Merge master into haskell-updates

lib/licenses.nix

@@ -204,6 +204,11 @@ in mkLicense lset) ({
     free = false;
   };
 
+  caossl = {
+    fullName = "Computer Associates Open Source Licence Version 1.0";
+    url = "http://jxplorer.org/licence.html";
+  };
+
   cal10 = {
     fullName = "Cryptographic Autonomy License version 1.0 (CAL-1.0)";
     url = "https://opensource.org/licenses/CAL-1.0";
@@ -230,6 +235,12 @@ in mkLicense lset) ({
     free = false;
   };
 
+  cc-by-nc-nd-40 = {
+    spdxId = "CC-BY-NC-ND-4.0";
+    fullName = "Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International";
+    free = false;
+  };
+
   cc-by-nc-sa-20 = {
     spdxId = "CC-BY-NC-SA-2.0";
     fullName = "Creative Commons Attribution Non Commercial Share Alike 2.0";

maintainers/maintainer-list.nix

@@ -4957,6 +4957,12 @@
     githubId = 25955146;
     name = "eyJhb";
   };
+  f2k1de = {
+    name = "f2k1de";
+    email = "hi@f2k1.de";
+    github = "f2k1de";
+    githubId = 11199213;
+  };
   f4814n = {
     email = "me@f4814n.de";
     github = "f4814";

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -108,8 +108,12 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [vault-agent](https://developer.hashicorp.com/vault/docs/agent), a template rendering and API auth proxy for HashiCorp Vault, similar to `consul-template`. Available as [services.vault-agent](#opt-services.vault-agent.instances).
 
+- [trippy](https://github.com/fujiapple852/trippy), a network diagnostic tool. Available as [programs.trippy](#opt-programs.trippy.enable).
+
 - [v2rayA](https://v2raya.org), a Linux web GUI client of Project V which supports V2Ray, Xray, SS, SSR, Trojan and Pingtunnel. Available as [services.v2raya](options.html#opt-services.v2raya.enable).
 
+- [rshim](https://github.com/Mellanox/rshim-user-space), the user-space rshim driver for the BlueField SoC. Available as [services.rshim](options.html#opt-services.rshim.enable).
+
 - [wstunnel](https://github.com/erebe/wstunnel), a proxy tunnelling arbitrary TCP or UDP traffic through a WebSocket connection. Instances may be configured via [services.wstunnel](options.html#opt-services.wstunnel.enable).
 
 - [ulogd](https://www.netfilter.org/projects/ulogd/index.html), a userspace logging daemon for netfilter/iptables related logging. Available as [services.ulogd](options.html#opt-services.ulogd.enable).
@@ -124,6 +128,10 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [photoprism](https://photoprism.app/), a AI-Powered Photos App for the Decentralized Web. Available as [services.photoprism](options.html#opt-services.photoprism.enable).
 
+- [alice-lg](github.com/alice-lg/alice-lg), a looking-glass for BGP sessions. Available as [services.alice-lg](#opt-services.alice-lg.enable).
+
+- [birdwatcher](github.com/alice-lg/birdwatcher), a small HTTP server meant to provide an API defined by Barry O'Donovan's birds-eye to the BIRD internet routing daemon. Available as [services.birdwatcher](#opt-services.birdwatcher.enable).
+
 - [peroxide](https://github.com/ljanyst/peroxide), a fork of the official [ProtonMail bridge](https://github.com/ProtonMail/proton-bridge) that aims to be similar to [Hydroxide](https://github.com/emersion/hydroxide). Available as [services.peroxide](#opt-services.peroxide.enable).
 
 - [autosuspend](https://github.com/languitar/autosuspend), a python daemon that suspends a system if certain conditions are met, or not met.
@@ -174,6 +182,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `git-bug` has been updated to at least version 0.8.0, which includes backwards incompatible changes. The `git-bug-migration` package can be used to upgrade existing repositories.
 
+- `graylog` has been updated to version 5, which can not be upgraded directly from the previously packaged version 3.3. If you had installed the previously packaged version 3.3, please follow the [upgrade path](https://go2docs.graylog.org/5-0/upgrading_graylog/upgrade_path.htm) from 3.3 to 4.0 to 4.3 to 5.0.
+
 - `nushell` has been updated to at least version 0.77.0, which includes potential breaking changes in aliases. The old aliases are now available as `old-alias` but it is recommended you migrate to the new format. See [Reworked aliases](https://www.nushell.sh/blog/2023-03-14-nushell_0_77.html#reworked-aliases-breaking-changes-kubouch).
 
 - `keepassx` and `keepassx2` have been removed, due to upstream [stopping development](https://www.keepassx.org/index.html%3Fp=636.html). Consider [KeePassXC](https://keepassxc.org) as a maintained alternative.
@@ -189,6 +199,26 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `services.sourcehut.dispatch` and the corresponding package (`sourcehut.dispatchsrht`) have been removed due to [upstream deprecation](https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/).
 
+- The attributes used by `services.snapper.configs.<name>` have changed. Migrate from this:
+
+  ```nix
+  services.snapper.configs.example = {
+    subvolume = "/example";
+    extraConfig = ''
+      ALLOW_USERS="alice"
+    '';
+  };
+  ```
+
+  to this:
+
+  ```nix
+  services.snapper.configs.example = {
+    SUBVOLUME = "/example";
+    ALLOW_USERS = [ "alice" ];
+  };
+  ```
+
 - The [services.snapserver.openFirewall](#opt-services.snapserver.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall.
 
 - The [services.tmate-ssh-server.openFirewall](#opt-services.tmate-ssh-server.openFirewall) module option default value has been changed from `true` to `false`. You will need to explicitly set this option to `true`, or configure your firewall.
@@ -237,7 +267,6 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [`services.nextcloud.database.createLocally`](#opt-services.nextcloud.database.createLocally) now uses socket authentication and is no longer compatible with password authentication.
   - If you want the module to manage the database for you, unset [`services.nextcloud.config.dbpassFile`](#opt-services.nextcloud.config.dbpassFile) (and [`services.nextcloud.config.dbhost`](#opt-services.nextcloud.config.dbhost), if it's set).
-  - If your database is external, simply set [`services.nextcloud.database.createLocally`](#opt-services.nextcloud.database.createLocally) to `false`.
   - If you want to use password authentication **and** create the database locally, you will have to use [`services.mysql`](#opt-services.mysql.enable) to set it up.
 
 - `protonmail-bridge` package has been updated to major version 3.
@@ -350,7 +379,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `services.maddy` got several updates:
   - Configuration of users and their credentials using `services.maddy.ensureCredentials`.
-  - Configuration of TLS key and certificate files using `services.maddy.tls`.
+  - TLS configuration is now possible via `services.maddy.tls` with two loaders present: ACME and file based.
 
 - The `dnsmasq` service now takes configuration via the
   `services.dnsmasq.settings` attribute set. The option
@@ -405,6 +434,8 @@ In addition to numerous new and upgraded packages, this release has the followin
   }
   ```
 
+- New option `security.pam.zfs` to enable unlocking and mounting of encrypted ZFS home dataset at login.
+
 - `services.peertube` now requires you to specify the secret file `secrets.secretsFile`. It can be generated by running `openssl rand -hex 32`.
   Before upgrading, read the release notes for PeerTube:
     - [Release v5.0.0](https://github.com/Chocobozzz/PeerTube/releases/tag/v5.0.0)

nixos/lib/make-disk-image.nix

@@ -511,7 +511,7 @@ let format' = format; in let
     ${if format == "raw" then ''
       mv $diskImage $out/${filename}
     '' else ''
-      ${pkgs.qemu}/bin/qemu-img convert -f raw -O ${format} ${compress} $diskImage $out/${filename}
+      ${pkgs.qemu-utils}/bin/qemu-img convert -f raw -O ${format} ${compress} $diskImage $out/${filename}
     ''}
     diskImage=$out/${filename}
   '';

nixos/lib/make-multi-disk-zfs-image.nix

@@ -261,8 +261,8 @@ let
           mv $bootDiskImage $out/${bootFilename}
           mv $rootDiskImage $out/${rootFilename}
         '' else ''
-          ${pkgs.qemu}/bin/qemu-img convert -f raw -O ${formatOpt} ${compress} $bootDiskImage $out/${bootFilename}
-          ${pkgs.qemu}/bin/qemu-img convert -f raw -O ${formatOpt} ${compress} $rootDiskImage $out/${rootFilename}
+          ${pkgs.qemu_kvm}/bin/qemu-img convert -f raw -O ${formatOpt} ${compress} $bootDiskImage $out/${bootFilename}
+          ${pkgs.qemu_kvm}/bin/qemu-img convert -f raw -O ${formatOpt} ${compress} $rootDiskImage $out/${rootFilename}
         ''}
           bootDiskImage=$out/${bootFilename}
           rootDiskImage=$out/${rootFilename}

nixos/lib/make-single-disk-zfs-image.nix

@@ -244,7 +244,7 @@ let
             ${if formatOpt == "raw" then ''
             mv $rootDiskImage $out/${rootFilename}
           '' else ''
-            ${pkgs.qemu}/bin/qemu-img convert -f raw -O ${formatOpt} ${compress} $rootDiskImage $out/${rootFilename}
+            ${pkgs.qemu_kvm}/bin/qemu-img convert -f raw -O ${formatOpt} ${compress} $rootDiskImage $out/${rootFilename}
           ''}
             rootDiskImage=$out/${rootFilename}
             set -x

nixos/maintainers/scripts/ec2/amazon-image.nix

@@ -102,8 +102,8 @@ in {
        ${pkgs.jq}/bin/jq -n \
          --arg system_label ${lib.escapeShellArg config.system.nixos.label} \
          --arg system ${lib.escapeShellArg pkgs.stdenv.hostPlatform.system} \
-         --arg root_logical_bytes "$(${pkgs.qemu}/bin/qemu-img info --output json "$rootDisk" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
-         --arg boot_logical_bytes "$(${pkgs.qemu}/bin/qemu-img info --output json "$bootDisk" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
+         --arg root_logical_bytes "$(${pkgs.qemu_kvm}/bin/qemu-img info --output json "$rootDisk" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
+         --arg boot_logical_bytes "$(${pkgs.qemu_kvm}/bin/qemu-img info --output json "$bootDisk" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
          --arg boot_mode "${amiBootMode}" \
          --arg root "$rootDisk" \
          --arg boot "$bootDisk" \
@@ -142,7 +142,7 @@ in {
        ${pkgs.jq}/bin/jq -n \
          --arg system_label ${lib.escapeShellArg config.system.nixos.label} \
          --arg system ${lib.escapeShellArg pkgs.stdenv.hostPlatform.system} \
-         --arg logical_bytes "$(${pkgs.qemu}/bin/qemu-img info --output json "$diskImage" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
+         --arg logical_bytes "$(${pkgs.qemu_kvm}/bin/qemu-img info --output json "$diskImage" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
          --arg boot_mode "${amiBootMode}" \
          --arg file "$diskImage" \
           '{}

nixos/maintainers/scripts/openstack/openstack-image-zfs.nix

@@ -85,7 +85,7 @@ in
         ${pkgs.jq}/bin/jq -n \
           --arg system_label ${lib.escapeShellArg config.system.nixos.label} \
           --arg system ${lib.escapeShellArg pkgs.stdenv.hostPlatform.system} \
-          --arg root_logical_bytes "$(${pkgs.qemu}/bin/qemu-img info --output json "$rootDisk" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
+          --arg root_logical_bytes "$(${pkgs.qemu_kvm}/bin/qemu-img info --output json "$rootDisk" | ${pkgs.jq}/bin/jq '."virtual-size"')" \
           --arg boot_mode "${imageBootMode}" \
           --arg root "$rootDisk" \
          '{}

nixos/modules/module-list.nix

@@ -249,6 +249,7 @@
   ./programs/thunar.nix
   ./programs/tmux.nix
   ./programs/traceroute.nix
+  ./programs/trippy.nix
   ./programs/tsm-client.nix
   ./programs/turbovnc.nix
   ./programs/udevil.nix
@@ -688,6 +689,7 @@
   ./services/misc/ripple-data-api.nix
   ./services/misc/rippled.nix
   ./services/misc/rmfakecloud.nix
+  ./services/misc/rshim.nix
   ./services/misc/safeeyes.nix
   ./services/misc/sdrplay.nix
   ./services/misc/serviio.nix
@@ -805,6 +807,7 @@
   ./services/network-filesystems/yandex-disk.nix
   ./services/networking/3proxy.nix
   ./services/networking/adguardhome.nix
+  ./services/networking/alice-lg.nix
   ./services/networking/amuled.nix
   ./services/networking/antennas.nix
   ./services/networking/aria2.nix
@@ -819,6 +822,7 @@
   ./services/networking/bind.nix
   ./services/networking/bird-lg.nix
   ./services/networking/bird.nix
+  ./services/networking/birdwatcher.nix
   ./services/networking/bitcoind.nix
   ./services/networking/bitlbee.nix
   ./services/networking/blockbook-frontend.nix

nixos/modules/programs/trippy.nix

@@ -0,0 +1,24 @@
+{ lib, config, pkgs, ... }:
+
+let
+  cfg = config.programs.trippy;
+in
+
+{
+  options = {
+    programs.trippy = {
+      enable = lib.mkEnableOption (lib.mdDoc "trippy");
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    security.wrappers.trip = {
+      owner = "root";
+      group = "root";
+      capabilities = "cap_net_raw+p";
+      source = lib.getExe pkgs.trippy;
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ figsoda ];
+}

nixos/modules/security/acme/default.nix

@@ -323,7 +323,7 @@ let
             }
           fi
         '');
-      } // optionalAttrs (data.listenHTTP != null && toInt (elemAt (splitString ":" data.listenHTTP) 1) < 1024) {
+      } // optionalAttrs (data.listenHTTP != null && toInt (last (splitString ":" data.listenHTTP)) < 1024) {
         CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
         AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
       };

nixos/modules/security/pam.nix

@@ -446,6 +446,15 @@ let
         };
       };
 
+      zfs = mkOption {
+        default = config.security.pam.zfs.enable;
+        defaultText = literalExpression "config.security.pam.zfs.enable";
+        type = types.bool;
+        description = lib.mdDoc ''
+          Enable unlocking and mounting of encrypted ZFS home dataset at login.
+        '';
+      };
+
       text = mkOption {
         type = types.nullOr types.lines;
         description = lib.mdDoc "Contents of the PAM service file.";
@@ -556,7 +565,8 @@ let
               || cfg.googleAuthenticator.enable
               || cfg.gnupg.enable
               || cfg.failDelay.enable
-              || cfg.duoSecurity.enable))
+              || cfg.duoSecurity.enable
+              || cfg.zfs))
             (
               optionalString config.services.homed.enable ''
                 auth optional ${config.systemd.package}/lib/security/pam_systemd_home.so
@@ -570,6 +580,9 @@ let
               optionalString config.security.pam.enableFscrypt ''
                 auth optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so
               '' +
+              optionalString cfg.zfs ''
+                auth optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes}
+              '' +
               optionalString cfg.pamMount ''
                 auth optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive
               '' +
@@ -628,6 +641,9 @@ let
           optionalString config.security.pam.enableFscrypt ''
             password optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so
           '' +
+          optionalString cfg.zfs ''
+            password optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes}
+          '' +
           optionalString cfg.pamMount ''
             password optional ${pkgs.pam_mount}/lib/security/pam_mount.so
           '' +
@@ -685,6 +701,10 @@ let
             session [success=1 default=ignore] pam_succeed_if.so service = systemd-user
             session optional ${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so
           '' +
+          optionalString cfg.zfs ''
+            session [success=1 default=ignore] pam_succeed_if.so service = systemd-user
+            session optional ${config.boot.zfs.package}/lib/security/pam_zfs_key.so homes=${config.security.pam.zfs.homes} ${optionalString config.security.pam.zfs.noUnmount "nounmount"}
+          '' +
           optionalString cfg.pamMount ''
             session optional ${pkgs.pam_mount}/lib/security/pam_mount.so disable_interactive
           '' +
@@ -1202,6 +1222,34 @@ in
       };
     };
 
+    security.pam.zfs = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = lib.mdDoc ''
+          Enable unlocking and mounting of encrypted ZFS home dataset at login.
+        '';
+      };
+
+      homes = mkOption {
+        example = "rpool/home";
+        default = "rpool/home";
+        type = types.str;
+        description = lib.mdDoc ''
+          Prefix of home datasets. This value will be concatenated with
+          `"/" + <username>` in order to determine the home dataset to unlock.
+        '';
+      };
+
+      noUnmount = mkOption {
+        default = false;
+        type = types.bool;
+        description = lib.mdDoc ''
+          Do not unmount home dataset on logout.
+        '';
+      };
+    };
+
     security.pam.enableEcryptfs = mkEnableOption (lib.mdDoc "eCryptfs PAM module (mounting ecryptfs home directory on login)");
     security.pam.enableFscrypt = mkEnableOption (lib.mdDoc ''
       Enables fscrypt to automatically unlock directories with the user's login password.
@@ -1238,6 +1286,12 @@ in
           Only one of users.motd and users.motdFile can be set.
         '';
       }
+      {
+        assertion = config.security.pam.zfs.enable -> (config.boot.zfs.enabled || config.boot.zfs.enableUnstable);
+        message = ''
+          `security.pam.zfs.enable` requires enabling ZFS (`boot.zfs.enabled` or `boot.zfs.enableUnstable`).
+        '';
+      }
     ];
 
     environment.systemPackages =
@@ -1378,7 +1432,10 @@ in
         mr ${pkgs.plasma5Packages.kwallet-pam}/lib/security/pam_kwallet5.so,
       '' +
       optionalString config.virtualisation.lxc.lxcfs.enable ''
-        mr ${pkgs.lxc}/lib/security/pam_cgfs.so
+        mr ${pkgs.lxc}/lib/security/pam_cgfs.so,
+      '' +
+      optionalString (isEnabled (cfg: cfg.zfs)) ''
+        mr ${config.boot.zfs.package}/lib/security/pam_zfs_key.so,
       '' +
       optionalString config.services.homed.enable ''
         mr ${config.systemd.package}/lib/security/pam_systemd_home.so

nixos/modules/security/wrappers/default.nix

@@ -283,7 +283,7 @@ in
         '';
 
     ###### wrappers consistency checks
-    system.extraDependencies = lib.singleton (pkgs.runCommandLocal
+    system.checks = lib.singleton (pkgs.runCommandLocal
       "ensure-all-wrappers-paths-exist" { }
       ''
         # make sure we produce output

nixos/modules/services/backup/restic.nix

@@ -145,6 +145,7 @@ in
           type = types.attrsOf unitOption;
           default = {
             OnCalendar = "daily";
+            Persistent = true;
           };
           description = lib.mdDoc ''
             When to run the backup. See {manpage}`systemd.timer(5)` for details.
@@ -152,6 +153,7 @@ in
           example = {
             OnCalendar = "00:05";
             RandomizedDelaySec = "5h";
+            Persistent = true;
           };
         };
 

nixos/modules/services/databases/postgresql.nix

@@ -489,7 +489,7 @@ in
      "/share/postgresql"
     ];
 
-    system.extraDependencies = lib.optional (cfg.checkConfig && pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) configFileCheck;
+    system.checks = lib.optional (cfg.checkConfig && pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) configFileCheck;
 
     systemd.services.postgresql =
       { description = "PostgreSQL Server";

nixos/modules/services/hardware/keyd.nix

@@ -76,7 +76,9 @@ in
         ExecStart = "${pkgs.keyd}/bin/keyd";
         Restart = "always";
 
-        DynamicUser = true;
+        # TODO investigate why it doesn't work propeprly with DynamicUser
+        # See issue: https://github.com/NixOS/nixpkgs/issues/226346
+        # DynamicUser = true;
         SupplementaryGroups = [
           config.users.groups.input.name
           config.users.groups.uinput.name
@@ -96,6 +98,7 @@ in
         ProtectHostname = true;
         PrivateUsers = true;
         PrivateMounts = true;
+        PrivateTmp = true;
         RestrictNamespaces = true;
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
@@ -104,7 +107,18 @@ in
         MemoryDenyWriteExecute = true;
         RestrictRealtime = true;
         LockPersonality = true;
-        ProtectProc = "noaccess";
+        ProtectProc = "invisible";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        RestrictAddressFamilies = [ "AF_UNIX" ];
+        RestrictSUIDSGID = true;
+        IPAddressDeny = [ "any" ];
+        NoNewPrivileges = true;
+        ProtectSystem = "strict";
+        ProcSubset = "pid";
         UMask = "0077";
       };
     };

nixos/modules/services/logging/graylog.nix

@@ -37,8 +37,8 @@ in
 
       package = mkOption {
         type = types.package;
-        default = pkgs.graylog;
-        defaultText = literalExpression "pkgs.graylog";
+        default = if versionOlder config.system.stateVersion "23.05" then pkgs.graylog-3_3 else pkgs.graylog-5_0;
+        defaultText = literalExpression (if versionOlder config.system.stateVersion "23.05" then "pkgs.graylog-3_3" else "pkgs.graylog-5_0");
         description = lib.mdDoc "Graylog package to use.";
       };
 

nixos/modules/services/mail/maddy.nix

@@ -206,7 +206,7 @@ in {
           Server configuration, see
           [https://maddy.email](https://maddy.email) for
           more information. The default configuration of this module will setup
-          minimal maddy instance for mail transfer without TLS encryption.
+          minimal Maddy instance for mail transfer without TLS encryption.
 
           ::: {.note}
           This should not be used in a production environment.
@@ -216,13 +216,24 @@ in {
 
       tls = {
         loader = mkOption {
-          type = with types; nullOr (enum [ "file" "off" ]);
+          type = with types; nullOr (enum [ "off" "file" "acme" ]);
           default = "off";
           description = lib.mdDoc ''
             TLS certificates are obtained by modules called "certificate
-            loaders". Currently only the file loader is supported which reads
-            certificates from files specifying the options `keyPaths` and
-            `certPaths`.
+            loaders".
+
+            The `file` loader module reads certificates from files specified by
+            the `certificates` option.
+
+            Alternatively the `acme` module can be used to automatically obtain
+            certificates using the ACME protocol.
+
+            Module configuration is done via the `tls.extraConfig` option.
+
+            Secrets such as API keys or passwords should not be supplied in
+            plaintext. Instead the `secrets` option can be used to read secrets
+            at runtime as environment variables. Secrets can be referenced with
+            `{env:VAR}`.
           '';
         };
 
@@ -261,11 +272,13 @@ in {
         extraConfig = mkOption {
           type = with types; nullOr lines;
           description = lib.mdDoc ''
-            Arguments for the specific certificate loader. Note that Maddy uses
-            secure defaults for the TLS configuration so there is no need to
-            change anything in most cases.
-            See [upstream manual](https://maddy.email/reference/tls/) for
-            available options.
+            Arguments for the specified certificate loader.
+
+            In case the `tls` loader is set, the defaults are considered secure
+            and there is no need to change anything in most cases.
+            For available options see [upstream manual](https://maddy.email/reference/tls/).
+
+            For ACME configuration, see [following page](https://maddy.email/reference/tls-acme).
           '';
           default = "";
         };
@@ -321,20 +334,41 @@ in {
         });
       };
 
+      secrets = lib.mkOption {
+        type = lib.types.path;
+        description = lib.mdDoc ''
+          A file containing the various secrets. Should be in the format
+          expected by systemd's `EnvironmentFile` directory. Secrets can be
+          referenced in the format `{env:VAR}`.
+        '';
+      };
+
     };
   };
 
   config = mkIf cfg.enable {
 
-    assertions = [{
-      assertion = cfg.tls.loader == "file" -> cfg.tls.certificates != [];
-      message = ''
-        If maddy is configured to use TLS, tls.certificates with attribute sets
-        of certPath and keyPath must be provided.
-        Read more about obtaining TLS certificates here:
-        https://maddy.email/tutorials/setting-up/#tls-certificates
-      '';
-    }];
+    assertions = [
+      {
+        assertion = cfg.tls.loader == "file" -> cfg.tls.certificates != [];
+        message = ''
+          If Maddy is configured to use TLS, tls.certificates with attribute sets
+          of certPath and keyPath must be provided.
+          Read more about obtaining TLS certificates here:
+          https://maddy.email/tutorials/setting-up/#tls-certificates
+        '';
+      }
+      {
+        assertion = cfg.tls.loader == "acme" -> cfg.tls.extraConfig != "";
+        message = ''
+          If Maddy is configured to obtain TLS certificates using the ACME
+          loader, extra configuration options must be supplied via
+          tls.extraConfig option.
+          See upstream documentation for more details:
+          https://maddy.email/reference/tls-acme
+        '';
+      }
+    ];
 
     systemd = {
 
@@ -345,6 +379,7 @@ in {
             User = cfg.user;
             Group = cfg.group;
             StateDirectory = [ "maddy" ];
+            EnvironmentFile = lib.mkIf (cfg.secrets != null) "${cfg.secrets}";
           };
           restartTriggers = [ config.environment.etc."maddy/maddy.conf".source ];
           wantedBy = [ "multi-user.target" ];
@@ -391,6 +426,12 @@ in {
           ) cfg.tls.certificates)} ${optionalString (cfg.tls.extraConfig != "") ''
             { ${cfg.tls.extraConfig} }
           ''}
+        '' else if (cfg.tls.loader == "acme") then ''
+          tls {
+            loader acme {
+              ${cfg.tls.extraConfig}
+            }
+          }
         '' else if (cfg.tls.loader == "off") then ''
           tls off
         '' else ""}

nixos/modules/services/matrix/mjolnir.nix

@@ -30,7 +30,7 @@ let
 
   # these config files will be merged one after the other to build the final config
   configFiles = [
-    "${pkgs.mjolnir}/share/mjolnir/config/default.yaml"
+    "${pkgs.mjolnir}/libexec/mjolnir/deps/mjolnir/config/default.yaml"
     moduleConfigFile
   ];
 
@@ -200,7 +200,7 @@ in
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
-        ExecStart = ''${pkgs.mjolnir}/bin/mjolnir'';
+        ExecStart = ''${pkgs.mjolnir}/bin/mjolnir --mjolnir-config ./config/default.yaml'';
         ExecStartPre = [ generateConfig ];
         WorkingDirectory = cfg.dataPath;
         StateDirectory = "mjolnir";

nixos/modules/services/misc/etcd.nix

@@ -167,10 +167,11 @@ in {
         ETCD_LISTEN_CLIENT_URLS = concatStringsSep "," cfg.listenClientUrls;
         ETCD_LISTEN_PEER_URLS = concatStringsSep "," cfg.listenPeerUrls;
         ETCD_INITIAL_ADVERTISE_PEER_URLS = concatStringsSep "," cfg.initialAdvertisePeerUrls;
+        ETCD_PEER_CLIENT_CERT_AUTH = toString cfg.peerClientCertAuth;
         ETCD_PEER_TRUSTED_CA_FILE = cfg.peerTrustedCaFile;
         ETCD_PEER_CERT_FILE = cfg.peerCertFile;
         ETCD_PEER_KEY_FILE = cfg.peerKeyFile;
-        ETCD_CLIENT_CERT_AUTH = toString cfg.peerClientCertAuth;
+        ETCD_CLIENT_CERT_AUTH = toString cfg.clientCertAuth;
         ETCD_TRUSTED_CA_FILE = cfg.trustedCaFile;
         ETCD_CERT_FILE = cfg.certFile;
         ETCD_KEY_FILE = cfg.keyFile;

nixos/modules/services/misc/rshim.nix

@@ -0,0 +1,99 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.rshim;
+
+  rshimCommand = [ "${cfg.package}/bin/rshim" ]
+    ++ lib.optionals (cfg.backend != null) [ "--backend ${cfg.backend}" ]
+    ++ lib.optionals (cfg.device != null) [ "--device ${cfg.device}" ]
+    ++ lib.optionals (cfg.index != null) [ "--index ${builtins.toString cfg.index}" ]
+    ++ [ "--log-level ${builtins.toString cfg.log-level}" ]
+  ;
+in
+{
+  options.services.rshim = {
+    enable = lib.mkEnableOption (lib.mdDoc "User-space rshim driver for the BlueField SoC");
+
+    package = lib.mkPackageOptionMD pkgs "rshim-user-space" { };
+
+    backend = lib.mkOption {
+      type = with lib.types; nullOr (enum [ "usb" "pcie" "pcie_lf" ]);
+      description = lib.mdDoc ''
+        Specify the backend to attach. If not specified, the driver will scan
+        all rshim backends unless the `device` option is given with a device
+        name specified.
+      '';
+      default = null;
+      example = "pcie";
+    };
+
+    device = lib.mkOption {
+      type = with lib.types; nullOr str;
+      description = lib.mdDoc ''
+        Specify the device name to attach. The backend driver can be deduced
+        from the device name, thus the `backend` option is not needed.
+      '';
+      default = null;
+      example = "pcie-04:00.2";
+    };
+
+    index = lib.mkOption {
+      type = with lib.types; nullOr int;
+      description = lib.mdDoc ''
+        Specify the index to create device path `/dev/rshim<index>`. It's also
+        used to create network interface name `tmfifo_net<index>`. This option
+        is needed when multiple rshim instances are running.
+      '';
+      default = null;
+      example = 1;
+    };
+
+    log-level = lib.mkOption {
+      type = lib.types.int;
+      description = lib.mdDoc ''
+        Specify the log level (0:none, 1:error, 2:warning, 3:notice, 4:debug).
+      '';
+      default = 2;
+      example = 4;
+    };
+
+    config = lib.mkOption {
+      type = with lib.types; attrsOf (oneOf [ int str ]);
+      description = lib.mdDoc ''
+        Structural setting for the rshim configuration file
+        (`/etc/rshim.conf`). It can be used to specify the static mapping
+        between rshim devices and rshim names. It can also be used to ignore
+        some rshim devices.
+      '';
+      default = { };
+      example = {
+        DISPLAY_LEVEL = 0;
+        rshim0 = "usb-2-1.7";
+        none = "usb-1-1.4";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.etc = lib.mkIf (cfg.config != { }) {
+      "rshim.conf".text = lib.generators.toKeyValue
+        { mkKeyValue = lib.generators.mkKeyValueDefault { } " "; }
+        cfg.config;
+    };
+
+    systemd.services.rshim = {
+      after = [ "network.target" ];
+      serviceConfig = {
+        Restart = "always";
+        Type = "forking";
+        ExecStart = [
+          (lib.concatStringsSep " \\\n" rshimCommand)
+        ];
+        KillMode = "control-group";
+      };
+      wantedBy = [ "multi-user.target" ];
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ nikstur ];
+}

nixos/modules/services/misc/snapper.nix

@@ -4,6 +4,81 @@ with lib;
 
 let
   cfg = config.services.snapper;
+
+  mkValue = v:
+    if isList v then "\"${concatMapStringsSep " " (escape [ "\\" " " ]) v}\""
+    else if v == true then "yes"
+    else if v == false then "no"
+    else if isString v then "\"${v}\""
+    else builtins.toJSON v;
+
+  mkKeyValue = k: v: "${k}=${mkValue v}";
+
+  # "it's recommended to always specify the filesystem type"  -- man snapper-configs
+  defaultOf = k: if k == "FSTYPE" then null else configOptions.${k}.default or null;
+
+  safeStr = types.strMatching "[^\n\"]*" // {
+    description = "string without line breaks or quotes";
+    descriptionClass = "conjunction";
+  };
+
+  configOptions = {
+    SUBVOLUME = mkOption {
+      type = types.path;
+      description = lib.mdDoc ''
+        Path of the subvolume or mount point.
+        This path is a subvolume and has to contain a subvolume named
+        .snapshots.
+        See also man:snapper(8) section PERMISSIONS.
+      '';
+    };
+
+    FSTYPE = mkOption {
+      type = types.enum [ "btrfs" ];
+      default = "btrfs";
+      description = lib.mdDoc ''
+        Filesystem type. Only btrfs is stable and tested.
+      '';
+    };
+
+    ALLOW_GROUPS = mkOption {
+      type = types.listOf safeStr;
+      default = [];
+      description = lib.mdDoc ''
+        List of groups allowed to operate with the config.
+
+        Also see the PERMISSIONS section in man:snapper(8).
+      '';
+    };
+
+    ALLOW_USERS = mkOption {
+      type = types.listOf safeStr;
+      default = [];
+      example = [ "alice" ];
+      description = lib.mdDoc ''
+        List of users allowed to operate with the config. "root" is always
+        implicitly included.
+
+        Also see the PERMISSIONS section in man:snapper(8).
+      '';
+    };
+
+    TIMELINE_CLEANUP = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Defines whether the timeline cleanup algorithm should be run for the config.
+      '';
+    };
+
+    TIMELINE_CREATE = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Defines whether hourly snapshots should be created.
+      '';
+    };
+  };
 in
 
 {
@@ -52,49 +127,23 @@ in
       example = literalExpression ''
         {
           home = {
-            subvolume = "/home";
-            extraConfig = '''
-              ALLOW_USERS="alice"
-              TIMELINE_CREATE=yes
-              TIMELINE_CLEANUP=yes
-            ''';
+            SUBVOLUME = "/home";
+            ALLOW_USERS = [ "alice" ];
+            TIMELINE_CREATE = true;
+            TIMELINE_CLEANUP = true;
           };
         }
       '';
 
       description = lib.mdDoc ''
-        Subvolume configuration
+        Subvolume configuration. Any option mentioned in man:snapper-configs(5)
+        is valid here, even if NixOS doesn't document it.
       '';
 
       type = types.attrsOf (types.submodule {
-        options = {
-          subvolume = mkOption {
-            type = types.path;
-            description = lib.mdDoc ''
-              Path of the subvolume or mount point.
-              This path is a subvolume and has to contain a subvolume named
-              .snapshots.
-              See also man:snapper(8) section PERMISSIONS.
-            '';
-          };
+        freeformType = types.attrsOf (types.oneOf [ (types.listOf safeStr) types.bool safeStr types.number ]);
 
-          fstype = mkOption {
-            type = types.enum [ "btrfs" ];
-            default = "btrfs";
-            description = lib.mdDoc ''
-              Filesystem type. Only btrfs is stable and tested.
-            '';
-          };
-
-          extraConfig = mkOption {
-            type = types.lines;
-            default = "";
-            description = lib.mdDoc ''
-              Additional configuration next to SUBVOLUME and FSTYPE.
-              See man:snapper-configs(5).
-            '';
-          };
-        };
+        options = configOptions;
       });
     };
   };
@@ -117,11 +166,7 @@ in
 
       }
       // (mapAttrs' (name: subvolume: nameValuePair "snapper/configs/${name}" ({
-        text = ''
-          ${subvolume.extraConfig}
-          FSTYPE="${subvolume.fstype}"
-          SUBVOLUME="${subvolume.subvolume}"
-        '';
+        text = lib.generators.toKeyValue { inherit mkKeyValue; } (filterAttrs (k: v: v != defaultOf k) subvolume);
       })) cfg.configs)
       // (lib.optionalAttrs (cfg.filters != null) {
         "snapper/filters/default.txt".text = cfg.filters;
@@ -181,5 +226,28 @@ in
       unitConfig.ConditionPathExists = "/etc/snapper/configs/root";
     };
 
+    assertions =
+      concatMap
+        (name:
+          let
+            sub = cfg.configs.${name};
+          in
+          [ { assertion = !(sub ? extraConfig);
+              message = ''
+                The option definition `services.snapper.configs.${name}.extraConfig' no longer has any effect; please remove it.
+                The contents of this option should be migrated to attributes on `services.snapper.configs.${name}'.
+              '';
+            }
+          ] ++
+          map
+            (attr: {
+              assertion = !(hasAttr attr sub);
+              message = ''
+                The option definition `services.snapper.configs.${name}.${attr}' has been renamed to `services.snapper.configs.${name}.${toUpper attr}'.
+              '';
+            })
+            [ "fstype" "subvolume" ]
+        )
+        (attrNames cfg.configs);
   });
 }

nixos/modules/services/networking/alice-lg.nix

@@ -0,0 +1,101 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.alice-lg;
+  settingsFormat = pkgs.formats.ini { };
+in
+{
+  options = {
+    services.alice-lg = {
+      enable = mkEnableOption (lib.mdDoc "Alice Looking Glass");
+
+      package = mkPackageOptionMD pkgs "alice-lg" { };
+
+      settings = mkOption {
+        type = settingsFormat.type;
+        default = { };
+        description = lib.mdDoc ''
+          alice-lg configuration, for configuration options see the example on [github](https://github.com/alice-lg/alice-lg/blob/main/etc/alice-lg/alice.example.conf)
+        '';
+        example = literalExpression ''
+          {
+            server = {
+              # configures the built-in webserver and provides global application settings
+              listen_http = "127.0.0.1:7340";
+              enable_prefix_lookup = true;
+              asn = 9033;
+              store_backend = postgres;
+              routes_store_refresh_parallelism = 5;
+              neighbors_store_refresh_parallelism = 10000;
+              routes_store_refresh_interval = 5;
+              neighbors_store_refresh_interval = 5;
+            };
+            postgres = {
+              url = "postgres://postgres:postgres@localhost:5432/alice";
+              min_connections = 2;
+              max_connections = 128;
+            };
+            pagination = {
+              routes_filtered_page_size = 250;
+              routes_accepted_page_size = 250;
+              routes_not_exported_page_size = 250;
+            };
+          }
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment = {
+      etc."alice-lg/alice.conf".source = settingsFormat.generate "alice-lg.conf" cfg.settings;
+    };
+    systemd.services = {
+      alice-lg = {
+        wants = [ "network.target" ];
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        description = "Alice Looking Glass";
+        serviceConfig = {
+          DynamicUser = true;
+          Type = "simple";
+          Restart = "on-failure";
+          RestartSec = 15;
+          ExecStart = "${cfg.package}/bin/alice-lg";
+          StateDirectoryMode = "0700";
+          UMask = "0007";
+          CapabilityBoundingSet = "";
+          NoNewPrivileges = true;
+          ProtectSystem = "strict";
+          PrivateTmp = true;
+          PrivateDevices = true;
+          PrivateUsers = true;
+          ProtectHostname = true;
+          ProtectClock = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          RestrictAddressFamilies = [ "AF_INET AF_INET6" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          PrivateMounts = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
+          BindReadOnlyPaths = [
+            "-/etc/resolv.conf"
+            "-/etc/nsswitch.conf"
+            "-/etc/ssl/certs"
+            "-/etc/static/ssl/certs"
+            "-/etc/hosts"
+            "-/etc/localtime"
+          ];
+        };
+      };
+    };
+  };
+}

nixos/modules/services/networking/birdwatcher.nix

@@ -0,0 +1,129 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.birdwatcher;
+in
+{
+  options = {
+    services.birdwatcher = {
+      package = mkOption {
+        type = types.package;
+        default = pkgs.birdwatcher;
+        defaultText = literalExpression "pkgs.birdwatcher";
+        description = lib.mdDoc "The Birdwatcher package to use.";
+      };
+      enable = mkEnableOption (lib.mdDoc "Birdwatcher");
+      flags = mkOption {
+        default = [ ];
+        type = types.listOf types.str;
+        example = [ "-worker-pool-size 16" "-6" ];
+        description = lib.mdDoc ''
+          Flags to append to the program call
+        '';
+      };
+
+      settings = mkOption {
+        type = types.lines;
+        default = { };
+        description = lib.mdDoc ''
+          birdwatcher configuration, for configuration options see the example on [github](https://github.com/alice-lg/birdwatcher/blob/master/etc/birdwatcher/birdwatcher.conf)
+        '';
+        example = literalExpression ''
+          [server]
+          allow_from = []
+          allow_uncached = false
+          modules_enabled = ["status",
+                             "protocols",
+                             "protocols_bgp",
+                             "protocols_short",
+                             "routes_protocol",
+                             "routes_peer",
+                             "routes_table",
+                             "routes_table_filtered",
+                             "routes_table_peer",
+                             "routes_filtered",
+                             "routes_prefixed",
+                             "routes_noexport",
+                             "routes_pipe_filtered_count",
+                             "routes_pipe_filtered"
+                            ]
+
+          [status]
+          reconfig_timestamp_source = "bird"
+          reconfig_timestamp_match = "# created: (.*)"
+
+          filter_fields = []
+
+          [bird]
+          listen = "0.0.0.0:29184"
+          config = "/etc/bird/bird2.conf"
+          birdc  = "''${pkgs.bird}/bin/birdc"
+          ttl = 5 # time to live (in minutes) for caching of cli output
+
+          [parser]
+          filter_fields = []
+
+          [cache]
+          use_redis = false # if not using redis cache, activate housekeeping to save memory!
+
+          [housekeeping]
+          interval = 5
+          force_release_memory = true
+        '';
+      };
+    };
+  };
+
+  config =
+    let flagsStr = escapeShellArgs cfg.flags;
+    in lib.mkIf cfg.enable {
+      environment.etc."birdwatcher/birdwatcher.conf".source = pkgs.writeTextFile {
+        name = "birdwatcher.conf";
+        text = cfg.settings;
+      };
+      systemd.services = {
+        birdwatcher = {
+          wants = [ "network.target" ];
+          after = [ "network.target" ];
+          wantedBy = [ "multi-user.target" ];
+          description = "Birdwatcher";
+          serviceConfig = {
+            Type = "simple";
+            Restart = "on-failure";
+            RestartSec = 15;
+            ExecStart = "${cfg.package}/bin/birdwatcher";
+            StateDirectoryMode = "0700";
+            UMask = "0117";
+            NoNewPrivileges = true;
+            ProtectSystem = "strict";
+            PrivateTmp = true;
+            PrivateDevices = true;
+            ProtectHostname = true;
+            ProtectClock = true;
+            ProtectKernelTunables = true;
+            ProtectKernelModules = true;
+            ProtectKernelLogs = true;
+            ProtectControlGroups = true;
+            RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
+            LockPersonality = true;
+            MemoryDenyWriteExecute = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            PrivateMounts = true;
+            SystemCallArchitectures = "native";
+            SystemCallFilter = "~@clock @privileged @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
+            BindReadOnlyPaths = [
+              "-/etc/resolv.conf"
+              "-/etc/nsswitch.conf"
+              "-/etc/ssl/certs"
+              "-/etc/static/ssl/certs"
+              "-/etc/hosts"
+              "-/etc/localtime"
+            ];
+          };
+        };
+      };
+    };
+}

nixos/modules/services/web-apps/nextcloud.md

@@ -17,11 +17,12 @@ and optionally supports
 
 For the database, you can set
 [`services.nextcloud.config.dbtype`](#opt-services.nextcloud.config.dbtype) to
-either `sqlite` (the default), `mysql`, or `pgsql`. For the last two, by
-default, a local database will be created and nextcloud will connect to it via
-socket; this can be disabled by setting
+either `sqlite` (the default), `mysql`, or `pgsql`. The simplest is `sqlite`,
+which will be automatically created and managed by the application. For the
+last two, you can easily create a local database by setting
 [`services.nextcloud.database.createLocally`](#opt-services.nextcloud.database.createLocally)
-to `false`.
+to `true`, Nextcloud will automatically be configured to connect to it through
+socket.
 
 A very basic configuration may look like this:
 ```
@@ -30,6 +31,7 @@ A very basic configuration may look like this:
   services.nextcloud = {
     enable = true;
     hostName = "nextcloud.tld";
+    database.createLocally = true;
     config = {
       dbtype = "pgsql";
       adminpassFile = "/path/to/admin-pass-file";

nixos/modules/services/web-apps/nextcloud.nix

@@ -317,7 +317,7 @@ in {
 
       createLocally = mkOption {
         type = types.bool;
-        default = true;
+        default = false;
         description = lib.mdDoc ''
           Create the database and database user locally.
         '';
@@ -754,9 +754,8 @@ in {
     { assertions = [
       { assertion = cfg.database.createLocally -> cfg.config.dbpassFile == null;
         message = ''
-          Using `services.nextcloud.database.createLocally` (that now defaults
-          to true) with database password authentication is no longer
-          supported.
+          Using `services.nextcloud.database.createLocally` with database
+          password authentication is no longer supported.
 
           If you use an external database (or want to use password auth for any
           other reason), set `services.nextcloud.database.createLocally` to

nixos/modules/services/web-apps/vikunja.nix

@@ -56,6 +56,11 @@ in {
       type = types.str;
       description = lib.mdDoc "The Hostname under which the frontend is running.";
     };
+    port = mkOption {
+      type = types.port;
+      default = 3456;
+      description = lib.mdDoc "The TCP port exposed by the API.";
+    };
 
     settings = mkOption {
       type = format.type;
@@ -101,6 +106,7 @@ in {
         inherit (cfg.database) type host user database path;
       };
       service = {
+        interface = ":${toString cfg.port}";
         frontendurl = "${cfg.frontendScheme}://${cfg.frontendHostname}/";
       };
       files = {
@@ -132,7 +138,7 @@ in {
           tryFiles = "try_files $uri $uri/ /";
         };
         "~* ^/(api|dav|\\.well-known)/" = {
-          proxyPass = "http://localhost:3456";
+          proxyPass = "http://localhost:${toString cfg.port}";
           extraConfig = ''
             client_max_body_size 20M;
           '';

nixos/modules/services/web-servers/varnish/default.nix

@@ -99,7 +99,7 @@ in
     environment.systemPackages = [ cfg.package ];
 
     # check .vcl syntax at compile time (e.g. before nixops deployment)
-    system.extraDependencies = mkIf cfg.enableConfigCheck [
+    system.checks = mkIf cfg.enableConfigCheck [
       (pkgs.runCommand "check-varnish-syntax" {} ''
         ${cfg.package}/bin/varnishd -C ${commandLine} 2> $out || (cat $out; exit 1)
       '')

nixos/modules/services/x11/xserver.nix

@@ -776,7 +776,7 @@ in
         xorg.xf86inputevdev.out
       ];
 
-    system.extraDependencies = singleton (pkgs.runCommand "xkb-validated" {
+    system.checks = singleton (pkgs.runCommand "xkb-validated" {
       inherit (cfg) xkbModel layout xkbVariant xkbOptions;
       nativeBuildInputs = with pkgs.buildPackages; [ xkbvalidate ];
       preferLocalBuild = true;

nixos/modules/system/activation/top-level.nix

@@ -263,8 +263,23 @@ in
       default = [];
       description = lib.mdDoc ''
         A list of packages that should be included in the system
-        closure but not otherwise made available to users. This is
-        primarily used by the installation tests.
+        closure but generally not visible to users.
+
+        This option has also been used for build-time checks, but the
+        `system.checks` option is more appropriate for that purpose as checks
+        should not leave a trace in the built system configuration.
+      '';
+    };
+
+    system.checks = mkOption {
+      type = types.listOf types.package;
+      default = [];
+      description = lib.mdDoc ''
+        Packages that are added as dependencies of the system's build, usually
+        for the purpose of validating some part of the configuration.
+
+        Unlike `system.extraDependencies`, these store paths do not
+        become part of the built system configuration.
       '';
     };
 
@@ -363,7 +378,17 @@ in
           fi
         '';
 
-    system.systemBuilderArgs = lib.optionalAttrs (config.system.forbiddenDependenciesRegex != "") {
+    system.systemBuilderArgs = {
+      # Not actually used in the builder. `passedChecks` is just here to create
+      # the build dependencies. Checks are similar to build dependencies in the
+      # sense that if they fail, the system build fails. However, checks do not
+      # produce any output of value, so they are not used by the system builder.
+      # In fact, using them runs the risk of accidentally adding unneeded paths
+      # to the system closure, which defeats the purpose of the `system.checks`
+      # option, as opposed to `system.extraDependencies`.
+      passedChecks = concatStringsSep " " config.system.checks;
+    }
+    // lib.optionalAttrs (config.system.forbiddenDependenciesRegex != "") {
       inherit (config.system) forbiddenDependenciesRegex;
       closureInfo = pkgs.closureInfo { rootPaths = [
         # override to avoid  infinite recursion (and to allow using extraDependencies to add forbidden dependencies)
@@ -371,6 +396,7 @@ in
       ]; };
     };
 
+
     system.build.toplevel = if config.system.includeBuildDependencies then systemWithBuildDeps else system;
 
   };

nixos/tests/alice-lg.nix

@@ -0,0 +1,44 @@
+# This test does a basic functionality check for alice-lg
+
+{ system ? builtins.currentSystem
+, pkgs ? import ../.. { inherit system; config = { }; }
+}:
+
+let
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+  inherit (pkgs.lib) optionalString;
+in
+makeTest {
+  name = "birdwatcher";
+  nodes = {
+    host1 = {
+      environment.systemPackages = with pkgs; [ jq ];
+      services.alice-lg = {
+        enable = true;
+        settings = {
+          server = {
+            listen_http = "[::]:7340";
+            enable_prefix_lookup = true;
+            asn = 1;
+            routes_store_refresh_parallelism = 5;
+            neighbors_store_refresh_parallelism = 10000;
+            routes_store_refresh_interval = 5;
+            neighbors_store_refresh_interval = 5;
+          };
+          housekeeping = {
+            interval = 5;
+            force_release_memory = true;
+          };
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    host1.wait_for_unit("alice-lg.service")
+    host1.wait_for_open_port(7340)
+    host1.succeed("curl http://[::]:7340 | grep 'Alice BGP Looking Glass'")
+  '';
+}

nixos/tests/all-tests.nix

@@ -102,6 +102,7 @@ in {
   airsonic = handleTest ./airsonic.nix {};
   akkoma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./akkoma.nix {};
   akkoma-confined = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./akkoma.nix { confined = true; };
+  alice-lg = handleTest ./alice-lg.nix {};
   allTerminfo = handleTest ./all-terminfo.nix {};
   alps = handleTest ./alps.nix {};
   amazon-init-shell = handleTest ./amazon-init-shell.nix {};
@@ -123,6 +124,7 @@ in {
   binary-cache = handleTest ./binary-cache.nix {};
   bind = handleTest ./bind.nix {};
   bird = handleTest ./bird.nix {};
+  birdwatcher = handleTest ./birdwatcher.nix {};
   bitcoind = handleTest ./bitcoind.nix {};
   bittorrent = handleTest ./bittorrent.nix {};
   blockbook-frontend = handleTest ./blockbook-frontend.nix {};
@@ -562,6 +564,7 @@ in {
   pam-oath-login = handleTest ./pam/pam-oath-login.nix {};
   pam-u2f = handleTest ./pam/pam-u2f.nix {};
   pam-ussh = handleTest ./pam/pam-ussh.nix {};
+  pam-zfs-key = handleTest ./pam/zfs-key.nix {};
   pass-secret-service = handleTest ./pass-secret-service.nix {};
   patroni = handleTestOn ["x86_64-linux"] ./patroni.nix {};
   pantalaimon = handleTest ./matrix/pantalaimon.nix {};
@@ -641,6 +644,7 @@ in {
   retroarch = handleTest ./retroarch.nix {};
   robustirc-bridge = handleTest ./robustirc-bridge.nix {};
   roundcube = handleTest ./roundcube.nix {};
+  rshim = handleTest ./rshim.nix {};
   rspamd = handleTest ./rspamd.nix {};
   rss2email = handleTest ./rss2email.nix {};
   rstudio-server = handleTest ./rstudio-server.nix {};

nixos/tests/birdwatcher.nix

@@ -0,0 +1,94 @@
+# This test does a basic functionality check for birdwatcher
+
+{ system ? builtins.currentSystem
+, pkgs ? import ../.. { inherit system; config = { }; }
+}:
+
+let
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
+  inherit (pkgs.lib) optionalString;
+in
+makeTest {
+  name = "birdwatcher";
+  nodes = {
+    host1 = {
+      environment.systemPackages = with pkgs; [ jq ];
+      services.bird2 = {
+        enable = true;
+        config = ''
+          log syslog all;
+
+          debug protocols all;
+
+          router id 10.0.0.1;
+
+          protocol device {
+          }
+
+          protocol kernel kernel4 {
+            ipv4 {
+              import none;
+              export all;
+            };
+          }
+
+          protocol kernel kernel6 {
+            ipv6 {
+              import none;
+              export all;
+            };
+          }
+        '';
+      };
+      services.birdwatcher = {
+        enable = true;
+        settings = ''
+          [server]
+          allow_from = []
+          allow_uncached = false
+          modules_enabled = ["status",
+                             "protocols",
+                             "protocols_bgp",
+                             "protocols_short",
+                             "routes_protocol",
+                             "routes_peer",
+                             "routes_table",
+                             "routes_table_filtered",
+                             "routes_table_peer",
+                             "routes_filtered",
+                             "routes_prefixed",
+                             "routes_noexport",
+                             "routes_pipe_filtered_count",
+                             "routes_pipe_filtered"
+                            ]
+          [status]
+          reconfig_timestamp_source = "bird"
+          reconfig_timestamp_match = "# created: (.*)"
+          filter_fields = []
+          [bird]
+          listen = "0.0.0.0:29184"
+          config = "/etc/bird/bird2.conf"
+          birdc  = "${pkgs.bird}/bin/birdc"
+          ttl = 5 # time to live (in minutes) for caching of cli output
+          [parser]
+          filter_fields = []
+          [cache]
+          use_redis = false # if not using redis cache, activate housekeeping to save memory!
+          [housekeeping]
+          interval = 5
+          force_release_memory = true
+        '';
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    host1.wait_for_unit("bird2.service")
+    host1.wait_for_unit("birdwatcher.service")
+    host1.wait_for_open_port(29184)
+    host1.succeed("curl http://[::]:29184/status | jq -r .status.message | grep 'Daemon is up and running'")
+    host1.succeed("curl http://[::]:29184/protocols | jq -r .protocols.device1.state | grep 'up'")
+  '';
+}

nixos/tests/matrix/mjolnir.nix

@@ -32,7 +32,6 @@ import ../make-test-python.nix (
     name = "mjolnir";
     meta = with pkgs.lib; {
       maintainers = teams.matrix.members;
-      broken = true; # times out after spending many hours
     };
 
     nodes = {
@@ -99,6 +98,8 @@ import ../make-test-python.nix (
             enable = true;
             username = "mjolnir";
             passwordFile = pkgs.writeText "password.txt" "mjolnir-password";
+            # otherwise mjolnir tries to connect to ::1, which is not listened by pantalaimon
+            options.listenAddress = "127.0.0.1";
           };
           managementRoom = "#moderators:homeserver";
         };

nixos/tests/nextcloud/basic.nix

@@ -43,6 +43,7 @@ in {
         enable = true;
         datadir = "/var/lib/nextcloud-data";
         hostName = "nextcloud";
+        database.createLocally = true;
         config = {
           # Don't inherit adminuser since "root" is supposed to be the default
           adminpassFile = "${pkgs.writeText "adminpass" adminpass}"; # Don't try this at home!

nixos/tests/nextcloud/openssl-sse.nix

@@ -9,6 +9,7 @@ args@{ pkgs, nextcloudVersion ? 25, ... }:
     services.nextcloud = {
       enable = true;
       config.adminpassFile = "${pkgs.writeText "adminpass" adminpass}";
+      database.createLocally = true;
       package = pkgs.${"nextcloud" + (toString nextcloudVersion)};
     };
   };

nixos/tests/nextcloud/with-mysql-and-memcached.nix

@@ -26,6 +26,7 @@ in {
           redis = false;
           memcached = true;
         };
+        database.createLocally = true;
         config = {
           dbtype = "mysql";
           # Don't inherit adminuser since "root" is supposed to be the default

nixos/tests/nextcloud/with-postgresql-and-redis.nix

@@ -25,6 +25,7 @@ in {
           redis = true;
           memcached = false;
         };
+        database.createLocally = true;
         config = {
           dbtype = "pgsql";
           inherit adminuser;

nixos/tests/pam/zfs-key.nix

@@ -0,0 +1,83 @@
+import ../make-test-python.nix ({ ... }:
+
+  let
+    userPassword = "password";
+    mismatchPass = "mismatch";
+  in
+  {
+    name = "pam-zfs-key";
+
+    nodes.machine =
+      { ... }: {
+        boot.supportedFilesystems = [ "zfs" ];
+
+        networking.hostId = "12345678";
+
+        security.pam.zfs.enable = true;
+
+        users.users = {
+          alice = {
+            isNormalUser = true;
+            password = userPassword;
+          };
+          bob = {
+            isNormalUser = true;
+            password = userPassword;
+          };
+        };
+      };
+
+    testScript = { nodes, ... }:
+      let
+        homes = nodes.machine.security.pam.zfs.homes;
+        pool = builtins.head (builtins.split "/" homes);
+      in
+      ''
+        machine.wait_for_unit("multi-user.target")
+        machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+
+        with subtest("Create encrypted ZFS datasets"):
+          machine.succeed("truncate -s 64M /testpool.img")
+          machine.succeed("zpool create -O canmount=off '${pool}' /testpool.img")
+          machine.succeed("zfs create -o canmount=off -p '${homes}'")
+          machine.succeed("echo ${userPassword} | zfs create -o canmount=noauto -o encryption=on -o keyformat=passphrase '${homes}/alice'")
+          machine.succeed("zfs unload-key '${homes}/alice'")
+          machine.succeed("echo ${mismatchPass} | zfs create -o canmount=noauto -o encryption=on -o keyformat=passphrase '${homes}/bob'")
+          machine.succeed("zfs unload-key '${homes}/bob'")
+
+        with subtest("Switch to tty2"):
+          machine.fail("pgrep -f 'agetty.*tty2'")
+          machine.send_key("alt-f2")
+          machine.wait_until_succeeds("[ $(fgconsole) = 2 ]")
+          machine.wait_for_unit("getty@tty2.service")
+          machine.wait_until_succeeds("pgrep -f 'agetty.*tty2'")
+
+        with subtest("Log in as user with home locked by login password"):
+          machine.wait_until_tty_matches("2", "login: ")
+          machine.send_chars("alice\n")
+          machine.wait_until_tty_matches("2", "login: alice")
+          machine.wait_until_succeeds("pgrep login")
+          machine.wait_until_tty_matches("2", "Password: ")
+          machine.send_chars("${userPassword}\n")
+          machine.wait_until_succeeds("pgrep -u alice bash")
+          machine.succeed("mount | grep ${homes}/alice")
+
+        with subtest("Switch to tty3"):
+          machine.fail("pgrep -f 'agetty.*tty3'")
+          machine.send_key("alt-f3")
+          machine.wait_until_succeeds("[ $(fgconsole) = 3 ]")
+          machine.wait_for_unit("getty@tty3.service")
+          machine.wait_until_succeeds("pgrep -f 'agetty.*tty3'")
+
+        with subtest("Log in as user with home locked by password different from login"):
+          machine.wait_until_tty_matches("3", "login: ")
+          machine.send_chars("bob\n")
+          machine.wait_until_tty_matches("3", "login: bob")
+          machine.wait_until_succeeds("pgrep login")
+          machine.wait_until_tty_matches("3", "Password: ")
+          machine.send_chars("${userPassword}\n")
+          machine.wait_until_succeeds("pgrep -u bob bash")
+          machine.fail("mount | grep ${homes}/bob")
+      '';
+  }
+)

nixos/tests/pgadmin4.nix

@@ -9,6 +9,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
     imports = [ ./common/user-account.nix ];
 
     environment.systemPackages = with pkgs; [
+      wget
       curl
       pgadmin4-desktopmode
     ];
@@ -40,8 +41,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
     with subtest("Check pgadmin module"):
       machine.wait_for_unit("postgresql")
       machine.wait_for_unit("pgadmin")
-      machine.wait_until_succeeds("curl -s localhost:5051")
-      machine.wait_until_succeeds("curl -s localhost:5051/login | grep \"<title>pgAdmin 4</title>\" > /dev/null")
+      machine.wait_until_succeeds("curl -sS localhost:5051")
+      machine.wait_until_succeeds("curl -sS localhost:5051/login | grep \"<title>pgAdmin 4</title>\" > /dev/null")
+      # check for missing support files (css, js etc). Should catch not-generated files during build. See e.g. https://github.com/NixOS/nixpkgs/pull/229184
+      machine.succeed("wget -nv --level=1 --spider --recursive localhost:5051/login")
 
     # pgadmin4 module saves the configuration to /etc/pgadmin/config_system.py
     # pgadmin4-desktopmode tries to read that as well. This normally fails with a PermissionError, as the config file
@@ -51,7 +54,8 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
     # because of the wrong config for desktopmode.
     with subtest("Check pgadmin standalone desktop mode"):
       machine.execute("sudo -u alice pgadmin4 >&2 &", timeout=60)
-      machine.wait_until_succeeds("curl -s localhost:5050")
-      machine.wait_until_succeeds("curl -s localhost:5050/browser/ | grep \"<title>pgAdmin 4</title>\" > /dev/null")
+      machine.wait_until_succeeds("curl -sS localhost:5050")
+      machine.wait_until_succeeds("curl -sS localhost:5050/browser/ | grep \"<title>pgAdmin 4</title>\" > /dev/null")
+      machine.succeed("wget -nv --level=1 --spider --recursive localhost:5050/browser")
   '';
 })

nixos/tests/rshim.nix

@@ -0,0 +1,25 @@
+{ system ? builtins.currentSystem
+, config ? { }
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+with pkgs.lib;
+
+{
+  basic = makeTest {
+    name = "rshim";
+    meta.maintainers = with maintainers; [ nikstur ];
+
+    nodes.machine = { config, pkgs, ... }: {
+      services.rshim.enable = true;
+    };
+
+    testScript = { nodes, ... }: ''
+      machine.start()
+      machine.wait_for_unit("multi-user.target")
+
+      print(machine.succeed("systemctl status rshim.service"))
+    '';
+  };
+}

nixos/tests/systemd-repart.nix

@@ -21,7 +21,7 @@ let
     shutil.copyfile("${machine.system.build.diskImage}/nixos.img", tmp_disk_image.name)
 
     subprocess.run([
-      "${pkgs.qemu}/bin/qemu-img",
+      "${machine.config.virtualisation.qemu.package}/bin/qemu-img",
       "resize",
       "-f",
       "raw",

nixos/tests/vikunja.nix

@@ -26,6 +26,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
         };
         frontendScheme = "http";
         frontendHostname = "localhost";
+        port = 9090;
       };
       services.postgresql = {
         enable = true;
@@ -52,8 +53,8 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
       vikunjaSqlite.succeed("curl --fail http://localhost")
 
       vikunjaPostgresql.wait_for_unit("vikunja-api.service")
-      vikunjaPostgresql.wait_for_open_port(3456)
-      vikunjaPostgresql.succeed("curl --fail http://localhost:3456/api/v1/info")
+      vikunjaPostgresql.wait_for_open_port(9090)
+      vikunjaPostgresql.succeed("curl --fail http://localhost:9090/api/v1/info")
 
       vikunjaPostgresql.wait_for_unit("nginx.service")
       vikunjaPostgresql.wait_for_open_port(80)

pkgs/applications/audio/muso/default.nix

@@ -4,13 +4,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "muso";
-  version = "2.0.0";
+  version = "unstable-2021-09-02";
 
   src = fetchFromGitHub {
     owner = "quebin31";
     repo = pname;
-    rev = "68cc90869bcc0f202830a318fbfd6bb9bdb75a39";
-    sha256 = "1dnfslliss173igympl7h1zc0qz0g10kf96dwrcj6aglmvvw426p";
+    rev = "6dd1c6d3a82b21d4fb2606accf2f26179eb6eaf9";
+    hash = "sha256-09DWUER0ZWQuwfE3sjov2GjJNI7coE3D3E5iUy9mlSE=";
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];
@@ -26,10 +26,10 @@ rustPlatform.buildRustPackage rec {
     cp share/* $out/share/muso/
   '';
 
-  cargoSha256 = "1hgdzyz005244f2mh97js9ga0a6s2hcd6iydz07f1hmhsh1j2bwy";
+  cargoHash = "sha256-+UVUejKCfjC6zdW315wmu7f3A5GmnoQ3rIk8SK6LIRI=";
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
+    broken = stdenv.isDarwin;
     description = "An automatic music sorter (based on ID3 tags)";
     homepage = "https://github.com/quebin31/muso";
     license = with licenses; [ gpl3Plus ];

pkgs/applications/audio/mympd/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mympd";
-  version = "10.3.1";
+  version = "10.3.2";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${version}";
-    sha256 = "sha256-KQf+Szr/AunL/roCtRPiC771P2A3POXPFlXUhbNej6g=";
+    sha256 = "sha256-VnV0jZp2ymsZkVIDBYXHhJTR10CZ74wutue1GTGQtxI=";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/open-stage-control/default.nix

@@ -2,13 +2,13 @@
 
 buildNpmPackage rec {
   pname = "open-stage-control";
-  version = "1.24.2";
+  version = "1.25.0";
 
   src = fetchFromGitHub {
     owner = "jean-emmanuel";
     repo = "open-stage-control";
     rev = "v${version}";
-    hash = "sha256-mM81u1irVfFFJUddOXKcs46tcGwVAcir+daKdkxFLsE=";
+    hash = "sha256-HbJFxgY/xba6X73TK40xXyLZiIxv1Ku/sVAekjApYFg=";
   };
 
   # Remove some Electron stuff from package.json

pkgs/applications/audio/psst/default.nix

@@ -16,22 +16,21 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "psst";
-  version = "unstable-2022-10-13";
+  version = "unstable-2023-05-13";
 
   src = fetchFromGitHub {
     owner = "jpochyla";
     repo = pname;
-    rev = "d70ed8104533dc15bc36b989ba8428872c9b578f";
-    hash = "sha256-ZKhHN0ruLb6ZVKkrKv/YawRsVop6SP1QF/nrtkmA8P8=";
+    rev = "f94af14aa9fdd3d59cd92849fa7f076103b37a70";
+    hash = "sha256-Cmpdyec1xe7j10LDm+iCaKlBICHkmmbhKz2nDeOFOF8=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "cubeb-0.10.1" = "sha256-PRQL8dq5BAsodbVlm5SnuzUDLg9/UY3BmoumcmWF+aY=";
-      "druid-0.7.0" = "sha256-fnsm+KGsuePLRRjTecJ0GBQEySSeDIth13AX/aAigqU=";
-      "druid-enums-0.1.0" = "sha256-4fo0ywoK+m4OuqYlbNbJS2BZK/VBFqeAYEFNGnGUVmM=";
-      "piet-0.5.0" = "sha256-hCg8vABnLAO8egFwMtRSpRdzH6auETrICoUfuBZVzz8=";
+      "cubeb-0.10.3" = "sha256-3eHW+kIJydF6nF0EkB/vglOvksfol+xIKoqFsKg3omI=";
+      "druid-0.8.3" = "sha256-hTB9PQf2TAhcLr64VjjQIr18mczwcNogDSRSN5dQULA=";
+      "druid-enums-0.1.0" = "sha256-KJvAgKxicx/g+4QRZq3iHt6MGVQbfOpyN+EhS6CyDZk=";
     };
   };
   # specify the subdirectory of the binary crate to build from the workspace
@@ -50,11 +49,20 @@ rustPlatform.buildRustPackage rec {
     pango
   ];
 
+  patches = [
+    # Use a fixed build time, hard-code upstream URL instead of trying to read `.git`
+    ./make-build-reproducible.patch
+  ];
+
   postInstall = ''
     install -Dm444 psst-gui/assets/logo_512.png $out/share/icons/hicolor/512x512/apps/${pname}.png
     install -Dm444 -t $out/share/applications ${desktopItem}/share/applications/*
   '';
 
+  passthru = {
+    updateScript = ./update.sh;
+  };
+
   meta = with lib; {
     description = "Fast and multi-platform Spotify client with native GUI";
     homepage = "https://github.com/jpochyla/psst";

pkgs/applications/audio/psst/make-build-reproducible.patch

@@ -0,0 +1,59 @@
+diff --git a/psst-core/build.rs b/psst-core/build.rs
+deleted file mode 100644
+index 1057827..0000000
+--- a/psst-core/build.rs
++++ /dev/null
+@@ -1,37 +0,0 @@
+-use std::{env, fs, io::Write};
+-
+-fn main() {
+-    let outdir = env::var("OUT_DIR").unwrap();
+-    let outfile = format!("{}/build-time.txt", outdir);
+-
+-    let mut fh = fs::File::create(outfile).unwrap();
+-    write!(fh, r#""{}""#, chrono::Local::now()).ok();
+-
+-    let git_config = gix_config::File::from_git_dir("../.git/").expect("Git Config not found!");
+-    // Get Git's 'Origin' URL
+-    let mut remote_url = git_config
+-        .raw_value("remote", Some("origin".as_ref()), "url")
+-        .expect("Couldn't extract origin url!")
+-        .to_string();
+-    // Check whether origin is accessed via ssh
+-    if remote_url.contains('@') {
+-        // If yes, strip the `git@` prefix and split the domain and path
+-        let mut split = remote_url
+-            .strip_prefix("git@")
+-            .unwrap_or(&remote_url)
+-            .split(':');
+-        let domain = split
+-            .next()
+-            .expect("Couldn't extract domain from ssh-style origin");
+-        let path = split
+-            .next()
+-            .expect("Couldn't expect path from ssh-style origin");
+-
+-        // And construct the http-style url
+-        remote_url = format!("https://{domain}/{path}");
+-    }
+-    remote_url = remote_url.trim_end_matches(".git").to_owned();
+-    let outfile = format!("{}/remote-url.txt", outdir);
+-    let mut file = fs::File::create(outfile).unwrap();
+-    write!(file, r#""{}""#, remote_url).ok();
+-}
+diff --git a/psst-core/src/lib.rs b/psst-core/src/lib.rs
+index fcbd491..2d71ee3 100644
+--- a/psst-core/src/lib.rs
++++ b/psst-core/src/lib.rs
+@@ -3,8 +3,8 @@
+ use git_version::git_version;
+ 
+-pub const GIT_VERSION: &str = git_version!();
+-pub const BUILD_TIME: &str = include!(concat!(env!("OUT_DIR"), "/build-time.txt"));
+-pub const REMOTE_URL: &str = include!(concat!(env!("OUT_DIR"), "/remote-url.txt"));
++pub const GIT_VERSION: &str = "f94af14aa9fdd3d59cd92849fa7f076103b37a70";
++pub const BUILD_TIME: &str = "1970-01-01 00:00:00";
++pub const REMOTE_URL: &str = "https://github.com/jpochyla/psst";
+ 
+ pub mod actor;
+ pub mod audio;

pkgs/applications/audio/psst/update.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix wget nix-prefetch-github jq coreutils
+
+# shellcheck shell=bash
+
+if [ -n "$GITHUB_TOKEN" ]; then
+    TOKEN_ARGS=(--header "Authorization: token $GITHUB_TOKEN")
+fi
+
+if [[ $# -gt 1 || $1 == -* ]]; then
+    echo "Regenerates packaging data for psst."
+    echo "Usage: $0 [git commit]"
+    exit 1
+fi
+
+set -x
+
+cd "$(dirname "$0")"
+rev="$1"
+
+set -euo pipefail
+
+if [ -z "$rev" ]; then
+    rev="$(wget -O- "${TOKEN_ARGS[@]}" "https://api.github.com/repos/jpochyla/psst/commits?per_page=1" | jq -r '.[0].sha')"
+fi
+
+version="unstable-$(date +%F)"
+
+# Sources
+src_hash=$(nix-prefetch-github jpochyla psst --rev "$rev" | jq -r .sha256)
+
+# Cargo.lock
+src="https://raw.githubusercontent.com/jpochyla/psst/$rev"
+wget "${TOKEN_ARGS[@]}" "$src/Cargo.lock" -O Cargo.lock
+
+# Use friendlier hashes
+src_hash=$(nix hash to-sri --type sha256 "$src_hash")
+
+sed -i -E -e "s#version = \".*\"#version = \"$version\"#" default.nix
+sed -i -E -e "s#rev = \".*\"#rev = \"$rev\"#" default.nix
+sed -i -E -e "s#hash = \".*\"#hash = \"$src_hash\"#" default.nix
+
+# Also update the git hash shown in the UI
+sed -i -E -e "s#GIT_VERSION = \".*\"#GIT_VERSION = \"$rev\"#" make-build-reproducible.patch

pkgs/applications/backup/restic-integrity/default.nix

@@ -0,0 +1,25 @@
+{ lib
+, rustPlatform
+, fetchFromGitLab
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "restic-integrity";
+  version = "1.2.1";
+  src = fetchFromGitLab {
+    domain = "gitlab.upi.li";
+    owner = "networkException";
+    repo = "restic-integrity";
+    rev = version;
+    hash = "sha256-/n8muqW9ol0AY9RM3N4nqLDw0U1h0308M1uRCMS2kOM=";
+  };
+
+  cargoHash = "sha256-TYDPzjWxTK9hQhzSknkCao9lq9UjZN3yQX3wtkMmP6E=";
+
+  meta = with lib; {
+    description = "A CLI tool to check the integrity of a restic repository without unlocking it";
+    homepage = "https://gitlab.upi.li/networkException/restic-integrity";
+    license = with licenses; [ bsd2 ];
+    maintainers = with maintainers; [ janik ];
+  };
+}

pkgs/applications/blockchains/ledger-live-desktop/default.nix

@@ -2,11 +2,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.57.0";
+  version = "2.58.0";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-fXvCj9eBEp/kGPSiNUdir19eU0x461KzXgl5YgeapHI=";
+    hash = "sha256-y9D+RKAB/woYmnu8X0armsVaxu0CWbqZpRiEFcN7rYM=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -104,12 +104,12 @@
   };
   bicep = buildGrammar {
     language = "bicep";
-    version = "0.0.0+rev=b94a098";
+    version = "0.0.0+rev=3604d8c";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-bicep";
-      rev = "b94a0983b69ebb75e9129329a188199ad6ebcec0";
-      hash = "sha256-YCVOgLmtCWd4FwfwmQUZhSzP2wS2ZDLwXP1BRrpE0Ls=";
+      rev = "3604d8c961ab129d2bfc6dfca56419c236ccdb83";
+      hash = "sha256-s0BtyYtC/D8+nudkHxpd4rSPQWrA0FngH9HIX85H/Uw=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-bicep";
   };
@@ -137,12 +137,12 @@
   };
   c_sharp = buildGrammar {
     language = "c_sharp";
-    version = "0.0.0+rev=2340fd6";
+    version = "0.0.0+rev=7611471";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-c-sharp";
-      rev = "2340fd6b57b06ccbf24c2c6dafb15905fdccfb1f";
-      hash = "sha256-9acxVw5EWr/NwO5ERwy3V976NMY65vDQp60jIoDfO7k=";
+      rev = "76114711aedd3f4b6e1333a7513975647930c629";
+      hash = "sha256-sBpI/8SfIzPQ0aJ8tw00IZoWGFnBo6mvRcn1lKfnaTg=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-c-sharp";
   };
@@ -225,23 +225,23 @@
   };
   cpon = buildGrammar {
     language = "cpon";
-    version = "0.0.0+rev=eedb93b";
+    version = "0.0.0+rev=f4b3cbc";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-cpon";
-      rev = "eedb93bf9e22e82ed6a67e6c57fd78731b44f591";
-      hash = "sha256-8x+oUbiwt7prGc5cli5HabHoH3q/mBnQzO1Wy2Bauac=";
+      rev = "f4b3cbc8b0bd4e13035d39940fef09f1392e8739";
+      hash = "sha256-Enxc0sdQS9vSZVvIQkkHxk/1bzT2denRk0+AZdDNnJ8=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-cpon";
   };
   cpp = buildGrammar {
     language = "cpp";
-    version = "0.0.0+rev=670404d";
+    version = "0.0.0+rev=70aed2e";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-cpp";
-      rev = "670404d7c689be1c868a46f919ba2a3912f2b7ef";
-      hash = "sha256-T+Ha2hlI7ucEsTYvDmk7xjHNEoyvnotp/1EWfyCwnWM=";
+      rev = "70aed2e9e83eb7320ab7c454d3084300bf587037";
+      hash = "sha256-3gTLqz1H/7A8+2NiZmR/jBPt4Rh/Wvlcxt/aD7w8T8A=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-cpp";
   };
@@ -258,12 +258,12 @@
   };
   cuda = buildGrammar {
     language = "cuda";
-    version = "0.0.0+rev=a358542";
+    version = "0.0.0+rev=a27cb7b";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-cuda";
-      rev = "a35854270463a96e79096bb854aae30a4f0e6cd2";
-      hash = "sha256-8CRFEUxTge0EJQQQVabCjstUGkOIPlC1duj2jD4R89E=";
+      rev = "a27cb7b9d105c43205fa899f49bc0cc4cf399484";
+      hash = "sha256-OXm/urF5AIxod1J5i951C6kcf6pZRj+Q+ObwD0yj55Q=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-cuda";
   };
@@ -513,12 +513,12 @@
   };
   func = buildGrammar {
     language = "func";
-    version = "0.0.0+rev=f161cfe";
+    version = "0.0.0+rev=0834e35";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-func";
-      rev = "f161cfe22452b386eeeab29ba0d2c14893f1a31f";
-      hash = "sha256-Swyg5EdBWVT6P9vgS7h/fmK0ySRwiFlynJEZT9I10qg=";
+      rev = "0834e35ecf8b23fbf9ad15b088af6a897e19d4a8";
+      hash = "sha256-2+YOp7MnwZR2qg95h/ywjJwDSLUnodtkwwpv9zuy8p8=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-func";
   };
@@ -667,12 +667,12 @@
   };
   gosum = buildGrammar {
     language = "gosum";
-    version = "0.0.0+rev=14da5c2";
+    version = "0.0.0+rev=e2ac513";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-go-sum";
-      rev = "14da5c2a34861eb2d97ed89f39324156031e8878";
-      hash = "sha256-PP8uj8tFMIBZtFuOQbEi25Yz/UEy5cRiEklbrlS5J+Q=";
+      rev = "e2ac513b2240c7ff1069ae33b2df29ce90777c11";
+      hash = "sha256-2foA2sd5PQpmeX8OhXrW/dxoJaEyxDXzPWh+UD0dgzQ=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-go-sum";
   };
@@ -711,12 +711,12 @@
   };
   hare = buildGrammar {
     language = "hare";
-    version = "0.0.0+rev=f0a9e62";
+    version = "0.0.0+rev=3d4af17";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-hare";
-      rev = "f0a9e6207a8c84bbd11143c8eb0c6cf70dc6d8b4";
-      hash = "sha256-zJxkbAzAbA3aRuSHWEF26msbVszK7OxgXP6YPZBUu8w=";
+      rev = "3d4af179414525a35dd069ba0208c9b71093d8b3";
+      hash = "sha256-RRi2uAE9rf0bjQrk8Asf6z+6ZDZYhEoKaX0m8hZnI9o=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-hare";
   };
@@ -766,12 +766,12 @@
   };
   hlsl = buildGrammar {
     language = "hlsl";
-    version = "0.0.0+rev=40472c1";
+    version = "0.0.0+rev=9160427";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-hlsl";
-      rev = "40472c119b5740d9a1fa0b0dc0b013502b636708";
-      hash = "sha256-PfShqPSIsYVMPpW9hQhbEz378vBwDiNkBKR3rLXcIdM=";
+      rev = "916042734060d3d3a023f6637c815a1d23814af8";
+      hash = "sha256-FGOXqBmQXCK2G1iseYgc7CdMOQ7P9dVG7ZHEsqcnRhk=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-hlsl";
   };
@@ -942,12 +942,12 @@
   };
   kdl = buildGrammar {
     language = "kdl";
-    version = "0.0.0+rev=d118f93";
+    version = "0.0.0+rev=e180e05";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-kdl";
-      rev = "d118f9376ef4f0461975289302fe74a28f073876";
-      hash = "sha256-FxY7wqksjSJiOffb7FBcsDQ0oMr94CeGreBV8MMtFr4=";
+      rev = "e180e05132c4cb229a8ba679b298790ef1eca77c";
+      hash = "sha256-XJ2thChaJQjn0N/tqotjc/eR3W4+6GrNv/FxjvScswc=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-kdl";
   };
@@ -975,12 +975,12 @@
   };
   latex = buildGrammar {
     language = "latex";
-    version = "0.0.0+rev=cd3cc49";
+    version = "0.0.0+rev=b0686a8";
     src = fetchFromGitHub {
       owner = "latex-lsp";
       repo = "tree-sitter-latex";
-      rev = "cd3cc493a92b6bac7be4b3bd6d006d35d3c36d4c";
-      hash = "sha256-CHN54T4+eD7EGx4nzAIryAHOu8NCiBDjM2A7Njjt87w=";
+      rev = "b0686a83c2429cc04e6d01f067f5a0a8efc0d17b";
+      hash = "sha256-/80/7HRLMt0p+SqO4d2wcRjHxZZCLH0ooJs4tNrw+oY=";
     };
     meta.homepage = "https://github.com/latex-lsp/tree-sitter-latex";
   };
@@ -1008,34 +1008,34 @@
   };
   lua = buildGrammar {
     language = "lua";
-    version = "0.0.0+rev=4e94980";
+    version = "0.0.0+rev=dcc44f7";
     src = fetchFromGitHub {
       owner = "MunifTanjim";
       repo = "tree-sitter-lua";
-      rev = "4e94980e52f81f713d09be104ba32bf050000031";
-      hash = "sha256-Arv627RIv0d/plfBPq5QVks737PUy3sq2kuLwLr++uM=";
+      rev = "dcc44f7473ecec4d7b99af0a9529705d98a769f1";
+      hash = "sha256-vcss4Ux4DYJHyW8WCFBejPcq711QhemBHsVg482zNY8=";
     };
     meta.homepage = "https://github.com/MunifTanjim/tree-sitter-lua";
   };
   luadoc = buildGrammar {
     language = "luadoc";
-    version = "0.0.0+rev=1e11522";
+    version = "0.0.0+rev=978cc13";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-luadoc";
-      rev = "1e1152264cc68e11d65d9e2493566f5717a13d11";
-      hash = "sha256-CNSo4m5peO1WBncZ1RGmmbA3V8qefh5LJJpFYFTAlsY=";
+      rev = "978cc13791c1d6e4626ee7e8db108d0be14f07e7";
+      hash = "sha256-59rUWQCQ7NzCe6VQJP4mWktDPbFMfUqRnPlqmbon8hU=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-luadoc";
   };
   luap = buildGrammar {
     language = "luap";
-    version = "0.0.0+rev=393915d";
+    version = "0.0.0+rev=43916b0";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-luap";
-      rev = "393915db4b16a792da9c60f52d11d93247d870b9";
-      hash = "sha256-FLRPzU1JI8PoI8vZAKXG6DtHcnSksXCwTHAS0fb4WsY=";
+      rev = "43916b0f31c48a05e03783eb0bab4eec54a4ac75";
+      hash = "sha256-wu2f9iCByf85/iE6j5slNruYH8GUVD19u/ygJ/yx76U=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-luap";
   };
@@ -1232,6 +1232,17 @@
     generate = true;
     meta.homepage = "https://github.com/atom-ocaml/tree-sitter-ocamllex";
   };
+  odin = buildGrammar {
+    language = "odin";
+    version = "0.0.0+rev=d165dbe";
+    src = fetchFromGitHub {
+      owner = "amaanq";
+      repo = "tree-sitter-odin";
+      rev = "d165dbee27617dab2653e38737d96ede1030d14f";
+      hash = "sha256-NxF3aSDtXGMcE7v0BrYQbnUM/hophanKgsYX1ad8AFY=";
+    };
+    meta.homepage = "https://github.com/amaanq/tree-sitter-odin";
+  };
   org = buildGrammar {
     language = "org";
     version = "0.0.0+rev=081179c";
@@ -1388,12 +1399,12 @@
   };
   puppet = buildGrammar {
     language = "puppet";
-    version = "0.0.0+rev=5e1bb97";
+    version = "0.0.0+rev=843868b";
     src = fetchFromGitHub {
       owner = "amaanq";
       repo = "tree-sitter-puppet";
-      rev = "5e1bb979ea71efc0860d4bc56eb3b3f7a670d6ec";
-      hash = "sha256-7xqZ5nVAyflQ84Zah6M6yxpJ8qQooWl6tOodioXvsI8=";
+      rev = "843868bfb909b734bfb63778a5685fae4bf2a33f";
+      hash = "sha256-6fJNADrLVsIoho9G8qCsMKNDB5a32gUntug7Nh8pKEg=";
     };
     meta.homepage = "https://github.com/amaanq/tree-sitter-puppet";
   };
@@ -1608,12 +1619,12 @@
   };
   smali = buildGrammar {
     language = "smali";
-    version = "0.0.0+rev=9bf8aa6";
+    version = "0.0.0+rev=72e334b";
     src = fetchFromSourcehut {
       owner = "~yotam";
       repo = "tree-sitter-smali";
-      rev = "9bf8aa671a233ae2d2c6e9512c7144ce121b1fb6";
-      hash = "sha256-V5JnB1JT8vV5zA+OjM0a7fBGC8CEqyPcUbeD8NoRTSE=";
+      rev = "72e334b2630f5852825ba5ff9dfd872447175eb5";
+      hash = "sha256-vV+4Q2IyWyw/GN8bmgHJmSEHhpjUWHkL2yschPI9fiU=";
     };
     meta.homepage = "https://git.sr.ht/~yotam/tree-sitter-smali";
   };
@@ -1741,13 +1752,13 @@
   };
   t32 = buildGrammar {
     language = "t32";
-    version = "0.0.0+rev=ff822fd";
+    version = "0.0.0+rev=4fca25f";
     src = fetchFromGitea {
       domain = "codeberg.org";
       owner = "xasc";
       repo = "tree-sitter-t32";
-      rev = "ff822fd77bb919854ba60d05f4d373d9d578d0e0";
-      hash = "sha256-jHVfyp8yLaxI+Aa4iH1fXpNIzIoGLdQwo7SvRGFKbFQ=";
+      rev = "4fca25fa99b6fd9ccf9cab9b6bf702a9df142ad5";
+      hash = "sha256-x657aMnqCw/TlS1VyC8er5GQ1QqGdGHGgfSIStUbVfQ=";
     };
     meta.homepage = "https://codeberg.org/xasc/tree-sitter-t32";
   };

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -774,15 +774,14 @@ self: super: {
   openscad-nvim = super.openscad-nvim.overrideAttrs (old: {
     buildInputs = [ zathura htop openscad ];
 
-    patches = [ ./patches/openscad.nvim/program_paths.patch ];
-
-    postPatch = ''
-      substituteInPlace lua/openscad.lua --replace '@zathura-path@' ${zathura}/bin/zathura
-      substituteInPlace autoload/health/openscad_nvim.vim --replace '@zathura-path@' ${zathura}/bin/zathura
-      substituteInPlace lua/openscad/terminal.lua --replace '@htop-path@' ${htop}/bin/htop
-      substituteInPlace autoload/health/openscad_nvim.vim --replace '@htop-path@' ${htop}/bin/htop
-      substituteInPlace lua/openscad.lua --replace '@openscad-path@' ${openscad}/bin/openscad
-    '';
+    patches = [
+      (substituteAll {
+        src = ./patches/openscad.nvim/program_paths.patch;
+        htop = lib.getExe htop;
+        openscad = lib.getExe openscad;
+        zathura = lib.getExe zathura;
+      })
+    ];
   });
 
   orgmode = super.orgmode.overrideAttrs (old: {

pkgs/applications/editors/vim/plugins/patches/openscad.nvim/program_paths.patch

@@ -7,7 +7,7 @@ index 9022d55..30ef53f 100644
  
  function! s:check_zathura_installed() abort
 -	if !executable('zathura')
-+	if !executable('@zathura-path@')
++	if !executable('@zathura@')
  		call health#report_error('has(zathura)','install zathura')
  	else
  		call health#report_ok("zathura is installed")
@@ -16,7 +16,7 @@ index 9022d55..30ef53f 100644
  
  function! s:check_htop_installed() abort
 -	if !executable('htop')
-+	if !executable('@htop-path@')
++	if !executable('@htop@')
  		call health#report_error('has(htop)','install htop')
  	else
  		call health#report_ok("htop is installed")
@@ -29,16 +29,16 @@ index 7dff2fb..4382003 100644
  function M.manual()
      local path = U.openscad_nvim_root_dir .. U.path_sep .. "help_source" .. U.path_sep .. "openscad-manual.pdf"
 -    api.nvim_command('silent !zathura --fork '  .. path)
-+    api.nvim_command('silent !@zathura-path@ --fork '  .. path)
++    api.nvim_command('silent !@zathura@ --fork '  .. path)
  end
  
  function M.help()
-@@ -119,7 +119,7 @@ end
+@@ -125,7 +125,7 @@ function M.exec_openscad()
+ 		jobCommand = '/Applications/OpenSCAD.app/Contents/MacOS/OpenSCAD ' .. vim.fn.expand('%:p')
+ 	else
+ 		-- TODO: What about Windows?
+-		jobCommand = 'openscad ' .. vim.fn.expand('%:p')
++		jobCommand = '@oepnscad@ ' .. vim.fn.expand('%:p')
+ 	end
  
- function M.exec_openscad()
-     -- maybe just use api.jobstart .. instead
--    api.nvim_command[[ call jobstart('openscad ' . shellescape(expand('%:p')), {'detach':1}) ]]
-+    api.nvim_command[[ call jobstart('@openscad-path@ ' . shellescape(expand('%:p')), {'detach':1}) ]]
- end
- 
- function M.default_mappings()
+ 	vim.fn.jobstart(jobCommand)

pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, vscode-utils, callPackage }:
 let
-  version = "1.8.1";
+  version = "1.16.0";
   rescript-editor-analysis = callPackage ./rescript-editor-analysis.nix { inherit version; };
   arch =
     if stdenv.isLinux then "linux"
@@ -13,7 +13,7 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
     name = "rescript-vscode";
     publisher = "chenglou92";
     inherit version;
-    sha256 = "sha256-XZG0PRzc3wyAVq9tQeGDlaUZg5YAgkPxJ3NsrdUHoOk=";
+    sha256 = "sha256-JoC9+NkbLAZXkOKDDMB0Xgzmn+w90pHcokerMrdACi4=";
   };
   postPatch = ''
     rm -r ${analysisDir}

pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/rescript-editor-analysis.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, bash, ocaml, dune_3, version }:
+{ lib, stdenv, fetchFromGitHub, bash, ocaml, ocamlPackages, dune_3, version }:
 
 stdenv.mkDerivation {
   pname = "rescript-editor-analysis";
@@ -8,10 +8,10 @@ stdenv.mkDerivation {
     owner = "rescript-lang";
     repo = "rescript-vscode";
     rev = version;
-    sha256 = "sha256-a8otK0BxZbl0nOp4QWQRkjb5fM85JA4nVkLuKAz71xU=";
+    sha256 = "sha256-+Ht8qWwxtFWHFMiV/aoZIs2S3SxkOWgdwSKN+akp/LU=";
   };
 
-  nativeBuildInputs = [ ocaml dune_3 ];
+  nativeBuildInputs = [ ocaml dune_3 ocamlPackages.cppo ];
 
   # Skip testing phases because they need to download and install node modules
   postPatch = ''

pkgs/applications/emulators/craftos-pc/default.nix

@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
     owner = "MCJack123";
     repo = "craftos2";
     rev = "v${version}";
-    sha256 = "sha256-Vb6mvim42Kvn7A3Qsp4gvTRBGQ5OJ9pVij96LZwWyuQ=";
+    sha256 = "sha256-9XMc7zmtPxlt3WgS93lUJNMFtUJ/llG9SFGtgdFqZEA=";
   };
 
   buildInputs = [ patchelf poco openssl SDL2 SDL2_mixer ncurses libpng pngpp libwebp ];

pkgs/applications/misc/cobalt/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cobalt";
-  version = "0.18.3";
+  version = "0.18.4";
 
   src = fetchFromGitHub {
     owner = "cobalt-org";
     repo = "cobalt.rs";
     rev = "v${version}";
-    sha256 = "sha256-GUN/TgAlIl9/libhA+qqYDYHhc1ZDvDymR/Ac8Mev3c=";
+    sha256 = "sha256-O7qFpp7Xr6K82o/KUMP0J5y2B32op+QBGUXo9Q5R5LQ=";
   };
 
-  cargoSha256 = "sha256-u6C19QA3gMzBZIRoNDnfu1p8zkirSQKjNSQrSb8+qvs=";
+  cargoHash = "sha256-ZBAF4BqQ+JMZ3Rpg2RxUhhVvPE5pN68qljVl0o2/VNA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 

pkgs/applications/misc/kemai/000-cmake-disable-conan.diff

@@ -0,0 +1,38 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index ce78a9d..3cd51e0 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -8,18 +8,21 @@ list(APPEND CMAKE_PREFIX_PATH ${CMAKE_BINARY_DIR})
+ # Common configuration
+ set(CMAKE_CXX_STANDARD 20)
+ set(CMAKE_CXX_STANDARD_REQUIRED ON)
+-
+-# Setup Conan
+-if(NOT EXISTS "${CMAKE_BINARY_DIR}/conan.cmake")
+-    message(STATUS "Downloading conan.cmake from https://github.com/conan-io/cmake-conan")
+-    file(DOWNLOAD "https://raw.githubusercontent.com/conan-io/cmake-conan/0.18.1/conan.cmake"
+-            "${CMAKE_BINARY_DIR}/conan.cmake"
+-            TLS_VERIFY ON)
+-endif()
+-include(${CMAKE_BINARY_DIR}/conan.cmake)
+-
+-conan_cmake_autodetect(settings)
+-conan_cmake_install(PATH_OR_REFERENCE ${CMAKE_SOURCE_DIR} BUILD missing SETTINGS ${settings})
++set(USE_CONAN ON CACHE BOOL "Use conan for dependency managment")
++
++if(USE_CONAN)
++    # Setup Conan
++    if(NOT EXISTS "${CMAKE_BINARY_DIR}/conan.cmake")
++        message(STATUS "Downloading conan.cmake from https://github.com/conan-io/cmake-conan")
++        file(DOWNLOAD "https://raw.githubusercontent.com/conan-io/cmake-conan/0.18.1/conan.cmake"
++                "${CMAKE_BINARY_DIR}/conan.cmake"
++                TLS_VERIFY ON)
++    endif()
++    include(${CMAKE_BINARY_DIR}/conan.cmake)
++
++    conan_cmake_autodetect(settings)
++    conan_cmake_install(PATH_OR_REFERENCE ${CMAKE_SOURCE_DIR} BUILD missing SETTINGS ${settings})
++endif ()
+ 
+ # Setup Qt
+ set(CMAKE_AUTOMOC ON)

pkgs/applications/misc/kemai/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, magic-enum
+, spdlog
+, qtbase
+, qtconnectivity
+, qttools
+, qtlanguageserver
+, wrapQtAppsHook
+, libXScrnSaver
+, nix-update-script
+}:
+
+stdenv.mkDerivation rec {
+  pname = "kemai";
+  version = "0.9.2";
+
+  src = fetchFromGitHub {
+    owner = "AlexandrePTJ";
+    repo = "kemai";
+    rev = version;
+    hash = "sha256-PDjNO2iMPK0J3TSHVZ/DW3W0GkdB8yNZYoTGEd2snac=";
+  };
+
+  buildInputs = [
+    qtbase
+    qtconnectivity
+    qttools
+    qtlanguageserver
+    libXScrnSaver
+    magic-enum
+    spdlog
+  ];
+  cmakeFlags = [ "-DUSE_CONAN=OFF" ];
+  patches = [ ./000-cmake-disable-conan.diff ];
+
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = with lib; {
+    description = "Kimai desktop client written in QT6";
+    homepage = "https://github.com/AlexandrePTJ/kemai";
+    license = licenses.mit;
+    maintainers = with maintainers; [ poelzi ];
+    platforms   = platforms.unix;
+  };
+}

pkgs/applications/misc/koreader/default.nix

@@ -16,9 +16,12 @@ stdenv.mkDerivation rec {
   pname = "koreader";
   version = "2023.04";
 
-  src = fetchurl {
-    url =
-      "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
+
+  src = if stdenv.isAarch64 then fetchurl {
+    url = "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-arm64.deb";
+    sha256 = "sha256-uuspjno0750hQMIB5HEhbV63wCna2izKOHEGIg/X0bU=";
+  } else fetchurl {
+    url = "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
     sha256 = "sha256-tRUeRB1+UcWT49dchN0YDvd0L5n1YRdtMSFc8yy6m5o=";
   };
 
@@ -63,7 +66,7 @@ stdenv.mkDerivation rec {
     description =
       "An ebook reader application supporting PDF, DjVu, EPUB, FB2 and many more formats, running on Cervantes, Kindle, Kobo, PocketBook and Android devices";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    platforms = intersectLists platforms.x86_64 platforms.linux;
+    platforms = [ "aarch64-linux" "x86_64-linux" ];
     license = licenses.agpl3Only;
     maintainers = with maintainers; [ contrun neonfuz];
   };

pkgs/applications/misc/privacyidea/default.nix

@@ -167,6 +167,9 @@ let
         sphinxHook = null;
         sphinx-rtd-theme = null;
       }).overridePythonAttrs dropDocOutput;
+      deprecated = (super.deprecated.override {
+        sphinxHook = null;
+      }).overridePythonAttrs dropDocOutput;
     };
   };
 in
@@ -239,5 +242,6 @@ python3'.pkgs.buildPythonPackage rec {
     license = licenses.agpl3Plus;
     homepage = "http://www.privacyidea.org";
     maintainers = with maintainers; [ globin ma27 ];
+    platforms = platforms.linux;
   };
 }

pkgs/applications/misc/rofi-power-menu/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rofi-power-menu";
-  version = "3.0.2";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "jluttine";
     repo = "rofi-power-menu";
     rev = version;
-    sha256 = "sha256-Bkc87BXSnAR517wCkyOAfoACYx/5xprDGJQhLWGUNns=";
+    sha256 = "sha256-VPCfmCTr6ADNT7MW4jiqLI/lvTjlAu1QrCAugiD0toU=";
   };
 
   installPhase = ''

pkgs/applications/misc/slweb/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "slweb";
-  version = "0.5.4";
+  version = "0.5.5";
 
   src = fetchFromSourcehut {
     owner = "~strahinja";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Wj9ZCs8nRBpIkX5jzTqBdo83zUBMamykk1vbBCIWyoQ=";
+    sha256 = "sha256-Hk3L++J8JiCRXitNHi9uWb7aYN8lMG3GjfpmNyIpoKU=";
   };
 
   nativeBuildInputs = [ redo-apenwarr ];

pkgs/applications/networking/cluster/argo-rollouts/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "argo-rollouts";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-rollouts";
     rev = "v${version}";
-    sha256 = "sha256-MpiKdPjQRF1LzNxBvPucoeRkDfboJdStfQ6X+d2jiwk=";
+    sha256 = "sha256-bOGC4RAeydPCvqyQZE+K0N01xRIGsoiwKJ4lMwVVgGk=";
   };
 
-  vendorHash = "sha256-ZIFZCMyhpfKK/Irq2/MvkXuXX1jExDaSK/nXZgzCZgU=";
+  vendorHash = "sha256-IxSLlRsOz/Xamguxm+7jy8qAAEZZFm/NHDIBjm5tnCs=";
 
   # Disable tests since some test fail because of missing test data
   doCheck = false;

pkgs/applications/networking/cluster/tanka/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tanka";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-RZLmbf9ginMbFAaUKL5mK5HIYQslP8Vu8zdh1OJ1P1Y=";
+    sha256 = "sha256-LAOcDgosSGE7sLiQYSimz//oZ3FHcx3PTjtG0WdDNmg=";
   };
 
-  vendorHash = "sha256-g9e0NesI7WdaTHZ57XRlo8as3IWAFlFW4nkyf6+kd40=";
+  vendorHash = "sha256-//uxNK8u7zIVeIUN401DXtkJsX/1iVfDcoFwcs8Y3cg=";
 
   doCheck = false;
 

pkgs/applications/networking/instant-messengers/abaddon/default.nix

@@ -0,0 +1,77 @@
+{ lib
+, fetchFromGitHub
+, stdenv
+, cmake
+, copyDesktopItems
+, makeDesktopItem
+, makeWrapper
+, pkg-config
+, curl
+, gtkmm3
+, libhandy
+, libsecret
+, nlohmann_json
+, sqlite
+}:
+
+stdenv.mkDerivation rec {
+  pname = "abaddon";
+  version = "0.1.10";
+
+  src = fetchFromGitHub {
+    owner = "uowuo";
+    repo = "abaddon";
+    rev = "v${version}";
+    hash = "sha256-84DrPx0e3pZjg87dHZO4y/z7KfIYNyAibE7/J7oYwXA=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    copyDesktopItems
+    makeWrapper
+    pkg-config
+  ];
+
+  buildInputs = [
+    curl
+    gtkmm3
+    libhandy
+    libsecret
+    nlohmann_json
+    sqlite
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/abaddon
+    cp -r ../res/{css,res} $out/share/abaddon
+    mkdir $out/bin
+    cp abaddon $out/bin
+    wrapProgram $out/bin/abaddon \
+      --chdir $out/share/abaddon
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      exec = pname;
+      desktopName = "Abaddon";
+      genericName = meta.description;
+      startupWMClass = pname;
+      categories = [ "Network" "InstantMessaging" ];
+      mimeTypes = [ "x-scheme-handler/discord" ];
+    })
+  ];
+
+  meta = with lib; {
+    description = "A discord client reimplementation, written in C++";
+    homepage = "https://github.com/uowuo/abaddon";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ genericnerdyusername ];
+    platforms = lib.intersectLists lib.platforms.x86_64 lib.platforms.linux;
+  };
+}

pkgs/applications/networking/instant-messengers/schildichat/pin.json

@@ -1,9 +1,9 @@
 {
-  "version": "1.11.22-sc.1",
-  "rev": "v1.11.22-sc.1",
-  "srcHash": "0di80hjd0d8bsbgbnddbmdjllc7cssgaxy27kd50j4dmw8qll1hv",
-  "webYarnHash": "182fh1ayh1y98kbg4mn8fxqvljs19b02j4ivvjszm55dcpwfp1df",
-  "jsSdkYarnHash": "0a8c7y34wh8bk1v35sa1s3s4piqkzvhjrzzapack4kzl1pfn0vix",
-  "reactSdkYarnHash": "0nhw9vk0yk2v738b2w6jjq5pfib5j66m5maxczhm40zync8b1wmp",
-  "desktopYarnHash": "0bq24rjf63rkq3jphv7raqaz2fnibmj41z905k5f3l4ln835ndfv"
+  "version": "1.11.30-sc.2",
+  "rev": "v1.11.30-sc.2",
+  "srcHash": "1qb1fcr52gyzxndz3j77vn3ddwjpxwvicnh16c72zpzpfbbky7a5",
+  "webYarnHash": "0bg5vc7q8afqfpsaqqkczf9whbzici5d2bxj5cadhrlmlb27f8nx",
+  "jsSdkYarnHash": "0p1whh3pmqz170l542fiq3zgljl5daa9b96i59p3wvggnx7kny7j",
+  "reactSdkYarnHash": "02ysshiyjj3w00b628is9bd7i8qc3vc8kr1zam2dpj26lb9k5pdd",
+  "desktopYarnHash": "16pzmlwzf3z8mky3wb4azaiggigyfnpxmbq3irjp30ic6yhl50yw"
 }

pkgs/applications/networking/insync/default.nix

@@ -1,34 +1,26 @@
-{ lib, stdenv, fetchurl, makeWrapper, autoPatchelfHook }:
+{ lib
+, writeShellScript
+, buildFHSEnv
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, dpkg
+, nss
+, libvorbis
+, libdrm
+, libGL
+, wayland
+, libthai
+}:
 
-stdenv.mkDerivation rec {
+let
   pname = "insync";
-  version = "1.5.7.37371";
-  src =
-    if stdenv.hostPlatform.system == "x86_64-linux" then
-      fetchurl {
-        url = "http://s.insynchq.com/builds/insync-portable_${version}_amd64.tar.bz2";
-        sha256 = "1cm3q6y2crw6pcsvh21sbkmh1hin7xl4fyslc96nbyql8rxsky5n";
-      }
-    else
-      throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";
-
-  nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
-
-  postPatch = ''
-    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" client/insync-portable
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp -a client $out/client
-    makeWrapper $out/client/insync-portable $out/bin/insync --set LC_TIME C
-  '';
-
-  meta = {
+  version = "3.8.5.50499";
+  meta = with lib; {
     platforms = ["x86_64-linux"];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfree;
-    maintainers = [ ];
+    license = licenses.unfree;
+    maintainers = with maintainers; [ hellwolf ];
     homepage = "https://www.insynchq.com";
     description = "Google Drive sync and backup with multiple account support";
     longDescription = ''
@@ -38,8 +30,81 @@ stdenv.mkDerivation rec {
      and built in sharing.
 
      There is a 15-day free trial, and it is a paid application after that.
+
+     Known bug(s):
+
+     1) Currently the system try icon does not render correctly.
+     2) libqtvirtualkeyboardplugin does not have necessary Qt library shipped from vendor.
     '';
-    # download URL removed
-    broken = true;
   };
+  insync-pkg = stdenv.mkDerivation {
+    inherit pname version;
+
+    src = fetchurl {
+      # Find a binary from https://www.insynchq.com/downloads/linux#ubuntu.
+      url = "https://cdn.insynchq.com/builds/linux/${pname}_${version}-lunar_amd64.deb";
+      sha256 = "sha256-mpMJe8LAmO9OrqRIEWuxfVNeh5ANvjZIEHFz8cXYObY=";
+    };
+
+    buildInputs = [
+      nss
+      libvorbis
+      libdrm
+      libGL
+      wayland
+      libthai
+    ];
+
+    nativeBuildInputs = [ autoPatchelfHook dpkg ];
+
+    unpackPhase = ''
+      dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin $out/lib $out/share
+      cp -R usr/* $out/
+
+      # use system glibc
+      rm -f $out/lib/insync/{libgcc_s.so.1,libstdc++.so.6}
+
+      # remove badly packaged plugins
+      rm $out/lib/insync/PySide2/plugins/platforminputcontexts/libqtvirtualkeyboardplugin.so
+
+      runHook postInstall
+    '';
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    # NB! This did the trick, otherwise it segfaults! However I don't understand why!
+    dontStrip = true;
+
+    inherit meta;
+  };
+in buildFHSEnv { # ref: pkgs/build-support/build-fhsenv-bubblewrap/default.nix
+  name = "${pname}-${version}";
+  inherit meta;
+
+  # for including insync's xdg data dirs
+  extraOutputsToInstall = [ "share" ];
+
+  targetPkgs = pkgs: [
+    insync-pkg
+  ];
+
+  multiPkgs = pkgs: with pkgs; [
+    # apparently only package needed for the FHS :)
+    libudev0-shim
+  ];
+
+  runScript = writeShellScript "insync-wrapper.sh" ''
+    # QT_STYLE_OVERRIDE was used to suppress a QT warning, it should have no actual effect for this binary.
+    export QT_STYLE_OVERRIDE=Fusion
+    exec "${insync-pkg.outPath}/lib/insync/insync" "$@"
+  '';
+  # "insync start" command starts a daemon.
+  dieWithParent = false;
 }

pkgs/applications/networking/insync/v3.nix

@@ -1,82 +0,0 @@
-{ stdenv
-, lib
-, fetchurl
-, makeWrapper
-, dpkg
-, libxcb
-, libGL
-, nss
-, libthai
-, wayland
-, alsa-lib
-, qtvirtualkeyboard
-, qtwebchannel
-, qtwebsockets
-, qtlocation
-, qtwebengine
-, autoPatchelfHook
-, wrapQtAppsHook
-}:
-
-stdenv.mkDerivation rec {
-  pname = "insync";
-  version = "3.8.5.50499";
-
-  src = fetchurl {
-    url = "https://cdn.insynchq.com/builds/linux/${pname}_${version}-focal_amd64.deb";
-    hash = "sha256-CtDwU0Cey12kDjEX+Y9x7pfKNARfKDopWsDVRaA1Zts=";
-  };
-
-  postPatch = ''
-    substituteInPlace usr/bin/insync --replace /usr/lib/insync $out/usr/lib/insync
-  '';
-
-  buildInputs = [
-    alsa-lib
-    libGL
-    libthai
-    libxcb
-    nss
-    qtlocation
-    qtvirtualkeyboard
-    qtwebchannel
-    qtwebengine
-    qtwebsockets
-    wayland
-  ];
-
-  nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper wrapQtAppsHook ];
-
-  unpackPhase = ''
-    dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin $out/lib $out/share
-    cp -R usr/* $out/
-    rm $out/lib/insync/libGLX.so.0
-    rm $out/lib/insync/libQt5*
-    sed -i 's|/usr/lib/insync|/lib/insync|' "$out/bin/insync"
-    wrapQtApp "$out/lib/insync/insync"
-  '';
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  meta = with lib; {
-    platforms = ["x86_64-linux"];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = with maintainers; [ ];
-    homepage = "https://www.insynchq.com";
-    description = "Google Drive sync and backup with multiple account support";
-    longDescription = ''
-     Insync is a commercial application that syncs your Drive files to your
-     computer.  It has more advanced features than Google's official client
-     such as multiple account support, Google Doc conversion, symlink support,
-     and built in sharing.
-
-     There is a 15-day free trial, and it is a paid application after that.
-    '';
-  };
-}

pkgs/applications/networking/jxplorer/default.nix

@@ -0,0 +1,50 @@
+{ lib, stdenv, fetchurl, makeDesktopItem, ant, jdk8, copyDesktopItems, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  pname = "jxplorer";
+  version = "3.3.1.2";
+
+  src = fetchurl {
+    url = "https://github.com/pegacat/jxplorer/releases/download/v${version}/jxplorer-${version}-project.tar.bz2";
+    hash = "sha256-/lWkavH51OqNFSLpgT+4WcQcfW3WvnnOkB03jB7bE/s=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "JXplorer";
+      exec = "jxplorer";
+      comment = "A Java Ldap Browser";
+      desktopName = "JXplorer";
+      genericName = "Java Ldap Browser";
+      icon = "jxplorer";
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -d "$out/opt/jxplorer" "$out/bin" "$out/share/pixmaps"
+    cp -r ./. "$out/opt/jxplorer"
+    install -Dm644 images/JX128.png "$out/share/pixmaps/jxplorer.png"
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    chmod +x $out/opt/jxplorer/jxplorer.sh
+    makeWrapper $out/opt/jxplorer/jxplorer.sh $out/bin/jxplorer \
+      --chdir $out/opt/jxplorer \
+      --set JAVA_HOME ${jdk8}
+  '';
+
+  meta = with lib; {
+    description = "A Java Ldap Browser";
+    homepage    = "https://sourceforge.net/projects/jxplorer/";
+    license     = lib.licenses.caossl;
+    maintainers = with maintainers; [ benwbooth ];
+    platforms   = platforms.linux;
+  };
+}

pkgs/applications/networking/owncloud-client/default.nix

@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "owncloud-client";
-  version = "3.2.1";
+  version = "4.0.0";
 
   libregraph = callPackage ./libre-graph-api-cpp-qt-client.nix { };
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "owncloud";
     repo = "client";
     rev = "refs/tags/v${version}";
-    hash = "sha256-39tpvzlTy3KRxg8DzCQW2VnsaLqJ+dNQRur2TqRZytE=";
+    hash = "sha256-KZ/e8ISQ4FNgT/mtKSlOCa3WQ0lRSaqNIhQn6al6NSM=";
   };
 
   nativeBuildInputs = [ pkg-config cmake extra-cmake-modules wrapQtAppsHook qttools ];
@@ -33,9 +33,6 @@ stdenv.mkDerivation rec {
   cmakeFlags = [
     "-UCMAKE_INSTALL_LIBDIR"
     "-DNO_SHIBBOLETH=1"
-    # https://github.com/owncloud/client/issues/10537#issuecomment-1447965096
-    # NB! From 4.0 it may be turned off by default
-    "-DWITH_AUTO_UPDATER=OFF"
   ];
 
   meta = with lib; {

pkgs/applications/networking/owncloud-client/libre-graph-api-cpp-qt-client.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libre-graph-api-cpp-qt-client";
-  version = "0.13.2";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "owncloud";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-gbrA8P+ukQAiF2czC2szw3fJv1qoPJyMQ72t7PqB5/s=";
+    hash = "sha256-wbdamPi2XSLWeprrYZtBUDH1A2gdp6/5geFZv+ZqSWk=";
   };
 
   sourceRoot = "source/client";

pkgs/applications/science/biology/fastp/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fastp";
-  version = "0.23.2";
+  version = "0.23.3";
 
   src = fetchFromGitHub {
     owner = "OpenGene";
     repo = "fastp";
     rev = "v${version}";
-    sha256 = "sha256-W1mXTfxD7/gHJhao6qqbNcyM3t2cfrUYiBYPJi/O1RI=";
+    sha256 = "sha256-9YHm5LIKJJpMavlWMZXD5ZgTgT5w9eXuXwQVa/prux8=";
   };
 
   buildInputs = [ zlib libdeflate isa-l ];

pkgs/applications/science/biology/truvari/default.nix

@@ -1,5 +1,6 @@
 { lib
 , fetchFromGitHub
+, fetchpatch
 , python3Packages
 , runtimeShell
 , bcftools
@@ -24,6 +25,19 @@ in python3Packages.buildPythonApplication rec {
     hash = "sha256-UJNMKEV5m2jFqnWvkVAtymkcE2TjPIXp7JqRZpMSqsE=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-anno-trf-on-darwin.patch";
+      url = "https://github.com/ACEnglish/truvari/commit/f9f36305e8eaa88f951562210e3672a4d4f71265.patch";
+      hash = "sha256-7O9jTQDCC2b8hUBm0qJQCYMzTC9NFtn/E0dTHSfJALU=";
+    })
+    (fetchpatch {
+      name = "fix-anno-grm-on-darwin.patch";
+      url = "https://github.com/ACEnglish/truvari/commit/31416552008a506204ed4e2add55474f10392357.patch";
+      hash = "sha256-42u0ewZU38GCoSfff+XQFv9hEFeO3WlJufTHcl6vkN4=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace setup.py \
       --replace "rich==" "rich>="

pkgs/applications/science/electronics/fritzing/default.nix

@@ -81,5 +81,6 @@ stdenv.mkDerivation rec {
     license = with licenses; [ gpl3 cc-by-sa-30 ];
     maintainers = with maintainers; [ robberer muscaln ];
     platforms = platforms.linux;
+    mainProgram = "Fritzing";
   };
 }

pkgs/applications/science/math/caffe/default.nix

@@ -84,7 +84,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = lib.optionals pythonSupport (
     # requirements.txt
     let pp = python.pkgs; in ([
-      pp.numpy pp.scipy pp.scikitimage pp.h5py
+      pp.numpy pp.scipy pp.scikit-image pp.h5py
       pp.matplotlib pp.ipython pp.networkx pp.nose
       pp.pandas pp.python-dateutil pp.protobuf pp.gflags
       pp.pyyaml pp.pillow pp.six

pkgs/applications/version-management/git-machete/default.nix

@@ -12,13 +12,13 @@
 
 buildPythonApplication rec {
   pname = "git-machete";
-  version = "3.17.3";
+  version = "3.17.4";
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-XBgYLrbxHE5czcEzYhX4ORQFtyKHcDw3VmZVx2TtycI=";
+    hash = "sha256-g3SEUVcyr6+nt0zMHB1F4drCwmQvPYQErOwSl9I+1Tg=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/applications/version-management/git-mit/default.nix

@@ -0,0 +1,39 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, rustPlatform
+, openssl
+, libgit2
+, libssh2
+, zlib
+, pkg-config
+}:
+
+let
+  version = "5.12.146";
+in
+rustPlatform.buildRustPackage {
+  pname = "git-mit";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "PurpleBooth";
+    repo = "git-mit";
+    rev = "v${version}";
+    hash = "sha256-VN1TbK9wi5Nt2K3yKx2lYSP30zSpwNETQ4OyHj8zxBg=";
+  };
+
+  cargoHash = "sha256-YtUuRLjmehG+5kUiCo4LK0PkKAckr28UahlrAjm9MYw=";
+
+  doCheck = true;
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl libgit2 libssh2 zlib ];
+
+  meta = {
+    description = "Minimalist set of hooks to aid pairing and link commits to issues";
+    homepage = "https://github.com/PurpleBooth/git-mit";
+    license = lib.licenses.cc0;
+  };
+}

pkgs/applications/version-management/gitoxide/default.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitoxide";
-  version = "0.23.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "gitoxide";
     rev = "v${version}";
-    sha256 = "sha256-HmynsnlTj08vwYwckFdq+0u1nquC7bDOGcq2vCeqdhA=";
+    sha256 = "sha256-3U/gQz/tJ/IrDd7ZIusJWDEB4nlpTM4miYfTEeEonv4=";
   };
 
-  cargoHash = "sha256-5JvDqp3dZ9rcOS17YzwgNwJYQGQ021cpd0ClrR+1+5Y=";
+  cargoHash = "sha256-VPOivxdqEWQdFYYhSZVe5ji8CS0dKQeElKPeHxfwg4A=";
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ curl ] ++ (if stdenv.isDarwin

pkgs/applications/version-management/monotone-viz/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ocamlPackages, gnome2, pkg-config, makeWrapper, glib
+{ lib, stdenv, fetchurl, fetchpatch, ocamlPackages, gnome2, pkg-config, makeWrapper, glib
 , libtool, libpng, bison, expat, fontconfig, gd, pango, libjpeg, libwebp, libX11, libXaw
 }:
 # We need an old version of Graphviz for format compatibility reasons.
@@ -23,17 +23,17 @@ stdenv.mkDerivation rec {
   prePatch="ln -s . a; ln -s . b";
   patchFlags = ["-p0"];
   patches = [
-    (fetchurl {
-      url = "https://src.fedoraproject.org/cgit/rpms/monotone-viz.git/plain/monotone-viz-1.0.2-dot.patch";
-      sha256 = "0risfy8iqmkr209hmnvpv57ywbd3rvchzzd0jy2lfyqrrrm6zknw";
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/monotone-viz/raw/c9f4c1bebe01bb471df05d8a37ca4b6d630574ec/f/monotone-viz-1.0.2-dot.patch";
+      hash = "sha256-e348703+IzM4m/3cpe6Z9VebZgTK8+3lRLdaTfXHwSI=";
     })
-    (fetchurl {
-      url = "https://src.fedoraproject.org/cgit/rpms/monotone-viz.git/plain/monotone-viz-1.0.2-new-stdio.patch";
-      sha256 = "16bj0ppzqd45an154dr7sifjra7lv4m9anxfw3c56y763jq7fafa";
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/monotone-viz/raw/c9f4c1bebe01bb471df05d8a37ca4b6d630574ec/f/monotone-viz-1.0.2-new-stdio.patch";
+      hash = "sha256-9xQzJ+oYz06fDFOe1YOOisEZnwiwShqr2Rt7IXiu6Zo=";
     })
-    (fetchurl {
-      url = "https://src.fedoraproject.org/cgit/rpms/monotone-viz.git/plain/monotone-viz-1.0.2-typefix.patch";
-      sha256 = "1gfp82rc7pawb5x4hh2wf7xh1l1l54ib75930xgd1y437la4703r";
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/monotone-viz/raw/c9f4c1bebe01bb471df05d8a37ca4b6d630574ec/f/monotone-viz-1.0.2-typefix.patch";
+      hash = "sha256-52VGXDJKx4ZGvZRO8QCXdTGsWR0m1pqQnEOby7PMQdg=";
     })
   ];
 

pkgs/applications/window-managers/i3/status-rust.nix

@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "i3status-rust";
-  version = "0.31.2";
+  version = "0.31.4";
 
   src = fetchFromGitHub {
     owner = "greshake";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-4lr2ibtBtJYXeeArBK4M35L4CUNqZcUDB+3Nm1kqp4w=";
+    hash = "sha256-+Xd+2MsthH16o0NsB2m5qTfmxIjkVAFdQbqnwm4FRnk=";
   };
 
-  cargoHash = "sha256-5LIXzfYSuHOdxYxfp1eMdxsqyP+3sldBCV0mgv7SRRI=";
+  cargoHash = "sha256-qBUPhAcxl8m+uIrMcuggxlhrD8+JIIauj4vJ/P0yxjc=";
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 

pkgs/applications/window-managers/labwc/default.nix

@@ -27,13 +27,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "labwc";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "labwc";
     repo = "labwc";
     rev = finalAttrs.version;
-    hash = "sha256-yZ1tXx7AA9pFc5C6c/J3B03/TfXw1PsAunNNiee3BGU=";
+    hash = "sha256-d8cbY1NbW5LLKxkoh+PFelPhikDOwBrFt3jfizKSb/0=";
   };
 
   nativeBuildInputs = [

pkgs/development/compilers/nim/default.nix

@@ -148,6 +148,7 @@ in {
       description = "Statically typed, imperative programming language";
       homepage = "https://nim-lang.org/";
       license = licenses.mit;
+      mainProgram = "nim";
       maintainers = with maintainers; [ ehmry ];
     };
   };

pkgs/development/coq-modules/mathcomp/default.nix

@@ -12,7 +12,7 @@
 
 { lib, ncurses, graphviz, lua, fetchzip,
   mkCoqDerivation, recurseIntoAttrs, withDoc ? false, single ? false,
-  coqPackages, coq, version ? null }@args:
+  coqPackages, coq, hierarchy-builder, version ? null }@args:
 with builtins // lib;
 let
   repo  = "math-comp";
@@ -20,6 +20,7 @@ let
   withDoc = single && (args.withDoc or false);
   defaultVersion = with versions; lib.switch coq.coq-version [
       { case = range "8.13" "8.17"; out = "1.16.0"; }
+      { case = range "8.16" "8.17"; out = "2.0.0"; }
       { case = range "8.14" "8.16"; out = "1.15.0"; }
       { case = range "8.11" "8.15"; out = "1.14.0"; }
       { case = range "8.11" "8.15"; out = "1.13.0"; }
@@ -32,6 +33,7 @@ let
       { case = range "8.5" "8.7";   out = "1.6.4";  }
     ] null;
   release = {
+    "2.0.0".sha256 = "sha256-dpOmrHYUXBBS9kmmz7puzufxlbNpIZofpcTvJFLG5DI=";
     "1.16.0".sha256 = "sha256-gXTKhRgSGeRBUnwdDezMsMKbOvxdffT+kViZ9e1gEz0=";
     "1.15.0".sha256 = "1bp0jxl35ms54s0mdqky15w9af03f3i0n06qk12k4gw1xzvwqv21";
     "1.14.0".sha256 = "07yamlp1c0g5nahkd2gpfhammcca74ga2s6qr7a3wm6y6j5pivk9";
@@ -113,13 +115,20 @@ let
          o.version != null && o.version != "dev" && versions.isLt "1.7" o.version)
       { preBuild = ""; buildPhase = ""; installPhase = "echo doing nothing"; }
     );
-    patched-derivation = patched-derivation1.overrideAttrs (o:
+    patched-derivation2 = patched-derivation1.overrideAttrs (o:
       optionalAttrs (versions.isLe "8.7" coq.coq-version ||
             (o.version != "dev" && versions.isLe "1.7" o.version))
       {
         installFlags = o.installFlags ++ [ "-f Makefile.coq" ];
       }
     );
+    patched-derivation = patched-derivation2.overrideAttrs (o:
+      optionalAttrs (o.version != null
+        && (o.version == "dev" || versions.isGe "2.0.0" o.version))
+      {
+        propagatedBuildInputs = o.propagatedBuildInputs ++ [ hierarchy-builder ];
+      }
+    );
     in patched-derivation;
 in
 mathcomp_ (if single then "single" else "all")

pkgs/development/interpreters/clisp/default.nix

@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   inherit libsigsegv gettext coreutils;
 
-  ffcallAvailable = stdenv.isLinux && (libffcall != null);
+  ffcallAvailable = libffcall != null;
 
   buildInputs = [libsigsegv]
   ++ lib.optional (gettext != null) gettext
@@ -101,8 +101,7 @@ stdenv.mkDerivation rec {
     homepage = "http://clisp.cons.org";
     maintainers = lib.teams.lisp.members;
     platforms = lib.platforms.unix;
-    # problems on Darwin: https://github.com/NixOS/nixpkgs/issues/20062
-    broken = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAarch64;
+    broken = stdenv.hostPlatform.isAarch64;
     license = lib.licenses.gpl2;
   };
 }

pkgs/development/interpreters/clisp/hg.nix

@@ -93,6 +93,7 @@ stdenv.mkDerivation rec {
     homepage = "http://clisp.cons.org";
     maintainers = lib.teams.lisp.members;
     # problems on Darwin: https://github.com/NixOS/nixpkgs/issues/20062
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/development/libraries/SDL/default.nix

@@ -89,7 +89,7 @@ stdenv.mkDerivation rec {
     # Ticket: https://bugs.freedesktop.org/show_bug.cgi?id=27222
     (fetchpatch {
       name = "SDL_SetGamma.patch";
-      url = "https://src.fedoraproject.org/cgit/rpms/SDL.git/plain/SDL-1.2.15-x11-Bypass-SetGammaRamp-when-changing-gamma.patch?id=04a3a7b1bd88c2d5502292fad27e0e02d084698d";
+      url = "https://src.fedoraproject.org/rpms/SDL/raw/7a07323e5cec08bea6f390526f86a1ce5341596d/f/SDL-1.2.15-x11-Bypass-SetGammaRamp-when-changing-gamma.patch";
       sha256 = "0x52s4328kilyq43i7psqkqg7chsfwh0aawr50j566nzd7j51dlv";
     })
     # Fix a build failure on OS X Mavericks

pkgs/development/libraries/dbus-cplusplus/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, dbus, glib, pkg-config, expat }:
+{ lib, stdenv, fetchurl, fetchpatch, dbus, glib, pkg-config, expat }:
 
 stdenv.mkDerivation rec {
   pname = "dbus-cplusplus";
@@ -17,23 +17,20 @@ stdenv.mkDerivation rec {
           + "dbus-c++/files/dbus-c++-0.9.0-gcc-4.7.patch";
       sha256 = "0rwcz9pvc13b3yfr0lkifnfz0vb5q6dg240bzgf37ni4s8rpc72g";
     })
-    (fetchurl {
+    (fetchpatch {
       name = "writechar.patch"; # since gcc7
-      url = "https://src.fedoraproject.org/cgit/rpms/dbus-c++.git/plain/"
-          + "dbus-c++-writechar.patch?id=7f371172f5c";
+      url = "https://src.fedoraproject.org/rpms/dbus-c++/raw/9f515ace0594c8b2b9f0d41ffe71bc5b78d30eee/f/dbus-c++-writechar.patch";
       sha256 = "1kkg4gbpm4hp87l25zw2a3r9c58g7vvgzcqgiman734i66zsbb9l";
     })
-    (fetchurl {
+    (fetchpatch {
       name = "threading.patch"; # since gcc7
-      url = "https://src.fedoraproject.org/cgit/rpms/dbus-c++.git/plain/"
-          + "dbus-c++-threading.patch?id=7f371172f5c";
+      url = "https://src.fedoraproject.org/rpms/dbus-c++/raw/9f515ace0594c8b2b9f0d41ffe71bc5b78d30eee/f/dbus-c++-threading.patch";
       sha256 = "1h362anx3wyxm5lq0v8girmip1jmkdbijrmbrq7k5pp47zkhwwrq";
     })
-    (fetchurl {
+    (fetchpatch {
       name = "template-operators.patch"; # since gcc12
-      url = "https://src.fedoraproject.org/cgit/rpms/dbus-c++.git/plain/"
-          + "dbus-c++-template-operators.patch?id=d3f0d8bb519c0af";
-      sha256 = "N25Y7jXDbr0qb7MfRr2yz3zRySppgGOe+oCfNQhRvVc=";
+      url = "https://src.fedoraproject.org/rpms/dbus-c++/raw/9f515ace0594c8b2b9f0d41ffe71bc5b78d30eee/f/dbus-c++-template-operators.patch";
+      hash = "sha256-B8S7z/YH2YEQgaRsBJBBVTx8vHQhHW7z171TZmogpL8=";
     })
   ];
 

pkgs/development/libraries/libosmo-abis/default.nix

@@ -1,39 +0,0 @@
-{ lib, stdenv, fetchgit, autoreconfHook, pkg-config
-, libosmocore, ortp, bctoolbox
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libosmo-abis";
-  version = "1.4.0";
-
-  src = fetchgit {
-    url = "https://gitea.osmocom.org/osmocom/libosmo-abis";
-    rev = version;
-    sha256 = "sha256-RKJis0Ur3Y0LximNQl+hm6GENg8t2E1S++2c+63D2pQ=";
-  };
-
-  postPatch = ''
-    echo "${version}" > .tarball-version
-  '';
-
-  configureFlags = [ "--disable-dahdi" ];
-
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-  ];
-
-  buildInputs = [
-    libosmocore
-    ortp
-    bctoolbox
-  ];
-
-  meta = with lib; {
-    description = "GSM A-bis interface library";
-    homepage = "https://osmocom.org/projects/libosmo-abis";
-    maintainers = [ maintainers.markuskowa ];
-    platforms = platforms.linux;
-    license = licenses.agpl3Only;
-  };
-}

pkgs/development/libraries/libosmo-netif/default.nix

@@ -1,37 +0,0 @@
-{ lib, stdenv, fetchgit, autoreconfHook, pkg-config
-, libosmocore, lksctp-tools
-}:
-
-
-stdenv.mkDerivation rec {
-  pname = "libosmo-netif";
-  version = "1.3.0";
-
-  src = fetchgit {
-    url = "https://gitea.osmocom.org/osmocom/libosmo-netif";
-    rev = version;
-    sha256 = "sha256-PhGi/6JVO8tXxzfGwEKUB/GdrgCJkqROo26TPU+O9Sg=";
-  };
-
-  postPatch = ''
-    echo "${version}" > .tarball-version
-  '';
-
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-  ];
-
-  buildInputs = [
-    libosmocore
-    lksctp-tools
-  ];
-
-  meta = with lib; {
-    description = "Higher-layer GSM cellular communications protocol implementation";
-    homepage = "https://gitea.osmocom.org/osmocom/libosmo-netif";
-    maintainers = [ maintainers.markuskowa ];
-    platforms = platforms.linux;
-    license = licenses.agpl3Only;
-  };
-}

pkgs/development/libraries/libosmo-sccp/default.nix

@@ -1,38 +0,0 @@
-{ lib, stdenv, fetchgit, autoreconfHook, pkg-config
-, libosmocore, libosmo-netif, lksctp-tools
-}:
-
-
-stdenv.mkDerivation rec {
-  pname = "libosmo-sccp";
-  version = "1.7.0";
-
-  src = fetchgit {
-    url = "https://gitea.osmocom.org/osmocom/libosmo-sccp";
-    rev = version;
-    sha256 = "sha256-ScJZke9iNmFc9XXqtRjb24ZzKfa5EYws5PDNhcZFb7U=";
-  };
-
-  postPatch = ''
-    echo "${version}" > .tarball-version
-  '';
-
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-  ];
-
-  buildInputs = [
-    libosmocore
-    libosmo-netif
-    lksctp-tools
-  ];
-
-  meta = with lib; {
-    description = "Implementation of telecom signaling protocols and OsmoSTP";
-    homepage = "https://osmocom.org/projects/osmo-stp/wiki";
-    maintainers = [ maintainers.markuskowa ];
-    platforms = platforms.linux;
-    license = licenses.agpl3Only;
-  };
-}

pkgs/development/libraries/libudev-zero/default.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-SU1pPmLLeTWZe5ybhmDplFw6O/vpEjFAKgfKDl0RS4U=";
   };
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [ "PREFIX=$(out)" "AR=${stdenv.cc.targetPrefix}ar" ];
 
   # Just let the installPhase build stuff, because there's no
   # non-install target that builds everything anyway.

pkgs/development/libraries/openslp/default.nix

@@ -12,12 +12,12 @@ stdenv.mkDerivation rec {
   patches = [
     (fetchpatch {
       name = "openslp-2.0.0-null-pointer-deref.patch";
-      url = "https://src.fedoraproject.org/cgit/rpms/openslp.git/plain/openslp-2.0.0-null-pointer-deref.patch";
+      url = "https://src.fedoraproject.org/rpms/openslp/raw/696fd55ae4fcea7beda0a25131dca8bfb14bbdf9/f/openslp-2.0.0-null-pointer-deref.patch";
       sha256 = "186f3rj3z2lf5h1lpbhqk0szj2a9far1p3mjqg6422f29yjfnz6a";
     })
     (fetchpatch {
       name = "openslp-2.0.0-CVE-2016-7567.patch";
-      url = "https://src.fedoraproject.org/cgit/rpms/openslp.git/plain/openslp-2.0.0-cve-2016-7567.patch";
+      url = "https://src.fedoraproject.org/rpms/openslp/raw/696fd55ae4fcea7beda0a25131dca8bfb14bbdf9/f/openslp-2.0.0-cve-2016-7567.patch";
       sha256 = "0zp61axx93b7nrbsyhn2x4dnw7n9y6g4rys21hyqxk4khrnc2yr9";
     })
     ./CVE-2016-4912.patch

pkgs/development/mobile/androidenv/compose-android-packages.nix

@@ -2,12 +2,12 @@
 , licenseAccepted ? false
 }:
 
-{ cmdLineToolsVersion ? "8.0"
+{ cmdLineToolsVersion ? "9.0"
 , toolsVersion ? "26.1.1"
-, platformToolsVersion ? "33.0.3"
-, buildToolsVersions ? [ "33.0.1" ]
+, platformToolsVersion ? "34.0.1"
+, buildToolsVersions ? [ "33.0.2" ]
 , includeEmulator ? false
-, emulatorVersion ? "31.3.14"
+, emulatorVersion ? "33.1.6"
 , platformVersions ? []
 , includeSources ? false
 , includeSystemImages ? false
@@ -15,7 +15,7 @@
 , abiVersions ? [ "armeabi-v7a" "arm64-v8a" ]
 , cmakeVersions ? [ ]
 , includeNDK ? false
-, ndkVersion ? "25.1.8937393"
+, ndkVersion ? "25.2.9519653"
 , ndkVersions ? [ndkVersion]
 , useGoogleAPIs ? false
 , useGoogleTVAddOns ? false

pkgs/development/mobile/androidenv/examples/shell-with-emulator.nix

@@ -115,7 +115,7 @@ pkgs.mkShell rec {
       echo "installed_packages_section: ''${installed_packages_section}"
 
       packages=(
-        "build-tools;33.0.1" "cmdline-tools;8.0" \
+        "build-tools;33.0.2" "cmdline-tools;9.0" \
         "emulator" "patcher;v4" "platform-tools" "platforms;android-33" \
         "system-images;android-33;google_apis;arm64-v8a" \
         "system-images;android-33;google_apis;x86_64"

pkgs/development/mobile/androidenv/examples/shell.nix

@@ -25,15 +25,15 @@ let
   # versions may be used in multiple places in this Nix expression.
   android = {
     versions = {
-      cmdLineToolsVersion = "8.0";
-      platformTools = "33.0.3";
-      buildTools = "30.0.3";
+      cmdLineToolsVersion = "9.0";
+      platformTools = "34.0.1";
+      buildTools = "33.0.2";
       ndk = [
         "25.1.8937393" # LTS NDK
-        "24.0.8215888"
+        "25.2.9519653"
       ];
-      cmake = "3.22.1";
-      emulator = "31.3.14";
+      cmake = "3.6.4111459";
+      emulator = "33.1.6";
     };
 
     platforms = ["23" "24" "25" "26" "27" "28" "29" "30" "31" "32" "33"];
@@ -165,7 +165,7 @@ pkgs.mkShell rec {
       installed_packages_section=$(echo "''${output%%Available Packages*}" | awk 'NR>4 {print $1}')
 
       packages=(
-        "build-tools;30.0.3" "platform-tools" \
+        "build-tools;33.0.2" "platform-tools" \
         "platforms;android-23" "platforms;android-24" "platforms;android-25" "platforms;android-26" \
         "platforms;android-27" "platforms;android-28" "platforms;android-29" "platforms;android-30" \
         "platforms;android-31" "platforms;android-32" "platforms;android-33" \

pkgs/development/mobile/androidenv/mkrepo.rb

@@ -177,8 +177,8 @@ def empty? value
   !value || value.empty?
 end
 
-# Fixes up returned hashes by sorting keys.
-# Will also convert archives (e.g. {'linux' => {'sha1' => ...}, 'macosx' => ...} to
+# Fixes up returned hashes by converting archives like
+#  (e.g. {'linux' => {'sha1' => ...}, 'macosx' => ...} to
 # [{'os' => 'linux', 'sha1' => ...}, {'os' => 'macosx', ...}, ...].
 def fixup value
   Hash[value.map do |k, v|
@@ -191,7 +191,35 @@ def fixup value
     else
       [k, v]
     end
-  end.sort {|(k1, v1), (k2, v2)| k1 <=> k2 }]
+  end]
+end
+
+# Today since Unix Epoch, January 1, 1970.
+def today
+  Time.now.utc.to_i / 24 / 60 / 60
+end
+
+# The expiration strategy. Expire if the last available day was before the `oldest_valid_day`.
+def expire_records record, oldest_valid_day
+  if record.is_a?(Hash)
+    if record.has_key?('last-available-day') &&
+      record['last-available-day'] < oldest_valid_day
+      return nil
+    end
+    update = {}
+    # This should only happen in the first run of this scrip after adding the `expire_record` function.
+    if record.has_key?('displayName') &&
+      !record.has_key?('last-available-day')
+      update['last-available-day'] = today
+    end
+    record.each {|key, value|
+      v = expire_records value, oldest_valid_day
+      update[key] = v if v
+    }
+    update
+  else
+    record
+  end
 end
 
 # Normalize the specified license text.
@@ -253,6 +281,7 @@ def parse_package_xml doc
     target['dependencies'] ||= dependencies if dependencies
     target['archives'] ||= {}
     merge target['archives'], archives
+    target['last-available-day'] = today
   end
 
   [licenses, packages]
@@ -294,6 +323,7 @@ def parse_image_xml doc
     target['dependencies'] ||= dependencies if dependencies
     target['archives'] ||= {}
     merge target['archives'], archives
+    target['last-available-day'] = today
   end
 
   [licenses, images]
@@ -351,19 +381,36 @@ def parse_addon_xml doc
     target['dependencies'] ||= dependencies if dependencies
     target['archives'] ||= {}
     merge target['archives'], archives
+    target['last-available-day'] = today
   end
 
   [licenses, addons, extras]
 end
 
+# Make the clean diff by always sorting the result before puting it in the stdout.
+def sort_recursively value
+  if value.is_a?(Hash)
+    Hash[
+      value.map do |k, v|
+        [k, sort_recursively(v)]
+      end.sort_by {|(k, v)| k }
+    ]
+  elsif value.is_a?(Array)
+    value.map do |v| sort_recursively(v) end
+  else
+    value
+  end
+end
+
 def merge_recursively a, b
   a.merge!(b) {|key, a_item, b_item|
     if a_item.is_a?(Hash) && b_item.is_a?(Hash)
       merge_recursively(a_item, b_item)
-    else
-      a[key] = b_item
+    elsif b_item != nil
+      b_item
     end
   }
+  a
 end
 
 def merge dest, src
@@ -376,31 +423,55 @@ opts = Slop.parse do |o|
   o.array '-a', '--addons', 'addon repo XMLs to parse'
 end
 
-result = {
-  licenses: {},
-  packages: {},
-  images: {},
-  addons: {},
-  extras: {}
-}
+result = {}
+result['licenses'] = {}
+result['packages'] = {}
+result['images'] = {}
+result['addons'] = {}
+result['extras'] = {}
 
 opts[:packages].each do |filename|
   licenses, packages = parse_package_xml(Nokogiri::XML(File.open(filename)) { |conf| conf.noblanks })
-  merge result[:licenses], licenses
-  merge result[:packages], packages
+  merge result['licenses'], licenses
+  merge result['packages'], packages
 end
 
 opts[:images].each do |filename|
   licenses, images = parse_image_xml(Nokogiri::XML(File.open(filename)) { |conf| conf.noblanks })
-  merge result[:licenses], licenses
-  merge result[:images], images
+  merge result['licenses'], licenses
+  merge result['images'], images
 end
 
 opts[:addons].each do |filename|
   licenses, addons, extras = parse_addon_xml(Nokogiri::XML(File.open(filename)) { |conf| conf.noblanks })
-  merge result[:licenses], licenses
-  merge result[:addons], addons
-  merge result[:extras], extras
+  merge result['licenses'], licenses
+  merge result['addons'], addons
+  merge result['extras'], extras
 end
 
-puts JSON.pretty_generate(fixup(result))
+# As we keep the old packages in the repo JSON file, we should have
+# a strategy to remove them at some point!
+# So with this variable we claim it's okay to remove them from the
+# JSON after two years that they are not available.
+two_years_ago = today - 2 * 365
+
+input = {}
+begin
+  input_json = (STDIN.tty?) ? "{}" : $stdin.read
+  if input_json != nil && !input_json.empty?
+    input =  expire_records(JSON.parse(input_json), two_years_ago)
+  end
+rescue JSON::ParserError => e
+  $stderr.write(e.message)
+  return
+end
+
+
+fixup_result = fixup(result)
+
+# Regular installation of Android SDK would keep the previously installed packages even if they are not
+# in the uptodate XML files, so here we try to support this logic by keeping un-available packages,
+# therefore the old packages will work as long as the links are working on the Google servers.
+output = merge input, fixup_result
+
+puts JSON.pretty_generate(sort_recursively(output))