Merge staging-next into staging

doc/builders/trivial-builders.chapter.md

@@ -50,3 +50,50 @@ Many more commands wrap `writeTextFile` including `writeText`, `writeTextDir`, `
 ## `symlinkJoin` {#trivial-builder-symlinkJoin}
 
 This can be used to put many derivations into the same directory structure. It works by creating a new derivation and adding symlinks to each of the paths listed. It expects two arguments, `name`, and `paths`. `name` is the name used in the Nix store path for the created derivation. `paths` is a list of paths that will be symlinked. These paths can be to Nix store derivations or any other subdirectory contained within.
+
+## `writeReferencesToFile` {#trivial-builder-writeReferencesToFile}
+
+Writes the closure of transitive dependencies to a file.
+
+This produces the equivalent of `nix-store -q --requisites`.
+
+For example,
+
+```nix
+writeReferencesToFile (writeScriptBin "hi" ''${hello}/bin/hello'')
+```
+
+produces an output path `/nix/store/<hash>-runtime-deps` containing
+
+```nix
+/nix/store/<hash>-hello-2.10
+/nix/store/<hash>-hi
+/nix/store/<hash>-libidn2-2.3.0
+/nix/store/<hash>-libunistring-0.9.10
+/nix/store/<hash>-glibc-2.32-40
+```
+
+You can see that this includes `hi`, the original input path,
+`hello`, which is a direct reference, but also
+the other paths that are indirectly required to run `hello`.
+
+## `writeDirectReferencesToFile` {#trivial-builder-writeDirectReferencesToFile}
+
+Writes the set of references to the output file, that is, their immediate dependencies.
+
+This produces the equivalent of `nix-store -q --references`.
+
+For example,
+
+```nix
+writeDirectReferencesToFile (writeScriptBin "hi" ''${hello}/bin/hello'')
+```
+
+produces an output path `/nix/store/<hash>-runtime-references` containing
+
+```nix
+/nix/store/<hash>-hello-2.10
+```
+
+but none of `hello`'s dependencies, because those are not referenced directly
+by `hi`'s output.

doc/languages-frameworks/dhall.section.md

@@ -5,7 +5,7 @@ support for importing Dhall expressions, which is documented here:
 
 * [`dhall-lang.org` - Installing packages](https://docs.dhall-lang.org/tutorials/Language-Tour.html#installing-packages)
 
-## Remote imports
+## Remote imports {#ssec-dhall-remote-imports}
 
 Nixpkgs bypasses Dhall's support for remote imports using Dhall's
 semantic integrity checks.  Specifically, any Dhall import can be protected by
@@ -32,7 +32,7 @@ example, the Prelude Dhall package uses `pkgs.fetchFromGitHub` to fetch the
 to fetch Dhall code ensures that Dhall packages built using Nix remain pure and
 also behave well when built within a sandbox.
 
-## Packaging a Dhall expression from scratch
+## Packaging a Dhall expression from scratch {#ssec-dhall-packaging-expression}
 
 We can illustrate how Nixpkgs integrates Dhall by beginning from the following
 trivial Dhall expression with one dependency (the Prelude):
@@ -117,7 +117,7 @@ in
 $ nix build --file ./example.nix dhallPackages.true
 ```
 
-## Contents of a Dhall package
+## Contents of a Dhall package {#ssec-dhall-package-contents}
 
 The above package produces the following directory tree:
 
@@ -224,7 +224,7 @@ $ cat ./result/source.dhall
 …
 ```
 
-## Packaging functions
+## Packaging functions {#ssec-dhall-packaging-functions}
 
 We already saw an example of using `buildDhallPackage` to create a Dhall
 package from a single file, but most Dhall packages consist of more than one
@@ -297,7 +297,7 @@ terms of `buildDhallPackage` that accepts the following arguments:
 Additionally, `buildDhallGitHubPackage` accepts the same arguments as
 `fetchFromGitHub`, such as `sha256` or `fetchSubmodules`.
 
-## `dhall-to-nixpkgs`
+## `dhall-to-nixpkgs` {#ssec-dhall-dhall-to-nixpkgs}
 
 You can use the `dhall-to-nixpkgs` command-line utility to automate
 packaging Dhall code.  For example:
@@ -342,7 +342,7 @@ $ dhall-to-nixpkgs directory ~/proj/dhall-semver
     }
 ```
 
-## Overriding dependency versions
+## Overriding dependency versions {#ssec-dhall-overriding-dependency-versions}
 
 Suppose that we change our `true.dhall` example expression to depend on an older
 version of the Prelude (19.0.0):
@@ -415,7 +415,7 @@ like this:
   };
 ```
 
-## Overrides
+## Overrides {#ssec-dhall-overrides}
 
 You can override any of the arguments to `buildDhallGitHubPackage` or
 `buildDhallDirectoryPackage` using the `overridePackage` attribute of a package.

maintainers/maintainer-list.nix

@@ -2511,6 +2511,12 @@
     githubId = 1316469;
     name = "Naomi Morse";
   };
+  dlesl = {
+    email = "dlesl@dlesl.com";
+    github = "dlesl";
+    githubId = 28980797;
+    name = "David Leslie";
+  };
   dmalikov = {
     email = "malikov.d.y@gmail.com";
     github = "dmalikov";
@@ -4133,6 +4139,12 @@
     githubId = 12491746;
     name = "Masato Yonekawa";
   };
+  hyzual = {
+    email = "hyzual@gmail.com";
+    github = "Hyzual";
+    githubId = 2051507;
+    name = "Joris Masson";
+  };
   hzeller = {
     email = "h.zeller@acm.org";
     github = "hzeller";
@@ -5868,6 +5880,12 @@
     githubId = 10626;
     name = "Andreas Wagner";
   };
+  lromor = {
+    email = "leonardo.romor@gmail.com";
+    github = "lromor";
+    githubId = 1597330;
+    name = "Leonardo Romor";
+  };
   lrworth = {
     email = "luke@worth.id.au";
     name = "Luke Worth";
@@ -7311,6 +7329,12 @@
     githubId = 1839979;
     name = "Niklas Thörne";
   };
+  nullx76 = {
+    email = "nix@xirion.net";
+    github = "NULLx76";
+    githubId = 1809198;
+    name = "Victor Roest";
+  };
   numinit = {
     email = "me@numin.it";
     github = "numinit";

nixos/modules/module-list.nix

@@ -895,6 +895,7 @@
   ./services/system/kerberos/default.nix
   ./services/system/nscd.nix
   ./services/system/saslauthd.nix
+  ./services/system/self-deploy.nix
   ./services/system/uptimed.nix
   ./services/torrent/deluge.nix
   ./services/torrent/flexget.nix

nixos/modules/programs/atop.nix

@@ -1,6 +1,6 @@
 # Global configuration for atop.
 
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 
 with lib;
 
@@ -12,11 +12,83 @@ in
 
   options = {
 
-    programs.atop = {
+    programs.atop = rec {
 
+      enable = mkEnableOption "Atop";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.atop;
+        description = ''
+          Which package to use for Atop.
+        '';
+      };
+
+      netatop = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Whether to install and enable the netatop kernel module.
+            Note: this sets the kernel taint flag "O" for loading out-of-tree modules.
+          '';
+        };
+        package = mkOption {
+          type = types.package;
+          default = config.boot.kernelPackages.netatop;
+          description = ''
+            Which package to use for netatop.
+          '';
+        };
+      };
+
+      atopgpu.enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to install and enable the atopgpud daemon to get information about
+          NVIDIA gpus.
+        '';
+      };
+
+      setuidWrapper.enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to install a setuid wrapper for Atop. This is required to use some of
+          the features as non-root user (e.g.: ipc information, netatop, atopgpu).
+          Atop tries to drop the root privileges shortly after starting.
+        '';
+      };
+
+      atopService.enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to enable the atop service responsible for storing statistics for
+          long-term analysis.
+        '';
+      };
+      atopRotateTimer.enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to enable the atop-rotate timer, which restarts the atop service
+          daily to make sure the data files are rotate.
+        '';
+      };
+      atopacctService.enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to enable the atopacct service which manages process accounting.
+          This allows Atop to gather data about processes that disappeared in between
+          two refresh intervals.
+        '';
+      };
       settings = mkOption {
         type = types.attrs;
-        default = {};
+        default = { };
         example = {
           flags = "a1f";
           interval = 5;
@@ -25,12 +97,50 @@ in
           Parameters to be written to <filename>/etc/atoprc</filename>.
         '';
       };
-
     };
   };
 
-  config = mkIf (cfg.settings != {}) {
-    environment.etc.atoprc.text =
-      concatStrings (mapAttrsToList (n: v: "${n} ${toString v}\n") cfg.settings);
-  };
+  config = mkIf cfg.enable (
+    let
+      atop =
+        if cfg.atopgpu.enable then
+          (cfg.package.override { withAtopgpu = true; })
+        else
+          cfg.package;
+    in
+    {
+      environment.etc = mkIf (cfg.settings != { }) {
+        atoprc.text = concatStrings
+          (mapAttrsToList
+            (n: v: ''
+              ${n} ${toString v}
+            '')
+            cfg.settings);
+      };
+      environment.systemPackages = [ atop (lib.mkIf cfg.netatop.enable cfg.netatop.package) ];
+      boot.extraModulePackages = [ (lib.mkIf cfg.netatop.enable cfg.netatop.package) ];
+      systemd =
+        let
+          mkSystemd = type: cond: name: restartTriggers: {
+            ${name} = lib.mkIf cond {
+              inherit restartTriggers;
+              wantedBy = [ (if type == "services" then "multi-user.target" else if type == "timers" then "timers.target" else null) ];
+            };
+          };
+          mkService = mkSystemd "services";
+          mkTimer = mkSystemd "timers";
+        in
+        {
+          packages = [ atop (lib.mkIf cfg.netatop.enable cfg.netatop.package) ];
+          services =
+            mkService cfg.atopService.enable "atop" [ atop ]
+            // mkService cfg.atopacctService.enable "atopacct" [ atop ]
+            // mkService cfg.netatop.enable "netatop" [ cfg.netatop.package ]
+            // mkService cfg.atopgpu.enable "atopgpu" [ atop ];
+          timers = mkTimer cfg.atopRotateTimer.enable "atop-rotate" [ atop ];
+        };
+      security.wrappers =
+        lib.mkIf cfg.setuidWrapper.enable { atop = { source = "${atop}/bin/atop"; }; };
+    }
+  );
 }

nixos/modules/programs/dconf.nix

@@ -54,6 +54,8 @@ in
 
     services.dbus.packages = [ pkgs.dconf ];
 
+    systemd.packages = [ pkgs.dconf ];
+
     # For dconf executable
     environment.systemPackages = [ pkgs.dconf ];
 

nixos/modules/programs/phosh.nix

@@ -145,15 +145,7 @@ in {
 
     programs.feedbackd.enable = true;
 
-    # https://source.puri.sm/Librem5/phosh/-/issues/303
-    security.pam.services.phosh = {
-      text = ''
-        auth    requisite       pam_nologin.so
-        auth    required        pam_succeed_if.so user != root quiet_success
-        auth    required        pam_securetty.so
-        auth    requisite       pam_nologin.so
-      '';
-    };
+    security.pam.services.phosh = {};
 
     services.gnome.core-shell.enable = true;
     services.gnome.core-os-services.enable = true;

nixos/modules/security/apparmor.nix

@@ -133,7 +133,7 @@ in
 
           parser = ${pkgs.apparmor-parser}/bin/apparmor_parser
           ldd = ${pkgs.glibc.bin}/bin/ldd
-          logger = ${pkgs.utillinux}/bin/logger
+          logger = ${pkgs.util-linux}/bin/logger
 
           # customize how file ownership permissions are presented
           # 0 - off

nixos/modules/security/ca.nix

@@ -10,15 +10,10 @@ let
     blacklist = cfg.caCertificateBlacklist;
   };
 
-  caCertificates = pkgs.runCommand "ca-certificates.crt"
-    { files =
-        cfg.certificateFiles ++
-        [ (builtins.toFile "extra.crt" (concatStringsSep "\n" cfg.certificates)) ];
-      preferLocalBuild = true;
-     }
-    ''
-      cat $files > $out
-    '';
+  caCertificates = pkgs.runCommand "ca-certificates.crt" {
+    files = cfg.certificateFiles ++ [ (builtins.toFile "extra.crt" (concatStringsSep "\n" cfg.certificates)) ];
+    preferLocalBuild = true;
+  } "awk 1 $files > $out";  # awk ensures a newline between each pair of consecutive files
 
 in
 

nixos/modules/services/computing/foldingathome/client.nix

@@ -49,6 +49,15 @@ in
       '';
     };
 
+    daemonNiceLevel = mkOption {
+      type = types.ints.between (-20) 19;
+      default = 0;
+      description = ''
+        Daemon process priority for FAHClient.
+        0 is the default Unix process priority, 19 is the lowest.
+      '';
+    };
+
     extraArgs = mkOption {
       type = types.listOf types.str;
       default = [];
@@ -70,6 +79,7 @@ in
       serviceConfig = {
         DynamicUser = true;
         StateDirectory = "foldingathome";
+        Nice = cfg.daemonNiceLevel;
         WorkingDirectory = "%S/foldingathome";
       };
     };

nixos/modules/services/databases/postgresql.nix

@@ -159,7 +159,7 @@ in
                 For more information on how to specify the target
                 and on which privileges exist, see the
                 <link xlink:href="https://www.postgresql.org/docs/current/sql-grant.html">GRANT syntax</link>.
-                The attributes are used as <code>GRANT ''${attrName} ON ''${attrValue}</code>.
+                The attributes are used as <code>GRANT ''${attrValue} ON ''${attrName}</code>.
               '';
               example = literalExample ''
                 {

nixos/modules/services/databases/redis.nix

@@ -331,7 +331,7 @@ in {
         PrivateMounts = true;
         # System Call Filtering
         SystemCallArchitectures = "native";
-        SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap";
+        SystemCallFilter = "~@cpu-emulation @debug @keyring @memlock @mount @obsolete @privileged @resources @setuid";
       };
     };
   };

nixos/modules/services/development/jupyter/default.nix

@@ -131,7 +131,7 @@ in {
             env = (pkgs.python3.withPackages (pythonPackages: with pythonPackages; [
                     ipykernel
                     pandas
-                    scikitlearn
+                    scikit-learn
                   ]));
           in {
             displayName = "Python 3 for machine learning";

nixos/modules/services/development/jupyterhub/default.nix

@@ -117,7 +117,7 @@ in {
             env = (pkgs.python3.withPackages (pythonPackages: with pythonPackages; [
                     ipykernel
                     pandas
-                    scikitlearn
+                    scikit-learn
                   ]));
           in {
             displayName = "Python 3 for machine learning";

nixos/modules/services/hardware/fancontrol.nix

@@ -31,16 +31,6 @@ in
 
   config = mkIf cfg.enable {
 
-    users = {
-      groups.lm_sensors = {};
-
-      users.fancontrol = {
-        isSystemUser = true;
-        group = "lm_sensors";
-        description = "fan speed controller";
-      };
-    };
-
     systemd.services.fancontrol = {
       documentation = [ "man:fancontrol(8)" ];
       description = "software fan control";
@@ -49,8 +39,6 @@ in
 
       serviceConfig = {
         ExecStart = "${pkgs.lm_sensors}/sbin/fancontrol ${configFile}";
-        Group = "lm_sensors";
-        User = "fancontrol";
       };
     };
   };

nixos/modules/services/misc/jellyfin.nix

@@ -92,9 +92,7 @@ in
         SystemCallErrorNumber = "EPERM";
         SystemCallFilter = [
           "@system-service"
-
-          "~@chown" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@module"
-          "~@obsolete" "~@privileged" "~@setuid"
+          "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid"
         ];
       };
     };

nixos/modules/services/network-filesystems/samba-wsdd.nix

@@ -117,7 +117,7 @@ in {
         PrivateMounts = true;
         # System Call Filtering
         SystemCallArchitectures = "native";
-        SystemCallFilter = "~@clock @cpu-emulation @debug @module @mount @obsolete @privileged @raw-io @reboot @resources @swap";
+        SystemCallFilter = "~@cpu-emulation @debug @mount @obsolete @privileged @resources";
       };
     };
   };

nixos/modules/services/networking/cjdns.nix

@@ -12,8 +12,18 @@ let
   { ... }:
   { options =
     { password = mkOption {
-      type = types.str;
-      description = "Authorized password to the opposite end of the tunnel.";
+        type = types.str;
+        description = "Authorized password to the opposite end of the tunnel.";
+      };
+      login = mkOption {
+        default = "";
+        type = types.str;
+        description = "(optional) name your peer has for you";
+      };
+      peerName = mkOption {
+        default = "";
+        type = types.str;
+        description = "(optional) human-readable name for peer";
       };
       publicKey = mkOption {
         type = types.str;

nixos/modules/services/networking/croc.nix

@@ -72,9 +72,7 @@ in
         RuntimeDirectoryMode = "700";
         SystemCallFilter = [
           "@system-service"
-          "~@aio" "~@chown" "~@keyring" "~@memlock"
-          "~@privileged" "~@resources" "~@setuid"
-          "~@sync" "~@timer"
+          "~@aio" "~@keyring" "~@memlock" "~@privileged" "~@resources" "~@setuid" "~@sync" "~@timer"
         ];
         SystemCallArchitectures = "native";
         SystemCallErrorNumber = "EPERM";

nixos/modules/services/networking/znc/default.nix

@@ -103,8 +103,8 @@ in
       };
 
       dataDir = mkOption {
-        default = "/var/lib/znc/";
-        example = "/home/john/.znc/";
+        default = "/var/lib/znc";
+        example = "/home/john/.znc";
         type = types.path;
         description = ''
           The state directory for ZNC. The config and the modules will be linked
@@ -258,6 +258,34 @@ in
         ExecStart = "${pkgs.znc}/bin/znc --foreground --datadir ${cfg.dataDir} ${escapeShellArgs cfg.extraFlags}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         ExecStop = "${pkgs.coreutils}/bin/kill -INT $MAINPID";
+        # Hardening
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ReadWritePaths = [ cfg.dataDir ];
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        UMask = "0027";
       };
       preStart = ''
         mkdir -p ${cfg.dataDir}/configs

nixos/modules/services/networking/znc/options.nix

@@ -44,7 +44,7 @@ let
       modules = mkOption {
         type = types.listOf types.str;
         default = [ "simple_away" ];
-        example = literalExample "[ simple_away sasl ]";
+        example = literalExample ''[ "simple_away" "sasl" ]'';
         description = ''
           ZNC network modules to load.
         '';

nixos/modules/services/system/self-deploy.nix

@@ -0,0 +1,170 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.self-deploy;
+
+  workingDirectory = "/var/lib/nixos-self-deploy";
+  repositoryDirectory = "${workingDirectory}/repo";
+  outPath = "${workingDirectory}/system";
+
+  gitWithRepo = "git -C ${repositoryDirectory}";
+
+  renderNixArgs = args:
+    let
+      toArg = key: value:
+        if builtins.isString value
+        then " --argstr ${lib.escapeShellArg key} ${lib.escapeShellArg value}"
+        else " --arg ${lib.escapeShellArg key} ${lib.escapeShellArg (toString value)}";
+    in
+    lib.concatStrings (lib.mapAttrsToList toArg args);
+
+  isPathType = x: lib.strings.isCoercibleToString x && builtins.substring 0 1 (toString x) == "/";
+
+in
+{
+  options.services.self-deploy = {
+    enable = lib.mkEnableOption "self-deploy";
+
+    nixFile = lib.mkOption {
+      type = lib.types.path;
+
+      default = "/default.nix";
+
+      description = ''
+        Path to nix file in repository. Leading '/' refers to root of
+        git repository.
+      '';
+    };
+
+    nixAttribute = lib.mkOption {
+      type = lib.types.str;
+
+      description = ''
+        Attribute of `nixFile` that builds the current system.
+      '';
+    };
+
+    nixArgs = lib.mkOption {
+      type = lib.types.attrs;
+
+      default = { };
+
+      description = ''
+        Arguments to `nix-build` passed as `--argstr` or `--arg` depending on
+        the type.
+      '';
+    };
+
+    switchCommand = lib.mkOption {
+      type = lib.types.enum [ "boot" "switch" "dry-activate" "test" ];
+
+      default = "switch";
+
+      description = ''
+        The `switch-to-configuration` subcommand used.
+      '';
+    };
+
+    repository = lib.mkOption {
+      type = with lib.types; oneOf [ path str ];
+
+      description = ''
+        The repository to fetch from. Must be properly formatted for git.
+
+        If this value is set to a path (must begin with `/`) then it's
+        assumed that the repository is local and the resulting service
+        won't wait for the network to be up.
+
+        If the repository will be fetched over SSH, you must add an
+        entry to `programs.ssh.knownHosts` for the SSH host for the fetch
+        to be successful.
+      '';
+    };
+
+    sshKeyFile = lib.mkOption {
+      type = with lib.types; nullOr path;
+
+      default = null;
+
+      description = ''
+        Path to SSH private key used to fetch private repositories over
+        SSH.
+      '';
+    };
+
+    branch = lib.mkOption {
+      type = lib.types.str;
+
+      default = "master";
+
+      description = ''
+        Branch to track
+
+        Technically speaking any ref can be specified here, as this is
+        passed directly to a `git fetch`, but for the use-case of
+        continuous deployment you're likely to want to specify a branch.
+      '';
+    };
+
+    startAt = lib.mkOption {
+      type = with lib.types; either str (listOf str);
+
+      default = "hourly";
+
+      description = ''
+        The schedule on which to run the `self-deploy` service. Format
+        specified by `systemd.time 7`.
+
+        This value can also be a list of `systemd.time 7` formatted
+        strings, in which case the service will be started on multiple
+        schedules.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.self-deploy = {
+      wantedBy = [ "multi-user.target" ];
+
+      requires = lib.mkIf (!(isPathType cfg.repository)) [ "network-online.target" ];
+
+      environment.GIT_SSH_COMMAND = lib.mkIf (!(isNull cfg.sshKeyFile))
+        "${pkgs.openssh}/bin/ssh -i ${lib.escapeShellArg cfg.sshKeyFile}";
+
+      restartIfChanged = false;
+
+      path = with pkgs; [
+        git
+        nix
+        systemd
+      ];
+
+      script = ''
+        if [ ! -e ${repositoryDirectory} ]; then
+          mkdir --parents ${repositoryDirectory}
+          git init ${repositoryDirectory}
+        fi
+
+        ${gitWithRepo} fetch ${lib.escapeShellArg cfg.repository} ${lib.escapeShellArg cfg.branch}
+
+        ${gitWithRepo} checkout FETCH_HEAD
+
+        nix-build${renderNixArgs cfg.nixArgs} ${lib.cli.toGNUCommandLineShell { } {
+          attr = cfg.nixAttribute;
+          out-link = outPath;
+        }} ${lib.escapeShellArg "${repositoryDirectory}${cfg.nixFile}"}
+
+        ${lib.optionalString (cfg.switchCommand != "test")
+          "nix-env --profile /nix/var/nix/profiles/system --set ${outPath}"}
+
+        ${outPath}/bin/switch-to-configuration ${cfg.switchCommand}
+
+        rm ${outPath}
+
+        ${gitWithRepo} gc --prune=all
+
+        ${lib.optionalString (cfg.switchCommand == "boot") "systemctl reboot"}
+      '';
+    };
+  };
+}

nixos/modules/services/web-apps/shiori.nix

@@ -86,10 +86,7 @@ in {
         SystemCallErrorNumber = "EPERM";
         SystemCallFilter = [
           "@system-service"
-
-          "~@chown" "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock"
-          "~@module" "~@obsolete" "~@privileged" "~@raw-io"
-          "~@resources" "~@setuid"
+          "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@resources" "~@setuid"
         ];
       };
     };

nixos/modules/services/web-servers/molly-brown.nix

@@ -41,7 +41,6 @@ in {
 
         As an example:
         <programlisting>
-        security.acme.certs."example.com".allowKeysForGroup = true;
         systemd.services.molly-brown.serviceConfig.SupplementaryGroups =
           [ config.security.acme.certs."example.com".group ];
         </programlisting>

nixos/modules/services/web-servers/nginx/default.nix

@@ -859,7 +859,7 @@ in
         PrivateMounts = true;
         # System Call Filtering
         SystemCallArchitectures = "native";
-        SystemCallFilter = "~@chown @cpu-emulation @debug @keyring @ipc @module @mount @obsolete @privileged @raw-io @reboot @setuid @swap";
+        SystemCallFilter = "~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid";
       };
     };
 
@@ -867,8 +867,9 @@ in
       source = configFile;
     };
 
-    # postRun hooks on cert renew can't be used to restart Nginx since renewal
-    # runs as the unprivileged acme user. sslTargets are added to wantedBy + before
+    # This service waits for all certificates to be available
+    # before reloading nginx configuration.
+    # sslTargets are added to wantedBy + before
     # which allows the acme-finished-$cert.target to signify the successful updating
     # of certs end-to-end.
     systemd.services.nginx-config-reload = let

nixos/modules/services/x11/desktop-managers/gnome.nix

@@ -64,6 +64,7 @@ in
 {
 
   meta = {
+    doc = ./gnome.xml;
     maintainers = teams.gnome.members;
   };
 
@@ -553,7 +554,7 @@ in
         /* gnome-boxes */
       ] config.environment.gnome.excludePackages);
 
-      services.sysprof.enable = true;
+      services.sysprof.enable = notExcluded pkgs.sysprof;
     })
   ];
 

nixos/modules/services/x11/desktop-managers/gnome.xml

@@ -0,0 +1,276 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="chap-gnome">
+ <title>GNOME Desktop</title>
+ <para>
+  GNOME provides a simple, yet full-featured desktop environment with a focus on productivity. Its Mutter compositor supports both Wayland and X server, and the GNOME Shell user interface is fully customizable by extensions.
+ </para>
+
+ <section xml:id="sec-gnome-enable">
+  <title>Enabling GNOME</title>
+
+  <para>
+   All of the core apps, optional apps, games, and core developer tools from GNOME are available.
+  </para>
+
+  <para>
+   To enable the GNOME desktop use:
+  </para>
+
+<programlisting>
+<xref linkend="opt-services.xserver.desktopManager.gnome.enable"/> = true;
+<xref linkend="opt-services.xserver.displayManager.gdm.enable"/> = true;
+</programlisting>
+
+  <note>
+   <para>
+    While it is not strictly necessary to use GDM as the display manager with GNOME, it is recommended, as some features such as screen lock <link xlink:href="#sec-gnome-faq-can-i-use-lightdm-with-gnome">might not work</link> without it.
+   </para>
+  </note>
+
+  <para>
+   The default applications used in NixOS are very minimal, inspired by the defaults used in <link xlink:href="https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/40.0/elements/core/meta-gnome-core-utilities.bst">gnome-build-meta</link>.
+  </para>
+
+  <section xml:id="sec-gnome-without-the-apps">
+   <title>GNOME without the apps</title>
+
+   <para>
+    If you’d like to only use the GNOME desktop and not the apps, you can disable them with:
+   </para>
+
+<programlisting>
+<xref linkend="opt-services.gnome.core-utilities.enable"/> = false;
+</programlisting>
+
+   <para>
+    and none of them will be installed.
+   </para>
+
+   <para>
+    If you’d only like to omit a subset of the core utilities, you can use <xref linkend="opt-environment.gnome.excludePackages"/>.
+    Note that this mechanism can only exclude core utilities, games and core developer tools.
+   </para>
+  </section>
+
+  <section xml:id="sec-gnome-disabling-services">
+   <title>Disabling GNOME services</title>
+
+   <para>
+    It is also possible to disable many of the <link xlink:href="https://github.com/NixOS/nixpkgs/blob/b8ec4fd2a4edc4e30d02ba7b1a2cc1358f3db1d5/nixos/modules/services/x11/desktop-managers/gnome.nix#L329-L348">core services</link>. For example, if you do not need indexing files, you can disable Tracker with:
+   </para>
+
+<programlisting>
+<xref linkend="opt-services.gnome.tracker-miners.enable"/> = false;
+<xref linkend="opt-services.gnome.tracker.enable"/> = false;
+</programlisting>
+
+   <para>
+    Note, however, that doing so is not supported and might break some applications. Notably, GNOME Music cannot work without Tracker.
+   </para>
+  </section>
+
+  <section xml:id="sec-gnome-games">
+   <title>GNOME games</title>
+
+   <para>
+    You can install all of the GNOME games with:
+   </para>
+
+<programlisting>
+<xref linkend="opt-services.gnome.games.enable"/> = true;
+</programlisting>
+  </section>
+
+  <section xml:id="sec-gnome-core-developer-tools">
+   <title>GNOME core developer tools</title>
+
+   <para>
+    You can install GNOME core developer tools with:
+   </para>
+
+<programlisting>
+<xref linkend="opt-services.gnome.core-developer-tools.enable"/> = true;
+</programlisting>
+  </section>
+ </section>
+
+ <section xml:id="sec-gnome-enable-flashback">
+  <title>Enabling GNOME Flashback</title>
+
+  <para>
+   GNOME Flashback provides a desktop environment based on the classic GNOME 2 architecture. You can enable the default GNOME Flashback session, which uses the Metacity window manager, with:
+  </para>
+
+<programlisting>
+<xref linkend="opt-services.xserver.desktopManager.gnome.flashback.enableMetacity"/> = true;
+</programlisting>
+
+  <para>
+   It is also possible to create custom sessions that replace Metacity with a different window manager using <xref linkend="opt-services.xserver.desktopManager.gnome.flashback.customSessions"/>.
+  </para>
+
+  <para>
+   The following example uses <literal>xmonad</literal> window manager:
+  </para>
+
+<programlisting>
+<xref linkend="opt-services.xserver.desktopManager.gnome.flashback.customSessions"/> = [
+  {
+    wmName = "xmonad";
+    wmLabel = "XMonad";
+    wmCommand = "${pkgs.haskellPackages.xmonad}/bin/xmonad";
+  }
+];
+</programlisting>
+
+ </section>
+ <section xml:id="sec-gnome-gdm">
+  <title>GDM</title>
+
+  <para>
+   If you want to use GNOME Wayland session on Nvidia hardware, you need to enable:
+  </para>
+
+<programlisting>
+<xref linkend="opt-services.xserver.displayManager.gdm.nvidiaWayland"/> = true;
+</programlisting>
+
+  <para>
+   as the default configuration will forbid this.
+  </para>
+ </section>
+
+ <section xml:id="sec-gnome-icons-and-gtk-themes">
+  <title>Icons and GTK Themes</title>
+
+  <para>
+   Icon themes and GTK themes don’t require any special option to install in NixOS.
+  </para>
+
+  <para>
+   You can add them to <xref linkend="opt-environment.systemPackages"/> and switch to them with GNOME Tweaks.
+   If you’d like to do this manually in dconf, change the values of the following keys:
+  </para>
+
+<programlisting>
+/org/gnome/desktop/interface/gtk-theme
+/org/gnome/desktop/interface/icon-theme
+</programlisting>
+
+  <para>
+   in <literal>dconf-editor</literal>
+  </para>
+ </section>
+
+ <section xml:id="sec-gnome-shell-extensions">
+  <title>Shell Extensions</title>
+
+  <para>
+   Most Shell extensions are packaged under the <literal>gnomeExtensions</literal> attribute.
+   Some packages that include Shell extensions, like <literal>gnome.gpaste</literal>, don’t have their extension decoupled under this attribute.
+  </para>
+
+  <para>
+   You can install them like any other package:
+  </para>
+
+<programlisting>
+<xref linkend="opt-environment.systemPackages"/> = [
+  gnomeExtensions.dash-to-dock
+  gnomeExtensions.gsconnect
+  gnomeExtensions.mpris-indicator-button
+];
+</programlisting>
+
+  <para>
+   Unfortunately, we lack a way for these to be managed in a completely declarative way.
+   So you have to enable them manually with an Extensions application.
+   It is possible to use a <link xlink:href="#sec-gnome-gsettings-overrides">GSettings override</link> for this on <literal>org.gnome.shell.enabled-extensions</literal>, but that will only influence the default value.
+  </para>
+ </section>
+
+ <section xml:id="sec-gnome-gsettings-overrides">
+  <title>GSettings Overrides</title>
+
+  <para>
+   Majority of software building on the GNOME platform use GLib’s <link xlink:href="https://developer.gnome.org/gio/unstable/GSettings.html">GSettings</link> system to manage runtime configuration. For our purposes, the system consists of XML schemas describing the individual configuration options, stored in the package, and a settings backend, where the values of the settings are stored. On NixOS, like on most Linux distributions, dconf database is used as the backend.
+  </para>
+
+  <para>
+   <link xlink:href="https://developer.gnome.org/gio/unstable/GSettings.html#id-1.4.19.2.9.25">GSettings vendor overrides</link> can be used to adjust the default values for settings of the GNOME desktop and apps by replacing the default values specified in the XML schemas. Using overrides will allow you to pre-seed user settings before you even start the session.
+  </para>
+
+  <warning>
+   <para>
+    Overrides really only change the default values for GSettings keys so if you or an application changes the setting value, the value set by the override will be ignored. Until <link xlink:href="https://github.com/NixOS/nixpkgs/issues/54150">NixOS’s dconf module implements changing values</link>, you will either need to keep that in mind and clear the setting from the backend using <literal>dconf reset</literal> command when that happens, or use the <link xlink:href="https://nix-community.github.io/home-manager/options.html#opt-dconf.settings">module from home-manager</link>.
+   </para>
+  </warning>
+
+  <para>
+   You can override the default GSettings values using the <xref linkend="opt-services.xserver.desktopManager.gnome.extraGSettingsOverrides"/> option.
+  </para>
+
+  <para>
+   Take note that whatever packages you want to override GSettings for, you need to add them to
+   <xref linkend="opt-services.xserver.desktopManager.gnome.extraGSettingsOverridePackages"/>.
+  </para>
+
+  <para>
+   You can use <literal>dconf-editor</literal> tool to explore which GSettings you can set.
+  </para>
+
+  <section xml:id="sec-gnome-gsettings-overrides-example">
+   <title>Example</title>
+
+<programlisting>
+services.xserver.desktopManager.gnome = {
+  <link xlink:href="#opt-services.xserver.desktopManager.gnome.extraGSettingsOverrides">extraGSettingsOverrides</link> = ''
+    # Change default background
+    [org.gnome.desktop.background]
+    picture-uri='file://${pkgs.nixos-artwork.wallpapers.mosaic-blue.gnomeFilePath}'
+
+    # Favorite apps in gnome-shell
+    [org.gnome.shell]
+    favorite-apps=['org.gnome.Photos.desktop', 'org.gnome.Nautilus.desktop']
+  '';
+
+  <link xlink:href="#opt-services.xserver.desktopManager.gnome.extraGSettingsOverridePackages">extraGSettingsOverridePackages</link> = [
+    pkgs.gsettings-desktop-schemas # for org.gnome.desktop
+    pkgs.gnome.gnome-shell # for org.gnome.shell
+  ];
+};
+</programlisting>
+  </section>
+ </section>
+
+ <section xml:id="sec-gnome-faq">
+  <title>Frequently Asked Questions</title>
+
+  <section xml:id="sec-gnome-faq-can-i-use-lightdm-with-gnome">
+   <title>Can I use LightDM with GNOME?</title>
+
+   <para>
+    Yes you can, and any other display-manager in NixOS.
+   </para>
+
+   <para>
+    However, it doesn’t work correctly for the Wayland session of GNOME Shell yet, and
+    won’t be able to lock your screen.
+   </para>
+
+   <para>
+    See <link xlink:href="https://github.com/NixOS/nixpkgs/issues/56342">this issue.</link>
+   </para>
+  </section>
+
+  <section xml:id="sec-gnome-faq-nixos-rebuild-switch-kills-session">
+   <title>Why does <literal>nixos-rebuild switch</literal> sometimes kill my session?</title>
+
+   <para>
+    This is a known <link xlink:href="https://github.com/NixOS/nixpkgs/issues/44344">issue</link> without any workarounds.
+    If you are doing a fairly large upgrade, it is probably safer to use <literal>nixos-rebuild boot</literal>.
+   </para>
+  </section>
+ </section>
+</chapter>

nixos/modules/system/boot/networkd.nix

@@ -716,10 +716,17 @@ let
           "NTP"
           "EmitSIP"
           "SIP"
+          "EmitPOP3"
+          "POP3"
+          "EmitSMTP"
+          "SMTP"
+          "EmitLPR"
+          "LPR"
           "EmitRouter"
           "EmitTimezone"
           "Timezone"
           "SendOption"
+          "SendVendorOption"
         ])
         (assertInt "PoolOffset")
         (assertMinimum "PoolOffset" 0)
@@ -728,6 +735,9 @@ let
         (assertValueOneOf "EmitDNS" boolValues)
         (assertValueOneOf "EmitNTP" boolValues)
         (assertValueOneOf "EmitSIP" boolValues)
+        (assertValueOneOf "EmitPOP3" boolValues)
+        (assertValueOneOf "EmitSMTP" boolValues)
+        (assertValueOneOf "EmitLPR" boolValues)
         (assertValueOneOf "EmitRouter" boolValues)
         (assertValueOneOf "EmitTimezone" boolValues)
       ];

nixos/modules/tasks/filesystems.nix

@@ -309,7 +309,7 @@ in
         "mount-pstore" = {
           serviceConfig = {
             Type = "oneshot";
-            ExecStart = "${pkgs.utillinux}/bin/mount -t pstore -o nosuid,noexec,nodev pstore /sys/fs/pstore";
+            ExecStart = "${pkgs.util-linux}/bin/mount -t pstore -o nosuid,noexec,nodev pstore /sys/fs/pstore";
             ExecStartPost = pkgs.writeShellScript "wait-for-pstore.sh" ''
               set -eu
               TRIES=0

nixos/release-combined.nix

@@ -90,7 +90,7 @@ in rec {
         (onFullSupported "nixos.tests.keymap.azerty")
         (onFullSupported "nixos.tests.keymap.colemak")
         (onFullSupported "nixos.tests.keymap.dvorak")
-        (onFullSupported "nixos.tests.keymap.dvp")
+        (onFullSupported "nixos.tests.keymap.dvorak-programmer")
         (onFullSupported "nixos.tests.keymap.neo")
         (onFullSupported "nixos.tests.keymap.qwertz")
         (onFullSupported "nixos.tests.latestKernel.login")

nixos/tests/all-tests.nix

@@ -29,6 +29,7 @@ in
   ammonite = handleTest ./ammonite.nix {};
   apparmor = handleTest ./apparmor.nix {};
   atd = handleTest ./atd.nix {};
+  atop = handleTest ./atop.nix {};
   avahi = handleTest ./avahi.nix {};
   avahi-with-resolved = handleTest ./avahi.nix { networkd = true; };
   awscli = handleTest ./awscli.nix { };

nixos/tests/atop.nix

@@ -0,0 +1,213 @@
+{ system ? builtins.currentSystem
+, config ? { }
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+with pkgs.lib;
+
+let assertions = rec {
+  path = program: path: ''
+    with subtest("The path of ${program} should be ${path}"):
+        p = machine.succeed("type -p \"${program}\" | head -c -1")
+        assert p == "${path}", f"${program} is {p}, expected ${path}"
+  '';
+  unit = name: state: ''
+    with subtest("Unit ${name} should be ${state}"):
+        machine.require_unit_state("${name}", "${state}")
+  '';
+  version = ''
+    import re
+
+    with subtest("binary should report the correct version"):
+        pkgver = "${pkgs.atop.version}"
+        ver = re.sub(r'(?s)^Version: (\d\.\d\.\d).*', r'\1', machine.succeed("atop -V"))
+        assert ver == pkgver, f"Version is `{ver}`, expected `{pkgver}`"
+  '';
+  atoprc = contents:
+    if builtins.stringLength contents > 0 then ''
+      with subtest("/etc/atoprc should have the correct contents"):
+          f = machine.succeed("cat /etc/atoprc")
+          assert f == "${contents}", f"/etc/atoprc contents: '{f}', expected '${contents}'"
+    '' else ''
+      with subtest("/etc/atoprc should not be present"):
+          machine.succeed("test ! -e /etc/atoprc")
+    '';
+  wrapper = present:
+    if present then path "atop" "/run/wrappers/bin/atop" + ''
+      with subtest("Wrapper should be setuid root"):
+          stat = machine.succeed("stat --printf '%a %u' /run/wrappers/bin/atop")
+          assert stat == "4511 0", f"Wrapper stat is {stat}, expected '4511 0'"
+    ''
+    else path "atop" "/run/current-system/sw/bin/atop";
+  atopService = present:
+    if present then
+      unit "atop.service" "active"
+      + ''
+        with subtest("atop.service should have written some data to /var/log/atop"):
+            files = int(machine.succeed("ls -1 /var/log/atop | wc -l"))
+            assert files > 0, "Expected at least 1 data file"
+      '' else unit "atop.service" "inactive";
+  atopRotateTimer = present:
+    unit "atop-rotate.timer" (if present then "active" else "inactive");
+  atopacctService = present:
+    if present then
+      unit "atopacct.service" "active"
+      + ''
+        with subtest("atopacct.service should enable process accounting"):
+            machine.succeed("test -f /run/pacct_source")
+
+        with subtest("atopacct.service should write data to /run/pacct_shadow.d"):
+            files = int(machine.succeed("ls -1 /run/pacct_shadow.d | wc -l"))
+            assert files >= 1, "Expected at least 1 pacct_shadow.d file"
+      '' else unit "atopacct.service" "inactive";
+  netatop = present:
+    if present then
+      unit "netatop.service" "active"
+      + ''
+        with subtest("The netatop kernel module should be loaded"):
+            out = machine.succeed("modprobe -n -v netatop")
+            assert out == "", f"Module should be loaded already, but modprobe would have done {out}."
+      '' else ''
+      with subtest("The netatop kernel module should be absent"):
+          machine.fail("modprobe -n -v netatop")
+    '';
+  atopgpu = present:
+    if present then
+      (unit "atopgpu.service" "active") + (path "atopgpud" "/run/current-system/sw/bin/atopgpud")
+    else (unit "atopgpu.service" "inactive") + ''
+      with subtest("atopgpud should not be present"):
+          machine.fail("type -p atopgpud")
+    '';
+};
+in
+{
+  name = "atop";
+
+  justThePackage = makeTest {
+    name = "atop-justThePackage";
+    machine = {
+      environment.systemPackages = [ pkgs.atop ];
+    };
+    testScript = with assertions; builtins.concatStringsSep "\n" [
+      version
+      (atoprc "")
+      (wrapper false)
+      (atopService false)
+      (atopRotateTimer false)
+      (atopacctService false)
+      (netatop false)
+      (atopgpu false)
+    ];
+  };
+  defaults = makeTest {
+    name = "atop-defaults";
+    machine = {
+      programs.atop = {
+        enable = true;
+      };
+    };
+    testScript = with assertions; builtins.concatStringsSep "\n" [
+      version
+      (atoprc "")
+      (wrapper false)
+      (atopService true)
+      (atopRotateTimer true)
+      (atopacctService true)
+      (netatop false)
+      (atopgpu false)
+    ];
+  };
+  minimal = makeTest {
+    name = "atop-minimal";
+    machine = {
+      programs.atop = {
+        enable = true;
+        atopService.enable = false;
+        atopRotateTimer.enable = false;
+        atopacctService.enable = false;
+      };
+    };
+    testScript = with assertions; builtins.concatStringsSep "\n" [
+      version
+      (atoprc "")
+      (wrapper false)
+      (atopService false)
+      (atopRotateTimer false)
+      (atopacctService false)
+      (netatop false)
+      (atopgpu false)
+    ];
+  };
+  netatop = makeTest {
+    name = "atop-netatop";
+    machine = {
+      programs.atop = {
+        enable = true;
+        netatop.enable = true;
+      };
+    };
+    testScript = with assertions; builtins.concatStringsSep "\n" [
+      version
+      (atoprc "")
+      (wrapper false)
+      (atopService true)
+      (atopRotateTimer true)
+      (atopacctService true)
+      (netatop true)
+      (atopgpu false)
+    ];
+  };
+  atopgpu = makeTest {
+    name = "atop-atopgpu";
+    machine = {
+      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (getName pkg) [
+        "cudatoolkit"
+      ];
+
+      programs.atop = {
+        enable = true;
+        atopgpu.enable = true;
+      };
+    };
+    testScript = with assertions; builtins.concatStringsSep "\n" [
+      version
+      (atoprc "")
+      (wrapper false)
+      (atopService true)
+      (atopRotateTimer true)
+      (atopacctService true)
+      (netatop false)
+      (atopgpu true)
+    ];
+  };
+  everything = makeTest {
+    name = "atop-everthing";
+    machine = {
+      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (getName pkg) [
+        "cudatoolkit"
+      ];
+
+      programs.atop = {
+        enable = true;
+        settings = {
+          flags = "faf1";
+          interval = 2;
+        };
+        setuidWrapper.enable = true;
+        netatop.enable = true;
+        atopgpu.enable = true;
+      };
+    };
+    testScript = with assertions; builtins.concatStringsSep "\n" [
+      version
+      (atoprc "flags faf1\\ninterval 2\\n")
+      (wrapper true)
+      (atopService true)
+      (atopRotateTimer true)
+      (atopacctService true)
+      (netatop true)
+      (atopgpu true)
+    ];
+  };
+}

nixos/tests/cagebreak.nix

@@ -17,56 +17,27 @@ in
   let
     alice = config.users.users.alice;
   in {
+    # Automatically login on tty1 as a normal user:
     imports = [ ./common/user-account.nix ];
+    services.getty.autologinUser = "alice";
+    programs.bash.loginShellInit = ''
+      if [ "$(tty)" = "/dev/tty1" ]; then
+        set -e
 
+        mkdir -p ~/.config/cagebreak
+        cp -f ${cagebreakConfigfile} ~/.config/cagebreak/config
+
+        cagebreak
+      fi
+    '';
+
+    hardware.opengl.enable = true;
+    programs.xwayland.enable = true;
     environment.systemPackages = [ pkgs.cagebreak pkgs.wallutils ];
-    services.xserver = {
-      enable = true;
-      displayManager.autoLogin = {
-        enable = true;
-        user = alice.name;
-      };
-    };
-    services.xserver.windowManager.session = lib.singleton {
-      manage = "desktop";
-      name = "cagebreak";
-      start = ''
-        export XDG_RUNTIME_DIR="/run/user/${toString alice.uid}"
-        ${pkgs.cagebreak}/bin/cagebreak &
-        waitPID=$!
-      '';
-    };
-
-    systemd.services.setupCagebreakConfig = {
-      wantedBy = [ "multi-user.target" ];
-      before = [ "multi-user.target" ];
-      environment = {
-        HOME = alice.home;
-      };
-      unitConfig = {
-        type = "oneshot";
-        RemainAfterExit = true;
-        user = alice.name;
-      };
-      script = ''
-        cd $HOME
-        CONFFILE=$HOME/.config/cagebreak/config
-        mkdir -p $(dirname $CONFFILE)
-        cp ${cagebreakConfigfile} $CONFFILE
-      '';
-    };
-
-    # Copied from cage:
-    # this needs a fairly recent kernel, otherwise:
-    #   [backend/drm/util.c:215] Unable to add DRM framebuffer: No such file or directory
-    #   [backend/drm/legacy.c:15] Virtual-1: Failed to set CRTC: No such file or directory
-    #   [backend/drm/util.c:215] Unable to add DRM framebuffer: No such file or directory
-    #   [backend/drm/legacy.c:15] Virtual-1: Failed to set CRTC: No such file or directory
-    #   [backend/drm/drm.c:618] Failed to initialize renderer on connector 'Virtual-1': initial page-flip failed
-    #   [backend/drm/drm.c:701] Failed to initialize renderer for plane
-    boot.kernelPackages = pkgs.linuxPackages_latest;
 
     virtualisation.memorySize = 1024;
+    # Need to switch to a different VGA card / GPU driver than the default one (std) so that Cagebreak can launch:
+    virtualisation.qemu.options = [ "-vga virtio" ];
   };
 
   enableOCR = true;
@@ -80,14 +51,15 @@ in
     machine.wait_for_file("${XDG_RUNTIME_DIR}/wayland-0")
 
     with subtest("ensure wayland works with wayinfo from wallutils"):
-        machine.succeed("env XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR} wayinfo")
+        print(machine.succeed("env XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR} wayinfo"))
 
-    with subtest("ensure xwayland works with xterm"):
-        machine.send_key("ctrl-t")
-        machine.send_key("t")
-        machine.wait_until_succeeds("pgrep xterm")
-        machine.wait_for_text("${user.name}@machine")
-        machine.screenshot("screen")
-        machine.send_key("ctrl-d")
+    # TODO: Fix the XWayland test (log the cagebreak output to debug):
+    # with subtest("ensure xwayland works with xterm"):
+    #     machine.send_key("ctrl-t")
+    #     machine.send_key("t")
+    #     machine.wait_until_succeeds("pgrep xterm")
+    #     machine.wait_for_text("${user.name}@machine")
+    #     machine.screenshot("screen")
+    #     machine.send_key("ctrl-d")
   '';
 })

nixos/tests/signal-desktop.nix

@@ -44,12 +44,11 @@ import ./make-test-python.nix ({ pkgs, ...} :
     # - https://github.com/NixOS/nixpkgs/issues/108772
     # - https://github.com/NixOS/nixpkgs/pull/117555
     print(machine.succeed("su - alice -c 'file ~/.config/Signal/sql/db.sqlite'"))
-    # TODO: The DB should be encrypted and the following should be machine.fail
-    # instead of machine.succeed but the DB is currently unencrypted and we
-    # want to notice if this isn't the case anymore as the transition to a
-    # encrypted DB can cause data loss!:
     machine.succeed(
-        "su - alice -c 'file ~/.config/Signal/sql/db.sqlite' | grep -i sqlite"
+        "su - alice -c 'file ~/.config/Signal/sql/db.sqlite' | grep 'db.sqlite: data'"
+    )
+    machine.fail(
+        "su - alice -c 'file ~/.config/Signal/sql/db.sqlite' | grep -e SQLite -e database"
     )
   '';
 })

nixos/tests/v2ray.nix

@@ -3,7 +3,7 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: let
   v2rayUser = {
     # A random UUID.
     id = "a6a46834-2150-45f8-8364-0f6f6ab32384";
-    alterId = 4;
+    alterId = 0; # Non-zero support will be disabled in the future.
   };
 
   # 1080 [http proxy] -> 1081 [vmess] -> direct

pkgs/applications/accessibility/squeekboard/default.nix

@@ -18,14 +18,14 @@
 
 stdenv.mkDerivation rec {
   pname = "squeekboard";
-  version = "unstable-2021-03-09";
+  version = "1.13.0";
 
   src = fetchFromGitLab {
     domain = "source.puri.sm";
     owner = "Librem5";
     repo = pname;
-    rev = "bffd212e102bf71a94c599aac0359a8d30d19008";
-    sha256 = "1j10zhyb8wyrcbryfj6f3drn9b0l9x0l7hnhy2imnjbfbnwwm4w7";
+    rev = "v${version}";
+    sha256 = "0xyd6ickbaqvrr8a7ak6j1ziqjk05jlnganjrdv43p74nnjyqr8y";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
       cat Cargo.toml.in Cargo.deps > Cargo.toml
     '';
     name = "${pname}-${version}";
-    sha256 = "1qaqiaxqc4x2x5bd31na4c49vbjwrmz5clmgli7733dv55rxxias";
+    sha256 = "096skk7vmr93axcf0qj7kyr8hm1faj0nkmd349g8mnzwd68a9npz";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/cantata/default.nix

@@ -54,12 +54,26 @@ let
   fstat = x: fn:
     "-DENABLE_${fn}=${if x then "ON" else "OFF"}";
 
-  fstats = x:
-    map (fstat x);
-
   withUdisks = (withTaglib && withDevices);
 
-  perl' = perl.withPackages (ppkgs: with ppkgs; [ URI ]);
+  options = [
+    { names = [ "CDDB" ]; enable = withCddb; pkgs = [ libcddb ]; }
+    { names = [ "CDPARANOIA" ]; enable = withCdda; pkgs = [ cdparanoia ]; }
+    { names = [ "DEVICES_SUPPORT" ]; enable = withDevices; pkgs = [ ]; }
+    { names = [ "DYNAMIC" ]; enable = withDynamic; pkgs = [ ]; }
+    { names = [ "FFMPEG" "MPG123" "SPEEXDSP" ]; enable = withReplaygain; pkgs = [ ffmpeg speex mpg123 ]; }
+    { names = [ "HTTPS_SUPPORT" ]; enable = true; pkgs = [ ]; }
+    { names = [ "HTTP_SERVER" ]; enable = withHttpServer; pkgs = [ ]; }
+    { names = [ "HTTP_STREAM_PLAYBACK" ]; enable = withHttpStream; pkgs = [ qtmultimedia ]; }
+    { names = [ "LAME" ]; enable = withLame; pkgs = [ lame ]; }
+    { names = [ "LIBVLC" ]; enable = withLibVlc; pkgs = [ libvlc ]; }
+    { names = [ "MTP" ]; enable = withMtp; pkgs = [ libmtp ]; }
+    { names = [ "MUSICBRAINZ" ]; enable = withMusicbrainz; pkgs = [ libmusicbrainz5 ]; }
+    { names = [ "ONLINE_SERVICES" ]; enable = withOnlineServices; pkgs = [ ]; }
+    { names = [ "STREAMS" ]; enable = withStreams; pkgs = [ ]; }
+    { names = [ "TAGLIB" "TAGLIB_EXTRAS" ]; enable = withTaglib; pkgs = [ taglib taglib_extras ]; }
+    { names = [ "UDISKS2" ]; enable = withUdisks; pkgs = [ udisks2 ]; }
+  ];
 
 in
 mkDerivation rec {
@@ -84,38 +98,16 @@ mkDerivation rec {
     patchShebangs playlists
   '';
 
-  buildInputs = [ qtbase qtsvg perl' ]
-    ++ lib.optionals withTaglib [ taglib taglib_extras ]
-    ++ lib.optionals withReplaygain [ ffmpeg speex mpg123 ]
-    ++ lib.optional withHttpStream qtmultimedia
-    ++ lib.optional withCdda cdparanoia
-    ++ lib.optional withCddb libcddb
-    ++ lib.optional withLame lame
-    ++ lib.optional withMtp libmtp
-    ++ lib.optional withMusicbrainz libmusicbrainz5
-    ++ lib.optional withUdisks udisks2
-    ++ lib.optional withLibVlc libvlc;
+  buildInputs = [
+    qtbase
+    qtsvg
+    (perl.withPackages (ppkgs: with ppkgs; [ URI ]))
+  ]
+  ++ lib.flatten (builtins.catAttrs "pkgs" (builtins.filter (e: e.enable) options));
 
   nativeBuildInputs = [ cmake pkg-config qttools ];
 
-  cmakeFlags = lib.flatten [
-    (fstats withTaglib [ "TAGLIB" "TAGLIB_EXTRAS" ])
-    (fstats withReplaygain [ "FFMPEG" "MPG123" "SPEEXDSP" ])
-    (fstat withHttpStream "HTTP_STREAM_PLAYBACK")
-    (fstat withCdda "CDPARANOIA")
-    (fstat withCddb "CDDB")
-    (fstat withLame "LAME")
-    (fstat withMtp "MTP")
-    (fstat withMusicbrainz "MUSICBRAINZ")
-    (fstat withOnlineServices "ONLINE_SERVICES")
-    (fstat withDynamic "DYNAMIC")
-    (fstat withDevices "DEVICES_SUPPORT")
-    (fstat withHttpServer "HTTP_SERVER")
-    (fstat withLibVlc "LIBVLC")
-    (fstat withStreams "STREAMS")
-    (fstat withUdisks "UDISKS2")
-    "-DENABLE_HTTPS_SUPPORT=ON"
-  ];
+  cmakeFlags = lib.flatten (map (e: map (f: fstat e.enable f) e.names) options);
 
   meta = with lib; {
     description = "A graphical client for MPD";

pkgs/applications/audio/deadbeef/default.nix

@@ -17,7 +17,7 @@
 , aacSupport ? true, faad2 ? null
 , opusSupport ? true, opusfile ? null
 , wavpackSupport ? false, wavpack ? null
-, ffmpegSupport ? false, ffmpeg_3 ? null
+, ffmpegSupport ? false, ffmpeg ? null
 , apeSupport ? true, yasm ? null
 # misc plugins
 , zipSupport ? true, libzip ? null
@@ -45,7 +45,7 @@ assert cdaSupport -> (libcdio != null && libcddb != null);
 assert aacSupport -> faad2 != null;
 assert opusSupport -> opusfile != null;
 assert zipSupport -> libzip != null;
-assert ffmpegSupport -> ffmpeg_3 != null;
+assert ffmpegSupport -> ffmpeg != null;
 assert apeSupport -> yasm != null;
 assert artworkSupport -> imlib2 != null;
 assert hotkeysSupport -> libX11 != null;
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
     ++ optional aacSupport faad2
     ++ optional opusSupport opusfile
     ++ optional zipSupport libzip
-    ++ optional ffmpegSupport ffmpeg_3
+    ++ optional ffmpegSupport ffmpeg
     ++ optional apeSupport yasm
     ++ optional artworkSupport imlib2
     ++ optional hotkeysSupport libX11

pkgs/applications/audio/gnome-podcasts/default.nix

@@ -8,8 +8,11 @@
 , python3
 , pkg-config
 , glib
-, libhandy_0
+, cmake
+, libhandy
 , gtk3
+, appstream-glib
+, desktop-file-utils
 , dbus
 , openssl
 , sqlite
@@ -19,20 +22,20 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-podcasts";
-  version = "0.4.8";
+  version = "0.4.9";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "podcasts";
     rev = version;
-    sha256 = "0y2332zjq7vf1v38wzwz98fs19vpzy9kl7y0xbdzqr303l59hjb1";
+    sha256 = "1ah59ac3xm3sqai8zhil8ar30pviw83cm8in1n4id77rv24xkvgm";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-GInRA/V61r42spb/JYlM8+mATSkmOxdm2zHPRWaKcck=";
+    sha256 = "1iihpfvkli09ysn46cnif53xizkwzk0m91bljmlzsygp3ip5i5yw";
   };
 
   nativeBuildInputs = [
@@ -49,9 +52,12 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    appstream-glib
+    cmake
+    desktop-file-utils
     glib
     gtk3
-    libhandy_0
+    libhandy
     dbus
     openssl
     sqlite

pkgs/applications/audio/muso/default.nix

@@ -1,5 +1,5 @@
-{ lib, fetchFromGitHub, rustPlatform
-, pkg-config, wrapGAppsHook
+{ lib, stdenv, fetchFromGitHub, rustPlatform
+, pkg-config, wrapGAppsHook, CoreServices
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -14,6 +14,7 @@ rustPlatform.buildRustPackage rec {
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+  buildInputs = lib.optional stdenv.isDarwin CoreServices;
 
   preConfigure = ''
     substituteInPlace lib/utils.rs \

pkgs/applications/audio/openmpt123/default.nix

@@ -2,14 +2,14 @@
 , usePulseAudio ? config.pulseaudio or false, libpulseaudio }:
 
 let
-  version = "0.5.6";
+  version = "0.5.8";
 in stdenv.mkDerivation {
   pname = "openmpt123";
   inherit version;
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "sha256-F96ngrM0wUb0rNlIx8Mf/dKvyJnrNH6+Ab4WBup59Lg=";
+    sha256 = "sha256-KeLCEXS3P2fyul7naAjWLxgrEw5PcE7i2a6Cg5gtis0=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/audio/spotify-qt/default.nix

@@ -9,13 +9,13 @@
 
 mkDerivation rec {
    pname = "spotify-qt";
-   version = "3.5";
+   version = "3.6";
 
    src = fetchFromGitHub {
       owner = "kraxarn";
       repo = pname;
       rev = "v${version}";
-      sha256 = "1bgd0q4sbbww3lbrx2zwgaz0sl7qh195s4kvgsq16gv7ij82bskn";
+      sha256 = "mKHyE6ZffMYYRLMpzMX53chyJyWxhTAaGvtBI3l6wkI=";
    };
 
    buildInputs = [ libxcb qtbase qtsvg ];

pkgs/applications/blockchains/btcpayserver/default.nix

@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "btcpayserver";
-  version = "1.0.7.2";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1hxpbzc4l1zxrcvmdm93vvphhksfwd0mw2dv6h8vi4451p77dhd9";
+    sha256 = "sha256-cCm4CZdVtjO2nj69CgRCrcwO0lAbiQVD6KocOj4CSdY=";
   };
 
   nativeBuildInputs = [ dotnetSdk dotnetPackages.Nuget makeWrapper ];

pkgs/applications/blockchains/btcpayserver/deps.nix

@@ -94,6 +94,21 @@
     version = "0.6.3";
     sha256 = "1vb7ahafcd3lcbiiz552aisilwm1yq3j600gkf1wik8vhvsk02fs";
   })
+  (fetchNuGet {
+    name = "Fido2.AspNet";
+    version = "2.0.1";
+    sha256 = "1d6bjyck3mlhb9b4c75xhzr2pcs47vdqg2ayi5wnjh1aszyam3nq";
+  })
+  (fetchNuGet {
+    name = "Fido2.Models";
+    version = "2.0.1";
+    sha256 = "0llpzkik82n5gpgjawx181j85d2lizimkbdkxj1wyrjvxb2xbg3q";
+  })
+  (fetchNuGet {
+    name = "Fido2";
+    version = "2.0.1";
+    sha256 = "1s829n970lxngbhac9lvarwa9n9hqxr79kwv8i12amnmg6ir8ny5";
+  })
   (fetchNuGet {
     name = "Google.Api.Gax.Rest";
     version = "2.5.0";
@@ -149,6 +164,11 @@
     version = "5.0.372";
     sha256 = "1gllp58vdbql2ybwf05i2178x7p4g8zyyk64317d1pyss5217g7r";
   })
+  (fetchNuGet {
+    name = "libsodium";
+    version = "1.0.18";
+    sha256 = "15qzl5k31yaaapqlijr336lh4lzz1qqxlimgxy8fdyig8jdmgszn";
+  })
   (fetchNuGet {
     name = "McMaster.NETCore.Plugins.Mvc";
     version = "1.3.1";
@@ -359,6 +379,11 @@
     version = "3.1.4";
     sha256 = "11w63yp7fk9qwmnq3lmpf1h30mlbzfx4zpm89vrs0lprj86g0742";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Caching.Abstractions";
+    version = "2.2.0";
+    sha256 = "0hhxc5dp52faha1bdqw0k426zicsv6x1kfqi30m9agr0b2hixj52";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.Caching.Abstractions";
     version = "3.1.4";
@@ -389,6 +414,11 @@
     version = "3.1.4";
     sha256 = "0r33m68y1vgpmqams4sgciizl0w6y97qkp93m0hyn0nlkxqf72l6";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Configuration.Abstractions";
+    version = "3.1.5";
+    sha256 = "03jwqjrfyx11ax19bq84c28qzaiyj4whrx7vayy4hr7sv0p28h8k";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.Configuration.Binder";
     version = "2.0.0";
@@ -399,6 +429,11 @@
     version = "3.1.4";
     sha256 = "1bnf213zlrh0m3sbhsv601yx21l5xp254jiy2g4hm7zpm8vsz1hz";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Configuration.Binder";
+    version = "3.1.5";
+    sha256 = "0310pvrwbbqak7k4s32syryqxlkwli8w8bwlpnqmz42svh2302wv";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.Configuration.EnvironmentVariables";
     version = "2.1.0";
@@ -429,6 +464,11 @@
     version = "3.1.4";
     sha256 = "0npc18pjl86d06czb0fy6ln3prfpwfb16p6709xx2jrsl96dp9bp";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Configuration";
+    version = "3.1.5";
+    sha256 = "1i7zm8ghgxwp655anyfm910qm7rcpvrz48fxjyzw9w63hj4sv6bk";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.DependencyInjection.Abstractions";
     version = "2.0.0";
@@ -444,6 +484,11 @@
     version = "3.1.4";
     sha256 = "03ys96pqca93zwxvh0vprzms09i9y0lmq32w98m6klbizq01fc06";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.DependencyInjection.Abstractions";
+    version = "3.1.5";
+    sha256 = "1wkf8ajh4pj6g3wwd18g3hjc3lqqny8052rl373ddcardxrs2gvn";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.DependencyInjection";
     version = "2.0.0";
@@ -539,6 +584,11 @@
     version = "3.1.4";
     sha256 = "1rkl0yqmi5vfivn641866v2mdsgdy8amym546y6lzbab39g24b5n";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Logging.Abstractions";
+    version = "3.1.5";
+    sha256 = "0lr22hlf52csrna9ly2lbz3y1agfgdlg7rvsqjg7ik488dhkmhji";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.Logging.Filter";
     version = "1.1.2";
@@ -559,6 +609,11 @@
     version = "2.0.0";
     sha256 = "1isc3rjbzz60f7wbmgcwslx5d10hm5hisnk7v54vfi2bz7132gll";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Options.ConfigurationExtensions";
+    version = "3.1.5";
+    sha256 = "10w78fj2jpmghvprz6b046xcr68zzp6x550a7m1iivn0h7a3l7pi";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.Options";
     version = "2.0.0";
@@ -569,6 +624,11 @@
     version = "3.1.4";
     sha256 = "0jphncx82l7jm5xi49dfxhbh24wv86sy44022chd7bkizllsypp4";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Options";
+    version = "3.1.5";
+    sha256 = "0rhqyqa7vhlmz2g0250zhypaayvckx4dv89micdg521cpvr5arpr";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.PlatformAbstractions";
     version = "1.1.0";
@@ -589,11 +649,36 @@
     version = "2.1.0";
     sha256 = "1r9gzwdfmb8ysnc4nzmyz5cyar1lw0qmizsvrsh252nhlyg06nmb";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Primitives";
+    version = "2.2.0";
+    sha256 = "0znah6arbcqari49ymigg3wiy2hgdifz8zsq8vdc3ynnf45r7h0c";
+  })
   (fetchNuGet {
     name = "Microsoft.Extensions.Primitives";
     version = "3.1.4";
     sha256 = "12xvysk024aghrcwzv4525vznnk8lqmknl2vqqxhq4k5hjxpsysp";
   })
+  (fetchNuGet {
+    name = "Microsoft.Extensions.Primitives";
+    version = "3.1.5";
+    sha256 = "0n2pk1sy8ikd29282sx4ps9r1wnhzgg4nwmkka9ypjizd8lkkk2m";
+  })
+  (fetchNuGet {
+    name = "Microsoft.IdentityModel.JsonWebTokens";
+    version = "6.6.0";
+    sha256 = "06z5a1jpqpdd1pix85is7kkpn4v0l4an909skji2p8gm09p5sfyv";
+  })
+  (fetchNuGet {
+    name = "Microsoft.IdentityModel.Logging";
+    version = "6.6.0";
+    sha256 = "1mpkx544cbxws1a22zwxbp3lqqamcc3x915l23spsxqvgr02jjrq";
+  })
+  (fetchNuGet {
+    name = "Microsoft.IdentityModel.Tokens";
+    version = "6.6.0";
+    sha256 = "0h5vbsd5x9cf7nqyrwn7d7y1axhf1zz0jr9prvi4xpxawa3kajyj";
+  })
   (fetchNuGet {
     name = "Microsoft.NET.Test.Sdk";
     version = "16.6.1";
@@ -671,8 +756,8 @@
   })
   (fetchNuGet {
     name = "NBitcoin.Altcoins";
-    version = "2.0.28";
-    sha256 = "1zfirfmhgigp733km9rqkgz560h5wg88bpba499x49h5j650cnn4";
+    version = "2.0.31";
+    sha256 = "13gcfsxpfq8slmsvgzf6iv581x7n535zq0p9c88bqs5p88r6lygm";
   })
   (fetchNuGet {
     name = "NBitcoin";
@@ -694,6 +779,11 @@
     version = "5.0.73";
     sha256 = "0vqgcb0ws5fnkrdzqfkyh78041c6q4l22b93rr0006dd4bmqrmg1";
   })
+  (fetchNuGet {
+    name = "NBitcoin";
+    version = "5.0.77";
+    sha256 = "0ykz4ii6lh6gdlz6z264wnib5pfnmq9q617qqbg0f04mq654jygb";
+  })
   (fetchNuGet {
     name = "NBitpayClient";
     version = "1.0.0.39";
@@ -701,8 +791,8 @@
   })
   (fetchNuGet {
     name = "NBXplorer.Client";
-    version = "3.0.20";
-    sha256 = "1mwa6ncmg5r6q7yn6skm9dgqm631c7r7nadcg9mvbw81113h0xxy";
+    version = "3.0.21";
+    sha256 = "1asri2wsjq3ljf2p4r4x52ba9cirh8ccc5ysxpnv4cvladkdazbi";
   })
   (fetchNuGet {
     name = "NETStandard.Library";
@@ -784,6 +874,11 @@
     version = "4.1.3.1";
     sha256 = "0qk3hb8s521c2gy4k3m1i6fhpr133mnw9w85cwsy9j7ghxyca1nv";
   })
+  (fetchNuGet {
+    name = "NSec.Cryptography";
+    version = "20.2.0";
+    sha256 = "19slji51v8s8i4836nqqg7qb3i3p4ahqahz0fbb3gwpp67pn6izx";
+  })
   (fetchNuGet {
     name = "NuGet.Frameworks";
     version = "5.0.0";
@@ -794,6 +889,21 @@
     version = "1.5.12";
     sha256 = "0f4gs31z8dwfvd246nrv3m0qkxzav37hxynx2maykza017khynyf";
   })
+  (fetchNuGet {
+    name = "PeterO.Cbor";
+    version = "4.1.3";
+    sha256 = "0882i3bhhx2yag2m4lbdsgngjwaj9ff4v0ab9zb839i4r77aq1yn";
+  })
+  (fetchNuGet {
+    name = "PeterO.Numbers";
+    version = "1.6.0";
+    sha256 = "04kfdkfr600h69g67g6izbn57bxqjamvaadyw3p9gjsc0wrivi98";
+  })
+  (fetchNuGet {
+    name = "PeterO.URIUtility";
+    version = "1.0.0";
+    sha256 = "04ihfbk2lf0smznwfb62h57qknls5jyxirdz72g5wn9h1dcgkdac";
+  })
   (fetchNuGet {
     name = "Pomelo.EntityFrameworkCore.MySql";
     version = "3.1.1";
@@ -804,11 +914,6 @@
     version = "2.2.1";
     sha256 = "1w6s9wjbsyvq8cnqknkdzm9chnv0g5gcsrq5i94zp6br9vg7c627";
   })
-  (fetchNuGet {
-    name = "Portable.BouncyCastle";
-    version = "1.8.1.3";
-    sha256 = "1lv1ljaz8df835jgmp3ny1xgqqjf1s9f25baw7bf8d24qlf25i2g";
-  })
   (fetchNuGet {
     name = "QRCoder";
     version = "1.4.1";
@@ -1164,6 +1269,11 @@
     version = "4.3.0";
     sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki";
   })
+  (fetchNuGet {
+    name = "System.IdentityModel.Tokens.Jwt";
+    version = "6.6.0";
+    sha256 = "17i6a43g1fksq9xy77dgsz54klz71pz062pb58lqx8h06p1818h1";
+  })
   (fetchNuGet {
     name = "System.Interactive.Async";
     version = "3.1.1";
@@ -1239,11 +1349,21 @@
     version = "4.5.0";
     sha256 = "1layqpcx1q4l805fdnj2dfqp6ncx2z42ca06rgsr6ikq4jjgbv30";
   })
+  (fetchNuGet {
+    name = "System.Memory";
+    version = "4.5.1";
+    sha256 = "0f07d7hny38lq9w69wx4lxkn4wszrqf9m9js6fh9is645csm167c";
+  })
   (fetchNuGet {
     name = "System.Memory";
     version = "4.5.3";
     sha256 = "0naqahm3wljxb5a911d37mwjqjdxv9l0b49p5dmfyijvni2ppy8a";
   })
+  (fetchNuGet {
+    name = "System.Memory";
+    version = "4.5.4";
+    sha256 = "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y";
+  })
   (fetchNuGet {
     name = "System.Net.Http";
     version = "4.3.0";
@@ -1409,6 +1529,11 @@
     version = "4.5.0";
     sha256 = "17labczwqk3jng3kkky73m0jhi8wc21vbl7cz5c0hj2p1dswin43";
   })
+  (fetchNuGet {
+    name = "System.Runtime.CompilerServices.Unsafe";
+    version = "4.5.1";
+    sha256 = "1xcrjx5fwg284qdnxyi2d0lzdm5q4frlpkp0nf6vvkx1kdz2prrf";
+  })
   (fetchNuGet {
     name = "System.Runtime.CompilerServices.Unsafe";
     version = "4.5.2";
@@ -1529,6 +1654,11 @@
     version = "4.3.0";
     sha256 = "1k468aswafdgf56ab6yrn7649kfqx2wm9aslywjam1hdmk5yypmv";
   })
+  (fetchNuGet {
+    name = "System.Security.Cryptography.Cng";
+    version = "4.7.0";
+    sha256 = "00797sqbba8lys486ifxblz9j52m29kidclvmqpk531820k55x9j";
+  })
   (fetchNuGet {
     name = "System.Security.Cryptography.Csp";
     version = "4.3.0";
@@ -1789,11 +1919,6 @@
     version = "2.12.1";
     sha256 = "0m41dxzc3hh0f4j1k4q915pvcq6zr0hv1pj6b3sayrn8vjhk64qb";
   })
-  (fetchNuGet {
-    name = "U2F.Core";
-    version = "1.0.4";
-    sha256 = "0mk32yyihigp9njs54z411fswgzr6x3kw134c7ylwy2d2wmq2n9b";
-  })
   (fetchNuGet {
     name = "WindowsAzure.Storage";
     version = "9.3.3";

pkgs/applications/blockchains/btcpayserver/update.sh

@@ -2,5 +2,10 @@
 set -euo pipefail
 
 scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
+cd "$scriptDir"
 
-"$scriptDir"/../nbxplorer/util/update-common.sh btcpayserver "$scriptDir"/deps.nix
+echo "Updating nbxplorer"
+../nbxplorer/update.sh
+echo
+echo "Updating btcpayserver"
+../nbxplorer/util/update-common.sh btcpayserver deps.nix

pkgs/applications/blockchains/nbxplorer/default.nix

@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "nbxplorer";
-  version = "2.1.49";
+  version = "2.1.51";
 
   src = fetchFromGitHub {
     owner = "dgarage";
     repo = "NBXplorer";
     rev = "v${version}";
-    sha256 = "0xg5gbq6rbzgsbgwf94qcy2b0m5kdspi6hc5a64smaj9i7i0136l";
+    sha256 = "sha256-tvuuoDZCSDFa8gAVyH+EP1DLtdPfbkr+w5lSxZkzZXg=";
   };
 
   nativeBuildInputs = [ dotnetSdk dotnetPackages.Nuget makeWrapper ];

pkgs/applications/blockchains/nbxplorer/deps.nix

@@ -181,18 +181,23 @@
   })
   (fetchNuGet {
     name = "NBitcoin.Altcoins";
-    version = "2.0.28";
-    sha256 = "1zfirfmhgigp733km9rqkgz560h5wg88bpba499x49h5j650cnn4";
+    version = "2.0.31";
+    sha256 = "13gcfsxpfq8slmsvgzf6iv581x7n535zq0p9c88bqs5p88r6lygm";
   })
   (fetchNuGet {
     name = "NBitcoin.TestFramework";
-    version = "2.0.21";
-    sha256 = "1k26fkss6d7x2yqlid31z5i04b5dmlbbbwijg9c8i3d996i1z7sq";
+    version = "2.0.22";
+    sha256 = "1zwhjy6xppl01jhkgl7lqjsmi8crny4qq22ml20cz8l437j1zi4n";
   })
   (fetchNuGet {
     name = "NBitcoin";
-    version = "5.0.73";
-    sha256 = "0vqgcb0ws5fnkrdzqfkyh78041c6q4l22b93rr0006dd4bmqrmg1";
+    version = "5.0.76";
+    sha256 = "0q3ilmsrw9ip1s38qmfs4qi02xvccmy1naafffn5yxj08q0n1p79";
+  })
+  (fetchNuGet {
+    name = "NBitcoin";
+    version = "5.0.77";
+    sha256 = "0ykz4ii6lh6gdlz6z264wnib5pfnmq9q617qqbg0f04mq654jygb";
   })
   (fetchNuGet {
     name = "NETStandard.Library";

pkgs/applications/blockchains/nbxplorer/util/create-deps.sh

@@ -6,7 +6,7 @@ set -euo pipefail
 # Expects $pkgSrc to contain a single .sln file.
 
 pkgSrc=$1
-depsFile=$2
+depsFile=$(realpath "$2")
 
 sln=$(cd "$pkgSrc"; find * -maxdepth 0 -name '*.sln' | head -1)
 [[ $sln ]] || { echo "No .sln file in $pkgSrc" ; exit 1; }

pkgs/applications/blockchains/nbxplorer/util/update-common.sh

@@ -1,16 +1,16 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils curl jq common-updater-scripts dotnet-sdk_3
+#!nix-shell -i bash -p coreutils curl jq common-updater-scripts dotnet-sdk_3 git gnupg
 set -euo pipefail
 
 # This script uses the following env vars:
 # getVersionFromTags
-# onlyCreateDeps
+# refetch
 
 pkgName=$1
 depsFile=$2
 
 : ${getVersionFromTags:=}
-: ${onlyCreateDeps:=}
+: ${refetch:=}
 
 scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
 nixpkgs=$(realpath "$scriptDir"/../../../../..)
@@ -29,23 +29,46 @@ getLatestVersionTag() {
     | sort -V | tail -1 | sed 's|^v||'
 }
 
-if [[ ! $onlyCreateDeps ]]; then
-  oldVersion=$(evalNixpkgs "$pkgName.version")
-  if [[ $getVersionFromTags ]]; then
-    newVersion=$(getLatestVersionTag)
-  else
-    newVersion=$(curl -s "https://api.github.com/repos/$(getRepo)/releases" | jq -r '.[0].name')
-  fi
-
-  if [[ $newVersion == $oldVersion ]]; then
-    echo "nixpkgs already has the latest version $newVersion"
-    echo "Run this script with env var onlyCreateDeps=1 to recreate "$(basename "$depsFile")
-    exit 0
-  else
-    echo "Updating $pkgName: $oldVersion -> $newVersion"
-    (cd "$nixpkgs" && update-source-version "$pkgName" "$newVersion")
-  fi
+oldVersion=$(evalNixpkgs "$pkgName.version")
+if [[ $getVersionFromTags ]]; then
+  newVersion=$(getLatestVersionTag)
+else
+  newVersion=$(curl -s "https://api.github.com/repos/$(getRepo)/releases" | jq -r '.[0].name')
 fi
 
+if [[ $newVersion == $oldVersion && ! $refetch ]]; then
+  echo "nixpkgs already has the latest version $newVersion"
+  echo "Run this script with env var refetch=1 to re-verify the content hash via GPG"
+  echo "and to recreate $(basename "$depsFile"). This is useful for reviewing a version update."
+  exit 0
+fi
+
+# Fetch release and GPG-verify the content hash
+tmpdir=$(mktemp -d /tmp/$pkgName-verify-gpg.XXX)
+repo=$tmpdir/repo
+trap "rm -rf $tmpdir" EXIT
+git clone --depth 1 --branch v${newVersion} -c advice.detachedHead=false https://github.com/$(getRepo) $repo
+export GNUPGHOME=$tmpdir
+# Fetch Nicolas Dorier's key (64-bit key ID: 6618763EF09186FE)
+gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys AB4CFA9895ACA0DBE27F6B346618763EF09186FE 2> /dev/null
+echo
+echo "Verifying commit"
+git -C $repo verify-commit HEAD
+rm -rf $repo/.git
+newHash=$(nix hash-path $repo)
+rm -rf $tmpdir
+echo
+
+# Update pkg version and hash
+echo "Updating $pkgName: $oldVersion -> $newVersion"
+if [[ $newVersion == $oldVersion ]]; then
+  # Temporarily set a source version that doesn't equal $newVersion so that $newHash
+  # is always updated in the next call to update-source-version.
+  (cd "$nixpkgs" && update-source-version "$pkgName" "0" "0000000000000000000000000000000000000000000000000000")
+fi
+(cd "$nixpkgs" && update-source-version "$pkgName" "$newVersion" "$newHash")
+echo
+
+# Create deps file
 storeSrc="$(nix-build "$nixpkgs" -A $pkgName.src --no-out-link)"
 . "$scriptDir"/create-deps.sh "$storeSrc" "$depsFile"

pkgs/applications/blockchains/turbo-geth.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "turbo-geth";
-  version = "2021.05.01";
+  version = "2021.05.02";
 
   src = fetchFromGitHub {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zvxtBK0/6fShxAZfU4gTV0XiP6TzhKFNsADSZA9gv0Y=";
+    sha256 = "sha256-7sTRAAlKZOdwi/LRbIEDKWpBe1ol8pZfEf2KIC4s0xk=";
   };
 
-  vendorSha256 = "0c8p6djs0zcci8sh4zgzky89155mr4cfqlax025618x8vngrsxf2";
+  vendorSha256 = "1d0ahdb2b5v8nxq3kdxw151phnyv6habb8kr8qjaq3kyhcnyk6ng";
   runVend = true;
 
   subPackages = [

pkgs/applications/editors/android-studio/common.nix

@@ -145,7 +145,7 @@ let
         ]}"
 
       # AS launches LLDBFrontend with a custom LD_LIBRARY_PATH
-      wrapProgram $out/bin/lldb/bin/LLDBFrontend --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [
+      wrapProgram $(find $out -name LLDBFrontend) --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [
         ncurses5
         zlib
       ]}"

pkgs/applications/editors/android-studio/default.nix

@@ -9,18 +9,18 @@ let
     inherit buildFHSUserEnv;
   };
   stableVersion = {
-    version = "4.1.3.0"; # "Android Studio 4.1.3"
-    build = "201.7199119";
-    sha256Hash = "06xwgk7bwcmljka8xa56cfwwg858r0bl0xp2jb9hdnkwljf796gm";
+    version = "4.2.1.0"; # "Android Studio 4.2.1"
+    build = "202.7351085";
+    sha256Hash = "074y6i0h8zamjgvvs882im44clds3g6aq8rssl7sq1wx6hrn5q36";
   };
   betaVersion = {
-    version = "4.2.0.22"; # "Android Studio 4.2 Beta 6"
-    build = "202.7188722";
-    sha256Hash = "0mzwkx1csx194wzg7dc1cii3c16wbmlbq1jdv9ly4nmdxlvc2rxb";
+    version = "4.2.0.24"; # "Android Studio 4.2.0"
+    build = "202.7322048";
+    sha256Hash = "1ii1zf8mv7xyql56wwkcdj5l4g3zaprdszv6r9md9r5zh78k4ccz";
   };
   latestVersion = { # canary & dev
-    version = "2020.3.1.10"; # "Android Studio Arctic Fox (2020.3.1) Canary 10"
-    sha256Hash = "15xxyjjjy5pnimc66dcwnqb7z4lq7ll4fl401a3br5ca4d1hpgsj";
+    version = "2020.3.1.15"; # "Android Studio Arctic Fox (2020.3.1) Canary 15"
+    sha256Hash = "0k66ibflqwdlgapir5w2v1d4zjwn6464yk2hvlmif9lsfdvd0ivv";
   };
 in {
   # Attributes are named by their corresponding release channels

pkgs/applications/editors/bless/default.nix

@@ -1,73 +1,58 @@
 { lib, stdenv
 , fetchFromGitHub
-, autoreconfHook
 , pkg-config
 , mono
+, meson
+, ninja
 , gtk-sharp-2_0
 , gettext
 , makeWrapper
 , glib
 , gtk2-x11
-, gnome2
+, libxslt
+, docbook_xsl
+, python3
 }:
 
 stdenv.mkDerivation rec {
   pname = "bless";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "afrantzis";
     repo = pname;
     rev = "v${version}";
-    sha256 = "04ra2mcx3pkhzbhcz0zwfmbpqj6cwisrypi6xbc2d6pxd4hdafn1";
+    hash = "sha256-rS+vJX0y9v1TiPsRfABroHiTuENQKEOxNsyKwagRuHM=";
   };
 
+  postPatch = ''
+    sed "s|get_option('tests')|false|g" -i meson.build
+    patchShebangs .
+  '';
+
   buildInputs = [
     gtk-sharp-2_0
     mono
     # runtime only deps
     glib
     gtk2-x11
-    gnome2.libglade
   ];
 
   nativeBuildInputs = [
     pkg-config
-    autoreconfHook
+    meson
+    ninja
     gettext
     makeWrapper
+    libxslt
+    docbook_xsl
+    python3
   ];
 
-  configureFlags = [
-    # scrollkeeper is a gnome2 package, so it must be old and we shouldn't really support it
-    # NOTE: that sadly doesn't turn off the compilation of the manual with scrollkeeper, so we have to fake the binaries below
-    "--without-scrollkeeper"
-  ];
-
-  autoreconfPhase = ''
-    mkdir _bin
-
-    # this fakes the scrollkeeper commands, to keep the build happy
-    for f in scrollkeeper-preinstall scrollkeeper-update; do
-      echo "true" > ./_bin/$f
-      chmod +x ./_bin/$f
-    done
-
-    export PATH="$PWD/_bin:$PATH"
-
-    # and it also wants to install that file
-    touch ./doc/user/bless-manual.omf
-
-    # patch mono path
-    sed "s|^mono|${mono}/bin/mono|g" -i src/bless-script.in
-
-    ./autogen.sh
-    '';
-
   preFixup = ''
-    MPATH="${gtk-sharp-2_0}/lib/mono/gtk-sharp-2.0:${glib.out}/lib:${gtk2-x11}/lib:${gnome2.libglade}/lib:${gtk-sharp-2_0}/lib"
-    wrapProgram $out/bin/bless --prefix MONO_PATH : "$MPATH" --prefix LD_LIBRARY_PATH : "$MPATH"
-    '';
+    MPATH="${gtk-sharp-2_0}/lib/mono/gtk-sharp-2.0:${glib.out}/lib:${gtk2-x11}/lib:${gtk-sharp-2_0}/lib"
+    wrapProgram $out/bin/bless --prefix MONO_PATH : "$MPATH" --prefix LD_LIBRARY_PATH : "$MPATH" --prefix PATH : ${lib.makeBinPath [ mono ]}
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/afrantzis/bless";

pkgs/applications/editors/ghostwriter/default.nix

@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "ghostwriter";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "wereturtle";
     repo = pname;
     rev = version;
-    sha256 = "sha256-5O2W7ZQeDkNzwi6t9MfNbv4fmNvak1AcMnzJTE1F9L8=";
+    sha256 = "sha256-bNVhYwX60F3lrP9UmZSntfz83vbmHe9tu/4nUgzUWR4=";
   };
 
   nativeBuildInputs = [ qmake pkg-config qttools ];

pkgs/applications/editors/vscode/vscodium.nix

@@ -13,10 +13,10 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1p68fvlr2fwrwr61gfrna3hjzgyazacr373hldbc4fxca3fdij76";
-    x86_64-darwin = "0wyihr2yfzjaypsa682zdklfxn3m7zca81brkzdvrndw24hdcl8m";
-    aarch64-linux = "0iw471n1fl8m2x06n2rdbkiwzhlc7lhk99vyql3z4fi0zyjy3pbn";
-    armv7l-linux = "0dx1icp245cfx3hkkpzzgfg9y8sv45llx35s03w1zzga2h2vhm3a";
+    x86_64-linux = "1gw2273ab0gdyav6mz7wk7d6g6cwcdvx0xaghvm610m1pvkbvxkz";
+    x86_64-darwin = "1zfzsr8gybmpmxc3jlfj6sx3m6ny6hc3dxvpgffni7k5zgv651df";
+    aarch64-linux = "079bp48h0qfpsbyir2qg3w1f43dc68ngmxqdqb3jnkx721affjzs";
+    armv7l-linux = "1d9243hk07xawv44909lk6y6bnvy0wjhy8xl13n3a11pg3djn5bm";
   }.${system};
 
   sourceRoot = {
@@ -33,7 +33,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.56.1";
+    version = "1.56.2";
     pname = "vscodium";
 
     executableName = "codium";

pkgs/applications/graphics/avocode/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "avocode";
-  version = "4.12.0";
+  version = "4.14.0";
 
   src = fetchurl {
     url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "sha256-qbG0Ii3Xmj1UGGS+n+LdiNPAHBkpQZMGEzrDvOcaUNA=";
+    sha256 = "sha256-BDW87UVN1Jub0sJFvtkZr5ssz835Yf2CNn5kHCn70cE=";
   };
 
   libPath = lib.makeLibraryPath (with xorg; [

pkgs/applications/graphics/emulsion/default.nix

@@ -37,16 +37,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "emulsion";
-  version = "8.0";
+  version = "9.0";
 
   src = fetchFromGitHub {
     owner = "ArturKovacs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xv3q59HobunrFyc+CPLztpsQd20Eu4+JI+iYhlGI0bc=";
+    sha256 = "sha256-Cdi+PQDHxMQG7t7iwDi6UWfDwQjjA2yiOf9p/ahBlOw=";
   };
 
-  cargoSha256 = "sha256-+jJMi3uBpvKYegURFyAV3TfP8eX4xRxgL4WGew7WMws=";
+  cargoSha256 = "sha256-2wiLamnGqACx1r4WJbWPCN3tvhww/rRWz8fcvAbjYE0=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/applications/graphics/fondo/default.nix

@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , nix-update-script
 , pantheon
@@ -57,18 +58,15 @@ stdenv.mkDerivation rec {
     patchShebangs meson/post_install.py
   '';
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = pname;
-    };
-  };
-
-
   meta = with lib; {
-    description = "Find the most beautiful wallpapers for your desktop";
     homepage = "https://github.com/calo001/fondo";
+    description = "Find the most beautiful wallpapers for your desktop";
     license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.linux;
   };
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
 }

pkgs/applications/graphics/gimp/plugins/default.nix

@@ -38,7 +38,7 @@ let
   }
   // attrs
   // {
-      name = "${gimp.name}-plugin-${name}";
+      name = "${gimp.pname}-plugin-${name}";
       buildInputs = [
         gimp
         gimp.gtk

pkgs/applications/misc/chrysalis/default.nix

@@ -1,16 +1,20 @@
-{ lib, appimageTools, fetchurl }:
+{ lib, appimageTools, fetchurl, gtk3, gsettings-desktop-schemas }:
 
 let
   pname = "chrysalis";
-  version = "0.7.9";
+  version = "0.8.4";
 in appimageTools.wrapType2 rec {
   name = "${pname}-${version}-binary";
 
   src = fetchurl {
-    url = "https://github.com/keyboardio/${pname}/releases/download/${pname}-${version}/${pname}-${version}.AppImage";
-    sha256 = "12w4vv7dwfpvxpc8kpfas90y7yy8mb8dj2096z3vw1bli5lrn3zi";
+    url = "https://github.com/keyboardio/${pname}/releases/download/v${version}/${pname}-${version}.AppImage";
+    sha256 = "b41f3e23dac855b1588cff141e3d317f96baff929a0543c79fccee0c6f095bc7";
   };
 
+  profile = ''
+    export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
+  '';
+
   multiPkgs = null;
   extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [
     p.glib

pkgs/applications/misc/curaengine/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "curaengine";
-  version = "4.9.0";
+  version = "4.9.1";
 
   src = fetchFromGitHub {
     owner = "Ultimaker";
     repo = "CuraEngine";
     rev = version;
-    sha256 = "0b82hwn7pb73h1azaandq93bkzlzskhgk71pwf4yws0j9bm6z084";
+    sha256 = "sha256-1hCjtnI1EnfyQ0QfU8qZoSLIjE5pyDYpu8H4J91cWYM=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/misc/dbeaver/default.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dbeaver";
-  version = "21.0.4"; # When updating also update fetchedMavenDeps.sha256
+  version = "21.0.5"; # When updating also update fetchedMavenDeps.sha256
 
   src = fetchFromGitHub {
     owner = "dbeaver";
     repo = "dbeaver";
     rev = version;
-    sha256 = "sha256-jV7Pe4MsLQnIrkDnlI2SrPzSjiDHM59GbMy4G7oeQK8=";
+    sha256 = "sha256-WMXhGXGHNjMJqob6A5S4+t9MDdJydAjdoY0u7T3ANbw=";
   };
 
   fetchedMavenDeps = stdenv.mkDerivation {

pkgs/applications/misc/keepassx/community.nix

@@ -23,6 +23,7 @@
 , qtsvg
 , qtx11extras
 , quazip
+, readline
 , wrapQtAppsHook
 , yubikey-personalization
 , zlib
@@ -51,13 +52,13 @@ stdenv.mkDerivation rec {
     sha256 = "02ajfkw818cmalvkl0kqvza85rgdgs59kw2v7b3c4v8kv00c41j3";
   };
 
-  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang [
+  NIX_CFLAGS_COMPILE = optionalString stdenv.cc.isClang [
     "-Wno-old-style-cast"
     "-Wno-error"
     "-D__BIG_ENDIAN__=${if stdenv.isBigEndian then "1" else "0"}"
   ];
 
-  NIX_LDFLAGS = lib.optionalString stdenv.isDarwin "-rpath ${libargon2}/lib";
+  NIX_LDFLAGS = optionalString stdenv.isDarwin "-rpath ${libargon2}/lib";
 
   patches = [
     ./darwin.patch
@@ -108,12 +109,14 @@ stdenv.mkDerivation rec {
     qtbase
     qtsvg
     qtx11extras
+    readline
     yubikey-personalization
     zlib
   ]
-  ++ lib.optional withKeePassKeeShareSecure quazip
-  ++ lib.optional stdenv.isDarwin qtmacextras
-  ++ lib.optional (stdenv.isDarwin && withKeePassTouchID) darwin.apple_sdk.frameworks.LocalAuthentication;
+  ++ optional withKeePassKeeShareSecure quazip
+  ++ optional stdenv.isDarwin qtmacextras
+  ++ optional (stdenv.isDarwin && withKeePassTouchID)
+    darwin.apple_sdk.frameworks.LocalAuthentication;
 
   preFixup = optionalString stdenv.isDarwin ''
     # Make it work without Qt in PATH.
@@ -123,8 +126,14 @@ stdenv.mkDerivation rec {
   passthru.tests = nixosTests.keepassxc;
 
   meta = {
-    description = "Password manager to store your passwords safely and auto-type them into your everyday websites and applications";
-    longDescription = "A community fork of KeePassX, which is itself a port of KeePass Password Safe. The goal is to extend and improve KeePassX with new features and bugfixes to provide a feature-rich, fully cross-platform and modern open-source password manager. Accessible via native cross-platform GUI, CLI, and browser integration with the KeePassXC Browser Extension (https://github.com/keepassxreboot/keepassxc-browser).";
+    description = "Offline password manager with many features.";
+    longDescription = ''
+      A community fork of KeePassX, which is itself a port of KeePass Password Safe.
+      The goal is to extend and improve KeePassX with new features and bugfixes,
+      to provide a feature-rich, fully cross-platform and modern open-source password manager.
+      Accessible via native cross-platform GUI, CLI, has browser integration
+      using the KeePassXC Browser Extension (https://github.com/keepassxreboot/keepassxc-browser)
+    '';
     homepage = "https://keepassxc.org/";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ jonafato turion ];

pkgs/applications/misc/makeself/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, which }:
+{ lib, stdenv, fetchFromGitHub, which, zstd, pbzip2 }:
 
 stdenv.mkDerivation rec {
   version = "2.4.2";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
   checkTarget = "test";
-  checkInputs = [ which ];
+  checkInputs = [ which zstd pbzip2 ];
 
   installPhase = ''
     mkdir -p $out/{bin,share/{${pname}-${version},man/man1}}

pkgs/applications/misc/notejot/default.nix

@@ -1,15 +1,30 @@
-{ lib, stdenv, fetchFromGitHub, nix-update-script, vala, pkg-config, meson, ninja, python3, pantheon
-, gtk3, gtksourceview, json-glib, libgee, wrapGAppsHook }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, gtk4
+, gtksourceview
+, json-glib
+, libadwaita
+, libgee
+, meson
+, ninja
+, nix-update-script
+, pantheon
+, pkg-config
+, python3
+, vala
+, wrapGAppsHook
+}:
 
 stdenv.mkDerivation rec {
   pname = "notejot";
-  version = "1.6.3";
+  version = "3.0.4";
 
   src = fetchFromGitHub {
     owner = "lainsce";
     repo = pname;
     rev = version;
-    sha256 = "170dzgd6cnf2k3hfifjysmdggpskx6v1pjmblqgbwaj2d3snf3h8";
+    hash = "sha256-p8rca3PsnT/3Lp6W30VvqR9aPr6EIuNrH5gsxL0lZ0Q=";
   };
 
   nativeBuildInputs = [
@@ -20,31 +35,30 @@ stdenv.mkDerivation rec {
     python3
     wrapGAppsHook
   ];
-
   buildInputs = [
-    gtk3
+    gtk4
     gtksourceview
     json-glib
+    libadwaita
     libgee
     pantheon.elementary-icon-theme
     pantheon.granite
   ];
 
   postPatch = ''
-    patchShebangs meson/post_install.py
+    chmod +x build-aux/post_install.py
+    patchShebangs build-aux/post_install.py
   '';
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = pname;
-    };
-  };
-
   meta = with lib; {
-    description = "Stupidly-simple sticky notes applet";
     homepage = "https://github.com/lainsce/notejot";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ ];
+    description = "Stupidly-simple sticky notes applet";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.linux;
   };
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
 }

pkgs/applications/misc/openbox-menu/default.nix

@@ -22,6 +22,13 @@ stdenv.mkDerivation rec {
   # Enables SVG support by uncommenting the Makefile
   patches = [ ./000-enable-svg.patch ];
 
+  # The strip options are not recognized by Darwin.
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    sed -i -e '/strip -s/d' Makefile
+  '';
+
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+
   installFlags = [ "prefix=${placeholder "out"}" ];
 
   meta = with lib; {

pkgs/applications/misc/sc-im/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , makeWrapper
 , pkg-config
 , which
@@ -16,29 +15,17 @@
 
 stdenv.mkDerivation rec {
   pname = "sc-im";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "andmarti1424";
     repo = "sc-im";
     rev = "v${version}";
-    sha256 = "sha256-AIYa3d1ml1f5GNLKijeFPX+UabgEqzdXiP60BGvBPsQ=";
+    sha256 = "sha256-H+GQUpouiXc/w6GWdkSVvTXZ/Dtb7sUmBLGcpxG3Mts=";
   };
 
   sourceRoot = "${src.name}/src";
 
-  patches = [
-    # libxls and libxlsxwriter are not found without the patch
-    # https://github.com/andmarti1424/sc-im/pull/542
-    (fetchpatch {
-      name = "use-pkg-config-for-libxls-and-libxlsxwriter.patch";
-      url = "https://github.com/andmarti1424/sc-im/commit/b62dc25eb808e18a8ab7ee7d8eb290e34efeb075.patch";
-      sha256 = "1yn32ps74ngzg3rbkqf8dn0g19jv4xhxrfgx9agnywf0x8gbwjh3";
-    })
-  ];
-
-  patchFlags = [ "-p2" ];
-
   nativeBuildInputs = [
     makeWrapper
     pkg-config

pkgs/applications/misc/slade/git.nix

@@ -1,18 +1,36 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, wxGTK, gtk2, sfml, fluidsynth, curl, freeimage, ftgl, glew, zip }:
+{ lib, stdenv, fetchFromGitHub
+, cmake
+, pkg-config
+, wxGTK
+, sfml
+, fluidsynth
+, curl
+, freeimage
+, ftgl
+, glew
+, zip
+, lua
+, fmt
+, mpg123
+}:
 
 stdenv.mkDerivation {
-  name = "slade-git-3.1.2.2018.01.29";
+  name = "slade-git-3.2.0.2021.05.13";
 
   src = fetchFromGitHub {
     owner = "sirjuddington";
     repo = "SLADE";
-    rev = "f7409c504b40c4962f419038db934c32688ddd2e";
-    sha256 = "14icxiy0r9rlcc10skqs1ylnxm1f0f3irhzfmx4sazq0pjv5ivld";
+    rev = "d2e249c89062a44c912a9b86951526edc8735ba0";
+    sha256 = "08dsvx7m7c97jm8fxzivmi1fr47hj53y0lv57clqc35bh2gi62dg";
   };
 
-  cmakeFlags = ["-DNO_WEBVIEW=1"];
+  cmakeFlags = [
+    "-DwxWidgets_CONFIG_EXECUTABLE=${wxGTK}/bin/wx-config"
+    "-DWX_GTK3=OFF"
+    "-DNO_WEBVIEW=1"
+  ];
   nativeBuildInputs = [ cmake pkg-config zip ];
-  buildInputs = [ wxGTK gtk2 sfml fluidsynth curl freeimage ftgl glew ];
+  buildInputs = [ wxGTK wxGTK.gtk sfml fluidsynth curl freeimage ftgl glew lua fmt mpg123 ];
 
   meta = with lib; {
     description = "Doom editor";

pkgs/applications/misc/zettlr/default.nix

@@ -10,11 +10,11 @@
 # Based on https://gist.github.com/msteen/96cb7df66a359b827497c5269ccbbf94 and joplin-desktop nixpkgs.
 let
   pname = "zettlr";
-  version = "1.8.7";
+  version = "1.8.9";
   name = "${pname}-${version}";
   src = fetchurl {
     url = "https://github.com/Zettlr/Zettlr/releases/download/v${version}/Zettlr-${version}-x86_64.appimage";
-    sha256 = "0zbmlk5qk92b3zycs0bmdwgc8fn4a4dv1yvq9q8q2wxz4ammx6c0";
+    sha256 = "sha256-1cU9HdPXrJ4ibSjOitO8iJfMIaGub/jjlb2lssYFfcU=";
   };
   appimageContents = appimageTools.extractType2 {
     inherit name src;

pkgs/applications/networking/appgate-sdp/default.nix

@@ -33,6 +33,7 @@
 , libXrandr
 , libXrender
 , libXtst
+, libxkbcommon
 , libsecret
 , libuuid
 , libxcb
@@ -81,6 +82,7 @@ let
     libXrandr
     libXrender
     libXtst
+    libxkbcommon
     libsecret
     libuuid
     libxcb
@@ -97,11 +99,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "appgate-sdp";
-  version = "5.3.3";
+  version = "5.4.0";
 
   src = fetchurl {
     url = "https://bin.appgate-sdp.com/${lib.versions.majorMinor version}/client/appgate-sdp_${version}_amd64.deb";
-    sha256 = "1854m93mr2crg68zhh1pgwwis0dqdv0778wqrb8dz9sdz940rza8";
+    sha256 = "sha256-2DzZ5JnFGBeaHtDf7CAXb/qv6kVI+sYMW5Nc25E3eNA=";
   };
 
   dontConfigure = true;
@@ -170,9 +172,14 @@ stdenv.mkDerivation rec {
       patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" --set-rpath "$ORIGIN:$out/opt/appgate/service/:$out/opt/appgate/:${rpath}" $binary
     done
 
+    # fail if there are missing dependencies
+    ldd $out/opt/appgate/appgate | grep -i 'not found' && exit 1
+    ldd $out/opt/appgate/service/appgateservice.bin | grep -i 'not found' && exit 1
+    ldd $out/opt/appgate/appgate-driver | grep -i 'not found' && exit 1
+
     wrapProgram $out/opt/appgate/appgate-driver --prefix PATH : ${lib.makeBinPath [ iproute2 networkmanager dnsmasq ]}
     wrapProgram $out/opt/appgate/linux/set_dns --set PYTHONPATH $PYTHONPATH
-    wrapProgram $out/bin/appgate --prefix PATH : ${xdg-utils}/bin
+    wrapProgram $out/bin/appgate --prefix PATH : ${lib.makeBinPath [ xdg-utils ]}
   '';
   meta = with lib; {
     description = "Appgate SDP (Software Defined Perimeter) desktop client";

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, zlib, libX11, libXext, libSM, libICE, libxkbcommon, libxshmfence
 , libXfixes, libXt, libXi, libXcursor, libXScrnSaver, libXcomposite, libXdamage, libXtst, libXrandr
-, alsaLib, dbus, cups, libexif, ffmpeg_3, systemd
+, alsaLib, dbus, cups, libexif, ffmpeg, systemd
 , freetype, fontconfig, libXft, libXrender, libxcb, expat
 , libuuid
 , libxml2
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
   buildInputs = [
     stdenv.cc.cc stdenv.cc.libc zlib libX11 libXt libXext libSM libICE libxcb libxkbcommon libxshmfence
     libXi libXft libXcursor libXfixes libXScrnSaver libXcomposite libXdamage libXtst libXrandr
-    atk at-spi2-atk at-spi2-core alsaLib dbus cups gtk3 gdk-pixbuf libexif ffmpeg_3 systemd
+    atk at-spi2-atk at-spi2-core alsaLib dbus cups gtk3 gdk-pixbuf libexif ffmpeg systemd
     freetype fontconfig libXrender libuuid expat glib nss nspr
     libxml2 pango cairo gnome2.GConf
     libdrm mesa

pkgs/applications/networking/cluster/fluxcd/default.nix

@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
 
 let
-  version = "0.13.3";
+  version = "0.13.4";
 
   manifests = fetchzip {
     url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";
@@ -19,10 +19,10 @@ buildGoModule rec {
     owner = "fluxcd";
     repo = "flux2";
     rev = "v${version}";
-    sha256 = "sha256-RaQOefVqDPHvTF1qMtgAFNpA1Gx7Vo2JKiwteePsGyo=";
+    sha256 = "sha256-edyqxVl8oIwKp/eqFIbu+qn9zhYEnKJKwUbYZ7uxx0I=";
   };
 
-  vendorSha256 = "sha256-GR40BgNMHi3TXVQVN1FaPNVi0HXYVm3vbg4NTXfYBes=";
+  vendorSha256 = "sha256-keIzuqaLppu6+XK3MFiU0en+SVxWVLpfkKEKOAVOz7k=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/networking/cluster/hadoop/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, makeWrapper, pkg-config, which, maven, cmake, jre, jdk8, bash
-, coreutils, glibc, protobuf2_5, fuse, snappy, zlib, bzip2, openssl, openssl_1_0_2
+, coreutils, glibc, protobuf2_5, fuse, snappy, zlib, bzip2, openssl, openssl_1_0_2, fetchpatch, libtirpc
 }:
 
 let
@@ -38,8 +38,19 @@ let
         };
 
         nativeBuildInputs = [ maven cmake pkg-config ];
-        buildInputs = [ fuse snappy zlib bzip2 opensslPkg protobuf2_5 ];
+        buildInputs = [ fuse snappy zlib bzip2 opensslPkg protobuf2_5 libtirpc ];
+        NIX_CFLAGS_COMPILE = [ "-I${libtirpc.dev}/include/tirpc" ];
+        NIX_LDFLAGS = [ "-ltirpc" ];
+
         # most of the hardcoded pathes are fixed in 2.9.x and 3.0.0, this list of patched files might be reduced when 2.7.x and 2.8.x will be deprecated
+
+        patches = [
+          (fetchpatch {
+            url = "https://patch-diff.githubusercontent.com/raw/apache/hadoop/pull/2886.patch";
+            sha256 = "1fim1d8va050za5i8a6slphmx015fzvhxkc2wi4rwg7kbj31sv0r";
+          })
+        ];
+
         postPatch = ''
           for file in hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/HardLink.java \
                       hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/util/Shell.java \

pkgs/applications/networking/cluster/helmfile/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "helmfile";
-  version = "0.139.0";
+  version = "0.139.3";
 
   src = fetchFromGitHub {
     owner = "roboll";
     repo = "helmfile";
     rev = "v${version}";
-    sha256 = "sha256-bwhiua+KQdt9fyvM4TeS6Mm7EQB9K2L04FPhGS380xI=";
+    sha256 = "sha256-Cg4FFTowrWMDfpaMJwrOSs3ykZxH378OMR+1+vJt5e8=";
   };
 
-  vendorSha256 = "sha256-Qpou4e1My/obIHL/4/IEUml0F82atIwPGZX5+vpvk0k=";
+  vendorSha256 = "sha256-Hs09CT/KSwYL2AKLseOjWB5Xvvr5TvbzwDywsGQ9kMw=";
 
   doCheck = false;
 

pkgs/applications/networking/cluster/helmsman/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helmsman";
-  version = "3.6.7";
+  version = "3.6.10";
 
   src = fetchFromGitHub {
     owner = "Praqma";
     repo = "helmsman";
     rev = "v${version}";
-    sha256 = "sha256-6w2CV6Uj1b8b3vwB933eNHPe1rK+TRyUL++Vy38cKqo=";
+    sha256 = "sha256-0Epff1NYfZXza27/5RBuICIj2455K31BGFr6PMLkNVE=";
   };
 
   vendorSha256 = "sha256-icX8mOc8g+DhfAjD1pzneLWTXY17lXyAjdPOWAxkHwI=";

pkgs/applications/networking/cluster/hetzner-kube/default.nix

@@ -11,6 +11,13 @@ buildGoModule rec {
     sha256 = "1iqgpmljqx6rhmvsir2675waj78amcfiw08knwvlmavjgpxx2ysw";
   };
 
+  patches = [
+    # Use $HOME instead of the OS user database.
+    # Upstream PR: https://github.com/xetys/hetzner-kube/pull/346
+    # Unfortunately, the PR patch does not apply against release.
+    ./fix-home.patch
+  ];
+
   vendorSha256 = "1jh2f66ys6rmrrwrf5zqfprgcvziyq6l4z8bfqwxgf1ysnxx525h";
 
   doCheck = false;
@@ -25,6 +32,8 @@ buildGoModule rec {
   ];
 
   postInstall = ''
+    # Need a writable home, because it fails if unable to write config.
+    export HOME=$TMP
     $out/bin/hetzner-kube completion bash > hetzner-kube
     $out/bin/hetzner-kube completion zsh > _hetzner-kube
     installShellCompletion --zsh _hetzner-kube

pkgs/applications/networking/cluster/hetzner-kube/fix-home.patch

@@ -0,0 +1,53 @@
+diff --git a/cmd/cluster_kubeconfig.go b/cmd/cluster_kubeconfig.go
+index 54cc0c9..fab288a 100644
+--- a/cmd/cluster_kubeconfig.go
++++ b/cmd/cluster_kubeconfig.go
+@@ -6,7 +6,7 @@ import (
+ 	"io/ioutil"
+ 	"log"
+ 	"os"
+-	"os/user"
++	"path/filepath"
+ 	"strings"
+ 
+ 	"github.com/spf13/cobra"
+@@ -52,9 +52,8 @@ Example 4: hetzner-kube cluster kubeconfig -n my-cluster -p > my-conf.yaml # pri
+ 		} else {
+ 			fmt.Println("create file")
+ 
+-			usr, _ := user.Current()
+-			dir := usr.HomeDir
+-			path := fmt.Sprintf("%s/.kube", dir)
++			dir, _ := os.UserHomeDir()
++			path := filepath.Join(dir, ".kube")
+ 
+ 			if _, err := os.Stat(path); os.IsNotExist(err) {
+ 				os.MkdirAll(path, 0755)
+diff --git a/cmd/config.go b/cmd/config.go
+index ce0f3e5..a03c4ba 100644
+--- a/cmd/config.go
++++ b/cmd/config.go
+@@ -8,7 +8,6 @@ import (
+ 	"io/ioutil"
+ 	"log"
+ 	"os"
+-	"os/user"
+ 	"path/filepath"
+ 
+ 	"github.com/hetznercloud/hcloud-go/hcloud"
+@@ -28,13 +27,8 @@ type AppSSHClient struct {
+ // NewAppConfig creates a new AppConfig struct using the locally saved configuration file. If no local
+ // configuration file is found a new config will be created.
+ func NewAppConfig() AppConfig {
+-	usr, err := user.Current()
+-	if err != nil {
+-		return AppConfig{}
+-	}
+-	if usr.HomeDir != "" {
+-		DefaultConfigPath = filepath.Join(usr.HomeDir, ".hetzner-kube")
+-	}
++	dir, _ := os.UserHomeDir()
++	DefaultConfigPath = filepath.Join(dir, ".hetzner-kube")
+ 
+ 	appConf := AppConfig{
+ 		Context: context.Background(),

pkgs/applications/networking/cluster/kubecfg/default.nix

@@ -1,6 +1,6 @@
 { lib, buildGoPackage, fetchFromGitHub, ... }:
 
-let version = "0.19.1"; in
+let version = "0.20.0"; in
 
 buildGoPackage {
   pname = "kubecfg";
@@ -10,7 +10,7 @@ buildGoPackage {
     owner = "bitnami";
     repo = "kubecfg";
     rev = "v${version}";
-    sha256 = "sha256-makRYWBtOjvuv7dAY1vNh1Nxv+nETVlaFh1C3oiojUo=";
+    sha256 = "sha256-7lBIqaozVBoiYYOTqAxq9h2N+Y3JFwLaunCykILOmPU=";
   };
 
   goPackagePath = "github.com/bitnami/kubecfg";

pkgs/applications/networking/cluster/kubetail/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kubetail";
-  version = "1.6.12";
+  version = "1.6.13";
 
   src = fetchFromGitHub {
     owner = "johanhaleby";
     repo = "kubetail";
     rev = version;
-    sha256 = "0hayfd7yvdhd2klfmhvl04hfqk0nfsimjyg3kbq8c5dbgbpz05nd";
+    sha256 = "sha256-EkOewNInzEEEgMOffYoRaKwhgYuBXgHaCkVgWg2mIDE=";
   };
 
   installPhase = ''

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -436,6 +436,15 @@
     "sha256": "0jhx9rap4128j8sfkvpp8lbdmvdba0rkd3nxvy38wr3n18m7v1xg",
     "version": "1.2.0"
   },
+  "hydra": {
+    "owner": "DeterminateSystems",
+    "provider-source-address": "registry.terraform.io/DeterminateSystems/hydra",
+    "repo": "terraform-provider-hydra",
+    "rev": "v0.1.0",
+    "sha256": "18c9j54fy1f2sfz317rlv8z7fb18bpc1a0baw1bgl72x5sgil5kv",
+    "vendorSha256": null,
+    "version": "0.1.0"
+  },
   "ibm": {
     "owner": "IBM-Cloud",
     "provider-source-address": "registry.terraform.io/IBM-Cloud/ibm",

pkgs/applications/networking/cluster/waypoint/default.nix

@@ -1,20 +1,20 @@
-{ lib, buildGoModule, fetchFromGitHub, go-bindata }:
+{ lib, buildGoModule, fetchFromGitHub, go-bindata, installShellFiles }:
 
 buildGoModule rec {
   pname = "waypoint";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WzKUVfc7oGMh0TamL5b6gsm/BAfSCZ6EB3Hg4Tg/3Hw=";
+    sha256 = "sha256-57DHImPYVFK+MXWGeArvc5fwHmqa3zodLytfDoAxglo=";
   };
 
   deleteVendor = true;
-  vendorSha256 = "sha256-VxKUYD92DssoSjWxR+1gZLq34vCVM/4U2ju5felLWzI=";
+  vendorSha256 = "sha256-HxrY35SqfUbT6VCCXkLUjAsxgtMzpOeoicAGLwD2OyA=";
 
-  nativeBuildInputs = [ go-bindata ];
+  nativeBuildInputs = [ go-bindata installShellFiles ];
 
   # GIT_{COMMIT,DIRTY} filled in blank to prevent trying to run git and ending up blank anyway
   buildPhase = ''
@@ -23,9 +23,29 @@ buildGoModule rec {
     runHook postBuild
   '';
 
+  doCheck = false;
+
   installPhase = ''
     runHook preInstall
+
+    local INSTALL="$out/bin/waypoint"
     install -D waypoint $out/bin/waypoint
+
+    # Write to a file as it doesn't like EOF within <()
+    cat > waypoint.fish <<EOF
+    function __complete_waypoint
+      set -lx COMP_LINE (commandline -cp)
+      test -z (commandline -ct)
+      and set COMP_LINE "$COMP_LINE "
+      $INSTALL
+    end
+    complete -f -c waypoint -a "(__complete_waypoint)"
+    EOF
+    installShellCompletion --cmd waypoint \
+      --bash <(echo "complete -C $INSTALL waypoint") \
+      --fish <(cat waypoint.fish) \
+      --zsh <(echo "complete -o nospace -C $INSTALL waypoint")
+
     runHook postInstall
   '';
 

pkgs/applications/networking/ftp/taxi/default.nix

@@ -1,33 +1,48 @@
-{ lib, stdenv, fetchFromGitHub, nix-update-script, pantheon, pkg-config, meson, ninja, python3, vala
-, gtk3, libgee, libsoup, libsecret, gobject-introspection, wrapGAppsHook }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, gobject-introspection
+, gtk3
+, libgee
+, libsecret
+, libsoup
+, meson
+, ninja
+, nix-update-script
+, pantheon
+, pkg-config
+, python3
+, vala
+, wrapGAppsHook
+}:
 
 stdenv.mkDerivation rec {
   pname = "taxi";
-  version = "0.0.1";
+  version = "0.0.1-unstable=2020-09-03";
 
   src = fetchFromGitHub {
     owner = "Alecaddd";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "01c552w68576pnsyqbwy3hjhbww6vys3r3s0wxjdiscjqj1aawqg";
+    rev = "74aade67fd9ba9e5bc10c950ccd8d7e48adc2ea1";
+    sha256 = "sha256-S/FeKJxIdA30CpfFVrQsALdq7Gy4F4+P50Ky5tmqKvM=";
   };
 
   nativeBuildInputs = [
-    vala
     gobject-introspection
     meson
     ninja
     pkg-config
     python3
+    vala
     wrapGAppsHook
   ];
 
   buildInputs = [
-    pantheon.granite
-    libgee
     gtk3
+    libgee
     libsecret
     libsoup
+    pantheon.granite
   ];
 
   postPatch = ''
@@ -35,17 +50,15 @@ stdenv.mkDerivation rec {
     patchShebangs meson/post_install.py
   '';
 
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = pname;
-    };
+  meta = with lib; {
+    homepage = "https://github.com/Alecaddd/taxi";
+    description = "The FTP Client that drives you anywhere";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = platforms.linux;
   };
 
-  meta = with lib; {
-    description = "The FTP Client that drives you anywhere";
-    homepage    = "https://github.com/Alecaddd/taxi";
-    license     = licenses.gpl3Plus;
-    maintainers = with maintainers; [ ];
-    platforms   = platforms.linux;
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
   };
 }

pkgs/applications/networking/instant-messengers/baresip/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, zlib, openssl, libre, librem, pkg-config, gst_all_1
-, cairo, mpg123, alsaLib, SDL, libv4l, celt, libsndfile, srtp, ffmpeg_3
+, cairo, mpg123, alsaLib, SDL, libv4l, celt, libsndfile, srtp, ffmpeg
 , gsm, speex, portaudio, spandsp, libuuid, libvpx
 }:
 stdenv.mkDerivation rec {
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [zlib openssl libre librem cairo mpg123
-    alsaLib SDL libv4l celt libsndfile srtp ffmpeg_3 gsm speex portaudio spandsp libuuid
+    alsaLib SDL libv4l celt libsndfile srtp ffmpeg gsm speex portaudio spandsp libuuid
     libvpx
   ] ++ (with gst_all_1; [ gstreamer gst-libav gst-plugins-base gst-plugins-bad gst-plugins-good ]);
   makeFlags = [

pkgs/applications/networking/instant-messengers/element/element-desktop-package.json

@@ -2,7 +2,7 @@
   "name": "element-desktop",
   "productName": "Element",
   "main": "src/electron-main.js",
-  "version": "1.7.27",
+  "version": "1.7.28",
   "description": "A feature-rich client for Matrix.org",
   "author": "Element",
   "repository": {

pkgs/applications/networking/instant-messengers/element/element-desktop.nix

@@ -8,12 +8,12 @@
 
 let
   executableName = "element-desktop";
-  version = "1.7.27";
+  version = "1.7.28";
   src = fetchFromGitHub {
     owner = "vector-im";
     repo = "element-desktop";
     rev = "v${version}";
-    sha256 = "0rgsc2cc1v6gjsklwvsjlqq9a8j9j80h9ac0jkvf9lhq33f3c57k";
+    sha256 = "0p88gw1y37q35qqf94w3qlb84s2shm41n1pw5fgx0c0ymlzpl636";
   };
 in mkYarnPackage rec {
   name = "element-desktop-${version}";

pkgs/applications/networking/instant-messengers/element/element-web.nix

@@ -12,11 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "element-web";
-  version = "1.7.27";
+  version = "1.7.28";
 
   src = fetchurl {
     url = "https://github.com/vector-im/element-web/releases/download/v${version}/element-v${version}.tar.gz";
-    sha256 = "004b1cjw8fqk0ixm0wnbk4y51cby1i7avsas95sfm2zsbnbwg519";
+    sha256 = "1adlpwq37yzmd3fq1pzbi476p4kr5hn5b5kwyd6cr5by0gsgkgyk";
   };
 
   installPhase = ''

pkgs/applications/networking/instant-messengers/psi-plus/default.nix

@@ -1,18 +1,19 @@
-{ mkDerivation, lib, fetchFromGitHub, cmake
+{ lib, mkDerivation, fetchFromGitHub, cmake
 , qtbase, qtmultimedia, qtx11extras, qttools, qtwebengine
-, libidn, qca-qt5, libsecret, libXScrnSaver, hunspell
-, libgcrypt, libotr, html-tidy, libgpgerror, libsignal-protocol-c
+, libidn, qca-qt5, libXScrnSaver, hunspell
+, libsecret, libgcrypt, libotr, html-tidy, libgpgerror, libsignal-protocol-c
+, usrsctp
 }:
 
 mkDerivation rec {
   pname = "psi-plus";
-  version = "1.4.1473";
+  version = "1.5.1520";
 
   src = fetchFromGitHub {
     owner = "psi-plus";
     repo = "psi-plus-snapshots";
     rev = version;
-    sha256 = "03f28zwbjn6fnsm0fqg8lmc11rpfdfvzjf7k7xydc3lzy8pxbds5";
+    sha256 = "0cj811qv0n8xck2qrnps2ybzrpvyjqz7nxkyccpaivq6zxj6mc12";
   };
 
   cmakeFlags = [
@@ -23,15 +24,16 @@ mkDerivation rec {
 
   buildInputs = [
     qtbase qtmultimedia qtx11extras qtwebengine
-    libidn qca-qt5 libsecret libXScrnSaver hunspell
-    libgcrypt libotr html-tidy libgpgerror libsignal-protocol-c
+    libidn qca-qt5 libXScrnSaver hunspell
+    libsecret libgcrypt libotr html-tidy libgpgerror libsignal-protocol-c
+    usrsctp
   ];
 
   meta = with lib; {
-    homepage = "https://sourceforge.net/projects/psiplus/";
+    homepage = "https://psi-plus.com";
     description = "XMPP (Jabber) client";
     maintainers = with maintainers; [ orivej misuzu ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.linux;
   };
 }

pkgs/applications/networking/instant-messengers/signal-desktop/db-reencryption-wrapper.py

@@ -0,0 +1,92 @@
+#!@PYTHON@
+
+import json
+import os
+import re
+import shlex
+import sqlite3
+import subprocess
+import sys
+
+
+DB_PATH = os.path.join(os.environ['HOME'], '.config/Signal/sql/db.sqlite')
+DB_COPY = os.path.join(os.environ['HOME'], '.config/Signal/sql/db.tmp')
+CONFIG_PATH = os.path.join(os.environ['HOME'], '.config/Signal/config.json')
+
+
+def zenity_askyesno(title, text):
+    args = [
+        '@ZENITY@',
+        '--question',
+        '--title',
+        shlex.quote(title),
+        '--text',
+        shlex.quote(text)
+    ]
+    return subprocess.run(args).returncode == 0
+
+
+def start_signal():
+    os.execvp('@SIGNAL-DESKTOP@', ['@SIGNAL-DESKTOP@'] + sys.argv[1:])
+
+
+def copy_pragma(name):
+    result = subprocess.run([
+        '@SQLCIPHER@',
+        DB_PATH,
+        f"PRAGMA {name};"
+    ], check=True, capture_output=True).stdout
+    result = re.search(r'[0-9]+', result.decode()).group(0)
+    subprocess.run([
+        '@SQLCIPHER@',
+        DB_COPY,
+        f"PRAGMA key = \"x'{key}'\"; PRAGMA {name} = {result};"
+    ], check=True, capture_output=True)
+
+
+try:
+    # Test if DB is encrypted:
+    con = sqlite3.connect(f'file:{DB_PATH}?mode=ro', uri=True)
+    cursor = con.cursor()
+    cursor.execute("SELECT name FROM sqlite_master WHERE type='table';")
+    con.close()
+except:
+    # DB is encrypted, everything ok:
+    start_signal()
+
+
+# DB is unencrypted!
+answer = zenity_askyesno(
+        "Error: Signal-Desktop database is not encrypted",
+        "Should we try to fix this automatically?"
+        + "You likely want to backup ~/.config/Signal/ first."
+)
+if not answer:
+    answer = zenity_askyesno(
+            "Launch Signal-Desktop",
+            "DB is unencrypted, should we still launch Signal-Desktop?"
+            + "Warning: This could result in data loss!"
+    )
+    if not answer:
+        print('Aborted')
+        sys.exit(0)
+    start_signal()
+
+# Re-encrypt the DB:
+with open(CONFIG_PATH) as json_file:
+    key = json.load(json_file)['key']
+result = subprocess.run([
+    '@SQLCIPHER@',
+    DB_PATH,
+    f" ATTACH DATABASE '{DB_COPY}' AS signal_db KEY \"x'{key}'\";"
+    + " SELECT sqlcipher_export('signal_db');"
+    + " DETACH DATABASE signal_db;"
+]).returncode
+if result != 0:
+    print('DB encryption failed')
+    sys.exit(1)
+# Need to copy user_version and schema_version manually:
+copy_pragma('user_version')
+copy_pragma('schema_version')
+os.rename(DB_COPY, DB_PATH)
+start_signal()

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -10,6 +10,9 @@
 , hunspellDicts, spellcheckerLanguage ? null # E.g. "de_DE"
 # For a full list of available languages:
 # $ cat pkgs/development/libraries/hunspell/dictionaries.nix | grep "dictFileName =" | awk '{ print $3 }'
+, python3
+, gnome
+, sqlcipher
 }:
 
 let
@@ -112,14 +115,20 @@ in stdenv.mkDerivation rec {
 
     # Symlink to bin
     mkdir -p $out/bin
-    ln -s $out/lib/Signal/signal-desktop $out/bin/signal-desktop
+    ln -s $out/lib/Signal/signal-desktop $out/bin/signal-desktop-unwrapped
 
     runHook postInstall
   '';
 
+  # Required for $SQLCIPHER_LIB which contains "/build/" inside the path:
+  noAuditTmpdir = true;
+
   preFixup = ''
+    export SQLCIPHER_LIB="$out/lib/Signal/resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node"
+    test -x "$SQLCIPHER_LIB" # To ensure the location hasn't changed
     gappsWrapperArgs+=(
       --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ] }"
+      --prefix LD_PRELOAD : "$SQLCIPHER_LIB"
       ${customLanguageWrapperArgs}
     )
 
@@ -131,6 +140,16 @@ in stdenv.mkDerivation rec {
     patchelf --add-needed ${libpulseaudio}/lib/libpulse.so $out/lib/Signal/resources/app.asar.unpacked/node_modules/ringrtc/build/linux/libringrtc.node
   '';
 
+  postFixup = ''
+    # This hack is temporarily required to avoid data-loss for users:
+    cp ${./db-reencryption-wrapper.py} $out/bin/signal-desktop
+    substituteInPlace $out/bin/signal-desktop \
+      --replace '@PYTHON@' '${python3}/bin/python3' \
+      --replace '@ZENITY@' '${gnome.zenity}/bin/zenity' \
+      --replace '@SQLCIPHER@' '${sqlcipher}/bin/sqlcipher' \
+      --replace '@SIGNAL-DESKTOP@' "$out/bin/signal-desktop-unwrapped"
+  '';
+
   # Tests if the application launches and waits for "Link your phone to Signal Desktop":
   passthru.tests.application-launch = nixosTests.signal-desktop;
 

pkgs/applications/networking/mullvad-vpn/default.nix

@@ -42,11 +42,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "mullvad-vpn";
-  version = "2021.2";
+  version = "2021.3";
 
   src = fetchurl {
     url = "https://github.com/mullvad/mullvadvpn-app/releases/download/${version}/MullvadVPN-${version}_amd64.deb";
-    sha256 = "sha256-nNZK11MckiQ+z8NDgDc7aJ6yrXWI1hPOvMZkrGwDDgU=";
+    sha256 = "sha256-f7ZCDZ/RN+Z0Szmnx8mbzhKZiRPjqXTsgClfWViFYzo=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/nextdns/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "nextdns";
-  version = "1.10.1";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "nextdns";
     repo = "nextdns";
     rev = "v${version}";
-    sha256 = "sha256-hMI6zq176p7MI4cjMSeQ8T8UvibJW60lzsPmeAOi3ow=";
+    sha256 = "sha256-gnWFgzfMMnn8O7zDN5LW3cMIz5/wmgEW9fI9aJBEah8=";
   };
 
   vendorSha256 = "sha256-kmszMqkDMaL+Z6GcZmQyeRShKKS/VGdn9vabYPW/kCc=";

pkgs/applications/networking/remote/rdesktop/default.nix

@@ -1,4 +1,5 @@
-{lib, stdenv, fetchFromGitHub, openssl, libX11, krb5, libXcursor, libtasn1, nettle, gnutls, pkg-config, autoreconfHook
+{ lib, stdenv, fetchFromGitHub, openssl, libX11, krb5, libXcursor, libtasn1
+, nettle, gnutls, pkg-config, autoreconfHook, libiconv
 , enableCredssp ? (!stdenv.isDarwin)
 } :
 
@@ -15,7 +16,8 @@ stdenv.mkDerivation (rec {
 
   nativeBuildInputs = [pkg-config autoreconfHook];
   buildInputs = [openssl libX11 libXcursor libtasn1 nettle gnutls]
-    ++ lib.optional enableCredssp krb5;
+    ++ lib.optional enableCredssp krb5
+    ++ lib.optional stdenv.isDarwin libiconv;
 
   configureFlags = [
     "--with-ipv6"

pkgs/applications/office/homebank/default.nix

@@ -2,10 +2,10 @@
 , libsoup, gnome }:
 
 stdenv.mkDerivation rec {
-  name = "homebank-5.5.1";
+  name = "homebank-5.5.2";
   src = fetchurl {
     url = "http://homebank.free.fr/public/${name}.tar.gz";
-    sha256 = "sha256-m7OeqtPExo0ry+IeL2xKUnTjo/OFr7Ky/3OuX9mY2gg=";
+    sha256 = "sha256-mJ7zeOTJ+CNLYruT1qSxS9TJjciJUZg426H0TxLFHtI=";
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];

pkgs/applications/radio/ebook2cw/Makefile.patch

@@ -1,12 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 005d60d..f69c7fe 100644
---- a/Makefile
-+++ b/Makefile
-@@ -41,6 +41,7 @@ install:
- 	install -d -v                      $(DESTDIR)/bin/
- 	install -d -v                      $(DESTDIR)/share/doc/ebook2cw/
- 	install -d -v                      $(DESTDIR)/share/doc/ebook2cw/examples/
-+	install -d -v                      $(DESTDIR)/share/locale/de/LC_MESSAGES/
- 	install -s -m 0755 ebook2cw        $(DESTDIR)/bin/
- 	install    -m 0644 ebook2cw.1      $(DESTDIR)/share/man/man1/
- 	install    -m 0644 README          $(DESTDIR)/share/doc/ebook2cw/

pkgs/applications/radio/ebook2cw/default.nix

@@ -1,18 +1,24 @@
-{ lib, stdenv, fetchgit, lame, libvorbis, gettext }:
+{ lib, stdenv, fetchgit, fetchpatch, lame, libvorbis, gettext }:
 
 stdenv.mkDerivation rec {
   pname = "ebook2cw";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchgit {
     url = "https://git.fkurz.net/dj1yfk/ebook2cw.git";
     rev = "${pname}-${version}";
-    sha256 = "0jqmnjblv3wzr0ppqzndzd8wg02nlkvzg1fqw14vyyp76sdjsh46";
+    sha256 = "0h7lg59m3dcydzkc8szipnwzag8fqwwvppa9fspn5xqd4blpcjd5";
   };
 
-  buildInputs = [ lame libvorbis gettext ];
+  patches = [
+    # Fixes non-GCC compilers and a missing directory in the install phase.
+    (fetchpatch {
+      url = "https://git.fkurz.net/dj1yfk/ebook2cw/commit/eb5742e70b042cf98a04440395c34390b171c035.patch";
+      sha256 = "1m5f819cj3fj1piss0a5ciib3jqrqdc14lp3i3dszw4bg9v1pgyd";
+    })
+  ];
 
-  patches = [ ./Makefile.patch ];
+  buildInputs = [ lame libvorbis gettext ];
 
   makeFlags = [ "DESTDIR=$(out)" ];
 

pkgs/applications/science/biology/est-sfs/default.nix

@@ -11,6 +11,10 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gsl ];
 
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+  ];
+
   installPhase = ''
     mkdir -p $out/bin
     mkdir -p $out/share/doc/${pname}

pkgs/applications/science/biology/samblaster/default.nix

@@ -11,6 +11,8 @@ stdenv.mkDerivation rec {
     sha256 = "0g24fq5hplnfgqkh3xqpg3lgx3wmxwnh9c7m6yw7pbi40lmgl1jv";
   };
 
+  makeFlags = [ "CPP=${stdenv.cc.targetPrefix}c++" ];
+
   installPhase = ''
     mkdir -p $out/bin
     cp samblaster $out/bin

pkgs/applications/science/chemistry/gwyddion/default.nix

@@ -35,10 +35,10 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gwyddion";
-   version = "2.57";
+   version = "2.58";
   src = fetchurl {
     url = "mirror://sourceforge/gwyddion/gwyddion-${version}.tar.xz";
-    sha256 = "sha256-kx/WqtNDaJQyVehxZ3weddXyaM1knX+fCuv47A9GaH0=";
+    sha256 = "sha256-0xNnzYkuW3nEsO2o+0WEA+Z71XWoq6FYXm342OWO9Sw=";
   };
 
   nativeBuildInputs = [ pkg-config file ];

pkgs/applications/science/electronics/gnucap/default.nix

@@ -21,6 +21,7 @@ It performs nonlinear dc and transient analyses, fourier analysis, and ac analys
     changelog = "https://git.savannah.gnu.org/cgit/gnucap.git/plain/NEWS?h=v${version}";
     license = licenses.gpl3Plus;
     platforms = platforms.all;
+    broken = stdenv.isDarwin; # Relies on LD_LIBRARY_PATH
     maintainers = [ maintainers.raboof ];
   };
 }

pkgs/applications/science/electronics/gtkwave/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gtkwave";
-  version = "3.3.108";
+  version = "3.3.109";
 
   src = fetchurl {
     url    = "mirror://sourceforge/gtkwave/${pname}-gtk3-${version}.tar.gz";
-    sha256 = "sha256-LtlexZKih+Si/pH3oQpWdpzfZ6j+41Otgfx7nLMfFSQ=";
+    sha256 = "sha256-NUYezNm4tEcMqnirmo8U7Ky8ye/2MDPY3OWAk+eG3rc=";
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];