Project import generated by Copybara.

GitOrigin-RevId: 24c9b05ac53e422f1af81a156f1fd58499eb27fb

third_party/nixpkgs/.editorconfig

@@ -56,6 +56,8 @@ indent_size = unset
 
 [deps.nix]
 insert_final_newline = unset
+[pkgs/tools/networking/dd-agent/*-deps.nix]
+insert_final_newline = unset
 
 [eggs.nix]
 trim_trailing_whitespace = unset
@@ -65,6 +67,8 @@ insert_final_newline = unset
 
 [node-{composition,packages}.nix]
 insert_final_newline = unset
+[node-packages-generated.nix]
+insert_final_newline = unset
 
 [nixos/modules/services/networking/ircd-hybrid/*.{conf,in}]
 trim_trailing_whitespace = unset
@@ -98,7 +102,7 @@ trim_trailing_whitespace = unset
 [pkgs/development/mobile/androidenv/generated/{addons,packages}.nix]
 trim_trailing_whitespace = unset
 
-[pkgs/development/node-packages/node-packages.nix]
+[pkgs/development/node-packages/composition.nix]
 insert_final_newline = unset
 
 [pkgs/servers/dict/wordnet_structures.py]

third_party/nixpkgs/doc/languages-frameworks/agda.section.md

@@ -12,12 +12,13 @@ Agda can be installed from `agda`:
 $ nix-env -iA agda
 ```
 
-To use agda with libraries, the `agda.withPackages` function can be used. This function either takes:
+To use Agda with libraries, the `agda.withPackages` function can be used. This function either takes:
-+ A list of packages,
-+ or a function which returns a list of packages when given the `agdaPackages` attribute set,
-+ or an attribute set containing a list of packages and a GHC derivation for compilation (see below).
 
-For example, suppose we wanted a version of agda which has access to the standard library. This can be obtained with the expressions:
+* A list of packages,
+* or a function which returns a list of packages when given the `agdaPackages` attribute set,
+* or an attribute set containing a list of packages and a GHC derivation for compilation (see below).
+
+For example, suppose we wanted a version of Agda which has access to the standard library. This can be obtained with the expressions:
 
 ```
 agda.withPackages [ agdaPackages.standard-library ]
@@ -33,18 +34,19 @@ or can be called as in the [Compiling Agda](#compiling-agda) section.
 
 If you want to use a library in your home directory (for instance if it is a development version) then typecheck it manually (using `agda.withPackages` if necessary) and then override the `src` attribute of the package to point to your local repository.
 
-Agda will not by default use these libraries. To tell agda to use the library we have some options:
+Agda will not by default use these libraries. To tell Agda to use the library we have some options:
-- Call `agda` with the library flag:
+
+* Call `agda` with the library flag:
 ```
 $ agda -l standard-library -i . MyFile.agda
 ```
-- Write a `my-library.agda-lib` file for the project you are working on which may look like:
+* Write a `my-library.agda-lib` file for the project you are working on which may look like:
 ```
 name: my-library
 include: .
 depend: standard-library
 ```
-- Create the file `~/.agda/defaults` and add any libraries you want to use by default.
+* Create the file `~/.agda/defaults` and add any libraries you want to use by default.
 
 More information can be found in the [official Agda documentation on library management](https://agda.readthedocs.io/en/v2.6.1/tools/package-system.html).
 
@@ -60,12 +62,13 @@ agda.withPackages {
 ```
 
 ## Writing Agda packages
-To write a nix derivation for an agda library, first check that the library has a `*.agda-lib` file.
+To write a nix derivation for an Agda library, first check that the library has a `*.agda-lib` file.
 
 A derivation can then be written using `agdaPackages.mkDerivation`. This has similar arguments to `stdenv.mkDerivation` with the following additions:
-+ `everythingFile` can be used to specify the location of the `Everything.agda` file, defaulting to `./Everything.agda`. If this file does not exist then either it should be patched in or the `buildPhase` should be overridden (see below).
+
-+ `libraryName` should be the name that appears in the `*.agda-lib` file, defaulting to `pname`.
+* `everythingFile` can be used to specify the location of the `Everything.agda` file, defaulting to `./Everything.agda`. If this file does not exist then either it should be patched in or the `buildPhase` should be overridden (see below).
-+ `libraryFile` should be the file name of the `*.agda-lib` file, defaulting to `${libraryName}.agda-lib`.
+* `libraryName` should be the name that appears in the `*.agda-lib` file, defaulting to `pname`.
+* `libraryFile` should be the file name of the `*.agda-lib` file, defaulting to `${libraryName}.agda-lib`.
 
 ### Building Agda packages
 The default build phase for `agdaPackages.mkDerivation` simply runs `agda` on the `Everything.agda` file.
@@ -74,12 +77,14 @@ Additionally, a `preBuild` or `configurePhase` can be used if there are steps th
 `agda` and the Agda libraries contained in `buildInputs` are made available during the build phase.
 
 ### Installing Agda packages
-The default install phase copies agda source files, agda interface files (`*.agdai`) and `*.agda-lib` files to the output directory.
+The default install phase copies Agda source files, Agda interface files (`*.agdai`) and `*.agda-lib` files to the output directory.
 This can be overridden.
 
-By default, agda sources are files ending on  `.agda`, or literate agda files ending on `.lagda`, `.lagda.tex`, `.lagda.org`, `.lagda.md`, `.lagda.rst`. The list of recognised agda source extensions can be extended by setting the `extraExtensions` config variable.
+By default, Agda sources are files ending on `.agda`, or literate Agda files ending on `.lagda`, `.lagda.tex`, `.lagda.org`, `.lagda.md`, `.lagda.rst`. The list of recognised Agda source extensions can be extended by setting the `extraExtensions` config variable.
 
-To add an agda package to `nixpkgs`, the derivation should be written to `pkgs/development/libraries/agda/${library-name}/` and an entry should be added to `pkgs/top-level/agda-packages.nix`. Here it is called in a scope with access to all other agda libraries, so the top line of the `default.nix` can look like:
+## Adding Agda packages to Nixpkgs
+
+To add an Agda package to `nixpkgs`, the derivation should be written to `pkgs/development/libraries/agda/${library-name}/` and an entry should be added to `pkgs/top-level/agda-packages.nix`. Here it is called in a scope with access to all other Agda libraries, so the top line of the `default.nix` can look like:
 ```
 { mkDerivation, standard-library, fetchFromGitHub }:
 ```
@@ -103,4 +108,4 @@ mkDerivation {
 ```
 This library has a file called `.agda-lib`, and so we give an empty string to `libraryFile` as nothing precedes `.agda-lib` in the filename. This file contains `name: IAL-1.3`, and so we let `libraryName =  "IAL-1.3"`. This library does not use an `Everything.agda` file and instead has a Makefile, so there is no need to set `everythingFile` and we set a custom `buildPhase`.
 
-When writing an agda package it is essential to make sure that no `.agda-lib` file gets added to the store as a single file (for example by using `writeText`). This causes agda to think that the nix store is a agda library and it will attempt to write to it whenever it typechecks something. See [https://github.com/agda/agda/issues/4613](https://github.com/agda/agda/issues/4613).
+When writing an Agda package it is essential to make sure that no `.agda-lib` file gets added to the store as a single file (for example by using `writeText`). This causes Agda to think that the nix store is a Agda library and it will attempt to write to it whenever it typechecks something. See [https://github.com/agda/agda/issues/4613](https://github.com/agda/agda/issues/4613).

third_party/nixpkgs/lib/default.nix

@@ -66,7 +66,7 @@ let
       stringLength sub substring tail;
     inherit (trivial) id const pipe concat or and bitAnd bitOr bitXor
       bitNot boolToString mergeAttrs flip mapNullable inNixShell min max
-      importJSON warn info showWarnings nixpkgsVersion version mod compare
+      importJSON importTOML warn info showWarnings nixpkgsVersion version mod compare
       splitByAndCompare functionArgs setFunctionArgs isFunction toHexString toBaseDigits;
     inherit (fixedPoints) fix fix' converge extends composeExtensions
       makeExtensible makeExtensibleWithCustomName;

third_party/nixpkgs/lib/modules.nix

@@ -875,4 +875,21 @@ rec {
       ];
     };
 
+  /* Use this function to import a JSON file as NixOS configuration.
+
+     importJSON -> path -> attrs
+  */
+  importJSON = file: {
+    _file = file;
+    config = lib.importJSON file;
+  };
+
+  /* Use this function to import a TOML file as NixOS configuration.
+
+     importTOML -> path -> attrs
+  */
+  importTOML = file: {
+    _file = file;
+    config = lib.importTOML file;
+  };
 }

third_party/nixpkgs/lib/trivial.nix

@@ -281,6 +281,12 @@ rec {
   importJSON = path:
     builtins.fromJSON (builtins.readFile path);
 
+  /* Reads a TOML file.
+
+     Type :: path -> any
+  */
+  importTOML = path:
+    builtins.fromTOML (builtins.readFile path);
 
   ## Warnings
 

third_party/nixpkgs/maintainers/maintainer-list.nix

@@ -1242,6 +1242,12 @@
     githubId = 32319131;
     name = "Brett L";
   };
+  buckley310 = {
+    email = "sean.bck@gmail.com";
+    github = "buckley310";
+    githubId = 2379774;
+    name = "Sean Buckley";
+  };
   buffet = {
     email = "niclas@countingsort.com";
     github = "buffet";
@@ -2389,6 +2395,12 @@
     githubId = 984691;
     name = "Evan Danaher";
   };
+  edcragg = {
+    email = "ed.cragg@eipi.xyz";
+    github = "nuxeh";
+    githubId = 1516017;
+    name = "Ed Cragg";
+  };
   edef = {
     email = "edef@edef.eu";
     github = "edef1c";
@@ -3313,6 +3325,12 @@
     githubId = 10654650;
     name = "Guillaume Koenig";
   };
+  guserav = {
+    email = "guserav@users.noreply.github.com";
+    github = "guserav";
+    githubId = 28863828;
+    name = "guserav";
+  };
   guyonvarch = {
     email = "joris@guyonvarch.me";
     github = "guyonvarch";
@@ -9750,4 +9768,10 @@
       fingerprint = "8597 4506 EC69 5392 0443  0805 9D98 CDAC FF04 FD78";
     }];
   };
+  hloeffler = {
+    name = "Hauke Löffler";
+    email = "nix@hauke-loeffler.de";
+    github = "hloeffler";
+    githubId = 6627191;
+  };
 }

third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2009.xml

@@ -64,6 +64,12 @@
      Python 3 now defaults to Python 3.8 instead of 3.7.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     Python 3.5 has reached its upstream EOL at the end of September 2020: it
+     has been removed from the list of available packages.
+    </para>
+   </listitem>
    <listitem>
     <para>
      Two new options, <link linkend="opt-services.openssh.authorizedKeysCommand">authorizedKeysCommand</link>
@@ -583,8 +589,8 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
    <listitem>
      <para>
        In addition to the hostname, the fully qualified domain name (FQDN),
-       which consists of <literal>${cfg.hostName}</literal> and
+       which consists of <literal>${networking.hostName}</literal> and
-       <literal>${cfg.domain}</literal> is now added to
+       <literal>${networking.domain}</literal> is now added to
        <literal>/etc/hosts</literal>, to allow local FQDN resolution, as used by the
        <literal>hostname --fqdn</literal> command and other applications that
        try to determine the FQDN. These new entries take precedence over entries
@@ -604,6 +610,10 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
        or digit, and have as interior characters only letters, digits, and
        hyphen. The maximum length is 63 characters. Additionally it is
        recommended to only use lower-case characters.
+       If (e.g. for legacy reasons) a FQDN is required as the Linux kernel network node hostname
+       (<literal>uname --nodename</literal>) the option
+       <literal>boot.kernel.sysctl."kernel.hostname"</literal>
+       can be used as a workaround (but be aware of the 64 character limit).
      </para>
    </listitem>
    <listitem>
@@ -864,6 +874,13 @@ CREATE ROLE postgres LOGIN SUPERUSER;
      </itemizedlist>
     </para>
    </listitem>
+   <listitem>
+    <para>
+      The GNOME desktop manager no longer default installs <package>gnome3.epiphany</package>.
+      It was chosen to do this as it has a usability breaking issue (see issue <link xlink:href="https://github.com/NixOS/nixpkgs/issues/98819">#98819</link>)
+      that makes it unsuitable to be a default app.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -1093,8 +1110,10 @@ services.transmission.settings.rpc-bind-address = "0.0.0.0";
    </listitem>
    <listitem>
     <para>
-     The <literal>fontconfig</literal> module stopped generating fontconfig 2.10.x config and cache.
+     The <literal>fontconfig</literal> module stopped generating config and cache files for fontconfig 2.10.x, the <filename>/etc/fonts/fonts.conf</filename> now belongs to the latest fontconfig, just like on other Linux distributions, and we will <link xlink:href="https://github.com/NixOS/nixpkgs/pull/95358">no longer</link> be versioning the config directories.
-     Fontconfig 2.10.x was removed from Nixpkgs - it hasn't been used in any nixpkgs package anymore.
+    </para>
+    <para>
+     Fontconfig 2.10.x was removed from Nixpkgs since it hasn’t been used in any Nixpkgs package for years now.
     </para>
    </listitem>
    <listitem>
@@ -1184,5 +1203,20 @@ services.transmission.settings.rpc-bind-address = "0.0.0.0";
     </para>
    </listitem>
   </itemizedlist>
+  <itemizedlist>
+    <listitem>
+      <para>
+        For AMD GPUs, Vulkan can now be used by adding <literal>amdvlk</literal>
+        to <literal>hardware.opengl.extraPackages</literal>.
+      </para>
+    </listitem>
+    <listitem>
+      <para>
+        Similarly, still for AMD GPUs, the ROCm OpenCL stack can now be used by adding
+        <literal>rocm-opencl-icd</literal> to
+        <literal>hardware.opengl.extraPackages</literal>.
+      </para>
+    </listitem>
+  </itemizedlist>
  </section>
 </section>

third_party/nixpkgs/nixos/modules/module-list.nix

@@ -332,6 +332,7 @@
   ./services/desktops/tumbler.nix
   ./services/desktops/zeitgeist.nix
   ./services/development/bloop.nix
+  ./services/development/blackfire.nix
   ./services/development/hoogle.nix
   ./services/development/jupyter/default.nix
   ./services/development/jupyterhub/default.nix
@@ -441,6 +442,7 @@
   ./services/misc/dysnomia.nix
   ./services/misc/disnix.nix
   ./services/misc/docker-registry.nix
+  ./services/misc/domoticz.nix
   ./services/misc/errbot.nix
   ./services/misc/etcd.nix
   ./services/misc/ethminer.nix

third_party/nixpkgs/nixos/modules/security/acme.nix

@@ -110,6 +110,7 @@ let
     protocolOpts = if useDns then (
       [ "--dns" data.dnsProvider ]
       ++ optionals (!data.dnsPropagationCheck) [ "--dns.disable-cp" ]
+      ++ optionals (data.dnsResolver != null) [ "--dns.resolvers" data.dnsResolver ]
     ) else (
       [ "--http" "--http.webroot" data.webroot ]
     );
@@ -403,6 +404,17 @@ let
         '';
       };
 
+      dnsResolver = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "1.1.1.1:53";
+        description = ''
+          Set the resolver to use for performing recursive DNS queries. Supported:
+          host:port. The default is to use the system resolvers, or Google's DNS
+          resolvers if the system's cannot be determined.
+        '';
+      };
+
       credentialsFile = mkOption {
         type = types.path;
         description = ''

third_party/nixpkgs/nixos/modules/security/pam.nix

@@ -366,7 +366,7 @@ let
           ${let p11 = config.security.pam.p11; in optionalString cfg.p11Auth
               "auth ${p11.control} ${pkgs.pam_p11}/lib/security/pam_p11.so ${pkgs.opensc}/lib/opensc-pkcs11.so"}
           ${let u2f = config.security.pam.u2f; in optionalString cfg.u2fAuth
-              "auth ${u2f.control} ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"}"}
+              "auth ${u2f.control} ${pkgs.pam_u2f}/lib/security/pam_u2f.so ${optionalString u2f.debug "debug"} ${optionalString (u2f.authFile != null) "authfile=${u2f.authFile}"} ${optionalString u2f.interactive "interactive"} ${optionalString u2f.cue "cue"} ${optionalString (u2f.appId != null) "appid=${u2f.appId}"}"}
           ${optionalString cfg.usbAuth
               "auth sufficient ${pkgs.pam_usb}/lib/security/pam_usb.so"}
           ${let oath = config.security.pam.oath; in optionalString cfg.oathAuth
@@ -654,6 +654,22 @@ in
         '';
       };
 
+      appId = mkOption {
+        default = null;
+        type = with types; nullOr str;
+        description = ''
+            By default <literal>pam-u2f</literal> module sets the application
+            ID to <literal>pam://$HOSTNAME</literal>.
+
+            When using <command>pamu2fcfg</command>, you can specify your
+            application ID with the <literal>-i</literal> flag.
+
+            More information can be found <link
+            xlink:href="https://developers.yubico.com/pam-u2f/Manuals/pam_u2f.8.html">
+            here</link>
+        '';
+      };
+
       control = mkOption {
         default = "sufficient";
         type = types.enum [ "required" "requisite" "sufficient" "optional" ];

third_party/nixpkgs/nixos/modules/services/development/blackfire.nix

@@ -0,0 +1,65 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.blackfire-agent;
+
+  agentConfigFile = lib.generators.toINI {} {
+    blackfire =  cfg.settings;
+  };
+
+  agentSock = "blackfire/agent.sock";
+in {
+  meta = {
+    maintainers = pkgs.blackfire.meta.maintainers;
+    doc = ./blackfire.xml;
+  };
+
+  options = {
+    services.blackfire-agent = {
+      enable = lib.mkEnableOption "Blackfire profiler agent";
+      settings = lib.mkOption {
+        description = ''
+          See https://blackfire.io/docs/configuration/agent
+        '';
+        type = lib.types.submodule {
+          freeformType = with lib.types; attrsOf str;
+
+          options = {
+            server-id = lib.mkOption {
+              type = lib.types.str;
+              description = ''
+                Sets the server id used to authenticate with Blackfire
+
+                You can find your personal server-id at https://blackfire.io/my/settings/credentials
+              '';
+            };
+
+            server-token = lib.mkOption {
+              type = lib.types.str;
+              description = ''
+                Sets the server token used to authenticate with Blackfire
+
+                You can find your personal server-token at https://blackfire.io/my/settings/credentials
+              '';
+            };
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.etc."blackfire/agent".text = agentConfigFile;
+
+    services.blackfire-agent.settings.socket = "unix:///run/${agentSock}";
+
+    systemd.services.blackfire-agent = {
+      description = "Blackfire agent";
+
+      serviceConfig = {
+        ExecStart = "${pkgs.blackfire}/bin/blackfire-agent";
+        RuntimeDirectory = "blackfire";
+      };
+    };
+  };
+}

third_party/nixpkgs/nixos/modules/services/development/blackfire.xml

@@ -0,0 +1,45 @@
+<chapter xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" version="5.0" xml:id="module-services-blackfire">
+ <title>Blackfire profiler</title>
+ <para>
+  <emphasis>Source:</emphasis>
+  <filename>modules/services/development/blackfire.nix</filename>
+ </para>
+ <para>
+  <emphasis>Upstream documentation:</emphasis>
+  <link xlink:href="https://blackfire.io/docs/introduction"/>
+ </para>
+ <para>
+  <link xlink:href="https://blackfire.io">Blackfire</link> is a proprietary tool for profiling applications. There are several languages supported by the product but currently only PHP support is packaged in Nixpkgs. The back-end consists of a module that is loaded into the language runtime (called <firstterm>probe</firstterm>) and a service (<firstterm>agent</firstterm>) that the probe connects to and that sends the profiles to the server.
+ </para>
+ <para>
+  To use it, you will need to enable the agent and the probe on your server. The exact method will depend on the way you use PHP but here is an example of NixOS configuration for PHP-FPM:
+<programlisting>let
+  php = pkgs.php.withExtensions ({ enabled, all }: enabled ++ (with all; [
+    blackfire
+  ]));
+in {
+  # Enable the probe extension for PHP-FPM.
+  services.phpfpm = {
+    phpPackage = php;
+  };
+
+  # Enable and configure the agent.
+  services.blackfire-agent = {
+    enable = true;
+    settings = {
+      # You will need to get credentials at https://blackfire.io/my/settings/credentials
+      # You can also use other options described in https://blackfire.io/docs/configuration/agent
+      server-id = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX";
+      server-token = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";
+    };
+  };
+
+  # Make the agent run on start-up.
+  # Alternately, you can start it manually with `systemctl start blackfire-agent`.
+  systemd.services.blackfire-agent.wantedBy = [ "phpfpm-foo.service" ];
+}</programlisting>
+ </para>
+ <para>
+  On your developer machine, you will also want to install <link xlink:href="https://blackfire.io/docs/up-and-running/installation#install-a-profiling-client">the client</link> (see <package>blackfire</package> package) or the browser extension to actually trigger the profiling.
+ </para>
+</chapter>

third_party/nixpkgs/nixos/modules/services/misc/domoticz.nix

@@ -0,0 +1,51 @@
+{ lib, pkgs, config, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.domoticz;
+  pkgDesc = "Domoticz home automation";
+
+in {
+
+  options = {
+
+    services.domoticz = {
+      enable = mkEnableOption pkgDesc;
+
+      bind = mkOption {
+        type = types.str;
+        default = "0.0.0.0";
+        description = "IP address to bind to.";
+      };
+
+      port = mkOption {
+        type = types.int;
+        default = 8080;
+        description = "Port to bind to for HTTP, set to 0 to disable HTTP.";
+      };
+
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services."domoticz" = {
+      description = pkgDesc;
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        StateDirectory = "domoticz";
+        Restart = "always";
+        ExecStart = ''
+          ${pkgs.domoticz}/bin/domoticz -noupdates -www ${toString cfg.port} -wwwbind ${cfg.bind} -sslwww 0 -userdata /var/lib/domoticz -approot ${pkgs.domoticz}/share/domoticz/ -pidfile /var/run/domoticz.pid
+        '';
+      };
+    };
+
+  };
+
+}

third_party/nixpkgs/nixos/modules/services/misc/mediatomb.nix

@@ -6,37 +6,97 @@ let
 
   gid = config.ids.gids.mediatomb;
   cfg = config.services.mediatomb;
+  name = cfg.package.pname;
+  pkg = cfg.package;
+  optionYesNo = option: if option then "yes" else "no";
+  # configuration on media directory
+  mediaDirectory = {
+    options = {
+      path = mkOption {
+        type = types.str;
+        description = ''
+          Absolute directory path to the media directory to index.
+        '';
+      };
+      recursive = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether the indexation must take place recursively or not.";
+      };
+      hidden-files = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Whether to index the hidden files or not.";
+      };
+    };
+  };
+  toMediaDirectory = d: "<directory location=\"${d.path}\" mode=\"inotify\" recursive=\"${optionYesNo d.recursive}\" hidden-files=\"${optionYesNo d.hidden-files}\" />\n";
 
-  mtConf = pkgs.writeText "config.xml" ''
+  transcodingConfig = if cfg.transcoding then with pkgs; ''
-  <?xml version="1.0" encoding="UTF-8"?>
+    <transcoding enabled="yes">
-  <config version="2" xmlns="http://mediatomb.cc/config/2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://mediatomb.cc/config/2 http://mediatomb.cc/config/2.xsd">
+      <mimetype-profile-mappings>
+        <transcode mimetype="video/x-flv" using="vlcmpeg" />
+        <transcode mimetype="application/ogg" using="vlcmpeg" />
+        <transcode mimetype="audio/ogg" using="ogg2mp3" />
+        <transcode mimetype="audio/x-flac" using="oggflac2raw"/>
+      </mimetype-profile-mappings>
+      <profiles>
+        <profile name="ogg2mp3" enabled="no" type="external">
+          <mimetype>audio/mpeg</mimetype>
+          <accept-url>no</accept-url>
+          <first-resource>yes</first-resource>
+          <accept-ogg-theora>no</accept-ogg-theora>
+          <agent command="${ffmpeg}/bin/ffmpeg" arguments="-y -i %in -f mp3 %out" />
+          <buffer size="1048576" chunk-size="131072" fill-size="262144" />
+        </profile>
+        <profile name="vlcmpeg" enabled="no" type="external">
+          <mimetype>video/mpeg</mimetype>
+          <accept-url>yes</accept-url>
+          <first-resource>yes</first-resource>
+          <accept-ogg-theora>yes</accept-ogg-theora>
+          <agent command="${libsForQt5.vlc}/bin/vlc"
+            arguments="-I dummy %in --sout #transcode{venc=ffmpeg,vcodec=mp2v,vb=4096,fps=25,aenc=ffmpeg,acodec=mpga,ab=192,samplerate=44100,channels=2}:standard{access=file,mux=ps,dst=%out} vlc:quit" />
+          <buffer size="14400000" chunk-size="512000" fill-size="120000" />
+        </profile>
+      </profiles>
+    </transcoding>
+'' else ''
+    <transcoding enabled="no">
+    </transcoding>
+'';
+
+  configText = optionalString (! cfg.customCfg) ''
+<?xml version="1.0" encoding="UTF-8"?>
+<config version="2" xmlns="http://mediatomb.cc/config/2" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://mediatomb.cc/config/2 http://mediatomb.cc/config/2.xsd">
     <server>
       <ui enabled="yes" show-tooltips="yes">
         <accounts enabled="no" session-timeout="30">
-          <account user="mediatomb" password="mediatomb"/>
+          <account user="${name}" password="${name}"/>
         </accounts>
       </ui>
       <name>${cfg.serverName}</name>
       <udn>uuid:${cfg.uuid}</udn>
       <home>${cfg.dataDir}</home>
-      <webroot>${pkgs.mediatomb}/share/mediatomb/web</webroot>
+      <interface>${cfg.interface}</interface>
+      <webroot>${pkg}/share/${name}/web</webroot>
+      <pc-directory upnp-hide="${optionYesNo cfg.pcDirectoryHide}"/>
       <storage>
         <sqlite3 enabled="yes">
-          <database-file>mediatomb.db</database-file>
+          <database-file>${name}.db</database-file>
         </sqlite3>
       </storage>
-      <protocolInfo extend="${if cfg.ps3Support then "yes" else "no"}"/>
+      <protocolInfo extend="${optionYesNo cfg.ps3Support}"/>
-      ${if cfg.dsmSupport then ''
+      ${optionalString cfg.dsmSupport ''
       <custom-http-headers>
         <add header="X-User-Agent: redsonic"/>
       </custom-http-headers>
 
       <manufacturerURL>redsonic.com</manufacturerURL>
       <modelNumber>105</modelNumber>
-      '' else ""}
+      ''}
-      ${if cfg.tg100Support then ''
+        ${optionalString cfg.tg100Support ''
       <upnp-string-limit>101</upnp-string-limit>
-      '' else ""}
+      ''}
       <extended-runtime-options>
         <mark-played-items enabled="yes" suppress-cds-updates="yes">
           <string mode="prepend">*</string>
@@ -47,11 +107,14 @@ let
       </extended-runtime-options>
     </server>
     <import hidden-files="no">
+      <autoscan use-inotify="auto">
+      ${concatMapStrings toMediaDirectory cfg.mediaDirectories}
+      </autoscan>
       <scripting script-charset="UTF-8">
-        <common-script>${pkgs.mediatomb}/share/mediatomb/js/common.js</common-script>
+        <common-script>${pkg}/share/${name}/js/common.js</common-script>
-        <playlist-script>${pkgs.mediatomb}/share/mediatomb/js/playlists.js</playlist-script>
+        <playlist-script>${pkg}/share/${name}/js/playlists.js</playlist-script>
         <virtual-layout type="builtin">
-          <import-script>${pkgs.mediatomb}/share/mediatomb/js/import.js</import-script>
+          <import-script>${pkg}/share/${name}/js/import.js</import-script>
         </virtual-layout>
       </scripting>
       <mappings>
@@ -75,12 +138,12 @@ let
           <map from="flv" to="video/x-flv"/>
           <map from="mkv" to="video/x-matroska"/>
           <map from="mka" to="audio/x-matroska"/>
-          ${if cfg.ps3Support then ''
+          ${optionalString cfg.ps3Support ''
           <map from="avi" to="video/divx"/>
-          '' else ""}
+          ''}
-          ${if cfg.dsmSupport then ''
+          ${optionalString cfg.dsmSupport ''
           <map from="avi" to="video/avi"/>
-          '' else ""}
+          ''}
         </extension-mimetype>
         <mimetype-upnpclass>
           <map from="audio/*" to="object.item.audioItem.musicTrack"/>
@@ -108,46 +171,27 @@ let
       </mappings>
       <online-content>
         <YouTube enabled="no" refresh="28800" update-at-start="no" purge-after="604800" racy-content="exclude" format="mp4" hd="no">
-          <favorites user="mediatomb"/>
+          <favorites user="${name}"/>
           <standardfeed feed="most_viewed" time-range="today"/>
-          <playlists user="mediatomb"/>
+          <playlists user="${name}"/>
-          <uploads user="mediatomb"/>
+          <uploads user="${name}"/>
           <standardfeed feed="recently_featured" time-range="today"/>
         </YouTube>
       </online-content>
     </import>
-    <transcoding enabled="${if cfg.transcoding then "yes" else "no"}">
+    ${transcodingConfig}
-      <mimetype-profile-mappings>
-        <transcode mimetype="video/x-flv" using="vlcmpeg"/>
-        <transcode mimetype="application/ogg" using="vlcmpeg"/>
-        <transcode mimetype="application/ogg" using="oggflac2raw"/>
-        <transcode mimetype="audio/x-flac" using="oggflac2raw"/>
-      </mimetype-profile-mappings>
-      <profiles>
-        <profile name="oggflac2raw" enabled="no" type="external">
-          <mimetype>audio/L16</mimetype>
-          <accept-url>no</accept-url>
-          <first-resource>yes</first-resource>
-          <accept-ogg-theora>no</accept-ogg-theora>
-          <agent command="ogg123" arguments="-d raw -o byteorder:big -f %out %in"/>
-          <buffer size="1048576" chunk-size="131072" fill-size="262144"/>
-        </profile>
-        <profile name="vlcmpeg" enabled="no" type="external">
-          <mimetype>video/mpeg</mimetype>
-          <accept-url>yes</accept-url>
-          <first-resource>yes</first-resource>
-          <accept-ogg-theora>yes</accept-ogg-theora>
-          <agent command="vlc" arguments="-I dummy %in --sout #transcode{venc=ffmpeg,vcodec=mp2v,vb=4096,fps=25,aenc=ffmpeg,acodec=mpga,ab=192,samplerate=44100,channels=2}:standard{access=file,mux=ps,dst=%out} vlc:quit"/>
-          <buffer size="14400000" chunk-size="512000" fill-size="120000"/>
-        </profile>
-      </profiles>
-    </transcoding>
   </config>
-  '';
+'';
+  defaultFirewallRules = {
+    # udp 1900 port needs to be opened for SSDP (not configurable within
+    # mediatomb/gerbera) cf.
+    # http://docs.gerbera.io/en/latest/run.html?highlight=udp%20port#network-setup
+    allowedUDPPorts = [ 1900 cfg.port ];
+    allowedTCPPorts = [ cfg.port ];
+  };
 
 in {
 
-
   ###### interface
 
   options = {
@@ -158,18 +202,27 @@ in {
         type = types.bool;
         default = false;
         description = ''
-          Whether to enable the mediatomb DLNA server.
+          Whether to enable the Gerbera/Mediatomb DLNA server.
         '';
       };
 
       serverName = mkOption {
         type = types.str;
-        default = "mediatomb";
+        default = "Gerbera (Mediatomb)";
         description = ''
           How to identify the server on the network.
         '';
       };
 
+      package = mkOption {
+        type = types.package;
+        example = literalExample "pkgs.mediatomb";
+        default = pkgs.gerbera;
+        description = ''
+          Underlying package to be used with the module (default: pkgs.gerbera).
+        '';
+      };
+
       ps3Support = mkOption {
         type = types.bool;
         default = false;
@@ -206,23 +259,34 @@ in {
 
       dataDir = mkOption {
         type = types.path;
-        default = "/var/lib/mediatomb";
+        default = "/var/lib/${name}";
         description = ''
-          The directory where mediatomb stores its state, data, etc.
+          The directory where Gerbera/Mediatomb stores its state, data, etc.
+        '';
+      };
+
+      pcDirectoryHide = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to list the top-level directory or not (from upnp client standpoint).
         '';
       };
 
       user = mkOption {
+        type = types.str;
         default = "mediatomb";
-        description = "User account under which mediatomb runs.";
+        description = "User account under which ${name} runs.";
       };
 
       group = mkOption {
+        type = types.str;
         default = "mediatomb";
-        description = "Group account under which mediatomb runs.";
+        description = "Group account under which ${name} runs.";
       };
 
       port = mkOption {
+        type = types.int;
         default = 49152;
         description = ''
           The network port to listen on.
@@ -230,40 +294,76 @@ in {
       };
 
       interface = mkOption {
+        type = types.str;
         default = "";
         description = ''
           A specific interface to bind to.
         '';
       };
 
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          If false (the default), this is up to the user to declare the firewall rules.
+          If true, this opens port 1900 (tcp and udp) and the port specified by
+          <option>sercvices.mediatomb.port</option>.
+
+          If the option <option>services.mediatomb.interface</option> is set,
+          the firewall rules opened are dedicated to that interface. Otherwise,
+          those rules are opened globally.
+        '';
+      };
+
       uuid = mkOption {
+        type = types.str;
         default = "fdfc8a4e-a3ad-4c1d-b43d-a2eedb03a687";
         description = ''
           A unique (on your network) to identify the server by.
         '';
       };
 
+      mediaDirectories = mkOption {
+        type = with types; listOf (submodule mediaDirectory);
+        default = {};
+        description = ''
+          Declare media directories to index.
+        '';
+        example = [
+          { path = "/data/pictures"; recursive = false; hidden-files = false; }
+          { path = "/data/audio"; recursive = true; hidden-files = false; }
+        ];
+      };
+
       customCfg = mkOption {
         type = types.bool;
         default = false;
         description = ''
-          Allow mediatomb to create and use its own config file inside ${cfg.dataDir}.
+          Allow ${name} to create and use its own config file inside the <literal>dataDir</literal> as
+          configured by <option>services.mediatomb.dataDir</option>.
+          Deactivated by default, the service then runs with the configuration generated from this module.
+          Otherwise, when enabled, no service configuration is generated. Gerbera/Mediatomb then starts using
+          config.xml within the configured <literal>dataDir</literal>. It's up to the user to make a correct
+          configuration file.
         '';
       };
+
     };
   };
 
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = let binaryCommand = "${pkg}/bin/${name}";
+               interfaceFlag = optionalString ( cfg.interface != "") "--interface ${cfg.interface}";
+               configFlag = optionalString (! cfg.customCfg) "--config ${pkgs.writeText "config.xml" configText}";
+    in mkIf cfg.enable {
     systemd.services.mediatomb = {
-      description = "MediaTomb media Server";
+      description = "${cfg.serverName} media Server";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.mediatomb ];
+      serviceConfig.ExecStart = "${binaryCommand} --port ${toString cfg.port} ${interfaceFlag} ${configFlag} --home ${cfg.dataDir}";
-      serviceConfig.ExecStart = "${pkgs.mediatomb}/bin/mediatomb -p ${toString cfg.port} ${if cfg.interface!="" then "-e ${cfg.interface}" else ""} ${if cfg.customCfg then "" else "-c ${mtConf}"} -m ${cfg.dataDir}";
+      serviceConfig.User = cfg.user;
-      serviceConfig.User = "${cfg.user}";
     };
 
     users.groups = optionalAttrs (cfg.group == "mediatomb") {
@@ -274,15 +374,18 @@ in {
       mediatomb = {
         isSystemUser = true;
         group = cfg.group;
-        home = "${cfg.dataDir}";
+        home = cfg.dataDir;
         createHome = true;
-        description = "Mediatomb DLNA Server User";
+        description = "${name} DLNA Server User";
       };
     };
 
-    networking.firewall = {
+    # Open firewall only if users enable it
-      allowedUDPPorts = [ 1900 cfg.port ];
+    networking.firewall = mkMerge [
-      allowedTCPPorts = [ cfg.port ];
+      (mkIf (cfg.openFirewall && cfg.interface != "") {
-    };
+        interfaces."${cfg.interface}" = defaultFirewallRules;
+      })
+      (mkIf (cfg.openFirewall && cfg.interface == "") defaultFirewallRules)
+    ];
   };
 }

third_party/nixpkgs/nixos/modules/services/misc/snapper.nix

@@ -121,6 +121,16 @@ in
 
     services.dbus.packages = [ pkgs.snapper ];
 
+    systemd.services.snapperd = {
+      description = "DBus interface for snapper";
+      inherit documentation;
+      serviceConfig = {
+        Type = "dbus";
+        BusName = "org.opensuse.Snapper";
+        ExecStart = "${pkgs.snapper}/bin/snapperd";
+      };
+    };
+
     systemd.services.snapper-timeline = {
       description = "Timeline of Snapper Snapshots";
       inherit documentation;

third_party/nixpkgs/nixos/modules/services/misc/ssm-agent.nix

@@ -29,8 +29,6 @@ in {
 
   config = mkIf cfg.enable {
     systemd.services.ssm-agent = {
-      users.extraUsers.ssm-user = {};
-
       inherit (cfg.package.meta) description;
       after    = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
@@ -43,5 +41,26 @@ in {
         RestartSec = "15min";
       };
     };
+
+    # Add user that Session Manager needs, and give it sudo.
+    # This is consistent with Amazon Linux 2 images.
+    security.sudo.extraRules = [
+      {
+        users = [ "ssm-user" ];
+        commands = [
+          {
+            command = "ALL";
+            options = [ "NOPASSWD" ];
+          }
+        ];
+      }
+    ];
+    # On Amazon Linux 2 images, the ssm-user user is pretty much a
+    # normal user with its own group. We do the same.
+    users.groups.ssm-user = {};
+    users.users.ssm-user = {
+      isNormalUser = true;
+      group = "ssm-user";
+    };
   };
 }

third_party/nixpkgs/nixos/modules/services/networking/murmur.nix

@@ -241,6 +241,34 @@ in
         default = "";
         description = "Extra configuration to put into murmur.ini.";
       };
+
+      environmentFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/var/lib/murmur/murmurd.env";
+        description = ''
+          Environment file as defined in <citerefentry>
+          <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
+          </citerefentry>.
+
+          Secrets may be passed to the service without adding them to the world-readable
+          Nix store, by specifying placeholder variables as the option value in Nix and
+          setting these variables accordingly in the environment file.
+
+          <programlisting>
+            # snippet of murmur-related config
+            services.murmur.password = "$MURMURD_PASSWORD";
+          </programlisting>
+
+          <programlisting>
+            # content of the environment file
+            MURMURD_PASSWORD=verysecretpassword
+          </programlisting>
+
+          Note that this file needs to be available on the host on which
+          <literal>murmur</literal> is running.
+        '';
+      };
     };
   };
 
@@ -256,14 +284,22 @@ in
       description = "Murmur Chat Service";
       wantedBy    = [ "multi-user.target" ];
       after       = [ "network-online.target "];
+      preStart    = ''
+        ${pkgs.envsubst}/bin/envsubst \
+          -o /run/murmur/murmurd.ini \
+          -i ${configFile}
+      '';
 
       serviceConfig = {
         # murmurd doesn't fork when logging to the console.
-        Type      = if forking then "forking" else "simple";
+        Type = if forking then "forking" else "simple";
-        PIDFile   = mkIf forking "/run/murmur/murmurd.pid";
+        PIDFile = mkIf forking "/run/murmur/murmurd.pid";
-        RuntimeDirectory = mkIf forking "murmur";
+        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
-        User      = "murmur";
+        ExecStart = "${pkgs.murmur}/bin/murmurd -ini /run/murmur/murmurd.ini";
-        ExecStart = "${pkgs.murmur}/bin/murmurd -ini ${configFile}";
+        Restart = "always";
+        RuntimeDirectory = "murmur";
+        RuntimeDirectoryMode = "0700";
+        User = "murmur";
       };
     };
   };

third_party/nixpkgs/nixos/modules/services/web-apps/nextcloud.nix

@@ -593,20 +593,19 @@ in {
               fastcgi_read_timeout 120s;
             '';
           };
-          "~ \\.(?:css|js|svg|gif|map)$".extraConfig = ''
+          "~ \\.(?:css|js|woff2?|svg|gif|map)$".extraConfig = ''
             try_files $uri /index.php$request_uri;
             expires 6M;
             access_log off;
           '';
-          "~ \\.woff2?$".extraConfig = ''
-            try_files $uri /index.php$request_uri;
-            expires 7d;
-            access_log off;
-          '';
           "~ ^\\/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = ''
             try_files $uri/ =404;
             index index.php;
           '';
+          "~ \\.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$".extraConfig = ''
+            try_files $uri /index.php$request_uri;
+            access_log off;
+          '';
         };
         extraConfig = ''
           index index.php index.html /index.php$request_uri;

third_party/nixpkgs/nixos/modules/services/x11/desktop-managers/gnome3.nix

@@ -374,7 +374,9 @@ in
         baobab
         cheese
         eog
-        epiphany
+        /* Not in good standing on nixos:
+         * https://github.com/NixOS/nixpkgs/issues/98819
+        /* epiphany */
         gedit
         gnome-calculator
         gnome-calendar

third_party/nixpkgs/nixos/modules/services/x11/display-managers/default.nix

@@ -481,6 +481,13 @@ in
             )
             [dms wms]
           );
+
+    # Make xsessions and wayland sessions installed at
+    # /run/current-system/sw/share as some programs
+    # have behavior that depends on them being installed
+    environment.systemPackages = [
+      cfg.displayManager.sessionData.desktops
+    ];
   };
 
   imports = [

third_party/nixpkgs/nixos/modules/tasks/network-interfaces.nix

@@ -391,6 +391,10 @@ in
         end with a letter or digit, and have as interior characters only
         letters, digits, and hyphen. The maximum length is 63 characters.
         Additionally it is recommended to only use lower-case characters.
+        If (e.g. for legacy reasons) a FQDN is required as the Linux kernel
+        network node hostname (uname --nodename) the option
+        boot.kernel.sysctl."kernel.hostname" can be used as a workaround (but
+        the 64 character limit still applies).
       '';
     };
 
@@ -470,7 +474,7 @@ in
 
     networking.search = mkOption {
       default = [];
-      example = [ "example.com" "local.domain" ];
+      example = [ "example.com" "home.arpa" ];
       type = types.listOf types.str;
       description = ''
         The list of search paths used when resolving domain names.
@@ -479,7 +483,7 @@ in
 
     networking.domain = mkOption {
       default = null;
-      example = "home";
+      example = "home.arpa";
       type = types.nullOr types.str;
       description = ''
         The domain.  It can be left empty if it is auto-detected through DHCP.

third_party/nixpkgs/nixos/tests/agda.nix

@@ -31,7 +31,7 @@ in
     machine.succeed('echo "import IO" > TestIO.agda')
     machine.succeed("agda -l standard-library -i . TestIO.agda")
 
-    # # Hello world
+    # Hello world
     machine.succeed(
         "cp ${hello-world} HelloWorld.agda"
     )

third_party/nixpkgs/nixos/tests/all-tests.nix

@@ -44,6 +44,7 @@ in
   caddy = handleTest ./caddy.nix {};
   cadvisor = handleTestOn ["x86_64-linux"] ./cadvisor.nix {};
   cage = handleTest ./cage.nix {};
+  cagebreak = handleTest ./cagebreak.nix {};
   cassandra = handleTest ./cassandra.nix {};
   ceph-single-node = handleTestOn ["x86_64-linux"] ./ceph-single-node.nix {};
   ceph-multi-node = handleTestOn ["x86_64-linux"] ./ceph-multi-node.nix {};

third_party/nixpkgs/nixos/tests/cagebreak.nix

@@ -0,0 +1,98 @@
+import ./make-test-python.nix ({ pkgs, lib, ...} :
+
+let
+  cagebreakConfigfile = pkgs.writeText "config" ''
+    workspaces 1
+    escape C-t
+    bind t exec env DISPLAY=:0 ${pkgs.xterm}/bin/xterm -cm -pc
+    bind a exec ${pkgs.alacritty}/bin/alacritty
+  '';
+in
+{
+  name = "cagebreak";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ berbiche ];
+  };
+
+  machine = { config, ... }:
+  let
+    alice = config.users.users.alice;
+  in {
+    imports = [ ./common/user-account.nix ];
+
+    environment.systemPackages = [ pkgs.cagebreak ];
+    services.xserver = {
+      enable = true;
+      displayManager.autoLogin = {
+        enable = true;
+        user = alice.name;
+      };
+    };
+    services.xserver.windowManager.session = lib.singleton {
+      manage = "desktop";
+      name = "cagebreak";
+      start = ''
+        export XDG_RUNTIME_DIR=/run/user/${toString alice.uid}
+        ${pkgs.cagebreak}/bin/cagebreak &
+        waitPID=$!
+      '';
+    };
+
+    systemd.services.setupCagebreakConfig = {
+      wantedBy = [ "multi-user.target" ];
+      before = [ "multi-user.target" ];
+      environment = {
+        HOME = alice.home;
+      };
+      unitConfig = {
+        type = "oneshot";
+        RemainAfterExit = true;
+        user = alice.name;
+      };
+      script = ''
+        cd $HOME
+        CONFFILE=$HOME/.config/cagebreak/config
+        mkdir -p $(dirname $CONFFILE)
+        cp ${cagebreakConfigfile} $CONFFILE
+      '';
+    };
+
+    # Copied from cage:
+    # this needs a fairly recent kernel, otherwise:
+    #   [backend/drm/util.c:215] Unable to add DRM framebuffer: No such file or directory
+    #   [backend/drm/legacy.c:15] Virtual-1: Failed to set CRTC: No such file or directory
+    #   [backend/drm/util.c:215] Unable to add DRM framebuffer: No such file or directory
+    #   [backend/drm/legacy.c:15] Virtual-1: Failed to set CRTC: No such file or directory
+    #   [backend/drm/drm.c:618] Failed to initialize renderer on connector 'Virtual-1': initial page-flip failed
+    #   [backend/drm/drm.c:701] Failed to initialize renderer for plane
+    boot.kernelPackages = pkgs.linuxPackages_latest;
+
+    virtualisation.memorySize = 1024;
+  };
+
+  enableOCR = true;
+
+  testScript = { nodes, ... }: let
+    user = nodes.machine.config.users.users.alice;
+  in ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_file("/run/user/${toString user.uid}/wayland-0")
+
+    with subtest("ensure wayland works with alacritty"):
+        machine.send_key("ctrl-t")
+        machine.send_key("a")
+        machine.wait_until_succeeds("pgrep alacritty")
+        machine.wait_for_text("alice@machine")
+        machine.screenshot("screen")
+        machine.send_key("ctrl-d")
+
+    with subtest("ensure xwayland works with xterm"):
+        machine.send_key("ctrl-t")
+        machine.send_key("t")
+        machine.wait_until_succeeds("pgrep xterm")
+        machine.wait_for_text("alice@machine")
+        machine.screenshot("screen")
+        machine.send_key("ctrl-d")
+  '';
+})

third_party/nixpkgs/nixos/tests/mediatomb.nix

@@ -0,0 +1,81 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+{
+  name = "mediatomb";
+
+  nodes = {
+    serverGerbera =
+      { ... }:
+      let port = 49152;
+      in {
+        imports = [ ../modules/profiles/minimal.nix ];
+        services.mediatomb = {
+          enable = true;
+          serverName = "Gerbera";
+          package = pkgs.gerbera;
+          interface = "eth1";  # accessible from test
+          openFirewall = true;
+          mediaDirectories = [
+            { path = "/var/lib/gerbera/pictures"; recursive = false; hidden-files = false; }
+            { path = "/var/lib/gerbera/audio"; recursive = true; hidden-files = false; }
+          ];
+        };
+      };
+
+    serverMediatomb =
+      { ... }:
+      let port = 49151;
+      in {
+        imports = [ ../modules/profiles/minimal.nix ];
+        services.mediatomb = {
+          enable = true;
+          serverName = "Mediatomb";
+          package = pkgs.mediatomb;
+          interface = "eth1";
+          inherit port;
+          mediaDirectories = [
+            { path = "/var/lib/mediatomb/pictures"; recursive = false; hidden-files = false; }
+            { path = "/var/lib/mediatomb/audio"; recursive = true; hidden-files = false; }
+          ];
+        };
+        networking.firewall.interfaces.eth1 = {
+          allowedUDPPorts = [ 1900 port ];
+          allowedTCPPorts = [ port ];
+        };
+      };
+
+      client = { ... }: { };
+  };
+
+  testScript =
+  ''
+    start_all()
+
+    port = 49151
+    serverMediatomb.succeed("mkdir -p /var/lib/mediatomb/{pictures,audio}")
+    serverMediatomb.succeed("chown -R mediatomb:mediatomb /var/lib/mediatomb")
+    serverMediatomb.wait_for_unit("mediatomb")
+    serverMediatomb.wait_for_open_port(port)
+    serverMediatomb.succeed(f"curl --fail http://serverMediatomb:{port}/")
+    page = client.succeed(f"curl --fail http://serverMediatomb:{port}/")
+    assert "MediaTomb" in page and "Gerbera" not in page
+    serverMediatomb.shutdown()
+
+    port = 49152
+    serverGerbera.succeed("mkdir -p /var/lib/mediatomb/{pictures,audio}")
+    serverGerbera.succeed("chown -R mediatomb:mediatomb /var/lib/mediatomb")
+    # service running gerbera fails the first time claiming something is already bound
+    # gerbera[715]: 2020-07-18 23:52:14   info: Please check if another instance of Gerbera or
+    # gerbera[715]: 2020-07-18 23:52:14   info: another application is running on port TCP 49152 or UDP 1900.
+    # I did not find anything so here I work around this
+    serverGerbera.succeed("sleep 2")
+    serverGerbera.wait_until_succeeds("systemctl restart mediatomb")
+    serverGerbera.wait_for_unit("mediatomb")
+    serverGerbera.succeed(f"curl --fail http://serverGerbera:{port}/")
+    page = client.succeed(f"curl --fail http://serverGerbera:{port}/")
+    assert "Gerbera" in page and "MediaTomb" not in page
+
+    serverGerbera.shutdown()
+    client.shutdown()
+  '';
+})

third_party/nixpkgs/nixos/tests/mumble.nix

@@ -5,6 +5,12 @@ let
     imports = [ ./common/x11.nix ];
     environment.systemPackages = [ pkgs.mumble ];
   };
+
+  # outside of tests, this file should obviously not come from the nix store
+  envFile = pkgs.writeText "nixos-test-mumble-murmurd.env" ''
+    MURMURD_PASSWORD=testpassword
+  '';
+
 in
 {
   name = "mumble";
@@ -14,8 +20,10 @@ in
 
   nodes = {
     server = { config, ... }: {
-      services.murmur.enable       = true;
+      services.murmur.enable = true;
       services.murmur.registerName = "NixOS tests";
+      services.murmur.password = "$MURMURD_PASSWORD";
+      services.murmur.environmentFile = envFile;
       networking.firewall.allowedTCPPorts = [ config.services.murmur.port ];
     };
 
@@ -30,8 +38,8 @@ in
     client1.wait_for_x()
     client2.wait_for_x()
 
-    client1.execute("mumble mumble://client1\@server/test &")
+    client1.execute("mumble mumble://client1:testpassword\@server/test &")
-    client2.execute("mumble mumble://client2\@server/test &")
+    client2.execute("mumble mumble://client2:testpassword\@server/test &")
 
     # cancel client audio configuration
     client1.wait_for_window(r"Audio Tuning Wizard")
@@ -63,8 +71,12 @@ in
     client2.send_chars("y")
 
     # Find clients in logs
-    server.wait_until_succeeds("journalctl -eu murmur -o cat | grep -q client1")
+    server.wait_until_succeeds(
-    server.wait_until_succeeds("journalctl -eu murmur -o cat | grep -q client2")
+        "journalctl -eu murmur -o cat | grep -q 'client1.\+Authenticated'"
+    )
+    server.wait_until_succeeds(
+        "journalctl -eu murmur -o cat | grep -q 'client2.\+Authenticated'"
+    )
 
     server.sleep(5)  # wait to get screenshot
     client1.screenshot("screen1")

third_party/nixpkgs/pkgs/applications/audio/carla/default.nix

@@ -15,13 +15,13 @@ assert withGtk3 -> gtk3 != null;
 
 stdenv.mkDerivation rec {
   pname = "carla";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "falkTX";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0c3y4a6cgi4bv1mg57i3qn5ia6pqjqlaylvkapj6bmpsw71ig22g";
+    sha256 = "B4xoRuNEW4Lz9haP8fqxOTcysGTNEXFOq9UXqUJLSFw=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/audio/friture/default.nix

@@ -32,9 +32,8 @@ in py.buildPythonApplication rec {
     ./unlock_constraints.patch
   ];
 
-  postFixup = ''
+  preFixup = ''
-    wrapQtApp $out/bin/friture
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
-    wrapQtApp $out/bin/.friture-wrapped
   '';
 
   meta = with lib; {

third_party/nixpkgs/pkgs/applications/audio/helio-workstation/default.nix

@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "helio-workstation";
-  version = "2.2";
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner = "helio-fm";
     repo = pname;
     rev = version;
     fetchSubmodules = true;
-    sha256 = "16iwj4mjs1nm8dlk70q97svp3vkcgs7hdj9hfda9h67acn4a8vvk";
+    sha256 = "10pna4k43g648gapviykq2zk82iwy5rqff4lbfh5vzxqpg5v4ma6";
   };
 
   buildInputs = [
@@ -22,7 +22,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig makeWrapper ];
 
-  preBuild = "cd Projects/LinuxMakefile";
+  preBuild = ''
+    cd Projects/LinuxMakefile
+    substituteInPlace Makefile --replace alsa "alsa jack"
+  '';
   buildFlags = [ "CONFIG=Release64" ];
 
   installPhase = ''

third_party/nixpkgs/pkgs/applications/audio/mellowplayer/default.nix

@@ -14,13 +14,13 @@
 
 mkDerivation rec {
   pname = "MellowPlayer";
-  version = "3.6.5";
+  version = "3.6.6";
 
   src = fetchFromGitLab {
     owner = "ColinDuquesnoy";
     repo = "MellowPlayer";
     rev = version;
-    sha256 = "1fnfqyy52hnh9vwq4rcndcqwh0zsm1sd3vi4h5gzaj4zbniq5v2f";
+    sha256 = "14y175fl6wg04fz0fhx553r8z3nwqrs2lr3rdls70bhwx5x6lavw";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];

third_party/nixpkgs/pkgs/applications/audio/munt/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, mkDerivation, fetchFromGitHub, cmake, qtbase, alsaLib, makeDesktopItem }:
+{ stdenv, mkDerivation, fetchFromGitHub, cmake, qtbase, alsaLib, makeDesktopItem, libjack2 }:
 
 let
   desktopItem = makeDesktopItem rec {
@@ -9,14 +9,14 @@ let
     categories = "Audio;AudioVideo;";
   };
 in mkDerivation rec {
-  version = "2.4.0";
+  version = "2.4.1";
   pname = "munt";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = with stdenv.lib.versions; "libmt32emu_${major version}_${minor version}_${patch version}";
-    sha256 = "0521i7js5imlsxj6n7181w5szfjikam0k4vq1d2ilkqgcwrkg6ln";
+    sha256 = "0bszhkbz24hhx32f973l6h5lkyn4lxhqrckiwmv765d1sba8n5bk";
   };
 
   postInstall = ''
@@ -26,7 +26,7 @@ in mkDerivation rec {
   dontFixCmake = true;
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ qtbase alsaLib ];
+  buildInputs = [ qtbase alsaLib libjack2 ];
 
   meta = with stdenv.lib; {
     description = "Multi-platform software synthesiser emulating Roland MT-32, CM-32L, CM-64 and LAPC-I devices";

third_party/nixpkgs/pkgs/applications/audio/picard/default.nix

@@ -58,7 +58,7 @@ in pythonPackages.buildPythonApplication rec {
     homepage = "https://picard.musicbrainz.org/";
     description = "The official MusicBrainz tagger";
     maintainers = with maintainers; [ ehmry ];
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.all;
   };
 }

third_party/nixpkgs/pkgs/applications/audio/puddletag/default.nix

@@ -30,5 +30,6 @@ python3Packages.buildPythonApplication rec {
     license = licenses.gpl3;
     maintainers = with maintainers; [ peterhoeg ];
     platforms = platforms.linux;
+    broken = true; # Needs Qt wrapping
   };
 }

third_party/nixpkgs/pkgs/applications/audio/soundkonverter/default.nix

@@ -3,7 +3,7 @@
   mkDerivation, fetchFromGitHub, fetchpatch, lib, makeWrapper,
   cmake, extra-cmake-modules, pkgconfig,
   libkcddb, kconfig, kconfigwidgets, ki18n, kdelibs4support, kio, solid, kwidgetsaddons, kxmlgui,
-  qtbase, phonon, 
+  qtbase, phonon,
   taglib,
   # optional backends
   withCD ? true, cdparanoia,
@@ -43,7 +43,7 @@ let runtimeDeps = []
     ++ lib.optionals withMp3 [ lame mp3gain ]
     ++ lib.optionals withAac [  faad2 aacgain ];
 
-in 
+in
 mkDerivation rec {
   name = "soundkonverter";
   version = "3.0.1";
@@ -67,7 +67,7 @@ mkDerivation rec {
   propagatedBuildInputs = [ libkcddb kconfig kconfigwidgets ki18n kdelibs4support kio solid kwidgetsaddons kxmlgui qtbase phonon];
   buildInputs = [ taglib ] ++ runtimeDeps;
   # encoder plugins go to ${out}/lib so they're found by kbuildsycoca5
-  cmakeFlags = [ "-DCMAKE_INSTALL_PREFIX=$out" ]; 
+  cmakeFlags = [ "-DCMAKE_INSTALL_PREFIX=$out" ];
   sourceRoot = "source/src";
   # add runt-time deps to PATH
   postInstall = ''
@@ -79,26 +79,26 @@ mkDerivation rec {
     description = "Audio file converter, CD ripper and Replay Gain tool";
     longDescription = ''
       soundKonverter is a frontend to various audio converters.
-      
+
       The key features are:
       - Audio file conversion
       - Replay Gain calculation
       - CD ripping
-      
+
       soundKonverter supports reading and writing tags and covers for many formats, so they are preserved when converting files.
-      
+
       It is extendable by plugins and supports many backends including:
-      
+
       - Audio file conversion
         Backends: faac, faad, ffmpeg, flac, lame, mplayer, neroaac, timidity, fluidsynth, vorbistools, opustools, sox, twolame,
         flake, mac, shorten, wavpack and speex
         Formats: ogg vorbis, mp3, flac, wma, aac, ac3, opus, alac, mp2, als, amr nb, amr wb, ape, speex, m4a, mp1, musepack shorten,
         tta, wavpack, ra, midi, mod, 3gp, rm, avi, mkv, ogv, mpeg, mov, mp4, flv, wmv and rv
-      
+
       - Replay Gain calculation
         Backends: aacgain, metaflac, mp3gain, vorbisgain, wvgain, mpcgain
         Formats: aac, mp3, flac, ogg vorbis, wavpack, musepack
-      
+
       - CD ripping
         Backends: cdparanoia
       '';

third_party/nixpkgs/pkgs/applications/backup/vorta/default.nix

@@ -28,8 +28,8 @@ buildPythonApplication rec {
   # QT setup in tests broken.
   doCheck = false;
 
-  postFixup = ''
+  preFixup = ''
-    wrapQtApp $out/bin/vorta
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
   '';
 
   meta = with lib; {

third_party/nixpkgs/pkgs/applications/blockchains/monero-gui/default.nix

@@ -1,62 +1,87 @@
 { stdenv, wrapQtAppsHook, makeDesktopItem
-, fetchFromGitHub, qmake, qttools, pkgconfig
+, fetchFromGitHub
+, cmake, qttools, pkgconfig
 , qtbase, qtdeclarative, qtgraphicaleffects
 , qtmultimedia, qtxmlpatterns
 , qtquickcontrols, qtquickcontrols2
-, monero, unbound, readline, boost, libunwind
+, monero, miniupnpc, unbound, readline
-, libsodium, pcsclite, zeromq, libgcrypt, libgpgerror
+, boost, libunwind, libsodium, pcsclite
-, hidapi, libusb-compat-0_1, protobuf, randomx
+, randomx, zeromq, libgcrypt, libgpgerror
+, hidapi, rapidjson
+, trezorSupport ? true
+,   libusb1  ? null
+,   protobuf ? null
+,   python3  ? null
 }:
 
 with stdenv.lib;
 
+assert trezorSupport -> all (x: x!=null) [ libusb1 protobuf python3 ];
+
+let
+  arch = if stdenv.isx86_64  then "x86-64"
+    else if stdenv.isi686    then "i686"
+    else if stdenv.isAarch64 then "armv8-a"
+    else throw "unsupported architecture";
+in
+
 stdenv.mkDerivation rec {
   pname = "monero-gui";
-  version = "0.16.0.3";
+  version = "0.17.0.1";
 
   src = fetchFromGitHub {
     owner  = "monero-project";
     repo   = "monero-gui";
     rev    = "v${version}";
-    sha256 = "0iwjp8x5swy8i8pzrlm5v55awhm54cf48pm1vz98lcq361lhfzk6";
+    sha256 = "1i9a3ampppyzsl4sllbqlr3w43sjpb3fdfxhb1j4n49p8g0jzmf3";
   };
 
-  nativeBuildInputs = [ qmake pkgconfig wrapQtAppsHook ];
+  nativeBuildInputs = [
+    cmake pkgconfig wrapQtAppsHook
+    (getDev qttools)
+  ];
 
   buildInputs = [
     qtbase qtdeclarative qtgraphicaleffects
     qtmultimedia qtquickcontrols qtquickcontrols2
     qtxmlpatterns
-    monero unbound readline libgcrypt libgpgerror
+    monero miniupnpc unbound readline
-    boost libunwind libsodium pcsclite zeromq
+    randomx libgcrypt libgpgerror
-    hidapi libusb-compat-0_1 protobuf randomx
+    boost libunwind libsodium pcsclite
-  ];
+    zeromq hidapi rapidjson
+  ] ++ optionals trezorSupport [ libusb1 protobuf python3 ];
 
-  NIX_CFLAGS_COMPILE = [ "-Wno-error=format-security" ];
+  postUnpack = ''
+    # copy monero sources here
+    # (needs to be writable)
+    cp -r ${monero.source}/* source/monero
+    chmod -R +w source/monero
+  '';
 
   patches = [ ./move-log-file.patch ];
 
   postPatch = ''
-    echo '
+    # set monero-gui version
-      var GUI_VERSION = "${version}";
+    substituteInPlace src/version.js.in \
-      var GUI_MONERO_VERSION = "${getVersion monero}";
+       --replace '@VERSION_TAG_GUI@' '${version}'
-    ' > version.js
+
-    substituteInPlace monero-wallet-gui.pro \
+    # remove this line on the next release
-      --replace '$$[QT_INSTALL_BINS]/lrelease' '${getDev qttools}/bin/lrelease'
+    rm cmake/Version.cmake
+
+    # use monerod from the monero package
     substituteInPlace src/daemon/DaemonManager.cpp \
       --replace 'QApplication::applicationDirPath() + "' '"${monero}/bin'
+
+    # only build external deps, *not* the full monero
+    substituteInPlace CMakeLists.txt \
+      --replace 'add_subdirectory(monero)' \
+                'add_subdirectory(monero EXCLUDE_FROM_ALL)'
   '';
 
-  makeFlags = [ "INSTALL_ROOT=$(out)" ];
+  cmakeFlags = [
-
+    "-DCMAKE_INSTALL_PREFIX=$out/bin"
-  preBuild = ''
+    "-DARCH=${arch}"
-    sed -i s#/opt/monero-wallet-gui##g Makefile
+  ];
-    make -C src/zxcvbn-c
-
-    # use nixpkgs monero sources
-    rmdir monero
-    ln -s "${monero.src}" monero
-  '';
 
   desktopItem = makeDesktopItem {
     name = "monero-wallet-gui";
@@ -69,15 +94,15 @@ stdenv.mkDerivation rec {
 
   postInstall = ''
     # install desktop entry
-    mkdir -p $out/share/applications
+    install -Dm644 -t $out/share/applications \
-    cp ${desktopItem}/share/applications/* $out/share/applications
+      ${desktopItem}/share/applications/*
 
     # install icons
     for n in 16 24 32 48 64 96 128 256; do
       size=$n"x"$n
-      mkdir -p $out/share/icons/hicolor/$size/apps
+      install -Dm644 \
-      cp $src/images/appicons/$size.png \
+        -t $out/share/icons/hicolor/$size/apps/monero.png \
-         $out/share/icons/hicolor/$size/apps/monero.png
+        $src/images/appicons/$size.png
     done;
   '';
 

third_party/nixpkgs/pkgs/applications/blockchains/monero/default.nix

@@ -1,40 +1,69 @@
-{ stdenv, fetchFromGitHub
+{ stdenv, fetchFromGitHub, fetchpatch
 , cmake, pkgconfig
 , boost, miniupnpc, openssl, unbound
 , zeromq, pcsclite, readline, libsodium, hidapi
-, protobuf, randomx, rapidjson, libusb-compat-0_1
+, randomx, rapidjson
 , CoreData, IOKit, PCSC
+, trezorSupport ? true
+,   libusb1  ? null
+,   protobuf ? null
+,   python3  ? null
 }:
 
+with stdenv.lib;
+
 assert stdenv.isDarwin -> IOKit != null;
+assert trezorSupport -> all (x: x!=null) [ libusb1 protobuf python3 ];
 
 stdenv.mkDerivation rec {
   pname = "monero";
-  version = "0.16.0.3";
+  version = "0.17.0.1";
 
   src = fetchFromGitHub {
     owner = "monero-project";
     repo = "monero";
     rev = "v${version}";
-    sha256 = "1r9x3712vhb24dxxirfiwj5f9x0h4m7x0ngiiavf5983dfdlgz33";
+    sha256 = "1v0phvg5ralli4dr09a60nq032xqlci5d6v4zfq8304vgrn1ffgp";
     fetchSubmodules = true;
   };
 
+  patches = [
+    ./use-system-libraries.patch
+
+    # This fixes a bug in the monero-gui build system,
+    # remove it once the PR has been merged
+    (fetchpatch {
+      url = "https://github.com/monero-project/monero/pull/6867.patch";
+      sha256 = "0nxa6861df1fadrm9bmhqf2g6mljgr4jndsbxqp7g501hv9z51j3";
+    })
+  ];
+
+  postPatch = ''
+    # remove vendored libraries
+    rm -r external/{miniupnp,randomx,rapidjson,unbound}
+    # export patched source for monero-gui
+    cp -r . $source
+  '';
+
   nativeBuildInputs = [ cmake pkgconfig ];
 
   buildInputs = [
     boost miniupnpc openssl unbound
     zeromq pcsclite readline
     libsodium hidapi randomx rapidjson
-    protobuf libusb-compat-0_1
+    protobuf
-  ] ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit CoreData PCSC ];
+  ] ++ optionals stdenv.isDarwin [ IOKit CoreData PCSC ]
+    ++ optionals trezorSupport [ libusb1 protobuf python3 ];
 
   cmakeFlags = [
     "-DCMAKE_BUILD_TYPE=Release"
     "-DUSE_DEVICE_TREZOR=ON"
     "-DBUILD_GUI_DEPS=ON"
     "-DReadline_ROOT_DIR=${readline.dev}"
-  ] ++ stdenv.lib.optional stdenv.isDarwin "-DBoost_USE_MULTITHREADED=OFF";
+    "-DRandomX_ROOT_DIR=${randomx}"
+  ] ++ optional stdenv.isDarwin "-DBoost_USE_MULTITHREADED=OFF";
+
+  outputs = [ "out" "source" ];
 
   meta = with stdenv.lib; {
     description = "Private, secure, untraceable currency";

third_party/nixpkgs/pkgs/applications/blockchains/monero/use-system-libraries.patch

@@ -0,0 +1,69 @@
+diff --git a/external/CMakeLists.txt b/external/CMakeLists.txt
+index a8916a7d0..39ec7747b 100644
+--- a/external/CMakeLists.txt
++++ b/external/CMakeLists.txt
+@@ -37,34 +37,16 @@
+ 
+ find_package(Miniupnpc REQUIRED)
+ 
+-message(STATUS "Using in-tree miniupnpc")
+-add_subdirectory(miniupnp/miniupnpc)
+-set_property(TARGET libminiupnpc-static PROPERTY FOLDER "external")
+-if(MSVC)
+-  set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -wd4244 -wd4267")
+-elseif(NOT MSVC)
+-  set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -Wno-undef -Wno-unused-result -Wno-unused-value")
+-endif()
+-if(CMAKE_SYSTEM_NAME MATCHES "NetBSD")
+-	set_property(TARGET libminiupnpc-static APPEND_STRING PROPERTY COMPILE_FLAGS " -D_NETBSD_SOURCE")
+-endif()
+-
+-set(UPNP_LIBRARIES "libminiupnpc-static" PARENT_SCOPE)
++set(UPNP_STATIC false PARENT_SCOPE)
++set(UPNP_INCLUDE ${MINIUPNP_INCLUDE_DIR} PARENT_SCOPE)
++set(UPNP_LIBRARIES ${MINIUPNP_LIBRARY} PARENT_SCOPE)
+ 
+ find_package(Unbound)
+ 
+ if(NOT UNBOUND_INCLUDE_DIR OR STATIC)
+-  # NOTE: If STATIC is true, CMAKE_FIND_LIBRARY_SUFFIXES has been reordered.
+-  # unbound has config tests which used OpenSSL libraries, so -ldl may need to
+-  # be set in this case.
+-  # The unbound CMakeLists.txt can set it, since it's also needed for the
+-  # static OpenSSL libraries set up there after with target_link_libraries.
+-  add_subdirectory(unbound)
+-
+-  set(UNBOUND_STATIC true PARENT_SCOPE)
+-  set(UNBOUND_INCLUDE "${CMAKE_CURRENT_SOURCE_DIR}/unbound/libunbound" PARENT_SCOPE)
+-  set(UNBOUND_LIBRARY "unbound" PARENT_SCOPE)
+-  set(UNBOUND_LIBRARY_DIRS "${LIBEVENT2_LIBDIR}" PARENT_SCOPE)
++  set(UNBOUND_STATIC false PARENT_SCOPE)
++  set(UPNP_INCLUDE ${MINIUPNP_INCLUDE_DIR} PARENT_SCOPE)
++  set(UPNP_LIBRARIES ${MINIUPNP_LIBRARY} PARENT_SCOPE)
+ else()
+   message(STATUS "Found libunbound include (unbound.h) in ${UNBOUND_INCLUDE_DIR}")
+   if(UNBOUND_LIBRARIES)
+@@ -81,4 +63,5 @@ endif()
+ add_subdirectory(db_drivers)
+ add_subdirectory(easylogging++)
+ add_subdirectory(qrcodegen)
+-add_subdirectory(randomx EXCLUDE_FROM_ALL)
++
++find_library(RANDOMX_LIBRARIES NAMES RandomX)
+diff --git a/src/p2p/net_node.inl b/src/p2p/net_node.inl
+index 175741146..088b582f7 100644
+--- a/src/p2p/net_node.inl
++++ b/src/p2p/net_node.inl
+@@ -60,9 +60,9 @@
+ #include "cryptonote_core/cryptonote_core.h"
+ #include "net/parse.h"
+ 
+-#include <miniupnp/miniupnpc/miniupnpc.h>
+-#include <miniupnp/miniupnpc/upnpcommands.h>
+-#include <miniupnp/miniupnpc/upnperrors.h>
++#include <miniupnpc/miniupnpc.h>
++#include <miniupnpc/upnpcommands.h>
++#include <miniupnpc/upnperrors.h>
+ 
+ #undef MONERO_DEFAULT_LOG_CATEGORY
+ #define MONERO_DEFAULT_LOG_CATEGORY "net.p2p"

third_party/nixpkgs/pkgs/applications/editors/android-studio/default.nix

@@ -9,9 +9,9 @@ let
     inherit buildFHSUserEnv;
   };
   stableVersion = {
-    version = "4.0.1.0"; # "Android Studio 4.0.1"
+    version = "4.0.2.0"; # "Android Studio 4.0.2"
-    build = "193.6626763";
+    build = "193.6821437";
-    sha256Hash = "15vm7fvi8c286wx9f28z6ysvm8wqqda759qql0zy9simwx22gy7j";
+    sha256Hash = "sha256-v3lug8XCl4tekMBP4N1wS925FnDaSMDf6SIJhwKydzY=";
   };
   betaVersion = {
     version = "4.1.0.18"; # "Android Studio 4.1 RC 3"

third_party/nixpkgs/pkgs/applications/editors/atom/default.nix

@@ -85,7 +85,7 @@ let
       description = "A hackable text editor for the 21st Century";
       homepage = "https://atom.io/";
       license = licenses.mit;
-      maintainers = with maintainers; [ offline nequissimus ysndr ];
+      maintainers = with maintainers; [ offline ysndr ];
       platforms = platforms.x86_64;
     };
   };

third_party/nixpkgs/pkgs/applications/editors/glow/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "glow";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "glow";
     rev = "v${version}";
-    sha256 = "0cgi7rz5al5smjsna9p2v5zxjn3lwpnhd38vpr1qhz8n0z37vss5";
+    sha256 = "05scgdivb0hf0lfznikn20b6pgb479jhs24hgf5f5i60v37v930y";
   };
 
   vendorSha256 = "180g6d9w3lfmxj4843kqvq4ikg8lwmwprgfxdgz1lzvjmbfjj3g9";

third_party/nixpkgs/pkgs/applications/editors/nano/default.nix

@@ -20,11 +20,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "nano";
-  version = "5.2";
+  version = "5.3";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    sha256 = "1qd7pn9g5dgzbfg4fb3nqxqgi2iqq0g6x33x8d1mx6mfw51xmhij";
+    sha256 = "0lj3fcfzprmv9raydx8yq25lw81bs6g40rhd0fv9d6idcb7wphf5";
   };
 
   nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;

third_party/nixpkgs/pkgs/applications/editors/nano/nanorc/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "nanorc";
-  version = "2018-09-05";
+  version = "2020-01-25";
 
   src = fetchFromGitHub {
     owner = "scopatz";
     repo = "nanorc";
-    rev = "1e589cb729d24fba470228d429e6dde07973d597";
+    rev = "2020.1.25";
-    sha256 = "136yxr38lzrfv8bar0c6c56rh54q9s94zpwa19f425crh44drppl";
+    sha256 = "1y8jk3jsl4bd6r4hzmxzcf77hv8bwm0318yv7y2npkkd3a060z8d";
   };
 
   dontBuild = true;

third_party/nixpkgs/pkgs/applications/editors/retext/default.nix

@@ -46,11 +46,13 @@ in python.pkgs.buildPythonApplication {
   propagatedBuildInputs = [ pythonEnv ];
 
   postInstall = ''
-    wrapQtApp "$out/bin/retext" \
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
-      --set ASPELL_CONF "dict-dir ${buildEnv {
+    makeWrapperArgs+=(
+      "--set" "ASPELL_CONF" "dict-dir ${buildEnv {
         name = "aspell-all-dicts";
         paths = map (path: "${path}/lib/aspell") enchantAspellDicts;
       }}"
+    )
   '';
 
   meta = with stdenv.lib; {

third_party/nixpkgs/pkgs/applications/editors/vscode/vscode.nix

@@ -11,8 +11,8 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "103p0daf13zsqz2481pw6zpr6n0vaf57dq89i4djcm449i9c959i";
+    x86_64-linux = "12nrv037an4f6h8hrbmysc0lk5wm492hywa7lp64n4d308zg5567";
-    x86_64-darwin = "0bxggvi0wzsy801iylszqp8rv6kij6j2v05b6qyf6af7j3cmd1qf";
+    x86_64-darwin = "1z22hn2ngx2x5l9h6zsblpyzr85lyjzv2ayplscbgaa9ff52l429";
   }.${system};
 in
   callPackage ./generic.nix rec {
@@ -21,7 +21,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.49.3";
+    version = "1.50.0";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";

third_party/nixpkgs/pkgs/applications/gis/qgis/unwrapped.nix

@@ -10,7 +10,7 @@ let
     [ qscintilla-qt5 gdal jinja2 numpy psycopg2
       chardet dateutil pyyaml pytz requests urllib3 pygments pyqt5 sip owslib six ];
 in mkDerivation rec {
-  version = "3.10.9";
+  version = "3.10.10";
   pname = "qgis";
   name = "${pname}-unwrapped-${version}";
 
@@ -18,7 +18,7 @@ in mkDerivation rec {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "0d646hvrhhgsw789qc2g3iblmsvr64qh15jck1jkaljzrj3qbml6";
+    sha256 = "yZBG+bpJA7iKkUEjVo45d+bmRp9WS7mk8z96FLf0ZQ0=";
   };
 
   passthru = {

third_party/nixpkgs/pkgs/applications/gis/zombietrackergps/default.nix

@@ -0,0 +1,57 @@
+{ mkDerivation
+, lib
+, fetchFromGitLab
+, qmake
+, qtbase
+, qtcharts
+, qtsvg
+, marble
+, qtwebengine
+, ldutils
+}:
+
+mkDerivation rec {
+  pname = "zombietrackergps";
+  version = "1.01";
+
+  src = fetchFromGitLab {
+    owner = "ldutils-projects";
+    repo = pname;
+    rev = "v_${version}";
+    sha256 = "0h354ydbahy8rpkmzh5ym5bddbl6irjzklpcg6nbkv6apry84d48";
+  };
+
+  buildInputs = [
+    ldutils
+    qtbase
+    qtcharts
+    qtsvg
+    marble.dev
+    qtwebengine
+  ];
+
+  nativeBuildInputs = [
+    qmake
+  ];
+
+  prePatch = ''
+    sed -ie "s,INCLUDEPATH += /usr/include/libldutils,INCLUDEPATH += ${ldutils}," ZombieTrackerGPS.pro
+  '';
+
+  preConfigure = ''
+    export LANG=en_US.UTF-8
+    export INSTALL_ROOT=$out
+  '';
+
+  postConfigure = ''
+    substituteInPlace Makefile --replace '$(INSTALL_ROOT)' ""
+  '';
+
+  meta = with lib; {
+    description = "GPS track manager for Qt using KDE Marble maps";
+    homepage = "https://gitlab.com/ldutils-projects/zombietrackergps";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ sohalt ];
+    platforms = platforms.linux;
+  };
+}

third_party/nixpkgs/pkgs/applications/graphics/c3d/default.nix

@@ -1,13 +1,14 @@
-{ stdenv, fetchgit, cmake, itk4, Cocoa }:
+{ stdenv, fetchFromGitHub, cmake, itk4, Cocoa }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname   = "c3d";
-  version = "unstable-2019-10-22";
+  version = "unstable-2020-10-05";
 
-  src = fetchgit {
+  src = fetchFromGitHub {
-    url    = "https://github.com/pyushkevich/c3d";
+    owner = "pyushkevich";
-    rev    = "c04e2b84568654665c64d8843378c8bbd58ba9b0";
+    repo = pname;
-    sha256 = "0lzldxvshl9q362mg76byc7s5zc9qx7mxf2wgyij5vysx8mihx3q";
+    rev = "0a87e3972ea403babbe2d05ec6d50855e7c06465";
+    sha256 = "0wsmkifqrcfy13fnwvinmnq1m0lkqmpyg7bgbwnb37mbrlbq06wf";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -15,11 +16,11 @@ stdenv.mkDerivation {
     ++ stdenv.lib.optional stdenv.isDarwin Cocoa;
 
   meta = with stdenv.lib; {
-    homepage = "http://www.itksnap.org/c3d";
+    homepage = "https://github.com/pyushkevich/c3d";
     description = "Medical imaging processing tool";
     maintainers = with maintainers; [ bcdarwin ];
     platforms = platforms.unix;
-    license = licenses.gpl2;
+    license = licenses.gpl3;
     broken = stdenv.isAarch64;
     # /build/git-3453f61/itkextras/OneDimensionalInPlaceAccumulateFilter.txx:311:10: fatal error: xmmintrin.h: No such file or directory
   };

third_party/nixpkgs/pkgs/applications/graphics/cq-editor/default.nix

@@ -2,6 +2,7 @@
 , mkDerivationWith
 , python3Packages
 , fetchFromGitHub
+, wrapQtAppsHook
 }:
 
 mkDerivationWith python3Packages.buildPythonApplication rec {
@@ -27,8 +28,9 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
     requests
   ];
 
-  postFixup = ''
+  nativeBuildInputs = [ wrapQtAppsHook ];
-    wrapQtApp "$out/bin/cq-editor"
+  preFixup = ''
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
   '';
 
   checkInputs = with python3Packages; [

third_party/nixpkgs/pkgs/applications/graphics/f3d/default.nix

@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitLab, cmake, vtk_9, libX11, libGL, Cocoa, OpenGL }:
+
+stdenv.mkDerivation rec {
+  pname = "f3d";
+  version = "1.0.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.kitware.com";
+    owner = "f3d";
+    repo = "f3d";
+    rev = "v${version}";
+    sha256 = "0a6r0jspkhl735f6zmnhby1g4dlmjqd5izgsp5yfdcdhqj4j63mg";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [ vtk_9 ]
+    ++ stdenv.lib.optionals stdenv.isLinux [ libGL libX11 ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ Cocoa OpenGL ];
+
+  meta = with stdenv.lib; {
+    description = "Fast and minimalist 3D viewer using VTK";
+    homepage = "https://kitware.github.io/F3D";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ bcdarwin ];
+    platforms = with platforms; unix;
+  };
+}

third_party/nixpkgs/pkgs/applications/graphics/gimp/default.nix

@@ -52,13 +52,13 @@ let
   python = python2.withPackages (pp: [ pp.pygtk ]);
 in stdenv.mkDerivation rec {
   pname = "gimp";
-  version = "2.10.20";
+  version = "2.10.22";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "http://download.gimp.org/pub/gimp/v${lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "4S+fh0saAHxCd7YKqB4LZzML5+YVPldJ6tg5uQL8ezw=";
+    sha256 = "1fqqyshakvdarf1jipk2n33ibqr23ni22z3d8srq13bpydblpf1d";
   };
 
   patches = [

third_party/nixpkgs/pkgs/applications/graphics/lazpaint/default.nix

@@ -7,24 +7,24 @@ let
   bgrabitmap = fetchFromGitHub {
     owner = "bgrabitmap";
     repo = "bgrabitmap";
-    rev = "v11.1";
+    rev = "v11.2.4";
-    sha256 = "0bcmiiwly4a7w8p3m5iskzvk8rz87qhc0gcijrdvwg87cafd88gz";
+    sha256 = "1zk88crfn07md16wg6af4i8nlx4ikkhxq9gfk49jirwimgwbf1md";
   };
   bgracontrols = fetchFromGitHub {
     owner = "bgrabitmap";
     repo = "bgracontrols";
-    rev = "v6.7.2";
+    rev = "v6.9";
-    sha256 = "0cwxzv0rl6crkf6f67mvga5cn5pyhr6ksm8cqhpxjiqi937dnyxx";
+    sha256 = "0hwjlqlwqs4fqxlgay84hccs1lm3c6i9nmq9sxzrip410mggnjyw";
   };
 in stdenv.mkDerivation rec {
   pname = "lazpaint";
-  version = "7.1.3";
+  version = "7.1.4";
 
   src = fetchFromGitHub {
     owner = "bgrabitmap";
     repo = "lazpaint";
     rev = "v${version}";
-    sha256 = "1sfb5hmhzscz3nv4cmc192jimkg70l4z3q3yxkivhw1hwwsv9cbg";
+    sha256 = "19b0wrjjyvz3g2d2gdsz8ihc1clda5v22yb597an8j9sblp9m0nf";
   };
 
   nativeBuildInputs = [ lazarus fpc makeWrapper ];

third_party/nixpkgs/pkgs/applications/misc/ArchiSteamFarm/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ArchiSteamFarm";
-  version = "4.2.4.0";
+  version = "4.3.0.6";
 
   src = fetchurl {
     url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-generic.zip";
-    sha256 = "1nkbyy9gnp8nkr04bbiapwvv2nspnl36fvnzjwaq4a13mj49m5zq";
+    sha256 = "1i8cb9j1dk2ikrdr11gah48wrsmw52gj70pv7yml1pzb435madm8";
   };
 
   nativeBuildInputs = [ unzip makeWrapper jq ];

third_party/nixpkgs/pkgs/applications/misc/charm/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "charm";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "charm";
     rev = "v${version}";
-    sha256 =  "1hgw3sxh7ary75286051v5xmdcw70ns1fm7m5nkqz04cx113hlwj";
+    sha256 = "1nbix7fi6g9jadak5zyx7fdz7d6367aly6fnrs0v98zsl1kxyvx3";
   };
 
   vendorSha256 = "0lhml6m0j9ksn09j7z4d9pix5aszhndpyqajycwj3apvi3ic90il";

third_party/nixpkgs/pkgs/applications/misc/dbeaver/default.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "dbeaver-ce";
-  version = "7.2.1";
+  version = "7.2.2";
 
   desktopItem = makeDesktopItem {
     name = "dbeaver";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "0vdwbgff55aq5l67fczdvw7kn7kf0dsz183x5lz2v1sb2blsjvjj";
+    sha256 = "08dm10smmzrpsc4vc5p3p6fbkg6a5r1sgmbdgr2ihkbk28gylfh0";
   };
 
   installPhase = ''

third_party/nixpkgs/pkgs/applications/misc/dupeguru/default.nix

@@ -40,15 +40,15 @@ python3Packages.buildPythonApplication rec {
   # Avoid double wrapping Python programs.
   dontWrapQtApps = true;
 
+  # TODO: A bug in python wrapper
+  # see https://github.com/NixOS/nixpkgs/pull/75054#discussion_r357656916
   preFixup = ''
-    # TODO: A bug in python wrapper
-    # see https://github.com/NixOS/nixpkgs/pull/75054#discussion_r357656916
     makeWrapperArgs="''${qtWrapperArgs[@]}"
   '';
 
+  # Executable in $out/bin is a symlink to $out/share/dupeguru/run.py
+  # so wrapPythonPrograms hook does not handle it automatically.
   postFixup = ''
-    # Executable in $out/bin is a symlink to $out/share/dupeguru/run.py
-    # so wrapPythonPrograms hook does not handle it automatically.
     wrapPythonProgramsIn "$out/share/dupeguru" "$out $pythonPath"
   '';
 
@@ -58,5 +58,6 @@ python3Packages.buildPythonApplication rec {
     license = licenses.bsd3;
     platforms = platforms.linux;
     maintainers = [ maintainers.novoxudonoser ];
+    broken = true; # mv: cannot stat '_block.cpython-38m*.so': No such file or directory
   };
 }

third_party/nixpkgs/pkgs/applications/misc/electron-cash/default.nix

@@ -3,13 +3,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "electron-cash";
-  version = "4.1.0";
+  version = "4.1.1";
 
   src = fetchFromGitHub {
     owner = "Electron-Cash";
     repo = "Electron-Cash";
     rev = version;
-    sha256 = "1ccfm6kkmbkvykfdzrisxvr0lx9kgq4l43ixk6v3xnvhnbfwz4s2";
+    sha256 = "1fllz2s20lg4hrppzmnlgjy9mrq7gaq66l2apb3vz1avzvsjw3gm";
   };
 
   propagatedBuildInputs = with python3Packages; [
@@ -36,15 +36,6 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [ wrapQtAppsHook ];
 
-  patches = [
-    # Patch a failed test, this can be removed in next version
-    (fetchpatch {
-      url =
-        "https://github.com/Electron-Cash/Electron-Cash/commit/1a9122d59be0c351b14c174a60880c2e927e6168.patch";
-      sha256 = "0zw629ypn9jxb1y124s3dkbbf2q3wj1i97j16lzdxpjy3sk0p5hk";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace contrib/requirements/requirements.txt \
       --replace "qdarkstyle==2.6.8" "qdarkstyle<3"
@@ -70,9 +61,11 @@ python3Packages.buildPythonApplication rec {
   #   Electron Cash was unable to find the secp256k1 library on this system.
   #   Elliptic curve cryptography operations will be performed in slow
   #   Python-only mode.
-  postFixup = ''
+  preFixup = ''
-    wrapQtApp $out/bin/electron-cash \
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
-      --prefix LD_LIBRARY_PATH : ${secp256k1}/lib
+    makeWrapperArgs+=(
+      "--prefix" "LD_LIBRARY_PATH" ":" "${secp256k1}/lib"
+    )
   '';
 
   doInstallCheck = true;

third_party/nixpkgs/pkgs/applications/misc/electrum/ltc.nix

@@ -36,8 +36,8 @@ python3Packages.buildPythonApplication rec {
     sed -i '/Created: .*/d' gui/qt/icons_rc.py
   '';
 
-  postFixup = ''
+  preFixup = ''
-    wrapQtApp $out/bin/electrum-ltc
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
   '';
 
   checkPhase = ''

third_party/nixpkgs/pkgs/applications/misc/gpxsee/default.nix

@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "gpxsee";
-  version = "7.32";
+  version = "7.33";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "0mcd6zv71laykg1208vkqmaxv1v12mqq47156gb78a5ww8paa0ka";
+    sha256 = "1k4zl7knlpwxrpqk1axkmy8x12915z15h3q2sjnx3jcnx6qw73ja";
   };
 
   patches = (substituteAll {

third_party/nixpkgs/pkgs/applications/misc/kdeconnect/default.nix

@@ -1,6 +1,7 @@
 { mkDerivation
 , lib
 , fetchurl
+, fetchpatch
 , extra-cmake-modules
 , kcmutils
 , kconfigwidgets
@@ -13,25 +14,55 @@
 , libfakekey
 , libXtst
 , qtx11extras
+, qtmultimedia
+, qtgraphicaleffects
 , sshfs
 , makeWrapper
 , kwayland
 , kio
+, kpeoplevcard
+, kpeople
+, kirigami2
+, pulseaudio-qt
 }:
 
 mkDerivation rec {
   pname = "kdeconnect";
-  version = "1.3.5";
+  version = "20.08.1";
 
   src = fetchurl {
-    url = "mirror://kde/stable/${pname}/${version}/${pname}-kde-${version}.tar.xz";
+    url = "https://download.kde.org/stable/release-service/${version}/src/${pname}-kde-${version}.tar.xz";
-    sha256 = "02lr3xx5s2mgddac4n3lkgr7ppf1z5m6ajs90rjix0vs8a271kp5";
+    sha256 = "0s76djgpx08jfmh99c7kx18mnr3w7bv4hdra120nicq89mmy7gwf";
   };
 
+  patches = [
+    # https://invent.kde.org/network/kdeconnect-kde/-/merge_requests/328
+    (fetchpatch {
+      url = "https://invent.kde.org/network/kdeconnect-kde/-/commit/6101ef3ad07d865958d58a3d2736f5536f1c5719.diff";
+      sha256 = "17mr7k13226vzcgxlmfs6q2mdc5j7vwp4iri9apmh6xlf6r591ac";
+    })
+  ];
+
   buildInputs = [
-    libfakekey libXtst
+    libfakekey
-    ki18n kiconthemes kcmutils kconfigwidgets kdbusaddons knotifications
+    libXtst
-    qca-qt5 qtx11extras makeWrapper kwayland kio
+    qtmultimedia
+    qtgraphicaleffects
+    pulseaudio-qt
+    kpeoplevcard
+    kpeople
+    kirigami2
+    ki18n
+    kiconthemes
+    kcmutils
+    kconfigwidgets
+    kdbusaddons
+    knotifications
+    qca-qt5
+    qtx11extras
+    makeWrapper
+    kwayland
+    kio
   ];
 
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];

third_party/nixpkgs/pkgs/applications/misc/mkgmap/build.xml.patch

@@ -1,6 +1,14 @@
---- a/build.xml	2019-08-26 23:22:55.104829846 +0300
+--- a/build.xml	(revision 4555)
-+++ b/build.xml	2019-08-27 00:11:07.366257594 +0300
++++ a/build.xml	(working copy)
-@@ -227,7 +227,7 @@
+@@ -222,13 +222,13 @@
+ 		<property name="svn.version.build" value="none"/>
+ 
+ 		<propertyfile file="${build.classes}/mkgmap-version.properties">
+-			<entry key="svn.version" value="${svn.version.build}" />
+-			<entry key="build.timestamp" value="${build.timestamp}" />
++			<entry key="svn.version" value="@version@" />
++			<entry key="build.timestamp" value="unknown" />
+ 		</propertyfile>
  	</target>
  
  	<!-- Compile the product itself (no tests). -->
@@ -9,3 +17,30 @@
  					description="main compilation">
  
  		<javac srcdir="${src}" destdir="${build.classes}" encoding="utf-8" debug="true" includeantruntime="false">
+@@ -263,7 +263,7 @@
+ 	</target>
+ 
+ 	<!-- Compile the test classes -->
+-	<target name="build-test" depends="build, resolve-test">
++	<target name="build-test" depends="build">
+ 		<mkdir dir="${build.test}" />
+ 		<javac srcdir="${test}" destdir="${build.test}" encoding="utf-8" debug="true" includeantruntime="false">
+ 			<include name="**/*.java" />
+@@ -271,7 +271,7 @@
+ 		</javac>
+ 	</target>
+ 
+-	<target name="test" depends="build-test, obtain-test-input-files" description="Run the junit tests">
++	<target name="test" depends="build-test" description="Run the junit tests">
+ 		<mkdir dir="tmp/report"/>
+ 		<junit printsummary="yes" failureproperty="junit.failure" forkmode="once">
+ 
+@@ -351,7 +351,7 @@
+ 			ignoreerrors="true"/>
+ 	</target>
+ 
+-	<target name="dist" depends="build, check-version, version-file"
++	<target name="dist" depends="build, version-file"
+ 					description="Make the distribution area">
+ 
+ 		<mkdir dir="${dist}"/>

third_party/nixpkgs/pkgs/applications/misc/mkgmap/default.nix

@@ -1,56 +1,84 @@
-{ stdenv, fetchurl, fetchsvn, jdk, jre, ant, makeWrapper }:
+{ stdenv
-
+, fetchurl
+, fetchsvn
+, jdk
+, jre
+, ant
+, makeWrapper
+, doCheck ? true
+, withExamples ? false
+}:
 let
-  fastutil = fetchurl {
+  version = "4565";
-    url = "http://ivy.mkgmap.org.uk/repo/it.unimi.dsi/fastutil/6.5.15-mkg.1b/jars/fastutil.jar";
+  sha256 = "0cfh0msky5812l28mavy6p3k2zgyxb698xk79mvla9l45zcicnvw";
-    sha256 = "0d88m0rpi69wgxhnj5zh924q4zsvxq8m4ybk7m9mr3gz1hx0yx8c";
-  };
-  osmpbf = fetchurl {
-    url = "http://ivy.mkgmap.org.uk/repo/crosby/osmpbf/1.3.3/jars/osmpbf.jar";
-    sha256 = "0zb4pqkwly5z30ww66qhhasdhdrzwmrw00347yrbgyk2ii4wjad3";
-  };
-  protobuf = fetchurl {
-    url = "https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java/2.5.0/protobuf-java-2.5.0.jar";
-    sha256 = "0x6c4pbsizvk3lm6nxcgi1g2iqgrxcna1ip74lbn01f0fm2wdhg0";
-  };
-in
 
-stdenv.mkDerivation rec {
+  deps = import ./deps.nix { inherit fetchurl; };
+  testInputs = import ./testinputs.nix { inherit fetchurl; };
+in
+stdenv.mkDerivation {
   pname = "mkgmap";
-  version = "4432";
+  inherit version;
 
   src = fetchsvn {
+    inherit sha256;
     url = "https://svn.mkgmap.org.uk/mkgmap/mkgmap/trunk";
     rev = version;
-    sha256 = "1z1ppf9v1b9clnx20v15xkmdrfw6q4h7i15drzxsdh2wl6bafzvx";
   };
 
-  # This patch removes from the build process
+  patches = [
-  # the automatic download of dependencies (see configurePhase)
+    # Disable automatic download of dependencies
-  patches = [ ./build.xml.patch ];
+    ./build.xml.patch
+
+    # Fix testJavaRules test
+    ./fix-failing-test.patch
+  ];
+
+  postPatch = with deps; ''
+    substituteInPlace build.xml \
+      --subst-var-by version ${version}
+
+    mkdir -p lib/compile
+    cp ${fastutil} lib/compile/${fastutil.name}
+    cp ${osmpbf} lib/compile/${osmpbf.name}
+    cp ${protobuf} lib/compile/${protobuf.name}
+  '' + stdenv.lib.optionalString doCheck ''
+    mkdir -p lib/test
+    cp ${fastutil} lib/test/${fastutil.name}
+    cp ${osmpbf} lib/test/${osmpbf.name}
+    cp ${protobuf} lib/test/${protobuf.name}
+    cp ${jaxb-api} lib/test/${jaxb-api.name}
+    cp ${junit} lib/test/${junit.name}
+    cp ${hamcrest-core} lib/test/${hamcrest-core.name}
+
+    mkdir -p test/resources/in/img
+    ${stdenv.lib.concatMapStringsSep "\n" (res: ''
+      cp ${res} test/resources/in/${builtins.replaceStrings [ "__" ] [ "/" ] res.name}
+    '') testInputs}
+  '';
 
   nativeBuildInputs = [ jdk ant makeWrapper ];
 
-  configurePhase = ''
-    mkdir -p lib/compile
-    cp ${fastutil} ${osmpbf} ${protobuf} lib/compile/
-  '';
-
   buildPhase = "ant";
 
+  inherit doCheck;
+
+  checkPhase = "ant test";
+
   installPhase = ''
-    cd dist
+    install -Dm644 dist/mkgmap.jar $out/share/java/mkgmap/mkgmap.jar
-    install -Dm644 mkgmap.jar $out/share/java/mkgmap/mkgmap.jar
+    install -Dm644 dist/doc/mkgmap.1 $out/share/man/man1/mkgmap.1
-    install -Dm644 doc/mkgmap.1 $out/share/man/man1/mkgmap.1
+    cp -r dist/lib/ $out/share/java/mkgmap/
-    cp -r lib/ $out/share/java/mkgmap/
     makeWrapper ${jre}/bin/java $out/bin/mkgmap \
       --add-flags "-jar $out/share/java/mkgmap/mkgmap.jar"
+  '' + stdenv.lib.optionalString withExamples ''
+    mkdir -p $out/share/mkgmap
+    cp -r dist/examples $out/share/mkgmap/
   '';
 
   meta = with stdenv.lib; {
     description = "Create maps for Garmin GPS devices from OpenStreetMap (OSM) data";
     homepage = "http://www.mkgmap.org.uk";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ sikmir ];
     platforms = platforms.all;
   };

third_party/nixpkgs/pkgs/applications/misc/mkgmap/deps.nix

@@ -0,0 +1,31 @@
+{ fetchurl }:
+{
+  fastutil = fetchurl {
+    url = "http://ivy.mkgmap.org.uk/repo/it.unimi.dsi/fastutil/6.5.15-mkg.1b/jars/fastutil.jar";
+    sha256 = "0d88m0rpi69wgxhnj5zh924q4zsvxq8m4ybk7m9mr3gz1hx0yx8c";
+  };
+  osmpbf = fetchurl {
+    url = "http://ivy.mkgmap.org.uk/repo/crosby/osmpbf/1.3.3/jars/osmpbf.jar";
+    sha256 = "0zb4pqkwly5z30ww66qhhasdhdrzwmrw00347yrbgyk2ii4wjad3";
+  };
+  protobuf = fetchurl {
+    url = "https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java/2.5.0/protobuf-java-2.5.0.jar";
+    sha256 = "0x6c4pbsizvk3lm6nxcgi1g2iqgrxcna1ip74lbn01f0fm2wdhg0";
+  };
+  xpp3 = fetchurl {
+    url = "https://repo1.maven.org/maven2/xpp3/xpp3/1.1.4c/xpp3-1.1.4c.jar";
+    sha256 = "1f9ifnxxj295xb1494jycbfm76476xm5l52p7608gf0v91d3jh83";
+  };
+  jaxb-api = fetchurl {
+    url = "https://repo1.maven.org/maven2/javax/xml/bind/jaxb-api/2.3.0/jaxb-api-2.3.0.jar";
+    sha256 = "00rxpc0m30d3jc572ni01ryxq8gcbnr955xsabrijg9pknc0fc48";
+  };
+  junit = fetchurl {
+    url = "https://repo1.maven.org/maven2/junit/junit/4.11/junit-4.11.jar";
+    sha256 = "1zh6klzv8w30dx7jg6pkhllk4587av4znflzhxz8x97c7rhf3a4h";
+  };
+  hamcrest-core = fetchurl {
+    url = "https://repo1.maven.org/maven2/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar";
+    sha256 = "1sfqqi8p5957hs9yik44an3lwpv8ln2a6sh9gbgli4vkx68yzzb6";
+  };
+}

third_party/nixpkgs/pkgs/applications/misc/mkgmap/fix-failing-test.patch

@@ -0,0 +1,22 @@
+--- a/test/uk/me/parabola/imgfmt/app/srt/SrtCollatorTest.java	(revision 4555)
++++ a/test/uk/me/parabola/imgfmt/app/srt/SrtCollatorTest.java	(working copy)
+@@ -125,7 +125,7 @@
+ 		assertEquals("prim: different letter", -1, collator.compare("aaac", "aaad"));
+ 		assertEquals("prim: different letter", 1, collator.compare("aaae", "aaad"));
+ 		assertEquals(0, collator.compare("aaaa", "aaaa"));
+-		assertEquals(0, collator.compare("aáÄâ", "aaaa"));
++		//assertEquals(0, collator.compare("aáÄâ", "aaaa"));
+ 
+ 		collator.setStrength(Collator.SECONDARY);
+ 		assertEquals(0, collator.compare("AabBb", "aabbb"));
+@@ -132,8 +132,8 @@
+ 		assertEquals(0, collator.compare("aabBb", "aabBb"));
+ 		assertEquals(0, collator.compare("aabbB", "aabBb"));
+ 		assertEquals(1, collator.compare("aáÄâ", "aaaa"));
+-		assertEquals("prim len diff", -1, collator.compare("aáÄâ", "aaaaa"));
+-		assertEquals(-1, collator.compare("aáÄâa", "aaaab"));
++		//assertEquals("prim len diff", -1, collator.compare("aáÄâ", "aaaaa"));
++		//assertEquals(-1, collator.compare("aáÄâa", "aaaab"));
+ 
+ 		collator.setStrength(Collator.TERTIARY);
+ 		assertEquals("prim: different case", 1, collator.compare("AabBb", "aabbb"));

third_party/nixpkgs/pkgs/applications/misc/mkgmap/splitter/build.xml.patch

@@ -0,0 +1,54 @@
+--- a/build.xml	(revision 597)
++++ a/build.xml	(working copy)
+@@ -207,12 +207,12 @@
+ 		<property name="svn.version.build" value="unknown"/>
+ 
+ 		<propertyfile file="${build.classes}/splitter-version.properties">
+-			<entry key="svn.version" value="${svn.version.build}" />
+-			<entry key="build.timestamp" value="${build.timestamp}" />
++			<entry key="svn.version" value="@version@" />
++			<entry key="build.timestamp" value="unknown" />
+ 		</propertyfile>
+ 	</target>
+ 
+-  <target name="compile" depends="prepare, resolve-compile" description="main compilation">
++  <target name="compile" depends="prepare" description="main compilation">
+     <javac srcdir="${src}" destdir="${build.classes}" debug="yes" includeantruntime="false">
+       <include name="**/*.java"/>
+       <classpath refid="classpath"/>
+@@ -219,7 +219,7 @@
+     </javac>
+   </target>
+ 
+-  <target name="compile.tests" depends="prepare, resolve-test" description="test compilation">
++  <target name="compile.tests" depends="prepare" description="test compilation">
+     <javac srcdir="${test}" destdir="${build.test-classes}" debug="yes" includeantruntime="false">
+       <include name="**/*.java"/>
+       <classpath refid="test.classpath"/>
+@@ -261,7 +261,7 @@
+ 	  <fail if="junit.failure" message="Test failed.  See test-reports/index.html"/>
+ 	</target>
+ 
+-  <target name="dist" depends="build, check-version, version-file" description="Make the distribution area">
++  <target name="dist" depends="build, version-file" description="Make the distribution area">
+ 
+     <mkdir dir="${dist}"/>
+     <mkdir dir="${dist}/doc/api"/>
+@@ -324,7 +324,7 @@
+ 	</target>
+ 
+ 	<!-- Main -->
+-  <target name="build" depends="compile,compile.tests,run.tests">
++  <target name="build" depends="compile">
+     <copy todir="${build.classes}">
+       <fileset dir="${resources}">
+         <include name="*.properties"/>
+@@ -349,7 +349,7 @@
+ 			ignoreerrors="true"/>
+ 	</target>
+  
+-	<target name="run.func-tests" depends="compile,compile.tests,obtain-test-input-files" description="Run the functional tests">
++	<target name="run.func-tests" depends="compile,compile.tests" description="Run the functional tests">
+ 		<mkdir dir="tmp/report"/>
+ 		<junit printsummary="yes" failureproperty="junit.failure" forkmode="once">
+ 	

third_party/nixpkgs/pkgs/applications/misc/mkgmap/splitter/default.nix

@@ -0,0 +1,78 @@
+{ stdenv
+, fetchurl
+, fetchsvn
+, jdk
+, jre
+, ant
+, makeWrapper
+, doCheck ? true
+}:
+let
+  version = "597";
+  sha256 = "1al3160amw0gdarrc707dsppm0kcai9mpkfak7ffspwzw9alsndx";
+
+  deps = import ../deps.nix { inherit fetchurl; };
+  testInputs = import ./testinputs.nix { inherit fetchurl; };
+in
+stdenv.mkDerivation {
+  pname = "splitter";
+  inherit version;
+
+  src = fetchsvn {
+    inherit sha256;
+    url = "https://svn.mkgmap.org.uk/mkgmap/splitter/trunk";
+    rev = version;
+  };
+
+  patches = [
+    # Disable automatic download of dependencies
+    ./build.xml.patch
+
+    # Fix func.SolverAndProblemGeneratorTest test
+    ./fix-failing-test.patch
+  ];
+
+  postPatch = with deps; ''
+    substituteInPlace build.xml \
+      --subst-var-by version ${version}
+
+    mkdir -p lib/compile
+    cp ${fastutil} lib/compile/${fastutil.name}
+    cp ${osmpbf} lib/compile/${osmpbf.name}
+    cp ${protobuf} lib/compile/${protobuf.name}
+    cp ${xpp3} lib/compile/${xpp3.name}
+  '' + stdenv.lib.optionalString doCheck ''
+    mkdir -p lib/test
+    cp ${junit} lib/test/${junit.name}
+    cp ${hamcrest-core} lib/test/${hamcrest-core.name}
+
+    mkdir -p test/resources/in/osm
+    ${stdenv.lib.concatMapStringsSep "\n" (res: ''
+      cp ${res} test/resources/in/${builtins.replaceStrings [ "__" ] [ "/" ] res.name}
+    '') testInputs}
+  '';
+
+  nativeBuildInputs = [ jdk ant makeWrapper ];
+
+  buildPhase = "ant";
+
+  inherit doCheck;
+
+  checkPhase = "ant run.tests && ant run.func-tests";
+
+  installPhase = ''
+    install -Dm644 dist/splitter.jar $out/share/java/splitter/splitter.jar
+    install -Dm644 doc/splitter.1 $out/share/man/man1/splitter.1
+    cp -r dist/lib/ $out/share/java/splitter/
+    makeWrapper ${jre}/bin/java $out/bin/splitter \
+      --add-flags "-jar $out/share/java/splitter/splitter.jar"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Utility for splitting OpenStreetMap maps into tiles";
+    homepage = "http://www.mkgmap.org.uk";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.all;
+  };
+}

third_party/nixpkgs/pkgs/applications/misc/mkgmap/splitter/fix-failing-test.patch

@@ -0,0 +1,11 @@
+--- a/test/func/SolverAndProblemGeneratorTest.java	(revision 597)
++++ a/test/func/SolverAndProblemGeneratorTest.java	(working copy)
+@@ -89,7 +89,7 @@
+ 			for (String l : lines) {
+ 				realSize += l.length();
+ 			}
+-			assertEquals(f + " has wrong size", expectedSize, realSize);
++			//assertEquals(f + " has wrong size", expectedSize, realSize);
+ 		}
+ 	}
+ 

third_party/nixpkgs/pkgs/applications/misc/mkgmap/splitter/testinputs.nix

@@ -0,0 +1,18 @@
+{ fetchurl }:
+let
+  fetchTestInput = { res, sha256 }: fetchurl {
+    inherit sha256;
+    url = "http://www.mkgmap.org.uk/testinput/${res}";
+    name = builtins.replaceStrings [ "/" ] [ "__" ] res;
+  };
+in
+[
+  (fetchTestInput {
+    res = "osm/alaska-2016-12-27.osm.pbf";
+    sha256 = "0hmb5v71a1bxgvrg1cbfj5l27b3vvdazs4pyggpmhcdhbwpw7ppm";
+  })
+  (fetchTestInput {
+    res = "osm/hamburg-2016-12-26.osm.pbf";
+    sha256 = "08bny4aavwm3z2114q99fv3fi2w905zxi0fl7bqgjyhgk0fxjssf";
+  })
+]

third_party/nixpkgs/pkgs/applications/misc/mkgmap/testinputs.nix

@@ -0,0 +1,66 @@
+{ fetchurl }:
+let
+  fetchTestInput = { res, sha256 }: fetchurl {
+    inherit sha256;
+    url = "http://www.mkgmap.org.uk/testinput/${res}";
+    name = builtins.replaceStrings [ "/" ] [ "__" ] res;
+  };
+in
+[
+  (fetchTestInput {
+    res = "osm/lon1.osm.gz";
+    sha256 = "1r8sl67hayjgybxy9crqwp7f1w0ljxvxh0apqcvr888yhsbb8drv";
+  })
+  (fetchTestInput {
+    res = "osm/uk-test-1.osm.gz";
+    sha256 = "0jdngkjn22jvi8q7hrzpqb9mnjlz82h1dwdmc4qrb64kkhzm4dfk";
+  })
+  (fetchTestInput {
+    res = "osm/uk-test-2.osm.gz";
+    sha256 = "05mw0qcdgki151ldmxayry0gqlb72jm5wrvxq3dkwq5i7jb21qs4";
+  })
+  (fetchTestInput {
+    res = "osm/is-in-samples.osm";
+    sha256 = "18vqfbq25ys59bj6dl6dq3q4m2ri3ki2xazim14fm94k1pbyhbh3";
+  })
+  (fetchTestInput {
+    res = "mp/test1.mp";
+    sha256 = "1dykr0z84c3fqgm9kdp2dzvxc3galjbx0dn9zxjw8cfk7mvnspj2";
+  })
+  (fetchTestInput {
+    res = "img/63240001.img";
+    sha256 = "1wmqgy940q1svazw85z8di20xyjm3vpaiaj9hizr47b549klw74q";
+  })
+  (fetchTestInput {
+    res = "img/63240002.img";
+    sha256 = "12ivywkiw6lrglyk0clnx5ff2wqj4z0c3f5yqjsqlsaawbmxqa1f";
+  })
+  (fetchTestInput {
+    res = "img/63240003.img";
+    sha256 = "19mgxqv6kqk8ahs8s819sj7cc79id67373ckwfsq7vvqyfrbasz1";
+  })
+  (fetchTestInput {
+    res = "hgt/N00W090.hgt.zip";
+    sha256 = "16hb06bgf47sz2mfbbx3xqmrh1nmm04wj4ngm512sng4rjhksxgn";
+  })
+  (fetchTestInput {
+    res = "hgt/N00W091.hgt.zip";
+    sha256 = "153j4wj7170qj81nr7sr6dp9zar62gnrkh6ww62bygpfqqyzdr1x";
+  })
+  (fetchTestInput {
+    res = "hgt/S01W090.hgt.zip";
+    sha256 = "0czgs9rhp7bnzmzm7907vprj3nhm2lj6q1piafk8dm9rcqkfg8sj";
+  })
+  (fetchTestInput {
+    res = "hgt/S01W091.hgt.zip";
+    sha256 = "0z58q3ai499mflxfjqhqv9i1di3fmp05pkv39886k1na107g3wbn";
+  })
+  (fetchTestInput {
+    res = "hgt/S02W090.hgt.zip";
+    sha256 = "0q7817gdxk2vq73ci6ffks288zqywc21f5ns73b6p5ds2lrxhf5n";
+  })
+  (fetchTestInput {
+    res = "hgt/S02W091.hgt.zip";
+    sha256 = "1mwpgd85v9n99gmx2bn8md7d312wvhq86w3c9k92y8ayrs20lmdr";
+  })
+]

third_party/nixpkgs/pkgs/applications/misc/octoprint/plugins.nix

@@ -255,13 +255,13 @@ in {
 
   displaylayerprogress = buildPlugin rec {
     pname = "OctoPrint-DisplayLayerProgress";
-    version = "1.23.2";
+    version = "1.24.0";
 
     src = fetchFromGitHub {
       owner = "OllisGit";
       repo = pname;
       rev = version;
-      sha256 = "0yv8gy5dq0rl7zxkvqa98az391aiixl8wbzkyvbmpjar9r6whdzm";
+      sha256 = "1lbivg3rcjzv8zqvp8n8gcaczxdm7gvd5ihjb6jq0fgf958lv59n";
     };
 
     meta = with stdenv.lib; {
@@ -272,15 +272,34 @@ in {
     };
   };
 
+  octoklipper = buildPlugin rec {
+    pname = "OctoKlipper";
+    version = "0.3.2";
+
+    src = fetchFromGitHub {
+      owner = "AliceGrey";
+      repo = "OctoprintKlipperPlugin";
+      rev = version;
+      sha256 = "15yg2blbgqp2gdpsqqm8qiiznq5qaq8wss07jimkl0865vrvlz7l";
+    };
+
+    meta = with stdenv.lib; {
+      description = "A plugin for a better integration of Klipper into OctoPrint";
+      homepage = "https://github.com/AliceGrey/OctoprintKlipperPlugin";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ lovesegfault ];
+    };
+  };
+
   octoprint-dashboard = buildPlugin rec {
     pname = "OctoPrint-Dashboard";
-    version = "1.13.0";
+    version = "1.15.1";
 
     src = fetchFromGitHub {
       owner = "StefanCohen";
       repo = pname;
       rev = version;
-      sha256 = "1879l05gkkryvhxkmhr3xvd10d4m7i0cr3jk1gdcv47xwyr6q9pf";
+      sha256 = "1psk069g8xdpgbzmna51dh978vrildh33dn7kbbi5y31ry5c3gx6";
     };
 
     meta = with stdenv.lib; {

third_party/nixpkgs/pkgs/applications/misc/prevo/data.nix

@@ -0,0 +1,41 @@
+{ stdenv, fetchFromGitHub, prevo-tools }:
+
+stdenv.mkDerivation rec {
+  pname = "prevo-data";
+  version = "2020-03-08";
+
+  src = fetchFromGitHub {
+    owner = "bpeel";
+    repo = "revo";
+    rev = "1e8d7197c0bc831e2127909e77e64dfc26906bdd";
+    sha256 = "1ldhzpi3d5cbssv8r7acsn7qwxcl8qpqi8ywpsp7cbgx3w7hhkyz";
+  };
+
+  nativeBuildInputs = [ prevo-tools ];
+
+  dontUnpack = true;
+
+  buildPhase = ''
+    prevodb -s -i $src -o prevo.db
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/prevo
+    cp prevo.db $out/share/prevo/
+  '';
+
+  meta = with stdenv.lib; {
+    description =
+      "data for offline version of the Esperanto dictionary Reta Vortaro";
+    longDescription = ''
+      PReVo is the "portable" ReVo, i.e., the offline version
+      of the Esperanto dictionary Reta Vortaro.
+
+      This package provides the ReVo database for the prevo command line application.
+    '';
+    homepage = "https://github.com/bpeel/revo";
+    license = licenses.gpl2Only;
+    maintainers = [ maintainers.das-g ];
+    platforms = platforms.linux;
+  };
+}

third_party/nixpkgs/pkgs/applications/misc/prevo/default.nix

@@ -0,0 +1,27 @@
+{ stdenv, symlinkJoin, prevo-tools, prevo-data, makeWrapper }:
+
+symlinkJoin rec {
+  name = "prevo-${version}";
+  inherit (prevo-tools) version;
+
+  paths = [ prevo-tools ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postBuild = ''
+    wrapProgram $out/bin/prevo \
+      --prefix XDG_DATA_DIRS : "${prevo-data}/share"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "offline version of the Esperanto dictionary Reta Vortaro";
+    longDescription = ''
+      PReVo is the "portable" ReVo, i.e., the offline version
+      of the Esperanto dictionary Reta Vortaro.
+    '';
+    homepage = "https://github.com/bpeel/prevodb";
+    license = licenses.gpl2Only;
+    maintainers = [ maintainers.das-g ];
+    platforms = platforms.linux;
+  };
+}

third_party/nixpkgs/pkgs/applications/misc/prevo/tools.nix

@@ -0,0 +1,38 @@
+{ stdenv, fetchFromGitHub, autoreconfHook, pkg-config, glib, expat
+, installShellFiles }:
+
+stdenv.mkDerivation rec {
+  pname = "prevo-tools";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "bpeel";
+    repo = "prevodb";
+    rev = version;
+    sha256 = "1fyrc4g9qdq04nxs4g8x0krxfani5xady6v9m0qfqpbh4xk2ry2d";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config installShellFiles ];
+  buildInputs = [ glib expat ];
+
+  postInstall = ''
+    installShellCompletion --bash $out/etc/bash_completion.d/prevo-completion
+  '';
+
+  meta = with stdenv.lib; {
+    description =
+      "CLI tools for the offline version of the Esperanto dictionary Reta Vortaro";
+    longDescription = ''
+      PReVo is the "portable" ReVo, i.e., the offline version
+      of the Esperanto dictionary Reta Vortaro.
+
+      This package provides the command line application prevo to query a local
+      ReVo database, as well as the command line tool revodb to create such a
+      database for this application or for the Android app of the same name.
+    '';
+    homepage = "https://github.com/bpeel/prevodb";
+    license = licenses.gpl2Only;
+    maintainers = [ maintainers.das-g ];
+    platforms = platforms.linux;
+  };
+}

third_party/nixpkgs/pkgs/applications/misc/st/default.nix

@@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
   inherit patches;
 
   configFile = optionalString (conf!=null) (writeText "config.def.h" conf);
-  postPatch = optionalString (conf!=null) "cp ${configFile} config.def.h";
+
+  postPatch = optionalString (conf!=null) "cp ${configFile} config.def.h"
+            + optionalString stdenv.isDarwin ''
+    substituteInPlace config.mk --replace "-lrt" ""
+  '';
 
   nativeBuildInputs = [ pkgconfig ncurses ];
   buildInputs = [ libX11 libXft ] ++ extraLibs;
@@ -28,7 +32,7 @@ stdenv.mkDerivation rec {
     homepage = "https://st.suckless.org/";
     description = "Simple Terminal for X from Suckless.org Community";
     license = licenses.mit;
-    maintainers = with maintainers; [andsild];
+    maintainers = with maintainers; [ andsild ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }

third_party/nixpkgs/pkgs/applications/misc/wtf/default.nix

@@ -3,20 +3,21 @@
 , lib
 , makeWrapper
 , ncurses
+, stdenv
 }:
 
 buildGoModule rec {
   pname = "wtf";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "wtfutil";
     repo = pname;
     rev = "v${version}";
-    sha256 = "07ngk83p753w9qxm8bvw6n5vk0zldn14yv08d900sxny8cg2h0rb";
+    sha256 = "1055shnf716ga46wwcaffdpgc1glr8vrqrbs2sqbkr3wjan6n0nw";
    };
 
-  vendorSha256 = "09iy148pnbdrzjj2j50lbd8s9mkv7vggrx77mj88p1gnqclz3lip";
+  vendorSha256 = "0l1q29mdb13ir7n1x65jfnrmy1lamlsa6hm2jagf6yjbm6wf1kw4";
 
   doCheck = false;
 
@@ -37,5 +38,6 @@ buildGoModule rec {
     license = licenses.mpl20;
     maintainers = with maintainers; [ kalbasit ];
     platforms = platforms.linux ++ platforms.darwin;
+    broken = stdenv.isDarwin;
   };
 }

third_party/nixpkgs/pkgs/applications/misc/zola/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zola";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "getzola";
     repo = pname;
     rev = "v${version}";
-    sha256 = "00fkcrr40v93z23h3q2wqlfx0120g59j6j9szk8nx9x85i40j3if";
+    sha256 = "sha256:0fb227kgani32ljnw73a0h5zn5361z5lraf79y34a0chcby2qv35";
   };
 
-  cargoSha256 = "1wdypyy787dzdq5q64a9mjfygg0kli49yjzw7xh66sjd7263w9fs";
+  cargoSha256 = "sha256:0ilfr32zcajag05qcpwi5ixz250s427i4xrjf4wrk7qy32bblnr5";
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = [ openssl oniguruma ]
@@ -32,6 +32,6 @@ rustPlatform.buildRustPackage rec {
     description = "A fast static site generator with everything built-in";
     homepage = "https://www.getzola.org/";
     license = licenses.mit;
-    maintainers = with maintainers; [ dywedir ];
+    maintainers = with maintainers; [ dywedir _0x4A6F ];
   };
 }

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/browser.nix

@@ -13,7 +13,7 @@ mkChromiumDerivation (base: rec {
 
   installPhase = ''
     mkdir -p "$libExecPath"
-    cp -v "$buildPath/"*.pak "$buildPath/"*.bin "$libExecPath/"
+    cp -v "$buildPath/"*.so "$buildPath/"*.pak "$buildPath/"*.bin "$libExecPath/"
     cp -v "$buildPath/icudtl.dat" "$libExecPath/"
     cp -vLR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
     cp -v "$buildPath/chrome" "$libExecPath/$packageName"

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/common.nix

@@ -13,7 +13,6 @@
 , bison, gperf
 , glib, gtk3, dbus-glib
 , glibc
-, xorg
 , libXScrnSaver, libXcursor, libXtst, libGLU, libGL
 , protobuf, speechd, libXdamage, cups
 , ffmpeg_3, libxslt, libxml2, at-spi2-core
@@ -131,7 +130,6 @@ let
       ninja which python2Packages.python perl pkgconfig
       python2Packages.ply python2Packages.jinja2 nodejs
       gnutar python2Packages.setuptools
-      (xorg.xcbproto.override { python = python2Packages.python; })
     ];
 
     buildInputs = defaultDependencies ++ [
@@ -150,13 +148,10 @@ let
       ++ optional pulseSupport libpulseaudio
       ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];
 
-    patches = optionals (versionRange "68" "86") [
+    patches = [
-      ./patches/nix_plugin_paths_68.patch
-    ] ++ [
       ./patches/remove-webp-include-69.patch
       ./patches/no-build-timestamps.patch
       ./patches/widevine-79.patch
-      ./patches/dont-use-ANGLE-by-default.patch
       # Unfortunately, chromium regularly breaks on major updates and
       # then needs various patches backported in order to be compiled with GCC.
       # Good sources for such patches and other hints:
@@ -166,18 +161,18 @@ let
       #
       # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
       # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
-    ] ++ optionals (useVaapi && versionRange "68" "86") [ # Improvements for the VA-API build:
+    ] ++ optionals (useVaapi) [
-      ./patches/enable-vdpau-support-for-nvidia.patch # https://aur.archlinux.org/cgit/aur.git/tree/vdpau-support.patch?h=chromium-vaapi
+      # Check for enable-accelerated-video-decode on Linux:
-      ./patches/enable-video-acceleration-on-linux.patch # Can be controlled at runtime (i.e. without rebuilding Chromium)
+      (githubPatch "54deb9811ca9bd2327def5c05ba6987b8c7a0897" "11jvxjlkzz1hm0pvfyr88j7z3zbwzplyl5idkx92l2lzv4459c8d")
     ];
 
-    postPatch = optionalString (!versionRange "0" "86") ''
+    postPatch = ''
       # Required for patchShebangs (unsupported interpreter directive, basename: invalid option -- '*', etc.):
       substituteInPlace native_client/SConstruct \
         --replace "#! -*- python -*-" ""
       substituteInPlace third_party/harfbuzz-ng/src/src/update-unicode-tables.make \
         --replace "/usr/bin/env -S make -f" "/usr/bin/make -f"
-    '' + ''
+
       # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
       substituteInPlace sandbox/linux/suid/client/setuid_sandbox_host.cc \
         --replace \
@@ -195,11 +190,6 @@ let
           '/usr/share/locale/' \
           '${glibc}/share/locale/'
 
-      substituteInPlace ui/gfx/x/BUILD.gn \
-        --replace \
-          '/usr/share/xcb' \
-          '${xorg.xcbproto}/share/xcb/'
-
       sed -i -e 's@"\(#!\)\?.*xdg-@"\1${xdg_utils}/bin/xdg-@' \
         chrome/browser/shell_integration_linux.cc
 

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/default.nix

@@ -1,5 +1,5 @@
 { newScope, config, stdenv, fetchurl, makeWrapper
-, llvmPackages_10, llvmPackages_11, ed, gnugrep, coreutils, xdg_utils
+, llvmPackages_11, ed, gnugrep, coreutils, xdg_utils
 , glib, gtk3, gnome3, gsettings-desktop-schemas, gn, fetchgit
 , libva ? null
 , pipewire_0_2
@@ -15,7 +15,7 @@
 , enablePepperFlash ? false
 , enableWideVine ? false
 , useVaapi ? false # Deprecated, use enableVaapi instead!
-, enableVaapi ? false # Disabled by default due to unofficial support and issues on radeon
+, enableVaapi ? false # Disabled by default due to unofficial support
 , useOzone ? false
 , cupsSupport ? true
 , pulseSupport ? config.pulseaudio or stdenv.isLinux
@@ -23,7 +23,7 @@
 }:
 
 let
-  llvmPackages = llvmPackages_10;
+  llvmPackages = llvmPackages_11;
   stdenv = llvmPackages.stdenv;
 
   callPackage = newScope chromium;
@@ -37,16 +37,6 @@ let
       inherit channel gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs
               cupsSupport pulseSupport useOzone;
       # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
-      gnChromium = gn.overrideAttrs (oldAttrs: {
-        version = "2020-05-19";
-        src = fetchgit {
-          url = "https://gn.googlesource.com/gn";
-          rev = "d0a6f072070988e7b038496c4e7d6c562b649732";
-          sha256 = "0197msabskgfbxvhzq73gc3wlr3n9cr4bzrhy5z5irbvy05lxk17";
-        };
-      });
-    } // lib.optionalAttrs (lib.versionAtLeast upstream-info.version "86") {
-      llvmPackages = llvmPackages_11;
       gnChromium = gn.overrideAttrs (oldAttrs: {
         version = "2020-07-20";
         src = fetchgit {
@@ -56,7 +46,6 @@ let
         };
       });
     } // lib.optionalAttrs (lib.versionAtLeast upstream-info.version "87") {
-      llvmPackages = llvmPackages_11;
       useOzone = true; # YAY: https://chromium-review.googlesource.com/c/chromium/src/+/2382834 \o/
       gnChromium = gn.overrideAttrs (oldAttrs: {
         version = "2020-08-17";
@@ -163,8 +152,8 @@ let
       Chromium's useVaapi was replaced by enableVaapi and you don't need to pass
       "--ignore-gpu-blacklist" anymore (also no rebuilds are required anymore).
     '' else lib.optionalString
-      (!enableVaapi)
+      (enableVaapi)
-      "--add-flags --disable-accelerated-video-decode --add-flags --disable-accelerated-video-encode";
+      "--add-flags --enable-accelerated-video-decode";
 in stdenv.mkDerivation {
   name = "chromium${suffix}-${version}";
   inherit version;

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/patches/dont-use-ANGLE-by-default.patch

@@ -1,26 +0,0 @@
-A field trial currently enables the passthrough command decoder, which causes
-gl_factory.cc to try kGLImplementationEGLANGLE first, which causes Chromium to fail
-to load libGLESv2.so on NixOS.  It somehow does not try kGLImplementationDesktopGL,
-and so there is no GL support at all.
-
-Revert to using the validating command decoder, which prevents gl_factory.cc
-from touching allowed_impls, allowing it to successfully use kGLImplementationDesktopGL.
-
-diff --git a/ui/gl/gl_utils.cc b/ui/gl/gl_utils.cc
-index 697cbed5fe2d..8419bdb21a2f 100644
---- a/ui/gl/gl_utils.cc
-+++ b/ui/gl/gl_utils.cc
-@@ -71,9 +71,10 @@ bool UsePassthroughCommandDecoder(const base::CommandLine* command_line) {
-   } else if (switch_value == kCmdDecoderValidatingName) {
-     return false;
-   } else {
--    // Unrecognized or missing switch, use the default.
--    return base::FeatureList::IsEnabled(
--        features::kDefaultPassthroughCommandDecoder);
-+    // Ignore the field trial that enables it; disable it until
-+    // gl_factory.cc kGLImplementationEGLANGLE issues are sorted
-+    // out on NixOS.
-+    return false;
-   }
- }
- }

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/patches/enable-vdpau-support-for-nvidia.patch

@@ -1,65 +0,0 @@
---- a/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
-+++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
-@@ -641,6 +641,7 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
-   // |vpp_vaapi_wrapper_| for VaapiPicture to DownloadFromSurface() the VA's
-   // internal decoded frame.
-   if (buffer_allocation_mode_ != BufferAllocationMode::kNone &&
-+      buffer_allocation_mode_ != BufferAllocationMode::kWrapVdpau &&
-       !vpp_vaapi_wrapper_) {
-     vpp_vaapi_wrapper_ = VaapiWrapper::Create(
-         VaapiWrapper::kVideoProcess, VAProfileNone,
-@@ -665,7 +666,8 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
-     PictureBuffer buffer = buffers[i];
-     buffer.set_size(requested_pic_size_);
-     std::unique_ptr<VaapiPicture> picture = vaapi_picture_factory_->Create(
--        (buffer_allocation_mode_ == BufferAllocationMode::kNone)
-+        ((buffer_allocation_mode_ == BufferAllocationMode::kNone) ||
-+         (buffer_allocation_mode_ == BufferAllocationMode::kWrapVdpau))
-             ? vaapi_wrapper_
-             : vpp_vaapi_wrapper_,
-         make_context_current_cb_, bind_image_cb_, buffer);
-@@ -1093,6 +1095,12 @@ VaapiVideoDecodeAccelerator::GetSupportedProfiles() {
-
- VaapiVideoDecodeAccelerator::BufferAllocationMode
- VaapiVideoDecodeAccelerator::DecideBufferAllocationMode() {
-+  // NVIDIA blobs use VDPAU
-+  if (VaapiWrapper::GetImplementationType() == VAImplementation::kNVIDIAVDPAU) {
-+    LOG(INFO) << "VA-API driver on VDPAU backend";
-+    return BufferAllocationMode::kWrapVdpau;
-+  }
-+
-   // TODO(crbug.com/912295): Enable a better BufferAllocationMode for IMPORT
-   // |output_mode_| as well.
-   if (output_mode_ == VideoDecodeAccelerator::Config::OutputMode::IMPORT)
---- a/media/gpu/vaapi/vaapi_video_decode_accelerator.h
-+++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.h
-@@ -204,6 +204,7 @@ class MEDIA_GPU_EXPORT VaapiVideoDecodeAccelerator
-     // Using |client_|s provided PictureBuffers and as many internally
-     // allocated.
-     kNormal,
-+    kWrapVdpau,
-   };
-
-   // Decides the concrete buffer allocation mode, depending on the hardware
---- a/media/gpu/vaapi/vaapi_wrapper.cc
-+++ b/media/gpu/vaapi/vaapi_wrapper.cc
-@@ -131,6 +131,9 @@ media::VAImplementation VendorStringToImplementationType(
-   } else if (base::StartsWith(va_vendor_string, "Intel iHD driver",
-                               base::CompareCase::SENSITIVE)) {
-     return media::VAImplementation::kIntelIHD;
-+  } else if (base::StartsWith(va_vendor_string, "Splitted-Desktop Systems VDPAU",
-+                              base::CompareCase::SENSITIVE)) {
-+    return media::VAImplementation::kNVIDIAVDPAU;
-   }
-   return media::VAImplementation::kOther;
- }
---- a/media/gpu/vaapi/vaapi_wrapper.h
-+++ b/media/gpu/vaapi/vaapi_wrapper.h
-@@ -79,6 +79,7 @@ enum class VAImplementation {
-   kIntelIHD,
-   kOther,
-   kInvalid,
-+  kNVIDIAVDPAU,
- };
-
- // This class handles VA-API calls and ensures proper locking of VA-API calls

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/patches/enable-video-acceleration-on-linux.patch

@@ -1,48 +0,0 @@
-From b2144fd28e09cd52e7a88a62a9d9b54cf9922f9f Mon Sep 17 00:00:00 2001
-From: Michael Weiss <dev.primeos@gmail.com>
-Date: Tue, 14 Apr 2020 14:16:10 +0200
-Subject: [PATCH] Enable accelerated video decode on Linux
-
-This will enable accelerated video decode on Linux by default (i.e.
-without "--ignore-gpu-blacklist"), but on NixOS we'll provide
-"--disable-accelerated-video-decode" and
-"--disable-accelerated-video-encode" by default to avoid regressions
-(e.g. VA-API doesn't work properly for some radeon drivers).
-
-Video acceleration can then be enabled via:
-chromium.override { enableVaapi = true; }
-without rebuilding Chromium.
----
- gpu/config/software_rendering_list.json | 16 ----------------
- 1 file changed, 16 deletions(-)
-
-diff --git a/gpu/config/software_rendering_list.json b/gpu/config/software_rendering_list.json
-index 22712bdbf38f..a06dd19a50e4 100644
---- a/gpu/config/software_rendering_list.json
-+++ b/gpu/config/software_rendering_list.json
-@@ -336,22 +336,6 @@
-       ]
-     },
-     {
--      "id": 48,
--      "description": "Accelerated video decode is unavailable on Linux",
--      "cr_bugs": [137247, 1032907],
--      "os": {
--        "type": "linux"
--      },
--      "exceptions": [
--        {
--          "machine_model_name": ["Chromecast"]
--        }
--      ],
--      "features": [
--        "accelerated_video_decode"
--      ]
--    },
--    {
-       "id": 50,
-       "description": "Disable VMware software renderer on older Mesa",
-       "cr_bugs": [145531, 332596, 571899, 629434],
--- 
-2.11.0
-

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/patches/nix_plugin_paths_68.patch

@@ -1,61 +0,0 @@
-diff --git a/chrome/common/chrome_paths.cc b/chrome/common/chrome_paths.cc
-index f4e119d..d9775bd 100644
---- a/chrome/common/chrome_paths.cc
-+++ b/chrome/common/chrome_paths.cc
-@@ -68,21 +68,14 @@ static base::LazyInstance<base::FilePath>
-     g_invalid_specified_user_data_dir = LAZY_INSTANCE_INITIALIZER;
- 
- // Gets the path for internal plugins.
--bool GetInternalPluginsDirectory(base::FilePath* result) {
--#if defined(OS_MACOSX)
--  // If called from Chrome, get internal plugins from a subdirectory of the
--  // framework.
--  if (base::mac::AmIBundled()) {
--    *result = chrome::GetFrameworkBundlePath();
--    DCHECK(!result->empty());
--    *result = result->Append("Internet Plug-Ins");
--    return true;
--  }
--  // In tests, just look in the module directory (below).
--#endif
--
--  // The rest of the world expects plugins in the module directory.
--  return base::PathService::Get(base::DIR_MODULE, result);
-+bool GetInternalPluginsDirectory(base::FilePath* result,
-+                                 const std::string& ident) {
-+  std::string full_env = std::string("NIX_CHROMIUM_PLUGIN_PATH_") + ident;
-+  const char* value = getenv(full_env.c_str());
-+  if (value == NULL)
-+      return base::PathService::Get(base::DIR_MODULE, result);
-+  else
-+      *result = base::FilePath(value);
- }
- 
- // Gets the path for bundled implementations of components. Note that these
-@@ -272,7 +265,7 @@ bool PathProvider(int key, base::FilePath* result) {
-       create_dir = true;
-       break;
-     case chrome::DIR_INTERNAL_PLUGINS:
--      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "ALL"))
-         return false;
-       break;
-     case chrome::DIR_COMPONENTS:
-@@ -280,7 +273,7 @@ bool PathProvider(int key, base::FilePath* result) {
-         return false;
-       break;
-     case chrome::DIR_PEPPER_FLASH_PLUGIN:
--      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "PEPPERFLASH"))
-         return false;
-       cur = cur.Append(kPepperFlashBaseDirectory);
-       break;
-@@ -358,7 +351,7 @@ bool PathProvider(int key, base::FilePath* result) {
-         cur = cur.DirName();
-       }
- #else
--      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "PNACL"))
-         return false;
- #endif
-       cur = cur.Append(FILE_PATH_LITERAL("pnacl"));

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -1,17 +1,17 @@
 {
   "stable": {
-    "version": "85.0.4183.121",
+    "version": "86.0.4240.75",
-    "sha256": "0a1xn39kmvyfpal6pgnylpy30z0322p3v7sx6vxi0r2naiz58670",
+    "sha256": "1ddw4p9zfdzhi5hrd8x14k4w326znljzprnpfi2f917rlpnl2ynx",
-    "sha256bin64": "08vqf1v91703aik47344bl409rsl4myar9bsd2lsvzqncncwsaca"
+    "sha256bin64": "17isxkd80rccqim6izzl08vw4yr52qsk6djp1rmhhijzg9rsvghz"
   },
   "beta": {
-    "version": "86.0.4240.42",
+    "version": "86.0.4240.75",
-    "sha256": "06cfhiym9xmz2q86v6b6xcicrrp2pmr7karavylzz4fqvwd2v6fa",
+    "sha256": "1ddw4p9zfdzhi5hrd8x14k4w326znljzprnpfi2f917rlpnl2ynx",
-    "sha256bin64": "1z5zmdc2i31iimps7p5z43vv4qi83c8ljb7x68zc1rvf8x62p7xj"
+    "sha256bin64": "16snxdka5bkbvybx6x0dzgfbfaifv0jcc1dcny6vlqqp2fmb2v39"
   },
   "dev": {
-    "version": "87.0.4263.3",
+    "version": "87.0.4278.0",
-    "sha256": "1ybfrlm4417lpbg5qcwhq5p6nnxrw68wzyy5zvb1sg1ma8s9hhkk",
+    "sha256": "1ywmv4iwn2as7vk2n0pslnmr300fl5y809ynxiw5xqcx9j6i8w85",
-    "sha256bin64": "1f7a272kalglmdwmrrzb4iw3crvvpv3mhxca5jh75qpldn4gby6m"
+    "sha256bin64": "15dvwvk6l6n7l04085hr48hlvsijypasyk7d8iq3s6cxai3wx4cl"
   }
 }

third_party/nixpkgs/pkgs/applications/networking/browsers/elinks/debian-patches.nix

@@ -1,34 +0,0 @@
-# Generated by debian-patches.sh from debian-patches.txt
-let
-  prefix = "https://sources.debian.org/data/main/e/elinks/0.13.2-1/debian/patches";
-in
-[
-  {
-    url = "${prefix}/03_459467_ui.leds.enable_0.diff";
-    sha256 = "0l35lglmnvyzz3xyy18nksra14gsp7yc67rskbzmr61szg8b9jqr";
-  }
-  {
-    url = "${prefix}/04_436817_nostrip.diff";
-    sha256 = "0ixvxaba1ww375gpdh7r67srp3xsfb5vyz2sfv1pgj6mczwg8v24";
-  }
-  {
-    url = "${prefix}/07_617713_cache_control.diff";
-    sha256 = "0drn4r33ywvmihr0drsp2jwz7mlf5z5fv8ra7fpkdavx45xqaf15";
-  }
-  {
-    url = "${prefix}/10-reproducible-build.diff";
-    sha256 = "024yp3xsh0hw29l1wikfmk9j3mqval6pdr4xi7rzffrlaknh58h5";
-  }
-  {
-    url = "${prefix}/14_debug_disable_Werror.diff";
-    sha256 = "0s620r88ikfljflb5nd133cww2wc0i85ag8lzpvrsmg0q00hfmax";
-  }
-  {
-    url = "${prefix}/16_POST_BUFFER_SIZE.diff";
-    sha256 = "17vkvy0d0rabmgk8iqwgdsrgjn6dbb9cf6760qbz82zlb37s09nh";
-  }
-  {
-    url = "${prefix}/11-reproducible-build.diff";
-    sha256 = "1z17g9z68lh12fs6fkralfghh8bs1bs5mlq83d15l4bn3za3s0sl";
-  }
-]

third_party/nixpkgs/pkgs/applications/networking/browsers/elinks/debian-patches.txt

@@ -1,8 +0,0 @@
-elinks/0.13.2-1
-03_459467_ui.leds.enable_0.diff
-04_436817_nostrip.diff
-07_617713_cache_control.diff
-10-reproducible-build.diff
-14_debug_disable_Werror.diff
-16_POST_BUFFER_SIZE.diff
-11-reproducible-build.diff

third_party/nixpkgs/pkgs/applications/networking/browsers/elinks/default.nix

@@ -1,42 +1,38 @@
-{ stdenv, fetchurl, fetchpatch, ncurses, xlibsWrapper, bzip2, zlib, brotli, openssl, autoconf, automake, gettext, pkgconfig, libev
+{ stdenv, fetchFromGitHub, fetchpatch, ncurses, xlibsWrapper, bzip2, zlib
-, gpm
+, brotli, zstd, lzma, openssl, autoreconfHook, gettext, pkgconfig, libev
+, gpm, libidn, tre, expat
 , # Incompatible licenses, LGPLv3 - GPLv2
   enableGuile        ? false,                                         guile ? null
 , enablePython       ? false,                                         python ? null
 , enablePerl         ? (stdenv.hostPlatform == stdenv.buildPlatform), perl ? null
-, enableSpidermonkey ? (stdenv.hostPlatform == stdenv.buildPlatform), spidermonkey_38 ? null
+# re-add javascript support when upstream supports modern spidermonkey
 }:
 
 assert enableGuile -> guile != null;
 assert enablePython -> python != null;
 
 stdenv.mkDerivation rec {
-  pname = "elinks-0.13.2";
+  pname = "elinks";
-  version = "0.13.2";
+  version = "0.13.5";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://deb.debian.org/debian/pool/main/e/elinks/elinks_${version}.orig.tar.gz";
+    owner = "rkd77";
-    sha256 = "0xkpqnqy0x8sizx4snca0pw3q98gkhnw5a05yf144j1x1y2nb14c";
+    repo = "felinks";
+    rev = "v${version}";
+    sha256 = "067l9m47j40039q8mvvnxd1amwrac3x6vv0c0svimfpvj4ammgkg";
   };
 
-  patches = map fetchurl (import ./debian-patches.nix);
+  buildInputs = [
-
+    ncurses xlibsWrapper bzip2 zlib brotli zstd lzma
-  postPatch = (stdenv.lib.optional stdenv.isDarwin) ''
+    openssl libidn tre expat libev
-    patch -p0 < ${fetchpatch {
+  ]
-      url = "https://raw.githubusercontent.com/macports/macports-ports/72bed7749e76b9092ddd8d9fe2d8449c5afb1d71/www/elinks/files/patch-perl.diff";
-      sha256 = "14q9hk3kg2n2r5b062hvrladp7b4yzysvhq07903w9kpg4zdbyqh";
-    }}
-  '';
-
-  buildInputs = [ ncurses xlibsWrapper bzip2 zlib brotli openssl libev ]
     ++ stdenv.lib.optional stdenv.isLinux gpm
     ++ stdenv.lib.optional enableGuile guile
     ++ stdenv.lib.optional enablePython python
     ++ stdenv.lib.optional enablePerl perl
-    ++ stdenv.lib.optional enableSpidermonkey spidermonkey_38
     ;
 
-  nativeBuildInputs = [ autoconf automake gettext pkgconfig ];
+  nativeBuildInputs = [ autoreconfHook gettext pkgconfig ];
 
   configureFlags = [
     "--enable-finger"
@@ -46,23 +42,20 @@ stdenv.mkDerivation rec {
     "--enable-bittorrent"
     "--enable-nntp"
     "--enable-256-colors"
+    "--enable-true-color"
+    "--with-lzma"
     "--with-libev"
+    "--with-terminfo"
   ] ++ stdenv.lib.optional enableGuile        "--with-guile"
     ++ stdenv.lib.optional enablePython       "--with-python"
     ++ stdenv.lib.optional enablePerl         "--with-perl"
-    ++ stdenv.lib.optional enableSpidermonkey "--with-spidermonkey=${spidermonkey_38}"
     ;
 
-  preConfigure = ''
-    patchShebangs ./autogen.sh
-    ./autogen.sh
-  '';
-
   meta = with stdenv.lib; {
     description = "Full-featured text-mode web browser (package based on the fork felinks)";
     homepage = "https://github.com/rkd77/felinks";
     license = licenses.gpl2;
     platforms = with platforms; linux ++ darwin;
-    maintainers = with maintainers; [ iblech ];
+    maintainers = with maintainers; [ iblech gebner ];
   };
 }

third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/common.nix

@@ -21,8 +21,9 @@
 , pulseaudioSupport ? stdenv.isLinux, libpulseaudio
 , ffmpegSupport ? true
 , gtk3Support ? true, gtk2, gtk3, wrapGAppsHook
-, waylandSupport ? true, libxkbcommon, pipewire
+, waylandSupport ? true, libxkbcommon
 , gssSupport ? true, kerberos
+, pipewireSupport ? waylandSupport && webrtcSupport, pipewire
 
 ## privacy-related options
 
@@ -69,6 +70,7 @@
 }:
 
 assert stdenv.cc.libc or null != null;
+assert pipewireSupport -> !waylandSupport || !webrtcSupport -> throw "pipewireSupport requires both wayland and webrtc support.";
 
 let
   flag = tf: x: [(if tf then "--enable-${x}" else "--disable-${x}")];
@@ -84,6 +86,7 @@ let
   execdir = if stdenv.isDarwin
             then "/Applications/${binaryNameCapitalized}.app/Contents/MacOS"
             else "/bin";
+
 in
 
 stdenv.mkDerivation ({
@@ -94,12 +97,12 @@ stdenv.mkDerivation ({
 
   patches = [
     ./env_var_for_system_dir.patch
+  ] ++ lib.optional pipewireSupport
     (fetchpatch {
       # https://src.fedoraproject.org/rpms/firefox/blob/master/f/firefox-pipewire-0-3.patch
       url = "https://src.fedoraproject.org/rpms/firefox/raw/e99b683a352cf5b2c9ff198756859bae408b5d9d/f/firefox-pipewire-0-3.patch";
       sha256 = "0qc62di5823r7ly2lxkclzj9rhg2z7ms81igz44nv0fzv3dszdab";
     })
-  ]
   ++ patches;
 
 
@@ -128,7 +131,8 @@ stdenv.mkDerivation ({
   ++ lib.optional  pulseaudioSupport libpulseaudio # only headers are needed
   ++ lib.optional  gtk3Support gtk3
   ++ lib.optional  gssSupport kerberos
-  ++ lib.optionals waylandSupport [ libxkbcommon pipewire ]
+  ++ lib.optionals waylandSupport [ libxkbcommon ]
+  ++ lib.optionals pipewireSupport [ pipewire ]
   ++ lib.optionals stdenv.isDarwin [ CoreMedia ExceptionHandling Kerberos
                                      AVFoundation MediaToolbox CoreLocation
                                      Foundation libobjc AddressBook cups ];
@@ -142,8 +146,10 @@ stdenv.mkDerivation ({
 
   postPatch = ''
     rm -rf obj-x86_64-pc-linux-gnu
-
+  '' + lib.optionalString pipewireSupport ''
-    # needed for enabling webrtc+pipewire
+    # substitute the /usr/include/ lines for the libraries that pipewire provides.
+    # The patch we pick from fedora only contains the generated moz.build files
+    # which hardcode the dependency paths instead of running pkg_config.
     substituteInPlace \
       media/webrtc/trunk/webrtc/modules/desktop_capture/desktop_capture_generic_gn/moz.build \
       --replace /usr/include ${pipewire.dev}/include

third_party/nixpkgs/pkgs/applications/networking/browsers/palemoon/default.nix

@@ -2,7 +2,7 @@
 , pkgconfig, autoconf213, alsaLib, bzip2, cairo
 , dbus, dbus-glib, ffmpeg_3, file, fontconfig, freetype
 , gnome2, gnum4, gtk2, hunspell, libevent, libjpeg
-, libnotify, libstartup_notification, makeWrapper
+, libnotify, libstartup_notification, wrapGAppsHook
 , libGLU, libGL, perl, python2, libpulseaudio
 , unzip, xorg, wget, which, yasm, zip, zlib
 
@@ -16,13 +16,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "palemoon";
-  version = "28.13.0";
+  version = "28.14.2";
 
   src = fetchFromGitHub {
     owner = "MoonchildProductions";
     repo = "Pale-Moon";
     rev = "${version}_Release";
-    sha256 = "1lza6239kb32wnwd9cwddn11npg1qx7p69l7qy63h9c59w29iypa";
+    sha256 = "1qz2sqc8rcg5z5kncabgmpl6v4i6wrs9dlgmna69255qrmsshwgm";
     fetchSubmodules = true;
   };
 
@@ -42,7 +42,7 @@ in stdenv.mkDerivation rec {
   '';
 
   nativeBuildInputs = [
-    desktop-file-utils file gnum4 makeWrapper perl pkgconfig python2 wget which
+    desktop-file-utils file gnum4 perl pkgconfig python2 wget which wrapGAppsHook
   ];
 
   buildInputs = [
@@ -126,9 +126,15 @@ in stdenv.mkDerivation rec {
       size=$n"x"$n
       install -Dm644 $src/palemoon/branding/official/$iconname.png $out/share/icons/hicolor/$size/apps/palemoon.png
     done
+  '';
 
-    wrapProgram $out/lib/palemoon-${version}/palemoon \
+  dontWrapGApps = true;
+
+  preFixup = ''
+    gappsWrapperArgs+=(
       --prefix LD_LIBRARY_PATH : "${libPath}"
+    )
+    wrapGApp $out/lib/palemoon-${version}/palemoon
   '';
 
   meta = with lib; {

third_party/nixpkgs/pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -90,7 +90,7 @@ in stdenv.mkDerivation rec {
     description = "A Browser for our Friends, powerful and personal";
     homepage    = "https://vivaldi.com";
     license     = licenses.unfree;
-    maintainers = with maintainers; [ otwieracz nequissimus badmutex ];
+    maintainers = with maintainers; [ otwieracz badmutex ];
     platforms   = [ "x86_64-linux" ];
   };
 }

third_party/nixpkgs/pkgs/applications/networking/cluster/minikube/default.nix

@@ -11,7 +11,7 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.13.0";
+  version = "1.13.1";
 
   vendorSha256 = "09bcp7pqbs9j06z1glpad70dqlsnrf69vn75l00bdjknbrvbzrb9";
 
@@ -21,7 +21,7 @@ buildGoModule rec {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "1xlz07q0nlsq6js58b5ad0wxajwganaqcvwglj4w6fgmiqm9s1ny";
+    sha256 = "1x4x40nwcdshxzpg22v8nlzaprz1c6sizam47mwvqmb53p9qv90q";
   };
 
   nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];
@@ -49,7 +49,7 @@ buildGoModule rec {
     homepage = "https://minikube.sigs.k8s.io";
     description = "A tool that makes it easy to run Kubernetes locally";
     license = licenses.asl20;
-    maintainers = with maintainers; [ ebzzry copumpkin vdemeester atkinschang ];
+    maintainers = with maintainers; [ ebzzry copumpkin vdemeester atkinschang Chili-Man ];
     platforms = platforms.unix;
   };
 }

third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/default.nix

@@ -2,22 +2,24 @@
 , buildGoPackage
 , fetchFromGitHub
 , callPackage
+, runtimeShell
 }:
 let
-  list = import ./data.nix;
+  list = lib.importJSON ./providers.json;
 
-  toDrv = data:
+  toDrv = name: data:
-    buildGoPackage rec {
+    buildGoPackage {
-      inherit (data) owner repo rev version sha256;
+      pname = data.repo;
-      name = "${repo}-${version}";
+      version = data.version;
-      goPackagePath = "github.com/${owner}/${repo}";
+      goPackagePath = "github.com/${data.owner}/${data.repo}";
       subPackages = [ "." ];
       src = fetchFromGitHub {
-        inherit owner repo rev sha256;
+        inherit (data) owner repo rev sha256;
       };
       # Terraform allow checking the provider versions, but this breaks
       # if the versions are not provided via file paths.
-      postBuild = "mv $NIX_BUILD_TOP/go/bin/${repo}{,_v${version}}";
+      postBuild = "mv $NIX_BUILD_TOP/go/bin/${data.repo}{,_v${data.version}}";
+      passthru = data;
     };
 
   # Google is now using the vendored go modules, which works a bit differently
@@ -48,7 +50,7 @@ let
     });
 
   # These providers are managed with the ./update-all script
-  automated-providers = lib.mapAttrs (_: toDrv) list;
+  automated-providers = lib.mapAttrs (toDrv) list;
 
   # These are the providers that don't fall in line with the default model
   special-providers = {
@@ -57,6 +59,13 @@ let
     google-beta = patchGoModVendor automated-providers.google-beta;
     ibm = patchGoModVendor automated-providers.ibm;
 
+    acme = automated-providers.acme.overrideAttrs (attrs: {
+      prePatch = attrs.prePatch or "" + ''
+        substituteInPlace go.mod --replace terraform-providers/terraform-provider-acme getstackhead/terraform-provider-acme
+        substituteInPlace main.go --replace terraform-providers/terraform-provider-acme getstackhead/terraform-provider-acme
+      '';
+    });
+
     # providers that were moved to the `hashicorp` organization,
     # but haven't updated their references yet:
 

third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/keycloak/default.nix

@@ -4,7 +4,7 @@
 }:
 
 buildGoModule rec {
-  name = "terraform-provider-keycloak-${version}";
+  pname = "terraform-provider-keycloak";
   version = "1.20.0";
 
   src = fetchFromGitHub {

third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/update-all

@@ -1,177 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i bash -p bash coreutils jq nix gitAndTools.hub
-# vim: ft=sh sw=2 et
-# shellcheck shell=bash
-#
-# This scripts scans the github terraform-providers repo for new releases,
-# generates the corresponding nix code and finally generates an index of
-# all the providers given in ./providers.txt.
-set -euo pipefail
-
-# the maximum number of attempts before giving up inside of GET and prefetch_github
-readonly maxAttempts=30
-
-get_tf_providers_org() {
-  # returns all terraform providers in a given organization, and their the
-  # latest tags, in the format
-  # $org/$repo $rev
-  local org=$1
-  hub api --paginate graphql -f query="
-    query(\$endCursor: String) {
-      repositoryOwner(login: \"${org}\") {
-        repositories(first: 100, after: \$endCursor) {
-          nodes {
-            nameWithOwner
-            name
-            refs(first: 1, refPrefix: \"refs/tags/\", orderBy: {field: TAG_COMMIT_DATE, direction: DESC}) {
-              nodes {
-                name
-              }
-            }
-          }
-          pageInfo {
-            hasNextPage
-            endCursor
-          }
-        }
-      }
-  }" | \
-  jq -r '.data.repositoryOwner.repositories.nodes[] | select(.name | startswith("terraform-provider-")) | select((.refs.nodes | length) > 0) | .nameWithOwner + " " + .refs.nodes[0].name'
-  # filter the result with jq:
-  # - repos need to start with `teraform-provider-`
-  # - they need to have at least one tag
-  # for each of the remaining repos, assemble a string $org/$repo $rev
-}
-
-get_latest_repo_tag() {
-  # of a given repo and owner, retrieve the latest tag
-  local owner=$1
-  local repo=$2
-  hub api --paginate "https://api.github.com/repos/$owner/$repo/git/refs/tags" | \
-    jq -r '.[].ref' | \
-    grep -v 'v\.' | \
-    cut -d '/' -f 3- | \
-    sort --version-sort | \
-    tail -1
-}
-
-prefetch_github() {
-  # of a given owner, repo and rev, fetch the tarball and return the output of
-  # `nix-prefetch-url`
-  local owner=$1
-  local repo=$2
-  local rev=$3
-  local retry=1
-  while ! nix-prefetch-url --unpack "https://github.com/$owner/$repo/archive/$rev.tar.gz"; do
-    echo "The nix-prefetch-url command has failed. Attempt $retry/${maxAttempts}" >&2
-    if [[ "${retry}" -eq "${maxAttempts}" ]]; then
-      exit 1
-    fi
-    retry=$(( retry + 1 ))
-    sleep 5
-  done
-}
-
-echo_entry() {
-  local owner=$1
-  local repo=$2
-  local rev=$3
-  local version=${rev#v}
-  local sha256=$4
-  cat <<EOF
-{
-  owner   = "$owner";
-  repo    = "$repo";
-  rev     = "$rev";
-  version = "$version";
-  sha256  = "$sha256";
-};
-EOF
-}
-
-indent() { sed 's/^/    /'; }
-
-add_provider() {
-  org="${1}"
-  repo="${2}"
-  rev="${3}"
-
-  echo "*** $org/$repo $rev ***"
-  name=$(echo "$repo" | cut -d - -f 3-)
-  sha256=$(prefetch_github "$org" "$repo" "$rev")
-
-  {
-    echo "  $name ="
-    echo_entry "$org" "$repo" "$rev" "$sha256" | indent
-  } >> data.nix
-}
-
-## Main ##
-
-cd "$(dirname "$0")"
-
-# individual repos to fetch
-slugs=(
-  IBM-Cloud/terraform-provider-ibm
-  ajbosco/terraform-provider-segment
-  camptocamp/terraform-provider-pass
-  carlpett/terraform-provider-sops
-  poseidon/terraform-provider-matchbox
-  poseidon/terraform-provider-ct
-  tweag/terraform-provider-nixos
-  tweag/terraform-provider-secret
-)
-
-# a list of providers to ignore
-blacklist=(
-  terraform-providers/terraform-provider-azure-classic
-  terraform-providers/terraform-provider-cidr
-  terraform-providers/terraform-provider-circonus
-  terraform-providers/terraform-provider-cloudinit
-  terraform-providers/terraform-provider-quorum
-  hashicorp/terraform-provider-time
-  terraform-providers/terraform-provider-vmc
-)
-
-cat <<HEADER > data.nix
-# Generated with ./update-all
-{
-HEADER
-
-# assemble list of terraform providers
-providers=$(get_tf_providers_org "terraform-providers")
-providers=$(echo "$providers";get_tf_providers_org "hashicorp")
-
-# add terraform-providers from slugs
-for slug in "${slugs[@]}"; do
-  # retrieve latest tag
-  org=${slug%/*}
-  repo=${slug#*/}
-  rev=$(get_latest_repo_tag "$org" "$repo")
-
-  # add to list
-  providers=$(echo "$providers";echo "$org/$repo $rev")
-done
-
-# filter out all providers on the blacklist
-for repo in "${blacklist[@]}"; do
-  providers=$(echo "$providers" | grep -v "^${repo} ")
-done
-
-# sort results alphabetically by repo name
-providers=$(echo "$providers" | sort -t "/" --key=2)
-
-# render list
-IFS=$'\n'
-for provider in $providers; do
-  org=$(echo "$provider" | cut -d " " -f 1 | cut -d "/" -f1)
-  repo=$(echo "$provider" | cut -d " " -f 1 | cut -d "/" -f2)
-  rev=$(echo "$provider" | cut -d " " -f 2)
-  add_provider "${org}" "${repo}" "${rev}"
-done
-
-cat <<FOOTER >> data.nix
-}
-FOOTER
-
-echo Done.

third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/update-all-providers

@@ -0,0 +1,22 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p jq
+# shellcheck shell=bash
+
+# Update all providers which have specified provider source address
+set -euo pipefail
+
+providers=$(
+  jq -r 'to_entries
+  | map_values(.value + { alias: .key })
+  | .[]
+  | select(."provider-source-address"?)
+  | .alias' providers.json
+)
+
+echo "Will update providers:"
+echo "$providers"
+
+for provider in $providers; do
+  echo "Updating $provider"
+  ./update-provider "$provider"
+done

third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/update-provider

@@ -0,0 +1,77 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p coreutils curl jq
+# shellcheck shell=bash
+#
+# Update a terraform provider to the latest version advertised at
+# the provider source address.
+set -euo pipefail
+
+USAGE=$(cat<<DOC
+Specify the terraform provider name to update.
+
+Example:
+To update nixpkgs.terraform-providers.aws run:
+./update-provider aws
+DOC
+)
+
+provider_name="${1:-}"
+if [ -z "$provider_name" ]; then
+  echo "No providers specified!"
+  echo
+  echo "$USAGE"
+  exit 1
+fi
+
+provider_source_address="$(jq -r ".$provider_name.\"provider-source-address\"" providers.json)"
+
+if [ "$provider_source_address" == "null" ]; then
+  echo "No provider source address specified with provider: $provider_name"
+  exit 1
+fi
+
+# The provider source address (used inside Terraform `required_providers` block) is
+# used to compute the registry API endpoint
+#
+# registry.terraform.io/hashicorp/aws (provider source address)
+# registry.terraform.io/providers/hashicorp/aws (provider URL for the website)
+# registry.terraform.io/v1/providers/hashicorp/aws (provider URL for the JSON API)
+registry_response=$(curl -s https://"${provider_source_address/\///v1/providers/}")
+
+prefetch_github() {
+  # of a given owner, repo and rev, fetch the tarball and return the output of
+  # `nix-prefetch-url`
+  local owner=$1
+  local repo=$2
+  local rev=$3
+  nix-prefetch-url --unpack "https://github.com/$owner/$repo/archive/$rev.tar.gz"
+}
+
+provider_source_url="$(jq -r '.source' <<< "$registry_response")"
+
+org="$(echo "$provider_source_url" | cut -d '/' -f 4)"
+repo="$(echo "$provider_source_url" | cut -d '/' -f 5)"
+rev="$(jq -r '.tag' <<< "$registry_response")"
+
+sha256=$(prefetch_github "$org" "$repo" "$rev")
+
+version="$(jq -r '.version' <<< "$registry_response")"
+
+updated_provider="$(mktemp)"
+cat <<EOF >> "$updated_provider"
+{
+  "$provider_name": {
+    "owner": "$org",
+    "repo": "$repo",
+    "rev": "$rev",
+    "sha256": "$sha256",
+    "version": "$version",
+    "provider-source-address": "$provider_source_address"
+  }
+}
+EOF
+
+original_provider_list="$(mktemp)"
+cat providers.json > "$original_provider_list"
+
+jq --sort-keys --slurp '.[0] * .[1]' "$original_provider_list" "$updated_provider" > providers.json

third_party/nixpkgs/pkgs/applications/networking/cluster/terraform/default.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, buildEnv, buildGoPackage, fetchFromGitHub, makeWrapper, coreutils
-, runCommand, writeText, terraform-providers, fetchpatch }:
+, runCommand, runtimeShell, writeText, terraform-providers, fetchpatch }:
 
 let
   goPackagePath = "github.com/hashicorp/terraform";
@@ -43,12 +43,13 @@ let
         homepage = "https://www.terraform.io/";
         license = licenses.mpl20;
         maintainers = with maintainers; [
-          zimbatm
+          Chili-Man
-          peterhoeg
+          babariviere
           kalbasit
           marsam
-          babariviere
+          peterhoeg
-          Chili-Man
+          timstott
+          zimbatm
         ];
       };
     } // attrs');
@@ -59,6 +60,35 @@ let
         let
           actualPlugins = plugins terraform.plugins;
 
+          # Make providers available in Terraform 0.13 and 0.12 search paths.
+          pluginDir = lib.concatMapStrings (pl: let
+            inherit (pl) version GOOS GOARCH;
+
+            pname = pl.pname or (throw "${pl.name} is missing a pname attribute");
+
+            # This is just the name, without the terraform-provider- prefix
+            plugin_name = lib.removePrefix "terraform-provider-" pname;
+
+            slug = pl.passthru.provider-source-address or "registry.terraform.io/nixpkgs/${plugin_name}";
+
+            shim = writeText "shim" ''
+              #!${runtimeShell}
+              exec ${pl}/bin/${pname}_v${version} "$@"
+            '';
+            in ''
+              TF_0_13_PROVIDER_PATH=$out/plugins/${slug}/${version}/${GOOS}_${GOARCH}/${pname}_v${version}
+              mkdir -p "$(dirname $TF_0_13_PROVIDER_PATH)"
+
+              cp ${shim} "$TF_0_13_PROVIDER_PATH"
+              chmod +x "$TF_0_13_PROVIDER_PATH"
+
+              TF_0_12_PROVIDER_PATH=$out/plugins/${pname}_v${version}
+
+              cp ${shim} "$TF_0_12_PROVIDER_PATH"
+              chmod +x "$TF_0_12_PROVIDER_PATH"
+          ''
+          ) actualPlugins;
+
           # Wrap PATH of plugins propagatedBuildInputs, plugins may have runtime dependencies on external binaries
           wrapperInputs = lib.unique (lib.flatten
             (lib.catAttrs "propagatedBuildInputs"
@@ -87,15 +117,10 @@ let
             inherit (terraform) name;
             buildInputs = [ makeWrapper ];
 
-            buildCommand = ''
+            buildCommand = pluginDir + ''
               mkdir -p $out/bin/
               makeWrapper "${terraform}/bin/terraform" "$out/bin/terraform" \
-                --set NIX_TERRAFORM_PLUGIN_DIR "${
+                --set NIX_TERRAFORM_PLUGIN_DIR $out/plugins \
-                  buildEnv {
-                    name = "tf-plugin-env";
-                    paths = actualPlugins;
-                  }
-                }/bin" \
                 --prefix PATH : "${lib.makeBinPath wrapperInputs}"
             '';
 

third_party/nixpkgs/pkgs/applications/networking/flent/default.nix

@@ -25,10 +25,8 @@ buildPythonApplication rec {
     xvfb-run -s '-screen 0 800x600x24' ./test-runner
   '';
 
-  postInstall = ''
+  preFixup = ''
-    for program in $out/bin/*; do
+    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
-      wrapQtApp $program --prefix PYTHONPATH : $PYTHONPATH
-    done
   '';
 
   meta = with stdenv.lib; {