From b4b9096d661fe53b96c4d9b11a3a79e79866a1c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kier=C3=A1n=20Meinhardt?= <kmein@posteo.de>
Date: Mon, 27 Dec 2021 09:57:53 +0100
Subject: [PATCH 01/44] astrolog: switches for using optional ephemeris/atlas
 files

---
 .../science/astronomy/astrolog/default.nix    | 25 ++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/science/astronomy/astrolog/default.nix b/pkgs/applications/science/astronomy/astrolog/default.nix
index 90749f54310d..dc567339d136 100644
--- a/pkgs/applications/science/astronomy/astrolog/default.nix
+++ b/pkgs/applications/science/astronomy/astrolog/default.nix
@@ -1,4 +1,8 @@
-{ lib, stdenv, fetchzip, fetchurl, xorg, gnused }:
+{ lib, stdenv, fetchzip, fetchurl, xorg, gnused
+, withBigAtlas ? true
+, withEphemeris ? true
+, withMoonsEphemeris ? true
+}:
 stdenv.mkDerivation rec {
   pname = "astrolog";
   version = "7.30";
@@ -23,15 +27,30 @@ stdenv.mkDerivation rec {
       sha256 = "1mwvpvfk3lxjcc79zvwl4ypqzgqzipnc01cjldxrmx56xkc35zn7";
       stripRoot = false;
     };
+    moonsEphemeris = fetchzip {
+      url = "https://www.astrolog.org/ftp/ephem/moons/sepm.zip";
+      sha256 = "0labcidm8mrwvww93nwpp5738m9ff9q48cqzbgd18xny1jf6f8xd";
+      stripRoot = false;
+    };
     atlas = fetchurl {
       url = "http://astrolog.org/ftp/atlas/atlasbig.as";
-      sha256 = "1k8cy8gpcvkwkhyz248qhvrv5xiwp1n1s3b7rlz86krh7vzz01mp";
+      sha256 = "001bmqyldsbk4bdliqfl4a9ydrh1ff13wccvfniwaxlmvkridx2q";
     };
   in ''
     mkdir -p $out/bin $out/astrolog
-    cp -r ${ephemeris}/*.se1 $out/astrolog
     cp *.as $out/astrolog
     install astrolog $out/bin
+    ${lib.optionalString withBigAtlas "cp ${atlas} $out/astrolog/atlas.as"}
+    ${lib.optionalString withEphemeris ''
+      sed -i "/-Yi1/s#\".*\"#\"$out/ephemeris\"#" $out/astrolog/astrolog.as
+      mkdir -p $out/ephemeris
+      cp -r ${ephemeris}/*.se1 $out/ephemeris
+    ''}
+    ${lib.optionalString withMoonsEphemeris ''
+      sed -i "/-Yi1/s#\".*\"#\"$out/ephemeris\"#" $out/astrolog/astrolog.as
+      mkdir -p $out/ephemeris
+      cp -r ${moonsEphemeris}/*.se1 $out/ephemeris
+    ''}
   '';
 
   meta = with lib; {

From abef4b10b6d75da66025b9f9fe095e820f8b96ad Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 8 Dec 2021 05:08:23 +0100
Subject: [PATCH 02/44] nixos/kubernetes: add missing defaultText to expression
 default

---
 nixos/modules/services/cluster/kubernetes/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nixos/modules/services/cluster/kubernetes/default.nix b/nixos/modules/services/cluster/kubernetes/default.nix
index cf7fcb0a6d73..af39b87fa772 100644
--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@@ -198,6 +198,9 @@ in {
       description = "Default location for kubernetes secrets. Not a store location.";
       type = types.path;
       default = cfg.dataDir + "/secrets";
+      defaultText = literalExpression ''
+        config.${opt.dataDir} + "/secrets"
+      '';
     };
   };
 

From 7e28421e1704c95c056f2b2e7fc27a7569182e0f Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 8 Dec 2021 05:09:32 +0100
Subject: [PATCH 03/44] nixos/kubernetes: make lib option internal and readonly

this set almost certainly shouldn't be touched by users, nor listed in
the manual. make it internal and use it only through the option path to
make clear that this should not be modified.
---
 .../services/cluster/kubernetes/controller-manager.nix   | 7 ++++---
 nixos/modules/services/cluster/kubernetes/default.nix    | 2 ++
 nixos/modules/services/cluster/kubernetes/kubelet.nix    | 7 ++++---
 nixos/modules/services/cluster/kubernetes/pki.nix        | 9 +++++----
 nixos/modules/services/cluster/kubernetes/proxy.nix      | 7 ++++---
 nixos/modules/services/cluster/kubernetes/scheduler.nix  | 7 ++++---
 6 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/nixos/modules/services/cluster/kubernetes/controller-manager.nix b/nixos/modules/services/cluster/kubernetes/controller-manager.nix
index ed25715fab7d..6d54659720cb 100644
--- a/nixos/modules/services/cluster/kubernetes/controller-manager.nix
+++ b/nixos/modules/services/cluster/kubernetes/controller-manager.nix
@@ -6,6 +6,7 @@ let
   top = config.services.kubernetes;
   otop = options.services.kubernetes;
   cfg = top.controllerManager;
+  klib = options.services.kubernetes.lib.default;
 in
 {
   imports = [
@@ -56,7 +57,7 @@ in
       type = int;
     };
 
-    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes controller manager";
+    kubeconfig = klib.mkKubeConfigOptions "Kubernetes controller manager";
 
     leaderElect = mkOption {
       description = "Whether to start leader election before executing main loop.";
@@ -129,7 +130,7 @@ in
             "--cluster-cidr=${cfg.clusterCidr}"} \
           ${optionalString (cfg.featureGates != [])
             "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
-          --kubeconfig=${top.lib.mkKubeConfig "kube-controller-manager" cfg.kubeconfig} \
+          --kubeconfig=${klib.mkKubeConfig "kube-controller-manager" cfg.kubeconfig} \
           --leader-elect=${boolToString cfg.leaderElect} \
           ${optionalString (cfg.rootCaFile!=null)
             "--root-ca-file=${cfg.rootCaFile}"} \
@@ -156,7 +157,7 @@ in
       path = top.path;
     };
 
-    services.kubernetes.pki.certs = with top.lib; {
+    services.kubernetes.pki.certs = with klib; {
       controllerManager = mkCert {
         name = "kube-controller-manager";
         CN = "kube-controller-manager";
diff --git a/nixos/modules/services/cluster/kubernetes/default.nix b/nixos/modules/services/cluster/kubernetes/default.nix
index af39b87fa772..807d8d1a193d 100644
--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@@ -192,6 +192,8 @@ in {
         inherit mkKubeConfigOptions;
       };
       type = types.attrs;
+      readOnly = true;
+      internal = true;
     };
 
     secretsPath = mkOption {
diff --git a/nixos/modules/services/cluster/kubernetes/kubelet.nix b/nixos/modules/services/cluster/kubernetes/kubelet.nix
index 3e8eac96f6ba..2d58547ce4ce 100644
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@@ -6,6 +6,7 @@ let
   top = config.services.kubernetes;
   otop = options.services.kubernetes;
   cfg = top.kubelet;
+  klib = options.services.kubernetes.lib.default;
 
   cniConfig =
     if cfg.cni.config != [] && cfg.cni.configDir != null then
@@ -27,7 +28,7 @@ let
     config.Cmd = ["/bin/pause"];
   };
 
-  kubeconfig = top.lib.mkKubeConfig "kubelet" cfg.kubeconfig;
+  kubeconfig = klib.mkKubeConfig "kubelet" cfg.kubeconfig;
 
   manifestPath = "kubernetes/manifests";
 
@@ -177,7 +178,7 @@ in
       type = str;
     };
 
-    kubeconfig = top.lib.mkKubeConfigOptions "Kubelet";
+    kubeconfig = klib.mkKubeConfigOptions "Kubelet";
 
     manifests = mkOption {
       description = "List of manifests to bootstrap with kubelet (only pods can be created as manifest entry)";
@@ -358,7 +359,7 @@ in
       services.kubernetes.kubelet.hostname = with config.networking;
         mkDefault (hostName + optionalString (domain != null) ".${domain}");
 
-      services.kubernetes.pki.certs = with top.lib; {
+      services.kubernetes.pki.certs = with klib; {
         kubelet = mkCert {
           name = "kubelet";
           CN = top.kubelet.hostname;
diff --git a/nixos/modules/services/cluster/kubernetes/pki.nix b/nixos/modules/services/cluster/kubernetes/pki.nix
index 76ab03cd520b..00d572a50988 100644
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@@ -1,10 +1,11 @@
-{ config, lib, pkgs, ... }:
+{ config, options, lib, pkgs, ... }:
 
 with lib;
 
 let
   top = config.services.kubernetes;
   cfg = top.pki;
+  klib = options.services.kubernetes.lib;
 
   csrCA = pkgs.writeText "kube-pki-cacert-csr.json" (builtins.toJSON {
     key = {
@@ -29,7 +30,7 @@ let
   cfsslAPITokenLength = 32;
 
   clusterAdminKubeconfig = with cfg.certs.clusterAdmin;
-    top.lib.mkKubeConfig "cluster-admin" {
+    klib.mkKubeConfig "cluster-admin" {
         server = top.apiserverAddress;
         certFile = cert;
         keyFile = key;
@@ -250,7 +251,7 @@ in
       # - it would be better with a more Nix-oriented way of managing addons
       systemd.services.kube-addon-manager = mkIf top.addonManager.enable (mkMerge [{
         environment.KUBECONFIG = with cfg.certs.addonManager;
-          top.lib.mkKubeConfig "addon-manager" {
+          klib.mkKubeConfig "addon-manager" {
             server = top.apiserverAddress;
             certFile = cert;
             keyFile = key;
@@ -343,7 +344,7 @@ in
       '';
 
       services.flannel = with cfg.certs.flannelClient; {
-        kubeconfig = top.lib.mkKubeConfig "flannel" {
+        kubeconfig = klib.mkKubeConfig "flannel" {
           server = top.apiserverAddress;
           certFile = cert;
           keyFile = key;
diff --git a/nixos/modules/services/cluster/kubernetes/proxy.nix b/nixos/modules/services/cluster/kubernetes/proxy.nix
index 5f3da034120b..986301f6bd95 100644
--- a/nixos/modules/services/cluster/kubernetes/proxy.nix
+++ b/nixos/modules/services/cluster/kubernetes/proxy.nix
@@ -6,6 +6,7 @@ let
   top = config.services.kubernetes;
   otop = options.services.kubernetes;
   cfg = top.proxy;
+  klib = options.services.kubernetes.lib.default;
 in
 {
   imports = [
@@ -43,7 +44,7 @@ in
       type = str;
     };
 
-    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes proxy";
+    kubeconfig = klib.mkKubeConfigOptions "Kubernetes proxy";
 
     verbosity = mkOption {
       description = ''
@@ -72,7 +73,7 @@ in
           ${optionalString (cfg.featureGates != [])
             "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
           --hostname-override=${cfg.hostname} \
-          --kubeconfig=${top.lib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
+          --kubeconfig=${klib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
           ${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
           ${cfg.extraOpts}
         '';
@@ -88,7 +89,7 @@ in
     services.kubernetes.proxy.hostname = with config.networking; mkDefault hostName;
 
     services.kubernetes.pki.certs = {
-      kubeProxyClient = top.lib.mkCert {
+      kubeProxyClient = klib.mkCert {
         name = "kube-proxy-client";
         CN = "system:kube-proxy";
         action = "systemctl restart kube-proxy.service";
diff --git a/nixos/modules/services/cluster/kubernetes/scheduler.nix b/nixos/modules/services/cluster/kubernetes/scheduler.nix
index 87263ee72fa4..442e3fe3a69f 100644
--- a/nixos/modules/services/cluster/kubernetes/scheduler.nix
+++ b/nixos/modules/services/cluster/kubernetes/scheduler.nix
@@ -6,6 +6,7 @@ let
   top = config.services.kubernetes;
   otop = options.services.kubernetes;
   cfg = top.scheduler;
+  klib = options.services.kubernetes.lib.default;
 in
 {
   ###### interface
@@ -32,7 +33,7 @@ in
       type = listOf str;
     };
 
-    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes scheduler";
+    kubeconfig = klib.mkKubeConfigOptions "Kubernetes scheduler";
 
     leaderElect = mkOption {
       description = "Whether to start leader election before executing main loop.";
@@ -69,7 +70,7 @@ in
           --address=${cfg.address} \
           ${optionalString (cfg.featureGates != [])
             "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
-          --kubeconfig=${top.lib.mkKubeConfig "kube-scheduler" cfg.kubeconfig} \
+          --kubeconfig=${klib.mkKubeConfig "kube-scheduler" cfg.kubeconfig} \
           --leader-elect=${boolToString cfg.leaderElect} \
           --port=${toString cfg.port} \
           ${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
@@ -87,7 +88,7 @@ in
     };
 
     services.kubernetes.pki.certs = {
-      schedulerClient = top.lib.mkCert {
+      schedulerClient = klib.mkCert {
         name = "kube-scheduler-client";
         CN = "system:kube-scheduler";
         action = "systemctl restart kube-scheduler.service";

From 55863f14ce1d4c4f5f3b961315dc8d94b832d12c Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Sat, 18 Dec 2021 09:28:04 +0100
Subject: [PATCH 04/44] nixos/couchdb: add missing defaultText

---
 nixos/modules/services/databases/couchdb.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/databases/couchdb.nix b/nixos/modules/services/databases/couchdb.nix
index 266bc82b6967..742e605d224d 100644
--- a/nixos/modules/services/databases/couchdb.nix
+++ b/nixos/modules/services/databases/couchdb.nix
@@ -1,9 +1,10 @@
-{ config, lib, pkgs, ... }:
+{ config, options, lib, pkgs, ... }:
 
 with lib;
 
 let
   cfg = config.services.couchdb;
+  opt = options.services.couchdb;
   configFile = pkgs.writeText "couchdb.ini" (
     ''
       [couchdb]
@@ -153,6 +154,7 @@ in {
       argsFile = mkOption {
         type = types.path;
         default = "${cfg.package}/etc/vm.args";
+        defaultText = literalExpression ''"config.${opt.package}/etc/vm.args"'';
         description = ''
           vm.args configuration. Overrides Couchdb's Erlang VM parameters file.
         '';

From bf58a90d09fdfb3f24b304be79e1259b123d8632 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Sat, 18 Dec 2021 09:28:23 +0100
Subject: [PATCH 05/44] nixos/xrdp: add missing defaultText

---
 nixos/modules/services/networking/xrdp.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/networking/xrdp.nix b/nixos/modules/services/networking/xrdp.nix
index e9f123a181ae..747fb7a1f9c4 100644
--- a/nixos/modules/services/networking/xrdp.nix
+++ b/nixos/modules/services/networking/xrdp.nix
@@ -100,6 +100,7 @@ in
       confDir = mkOption {
         type = types.path;
         default = confDir;
+        defaultText = literalDocBook "generated from configuration";
         description = "The location of the config files for xrdp.";
       };
     };

From 3dbb117aa579330d76fd3b949862b1223f91d6ea Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Sat, 18 Dec 2021 09:28:37 +0100
Subject: [PATCH 06/44] nixos/aesmd: add missing defaultText

---
 nixos/modules/services/security/aesmd.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/security/aesmd.nix b/nixos/modules/services/security/aesmd.nix
index bb53bc49e259..924d614e4717 100644
--- a/nixos/modules/services/security/aesmd.nix
+++ b/nixos/modules/services/security/aesmd.nix
@@ -1,7 +1,8 @@
-{ config, pkgs, lib, ... }:
+{ config, options, pkgs, lib, ... }:
 with lib;
 let
   cfg = config.services.aesmd;
+  opt = options.services.aesmd;
 
   sgx-psw = pkgs.sgx-psw.override { inherit (cfg) debug; };
 
@@ -43,6 +44,9 @@ in
         options.proxyType = mkOption {
           type = with types; nullOr (enum [ "default" "direct" "manual" ]);
           default = if (cfg.settings.proxy != null) then "manual" else null;
+          defaultText = literalExpression ''
+            if (config.${opt.settings}.proxy != null) then "manual" else null
+          '';
           example = "default";
           description = ''
             Type of proxy to use. The <literal>default</literal> uses the system's default proxy.

From 55daffc1c943bddb71dc89a606f8284f6d50f5bd Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Wed, 29 Dec 2021 20:09:30 +0100
Subject: [PATCH 07/44] nixos/sourcehut: add missing defaultText, escape
 antiquotations

---
 nixos/modules/services/misc/sourcehut/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/misc/sourcehut/default.nix b/nixos/modules/services/misc/sourcehut/default.nix
index 1bd21c278e00..21551d7d5f03 100644
--- a/nixos/modules/services/misc/sourcehut/default.nix
+++ b/nixos/modules/services/misc/sourcehut/default.nix
@@ -678,7 +678,7 @@ in
                 rev = "ff96a0fa5635770390b184ae74debea75c3fd534";
                 ref = "nixos-unstable";
             };
-            image_from_nixpkgs = (import ("${pkgs.sourcehut.buildsrht}/lib/images/nixos/image.nix") {
+            image_from_nixpkgs = (import ("''${pkgs.sourcehut.buildsrht}/lib/images/nixos/image.nix") {
               pkgs = (import pkgs_unstable {});
             });
           in
@@ -696,6 +696,7 @@ in
       package = mkOption {
         type = types.package;
         default = pkgs.git;
+        defaultText = literalExpression "pkgs.git";
         example = literalExpression "pkgs.gitFull";
         description = ''
           Git package for git.sr.ht. This can help silence collisions.
@@ -712,6 +713,7 @@ in
       package = mkOption {
         type = types.package;
         default = pkgs.mercurial;
+        defaultText = literalExpression "pkgs.mercurial";
         description = ''
           Mercurial package for hg.sr.ht. This can help silence collisions.
         '';

From a1feb0a056910c0217705601669cd031b9b60791 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 1 Jan 2022 20:27:25 +0000
Subject: [PATCH 08/44] python39Packages.elasticsearch: 7.16.1 -> 7.16.2

---
 pkgs/development/python-modules/elasticsearch/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/elasticsearch/default.nix b/pkgs/development/python-modules/elasticsearch/default.nix
index 81bc807a1347..601c5b68864d 100644
--- a/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/pkgs/development/python-modules/elasticsearch/default.nix
@@ -12,11 +12,11 @@ buildPythonPackage (rec {
   # there's a clear path forward. See
   # https://github.com/elastic/elasticsearch-py/issues/1639 for more
   # info.
-  version = "7.16.1";
+  version = "7.16.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c024ee2e7e2509c842c4e3c5e2b99a92ceecfde06d6dac2d32a19bf566c3e175";
+    sha256 = "23ac0afb4398c48990e359ac73ab6963741bd05321345299c62d9d23e209eee2";
   };
 
   # Check is disabled because running them destroy the content of the local cluster!

From eb9d92ccb682cd26c3d2017cebbb5deecae03460 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 2 Jan 2022 01:01:32 +0100
Subject: [PATCH 09/44] python3Packages.pytest-socket: 0.4.0 -> 0.5.0

---
 .../python-modules/pytest-socket/default.nix  | 26 ++++++-------------
 1 file changed, 8 insertions(+), 18 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-socket/default.nix b/pkgs/development/python-modules/pytest-socket/default.nix
index 0371b7cac5a4..1376d3e8412f 100644
--- a/pkgs/development/python-modules/pytest-socket/default.nix
+++ b/pkgs/development/python-modules/pytest-socket/default.nix
@@ -1,23 +1,24 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , poetry-core
 , pytest
 , pythonOlder
+, setuptoolsBuildHook
 }:
 
 buildPythonPackage rec {
   pname = "pytest-socket";
-  version = "0.4.0";
-  disabled = pythonOlder "3.6";
+  version = "0.5.0";
   format = "pyproject";
 
+  disabled = pythonOlder "3.7";
+
   src = fetchFromGitHub {
     owner = "miketheman";
     repo = pname;
     rev = version;
-    sha256 = "sha256-cFYtJqZ/RjFbn9XlEy6ffxZ2djisajQAwjV/YR2f59Q=";
+    hash = "sha256-HdGkpIHFsoAG2+8UyL9jSb3Dm8bWkYzREdY3i15ls/Q=";
   };
 
   nativeBuildInputs = [
@@ -28,23 +29,12 @@ buildPythonPackage rec {
     pytest
   ];
 
-  checkInputs = [
-    pytest
-  ];
-
-  patches = [
-    # Switch to poetry-core, https://github.com/miketheman/pytest-socket/pull/74
-    (fetchpatch {
-      name = "switch-to-poetry-core.patch";
-      url = "https://github.com/miketheman/pytest-socket/commit/32519170e656e731d24b81770a170333d3efa6a8.patch";
-      sha256 = "19ksgx77rsa6ijcbml74alwc5052mdqr4rmvqhlzvfcvv3676ig2";
-    })
-  ];
-
   # pytest-socket require network for majority of tests
   doCheck = false;
 
-  pythonImportsCheck = [ "pytest_socket" ];
+  pythonImportsCheck = [
+    "pytest_socket"
+  ];
 
   meta = with lib; {
     description = "Pytest Plugin to disable socket calls during tests";

From 559d193f4e7c7bc8ac472f2ba44eb8902928a78a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 2 Jan 2022 11:28:42 +0100
Subject: [PATCH 10/44] python3Packages.url-normalize: switch to poetry-core,
 remove cov and flakes

---
 .../python-modules/url-normalize/default.nix  | 33 +++++++++++++++----
 1 file changed, 26 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/url-normalize/default.nix b/pkgs/development/python-modules/url-normalize/default.nix
index ea7825d9ffd2..3032f7791a70 100644
--- a/pkgs/development/python-modules/url-normalize/default.nix
+++ b/pkgs/development/python-modules/url-normalize/default.nix
@@ -1,8 +1,8 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, poetry
-, pytest-cov
+, fetchpatch
+, poetry-core
 , pytest-flakes
 , pytest-mock
 , pytest-socket
@@ -19,22 +19,41 @@ buildPythonPackage rec {
     owner = "niksite";
     repo = pname;
     rev = version;
-    sha256 = "09nac5nh94x0n4bfazjfxk96b20mfsx6r1fnvqv85gkzs0rwqkaq";
+    hash = "sha256-WE3MM9B/voI23taFbLp2FYhl0uxOfuUWsaCTBG1hyiY=";
   };
 
-  nativeBuildInputs = [ poetry ];
+  nativeBuildInputs = [
+    poetry-core
+  ];
 
-  propagatedBuildInputs = [ six ];
+  propagatedBuildInputs = [
+    six
+  ];
 
   checkInputs = [
-    pytest-cov
     pytest-flakes
     pytest-mock
     pytest-socket
     pytestCheckHook
   ];
 
-  pythonImportsCheck = [ "url_normalize" ];
+  patches = [
+    # Switch to poetry-core, https://github.com/niksite/url-normalize/pull/28
+    (fetchpatch {
+      name = "switch-to-poetry-core.patch";
+      url = "https://github.com/niksite/url-normalize/commit/b8557b10c977b191cc9d37e6337afe874a24ad08.patch";
+      sha256 = "sha256-SVCQATV9V6HbLmjOHs7V7eBagO0PuqZLubIJghBYfQQ=";
+    })
+  ];
+
+  postPatch = ''
+    sed -i "/--cov/d" tox.ini
+    sed -i "/--flakes/d" tox.ini
+  '';
+
+  pythonImportsCheck = [
+    "url_normalize"
+  ];
 
   meta = with lib; {
     description = "URL normalization for Python";

From fc614c37c653637e5475a0b0a987489b4d1f351d Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Fri, 19 Nov 2021 00:26:27 +0100
Subject: [PATCH 11/44] nixos/documentation: split options doc build

most modules can be evaluated for their documentation in a very
restricted environment that doesn't include all of nixpkgs. this
evaluation can then be cached and reused for subsequent builds, merging
only documentation that has changed into the cached set. since nixos
ships with a large number of modules of which only a few are used in any
given config this can save evaluation a huge percentage of nixos
options available in any given config.

in tests of this caching, despite having to copy most of nixos/, saves
about 80% of the time needed to build the system manual, or about two
second on the machine used for testing. build time for a full system
config shrank from 9.4s to 7.4s, while turning documentation off
entirely shortened the build to 7.1s.
---
 lib/options.nix                               |  2 +-
 nixos/doc/manual/default.nix                  |  8 +-
 .../development/meta-attributes.section.md    | 28 +++++-
 .../development/meta-attributes.section.xml   | 44 ++++++++-
 nixos/lib/eval-cacheable-options.nix          | 53 +++++++++++
 nixos/lib/make-options-doc/default.nix        | 16 +++-
 nixos/lib/make-options-doc/mergeJSON.py       | 71 ++++++++++++++
 nixos/modules/config/qt5.nix                  |  3 +
 nixos/modules/i18n/input-method/fcitx.nix     |  3 +
 nixos/modules/i18n/input-method/ibus.nix      |  3 +
 nixos/modules/i18n/input-method/kime.nix      |  4 +-
 nixos/modules/misc/documentation.nix          | 95 +++++++++++++++++--
 nixos/modules/misc/meta.nix                   | 15 +++
 nixos/modules/misc/nixpkgs.nix                |  3 +
 nixos/modules/misc/version.nix                |  2 +
 nixos/modules/programs/dmrconfig.nix          |  2 +
 nixos/modules/programs/gnupg.nix              |  2 +
 nixos/modules/programs/tmux.nix               |  3 +
 nixos/modules/services/backup/sanoid.nix      |  5 +-
 .../pipewire/pipewire-media-session.nix       |  2 +
 .../services/desktops/pipewire/pipewire.nix   |  2 +
 nixos/modules/services/hardware/thinkfan.nix  |  3 +
 .../services/misc/matrix-appservice-irc.nix   |  3 +
 .../services/networking/dnscrypt-proxy2.nix   |  3 +
 nixos/modules/services/networking/kea.nix     |  2 +
 nixos/modules/services/networking/searx.nix   |  3 +-
 .../services/security/vaultwarden/default.nix |  3 +
 nixos/modules/services/web-apps/dex.nix       |  3 +
 nixos/modules/services/web-apps/gerrit.nix    |  2 +
 nixos/modules/services/web-apps/jirafeau.nix  |  3 +
 nixos/modules/services/web-apps/nextcloud.nix |  2 +
 .../services/web-apps/powerdns-admin.nix      |  3 +
 nixos/modules/services/x11/xserver.nix        |  2 +
 nixos/modules/system/activation/top-level.nix |  2 +
 nixos/modules/virtualisation/qemu-vm.nix      |  3 +
 nixos/modules/virtualisation/xen-dom0.nix     |  3 +
 36 files changed, 384 insertions(+), 22 deletions(-)
 create mode 100644 nixos/lib/eval-cacheable-options.nix
 create mode 100644 nixos/lib/make-options-doc/mergeJSON.py

diff --git a/lib/options.nix b/lib/options.nix
index 5d52f065af08..53001a3113f9 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -177,7 +177,7 @@ rec {
         docOption = rec {
           loc = opt.loc;
           name = showOption opt.loc;
-          description = opt.description or (lib.warn "Option `${name}' has no description." "This option has no description.");
+          description = opt.description or null;
           declarations = filter (x: x != unknownModule) opt.declarations;
           internal = opt.internal or false;
           visible =
diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index 31b6da01c6bd..9bc63686fa3a 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -1,4 +1,4 @@
-{ pkgs, options, config, version, revision, extraSources ? [] }:
+{ pkgs, options, config, version, revision, extraSources ? [], baseOptionsJSON ? null, prefix ? ../../.. }:
 
 with pkgs;
 
@@ -11,11 +11,11 @@ let
   #
   # E.g. if some `options` came from modules in ${pkgs.customModules}/nix,
   # you'd need to include `extraSources = [ pkgs.customModules ]`
-  prefixesToStrip = map (p: "${toString p}/") ([ ../../.. ] ++ extraSources);
+  prefixesToStrip = map (p: "${toString p}/") ([ prefix ] ++ extraSources);
   stripAnyPrefixes = lib.flip (lib.foldr lib.removePrefix) prefixesToStrip;
 
   optionsDoc = buildPackages.nixosOptionsDoc {
-    inherit options revision;
+    inherit options revision baseOptionsJSON;
     transformOptions = opt: opt // {
       # Clean up declaration sites to not refer to the NixOS source tree.
       declarations = map stripAnyPrefixes opt.declarations;
@@ -161,7 +161,7 @@ let
 in rec {
   inherit generatedSources;
 
-  inherit (optionsDoc) optionsJSON optionsDocBook;
+  inherit (optionsDoc) optionsJSON optionsNix optionsDocBook;
 
   # Generate the NixOS manual.
   manualHTML = runCommand "nixos-manual-html"
diff --git a/nixos/doc/manual/development/meta-attributes.section.md b/nixos/doc/manual/development/meta-attributes.section.md
index ca4ba007f7dc..946c08efd0a3 100644
--- a/nixos/doc/manual/development/meta-attributes.section.md
+++ b/nixos/doc/manual/development/meta-attributes.section.md
@@ -5,7 +5,7 @@ extra information. Module meta attributes are defined in the `meta.nix`
 special module.
 
 `meta` is a top level attribute like `options` and `config`. Available
-meta-attributes are `maintainers` and `doc`.
+meta-attributes are `maintainers`, `doc`, and `buildDocsInSandbox`.
 
 Each of the meta-attributes must be defined at most once per module
 file.
@@ -24,6 +24,7 @@ file.
   meta = {
     maintainers = with lib.maintainers; [ ericsagnes ];
     doc = ./default.xml;
+    buildDocsInSandbox = true;
   };
 }
 ```
@@ -38,3 +39,28 @@ file.
     ```ShellSession
     $ nix-build nixos/release.nix -A manual.x86_64-linux
     ```
+
+-  `buildDocsInSandbox` indicates whether the option documentation for the
+   module can be built in a derivation sandbox. This option is currently only
+   honored for modules shipped by nixpkgs. User modules and modules taken from
+   `NIXOS_EXTRA_MODULE_PATH` are always built outside of the sandbox, as has
+   been the case in previous releases.
+
+   Building NixOS option documentation in a sandbox allows caching of the built
+   documentation, which greatly decreases the amount of time needed to evaluate
+   a system configuration that has NixOS documentation enabled. The sandbox also
+   restricts which attributes may be referenced by documentation attributes
+   (such as option descriptions) to the `options` and `lib` module arguments and
+   the `pkgs.formats` attribute of the `pkgs` argument, `config` and the rest of
+   `pkgs` are disallowed and will cause doc build failures when used. This
+   restriction is necessary because we cannot reproduce the full nixpkgs
+   instantiation with configuration and overlays from a system configuration
+   inside the sandbox. The `options` argument only includes options of modules
+   that are also built inside the sandbox, referencing an option of a module
+   that isn't built in the sandbox is also forbidden.
+
+   The default is `true` and should usually not be changed; set it to `false`
+   only if the module requires access to `pkgs` in its documentation (e.g.
+   because it loads information from a linked package to build an option type)
+   or if its documentation depends on other modules that also aren't sandboxed
+   (e.g. by using types defined in the other module).
diff --git a/nixos/doc/manual/from_md/development/meta-attributes.section.xml b/nixos/doc/manual/from_md/development/meta-attributes.section.xml
index f535d94602bd..1eb6e0f30368 100644
--- a/nixos/doc/manual/from_md/development/meta-attributes.section.xml
+++ b/nixos/doc/manual/from_md/development/meta-attributes.section.xml
@@ -8,8 +8,8 @@
   <para>
     <literal>meta</literal> is a top level attribute like
     <literal>options</literal> and <literal>config</literal>. Available
-    meta-attributes are <literal>maintainers</literal> and
-    <literal>doc</literal>.
+    meta-attributes are <literal>maintainers</literal>,
+    <literal>doc</literal>, and <literal>buildDocsInSandbox</literal>.
   </para>
   <para>
     Each of the meta-attributes must be defined at most once per module
@@ -29,6 +29,7 @@
   meta = {
     maintainers = with lib.maintainers; [ ericsagnes ];
     doc = ./default.xml;
+    buildDocsInSandbox = true;
   };
 }
 </programlisting>
@@ -51,5 +52,44 @@
 $ nix-build nixos/release.nix -A manual.x86_64-linux
 </programlisting>
     </listitem>
+    <listitem>
+      <para>
+        <literal>buildDocsInSandbox</literal> indicates whether the
+        option documentation for the module can be built in a derivation
+        sandbox. This option is currently only honored for modules
+        shipped by nixpkgs. User modules and modules taken from
+        <literal>NIXOS_EXTRA_MODULE_PATH</literal> are always built
+        outside of the sandbox, as has been the case in previous
+        releases.
+      </para>
+      <para>
+        Building NixOS option documentation in a sandbox allows caching
+        of the built documentation, which greatly decreases the amount
+        of time needed to evaluate a system configuration that has NixOS
+        documentation enabled. The sandbox also restricts which
+        attributes may be referenced by documentation attributes (such
+        as option descriptions) to the <literal>options</literal> and
+        <literal>lib</literal> module arguments and the
+        <literal>pkgs.formats</literal> attribute of the
+        <literal>pkgs</literal> argument, <literal>config</literal> and
+        the rest of <literal>pkgs</literal> are disallowed and will
+        cause doc build failures when used. This restriction is
+        necessary because we cannot reproduce the full nixpkgs
+        instantiation with configuration and overlays from a system
+        configuration inside the sandbox. The <literal>options</literal>
+        argument only includes options of modules that are also built
+        inside the sandbox, referencing an option of a module that isn’t
+        built in the sandbox is also forbidden.
+      </para>
+      <para>
+        The default is <literal>true</literal> and should usually not be
+        changed; set it to <literal>false</literal> only if the module
+        requires access to <literal>pkgs</literal> in its documentation
+        (e.g. because it loads information from a linked package to
+        build an option type) or if its documentation depends on other
+        modules that also aren’t sandboxed (e.g. by using types defined
+        in the other module).
+      </para>
+    </listitem>
   </itemizedlist>
 </section>
diff --git a/nixos/lib/eval-cacheable-options.nix b/nixos/lib/eval-cacheable-options.nix
new file mode 100644
index 000000000000..c3ba2ce66375
--- /dev/null
+++ b/nixos/lib/eval-cacheable-options.nix
@@ -0,0 +1,53 @@
+{ libPath
+, pkgsLibPath
+, nixosPath
+, modules
+, stateVersion
+, release
+}:
+
+let
+  lib = import libPath;
+  modulesPath = "${nixosPath}/modules";
+  # dummy pkgs set that contains no packages, only `pkgs.lib` from the full set.
+  # not having `pkgs.lib` causes all users of `pkgs.formats` to fail.
+  pkgs = import pkgsLibPath {
+    inherit lib;
+    pkgs = null;
+  };
+  utils = import "${nixosPath}/lib/utils.nix" {
+    inherit config lib;
+    pkgs = null;
+  };
+  # this is used both as a module and as specialArgs.
+  # as a module it sets the _module special values, as specialArgs it makes `config`
+  # unusable. this causes documentation attributes depending on `config` to fail.
+  config = {
+    _module.check = false;
+    _module.args = {};
+    system.stateVersion = stateVersion;
+  };
+  eval = lib.evalModules {
+    modules = (map (m: "${modulesPath}/${m}") modules) ++ [
+      config
+    ];
+    specialArgs = {
+      inherit config pkgs utils;
+    };
+  };
+  docs = import "${nixosPath}/doc/manual" {
+    pkgs = pkgs // {
+      inherit lib;
+      # duplicate of the declaration in all-packages.nix
+      buildPackages.nixosOptionsDoc = attrs:
+        (import "${nixosPath}/lib/make-options-doc")
+          ({ inherit pkgs lib; } // attrs);
+    };
+    config = config.config;
+    options = eval.options;
+    version = release;
+    revision = "release-${release}";
+    prefix = modulesPath;
+  };
+in
+  docs.optionsNix
diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index 44bc25be9238..4b40af34b185 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -21,6 +21,10 @@
 , options
 , transformOptions ? lib.id  # function for additional tranformations of the options
 , revision ? "" # Specify revision for the options
+# a set of options the docs we are generating will be merged into, as if by recursiveUpdate.
+# used to split the options doc build into a static part (nixos/modules) and a dynamic part
+# (non-nixos modules imported via configuration.nix, other module sources).
+, baseOptionsJSON ? null
 }:
 
 let
@@ -99,13 +103,23 @@ in rec {
   optionsJSON = pkgs.runCommand "options.json"
     { meta.description = "List of NixOS options in JSON format";
       buildInputs = [ pkgs.brotli ];
+      options = builtins.toFile "options.json"
+        (builtins.unsafeDiscardStringContext (builtins.toJSON optionsNix));
     }
     ''
       # Export list of options in different format.
       dst=$out/share/doc/nixos
       mkdir -p $dst
 
-      cp ${builtins.toFile "options.json" (builtins.unsafeDiscardStringContext (builtins.toJSON optionsNix))} $dst/options.json
+      ${
+        if baseOptionsJSON == null
+          then "cp $options $dst/options.json"
+          else ''
+            ${pkgs.python3Minimal}/bin/python ${./mergeJSON.py} \
+              ${baseOptionsJSON} $options \
+              > $dst/options.json
+          ''
+      }
 
       brotli -9 < $dst/options.json > $dst/options.json.br
 
diff --git a/nixos/lib/make-options-doc/mergeJSON.py b/nixos/lib/make-options-doc/mergeJSON.py
new file mode 100644
index 000000000000..e7f6897c6d0d
--- /dev/null
+++ b/nixos/lib/make-options-doc/mergeJSON.py
@@ -0,0 +1,71 @@
+import collections
+import json
+import sys
+
+class Key:
+    def __init__(self, path):
+        self.path = path
+    def __hash__(self):
+        result = 0
+        for id in self.path:
+            result ^= hash(id)
+        return result
+    def __eq__(self, other):
+        return type(self) is type(other) and self.path == other.path
+
+Option = collections.namedtuple('Option', ['name', 'value'])
+
+# pivot a dict of options keyed by their display name to a dict keyed by their path
+def pivot(options):
+    result = dict()
+    for (name, opt) in options.items():
+        result[Key(opt['loc'])] = Option(name, opt)
+    return result
+
+# pivot back to indexed-by-full-name
+# like the docbook build we'll just fail if multiple options with differing locs
+# render to the same option name.
+def unpivot(options):
+    result = dict()
+    for (key, opt) in options.items():
+        if opt.name in result:
+            raise RuntimeError(
+                'multiple options with colliding ids found',
+                opt.name,
+                result[opt.name]['loc'],
+                opt.value['loc'],
+            )
+        result[opt.name] = opt.value
+    return result
+
+options = pivot(json.load(open(sys.argv[1], 'r')))
+overrides = pivot(json.load(open(sys.argv[2], 'r')))
+
+# fix up declaration paths in lazy options, since we don't eval them from a full nixpkgs dir
+for (k, v) in options.items():
+    v.value['declarations'] = list(map(lambda s: f'nixos/modules/{s}', v.value['declarations']))
+
+# merge both descriptions
+for (k, v) in overrides.items():
+    cur = options.setdefault(k, v).value
+    for (ok, ov) in v.value.items():
+        if ok == 'declarations':
+            decls = cur[ok]
+            for d in ov:
+                if d not in decls:
+                    decls += [d]
+        elif ok == "type":
+            # ignore types of placeholder options
+            if ov != "_unspecified" or cur[ok] == "_unspecified":
+                cur[ok] = ov
+        elif ov is not None or cur.get(ok, None) is None:
+            cur[ok] = ov
+
+# check that every option has a description
+# TODO: nixos-rebuild with flakes may hide the warning, maybe turn on -L by default for those?
+for (k, v) in options.items():
+    if v.value.get('description', None) is None:
+        print(f"\x1b[1;31mwarning: option {v.name} has no description\x1b[0m", file=sys.stderr)
+        v.value['description'] = "This option has no description."
+
+json.dump(unpivot(options), fp=sys.stdout)
diff --git a/nixos/modules/config/qt5.nix b/nixos/modules/config/qt5.nix
index eabba9ad95f0..24b2a6f9f4a4 100644
--- a/nixos/modules/config/qt5.nix
+++ b/nixos/modules/config/qt5.nix
@@ -101,4 +101,7 @@ in
     environment.systemPackages = packages;
 
   };
+
+  # uses relatedPackages
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/i18n/input-method/fcitx.nix b/nixos/modules/i18n/input-method/fcitx.nix
index 57960cc365b6..7738581b893a 100644
--- a/nixos/modules/i18n/input-method/fcitx.nix
+++ b/nixos/modules/i18n/input-method/fcitx.nix
@@ -40,4 +40,7 @@ in
     };
     services.xserver.displayManager.sessionCommands = "${fcitxPackage}/bin/fcitx";
   };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/i18n/input-method/ibus.nix b/nixos/modules/i18n/input-method/ibus.nix
index 92f8c64338a4..c5b0cbc21502 100644
--- a/nixos/modules/i18n/input-method/ibus.nix
+++ b/nixos/modules/i18n/input-method/ibus.nix
@@ -80,4 +80,7 @@ in
       ibusPackage
     ];
   };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/i18n/input-method/kime.nix b/nixos/modules/i18n/input-method/kime.nix
index e462cae2437b..729a665614ae 100644
--- a/nixos/modules/i18n/input-method/kime.nix
+++ b/nixos/modules/i18n/input-method/kime.nix
@@ -45,5 +45,7 @@ in
 
     environment.etc."xdg/kime/config.yaml".text = replaceStrings [ "\\\\" ] [ "\\" ] (builtins.toJSON cfg.config);
   };
-}
 
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
+}
diff --git a/nixos/modules/misc/documentation.nix b/nixos/modules/misc/documentation.nix
index 64b1c15086fc..f868e4b709a6 100644
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@@ -1,19 +1,35 @@
-{ config, lib, pkgs, extendModules, noUserModules, ... }:
+{ config, options, lib, pkgs, utils, modules, baseModules, extraModules, modulesPath, ... }:
 
 with lib;
 
 let
 
   cfg = config.documentation;
+  allOpts = options;
 
   /* Modules for which to show options even when not imported. */
   extraDocModules = [ ../virtualisation/qemu-vm.nix ];
 
-  /* For the purpose of generating docs, evaluate options with each derivation
-    in `pkgs` (recursively) replaced by a fake with path "\${pkgs.attribute.path}".
-    It isn't perfect, but it seems to cover a vast majority of use cases.
-    Caveat: even if the package is reached by a different means,
-    the path above will be shown and not e.g. `${config.services.foo.package}`. */
+  canCacheDocs = m:
+    let
+      f = import m;
+      instance = f (mapAttrs (n: _: abort "evaluating ${n} for `meta` failed") (functionArgs f));
+    in
+      cfg.nixos.splitOptionDocBuild
+        && builtins.isPath m
+        && isFunction f
+        && instance ? options
+        && instance.meta.buildDocsInSandbox or true;
+
+  docModules =
+    let
+      p = partition canCacheDocs (baseModules ++ extraDocModules);
+    in
+      {
+        lazy = p.right;
+        eager = p.wrong ++ optionals cfg.nixos.includeAllModules (extraModules ++ modules);
+      };
+
   manual = import ../../doc/manual rec {
     inherit pkgs config;
     version = config.system.nixos.release;
@@ -21,10 +37,17 @@ let
     extraSources = cfg.nixos.extraModuleSources;
     options =
       let
-        extendNixOS = if cfg.nixos.includeAllModules then extendModules else noUserModules.extendModules;
-        scrubbedEval = extendNixOS {
-          modules = extraDocModules;
-          specialArgs.pkgs = scrubDerivations "pkgs" pkgs;
+        scrubbedEval = evalModules {
+          modules = [ {
+            _module.check = false;
+          } ] ++ docModules.eager;
+          specialArgs = {
+            pkgs = scrubDerivations "pkgs" pkgs;
+            # allow access to arbitrary options for eager modules, eg for getting
+            # option types from lazy modules
+            options = allOpts;
+            inherit modulesPath utils;
+          };
         };
         scrubDerivations = namePrefix: pkgSet: mapAttrs
           (name: value:
@@ -36,6 +59,48 @@ let
           )
           pkgSet;
       in scrubbedEval.options;
+    baseOptionsJSON =
+      let
+        filter =
+          builtins.filterSource
+            (n: t:
+              (t == "directory" -> baseNameOf n != "tests")
+              && (t == "file" -> hasSuffix ".nix" n)
+            );
+      in
+        pkgs.runCommand "lazy-options.json" {
+          libPath = filter "${toString pkgs.path}/lib";
+          pkgsLibPath = filter "${toString pkgs.path}/pkgs/pkgs-lib";
+          nixosPath = filter "${toString pkgs.path}/nixos";
+          modules = map (p: ''"${removePrefix "${modulesPath}/" (toString p)}"'') docModules.lazy;
+        } ''
+          export NIX_STORE_DIR=$TMPDIR/store
+          export NIX_STATE_DIR=$TMPDIR/state
+          ${pkgs.nix}/bin/nix-instantiate \
+            --show-trace \
+            --eval --json --strict \
+            --argstr libPath "$libPath" \
+            --argstr pkgsLibPath "$pkgsLibPath" \
+            --argstr nixosPath "$nixosPath" \
+            --arg modules "[ $modules ]" \
+            --argstr stateVersion "${options.system.stateVersion.default}" \
+            --argstr release "${config.system.nixos.release}" \
+            $nixosPath/lib/eval-cacheable-options.nix > $out \
+            || {
+              echo -en "\e[1;31m"
+              echo 'Cacheable portion of option doc build failed.'
+              echo 'Usually this means that an option attribute that ends up in documentation (eg' \
+                '`default` or `description`) depends on the restricted module arguments' \
+                '`config` or `pkgs`.'
+              echo
+              echo 'Rebuild your configuration with `--show-trace` to find the offending' \
+                'location. Remove the references to restricted arguments (eg by escaping' \
+                'their antiquotations or adding a `defaultText`) or disable the sandboxed' \
+                'build for the failing module by setting `meta.buildDocsInSandbox = false`.'
+              echo -en "\e[0m"
+              exit 1
+            } >&2
+        '';
   };
 
 
@@ -191,6 +256,16 @@ in
         '';
       };
 
+      nixos.splitOptionDocBuild = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to split the option docs build into a cacheable and an uncacheable part.
+          Splitting the build can substantially decrease the amount of time needed to build
+          the manual, but some user modules may be incompatible with this splitting.
+        '';
+      };
+
       nixos.includeAllModules = mkOption {
         type = types.bool;
         default = false;
diff --git a/nixos/modules/misc/meta.nix b/nixos/modules/misc/meta.nix
index 3dd97cbec235..8e689a63f6bf 100644
--- a/nixos/modules/misc/meta.nix
+++ b/nixos/modules/misc/meta.nix
@@ -54,6 +54,21 @@ in
         '';
       };
 
+      buildDocsInSandbox = mkOption {
+        type = types.bool // {
+          merge = loc: defs: defs;
+        };
+        internal = true;
+        default = true;
+        description = ''
+          Whether to include this module in the split options doc build.
+          Disable if the module references `config`, `pkgs` or other module
+          arguments that cannot be evaluated as constants.
+
+          This option should be defined at most once per module.
+        '';
+      };
+
     };
   };
 
diff --git a/nixos/modules/misc/nixpkgs.nix b/nixos/modules/misc/nixpkgs.nix
index 08bc4398555b..2e0c8e4cf2c4 100644
--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@@ -248,4 +248,7 @@ in
       )
     ];
   };
+
+  # needs a full nixpkgs path to import nixpkgs
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index fc0d65d5148e..6c526f6d4f2d 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -119,4 +119,6 @@ in
 
   };
 
+  # uses version info nixpkgs, which requires a full nixpkgs path
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/programs/dmrconfig.nix b/nixos/modules/programs/dmrconfig.nix
index d2a5117c48ef..73e1b529da9f 100644
--- a/nixos/modules/programs/dmrconfig.nix
+++ b/nixos/modules/programs/dmrconfig.nix
@@ -7,6 +7,8 @@ let
 
 in {
   meta.maintainers = [ maintainers.etu ];
+  # uses relatedPackages
+  meta.buildDocsInSandbox = false;
 
   ###### interface
   options = {
diff --git a/nixos/modules/programs/gnupg.nix b/nixos/modules/programs/gnupg.nix
index fe5d7bd834b2..b41f30287ea5 100644
--- a/nixos/modules/programs/gnupg.nix
+++ b/nixos/modules/programs/gnupg.nix
@@ -149,4 +149,6 @@ in
     ];
   };
 
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/programs/tmux.nix b/nixos/modules/programs/tmux.nix
index c39908751d29..54c32a463e52 100644
--- a/nixos/modules/programs/tmux.nix
+++ b/nixos/modules/programs/tmux.nix
@@ -185,4 +185,7 @@ in {
   imports = [
     (lib.mkRenamedOptionModule [ "programs" "tmux" "extraTmuxConf" ] [ "programs" "tmux" "extraConfig" ])
   ];
+
+  # uses relatedPackages
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/backup/sanoid.nix b/nixos/modules/services/backup/sanoid.nix
index e70063415ec0..5eb031b2e9f0 100644
--- a/nixos/modules/services/backup/sanoid.nix
+++ b/nixos/modules/services/backup/sanoid.nix
@@ -51,7 +51,10 @@ let
   datasetOptions = rec {
     use_template = mkOption {
       description = "Names of the templates to use for this dataset.";
-      type = types.listOf (types.enum (attrNames cfg.templates));
+      type = types.listOf (types.str // {
+        check = (types.enum (attrNames cfg.templates)).check;
+        description = "configured template name";
+      });
       default = [ ];
     };
     useTemplate = use_template;
diff --git a/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix b/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
index 4be3e881a9dc..803438b6f7e5 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
@@ -29,6 +29,8 @@ in {
 
   meta = {
     maintainers = teams.freedesktop.members;
+    # uses attributes of the linked package
+    buildDocsInSandbox = false;
   };
 
   ###### interface
diff --git a/nixos/modules/services/desktops/pipewire/pipewire.nix b/nixos/modules/services/desktops/pipewire/pipewire.nix
index 55755ecd6457..372b4785f185 100644
--- a/nixos/modules/services/desktops/pipewire/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@@ -40,6 +40,8 @@ in {
 
   meta = {
     maintainers = teams.freedesktop.members;
+    # uses attributes of the linked package
+    buildDocsInSandbox = false;
   };
 
   ###### interface
diff --git a/nixos/modules/services/hardware/thinkfan.nix b/nixos/modules/services/hardware/thinkfan.nix
index 4ea829e496e8..1c5b428d5d65 100644
--- a/nixos/modules/services/hardware/thinkfan.nix
+++ b/nixos/modules/services/hardware/thinkfan.nix
@@ -221,4 +221,7 @@ in {
     boot.extraModprobeConfig = "options thinkpad_acpi experimental=1 fan_control=1";
 
   };
+
+  # uses relatedPackages
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/misc/matrix-appservice-irc.nix b/nixos/modules/services/misc/matrix-appservice-irc.nix
index 02627e51c932..b041c9c82c56 100644
--- a/nixos/modules/services/misc/matrix-appservice-irc.nix
+++ b/nixos/modules/services/misc/matrix-appservice-irc.nix
@@ -226,4 +226,7 @@ in {
       isSystemUser = true;
     };
   };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/networking/dnscrypt-proxy2.nix b/nixos/modules/services/networking/dnscrypt-proxy2.nix
index dc6a019e9b77..316e6e37f9da 100644
--- a/nixos/modules/services/networking/dnscrypt-proxy2.nix
+++ b/nixos/modules/services/networking/dnscrypt-proxy2.nix
@@ -118,4 +118,7 @@ in
       };
     };
   };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/networking/kea.nix b/nixos/modules/services/networking/kea.nix
index 4da47f575f79..17b4eb2e283b 100644
--- a/nixos/modules/services/networking/kea.nix
+++ b/nixos/modules/services/networking/kea.nix
@@ -378,4 +378,6 @@ in
   ]);
 
   meta.maintainers = with maintainers; [ hexa ];
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix
index 9fb06af7442e..6fd81521e7fb 100644
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@@ -228,5 +228,6 @@ in
   };
 
   meta.maintainers = with maintainers; [ rnhmjoj ];
-
+  # uses relatedPackages
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/security/vaultwarden/default.nix b/nixos/modules/services/security/vaultwarden/default.nix
index 5b951bc85ec0..71088fc4dcd8 100644
--- a/nixos/modules/services/security/vaultwarden/default.nix
+++ b/nixos/modules/services/security/vaultwarden/default.nix
@@ -179,4 +179,7 @@ in {
       wantedBy = [ "multi-user.target" ];
     };
   };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/web-apps/dex.nix b/nixos/modules/services/web-apps/dex.nix
index f08dd65bdb0f..4d4689a4cf24 100644
--- a/nixos/modules/services/web-apps/dex.nix
+++ b/nixos/modules/services/web-apps/dex.nix
@@ -112,4 +112,7 @@ in
       };
     };
   };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/web-apps/gerrit.nix b/nixos/modules/services/web-apps/gerrit.nix
index 9ee9dbf1aa49..6bfc67368dd5 100644
--- a/nixos/modules/services/web-apps/gerrit.nix
+++ b/nixos/modules/services/web-apps/gerrit.nix
@@ -237,4 +237,6 @@ in
   };
 
   meta.maintainers = with lib.maintainers; [ edef zimbatm ];
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/web-apps/jirafeau.nix b/nixos/modules/services/web-apps/jirafeau.nix
index 83cf224f7d27..a95e2b4f82a9 100644
--- a/nixos/modules/services/web-apps/jirafeau.nix
+++ b/nixos/modules/services/web-apps/jirafeau.nix
@@ -167,4 +167,7 @@ in
       "d ${cfg.dataDir}/async/ 0750 ${user} ${group} - -"
     ];
   };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 6692d67081c5..e04b30a7d62d 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -932,4 +932,6 @@ in {
   ]);
 
   meta.doc = ./nextcloud.xml;
+  # uses relatedPackages
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/web-apps/powerdns-admin.nix b/nixos/modules/services/web-apps/powerdns-admin.nix
index ce99b606c318..4661ba80c5d6 100644
--- a/nixos/modules/services/web-apps/powerdns-admin.nix
+++ b/nixos/modules/services/web-apps/powerdns-admin.nix
@@ -146,4 +146,7 @@ in
       group = "powerdnsadmin";
     };
   };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 24d925734423..f0cabdd4465a 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -865,4 +865,6 @@ in
 
   };
 
+  # uses relatedPackages
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/system/activation/top-level.nix b/nixos/modules/system/activation/top-level.nix
index 501998fa399e..2efe0f05e0c0 100644
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -317,4 +317,6 @@ in
 
   };
 
+  # uses extendModules to generate a type
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index fa3e25afb03e..29e3aa024dfa 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -999,4 +999,7 @@ in
       ];
 
   };
+
+  # uses types of services/x11/xserver.nix
+  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix
index f8f4af4f6b85..fc640bd947b8 100644
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@@ -451,4 +451,7 @@ in
 
   };
 
+
+  # uses relatedPackages
+  meta.buildDocsInSandbox = false;
 }

From b92a47c87cfc4ff750f69d4de54b016e5f53c449 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Sat, 18 Dec 2021 18:57:45 +0100
Subject: [PATCH 12/44] nixos/make-options-doc: add type annotations to
 mergeJSON.py

---
 nixos/lib/make-options-doc/mergeJSON.py | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/nixos/lib/make-options-doc/mergeJSON.py b/nixos/lib/make-options-doc/mergeJSON.py
index e7f6897c6d0d..b7dfe2b88e7a 100644
--- a/nixos/lib/make-options-doc/mergeJSON.py
+++ b/nixos/lib/make-options-doc/mergeJSON.py
@@ -1,9 +1,12 @@
 import collections
 import json
 import sys
+from typing import Any, Dict, List
+
+JSON = Dict[str, Any]
 
 class Key:
-    def __init__(self, path):
+    def __init__(self, path: List[str]):
         self.path = path
     def __hash__(self):
         result = 0
@@ -16,8 +19,8 @@ class Key:
 Option = collections.namedtuple('Option', ['name', 'value'])
 
 # pivot a dict of options keyed by their display name to a dict keyed by their path
-def pivot(options):
-    result = dict()
+def pivot(options: Dict[str, JSON]) -> Dict[Key, Option]:
+    result: Dict[Key, Option] = dict()
     for (name, opt) in options.items():
         result[Key(opt['loc'])] = Option(name, opt)
     return result
@@ -25,8 +28,8 @@ def pivot(options):
 # pivot back to indexed-by-full-name
 # like the docbook build we'll just fail if multiple options with differing locs
 # render to the same option name.
-def unpivot(options):
-    result = dict()
+def unpivot(options: Dict[Key, Option]) -> Dict[str, JSON]:
+    result: Dict[str, Dict] = dict()
     for (key, opt) in options.items():
         if opt.name in result:
             raise RuntimeError(

From 1301bdb185c4d0d7c30d0400d76eae8669b5b64d Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Sat, 18 Dec 2021 19:21:21 +0100
Subject: [PATCH 13/44] nixos/make-options-doc: turn relatedPackages into links

link to search.nixos.org instead of pulling package metadata out of pkgs. this
lets us cache docs of a few more modules and provides easier access to package
info from the HTML manual, but makes the manpage slightly less useful since
package description are no longer rendered.
---
 nixos/lib/make-options-doc/default.nix        | 31 +++++++++++--------
 nixos/modules/config/qt5.nix                  |  3 --
 nixos/modules/programs/dmrconfig.nix          |  2 --
 nixos/modules/programs/tmux.nix               |  3 --
 nixos/modules/services/hardware/thinkfan.nix  |  3 --
 nixos/modules/services/networking/searx.nix   |  2 --
 nixos/modules/services/web-apps/nextcloud.nix |  2 --
 nixos/modules/virtualisation/xen-dom0.nix     |  4 ---
 8 files changed, 18 insertions(+), 32 deletions(-)

diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index 4b40af34b185..cc4ddd55d026 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -55,10 +55,15 @@ let
   # ../../../lib/options.nix influences.
   #
   # Each element of `relatedPackages` can be either
-  # - a string:  that will be interpreted as an attribute name from `pkgs`,
-  # - a list:    that will be interpreted as an attribute path from `pkgs`,
-  # - an attrset: that can specify `name`, `path`, `package`, `comment`
+  # - a string:  that will be interpreted as an attribute name from `pkgs` and turned into a link
+  #              to search.nixos.org,
+  # - a list:    that will be interpreted as an attribute path from `pkgs` and turned into a link
+  #              to search.nixos.org,
+  # - an attrset: that can specify `name`, `path`, `comment`
   #   (either of `name`, `path` is required, the rest are optional).
+  #
+  # NOTE: No checks against `pkgs` are made to ensure that the referenced package actually exists.
+  # Such checks are not compatible with option docs caching.
   genRelatedPackages = packages: optName:
     let
       unpack = p: if lib.isString p then { name = p; }
@@ -68,16 +73,16 @@ let
         let
           title = args.title or null;
           name = args.name or (lib.concatStringsSep "." args.path);
-          path = args.path or [ args.name ];
-          package = args.package or (lib.attrByPath path (throw "Invalid package attribute path `${toString path}' found while evaluating `relatedPackages' of option `${optName}'") pkgs);
-        in "<listitem>"
-        + "<para><literal>${lib.optionalString (title != null) "${title} aka "}pkgs.${name} (${package.meta.name})</literal>"
-        + lib.optionalString (!package.meta.available) " <emphasis>[UNAVAILABLE]</emphasis>"
-        + ": ${package.meta.description or "???"}.</para>"
-        + lib.optionalString (args ? comment) "\n<para>${args.comment}</para>"
-        # Lots of `longDescription's break DocBook, so we just wrap them into <programlisting>
-        + lib.optionalString (package.meta ? longDescription) "\n<programlisting>${package.meta.longDescription}</programlisting>"
-        + "</listitem>";
+        in ''
+          <listitem>
+            <para>
+              <link xlink:href="https://search.nixos.org/packages?show=${name}&amp;sort=relevance&amp;query=${name}">
+                <literal>${lib.optionalString (title != null) "${title} aka "}pkgs.${name}</literal>
+              </link>
+            </para>
+            ${lib.optionalString (args ? comment) "<para>${args.comment}</para>"}
+          </listitem>
+        '';
     in "<itemizedlist>${lib.concatStringsSep "\n" (map (p: describe (unpack p)) packages)}</itemizedlist>";
 
   # Remove invisible and internal options.
diff --git a/nixos/modules/config/qt5.nix b/nixos/modules/config/qt5.nix
index 24b2a6f9f4a4..eabba9ad95f0 100644
--- a/nixos/modules/config/qt5.nix
+++ b/nixos/modules/config/qt5.nix
@@ -101,7 +101,4 @@ in
     environment.systemPackages = packages;
 
   };
-
-  # uses relatedPackages
-  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/programs/dmrconfig.nix b/nixos/modules/programs/dmrconfig.nix
index 73e1b529da9f..d2a5117c48ef 100644
--- a/nixos/modules/programs/dmrconfig.nix
+++ b/nixos/modules/programs/dmrconfig.nix
@@ -7,8 +7,6 @@ let
 
 in {
   meta.maintainers = [ maintainers.etu ];
-  # uses relatedPackages
-  meta.buildDocsInSandbox = false;
 
   ###### interface
   options = {
diff --git a/nixos/modules/programs/tmux.nix b/nixos/modules/programs/tmux.nix
index 54c32a463e52..c39908751d29 100644
--- a/nixos/modules/programs/tmux.nix
+++ b/nixos/modules/programs/tmux.nix
@@ -185,7 +185,4 @@ in {
   imports = [
     (lib.mkRenamedOptionModule [ "programs" "tmux" "extraTmuxConf" ] [ "programs" "tmux" "extraConfig" ])
   ];
-
-  # uses relatedPackages
-  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/hardware/thinkfan.nix b/nixos/modules/services/hardware/thinkfan.nix
index 1c5b428d5d65..4ea829e496e8 100644
--- a/nixos/modules/services/hardware/thinkfan.nix
+++ b/nixos/modules/services/hardware/thinkfan.nix
@@ -221,7 +221,4 @@ in {
     boot.extraModprobeConfig = "options thinkpad_acpi experimental=1 fan_control=1";
 
   };
-
-  # uses relatedPackages
-  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/networking/searx.nix b/nixos/modules/services/networking/searx.nix
index 6fd81521e7fb..b73f255eb9dd 100644
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@@ -228,6 +228,4 @@ in
   };
 
   meta.maintainers = with maintainers; [ rnhmjoj ];
-  # uses relatedPackages
-  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index e04b30a7d62d..6692d67081c5 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -932,6 +932,4 @@ in {
   ]);
 
   meta.doc = ./nextcloud.xml;
-  # uses relatedPackages
-  meta.buildDocsInSandbox = false;
 }
diff --git a/nixos/modules/virtualisation/xen-dom0.nix b/nixos/modules/virtualisation/xen-dom0.nix
index fc640bd947b8..975eed10cd26 100644
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@@ -450,8 +450,4 @@ in
     };
 
   };
-
-
-  # uses relatedPackages
-  meta.buildDocsInSandbox = false;
 }

From 50954ad1c5847e04fe78fa155fed97ee52dcb9f6 Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Sat, 18 Dec 2021 19:37:41 +0100
Subject: [PATCH 14/44] nixos/make-options-doc: treat missing descriptions as
 errors by default

this partially solves the problem of "missing description" warnings of the
options doc build being lost by nix build, at the cost of failing builds that
previously ran. an option to disable this behaviour is provided.
---
 nixos/doc/manual/default.nix            | 13 +++++++++++--
 nixos/lib/make-options-doc/default.nix  |  4 ++++
 nixos/lib/make-options-doc/mergeJSON.py | 20 ++++++++++++++++----
 nixos/modules/misc/documentation.nix    | 14 ++++++++++++--
 4 files changed, 43 insertions(+), 8 deletions(-)

diff --git a/nixos/doc/manual/default.nix b/nixos/doc/manual/default.nix
index 9bc63686fa3a..52d500c64d33 100644
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -1,4 +1,13 @@
-{ pkgs, options, config, version, revision, extraSources ? [], baseOptionsJSON ? null, prefix ? ../../.. }:
+{ pkgs
+, options
+, config
+, version
+, revision
+, extraSources ? []
+, baseOptionsJSON ? null
+, warningsAreErrors ? true
+, prefix ? ../../..
+}:
 
 with pkgs;
 
@@ -15,7 +24,7 @@ let
   stripAnyPrefixes = lib.flip (lib.foldr lib.removePrefix) prefixesToStrip;
 
   optionsDoc = buildPackages.nixosOptionsDoc {
-    inherit options revision baseOptionsJSON;
+    inherit options revision baseOptionsJSON warningsAreErrors;
     transformOptions = opt: opt // {
       # Clean up declaration sites to not refer to the NixOS source tree.
       declarations = map stripAnyPrefixes opt.declarations;
diff --git a/nixos/lib/make-options-doc/default.nix b/nixos/lib/make-options-doc/default.nix
index cc4ddd55d026..57652dd5db1e 100644
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@@ -25,6 +25,9 @@
 # used to split the options doc build into a static part (nixos/modules) and a dynamic part
 # (non-nixos modules imported via configuration.nix, other module sources).
 , baseOptionsJSON ? null
+# instead of printing warnings for eg options with missing descriptions (which may be lost
+# by nix build unless -L is given), emit errors instead and fail the build
+, warningsAreErrors ? true
 }:
 
 let
@@ -121,6 +124,7 @@ in rec {
           then "cp $options $dst/options.json"
           else ''
             ${pkgs.python3Minimal}/bin/python ${./mergeJSON.py} \
+              ${lib.optionalString warningsAreErrors "--warnings-are-errors"} \
               ${baseOptionsJSON} $options \
               > $dst/options.json
           ''
diff --git a/nixos/lib/make-options-doc/mergeJSON.py b/nixos/lib/make-options-doc/mergeJSON.py
index b7dfe2b88e7a..029787a31586 100644
--- a/nixos/lib/make-options-doc/mergeJSON.py
+++ b/nixos/lib/make-options-doc/mergeJSON.py
@@ -41,8 +41,10 @@ def unpivot(options: Dict[Key, Option]) -> Dict[str, JSON]:
         result[opt.name] = opt.value
     return result
 
-options = pivot(json.load(open(sys.argv[1], 'r')))
-overrides = pivot(json.load(open(sys.argv[2], 'r')))
+warningsAreErrors = sys.argv[1] == "--warnings-are-errors"
+optOffset = 1 if warningsAreErrors else 0
+options = pivot(json.load(open(sys.argv[1 + optOffset], 'r')))
+overrides = pivot(json.load(open(sys.argv[2 + optOffset], 'r')))
 
 # fix up declaration paths in lazy options, since we don't eval them from a full nixpkgs dir
 for (k, v) in options.items():
@@ -65,10 +67,20 @@ for (k, v) in overrides.items():
             cur[ok] = ov
 
 # check that every option has a description
-# TODO: nixos-rebuild with flakes may hide the warning, maybe turn on -L by default for those?
+hasWarnings = False
 for (k, v) in options.items():
     if v.value.get('description', None) is None:
-        print(f"\x1b[1;31mwarning: option {v.name} has no description\x1b[0m", file=sys.stderr)
+        severity = "error" if warningsAreErrors else "warning"
+        hasWarnings = True
+        print(f"\x1b[1;31m{severity}: option {v.name} has no description\x1b[0m", file=sys.stderr)
         v.value['description'] = "This option has no description."
+if hasWarnings and warningsAreErrors:
+    print(
+        "\x1b[1;31m" +
+        "Treating warnings as errors. Set documentation.nixos.options.warningsAreErrors " +
+        "to false to ignore these warnings." +
+        "\x1b[0m",
+        file=sys.stderr)
+    sys.exit(1)
 
 json.dump(unpivot(options), fp=sys.stdout)
diff --git a/nixos/modules/misc/documentation.nix b/nixos/modules/misc/documentation.nix
index f868e4b709a6..4451f3026f85 100644
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@@ -15,7 +15,7 @@ let
       f = import m;
       instance = f (mapAttrs (n: _: abort "evaluating ${n} for `meta` failed") (functionArgs f));
     in
-      cfg.nixos.splitOptionDocBuild
+      cfg.nixos.options.splitBuild
         && builtins.isPath m
         && isFunction f
         && instance ? options
@@ -101,6 +101,7 @@ let
               exit 1
             } >&2
         '';
+    inherit (cfg.nixos.options) warningsAreErrors;
   };
 
 
@@ -256,7 +257,7 @@ in
         '';
       };
 
-      nixos.splitOptionDocBuild = mkOption {
+      nixos.options.splitBuild = mkOption {
         type = types.bool;
         default = true;
         description = ''
@@ -266,6 +267,15 @@ in
         '';
       };
 
+      nixos.options.warningsAreErrors = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Treat warning emitted during the option documentation build (eg for missing option
+          descriptions) as errors.
+        '';
+      };
+
       nixos.includeAllModules = mkOption {
         type = types.bool;
         default = false;

From 1511e72b75b49cdeeee68def0c203f997d01bafa Mon Sep 17 00:00:00 2001
From: pennae <github@quasiparticle.net>
Date: Sat, 18 Dec 2021 20:10:18 +0100
Subject: [PATCH 15/44] nixos/documentation: avoid copying nixpkgs subpaths

the docs build should work well even when called from a git checkout of
nixpkgs, but should avoid as much work as possible in all cases.
if pkgs.path is already a store path we can avoid copying parts of it
into the docs build sandbox by wrapping pkgs.path in builtins.storePath
---
 nixos/modules/misc/documentation.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/misc/documentation.nix b/nixos/modules/misc/documentation.nix
index 4451f3026f85..e908a4ae02d7 100644
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@@ -67,11 +67,15 @@ let
               (t == "directory" -> baseNameOf n != "tests")
               && (t == "file" -> hasSuffix ".nix" n)
             );
+        pull = dir:
+          if isStorePath pkgs.path
+          then "${builtins.storePath pkgs.path}/${dir}"
+          else filter "${toString pkgs.path}/${dir}";
       in
         pkgs.runCommand "lazy-options.json" {
-          libPath = filter "${toString pkgs.path}/lib";
-          pkgsLibPath = filter "${toString pkgs.path}/pkgs/pkgs-lib";
-          nixosPath = filter "${toString pkgs.path}/nixos";
+          libPath = pull "lib";
+          pkgsLibPath = pull "pkgs/pkgs-lib";
+          nixosPath = pull "nixos";
           modules = map (p: ''"${removePrefix "${modulesPath}/" (toString p)}"'') docModules.lazy;
         } ''
           export NIX_STORE_DIR=$TMPDIR/store

From 3a5fd798dc4a6409a82d6318ab6e20de5699c9a4 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Sun, 2 Jan 2022 17:50:52 -0300
Subject: [PATCH 16/44] libretro: simplify mkLibRetroCore function

---
 pkgs/misc/emulators/retroarch/cores.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/misc/emulators/retroarch/cores.nix b/pkgs/misc/emulators/retroarch/cores.nix
index 09acbca8652d..d3fd311e1cc9 100644
--- a/pkgs/misc/emulators/retroarch/cores.nix
+++ b/pkgs/misc/emulators/retroarch/cores.nix
@@ -54,7 +54,7 @@ let
     , description
       # Check https://github.com/libretro/libretro-core-info for license information
     , license
-    , src ? null
+    , src ? (getCoreSrc core)
     , broken ? false
     , version ? "unstable-2021-12-06"
     , platforms ? retroarch.meta.platforms
@@ -63,15 +63,13 @@ let
     , normalizeCore ? true
     , ...
     }@args:
-    lib.makeOverridable stdenv.mkDerivation (
+    stdenv.mkDerivation (
       let
         d2u = if normalizeCore then (lib.replaceChars [ "-" ] [ "_" ]) else (x: x);
-        finalSrc = if src == null then getCoreSrc core else src;
       in
       (rec {
         pname = "libretro-${core}";
-        inherit version;
-        src = finalSrc;
+        inherit version src;
 
         buildInputs = [ zlib ] ++ args.extraBuildInputs or [ ];
         nativeBuildInputs = [ makeWrapper ] ++ args.extraNativeBuildInputs or [ ];

From d83e270109a084a5088e1c1af5b0cb9cca90efba Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Sun, 2 Jan 2022 19:03:54 -0300
Subject: [PATCH 17/44] libretro.citra: remove nix-prefetch-github hack

---
 pkgs/misc/emulators/retroarch/cores.nix   |  7 ----
 pkgs/misc/emulators/retroarch/hashes.json |  6 ++--
 pkgs/misc/emulators/retroarch/update.py   | 39 +++++++++++++----------
 3 files changed, 27 insertions(+), 25 deletions(-)

diff --git a/pkgs/misc/emulators/retroarch/cores.nix b/pkgs/misc/emulators/retroarch/cores.nix
index d3fd311e1cc9..4bbe12cbd298 100644
--- a/pkgs/misc/emulators/retroarch/cores.nix
+++ b/pkgs/misc/emulators/retroarch/cores.nix
@@ -306,13 +306,6 @@ in
 
   citra = mkLibRetroCore {
     core = "citra";
-    # `nix-prefetch-github` doesn't support `deepClone`, necessary for citra
-    # https://github.com/seppeljordan/nix-prefetch-github/issues/41
-    src = fetchFromGitHub {
-      inherit (hashesFile.citra) owner repo rev fetchSubmodules;
-      deepClone = true;
-      sha256 = "sha256-bwnYkMvbtRF5bGZRYVtMWxnCu9P45qeX4+ntOj9eRds=";
-    };
     description = "Port of Citra to libretro";
     license = lib.licenses.gpl2Plus;
     extraNativeBuildInputs = [ cmake pkg-config ];
diff --git a/pkgs/misc/emulators/retroarch/hashes.json b/pkgs/misc/emulators/retroarch/hashes.json
index 2d5e7411b8e4..4f01bcf8b470 100644
--- a/pkgs/misc/emulators/retroarch/hashes.json
+++ b/pkgs/misc/emulators/retroarch/hashes.json
@@ -122,8 +122,10 @@
         "owner": "libretro",
         "repo": "citra",
         "rev": "b1959d07a340bfd9af65ad464fd19eb6799a96ef",
-        "sha256": "Tw6Niba9gsZOMKGaXF9AZ5gdigB0mmFyqoRTMElM/Ps=",
-        "fetchSubmodules": true
+        "sha256": "bwnYkMvbtRF5bGZRYVtMWxnCu9P45qeX4+ntOj9eRds=",
+        "fetchSubmodules": true,
+        "leaveDotGit": true,
+        "deepClone": true
     },
     "desmume": {
         "owner": "libretro",
diff --git a/pkgs/misc/emulators/retroarch/update.py b/pkgs/misc/emulators/retroarch/update.py
index 831709d89e7c..857c5df6244d 100755
--- a/pkgs/misc/emulators/retroarch/update.py
+++ b/pkgs/misc/emulators/retroarch/update.py
@@ -1,12 +1,11 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ requests nix-prefetch-github ])" -p "git"
+#!nix-shell -I nixpkgs=../../../../ -i python3 -p "python3.withPackages (ps: with ps; [ requests nix-prefetch-github ])" -p "git"
 
 import json
 import sys
+import subprocess
 from pathlib import Path
 
-from nix_prefetch_github import nix_prefetch_github
-
 SCRIPT_PATH = Path(__file__).absolute().parent
 HASHES_PATH = SCRIPT_PATH / "hashes.json"
 CORES = {
@@ -27,7 +26,7 @@ CORES = {
     "bsnes": {"repo": "bsnes-libretro"},
     "bsnes-hd": {"repo": "bsnes-hd", "owner": "DerKoun"},
     "bsnes-mercury": {"repo": "bsnes-mercury"},
-    "citra": {"repo": "citra", "fetch_submodules": True},
+    "citra": {"repo": "citra", "fetch_submodules": True, "deep_clone": True, "leave_dot_git": True},
     "desmume": {"repo": "desmume"},
     "desmume2015": {"repo": "desmume2015"},
     "dolphin": {"repo": "dolphin"},
@@ -97,19 +96,27 @@ def info(*msg):
     print(*msg, file=sys.stderr)
 
 
-def get_repo_hash_fetchFromGitHub(repo, owner="libretro", fetch_submodules=False):
-    assert repo is not None, "Parameter 'repo' can't be None."
-
-    repo_hash = nix_prefetch_github(
-        owner=owner, repo=repo, fetch_submodules=fetch_submodules
+def get_repo_hash_fetchFromGitHub(
+    repo,
+    owner="libretro",
+    deep_clone=False,
+    fetch_submodules=False,
+    leave_dot_git=False,
+):
+    extra_args = []
+    if deep_clone:
+        extra_args.append("--deep-clone")
+    if fetch_submodules:
+        extra_args.append("--fetch-submodules")
+    if leave_dot_git:
+        extra_args.append("--leave-dot-git")
+    result = subprocess.run(
+        ["nix-prefetch-github", owner, repo, *extra_args],
+        check=True,
+        capture_output=True,
+        text=True,
     )
-    return {
-        "owner": repo_hash.repository.owner,
-        "repo": repo_hash.repository.name,
-        "rev": repo_hash.rev,
-        "sha256": repo_hash.sha256,
-        "fetchSubmodules": repo_hash.fetch_submodules,
-    }
+    return json.loads(result.stdout)
 
 
 def get_repo_hash(fetcher="fetchFromGitHub", **kwargs):

From ac96423f53d0f3277e7ae370b436122151458f6b Mon Sep 17 00:00:00 2001
From: Pierre Bourdon <delroth@gmail.com>
Date: Mon, 3 Jan 2022 00:37:26 +0100
Subject: [PATCH 18/44] nixosTests.sudo: fix test flakiness

One of the subtests in the sudo NixOS test suite was broken: instead of
running the sudo invocation as user 'test2', it was running it as root.
Since root doesn't require a password to use sudo, this was causing
random "broken pipe" errors when trying to pass it a password via stdin.
---
 nixos/tests/sudo.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/sudo.nix b/nixos/tests/sudo.nix
index 4885d6e17b82..ae9362ca70da 100644
--- a/nixos/tests/sudo.nix
+++ b/nixos/tests/sudo.nix
@@ -73,7 +73,7 @@ in
             machine.fail('su - test1 -c "sudo -n -u root true"')
 
         with subtest("users in group 'foobar' should be able to use sudo with password"):
-            machine.succeed("sudo -u test2 echo ${password} | sudo -S -u root true")
+            machine.succeed('su - test2 -c "echo ${password} | sudo -S -u root true"')
 
         with subtest("users in group 'barfoo' should be able to use sudo without password"):
             machine.succeed("sudo -u test3 sudo -n -u root true")

From 6886a9a246ee2054ac3542cb336f69536077da85 Mon Sep 17 00:00:00 2001
From: Pierre Bourdon <delroth@gmail.com>
Date: Mon, 3 Jan 2022 00:39:51 +0100
Subject: [PATCH 19/44] sudo: 1.9.7p2 -> 1.9.8p2

---
 pkgs/tools/security/sudo/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/sudo/default.nix b/pkgs/tools/security/sudo/default.nix
index e5207ea9d7b1..58afd5318df0 100644
--- a/pkgs/tools/security/sudo/default.nix
+++ b/pkgs/tools/security/sudo/default.nix
@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, buildPackages
 , coreutils
 , pam
 , groff
@@ -13,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sudo";
-  version = "1.9.7p2";
+  version = "1.9.8p2";
 
   src = fetchurl {
     url = "https://www.sudo.ws/dist/${pname}-${version}.tar.gz";
-    sha256 = "sha256-KLXucl2/iaeFL0LzCcqHfSgQqVMbTuz+WfOoS2tK/Kg=";
+    sha256 = "sha256-njuLjafe9DtuYMJXq+gEZyBWcP0PfAgd4UI8QUtoDy0=";
   };
 
   prePatch = ''
@@ -56,6 +57,7 @@ stdenv.mkDerivation rec {
       installFlags="sudoers_uid=$(id -u) sudoers_gid=$(id -g) sysconfdir=$out/etc rundir=$TMPDIR/dummy vardir=$TMPDIR/dummy DESTDIR=/"
     '';
 
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ groff ];
   buildInputs = [ pam ];
 

From 12ca21660a2081107b640f5c5858d7ab60ec39d1 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 3 Jan 2022 08:32:00 +0100
Subject: [PATCH 20/44] jaeles: init at 0.17

---
 pkgs/tools/security/jaeles/default.nix | 30 ++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix        |  2 ++
 2 files changed, 32 insertions(+)
 create mode 100644 pkgs/tools/security/jaeles/default.nix

diff --git a/pkgs/tools/security/jaeles/default.nix b/pkgs/tools/security/jaeles/default.nix
new file mode 100644
index 000000000000..e6e2905ed543
--- /dev/null
+++ b/pkgs/tools/security/jaeles/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "jaeles";
+  version = "0.17";
+
+  src = fetchFromGitHub {
+    owner = "jaeles-project";
+    repo = pname;
+    rev = "beta-v${version}";
+    hash = "sha256-IGB+TYMOOO7fvRfDe9y+JSXuDSMDVJK+N4hS+kezG48=";
+  };
+
+  vendorSha256 = "sha256-3CKDkxvr7egHui6d8+25t9Zq2ePMUOULr+1NjEm4GXA=";
+
+  runVend = true;
+
+  # Tests want to download signatures
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Tool for automated Web application testing";
+    homepage = "https://github.com/jaeles-project/jaeles";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 15186d004ddf..49436a9f3624 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -26441,6 +26441,8 @@ with pkgs;
   jackmix = libsForQt5.callPackage ../applications/audio/jackmix { };
   jackmix_jack1 = jackmix.override { jack = jack1; };
 
+  jaeles = callPackage ../tools/security/jaeles { };
+
   jalv = callPackage ../applications/audio/jalv { };
 
   jameica = callPackage ../applications/office/jameica {

From d5411548aece612b3fc45896dc9ef559884fb594 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 3 Jan 2022 20:31:50 +0100
Subject: [PATCH 21/44] metasploit: 6.1.21 -> 6.1.22

---
 pkgs/tools/security/metasploit/Gemfile      |  2 +-
 pkgs/tools/security/metasploit/Gemfile.lock | 14 ++++++-------
 pkgs/tools/security/metasploit/default.nix  |  4 ++--
 pkgs/tools/security/metasploit/gemset.nix   | 22 ++++++++++-----------
 4 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index a5808532cafc..2b1a9c3c2d31 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.1.21"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.1.22"
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 84330722835e..d0e479851593 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 0b16a2cd771a6afd286188da1c60c9fd772ab0f1
-  ref: refs/tags/6.1.21
+  revision: 3bfd2d8eeab3f8ab7efd7a46f8125a7a3bb5f2f0
+  ref: refs/tags/6.1.22
   specs:
-    metasploit-framework (6.1.21)
+    metasploit-framework (6.1.22)
       actionpack (~> 6.0)
       activerecord (~> 6.0)
       activesupport (~> 6.0)
@@ -214,7 +214,7 @@ GEM
     httpclient (2.8.3)
     i18n (1.8.11)
       concurrent-ruby (~> 1.0)
-    io-console (0.5.9)
+    io-console (0.5.11)
     irb (1.3.6)
       reline (>= 0.2.5)
     jmespath (1.4.0)
@@ -288,7 +288,7 @@ GEM
       pcaprub
     patch_finder (1.0.2)
     pcaprub (0.12.4)
-    pdf-reader (2.7.0)
+    pdf-reader (2.8.0)
       Ascii85 (~> 1.0)
       afm (~> 0.2.1)
       hashery (~> 2.0)
@@ -375,7 +375,7 @@ GEM
     ruby-macho (2.5.1)
     ruby-rc4 (0.1.5)
     ruby2_keywords (0.0.5)
-    ruby_smb (2.0.12)
+    ruby_smb (2.0.13)
       bindata
       openssl-ccm
       openssl-cmac
@@ -433,7 +433,7 @@ GEM
       activesupport (>= 4.2, < 7.0)
     xmlrpc (0.3.2)
       webrick
-    zeitwerk (2.5.1)
+    zeitwerk (2.5.3)
 
 PLATFORMS
   ruby
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index e2659abe6ab3..426f92586440 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.1.21";
+  version = "6.1.22";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-43abc6XUmLZZ+KuaAqyT/fJT+79JWKeRRA41NJOWoPY=";
+    sha256 = "sha256-D3OmkXEqOgDOf1fvMtWiFT4bLw38SNHp2A25xAkq7Ew=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 9e6f49e96d7f..6d2cea42c652 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -554,10 +554,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0pmafwxh8z1apnk7bb1ibnbhfrgb1jgilxm4j8d0fcqlc2ggmbja";
+      sha256 = "0r9kxrf9jccrr329pa3s37rf16vy426cbqmfwxkav1fidwvih93y";
       type = "gem";
     };
-    version = "0.5.9";
+    version = "0.5.11";
   };
   irb = {
     groups = ["default"];
@@ -664,12 +664,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "0b16a2cd771a6afd286188da1c60c9fd772ab0f1";
-      sha256 = "1xm0js9k8d8f8j8sfn29pzxm7wpxjfn056mbz1cvd66llmrrnxp3";
+      rev = "3bfd2d8eeab3f8ab7efd7a46f8125a7a3bb5f2f0";
+      sha256 = "0k7c584w9f8dv3lx2j7w1lpinghmlbak5vspgz700fiaf68scwqg";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.1.21";
+    version = "6.1.22";
   };
   metasploit-model = {
     groups = ["default"];
@@ -947,10 +947,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0c8s9p3s7z39zv9s6avaf5ddqncpglraqpqn50yhb1lrnna3akgi";
+      sha256 = "18vsmybpvyi0favlabjipznpc8hgprsm7jpw3s7xr01c3lpjli7y";
       type = "gem";
     };
-    version = "2.7.0";
+    version = "2.8.0";
   };
   pg = {
     groups = ["default"];
@@ -1337,10 +1337,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "103rm0p44w8q2gyw3yigb6k2v12hi7gkj71b2wkj4859jzi96vyb";
+      sha256 = "1bjsh4qi6ii4zl0g0na004ylk991ar9rg5kz9rq1q7r5crxy2rw7";
       type = "gem";
     };
-    version = "2.0.12";
+    version = "2.0.13";
   };
   rubyntlm = {
     groups = ["default"];
@@ -1607,9 +1607,9 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "18l4r6layck0d80ydc692mv1lxak5xbf6w2paj1x7m2ggbggzxgj";
+      sha256 = "0lmg9x683gr9mkrbq9df2m0zb0650mdfxqna0bs10js44inv7znx";
       type = "gem";
     };
-    version = "2.5.1";
+    version = "2.5.3";
   };
 }

From 6ec5cf98d7f270cf7783600c0649201dd5b39e03 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 3 Jan 2022 20:52:27 +0100
Subject: [PATCH 22/44] snapcast: 0.25.0 -> 0.26.0

---
 pkgs/applications/audio/snapcast/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/snapcast/default.nix b/pkgs/applications/audio/snapcast/default.nix
index d2b6ba07d2eb..19016b700fdc 100644
--- a/pkgs/applications/audio/snapcast/default.nix
+++ b/pkgs/applications/audio/snapcast/default.nix
@@ -37,13 +37,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "snapcast";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner  = "badaix";
     repo   = "snapcast";
     rev    = "v${version}";
-    sha256 = "064pcpr5dsv9hncqkrnxriva4xjv1vcxhvc69h1an8x8vn4dwgmf";
+    sha256 = "sha256-CCifn9OEFM//Hk1PJj8T3MXIV8pXCTdBBXPsHuZwLyQ=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

From dbedaf3f4862f8ea391dd41834b224daaf00857b Mon Sep 17 00:00:00 2001
From: Nikolay Amiantov <ab@fmap.me>
Date: Tue, 4 Jan 2022 04:19:27 +0300
Subject: [PATCH 23/44] libfprint: 1.92.1 -> 1.94.1

---
 pkgs/development/libraries/libfprint/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libfprint/default.nix b/pkgs/development/libraries/libfprint/default.nix
index 42e308f41a9e..daa1d2233426 100644
--- a/pkgs/development/libraries/libfprint/default.nix
+++ b/pkgs/development/libraries/libfprint/default.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libfprint";
-  version = "1.92.1";
+  version = "1.94.1";
   outputs = [ "out" "devdoc" ];
 
   src = fetchFromGitLab {
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "libfprint";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0dpwzmwl9jjpaz44znvy3v8s9sln0c71b756rs1knk0zx8sa1qbc";
+    sha256 = "sha256-xFmby1x2TRZqXrV9Einqu3002qMAN5tQga2mIAHfC9c=";
   };
 
   nativeBuildInputs = [

From 19bf1644594c050ccb8542c8038bf523c8a07e9a Mon Sep 17 00:00:00 2001
From: Nikolay Amiantov <ab@fmap.me>
Date: Tue, 4 Jan 2022 04:19:47 +0300
Subject: [PATCH 24/44] fprintd: 1.92.0 -> 1.94.1

---
 pkgs/tools/security/fprintd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/security/fprintd/default.nix b/pkgs/tools/security/fprintd/default.nix
index 1340ec26ca29..b0339846a67d 100644
--- a/pkgs/tools/security/fprintd/default.nix
+++ b/pkgs/tools/security/fprintd/default.nix
@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation rec {
   pname = "fprintd";
-  version = "1.92.0";
+  version = "1.94.1";
   outputs = [ "out" "devdoc" ];
 
   src = fetchFromGitLab {
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     owner = "libfprint";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0bqzxxb5iq3pdwdv1k8wsx3alirbjla6zgcki55b5p6mzrvk781x";
+    sha256 = "sha256-XHfHPffVp0jV3Md9Gui9v/nyOJ/bTWM3+hiR7WdEsgQ=";
   };
 
   nativeBuildInputs = [

From df577b1b00a0ff992df4469562418ea1a9ddada1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 4 Jan 2022 02:51:04 +0000
Subject: [PATCH 25/44] python38Packages.qcs-api-client: 0.20.5 -> 0.20.7

---
 pkgs/development/python-modules/qcs-api-client/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/qcs-api-client/default.nix b/pkgs/development/python-modules/qcs-api-client/default.nix
index 7e961b8a233d..c286cb3dc65b 100644
--- a/pkgs/development/python-modules/qcs-api-client/default.nix
+++ b/pkgs/development/python-modules/qcs-api-client/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "qcs-api-client";
-  version = "0.20.5";
+  version = "0.20.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-nSkCARZk6K5JMgiXunRBrb3pn5Ti6f493OOFzJYaW0M=";
+    sha256 = "64f3ee91cb9424ac1f27a2e13a4d03090a57d2e0e5edf6981a0b4e5295844c81";
   };
 
   propagatedBuildInputs = [

From b790f8ce318900a9c760dab496c066bd1502b2d6 Mon Sep 17 00:00:00 2001
From: Mauricio Collares <mauricio@collares.org>
Date: Tue, 4 Jan 2022 10:35:17 -0300
Subject: [PATCH 26/44] lean: 3.35.1 -> 3.36.0

---
 pkgs/applications/science/logic/lean/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/science/logic/lean/default.nix b/pkgs/applications/science/logic/lean/default.nix
index 0b53c2ed8e68..bb1463ad9648 100644
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lean";
-  version = "3.35.1";
+  version = "3.36.0";
 
   src = fetchFromGitHub {
     owner  = "leanprover-community";
@@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
     # from. this is then used to check whether an olean file should be
     # rebuilt. don't use a tag as rev because this will get replaced into
     # src/githash.h.in in preConfigure.
-    rev    = "4887d8a30621941c883f208e151e61ab268c006d";
-    sha256 = "0xmiysmq80dnzq1lw9jmprc85kfimw0sl8m5rbi05z8f782gzv1z";
+    rev    = "e948149d3d1bbdb8eac9cd103d58626a59fae3b9";
+    sha256 = "1lcjif29lfj3myc6j63ifk8fdvylyv8g82g2dv0d85nz7mpbq47b";
   };
 
   nativeBuildInputs = [ cmake ];

From 4437f2441e9370b8031a87c3c04985da204d73c1 Mon Sep 17 00:00:00 2001
From: midchildan <git@midchildan.org>
Date: Wed, 5 Jan 2022 00:55:30 +0900
Subject: [PATCH 27/44] python3Packages.capstone: fix invalid sourceRoot

Follow-up of #152297
---
 pkgs/development/python-modules/capstone/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/capstone/default.nix b/pkgs/development/python-modules/capstone/default.nix
index f10f34c381d4..c99c392841eb 100644
--- a/pkgs/development/python-modules/capstone/default.nix
+++ b/pkgs/development/python-modules/capstone/default.nix
@@ -10,7 +10,7 @@ buildPythonPackage rec {
   version = lib.getVersion capstone;
 
   src = capstone.src;
-  sourceRoot = "${capstone.name}/bindings/python";
+  sourceRoot = "source/bindings/python";
 
   postPatch = ''
     ln -s ${capstone}/lib/libcapstone${stdenv.targetPlatform.extensions.sharedLibrary} prebuilt/

From 6db2abc780429d71e062e510edcef5b02c6b2977 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 4 Jan 2022 17:40:58 +0100
Subject: [PATCH 28/44] python3Packages.flux-led: 0.27.32 -> 0.27.36

---
 pkgs/development/python-modules/flux-led/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/flux-led/default.nix b/pkgs/development/python-modules/flux-led/default.nix
index 4816c4101286..a898520f5992 100644
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "flux-led";
-  version = "0.27.32";
+  version = "0.27.36";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "flux_led";
     rev = version;
-    sha256 = "sha256-7EBZN4Nb3iVieTZvYlbN+CwgVxOwFatle0e6gFwcdwM=";
+    sha256 = "sha256-Q84hDb7YnYU5L2IyL3aZ/16yRxViGlt8VX4vlMcykDA=";
   };
 
   propagatedBuildInputs = [

From 88468e258929250f2006d267cddee09fdaaaabee Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 4 Jan 2022 19:09:28 +0100
Subject: [PATCH 29/44] python3Packages.cirq-rigetti: disable outdated test

---
 pkgs/development/python-modules/cirq-rigetti/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/cirq-rigetti/default.nix b/pkgs/development/python-modules/cirq-rigetti/default.nix
index f2fd48d54176..662eaef5579b 100644
--- a/pkgs/development/python-modules/cirq-rigetti/default.nix
+++ b/pkgs/development/python-modules/cirq-rigetti/default.nix
@@ -13,6 +13,7 @@
 , pyjwt
 , pyquil
 , python-dateutil
+, pythonOlder
 , qcs-api-client
 , retrying
 , rfc3339
@@ -26,6 +27,8 @@ buildPythonPackage rec {
   pname = "cirq-rigetti";
   inherit (cirq-core) version src meta;
 
+  disabled = pythonOlder "3.7";
+
   sourceRoot = "source/${pname}";
 
   postPatch = ''
@@ -36,9 +39,10 @@ buildPythonPackage rec {
       --replace "httpcore~=0.11.1" "httpcore" \
       --replace "httpx~=0.15.5" "httpx" \
       --replace "idna~=2.10" "idna" \
-      --replace "requests~=2.18" "requests" \
       --replace "pyjwt~=1.7.1" "pyjwt" \
       --replace "qcs-api-client~=0.8.0" "qcs-api-client"
+    # Remove outdated test
+    rm cirq_rigetti/service_test.py
   '';
 
   propagatedBuildInputs = [

From 13c35a4f5fa2315963f474f242436cf084381d04 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Tue, 4 Jan 2022 15:18:56 -0300
Subject: [PATCH 30/44] pinta: add meta.mainProgram

---
 pkgs/applications/graphics/pinta/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/graphics/pinta/default.nix b/pkgs/applications/graphics/pinta/default.nix
index 9aa2b7e108a9..a4ad25109c84 100644
--- a/pkgs/applications/graphics/pinta/default.nix
+++ b/pkgs/applications/graphics/pinta/default.nix
@@ -82,5 +82,6 @@ buildDotnetModule rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ thiagokokada ];
     platforms = with lib.platforms; linux;
+    mainProgram = "pinta";
   };
 }

From dafaecb3b969c44b2496026fc2788dde78bf5e9f Mon Sep 17 00:00:00 2001
From: Jan Tojnar <jtojnar@gmail.com>
Date: Tue, 4 Jan 2022 19:22:05 +0100
Subject: [PATCH 31/44] nixos/gvfs: fix libmtp udev package path for realz

bin is the primary output so the previous attempt at fixing this
(https://github.com/NixOS/nixpkgs/commit/2d7fc66c79d7543ada565c96a3c6ad2b15c6b350)
was a no-op.
---
 nixos/modules/services/desktops/gvfs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/desktops/gvfs.nix b/nixos/modules/services/desktops/gvfs.nix
index cc9a46032705..27864fad4f26 100644
--- a/nixos/modules/services/desktops/gvfs.nix
+++ b/nixos/modules/services/desktops/gvfs.nix
@@ -54,7 +54,7 @@ in
 
     systemd.packages = [ cfg.package ];
 
-    services.udev.packages = [ pkgs.libmtp ];
+    services.udev.packages = [ pkgs.libmtp.out ];
 
     # Needed for unwrapped applications
     environment.variables.GIO_EXTRA_MODULES = [ "${cfg.package}/lib/gio/modules" ];

From e10ceab9c0b84a4f808bb28e8f977794f595dee8 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Tue, 4 Jan 2022 15:28:42 -0300
Subject: [PATCH 32/44] dart: remove myself from maintainers

---
 pkgs/development/interpreters/dart/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/interpreters/dart/default.nix b/pkgs/development/interpreters/dart/default.nix
index 452d0edc3e0a..d41c0a3c1f59 100644
--- a/pkgs/development/interpreters/dart/default.nix
+++ b/pkgs/development/interpreters/dart/default.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
 
   meta = with lib; {
     homepage = "https://www.dartlang.org/";
-    maintainers = with maintainers; [ grburst thiagokokada flexagoon ];
+    maintainers = with maintainers; [ grburst flexagoon ];
     description = "Scalable programming language, with robust libraries and runtimes, for building web, server, and mobile apps";
     longDescription = ''
       Dart is a class-based, single inheritance, object-oriented language

From 8155bc8739febcac326438befec0f9fa75df4616 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Tue, 4 Jan 2022 15:28:54 -0300
Subject: [PATCH 33/44] leiningen: add meta.mainProgram

---
 pkgs/development/tools/build-managers/leiningen/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/tools/build-managers/leiningen/default.nix b/pkgs/development/tools/build-managers/leiningen/default.nix
index 592564878e2e..7dfb6c9b2ad5 100644
--- a/pkgs/development/tools/build-managers/leiningen/default.nix
+++ b/pkgs/development/tools/build-managers/leiningen/default.nix
@@ -48,5 +48,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.epl10;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = with lib.maintainers; [ thiagokokada ];
+    mainProgram = "lein";
   };
 }

From 43176d04f310af993113482aaf7612e3ea377c06 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Tue, 4 Jan 2022 15:29:04 -0300
Subject: [PATCH 34/44] cpuset: add meta.mainProgram

---
 pkgs/os-specific/linux/cpuset/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/os-specific/linux/cpuset/default.nix b/pkgs/os-specific/linux/cpuset/default.nix
index e82e3f5901c1..bb7a953c1195 100644
--- a/pkgs/os-specific/linux/cpuset/default.nix
+++ b/pkgs/os-specific/linux/cpuset/default.nix
@@ -40,5 +40,6 @@ pythonPackages.buildPythonApplication rec {
     homepage    = "https://github.com/lpechacek/cpuset";
     license     = licenses.gpl2;
     maintainers = with maintainers; [ thiagokokada wykurz ];
+    mainProgram = "cset";
   };
 }

From 2bba578ff63a23584441b7ab13cb7c57b65333d2 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Tue, 4 Jan 2022 15:29:12 -0300
Subject: [PATCH 35/44] opentabletdriver: add meta.mainProgram, update website

---
 pkgs/tools/X11/opentabletdriver/default.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/X11/opentabletdriver/default.nix b/pkgs/tools/X11/opentabletdriver/default.nix
index ff2472294eed..3d7183c786bd 100644
--- a/pkgs/tools/X11/opentabletdriver/default.nix
+++ b/pkgs/tools/X11/opentabletdriver/default.nix
@@ -22,15 +22,15 @@ buildDotnetModule rec {
   version = "0.5.3.3";
 
   src = fetchFromGitHub {
-    owner = "InfinityGhost";
+    owner = "OpenTabletDriver";
     repo = "OpenTabletDriver";
     rev = "v${version}";
-    sha256 = "k4SoOMKAwHeYSQ80M8Af1DiiDSZIi3gS7lGr2ZrXrEI=";
+    sha256 = "sha256-k4SoOMKAwHeYSQ80M8Af1DiiDSZIi3gS7lGr2ZrXrEI=";
   };
 
   debPkg = fetchurl {
-    url = "https://github.com/InfinityGhost/OpenTabletDriver/releases/download/v${version}/OpenTabletDriver.deb";
-    sha256 = "0v03qiiz28k1yzgxf5qc1mdg2n7kjx6h8vpx9dxz342wwbgqg6ic";
+    url = "https://github.com/OpenTabletDriver/OpenTabletDriver/releases/download/v${version}/OpenTabletDriver.deb";
+    sha256 = "sha256-LJqH3+JckPF7S/1uBE2X81jxWg0MF9ff92Ei8WPEA2w=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_5_0;
@@ -103,9 +103,10 @@ buildDotnetModule rec {
 
   meta = with lib; {
     description = "Open source, cross-platform, user-mode tablet driver";
-    homepage = "https://github.com/InfinityGhost/OpenTabletDriver";
+    homepage = "https://github.com/OpenTabletDriver/OpenTabletDriver";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ thiagokokada ];
     platforms = platforms.linux;
+    mainProgram = "otd";
   };
 }

From 58c9aec5c09374db2ad0257cb2784b3ad1f8b4b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 3 Jan 2022 00:51:50 +0000
Subject: [PATCH 36/44] proj: 8.2.0 -> 8.2.1

https://github.com/OSGeo/PROJ/releases/tag/8.2.1
---
 pkgs/development/libraries/proj/default.nix | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/libraries/proj/default.nix b/pkgs/development/libraries/proj/default.nix
index 6ecc3606b96d..376cb36edd61 100644
--- a/pkgs/development/libraries/proj/default.nix
+++ b/pkgs/development/libraries/proj/default.nix
@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , sqlite
@@ -12,23 +11,15 @@
 
 stdenv.mkDerivation rec {
   pname = "proj";
-  version = "8.2.0";
+  version = "8.2.1";
 
   src = fetchFromGitHub {
     owner = "OSGeo";
     repo = "PROJ";
     rev = version;
-    sha256 = "sha256-YXZ3txBWW5vUcdYLISJPxdFGCQpKi1vvJlX8rntujg8=";
+    hash = "sha256-tnaIqYKgYHY1Tg33jsKYn9QL8YUobgXKbQsodoCXNys=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "Make-CApi-test-cross-platform.patch";
-      url = "https://github.com/OSGeo/PROJ/commit/ac113a8898cded7f5359f1edd3abc17a78eee9b4.patch";
-      sha256 = "0gz2xa5nxzck5c0yr7cspv3kw4cz3fxb2yic76w7qfvxidi7z1s1";
-    })
-  ];
-
   outputs = [ "out" "dev"];
 
   nativeBuildInputs = [ cmake pkg-config ];

From 16ba1d62e52f94dcc7a7a1202d799100ff3f629f Mon Sep 17 00:00:00 2001
From: Daniel Wheeler <daniel.wheeler2@gmail.com>
Date: Tue, 4 Jan 2022 13:59:16 -0500
Subject: [PATCH 37/44] pythonPackages.sfepy: 2021.2 -> 2021.4

---
 pkgs/development/python-modules/sfepy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sfepy/default.nix b/pkgs/development/python-modules/sfepy/default.nix
index 7b939342bfc2..3d895f4a3f36 100644
--- a/pkgs/development/python-modules/sfepy/default.nix
+++ b/pkgs/development/python-modules/sfepy/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "sfepy";
-  version = "2021.2";
+  version = "2021.4";
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "sfepy";
     repo = "sfepy";
     rev = "release_${version}";
-    sha256 = "sha256-zFtm4KrpqjYfxVHcMrTU4tMyHYnD9VPEvuId2lR1MHU=";
+    sha256 = "sha256-+wvFcME02la5JwzD5bvPgBBlkQKF5LWz5MC3+0s5jSs=";
   };
 
   propagatedBuildInputs = [

From e09df20b20207110903c416bf8d2c802381cab94 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 4 Jan 2022 20:04:40 +0100
Subject: [PATCH 38/44] python3Packages.adafruit-platformdetect: 3.18.0 ->
 3.19.1

---
 .../python-modules/adafruit-platformdetect/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index 9e32e903e82f..6f4bba33ebba 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -6,13 +6,13 @@
 
 buildPythonPackage rec {
   pname = "adafruit-platformdetect";
-  version = "3.18.0";
+  version = "3.19.1";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "Adafruit-PlatformDetect";
     inherit version;
-    sha256 = "593f3719580b31b3dffab0817414a3aa548ed609659ad216ceb8cf31cc51ec9b";
+    sha256 = "sha256-mJ121SSoO7v2p+qCF5Va5+ppHQsHcFuyJDpyc6lykRI=";
   };
 
   nativeBuildInputs = [

From 49ca628c396a4a0d408c874e1cac9dee552028b3 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 4 Jan 2022 21:47:40 +0100
Subject: [PATCH 39/44] kubescape: 1.0.136 -> 1.0.137

---
 pkgs/tools/security/kubescape/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/security/kubescape/default.nix b/pkgs/tools/security/kubescape/default.nix
index 0a13b54d2bfa..8f5382d38108 100644
--- a/pkgs/tools/security/kubescape/default.nix
+++ b/pkgs/tools/security/kubescape/default.nix
@@ -6,20 +6,20 @@
 
 buildGoModule rec {
   pname = "kubescape";
-  version = "1.0.136";
+  version = "1.0.137";
 
   src = fetchFromGitHub {
     owner = "armosec";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-g7gM+fZIDb6YK3QDiBqiQaTEyFtIQ30mTe6AAR3S3iw=";
+    sha256 = "sha256-2VjC5icIKF7VO7Tli/mk/gXbIzZxkFm7Aigwl+BVQ6g=";
   };
 
   nativeBuildInputs = [
     installShellFiles
   ];
 
-  vendorSha256 = "sha256-hEj69RsYj+KxfZPri2j+vFxUU2S8wuK85EYGND5wtWg=";
+  vendorSha256 = "sha256-nUMbHoF7xqSpyfb+v7+ZaKzYOalpNcrFxcaRUw2W49s=";
 
   ldflags = [
     "-s"

From fda6ac57097d559d2581fa3213ef944c74e04bfa Mon Sep 17 00:00:00 2001
From: Will Cohen <willcohen@users.noreply.github.com>
Date: Tue, 4 Jan 2022 14:14:46 -0500
Subject: [PATCH 40/44] maintainers: add willcohen

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e11a063d3c12..5da3f96c3c98 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -12671,6 +12671,12 @@
     email = "tim.williams.public@gmail.com";
     name = "Tim Philip Williams";
   };
+  willcohen = {
+    email = "willcohen@users.noreply.github.com";
+    github = "willcohen";
+    githubId = 5185341;
+    name = "Will Cohen";
+  };
   winden = {
     email = "windenntw@gmail.com";
     name = "Antonio Vargas Gonzalez";

From eaff5241bf0929415717478fcb00802b15296918 Mon Sep 17 00:00:00 2001
From: techknowlogick <techknowlogick@gitea.io>
Date: Tue, 4 Jan 2022 16:33:26 -0500
Subject: [PATCH 41/44] maintainers: add techknowlogick

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e11a063d3c12..8b28917a5874 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11617,6 +11617,12 @@
     githubId = 2389333;
     name = "Andy Tockman";
   };
+  techknowlogick = {
+    email = "techknowlogick@gitea.io";
+    github = "techknowlogick";
+    githubId = 164197;
+    name = "techknowlogick";
+  };
   Technical27 = {
     email = "38222826+Technical27@users.noreply.github.com";
     github = "Technical27";

From 6299ff2be1e0841d3500b35b318d4ced281fd2aa Mon Sep 17 00:00:00 2001
From: techknowlogick <techknowlogick@gitea.io>
Date: Tue, 4 Jan 2022 16:35:32 -0500
Subject: [PATCH 42/44] consul: 1.10.3 -> 1.11.1

---
 pkgs/servers/consul/default.nix | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/pkgs/servers/consul/default.nix b/pkgs/servers/consul/default.nix
index bf75eb4d3a51..58b11dfab09c 100644
--- a/pkgs/servers/consul/default.nix
+++ b/pkgs/servers/consul/default.nix
@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.10.3";
+  version = "1.11.1";
   rev = "v${version}";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     inherit rev;
-    sha256 = "sha256-Jn8cF+8Wf4zZ/PFXvjCGpomSa/DvraBGW0LsZQ+Zy+4=";
+    sha256 = "0x374capaz6h8mzvq2pfz4zg3gz27fjbqax65f23zqyl46haj01p";
   };
 
   passthru.tests.consul = nixosTests.consul;
@@ -26,12 +26,10 @@ buildGoModule rec {
   # has a split module structure in one repo
   subPackages = ["." "connect/certgen"];
 
-  vendorSha256 = "sha256-cQP1po9LGunFVocl4+HPs67oae2KpgyfRRB+xGVySUY=";
+  vendorSha256 = "09rz2xv407ym71dap7f6bbqhdnqvylvbd9zg6f6h7qsb88nvyzsp";
 
   doCheck = false;
 
-  deleteVendor = true;
-
   ldflags = [
     "-X github.com/hashicorp/consul/version.GitDescribe=v${version}"
     "-X github.com/hashicorp/consul/version.Version=${version}"
@@ -43,6 +41,6 @@ buildGoModule rec {
     homepage = "https://www.consul.io/";
     platforms = platforms.linux ++ platforms.darwin;
     license = licenses.mpl20;
-    maintainers = with maintainers; [ pradeepchhetri vdemeester nh2 ];
+    maintainers = with maintainers; [ pradeepchhetri vdemeester nh2 techknowlogick];
   };
 }

From 3951393fe99d137fb11e6651dbe1450e15e9da4c Mon Sep 17 00:00:00 2001
From: Will Cohen <willcohen@users.noreply.github.com>
Date: Tue, 4 Jan 2022 15:29:32 -0500
Subject: [PATCH 43/44] obb: init at 0.0.1

---
 pkgs/development/interpreters/clojure/obb.nix | 79 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 81 insertions(+)
 create mode 100644 pkgs/development/interpreters/clojure/obb.nix

diff --git a/pkgs/development/interpreters/clojure/obb.nix b/pkgs/development/interpreters/clojure/obb.nix
new file mode 100644
index 000000000000..3e0a63b5e28c
--- /dev/null
+++ b/pkgs/development/interpreters/clojure/obb.nix
@@ -0,0 +1,79 @@
+{ lib
+, stdenv
+, fetchurl
+, babashka
+, cacert
+, clojure
+, git
+, jdk
+, callPackage
+, makeWrapper
+, runCommand }:
+
+stdenv.mkDerivation rec {
+  pname = "obb";
+  version = "0.0.1";
+
+  src = fetchurl {
+    url = "https://github.com/babashka/${pname}/archive/refs/tags/v${version}.tar.gz";
+    sha256 = "sha256-ZVd3VCJ7vdQGQ7iY5v2b+gRX/Ni0/03hzqBElqpPvpI=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [ babashka cacert git jdk ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    mkdir -p .m2
+    substituteInPlace deps.edn --replace ':paths' ':mvn/local-repo "./.m2" :paths'
+    substituteInPlace bb.edn --replace ':paths' ':mvn/local-repo "./.m2" :paths'
+    echo deps.edn
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    export DEPS_CLJ_TOOLS_DIR=${clojure}
+    export DEPS_CLJ_TOOLS_VERSION=${clojure.version}
+    mkdir -p .gitlibs
+    mkdir -p .cpcache
+    export GITLIBS=.gitlibs
+    export CLJ_CACHE=.cpcache
+
+    bb build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    ln -s /usr/bin/osascript $out/bin/osascript
+
+    install -Dm755 "out/bin/obb" "$out/bin/obb"
+    wrapProgram $out/bin/obb --prefix PATH : $out/bin
+
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    [ $($out/bin/obb -e '(+ 1 2)') = '3' ]
+  '';
+
+
+  meta = with lib; {
+    description = "Ad-hoc ClojureScript scripting of Mac applications via Apple's Open Scripting Architecture";
+    homepage = "https://github.com/babashka/obb";
+    license = licenses.epl10;
+    maintainers = with maintainers; [
+      willcohen
+    ];
+    platforms = platforms.darwin;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f0d9bfc19fab..19f954a1910d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13578,6 +13578,8 @@ with pkgs;
 
   ngn-k = callPackage ../development/interpreters/ngn-k { };
 
+  obb = callPackage ../development/interpreters/clojure/obb.nix { };
+
   octave = callPackage ../development/interpreters/octave {
     python = python3;
     mkDerivation = stdenv.mkDerivation;

From 43a33f1f01c8d28df0a79343566218ea0ef98943 Mon Sep 17 00:00:00 2001
From: Michael Weiss <dev.primeos@gmail.com>
Date: Tue, 4 Jan 2022 23:56:18 +0100
Subject: [PATCH 44/44] chromium: 96.0.4664.110 -> 97.0.4692.71

https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html

This update includes 37 security fixes.

CVEs:
CVE-2022-0096 CVE-2022-0097 CVE-2022-0098 CVE-2022-0099 CVE-2022-0100
CVE-2022-0101 CVE-2022-0102 CVE-2022-0103 CVE-2022-0104 CVE-2022-0105
CVE-2022-0106 CVE-2022-0107 CVE-2022-0108 CVE-2022-0109 CVE-2022-0110
CVE-2022-0111 CVE-2022-0112 CVE-2022-0113 CVE-2022-0114 CVE-2022-0115
CVE-2022-0116 CVE-2022-0117 CVE-2022-0118 CVE-2022-0120
---
 .../browsers/chromium/upstream-info.json      | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/upstream-info.json b/pkgs/applications/networking/browsers/chromium/upstream-info.json
index e373fac57915..0d7b0f826c27 100644
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -1,21 +1,21 @@
 {
   "stable": {
-    "version": "96.0.4664.110",
-    "sha256": "1s3ilq0ik36qgqp7l88gfd1yx97zscn8yr2kprsrjfp9q8lrva9n",
-    "sha256bin64": "17cyj1jx47fz6y26f196xhlngrw5gnjgcvapvgkgswlwd7y67jcb",
+    "version": "97.0.4692.71",
+    "sha256": "0z7ximvm4a78kxyp4j0i2jzklxazpw6jcqi9jkaf8bvq9ga8kqca",
+    "sha256bin64": "1z1d50i5pvqaw6hjdxwasbznzgqwrnd1z8jmy2x05b6i49vd7r9j",
     "deps": {
       "gn": {
-        "version": "2021-09-24",
+        "version": "2021-11-03",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "0153d369bbccc908f4da4993b1ba82728055926a",
-        "sha256": "0y4414h8jqsbz5af6pn91c0vkfp4s281s85g992xfyl785c5zbsi"
+        "rev": "90294ccdcf9334ed25a76ac9b67689468e506342",
+        "sha256": "0n0jml8s00ayy186jzrf207hbz70pxiq426znxwxd4gjcp60scsa"
       }
     },
     "chromedriver": {
-      "version": "96.0.4664.45",
-      "sha256_linux": "15wybxlh38sw7f2bzalf9ivfp8262cpcvhq08nw9d2cj3j39f13m",
-      "sha256_darwin": "0r3b8wgbd8xjb09f4vc402gp77y2aqjk9hpqvvr6xgdr7nqym20f",
-      "sha256_darwin_aarch64": "1yynw8ngs2655blnf1s6r9flbxlwgaybdvgl6r6h7ppl974dl7rm"
+      "version": "97.0.4692.36",
+      "sha256_linux": "11x28m31bsfq1flqrsa5mawss39kznia2ig5ams5qkm2v5p3y39d",
+      "sha256_darwin": "1ysnfvj0795yc3g8sbz7g9mhc5j0sxm2r3ad2fh13sarnhn6wrs4",
+      "sha256_darwin_aarch64": "09m1qpk6901gqs4c7isgryffhb92szfzbxfybxhn2g5i4wrns6j7"
     }
   },
   "beta": {