From d6dbe0703566c8d6baa2246a6eb79a53365199c9 Mon Sep 17 00:00:00 2001
From: marius david <mariusdavid@laposte.net>
Date: Mon, 8 Nov 2021 23:49:47 +0100
Subject: [PATCH 01/76] patool: fix the non-use of hard-coded binary

---
 pkgs/development/python-modules/patool/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/patool/default.nix b/pkgs/development/python-modules/patool/default.nix
index 2fa07d32ccb1..3c4d971240f6 100644
--- a/pkgs/development/python-modules/patool/default.nix
+++ b/pkgs/development/python-modules/patool/default.nix
@@ -3,6 +3,7 @@
   gzip, bzip2, xz}:
 
 # unrar is unfree, as well as 7z with unrar support, not including it (patool doesn't support unar)
+# it will still use unrar if present in the path
 
 let
   compression-utilities = [
@@ -34,9 +35,9 @@ buildPythonPackage rec {
     sha256 = "0v4r77sm3yzh7y1whfwxmp01cchd82jbhvbg9zsyd2yb944imzjy";
   };
 
-  prePatch = ''
+  postPatch = ''
     substituteInPlace patoolib/util.py \
-      --replace "path = None" 'path = append_to_path(os.environ["PATH"], "${lib.makeBinPath compression-utilities}")'
+      --replace "path = None" 'path = os.environ["PATH"] + ":${lib.makeBinPath compression-utilities}"'
   '';
 
   checkInputs = [ pytestCheckHook ] ++ compression-utilities;

From 87f831c382113e79d3e1a62c15d8ba048347fd57 Mon Sep 17 00:00:00 2001
From: marius david <mariusdavid@laposte.net>
Date: Fri, 6 May 2022 10:54:45 +0200
Subject: [PATCH 02/76] patool: remove unused compression utilities

---
 pkgs/development/python-modules/patool/default.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/patool/default.nix b/pkgs/development/python-modules/patool/default.nix
index 3c4d971240f6..cbc3a05044ee 100644
--- a/pkgs/development/python-modules/patool/default.nix
+++ b/pkgs/development/python-modules/patool/default.nix
@@ -1,5 +1,5 @@
 { lib, buildPythonPackage, fetchFromGitHub, pytestCheckHook, p7zip,
-  unzip, cabextract, zip, zopfli, lzip, zpaq, gnutar, gnugrep, diffutils, file,
+  cabextract, zip, lzip, zpaq, gnutar, gnugrep, diffutils, file,
   gzip, bzip2, xz}:
 
 # unrar is unfree, as well as 7z with unrar support, not including it (patool doesn't support unar)
@@ -8,11 +8,9 @@
 let
   compression-utilities = [
     p7zip
-    unzip
     gnutar
     cabextract
     zip
-    zopfli
     lzip
     zpaq
     gzip

From a1ba737c5ee13938f9d4208b2c67073caed14a2b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Tue, 24 May 2022 07:17:28 +0200
Subject: [PATCH 03/76] folly: enable jemalloc

Folly does take advantage of jemalloc to expand allocations in-place when possible.
---
 pkgs/development/libraries/folly/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/folly/default.nix b/pkgs/development/libraries/folly/default.nix
index c3fe3ba2ce76..e2057b873cd0 100644
--- a/pkgs/development/libraries/folly/default.nix
+++ b/pkgs/development/libraries/folly/default.nix
@@ -16,6 +16,7 @@
 , xz
 , zlib
 , zstd
+, jemalloc
 , follyMobile ? false
 }:
 
@@ -50,7 +51,10 @@ stdenv.mkDerivation rec {
     libunwind
     fmt_8
     zstd
-  ];
+  ] ++ lib.optional stdenv.isLinux jemalloc;
+
+  # jemalloc headers are required in include/folly/portability/Malloc.h
+  propagatedBuildInputs = lib.optional stdenv.isLinux jemalloc;
 
   NIX_CFLAGS_COMPILE = [ "-DFOLLY_MOBILE=${if follyMobile then "1" else "0"}" "-fpermissive" ];
   cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ];

From 360b31707a08803bd54a44a078e95e4c539450c2 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Mon, 30 May 2022 10:44:34 -0700
Subject: [PATCH 04/76] purescript: mark meta.sourceProvenance

---
 pkgs/development/compilers/purescript/purescript/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/compilers/purescript/purescript/default.nix b/pkgs/development/compilers/purescript/purescript/default.nix
index 46d74309660a..1920793859bd 100644
--- a/pkgs/development/compilers/purescript/purescript/default.nix
+++ b/pkgs/development/compilers/purescript/purescript/default.nix
@@ -61,6 +61,7 @@ in stdenv.mkDerivation rec {
     description = "A strongly-typed functional programming language that compiles to JavaScript";
     homepage = "https://www.purescript.org/";
     license = licenses.bsd3;
+    sourceProvenance = with lib.source-types; [ binaryNativeCode ];
     maintainers = with maintainers; [ justinwoo mbbx6spp cdepillabout ];
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
     mainProgram = "purs";

From 16ad8ea53c95f9f9902a0c3a8c5d3968f9b88128 Mon Sep 17 00:00:00 2001
From: Adam Joseph <adam@westernsemico.com>
Date: Mon, 30 May 2022 11:07:31 -0700
Subject: [PATCH 05/76] s/sourceTypes/source-types/

---
 pkgs/development/compilers/purescript/purescript/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/purescript/purescript/default.nix b/pkgs/development/compilers/purescript/purescript/default.nix
index 1920793859bd..8daed0ff7839 100644
--- a/pkgs/development/compilers/purescript/purescript/default.nix
+++ b/pkgs/development/compilers/purescript/purescript/default.nix
@@ -61,7 +61,7 @@ in stdenv.mkDerivation rec {
     description = "A strongly-typed functional programming language that compiles to JavaScript";
     homepage = "https://www.purescript.org/";
     license = licenses.bsd3;
-    sourceProvenance = with lib.source-types; [ binaryNativeCode ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with maintainers; [ justinwoo mbbx6spp cdepillabout ];
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
     mainProgram = "purs";

From 4258952dc69ea2b2063b53c584d2d285b9423abe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 18 Jun 2022 16:59:31 +0200
Subject: [PATCH 06/76] nixos/jellyfin: sync up with hardening provided in
 upstream

---
 nixos/modules/services/misc/jellyfin.nix | 67 +++++++++++++-----------
 1 file changed, 36 insertions(+), 31 deletions(-)

diff --git a/nixos/modules/services/misc/jellyfin.nix b/nixos/modules/services/misc/jellyfin.nix
index 789b78702e9b..7b31bfc1f8ff 100644
--- a/nixos/modules/services/misc/jellyfin.nix
+++ b/nixos/modules/services/misc/jellyfin.nix
@@ -49,7 +49,10 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
+      # This is mostly follows: https://github.com/jellyfin/jellyfin/blob/master/debian/jellyfin.service
+      # Upstream also disable some hardenings when running in LXC, we do the same with the isContainer option
       serviceConfig = rec {
+        Type = "simple";
         User = cfg.user;
         Group = cfg.group;
         StateDirectory = "jellyfin";
@@ -57,48 +60,50 @@ in
         CacheDirectory = "jellyfin";
         CacheDirectoryMode = "0700";
         UMask = "0077";
+        WorkingDirectory = "/var/lib/jellyfin";
         ExecStart = "${cfg.package}/bin/jellyfin --datadir '/var/lib/${StateDirectory}' --cachedir '/var/cache/${CacheDirectory}'";
         Restart = "on-failure";
+        TimeoutSec = 15;
+        SuccessExitStatus = ["0" "143"];
 
         # Security options:
-
         NoNewPrivileges = true;
-
-        AmbientCapabilities = "";
-        CapabilityBoundingSet = "";
-
-        # ProtectClock= adds DeviceAllow=char-rtc r
-        DeviceAllow = "";
-
-        LockPersonality = true;
-
-        PrivateTmp = true;
-        # Disabled to allow Jellyfin to access hw accel devices endpoints
-        # PrivateDevices = true;
-        PrivateUsers = true;
-
-        # Disabled as it does not allow Jellyfin to interface with CUDA devices
-        # ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-
-        RemoveIPC = true;
-
-        RestrictNamespaces = true;
+        SystemCallArchitectures = "native";
         # AF_NETLINK needed because Jellyfin monitors the network connection
-        RestrictAddressFamilies = [ "AF_NETLINK" "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK" ];
+        RestrictNamespaces = !config.boot.isContainer;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
+        ProtectControlGroups = !config.boot.isContainer;
+        ProtectHostname = true;
+        ProtectKernelLogs = !config.boot.isContainer;
+        ProtectKernelModules = !config.boot.isContainer;
+        ProtectKernelTunables = !config.boot.isContainer;
+        LockPersonality = true;
+        PrivateTmp = !config.boot.isContainer;
+        # needed for hardware accelaration
+        PrivateDevices = false;
+        PrivateUsers = true;
+        RemoveIPC = true;
 
-        SystemCallArchitectures = "native";
-        SystemCallErrorNumber = "EPERM";
         SystemCallFilter = [
-          "@system-service"
-          "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid"
+          "~@clock"
+          "~@aio"
+          "~@chown"
+          "~@cpu-emulation"
+          "~@debug"
+          "~@keyring"
+          "~@memlock"
+          "~@module"
+          "~@mount"
+          "~@obsolete"
+          "~@privileged"
+          "~@raw-io"
+          "~@reboot"
+          "~@setuid"
+          "~@swap"
         ];
+        SystemCallErrorNumber = "EPERM";
       };
     };
 

From 5f1923d67e1ecdc2176f017d7d2008aa1c908baf Mon Sep 17 00:00:00 2001
From: Jari Vetoniemi <mailroxas@gmail.com>
Date: Wed, 29 Jun 2022 18:24:19 +0900
Subject: [PATCH 07/76] androidenv: fix android cross-compilers

These were completely broken. Even if they managed to output a binary,
it wouldn't actually run on the actual device.
---
 .../androidndk-pkgs/androidndk-pkgs.nix       | 143 ++++++++++++++----
 pkgs/development/androidndk-pkgs/default.nix  |   4 +-
 .../mobile/androidenv/ndk-bundle/default.nix  |  11 +-
 3 files changed, 125 insertions(+), 33 deletions(-)

diff --git a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
index 736e088454e7..dc9802ea7f9e 100644
--- a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
+++ b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
@@ -1,6 +1,6 @@
 { lib, stdenv
-, makeWrapper
-, runCommand, wrapBintoolsWith, wrapCCWith
+, makeWrapper, python
+, runCommand, wrapBintoolsWith, wrapCCWith, autoPatchelfHook
 , buildAndroidndk, androidndk, targetAndroidndkPkgs
 }:
 
@@ -11,6 +11,9 @@ let
   # N.B. The Android NDK uses slightly different LLVM-style platform triples
   # than we do. We don't just use theirs because ours are less ambiguous and
   # some builds need that clarity.
+  #
+  # FIXME:
+  # There's some dragons here. Build host and target concepts are being mixed up.
   ndkInfoFun = { config, ... }: {
     x86_64-apple-darwin = {
       double = "darwin-x86_64";
@@ -21,65 +24,123 @@ let
     i686-unknown-linux-android = {
       triple = "i686-linux-android";
       arch = "x86";
+      # LEGACY
       toolchain = "x86";
       gccVer = "4.9";
     };
     x86_64-unknown-linux-android = {
       triple = "x86_64-linux-android";
       arch = "x86_64";
+      # LEGACY
       toolchain = "x86_64";
       gccVer = "4.9";
     };
     armv7a-unknown-linux-androideabi = {
       arch = "arm";
       triple = "arm-linux-androideabi";
+      # LEGACY
       toolchain = "arm-linux-androideabi";
       gccVer = "4.9";
     };
     aarch64-unknown-linux-android = {
       arch = "arm64";
       triple = "aarch64-linux-android";
+      # LEGACY
       toolchain = "aarch64-linux-android";
       gccVer = "4.9";
     };
   }.${config} or
     (throw "Android NDK doesn't support ${config}, as far as we know");
 
+  buildInfo = ndkInfoFun stdenv.buildPlatform;
   hostInfo = ndkInfoFun stdenv.hostPlatform;
   targetInfo = ndkInfoFun stdenv.targetPlatform;
 
-  prefix = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) (stdenv.targetPlatform.config + "-");
+  inherit (stdenv.targetPlatform) sdkVer;
+  suffixSalt = lib.replaceStrings ["-" "."] ["_" "_"] stdenv.targetPlatform.config;
+
+  # targetInfo.triple is what Google thinks the toolchain should be, this is a little
+  # different from what we use. We make it four parts to conform with the existing
+  # standard more properly.
+  targetConfig = lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform) (stdenv.targetPlatform.config);
 in
 
 rec {
   # Misc tools
-  binaries = runCommand "ndk-toolchain-binutils" {
-    pname = "ndk-toolchain-binutils";
+  binaries = stdenv.mkDerivation {
+    pname = "${targetConfig}-ndk-toolchain";
     inherit (androidndk) version;
-    nativeBuildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper python autoPatchelfHook ];
     propagatedBuildInputs = [ androidndk ];
     passthru = {
-      targetPrefix = prefix;
       isClang = true; # clang based cc, but bintools ld
     };
-  } ''
-    mkdir -p $out/bin
+    dontUnpack = true;
+    dontBuild = true;
+    dontStrip = true;
+    dontConfigure = true;
+    dontPatch = true;
+    autoPatchelfIgnoreMissingDeps = true;
+    installPhase = ''
+      if [ ! -d ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double} ]; then
+        # LEGACY: make-standalone-toolchain is deprecated
+        #         https://developer.android.com/ndk/guides/standalone_toolchain
+        ${androidndk}/libexec/android-sdk/ndk-bundle/build/tools/make-standalone-toolchain.sh --arch=${targetInfo.arch} --install-dir=$out/toolchain --platform=${sdkVer} --force
+      else
+        # https://developer.android.com/ndk/guides/other_build_systems
+        mkdir -p $out
+        cp -r ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double} $out/toolchain
+        find $out/toolchain -type d -exec chmod 777 {} \;
+      fi
 
-    # llvm toolchain
-    for prog in ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${hostInfo.double}/bin/*; do
-      ln -s $prog $out/bin/$(basename $prog)
-      ln -s $prog $out/bin/${prefix}$(basename $prog)
-    done
+      if [ ! -d $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer} ]; then
+        echo "NDK does not contain libraries for SDK version ${sdkVer}";
+        exit 1
+      fi
 
-    # bintools toolchain
-    for prog in ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/${targetInfo.toolchain}-${targetInfo.gccVer}/prebuilt/${hostInfo.double}/bin/*; do
-      prog_suffix=$(basename $prog | sed 's/${targetInfo.triple}-//')
-      ln -s $prog $out/bin/${stdenv.targetPlatform.config}-$prog_suffix
-    done
+      ln -vfs $out/toolchain/sysroot/usr/lib $out/lib
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.so $out/lib/
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/*.a $out/lib/
+      chmod +w $out/lib/*
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}/*.so $out/lib/
+      ln -s $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}/*.o $out/lib/
 
-    # shitty googly wrappers
-    rm -f $out/bin/${stdenv.targetPlatform.config}-gcc $out/bin/${stdenv.targetPlatform.config}-g++
-  '';
+      echo "INPUT(-lc++_static)" > $out/lib/libc++.a
+
+      ln -s $out/toolchain/bin $out/bin
+      ln -s $out/toolchain/${targetInfo.triple}/bin/* $out/bin/
+      for f in $out/bin/${targetInfo.triple}-*; do
+        ln -s $f ''${f/${targetInfo.triple}-/${targetConfig}-}
+      done
+      for f in $(find $out/toolchain -type d -name ${targetInfo.triple}); do
+        ln -s $f ''${f/${targetInfo.triple}/${targetConfig}}
+      done
+
+      # LEGACY: get rid of gcc and g++, otherwise wrapCCWith will use them instead of clang
+      rm -f $out/bin/${targetConfig}-gcc $out/bin/${targetConfig}-g++
+
+      # LEGACY: ld doesn't properly include transitive library dependencies.
+      #         Let's use gold instead
+      rm -f $out/bin/${targetConfig}-ld
+      if [[ -f  $out/bin/${targetConfig}-ld.gold ]]; then
+        ln -s $out/bin/${targetConfig}-ld.gold $out/bin/${targetConfig}-ld
+      else
+        ln -s $out/bin/lld $out/bin/${targetConfig}-ld
+      fi
+
+      (cd $out/bin;
+        for tool in llvm-*; do
+          ln -sf $tool ${targetConfig}-$(echo $tool | sed 's/llvm-//')
+          ln -sf $tool $(echo $tool | sed 's/llvm-//')
+        done)
+
+      # handle last, as llvm-as is for llvm bytecode
+      ln -sf $out/bin/${targetInfo.triple}-as $out/bin/${targetConfig}-as
+      ln -sf $out/bin/${targetInfo.triple}-as $out/bin/as
+
+      patchShebangs $out/bin
+    '';
+  };
 
   binutils = wrapBintoolsWith {
     bintools = binaries;
@@ -95,9 +156,22 @@ rec {
     libc = targetAndroidndkPkgs.libraries;
     extraBuildCommands = ''
       echo "-D__ANDROID_API__=${stdenv.targetPlatform.sdkVer}" >> $out/nix-support/cc-cflags
-      echo "-target ${stdenv.targetPlatform.config}" >> $out/nix-support/cc-cflags
-      echo "-resource-dir=$(echo ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${hostInfo.double}/lib*/clang/*)" >> $out/nix-support/cc-cflags
-      echo "--gcc-toolchain=${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/${targetInfo.toolchain}-${targetInfo.gccVer}/prebuilt/${hostInfo.double}" >> $out/nix-support/cc-cflags
+      if [ ! -d ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${hostInfo.double} ]; then
+        # LEGACY: probably won't work for any recent android
+        echo "--gcc-toolchain=${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/${targetInfo.toolchain}-${targetInfo.gccVer}/prebuilt/${hostInfo.double}" >> $out/nix-support/cc-cflags
+        echo "-fuse-ld=$out/bin/${targetConfig}-ld.gold -L${binaries}/lib" >> $out/nix-support/cc-ldflags
+      else
+        # Android needs executables linked with -pie since version 5.0
+        # Use -fPIC for compilation, and link with -pie if no -shared flag used in ldflags
+        echo "-target ${targetInfo.triple} -fPIC" >> $out/nix-support/cc-cflags
+        echo "-z,noexecstack -z,relro -z,now" >> $out/nix-support/cc-ldflags
+        echo 'if [[ ! " $@ " =~ " -shared " ]]; then NIX_LDFLAGS_${suffixSalt}+=" -pie"; fi' >> $out/nix-support/add-flags.sh
+        echo "-Xclang -mnoexecstack" >> $out/nix-support/cc-cxxflags
+      fi
+      if [ ${targetInfo.triple} == arm-linux-androideabi ]; then
+        # https://android.googlesource.com/platform/external/android-cmake/+/refs/heads/cmake-master-dev/android.toolchain.cmake
+        echo "--fix-cortex-a8" >> $out/nix-support/cc-ldflags
+      fi
     '';
   };
 
@@ -107,10 +181,19 @@ rec {
   # cross-compiling packages to wrap incorrectly wrap binaries we don't include
   # anyways.
   libraries = runCommand "bionic-prebuilt" {} ''
-    mkdir -p $out
-    cp -r ${buildAndroidndk}/libexec/android-sdk/ndk-bundle/sysroot/usr/include $out/include
-    chmod +w $out/include
-    cp -r ${buildAndroidndk}/libexec/android-sdk/ndk-bundle/sysroot/usr/include/${targetInfo.triple}/* $out/include
-    ln -s ${buildAndroidndk}/libexec/android-sdk/ndk-bundle/platforms/android-${stdenv.hostPlatform.sdkVer}/arch-${hostInfo.arch}/usr/${if hostInfo.arch == "x86_64" then "lib64" else "lib"} $out/lib
+    if [ -d ${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt ]; then
+      lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double}/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}
+    else
+      # LEGACY
+      lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/platforms/android-${sdkVer}/arch-${hostInfo.arch}/usr/${if hostInfo.arch == "x86_64" then "lib64" else "lib"}
+    fi
+    if [ ! -d $lpath ]; then
+      echo "NDK does not contain libraries for SDK version ${sdkVer} <$lpath>"
+      exit 1
+    fi
+    mkdir -p $out/lib
+    cp $lpath/*.so $lpath/*.a $out/lib
+    chmod +w $out/lib/*
+    cp $lpath/* $out/lib
   '';
 }
diff --git a/pkgs/development/androidndk-pkgs/default.nix b/pkgs/development/androidndk-pkgs/default.nix
index 5f71304d3855..1648a918b87b 100644
--- a/pkgs/development/androidndk-pkgs/default.nix
+++ b/pkgs/development/androidndk-pkgs/default.nix
@@ -19,7 +19,7 @@
     import ./androidndk-pkgs.nix {
       inherit lib;
       inherit (buildPackages)
-        makeWrapper;
+        makeWrapper python autoPatchelfHook;
       inherit (pkgs)
         stdenv
         runCommand wrapBintoolsWith wrapCCWith;
@@ -49,7 +49,7 @@
     import ./androidndk-pkgs.nix {
       inherit lib;
       inherit (buildPackages)
-        makeWrapper;
+        makeWrapper python autoPatchelfHook;
       inherit (pkgs)
         stdenv
         runCommand wrapBintoolsWith wrapCCWith;
diff --git a/pkgs/development/mobile/androidenv/ndk-bundle/default.nix b/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
index 58cc8f9d5709..28c7ca62b26d 100644
--- a/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
+++ b/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
@@ -16,7 +16,7 @@ deployAndroidPackage {
   patchInstructions = lib.optionalString (os == "linux") (''
     patchShebangs .
 
-    # Fix the shebangs of the auto-generated scripts.
+    # LEGACY: Fix the shebangs of the auto-generated scripts.
     substituteInPlace ./build/tools/make_standalone_toolchain.py \
       --replace '#!/bin/bash' '#!${pkgs.bash}/bin/bash'
 
@@ -29,6 +29,15 @@ deployAndroidPackage {
     # TODO: allow this stuff
     rm -rf docs tests
 
+    # Ndk now has a prebuilt toolchains inside, the file layout has changed, we do a symlink
+    # to still support the old standalone toolchains builds.
+    if [ -d $out/libexec/android-sdk/ndk ] && [ ! -d $out/libexec/android-sdk/ndk-bundle ]; then
+        ln -sf $out/libexec/android-sdk/ndk/${package.revision} $out/libexec/android-sdk/ndk-bundle
+    else
+        echo "The ndk-bundle layout has changed. The nix expressions have to be updated!"
+        exit 1
+    fi
+
     # Patch the executables of the toolchains, but not the libraries -- they are needed for crosscompiling
     if [ -d $out/libexec/android-sdk/ndk-bundle/toolchains/renderscript/prebuilt/linux-x86_64/lib64 ]; then
         addAutoPatchelfSearchPath $out/libexec/android-sdk/ndk-bundle/toolchains/renderscript/prebuilt/linux-x86_64/lib64

From 0aded46f0838502361356497fc37825a9c3f9410 Mon Sep 17 00:00:00 2001
From: Jari Vetoniemi <mailroxas@gmail.com>
Date: Sun, 26 Jun 2022 03:20:13 +0900
Subject: [PATCH 08/76] androidenv: update packages

---
 pkgs/development/androidndk-pkgs/default.nix  |  60 +++
 .../androidenv/compose-android-packages.nix   |   6 +-
 pkgs/development/mobile/androidenv/repo.json  | 412 ++++++++++++++----
 pkgs/top-level/all-packages.nix               |   2 +
 4 files changed, 398 insertions(+), 82 deletions(-)

diff --git a/pkgs/development/androidndk-pkgs/default.nix b/pkgs/development/androidndk-pkgs/default.nix
index 1648a918b87b..cd076653ebd7 100644
--- a/pkgs/development/androidndk-pkgs/default.nix
+++ b/pkgs/development/androidndk-pkgs/default.nix
@@ -62,4 +62,64 @@
       targetAndroidndkPkgs = targetPackages.androidndkPkgs_21;
     };
 
+  "23b" =
+    let
+      ndkVersion = "23.1.7779620";
+
+      buildAndroidComposition = buildPackages.buildPackages.androidenv.composeAndroidPackages {
+        includeNDK = true;
+        inherit ndkVersion;
+      };
+
+      androidComposition = androidenv.composeAndroidPackages {
+        includeNDK = true;
+        inherit ndkVersion;
+      };
+    in
+    import ./androidndk-pkgs.nix {
+      inherit lib;
+      inherit (buildPackages)
+        makeWrapper python autoPatchelfHook;
+      inherit (pkgs)
+        stdenv
+        runCommand wrapBintoolsWith wrapCCWith;
+      # buildPackages.foo rather than buildPackages.buildPackages.foo would work,
+      # but for splicing messing up on infinite recursion for the variants we
+      # *dont't* use. Using this workaround, but also making a test to ensure
+      # these two really are the same.
+      buildAndroidndk = buildAndroidComposition.ndk-bundle;
+      androidndk = androidComposition.ndk-bundle;
+      targetAndroidndkPkgs = targetPackages.androidndkPkgs_23b;
+    };
+
+  "24" =
+    let
+      ndkVersion = "24.0.8215888";
+
+      buildAndroidComposition = buildPackages.buildPackages.androidenv.composeAndroidPackages {
+        includeNDK = true;
+        inherit ndkVersion;
+      };
+
+      androidComposition = androidenv.composeAndroidPackages {
+        includeNDK = true;
+        inherit ndkVersion;
+      };
+    in
+    import ./androidndk-pkgs.nix {
+      inherit lib;
+      inherit (buildPackages)
+        makeWrapper python autoPatchelfHook;
+      inherit (pkgs)
+        stdenv
+        runCommand wrapBintoolsWith wrapCCWith;
+      # buildPackages.foo rather than buildPackages.buildPackages.foo would work,
+      # but for splicing messing up on infinite recursion for the variants we
+      # *dont't* use. Using this workaround, but also making a test to ensure
+      # these two really are the same.
+      buildAndroidndk = buildAndroidComposition.ndk-bundle;
+      androidndk = androidComposition.ndk-bundle;
+      targetAndroidndkPkgs = targetPackages.androidndkPkgs_24;
+    };
+
 }
diff --git a/pkgs/development/mobile/androidenv/compose-android-packages.nix b/pkgs/development/mobile/androidenv/compose-android-packages.nix
index 8270960d9b99..c6d838544e9c 100644
--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@@ -3,7 +3,7 @@
 }:
 
 { toolsVersion ? "26.1.1"
-, platformToolsVersion ? "33.0.1"
+, platformToolsVersion ? "33.0.2"
 , buildToolsVersions ? [ "32.0.0" ]
 , includeEmulator ? false
 , emulatorVersion ? "31.3.7"
@@ -11,7 +11,7 @@
 , includeSources ? false
 , includeSystemImages ? false
 , systemImageTypes ? [ "google_apis_playstore" ]
-, abiVersions ? [ "armeabi-v7a" ]
+, abiVersions ? [ "armeabi-v7a" "arm64-v8a" ]
 , cmakeVersions ? [ ]
 , includeNDK ? false
 , ndkVersion ? "24.0.8215888"
@@ -181,7 +181,7 @@ rec {
   makeNdkBundle = ndkVersion:
     import ./ndk-bundle {
       inherit deployAndroidPackage os autoPatchelfHook makeWrapper pkgs pkgsHostHost lib platform-tools stdenv;
-      package = packages.ndk-bundle.${ndkVersion};
+      package = packages.ndk-bundle.${ndkVersion} or packages.ndk.${ndkVersion};
     };
 
   # All NDK bundles.
diff --git a/pkgs/development/mobile/androidenv/repo.json b/pkgs/development/mobile/androidenv/repo.json
index 5ccbc430fce6..bf69c67820b0 100644
--- a/pkgs/development/mobile/androidenv/repo.json
+++ b/pkgs/development/mobile/androidenv/repo.json
@@ -1241,6 +1241,21 @@
     },
     "23": {
       "google_apis": {
+        "arm64-v8a": {
+          "archives": [
+            {
+              "os": "all",
+              "sha1": "2d1ae21b1978e202917b7c6a5f49ab8bc87c6417",
+              "size": 493891214,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis/arm64-v8a-23_r33.zip"
+            }
+          ],
+          "displayName": "Google APIs ARM 64 v8a System Image",
+          "license": "android-sdk-license",
+          "name": "system-image-23-google_apis-arm64-v8a",
+          "path": "system-images/android-23/google_apis/arm64-v8a",
+          "revision": "23-google_apis-arm64-v8a"
+        },
         "armeabi-v7a": {
           "archives": [
             {
@@ -1663,43 +1678,117 @@
         }
       }
     },
-    "Tiramisu": {
+    "33": {
       "google_apis_playstore": {
         "arm64-v8a": {
           "archives": [
             {
               "os": "macosx",
-              "sha1": "2b6d4dc0af98b2b4d3ed4ac82b6d8ee0bfe38383",
-              "size": 1457296537,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-Tiramisu_r02-darwin.zip"
+              "sha1": "0b850a4f317d7a6abe854a6845705c9ca4437764",
+              "size": 1492105537,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-33_r05-darwin.zip"
             },
             {
               "os": "linux",
-              "sha1": "2b6d4dc0af98b2b4d3ed4ac82b6d8ee0bfe38383",
-              "size": 1457296537,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-Tiramisu_r02-linux.zip"
+              "sha1": "0b850a4f317d7a6abe854a6845705c9ca4437764",
+              "size": 1492105537,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-33_r05-linux.zip"
             }
           ],
           "displayName": "Google Play ARM 64 v8a System Image",
           "license": "android-sdk-arm-dbt-license",
-          "name": "system-image-Tiramisu-google_apis_playstore-arm64-v8a",
-          "path": "system-images/android-Tiramisu/google_apis_playstore/arm64-v8a",
-          "revision": "Tiramisu-google_apis_playstore-arm64-v8a"
+          "name": "system-image-33-google_apis_playstore-arm64-v8a",
+          "path": "system-images/android-33/google_apis_playstore/arm64-v8a",
+          "revision": "33-google_apis_playstore-arm64-v8a"
         },
         "x86_64": {
           "archives": [
             {
               "os": "all",
-              "sha1": "2d2fb4c36efa836f348d6acbfc588f9eed70934e",
-              "size": 1438511715,
-              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-Tiramisu_r02.zip"
+              "sha1": "ed2931ebef4f7bedff8610254748d6496ce5d3c4",
+              "size": 1496628942,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-33_r05.zip"
             }
           ],
           "displayName": "Google Play Intel x86 Atom_64 System Image",
           "license": "android-sdk-preview-license",
-          "name": "system-image-Tiramisu-google_apis_playstore-x86_64",
-          "path": "system-images/android-Tiramisu/google_apis_playstore/x86_64",
-          "revision": "Tiramisu-google_apis_playstore-x86_64"
+          "name": "system-image-33-google_apis_playstore-x86_64",
+          "path": "system-images/android-33/google_apis_playstore/x86_64",
+          "revision": "33-google_apis_playstore-x86_64"
+        }
+      }
+    },
+    "Tiramisu": {
+      "android-tv": {
+        "arm64-v8a": {
+          "archives": [
+            {
+              "os": "all",
+              "sha1": "4b70bed5ffb28162cdde7852e0597d957910270d",
+              "size": 840304267,
+              "url": "https://dl.google.com/android/repository/sys-img/android-tv/arm64-v8a-Tiramisu_r03.zip"
+            }
+          ],
+          "displayName": "Android TV ARM 64 v8a System Image",
+          "license": "android-sdk-license",
+          "name": "system-image-Tiramisu-android-tv-arm64-v8a",
+          "path": "system-images/android-Tiramisu/android-tv/arm64-v8a",
+          "revision": "Tiramisu-android-tv-arm64-v8a"
+        },
+        "x86": {
+          "archives": [
+            {
+              "os": "all",
+              "sha1": "547a24d9dec83e11486ef4ea45848d9fa99f35c2",
+              "size": 832895525,
+              "url": "https://dl.google.com/android/repository/sys-img/android-tv/x86-Tiramisu_r03.zip"
+            }
+          ],
+          "displayName": "Android TV Intel x86 Atom System Image",
+          "license": "android-sdk-license",
+          "name": "system-image-Tiramisu-android-tv-x86",
+          "path": "system-images/android-Tiramisu/android-tv/x86",
+          "revision": "Tiramisu-android-tv-x86"
+        }
+      }
+    },
+    "TiramisuPrivacySandbox": {
+      "google_apis_playstore": {
+        "arm64-v8a": {
+          "archives": [
+            {
+              "os": "macosx",
+              "sha1": "4653d7aa2dbd2629c3afc1c700284de0f7791bb2",
+              "size": 1514681298,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-TiramisuPrivacySandbox_r05-darwin.zip"
+            },
+            {
+              "os": "linux",
+              "sha1": "4653d7aa2dbd2629c3afc1c700284de0f7791bb2",
+              "size": 1514681298,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/arm64-v8a-TiramisuPrivacySandbox_r05-linux.zip"
+            }
+          ],
+          "displayName": "Google Play ARM 64 v8a System Image",
+          "license": "android-sdk-arm-dbt-license",
+          "name": "system-image-TiramisuPrivacySandbox-google_apis_playstore-arm64-v8a",
+          "path": "system-images/android-TiramisuPrivacySandbox/google_apis_playstore/arm64-v8a",
+          "revision": "TiramisuPrivacySandbox-google_apis_playstore-arm64-v8a"
+        },
+        "x86_64": {
+          "archives": [
+            {
+              "os": "all",
+              "sha1": "2a4ea6ce714155ea8ddfea26cf61ad219f32c02a",
+              "size": 1519169526,
+              "url": "https://dl.google.com/android/repository/sys-img/google_apis_playstore/x86_64-TiramisuPrivacySandbox_r05.zip"
+            }
+          ],
+          "displayName": "Google Play Intel x86 Atom_64 System Image",
+          "license": "android-sdk-preview-license",
+          "name": "system-image-TiramisuPrivacySandbox-google_apis_playstore-x86_64",
+          "path": "system-images/android-TiramisuPrivacySandbox/google_apis_playstore/x86_64",
+          "revision": "TiramisuPrivacySandbox-google_apis_playstore-x86_64"
         }
       }
     }
@@ -3298,32 +3387,32 @@
         "path": "build-tools/32.1.0-rc1",
         "revision": "32.1.0-rc1"
       },
-      "33.0.0-rc2": {
+      "33.0.0": {
         "archives": [
-          {
-            "os": "windows",
-            "sha1": "789aa6dfb2155b81e073108c70982f73c890a95b",
-            "size": 55466255,
-            "url": "https://dl.google.com/android/repository/830151c9e0c410f6148390f0de30bd349ba91efd.build-tools_r33-rc2-windows.zip"
-          },
           {
             "os": "linux",
-            "sha1": "013f98217b7af4f5677ab1a47e98da18ad57721c",
-            "size": 57876882,
-            "url": "https://dl.google.com/android/repository/build-tools_r33-rc2-linux.zip"
+            "sha1": "c561971600d4ce682b128b0bd5d4ab71c5f2ad35",
+            "size": 56000182,
+            "url": "https://dl.google.com/android/repository/build-tools_r33-linux.zip"
           },
           {
             "os": "macosx",
-            "sha1": "586f8f77847ba3899b7652d6514e8c6a78ab673a",
-            "size": 59910819,
-            "url": "https://dl.google.com/android/repository/f8baa248444f0a5aca1119b48e897908a3da49d5.build-tools_r33-rc2-macosx.zip"
+            "sha1": "3693851532ba9640710d2dd360d85aa5b04c5151",
+            "size": 60023096,
+            "url": "https://dl.google.com/android/repository/build-tools_r33-macosx.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "f4ef853e5e755ea5ffc50de73a9e420fc76c662e",
+            "size": 55610532,
+            "url": "https://dl.google.com/android/repository/build-tools_r33-windows.zip"
           }
         ],
-        "displayName": "Android SDK Build-Tools 33-rc2",
-        "license": "android-sdk-preview-license",
+        "displayName": "Android SDK Build-Tools 33",
+        "license": "android-sdk-license",
         "name": "build-tools",
-        "path": "build-tools/33.0.0-rc2",
-        "revision": "33.0.0-rc2"
+        "path": "build-tools/33.0.0",
+        "revision": "33.0.0"
       }
     },
     "cmake": {
@@ -3625,62 +3714,116 @@
         "name": "cmdline-tools",
         "path": "cmdline-tools/6.0",
         "revision": "6.0"
-      }
-    },
-    "emulator": {
-      "31.2.9": {
+      },
+      "7.0": {
         "archives": [
           {
             "os": "linux",
-            "sha1": "164b759748b3d2ee2616da74173867b11b18f64f",
-            "size": 276337192,
-            "url": "https://dl.google.com/android/repository/emulator-linux_x64-8316981.zip"
-          },
-          {
-            "os": "windows",
-            "sha1": "2b6768485a8e6492823a9156fa43c55092afd533",
-            "size": 345298639,
-            "url": "https://dl.google.com/android/repository/emulator-windows_x64-8316981.zip"
+            "sha1": "5e7bf2dd563d34917d32f3c5920a85562a795c93",
+            "size": 114168525,
+            "url": "https://dl.google.com/android/repository/commandlinetools-linux-8512546_latest.zip"
           },
           {
             "os": "macosx",
-            "sha1": "af2d950318d8ae8cc516a1401a94f888f615aca6",
-            "size": 313877066,
-            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-8316981.zip"
+            "sha1": "9a663c49dbd3709fc2b7d49db2814b383d811b4a",
+            "size": 114168511,
+            "url": "https://dl.google.com/android/repository/commandlinetools-mac-8512546_latest.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "1bdd32ac4b9fffea04f5bc341108e8b4fea6f32c",
+            "size": 114147385,
+            "url": "https://dl.google.com/android/repository/commandlinetools-win-8512546_latest.zip"
+          }
+        ],
+        "displayName": "Android SDK Command-line Tools",
+        "license": "android-sdk-license",
+        "name": "cmdline-tools",
+        "path": "cmdline-tools/7.0",
+        "revision": "7.0"
+      }
+    },
+    "emulator": {
+      "31.2.10": {
+        "archives": [
+          {
+            "os": "linux",
+            "sha1": "1f2c3ddeb2c9ac4feef5946098a0a710d08e9c6d",
+            "size": 276337904,
+            "url": "https://dl.google.com/android/repository/emulator-linux_x64-8420304.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "206491b5c4e531b2c66dc80402702b9fa1a64c2a",
+            "size": 345300871,
+            "url": "https://dl.google.com/android/repository/emulator-windows_x64-8420304.zip"
+          },
+          {
+            "os": "macosx",
+            "sha1": "677b6a00c145eb8bf4306daeb2231c8efd507177",
+            "size": 313876814,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-8420304.zip"
           }
         ],
         "displayName": "Android Emulator",
         "license": "android-sdk-license",
         "name": "emulator",
         "path": "emulator",
-        "revision": "31.2.9"
+        "revision": "31.2.10"
       },
-      "31.3.7": {
+      "31.3.8": {
         "archives": [
           {
             "os": "macosx",
-            "sha1": "0020b44623995a5a9a5b0d114f8fd942e9d3cbed",
-            "size": 347204784,
-            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-8408431.zip"
+            "sha1": "7214e8384c97a7c9875142149d3bf9c940e9b5a0",
+            "size": 347222379,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-8598121.zip"
           },
           {
             "os": "linux",
-            "sha1": "46ba0c398fcd2704bee015c95e44d8f317b7b720",
-            "size": 293765376,
-            "url": "https://dl.google.com/android/repository/emulator-linux_x64-8408431.zip"
+            "sha1": "0f781977a6cc5377b64444121ff75a513841a4fa",
+            "size": 293782881,
+            "url": "https://dl.google.com/android/repository/emulator-linux_x64-8598121.zip"
           },
           {
             "os": "windows",
-            "sha1": "c09a35dd8c7eb7d8c53bf89c86019f5dbcd89b9d",
-            "size": 380137986,
-            "url": "https://dl.google.com/android/repository/emulator-windows_x64-8408431.zip"
+            "sha1": "b4f30bad4e68da41cc9bd44965259b2111a011a1",
+            "size": 380151866,
+            "url": "https://dl.google.com/android/repository/emulator-windows_x64-8598121.zip"
           }
         ],
         "displayName": "Android Emulator",
         "license": "android-sdk-preview-license",
         "name": "emulator",
         "path": "emulator",
-        "revision": "31.3.7"
+        "revision": "31.3.8"
+      },
+      "31.3.9": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "6e7b549113252728cfe0992d58e8cb1790dce9d6",
+            "size": 347241742,
+            "url": "https://dl.google.com/android/repository/emulator-darwin_x64-8700579.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "1c1a7ef65476d3de34f19455a0093cb68e8e90f7",
+            "size": 293801439,
+            "url": "https://dl.google.com/android/repository/emulator-linux_x64-8700579.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "ea834211b199a7fcf6b6758a53c4594d01b44ab9",
+            "size": 380168712,
+            "url": "https://dl.google.com/android/repository/emulator-windows_x64-8700579.zip"
+          }
+        ],
+        "displayName": "Android Emulator",
+        "license": "android-sdk-license",
+        "name": "emulator",
+        "path": "emulator",
+        "revision": "31.3.9"
       }
     },
     "extras": {
@@ -4523,6 +4666,33 @@
         "path": "ndk/23.1.7779620",
         "revision": "23.1.7779620"
       },
+      "23.2.8568313": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "1fc65d8f6083f3f5cd01e0cf97c6adc10f4f076f",
+            "size": 982917530,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23c-darwin.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "e5053c126a47e84726d9f7173a04686a71f9a67a",
+            "size": 724733960,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23c-linux.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "f2c5def76a9de371f27d028864fe301ab4fe0cf8",
+            "size": 788336993,
+            "url": "https://dl.google.com/android/repository/android-ndk-r23c-windows.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 23.2.8568313",
+        "license": "android-sdk-license",
+        "name": "ndk",
+        "path": "ndk/23.2.8568313",
+        "revision": "23.2.8568313"
+      },
       "24.0.7856742-rc1": {
         "archives": [
           {
@@ -4684,6 +4854,60 @@
         "name": "ndk",
         "path": "ndk/25.0.8221429",
         "revision": "25.0.8221429-rc2"
+      },
+      "25.0.8355429-rc3": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "224594abb41357c20cb4a9f4a732c484b2e743ba",
+            "size": 748047157,
+            "url": "https://dl.google.com/android/repository/android-ndk-r25-beta3-darwin.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "79c8db05e20edde0cbb02d2326e7b8405f7eb977",
+            "size": 510520692,
+            "url": "https://dl.google.com/android/repository/android-ndk-r25-beta3-linux.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "7d2c398045f6bbad03f6fb2f2ba419a2a48ab1e7",
+            "size": 506142216,
+            "url": "https://dl.google.com/android/repository/android-ndk-r25-beta3-windows.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 25.0.8355429",
+        "license": "android-sdk-preview-license",
+        "name": "ndk",
+        "path": "ndk/25.0.8355429",
+        "revision": "25.0.8355429-rc3"
+      },
+      "25.0.8528842-rc4": {
+        "archives": [
+          {
+            "os": "macosx",
+            "sha1": "d7f344ecc68518a8178d15b1b80e27bc5c69f00d",
+            "size": 716633626,
+            "url": "https://dl.google.com/android/repository/android-ndk-r25-beta4-darwin.zip"
+          },
+          {
+            "os": "linux",
+            "sha1": "d13f688fd286709f0d950c75119ec9fcad8a47ff",
+            "size": 531018178,
+            "url": "https://dl.google.com/android/repository/android-ndk-r25-beta4-linux.zip"
+          },
+          {
+            "os": "windows",
+            "sha1": "668b063c7c535c4f8be52c84acebb5779935203b",
+            "size": 464031742,
+            "url": "https://dl.google.com/android/repository/android-ndk-r25-beta4-windows.zip"
+          }
+        ],
+        "displayName": "NDK (Side by side) 25.0.8528842",
+        "license": "android-sdk-preview-license",
+        "name": "ndk",
+        "path": "ndk/25.0.8528842",
+        "revision": "25.0.8528842-rc4"
       }
     },
     "ndk-bundle": {
@@ -5381,32 +5605,32 @@
       }
     },
     "platform-tools": {
-      "33.0.1": {
+      "33.0.2": {
         "archives": [
           {
             "os": "macosx",
-            "sha1": "82f7c23e9e4acf6c86991bb23cd5d9f861f7819f",
-            "size": 13131422,
-            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.1-darwin.zip"
+            "sha1": "9b5661e0c18a2e5b6935e2b96bcc7be580cd6dcd",
+            "size": 13038676,
+            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.2-darwin.zip"
           },
           {
             "os": "linux",
-            "sha1": "4792ee4593e8e2395ddb87a3e82d60629eb0e977",
-            "size": 7449306,
-            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.1-linux.zip"
+            "sha1": "6bf4f747ad929b02378b44ce083b4502d26109c7",
+            "size": 7406632,
+            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.2-linux.zip"
           },
           {
             "os": "windows",
-            "sha1": "e91ab59b5ddc5e387c5171b37c3813eaa2fa3846",
-            "size": 6331279,
-            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.1-windows.zip"
+            "sha1": "2d7599f59b54f02c4ecd33d656091a3c1e55ad9c",
+            "size": 6304111,
+            "url": "https://dl.google.com/android/repository/platform-tools_r33.0.2-windows.zip"
           }
         ],
         "displayName": "Android SDK Platform-Tools",
         "license": "android-sdk-license",
         "name": "platform-tools",
         "path": "platform-tools",
-        "revision": "33.0.1"
+        "revision": "33.0.2"
       }
     },
     "platforms": {
@@ -5809,6 +6033,21 @@
         "path": "platforms/android-32",
         "revision": "32"
       },
+      "33": {
+        "archives": [
+          {
+            "os": "all",
+            "sha1": "298f5800e37f3c089ab0eb58d4f6aef4058b689b",
+            "size": 67324871,
+            "url": "https://dl.google.com/android/repository/platform-33_r01.zip"
+          }
+        ],
+        "displayName": "Android SDK Platform 33",
+        "license": "android-sdk-license",
+        "name": "platforms",
+        "path": "platforms/android-33",
+        "revision": "33"
+      },
       "4": {
         "archives": [
           {
@@ -5935,20 +6174,20 @@
         "path": "platforms/android-9",
         "revision": "9"
       },
-      "Tiramisu": {
+      "TiramisuPrivacySandbox": {
         "archives": [
           {
             "os": "all",
-            "sha1": "2ac79862a909392d68d8ad503c45809e725d71f6",
-            "size": 67290653,
-            "url": "https://dl.google.com/android/repository/platform-Tiramisu_r02.zip"
+            "sha1": "8dd74a564f71c8381f5230682c5da291d230cc81",
+            "size": 67918949,
+            "url": "https://dl.google.com/android/repository/platform-TiramisuPrivacySandbox_r03.zip"
           }
         ],
-        "displayName": "Android SDK Platform Tiramisu",
+        "displayName": "Android SDK Platform TiramisuPrivacySandbox",
         "license": "android-sdk-license",
         "name": "platforms",
-        "path": "platforms/android-Tiramisu",
-        "revision": "Tiramisu"
+        "path": "platforms/android-TiramisuPrivacySandbox",
+        "revision": "TiramisuPrivacySandbox"
       }
     },
     "skiaparser": {
@@ -6304,6 +6543,21 @@
         "name": "sources",
         "path": "sources/android-31",
         "revision": "31"
+      },
+      "32": {
+        "archives": [
+          {
+            "os": "all",
+            "sha1": "d7195c6de611b99d7ec3565eabe2fd21268b7f98",
+            "size": 46933291,
+            "url": "https://dl.google.com/android/repository/sources-32_r01.zip"
+          }
+        ],
+        "displayName": "Sources for Android 32",
+        "license": "android-sdk-license",
+        "name": "sources",
+        "path": "sources/android-32",
+        "revision": "32"
       }
     },
     "tools": {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 92c47cbd5be2..ace695a85ddd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2659,6 +2659,8 @@ with pkgs;
   androidndkPkgs = androidndkPkgs_18b;
   androidndkPkgs_18b = (callPackage ../development/androidndk-pkgs {})."18b";
   androidndkPkgs_21 = (callPackage ../development/androidndk-pkgs {})."21";
+  androidndkPkgs_23b = (callPackage ../development/androidndk-pkgs {})."23b";
+  androidndkPkgs_24 = (callPackage ../development/androidndk-pkgs {})."24";
 
   androidsdk_9_0 = androidenv.androidPkgs_9_0.androidsdk;
 

From 2a914f022c533d78a86a23d99fe72952af1be990 Mon Sep 17 00:00:00 2001
From: Jari Vetoniemi <mailroxas@gmail.com>
Date: Fri, 18 Feb 2022 12:22:09 +0900
Subject: [PATCH 09/76] update android targets to recommended ones

---
 lib/systems/examples.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index b26407117c85..03e8c6cb5382 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -57,23 +57,23 @@ rec {
   armv7a-android-prebuilt = {
     config = "armv7a-unknown-linux-androideabi";
     rustc.config = "armv7-linux-androideabi";
-    sdkVer = "29";
-    ndkVer = "21";
+    sdkVer = "28";
+    ndkVer = "24";
     useAndroidPrebuilt = true;
   } // platforms.armv7a-android;
 
   aarch64-android-prebuilt = {
     config = "aarch64-unknown-linux-android";
     rustc.config = "aarch64-linux-android";
-    sdkVer = "29";
-    ndkVer = "21";
+    sdkVer = "28";
+    ndkVer = "24";
     useAndroidPrebuilt = true;
   };
 
   aarch64-android = {
     config = "aarch64-unknown-linux-android";
     sdkVer = "30";
-    ndkVer = "21";
+    ndkVer = "24";
     libc = "bionic";
     useAndroidPrebuilt = false;
     useLLVM = true;

From 539222e8d4bafaf783814c747e0ace40affa3761 Mon Sep 17 00:00:00 2001
From: Jari Vetoniemi <mailroxas@gmail.com>
Date: Sun, 26 Jun 2022 07:05:23 +0900
Subject: [PATCH 10/76] canExecute: check for android

---
 lib/systems/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index d9d0918c1cc6..25340825c4b5 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -36,6 +36,7 @@ rec {
       config = parse.tripleFromSystem final.parsed;
       # Determine whether we can execute binaries built for the provided platform.
       canExecute = platform:
+        final.isAndroid == platform.isAndroid &&
         parse.isCompatible final.parsed.cpu platform.parsed.cpu
         && final.parsed.kernel == platform.parsed.kernel;
       isCompatible = _: throw "2022-05-23: isCompatible has been removed in favor of canExecute, refer to the 22.11 changelog for details";

From 2408ef3c6faa0ba0d513257378563ddc886f1020 Mon Sep 17 00:00:00 2001
From: Jari Vetoniemi <mailroxas@gmail.com>
Date: Wed, 29 Jun 2022 18:24:50 +0900
Subject: [PATCH 11/76] androidndk: remove legacy ndks

allows us to remove python2 dependencies and lot more
---
 .../androidndk-pkgs/androidndk-pkgs.nix       | 67 ++++---------------
 pkgs/development/androidndk-pkgs/default.nix  | 36 +---------
 .../mobile/androidenv/ndk-bundle/default.nix  | 12 +---
 .../make_standalone_toolchain.py_18.patch     | 44 ------------
 pkgs/top-level/all-packages.nix               |  3 +-
 5 files changed, 19 insertions(+), 143 deletions(-)
 delete mode 100644 pkgs/development/mobile/androidenv/ndk-bundle/make_standalone_toolchain.py_18.patch

diff --git a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
index dc9802ea7f9e..2d5619620417 100644
--- a/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
+++ b/pkgs/development/androidndk-pkgs/androidndk-pkgs.nix
@@ -1,5 +1,4 @@
-{ lib, stdenv
-, makeWrapper, python
+{ lib, stdenv, makeWrapper
 , runCommand, wrapBintoolsWith, wrapCCWith, autoPatchelfHook
 , buildAndroidndk, androidndk, targetAndroidndkPkgs
 }:
@@ -24,30 +23,18 @@ let
     i686-unknown-linux-android = {
       triple = "i686-linux-android";
       arch = "x86";
-      # LEGACY
-      toolchain = "x86";
-      gccVer = "4.9";
     };
     x86_64-unknown-linux-android = {
       triple = "x86_64-linux-android";
       arch = "x86_64";
-      # LEGACY
-      toolchain = "x86_64";
-      gccVer = "4.9";
     };
     armv7a-unknown-linux-androideabi = {
       arch = "arm";
       triple = "arm-linux-androideabi";
-      # LEGACY
-      toolchain = "arm-linux-androideabi";
-      gccVer = "4.9";
     };
     aarch64-unknown-linux-android = {
       arch = "arm64";
       triple = "aarch64-linux-android";
-      # LEGACY
-      toolchain = "aarch64-linux-android";
-      gccVer = "4.9";
     };
   }.${config} or
     (throw "Android NDK doesn't support ${config}, as far as we know");
@@ -70,7 +57,7 @@ rec {
   binaries = stdenv.mkDerivation {
     pname = "${targetConfig}-ndk-toolchain";
     inherit (androidndk) version;
-    nativeBuildInputs = [ makeWrapper python autoPatchelfHook ];
+    nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
     propagatedBuildInputs = [ androidndk ];
     passthru = {
       isClang = true; # clang based cc, but bintools ld
@@ -82,16 +69,10 @@ rec {
     dontPatch = true;
     autoPatchelfIgnoreMissingDeps = true;
     installPhase = ''
-      if [ ! -d ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double} ]; then
-        # LEGACY: make-standalone-toolchain is deprecated
-        #         https://developer.android.com/ndk/guides/standalone_toolchain
-        ${androidndk}/libexec/android-sdk/ndk-bundle/build/tools/make-standalone-toolchain.sh --arch=${targetInfo.arch} --install-dir=$out/toolchain --platform=${sdkVer} --force
-      else
-        # https://developer.android.com/ndk/guides/other_build_systems
-        mkdir -p $out
-        cp -r ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double} $out/toolchain
-        find $out/toolchain -type d -exec chmod 777 {} \;
-      fi
+      # https://developer.android.com/ndk/guides/other_build_systems
+      mkdir -p $out
+      cp -r ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double} $out/toolchain
+      find $out/toolchain -type d -exec chmod 777 {} \;
 
       if [ ! -d $out/toolchain/sysroot/usr/lib/${targetInfo.triple}/${sdkVer} ]; then
         echo "NDK does not contain libraries for SDK version ${sdkVer}";
@@ -116,17 +97,8 @@ rec {
         ln -s $f ''${f/${targetInfo.triple}/${targetConfig}}
       done
 
-      # LEGACY: get rid of gcc and g++, otherwise wrapCCWith will use them instead of clang
-      rm -f $out/bin/${targetConfig}-gcc $out/bin/${targetConfig}-g++
-
-      # LEGACY: ld doesn't properly include transitive library dependencies.
-      #         Let's use gold instead
       rm -f $out/bin/${targetConfig}-ld
-      if [[ -f  $out/bin/${targetConfig}-ld.gold ]]; then
-        ln -s $out/bin/${targetConfig}-ld.gold $out/bin/${targetConfig}-ld
-      else
-        ln -s $out/bin/lld $out/bin/${targetConfig}-ld
-      fi
+      ln -s $out/bin/lld $out/bin/${targetConfig}-ld
 
       (cd $out/bin;
         for tool in llvm-*; do
@@ -156,18 +128,12 @@ rec {
     libc = targetAndroidndkPkgs.libraries;
     extraBuildCommands = ''
       echo "-D__ANDROID_API__=${stdenv.targetPlatform.sdkVer}" >> $out/nix-support/cc-cflags
-      if [ ! -d ${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${hostInfo.double} ]; then
-        # LEGACY: probably won't work for any recent android
-        echo "--gcc-toolchain=${androidndk}/libexec/android-sdk/ndk-bundle/toolchains/${targetInfo.toolchain}-${targetInfo.gccVer}/prebuilt/${hostInfo.double}" >> $out/nix-support/cc-cflags
-        echo "-fuse-ld=$out/bin/${targetConfig}-ld.gold -L${binaries}/lib" >> $out/nix-support/cc-ldflags
-      else
-        # Android needs executables linked with -pie since version 5.0
-        # Use -fPIC for compilation, and link with -pie if no -shared flag used in ldflags
-        echo "-target ${targetInfo.triple} -fPIC" >> $out/nix-support/cc-cflags
-        echo "-z,noexecstack -z,relro -z,now" >> $out/nix-support/cc-ldflags
-        echo 'if [[ ! " $@ " =~ " -shared " ]]; then NIX_LDFLAGS_${suffixSalt}+=" -pie"; fi' >> $out/nix-support/add-flags.sh
-        echo "-Xclang -mnoexecstack" >> $out/nix-support/cc-cxxflags
-      fi
+      # Android needs executables linked with -pie since version 5.0
+      # Use -fPIC for compilation, and link with -pie if no -shared flag used in ldflags
+      echo "-target ${targetInfo.triple} -fPIC" >> $out/nix-support/cc-cflags
+      echo "-z,noexecstack -z,relro -z,now" >> $out/nix-support/cc-ldflags
+      echo 'if [[ ! " $@ " =~ " -shared " ]]; then NIX_LDFLAGS_${suffixSalt}+=" -pie"; fi' >> $out/nix-support/add-flags.sh
+      echo "-Xclang -mnoexecstack" >> $out/nix-support/cc-cxxflags
       if [ ${targetInfo.triple} == arm-linux-androideabi ]; then
         # https://android.googlesource.com/platform/external/android-cmake/+/refs/heads/cmake-master-dev/android.toolchain.cmake
         echo "--fix-cortex-a8" >> $out/nix-support/cc-ldflags
@@ -181,12 +147,7 @@ rec {
   # cross-compiling packages to wrap incorrectly wrap binaries we don't include
   # anyways.
   libraries = runCommand "bionic-prebuilt" {} ''
-    if [ -d ${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt ]; then
-      lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double}/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}
-    else
-      # LEGACY
-      lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/platforms/android-${sdkVer}/arch-${hostInfo.arch}/usr/${if hostInfo.arch == "x86_64" then "lib64" else "lib"}
-    fi
+    lpath=${buildAndroidndk}/libexec/android-sdk/ndk-bundle/toolchains/llvm/prebuilt/${buildInfo.double}/sysroot/usr/lib/${targetInfo.triple}/${sdkVer}
     if [ ! -d $lpath ]; then
       echo "NDK does not contain libraries for SDK version ${sdkVer} <$lpath>"
       exit 1
diff --git a/pkgs/development/androidndk-pkgs/default.nix b/pkgs/development/androidndk-pkgs/default.nix
index cd076653ebd7..a7001ce1d4a6 100644
--- a/pkgs/development/androidndk-pkgs/default.nix
+++ b/pkgs/development/androidndk-pkgs/default.nix
@@ -2,36 +2,6 @@
 }:
 
 {
-  "18b" =
-    let
-      ndkVersion = "18.1.5063045";
-
-      buildAndroidComposition = buildPackages.buildPackages.androidenv.composeAndroidPackages {
-        includeNDK = true;
-        inherit ndkVersion;
-      };
-
-      androidComposition = androidenv.composeAndroidPackages {
-        includeNDK = true;
-        inherit ndkVersion;
-      };
-    in
-    import ./androidndk-pkgs.nix {
-      inherit lib;
-      inherit (buildPackages)
-        makeWrapper python autoPatchelfHook;
-      inherit (pkgs)
-        stdenv
-        runCommand wrapBintoolsWith wrapCCWith;
-      # buildPackages.foo rather than buildPackages.buildPackages.foo would work,
-      # but for splicing messing up on infinite recursion for the variants we
-      # *dont't* use. Using this workaround, but also making a test to ensure
-      # these two really are the same.
-      buildAndroidndk = buildAndroidComposition.ndk-bundle;
-      androidndk = androidComposition.ndk-bundle;
-      targetAndroidndkPkgs = targetPackages.androidndkPkgs_18b;
-    };
-
   "21" =
     let
       ndkVersion = "21.0.6113669";
@@ -49,7 +19,7 @@
     import ./androidndk-pkgs.nix {
       inherit lib;
       inherit (buildPackages)
-        makeWrapper python autoPatchelfHook;
+        makeWrapper autoPatchelfHook;
       inherit (pkgs)
         stdenv
         runCommand wrapBintoolsWith wrapCCWith;
@@ -79,7 +49,7 @@
     import ./androidndk-pkgs.nix {
       inherit lib;
       inherit (buildPackages)
-        makeWrapper python autoPatchelfHook;
+        makeWrapper autoPatchelfHook;
       inherit (pkgs)
         stdenv
         runCommand wrapBintoolsWith wrapCCWith;
@@ -109,7 +79,7 @@
     import ./androidndk-pkgs.nix {
       inherit lib;
       inherit (buildPackages)
-        makeWrapper python autoPatchelfHook;
+        makeWrapper autoPatchelfHook;
       inherit (pkgs)
         stdenv
         runCommand wrapBintoolsWith wrapCCWith;
diff --git a/pkgs/development/mobile/androidenv/ndk-bundle/default.nix b/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
index 28c7ca62b26d..5d0e2c2b171f 100644
--- a/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
+++ b/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
@@ -12,20 +12,10 @@ deployAndroidPackage {
   nativeBuildInputs = [ makeWrapper ]
     ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ];
   autoPatchelfIgnoreMissingDeps = true;
-  buildInputs = lib.optional (os == "linux") [ pkgs.glibc pkgs.stdenv.cc.cc pkgs.python2 pkgs.ncurses5 pkgs.zlib pkgs.libcxx.out pkgs.libxml2 ];
+  buildInputs = lib.optional (os == "linux") [ pkgs.zlib ];
   patchInstructions = lib.optionalString (os == "linux") (''
     patchShebangs .
 
-    # LEGACY: Fix the shebangs of the auto-generated scripts.
-    substituteInPlace ./build/tools/make_standalone_toolchain.py \
-      --replace '#!/bin/bash' '#!${pkgs.bash}/bin/bash'
-
-  '' + lib.optionalString (builtins.compareVersions (lib.getVersion package) "21" > 0) ''
-    patch -p1 \
-      --no-backup-if-mismatch < ${./make_standalone_toolchain.py_18.patch} || true
-    wrapProgram ./build/tools/make_standalone_toolchain.py --prefix PATH : "${runtime_paths}"
-  '' + ''
-
     # TODO: allow this stuff
     rm -rf docs tests
 
diff --git a/pkgs/development/mobile/androidenv/ndk-bundle/make_standalone_toolchain.py_18.patch b/pkgs/development/mobile/androidenv/ndk-bundle/make_standalone_toolchain.py_18.patch
deleted file mode 100644
index 7af2d44a0f20..000000000000
--- a/pkgs/development/mobile/androidenv/ndk-bundle/make_standalone_toolchain.py_18.patch
+++ /dev/null
@@ -1,44 +0,0 @@
-diff -Naur android-ndk-r18b/build/tools/make_standalone_toolchain.py android-ndk-r18b-new/build/tools/make_standalone_toolchain.py
---- android-ndk-r18b/build/tools/make_standalone_toolchain.py	2018-10-11 12:49:38.000000000 +0200
-+++ android-ndk-r18b-new/build/tools/make_standalone_toolchain.py	2018-11-20 21:55:52.689991420 +0100
-@@ -30,7 +30,7 @@
- import sys
- import tempfile
- import textwrap
--
-+import subprocess
- 
- THIS_DIR = os.path.realpath(os.path.dirname(__file__))
- NDK_DIR = os.path.realpath(os.path.join(THIS_DIR, '../..'))
-@@ -173,6 +173,7 @@
-                 logger().debug('Copying %s', src_file)
-                 shutil.copy2(src_file, dst_dir)
- 
-+    subprocess.check_call(["chmod", "-R", "+w", dst])
- 
- def make_clang_scripts(install_dir, triple, api, windows):
-     """Creates Clang wrapper scripts.
-@@ -365,6 +366,7 @@
-     install_headers = os.path.join(install_sysroot, 'usr/include')
-     os.makedirs(os.path.dirname(install_headers))
-     shutil.copytree(headers, install_headers)
-+    subprocess.check_call(["chmod", "-R", "+w", install_path])
- 
-     arch_headers = os.path.join(sysroot, 'usr/include', triple)
-     copy_directory_contents(arch_headers, os.path.join(install_headers))
-@@ -375,6 +377,7 @@
-             install_sysroot, 'usr/lib{}'.format(lib_suffix))
-         if os.path.exists(lib_path):
-             shutil.copytree(lib_path, lib_install)
-+            subprocess.check_call(["chmod", "-R", "+w", install_path])
- 
-     static_lib_path = os.path.join(sysroot, 'usr/lib', triple)
-     static_lib_install = os.path.join(install_sysroot, 'usr/lib')
-@@ -389,6 +392,7 @@
-         NDK_DIR, 'prebuilt', 'android-' + arch, 'gdbserver')
-     gdbserver_install = os.path.join(install_path, 'share', 'gdbserver')
-     shutil.copytree(gdbserver_path, gdbserver_install)
-+    subprocess.check_call(["chmod", "-R", "+w", install_path])
- 
-     toolchain_lib_dir = os.path.join(gcc_path, 'lib/gcc', triple)
-     dirs = os.listdir(toolchain_lib_dir)
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ace695a85ddd..eb9b50788856 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2656,8 +2656,7 @@ with pkgs;
     pkgs_i686 = pkgsi686Linux;
   };
 
-  androidndkPkgs = androidndkPkgs_18b;
-  androidndkPkgs_18b = (callPackage ../development/androidndk-pkgs {})."18b";
+  androidndkPkgs = androidndkPkgs_21;
   androidndkPkgs_21 = (callPackage ../development/androidndk-pkgs {})."21";
   androidndkPkgs_23b = (callPackage ../development/androidndk-pkgs {})."23b";
   androidndkPkgs_24 = (callPackage ../development/androidndk-pkgs {})."24";

From d09303b31d762378db24546fa862aead93241906 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <Mic92@users.noreply.github.com>
Date: Mon, 4 Jul 2022 13:25:43 +0100
Subject: [PATCH 12/76] Update nixos/modules/services/misc/jellyfin.nix

---
 nixos/modules/services/misc/jellyfin.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/misc/jellyfin.nix b/nixos/modules/services/misc/jellyfin.nix
index 7b31bfc1f8ff..e2f227b06196 100644
--- a/nixos/modules/services/misc/jellyfin.nix
+++ b/nixos/modules/services/misc/jellyfin.nix
@@ -49,7 +49,7 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
 
-      # This is mostly follows: https://github.com/jellyfin/jellyfin/blob/master/debian/jellyfin.service
+      # This is mostly follows: https://github.com/jellyfin/jellyfin/blob/master/fedora/jellyfin.service
       # Upstream also disable some hardenings when running in LXC, we do the same with the isContainer option
       serviceConfig = rec {
         Type = "simple";

From 04eb893beb851563010cd3158fac617e5d2ff123 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Sun, 10 Jul 2022 10:24:01 +0200
Subject: [PATCH 13/76] weechat: 3.5 -> 3.6

https://github.com/weechat/weechat/releases/tag/v3.6
---
 pkgs/applications/networking/irc/weechat/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/irc/weechat/default.nix b/pkgs/applications/networking/irc/weechat/default.nix
index 1b5f797e98c6..1835e59e86c2 100644
--- a/pkgs/applications/networking/irc/weechat/default.nix
+++ b/pkgs/applications/networking/irc/weechat/default.nix
@@ -28,14 +28,14 @@ let
   in
     assert lib.all (p: p.enabled -> ! (builtins.elem null p.buildInputs)) plugins;
     stdenv.mkDerivation rec {
-      version = "3.5";
+      version = "3.6";
       pname = "weechat";
 
       hardeningEnable = [ "pie" ];
 
       src = fetchurl {
         url = "https://weechat.org/files/src/weechat-${version}.tar.bz2";
-        sha256 = "sha256-8ZSa2dQPTiChGW00T5OASHmd0C2PatUtTu9Gr4CF4Oc=";
+        sha256 = "sha256-GkYN/Y4LQQr7GdSDu0ucXXM9wWPAqKD1txJXkOhJMDc=";
       };
 
       outputs = [ "out" "man" ] ++ map (p: p.name) enabledPlugins;

From 602e9830e9a3b0f7f4cfacbc599d4714a9ac126a Mon Sep 17 00:00:00 2001
From: Michal <michal@tar.black>
Date: Sun, 10 Jul 2022 20:38:57 +0100
Subject: [PATCH 14/76] maintainers: add ihatethefrench

---
 maintainers/maintainer-list.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 6d9da62e2ddf..69700f081622 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5393,6 +5393,13 @@
     githubId = 40234257;
     name = "ilkecan bozdogan";
   };
+  ihatethefrench =  {
+    email = "michal@tar.black";
+    matrix = "@michal:tar.black";
+    github = "ihatethefrench";
+    githubId = 30374463;
+    name = "Michal S.";
+  };
   illegalprime = {
     email = "themichaeleden@gmail.com";
     github = "illegalprime";

From 190a8c326c5c7ce8bc8d28d4909a2f5e86d49fda Mon Sep 17 00:00:00 2001
From: Michal <michal@tar.black>
Date: Sun, 10 Jul 2022 20:40:31 +0100
Subject: [PATCH 15/76] sshs: init at 3.2.0

---
 pkgs/development/tools/sshs/default.nix | 32 +++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix         |  2 ++
 2 files changed, 34 insertions(+)
 create mode 100644 pkgs/development/tools/sshs/default.nix

diff --git a/pkgs/development/tools/sshs/default.nix b/pkgs/development/tools/sshs/default.nix
new file mode 100644
index 000000000000..76cd63876ad8
--- /dev/null
+++ b/pkgs/development/tools/sshs/default.nix
@@ -0,0 +1,32 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, nix-update-script
+}:
+
+buildGoModule rec {
+  pname = "sshs";
+  version = "3.2.0";
+
+  src = fetchFromGitHub {
+    owner = "quantumsheep";
+    repo = pname;
+    rev = version;
+    sha256 = "D9doNVb2sTnzM8tF8cSJbIoaIYjGurkUHEyhcE3OqQg=";
+  };
+
+  vendorSha256 = "QWFz85bOrTnPGum5atccB5hKeATlZvDAt32by+DO/Fo=";
+
+  ldflags = [ "-s" "-w" "-X github.com/quantumsheep/sshs/cmd.Version=${version}" ];
+
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
+
+  meta = with lib; {
+    description = "Terminal user interface for SSH";
+    homepage = "https://github.com/quantumsheep/sshs";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ihatethefrench ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c05be7583114..dd3e213c254b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2669,6 +2669,8 @@ with pkgs;
 
   sshchecker = callPackage ../tools/security/sshchecker { };
 
+  sshs = callPackage ../development/tools/sshs { };
+
   titaniumenv = callPackage ../development/mobile/titaniumenv { };
 
   abootimg = callPackage ../development/mobile/abootimg {};

From d7f5c97885e46c91bd870a56b8b179ad25dd61df Mon Sep 17 00:00:00 2001
From: Mauricio Collares <mauricio@collares.org>
Date: Tue, 21 Jun 2022 17:33:31 +0200
Subject: [PATCH 16/76] eclib: 20210625 -> 20220621

---
 pkgs/development/libraries/eclib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/eclib/default.nix b/pkgs/development/libraries/eclib/default.nix
index 74a6f21992b5..af358be31218 100644
--- a/pkgs/development/libraries/eclib/default.nix
+++ b/pkgs/development/libraries/eclib/default.nix
@@ -14,7 +14,7 @@ assert withFlint -> flint != null;
 
 stdenv.mkDerivation rec {
   pname = "eclib";
-  version = "20210625"; # upgrade might break the sage interface
+  version = "20220621"; # upgrade might break the sage interface
   # sage tests to run:
   # src/sage/interfaces/mwrank.py
   # src/sage/libs/eclib
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     # see https://github.com/JohnCremona/eclib/issues/64#issuecomment-789788561
     # for upstream's explanation of the above
     url = "https://github.com/JohnCremona/eclib/releases/download/${version}/eclib-${version}.tar.bz2";
-    sha256 = "sha256-fA3MPz/L+Q39sA8wxAYOUowlHRcgOd8VF4tpsBGI6BA=";
+    sha256 = "sha256-EfoCNhnXGuN5SxgPFES4BaevhSRzU1JvT3ARq9NMJhM=";
   };
   buildInputs = [
     pari

From 55a53e1dec01d618a5f448b6a774fc0a05d813a5 Mon Sep 17 00:00:00 2001
From: Mauricio Collares <mauricio@collares.org>
Date: Mon, 11 Jul 2022 10:48:13 +0200
Subject: [PATCH 17/76] sage: apply eclib 20220621 update patch

---
 pkgs/applications/science/math/sage/sage-src.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/applications/science/math/sage/sage-src.nix b/pkgs/applications/science/math/sage/sage-src.nix
index 95da9b26e54e..a0375a5184a8 100644
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@@ -117,6 +117,13 @@ stdenv.mkDerivation rec {
     # 5.0 hits nixpkgs.
     # https://github.com/sphinx-doc/sphinx/pull/10372
     ./patches/docutils-0.18.1-deprecation.patch
+
+    (fetchSageDiff {
+      name = "eclib-20220621-update.patch";
+      base = "9.7.beta4";
+      rev = "9b65d73399b33043777ba628a4d318638aec6e0e";
+      sha256 = "sha256-pcb9Q9a0ROCZTyfT7TRMtgEqCom8SgrtAaZ8ATgeqVI=";
+    })
   ];
 
   patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;

From b9854d669e0bf71c9874933544082da0d975eaed Mon Sep 17 00:00:00 2001
From: Mauricio Collares <mauricio@collares.org>
Date: Mon, 11 Jul 2022 11:53:32 +0200
Subject: [PATCH 18/76] nauty: 2.7r3 -> 2.7r4

---
 pkgs/applications/science/math/nauty/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/science/math/nauty/default.nix b/pkgs/applications/science/math/nauty/default.nix
index 9fae8c31ea41..ef8c041039b1 100644
--- a/pkgs/applications/science/math/nauty/default.nix
+++ b/pkgs/applications/science/math/nauty/default.nix
@@ -4,11 +4,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nauty";
-  version = "2.7r3";
+  version = "2.7r4";
 
   src = fetchurl {
     url = "https://pallini.di.uniroma1.it/nauty${builtins.replaceStrings ["."] [""] version}.tar.gz";
-    sha256 = "sha256-TwZltxalP3oU6irjAFnyPQZM4/5MEsATQE724e4LiMI=";
+    sha256 = "sha256-uBDIWm/imfO0yfJKr5KcrH+VRsLzXCDh3Qrbx0CISKY=";
   };
 
   outputs = [ "out" "dev" ];

From fa748c2e5d509a30b3c7fbcc1f21de7668250048 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Tue, 12 Jul 2022 09:13:17 +0200
Subject: [PATCH 19/76] =?UTF-8?q?gajim:=201.4.3=20=E2=86=92=201.4.6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../networking/instant-messengers/gajim/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/gajim/default.nix b/pkgs/applications/networking/instant-messengers/gajim/default.nix
index 7c18ebf763c8..9725676da027 100644
--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@@ -22,11 +22,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gajim";
-  version = "1.4.3";
+  version = "1.4.6";
 
   src = fetchurl {
     url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    sha256 = "sha256:0n6v96pwgds8655877fjgsphq4rd4gb9mz7cbqp4nkd4m7kvr3xv";
+    sha256 = "sha256-iiZ2Nv6voq67+OJ26hk+3JQSKevx9ti8s6DreSAsQk8=";
   };
 
   buildInputs = [

From 02906974ec37d5a85bcdfe023f50b9a86ff9a391 Mon Sep 17 00:00:00 2001
From: Peder Bergebakken Sundt <pbsds@hotmail.com>
Date: Wed, 13 Jul 2022 01:30:11 +0200
Subject: [PATCH 20/76] polaris: fix Os error 24: 'Too many open files' in
 checkPhase

I set the ulimit to 4096, the default used by Darwin since #173657
---
 pkgs/servers/polaris/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/servers/polaris/default.nix b/pkgs/servers/polaris/default.nix
index fb9384ea0518..da53dc99252a 100644
--- a/pkgs/servers/polaris/default.nix
+++ b/pkgs/servers/polaris/default.nix
@@ -38,6 +38,11 @@ rustPlatform.buildRustPackage rec {
     cp -a docs/swagger $out/share/polaris-swagger
   '';
 
+  preCheck = ''
+    # 'Err' value: Os { code: 24, kind: Uncategorized, message: "Too many open files" }
+    ulimit -n 4096
+  '';
+
   passthru.updateScript = ./update.sh;
 
   meta = with lib; {

From d54d70f16615992b8005e7bec4b0d77954a95346 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Wed, 13 Jul 2022 19:03:50 +0200
Subject: [PATCH 21/76] nixos/mxisd: allow passing secrets

Suppose you want to provide a LDAP-based directory search to your
homeserver via a service-user with a bind-password. To make sure that
this doesn't end up in the Nix store, it's now possible to set a
substitute for the bindPassword like

    services.mxisd.extraConfig.ldap.connection = {
      # host, bindDn etc.
      bindPassword = "$LDAP_BIND_PW";
    };

and write the actual secret into an environment file that's readable for
`mxisd.service` containing

    LDAP_BIND_PW=<your secret bind pw>

and the following setting in the Nix expression:

    services.mxisd.environmentFile = "/runs/ecrets/mxisd";

(cherry picked from commit aa25ce7aa1a89618e4257fd46c7d20879f54c728)
---
 nixos/modules/services/networking/mxisd.nix | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/mxisd.nix b/nixos/modules/services/networking/mxisd.nix
index 803f0689d1fd..267c605040ea 100644
--- a/nixos/modules/services/networking/mxisd.nix
+++ b/nixos/modules/services/networking/mxisd.nix
@@ -46,6 +46,15 @@ in {
         description = "The mxisd/ma1sd package to use";
       };
 
+      environmentFile = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          Path to an environment-file which may contain secrets to be
+          substituted via <package>envsubst</package>.
+        '';
+      };
+
       dataDir = mkOption {
         type = types.str;
         default = "/var/lib/mxisd";
@@ -118,7 +127,12 @@ in {
         Type = "simple";
         User = "mxisd";
         Group = "mxisd";
-        ExecStart = "${cfg.package}/bin/${executable} -c ${configFile}";
+        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        ExecStart = "${cfg.package}/bin/${executable} -c ${cfg.dataDir}/mxisd-config.yaml";
+        ExecStartPre = "${pkgs.writeShellScript "mxisd-substitute-secrets" ''
+          ${pkgs.envsubst}/bin/envsubst -o ${cfg.dataDir}/mxisd-config.yaml \
+            -i ${configFile}
+        ''}";
         WorkingDirectory = cfg.dataDir;
         Restart = "on-failure";
       };

From bccaac95357abafe114ee20a39a5d9c91253d5bc Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 14 Jul 2022 23:42:18 +0200
Subject: [PATCH 22/76] nixos/privacyidea: better secret-handling ldap-proxy &
 RFC42-style settings for ldap-proxy

Instead of hard-coding a single `configFile` for
`privacyidea-ldap-proxy.service` which is pretty unmergable with other
declarations it now uses a RFC42-like approach. Also to make sure that
secrets can be handled properly without ending up in the Nix store, it's
possible to inject secrets via envsubst

    {
      services.privacyidea.ldap-proxy = {
        enable = true;
        environmentFile = "/run/secrets/ldap-pw";
        settings = {
          privacyidea.instance = "privacyidea.example.org";
          service-account = {
            dn = "uid=readonly,ou=serviceaccounts,dc=example,dc=org";
            password = "$LDAP_PW";
          };
        };
      };
    }

and the following secret file (at `/run/secrets`):

    LDAP_PW=<super-secret ldap pw>

For backwards-compat the old `configFile`-option is kept, but it throws
a deprecation warning and is mutually exclusive with the
`settings`-attrset. Also, it doesn't support secrets injection with
`envsubst` & `environmentFile`.
---
 .../modules/services/security/privacyidea.nix | 63 ++++++++++++++++++-
 1 file changed, 60 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/security/privacyidea.nix b/nixos/modules/services/security/privacyidea.nix
index c1617348fb01..190feaf657f3 100644
--- a/nixos/modules/services/security/privacyidea.nix
+++ b/nixos/modules/services/security/privacyidea.nix
@@ -51,6 +51,16 @@ let
     ${cfg.extraConfig}
   '';
 
+  renderValue = x:
+    if isList x then concatMapStringsSep "," (x: ''"${x}"'') x
+    else if isString x && hasInfix "," x then ''"${x}"''
+    else x;
+
+  ldapProxyConfig = pkgs.writeText "ldap-proxy.ini"
+    (generators.toINI {}
+      (flip mapAttrs cfg.ldap-proxy.settings
+        (const (mapAttrs (const renderValue)))));
+
 in
 
 {
@@ -172,7 +182,8 @@ in
         enable = mkEnableOption "PrivacyIDEA LDAP Proxy";
 
         configFile = mkOption {
-          type = types.path;
+          type = types.nullOr types.path;
+          default = null;
           description = ''
             Path to PrivacyIDEA LDAP Proxy configuration (proxy.ini).
           '';
@@ -189,6 +200,26 @@ in
           default = "pi-ldap-proxy";
           description = "Group account under which PrivacyIDEA LDAP proxy runs.";
         };
+
+        settings = mkOption {
+          type = with types; attrsOf (attrsOf (oneOf [ str bool int (listOf str) ]));
+          default = {};
+          description = ''
+            Attribute-set containing the settings for <package>privacyidea-ldap-proxy</package>.
+            It's possible to pass secrets using env-vars as substitutes and
+            use the option <xref linkend="opt-services.privacyidea.ldap-proxy.environmentFile" />
+            to inject them via <package>envsubst</package>.
+          '';
+        };
+
+        environmentFile = mkOption {
+          default = null;
+          type = types.nullOr types.str;
+          description = ''
+            Environment file containing secrets to be substituted into
+            <xref linkend="opt-services.privacyidea.ldap-proxy.settings" />.
+          '';
+        };
       };
     };
   };
@@ -276,6 +307,18 @@ in
 
     (mkIf cfg.ldap-proxy.enable {
 
+      assertions = [
+        { assertion = let
+            xor = a: b: a && !b || !a && b;
+          in xor (cfg.ldap-proxy.settings == {}) (cfg.ldap-proxy.configFile == null);
+          message = "configFile & settings are mutually exclusive for services.privacyidea.ldap-proxy!";
+        }
+      ];
+
+      warnings = mkIf (cfg.ldap-proxy.configFile != null) [
+        "Using services.privacyidea.ldap-proxy.configFile is deprecated! Use the RFC42-style settings option instead!"
+      ];
+
       systemd.services.privacyidea-ldap-proxy = let
         ldap-proxy-env = pkgs.python3.withPackages (ps: [ ps.privacyidea-ldap-proxy ]);
       in {
@@ -284,14 +327,28 @@ in
         serviceConfig = {
           User = cfg.ldap-proxy.user;
           Group = cfg.ldap-proxy.group;
-          ExecStart = ''
+          StateDirectory = "privacyidea-ldap-proxy";
+          EnvironmentFile = mkIf (cfg.ldap-proxy.environmentFile != null)
+            cfg.ldap-proxy.environmentFile;
+          ExecStartPre = mkIf (cfg.ldap-proxy.settings != {})
+            "${pkgs.writeShellScript "substitute-secrets-ldap-proxy" ''
+              set -x
+              ${pkgs.envsubst}/bin/envsubst \
+                -i ${ldapProxyConfig} \
+                -o $STATE_DIRECTORY/ldap-proxy.ini
+            ''}";
+          ExecStart = let
+            configPath = if cfg.ldap-proxy.settings != {}
+              then "%S/privacyidea-ldap-proxy/ldap-proxy.ini"
+              else cfg.ldap-proxy.configFile;
+          in ''
             ${ldap-proxy-env}/bin/twistd \
               --nodaemon \
               --pidfile= \
               -u ${cfg.ldap-proxy.user} \
               -g ${cfg.ldap-proxy.group} \
               ldap-proxy \
-              -c ${cfg.ldap-proxy.configFile}
+              -c ${configPath}
           '';
           Restart = "always";
         };

From ef73f1a15652fa33cd8478cab87fcdf0c889c21d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 15 Jul 2022 04:01:57 +0000
Subject: [PATCH 23/76] gtk-vnc: 1.3.0 -> 1.3.1

---
 pkgs/tools/admin/gtk-vnc/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/admin/gtk-vnc/default.nix b/pkgs/tools/admin/gtk-vnc/default.nix
index 060c95a8f767..f4c4b0facde1 100644
--- a/pkgs/tools/admin/gtk-vnc/default.nix
+++ b/pkgs/tools/admin/gtk-vnc/default.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gtk-vnc";
-  version = "1.3.0";
+  version = "1.3.1";
 
   outputs = [ "out" "bin" "man" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "X6qlgjuMvowLC6HkVsTnDEsa5mhcn+gaQoLZjPAKIR0=";
+    sha256 = "USdjrE4FWdAVi2aCyl3Ro71jPwgvXkNJ1xWOa1+A8c4=";
   };
 
   nativeBuildInputs = [

From 077dc1f8527909a2094524c8780b4d1a9dd4c732 Mon Sep 17 00:00:00 2001
From: Pavol Rusnak <pavol@rusnak.io>
Date: Sat, 16 Jul 2022 00:17:05 +0200
Subject: [PATCH 24/76] electrum: 4.2.1 -> 4.2.2

---
 pkgs/applications/misc/electrum/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index 4f95efa175e9..025d89e41387 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -21,7 +21,7 @@
 }:
 
 let
-  version = "4.2.1";
+  version = "4.2.2";
 
   libsecp256k1_name =
     if stdenv.isLinux then "libsecp256k1.so.0"
@@ -37,7 +37,7 @@ let
     owner = "spesmilo";
     repo = "electrum";
     rev = version;
-    sha256 = "sha256-BoikYSsQZAv8WswIr5nmBsGmjZbTXaLAbdO2QtPvc7c=";
+    sha256 = "sha256-bFceOu+3SLtD2eY+aSBEn13xJw7a3aVwX39QfAuqVSo=";
 
     postFetch = ''
       mv $out ./all
@@ -53,7 +53,7 @@ python3.pkgs.buildPythonApplication {
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "sha256-2SxSTH9P380j2KaCbkXjgmQO7K2z81AG6PMA/EMggXA=";
+    sha256 = "sha256-ucLLfqmTKO5Qpg+PnmcdQwht7cWMWJoFjQWnDecEtVs=";
   };
 
   postUnpack = ''

From 1be882bca94ac36e42f04a424f11376e3a5a66ee Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sat, 16 Jul 2022 04:20:00 +0000
Subject: [PATCH 25/76] yt-dlp: 2022.6.29 -> 2022.07.18

https://github.com/yt-dlp/yt-dlp/releases/tag/2022.07.18
---
 pkgs/tools/misc/yt-dlp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/yt-dlp/default.nix b/pkgs/tools/misc/yt-dlp/default.nix
index 3f806ea97378..069f4e13aff8 100644
--- a/pkgs/tools/misc/yt-dlp/default.nix
+++ b/pkgs/tools/misc/yt-dlp/default.nix
@@ -20,12 +20,12 @@ buildPythonPackage rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2022.6.29";
+  version = "2022.07.18";
 
   src = fetchPypi {
     inherit pname;
     version = builtins.replaceStrings [ ".0" ] [ "." ] version;
-    sha256 = "sha256-X7+scv0DXRG8JpPl0c1pM7G8BxL3QvUIKiYXA4ELtck=";
+    sha256 = "sha256-DnuB/GrI0bfT//p5+QRMpBY3hEIlgsmjWTMF2ipp7AI=";
   };
 
   propagatedBuildInputs = [ brotli certifi mutagen pycryptodomex websockets ];

From 765cc35042d9153bc067e785a2eb90fb6ca3f8ff Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sat, 16 Jul 2022 12:57:28 +0200
Subject: [PATCH 26/76] nixos/atlassian-jira: allow to store SSO password for
 crowd outside of the Nix store

The option `services.jira.sso.applicationPassword` has been replaced by
`applicationPasswordFile` that needs to be readable by the `jira`-user
or group.

The new `crowd.properties` is created on startup in `~jira` and the
secret is injected into it using `replace-secret`.
---
 .../services/web-apps/atlassian/jira.nix      | 46 +++++++++++++------
 pkgs/servers/atlassian/jira.nix               | 10 ++--
 2 files changed, 35 insertions(+), 21 deletions(-)

diff --git a/nixos/modules/services/web-apps/atlassian/jira.nix b/nixos/modules/services/web-apps/atlassian/jira.nix
index bc0bf43522e0..fd89d763c7fb 100644
--- a/nixos/modules/services/web-apps/atlassian/jira.nix
+++ b/nixos/modules/services/web-apps/atlassian/jira.nix
@@ -8,21 +8,22 @@ let
 
   pkg = cfg.package.override (optionalAttrs cfg.sso.enable {
     enableSSO = cfg.sso.enable;
-    crowdProperties = ''
-      application.name                        ${cfg.sso.applicationName}
-      application.password                    ${cfg.sso.applicationPassword}
-      application.login.url                   ${cfg.sso.crowd}/console/
-
-      crowd.server.url                        ${cfg.sso.crowd}/services/
-      crowd.base.url                          ${cfg.sso.crowd}/
-
-      session.isauthenticated                 session.isauthenticated
-      session.tokenkey                        session.tokenkey
-      session.validationinterval              ${toString cfg.sso.validationInterval}
-      session.lastvalidation                  session.lastvalidation
-    '';
   });
 
+  crowdProperties = pkgs.writeText "crowd.properties" ''
+    application.name                        ${cfg.sso.applicationName}
+    application.password                    @NIXOS_JIRA_CROWD_SSO_PWD@
+    application.login.url                   ${cfg.sso.crowd}/console/
+
+    crowd.server.url                        ${cfg.sso.crowd}/services/
+    crowd.base.url                          ${cfg.sso.crowd}/
+
+    session.isauthenticated                 session.isauthenticated
+    session.tokenkey                        session.tokenkey
+    session.validationinterval              ${toString cfg.sso.validationInterval}
+    session.lastvalidation                  session.lastvalidation
+  '';
+
 in
 
 {
@@ -112,9 +113,9 @@ in
           description = "Exact name of this JIRA instance in Crowd";
         };
 
-        applicationPassword = mkOption {
+        applicationPasswordFile = mkOption {
           type = types.str;
-          description = "Application password of this JIRA instance in Crowd";
+          description = "Path to the file containing the application password of this JIRA instance in Crowd";
         };
 
         validationInterval = mkOption {
@@ -181,6 +182,7 @@ in
         JIRA_HOME = cfg.home;
         JAVA_HOME = "${cfg.jrePackage}";
         CATALINA_OPTS = concatStringsSep " " cfg.catalinaOptions;
+        JAVA_OPTS = mkIf cfg.sso.enable "-Dcrowd.properties=${cfg.home}/crowd.properties";
       };
 
       preStart = ''
@@ -191,6 +193,14 @@ in
           -e 's,protocol="HTTP/1.1",protocol="HTTP/1.1" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}" secure="${toString cfg.proxy.secure}",' \
         '') + ''
           ${pkg}/conf/server.xml.dist > ${cfg.home}/server.xml
+
+        ${optionalString cfg.sso.enable ''
+          install -m660 ${crowdProperties} ${cfg.home}/crowd.properties
+          ${pkgs.replace-secret}/bin/replace-secret \
+            '@NIXOS_JIRA_CROWD_SSO_PWD@' \
+            ${cfg.sso.applicationPasswordFile} \
+            ${cfg.home}/crowd.properties
+        ''}
       '';
 
       serviceConfig = {
@@ -204,4 +214,10 @@ in
       };
     };
   };
+
+  imports = [
+    (mkRemovedOptionModule [ "services" "jira" "sso" "applicationPassword" ] ''
+      Use `applicationPasswordFile` instead!
+    '')
+  ];
 }
diff --git a/pkgs/servers/atlassian/jira.nix b/pkgs/servers/atlassian/jira.nix
index 6434a756bcd8..5b4d9d695f50 100644
--- a/pkgs/servers/atlassian/jira.nix
+++ b/pkgs/servers/atlassian/jira.nix
@@ -3,7 +3,7 @@
 , fetchurl
 , gawk
 , enableSSO ? false
-, crowdProperties ? null
+, makeWrapper
 }:
 
 stdenv.mkDerivation rec {
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-Zog0m8tsx8mDLU1rsW5zhhHgyRmi4JGWuy9DV8yp9nY=";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
+
   buildPhase = ''
     mv conf/server.xml conf/server.xml.dist
     ln -sf /run/atlassian-jira/server.xml conf/server.xml
@@ -27,10 +29,6 @@ stdenv.mkDerivation rec {
     substituteInPlace atlassian-jira/WEB-INF/classes/seraph-config.xml \
       --replace com.atlassian.jira.security.login.JiraSeraphAuthenticator \
                 com.atlassian.jira.security.login.SSOSeraphAuthenticator
-  '' + lib.optionalString (crowdProperties != null) ''
-    cat <<EOF > atlassian-jira/WEB-INF/classes/crowd.properties
-    ${crowdProperties}
-    EOF
   '';
 
   installPhase = ''
@@ -41,6 +39,6 @@ stdenv.mkDerivation rec {
     description = "Proprietary issue tracking product, also providing project management functions";
     homepage = "https://www.atlassian.com/software/jira";
     license = licenses.unfree;
-    maintainers = with maintainers; [ fpletz globin ciil megheaiulian techknowlogick ];
+    maintainers = with maintainers; [ fpletz globin ciil megheaiulian techknowlogick ma27 ];
   };
 }

From 4adf26f01893ed98f9ebbc55cbf87cb1be57a54a Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sat, 16 Jul 2022 14:00:46 +0200
Subject: [PATCH 27/76] nixos/privacyidea-ldap-proxy: always run envsubst

Otherwise the file doesn't exist at the expected location.
---
 nixos/modules/services/security/privacyidea.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/nixos/modules/services/security/privacyidea.nix b/nixos/modules/services/security/privacyidea.nix
index 190feaf657f3..d48266e4a759 100644
--- a/nixos/modules/services/security/privacyidea.nix
+++ b/nixos/modules/services/security/privacyidea.nix
@@ -330,9 +330,8 @@ in
           StateDirectory = "privacyidea-ldap-proxy";
           EnvironmentFile = mkIf (cfg.ldap-proxy.environmentFile != null)
             cfg.ldap-proxy.environmentFile;
-          ExecStartPre = mkIf (cfg.ldap-proxy.settings != {})
+          ExecStartPre =
             "${pkgs.writeShellScript "substitute-secrets-ldap-proxy" ''
-              set -x
               ${pkgs.envsubst}/bin/envsubst \
                 -i ${ldapProxyConfig} \
                 -o $STATE_DIRECTORY/ldap-proxy.ini

From d654eccd4acd1dda2e3478a4949a185da31f7f3a Mon Sep 17 00:00:00 2001
From: Azat Bahawi <azat@bahawi.net>
Date: Sat, 16 Jul 2022 18:38:34 +0300
Subject: [PATCH 28/76] endlessh-go: 20220308.1 -> 20220710

---
 pkgs/servers/endlessh-go/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/endlessh-go/default.nix b/pkgs/servers/endlessh-go/default.nix
index a1eb7b970eab..320d5c4137c0 100644
--- a/pkgs/servers/endlessh-go/default.nix
+++ b/pkgs/servers/endlessh-go/default.nix
@@ -5,22 +5,25 @@
 
 buildGoModule rec {
   pname = "endlessh-go";
-  version = "20220308.1";
+  version = "20220710";
 
   src = fetchFromGitHub {
     owner = "shizunge";
     repo = "endlessh-go";
     rev = version;
-    hash = "sha256-U+h/WmTVwwUIBEOiNa/EKS6HvkeoGNmP3NpeP1fcqYw=";
+    sha256 = "sha256-T8DLzHfITMLeHJtKuK4AjEzGGCIDJUPlqF2Lj56xPxY=";
   };
 
-  vendorSha256 = "sha256-5a/V2OQGVRIJVl/YG+lvtbLeHCy/1eiZu69zKIFqRKM=";
+  vendorSha256 = "sha256-hMCjYAqsI6h9B8iGVYQcNbKU5icalOHavvPKwOmvf/w=";
 
   proxyVendor = true;
 
+  ldflags = [ "-s" "-w" ];
+
   meta = with lib; {
     description = "An implementation of endlessh exporting Prometheus metrics";
     homepage = "https://github.com/shizunge/endlessh-go";
+    changelog = "https://github.com/shizunge/endlessh-go/releases/tag/${version}";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ azahi ];
   };

From 5e20771aec1e5d5e02741d92f63482d3df702914 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 17 Jul 2022 01:30:54 +0000
Subject: [PATCH 29/76] python310Packages.pytest-testmon: 1.3.3 -> 1.3.4

---
 pkgs/development/python-modules/pytest-testmon/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pytest-testmon/default.nix b/pkgs/development/python-modules/pytest-testmon/default.nix
index 667927bfe105..9652e0289464 100644
--- a/pkgs/development/python-modules/pytest-testmon/default.nix
+++ b/pkgs/development/python-modules/pytest-testmon/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "pytest-testmon";
-  version = "1.3.3";
+  version = "1.3.4";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Csg5wIm9+ZdAQYdZozlx09rMaVz3GazeS5Z/f4jRECw=";
+    sha256 = "sha256-jr+uKjtm5nFYHrZpG63VNK/wO93TQJh1x4SoTxJtlw0=";
   };
 
   propagatedBuildInputs = [ pytest coverage ];

From fcd75613ea1f8ae73ad6c0f70b18197584a94e2e Mon Sep 17 00:00:00 2001
From: Alexander Bantyev <balsoft@balsoft.ru>
Date: Sat, 16 Jul 2022 14:43:23 +0400
Subject: [PATCH 30/76] opam2json: init at v0.2

---
 .../tools/ocaml/opam2json/default.nix         | 25 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 ++
 2 files changed, 27 insertions(+)
 create mode 100644 pkgs/development/tools/ocaml/opam2json/default.nix

diff --git a/pkgs/development/tools/ocaml/opam2json/default.nix b/pkgs/development/tools/ocaml/opam2json/default.nix
new file mode 100644
index 000000000000..198a5f575eb4
--- /dev/null
+++ b/pkgs/development/tools/ocaml/opam2json/default.nix
@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchFromGitHub, opam-installer, ocamlPackages }:
+stdenv.mkDerivation rec {
+  pname = "opam2json";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "tweag";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "fe8bm/V/4r2iNxgbitT2sXBqDHQ0GBSnSUSBg/1aXoI=";
+  };
+
+  buildInputs = with ocamlPackages; [ yojson opam-file-format cmdliner ];
+  nativeBuildInputs = with ocamlPackages; [ ocaml findlib opam-installer ];
+
+  preInstall = ''export PREFIX="$out"'';
+
+  meta = with lib; {
+    platforms = platforms.all;
+    description = "convert opam file syntax to JSON";
+    maintainers = [ maintainers.balsoft ];
+    license = licenses.gpl3;
+    homepage = "https://github.com/tweag/opam2json";
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f5f1a48ba964..7be1a321f144 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13938,6 +13938,8 @@ with pkgs;
 
   opam-installer = callPackage ../development/tools/ocaml/opam/installer.nix { };
 
+  opam2json = callPackage ../development/tools/ocaml/opam2json { };
+
   wrapWatcom = callPackage ../development/compilers/open-watcom/wrapper.nix { };
   open-watcom-v2-unwrapped = callPackage ../development/compilers/open-watcom/v2.nix { };
   open-watcom-v2 = wrapWatcom open-watcom-v2-unwrapped { };

From 4a9a8d6425f7670db5084892237905a36c4267a3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 17 Jul 2022 04:14:23 +0000
Subject: [PATCH 31/76] iosevka-bin: 15.5.2 -> 15.6.0

---
 pkgs/data/fonts/iosevka/bin.nix      |   2 +-
 pkgs/data/fonts/iosevka/variants.nix | 184 +++++++++++++--------------
 2 files changed, 93 insertions(+), 93 deletions(-)

diff --git a/pkgs/data/fonts/iosevka/bin.nix b/pkgs/data/fonts/iosevka/bin.nix
index 05ad16623402..f180e5b4ffad 100644
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@@ -11,7 +11,7 @@ let
     (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
   pname = "${name}-bin";
-  version = "15.5.2";
+  version = "15.6.0";
 
   src = fetchurl {
     url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
diff --git a/pkgs/data/fonts/iosevka/variants.nix b/pkgs/data/fonts/iosevka/variants.nix
index 39112a725487..f666dec7a577 100644
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1f96ngb6m5ssp5hcdv5mrb28jcqx4w8hmz9igi64rrbg3flj93ix";
-  iosevka-aile = "19b9mip3bffdfiwlr0gn2qs9zymdrill4kak1pbx2y6kjlbsz7c1";
-  iosevka-curly = "0mkkxi0sb50il400bvv5rsgcf0gdbzir0br9m6syxzqwg90lakl7";
-  iosevka-curly-slab = "1qbbk2nzgwp4skiwg5cck9i6hzdsqfd88l1cypbk4l4jvvmx0gxm";
-  iosevka-etoile = "1l6f8dgk8ajbd35gbf1hdrzjrn96fh6v2wqsp3q0ncyqa210yasp";
-  iosevka-slab = "1fnp92s7f73nzy1qlfaal15hl2wgayixl26z8gpcvkzz964zgip7";
-  iosevka-ss01 = "0fchf91kmgrisb0na5yig43w8dvpqasj87ppmc12jghybn6zfz8z";
-  iosevka-ss02 = "00sn5207s75w79qxlcn153vf0k9jfpwhvn7iydnrdibjgy1wr1h4";
-  iosevka-ss03 = "0j227mq286jm7ndd4lr9v3s6wmcw3ya5mbmyc2b7n0hq0jqnbi3h";
-  iosevka-ss04 = "1za5893fmbc78jzh7l1ggp3hzm3wjxmmdanc0xg5dj95nrp878di";
-  iosevka-ss05 = "0x6z60ig01x3r95izqr2w94d8ddiqawvml6ga1r476xsv3djvl4w";
-  iosevka-ss06 = "1w4p4bqrl29v2dpbrk8cdxr1zmipa5n8d2gnyd1ay0p8mrmclfl3";
-  iosevka-ss07 = "1abk0fnz5d5rlz226s8m45ndqss4f1sn9249fdhgbph939lcfqlr";
-  iosevka-ss08 = "0ilw5013rkl1sflri40pi1h56iir1hadnmxk8a3aa2l7ysmslz44";
-  iosevka-ss09 = "1v4y06d521c8hg03vw78h1lhdpvlij3ihdpm7g1ir2mfr1wz2dj9";
-  iosevka-ss10 = "1kk7gm2xzy3i8rr149f2lydwdzkgs21hp46yminv6k0ipzfhhy28";
-  iosevka-ss11 = "10sz5gncvizvi3f8sx7m6x7g1s1459v47xnap0j8w9qjp1c8d6c7";
-  iosevka-ss12 = "12gwiq5fpx3xiv40k0i3k7c3hj15vf0vp7i1glp00yv4v6vrx8an";
-  iosevka-ss13 = "05912nq3ll7ihalzazrs2r32krknfg9gpn8i05m7xn31zakizx98";
-  iosevka-ss14 = "0lfzxqywx6vjr9vwkgmf73j1bcqjyzgg2n0dk2l523bxlq26j9ng";
-  iosevka-ss15 = "0z5vx4hjclf06rirnacd3sdxa0cv6mbgdkiayjbl7k5j3xw2sh5r";
-  iosevka-ss16 = "1lhhbdkd5dd87l2b5jmkacnx8h2pp6gwql9clj7sq006ir6a7in4";
-  iosevka-ss17 = "0000x8zsfh7kpjdcqhd9fqi9sp4hfkq3i1rmwhlxjmjwcx1rbccd";
-  iosevka-ss18 = "16chvb7fz9nn5g87nx2qxfbzqydi6aqdrr5l5hbd42zgx06rxg6b";
-  sgr-iosevka = "1pxbqg4c9s63c6yg0hfzw2pky2izgi8m4rl987k7bisqmsmw7dz5";
-  sgr-iosevka-aile = "16b44mhvd86cfzazwgrxzvlb4pl79qgcyllw07r4xis3x1gb9n4x";
-  sgr-iosevka-curly = "011rr2z0c1sdydyb4g3wb7icf6w13qagsimg6wvwq5v49ybv2p51";
-  sgr-iosevka-curly-slab = "0rvddn0fw3p454f5kpnh5lc0vgg5zg9v5658a16yqq0pyabbqm1v";
-  sgr-iosevka-etoile = "1l4ljc4g1gfn8n79783cid991rpvffw2abp0br4j0sd8fy4vd97s";
-  sgr-iosevka-fixed = "0hkfc8lpqda5vrbckcb740vyysgr7xbfns0v2gsdgj8kbvmw21bc";
-  sgr-iosevka-fixed-curly = "19r03fvhcm49nknvf52cp2hrgiaas29jm6skw2xci377adl8xvy7";
-  sgr-iosevka-fixed-curly-slab = "1smas7dhsz5qqg22hwlzwhf2wqrasj9gm28pyrwqbqri68982d8i";
-  sgr-iosevka-fixed-slab = "1qsafga9xfx6zyyhnlli6d33n9mak5a44lj4klnipm631cfax539";
-  sgr-iosevka-fixed-ss01 = "1w3683s7dgwh4njqv4726ghanfki119grszlpkd4ry5l88naw9wz";
-  sgr-iosevka-fixed-ss02 = "0lxdx1d6ynywjifarcr5ijga60d8mj4jn4av57yk0m7430qj535m";
-  sgr-iosevka-fixed-ss03 = "0wzpn8ra4y6g8gyhx62yyq2s1k7vvp0rbr5cnn810hfqjhc49dhi";
-  sgr-iosevka-fixed-ss04 = "0135yadsykcnpjcn9ldhr3pj9l6qnqnixfyn2xvvkxlmlkhizkm9";
-  sgr-iosevka-fixed-ss05 = "18vwd9sz6mlzg23dms1w79a98xsy2prkm0d6wkmyczi3pmwc11f2";
-  sgr-iosevka-fixed-ss06 = "12mwqq8js5njlddkakpsb798vc8bbiabd2kkvkkvsqmbanpic9ih";
-  sgr-iosevka-fixed-ss07 = "19r5a11n8m8k5nqlzgh4wr28gid81gxm7f28bgcz8jmjyvhrkmsq";
-  sgr-iosevka-fixed-ss08 = "0ya22ig0aawfi9k7q2hbqd7nfkhij8mj6jaqcp5fqlglgy8r437b";
-  sgr-iosevka-fixed-ss09 = "0cyvzalw9jp09kssc9p6pyfw843pbjgyhhjs311b5l8sr33add4k";
-  sgr-iosevka-fixed-ss10 = "1bvjm58jcgpjcjyhas10bp0wy5zlvqfkzwj4pzn5h4640vlv7rab";
-  sgr-iosevka-fixed-ss11 = "0zm7ncl1n910lqzrp20wp8dayl0wnaijwjzjza7y7wi8f3wi072f";
-  sgr-iosevka-fixed-ss12 = "0y3iqkx7hkry9yj7vszvqywbpnim26gdlm6a9gq57i3ilnkh3fqq";
-  sgr-iosevka-fixed-ss13 = "10snkzp4ihfd25760sf535s0z736lszx9kmr37bjs0yfk91qcd6i";
-  sgr-iosevka-fixed-ss14 = "1h4l025xzsxfhwzs19bzib6kf4asj0066ynwn6a7hjicsy2l8als";
-  sgr-iosevka-fixed-ss15 = "1jplpd42ik9lvdxl4kl1hqpz7h1m580r10p0pnnpv64zw9vqpzzc";
-  sgr-iosevka-fixed-ss16 = "0w2fgg3c0qkwpsvj4jq287wjgidpx49gnd4ijyqqwlzwyijc8v2a";
-  sgr-iosevka-fixed-ss17 = "0m8qpimcan5i2s7v8dhy8j85lzddgmlqjyjf1sfg6694d2ar0hpb";
-  sgr-iosevka-fixed-ss18 = "0hbaa84j5izsmibmnx1cwg4s37bc5iq6pib1shlk97fd7c96b3g7";
-  sgr-iosevka-slab = "1fxwc9s9ic33fn65gc565fg7h91ny9vj09lvhqpwc5v6jqky7bx8";
-  sgr-iosevka-ss01 = "1x72r1k4bz7xg92f8h5lp627dvvcw1li7iq3z511hprf08diyj6w";
-  sgr-iosevka-ss02 = "1xzysnn656j8pwsy1grfgbsdkyhizfviah9b6plkfs0crkpjfrd4";
-  sgr-iosevka-ss03 = "18d8in437sp0bc3bqb6rim97ygzsmyimnyp7m0czn8f9nyq920xc";
-  sgr-iosevka-ss04 = "1vbdqygbw3m0vk4jxd7f8qzap9cms9h0f9i7sr6cn50k998f9pnx";
-  sgr-iosevka-ss05 = "0fzkh4a6ni4mc26ss0x4bmhil0xm81p3xwhk0w0cr4qz7m5hk5b7";
-  sgr-iosevka-ss06 = "1b7zmjlgzwjnvvkh743ma3lla7jqcq6fsg526kfh0ghxzhhp4s9y";
-  sgr-iosevka-ss07 = "0l75xqx4lp5pa65s6phany5gwhswmfs3y0sck211sfzgifmlqf73";
-  sgr-iosevka-ss08 = "06zj3msqc69xlmm2sjwcr5s7ibk4qlych7fhhfzjyrawy7mvxrq9";
-  sgr-iosevka-ss09 = "11ba3rlp7mnnklznjhmhqfhy3qcnj7fn3w1wjzpqczvi71kskrff";
-  sgr-iosevka-ss10 = "04y5q4wspay4y7clrybgyrdyx43kw89zknszzd2df6bz7jpa583x";
-  sgr-iosevka-ss11 = "13igcnw8ja2xcpdyshm75qv293x050nx5r9yzxq6rxbppgv7yac2";
-  sgr-iosevka-ss12 = "0f3qnldpcavacrnj3x1av7729api33zll4x00zi1rhxd0akldrlb";
-  sgr-iosevka-ss13 = "1zy59pa7h2bchxl9gp6xvlj56a6p7jms2m49rsss8l9x5aq2gar1";
-  sgr-iosevka-ss14 = "1m66cyr8iybxa7hag65lv82q28mnx02yncklssb516gv5swd4sly";
-  sgr-iosevka-ss15 = "03n0qglqhlvg078jnj4l2ni3257g9l5zrbl7y3j051qpn3lkradg";
-  sgr-iosevka-ss16 = "0zqyxinrmfnlmkd735laz8ijb22mp1p04xhgqvgvx1npnjkz79jx";
-  sgr-iosevka-ss17 = "13dyw8im15njkml0wzqky1jp1rf4pnp8c1jhich4c6s24y0nvnkk";
-  sgr-iosevka-ss18 = "1bmh3k5g4h9qq539dh7qhpb5ai1sqrnk6yla6yr8bwpym53knysd";
-  sgr-iosevka-term = "0rzl36kz7xfg2cqr8hq8d3vqgg3wnk6ki44xxpspdfgkhyhffz5v";
-  sgr-iosevka-term-curly = "0212hs0yp8d46vc12gg3wahmxd2chscrpxcpcwi19cpii8m1jvsx";
-  sgr-iosevka-term-curly-slab = "04vyaj8ah3vj90zrd3jv2iqhgdcndqa0sn31ff4s28jzqwfg4d5q";
-  sgr-iosevka-term-slab = "0g60dz0y69wwa47x4q5kdpf2bjwjzsmr2zdnphsxwp0iari3mnls";
-  sgr-iosevka-term-ss01 = "16s7mgll7filyjjzw5cd5xmfgy7w658xxp8h6x52prcb8b1jpaxr";
-  sgr-iosevka-term-ss02 = "1vbarkid9v77qk83ymls3ppgh81kh5qch7k2zqd293dvb25p1irc";
-  sgr-iosevka-term-ss03 = "0zgy4v7i7wnbr1rgwcq8mn7128m82f25i9xmbyv3nk66ic4dn17v";
-  sgr-iosevka-term-ss04 = "1vl1w9y1xrpnpdzgcnp86gq9k7kyili1spccb6rbziw7il0sva5w";
-  sgr-iosevka-term-ss05 = "0kfbkpd1zdh8wdqh72h6q20fq6yfr0xp48bk1nk4k5y1pakibdcs";
-  sgr-iosevka-term-ss06 = "1mmc5w6div7nz8c0bfhhzxi6hm0w0qhfn4v7barkl5pw39iy7hls";
-  sgr-iosevka-term-ss07 = "16ki4n6vw9vxhwkx7mc0gid456hzznhcv8adq5ky8f78x0d1b7sa";
-  sgr-iosevka-term-ss08 = "1c3fbn01dpp684znawk0c8d0vq9ldsiybwsl9jmz3ighx1wli6d0";
-  sgr-iosevka-term-ss09 = "1ch6g56y7jfm2720cvn3v1kb7lj23db23p4frnyx32wxngfb8fc7";
-  sgr-iosevka-term-ss10 = "08pq3y4112x7s72b7clv4j0hna6v4ks75ap62g0ll6xw541s5g7k";
-  sgr-iosevka-term-ss11 = "0bivi2kd01q2007zja7cnphy6g3f369qgc4i848agpsin7dzxavh";
-  sgr-iosevka-term-ss12 = "1jfinia1kmwm6kjyx5sfbzfhb9qyjq51hjynpafrlyc2jzi4jh2w";
-  sgr-iosevka-term-ss13 = "19jg7r1jz3b39brsp8l0xklmydm015v4z3lcm8waw84g6ahpsz4d";
-  sgr-iosevka-term-ss14 = "1060bnwvc0mfkfq03m45giv7n5b9cdn7ssz8y0dkavfkxxqjf3rb";
-  sgr-iosevka-term-ss15 = "1zjl2jxsvkp31h756l95bhg7vk2vmpsrrdvr8s1blgbywf73vs0h";
-  sgr-iosevka-term-ss16 = "104myf8pvxiqjzy6ws2b8yjxddrlmnympnlgi2klbda0snvipcah";
-  sgr-iosevka-term-ss17 = "0aas4q54mhrd0vnh0ridgcb5q9m8xism9lk87kwxr6nmkyp5fabj";
-  sgr-iosevka-term-ss18 = "0z0gcvvpiyb86i5x6c1haggbb02l2jx1asa8ag17mwdaf7cp792m";
+  iosevka = "1frma5fnrfq1z06mvpy3wvp7jkww8qlji308b3pxv0nxwgjd1vyv";
+  iosevka-aile = "086ml3r09k3raxrwdmqgn7s7xga1zgrkvzxsldzwjpsw9jsax0m6";
+  iosevka-curly = "000n3wsjsk562lpydmck2c36sxd0w2wkjgz8f7dm8iw57ls9pn6g";
+  iosevka-curly-slab = "1cybjnmiwqjxj0rw3lil7n5vc6c30dg7ak0dz4g6q5klbnsw354s";
+  iosevka-etoile = "0gxhsgsxzkz34lln20aqz0rd8wvm58090f6v8z4fi5qsm0dla06s";
+  iosevka-slab = "00nd3h8vyqzlwbp45by6crzjq9rjpmj0nmmbbq17xvjgxxfhjsxr";
+  iosevka-ss01 = "1yq8bnrbw3g24xsnrwbq1vl05m4dlcpjl29h8g8irhhpbnnm44nx";
+  iosevka-ss02 = "1r40drbjxpwb7aqa24hh90nxayzj3gah110fsf8yjq5l5azg9ds8";
+  iosevka-ss03 = "1mlg9qjfdfia0vwd86gi9ygbbnamld56lpf4h6m7gr8y8v00p07i";
+  iosevka-ss04 = "0ap45s2si80gbz78q5v8qqga2ipy9dsz9hkq5dyfh8axlx1wiy7p";
+  iosevka-ss05 = "1mah12ihqwqlkmr01l5z6kasb6h6xifgd7acfypz5547ip2zy425";
+  iosevka-ss06 = "09w0hm5djjhfvy6lhbynvlq6ckd70zisv0z5y7w4jfmanif8jns3";
+  iosevka-ss07 = "17imf7021ncpl9f8nbm1c0bjz5grz1iqgvpz48vpqd56632ac6k6";
+  iosevka-ss08 = "199bf0qa76z59ad5d7fcgkiq8m4fxcia7q162zzjlxpl5bgv0665";
+  iosevka-ss09 = "0w7jcgi4vn5ix58ji5cybpbnzvdl21k1r6rxad76z97ywwqbflag";
+  iosevka-ss10 = "18vm9p6jdbyfc8q3cz8wf3sgd0xn7pzyw3qxld9d2qg83siybsmk";
+  iosevka-ss11 = "0aj1l0g3zzcr3grkj1l6s39449g60v6hvjfmb4xx4kxg7h1h5b4i";
+  iosevka-ss12 = "0zl2ffmgnlrcaj8mzfgp5x5z7iras5svdpf0zl2xcgjn15k17lkx";
+  iosevka-ss13 = "0b58jjhd17i9pc5gdcx3xj9y8bgzwxrlh21j6di4cgvgj41gh46k";
+  iosevka-ss14 = "0vlqr5s40xcc2645vsaap42cgfswi2p4hbpqbfjfzsmf41w6j6qc";
+  iosevka-ss15 = "01qgvdmy8frbasb5d39c12dxjlha6iv1dq621il0dzm0850x48ys";
+  iosevka-ss16 = "12vl98p6w73l4rfy2scn57jrvg2jxk99d2vsndri013grx488lq5";
+  iosevka-ss17 = "0336m1i7vdd86jgyfdnsw4f6pdzcd4d757gxf8pa3h6jyczcn8n1";
+  iosevka-ss18 = "07sqd4zwc85q8mh9l1bc2nbyr966b0bh9fff9rk91jrk106fijcl";
+  sgr-iosevka = "0adxnngdwz6lmp4yla8amk0840y9k6d3k1jl90z5qd3dpl0m0w7z";
+  sgr-iosevka-aile = "07470h9apwbmnai1rzx5s9jw3195gsxqv6q0z1gnf56mp94wihg1";
+  sgr-iosevka-curly = "1jii49qqlrpvzczwqi39001j0qwbrzklc96bwampn9f0la1iqcbf";
+  sgr-iosevka-curly-slab = "0bwfsimzkw4pbk6qy4nvbpwcw0h3m16qsjaqwrwfhnzy8hqc6akc";
+  sgr-iosevka-etoile = "091ikanzxmkb673wfcfdg9qm56xqv4vwd3c1ph0c5bzc2nz3il50";
+  sgr-iosevka-fixed = "1nz7x90zcbmvwldiz5zv5j22qyjgjn4ba42liki747lr930f38lm";
+  sgr-iosevka-fixed-curly = "17y7h5jwim59zybpmkv3rqdcc41dxax5145xmhyzvagblsc7qlpk";
+  sgr-iosevka-fixed-curly-slab = "1xfaszbpydi6vzif14bymv5cqlwxvvkdadba4jhy0psc7b30k095";
+  sgr-iosevka-fixed-slab = "0pbmhr3nbb777ym30qmhlp4swq0q1f5aqc6i7453fc0lhygmcg55";
+  sgr-iosevka-fixed-ss01 = "1klxs5npm5i1sxgrnkbkf1rbn1dvrdxp6mr34kjxkjxrd5flrb6m";
+  sgr-iosevka-fixed-ss02 = "0aw0yqmvahk0wagyb2k6q6jibpdlyza3q7zn2a7pi36pcnm9b2rn";
+  sgr-iosevka-fixed-ss03 = "0ssxx7a7cskd8lcfy3lnjic1qgzy087d6vk7hmhnlg52jhcfbkjm";
+  sgr-iosevka-fixed-ss04 = "0fhqzj5ksvcp1rxa8g11a0jwznhwb5xw41wpvjqy1za1qh2h6shw";
+  sgr-iosevka-fixed-ss05 = "06z42m7x565wzsf9sfxi4p4846cb3mgz7mr5h3xa528789fk1sx0";
+  sgr-iosevka-fixed-ss06 = "0hzy5bj3ac009q515ylxlc73d1qwdfqcxfq8jxla5h6cgcfipnl4";
+  sgr-iosevka-fixed-ss07 = "1051ah3q8wgdana4a9v38szd36wdy0h3c15sf1blm0cv3y0q7cv3";
+  sgr-iosevka-fixed-ss08 = "05pg3ywxg8m4c1ij8xpd43azz1671v1bsw7r3szbiqmmlq651h9w";
+  sgr-iosevka-fixed-ss09 = "0way85q2jwkhz8ixicx73s1x1hsyznr524am95igqkzwaz7c72q9";
+  sgr-iosevka-fixed-ss10 = "12b91hk7i00766gmd04dgh3c6m42bvbc25y9h049c6rfimzd9f75";
+  sgr-iosevka-fixed-ss11 = "1pn06gz3jrksg6f2glk45gj9i7jmgnh4f509fi7qqa73r3an0pl8";
+  sgr-iosevka-fixed-ss12 = "0nb7g0kbi4riczhjl1dqbzg3kwwsw1vlxnsc5p0qfh8h1rnfpg9g";
+  sgr-iosevka-fixed-ss13 = "1nj3nbp0b9a4nmskxg4vv98y7qp7gnj6rqkckvsw7bw43mxa2faq";
+  sgr-iosevka-fixed-ss14 = "1fhwx95702qyr23iwp400l16lgq12pd3ckbf5dn1hyhfmm691cvg";
+  sgr-iosevka-fixed-ss15 = "088xdxr11gdpn5j4fbf4xscq4prc1cydb23xcsmpnci6gsv4ppzg";
+  sgr-iosevka-fixed-ss16 = "1p20k188c75jisrg7bqr6fq9pra07b44vyvj10ngm38xwfgqb5lz";
+  sgr-iosevka-fixed-ss17 = "03giwk9xlnirgshbkpbkqav3l97n2fm7y3wd21g449vi7r9srimk";
+  sgr-iosevka-fixed-ss18 = "1yl501fcik0kcm20b98n9a285zv9m3yc33ngkjdgj12ssgb02lj8";
+  sgr-iosevka-slab = "0svls9wajw539bj5xziqbcp3wgc3f3hvwvz0rsicc9wgm7h47i33";
+  sgr-iosevka-ss01 = "09i5iylma19jfiqcl0svm7dz4d2agi1ylkvzvsh050ggsk57nzv6";
+  sgr-iosevka-ss02 = "1l0c7519wj46m14aq318rlhajq51hkv5sddhl8nvaqpdmrxx0zcj";
+  sgr-iosevka-ss03 = "02yz6wqaqnc0in8b6j2n02kf6lws4x16182a5djnh3nnml2jhvi6";
+  sgr-iosevka-ss04 = "0llrnx6vh6fl0fn5jjxzkq4rk91siy90pcpwin010sm3bppc0qgf";
+  sgr-iosevka-ss05 = "166y9hywcm6d1zw2szqfrlaj9qaankamcs0ff02vd7q399bkl9a2";
+  sgr-iosevka-ss06 = "0q41sikcv60nkvxqs5l3zw1dram20192dd5nr17nsd2lrbbdw1qx";
+  sgr-iosevka-ss07 = "1nxgsj6ykgh5dj3gjba2ild1y5knilm7pzi5b5qbqpal89ymk5dq";
+  sgr-iosevka-ss08 = "19bidxh3zxid6md8y0zp6ij4yxhqbyhqxfmld12pcskvp9xdv5bc";
+  sgr-iosevka-ss09 = "15w7dqb73q2v0qkh0wmlhjd3sphcq6qilb8iqz0ifg3kbsix3hd3";
+  sgr-iosevka-ss10 = "04gcwjpi313sqmdq1limfzycjyhr6p05vnr8jsabvgbxididikdi";
+  sgr-iosevka-ss11 = "1mvhrqgbppx35h2v62ykhihdkh4zw2lwz5i7fd5qdw0ysiv1006d";
+  sgr-iosevka-ss12 = "0r7qlba9mx1fibs0jrqgjzbffk1j49912zzim441n9539n6rmpvp";
+  sgr-iosevka-ss13 = "1qvn83frjhy2w16i9jnhp3874rjlf0z95n7x1kmcg89hzy3x7288";
+  sgr-iosevka-ss14 = "1yjbdgj1b03p2cwvwsh7jl0npj4a840whgn35j61fi9ap74jld8c";
+  sgr-iosevka-ss15 = "1jrixb0lw04axv2h6d92mbwgavyzpc189n72b8wf729kwi22bvww";
+  sgr-iosevka-ss16 = "1mvgl5dh9frqmqvia17zwpyyy9hwm8iayx2azm7mhjkkff0f0sd9";
+  sgr-iosevka-ss17 = "00059jzz2w9xdfcl2lws2i0lwqgn08fakn0di6clqhjig695yglc";
+  sgr-iosevka-ss18 = "03sy0az47x9sc0qxjc1wvhkmp71wqrm7q998ijxmj6mkbd3kc24v";
+  sgr-iosevka-term = "0r5ah7rxqqi4cha3r6nz6dli6z55s1g91yb1x6b2q04irvm0hzrc";
+  sgr-iosevka-term-curly = "1c9vf1kcl0yai5smzh9dldhkbwanbxji2a1j6y1sw59kn9n7aygf";
+  sgr-iosevka-term-curly-slab = "02m3fpdj9gxskap4sp43pjr4ylyvr6fpbsbl5csjl5x4rlrh71kr";
+  sgr-iosevka-term-slab = "1bnb803vcrkk05igm80v3k8b3p6ji14bsa5rjrplxq7yrjq7ybk4";
+  sgr-iosevka-term-ss01 = "1wfz766fi0xi5nb80wdlpp4j4klggz8v2aa1prl6mbvmzq4g1alk";
+  sgr-iosevka-term-ss02 = "12vcmbx597h0mfmib9wzqpc7bchbim2jyqnk835fhgrdrddb1w0j";
+  sgr-iosevka-term-ss03 = "0a4dfrah8rg5bc7x8r08n2ijr6nfxr5nwbwj7ig0snbw1rrizm4i";
+  sgr-iosevka-term-ss04 = "0ix8wn6dbqs072s3bmcjc1k8jfi4zpgjikbbdld3fgsg13gncz2p";
+  sgr-iosevka-term-ss05 = "19jjvadmffizdymy21dniz43ac1qkik5i33a4imchk64kcn7nqin";
+  sgr-iosevka-term-ss06 = "0lx61ikw9c2glr7smxyqkx68271sww47khkdy68llmw16c1dcapc";
+  sgr-iosevka-term-ss07 = "12nx451b67cc6kx6pkb9x2jyk683xvjz3m21wg7zjplskrhlfaqa";
+  sgr-iosevka-term-ss08 = "19n39wpz09kp9km9gmb16q6g4xbp288dgnlpdy4jxnway3i23drp";
+  sgr-iosevka-term-ss09 = "1j4sh9fjyxi5qa85w72bs7sin5189qis8zdr2fbl39ma7igj5l5f";
+  sgr-iosevka-term-ss10 = "02bv19gc1n73qyrdghp5nfzf2vwcvws3qnrcx7k3jpz23xf1n8s8";
+  sgr-iosevka-term-ss11 = "1a93vv86sg38ipji4cbpndcr9bfcc2n4bg0s3f19lzyqpw3pa6r9";
+  sgr-iosevka-term-ss12 = "1c3d3cxna1m7qq77fc278jja7yz84591pazc1adij28l3xl7xh1z";
+  sgr-iosevka-term-ss13 = "0ss0l4373867csgis87miymby4m1vvxs321lqq00m73x35y9xrj2";
+  sgr-iosevka-term-ss14 = "0dzg0g5p9p1p8yajdz0xnir8advs69fyj325qwh5616in9y3lv32";
+  sgr-iosevka-term-ss15 = "0rx346bjrm33n9ww9bc4czn9dda16bkxjf6h9m4bnvlgxdflgd3y";
+  sgr-iosevka-term-ss16 = "14i3f4bwnsb3haai8003pi9hsahcmxm1r1vccbrzny5vx78892py";
+  sgr-iosevka-term-ss17 = "0idfiqxj0ixrmvfa0bhl1sg6pvaivcw0csjcfxpp7d406553a70i";
+  sgr-iosevka-term-ss18 = "1732sskv5jzpdaaf4dc6xcp45r5fpxxxdq35jlnxbwng0njww3qy";
 }

From 1b79dbb4d7a25f1fc47f34eb2ec5f6bc8b9f91d9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 17 Jul 2022 05:20:14 +0000
Subject: [PATCH 32/76] linode-cli: 5.21.0 -> 5.21.0

---
 pkgs/tools/virtualization/linode-cli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/virtualization/linode-cli/default.nix b/pkgs/tools/virtualization/linode-cli/default.nix
index 743764196c55..d7a58779399b 100644
--- a/pkgs/tools/virtualization/linode-cli/default.nix
+++ b/pkgs/tools/virtualization/linode-cli/default.nix
@@ -13,8 +13,8 @@
 let
   sha256 = "1yglnmwspdncqmy5x0zc0g43bfm4597zfmwfvs7qkalv1pprf0s3";
   # specVersion taken from: https://www.linode.com/docs/api/openapi.yaml at `info.version`.
-  specVersion = "4.129.0";
-  specSha256 = "02bf1jcqn7sp6qmkd56jgmgpfg3agbw47cd38zha6fksm2knmd32";
+  specVersion = "4.130.0";
+  specSha256 = "0qwydx6bsbi37135zmwm8vx1yzwa5gyi8bz1zsvkd64wjv79yra1";
   spec = fetchurl {
     url = "https://raw.githubusercontent.com/linode/linode-api-docs/v${specVersion}/openapi.yaml";
     sha256 = specSha256;

From bafaa05bf1cdb00030b8f4303eb1f976cf728793 Mon Sep 17 00:00:00 2001
From: Simon Bruder <simon@sbruder.de>
Date: Sun, 17 Jul 2022 10:11:15 +0200
Subject: [PATCH 33/76] yuzu-{ea,mainline}: {2725,1088} -> {2841,1092}

This also changes the update script, because pineapple changed their
releases which no longer have a name set explicitly.
---
 pkgs/applications/emulators/yuzu/default.nix | 12 ++++++------
 pkgs/applications/emulators/yuzu/update.sh   |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/emulators/yuzu/default.nix b/pkgs/applications/emulators/yuzu/default.nix
index 5c6fd625cf66..bc63771494e2 100644
--- a/pkgs/applications/emulators/yuzu/default.nix
+++ b/pkgs/applications/emulators/yuzu/default.nix
@@ -5,23 +5,23 @@
 }:
 
 let
-  # Fetched from https://api.yuzu-emu.org/gamedb, last updated 2022-05-12
+  # Fetched from https://api.yuzu-emu.org/gamedb, last updated 2022-07-14
   # Please make sure to update this when updating yuzu!
   compat-list = fetchurl {
     name = "yuzu-compat-list";
-    url = "https://web.archive.org/web/20220512184801/https://api.yuzu-emu.org/gamedb";
+    url = "https://web.archive.org/web/20220714160745/https://api.yuzu-emu.org/gamedb";
     sha256 = "sha256-anOmO7NscHDsQxT03+YbJEyBkXjhcSVGgKpDwt//GHw=";
   };
 in {
   mainline = libsForQt5.callPackage ./generic.nix rec {
     pname = "yuzu-mainline";
-    version = "1088";
+    version = "1092";
 
     src = fetchFromGitHub {
       owner = "yuzu-emu";
       repo = "yuzu-mainline";
       rev = "mainline-0-${version}";
-      sha256 = "0kjiynv1fwc14w7382qgzayz5j9n2rnzbpbq49zgcywc4wwcxzs2";
+      sha256 = "1avcq924q0r8pfv1s0a88iyii7yixcxpb3yhlj0xg9zqnwp9r23y";
       fetchSubmodules = true;
     };
 
@@ -30,13 +30,13 @@ in {
 
   early-access = libsForQt5.callPackage ./generic.nix rec {
     pname = "yuzu-ea";
-    version = "2725";
+    version = "2841";
 
     src = fetchFromGitHub {
       owner = "pineappleEA";
       repo = "pineapple-src";
       rev = "EA-${version}";
-      sha256 = "1nmcl9y9chr7cdvnra5zs1v42d3i801hmsjdlz3fmp15n04bcjmp";
+      sha256 = "16lrq9drv0x7gs1siq37m4zmh6d2g3vhnw9qcqajr9p0vmlpnh6l";
       fetchSubmodules = true;
     };
 
diff --git a/pkgs/applications/emulators/yuzu/update.sh b/pkgs/applications/emulators/yuzu/update.sh
index e128db066f35..8dedcab02813 100755
--- a/pkgs/applications/emulators/yuzu/update.sh
+++ b/pkgs/applications/emulators/yuzu/update.sh
@@ -53,7 +53,7 @@ updateEarlyAccess() {
     OLD_EA_HASH="$(getLocalHash "yuzu-ea")"
 
     NEW_EA_VERSION="$(curl -s ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
-        "https://api.github.com/repos/pineappleEA/pineapple-src/releases?per_page=1" | jq -r '.[0].name' | cut -d"-" -f2 | cut -d" " -f1)"
+        "https://api.github.com/repos/pineappleEA/pineapple-src/releases?per_page=1" | jq -r '.[0].tag_name' | cut -d"-" -f2 | cut -d" " -f1)"
 
     if [[ "${OLD_EA_VERSION}" = "${NEW_EA_VERSION}" ]]; then
         echo "yuzu-ea is already up to date!"

From 4396fd615c4c5061c690b03e0b278ff73bc509e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 17 Jul 2022 21:46:16 +0200
Subject: [PATCH 34/76] nixos/systemd-boot: remove default log message if
 nothing changes

---
 .../system/boot/loader/systemd-boot/systemd-boot-builder.py     | 2 --
 1 file changed, 2 deletions(-)

diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
index aca6a1ca2cc2..77280a9680e3 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -264,8 +264,6 @@ def main() -> None:
         if installed_version < available_version:
             print("updating systemd-boot from %s to %s" % (installed_version, available_version))
             subprocess.check_call(["@systemd@/bin/bootctl", "--path=@efiSysMountPoint@", "update"])
-        else:
-            print("leaving systemd-boot %s in place (%s is not newer)" % (installed_version, available_version))
 
     mkdir_p("@efiSysMountPoint@/efi/nixos")
     mkdir_p("@efiSysMountPoint@/loader/entries")

From 28778e05a0e00ec7f6a0efb80f988c197df86943 Mon Sep 17 00:00:00 2001
From: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
Date: Fri, 15 Jul 2022 21:00:43 +0100
Subject: [PATCH 35/76] maintainers: add anoa

---
 maintainers/maintainer-list.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2fb788f41d44..93f6c48d43de 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -887,6 +887,13 @@
     githubId = 661909;
     name = "Antonio Nuno Monteiro";
   };
+  anoa = {
+    matrix = "@andrewm:amorgan.xyz";
+    email = "andrew@amorgan.xyz";
+    github = "anoadragon453";
+    githubId = 1342360;
+    name = "Andrew Morgan";
+  };
   anpryl = {
     email = "anpryl@gmail.com";
     github = "anpryl";

From 4f82bcc8225467540bba162db548f4d19ead1204 Mon Sep 17 00:00:00 2001
From: Andrew Morgan <1342360+anoadragon453@users.noreply.github.com>
Date: Fri, 15 Jul 2022 21:00:28 +0100
Subject: [PATCH 36/76] libuiohook: init at 1.2.2

---
 nixos/tests/all-tests.nix                     |  1 +
 nixos/tests/libuiohook.nix                    | 21 ++++++
 .../libraries/libuiohook/default.nix          | 71 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  4 ++
 4 files changed, 97 insertions(+)
 create mode 100644 nixos/tests/libuiohook.nix
 create mode 100644 pkgs/development/libraries/libuiohook/default.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 3253a3c750be..5714d4b3c5bb 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -279,6 +279,7 @@ in {
   libresprite = handleTest ./libresprite.nix {};
   libreswan = handleTest ./libreswan.nix {};
   librewolf = handleTest ./firefox.nix { firefoxPackage = pkgs.librewolf; };
+  libuiohook = handleTest ./libuiohook.nix {};
   lidarr = handleTest ./lidarr.nix {};
   lightdm = handleTest ./lightdm.nix {};
   limesurvey = handleTest ./limesurvey.nix {};
diff --git a/nixos/tests/libuiohook.nix b/nixos/tests/libuiohook.nix
new file mode 100644
index 000000000000..66c5033d9688
--- /dev/null
+++ b/nixos/tests/libuiohook.nix
@@ -0,0 +1,21 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "libuiohook";
+  meta = with lib.maintainers; { maintainers = [ anoa ]; };
+
+  nodes.client = { nodes, ... }:
+      let user = nodes.client.config.users.users.alice;
+      in {
+        imports = [ ./common/user-account.nix ./common/x11.nix ];
+
+        environment.systemPackages = [ pkgs.libuiohook.test ];
+
+        test-support.displayManager.auto.user = user.name;
+      };
+
+  testScript = { nodes, ... }:
+    let user = nodes.client.config.users.users.alice;
+    in ''
+      client.wait_for_x()
+      client.succeed("su - alice -c ${pkgs.libuiohook.test}/share/uiohook_tests >&2 &")
+    '';
+})
diff --git a/pkgs/development/libraries/libuiohook/default.nix b/pkgs/development/libraries/libuiohook/default.nix
new file mode 100644
index 000000000000..3f1f48317fdc
--- /dev/null
+++ b/pkgs/development/libraries/libuiohook/default.nix
@@ -0,0 +1,71 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, nixosTests
+, cmake
+, pkg-config
+, AppKit
+, ApplicationServices
+, Carbon
+, libX11
+, libxkbcommon
+, xinput
+, xorg
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libuiohook";
+  version = "1.2.2";
+
+  src = fetchFromGitHub {
+    owner = "kwhat";
+    repo = pname;
+    rev = version;
+    sha256 = "1qlz55fp4i9dd8sdwmy1m8i4i1jy1s09cpmlxzrgf7v34w72ncm7";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  buildInputs =
+    if stdenv.isDarwin then [ AppKit ApplicationServices Carbon ]
+    else [
+      libX11
+      libxkbcommon
+      xinput
+    ] ++
+    (with xorg; [
+      libXau
+      libXdmcp
+      libXi
+      libXinerama
+      libXt
+      libXtst
+      libXext
+      libxkbfile
+    ]);
+
+  outputs = [ "out" "test" ];
+
+  # We build the tests, but they're only installed when using the "test" output.
+  # This will produce a "uiohook_tests" binary which can be run to test the
+  # functionality of the library on the current system.
+  # Running the test binary requires a running X11 session.
+  cmakeFlags = [
+    "-DENABLE_TEST:BOOL=ON"
+  ];
+
+  postInstall = ''
+    mkdir -p $test/share
+    cp ./uiohook_tests $test/share
+  '';
+
+  meta = with lib; {
+    description = "A C library to provide global keyboard and mouse hooks from userland";
+    homepage = "https://github.com/kwhat/libuiohook";
+    license = licenses.gpl3Only;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ anoa ];
+  };
+
+  passthru.tests.libuiohook = nixosTests.libuiohook;
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 04234fe9d9f0..64b079b7e69b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -19662,6 +19662,10 @@ with pkgs;
 
   libuinputplus = callPackage ../development/libraries/libuinputplus { };
 
+  libuiohook = callPackage ../development/libraries/libuiohook {
+    inherit (darwin.apple_sdk.frameworks) AppKit ApplicationServices Carbon;
+  };
+
   libunistring = callPackage ../development/libraries/libunistring { };
 
   libupnp = callPackage ../development/libraries/pupnp { };

From 637c882de775313fbc8df44cdbf2e8d90e9f8f5e Mon Sep 17 00:00:00 2001
From: arcnmx <arcnmx@users.noreply.github.com>
Date: Sun, 17 Jul 2022 17:11:10 -0700
Subject: [PATCH 37/76] page: 3.1.0 -> 3.1.2

---
 pkgs/tools/misc/page/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/misc/page/default.nix b/pkgs/tools/misc/page/default.nix
index 818642af9753..7d574586a8a3 100644
--- a/pkgs/tools/misc/page/default.nix
+++ b/pkgs/tools/misc/page/default.nix
@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "page";
-  version = "3.1.0";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "I60R";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-3XRtTiIqUI2j9kmsg0yeuipgHEzdJRG2abO3Ll7ukmA=";
+    sha256 = "sha256-e6GkvIojMfsIm4UxRyEvvNkZPGSmUnf9K/0ZISy8kj4=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
     installShellCompletion --zsh $completions_dir/_page
   '';
 
-  cargoSha256 = "sha256-4Z58OkCvlGXmuTeVl0me3a/YImcKwggF9tXfenQnjtA=";
+  cargoSha256 = "sha256-qyaHW4mbJXZ/iGQlIzmTo2dgPLC9JlPKBee+uAuW5PQ=";
 
   meta = with lib; {
     description = "Use neovim as pager";

From 618e446ed1f49967e47306478ec9257742ec6b03 Mon Sep 17 00:00:00 2001
From: hqurve <hqurve@outlook.com>
Date: Sun, 17 Jul 2022 13:32:57 -0400
Subject: [PATCH 38/76] openbangla-keyboard: init at 2.0.0

---
 .../misc/openbangla-keyboard/Cargo.lock       | 251 ++++++++++++++++++
 .../misc/openbangla-keyboard/default.nix      |  72 +++++
 pkgs/top-level/all-packages.nix               |   2 +
 3 files changed, 325 insertions(+)
 create mode 100644 pkgs/applications/misc/openbangla-keyboard/Cargo.lock
 create mode 100644 pkgs/applications/misc/openbangla-keyboard/default.nix

diff --git a/pkgs/applications/misc/openbangla-keyboard/Cargo.lock b/pkgs/applications/misc/openbangla-keyboard/Cargo.lock
new file mode 100644
index 000000000000..6fa93003a60c
--- /dev/null
+++ b/pkgs/applications/misc/openbangla-keyboard/Cargo.lock
@@ -0,0 +1,251 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "ahash"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8fd72866655d1904d6b0997d0b07ba561047d070fbe29de039031c641b61217"
+
+[[package]]
+name = "aho-corasick"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c02a4d71819009c192cf4872265391563fd6a84c81ff2c0f2a7026ca4c1d85c"
+dependencies = [
+ "cfg-if",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6455c0ca19f0d2fbf751b908d5c55c1f5cbc65e03c4225427254b46890bdde1e"
+dependencies = [
+ "cfg-if",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07db9d94cbd326813772c968ccd25999e5f8ae22f4f8d1b11effa37ef6ce281d"
+dependencies = [
+ "autocfg",
+ "cfg-if",
+ "crossbeam-utils",
+ "memoffset",
+ "once_cell",
+ "scopeguard",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d82ee10ce34d7bc12c2122495e7593a9c41347ecdd64185af4ecf72cb1a7f83"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+]
+
+[[package]]
+name = "edit-distance"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbbaaaf38131deb9ca518a274a45bfdb8771f139517b073b16c2d3d32ae5037b"
+
+[[package]]
+name = "either"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f107b87b6afc2a64fd13cac55fe06d6c8859f12d4b14cbcdd2c67d0976781be"
+
+[[package]]
+name = "hashbrown"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91b62f79061a0bc2e046024cb7ba44b08419ed238ecbd9adbd787434b9e8c25"
+dependencies = [
+ "ahash",
+ "autocfg",
+ "rayon",
+ "serde",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "112c678d4050afce233f4f2852bb2eb519230b3cf12f33585275537d7e41578d"
+
+[[package]]
+name = "libc"
+version = "0.2.126"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349d5a591cd28b49e1d1037471617a32ddcda5731b99419008085f72d5a53836"
+
+[[package]]
+name = "memchr"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dffe52ecf27772e601905b7522cb4ef790d2cc203488bbd0e2fe85fcb74566d"
+
+[[package]]
+name = "memoffset"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19e64526ebdee182341572e50e9ad03965aa510cd94427a4549448f285e957a1"
+dependencies = [
+ "hermit-abi",
+ "libc",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18a6dbe30758c9f83eb00cbea4ac95966305f5a7772f3f42ebfc7fc7eddbd8e1"
+
+[[package]]
+name = "rayon"
+version = "1.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd99e5772ead8baa5215278c9b15bf92087709e9c1b2d1f97cdb5a183c933a7d"
+dependencies = [
+ "autocfg",
+ "crossbeam-deque",
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "258bcdb5ac6dad48491bb2992db6b7cf74878b0384908af124823d118c99683f"
+dependencies = [
+ "crossbeam-channel",
+ "crossbeam-deque",
+ "crossbeam-utils",
+ "num_cpus",
+]
+
+[[package]]
+name = "regex"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c4eb3267174b8c6c2f654116623910a0fef09c4753f8dd83db29c48a0df988b"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3f87b73ce11b1619a3c6332f45341e0047173771e8b8b73f87bfeefb7b56244"
+
+[[package]]
+name = "riti"
+version = "0.1.0"
+dependencies = [
+ "edit-distance",
+ "either",
+ "hashbrown",
+ "rayon",
+ "regex",
+ "rupantor",
+ "serde_json",
+ "stringplus",
+]
+
+[[package]]
+name = "rupantor"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04eb802986005129b0946dbb4baa420bf14cea547c5ee6b57ba081d9e85f6a4b"
+dependencies = [
+ "serde_json",
+ "stringplus",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3f6f92acf49d1b98f7a81226834412ada05458b7364277387724a237f062695"
+
+[[package]]
+name = "scopeguard"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
+
+[[package]]
+name = "serde"
+version = "1.0.139"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0171ebb889e45aa68b44aee0859b3eede84c6f5f5c228e6f140c0b2a0a46cad6"
+
+[[package]]
+name = "serde_json"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "82c2c1fdcd807d1098552c5b9a36e425e42e9fbd7c6a37a8425f390f781f7fa7"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "stringplus"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9057d3b491a3eee749e52560657c4d93b0badc04fb3fa8dae3c942c5c066f222"
diff --git a/pkgs/applications/misc/openbangla-keyboard/default.nix b/pkgs/applications/misc/openbangla-keyboard/default.nix
new file mode 100644
index 000000000000..28b730e0b2d8
--- /dev/null
+++ b/pkgs/applications/misc/openbangla-keyboard/default.nix
@@ -0,0 +1,72 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, rustPlatform
+, wrapQtAppsHook
+, ibus
+, qtbase
+, zstd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openbangla-keyboard";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "openbangla";
+    repo = "openbangla-keyboard";
+    rev = version;
+    hash = "sha256-UoLiysaA0Wob/SLBqm36Txqb8k7bwoQ56h8ZufHR74I=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    rustPlatform.rust.cargo
+    rustPlatform.rust.rustc
+    rustPlatform.cargoSetupHook
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    ibus
+    qtbase
+    zstd
+  ];
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    postPatch = ''
+      cp ${./Cargo.lock} Cargo.lock
+    '';
+    sourceRoot = "source/${cargoRoot}";
+    sha256 = "sha256-01MWuUUirsgpoprMArRp3qxKNayPHTkYWk31nXcIC34=";
+  };
+
+  cargoRoot = "src/engine/riti";
+  postPatch = ''
+    cp ${./Cargo.lock} ${cargoRoot}/Cargo.lock
+
+    substituteInPlace CMakeLists.txt \
+      --replace "/usr" "$out"
+
+    substituteInPlace src/shared/FileSystem.cpp \
+      --replace "/usr" "$out"
+  '';
+
+  postInstall = ''
+    mkdir -p $out/bin
+    ln -s $out/share/openbangla-keyboard/openbangla-gui $out/bin/openbangla-gui
+  '';
+
+  meta = with lib; {
+    description = "An OpenSource, Unicode compliant Bengali Input Method";
+    homepage = "https://openbangla.github.io/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ hqurve ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d1861b2a81d5..68bc20ac9404 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9183,6 +9183,8 @@ with pkgs;
   openapi-generator-cli = callPackage ../tools/networking/openapi-generator-cli { jre = pkgs.jre_headless; };
   openapi-generator-cli-unstable = callPackage ../tools/networking/openapi-generator-cli/unstable.nix { jre = pkgs.jre_headless; };
 
+  openbangla-keyboard = libsForQt5.callPackage ../applications/misc/openbangla-keyboard { };
+
   openboard = libsForQt5.callPackage ../applications/graphics/openboard { };
 
   opencc = callPackage ../tools/text/opencc { };

From dd927c3f52aaaf73ee4d01958d85704d90c71dea Mon Sep 17 00:00:00 2001
From: Soham S Gumaste <sgumas2@uic.edu>
Date: Tue, 12 Jul 2022 14:19:13 -0500
Subject: [PATCH 39/76] adcli: init at 0.9.1

---
 pkgs/os-specific/linux/adcli/default.nix | 68 ++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix          |  2 +
 2 files changed, 70 insertions(+)
 create mode 100644 pkgs/os-specific/linux/adcli/default.nix

diff --git a/pkgs/os-specific/linux/adcli/default.nix b/pkgs/os-specific/linux/adcli/default.nix
new file mode 100644
index 000000000000..977c1d09dbae
--- /dev/null
+++ b/pkgs/os-specific/linux/adcli/default.nix
@@ -0,0 +1,68 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, fetchpatch
+, openldap
+, libkrb5
+, libxslt
+, autoreconfHook
+, pkg-config
+, cyrus_sasl
+, util-linux
+, xmlto
+, docbook_xsl
+, docbook_xml_dtd_43
+}:
+
+stdenv.mkDerivation rec {
+  pname = "adcli";
+  version = "0.9.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "realmd";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-Zzt4qgLiJNuSrbtDWuxJEfGL7sWSbqN301q3qXZpn9c=";
+  };
+
+  # https://bugs.gentoo.org/820224
+  # Without this it produces some weird missing symbol error in glibc
+  patches = [
+    (fetchpatch {
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-crypt/adcli/files/adcli-0.9.1-glibc-2.34-resolv.patch?id=01db544de893262e857685e11b33c2a74210181f";
+      sha256 = "sha256-dZ6dkzxd+0XjY/X9/2IWMan3syvCDGFHiMbxFxMHGFA=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace tools/Makefile.am \
+      --replace 'sbin_PROGRAMS' 'bin_PROGRAMS'
+
+    substituteInPlace doc/Makefile.am \
+        --replace 'http://docbook.sourceforge.net/release/xsl/current/manpages/docbook.xsl' \
+                  '${docbook_xsl}/xml/xsl/docbook/manpages/docbook.xsl'
+
+    function patch_docbook(){
+      substituteInPlace $1 \
+        --replace "http://www.oasis-open.org/docbook/xml/4.3/docbookx.dtd" \
+                  "${docbook_xml_dtd_43}/xml/dtd/docbook/docbookx.dtd"
+    }
+    patch_docbook doc/adcli.xml
+    patch_docbook doc/adcli-devel.xml
+    patch_docbook doc/adcli-docs.xml
+  '';
+  nativeBuildInputs = [ autoreconfHook pkg-config docbook_xsl ];
+
+  buildInputs = [ openldap libkrb5 libxslt cyrus_sasl util-linux xmlto docbook_xsl ];
+
+  configureFlags = [ "--disable-debug" ];
+
+  meta = with lib; {
+    homepage = "https://www.freedesktop.org/software/realmd/adcli/adcli.html";
+    description = "A helper library and tools for Active Directory client operations.";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ SohamG ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 45039c4cf52d..224def01327c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -216,6 +216,8 @@ with pkgs;
 
   quickemu = callPackage ../development/quickemu { };
 
+  adcli = callPackage ../os-specific/linux/adcli { };
+
   aether = callPackage ../applications/networking/aether { };
 
   alda = callPackage ../development/interpreters/alda { };

From 586a0b593b5848b2ba41b53be4cdd28edeb52c4d Mon Sep 17 00:00:00 2001
From: Peter Hoeg <peter@hoeg.com>
Date: Fri, 15 Jul 2022 13:44:08 +0800
Subject: [PATCH 40/76] prometheus-domain-exporter: 1.11.0 -> 1.17.1

---
 .../monitoring/prometheus/domain-exporter.nix  | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/pkgs/servers/monitoring/prometheus/domain-exporter.nix b/pkgs/servers/monitoring/prometheus/domain-exporter.nix
index 78c35d8cf16e..fc455b92ae89 100644
--- a/pkgs/servers/monitoring/prometheus/domain-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/domain-exporter.nix
@@ -1,17 +1,25 @@
-{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch, nixosTests }:
 
 buildGoModule rec {
   pname = "domain-exporter";
-  version = "1.11.0";
+  version = "1.17.1";
 
   src = fetchFromGitHub {
     owner = "caarlos0";
     repo = "domain_exporter";
     rev = "v${version}";
-    sha256 = "018y0xwdn2f2shhwaa0hqm4y8xsbqwif0733qb0377wpjbj4v137";
+    hash = "sha256-18r+jUdVcv7hA9KdWkgvu2tNUIGf9f1uj2cwwMDnAs8=";
   };
 
-  vendorSha256 = "0s1hs8byba9y57abg386n09wfg1wcqpzs164ap0km8ap2i96bdlb";
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/caarlos0/domain_exporter/commit/32815b0956056c5c14313d0b860d1e9db754e545.patch";
+      hash = "sha256-iEYnJ4BU+MWQd0BgKmRb8RNj/lH2V/Z9uwFS2muR4Go=";
+      name = "sg_domains.patch";
+    })
+  ];
+
+  vendorSha256 = "sha256-LHs2DSLNe+E3NUXZS7TV5M53ueUbCjjNM87UPRTaCpo=";
 
   doCheck = false; # needs internet connection
 
@@ -21,6 +29,6 @@ buildGoModule rec {
     homepage = "https://github.com/caarlos0/domain_exporter";
     description = "Exports the expiration time of your domains as prometheus metrics";
     license = licenses.mit;
-    maintainers = with maintainers; [ mmilata prusnak ];
+    maintainers = with maintainers; [ mmilata prusnak peterhoeg ];
   };
 }

From 2c184fc2002a9765e4f4e6e86402b8cb550156c0 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Thu, 14 Jul 2022 10:46:16 -0700
Subject: [PATCH 41/76] python3Packages.protobuf: allow for
 buildPackages.protobuf to be passed

---
 pkgs/development/python-modules/protobuf/default.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/protobuf/default.nix b/pkgs/development/python-modules/protobuf/default.nix
index 30e9fbf9ea75..ee1d0bbffb5a 100644
--- a/pkgs/development/python-modules/protobuf/default.nix
+++ b/pkgs/development/python-modules/protobuf/default.nix
@@ -19,7 +19,12 @@ buildPythonPackage {
   doCheck = doCheck && !isPy27; # setuptools>=41.4 no longer collects correctly on python2
 
   propagatedBuildInputs = [ six ] ++ lib.optionals isPy27 [ google-apputils ];
-  propagatedNativeBuildInputs = [ buildPackages.protobuf ]; # For protoc.
+  propagatedNativeBuildInputs = let
+    protobufVersion = "${lib.versions.major protobuf.version}_${lib.versions.minor protobuf.version}";
+  in [
+    buildPackages."protobuf${protobufVersion}" # For protoc of the same version.
+  ];
+
   nativeBuildInputs = [ pyext ] ++ lib.optionals isPy27 [ google-apputils ];
   buildInputs = [ protobuf ];
 

From 5c38e6b3d27fa613087a2245e82f07ccd1f8c8a3 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Wed, 20 Apr 2022 16:04:10 -0700
Subject: [PATCH 42/76] protobuf: add cmake generic builder

---
 .../libraries/protobuf/generic-v3-cmake.nix   | 107 ++++++++++++++++++
 1 file changed, 107 insertions(+)
 create mode 100644 pkgs/development/libraries/protobuf/generic-v3-cmake.nix

diff --git a/pkgs/development/libraries/protobuf/generic-v3-cmake.nix b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
new file mode 100644
index 000000000000..0b6967a67385
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/generic-v3-cmake.nix
@@ -0,0 +1,107 @@
+# The cmake version of this build is meant to enable both cmake and .pc being exported
+# this is important because grpc exports a .cmake file which also expects for protobuf
+# to have been exported through cmake as well.
+{ lib
+, stdenv
+, abseil-cpp
+, buildPackages
+, cmake
+, fetchFromGitHub
+, fetchpatch
+, gtest
+, zlib
+, version
+, sha256
+
+# downstream dependencies
+, python3
+
+, ...
+}:
+
+let
+  self = stdenv.mkDerivation {
+    pname = "protobuf";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "protocolbuffers";
+      repo = "protobuf";
+      rev = "v${version}";
+      inherit sha256;
+    };
+
+    # re-create submodule logic
+    postPatch = ''
+      rm -rf gmock
+      cp -r ${gtest.src}/googlemock third_party/gmock
+      cp -r ${gtest.src}/googletest third_party/
+      chmod -R a+w third_party/
+
+      ln -s ../googletest third_party/gmock/gtest
+      ln -s ../gmock third_party/googletest/googlemock
+      ln -s $(pwd)/third_party/googletest third_party/googletest/googletest
+    '' + lib.optionalString stdenv.isDarwin ''
+      substituteInPlace src/google/protobuf/testing/googletest.cc \
+        --replace 'tmpnam(b)' '"'$TMPDIR'/foo"'
+    '';
+
+    patches = lib.optionals (lib.versionOlder version "3.22") [
+      # fix protobuf-targets.cmake installation paths, and allow for CMAKE_INSTALL_LIBDIR to be absolute
+      # https://github.com/protocolbuffers/protobuf/pull/10090
+      (fetchpatch {
+        url = "https://github.com/protocolbuffers/protobuf/commit/a7324f88e92bc16b57f3683403b6c993bf68070b.patch";
+        sha256 = "sha256-SmwaUjOjjZulg/wgNmR/F5b8rhYA2wkKAjHIOxjcQdQ=";
+      })
+    ];
+
+    nativeBuildInputs = let
+      protobufVersion = "${lib.versions.major version}_${lib.versions.minor version}";
+    in [
+      cmake
+    ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+      # protoc of the same version must be available for build. For non-cross builds, it's able to
+      # re-use the executable generated as part of the build
+      buildPackages."protobuf${protobufVersion}"
+    ];
+
+    buildInputs = [
+      abseil-cpp
+      zlib
+    ];
+
+    # After 3.20, CMakeLists.txt can now be found at the top-level, however
+    # a stub cmake/CMakeLists.txt still exists for compatibility with previous build assumptions
+    cmakeDir = "../cmake";
+    cmakeFlags = [
+      "-Dprotobuf_ABSL_PROVIDER=package"
+      ] ++ lib.optionals (!stdenv.targetPlatform.isStatic) [
+      "-Dprotobuf_BUILD_SHARED_LIBS=ON"
+    ];
+
+    # unfortunately the shared libraries have yet to been patched by nix, thus tests will fail
+    doCheck = false;
+
+    passthru = {
+      tests = {
+        pythonProtobuf = python3.pkgs.protobuf.override(_: {
+          protobuf = self;
+        });
+      };
+    };
+
+    meta = {
+      description = "Google's data interchange format";
+      longDescription = ''
+        Protocol Buffers are a way of encoding structured data in an efficient
+        yet extensible format. Google uses Protocol Buffers for almost all of
+        its internal RPC protocols and file formats.
+      '';
+      license = lib.licenses.bsd3;
+      platforms = lib.platforms.unix;
+      homepage = "https://developers.google.com/protocol-buffers/";
+      maintainers = with lib.maintainers; [ jonringer ];
+    };
+  };
+in
+  self

From 436f9e14b11fbd46accc45dbf844524db3639cfe Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Wed, 20 Apr 2022 16:04:52 -0700
Subject: [PATCH 43/76] protobuf3_20: init at 3.20.1

---
 pkgs/development/libraries/protobuf/3.20.nix | 6 ++++++
 pkgs/top-level/all-packages.nix              | 1 +
 2 files changed, 7 insertions(+)
 create mode 100644 pkgs/development/libraries/protobuf/3.20.nix

diff --git a/pkgs/development/libraries/protobuf/3.20.nix b/pkgs/development/libraries/protobuf/3.20.nix
new file mode 100644
index 000000000000..93d180159b87
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/3.20.nix
@@ -0,0 +1,6 @@
+{ callPackage, abseil-cpp, ... }:
+
+callPackage ./generic-v3.nix {
+  version = "3.20.1";
+  sha256 = "sha256-pAMacD0UQetqysZHszu5slPqp0iREtDmHFv1cgcUBJA=";
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index daab3de1f055..83966fcc197e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20527,6 +20527,7 @@ with pkgs;
 
   protobuf = protobuf3_19;
 
+  protobuf3_20 = callPackage ../development/libraries/protobuf/3.20.nix { };
   protobuf3_19 = callPackage ../development/libraries/protobuf/3.19.nix { };
   protobuf3_17 = callPackage ../development/libraries/protobuf/3.17.nix { };
   protobuf3_11 = callPackage ../development/libraries/protobuf/3.11.nix { };

From 950a258b9ef24ca4346bbf722a694c2ab54e4654 Mon Sep 17 00:00:00 2001
From: Jonathan Ringer <jonringer117@gmail.com>
Date: Tue, 31 May 2022 16:35:11 -0700
Subject: [PATCH 44/76] protobuf3_21: init at 3.21.2

---
 pkgs/development/libraries/protobuf/3.21.nix | 6 ++++++
 pkgs/top-level/all-packages.nix              | 1 +
 2 files changed, 7 insertions(+)
 create mode 100644 pkgs/development/libraries/protobuf/3.21.nix

diff --git a/pkgs/development/libraries/protobuf/3.21.nix b/pkgs/development/libraries/protobuf/3.21.nix
new file mode 100644
index 000000000000..70c6095ae7b6
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/3.21.nix
@@ -0,0 +1,6 @@
+{ callPackage, abseil-cpp, ... }:
+
+callPackage ./generic-v3-cmake.nix {
+  version = "3.21.2";
+  sha256 = "sha256-DUv07pWiZV7jNeSA2ClDOz9DY0x/hiJynxkbSTeJOSs=";
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 83966fcc197e..f216586023ba 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20527,6 +20527,7 @@ with pkgs;
 
   protobuf = protobuf3_19;
 
+  protobuf3_21 = callPackage ../development/libraries/protobuf/3.21.nix { };
   protobuf3_20 = callPackage ../development/libraries/protobuf/3.20.nix { };
   protobuf3_19 = callPackage ../development/libraries/protobuf/3.19.nix { };
   protobuf3_17 = callPackage ../development/libraries/protobuf/3.17.nix { };

From ae0b8a01b10a689d0d33e9024b8480069e5c854d Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Mon, 11 Jul 2022 08:46:37 +0200
Subject: [PATCH 45/76] =?UTF-8?q?ocamlPackages.gapi-ocaml:=200.4.2=20?=
 =?UTF-8?q?=E2=86=92=200.4.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../networking/google-drive-ocamlfuse/default.nix  |  4 ++--
 .../ocaml-modules/gapi-ocaml/default.nix           | 14 ++++++--------
 pkgs/top-level/ocaml-packages.nix                  |  2 +-
 3 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/pkgs/applications/networking/google-drive-ocamlfuse/default.nix b/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
index 02df4313f7fc..eb677eb00ded 100644
--- a/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
+++ b/pkgs/applications/networking/google-drive-ocamlfuse/default.nix
@@ -1,5 +1,5 @@
 { lib, buildDunePackage, fetchFromGitHub
-, ocaml_extlib, ocamlfuse, gapi_ocaml, ocaml_sqlite3
+, ocaml_extlib, ocamlfuse, gapi-ocaml, ocaml_sqlite3
 , tiny_httpd
 , ounit
 }:
@@ -18,7 +18,7 @@ buildDunePackage rec {
   doCheck = true;
   checkInputs = [ ounit ];
 
-  buildInputs = [ ocaml_extlib ocamlfuse gapi_ocaml ocaml_sqlite3 tiny_httpd ];
+  buildInputs = [ ocaml_extlib ocamlfuse gapi-ocaml ocaml_sqlite3 tiny_httpd ];
 
   meta = {
     inherit (src.meta) homepage;
diff --git a/pkgs/development/ocaml-modules/gapi-ocaml/default.nix b/pkgs/development/ocaml-modules/gapi-ocaml/default.nix
index c417d94e2947..f9e566eb0494 100644
--- a/pkgs/development/ocaml-modules/gapi-ocaml/default.nix
+++ b/pkgs/development/ocaml-modules/gapi-ocaml/default.nix
@@ -1,31 +1,29 @@
 { lib, fetchFromGitHub, buildDunePackage, ocaml
 , cryptokit, ocamlnet, ocurl, yojson
-, ounit
+, ounit2
 }:
 
 buildDunePackage rec {
   pname = "gapi-ocaml";
-  version = "0.4.2";
+  version = "0.4.3";
 
-  useDune2 = true;
-
-  minimumOCamlVersion = "4.02";
+  minimalOCamlVersion = "4.02";
 
   src = fetchFromGitHub {
     owner = "astrada";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-imicHOlNjPHHW/lcWRJmURafYZFe/6J3efKPJcel8J8=";
+    sha256 = "sha256-V0GB9Bd06IdcI5PDFHGVZ0Y/qi7tTs/4ITqPXUOxCLs=";
   };
 
   propagatedBuildInputs = [ cryptokit ocamlnet ocurl yojson ];
 
   doCheck = lib.versionAtLeast ocaml.version "4.04";
-  checkInputs = [ ounit ];
+  checkInputs = [ ounit2 ];
 
   meta = {
     description = "OCaml client for google services";
-    homepage = "http://gapi-ocaml.forge.ocamlcore.org";
+    inherit (src.meta) homepage;
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ bennofs ];
   };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index d794592461f7..07257daa0039 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -549,7 +549,7 @@ let
 
     dypgen = callPackage ../development/ocaml-modules/dypgen { };
 
-    gapi_ocaml = callPackage ../development/ocaml-modules/gapi-ocaml { };
+    gapi-ocaml = callPackage ../development/ocaml-modules/gapi-ocaml { };
 
     gen_js_api = callPackage ../development/ocaml-modules/gen_js_api { };
 

From 622952b45e2fd9c9c4e0f8420dede900fff7a933 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 18 Jul 2022 07:33:09 +0000
Subject: [PATCH 46/76] purescript: 0.15.2 -> 0.15.4

---
 .../development/compilers/purescript/purescript/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/purescript/purescript/default.nix b/pkgs/development/compilers/purescript/purescript/default.nix
index 46d74309660a..f914bc482d55 100644
--- a/pkgs/development/compilers/purescript/purescript/default.nix
+++ b/pkgs/development/compilers/purescript/purescript/default.nix
@@ -18,7 +18,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "purescript";
-  version = "0.15.2";
+  version = "0.15.4";
 
   # These hashes can be updated automatically by running the ./update.sh script.
   src =
@@ -26,12 +26,12 @@ in stdenv.mkDerivation rec {
     then
     fetchurl {
       url = "https://github.com/${pname}/${pname}/releases/download/v${version}/macos.tar.gz";
-      sha256 = "06fsq9ynfvfqn3ac5jxdj81lmzd6bh84p7jz5qib31h27iy5aq4h";
+      sha256 = "0rksc6c98pp48lcavair6apjpgq3s1zz0lhkc59vbz67c8zxc26d";
     }
     else
     fetchurl {
       url = "https://github.com/${pname}/${pname}/releases/download/v${version}/linux64.tar.gz";
-      sha256 = "1p37k6briczw6gvw04idkx734ms1swgrx9sl4hi6xwvxkfp1nm0m";
+      sha256 = "13p6qsba6kmcsppc3z6vcm3v5c7jxhp10nyvxry4nmj9mkdmjaiy";
     };
 
 

From 09e68b853589a194ad0e83bae457856c1ca954cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lo=C3=AFc=20Reynier?= <loic@loicreynier.fr>
Date: Fri, 8 Jul 2022 14:40:36 +0200
Subject: [PATCH 47/76] fzf-obc: init at 1.3.0

Co-authored-by: Sandro <sandro.jaeckel@gmail.com>
---
 pkgs/shells/bash/fzf-obc/default.nix | 30 ++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix      |  2 ++
 2 files changed, 32 insertions(+)
 create mode 100644 pkgs/shells/bash/fzf-obc/default.nix

diff --git a/pkgs/shells/bash/fzf-obc/default.nix b/pkgs/shells/bash/fzf-obc/default.nix
new file mode 100644
index 000000000000..7621ae8c73c0
--- /dev/null
+++ b/pkgs/shells/bash/fzf-obc/default.nix
@@ -0,0 +1,30 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "fzf-obc";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "rockandska";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-KIAlDpt1Udl+RLp3728utgQ9FCjZz/OyoG92MOJmgPI=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/share/fzf-obc/{bin,lib/fzf-obc,plugins/{kill,gradle}}
+    install -m644 bin/* $out/share/fzf-obc/bin
+    install -m644 lib/fzf-obc/* $out/share/fzf-obc/lib/fzf-obc
+    install -m644 plugins/kill/* $out/share/fzf-obc/plugins/kill
+    install -m644 plugins/gradle/* $out/share/fzf-obc/plugins/gradle
+  '';
+
+  meta = with lib; {
+    homepage = "https://fzf-obc.readthedocs.io";
+    description = "Completion script adding fzf over all know bash completion functions";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ loicreynier ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ceacfe402229..9fb1f0fd0561 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3599,6 +3599,8 @@ with pkgs;
 
   fzf = callPackage ../tools/misc/fzf { };
 
+  fzf-obc = callPackage ../shells/bash/fzf-obc { };
+
   fzf-zsh = callPackage ../shells/zsh/fzf-zsh { };
 
   fzy = callPackage ../tools/misc/fzy { };

From caa3cefeb5082fe770c0e62984d52bc742810f79 Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sun, 17 Jul 2022 12:00:00 +0000
Subject: [PATCH 48/76] ocamlPackages.chrome-trace: init at ${dune.version}

---
 .../ocaml-modules/chrome-trace/default.nix    | 20 +++++++++++++++++++
 pkgs/top-level/ocaml-packages.nix             |  2 ++
 2 files changed, 22 insertions(+)
 create mode 100644 pkgs/development/ocaml-modules/chrome-trace/default.nix

diff --git a/pkgs/development/ocaml-modules/chrome-trace/default.nix b/pkgs/development/ocaml-modules/chrome-trace/default.nix
new file mode 100644
index 000000000000..fb6c14b3362e
--- /dev/null
+++ b/pkgs/development/ocaml-modules/chrome-trace/default.nix
@@ -0,0 +1,20 @@
+{ lib, buildDunePackage, dune_3 }:
+
+buildDunePackage rec {
+  pname = "chrome-trace";
+  inherit (dune_3) src version;
+
+  duneVersion = "3";
+
+  dontAddPrefix = true;
+
+  preBuild = ''
+    rm -r vendor/csexp
+  '';
+
+  meta = with lib; {
+    description = "Chrome trace event generation library";
+    inherit (dune_3.meta) homepage;
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 07257daa0039..1955f962b7c7 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -181,6 +181,8 @@ let
 
     checkseum = callPackage ../development/ocaml-modules/checkseum { };
 
+    chrome-trace = callPackage ../development/ocaml-modules/chrome-trace { };
+
     cil = callPackage ../development/ocaml-modules/cil { };
 
     cmdliner_1_0 = callPackage ../development/ocaml-modules/cmdliner/1_0.nix { };

From 9eddb61dcffc7602a1a88e858d695fad956af89d Mon Sep 17 00:00:00 2001
From: Guillaume Girol <symphorien+git@xlumurb.eu>
Date: Sun, 17 Jul 2022 12:00:00 +0000
Subject: [PATCH 49/76] ocaml-ng.ocamlPackages_4_14.ocaml-lsp: 1.11 -> 1.12

---
 .../ocaml-modules/ocaml-lsp/jsonrpc.nix        | 10 +++++++---
 .../ocaml-modules/ocaml-lsp/lsp.nix            | 18 +++++++++++++++++-
 2 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix b/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
index 2e6802a50426..4e79e0310ac6 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/jsonrpc.nix
@@ -12,17 +12,21 @@
 let params =
   if lib.versionAtLeast ocaml.version "4.14"
   then {
-    version = "1.11.3";
-    sha256 = "sha256-KlMFh05O04I0Xil2B+nL2hUxZw0jaDMUnI23oUwGyhs=";
+    name = "lsp";
+    version = "1.12.4";
+    sha256 = "sha256-kZuYAny8VjWdq+ipEdPSTRcGzqjNBOgXOi0dOwb52EY=";
   } else if lib.versionAtLeast ocaml.version "4.13"
   then {
+    name = "jsonrpc";
     version = "1.10.5";
     sha256 = "sha256-TeJS6t1ruWhWPvWNatrnSUWI6T17XKiosHLYizBDDcw=";
   } else if lib.versionAtLeast ocaml.version "4.12"
   then {
+    name = "jsonrpc";
     version = "1.9.0";
     sha256 = "sha256:1ac44n6g3rf84gvhcca545avgf9vpkwkkkm0s8ipshfhp4g4jikh";
   } else {
+    name = "jsonrpc";
     version = "1.4.1";
     sha256 = "1ssyazc0yrdng98cypwa9m3nzfisdzpp7hqnx684rqj8f0g3gs6f";
   }
@@ -32,7 +36,7 @@ buildDunePackage rec {
   pname = "jsonrpc";
   inherit (params) version;
   src = fetchurl {
-    url = "https://github.com/ocaml/ocaml-lsp/releases/download/${version}/jsonrpc-${version}.tbz";
+    url = "https://github.com/ocaml/ocaml-lsp/releases/download/${version}/${params.name}-${version}.tbz";
     inherit (params) sha256;
   };
 
diff --git a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
index faa149519077..3111d4277c41 100644
--- a/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
+++ b/pkgs/development/ocaml-modules/ocaml-lsp/lsp.nix
@@ -13,6 +13,7 @@
 , dyn
 , re
 , stdune
+, chrome-trace
 , dune_3
 , csexp
 , pp
@@ -40,7 +41,22 @@ buildDunePackage rec {
   '';
 
   buildInputs =
-    if lib.versionAtLeast version "1.10.0" then
+    if lib.versionAtLeast version "1.12.0" then
+      [
+        pp
+        re
+        ppx_yojson_conv_lib
+        octavius
+        dune-build-info
+        dune-rpc
+        omd
+        cmdliner
+        ocamlformat-rpc-lib
+        dyn
+        stdune
+        chrome-trace
+      ]
+    else if lib.versionAtLeast version "1.10.0" then
       [
         pp
         re

From a170fbe73a2d83532747ff3c79f36cc3a1567ac3 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Wed, 13 Jul 2022 08:59:52 +1000
Subject: [PATCH 50/76] zls: set platforms

---
 pkgs/development/tools/zls/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/tools/zls/default.nix b/pkgs/development/tools/zls/default.nix
index a48dbf9e30f9..8cb041b90b2e 100644
--- a/pkgs/development/tools/zls/default.nix
+++ b/pkgs/development/tools/zls/default.nix
@@ -28,5 +28,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/zigtools/zls";
     license = licenses.mit;
     maintainers = with maintainers; [ fortuneteller2k ];
+    platforms = platforms.unix;
   };
 }

From c03fbc7db8099365a1c9034f5fa663b11954cdb0 Mon Sep 17 00:00:00 2001
From: Alexander Kiselyov <aleksandr.kiselyov@gmail.com>
Date: Mon, 18 Jul 2022 13:21:23 +0300
Subject: [PATCH 51/76] p4est: fixed versioning (#180737)

---
 .../libraries/science/math/p4est/default.nix        | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/libraries/science/math/p4est/default.nix b/pkgs/development/libraries/science/math/p4est/default.nix
index c38b0d623bac..9396a9144423 100644
--- a/pkgs/development/libraries/science/math/p4est/default.nix
+++ b/pkgs/development/libraries/science/math/p4est/default.nix
@@ -1,5 +1,8 @@
-{ lib, stdenv, fetchFromGitHub
-, autoreconfHook, pkg-config
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
 , p4est-withMetis ? true, metis
 , p4est-sc
 }:
@@ -31,9 +34,11 @@ stdenv.mkDerivation {
   postPatch = ''
     sed -i -e "s:\(^\s*ACLOCAL_AMFLAGS.*\)\s@P4EST_SC_AMFLAGS@\s*$:\1 -I ${p4est-sc}/share/aclocal:" Makefile.am
   '';
-  preConfigure = ''
+  preAutoreconf = ''
     echo "2.8.0" > .tarball-version
-    ${if mpiSupport then "unset CC" else ""}
+  '';
+  preConfigure = lib.optionalString mpiSupport ''
+    unset CC
   '';
 
   configureFlags = p4est-sc.configureFlags

From 533140b7bf12ffdcdb4deaf48db9d4469c9901e7 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 13 Jul 2022 09:38:52 +0200
Subject: [PATCH 52/76] python310Packages.django-sampledatahelper: Drop package

---
 .../django-sampledatahelper/default.nix       | 39 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 3 files changed, 1 insertion(+), 41 deletions(-)
 delete mode 100644 pkgs/development/python-modules/django-sampledatahelper/default.nix

diff --git a/pkgs/development/python-modules/django-sampledatahelper/default.nix b/pkgs/development/python-modules/django-sampledatahelper/default.nix
deleted file mode 100644
index 4ff2b7ba8539..000000000000
--- a/pkgs/development/python-modules/django-sampledatahelper/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, versiontools
-, django
-, sampledata
-, nose
-, pillow
-, six
-}:
-
-buildPythonPackage rec {
-  pname = "django-sampledatahelper";
-  version = "0.5";
-
-  # no tests on PyPI
-  src = fetchFromGitHub {
-    owner = "kaleidos";
-    repo = "django-sampledatahelper";
-    rev = "8576f352ec26a3650f4386a6e1285b723f6aec23"; # no tag
-    sha256 = "1fx3ql4b9791594zkary19n20x5ra1m1n3pjaya9di1qy64csac4";
-  };
-
-  nativeBuildInputs = [ versiontools ];
-
-  propagatedBuildInputs = [ django sampledata ];
-
-  checkInputs = [ nose pillow six ];
-
-  checkPhase = ''
-    DJANGO_SETTINGS_MODULE=tests.settings NOSE_EXCLUDE=test_calling_command nosetests -v
-  '';
-
-  meta = {
-    description = "Helper class for generate sample data for django apps development";
-    homepage = "https://github.com/kaleidos/django-sampledatahelper";
-    license = lib.licenses.bsd3;
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 087417c9fb35..58223bafd5ba 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -55,6 +55,7 @@ mapAliases ({
   diff_cover = diff-cover; # added 2021-07-02
   discogs_client = discogs-client; # added 2021-07-02
   djangorestframework-jwt = drf-jwt; # added 2021-07-20
+  django-sampledatahelper = throw "django-sampledatahelper was removed because it is no longer compatible to latest Django version"; # added 2022-07-18
   django_2 = throw "Django 2 has reached it's projected EOL in 2022/04 and has therefore been removed."; # added 2022-03-05
   django_appconf = django-appconf; # added 2022-03-03
   django_environ = django-environ; # added 2021-12-25
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 223b190b43e8..db3819e5115f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2471,8 +2471,6 @@ in {
 
   django-reversion = callPackage ../development/python-modules/django-reversion { };
 
-  django-sampledatahelper = callPackage ../development/python-modules/django-sampledatahelper { };
-
   django-sesame = callPackage ../development/python-modules/django-sesame { };
 
   django_silk = callPackage ../development/python-modules/django_silk { };

From 86631b4428ca7ada142f6fab95a579827bd99251 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Sun, 17 Jul 2022 11:05:18 +0200
Subject: [PATCH 53/76] python310Packages.plotnine: Add missing test
 dependencies

---
 pkgs/development/python-modules/plotnine/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/plotnine/default.nix b/pkgs/development/python-modules/plotnine/default.nix
index 58df795cb3a1..9e0b1c817613 100644
--- a/pkgs/development/python-modules/plotnine/default.nix
+++ b/pkgs/development/python-modules/plotnine/default.nix
@@ -8,6 +8,8 @@
 , statsmodels
 , pytestCheckHook
 , geopandas
+, scikit-misc
+, adjusttext
 , mizani }:
 
 buildPythonPackage rec {
@@ -34,8 +36,10 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
+    adjusttext
     geopandas
     pytestCheckHook
+    scikit-misc
   ];
 
   preCheck = ''

From aaaedf2c7e1a402ca542c90c27988239e012089a Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Sun, 17 Jul 2022 11:23:22 +0200
Subject: [PATCH 54/76] python310Packages.scikit-misc: init at 0.1.4

---
 .../python-modules/scikit-misc/default.nix    | 45 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 47 insertions(+)
 create mode 100644 pkgs/development/python-modules/scikit-misc/default.nix

diff --git a/pkgs/development/python-modules/scikit-misc/default.nix b/pkgs/development/python-modules/scikit-misc/default.nix
new file mode 100644
index 000000000000..bfe0ab7d5b34
--- /dev/null
+++ b/pkgs/development/python-modules/scikit-misc/default.nix
@@ -0,0 +1,45 @@
+{ lib
+, fetchPypi
+, buildPythonPackage
+, cython
+, gfortran
+, pytestCheckHook
+, numpy }:
+
+buildPythonPackage rec {
+  pname = "scikit-misc";
+  version = "0.1.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-93RqA0eBEGPh7PkSHflINXhQA5U8OLW6hPY/xQjCKRE=";
+  };
+
+  postPatch = ''
+    substituteInPlace pytest.ini \
+      --replace "--cov --cov-report=xml" ""
+  '';
+
+  nativeBuildInputs = [
+    gfortran
+  ];
+
+  buildInputs = [
+    cython
+    numpy
+  ];
+
+  # Tests fail because of infinite recursion error
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "skmisc"
+  ];
+
+  meta = with lib; {
+    description = "Miscellaneous tools for scientific computing";
+    homepage = "https://github.com/has2k1/scikit-misc";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ onny ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index db3819e5115f..4f430c6bb183 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9575,6 +9575,8 @@ in {
 
   scikit-learn-extra = callPackage ../development/python-modules/scikit-learn-extra { };
 
+  scikit-misc = callPackage ../development/python-modules/scikit-misc { };
+
   scikit-optimize = callPackage ../development/python-modules/scikit-optimize { };
 
   scikits-odes = callPackage ../development/python-modules/scikits-odes { };

From e9995a5aded046f2a4440b68f06e0833fd8bb35c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sun, 17 Jul 2022 20:18:46 +0200
Subject: [PATCH 55/76] rspamd: fix crashes by switching pcre2 -> pcre1

on x86-64 the impact should be also minimal because hyperscan is used
for performance critical regexes.
---
 pkgs/servers/mail/rspamd/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/mail/rspamd/default.nix b/pkgs/servers/mail/rspamd/default.nix
index a720500380e1..05d71c9bad32 100644
--- a/pkgs/servers/mail/rspamd/default.nix
+++ b/pkgs/servers/mail/rspamd/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchFromGitHub, cmake, perl
-, glib, luajit, openssl, pcre2, pkg-config, sqlite, ragel, icu
+, glib, luajit, openssl, pcre, pkg-config, sqlite, ragel, icu
 , hyperscan, jemalloc, blas, lapack, lua, libsodium
 , withBlas ? true
 , withHyperscan ? stdenv.isx86_64
@@ -23,12 +23,14 @@ stdenv.mkDerivation rec {
   hardeningEnable = [ "pie" ];
 
   nativeBuildInputs = [ cmake pkg-config perl ];
-  buildInputs = [ glib openssl pcre2 sqlite ragel icu jemalloc libsodium ]
+  buildInputs = [ glib openssl pcre sqlite ragel icu jemalloc libsodium ]
     ++ lib.optional withHyperscan hyperscan
     ++ lib.optionals withBlas [ blas lapack ]
     ++ lib.optional withLuaJIT luajit ++ lib.optional (!withLuaJIT) lua;
 
   cmakeFlags = [
+    # pcre2 jit seems to cause crashes: https://github.com/NixOS/nixpkgs/pull/181908
+    "-DENABLE_PCRE2=OFF"
     "-DDEBIAN_BUILD=ON"
     "-DRUNDIR=/run/rspamd"
     "-DDBDIR=/var/lib/rspamd"

From dcb0d8e968aa51643b3107d7f7bc0293a42df4bb Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Fri, 15 Jul 2022 10:15:32 +0200
Subject: [PATCH 56/76] python310Packages.optax: 0.1.1 -> 0.1.3

---
 .../python-modules/optax/default.nix          | 38 +++++++++----------
 .../python-modules/optax/tests.nix            | 35 +++++++++++++++++
 2 files changed, 53 insertions(+), 20 deletions(-)
 create mode 100644 pkgs/development/python-modules/optax/tests.nix

diff --git a/pkgs/development/python-modules/optax/default.nix b/pkgs/development/python-modules/optax/default.nix
index b0f896a18ebb..42541d9078cf 100644
--- a/pkgs/development/python-modules/optax/default.nix
+++ b/pkgs/development/python-modules/optax/default.nix
@@ -1,28 +1,29 @@
 { absl-py
 , buildPythonPackage
 , chex
-, dm-haiku
 , fetchFromGitHub
 , jaxlib
 , lib
 , numpy
-, pytest-xdist
-, pytestCheckHook
-, tensorflow
-, tensorflow-datasets
+, callPackage
 }:
 
 buildPythonPackage rec {
   pname = "optax";
-  version = "0.1.1";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "deepmind";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-s/BcqzhdfWzR61MStusUPQtuT4+t8NcC5gBGiGggFqw=";
+    hash = "sha256-XAYztMBQpLBHNuNED/iodbwIMJSN/0GxdmTGQ5jD9Ws=";
   };
 
+  outputs = [
+    "out"
+    "testsout"
+  ];
+
   buildInputs = [ jaxlib ];
 
   propagatedBuildInputs = [
@@ -31,24 +32,21 @@ buildPythonPackage rec {
     numpy
   ];
 
-  checkInputs = [
-    dm-haiku
-    pytest-xdist
-    pytestCheckHook
-    tensorflow
-    tensorflow-datasets
-  ];
+  postInstall = ''
+    mkdir $testsout
+    cp -R examples $testsout/examples
+  '';
 
   pythonImportsCheck = [
     "optax"
   ];
 
-  disabledTestPaths = [
-    # Requires `flax` which depends on `optax` creating circular dependency.
-    "optax/_src/equivalence_test.py"
-    # See https://github.com/deepmind/optax/issues/323.
-    "examples/lookahead_mnist_test.py"
-  ];
+  # check in passthru.tests.pytest to escape infinite recursion with flax
+  doCheck = false;
+
+  passthru.tests = {
+    pytest = callPackage ./tests.nix { };
+  };
 
   meta = with lib; {
     description = "Optax is a gradient processing and optimization library for JAX.";
diff --git a/pkgs/development/python-modules/optax/tests.nix b/pkgs/development/python-modules/optax/tests.nix
new file mode 100644
index 000000000000..fedff61302d7
--- /dev/null
+++ b/pkgs/development/python-modules/optax/tests.nix
@@ -0,0 +1,35 @@
+{ stdenv
+, buildPythonPackage
+, dm-haiku
+, pytest-xdist
+, pytestCheckHook
+, tensorflow
+, tensorflow-datasets
+, flax
+, optax
+}:
+
+buildPythonPackage rec {
+  pname = "optax-tests";
+  inherit (optax) version;
+
+  src = optax.testsout;
+
+  dontBuild = true;
+  dontInstall = true;
+
+  checkInputs = [
+    dm-haiku
+    pytest-xdist
+    pytestCheckHook
+    tensorflow
+    tensorflow-datasets
+    flax
+  ];
+
+  disabledTestPaths = [
+    # See https://github.com/deepmind/optax/issues/323
+    "examples/lookahead_mnist_test.py"
+  ];
+
+}

From 04b1ada50ec096bfe0541428c1500895f8e6e8c9 Mon Sep 17 00:00:00 2001
From: "Bryan A. S" <bryanasdev000@gmail.com>
Date: Mon, 18 Jul 2022 05:24:40 -0300
Subject: [PATCH 57/76] etcd_3_4: 3.4.18 -> 3.4.19

---
 pkgs/servers/etcd/3.4.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/etcd/3.4.nix b/pkgs/servers/etcd/3.4.nix
index 538b7a7d2308..ad3c1e35204c 100644
--- a/pkgs/servers/etcd/3.4.nix
+++ b/pkgs/servers/etcd/3.4.nix
@@ -2,9 +2,9 @@
 
 buildGoModule rec {
   pname = "etcd";
-  version = "3.4.18";
+  version = "3.4.19";
 
-  vendorSha256 = null;
+  vendorSha256 = "sha256-ZONIsizxRiwZWRu4y9VzZcCpyBKoa0j3h3JqoMMPGu0=";
 
   doCheck = false;
 
@@ -12,7 +12,7 @@ buildGoModule rec {
     owner = "etcd-io";
     repo = "etcd";
     rev = "v${version}";
-    sha256 = "sha256-/bXcW5g8mNFEjvfg+1loLFi8+IaWdcTE/lUPsHzEaIo=";
+    sha256 = "sha256-8X7xTZrZ/AjUgrW9XgD8B7eKFfOulj8WBjXoImAtJoM=";
   };
 
   buildPhase = ''

From c2c82fbe43c6f793b3e4999eaa5775b5f1c07508 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 18 Jul 2022 13:47:09 +0200
Subject: [PATCH 58/76] nixos/mxisd: use a list for env file for mergeability

---
 nixos/modules/services/networking/mxisd.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/networking/mxisd.nix b/nixos/modules/services/networking/mxisd.nix
index 267c605040ea..5b1e0dee8e35 100644
--- a/nixos/modules/services/networking/mxisd.nix
+++ b/nixos/modules/services/networking/mxisd.nix
@@ -127,7 +127,7 @@ in {
         Type = "simple";
         User = "mxisd";
         Group = "mxisd";
-        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
         ExecStart = "${cfg.package}/bin/${executable} -c ${cfg.dataDir}/mxisd-config.yaml";
         ExecStartPre = "${pkgs.writeShellScript "mxisd-substitute-secrets" ''
           ${pkgs.envsubst}/bin/envsubst -o ${cfg.dataDir}/mxisd-config.yaml \

From 949c334ea9b9a506cb8644a356f64c30a92ef307 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Mon, 18 Jul 2022 13:58:08 +0200
Subject: [PATCH 59/76] nixos/privacyidea-ldap-proxy: use list for
 EnvironmentFile for mergeability

---
 nixos/modules/services/security/privacyidea.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/security/privacyidea.nix b/nixos/modules/services/security/privacyidea.nix
index d48266e4a759..13e27f255068 100644
--- a/nixos/modules/services/security/privacyidea.nix
+++ b/nixos/modules/services/security/privacyidea.nix
@@ -329,7 +329,7 @@ in
           Group = cfg.ldap-proxy.group;
           StateDirectory = "privacyidea-ldap-proxy";
           EnvironmentFile = mkIf (cfg.ldap-proxy.environmentFile != null)
-            cfg.ldap-proxy.environmentFile;
+            [ cfg.ldap-proxy.environmentFile ];
           ExecStartPre =
             "${pkgs.writeShellScript "substitute-secrets-ldap-proxy" ''
               ${pkgs.envsubst}/bin/envsubst \

From 83841f8bf7fe66931aff44d94f89f7a14aebdc6c Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Fri, 15 Jul 2022 21:56:18 +0300
Subject: [PATCH 60/76] =?UTF-8?q?qgis:=203.26.0=20=E2=86=92=203.26.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/applications/gis/qgis/unwrapped.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/gis/qgis/unwrapped.nix b/pkgs/applications/gis/qgis/unwrapped.nix
index 1c46cd81f65a..f0cfbda170d9 100644
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -69,14 +69,14 @@ let
     six
   ];
 in mkDerivation rec {
-  version = "3.26.0";
+  version = "3.26.1";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-yHQi5ai7fdgznTf562Bj0QPE+SXg972O7+r01RY7itE=";
+    sha256 = "sha256-FjMe/5uEbmSeQrAtkKvoGh4VlPkbGMHNzlCpn27C5CQ=";
   };
 
   passthru = {

From 75fdfe76cd4fb7ccf00647ba487bfe470cf23498 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Fri, 15 Jul 2022 21:56:53 +0300
Subject: [PATCH 61/76] =?UTF-8?q?qgis-ltr:=203.22.8=20=E2=86=92=203.22.9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/applications/gis/qgis/unwrapped-ltr.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/gis/qgis/unwrapped-ltr.nix b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
index 0ad11bc630bf..8acc917b047f 100644
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@@ -69,14 +69,14 @@ let
     six
   ];
 in mkDerivation rec {
-  version = "3.22.8";
+  version = "3.22.9";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-YxF7FzyNNt+bdk96g2sWWv9haqV0L6Ab96D0hV0BFrA=";
+    sha256 = "sha256-QHdcK34e7tC0AUstE8pbsBHzHXbmOd3gI2/zqsxb6X4=";
   };
 
   passthru = {

From d9a59b22ee0a61cc59bd21d0a2f748fe3fd6af26 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Sun, 17 Jul 2022 13:42:39 +0300
Subject: [PATCH 62/76] Group GIS applications

---
 pkgs/top-level/all-packages.nix | 63 +++++++++++++++++----------------
 1 file changed, 32 insertions(+), 31 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 58a47d5ed77c..7aa11d31370c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3410,8 +3410,6 @@ with pkgs;
 
   dconf = callPackage ../development/libraries/dconf { };
 
-  dcw-gmt = callPackage ../applications/gis/gmt/dcw.nix { };
-
   ddate = callPackage ../tools/misc/ddate { };
 
   ddosify = callPackage ../development/tools/ddosify { };
@@ -3839,11 +3837,6 @@ with pkgs;
     variant = "krita";
   };
 
-  gmt = callPackage ../applications/gis/gmt {
-    inherit (darwin.apple_sdk.frameworks)
-      Accelerate CoreGraphics CoreVideo;
-  };
-
   gpg-tui = callPackage ../tools/security/gpg-tui {
     inherit (darwin.apple_sdk.frameworks) AppKit Foundation;
     inherit (darwin) libobjc libresolv;
@@ -25593,6 +25586,38 @@ with pkgs;
 
   zuki-themes = callPackage ../data/themes/zuki { };
 
+  ### APPLICATIONS / GIS
+
+  gmt = callPackage ../applications/gis/gmt {
+    inherit (darwin.apple_sdk.frameworks)
+      Accelerate CoreGraphics CoreVideo;
+  };
+
+  gshhg-gmt = callPackage ../applications/gis/gmt/gshhg.nix { };
+
+  dcw-gmt = callPackage ../applications/gis/gmt/dcw.nix { };
+
+  grass = callPackage ../applications/gis/grass { };
+
+  openorienteering-mapper = libsForQt5.callPackage ../applications/gis/openorienteering-mapper { };
+
+  qgis-ltr = callPackage ../applications/gis/qgis/ltr.nix { };
+
+  qgis = callPackage ../applications/gis/qgis { };
+
+  qmapshack = libsForQt5.callPackage ../applications/gis/qmapshack { };
+
+  saga = libsForQt5.callPackage ../applications/gis/saga {
+    inherit (darwin.apple_sdk.frameworks) Cocoa;
+  };
+
+  udig = callPackage ../applications/gis/udig { };
+
+  whitebox-tools = callPackage ../applications/gis/whitebox-tools {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
+  zombietrackergps = libsForQt5.callPackage ../applications/gis/zombietrackergps { };
 
   ### APPLICATIONS
 
@@ -26956,8 +26981,6 @@ with pkgs;
 
   gpx-viewer = callPackage ../applications/misc/gpx-viewer { };
 
-  grass = callPackage ../applications/gis/grass { };
-
   grepcidr = callPackage ../applications/search/grepcidr { };
 
   grepm = callPackage ../applications/search/grepm { };
@@ -29328,8 +29351,6 @@ with pkgs;
     vm = callPackage ../applications/audio/open-music-kontrollers/vm.nix { };
   };
 
-  openorienteering-mapper = libsForQt5.callPackage ../applications/gis/openorienteering-mapper { };
-
   openscad = libsForQt5.callPackage ../applications/graphics/openscad {};
 
   open-stage-control = callPackage ../applications/audio/open-stage-control {
@@ -29720,10 +29741,6 @@ with pkgs;
 
   wrapQemuBinfmtP = callPackage ../applications/virtualization/qemu/binfmt-p-wrapper.nix { };
 
-  qgis-ltr = callPackage ../applications/gis/qgis/ltr.nix { };
-
-  qgis = callPackage ../applications/gis/qgis { };
-
   qgroundcontrol = libsForQt5.callPackage ../applications/science/robotics/qgroundcontrol { };
 
   qjackctl = libsForQt5.callPackage ../applications/audio/qjackctl { };
@@ -29741,8 +29758,6 @@ with pkgs;
 
   garmindev = callPackage ../applications/misc/qlandkartegt/garmindev.nix {};
 
-  qmapshack = libsForQt5.callPackage ../applications/gis/qmapshack { };
-
   qmediathekview = libsForQt5.callPackage ../applications/video/qmediathekview { };
 
   qmplay2 = libsForQt5.callPackage ../applications/video/qmplay2 { };
@@ -31166,10 +31181,6 @@ with pkgs;
     wlroots = wlroots_0_14;
   };
 
-  whitebox-tools = callPackage ../applications/gis/whitebox-tools {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   windowlab = callPackage ../applications/window-managers/windowlab { };
 
   windowmaker = callPackage ../applications/window-managers/windowmaker { };
@@ -31605,8 +31616,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreServices;
   };
 
-  zombietrackergps = libsForQt5.callPackage ../applications/gis/zombietrackergps { };
-
   zoom-us = callPackage ../applications/networking/instant-messengers/zoom-us { };
 
   zotero = callPackage ../applications/office/zotero { };
@@ -31898,10 +31907,6 @@ with pkgs;
 
   quorum = callPackage ../applications/blockchains/quorum { };
 
-  saga = libsForQt5.callPackage ../applications/gis/saga {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
-
   samplv1 = libsForQt5.callPackage ../applications/audio/samplv1 { };
 
   scaleft = callPackage ../applications/networking/scaleft { };
@@ -31927,8 +31932,6 @@ with pkgs;
 
   drumkv1 = libsForQt5.callPackage ../applications/audio/drumkv1 { };
 
-  gshhg-gmt = callPackage ../applications/gis/gmt/gshhg.nix { };
-
   eureka-editor = callPackage ../applications/misc/eureka-editor { };
 
   eureka-ideas = callPackage ../applications/misc/eureka-ideas {
@@ -32980,8 +32983,6 @@ with pkgs;
 
   uchess = callPackage ../games/uchess { };
 
-  udig = callPackage ../applications/gis/udig { };
-
   ufoai = callPackage ../games/ufoai { };
 
   uhexen2 = callPackage ../games/uhexen2 { };

From b3b78ce3ef66e838dbbabfbdb5162b6a551b5a32 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Mon, 18 Jul 2022 22:40:13 +1000
Subject: [PATCH 63/76] sgt-puzzles: update sgt-puzzles.menu to a working URL

Motivation: Fix sgt-puzzles.menu. Its URL is currently 404ing since
https://github.com/gentoo/gentoo/raw/720e614d0107e86fc1e520bac17726578186843d/games-puzzle/sgt-puzzles/files/sgt-puzzles.menu
is 404ing because https://github.com/Oleh-Kravchenko/portage is 404ing.
---
 pkgs/games/sgt-puzzles/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index 1c0b7aeda493..e3a6bd5d9ec2 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   };
 
   sgt-puzzles-menu = fetchurl {
-    url = "https://raw.githubusercontent.com/Oleh-Kravchenko/portage/master/games-puzzle/sgt-puzzles/files/sgt-puzzles.menu";
+    url = "https://raw.githubusercontent.com/gentoo/gentoo/720e614d0107e86fc1e520bac17726578186843d/games-puzzle/sgt-puzzles/files/sgt-puzzles.menu";
     sha256 = "088w0x9g3j8pn725ix8ny8knhdsfgjr3hpswsh9fvfkz5vlg2xkm";
   };
 

From 34aa48f5784ab6fe748df1062e46a43683cd5082 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Mon, 18 Jul 2022 22:23:53 +1000
Subject: [PATCH 64/76] sgtpuzzles: Fix Icon path.

Prior to this commits, GNOME did not render icons for sgtpuzzle's
desktop items.
---
 pkgs/games/sgt-puzzles/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index e3a6bd5d9ec2..20ac24242c46 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
         --set-key Name --set-value $i \
         --set-key Comment --set-value "${meta.description}" \
         --set-key Categories --set-value "Game;LogicGame;X-sgt-puzzles;" \
-        --set-key Icon --set-value $out/share/icons/hicolor/48x48/apps/$i-48d24 \
+        --set-key Icon --set-value $out/share/icons/hicolor/48x48/apps/$i-48d24.png \
         $i.desktop
     done
 

From 61bf2a9c6879496ae9bbbe59c7c3b169728f1516 Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Mon, 18 Jul 2022 22:20:28 +1000
Subject: [PATCH 65/76] sgtpuzzles: 20200610.9aa7b7c -> 20220613.387d323

This required moving to sgtpuzzle's cmake-based build:
https://git.tartarus.org/?p=simon/puzzles.git;a=commit;h=cc7f5503dc8f4ddf468e080a73028c83d1196e83

Tested by compiling and playing some games on x86_64.
---
 pkgs/games/sgt-puzzles/default.nix | 31 ++++++++++++------------------
 1 file changed, 12 insertions(+), 19 deletions(-)

diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index 20ac24242c46..603f119e20db 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchurl, desktop-file-utils
-, gtk3, libX11
-, makeWrapper, pkg-config, perl, autoreconfHook, wrapGAppsHook
+, gtk3, libX11, cmake, imagemagick
+, pkg-config, perl, wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
   pname = "sgt-puzzles";
-  version = "20200610.9aa7b7c";
+  version = "20220613.387d323";
 
   src = fetchurl {
     url = "http://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles-${version}.tar.gz";
-    sha256 = "0rrd1c77ar91zqy4rr4xp1z7x3ywnshlac99cga4hnrgwb7vwl3f";
+    hash = "sha256-Vcm7gxC9R7vvLkgkHblvEOONGLkYSHGMRfSBktgN/oQ=";
   };
 
   sgt-puzzles-menu = fetchurl {
@@ -17,18 +17,17 @@ stdenv.mkDerivation rec {
     sha256 = "088w0x9g3j8pn725ix8ny8knhdsfgjr3hpswsh9fvfkz5vlg2xkm";
   };
 
-  nativeBuildInputs = [ autoreconfHook desktop-file-utils makeWrapper
-    pkg-config perl wrapGAppsHook ];
+  nativeBuildInputs = [
+    cmake
+    desktop-file-utils
+    imagemagick
+    perl
+    pkg-config
+    wrapGAppsHook
+  ];
 
   buildInputs = [ gtk3 libX11 ];
 
-  makeFlags = [ "prefix=$(out)" "gamesdir=$(out)/bin"];
-
-  preInstall = ''
-    mkdir -p "$out"/{bin,share/doc/sgtpuzzles}
-    cp gamedesc.txt LICENCE README "$out/share/doc/sgtpuzzles"
-  '';
-
   postInstall = ''
     for i in  $(basename -s $out/bin/*); do
 
@@ -57,12 +56,6 @@ stdenv.mkDerivation rec {
     install -Dm644 ${sgt-puzzles-menu} -t $out/etc/xdg/menus/applications-merged/
   '';
 
-  preConfigure = ''
-    perl mkfiles.pl
-    export NIX_LDFLAGS="$NIX_LDFLAGS -lX11"
-    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -Wno-error"
-    cp Makefile.gtk Makefile
-  '';
   meta = with lib; {
     description = "Simon Tatham's portable puzzle collection";
     license = licenses.mit;

From 59cc4254df4d727bf2048ee44bb68d4173c23aca Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Mon, 18 Jul 2022 22:24:40 +1000
Subject: [PATCH 66/76] sgtpuzzles: Use higher resolution icons: 48x48 -> 96x96

Motivation: The 48x48 icons look fuzzy on my 1080 width monitor, and
on the Pinephone.
---
 pkgs/games/sgt-puzzles/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index 603f119e20db..499e8385388c 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
     for i in  $(basename -s $out/bin/*); do
 
       ln -s $out/bin/$i $out/bin/sgt-puzzle-$i
-      install -Dm644 icons/$i-48d24.png -t $out/share/icons/hicolor/48x48/apps/
+      install -Dm644 icons/$i-96d24.png -t $out/share/icons/hicolor/96x96/apps/
 
       # Generate/validate/install .desktop files.
       echo "[Desktop Entry]" > $i.desktop
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
         --set-key Name --set-value $i \
         --set-key Comment --set-value "${meta.description}" \
         --set-key Categories --set-value "Game;LogicGame;X-sgt-puzzles;" \
-        --set-key Icon --set-value $out/share/icons/hicolor/48x48/apps/$i-48d24.png \
+        --set-key Icon --set-value $out/share/icons/hicolor/96x96/apps/$i-96d24.png \
         $i.desktop
     done
 

From 55a280290d9016d252edbf1055b9283d8a653b1e Mon Sep 17 00:00:00 2001
From: Tom Fitzhenry <tom@tom-fitzhenry.me.uk>
Date: Mon, 18 Jul 2022 22:47:58 +1000
Subject: [PATCH 67/76] sgtpuzzles: add tomfitzhenry@ as co-maintainer

---
 pkgs/games/sgt-puzzles/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/games/sgt-puzzles/default.nix b/pkgs/games/sgt-puzzles/default.nix
index 499e8385388c..7419b6810cb2 100644
--- a/pkgs/games/sgt-puzzles/default.nix
+++ b/pkgs/games/sgt-puzzles/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Simon Tatham's portable puzzle collection";
     license = licenses.mit;
-    maintainers = [ maintainers.raskin ];
+    maintainers = with maintainers; [ raskin tomfitzhenry ];
     platforms = platforms.linux;
     homepage = "https://www.chiark.greenend.org.uk/~sgtatham/puzzles/";
   };

From c286a8f8c25db8d31178a874886c892a2ecebad7 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Mon, 18 Jul 2022 15:00:07 +0200
Subject: [PATCH 68/76] rt: 5.0.2 -> 5.0.3

fixes CVE-2022-25802, CVE-2022-25803 and CVE-2020-11022 (in rt)

For all changes see https://github.com/bestpractical/rt/releases/tag/rt-5.0.3
---
 pkgs/servers/rt/default.nix      | 7 +++----
 pkgs/top-level/perl-packages.nix | 6 +++---
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkgs/servers/rt/default.nix b/pkgs/servers/rt/default.nix
index a113c25f396c..894da7a652ee 100644
--- a/pkgs/servers/rt/default.nix
+++ b/pkgs/servers/rt/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rt";
-  version = "5.0.2";
+  version = "5.0.3";
 
   src = fetchFromGitHub {
     repo = pname;
     rev = "${pname}-${version}";
     owner = "bestpractical";
-    sha256 = "1qdvbsmdynjw2v0clnmhdmrky7w4dsiysv92n7d7jdbawnicqahn";
+    hash = "sha256-ZitlueLEbV3mGJg0aDrLa5IReJiOVaEf+JicbA9zUS4=";
   };
 
   patches = [
@@ -120,8 +120,7 @@ stdenv.mkDerivation rec {
   ];
 
   preAutoreconf = ''
-    substituteInPlace configure.ac \
-      --replace "rt-3.9.EXPORTED" "rt-${version}"
+    echo rt-${version} > .tag
   '';
   preConfigure = ''
     configureFlags="$configureFlags --with-web-user=$UID"
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 244711fa9013..3e85dd0713e1 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -6590,10 +6590,10 @@ let
 
   DBIxSearchBuilder = buildPerlPackage {
     pname = "DBIx-SearchBuilder";
-    version = "1.68";
+    version = "1.71";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/B/BP/BPS/DBIx-SearchBuilder-1.68.tar.gz";
-      sha256 = "be197c0f83c426996f77d22126f3103f958fc4bd1791c6962b793cc2779601f8";
+      url = "mirror://cpan/authors/id/B/BP/BPS/DBIx-SearchBuilder-1.71.tar.gz";
+      sha256 = "1ga2sjis6lg51z58il8q165klc38dmb3wj3phyxjfjg6yskdsbz4";
     };
     buildInputs = [ DBDSQLite ];
     propagatedBuildInputs = [ CacheSimpleTimedExpiry ClassAccessor ClassReturnValue Clone DBIxDBSchema Want capitalization ];

From 0005ee6060ba02bee022d06117a49d6ee0d9a7cd Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Mon, 18 Jul 2022 12:39:33 +0200
Subject: [PATCH 69/76] josh: init at 22.06.22

---
 .../version-management/josh/default.nix       | 60 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 62 insertions(+)
 create mode 100644 pkgs/applications/version-management/josh/default.nix

diff --git a/pkgs/applications/version-management/josh/default.nix b/pkgs/applications/version-management/josh/default.nix
new file mode 100644
index 000000000000..acf2b24c0794
--- /dev/null
+++ b/pkgs/applications/version-management/josh/default.nix
@@ -0,0 +1,60 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, libgit2
+, openssl
+, pkg-config
+, makeWrapper
+, git
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "josh";
+  version = "22.06.22";
+
+  src = fetchFromGitHub {
+    owner = "esrlabs";
+    repo = "josh";
+    rev = "r" + version;
+    sha256 = "0511qv9zyjvv4zfz6zyi69ssbkrwa24n0ah5w9mb4gzd547as8pq";
+  };
+
+  cargoSha256 = "0zfjjyyz4pxar1mfkkj9aij4dnwqy3asdrmay1iy6ijjn1qd97n4";
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    libgit2
+    openssl
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.Security
+  ];
+
+  cargoBuildFlags = [
+    "-p" "josh"
+    "-p" "josh-proxy"
+    # TODO: josh-ui
+  ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/josh-proxy" --prefix PATH : "${git}/bin"
+  '';
+
+  meta = {
+    description = "Just One Single History";
+    homepage = "https://josh-project.github.io/josh/";
+    downloadPage = "https://github.com/josh-project/josh";
+    changelog = "https://github.com/josh-project/josh/releases/tag/${version}";
+    license = lib.licenses.mit;
+    maintainers = [
+      lib.maintainers.sternenseemann
+      lib.maintainers.tazjin
+    ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7aa11d31370c..6c8af61fe2f2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27309,6 +27309,8 @@ with pkgs;
 
   jmusicbot = callPackage ../applications/audio/jmusicbot { };
 
+  josh = callPackage ../applications/version-management/josh { };
+
   junction = callPackage ../applications/misc/junction { };
 
   lemonade = callPackage ../applications/misc/lemonade { };

From 080774e28f421b6fb890cf4d6aff7caad8e9b32e Mon Sep 17 00:00:00 2001
From: oaksoaj <oaksoaj@riseup.net>
Date: Sat, 2 Jul 2022 16:34:59 +0200
Subject: [PATCH 70/76] yggdrasil: reenable DynamicUser

Since version 0.4 Yggdrasil works again using systemd's DynamicUser option.
This patch reenables it to improve security.

We tested this with both persistent and non-persistent keys. Everything
seems to work fine.
---
 .../modules/services/networking/yggdrasil.nix | 29 ++++---------------
 1 file changed, 6 insertions(+), 23 deletions(-)

diff --git a/nixos/modules/services/networking/yggdrasil.nix b/nixos/modules/services/networking/yggdrasil.nix
index 99c18ae6919e..8e88064a9071 100644
--- a/nixos/modules/services/networking/yggdrasil.nix
+++ b/nixos/modules/services/networking/yggdrasil.nix
@@ -60,13 +60,6 @@ in {
         '';
       };
 
-      group = mkOption {
-        type = types.str;
-        default = "root";
-        example = "wheel";
-        description = "Group to grant access to the Yggdrasil control socket.";
-      };
-
       openMulticastPort = mkOption {
         type = bool;
         default = false;
@@ -154,27 +147,17 @@ in {
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         Restart = "always";
 
-        Group = cfg.group;
+        User = "yggdrasil";
+        DynamicUser = true;
+        StateDirectory = "yggdrasil";
         RuntimeDirectory = "yggdrasil";
         RuntimeDirectoryMode = "0750";
         BindReadOnlyPaths = lib.optional configFileProvided cfg.configFile
           ++ lib.optional cfg.persistentKeys keysPath;
+        ReadWritePaths = "/run/yggdrasil";
 
-        # TODO: as of yggdrasil 0.3.8 and systemd 243, yggdrasil fails
-        # to set up the network adapter when DynamicUser is set.  See
-        # github.com/yggdrasil-network/yggdrasil-go/issues/557.  The
-        # following options are implied by DynamicUser according to
-        # the systemd.exec documentation, and can be removed if the
-        # upstream issue is fixed and DynamicUser is set to true:
-        PrivateTmp = true;
-        RemoveIPC = true;
-        NoNewPrivileges = true;
-        ProtectSystem = "strict";
-        RestrictSUIDSGID = true;
-        # End of list of options implied by DynamicUser.
-
-        AmbientCapabilities = "CAP_NET_ADMIN";
-        CapabilityBoundingSet = "CAP_NET_ADMIN";
+        AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
+        CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
         MemoryDenyWriteExecute = true;
         ProtectControlGroups = true;
         ProtectHome = "tmpfs";

From fc9e22fca12e71f5a43ab616aa0e669392174e12 Mon Sep 17 00:00:00 2001
From: oaksoaj <oaksoaj@riseup.net>
Date: Sat, 2 Jul 2022 18:20:27 +0200
Subject: [PATCH 71/76] yggdrasil: add group option back and remove systemd
 User= directive

The group configuration parameter allow to share access to yggdrasil
control socket with the users in the system. In the version we propose,
it is null by default so that only root can access the control socket,
but let user create their own group if they need.

Remove User= durective in systemd unit. Should a user with the specified
name already exist in the system, it would be used silently instead of a
dynamic user which could be a security concern.
---
 nixos/modules/services/networking/yggdrasil.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/networking/yggdrasil.nix b/nixos/modules/services/networking/yggdrasil.nix
index 8e88064a9071..ae681988ea11 100644
--- a/nixos/modules/services/networking/yggdrasil.nix
+++ b/nixos/modules/services/networking/yggdrasil.nix
@@ -60,6 +60,13 @@ in {
         '';
       };
 
+      group = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "wheel";
+        description = "Group to grant access to the Yggdrasil control socket. If <code>null</code>, only root can access the socket.";
+      };
+
       openMulticastPort = mkOption {
         type = bool;
         default = false;
@@ -147,7 +154,6 @@ in {
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         Restart = "always";
 
-        User = "yggdrasil";
         DynamicUser = true;
         StateDirectory = "yggdrasil";
         RuntimeDirectory = "yggdrasil";
@@ -168,7 +174,9 @@ in {
         RestrictRealtime = true;
         SystemCallArchitectures = "native";
         SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @resources";
-      };
+      } // (if (cfg.group != null) then {
+        Group = cfg.group;
+      } else {});
     };
 
     networking.dhcpcd.denyInterfaces = cfg.denyDhcpcdInterfaces;

From 49a5377557a8c3695b96e5cece1db315c72ddc86 Mon Sep 17 00:00:00 2001
From: Dan Fithian <danielf@vitalbio.com>
Date: Tue, 5 Jul 2022 08:12:10 -0400
Subject: [PATCH 72/76] heartbeat service: specify package

Other elastic services can specify the package. Now we can also do it for heartbeat.
---
 nixos/modules/services/logging/heartbeat.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/logging/heartbeat.nix b/nixos/modules/services/logging/heartbeat.nix
index 56fb4deabda5..843ec033911f 100644
--- a/nixos/modules/services/logging/heartbeat.nix
+++ b/nixos/modules/services/logging/heartbeat.nix
@@ -20,6 +20,16 @@ in
 
       enable = mkEnableOption "heartbeat";
 
+      package = mkOption {
+        type = types.package;
+        default = pkgs.heartbeat;
+        defaultText = literalExpression "pkgs.heartbeat";
+        example = literalExpression "pkgs.heartbeat7";
+        description = ''
+          The heartbeat package to use.
+        '';
+      };
+
       name = mkOption {
         type = types.str;
         default = "heartbeat";
@@ -67,7 +77,7 @@ in
       serviceConfig = {
         User = "nobody";
         AmbientCapabilities = "cap_net_raw";
-        ExecStart = "${pkgs.heartbeat}/bin/heartbeat -c \"${heartbeatYml}\" -path.data \"${cfg.stateDir}/data\" -path.logs \"${cfg.stateDir}/logs\"";
+        ExecStart = "${cfg.package}/bin/heartbeat -c \"${heartbeatYml}\" -path.data \"${cfg.stateDir}/data\" -path.logs \"${cfg.stateDir}/logs\"";
       };
     };
   };

From 021f4cac52b81251a65b33081c9fb37e08fc3024 Mon Sep 17 00:00:00 2001
From: Dan Fithian <danielf@vitalbio.com>
Date: Mon, 18 Jul 2022 15:20:34 -0400
Subject: [PATCH 73/76] beats: add dfithian as maintainer

---
 pkgs/misc/logging/beats/6.x.nix | 2 +-
 pkgs/misc/logging/beats/7.x.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/misc/logging/beats/6.x.nix b/pkgs/misc/logging/beats/6.x.nix
index bdef9dd21391..1c3e4adccf82 100644
--- a/pkgs/misc/logging/beats/6.x.nix
+++ b/pkgs/misc/logging/beats/6.x.nix
@@ -26,7 +26,7 @@ let beat = package : extraArgs : buildGoPackage (rec {
       meta = with lib; {
         homepage = "https://www.elastic.co/products/beats";
         license = licenses.asl20;
-        maintainers = with maintainers; [ fadenb basvandijk ];
+        maintainers = with maintainers; [ fadenb basvandijk dfithian ];
         platforms = platforms.linux;
       };
     } // extraArgs);
diff --git a/pkgs/misc/logging/beats/7.x.nix b/pkgs/misc/logging/beats/7.x.nix
index 55fed8fb6741..a2a7e7969166 100644
--- a/pkgs/misc/logging/beats/7.x.nix
+++ b/pkgs/misc/logging/beats/7.x.nix
@@ -18,7 +18,7 @@ let beat = package: extraArgs: buildGoModule (rec {
   meta = with lib; {
     homepage = "https://www.elastic.co/products/beats";
     license = licenses.asl20;
-    maintainers = with maintainers; [ fadenb basvandijk ];
+    maintainers = with maintainers; [ fadenb basvandijk dfithian ];
     platforms = platforms.linux;
   };
 } // extraArgs);

From 7af8cc5769c8c8e56a709571d8417bca94ec078f Mon Sep 17 00:00:00 2001
From: Dan Fithian <danielf@vitalbio.com>
Date: Mon, 18 Jul 2022 15:20:44 -0400
Subject: [PATCH 74/76] maintainers: add dfithian

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8cc8ea9d9b62..15ea77b5c29c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14564,4 +14564,10 @@
     github = "npatsakula";
     githubId = 23001619;
   };
+  dfithian = {
+    email = "daniel.m.fithian@gmail.com";
+    name = "Daniel Fithian";
+    github = "dfithian";
+    githubId = 8409320;
+  };
 }

From 02da3a122947e0ae1c024d276b03cb487f2266bd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 9 Mar 2022 10:47:01 +0000
Subject: [PATCH 75/76] ocamlPackages.ocp-index: 1.3.1 -> 1.3.3

---
 pkgs/development/tools/ocaml/ocp-index/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/ocaml/ocp-index/default.nix b/pkgs/development/tools/ocaml/ocp-index/default.nix
index 1ca8cfb5c52c..b055ccbde5dc 100644
--- a/pkgs/development/tools/ocaml/ocp-index/default.nix
+++ b/pkgs/development/tools/ocaml/ocp-index/default.nix
@@ -2,7 +2,7 @@
 
 buildDunePackage rec {
   pname = "ocp-index";
-  version = "1.3.1";
+  version = "1.3.3";
 
   useDune2 = true;
 
@@ -10,7 +10,7 @@ buildDunePackage rec {
     owner = "OCamlPro";
     repo = "ocp-index";
     rev = version;
-    sha256 = "120w72fqymjp6ibicbp31jyx9yv34mdvgkr0zdfpzvfb7lgd8rc7";
+    sha256 = "sha256-ElCXjUR85tkyBLIpIKefDouE1upzJytQnk4xoQt/cb0=";
   };
 
   strictDeps = true;

From d5765d51504a3b0bd3e2798e5e15e6caad6deb7f Mon Sep 17 00:00:00 2001
From: Marek Fajkus <marek.faj@gmail.com>
Date: Mon, 18 Jul 2022 22:26:48 +0200
Subject: [PATCH 76/76] elmPackages.elm-json: 0.2.10 -> 0.2.12

---
 .../compilers/elm/packages/elm-json.nix       |  6 ++--
 .../compilers/elm/packages/elm-json.patch     | 28 +++++++++----------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/pkgs/development/compilers/elm/packages/elm-json.nix b/pkgs/development/compilers/elm/packages/elm-json.nix
index faf6ffd8a2e1..6eb5d10cd471 100644
--- a/pkgs/development/compilers/elm/packages/elm-json.nix
+++ b/pkgs/development/compilers/elm/packages/elm-json.nix
@@ -10,11 +10,11 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "elm-json";
-  version = "0.2.10";
+  version = "0.2.12";
 
   src = fetchurl {
     url = "https://github.com/zwilias/elm-json/archive/v${version}.tar.gz";
-    sha256 = "sha256:03azh7wvl60h6w7ffpvl49s7jr7bxpladcm4fzcasakg26i5a71x";
+    sha256 = "sha256:nlpxlPzWk3wwDgczuMI9T6DFY1YtQpQ1R4BhdPbzZBs=";
   };
 
   cargoPatches = [ ./elm-json.patch ];
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
     curl openssl
   ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
 
-  cargoSha256 = "sha256:01zasrqf1va58i52s3kwdkj1rnwy80gv00xi6npfshjirj3ix07f";
+  cargoSha256 = "sha256:8SOpL8nfhYen9vza0LYpB/5fgVmBwG7vGMmFOaJskIc=";
 
   # Tests perform networking and therefore can't work in sandbox
   doCheck = false;
diff --git a/pkgs/development/compilers/elm/packages/elm-json.patch b/pkgs/development/compilers/elm/packages/elm-json.patch
index d7f434c8eb34..54df03019231 100644
--- a/pkgs/development/compilers/elm/packages/elm-json.patch
+++ b/pkgs/development/compilers/elm/packages/elm-json.patch
@@ -1,24 +1,24 @@
 diff --git a/Cargo.lock b/Cargo.lock
-index 5440d72..6e173fa 100644
+index b9bf434..58cfe81 100644
 --- a/Cargo.lock
 +++ b/Cargo.lock
-@@ -774,15 +774,6 @@ version = "0.1.2"
+@@ -685,15 +685,6 @@ version = "0.1.4"
  source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "77af24da69f9d9341038eba93a073b1fdaaa1b788221b00a69bce9e762cb32de"
+ checksum = "28988d872ab76095a6e6ac88d99b54fd267702734fd7ffe610ca27f533ddb95a"
  
 -[[package]]
 -name = "openssl-src"
--version = "111.11.0+1.1.1h"
+-version = "111.17.0+1.1.1m"
 -source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "380fe324132bea01f45239fadfec9343adb044615f29930d039bec1ae7b9fa5b"
+-checksum = "05d6a336abd10814198f66e2a91ccd7336611f30334119ca8ce300536666fcf4"
 -dependencies = [
 - "cc",
 -]
 -
  [[package]]
  name = "openssl-sys"
- version = "0.9.58"
-@@ -792,7 +783,6 @@ dependencies = [
+ version = "0.9.72"
+@@ -703,7 +694,6 @@ dependencies = [
   "autocfg",
   "cc",
   "libc",
@@ -27,17 +27,17 @@ index 5440d72..6e173fa 100644
   "vcpkg",
  ]
 diff --git a/Cargo.toml b/Cargo.toml
-index 4d319f2..6f4d0e5 100644
+index bc97f20..54d3b14 100644
 --- a/Cargo.toml
 +++ b/Cargo.toml
-@@ -21,8 +21,8 @@ colored = "2.0"
+@@ -17,8 +17,8 @@ colored = "2.0"
  dialoguer = "0.6"
  dirs = "3.0"
  fs2 = "0.4"
--isahc = { version = "0.9", features = ["static-ssl"] }
--curl = {version = "0.4", features = ["static-curl", "static-ssl", "force-system-lib-on-osx", "http2"]}
-+isahc = "0.9"
-+curl = {version = "0.4", features = ["force-system-lib-on-osx", "http2"]}
+-isahc = { version = "1.6.0", default-features = false, features = ["static-ssl", "static-curl"] }
+-curl = {version = "0.4.42", default-features = false, features = ["ssl", "static-curl", "static-ssl", "force-system-lib-on-osx"]}
++isahc = { version = "1.6.0", default-features = false }
++curl = {version = "0.4.42", default-features = false, features = ["ssl", "force-system-lib-on-osx"]}
  ctrlc = "3.1"
  console = "0.12"
- 
+ anyhow = "1.0"