From 4d7f8b50d240ef85b93a64744c21f56ab3c965d7 Mon Sep 17 00:00:00 2001
From: Morgan Helton <mhelton@gmail.com>
Date: Tue, 23 Aug 2022 19:47:27 -0500
Subject: [PATCH 01/21] envoy: 1.21.4 -> 1.21.5

---
 pkgs/servers/http/envoy/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/servers/http/envoy/default.nix b/pkgs/servers/http/envoy/default.nix
index 1cd6e0c785ef..9bcf573d06c4 100644
--- a/pkgs/servers/http/envoy/default.nix
+++ b/pkgs/servers/http/envoy/default.nix
@@ -23,8 +23,8 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.21.4";
-    rev = "782ba5e5ab9476770378ec9f1901803e0d38ac41";
+    version = "1.21.5";
+    rev = "0512f18b764828497febd0f6dcecc1861003d614";
   };
 in
 buildBazelPackage rec {
@@ -35,7 +35,7 @@ buildBazelPackage rec {
     owner = "envoyproxy";
     repo = "envoy";
     inherit (srcVer) rev;
-    hash = "sha256-SthKDMQs5yNU0iouAPVsDeCPKcsBXmO9ebDwu58UQRs=";
+    sha256 = "sha256-VWcfdoZ1wGkxaf0PZwfiSFg8D/QDIZs4u/iLUnsbjMo=";
 
     postFetch = ''
       chmod -R +w $out
@@ -85,8 +85,8 @@ buildBazelPackage rec {
 
   fetchAttrs = {
     sha256 = {
-      x86_64-linux = "sha256-/SA+WFHcMjk6iLwuEmuBIzy3pMhw7TThIEx292dv6IE=";
-      aarch64-linux = "sha256-0XdeirdIP7+nKy8zZbr2uHN2RZ4ZFOJt9i/+Ow1s/W4=";
+      x86_64-linux = "sha256-bE28PBQjsOLkxjIoDk6HcELPP3XzvqKKVa7yUbXB1Qk=";
+      aarch64-linux = "sha256-Rf7kEBeH72vsvmzKy/7oKQf8cVNVzIcSuXMhrIhMFKM=";
     }.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
     dontUseCmakeConfigure = true;
     dontUseGnConfigure = true;

From 9677d8a7a5330f10bea4bf5d7866d957adb374b3 Mon Sep 17 00:00:00 2001
From: Morgan Helton <mhelton@gmail.com>
Date: Tue, 23 Aug 2022 20:03:27 -0500
Subject: [PATCH 02/21] pomerium: build and include ui

---
 pkgs/servers/http/pomerium/common.nix         | 27 +++++++++
 pkgs/servers/http/pomerium/default.nix        | 24 +++-----
 .../http/pomerium/pomerium-ui-package.json    | 60 +++++++++++++++++++
 pkgs/servers/http/pomerium/ui.nix             | 38 ++++++++++++
 pkgs/top-level/all-packages.nix               |  4 +-
 5 files changed, 135 insertions(+), 18 deletions(-)
 create mode 100644 pkgs/servers/http/pomerium/common.nix
 create mode 100644 pkgs/servers/http/pomerium/pomerium-ui-package.json
 create mode 100644 pkgs/servers/http/pomerium/ui.nix

diff --git a/pkgs/servers/http/pomerium/common.nix b/pkgs/servers/http/pomerium/common.nix
new file mode 100644
index 000000000000..87b9b98a72e8
--- /dev/null
+++ b/pkgs/servers/http/pomerium/common.nix
@@ -0,0 +1,27 @@
+{ fetchFromGitHub
+, lib
+}:
+let
+  version = "0.17.1";
+  srcHash = "sha256:0b9mdzyfn7c6gwgslqk787yyrrcmdjf3282vx2zvhcr3psz0xqwx";
+  vendorSha256 = "sha256:1cq4m5a7z64yg3v1c68d15ilw78il6p53vaqzxgn338zjggr3kig";
+  yarnSha256 = "sha256-dLkn9xvQ3gixU63g1xvzbY+YI+9YnaGa3D0uGrrpGvI=";
+in
+{
+  inherit version vendorSha256 yarnSha256;
+
+  src = fetchFromGitHub {
+    owner = "pomerium";
+    repo = "pomerium";
+    rev = "v${version}";
+    hash = srcHash;
+  };
+
+  meta = with lib; {
+    homepage = "https://pomerium.io";
+    description = "Authenticating reverse proxy";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ lukegb ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+  };
+}
diff --git a/pkgs/servers/http/pomerium/default.nix b/pkgs/servers/http/pomerium/default.nix
index b6de805a619b..7b115d6d694a 100644
--- a/pkgs/servers/http/pomerium/default.nix
+++ b/pkgs/servers/http/pomerium/default.nix
@@ -1,26 +1,21 @@
 { buildGoModule
 , fetchFromGitHub
+, callPackage
 , lib
 , envoy
-, zip
 , nixosTests
+, pomerium-ui
 , pomerium-cli
 }:
 
 let
   inherit (lib) concatStringsSep concatMap id mapAttrsToList;
+  common = callPackage ./common.nix { };
 in
 buildGoModule rec {
+  inherit (common) version src vendorSha256 meta;
   pname = "pomerium";
-  version = "0.17.1";
-  src = fetchFromGitHub {
-    owner = "pomerium";
-    repo = "pomerium";
-    rev = "v${version}";
-    hash = "sha256:0b9mdzyfn7c6gwgslqk787yyrrcmdjf3282vx2zvhcr3psz0xqwx";
-  };
 
-  vendorSha256 = "sha256:1cq4m5a7z64yg3v1c68d15ilw78il6p53vaqzxgn338zjggr3kig";
   subPackages = [
     "cmd/pomerium"
   ];
@@ -70,6 +65,9 @@ buildGoModule rec {
     EOF
     sha256sum '${envoy}/bin/envoy' > internal/envoy/files/envoy.sha256
     echo '${envoy.version}' > internal/envoy/files/envoy.version
+
+    # put the built UI files where they will be picked up as part of binary build
+    cp -r ${pomerium-ui} ui
   '';
 
   installPhase = ''
@@ -80,12 +78,4 @@ buildGoModule rec {
     inherit (nixosTests) pomerium;
     inherit pomerium-cli;
   };
-
-  meta = with lib; {
-    homepage = "https://pomerium.io";
-    description = "Authenticating reverse proxy";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ lukegb ];
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
-  };
 }
diff --git a/pkgs/servers/http/pomerium/pomerium-ui-package.json b/pkgs/servers/http/pomerium/pomerium-ui-package.json
new file mode 100644
index 000000000000..12f39ead62a9
--- /dev/null
+++ b/pkgs/servers/http/pomerium/pomerium-ui-package.json
@@ -0,0 +1,60 @@
+{
+  "name": "pomerium",
+  "version": "1.0.0",
+  "main": "src/index.tsx",
+  "license": "Apache-2.0",
+  "scripts": {
+    "build": "ts-node ./scripts/esbuild.ts",
+    "format": "prettier --write .",
+    "lint": "eslint .",
+    "watch": "ts-node ./scripts/esbuild.ts --watch"
+  },
+  "browserslist": {
+    "production": [
+      ">0.2%",
+      "not dead",
+      "not op_mini all"
+    ],
+    "development": [
+      "last 1 chrome version",
+      "last 1 firefox version",
+      "last 1 safari version"
+    ]
+  },
+  "dependencies": {
+    "@babel/core": "^7.0.0",
+    "@emotion/react": "^11.7.1",
+    "@emotion/styled": "^11.6.0",
+    "@fontsource/dm-mono": "^4.5.2",
+    "@fontsource/dm-sans": "^4.5.1",
+    "@mui/icons-material": "^5.3.1",
+    "@mui/material": "^5.4.0",
+    "luxon": "^2.3.0",
+    "react": "^17.0.2",
+    "react-dom": "^17.0.2",
+    "react-feather": "^2.0.9"
+  },
+  "devDependencies": {
+    "@trivago/prettier-plugin-sort-imports": "2.0.4",
+    "@types/luxon": "^2.0.9",
+    "@types/node": "^17.0.14",
+    "@types/react": "^17.0.34",
+    "@types/react-dom": "^17.0.11",
+    "@typescript-eslint/eslint-plugin": "^5.10.2",
+    "@typescript-eslint/parser": "^5.10.2",
+    "esbuild": "^0.13.12",
+    "eslint": "7.32.0",
+    "eslint-config-prettier": "^8.3.0",
+    "eslint-plugin-react": "^7.28.0",
+    "prettier": "^2.4.1",
+    "ts-node": "^10.4.0",
+    "typescript": "^4.4.4"
+  },
+  "prettier": {
+    "importOrder": [
+      "^[./]"
+    ],
+    "importOrderSeparation": true,
+    "importOrderSortSpecifiers": true
+  }
+}
diff --git a/pkgs/servers/http/pomerium/ui.nix b/pkgs/servers/http/pomerium/ui.nix
new file mode 100644
index 000000000000..f2a94814ca21
--- /dev/null
+++ b/pkgs/servers/http/pomerium/ui.nix
@@ -0,0 +1,38 @@
+{ lib
+, callPackage
+, fetchFromGitHub
+, fetchYarnDeps
+, mkYarnPackage }:
+let
+  common = callPackage ./common.nix { };
+in
+mkYarnPackage {
+  inherit (common) version;
+  pname = "pomerium-ui";
+  src = "${common.src}/ui";
+
+  # update pomerium-ui-package.json when updating package, sourced from ui/package.json
+  packageJSON = ./pomerium-ui-package.json;
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${common.src}/ui/yarn.lock";
+    sha256 = common.yarnSha256;
+  };
+
+  buildPhase = ''
+    runHook preBuild
+    yarn --offline build
+    runHook postbuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    cp -R deps/pomerium/dist $out
+    runHook postInstall
+  '';
+
+  doDist = false;
+
+  meta = common.meta // {
+    description = "Pomerium authenticating reverse proxy UI";
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6f8786a40cf4..e18c5dc1e98e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22892,7 +22892,9 @@ with pkgs;
   };
   pflogsumm = callPackage ../servers/mail/postfix/pflogsumm.nix { };
 
-  pomerium = callPackage ../servers/http/pomerium { };
+  pomerium = callPackage ../servers/http/pomerium {
+    pomerium-ui = callPackage ../servers/http/pomerium/ui.nix { };
+  };
   pomerium-cli = callPackage ../tools/security/pomerium-cli { };
 
   postgrey = callPackage ../servers/mail/postgrey { };

From 4dfa0d23241afc02fe30caef4d6bd26075b48c61 Mon Sep 17 00:00:00 2001
From: Morgan Helton <mhelton@gmail.com>
Date: Tue, 23 Aug 2022 20:08:34 -0500
Subject: [PATCH 03/21] pomerium: 0.17.1 -> 0.18.0

---
 pkgs/servers/http/pomerium/common.nix         | 10 ++--
 pkgs/servers/http/pomerium/default.nix        | 13 +++--
 .../servers/http/pomerium/external-envoy.diff | 48 +++++++++++++++++++
 3 files changed, 61 insertions(+), 10 deletions(-)
 create mode 100644 pkgs/servers/http/pomerium/external-envoy.diff

diff --git a/pkgs/servers/http/pomerium/common.nix b/pkgs/servers/http/pomerium/common.nix
index 87b9b98a72e8..d7a0814f1315 100644
--- a/pkgs/servers/http/pomerium/common.nix
+++ b/pkgs/servers/http/pomerium/common.nix
@@ -2,10 +2,10 @@
 , lib
 }:
 let
-  version = "0.17.1";
-  srcHash = "sha256:0b9mdzyfn7c6gwgslqk787yyrrcmdjf3282vx2zvhcr3psz0xqwx";
-  vendorSha256 = "sha256:1cq4m5a7z64yg3v1c68d15ilw78il6p53vaqzxgn338zjggr3kig";
-  yarnSha256 = "sha256-dLkn9xvQ3gixU63g1xvzbY+YI+9YnaGa3D0uGrrpGvI=";
+  version = "0.18.0";
+  srcSha256 = "sha256-sM4kM8CqbZjl+RIsezWYVCmjoDKfGl+EQcdEaPKvVHs=";
+  vendorSha256 = "sha256-1EWcjfrO3FEypUUKwNwDisogERCuKOvtC7z0mC2JZn4=";
+  yarnSha256 = "sha256-Uh0y2Zmy6bSoyL5WMTce01hoH7EvSIniHyIBMxfMvhg=";
 in
 {
   inherit version vendorSha256 yarnSha256;
@@ -14,7 +14,7 @@ in
     owner = "pomerium";
     repo = "pomerium";
     rev = "v${version}";
-    hash = srcHash;
+    sha256 = srcSha256;
   };
 
   meta = with lib; {
diff --git a/pkgs/servers/http/pomerium/default.nix b/pkgs/servers/http/pomerium/default.nix
index 7b115d6d694a..31f9a7e59e0c 100644
--- a/pkgs/servers/http/pomerium/default.nix
+++ b/pkgs/servers/http/pomerium/default.nix
@@ -20,6 +20,9 @@ buildGoModule rec {
     "cmd/pomerium"
   ];
 
+  # patch pomerium to allow use of external envoy
+  patches = [ ./external-envoy.diff ];
+
   ldflags = let
     # Set a variety of useful meta variables for stamping the build with.
     setVars = {
@@ -29,7 +32,7 @@ buildGoModule rec {
         ProjectName = "pomerium";
         ProjectURL = "github.com/pomerium/pomerium";
       };
-      "github.com/pomerium/pomerium/internal/envoy" = {
+      "github.com/pomerium/pomerium/pkg/envoy" = {
         OverrideEnvoyPath = "${envoy}/bin/envoy";
       };
     };
@@ -49,8 +52,8 @@ buildGoModule rec {
     # Replace embedded envoy with nothing.
     # We set OverrideEnvoyPath above, so rawBinary should never get looked at
     # but we still need to set a checksum/version.
-    rm internal/envoy/files/files_{darwin,linux}*.go
-    cat <<EOF >internal/envoy/files/files_generic.go
+    rm pkg/envoy/files/files_{darwin,linux}*.go
+    cat <<EOF >pkg/envoy/files/files_external.go
     package files
 
     import _ "embed" // embed
@@ -63,8 +66,8 @@ buildGoModule rec {
     //go:embed envoy.version
     var rawVersion string
     EOF
-    sha256sum '${envoy}/bin/envoy' > internal/envoy/files/envoy.sha256
-    echo '${envoy.version}' > internal/envoy/files/envoy.version
+    sha256sum '${envoy}/bin/envoy' > pkg/envoy/files/envoy.sha256
+    echo '${envoy.version}' > pkg/envoy/files/envoy.version
 
     # put the built UI files where they will be picked up as part of binary build
     cp -r ${pomerium-ui} ui
diff --git a/pkgs/servers/http/pomerium/external-envoy.diff b/pkgs/servers/http/pomerium/external-envoy.diff
new file mode 100644
index 000000000000..49f4985ad77c
--- /dev/null
+++ b/pkgs/servers/http/pomerium/external-envoy.diff
@@ -0,0 +1,48 @@
+diff --git a/pkg/envoy/envoy.go b/pkg/envoy/envoy.go
+index e32cfc29..9d32c057 100644
+--- a/pkg/envoy/envoy.go
++++ b/pkg/envoy/envoy.go
+@@ -8,9 +8,9 @@ import (
+ 	"errors"
+ 	"fmt"
+ 	"io"
++	"io/fs"
+ 	"os"
+ 	"os/exec"
+-	"path"
+ 	"path/filepath"
+ 	"regexp"
+ 	"strconv"
+@@ -36,8 +36,12 @@ import (
+ 
+ const (
+ 	configFileName = "envoy-config.yaml"
++	workingDirectoryName = ".pomerium-envoy"
++	embeddedEnvoyPermissions     fs.FileMode = 0o700
+ )
+ 
++var OverrideEnvoyPath = ""
++
+ type serverOptions struct {
+ 	services string
+ 	logLevel string
+@@ -60,13 +64,16 @@ type Server struct {
+ 
+ // NewServer creates a new server with traffic routed by envoy.
+ func NewServer(ctx context.Context, src config.Source, builder *envoyconfig.Builder) (*Server, error) {
+-	envoyPath, err := Extract()
++	envoyPath := OverrideEnvoyPath
++	wd := filepath.Join(os.TempDir(), workingDirectoryName)
++
++	err := os.MkdirAll(wd, embeddedEnvoyPermissions)
+ 	if err != nil {
+-		return nil, fmt.Errorf("extracting envoy: %w", err)
++		return nil, fmt.Errorf("error creating temporary working directory for envoy: %w", err)
+ 	}
+ 
+ 	srv := &Server{
+-		wd:        path.Dir(envoyPath),
++		wd:        wd,
+ 		builder:   builder,
+ 		grpcPort:  src.GetConfig().GRPCPort,
+ 		httpPort:  src.GetConfig().HTTPPort,

From b900ad154bed259755cfac10aa182937c12c6c2a Mon Sep 17 00:00:00 2001
From: Morgan Helton <mhelton@gmail.com>
Date: Tue, 23 Aug 2022 20:08:41 -0500
Subject: [PATCH 04/21] pomerium-cli: 0.17.1 -> 0.18.0

---
 pkgs/tools/security/pomerium-cli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/pomerium-cli/default.nix b/pkgs/tools/security/pomerium-cli/default.nix
index 9463e0851898..3731aed4e663 100644
--- a/pkgs/tools/security/pomerium-cli/default.nix
+++ b/pkgs/tools/security/pomerium-cli/default.nix
@@ -15,10 +15,10 @@ buildGoModule rec {
     owner = "pomerium";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-AZeBtHy2MEPE8uZVJv4wLdOt6f9QNbaQnP5a2YVYYAg=";
+    sha256 = "sha256-P1aEAr+Q2wnKLq3JHQbss6SPdrYnzE8J2yp/Lu5Cg/0=";
   };
 
-  vendorSha256 = "sha256-K0Vdsl6wD0eJeJRsUjiNPuGx1KPkZrlCCzdyAysVonc=";
+  vendorSha256 = "sha256-AAdhFpFCbUU3kjVQ84sYWYrGBWD5u6f219MvVS0j9Oo=";
 
   subPackages = [
     "cmd/pomerium-cli"

From 7f6ab2ddbc08de30f1e5a3b7644a5523daf51554 Mon Sep 17 00:00:00 2001
From: Luke Granger-Brown <git@lukegb.com>
Date: Sun, 4 Sep 2022 22:10:23 +0100
Subject: [PATCH 05/21] pomerium-cli: detach from pomerium versioning

---
 pkgs/tools/security/pomerium-cli/default.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/tools/security/pomerium-cli/default.nix b/pkgs/tools/security/pomerium-cli/default.nix
index 3731aed4e663..cded5b83643a 100644
--- a/pkgs/tools/security/pomerium-cli/default.nix
+++ b/pkgs/tools/security/pomerium-cli/default.nix
@@ -1,7 +1,6 @@
 { buildGoModule
 , fetchFromGitHub
 , lib
-, pomerium
 }:
 
 let
@@ -9,7 +8,7 @@ let
 in
 buildGoModule rec {
   pname = "pomerium-cli";
-  inherit (pomerium) version;
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "pomerium";

From 16215285cd14ee42f1764d93a22bde764b216e7d Mon Sep 17 00:00:00 2001
From: Luke Granger-Brown <git@lukegb.com>
Date: Sun, 4 Sep 2022 22:20:47 +0100
Subject: [PATCH 06/21] envoy: 1.21.5 -> 1.23.1

---
 pkgs/servers/http/envoy/default.nix           | 46 +++++++++------
 .../http/envoy/use-system-python.patch        | 58 +++++++++++++++++++
 2 files changed, 85 insertions(+), 19 deletions(-)
 create mode 100644 pkgs/servers/http/envoy/use-system-python.patch

diff --git a/pkgs/servers/http/envoy/default.nix b/pkgs/servers/http/envoy/default.nix
index 9bcf573d06c4..b9342ccd4fac 100644
--- a/pkgs/servers/http/envoy/default.nix
+++ b/pkgs/servers/http/envoy/default.nix
@@ -1,14 +1,14 @@
 { lib
-, bazel_4
+, bazel_5
 , buildBazelPackage
 , fetchFromGitHub
-, fetchpatch
 , stdenv
 , cmake
 , gn
 , go
 , jdk
 , ninja
+, patchelf
 , python3
 , linuxHeaders
 , nixosTests
@@ -23,19 +23,19 @@ let
     # However, the version string is more useful for end-users.
     # These are contained in a attrset of their own to make it obvious that
     # people should update both.
-    version = "1.21.5";
-    rev = "0512f18b764828497febd0f6dcecc1861003d614";
+    version = "1.23.1";
+    rev = "edd69583372955fdfa0b8ca3820dd7312c094e46";
   };
 in
 buildBazelPackage rec {
   pname = "envoy";
   inherit (srcVer) version;
-  bazel = bazel_4;
+  bazel = bazel_5;
   src = fetchFromGitHub {
     owner = "envoyproxy";
     repo = "envoy";
     inherit (srcVer) rev;
-    sha256 = "sha256-VWcfdoZ1wGkxaf0PZwfiSFg8D/QDIZs4u/iLUnsbjMo=";
+    sha256 = "sha256:157dbmp479xv5507n48yibvlgi2ac0l3sl9rzm28cm9lhzwva3k0";
 
     postFetch = ''
       chmod -R +w $out
@@ -48,26 +48,21 @@ buildBazelPackage rec {
   postPatch = ''
     sed -i 's,#!/usr/bin/env python3,#!${python3}/bin/python,' bazel/foreign_cc/luajit.patch
     sed -i '/javabase=/d' .bazelrc
-    # Patch paths to build tools, and disable gold because it just segfaults.
-    substituteInPlace bazel/external/wee8.genrule_cmd \
-      --replace '"''$$gn"' '"''$$(command -v gn)"' \
-      --replace '"''$$ninja"' '"''$$(command -v ninja)"' \
-      --replace '"''$$WEE8_BUILD_ARGS"' '"''$$WEE8_BUILD_ARGS use_gold=false"'
+
+    # Use system Python.
+    sed -i -e '/python_interpreter_target =/d' -e '/@python3_10/d' bazel/python_dependencies.bzl
   '';
 
   patches = [
-    # make linux/tcp.h relative. drop when upgrading to >1.21
-    (fetchpatch {
-      url = "https://github.com/envoyproxy/envoy/commit/68448aae7a78a3123097b6ea96016b270457e7b8.patch";
-      sha256 = "123kv3x37p8fgfp29jhw5xg5js5q5ipibs8hsm7gzfd5bcllnpfh";
-    })
-
     # fix issues with brotli and GCC 11.2.0+ (-Werror=vla-parameter)
     ./bump-brotli.patch
 
     # fix linux-aarch64 WAMR builds
     # (upstream WAMR only detects aarch64 on Darwin, not Linux)
     ./fix-aarch64-wamr.patch
+
+    # use system Python, not bazel-fetched binary Python
+    ./use-system-python.patch
   ];
 
   nativeBuildInputs = [
@@ -77,6 +72,7 @@ buildBazelPackage rec {
     go
     jdk
     ninja
+    patchelf
   ];
 
   buildInputs = [
@@ -85,8 +81,8 @@ buildBazelPackage rec {
 
   fetchAttrs = {
     sha256 = {
-      x86_64-linux = "sha256-bE28PBQjsOLkxjIoDk6HcELPP3XzvqKKVa7yUbXB1Qk=";
-      aarch64-linux = "sha256-Rf7kEBeH72vsvmzKy/7oKQf8cVNVzIcSuXMhrIhMFKM=";
+      x86_64-linux = "0y3gpvx148bnn6kljdvkg99m681vw39l0avrhvncbf62hvpifqkw";
+      aarch64-linux = "0lln5mdlskahz5hb4w268ys2ksy3051drrwlhracmk4i7rpm7fq3";
     }.${stdenv.system} or (throw "unsupported system ${stdenv.system}");
     dontUseCmakeConfigure = true;
     dontUseGnConfigure = true;
@@ -95,6 +91,12 @@ buildBazelPackage rec {
       find $bazelOut/external -name requirements.bzl | while read requirements; do
         sed -i '/# Generated from /d' "$requirements"
       done
+      find $bazelOut/external -type f -executable | while read execbin; do
+        file "$execbin" | grep -q ': ELF .*, dynamically linked,' || continue
+        patchelf \
+          --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) \
+          "$execbin"
+      done
 
       # Remove references to paths in the Nix store.
       sed -i \
@@ -138,6 +140,12 @@ buildBazelPackage rec {
     "--cxxopt=-Wno-maybe-uninitialized"
     "--cxxopt=-Wno-uninitialized"
     "--cxxopt=-Wno-error=type-limits"
+    "--cxxopt=-Wno-error=range-loop-construct"
+
+    # Force use of system Java.
+    "--extra_toolchains=@local_jdk//:all"
+    "--java_runtime_version=local_jdk"
+    "--tool_java_runtime_version=local_jdk"
 
     "--define=wasm=${wasmRuntime}"
   ];
diff --git a/pkgs/servers/http/envoy/use-system-python.patch b/pkgs/servers/http/envoy/use-system-python.patch
new file mode 100644
index 000000000000..a2030cc75fd0
--- /dev/null
+++ b/pkgs/servers/http/envoy/use-system-python.patch
@@ -0,0 +1,58 @@
+diff --git a/bazel/python_dependencies.bzl b/bazel/python_dependencies.bzl
+index d9dfb14a9b..b8e92452a7 100644
+--- a/bazel/python_dependencies.bzl
++++ b/bazel/python_dependencies.bzl
+@@ -1,10 +1,8 @@
+ load("@rules_python//python:pip.bzl", "pip_install", "pip_parse")
+-load("@python3_10//:defs.bzl", "interpreter")
+ 
+ def envoy_python_dependencies():
+     pip_parse(
+         name = "base_pip3",
+-        python_interpreter_target = interpreter,
+         requirements_lock = "@envoy//tools/base:requirements.txt",
+         extra_pip_args = ["--require-hashes"],
+     )
+@@ -12,14 +10,12 @@ def envoy_python_dependencies():
+     # These need to use `pip_install`
+     pip_install(
+         # Note: dev requirements do *not* check hashes
+-        python_interpreter_target = interpreter,
+         name = "dev_pip3",
+         requirements = "@envoy//tools/dev:requirements.txt",
+     )
+ 
+     pip_install(
+         name = "fuzzing_pip3",
+-        python_interpreter_target = interpreter,
+         requirements = "@rules_fuzzing//fuzzing:requirements.txt",
+         extra_pip_args = ["--require-hashes"],
+     )
+diff --git a/bazel/repositories_extra.bzl b/bazel/repositories_extra.bzl
+index 885b41dec6..ac5605eb30 100644
+--- a/bazel/repositories_extra.bzl
++++ b/bazel/repositories_extra.bzl
+@@ -1,22 +1,12 @@
+ load("@emsdk//:deps.bzl", emsdk_deps = "deps")
+-load("@rules_python//python:repositories.bzl", "python_register_toolchains")
+ load("@proxy_wasm_cpp_host//bazel/cargo/wasmtime:crates.bzl", "wasmtime_fetch_remote_crates")
+ load("//bazel/external/cargo:crates.bzl", "raze_fetch_remote_crates")
+ load("@aspect_bazel_lib//lib:repositories.bzl", "aspect_bazel_lib_dependencies")
+ 
+-# Python version for `rules_python`
+-PYTHON_VERSION = "3.10.2"
+-
+ # Envoy deps that rely on a first stage of dependency loading in envoy_dependencies().
+-def envoy_dependencies_extra(python_version = PYTHON_VERSION):
++def envoy_dependencies_extra():
+     emsdk_deps()
+     raze_fetch_remote_crates()
+     wasmtime_fetch_remote_crates()
+ 
+-    # Registers underscored Python minor version - eg `python3_10`
+-    python_register_toolchains(
+-        name = "python%s" % ("_".join(python_version.split(".")[:-1])),
+-        python_version = python_version,
+-    )
+-
+     aspect_bazel_lib_dependencies()

From 2ded6702dcccfdf9c42d0cefa1fb2e15fd0e0676 Mon Sep 17 00:00:00 2001
From: Luke Granger-Brown <git@lukegb.com>
Date: Sun, 4 Sep 2022 22:20:58 +0100
Subject: [PATCH 07/21] pomerium: 0.18.0 -> 0.19.0

---
 pkgs/servers/http/pomerium/common.nix               | 12 +++++-------
 pkgs/servers/http/pomerium/pomerium-ui-package.json |  1 +
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkgs/servers/http/pomerium/common.nix b/pkgs/servers/http/pomerium/common.nix
index d7a0814f1315..24071eb5044d 100644
--- a/pkgs/servers/http/pomerium/common.nix
+++ b/pkgs/servers/http/pomerium/common.nix
@@ -1,14 +1,12 @@
 { fetchFromGitHub
 , lib
 }:
-let
-  version = "0.18.0";
-  srcSha256 = "sha256-sM4kM8CqbZjl+RIsezWYVCmjoDKfGl+EQcdEaPKvVHs=";
-  vendorSha256 = "sha256-1EWcjfrO3FEypUUKwNwDisogERCuKOvtC7z0mC2JZn4=";
-  yarnSha256 = "sha256-Uh0y2Zmy6bSoyL5WMTce01hoH7EvSIniHyIBMxfMvhg=";
-in
+
 {
-  inherit version vendorSha256 yarnSha256;
+  version = "0.19.0";
+  srcSha256 = "sha256:0s5ji1iywymzxlv89y3ivl5vngkifhbpidpwxdrh969l3c5r4klf";
+  vendorSha256 = "sha256:1p78nb7bryvs7p5iq6ihylflyjia60x4hd9c62ffwz37dwqlbi33";
+  yarnSha256 = "sha256:1n6swanrds9hbd4yyfjzpnfhsb8fzj1pwvvcg3w7b1cgnihclrmv";
 
   src = fetchFromGitHub {
     owner = "pomerium";
diff --git a/pkgs/servers/http/pomerium/pomerium-ui-package.json b/pkgs/servers/http/pomerium/pomerium-ui-package.json
index 12f39ead62a9..6b9dcf4a3e8d 100644
--- a/pkgs/servers/http/pomerium/pomerium-ui-package.json
+++ b/pkgs/servers/http/pomerium/pomerium-ui-package.json
@@ -30,6 +30,7 @@
     "@mui/icons-material": "^5.3.1",
     "@mui/material": "^5.4.0",
     "luxon": "^2.3.0",
+    "markdown-to-jsx": "^7.1.7",
     "react": "^17.0.2",
     "react-dom": "^17.0.2",
     "react-feather": "^2.0.9"

From ff65a9cf26447b21d4c2d868a6cd15859bbc1d5b Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Mon, 5 Sep 2022 11:03:13 +0300
Subject: [PATCH 08/21] =?UTF-8?q?gpxsee:=2011.3=20=E2=86=92=2011.4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/applications/misc/gpxsee/default.nix | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/gpxsee/default.nix b/pkgs/applications/misc/gpxsee/default.nix
index 0fbfbcba3139..8f7ab1e5f9e0 100644
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@@ -1,14 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, qmake, qttools, qttranslations, qtlocation, qtpbfimageplugin, wrapQtAppsHook, substituteAll }:
+{ lib, stdenv, fetchFromGitHub, nix-update-script, substituteAll
+, qmake, qttools, qttranslations, qtlocation, qtpbfimageplugin, wrapQtAppsHook
+}:
 
 stdenv.mkDerivation rec {
   pname = "gpxsee";
-  version = "11.3";
+  version = "11.4";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "sha256-n8busir6IYyWyGOv9AzYjm8erR0fjMAduIzITH+EvVI=";
+    hash = "sha256-aePX82B810I45n2t0OVCt1FlmkVKWgNgzCD71lYyngU=";
   };
 
   patches = (substituteAll {
@@ -30,6 +32,12 @@ stdenv.mkDerivation rec {
     mv GPXSee.app $out/Applications
   '';
 
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = pname;
+    };
+  };
+
   meta = with lib; {
     description = "GPS log file viewer and analyzer";
     longDescription = ''

From c81163c9167890f3b8074c5cef13c94a9066b719 Mon Sep 17 00:00:00 2001
From: Zane van Iperen <zane@zanevaniperen.com>
Date: Sat, 26 Feb 2022 14:00:14 +1000
Subject: [PATCH 09/21] python3Packages.assay: init at unstable-2022-01-19

---
 .../python-modules/assay/default.nix          | 22 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 24 insertions(+)
 create mode 100644 pkgs/development/python-modules/assay/default.nix

diff --git a/pkgs/development/python-modules/assay/default.nix b/pkgs/development/python-modules/assay/default.nix
new file mode 100644
index 000000000000..b019e24579ce
--- /dev/null
+++ b/pkgs/development/python-modules/assay/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildPythonPackage, fetchFromGitHub }:
+
+buildPythonPackage rec {
+  pname = "assay";
+  version = "unstable-2022-01-19";
+
+  src = fetchFromGitHub {
+    owner = "brandon-rhodes";
+    repo = pname;
+    rev = "bb62d1f7d51d798b05a88045fff3a2ff92c299c3";
+    sha256 = "sha256-FuAD74mFJ9F9AMgB3vPmODAlZKgPR7FQ4yn7HEBS5Rw=";
+  };
+
+  pythonImportsCheck = [ "assay" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/brandon-rhodes/assay";
+    description = "Attempt to write a Python testing framework I can actually stand";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zane ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 637f9640bd57..1139281043ac 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -754,6 +754,8 @@ in {
 
   aspy-yaml = callPackage ../development/python-modules/aspy.yaml { };
 
+  assay = callPackage ../development/python-modules/assay { };
+
   assertpy = callPackage ../development/python-modules/assertpy { };
 
   asterisk-mbox = callPackage ../development/python-modules/asterisk-mbox { };

From a217911800a8cf3351a8e309734800a7fde3dfcf Mon Sep 17 00:00:00 2001
From: Zane van Iperen <zane@zanevaniperen.com>
Date: Sat, 26 Feb 2022 14:09:39 +1000
Subject: [PATCH 10/21] python3Packages.jplephem: init at 2.17

---
 .../python-modules/jplephem/default.nix       | 28 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 30 insertions(+)
 create mode 100644 pkgs/development/python-modules/jplephem/default.nix

diff --git a/pkgs/development/python-modules/jplephem/default.nix b/pkgs/development/python-modules/jplephem/default.nix
new file mode 100644
index 000000000000..a55c1ed15ee5
--- /dev/null
+++ b/pkgs/development/python-modules/jplephem/default.nix
@@ -0,0 +1,28 @@
+{ lib, buildPythonPackage, fetchPypi, numpy, pytestCheckHook }:
+
+buildPythonPackage rec {
+  pname = "jplephem";
+  version = "2.17";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-4cblVlxNAEhfEGMkG00e/wRFhcIrjpf60P8vbvuKqic=";
+  };
+
+  propagatedBuildInputs = [ numpy ];
+
+  # Weird import error, only happens in testing:
+  #   File "/build/jplephem-2.17/jplephem/daf.py", line 10, in <module>
+  #     from numpy import array as numpy_array, ndarray
+  # ImportError: cannot import name 'array' from 'sys' (unknown location)
+  doCheck = false;
+
+  pythonImportsCheck = [ "jplephem" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/brandon-rhodes/python-jplephem/";
+    description = "Python version of NASA DE4xx ephemerides, the basis for the Astronomical Alamanac";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zane ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1139281043ac..eb6348aef7fa 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4724,6 +4724,8 @@ in {
     inherit (self) systemd pytest;
   };
 
+  jplephem = callPackage ../development/python-modules/jplephem { };
+
   jproperties = callPackage ../development/python-modules/jproperties { };
 
   jpylyzer = callPackage ../development/python-modules/jpylyzer { };

From 76a5da1aae019e6c7ba0aebda09288bd2af20b50 Mon Sep 17 00:00:00 2001
From: Zane van Iperen <zane@zanevaniperen.com>
Date: Sat, 26 Feb 2022 14:11:05 +1000
Subject: [PATCH 11/21] python3Packages.sgp4: init at 2.21

---
 .../python-modules/sgp4/default.nix           | 22 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 ++
 2 files changed, 24 insertions(+)
 create mode 100644 pkgs/development/python-modules/sgp4/default.nix

diff --git a/pkgs/development/python-modules/sgp4/default.nix b/pkgs/development/python-modules/sgp4/default.nix
new file mode 100644
index 000000000000..1b8ecc0b46ba
--- /dev/null
+++ b/pkgs/development/python-modules/sgp4/default.nix
@@ -0,0 +1,22 @@
+{ lib, buildPythonPackage, fetchPypi, tox, numpy }:
+
+buildPythonPackage rec {
+  pname = "sgp4";
+  version = "2.21";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-YXm4dQRId+lBYzwgr3ci/SMaiNiomvAb8wvWTzPN7O8=";
+  };
+
+  checkInputs = [ tox numpy ];
+
+  pythonImportsCheck = [ "sgp4" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/brandon-rhodes/python-sgp4";
+    description = "Python version of the SGP4 satellite position library";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zane ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index eb6348aef7fa..227cd1d6a7e3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9958,6 +9958,8 @@ in {
 
   sgmllib3k = callPackage ../development/python-modules/sgmllib3k { };
 
+  sgp4 = callPackage ../development/python-modules/sgp4 { };
+
   shamir-mnemonic = callPackage ../development/python-modules/shamir-mnemonic { };
 
   shap = callPackage ../development/python-modules/shap { };

From b915c914827a11996a0673339611a77ae0d333b7 Mon Sep 17 00:00:00 2001
From: Zane van Iperen <zane@zanevaniperen.com>
Date: Mon, 28 Feb 2022 13:57:20 +1000
Subject: [PATCH 12/21] python3Packages.skyfield: init at 1.42

Pull from GitHub instead of Pypi because of unit testing files.
---
 .../python-modules/skyfield/default.nix       | 37 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/development/python-modules/skyfield/default.nix

diff --git a/pkgs/development/python-modules/skyfield/default.nix b/pkgs/development/python-modules/skyfield/default.nix
new file mode 100644
index 000000000000..c6b3c69fc3e9
--- /dev/null
+++ b/pkgs/development/python-modules/skyfield/default.nix
@@ -0,0 +1,37 @@
+{ lib, buildPythonPackage, fetchFromGitHub, certifi, numpy, sgp4, jplephem
+, pandas, ipython, matplotlib, assay
+}:
+
+buildPythonPackage rec {
+  pname = "skyfield";
+  version = "1.42";
+
+  src = fetchFromGitHub {
+    owner = "skyfielders";
+    repo = "python-skyfield";
+    rev = version;
+    sha256 = "sha256-aoSkuLhZcEy+13EJQOBHV2/rgmN6aZQHqfj4OOirOG0=";
+  };
+
+  propagatedBuildInputs = [ certifi numpy sgp4 jplephem ];
+
+  checkInputs = [ pandas ipython matplotlib assay ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    cd ci
+    assay --batch skyfield.tests
+
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [ "skyfield" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/skyfielders/python-skyfield";
+    description = "Elegant astronomy for Python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zane ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 227cd1d6a7e3..0ec9b96d844c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10070,6 +10070,8 @@ in {
 
   skybellpy = callPackage ../development/python-modules/skybellpy { };
 
+  skyfield = callPackage ../development/python-modules/skyfield { };
+
   skytemple-dtef = callPackage ../development/python-modules/skytemple-dtef { };
 
   skytemple-eventserver = callPackage ../development/python-modules/skytemple-eventserver { };

From 0b16c98205c02df91ab72d687a66927f34e3a7aa Mon Sep 17 00:00:00 2001
From: Morgan Helton <mhelton@gmail.com>
Date: Mon, 5 Sep 2022 14:28:23 -0500
Subject: [PATCH 13/21] pomerium: consolidate ui and base package

---
 pkgs/servers/http/pomerium/common.nix  | 25 -------------
 pkgs/servers/http/pomerium/default.nix | 50 +++++++++++++++++++++++---
 pkgs/servers/http/pomerium/ui.nix      | 38 --------------------
 pkgs/top-level/all-packages.nix        |  4 +--
 4 files changed, 47 insertions(+), 70 deletions(-)
 delete mode 100644 pkgs/servers/http/pomerium/common.nix
 delete mode 100644 pkgs/servers/http/pomerium/ui.nix

diff --git a/pkgs/servers/http/pomerium/common.nix b/pkgs/servers/http/pomerium/common.nix
deleted file mode 100644
index 24071eb5044d..000000000000
--- a/pkgs/servers/http/pomerium/common.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{ fetchFromGitHub
-, lib
-}:
-
-{
-  version = "0.19.0";
-  srcSha256 = "sha256:0s5ji1iywymzxlv89y3ivl5vngkifhbpidpwxdrh969l3c5r4klf";
-  vendorSha256 = "sha256:1p78nb7bryvs7p5iq6ihylflyjia60x4hd9c62ffwz37dwqlbi33";
-  yarnSha256 = "sha256:1n6swanrds9hbd4yyfjzpnfhsb8fzj1pwvvcg3w7b1cgnihclrmv";
-
-  src = fetchFromGitHub {
-    owner = "pomerium";
-    repo = "pomerium";
-    rev = "v${version}";
-    sha256 = srcSha256;
-  };
-
-  meta = with lib; {
-    homepage = "https://pomerium.io";
-    description = "Authenticating reverse proxy";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ lukegb ];
-    platforms = [ "x86_64-linux" "aarch64-linux" ];
-  };
-}
diff --git a/pkgs/servers/http/pomerium/default.nix b/pkgs/servers/http/pomerium/default.nix
index 31f9a7e59e0c..42af2054caf2 100644
--- a/pkgs/servers/http/pomerium/default.nix
+++ b/pkgs/servers/http/pomerium/default.nix
@@ -3,18 +3,52 @@
 , callPackage
 , lib
 , envoy
+, mkYarnPackage
+, fetchYarnDeps
 , nixosTests
-, pomerium-ui
 , pomerium-cli
 }:
 
 let
   inherit (lib) concatStringsSep concatMap id mapAttrsToList;
-  common = callPackage ./common.nix { };
 in
 buildGoModule rec {
-  inherit (common) version src vendorSha256 meta;
   pname = "pomerium";
+  version = "0.19.0";
+  src = fetchFromGitHub {
+    owner = "pomerium";
+    repo = "pomerium";
+    rev = "v${version}";
+    sha256 = "sha256:0s5ji1iywymzxlv89y3ivl5vngkifhbpidpwxdrh969l3c5r4klf";
+  };
+
+  vendorSha256 = "sha256:1p78nb7bryvs7p5iq6ihylflyjia60x4hd9c62ffwz37dwqlbi33";
+
+  ui = mkYarnPackage {
+    inherit version;
+    src = "${src}/ui";
+
+    # update pomerium-ui-package.json when updating package, sourced from ui/package.json
+    packageJSON = ./pomerium-ui-package.json;
+    offlineCache = fetchYarnDeps {
+      yarnLock = "${src}/ui/yarn.lock";
+      sha256 = "sha256:1n6swanrds9hbd4yyfjzpnfhsb8fzj1pwvvcg3w7b1cgnihclrmv";
+    };
+
+    buildPhase = ''
+      runHook preBuild
+      yarn --offline build
+      runHook postbuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      cp -R deps/pomerium/dist $out
+      runHook postInstall
+    '';
+
+    doDist = false;
+  };
 
   subPackages = [
     "cmd/pomerium"
@@ -70,7 +104,7 @@ buildGoModule rec {
     echo '${envoy.version}' > pkg/envoy/files/envoy.version
 
     # put the built UI files where they will be picked up as part of binary build
-    cp -r ${pomerium-ui} ui
+    cp -r ${ui}/* ui/dist
   '';
 
   installPhase = ''
@@ -81,4 +115,12 @@ buildGoModule rec {
     inherit (nixosTests) pomerium;
     inherit pomerium-cli;
   };
+
+  meta = with lib; {
+    homepage = "https://pomerium.io";
+    description = "Authenticating reverse proxy";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ lukegb ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
+  };
 }
diff --git a/pkgs/servers/http/pomerium/ui.nix b/pkgs/servers/http/pomerium/ui.nix
deleted file mode 100644
index f2a94814ca21..000000000000
--- a/pkgs/servers/http/pomerium/ui.nix
+++ /dev/null
@@ -1,38 +0,0 @@
-{ lib
-, callPackage
-, fetchFromGitHub
-, fetchYarnDeps
-, mkYarnPackage }:
-let
-  common = callPackage ./common.nix { };
-in
-mkYarnPackage {
-  inherit (common) version;
-  pname = "pomerium-ui";
-  src = "${common.src}/ui";
-
-  # update pomerium-ui-package.json when updating package, sourced from ui/package.json
-  packageJSON = ./pomerium-ui-package.json;
-  offlineCache = fetchYarnDeps {
-    yarnLock = "${common.src}/ui/yarn.lock";
-    sha256 = common.yarnSha256;
-  };
-
-  buildPhase = ''
-    runHook preBuild
-    yarn --offline build
-    runHook postbuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    cp -R deps/pomerium/dist $out
-    runHook postInstall
-  '';
-
-  doDist = false;
-
-  meta = common.meta // {
-    description = "Pomerium authenticating reverse proxy UI";
-  };
-}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e18c5dc1e98e..6f8786a40cf4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -22892,9 +22892,7 @@ with pkgs;
   };
   pflogsumm = callPackage ../servers/mail/postfix/pflogsumm.nix { };
 
-  pomerium = callPackage ../servers/http/pomerium {
-    pomerium-ui = callPackage ../servers/http/pomerium/ui.nix { };
-  };
+  pomerium = callPackage ../servers/http/pomerium { };
   pomerium-cli = callPackage ../tools/security/pomerium-cli { };
 
   postgrey = callPackage ../servers/mail/postgrey { };

From 40788fb997b792215d8a2c975ba2adb7f10d446a Mon Sep 17 00:00:00 2001
From: Enno Richter <enno@nerdworks.de>
Date: Sat, 26 Mar 2022 07:21:25 +0100
Subject: [PATCH 14/21] ksmbd-tools: init at 3.4.5

---
 .../os-specific/linux/ksmbd-tools/default.nix | 40 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 42 insertions(+)
 create mode 100644 pkgs/os-specific/linux/ksmbd-tools/default.nix

diff --git a/pkgs/os-specific/linux/ksmbd-tools/default.nix b/pkgs/os-specific/linux/ksmbd-tools/default.nix
new file mode 100644
index 000000000000..d0a1f1f4e684
--- /dev/null
+++ b/pkgs/os-specific/linux/ksmbd-tools/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoconf
+, automake
+, glib
+, libkrb5
+, libnl
+, libtool
+, pkg-config
+, withKerberos ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ksmbd-tools";
+  version = "3.4.5";
+
+  src = fetchFromGitHub {
+    owner = "cifsd-team";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-sSCLXNdVUAdk+GnFlVx/BsAzyfz0KDdugJ1isrOztgs=";
+  };
+
+  buildInputs = [ glib libnl ] ++ lib.optional withKerberos libkrb5;
+
+  nativeBuildInputs = [ autoconf automake libtool pkg-config ];
+
+  preConfigure = "./autogen.sh";
+
+  configureFlags = lib.optional withKerberos "--enable-krb5";
+
+  meta = with lib; {
+    description = "Userspace utilities for the ksmbd kernel SMB server";
+    homepage = "https://www.kernel.org/doc/html/latest/filesystems/cifs/ksmbd.html";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ elohmeier ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c17bc68750d4..c54f354a4e1b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1301,6 +1301,8 @@ with pkgs;
 
   kanata-with-cmd = callPackage ../tools/system/kanata { withCmd = true; };
 
+  ksmbd-tools = callPackage ../os-specific/linux/ksmbd-tools { };
+
   ksnip = libsForQt5.callPackage ../tools/misc/ksnip { };
 
   kubevirt = callPackage ../tools/virtualization/kubevirt { };

From 509541c7a735db6346da0f75eda9e7870c078ecc Mon Sep 17 00:00:00 2001
From: Ryan Horiguchi <ryan.horiguchi@gmail.com>
Date: Thu, 11 Aug 2022 20:33:17 +0200
Subject: [PATCH 15/21] tautulli: 2.10.2 -> 2.10.4

---
 pkgs/servers/tautulli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/tautulli/default.nix b/pkgs/servers/tautulli/default.nix
index ceb8582a6868..f02b0f7e92e6 100644
--- a/pkgs/servers/tautulli/default.nix
+++ b/pkgs/servers/tautulli/default.nix
@@ -2,7 +2,7 @@
 
 buildPythonApplication rec {
   pname = "Tautulli";
-  version = "2.10.2";
+  version = "2.10.4";
   format = "other";
 
   pythonPath = [ setuptools ];
@@ -12,7 +12,7 @@ buildPythonApplication rec {
     owner = "Tautulli";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-nEiyYpj5J95tQAFcyRlaF5VEfosCkk4cmdYKLjfeA98=";
+    sha256 = "sha256-G7rKPDozo5IyYOqfhoZcn1obASzJx8PpQt53CCmDZek=";
   };
 
   installPhase = ''

From 20f50c5f55ceb219ab50bdc305257efc8c02f68d Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Mon, 5 Sep 2022 23:35:35 +0200
Subject: [PATCH 16/21] python310Packages.cairo-lang: 0.9.1 -> 0.10.0

---
 pkgs/development/python-modules/cairo-lang/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cairo-lang/default.nix b/pkgs/development/python-modules/cairo-lang/default.nix
index de2b0253e1b5..00a9361c27f8 100644
--- a/pkgs/development/python-modules/cairo-lang/default.nix
+++ b/pkgs/development/python-modules/cairo-lang/default.nix
@@ -29,11 +29,11 @@
 
 buildPythonPackage rec {
   pname = "cairo-lang";
-  version = "0.9.1";
+  version = "0.10.0";
 
   src = fetchzip {
     url = "https://github.com/starkware-libs/cairo-lang/releases/download/v${version}/cairo-lang-${version}.zip";
-    sha256 = "sha256-i4030QLG6PssfKD5FO4VrZxap19obMZ3Aa77p5MXlNY=";
+    sha256 = "sha256-+PE7RSKEGADbue63FoT6UBOwURJs7lBNkL7aNlpSxP8=";
   };
 
   # TODO: remove a substantial part when https://github.com/starkware-libs/cairo-lang/pull/88/files is merged.

From 2e88e9b4d6706310ad03c11c09a3c4ad72b02f41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 6 Sep 2022 01:03:11 +0200
Subject: [PATCH 17/21] wezterm: 20220903-194523-3bb1ed61 ->
 20220905-102802-7d4b8249

---
 pkgs/applications/terminal-emulators/wezterm/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/terminal-emulators/wezterm/default.nix b/pkgs/applications/terminal-emulators/wezterm/default.nix
index 0342b6817c66..ebf7883e3657 100644
--- a/pkgs/applications/terminal-emulators/wezterm/default.nix
+++ b/pkgs/applications/terminal-emulators/wezterm/default.nix
@@ -29,14 +29,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wezterm";
-  version = "20220903-194523-3bb1ed61";
+  version = "20220905-102802-7d4b8249";
 
   src = fetchFromGitHub {
     owner = "wez";
     repo = pname;
     rev = version;
     fetchSubmodules = true;
-    sha256 = "sha256-R5DFBO6U1hVDCjvvNF2nDoldl+mzkrjaXR5rIPCosmM=";
+    sha256 = "sha256-Xvi0bluLM4F3BFefIPhkhTF3dmRvP8u+qV70Rz4CGKI=";
   };
 
   postPatch = ''
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage rec {
     rm -r wezterm-ssh/tests
   '';
 
-  cargoSha256 = "sha256-x2n8ti9zk+h2MrwDg/FgRWTQJmCAckxE2fOHgrWdayA=";
+  cargoSha256 = "sha256-XJAeMDwtLtBzHMU/cb3lZgmcw5F3ifjKzKVmuP85/RY=";
 
   nativeBuildInputs = [
     pkg-config

From bfe73f95430a71daf1d2fdf1ae6832f2a4db0f35 Mon Sep 17 00:00:00 2001
From: Pierre Bourdon <delroth@gmail.com>
Date: Tue, 6 Sep 2022 02:10:47 +0200
Subject: [PATCH 18/21] nixos/grafana: loosen systemd syscall sandboxing

Allow @resources syscalls in the grafana.service unit. While Grafana
itself does not need them, some plugins (incl. first party) crash if
they fail to setrlimit. This was first seen with the official grafana
Clickhouse datasource plugin.

The @resources syscalls set is fairly harmess anyway.
---
 nixos/modules/services/monitoring/grafana.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index d72aaf0464ed..dd99fa3ddccd 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -792,7 +792,7 @@ in {
         SystemCallArchitectures = "native";
         # Upstream grafana is not setting SystemCallFilter for compatibility
         # reasons, see https://github.com/grafana/grafana/pull/40176
-        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
         UMask = "0027";
       };
       preStart = ''

From 78f2923e5c319ffcf73eb22ffd245a566b8bd2d3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 6 Sep 2022 04:47:35 +0000
Subject: [PATCH 19/21] python310Packages.niapy: 2.0.2 -> 2.0.3

---
 pkgs/development/python-modules/niapy/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/niapy/default.nix b/pkgs/development/python-modules/niapy/default.nix
index b83091cc1dad..867c7969e545 100644
--- a/pkgs/development/python-modules/niapy/default.nix
+++ b/pkgs/development/python-modules/niapy/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "niapy";
-  version = "2.0.2";
+  version = "2.0.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "NiaOrg";
     repo = "NiaPy";
-    rev = version;
-    hash = "sha256-b/0TEO27fPuoPzkNBCwgUqBG+8htOR2ipFikpqjYdnM=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-h3bCitNFjw2WQtsQFR25VJlNVMojdfik+lrPMKwp8Mw=";
   };
 
   propagatedBuildInputs = [

From aa192bd8976b6ad31fd61708e6fa24c6c8310c8c Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Tue, 6 Sep 2022 01:52:49 -0700
Subject: [PATCH 20/21] hashcat: 6.2.5 -> 6.2.6 (#189921)

---
 pkgs/tools/security/hashcat/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/hashcat/default.nix b/pkgs/tools/security/hashcat/default.nix
index ed06ee992e4a..ec078d4695a8 100644
--- a/pkgs/tools/security/hashcat/default.nix
+++ b/pkgs/tools/security/hashcat/default.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname   = "hashcat";
-  version = "6.2.5";
+  version = "6.2.6";
 
   src = fetchurl {
     url = "https://hashcat.net/files/hashcat-${version}.tar.gz";
-    sha256 = "sha256-b2iZ162Jlln3tDpNaAmFQ6tUbSFx+OUdaR0Iplk3iWk=";
+    sha256 = "sha256-sl4Qd7zzSQjMjxjBppouyYsEeyy88PURRNzzuh4Leyo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From d98f8e3ca723d69a25bf65504345977da2b9c260 Mon Sep 17 00:00:00 2001
From: kilianar <mail@kilianar.de>
Date: Tue, 6 Sep 2022 11:04:57 +0200
Subject: [PATCH 21/21] syncthing: 1.20.4 -> 1.21.0

https://github.com/syncthing/syncthing/releases/tag/v1.21.0
---
 pkgs/applications/networking/syncthing/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/syncthing/default.nix b/pkgs/applications/networking/syncthing/default.nix
index 6fdc0e0d0051..e668b35d482f 100644
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@@ -4,16 +4,16 @@ let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
       pname = stname;
-      version = "1.20.4";
+      version = "1.21.0";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         rev = "v${version}";
-        hash = "sha256-umnlYvCtT+76Yer17T7ZvWJ5sUdXu+7kiRikrmWrIM8=";
+        hash = "sha256-Qgp9fo3yZabxsCFhn7U9B2AcVSUb9GCzm7B81HrI1jY=";
       };
 
-      vendorSha256 = "sha256-CJFKY69Iz8GrVpvUdDveMQQFj6RXApfgYjP7B1wfgfo=";
+      vendorSha256 = "sha256-rde7oyEZA8uGmkvz078Cu+aFrn9TuLTv0i7SW0ytyxU=";
 
       doCheck = false;