From b8f083b48f11e8ff5f9dc6fc5972272683c7c021 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stephan=20He=C3=9Felmann?= <shesselm@redhat.com>
Date: Sat, 19 Nov 2022 01:35:49 +0100
Subject: [PATCH 01/52] vals: init at 0.19.0

---
 pkgs/tools/security/vals/default.nix | 37 ++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix      |  2 ++
 2 files changed, 39 insertions(+)
 create mode 100644 pkgs/tools/security/vals/default.nix

diff --git a/pkgs/tools/security/vals/default.nix b/pkgs/tools/security/vals/default.nix
new file mode 100644
index 000000000000..d886908389c3
--- /dev/null
+++ b/pkgs/tools/security/vals/default.nix
@@ -0,0 +1,37 @@
+{ lib, buildGoModule, fetchFromGitHub, testers, vals }:
+
+buildGoModule rec {
+  pname = "vals";
+  version = "0.19.0";
+
+  src = fetchFromGitHub {
+    rev = "v${version}";
+    owner = "variantdev";
+    repo = pname;
+    sha256 = "sha256-0TO8aN1qKpGQnec6hKph6EHkRWb1dfHtyRdFYX0BjM0=";
+  };
+
+  vendorSha256 = "sha256-wxM8g553DCkoL09Icz+HoXB98z1f6mm4qzk01k09++0=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${version}"
+  ];
+
+  # Tests require connectivity to various backends.
+  doCheck = false;
+
+  passthru.tests.version = testers.testVersion {
+    package = vals;
+    command = "vals version";
+  };
+
+  meta = with lib; {
+    description = "Helm-like configuration values loader with support for various sources";
+    license = licenses.asl20;
+    homepage = "https://github.com/variantdev/vals";
+    changelog = "https://github.com/variantdev/vals/releases/v${version}";
+    maintainers = with maintainers; [ stehessel ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 41ff5fb69f59..57381cad91a4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12871,6 +12871,8 @@ with pkgs;
 
   urlwatch = callPackage ../tools/networking/urlwatch { };
 
+  vals = callPackage ../tools/security/vals { };
+
   valum = callPackage ../development/web/valum { };
 
   inherit (callPackages ../servers/varnish { })

From df2c438cece32e6f1f4e9f41940b856371e27d75 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Stephan=20He=C3=9Felmann?= <shesselm@redhat.com>
Date: Wed, 30 Nov 2022 00:06:46 +0100
Subject: [PATCH 02/52] rhoas: init at 0.51.7

---
 pkgs/tools/admin/rhoas/default.nix | 46 ++++++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix    |  2 ++
 2 files changed, 48 insertions(+)
 create mode 100644 pkgs/tools/admin/rhoas/default.nix

diff --git a/pkgs/tools/admin/rhoas/default.nix b/pkgs/tools/admin/rhoas/default.nix
new file mode 100644
index 000000000000..d88cedf81ad4
--- /dev/null
+++ b/pkgs/tools/admin/rhoas/default.nix
@@ -0,0 +1,46 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles, testers, rhoas }:
+
+buildGoModule rec {
+  pname = "rhoas";
+  version = "0.51.7";
+
+  src = fetchFromGitHub {
+    owner = "redhat-developer";
+    repo = "app-services-cli";
+    rev = "v${version}";
+    sha256 = "sha256-sgAr9v3nkMZ8linvR5AhYZV0NQuVqMnueGOo/KLqPc0=";
+  };
+
+  vendorSha256 = null;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/redhat-developer/app-services-cli/internal/build.Version=${version}"
+  ];
+
+  nativeBuildInputs = [installShellFiles];
+
+  # Networking tests fail.
+  doCheck = false;
+
+  postInstall = ''
+    installShellCompletion --cmd rhoas \
+      --bash <($out/bin/rhoas completion bash) \
+      --fish <($out/bin/rhoas completion fish) \
+      --zsh <($out/bin/rhoas completion zsh)
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = rhoas;
+    command = "HOME=$TMP rhoas version";
+  };
+
+  meta = with lib; {
+    description = "Command Line Interface for Red Hat OpenShift Application Services";
+    license = licenses.asl20;
+    homepage = "https://github.com/redhat-developer/app-services-cli";
+    changelog = "https://github.com/redhat-developer/app-services-cli/releases/v${version}";
+    maintainers = with maintainers; [stehessel];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f7a1949c7b5f..e02ee4503f67 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11050,6 +11050,8 @@ with pkgs;
 
   rhash = callPackage ../tools/security/rhash { };
 
+  rhoas = callPackage ../tools/admin/rhoas { };
+
   riemann_c_client = callPackage ../tools/misc/riemann-c-client { };
   riemann-tools = callPackage ../tools/misc/riemann-tools { };
 

From 7de32b0ce90bc507479ce6a4d83602c51e9eeb47 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andreas=20St=C3=BChrk?= <andy@hammerhartes.de>
Date: Fri, 25 Nov 2022 17:40:42 +0100
Subject: [PATCH 03/52] sgx-azure-dcap-client: init at 1.11.2

---
 .../linux/sgx/azure-dcap-client/default.nix   | 88 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 90 insertions(+)
 create mode 100644 pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix

diff --git a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
new file mode 100644
index 000000000000..ce0a20de329c
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
@@ -0,0 +1,88 @@
+{ stdenv
+, fetchFromGitHub
+, fetchurl
+, lib
+, curl
+, nlohmann_json
+, openssl
+, pkg-config
+, linkFarmFromDrvs
+}:
+
+let
+  # Although those headers are also included in the source of `sgx-psw`, the `azure-dcap-client` build needs specific versions
+  filterSparse = list: ''
+    cp -r "$out"/. .
+    find "$out" -mindepth 1 -delete
+    cp ${lib.concatStringsSep " " list} "$out/"
+  '';
+  headers = linkFarmFromDrvs "azure-dcpa-client-intel-headers" [
+    (fetchFromGitHub rec {
+      name = "${repo}-headers";
+      owner = "intel";
+      repo = "SGXDataCenterAttestationPrimitives";
+      rev = "0436284f12f1bd5da7e7a06f6274d36b4c8d39f9";
+      sparseCheckout = [ "QuoteGeneration/quote_wrapper/common/inc/sgx_ql_lib_common.h" ];
+      hash = "sha256-ipKpYHbiwjCUXF/pCArJZy5ko1YX2wqMMdSnMUzhkgY=";
+      postFetch = filterSparse sparseCheckout;
+    })
+    (fetchFromGitHub rec {
+      name = "${repo}-headers";
+      owner = "intel";
+      repo = "linux-sgx";
+      rev = "1ccf25b64abd1c2eff05ead9d14b410b3c9ae7be";
+      hash = "sha256-WJRoS6+NBVJrFmHABEEDpDhW+zbWFUl65AycCkRavfs=";
+      sparseCheckout = [
+        "common/inc/sgx_report.h"
+        "common/inc/sgx_key.h"
+        "common/inc/sgx_attributes.h"
+      ];
+      postFetch = filterSparse sparseCheckout;
+    })
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "azure-dcap-client";
+  version = "1.11.2";
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = pname;
+    rev = version;
+    hash = "sha256-EYj3jnzTyJRl6N7avNf9VrB8r9U6zIE6wBNeVsMtWCA=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    curl
+    nlohmann_json
+    openssl
+  ];
+
+  postPatch = ''
+    mkdir -p src/Linux/ext/intel
+    find -L '${headers}' -type f -exec ln -s {} src/Linux/ext/intel \;
+
+    substitute src/Linux/Makefile{.in,} \
+      --replace '##CURLINC##' '${curl.dev}/include/curl/' \
+      --replace '$(TEST_SUITE): $(PROVIDER_LIB) $(TEST_SUITE_OBJ)' '$(TEST_SUITE): $(TEST_SUITE_OBJ)'
+  '';
+
+  NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations";
+
+  makeFlags = [
+    "-C src/Linux"
+    "prefix=$(out)"
+  ];
+
+  meta = with lib; {
+    description = "Interfaces between SGX SDKs and the Azure Attestation SGX Certification Cache";
+    homepage = "https://github.com/microsoft/azure-dcap-client";
+    maintainers = with maintainers; [ trundle veehaitch ];
+    platforms = [ "x86_64-linux" ];
+    license = [ licenses.mit ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 28ceea8c98bf..dd6d12eb346b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -25808,6 +25808,8 @@ with pkgs;
 
   seturgent = callPackage ../os-specific/linux/seturgent { };
 
+  sgx-azure-dcap-client = callPackage ../os-specific/linux/sgx/azure-dcap-client { };
+
   sgx-sdk = callPackage ../os-specific/linux/sgx/sdk { };
 
   sgx-ssl = callPackage ../os-specific/linux/sgx/ssl { };

From da0dc8339ceca52b962d91e56d8764fcdc0ecdd8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Andreas=20St=C3=BChrk?= <andy@hammerhartes.de>
Date: Fri, 25 Nov 2022 19:20:39 +0100
Subject: [PATCH 04/52] nixos/aesmd: add option to configure quote provider
 library

Changes sgx-psw to append `aesm` to `LD_LIBRARY_PATH`:
- Append instead of prepend to allow for overriding in service config
- As we already add a wrapper to add `aesm` to `LD_LIBRARY_PATH` it is
  not necessary to also set in `LD_LIBRARY_PATH` of the systemd service.

Co-authored-by: Vincent Haupert <mail@vincent-haupert.de>
---
 nixos/modules/services/security/aesmd.nix  |  9 ++-
 nixos/tests/aesmd.nix                      | 87 +++++++++++++++-------
 nixos/tests/all-tests.nix                  |  2 +-
 pkgs/os-specific/linux/sgx/psw/default.nix |  2 +-
 4 files changed, 68 insertions(+), 32 deletions(-)

diff --git a/nixos/modules/services/security/aesmd.nix b/nixos/modules/services/security/aesmd.nix
index 7b0a46d6d029..f44dcb0de8ac 100644
--- a/nixos/modules/services/security/aesmd.nix
+++ b/nixos/modules/services/security/aesmd.nix
@@ -25,6 +25,12 @@ in
       default = false;
       description = lib.mdDoc "Whether to build the PSW package in debug mode.";
     };
+    quoteProviderLibrary = mkOption {
+      type = with types; nullOr path;
+      default = null;
+      example = literalExpression "pkgs.sgx-azure-dcap-client";
+      description = lib.mdDoc "Custom quote provider library to use.";
+    };
     settings = mkOption {
       description = lib.mdDoc "AESM configuration";
       default = { };
@@ -83,7 +89,6 @@ in
         storeAesmFolder = "${sgx-psw}/aesm";
         # Hardcoded path AESM_DATA_FOLDER in psw/ae/aesm_service/source/oal/linux/aesm_util.cpp
         aesmDataFolder = "/var/opt/aesmd/data";
-        aesmStateDirSystemd = "%S/aesmd";
       in
       {
         description = "Intel Architectural Enclave Service Manager";
@@ -98,7 +103,7 @@ in
         environment = {
           NAME = "aesm_service";
           AESM_PATH = storeAesmFolder;
-          LD_LIBRARY_PATH = storeAesmFolder;
+          LD_LIBRARY_PATH = makeLibraryPath [ cfg.quoteProviderLibrary ];
         };
 
         # Make sure any of the SGX application enclave devices is available
diff --git a/nixos/tests/aesmd.nix b/nixos/tests/aesmd.nix
index 5da661afd548..c1b7232bb24a 100644
--- a/nixos/tests/aesmd.nix
+++ b/nixos/tests/aesmd.nix
@@ -1,7 +1,7 @@
 { pkgs, lib, ... }: {
   name = "aesmd";
   meta = {
-    maintainers = with lib.maintainers; [ veehaitch ];
+    maintainers = with lib.maintainers; [ trundle veehaitch ];
   };
 
   nodes.machine = { lib, ... }: {
@@ -25,38 +25,69 @@
 
     # We don't have a real SGX machine in NixOS tests
     systemd.services.aesmd.unitConfig.AssertPathExists = lib.mkForce [ ];
+
+    specialisation = {
+      withQuoteProvider.configuration = { ... }: {
+        services.aesmd.quoteProviderLibrary = pkgs.sgx-azure-dcap-client;
+      };
+    };
   };
 
-  testScript = ''
-    with subtest("aesmd.service starts"):
-      machine.wait_for_unit("aesmd.service")
-      status, main_pid = machine.systemctl("show --property MainPID --value aesmd.service")
-      assert status == 0, "Could not get MainPID of aesmd.service"
-      main_pid = main_pid.strip()
+  testScript = { nodes, ... }:
+    let
+      specialisations = "${nodes.machine.system.build.toplevel}/specialisation";
+    in
+    ''
+      def get_aesmd_pid():
+        status, main_pid = machine.systemctl("show --property MainPID --value aesmd.service")
+        assert status == 0, "Could not get MainPID of aesmd.service"
+        return main_pid.strip()
 
-    with subtest("aesmd.service runtime directory permissions"):
-      runtime_dir = "/run/aesmd";
-      res = machine.succeed(f"stat -c '%a %U %G' {runtime_dir}").strip()
-      assert "750 aesmd sgx" == res, f"{runtime_dir} does not have the expected permissions: {res}"
+      with subtest("aesmd.service starts"):
+        machine.wait_for_unit("aesmd.service")
 
-    with subtest("aesm.socket available on host"):
-      socket_path = "/var/run/aesmd/aesm.socket"
-      machine.wait_until_succeeds(f"test -S {socket_path}")
-      machine.succeed(f"test 777 -eq $(stat -c '%a' {socket_path})")
-      for op in [ "-r", "-w", "-x" ]:
-        machine.succeed(f"sudo -u sgxtest test {op} {socket_path}")
-        machine.fail(f"sudo -u nosgxtest test {op} {socket_path}")
+      main_pid = get_aesmd_pid()
 
-    with subtest("Copies white_list_cert_to_be_verify.bin"):
-      whitelist_path = "/var/opt/aesmd/data/white_list_cert_to_be_verify.bin"
-      whitelist_perms = machine.succeed(
-        f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/stat -c '%a' {whitelist_path}"
-      ).strip()
-      assert "644" == whitelist_perms, f"white_list_cert_to_be_verify.bin has permissions {whitelist_perms}"
+      with subtest("aesmd.service runtime directory permissions"):
+        runtime_dir = "/run/aesmd";
+        res = machine.succeed(f"stat -c '%a %U %G' {runtime_dir}").strip()
+        assert "750 aesmd sgx" == res, f"{runtime_dir} does not have the expected permissions: {res}"
 
-    with subtest("Writes and binds aesm.conf in service namespace"):
-      aesmd_config = machine.succeed(f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/cat /etc/aesmd.conf")
+      with subtest("aesm.socket available on host"):
+        socket_path = "/var/run/aesmd/aesm.socket"
+        machine.wait_until_succeeds(f"test -S {socket_path}")
+        machine.succeed(f"test 777 -eq $(stat -c '%a' {socket_path})")
+        for op in [ "-r", "-w", "-x" ]:
+          machine.succeed(f"sudo -u sgxtest test {op} {socket_path}")
+          machine.fail(f"sudo -u nosgxtest test {op} {socket_path}")
 
-      assert aesmd_config == "whitelist url = http://nixos.org\nproxy type = direct\ndefault quoting type = ecdsa_256\n", "aesmd.conf differs"
-  '';
+      with subtest("Copies white_list_cert_to_be_verify.bin"):
+        whitelist_path = "/var/opt/aesmd/data/white_list_cert_to_be_verify.bin"
+        whitelist_perms = machine.succeed(
+          f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/stat -c '%a' {whitelist_path}"
+        ).strip()
+        assert "644" == whitelist_perms, f"white_list_cert_to_be_verify.bin has permissions {whitelist_perms}"
+
+      with subtest("Writes and binds aesm.conf in service namespace"):
+        aesmd_config = machine.succeed(f"nsenter -m -t {main_pid} ${pkgs.coreutils}/bin/cat /etc/aesmd.conf")
+
+        assert aesmd_config == "whitelist url = http://nixos.org\nproxy type = direct\ndefault quoting type = ecdsa_256\n", "aesmd.conf differs"
+
+      with subtest("aesmd.service without quote provider library has correct LD_LIBRARY_PATH"):
+        status, environment = machine.systemctl("show --property Environment --value aesmd.service")
+        assert status == 0, "Could not get Environment of aesmd.service"
+        env_by_name = dict(entry.split("=", 1) for entry in environment.split())
+        assert not env_by_name["LD_LIBRARY_PATH"], "LD_LIBRARY_PATH is not empty"
+
+      with subtest("aesmd.service with quote provider library starts"):
+        machine.succeed('${specialisations}/withQuoteProvider/bin/switch-to-configuration test')
+        machine.wait_for_unit("aesmd.service")
+
+      main_pid = get_aesmd_pid()
+
+      with subtest("aesmd.service with quote provider library has correct LD_LIBRARY_PATH"):
+        ld_library_path = machine.succeed(f"xargs -0 -L1 -a /proc/{main_pid}/environ | grep LD_LIBRARY_PATH")
+        assert ld_library_path.startswith("LD_LIBRARY_PATH=${pkgs.sgx-azure-dcap-client}/lib:"), \
+          "LD_LIBRARY_PATH is not set to the configured quote provider library"
+    '';
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 726884d7cd9c..423c834e708d 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -69,7 +69,7 @@ in {
   _3proxy = runTest ./3proxy.nix;
   acme = runTest ./acme.nix;
   adguardhome = runTest ./adguardhome.nix;
-  aesmd = runTest ./aesmd.nix;
+  aesmd = runTestOn ["x86_64-linux"] ./aesmd.nix;
   agate = runTest ./web-servers/agate.nix;
   agda = handleTest ./agda.nix {};
   airsonic = handleTest ./airsonic.nix {};
diff --git a/pkgs/os-specific/linux/sgx/psw/default.nix b/pkgs/os-specific/linux/sgx/psw/default.nix
index 2077d23bc9d7..ba2d0967e45d 100644
--- a/pkgs/os-specific/linux/sgx/psw/default.nix
+++ b/pkgs/os-specific/linux/sgx/psw/default.nix
@@ -121,7 +121,7 @@ stdenv.mkDerivation rec {
 
     mkdir $out/bin
     makeWrapper $out/aesm/aesm_service $out/bin/aesm_service \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ protobuf ]}:$out/aesm \
+      --suffix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ protobuf ]}:$out/aesm \
       --chdir "$out/aesm"
 
     # Make sure we didn't forget to handle any files

From 4e937f0d6b8f5f5e34d2215a3d71620a8e89fa13 Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Tue, 29 Nov 2022 15:19:01 +0100
Subject: [PATCH 05/52] sgx-azure-quote-provider: add test-suite derivation

---
 .../linux/sgx/azure-dcap-client/default.nix   |  5 ++++
 .../sgx/azure-dcap-client/test-suite.nix      | 27 +++++++++++++++++++
 2 files changed, 32 insertions(+)
 create mode 100644 pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix

diff --git a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
index ce0a20de329c..5440e4175351 100644
--- a/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
+++ b/pkgs/os-specific/linux/sgx/azure-dcap-client/default.nix
@@ -7,6 +7,7 @@
 , openssl
 , pkg-config
 , linkFarmFromDrvs
+, callPackage
 }:
 
 let
@@ -78,6 +79,10 @@ stdenv.mkDerivation rec {
     "prefix=$(out)"
   ];
 
+  # Online test suite; run with
+  # $(nix-build -A sgx-azure-dcap-client.tests.suite)/bin/tests
+  passthru.tests.suite = callPackage ./test-suite.nix { };
+
   meta = with lib; {
     description = "Interfaces between SGX SDKs and the Azure Attestation SGX Certification Cache";
     homepage = "https://github.com/microsoft/azure-dcap-client";
diff --git a/pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix b/pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix
new file mode 100644
index 000000000000..71fdb2bab39c
--- /dev/null
+++ b/pkgs/os-specific/linux/sgx/azure-dcap-client/test-suite.nix
@@ -0,0 +1,27 @@
+{ lib
+, sgx-azure-dcap-client
+, gtest
+, makeWrapper
+}:
+sgx-azure-dcap-client.overrideAttrs (oldAttrs: {
+  nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [
+    makeWrapper
+    gtest
+  ];
+
+  buildFlags = [
+    "tests"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D ./src/Linux/tests "$out/bin/tests"
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    wrapProgram "$out/bin/tests" --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ sgx-azure-dcap-client ]}"
+  '';
+})

From dbff3c22c156de370cd8771688651becd62cab6b Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Tue, 29 Nov 2022 16:25:11 +0100
Subject: [PATCH 06/52] nixos/aesmd: add option `environment`

---
 nixos/modules/services/security/aesmd.nix | 12 +++++++++++-
 nixos/tests/aesmd.nix                     | 11 ++++++++++-
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/security/aesmd.nix b/nixos/modules/services/security/aesmd.nix
index f44dcb0de8ac..8b3f010d7c4d 100644
--- a/nixos/modules/services/security/aesmd.nix
+++ b/nixos/modules/services/security/aesmd.nix
@@ -25,6 +25,16 @@ in
       default = false;
       description = lib.mdDoc "Whether to build the PSW package in debug mode.";
     };
+    environment = mkOption {
+      type = with types; attrsOf str;
+      default = { };
+      description = mdDoc "Additional environment variables to pass to the AESM service.";
+      # Example environment variable for `sgx-azure-dcap-client` provider library
+      example = {
+        AZDCAP_COLLATERAL_VERSION = "v2";
+        AZDCAP_DEBUG_LOG_LEVEL = "INFO";
+      };
+    };
     quoteProviderLibrary = mkOption {
       type = with types; nullOr path;
       default = null;
@@ -104,7 +114,7 @@ in
           NAME = "aesm_service";
           AESM_PATH = storeAesmFolder;
           LD_LIBRARY_PATH = makeLibraryPath [ cfg.quoteProviderLibrary ];
-        };
+        } // cfg.environment;
 
         # Make sure any of the SGX application enclave devices is available
         unitConfig.AssertPathExists = [
diff --git a/nixos/tests/aesmd.nix b/nixos/tests/aesmd.nix
index c1b7232bb24a..848e1c599201 100644
--- a/nixos/tests/aesmd.nix
+++ b/nixos/tests/aesmd.nix
@@ -28,7 +28,12 @@
 
     specialisation = {
       withQuoteProvider.configuration = { ... }: {
-        services.aesmd.quoteProviderLibrary = pkgs.sgx-azure-dcap-client;
+        services.aesmd = {
+          quoteProviderLibrary = pkgs.sgx-azure-dcap-client;
+          environment = {
+            AZDCAP_DEBUG_LOG_LEVEL = "INFO";
+          };
+        };
       };
     };
   };
@@ -89,5 +94,9 @@
         ld_library_path = machine.succeed(f"xargs -0 -L1 -a /proc/{main_pid}/environ | grep LD_LIBRARY_PATH")
         assert ld_library_path.startswith("LD_LIBRARY_PATH=${pkgs.sgx-azure-dcap-client}/lib:"), \
           "LD_LIBRARY_PATH is not set to the configured quote provider library"
+
+      with subtest("aesmd.service with quote provider library has set AZDCAP_DEBUG_LOG_LEVEL"):
+        azdcp_debug_log_level = machine.succeed(f"xargs -0 -L1 -a /proc/{main_pid}/environ | grep AZDCAP_DEBUG_LOG_LEVEL")
+        assert azdcp_debug_log_level == "AZDCAP_DEBUG_LOG_LEVEL=INFO\n", "AZDCAP_DEBUG_LOG_LEVEL is not set to INFO"
     '';
 }

From 8909db923f2b826bb4482fba46f7a6d798c6240c Mon Sep 17 00:00:00 2001
From: Vincent Haupert <mail@vincent-haupert.de>
Date: Tue, 20 Dec 2022 13:06:45 +0100
Subject: [PATCH 07/52] azure-static-sites-client: init at 1.0.021731

---
 .../azure-static-sites-client/default.nix     | 97 +++++++++++++++++++
 .../tools/azure-static-sites-client/update.sh |  9 ++
 .../azure-static-sites-client/versions.json   | 59 +++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 4 files changed, 167 insertions(+)
 create mode 100644 pkgs/development/tools/azure-static-sites-client/default.nix
 create mode 100755 pkgs/development/tools/azure-static-sites-client/update.sh
 create mode 100644 pkgs/development/tools/azure-static-sites-client/versions.json

diff --git a/pkgs/development/tools/azure-static-sites-client/default.nix b/pkgs/development/tools/azure-static-sites-client/default.nix
new file mode 100644
index 000000000000..60d151147251
--- /dev/null
+++ b/pkgs/development/tools/azure-static-sites-client/default.nix
@@ -0,0 +1,97 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, curl
+, icu70
+, libkrb5
+, lttng-ust
+, openssl_1_1
+, zlib
+, azure-static-sites-client
+  # "latest", "stable" or "backup"
+, versionFlavor ? "stable"
+}:
+let
+  versions = lib.importJSON ./versions.json;
+  flavor = with lib; head (filter (x: x.version == versionFlavor) versions);
+  fetchBinary = runtimeId: fetchurl {
+    url = flavor.files.${runtimeId}.url;
+    sha256 = flavor.files.${runtimeId}.sha;
+  };
+  sources = {
+    "x86_64-linux" = fetchBinary "linux-x64";
+    "x86_64-darwin" = fetchBinary "macOS";
+  };
+in
+stdenv.mkDerivation {
+  pname = "StaticSitesClient-${versionFlavor}";
+  version = flavor.buildId;
+
+  src = sources.${stdenv.targetPlatform.system} or (throw "Unsupported platform");
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    curl
+    icu70
+    openssl_1_1
+    libkrb5
+    lttng-ust
+    stdenv.cc.cc.lib
+    zlib
+  ];
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -m755 "$src" -D "$out/bin/StaticSitesClient"
+
+    for icu_lib in 'icui18n' 'icuuc' 'icudata'; do
+      patchelf --add-needed "lib''${icu_lib}.so.${with lib; head (splitVersion (getVersion icu70.name))}" "$out/bin/StaticSitesClient"
+    done
+
+    patchelf --add-needed 'libgssapi_krb5.so' \
+             --add-needed 'liblttng-ust.so'   \
+             --add-needed 'libssl.so.1.1'     \
+             "$out/bin/StaticSitesClient"
+
+    runHook postInstall
+  '';
+
+  # Stripping kills the binary
+  dontStrip = true;
+
+  # Just make sure the binary executes sucessfully
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $out/bin/StaticSitesClient version
+
+    runHook postInstallCheck
+  '';
+
+  passthru = {
+    # Create tests for all flavors
+    tests = with lib; genAttrs (map (x: x.version) versions) (versionFlavor:
+      azure-static-sites-client.override { inherit versionFlavor; }
+    );
+    updateScript = ./update.sh;
+  };
+
+  meta = with lib; {
+    description = "Azure static sites client";
+    homepage = "https://github.com/Azure/static-web-apps-cli";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = licenses.unfree;
+    mainProgram = "StaticSitesClient";
+    maintainers = with maintainers; [ veehaitch ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
diff --git a/pkgs/development/tools/azure-static-sites-client/update.sh b/pkgs/development/tools/azure-static-sites-client/update.sh
new file mode 100755
index 000000000000..156771e7f12b
--- /dev/null
+++ b/pkgs/development/tools/azure-static-sites-client/update.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl
+
+set -euo pipefail
+
+dirname="$(dirname "$0")"
+
+curl -O --silent --output-dir "$dirname" 'https://swalocaldeploy.azureedge.net/downloads/versions.json'
+echo "" >> "$dirname/versions.json"
diff --git a/pkgs/development/tools/azure-static-sites-client/versions.json b/pkgs/development/tools/azure-static-sites-client/versions.json
new file mode 100644
index 000000000000..0cb5de090269
--- /dev/null
+++ b/pkgs/development/tools/azure-static-sites-client/versions.json
@@ -0,0 +1,59 @@
+[
+  {
+    "version": "latest",
+    "buildId": "1.0.021731",
+    "publishDate": "2022-12-14T02:22:20.0230853Z",
+    "files": {
+      "linux-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021731/linux/StaticSitesClient",
+        "sha": "d2f88cf8b855169534c7e330dd95385b993b1c0f83331306e685faa8468a82b5"
+      },
+      "win-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021731/windows/StaticSitesClient.exe",
+        "sha": "525d13ebffd79ea9663a15a4bd2e6d49bca72d20aa44838aa4b83133943d450c"
+      },
+      "osx-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021731/macOS/StaticSitesClient",
+        "sha": "5de3ac4b205d3871e7a8ff3b5869f2a57002277ac7fa6317032239d114e25ab8"
+      }
+    }
+  },
+  {
+    "version": "stable",
+    "buildId": "1.0.021731",
+    "publishDate": "2022-12-14T02:22:20.0230853Z",
+    "files": {
+      "linux-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021731/linux/StaticSitesClient",
+        "sha": "d2f88cf8b855169534c7e330dd95385b993b1c0f83331306e685faa8468a82b5"
+      },
+      "win-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021731/windows/StaticSitesClient.exe",
+        "sha": "525d13ebffd79ea9663a15a4bd2e6d49bca72d20aa44838aa4b83133943d450c"
+      },
+      "osx-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021731/macOS/StaticSitesClient",
+        "sha": "5de3ac4b205d3871e7a8ff3b5869f2a57002277ac7fa6317032239d114e25ab8"
+      }
+    }
+  },
+  {
+    "version": "backup",
+    "buildId": "1.0.021671",
+    "publishDate": "2022-12-08T00:34:47.6310685Z",
+    "files": {
+      "linux-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021671/linux/StaticSitesClient",
+        "sha": "306c2d24cbc6461cdf1fe29e9206ccb9d452ba3514ee9d67a1d7e0f8edbc036f"
+      },
+      "win-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021671/windows/StaticSitesClient.exe",
+        "sha": "ee868ca5e73a6ad8758698c168bb01d07b66288d353813fefe41d441f82b9f1f"
+      },
+      "osx-x64": {
+        "url": "https://swalocaldeploy.azureedge.net/downloads/1.0.021671/macOS/StaticSitesClient",
+        "sha": "5ef513530a45d4b8e135e272f7e7112e900fbb8c8137c19e645a694e71b98c74"
+      }
+    }
+  }
+]
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0b93e6734821..26f033cf6046 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2667,6 +2667,8 @@ with pkgs;
 
   azure-functions-core-tools = callPackage ../development/tools/azure-functions-core-tools { };
 
+  azure-static-sites-client = callPackage ../development/tools/azure-static-sites-client { };
+
   azure-storage-azcopy = callPackage ../development/tools/azcopy { };
 
   bashblog = callPackage ../tools/text/bashblog { };

From d2df783515f9c3fe41a91d78ddc927131c10b540 Mon Sep 17 00:00:00 2001
From: Rouven Czerwinski <rouven@czerwinskis.de>
Date: Thu, 15 Dec 2022 07:16:23 +0100
Subject: [PATCH 08/52] xwayland: 22.1.6 -> 22.1.7

Changelog: https://lists.x.org/archives/xorg-announce/2022-December/003309.html
---
 pkgs/servers/x11/xorg/xwayland.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/x11/xorg/xwayland.nix b/pkgs/servers/x11/xorg/xwayland.nix
index 22e224013617..ae3025461449 100644
--- a/pkgs/servers/x11/xorg/xwayland.nix
+++ b/pkgs/servers/x11/xorg/xwayland.nix
@@ -43,11 +43,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xwayland";
-  version = "22.1.6";
+  version = "22.1.7";
 
   src = fetchurl {
     url = "mirror://xorg/individual/xserver/${pname}-${version}.tar.xz";
-    sha256 = "sha256-nkJD8D0A/RJDWu4520zhBx/EeG/8UlR+igemWrVbDnw=";
+    sha256 = "sha256-1Tr6xscZU/XPZtA9KJ2s2JYdpb0wnB3/El1ZVdnbX3Y=";
   };
 
   depsBuildBuild = [

From bf1e0e82a38277c5a7c122d35b8047e7a8b0d5a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cyryl=20P=C5=82otnicki?= <cyplo@cyplo.dev>
Date: Thu, 22 Dec 2022 15:23:40 +0000
Subject: [PATCH 09/52] fheroes2: 0.9.21 -> 1.0.0

---
 pkgs/games/fheroes2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/games/fheroes2/default.nix b/pkgs/games/fheroes2/default.nix
index 7d3123b3eb93..e1b15b6248f4 100644
--- a/pkgs/games/fheroes2/default.nix
+++ b/pkgs/games/fheroes2/default.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fheroes2";
-  version = "0.9.21";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "ihhub";
     repo = "fheroes2";
     rev = version;
-    sha256 = "sha256-b4OAuwMgVgZUdLWJp6Rv/+1X+rPcG7piIBk8SlEXoUY=";
+    sha256 = "sha256-86+4rFSvJ3xIVx+qDXZ65TSqIrPkbyoLNo1A+mFPdy8=";
   };
 
   buildInputs = [ gettext glibcLocalesUtf8 libpng SDL2 SDL2_image SDL2_mixer SDL2_ttf zlib ];

From c8408ba0683d18da93c9d17ad28b3a319c62fce0 Mon Sep 17 00:00:00 2001
From: Adam Stephens <adam@valkor.net>
Date: Fri, 23 Dec 2022 11:20:14 -0500
Subject: [PATCH 10/52] caffd2 squeezelite: 1.9.9.1414 -> 1.9.9.1419

---
 pkgs/applications/audio/squeezelite/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/audio/squeezelite/default.nix b/pkgs/applications/audio/squeezelite/default.nix
index dad4402e2d46..19b72d1c3788 100644
--- a/pkgs/applications/audio/squeezelite/default.nix
+++ b/pkgs/applications/audio/squeezelite/default.nix
@@ -34,13 +34,13 @@ stdenv.mkDerivation {
   pname = binName;
   # versions are specified in `squeezelite.h`
   # see https://github.com/ralph-irving/squeezelite/issues/29
-  version = "1.9.9.1414";
+  version = "1.9.9.1419";
 
   src = fetchFromGitHub {
     owner = "ralph-irving";
     repo = "squeezelite";
-    rev = "dbe69eb8aa88f644cfb46541d6cef72fa666570d";
-    hash = "sha256-BN6eBHMMecucfHwzmho3xi1l2O3YnYcBUE321Rl6xrc=";
+    rev = "226efa300c4cf037e8486bad635e9deb3104636f";
+    hash = "sha256-ZZWliw1prFbBZMFp0QmXg6MKuHPNuFh2lFxQ8bbuWAM=";
   };
 
   buildInputs = [ flac libmad libvorbis mpg123 ]

From 0690e63c82ad4c5b75a14db2a450139ba1f4995d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 23 Dec 2022 17:00:03 +0000
Subject: [PATCH 11/52] vttest: 20220827 -> 20221111

---
 pkgs/tools/misc/vttest/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/misc/vttest/default.nix b/pkgs/tools/misc/vttest/default.nix
index 33091b418118..0f3096cc4b06 100644
--- a/pkgs/tools/misc/vttest/default.nix
+++ b/pkgs/tools/misc/vttest/default.nix
@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vttest";
-  version = "20220827";
+  version = "20221111";
 
   src = fetchurl {
     urls = [
       "https://invisible-mirror.net/archives/${pname}/${pname}-${version}.tgz"
       "ftp://ftp.invisible-island.net/${pname}/${pname}-${version}.tgz"
     ];
-    sha256 = "sha256-Vyaq5YE3dzzmzgH+aob8D4PEd2PjBIi/81ubxPyUbOI=";
+    sha256 = "sha256-asC/ZqWAc3gP3rdGMRT1HYCxzJ6O8djHNjBT/Nwxgac=";
   };
 
   meta = with lib; {

From dedd108507821d216c547f96f98f3b4f073b2839 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 23 Dec 2022 17:16:46 +0000
Subject: [PATCH 12/52] omake: 0.10.3 -> 0.10.5

---
 pkgs/development/tools/ocaml/omake/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/ocaml/omake/default.nix b/pkgs/development/tools/ocaml/omake/default.nix
index bcfd86a2d4de..f6c7955c6863 100644
--- a/pkgs/development/tools/ocaml/omake/default.nix
+++ b/pkgs/development/tools/ocaml/omake/default.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
 
   pname = "omake";
-  version = "0.10.3";
+  version = "0.10.5";
 
   src = fetchurl {
     url = "http://download.camlcity.org/download/${pname}-${version}.tar.gz";
-    sha256 = "07bdg1h5i7qnlv9xq81ad5hfypl10hxm771h4rjyl5cn8plhfcgz";
+    sha256 = "sha256-VOFq2KLBbmZCRgHzfpD7p0iyF8yU1tTbyvTiOcpm98Q=";
   };
 
   buildInputs = [ ocaml ncurses ];

From 9b41d9755b408547aaaad32751e3d01beb3d4bb4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 23 Dec 2022 17:28:55 +0000
Subject: [PATCH 13/52] libcouchbase: 3.3.2 -> 3.3.3

---
 pkgs/development/libraries/libcouchbase/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libcouchbase/default.nix b/pkgs/development/libraries/libcouchbase/default.nix
index a1d75d65aa63..50fc23aa5f10 100644
--- a/pkgs/development/libraries/libcouchbase/default.nix
+++ b/pkgs/development/libraries/libcouchbase/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcouchbase";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchFromGitHub {
     owner = "couchbase";
     repo = "libcouchbase";
     rev = version;
-    sha256 = "sha256-nGZHAp2ajGHNHjfKTAQrQSlBmyufzP9V8/vRO6S8Ui0=";
+    sha256 = "sha256-kg/dVarfmDibZXLGY4zXfReNQ1DC4T/3g54g8zxNmEs=";
   };
 
   cmakeFlags = [ "-DLCB_NO_MOCK=ON" ];

From d9283c04d5390c19b550d981f0435d01c33e3a3c Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Fri, 23 Dec 2022 18:41:52 +0100
Subject: [PATCH 14/52] nixos/testing-python.nix: Help users who need
 specialArgs

---
 nixos/lib/testing-python.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/nixos/lib/testing-python.nix b/nixos/lib/testing-python.nix
index 134d38f1b676..4904ad6e3591 100644
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@@ -1,3 +1,4 @@
+args@
 { system
 , pkgs ? import ../.. { inherit system config; }
   # Use a minimal kernel?
@@ -5,7 +6,7 @@
   # Ignored
 , config ? { }
   # !!! See comment about args in lib/modules.nix
-, specialArgs ? { }
+, specialArgs ? throw "legacy - do not use, see error below"
   # Modules to add to each VM
 , extraConfigurations ? [ ]
 }:
@@ -13,6 +14,13 @@ let
   nixos-lib = import ./default.nix { inherit (pkgs) lib; };
 in
 
+pkgs.lib.throwIf (args?specialArgs) ''
+  testing-python.nix: `specialArgs` is not supported anymore. If you're looking
+  for the public interface to the NixOS test framework, use `runTest`, and
+  `node.specialArgs`.
+  See https://nixos.org/manual/nixos/unstable/index.html#sec-calling-nixos-tests
+  and https://nixos.org/manual/nixos/unstable/index.html#test-opt-node.specialArgs
+''
 rec {
 
   inherit pkgs;

From 226fd21cc760d12b6c00730a522628b12073d522 Mon Sep 17 00:00:00 2001
From: Ivan Petkov <ivanppetkov@gmail.com>
Date: Fri, 23 Dec 2022 09:48:08 -0800
Subject: [PATCH 15/52] _1password-gui: 8.9.8 -> 8.9.10, 8.9.10-1.BETA ->
 8.9.12-4.BETA

---
 .../misc/1password-gui/default.nix             | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/applications/misc/1password-gui/default.nix b/pkgs/applications/misc/1password-gui/default.nix
index e6cf00d669de..3c08f1d8a9da 100644
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@@ -9,43 +9,43 @@
 let
 
   pname = "1password";
-  version = if channel == "stable" then "8.9.8" else "8.9.10-1.BETA";
+  version = if channel == "stable" then "8.9.10" else "8.9.12-4.BETA";
 
   sources = {
     stable = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/x86_64/1password-${version}.x64.tar.gz";
-        sha256 = "sha256-s5GFGsSelnvqdoEgCzU88BG0dc4bUG4IX3fbeciIPIk=";
+        sha256 = "sha256-aoa00W5zvZQeHKd2Eqyrxl5Z1PwLMHc5lkMUskLiD74=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/stable/aarch64/1password-${version}.arm64.tar.gz";
-        sha256 = "sha256-wNF9jwHTxuojFQ+s05jhb7dFihE/36cadaBONqrMYF0=";
+        sha256 = "sha256-Zt64UGKI3+DayS6XP7jTE+pxv52tUUZbUHiuzjcm1JI=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        sha256 = "sha256-Ok0M6jPZ513iTE646PDPu+dK6Y3b/J8oejJQQkQMS2w=";
+        sha256 = "sha256-sx9eASpMcgkIH1GRzJMqSQa5Y5GJlYU/20CZFyFK+OU=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        sha256 = "sha256-zocY/0IgiGwuY/ZrMbip34HoRp90ATWRpfAIRhyH9M8=";
+        sha256 = "sha256-Z1cEynO9iWZra542CVGmefrTNerMe13OcTAzWXNi8jI=";
       };
     };
     beta = {
       x86_64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/x86_64/1password-${version}.x64.tar.gz";
-        sha256 = "sha256-fW+9mko1OZ5zlTnbZucOjvjus8KVZA4Mcga/4HJyJL4=";
+        sha256 = "sha256-/WXaLINqLFLft+wrmr+fV0kM9qS5w4etFiGltnzoVdo=";
       };
       aarch64-linux = {
         url = "https://downloads.1password.com/linux/tar/beta/aarch64/1password-${version}.arm64.tar.gz";
-        sha256 = "sha256-jczDhKMCEHjE5yXr5jczSalGa4pVFs7V8BcIhueT88M=";
+        sha256 = "sha256-Zv9uHkFCZ0flBMAwQBjNhqFWhAXKyHBfZk733hbSag4=";
       };
       x86_64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-x86_64.zip";
-        sha256 = "sha256-apgXMoZ7yNtUgf6efuSjAK6TGFR230FMK4j95OoXgwQ=";
+        sha256 = "sha256-Vryk6nMQY+0NIgwJkZ2j3vrxyhrzxbe96jbyoNbPIR0=";
       };
       aarch64-darwin = {
         url = "https://downloads.1password.com/mac/1Password-${version}-aarch64.zip";
-        sha256 = "sha256-tdGu648joHu5E8ECU1TpkxgfU6ZMHlJAy+VcNDtIscA=";
+        sha256 = "sha256-74iOaNkuPRKUsTNNd7UTpy5ahjoMmxiNT84Op5ztRGk=";
       };
     };
   };

From cd1eb364e997e8160b85e7b641c9de822cb21ce0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 23 Dec 2022 17:52:29 +0000
Subject: [PATCH 16/52] gallery-dl: 1.24.1 -> 1.24.2

---
 pkgs/applications/misc/gallery-dl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/gallery-dl/default.nix b/pkgs/applications/misc/gallery-dl/default.nix
index edd5f491cced..2ec4d7df2402 100644
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.24.1";
+  version = "1.24.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    sha256 = "sha256-pjm410aT4+Lj3PBAlibmglNPGlmBgkRoHAg7JrIDp0s=";
+    sha256 = "sha256-KqDprKoqpbNpUrM7nAYj71cuMh6U3s65kqVTW2cHeLc=";
   };
 
   propagatedBuildInputs = [

From bd3f84c6d7fc5c2ce5d5ce32193b1c51c5ce4c42 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 23 Dec 2022 18:03:10 +0000
Subject: [PATCH 17/52] linkerd: 2.12.0 -> 2.12.3

---
 pkgs/applications/networking/cluster/linkerd/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/linkerd/default.nix b/pkgs/applications/networking/cluster/linkerd/default.nix
index 83d75d7d189a..896c2ac5a016 100644
--- a/pkgs/applications/networking/cluster/linkerd/default.nix
+++ b/pkgs/applications/networking/cluster/linkerd/default.nix
@@ -2,7 +2,7 @@
 
 (callPackage ./generic.nix { }) {
   channel = "stable";
-  version = "2.12.0";
-  sha256 = "0p8k5c0gzpmqp7qrhfcjrhbgwd2mzsn2qpsv7ym0ywjkvrkg3355";
-  vendorSha256 = "sha256-qjXpzS1ctEQfXFjzyBUiIp6+oqABedpwHqDxQz0DJ8U=";
+  version = "2.12.3";
+  sha256 = "01vnqhn5lc4pv1rgwmmzzf7ynqc4ss0jysqhjq0m5yzll2k40d8z";
+  vendorSha256 = "sha256-7CkeWbgiQIKhuCrJErZrkkx0MD41qxaWAY/18VafLZE=";
 }

From fb136e390c18c645b064e4ed034684c370f329a6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 23 Dec 2022 18:11:23 +0000
Subject: [PATCH 18/52] clickhouse-backup: 2.1.2 -> 2.1.3

---
 .../tools/database/clickhouse-backup/default.nix            | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/database/clickhouse-backup/default.nix b/pkgs/development/tools/database/clickhouse-backup/default.nix
index 4db8dbe263ff..81c53082b7ec 100644
--- a/pkgs/development/tools/database/clickhouse-backup/default.nix
+++ b/pkgs/development/tools/database/clickhouse-backup/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "clickhouse-backup";
-  version = "2.1.2";
+  version = "2.1.3";
 
   src = fetchFromGitHub {
     owner = "AlexAkulov";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Vc9zPERRF6AWSOGSiOe6n33Ioc3uOtHQEehfMhPkSFk=";
+    sha256 = "sha256-RaThNBTRBECSeSeJOQ2UsrkBHjSjrS91vIRF/4MGek4=";
   };
 
-  vendorSha256 = "sha256-kbIztD0g+92gxxBYhWILudgFRFCshagmAUs8bY/Z8yg=";
+  vendorSha256 = "sha256-sSN+HAUC9rJc9XMTG8H+Zg7mzZSVxn6Z7dixJ10mOuM=";
 
   ldflags = [
     "-X main.version=${version}"

From 77fe22db6541aa956caa338212575ab9f39215c7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 23 Dec 2022 19:11:36 +0000
Subject: [PATCH 19/52] libdigidocpp: 3.14.10 -> 3.14.11

---
 pkgs/development/libraries/libdigidocpp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libdigidocpp/default.nix b/pkgs/development/libraries/libdigidocpp/default.nix
index 7d34388aea39..21da1a917bf1 100644
--- a/pkgs/development/libraries/libdigidocpp/default.nix
+++ b/pkgs/development/libraries/libdigidocpp/default.nix
@@ -2,12 +2,12 @@
 , xercesc, xml-security-c, pkg-config, xsd, zlib, xalanc, xxd }:
 
 stdenv.mkDerivation rec {
-  version = "3.14.10";
+  version = "3.14.11";
   pname = "libdigidocpp";
 
   src = fetchurl {
      url = "https://github.com/open-eid/libdigidocpp/releases/download/v${version}/libdigidocpp-${version}.tar.gz";
-     hash = "sha256-n/+R4ho1Qcft3YSKE12oxZjbFHAsUDwoLFNuk5GXf5c=";
+     hash = "sha256-5QYKHwRB5nck5yqukX/UA+M3jFlBvkQ/ekB7JFIY5tI=";
   };
 
   nativeBuildInputs = [ cmake pkg-config xxd ];

From c4c3cfbba4637f496d511ecd8c9e23039cbe02b1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 23 Dec 2022 19:18:20 +0000
Subject: [PATCH 20/52] datasette: 0.63.2 -> 0.63.3

---
 pkgs/development/python-modules/datasette/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/datasette/default.nix b/pkgs/development/python-modules/datasette/default.nix
index 8394befc51e6..91517c564f91 100644
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "datasette";
-  version = "0.63.2";
+  version = "0.63.3";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "simonw";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-VDmh2Q/ab5xaNbj0APuQ9pkZ+GHoNXW2crrJXi556Fk=";
+    sha256 = "sha256-SnUhF7QOXwCU288L4BB4JnhtP6XyHsBS1PpaFM32J0w=";
   };
 
   postPatch = ''

From f1d26228f2c12a74948507c67527a0009a7e3f4a Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Fri, 23 Dec 2022 15:33:12 -0500
Subject: [PATCH 21/52] cargo-semver-checks: 0.12.0 -> 0.14.0

Diff: https://github.com/obi1kenobi/cargo-semver-checks/compare/v0.12.0...v0.14.0
---
 .../tools/rust/cargo-semver-checks/default.nix | 18 +++++++++---------
 pkgs/top-level/all-packages.nix                |  4 +---
 2 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/tools/rust/cargo-semver-checks/default.nix b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
index 19c487368e78..ab86d41d7c53 100644
--- a/pkgs/development/tools/rust/cargo-semver-checks/default.nix
+++ b/pkgs/development/tools/rust/cargo-semver-checks/default.nix
@@ -5,38 +5,38 @@
 , libgit2
 , openssl
 , stdenv
-, Security
+, darwin
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-semver-checks";
-  version = "0.12.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "obi1kenobi";
-    repo = "cargo-semver-check";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gB8W/u/Yb/rMMB+654N3Mj4QbTMWGK6cgQKM0lld/10=";
+    sha256 = "sha256-upGVWCK3gEPH6BZ7W410AnQPIWOCeD4sawQqPLRowfw=";
   };
 
-  cargoSha256 = "sha256-ML4cTNtCvaLFkt1QdA34QvAGhrFTO90xw7fsUD2weqQ=";
+  cargoSha256 = "sha256-PYZe7OO/cevictnWGc+NHVpJXctU2XyejF8jPjSNp3M=";
 
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ libgit2 openssl ] ++ lib.optionals stdenv.isDarwin [
-    Security
+    darwin.apple_sdk.frameworks.Security
   ];
 
   checkFlags = [
     # requires nightly version of cargo-rustdoc
-    "--skip=adapter::tests"
+    "--skip=dump::tests"
     "--skip=query::tests"
   ];
 
   meta = with lib; {
     description = "A tool to scan your Rust crate for semver violations";
-    homepage = "https://github.com/obi1kenobi/cargo-semver-check";
-    license = licenses.asl20;
+    homepage = "https://github.com/obi1kenobi/cargo-semver-checks";
+    license = with licenses; [ mit /* or */ asl20 ];
     maintainers = with maintainers; [ figsoda matthiasbeyer ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0f210979796a..ed6d005ad868 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15419,9 +15419,7 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
   cargo-readme = callPackage ../development/tools/rust/cargo-readme {};
-  cargo-semver-checks = callPackage ../development/tools/rust/cargo-semver-checks {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
+  cargo-semver-checks = callPackage ../development/tools/rust/cargo-semver-checks { };
 
   cargo-show-asm = callPackage ../development/tools/rust/cargo-show-asm { };
 

From 6249f9a1dad89aa986277852d2c631e70f2520de Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 24 Dec 2022 00:39:52 +0000
Subject: [PATCH 22/52] grpc-gateway: 2.14.0 -> 2.15.0

---
 pkgs/development/tools/grpc-gateway/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/grpc-gateway/default.nix b/pkgs/development/tools/grpc-gateway/default.nix
index 3870e87dcb45..54e6ccd471dc 100644
--- a/pkgs/development/tools/grpc-gateway/default.nix
+++ b/pkgs/development/tools/grpc-gateway/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "grpc-gateway";
-  version = "2.14.0";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "grpc-ecosystem";
     repo = "grpc-gateway";
     rev = "v${version}";
-    sha256 = "sha256-lnNdsDCpeSHtl2lC1IhUw11t3cnGF+37qSM7HDvKLls=";
+    sha256 = "sha256-NOcV3XrSFeb/LYzeZQ0M1l1l4TkC+fVqAXCDUTaMN3c=";
   };
 
-  vendorSha256 = "sha256-dGdnDuRbwg8fU7uB5GaHEWa/zI3w06onqjturvooJQA=";
+  vendorSha256 = "sha256-zYKRWJ09SnE0Y9iahTyODas/04an8x9w+rsY0x4/NRM=";
 
   meta = with lib; {
     description =

From 09bf072091111c87873ec07ce9b9bd4b4f848609 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 24 Dec 2022 01:41:32 +0000
Subject: [PATCH 23/52] matio: 1.5.22 -> 1.5.23

---
 pkgs/development/libraries/matio/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/matio/default.nix b/pkgs/development/libraries/matio/default.nix
index c92c712e1500..a1aee4dd8f51 100644
--- a/pkgs/development/libraries/matio/default.nix
+++ b/pkgs/development/libraries/matio/default.nix
@@ -1,10 +1,10 @@
 { lib, stdenv, fetchurl }:
 stdenv.mkDerivation rec {
   pname = "matio";
-  version = "1.5.22";
+  version = "1.5.23";
   src = fetchurl {
     url = "mirror://sourceforge/matio/${pname}-${version}.tar.gz";
-    sha256 = "sha256-gMPR4iLhFXaLV7feZAo30O58t6O9A52z6pQecfxSBMM=";
+    sha256 = "sha256-n5Hq5mHfRupTwxGhstz/cgUQlbAjxhLXy/wJQGyfTW4=";
   };
 
   meta = with lib; {

From 7d30e602151e5496b4b09483b801a5f192571079 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 24 Dec 2022 01:41:55 +0000
Subject: [PATCH 24/52] exoscale-cli: 1.61.0 -> 1.63.0

---
 pkgs/tools/admin/exoscale-cli/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/admin/exoscale-cli/default.nix b/pkgs/tools/admin/exoscale-cli/default.nix
index 475fbe4cdde0..1c78b5a0278c 100644
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "exoscale-cli";
-  version = "1.61.0";
+  version = "1.63.0";
 
   src = fetchFromGitHub {
     owner = "exoscale";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-3ak/z6Ww+/VY1/TErQ+CBxq5xte3VeGbCz2P5QlHxLg=";
+    sha256 = "sha256-YRpaPUKExHewuDqIlXjS32Bu6eMHam153Cfbv+crs9M=";
   };
 
   vendorSha256 = null;

From b837e030ec9701a2050296885c4ff97cc4b3a306 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Sat, 24 Dec 2022 09:52:44 +0700
Subject: [PATCH 25/52] fq: 0.1.0 -> 0.2.0

Diff: https://github.com/wader/fq/compare/v0.1.0...v0.2.0
---
 pkgs/development/tools/fq/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/fq/default.nix b/pkgs/development/tools/fq/default.nix
index 293e16508276..2145a3ab74c1 100644
--- a/pkgs/development/tools/fq/default.nix
+++ b/pkgs/development/tools/fq/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "fq";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "wader";
     repo = "fq";
     rev = "v${version}";
-    sha256 = "sha256-ZUbeAZGHG7I4NwJZjI92isIMX8M675oI833v3uKZE7U=";
+    sha256 = "sha256-OAdKt5RgLVoTmccN50TUwUAU7VLiTU9hEnDAKxKBRzI=";
   };
 
-  vendorSha256 = "sha256-GGbKoLj8CyfqB90QnOsomZBVd6KwJCTp/MeyKvRopSQ=";
+  vendorSha256 = "sha256-Y9wfeAX0jt3KrpRa5kJi8V8WN/hp4jTcPCbvy0RDGRk=";
 
   ldflags = [
     "-s"

From 79bb27da219283e41a515317d2827499ca36dd57 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 24 Dec 2022 04:34:14 +0000
Subject: [PATCH 26/52] python310Packages.dacite: 1.6.0 -> 1.7.0

---
 pkgs/development/python-modules/dacite/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/dacite/default.nix b/pkgs/development/python-modules/dacite/default.nix
index ba74695fb5ea..74eb5040d121 100644
--- a/pkgs/development/python-modules/dacite/default.nix
+++ b/pkgs/development/python-modules/dacite/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "dacite";
-  version = "1.6.0";
+  version = "1.7.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "konradhalas";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "0nv2bnj3bq2v08ac4p583cnpjq2d6bv5isycgji5i5wg1y082a3d";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-+yWvlJcOmqDkHl3JZfPnIV3C4ieSo4FiBvoUZ0+J4N0=";
   };
 
   checkInputs = [

From e9917797b1fd7db215fd21dae10ce0baf2265133 Mon Sep 17 00:00:00 2001
From: Jamie Magee <jamie.magee@gmail.com>
Date: Fri, 23 Dec 2022 22:46:30 -0800
Subject: [PATCH 27/52] pythonPackages.btsmarthub_devicelist: init at 0.2.3

---
 .../btsmarthub_devicelist/default.nix         | 44 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 46 insertions(+)
 create mode 100644 pkgs/development/python-modules/btsmarthub_devicelist/default.nix

diff --git a/pkgs/development/python-modules/btsmarthub_devicelist/default.nix b/pkgs/development/python-modules/btsmarthub_devicelist/default.nix
new file mode 100644
index 000000000000..540155c07c62
--- /dev/null
+++ b/pkgs/development/python-modules/btsmarthub_devicelist/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pythonOlder,
+  requests,
+  responses,
+}:
+buildPythonPackage rec {
+  pname = "btsmarthub_devicelist";
+  version = "0.2.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "jxwolstenholme";
+    repo = "btsmarthub_devicelist";
+    rev = "${version}";
+    hash = "sha256-7ncxCpY+A2SuSFa3k21QchrmFs1dPRUMb1r1z/laa6M=";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  checkInputs = [
+    responses
+    requests
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    "test_btsmarthub2_detection_neither_router_present"
+  ];
+
+  meta = with lib; {
+    description = "Retrieve a list of devices from a bt smarthub or bt smarthub 2 on a local network";
+    homepage = "https://github.com/jxwolstenholme/btsmarthub_devicelist";
+    license = licenses.mit;
+    maintainers = with maintainers; [jamiemagee];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e51082db63f6..d2aa9dad8af3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1443,6 +1443,8 @@ self: super: with self; {
 
   btrfsutil = callPackage ../development/python-modules/btrfsutil { };
 
+  btsmarthub_devicelist = callPackage ../development/python-modules/btsmarthub_devicelist { };
+
   btsocket = callPackage ../development/python-modules/btsocket { };
 
   bucketstore = callPackage ../development/python-modules/bucketstore { };

From 0619c5f5ab6631797c8641a6167766432967e048 Mon Sep 17 00:00:00 2001
From: Jamie Magee <jamie.magee@gmail.com>
Date: Fri, 23 Dec 2022 23:05:22 -0800
Subject: [PATCH 28/52] home-assistant: update component-packages

---
 pkgs/servers/home-assistant/component-packages.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 7b8fdcff2b10..b72fa929a7db 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -429,7 +429,8 @@
     "bt_home_hub_5" = ps: with ps; [
     ]; # missing inputs: bthomehub5-devicelist
     "bt_smarthub" = ps: with ps; [
-    ]; # missing inputs: btsmarthub_devicelist
+      btsmarthub_devicelist
+    ];
     "bthome" = ps: with ps; [
       aiohttp-cors
       bleak-retry-connector

From 7ef58bce9d2e261ecfd4f0b5c1fb4a7da6888dc0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Sat, 24 Dec 2022 09:25:13 +0100
Subject: [PATCH 29/52] nixos/nginx: disable configuration validation for now

There still seem a lot of breakages not addressed yet:

https://github.com/NixOS/nixpkgs/pull/205561
---
 nixos/modules/services/web-servers/nginx/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 953f31632934..8377e8a76d52 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -524,7 +524,9 @@ in
       };
 
       validateConfig = mkOption {
-        default = pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform;
+        # FIXME: re-enable if we can make of the configurations work.
+        #default = pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform;
+        default = false;
         defaultText = literalExpression "pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform";
         type = types.bool;
         description = lib.mdDoc ''

From dd40456033a498005bdc03c6344a02edb598ebe0 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 24 Dec 2022 12:08:44 +0100
Subject: [PATCH 30/52] python310Packages.volkszaehler: add changelog to meta

---
 pkgs/development/python-modules/volkszaehler/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/volkszaehler/default.nix b/pkgs/development/python-modules/volkszaehler/default.nix
index cbc51d024a6e..f5b01ce12d86 100644
--- a/pkgs/development/python-modules/volkszaehler/default.nix
+++ b/pkgs/development/python-modules/volkszaehler/default.nix
@@ -16,8 +16,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "home-assistant-ecosystem";
     repo = "python-volkszaehler";
-    rev = version;
-    sha256 = "sha256-EiruMlhXvbUhCaDtHc3qCLbpp/KHp9rVpk2FmbR4A/k=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-EiruMlhXvbUhCaDtHc3qCLbpp/KHp9rVpk2FmbR4A/k=";
   };
 
   propagatedBuildInputs = [
@@ -35,6 +35,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for interacting with the Volkszahler API";
     homepage = "https://github.com/home-assistant-ecosystem/python-volkszaehler";
+    changelog = "https://github.com/home-assistant-ecosystem/python-volkszaehler/releases/tag/${version}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
   };

From 4adb674709e97f8bc0abfbbbc475929b6d7a498d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 24 Dec 2022 12:09:56 +0100
Subject: [PATCH 31/52] python310Packages.volkszaehler: 0.3.2 -> 0.4.0

Changelog: https://github.com/home-assistant-ecosystem/python-volkszaehler/releases/tag/0.4.0
---
 pkgs/development/python-modules/volkszaehler/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/volkszaehler/default.nix b/pkgs/development/python-modules/volkszaehler/default.nix
index f5b01ce12d86..dcb153ba98ca 100644
--- a/pkgs/development/python-modules/volkszaehler/default.nix
+++ b/pkgs/development/python-modules/volkszaehler/default.nix
@@ -8,16 +8,16 @@
 
 buildPythonPackage rec {
   pname = "volkszaehler";
-  version = "0.3.2";
+  version = "0.4.0";
   format = "setuptools";
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "home-assistant-ecosystem";
     repo = "python-volkszaehler";
     rev = "refs/tags/${version}";
-    hash = "sha256-EiruMlhXvbUhCaDtHc3qCLbpp/KHp9rVpk2FmbR4A/k=";
+    hash = "sha256-jX0nwBsBYU383LG8f08FVI7Lo9gnyPSQ0fiEF8dQc/M=";
   };
 
   propagatedBuildInputs = [

From 1bd7c66e6418ff3b92d96d800ad758ccfda94898 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 24 Dec 2022 12:15:13 +0100
Subject: [PATCH 32/52] python310Packages.dacite: add changelog to meta

---
 pkgs/development/python-modules/dacite/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/dacite/default.nix b/pkgs/development/python-modules/dacite/default.nix
index 74eb5040d121..d95b0155c79c 100644
--- a/pkgs/development/python-modules/dacite/default.nix
+++ b/pkgs/development/python-modules/dacite/default.nix
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "konradhalas";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-+yWvlJcOmqDkHl3JZfPnIV3C4ieSo4FiBvoUZ0+J4N0=";
+    hash = "sha256-+yWvlJcOmqDkHl3JZfPnIV3C4ieSo4FiBvoUZ0+J4N0=";
   };
 
   checkInputs = [
@@ -36,6 +36,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python helper to create data classes from dictionaries";
     homepage = "https://github.com/konradhalas/dacite";
+    changelog = "https://github.com/konradhalas/dacite/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

From f0e6dd2e8300058232e514e5c5a223d62ea4a8d4 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 24 Dec 2022 12:15:38 +0100
Subject: [PATCH 33/52] python310Packages.dacite: re-enable test

---
 pkgs/development/python-modules/dacite/default.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/development/python-modules/dacite/default.nix b/pkgs/development/python-modules/dacite/default.nix
index d95b0155c79c..12b14b226def 100644
--- a/pkgs/development/python-modules/dacite/default.nix
+++ b/pkgs/development/python-modules/dacite/default.nix
@@ -24,11 +24,6 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals (pythonAtLeast "3.10") [
-    # https://github.com/konradhalas/dacite/issues/167
-    "test_from_dict_with_union_and_wrong_data"
-  ];
-
   pythonImportsCheck = [
     "dacite"
   ];

From cab81591bce1f781cf893d768d2d1848b760f65a Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Sat, 24 Dec 2022 19:41:13 +0800
Subject: [PATCH 34/52] v2ray-domain-list-community: 20221130032508 ->
 20221223102220

---
 pkgs/data/misc/v2ray-domain-list-community/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/data/misc/v2ray-domain-list-community/default.nix b/pkgs/data/misc/v2ray-domain-list-community/default.nix
index 9fd794d9d5bb..3d44e34f2b0d 100644
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@@ -3,12 +3,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20221130032508";
+    version = "20221223102220";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      sha256 = "sha256-1UkP88HGh0KBYaekskeQHkJh02veUYmATKJD/wy4erc=";
+      sha256 = "sha256-bvTNxJcogF3KxZbC8jW0PMIiJJZnzubWybDcNK7id8s=";
     };
     vendorSha256 = "sha256-CCY3CgjA1w4svzmkaI2Jt272Rrt5UOt5sbVDAWRRfzk=";
     meta = with lib; {

From 094c0253cdd0d9f288625a9505764b22b921ee9e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 24 Dec 2022 12:16:10 +0000
Subject: [PATCH 35/52] talosctl: 1.2.7 -> 1.2.8

---
 pkgs/applications/networking/cluster/talosctl/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/talosctl/default.nix b/pkgs/applications/networking/cluster/talosctl/default.nix
index 93f6f97a6a39..fcd2ef9fb5be 100644
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "talosctl";
-  version = "1.2.7";
+  version = "1.2.8";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     rev = "v${version}";
-    sha256 = "sha256-AQTBiHlaVFV1fvZ278DYf2XnktnLNa1Hb4qS2D2r/fM=";
+    sha256 = "sha256-5oleIRJHEmIOXLXwBuklY16WhkePAokPGDfcPoxOUo0=";
   };
 
-  vendorSha256 = "sha256-GKDhqIfYmPwbxt+hId3Axr64xOTXkLklZzNYWDo9SG8=";
+  vendorSha256 = "sha256-+jKbBWDBNgDYf6Ka69NqHzB2KAwKIDJWZpjXl3aylBA=";
 
   ldflags = [ "-s" "-w" ];
 

From 755d5259c7ab46a3fa726f97b9a2e0084382cd66 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Favier?= <n@monade.li>
Date: Sat, 24 Dec 2022 11:02:15 +0100
Subject: [PATCH 36/52] maintainers/scripts/haskell: fix
 regenerate-transitive-broken

- use `restrict-eval` so that we're not affected by the user's environment
- use jq instead of the horrible echo+sed hack

The second point also fixes the indentation before each line to be two
spaces instead of one, so I set it back to one space to avoid a diff.
---
 .../scripts/haskell/regenerate-transitive-broken-packages.sh  | 4 ++--
 maintainers/scripts/haskell/transitive-broken-packages.nix    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh b/maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
index 94104e00edb8..69455bfb6879 100755
--- a/maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
+++ b/maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
@@ -1,5 +1,5 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i bash -p coreutils nix gnused -I nixpkgs=.
+#! nix-shell -i bash -p coreutils jq nix -I nixpkgs=.
 
 config_file=pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml
 
@@ -12,4 +12,4 @@ dont-distribute-packages:
 EOF
 
 echo "Regenerating list of transitive broken packages ..."
-echo -e $(nix-instantiate --eval --strict maintainers/scripts/haskell/transitive-broken-packages.nix) | sed 's/\"//' | LC_ALL=C.UTF-8 sort -i >> $config_file
+nix-instantiate --eval --option restrict-eval true -I . --strict --json maintainers/scripts/haskell/transitive-broken-packages.nix | jq -r . | LC_ALL=C.UTF-8 sort -i >> $config_file
diff --git a/maintainers/scripts/haskell/transitive-broken-packages.nix b/maintainers/scripts/haskell/transitive-broken-packages.nix
index d4ddaa957658..50ccb14577bc 100644
--- a/maintainers/scripts/haskell/transitive-broken-packages.nix
+++ b/maintainers/scripts/haskell/transitive-broken-packages.nix
@@ -12,5 +12,5 @@ let
     (getEvaluating (nixpkgs { config.allowBroken = true; }).haskellPackages);
 in
 ''
-  ${lib.concatMapStringsSep "\n" (x: "  - ${x}") brokenDeps}
+  ${lib.concatMapStringsSep "\n" (x: " - ${x}") brokenDeps}
 ''

From b40050bad1a99fa9a0455ea5318792d915d2e146 Mon Sep 17 00:00:00 2001
From: Daniel Nagy <danielnagy@posteo.de>
Date: Sat, 24 Dec 2022 13:40:12 +0100
Subject: [PATCH 37/52] gccgo: track latest gcc (#144467)

---
 pkgs/top-level/all-packages.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bdbc3f6410eb..5ad54e6d2ed0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -14448,12 +14448,12 @@ with pkgs;
 
   gnu-smalltalk = callPackage ../development/compilers/gnu-smalltalk { };
 
-  gccgo = gccgo6;
-  gccgo6 = wrapCC (gcc6.cc.override {
-    name = "gccgo6";
+  gccgo = wrapCC (gcc.cc.override {
+    name = "gccgo";
     langCC = true; #required for go.
     langC = true;
     langGo = true;
+    langJit = true;
     profiledCompiler = false;
   });
 

From d9c3fbfcdcffd2e6b8bf2f59cffcce5507c304b7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 23 Dec 2022 21:52:28 +0000
Subject: [PATCH 38/52] erlangR25: 25.1.2 -> 25.2

---
 pkgs/development/interpreters/erlang/R25.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/R25.nix b/pkgs/development/interpreters/erlang/R25.nix
index 885dd13efef7..0f2dff14fcef 100644
--- a/pkgs/development/interpreters/erlang/R25.nix
+++ b/pkgs/development/interpreters/erlang/R25.nix
@@ -1,6 +1,6 @@
 { mkDerivation }:
 
 mkDerivation {
-  version = "25.1.2";
-  sha256 = "0fn6zyqrgyiznyghkhygak524f3clc3kz91rarq8cqn3r920dmg9";
+  version = "25.2";
+  sha256 = "zZ6i0NIftTcjzB5J51Q16GmVPlc5gPnGfo6EoBT2HY0=";
 }

From 2b5677caa342629ee42743ac92556ac8bf5e8ef9 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 24 Dec 2022 13:58:22 +0100
Subject: [PATCH 39/52] nixosTests.keymap: Reorder test cases to make setup
 more reliable

I've run this test on repeat for hours, so there's reason to be
hopeful.
---
 nixos/tests/keymap.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/nixos/tests/keymap.nix b/nixos/tests/keymap.nix
index 4306a9ae2cf9..40f4762bed83 100644
--- a/nixos/tests/keymap.nix
+++ b/nixos/tests/keymap.nix
@@ -78,9 +78,18 @@ let
       with open("${pkgs.writeText "tests.json" (builtins.toJSON tests)}") as json_file:
           tests = json.load(json_file)
 
+      # These environments used to run in the opposite order, causing the
+      # following error at openvt startup.
+      #
+      # openvt: Couldn't deallocate console 1
+      #
+      # This error did not appear in successful runs.
+      # I don't know the exact cause, but I it seems that openvt and X are
+      # fighting over the virtual terminal. This does not appear to be a problem
+      # when the X test runs first.
       keymap_environments = {
-          "VT Keymap": "openvt -sw --",
           "Xorg Keymap": "DISPLAY=:0 xterm -title testterm -class testterm -fullscreen -e",
+          "VT Keymap": "openvt -sw --",
       }
 
       machine.wait_for_x()

From 562431130592150c9910b1abd5019c16c6d6fcb0 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sat, 24 Dec 2022 13:59:57 +0100
Subject: [PATCH 40/52] nixosTests.keymap: Remove unnecessary sleep

When test-input-reader runs, it's standard input exists and will
be buffered, so by the time the file exists, the standard input
can already be written to.
I have no reason to believe that a terminal emulator would start
accepting input _after_ launching the command.
I've tested this for hours in a loop without a single failure or
timeout.
---
 nixos/tests/keymap.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/tests/keymap.nix b/nixos/tests/keymap.nix
index 40f4762bed83..0bde21093b0a 100644
--- a/nixos/tests/keymap.nix
+++ b/nixos/tests/keymap.nix
@@ -64,7 +64,6 @@ let
 
               # wait for reader to be ready
               machine.wait_for_file("${readyFile}")
-              machine.sleep(1)
 
               # send all keys
               for key in inputs:

From 5ff21bfc73f59efd3e61776964f7b7f1863a3136 Mon Sep 17 00:00:00 2001
From: hsjobeki <hsjobeki+github@gmail.com>
Date: Sat, 24 Dec 2022 14:08:11 +0100
Subject: [PATCH 41/52] attrsets: fix and add some doc types

---
 lib/attrsets.nix | 61 ++++++++++++++++++++++++++++--------------------
 lib/options.nix  |  4 ++--
 2 files changed, 38 insertions(+), 27 deletions(-)

diff --git a/lib/attrsets.nix b/lib/attrsets.nix
index 4b663db2ce4a..9009feb87d90 100644
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -16,6 +16,8 @@ rec {
 
      Example:
        x = { a = { b = 3; }; }
+       # ["a" "b"] is equivalent to x.a.b
+       # 6 is a default value to return if the path does not exist in attrset
        attrByPath ["a" "b"] 6 x
        => 3
        attrByPath ["z" "z"] 6 x
@@ -23,6 +25,7 @@ rec {
 
      Type:
        attrByPath :: [String] -> Any -> AttrSet -> Any
+
   */
   attrByPath =
     # A list of strings representing the attribute path to return from `set`
@@ -96,7 +99,7 @@ rec {
        => error: cannot find attribute `z.z'
 
      Type:
-       getAttrFromPath :: [String] -> AttrSet -> Value
+       getAttrFromPath :: [String] -> AttrSet -> Any
   */
   getAttrFromPath =
     # A list of strings representing the attribute path to get from `set`
@@ -109,10 +112,7 @@ rec {
   /* Map each attribute in the given set and merge them into a new attribute set.
 
      Type:
-       concatMapAttrs ::
-         (String -> a -> AttrSet)
-         -> AttrSet
-         -> AttrSet
+       concatMapAttrs :: (String -> a -> AttrSet) -> AttrSet -> AttrSet
 
      Example:
        concatMapAttrs
@@ -168,8 +168,7 @@ rec {
        ] { a.b.c = 0; }
        => { a = { b = { d = 1; }; }; x = { y = "xy"; }; }
 
-    Type:
-      updateManyAttrsByPath :: [AttrSet] -> AttrSet -> AttrSet
+    Type: updateManyAttrsByPath :: [{ path :: [String], update :: (Any -> Any) }] -> AttrSet -> AttrSet
   */
   updateManyAttrsByPath = let
     # When recursing into attributes, instead of updating the `path` of each
@@ -252,6 +251,7 @@ rec {
      Example:
        attrValues {c = 3; a = 1; b = 2;}
        => [1 2 3]
+
      Type:
        attrValues :: AttrSet -> [Any]
   */
@@ -341,6 +341,7 @@ rec {
 
      Type:
        foldAttrs :: (Any -> Any -> Any) -> Any -> [AttrSets] -> Any
+
   */
   foldAttrs =
     # A function, given a value and a collector combines the two.
@@ -394,7 +395,7 @@ rec {
            { a = 2; b = 20; }
          ]
      Type:
-     cartesianProductOfSets :: AttrSet -> [AttrSet]
+       cartesianProductOfSets :: AttrSet -> [AttrSet]
   */
   cartesianProductOfSets =
     # Attribute set with attributes that are lists of values
@@ -413,7 +414,7 @@ rec {
        => { name = "some"; value = 6; }
 
      Type:
-       nameValuePair :: String -> Any -> AttrSet
+       nameValuePair :: String -> Any -> { name :: String, value :: Any }
   */
   nameValuePair =
     # Attribute name
@@ -600,7 +601,7 @@ rec {
        => { }
 
      Type:
-       optionalAttrs :: Bool -> AttrSet
+       optionalAttrs :: Bool -> AttrSet -> AttrSet
   */
   optionalAttrs =
     # Condition under which the `as` attribute set is returned.
@@ -646,7 +647,7 @@ rec {
        => { a = ["x" "y"]; b = ["z"] }
 
      Type:
-     zipAttrsWith :: (String -> [ Any ] -> Any) -> [ AttrSet ] -> AttrSet
+       zipAttrsWith :: (String -> [ Any ] -> Any) -> [ AttrSet ] -> AttrSet
   */
   zipAttrsWith =
     builtins.zipAttrsWith or (f: sets: zipAttrsWithNames (concatMap attrNames sets) f sets);
@@ -737,7 +738,7 @@ rec {
        }
 
      Type:
-     recursiveUpdate :: AttrSet -> AttrSet -> AttrSet
+       recursiveUpdate :: AttrSet -> AttrSet -> AttrSet
   */
   recursiveUpdate =
     # Left attribute set of the merge.
@@ -795,6 +796,7 @@ rec {
   /* Turns a list of strings into a human-readable description of those
     strings represented as an attribute path. The result of this function is
     not intended to be machine-readable.
+    Create a new attribute set with `value` set at the nested attribute location specified in `attrPath`.
 
     Example:
       showAttrPath [ "foo" "10" "bar" ]
@@ -831,11 +833,11 @@ rec {
      If the output does not exist, fallback to `.out` and then to the default.
 
      Example:
-       getOutput pkgs.openssl
+       getBin pkgs.openssl
        => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r"
 
      Type:
-       getOutput :: Derivation -> String
+       getBin :: Derivation -> String
   */
   getBin = getOutput "bin";
 
@@ -844,11 +846,11 @@ rec {
      If the output does not exist, fallback to `.out` and then to the default.
 
      Example:
-       getOutput pkgs.openssl
+       getLib pkgs.openssl
        => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-lib"
 
      Type:
-       getOutput :: Derivation -> String
+       getLib :: Derivation -> String
   */
   getLib = getOutput "lib";
 
@@ -857,11 +859,11 @@ rec {
      If the output does not exist, fallback to `.out` and then to the default.
 
      Example:
-       getOutput pkgs.openssl
+       getDev pkgs.openssl
        => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-dev"
 
      Type:
-       getOutput :: Derivation -> String
+       getDev :: Derivation -> String
   */
   getDev = getOutput "dev";
 
@@ -870,15 +872,19 @@ rec {
      If the output does not exist, fallback to `.out` and then to the default.
 
      Example:
-       getOutput pkgs.openssl
+       getMan pkgs.openssl
        => "/nix/store/9rz8gxhzf8sw4kf2j2f1grr49w8zx5vj-openssl-1.0.1r-man"
 
      Type:
-       getOutput :: Derivation -> String
+       getMan :: Derivation -> String
   */
   getMan = getOutput "man";
 
-  /* Pick the outputs of packages to place in `buildInputs` */
+  /* Pick the outputs of packages to place in `buildInputs`
+
+   Type: chooseDevOutputs :: [Derivation] -> [String]
+
+  */
   chooseDevOutputs =
     # List of packages to pick `dev` outputs from
     drvs:
@@ -900,6 +906,7 @@ rec {
 
      Type:
        recurseIntoAttrs :: AttrSet -> AttrSet
+
    */
   recurseIntoAttrs =
     # An attribute set to scan for derivations.
@@ -909,7 +916,7 @@ rec {
   /* Undo the effect of recurseIntoAttrs.
 
      Type:
-       recurseIntoAttrs :: AttrSet -> AttrSet
+       dontRecurseIntoAttrs :: AttrSet -> AttrSet
    */
   dontRecurseIntoAttrs =
     # An attribute set to not scan for derivations.
@@ -919,7 +926,10 @@ rec {
   /* `unionOfDisjoint x y` is equal to `x // y // z` where the
      attrnames in `z` are the intersection of the attrnames in `x` and
      `y`, and all values `assert` with an error message.  This
-      operator is commutative, unlike (//). */
+      operator is commutative, unlike (//).
+
+     Type: unionOfDisjoint :: AttrSet -> AttrSet -> AttrSet
+  */
   unionOfDisjoint = x: y:
     let
       intersection = builtins.intersectAttrs x y;
@@ -930,9 +940,10 @@ rec {
     in
       (x // y) // mask;
 
-  # deprecated
+  # DEPRECATED
   zipWithNames = zipAttrsWithNames;
-  # deprecated
+
+  # DEPRECATED
   zip = builtins.trace
     "lib.zip is deprecated, use lib.zipAttrsWith instead" zipAttrsWith;
 }
diff --git a/lib/options.nix b/lib/options.nix
index 0fd5b64a65d1..9425e803c056 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -104,8 +104,6 @@ rec {
   /* Creates an Option attribute set for an option that specifies the
      package a module should use for some purpose.
 
-     Type: mkPackageOption :: pkgs -> string -> { default :: [string], example :: null | string | [string] } -> option
-
      The package is specified as a list of strings representing its attribute path in nixpkgs.
 
      Because of this, you need to pass nixpkgs itself as the first argument.
@@ -116,6 +114,8 @@ rec {
 
      You can omit the default path if the name of the option is also attribute path in nixpkgs.
 
+     Type: mkPackageOption :: pkgs -> string -> { default :: [string], example :: null | string | [string] } -> option
+
      Example:
        mkPackageOption pkgs "hello" { }
        => { _type = "option"; default = «derivation /nix/store/3r2vg51hlxj3cx5vscp0vkv60bqxkaq0-hello-2.10.drv»; defaultText = { ... }; description = "The hello package to use."; type = { ... }; }

From 0bbb3b7d2e6abda2231ed68f0be32c40d53b9edf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 24 Dec 2022 13:48:26 +0000
Subject: [PATCH 42/52] jove: 4.17.4.8 -> 4.17.4.9

---
 pkgs/applications/editors/jove/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/jove/default.nix b/pkgs/applications/editors/jove/default.nix
index ca494a37fa85..fc8026fb5caf 100644
--- a/pkgs/applications/editors/jove/default.nix
+++ b/pkgs/applications/editors/jove/default.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jove";
-  version = "4.17.4.8";
+  version = "4.17.4.9";
 
   src = fetchFromGitHub {
     owner = "jonmacs";
     repo = "jove";
     rev = finalAttrs.version;
-    sha256 = "sha256-/n/TgVqyG/WeK+/DZqFZCdkQR4SD5+YmljLlzAehMvw=";
+    sha256 = "sha256-Lo5S3t4vewkpoihVdxa3yRrEzNWeNLHCZHXiLCxOH5o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 799491febaadffbe37d0bbc6803cbd27cafcda22 Mon Sep 17 00:00:00 2001
From: Gabriella Gonzalez <Gabriel439@gmail.com>
Date: Sat, 24 Dec 2022 08:47:59 -0600
Subject: [PATCH 43/52] darwin.builder: Fix `system` for `install-credentials`

The script was being mistakenly being built for the guest
system instead of the host system
---
 nixos/modules/profiles/macos-builder.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/profiles/macos-builder.nix b/nixos/modules/profiles/macos-builder.nix
index 77f3224a7294..0cbac3bd61fe 100644
--- a/nixos/modules/profiles/macos-builder.nix
+++ b/nixos/modules/profiles/macos-builder.nix
@@ -62,7 +62,7 @@ in
 
       # This installCredentials script is written so that it's as easy as
       # possible for a user to audit before confirming the `sudo`
-      installCredentials = pkgs.writeShellScript "install-credentials" ''
+      installCredentials = hostPkgs.writeShellScript "install-credentials" ''
         KEYS="''${1}"
         INSTALL=${hostPkgs.coreutils}/bin/install
         "''${INSTALL}" -g nixbld -m 600 "''${KEYS}/${user}_${keyType}" ${privateKey}

From 95cfb3ad3626eaa4b495da3ac16303ac3d6ff59e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 24 Dec 2022 15:07:03 +0000
Subject: [PATCH 44/52] oven-media-engine: 0.14.17 -> 0.14.18

---
 pkgs/servers/misc/oven-media-engine/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/misc/oven-media-engine/default.nix b/pkgs/servers/misc/oven-media-engine/default.nix
index f41dd379f4cb..0529a2bb0716 100644
--- a/pkgs/servers/misc/oven-media-engine/default.nix
+++ b/pkgs/servers/misc/oven-media-engine/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "oven-media-engine";
-  version = "0.14.17";
+  version = "0.14.18";
 
   src = fetchFromGitHub {
     owner = "AirenSoft";
     repo = "OvenMediaEngine";
     rev = "v${version}";
-    sha256 = "sha256-vCew+JUBCMeVfXm6Vt5nO59o1/N76Nu8aoygEsouCFE=";
+    sha256 = "sha256-M204aIFbs2VmwgZbOmkpuyqOfpom/FnKc6noEVMuZfs=";
   };
 
   sourceRoot = "source/src";

From bfeee6fa3dae22e2f49b2d7df0461d3907d5f75e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 24 Dec 2022 11:27:46 +0000
Subject: [PATCH 45/52] v2ray-geoip: 202212150047 -> 202212220043

---
 pkgs/data/misc/v2ray-geoip/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/data/misc/v2ray-geoip/default.nix b/pkgs/data/misc/v2ray-geoip/default.nix
index 2842394f7347..4cb78dcf7c99 100644
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "v2ray-geoip";
-  version = "202212150047";
+  version = "202212220043";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "geoip";
-    rev = "29c096b1285812a0a9a955b98ff2998c46f9b80a";
-    sha256 = "sha256-44kP+4Bc7fwxNViWiKo7jLtUov+7k60v+7NF7CTkbjg=";
+    rev = "4a54320369805321b90c7c5ca4cdda4f12bdd295";
+    sha256 = "sha256-PFbjzzjeCKL9aak45B+R5Y+H3fTBzdXpyEvvEEdInbQ=";
   };
 
   installPhase = ''

From e6cc2d4aa7d1329f06f15fd9f818ae13cb81927d Mon Sep 17 00:00:00 2001
From: kilianar <mail@kilianar.de>
Date: Sat, 24 Dec 2022 17:09:34 +0100
Subject: [PATCH 46/52] oxipng: 7.0.0 -> 8.0.0

https://github.com/shssoichiro/oxipng/releases/tag/v8.0.0
---
 pkgs/tools/graphics/oxipng/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/graphics/oxipng/default.nix b/pkgs/tools/graphics/oxipng/default.nix
index 57c7a35e0b94..a48f18af51e9 100644
--- a/pkgs/tools/graphics/oxipng/default.nix
+++ b/pkgs/tools/graphics/oxipng/default.nix
@@ -1,15 +1,15 @@
 { lib, stdenv, fetchCrate, rustPlatform }:
 
 rustPlatform.buildRustPackage rec {
-  version = "7.0.0";
+  version = "8.0.0";
   pname = "oxipng";
 
   src = fetchCrate {
     inherit version pname;
-    hash = "sha256-egAt2XypPFxsOuo8RsIXTmFdmBUe+eZh3p3vlnnx8wo=";
+    hash = "sha256-stTwsU9XK3lF4q2sDgb9A1KG1NnhCfVxYWRiBvlmiqQ=";
   };
 
-  cargoHash = "sha256-GbJU31UBdRai2JLEdx9sPh6rJWnU4RlDL8DooI9MCUg=";
+  cargoHash = "sha256-XMIsdv2AHMGs0tDEWe3cfplZU9CbqEkHd7L5eS+V7j0=";
 
   doCheck = !stdenv.isAarch64 && !stdenv.isDarwin;
 

From f061c452a62b83c1442264b14369be92359d934b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9o=20Zimmermann?= <theo.zimmermann@inria.fr>
Date: Sat, 24 Dec 2022 17:19:04 +0100
Subject: [PATCH 47/52] coqPackages.Cheerios: preemptive fix for removal of
 configure in future versions

---
 pkgs/development/coq-modules/Cheerios/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/coq-modules/Cheerios/default.nix b/pkgs/development/coq-modules/Cheerios/default.nix
index d7763d87c9e6..5c79969c756c 100644
--- a/pkgs/development/coq-modules/Cheerios/default.nix
+++ b/pkgs/development/coq-modules/Cheerios/default.nix
@@ -9,5 +9,9 @@ with lib; mkCoqDerivation {
   release."20200201".sha256 = "1h55s6lk47bk0lv5ralh81z55h799jbl9mhizmqwqzy57y8wqgs1";
 
   propagatedBuildInputs = [ StructTact ];
-  preConfigure = "patchShebangs ./configure";
+  preConfigure = ''
+    if [ -f ./configure ]; then
+      patchShebangs ./configure
+    fi
+  '';
 }

From 6bd604b37c7292772ba7285abe5b56e0f2d9c8c9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9o=20Zimmermann?= <theo.zimmermann@inria.fr>
Date: Sat, 24 Dec 2022 17:19:21 +0100
Subject: [PATCH 48/52] coqPackages.InfSeqExt: preemptive fix for removal of
 configure in future versions

---
 pkgs/development/coq-modules/InfSeqExt/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/coq-modules/InfSeqExt/default.nix b/pkgs/development/coq-modules/InfSeqExt/default.nix
index 1f11ae8e84a2..7f21386c86f6 100644
--- a/pkgs/development/coq-modules/InfSeqExt/default.nix
+++ b/pkgs/development/coq-modules/InfSeqExt/default.nix
@@ -7,5 +7,9 @@ mkCoqDerivation {
   defaultVersion = if lib.versions.isGe "8.5" coq.version then "20200131" else null;
   release."20200131".rev    = "203d4c20211d6b17741f1fdca46dbc091f5e961a";
   release."20200131".sha256 = "0xylkdmb2dqnnqinf3pigz4mf4zmczcbpjnn59g5g76m7f2cqxl0";
-  preConfigure = "patchShebangs ./configure";
+  preConfigure = ''
+    if [ -f ./configure ]; then
+      patchShebangs ./configure
+    fi
+  '';
 }

From 365f7f342fdc3fccfc22b57e7974e7d1eaf615cd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9o=20Zimmermann?= <theo.zimmermann@inria.fr>
Date: Sat, 24 Dec 2022 17:19:46 +0100
Subject: [PATCH 49/52] coqPackages.StructTact: preemptive fix for removal of
 configure in future versions

---
 pkgs/development/coq-modules/StructTact/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/coq-modules/StructTact/default.nix b/pkgs/development/coq-modules/StructTact/default.nix
index 6618e75bab80..3fb8a42cfb56 100644
--- a/pkgs/development/coq-modules/StructTact/default.nix
+++ b/pkgs/development/coq-modules/StructTact/default.nix
@@ -12,5 +12,9 @@ with lib; mkCoqDerivation {
   release."20210328".sha256 = "sha256:1y5r1zm3hli10ah6lnj7n8hxad6rb6rgldd0g7m2fjibzvwqzhdg";
   release."20181102".rev =    "82a85b7ec07e71fa6b30cfc05f6a7bfb09ef2510";
   release."20181102".sha256 = "08zry20flgj7qq37xk32kzmg4fg6d4wi9m7pf9aph8fd3j2a0b5v";
-  preConfigure = "patchShebangs ./configure";
+  preConfigure = ''
+    if [ -f ./configure ]; then
+      patchShebangs ./configure
+    fi
+  '';
 }

From d76cdd7b8b993ace92085d55cb164b0bbff77b0a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Th=C3=A9o=20Zimmermann?= <theo.zimmermann@inria.fr>
Date: Sat, 24 Dec 2022 17:19:51 +0100
Subject: [PATCH 50/52] coqPackages.Verdi: preemptive fix for removal of
 configure in future versions

---
 pkgs/development/coq-modules/Verdi/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/coq-modules/Verdi/default.nix b/pkgs/development/coq-modules/Verdi/default.nix
index 190758855f78..80b964b39042 100644
--- a/pkgs/development/coq-modules/Verdi/default.nix
+++ b/pkgs/development/coq-modules/Verdi/default.nix
@@ -21,5 +21,9 @@ with lib; mkCoqDerivation {
   release."20181102".sha256 = "1vw47c37k5vaa8vbr6ryqy8riagngwcrfmb3rai37yi9xhdqg55z";
 
   propagatedBuildInputs = [ Cheerios InfSeqExt ssreflect ];
-  preConfigure = "patchShebangs ./configure";
+  preConfigure = ''
+    if [ -f ./configure ]; then
+      patchShebangs ./configure
+    fi
+  '';
 }

From a82832314f3fc9c172f38ffdfed22360fba0a881 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Thu, 22 Dec 2022 23:26:59 +0100
Subject: [PATCH 51/52] libredwg: unbreak on aarch64-darwin

---
 pkgs/development/libraries/libredwg/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/development/libraries/libredwg/default.nix b/pkgs/development/libraries/libredwg/default.nix
index a3b43e9377e1..155af3f74f4f 100644
--- a/pkgs/development/libraries/libredwg/default.nix
+++ b/pkgs/development/libraries/libredwg/default.nix
@@ -59,7 +59,6 @@ stdenv.mkDerivation rec {
   checkInputs = lib.optionals enablePython [ libxml2 libxml2.dev ];
 
   meta = with lib; {
-    broken = stdenv.isDarwin && stdenv.isAarch64;
     description = "Free implementation of the DWG file format";
     homepage = "https://savannah.gnu.org/projects/libredwg/";
     maintainers = with maintainers; [ tweber ];

From b1a9ae8dfd85d144ff1b268d6c7b47934358c9a1 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Fri, 23 Dec 2022 05:34:21 +0100
Subject: [PATCH 52/52] percona-xtrabackup_2_4: drop

---
 pkgs/tools/backup/percona-xtrabackup/2_4.nix | 6 ------
 pkgs/top-level/aliases.nix                   | 1 +
 pkgs/top-level/all-packages.nix              | 4 ----
 3 files changed, 1 insertion(+), 10 deletions(-)
 delete mode 100644 pkgs/tools/backup/percona-xtrabackup/2_4.nix

diff --git a/pkgs/tools/backup/percona-xtrabackup/2_4.nix b/pkgs/tools/backup/percona-xtrabackup/2_4.nix
deleted file mode 100644
index 0d2f951c5f89..000000000000
--- a/pkgs/tools/backup/percona-xtrabackup/2_4.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{ callPackage, ... } @ args:
-
-callPackage ./generic.nix (args // {
-  version = "2.4.26";
-  sha256 = "sha256-/erBv/Asi/MfoSvAcQ647VAgOfiViPunFWmvy/W9J18=";
-})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d459d90fd2bc..a77df8b115ee 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1100,6 +1100,7 @@ mapAliases ({
   pentablet-driver = xp-pen-g430-driver; # Added 2022-06-23
   percona-server = percona-server56; # Added 2022-11-01
   percona-server56 = throw "'percona-server56' has been dropped due to lack of maintenance, no upstream support and security issues"; # Added 2022-11-01
+  percona-xtrabackup_2_4 = throw "'percona-xtrabackup_2_4' has been renamed to/replaced by 'percona-xtrabackup'"; # Added 2022-12-23
   perlXMLParser = throw "'perlXMLParser' has been renamed to/replaced by 'perlPackages.XMLParser'"; # Converted to throw 2022-02-22
   perlArchiveCpio = throw "'perlArchiveCpio' has been renamed to/replaced by 'perlPackages.ArchiveCpio'"; # Converted to throw 2022-02-22
   pgadmin = pgadmin4;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 599f8a995f9a..31326355f96f 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10466,10 +10466,6 @@ with pkgs;
   perceptualdiff = callPackage ../tools/graphics/perceptualdiff { };
 
   percona-xtrabackup = percona-xtrabackup_8_0;
-  percona-xtrabackup_2_4 = callPackage ../tools/backup/percona-xtrabackup/2_4.nix {
-    boost = boost159;
-    openssl = openssl_1_1;
-  };
   percona-xtrabackup_8_0 = callPackage ../tools/backup/percona-xtrabackup/8_0.nix {
     boost = boost177;
     openssl = openssl_1_1;