sha256 = "0wzmrd9ja5makvsgf0ckil99wr8vw91dml8fi9miiq4la0100q0n";
   };
 
   propagatedBuildInputs = [ ifaddr requests xmltodict ];

From 4b9a7b96dc36ae87da93152c8f57c91823ae9969 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Tue, 11 May 2021 00:34:00 +0000
Subject: [PATCH 11/20] agi: 1.1.0-dev-20210506 -> 1.1.0-dev-20210507

---
 pkgs/tools/graphics/agi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/agi/default.nix b/pkgs/tools/graphics/agi/default.nix
index b7cfefe70cbf..9c9356371b6f 100644
--- a/pkgs/tools/graphics/agi/default.nix
+++ b/pkgs/tools/graphics/agi/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "agi";
-  version = "1.1.0-dev-20210506";
+  version = "1.1.0-dev-20210507";
 
   src = fetchzip {
     url = "https://github.com/google/agi-dev-releases/releases/download/v${version}/agi-${version}-linux.zip";
-    sha256 = "sha256-VB9AL2h+e+92lhsfdYHbSgv5AIrgEPJsa74VGncDHGo=";
+    sha256 = "sha256-Tbxbsh40Lel4kGnCIWyNRge15Y71ao+oUixClBdj4f4=";
   };
 
   nativeBuildInputs = [

From b8a7603c6d3582bdaf24688579014429a70cfc2e Mon Sep 17 00:00:00 2001
From: Evils <evils.devils@protonmail.com>
Date: Sun, 9 May 2021 02:30:09 +0200
Subject: [PATCH 12/20] pycflow2dot: init at 0.2.3

---
 .../python-modules/pycflow2dot/default.nix    | 41 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 pkgs/top-level/python-packages.nix            |  4 ++
 3 files changed, 47 insertions(+)
 create mode 100644 pkgs/development/python-modules/pycflow2dot/default.nix

diff --git a/pkgs/development/python-modules/pycflow2dot/default.nix b/pkgs/development/python-modules/pycflow2dot/default.nix
new file mode 100644
index 000000000000..db1ac8fabb2f
--- /dev/null
+++ b/pkgs/development/python-modules/pycflow2dot/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, cflow
+, graphviz
+, pydot
+, networkx
+, which
+}:
+
+buildPythonPackage rec {
+  pname = "pycflow2dot";
+  version = "0.2.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1zm8x2pd0q6zza0fw7hg9g1qvybfnjq6ql9b8mh2fc45l7l25655";
+  };
+
+  propagatedBuildInputs = [
+    cflow
+    graphviz
+    pydot
+    networkx
+    which
+  ];
+
+  pythonImportsCheck = [ "pycflow2dot" ];
+  checkPhase = ''
+    cd tests
+    export PATH=$out/bin:$PATH
+    make all
+  '';
+
+  meta = with lib; {
+    description = "Layout C call graphs from cflow using GraphViz dot";
+    homepage    = "https://github.com/johnyf/pycflow2dot";
+    license     = licenses.gpl3Plus;
+    maintainers = with maintainers; [ evils ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e7cfe7eaf95e..d592008e2413 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7820,6 +7820,8 @@ in
 
   pycangjie = pythonPackages.pycangjie;
 
+  pycflow2dot = with python.pkgs; toPythonApplication pycflow2dot;
+
   pydb = callPackage ../development/tools/pydb { };
 
   pydf = callPackage ../applications/misc/pydf { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f4f6a4d6e36f..0d75625019bf 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5410,6 +5410,10 @@ in {
 
   pycfdns = callPackage ../development/python-modules/pycfdns { };
 
+  pycflow2dot = callPackage ../development/python-modules/pycflow2dot {
+    inherit (pkgs) graphviz;
+  };
+
   pychannels = callPackage ../development/python-modules/pychannels { };
 
   pychart = callPackage ../development/python-modules/pychart { };

From 63872607cd5f5c550189b0788eb59224c614e996 Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 11 May 2021 09:22:26 +0800
Subject: [PATCH 13/20] vimPlugins: update

---
 pkgs/misc/vim-plugins/generated.nix | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index a0eb16763f70..705e7ec79028 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -389,12 +389,12 @@ let
 
   chadtree = buildVimPluginFrom2Nix {
     pname = "chadtree";
-    version = "2021-05-10";
+    version = "2021-05-11";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "d6ddb11b13a28f858344cdfafbe4d76fe032803a";
-      sha256 = "0wr6m0i0lj5dpp0rbqyx534jnwpmrrywjq55xai5z799dh4in42k";
+      rev = "2ccce5fa035176b51fa628ba6c672dedf78813e8";
+      sha256 = "0nrxxwf4wy6g5222qf4bjbyai8gym1k0b4wdyjpldfk5pdxd81zg";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
@@ -702,12 +702,12 @@ let
 
   context_filetype-vim = buildVimPluginFrom2Nix {
     pname = "context_filetype-vim";
-    version = "2021-03-04";
+    version = "2021-05-11";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "context_filetype.vim";
-      rev = "f5e4ed8f7847cd5474017459c2a0f2dfd2bf971c";
-      sha256 = "039mnsd6k0sgs8l1a8ngl3y817c8g657nv8v9bdw9h8l5a934cb2";
+      rev = "39a552866c83946127f244912b6d408525f03364";
+      sha256 = "0m2w4f3bn8miplxb9q76fcipdkc9lbfyp47193q57s555b1g0x0k";
     };
     meta.homepage = "https://github.com/Shougo/context_filetype.vim/";
   };
@@ -1503,8 +1503,8 @@ let
     src = fetchFromGitHub {
       owner = "rafamadriz";
       repo = "friendly-snippets";
-      rev = "83de9287ad388f55b7d74f66b8ea5b89bb6abf24";
-      sha256 = "13jp8bg85yyxyl390ymrp6qasg4p6a57x08m2l9ld8wiq33ps6yp";
+      rev = "9178101a99226fb4a973fd88ba6e84972c7b0a94";
+      sha256 = "1dy9b5ipzs412sz31mqqrr6rfjs24569pw17z9b3z40dipmzg1x8";
     };
     meta.homepage = "https://github.com/rafamadriz/friendly-snippets/";
   };
@@ -7087,12 +7087,12 @@ let
 
   vim-matchup = buildVimPluginFrom2Nix {
     pname = "vim-matchup";
-    version = "2021-05-09";
+    version = "2021-05-10";
     src = fetchFromGitHub {
       owner = "andymass";
       repo = "vim-matchup";
-      rev = "2032562ba91b9904fdbaac8a586d93fc69d5aec6";
-      sha256 = "1d38dx5s89113iglbji3q4va3hnjqa6cx141faldp283v39y2qv2";
+      rev = "ea2612d87a38ef2261f66063571eef06689bbb8e";
+      sha256 = "0a7dxvl8p3n8kfm1abm1k2r9l6s230585521scgh8y1sh88zkpay";
     };
     meta.homepage = "https://github.com/andymass/vim-matchup/";
   };

From 28ed9e7f3c934bccdcd716a9364b4d4e87088602 Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 11 May 2021 09:25:08 +0800
Subject: [PATCH 14/20] vimPlugins.Shade-nvim: init at 2021-04-29

---
 pkgs/misc/vim-plugins/generated.nix    | 12 ++++++++++++
 pkgs/misc/vim-plugins/vim-plugin-names |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index 705e7ec79028..d391f145b482 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -4127,6 +4127,18 @@ let
     meta.homepage = "https://github.com/osyo-manga/shabadou.vim/";
   };
 
+  Shade-nvim = buildVimPluginFrom2Nix {
+    pname = "Shade-nvim";
+    version = "2021-04-29";
+    src = fetchFromGitHub {
+      owner = "sunjon";
+      repo = "Shade.nvim";
+      rev = "0196387bba50b8d36cec99cd6483583ff2dedb42";
+      sha256 = "0831k71gm8rpl54x63v7mgp9i1fgxydp2wig3yyd98dc7z9d8f48";
+    };
+    meta.homepage = "https://github.com/sunjon/Shade.nvim/";
+  };
+
   ShowMultiBase = buildVimPluginFrom2Nix {
     pname = "ShowMultiBase";
     version = "2010-10-18";
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index 50b26968f8c7..292f30997da1 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -596,6 +596,7 @@ steelsojka/completion-buffers
 stefandtw/quickfix-reflector.vim
 stephpy/vim-yaml
 sunaku/vim-dasht
+sunjon/Shade.nvim
 svermeulen/vim-subversive
 t9md/vim-choosewin
 t9md/vim-smalls

From 8e5211de812c1e2b8eb8c6069cdd9e95983efad0 Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 11 May 2021 09:33:11 +0800
Subject: [PATCH 15/20] vimPlugins.floating-nvim: init at 2021-05-08

---
 pkgs/misc/vim-plugins/generated.nix    | 12 ++++++++++++
 pkgs/misc/vim-plugins/vim-plugin-names |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index d391f145b482..f7890b076ca4 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -1473,6 +1473,18 @@ let
     meta.homepage = "https://github.com/ncm2/float-preview.nvim/";
   };
 
+  floating-nvim = buildVimPluginFrom2Nix {
+    pname = "floating-nvim";
+    version = "2021-05-08";
+    src = fetchFromGitHub {
+      owner = "fhill2";
+      repo = "floating.nvim";
+      rev = "c47af010aa8e88758995858f0ed2771a99cd3e98";
+      sha256 = "0cvs6c903bq4jk4l197vvdrk8q85rl7z7iy7cvd5m4k7yd937r50";
+    };
+    meta.homepage = "https://github.com/fhill2/floating.nvim/";
+  };
+
   floobits-neovim = buildVimPluginFrom2Nix {
     pname = "floobits-neovim";
     version = "2018-08-01";
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index 292f30997da1..fec947713897 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -131,6 +131,7 @@ fatih/vim-go
 fcpg/vim-osc52
 FelikZ/ctrlp-py-matcher
 fenetikm/falcon
+fhill2/floating.nvim
 fiatjaf/neuron.vim
 fisadev/vim-isort
 flazz/vim-colorschemes

From 7cda01fcb817f58af5022cf8804c57018646136f Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 11 May 2021 09:37:03 +0800
Subject: [PATCH 16/20] vimPlugins.fwatch-nvim: init at 2021-04-26

---
 pkgs/misc/vim-plugins/generated.nix    | 12 ++++++++++++
 pkgs/misc/vim-plugins/vim-plugin-names |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index f7890b076ca4..349cc7c42b68 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -1545,6 +1545,18 @@ let
     meta.homepage = "https://github.com/shumphrey/fugitive-gitlab.vim/";
   };
 
+  fwatch-nvim = buildVimPluginFrom2Nix {
+    pname = "fwatch-nvim";
+    version = "2021-04-26";
+    src = fetchFromGitHub {
+      owner = "rktjmp";
+      repo = "fwatch.nvim";
+      rev = "5fd6bff00d7fa432cdc847819563dad90bcf649d";
+      sha256 = "1jc3kv0w3767593p9capif3p0msf8ac5xal170757ghfiy2jhsp9";
+    };
+    meta.homepage = "https://github.com/rktjmp/fwatch.nvim/";
+  };
+
   fzf-lsp-nvim = buildVimPluginFrom2Nix {
     pname = "fzf-lsp-nvim";
     version = "2021-02-04";
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index fec947713897..58a8bb61890e 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -531,6 +531,7 @@ rhysd/vim-grammarous
 rhysd/vim-operator-surround
 RishabhRD/nvim-lsputils
 RishabhRD/popfix
+rktjmp/fwatch.nvim@main
 rktjmp/lush.nvim@main
 rmagatti/auto-session@main
 rodjek/vim-puppet

From ee4520e789864f3441f3ec488e16d9f548b22ca5 Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 11 May 2021 09:41:59 +0800
Subject: [PATCH 17/20] vimPlugins.aurora: init at 2021-05-10

---
 pkgs/misc/vim-plugins/generated.nix    | 12 ++++++++++++
 pkgs/misc/vim-plugins/vim-plugin-names |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index 349cc7c42b68..459f768a379e 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -183,6 +183,18 @@ let
     meta.homepage = "https://github.com/vmchale/ats-vim/";
   };
 
+  aurora = buildVimPluginFrom2Nix {
+    pname = "aurora";
+    version = "2021-05-10";
+    src = fetchFromGitHub {
+      owner = "ray-x";
+      repo = "aurora";
+      rev = "bf185b9c5aaaad7cfd20f29f92d3b77164f8f1e7";
+      sha256 = "17ir0daw3rsfgprgvrskip2r19g15z05spdk14dz105nrgv4hh4y";
+    };
+    meta.homepage = "https://github.com/ray-x/aurora/";
+  };
+
   auto-git-diff = buildVimPluginFrom2Nix {
     pname = "auto-git-diff";
     version = "2019-09-23";
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index 58a8bb61890e..8dd07b20256f 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -521,6 +521,7 @@ raghur/fruzzy
 raghur/vim-ghost
 Raimondi/delimitMate
 rakr/vim-one
+ray-x/aurora
 rbgrouleff/bclose.vim
 rbong/vim-flog
 rhysd/committia.vim

From e97d557475a2f7a8da811256b7df769514560d1f Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 11 May 2021 11:35:33 +0800
Subject: [PATCH 18/20] zfsUnstable: 2.1.0-rc4 -> 2.1.0-rc5

---
 pkgs/os-specific/linux/zfs/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index e10be635b1c5..6db953ae4eff 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -203,12 +203,12 @@ in {
 
   zfsUnstable = common {
     # check the release notes for compatible kernels
-    kernelCompatible = kernel.kernelAtLeast "3.10" && kernel.kernelOlder "5.12";
+    kernelCompatible = kernel.kernelAtLeast "3.10" && kernel.kernelOlder "5.13";
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2.1.0-rc4";
+    version = "2.1.0-rc5";
 
-    sha256 = "sha256-eakOEA7LCJOYDsZH24Y5JbEd2wh1KfCN+qX3QxQZ4e8=";
+    sha256 = "sha256-cj0P2bw6sTO+Y74pYn/WEpBuVGMMYCreJQjUdC3DMTE=";
 
     isUnstable = true;
   };

From 768075ffb90da1dc66e5e4603a77b76b5a67d343 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Tue, 11 May 2021 04:13:56 +0000
Subject: [PATCH 19/20] golangci-lint: 1.39.0 -> 1.40.0

---
 pkgs/development/tools/golangci-lint/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index 83bc3f473d32..647e8b58490e 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.39.0";
+  version = "1.40.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    sha256 = "0c9yka27k4v1waijk7mn7k31l5a373sclykypflchy7xnlrsa18v";
+    sha256 = "sha256-/AKDwX4W9MCPXNy2izSGTugLV8DVX4A2djZla8bqDCs=";
   };
 
-  vendorSha256 = "1685iv1lsal462c8xqvs76x9dwvbwazrak902j0p12s0fyb66lpl";
+  vendorSha256 = "sha256-HkVt0Nkq7+gvn5VNeROAmuhlCFGYx2niWb1NwJfLtRc=";
 
   doCheck = false;
 

From f93d83d21b6a2d485006c4832f4850545ab7824e Mon Sep 17 00:00:00 2001
From: sterni <0rpkxez4ksa01gb3typccl0i@systemli.org>
Date: Tue, 11 May 2021 06:54:15 +0200
Subject: [PATCH 20/20] ocamlPackages: cohttp: 2.5.0 -> 4.0.0; conduit: 2.2.2
 -> 4.0.0 (#118144)

* ocamlPackages.x509: 0.12.0 -> 0.13.0

https://github.com/mirleft/ocaml-x509/releases/tag/v0.13.0

* ocamlPackages.tls{,-mirage}: 0.12.8 -> 0.13.1

https://github.com/mirleft/ocaml-tls/releases/tag/v0.13.0
https://github.com/mirleft/ocaml-tls/releases/tag/v0.13.1

* ocamlPackages.ca-certs: 0.2.0 -> 0.2.1

Adds support for NIX_SSL_CERT_FILE, so we can finally run its test
suite! https://github.com/mirage/ca-certs/releases/tag/v0.2.1

* ocamlPackages.dns*: 4.6.3 -> 5.0.0

* jackline: unstable-2020-09-03 -> unstable-2021-04-23

Compatibility with tls >= 0.13.0

* ocamlPackages.ca-certs-nss: init at 3.64.0.1

* ocamlPackages.conduit: 2.2.2 -> 2.3.0

https://github.com/mirage/ocaml-conduit/releases/tag/v2.3.0

* ocamlPackages.curly: fix tests with new ca-certs behavior

* ocamlPackages.cohttp: 2.5.0 -> 4.0.0

ocamlPackages.cohttp-lwt-unix: add description

https://github.com/mirage/ocaml-cohttp/releases/tag/v4.0.0

* ocamlPackages.mirage{,-runtime,-types*}: 3.10.1 -> 3.10.3

Adjust to a few changed dependencies:
https://github.com/mirage/mirage/releases/tag/v3.10.2
https://github.com/mirage/mirage/releases/tag/v3.10.3

* ocamlPackages.conduit*: 2.3.0 -> 4.0.0

https://github.com/mirage/ocaml-conduit/releases/tag/v4.0.0

* ocamlPackages.cohttp-lwt-unix: disable tests

* ocamlPackages.dns*: 5.0.0 -> 5.0.1

https://github.com/mirage/ocaml-dns/releases/tag/v5.0.1

* ocamlPackages.awa*: 0.0.1 -> 0.0.3

https://github.com/mirage/awa-ssh/releases/tag/v0.0.2
https://github.com/mirage/awa-ssh/releases/tag/v0.0.3

* ocamlPackages.optint: 0.0.4 -> 0.1.0

https://github.com/mirage/optint/releases/tag/v0.0.5
https://github.com/mirage/optint/releases/tag/v0.1.0

* ocamlPackages.decompress: 1.3.0 -> 1.4.0

https://github.com/mirage/decompress/releases/tag/v1.4.0

* ocamlPackages.checkseum: 0.2.1 -> 0.3.1

https://github.com/mirage/checkseum/releases/tag/v0.3.0
https://github.com/mirage/checkseum/releases/tag/v0.3.1

* ocamlPackages.checkseum: allow compilation with ocaml-freestanding

* ocamlPackages.carton: 0.4.0 -> 0.4.1

https://github.com/mirage/ocaml-git/releases/tag/carton-v0.4.1

* ocamlPackages.mimic: 0.0.2 -> 0.0.3

* Upstream changed.
* https://github.com/dinosaure/mimic/releases/tag/0.0.3

* ocamlPackages.letsencrypt: 0.2.4 -> 0.2.5

* ocamlPackages.paf: 0.0.1 -> 0.0.3

* ocamlPackages.git-cohttp-mirage: remove at 3.3.3

Will be replaced by git-paf 3.4.0.

* ocamlPackages.git*: 3.3.3 -> 3.4.0

ocamlPackages.git-paf: init at 3.4.0

https://github.com/mirage/ocaml-git/releases/tag/3.4.0

* ocamlPackages.irmin*: 2.5.3 -> 2.6.0

https://github.com/mirage/irmin/releases/tag/2.6.0
---
 .../instant-messengers/jackline/default.nix   |  6 +-
 .../development/ocaml-modules/awa/default.nix |  4 +-
 .../ocaml-modules/ca-certs-nss/default.nix    | 55 ++++++++++++++
 .../ocaml-modules/ca-certs/default.nix        | 12 ++--
 .../ocaml-modules/carton/default.nix          |  6 +-
 .../ocaml-modules/checkseum/default.nix       | 39 +++++++---
 .../checkseum/makefile-no-opam.patch          | 12 ++++
 .../ocaml-modules/cohttp/async.nix            | 72 ++++++++++++++-----
 .../ocaml-modules/cohttp/default.nix          | 13 ++--
 .../ocaml-modules/cohttp/lwt-unix.nix         | 25 ++++---
 pkgs/development/ocaml-modules/cohttp/lwt.nix | 25 ++++---
 .../ocaml-modules/cohttp/mirage.nix           |  3 +
 .../ocaml-modules/conduit/async.nix           | 18 ++---
 .../ocaml-modules/conduit/default.nix         | 10 +--
 .../ocaml-modules/conduit/lwt-unix.nix        | 27 +++++--
 .../ocaml-modules/conduit/mirage.nix          |  7 +-
 .../ocaml-modules/curly/default.nix           |  6 +-
 .../ocaml-modules/decompress/default.nix      |  4 +-
 .../development/ocaml-modules/dns/certify.nix |  4 +-
 .../development/ocaml-modules/dns/default.nix |  4 +-
 .../ocaml-modules/git/cohttp-mirage.nix       | 18 -----
 .../development/ocaml-modules/git/default.nix | 13 ++--
 pkgs/development/ocaml-modules/git/paf.nix    | 49 +++++++++++++
 pkgs/development/ocaml-modules/git/unix.nix   | 11 ++-
 .../ocaml-modules/irmin/containers.nix        |  4 +-
 pkgs/development/ocaml-modules/irmin/git.nix  |  4 +-
 .../ocaml-modules/irmin/graphql.nix           |  3 +-
 pkgs/development/ocaml-modules/irmin/http.nix |  5 +-
 .../ocaml-modules/irmin/mirage-git.nix        |  4 +-
 pkgs/development/ocaml-modules/irmin/ppx.nix  |  4 +-
 pkgs/development/ocaml-modules/irmin/unix.nix |  6 +-
 .../ocaml-modules/letsencrypt/default.nix     |  4 +-
 .../ocaml-modules/mimic/default.nix           | 14 ++--
 .../ocaml-modules/mirage/runtime.nix          |  4 +-
 .../ocaml-modules/optint/default.nix          |  6 +-
 .../development/ocaml-modules/paf/default.nix |  6 +-
 .../development/ocaml-modules/tls/default.nix | 12 ++--
 pkgs/development/ocaml-modules/tls/mirage.nix |  5 +-
 .../ocaml-modules/x509/default.nix            |  4 +-
 pkgs/top-level/ocaml-packages.nix             |  4 +-
 40 files changed, 371 insertions(+), 161 deletions(-)
 create mode 100644 pkgs/development/ocaml-modules/ca-certs-nss/default.nix
 create mode 100644 pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch
 delete mode 100644 pkgs/development/ocaml-modules/git/cohttp-mirage.nix
 create mode 100644 pkgs/development/ocaml-modules/git/paf.nix

diff --git a/pkgs/applications/networking/instant-messengers/jackline/default.nix b/pkgs/applications/networking/instant-messengers/jackline/default.nix
index 4c067e384f95..89d4931a2fe4 100644
--- a/pkgs/applications/networking/instant-messengers/jackline/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jackline/default.nix
@@ -4,7 +4,7 @@ with ocamlPackages;
 
 buildDunePackage rec {
   pname = "jackline";
-  version = "unstable-2020-09-03";
+  version = "unstable-2021-04-23";
 
   minimumOCamlVersion = "4.08";
 
@@ -13,8 +13,8 @@ buildDunePackage rec {
   src = fetchFromGitHub {
     owner  = "hannesm";
     repo   = "jackline";
-    rev    = "dd5f19636c9b99b72c348f0f639452d87b7c017c";
-    sha256 = "076smdgig4nwvqsqxa6gsl0c3daq5agwgzp4n2y8xxm3qiq91y89";
+    rev    = "861c59bb7cd27ad5c7558ff94cb0d0e8dca249e5";
+    sha256 = "00waw5qr0n70i9l9b25r9ryfi836x4qrj046bb4k9qa4d0p8q1sa";
   };
 
   nativeBuildInpts = [
diff --git a/pkgs/development/ocaml-modules/awa/default.nix b/pkgs/development/ocaml-modules/awa/default.nix
index 49d614cda884..14f99bb6f8db 100644
--- a/pkgs/development/ocaml-modules/awa/default.nix
+++ b/pkgs/development/ocaml-modules/awa/default.nix
@@ -8,14 +8,14 @@
 
 buildDunePackage rec {
   pname = "awa";
-  version = "0.0.1";
+  version = "0.0.3";
 
   minimumOCamlVersion = "4.07";
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-v${version}.tbz";
-    sha256 = "c1d604645517b191184a5800f5c48a6a9a3e5a2fce4a0e2ecfeee74586301400";
+    sha256 = "5a7927363ffe672cccf12d5425386e84f6f553a17ffec2b01ae5dc28180c831a";
   };
 
   nativeBuildInputs = [ ppx_sexp_conv ppx_cstruct ];
diff --git a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
new file mode 100644
index 000000000000..5e6691a9feba
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, rresult
+, mirage-crypto
+, mirage-clock
+, x509
+, logs
+, fmt
+, hex
+, bos
+, astring
+, cmdliner
+, alcotest
+}:
+
+buildDunePackage rec {
+  pname = "ca-certs-nss";
+  version = "3.64.0.1";
+
+  minimumOCamlVersion = "4.07";
+
+  src = fetchurl {
+    url = "https://github.com/mirage/ca-certs-nss/releases/download/v${version}/ca-certs-nss-v${version}.tbz";
+    sha256 = "909c64076491647471f785527bfdd9a886a34504edabf88542b43f27b86067f9";
+  };
+
+  useDune2 = true;
+
+  propagatedBuildInputs = [
+    rresult
+    mirage-crypto
+    mirage-clock
+    x509
+  ];
+
+  buildInputs = [
+    logs
+    fmt
+    hex
+    bos
+    astring
+    cmdliner
+  ];
+
+  doCheck = true;
+  checkInputs = [ alcotest ];
+
+  meta = with lib; {
+    license = licenses.isc;
+    description = "X.509 trust anchors extracted from Mozilla's NSS";
+    maintainers = [ maintainers.sternenseemann ];
+    homepage = "https://github.com/mirage/ca-certs-nss";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/ca-certs/default.nix b/pkgs/development/ocaml-modules/ca-certs/default.nix
index dacc181f751c..acf869dbd275 100644
--- a/pkgs/development/ocaml-modules/ca-certs/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs/default.nix
@@ -1,24 +1,28 @@
 { lib, buildDunePackage, fetchurl
 , bos, fpath, rresult, ptime, mirage-crypto, x509, astring, logs
+, cacert, alcotest
 }:
 
 buildDunePackage rec {
   pname = "ca-certs";
-  version = "0.2.0";
+  version = "0.2.1";
 
   minimumOCamlVersion = "4.07";
 
   src = fetchurl {
     url = "https://github.com/mirage/ca-certs/releases/download/v${version}/ca-certs-v${version}.tbz";
-    sha256 = "15jfb5zvahs90jsfs7ridqihlka5198z2xrvplj8ddchxfmpx868";
+    sha256 = "d43109496a5129feff967d557c556af96f8b10456896a405c43b7cf0c35d0af3";
   };
 
   useDune2 = true;
 
   propagatedBuildInputs = [ bos fpath rresult ptime mirage-crypto x509 astring logs ];
 
-  # tests need access to network and systemwide ca cert chain
-  doCheck = false;
+  doCheck = true;
+  checkInputs = [
+    cacert    # for /etc/ssl/certs/ca-bundle.crt
+    alcotest
+  ];
 
   meta = with lib; {
     description = "Detect root CA certificates from the operating system";
diff --git a/pkgs/development/ocaml-modules/carton/default.nix b/pkgs/development/ocaml-modules/carton/default.nix
index 31b864e29d32..c10537d5d506 100644
--- a/pkgs/development/ocaml-modules/carton/default.nix
+++ b/pkgs/development/ocaml-modules/carton/default.nix
@@ -7,19 +7,19 @@
 
 buildDunePackage rec {
   pname = "carton";
-  version = "0.4.0";
+  version = "0.4.1";
 
   useDune2 = true;
   minimumOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-git/releases/download/${pname}-v${version}/${pname}-${pname}-v${version}.tbz";
-    sha256 = "777f9692b83cd63570c17527a32c5045818ab9242d923cbbde72fc23d0da0140";
+    sha256 = "d16aad5560d9ab1e3b4d93d2e8fdea638c216ff47338fb630a8aefd22b452665";
   };
 
   # remove changelogs for mimic and the git* packages
   postPatch = ''
-    rm CHANGES.md CHANGES.mimic.md
+    rm CHANGES.md
   '';
 
   buildInputs = [
diff --git a/pkgs/development/ocaml-modules/checkseum/default.nix b/pkgs/development/ocaml-modules/checkseum/default.nix
index 810099810470..527afec33eb3 100644
--- a/pkgs/development/ocaml-modules/checkseum/default.nix
+++ b/pkgs/development/ocaml-modules/checkseum/default.nix
@@ -1,23 +1,46 @@
-{ lib, fetchurl, buildDunePackage, dune-configurator
+{ lib, fetchurl, buildDunePackage, dune-configurator, pkg-config
 , bigarray-compat, optint
-, fmt, rresult
-, alcotest
+, fmt, rresult, bos, fpath, astring, alcotest
+, withFreestanding ? false
+, ocaml-freestanding
 }:
 
 buildDunePackage rec {
-  version = "0.2.1";
+  version = "0.3.1";
   pname = "checkseum";
 
   useDune2 = true;
 
+  minimumOCamlVersion = "4.07";
+
   src = fetchurl {
     url = "https://github.com/mirage/checkseum/releases/download/v${version}/checkseum-v${version}.tbz";
-    sha256 = "1swb44c64pcs4dh9ka9lig6d398qwwkd3kkiajicww6qk7jbh3n5";
+    sha256 = "b9e4d054e17618b1faed8c0eb15afe0614b2f093e58b59a180bda4500a5d2da1";
   };
 
-  buildInputs = [ dune-configurator fmt rresult ];
-  propagatedBuildInputs = [ bigarray-compat optint ];
-  checkInputs = lib.optionals doCheck [ alcotest ];
+  patches = [
+    ./makefile-no-opam.patch
+  ];
+
+  nativeBuildInputs = [
+    dune-configurator
+    pkg-config
+  ];
+  propagatedBuildInputs = [
+    bigarray-compat
+    optint
+  ] ++ lib.optionals withFreestanding [
+    ocaml-freestanding
+  ];
+
+  checkInputs = [
+    alcotest
+    bos
+    astring
+    fmt
+    fpath
+    rresult
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch b/pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch
new file mode 100644
index 000000000000..49fb41b2e008
--- /dev/null
+++ b/pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch
@@ -0,0 +1,12 @@
+diff --git a/freestanding/Makefile b/freestanding/Makefile
+index d535050..bb286bd 100644
+--- a/freestanding/Makefile
++++ b/freestanding/Makefile
+@@ -1,4 +1,6 @@
+-PKG_CONFIG_PATH := $(shell opam config var prefix)/lib/pkgconfig
++ifneq (, $(shell command -v opam))
++PKG_CONFIG_PATH ?= $(shell opam var prefix)/lib/pkgconfig
++endif
+ 
+ EXISTS := $(shell PKG_CONFIG_PATH=$(PKG_CONFIG_PATH) pkg-config --exists ocaml-freestanding; echo $$?)
+ 
diff --git a/pkgs/development/ocaml-modules/cohttp/async.nix b/pkgs/development/ocaml-modules/cohttp/async.nix
index 21e22533f1b2..060d2c6fb6a8 100644
--- a/pkgs/development/ocaml-modules/cohttp/async.nix
+++ b/pkgs/development/ocaml-modules/cohttp/async.nix
@@ -1,22 +1,60 @@
-{ lib, buildDunePackage, async, cohttp, conduit-async, uri, ppx_sexp_conv
-, logs, magic-mime }:
+{ lib
+, buildDunePackage
+, ppx_sexp_conv
+, base
+, async
+, async_kernel
+, async_unix
+, cohttp
+, conduit-async
+, uri
+, uri-sexp
+, logs
+, fmt
+, sexplib0
+, ipaddr
+, magic-mime
+, ounit
+, mirage-crypto
+, core
+}:
 
-if !lib.versionAtLeast cohttp.version "0.99" then
-  cohttp
-else if !lib.versionAtLeast async.version "0.13" then
-  throw "cohttp-async needs async-0.13 (hence OCaml >= 4.08)"
-else
+buildDunePackage {
+  pname = "cohttp-async";
 
-  buildDunePackage {
-    pname = "cohttp-async";
-    useDune2 = true;
-    inherit (cohttp) version src;
+  inherit (cohttp)
+    version
+    src
+    minimumOCamlVersion
+    useDune2
+    ;
 
-    buildInputs = [ ppx_sexp_conv ];
+  buildInputs = [ ppx_sexp_conv ];
 
-    propagatedBuildInputs = [ async cohttp conduit-async logs magic-mime uri ];
+  propagatedBuildInputs = [
+    cohttp
+    conduit-async
+    async_kernel
+    async_unix
+    async
+    base
+    magic-mime
+    logs
+    fmt
+    sexplib0
+    uri
+    uri-sexp
+    ipaddr
+  ];
 
-    meta = cohttp.meta // {
-      description = "CoHTTP implementation for the Async concurrency library";
-    };
-  }
+  doCheck = true;
+  checkInputs = [
+    ounit
+    mirage-crypto
+    core
+  ];
+
+  meta = cohttp.meta // {
+    description = "CoHTTP implementation for the Async concurrency library";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/cohttp/default.nix b/pkgs/development/ocaml-modules/cohttp/default.nix
index 1cbc43bc2804..c1dc973d0eea 100644
--- a/pkgs/development/ocaml-modules/cohttp/default.nix
+++ b/pkgs/development/ocaml-modules/cohttp/default.nix
@@ -1,25 +1,24 @@
 { lib, fetchurl, buildDunePackage
-, ppx_fields_conv, ppx_sexp_conv, stdlib-shims
-, base64, fieldslib, jsonm, re, stringext, uri-sexp
+, ppx_sexp_conv, base64, jsonm, re, stringext, uri-sexp
 , ocaml, fmt, alcotest
 }:
 
 buildDunePackage rec {
   pname = "cohttp";
-  version = "2.5.5";
+  version = "4.0.0";
 
   useDune2 = true;
 
-  minimumOCamlVersion = "4.04.1";
+  minimumOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-cohttp/releases/download/v${version}/cohttp-v${version}.tbz";
-    sha256 = "0ywmql4lp6ps2gd064ixbjzsdnnn5vk3pipm005sswl553qqwaim";
+    sha256 = "bd7aa4cd2c82744990ed7c49e3ee7a40324c64cb3d8509804809155e2bacd1d2";
   };
 
-  buildInputs = [ jsonm ppx_fields_conv ppx_sexp_conv ];
+  buildInputs = [ jsonm ppx_sexp_conv ];
 
-  propagatedBuildInputs = [ base64 fieldslib re stringext uri-sexp stdlib-shims ];
+  propagatedBuildInputs = [ base64 re stringext uri-sexp ];
 
   doCheck = lib.versionAtLeast ocaml.version "4.05";
   checkInputs = [ fmt alcotest ];
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix b/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
index 845df2a3f542..57885b0e65e0 100644
--- a/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
+++ b/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
@@ -1,19 +1,28 @@
 { lib, buildDunePackage, cohttp-lwt
-, conduit-lwt-unix, ppx_sexp_conv
-, cmdliner, fmt, magic-mime
+, conduit-lwt-unix, conduit-lwt, ppx_sexp_conv
+, cmdliner, fmt, logs, magic-mime
+, ounit
+, cacert
 }:
 
-if !lib.versionAtLeast cohttp-lwt.version "0.99"
-then cohttp-lwt
-else
-
 buildDunePackage {
   pname = "cohttp-lwt-unix";
-  inherit (cohttp-lwt) version src meta;
+  inherit (cohttp-lwt) version src;
 
   useDune2 = true;
 
   buildInputs = [ cmdliner ppx_sexp_conv ];
 
-  propagatedBuildInputs = [ cohttp-lwt conduit-lwt-unix fmt magic-mime ];
+  propagatedBuildInputs = [
+    cohttp-lwt conduit-lwt conduit-lwt-unix fmt logs magic-mime
+  ];
+
+  # TODO(@sternenseemann): fail for unknown reason
+  # https://github.com/mirage/ocaml-cohttp/issues/675#issuecomment-830692742
+  doCheck = false;
+  checkInputs = [ ounit cacert ];
+
+  meta = cohttp-lwt.meta // {
+    description = "CoHTTP implementation for Unix and Windows using Lwt";
+  };
 }
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt.nix b/pkgs/development/ocaml-modules/cohttp/lwt.nix
index 36831d946132..158aa3b27b26 100644
--- a/pkgs/development/ocaml-modules/cohttp/lwt.nix
+++ b/pkgs/development/ocaml-modules/cohttp/lwt.nix
@@ -1,16 +1,21 @@
-{ lib, buildDunePackage, cohttp, ocaml_lwt, uri, ppx_sexp_conv, logs }:
-
-if !lib.versionAtLeast cohttp.version "0.99"
-then cohttp
-else if !lib.versionAtLeast ppx_sexp_conv.version "0.13"
-then throw "cohttp-lwt is not available for ppx_sexp_conv version ${ppx_sexp_conv.version}"
-else
+{ lib, buildDunePackage, cohttp, ocaml_lwt, uri, ppx_sexp_conv, logs, sexplib0 }:
 
 buildDunePackage {
   pname = "cohttp-lwt";
-  inherit (cohttp) version src useDune2 meta;
+  inherit (cohttp)
+    version
+    src
+    useDune2
+    minimumOCamlVersion
+    ;
 
-  buildInputs = [ uri ppx_sexp_conv ];
+  buildInputs = [ ppx_sexp_conv ];
 
-  propagatedBuildInputs = [ cohttp ocaml_lwt logs ];
+  propagatedBuildInputs = [
+    cohttp ocaml_lwt logs sexplib0 uri
+  ];
+
+  meta = cohttp.meta // {
+    description = "CoHTTP implementation using the Lwt concurrency library";
+  };
 }
diff --git a/pkgs/development/ocaml-modules/cohttp/mirage.nix b/pkgs/development/ocaml-modules/cohttp/mirage.nix
index e7b172349cb9..d2d3e945645b 100644
--- a/pkgs/development/ocaml-modules/cohttp/mirage.nix
+++ b/pkgs/development/ocaml-modules/cohttp/mirage.nix
@@ -2,6 +2,7 @@
 , mirage-flow, mirage-channel, mirage-kv
 , conduit, conduit-mirage, lwt
 , astring, magic-mime
+, ppx_sexp_conv
 }:
 
 buildDunePackage {
@@ -9,6 +10,8 @@ buildDunePackage {
 
   inherit (cohttp) version src minimumOCamlVersion useDune2;
 
+  nativeBuildInputs = [ ppx_sexp_conv ];
+
   propagatedBuildInputs = [
     mirage-flow mirage-channel conduit conduit-mirage mirage-kv
     lwt cohttp cohttp-lwt astring magic-mime
diff --git a/pkgs/development/ocaml-modules/conduit/async.nix b/pkgs/development/ocaml-modules/conduit/async.nix
index c15ad0520fb2..e78cb2bc5165 100644
--- a/pkgs/development/ocaml-modules/conduit/async.nix
+++ b/pkgs/development/ocaml-modules/conduit/async.nix
@@ -1,17 +1,17 @@
-{ lib, buildDunePackage, async, async_ssl, ppx_sexp_conv, conduit }:
-
-if !lib.versionAtLeast conduit.version "1.0"
-then conduit
-else
+{ lib, buildDunePackage, async, async_ssl, ppx_sexp_conv, ppx_here, uri, conduit }:
 
 buildDunePackage {
   pname = "conduit-async";
-  useDune2 = true;
-  inherit (conduit) version src;
+  inherit (conduit)
+    version
+    src
+    minimumOCamlVersion
+    useDune2
+    ;
 
-  buildInputs = [ ppx_sexp_conv ];
+  buildInputs = [ ppx_sexp_conv ppx_here ];
 
-  propagatedBuildInputs = [ async async_ssl conduit ];
+  propagatedBuildInputs = [ async async_ssl conduit uri ];
 
   meta = conduit.meta // {
     description = "A network connection establishment library for Async";
diff --git a/pkgs/development/ocaml-modules/conduit/default.nix b/pkgs/development/ocaml-modules/conduit/default.nix
index 8c9b757f87c3..96f5bf43d214 100644
--- a/pkgs/development/ocaml-modules/conduit/default.nix
+++ b/pkgs/development/ocaml-modules/conduit/default.nix
@@ -5,18 +5,18 @@
 
 buildDunePackage rec {
   pname = "conduit";
-  version = "2.2.2";
+  version = "4.0.0";
   useDune2 = true;
 
-  minimumOCamlVersion = "4.07";
+  minimumOCamlVersion = "4.03";
 
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-conduit/releases/download/v2.2.2/conduit-v2.2.2.tbz";
-    sha256 = "1zb83w2pq9c8xrappfxa6y5q93772f5dj22x78camsm77a2c2z55";
+    url = "https://github.com/mirage/ocaml-conduit/releases/download/v${version}/conduit-v${version}.tbz";
+    sha256 = "74b29d72bf47adc5d5c4cae6130ad5a2a4923118b9c571331bd1cb3c56decd2a";
   };
 
   buildInputs = [ ppx_sexp_conv ];
-  propagatedBuildInputs = [ astring ipaddr ipaddr-sexp sexplib uri ];
+  propagatedBuildInputs = [ astring ipaddr ipaddr-sexp sexplib uri logs ];
 
   meta = {
     description = "A network connection establishment library";
diff --git a/pkgs/development/ocaml-modules/conduit/lwt-unix.nix b/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
index ab6449b50a17..ce6016012d76 100644
--- a/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
+++ b/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
@@ -1,18 +1,31 @@
 { buildDunePackage
-, conduit-lwt, ppx_sexp_conv, ocaml_lwt, uri, ipaddr, ipaddr-sexp
-, lwt_ssl, tls
+, conduit-lwt, ppx_sexp_conv, ocaml_lwt, uri, ipaddr, ipaddr-sexp, ca-certs, logs
+, lwt_ssl, tls, lwt_log, ssl
 }:
 
 buildDunePackage {
   pname = "conduit-lwt-unix";
-  inherit (conduit-lwt) version src minimumOCamlVersion;
-
-  useDune2 = true;
+  inherit (conduit-lwt) version src minimumOCamlVersion useDune2;
 
   buildInputs = [ ppx_sexp_conv ];
 
-  propagatedBuildInputs =
-    [ conduit-lwt ocaml_lwt uri ipaddr ipaddr-sexp tls lwt_ssl ];
+  propagatedBuildInputs = [
+    conduit-lwt
+    ocaml_lwt
+    uri
+    ipaddr
+    ipaddr-sexp
+    tls
+    ca-certs
+    logs
+    lwt_ssl
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    lwt_log
+    ssl
+  ];
 
   meta = conduit-lwt.meta // {
     description = "A network connection establishment library for Lwt_unix";
diff --git a/pkgs/development/ocaml-modules/conduit/mirage.nix b/pkgs/development/ocaml-modules/conduit/mirage.nix
index 6100908f785b..d1f636be93c4 100644
--- a/pkgs/development/ocaml-modules/conduit/mirage.nix
+++ b/pkgs/development/ocaml-modules/conduit/mirage.nix
@@ -1,7 +1,8 @@
 { buildDunePackage, conduit-lwt
-, ppx_sexp_conv, sexplib, cstruct, mirage-stack, mirage-flow
+, ppx_sexp_conv, sexplib, uri, cstruct, mirage-stack, mirage-flow
 , mirage-flow-combinators, mirage-random, mirage-time, mirage-clock
 , dns-client, vchan, xenstore, tls, tls-mirage, ipaddr, ipaddr-sexp
+, tcpip, ca-certs-nss
 }:
 
 buildDunePackage {
@@ -12,10 +13,10 @@ buildDunePackage {
   nativeBuildInputs = [ ppx_sexp_conv ];
 
   propagatedBuildInputs = [
-    sexplib cstruct mirage-stack mirage-clock mirage-flow
+    sexplib uri cstruct mirage-stack mirage-clock mirage-flow
     mirage-flow-combinators mirage-random mirage-time
     dns-client conduit-lwt vchan xenstore tls tls-mirage
-    ipaddr ipaddr-sexp
+    ipaddr ipaddr-sexp tcpip ca-certs-nss
   ];
 
   meta = conduit-lwt.meta // {
diff --git a/pkgs/development/ocaml-modules/curly/default.nix b/pkgs/development/ocaml-modules/curly/default.nix
index 1c48b509c414..20197e207af3 100644
--- a/pkgs/development/ocaml-modules/curly/default.nix
+++ b/pkgs/development/ocaml-modules/curly/default.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, buildDunePackage, fetchurl, ocaml
-, result, alcotest, cohttp-lwt-unix, odoc, curl }:
+, result, alcotest, cohttp-lwt-unix, odoc, curl, cacert
+}:
 
 buildDunePackage rec {
   pname = "curly";
@@ -15,8 +16,9 @@ buildDunePackage rec {
   };
 
   propagatedBuildInputs = [ result ];
-  checkInputs = [ alcotest cohttp-lwt-unix ];
+  checkInputs = [ alcotest cohttp-lwt-unix cacert ];
   # test dependencies are only available for >= 4.08
+  # https://github.com/mirage/ca-certs/issues/16
   doCheck = lib.versionAtLeast ocaml.version "4.08"
     # Some test fails in macOS sandbox
     # > Fatal error: exception Unix.Unix_error(Unix.EPERM, "bind", "")
diff --git a/pkgs/development/ocaml-modules/decompress/default.nix b/pkgs/development/ocaml-modules/decompress/default.nix
index d2cba68d732e..505ffe3c4257 100644
--- a/pkgs/development/ocaml-modules/decompress/default.nix
+++ b/pkgs/development/ocaml-modules/decompress/default.nix
@@ -4,7 +4,7 @@
 }:
 
 buildDunePackage rec {
-  version = "1.3.0";
+  version = "1.4.0";
   pname = "decompress";
 
   minimumOCamlVersion = "4.07";
@@ -13,7 +13,7 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/mirage/decompress/releases/download/v${version}/decompress-v${version}.tbz";
-    sha256 = "de149896939be13fedec46a4581121d5ab74850a2241d08e6aa8ae4bb18c52c4";
+    sha256 = "d1669e07446d73dd5e16f020d4a1682abcbb1b7a1e3bf19b805429636c26a19b";
   };
 
   buildInputs = [ cmdliner ];
diff --git a/pkgs/development/ocaml-modules/dns/certify.nix b/pkgs/development/ocaml-modules/dns/certify.nix
index 1835114d707c..31b39d18225c 100644
--- a/pkgs/development/ocaml-modules/dns/certify.nix
+++ b/pkgs/development/ocaml-modules/dns/certify.nix
@@ -1,6 +1,6 @@
 { buildDunePackage, dns, dns-tsig, dns-mirage, randomconv, x509
 , mirage-random, mirage-time, mirage-clock, mirage-stack
-, logs, mirage-crypto-pk, mirage-crypto-rng, tls, lwt
+, logs, mirage-crypto-pk, mirage-crypto-rng, mirage-crypto-ec, lwt
 }:
 
 buildDunePackage {
@@ -21,7 +21,7 @@ buildDunePackage {
     logs
     mirage-crypto-pk
     mirage-crypto-rng
-    tls
+    mirage-crypto-ec
     lwt
   ];
 
diff --git a/pkgs/development/ocaml-modules/dns/default.nix b/pkgs/development/ocaml-modules/dns/default.nix
index 4f0b95da6cb3..8a5115f10f05 100644
--- a/pkgs/development/ocaml-modules/dns/default.nix
+++ b/pkgs/development/ocaml-modules/dns/default.nix
@@ -4,14 +4,14 @@
 
 buildDunePackage rec {
   pname = "dns";
-  version = "4.6.3";
+  version = "5.0.1";
 
   useDune2 = true;
   minimumOCamlVersion = "4.07";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-dns/releases/download/v${version}/dns-v${version}.tbz";
-    sha256 = "0g7xw43jm5hv0w9lsnhhi0w3243mxl615cdsvz29yh39fcqvqsdy";
+    sha256 = "72c0a1a91c8e409bd448c8e0ea28d16d13177c326aea403ee1c30ddcb5969adc";
   };
 
   propagatedBuildInputs = [ rresult astring fmt logs ptime domain-name gmap cstruct ipaddr lru duration metrics ];
diff --git a/pkgs/development/ocaml-modules/git/cohttp-mirage.nix b/pkgs/development/ocaml-modules/git/cohttp-mirage.nix
deleted file mode 100644
index d30884006410..000000000000
--- a/pkgs/development/ocaml-modules/git/cohttp-mirage.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildDunePackage
-, git, mimic, cohttp-mirage, cohttp, cohttp-lwt
-, fmt, lwt, result, rresult, uri
-}:
-
-buildDunePackage {
-  pname = "git-cohttp-mirage";
-
-  inherit (git) version src minimumOCamlVersion useDune2;
-
-  propagatedBuildInputs = [
-    git mimic cohttp-mirage cohttp cohttp-lwt fmt lwt result rresult uri
-  ];
-
-  meta = git.meta // {
-    description = "A package to use HTTP-based ocaml-git with MirageOS backend";
-  };
-}
diff --git a/pkgs/development/ocaml-modules/git/default.nix b/pkgs/development/ocaml-modules/git/default.nix
index b8d73178d09b..954e4956c816 100644
--- a/pkgs/development/ocaml-modules/git/default.nix
+++ b/pkgs/development/ocaml-modules/git/default.nix
@@ -1,30 +1,35 @@
 { stdenv, lib, fetchurl, buildDunePackage
 , alcotest, mtime, mirage-crypto-rng, tls, git-binary
 , angstrom, astring, cstruct, decompress, digestif, encore, duff, fmt, checkseum
-, fpath, ke, logs, lwt, ocamlgraph, uri, rresult, base64
+, fpath, ke, logs, lwt, ocamlgraph, uri, rresult, base64, hxd
 , result, bigstringaf, optint, mirage-flow, domain-name, emile
 , mimic, carton, carton-lwt, carton-git, ipaddr, psq, crowbar, alcotest-lwt
 }:
 
 buildDunePackage rec {
   pname = "git";
-  version = "3.3.3";
+  version = "3.4.0";
 
   minimumOCamlVersion = "4.08";
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-git/releases/download/${version}/git-${version}.tbz";
-    sha256 = "0j8pw9w74bfhrjsqr8zm8g7h1az94z9vg7qgc6z6649zm9yjiax3";
+    sha256 = "6eef1240c7c85a8e495b82ef863c509ad41d75e0c45cf73c34ed1bdafd03413f";
   };
 
+  # remove changelog for the carton package
+  postPatch = ''
+    rm CHANGES.carton.md
+  '';
+
   buildInputs = [
     base64
   ];
   propagatedBuildInputs = [
     angstrom astring checkseum cstruct decompress digestif encore duff fmt fpath
     ke logs lwt ocamlgraph uri rresult result bigstringaf optint mirage-flow
-    domain-name emile mimic carton carton-lwt carton-git ipaddr psq
+    domain-name emile mimic carton carton-lwt carton-git ipaddr psq hxd
   ];
   checkInputs = [
     alcotest alcotest-lwt mtime mirage-crypto-rng tls git-binary crowbar
diff --git a/pkgs/development/ocaml-modules/git/paf.nix b/pkgs/development/ocaml-modules/git/paf.nix
new file mode 100644
index 000000000000..cf0272ddf3b8
--- /dev/null
+++ b/pkgs/development/ocaml-modules/git/paf.nix
@@ -0,0 +1,49 @@
+{ lib, buildDunePackage
+, git
+, mimic
+, paf
+, ca-certs-nss
+, cohttp
+, cohttp-lwt
+, fmt
+, ipaddr
+, logs
+, lwt
+, mirage-clock
+, mirage-stack
+, mirage-time
+, result
+, rresult
+, tls
+, uri
+}:
+
+buildDunePackage {
+  pname = "git-paf";
+
+  inherit (git) version src minimumOCamlVersion useDune2;
+
+  propagatedBuildInputs = [
+    git
+    mimic
+    paf
+    ca-certs-nss
+    cohttp
+    cohttp-lwt
+    fmt
+    lwt
+    result
+    rresult
+    ipaddr
+    logs
+    mirage-clock
+    mirage-stack
+    mirage-time
+    tls
+    uri
+  ];
+
+  meta = git.meta // {
+    description = "A package to use HTTP-based ocaml-git with MirageOS backend";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/git/unix.nix b/pkgs/development/ocaml-modules/git/unix.nix
index f4cea472886d..3e5f464cea06 100644
--- a/pkgs/development/ocaml-modules/git/unix.nix
+++ b/pkgs/development/ocaml-modules/git/unix.nix
@@ -6,7 +6,8 @@
 , tcpip, awa-mirage, mirage-flow
 , alcotest, alcotest-lwt, base64, cstruct
 , ke, mirage-crypto-rng, ocurl, git-binary
-, ptime
+, ptime, mimic, ca-certs-nss, tls, tls-mirage
+, cacert
 }:
 
 buildDunePackage {
@@ -24,10 +25,14 @@ buildDunePackage {
     fmt bos fpath uri digestif logs lwt
     astring cohttp-lwt-unix decompress
     domain-name ipaddr mtime mirage-flow
+    cstruct ptime mimic ca-certs-nss
+    tls tls-mirage
   ];
   checkInputs = [
-    alcotest alcotest-lwt base64 cstruct ke
-    mirage-crypto-rng ocurl git-binary ptime
+    alcotest alcotest-lwt base64 ke
+    mirage-crypto-rng git-binary
+    cohttp-lwt-unix
+    cacert # sets up NIX_SSL_CERT_FILE
   ];
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/irmin/containers.nix b/pkgs/development/ocaml-modules/irmin/containers.nix
index 761e9bf5619e..76383099a41d 100644
--- a/pkgs/development/ocaml-modules/irmin/containers.nix
+++ b/pkgs/development/ocaml-modules/irmin/containers.nix
@@ -1,6 +1,6 @@
 { buildDunePackage
 , irmin, irmin-unix, irmin-git, ppx_irmin, lwt, mtime
-, alcotest, alcotest-lwt
+, alcotest, alcotest-lwt, cacert
 }:
 
 buildDunePackage {
@@ -18,7 +18,7 @@ buildDunePackage {
 
   doCheck = true;
   checkInputs = [
-    alcotest alcotest-lwt
+    alcotest alcotest-lwt cacert
   ];
 
   meta = ppx_irmin.meta // {
diff --git a/pkgs/development/ocaml-modules/irmin/git.nix b/pkgs/development/ocaml-modules/irmin/git.nix
index a6c1e8af8fa4..d477c932928e 100644
--- a/pkgs/development/ocaml-modules/irmin/git.nix
+++ b/pkgs/development/ocaml-modules/irmin/git.nix
@@ -1,7 +1,7 @@
 { lib, buildDunePackage
 , git, irmin, irmin-test, ppx_irmin, git-cohttp-unix, git-unix
 , digestif, cstruct, fmt, astring, fpath, logs, lwt, uri
-, mtime, alcotest
+, mtime, alcotest, cacert
 }:
 
 buildDunePackage {
@@ -26,7 +26,7 @@ buildDunePackage {
     uri
   ];
 
-  checkInputs = [ mtime alcotest git-cohttp-unix git-unix irmin-test ];
+  checkInputs = [ mtime alcotest git-cohttp-unix git-unix irmin-test cacert ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/irmin/graphql.nix b/pkgs/development/ocaml-modules/irmin/graphql.nix
index ca205cac4e15..03c8f1eca291 100644
--- a/pkgs/development/ocaml-modules/irmin/graphql.nix
+++ b/pkgs/development/ocaml-modules/irmin/graphql.nix
@@ -1,5 +1,5 @@
 { lib, buildDunePackage, cohttp-lwt, graphql-cohttp, graphql-lwt, irmin
-, alcotest, alcotest-lwt, logs, yojson, cohttp-lwt-unix
+, alcotest, alcotest-lwt, logs, yojson, cohttp-lwt-unix, cacert
 }:
 
 buildDunePackage rec {
@@ -19,6 +19,7 @@ buildDunePackage rec {
     logs
     cohttp-lwt-unix
     yojson
+    cacert
   ];
 
   meta = irmin.meta // {
diff --git a/pkgs/development/ocaml-modules/irmin/http.nix b/pkgs/development/ocaml-modules/irmin/http.nix
index b50e0b873454..7bfae9982021 100644
--- a/pkgs/development/ocaml-modules/irmin/http.nix
+++ b/pkgs/development/ocaml-modules/irmin/http.nix
@@ -1,5 +1,6 @@
 { lib, buildDunePackage, cohttp-lwt, irmin, webmachine
 , checkseum, git-unix, irmin-git, irmin-test, digestif, git-cohttp-unix
+, cacert
 }:
 
 buildDunePackage rec {
@@ -12,7 +13,9 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ cohttp-lwt irmin webmachine ];
 
-  checkInputs = [ digestif checkseum git-cohttp-unix git-unix irmin-git irmin-test ];
+  checkInputs = [
+    digestif checkseum git-cohttp-unix git-unix irmin-git irmin-test cacert
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/irmin/mirage-git.nix b/pkgs/development/ocaml-modules/irmin/mirage-git.nix
index dfa84ff2335d..e33b766bd4cb 100644
--- a/pkgs/development/ocaml-modules/irmin/mirage-git.nix
+++ b/pkgs/development/ocaml-modules/irmin/mirage-git.nix
@@ -1,6 +1,6 @@
 { buildDunePackage, irmin-mirage, irmin-git
 , mirage-kv, cohttp, conduit-lwt, conduit-mirage
-, git-cohttp-mirage, fmt, git, lwt, mirage-clock, uri
+, git-paf, fmt, git, lwt, mirage-clock, uri
 }:
 
 buildDunePackage {
@@ -15,7 +15,7 @@ buildDunePackage {
     cohttp
     conduit-lwt
     conduit-mirage
-    git-cohttp-mirage
+    git-paf
     fmt
     git
     lwt
diff --git a/pkgs/development/ocaml-modules/irmin/ppx.nix b/pkgs/development/ocaml-modules/irmin/ppx.nix
index 7c59e1eaef34..c7eed70d9d99 100644
--- a/pkgs/development/ocaml-modules/irmin/ppx.nix
+++ b/pkgs/development/ocaml-modules/irmin/ppx.nix
@@ -2,11 +2,11 @@
 
 buildDunePackage rec {
   pname = "ppx_irmin";
-  version = "2.5.3";
+  version = "2.6.0";
 
   src = fetchurl {
     url = "https://github.com/mirage/irmin/releases/download/${version}/irmin-${version}.tbz";
-    sha256 = "2c8ef24cc57379c3a138f121fea350ee7b6077abc22a4fdc6a47d0c81585f3f6";
+    sha256 = "1db134221e82c424260a0e206b640fcb82902be35eea4137af2bcd9c98d3ac0f";
   };
 
   minimumOCamlVersion = "4.08";
diff --git a/pkgs/development/ocaml-modules/irmin/unix.nix b/pkgs/development/ocaml-modules/irmin/unix.nix
index a3dfb5d508c2..89cf36979bde 100644
--- a/pkgs/development/ocaml-modules/irmin/unix.nix
+++ b/pkgs/development/ocaml-modules/irmin/unix.nix
@@ -1,7 +1,7 @@
 { lib, buildDunePackage
 , checkseum, cmdliner, git-unix, git-cohttp-unix, yaml, fpath
 , irmin, irmin-fs, irmin-git, irmin-graphql, irmin-http
-, irmin-pack, irmin-watcher, irmin-test
+, irmin-pack, irmin-watcher, irmin-test, cacert
 }:
 
 buildDunePackage rec {
@@ -18,7 +18,9 @@ buildDunePackage rec {
     irmin-pack irmin-watcher git-cohttp-unix
   ];
 
-  checkInputs = lib.optional doCheck irmin-test;
+  checkInputs = [
+    irmin-test cacert
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/letsencrypt/default.nix b/pkgs/development/ocaml-modules/letsencrypt/default.nix
index b3c0d4f89412..0a70bf302428 100644
--- a/pkgs/development/ocaml-modules/letsencrypt/default.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/default.nix
@@ -31,11 +31,11 @@
 
 buildDunePackage rec {
   pname = "letsencrypt";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchurl {
     url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${version}/letsencrypt-v${version}.tbz";
-    sha256 = "91c79828a50243804da29c17563c54d2d528a79207e5b874dce6a3e7fedf7567";
+    sha256 = "6e3bbb5f593823d49e83e698c06cf9ed48818695ec8318507b311ae74731e607";
   };
 
   minimumOCamlVersion = "4.08";
diff --git a/pkgs/development/ocaml-modules/mimic/default.nix b/pkgs/development/ocaml-modules/mimic/default.nix
index 3ddae57e9e8d..ea1636427038 100644
--- a/pkgs/development/ocaml-modules/mimic/default.nix
+++ b/pkgs/development/ocaml-modules/mimic/default.nix
@@ -1,27 +1,23 @@
 { lib, buildDunePackage, fetchurl
-, fmt, mirage-flow, result, rresult, cstruct, logs, ke
+, fmt, mirage-flow, result, rresult, cstruct, logs, ke, lwt
 , alcotest, alcotest-lwt, bigstringaf, bigarray-compat
 }:
 
 buildDunePackage rec {
   pname = "mimic";
-  version = "0.0.2";
+  version = "0.0.3";
 
   minimumOCamlVersion = "4.08";
   useDune2 = true;
 
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-git/releases/download/${pname}-v${version}/${pname}-${pname}-v${version}.tbz";
-    sha256 = "3ad5af3caa1120ecfdf022de41ba5be8edfbf50270fc99238b82d3d2d6e7c317";
+    url = "https://github.com/dinosaure/mimic/releases/download/${version}/mimic-${version}.tbz";
+    sha256 = "e4743cd2e4f8242eb1ce9d8086fd2affba0eb6a62131309ffa279108bd3dbbcb";
   };
 
-  # don't install changelogs for other packages
-  postPatch = ''
-    rm -f CHANGES.md CHANGES.carton.md
-  '';
-
   propagatedBuildInputs = [
     fmt
+    lwt
     mirage-flow
     result
     rresult
diff --git a/pkgs/development/ocaml-modules/mirage/runtime.nix b/pkgs/development/ocaml-modules/mirage/runtime.nix
index 50121ad62802..aaa51aa276c4 100644
--- a/pkgs/development/ocaml-modules/mirage/runtime.nix
+++ b/pkgs/development/ocaml-modules/mirage/runtime.nix
@@ -3,7 +3,7 @@
 
 buildDunePackage rec {
   pname = "mirage-runtime";
-  version = "3.10.1";
+  version = "3.10.3";
 
   useDune2 = true;
 
@@ -11,7 +11,7 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage/releases/download/v${version}/mirage-v${version}.tbz";
-    sha256 = "1glmsz2znhfkk4w6d6nsr7q5jqvivhmi8zwagzw2d8pah0c8bhm4";
+    sha256 = "7c8059ef9e330eaef1ed51c0d89afe17900310f8083a426cd8099602222c2281";
   };
 
   propagatedBuildInputs = [ ipaddr functoria-runtime fmt logs ocaml_lwt ];
diff --git a/pkgs/development/ocaml-modules/optint/default.nix b/pkgs/development/ocaml-modules/optint/default.nix
index 7f8ded5feb6c..2227f6e033ca 100644
--- a/pkgs/development/ocaml-modules/optint/default.nix
+++ b/pkgs/development/ocaml-modules/optint/default.nix
@@ -1,12 +1,12 @@
 { lib, buildDunePackage, fetchurl }:
 
 buildDunePackage rec {
-  minimumOCamlVersion = "4.03";
-  version = "0.0.4";
+  minimumOCamlVersion = "4.07";
+  version = "0.1.0";
   pname = "optint";
   src = fetchurl {
     url = "https://github.com/mirage/optint/releases/download/v${version}/optint-v${version}.tbz";
-    sha256 = "1a7gabxqmfvii8qnxq1clx43md2h9glskxhac8y8r0rhzblx3s1a";
+    sha256 = "27847660223c16cc7eaf8fcd9d5589a0b802114330a2529578f8007d3b01185d";
   };
 
   useDune2 = true;
diff --git a/pkgs/development/ocaml-modules/paf/default.nix b/pkgs/development/ocaml-modules/paf/default.nix
index 0c91051e2433..375ba1c125e8 100644
--- a/pkgs/development/ocaml-modules/paf/default.nix
+++ b/pkgs/development/ocaml-modules/paf/default.nix
@@ -5,6 +5,7 @@
 , mirage-stack
 , mirage-time
 , httpaf
+, h2
 , tls-mirage
 , mimic
 , cohttp-lwt
@@ -31,11 +32,11 @@
 
 buildDunePackage rec {
   pname = "paf";
-  version = "0.0.1";
+  version = "0.0.3";
 
   src = fetchurl {
     url = "https://github.com/dinosaure/paf-le-chien/releases/download/${version}/paf-${version}.tbz";
-    sha256 = "7a794c21ce458bda302553b0f5ac128c067579fbb3b7b8fba9b410446c43e790";
+    sha256 = "a0bbb84b19e1f0255337fc4d7017f3ea3611b241746e391b11c1d8b1f5f30a2b";
   };
 
   useDune2 = true;
@@ -45,6 +46,7 @@ buildDunePackage rec {
     mirage-stack
     mirage-time
     httpaf
+    h2
     tls-mirage
     mimic
     cohttp-lwt
diff --git a/pkgs/development/ocaml-modules/tls/default.nix b/pkgs/development/ocaml-modules/tls/default.nix
index 2ee01ed82194..dadeb5a98eaf 100644
--- a/pkgs/development/ocaml-modules/tls/default.nix
+++ b/pkgs/development/ocaml-modules/tls/default.nix
@@ -1,17 +1,17 @@
 { lib, fetchurl, buildDunePackage, ppx_sexp_conv, ppx_cstruct, cstruct
 , cstruct-sexp, sexplib, mirage-crypto, mirage-crypto-pk, mirage-crypto-rng
-, x509, domain-name, fmt, cstruct-unix, ounit2, ocaml_lwt, ptime
-, hacl_x25519, fiat-p256, hkdf, logs, alcotest }:
+, x509, domain-name, fmt, cstruct-unix, ounit2, ocaml_lwt, ptime, rresult
+, mirage-crypto-ec, hkdf, logs, alcotest }:
 
 buildDunePackage rec {
   minimumOCamlVersion = "4.08";
 
-  version = "0.12.8";
+  version = "0.13.1";
   pname = "tls";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-v${version}.tbz";
-    sha256 = "0sgppvfnamfnsglw1cl801i1xqkxbs33g40kwmmqj2vqjcarm26a";
+    sha256 = "ca95fa59a82f7d38b0b495fc0cd1ff54e7728492a292895d0067c1ba9de81b7b";
   };
 
   useDune2 = true;
@@ -21,8 +21,8 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ ppx_sexp_conv ppx_cstruct cstruct cstruct-sexp
                             sexplib mirage-crypto mirage-crypto-pk mirage-crypto-rng
-                            x509 domain-name fmt ocaml_lwt ptime hacl_x25519 fiat-p256
-                            hkdf logs ];
+                            x509 domain-name fmt ocaml_lwt ptime mirage-crypto-ec
+                            hkdf logs rresult ];
 
   meta = with lib; {
     homepage = "https://github.com/mirleft/ocaml-tls";
diff --git a/pkgs/development/ocaml-modules/tls/mirage.nix b/pkgs/development/ocaml-modules/tls/mirage.nix
index ad81c03c35d0..18d0f08357d4 100644
--- a/pkgs/development/ocaml-modules/tls/mirage.nix
+++ b/pkgs/development/ocaml-modules/tls/mirage.nix
@@ -1,6 +1,6 @@
 { buildDunePackage, tls
 , x509, lwt, fmt, mirage-flow, mirage-kv, mirage-clock, ptime
-, mirage-crypto, mirage-crypto-pk, hacl_x25519, fiat-p256
+, mirage-crypto, mirage-crypto-pk, mirage-crypto-ec
 }:
 
 buildDunePackage {
@@ -19,8 +19,7 @@ buildDunePackage {
     ptime
     mirage-crypto
     mirage-crypto-pk
-    hacl_x25519
-    fiat-p256
+    mirage-crypto-ec
   ];
 
   meta = tls.meta // {
diff --git a/pkgs/development/ocaml-modules/x509/default.nix b/pkgs/development/ocaml-modules/x509/default.nix
index 637105361fda..0ce57b071689 100644
--- a/pkgs/development/ocaml-modules/x509/default.nix
+++ b/pkgs/development/ocaml-modules/x509/default.nix
@@ -8,11 +8,11 @@ buildDunePackage rec {
   minimumOCamlVersion = "4.07";
 
   pname = "x509";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-x509/releases/download/v${version}/x509-v${version}.tbz";
-    sha256 = "04g59j8sn8am0z0a94h8cyvr6cqzd5gkn2lj6g51nb5dkwajj19h";
+    sha256 = "4577c2a616bda45cc777869fc44e272397d63a029135a993df8937bcfd6f6c49";
   };
 
   useDune2 = true;
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 71da1aa5c0ae..b6c551158c03 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -82,6 +82,8 @@ let
 
     ca-certs = callPackage ../development/ocaml-modules/ca-certs { };
 
+    ca-certs-nss = callPackage ../development/ocaml-modules/ca-certs-nss { };
+
     carton = callPackage ../development/ocaml-modules/carton { };
 
     carton-git = callPackage ../development/ocaml-modules/carton/git.nix { };
@@ -457,7 +459,7 @@ let
 
     git-cohttp-unix = callPackage ../development/ocaml-modules/git/cohttp-unix.nix { };
 
-    git-cohttp-mirage = callPackage ../development/ocaml-modules/git/cohttp-mirage.nix { };
+    git-paf = callPackage ../development/ocaml-modules/git/paf.nix { };
 
     git-unix = callPackage ../development/ocaml-modules/git/unix.nix {
       git-binary = pkgs.git;