Merge master into haskell-updates

maintainers/maintainer-list.nix

@@ -1124,6 +1124,16 @@
     githubId = 73002165;
     name = "apfelkuchen6";
   };
+  aplund = {
+    email = "austin.lund@gmail.com";
+    matrix = "@aplund:matrix.org";
+    github = "aplund";
+    githubId = 1369436;
+    name = "Austin Lund";
+    keys = [{
+      fingerprint = "7083 E268 4BFD 845F 2B84  9E74 B695 8918 ED23 32CE";
+    }];
+  };
   applePrincess = {
     email = "appleprincess@appleprincess.io";
     github = "applePrincess";
@@ -6740,6 +6750,12 @@
       fingerprint = "6BD3 7248 30BD 941E 9180  C1A3 3A33 FA4C 82ED 674F";
     }];
   };
+  ivanmoreau = {
+    email = "Iván Molina Rebolledo";
+    github = "ivanmoreau";
+    githubId = 10843250;
+    name = "ivan@ivmoreau.com";
+  };
   ivan-timokhin = {
     email = "nixpkgs@ivan.timokhin.name";
     name = "Ivan Timokhin";
@@ -10572,6 +10588,12 @@
     githubId = 133448;
     name = "Mikołaj Siedlarek";
   };
+  mslingsby = {
+    email = "morten.slingsby@eviny.no";
+    github = "MortenSlingsby";
+    githubId = 111859550;
+    name = "Morten Slingsby";
+  };
   msm = {
     email = "msm@tailcall.net";
     github = "msm-code";
@@ -11527,6 +11549,12 @@
     githubId = 1538622;
     name = "Michael Reilly";
   };
+  onedragon = {
+    name = "YiLong Liu";
+    email = "18922251299@163.com";
+    github = "jackyliu16";
+    githubId = 50787361;
+  };
   onixie = {
     email = "onixie@gmail.com";
     github = "onixie";

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -63,6 +63,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [opensearch](https://opensearch.org), a search server alternative to Elasticsearch. Available as [services.opensearch](options.html#opt-services.opensearch.enable).
 
+- [monica](https://www.monicahq.com), an open source personal CRM. Available as [services.monica](options.html#opt-services.monica.enable).
+
 - [authelia](https://www.authelia.com/), is an open-source authentication and authorization server. Available under [services.authelia](options.html#opt-services.authelia.enable).
 
 - [goeland](https://github.com/slurdge/goeland), an alternative to rss2email written in golang with many filters. Available as [services.goeland](#opt-services.goeland.enable).
@@ -89,6 +91,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [ulogd](https://www.netfilter.org/projects/ulogd/index.html), a userspace logging daemon for netfilter/iptables related logging. Available as [services.ulogd](options.html#opt-services.ulogd.enable).
 
+- [PufferPanel](https://pufferpanel.com), game server management panel designed to be easy to use. Available as [services.pufferpanel](#opt-services.pufferpanel.enable).
+
 - [jellyseerr](https://github.com/Fallenbagel/jellyseerr), a web-based requests manager for Jellyfin, forked from Overseerr. Available as [services.jellyseerr](#opt-services.jellyseerr.enable).
 
 - [photoprism](https://photoprism.app/), a AI-Powered Photos App for the Decentralized Web. Available as [services.photoprism](options.html#opt-services.photoprism.enable).
@@ -113,6 +117,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [hardware.ipu6](#opt-hardware.ipu6.enable) adds support for ipu6 based webcams on intel tiger lake and alder lake.
 
+- [ivpn](https://www.ivpn.net/), a secure, private VPN with fast WireGuard connections. Available as [services.ivpn](#opt-services.ivpn.enable).
+
 ## Backward Incompatibilities {#sec-release-23.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/module-list.nix

@@ -670,6 +670,7 @@
   ./services/misc/polaris.nix
   ./services/misc/portunus.nix
   ./services/misc/prowlarr.nix
+  ./services/misc/pufferpanel.nix
   ./services/misc/pykms.nix
   ./services/misc/radarr.nix
   ./services/misc/readarr.nix
@@ -884,6 +885,7 @@
   ./services/networking/iscsi/initiator.nix
   ./services/networking/iscsi/root-initiator.nix
   ./services/networking/iscsi/target.nix
+  ./services/networking/ivpn.nix
   ./services/networking/iwd.nix
   ./services/networking/jibri/default.nix
   ./services/networking/jicofo.nix
@@ -1182,6 +1184,7 @@
   ./services/web-apps/mattermost.nix
   ./services/web-apps/mediawiki.nix
   ./services/web-apps/miniflux.nix
+  ./services/web-apps/monica.nix
   ./services/web-apps/moodle.nix
   ./services/web-apps/netbox.nix
   ./services/web-apps/nextcloud.nix

nixos/modules/programs/neovim.nix

@@ -4,12 +4,8 @@ with lib;
 
 let
   cfg = config.programs.neovim;
-
-  runtime' = filter (f: f.enable) (attrValues cfg.runtime);
-
-  runtime = pkgs.linkFarm "neovim-runtime" (map (x: { name = "etc/${x.target}"; path = x.source; }) runtime');
-
-in {
+in
+{
   options.programs.neovim = {
     enable = mkOption {
       type = types.bool;
@@ -70,7 +66,7 @@ in {
 
     configure = mkOption {
       type = types.attrs;
-      default = {};
+      default = { };
       example = literalExpression ''
         {
           customRC = '''
@@ -105,7 +101,7 @@ in {
     };
 
     runtime = mkOption {
-      default = {};
+      default = { };
       example = literalExpression ''
         { "ftplugin/c.vim".text = "setlocal omnifunc=v:lua.vim.lsp.omnifunc"; }
       '';
@@ -115,14 +111,15 @@ in {
 
       type = with types; attrsOf (submodule (
         { name, config, ... }:
-        { options = {
+        {
+          options = {
 
             enable = mkOption {
               type = types.bool;
               default = true;
               description = lib.mdDoc ''
-                Whether this /etc file should be generated.  This
-                option allows specific /etc files to be disabled.
+                Whether this runtime directory should be generated.  This
+                option allows specific runtime files to be disabled.
               '';
             };
 
@@ -147,14 +144,9 @@ in {
 
           };
 
-          config = {
-            target = mkDefault name;
-            source = mkIf (config.text != null) (
-              let name' = "neovim-runtime" + baseNameOf name;
-              in mkDefault (pkgs.writeText name' config.text));
-          };
-
-        }));
+          config.target = mkDefault name;
+        }
+      ));
 
     };
   };
@@ -165,14 +157,17 @@ in {
     ];
     environment.variables.EDITOR = mkIf cfg.defaultEditor (mkOverride 900 "nvim");
 
-    programs.neovim.finalPackage = pkgs.wrapNeovim cfg.package {
-      inherit (cfg) viAlias vimAlias withPython3 withNodeJs withRuby;
-      configure = cfg.configure // {
+    environment.etc = listToAttrs (attrValues (mapAttrs
+      (name: value: {
+        name = "xdg/nvim/${name}";
+        value = value // {
+          target = "xdg/nvim/${value.target}";
+        };
+      })
+      cfg.runtime));
 
-        customRC = (cfg.configure.customRC or "") + ''
-          set runtimepath^=${runtime}/etc
-        '';
-      };
+    programs.neovim.finalPackage = pkgs.wrapNeovim cfg.package {
+      inherit (cfg) viAlias vimAlias withPython3 withNodeJs withRuby configure;
     };
   };
 }

nixos/modules/programs/tmux.nix

@@ -160,7 +160,10 @@ in {
         default = defaultTerminal;
         example = "screen-256color";
         type = types.str;
-        description = lib.mdDoc "Set the $TERM variable.";
+        description = lib.mdDoc ''
+          Set the $TERM variable. Use tmux-direct if italics or 24bit true color
+          support is needed.
+        '';
       };
 
       secureSocket = mkOption {

nixos/modules/services/misc/pufferpanel.nix

@@ -0,0 +1,176 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.pufferpanel;
+in
+{
+  options.services.pufferpanel = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Whether to enable PufferPanel game management server.
+
+        Note that [PufferPanel templates] and binaries downloaded by PufferPanel
+        expect [FHS environment]. It is possible to set {option}`package` option
+        to use PufferPanel wrapper with FHS environment. For example, to use
+        `Download Game from Steam` and `Download Java` template operations:
+        ```Nix
+        { lib, pkgs, ... }: {
+          services.pufferpanel = {
+            enable = true;
+            extraPackages = with pkgs; [ bash curl gawk gnutar gzip ];
+            package = pkgs.buildFHSUserEnv {
+              name = "pufferpanel-fhs";
+              runScript = lib.getExe pkgs.pufferpanel;
+              targetPkgs = pkgs': with pkgs'; [ icu openssl zlib ];
+            };
+          };
+        }
+        ```
+
+        [PufferPanel templates]: https://github.com/PufferPanel/templates
+        [FHS environment]: https://wikipedia.org/wiki/Filesystem_Hierarchy_Standard
+      '';
+    };
+
+    package = lib.mkPackageOptionMD pkgs "pufferpanel" { };
+
+    extraGroups = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "podman" ];
+      description = lib.mdDoc ''
+        Additional groups for the systemd service.
+      '';
+    };
+
+    extraPackages = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ ];
+      example = lib.literalExpression "[ pkgs.jre ]";
+      description = lib.mdDoc ''
+        Packages to add to the PATH environment variable. Both the {file}`bin`
+        and {file}`sbin` subdirectories of each package are added.
+      '';
+    };
+
+    environment = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = { };
+      example = lib.literalExpression ''
+        {
+          PUFFER_WEB_HOST = ":8080";
+          PUFFER_DAEMON_SFTP_HOST = ":5657";
+          PUFFER_DAEMON_CONSOLE_BUFFER = "1000";
+          PUFFER_DAEMON_CONSOLE_FORWARD = "true";
+          PUFFER_PANEL_REGISTRATIONENABLED = "false";
+        }
+      '';
+      description = lib.mdDoc ''
+        Environment variables to set for the service. Secrets should be
+        specified using {option}`environmentFile`.
+
+        Refer to the [PufferPanel source code][] for the list of available
+        configuration options. Variable name is an upper-cased configuration
+        entry name with underscores instead of dots, prefixed with `PUFFER_`.
+        For example, `panel.settings.companyName` entry can be set using
+        {env}`PUFFER_PANEL_SETTINGS_COMPANYNAME`.
+
+        When running with panel enabled (configured with `PUFFER_PANEL_ENABLE`
+        environment variable), it is recommended disable registration using
+        `PUFFER_PANEL_REGISTRATIONENABLED` environment variable (registration is
+        enabled by default). To create the initial administrator user, run
+        {command}`pufferpanel --workDir /var/lib/pufferpanel user add --admin`.
+
+        Some options override corresponding settings set via web interface (e.g.
+        `PUFFER_PANEL_REGISTRATIONENABLED`). Those options can be temporarily
+        toggled or set in settings but do not persist between restarts.
+
+        [PufferPanel source code]: https://github.com/PufferPanel/PufferPanel/blob/master/config/entries.go
+      '';
+    };
+
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = lib.mdDoc ''
+        File to load environment variables from. Loaded variables override
+        values set in {option}`environment`.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.pufferpanel = {
+      description = "PufferPanel game management server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      path = cfg.extraPackages;
+      environment = cfg.environment;
+
+      # Note that we export environment variables for service directories if the
+      # value is not set. An empty environment variable is considered to be set.
+      # E.g.
+      #   export PUFFER_LOGS=${PUFFER_LOGS-$LOGS_DIRECTORY}
+      # would set PUFFER_LOGS to $LOGS_DIRECTORY if PUFFER_LOGS environment
+      # variable is not defined.
+      script = ''
+        ${lib.concatLines (lib.mapAttrsToList (name: value: ''
+          export ${name}="''${${name}-${value}}"
+        '') {
+          PUFFER_LOGS = "$LOGS_DIRECTORY";
+          PUFFER_DAEMON_DATA_CACHE = "$CACHE_DIRECTORY";
+          PUFFER_DAEMON_DATA_SERVERS = "$STATE_DIRECTORY/servers";
+          PUFFER_DAEMON_DATA_BINARIES = "$STATE_DIRECTORY/binaries";
+        })}
+        exec ${lib.getExe cfg.package} run --workDir "$STATE_DIRECTORY"
+      '';
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+
+        UMask = "0077";
+
+        SupplementaryGroups = cfg.extraGroups;
+
+        StateDirectory = "pufferpanel";
+        StateDirectoryMode = "0700";
+        CacheDirectory = "pufferpanel";
+        CacheDirectoryMode = "0700";
+        LogsDirectory = "pufferpanel";
+        LogsDirectoryMode = "0700";
+
+        EnvironmentFile = cfg.environmentFile;
+
+        # Command "pufferpanel shutdown --pid $MAINPID" sends SIGTERM (code 15)
+        # to the main process and waits for termination. This is essentially
+        # KillMode=mixed we are using here. See
+        # https://freedesktop.org/software/systemd/man/systemd.kill.html#KillMode=
+        KillMode = "mixed";
+
+        DynamicUser = true;
+        ProtectHome = true;
+        ProtectProc = "invisible";
+        ProtectClock = true;
+        ProtectHostname = true;
+        ProtectControlGroups = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        PrivateUsers = true;
+        PrivateDevices = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = [ "user" "mnt" ]; # allow buildFHSUserEnv
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        LockPersonality = true;
+        DeviceAllow = [ "" ];
+        DevicePolicy = "closed";
+        CapabilityBoundingSet = [ "" ];
+      };
+    };
+  };
+
+  meta.maintainers = [ lib.maintainers.tie ];
+}

nixos/modules/services/networking/ivpn.nix

@@ -0,0 +1,51 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.ivpn;
+in
+with lib;
+{
+  options.services.ivpn = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        This option enables iVPN daemon.
+        This sets {option}`networking.firewall.checkReversePath` to "loose", which might be undesirable for security.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    boot.kernelModules = [ "tun" ];
+
+    environment.systemPackages = with pkgs; [ ivpn ivpn-service ];
+
+    # iVPN writes to /etc/iproute2/rt_tables
+    networking.iproute2.enable = true;
+    networking.firewall.checkReversePath = "loose";
+
+    systemd.services.ivpn-service = {
+      description = "iVPN daemon";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network.target" ];
+      after = [
+        "network-online.target"
+        "NetworkManager.service"
+        "systemd-resolved.service"
+      ];
+      path = [
+        # Needed for mount
+        "/run/wrappers"
+      ];
+      startLimitBurst = 5;
+      startLimitIntervalSec = 20;
+      serviceConfig = {
+        ExecStart = "${pkgs.ivpn-service}/bin/ivpn-service --logging";
+        Restart = "always";
+        RestartSec = 1;
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ ataraxiasjel ];
+}

nixos/modules/services/networking/wstunnel.nix

@@ -294,7 +294,7 @@ let
         DynamicUser = true;
         SupplementaryGroups = optional (serverCfg.useACMEHost != null) certConfig.group;
         PrivateTmp = true;
-        AmbientCapabilities = optional (serverCfg.listen.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+        AmbientCapabilities = optionals (serverCfg.listen.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
         NoNewPrivileges = true;
         RestrictNamespaces = "uts ipc pid user cgroup";
         ProtectSystem = "strict";
@@ -340,7 +340,7 @@ let
         EnvironmentFile = optional (clientCfg.environmentFile != null) clientCfg.environmentFile;
         DynamicUser = true;
         PrivateTmp = true;
-        AmbientCapabilities = (optional (clientCfg.soMark != null) [ "CAP_NET_ADMIN" ]) ++ (optional ((clientCfg.dynamicToRemote.port or 1024) < 1024 || (any (x: x.local.port < 1024) clientCfg.localToRemote)) [ "CAP_NET_BIND_SERVICE" ]);
+        AmbientCapabilities = (optionals (clientCfg.soMark != null) [ "CAP_NET_ADMIN" ]) ++ (optionals ((clientCfg.dynamicToRemote.port or 1024) < 1024 || (any (x: x.local.port < 1024) clientCfg.localToRemote)) [ "CAP_NET_BIND_SERVICE" ]);
         NoNewPrivileges = true;
         RestrictNamespaces = "uts ipc pid user cgroup";
         ProtectSystem = "strict";

nixos/modules/services/system/cachix-watch-store.nix

@@ -62,7 +62,13 @@ in
       after = [ "network-online.target" ];
       path = [ config.nix.package ];
       wantedBy = [ "multi-user.target" ];
+      unitConfig = {
+        # allow to restart indefinitely
+        StartLimitIntervalSec = 0;
+      };
       serviceConfig = {
+        # don't put too much stress on the machine when restarting
+        RestartSec = 1;
         # we don't want to kill children processes as those are deployments
         KillMode = "process";
         Restart = "on-failure";

nixos/modules/services/web-apps/monica.nix

@@ -0,0 +1,468 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib; let
+  cfg = config.services.monica;
+  monica = pkgs.monica.override {
+    dataDir = cfg.dataDir;
+  };
+  db = cfg.database;
+  mail = cfg.mail;
+
+  user = cfg.user;
+  group = cfg.group;
+
+  # shell script for local administration
+  artisan = pkgs.writeScriptBin "monica" ''
+    #! ${pkgs.runtimeShell}
+    cd ${monica}
+    sudo() {
+      if [[ "$USER" != ${user} ]]; then
+        exec /run/wrappers/bin/sudo -u ${user} "$@"
+      else
+        exec "$@"
+      fi
+    }
+    sudo ${pkgs.php}/bin/php artisan "$@"
+  '';
+
+  tlsEnabled = cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME;
+in {
+  options.services.monica = {
+    enable = mkEnableOption (lib.mdDoc "monica");
+
+    user = mkOption {
+      default = "monica";
+      description = lib.mdDoc "User monica runs as.";
+      type = types.str;
+    };
+
+    group = mkOption {
+      default = "monica";
+      description = lib.mdDoc "Group monica runs as.";
+      type = types.str;
+    };
+
+    appKeyFile = mkOption {
+      description = lib.mdDoc ''
+        A file containing the Laravel APP_KEY - a 32 character long,
+        base64 encoded key used for encryption where needed. Can be
+        generated with <code>head -c 32 /dev/urandom | base64</code>.
+      '';
+      example = "/run/keys/monica-appkey";
+      type = types.path;
+    };
+
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default =
+        if config.networking.domain != null
+        then config.networking.fqdn
+        else config.networking.hostName;
+      defaultText = lib.literalExpression "config.networking.fqdn";
+      example = "monica.example.com";
+      description = lib.mdDoc ''
+        The hostname to serve monica on.
+      '';
+    };
+
+    appURL = mkOption {
+      description = lib.mdDoc ''
+        The root URL that you want to host monica on. All URLs in monica will be generated using this value.
+        If you change this in the future you may need to run a command to update stored URLs in the database.
+        Command example: <code>php artisan monica:update-url https://old.example.com https://new.example.com</code>
+      '';
+      default = "http${lib.optionalString tlsEnabled "s"}://${cfg.hostname}";
+      defaultText = ''http''${lib.optionalString tlsEnabled "s"}://''${cfg.hostname}'';
+      example = "https://example.com";
+      type = types.str;
+    };
+
+    dataDir = mkOption {
+      description = lib.mdDoc "monica data directory";
+      default = "/var/lib/monica";
+      type = types.path;
+    };
+
+    database = {
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = lib.mdDoc "Database host address.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 3306;
+        description = lib.mdDoc "Database host port.";
+      };
+      name = mkOption {
+        type = types.str;
+        default = "monica";
+        description = lib.mdDoc "Database name.";
+      };
+      user = mkOption {
+        type = types.str;
+        default = user;
+        defaultText = lib.literalExpression "user";
+        description = lib.mdDoc "Database username.";
+      };
+      passwordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "/run/keys/monica-dbpassword";
+        description = lib.mdDoc ''
+          A file containing the password corresponding to
+          <option>database.user</option>.
+        '';
+      };
+      createLocally = mkOption {
+        type = types.bool;
+        default = true;
+        description = lib.mdDoc "Create the database and database user locally.";
+      };
+    };
+
+    mail = {
+      driver = mkOption {
+        type = types.enum ["smtp" "sendmail"];
+        default = "smtp";
+        description = lib.mdDoc "Mail driver to use.";
+      };
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = lib.mdDoc "Mail host address.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 1025;
+        description = lib.mdDoc "Mail host port.";
+      };
+      fromName = mkOption {
+        type = types.str;
+        default = "monica";
+        description = lib.mdDoc "Mail \"from\" name.";
+      };
+      from = mkOption {
+        type = types.str;
+        default = "mail@monica.com";
+        description = lib.mdDoc "Mail \"from\" email.";
+      };
+      user = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        example = "monica";
+        description = lib.mdDoc "Mail username.";
+      };
+      passwordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "/run/keys/monica-mailpassword";
+        description = lib.mdDoc ''
+          A file containing the password corresponding to
+          <option>mail.user</option>.
+        '';
+      };
+      encryption = mkOption {
+        type = with types; nullOr (enum ["tls"]);
+        default = null;
+        description = lib.mdDoc "SMTP encryption mechanism to use.";
+      };
+    };
+
+    maxUploadSize = mkOption {
+      type = types.str;
+      default = "18M";
+      example = "1G";
+      description = lib.mdDoc "The maximum size for uploads (e.g. images).";
+    };
+
+    poolConfig = mkOption {
+      type = with types; attrsOf (oneOf [str int bool]);
+      default = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+      };
+      description = lib.mdDoc ''
+        Options for the monica PHP pool. See the documentation on <literal>php-fpm.conf</literal>
+        for details on configuration directives.
+      '';
+    };
+
+    nginx = mkOption {
+      type = types.submodule (
+        recursiveUpdate
+        (import ../web-servers/nginx/vhost-options.nix {inherit config lib;}) {}
+      );
+      default = {};
+      example = ''
+        {
+          serverAliases = [
+            "monica.''${config.networking.domain}"
+          ];
+          # To enable encryption and let let's encrypt take care of certificate
+          forceSSL = true;
+          enableACME = true;
+        }
+      '';
+      description = lib.mdDoc ''
+        With this option, you can customize the nginx virtualHost settings.
+      '';
+    };
+
+    config = mkOption {
+      type = with types;
+        attrsOf
+        (nullOr
+          (either
+            (oneOf [
+              bool
+              int
+              port
+              path
+              str
+            ])
+            (submodule {
+              options = {
+                _secret = mkOption {
+                  type = nullOr str;
+                  description = lib.mdDoc ''
+                    The path to a file containing the value the
+                    option should be set to in the final
+                    configuration file.
+                  '';
+                };
+              };
+            })));
+      default = {};
+      example = ''
+        {
+          ALLOWED_IFRAME_HOSTS = "https://example.com";
+          WKHTMLTOPDF = "/home/user/bins/wkhtmltopdf";
+          AUTH_METHOD = "oidc";
+          OIDC_NAME = "MyLogin";
+          OIDC_DISPLAY_NAME_CLAIMS = "name";
+          OIDC_CLIENT_ID = "monica";
+          OIDC_CLIENT_SECRET = {_secret = "/run/keys/oidc_secret"};
+          OIDC_ISSUER = "https://keycloak.example.com/auth/realms/My%20Realm";
+          OIDC_ISSUER_DISCOVER = true;
+        }
+      '';
+      description = lib.mdDoc ''
+        monica configuration options to set in the
+        <filename>.env</filename> file.
+
+        Refer to <link xlink:href="https://github.com/monicahq/monica"/>
+        for details on supported values.
+
+        Settings containing secret data should be set to an attribute
+        set containing the attribute <literal>_secret</literal> - a
+        string pointing to a file containing the value the option
+        should be set to. See the example to get a better picture of
+        this: in the resulting <filename>.env</filename> file, the
+        <literal>OIDC_CLIENT_SECRET</literal> key will be set to the
+        contents of the <filename>/run/keys/oidc_secret</filename>
+        file.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = db.createLocally -> db.user == user;
+        message = "services.monica.database.user must be set to ${user} if services.monica.database.createLocally is set true.";
+      }
+      {
+        assertion = db.createLocally -> db.passwordFile == null;
+        message = "services.monica.database.passwordFile cannot be specified if services.monica.database.createLocally is set to true.";
+      }
+    ];
+
+    services.monica.config = {
+      APP_ENV = "production";
+      APP_KEY._secret = cfg.appKeyFile;
+      APP_URL = cfg.appURL;
+      DB_HOST = db.host;
+      DB_PORT = db.port;
+      DB_DATABASE = db.name;
+      DB_USERNAME = db.user;
+      MAIL_DRIVER = mail.driver;
+      MAIL_FROM_NAME = mail.fromName;
+      MAIL_FROM = mail.from;
+      MAIL_HOST = mail.host;
+      MAIL_PORT = mail.port;
+      MAIL_USERNAME = mail.user;
+      MAIL_ENCRYPTION = mail.encryption;
+      DB_PASSWORD._secret = db.passwordFile;
+      MAIL_PASSWORD._secret = mail.passwordFile;
+      APP_SERVICES_CACHE = "/run/monica/cache/services.php";
+      APP_PACKAGES_CACHE = "/run/monica/cache/packages.php";
+      APP_CONFIG_CACHE = "/run/monica/cache/config.php";
+      APP_ROUTES_CACHE = "/run/monica/cache/routes-v7.php";
+      APP_EVENTS_CACHE = "/run/monica/cache/events.php";
+      SESSION_SECURE_COOKIE = tlsEnabled;
+    };
+
+    environment.systemPackages = [artisan];
+
+    services.mysql = mkIf db.createLocally {
+      enable = true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = [db.name];
+      ensureUsers = [
+        {
+          name = db.user;
+          ensurePermissions = {"${db.name}.*" = "ALL PRIVILEGES";};
+        }
+      ];
+    };
+
+    services.phpfpm.pools.monica = {
+      inherit user group;
+      phpOptions = ''
+        log_errors = on
+        post_max_size = ${cfg.maxUploadSize}
+        upload_max_filesize = ${cfg.maxUploadSize}
+      '';
+      settings = {
+        "listen.mode" = "0660";
+        "listen.owner" = user;
+        "listen.group" = group;
+      } // cfg.poolConfig;
+    };
+
+    services.nginx = {
+      enable = mkDefault true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedProxySettings = true;
+      virtualHosts.${cfg.hostname} = mkMerge [
+        cfg.nginx
+        {
+          root = mkForce "${monica}/public";
+          locations = {
+            "/" = {
+              index = "index.php";
+              tryFiles = "$uri $uri/ /index.php?$query_string";
+            };
+            "~ \.php$".extraConfig = ''
+              fastcgi_pass unix:${config.services.phpfpm.pools."monica".socket};
+            '';
+            "~ \.(js|css|gif|png|ico|jpg|jpeg)$" = {
+              extraConfig = "expires 365d;";
+            };
+          };
+        }
+      ];
+    };
+
+    systemd.services.monica-setup = {
+      description = "Preperation tasks for monica";
+      before = ["phpfpm-monica.service"];
+      after = optional db.createLocally "mysql.service";
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = user;
+        UMask = 077;
+        WorkingDirectory = "${monica}";
+        RuntimeDirectory = "monica/cache";
+        RuntimeDirectoryMode = 0700;
+      };
+      path = [pkgs.replace-secret];
+      script = let
+        isSecret = v: isAttrs v && v ? _secret && isString v._secret;
+        monicaEnvVars = lib.generators.toKeyValue {
+          mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
+            mkValueString = v:
+              with builtins;
+                if isInt v
+                then toString v
+                else if isString v
+                then v
+                else if true == v
+                then "true"
+                else if false == v
+                then "false"
+                else if isSecret v
+                then hashString "sha256" v._secret
+                else throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty {}) v}";
+          };
+        };
+        secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.config);
+        mkSecretReplacement = file: ''
+          replace-secret ${escapeShellArgs [(builtins.hashString "sha256" file) file "${cfg.dataDir}/.env"]}
+        '';
+        secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
+        filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! elem v [{} null])) cfg.config;
+        monicaEnv = pkgs.writeText "monica.env" (monicaEnvVars filteredConfig);
+      in ''
+        # error handling
+        set -euo pipefail
+
+        # create .env file
+        install -T -m 0600 -o ${user} ${monicaEnv} "${cfg.dataDir}/.env"
+        ${secretReplacements}
+        if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
+          sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
+        fi
+
+        # migrate & seed db
+        ${pkgs.php}/bin/php artisan key:generate --force
+        ${pkgs.php}/bin/php artisan setup:production -v --force
+      '';
+    };
+
+    systemd.services.monica-scheduler = {
+      description = "Background tasks for monica";
+      startAt = "minutely";
+      after = ["monica-setup.service"];
+      serviceConfig = {
+        Type = "oneshot";
+        User = user;
+        WorkingDirectory = "${monica}";
+        ExecStart = "${pkgs.php}/bin/php ${monica}/artisan schedule:run -v";
+      };
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir}                            0710 ${user} ${group} - -"
+      "d ${cfg.dataDir}/public                     0750 ${user} ${group} - -"
+      "d ${cfg.dataDir}/public/uploads             0750 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage                    0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/app                0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/fonts              0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework          0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework/cache    0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework/sessions 0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework/views    0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/logs               0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/uploads            0700 ${user} ${group} - -"
+    ];
+
+    users = {
+      users = mkIf (user == "monica") {
+        monica = {
+          inherit group;
+          isSystemUser = true;
+        };
+        "${config.services.nginx.user}".extraGroups = [group];
+      };
+      groups = mkIf (group == "monica") {
+        monica = {};
+      };
+    };
+  };
+}
+

nixos/modules/services/web-apps/plausible.nix

@@ -9,6 +9,8 @@ in {
   options.services.plausible = {
     enable = mkEnableOption (lib.mdDoc "plausible");
 
+    package = mkPackageOptionMD pkgs "plausible" { };
+
     releaseCookiePath = mkOption {
       type = with types; either str path;
       description = lib.mdDoc ''
@@ -180,12 +182,12 @@ in {
 
     services.epmd.enable = true;
 
-    environment.systemPackages = [ pkgs.plausible ];
+    environment.systemPackages = [ cfg.package ];
 
     systemd.services = mkMerge [
       {
         plausible = {
-          inherit (pkgs.plausible.meta) description;
+          inherit (cfg.package.meta) description;
           documentation = [ "https://plausible.io/docs/self-hosting" ];
           wantedBy = [ "multi-user.target" ];
           after = optional cfg.database.clickhouse.setup "clickhouse.service"
@@ -233,7 +235,7 @@ in {
             SMTP_USER_NAME = cfg.mail.smtp.user;
           });
 
-          path = [ pkgs.plausible ]
+          path = [ cfg.package ]
             ++ optional cfg.database.postgres.setup config.services.postgresql.package;
           script = ''
             export CONFIG_DIR=$CREDENTIALS_DIRECTORY
@@ -241,10 +243,10 @@ in {
             export RELEASE_COOKIE="$(< $CREDENTIALS_DIRECTORY/RELEASE_COOKIE )"
 
             # setup
-            ${pkgs.plausible}/createdb.sh
-            ${pkgs.plausible}/migrate.sh
+            ${cfg.package}/createdb.sh
+            ${cfg.package}/migrate.sh
             ${optionalString cfg.adminUser.activate ''
-              if ! ${pkgs.plausible}/init-admin.sh | grep 'already exists'; then
+              if ! ${cfg.package}/init-admin.sh | grep 'already exists'; then
                 psql -d plausible <<< "UPDATE users SET email_verified=true;"
               fi
             ''}

nixos/tests/all-tests.nix

@@ -421,6 +421,7 @@ in {
   mjolnir = handleTest ./matrix/mjolnir.nix {};
   mod_perl = handleTest ./mod_perl.nix {};
   molly-brown = handleTest ./molly-brown.nix {};
+  monica = handleTest ./web-apps/monica.nix {};
   mongodb = handleTest ./mongodb.nix {};
   moodle = handleTest ./moodle.nix {};
   moonraker = handleTest ./moonraker.nix {};
@@ -587,6 +588,7 @@ in {
   pt2-clone = handleTest ./pt2-clone.nix {};
   pykms = handleTest ./pykms.nix {};
   public-inbox = handleTest ./public-inbox.nix {};
+  pufferpanel = handleTest ./pufferpanel.nix {};
   pulseaudio = discoverTests (import ./pulseaudio.nix);
   qboot = handleTestOn ["x86_64-linux" "i686-linux"] ./qboot.nix {};
   qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix {};

nixos/tests/pufferpanel.nix

@@ -0,0 +1,74 @@
+import ./make-test-python.nix ({ lib, ... }: {
+  name = "pufferpanel";
+  meta.maintainers = [ lib.maintainers.tie ];
+
+  nodes.machine = { pkgs, ... }: {
+    environment.systemPackages = [ pkgs.pufferpanel ];
+    services.pufferpanel = {
+      enable = true;
+      extraPackages = [ pkgs.netcat ];
+      environment = {
+        PUFFER_PANEL_REGISTRATIONENABLED = "false";
+        PUFFER_PANEL_SETTINGS_COMPANYNAME = "NixOS";
+      };
+    };
+  };
+
+  testScript = ''
+    import shlex
+    import json
+
+    curl = "curl --fail-with-body --silent"
+    baseURL = "http://localhost:8080"
+    adminName = "admin"
+    adminEmail = "admin@nixos.org"
+    adminPass = "admin"
+    adminCreds = json.dumps({
+      "email": adminEmail,
+      "password": adminPass,
+    })
+    stopCode = 9 # SIGKILL
+    serverPort = 1337
+    serverDefinition = json.dumps({
+      "name": "netcat",
+      "node": 0,
+      "users": [
+        adminName,
+      ],
+      "type": "netcat",
+      "run": {
+        "stopCode": stopCode,
+        "command": f"nc -l {serverPort}",
+      },
+      "environment": {
+        "type": "standard",
+      },
+    })
+
+    start_all()
+
+    machine.wait_for_unit("pufferpanel.service")
+    machine.wait_for_open_port(5657) # SFTP
+    machine.wait_for_open_port(8080) # HTTP
+
+    # Note that PufferPanel does not initialize database unless necessary.
+    # /api/config endpoint creates database file and triggers migrations.
+    # On success, we run a command to create administrator user that we use to
+    # interact with HTTP API.
+    resp = json.loads(machine.succeed(f"{curl} {baseURL}/api/config"))
+    assert resp["branding"]["name"] == "NixOS", "Invalid company name in configuration"
+    assert resp["registrationEnabled"] == False, "Expected registration to be disabled"
+
+    machine.succeed(f"pufferpanel --workDir /var/lib/pufferpanel user add --admin --name {adminName} --email {adminEmail} --password {adminPass}")
+
+    resp = json.loads(machine.succeed(f"{curl} -d '{adminCreds}' {baseURL}/auth/login"))
+    assert "servers.admin" in resp["scopes"], "User is not administrator"
+    token = resp["session"]
+    authHeader = shlex.quote(f"Authorization: Bearer {token}")
+
+    resp = json.loads(machine.succeed(f"{curl} -H {authHeader} -H 'Content-Type: application/json' -d '{serverDefinition}' {baseURL}/api/servers"))
+    serverID = resp["id"]
+    machine.succeed(f"{curl} -X POST -H {authHeader} {baseURL}/proxy/daemon/server/{serverID}/start")
+    machine.wait_for_open_port(serverPort)
+  '';
+})

nixos/tests/web-apps/monica.nix

@@ -0,0 +1,33 @@
+import ../make-test-python.nix ({pkgs, ...}:
+let
+  cert = pkgs.runCommand "selfSignedCerts" { nativeBuildInputs = [ pkgs.openssl ]; } ''
+    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=localhost' -days 36500
+    mkdir -p $out
+    cp key.pem cert.pem $out
+  '';
+in
+{
+  name = "monica";
+
+  nodes = {
+    machine = {pkgs, ...}: {
+      services.monica = {
+        enable = true;
+        hostname = "localhost";
+        appKeyFile = "${pkgs.writeText "keyfile" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}";
+        nginx = {
+          forceSSL = true;
+          sslCertificate = "${cert}/cert.pem";
+          sslCertificateKey = "${cert}/key.pem";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("monica-setup.service")
+    machine.wait_for_open_port(443)
+    machine.succeed("curl -k --fail https://localhost", timeout=10)
+  '';
+})

pkgs/applications/audio/mbrola/default.nix

@@ -1,42 +1,72 @@
-{ stdenv, lib, fetchFromGitHub }:
+{ stdenv, stdenvNoCC, lib, symlinkJoin, fetchFromGitHub }:
 
 let
-  voices = fetchFromGitHub {
-    owner = "numediart";
-    repo = "MBROLA-voices";
-    rev = "fe05a0ccef6a941207fd6aaad0b31294a1f93a51";  # using latest commit
-    sha256 = "1w0y2xjp9rndwdjagp2wxh656mdm3d6w9cs411g27rjyfy1205a0";
-  };
-in
-stdenv.mkDerivation rec {
   pname = "mbrola";
   version = "3.3";
 
-  src = fetchFromGitHub {
-    owner = "numediart";
-    repo = "MBROLA";
-    rev = version;
-    sha256 = "1w86gv6zs2cbr0731n49z8v6xxw0g8b0hzyv2iqb9mqcfh38l8zy";
-  };
-
-  # required for cross compilation
-  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
-
-  installPhase = ''
-    runHook preInstall
-    install -D Bin/mbrola $out/bin/mbrola
-
-    # TODO: package separately because it's very big
-    install -d $out/share/mbrola/voices
-    cp -R ${voices}/data/* $out/share/mbrola/voices/
-    runHook postInstall
-  '';
-
   meta = with lib; {
-    description = "Speech synthesizer based on the concatenation of diphones";
-    homepage = "https://github.com/numediart/MBROLA";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ davidak ];
     platforms = platforms.linux;
+    description = "Speech synthesizer based on the concatenation of diphones";
+    homepage = "https://github.com/numediart/MBROLA";
   };
+
+  voices = stdenvNoCC.mkDerivation {
+    pname = "${pname}-voices";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "numediart";
+      repo = "MBROLA-voices";
+      rev = "fe05a0ccef6a941207fd6aaad0b31294a1f93a51";  # using latest commit
+      sha256 = "1w0y2xjp9rndwdjagp2wxh656mdm3d6w9cs411g27rjyfy1205a0";
+    };
+
+    dontBuild = true;
+    installPhase = ''
+      runHook preInstall
+      install -d $out/share/mbrola/voices
+      cp -R $src/data/* $out/share/mbrola/voices/
+      runHook postInstall
+    '';
+    dontFixup = true;
+
+    meta = meta // {
+      description = "Speech synthesizer based on the concatenation of diphones (voice files)";
+      homepage = "https://github.com/numediart/MBROLA-voices";
+    };
+  };
+
+  bin = stdenv.mkDerivation {
+    pname = "${pname}-bin";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "numediart";
+      repo = "MBROLA";
+      rev = version;
+      sha256 = "1w86gv6zs2cbr0731n49z8v6xxw0g8b0hzyv2iqb9mqcfh38l8zy";
+    };
+
+    # required for cross compilation
+    makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+
+    installPhase = ''
+      runHook preInstall
+      install -D Bin/mbrola $out/bin/mbrola
+      rm -rf $out/share/mbrola/voices/*
+      runHook postInstall
+    '';
+
+    meta = meta // {
+      description = "Speech synthesizer based on the concatenation of diphones (binary only)";
+    };
+  };
+
+in
+symlinkJoin {
+  inherit pname version meta;
+  name = "${pname}-${version}";
+  paths = [ bin voices ];
 }

pkgs/applications/audio/spotify/darwin.nix

@@ -0,0 +1,37 @@
+{ stdenv
+, pname
+, meta
+, fetchurl
+, undmg
+, lib
+}:
+
+stdenv.mkDerivation {
+  inherit pname;
+
+  version = "1.1.97.962.g24733a46";
+
+  src = if stdenv.isAarch64 then (
+    fetchurl {
+      url = "https://web.archive.org/web/20221101120432/https://download.scdn.co/SpotifyARM64.dmg";
+      sha256 = "sha256-8WDeVRgaZXuUa95PNa15Cuul95ynklBaZpuq+U1eGTU=";
+    })
+  else (
+    fetchurl {
+      url = "https://web.archive.org/web/20221101120647/https://download.scdn.co/Spotify.dmg";
+      sha256 = "sha256-uPpD8Hv70FlaSjtt9rq5ntI64agxG8+/LNEvRe4ocJ4=";
+    });
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    mkdir -p $out/Applications
+    cp -r *.app $out/Applications
+  '';
+
+  meta = meta // {
+    maintainers = with lib.maintainers; [ Enzime ];
+  };
+}

pkgs/applications/audio/spotify/default.nix

@@ -1,182 +1,16 @@
-{ fetchurl, lib, stdenv, squashfsTools, xorg, alsa-lib, makeShellWrapper, wrapGAppsHook, openssl, freetype
-, glib, pango, cairo, atk, gdk-pixbuf, gtk3, cups, nspr, nss, libpng, libnotify
-, libgcrypt, systemd, fontconfig, dbus, expat, ffmpeg, curlWithGnuTls, zlib, gnome
-, at-spi2-atk, at-spi2-core, libpulseaudio, libdrm, mesa, libxkbcommon
-  # High-DPI support: Spotify's --force-device-scale-factor argument
-  # not added if `null`, otherwise, should be a number.
-, deviceScaleFactor ? null
-}:
+{ lib, stdenv, callPackage }:
 
 let
-  # TO UPDATE: just execute the ./update.sh script (won't do anything if there is no update)
-  # "rev" decides what is actually being downloaded
-  # If an update breaks things, one of those might have valuable info:
-  # https://aur.archlinux.org/packages/spotify/
-  # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.1.99.878.g1e4ccc6e";
-  # To get the latest stable revision:
-  # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
-  # To get general information:
-  # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
-  # More examples of api usage:
-  # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "62";
-
-  deps = [
-    alsa-lib
-    at-spi2-atk
-    at-spi2-core
-    atk
-    cairo
-    cups
-    curlWithGnuTls
-    dbus
-    expat
-    ffmpeg
-    fontconfig
-    freetype
-    gdk-pixbuf
-    glib
-    gtk3
-    libdrm
-    libgcrypt
-    libnotify
-    libpng
-    libpulseaudio
-    libxkbcommon
-    mesa
-    nss
-    pango
-    stdenv.cc.cc
-    systemd
-    xorg.libICE
-    xorg.libSM
-    xorg.libX11
-    xorg.libxcb
-    xorg.libXcomposite
-    xorg.libXcursor
-    xorg.libXdamage
-    xorg.libXext
-    xorg.libXfixes
-    xorg.libXi
-    xorg.libXrandr
-    xorg.libXrender
-    xorg.libXScrnSaver
-    xorg.libxshmfence
-    xorg.libXtst
-    zlib
-  ];
-
-in
-
-stdenv.mkDerivation {
   pname = "spotify";
-  inherit version;
-
-  # fetch from snapcraft instead of the debian repository most repos fetch from.
-  # That is a bit more cumbersome. But the debian repository only keeps the last
-  # two versions, while snapcraft should provide versions indefinitely:
-  # https://forum.snapcraft.io/t/how-can-a-developer-remove-her-his-app-from-snap-store/512
-
-  # This is the next-best thing, since we're not allowed to re-distribute
-  # spotify ourselves:
-  # https://community.spotify.com/t5/Desktop-Linux/Redistribute-Spotify-on-Linux-Distributions/td-p/1695334
-  src = fetchurl {
-    url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    sha512 = "339r2q13nnpwi7gjd1axc6z2gycfm9gwz3x9dnqyaqd1g3rw7nk6nfbp6bmpkr68lfq1jfgvqwnimcgs84rsi7nmgsiabv3cz0673wv";
-  };
-
-  nativeBuildInputs = [ wrapGAppsHook makeShellWrapper squashfsTools ];
-
-  dontStrip = true;
-  dontPatchELF = true;
-
-  unpackPhase = ''
-    runHook preUnpack
-    unsquashfs "$src" '/usr/share/spotify' '/usr/bin/spotify' '/meta/snap.yaml'
-    cd squashfs-root
-    if ! grep -q 'grade: stable' meta/snap.yaml; then
-      # Unfortunately this check is not reliable: At the moment (2018-07-26) the
-      # latest version in the "edge" channel is also marked as stable.
-      echo "The snap package is marked as unstable:"
-      grep 'grade: ' meta/snap.yaml
-      echo "You probably chose the wrong revision."
-      exit 1
-    fi
-    if ! grep -q '${version}' meta/snap.yaml; then
-      echo "Package version differs from version found in snap metadata:"
-      grep 'version: ' meta/snap.yaml
-      echo "While the nix package specifies: ${version}."
-      echo "You probably chose the wrong revision or forgot to update the nix version."
-      exit 1
-    fi
-    runHook postUnpack
-  '';
-
-  # Prevent double wrapping
-  dontWrapGApps = true;
-
-  installPhase =
-    ''
-      runHook preInstall
-
-      libdir=$out/lib/spotify
-      mkdir -p $libdir
-      mv ./usr/* $out/
-
-      cp meta/snap.yaml $out
-
-      # Work around Spotify referring to a specific minor version of
-      # OpenSSL.
-
-      ln -s ${lib.getLib openssl}/lib/libssl.so $libdir/libssl.so.1.0.0
-      ln -s ${lib.getLib openssl}/lib/libcrypto.so $libdir/libcrypto.so.1.0.0
-      ln -s ${nspr.out}/lib/libnspr4.so $libdir/libnspr4.so
-      ln -s ${nspr.out}/lib/libplc4.so $libdir/libplc4.so
-
-      ln -s ${ffmpeg.lib}/lib/libavcodec.so* $libdir
-      ln -s ${ffmpeg.lib}/lib/libavformat.so* $libdir
-
-      rpath="$out/share/spotify:$libdir"
-
-      patchelf \
-        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath $rpath $out/share/spotify/spotify
-
-      librarypath="${lib.makeLibraryPath deps}:$libdir"
-      wrapProgramShell $out/share/spotify/spotify \
-        ''${gappsWrapperArgs[@]} \
-        ${lib.optionalString (deviceScaleFactor != null) ''
-          --add-flags "--force-device-scale-factor=${toString deviceScaleFactor}" \
-        ''} \
-        --prefix LD_LIBRARY_PATH : "$librarypath" \
-        --prefix PATH : "${gnome.zenity}/bin" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
-
-      # fix Icon line in the desktop file (#48062)
-      sed -i "s:^Icon=.*:Icon=spotify-client:" "$out/share/spotify/spotify.desktop"
-
-      # Desktop file
-      mkdir -p "$out/share/applications/"
-      cp "$out/share/spotify/spotify.desktop" "$out/share/applications/"
-
-      # Icons
-      for i in 16 22 24 32 48 64 128 256 512; do
-        ixi="$i"x"$i"
-        mkdir -p "$out/share/icons/hicolor/$ixi/apps"
-        ln -s "$out/share/spotify/icons/spotify-linux-$i.png" \
-          "$out/share/icons/hicolor/$ixi/apps/spotify-client.png"
-      done
-
-      runHook postInstall
-    '';
 
   meta = with lib; {
     homepage = "https://www.spotify.com/";
     description = "Play music from the Spotify music service";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
-    maintainers = with maintainers; [ eelco ftrvxmtrx sheenobu mudri timokau ma27 ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" ];
   };
-}
+
+in if stdenv.isDarwin
+then callPackage ./darwin.nix { inherit pname meta; }
+else callPackage ./linux.nix { inherit pname meta; }

pkgs/applications/audio/spotify/linux.nix

@@ -0,0 +1,177 @@
+{ fetchurl, lib, stdenv, squashfsTools, xorg, alsa-lib, makeShellWrapper, wrapGAppsHook, openssl, freetype
+, glib, pango, cairo, atk, gdk-pixbuf, gtk3, cups, nspr, nss, libpng, libnotify
+, libgcrypt, systemd, fontconfig, dbus, expat, ffmpeg, curlWithGnuTls, zlib, gnome
+, at-spi2-atk, at-spi2-core, libpulseaudio, libdrm, mesa, libxkbcommon
+, pname, meta
+  # High-DPI support: Spotify's --force-device-scale-factor argument
+  # not added if `null`, otherwise, should be a number.
+, deviceScaleFactor ? null
+}:
+
+let
+  # TO UPDATE: just execute the ./update.sh script (won't do anything if there is no update)
+  # "rev" decides what is actually being downloaded
+  # If an update breaks things, one of those might have valuable info:
+  # https://aur.archlinux.org/packages/spotify/
+  # https://community.spotify.com/t5/Desktop-Linux
+  version = "1.1.99.878.g1e4ccc6e";
+  # To get the latest stable revision:
+  # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
+  # To get general information:
+  # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
+  # More examples of api usage:
+  # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
+  rev = "62";
+
+  deps = [
+    alsa-lib
+    at-spi2-atk
+    at-spi2-core
+    atk
+    cairo
+    cups
+    curlWithGnuTls
+    dbus
+    expat
+    ffmpeg
+    fontconfig
+    freetype
+    gdk-pixbuf
+    glib
+    gtk3
+    libdrm
+    libgcrypt
+    libnotify
+    libpng
+    libpulseaudio
+    libxkbcommon
+    mesa
+    nss
+    pango
+    stdenv.cc.cc
+    systemd
+    xorg.libICE
+    xorg.libSM
+    xorg.libX11
+    xorg.libxcb
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXScrnSaver
+    xorg.libxshmfence
+    xorg.libXtst
+    zlib
+  ];
+
+in
+
+stdenv.mkDerivation {
+  inherit pname version;
+
+  # fetch from snapcraft instead of the debian repository most repos fetch from.
+  # That is a bit more cumbersome. But the debian repository only keeps the last
+  # two versions, while snapcraft should provide versions indefinitely:
+  # https://forum.snapcraft.io/t/how-can-a-developer-remove-her-his-app-from-snap-store/512
+
+  # This is the next-best thing, since we're not allowed to re-distribute
+  # spotify ourselves:
+  # https://community.spotify.com/t5/Desktop-Linux/Redistribute-Spotify-on-Linux-Distributions/td-p/1695334
+  src = fetchurl {
+    url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
+    sha512 = "339r2q13nnpwi7gjd1axc6z2gycfm9gwz3x9dnqyaqd1g3rw7nk6nfbp6bmpkr68lfq1jfgvqwnimcgs84rsi7nmgsiabv3cz0673wv";
+  };
+
+  nativeBuildInputs = [ wrapGAppsHook makeShellWrapper squashfsTools ];
+
+  dontStrip = true;
+  dontPatchELF = true;
+
+  unpackPhase = ''
+    runHook preUnpack
+    unsquashfs "$src" '/usr/share/spotify' '/usr/bin/spotify' '/meta/snap.yaml'
+    cd squashfs-root
+    if ! grep -q 'grade: stable' meta/snap.yaml; then
+      # Unfortunately this check is not reliable: At the moment (2018-07-26) the
+      # latest version in the "edge" channel is also marked as stable.
+      echo "The snap package is marked as unstable:"
+      grep 'grade: ' meta/snap.yaml
+      echo "You probably chose the wrong revision."
+      exit 1
+    fi
+    if ! grep -q '${version}' meta/snap.yaml; then
+      echo "Package version differs from version found in snap metadata:"
+      grep 'version: ' meta/snap.yaml
+      echo "While the nix package specifies: ${version}."
+      echo "You probably chose the wrong revision or forgot to update the nix version."
+      exit 1
+    fi
+    runHook postUnpack
+  '';
+
+  # Prevent double wrapping
+  dontWrapGApps = true;
+
+  installPhase =
+    ''
+      runHook preInstall
+
+      libdir=$out/lib/spotify
+      mkdir -p $libdir
+      mv ./usr/* $out/
+
+      cp meta/snap.yaml $out
+
+      # Work around Spotify referring to a specific minor version of
+      # OpenSSL.
+
+      ln -s ${lib.getLib openssl}/lib/libssl.so $libdir/libssl.so.1.0.0
+      ln -s ${lib.getLib openssl}/lib/libcrypto.so $libdir/libcrypto.so.1.0.0
+      ln -s ${nspr.out}/lib/libnspr4.so $libdir/libnspr4.so
+      ln -s ${nspr.out}/lib/libplc4.so $libdir/libplc4.so
+
+      ln -s ${ffmpeg.lib}/lib/libavcodec.so* $libdir
+      ln -s ${ffmpeg.lib}/lib/libavformat.so* $libdir
+
+      rpath="$out/share/spotify:$libdir"
+
+      patchelf \
+        --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+        --set-rpath $rpath $out/share/spotify/spotify
+
+      librarypath="${lib.makeLibraryPath deps}:$libdir"
+      wrapProgramShell $out/share/spotify/spotify \
+        ''${gappsWrapperArgs[@]} \
+        ${lib.optionalString (deviceScaleFactor != null) ''
+          --add-flags "--force-device-scale-factor=${toString deviceScaleFactor}" \
+        ''} \
+        --prefix LD_LIBRARY_PATH : "$librarypath" \
+        --prefix PATH : "${gnome.zenity}/bin" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
+
+      # fix Icon line in the desktop file (#48062)
+      sed -i "s:^Icon=.*:Icon=spotify-client:" "$out/share/spotify/spotify.desktop"
+
+      # Desktop file
+      mkdir -p "$out/share/applications/"
+      cp "$out/share/spotify/spotify.desktop" "$out/share/applications/"
+
+      # Icons
+      for i in 16 22 24 32 48 64 128 256 512; do
+        ixi="$i"x"$i"
+        mkdir -p "$out/share/icons/hicolor/$ixi/apps"
+        ln -s "$out/share/spotify/icons/spotify-linux-$i.png" \
+          "$out/share/icons/hicolor/$ixi/apps/spotify-client.png"
+      done
+
+      runHook postInstall
+    '';
+
+  meta = meta // {
+    maintainers = with lib.maintainers; [ eelco ftrvxmtrx sheenobu timokau ma27 ];
+  };
+}

pkgs/applications/audio/spotify/update.sh

@@ -20,7 +20,7 @@
 
 channel="${1:-stable}" # stable/candidate/edge
 nixpkgs="$(git rev-parse --show-toplevel)"
-spotify_nix="$nixpkgs/pkgs/applications/audio/spotify/default.nix"
+spotify_nix="$nixpkgs/pkgs/applications/audio/spotify/linux.nix"
 
 
 #

pkgs/applications/backup/pika-backup/default.nix

@@ -19,20 +19,20 @@
 
 stdenv.mkDerivation rec {
   pname = "pika-backup";
-  version = "0.5.2";
+  version = "0.6.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "pika-backup";
     rev = "v${version}";
-    hash = "sha256-d+VkKY14o1wwINSlVBsvWux8YhyXg77N9i2R61QLGqM=";
+    hash = "sha256-eI2MRrW6MID4dMHR1OjDT83xd/9CgDuhAWpEHmhnMVw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-3MNwX8kB+bjP9Dz+k+HYmCOI1Naa9tDBe0+GKsEmqnc=";
+    hash = "sha256-hbh4kfQcym0n2cCp2ebljQpizolsxyfZk7ctKOlDybA=";
   };
 
   patches = [

pkgs/applications/editors/cudatext/default.nix

@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cudatext";
-  version = "1.190.1";
+  version = "1.191.0";
 
   src = fetchFromGitHub {
     owner = "Alexey-T";
     repo = "CudaText";
     rev = version;
-    hash = "sha256-JnFvbCSDRkw2/BXoSCB9IcB5hwrhB+hvS1xLj5eAQbs=";
+    hash = "sha256-wn2pSzz4w8tQjVFEIfR3/1ddeTjQBQaKl26SxXbOXG0=";
   };
 
   postPatch = ''

pkgs/applications/editors/cudatext/deps.json

@@ -16,8 +16,8 @@
   },
   "ATSynEdit": {
     "owner": "Alexey-T",
-    "rev": "2023.04.08",
-    "hash": "sha256-FBrb/2VwmpM6FCUvHXZTJCsn/a9r3qPNBYVWyN5CS5o="
+    "rev": "2023.04.17",
+    "hash": "sha256-QllXTq9BCKedt/Pv14qOn1UoxZ57qz76OyptnjT92hA="
   },
   "ATSynEdit_Cmp": {
     "owner": "Alexey-T",
@@ -26,13 +26,13 @@
   },
   "EControl": {
     "owner": "Alexey-T",
-    "rev": "2023.04.04",
-    "hash": "sha256-BLj37uTHB4T0ek97u7hYqxbUjW71efGBKGG35CEyLR8="
+    "rev": "2023.04.17",
+    "hash": "sha256-EdtrKYZTP+1MQU5fLO6vYoU3EjS91PaSQnIxtgAs7TI="
   },
   "ATSynEdit_Ex": {
     "owner": "Alexey-T",
-    "rev": "2023.04.04",
-    "hash": "sha256-bqNq1tzZjzwMw3I6G5kuFeh7qp33DGo4gu4BVd4pONk="
+    "rev": "2023.04.17",
+    "hash": "sha256-ZCRoKuwU+DtXEEZEL2QhhwMfewQMhw+/20vVRgHpHf4="
   },
   "Python-for-Lazarus": {
     "owner": "Alexey-T",

pkgs/applications/editors/eclipse/build-eclipse.nix

@@ -2,7 +2,7 @@
 , zlib, jdk, glib, glib-networking, gtk, libXtst, libsecret, gsettings-desktop-schemas, webkitgtk
 , makeWrapper, perl, ... }:
 
-{ name, src ? builtins.getAttr stdenv.hostPlatform.system sources, sources ? null, description }:
+{ name, src ? builtins.getAttr stdenv.hostPlatform.system sources, sources ? null, description, productVersion }:
 
 stdenv.mkDerivation rec {
   inherit name src;
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     categories = [ "Development" ];
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper perl ];
   buildInputs = [
     fontconfig freetype glib gsettings-desktop-schemas gtk jdk libX11
     libXrender libXtst libsecret zlib
@@ -38,14 +38,13 @@ stdenv.mkDerivation rec {
     # settings in ~/.eclipse/org.eclipse.platform_<version> rather
     # than ~/.eclipse/org.eclipse.platform_<version>_<number>.
     productId=$(sed 's/id=//; t; d' $out/eclipse/.eclipseproduct)
-    productVersion=$(sed 's/version=//; t; d' $out/eclipse/.eclipseproduct)
 
     makeWrapper $out/eclipse/eclipse $out/bin/eclipse \
       --prefix PATH : ${jdk}/bin \
       --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ glib gtk libXtst libsecret ] ++ lib.optional (webkitgtk != null) webkitgtk)} \
       --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
       --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
-      --add-flags "-configuration \$HOME/.eclipse/''${productId}_$productVersion/configuration"
+      --add-flags "-configuration \$HOME/.eclipse/''${productId}_${productVersion}/configuration"
 
     # Create desktop item.
     mkdir -p $out/share/applications
@@ -54,7 +53,7 @@ stdenv.mkDerivation rec {
     ln -s $out/eclipse/icon.xpm $out/share/pixmaps/eclipse.xpm
 
     # ensure eclipse.ini does not try to use a justj jvm, as those aren't compatible with nix
-    ${perl}/bin/perl -i -p0e 's|-vm\nplugins/org.eclipse.justj.*/jre/bin\n||' $out/eclipse/eclipse.ini
+    perl -i -p0e 's|-vm\nplugins/org.eclipse.justj.*/jre/bin.*\n||' $out/eclipse/eclipse.ini
   ''; # */
 
   meta = {

pkgs/applications/editors/eclipse/default.nix

@@ -10,15 +10,15 @@
 # find the downloads needed for new versions
 #
 # to test:
-# $ for e in cpp modeling platform sdk java jee committers rcp; do nix build -f default.nix pkgs.eclipses.eclipse-${e} -o eclipse-${e}; done
+# for e in cpp modeling platform sdk java jee committers rcp; do for s in pkgs pkgsCross.aarch64-multiplatform; do echo; echo $s $e; nix build -f default.nix ${s}.eclipses.eclipse-${e} -o eclipse-${s}-${e}; done; done
 
 let
   platform_major = "4";
-  platform_minor = "26";
-  year = "2022";
-  month = "12"; #release month
-  buildmonth = "11"; #sometimes differs from release month
-  timestamp = "${year}${buildmonth}231800";
+  platform_minor = "27";
+  year = "2023";
+  month = "03"; #release month
+  buildmonth = "03"; #sometimes differs from release month
+  timestamp = "${year}${buildmonth}020300";
   gtk = gtk3;
   arch = if stdenv.hostPlatform.isx86_64 then
     "x86_64"
@@ -27,11 +27,13 @@ let
   else throw "don't know what platform suffix for ${stdenv.hostPlatform.system} will be";
 in rec {
 
-  buildEclipse = callPackage ./build-eclipse.nix {
+  # work around https://bugs.eclipse.org/bugs/show_bug.cgi?id=476075#c3
+  buildEclipseUnversioned = callPackage ./build-eclipse.nix {
     inherit stdenv makeDesktopItem freetype fontconfig libX11 libXrender zlib
             jdk glib gtk libXtst gsettings-desktop-schemas webkitgtk
             makeWrapper;
   };
+  buildEclipse = eclipseData: buildEclipseUnversioned (eclipseData // { productVersion = "${platform_major}.${platform_minor}"; });
 
   ### Eclipse CPP
 
@@ -42,8 +44,8 @@ in rec {
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-cpp-${year}-${month}-R-linux-gtk-${arch}.tar.gz";
         hash = {
-          x86_64 = "sha512-nqqY4dewq1bjeNoZdWvOez+cBti+f9qXshx1eqJ2lB7sGJva5mcR9e+CZTVD0+EtVJ/U+8viJ+E1Veht1ZnqOw==";
-          aarch64 = "sha512-kmeNH6F8oK72LtrYtiJVLKhy6Q1HwnU+Bh+mpXdXSrfj9KtqzHQkJ0kTnnJkGYLtpi+zyXDwsxzyjh6pPyDRJA==";
+          x86_64 = "sha256-MBng3ETarHMlUUPpVvMIZxVqpe9JW5xNHonnN6CHRcw=";
+          aarch64 = "sha256-7FgpPzp5MY/fB6Q/wvrvi+Lpcm3tmH7bUTLh7q2Rjek=";
         }.${arch};
       };
   };
@@ -57,8 +59,8 @@ in rec {
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-modeling-${year}-${month}-R-linux-gtk-${arch}.tar.gz";
         hash = {
-          x86_64 = "sha512-WU2BJt6GL3ug3yOUOd5y6/AbGLcr2MkCg+QJiNIMkSXvoU9TF6R6oimoGVc3kPZmazRy6WYoes55T3bWrHnO8Q==";
-          aarch64 = "sha512-F63f2o9u/p7hhrxI+Eu6NiL4sPccIYw876Nnj8mfSZ7bozs1OVNWftZj+xbdLLbr0bVz3WKnt4BHzcLUA6QG7g==";
+          x86_64 = "sha256-BXofrKElgCG3+WUCanpX1sGLhirj2pLi+pi24Z+WjBk=";
+          aarch64 = "sha256-CdePRa6jmWlt3Wismt3RahGzYOm1ZDwQRt82kRVXSdM=";
         }.${arch};
       };
   };
@@ -72,8 +74,8 @@ in rec {
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops${platform_major}/R-${platform_major}.${platform_minor}-${timestamp}/eclipse-platform-${platform_major}.${platform_minor}-linux-gtk-${arch}.tar.gz";
         hash = {
-          x86_64 = "sha512-hmdWGteMDt4HhYq+k9twuftalpTzHtGnVVLphZcpJcw+6vJfersciDMaeLRqbCAeFbzJdgzjYo76bpP6FubySw==";
-          aarch64 = "sha512-BvUkOdCsjwtscPeuBXG7ZpitOr8EQK5JL8nSGpw/RhhBEFz46nsc7W18l0aYjdzRHh2ie55RylS2PEQELkS/hQ==";
+          x86_64 = "sha256-aprXjNv2NMoIDCNkFxwmMKcGUt2ssRonzTZ/hH57Mig=";
+          aarch64 = "sha256-Aq9PDVo/9zTeQ2j6q5bf1aIKjKM7oonIr1mEQ7rX48Y=";
         }.${arch};
       };
   };
@@ -81,9 +83,10 @@ in rec {
   ### Eclipse Scala SDK
 
   eclipse-scala-sdk =
-    (buildEclipse.override { jdk = jdk8; gtk = gtk2; } {
+    (buildEclipseUnversioned.override { jdk = jdk8; gtk = gtk2; } {
       name = "eclipse-scala-sdk-4.7.0";
       description = "Eclipse IDE for Scala Developers";
+      productVersion = "4.7";
       src =
         fetchurl {
           url = "https://downloads.typesafe.com/scalaide-pack/4.7.0-vfinal-oxygen-212-20170929/scala-SDK-4.7.0-vfinal-2.12-linux.gtk.x86_64.tar.gz";
@@ -103,8 +106,8 @@ in rec {
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/eclipse/downloads/drops${platform_major}/R-${platform_major}.${platform_minor}-${timestamp}/eclipse-SDK-${platform_major}.${platform_minor}-linux-gtk-${arch}.tar.gz";
         hash = {
-          x86_64 = "sha512-yH4/K9sBLCUc2EVYwPL0dLql/S3AfaV6fFh7ewAuIb7yHtcsOWMqy/h1hZUlFFg2ykfwDWDDHEK7qfTI0hM7BQ==";
-          aarch64 = "sha512-UYp8t7r2RrN3rKN180cWpJyhyO5LVXL8LrTRKJzttUgB7kM1nroTEI3DesBu+Hw4Ynl7eLiBK397rqcpOAfxJw==";
+          x86_64 = "sha256-39DXU7wIsdxkUpNKnYPT7+qPJ2DrF7G7UJqPfhEDGGs=";
+          aarch64 = "sha256-7GwKGNHWPZ3uOFyzQj1dftFFz/3oa2j8XWkRn0wnllY=";
         }.${arch};
       };
   };
@@ -118,8 +121,8 @@ in rec {
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-java-${year}-${month}-R-linux-gtk-${arch}.tar.gz";
         hash = {
-          x86_64 = "sha512-71mXYVLVnyDjYZbJGBKc0aDPq8sbTxlVZRQq7GlSUDv2fsoNYWYgqYfK7RSED5yoasCfs3HUYr7QowRAKJOnfQ==";
-          aarch64 = "sha512-KOQ6BZuQJeVpbMQVxF67M3F/KXMmDhmZQBNq0yWM+/8+d0DiBRkwJtqPYsnTqrax8FSunn2yy+CzlfyHSoNvpg==";
+          x86_64 = "sha256-zNBzFHmNaxUutzMh/5pOglJiKh5NAvSVwvPYyA6RVr4=";
+          aarch64 = "sha256-RtLXB9kgpLERfhpvDTaJG84qVyN1Puud1PTZtk/WIO0=";
         }.${arch};
       };
   };
@@ -133,8 +136,8 @@ in rec {
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-jee-${year}-${month}-R-linux-gtk-${arch}.tar.gz";
         hash = {
-          x86_64 = "sha512-55i9YVOa+vKHt72vHIqy9BmKMkg1KaLqMStjTtfaLTH5yP0ei+NTP2XL8IBHOgu0hCEJqYXTq+3I3RQy476etQ==";
-          aarch64 = "sha512-iaoTB/Pinoj1weiGBBv0plQ4jGNdFs2JiBG7S/icUoAX5O6jTGAgJvOwh7Nzn+0N6YL6+HPWaV24a6lM43y8Og==";
+          x86_64 = "sha256-vpvmKZKVl6ubfq8QMDr0xprXYMWl576hu+ovvREN4ak=";
+          aarch64 = "sha256-5Yqxgl4kkN3Bb7hsTnd9q5TsCpVBVkEVvqPbL5MYEyg=";
         }.${arch};
       };
   };
@@ -148,8 +151,8 @@ in rec {
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-committers-${year}-${month}-R-linux-gtk-${arch}.tar.gz";
         hash = {
-          x86_64 = "sha512-zGeynifM0dn1214HEVS7OVtv7xa8asjLzOXh5riJK8c/DWvNrRduHn6o6PGnxYOYVIfC9BzNRAjG1STkWu9j+Q==";
-          aarch64 = "sha512-B866dFJcsTkq+h0RZ61CxXE83TWvCf8ZAbGeIC385PpPR3i/gZnRjN2oRrDP22CNR5XXA+PfXKxqvERhJB5ebA==";
+          x86_64 = "sha256-4SAiEZWSUaiK8QO2Hg39FBcj1aYRtbOJkeF1W1AMQBo=";
+          aarch64 = "sha256-+KGDlo6QK3o/n2vSiD0HpIkBwqwIiMXzdFUpfE48gps=";
         }.${arch};
       };
   };
@@ -163,8 +166,8 @@ in rec {
       fetchurl {
         url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/technology/epp/downloads/release/${year}-${month}/R/eclipse-rcp-${year}-${month}-R-linux-gtk-${arch}.tar.gz";
         hash = {
-          x86_64 = "sha256-ml76ix0fHuR0KqYWQuTftEBAgq7iaOIyvr8V6WhuzeU=";
-          aarch64 = "sha256-sMB6a3f0fiL6ZentIjJTMi59ZOh7dizXrkMQuIRbds0=";
+          x86_64 = "sha256-bhcpzsS9cci3Y3Pk9DOrtPonKjRg/vzDqDr3Be/xfks=";
+          aarch64 = "sha256-YCb4leFWRtx4VPwK/5vgwwDH3/f0/0OWEy4ueAS7sUw=";
         }.${arch};
       };
   };

pkgs/applications/editors/eclipse/plugins.nix

@@ -254,13 +254,13 @@ rec {
 
   cdt = buildEclipseUpdateSite rec {
     name = "cdt-${version}";
-    # find current version at https://www.eclipse.org/cdt/downloads.php
-    version = "11.0.0";
+    # find current version at https://github.com/eclipse-cdt/cdt/releases
+    version = "11.1.1";
 
     src = fetchzip {
       stripRoot = false;
       url = "https://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/tools/cdt/releases/${lib.versions.majorMinor version}/${name}/${name}.zip";
-      hash = "sha256-2rt9crMqNFevIHFIdOGWDq+j0ZJPVt1a9Z7P9HG58Ks=";
+      hash = "sha256-k78QKPIb3Lr0Wcg2tTlX1abdpcvxspjaxJiP2Hrgb4A=";
     };
 
     meta = with lib; {

pkgs/applications/editors/pulsar/default.nix

@@ -17,23 +17,26 @@
 , makeDesktopItem
 , copyDesktopItems
 , makeWrapper
+, nodePackages
+, python3
 }:
 
 let
-  pname = "Pulsar";
-  version = "1.103.0";
+  pname = "pulsar";
+  version = "1.104.0";
 
   sourcesPath = {
     x86_64-linux.tarname = "Linux.${pname}-${version}.tar.gz";
-    x86_64-linux.hash = "sha256-C9La+rMpxyFthNPwPBZfV1goP/F1TiNYYYwmPCSkKdw=";
+    x86_64-linux.hash = "sha256-HEMUQVNPb6qWIXX25N79HwHo7j11MyFiBRsq9otdAL8=";
     aarch64-linux.tarname = "ARM.Linux.${pname}-${version}-arm64.tar.gz";
-    aarch64-linux.hash = "sha256-uVGxDLqFgm5USZT6i7pLYJZq8jFxZviVXXYTL3RVhpw=";
+    aarch64-linux.hash = "sha256-f+s54XtLLdhTFY9caKTKngJF6zLai0F7ur9v37bwuNE=";
   }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   additionalLibs = lib.makeLibraryPath [
     xorg.libxshmfence
     libxkbcommon
     xorg.libxkbfile
+    stdenv.cc.cc.lib
   ];
   newLibpath = "${atomEnv.libPath}:${additionalLibs}";
 
@@ -57,6 +60,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     wrapGAppsHook
     copyDesktopItems
+    nodePackages.asar
   ];
 
   buildInputs = [
@@ -110,12 +114,26 @@ stdenv.mkDerivation rec {
     ln -s ${git}/bin/git $dugite/git/bin/git
     rm -f $dugite/git/libexec/git-core/git
     ln -s ${git}/bin/git $dugite/git/libexec/git-core/git
+
+    # We have to patch a prebuilt binary in the asar archive
+    # But asar complains because the node_gyp unpacked dependency uses a prebuilt Python3 itself
+
+    rm $opt/resources/app.asar.unpacked/node_modules/tree-sitter-bash/build/node_gyp_bins/python3
+    ln -s ${python3}/bin/python3 $opt/resources/app.asar.unpacked/node_modules/tree-sitter-bash/build/node_gyp_bins/python3
   '' + ''
     # Patch the bundled node executables
     find $opt -name "*.node" -exec patchelf --set-rpath "${newLibpath}:$opt" {} \;
     # Also patch the node executable for apm
     patchelf --set-rpath "${newLibpath}:$opt" $opt/resources/app/ppm/bin/node
 
+    # The pre-packaged ASAR bundle comes with prebuild binaries, expecting libstdc++.so.6
+    asarBundle=$TMPDIR/asarbundle
+    asar e $opt/resources/app.asar $asarBundle
+    find $asarBundle -name "*.node" -exec patchelf --set-rpath "${newLibpath}:$opt" --add-needed libstdc++.so.6 {} \;
+    unlink $asarBundle/node_modules/document-register-element/dre # Self referencing symlink, breaking asar rebundling
+    asar p $asarBundle $opt/resources/app.asar
+    rm -rf $asarBundle
+
     # We have patched the original wrapper, but now it needs the "PULSAR_PATH" env var
     mkdir -p $out/bin
     wrapProgram $opt/resources/pulsar.sh \

pkgs/applications/editors/pulsar/update.mjs

@@ -4,15 +4,13 @@
 */
 
 import { promises as fs } from 'node:fs';
-import { promisify } from 'node:util';
-import { exec as _exec } from 'node:child_process';
-const exec = promisify(_exec);
 
 const constants = {
     githubUrl: "https://api.github.com/repos/pulsar-edit/pulsar/releases",
     sha256FileURL: (newVersion) => `https://github.com/pulsar-edit/pulsar/releases/download/v${newVersion}/SHA256SUMS.txt`,
     x86_64FileName: (newVersion) => `Linux.pulsar-${newVersion}.tar.gz`,
     aarch64FileName: (newVersion) => `ARM.Linux.pulsar-${newVersion}-arm64.tar.gz`,
+    targetFile: new URL("default.nix", import.meta.url).pathname,
 };
 
 async function getLatestVersion() {
@@ -69,10 +67,10 @@ async function updateFile(newVersion, sha256Sums, currentFile) {
     newFile = newFile.replace(/x86_64-linux\.hash = "(.*)";/, `x86_64-linux.hash = "${sha256Sums.x86_64}";`);
     newFile = newFile.replace(/aarch64-linux\.hash = "(.*)";/, `aarch64-linux.hash = "${sha256Sums.aarch64}";`);
 
-    await fs.writeFile('default.nix', newFile);
+    await fs.writeFile(constants.targetFile, newFile);
 };
 
-let currentFile = await fs.readFile('default.nix', 'utf8');
+let currentFile = await fs.readFile(constants.targetFile, 'utf8');
 let currentVersion = currentFile.match(/version = "(.*)";/)[1];
 const newVersion = await getLatestVersion();
 if (currentVersion === newVersion) {

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -60,12 +60,12 @@
   };
   bash = buildGrammar {
     language = "bash";
-    version = "0.0.0+rev=b338fa9";
+    version = "0.0.0+rev=422a07c";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-bash";
-      rev = "b338fa9f4807b9e0336cd4dde04948a8c324a4cf";
-      hash = "sha256-2ARBWfjtnM9+FKfASk1s6L7cDnUFIV6U9wBld2s8WWM=";
+      rev = "422a07cb221b92c6b117e854efa8945a506b5214";
+      hash = "sha256-P5ne6DIQZElbGpSpwxbEQrufcUhekWWEhOhD0GHJ/AQ=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-bash";
   };
@@ -137,12 +137,12 @@
   };
   c_sharp = buildGrammar {
     language = "c_sharp";
-    version = "0.0.0+rev=92d572e";
+    version = "0.0.0+rev=0dd182a";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-c-sharp";
-      rev = "92d572eef5ffdd4117e7ba36b56850a90cb79151";
-      hash = "sha256-Zp8aEoLv/FPaTQPJzS2gS3htU9wpUwWB1gvRfYh4gsY=";
+      rev = "0dd182a14a519a70dc60c3727fdc2fdb65c030ae";
+      hash = "sha256-yIZUsEJvQkxD4gNp4jQRGtEeSTLeSdgFdJs03nvt9ko=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-c-sharp";
   };
@@ -236,12 +236,12 @@
   };
   cpp = buildGrammar {
     language = "cpp";
-    version = "0.0.0+rev=0b6d0eb";
+    version = "0.0.0+rev=670404d";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-cpp";
-      rev = "0b6d0eb9abdf7cea31961cd903eeed5bbd0aae74";
-      hash = "sha256-rsxRiZCrsEB/ixAP4YmxFtnCoDQrLAp75c74DFR0/nk=";
+      rev = "670404d7c689be1c868a46f919ba2a3912f2b7ef";
+      hash = "sha256-T+Ha2hlI7ucEsTYvDmk7xjHNEoyvnotp/1EWfyCwnWM=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-cpp";
   };
@@ -258,12 +258,12 @@
   };
   cuda = buildGrammar {
     language = "cuda";
-    version = "0.0.0+rev=967e7d7";
+    version = "0.0.0+rev=a358542";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-cuda";
-      rev = "967e7d74a1a04a680674199e12141963a8dd6336";
-      hash = "sha256-3rkmxnf1YzshBUEOXBXj9Zpg9IHh2uS0QzdncOU99IQ=";
+      rev = "a35854270463a96e79096bb854aae30a4f0e6cd2";
+      hash = "sha256-8CRFEUxTge0EJQQQVabCjstUGkOIPlC1duj2jD4R89E=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-cuda";
   };
@@ -392,12 +392,12 @@
   };
   elm = buildGrammar {
     language = "elm";
-    version = "0.0.0+rev=28bb193";
+    version = "0.0.0+rev=692c50c";
     src = fetchFromGitHub {
       owner = "elm-tooling";
       repo = "tree-sitter-elm";
-      rev = "28bb193640d916dfaf947912c1413cebb0484841";
-      hash = "sha256-Ijw9Ov8+IBLl0fQlkuH6rQ6E7tlKeD+huj0GZdz6XH8=";
+      rev = "692c50c0b961364c40299e73c1306aecb5d20f40";
+      hash = "sha256-0LpuyebOB5ew9fULBcaw8aUbF7HM5sXQpv+Jroz4tXg=";
     };
     meta.homepage = "https://github.com/elm-tooling/tree-sitter-elm";
   };
@@ -766,12 +766,12 @@
   };
   hlsl = buildGrammar {
     language = "hlsl";
-    version = "0.0.0+rev=fce5ea2";
+    version = "0.0.0+rev=40472c1";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-hlsl";
-      rev = "fce5ea2e842404ce1af13fffdcf0daa02240c3dd";
-      hash = "sha256-7/HJPPLUwwnxgmNP0Vzm+nTJ1YfnUYbqMcOEZZj5uRA=";
+      rev = "40472c119b5740d9a1fa0b0dc0b013502b636708";
+      hash = "sha256-PfShqPSIsYVMPpW9hQhbEz378vBwDiNkBKR3rLXcIdM=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-hlsl";
   };
@@ -788,12 +788,12 @@
   };
   html = buildGrammar {
     language = "html";
-    version = "0.0.0+rev=29f53d8";
+    version = "0.0.0+rev=594f23e";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-html";
-      rev = "29f53d8f4f2335e61bf6418ab8958dac3282077a";
-      hash = "sha256-v84N9erFL+QMoxh1dtfVdAJ5iTCoiFcT3kQ2+yq8TXE=";
+      rev = "594f23eb6da580cf269a59d966db68f2cde7d0c8";
+      hash = "sha256-DgYcJjMCQ0C96l1J4if6FdArj5atxy3LsJr+SnZqiQo=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-html";
   };
@@ -964,12 +964,12 @@
   };
   latex = buildGrammar {
     language = "latex";
-    version = "0.0.0+rev=376f640";
+    version = "0.0.0+rev=cd3cc49";
     src = fetchFromGitHub {
       owner = "latex-lsp";
       repo = "tree-sitter-latex";
-      rev = "376f64097b7a26691a2ca60dc94e4dfa417be932";
-      hash = "sha256-9hcmCr9HfhKt5dkNN24haubrOySqpxzMoLVEGO53lxk=";
+      rev = "cd3cc493a92b6bac7be4b3bd6d006d35d3c36d4c";
+      hash = "sha256-CHN54T4+eD7EGx4nzAIryAHOu8NCiBDjM2A7Njjt87w=";
     };
     meta.homepage = "https://github.com/latex-lsp/tree-sitter-latex";
   };
@@ -1008,12 +1008,12 @@
   };
   luadoc = buildGrammar {
     language = "luadoc";
-    version = "0.0.0+rev=5c9572f";
+    version = "0.0.0+rev=1e11522";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-luadoc";
-      rev = "5c9572faf56d1fa0f7e0740c94de1c4f67c6af5e";
-      hash = "sha256-90FXGhzTpPVVBPpAdAvfqdIOVCPKTUtRC0WWQyCR0Eg=";
+      rev = "1e1152264cc68e11d65d9e2493566f5717a13d11";
+      hash = "sha256-CNSo4m5peO1WBncZ1RGmmbA3V8qefh5LJJpFYFTAlsY=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-luadoc";
   };
@@ -1076,12 +1076,12 @@
   };
   matlab = buildGrammar {
     language = "matlab";
-    version = "0.0.0+rev=2d5d3d5";
+    version = "0.0.0+rev=dd95e1f";
     src = fetchFromGitHub {
       owner = "mstanciu552";
       repo = "tree-sitter-matlab";
-      rev = "2d5d3d5193718a86477d4335aba5b34e79147326";
-      hash = "sha256-Rpa/F3MIFRmHunJFsuvbs3h3vDlR3U7UZ+sTN5tJS8U=";
+      rev = "dd95e1fc1b5514aa3a882d5fb8ddbf4683e953f0";
+      hash = "sha256-0CSwSFf4mUtz4lg06Fi24Szo5WpD18M9Fiu8KIg2QB8=";
     };
     meta.homepage = "https://github.com/mstanciu552/tree-sitter-matlab";
   };
@@ -1245,12 +1245,12 @@
   };
   perl = buildGrammar {
     language = "perl";
-    version = "0.0.0+rev=3d3a95e";
+    version = "0.0.0+rev=60aa138";
     src = fetchFromGitHub {
       owner = "ganezdragon";
       repo = "tree-sitter-perl";
-      rev = "3d3a95ee6645d7bcd993e77b252ffd33fd297c8e";
-      hash = "sha256-YM4lxdcvkX2l4KkdktDSoNXaN2zCqAS4W0mXMh8GJOs=";
+      rev = "60aa138f9e1db15becad53070f4d5898b0e8a98c";
+      hash = "sha256-GpgUSm/kFFXgJOSBVBxPQiMfykZUgxLdmQfDfJE3Jq8=";
     };
     meta.homepage = "https://github.com/ganezdragon/tree-sitter-perl";
   };
@@ -1344,12 +1344,12 @@
   };
   prql = buildGrammar {
     language = "prql";
-    version = "0.0.0+rev=4045dcf";
+    version = "0.0.0+rev=02b1e96";
     src = fetchFromGitHub {
       owner = "PRQL";
       repo = "tree-sitter-prql";
-      rev = "4045dcff3f8ac04669855b32584053dec065bba4";
-      hash = "sha256-+uyCgWon/yCRAOTpzpcDovxyXrIZ4UDwwWG4ndMz0iY=";
+      rev = "02b1e967ede00aaa5d7c9fcd4a604b83825a6261";
+      hash = "sha256-3pdfcCfHdusphn7vQX/d1gS5kKyNTE9qf0YBvsa/BjM=";
     };
     meta.homepage = "https://github.com/PRQL/tree-sitter-prql";
   };
@@ -1575,12 +1575,12 @@
   };
   smali = buildGrammar {
     language = "smali";
-    version = "0.0.0+rev=a67a429";
+    version = "0.0.0+rev=b002dce";
     src = fetchFromSourcehut {
       owner = "~yotam";
       repo = "tree-sitter-smali";
-      rev = "a67a429784dafa0ca4342d71e6530137ca803883";
-      hash = "sha256-Pby6RZKPXyPR41E9m2iRsLgVt7bOn2AZyyb4lvcwYwY=";
+      rev = "b002dceb9b91a6d6de45479ab4b2e9596ebbaaf3";
+      hash = "sha256-KZ5+3xqQkxAZcOY8UVxfycQWlaGHq9pv4MzjiIaVtLY=";
     };
     meta.homepage = "https://git.sr.ht/~yotam/tree-sitter-smali";
   };
@@ -1685,12 +1685,12 @@
   };
   swift = buildGrammar {
     language = "swift";
-    version = "0.0.0+rev=ca3a370";
+    version = "0.0.0+rev=05467af";
     src = fetchFromGitHub {
       owner = "alex-pinkus";
       repo = "tree-sitter-swift";
-      rev = "ca3a37055069277ad91d6a2c35faf9f247dcfbfb";
-      hash = "sha256-H/6BBBB+vITl91FwiM6/aiv8OEgGjLt3HihTTsYzTVE=";
+      rev = "05467af73ac315fc80c7f3ef397e261f30395e2a";
+      hash = "sha256-4/5ZzxkMiv8qXCXM/M/+NBX9uMw46DnGTEFKbPgNNzU=";
     };
     generate = true;
     meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@@ -1708,13 +1708,13 @@
   };
   t32 = buildGrammar {
     language = "t32";
-    version = "0.0.0+rev=f8106fc";
+    version = "0.0.0+rev=0802b36";
     src = fetchFromGitea {
       domain = "codeberg.org";
       owner = "xasc";
       repo = "tree-sitter-t32";
-      rev = "f8106fcf5a27f905b3d9d55d9cd3e910bea70c60";
-      hash = "sha256-hKddSekx67Yqm4+LqVaH8Sf1+73RlCnXE6th2FTHB34=";
+      rev = "0802b3638a1c5022b4d55bdafa64f856ed43d7d6";
+      hash = "sha256-9c5EUgtvoXXZQY5AtahyfmG9SGxcjhrrOxWa0eyicqU=";
     };
     meta.homepage = "https://codeberg.org/xasc/tree-sitter-t32";
   };
@@ -2011,12 +2011,12 @@
   };
   zig = buildGrammar {
     language = "zig";
-    version = "0.0.0+rev=2c7b630";
+    version = "0.0.0+rev=9b84cb6";
     src = fetchFromGitHub {
       owner = "maxxnino";
       repo = "tree-sitter-zig";
-      rev = "2c7b6308d906d7aec4b3e1fafaaeca447a8a2c2f";
-      hash = "sha256-uN/B4YasWdgAWV8IAwKd4MP/L73+RiQJGQD00ZA8d6E=";
+      rev = "9b84cb66e7d480e7c0370f4e33e8325bac6ad09f";
+      hash = "sha256-IyVYRqSAqCxUK5ADXlTfNK9MhcdvDVwCJ2Y5VF/oYVs=";
     };
     meta.homepage = "https://github.com/maxxnino/tree-sitter-zig";
   };

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -678,6 +678,7 @@ https://github.com/camspiers/snap/,,
 https://github.com/norcalli/snippets.nvim/,,
 https://github.com/shaunsingh/solarized.nvim/,HEAD,
 https://github.com/sainnhe/sonokai/,,
+https://github.com/sQVe/sort.nvim/,HEAD,
 https://github.com/chikatoike/sourcemap.vim/,,
 https://github.com/liuchengxu/space-vim/,,
 https://github.com/ctjhoa/spacevim/,,

pkgs/applications/editors/vscode/extensions/contextmapper.context-mapper-vscode-extension/default.nix

@@ -0,0 +1,36 @@
+{ graphviz
+, jre
+, lib
+, makeWrapper
+, vscode-utils
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension rec {
+  mktplcRef = {
+    name = "context-mapper-vscode-extension";
+    publisher = "contextmapper";
+    version = "6.7.0";
+    sha256 = "sha256-vlDVqn1Je0eo5Nf2gyotSvhIa07tWCINe79RZSyMzcA=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  buildInputs = [
+    graphviz
+  ];
+
+  postInstall = ''
+    wrapProgram $out/share/vscode/extensions/contextmapper.context-mapper-vscode-extension/lsp/bin/context-mapper-lsp \
+      --set JAVA_HOME "${jre}"
+  '';
+
+  meta = {
+    description = "A VSCode extension for Context Mapper";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=${mktplcRef.publisher}.${mktplcRef.name}";
+    homepage = "https://github.com/ContextMapper/vscode-extension";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.rhoriguchi ];
+  };
+}

pkgs/applications/editors/vscode/extensions/default.nix

@@ -669,6 +669,8 @@ let
         };
       };
 
+      contextmapper.context-mapper-vscode-extension = callPackage ./contextmapper.context-mapper-vscode-extension { };
+
       coolbear.systemd-unit-file = buildVscodeMarketplaceExtension {
         mktplcRef = {
           publisher = "coolbear";
@@ -1942,8 +1944,8 @@ let
         mktplcRef = {
           name = "direnv";
           publisher = "mkhl";
-          version = "0.10.1";
-          sha256 = "0m89sx1qqdkwa9pfmd9b11lp8z0dqpi6jn27js5q4ymscyg41bqd";
+          version = "0.12.0";
+          sha256 = "sha256-UMGTWAiPAxSjy5ALUkijD0GE9TW37TZ3UvMmgFBNYsU=";
         };
         meta = {
           description = "direnv support for Visual Studio Code";

pkgs/applications/editors/vscode/extensions/rust-lang.rust-analyzer/default.nix

@@ -29,7 +29,7 @@ let
     sha256 = "sha256-Njlus+vY3N++qWE0JXrGjwcXY2QDFuOV/7NruBBMETY=";
   };
 
-  build-deps = nodePackages."rust-analyzer-build-deps-../../applications/editors/vscode/extensions/rust-analyzer/build-deps";
+  build-deps = nodePackages."rust-analyzer-build-deps-../../applications/editors/vscode/extensions/rust-lang.rust-analyzer/build-deps";
   # FIXME: Making a new derivation to link `node_modules` and run `npm run package`
   # will cause a build failure.
   vsix = build-deps.override {

pkgs/applications/graphics/ImageMagick/default.nix

@@ -47,13 +47,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.1-6";
+  version = "7.1.1-7";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = finalAttrs.version;
-    hash = "sha256-D1ZKTL3c+engyvBwCdjYqeoHx2v/6gwmK8UfaAxjnWI=";
+    hash = "sha256-PeXWtD8AX9VEJruZu/TO1Bpaoa1XNKIFGfGK+TpQEMs=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big

pkgs/applications/graphics/ipe/default.nix

@@ -1,5 +1,5 @@
 { lib
-, mkDerivation
+, stdenv
 , makeDesktopItem
 , fetchurl
 , pkg-config
@@ -14,21 +14,24 @@
 , lua5
 , qtbase
 , texlive
+, wrapQtAppsHook
 , zlib
+, withTeXLive ? true
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "ipe";
-  version = "7.2.24";
+  version = "7.2.26";
 
   src = fetchurl {
     url = "https://github.com/otfried/ipe/releases/download/v${version}/ipe-${version}-src.tar.gz";
-    sha256 = "sha256-/rh58k0dziWRB5B3BEbVCwPkbuLr19KBV7FwWXFkT28=";
+    sha256 = "sha256-5J0AV5E6SlFrIBfwDZrbJnkDUoVZ0fDH669s2RQ1CqU=";
   };
+  patches = [
+    ./headers-lookup.patch
+  ];
 
-  sourceRoot = "${pname}-${version}/src";
-
-  nativeBuildInputs = [ pkg-config copyDesktopItems ];
+  nativeBuildInputs = [ pkg-config copyDesktopItems wrapQtAppsHook ];
 
   buildInputs = [
     cairo
@@ -40,15 +43,19 @@ mkDerivation rec {
     libspiro
     lua5
     qtbase
-    texlive
     zlib
+  ] ++ (lib.optionals withTeXLive [
+    texlive
+  ]);
+
+  makeFlags = [
+    "-C src"
+    "IPEPREFIX=${placeholder "out"}"
+    "LUA_PACKAGE=lua"
+    "IPE_NO_SPELLCHECK=1" # qtSpell is not yet packaged
   ];
 
-  IPEPREFIX = placeholder "out";
-  URWFONTDIR = "${texlive}/texmf-dist/fonts/type1/urw/";
-  LUA_PACKAGE = "lua";
-
-  qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ texlive ]}" ];
+  qtWrapperArgs = lib.optional withTeXLive [ "--prefix PATH : ${lib.makeBinPath [ texlive ]}" ];
 
   enableParallelBuilding = true;
 

pkgs/applications/graphics/ipe/headers-lookup.patch

@@ -0,0 +1,13 @@
+diff --git a/src/ipepresenter/Makefile b/src/ipepresenter/Makefile
+index ae3664e..f4f74ff 100644
+--- a/src/ipepresenter/Makefile
++++ b/src/ipepresenter/Makefile
+@@ -8,7 +8,7 @@ include ../common.mak
+ 
+ TARGET = $(call exe_target,ipepresenter)
+ 
+-CXXFLAGS += -I../include -I../ipecanvas -I../ipecairo \
++CPPFLAGS += -I../include -I../ipecanvas -I../ipecairo \
+ 	$(UI_CFLAGS) $(CAIRO_CFLAGS) $(ZLIB_CFLAGS)
+ LIBS += -L$(buildlib) -lipecanvas -lipecairo -lipe \
+ 	$(UI_LIBS) $(CAIRO_LIBS) $(ZLIB_LIBS)

pkgs/applications/graphics/yed/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "yEd";
-  version = "3.22";
+  version = "3.23.1";
 
   src = fetchzip {
     url = "https://www.yworks.com/resources/yed/demo/${pname}-${version}.zip";
-    sha256 = "sha256-GHYdvWie2k9YarS9DaA4bExswV3UQ26O8+7K/6yvtac=";
+    sha256 = "sha256-MboljULek5vCcHpRFL9kdT4AROTD774AOBYeOTzcdig=";
   };
 
   nativeBuildInputs = [ makeWrapper unzip wrapGAppsHook ];

pkgs/applications/misc/blender/default.nix

@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
       libharu
       libepoxy
     ]
-    ++ lib.optional (!stdenv.isAarch64) [
+    ++ lib.optionals (!stdenv.isAarch64) [
       openimagedenoise
       embree
     ]

pkgs/applications/misc/klipper-estimator/default.nix

@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs =
     [ openssl ]
-    ++ lib.optional stdenv.isDarwin [ libgit2 Security ];
+    ++ lib.optionals stdenv.isDarwin [ libgit2 Security ];
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -36,4 +36,3 @@ rustPlatform.buildRustPackage rec {
     maintainers = with maintainers; [ tmarkus ];
   };
 }
-

pkgs/applications/misc/octoprint/default.nix

@@ -1,5 +1,6 @@
 { pkgs
 , stdenv
+, callPackage
 , lib
 , fetchFromGitHub
 , python3
@@ -242,9 +243,10 @@ let
               ];
 
               passthru = {
-                python = self.python;
+                inherit (self) python;
                 updateScript = nix-update-script { };
                 tests = {
+                  plugins = (callPackage ./plugins.nix { }) super self;
                   inherit (nixosTests) octoprint;
                 };
               };
@@ -258,7 +260,7 @@ let
             };
           }
         )
-        (import ./plugins.nix { inherit pkgs; })
+        (callPackage ./plugins.nix { })
         packageOverrides
       ]
     );

pkgs/applications/misc/octoprint/plugins.nix

@@ -1,11 +1,15 @@
-{ pkgs }:
-
-with pkgs;
+{ lib
+, config
+, fetchFromGitHub
+, fetchFromGitLab
+, fetchpatch
+, marlin-calc
+}:
 
 self: super:
 let
   buildPlugin = args: self.buildPythonPackage (args // {
-    pname = "OctoPrintPlugin-${args.pname}";
+    pname = "octoprint-plugin-${args.pname}";
     inherit (args) version;
     propagatedBuildInputs = (args.propagatedBuildInputs or [ ]) ++ [ super.octoprint ];
     # none of the following have tests
@@ -16,7 +20,7 @@ in
   inherit buildPlugin;
 
   m86motorsoff = buildPlugin rec {
-    pname = "M84MotorsOff";
+    pname = "m84motorsoff";
     version = "0.1.0";
 
     src = fetchFromGitHub {
@@ -35,11 +39,13 @@ in
   };
 
   abl-expert = buildPlugin rec {
-    pname = "ABL_Expert";
+    pname = "abl-expert";
     version = "0.6";
 
-    src = fetchgit {
-      url = "https://framagit.org/razer/Octoprint_ABL_Expert/";
+    src = fetchFromGitLab {
+      domain = "framagit.org";
+      owner = "razer";
+      repo = "Octoprint_ABL_Expert";
       rev = version;
       sha256 = "0ij3rvdwya1sbymwm5swlh2j4jagb6fal945g88zrzh5xf26hzjh";
     };
@@ -53,12 +59,12 @@ in
   };
 
   bedlevelvisualizer = buildPlugin rec {
-    pname = "BedLevelVisualizer";
+    pname = "bedlevelvisualizer";
     version = "1.1.0";
 
     src = fetchFromGitHub {
       owner = "jneilliii";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-BedLevelVisualizer";
       rev = version;
       sha256 = "sha256-SKrhtTGyDuvbDmUCXSx83Y+C83ZzVHA78TwMYwE6tcc=";
     };
@@ -74,12 +80,12 @@ in
   };
 
   costestimation = buildPlugin rec {
-    pname = "CostEstimation";
+    pname = "costestimation";
     version = "3.4.0";
 
     src = fetchFromGitHub {
       owner = "OllisGit";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-CostEstimation";
       rev = version;
       sha256 = "sha256-04OPa/RpM8WehUmOp195ocsAjAvKdVY7iD5ybzQO7Dg=";
     };
@@ -93,12 +99,12 @@ in
   };
 
   curaenginelegacy = buildPlugin rec {
-    pname = "CuraEngineLegacy";
+    pname = "curaenginelegacy";
     version = "1.1.2";
 
     src = fetchFromGitHub {
       owner = "OctoPrint";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-CuraEngineLegacy";
       rev = version;
       sha256 = "sha256-54siSmzgPlnCRpkpZhXU9theNQ3hqL3j+Ip4Ie2w2vA=";
     };
@@ -112,12 +118,12 @@ in
   };
 
   displayprogress = buildPlugin rec {
-    pname = "DisplayProgress";
+    pname = "displayprogress";
     version = "0.1.3";
 
     src = fetchFromGitHub {
       owner = "OctoPrint";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-DisplayProgress";
       rev = version;
       sha256 = "080prvfwggl4vkzyi369vxh1n8231hrl8a44f399laqah3dn5qw4";
     };
@@ -131,12 +137,12 @@ in
   };
 
   displaylayerprogress = buildPlugin rec {
-    pname = "OctoPrint-DisplayLayerProgress";
+    pname = "displaylayerprogress";
     version = "1.26.0";
 
     src = fetchFromGitHub {
       owner = "OllisGit";
-      repo = pname;
+      repo = "OctoPrint-DisplayLayerProgress";
       rev = version;
       sha256 = "sha256-hhHc2SPixZCPJzCP8enMMWNYaYbNZAU0lNSx1B0d++4=";
     };
@@ -149,8 +155,8 @@ in
     };
   };
 
-  ender3v2tempfix = buildPlugin rec {
-    pname = "OctoPrintPlugin-ender3v2tempfix";
+  ender3v2tempfix = buildPlugin {
+    pname = "ender3v2tempfix";
     version = "unstable-2021-04-27";
 
     src = fetchFromGitHub {
@@ -169,12 +175,12 @@ in
   };
 
   gcodeeditor = buildPlugin rec {
-    pname = "GcodeEditor";
+    pname = "gcodeeditor";
     version = "0.2.12";
 
     src = fetchFromGitHub {
       owner = "ieatacid";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-GcodeEditor";
       rev = version;
       sha256 = "sha256-1Sk2ri3DKW8q8VJ/scFjpRsz65Pwt8OEURP1k70aydE=";
     };
@@ -188,12 +194,12 @@ in
   };
 
   marlingcodedocumentation = buildPlugin rec {
-    pname = "MarlinGcodeDocumentation";
+    pname = "marlingcodedocumentation";
     version = "0.13.0";
 
     src = fetchFromGitHub {
       owner = "costas-basdekis";
-      repo = pname;
+      repo = "MarlinGcodeDocumentation";
       rev = "v${version}";
       sha256 = "sha256-3ay6iCxZk8QkFM/2Y14VTpPoxr6NXq14BFSHofn3q7I=";
     };
@@ -207,7 +213,7 @@ in
   };
 
   mqtt = buildPlugin rec {
-    pname = "MQTT";
+    pname = "mqtt";
     version = "0.8.10";
 
     src = fetchFromGitHub {
@@ -228,12 +234,12 @@ in
   };
 
   printtimegenius = buildPlugin rec {
-    pname = "PrintTimeGenius";
+    pname = "printtimegenius";
     version = "2.2.8";
 
     src = fetchFromGitHub {
       owner = "eyal0";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-PrintTimeGenius";
       rev = version;
       sha256 = "sha256-Bbpm7y4flzEbUb6Sgkp6hIIHs455A0IsbmzvZwlkbh0=";
     };
@@ -246,7 +252,7 @@ in
     preConfigure = ''
       # PrintTimeGenius ships with marlin-calc binaries for multiple architectures
       rm */analyzers/marlin-calc*
-      sed 's@"{}.{}".format(binary_base_name, machine)@"${pkgs.marlin-calc}/bin/marlin-calc"@' -i */analyzers/analyze_progress.py
+      sed 's@"{}.{}".format(binary_base_name, machine)@"${marlin-calc}/bin/marlin-calc"@' -i */analyzers/analyze_progress.py
     '';
 
     meta = with lib; {
@@ -258,12 +264,12 @@ in
   };
 
   psucontrol = buildPlugin rec {
-    pname = "PSUControl";
+    pname = "psucontrol";
     version = "1.0.6";
 
     src = fetchFromGitHub {
       owner = "kantlivelong";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-PSUControl";
       rev = version;
       sha256 = "sha256-S+lPm85+ZEO/3BXYsrxE4FU29EGWzWrSw3y1DLdByrM=";
     };
@@ -286,12 +292,12 @@ in
   };
 
   simpleemergencystop = buildPlugin rec {
-    pname = "SimpleEmergencyStop";
+    pname = "simpleemergencystop";
     version = "1.0.5";
 
     src = fetchFromGitHub {
       owner = "Sebclem";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-SimpleEmergencyStop";
       rev = version;
       sha256 = "sha256-MbP3cKa9FPElQ/M8ykYh9kVXl8hNvmGiCHDvjgWvm9k=";
     };
@@ -305,7 +311,7 @@ in
   };
 
   stlviewer = buildPlugin rec {
-    pname = "STLViewer";
+    pname = "stlviewer";
     version = "0.4.2";
 
     src = fetchFromGitHub {
@@ -324,12 +330,12 @@ in
   };
 
   telegram = buildPlugin rec {
-    pname = "Telegram";
+    pname = "telegram";
     version = "1.6.5";
 
     src = fetchFromGitHub {
       owner = "fabianonline";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-Telegram";
       rev = version;
       sha256 = "sha256-SckJCbPNCflgGYLHFiXy0juCtpvo8YS1BQsFpc1f5rg=";
     };
@@ -345,14 +351,14 @@ in
   };
 
   themeify = buildPlugin rec {
-    pname = "Themeify";
+    pname = "themeify";
     version = "1.2.2";
 
     src = fetchFromGitHub {
       owner = "Birkbjo";
-      repo = "Octoprint-${pname}";
+      repo = "Octoprint-Themeify";
       rev = "v${version}";
-      sha256 = "0j1qs6kyh947npdy7pqda25fjkqinpas3sy0qyscqlxi558lhvx2";
+      sha256 = "sha256-om9IUSmxU8y0x8DrodW1EU/pilAN3+PbtYck6KfROEg=";
     };
 
     meta = with lib; {
@@ -364,7 +370,7 @@ in
   };
 
   titlestatus = buildPlugin rec {
-    pname = "TitleStatus";
+    pname = "titlestatus";
     version = "0.0.5";
 
     src = fetchFromGitHub {
@@ -383,12 +389,12 @@ in
   };
 
   touchui = buildPlugin rec {
-    pname = "TouchUI";
+    pname = "touchui";
     version = "0.3.18";
 
     src = fetchFromGitHub {
       owner = "BillyBlaze";
-      repo = "OctoPrint-${pname}";
+      repo = "OctoPrint-TouchUI";
       rev = version;
       sha256 = "sha256-PNDCjY7FhfnwK7Nd86el9ZQ00G4uMANH2Sk080iMYXw=";
     };
@@ -402,7 +408,7 @@ in
   };
 
   octoklipper = buildPlugin rec {
-    pname = "OctoKlipper";
+    pname = "octoklipper";
     version = "0.3.8.3";
 
     src = fetchFromGitHub {
@@ -421,36 +427,47 @@ in
   };
 
   octolapse = buildPlugin rec {
-    pname = "Octolapse";
-    version = "0.4.1";
+    pname = "octolapse";
+    version = "0.4.2";
 
     src = fetchFromGitHub {
       owner = "FormerLurker";
-      repo = pname;
+      repo = "Octolapse";
       rev = "v${version}";
-      sha256 = "13q20g7brabplc198jh67lk65rn140r8217iak9b2jy3in8fggv4";
+      sha256 = "sha256-QP6PkKWKUv4uIaYdqTAsZmK7DVes94Q9K/DrBYrWxzY=";
     };
 
+    patches = [
+      # fix version constraint
+      # https://github.com/FormerLurker/Octolapse/pull/894
+      (fetchpatch {
+        url = "https://github.com/FormerLurker/Octolapse/commit/0bd7db2430aef370f2665c6c7011fc3bb559122e.patch";
+        hash = "sha256-z2aEq5sJGarGtIDbTRCvXdSj+kq8HIVvLRWpKutmJNY=";
+      })
+    ];
+
     # Test fails due to code executed on import, see #136513
     #pythonImportsCheck = [ "octoprint_octolapse" ];
 
-    propagatedBuildInputs = with super; [ awesome-slugify setuptools pillow sarge six psutil file-read-backwards ];
+    propagatedBuildInputs = with super; [ awesome-slugify setuptools pillow sarge six pillow psutil file-read-backwards ];
 
     meta = with lib; {
       description = "Stabilized timelapses for Octoprint";
       homepage = "https://github.com/FormerLurker/OctoLapse";
       license = licenses.agpl3Plus;
       maintainers = with maintainers; [ illustris j0hax ];
+      # requires pillow >=6.2.0,<7.0.0
+      broken = true;
     };
   };
 
-  octoprint-dashboard = buildPlugin rec {
-    pname = "OctoPrint-Dashboard";
+  dashboard = buildPlugin rec {
+    pname = "dashboard";
     version = "1.18.3";
 
     src = fetchFromGitHub {
       owner = "StefanCohen";
-      repo = pname;
+      repo = "OctoPrint-Dashboard";
       rev = version;
       sha256 = "sha256-hLHT3Uze/6PlOCEICVZ2ieFTyXgcqCvgHOlIIEquujg=";
     };
@@ -462,4 +479,6 @@ in
       maintainers = with maintainers; [ j0hax ];
     };
   };
+} // lib.optionalAttrs config.allowAliases {
+  octoprint-dashboard = self.dashboard;
 }

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -3,10 +3,10 @@
 rec {
   firefox = buildMozillaMach rec {
     pname = "firefox";
-    version = "112.0";
+    version = "112.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "6b2bc8c0c93f3109da27168fe7e8f734c6ab4efb4ca56ff2d5e3a52659da71173bba2104037a000623833be8338621fca482f39f836e3910fe2996e6d0a68b39";
+      sha512 = "23a5cd9c1f165275d8ca7465bebce86018441c72292421f4ed56d7ad8ada9402dc8d22a08467d9d0ef3ef8c62338006dfa3bcbddf12cb8a59eafa0bd7d0cda50";
     };
 
     meta = {

pkgs/applications/networking/browsers/mullvad-browser/default.nix

@@ -210,10 +210,14 @@ stdenv.mkDerivation rec {
     runHook postBuild
   '';
 
-  postInstall = ''
+  installPhase = ''
+    runHook preInstall
+
     # Install distribution customizations
     install -Dvm644 ${distributionIni} $out/share/mullvad-browser/distribution/distribution.ini
     install -Dvm644 ${policiesJson} $out/share/mullvad-browser/distribution/policies.json
+
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix

@@ -31,7 +31,7 @@ buildGo120Package rec {
   '';
 
   doCheck = true;
-  checkFlags = "-skip TestSetSessionHandlers";
+  checkFlags = [ "-skip=TestSetSessionHandlers" ];
 
   preCheck = ''
     if ! [[ $(go/bin/sessionmanagerplugin-main --version) = ${lib.escapeShellArg version} ]]; then

pkgs/applications/networking/dnscontrol/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "3.31.0";
+  version = "3.31.1";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NwczSmaWzwZXKwnd7AvM758/E85lFWF3SvknOx9/tf0=";
+    sha256 = "sha256-T8fErChbQbarvE3/Zds1482m1hfD9Qa3esYvqjzNN3c=";
   };
 
   vendorHash = "sha256-BE/UnJw5elHYmyB+quN89ZkrlMcTjaVN0T2+h8cpPS8=";

pkgs/applications/networking/feedreaders/feed2imap-go/default.nix

@@ -0,0 +1,27 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "feed2imap-go";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "Necoro";
+    repo = "feed2imap-go";
+    rev = "v${version}";
+    sha256 = "sha256-zRp/MfRtCgzYFNKoV4IWbORfCy7vaaDgmRvNQ0cICNQ=";
+  };
+
+  vendorHash = "sha256-py0totvLLw3kahEtdZkES1t7tZsKBAUS6IMTcn847kE=";
+
+  # The print-cache tool is not an end-user tool (https://github.com/Necoro/feed2imap-go/issues/94)
+  postInstall = ''
+    rm -f $out/bin/print-cache
+  '';
+
+  meta = with lib; {
+    description = "Uploads rss feeds as e-mails onto an IMAP server";
+    homepage = "https://github.com/Necoro/feed2imap-go";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ nomeata ];
+  };
+}

pkgs/applications/networking/instant-messengers/teams-for-linux/default.nix

@@ -12,6 +12,7 @@
 , libpulseaudio
 , pipewire
 , alsa-utils
+, which
 }:
 
 stdenv.mkDerivation rec {
@@ -76,7 +77,7 @@ stdenv.mkDerivation rec {
     # Linux needs 'aplay' for notification sounds, 'libpulse' for meeting sound, and 'libpipewire' for screen sharing
     makeWrapper '${electron}/bin/electron' "$out/bin/teams-for-linux" \
       ${lib.optionalString stdenv.isLinux ''
-        --prefix PATH : ${lib.makeBinPath [ alsa-utils ]} \
+        --prefix PATH : ${lib.makeBinPath [ alsa-utils which ]} \
         --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio pipewire ]} \
       ''} \
       --add-flags "$out/share/teams-for-linux/app.asar" \

pkgs/applications/office/PageEdit/default.nix

@@ -1,7 +1,7 @@
-{ lib, mkDerivation, fetchFromGitHub, cmake, qtsvg, qtwebengine, qttranslations }:
+{ lib, stdenv, mkDerivation, fetchFromGitHub, cmake, qtsvg, qtwebengine, qttranslations, wrapQtAppsHook }:
 
-mkDerivation rec {
-  pname = "PageEdit";
+stdenv.mkDerivation rec {
+  pname = "pageedit";
   version = "1.9.20";
 
   src = fetchFromGitHub {
@@ -11,10 +11,21 @@ mkDerivation rec {
     hash = "sha256-naoflFANeMwabbdrNL3+ndvEXYT4Yqf+Mo77HcCexHE=";
   };
 
-  nativeBuildInputs = [ cmake qttranslations ];
+  nativeBuildInputs = [ cmake qttranslations wrapQtAppsHook ];
   propagatedBuildInputs = [ qtsvg qtwebengine ];
   cmakeFlags = [ "-DINSTALL_BUNDLED_DICTS=0" ];
 
+  installPhase =
+    if stdenv.isDarwin then ''
+      runHook preInstall
+
+      mkdir -p $out/Applications
+      cp -r bin/PageEdit.app $out/Applications
+      makeWrapper $out/Applications/PageEdit.app/Contents/MacOS/PageEdit $out/bin/pageedit
+
+      runHook postInstall
+    '' else null;
+
   meta = with lib; {
     description = "ePub XHTML Visual Editor";
     homepage = "https://sigil-ebook.com/pageedit/";

pkgs/applications/science/biology/blast/bin.nix

@@ -35,7 +35,7 @@ in
 stdenv.mkDerivation {
   inherit pname version src;
 
-  nativeBuildInputs = lib.optional stdenv.isLinux [ autoPatchelfHook ];
+  nativeBuildInputs = lib.optionals stdenv.isLinux [ autoPatchelfHook ];
 
   buildInputs = [ python3 perl ] ++ lib.optionals stdenv.isLinux [ zlib bzip2 glib libxml2 ];
 

pkgs/applications/science/biology/dssp/default.nix

@@ -1,19 +1,30 @@
-{ lib, stdenv, fetchFromGitHub, boost, cmake, libcifpp, zlib, }:
+{ lib, stdenv, fetchFromGitHub, cmake, libcifpp, libmcfp, zlib }:
+let
+  libcifpp' = libcifpp.overrideAttrs (oldAttrs:  rec {
+    # dssp 4.2.2.1 requires specific version "5.0.8" of libcifpp
+    version = "5.0.8";
+    src = fetchFromGitHub {
+      inherit (oldAttrs.src) owner repo;
+      rev = "v${version}";
+      sha256 = "sha256-KJGcopGhCWSl+ElG3BPJjBf/kvYJowOHxto6Ci1IMco=";
+    };
+  });
+in
 
 stdenv.mkDerivation rec {
   pname = "dssp";
-  version = "4.0.5";
+  version = "4.2.2.1";
 
   src = fetchFromGitHub {
     owner = "PDB-REDO";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1x35rdcm4fch66pjbmy73lv0gdb6g9y3v023a66512a6nzsqjsir";
+    sha256 = "sha256-vmGvC5d8LTo+pcY9sxwj0d6JvH8Lyk+QSOZo5raBci4=";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ boost libcifpp zlib ];
+  buildInputs = [ libcifpp' libmcfp zlib ];
 
   meta = with lib; {
     description = "Calculate the most likely secondary structure assignment given the 3D structure of a protein";

pkgs/applications/science/chemistry/jmol/default.nix

@@ -25,14 +25,14 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  version = "16.1.3";
+  version = "16.1.9";
   pname = "jmol";
 
   src = let
     baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
   in fetchurl {
     url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "sha256-k1F4OaER9vg8GIi4eqppeh2f0MtlcBSfd4zkewFp2As=";
+    hash = "sha256-QGduoUKWNUjNlMEYO0wD5+igjuF03V5SVlgq44d2HDs=";
   };
 
   patchPhase = ''

pkgs/applications/science/math/sage/patches/ipywidgets-on_submit-deprecationwarning.patch

@@ -1,13 +0,0 @@
-diff --git a/src/sage/interacts/library.py b/src/sage/interacts/library.py
-index 06d680109a..139b00bfd1 100644
---- a/src/sage/interacts/library.py
-+++ b/src/sage/interacts/library.py
-@@ -1434,6 +1434,8 @@ def riemann_sum(
-     creates the mathlet::
- 
-         sage: interacts.calculus.riemann_sum()
-+        ...
-+        DeprecationWarning: on_submit is deprecated. Instead, set the .continuous_update attribute to False and observe the value changing with: mywidget.observe(callback, 'value').
-         Manual interactive function <function riemann_sum at ...> with 9 widgets
-           title: HTMLText(value='<h2>Riemann integral with random sampling</h2>')
-           f: EvalText(value='x^2+1', description='$f(x)=$', layout=Layout(max_width='41em'))

pkgs/applications/science/math/sage/sage-src.nix

@@ -141,12 +141,23 @@ stdenv.mkDerivation rec {
       sha256 = "sha256-YdPnMsjXBm9ZRm6a8hH8rSynkrABjLoIzqwp3F/rKAw=";
     })
 
+    # https://github.com/sagemath/sage/pull/35336, merged in 10.0.beta8
+    (fetchpatch {
+      name = "ipywidgets-8.0.5-upgrade.patch";
+      url = "https://github.com/sagemath/sage/commit/7ab3e3aa81d47a35d09161b965bba8ab16fd5c9e.diff";
+      sha256 = "sha256-WjdsPTui6uv92RerlV0mqltmLaxADvz+3aqSvxBFmfU=";
+    })
+
+    # https://github.com/sagemath/sage/pull/35499
+    (fetchpatch {
+      name = "ipywidgets-8.0.5-upgrade-part-deux.patch";
+      url = "https://github.com/sagemath/sage/pull/35499.diff";
+      sha256 = "sha256-uNCjLs9qrARTQNsq1+kTdvuV2A1M4xx5b1gWh5c55X0=";
+    })
+
     # rebased from https://github.com/sagemath/sage/pull/34994, merged in sage 10.0.beta2
     ./patches/numpy-1.24-upgrade.patch
 
-    # temporarily paper over https://github.com/jupyter-widgets/ipywidgets/issues/3669
-    ./patches/ipywidgets-on_submit-deprecationwarning.patch
-
     # Sage uses mixed integer programs (MIPs) to find edge disjoint
     # spanning trees. For some reason, aarch64 glpk takes much longer
     # than x86_64 glpk to solve such MIPs. Since the MIP formulation

pkgs/applications/version-management/git-ignore/default.nix

@@ -1,36 +1,43 @@
-{ lib, stdenv, fetchFromGitHub, installShellFiles, rustPlatform, pkg-config, openssl, darwin }:
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, installShellFiles
+, stdenv
+, darwin
+}:
 
-with rustPlatform;
-
-buildRustPackage rec {
+rustPlatform.buildRustPackage rec {
   pname = "git-ignore";
-  version = "1.2.0";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "sondr3";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Bfr+4zDi6QqirlqccW1jU95eb4q82ZFG9LtT2mCPYLc=";
+    hash = "sha256-kIRuoY0dM2t+aY4iYdik9gUpG+81sDiJLD11Bmx68FI=";
   };
 
-  cargoSha256 = "sha256-ehEUI4M2IxqS6QhyqOncwP+w6IGbIlSFNIP/FEVH/JI=";
+  cargoHash = "sha256-6sb+OW5VtA6vY6fDtsaZePZD53ehH7QawxJJlUNsrnM=";
 
-  nativeBuildInputs = [ pkg-config installShellFiles ];
-  buildInputs = [ openssl ]
-  ++ lib.optionals stdenv.isDarwin [
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security
   ];
 
   postInstall = ''
-    installManPage assets/git-ignore.1
-    # There's also .elv and .ps1 completion files but I don't know where to install those
-    installShellCompletion assets/git-ignore.{bash,fish} --zsh assets/_git-ignore
+    assets=$releaseDir/../assets
+    installManPage $assets/git-ignore.1
+    installShellCompletion $assets/git-ignore.{bash,fish} --zsh $assets/_git-ignore
   '';
 
   meta = with lib; {
     description = "Quickly and easily fetch .gitignore templates from gitignore.io";
     homepage = "https://github.com/sondr3/git-ignore";
+    changelog = "https://github.com/sondr3/git-ignore/blob/${src.rev}/CHANGELOG.md";
     license = licenses.gpl3Plus;
-    maintainers = [ ];
+    maintainers = with maintainers; [ figsoda ];
   };
 }

pkgs/applications/version-management/mercurial/default.nix

@@ -21,11 +21,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.4.1";
+    version = "6.4.2";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-BbBZoMx/TnJhm+Vz56yunU15YU1HID0geNIXCsBH8K4=";
+      sha256 = "sha256-W59qPDX05GlchU73FCjPlGHKGlKfaRwG3G97SOe7MzU=";
     };
 
     format = "other";
@@ -35,7 +35,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-1enrXgQbf2aoBmM8WeAZg1259pR0OhdZnEB4Ax5k2K8=";
+      sha256 = "sha256-dRajIqM91fESEm4EEa9qvS8h6/HlLZIJZztVGoS/G+M=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;

pkgs/applications/virtualization/OVMF/default.nix

@@ -48,6 +48,8 @@ edk2.mkDerivation projectDscPath (finalAttrs: {
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Qunused-arguments";
 
+  env.PYTHON_COMMAND = "python3";
+
   postPatch = lib.optionalString csmSupport ''
     cp ${seabios}/Csm16.bin OvmfPkg/Csm/Csm16/Csm16.bin
   '';

pkgs/applications/virtualization/sail-riscv/default.nix

@@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitHub
+, fetchpatch
 , lib
 , arch
 , ocamlPackages
@@ -24,14 +25,24 @@ stdenv.mkDerivation rec {
   buildInputs = with ocamlPackages; [ zlib linksem ];
   strictDeps = true;
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/riscv/sail-riscv/pull/250/commits/8bd37c484b83a8ce89c8bb7a001b8ae34dc4d77f.patch";
+      hash = "sha256-tDgkGhcbT6phoCAvilxMI56YUuUqQFgvh+2QduOjdMg=";
+    })
+  ];
+
   postPatch = ''
     rm -r prover_snapshots
+  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace Makefile --replace "-flto" ""
   '';
 
   makeFlags = [
     "SAIL=sail"
     "ARCH=${arch}"
     "SAIL_DIR=${ocamlPackages.sail}/share/sail"
+    "LEM_DIR=${ocamlPackages.sail}/share/lem"
   ];
 
   installPhase = ''
@@ -50,6 +61,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/riscv/sail-riscv";
     description = "A formal specification of the RISC-V architecture, written in Sail";
     maintainers = with maintainers; [ genericnerdyusername ];
+    broken = stdenv.isDarwin && stdenv.isAarch64;
     license = licenses.bsd2;
   };
 }

pkgs/desktops/gnome/extensions/arcmenu/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-arcmenu";
-  version = "43";
+  version = "44";
 
   src = fetchFromGitLab {
     owner = "arcmenu";
     repo = "ArcMenu";
-    rev = "v${version}";
-    sha256 = "sha256-Mb3C2H7jq+zVcLjb0iaiIdO6zmU54vhuYxhN6oBCyP8=";
+    rev = "v44.1";
+    sha256 = "sha256-+aPBRxjL5lgdm96SbRZnp+9o9nl2N8Rb3dehMAv883c=";
   };
 
   patches = [

pkgs/desktops/gnome/extensions/arcmenu/fix_gmenu.patch

@@ -1,11 +1,10 @@
 --- a/extension.js
 +++ b/extension.js
-@@ -23,6 +23,8 @@
-
- const Me = imports.misc.extensionUtils.getCurrentExtension();
+@@ -20,6 +20,8 @@
+ const ExtensionUtils = imports.misc.extensionUtils;
+ const Me = ExtensionUtils.getCurrentExtension();
 
 +imports.gi.GIRepository.Repository.prepend_search_path('@gmenu_path@');
 +
- const {GLib, Gio, St} = imports.gi;
  const Constants = Me.imports.constants;
  const Controller = Me.imports.controller;

pkgs/desktops/gnome/extensions/pop-shell/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-pop-shell";
-  version = "unstable-2022-10-11";
+  version = "unstable-2023-04-05";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "shell";
-    rev = "886a069c0582b371e90ac3602b1747ea5fba616c";
-    hash = "sha256-DwJ3IFhYuEW0LQrmN/mOspEiudj4X5BCLhdOyP74EVs=";
+    rev = "a3a1b7bb832838fec2ea875954d33443fc680912";
+    hash = "sha256-B82UKtJRDDejBX1UBBIjPRO8rzHNapJRi8wv6dT7oJ8=";
   };
 
   nativeBuildInputs = [ glib nodePackages.typescript gjs ];

pkgs/desktops/lxqt/libfm-qt/default.nix

@@ -16,13 +16,13 @@
 
 mkDerivation rec {
   pname = "libfm-qt";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = "libfm-qt";
     rev = version;
-    sha256 = "CrCLwAdkSIhEKJtVJdtHvwEUNKhcvF22p3OOWOuxBAk=";
+    sha256 = "MK1QMYfr0T/cE46IUWarG9a/PJUSSskk1W3y2+kvEwg=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/liblxqt/default.nix

@@ -15,13 +15,13 @@
 
 mkDerivation rec {
   pname = "liblxqt";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "x1gzqmTHDnpAdLxacKyl+gDob1M7toTDUufaM0y+AHA=";
+    sha256 = "Ug6LmDxynSDLWykZhnih2F9lT34aOlU0ewM88PX+5Ms=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/libqtxdg/default.nix

@@ -10,13 +10,13 @@
 
 mkDerivation rec {
   pname = "libqtxdg";
-  version = "3.10.0";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "Lynm6Qxy02Os69YQ1cb2W0hV7sq9kBhbACqjHTGj7Tw=";
+    sha256 = "b3XR0Tn/roiCjNGb3EMf4ilECNaUjGYi11ykVBppBuc=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lximage-qt/default.nix

@@ -18,13 +18,13 @@
 
 mkDerivation rec {
   pname = "lximage-qt";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "T/LvxnHi0094wvxjB+6W7Ztg2lxkSu5yzjGx/jSzM8Y=";
+    sha256 = "afCW3VeXAq2HYc4fjSrd+7j6cGoHmGlO8jCiNq6/F3E=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-about/default.nix

@@ -14,13 +14,13 @@
 
 mkDerivation rec {
   pname = "lxqt-about";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "aOGbT8DwDAfp8odcOkNsZkuI/guSRbQnETii5o24jcU=";
+    sha256 = "Dm4WFtF0O7MgAvwYBI/1DkY9MhneI+QSM+wRp4JlD+o=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-admin/default.nix

@@ -15,13 +15,13 @@
 
 mkDerivation rec {
   pname = "lxqt-admin";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "0b6I45O4hUSnhP+IJJV8jesJgWpg3Y53TEaROhGQctY=";
+    sha256 = "glSxrSCr56lpdWca9q8hgnMcW22DNdsIyBzxPmQXQOY=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-archiver/default.nix

@@ -16,13 +16,13 @@
 
 mkDerivation rec {
   pname = "lxqt-archiver";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = "lxqt-archiver";
     rev = version;
-    sha256 = "aHN17sugIoH5UfbOn11mDofq2EY7KByYCWE5NJRJWbo=";
+    sha256 = "C38c/jCyRur7jQSgU2ByasCQnollHgy3/mUoNv61OCU=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-build-tools/default.nix

@@ -1,7 +1,5 @@
 { lib
-, stdenv
 , mkDerivation
-, fetchpatch
 , fetchFromGitHub
 , cmake
 , pkg-config
@@ -14,13 +12,13 @@
 
 mkDerivation rec {
   pname = "lxqt-build-tools";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "18+xSHBjYmtENGJuTf8yJh4C4QTNYttr8ucRU8KK1HU=";
+    sha256 = "4/hVlEdqqqd6CNitCRkIzsS1R941vPJdirIklp4acXA=";
   };
 
   postPatch = ''

pkgs/desktops/lxqt/lxqt-config/default.nix

@@ -21,26 +21,15 @@
 
 mkDerivation rec {
   pname = "lxqt-config";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "WgrcHM4iJLZsJO2obqSkjHHMB+/kcadQArkcXC5FB24=";
+    sha256 = "Gm/Y/5i7Abob9eRdLZHpRma2+Mdh2LBZUGKM4mMZMFk=";
   };
 
-  patches = [
-    # FIXME: backport Plasma 5.27 build fix, remove for next release
-    (fetchpatch {
-      url = "https://github.com/lxqt/lxqt-config/commit/6add4e4f0040693e7c4242fbae48c9d32007686c.diff";
-      hash = "sha256-Tir4KeGhBnD9dYmB1FAjuf4R4V+rn12MOxsRwTdE0Sc=";
-    })
-  ];
-
-  # FIXME: required to build with Plasma 5.27, which uses std::optional
-  cmakeFlags = ["-DCMAKE_CXX_STANDARD=17"];
-
   nativeBuildInputs = [
     cmake
     pkg-config

pkgs/desktops/lxqt/lxqt-globalkeys/default.nix

@@ -15,13 +15,13 @@
 
 mkDerivation rec {
   pname = "lxqt-globalkeys";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "GZ5E8OAx7Wb1bEwqwmYdOVcOXFaTxD1SibADgTWhdbg=";
+    sha256 = "lo5FG6+kQTm15MEh+CZO2DvywsLrmX4sKzs4Rka6GSo=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-notificationd/default.nix

@@ -15,13 +15,13 @@
 
 mkDerivation rec {
   pname = "lxqt-notificationd";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "RbOkMsz3jejoij/GnRbGuoA7vW4GTZxPnkIfbhq64qI=";
+    sha256 = "zfoTc+O8eYpUc13vzHUuk71q+MATNGEGtiYhQmFldtw=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-openssh-askpass/default.nix

@@ -15,13 +15,13 @@
 
 mkDerivation rec {
   pname = "lxqt-openssh-askpass";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "1uBgP4cOKypZZbMVYdvgM7GyZI2Ef3XmuAfs0nPzHd0=";
+    sha256 = "6S+x8Az9e7rZ8i5p6+F3PZjx7k8fJcM1b/55dJdkuOM=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-panel/default.nix

@@ -30,13 +30,13 @@
 
 mkDerivation rec {
   pname = "lxqt-panel";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "TwVM0JY+BMvw6e/mzy82AH5E6pPsffE6oadd0BuCZk0=";
+    sha256 = "tSj7GGIvneYapkyqqgSMJtPGApC1fdpiId2XgQF5xf0=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-policykit/default.nix

@@ -19,13 +19,13 @@
 
 mkDerivation rec {
   pname = "lxqt-policykit";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "SvJ4XN0JZs2VAt5H9CJXrJhThxnQnlbsLP44CW7zpGM=";
+    sha256 = "ZcftMdMBj/7OhxRZ34AB0IW5CfDYTT8JZLJejTb0XVg=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-powermanagement/default.nix

@@ -18,13 +18,13 @@
 
 mkDerivation rec {
   pname = "lxqt-powermanagement";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "yUQYvAWAsbaa2acwzIqnlFt5bsFLT63/RQdvWUsopqc=";
+    sha256 = "lnEi3Emwx3ykIx1ZlRMjRP3FAaYgIhsVpY9r0dT3DEE=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-qtplugin/default.nix

@@ -15,13 +15,13 @@
 
 mkDerivation rec {
   pname = "lxqt-qtplugin";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "oxETofSxje7fNEI8AahSUCaT+k/flfU6XJroMhtdiCw=";
+    sha256 = "/phBrpSru/4m+mcAkn4C6hKm5H2BAXNkbTgU2HmoyBg=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-runner/default.nix

@@ -20,13 +20,13 @@
 
 mkDerivation rec {
   pname = "lxqt-runner";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "fJHTw7xPn7rWVd+H1cDnNmeu3BPlE/ta0VOfJsUfSNs=";
+    sha256 = "iC0XTdgB1+hwMfc/45JiEfAhwadbFOgTTJj9Kvxx+l4=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-session/default.nix

@@ -20,13 +20,13 @@
 
 mkDerivation rec {
   pname = "lxqt-session";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "EmaMIoVouC1/B/WrLwynynx3F9A1Ae5kT3uhl5HVQg8=";
+    sha256 = "jhz1OHnPvjZMSo8+X/pf8rVLjPPSEiE7BDLnhUp/Vbk=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-sudo/default.nix

@@ -16,13 +16,13 @@
 
 mkDerivation rec {
   pname = "lxqt-sudo";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "oa6q85iPOrhou1ii7/CsdIWnf5VNkxs55QMtiQWRM2c=";
+    sha256 = "S+NWoF1l0HPOwceWwhfmGo7Xrm+6GeoMpJbGpK16rZs=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/lxqt-themes/default.nix

@@ -8,13 +8,13 @@
 
 mkDerivation rec {
   pname = "lxqt-themes";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "c7SGsnF2t2IrQFZODVmZS0ijJ7G1KiLWOLm7Rs2hehs=";
+    sha256 = "bmkvg62lNFRhSerKFSo2POP8MWa1ZrdSi2E9nWDQSRQ=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/pavucontrol-qt/default.nix

@@ -14,13 +14,13 @@
 
 mkDerivation rec {
   pname = "pavucontrol-qt";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "OCMdfwbvgjb+7IYDp/NKF/gI4luJGFfFRKZH64JsPP8=";
+    sha256 = "cXYJ9EMmZ1LHBvjRWM1TEv7ADdG69DTyb5DZN7q3NIQ=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/pcmanfm-qt/default.nix

@@ -17,13 +17,13 @@
 
 mkDerivation rec {
   pname = "pcmanfm-qt";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "HzA6+dOxXyeKrzYaR5Xwqj91rivc66ObjTLKHUay61A=";
+    sha256 = "qqvjsZRG+ImKHr+XLNNHhnAe1kBWh47/nFcKB1MTSJo=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,6 @@ mkDerivation rec {
     qtx11extras
     qtimageformats # add-on module to support more image file formats
     libfm-qt
-    libfm-qt
     menu-cache
     lxmenu-data
   ];

pkgs/desktops/lxqt/qps/default.nix

@@ -14,13 +14,13 @@
 
 mkDerivation rec {
   pname = "qps";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "A0JIZNNv/6lUlKnEp8MbBe+3lIQzyjqSPjlYcwbpENk=";
+    sha256 = "70mANEnui/orN+8eIBzCCSsh5wvPXuPUAAwRcXtHsaY=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/qterminal/default.nix

@@ -13,13 +13,13 @@
 
 mkDerivation rec {
   pname = "qterminal";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "7fsMJdObNjXSXfmS2TxXtbErnRCZCJZb7WitE6y1xjg=";
+    sha256 = "/R/fv8UAOeCVvXXBAXjturTTmN/LeqLKFJjAmEry2WU=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/qtermwidget/default.nix

@@ -11,13 +11,13 @@
 
 mkDerivation rec {
   pname = "qtermwidget";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "utQC0CNZtwHD0yAaV9Tr0iEUBa8DcrEMNKmWyuhj6GQ=";
+    sha256 = "eir9PvJXzAQYwRqoUf0Nc4SfkVGa7bohbJVdKPCoyNs=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/qtxdg-tools/default.nix

@@ -10,13 +10,13 @@
 
 mkDerivation rec {
   pname = "qtxdg-tools";
-  version = "3.10.0";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "sha256-8jrb1Mdn9dhQzIEu6E0kz5F8eEnKAREwjXuypqfhw60=";
+    sha256 = "sha256-iUvjLZbTDBsQw7PIA0LUAvhoq6FrdbLhjbMwKdE01Hc=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/screengrab/default.nix

@@ -17,13 +17,13 @@
 
 mkDerivation rec {
   pname = "screengrab";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "QEe1vOAeUDOlQfTh5/BvwBv9+v40NsuoMbC77+U6GCA=";
+    sha256 = "ySC5bCOnen2bjhmLY4GnwiFaUrvGx93LJrLQo0pBUc4=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lxqt/xdg-desktop-portal-lxqt/default.nix

@@ -12,13 +12,13 @@
 
 mkDerivation rec {
   pname = "xdg-desktop-portal-lxqt";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "lxqt";
     repo = pname;
     rev = version;
-    sha256 = "oEcFRBIYb/ZJQo9W+yIiq3l3eU1GqUzfDdF/Rvq5SKs=";
+    sha256 = "gH4L6cjx3DjGWcgoqUSnsx4Bn+T9t03AXPB5ZNDa0Nw=";
   };
 
   nativeBuildInputs = [

pkgs/development/compilers/crystal/build-package.nix

@@ -150,6 +150,9 @@ stdenv.mkDerivation (mkDerivationArgs // {
 
   installCheckPhase = args.installCheckPhase or ''
     for f in $out/bin/*; do
+      if [ $f == $out/bin/*.dwarf ]; then
+        continue
+      fi
       $f --help > /dev/null
     done
   '';

pkgs/development/compilers/crystal/default.nix

@@ -20,6 +20,7 @@
 , llvmPackages
 , makeWrapper
 , openssl
+, pcre2
 , pcre
 , pkg-config
 , readline
@@ -74,6 +75,7 @@ let
   commonBuildInputs = extraBuildInputs: [
     boehmgc
     pcre
+    pcre2
     libevent
     libyaml
     zlib
@@ -274,5 +276,11 @@ rec {
     binary = binaryCrystal_1_2;
   };
 
-  crystal = crystal_1_7;
+  crystal_1_8 = generic {
+    version = "1.8.0";
+    sha256 = "sha256-oTvBKrfDkrpJg4gaOVrrKWfsqZC+Z9Lp/jt4ye+Iw/M=";
+    binary = binaryCrystal_1_2;
+  };
+
+  crystal = crystal_1_8;
 }

pkgs/development/interpreters/perl/default.nix

@@ -1,264 +1,84 @@
-{ config, lib, stdenv, fetchurl, fetchFromGitHub, pkgs, buildPackages
-, callPackage
-, enableThreading ? true, coreutils, makeWrapper
-, enableCrypt ? true, libxcrypt ? null
-, zlib
-}:
-
-assert (enableCrypt -> (libxcrypt != null));
-
-# Note: this package is used for bootstrapping fetchurl, and thus
-# cannot use fetchpatch! All mutable patches (generated by GitHub or
-# cgit) that are needed here should be included directly in Nixpkgs as
-# files.
+{ callPackage }:
 
 let
+  # Common passthru for all perl interpreters.
+  # copied from lua
+  passthruFun =
+    { overrides
+    , perlOnBuildForBuild
+    , perlOnBuildForHost
+    , perlOnBuildForTarget
+    , perlOnHostForHost
+    , perlOnTargetForTarget
+    , perlAttr ? null
+    , self # is perlOnHostForTarget
+    }: let
+      perlPackages = callPackage
+        # Function that when called
+        # - imports perl-packages.nix
+        # - adds spliced package sets to the package set
+        ({ stdenv, pkgs, perl, callPackage, makeScopeWithSplicing }: let
+          perlPackagesFun = callPackage ../../../top-level/perl-packages.nix {
+            # allow 'perlPackages.override { pkgs = pkgs // { imagemagick = imagemagickBig; }; }' like in python3Packages
+            # most perl packages aren't called with callPackage so it's not possible to override their arguments individually
+            # the conditional is because the // above won't be applied to __splicedPackages and hopefully no one is doing that when cross-compiling
+            pkgs = if stdenv.buildPlatform != stdenv.hostPlatform then pkgs.__splicedPackages else pkgs;
+            inherit stdenv;
+            perl = self;
+          };
 
-  libc = if stdenv.cc.libc or null != null then stdenv.cc.libc else "/usr";
-  libcInc = lib.getDev libc;
-  libcLib = lib.getLib libc;
-  crossCompiling = stdenv.buildPlatform != stdenv.hostPlatform;
+          otherSplices = {
+            selfBuildBuild = perlOnBuildForBuild.pkgs;
+            selfBuildHost = perlOnBuildForHost.pkgs;
+            selfBuildTarget = perlOnBuildForTarget.pkgs;
+            selfHostHost = perlOnHostForHost.pkgs;
+            selfTargetTarget = perlOnTargetForTarget.pkgs or {};
+          };
+          keep = self: { };
+          extra = spliced0: {};
+        in makeScopeWithSplicing
+          otherSplices
+          keep
+          extra
+          perlPackagesFun)
+        {
+          perl = self;
+        };
+    in rec {
+        buildEnv = callPackage ./wrapper.nix {
+          perl = self;
+          inherit (pkgs) requiredPerlModules;
+        };
+        withPackages = f: buildEnv.override { extraLibs = f pkgs; };
+        pkgs = perlPackages // (overrides pkgs);
+        interpreter = "${self}/bin/perl";
+        libPrefix = "lib/perl5/site_perl";
+        perlOnBuild = perlOnBuildForHost.override { inherit overrides; self = perlOnBuild; };
+  };
 
-  common = { perl, buildPerl, version, sha256 }: stdenv.mkDerivation (rec {
-    inherit version;
-    pname = "perl";
-
-    src = fetchurl {
-      url = "mirror://cpan/src/5.0/perl-${version}.tar.gz";
-      inherit sha256;
-    };
-
-    strictDeps = true;
-    # TODO: Add a "dev" output containing the header files.
-    outputs = [ "out" "man" "devdoc" ] ++
-      lib.optional crossCompiling "mini";
-    setOutputFlags = false;
-
-    # On FreeBSD, if Perl is built with threads support, having
-    # libxcrypt available will result in a build failure, because
-    # perl.h will get conflicting definitions of struct crypt_data
-    # from libc's unistd.h and libxcrypt's crypt.h.
-    #
-    # FreeBSD Ports has the same issue building the perl port if
-    # the libxcrypt port has been installed.
-    #
-    # Without libxcrypt, Perl will still find FreeBSD's crypt functions.
-    propagatedBuildInputs = lib.optional (enableCrypt && !stdenv.isFreeBSD) libxcrypt;
-
-    disallowedReferences = [ stdenv.cc ];
-
-    patches =
-      [
-        # Do not look in /usr etc. for dependencies.
-        ./no-sys-dirs-5.31.patch
-
-        # Enable TLS/SSL verification in HTTP::Tiny by default
-        ./http-tiny-verify-ssl-by-default.patch
-      ]
-      ++ lib.optional stdenv.isSunOS ./ld-shared.patch
-      ++ lib.optionals stdenv.isDarwin [ ./cpp-precomp.patch ./sw_vers.patch ]
-      ++ lib.optional crossCompiling ./MakeMaker-cross.patch;
-
-    # This is not done for native builds because pwd may need to come from
-    # bootstrap tools when building bootstrap perl.
-    postPatch = (if crossCompiling then ''
-      substituteInPlace dist/PathTools/Cwd.pm \
-        --replace "/bin/pwd" '${coreutils}/bin/pwd'
-      substituteInPlace cnf/configure_tool.sh --replace "cc -E -P" "cc -E"
-    '' else ''
-      substituteInPlace dist/PathTools/Cwd.pm \
-        --replace "/bin/pwd" "$(type -P pwd)"
-    '') +
-    # Perl's build system uses the src variable, and its value may end up in
-    # the output in some cases (when cross-compiling)
-    ''
-      unset src
-    '';
-
-    # Build a thread-safe Perl with a dynamic libperl.so.  We need the
-    # "installstyle" option to ensure that modules are put under
-    # $out/lib/perl5 - this is the general default, but because $out
-    # contains the string "perl", Configure would select $out/lib.
-    # Miniperl needs -lm. perl needs -lrt.
-    configureFlags =
-      (if crossCompiling
-       then [ "-Dlibpth=\"\"" "-Dglibpth=\"\"" "-Ddefault_inc_excludes_dot" ]
-       else [ "-de" "-Dcc=cc" ])
-      ++ [
-        "-Uinstallusrbinperl"
-        "-Dinstallstyle=lib/perl5"
-      ] ++ lib.optional (!crossCompiling) "-Duseshrplib" ++ [
-        "-Dlocincpth=${libcInc}/include"
-        "-Dloclibpth=${libcLib}/lib"
-      ]
-      ++ lib.optionals ((builtins.match ''5\.[0-9]*[13579]\..+'' version) != null) [ "-Dusedevel" "-Uversiononly" ]
-      ++ lib.optional stdenv.isSunOS "-Dcc=gcc"
-      ++ lib.optional enableThreading "-Dusethreads"
-      ++ lib.optional (!enableCrypt) "-A clear:d_crypt_r"
-      ++ lib.optional stdenv.hostPlatform.isStatic "--all-static"
-      ++ lib.optionals (!crossCompiling) [
-        "-Dprefix=${placeholder "out"}"
-        "-Dman1dir=${placeholder "out"}/share/man/man1"
-        "-Dman3dir=${placeholder "out"}/share/man/man3"
-      ];
-
-    configureScript = lib.optionalString (!crossCompiling) "${stdenv.shell} ./Configure";
-
-    dontAddStaticConfigureFlags = true;
-
-    dontAddPrefix = !crossCompiling;
-
-    enableParallelBuilding = !crossCompiling;
-
-    # perl includes the build date, the uname of the build system and the
-    # username of the build user in some files.
-    # We override these to make it build deterministically.
-    # other distro solutions
-    # https://github.com/bmwiedemann/openSUSE/blob/master/packages/p/perl/perl-reproducible.patch
-    # https://github.com/archlinux/svntogit-packages/blob/packages/perl/trunk/config.over
-    # https://salsa.debian.org/perl-team/interpreter/perl/blob/debian-5.26/debian/config.over
-    # A ticket has been opened upstream to possibly clean some of this up: https://rt.perl.org/Public/Bug/Display.html?id=133452
-    preConfigure = ''
-        cat > config.over <<EOF
-        ${lib.optionalString (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) ''osvers="gnulinux"''}
-        myuname="nixpkgs"
-        myhostname="nixpkgs"
-        cf_by="nixpkgs"
-        cf_time="$(date -d "@$SOURCE_DATE_EPOCH")"
-        EOF
-
-        # Compress::Raw::Zlib should use our zlib package instead of the one
-        # included with the distribution
-        cat > ./cpan/Compress-Raw-Zlib/config.in <<EOF
-        BUILD_ZLIB   = False
-        INCLUDE      = ${zlib.dev}/include
-        LIB          = ${zlib.out}/lib
-        OLD_ZLIB     = False
-        GZIP_OS_CODE = AUTO_DETECT
-        EOF
-      '' + lib.optionalString stdenv.isDarwin ''
-        substituteInPlace hints/darwin.sh --replace "env MACOSX_DEPLOYMENT_TARGET=10.3" ""
-      '' + lib.optionalString (!enableThreading) ''
-        # We need to do this because the bootstrap doesn't have a static libpthread
-        sed -i 's,\(libswanted.*\)pthread,\1,g' Configure
-      '';
-
-    # Default perl does not support --host= & co.
-    configurePlatforms = [];
-
-    setupHook = ./setup-hook.sh;
-
-    passthru = rec {
-      interpreter = "${perl}/bin/perl";
-      libPrefix = "lib/perl5/site_perl";
-      pkgs = callPackage ../../../top-level/perl-packages.nix {
-        inherit perl buildPerl;
-        overrides = config.perlPackageOverrides or (p: {}); # TODO: (self: super: {}) like in python
-      };
-      buildEnv = callPackage ./wrapper.nix {
-        inherit perl;
-        inherit (pkgs) requiredPerlModules;
-      };
-      withPackages = f: buildEnv.override { extraLibs = f pkgs; };
-    };
-
-    doCheck = false; # some tests fail, expensive
-
-    # TODO: it seems like absolute paths to some coreutils is required.
-    postInstall =
-      ''
-        # Remove dependency between "out" and "man" outputs.
-        rm "$out"/lib/perl5/*/*/.packlist
-
-        # Remove dependencies on glibc and gcc
-        sed "/ *libpth =>/c    libpth => ' '," \
-          -i "$out"/lib/perl5/*/*/Config.pm
-        # TODO: removing those paths would be cleaner than overwriting with nonsense.
-        substituteInPlace "$out"/lib/perl5/*/*/Config_heavy.pl \
-          --replace "${libcInc}" /no-such-path \
-          --replace "${
-              if stdenv.hasCC then stdenv.cc.cc else "/no-such-path"
-            }" /no-such-path \
-          --replace "${stdenv.cc}" /no-such-path \
-          --replace "$man" /no-such-path
-      '' + lib.optionalString crossCompiling
-      ''
-        mkdir -p $mini/lib/perl5/cross_perl/${version}
-        for dir in cnf/{stub,cpan}; do
-          cp -r $dir/* $mini/lib/perl5/cross_perl/${version}
-        done
-
-        mkdir -p $mini/bin
-        install -m755 miniperl $mini/bin/perl
-
-        export runtimeArch="$(ls $out/lib/perl5/site_perl/${version})"
-        # wrapProgram should use a runtime-native SHELL by default, but
-        # it actually uses a buildtime-native one. If we ever fix that,
-        # we'll need to fix this to use a buildtime-native one.
-        #
-        # Adding the arch-specific directory is morally incorrect, as
-        # miniperl can't load the native modules there. However, it can
-        # (and sometimes needs to) load and run some of the pure perl
-        # code there, so we add it anyway. When needed, stubs can be put
-        # into $mini/lib/perl5/cross_perl/${version}.
-        wrapProgram $mini/bin/perl --prefix PERL5LIB : \
-          "$mini/lib/perl5/cross_perl/${version}:$out/lib/perl5/${version}:$out/lib/perl5/${version}/$runtimeArch"
-      ''; # */
-
-    meta = with lib; {
-      homepage = "https://www.perl.org/";
-      description = "The standard implementation of the Perl 5 programmming language";
-      license = licenses.artistic1;
-      maintainers = [ maintainers.eelco ];
-      platforms = platforms.all;
-      priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
-    };
-  } // lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "c876045741f5159318085d2737b0090f35a842ca"; # June 5, 2022
-
-    perl-cross-src = fetchFromGitHub {
-      name = "perl-cross-unstable-${crossVersion}";
-      owner = "arsv";
-      repo = "perl-cross";
-      rev = crossVersion;
-      sha256 = "sha256-m9UCoTQgXBxSgk9Q1Zv6wl3Qnd0aZm/jEPXkcMKti8U=";
-    };
-
-    depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
-
-    postUnpack = ''
-      unpackFile ${perl-cross-src}
-      chmod -R u+w ${perl-cross-src.name}
-      cp -R ${perl-cross-src.name}/* perl-${version}/
-    '';
-
-    configurePlatforms = [ "build" "host" "target" ];
-
-    # TODO merge setup hooks
-    setupHook = ./setup-hook-cross.sh;
-  });
-in {
+in rec {
   # Maint version
-  perl534 = common {
-    perl = pkgs.perl534;
-    buildPerl = buildPackages.perl534;
+  perl534 = callPackage ./intepreter.nix {
+    self = perl534;
     version = "5.34.1";
     sha256 = "sha256-NXlRpJGwuhzjYRJjki/ux4zNWB3dwkpEawM+JazyQqE=";
+    inherit passthruFun;
   };
 
   # Maint version
-  perl536 = common {
-    perl = pkgs.perl536;
-    buildPerl = buildPackages.perl536;
+  perl536 = callPackage ./intepreter.nix {
+    self = perl536;
     version = "5.36.0";
     sha256 = "sha256-4mCFr4rDlvYq3YpTPDoOqMhJfYNvBok0esWr17ek4Ao=";
+    inherit passthruFun;
   };
 
   # the latest Devel version
-  perldevel = common {
-    perl = pkgs.perldevel;
-    buildPerl = buildPackages.perldevel;
+  perldevel = callPackage ./intepreter.nix {
+    self = perldevel;
+    perlAttr = "perldevel";
     version = "5.37.0";
     sha256 = "sha256-8RQO6gtH+WmghqzRafbqAH1MhKv/vJCcvysi7/+T9XI=";
+    inherit passthruFun;
   };
 }

pkgs/development/interpreters/perl/intepreter.nix

@@ -0,0 +1,257 @@
+{ stdenv
+, fetchurl
+, fetchFromGitHub
+, buildPackages
+, lib
+, self
+, version
+, sha256
+, pkgsBuildBuild
+, pkgsBuildHost
+, pkgsBuildTarget
+, pkgsHostHost
+, pkgsTargetTarget
+, zlib
+, config
+, passthruFun
+, perlAttr ? "perl${lib.versions.major version}${lib.versions.minor version}"
+, enableThreading ? true, coreutils, makeWrapper
+, enableCrypt ? true, libxcrypt ? null
+, overrides ? config.perlPackageOverrides or (p: {}) # TODO: (self: super: {}) like in python
+} @ inputs:
+
+# Note: this package is used for bootstrapping fetchurl, and thus
+# cannot use fetchpatch! All mutable patches (generated by GitHub or
+# cgit) that are needed here should be included directly in Nixpkgs as
+# files.
+
+assert (enableCrypt -> (libxcrypt != null));
+
+let
+  crossCompiling = stdenv.buildPlatform != stdenv.hostPlatform;
+  libc = if stdenv.cc.libc or null != null then stdenv.cc.libc else "/usr";
+  libcInc = lib.getDev libc;
+  libcLib = lib.getLib libc;
+in
+
+stdenv.mkDerivation (rec {
+  inherit version;
+  pname = "perl";
+
+  src = fetchurl {
+    url = "mirror://cpan/src/5.0/perl-${version}.tar.gz";
+    inherit sha256;
+  };
+
+  strictDeps = true;
+  # TODO: Add a "dev" output containing the header files.
+  outputs = [ "out" "man" "devdoc" ] ++
+    lib.optional crossCompiling "mini";
+  setOutputFlags = false;
+
+  # On FreeBSD, if Perl is built with threads support, having
+  # libxcrypt available will result in a build failure, because
+  # perl.h will get conflicting definitions of struct crypt_data
+  # from libc's unistd.h and libxcrypt's crypt.h.
+  #
+  # FreeBSD Ports has the same issue building the perl port if
+  # the libxcrypt port has been installed.
+  #
+  # Without libxcrypt, Perl will still find FreeBSD's crypt functions.
+  propagatedBuildInputs = lib.optional (enableCrypt && !stdenv.isFreeBSD) libxcrypt;
+
+  disallowedReferences = [ stdenv.cc ];
+
+  patches =
+    [
+      # Do not look in /usr etc. for dependencies.
+      ./no-sys-dirs-5.31.patch
+
+      # Enable TLS/SSL verification in HTTP::Tiny by default
+      ./http-tiny-verify-ssl-by-default.patch
+    ]
+    ++ lib.optional stdenv.isSunOS ./ld-shared.patch
+    ++ lib.optionals stdenv.isDarwin [ ./cpp-precomp.patch ./sw_vers.patch ]
+    ++ lib.optional crossCompiling ./MakeMaker-cross.patch;
+
+  # This is not done for native builds because pwd may need to come from
+  # bootstrap tools when building bootstrap perl.
+  postPatch = (if crossCompiling then ''
+    substituteInPlace dist/PathTools/Cwd.pm \
+      --replace "/bin/pwd" '${coreutils}/bin/pwd'
+    substituteInPlace cnf/configure_tool.sh --replace "cc -E -P" "cc -E"
+  '' else ''
+    substituteInPlace dist/PathTools/Cwd.pm \
+      --replace "/bin/pwd" "$(type -P pwd)"
+  '') +
+  # Perl's build system uses the src variable, and its value may end up in
+  # the output in some cases (when cross-compiling)
+  ''
+    unset src
+  '';
+
+  # Build a thread-safe Perl with a dynamic libperl.so.  We need the
+  # "installstyle" option to ensure that modules are put under
+  # $out/lib/perl5 - this is the general default, but because $out
+  # contains the string "perl", Configure would select $out/lib.
+  # Miniperl needs -lm. perl needs -lrt.
+  configureFlags =
+    (if crossCompiling
+    then [ "-Dlibpth=\"\"" "-Dglibpth=\"\"" "-Ddefault_inc_excludes_dot" ]
+    else [ "-de" "-Dcc=cc" ])
+    ++ [
+      "-Uinstallusrbinperl"
+      "-Dinstallstyle=lib/perl5"
+    ] ++ lib.optional (!crossCompiling) "-Duseshrplib" ++ [
+      "-Dlocincpth=${libcInc}/include"
+      "-Dloclibpth=${libcLib}/lib"
+    ]
+    ++ lib.optionals ((builtins.match ''5\.[0-9]*[13579]\..+'' version) != null) [ "-Dusedevel" "-Uversiononly" ]
+    ++ lib.optional stdenv.isSunOS "-Dcc=gcc"
+    ++ lib.optional enableThreading "-Dusethreads"
+    ++ lib.optional (!enableCrypt) "-A clear:d_crypt_r"
+    ++ lib.optional stdenv.hostPlatform.isStatic "--all-static"
+    ++ lib.optionals (!crossCompiling) [
+      "-Dprefix=${placeholder "out"}"
+      "-Dman1dir=${placeholder "out"}/share/man/man1"
+      "-Dman3dir=${placeholder "out"}/share/man/man3"
+    ];
+
+  configureScript = lib.optionalString (!crossCompiling) "${stdenv.shell} ./Configure";
+
+  dontAddStaticConfigureFlags = true;
+
+  dontAddPrefix = !crossCompiling;
+
+  enableParallelBuilding = !crossCompiling;
+
+  # perl includes the build date, the uname of the build system and the
+  # username of the build user in some files.
+  # We override these to make it build deterministically.
+  # other distro solutions
+  # https://github.com/bmwiedemann/openSUSE/blob/master/packages/p/perl/perl-reproducible.patch
+  # https://github.com/archlinux/svntogit-packages/blob/packages/perl/trunk/config.over
+  # https://salsa.debian.org/perl-team/interpreter/perl/blob/debian-5.26/debian/config.over
+  # A ticket has been opened upstream to possibly clean some of this up: https://rt.perl.org/Public/Bug/Display.html?id=133452
+  preConfigure = ''
+    cat > config.over <<EOF
+    ${lib.optionalString (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu) ''osvers="gnulinux"''}
+    myuname="nixpkgs"
+    myhostname="nixpkgs"
+    cf_by="nixpkgs"
+    cf_time="$(date -d "@$SOURCE_DATE_EPOCH")"
+    EOF
+
+    # Compress::Raw::Zlib should use our zlib package instead of the one
+    # included with the distribution
+    cat > ./cpan/Compress-Raw-Zlib/config.in <<EOF
+    BUILD_ZLIB   = False
+    INCLUDE      = ${zlib.dev}/include
+    LIB          = ${zlib.out}/lib
+    OLD_ZLIB     = False
+    GZIP_OS_CODE = AUTO_DETECT
+    EOF
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace hints/darwin.sh --replace "env MACOSX_DEPLOYMENT_TARGET=10.3" ""
+  '' + lib.optionalString (!enableThreading) ''
+    # We need to do this because the bootstrap doesn't have a static libpthread
+    sed -i 's,\(libswanted.*\)pthread,\1,g' Configure
+  '';
+
+  # Default perl does not support --host= & co.
+  configurePlatforms = [ ];
+
+  setupHook = ./setup-hook.sh;
+
+  # copied from python
+  passthru =
+    let
+      # When we override the interpreter we also need to override the spliced versions of the interpreter
+      inputs' = lib.filterAttrs (n: v: ! lib.isDerivation v && n != "passthruFun") inputs;
+      override = attr: let perl = attr.override (inputs' // { self = perl; }); in perl;
+    in
+    passthruFun rec {
+      inherit self perlAttr;
+      inherit overrides;
+      perlOnBuildForBuild = override pkgsBuildBuild.${perlAttr};
+      perlOnBuildForHost = override pkgsBuildHost.${perlAttr};
+      perlOnBuildForTarget = override pkgsBuildTarget.${perlAttr};
+      perlOnHostForHost = override pkgsHostHost.${perlAttr};
+      perlOnTargetForTarget = if lib.hasAttr perlAttr pkgsTargetTarget then (override pkgsTargetTarget.${perlAttr}) else { };
+    };
+
+  doCheck = false; # some tests fail, expensive
+
+  # TODO: it seems like absolute paths to some coreutils is required.
+  postInstall =
+    ''
+      # Remove dependency between "out" and "man" outputs.
+      rm "$out"/lib/perl5/*/*/.packlist
+
+      # Remove dependencies on glibc and gcc
+      sed "/ *libpth =>/c    libpth => ' '," \
+        -i "$out"/lib/perl5/*/*/Config.pm
+      # TODO: removing those paths would be cleaner than overwriting with nonsense.
+      substituteInPlace "$out"/lib/perl5/*/*/Config_heavy.pl \
+        --replace "${libcInc}" /no-such-path \
+        --replace "${
+            if stdenv.hasCC then stdenv.cc.cc else "/no-such-path"
+          }" /no-such-path \
+        --replace "${stdenv.cc}" /no-such-path \
+        --replace "$man" /no-such-path
+    '' + lib.optionalString crossCompiling
+      ''
+        mkdir -p $mini/lib/perl5/cross_perl/${version}
+        for dir in cnf/{stub,cpan}; do
+          cp -r $dir/* $mini/lib/perl5/cross_perl/${version}
+        done
+
+        mkdir -p $mini/bin
+        install -m755 miniperl $mini/bin/perl
+
+        export runtimeArch="$(ls $out/lib/perl5/site_perl/${version})"
+        # wrapProgram should use a runtime-native SHELL by default, but
+        # it actually uses a buildtime-native one. If we ever fix that,
+        # we'll need to fix this to use a buildtime-native one.
+        #
+        # Adding the arch-specific directory is morally incorrect, as
+        # miniperl can't load the native modules there. However, it can
+        # (and sometimes needs to) load and run some of the pure perl
+        # code there, so we add it anyway. When needed, stubs can be put
+        # into $mini/lib/perl5/cross_perl/${version}.
+        wrapProgram $mini/bin/perl --prefix PERL5LIB : \
+          "$mini/lib/perl5/cross_perl/${version}:$out/lib/perl5/${version}:$out/lib/perl5/${version}/$runtimeArch"
+      ''; # */
+
+  meta = with lib; {
+    homepage = "https://www.perl.org/";
+    description = "The standard implementation of the Perl 5 programmming language";
+    license = licenses.artistic1;
+    maintainers = [ maintainers.eelco ];
+    platforms = platforms.all;
+    priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
+  };
+} // lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
+  crossVersion = "c876045741f5159318085d2737b0090f35a842ca"; # June 5, 2022
+
+  perl-cross-src = fetchFromGitHub {
+    name = "perl-cross-unstable-${crossVersion}";
+    owner = "arsv";
+    repo = "perl-cross";
+    rev = crossVersion;
+    sha256 = "sha256-m9UCoTQgXBxSgk9Q1Zv6wl3Qnd0aZm/jEPXkcMKti8U=";
+  };
+
+  depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
+
+  postUnpack = ''
+    unpackFile ${perl-cross-src}
+    chmod -R u+w ${perl-cross-src.name}
+    cp -R ${perl-cross-src.name}/* perl-${version}/
+  '';
+
+  configurePlatforms = [ "build" "host" "target" ];
+
+  # TODO merge setup hooks
+  setupHook = ./setup-hook-cross.sh;
+})

pkgs/development/interpreters/supercollider/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, mkDerivation, fetchurl, fetchpatch, cmake
+{ lib, stdenv, mkDerivation, fetchurl, cmake
 , pkg-config, alsa-lib, libjack2, libsndfile, fftw
 , curl, gcc, libXt, qtbase, qttools, qtwebengine
 , readline, qtwebsockets, useSCEL ? false, emacs
@@ -8,22 +8,16 @@
 
 mkDerivation rec {
   pname = "supercollider";
-  version = "3.12.2";
+  version = "3.13.0";
 
   src = fetchurl {
     url = "https://github.com/supercollider/supercollider/releases/download/Version-${version}/SuperCollider-${version}-Source.tar.bz2";
-    sha256 = "sha256-1QYorCgSwBK+SVAm4k7HZirr1j+znPmVicFmJdvO3g4=";
+    sha256 = "sha256-D8Xbpbrq43+Qaa0oiFqkBcaiUwnjiGy+ERvTt8BVMc4=";
   };
 
   patches = [
     # add support for SC_DATA_DIR and SC_PLUGIN_DIR env vars to override compile-time values
     ./supercollider-3.12.0-env-dirs.patch
-
-    # fix issue with libsndfile >=1.1.0
-    (fetchpatch {
-      url = "https://github.com/supercollider/supercollider/commit/b9dd70c4c8d61c93d7a70645e0bd18fa76e6834e.patch";
-      hash = "sha256-6FhEHyY0rnE6d7wC+v0U9K+L0aun5LkTqaEFhr3eQNw=";
-    })
   ];
 
   strictDeps = true;
@@ -72,6 +66,7 @@ mkDerivation rec {
   meta = with lib; {
     description = "Programming language for real time audio synthesis";
     homepage = "https://supercollider.github.io";
+    changelog = "https://github.com/supercollider/supercollider/blob/Version-${version}/CHANGELOG.md";
     maintainers = with maintainers; [ lilyinstarlight ];
     license = licenses.gpl3Plus;
     platforms = platforms.linux;

pkgs/development/libraries/appstream/default.nix

@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     itstool
     vala
     gperf
-  ] ++ lib.optional (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+  ] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     mesonEmulatorHook
   ];
 

pkgs/development/libraries/libcifpp/default.nix

@@ -1,19 +1,22 @@
-{ lib, stdenv, fetchFromGitHub, boost, cmake, }:
+{ lib, stdenv, fetchFromGitHub, boost, cmake, zlib }:
 
 stdenv.mkDerivation rec {
   pname = "libcifpp";
-  version = "4.2.2";
+  version = "5.0.8";
 
   src = fetchFromGitHub {
     owner = "PDB-REDO";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0mhplcpni4p8lavrq4fz9qq8mbxhvpnlxzy55yrz8y07d76ajg6y";
+    sha256 = "sha256-KJGcopGhCWSl+ElG3BPJjBf/kvYJowOHxto6Ci1IMco=";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ boost ];
+  # disable network access
+  cmakeFlags = [ "-DCIFPP_DOWNLOAD_CCD=OFF" ];
+
+  buildInputs = [ boost zlib ];
 
   meta = with lib; {
     description = "Manipulate mmCIF and PDB files";

pkgs/development/libraries/libmcfp/default.nix

@@ -0,0 +1,23 @@
+{ lib, stdenv, fetchFromGitHub, cmake }:
+
+stdenv.mkDerivation rec {
+  pname = "libmcfp";
+  version = "1.2.3";
+
+  src = fetchFromGitHub {
+    owner = "mhekkel";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-Mi5nj8vR1j3V7fIMBrSyhD57emmlkCb0F08+5s7Usj0=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "Header only library that can collect configuration options from command line arguments";
+    homepage = "https://github.com/mhekkel/libmcfp";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ natsukium ];
+    platforms = platforms.unix;
+  };
+}

pkgs/development/libraries/qt-6/default.nix

@@ -137,6 +137,9 @@ let
           GameController ImageCaptureCore LocalAuthentication
           MediaAccessibility MediaPlayer MetalKit Network OpenDirectory Quartz
           ReplayKit SecurityInterface Vision;
+        xcbuild = buildPackages.xcbuild.override {
+          productBuildVer = "20A2408";
+        };
       };
       qtwebsockets = callPackage ./modules/qtwebsockets.nix { };
       qtwebview = callPackage ./modules/qtwebview.nix {

pkgs/development/libraries/qt-6/modules/qtwebengine.nix

@@ -127,6 +127,12 @@ qtModule {
   # which cannot be set at the same time as -Wformat-security
   hardeningDisable = [ "format" ];
 
+  # removes macOS 12+ dependencies
+  patches = [
+    ../patches/qtwebengine-darwin-no-low-latency-flag.patch
+    ../patches/qtwebengine-darwin-no-copy-certificate-chain.patch
+  ];
+
   postPatch = ''
     # Patch Chromium build tools
     (
@@ -301,7 +307,8 @@ qtModule {
 
   meta = with lib; {
     description = "A web engine based on the Chromium web browser";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin && stdenv.isx86_64;
     # This build takes a long time; particularly on slow architectures
     # 1 hour on 32x3.6GHz -> maybe 12 hours on 4x2.4GHz
     timeout = 24 * 3600;