Project import generated by Copybara.

GitOrigin-RevId: f5e8bdd07d1afaabf6b37afc5497b1e498b8046f

third_party/nixpkgs/doc/contributing/submitting-changes.chapter.md

@@ -68,15 +68,16 @@
 
 Security fixes are submitted in the same way as other changes and thus the same guidelines apply.
 
-If the security fix comes in the form of a patch and a CVE is available, then the name of the patch should be the CVE identifier, so e.g. `CVE-2019-13636.patch` in the case of a patch that is included in the Nixpkgs tree. If a patch is fetched the name needs to be set as well, e.g.:
+- If a new version fixing the vulnerability has been released, update the package;
-
+- If the security fix comes in the form of a patch and a CVE is available, then add the patch to the Nixpkgs tree, and apply it to the package.
-```nix
+  The name of the patch should be the CVE identifier, so e.g. `CVE-2019-13636.patch`; If a patch is fetched the name needs to be set as well, e.g.:
-(fetchpatch {
+  ```nix
-  name = "CVE-2019-11068.patch";
+  (fetchpatch {
-  url = "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.patch";
+    name = "CVE-2019-11068.patch";
-  sha256 = "0pkpb4837km15zgg6h57bncp66d5lwrlvkr73h0lanywq7zrwhj8";
+    url = "https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6.patch";
-})
+    sha256 = "0pkpb4837km15zgg6h57bncp66d5lwrlvkr73h0lanywq7zrwhj8";
-```
+  })
+  ```
 
 If a security fix applies to both master and a stable release then, similar to regular changes, they are preferably delivered via master first and cherry-picked to the release branch.
 

third_party/nixpkgs/doc/contributing/vulnerability-roundup.chapter.md

@@ -0,0 +1,45 @@
+# Vulnerability Roundup {#chap-vulnerability-roundup}
+
+## Issues {#vulnerability-roundup-issues}
+
+Vulnerable packages in Nixpkgs are managed using issues.
+Currently opened ones can be found using the following:
+
+[github.com/NixOS/nixpkgs/issues?q=is:issue+is:open+"Vulnerability+roundup"](https://github.com/NixOS/nixpkgs/issues?q=is%3Aissue+is%3Aopen+%22Vulnerability+roundup%22)
+
+Each issue correspond to a vulnerable version of a package; As a consequence:
+
+- One issue can contain several CVEs;
+- One CVE can be shared across several issues;
+- A single package can be concerned by several issues.
+
+
+A "Vulnerability roundup" issue usually respects the following format:
+
+```txt
+<link to relevant package search on search.nix.gsc.io>, <link to relevant files in Nixpkgs on GitHub>
+
+<list of related CVEs, their CVSS score, and the impacted NixOS version>
+
+<list of the scanned Nixpkgs versions>
+
+<list of relevant contributors>
+```
+
+Note that there can be an extra comment containing links to previously reported (and still open) issues for the same package.
+
+
+## Triaging and Fixing {#vulnerability-roundup-triaging-and-fixing}
+
+**Note**: An issue can be a "false positive" (i.e. automatically opened, but without the package it refers to being actually vulnerable).
+If you find such a "false positive", comment on the issue an explanation of why it falls into this category, linking as much information as the necessary to help maintainers double check.
+
+If you are investigating a "true positive":
+
+- Find the earliest patched version or a code patch in the CVE details;
+- Is the issue already patched (version up-to-date or patch applied manually) in Nixpkgs's `master` branch?
+  - **No**:
+    - [Submit a security fix](#submitting-changes-submitting-security-fixes);
+    - Once the fix is merged into `master`, [submit the change to the vulnerable release branch(es)](https://nixos.org/manual/nixpkgs/stable/#submitting-changes-stable-release-branches);
+  - **Yes**: [Backport the change to the vulnerable release branch(es)](https://nixos.org/manual/nixpkgs/stable/#submitting-changes-stable-release-branches).
+- When the patch has made it into all the relevant branches (`master`, and the vulnerable releases), close the relevant issue(s).

third_party/nixpkgs/doc/languages-frameworks/rust.section.md

@@ -72,8 +72,8 @@ For `cargoHash` you can use:
 Per the instructions in the [Cargo Book](https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html)
 best practices guide, Rust applications should always commit the `Cargo.lock`
 file in git to ensure a reproducible build. However, a few packages do not, and
-Nix depends on this file, so if it missing you can use `cargoPatches` to apply
+Nix depends on this file, so if it is missing you can use `cargoPatches` to
-it in the `patchPhase`. Consider sending a PR upstream with a note to the
+apply it in the `patchPhase`. Consider sending a PR upstream with a note to the
 maintainer describing why it's important to include in the application.
 
 The fetcher will verify that the `Cargo.lock` file is in sync with the `src`
@@ -146,6 +146,7 @@ where they are known to differ. But there are ways to customize the argument:
        rustc.platform = { foo = ""; bar = ""; };
      };
    }
+   ```
    will result in:
    ```shell
    --target /nix/store/asdfasdfsadf-thumb-crazy.json # contains {"foo":"","bar":""}
@@ -156,7 +157,7 @@ path) can be passed directly to `buildRustPackage`:
 
 ```nix
 pkgs.rustPlatform.buildRustPackage {
-  (...)
+  /* ... */
   target = "x86_64-fortanix-unknown-sgx";
 }
 ```
@@ -191,6 +192,13 @@ rustPlatform.buildRustPackage {
 Please note that the code will be compiled twice here: once in `release` mode
 for the `buildPhase`, and again in `debug` mode for the `checkPhase`.
 
+Test flags, e.g., `--features xxx/yyy`, can be passed to `cargo test` via the
+`cargoTestFlags` attribute.
+
+Another attribute, called `checkFlags`, is used to pass arguments to the test
+binary itself, as stated
+(here)[https://doc.rust-lang.org/cargo/commands/cargo-test.html].
+
 #### Tests relying on the structure of the `target/` directory
 
 Some tests may rely on the structure of the `target/` directory. Those tests
@@ -320,9 +328,10 @@ attributes can also be used:
   variable `buildAndTestSubdir` can be used to build a crate in a
   Cargo workspace. Additional maturin flags can be passed through
   `maturinBuildFlags`.
-* `cargoCheckHook`: run tests using Cargo. Additional flags can be
+* `cargoCheckHook`: run tests using Cargo. The build type for checks
-  passed to Cargo using `checkFlags` and `checkFlagsArray`. By
+  can be set using `cargoCheckType`. Additional flags can be passed to
-  default, tests are run in parallel. This can be disabled by setting
+  the tests using `checkFlags` and `checkFlagsArray`. By default,
+  tests are run in parallel. This can be disabled by setting
   `dontUseCargoParallelTests`.
 * `cargoInstallHook`: install binaries and static/shared libraries
   that were built using `cargoBuildHook`.

third_party/nixpkgs/doc/manual.xml

@@ -35,6 +35,7 @@
   <xi:include href="contributing/quick-start.xml" />
   <xi:include href="contributing/coding-conventions.xml" />
   <xi:include href="contributing/submitting-changes.chapter.xml" />
+  <xi:include href="contributing/vulnerability-roundup.chapter.xml" />
   <xi:include href="contributing/reviewing-contributions.xml" />
   <xi:include href="contributing/contributing-to-documentation.xml" />
  </part>

third_party/nixpkgs/lib/licenses.nix

@@ -603,6 +603,11 @@ lib.mapAttrs (n: v: v // { shortName = n; }) ({
     free = false;
   };
 
+  odbl = spdx {
+    spdxId = "ODbL-1.0";
+    fullName = "Open Data Commons Open Database License v1.0";
+  };
+
   ofl = spdx {
     spdxId = "OFL-1.1";
     fullName = "SIL Open Font License 1.1";

third_party/nixpkgs/lib/systems/default.nix

@@ -107,6 +107,11 @@ rec {
           powerpc64le = "ppc64le";
         }.${final.parsed.cpu.name} or final.parsed.cpu.name;
 
+      darwinArch = {
+        armv7a  = "armv7";
+        aarch64 = "arm64";
+      }.${final.parsed.cpu.name} or final.parsed.cpu.name;
+
       emulator = pkgs: let
         qemu-user = pkgs.qemu.override {
           smartcardSupport = false;

third_party/nixpkgs/maintainers/maintainer-list.nix

@@ -1859,6 +1859,12 @@
       fingerprint = "68B8 0D57 B2E5 4AC3 EC1F  49B0 B37E 0F23 7101 6A4C";
     }];
   };
+  collares = {
+    email = "mauricio@collares.org";
+    github = "collares";
+    githubId = 244239;
+    name = "Mauricio Collares";
+  };
   copumpkin = {
     email = "pumpkingod@gmail.com";
     github = "copumpkin";
@@ -2889,6 +2895,12 @@
     githubId = 3787281;
     name = "Erik Rybakken";
   };
+  erin = {
+    name = "Erin van der Veen";
+    email = "erin@erinvanderveen.nl";
+    github = "ErinvanderVeen";
+    githubId = 10973664;
+  };
   erosennin = {
     email = "ag@sologoc.com";
     github = "erosennin";
@@ -4153,6 +4165,12 @@
     github = "j0hax";
     githubId = 3802620;
   };
+  j4m3s = {
+    name = "James Landrein";
+    email = "github@j4m3s.eu";
+    github = "j4m3s-s";
+    githubId = 9413812;
+  };
   jacg = {
     name = "Jacek Generowicz";
     email = "jacg@my-post-office.net";
@@ -4177,6 +4195,12 @@
     githubId = 175537;
     name = "Johannes Lötzsch";
   };
+  jackgerrits = {
+    email = "jack@jackgerrits.com";
+    github = "jackgerrits";
+    githubId = 7558482;
+    name = "Jack Gerrits";
+  };
   jagajaga = {
     email = "ars.seroka@gmail.com";
     github = "jagajaga";
@@ -5530,6 +5554,12 @@
     githubId = 7622248;
     name = "Sebastian Zivota";
   };
+  locallycompact = {
+    email = "dan.firth@homotopic.tech";
+    github = "locallycompact";
+    githubId = 1267527;
+    name = "Daniel Firth";
+  };
   lopsided98 = {
     email = "benwolsieffer@gmail.com";
     github = "lopsided98";
@@ -6987,6 +7017,12 @@
     githubId = 3359345;
     name = "obadz";
   };
+  obsidian-systems-maintenance = {
+    name = "Obsidian Systems Maintenance";
+    email = "maintainer@obsidian.systems";
+    github = "obsidian-systems-maintenance";
+    githubId = 80847921;
+  };
   odi = {
     email = "oliver.dunkl@gmail.com";
     github = "odi";

third_party/nixpkgs/maintainers/scripts/pluginupdate.py

@@ -514,7 +514,7 @@ def update_plugins(editor: Editor):
         )
 
     for plugin_line in args.add_plugins:
-        rewrite_input(args.input_fil, editor.deprecated, append=(plugin_line + "\n",))
+        rewrite_input(args.input_file, editor.deprecated, append=(plugin_line + "\n",))
         update()
         plugin = fetch_plugin_from_pluginline(plugin_line)
         commit(

third_party/nixpkgs/maintainers/team-list.nix

@@ -134,6 +134,7 @@ with lib.maintainers; {
       timokau
       omasanori
       raskin
+      collares
     ];
     scope = "Maintain SageMath and the dependencies that are likely to break it.";
   };

third_party/nixpkgs/nixos/modules/config/update-users-groups.pl

@@ -288,7 +288,7 @@ foreach my $u (values %usersOut) {
     push @shadowNew, join(":", $u->{name}, $hashedPassword, "1::::::") . "\n";
 }
 
-updateFile("/etc/shadow", \@shadowNew, 0600);
+updateFile("/etc/shadow", \@shadowNew, 0640);
 {
     my $uid = getpwnam "root";
     my $gid = getgrnam "shadow";

third_party/nixpkgs/nixos/modules/module-list.nix

@@ -155,6 +155,7 @@
   ./programs/nm-applet.nix
   ./programs/npm.nix
   ./programs/oblogout.nix
+  ./programs/partition-manager.nix
   ./programs/plotinus.nix
   ./programs/proxychains.nix
   ./programs/qt5ct.nix
@@ -177,6 +178,7 @@
   ./programs/tmux.nix
   ./programs/traceroute.nix
   ./programs/tsm-client.nix
+  ./programs/turbovnc.nix
   ./programs/udevil.nix
   ./programs/usbtop.nix
   ./programs/vim.nix
@@ -882,6 +884,7 @@
   ./services/web-apps/atlassian/confluence.nix
   ./services/web-apps/atlassian/crowd.nix
   ./services/web-apps/atlassian/jira.nix
+  ./services/web-apps/bookstack.nix
   ./services/web-apps/convos.nix
   ./services/web-apps/cryptpad.nix
   ./services/web-apps/documize.nix

third_party/nixpkgs/nixos/modules/programs/partition-manager.nix

@@ -0,0 +1,19 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  meta.maintainers = [ maintainers.oxalica ];
+
+  ###### interface
+  options = {
+    programs.partition-manager.enable = mkEnableOption "KDE Partition Manager";
+  };
+
+  ###### implementation
+  config = mkIf config.programs.partition-manager.enable {
+    services.dbus.packages = [ pkgs.libsForQt5.kpmcore ];
+    # `kpmcore` need to be installed to pull in polkit actions.
+    environment.systemPackages = [ pkgs.libsForQt5.kpmcore pkgs.partition-manager ];
+  };
+}

third_party/nixpkgs/nixos/modules/programs/sway.nix

@@ -90,7 +90,7 @@ in {
         rxvt-unicode # For backward compatibility (old default terminal)
       ];
       defaultText = literalExample ''
-        with pkgs; [ swaylock swayidle xwayland rxvt-unicode dmenu ];
+        with pkgs; [ swaylock swayidle rxvt-unicode alacritty dmenu ];
       '';
       example = literalExample ''
         with pkgs; [

third_party/nixpkgs/nixos/modules/programs/turbovnc.nix

@@ -0,0 +1,54 @@
+# Global configuration for the SSH client.
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.turbovnc;
+in
+{
+  options = {
+
+    programs.turbovnc = {
+
+      ensureHeadlessSoftwareOpenGL = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to set up NixOS such that TurboVNC's built-in software OpenGL
+          implementation works.
+
+          This will enable <option>hardware.opengl.enable</option> so that OpenGL
+          programs can find Mesa's llvmpipe drivers.
+
+          Setting this option to <code>false</code> does not mean that software
+          OpenGL won't work; it may still work depending on your system
+          configuration.
+
+          This option is also intended to generate warnings if you are using some
+          configuration that's incompatible with using headless software OpenGL
+          in TurboVNC.
+        '';
+      };
+
+    };
+
+  };
+
+  config = mkIf cfg.ensureHeadlessSoftwareOpenGL {
+
+    # TurboVNC has builtin support for Mesa llvmpipe's `swrast`
+    # software rendering to implemnt GLX (OpenGL on Xorg).
+    # However, just building TurboVNC with support for that is not enough
+    # (it only takes care of the X server side part of OpenGL);
+    # the indiviudual applications (e.g. `glxgears`) also need to directly load
+    # the OpenGL libs.
+    # Thus, this creates `/run/opengl-driver` populated by Mesa so that the applications
+    # can find the llvmpipe `swrast.so` software rendering DRI lib via `libglvnd`.
+    # This comment exists to explain why `hardware.` is involved,
+    # even though 100% software rendering is used.
+    hardware.opengl.enable = true;
+
+  };
+}

third_party/nixpkgs/nixos/modules/services/computing/slurm/slurm.nix

@@ -274,6 +274,15 @@ in
         '';
       };
 
+      etcSlurm = mkOption {
+        type = types.path;
+        internal = true;
+        default = etcSlurm;
+        description = ''
+          Path to directory with slurm config files. This option is set by default from the
+          Slurm module and is meant to make the Slurm config file available to other modules.
+        '';
+      };
 
     };
 
@@ -308,7 +317,7 @@ in
           #!/bin/sh
           if [ -z "$SLURM_CONF" ]
           then
-            SLURM_CONF="${etcSlurm}/slurm.conf" "$EXE" "\$@"
+            SLURM_CONF="${cfg.etcSlurm}/slurm.conf" "$EXE" "\$@"
           else
             "$EXE" "\$0"
           fi

third_party/nixpkgs/nixos/modules/services/misc/redmine.nix

@@ -28,7 +28,7 @@ let
   unpack = id: (name: source:
     pkgs.stdenv.mkDerivation {
       name = "redmine-${id}-${name}";
-      buildInputs = [ pkgs.unzip ];
+      nativeBuildInputs = [ pkgs.unzip ];
       buildCommand = ''
         mkdir -p $out
         cd $out

third_party/nixpkgs/nixos/modules/services/monitoring/prometheus/exporters/postgres.nix

@@ -30,12 +30,49 @@ in
         Whether to run the exporter as the local 'postgres' super user.
       '';
     };
+
+    # TODO perhaps LoadCredential would be more appropriate
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/root/prometheus-postgres-exporter.env";
+      description = ''
+        Environment file as defined in <citerefentry>
+        <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
+        </citerefentry>.
+
+        Secrets may be passed to the service without adding them to the
+        world-readable Nix store, by specifying placeholder variables as
+        the option value in Nix and setting these variables accordingly in the
+        environment file.
+
+        Environment variables from this file will be interpolated into the
+        config file using envsubst with this syntax:
+        <literal>$ENVIRONMENT ''${VARIABLE}</literal>
+
+        The main use is to set the DATA_SOURCE_NAME that contains the
+        postgres password
+
+        note that contents from this file will override dataSourceName
+        if you have set it from nix.
+
+        <programlisting>
+          # Content of the environment file
+          DATA_SOURCE_NAME=postgresql://username:password@localhost:5432/postgres?sslmode=disable
+        </programlisting>
+
+        Note that this file needs to be available on the host on which
+        this exporter is running.
+      '';
+    };
+
   };
   serviceOpts = {
     environment.DATA_SOURCE_NAME = cfg.dataSourceName;
     serviceConfig = {
       DynamicUser = false;
       User = mkIf cfg.runAsLocalSuperUser (mkForce "postgres");
+      EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
       ExecStart = ''
         ${pkgs.prometheus-postgres-exporter}/bin/postgres_exporter \
           --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \

third_party/nixpkgs/nixos/modules/services/system/localtime.nix

@@ -29,15 +29,14 @@ in {
       };
     };
 
-    # We use the 'out' output, since localtime has its 'bin' output
-    # first, so that is what we get if we use the derivation bare.
     # Install the polkit rules.
-    environment.systemPackages = [ pkgs.localtime.out ];
+    environment.systemPackages = [ pkgs.localtime ];
     # Install the systemd unit.
-    systemd.packages = [ pkgs.localtime.out ];
+    systemd.packages = [ pkgs.localtime ];
 
     users.users.localtimed = {
-      description = "Taskserver user";
+      description = "localtime daemon";
+      isSystemUser = true;
     };
 
     systemd.services.localtime = {

third_party/nixpkgs/nixos/modules/services/web-apps/bookstack.nix

@@ -0,0 +1,365 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.bookstack;
+  bookstack = pkgs.bookstack.override {
+    dataDir = cfg.dataDir;
+  };
+  db = cfg.database;
+  mail = cfg.mail;
+
+  user = cfg.user;
+  group = cfg.group;
+
+  # shell script for local administration
+  artisan = pkgs.writeScriptBin "bookstack" ''
+    #! ${pkgs.runtimeShell}
+    cd ${bookstack}
+    sudo=exec
+    if [[ "$USER" != ${user} ]]; then
+      sudo='exec /run/wrappers/bin/sudo -u ${user}'
+    fi
+    $sudo ${pkgs.php}/bin/php artisan $*
+  '';
+
+
+in {
+  options.services.bookstack = {
+
+    enable = mkEnableOption "BookStack";
+
+    user = mkOption {
+      default = "bookstack";
+      description = "User bookstack runs as.";
+      type = types.str;
+    };
+
+    group = mkOption {
+      default = "bookstack";
+      description = "Group bookstack runs as.";
+      type = types.str;
+    };
+
+    appKeyFile = mkOption {
+      description = ''
+        A file containing the AppKey.
+        Used for encryption where needed. Can be generated with <code>head -c 32 /dev/urandom| base64</code> and must be prefixed with <literal>base64:</literal>.
+      '';
+      example = "/run/keys/bookstack-appkey";
+      type = types.path;
+    };
+
+    appURL = mkOption {
+      description = ''
+        The root URL that you want to host BookStack on. All URLs in BookStack will be generated using this value.
+        If you change this in the future you may need to run a command to update stored URLs in the database. Command example: <code>php artisan bookstack:update-url https://old.example.com https://new.example.com</code>
+      '';
+      example = "https://example.com";
+      type = types.str;
+    };
+
+    cacheDir = mkOption {
+      description = "BookStack cache directory";
+      default = "/var/cache/bookstack";
+      type = types.path;
+    };
+
+    dataDir = mkOption {
+      description = "BookStack data directory";
+      default = "/var/lib/bookstack";
+      type = types.path;
+    };
+
+    database = {
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = "Database host address.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 3306;
+        description = "Database host port.";
+      };
+      name = mkOption {
+        type = types.str;
+        default = "bookstack";
+        description = "Database name.";
+      };
+      user = mkOption {
+        type = types.str;
+        default = user;
+        defaultText = "\${user}";
+        description = "Database username.";
+      };
+      passwordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "/run/keys/bookstack-dbpassword";
+        description = ''
+          A file containing the password corresponding to
+          <option>database.user</option>.
+        '';
+      };
+      createLocally = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Create the database and database user locally.";
+      };
+    };
+
+    mail = {
+      driver = mkOption {
+        type = types.enum [ "smtp" "sendmail" ];
+        default = "smtp";
+        description = "Mail driver to use.";
+      };
+      host = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = "Mail host address.";
+      };
+      port = mkOption {
+        type = types.port;
+        default = 1025;
+        description = "Mail host port.";
+      };
+      fromName = mkOption {
+        type = types.str;
+        default = "BookStack";
+        description = "Mail \"from\" name.";
+      };
+      from = mkOption {
+        type = types.str;
+        default = "mail@bookstackapp.com";
+        description = "Mail \"from\" email.";
+      };
+      user = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        example = "bookstack";
+        description = "Mail username.";
+      };
+      passwordFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        example = "/run/keys/bookstack-mailpassword";
+        description = ''
+          A file containing the password corresponding to
+          <option>mail.user</option>.
+        '';
+      };
+      encryption = mkOption {
+        type = with types; nullOr (enum [ "tls" ]);
+        default = null;
+        description = "SMTP encryption mechanism to use.";
+      };
+    };
+
+    maxUploadSize = mkOption {
+      type = types.str;
+      default = "18M";
+      example = "1G";
+      description = "The maximum size for uploads (e.g. images).";
+    };
+
+    poolConfig = mkOption {
+      type = with types; attrsOf (oneOf [ str int bool ]);
+      default = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+      };
+      description = ''
+        Options for the bookstack PHP pool. See the documentation on <literal>php-fpm.conf</literal>
+        for details on configuration directives.
+      '';
+    };
+
+    nginx = mkOption {
+      type = types.submodule (
+        recursiveUpdate
+          (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) {}
+      );
+      default = {};
+      example = {
+        serverAliases = [
+          "bookstack.\${config.networking.domain}"
+        ];
+        # To enable encryption and let let's encrypt take care of certificate
+        forceSSL = true;
+        enableACME = true;
+      };
+      description = ''
+        With this option, you can customize the nginx virtualHost settings.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.nullOr types.lines;
+      default = null;
+      example = ''
+        ALLOWED_IFRAME_HOSTS="https://example.com"
+        WKHTMLTOPDF=/home/user/bins/wkhtmltopdf
+      '';
+      description = ''
+        Lines to be appended verbatim to the BookStack configuration.
+        Refer to <link xlink:href="https://www.bookstackapp.com/docs/"/> for details on supported values.
+      '';
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    assertions = [
+      { assertion = db.createLocally -> db.user == user;
+        message = "services.bookstack.database.user must be set to ${user} if services.mediawiki.database.createLocally is set true.";
+      }
+      { assertion = db.createLocally -> db.passwordFile == null;
+        message = "services.bookstack.database.passwordFile cannot be specified if services.bookstack.database.createLocally is set to true.";
+      }
+    ];
+
+    environment.systemPackages = [ artisan ];
+
+    services.mysql = mkIf db.createLocally {
+      enable = true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = [ db.name ];
+      ensureUsers = [
+        { name = db.user;
+          ensurePermissions = { "${db.name}.*" = "ALL PRIVILEGES"; };
+        }
+      ];
+    };
+
+    services.phpfpm.pools.bookstack = {
+      inherit user;
+      inherit group;
+      phpOptions = ''
+        log_errors = on
+        post_max_size = ${cfg.maxUploadSize}
+        upload_max_filesize = ${cfg.maxUploadSize}
+      '';
+      settings = {
+        "listen.mode" = "0660";
+        "listen.owner" = user;
+        "listen.group" = group;
+      } // cfg.poolConfig;
+    };
+
+    services.nginx = {
+      enable = mkDefault true;
+      virtualHosts.bookstack = mkMerge [ cfg.nginx {
+        root = mkForce "${bookstack}/public";
+        extraConfig = optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "fastcgi_param HTTPS on;";
+        locations = {
+          "/" = {
+            index = "index.php";
+            extraConfig = ''try_files $uri $uri/ /index.php?$query_string;'';
+          };
+          "~ \.php$" = {
+            extraConfig = ''
+              try_files $uri $uri/ /index.php?$query_string;
+              include ${pkgs.nginx}/conf/fastcgi_params;
+              fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+              fastcgi_param REDIRECT_STATUS 200;
+              fastcgi_pass unix:${config.services.phpfpm.pools."bookstack".socket};
+              ${optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "fastcgi_param HTTPS on;"}
+            '';
+          };
+          "~ \.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            extraConfig = "expires 365d;";
+          };
+        };
+      }];
+    };
+
+    systemd.services.bookstack-setup = {
+      description = "Preperation tasks for BookStack";
+      before = [ "phpfpm-bookstack.service" ];
+      after = optional db.createLocally "mysql.service";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = user;
+        WorkingDirectory = "${bookstack}";
+      };
+      script = ''
+        # create .env file
+        echo "
+        APP_KEY=base64:$(head -n1 ${cfg.appKeyFile})
+        APP_URL=${cfg.appURL}
+        DB_HOST=${db.host}
+        DB_PORT=${toString db.port}
+        DB_DATABASE=${db.name}
+        DB_USERNAME=${db.user}
+        MAIL_DRIVER=${mail.driver}
+        MAIL_FROM_NAME=\"${mail.fromName}\"
+        MAIL_FROM=${mail.from}
+        MAIL_HOST=${mail.host}
+        MAIL_PORT=${toString mail.port}
+        ${optionalString (mail.user != null) "MAIL_USERNAME=${mail.user};"}
+        ${optionalString (mail.encryption != null) "MAIL_ENCRYPTION=${mail.encryption};"}
+        ${optionalString (db.passwordFile != null) "DB_PASSWORD=$(head -n1 ${db.passwordFile})"}
+        ${optionalString (mail.passwordFile != null) "MAIL_PASSWORD=$(head -n1 ${mail.passwordFile})"}
+        APP_SERVICES_CACHE=${cfg.cacheDir}/services.php
+        APP_PACKAGES_CACHE=${cfg.cacheDir}/packages.php
+        APP_CONFIG_CACHE=${cfg.cacheDir}/config.php
+        APP_ROUTES_CACHE=${cfg.cacheDir}/routes-v7.php
+        APP_EVENTS_CACHE=${cfg.cacheDir}/events.php
+        ${optionalString (cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME) "SESSION_SECURE_COOKIE=true"}
+        ${toString cfg.extraConfig}
+        " > "${cfg.dataDir}/.env"
+        # set permissions
+        chmod 700 "${cfg.dataDir}/.env"
+
+        # migrate db
+        ${pkgs.php}/bin/php artisan migrate --force
+
+        # create caches
+        ${pkgs.php}/bin/php artisan config:cache
+        ${pkgs.php}/bin/php artisan route:cache
+        ${pkgs.php}/bin/php artisan view:cache
+      '';
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.cacheDir}                           0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}                            0710 ${user} ${group} - -"
+      "d ${cfg.dataDir}/public                     0750 ${user} ${group} - -"
+      "d ${cfg.dataDir}/public/uploads             0750 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage                    0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/app                0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/fonts              0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework          0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework/cache    0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework/sessions 0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/framework/views    0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/logs               0700 ${user} ${group} - -"
+      "d ${cfg.dataDir}/storage/uploads            0700 ${user} ${group} - -"
+    ];
+
+    users = {
+      users = mkIf (user == "bookstack") {
+        bookstack = {
+          inherit group;
+          isSystemUser = true;
+        };
+        "${config.services.nginx.user}".extraGroups = [ group ];
+      };
+      groups = mkIf (group == "bookstack") {
+        bookstack = {};
+      };
+    };
+
+  };
+
+  meta.maintainers = with maintainers; [ ymarkus ];
+}

third_party/nixpkgs/nixos/modules/services/web-apps/dokuwiki.nix

@@ -193,7 +193,7 @@ let
                 };
                 sourceRoot = ".";
                 # We need unzip to build this package
-                buildInputs = [ pkgs.unzip ];
+                nativeBuildInputs = [ pkgs.unzip ];
                 # Installing simply means copying all files to the output directory
                 installPhase = "mkdir -p $out; cp -R * $out/";
               };
@@ -220,7 +220,7 @@ let
                   sha256 = "4de5ff31d54dd61bbccaf092c9e74c1af3a4c53e07aa59f60457a8f00cfb23a6";
                 };
                 # We need unzip to build this package
-                buildInputs = [ pkgs.unzip ];
+                nativeBuildInputs = [ pkgs.unzip ];
                 # Installing simply means copying all files to the output directory
                 installPhase = "mkdir -p $out; cp -R * $out/";
               };

third_party/nixpkgs/nixos/modules/services/web-apps/wordpress.nix

@@ -109,7 +109,7 @@ let
                 sha256 = "1rhba5h5fjlhy8p05zf0p14c9iagfh96y91r36ni0rmk6y891lyd";
               };
               # We need unzip to build this package
-              buildInputs = [ pkgs.unzip ];
+              nativeBuildInputs = [ pkgs.unzip ];
               # Installing simply means copying all files to the output directory
               installPhase = "mkdir -p $out; cp -R * $out/";
             };
@@ -136,7 +136,7 @@ let
                 sha256 = "0rjwm811f4aa4q43r77zxlpklyb85q08f9c8ns2akcarrvj5ydx3";
               };
               # We need unzip to build this package
-              buildInputs = [ pkgs.unzip ];
+              nativeBuildInputs = [ pkgs.unzip ];
               # Installing simply means copying all files to the output directory
               installPhase = "mkdir -p $out; cp -R * $out/";
             };

third_party/nixpkgs/nixos/modules/services/web-servers/nginx/default.nix

@@ -804,7 +804,7 @@ in
         ProtectControlGroups = true;
         RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
         LockPersonality = true;
-        MemoryDenyWriteExecute = !(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules);
+        MemoryDenyWriteExecute = !(builtins.any (mod: (mod.allowMemoryWriteExecute or false)) (optionals (cfg.package ? modules) cfg.package.modules));
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         PrivateMounts = true;

third_party/nixpkgs/nixos/tests/all-tests.nix

@@ -408,6 +408,7 @@ in
   trickster = handleTest ./trickster.nix {};
   trilium-server = handleTestOn ["x86_64-linux"] ./trilium-server.nix {};
   tuptime = handleTest ./tuptime.nix {};
+  turbovnc-headless-server = handleTest ./turbovnc-headless-server.nix {};
   ucg = handleTest ./ucg.nix {};
   udisks2 = handleTest ./udisks2.nix {};
   unbound = handleTest ./unbound.nix {};

third_party/nixpkgs/nixos/tests/dokuwiki.nix

@@ -9,7 +9,7 @@ let
       sha256 = "4de5ff31d54dd61bbccaf092c9e74c1af3a4c53e07aa59f60457a8f00cfb23a6";
     };
     # We need unzip to build this package
-    buildInputs = [ pkgs.unzip ];
+    nativeBuildInputs = [ pkgs.unzip ];
     # Installing simply means copying all files to the output directory
     installPhase = "mkdir -p $out; cp -R * $out/";
   };
@@ -24,7 +24,7 @@ let
       sha256 = "e40ed7dd6bbe7fe3363bbbecb4de481d5e42385b5a0f62f6a6ce6bf3a1f9dfa8";
     };
     # We need unzip to build this package
-    buildInputs = [ pkgs.unzip ];
+    nativeBuildInputs = [ pkgs.unzip ];
     sourceRoot = ".";
     # Installing simply means copying all files to the output directory
     installPhase = "mkdir -p $out; cp -R * $out/";

third_party/nixpkgs/nixos/tests/turbovnc-headless-server.nix

@@ -0,0 +1,171 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "turbovnc-headless-server";
+  meta = {
+    maintainers = with lib.maintainers; [ nh2 ];
+  };
+
+  machine = { pkgs, ... }: {
+
+    environment.systemPackages = with pkgs; [
+      glxinfo
+      procps # for `pkill`, `pidof` in the test
+      scrot # for screenshotting Xorg
+      turbovnc
+    ];
+
+    programs.turbovnc.ensureHeadlessSoftwareOpenGL = true;
+
+    networking.firewall = {
+      # Reject instead of drop, for failures instead of hangs.
+      rejectPackets = true;
+      allowedTCPPorts = [
+        5900 # VNC :0, for seeing what's going on in the server
+      ];
+    };
+
+    # So that we can ssh into the VM, see e.g.
+    # http://blog.patapon.info/nixos-local-vm/#accessing-the-vm-with-ssh
+    services.openssh.enable = true;
+    services.openssh.permitRootLogin = "yes";
+    users.extraUsers.root.password = "";
+    users.mutableUsers = false;
+  };
+
+  testScript = ''
+    def wait_until_terminated_or_succeeds(
+        termination_check_shell_command,
+        success_check_shell_command,
+        get_detail_message_fn,
+        retries=60,
+        retry_sleep=0.5,
+    ):
+        def check_success():
+            command_exit_code, _output = machine.execute(success_check_shell_command)
+            return command_exit_code == 0
+
+        for _ in range(retries):
+            exit_check_exit_code, _output = machine.execute(termination_check_shell_command)
+            is_terminated = exit_check_exit_code != 0
+            if is_terminated:
+                if check_success():
+                    return
+                else:
+                    details = get_detail_message_fn()
+                    raise Exception(
+                        f"termination check ({termination_check_shell_command}) triggered without command succeeding ({success_check_shell_command}); details: {details}"
+                    )
+            else:
+                if check_success():
+                    return
+            time.sleep(retry_sleep)
+
+        if not check_success():
+            details = get_detail_message_fn()
+            raise Exception(
+                f"action timed out ({success_check_shell_command}); details: {details}"
+            )
+
+
+    # Below we use the pattern:
+    #     (cmd | tee stdout.log) 3>&1 1>&2 2>&3 | tee stderr.log
+    # to capture both stderr and stdout while also teeing them, see:
+    # https://unix.stackexchange.com/questions/6430/how-to-redirect-stderr-and-stdout-to-different-files-and-also-display-in-termina/6431#6431
+
+
+    # Starts headless VNC server, backgrounding it.
+    def start_xvnc():
+        xvnc_command = " ".join(
+            [
+                "Xvnc",
+                ":0",
+                "-iglx",
+                "-auth /root/.Xauthority",
+                "-geometry 1240x900",
+                "-depth 24",
+                "-rfbwait 5000",
+                "-deferupdate 1",
+                "-verbose",
+                "-securitytypes none",
+                # We don't enforce localhost listening such that we
+                # can connect from outside the VM using
+                #     env QEMU_NET_OPTS=hostfwd=tcp::5900-:5900 $(nix-build nixos/tests/turbovnc-headless-server.nix -A driver)/bin/nixos-test-driver
+                # for testing purposes, and so that we can in the future
+                # add another test case that connects the TurboVNC client.
+                # "-localhost",
+            ]
+        )
+        machine.execute(
+            # Note trailing & for backgrounding.
+            f"({xvnc_command} | tee /tmp/Xvnc.stdout) 3>&1 1>&2 2>&3 | tee /tmp/Xvnc.stderr &",
+        )
+
+
+    # Waits until the server log message that tells us that GLX is ready
+    # (requires `-verbose` above), avoiding screenshoting racing below.
+    def wait_until_xvnc_glx_ready():
+        machine.wait_until_succeeds("test -f /tmp/Xvnc.stderr")
+        wait_until_terminated_or_succeeds(
+            termination_check_shell_command="pidof Xvnc",
+            success_check_shell_command="grep 'GLX: Initialized DRISWRAST' /tmp/Xvnc.stderr",
+            get_detail_message_fn=lambda: "Contents of /tmp/Xvnc.stderr:\n"
+            + machine.succeed("cat /tmp/Xvnc.stderr"),
+        )
+
+
+    # Checks that we detect glxgears failing when
+    # `LIBGL_DRIVERS_PATH=/nonexistent` is set
+    # (in which case software rendering should not work).
+    def test_glxgears_failing_with_bad_driver_path():
+        machine.execute(
+            # Note trailing & for backgrounding.
+            "(env DISPLAY=:0 LIBGL_DRIVERS_PATH=/nonexistent glxgears -info | tee /tmp/glxgears-should-fail.stdout) 3>&1 1>&2 2>&3 | tee /tmp/glxgears-should-fail.stderr &"
+        )
+        machine.wait_until_succeeds("test -f /tmp/glxgears-should-fail.stderr")
+        wait_until_terminated_or_succeeds(
+            termination_check_shell_command="pidof glxgears",
+            success_check_shell_command="grep 'libGL error: failed to load driver: swrast' /tmp/glxgears-should-fail.stderr",
+            get_detail_message_fn=lambda: "Contents of /tmp/glxgears-should-fail.stderr:\n"
+            + machine.succeed("cat /tmp/glxgears-should-fail.stderr"),
+        )
+        machine.wait_until_fails("pidof glxgears")
+
+
+    # Starts glxgears, backgrounding it. Waits until it prints the `GL_RENDERER`.
+    # Does not quit glxgears.
+    def test_glxgears_prints_renderer():
+        machine.execute(
+            # Note trailing & for backgrounding.
+            "(env DISPLAY=:0 glxgears -info | tee /tmp/glxgears.stdout) 3>&1 1>&2 2>&3 | tee /tmp/glxgears.stderr &"
+        )
+        machine.wait_until_succeeds("test -f /tmp/glxgears.stderr")
+        wait_until_terminated_or_succeeds(
+            termination_check_shell_command="pidof glxgears",
+            success_check_shell_command="grep 'GL_RENDERER' /tmp/glxgears.stdout",
+            get_detail_message_fn=lambda: "Contents of /tmp/glxgears.stderr:\n"
+            + machine.succeed("cat /tmp/glxgears.stderr"),
+        )
+
+
+    with subtest("Start Xvnc"):
+        start_xvnc()
+        wait_until_xvnc_glx_ready()
+
+    with subtest("Ensure bad driver path makes glxgears fail"):
+        test_glxgears_failing_with_bad_driver_path()
+
+    with subtest("Run 3D application (glxgears)"):
+        test_glxgears_prints_renderer()
+
+        # Take screenshot; should display the glxgears.
+        machine.succeed("scrot --display :0 /tmp/glxgears.png")
+
+    # Copy files down.
+    machine.copy_from_vm("/tmp/glxgears.png")
+    machine.copy_from_vm("/tmp/glxgears.stdout")
+    machine.copy_from_vm("/tmp/glxgears-should-fail.stdout")
+    machine.copy_from_vm("/tmp/glxgears-should-fail.stderr")
+    machine.copy_from_vm("/tmp/Xvnc.stdout")
+    machine.copy_from_vm("/tmp/Xvnc.stderr")
+  '';
+
+})

third_party/nixpkgs/pkgs/applications/accessibility/squeekboard/default.nix

@@ -0,0 +1,70 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, gnome3
+, glib
+, gtk3
+, wayland
+, wayland-protocols
+, libxml2
+, libxkbcommon
+, rustPlatform
+, feedbackd
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "squeekboard";
+  version = "unstable-2021-03-09";
+
+  src = fetchFromGitLab {
+    domain = "source.puri.sm";
+    owner = "Librem5";
+    repo = pname;
+    rev = "bffd212e102bf71a94c599aac0359a8d30d19008";
+    sha256 = "1j10zhyb8wyrcbryfj6f3drn9b0l9x0l7hnhy2imnjbfbnwwm4w7";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    cargoUpdateHook = ''
+      cat Cargo.toml.in Cargo.deps > Cargo.toml
+    '';
+    name = "${pname}-${version}";
+    sha256 = "1qaqiaxqc4x2x5bd31na4c49vbjwrmz5clmgli7733dv55rxxias";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    glib
+    wayland
+    wrapGAppsHook
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);
+
+  buildInputs = [
+    gtk3
+    gnome3.gnome-desktop
+    wayland
+    wayland-protocols
+    libxml2
+    libxkbcommon
+    feedbackd
+  ];
+
+  meta = with lib; {
+    description = "A virtual keyboard supporting Wayland";
+    homepage = "https://source.puri.sm/Librem5/squeekboard";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ artturin ];
+    platforms = platforms.linux;
+  };
+}

third_party/nixpkgs/pkgs/applications/audio/ardour/5.nix

@@ -8,7 +8,6 @@
 , doxygen
 , fftwSinglePrec
 , flac
-, glibc
 , glibmm
 , graphviz
 , gtkmm2

third_party/nixpkgs/pkgs/applications/audio/callaudiod/default.nix

@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation rec {
   pname = "callaudiod";
-  version = "0.0.4";
+  version = "0.1.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.com";
     owner = "mobian1";
     repo = pname;
     rev = version;
-    sha256 = "07k7xp5a9c4d4lq7amaj6cg6b3gsd77x9wvf7nzcf4vpaph4yiyj";
+    sha256 = "087589z45xvldn2m1g79y0xbwzylwkjmfk83s5xjixyq0wqmfppd";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/audio/cheesecutter/default.nix

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "cheesecutter";
-  version = "unstable-2020-04-03";
+  version = "unstable-2021-02-27";
 
   src = fetchFromGitHub {
     owner = "theyamo";
     repo = "CheeseCutter";
-    rev = "68d6518f0e6249a2a5d122fc80201578337c1277";
+    rev = "84450d3614b8fb2cabda87033baab7bedd5a5c98";
-    sha256 = "0xspzjhc6cp3m0yd0mwxncg8n1wklizamxvidrnn21jgj3mnaq2q";
+    sha256 = "sha256:0q4a791nayya6n01l0f4kk497rdq6kiq0n72fqdpwqy138pfwydn";
   };
 
   patches = [

third_party/nixpkgs/pkgs/applications/audio/espeak/default.nix

@@ -8,7 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0n86gwh9pw0jqqpdz7mxggllfr8k0r7pc67ayy7w5z6z79kig6mz";
   };
 
-  buildInputs = [ unzip portaudio ];
+  nativeBuildInputs = [ unzip ];
+  buildInputs = [ portaudio ];
 
   patches = [
     ./gcc6.patch

third_party/nixpkgs/pkgs/applications/audio/espeak/edit.nix

@@ -8,8 +8,8 @@ stdenv.mkDerivation rec {
     sha256 = "0x8s7vpb7rw5x37yjzy1f98m4f2csdg89libb74fm36gn8ly0hli";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config unzip ];
-  buildInputs = [ unzip portaudio wxGTK ];
+  buildInputs = [ portaudio wxGTK ];
 
   # TODO:
   # Uhm, seems like espeakedit still wants espeak-data/ in $HOME, even thought

third_party/nixpkgs/pkgs/applications/audio/gnome-podcasts/default.nix

@@ -75,5 +75,7 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
+    # couldn't read /build/source/build/podcasts-gtk/resources/resources.gresource: No such file or directory (os error 2)
+    broken = true;
   };
 }

third_party/nixpkgs/pkgs/applications/audio/mp3gain/default.nix

@@ -7,7 +7,8 @@ stdenv.mkDerivation {
     sha256 = "0varr6y7k8zarr56b42r0ad9g3brhn5vv3xjg1c0v19jxwr4gh2w";
   };
 
-  buildInputs = [ unzip mpg123 ];
+  nativeBuildInputs = [ unzip ];
+  buildInputs = [ mpg123 ];
 
   sourceRoot = ".";
 

third_party/nixpkgs/pkgs/applications/audio/mpg123/default.nix

@@ -7,11 +7,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "mpg123-1.26.3";
+  name = "mpg123-1.26.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/${name}.tar.bz2";
-    sha256 = "0vkcfdx0mqq6lmpczsmpa2jsb0s6dryx3i7gvr32i3w9b9w9ij9h";
+    sha256 = "sha256-CBmRVA33pmaykEmthw8pPPoohjs2SIq01Yzqp7WEZFQ=";
   };
 
   outputs = [ "out" "conplay" ];

third_party/nixpkgs/pkgs/applications/audio/pd-plugins/helmholtz/default.nix

@@ -10,7 +10,8 @@ stdenv.mkDerivation {
     sha256 = "0h1fj7lmvq9j6rmw33rb8k0byxb898bi2xhcwkqalb84avhywgvs";
   };
 
-  buildInputs = [ unzip puredata ];
+  nativeBuildInputs = [ unzip ];
+  buildInputs = [ puredata ];
 
   unpackPhase = ''
     unzip $src

third_party/nixpkgs/pkgs/applications/audio/pd-plugins/puremapping/default.nix

@@ -10,7 +10,8 @@ stdenv.mkDerivation rec {
     sha256 = "1h7qgqd8srrxw2y1rkdw5js4k6f5vc8x6nlm2mq9mq9vjck7n1j7";
   };
 
-  buildInputs = [ unzip puredata ];
+  nativeBuildInputs = [ unzip ];
+  buildInputs = [ puredata ];
 
   unpackPhase = ''
     unzip $src

third_party/nixpkgs/pkgs/applications/audio/pd-plugins/timbreid/default.nix

@@ -9,7 +9,8 @@ stdenv.mkDerivation rec {
     sha256 = "14k2xk5zrzrw1zprdbwx45hrlc7ck8vq4drpd3l455i5r8yk4y6b";
   };
 
-  buildInputs = [ unzip puredata fftw ];
+  nativeBuildInputs = [ unzip ];
+  buildInputs = [ puredata fftw ];
 
   unpackPhase = ''
     mkdir source

third_party/nixpkgs/pkgs/applications/audio/plexamp/default.nix

@@ -2,13 +2,13 @@
 
 let
   pname = "plexamp";
-  version = "3.4.3";
+  version = "3.4.4";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://plexamp.plex.tv/plexamp.plex.tv/desktop/Plexamp-${version}.AppImage";
     name="${pname}-${version}.AppImage";
-    sha256 = "1rzhrc5yr5f6bxydgmcjwrg85vkbkn6lqj72512lyhq5gg7zmm1w";
+    sha256 = "1iz6qi12ljafb49l73rba5rwi5sdbd8ck5h2r6jiy260lgr2iiyk";
   };
 
   appimageContents = appimageTools.extractType2 {
@@ -32,7 +32,7 @@ in appimageTools.wrapType2 {
   meta = with lib; {
     description = "A beautiful Plex music player for audiophiles, curators, and hipsters";
     homepage = "https://plexamp.com/";
-    changelog = "https://forums.plex.tv/t/plexamp-release-notes/221280/25";
+    changelog = "https://forums.plex.tv/t/plexamp-release-notes/221280/26";
     license = licenses.unfree;
     maintainers = with maintainers; [ killercup synthetica ];
     platforms = [ "x86_64-linux" ];

third_party/nixpkgs/pkgs/applications/audio/renoise/default.nix

@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
         }
         else
           releasePath
-    else throw "Platform is not supported by Renoise";
+    else throw "Platform is not supported. Use instalation native to your platform https://www.renoise.com/";
 
   buildInputs = [ alsaLib libjack2 libX11 libXcursor libXext libXrandr ];
 
@@ -47,6 +47,16 @@ stdenv.mkDerivation rec {
 
     mkdir $out/bin
     ln -s $out/renoise $out/bin/renoise
+
+    # Desktop item
+    mkdir -p $out/share/applications
+    cp -r Installer/renoise.desktop $out/share/applications/renoise.desktop
+
+    # Desktop item icons
+    mkdir -p $out/share/icons/hicolor/{48x48,64x64,128x128}/apps
+    cp Installer/renoise-48.png $out/share/icons/hicolor/48x48/apps/renoise.png
+    cp Installer/renoise-64.png $out/share/icons/hicolor/64x64/apps/renoise.png
+    cp Installer/renoise-128.png $out/share/icons/hicolor/128x128/apps/renoise.png
   '';
 
   postFixup = ''
@@ -61,6 +71,9 @@ stdenv.mkDerivation rec {
         --set-rpath $out/lib \
         $path
     done
+
+    substituteInPlace $out/share/applications/renoise.desktop \
+      --replace Exec=renoise Exec=$out/bin/renoise
   '';
 
   meta = {

third_party/nixpkgs/pkgs/applications/audio/samplv1/default.nix

@@ -5,11 +5,11 @@
 
 mkDerivation rec {
   pname = "samplv1";
-  version = "0.9.18";
+  version = "0.9.20";
 
   src = fetchurl {
     url = "mirror://sourceforge/samplv1/${pname}-${version}.tar.gz";
-    sha256 = "ePhM9OTLJp1Wa2D9Y1Dqq/69WlEhEp3ih9yNUIJU5Y4=";
+    sha256 = "sha256-9tm72lV9i/155TVweNwO2jpPsCJkh6r82g7Z1wCI1ho=";
   };
 
   nativeBuildInputs = [ qttools pkg-config ];

third_party/nixpkgs/pkgs/applications/audio/strawberry/default.nix

@@ -35,13 +35,13 @@
 
 mkDerivation rec {
   pname = "strawberry";
-  version = "0.8.5";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    sha256 = "sha256-+ZQ80J94Teqt4Gy6fw/pS7FwILK/TPehtJDy72Bdy1E=";
+    sha256 = "sha256-1aXHMvjLK5WiE0mut/a3ynuMfNHgPbUzAZdmaVJBDXQ=";
   };
 
   buildInputs = [

third_party/nixpkgs/pkgs/applications/audio/sunvox/default.nix

@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     sha256 = "0lqzr68n2c6aifw2vbyars91wn1chmgb9xfdk463g4vjqiava3ih";
   };
 
-  buildInputs = [ unzip ];
+  nativeBuildInputs = [ unzip ];
 
   unpackPhase = "unzip $src";
 
@@ -44,5 +44,7 @@ stdenv.mkDerivation rec {
     homepage = "http://www.warmplace.ru/soft/sunvox/";
     maintainers = with maintainers; [ puffnfresh ];
     platforms = [ "i686-linux" "x86_64-linux" ];
+    # hash mismatch
+    broken = true;
   };
 }

third_party/nixpkgs/pkgs/applications/audio/surge/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "surge";
-  version = "1.7.1";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "surge-synthesizer";
     repo = pname;
     rev = "release_${version}";
-    sha256 = "1b3ccc78vrpzy18w7070zfa250dnd1bww147xxcnj457vd6n065s";
+    sha256 = "0lla860g7zgn9n1zgy14g4j72d5n5y7isyxz2w5xy2fzdpdg24ql";
     leaveDotGit = true; # for SURGE_VERSION
     fetchSubmodules = true;
   };
@@ -20,9 +20,10 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace src/common/SurgeStorage.cpp --replace "/usr/share/Surge" "$out/share/surge"
-    substituteInPlace src/common/gui/PopupEditorDialog.cpp --replace '"zenity' '"${zenity}/bin/zenity'
     substituteInPlace src/linux/UserInteractionsLinux.cpp --replace '"zenity' '"${zenity}/bin/zenity'
     substituteInPlace vstgui.surge/vstgui/lib/platform/linux/x11fileselector.cpp --replace /usr/bin/zenity ${zenity}/bin/zenity
+    patchShebangs scripts/linux/emit-vector-piggy
+    patchShebangs scripts/linux/generate-lv2-ttl
   '';
 
   installPhase = ''

third_party/nixpkgs/pkgs/applications/blockchains/ledger-live-desktop/default.nix

@@ -2,12 +2,12 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.23.0";
+  version = "2.24.0";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/LedgerHQ/${pname}/releases/download/v${version}/${pname}-${version}-linux-x86_64.AppImage";
-    sha256 = "0id9zbpfq3knv8qwkhplbl9pwrvdkn212pafwh4vpjbbp4yimhq5";
+    sha256 = "1xdqj825vwh3kg35v7568zr1jhvldb4wcazzgzcaawkr4qzfdb2n";
   };
 
   appimageContents = appimageTools.extractType2 {

third_party/nixpkgs/pkgs/applications/blockchains/monero-gui/default.nix

@@ -10,15 +10,13 @@
 , randomx, zeromq, libgcrypt, libgpgerror
 , hidapi, rapidjson, quirc
 , trezorSupport ? true
-,   libusb1  ? null
+,   libusb1
-,   protobuf ? null
+,   protobuf
-,   python3  ? null
+,   python3
 }:
 
 with lib;
 
-assert trezorSupport -> all (x: x!=null) [ libusb1 protobuf python3 ];
-
 let
   arch = if stdenv.isx86_64  then "x86-64"
     else if stdenv.isi686    then "i686"

third_party/nixpkgs/pkgs/applications/editors/android-studio/common.nix

@@ -65,9 +65,9 @@ let
       sha256 = sha256Hash;
     };
 
+    nativeBuildInputs = [ unzip ];
     buildInputs = [
       makeWrapper
-      unzip
     ];
     installPhase = ''
       cp -r . $out

third_party/nixpkgs/pkgs/applications/editors/android-studio/default.nix

@@ -9,18 +9,18 @@ let
     inherit buildFHSUserEnv;
   };
   stableVersion = {
-    version = "4.1.2.0"; # "Android Studio 4.1.2"
+    version = "4.1.3.0"; # "Android Studio 4.1.3"
-    build = "201.7042882";
+    build = "201.7199119";
-    sha256Hash = "1f9bclvyvm3sg9an7wxlfwd8jwnb9cl726dvggmysa6r7shc7xw9";
+    sha256Hash = "06xwgk7bwcmljka8xa56cfwwg858r0bl0xp2jb9hdnkwljf796gm";
   };
   betaVersion = {
-    version = "4.2.0.21"; # "Android Studio 4.2 Beta 5"
+    version = "4.2.0.22"; # "Android Studio 4.2 Beta 6"
-    build = "202.7141121";
+    build = "202.7188722";
-    sha256Hash = "05610xf9zz3yxarx6fv83fynlvqw9jl7h2a40yj3xx5kb7mzdnf2";
+    sha256Hash = "0mzwkx1csx194wzg7dc1cii3c16wbmlbq1jdv9ly4nmdxlvc2rxb";
   };
   latestVersion = { # canary & dev
-    version = "2020.3.1.7"; # "Android Studio Arctic Fox (2020.3.1) Canary 7"
+    version = "2020.3.1.10"; # "Android Studio Arctic Fox (2020.3.1) Canary 10"
-    sha256Hash = "03gq4s8rmg7si0r2y1w26v9bjwhj6gzmrdny5z3j5pq8xsfjfqiw";
+    sha256Hash = "15xxyjjjy5pnimc66dcwnqb7z4lq7ll4fl401a3br5ca4d1hpgsj";
   };
 in {
   # Attributes are named by their corresponding release channels

third_party/nixpkgs/pkgs/applications/editors/edit/default.nix

@@ -2,39 +2,39 @@
 
 stdenv.mkDerivation {
   pname = "edit-nightly";
-  version = "20160425";
+  version = "20180228";
 
   src = fetchgit {
     url = "git://c9x.me/ed.git";
-    rev = "323d49b68c5e804ed3b8cada0e2274f1589b3484";
+    rev = "77d96145b163d79186c722a7ffccfff57601157c";
-    sha256 = "0wv8i3ii7cd9bqhjpahwp2g5fcmyk365nc7ncmvl79cxbz3f7y8v";
+    sha256 = "0rsmp7ydmrq3xx5q19566is9a2v2w5yfsphivfc7j4ljp32jlyyy";
   };
 
-  buildInputs = [
+  nativeBuildInputs = [
-     unzip
+    unzip
-     pkg-config
+    pkg-config
-     ncurses
+    cwebbin
-     libX11
-     libXft
-     cwebbin
   ];
 
-  buildPhase = ''
+  buildInputs = [
+    ncurses
+    libX11
+    libXft
+  ];
+
+  preBuild = ''
     ctangle *.w
-    make
   '';
 
   installPhase = ''
-    mkdir -p $out/bin/
+    install -Dm755 obj/edit -t $out/bin
-    cp obj/edit $out/bin/edit
   '';
 
   meta = with lib; {
     description = "A relaxing mix of Vi and ACME";
-    homepage = "http://c9x.me/edit";
+    homepage = "https://c9x.me/edit";
     license = licenses.publicDomain;
     maintainers = [ maintainers.vrthra ];
-    platforms = platforms.linux;
+    platforms = platforms.all;
   };
 }
-

third_party/nixpkgs/pkgs/applications/editors/fte/default.nix

@@ -3,7 +3,8 @@
 stdenv.mkDerivation rec {
   name = "fte-0.50.02";
 
-  buildInputs = [ unzip perl libX11 libXpm gpm ncurses slang ];
+  nativeBuildInputs = [ unzip ];
+  buildInputs = [ perl libX11 libXpm gpm ncurses slang ];
 
   ftesrc = fetchurl {
     url = "mirror://sourceforge/fte/fte-20110708-src.zip";

third_party/nixpkgs/pkgs/applications/editors/jetbrains/default.nix

@@ -337,7 +337,7 @@ in
     name = "mps-${version}";
     version = "2020.3.1"; /* updated by script */
     description = "Create your own domain-specific language";
-    license = lib.licenses.unfree;
+    license = lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/mps/2020.3/MPS-${version}.tar.gz";
       sha256 = "0qvl724mm53rxfhafl6561rhpwppcadmwr9sh0hpsfgsprh2xznv"; /* updated by script */

third_party/nixpkgs/pkgs/applications/editors/jetbrains/update.pl

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i perl -p perl perlPackages.LWPProtocolhttps perlPackages.FileSlurp
+#!nix-shell -i perl -p perl perlPackages.LWPProtocolHttps perlPackages.FileSlurp
 
 use strict;
 use List::Util qw(reduce);

third_party/nixpkgs/pkgs/applications/editors/monodevelop/default.nix

@@ -34,10 +34,10 @@ stdenv.mkDerivation rec {
   patchFlags = [ "-p2" ];
   patches = [ ./git-revert-12d610fb3f6dce121df538e36f21d8c2eeb0a6e3.patch ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config unzip ];
   buildInputs = [
     autoconf automake shared-mime-info intltool
-    mono gtk-sharp-2_0 gnome-sharp unzip
+    mono gtk-sharp-2_0 gnome-sharp
     dotnetPackages.NUnit
     dotnetPackages.NUnitRunners
     dotnetPackages.Nuget

third_party/nixpkgs/pkgs/applications/editors/netbeans/default.nix

@@ -56,8 +56,8 @@ stdenv.mkDerivation {
     ln -s ${desktopItem}/share/applications/* $out/share/applications
   '';
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper unzip ];
-  buildInputs = [ perl python unzip libicns imagemagick ];
+  buildInputs = [ perl python libicns imagemagick ];
 
   meta = {
     description = "An integrated development environment for Java, C, C++ and PHP";

third_party/nixpkgs/pkgs/applications/editors/textadept/10/default.nix

@@ -4,9 +4,9 @@ stdenv.mkDerivation rec {
   version = "10.8";
   pname = "textadept";
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config unzip ];
   buildInputs = [
-    gtk2 ncurses glib unzip zip
+    gtk2 ncurses glib zip
   ];
 
   src = fetchhg {

third_party/nixpkgs/pkgs/applications/editors/textadept/11/default.nix

@@ -4,9 +4,9 @@ stdenv.mkDerivation rec {
   version = "11.0_beta";
   pname = "textadept11";
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config unzip ];
   buildInputs = [
-    gtk2 ncurses glib unzip zip
+    gtk2 ncurses glib zip
   ];
 
   src = fetchFromGitHub {

third_party/nixpkgs/pkgs/applications/editors/vscode/generic.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, makeDesktopItem
-, unzip, libsecret, libXScrnSaver, wrapGAppsHook
+, unzip, libsecret, libXScrnSaver, libxshmfence, wrapGAppsHook
 , gtk2, atomEnv, at-spi2-atk, autoPatchelfHook
 , systemd, fontconfig, libdbusmenu
 
@@ -60,14 +60,12 @@ in
       '';
     };
 
-    buildInputs = (if stdenv.isDarwin
+    buildInputs = [ libsecret libXScrnSaver libxshmfence ]
-      then [ unzip ]
+      ++ lib.optionals (!stdenv.isDarwin) ([ gtk2 at-spi2-atk wrapGAppsHook ] ++ atomEnv.packages);
-      else [ gtk2 at-spi2-atk wrapGAppsHook ] ++ atomEnv.packages)
-        ++ [ libsecret libXScrnSaver ];
 
     runtimeDependencies = lib.optional (stdenv.isLinux) [ (lib.getLib systemd) fontconfig.lib libdbusmenu ];
 
-    nativeBuildInputs = lib.optional (!stdenv.isDarwin) autoPatchelfHook;
+    nativeBuildInputs = [unzip] ++ lib.optional (!stdenv.isDarwin) autoPatchelfHook;
 
     dontBuild = true;
     dontConfigure = true;

third_party/nixpkgs/pkgs/applications/graphics/avocode/default.nix

@@ -58,8 +58,8 @@ stdenv.mkDerivation rec {
     comment = "The bridge between designers and developers";
   };
 
-  nativeBuildInputs = [makeWrapper wrapGAppsHook];
+  nativeBuildInputs = [makeWrapper wrapGAppsHook unzip];
-  buildInputs = [ unzip gtk3 gnome3.adwaita-icon-theme ];
+  buildInputs = [ gtk3 gnome3.adwaita-icon-theme ];
 
   # src is producing multiple folder on unzip so we must
   # override unpackCmd to extract it into newly created folder

third_party/nixpkgs/pkgs/applications/graphics/fondo/default.nix

@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fondo";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "calo001";
     repo = pname;
     rev = version;
-    sha256 = "sha256-eGHgZm9Q6JnY6OQNAyrFvRsuyuFnruMJNckOCCiO4Ug=";
+    sha256 = "sha256-EATZRmYSGUzWYaPqFT4mLTGGvwUp+Mn93yMF2JsPaYo=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/graphics/freecad/default.nix

@@ -1,48 +1,114 @@
-{ lib, mkDerivation, fetchFromGitHub, fetchpatch, cmake, ninja, coin3d,
+{ lib
-xercesc, ode, eigen, qtbase, qttools, qtwebengine, qtxmlpatterns, wrapQtAppsHook,
+, mkDerivation
-opencascade-occt, gts, hdf5, vtk, medfile, zlib, python3Packages, swig,
+, fetchFromGitHub
-gfortran, libXmu, soqt, libf2c, libGLU, makeWrapper, pkg-config, mpi,
+, fetchpatch
-spaceNavSupport ? true, libspnav, qtx11extras }:
+, cmake
+, ninja
+, GitPython
+, boost
+, coin3d
+, eigen
+, gfortran
+, gts
+, hdf5
+, libGLU
+, libXmu
+, libf2c
+, libspnav
+, matplotlib
+, medfile
+, mpi
+, ode
+, opencascade-occt
+, pivy
+, pkg-config
+, pycollada
+, pyside2
+, pyside2-tools
+, python
+, pyyaml
+, qtbase
+, qttools
+, qtwebengine
+, qtx11extras
+, qtxmlpatterns
+, scipy
+, shiboken2
+, soqt
+, spaceNavSupport ? true
+, swig
+, vtk
+, wrapQtAppsHook
+, xercesc
+, zlib
+}:
 
-let
+mkDerivation rec {
-  pythonPackages = python3Packages;
+  pname = "freecad";
-in mkDerivation rec {
+  version = "0.19.1";
-  pname = "freecad-unstable";
-  version = "2020-12-08";
 
   src = fetchFromGitHub {
     owner = "FreeCAD";
     repo = "FreeCAD";
-    rev = "daea30341ea2d5eaf2bfb65614128a5fa2abc8b7";
+    rev = version;
-    sha256 = "1fza64lygqq35v7kzgqmiq5dvl5rpgkhlzv06f9dszdz44hznina";
+    hash = "sha256-itIrO+/mKXOPNs+2POKT8u4YZuqx/QAwVBWrHgKP1qQ=";
   };
 
   nativeBuildInputs = [
     cmake
     ninja
     pkg-config
-    pythonPackages.pyside2-tools
+    pyside2-tools
     wrapQtAppsHook
   ];
 
   buildInputs = [
-    coin3d xercesc ode eigen opencascade-occt gts
-    zlib swig gfortran soqt libf2c makeWrapper mpi vtk hdf5 medfile
-    libGLU libXmu qtbase qttools qtwebengine qtxmlpatterns
-  ] ++ (with pythonPackages; [
-    matplotlib pycollada shiboken2 pyside2 pyside2-tools pivy python boost
     GitPython # for addon manager
-    scipy pyyaml # (at least for) PyrateWorkbench
+    boost
-  ]) ++ lib.optionals spaceNavSupport [ libspnav qtx11extras ];
+    coin3d
+    eigen
+    gfortran
+    gts
+    hdf5
+    libGLU
+    libXmu
+    libf2c
+    matplotlib
+    medfile
+    mpi
+    ode
+    opencascade-occt
+    pivy
+    pycollada
+    pyside2
+    pyside2-tools
+    python
+    pyyaml # (at least for) PyrateWorkbench
+    qtbase
+    qttools
+    qtwebengine
+    qtxmlpatterns
+    scipy
+    shiboken2
+    soqt
+    swig
+    vtk
+    xercesc
+    zlib
+  ] ++ lib.optionals spaceNavSupport [
+    libspnav
+    qtx11extras
+  ];
 
   cmakeFlags = [
+    "-DBUILD_FLAT_MESH:BOOL=ON"
     "-DBUILD_QT5=ON"
-    "-DSHIBOKEN_INCLUDE_DIR=${pythonPackages.shiboken2}/include"
+    "-DSHIBOKEN_INCLUDE_DIR=${shiboken2}/include"
     "-DSHIBOKEN_LIBRARY=Shiboken2::libshiboken"
-    ("-DPYSIDE_INCLUDE_DIR=${pythonPackages.pyside2}/include"
+    ("-DPYSIDE_INCLUDE_DIR=${pyside2}/include"
-      + ";${pythonPackages.pyside2}/include/PySide2/QtCore"
+      + ";${pyside2}/include/PySide2/QtCore"
-      + ";${pythonPackages.pyside2}/include/PySide2/QtWidgets"
+      + ";${pyside2}/include/PySide2/QtWidgets"
-      + ";${pythonPackages.pyside2}/include/PySide2/QtGui"
+      + ";${pyside2}/include/PySide2/QtGui"
       )
     "-DPYSIDE_LIBRARY=PySide2::pyside2"
   ];
@@ -65,13 +131,31 @@ in mkDerivation rec {
 
   postFixup = ''
     mv $out/share/doc $out
+    ln -s $out/bin/FreeCAD $out/bin/freecad
+    ln -s $out/bin/FreeCADCmd $out/bin/freecadcmd
   '';
 
   meta = with lib; {
-    description = "General purpose Open Source 3D CAD/MCAD/CAx/CAE/PLM modeler";
     homepage = "https://www.freecadweb.org/";
+    description = "General purpose Open Source 3D CAD/MCAD/CAx/CAE/PLM modeler";
+    longDescription = ''
+      FreeCAD is an open-source parametric 3D modeler made primarily to design
+      real-life objects of any size. Parametric modeling allows you to easily
+      modify your design by going back into your model history and changing its
+      parameters.
+
+      FreeCAD allows you to sketch geometry constrained 2D shapes and use them
+      as a base to build other objects. It contains many components to adjust
+      dimensions or extract design details from 3D models to create high quality
+      production ready drawings.
+
+      FreeCAD is designed to fit a wide range of uses including product design,
+      mechanical engineering and architecture. Whether you are a hobbyist, a
+      programmer, an experienced CAD user, a student or a teacher, you will feel
+      right at home with FreeCAD.
+    '';
     license = licenses.lgpl2Plus;
-    maintainers = with maintainers; [ viric gebner ];
+    maintainers = with maintainers; [ viric gebner AndersonTorres ];
     platforms = platforms.linux;
   };
 }

third_party/nixpkgs/pkgs/applications/graphics/gimp/default.nix

@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchurl
+, fetchpatch
 , substituteAll
 , autoreconfHook
 , pkg-config
@@ -72,6 +73,12 @@ in stdenv.mkDerivation rec {
     # Use absolute paths instead of relying on PATH
     # to make sure plug-ins are loaded by the correct interpreter.
     ./hardcode-plugin-interpreters.patch
+
+    # Fix crash without dot.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gimp/-/commit/f83fd22c4b8701ffc4ce14383e5e22756a4bce04.patch";
+      sha256 = "POuvBhOSStO7hBGp4HgNx5F9pElFRoqN3W+i3u4zOnk=";
+    })
   ];
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/graphics/imagej/default.nix

@@ -15,8 +15,7 @@ let
       url = "https://wsr.imagej.net/distros/cross-platform/ij150.zip";
       sha256 = "97aba6fc5eb908f5160243aebcdc4965726693cb1353d9c0d71b8f5dd832cb7b";
     };
-    nativeBuildInputs = [ makeWrapper ];
+    nativeBuildInputs = [ makeWrapper unzip ];
-    buildInputs = [ unzip ];
     inherit jre;
 
     # JAR files that are intended to be used by other packages

third_party/nixpkgs/pkgs/applications/graphics/leocad/default.nix

@@ -1,31 +1,53 @@
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, fetchurl
+, qmake
+, qttools
+, zlib
+}:
+
 /*
 To use aditional parts libraries
 set the variable LEOCAD_LIB=/path/to/libs/ or use option -l /path/to/libs/
 */
 
-{ lib, stdenv, fetchFromGitHub, qt4, qmake4Hook, zlib }:
+let
+  parts = fetchurl {
+    url = "https://web.archive.org/web/20190715142541/https://www.ldraw.org/library/updates/complete.zip";
+    sha256 = "sha256-PW3XCbFwRaNkx4EgCnl2rXH7QgmpNgjTi17kZ5bladA=";
+  };
 
-stdenv.mkDerivation rec {
+in
+mkDerivation rec {
   pname = "leocad";
-  version = "19.07.1";
+  version = "21.03";
 
   src = fetchFromGitHub {
     owner = "leozide";
     repo = "leocad";
     rev = "v${version}";
-    sha256 = "02kv1m18g6s4dady9jv4sjivfkrp192bmdw2a3d9lzlp60zks0p2";
+    sha256 = "sha256-69Ocfk5dBXwcRqAZWEP9Xg41o/tAQo76dIOk9oYhCUE=";
   };
 
-  nativeBuildInputs = [ qmake4Hook ];
+  nativeBuildInputs = [ qmake qttools ];
-  buildInputs = [ qt4 zlib ];
+
-  postPatch = ''
+  buildInputs = [ zlib ];
-    export qmakeFlags="$qmakeFlags INSTALL_PREFIX=$out"
+
-  '';
+  qmakeFlags = [
+    "INSTALL_PREFIX=${placeholder "out"}"
+    "DISABLE_UPDATE_CHECK=1"
+  ];
+
+  qtWrapperArgs = [
+    "--set-default LEOCAD_LIB ${parts}"
+  ];
 
   meta = with lib; {
     description = "CAD program for creating virtual LEGO models";
     homepage = "https://www.leocad.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ peterhoeg ];
     platforms = platforms.linux;
   };
 }

third_party/nixpkgs/pkgs/applications/graphics/zgrviewer/default.nix

@@ -6,7 +6,8 @@ stdenv.mkDerivation rec {
     url = "mirror://sourceforge/zvtm/${pname}/${version}/${pname}-${version}.zip";
     sha256 = "1yg2rck81sqqrgfi5kn6c1bz42dr7d0zqpcsdjhicssi1y159f23";
   };
-  buildInputs = [jre unzip];
+  nativeBuildInputs = [ unzip ];
+  buildInputs = [jre];
   buildPhase = "";
   installPhase = ''
     mkdir -p "$out"/{bin,share/java/zvtm/plugins,share/doc/zvtm}

third_party/nixpkgs/pkgs/applications/kde/fetch.sh

@@ -1 +1 @@
-WGET_ARGS=( http://download.kde.org/stable/release-service/20.12.1/src -A '*.tar.xz' )
+WGET_ARGS=( http://download.kde.org/stable/release-service/20.12.2/src -A '*.tar.xz' )

third_party/nixpkgs/pkgs/applications/misc/1password-gui/default.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "1password";
-  version = "8.0.27";
+  version = "8.0.28";
 
   src = fetchurl {
     url = "https://onepassword.s3.amazonaws.com/linux/appimage/${pname}-${version}.AppImage";
-    hash = "sha256-qzZXs7ak4052Igq+YWuzgDqJ7143q5qw5P3b3eN3NkU=";
+    hash = "sha256-okLeyok/5rihGXaQaUR06dGkpuqqW02qJ6q6VVLtZsE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

third_party/nixpkgs/pkgs/applications/misc/audio/soxr/arm64-check.patch

@@ -0,0 +1,79 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Misty De Meo <mistydemeo@gmail.com>
+Date: Tue, 15 Sep 2020 16:57:26 -0700
+Subject: [PATCH] Check for __arm64__, not just __arm__
+
+On at least one 64-bit ARM processor I've tested (Apple Silicon on macOS),
+__arm__ isn't defined but __arm64__ is. As a result, some of the
+ARM-specific macros are missing and calls to them fail.
+---
+ src/cr-core.c    | 2 +-
+ src/dev32s.h     | 2 +-
+ src/pffft-wrap.c | 2 +-
+ src/pffft.c      | 4 ++--
+ 4 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/src/cr-core.c b/src/cr-core.c
+index 159a5d9..fe5ea8a 100644
+--- a/src/cr-core.c
++++ b/src/cr-core.c
+@@ -80,7 +80,7 @@ static void cubic_stage_fn(stage_t * p, fifo_t * output_fifo)
+   #define DEFINED_X86 0
+ #endif
+ 
+-#if defined __arm__
++#if defined(__arm__) || defined(__arm64__)
+   #define DEFINED_ARM 1
+ #else
+   #define DEFINED_ARM 0
+diff --git a/src/dev32s.h b/src/dev32s.h
+index 7edae86..a14d7ad 100644
+--- a/src/dev32s.h
++++ b/src/dev32s.h
+@@ -31,7 +31,7 @@ SIMD_INLINE(void) vStorSum(float * a, v4_t b) {
+   v4_t t = vAdd(_mm_movehl_ps(b, b), b);
+   _mm_store_ss(a, vAdd(t, _mm_shuffle_ps(t,t,1)));}
+ 
+-#elif defined __arm__
++#elif defined(__arm__) || defined(__arm64__)
+ 
+ #include <arm_neon.h>
+ 
+diff --git a/src/pffft-wrap.c b/src/pffft-wrap.c
+index c920f06..1641fc4 100644
+--- a/src/pffft-wrap.c
++++ b/src/pffft-wrap.c
+@@ -40,7 +40,7 @@ static void pffft_zconvolve(PFFFT_Setup *s, const float *a, const float *b, floa
+ 
+   float ar, ai, br, bi;
+ 
+-#ifdef __arm__
++#if defined(__arm__) || defined(__arm64__)
+   __builtin_prefetch(va);
+   __builtin_prefetch(vb);
+   __builtin_prefetch(va+2);
+diff --git a/src/pffft.c b/src/pffft.c
+index 46c841e..8c775a9 100644
+--- a/src/pffft.c
++++ b/src/pffft.c
+@@ -157,7 +157,7 @@ typedef __m128 v4sf;
+ /*
+   ARM NEON support macros
+ */
+-#elif !defined(PFFFT_SIMD_DISABLE) && defined(__arm__)
++#elif !defined(PFFFT_SIMD_DISABLE) && (defined(__arm__) || defined(__arm64__))
+ #  include <arm_neon.h>
+ typedef float32x4_t v4sf;
+ #  define SIMD_SZ 4
+@@ -1732,7 +1732,7 @@ void pffft_zconvolve_accumulate(PFFFT_Setup *s, const float *a, const float *b,
+   const v4sf * RESTRICT vb = (const v4sf*)b;
+   v4sf * RESTRICT vab = (v4sf*)ab;
+ 
+-#ifdef __arm__
++#if defined(__arm__) || defined(__arm64__)
+   __builtin_prefetch(va);
+   __builtin_prefetch(vb);
+   __builtin_prefetch(vab);
+-- 
+2.30.1
+

third_party/nixpkgs/pkgs/applications/misc/audio/soxr/default.nix

@@ -8,6 +8,11 @@ stdenv.mkDerivation rec {
     sha256 = "12aql6svkplxq5fjycar18863hcq84c5kx8g6f4rj0lcvigw24di";
   };
 
+  patches = [
+    # Remove once https://sourceforge.net/p/soxr/code/merge-requests/5/ is merged.
+    ./arm64-check.patch
+  ];
+
   outputs = [ "out" "doc" ]; # headers are just two and very small
 
   preConfigure = if stdenv.isDarwin then ''

third_party/nixpkgs/pkgs/applications/misc/avrdudess/default.nix

@@ -8,7 +8,7 @@ stdenv.mkDerivation {
     sha256 = "18llpvjsfhypzijrvfbzmcg3g141f307mzsrg11wcdxh9syxqak6";
   };
 
-  buildInputs = [ unzip ];
+  nativeBuildInputs = [ unzip ];
 
   phases = [ "buildPhase" ];
 

third_party/nixpkgs/pkgs/applications/misc/bemenu/default.nix

@@ -2,12 +2,12 @@
 , pango, fribidi, harfbuzz, pcre, pkg-config
 , ncursesSupport ? true, ncurses ? null
 , waylandSupport ? true, wayland ? null, wayland-protocols ? null
-, x11Support ? true, xlibs ? null, xorg ? null
+, x11Support ? true, xorg ? null
 }:
 
 assert ncursesSupport -> ncurses != null;
 assert waylandSupport -> ! lib.elem null [wayland wayland-protocols];
-assert x11Support -> xlibs != null && xorg != null;
+assert x11Support -> xorg != null;
 
 stdenv.mkDerivation rec {
   pname = "bemenu";
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
   ] ++ optional ncursesSupport ncurses
     ++ optionals waylandSupport [ wayland wayland-protocols ]
     ++ optionals x11Support [
-      xlibs.libX11 xlibs.libXinerama xlibs.libXft
+      xorg.libX11 xorg.libXinerama xorg.libXft
       xorg.libXdmcp xorg.libpthreadstubs xorg.libxcb
     ];
 

third_party/nixpkgs/pkgs/applications/misc/birdtray/default.nix

@@ -36,11 +36,15 @@ mkDerivation rec {
       --subst-var-by qttranslations ${qttranslations}
   '';
 
+  # Wayland support is broken.
+  # https://github.com/gyunaev/birdtray/issues/113#issuecomment-621742315
+  qtWrapperArgs = [ "--set QT_QPA_PLATFORM xcb" ];
+
   meta = with lib; {
     description = "Mail system tray notification icon for Thunderbird";
     homepage = "https://github.com/gyunaev/birdtray";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ Flakebi ];
+    maintainers = with maintainers; [ Flakebi oxalica ];
     platforms = platforms.linux;
   };
 }

third_party/nixpkgs/pkgs/applications/misc/extract_url/default.nix

@@ -5,7 +5,7 @@
 
 let
   perlDeps =
-    [ perlPackages.MIMEtools perlPackages.HTMLParser ]
+    [ perlPackages.MIMETools perlPackages.HTMLParser ]
     ++ lib.optional cursesSupport perlPackages.CursesUI
     ++ lib.optional uriFindSupport perlPackages.URIFind;
 

third_party/nixpkgs/pkgs/applications/misc/gcstar/default.nix

@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     JSON
     ImageExifTool
     librelative
-    LWPUserAgent
+    LWP
     LWPProtocolHttps
     MP3Info
     MP3Tag

third_party/nixpkgs/pkgs/applications/misc/jrnl/default.nix

@@ -18,14 +18,14 @@
 
 buildPythonApplication rec {
   pname = "jrnl";
-  version = "2.7";
+  version = "2.7.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "jrnl-org";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1hyjjw9mxy73n3pkliaaif135h2sd4iy43pw9d5zynid5abnr3yz";
+    sha256 = "1m1shgnvwzzs0g6ph7rprwxd7w8zj0x4sbgiqsv9z41k6li7xj4r";
   };
 
   nativeBuildInputs = [ poetry ];

third_party/nixpkgs/pkgs/applications/misc/kdbplus/default.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   };
 
   dontStrip = true;
-  buildInputs = [ unzip ];
+  nativeBuildInputs = [ unzip ];
 
   phases = "unpackPhase installPhase";
   unpackPhase = "mkdir ${pname}-${version} && cd ${pname}-${version} && unzip -qq ${src}";

third_party/nixpkgs/pkgs/applications/misc/keepass/default.nix

@@ -12,8 +12,8 @@ with builtins; buildDotnetPackage rec {
 
   sourceRoot = ".";
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper unzip ];
-  buildInputs = [ unzip icoutils ];
+  buildInputs = [ icoutils ];
 
   patches = [
     (substituteAll {

third_party/nixpkgs/pkgs/applications/misc/lyx/default.nix

@@ -3,12 +3,12 @@
 }:
 
 mkDerivation rec {
-  version = "2.3.6";
+  version = "2.3.6.1";
   pname = "lyx";
 
   src = fetchurl {
     url = "ftp://ftp.lyx.org/pub/lyx/stable/2.3.x/${pname}-${version}.tar.xz";
-    sha256 = "160whjwwrmxizdakjlkf9xc86bhqfnslw47fixgqq4qhbapcxxkg";
+    sha256 = "sha256-xr7SYzQZiY4Bp8w1AxDX2TS/WRyrcln8JYGqTADq+ng=";
   };
 
   # LaTeX is used from $PATH, as people often want to have it with extra pkgs

third_party/nixpkgs/pkgs/applications/misc/marktext/default.nix

@@ -25,7 +25,7 @@ appimageTools.wrapType2 rec {
   multiPkgs = null; # no 32bit needed
   extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [
     p.libsecret
-    p.xlibs.libxkbfile
+    p.xorg.libxkbfile
   ];
 
   # Strip version from binary name.

third_party/nixpkgs/pkgs/applications/misc/megasync/default.nix

@@ -38,7 +38,7 @@ mkDerivation rec {
   };
 
   nativeBuildInputs =
-    [ autoconf automake doxygen lsb-release pkg-config qttools swig ];
+    [ autoconf automake doxygen lsb-release pkg-config qttools swig unzip ];
   buildInputs = [
     c-ares
     cryptopp
@@ -53,7 +53,6 @@ mkDerivation rec {
     qtbase
     qtx11extras
     sqlite
-    unzip
     wget
   ];
 

third_party/nixpkgs/pkgs/applications/misc/metadata-cleaner/default.nix

@@ -0,0 +1,61 @@
+{ lib
+, python3
+, fetchFromGitLab
+, appstream
+, desktop-file-utils
+, glib
+, gobject-introspection
+, gtk3
+, libhandy
+, librsvg
+, meson
+, ninja
+, pkg-config
+, poppler_gi
+, wrapGAppsHook
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "metadata-cleaner";
+  version = "1.0.3";
+
+  format = "other";
+
+  src = fetchFromGitLab {
+    owner = "rmnvgr";
+    repo = "metadata-cleaner";
+    rev = "v${version}";
+    sha256 = "06dzfcnjb1xd8lk0r7bi4i784gfj8r7habbjbk2c4vn2847v71lf";
+  };
+
+  nativeBuildInputs = [
+    appstream
+    desktop-file-utils
+    glib
+    gtk3
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gobject-introspection
+    gtk3
+    libhandy
+    librsvg
+    poppler_gi
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    mat2
+    pygobject3
+  ];
+
+  meta = with lib; {
+    description = "Python GTK application to view and clean metadata in files, using mat2";
+    homepage = "https://gitlab.com/rmnvgr/metadata-cleaner";
+    license = with licenses; [ gpl3Plus cc-by-sa-40 ];
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}

third_party/nixpkgs/pkgs/applications/misc/milu/default.nix

@@ -22,10 +22,9 @@ stdenv.mkDerivation {
     cp bin/milu $out/bin
   '';
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ pkg-config unzip ];
   buildInputs = [
      glib
-     unzip
      llvmPackages.libclang
   ];
 

third_party/nixpkgs/pkgs/applications/misc/nnn/default.nix

@@ -7,13 +7,13 @@ assert withNerdIcons -> withIcons == false;
 
 stdenv.mkDerivation rec {
   pname = "nnn";
-  version = "3.5";
+  version = "3.6";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1fa7cmwrzn6kx87kms8i98p9azdlwyh2gnif29l340syl9hkr5qy";
+    sha256 = "1hwv7ncp8pmzdir30877ni4qlmczmb3yjdkbfd1pssr08y1srsc7";
   };
 
   configFile = lib.optionalString (conf != null) (builtins.toFile "nnn.h" conf);
@@ -22,10 +22,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ readline ncurses ];
 
-  makeFlags = [
+  makeFlags = [ "PREFIX=$(out)" ]
-    "DESTDIR=${placeholder "out"}"
+    ++ lib.optional withIcons [ "O_ICONS=1" ]
-    "PREFIX="
-  ] ++ lib.optional withIcons [ "O_ICONS=1" ]
     ++ lib.optional withNerdIcons [ "O_NERD=1" ];
 
   # shell completions
@@ -38,6 +36,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Small ncurses-based file browser forked from noice";
     homepage = "https://github.com/jarun/nnn";
+    changelog = "https://github.com/jarun/nnn/blob/v${version}/CHANGELOG";
     license = licenses.bsd2;
     platforms = platforms.all;
     maintainers = with maintainers; [ jfrankenau Br1ght0ne ];

third_party/nixpkgs/pkgs/applications/misc/omegat.nix

@@ -9,8 +9,7 @@ stdenv.mkDerivation {
     sha256 = "0axz7r30p34z5hgvdglznc82g7yvm3g56dv5190jixskx6ba58rs";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper unzip ];
-  buildInputs = [ unzip ];
 
   unpackCmd = "unzip -o $curSrc";  # tries to go interactive without -o
 

third_party/nixpkgs/pkgs/applications/misc/openjump/default.nix

@@ -18,8 +18,7 @@ stdenv.mkDerivation {
     cd $out; unzip $src
   '';
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper unzip ];
-  buildInputs = [ unzip ];
 
   installPhase = ''
     dir=$(echo $out/OpenJUMP-*)

third_party/nixpkgs/pkgs/applications/misc/pdfslicer/default.nix

@@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, gettext
+, intltool
+, pkg-config
+, wrapGAppsHook
+, gtkmm3
+, libuuid
+, poppler
+, qpdf
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pdfslicer";
+  version = "1.8.8";
+
+  src = fetchFromGitHub {
+    owner = "junrrein";
+    repo = "pdfslicer";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "0sja0ddd9c8wjjpzk2ag8q1lxpj09adgmhd7wnsylincqnj2jyls";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    gettext
+    intltool
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtkmm3
+    libuuid
+    poppler
+    qpdf
+  ];
+
+  meta = with lib; {
+    description = "A simple application to extract, merge, rotate and reorder pages of PDF documents";
+    homepage = "https://junrrein.github.io/pdfslicer/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}

third_party/nixpkgs/pkgs/applications/misc/qcad/default.nix

@@ -15,16 +15,17 @@
 
 mkDerivationWith stdenv.mkDerivation rec {
   pname = "qcad";
-  version = "3.25.2.0";
+  version = "3.26.0.1";
 
   src = fetchFromGitHub {
     owner = "qcad";
     repo = "qcad";
     rev = "v${version}";
-    sha256 = "1lz6q9n2p0l7k8rwqsdj6av9p3426423g5avc4y6s7nbk36280mz";
+    sha256 = "sha256-V+QlwM8BWmcarwZtqJfc+MYHOZgIH1W5R8m2EHhNJls=";
   };
 
   patches = [
+    # Patch directory lookup, remove __DATE__ and executable name
     ./application-dir.patch
   ];
 
@@ -90,12 +91,10 @@ mkDerivationWith stdenv.mkDerivation rec {
     qttools
   ];
 
-  enableParallelBuilding = true;
-
   meta = with lib; {
     description = "2D CAD package based on Qt";
     homepage = "https://qcad.org";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
     maintainers = with maintainers; [ yvesf ];
     platforms = qtbase.meta.platforms;
   };

third_party/nixpkgs/pkgs/applications/misc/reddsaver/default.nix

@@ -8,22 +8,22 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reddsaver";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "manojkarthick";
     repo = "reddsaver";
     rev = "v${version}";
-    sha256 = "0kww3abgvxr7azr7yb8aiw28fz13qb4sn3x7nnz1ihmd4yczi9fg";
+    sha256 = "0ffci3as50f55n1v36hji4n0b3lkch5ylc75awjz65jz2gd2y2j4";
   };
 
-  cargoSha256 = "09xm22vgmd3dc0wr6n3jczxvhwpcsijwfbv50dz1lnsx57g8mgmd";
+  cargoSha256 = "1cx3sqr7zb1vlfdvbcxp0yva9xh654qczpy8s09c8cviy8hac5sr";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ]
     ++ lib.optional stdenv.isDarwin Security;
 
-  # package does not contain tests as of v0.3.1
+  # package does not contain tests as of v0.3.2
   docCheck = false;
 
   meta = with lib; {

third_party/nixpkgs/pkgs/applications/misc/regextester/default.nix

@@ -6,7 +6,7 @@
 , pkg-config
 , glib
 , gtk3
-, gnome3
+, libgee
 , meson
 , ninja
 , gobject-introspection
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     pantheon.elementary-icon-theme
     pantheon.granite
     glib
-    gnome3.libgee
+    libgee
     gsettings-desktop-schemas
     gtk3
   ];

third_party/nixpkgs/pkgs/applications/misc/tickrs/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tickrs";
-  version = "0.14.2";
+  version = "0.14.3";
 
   src = fetchFromGitHub {
     owner = "tarkah";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8m4mIXTqc6rDMIjODbHJL7ipH5Y4WwgsWcSmw/SaiIo=";
+    sha256 = "sha256-mHMBhYI9pJkuK/6tCg1fXPjTfGFe0gkMzplesuFvl5M=";
   };
 
-  cargoSha256 = "sha256-ZcRFQT2CxqpO35UqK79g2Jq5SPOLZ88WiG36issC5kY=";
+  cargoSha256 = "sha256-XmLobbVTYO8dA8YVtI/ntlD1RB9sO3poP6NBdDOPIlE=";
 
   nativeBuildInputs = [ perl ];
 

third_party/nixpkgs/pkgs/applications/misc/zathura/pdf-mupdf/default.nix

@@ -6,7 +6,7 @@
 , jbig2dec
 , libjpeg
 , mupdf
-, openjpeg_2
+, openjpeg
 , pkg-config
 , zathura_core
 }:
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     jbig2dec
     libjpeg
     mupdf
-    openjpeg_2
+    openjpeg
     zathura_core
   ] ++ lib.optional stdenv.isDarwin gtk-mac-integration;
 

third_party/nixpkgs/pkgs/applications/networking/browsers/brave/default.nix

@@ -90,11 +90,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.21.76";
+  version = "1.21.77";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "JFZaPS9NmwZeyEdDqOrKG9VEQP7wIyqkR/Sk44GVxps=";
+    sha256 = "Q7paeGAvdmc4+FP28ASLlJhN1ui7M5fDpxnrh+gbEm4=";
   };
 
   dontConfigure = true;

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/browser.nix

@@ -89,5 +89,6 @@ mkChromiumDerivation (base: rec {
       then ["aarch64-linux" "x86_64-linux"]
       else [];
     timeout = 172800; # 48 hours (increased from the Hydra default of 10h)
+    broken = elem channel [ "beta" "dev" ]; # Build requires LLVM 12
   };
 })

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -18,9 +18,9 @@
     }
   },
   "beta": {
-    "version": "90.0.4430.19",
+    "version": "90.0.4430.30",
-    "sha256": "174isyx4g62d8ggn9imp41dfklcbxi3y5nfprm4jbjmn5cb7v8xa",
+    "sha256": "01b6naziii72pvw35wphfqz3inih75is038yf1mdp1847jbvxpwp",
-    "sha256bin64": "0z665iykdsmjrjbijsrcq80y2anvcfykasznf8w4brg9l9k59wv8",
+    "sha256bin64": "0k48mfzmyjb0w75fkm2j7ll340qgmzvmskz12awc2l19hgnw1s8p",
     "deps": {
       "gn": {
         "version": "2021-02-09",
@@ -31,15 +31,15 @@
     }
   },
   "dev": {
-    "version": "91.0.4442.4",
+    "version": "91.0.4449.6",
-    "sha256": "0cmm2pimkghb6s956bkqf2k77lj69dz51nlydgkqbvw0sc8n784k",
+    "sha256": "1y6z7p64fi4dxyrxrnlmg0wwczgw58cinrsywhnrpl2wp2y3v6m3",
-    "sha256bin64": "1hbfx8n51p7dwwz1vbp94jdmlb96vvxrbql2af4kmvx1bmzr2ism",
+    "sha256bin64": "1baxra0hg981awinyyvm1x46rlskjmhs2m1h0zf72l11y1jyj5vc",
     "deps": {
       "gn": {
-        "version": "2021-02-09",
+        "version": "2021-03-12",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "dfcbc6fed0a8352696f92d67ccad54048ad182b3",
+        "rev": "64b3b9401c1c3ed5f3c43c1cac00b91f83597ab8",
-        "sha256": "1941bzg37c4dpsk3sh6ga3696gpq6vjzpcw9rsnf6kdr9mcgdxvn"
+        "sha256": "14whk4gyx21cqxy1560xm8p1mc1581dh9g7xy120g8vvcylknjlm"
       }
     }
   },

third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/common.nix

@@ -161,7 +161,7 @@ buildStdenv.mkDerivation ({
     xorg.libX11 xorg.libXrender xorg.libXft xorg.libXt file
     xorg.pixman yasm libGLU libGL
     xorg.xorgproto
-    xorg.libXext unzip makeWrapper
+    xorg.libXext makeWrapper
     libevent libstartup_notification /* cairo */
     libpng jemalloc glib
     nasm icu67 libvpx_1_8
@@ -222,6 +222,7 @@ buildStdenv.mkDerivation ({
       rust-cbindgen
       rustc
       which
+      unzip
     ]
     ++ lib.optional gtk3Support wrapGAppsHook
     ++ lib.optionals buildStdenv.isDarwin [ xcbuild rsync ]

third_party/nixpkgs/pkgs/applications/networking/browsers/palemoon/default.nix

@@ -43,14 +43,14 @@ in stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [
-    desktop-file-utils file gnum4 perl pkg-config python2 wget which wrapGAppsHook
+    desktop-file-utils file gnum4 perl pkg-config python2 wget which wrapGAppsHook unzip
   ];
 
   buildInputs = [
     alsaLib bzip2 cairo dbus dbus-glib ffmpeg fontconfig freetype
     gnome2.GConf gtk2 hunspell libevent libjpeg libnotify
     libstartup_notification libGLU libGL
-    libpulseaudio unzip yasm zip zlib
+    libpulseaudio yasm zip zlib
   ]
   ++ (with xorg; [
     libX11 libXext libXft libXi libXrender libXScrnSaver

third_party/nixpkgs/pkgs/applications/networking/browsers/vivaldi/widevine.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "0l743f2yyaq1vvc3iicajgnfpjxjsfvjcqvanndbxs23skgjcv6r";
   };
 
-  buildInputs = [ unzip ];
+  nativeBuildInputs = [ unzip ];
 
   unpackPhase = ''
     unzip $src

third_party/nixpkgs/pkgs/applications/networking/browsers/webbrowser/default.nix

@@ -41,12 +41,12 @@ in stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
-    gnum4 makeWrapper perl pkg-config python2
+    gnum4 makeWrapper perl pkg-config python2 unzip
   ];
 
   buildInputs = [
     alsaLib dbus dbus-glib ffmpeg fontconfig freetype yasm zip jack2 gtk2
-    unzip gnome2.GConf xorg.libXt
+    gnome2.GConf xorg.libXt
   ];
 
   enableParallelBuilding = true;

third_party/nixpkgs/pkgs/applications/networking/calls/default.nix

@@ -3,7 +3,6 @@
 , fetchFromGitLab
 , meson
 , ninja
-, cmake
 , pkg-config
 , libhandy
 , modemmanager
@@ -13,35 +12,46 @@
 , feedbackd
 , callaudiod
 , evolution-data-server
+, glib
 , folks
 , desktop-file-utils
+, appstream-glib
 , libpeas
 , dbus
 , vala
 , wrapGAppsHook
 , xvfb_run
+, gtk-doc
+, docbook-xsl-nons
+, docbook_xml_dtd_43
+, gobject-introspection
 }:
 
 stdenv.mkDerivation rec {
   pname = "calls";
-  version = "0.2.0";
+  version = "0.3.1";
 
   src = fetchFromGitLab {
     domain = "source.puri.sm";
     owner = "Librem5";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1qmjdhnr95dawccw1ss8hc3lk0cypj86xg2amjq7avzn86ryd76l";
+    sha256 = "0igap5ynq269xqaky6fqhdg2dpsvxa008z953ywa4s5b5g5dk3dd";
   };
 
+  outputs = [ "out" "devdoc" ];
+
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     desktop-file-utils
+    appstream-glib
     vala
-    cmake
     wrapGAppsHook
+    gtk-doc
+    docbook-xsl-nons
+    docbook_xml_dtd_43
   ];
 
   buildInputs = [
@@ -62,10 +72,10 @@ stdenv.mkDerivation rec {
     xvfb_run
   ];
 
+  NIX_CFLAGS_COMPILE = "-I${glib.dev}/include/gio-unix-2.0";
+
   mesonFlags = [
-    # docs fail to build
+    "-Dgtk_doc=true"
-    # https://source.puri.sm/Librem5/calls/issues/99
-    "-Dgtk_doc=false"
   ];
 
   doCheck = true;
@@ -73,6 +83,7 @@ stdenv.mkDerivation rec {
   checkPhase = ''
     runHook preCheck
     NO_AT_BRIDGE=1 \
+    XDG_DATA_DIRS=${folks}/share/gsettings-schemas/${folks.name} \
     xvfb-run -s '-screen 0 800x600x24' dbus-run-session \
       --config-file=${dbus.daemon}/share/dbus-1/session.conf \
       meson test --print-errorlogs

third_party/nixpkgs/pkgs/applications/networking/cluster/fluxctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fluxctl";
-  version = "1.21.2";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = "flux";
     rev = version;
-    sha256 = "sha256-pI/LGAjTWFXiDKSV+dZl0wXK/TZmN9DuWf5Nu8EYNYc=";
+    sha256 = "sha256-7uS8704YZ7lQTSSnbVvc6T5iadl02TeVpwVPf2uS9L4=";
   };
 
-  vendorSha256 = "sha256-Q8gIhJSZqdjBXrIcJfCd25BniDScwVzUwZ9Vc8p/z3c=";
+  vendorSha256 = "sha256-oqfJaQA8ybh0UNWYJ2ukoWkwdgORwvXzRCquGstwA4M=";
 
   nativeBuildInputs = [ installShellFiles ];