From 4a841f87b8db52558deb053bd1c609e1db1faac8 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Sat, 13 Aug 2022 19:51:01 +0800
Subject: [PATCH 01/41] AMB-plugins: fix cross compilation by replacing
 hardcoded g++ with CXX

---
 pkgs/applications/audio/AMB-plugins/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/audio/AMB-plugins/default.nix b/pkgs/applications/audio/AMB-plugins/default.nix
index 8b03a97d1280..b388674fa449 100644
--- a/pkgs/applications/audio/AMB-plugins/default.nix
+++ b/pkgs/applications/audio/AMB-plugins/default.nix
@@ -15,6 +15,7 @@ stdenv.mkDerivation rec {
     sed -i 's@/usr/bin/install@install@g' Makefile
     sed -i 's@/bin/rm@rm@g' Makefile
     sed -i 's@/usr/lib/ladspa@$(out)/lib/ladspa@g' Makefile
+    sed -i 's@g++@$(CXX)@g' Makefile
   '';
 
   preInstall="mkdir -p $out/lib/ladspa";

From 79ae4eb9979bf89a6d5e6f0804a216b3b86106a5 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <contact@infinisil.com>
Date: Fri, 13 May 2022 16:59:22 +0200
Subject: [PATCH 02/41] fake-nss: Add support for extra passwd and group lines

---
 pkgs/build-support/fake-nss/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/fake-nss/default.nix b/pkgs/build-support/fake-nss/default.nix
index 9e0b60133e00..7d85ec5fc0a5 100644
--- a/pkgs/build-support/fake-nss/default.nix
+++ b/pkgs/build-support/fake-nss/default.nix
@@ -2,17 +2,17 @@
 # Useful when packaging binaries that insist on using nss to look up
 # username/groups (like nginx).
 # /bin/sh is fine to not exist, and provided by another shim.
-{ symlinkJoin, writeTextDir, runCommand }:
+{ lib, symlinkJoin, writeTextDir, runCommand, extraPasswdLines ? [], extraGroupLines ? [] }:
 symlinkJoin {
   name = "fake-nss";
   paths = [
     (writeTextDir "etc/passwd" ''
       root:x:0:0:root user:/var/empty:/bin/sh
-      nobody:x:65534:65534:nobody:/var/empty:/bin/sh
+      ${lib.concatStrings (map (line: line + "\n") extraPasswdLines)}nobody:x:65534:65534:nobody:/var/empty:/bin/sh
     '')
     (writeTextDir "etc/group" ''
       root:x:0:
-      nobody:x:65534:
+      ${lib.concatStrings (map (line: line + "\n") extraGroupLines)}nobody:x:65534:
     '')
     (writeTextDir "etc/nsswitch.conf" ''
       hosts: files dns

From 8ec0837a72b532df84d61b3f8571793f15326b29 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <contact@infinisil.com>
Date: Mon, 9 May 2022 20:43:52 +0200
Subject: [PATCH 03/41] Introduce dockerTools.buildNixShellImage

---
 doc/builders/images/dockertools.section.md | 139 ++++++++++++++++
 pkgs/build-support/docker/default.nix      | 183 +++++++++++++++++++++
 2 files changed, 322 insertions(+)

diff --git a/doc/builders/images/dockertools.section.md b/doc/builders/images/dockertools.section.md
index db1a2a214d1e..581bffd1a5a3 100644
--- a/doc/builders/images/dockertools.section.md
+++ b/doc/builders/images/dockertools.section.md
@@ -394,3 +394,142 @@ buildImage {
   };
 }
 ```
+
+## buildNixShellImage {#ssec-pkgs-dockerTools-buildNixShellImage}
+
+Create a Docker image that sets up an environment similar to that of running `nix-shell` on a derivation.
+When run in Docker, this environment somewhat resembles the Nix sandbox typically used by `nix-build`, with a major difference being that access to the internet is allowed.
+It additionally also behaves like an interactive `nix-shell`, running things like `shellHook` and setting an interactive prompt.
+If the derivation is fully buildable (i.e. `nix-build` can be used on it), running `buildDerivation` inside such a Docker image will build the derivation, with all its outputs being available in the correct `/nix/store` paths, pointed to by the respective environment variables like `$out`, etc.
+
+::: {.warning}
+The behavior doesn't match `nix-shell` or `nix-build` exactly and this function is known not to work correctly for e.g. fixed-output derivations, content-addressed derivations, impure derivations and other special types of derivations.
+:::
+
+### Arguments
+
+`drv`
+
+: The derivation on which to base the Docker image.
+
+    Adding packages to the Docker image is possible by e.g. extending the list of `nativeBuildInputs` of this derivation like
+
+    ```nix
+    buildNixShellImage {
+      drv = someDrv.overrideAttrs (old: {
+        nativeBuildInputs = old.nativeBuildInputs or [] ++ [
+          somethingExtra
+        ];
+      });
+      # ...
+    }
+    ```
+
+    Similarly, you can extend the image initialization script by extending `shellHook`
+
+`name` _optional_
+
+: The name of the resulting image.
+
+    *Default:* `drv.name + "-env"`
+
+`tag` _optional_
+
+: Tag of the generated image.
+
+    *Default:* the resulting image derivation output path's hash
+
+`uid`/`gid` _optional_
+
+: The user/group ID to run the container as. This is like a `nixbld` build user.
+
+    *Default:* 1000/1000
+
+`homeDirectory` _optional_
+
+: The home directory of the user the container is running as
+
+    *Default:* `/build`
+
+`shell` _optional_
+
+: The path to the `bash` binary to use as the shell. This shell is started when running the image.
+
+    *Default:* `pkgs.bashInteractive + "/bin/bash"`
+
+`command` _optional_
+
+: Run this command in the environment of the derivation, in an interactive shell. See the `--command` option in the [`nix-shell` documentation](https://nixos.org/manual/nix/stable/command-ref/nix-shell.html?highlight=nix-shell#options).
+
+    *Default:* (none)
+
+`run` _optional_
+
+: Same as `command`, but runs the command in a non-interactive shell instead. See the `--run` option in the [`nix-shell` documentation](https://nixos.org/manual/nix/stable/command-ref/nix-shell.html?highlight=nix-shell#options).
+
+    *Default:* (none)
+
+### Example
+
+The following shows how to build the `pkgs.hello` package inside a Docker container built with `buildNixShellImage`.
+
+```nix
+with import <nixpkgs> {};
+dockerTools.buildNixShellImage {
+  drv = hello;
+}
+```
+
+Build the derivation:
+
+```console
+nix-build hello.nix
+```
+
+    these 8 derivations will be built:
+      /nix/store/xmw3a5ln29rdalavcxk1w3m4zb2n7kk6-nix-shell-rc.drv
+    ...
+    Creating layer 56 from paths: ['/nix/store/crpnj8ssz0va2q0p5ibv9i6k6n52gcya-stdenv-linux']
+    Creating layer 57 with customisation...
+    Adding manifests...
+    Done.
+    /nix/store/cpyn1lc897ghx0rhr2xy49jvyn52bazv-hello-2.12-env.tar.gz
+
+Load the image:
+
+```console
+docker load -i result
+```
+
+    0d9f4c4cd109: Loading layer [==================================================>]   2.56MB/2.56MB
+    ...
+    ab1d897c0697: Loading layer [==================================================>]  10.24kB/10.24kB
+    Loaded image: hello-2.12-env:pgj9h98nal555415faa43vsydg161bdz
+
+Run the container:
+
+```console
+docker run -it hello-2.12-env:pgj9h98nal555415faa43vsydg161bdz
+```
+
+    [nix-shell:/build]$
+
+In the running container, run the build:
+
+```console
+buildDerivation
+```
+
+    unpacking sources
+    unpacking source archive /nix/store/8nqv6kshb3vs5q5bs2k600xpj5bkavkc-hello-2.12.tar.gz
+    ...
+    patching script interpreter paths in /nix/store/z5wwy5nagzy15gag42vv61c2agdpz2f2-hello-2.12
+    checking for references to /build/ in /nix/store/z5wwy5nagzy15gag42vv61c2agdpz2f2-hello-2.12...
+
+Check the build result:
+
+```console
+$out/bin/hello
+```
+
+    Hello, world!
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index e5b39cdd9dce..81e18c67959b 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -19,6 +19,7 @@
 , pigz
 , rsync
 , runCommand
+, runCommandNoCC
 , runtimeShell
 , shadow
 , skopeo
@@ -30,6 +31,7 @@
 , vmTools
 , writeReferencesToFile
 , writeScript
+, writeShellScriptBin
 , writeText
 , writeTextDir
 , writePython3
@@ -1027,4 +1029,185 @@ rec {
         '';
       in
       result;
+
+  # This function streams a docker image that behaves like a nix-shell for a derivation
+  streamNixShellImage =
+    { # The derivation whose environment this docker image should be based on
+      drv
+    , # Image Name
+      name ? drv.name + "-env"
+    , # Image tag, the Nix's output hash will be used if null
+      tag ? null
+    , # User id to run the container as. Defaults to 1000, because many
+      # binaries don't like to be run as root
+      uid ? 1000
+    , # Group id to run the container as, see also uid
+      gid ? 1000
+    , # The home directory of the user
+      homeDirectory ? "/build"
+    , # The path to the bash binary to use as the shell. See `NIX_BUILD_SHELL` in `man nix-shell`
+      shell ? bashInteractive + "/bin/bash"
+    , # Run this command in the environment of the derivation, in an interactive shell. See `--command` in `man nix-shell`
+      command ? null
+    , # Same as `command`, but runs the command in a non-interactive shell instead. See `--run` in `man nix-shell`
+      run ? null
+    }:
+      assert lib.assertMsg (! (drv.drvAttrs.__structuredAttrs or false))
+        "streamNixShellImage: Does not work with the derivation ${drv.name} because it uses __structuredAttrs";
+      assert lib.assertMsg (command == null || run == null)
+        "streamNixShellImage: Can't specify both command and run";
+      let
+
+        # A binary that calls the command to build the derivation
+        builder = writeShellScriptBin "buildDerivation" ''
+          exec ${lib.escapeShellArg (stringValue drv.drvAttrs.builder)} ${lib.escapeShellArgs (map stringValue drv.drvAttrs.args)}
+        '';
+
+        staticPath = "${dirOf shell}:${lib.makeBinPath [ builder ]}";
+
+        # https://github.com/NixOS/nix/blob/2.8.0/src/nix-build/nix-build.cc#L493-L526
+        rcfile = writeText "nix-shell-rc" ''
+          unset PATH
+          dontAddDisableDepTrack=1
+          # TODO: https://github.com/NixOS/nix/blob/2.8.0/src/nix-build/nix-build.cc#L506
+          [ -e $stdenv/setup ] && source $stdenv/setup
+          PATH=${staticPath}:"$PATH"
+          SHELL=${lib.escapeShellArg shell}
+          BASH=${lib.escapeShellArg shell}
+          set +e
+          [ -n "$PS1" -a -z "$NIX_SHELL_PRESERVE_PROMPT" ] && PS1='\n\[\033[1;32m\][nix-shell:\w]\$\[\033[0m\] '
+          if [ "$(type -t runHook)" = function ]; then
+            runHook shellHook
+          fi
+          unset NIX_ENFORCE_PURITY
+          shopt -u nullglob
+          shopt -s execfail
+          ${optionalString (command != null || run != null) ''
+            ${optionalString (command != null) command}
+            ${optionalString (run != null) run}
+            exit
+          ''}
+        '';
+
+        # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/globals.hh#L464-L465
+        sandboxBuildDir = "/build";
+
+        # This function closely mirrors what this Nix code does:
+        # https://github.com/NixOS/nix/blob/2.8.0/src/libexpr/primops.cc#L1102
+        # https://github.com/NixOS/nix/blob/2.8.0/src/libexpr/eval.cc#L1981-L2036
+        stringValue = value:
+          # We can't just use `toString` on all derivation attributes because that
+          # would not put path literals in the closure. So we explicitly copy
+          # those into the store here
+          if builtins.typeOf value == "path" then "${value}"
+          else if builtins.typeOf value == "list" then toString (map stringValue value)
+          else toString value;
+
+        # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L992-L1004
+        drvEnv = lib.mapAttrs' (name: value:
+          let str = stringValue value;
+          in if lib.elem name (drv.drvAttrs.passAsFile or [])
+          then lib.nameValuePair "${name}Path" (writeText "pass-as-text-${name}" str)
+          else lib.nameValuePair name str
+        ) drv.drvAttrs //
+          # A mapping from output name to the nix store path where they should end up
+          # https://github.com/NixOS/nix/blob/2.8.0/src/libexpr/primops.cc#L1253
+          lib.genAttrs drv.outputs (output: builtins.unsafeDiscardStringContext drv.${output}.outPath);
+
+        # Environment variables set in the image
+        envVars = {
+
+          # Root certificates for internet access
+          SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+          # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1027-L1030
+          # PATH = "/path-not-set";
+          # Allows calling bash and `buildDerivation` as the Cmd
+          PATH = staticPath;
+
+          # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1032-L1038
+          HOME = homeDirectory;
+
+          # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1040-L1044
+          NIX_STORE = storeDir;
+
+          # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1046-L1047
+          # TODO: Make configurable?
+          NIX_BUILD_CORES = "1";
+
+        } // drvEnv // {
+
+          # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1008-L1010
+          NIX_BUILD_TOP = sandboxBuildDir;
+
+          # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1012-L1013
+          TMPDIR = sandboxBuildDir;
+          TEMPDIR = sandboxBuildDir;
+          TMP = sandboxBuildDir;
+          TEMP = sandboxBuildDir;
+
+          # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1015-L1019
+          PWD = sandboxBuildDir;
+
+          # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1071-L1074
+          # We don't set it here because the output here isn't handled in any special way
+          # NIX_LOG_FD = "2";
+
+          # https://github.com/NixOS/nix/blob/2.8.0/src/libstore/build/local-derivation-goal.cc#L1076-L1077
+          TERM = "xterm-256color";
+        };
+
+
+      in streamLayeredImage {
+        inherit name tag;
+        contents = [
+          binSh
+          usrBinEnv
+          (fakeNss.override {
+            # Allows programs to look up the build user's home directory
+            # https://github.com/NixOS/nix/blob/ffe155abd36366a870482625543f9bf924a58281/src/libstore/build/local-derivation-goal.cc#L906-L910
+            # Slightly differs however: We use the passed-in homeDirectory instead of sandboxBuildDir.
+            # We're doing this because it's arguably a bug in Nix that sandboxBuildDir is used here: https://github.com/NixOS/nix/issues/6379
+            extraPasswdLines = [
+              "nixbld:x:${toString uid}:${toString gid}:Build user:${homeDirectory}:/noshell"
+            ];
+            extraGroupLines = [
+              "nixbld:!:${toString gid}:"
+            ];
+          })
+        ];
+
+        fakeRootCommands = ''
+          # Allows any user to create new directories in the Nix store (for the build result)
+          mkdir -p .${storeDir}
+          chmod a+w+t .${storeDir}
+
+          # Gives the user control over the build directory
+          mkdir -p .${sandboxBuildDir}
+          chown -R ${toString uid}:${toString gid} .${sandboxBuildDir}
+        '';
+
+        # Run this image as the given uid/gid
+        config.User = "${toString uid}:${toString gid}";
+        config.Cmd =
+          # https://github.com/NixOS/nix/blob/2.8.0/src/nix-build/nix-build.cc#L185-L186
+          # https://github.com/NixOS/nix/blob/2.8.0/src/nix-build/nix-build.cc#L534-L536
+          if run == null
+          then [ shell "--rcfile" rcfile ]
+          else [ shell rcfile ];
+        config.WorkingDir = sandboxBuildDir;
+        config.Env = lib.mapAttrsToList (name: value: "${name}=${value}") envVars;
+      };
+
+  # Wrapper around streamNixShellImage to build an image from the result
+  buildNixShellImage = { drv, ... }@args:
+    let
+      stream = streamNixShellImage args;
+    in
+    runCommand "${drv.name}-env.tar.gz"
+      {
+        inherit (stream) imageName;
+        passthru = { inherit (stream) imageTag; };
+        nativeBuildInputs = [ pigz ];
+      } "${stream} | pigz -nT > $out";
 }

From c36f929dee42c13ffa5e02adfdf749ec789fc5f4 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <contact@infinisil.com>
Date: Mon, 16 May 2022 17:00:54 +0200
Subject: [PATCH 04/41] nixos/tests: Add tests for
 dockerTools.buildNixShellImage

---
 nixos/tests/docker-tools.nix           |  53 +++++++++++
 pkgs/build-support/docker/default.nix  |   2 +-
 pkgs/build-support/docker/examples.nix | 116 ++++++++++++++++++++++++-
 3 files changed, 169 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
index 21a727dbd97c..e76a46131929 100644
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@@ -431,5 +431,58 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         docker.succeed("docker run --rm image-with-certs:latest test -r /etc/pki/tls/certs/ca-bundle.crt")
         docker.succeed("docker image rm image-with-certs:latest")
 
+    with subtest("buildNixShellImage: Can build a basic derivation"):
+        docker.succeed(
+            "${examples.nix-shell-basic} | docker load",
+            "docker run --rm nix-shell-basic bash -c 'buildDerivation && $out/bin/hello' | grep '^Hello, world!$'"
+        )
+
+    with subtest("buildNixShellImage: Runs the shell hook"):
+        docker.succeed(
+            "${examples.nix-shell-hook} | docker load",
+            "docker run --rm -it nix-shell-hook | grep 'This is the shell hook!'"
+        )
+
+    with subtest("buildNixShellImage: Sources stdenv, making build inputs available"):
+        docker.succeed(
+            "${examples.nix-shell-inputs} | docker load",
+            "docker run --rm -it nix-shell-inputs | grep 'Hello, world!'"
+        )
+
+    with subtest("buildNixShellImage: passAsFile works"):
+        docker.succeed(
+            "${examples.nix-shell-pass-as-file} | docker load",
+            "docker run --rm -it nix-shell-pass-as-file | grep 'this is a string'"
+        )
+
+    with subtest("buildNixShellImage: run argument works"):
+        docker.succeed(
+            "${examples.nix-shell-run} | docker load",
+            "docker run --rm -it nix-shell-run | grep 'This shell is not interactive'"
+        )
+
+    with subtest("buildNixShellImage: command argument works"):
+        docker.succeed(
+            "${examples.nix-shell-command} | docker load",
+            "docker run --rm -it nix-shell-command | grep 'This shell is interactive'"
+        )
+
+    with subtest("buildNixShellImage: home directory is writable by default"):
+        docker.succeed(
+            "${examples.nix-shell-writable-home} | docker load",
+            "docker run --rm -it nix-shell-writable-home"
+        )
+
+    with subtest("buildNixShellImage: home directory can be made non-existent"):
+        docker.succeed(
+            "${examples.nix-shell-nonexistent-home} | docker load",
+            "docker run --rm -it nix-shell-nonexistent-home"
+        )
+
+    with subtest("buildNixShellImage: can build derivations"):
+        docker.succeed(
+            "${examples.nix-shell-build-derivation} | docker load",
+            "docker run --rm -it nix-shell-build-derivation"
+        )
   '';
 })
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 81e18c67959b..9e35ffc1bced 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -80,7 +80,7 @@ let
 in
 rec {
   examples = callPackage ./examples.nix {
-    inherit buildImage buildLayeredImage fakeNss pullImage shadowSetup buildImageWithNixDb;
+    inherit buildImage buildLayeredImage fakeNss pullImage shadowSetup buildImageWithNixDb streamNixShellImage;
   };
 
   tests = {
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index 1e9f07045e37..802b2f79f0fc 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -7,7 +7,7 @@
 #  $ nix-build '<nixpkgs>' -A dockerTools.examples.redis
 #  $ docker load < result
 
-{ pkgs, buildImage, buildLayeredImage, fakeNss, pullImage, shadowSetup, buildImageWithNixDb, pkgsCross }:
+{ pkgs, buildImage, buildLayeredImage, fakeNss, pullImage, shadowSetup, buildImageWithNixDb, pkgsCross, streamNixShellImage }:
 
 let
   nixosLib = import ../../../nixos/lib {
@@ -715,4 +715,118 @@ rec {
     config = {
     };
   };
+
+  nix-shell-basic = streamNixShellImage {
+    name = "nix-shell-basic";
+    tag = "latest";
+    drv = pkgs.hello;
+  };
+
+  nix-shell-hook = streamNixShellImage {
+    name = "nix-shell-hook";
+    tag = "latest";
+    drv = pkgs.mkShell {
+      shellHook = ''
+        echo "This is the shell hook!"
+        exit
+      '';
+    };
+  };
+
+  nix-shell-inputs = streamNixShellImage {
+    name = "nix-shell-inputs";
+    tag = "latest";
+    drv = pkgs.mkShell {
+      nativeBuildInputs = [
+        pkgs.hello
+      ];
+    };
+    command = ''
+      hello
+    '';
+  };
+
+  nix-shell-pass-as-file = streamNixShellImage {
+    name = "nix-shell-pass-as-file";
+    tag = "latest";
+    drv = pkgs.mkShell {
+      str = "this is a string";
+      passAsFile = [ "str" ];
+    };
+    command = ''
+      cat "$strPath"
+    '';
+  };
+
+  nix-shell-run = streamNixShellImage {
+    name = "nix-shell-run";
+    tag = "latest";
+    drv = pkgs.mkShell {};
+    run = ''
+      case "$-" in
+      *i*) echo This shell is interactive ;;
+      *) echo This shell is not interactive ;;
+      esac
+    '';
+  };
+
+  nix-shell-command = streamNixShellImage {
+    name = "nix-shell-command";
+    tag = "latest";
+    drv = pkgs.mkShell {};
+    command = ''
+      case "$-" in
+      *i*) echo This shell is interactive ;;
+      *) echo This shell is not interactive ;;
+      esac
+    '';
+  };
+
+  nix-shell-writable-home = streamNixShellImage {
+    name = "nix-shell-writable-home";
+    tag = "latest";
+    drv = pkgs.mkShell {};
+    run = ''
+      if [[ "$HOME" != "$(eval "echo ~$(whoami)")" ]]; then
+        echo "\$HOME ($HOME) is not the same as ~\$(whoami) ($(eval "echo ~$(whoami)"))"
+        exit 1
+      fi
+
+      if ! touch $HOME/test-file; then
+        echo "home directory is not writable"
+        exit 1
+      fi
+      echo "home directory is writable"
+    '';
+  };
+
+  nix-shell-nonexistent-home = streamNixShellImage {
+    name = "nix-shell-nonexistent-home";
+    tag = "latest";
+    drv = pkgs.mkShell {};
+    homeDirectory = "/homeless-shelter";
+    run = ''
+      if [[ "$HOME" != "$(eval "echo ~$(whoami)")" ]]; then
+        echo "\$HOME ($HOME) is not the same as ~\$(whoami) ($(eval "echo ~$(whoami)"))"
+        exit 1
+      fi
+
+      if -e $HOME; then
+        echo "home directory exists"
+        exit 1
+      fi
+      echo "home directory doesn't exist"
+    '';
+  };
+
+  nix-shell-build-derivation = streamNixShellImage {
+    name = "nix-shell-build-derivation";
+    tag = "latest";
+    drv = pkgs.hello;
+    run = ''
+      buildDerivation
+      $out/bin/hello
+    '';
+  };
+
 }

From afa775618da7af998227a7e82f4b5ae6a294f40a Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Wed, 2 Nov 2022 11:44:27 +0800
Subject: [PATCH 05/41] openpgp-card-tools: 0.0.12 -> 0.9.0

---
 pkgs/tools/security/openpgp-card-tools/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/security/openpgp-card-tools/default.nix b/pkgs/tools/security/openpgp-card-tools/default.nix
index 572c862b7f1f..c3c512081c62 100644
--- a/pkgs/tools/security/openpgp-card-tools/default.nix
+++ b/pkgs/tools/security/openpgp-card-tools/default.nix
@@ -12,14 +12,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "openpgp-card-tools";
-  version = "0.0.12";
+  version = "0.9.0";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-3OKOMe7Uj+8qpzfu0DzqwIGa/QJ0YoKczPN9W8HXJZU=";
+    sha256 = "sha256-Mvnj8AEhREP+nGrioC9IHYX3k6sKGKzOh00V8nslyhw=";
   };
 
-  cargoHash = "sha256-gq17BXorXrlJx4zlvLuOT8XGUCqZXFDSxgs/Fv9dChk=";
+  cargoHash = "sha256-0KRq8GsrQaLJ6fopZpdzgxIWHIse9QWDo24IQj1eAhc=";
 
   nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ];
   buildInputs = [ pcsclite nettle ] ++ lib.optionals stdenv.isDarwin [ PCSC ];

From a1cf24939404560acaac6555ae55942ae4163b9f Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <contact@infinisil.com>
Date: Mon, 7 Nov 2022 19:37:34 +0100
Subject: [PATCH 06/41] dockerTools.buildNixShellImage: Chown nix directories

To the user running the docker image. If a Nix binary is available in
the resulting derivation, this then behaves like a single-user Nix
installation, except that already-written /nix/store paths can't be
changed. Most notably it makes Nix work not have to rely on a chroot
store in the image
---
 pkgs/build-support/docker/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index 9e35ffc1bced..1a28cf8970c3 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -1178,9 +1178,12 @@ rec {
         ];
 
         fakeRootCommands = ''
-          # Allows any user to create new directories in the Nix store (for the build result)
-          mkdir -p .${storeDir}
-          chmod a+w+t .${storeDir}
+          # Effectively a single-user installation of Nix, giving the user full
+          # control over the Nix store. Needed for building the derivation this
+          # shell is for, but also in case one wants to use Nix inside the
+          # image
+          mkdir -p ./nix/{store,var/nix} ./etc/nix
+          chown -R ${toString uid}:${toString gid} ./nix ./etc/nix
 
           # Gives the user control over the build directory
           mkdir -p .${sandboxBuildDir}

From 53c31d03d55dad7d00c25b5c2fcf9fbb75ffedb8 Mon Sep 17 00:00:00 2001
From: Nick Cao <nickcao@nichi.co>
Date: Mon, 21 Nov 2022 15:34:04 +0800
Subject: [PATCH 07/41] scdoc: fix cross compilation by setting HOST_SCDOC

---
 pkgs/tools/typesetting/scdoc/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/tools/typesetting/scdoc/default.nix b/pkgs/tools/typesetting/scdoc/default.nix
index c64136ad6b98..17a91d18e393 100644
--- a/pkgs/tools/typesetting/scdoc/default.nix
+++ b/pkgs/tools/typesetting/scdoc/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromSourcehut }:
+{ lib, stdenv, fetchFromSourcehut, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "scdoc";
@@ -17,6 +17,10 @@ stdenv.mkDerivation rec {
       --replace "/usr/local" "$out"
   '';
 
+  makeFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "HOST_SCDOC=${buildPackages.scdoc}/bin/scdoc"
+  ];
+
   doCheck = true;
 
   meta = with lib; {

From 6b3271ebeed4aa5b371286437e6a95010fb66666 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Mon, 21 Nov 2022 20:41:48 +0300
Subject: [PATCH 08/41] =?UTF-8?q?martin:=200.5.0=20=E2=86=92=200.6.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/servers/geospatial/martin/default.nix    |  20 +-
 .../martin/update-socket2-for-rust-1.64.patch | 358 ------------------
 2 files changed, 7 insertions(+), 371 deletions(-)
 delete mode 100644 pkgs/servers/geospatial/martin/update-socket2-for-rust-1.64.patch

diff --git a/pkgs/servers/geospatial/martin/default.nix b/pkgs/servers/geospatial/martin/default.nix
index b225591a5adc..8525efe97057 100644
--- a/pkgs/servers/geospatial/martin/default.nix
+++ b/pkgs/servers/geospatial/martin/default.nix
@@ -2,21 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "martin";
-  version = "0.5.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
-    owner = "urbica";
-    repo = pname;
+    owner = "maplibre";
+    repo = "martin";
     rev = "v${version}";
-    hash = "sha256-kygqwbaByse81oc007piXHM6aK6Yi2JB0qTFN2WFP8U=";
+    hash = "sha256-k5PekD+7cmsRa7qRAqQ1gKaX7i07whKTgeU6OM39BBE=";
   };
 
-  cargoPatches = [
-    # Remove after a new release, tracked by https://github.com/maplibre/martin/issues/410.
-    ./update-socket2-for-rust-1.64.patch
-  ];
-
-  cargoHash = "sha256-oevyr1P0uzHbpWCYQ1raqA42HI2KLl2IYcm1D2PeKOo=";
+  cargoHash = "sha256-rcyR1/b9Ap6mQR9yFDdsDJSvGxVNQrpt+t3sRSV4oPU=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
@@ -24,9 +19,8 @@ rustPlatform.buildRustPackage rec {
 
   meta = with lib; {
     description = "Blazing fast and lightweight PostGIS vector tiles server";
-    homepage = "https://martin.urbica.co/";
-    license = licenses.mit;
+    homepage = "https://martin.maplibre.org/";
+    license = with licenses; [ mit /* or */ asl20 ];
     maintainers = with maintainers; [ sikmir ];
-    platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/servers/geospatial/martin/update-socket2-for-rust-1.64.patch b/pkgs/servers/geospatial/martin/update-socket2-for-rust-1.64.patch
deleted file mode 100644
index c70261a3076c..000000000000
--- a/pkgs/servers/geospatial/martin/update-socket2-for-rust-1.64.patch
+++ /dev/null
@@ -1,358 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 8c90ecb..13c3149 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -305,7 +305,7 @@ name = "atty"
- version = "0.2.13"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
-@@ -343,7 +343,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "backtrace-sys 0.1.32 (registry+https://github.com/rust-lang/crates.io-index)",
-  "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rustc-demangle 0.1.16 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
-@@ -353,7 +353,7 @@ version = "0.1.32"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "cc 1.0.46 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
- [[package]]
-@@ -393,7 +393,7 @@ version = "0.3.2"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "cc 1.0.46 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
- [[package]]
-@@ -402,7 +402,7 @@ version = "0.3.2"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "brotli-sys 0.3.2 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
- [[package]]
-@@ -458,12 +458,17 @@ name = "cfg-if"
- version = "0.1.10"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- 
-+[[package]]
-+name = "cfg-if"
-+version = "1.0.0"
-+source = "registry+https://github.com/rust-lang/crates.io-index"
-+
- [[package]]
- name = "chrono"
- version = "0.4.9"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "num-integer 0.1.41 (registry+https://github.com/rust-lang/crates.io-index)",
-  "num-traits 0.2.8 (registry+https://github.com/rust-lang/crates.io-index)",
-  "time 0.1.42 (registry+https://github.com/rust-lang/crates.io-index)",
-@@ -734,7 +739,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
-  "crc32fast 1.2.0 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "miniz-sys 0.1.12 (registry+https://github.com/rust-lang/crates.io-index)",
-  "miniz_oxide 0.3.3 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
-@@ -782,7 +787,7 @@ version = "0.1.13"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "wasi 0.7.0 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
-@@ -832,7 +837,7 @@ name = "hostname"
- version = "0.1.5"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "winutil 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
-@@ -892,7 +897,7 @@ name = "iovec"
- version = "0.1.4"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
- [[package]]
-@@ -900,7 +905,7 @@ name = "ipconfig"
- version = "0.2.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-- "socket2 0.3.11 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "socket2 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)",
-  "widestring 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
-  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
-  "winreg 0.6.2 (registry+https://github.com/rust-lang/crates.io-index)",
-@@ -940,7 +945,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- 
- [[package]]
- name = "libc"
--version = "0.2.65"
-+version = "0.2.134"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- 
- [[package]]
-@@ -1019,7 +1024,7 @@ name = "memchr"
- version = "1.0.2"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
- [[package]]
-@@ -1027,7 +1032,7 @@ name = "memchr"
- version = "2.2.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
- [[package]]
-@@ -1049,7 +1054,7 @@ version = "0.1.12"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "cc 1.0.46 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
- [[package]]
-@@ -1069,7 +1074,7 @@ dependencies = [
-  "fuchsia-zircon-sys 0.3.3 (registry+https://github.com/rust-lang/crates.io-index)",
-  "iovec 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
-  "kernel32-sys 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "log 0.4.8 (registry+https://github.com/rust-lang/crates.io-index)",
-  "miow 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)",
-  "net2 0.2.33 (registry+https://github.com/rust-lang/crates.io-index)",
-@@ -1083,7 +1088,7 @@ version = "0.6.7"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "iovec 0.1.4 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "mio 0.6.19 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
-@@ -1104,7 +1109,7 @@ version = "0.2.33"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
-@@ -1135,7 +1140,7 @@ name = "num_cpus"
- version = "1.10.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
- [[package]]
-@@ -1165,7 +1170,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
-  "cloudabi 0.0.3 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rand 0.6.5 (registry+https://github.com/rust-lang/crates.io-index)",
-  "redox_syscall 0.1.56 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rustc_version 0.2.3 (registry+https://github.com/rust-lang/crates.io-index)",
-@@ -1180,7 +1185,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
-  "cloudabi 0.0.3 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "redox_syscall 0.1.56 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rustc_version 0.2.3 (registry+https://github.com/rust-lang/crates.io-index)",
-  "smallvec 0.6.10 (registry+https://github.com/rust-lang/crates.io-index)",
-@@ -1223,7 +1228,7 @@ dependencies = [
-  "log 0.4.8 (registry+https://github.com/rust-lang/crates.io-index)",
-  "postgres-protocol 0.3.2 (registry+https://github.com/rust-lang/crates.io-index)",
-  "postgres-shared 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)",
-- "socket2 0.3.11 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "socket2 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
- [[package]]
-@@ -1325,7 +1330,7 @@ name = "rand"
- version = "0.3.23"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rand 0.4.6 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
-@@ -1335,7 +1340,7 @@ version = "0.4.6"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "fuchsia-cprng 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rand_core 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rdrand 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
-  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
-@@ -1347,7 +1352,7 @@ version = "0.6.5"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "autocfg 0.1.7 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rand_chacha 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rand_core 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rand_hc 0.1.0 (registry+https://github.com/rust-lang/crates.io-index)",
-@@ -1365,7 +1370,7 @@ version = "0.7.2"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "getrandom 0.1.13 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rand_chacha 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rand_core 0.5.1 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rand_hc 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)",
-@@ -1439,7 +1444,7 @@ name = "rand_jitter"
- version = "0.1.4"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rand_core 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)",
-  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
-@@ -1451,7 +1456,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "cloudabi 0.0.3 (registry+https://github.com/rust-lang/crates.io-index)",
-  "fuchsia-cprng 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rand_core 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rdrand 0.4.0 (registry+https://github.com/rust-lang/crates.io-index)",
-  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
-@@ -1687,7 +1692,7 @@ name = "signal-hook"
- version = "0.1.10"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "signal-hook-registry 1.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
-@@ -1697,7 +1702,7 @@ version = "1.1.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "arc-swap 0.4.3 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
- [[package]]
-@@ -1717,12 +1722,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
- 
- [[package]]
- name = "socket2"
--version = "0.3.11"
-+version = "0.3.19"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-- "cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-- "redox_syscall 0.1.56 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "cfg-if 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
- 
-@@ -1825,7 +1829,7 @@ name = "time"
- version = "0.1.42"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "redox_syscall 0.1.56 (registry+https://github.com/rust-lang/crates.io-index)",
-  "winapi 0.3.8 (registry+https://github.com/rust-lang/crates.io-index)",
- ]
-@@ -1901,7 +1905,7 @@ version = "0.2.7"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- dependencies = [
-  "futures 0.1.29 (registry+https://github.com/rust-lang/crates.io-index)",
-- "libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)",
-  "mio 0.6.19 (registry+https://github.com/rust-lang/crates.io-index)",
-  "mio-uds 0.6.7 (registry+https://github.com/rust-lang/crates.io-index)",
-  "signal-hook 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
-@@ -1972,7 +1976,7 @@ dependencies = [
-  "log 0.4.8 (registry+https://github.com/rust-lang/crates.io-index)",
-  "rand 0.6.5 (registry+https://github.com/rust-lang/crates.io-index)",
-  "smallvec 0.6.10 (registry+https://github.com/rust-lang/crates.io-index)",
-- "socket2 0.3.11 (registry+https://github.com/rust-lang/crates.io-index)",
-+ "socket2 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)",
-  "tokio-executor 0.1.8 (registry+https://github.com/rust-lang/crates.io-index)",
-  "tokio-io 0.1.12 (registry+https://github.com/rust-lang/crates.io-index)",
-  "tokio-reactor 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)",
-@@ -2200,6 +2204,7 @@ dependencies = [
- "checksum cast 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)" = "926013f2860c46252efceabb19f4a6b308197505082c609025aa6706c011d427"
- "checksum cc 1.0.46 (registry+https://github.com/rust-lang/crates.io-index)" = "0213d356d3c4ea2c18c40b037c3be23cd639825c18f25ee670ac7813beeef99c"
- "checksum cfg-if 0.1.10 (registry+https://github.com/rust-lang/crates.io-index)" = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
-+"checksum cfg-if 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)" = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
- "checksum chrono 0.4.9 (registry+https://github.com/rust-lang/crates.io-index)" = "e8493056968583b0193c1bb04d6f7684586f3726992d6c573261941a895dbd68"
- "checksum clap 2.33.0 (registry+https://github.com/rust-lang/crates.io-index)" = "5067f5bb2d80ef5d68b4c87db81601f0b75bca627bc2ef76b141d7b846a3c6d9"
- "checksum cloudabi 0.0.3 (registry+https://github.com/rust-lang/crates.io-index)" = "ddfc5b9aa5d4507acaf872de71051dfd0e309860e88966e1051e462a077aac4f"
-@@ -2256,7 +2261,7 @@ dependencies = [
- "checksum kernel32-sys 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)" = "7507624b29483431c0ba2d82aece8ca6cdba9382bff4ddd0f7490560c056098d"
- "checksum language-tags 0.2.2 (registry+https://github.com/rust-lang/crates.io-index)" = "a91d884b6667cd606bb5a69aa0c99ba811a115fc68915e7056ec08a46e93199a"
- "checksum lazy_static 1.4.0 (registry+https://github.com/rust-lang/crates.io-index)" = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
--"checksum libc 0.2.65 (registry+https://github.com/rust-lang/crates.io-index)" = "1a31a0627fdf1f6a39ec0dd577e101440b7db22672c0901fe00a9a6fbb5c24e8"
-+"checksum libc 0.2.134 (registry+https://github.com/rust-lang/crates.io-index)" = "329c933548736bc49fd575ee68c89e8be4d260064184389a5b77517cddd99ffb"
- "checksum linked-hash-map 0.5.2 (registry+https://github.com/rust-lang/crates.io-index)" = "ae91b68aebc4ddb91978b11a1b02ddd8602a05ec19002801c5666000e05e0f83"
- "checksum lock_api 0.2.0 (registry+https://github.com/rust-lang/crates.io-index)" = "ed946d4529956a20f2d63ebe1b69996d5a2137c91913fe3ebbeff957f5bca7ff"
- "checksum lock_api 0.3.1 (registry+https://github.com/rust-lang/crates.io-index)" = "f8912e782533a93a167888781b836336a6ca5da6175c05944c86cf28c31104dc"
-@@ -2344,7 +2349,7 @@ dependencies = [
- "checksum siphasher 0.2.3 (registry+https://github.com/rust-lang/crates.io-index)" = "0b8de496cf83d4ed58b6be86c3a275b8602f6ffe98d3024a869e124147a9a3ac"
- "checksum slab 0.4.2 (registry+https://github.com/rust-lang/crates.io-index)" = "c111b5bd5695e56cffe5129854aa230b39c93a305372fdbb2668ca2394eea9f8"
- "checksum smallvec 0.6.10 (registry+https://github.com/rust-lang/crates.io-index)" = "ab606a9c5e214920bb66c458cd7be8ef094f813f20fe77a54cc7dbfff220d4b7"
--"checksum socket2 0.3.11 (registry+https://github.com/rust-lang/crates.io-index)" = "e8b74de517221a2cb01a53349cf54182acdc31a074727d3079068448c0676d85"
-+"checksum socket2 0.3.19 (registry+https://github.com/rust-lang/crates.io-index)" = "122e570113d28d773067fab24266b66753f6ea915758651696b6e35e49f88d6e"
- "checksum string 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "d24114bfcceb867ca7f71a0d3fe45d45619ec47a6fbfa98cb14e14250bfa5d6d"
- "checksum stringprep 0.1.2 (registry+https://github.com/rust-lang/crates.io-index)" = "8ee348cb74b87454fff4b551cbf727025810a004f88aeacae7f85b87f4e9a1c1"
- "checksum strsim 0.9.2 (registry+https://github.com/rust-lang/crates.io-index)" = "032c03039aae92b350aad2e3779c352e104d919cb192ba2fabbd7b831ce4f0f6"
-@@ -2393,3 +2398,4 @@ dependencies = [
- "checksum winutil 0.1.1 (registry+https://github.com/rust-lang/crates.io-index)" = "7daf138b6b14196e3830a588acf1e86966c694d3e8fb026fb105b8b5dca07e6e"
- "checksum ws2_32-sys 0.2.1 (registry+https://github.com/rust-lang/crates.io-index)" = "d59cefebd0c892fa2dd6de581e937301d8552cb44489cdff035c6187cb63fa5e"
- "checksum yaml-rust 0.4.3 (registry+https://github.com/rust-lang/crates.io-index)" = "65923dd1784f44da1d2c3dbbc5e822045628c590ba72123e1c73d3c230c4434d"
-+

From 8fbec14a71827220bbc9211c3a2a201f1ea9feb0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 25 Nov 2022 09:30:47 -0800
Subject: [PATCH 09/41] telepathy-logger: build using python3

---
 .../telepathy/logger/default.nix                 | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix b/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix
index 1bf0e329073d..ac03ee20ff95 100644
--- a/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/logger/default.nix
@@ -1,5 +1,7 @@
-{ lib, stdenv, fetchurl, dbus-glib, libxml2, sqlite, telepathy-glib, python2, pkg-config
-, dconf, makeWrapper, intltool, libxslt, gobject-introspection, dbus }:
+{ lib, stdenv, fetchurl, dbus-glib, libxml2, sqlite, telepathy-glib, python3, pkg-config
+, dconf, makeWrapper, intltool, libxslt, gobject-introspection, dbus
+, fetchpatch
+}:
 
 stdenv.mkDerivation rec {
   pname = "telepathy-logger";
@@ -10,12 +12,20 @@ stdenv.mkDerivation rec {
     sha256 = "1bjx85k7jyfi5pvl765fzc7q2iz9va51anrc2djv7caksqsdbjlg";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/archlinux/svntogit-packages/raw/2b5bdbb4739d3517f5e7300edc8dab775743b96d/trunk/0001-tools-Fix-the-build-with-Python-3.patch";
+      hash = "sha256-o1lfdZIIqaxn7ntQZnoOMqquc6efTHgSIxB5dpFWRgg=";
+    })
+  ];
+
   nativeBuildInputs = [
     makeWrapper pkg-config intltool libxslt gobject-introspection
+    python3
   ];
   buildInputs = [
     dbus-glib libxml2 sqlite telepathy-glib
-    dbus python2
+    dbus
   ];
 
   configureFlags = [ "--enable-call" ];

From 32116efdc00871434b1f29cc8850462015c4de30 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 25 Nov 2022 10:24:31 -0800
Subject: [PATCH 10/41] telepathy-idle: 0.2.0 -> 0.2.2

---
 .../instant-messengers/telepathy/idle/default.nix      | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix b/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix
index fe7ef49cd0d3..1a546ed1aef5 100644
--- a/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/idle/default.nix
@@ -1,16 +1,16 @@
-{ lib, stdenv, fetchurl, glib, dconf, pkg-config, dbus-glib, telepathy-glib, python2, libxslt, makeWrapper }:
+{ lib, stdenv, fetchurl, glib, dconf, pkg-config, dbus-glib, telepathy-glib, python3, libxslt, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "telepathy-idle";
-  version = "0.2.0";
+  version = "0.2.2";
 
   src = fetchurl {
     url = "http://telepathy.freedesktop.org/releases/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1argdzbif1vdmwp5vqbgkadq9ancjmgdm2ncp0qfckni715ss4rh";
+    hash = "sha256-g4fiXl+wtMvnAeXcCS1mbWUQuDP9Pn5GLpFw027DwV8=";
   };
 
-  nativeBuildInputs = [ pkg-config makeWrapper ];
-  buildInputs = [ glib telepathy-glib dbus-glib libxslt python2 (lib.getLib dconf) ];
+  nativeBuildInputs = [ pkg-config python3 makeWrapper ];
+  buildInputs = [ glib telepathy-glib dbus-glib libxslt (lib.getLib dconf) ];
 
   preFixup = ''
     wrapProgram "$out/libexec/telepathy-idle" \

From b5f9c6e591c9e0a375d8586fca54d1ab2dd20400 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 25 Nov 2022 10:33:24 -0800
Subject: [PATCH 11/41] telepathy-haze: 0.8.0 -> 0.8.1

---
 .../telepathy/haze/default.nix                | 21 ++++++-------------
 1 file changed, 6 insertions(+), 15 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/telepathy/haze/default.nix b/pkgs/applications/networking/instant-messengers/telepathy/haze/default.nix
index 27df1273c083..4b8d2f6104ab 100644
--- a/pkgs/applications/networking/instant-messengers/telepathy/haze/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/haze/default.nix
@@ -1,26 +1,17 @@
-{ lib, stdenv, fetchurl, fetchpatch, pidgin, telepathy-glib, python2, glib, dbus-glib, pkg-config, libxslt }:
+{ lib, stdenv, fetchurl, fetchpatch, pidgin, telepathy-glib, python3, glib, dbus-glib, pkg-config, libxslt }:
 
 stdenv.mkDerivation rec {
   pname = "telepathy-haze";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchurl {
-    url = "https://telepathy.freedesktop.org/releases/telepathy-haze/telepathy-haze${version}.tar.gz";
-    sha256 = "1jgrp32p6rllj089ynbsk3n9xrvsvzmwzhf0ql05kkgj0nf08xiy";
+    url = "https://telepathy.freedesktop.org/releases/telepathy-haze/telepathy-haze-${version}.tar.gz";
+    hash = "sha256-cEvvpC7sIXPspLrAH/0AQBRmXyutRtyJSOVCM2TN4wo=";
   };
 
-  buildInputs = [ glib telepathy-glib dbus-glib pidgin python2 ];
+  buildInputs = [ glib telepathy-glib dbus-glib pidgin ];
 
-  nativeBuildInputs = [ pkg-config libxslt ];
-
-  patches = [
-    # Patch from Gentoo that helps telepathy-haze build with more
-    # recent versions of pidgin.
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/gentoo/gentoo/master/net-voip/telepathy-haze/files/telepathy-haze-0.8.0-pidgin-2.10.12-compat.patch";
-      sha256 = "0fa1p4n1559qd096w7ya4kvfnc1c98ykarkxzlpkwvzbczwzng3c";
-    })
-  ];
+  nativeBuildInputs = [ pkg-config libxslt python3 ];
 
   meta = {
     description = "A Telepathy connection manager based on libpurple";

From 041f282dbf953cbb207ea18939f47488b6c702a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 25 Nov 2022 10:36:47 -0800
Subject: [PATCH 12/41] telepathy-gabble: build using python3

---
 .../telepathy/gabble/default.nix                | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/telepathy/gabble/default.nix b/pkgs/applications/networking/instant-messengers/telepathy/gabble/default.nix
index 3b1775a7ba8c..b3fe15fcaac6 100644
--- a/pkgs/applications/networking/instant-messengers/telepathy/gabble/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telepathy/gabble/default.nix
@@ -1,5 +1,7 @@
-{ lib, stdenv, fetchurl, pkg-config, libxslt, telepathy-glib, python2, libxml2, dbus-glib, dbus
-, sqlite, libsoup, libnice, gnutls}:
+{ lib, stdenv, fetchurl, pkg-config, libxslt, telepathy-glib, python3, libxml2, dbus-glib, dbus
+, sqlite, libsoup, libnice, gnutls
+, fetchpatch
+}:
 
 stdenv.mkDerivation rec {
   pname = "telepathy-gabble";
@@ -10,8 +12,15 @@ stdenv.mkDerivation rec {
     sha256 = "174nlkqm055vrhv11gy73m20jbsggcb0ddi51c7s9m3j5ibr2p0i";
   };
 
-  nativeBuildInputs = [ pkg-config libxslt ];
-  buildInputs = [ libxml2 dbus-glib sqlite libsoup libnice telepathy-glib gnutls python2 ];
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/archlinux/svntogit-packages/raw/edcf78c831894000f2fbfd3e5818e363911c746a/trunk/telepathy-gabble-0.18.4-python3.patch";
+      hash = "sha256-bvcZW6gbCNogqwPDaXHTbohe7c2GAYjXeHGyBEDVsB4=";
+    })
+  ];
+
+  nativeBuildInputs = [ pkg-config libxslt python3 ];
+  buildInputs = [ libxml2 dbus-glib sqlite libsoup libnice telepathy-glib gnutls ];
 
   checkInputs = [ dbus.daemon ];
 

From 3a7a8f5133ddca8676aa8cce1c1914d4d453a09c Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 26 Nov 2022 06:54:40 +1000
Subject: [PATCH 13/41] crun: 1.7 -> 1.7.1

https://github.com/containers/crun/releases/tag/1.7.1
---
 pkgs/applications/virtualization/crun/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/virtualization/crun/default.nix b/pkgs/applications/virtualization/crun/default.nix
index 810fefa2863f..82d9b251292a 100644
--- a/pkgs/applications/virtualization/crun/default.nix
+++ b/pkgs/applications/virtualization/crun/default.nix
@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.7";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Ly6GBR7nF7J5Dwe1jrQxR4XYsao7KxBAxGn8fsJwmMs=";
+    sha256 = "sha256-YCymMr2dxDACdBNylPXa0GKu+QRzKFi5QzlyacAyE5A=";
     fetchSubmodules = true;
   };
 
@@ -55,6 +55,8 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
   strictDeps = true;
 
+  NIX_LDFLAGS = "-lcriu";
+
   # we need this before autoreconfHook does its thing in order to initialize
   # config.h with the correct values
   postPatch = ''

From e61cc2ab0265dbc52f4a8ec7b019710545e6d577 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 25 Nov 2022 17:02:08 -0800
Subject: [PATCH 14/41] lxpanel: use gtk3 by default

---
 pkgs/desktops/lxde/core/lxpanel/default.nix | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/pkgs/desktops/lxde/core/lxpanel/default.nix b/pkgs/desktops/lxde/core/lxpanel/default.nix
index 1208f9cd64cf..214c2b14dd2c 100644
--- a/pkgs/desktops/lxde/core/lxpanel/default.nix
+++ b/pkgs/desktops/lxde/core/lxpanel/default.nix
@@ -7,10 +7,13 @@
 , intltool
 , libxmlxx
 , keybinder
+, keybinder3
 , gtk2
+, gtk3
 , libX11
 , libfm
 , libwnck2
+, libwnck3
 , libXmu
 , libXpm
 , cairo
@@ -21,6 +24,7 @@
 , wirelesstools
 , curl
 , supportAlsa ? false, alsa-lib
+, withGtk3 ? true
 }:
 
 stdenv.mkDerivation rec {
@@ -34,11 +38,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config gettext m4 intltool libxmlxx ];
   buildInputs = [
-    keybinder
-    gtk2
+    (if withGtk3 then keybinder3 else keybinder)
+    (if withGtk3 then gtk3 else gtk2)
     libX11
-    libfm
-    libwnck2
+    (libfm.override { inherit withGtk3; })
+    (if withGtk3 then libwnck3 else libwnck2)
     libXmu
     libXpm
     cairo
@@ -58,6 +62,8 @@ stdenv.mkDerivation rec {
       --replace "@PACKAGE_CFLAGS@" "@PACKAGE_CFLAGS@ -I${gdk-pixbuf-xlib.dev}/include/gdk-pixbuf-2.0"
   '';
 
+  configureFlags = lib.optional withGtk3 "--enable-gtk3";
+
   meta = with lib; {
     description = "Lightweight X11 desktop panel for LXDE";
     homepage = "https://lxde.org/";

From 1029d3a644e2fe6616c72960bb64e6aa230432ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 25 Nov 2022 17:19:47 -0800
Subject: [PATCH 15/41] nsis: build using python3

---
 pkgs/development/tools/nsis/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/nsis/default.nix b/pkgs/development/tools/nsis/default.nix
index 48651435d371..6e784a2b110b 100644
--- a/pkgs/development/tools/nsis/default.nix
+++ b/pkgs/development/tools/nsis/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     chmod -R u+w $out/share/nsis
   '';
 
-  nativeBuildInputs = [ sconsPackages.scons_3_1_2 ];
+  nativeBuildInputs = [ sconsPackages.scons_latest ];
   buildInputs = [ zlib ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
   CPPPATH = symlinkJoin {

From 1710b52c6eefdb8434a63951d0e3a35bde4adb02 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 25 Nov 2022 18:25:44 -0800
Subject: [PATCH 16/41] rubyPackages.libv8: use python3

---
 pkgs/development/ruby-modules/gem-config/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index 2885eeb04119..236570be0dcf 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -370,7 +370,7 @@ in
   # otherwise the gem will fail to link to the libv8 binary.
   # see: https://github.com/cowboyd/libv8/pull/161
   libv8 = attrs: {
-    buildInputs = [ which v8 python2 ];
+    buildInputs = [ which v8 python3 ];
     buildFlags = [ "--with-system-v8=true" ];
     dontBuild = false;
     # The gem includes broken symlinks which are ignored during unpacking, but

From cc4a9cedba6a5a8f6ffd60727f66597fee53a73c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 25 Nov 2022 19:05:25 -0800
Subject: [PATCH 17/41] python310Packages.svg2tikz: 1.0.0 ->
 unstable-2021-01-12

---
 .../python-modules/svg2tikz/default.nix       | 34 ++++++++++++-------
 pkgs/top-level/all-packages.nix               |  2 +-
 2 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/svg2tikz/default.nix b/pkgs/development/python-modules/svg2tikz/default.nix
index c15e88ebeb24..b902572dbe81 100644
--- a/pkgs/development/python-modules/svg2tikz/default.nix
+++ b/pkgs/development/python-modules/svg2tikz/default.nix
@@ -2,29 +2,39 @@
 , buildPythonPackage
 , fetchFromGitHub
 , lxml
-, isPy27
+, pytestCheckHook
 }:
 
 buildPythonPackage {
   pname = "svg2tikz";
-  version = "1.0.0";
-  disabled = ! isPy27;
+  version = "unstable-2021-01-12";
 
-  propagatedBuildInputs = [ lxml ];
+  format = "setuptools";
 
   src = fetchFromGitHub {
-    owner = "kjellmf";
+    owner = "xyz2tex";
     repo = "svg2tikz";
-    rev = "ad36f2c3818da13c4136d70a0fd8153acf8daef4";
-    sha256 = "sha256-QpQo7ENeU2crhc37uJu4rw/5+COPXQWXBynlF30lLV8=";
-    fetchSubmodules = true;
+    rev = "7a9959c295e1ed73e543474c6f3679d04cebc9e9";
+    hash = "sha256-OLMFtEEdcY8ARI+hUSOhMwwcrtOAsbKRJRdDJcuaIBg=";
   };
 
+  propagatedBuildInputs = [
+    lxml
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  # upstream hasn't updated the tests in a while
+  doCheck = false;
+
+  pythonImportsCheck = [ "svg2tikz" ];
+
   meta = with lib; {
-    homepage = "https://github.com/kjellmf/svg2tikz";
-    description = "An SVG to TikZ converter";
+    homepage = "https://github.com/xyz2tex/svg2tikz";
+    description = "Set of tools for converting SVG graphics to TikZ/PGF code";
     license = licenses.gpl2Plus;
-    maintainers =  with maintainers; [ gal_bolle ];
+    maintainers = with maintainers; [ dotlambda gal_bolle ];
   };
-
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ddd3f57f82b8..9efe3daf57b3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -15947,7 +15947,7 @@ with pkgs;
   pysideApiextractor = callPackage ../development/python-modules/pyside/apiextractor.nix { };
   pysideGeneratorrunner = callPackage ../development/python-modules/pyside/generatorrunner.nix { };
 
-  svg2tikz = python27Packages.svg2tikz;
+  svg2tikz = with python3.pkgs; toPythonApplication svg2tikz;
 
   svg2pdf = callPackage ../tools/graphics/svg2pdf { };
 

From ff883d2557013b5cc1dad788eba5abf4e4975da5 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Sat, 26 Nov 2022 10:56:02 +0300
Subject: [PATCH 18/41] =?UTF-8?q?the-foundation:=201.4.0=20=E2=86=92=201.5?=
 =?UTF-8?q?.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/libraries/the-foundation/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/libraries/the-foundation/default.nix b/pkgs/development/libraries/the-foundation/default.nix
index 95c8653a4663..95ea916e09b9 100644
--- a/pkgs/development/libraries/the-foundation/default.nix
+++ b/pkgs/development/libraries/the-foundation/default.nix
@@ -10,16 +10,16 @@
 , zlib
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "the-foundation";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitea {
     domain = "git.skyjake.fi";
     owner = "skyjake";
     repo = "the_Foundation";
-    rev = "v${version}";
-    hash = "sha256-IHwWJryG4HcrW9Bf8KJrisCrbF86RBQj6Xl1HTmcr6k=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-wPFBKc20/ED58RFpDhmPnlSHCf3FG5sD2ubQOl5NF+o=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];
@@ -38,4 +38,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ sikmir ];
     platforms = platforms.unix;
   };
-}
+})

From 318bfb7018723cdc529aca8a1aa98e1cced2e84c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 26 Nov 2022 13:46:26 +0000
Subject: [PATCH 19/41] libreddit: 0.24.0 -> 0.24.1

---
 pkgs/servers/libreddit/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/libreddit/default.nix b/pkgs/servers/libreddit/default.nix
index cb3770339068..3a655d943249 100644
--- a/pkgs/servers/libreddit/default.nix
+++ b/pkgs/servers/libreddit/default.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "libreddit";
-  version = "0.24.0";
+  version = "0.24.1";
 
   src = fetchFromGitHub {
     owner = "libreddit";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-I/LPCPAZLltb55TBBS3NE2oU97Dx3L/dHLaEVkVBTGA=";
+    hash = "sha256-LS9yUjKv0GxK6wGo0f5jHAn7vyo+tvgHd3NWLYpAQOs=";
   };
 
-  cargoSha256 = "sha256-0Udwnvf60sumAeGtaxyiHbkWYMvNjwcWX9W1m3CUvb8=";
+  cargoSha256 = "sha256-14tJLhWITCz/e+XuCww2GVZ+sXy08LQe+DpL4tkLUzE=";
 
   buildInputs = lib.optional stdenv.isDarwin [
     Security

From 57041d44e8d42ac173ecf061472171c14aa6cc32 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Sat, 26 Nov 2022 11:13:26 +0300
Subject: [PATCH 20/41] =?UTF-8?q?lagrange:=201.13.8=20=E2=86=92=201.14.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../networking/browsers/lagrange/default.nix         | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/networking/browsers/lagrange/default.nix b/pkgs/applications/networking/browsers/lagrange/default.nix
index b41f95b0b0cc..989903329778 100644
--- a/pkgs/applications/networking/browsers/lagrange/default.nix
+++ b/pkgs/applications/networking/browsers/lagrange/default.nix
@@ -15,15 +15,15 @@
 , enableTUI ? false, ncurses, sealcurses
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "lagrange";
-  version = "1.13.8";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "skyjake";
     repo = "lagrange";
-    rev = "v${version}";
-    sha256 = "sha256-SdncFkMCAY28njw361R70h6gcK0YHSU7AUwf9wzxCRo=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-xS6cyramlcItjRBSSunzm39zcGXdX9s/pvi0tsaTkW8=";
   };
 
   nativeBuildInputs = [ cmake pkg-config zip ];
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = nix-update-script {
-      attrPath = pname;
+      attrPath = finalAttrs.pname;
     };
   };
 
@@ -62,4 +62,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ sikmir ];
     platforms = platforms.unix;
   };
-}
+})

From 2abf4e596782dfd9b96e3abe1c9cb7bc4091ed59 Mon Sep 17 00:00:00 2001
From: sveitser <sveitser@gmail.com>
Date: Sat, 26 Nov 2022 16:25:24 +0100
Subject: [PATCH 21/41] python3Packages.acoustics: fix build

---
 pkgs/development/python-modules/acoustics/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/acoustics/default.nix b/pkgs/development/python-modules/acoustics/default.nix
index f81f382b956e..7de65d83fb65 100644
--- a/pkgs/development/python-modules/acoustics/default.nix
+++ b/pkgs/development/python-modules/acoustics/default.nix
@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, flit-core
 , matplotlib
 , numpy
 , pandas
@@ -20,6 +21,9 @@ buildPythonPackage rec {
     inherit pname version;
     sha256 = "sha256-0CvMhCUc+i7dPiHH+IXdlj+OjFh/l1wvnU4dmxQrzFI=";
   };
+  format = "pyproject";
+
+  nativeBuildInputs = [ flit-core ];
 
   propagatedBuildInputs = [
     matplotlib
@@ -44,8 +48,8 @@ buildPythonPackage rec {
   ];
 
   disabledTestPaths = [
-    # All tests fail with TypeError
-    "tests/test_aio.py"
+    # ValueError: Unknown window type: "hanning"
+    "tests/standards/test_iso_1996_2_2007.py"
   ];
 
   pythonImportsCheck = [ "acoustics" ];

From ae03537f743a9535a59f3b2d3566f0c96e65dd8b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 26 Nov 2022 16:38:45 +0100
Subject: [PATCH 22/41] libreddit: add changelog to meta

---
 pkgs/servers/libreddit/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/libreddit/default.nix b/pkgs/servers/libreddit/default.nix
index 3a655d943249..61978936d780 100644
--- a/pkgs/servers/libreddit/default.nix
+++ b/pkgs/servers/libreddit/default.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "libreddit";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-LS9yUjKv0GxK6wGo0f5jHAn7vyo+tvgHd3NWLYpAQOs=";
   };
 
@@ -30,6 +30,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "Private front-end for Reddit";
     homepage = "https://github.com/libreddit/libreddit";
+    changelog = "https://github.com/libreddit/libreddit/releases/tag/v${version}";
     license = with licenses; [ agpl3Only ];
     maintainers = with maintainers; [ fab jojosch ];
   };

From cfc3633d9ec85292cdd8f84d3f8a99154aa3e9bd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 26 Nov 2022 16:01:37 +0000
Subject: [PATCH 23/41] python310Packages.cloudscraper: 1.2.65 -> 1.2.66

---
 pkgs/development/python-modules/cloudscraper/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cloudscraper/default.nix b/pkgs/development/python-modules/cloudscraper/default.nix
index 85b7a9447919..424f4737a241 100644
--- a/pkgs/development/python-modules/cloudscraper/default.nix
+++ b/pkgs/development/python-modules/cloudscraper/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "cloudscraper";
-  version = "1.2.65";
+  version = "1.2.66";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-vwH5sSA9rFrnFO4zIvjloYXSNWK5Vn1rODO74vPWvEE=";
+    hash = "sha256-XwzeI3dCcOigkt5o4PvWjheFTHZ/wtQEKpG9qeSBaHE=";
   };
 
   propagatedBuildInputs = [

From 0ec9112cf45a7f18eb8a64b92604dc80d7e9e94d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 26 Nov 2022 17:14:13 +0100
Subject: [PATCH 24/41]   python310Packages.cloudscraper: add changelog to meta

---
 pkgs/development/python-modules/cloudscraper/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/cloudscraper/default.nix b/pkgs/development/python-modules/cloudscraper/default.nix
index 424f4737a241..d3e9431e6743 100644
--- a/pkgs/development/python-modules/cloudscraper/default.nix
+++ b/pkgs/development/python-modules/cloudscraper/default.nix
@@ -36,6 +36,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to bypass Cloudflare's anti-bot page";
     homepage = "https://github.com/venomous/cloudscraper";
+    changelog = "https://github.com/VeNoMouS/cloudscraper/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ kini ];
   };

From 9d44d08620474ecc8be6aaf7dfe6020693551229 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 26 Nov 2022 17:27:46 +0000
Subject: [PATCH 25/41] python310Packages.diff-cover: 7.0.2 -> 7.1.0

---
 pkgs/development/python-modules/diff-cover/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/diff-cover/default.nix b/pkgs/development/python-modules/diff-cover/default.nix
index a3ea4034e8b6..7cfd08390c78 100644
--- a/pkgs/development/python-modules/diff-cover/default.nix
+++ b/pkgs/development/python-modules/diff-cover/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "diff-cover";
-  version = "7.0.2";
+  version = "7.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "diff_cover";
     inherit version;
-    hash = "sha256-OENUR9rTKrt+AdHDlCU5AhpSI4ijtYXVg6biB8wTNJc=";
+    hash = "sha256-7RqhNSIUD3ofYoB7x1UoGdJDQ+6TmLenTpShjHji6GQ=";
   };
 
   propagatedBuildInputs = [

From 2b149526b66650bc77e4ffcb1906c882edd55ebd Mon Sep 17 00:00:00 2001
From: MayNiklas <info@niklas-steffen.de>
Date: Sat, 26 Nov 2022 18:43:35 +0100
Subject: [PATCH 26/41] discord.py: 2.0.1 -> 2.1.0

---
 pkgs/development/python-modules/discordpy/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/discordpy/default.nix b/pkgs/development/python-modules/discordpy/default.nix
index 2bcba19d03ac..05b079f3f4e5 100644
--- a/pkgs/development/python-modules/discordpy/default.nix
+++ b/pkgs/development/python-modules/discordpy/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "discord.py";
-  version = "2.0.1";
+  version = "2.1.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "Rapptz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DX9AmVhwP7XgzUApY8d+UB6LGqymErsaSzaisuKAOB0=";
+    sha256 = "sha256-243w3J3nb/6GV5ogS/Ev9X3r0GrgUokMq14r5rjOdrA=";
   };
 
   propagatedBuildInputs = [

From 68d4c769dac457843f923f63cbe4c9ccee53b8d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 25 Nov 2022 08:03:13 -0800
Subject: [PATCH 27/41] blitz: 1.0.1 -> 1.0.2

https://github.com/blitzpp/blitz/releases/tag/1.0.2
---
 pkgs/development/libraries/blitz/default.nix | 51 +++++++++++---------
 1 file changed, 27 insertions(+), 24 deletions(-)

diff --git a/pkgs/development/libraries/blitz/default.nix b/pkgs/development/libraries/blitz/default.nix
index 2b5e5a4addca..d48669845485 100644
--- a/pkgs/development/libraries/blitz/default.nix
+++ b/pkgs/development/libraries/blitz/default.nix
@@ -1,10 +1,12 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
+, cmake
 , pkg-config
 , gfortran
 , texinfo
-, python2
+, python3
 , boost
   # Select SIMD alignment width (in bytes) for vectorization.
 , simdWidth ? 1
@@ -23,35 +25,37 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "blitz++";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "blitzpp";
     repo = "blitz";
-    rev = "1.0.1";
-    sha256 = "0nq84vwvvbq7m0my6h835ijfw53bxdp42qjc6kjhk436888qy9rh";
+    rev = version;
+    hash = "sha256-wZDg+4lCd9iHvxuQQE/qs58NorkxZ0+mf+8PKQ57CDE=";
   };
 
-  nativeBuildInputs = [ pkg-config python2 texinfo ];
+  patches = [
+    # https://github.com/blitzpp/blitz/pull/180
+    (fetchpatch {
+      name = "use-cmake-install-full-dir.patch";
+      url = "https://github.com/blitzpp/blitz/commit/020f1d768c7fa3265cec244dc28f3dc8572719c5.patch";
+      hash = "sha256-8hYFNyWrejjIWPN/HzIOphD4Aq6Soe0FFUBmwV4tpWQ=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    python3
+    texinfo
+  ];
+
   buildInputs = [ gfortran texinfo boost ];
 
-  configureFlags =
-    [
-      "--enable-shared"
-      "--disable-static"
-      "--enable-fortran"
-      "--enable-optimize"
-      "--with-pic=yes"
-      "--enable-html-docs"
-      "--disable-doxygen"
-      "--disable-dot"
-      "--disable-latex-docs"
-      "--enable-simd-width=${toString simdWidth}"
-      "--with-boost=${boost.dev}"
-      "--with-boost-libdir=${boost.out}/lib"
-    ] ++ optional enablePadding "--enable-array-length-padding"
-    ++ optional enableSerialization "--enable-serialization"
-    ++ optional stdenv.is64bit "--enable-64bit";
+  cmakeFlags = optional enablePadding "-DARRAY_LENGTH_PADDING=ON"
+    ++ optional enableSerialization "-DENABLE_SERIALISATION=ON"
+    ++ optional stdenv.is64bit "-DBZ_FULLY64BIT=ON";
+    # FIXME ++ optional doCheck "-DBUILD_TESTING=ON";
 
   # skip broken library name detection
   ax_boost_user_serialization_lib = lib.optionalString stdenv.isDarwin "boost_serialization";
@@ -59,12 +63,11 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   inherit doCheck;
-  checkTarget = "check-testsuite check-examples";
 
   meta = with lib; {
     description = "Fast multi-dimensional array library for C++";
     homepage = "https://sourceforge.net/projects/blitz/";
-    license = licenses.lgpl3;
+    license = with licenses; [ artistic2 /* or */ bsd3 /* or */ lgpl3Plus ];
     platforms = platforms.unix;
     maintainers = with maintainers; [ ToxicFrog ];
     longDescription = ''

From c14f1f71b1da47c660569e4de50c09eba909869c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 26 Nov 2022 10:51:32 -0800
Subject: [PATCH 28/41] nsis: mark broken on Darwin

---
 pkgs/development/tools/nsis/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/tools/nsis/default.nix b/pkgs/development/tools/nsis/default.nix
index 6e784a2b110b..b9fb3aa711c2 100644
--- a/pkgs/development/tools/nsis/default.nix
+++ b/pkgs/development/tools/nsis/default.nix
@@ -71,5 +71,6 @@ stdenv.mkDerivation rec {
     platforms = platforms.unix;
     maintainers = with maintainers; [ pombeirp ];
     mainProgram = "makensis";
+    broken = stdenv.isDarwin;
   };
 }

From 1b5ad5946f42dd41abcf6c88de1670c96ebd271d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?PedroHLC=20=E2=98=AD?= <root@pedrohlc.com>
Date: Sat, 26 Nov 2022 16:11:40 -0300
Subject: [PATCH 29/41] linuxKernel.kernels.linux_lqx: 6.0.8 -> 6.0.10

---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 9863e3c4f4ee..40ce7182a4e9 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -11,9 +11,9 @@ let
   };
   # ./update-zen.py lqx
   lqxVariant = {
-    version = "6.0.8"; #lqx
+    version = "6.0.10"; #lqx
     suffix = "lqx1"; #lqx
-    sha256 = "1jjna3g1x58r8qz323fmdzf6ws3anjqdw57r12fnvq3by660p0qh"; #lqx
+    sha256 = "0hbak9m4j259xrhbv173axbfzr13r47xqsax7s64ga9688bra1m7"; #lqx
     isLqx = true;
   };
   zenKernelsFor = { version, suffix, sha256, isLqx }: buildLinux (args // {

From 55a5d40e4813912e2e44ebcdf966aa926f11b7bf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 26 Nov 2022 19:11:53 +0000
Subject: [PATCH 30/41] miniplayer: 1.7.3 -> 1.8.1

---
 pkgs/applications/audio/miniplayer/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/audio/miniplayer/default.nix b/pkgs/applications/audio/miniplayer/default.nix
index 53fa9d8a10bf..bc9c88b292a0 100644
--- a/pkgs/applications/audio/miniplayer/default.nix
+++ b/pkgs/applications/audio/miniplayer/default.nix
@@ -6,12 +6,12 @@ with python3Packages;
 
 buildPythonApplication rec {
   pname = "miniplayer";
-  version = "1.7.3";
+  version = "1.8.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GxbsDIZ5LvxMqbDC81rerrk0mn94qHlX1uxrNL+vxSU=";
+    hash = "sha256-iUUsVIDLQAiaMomfA2LvvJZ2ePhgADtC6GCwIpRC1MA=";
   };
 
   propagatedBuildInputs = [

From 41dbacdcd87ae38cf4e5f0273691b066b48c748b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?PedroHLC=20=E2=98=AD?= <root@pedrohlc.com>
Date: Sat, 26 Nov 2022 16:13:44 -0300
Subject: [PATCH 31/41] linuxKernel.kernels.linux_zen: 6.0.8-zen1 ->
 6.0.10-zen2

---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 40ce7182a4e9..6ee6c38a31b8 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -4,9 +4,9 @@ let
   # comments with variant added for update script
   # ./update-zen.py zen
   zenVariant = {
-    version = "6.0.8"; #zen
-    suffix = "zen1"; #zen
-    sha256 = "0vp6vp77blrxa8rcl8wl81di7m4s1cmbznzacx3729560km98ki8"; #zen
+    version = "6.0.10"; #zen
+    suffix = "zen2"; #zen
+    sha256 = "12mpgw1maa5yi35ls4j1m0vmlw4fka69n0pidbxqi3yadbfn2iy5"; #zen
     isLqx = false;
   };
   # ./update-zen.py lqx

From 9c2970e8fc1a93cb21742949b118469b6fa8268e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 26 Nov 2022 20:54:15 +0100
Subject: [PATCH 32/41]  python310Packages.diff-cover: add changelog to meta

---
 pkgs/development/python-modules/diff-cover/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/diff-cover/default.nix b/pkgs/development/python-modules/diff-cover/default.nix
index 7cfd08390c78..c1afa7098009 100644
--- a/pkgs/development/python-modules/diff-cover/default.nix
+++ b/pkgs/development/python-modules/diff-cover/default.nix
@@ -61,6 +61,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Automatically find diff lines that need test coverage";
     homepage = "https://github.com/Bachmann1234/diff-cover";
+    changelog = "https://github.com/Bachmann1234/diff_cover/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ dzabraev ];
   };

From c516529ad36112e4ce5ccd35ac73d62f0bce3d2b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 26 Nov 2022 20:58:43 +0100
Subject: [PATCH 33/41]  python310Packages.discord.py: add changelog to meta

---
 pkgs/development/python-modules/discordpy/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/discordpy/default.nix b/pkgs/development/python-modules/discordpy/default.nix
index 05b079f3f4e5..07008fac336b 100644
--- a/pkgs/development/python-modules/discordpy/default.nix
+++ b/pkgs/development/python-modules/discordpy/default.nix
@@ -19,8 +19,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Rapptz";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-243w3J3nb/6GV5ogS/Ev9X3r0GrgUokMq14r5rjOdrA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-243w3J3nb/6GV5ogS/Ev9X3r0GrgUokMq14r5rjOdrA=";
   };
 
   propagatedBuildInputs = [
@@ -56,6 +56,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python wrapper for the Discord API";
     homepage = "https://discordpy.rtfd.org/";
+    changelog = "https://github.com/Rapptz/discord.py/blob/v${version}/docs/whats_new.rst";
     license = licenses.mit;
     maintainers = with maintainers; [ ivar ];
   };

From a548967a87091df02afcc87ca088a9139812a801 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Anselm=20Sch=C3=BCler?= <mail@anselmschueler.com>
Date: Sat, 26 Nov 2022 21:11:49 +0100
Subject: [PATCH 34/41] screenfetch: update pname to reflect attribute path and
 executable name

---
 pkgs/tools/misc/screenfetch/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/tools/misc/screenfetch/default.nix b/pkgs/tools/misc/screenfetch/default.nix
index 3d42ab9374a0..83edfec25812 100644
--- a/pkgs/tools/misc/screenfetch/default.nix
+++ b/pkgs/tools/misc/screenfetch/default.nix
@@ -19,7 +19,7 @@ let
   ]));
 
 in stdenv.mkDerivation rec {
-  pname = "screenFetch";
+  pname = "screenfetch";
   version = "3.9.1";
 
   src = fetchFromGitHub {

From 03bf773416a07b6586c1d76864f2d782a462ea70 Mon Sep 17 00:00:00 2001
From: Otavio Salvador <otavio@ossystems.com.br>
Date: Sat, 26 Nov 2022 16:57:19 -0300
Subject: [PATCH 35/41] shellhub-agent: 0.10.4 -> 0.10.8

Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
---
 pkgs/applications/networking/shellhub-agent/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/shellhub-agent/default.nix b/pkgs/applications/networking/shellhub-agent/default.nix
index 4016ca04b454..8d404d4ebd25 100644
--- a/pkgs/applications/networking/shellhub-agent/default.nix
+++ b/pkgs/applications/networking/shellhub-agent/default.nix
@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "shellhub-agent";
-  version = "0.10.4";
+  version = "0.10.8";
 
   src = fetchFromGitHub {
     owner = "shellhub-io";
     repo = "shellhub";
     rev = "v${version}";
-    sha256 = "ov1hA+3sKh9Ms5D3/+ubwcAp+skuIfB3pvsvNSUKiSE=";
+    sha256 = "BtD22Ss5PuVx2RVLQIsUeGBJBl5lh1XHJ0vcM2bOEwk=";
   };
 
   modRoot = "./agent";
 
-  vendorSha256 = "sha256-IYDy3teo+hm+yEfZa9V9MFNGmO2tqeh3lAq+Eh4Ek+A=";
+  vendorSha256 = "sha256-tvKiTQioj999oIUDHUSXTMXOh/LKoykzu8JEUnrelws=";
 
   ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];
 

From 72779c7b0f882c4e0dcfc375b723802437caefba Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 1 Nov 2022 23:56:29 +0100
Subject: [PATCH 36/41] kanidm: 1.1.0-alpha.9 -> 1.1.0-alpha.10

https://github.com/kanidm/kanidm/releases/tag/v1.1.0-alpha.10
---
 pkgs/servers/kanidm/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/kanidm/default.nix b/pkgs/servers/kanidm/default.nix
index 0984a622330c..8941a5c7c6cd 100644
--- a/pkgs/servers/kanidm/default.nix
+++ b/pkgs/servers/kanidm/default.nix
@@ -17,16 +17,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "kanidm";
-  version = "1.1.0-alpha.9";
+  version = "1.1.0-alpha.10";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
-    rev = "985462590b1c49b26a0b0ee01e24b1eb01942165";
-    hash = "sha256-JtoDuA3NCKmX+wDqav30VwrLeDALYat1iKFWpbYOO1s=";
+    rev = "fb76326234bffd9c9f3f24808d113f2c335c86fe";
+    hash = "sha256-nE3zyigorAbDp5mgXzoyXWGOG+GaFC//SS/7Z9zj1Ps=";
   };
 
-  cargoSha256 = "sha256-pkBkXIG2PF5YMeighQwHwhURWbJabfveyszRIdrQjcA=";
+  cargoSha256 = "sha256-/CcmKYPtBHNdhJnO0OmZtW/39HH58qmCE9hFbIiNsaE=";
 
   KANIDM_BUILD_PROFILE = "release_nixos_${arch}";
 

From 887020f39cca2dc5464ff2a6350d8681543dc769 Mon Sep 17 00:00:00 2001
From: Flakebi <flakebi@t-online.de>
Date: Sun, 20 Nov 2022 18:10:15 +0100
Subject: [PATCH 37/41] nixos/kanidm: Add tls options

Since 1.1.0-alpha.10 kanidm requires TLS to be set up or it won't start.
---
 nixos/modules/services/security/kanidm.nix |  8 ++++++++
 nixos/tests/kanidm.nix                     | 19 +++++--------------
 2 files changed, 13 insertions(+), 14 deletions(-)

diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index 788e06ffecf0..55120799c993 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -100,6 +100,14 @@ in
             readOnly = true;
             type = lib.types.path;
           };
+          tls_chain = lib.mkOption {
+            description = lib.mdDoc "TLS chain in pem format.";
+            type = lib.types.path;
+          };
+          tls_key = lib.mkOption {
+            description = lib.mdDoc "TLS key in pem format.";
+            type = lib.types.path;
+          };
           log_level = lib.mkOption {
             description = lib.mdDoc "Log level of the server.";
             default = "default";
diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix
index 7f8a4e501777..33c65026b9b1 100644
--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@@ -13,26 +13,17 @@ import ./make-test-python.nix ({ pkgs, ... }:
         serverSettings = {
           origin = "https://${serverDomain}";
           domain = serverDomain;
-          bindaddress = "[::1]:8443";
+          bindaddress = "[::]:443";
           ldapbindaddress = "[::1]:636";
-        };
-      };
-
-      services.nginx = {
-        enable = true;
-        recommendedProxySettings = true;
-        virtualHosts."${serverDomain}" = {
-          forceSSL = true;
-          sslCertificate = certs."${serverDomain}".cert;
-          sslCertificateKey = certs."${serverDomain}".key;
-          locations."/".proxyPass = "http://[::1]:8443";
+          tls_chain = certs."${serverDomain}".cert;
+          tls_key = certs."${serverDomain}".key;
         };
       };
 
       security.pki.certificateFiles = [ certs.ca.cert ];
 
       networking.hosts."::1" = [ serverDomain ];
-      networking.firewall.allowedTCPPorts = [ 80 443 ];
+      networking.firewall.allowedTCPPorts = [ 443 ];
 
       users.users.kanidm.shell = pkgs.bashInteractive;
 
@@ -73,7 +64,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
         start_all()
         server.wait_for_unit("kanidm.service")
         server.wait_until_succeeds("curl -sf https://${serverDomain} | grep Kanidm")
-        server.succeed("ldapsearch -H ldap://[::1]:636 -b '${ldapBaseDN}' -x '(name=test)'")
+        server.succeed("ldapsearch -H ldaps://${serverDomain}:636 -b '${ldapBaseDN}' -x '(name=test)'")
         client.succeed("kanidm login -D anonymous && kanidm self whoami | grep anonymous@${serverDomain}")
         rv, result = server.execute("kanidmd recover_account -c ${serverConfigFile} idm_admin 2>&1 | rg -o '[A-Za-z0-9]{48}'")
         assert rv == 0

From 272ac9ec64020808b88a1ddeee13f38cb929c22b Mon Sep 17 00:00:00 2001
From: Flakebi <flakebi@t-online.de>
Date: Sat, 26 Nov 2022 20:06:07 +0100
Subject: [PATCH 38/41] kanidm: add release not for tls requirement

---
 .../doc/manual/from_md/release-notes/rl-2211.section.xml  | 8 ++++++++
 nixos/doc/manual/release-notes/rl-2211.section.md         | 2 ++
 2 files changed, 10 insertions(+)

diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
index b0f3688d14dc..e78e694c163e 100644
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@@ -709,6 +709,14 @@
           <literal>emacs-gtk</literal>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>kanidm</literal> has been updated to 1.1.0-alpha.10
+          and now requires a tls certificate and key. It will always
+          start an https and – if enabled – an ldaps server and no http
+          and ldap server anymore.
+        </para>
+      </listitem>
       <listitem>
         <para>
           riak package removed along with
diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md
index 72d16c4771a3..40645b3c8345 100644
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@@ -231,6 +231,8 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
 - Emacs now uses the Lucid toolkit by default instead of GTK because of stability and compatibility issues.
   Users who still wish to remain using GTK can do so by using `emacs-gtk`.
 
+- `kanidm` has been updated to 1.1.0-alpha.10 and now requires a tls certificate and key. It will always start an https and – if enabled – an ldaps server and no http and ldap server anymore.
+
 - riak package removed along with `services.riak` module, due to lack of maintainer to update the package.
 
 - ppd files in `pkgs.cups-drv-rastertosag-gdi` are now gzipped.  If you refer to such a ppd file with its path (e.g. via [hardware.printers.ensurePrinters](options.html#opt-hardware.printers.ensurePrinters)) you will need to append `.gz` to the path.

From 3490efd24580dff7842e6ded16bb63a110183aae Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 26 Nov 2022 17:00:29 +0100
Subject: [PATCH 39/41] python310Packages.pygmars: add changelog to meta

---
 pkgs/development/python-modules/pygmars/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pygmars/default.nix b/pkgs/development/python-modules/pygmars/default.nix
index e0764ecb3a4b..1d2109a321f5 100644
--- a/pkgs/development/python-modules/pygmars/default.nix
+++ b/pkgs/development/python-modules/pygmars/default.nix
@@ -9,13 +9,14 @@
 buildPythonPackage rec {
   pname = "pygmars";
   version = "0.7.0";
+  format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "nexB";
     repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     sha256 = "0wghk4nzplpl26iwrgvm0n9x88nyxlcxz4ywss4nwdr4hfccl28l";
   };
 
@@ -36,6 +37,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python lexing and parsing library";
     homepage = "https://github.com/nexB/pygmars";
+    changelog = "https://github.com/nexB/pygmars/releases/tag/v${version}";
     license = with licenses; [ asl20 ];
     maintainers = with maintainers; [ fab ];
   };

From 46189b54a8d86df8604e8990221b4f200427d5dd Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 26 Nov 2022 17:01:13 +0100
Subject: [PATCH 40/41] python310Packages.pygmars: 0.7.0 -> 0.8.0

Changelog: https://github.com/nexB/pygmars/releases/tag/v0.8.0
---
 pkgs/development/python-modules/pygmars/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pygmars/default.nix b/pkgs/development/python-modules/pygmars/default.nix
index 1d2109a321f5..2408a934b09c 100644
--- a/pkgs/development/python-modules/pygmars/default.nix
+++ b/pkgs/development/python-modules/pygmars/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pygmars";
-  version = "0.7.0";
+  version = "0.8.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "nexB";
     repo = pname;
     rev = "refs/tags/v${version}";
-    sha256 = "0wghk4nzplpl26iwrgvm0n9x88nyxlcxz4ywss4nwdr4hfccl28l";
+    sha256 = "sha256-PiH1lV1Vt9VTSOB+jep8FHIdk8qnauxj4nP3CIi/m7o=";
   };
 
   dontConfigure = true;

From 9e6b054555c9b10310543cd213ce7c70bb0cbc5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 26 Nov 2022 15:37:51 -0800
Subject: [PATCH 41/41] lxpanel: don't use alias libwnck3

---
 pkgs/desktops/lxde/core/lxpanel/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/desktops/lxde/core/lxpanel/default.nix b/pkgs/desktops/lxde/core/lxpanel/default.nix
index 214c2b14dd2c..3fc8f0b06cd8 100644
--- a/pkgs/desktops/lxde/core/lxpanel/default.nix
+++ b/pkgs/desktops/lxde/core/lxpanel/default.nix
@@ -12,8 +12,8 @@
 , gtk3
 , libX11
 , libfm
+, libwnck
 , libwnck2
-, libwnck3
 , libXmu
 , libXpm
 , cairo
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     (if withGtk3 then gtk3 else gtk2)
     libX11
     (libfm.override { inherit withGtk3; })
-    (if withGtk3 then libwnck3 else libwnck2)
+    (if withGtk3 then libwnck else libwnck2)
     libXmu
     libXpm
     cairo