Merge master into staging-next

2023-01-01 18:01:09 +00:00
parent 0033f558b1 62936a094c
commit 9b617f9ab3
59 changed files with 478 additions and 190 deletions
@@ -55,10 +55,13 @@ trim_trailing_whitespace = unset
 [*.lock]
 indent_size = unset

-# trailing whitespace is an actual syntax element of classic Markdown/
-# CommonMark to enforce a line break
+# Although Markdown/CommonMark allows using two trailing spaces to denote
+# a hard line break, we do not use that feature in nixpkgs since
+# it forces the surrounding paragraph to become a <literallayout> which
+# does not wrap reasonably.
+# Instead of a hard line break, start a new paragraph by inserting a blank line.
 [*.md]
-trim_trailing_whitespace = unset
+trim_trailing_whitespace = true

 # binaries
 [*.nib]
@@ -38,10 +38,6 @@ jobs:
            into: staging-next-22.11
          - from: staging-next-22.11
            into: staging-22.11
-          - from: release-22.05
-            into: staging-next-22.05
-          - from: staging-next-22.05
-            into: staging-22.05
    name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
    steps:
      - uses: actions/checkout@v3
@@ -1,4 +1,4 @@
-Copyright (c) 2003-2022 Eelco Dolstra and the Nixpkgs/NixOS contributors
+Copyright (c) 2003-2023 Eelco Dolstra and the Nixpkgs/NixOS contributors

 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -20,7 +20,7 @@ Features are separated in various sections depending on if you opt for a Nix-sto
 ### Common

 - arbitrary NixOS configuration
- automatic or bound disk size: `diskSize` parameter, `additionalSpace` can be set when `diskSize` is `auto` to add a constant of disk space 
+- automatic or bound disk size: `diskSize` parameter, `additionalSpace` can be set when `diskSize` is `auto` to add a constant of disk space
 - multiple partition table layouts: EFI, legacy, legacy + GPT, hybrid, none through `partitionTableType` parameter
 - OVMF or EFI firmwares and variables templates can be customized
 - root filesystem `fsType` can be customized to whatever `mkfs.${fsType}` exist during operations
@@ -62,7 +62,7 @@ runCommand "example" {
 '';
 ```

-While `testBuildFailure` is designed to keep changes to the original builder's 
+While `testBuildFailure` is designed to keep changes to the original builder's
 environment to a minimum, some small changes are inevitable.

 - The file `$TMPDIR/testBuildFailure.log` is present. It should not be deleted.
@@ -16,7 +16,8 @@ In the following is an example expression using `buildGoModule`, the following a
  `vendorHash` can also be set to `null`.
  In that case, rather than fetching the dependencies and vendoring them, the dependencies vendored in the source repo will be used.

-  To avoid updating this field when dependencies change, run `go mod vendor` in your source repo and set `vendorHash = null;`  
+  To avoid updating this field when dependencies change, run `go mod vendor` in your source repo and set `vendorHash = null;`
+
  To obtain the actual hash, set `vendorHash = lib.fakeSha256;` and run the build ([more details here](#sec-source-hashes)).
 - `proxyVendor`: Fetches (go mod download) and proxies the vendor directory. This is useful if your code depends on c code and go mod tidy does not include the needed sources to build or if any dependency has case-insensitive conflicts which will produce platform dependant `vendorHash` checksums.

@@ -63,7 +63,7 @@ You should prefer `overrideAttrs` in almost all cases, see its documentation for
 :::

 ::: {.warning}
-Do not use this function in Nixpkgs as it evaluates a Derivation before modifying it, which breaks package abstraction and removes error-checking of function arguments. In addition, this evaluation-per-function application incurs a performance penalty, which can become a problem if many overrides are used. It is only intended for ad-hoc customisation, such as in `~/.config/nixpkgs/config.nix`.
+Do not use this function in Nixpkgs as it evaluates a derivation before modifying it, which breaks package abstraction. In addition, this evaluation-per-function application incurs a performance penalty, which can become a problem if many overrides are used. It is only intended for ad-hoc customisation, such as in `~/.config/nixpkgs/config.nix`.
 :::

 The function `overrideDerivation` creates a new derivation based on an existing one by overriding the original's attributes with the attribute set produced by the specified function. This function is available on all derivations defined using the `makeOverridable` function. Most standard derivation-producing functions, such as `stdenv.mkDerivation`, are defined using this function, which means most packages in the nixpkgs expression, `pkgs`, have this function.
@@ -27,11 +27,19 @@ rec {
     For another application, see build-support/vm, where this
     function is used to build arbitrary derivations inside a QEMU
     virtual machine.
+
+     Note that in order to preserve evaluation errors, the new derivation's
+     outPath depends on the old one's, which means that this function cannot
+     be used in circular situations when the old derivation also depends on the
+     new one.
+
+     You should in general prefer `drv.overrideAttrs` over this function;
+     see the nixpkgs manual for more information on overriding.
  */
  overrideDerivation = drv: f:
    let
      newDrv = derivation (drv.drvAttrs // (f drv));
-    in lib.flip (extendDerivation true) newDrv (
+    in lib.flip (extendDerivation (builtins.seq drv.drvPath true)) newDrv (
      { meta = drv.meta or {};
        passthru = if drv ? passthru then drv.passthru else {};
      }
@@ -63,7 +63,7 @@ let

    inherit (builtins) add addErrorContext attrNames concatLists
      deepSeq elem elemAt filter genericClosure genList getAttr
-      hasAttr head isAttrs isBool isInt isList isString length
+      hasAttr head isAttrs isBool isInt isList isPath isString length
      lessThan listToAttrs pathExists readFile replaceStrings seq
      stringLength sub substring tail trace;
    inherit (self.trivial) id const pipe concat or and bitAnd bitOr bitXor
@@ -96,14 +96,16 @@ let
      concatImapStringsSep makeSearchPath makeSearchPathOutput
      makeLibraryPath makeBinPath optionalString
      hasInfix hasPrefix hasSuffix stringToCharacters stringAsChars escape
-      escapeShellArg escapeShellArgs isValidPosixName toShellVar toShellVars
+      escapeShellArg escapeShellArgs
+      isStorePath isStringLike
+      isValidPosixName toShellVar toShellVars
      escapeRegex escapeXML replaceChars lowerChars
      upperChars toLower toUpper addContextFrom splitString
      removePrefix removeSuffix versionOlder versionAtLeast
      getName getVersion
      mesonOption mesonBool mesonEnable
      nameFromURL enableFeature enableFeatureAs withFeature
-      withFeatureAs fixedWidthString fixedWidthNumber isStorePath
+      withFeatureAs fixedWidthString fixedWidthNumber
      toInt toIntBase10 readPathsFromFile fileContents;
    inherit (self.stringsWithDeps) textClosureList textClosureMap
      noDepEntry fullDepEntry packEntry stringAfter;
@@ -289,7 +289,9 @@ rec {
       (This means fn is type Val -> String.) */
    allowPrettyValues ? false,
    /* If this option is true, the output is indented with newlines for attribute sets and lists */
-    multiline ? true
+    multiline ? true,
+    /* Initial indentation level */
+    indent ? ""
  }:
    let
    go = indent: v: with builtins;
@@ -348,7 +350,7 @@ rec {
                };") v)
        + outroSpace + "}"
    else abort "generators.toPretty: should never happen (v = ${v})";
-  in go "";
+  in go indent;

  # PLIST handling
  toPlist = {}: v: let
@@ -18,6 +18,7 @@ rec {
    isInt
    isList
    isAttrs
+    isPath
    isString
    match
    parseDrvName
@@ -395,7 +396,7 @@ rec {
  */
  toShellVar = name: value:
    lib.throwIfNot (isValidPosixName name) "toShellVar: ${name} is not a valid shell variable name" (
-    if isAttrs value && ! isCoercibleToString value then
+    if isAttrs value && ! isStringLike value then
      "declare -A ${name}=(${
        concatStringsSep " " (lib.mapAttrsToList (n: v:
          "[${escapeShellArg n}]=${escapeShellArg v}"
@@ -798,10 +799,31 @@ rec {
  in lib.warnIf (!precise) "Imprecise conversion from float to string ${result}"
    result;

-  /* Check whether a value can be coerced to a string */
-  isCoercibleToString = x:
-    elem (typeOf x) [ "path" "string" "null" "int" "float" "bool" ] ||
-    (isList x && lib.all isCoercibleToString x) ||
+  /* Soft-deprecated function. While the original implementation is available as
+     isConvertibleWithToString, consider using isStringLike instead, if suitable. */
+  isCoercibleToString = lib.warnIf (lib.isInOldestRelease 2305)
+    "lib.strings.isCoercibleToString is deprecated in favor of either isStringLike or isConvertibleWithToString. Only use the latter if it needs to return true for null, numbers, booleans and list of similarly coercibles."
+    isConvertibleWithToString;
+
+  /* Check whether a list or other value can be passed to toString.
+
+     Many types of value are coercible to string this way, including int, float,
+     null, bool, list of similarly coercible values.
+  */
+  isConvertibleWithToString = x:
+    isStringLike x ||
+    elem (typeOf x) [ "null" "int" "float" "bool" ] ||
+    (isList x && lib.all isConvertibleWithToString x);
+
+  /* Check whether a value can be coerced to a string.
+     The value must be a string, path, or attribute set.
+
+     String-like values can be used without explicit conversion in
+     string interpolations and in most functions that expect a string.
+   */
+  isStringLike = x:
+    isString x ||
+    isPath x ||
    x ? outPath ||
    x ? __toString;

@@ -818,7 +840,7 @@ rec {
       => false
  */
  isStorePath = x:
-    if !(isList x) && isCoercibleToString x then
+    if isStringLike x then
      let str = toString x; in
      substring 0 1 str == "/"
      && dirOf str == storeDir
@@ -179,7 +179,7 @@ rec {
     they take effect as soon as the oldest release reaches end of life. */
  oldestSupportedRelease =
    # Update on master only. Do not backport.
-    2205;
+    2211;

  /* Whether a feature is supported in all supported releases (at the time of
     release branch-off, if applicable). See `oldestSupportedRelease`. */
@@ -54,7 +54,7 @@ let
    concatStringsSep
    escapeNixString
    hasInfix
-    isCoercibleToString
+    isStringLike
    ;
  inherit (lib.trivial)
    boolToString
@@ -227,7 +227,7 @@ rec {
      merge = loc: defs:
        let
          getType = value:
-            if isAttrs value && isCoercibleToString value
+            if isAttrs value && isStringLike value
            then "stringCoercibleSet"
            else builtins.typeOf value;

@@ -479,7 +479,7 @@ rec {
    path = mkOptionType {
      name = "path";
      descriptionClass = "noun";
-      check = x: isCoercibleToString x && builtins.substring 0 1 (toString x) == "/";
+      check = x: isStringLike x && builtins.substring 0 1 (toString x) == "/";
      merge = mergeEqualOption;
    };

@@ -16,8 +16,20 @@
    </para>
    <itemizedlist>
      <listitem>
-<literallayout>Nix has been updated from 2.3 to 2.8. This mainly brings experimental support for Flakes, but also marks the <literal>nix</literal> command as experimental which now has to be enabled via the configuration explicitly. For more information and instructions for upgrades, see the relase notes for <link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.4.html">nix-2.4</link>,
-<link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.5.html">nix-2.5</link>, <link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.6.html">nix-2.6</link>, <link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.7.html">nix-2.7</link> and <link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.8.html">nix-2.8</link></literallayout>
+        <para>
+          Nix has been updated from 2.3 to 2.8. This mainly brings
+          experimental support for Flakes, but also marks the
+          <literal>nix</literal> command as experimental which now has
+          to be enabled via the configuration explicitly. For more
+          information and instructions for upgrades, see the relase
+          notes for
+          <link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.4.html">nix-2.4</link>,
+          <link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.5.html">nix-2.5</link>,
+          <link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.6.html">nix-2.6</link>,
+          <link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.7.html">nix-2.7</link>
+          and
+          <link xlink:href="https://nixos.org/manual/nix/stable/release-notes/rl-2.8.html">nix-2.8</link>
+        </para>
      </listitem>
      <listitem>
        <para>
@@ -9,8 +9,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - Nix has been updated from 2.3 to 2.8. This mainly brings experimental support
  for Flakes, but also marks the `nix` command as experimental which now has to
  be enabled via the configuration explicitly. For more information and
-  instructions for upgrades, see the 
-  relase notes for [nix-2.4](https://nixos.org/manual/nix/stable/release-notes/rl-2.4.html),  
+  instructions for upgrades, see the
+  relase notes for [nix-2.4](https://nixos.org/manual/nix/stable/release-notes/rl-2.4.html),
  [nix-2.5](https://nixos.org/manual/nix/stable/release-notes/rl-2.5.html),
  [nix-2.6](https://nixos.org/manual/nix/stable/release-notes/rl-2.6.html),
  [nix-2.7](https://nixos.org/manual/nix/stable/release-notes/rl-2.7.html) and
@@ -30,7 +30,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - Systemd has been upgraded to the version 250.

- Pulseaudio has been updated to version 15.0 and now optionally 
+- Pulseaudio has been updated to version 15.0 and now optionally
  [supports additional Bluetooth audio codecs](https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/15.0/#supportforldacandaptxbluetoothcodecsplussbcxqsbcwithhigher-qualityparameters)
  such as aptX or LDAC, with codec switching available in `pavucontrol`. This
  feature is disabled by default, but can be enabled with the option
@@ -50,7 +50,7 @@ In addition to numerous new and upgraded packages, this release has the followin
  settings for many certificates at once. This also opens up the option to use
  DNS-01 validation when using `enableACME` web server virtual hosts (e.g.
  `services.nginx.virtualHosts.*.enableACME`).
-  
+
 ## New Services {#sec-release-22.05-new-services}

 - [1password](https://1password.com/), command-lines and graphic interface for 1Password. Available as [programs._1password](#opt-programs._1password.enable) and [programs._1password-gui](#opt-programs._1password.enable).
@@ -743,11 +743,11 @@ In addition to numerous new and upgraded packages, this release has the followin
 - The configuration portion of the `nix-daemon` module has been reworked and exposed as [nix.settings](options.html#opt-nix-settings):
  * Legacy options have been mapped to the corresponding options under under [nix.settings](options.html#opt-nix.settings) and will be deprecated when NixOS 21.11 reaches end of life.
  * [nix.buildMachines.publicHostKey](options.html#opt-nix.buildMachines.publicHostKey) has been added.
-  
+
 - [`kops`](https://kops.sigs.k8s.io) defaults to 1.23.2, which will enable [Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html) and require tokens on new clusters with Kubernetes >= 1.22. This will increase security by default, but may break some types of workloads. The default behaviour for `spec.kubeDNS.nodeLocalDNS.forwardToKubeDNS` has changed from `true` to `false`. Cilium now has `disable-cnp-status-updates: true` by default. Set this to false if you rely on the CiliumNetworkPolicy status fields. Support for Kubernetes 1.17, the Lyft CNI, Weave CNI on Kubernetes >= 1.23, CentOS 7 and 8, Debian 9, RHEL 7, and Ubuntu 16.05 (Xenial) has been removed. See the [1.22 release notes](https://kops.sigs.k8s.io/releases/1.22-notes/) and [1.23 release notes](https://kops.sigs.k8s.io/releases/1.23-notes/) for more details, including other significant changes.

 - Mattermost has been upgraded to extended support version 6.3 as the previously
-  packaged extended support version 5.37 is [reaching end of life](https://docs.mattermost.com/upgrade/extended-support-release.html). 
+  packaged extended support version 5.37 is [reaching end of life](https://docs.mattermost.com/upgrade/extended-support-release.html).
  Migration may take some time, see the [changelog](https://docs.mattermost.com/install/self-managed-changelog.html#release-v6-3-extended-support-release)
  and [important upgrade notes](https://docs.mattermost.com/upgrade/important-upgrade-notes.html).

@@ -762,14 +762,14 @@ In addition to numerous new and upgraded packages, this release has the followin
  By default auto-upgrade will now run immediately if it would have been triggered at least
  once during the time when the timer was inactive.

- Mastodon now uses `services.redis.servers` to start a new redis server, instead of using a global redis server. 
+- Mastodon now uses `services.redis.servers` to start a new redis server, instead of using a global redis server.
  This improves compatibility with other services that use redis.
-  
-  Note that this will recreate the redis database, although according to the [Mastodon docs](https://docs.joinmastodon.org/admin/backups/), 
+
+  Note that this will recreate the redis database, although according to the [Mastodon docs](https://docs.joinmastodon.org/admin/backups/),
  this is almost harmless:
-  > Losing the Redis database is almost harmless: The only irrecoverable data will be the contents of the Sidekiq queues and scheduled retries of previously failed jobs. 
+  > Losing the Redis database is almost harmless: The only irrecoverable data will be the contents of the Sidekiq queues and scheduled retries of previously failed jobs.
  >  The home and list feeds are stored in Redis, but can be regenerated with tootctl.
-  
+
  If you do want to save the redis database, you can use the following commands:
  ```bash
  redis-cli save
@@ -980,7 +980,7 @@ In addition to numerous new and upgraded packages, this release has the followin
  or `wl*` with priority 99 (which means that it doesn't have any effect if such an interface is matched
  by a `.network-`unit with a lower priority). In case of scripted networking, no behavior
  was changed.
-  
+
 - The new [`postgresqlTestHook`](https://nixos.org/manual/nixpkgs/stable/#sec-postgresqlTestHook) runs a PostgreSQL server for the duration of package checks.

 - `zfs` was updated from 2.1.4 to 2.1.5, enabling it to be used with Linux kernel 5.18.
@@ -38,7 +38,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `carnix` and `cratesIO` has been removed due to being unmaintained, use alternatives such as [naersk](https://github.com/nix-community/naersk) and [crate2nix](https://github.com/kolloch/crate2nix) instead.

- `borgbackup` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.borgbackup.jobs.<name>.inhibitsSleep`](#opt-services.borgbackup.jobs._name_.inhibitsSleep). 
+- `borgbackup` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.borgbackup.jobs.<name>.inhibitsSleep`](#opt-services.borgbackup.jobs._name_.inhibitsSleep).

 - The EC2 image module no longer fetches instance metadata in stage-1. This results in a significantly smaller initramfs, since network drivers no longer need to be included, and faster boots, since metadata fetching can happen in parallel with startup of other services.
  This breaks services which rely on metadata being present by the time stage-2 is entered. Anything which reads EC2 metadata from `/etc/ec2-metadata` should now have an `after` dependency on `fetch-ec2-metadata.service`
@@ -42,7 +42,7 @@ let
        else if isDerivation v then toString v
        else if builtins.isPath v then toString v
        else if isString v then v
-        else if strings.isCoercibleToString v then toString v
+        else if strings.isConvertibleWithToString v then toString v
        else abort "The nix conf value: ${toPretty {} v} can not be encoded";

      mkKeyValue = k: v: "${escape [ "=" ] k} = ${mkValueString v}";
@@ -792,7 +792,10 @@ in
        fi
      '';

-    nix.nrBuildUsers = mkDefault (max 32 (if cfg.settings.max-jobs == "auto" then 0 else cfg.settings.max-jobs));
+    nix.nrBuildUsers = mkDefault (
+      if cfg.settings.auto-allocate-uids or false then 0
+      else max 32 (if cfg.settings.max-jobs == "auto" then 0 else cfg.settings.max-jobs)
+    );

    users.users = nixbldUsers;

@@ -273,7 +273,11 @@ let
        after = [ "network.target" "network-online.target" ];
        wantedBy = optional values.autostart "multi-user.target";
        environment.DEVICE = name;
-        path = [ pkgs.kmod pkgs.wireguard-tools config.networking.resolvconf.package ];
+        path = [
+          pkgs.wireguard-tools
+          config.networking.firewall.package   # iptables or nftables
+          config.networking.resolvconf.package # openresolv or systemd
+        ];

        serviceConfig = {
          Type = "oneshot";
@@ -281,7 +285,7 @@ let
        };

        script = ''
-          ${optionalString (!config.boot.isContainer) "modprobe wireguard"}
+          ${optionalString (!config.boot.isContainer) "${pkgs.kmod}/bin/modprobe wireguard"}
          ${optionalString (values.configFile != null) ''
            cp ${values.configFile} ${configPath}
          ''}
@@ -18,7 +18,7 @@ let
    in
    lib.concatStrings (lib.mapAttrsToList toArg args);

-  isPathType = x: lib.strings.isCoercibleToString x && builtins.substring 0 1 (toString x) == "/";
+  isPathType = x: lib.types.path.check x;

 in
 {
@@ -1,5 +1,4 @@
-{ kernelPackages ? null }:
-import ../make-test-python.nix ({ pkgs, lib, ...} :
+import ../make-test-python.nix ({ pkgs, lib, kernelPackages ? null, ...} :
  let
    wg-snakeoil-keys = import ./snakeoil-keys.nix;
    peer = (import ./make-peer.nix) { inherit lib; };
@@ -7,10 +7,11 @@
 with pkgs.lib;

 let
-  tests = let callTest = p: flip (import p) { inherit system pkgs; }; in {
+  tests = let callTest = p: args: import p ({ inherit system pkgs; } // args); in {
    basic = callTest ./basic.nix;
    namespaces = callTest ./namespaces.nix;
    wg-quick = callTest ./wg-quick.nix;
+    wg-quick-nftables = args: callTest ./wg-quick.nix ({ nftables = true; } // args);
    generated = callTest ./generated.nix;
  };
 in
@@ -1,5 +1,4 @@
-{ kernelPackages ? null }:
-import ../make-test-python.nix ({ pkgs, lib, ... } : {
+import ../make-test-python.nix ({ pkgs, lib, kernelPackages ? null, ... } : {
  name = "wireguard-generated";
  meta = with pkgs.lib.maintainers; {
    maintainers = [ ma27 grahamc ];
@@ -1,5 +1,3 @@
-{ kernelPackages ? null }:
-
 let
  listenPort = 12345;
  socketNamespace = "foo";
@@ -15,7 +13,7 @@ let

 in

-import ../make-test-python.nix ({ pkgs, lib, ... } : {
+import ../make-test-python.nix ({ pkgs, lib, kernelPackages ? null, ... } : {
  name = "wireguard-with-namespaces";
  meta = with pkgs.lib.maintainers; {
    maintainers = [ asymmetric ];
@@ -1,9 +1,13 @@
-{ kernelPackages ? null }:
-
-import ../make-test-python.nix ({ pkgs, lib, ... }:
+import ../make-test-python.nix ({ pkgs, lib, kernelPackages ? null, nftables ? false, ... }:
  let
    wg-snakeoil-keys = import ./snakeoil-keys.nix;
-    peer = (import ./make-peer.nix) { inherit lib; };
+    peer = import ./make-peer.nix { inherit lib; };
+    commonConfig = {
+      boot.kernelPackages = lib.mkIf (kernelPackages != null) kernelPackages;
+      networking.nftables.enable = nftables;
+      # Make sure iptables doesn't work with nftables enabled
+      boot.blacklistedKernelModules = lib.mkIf nftables [ "nft_compat" ];
+    };
  in
  {
    name = "wg-quick";
@@ -15,47 +19,51 @@ import ../make-test-python.nix ({ pkgs, lib, ... }:
      peer0 = peer {
        ip4 = "192.168.0.1";
        ip6 = "fd00::1";
-        extraConfig = {
-          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
-          networking.firewall.allowedUDPPorts = [ 23542 ];
-          networking.wg-quick.interfaces.wg0 = {
-            address = [ "10.23.42.1/32" "fc00::1/128" ];
-            listenPort = 23542;
+        extraConfig = lib.mkMerge [
+          commonConfig
+          {
+            networking.firewall.allowedUDPPorts = [ 23542 ];
+            networking.wg-quick.interfaces.wg0 = {
+              address = [ "10.23.42.1/32" "fc00::1/128" ];
+              listenPort = 23542;

-            inherit (wg-snakeoil-keys.peer0) privateKey;
+              inherit (wg-snakeoil-keys.peer0) privateKey;

-            peers = lib.singleton {
-              allowedIPs = [ "10.23.42.2/32" "fc00::2/128" ];
+              peers = lib.singleton {
+                allowedIPs = [ "10.23.42.2/32" "fc00::2/128" ];

-              inherit (wg-snakeoil-keys.peer1) publicKey;
+                inherit (wg-snakeoil-keys.peer1) publicKey;
+              };
+
+              dns = [ "10.23.42.2" "fc00::2" "wg0" ];
            };
-
-            dns = [ "10.23.42.2" "fc00::2" "wg0" ];
-          };
-        };
+          }
+        ];
      };

      peer1 = peer {
        ip4 = "192.168.0.2";
        ip6 = "fd00::2";
-        extraConfig = {
-          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
-          networking.useNetworkd = true;
-          networking.wg-quick.interfaces.wg0 = {
-            address = [ "10.23.42.2/32" "fc00::2/128" ];
-            inherit (wg-snakeoil-keys.peer1) privateKey;
+        extraConfig = lib.mkMerge [
+          commonConfig
+          {
+            networking.useNetworkd = true;
+            networking.wg-quick.interfaces.wg0 = {
+              address = [ "10.23.42.2/32" "fc00::2/128" ];
+              inherit (wg-snakeoil-keys.peer1) privateKey;

-            peers = lib.singleton {
-              allowedIPs = [ "0.0.0.0/0" "::/0" ];
-              endpoint = "192.168.0.1:23542";
-              persistentKeepalive = 25;
+              peers = lib.singleton {
+                allowedIPs = [ "0.0.0.0/0" "::/0" ];
+                endpoint = "192.168.0.1:23542";
+                persistentKeepalive = 25;

-              inherit (wg-snakeoil-keys.peer0) publicKey;
+                inherit (wg-snakeoil-keys.peer0) publicKey;
+              };
+
+              dns = [ "10.23.42.1" "fc00::1" "wg0" ];
            };
-
-            dns = [ "10.23.42.1" "fc00::1" "wg0" ];
-          };
-        };
+          }
+        ];
      };
    };

@@ -18,14 +18,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "eartag";
-  version = "0.2.1";
+  version = "0.3.1";
  format = "other";

  src = fetchFromGitHub {
    owner = "knuxify";
    repo = pname;
-    rev = version;
-    sha256 = "sha256-TlY2F2y7ZZ9f+vkYYkES5zoIGcuTWP1+rOJI62wc4SU=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-gN3V5ZHlhHp52Jg/i+hDLEDpSvP8yFngujyw5ZncQQg=";
  };

  postPatch = ''
@@ -21,14 +21,14 @@

 stdenv.mkDerivation rec {
  pname = "furnace";
-  version = "0.6pre2";
+  version = "0.6pre3";

  src = fetchFromGitHub {
    owner = "tildearrow";
    repo = "furnace";
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-ydywnlZ6HEcTiBIB92yduCzPsOljvypP1KpCVjETzBc=";
+    sha256 = "sha256-bHVeTw69k6LLcrfkmGxvjlFfR/hWiCfm/P3utknid1o=";
  };

  nativeBuildInputs = [
@@ -17,7 +17,7 @@ let
      homepage    = "https://keepass.info/plugins.html#otpkeyprov";
      platforms   = with lib.platforms; linux;
      license     = lib.licenses.gpl2;
-      maintainers = [ lib.maintainers.ente ];
+      maintainers = [ lib.maintainers.Enteee ];
    };

    pluginFilename = "OtpKeyProv.plgx";
@@ -231,6 +231,5 @@ in stdenv.mkDerivation {
    inherit (chromium) upstream-info browser;
    mkDerivation = chromium.mkChromiumDerivation;
    inherit chromeSrc sandboxExecutableName;
-    updateScript = ./update.py;
  };
 }
@@ -32,15 +32,15 @@
    }
  },
  "dev": {
-    "version": "110.0.5464.2",
-    "sha256": "18k4rrwszk4xz416xi6li9b5pdajlscfgg4cyv67y10z7f28qwby",
-    "sha256bin64": "0hzv55bba4041400zjysgzz1n8svzvi156xyrayfr5ynapf7g2rd",
+    "version": "110.0.5478.4",
+    "sha256": "0sn07gk53mc6xcmbq1jrxwf4lp2hmw6k9rmhsw36qf5alcdkx94h",
+    "sha256bin64": "0r63qj6gc74vrjp7fyygzf49prsyim03s3cv43fm85lnab9m4x6i",
    "deps": {
      "gn": {
-        "version": "2022-11-29",
+        "version": "2022-12-12",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "70d6c60823c0233a0f35eccc25b2b640d2980bdc",
-        "sha256": "04md36i6l07c1bq8mqghrnbf308j9avmqkwqjqm8gciclnrnlsii"
+        "rev": "5e19d2fb166fbd4f6f32147fbb2f497091a54ad8",
+        "sha256": "1b5fwldfmkkbpp5x63n1dxv0nc965hphc8rm8ah7zg44zscm9z30"
      }
    }
  },
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchurl
+, autoreconfHook
+, pkg-config
+, which
+, gtk3
+, blas
+, lapack
+}:
+
+assert (!blas.isILP64) && (!lapack.isILP64);
+
+stdenv.mkDerivation rec {
+  pname = "xnec2c";
+  version = "4.4.12";
+
+  src = fetchurl {
+    url = "https://www.xnec2c.org/releases/${pname}-v${version}.tar.gz";
+    hash = "sha256-6Yrx6LkJjfnMA/kJUDWLhGzGopZeecARSrcR++UScsU=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config which ];
+  buildInputs = [ gtk3 blas lapack ];
+
+  meta = with lib; {
+    homepage = "https://www.xnec2c.org/";
+    description = "Graphical antenna simulation";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ mvs ];
+    platforms = platforms.unix;
+
+    # Darwin support likely to be fixed upstream in the next release
+    broken = stdenv.isDarwin;
+  };
+}
@@ -9,16 +9,16 @@

 buildPythonPackage rec {
  pname = "beancount-parser";
-  version = "0.1.21";
+  version = "0.1.23";
+  format = "pyproject";

  disabled = pythonOlder "3.9";
-  format = "pyproject";

  src = fetchFromGitHub {
    owner = "LaunchPlatform";
    repo = "beancount-parser";
-    rev = version;
-    sha256 = "sha256-0uhH75OEjC9iA0XD0VX7CGoRIP/hpM4y+53JnyXgZpA=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-3pO1HvH3R2RpNFtplWyaXxqZy0caAoAxlmfSKmjkvKQ=";
  };

  buildInputs = [
@@ -40,6 +40,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Standalone Lark based Beancount syntax parser";
    homepage = "https://github.com/LaunchPlatform/beancount-parser/";
+    changelog = "https://github.com/LaunchPlatform/beancount-parser/releases/tag/${version}";
    license = with licenses; [ mit ];
    maintainers = with maintainers; [ ambroisie ];
  };
@@ -0,0 +1,52 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+# propagates
+, django
+, dateutil
+, scim2-filter-parser
+, gssapi
+, ldap
+, sssd
+
+# tests
+, mock
+}:
+
+buildPythonPackage rec {
+  pname = "django-scim2";
+  version = "0.17.3";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "15five";
+    repo = pname;
+    rev = "refs/tags/${version}";
+    hash = "sha256-5zdGPpjooiFoj+2OoglXhhKsPFB/KOHvrZWZd+1nZqU=";
+  };
+
+  propagatedBuildInputs = [
+    django
+    dateutil
+    scim2-filter-parser
+    gssapi
+    ldap
+    sssd
+  ];
+
+  pythonImportsCheck = [
+    "django_scim"
+  ];
+
+  checkInputs = [
+    mock
+  ];
+
+  meta = with lib; {
+    description = "A SCIM 2.0 Service Provider Implementation (for Django)";
+    homepage = "https://github.com/15five/django-scim2";
+    license = licenses.mit;
+    maintainers = with maintainers; [ s1341 ];
+  };
+}
@@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "hcloud";
-  version = "1.18.1";
+  version = "1.18.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-nhz9fJEcYyt7rhIe0AkYPgG/mV0r87KUj/mM2A70rPE=";
+    hash = "sha256-N71bpWOH48SRxbq9PgirkdXwOQzV6IDk3+oZ4haBvJ4=";
  };

  propagatedBuildInputs = [
@@ -39,6 +39,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Library for the Hetzner Cloud API";
    homepage = "https://github.com/hetznercloud/hcloud-python";
+    changelog = "https://github.com/hetznercloud/hcloud-python/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ liff ];
  };
@@ -1,14 +1,21 @@
-{ lib, buildPythonPackage, fetchPypi, pillow, poppler_utils }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pillow
+, poppler_utils
+, pythonOlder
+}:

 buildPythonPackage rec {
  pname = "pdf2image";
-  version = "1.16.0";
+  version = "1.16.2";
+  format = "setuptools";

-  propagatedBuildInputs = [ pillow ];
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "d58ed94d978a70c73c2bb7fdf8acbaf2a7089c29ff8141be5f45433c0c4293bb";
+    hash = "sha256-hnYQke7jX0ZB6pjf3bJUJUNh0Bi+aYoZmv98HTczGAM=";
  };

  postPatch = ''
@@ -16,9 +23,18 @@ buildPythonPackage rec {
    sed -i '0,/poppler_path=None/s||poppler_path="${poppler_utils}/bin"|' pdf2image/pdf2image.py
  '';

+  propagatedBuildInputs = [
+    pillow
+  ];
+
+  pythonImportsCheck = [
+    "pdf2image"
+  ];
+
  meta = with lib; {
-    description = "A python module that wraps the pdftoppm utility to convert PDF to PIL Image object";
+    description = "Module that wraps the pdftoppm utility to convert PDF to PIL Image object";
    homepage = "https://github.com/Belval/pdf2image";
+    changelog = "https://github.com/Belval/pdf2image/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ gerschtli ];
    platforms = platforms.all;
@@ -28,12 +28,12 @@ let
  debuggerName = lib.strings.getName debugger;
 in
 buildPythonPackage rec {
-  version = "4.8.0";
+  version = "4.9.0";
  pname = "pwntools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-QgUuLYg3EOTh2gQekWdabXGftOXvLdJFyyhT2hEmkpA=";
+    sha256 = "sha256-7qZ9GC+RcEiDkpmNmy8d67dYiTgFBVAfB3B2RfrH5xI=";
  };

  postPatch = ''
@@ -3,24 +3,35 @@
 , fetchPypi
 , samba
 , pkg-config
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "pysmbc";
-  version = "1.0.23";
+  version = "1.0.24";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1y0n1n6jkzf4mr5lqfc73l2m0qp56gvxwfjnx2vj8c0hh5i1gnq8";
+    hash = "sha256-zq3o1hHmPXKnXSYrNCptyDa2+AqzjqX9WtRD4ve+LO0=";
  };

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ];

-  buildInputs = [ samba ];
+  buildInputs = [
+    samba
+  ];

  # Tests would require a local SMB server
  doCheck = false;
-  pythonImportsCheck = [ "smbc" ];
+
+  pythonImportsCheck = [
+    "smbc"
+  ];

  meta = with lib; {
    description = "libsmbclient binding for Python";
@@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "schema-salad";
-  version = "8.3.20220913105718";
+  version = "8.3.20221209165047";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-18/xLIq1+yM8iQBIeXvRIO4A5GqZS/3qOKXmi439+sQ=";
+    hash = "sha256-2XzJpNfEJV64AAvOuqisDR0xgBySH9QROrMFHB4ybHw=";
  };

  nativeBuildInputs = [
@@ -57,13 +57,15 @@ buildPythonPackage rec {
  ];

  passthru.optional-dependencies = {
-    pycodegen = [ black ];
+    pycodegen = [
+      black
+    ];
  };

  meta = with lib; {
-    broken = true; # disables on outdated version of mistune
    description = "Semantic Annotations for Linked Avro Data";
    homepage = "https://github.com/common-workflow-language/schema_salad";
+    changelog = "https://github.com/common-workflow-language/schema_salad/releases/tag/${version}";
    license = with licenses; [ asl20 ];
    maintainers = with maintainers; [ veprbl ];
  };
@@ -0,0 +1,38 @@
+{ stdenv, lib, fetchFromGitHub, buildPythonPackage, unittestCheckHook
+, pytest-runner, django
+, sly }:
+
+buildPythonPackage rec {
+  pname = "scim2-filter-parser";
+  version = "0.4.0";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "15five";
+    repo = pname;
+    # gets rarely updated, we can then just replace the hash
+    rev = "refs/tags/${version}";
+    hash = "sha256-ZemR5tn+T9WWgNB1FYrPJO6zh8g9zjobFZemi+MHkEE=";
+  };
+
+  propagatedBuildInputs = [
+    sly
+  ];
+
+  pythonImportsCheck = [
+    "scim2_filter_parser"
+  ];
+
+  checkInputs = [
+    django
+    pytest-runner
+    unittestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "A customizable parser/transpiler for SCIM2.0 filters";
+    homepage    = "https://github.com/15five/scim2-filter-parser";
+    license     = licenses.mit;
+    maintainers = with maintainers; [ s1341 ];
+  };
+}
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "tflint";
-  version = "0.43.0";
+  version = "0.44.1";

  src = fetchFromGitHub {
    owner = "terraform-linters";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-a5rTG+4qObdmInVZH8QkMdWmRrDA9ZUl2NL5p53D2MY=";
+    sha256 = "sha256-O758CU70NqRFlbtiy5cmfIHiHdQLxH88BHNZLQVvZ+M=";
  };

-  vendorSha256 = "sha256-hdevIQ0Ugn7+MtvNbF+HjJAMyBtGYuJPCFFcxS8p35E=";
+  vendorSha256 = "sha256-4ODf6Er7V5KsVUdWjqjv+dfH84PPR+5T29V1AJluoJA=";

  doCheck = false;

@@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "litefs";
-  version = "0.2.0";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "superfly";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Gh1GcIsRNfAwQ2HJq82IlyUHPyaDpA3CpBe4glBbU/I=";
+    sha256 = "sha256-fNZ0PtgMgCGB1b1HLJsmbm/I8wa3auHimL1ktf6wA9M=";
  };

-  vendorSha256 = "sha256-dXCyBY4k9Gxsy/7UwkWFTxihZnFkZGrZKgw9pHD8jco=";
+  vendorSha256 = "sha256-w77JQNk1QZFJVrn9yuvKOemggV9e0FuqhVWK3d4umuY=";

  subPackages = [ "cmd/litefs" ];

@@ -2,14 +2,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-tally";
-  version = "1.0.19";
+  version = "1.0.21";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-TlHb974Dtmz5qW+4L3BE6GQ3SbkwtIrZxE6FpJrgNdY=";
+    sha256 = "sha256-YEsgXIZ4R2w0HOkTV8LOGi2g32nHRs63nhk9yVR4vak=";
  };

-  cargoSha256 = "sha256-np1rln9tD+J4s410/Pv4/eKAxyzK8qtLoON86JR1T94=";
+  cargoSha256 = "sha256-jLbYC862fZONvMHh0CLsiuUmn/hmAF6sRLuav3P+bck=";

  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk_11_0.frameworks; [
    DiskArbitration
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
    license = licenses.gpl2;
    platforms = platforms.linux;
    maintainers = with maintainers; [ pmiddend ];
-    badPlatforms = [ platforms.aarch64 ];
+    badPlatforms = platforms.aarch64;
    # never built on aarch64-linux since first introduction in nixpkgs
    broken = stdenv.isLinux && stdenv.isAarch64;
  };
@@ -41,10 +41,10 @@ lib.overrideDerivation (buildLinux (args // {
  '';

  extraMeta = if (rpiVersion < 3) then {
-    platforms = with lib.platforms; [ arm ];
+    platforms = with lib.platforms; arm;
    hydraPlatforms = [];
  } else {
-    platforms = with lib.platforms; [ arm aarch64 ];
+    platforms = with lib.platforms; arm ++ aarch64;
    hydraPlatforms = [ "aarch64-linux" ];
  };
 } // (args.argsOverride or {}))) (oldAttrs: {
@@ -24,6 +24,13 @@ stdenv.mkDerivation rec {
    hash = "sha256-9lfHCcODlS7sZMjQhK0yQcCBEoGyZOChx/oM0CU37sY=";
  };

+  # Upstream build system have knob to enable and disable building of static
+  # library, shared library is built unconditionally.
+  postPatch = lib.optionalString stdenv.hostPlatform.isStatic ''
+    sed -i 'lib/Module.mk' -e '/LIBTARGETS :=/,+1d; /-m 755/ d'
+    substituteInPlace prog/sensors/Module.mk --replace 'lib/$(LIBSHBASENAME)' ""
+  '';
+
  nativeBuildInputs = [ bison flex which ];
  # bash is required for correctly replacing the shebangs in all tools for cross-compilation.
  buildInputs = [ bash perl ]
@@ -39,6 +46,12 @@ stdenv.mkDerivation rec {
    "ETCDIR=${placeholder "out"}/etc"
  ];

+  # Making regexp to patch-out installing of .so symlinks from Makefile is
+  # complicated, it is easier to remove them post-install.
+  postInstall = lib.optionalString stdenv.hostPlatform.isStatic ''
+    rm $out/lib/*.so*
+  '';
+
  meta = with lib; {
    homepage = "https://hwmon.wiki.kernel.org/lm_sensors";
    changelog = "https://raw.githubusercontent.com/lm-sensors/lm-sensors/V${dashedVersion}/CHANGES";
@@ -23,6 +23,9 @@ rustPlatform.buildRustPackage rec {
    Security
  ];

+  # FIXME: checkPhase on darwin will leave some zombie spawn processes
+  # see https://github.com/NixOS/nixpkgs/issues/205620
+  doCheck = !stdenv.isDarwin;
  checkFlags = [
    # tests depend on network interface, may fail with virtual IPs.
    "--skip=validate_printed_urls"
@@ -2,6 +2,9 @@
 , fetchFromGitHub
 , python3Packages
 , prometheus-alertmanager
+, fetchpatch
+, runCommand
+, prometheus-xmpp-alerts
 }:

 python3Packages.buildPythonApplication rec {
@@ -15,6 +18,16 @@ python3Packages.buildPythonApplication rec {
    sha256 = "sha256-PwShGS1rbfZCK5OS6Cnn+mduOpWAD4fC69mcGB5GB1c=";
  };

+  patches = [
+    # Required until https://github.com/jelmer/prometheus-xmpp-alerts/pull/33 is merged
+    # and contained in a release
+    (fetchpatch {
+      name = "Fix-outdated-entrypoint-definiton.patch";
+      url = "https://github.com/jelmer/prometheus-xmpp-alerts/commit/c41dd41dbd3c781b874bcf0708f6976e6252b621.patch";
+      hash = "sha256-G7fRLSXbkI5EDgGf4n9xSVs54IPD0ev8rTEFffRvLY0=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace setup.cfg \
      --replace "bs4" "beautifulsoup4"
@@ -39,6 +52,14 @@ python3Packages.buildPythonApplication rec {

  pythonImportsCheck = [ "prometheus_xmpp" ];

+  passthru.tests = {
+    binaryWorks = runCommand "${pname}-binary-test" {} ''
+      # Running with --help to avoid it erroring due to a missing config file
+      ${prometheus-xmpp-alerts}/bin/prometheus-xmpp-alerts --help | tee $out
+      grep "usage: prometheus-xmpp-alerts" $out
+    '';
+  };
+
  meta = {
    description = "XMPP Web hook for Prometheus";
    homepage = "https://github.com/jelmer/prometheus-xmpp-alerts";
@@ -13,9 +13,9 @@ for example `breezedark` for the app with the url

 To regenerate the nixpkgs nextcloudPackages set, run:

-``` 
+```
 ./generate.sh
-``` 
+```

 After that you can commit and submit the changes.

@@ -18,9 +18,9 @@ For available translations and language codes see [upstream translation reposito

 To regenerate the nixpkgs wordpressPackages set, run:

-``` 
+```
 ./generate.sh
-``` 
+```

 After that you can commit and submit the changes.

@@ -29,7 +29,7 @@ After that you can commit and submit the changes.
 The plugins will be available in the namespace `wordpressPackages.plugins`.
 Using it together with the Wordpress module could look like this:

-``` 
+```
 services.wordpress = {
  sites."blog.${config.networking.domain}" = {
    plugins = with pkgs.wordpressPackages.plugins; [
@@ -11,7 +11,6 @@

 let
  inherit (stdenv) isDarwin;
-  inherit (lib) overrideDerivation;

  malloc0ReturnsNullCrossFlag = lib.optional
    (stdenv.hostPlatform != stdenv.buildPlatform)
@@ -761,7 +760,7 @@ self: super:
      ];
      # XQuartz requires two compilations: the first to get X / XQuartz,
      # and the second to get Xvfb, Xnest, etc.
-      darwinOtherX = overrideDerivation xorgserver (oldAttrs: {
+      darwinOtherX = xorgserver.overrideAttrs (oldAttrs: {
        configureFlags = oldAttrs.configureFlags ++ [
          "--disable-xquartz"
          "--enable-xorg"
@@ -247,16 +247,16 @@ let
      isEnabled = lib.findFirst (x: x == reason) null showWarnings;
    in if isEnabled != null then builtins.trace msg true else true;

+  # Deep type-checking. Note that calling `type.check` is not enough: see `lib.mkOptionType`'s documentation.
+  # We don't include this in lib for now because this function is flawed: it accepts things like `mkIf true 42`.
+  typeCheck = type: value: let
+    merged = lib.mergeDefinitions [ ] type [
+      { file = lib.unknownModule; inherit value; }
+    ];
+    eval = builtins.tryEval (builtins.deepSeq merged.mergedValue null);
+  in eval.success;

-  # A shallow type check. We are using NixOS'
-  # option types here, which however have the major drawback
-  # of not providing full type checking (part of the type check is
-  # done by the module evaluation itself). Therefore, the checks
-  # will not recurse into attributes.
-  # We still provide the full type for documentation
-  # purposes and in the hope that they will be used eventually.
-  # See https://github.com/NixOS/nixpkgs/pull/191171 for an attempt
-  # to fix this, or mkOptionType in lib/types.nix for more information.
+  # TODO make this into a proper module and use the generic option documentation generation?
  metaTypes = with lib.types; rec {
    # These keys are documented
    description = str;
@@ -266,9 +266,11 @@ let
    homepage = either (listOf str) str;
    downloadPage = str;
    changelog = either (listOf str) str;
-    license = either (listOf lib.types.attrs) (either lib.types.attrs str);
-    sourceProvenance = either (listOf lib.types.attrs) lib.types.attrs;
-    maintainers = listOf (attrsOf str);
+    license = let
+      licenseType = either (attrsOf anything) str; # TODO disallow `str` licenses, use a module
+    in either licenseType (listOf licenseType);
+    sourceProvenance = either (listOf (attrsOf anything)) (attrsOf anything);
+    maintainers = listOf (attrsOf anything); # TODO use the maintainer type from lib/tests/maintainer-module.nix
    priority = int;
    platforms = listOf str;
    hydraPlatforms = listOf str;
@@ -310,16 +312,16 @@ let
    badPlatforms = platforms;
  };

-  # WARNING: this does not check inner values of the attribute, like list elements or nested attributes.
-  # See metaTypes above and mkOptionType in lib/types.nix for more information
  checkMetaAttr = k: v:
    if metaTypes?${k} then
-      if metaTypes.${k}.check v then
+      if typeCheck metaTypes.${k} v then
        null
      else
-        "key 'meta.${k}' has a value of invalid type ${builtins.typeOf v}; expected ${metaTypes.${k}.description}"
+        "key 'meta.${k}' has invalid value; expected ${metaTypes.${k}.description}, got\n    ${
+          lib.generators.toPretty { indent = "    "; } v
+        }"
    else
-      "key 'meta.${k}' is unrecognized; expected one of: \n\t      [${lib.concatMapStringsSep ", " (x: "'${x}'") (lib.attrNames metaTypes)}]";
+      "key 'meta.${k}' is unrecognized; expected one of: \n  [${lib.concatMapStringsSep ", " (x: "'${x}'") (lib.attrNames metaTypes)}]";
  checkMeta = meta: if config.checkMeta then lib.remove null (lib.mapAttrsToList checkMetaAttr meta) else [];

  checkOutputsToInstall = attrs: let
@@ -333,25 +335,27 @@ let
  # Check if a derivation is valid, that is whether it passes checks for
  # e.g brokenness or license.
  #
-  # Return { valid: Bool } and additionally
+  # Return { valid: "yes", "warn" or "no" } and additionally
  # { reason: String; errormsg: String } if it is not valid, where
  # reason is one of "unfree", "blocklisted", "broken", "insecure", ...
+  # !!! reason strings are hardcoded into OfBorg, make sure to keep them in sync
  # Along with a boolean flag for each reason
  checkValidity = attrs:
-    {
+    # Check meta attribute types first, to make sure it is always called even when there are other issues
+    # Note that this is not a full type check and functions below still need to by careful about their inputs!
+    let res = checkMeta (attrs.meta or {}); in if res != [] then
+      { valid = "no"; reason = "unknown-meta"; errormsg = "has an invalid meta attrset:${lib.concatMapStrings (x: "\n  - " + x) res}\n";
+        unfree = false; nonSource = false; broken = false; unsupported = false; insecure = false;
+      }
+    else {
      unfree = hasUnfreeLicense attrs;
      nonSource = hasNonSourceProvenance attrs;
      broken = isMarkedBroken attrs;
      unsupported = hasUnsupportedPlatform attrs;
      insecure = isMarkedInsecure attrs;
-    }
-    // (
-    # Check meta attribute types first, to make sure it is always called even when there are other issues
-    # Note that this is not a full type check and functions below still need to by careful about their inputs!
-    let res = checkMeta (attrs.meta or {}); in if res != [] then
-      { valid = "no"; reason = "unknown-meta"; errormsg = "has an invalid meta attrset:${lib.concatMapStrings (x: "\n\t - " + x) res}"; }
+    } // (
    # --- Put checks that cannot be ignored here ---
-    else if checkOutputsToInstall attrs then
+    if checkOutputsToInstall attrs then
      { valid = "no"; reason = "broken-outputs"; errormsg = "has invalid meta.outputsToInstall"; }

    # --- Put checks that can be ignored here ---
@@ -6,14 +6,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "svg2pdf";
-  version = "0.4.0";
+  version = "0.4.1";
  # This cargo package is usually a library, hence it does not track a
  # Cargo.lock by default so we use fetchCrate
  src = fetchCrate {
    inherit version pname;
-    sha256 = "2Aw8VYFVw0rKeaDUTsYTHcHBDP1jLm4tVGfi6+RNK9E=";
+    sha256 = "sha256-0sjJIHD+x9P7FPLNwTXYcetbU4Ck5K4pFGF5cMI3+rk=";
  };
-  cargoSha256 = "KADfBOnkY1T1xy4Oj7s85SXcDhjRhQQ2hWGWinMXux8=";
+  cargoSha256 = "sha256-vjDV604HDwlaxwq5iQbGOKXmLTRgx1oZ824HXBSiouw=";
  buildFeatures = [ "cli" ];

  doCheck = true;
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "moar";
-  version = "1.11.1";
+  version = "1.11.2";

  src = fetchFromGitHub {
    owner = "walles";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-jIxZAslqkQU51O9ZSvlVZ3sCZpFYQTtuPpS2tEXXLzo=";
+    sha256 = "sha256-UzgGJrnckiuUT4JYSTQ4TargO4B2sjVMMOYygg7wGps=";
  };

-  vendorSha256 = "sha256-RfkY66879Us0UudplMzW8xEC1zs+2OXwyB+nBim3I0I=";
+  vendorSha256 = "sha256-XexIBg49gK+b2Zef5eR7NfqFZHPp5DXhlcC3Loh6PfI=";

  nativeBuildInputs = [ installShellFiles ];

@@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, perl, gettext, pkg-config, libidn2, libiconv }:

 stdenv.mkDerivation rec {
-  version = "5.5.14";
+  version = "5.5.15";
  pname = "whois";

  src = fetchFromGitHub {
    owner = "rfc1036";
    repo = "whois";
    rev = "v${version}";
-    sha256 = "sha256-UTUsuu/CGWhx9zYr7ppnJd7pumb6nGEyVwtJwC0loZ0=";
+    sha256 = "sha256-kx9Rl4w44zNDSfCMn5PEmQ1jP0Zxa/fYPlZPQnAp4xI=";
  };

  nativeBuildInputs = [ perl gettext pkg-config ];
@@ -37,10 +37,11 @@ stdenv.mkDerivation rec {
      --replace /usr/bin $out/bin
  '' + lib.optionalString stdenv.isLinux ''
    for f in $out/bin/*; do
-      # allow users to provide their own resolvconf implementation, e.g. the one provided by systemd-resolved
+      # Which firewall and resolvconf implementations to use should be determined by the
+      # environment, we provide the "default" ones as fallback.
      wrapProgram $f \
-        --prefix PATH : ${lib.makeBinPath [ procps iproute2 iptables ]} \
-        --suffix PATH : ${lib.makeBinPath [ openresolv ]}
+        --prefix PATH : ${lib.makeBinPath [ procps iproute2 ]} \
+        --suffix PATH : ${lib.makeBinPath [ iptables openresolv ]}
    done
  '';

@@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "firefox_decrypt";
-  version = "unstable-2021-12-29";
+  version = "unstable-2022-12-21";

  src = fetchFromGitHub {
    owner = "unode";
    repo = pname;
-    rev = "a3daadc09603a6cf8c4b7e49a59776340bc885e7";
-    sha256 = "0g219zqbdnhh9j09d9a0b81vr6j44zzk13ckl5fzkr10gqndiscc";
+    rev = "84bb368cc2f8d2055a8374ab1a40c403e0486859";
+    sha256 = "sha256-dyQTf6fgsQEmp++DeXl85nvyezm0Lq9onyfIdhQoGgI=";
  };

  nativeBuildInputs = [ wrapPython ];
@@ -38,7 +38,7 @@ let
    meta = oa.meta // {
      description = "Using OnlyKey as hardware SSH and GPG agent";
      homepage = "https://github.com/trustcrypto/onlykey-agent/tree/ledger";
-      maintainers = with maintainers; [ kalbasit ];
+      maintainers = with lib.maintainers; [ kalbasit ];
    };
  });
 in
@@ -1,14 +1,25 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, libewf, afflib, openssl, zlib, openjdk, perl, ant }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, libewf
+, afflib
+, openssl
+, zlib
+, openjdk
+, perl
+, ant
+}:

 stdenv.mkDerivation rec {
-  version = "4.11.1";
+  version = "4.12.0";
  pname = "sleuthkit";

  sleuthsrc = fetchFromGitHub {
    owner = "sleuthkit";
    repo = "sleuthkit";
    rev = "${pname}-${version}";
-    sha256 = "sha256-TM8My4dAZigukwMUNDnP3aVCQ8JDdVv/KNkchDvCl9I=";
+    hash = "sha256-NX7LNtor7UQJ6HCDz9wGpxbqrLQTTH9+543hOaQOAz4=";
  };

  # Fetch libraries using a fixed output derivation
@@ -16,7 +27,10 @@ stdenv.mkDerivation rec {

    version = "1.0";
    pname = "sleuthkit-deps";
-    nativeBuildInputs = [ openjdk ant ];
+    nativeBuildInputs = [
+      openjdk
+      ant
+    ];

    src = sleuthsrc;

@@ -56,8 +70,20 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  nativeBuildInputs = [ autoreconfHook openjdk perl ant rdeps ];
-  buildInputs = [ libewf afflib openssl zlib ];
+  nativeBuildInputs = [
+    autoreconfHook
+    openjdk
+    perl
+    ant
+    rdeps
+  ];
+
+  buildInputs = [
+    libewf
+    afflib
+    openssl
+    zlib
+  ];

  # Hack to fix the RPATH
  preFixup = ''
@@ -82,6 +108,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "A forensic/data recovery tool";
    homepage = "https://www.sleuthkit.org/";
+    changelog = "https://github.com/sleuthkit/sleuthkit/releases/tag/sleuthkit-${version}";
    maintainers = with maintainers; [ raskin gfrascadorio ];
    platforms = platforms.linux;
    sourceProvenance = with sourceTypes; [
@@ -36024,6 +36024,8 @@ with pkgs;

  xflr5 = libsForQt5.callPackage ../applications/science/physics/xflr5 { };

+  xnec2c = callPackage ../applications/science/physics/xnec2c { };
+
  ### SCIENCE/PROGRAMMING

  dafny = dotnetPackages.Dafny;
@@ -2590,6 +2590,8 @@ self: super: with self; {

  django-scopes = callPackage ../development/python-modules/django-scopes { };

+  django-scim2 = callPackage ../development/python-modules/django-scim2 { };
+
  djangoql = callPackage ../development/python-modules/djangoql { };

  django-ranged-response = callPackage ../development/python-modules/django-ranged-response { };
@@ -10107,6 +10109,8 @@ self: super: with self; {

  schwifty = callPackage ../development/python-modules/schwifty { };

+  scim2-filter-parser = callPackage ../development/python-modules/scim2-filter-parser { };
+
  scikit-bio = callPackage ../development/python-modules/scikit-bio { };

  scikit-build = callPackage ../development/python-modules/scikit-build { };