Merge master into haskell-updates

doc/builders/images.xml

@@ -11,4 +11,5 @@
  <xi:include href="images/snaptools.section.xml" />
  <xi:include href="images/portableservice.section.xml" />
  <xi:include href="images/makediskimage.section.xml" />
+ <xi:include href="images/binarycache.section.xml" />
 </chapter>

doc/builders/images/binarycache.section.md

@@ -0,0 +1,49 @@
+# pkgs.mkBinaryCache {#sec-pkgs-binary-cache}
+
+`pkgs.mkBinaryCache` is a function for creating Nix flat-file binary caches. Such a cache exists as a directory on disk, and can be used as a Nix substituter by passing `--substituter file:///path/to/cache` to Nix commands.
+
+Nix packages are most commonly shared between machines using [HTTP, SSH, or S3](https://nixos.org/manual/nix/stable/package-management/sharing-packages.html), but a flat-file binary cache can still be useful in some situations. For example, you can copy it directly to another machine, or make it available on a network file system. It can also be a convenient way to make some Nix packages available inside a container via bind-mounting.
+
+Note that this function is meant for advanced use-cases. The more idiomatic way to work with flat-file binary caches is via the [nix-copy-closure](https://nixos.org/manual/nix/stable/command-ref/nix-copy-closure.html) command. You may also want to consider [dockerTools](#sec-pkgs-dockerTools) for your containerization needs.
+
+## Example
+
+The following derivation will construct a flat-file binary cache containing the closure of `hello`.
+
+```nix
+mkBinaryCache {
+  rootPaths = [hello];
+}
+```
+
+- `rootPaths` specifies a list of root derivations. The transitive closure of these derivations' outputs will be copied into the cache.
+
+Here's an example of building and using the cache.
+
+Build the cache on one machine, `host1`:
+
+```shellSession
+nix-build -E 'with import <nixpkgs> {}; mkBinaryCache { rootPaths = [hello]; }'
+```
+
+```shellSession
+/nix/store/cc0562q828rnjqjyfj23d5q162gb424g-binary-cache
+```
+
+Copy the resulting directory to the other machine, `host2`:
+
+```shellSession
+scp result host2:/tmp/hello-cache
+```
+
+Substitute the derivation using the flat-file binary cache on the other machine, `host2`:
+```shellSession
+nix-build -A hello '<nixpkgs>' \
+  --option require-sigs false \
+  --option trusted-substituters file:///tmp/hello-cache \
+  --option substituters file:///tmp/hello-cache
+```
+
+```shellSession
+/nix/store/gl5a41azbpsadfkfmbilh9yk40dh5dl0-hello-2.12.1
+```

lib/options.nix

@@ -36,6 +36,9 @@ let
   inherit (lib.types)
     mkOptionType
     ;
+  prioritySuggestion = ''
+   Use `lib.mkForce value` or `lib.mkDefault value` to change the priority on any of these definitions.
+  '';
 in
 rec {
 
@@ -184,7 +187,7 @@ rec {
     if length defs == 1
     then (head defs).value
     else assert length defs > 1;
-      throw "The option `${showOption loc}' is defined multiple times.\n${message}\nDefinition values:${showDefs defs}";
+      throw "The option `${showOption loc}' is defined multiple times while it's expected to be unique.\n${message}\nDefinition values:${showDefs defs}\n${prioritySuggestion}";
 
   /* "Merge" option definitions by checking that they all have the same value. */
   mergeEqualOption = loc: defs:
@@ -195,7 +198,7 @@ rec {
     else if length defs == 1 then (head defs).value
     else (foldl' (first: def:
       if def.value != first.value then
-        throw "The option `${showOption loc}' has conflicting definition values:${showDefs [ first def ]}"
+        throw "The option `${showOption loc}' has conflicting definition values:${showDefs [ first def ]}\n${prioritySuggestion}"
       else
         first) (head defs) (tail defs)).value;
 

maintainers/maintainer-list.nix

@@ -5263,6 +5263,15 @@
     githubId = 313929;
     name = "Gabriel Ebner";
   };
+  genericnerdyusername = {
+    name = "GenericNerdyUsername";
+    email = "genericnerdyusername@proton.me";
+    github = "GenericNerdyUsername";
+    githubId = 111183546;
+    keys = [{
+      fingerprint = "58CE D4BE 6B10 149E DA80  A990 2F48 6356 A4CB 30F3";
+    }];
+  };
   genofire = {
     name = "genofire";
     email = "geno+dev@fireorbit.de";
@@ -14419,6 +14428,12 @@
     githubId = 139251;
     name = "Tom Hunger";
   };
+  tehmatt = {
+    name = "tehmatt";
+    email = "nix@programsareproofs.com";
+    github = "tehmatt";
+    githubId = 3358866;
+  };
   tejasag = {
     name = "Tejas Agarwal";
     email = "tejasagarwalbly@gmail.com";
@@ -16099,6 +16114,12 @@
     githubId = 2242427;
     name = "Yoann Ono";
   };
+  yajo = {
+    email = "yajo.sk8@gmail.com";
+    github = "yajo";
+    githubId = 973709;
+    name = "Jairo Llopis";
+  };
   yana = {
     email = "yana@riseup.net";
     github = "yanalunaterra";

nixos/modules/misc/ids.nix

@@ -510,6 +510,7 @@ in
       #seeks = 148; # removed 2020-06-21
       prosody = 149;
       i2pd = 150;
+      systemd-coredump = 151;
       systemd-network = 152;
       systemd-resolve = 153;
       systemd-timesync = 154;

nixos/modules/services/audio/ympd.nix

@@ -48,8 +48,46 @@ in {
 
     systemd.services.ympd = {
       description = "Standalone MPD Web GUI written in C";
+
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${pkgs.ympd}/bin/ympd --host ${cfg.mpd.host} --port ${toString cfg.mpd.port} --webport ${toString cfg.webPort} --user nobody";
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        ExecStart = ''
+          ${pkgs.ympd}/bin/ympd \
+            --host ${cfg.mpd.host} \
+            --port ${toString cfg.mpd.port} \
+            --webport ${toString cfg.webPort}
+        '';
+
+        DynamicUser = true;
+        NoNewPrivileges = true;
+
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ProtectHome = "tmpfs";
+
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateIPC = true;
+
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+
+        SystemCallFilter = [
+          "@system-service"
+          "~@process"
+          "~@setuid"
+        ];
+      };
     };
 
   };

nixos/modules/services/web-servers/caddy/default.nix

@@ -35,7 +35,8 @@ let
 
       Caddyfile-formatted = pkgs.runCommand "Caddyfile-formatted" { nativeBuildInputs = [ cfg.package ]; } ''
         mkdir -p $out
-        ${cfg.package}/bin/caddy fmt ${Caddyfile}/Caddyfile > $out/Caddyfile
+        cp --no-preserve=mode ${Caddyfile}/Caddyfile $out/Caddyfile
+        caddy fmt --overwrite $out/Caddyfile
       '';
     in
       "${if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform then Caddyfile-formatted else Caddyfile}/Caddyfile";

nixos/modules/system/boot/systemd/coredump.nix

@@ -66,7 +66,9 @@ in {
         uid = config.ids.uids.systemd-coredump;
         group = "systemd-coredump";
       };
-      users.groups.systemd-coredump = {};
+      users.groups.systemd-coredump = {
+        gid = config.ids.gids.systemd-coredump;
+      };
     })
 
     (mkIf (!cfg.enable) {

nixos/tests/all-tests.nix

@@ -92,6 +92,7 @@ in {
   bcachefs = handleTestOn ["x86_64-linux" "aarch64-linux"] ./bcachefs.nix {};
   beanstalkd = handleTest ./beanstalkd.nix {};
   bees = handleTest ./bees.nix {};
+  binary-cache = handleTest ./binary-cache.nix {};
   bind = handleTest ./bind.nix {};
   bird = handleTest ./bird.nix {};
   bitcoind = handleTest ./bitcoind.nix {};
@@ -520,7 +521,6 @@ in {
   peering-manager = handleTest ./web-apps/peering-manager.nix {};
   peertube = handleTestOn ["x86_64-linux"] ./web-apps/peertube.nix {};
   pgadmin4 = handleTest ./pgadmin4.nix {};
-  pgadmin4-standalone = handleTest ./pgadmin4-standalone.nix {};
   pgjwt = handleTest ./pgjwt.nix {};
   pgmanage = handleTest ./pgmanage.nix {};
   phosh = handleTest ./phosh.nix {};

nixos/tests/binary-cache.nix

@@ -0,0 +1,62 @@
+import ./make-test-python.nix ({ lib, ... }:
+
+with lib;
+
+{
+  name = "binary-cache";
+  meta.maintainers = with maintainers; [ thomasjm ];
+
+  nodes.machine =
+    { pkgs, ... }: {
+      imports = [ ../modules/installer/cd-dvd/channel.nix ];
+      environment.systemPackages = with pkgs; [python3];
+      system.extraDependencies = with pkgs; [hello.inputDerivation];
+      nix.extraOptions = ''
+        experimental-features = nix-command
+      '';
+    };
+
+  testScript = ''
+    # Build the cache, then remove it from the store
+    cachePath = machine.succeed("nix-build --no-out-link -E 'with import <nixpkgs> {}; mkBinaryCache { rootPaths = [hello]; }'").strip()
+    machine.succeed("cp -r %s/. /tmp/cache" % cachePath)
+    machine.succeed("nix-store --delete " + cachePath)
+
+    # Sanity test of cache structure
+    status, stdout = machine.execute("ls /tmp/cache")
+    cache_files = stdout.split()
+    assert ("nix-cache-info" in cache_files)
+    assert ("nar" in cache_files)
+
+    # Nix store ping should work
+    machine.succeed("nix store ping --store file:///tmp/cache")
+
+    # Cache should contain a .narinfo referring to "hello"
+    grepLogs = machine.succeed("grep -l 'StorePath: /nix/store/[[:alnum:]]*-hello-.*' /tmp/cache/*.narinfo")
+
+    # Get the store path referenced by the .narinfo
+    narInfoFile = grepLogs.strip()
+    narInfoContents = machine.succeed("cat " + narInfoFile)
+    import re
+    match = re.match(r"^StorePath: (/nix/store/[a-z0-9]*-hello-.*)$", narInfoContents, re.MULTILINE)
+    if not match: raise Exception("Couldn't find hello store path in cache")
+    storePath = match[1]
+
+    # Delete the store path
+    machine.succeed("nix-store --delete " + storePath)
+    machine.succeed("[ ! -d %s ] || exit 1" % storePath)
+
+    # Should be able to build hello using the cache
+    logs = machine.succeed("nix-build -A hello '<nixpkgs>' --option require-sigs false --option trusted-substituters file:///tmp/cache --option substituters file:///tmp/cache 2>&1")
+    logLines = logs.split("\n")
+    if not "this path will be fetched" in logLines[0]: raise Exception("Unexpected first log line")
+    def shouldBe(got, desired):
+      if got != desired: raise Exception("Expected '%s' but got '%s'" % (desired, got))
+    shouldBe(logLines[1], "  " + storePath)
+    shouldBe(logLines[2], "copying path '%s' from 'file:///tmp/cache'..." % storePath)
+    shouldBe(logLines[3], storePath)
+
+    # Store path should exist in the store now
+    machine.succeed("[ -d %s ] || exit 1" % storePath)
+  '';
+})

nixos/tests/pgadmin4-standalone.nix

@@ -1,43 +0,0 @@
-import ./make-test-python.nix ({ pkgs, lib, ... }:
-  # This is separate from pgadmin4 since we don't want both running at once
-
-  {
-    name = "pgadmin4-standalone";
-    meta.maintainers = with lib.maintainers; [ mkg20001 ];
-
-    nodes.machine = { pkgs, ... }: {
-      environment.systemPackages = with pkgs; [
-        curl
-      ];
-
-      services.postgresql = {
-        enable = true;
-
-        authentication = ''
-          host    all             all             localhost               trust
-        '';
-
-        ensureUsers = [
-          {
-            name = "postgres";
-            ensurePermissions = {
-              "DATABASE \"postgres\"" = "ALL PRIVILEGES";
-            };
-          }
-        ];
-      };
-
-      services.pgadmin = {
-        enable = true;
-        initialEmail = "bruh@localhost.de";
-        initialPasswordFile = pkgs.writeText "pw" "bruh2012!";
-      };
-    };
-
-    testScript = ''
-      machine.wait_for_unit("postgresql")
-      machine.wait_for_unit("pgadmin")
-
-      machine.wait_until_succeeds("curl -s localhost:5050")
-    '';
-  })

nixos/tests/pgadmin4.nix

@@ -1,56 +1,18 @@
-import ./make-test-python.nix ({ pkgs, lib, buildDeps ? [ ], pythonEnv ? [ ], ... }:
+import ./make-test-python.nix ({ pkgs, lib, ... }:
 
-/*
-  This test suite replaces the typical pytestCheckHook function in python
-  packages. Pgadmin4 test suite needs a running and configured postgresql
-  server. This is why this test exists.
-
-  To not repeat all the python dependencies needed, this test is called directly
-  from the pgadmin4 derivation, which also passes the currently
-  used propagatedBuildInputs and any python overrides.
-
-  Unfortunately, there doesn't seem to be an easy way to otherwise include
-  the needed packages here.
-
-  Due the the needed parameters a direct call to "nixosTests.pgadmin4" fails
-  and needs to be called as "pgadmin4.tests"
-
-  */
-
-let
-  pgadmin4SrcDir = "/pgadmin";
-  pgadmin4Dir = "/var/lib/pgadmin";
-  pgadmin4LogDir = "/var/log/pgadmin";
-
-in
 {
   name = "pgadmin4";
-  meta.maintainers = with lib.maintainers; [ gador ];
+  meta.maintainers = with lib.maintainers; [ mkg20001 gador ];
 
   nodes.machine = { pkgs, ... }: {
-    imports = [ ./common/x11.nix ];
+
-    # needed because pgadmin 6.8 will fail, if those dependencies get updated
+    imports = [ ./common/user-account.nix ];
-    nixpkgs.overlays = [
-      (self: super: {
-        pythonPackages = pythonEnv;
-      })
-    ];
 
     environment.systemPackages = with pkgs; [
-      pgadmin4
+      curl
-      postgresql
+      pgadmin4-desktopmode
-      chromedriver
-      chromium
-      # include the same packages as in pgadmin minus speaklater3
-      (python3.withPackages
-        (ps: buildDeps ++
-          [
-            # test suite package requirements
-            pythonPackages.testscenarios
-            pythonPackages.selenium
-          ])
-      )
     ];
+
     services.postgresql = {
       enable = true;
       authentication = ''
@@ -65,75 +27,31 @@ in
         }
       ];
     };
+
+    services.pgadmin = {
+      port = 5051;
+      enable = true;
+      initialEmail = "bruh@localhost.de";
+      initialPasswordFile = pkgs.writeText "pw" "bruh2012!";
+    };
   };
 
   testScript = ''
-    machine.wait_for_unit("postgresql")
+    with subtest("Check pgadmin module"):
+      machine.wait_for_unit("postgresql")
+      machine.wait_for_unit("pgadmin")
+      machine.wait_until_succeeds("curl -s localhost:5051")
+      machine.wait_until_succeeds("curl -s localhost:5051/login | grep \"<title>pgAdmin 4</title>\" > /dev/null")
 
-    # pgadmin4 needs its data and log directories
+    # pgadmin4 module saves the configuration to /etc/pgadmin/config_system.py
-    machine.succeed(
+    # pgadmin4-desktopmode tries to read that as well. This normally fails with a PermissionError, as the config file
-        "mkdir -p ${pgadmin4Dir} \
+    # is owned by the user of the pgadmin module. With the check-system-config-dir.patch this will just throw a warning
-        && mkdir -p ${pgadmin4LogDir} \
+    # but will continue and not read the file.
-        && mkdir -p ${pgadmin4SrcDir}"
+    # If we run pgadmin4-desktopmode as root (something one really shouldn't do), it can read the config file and fail,
-    )
+    # because of the wrong config for desktopmode.
-
+    with subtest("Check pgadmin standalone desktop mode"):
-    machine.succeed(
+      machine.execute("sudo -u alice pgadmin4 >&2 &", timeout=60)
-         "tar xvzf ${pkgs.pgadmin4.src} -C ${pgadmin4SrcDir}"
+      machine.wait_until_succeeds("curl -s localhost:5050")
-    )
+      machine.wait_until_succeeds("curl -s localhost:5050/browser/ | grep \"<title>pgAdmin 4</title>\" > /dev/null")
-
-    machine.wait_for_file("${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version}/README.md")
-
-    # set paths and config for tests
-    # also ensure Server Mode is set to false, which will automatically exclude some unnecessary tests.
-    # see https://github.com/pgadmin-org/pgadmin4/blob/fd1c26408bbf154fa455a49ee5c12895933833a3/web/regression/runtests.py#L217-L226
-    machine.succeed(
-        "cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version} \
-        && cp -v web/regression/test_config.json.in web/regression/test_config.json \
-        && sed -i 's|PostgreSQL 9.4|PostgreSQL|' web/regression/test_config.json \
-        && sed -i 's|/opt/PostgreSQL/9.4/bin/|${pkgs.postgresql}/bin|' web/regression/test_config.json \
-        && sed -i 's|\"headless_chrome\": false|\"headless_chrome\": true|' web/regression/test_config.json \
-        && sed -i 's|builtins.SERVER_MODE = None|builtins.SERVER_MODE = False|' web/regression/runtests.py"
-    )
-
-    # adapt chrome config to run within a sandbox without GUI
-    # see https://stackoverflow.com/questions/50642308/webdriverexception-unknown-error-devtoolsactiveport-file-doesnt-exist-while-t#50642913
-    # add chrome binary path. use spaces to satisfy python indention (tabs throw an error)
-    machine.succeed(
-         "cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version} \
-         && sed -i '\|options.add_argument(\"--disable-infobars\")|a \ \ \ \ \ \ \ \ options.binary_location = \"${pkgs.chromium}/bin/chromium\"' web/regression/runtests.py \
-         && sed -i '\|options.add_argument(\"--no-sandbox\")|a \ \ \ \ \ \ \ \ options.add_argument(\"--headless\")' web/regression/runtests.py \
-         && sed -i '\|options.add_argument(\"--disable-infobars\")|a \ \ \ \ \ \ \ \ options.add_argument(\"--disable-dev-shm-usage\")' web/regression/runtests.py \
-         && sed -i 's|(chrome_options=options)|(executable_path=\"${pkgs.chromedriver}/bin/chromedriver\", chrome_options=options)|' web/regression/runtests.py \
-         && sed -i 's|driver_local.maximize_window()||' web/regression/runtests.py"
-    )
-
-    # don't bother to test kerberos authentication
-    excluded_tests = [ "browser.tests.test_kerberos_with_mocking",
-                       ]
-
-    with subtest("run browser test"):
-        machine.succeed(
-             'cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version}/web \
-             && python regression/runtests.py \
-             --pkg browser \
-             --exclude ' + ','.join(excluded_tests)
-        )
-
-    with subtest("run resql test"):
-      machine.succeed(
-           'cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version}/web \
-           && python regression/runtests.py --pkg resql'
-      )
-
-    # fontconfig is necessary for chromium to run
-    # https://github.com/NixOS/nixpkgs/issues/136207
-    # also, the feature_tests require Server Mode = True
-    with subtest("run feature test"):
-       machine.succeed(
-           'cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version}/web \
-            && export FONTCONFIG_FILE=${pkgs.makeFontsConf { fontDirectories = [];}} \
-            && sed -i \'s|builtins.SERVER_MODE = False|builtins.SERVER_MODE = True|\' regression/runtests.py \
-            && python regression/runtests.py --pkg feature_tests'
-       )
   '';
 })

pkgs/applications/audio/flac2all/default.nix

@@ -0,0 +1,45 @@
+{ python3Packages, lib, flac, lame, opusTools, vorbis-tools, ffmpeg }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "flac2all";
+  version = "5.1";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "OBjlr7cbSx2WOIfZUNwHy5Hpb2Fmh3vmZdc70JiWsiI=";
+  };
+
+  # Not sure why this is needed, but setup.py expects this to be set
+  postPatch = ''
+    echo ${version} > ./flac2all_pkg/version
+  '';
+
+  propagatedBuildInputs = [
+    python3Packages.pyzmq
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/flac2all \
+      --set PATH ${lib.makeBinPath [
+        # Hard requirements
+        flac
+        lame
+        # Optional deps depending on encoding types
+        opusTools
+        vorbis-tools
+        ffmpeg
+      ]}
+  '';
+
+  # Has no standard tests, so we verify a few imports instead.
+  doCheck = false;
+  pythonImportsCheck = [ "flac2all_pkg.vorbis" "flac2all_pkg.mp3" ];
+
+  meta = with lib; {
+    description = "Multi process, clustered, FLAC to multi codec audio converter with tagging support";
+    homepage = "https://github.com/ZivaVatra/flac2all";
+    license = licenses.gpl3;
+    # TODO: This has only been tested on Linux, but may work on Mac too.
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/audio/pocket-casts/default.nix

@@ -1,57 +1,59 @@
-{ lib, stdenv, fetchurl, dpkg, autoPatchelfHook, makeWrapper, electron
+{ lib
-, alsa-lib, gtk3, libXScrnSaver, libXtst, mesa, nss }:
+, stdenv
+, fetchFromGitHub
+, electron
+, copyDesktopItems
+, makeDesktopItem
+, makeWrapper
+}:
 
 stdenv.mkDerivation rec {
   pname = "pocket-casts";
   version = "0.6.0";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://github.com/felicianotech/pocket-casts-desktop-app/releases/download/v${version}/${pname}_${version}_amd64.deb";
+    owner = "felicianotech";
-    sha256 = "sha256-nHdF9RDOkM9HwwmK/axiIPM4nmKrWp/FHNC/EI1vTTc=";
+    repo = "pocket-casts-desktop-app";
+    rev = "v${version}";
+    sha256 = "sha256-WMv2G4b7kYnWy0pz8YyI2eTdefs1mtWau+HQLiRygjE=";
   };
 
-  nativeBuildInputs = [
+  desktopItems = [
-    dpkg
+    (makeDesktopItem {
-    autoPatchelfHook
+      name = pname;
-    makeWrapper
+      desktopName = "Pocket Casts";
+      genericName = "Podcasts Listener";
+      exec = "pocket-casts";
+      icon = "pocket-casts";
+      comment = meta.description;
+    })
   ];
 
-  buildInputs = [ alsa-lib gtk3 libXScrnSaver libXtst mesa nss ];
+  nativeBuildInputs = [
-
+    copyDesktopItems
-  unpackCmd = ''
+    makeWrapper
-    # If unpacking using -x option, there is a permission error
+  ];
-    dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner;
-  '';
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out
+    mkdir -p $out/bin $out/opt/pocket-casts $out/share/pixmaps
-    mv bin $out
-    mv lib $out
-    mv share $out
 
-    cp $out/lib/pocket-casts/resources/app/icon.png $out/share/pixmaps/pocket-casts.png
+    cp -r main.js tray-icon.png LICENSE $out/opt/pocket-casts
+    install -Dm644 icon.png $out/share/pixmaps/pocket-casts.png
+    install -Dm644 icon-x360.png $out/share/pixmaps/pocket-casts-x360.png
+
+    makeWrapper ${electron}/bin/electron $out/bin/pocket-casts \
+      --add-flags $out/opt/pocket-casts/main.js
 
     runHook postInstall
   '';
 
-  postFixup = ''
-    substituteInPlace $out/share/applications/pocket-casts.desktop \
-      --replace Name=pocket-casts "Name=Pocket Casts" \
-      --replace GenericName=pocket-casts "GenericName=Podcasts App" \
-      --replace Exec=pocket-casts Exec=$out/bin/pocket-casts
-    makeWrapper ${electron}/bin/electron \
-      $out/bin/pocket-casts \
-      --add-flags $out/lib/pocket-casts/resources/app/main.js
-  '';
-
   meta = with lib; {
     description = "Pocket Casts webapp, packaged for the Linux Desktop";
     homepage = "https://github.com/felicianotech/pocket-casts-desktop-app";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.mit;
     maintainers = with maintainers; [ wolfangaukang ];
-    platforms = [ "x86_64-linux" ];
+    platforms = platforms.linux;
   };
 }

pkgs/applications/audio/praat/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "praat";
-  version = "6.3.06";
+  version = "6.3.07";
 
   src = fetchFromGitHub {
     owner = "praat";
     repo = "praat";
     rev = "v${version}";
-    sha256 = "sha256-KwJ8ia1yQmmG+N44ipvGCbuoR2cL03STSTKzUwlDqms=";
+    sha256 = "sha256-hWR6mYD0vBJbX07D/HtFE9qwdbxMliHLCsNDXVYcm1Y=";
   };
 
   configurePhase = ''

pkgs/applications/audio/reaper/default.nix

@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "6.73";
+  version = "6.75";
 
   src = fetchurl {
     url = url_for_platform version stdenv.hostPlatform.qemuArch;
     hash = {
-      x86_64-linux = "sha256-omQ2XdL4C78BQRuYKy90QlMko2XYHoVhd4X0C+Zyp8E=";
+      x86_64-linux = "sha256-wtXClHL+SeuLxMROaZKZOwYnLo6MXC7lAiwCj80X0Ck=";
-      aarch64-linux = "sha256-XHohznrfFMHHgif4iFrpXb0FNddYiBb0gB7ZznlU834=";
+      aarch64-linux = "sha256-xCkAbKzXH7E1Ud6iGsnzgZT/2Sy6qpRItYUHFF6ggpQ=";
     }.${stdenv.hostPlatform.system};
   };
 

pkgs/applications/blockchains/btcpayserver/default.nix

@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "btcpayserver";
-  version = "1.7.5";
+  version = "1.7.7";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xycNt3jzZY2a4hNv3arWLt+EfMqpFVMDHMuzOWnL7aQ=";
+    sha256 = "sha256-bflQsVaCwV5zaU5k46wFQ45dIOg3dHmYfBVQHyw+EpM=";
   };
 
   projectFile = "BTCPayServer/BTCPayServer.csproj";

pkgs/applications/blockchains/btcpayserver/deps.nix

@@ -8,15 +8,15 @@
   (fetchNuGet { pname = "AWSSDK.S3"; version = "3.3.110.10"; sha256 = "1lf1hfbx792dpa1hxgn0a0jrrvldd16hgbxx229dk2qcz5qlnc38"; })
   (fetchNuGet { pname = "BIP78.Sender"; version = "0.2.2"; sha256 = "12pm2s35c0qzc06099q2z1pxwq94rq85n74yz8fs8gwvm2ksgp4p"; })
   (fetchNuGet { pname = "BTCPayServer.Hwi"; version = "2.0.2"; sha256 = "0lh3n1qncqs4kbrmx65xs271f0d9c7irrs9qnsa9q51cbbqbljh9"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.4.18"; sha256 = "1w1h6za2mjk04njkw4hny3lx38h2m03gmvwrihj9h2rak7jf2gij"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.4.20"; sha256 = "1vnzmczd4z25vbf987p4vp6sxc09fp6mvhrvq41iwj1ks5zcprlf"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Charge"; version = "1.3.20"; sha256 = "0nk82hkgs67mxfxkgbav8yxxd79m0xyqaan7vay00gg33pjqdjvj"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.3.24"; sha256 = "0i0lqpxx0gy9zbssjigz0vq0way88x0slyyfijsx4sasrhrbv5qs"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.3.25"; sha256 = "0172czzzlgsljgmhb5wh8cb1cl12ac54qyzmd3w18wbkxmr205qk"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.3.16"; sha256 = "1g37736b4k0ncpyy2qycbk4l85fqvgwac3k98nbdj0dvhfghp1dn"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.3.21"; sha256 = "042xwfsxd30zgwiz0w14ynb755w5sldkplxgw1fkw68lrz66x5s4"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.Eclair"; version = "1.3.20"; sha256 = "093w82mcxxxbvx66j0sp3lsfm2bkbi3igm80iz9zdghy85845kc9"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LNBank"; version = "1.3.23"; sha256 = "036cggc386448i05s38pnhzs7qqbix6lml7j2zn84gcgk8w741gi"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LNBank"; version = "1.3.24"; sha256 = "0dah7q90x29rqhngxd9226pfn1k4bbhhfgnkpjpw64529m29cdks"; })
   (fetchNuGet { pname = "BTCPayServer.Lightning.LND"; version = "1.4.14"; sha256 = "1gzqz34lgk42kf86ldi3z0k4m9x91hlkqh6d7rq93nphl57mwqar"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LNDhub"; version = "1.0.16"; sha256 = "0l6pnjc6phsacwg145kwsakjpkd44jm1w53y0s166bwzpcdmljq0"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LNDhub"; version = "1.0.18"; sha256 = "0vnnnm9c5w8ag3a25fzmsjax028ykb7xr4fp7saq4si3bmzkjswp"; })
   (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins"; version = "1.4.4"; sha256 = "0rk0prmb0539ji5fd33cqy3yvw51i5i8m5hb43admr5z8960dd6l"; })
   (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins.Mvc"; version = "1.4.4"; sha256 = "1kmmj5m7s41wc1akpqw1b1j7pp4c0vn6sqxb487980ibpj6hyisl"; })
   (fetchNuGet { pname = "CsvHelper"; version = "15.0.5"; sha256 = "01y8bhsnxghn3flz0pr11vj6wjrpmia8rpdrsp7kjfc1zmhqlgma"; })

pkgs/applications/blockchains/nbxplorer/default.nix

@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "nbxplorer";
-  version = "2.3.57";
+  version = "2.3.60";
 
   src = fetchFromGitHub {
     owner = "dgarage";
     repo = "NBXplorer";
     rev = "v${version}";
-    sha256 = "sha256-oLkkGdzjyvgIXi0HZiFPCShzbBR8cOgMf1h1Nf1U6Rk=";
+    sha256 = "sha256-YUZvTs77dGhG7dpxbQyGhrOMMx+8LotdMJflPflMDAE=";
   };
 
   projectFile = "NBXplorer/NBXplorer.csproj";

pkgs/applications/editors/texstudio/default.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "texstudio";
-  version = "4.4.1";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "${pname}-org";
     repo = pname;
     rev = version;
-    hash = "sha256-3w9JKX0tT5J3tJthIxJ+ZMlG8+gEeQAl9Gn+Zyjhmt4=";
+    hash = "sha256-QBPWelCqh8Ggp0IjH37QGYGu5Ya2fpsiSEkKh3Ee7PM=";
   };
 
   nativeBuildInputs = [ qmake wrapQtAppsHook pkg-config ];

pkgs/applications/misc/anytype/default.nix

@@ -2,13 +2,13 @@
 
 let
   pname = "anytype";
-  version = "0.29.1";
+  version = "0.30.0";
   name = "Anytype-${version}";
   nameExecutable = pname;
   src = fetchurl {
     url = "https://at9412003.fra1.digitaloceanspaces.com/Anytype-${version}.AppImage";
     name = "Anytype-${version}.AppImage";
-    sha256 = "sha256-NyIAOkOX9s9dN6m/5hfMhy4tSENPCDk2w/F8z+J6qqk=";
+    sha256 = "sha256-LifJc5mLbnt5wBXGM1n1uice0B6mCY80LYf3kEFJy90=";
   };
   appimageContents = appimageTools.extractType2 { inherit name src; };
 in

pkgs/applications/misc/keepass/default.nix

@@ -4,11 +4,11 @@ let
   inherit (builtins) add length readFile replaceStrings unsafeDiscardStringContext toString map;
 in buildDotnetPackage rec {
   pname = "keepass";
-  version = "2.53";
+  version = "2.53.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/keepass/KeePass-${version}-Source.zip";
-    hash = "sha256-wpXbLH9VyjJyb+KuQ8xmbik1jq+xqAFRxsxAuLM5MI0=";
+    hash = "sha256-R7KWxlxrhl55nOaDNYwA/cJJl+kd5ZYy6eZVqyrxxnM=";
   };
 
   sourceRoot = ".";

pkgs/applications/misc/translate-shell/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "translate-shell";
-  version = "0.9.7";
+  version = "0.9.7.1";
 
   src = fetchFromGitHub {
     owner = "soimort";
     repo = "translate-shell";
     rev = "v${version}";
-    sha256 = "sha256-OLbGBP+QHW51mt0sFXf6SqrIYZ0iC/X10F148NAG4A4=";
+    sha256 = "sha256-ILXE8cSrivYqMruE+xtNIInLdwdRfMX5dneY9Nn12Uk=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/misc/xmrig/default.nix

@@ -1,38 +1,69 @@
-{ stdenv, lib, fetchFromGitHub, cmake, libuv, libmicrohttpd, openssl, hwloc
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, libuv
+, libmicrohttpd
+, openssl
+, hwloc
 , donateLevel ? 0
+, darwin
 }:
 
+let
+  inherit (darwin.apple_sdk_11_0.frameworks) Carbon CoreServices OpenCL;
+in
 stdenv.mkDerivation rec {
   pname = "xmrig";
-  version = "6.18.1";
+  version = "6.19.0";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig";
     rev = "v${version}";
-    sha256 = "sha256-aTyJhPVqq3jGNVozD39RJ4n0FmAKAtPttW9ecoanEzg=";
+    hash = "sha256-pMI5SqAa9jauwWvc3JpyWQa+pQvntbTrta1p0qjBaoM=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  patches = [
-  buildInputs = [ libuv libmicrohttpd openssl hwloc ];
+    ./donate-level.patch
+  ];
+
+  postPatch = ''
+    substituteAllInPlace src/donate.h
+    substituteInPlace cmake/OpenSSL.cmake \
+      --replace "set(OPENSSL_USE_STATIC_LIBS TRUE)" "set(OPENSSL_USE_STATIC_LIBS FALSE)"
+  '';
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libuv
+    libmicrohttpd
+    openssl
+    hwloc
+  ] ++ lib.optionals stdenv.isDarwin [
+    Carbon
+    CoreServices
+    OpenCL
+  ];
 
   inherit donateLevel;
 
-  patches = [ ./donate-level.patch ];
-  postPatch = ''
-    substituteAllInPlace src/donate.h
-  '';
-
   installPhase = ''
+    runHook preInstall
+
     install -vD xmrig $out/bin/xmrig
+
+    runHook postInstall
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "Monero (XMR) CPU miner";
     homepage = "https://github.com/xmrig/xmrig";
     license = licenses.gpl3Plus;
-    platforms   = [ "x86_64-linux" "x86_64-darwin" ];
+    platforms = platforms.unix;
     maintainers = with maintainers; [ kim0 ];
   };
 }

pkgs/applications/networking/browsers/brave/default.nix

@@ -90,11 +90,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.47.186";
+  version = "1.48.158";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-47LkjcC+fEE+cn2m434+9fQ+N2yZSc1eF0gDO7jGfPI=";
+    sha256 = "sha256-hgV8+Mjth43KItly98lTh3Ur+h9vA9BfJxOqMGl1ndY=";
   };
 
   dontConfigure = true;

pkgs/applications/networking/browsers/chromium/common.nix

@@ -150,10 +150,10 @@ let
       libdrm wayland mesa.drivers libxkbcommon
       curl
       libepoxy
+      libffi
     ] ++ lib.optional systemdSupport systemd
       ++ lib.optionals cupsSupport [ libgcrypt cups ]
-      ++ lib.optional pulseSupport libpulseaudio
+      ++ lib.optional pulseSupport libpulseaudio;
-      ++ lib.optional (chromiumVersionAtLeast "110") libffi;
 
     patches = [
       # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed):
@@ -293,15 +293,6 @@ let
       chrome_pgo_phase = 0;
       clang_base_path = "${llvmPackages.clang}";
       use_qt = false;
-    } // lib.optionalAttrs (!chromiumVersionAtLeast "110") {
-      # The default has changed to false. We'll build with libwayland from
-      # Nixpkgs for now but might want to eventually use the bundled libwayland
-      # as well to avoid incompatibilities (if this continues to be a problem
-      # from time to time):
-      use_system_libwayland = true;
-      # The default value is hardcoded instead of using pkg-config:
-      system_wayland_scanner_path = "${wayland.bin}/bin/wayland-scanner";
-    } // lib.optionalAttrs (chromiumVersionAtLeast "110") {
       # To fix the build as we don't provide libffi_pic.a
       # (ld.lld: error: unable to find library -l:libffi_pic.a):
       use_system_libffi = true;

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -45,19 +45,19 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "109.0.5414.120",
+    "version": "110.0.5481.78",
-    "sha256": "1yvfd0a7zfz4x00f83irrs6hy15wn85mrbbm7mk5wy4gjwg5zyrj",
+    "sha256": "1m67xfdgggaan09xsbppna209b8sm882xq587i0hsnnnzb3fdxdj",
     "sha256bin64": null,
     "deps": {
       "gn": {
-        "version": "2022-11-10",
+        "version": "2022-12-12",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "1c4151ff5c1d6fbf7fa800b8d4bb34d3abc03a41",
+        "rev": "5e19d2fb166fbd4f6f32147fbb2f497091a54ad8",
-        "sha256": "02621c9nqpr4pwcapy31x36l5kbyd0vdgd0wdaxj5p8hrxk67d6b"
+        "sha256": "1b5fwldfmkkbpp5x63n1dxv0nc965hphc8rm8ah7zg44zscm9z30"
       },
       "ungoogled-patches": {
-        "rev": "109.0.5414.120-1",
+        "rev": "110.0.5481.78-1",
-        "sha256": "0hq48lsjl7da8rdq129mc7cd0z5ykqbaf1sbhhs1d10dzm5zs4p3"
+        "sha256": "1ffb2wf1bdmzlxk4ih8qq439jzqz17f8nchvx7na52y48am1qr3c"
       }
     }
   }

pkgs/applications/networking/browsers/ladybird/default.nix

@@ -10,28 +10,25 @@
 , nixosTests
 }:
 
-let serenity = fetchFromGitHub {
-  owner = "SerenityOS";
-  repo = "serenity";
-  rev = "a0f3e2c9a2b82117aa7c1a3444ad0d31baa070d5";
-  hash = "sha256-8Xde59ZfdkTD39mYSv0lfFjBHFDWTUwfozE+Q9Yq6C8=";
-};
-in
 stdenv.mkDerivation {
   pname = "ladybird";
-  version = "unstable-2022-09-29";
+  version = "unstable-2023-01-17";
 
-  # Remember to update `serenity` too!
   src = fetchFromGitHub {
     owner = "SerenityOS";
-    repo = "ladybird";
+    repo = "serenity";
-    rev = "d69ad7332477de33bfd1963026e057d55c6f222d";
+    rev = "45e85d20b64862df119f643f24e2d500c76c58f3";
-    hash = "sha256-XQj2Bohk8F6dGCAManOmmDP5b/SqEeZXZbLDYPfvi2E=";
+    hash = "sha256-n2mLg9wNfdMGsJuGj+ukjto9qYjGOIz4cZjgvMGQUrY=";
   };
 
+  sourceRoot = "source/Ladybird";
+
   postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace "MACOSX_BUNDLE TRUE" "MACOSX_BUNDLE FALSE"
+    # https://github.com/SerenityOS/serenity/issues/17062
+    substituteInPlace main.cpp \
+      --replace "./SQLServer/SQLServer" "$out/bin/SQLServer"
   '';
 
   nativeBuildInputs = [
@@ -47,17 +44,18 @@ stdenv.mkDerivation {
   ];
 
   cmakeFlags = [
-    "-DSERENITY_SOURCE_DIR=${serenity}"
     # Disable network operations
     "-DENABLE_TIME_ZONE_DATABASE_DOWNLOAD=false"
     "-DENABLE_UNICODE_DATABASE_DOWNLOAD=false"
   ];
 
-  # error: use of undeclared identifier 'aligned_alloc'
+  NIX_CFLAGS_COMPILE = [
-  NIX_CFLAGS_COMPILE = toString (lib.optionals (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinSdkVersion "11.0") [
+    "-Wno-error"
+  ] ++ lib.optionals (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinSdkVersion "11.0") [
+    # error: use of undeclared identifier 'aligned_alloc'
     "-include mm_malloc.h"
     "-Daligned_alloc=_mm_malloc"
-  ]);
+  ];
 
   # https://github.com/NixOS/nixpkgs/issues/201254
   NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";

pkgs/applications/networking/cluster/arkade/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.8.60";
+  version = "0.8.62";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    sha256 = "sha256-kyWUokQl5n7ko/1pdNs15WxRAAfe8KioYpkTMcLhJjU=";
+    sha256 = "sha256-lnMinIZ1n94ks7H5tlYmgaDDHyGi5YxTM9dTrckQ9y0=";
   };
 
   CGO_ENABLED = 0;

pkgs/applications/networking/cluster/civo/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "civo";
-  version = "1.0.47";
+  version = "1.0.48";
 
   src = fetchFromGitHub {
     owner  = "civo";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-iowBEtO+Ol6mFJrwLaDa88wsQB8nZEe9OFPuhbH4t1s=";
+    sha256 = "sha256-KoW+XKEFoe2QNJPu97MYYZnxbU0Wat8slJjQm/vtmew=";
   };
 
   vendorHash = "sha256-QzTu6/iFK+CS8UXoXSVq3OTuwk/xcHnAX4UpCU/Scpk=";

pkgs/applications/networking/cluster/glooctl/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.13.5";
+  version = "1.13.6";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-mBmjGP7O1uX+uVM4/us4RWeJcXB1lSEvZQWT/3Ygzik=";
+    hash = "sha256-CBWKKW5VIkRgl7wY63OCm/CowWHO389se3kEraqaDCI=";
   };
 
   subPackages = [ "projects/gloo/cli/cmd" ];

pkgs/applications/networking/cluster/helm/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubernetes-helm";
-  version = "3.11.0";
+  version = "3.11.1";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "sha256-Pes1p7rTO17Bef6qacsQWJkhb1CWilzmVYQe886EepU=";
+    sha256 = "sha256-TrjPpKFHMF+dPz9AqXVkYPUNWeWEeH8bA37Dpxr7b8s=";
   };
   vendorSha256 = "sha256-LRMDrBSl5EGQqQt5FUU4JJHqdwfYt5qsVpe76jUQBVI=";
 

pkgs/applications/networking/cluster/k3s/1_23/0001-script-download-strip-downloading-just-package-CRD.patch

@@ -1,41 +0,0 @@
-From 6f53bd36a40da4c71486e3b79f6e32d53d6eea5d Mon Sep 17 00:00:00 2001
-From: Euan Kemp <euank@euank.com>
-Date: Thu, 3 Feb 2022 23:50:40 -0800
-Subject: [PATCH 2/2] scrips/download: strip downloading, just package CRD
-
-The CRD packaging is a complicated set of commands, so let's reuse it.
----
- scripts/download | 10 ++--------
- 1 file changed, 2 insertions(+), 8 deletions(-)
-
-diff --git a/scripts/download b/scripts/download
-index 5effc0562a..82361803ee 100755
---- a/scripts/download
-+++ b/scripts/download
-@@ -24,12 +24,6 @@ rm -rf ${CONTAINERD_DIR}
- mkdir -p ${CHARTS_DIR}
- mkdir -p ${DATA_DIR}
- 
--curl --compressed -sfL https://github.com/k3s-io/k3s-root/releases/download/${VERSION_ROOT}/k3s-root-${ARCH}.tar | tar xf - --exclude=bin/socat
--
--git clone --single-branch --branch=${VERSION_RUNC} --depth=1 https://github.com/opencontainers/runc ${RUNC_DIR}
--
--git clone --single-branch --branch=${VERSION_CONTAINERD} --depth=1 https://github.com/k3s-io/containerd ${CONTAINERD_DIR}
--
- setup_tmp() {
-     TMP_DIR=$(mktemp -d --tmpdir=${CHARTS_DIR})
-     cleanup() {
-@@ -44,8 +38,8 @@ setup_tmp() {
- 
- download_and_package_traefik () {
-   echo "Downloading Traefik Helm chart from ${TRAEFIK_URL}"
--  curl -sfL ${TRAEFIK_URL} -o ${TMP_DIR}/${TRAEFIK_FILE}
--  code=$?
-+  # nixpkgs: copy in our known traefik chart instead
-+  cp $TRAEFIK_CHART_FILE ${TMP_DIR}/${TRAEFIK_FILE}
- 
-   if [ $code -ne 0 ]; then
-     echo "Error: Failed to download Traefik Helm chart!"
--- 
-2.34.1
-

pkgs/applications/networking/cluster/k3s/1_23/chart-versions.nix

@@ -0,0 +1,10 @@
+{
+    traefik-crd  = {
+        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-20.3.1+up20.3.0.tgz";
+        sha256 = "1775vjldvqvhzdbzanxhbaqbmkih09yb91im651q8bc7z5sb9ckn";
+    };
+    traefik = {
+        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-20.3.1+up20.3.0.tgz";
+        sha256 = "1rj0f0n0vgjcbzfwzhqmsd501i2f6vw145w9plbp8gwdyzmg2nc6";
+    };
+}

pkgs/applications/networking/cluster/k3s/1_23/default.nix

@@ -48,30 +48,32 @@ with lib;
 # Those pieces of software we entirely ignore upstream's handling of, and just
 # make sure they're in the path if desired.
 let
-  k3sVersion = "1.23.6+k3s1";     # k3s git tag
+  k3sVersion = "1.23.16+k3s1";     # k3s git tag
-  k3sCommit = "418c3fa858b69b12b9cefbcff0526f666a6236b9"; # k3s git commit at the above version
+  k3sCommit = "64b0feeb36c2a26976a364a110f23ebcf971f976"; # k3s git commit at the above version
-  k3sRepoSha256 = "0fmw491dn5mpi058mr7sij51i5m4qg2grx30cnl3h2v4s0sdkx2i";
+  k3sRepoSha256 = "sha256-H6aaYa5OYAaD5hjSi8+RNXiP1zhRZCgKXQA6eU7AWBk=";
-  k3sVendorSha256 = "sha256-iHg5ySMaiSWXs98YGmxPwdZr4zdBIFma12dNEuf30Hs=";
+  k3sVendorSha256 = "sha256-+xygljXp27NahsHSgoigMANBQCRwGFYwGHQEwlI9YsQ=";
 
-  # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
+  # Based on the traefik charts here: https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/scripts/download#L29-L32
-  # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
+  # see also https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/manifests/traefik.yaml#L8-L16
-  traefikChartVersion = "10.19.3";
+  # At the time of writing, there are two traefik charts, and that's it
-  traefikChartSha256 = "04zg5li957svgscdmkzmzjkwljaljyav68rzxmhakkwgav6q9058";
+  charts = import ./chart-versions.nix;
 
-  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
+  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/scripts/version.sh#L54
-  k3sRootVersion = "0.11.0";
+  k3sRootVersion = "0.12.1";
-  k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
+  k3sRootSha256 = "sha256-xCXbarWztnvW2xn3cGa84hie3OevVZeGEDWh+Uf3RBw=";
 
-  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
+  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/scripts/version.sh#L47
-  k3sCNIVersion = "1.0.1-k3s1";
+  k3sCNIVersion = "1.1.1-k3s1";
-  k3sCNISha256 = "11ihlzzdnqf9p21y0a4ckpbxac016nm7746dcykhj26ym9zxyv92";
+  k3sCNISha256 = "sha256-1Br7s+iMtfiPjM0EcNPuFdSlp9dVPjSG1UGuiPUfq5I=";
 
   # taken from go.mod, the 'github.com/containerd/containerd' line
   # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
-  containerdVersion = "1.5.11-k3s2";
+  # https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/go.mod#L9
-  containerdSha256 = "16132snvrg8r0vwm6c0lz0q6fx686s2ix53nm3aka9a83xs75vf2";
+  containerdVersion = "1.5.16-k3s2-1-22";
+  containerdSha256 = "sha256-PRrp05Jgx368Ox4hTC66lbCInWuex0OtAuCY4l8geqA=";
 
   # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
+  # https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/go.mod#L19
   criCtlVersion = "1.22.0-k3s1";
 
   baseMeta = k3s.meta;
@@ -94,10 +96,9 @@ let
   ];
 
   # bundled into the k3s binary
-  traefikChart = fetchurl {
+  traefikChart = fetchurl charts.traefik;
-    url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
+  traefik-crdChart = fetchurl charts.traefik-crd;
-    sha256 = traefikChartSha256;
+
-  };
   # so, k3s is a complicated thing to package
   # This derivation attempts to avoid including any random binaries from the
   # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
@@ -181,12 +182,13 @@ let
     postInstall = ''
       mv $out/bin/server $out/bin/k3s
       pushd $out
-      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
+      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/scripts/build#L123-L131
       ln -s k3s ./bin/k3s-agent
       ln -s k3s ./bin/k3s-server
       ln -s k3s ./bin/k3s-etcd-snapshot
       ln -s k3s ./bin/k3s-secrets-encrypt
       ln -s k3s ./bin/k3s-certificate
+      ln -s k3s ./bin/k3s-completion
       ln -s k3s ./bin/kubectl
       ln -s k3s ./bin/crictl
       ln -s k3s ./bin/ctr
@@ -219,10 +221,6 @@ buildGoModule rec {
   src = k3sRepo;
   vendorSha256 = k3sVendorSha256;
 
-  patches = [
-    ./0001-script-download-strip-downloading-just-package-CRD.patch
-  ];
-
   postPatch = ''
     # Nix prefers dynamically linked binaries over static binary.
 
@@ -290,11 +288,9 @@ buildGoModule rec {
     ln -vsf ${k3sContainerd}/bin/* ./bin/
     rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
     mkdir -p ./build/static/charts
-    # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
+
-    export TRAEFIK_CHART_FILE=${traefikChart}
+    cp ${traefikChart} ./build/static/charts
-    # place the traefik chart using their code since it's complicated
+    cp ${traefik-crdChart} ./build/static/charts
-    # We trim the actual download, see patches
-    ./scripts/download
 
     export ARCH=$GOARCH
     export DRONE_TAG="v${k3sVersion}"

pkgs/applications/networking/cluster/k3s/1_26/default.nix

@@ -75,7 +75,7 @@ let
     description = "A lightweight Kubernetes distribution";
     license = licenses.asl20;
     homepage = "https://k3s.io";
-    maintainers = with maintainers; [ euank mic92 superherointj ];
+    maintainers = with maintainers; [ euank mic92 superherointj yajo ];
     platforms = platforms.linux;
   };
 

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -46,11 +46,11 @@
     "vendorHash": "sha256-xIxQxgfOv+/i0gyRtpZaCm22rsK/4ajFNKQpGP5uy0Y="
   },
   "alicloud": {
-    "hash": "sha256-sG241dMkFL9YllVGuQ7KlZ8Ta3hz9v8VdyOOcjOKie0=",
+    "hash": "sha256-LFguUrrI/7gFiXwub2jTKTOI1ppLEx8M/Jka4ypgb3E=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.197.0",
+    "rev": "v1.198.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -766,13 +766,13 @@
     "vendorHash": null
   },
   "newrelic": {
-    "hash": "sha256-lWjXsIeYpe07+kIHr8qS8SmChs0tnfzxWy/K1KNJ5oo=",
+    "hash": "sha256-OUcSegGIiXNKC5FCB9+4tnsNGiEIxBFX1UZLLwxsHwM=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.13.0",
+    "rev": "v3.14.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Ptjd4A/P2pZL5wP8IGHN385jngfS56w7FN1g/EpknRw="
+    "vendorHash": "sha256-AR62fegcN9+qTuKwGbb8cEem8nsjgRQkYm3R3VNzYKA="
   },
   "nomad": {
     "hash": "sha256-oHY+jM4JQgLlE1wd+/H9H8H2g0e9ZuxI6OMlz3Izfjg=",
@@ -812,11 +812,11 @@
     "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
   },
   "oci": {
-    "hash": "sha256-ecel4aXOqkPmeOzG5G/D8vmjo2HP9TG+c8H27pCYn2g=",
+    "hash": "sha256-mzAfqJcAZEFGmptjaXAtbmcrtVyufd2LLTe8TmFHtQc=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v4.106.0",
+    "rev": "v4.107.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -983,13 +983,13 @@
     "vendorHash": null
   },
   "selectel": {
-    "hash": "sha256-glIvlf5lWwkdZKn4rxhR+XnBqUdu9RO+loxke07i2c0=",
+    "hash": "sha256-gZiDFcrQZsOE0R74LYwoitAjuPqPZCPLTEL3giom+c8=",
     "homepage": "https://registry.terraform.io/providers/selectel/selectel",
     "owner": "selectel",
     "repo": "terraform-provider-selectel",
-    "rev": "v3.9.0",
+    "rev": "v3.9.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-0UOC70RWcEb/YqPrrc7k+dY7jBuTZLWvUTNxuUZIyu4="
+    "vendorHash": "sha256-+Duf/wdjmw6NBhmy1KmNRJ+ZEjjwtJoXXQCw2lJzxS4="
   },
   "sentry": {
     "hash": "sha256-L/aZ4/xCVZk3C6AGglzCj5T9XnoI/uiLbRASNAHwcro=",
@@ -1219,13 +1219,13 @@
     "vendorHash": null
   },
   "vsphere": {
-    "hash": "sha256-UwhIGK1zQ++IuwAKH9i+Dlu2vvXkMYL+s1P03qKSe3E=",
+    "hash": "sha256-VScIcK4bInS9yhIYkYRsU8Hhzex9iyVkPiyjnnjshkI=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vsphere",
     "owner": "hashicorp",
     "repo": "terraform-provider-vsphere",
-    "rev": "v2.2.0",
+    "rev": "v2.3.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-160GDEQfymeCJpjYOoWP5sGQ0PJHw9kKPaefmbF5Ig4="
+    "vendorHash": "sha256-guUjkk7oW+Gvu015LUAxGqUwZF4H+4xmmOaMqKixZaI="
   },
   "vultr": {
     "hash": "sha256-DfiJgN1R7qW3c13hBabsMizY3mYamIq8AGms1q9kdVU=",

pkgs/applications/networking/cluster/terraform/default.nix

@@ -168,9 +168,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.3.7";
+    version = "1.3.8";
-    sha256 = "sha256-z49DXJ9oYObJQWHPeuKvQ6jJtAheYuy0+QmvZ74ZbTQ";
+    sha256 = "sha256-AXLk5s3qu3QZ1aXx/FwPNq3hM26skBj0wyn/x8nVMkE=";
-    vendorSha256 = "sha256-fviukVGBkbxFs2fJpEp/tFMymXex7NRQdcGIIA9W88k=";
+    vendorSha256 = "sha256-CE6jNBvM0980+R0e5brK5lMrkad+91qTt9mp2h3NZyY=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;

pkgs/applications/networking/cluster/tfswitch/default.nix

@@ -1,16 +1,16 @@
 { buildGoModule, lib, fetchFromGitHub }:
 buildGoModule rec {
   pname = "tfswitch";
-  version = "0.13.1300";
+  version = "0.13.1308";
 
   src = fetchFromGitHub {
     owner = "warrensbox";
     repo = "terraform-switcher";
     rev = version;
-    sha256 = "sha256-btvoFllCfwQJNpRWdAB05Cu4JYmT1xynJxDbzO/6LDs=";
+    sha256 = "sha256-EyA7LwfL3vCNzd2wpyUbrUnvkM0/f7/cQp+jcAcGZsg=";
   };
 
-  vendorSha256 = "sha256-NX+vzI/Fa/n9ZQjpESes4fNVAmKlA1rqPwSKsL2GEUY=";
+  vendorHash = "sha256-NX+vzI/Fa/n9ZQjpESes4fNVAmKlA1rqPwSKsL2GEUY=";
 
   # Disable tests since it requires network access and relies on the
   # presence of release.hashicorp.com

pkgs/applications/networking/nali/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nali";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "zu1k";
     repo = "nali";
     rev = "v${version}";
-    sha256 = "sha256-NHTS9YajVjyAjSEQxMqyyY2Hwd30pjnIthZ+1jroqTE=";
+    sha256 = "sha256-ZJnQiTcfvxHFgRNytQANs/lF4hy0S0cXOy8IuGECYi0=";
   };
 
-  vendorSha256 = "sha256-1sXG/xEzPVN1aRCsYqUee9aidT+ognZszOC7SR8YArw=";
+  vendorHash = "sha256-TLij88IksL0+pARKVhEhPg6qUPAXMlL2DWJk4ynahUs=";
   subPackages = [ "." ];
 
   meta = with lib; {

pkgs/applications/virtualization/podman/default.nix

@@ -18,13 +18,13 @@
 
 buildGoModule rec {
   pname = "podman";
-  version = "4.4.0";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    sha256 = "sha256-kyeON8S7CCVdHt09wigNXDWScgyaLzC4EhOts8ViP2w=";
+    hash = "sha256-Uha5ueOGNmG2f+1I89uFQKA3pSSp1d02FGy86Fc2eWE=";
   };
 
   patches = [
@@ -32,7 +32,7 @@ buildGoModule rec {
     ./rm-podman-mac-helper-msg.patch
   ];
 
-  vendorSha256 = null;
+  vendorHash = null;
 
   doCheck = false;
 

pkgs/applications/virtualization/sail-riscv/default.nix

@@ -0,0 +1,55 @@
+{ stdenv
+, fetchFromGitHub
+, lib
+, arch
+, ocamlPackages
+, ocaml
+, zlib
+, z3
+}:
+
+
+stdenv.mkDerivation rec {
+  pname = "sail-riscv";
+  version = "0.5";
+
+  src = fetchFromGitHub {
+    owner = "riscv";
+    repo = pname;
+    rev = version;
+    hash = "sha256-7PZNNUMaCZEBf0lOCqkquewRgZPooBOjIbGF7JlLnEo=";
+  };
+
+  nativeBuildInputs = with ocamlPackages; [ ocamlbuild findlib ocaml z3 sail ];
+  buildInputs = with ocamlPackages; [ zlib linksem ];
+  strictDeps = true;
+
+  postPatch = ''
+    rm -r prover_snapshots
+  '';
+
+  makeFlags = [
+    "SAIL=sail"
+    "ARCH=${arch}"
+    "SAIL_DIR=${ocamlPackages.sail}/share/sail"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp c_emulator/riscv_sim_${arch} $out/bin
+    mkdir $out/share/
+    cp -r generated_definitions/{coq,hol4,isabelle} $out/share/
+
+    runHook postInstall
+  '';
+
+
+  meta = with lib; {
+    homepage = "https://github.com/riscv/sail-riscv";
+    description = "A formal specification of the RISC-V architecture, written in Sail";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.bsd2;
+  };
+}

pkgs/build-support/binary-cache/default.nix

@@ -0,0 +1,40 @@
+{ stdenv, buildPackages }:
+
+# This function is for creating a flat-file binary cache, i.e. the kind created by
+# nix copy --to file:///some/path and usable as a substituter (with the file:// prefix).
+
+# For example, in the Nixpkgs repo:
+# nix-build -E 'with import ./. {}; mkBinaryCache { rootPaths = [hello]; }'
+
+{ name ? "binary-cache"
+, rootPaths
+}:
+
+stdenv.mkDerivation {
+  inherit name;
+
+  __structuredAttrs = true;
+
+  exportReferencesGraph.closure = rootPaths;
+
+  preferLocalBuild = true;
+
+  PATH = "${buildPackages.coreutils}/bin:${buildPackages.jq}/bin:${buildPackages.python3}/bin:${buildPackages.nix}/bin:${buildPackages.xz}/bin";
+
+  builder = builtins.toFile "builder" ''
+    . .attrs.sh
+
+    export out=''${outputs[out]}
+
+    mkdir $out
+    mkdir $out/nar
+
+    python ${./make-binary-cache.py}
+
+    # These directories must exist, or Nix might try to create them in LocalBinaryCacheStore::init(),
+    # which fails if mounted read-only
+    mkdir $out/realisations
+    mkdir $out/debuginfo
+    mkdir $out/log
+  '';
+}

pkgs/build-support/binary-cache/make-binary-cache.py

@@ -0,0 +1,43 @@
+
+import json
+import os
+import subprocess
+
+with open(".attrs.json", "r") as f:
+  closures = json.load(f)["closure"]
+
+os.chdir(os.environ["out"])
+
+nixPrefix = os.environ["NIX_STORE"] # Usually /nix/store
+
+with open("nix-cache-info", "w") as f:
+  f.write("StoreDir: " + nixPrefix + "\n")
+
+def dropPrefix(path):
+  return path[len(nixPrefix + "/"):]
+
+for item in closures:
+  narInfoHash = dropPrefix(item["path"]).split("-")[0]
+
+  xzFile = "nar/" + narInfoHash + ".nar.xz"
+  with open(xzFile, "w") as f:
+    subprocess.run("nix-store --dump %s | xz -c" % item["path"], stdout=f, shell=True)
+
+  fileHash = subprocess.run(["nix-hash", "--base32", "--type", "sha256", item["path"]], capture_output=True).stdout.decode().strip()
+  fileSize = os.path.getsize(xzFile)
+
+  # Rename the .nar.xz file to its own hash to match "nix copy" behavior
+  finalXzFile = "nar/" + fileHash + ".nar.xz"
+  os.rename(xzFile, finalXzFile)
+
+  with open(narInfoHash + ".narinfo", "w") as f:
+    f.writelines((x + "\n" for x in [
+      "StorePath: " + item["path"],
+      "URL: " + finalXzFile,
+      "Compression: xz",
+      "FileHash: sha256:" + fileHash,
+      "FileSize: " + str(fileSize),
+      "NarHash: " + item["narHash"],
+      "NarSize: " + str(item["narSize"]),
+      "References: " + " ".join(dropPrefix(ref) for ref in item["references"]),
+    ]))

pkgs/desktops/pantheon/apps/appcenter/default.nix

@@ -25,13 +25,13 @@
 
 stdenv.mkDerivation rec {
   pname = "appcenter";
-  version = "7.1.0";
+  version = "7.2.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ToRY27qB/cNKjKW22MTEojxxOXMBfO1LUusy/pXKJ9A=";
+    sha256 = "sha256-XWDhQ5Nu+gGj0/TQ/fALxQJ+QXzMiHm0Qh9FlGiskEA=";
   };
 
   patches = [

pkgs/development/compilers/circt/default.nix

@@ -38,6 +38,19 @@ stdenv.mkDerivation rec {
     "-DCIRCT_LLHD_SIM_ENABLED=OFF"
   ];
 
+  # There are some tests depending on `clang-tools` to work. They are activated only when detected
+  # `clang-tidy` in PATH, However, we cannot simply put `clang-tools` in checkInputs to make these
+  # tests work. Because
+  #
+  # 1. The absolute paths of binaries used in tests are resolved in configure phase.
+  # 2. When stdenv = clangStdenv, the `clang-tidy` binary appears in PATH via `clang-unwrapped`,
+  #    which is always placed before `${clang-tools}/bin` in PATH. `clang-tidy` provided in
+  #    `clang-unwrapped` cause tests failing because it is not wrapped to resolve header search paths.
+  #    https://github.com/NixOS/nixpkgs/issues/214945 discusses this issue.
+  #
+  # As a temporary fix, we disabled these tests when using clang stdenv
+  LIT_FILTER_OUT = lib.optionalString stdenv.cc.isClang "CIRCT :: Target/ExportSystemC/.*\.mlir";
+
   preConfigure = ''
     substituteInPlace test/circt-reduce/test/annotation-remover.mlir --replace "/usr/bin/env" "${coreutils}/bin/env"
   '';

pkgs/development/compilers/gcc/10/default.nix

@@ -158,34 +158,32 @@ stdenv.mkDerivation ({
   inherit noSysDirs staticCompiler crossStageStatic
     libcCross crossMingw;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  inherit (import ../common/dependencies.nix {
-  nativeBuildInputs = [ texinfo which gettext ]
+    inherit
-    ++ (optional (perl != null) perl)
+      lib
-    ++ (optional langAda gnatboot)
+      stdenv
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+      buildPackages
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+      targetPackages
-    ++ (optional buildPlatform.isDarwin gnused)
+      crossStageStatic
+      threadsCross
+      langAda
+      libxcrypt
+      gnatboot
+      version
+      texinfo
+      which
+      gettext
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      zip
+      perl
     ;
-
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc libxcrypt
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {} && threadsCross.package != null) threadsCross.package;
 
   NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 

pkgs/development/compilers/gcc/11/default.nix

@@ -164,34 +164,32 @@ stdenv.mkDerivation ({
   inherit noSysDirs staticCompiler crossStageStatic
     libcCross crossMingw;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  inherit (import ../common/dependencies.nix {
-  nativeBuildInputs = [ texinfo which gettext ]
+    inherit
-    ++ (optional (perl != null) perl)
+      lib
-    ++ (optional langAda gnatboot)
+      stdenv
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+      buildPackages
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+      targetPackages
-    ++ (optional buildPlatform.isDarwin gnused)
+      crossStageStatic
+      threadsCross
+      langAda
+      libxcrypt
+      gnatboot
+      version
+      texinfo
+      which
+      gettext
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      zip
+      perl
     ;
-
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc libxcrypt
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {} && threadsCross.package != null) threadsCross.package;
 
   NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 

pkgs/development/compilers/gcc/12/default.nix

@@ -198,35 +198,34 @@ stdenv.mkDerivation ({
   inherit noSysDirs staticCompiler crossStageStatic
     libcCross crossMingw;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  inherit (import ../common/dependencies.nix {
-  nativeBuildInputs = [ texinfo which gettext ]
+    inherit
-    ++ (optional (perl != null) perl)
+      lib
-    ++ (optional langAda gnatboot)
+      stdenv
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+      buildPackages
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+      targetPackages
-    ++ (optional buildPlatform.isDarwin gnused)
+      crossStageStatic
+      threadsCross
+      langAda
+      langGo
+      libucontext
+      libxcrypt
+      gnatboot
+      version
+      texinfo
+      which
+      gettext
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      zip
+      perl
     ;
-
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc libxcrypt
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ++ (optional (langGo && stdenv.hostPlatform.isMusl) libucontext)
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross.package;
 
   NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 

pkgs/development/compilers/gcc/4.8/default.nix

@@ -158,37 +158,38 @@ stdenv.mkDerivation ({
   inherit noSysDirs staticCompiler langJava crossStageStatic
     libcCross crossMingw;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  inherit (import ../common/dependencies.nix {
-  nativeBuildInputs = [ texinfo which gettext ]
+    inherit
-    ++ (optional (perl != null) perl)
+      lib
-    ++ (optional javaAwtGtk pkg-config)
+      stdenv
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+      buildPackages
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+      targetPackages
-    ++ (optional buildPlatform.isDarwin gnused)
+      crossStageStatic
+      threadsCross
+      version
+      langJava
+      javaAwtGtk
+      texinfo
+      which
+      gettext
+      pkg-config
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      cloog
+      isl
+      zlib
+      boehmgc
+      zip
+      unzip
+      gtk2
+      libart_lgpl
+      perl
+      xlibs
     ;
-
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (cloog != null) cloog)
-    ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ++ (optionals langJava [ boehmgc zip unzip ])
-    ++ (optionals javaAwtGtk ([ gtk2 libart_lgpl ] ++ xlibs))
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross;
 
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;

pkgs/development/compilers/gcc/4.9/default.nix

@@ -178,37 +178,38 @@ stdenv.mkDerivation ({
   inherit noSysDirs staticCompiler langJava crossStageStatic
     libcCross crossMingw;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  inherit (import ../common/dependencies.nix {
-  nativeBuildInputs = [ texinfo which gettext ]
+    inherit
-    ++ (optional (perl != null) perl)
+      lib
-    ++ (optional javaAwtGtk pkg-config)
+      stdenv
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+      buildPackages
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+      targetPackages
-    ++ (optional buildPlatform.isDarwin gnused)
+      crossStageStatic
+      threadsCross
+      version
+      langJava
+      javaAwtGtk
+      texinfo
+      which
+      gettext
+      pkg-config
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      cloog
+      isl
+      zlib
+      boehmgc
+      zip
+      unzip
+      gtk2
+      libart_lgpl
+      perl
+      xlibs
     ;
-
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (cloog != null) cloog)
-    ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ++ (optionals langJava [ boehmgc zip unzip ])
-    ++ (optionals javaAwtGtk ([ gtk2 libart_lgpl ] ++ xlibs))
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross;
 
   preConfigure = import ../common/pre-configure.nix {
     inherit lib;

pkgs/development/compilers/gcc/6/default.nix

@@ -193,38 +193,40 @@ stdenv.mkDerivation ({
   inherit noSysDirs staticCompiler langJava crossStageStatic
     libcCross crossMingw;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  inherit (import ../common/dependencies.nix {
-  nativeBuildInputs = [ texinfo which gettext ]
+    inherit
-    ++ (optional (perl != null) perl)
+      lib
-    ++ (optional javaAwtGtk pkg-config)
+      stdenv
-    ++ (optional (with stdenv.targetPlatform; isVc4 || isRedox) flex)
+      buildPackages
-    ++ (optional langAda gnatboot)
+      targetPackages
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+      crossStageStatic
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+      threadsCross
-    ++ (optional buildPlatform.isDarwin gnused)
+      version
+      langAda
+      gnatboot
+      flex
+      langJava
+      javaAwtGtk
+      texinfo
+      which
+      gettext
+      pkg-config
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      boehmgc
+      zip
+      unzip
+      gtk2
+      libart_lgpl
+      perl
+      xlibs
     ;
-
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ++ (optionals langJava [ boehmgc zip unzip ])
-    ++ (optionals javaAwtGtk ([ gtk2 libart_lgpl ] ++ xlibs))
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross.package;
 
   NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 

pkgs/development/compilers/gcc/7/default.nix

@@ -165,33 +165,29 @@ stdenv.mkDerivation ({
   inherit noSysDirs staticCompiler crossStageStatic
     libcCross crossMingw;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  inherit (import ../common/dependencies.nix {
-  nativeBuildInputs = [ texinfo which gettext ]
+    inherit
-    ++ (optional (perl != null) perl)
+      lib
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+      stdenv
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+      buildPackages
-    ++ (optional buildPlatform.isDarwin gnused)
+      targetPackages
+      crossStageStatic
+      threadsCross
+      version
+      texinfo
+      which
+      gettext
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      zip
+      perl
     ;
-
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross.package;
 
   NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument";
   NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";

pkgs/development/compilers/gcc/8/default.nix

@@ -147,33 +147,29 @@ stdenv.mkDerivation ({
   inherit noSysDirs staticCompiler crossStageStatic
     libcCross crossMingw;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  inherit (import ../common/dependencies.nix {
-  nativeBuildInputs = [ texinfo which gettext ]
+    inherit
-    ++ (optional (perl != null) perl)
+      lib
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+      stdenv
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+      buildPackages
-    ++ (optional buildPlatform.isDarwin gnused)
+      targetPackages
+      crossStageStatic
+      threadsCross
+      version
+      texinfo
+      which
+      gettext
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      zip
+      perl
     ;
-
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross.package;
 
   NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 

pkgs/development/compilers/gcc/9/default.nix

@@ -158,34 +158,31 @@ stdenv.mkDerivation ({
   inherit noSysDirs staticCompiler crossStageStatic
     libcCross crossMingw;
 
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
+  inherit (import ../common/dependencies.nix {
-  nativeBuildInputs = [ texinfo which gettext ]
+    inherit
-    ++ (optional (perl != null) perl)
+      lib
-    ++ (optional langAda gnatboot)
+      stdenv
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+      buildPackages
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+      targetPackages
-    ++ (optional buildPlatform.isDarwin gnused)
+      crossStageStatic
+      threadsCross
+      langAda
+      gnatboot
+      version
+      texinfo
+      which
+      gettext
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      zip
+      perl
     ;
-
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross.package;
 
   NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
 

pkgs/development/compilers/gcc/common/dependencies.nix

@@ -0,0 +1,92 @@
+{ lib
+, stdenv
+, version
+, buildPackages
+, targetPackages
+, texinfo
+, which
+, gettext
+, pkg-config ? null
+, gnused
+, patchelf
+, gmp
+, mpfr
+, libmpc
+, libucontext ? null
+, libxcrypt ? null
+, cloog ? null
+, isl ? null
+, zlib ? null
+, gnatboot ? null
+, flex ? null
+, boehmgc ? null
+, zip ? null
+, unzip ? null
+, gtk2 ? null
+, libart_lgpl ? null
+, perl ? null
+, xlibs ? null
+, langJava ? false
+, javaAwtGtk ? false
+, langAda ? false
+, langGo ? false
+, crossStageStatic ? null
+, threadsCross ? null
+}:
+
+let
+  inherit (lib) optionals;
+  inherit (stdenv) buildPlatform hostPlatform targetPlatform;
+in
+
+{
+  # same for all gcc's
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [
+    texinfo
+    which
+    gettext
+  ]
+  ++ optionals (perl != null) [ perl ]
+  ++ optionals javaAwtGtk [ pkg-config ]
+  ++ optionals (with stdenv.targetPlatform; isVc4 || isRedox && flex != null) [ flex ]
+  ++ optionals langAda [ gnatboot ]
+  # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+  # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+  ++ optionals buildPlatform.isDarwin [ gnused ]
+  ;
+
+  # For building runtime libs
+  # same for all gcc's
+  depsBuildTarget =
+    (
+      if hostPlatform == buildPlatform then [
+        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
+      ] else assert targetPlatform == hostPlatform; [
+        # build != host == target
+        stdenv.cc
+      ]
+    )
+    ++ optionals targetPlatform.isLinux [ patchelf ];
+
+  buildInputs = [
+    gmp
+    mpfr
+    libmpc
+  ]
+  ++ optionals (lib.versionAtLeast version "10") [ libxcrypt ]
+  ++ [
+    targetPackages.stdenv.cc.bintools # For linking code at run-time
+  ]
+  ++ optionals (cloog != null) [ cloog ]
+  ++ optionals (isl != null) [ isl ]
+  ++ optionals (zlib != null) [ zlib ]
+  ++ optionals langJava [ boehmgc zip unzip ]
+  ++ optionals javaAwtGtk ([ gtk2 libart_lgpl ] ++ xlibs)
+  ++ optionals (langGo && stdenv.hostPlatform.isMusl) [ libucontext ]
+  ;
+
+  # threadsCross.package after gcc6 so i assume its okay for 4.8 and 4.9 too
+  depsTargetTarget = optionals (!crossStageStatic && threadsCross != { } && threadsCross.package != null) [ threadsCross.package ];
+}

pkgs/development/compilers/kotlin/native.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "kotlin-native";
-  version = "1.8.0";
+  version = "1.8.10";
 
   src = let
     getArch = {
@@ -20,9 +20,9 @@ stdenv.mkDerivation rec {
       "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-native-${arch}-${version}.tar.gz";
 
     getHash = arch: {
-      "macos-aarch64" = "19dcc2ylh11vxirglda8xrrm06i2nd53ndd8b1smf2vyj0v9593m";
+      "macos-aarch64" = "119ar6wax0bkp5fmardplhsvaw1jhpfr5xgkpkkv10nmx4agbkh8";
-      "macos-x86_64" = "0pkc4g09qwp4lcvs62qis0zxdjbr9z5mbgyi4mczxx5kqha4fxp3";
+      "macos-x86_64" = "1nqqzx397k1ifpdymaw39iz5mzpyi7n00kpw03y5iq5avzr7rsjj";
-      "linux-x86_64" = "124nvhjh9xj8nsdjf71vzsgfjdq6mc0nalk79xfvsp2wh7xd8d0n";
+      "linux-x86_64" = "0hlpda33y07d8dybjn65gzdl0ws0r8vda515pr2rhfisls18lp2c";
     }.${arch};
   in
     fetchurl {

pkgs/development/compilers/picat/default.nix

@@ -9,11 +9,11 @@ let
 in
 stdenv.mkDerivation {
   pname = "picat";
-  version = "3.0p4";
+  version = "3.3p3";
 
   src = fetchurl {
-    url    = "http://picat-lang.org/download/picat30_4_src.tar.gz";
+    url = "http://picat-lang.org/download/picat333_src.tar.gz";
-    sha256 = "1rwin44m7ni2h2v51sh2r8gj2k6wm6f86zgaylrria9jr57inpqj";
+    hash = "sha256-LMmAHCGKgon/wNbrXTUH9hiHyGVwwSDpB1236xawzXs=";
   };
 
   buildInputs = [ zlib ];

pkgs/development/interpreters/python/default.nix

@@ -196,9 +196,9 @@ in {
       major = "3";
       minor = "12";
       patch = "0";
-      suffix = "a3";
+      suffix = "a5";
     };
-    sha256 = "sha256-G2SzB14KkkGXTlgOCbCckRehxOK+aYA5IB7x2Kc0U9E=";
+    sha256 = "sha256-1m73o0L+OjVvnO47uXrcHl+0hA9rbP994P991JX4Mjs=";
     inherit (darwin) configd;
     inherit passthruFun;
   };

pkgs/development/interpreters/racket/default.nix

@@ -50,7 +50,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "racket";
-  version = "8.7"; # always change at once with ./minimal.nix
+  version = "8.8"; # always change at once with ./minimal.nix
 
   src = (lib.makeOverridable ({ name, sha256 }:
     fetchurl {
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
     }
   )) {
     name = "${pname}-${version}";
-    sha256 = "sha256-dqfmbUfnPrDcP8on/IGONuHUv/502iY8Xv47iAGjCgE=";
+    sha256 = "sha256-OYQi4rQjc+FOTg+W2j2Vy1dEJHuj9z6pmBX7aTwnFKs=";
   };
 
   FONTCONFIG_FILE = fontsConf;

pkgs/development/interpreters/racket/minimal.nix

@@ -6,7 +6,7 @@ racket.overrideAttrs (oldAttrs: rec {
   version = oldAttrs.version;
   src = oldAttrs.src.override {
     name = "${pname}-${version}";
-    sha256 = "sha256-Iy7ZzxfNf3Q7LM9z13XsNbWvJrJeVREprrYDi7DNwOw=";
+    sha256 = "sha256-KaYT1PzHtGYej3CZEnensGiFaR9+487XueiZf3e+hQU=";
   };
 
   meta = oldAttrs.meta // {

pkgs/development/interpreters/trealla/default.nix

@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, readline, openssl, libffi, withThread ? true, withSSL ? true, xxd }:
+{ lib, stdenv, fetchFromGitHub, readline, openssl, libffi, valgrind, withThread ? true, withSSL ? true, xxd }:
 
 stdenv.mkDerivation rec {
   pname = "trealla";
-  version = "2.2.6";
+  version = "2.8.4";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${version}";
-    sha256 = "sha256-DxlexijQPcNxlPjo/oIvsN//8nZ0injXFHc2t3n4yjg=";
+    sha256 = "sha256-/jB4jlYotvdU068+zj9Z+G0g75sI9dTmtgN874i0qAE=";
   };
 
   postPatch = ''
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ xxd ];
   buildInputs = [ readline openssl libffi ];
+  checkInputs = [ valgrind ];
   enableParallelBuilding = true;
 
   installPhase = ''

pkgs/development/libraries/draco/default.nix

@@ -16,17 +16,23 @@ let
   cmakeBool = b: if b then "ON" else "OFF";
 in
 stdenv.mkDerivation rec {
-  version = "1.5.5";
+  version = "1.5.6";
   pname = "draco";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "draco";
     rev = version;
-    sha256 = "sha256-WYWEUfBPz/Pt7sE8snG3/LnOA3DEUm/SUVLtsH7zG5g=";
+    hash = "sha256-2YQMav0JJMbJ2bvnN/Xv90tjE/OWLbrZDO4WlaOvcfI=";
     fetchSubmodules = true;
   };
 
+  # ld: unknown option: --start-group
+  postPatch = ''
+    substituteInPlace cmake/draco_targets.cmake \
+      --replace "^Clang" "^AppleClang"
+  '';
+
   buildInputs = [ gtest ]
     ++ lib.optionals withTranscoder [ eigen ghc_filesystem tinygltf ];
 

pkgs/development/libraries/gss/default.nix

@@ -1,18 +1,26 @@
-{ lib, stdenv, fetchurl
+{ lib
-, withShishi ? !stdenv.isDarwin, shishi
+, stdenv
+, fetchurl
+, withShishi ? !stdenv.isDarwin
+, shishi
 }:
 
 stdenv.mkDerivation rec {
   pname = "gss";
-  version = "1.0.3";
+  version = "1.0.4";
 
   src = fetchurl {
     url = "mirror://gnu/gss/gss-${version}.tar.gz";
-    sha256 = "1syyvh3k659xf1hdv9pilnnhbbhs6vfapayp4xgdcc8mfgf9v4gz";
+    hash = "sha256-7M6r3vTK4/znIYsuy4PrQifbpEtTthuMKy6IrgJBnHM=";
   };
 
   buildInputs = lib.optional withShishi shishi;
 
+  # ./stdint.h:89:5: error: expected value in expression
+  preConfigure = lib.optionalString stdenv.isDarwin ''
+    export GNULIBHEADERS_OVERRIDE_WINT_T=0
+  '';
+
   configureFlags = [
     "--${if withShishi then "enable" else "disable"}-kerberos5"
   ];

pkgs/development/libraries/ldb/default.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ldb";
-  version = "2.3.0";
+  version = "2.6.1";
 
   src = fetchurl {
     url = "mirror://samba/ldb/${pname}-${version}.tar.gz";
-    sha256 = "0bcjj4gv48ddg44wyxpsvrs26xry6yy9x9k16qgz0bljs2rhilx4";
+    sha256 = "sha256-RnQD9334Z4LDlluxdUQLqi7XUan+uVYBlL2MBr8XNsk=";
   };
 
   outputs = [ "out" "dev" ];
@@ -44,6 +44,13 @@ stdenv.mkDerivation rec {
     cmocka
   ];
 
+  # otherwise the configure script fails with
+  # PYTHONHASHSEED=1 missing! Don't use waf directly, use ./configure and make!
+  preConfigure = ''
+    export PKGCONFIG="$PKG_CONFIG"
+    export PYTHONHASHSEED=1
+  '';
+
   wafPath = "buildtools/bin/waf";
 
   wafConfigureFlags = [

pkgs/development/libraries/libpgf/default.nix

@@ -1,21 +1,29 @@
-{ lib, stdenv, fetchzip, autoreconfHook }:
+{ lib
+, stdenv
+, fetchzip
+, autoreconfHook
+, dos2unix
+}:
 
 stdenv.mkDerivation rec {
   pname = "libpgf";
-  version = "7.21.2";
+  version = "7.21.7";
 
   src = fetchzip {
     url = "mirror://sourceforge/${pname}/${pname}/${version}/${pname}.zip";
-    sha256 = "0l1j5b1d02jn27miggihlppx656i0pc70cn6x89j1rpj33zn0g9r";
+    hash = "sha256-TAWIuikijfyeTRetZWoMMdB/FeGAR7ZjNssVxUevlVg=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  postPatch = ''
-
+    find . -type f | xargs dos2unix
-  autoreconfPhase = ''
     mv README.txt README
-    sh autogen.sh
   '';
 
+  nativeBuildInputs = [
+    autoreconfHook
+    dos2unix
+  ];
+
   meta = {
     homepage = "https://www.libpgf.org/";
     description = "Progressive Graphics Format";

pkgs/development/libraries/talloc/default.nix

@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "talloc";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchurl {
     url = "mirror://samba/talloc/${pname}-${version}.tar.gz";
-    sha256 = "sha256-a+lbI2i9CvHEzXqIFG62zuoY5Gw//JMwv2JitA0diqo=";
+    sha256 = "sha256-F5+eviZeZ+SrLCbK0rfeS2p3xsIS+WaQM4KGnwa+ZQU=";
   };
 
   nativeBuildInputs = [
@@ -37,6 +37,13 @@ stdenv.mkDerivation rec {
     libxcrypt
   ];
 
+  # otherwise the configure script fails with
+  # PYTHONHASHSEED=1 missing! Don't use waf directly, use ./configure and make!
+  preConfigure = ''
+    export PKGCONFIG="$PKG_CONFIG"
+    export PYTHONHASHSEED=1
+  '';
+
   wafPath = "buildtools/bin/waf";
 
   wafConfigureFlags = [

pkgs/development/libraries/tdb/default.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tdb";
-  version = "1.4.6";
+  version = "1.4.7";
 
   src = fetchurl {
     url = "mirror://samba/tdb/${pname}-${version}.tar.gz";
-    sha256 = "sha256-1okr2L7+BKd2QqHdVuSoeTSb8c9bLAv1+4QQYZON7ws=";
+    sha256 = "sha256-pPsWje9TPzH/LAf32YRLsxMeZ5nwlOvnfQOArcmHwg4=";
   };
 
   nativeBuildInputs = [
@@ -34,6 +34,13 @@ stdenv.mkDerivation rec {
     libxcrypt
   ];
 
+  # otherwise the configure script fails with
+  # PYTHONHASHSEED=1 missing! Don't use waf directly, use ./configure and make!
+  preConfigure = ''
+    export PKGCONFIG="$PKG_CONFIG"
+    export PYTHONHASHSEED=1
+  '';
+
   wafPath = "buildtools/bin/waf";
 
   wafConfigureFlags = [

pkgs/development/libraries/tevent/default.nix

@@ -2,6 +2,7 @@
 , fetchurl
 , python3
 , pkg-config
+, cmocka
 , readline
 , talloc
 , libxslt
@@ -13,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tevent";
-  version = "0.10.2";
+  version = "0.13.0";
 
   src = fetchurl {
     url = "mirror://samba/tevent/${pname}-${version}.tar.gz";
-    sha256 = "15k6i8ad5lpxfjsjyq9h64zlyws8d3cm0vwdnaw8z1xjwli7hhpq";
+    sha256 = "sha256-uUN6kX+lU0Q2G+tk7J4AQumcroh5iCpi3Tj2q+I3HQw=";
   };
 
   nativeBuildInputs = [
@@ -32,10 +33,18 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     python3
+    cmocka
     readline # required to build python
     talloc
   ];
 
+  # otherwise the configure script fails with
+  # PYTHONHASHSEED=1 missing! Don't use waf directly, use ./configure and make!
+  preConfigure = ''
+    export PKGCONFIG="$PKG_CONFIG"
+    export PYTHONHASHSEED=1
+  '';
+
   wafPath = "buildtools/bin/waf";
 
   wafConfigureFlags = [

pkgs/development/libraries/zint/default.nix

@@ -12,17 +12,15 @@
 
 stdenv.mkDerivation rec {
   pname = "zint";
-  version = "2.11.1";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "zint";
     repo = "zint";
     rev = version;
-    sha256 = "sha256-ozhXy7ftmGz1XvmF8AS1ifWJ3Q5hLSsysB8qLUP60n8=";
+    hash = "sha256-Ay6smir6zUpadmw1WpU+F7e9t7Gk3JNVtf2VVu92bDk=";
   };
 
-  patches = [ ./qobject.patch ];
-
   outputs = [ "out" "dev" ];
 
   nativeBuildInputs = [ cmake wrapQtAppsHook ];

pkgs/development/libraries/zint/qobject.patch

@@ -1,12 +0,0 @@
-diff --git a/backend_qt/qzint.h b/backend_qt/qzint.h
-index d57ab6a..62fb0a4 100644
---- a/backend_qt/qzint.h
-+++ b/backend_qt/qzint.h
-@@ -19,6 +19,7 @@
- #ifndef QZINT_H
- #define QZINT_H
- 
-+#include <QObject>
- #include <QColor>
- #include <QPainter>
- #include "zint.h"

pkgs/development/mobile/androidenv/ndk-bundle/default.nix

@@ -49,7 +49,7 @@ deployAndroidPackage {
     done
 
     # Patch executables
-    if [ -d prebuild/linux-x86_64 ]; then
+    if [ -d prebuilt/linux-x86_64 ]; then
         autoPatchelf prebuilt/linux-x86_64
     fi
 

pkgs/development/ocaml-modules/lem/default.nix

@@ -0,0 +1,45 @@
+{ stdenv
+, fetchFromGitHub
+, lib
+, ncurses
+, makeWrapper
+, ocamlbuild
+, findlib
+, ocaml
+, num
+, zarith
+}:
+
+lib.throwIfNot (lib.versionAtLeast ocaml.version "4.07")
+  "lem is not available for OCaml ${ocaml.version}"
+
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-lem";
+  version = "2022-12-10";
+
+  src = fetchFromGitHub {
+    owner = "rems-project";
+    repo = "lem";
+    rev = version;
+    hash = "sha256-ZQgcuIVRkJS0KtpzjbO4OPHGg6B0TadWA6XpRir30y8=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ocamlbuild findlib ocaml ];
+  propagatedBuildInputs = [ zarith num ];
+
+  installFlags = [ "INSTALL_DIR=$(out)" ];
+
+  createFindlibDestdir = true;
+
+  postInstall = ''
+    wrapProgram $out/bin/lem --set LEMLIB $out/share/lem/library
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/rems-project/lem";
+    description = "A tool for lightweight executable mathematics";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = with licenses; [ bsd3 gpl2 ];
+    platforms = ocaml.meta.platforms;
+  };
+}

pkgs/development/ocaml-modules/linksem/default.nix

@@ -0,0 +1,36 @@
+{ lib
+, fetchFromGitHub
+, stdenv
+, findlib
+, ocaml
+, lem
+}:
+
+lib.throwIfNot (lib.versionAtLeast ocaml.version "4.07")
+  "linksem is not available for OCaml ${ocaml.version}"
+
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-linksem";
+  version = "0.8";
+
+  src = fetchFromGitHub {
+    owner = "rems-project";
+    repo = "linksem";
+    rev = version;
+    hash = "sha256-7/YfDK3TruKCckMzAPLRrwBkHRJcX1S+AzXHWRxkZPA=";
+  };
+
+  nativeBuildInputs = [ findlib ocaml ];
+
+  propagatedBuildInputs = [ lem ];
+
+  createFindlibDestdir = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/rems-project/linksem";
+    description = "A formalisation of substantial parts of ELF linking and DWARF debug information";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.bsd2;
+    platforms = ocaml.meta.platforms;
+  };
+}

pkgs/development/ocaml-modules/ppx_deriving_rpc/default.nix

@@ -3,9 +3,10 @@
 buildDunePackage rec {
   pname = "ppx_deriving_rpc";
 
-  inherit (rpclib) version useDune2 src;
+  inherit (rpclib) version src;
 
-  minimumOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   propagatedBuildInputs = [ ppxlib rpclib ppx_deriving ];
 

pkgs/development/ocaml-modules/rpclib/default.nix

@@ -1,24 +1,25 @@
-{ lib, fetchurl, buildDunePackage, ocaml
+{ lib, fetchurl, buildDunePackage
 , alcotest
 , base64, cmdliner, rresult, xmlm, yojson
 }:
 
 buildDunePackage rec {
   pname = "rpclib";
-  version = "8.1.0";
+  version = "9.0.0";
 
-  useDune2 = true;
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";
 
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-rpc/releases/download/v${version}/rpclib-v${version}.tbz";
+    url = "https://github.com/mirage/ocaml-rpc/releases/download/${version}/rpclib-${version}.tbz";
-    sha256 = "0fbajg8wq8hjhkvvfnq68br0m0pa8zf2qzadhfgi2nnr9713rada";
+    hash = "sha256-ziPrdWwCjZN0vRmCMpa923wjfT8FVFLTDRz30VIW6WM=";
   };
 
   buildInputs = [ cmdliner yojson ];
   propagatedBuildInputs = [ base64 rresult xmlm ];
   checkInputs = [ alcotest ];
 
-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;
 
   meta = with lib; {
     homepage = "https://github.com/mirage/ocaml-rpc";

pkgs/development/ocaml-modules/rpclib/lwt.nix

@@ -9,7 +9,8 @@
 
 buildDunePackage {
   pname = "rpclib-lwt";
-  inherit (rpclib) version useDune2 src;
+  inherit (rpclib) version src;
+  duneVersion = "3";
 
   propagatedBuildInputs = [ lwt rpclib ];
 

pkgs/development/ocaml-modules/rresult/default.nix

@@ -1,5 +1,8 @@
 { stdenv, lib, fetchurl, ocaml, findlib, ocamlbuild, topkg, result }:
 
+lib.throwIfNot (lib.versionAtLeast ocaml.version "4.07")
+  "rresult is not available for OCaml ${ocaml.version}"
+
 stdenv.mkDerivation rec {
   pname = "ocaml${ocaml.version}-rresult";
   version = "0.7.0";

pkgs/development/ocaml-modules/sail/default.nix

@@ -0,0 +1,79 @@
+{ lib
+, fetchFromGitHub
+, buildDunePackage
+, base64
+, omd
+, menhir
+, ott
+, linenoise
+, dune-site
+, pprint
+, makeWrapper
+, lem
+, z3
+, linksem
+, num
+}:
+
+buildDunePackage rec {
+  pname = "sail";
+  version = "0.15";
+
+  src = fetchFromGitHub {
+    owner = "rems-project";
+    repo = "sail";
+    rev = version;
+    hash = "sha256-eNdFOSzkniNvSCZeORRJ/IYAu+9P4HSouwmhd4BQLPk=";
+  };
+
+  duneVersion = "3";
+  minimalOCamlVersion = "4.08";
+
+  nativeBuildInputs = [
+    makeWrapper
+    ott
+    menhir
+    lem
+  ];
+
+  propagatedBuildInputs = [
+    base64
+    omd
+    dune-site
+    linenoise
+    pprint
+    linksem
+  ];
+
+  preBuild = ''
+    rm -r aarch*  # Remove code derived from non-bsd2 arm spec
+    rm -r snapshots  # Some of this might be derived from stuff in the aarch dir, it builds fine without it
+  '';
+  # `buildDunePackage` only builds the [pname] package
+  # This doesnt work in this case, as sail includes multiple packages in the same source tree
+  buildPhase = ''
+    runHook preBuild
+    dune build --release ''${enableParallelBuild:+-j $NIX_BUILD_CORES}
+    runHook postBuild
+  '';
+  checkPhase = ''
+    runHook preCheck
+    dune runtest ''${enableParallelBuild:+-j $NIX_BUILD_CORES}
+    runHook postCheck
+  '';
+  installPhase = ''
+    runHook preInstall
+    dune install --prefix $out --libdir $OCAMLFIND_DESTDIR
+    runHook postInstall
+  '';
+  postInstall = ''
+    wrapProgram $out/bin/sail --set SAIL_DIR $out/share/sail
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/rems-project/sail";
+    description = "A language for describing the instruction-set architecture (ISA) semantics of processors";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.bsd2;
+  };
+}

pkgs/development/python-modules/apache-beam/default.nix

@@ -4,6 +4,7 @@
 , cython
 , dill
 , fastavro
+, fasteners
 , fetchFromGitHub
 , fetchpatch
 , freezegun
@@ -11,11 +12,12 @@
 , grpcio-tools
 , hdfs
 , httplib2
+, hypothesis
 , lib
 , mock
 , mypy-protobuf
 , numpy
-, oauth2client
+, objsize
 , orjson
 , pandas
 , parameterized
@@ -26,32 +28,33 @@
 , pydot
 , pyhamcrest
 , pymongo
+, pytest-xdist
 , pytestCheckHook
 , python
 , python-dateutil
-, pythonAtLeast
 , pythonRelaxDepsHook
 , pytz
 , pyyaml
+, regex
 , requests
 , requests-mock
 , scikit-learn
-, setuptools
 , sqlalchemy
 , tenacity
 , testcontainers
 , typing-extensions
+, zstandard
 }:
 
 buildPythonPackage rec {
   pname = "apache-beam";
-  version = "2.43.0";
+  version = "2.44.0";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "beam";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-lqGXCC66eyBnHcK06k9knggX5C+2d0m6xBAI5sh0RHo=";
+    hash = "sha256-5fnZxv2ZkFlv8vGDIt/6EL41v9P1iKa1tEd1nezq+PU=";
   };
 
   patches = [
@@ -62,24 +65,22 @@ buildPythonPackage rec {
       hash = "sha256-iUmnzrItTFM98w3mpadzrmtI3t0fucpSujAg/6qxCGk=";
       stripLen = 2;
     })
-    (fetchpatch {
-      # https://github.com/apache/beam/pull/24573
-      name = "relax-httplib2-version.patch";
-      url = "https://github.com/apache/beam/commit/4045503575ae5ccef3de8d7b868c54e37fef658b.patch";
-      hash = "sha256-YqT+sHaa1R9vLQnEQN2K0lYoCdnGoPY9qduGBpXPaek=";
-      stripLen = 2;
-    })
   ];
 
   pythonRelaxDeps = [
     # See https://github.com/NixOS/nixpkgs/issues/156957
     "dill"
     "numpy"
-    "pyarrow"
     "pymongo"
 
     # See https://github.com/NixOS/nixpkgs/issues/193613
     "protobuf"
+
+    # As of apache-beam v2.44.0, the requirement is httplib2>=0.8,<0.21.0, but
+    # the current (2023-02-08) nixpkgs's httplib2 version is 0.21.0. This can be
+    # removed once beam is upgraded since the current requirement on master is
+    # for httplib2>=0.8,<0.22.0.
+    "httplib2"
   ];
 
   sourceRoot = "source/sdks/python";
@@ -94,14 +95,14 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     cloudpickle
     crcmod
-    cython
     dill
     fastavro
+    fasteners
     grpcio
     hdfs
     httplib2
     numpy
-    oauth2client
+    objsize
     orjson
     proto-plus
     protobuf
@@ -110,9 +111,10 @@ buildPythonPackage rec {
     pymongo
     python-dateutil
     pytz
+    regex
     requests
-    setuptools
     typing-extensions
+    zstandard
   ];
 
   enableParallelBuilding = true;
@@ -121,14 +123,16 @@ buildPythonPackage rec {
     "apache_beam"
   ];
 
-  nativeCheckInputs = [
+  checkInputs = [
     freezegun
+    hypothesis
     mock
     pandas
     parameterized
     psycopg2
     pyhamcrest
     pytestCheckHook
+    pytest-xdist
     pyyaml
     requests-mock
     scikit-learn
@@ -160,6 +164,13 @@ buildPythonPackage rec {
     # Fails starting from dill 0.3.6 because it tries to pickle pytest globals:
     # https://github.com/uqfoundation/dill/issues/482#issuecomment-1139017499.
     "apache_beam/transforms/window_test.py"
+
+    # See https://github.com/apache/beam/issues/25390.
+    "apache_beam/coders/slow_coders_test.py"
+    "apache_beam/dataframe/pandas_doctests_test.py"
+    "apache_beam/typehints/typed_pipeline_test.py"
+    "apache_beam/coders/fast_coders_test.py"
+    "apache_beam/dataframe/schemas_test.py"
   ];
 
   disabledTests = [

pkgs/development/python-modules/argh/default.nix

@@ -9,22 +9,13 @@
 
 buildPythonPackage rec {
   pname = "argh";
-  version = "0.26.2";
+  version = "0.27.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "e9535b8c84dc9571a48999094fda7f33e63c3f1b74f3e5f3ac0105a58405bb65";
+    hash = "sha256-2wbZEIHxck40fM23iclXD+yUc351WvFZiDcpPgH8TNI=";
   };
 
-  patches = [
-    # https://github.com/neithere/argh/issues/148
-    (fetchpatch {
-      name = "argh-0.26.2-fix-py3.9-msgs.patch";
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-python/argh/files/argh-0.26.2-fix-py3.9-msgs.patch?id=6f194f12a2e30aad7da347848f7b0187e188f983";
-      sha256 = "nBmhF2PXVeS7cBNujzip6Bb601LRHrjmhlGKFr/++Oo=";
-    })
-  ];
-
   nativeCheckInputs = [
     iocapture
     mock
@@ -34,6 +25,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "argh" ];
 
   meta = with lib; {
+    changelog = "https://github.com/neithere/argh/blob/v${version}/CHANGES";
     homepage = "https://github.com/neithere/argh";
     description = "An unobtrusive argparse wrapper with natural syntax";
     license = licenses.lgpl3Plus;

pkgs/development/python-modules/b2sdk/default.nix

@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "b2sdk";
-  version = "1.18.0";
+  version = "1.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-knLyjRjUmLZtM9dJoPBeSdm7GpE0+UJhwLi/obVvPuw=";
+    hash = "sha256-aJpSt+dXjw4S33dBiMkaR6wxzwLru+jseuPKFj2R36Y=";
   };
 
   nativeBuildInputs = [
@@ -56,6 +56,7 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # requires aws s3 auth
     "test/integration/test_download.py"
+    "test/integration/test_upload.py"
   ];
 
   disabledTests = [

pkgs/development/python-modules/cmaes/default.nix

@@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, hypothesis
+, numpy
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "cmaes";
+  version = "0.9.1";
+  disabled = pythonOlder "3.7";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "CyberAgentAILab";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-dd5vLT4Q0cI5ts0WgBpjPtOA81exGNjWSNHEiPggYbg=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+  propagatedBuildInputs = [ numpy ];
+
+  nativeCheckInputs = [ pytestCheckHook hypothesis ];
+
+  pythonImportsCheck = [ "cmaes" ];
+
+  meta = with lib; {
+    description = "Python library for CMA evolution strategy";
+    homepage = "https://github.com/CyberAgentAILab/cmaes";
+    license = licenses.mit;
+    maintainers = [ maintainers.bcdarwin ];
+  };
+}

pkgs/development/python-modules/dataproperty/default.nix

@@ -0,0 +1,39 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, mbstrdecoder
+, typepy
+, pytestCheckHook
+, termcolor
+}:
+
+buildPythonPackage rec {
+  pname = "dataproperty";
+  version = "0.55.0";
+
+  src = fetchFromGitHub {
+    owner = "thombashi";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-ODSrKZ8M/ni9r2gkVIKWaKkdr+3AVi4INkEKJ+cmb44=";
+  };
+
+  propagatedBuildInputs = [ mbstrdecoder typepy ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+  checkInputs = [ termcolor ];
+
+  # Tests fail, even on non-nixos
+  pytestFlagsArray = [
+    "--deselect test/test_dataproperty.py::Test_DataPeroperty_len::test_normal_ascii_escape_sequence"
+    "--deselect test/test_dataproperty.py::Test_DataPeroperty_is_include_ansi_escape::test_normal"
+    "--deselect test/test_dataproperty.py::Test_DataPeroperty_repr::test_normal"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/thombashi/dataproperty";
+    description = "A library for extracting properties from data";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.mit;
+  };
+}

pkgs/development/python-modules/flask-babel/default.nix

@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "flask-babel";
-  version = "3.0.0";
+  version = "3.0.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "python-babel";
     repo = "flask-babel";
     rev = "refs/tags/v${version}";
-    hash = "sha256-c3QKAnyMe1THHuJ3uB2d0jMMo1SYGRAB9mBpIJSAHw0=";
+    hash = "sha256-bHsB1f7dbZW4k8JteyZOwVCgWRDZMu21XdMcjM5NYjk=";
   };
 
   outputs = [

pkgs/development/python-modules/gbulb/default.nix

@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "gbulb";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchFromGitHub {
     owner = "beeware";
     repo = "gbulb";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "sha256-QNpZf1zfe6r6MtmYMWSrXPsXm5iX36oMx4GnXiTYPaQ=";
+    sha256 = "sha256-AdZSvxix0cpoFQSrslGl+hB/s6Nh0EsWMQmXZAJVJOg=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/google-cloud-error-reporting/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-error-reporting";
-  version = "1.8.1";
+  version = "1.8.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Xl+Jc05daQZPh4xggf/JYYlJ5Lx6LafqWhMcVdk/r6o=";
+    hash = "sha256-bwl1gWLux5LJMZIS/tJFMhHs1LcaDVCTgNrke6ASiBI=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/karton-asciimagic/default.nix

@@ -3,30 +3,39 @@
 , fetchFromGitHub
 , karton-core
 , unittestCheckHook
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "karton-asciimagic";
   version = "1.2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "sha256-sY5ik9efzLBa6Fbh17Vh4q7PlwOGYjuodU9yvp/8E3k=";
+    hash = "sha256-sY5ik9efzLBa6Fbh17Vh4q7PlwOGYjuodU9yvp/8E3k=";
   };
 
   propagatedBuildInputs = [
     karton-core
   ];
 
-  nativeCheckInputs = [ unittestCheckHook ];
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];
 
-  pythonImportsCheck = [ "karton.asciimagic" ];
+  pythonImportsCheck = [
+    "karton.asciimagic"
+  ];
 
   meta = with lib; {
     description = "Decoders for ascii-encoded executables for the Karton framework";
     homepage = "https://github.com/CERT-Polska/karton-asciimagic";
+    changelog = "https://github.com/CERT-Polska/karton-asciimagic/releases/tag/v${version}";
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/karton-autoit-ripper/default.nix

@@ -18,8 +18,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "sha256-D+M3JsIN8LUWg8GVweEzySHI7KaBb6cNHHn4pXoq55M=";
+    hash = "sha256-D+M3JsIN8LUWg8GVweEzySHI7KaBb6cNHHn4pXoq55M=";
   };
 
   propagatedBuildInputs = [
@@ -46,6 +46,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "AutoIt script ripper for Karton framework";
     homepage = "https://github.com/CERT-Polska/karton-autoit-ripper";
+    changelog = "https://github.com/CERT-Polska/karton-autoit-ripper/releases/tag/v${version}";
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/karton-classifier/default.nix

@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-TRmAin0TAOIwR5EBMwTOJ9QaHO+mOx/eAjgqvyQZDj4=";
   };
 
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "File type classifier for the Karton framework";
     homepage = "https://github.com/CERT-Polska/karton-classifier";
+    changelog = "https://github.com/CERT-Polska/karton-classifier/releases/tag/v${version}";
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/karton-config-extractor/default.nix

@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "sha256-ep69Rrm8Ek0lkgctz6vDAZ1MZ8kWKZSyIvMMAmzTngA=";
+    hash = "sha256-ep69Rrm8Ek0lkgctz6vDAZ1MZ8kWKZSyIvMMAmzTngA=";
   };
 
   propagatedBuildInputs = [
@@ -40,6 +40,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Static configuration extractor for the Karton framework";
     homepage = "https://github.com/CERT-Polska/karton-config-extractor";
+    changelog = "https://github.com/CERT-Polska/karton-config-extractor/releases/tag/v${version}";
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/karton-core/default.nix

@@ -3,12 +3,16 @@
 , buildPythonPackage
 , fetchFromGitHub
 , unittestCheckHook
+, pythonOlder
 , redis
 }:
 
 buildPythonPackage rec {
   pname = "karton-core";
   version = "5.0.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
@@ -22,7 +26,9 @@ buildPythonPackage rec {
     redis
   ];
 
-  nativeCheckInputs = [ unittestCheckHook ];
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];
 
   pythonImportsCheck = [
     "karton.core"
@@ -31,6 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Distributed malware processing framework";
     homepage = "https://karton-core.readthedocs.io/";
+    changelog = "https://github.com/CERT-Polska/karton/releases/tag/v${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ chivay fab ];
   };

pkgs/development/python-modules/karton-dashboard/default.nix

@@ -53,6 +53,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Web application that allows for Karton task and queue introspection";
     homepage = "https://github.com/CERT-Polska/karton-dashboard";
+    changelog = "https://github.com/CERT-Polska/karton-dashboard/releases/tag/v${version}";
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/karton-mwdb-reporter/default.nix

@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-QVxczXT74Xt0AtCSDm4nhIK4qtHQ6bqmVNb/CALZSE4=";
   };
 
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Karton service that uploads analyzed artifacts and metadata to MWDB Core";
     homepage = "https://github.com/CERT-Polska/karton-mwdb-reporter";
+    changelog = "https://github.com/CERT-Polska/karton-mwdb-reporter/releases/tag/v${version}";
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/karton-yaramatcher/default.nix

@@ -3,18 +3,22 @@
 , fetchFromGitHub
 , karton-core
 , unittestCheckHook
+, pythonOlder
 , yara-python
 }:
 
 buildPythonPackage rec {
   pname = "karton-yaramatcher";
   version = "1.2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
-    sha256 = "sha256-ulWwPXbjqQXwSRi8MFdcx7vC7P19yu66Ll8jkuTesao=";
+    hash = "sha256-ulWwPXbjqQXwSRi8MFdcx7vC7P19yu66Ll8jkuTesao=";
   };
 
   propagatedBuildInputs = [
@@ -22,13 +26,18 @@ buildPythonPackage rec {
     yara-python
   ];
 
-  nativeCheckInputs = [ unittestCheckHook ];
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];
 
-  pythonImportsCheck = [ "karton.yaramatcher" ];
+  pythonImportsCheck = [
+    "karton.yaramatcher"
+  ];
 
   meta = with lib; {
     description = "File and analysis artifacts yara matcher for the Karton framework";
     homepage = "https://github.com/CERT-Polska/karton-yaramatcher";
+    changelog = "https://github.com/CERT-Polska/karton-yaramatcher/releases/tag/v${version}";
     license = with licenses; [ bsd3 ];
     maintainers = with maintainers; [ fab ];
   };

pkgs/development/python-modules/mbstrdecoder/default.nix

@@ -0,0 +1,31 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, chardet
+, pytestCheckHook
+, faker
+}:
+
+buildPythonPackage rec {
+  pname = "mbstrdecoder";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "thombashi";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-U8F+mWKDulIRvvhswmdGnxKjM2qONQybViQ5TLZbLDY=";
+  };
+
+  propagatedBuildInputs = [ chardet ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+  checkInputs = [ faker ];
+
+  meta = with lib; {
+    homepage = "https://github.com/thombashi/mbstrdecoder";
+    description = "A library for decoding multi-byte character strings";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.mit;
+  };
+}

pkgs/development/python-modules/nomadnet/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "nomadnet";
-  version = "0.3.2";
+  version = "0.3.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "NomadNet";
     rev = "refs/tags/${version}";
-    hash = "sha256-QIme76Y7rhPCooazX+pr5ETbAmShVHZ9polJ964NLFg=";
+    hash = "sha256-7EiAvWYhYJ7S/quME6B4Iw5nw+xOnL7PMCWXLPx0O+4=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pyorthanc/default.nix

@@ -0,0 +1,41 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, poetry-core
+, httpx
+, pydicom
+}:
+
+buildPythonPackage rec {
+  pname = "pyorthanc";
+  version = "1.11.4";
+  disabled = pythonOlder "3.8";
+
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "gacou54";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-HbNeI6KpdIoLwRx09qQGJ/iJGKnRj0Z4/mkgoXhofGA=";
+  };
+
+  nativeBuildInputs = [ poetry-core ];
+
+  propagatedBuildInputs = [ httpx pydicom ];
+
+  doCheck = false;  # requires orthanc server (not in Nixpkgs)
+
+  pythonImportsCheck = [
+    "pyorthanc"
+  ];
+
+  meta = with lib; {
+    description = "Python library that wraps the Orthanc REST API";
+    homepage = "https://github.com/gacou54/pyorthanc";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}

pkgs/development/python-modules/pypinyin/default.nix

@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "pypinyin";
-  version = "0.47.1";
+  version = "0.48.0";
 
   src = fetchFromGitHub {
     owner = "mozillazg";
     repo = "python-pinyin";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-c9pEO9k5tCFWLPismrXrrYEQYmxYKkciXFgpbrDEGzE=";
+    sha256 = "sha256-gt0jrDPr6FeLB5P9HCSosCHb/W1sAKSusTrCpkqO26E=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pytablewriter/default.nix

@@ -0,0 +1,57 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, dataproperty
+, mbstrdecoder
+, pathvalidate
+, setuptools
+, tabledata
+, tcolorpy
+, typepy
+, pytestCheckHook
+, pyyaml
+, toml
+, elasticsearch
+, dominate
+}:
+
+buildPythonPackage rec {
+  pname = "pytablewriter";
+  version = "0.64.2";
+
+  src = fetchFromGitHub {
+    owner = "thombashi";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-+IOHnmdd9g3SoHyITJJtbJ0/SAAmwWmwX5XeqsO34EM=";
+  };
+
+  propagatedBuildInputs = [
+    dataproperty
+    mbstrdecoder
+    pathvalidate
+    tabledata
+    tcolorpy
+    typepy
+  ];
+
+  checkInputs = [ pyyaml toml elasticsearch dominate ];
+  nativeCheckInputs = [ pytestCheckHook ];
+  # Circular dependency
+  disabledTests = [
+    "test_normal_from_file"
+    "test_normal_from_text"
+    "test_normal_clear_theme"
+  ];
+  disabledTestPaths = [
+    "test/writer/binary/test_excel_writer.py"
+    "test/writer/binary/test_sqlite_writer.py"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/thombashi/pytablewriter";
+    description = "A library to write a table in various formats";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.mit;
+  };
+}