Project import generated by Copybara.

GitOrigin-RevId: 09c38c29f2c719cd76ca17a596c2fdac9e186ceb

third_party/nixpkgs/.github/workflows/merge-staging.yml

@@ -1,41 +0,0 @@
-name: "merge staging(-next)"
-
-on:
-  schedule:
-    # * is a special character in YAML so you have to quote this string
-    # Merge every 6 hours
-    - cron:  '0 */6 * * *'
-
-jobs:
-  sync-branch:
-    if: github.repository_owner == 'NixOS'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Merge master into staging-next
-        id: staging_next
-        uses: devmasx/merge-branch@v1.3.1
-        with:
-          type: now
-          from_branch: master
-          target_branch: staging-next
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Merge staging-next into staging
-        id: staging
-        uses: devmasx/merge-branch@v1.3.1
-        with:
-          type: now
-          from_branch: staging-next
-          target_branch: staging
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Comment on failure
-        uses: peter-evans/create-or-update-comment@v1
-        if: ${{ failure() }}
-        with:
-          issue-number: 105153
-          body: |
-            An automatic merge${{ (steps.staging_next.outcome == 'failure' && ' from master to staging-next') || ((steps.staging.outcome == 'failure' && ' from staging-next to staging') || '') }} [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
-

third_party/nixpkgs/.github/workflows/periodic-merge-24h.yml

@@ -0,0 +1,49 @@
+# This action periodically merges base branches into staging branches.
+# This is done to
+#  * prevent conflicts or rather resolve them early
+#  * make all potential breakage happen on the staging branch
+#  * and make sure that all major rebuilds happen before the staging
+#    branch get’s merged back into its base branch.
+
+name: "Periodic Merges (24h)"
+
+
+on:
+  schedule:
+    # * is a special character in YAML so you have to quote this string
+    # Merge every 6 hours
+    - cron:  '0 0 * * *'
+
+jobs:
+  periodic-merge:
+    if: github.repository_owner == 'NixOS'
+    runs-on: ubuntu-latest
+    strategy:
+      # don't fail fast, so that all pairs are tried
+      fail-fast: false
+      # certain branches need to be merged in order, like master->staging-next->staging
+      # and disabling parallelism ensures the order of the pairs below.
+      max-parallel: 1
+      matrix:
+        pairs:
+          - from: master
+            into: haskell-updates
+    name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
+        uses: devmasx/merge-branch@v1.3.1
+        with:
+          type: now
+          from_branch: ${{ matrix.pairs.from }}
+          target_branch: ${{ matrix.pairs.into }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Comment on failure
+        uses: peter-evans/create-or-update-comment@v1
+        if: ${{ failure() }}
+        with:
+          issue-number: 105153
+          body: |
+            Periodic merge from `${{ matrix.pairs.from }}` into `${{ matrix.pairs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).

third_party/nixpkgs/.github/workflows/periodic-merge-6h.yml

@@ -0,0 +1,55 @@
+# This action periodically merges base branches into staging branches.
+# This is done to
+#  * prevent conflicts or rather resolve them early
+#  * make all potential breakage happen on the staging branch
+#  * and make sure that all major rebuilds happen before the staging
+#    branch get’s merged back into its base branch.
+
+name: "Periodic Merges (6h)"
+
+
+on:
+  schedule:
+    # * is a special character in YAML so you have to quote this string
+    # Merge every 6 hours
+    - cron:  '0 */6 * * *'
+
+jobs:
+  periodic-merge:
+    if: github.repository_owner == 'NixOS'
+    runs-on: ubuntu-latest
+    strategy:
+      # don't fail fast, so that all pairs are tried
+      fail-fast: false
+      # certain branches need to be merged in order, like master->staging-next->staging
+      # and disabling parallelism ensures the order of the pairs below.
+      max-parallel: 1
+      matrix:
+        pairs:
+          - from: master
+            into: staging-next
+          - from: staging-next
+            into: staging
+          - from: release-21.05
+            into: staging-next-21.05
+          - from: staging-next-21.05
+            into: staging-21.05
+    name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
+    steps:
+      - uses: actions/checkout@v2
+
+      - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
+        uses: devmasx/merge-branch@v1.3.1
+        with:
+          type: now
+          from_branch: ${{ matrix.pairs.from }}
+          target_branch: ${{ matrix.pairs.into }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Comment on failure
+        uses: peter-evans/create-or-update-comment@v1
+        if: ${{ failure() }}
+        with:
+          issue-number: 105153
+          body: |
+            Periodic merge from `${{ matrix.pairs.from }}` into `${{ matrix.pairs.into }}` has [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).

third_party/nixpkgs/doc/builders/packages/steam.section.md

@@ -56,16 +56,7 @@ Use `programs.steam.enable = true;` if you want to add steam to systemPackages a
 
 ## steam-run {#sec-steam-run}
 
-The FHS-compatible chroot used for steam can also be used to run other linux games that expect a FHS environment. To do it, add
+The FHS-compatible chroot used for Steam can also be used to run other Linux games that expect a FHS environment. To use it, install the `steam-run-native` package and run the game with
-
-```nix
-pkgs.steam.override ({
-  nativeOnly = true;
-  newStdcpp = true;
-}).run
-```
-
-to your configuration, rebuild, and run the game with
 
 ```
 steam-run ./foo

third_party/nixpkgs/doc/languages-frameworks/beam.section.md

@@ -241,7 +241,7 @@ let
     git
     # replace with beam.packages.erlang.elixir_1_11 if you need
     beam.packages.erlang.elixir
-    nodejs-15_x
+    nodejs
     postgresql_13
     # only used for frontend dependencies
     # you are free to use yarn2nix as well

third_party/nixpkgs/doc/languages-frameworks/hy.section.md

@@ -0,0 +1,31 @@
+# Hy {#sec-language-hy}
+
+## Installation {#ssec-hy-installation}
+
+### Installation without packages {#installation-without-packages}
+
+You can install `hy` via nix-env or by adding it to `configuration.nix` by reffering to it as a `hy` attribute. This kind of installation adds `hy` to your environment and it succesfully works with `python3`.
+
+::: {.caution}
+Packages that are installed with your python derivation, are not accesible by `hy` this way.
+:::
+
+### Installation with packages {#installation-with-packages}
+
+Creating `hy` derivation with custom `python` packages is really simple and similar to the way that python does it. Attribute `hy` provides function `withPackages` that creates custom `hy` derivation with specified packages.
+
+For example if you want to create shell with `matplotlib` and `numpy`, you can do it like so:
+
+```ShellSession
+$ nix-shell -p "hy.withPackages (ps: with ps; [ numpy matplotlib ])"
+```
+
+Or if you want to extend your `configuration.nix`:
+```nix
+{ # ...
+
+  environment.systemPackages = with pkgs; [
+    (hy.withPackages (py-packages: with py-packages; [ numpy matplotlib ]))
+  ];
+}
+```

third_party/nixpkgs/doc/languages-frameworks/index.xml

@@ -16,6 +16,7 @@
  <xi:include href="gnome.section.xml" />
  <xi:include href="go.section.xml" />
  <xi:include href="haskell.section.xml" />
+ <xi:include href="hy.section.xml" />
  <xi:include href="idris.section.xml" />
  <xi:include href="ios.section.xml" />
  <xi:include href="java.section.xml" />

third_party/nixpkgs/maintainers/maintainer-list.nix

@@ -1701,6 +1701,18 @@
     githubId = 3471749;
     name = "Claudio Bley";
   };
+  cburstedde = {
+    email = "burstedde@ins.uni-bonn.de";
+    github = "cburstedde";
+    githubId = 109908;
+    name = "Carsten Burstedde";
+    keys = [
+      {
+        longkeyid = "rsa2048/0x0704CD9E550A6BCD";
+        fingerprint = "1127 A432 6524 BF02 737B  544E 0704 CD9E 550A 6BCD";
+      }
+    ];
+  };
   cdepillabout = {
     email = "cdep.illabout@gmail.com";
     github = "cdepillabout";
@@ -2562,7 +2574,7 @@
     name = "Diego Lelis";
   };
   diffumist = {
-    email = "diffumist@gmail.com";
+    email = "git@diffumist.me";
     github = "diffumist";
     githubId = 32810399;
     name = "Diffumist";
@@ -4049,6 +4061,12 @@
     github = "gytis-ivaskevicius";
     githubId = 23264966;
   };
+  hagl = {
+    email = "harald@glie.be";
+    github = "hagl";
+    githubId = 1162118;
+    name = "Harald Gliebe";
+  };
   hakuch = {
     email = "hakuch@gmail.com";
     github = "hakuch";
@@ -7228,10 +7246,10 @@
     name = "Marko Poikonen";
   };
   mtreca = {
-    email = "maxime@treca.dev";
+    email = "maxime.treca@gmail.com";
-    name = "Maxime Tréca";
     github = "mtreca";
     githubId = 16440823;
+    name = "Maxime Tréca";
   };
   mtreskin = {
     email = "zerthurd@gmail.com";
@@ -10776,6 +10794,12 @@
     githubId = 347983;
     name = "Udo Spallek";
   };
+  ulrikstrid = {
+    email = "ulrik.strid@outlook.com";
+    github = "ulrikstrid";
+    githubId = 1607770;
+    name = "Ulrik Strid";
+  };
   unode = {
     email = "alves.rjc@gmail.com";
     github = "unode";
@@ -10872,6 +10896,12 @@
     githubId = 608417;
     name = "Jos van den Oever";
   };
+  vanilla = {
+    email = "neko@hydev.org";
+    github = "VergeDX";
+    githubId = 25173827;
+    name = "Vanilla";
+  };
   vanschelven = {
     email = "klaas@vanschelven.com";
     github = "vanschelven";

third_party/nixpkgs/maintainers/scripts/haskell/mark-broken.sh

@@ -17,9 +17,9 @@ trap "rm ${tmpfile}" 0
 
 echo "Remember that you need to manually run 'maintainers/scripts/haskell/hydra-report.hs get-report' sometime before running this script."
 echo "Generating a list of broken builds and displaying for manual confirmation ..."
-maintainers/scripts/haskell/hydra-report.hs mark-broken-list | sort -i > $tmpfile
+maintainers/scripts/haskell/hydra-report.hs mark-broken-list | sort -i > "$tmpfile"
 
-$EDITOR $tmpfile
+$EDITOR "$tmpfile"
 
 tail -n +3 "$broken_config" >> "$tmpfile"
 
@@ -28,10 +28,11 @@ broken-packages:
   # These packages don't compile.
 EOF
 
+# clear environment here to avoid things like allowing broken builds in
 sort -iu "$tmpfile" >> "$broken_config"
-maintainers/scripts/haskell/regenerate-hackage-packages.sh
+env -i maintainers/scripts/haskell/regenerate-hackage-packages.sh
-maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
+env -i maintainers/scripts/haskell/regenerate-transitive-broken-packages.sh
-maintainers/scripts/haskell/regenerate-hackage-packages.sh
+env -i maintainers/scripts/haskell/regenerate-hackage-packages.sh
 
 if [[ "${1:-}" == "--do-commit" ]]; then
 git add $broken_config

third_party/nixpkgs/nixos/doc/manual/development/nixos-tests.xml

@@ -13,7 +13,7 @@ xlink:href="https://github.com/NixOS/nixpkgs/tree/master/nixos/tests">nixos/test
   one or more virtual machines containing the NixOS system(s) required for the
   test.
  </para>
- <xi:include href="writing-nixos-tests.xml" />
+ <xi:include href="../from_md/development/writing-nixos-tests.section.xml" />
- <xi:include href="running-nixos-tests.xml" />
+ <xi:include href="../from_md/development/running-nixos-tests.section.xml" />
- <xi:include href="running-nixos-tests-interactively.xml" />
+ <xi:include href="../from_md/development/running-nixos-tests-interactively.section.xml" />
 </chapter>

third_party/nixpkgs/nixos/doc/manual/development/running-nixos-tests-interactively.section.md

@@ -0,0 +1,44 @@
+# Running Tests interactively {#sec-running-nixos-tests-interactively}
+
+The test itself can be run interactively. This is particularly useful
+when developing or debugging a test:
+
+```ShellSession
+$ nix-build nixos/tests/login.nix -A driverInteractive
+$ ./result/bin/nixos-test-driver
+starting VDE switch for network 1
+>
+```
+
+You can then take any Python statement, e.g.
+
+```py
+> start_all()
+> test_script()
+> machine.succeed("touch /tmp/foo")
+> print(machine.succeed("pwd")) # Show stdout of command
+```
+
+The function `test_script` executes the entire test script and drops you
+back into the test driver command line upon its completion. This allows
+you to inspect the state of the VMs after the test (e.g. to debug the
+test script).
+
+To just start and experiment with the VMs, run:
+
+```ShellSession
+$ nix-build nixos/tests/login.nix -A driverInteractive
+$ ./result/bin/nixos-run-vms
+```
+
+The script `nixos-run-vms` starts the virtual machines defined by test.
+
+You can re-use the VM states coming from a previous run by setting the
+`--keep-vm-state` flag.
+
+```ShellSession
+$ ./result/bin/nixos-run-vms --keep-vm-state
+```
+
+The machine state is stored in the `$TMPDIR/vm-state-machinename`
+directory.

third_party/nixpkgs/nixos/doc/manual/development/running-nixos-tests-interactively.xml

@@ -1,49 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-        xmlns:xlink="http://www.w3.org/1999/xlink"
-        xmlns:xi="http://www.w3.org/2001/XInclude"
-        version="5.0"
-        xml:id="sec-running-nixos-tests-interactively">
- <title>Running Tests interactively</title>
-
- <para>
-  The test itself can be run interactively. This is particularly useful when
-  developing or debugging a test:
-<screen>
-<prompt>$ </prompt>nix-build nixos/tests/login.nix -A driverInteractive
-<prompt>$ </prompt>./result/bin/nixos-test-driver
-starting VDE switch for network 1
-<prompt>&gt;</prompt>
-</screen>
-  You can then take any Python statement, e.g.
-<screen>
-<prompt>&gt;</prompt> start_all()
-<prompt>&gt;</prompt> test_script()
-<prompt>&gt;</prompt> machine.succeed("touch /tmp/foo")
-<prompt>&gt;</prompt> print(machine.succeed("pwd")) # Show stdout of command
-</screen>
-  The function <command>test_script</command> executes the entire test script
-  and drops you back into the test driver command line upon its completion.
-  This allows you to inspect the state of the VMs after the test (e.g. to debug
-  the test script).
- </para>
-
- <para>
-  To just start and experiment with the VMs, run:
-<screen>
-<prompt>$ </prompt>nix-build nixos/tests/login.nix -A driverInteractive
-<prompt>$ </prompt>./result/bin/nixos-run-vms
-</screen>
-  The script <command>nixos-run-vms</command> starts the virtual machines
-  defined by test.
- </para>
-
- <para>
-   You can re-use the VM states coming from a previous run
-   by setting the <command>--keep-vm-state</command> flag.
-<screen>
-<prompt>$ </prompt>./result/bin/nixos-run-vms --keep-vm-state
-</screen>
-  The machine state is stored in the
-  <filename>$TMPDIR/vm-state-</filename><varname>machinename</varname> directory.
- </para>
-</section>

third_party/nixpkgs/nixos/doc/manual/development/running-nixos-tests.section.md

@@ -0,0 +1,31 @@
+# Running Tests {#sec-running-nixos-tests}
+
+You can run tests using `nix-build`. For example, to run the test
+[`login.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix),
+you just do:
+
+```ShellSession
+$ nix-build '<nixpkgs/nixos/tests/login.nix>'
+```
+
+or, if you don't want to rely on `NIX_PATH`:
+
+```ShellSession
+$ cd /my/nixpkgs/nixos/tests
+$ nix-build login.nix
+…
+running the VM test script
+machine: QEMU running (pid 8841)
+…
+6 out of 6 tests succeeded
+```
+
+After building/downloading all required dependencies, this will perform
+a build that starts a QEMU/KVM virtual machine containing a NixOS
+system. The virtual machine mounts the Nix store of the host; this makes
+VM creation very fast, as no disk image needs to be created. Afterwards,
+you can view a pretty-printed log of the test:
+
+```ShellSession
+$ firefox result/log.html
+```

third_party/nixpkgs/nixos/doc/manual/development/running-nixos-tests.xml

@@ -1,36 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-        xmlns:xlink="http://www.w3.org/1999/xlink"
-        xmlns:xi="http://www.w3.org/2001/XInclude"
-        version="5.0"
-        xml:id="sec-running-nixos-tests">
- <title>Running Tests</title>
-
- <para>
-  You can run tests using <command>nix-build</command>. For example, to run the
-  test
-  <filename
-xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix">login.nix</filename>,
-  you just do:
-<screen>
-<prompt>$ </prompt>nix-build '&lt;nixpkgs/nixos/tests/login.nix>'
-</screen>
-  or, if you don’t want to rely on <envar>NIX_PATH</envar>:
-<screen>
-<prompt>$ </prompt>cd /my/nixpkgs/nixos/tests
-<prompt>$ </prompt>nix-build login.nix
-…
-running the VM test script
-machine: QEMU running (pid 8841)
-…
-6 out of 6 tests succeeded
-</screen>
-  After building/downloading all required dependencies, this will perform a
-  build that starts a QEMU/KVM virtual machine containing a NixOS system. The
-  virtual machine mounts the Nix store of the host; this makes VM creation very
-  fast, as no disk image needs to be created. Afterwards, you can view a
-  pretty-printed log of the test:
-<screen>
-<prompt>$ </prompt>firefox result/log.html
-</screen>
- </para>
-</section>

third_party/nixpkgs/nixos/doc/manual/development/writing-nixos-tests.section.md

@@ -0,0 +1,301 @@
+# Writing Tests {#sec-writing-nixos-tests}
+
+A NixOS test is a Nix expression that has the following structure:
+
+```nix
+import ./make-test-python.nix {
+
+  # Either the configuration of a single machine:
+  machine =
+    { config, pkgs, ... }:
+    { configuration…
+    };
+
+  # Or a set of machines:
+  nodes =
+    { machine1 =
+        { config, pkgs, ... }: { … };
+      machine2 =
+        { config, pkgs, ... }: { … };
+      …
+    };
+
+  testScript =
+    ''
+      Python code…
+    '';
+}
+```
+
+The attribute `testScript` is a bit of Python code that executes the
+test (described below). During the test, it will start one or more
+virtual machines, the configuration of which is described by the
+attribute `machine` (if you need only one machine in your test) or by
+the attribute `nodes` (if you need multiple machines). For instance,
+[`login.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix)
+only needs a single machine to test whether users can log in
+on the virtual console, whether device ownership is correctly maintained
+when switching between consoles, and so on. On the other hand,
+[`nfs/simple.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs/simple.nix),
+which tests NFS client and server functionality in the
+Linux kernel (including whether locks are maintained across server
+crashes), requires three machines: a server and two clients.
+
+There are a few special NixOS configuration options for test VMs:
+
+`virtualisation.memorySize`
+
+:   The memory of the VM in megabytes.
+
+`virtualisation.vlans`
+
+:   The virtual networks to which the VM is connected. See
+    [`nat.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nat.nix)
+    for an example.
+
+`virtualisation.writableStore`
+
+:   By default, the Nix store in the VM is not writable. If you enable
+    this option, a writable union file system is mounted on top of the
+    Nix store to make it appear writable. This is necessary for tests
+    that run Nix operations that modify the store.
+
+For more options, see the module
+[`qemu-vm.nix`](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualisation/qemu-vm.nix).
+
+The test script is a sequence of Python statements that perform various
+actions, such as starting VMs, executing commands in the VMs, and so on.
+Each virtual machine is represented as an object stored in the variable
+`name` if this is also the identifier of the machine in the declarative
+config. If you didn\'t specify multiple machines using the `nodes`
+attribute, it is just `machine`. The following example starts the
+machine, waits until it has finished booting, then executes a command
+and checks that the output is more-or-less correct:
+
+```py
+machine.start()
+machine.wait_for_unit("default.target")
+if not "Linux" in machine.succeed("uname"):
+  raise Exception("Wrong OS")
+```
+
+The first line is actually unnecessary; machines are implicitly started
+when you first execute an action on them (such as `wait_for_unit` or
+`succeed`). If you have multiple machines, you can speed up the test by
+starting them in parallel:
+
+```py
+start_all()
+```
+
+The following methods are available on machine objects:
+
+`start`
+
+:   Start the virtual machine. This method is asynchronous --- it does
+    not wait for the machine to finish booting.
+
+`shutdown`
+
+:   Shut down the machine, waiting for the VM to exit.
+
+`crash`
+
+:   Simulate a sudden power failure, by telling the VM to exit
+    immediately.
+
+`block`
+
+:   Simulate unplugging the Ethernet cable that connects the machine to
+    the other machines.
+
+`unblock`
+
+:   Undo the effect of `block`.
+
+`screenshot`
+
+:   Take a picture of the display of the virtual machine, in PNG format.
+    The screenshot is linked from the HTML log.
+
+`get_screen_text_variants`
+
+:   Return a list of different interpretations of what is currently
+    visible on the machine\'s screen using optical character
+    recognition. The number and order of the interpretations is not
+    specified and is subject to change, but if no exception is raised at
+    least one will be returned.
+
+    ::: {.note}
+    This requires passing `enableOCR` to the test attribute set.
+    :::
+
+`get_screen_text`
+
+:   Return a textual representation of what is currently visible on the
+    machine\'s screen using optical character recognition.
+
+    ::: {.note}
+    This requires passing `enableOCR` to the test attribute set.
+    :::
+
+`send_monitor_command`
+
+:   Send a command to the QEMU monitor. This is rarely used, but allows
+    doing stuff such as attaching virtual USB disks to a running
+    machine.
+
+`send_key`
+
+:   Simulate pressing keys on the virtual keyboard, e.g.,
+    `send_key("ctrl-alt-delete")`.
+
+`send_chars`
+
+:   Simulate typing a sequence of characters on the virtual keyboard,
+    e.g., `send_chars("foobar\n")` will type the string `foobar`
+    followed by the Enter key.
+
+`execute`
+
+:   Execute a shell command, returning a list `(status, stdout)`.
+
+`succeed`
+
+:   Execute a shell command, raising an exception if the exit status is
+    not zero, otherwise returning the standard output. Commands are run
+    with `set -euo pipefail` set:
+
+    -   If several commands are separated by `;` and one fails, the
+        command as a whole will fail.
+
+    -   For pipelines, the last non-zero exit status will be returned
+        (if there is one, zero will be returned otherwise).
+
+    -   Dereferencing unset variables fail the command.
+
+`fail`
+
+:   Like `succeed`, but raising an exception if the command returns a zero
+    status.
+
+`wait_until_succeeds`
+
+:   Repeat a shell command with 1-second intervals until it succeeds.
+
+`wait_until_fails`
+
+:   Repeat a shell command with 1-second intervals until it fails.
+
+`wait_for_unit`
+
+:   Wait until the specified systemd unit has reached the "active"
+    state.
+
+`wait_for_file`
+
+:   Wait until the specified file exists.
+
+`wait_for_open_port`
+
+:   Wait until a process is listening on the given TCP port (on
+    `localhost`, at least).
+
+`wait_for_closed_port`
+
+:   Wait until nobody is listening on the given TCP port.
+
+`wait_for_x`
+
+:   Wait until the X11 server is accepting connections.
+
+`wait_for_text`
+
+:   Wait until the supplied regular expressions matches the textual
+    contents of the screen by using optical character recognition (see
+    `get_screen_text` and `get_screen_text_variants`).
+
+    ::: {.note}
+    This requires passing `enableOCR` to the test attribute set.
+    :::
+
+`wait_for_console_text`
+
+:   Wait until the supplied regular expressions match a line of the
+    serial console output. This method is useful when OCR is not
+    possibile or accurate enough.
+
+`wait_for_window`
+
+:   Wait until an X11 window has appeared whose name matches the given
+    regular expression, e.g., `wait_for_window("Terminal")`.
+
+`copy_from_host`
+
+:   Copies a file from host to machine, e.g.,
+    `copy_from_host("myfile", "/etc/my/important/file")`.
+
+    The first argument is the file on the host. The file needs to be
+    accessible while building the nix derivation. The second argument is
+    the location of the file on the machine.
+
+`systemctl`
+
+:   Runs `systemctl` commands with optional support for
+    `systemctl --user`
+
+    ```py
+    machine.systemctl("list-jobs --no-pager") # runs `systemctl list-jobs --no-pager`
+    machine.systemctl("list-jobs --no-pager", "any-user") # spawns a shell for `any-user` and runs `systemctl --user list-jobs --no-pager`
+    ```
+
+`shell_interact`
+
+:   Allows you to directly interact with the guest shell. This should
+    only be used during test development, not in production tests.
+    Killing the interactive session with `Ctrl-d` or `Ctrl-c` also ends
+    the guest session.
+
+To test user units declared by `systemd.user.services` the optional
+`user` argument can be used:
+
+```py
+machine.start()
+machine.wait_for_x()
+machine.wait_for_unit("xautolock.service", "x-session-user")
+```
+
+This applies to `systemctl`, `get_unit_info`, `wait_for_unit`,
+`start_job` and `stop_job`.
+
+For faster dev cycles it\'s also possible to disable the code-linters
+(this shouldn\'t be commited though):
+
+```nix
+import ./make-test-python.nix {
+  skipLint = true;
+  machine =
+    { config, pkgs, ... }:
+    { configuration…
+    };
+
+  testScript =
+    ''
+      Python code…
+    '';
+}
+```
+
+This will produce a Nix warning at evaluation time. To fully disable the
+linter, wrap the test script in comment directives to disable the Black
+linter directly (again, don\'t commit this within the Nixpkgs
+repository):
+
+```nix
+  testScript =
+    ''
+      # fmt: off
+      Python code…
+      # fmt: on
+    '';
+```

third_party/nixpkgs/nixos/doc/manual/development/writing-nixos-tests.xml

@@ -1,517 +0,0 @@
-<section xmlns="http://docbook.org/ns/docbook"
-        xmlns:xlink="http://www.w3.org/1999/xlink"
-        xmlns:xi="http://www.w3.org/2001/XInclude"
-        version="5.0"
-        xml:id="sec-writing-nixos-tests">
- <title>Writing Tests</title>
-
- <para>
-  A NixOS test is a Nix expression that has the following structure:
-<programlisting>
-import ./make-test-python.nix {
-
-  # Either the configuration of a single machine:
-  machine =
-    { config, pkgs, ... }:
-    { <replaceable>configuration…</replaceable>
-    };
-
-  # Or a set of machines:
-  nodes =
-    { <replaceable>machine1</replaceable> =
-        { config, pkgs, ... }: { <replaceable>…</replaceable> };
-      <replaceable>machine2</replaceable> =
-        { config, pkgs, ... }: { <replaceable>…</replaceable> };
-      …
-    };
-
-  testScript =
-    ''
-      <replaceable>Python code…</replaceable>
-    '';
-}
-</programlisting>
-  The attribute <literal>testScript</literal> is a bit of Python code that
-  executes the test (described below). During the test, it will start one or
-  more virtual machines, the configuration of which is described by the
-  attribute <literal>machine</literal> (if you need only one machine in your
-  test) or by the attribute <literal>nodes</literal> (if you need multiple
-  machines). For instance,
-  <filename
-xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix">login.nix</filename>
-  only needs a single machine to test whether users can log in on the virtual
-  console, whether device ownership is correctly maintained when switching
-  between consoles, and so on. On the other hand,
-  <filename
-xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs/simple.nix">nfs/simple.nix</filename>,
-  which tests NFS client and server functionality in the Linux kernel
-  (including whether locks are maintained across server crashes), requires
-  three machines: a server and two clients.
- </para>
-
- <para>
-  There are a few special NixOS configuration options for test VMs:
-<!-- FIXME: would be nice to generate this automatically. -->
-  <variablelist>
-   <varlistentry>
-    <term>
-     <option>virtualisation.memorySize</option>
-    </term>
-    <listitem>
-     <para>
-      The memory of the VM in megabytes.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <option>virtualisation.vlans</option>
-    </term>
-    <listitem>
-     <para>
-      The virtual networks to which the VM is connected. See
-      <filename
-    xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nat.nix">nat.nix</filename>
-      for an example.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <option>virtualisation.writableStore</option>
-    </term>
-    <listitem>
-     <para>
-      By default, the Nix store in the VM is not writable. If you enable this
-      option, a writable union file system is mounted on top of the Nix store
-      to make it appear writable. This is necessary for tests that run Nix
-      operations that modify the store.
-     </para>
-    </listitem>
-   </varlistentry>
-  </variablelist>
-  For more options, see the module
-  <filename
-xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualisation/qemu-vm.nix">qemu-vm.nix</filename>.
- </para>
-
- <para>
-  The test script is a sequence of Python statements that perform various
-  actions, such as starting VMs, executing commands in the VMs, and so on. Each
-  virtual machine is represented as an object stored in the variable
-  <literal><replaceable>name</replaceable></literal> if this is also the
-  identifier of the machine in the declarative config.
-  If you didn't specify multiple machines using the <literal>nodes</literal>
-  attribute, it is just <literal>machine</literal>.
-  The following example starts the machine, waits until it has finished booting,
-  then executes a command and checks that the output is more-or-less correct:
-<programlisting>
-machine.start()
-machine.wait_for_unit("default.target")
-if not "Linux" in machine.succeed("uname"):
-  raise Exception("Wrong OS")
-</programlisting>
-  The first line is actually unnecessary; machines are implicitly started when
-  you first execute an action on them (such as <literal>wait_for_unit</literal>
-  or <literal>succeed</literal>). If you have multiple machines, you can speed
-  up the test by starting them in parallel:
-<programlisting>
-start_all()
-</programlisting>
- </para>
-
- <para>
-  The following methods are available on machine objects:
-  <variablelist>
-   <varlistentry>
-    <term>
-     <methodname>start</methodname>
-    </term>
-    <listitem>
-     <para>
-      Start the virtual machine. This method is asynchronous — it does not
-      wait for the machine to finish booting.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>shutdown</methodname>
-    </term>
-    <listitem>
-     <para>
-      Shut down the machine, waiting for the VM to exit.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>crash</methodname>
-    </term>
-    <listitem>
-     <para>
-      Simulate a sudden power failure, by telling the VM to exit immediately.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>block</methodname>
-    </term>
-    <listitem>
-     <para>
-      Simulate unplugging the Ethernet cable that connects the machine to the
-      other machines.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>unblock</methodname>
-    </term>
-    <listitem>
-     <para>
-      Undo the effect of <methodname>block</methodname>.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>screenshot</methodname>
-    </term>
-    <listitem>
-     <para>
-      Take a picture of the display of the virtual machine, in PNG format. The
-      screenshot is linked from the HTML log.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>get_screen_text_variants</methodname>
-    </term>
-    <listitem>
-     <para>
-      Return a list of different interpretations of what is currently visible
-      on the machine's screen using optical character recognition. The number
-      and order of the interpretations is not specified and is subject to
-      change, but if no exception is raised at least one will be returned.
-     </para>
-     <note>
-      <para>
-       This requires passing <option>enableOCR</option> to the test attribute
-       set.
-      </para>
-     </note>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>get_screen_text</methodname>
-    </term>
-    <listitem>
-     <para>
-      Return a textual representation of what is currently visible on the
-      machine's screen using optical character recognition.
-     </para>
-     <note>
-      <para>
-       This requires passing <option>enableOCR</option> to the test attribute
-       set.
-      </para>
-     </note>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>send_monitor_command</methodname>
-    </term>
-    <listitem>
-     <para>
-      Send a command to the QEMU monitor. This is rarely used, but allows doing
-      stuff such as attaching virtual USB disks to a running machine.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>send_key</methodname>
-    </term>
-    <listitem>
-     <para>
-      Simulate pressing keys on the virtual keyboard, e.g.,
-      <literal>send_key("ctrl-alt-delete")</literal>.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>send_chars</methodname>
-    </term>
-    <listitem>
-     <para>
-      Simulate typing a sequence of characters on the virtual keyboard, e.g.,
-      <literal>send_chars("foobar\n")</literal> will type the string
-      <literal>foobar</literal> followed by the Enter key.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>execute</methodname>
-    </term>
-    <listitem>
-     <para>
-      Execute a shell command, returning a list
-      <literal>(<replaceable>status</replaceable>,
-      <replaceable>stdout</replaceable>)</literal>.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>succeed</methodname>
-    </term>
-    <listitem>
-     <para>
-      Execute a shell command, raising an exception if the exit status
-      is not zero, otherwise returning the standard output. Commands
-      are run with <literal>set -euo pipefail</literal> set:
-      <itemizedlist>
-        <listitem>
-          <para>
-            If several commands are separated by <literal>;</literal>
-            and one fails, the command as a whole will fail.
-          </para>
-        </listitem>
-        <listitem>
-          <para>
-            For pipelines, the last non-zero exit status will be
-            returned (if there is one, zero will be returned
-            otherwise).
-          </para>
-        </listitem>
-        <listitem>
-          <para>
-            Dereferencing unset variables fail the command.
-          </para>
-        </listitem>
-      </itemizedlist>
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>fail</methodname>
-    </term>
-    <listitem>
-     <para>
-      Like <methodname>succeed</methodname>, but raising an exception if the
-      command returns a zero status.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>wait_until_succeeds</methodname>
-    </term>
-    <listitem>
-     <para>
-      Repeat a shell command with 1-second intervals until it succeeds.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>wait_until_fails</methodname>
-    </term>
-    <listitem>
-     <para>
-      Repeat a shell command with 1-second intervals until it fails.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>wait_for_unit</methodname>
-    </term>
-    <listitem>
-     <para>
-      Wait until the specified systemd unit has reached the “active” state.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>wait_for_file</methodname>
-    </term>
-    <listitem>
-     <para>
-      Wait until the specified file exists.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>wait_for_open_port</methodname>
-    </term>
-    <listitem>
-     <para>
-      Wait until a process is listening on the given TCP port (on
-      <literal>localhost</literal>, at least).
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>wait_for_closed_port</methodname>
-    </term>
-    <listitem>
-     <para>
-      Wait until nobody is listening on the given TCP port.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>wait_for_x</methodname>
-    </term>
-    <listitem>
-     <para>
-      Wait until the X11 server is accepting connections.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>wait_for_text</methodname>
-    </term>
-    <listitem>
-     <para>
-      Wait until the supplied regular expressions matches the textual contents
-      of the screen by using optical character recognition (see
-     <methodname>get_screen_text</methodname> and
-     <methodname>get_screen_text_variants</methodname>).
-     </para>
-     <note>
-      <para>
-       This requires passing <option>enableOCR</option> to the test attribute
-       set.
-      </para>
-     </note>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>wait_for_console_text</methodname>
-    </term>
-    <listitem>
-     <para>
-      Wait until the supplied regular expressions match a line of the serial
-      console output. This method is useful when OCR is not possibile or
-      accurate enough.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>wait_for_window</methodname>
-    </term>
-    <listitem>
-     <para>
-      Wait until an X11 window has appeared whose name matches the given
-      regular expression, e.g., <literal>wait_for_window("Terminal")</literal>.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>copy_from_host</methodname>
-    </term>
-    <listitem>
-     <para>
-      Copies a file from host to machine, e.g.,
-      <literal>copy_from_host("myfile", "/etc/my/important/file")</literal>.
-     </para>
-     <para>
-      The first argument is the file on the host. The file needs to be
-      accessible while building the nix derivation. The second argument is the
-      location of the file on the machine.
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>systemctl</methodname>
-    </term>
-    <listitem>
-     <para>
-      Runs <literal>systemctl</literal> commands with optional support for
-      <literal>systemctl --user</literal>
-     </para>
-     <para>
-<programlisting>
-machine.systemctl("list-jobs --no-pager") # runs `systemctl list-jobs --no-pager`
-machine.systemctl("list-jobs --no-pager", "any-user") # spawns a shell for `any-user` and runs `systemctl --user list-jobs --no-pager`
-</programlisting>
-     </para>
-    </listitem>
-   </varlistentry>
-   <varlistentry>
-    <term>
-     <methodname>shell_interact</methodname>
-    </term>
-    <listitem>
-     <para>
-      Allows you to directly interact with the guest shell.
-      This should only be used during test development, not in production tests.
-      Killing the interactive session with <literal>Ctrl-d</literal> or <literal>Ctrl-c</literal> also ends the guest session.
-     </para>
-    </listitem>
-   </varlistentry>
-  </variablelist>
- </para>
-
- <para>
-  To test user units declared by <literal>systemd.user.services</literal> the
-  optional <literal>user</literal> argument can be used:
-<programlisting>
-machine.start()
-machine.wait_for_x()
-machine.wait_for_unit("xautolock.service", "x-session-user")
-</programlisting>
-  This applies to <literal>systemctl</literal>, <literal>get_unit_info</literal>,
-  <literal>wait_for_unit</literal>, <literal>start_job</literal> and
-  <literal>stop_job</literal>.
- </para>
-
- <para>
-  For faster dev cycles it's also possible to disable the code-linters (this shouldn't
-  be commited though):
-<programlisting>
-import ./make-test-python.nix {
-  skipLint = true;
-  machine =
-    { config, pkgs, ... }:
-    { <replaceable>configuration…</replaceable>
-    };
-
-  testScript =
-    ''
-      <replaceable>Python code…</replaceable>
-    '';
-}
-</programlisting>
-  This will produce a Nix warning at evaluation time. To fully disable the
-  linter, wrap the test script in comment directives to disable the Black linter
-  directly (again, don't commit this within the Nixpkgs repository):
-<programlisting>
-  testScript =
-    ''
-      # fmt: off
-      <replaceable>Python code…</replaceable>
-      # fmt: on
-    '';
-</programlisting>
- </para>
-</section>

third_party/nixpkgs/nixos/doc/manual/from_md/development/running-nixos-tests-interactively.section.xml

@@ -0,0 +1,50 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-running-nixos-tests-interactively">
+  <title>Running Tests interactively</title>
+  <para>
+    The test itself can be run interactively. This is particularly
+    useful when developing or debugging a test:
+  </para>
+  <programlisting>
+$ nix-build nixos/tests/login.nix -A driverInteractive
+$ ./result/bin/nixos-test-driver
+starting VDE switch for network 1
+&gt;
+</programlisting>
+  <para>
+    You can then take any Python statement, e.g.
+  </para>
+  <programlisting language="python">
+&gt; start_all()
+&gt; test_script()
+&gt; machine.succeed(&quot;touch /tmp/foo&quot;)
+&gt; print(machine.succeed(&quot;pwd&quot;)) # Show stdout of command
+</programlisting>
+  <para>
+    The function <literal>test_script</literal> executes the entire test
+    script and drops you back into the test driver command line upon its
+    completion. This allows you to inspect the state of the VMs after
+    the test (e.g. to debug the test script).
+  </para>
+  <para>
+    To just start and experiment with the VMs, run:
+  </para>
+  <programlisting>
+$ nix-build nixos/tests/login.nix -A driverInteractive
+$ ./result/bin/nixos-run-vms
+</programlisting>
+  <para>
+    The script <literal>nixos-run-vms</literal> starts the virtual
+    machines defined by test.
+  </para>
+  <para>
+    You can re-use the VM states coming from a previous run by setting
+    the <literal>--keep-vm-state</literal> flag.
+  </para>
+  <programlisting>
+$ ./result/bin/nixos-run-vms --keep-vm-state
+</programlisting>
+  <para>
+    The machine state is stored in the
+    <literal>$TMPDIR/vm-state-machinename</literal> directory.
+  </para>
+</section>

third_party/nixpkgs/nixos/doc/manual/from_md/development/running-nixos-tests.section.xml

@@ -0,0 +1,34 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-running-nixos-tests">
+  <title>Running Tests</title>
+  <para>
+    You can run tests using <literal>nix-build</literal>. For example,
+    to run the test
+    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix"><literal>login.nix</literal></link>,
+    you just do:
+  </para>
+  <programlisting>
+$ nix-build '&lt;nixpkgs/nixos/tests/login.nix&gt;'
+</programlisting>
+  <para>
+    or, if you don’t want to rely on <literal>NIX_PATH</literal>:
+  </para>
+  <programlisting>
+$ cd /my/nixpkgs/nixos/tests
+$ nix-build login.nix
+…
+running the VM test script
+machine: QEMU running (pid 8841)
+…
+6 out of 6 tests succeeded
+</programlisting>
+  <para>
+    After building/downloading all required dependencies, this will
+    perform a build that starts a QEMU/KVM virtual machine containing a
+    NixOS system. The virtual machine mounts the Nix store of the host;
+    this makes VM creation very fast, as no disk image needs to be
+    created. Afterwards, you can view a pretty-printed log of the test:
+  </para>
+  <programlisting>
+$ firefox result/log.html
+</programlisting>
+</section>

third_party/nixpkgs/nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml

@@ -0,0 +1,526 @@
+<section xmlns="http://docbook.org/ns/docbook" xmlns:xlink="http://www.w3.org/1999/xlink" xml:id="sec-writing-nixos-tests">
+  <title>Writing Tests</title>
+  <para>
+    A NixOS test is a Nix expression that has the following structure:
+  </para>
+  <programlisting language="bash">
+import ./make-test-python.nix {
+
+  # Either the configuration of a single machine:
+  machine =
+    { config, pkgs, ... }:
+    { configuration…
+    };
+
+  # Or a set of machines:
+  nodes =
+    { machine1 =
+        { config, pkgs, ... }: { … };
+      machine2 =
+        { config, pkgs, ... }: { … };
+      …
+    };
+
+  testScript =
+    ''
+      Python code…
+    '';
+}
+</programlisting>
+  <para>
+    The attribute <literal>testScript</literal> is a bit of Python code
+    that executes the test (described below). During the test, it will
+    start one or more virtual machines, the configuration of which is
+    described by the attribute <literal>machine</literal> (if you need
+    only one machine in your test) or by the attribute
+    <literal>nodes</literal> (if you need multiple machines). For
+    instance,
+    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/login.nix"><literal>login.nix</literal></link>
+    only needs a single machine to test whether users can log in on the
+    virtual console, whether device ownership is correctly maintained
+    when switching between consoles, and so on. On the other hand,
+    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nfs/simple.nix"><literal>nfs/simple.nix</literal></link>,
+    which tests NFS client and server functionality in the Linux kernel
+    (including whether locks are maintained across server crashes),
+    requires three machines: a server and two clients.
+  </para>
+  <para>
+    There are a few special NixOS configuration options for test VMs:
+  </para>
+  <variablelist>
+    <varlistentry>
+      <term>
+        <literal>virtualisation.memorySize</literal>
+      </term>
+      <listitem>
+        <para>
+          The memory of the VM in megabytes.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>virtualisation.vlans</literal>
+      </term>
+      <listitem>
+        <para>
+          The virtual networks to which the VM is connected. See
+          <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/tests/nat.nix"><literal>nat.nix</literal></link>
+          for an example.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>virtualisation.writableStore</literal>
+      </term>
+      <listitem>
+        <para>
+          By default, the Nix store in the VM is not writable. If you
+          enable this option, a writable union file system is mounted on
+          top of the Nix store to make it appear writable. This is
+          necessary for tests that run Nix operations that modify the
+          store.
+        </para>
+      </listitem>
+    </varlistentry>
+  </variablelist>
+  <para>
+    For more options, see the module
+    <link xlink:href="https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualisation/qemu-vm.nix"><literal>qemu-vm.nix</literal></link>.
+  </para>
+  <para>
+    The test script is a sequence of Python statements that perform
+    various actions, such as starting VMs, executing commands in the
+    VMs, and so on. Each virtual machine is represented as an object
+    stored in the variable <literal>name</literal> if this is also the
+    identifier of the machine in the declarative config. If you didn't
+    specify multiple machines using the <literal>nodes</literal>
+    attribute, it is just <literal>machine</literal>. The following
+    example starts the machine, waits until it has finished booting,
+    then executes a command and checks that the output is more-or-less
+    correct:
+  </para>
+  <programlisting language="python">
+machine.start()
+machine.wait_for_unit(&quot;default.target&quot;)
+if not &quot;Linux&quot; in machine.succeed(&quot;uname&quot;):
+  raise Exception(&quot;Wrong OS&quot;)
+</programlisting>
+  <para>
+    The first line is actually unnecessary; machines are implicitly
+    started when you first execute an action on them (such as
+    <literal>wait_for_unit</literal> or <literal>succeed</literal>). If
+    you have multiple machines, you can speed up the test by starting
+    them in parallel:
+  </para>
+  <programlisting language="python">
+start_all()
+</programlisting>
+  <para>
+    The following methods are available on machine objects:
+  </para>
+  <variablelist>
+    <varlistentry>
+      <term>
+        <literal>start</literal>
+      </term>
+      <listitem>
+        <para>
+          Start the virtual machine. This method is asynchronous — it
+          does not wait for the machine to finish booting.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>shutdown</literal>
+      </term>
+      <listitem>
+        <para>
+          Shut down the machine, waiting for the VM to exit.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>crash</literal>
+      </term>
+      <listitem>
+        <para>
+          Simulate a sudden power failure, by telling the VM to exit
+          immediately.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>block</literal>
+      </term>
+      <listitem>
+        <para>
+          Simulate unplugging the Ethernet cable that connects the
+          machine to the other machines.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>unblock</literal>
+      </term>
+      <listitem>
+        <para>
+          Undo the effect of <literal>block</literal>.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>screenshot</literal>
+      </term>
+      <listitem>
+        <para>
+          Take a picture of the display of the virtual machine, in PNG
+          format. The screenshot is linked from the HTML log.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>get_screen_text_variants</literal>
+      </term>
+      <listitem>
+        <para>
+          Return a list of different interpretations of what is
+          currently visible on the machine's screen using optical
+          character recognition. The number and order of the
+          interpretations is not specified and is subject to change, but
+          if no exception is raised at least one will be returned.
+        </para>
+        <note>
+          <para>
+            This requires passing <literal>enableOCR</literal> to the
+            test attribute set.
+          </para>
+        </note>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>get_screen_text</literal>
+      </term>
+      <listitem>
+        <para>
+          Return a textual representation of what is currently visible
+          on the machine's screen using optical character recognition.
+        </para>
+        <note>
+          <para>
+            This requires passing <literal>enableOCR</literal> to the
+            test attribute set.
+          </para>
+        </note>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>send_monitor_command</literal>
+      </term>
+      <listitem>
+        <para>
+          Send a command to the QEMU monitor. This is rarely used, but
+          allows doing stuff such as attaching virtual USB disks to a
+          running machine.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>send_key</literal>
+      </term>
+      <listitem>
+        <para>
+          Simulate pressing keys on the virtual keyboard, e.g.,
+          <literal>send_key(&quot;ctrl-alt-delete&quot;)</literal>.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>send_chars</literal>
+      </term>
+      <listitem>
+        <para>
+          Simulate typing a sequence of characters on the virtual
+          keyboard, e.g.,
+          <literal>send_chars(&quot;foobar\n&quot;)</literal> will type
+          the string <literal>foobar</literal> followed by the Enter
+          key.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>execute</literal>
+      </term>
+      <listitem>
+        <para>
+          Execute a shell command, returning a list
+          <literal>(status, stdout)</literal>.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>succeed</literal>
+      </term>
+      <listitem>
+        <para>
+          Execute a shell command, raising an exception if the exit
+          status is not zero, otherwise returning the standard output.
+          Commands are run with <literal>set -euo pipefail</literal>
+          set:
+        </para>
+        <itemizedlist>
+          <listitem>
+            <para>
+              If several commands are separated by <literal>;</literal>
+              and one fails, the command as a whole will fail.
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              For pipelines, the last non-zero exit status will be
+              returned (if there is one, zero will be returned
+              otherwise).
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              Dereferencing unset variables fail the command.
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>fail</literal>
+      </term>
+      <listitem>
+        <para>
+          Like <literal>succeed</literal>, but raising an exception if
+          the command returns a zero status.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>wait_until_succeeds</literal>
+      </term>
+      <listitem>
+        <para>
+          Repeat a shell command with 1-second intervals until it
+          succeeds.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>wait_until_fails</literal>
+      </term>
+      <listitem>
+        <para>
+          Repeat a shell command with 1-second intervals until it fails.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>wait_for_unit</literal>
+      </term>
+      <listitem>
+        <para>
+          Wait until the specified systemd unit has reached the
+          <quote>active</quote> state.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>wait_for_file</literal>
+      </term>
+      <listitem>
+        <para>
+          Wait until the specified file exists.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>wait_for_open_port</literal>
+      </term>
+      <listitem>
+        <para>
+          Wait until a process is listening on the given TCP port (on
+          <literal>localhost</literal>, at least).
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>wait_for_closed_port</literal>
+      </term>
+      <listitem>
+        <para>
+          Wait until nobody is listening on the given TCP port.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>wait_for_x</literal>
+      </term>
+      <listitem>
+        <para>
+          Wait until the X11 server is accepting connections.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>wait_for_text</literal>
+      </term>
+      <listitem>
+        <para>
+          Wait until the supplied regular expressions matches the
+          textual contents of the screen by using optical character
+          recognition (see <literal>get_screen_text</literal> and
+          <literal>get_screen_text_variants</literal>).
+        </para>
+        <note>
+          <para>
+            This requires passing <literal>enableOCR</literal> to the
+            test attribute set.
+          </para>
+        </note>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>wait_for_console_text</literal>
+      </term>
+      <listitem>
+        <para>
+          Wait until the supplied regular expressions match a line of
+          the serial console output. This method is useful when OCR is
+          not possibile or accurate enough.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>wait_for_window</literal>
+      </term>
+      <listitem>
+        <para>
+          Wait until an X11 window has appeared whose name matches the
+          given regular expression, e.g.,
+          <literal>wait_for_window(&quot;Terminal&quot;)</literal>.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>copy_from_host</literal>
+      </term>
+      <listitem>
+        <para>
+          Copies a file from host to machine, e.g.,
+          <literal>copy_from_host(&quot;myfile&quot;, &quot;/etc/my/important/file&quot;)</literal>.
+        </para>
+        <para>
+          The first argument is the file on the host. The file needs to
+          be accessible while building the nix derivation. The second
+          argument is the location of the file on the machine.
+        </para>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>systemctl</literal>
+      </term>
+      <listitem>
+        <para>
+          Runs <literal>systemctl</literal> commands with optional
+          support for <literal>systemctl --user</literal>
+        </para>
+        <programlisting language="python">
+machine.systemctl(&quot;list-jobs --no-pager&quot;) # runs `systemctl list-jobs --no-pager`
+machine.systemctl(&quot;list-jobs --no-pager&quot;, &quot;any-user&quot;) # spawns a shell for `any-user` and runs `systemctl --user list-jobs --no-pager`
+</programlisting>
+      </listitem>
+    </varlistentry>
+    <varlistentry>
+      <term>
+        <literal>shell_interact</literal>
+      </term>
+      <listitem>
+        <para>
+          Allows you to directly interact with the guest shell. This
+          should only be used during test development, not in production
+          tests. Killing the interactive session with
+          <literal>Ctrl-d</literal> or <literal>Ctrl-c</literal> also
+          ends the guest session.
+        </para>
+      </listitem>
+    </varlistentry>
+  </variablelist>
+  <para>
+    To test user units declared by
+    <literal>systemd.user.services</literal> the optional
+    <literal>user</literal> argument can be used:
+  </para>
+  <programlisting language="python">
+machine.start()
+machine.wait_for_x()
+machine.wait_for_unit(&quot;xautolock.service&quot;, &quot;x-session-user&quot;)
+</programlisting>
+  <para>
+    This applies to <literal>systemctl</literal>,
+    <literal>get_unit_info</literal>, <literal>wait_for_unit</literal>,
+    <literal>start_job</literal> and <literal>stop_job</literal>.
+  </para>
+  <para>
+    For faster dev cycles it's also possible to disable the code-linters
+    (this shouldn't be commited though):
+  </para>
+  <programlisting language="bash">
+import ./make-test-python.nix {
+  skipLint = true;
+  machine =
+    { config, pkgs, ... }:
+    { configuration…
+    };
+
+  testScript =
+    ''
+      Python code…
+    '';
+}
+</programlisting>
+  <para>
+    This will produce a Nix warning at evaluation time. To fully disable
+    the linter, wrap the test script in comment directives to disable
+    the Black linter directly (again, don't commit this within the
+    Nixpkgs repository):
+  </para>
+  <programlisting language="bash">
+  testScript =
+    ''
+      # fmt: off
+      Python code…
+      # fmt: on
+    '';
+</programlisting>
+</section>

third_party/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

@@ -48,6 +48,14 @@
           <link xlink:href="options.html#opt-networking.ucarp.enable">networking.ucarp</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          Users of flashrom should migrate to
+          <link xlink:href="options.html#opt-programs.flashrom.enable">programs.flashrom.enable</link>
+          and add themselves to the <literal>flashrom</literal> group to
+          be able to access programmers supported by flashrom.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-incompatibilities">

third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2111.section.md

@@ -16,6 +16,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [ucarp](https://download.pureftpd.org/pub/ucarp/README), an userspace implementation of the Common Address Redundancy Protocol (CARP). Available as [networking.ucarp](options.html#opt-networking.ucarp.enable).
 
+- Users of flashrom should migrate to [programs.flashrom.enable](options.html#opt-programs.flashrom.enable) and add themselves to the `flashrom` group to be able to access programmers supported by flashrom.
+
 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}
 
 - The `staticjinja` package has been upgraded from 1.0.4 to 2.0.0

third_party/nixpkgs/nixos/modules/config/shells-environment.nix

@@ -126,6 +126,14 @@ in
       type = types.bool;
     };
 
+    environment.localBinInPath = mkOption {
+      description = ''
+        Add ~/.local/bin/ to $PATH
+      '';
+      default = false;
+      type = types.bool;
+    };
+
     environment.binsh = mkOption {
       default = "${config.system.build.binsh}/bin/sh";
       defaultText = "\${config.system.build.binsh}/bin/sh";
@@ -198,6 +206,10 @@ in
           # ~/bin if it exists overrides other bin directories.
           export PATH="$HOME/bin:$PATH"
         ''}
+
+        ${optionalString cfg.localBinInPath ''
+          export PATH="$HOME/.local/bin:$PATH"
+        ''}
       '';
 
     system.activationScripts.binsh = stringAfter [ "stdio" ]

third_party/nixpkgs/nixos/modules/installer/tools/tools.nix

@@ -40,7 +40,7 @@ let
   };
 
   nixos-option =
-    if lib.versionAtLeast (lib.getVersion pkgs.nix) "2.4pre"
+    if lib.versionAtLeast (lib.getVersion config.nix.package) "2.4pre"
     then null
     else pkgs.callPackage ./nixos-option { };
 

third_party/nixpkgs/nixos/modules/module-list.nix

@@ -138,6 +138,7 @@
   ./programs/file-roller.nix
   ./programs/firejail.nix
   ./programs/fish.nix
+  ./programs/flashrom.nix
   ./programs/flexoptix-app.nix
   ./programs/freetds.nix
   ./programs/fuse.nix

third_party/nixpkgs/nixos/modules/programs/flashrom.nix

@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.flashrom;
+in
+{
+  options.programs.flashrom = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Installs flashrom and configures udev rules for programmers
+        used by flashrom. Grants access to users in the "flashrom"
+        group.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.udev.packages = [ pkgs.flashrom ];
+    environment.systemPackages = [ pkgs.flashrom ];
+    users.groups.flashrom = { };
+  };
+}

third_party/nixpkgs/nixos/modules/programs/zsh/zsh.nix

@@ -91,7 +91,7 @@ in
           # before setting your PS1 and etc. Otherwise this will likely to interact with
           # your ~/.zshrc configuration in unexpected ways as the default prompt sets
           # a lot of different prompt variables.
-          autoload -U promptinit && promptinit && prompt walters && setopt prompt_sp
+          autoload -U promptinit && promptinit && prompt suse && setopt prompt_sp
         '';
         description = ''
           Shell script code used to initialise the zsh prompt.

third_party/nixpkgs/nixos/modules/security/systemd-confinement.nix

@@ -105,7 +105,7 @@ in {
         wantsAPIVFS = lib.mkDefault (config.confinement.mode == "full-apivfs");
       in lib.mkIf config.confinement.enable {
         serviceConfig = {
-          RootDirectory = pkgs.runCommand rootName {} "mkdir \"$out\"";
+          RootDirectory = "/var/empty";
           TemporaryFileSystem = "/";
           PrivateMounts = lib.mkDefault true;
 

third_party/nixpkgs/nixos/modules/services/audio/slimserver.nix

@@ -63,6 +63,7 @@ in {
         description = "Slimserver daemon user";
         home = cfg.dataDir;
         group = "slimserver";
+        isSystemUser = true;
       };
       groups.slimserver = {};
     };

third_party/nixpkgs/nixos/modules/services/backup/sanoid.nix

@@ -10,74 +10,51 @@ let
       description = "dataset/template options";
     };
 
-  # Default values from https://github.com/jimsalterjrs/sanoid/blob/master/sanoid.defaults.conf
-
   commonOptions = {
     hourly = mkOption {
       description = "Number of hourly snapshots.";
-      type = types.ints.unsigned;
+      type = with types; nullOr ints.unsigned;
-      default = 48;
+      default = null;
     };
 
     daily = mkOption {
       description = "Number of daily snapshots.";
-      type = types.ints.unsigned;
+      type = with types; nullOr ints.unsigned;
-      default = 90;
+      default = null;
     };
 
     monthly = mkOption {
       description = "Number of monthly snapshots.";
-      type = types.ints.unsigned;
+      type = with types; nullOr ints.unsigned;
-      default = 6;
+      default = null;
     };
 
     yearly = mkOption {
       description = "Number of yearly snapshots.";
-      type = types.ints.unsigned;
+      type = with types; nullOr ints.unsigned;
-      default = 0;
+      default = null;
     };
 
     autoprune = mkOption {
       description = "Whether to automatically prune old snapshots.";
-      type = types.bool;
+      type = with types; nullOr bool;
-      default = true;
+      default = null;
     };
 
     autosnap = mkOption {
       description = "Whether to automatically take snapshots.";
-      type = types.bool;
+      type = with types; nullOr bool;
-      default = true;
+      default = null;
-    };
-
-    settings = mkOption {
-      description = ''
-        Free-form settings for this template/dataset. See
-        <link xlink:href="https://github.com/jimsalterjrs/sanoid/blob/master/sanoid.defaults.conf"/>
-        for allowed values.
-      '';
-      type = datasetSettingsType;
     };
   };
 
-  commonConfig = config: {
+  datasetOptions = rec {
-    settings = {
+    use_template = mkOption {
-      hourly = mkDefault config.hourly;
-      daily = mkDefault config.daily;
-      monthly = mkDefault config.monthly;
-      yearly = mkDefault config.yearly;
-      autoprune = mkDefault config.autoprune;
-      autosnap = mkDefault config.autosnap;
-    };
-  };
-
-  datasetOptions = {
-    useTemplate = mkOption {
       description = "Names of the templates to use for this dataset.";
-      type = (types.listOf (types.enum (attrNames cfg.templates))) // {
+      type = types.listOf (types.enum (attrNames cfg.templates));
-        description = "list of template names";
-      };
       default = [];
     };
+    useTemplate = use_template;
 
     recursive = mkOption {
       description = "Whether to recursively snapshot dataset children.";
@@ -85,19 +62,12 @@ let
       default = false;
     };
 
-    processChildrenOnly = mkOption {
+    process_children_only = mkOption {
       description = "Whether to only snapshot child datasets if recursing.";
       type = types.bool;
       default = false;
     };
-  };
+    processChildrenOnly = process_children_only;
-
-  datasetConfig = config: {
-    settings = {
-      use_template = mkDefault config.useTemplate;
-      recursive = mkDefault config.recursive;
-      process_children_only = mkDefault config.processChildrenOnly;
-    };
   };
 
   # Extract pool names from configured datasets
@@ -109,11 +79,11 @@ let
       else generators.mkValueStringDefault {} v;
 
     mkKeyValue = k: v: if v == null then ""
+      else if k == "processChildrenOnly" then ""
+      else if k == "useTemplate" then ""
       else generators.mkKeyValueDefault { inherit mkValueString; } "=" k v;
   in generators.toINI { inherit mkKeyValue; } cfg.settings;
 
-  configDir = pkgs.writeTextDir "sanoid.conf" configFile;
-
 in {
 
     # Interface
@@ -135,19 +105,21 @@ in {
       };
 
       datasets = mkOption {
-        type = types.attrsOf (types.submodule ({ config, ... }: {
+        type = types.attrsOf (types.submodule ({config, options, ...}: {
+          freeformType = datasetSettingsType;
           options = commonOptions // datasetOptions;
-          config = mkMerge [ (commonConfig config) (datasetConfig config) ];
+          config.use_template = mkAliasDefinitions (options.useTemplate or {});
+          config.process_children_only = mkAliasDefinitions (options.processChildrenOnly or {});
         }));
         default = {};
         description = "Datasets to snapshot.";
       };
 
       templates = mkOption {
-        type = types.attrsOf (types.submodule ({ config, ... }: {
+        type = types.attrsOf (types.submodule {
+          freeformType = datasetSettingsType;
           options = commonOptions;
-          config = commonConfig config;
+        });
-        }));
         default = {};
         description = "Templates for datasets.";
       };
@@ -177,8 +149,8 @@ in {
 
     config = mkIf cfg.enable {
       services.sanoid.settings = mkMerge [
-        (mapAttrs' (d: v: nameValuePair ("template_" + d) v.settings) cfg.templates)
+        (mapAttrs' (d: v: nameValuePair ("template_" + d) v) cfg.templates)
-        (mapAttrs (d: v: v.settings) cfg.datasets)
+        (mapAttrs (d: v: v) cfg.datasets)
       ];
 
       systemd.services.sanoid = {
@@ -191,7 +163,7 @@ in {
           ExecStart = lib.escapeShellArgs ([
             "${pkgs.sanoid}/bin/sanoid"
             "--cron"
-            "--configdir" configDir
+            "--configdir" (pkgs.writeTextDir "sanoid.conf" configFile)
           ] ++ cfg.extraArgs);
           ExecStopPost = map (pool: lib.escapeShellArgs [
             "+/run/booted-system/sw/bin/zfs" "unallow" "sanoid" pool

third_party/nixpkgs/nixos/modules/services/cluster/kubernetes/pki.nix

@@ -189,6 +189,7 @@ in
         # manually paste it in place. Just symlink.
         # otherwise, create the target file, ready for users to insert the token
 
+        mkdir -p $(dirname ${certmgrAPITokenPath})
         if [ -f "${cfsslAPITokenPath}" ]; then
           ln -fs "${cfsslAPITokenPath}" "${certmgrAPITokenPath}"
         else

third_party/nixpkgs/nixos/modules/services/cluster/kubernetes/proxy.nix

@@ -59,7 +59,7 @@ in
       description = "Kubernetes Proxy Service";
       wantedBy = [ "kubernetes.target" ];
       after = [ "kube-apiserver.service" ];
-      path = with pkgs; [ iptables conntrack_tools ];
+      path = with pkgs; [ iptables conntrack-tools ];
       serviceConfig = {
         Slice = "kubernetes.slice";
         ExecStart = ''${top.package}/bin/kube-proxy \

third_party/nixpkgs/nixos/modules/services/misc/geoipupdate.nix

@@ -99,9 +99,22 @@ in
       LockFile = "/run/geoipupdate/.lock";
     };
 
+    systemd.services.geoipupdate-create-db-dir = {
+      serviceConfig.Type = "oneshot";
+      script = ''
+        mkdir -p ${cfg.settings.DatabaseDirectory}
+        chmod 0755 ${cfg.settings.DatabaseDirectory}
+      '';
+    };
+
     systemd.services.geoipupdate = {
       description = "GeoIP Updater";
-      after = [ "network-online.target" "nss-lookup.target" ];
+      requires = [ "geoipupdate-create-db-dir.service" ];
+      after = [
+        "geoipupdate-create-db-dir.service"
+        "network-online.target"
+        "nss-lookup.target"
+      ];
       wants = [ "network-online.target" ];
       startAt = cfg.interval;
       serviceConfig = {
@@ -119,11 +132,9 @@ in
               };
             };
 
-            geoipupdateConf = pkgs.writeText "discourse.conf" (geoipupdateKeyValue cfg.settings);
+            geoipupdateConf = pkgs.writeText "geoipupdate.conf" (geoipupdateKeyValue cfg.settings);
 
             script = ''
-              mkdir -p "${cfg.settings.DatabaseDirectory}"
-              chmod 755 "${cfg.settings.DatabaseDirectory}"
               chown geoip "${cfg.settings.DatabaseDirectory}"
 
               cp ${geoipupdateConf} /run/geoipupdate/GeoIP.conf
@@ -139,7 +150,38 @@ in
         ReadWritePaths = cfg.settings.DatabaseDirectory;
         RuntimeDirectory = "geoipupdate";
         RuntimeDirectoryMode = 0700;
+        CapabilityBoundingSet = "";
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        MemoryDenyWriteExecute = true;
+        LockPersonality = true;
+        SystemCallArchitectures = "native";
+      };
+    };
+
+    systemd.timers.geoipupdate-initial-run = {
+      wantedBy = [ "timers.target" ];
+      unitConfig.ConditionPathExists = "!${cfg.settings.DatabaseDirectory}";
+      timerConfig = {
+        Unit = "geoipupdate.service";
+        OnActiveSec = 0;
       };
     };
   };
+
+  meta.maintainers = [ lib.maintainers.talyz ];
 }

third_party/nixpkgs/nixos/modules/services/network-filesystems/ipfs.nix

@@ -231,9 +231,9 @@ in {
           }
         fi
       '' + optionalString cfg.autoMount ''
-        ipfs --local config Mounts.FuseAllowOther --json true
+        ipfs --offline config Mounts.FuseAllowOther --json true
-        ipfs --local config Mounts.IPFS ${cfg.ipfsMountDir}
+        ipfs --offline config Mounts.IPFS ${cfg.ipfsMountDir}
-        ipfs --local config Mounts.IPNS ${cfg.ipnsMountDir}
+        ipfs --offline config Mounts.IPNS ${cfg.ipnsMountDir}
       '' + concatStringsSep "\n" (collect
             isString
             (mapAttrsRecursive
@@ -243,7 +243,7 @@ in {
                 read value <<EOF
                 ${builtins.toJSON value}
                 EOF
-                ipfs --local config --json "${concatStringsSep "." path}" "$value"
+                ipfs --offline config --json "${concatStringsSep "." path}" "$value"
               '')
               ({ Addresses.API = cfg.apiAddress;
                  Addresses.Gateway = cfg.gatewayAddress;

third_party/nixpkgs/nixos/modules/services/networking/ssh/sshd.nix

@@ -453,6 +453,7 @@ in
               { ExecStart =
                   (optionalString cfg.startWhenNeeded "-") +
                   "${cfgc.package}/bin/sshd " + (optionalString cfg.startWhenNeeded "-i ") +
+                  "-D " +  # don't detach into a daemon process
                   "-f /etc/ssh/sshd_config";
                 KillMode = "process";
               } // (if cfg.startWhenNeeded then {

third_party/nixpkgs/nixos/modules/services/networking/tailscale.nix

@@ -34,7 +34,7 @@ in {
     systemd.packages = [ cfg.package ];
     systemd.services.tailscaled = {
       wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.openresolv ];
+      path = [ pkgs.openresolv pkgs.procps ];
       serviceConfig.Environment = [
         "PORT=${toString cfg.port}"
         ''"FLAGS=--tun ${lib.escapeShellArg cfg.interfaceName}"''

third_party/nixpkgs/nixos/modules/services/web-apps/discourse.nix

@@ -30,6 +30,9 @@ in
       package = lib.mkOption {
         type = lib.types.package;
         default = pkgs.discourse;
+        apply = p: p.override {
+          plugins = lib.unique (p.enabledPlugins ++ cfg.plugins);
+        };
         defaultText = "pkgs.discourse";
         description = ''
           The discourse package to use.
@@ -731,8 +734,6 @@ in
 
           cp -r ${cfg.package}/share/discourse/config.dist/* /run/discourse/config/
           cp -r ${cfg.package}/share/discourse/public.dist/* /run/discourse/public/
-          cp -r ${cfg.package}/share/discourse/plugins.dist/* /run/discourse/plugins/
-          ${lib.concatMapStringsSep "\n" (p: "ln -sf ${p} /run/discourse/plugins/") cfg.plugins}
           ln -sf /var/lib/discourse/uploads /run/discourse/public/uploads
           ln -sf /var/lib/discourse/backups /run/discourse/public/backups
 

third_party/nixpkgs/nixos/modules/services/web-servers/minio.nix

@@ -4,6 +4,11 @@ with lib;
 
 let
   cfg = config.services.minio;
+
+  legacyCredentials = cfg: pkgs.writeText "minio-legacy-credentials" ''
+    MINIO_ROOT_USER=${cfg.accessKey}
+    MINIO_ROOT_PASSWORD=${cfg.secretKey}
+  '';
 in
 {
   meta.maintainers = [ maintainers.bachp ];
@@ -49,6 +54,17 @@ in
       '';
     };
 
+    rootCredentialsFile = mkOption  {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        File containing the MINIO_ROOT_USER, default is "minioadmin", and
+        MINIO_ROOT_PASSWORD (length >= 8), default is "minioadmin"; in the format of
+        an EnvironmentFile=, as described by systemd.exec(5).
+      '';
+      example = "/etc/nixos/minio-root-credentials";
+    };
+
     region = mkOption {
       default = "us-east-1";
       type = types.str;
@@ -72,6 +88,8 @@ in
   };
 
   config = mkIf cfg.enable {
+    warnings = optional ((cfg.accessKey != "") || (cfg.secretKey != "")) "services.minio.`accessKey` and services.minio.`secretKey` are deprecated, please use services.minio.`rootCredentialsFile` instead.";
+
     systemd.tmpfiles.rules = [
       "d '${cfg.configDir}' - minio minio - -"
     ] ++ (map (x:  "d '" + x + "' - minio minio - - ") cfg.dataDir);
@@ -86,14 +104,13 @@ in
         User = "minio";
         Group = "minio";
         LimitNOFILE = 65536;
+        EnvironmentFile = if (cfg.rootCredentialsFile != null) then cfg.rootCredentialsFile
+                          else if ((cfg.accessKey != "") || (cfg.secretKey != "")) then (legacyCredentials cfg)
+                          else null;
       };
       environment = {
         MINIO_REGION = "${cfg.region}";
         MINIO_BROWSER = "${if cfg.browser then "on" else "off"}";
-      } // optionalAttrs (cfg.accessKey != "") {
-        MINIO_ACCESS_KEY = "${cfg.accessKey}";
-      } // optionalAttrs (cfg.secretKey != "") {
-        MINIO_SECRET_KEY = "${cfg.secretKey}";
       };
     };
 

third_party/nixpkgs/nixos/modules/services/x11/display-managers/gdm.nix

@@ -99,7 +99,8 @@ in
       autoSuspend = mkOption {
         default = true;
         description = ''
-          Suspend the machine after inactivity.
+          On the GNOME Display Manager login screen, suspend the machine after inactivity.
+          (Does not affect automatic suspend while logged in, or at lock screen.)
         '';
         type = types.bool;
       };

third_party/nixpkgs/nixos/modules/services/x11/window-managers/fvwm.nix

@@ -4,7 +4,7 @@ with lib;
 
 let
   cfg = config.services.xserver.windowManager.fvwm;
-  fvwm = pkgs.fvwm.override { gestures = cfg.gestures; };
+  fvwm = pkgs.fvwm.override { enableGestures = cfg.gestures; };
 in
 
 {

third_party/nixpkgs/nixos/modules/system/boot/kernel.nix

@@ -38,11 +38,11 @@ in
       default = pkgs.linuxPackages;
       type = types.unspecified // { merge = mergeEqualOption; };
       apply = kernelPackages: kernelPackages.extend (self: super: {
-        kernel = super.kernel.override {
+        kernel = super.kernel.override (originalArgs: {
           inherit randstructSeed;
-          kernelPatches = super.kernel.kernelPatches ++ kernelPatches;
+          kernelPatches = (originalArgs.kernelPatches or []) ++ kernelPatches;
           features = lib.recursiveUpdate super.kernel.features features;
-        };
+        });
       });
       # We don't want to evaluate all of linuxPackages for the manual
       # - some of it might not even evaluate correctly.

third_party/nixpkgs/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

@@ -61,7 +61,7 @@ def write_loader_conf(profile: Optional[str], generation: int) -> None:
 
 
 def profile_path(profile: Optional[str], generation: int, name: str) -> str:
-    return os.readlink("%s/%s" % (system_dir(profile, generation), name))
+    return os.path.realpath("%s/%s" % (system_dir(profile, generation), name))
 
 
 def copy_from_profile(profile: Optional[str], generation: int, name: str, dry_run: bool = False) -> str:

third_party/nixpkgs/nixos/modules/system/boot/luksroot.nix

@@ -621,6 +621,8 @@ in
               Whether to allow TRIM requests to the underlying device. This option
               has security implications; please read the LUKS documentation before
               activating it.
+              This option is incompatible with authenticated encryption (dm-crypt
+              stacked over dm-integrity).
             '';
           };
 

third_party/nixpkgs/nixos/tests/kubernetes/base.nix

@@ -40,7 +40,7 @@ let
                   allowedTCPPorts = [
                     10250 # kubelet
                   ];
-                  trustedInterfaces = ["docker0"];
+                  trustedInterfaces = ["mynet"];
 
                   extraCommands = concatMapStrings  (node: ''
                     iptables -A INPUT -s ${node.config.networking.primaryIPAddress} -j ACCEPT
@@ -61,6 +61,13 @@ let
                   advertiseAddress = master.ip;
                 };
                 masterAddress = "${masterName}.${config.networking.domain}";
+                # workaround for:
+                #   https://github.com/kubernetes/kubernetes/issues/102676
+                #   (workaround from) https://github.com/kubernetes/kubernetes/issues/95488
+                kubelet.extraOpts = ''\
+                  --cgroups-per-qos=false \
+                  --enforce-node-allocatable="" \
+                '';
               };
             }
             (optionalAttrs (any (role: role == "master") machine.roles) {

third_party/nixpkgs/nixos/tests/sanoid.nix

@@ -33,7 +33,7 @@ in {
 
           autosnap = true;
         };
-        datasets."pool/sanoid".useTemplate = [ "test" ];
+        datasets."pool/sanoid".use_template = [ "test" ];
         extraArgs = [ "--verbose" ];
       };
 

third_party/nixpkgs/nixos/tests/vault.nix

@@ -19,6 +19,8 @@ import ./make-test-python.nix ({ pkgs, ... }:
       machine.wait_for_unit("vault.service")
       machine.wait_for_open_port(8200)
       machine.succeed("vault operator init")
-      machine.succeed("vault status | grep Sealed | grep true")
+      # vault now returns exit code 2 for sealed vaults
+      machine.fail("vault status")
+      machine.succeed("vault status || test $? -eq 2")
     '';
 })

third_party/nixpkgs/nixos/tests/zsh-history.nix

@@ -23,7 +23,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     # Login
     default.wait_until_tty_matches(1, "login: ")
     default.send_chars("root\n")
-    default.wait_until_tty_matches(1, "root@default>")
+    default.wait_until_tty_matches(1, r"\nroot@default\b")
 
     # Generate some history
     default.send_chars("echo foobar\n")

third_party/nixpkgs/pkgs/applications/audio/freac/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "freac";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "enzo1982";
     repo = "freac";
     rev = "v${version}";
-    sha256 = "sha256-JwZJOV4mxNKqhhdlfFcX06NwBxmbye2mgMfdM//bHYI=";
+    sha256 = "sha256-cRmN9D/+FLiXqZW/PYhw61EoZuL3y61YtQ/ZNjnhfmY=";
   };
 
   buildInputs = [

third_party/nixpkgs/pkgs/applications/audio/mixxx/default.nix

@@ -1,49 +1,117 @@
-{ lib, mkDerivation, fetchurl, fetchFromGitHub, chromaprint
+{ lib
-, fftw, flac, faad2, glibcLocales, mp4v2
+, mkDerivation
-, libid3tag, libmad, libopus, libshout, libsndfile, libusb1, libvorbis
+, fetchurl
-, libGLU, libxcb, lilv, lv2, opusfile
+, fetchFromGitHub
-, pkg-config, portaudio, portmidi, protobuf, qtbase, qtscript, qtsvg
+, chromaprint
-, qtx11extras, rubberband, sconsPackages, sqlite, taglib, upower, vamp-plugin-sdk
+, cmake
+, faad2
+, ffmpeg
+, fftw
+, flac
+, glibcLocales
+, hidapi
+, lame
+, libebur128
+, libGLU
+, libid3tag
+, libkeyfinder
+, libmad
+, libmodplug
+, libopus
+, libsecret
+, libshout
+, libsndfile
+, libusb1
+, libvorbis
+, libxcb
+, lilv
+, lv2
+, mp4v2
+, opusfile
+, pcre
+, pkg-config
+, portaudio
+, portmidi
+, protobuf
+, qtbase
+, qtkeychain
+, qtscript
+, qtsvg
+, qtx11extras
+, rubberband
+, serd
+, sord
+, soundtouch
+, sratom
+, sqlite
+, taglib
+, upower
+, vamp-plugin-sdk
+, wavpack
 }:
 
-let
-  # Because libshout 2.4.2 and newer seem to break streaming in mixxx, build it
-  # with 2.4.1 instead.
-  libshout241 = libshout.overrideAttrs (o: rec {
-    name = "libshout-2.4.1";
-    src = fetchurl {
-      url = "http://downloads.xiph.org/releases/libshout/${name}.tar.gz";
-      sha256 = "0kgjpf8jkgyclw11nilxi8vyjk4s8878x23qyxnvybbgqbgbib7k";
-    };
-  });
-in
 mkDerivation rec {
   pname = "mixxx";
-  version = "2.2.4";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "mixxxdj";
     repo = "mixxx";
-    rev = "release-${version}";
+    rev = version;
-    sha256 = "1dj9li8av9b2kbm76jvvbdmihy1pyrw0s4xd7dd524wfhwr1llxr";
+    sha256 = "18sx4l3zzbn5142xfv5bp0crdd615a5728fkprqacnx3zpa144x6";
   };
 
-  nativeBuildInputs = [ sconsPackages.scons_3_1_2 ];
+  nativeBuildInputs = [ cmake pkg-config ];
+
   buildInputs = [
-    chromaprint fftw flac faad2 glibcLocales mp4v2 libid3tag libmad libopus libshout241 libsndfile
+    chromaprint
-    libusb1 libvorbis libxcb libGLU lilv lv2 opusfile pkg-config portaudio portmidi protobuf qtbase qtscript qtsvg
+    faad2
-    qtx11extras rubberband sqlite taglib upower vamp-plugin-sdk
+    ffmpeg
+    fftw
+    flac
+    glibcLocales
+    hidapi
+    lame
+    libebur128
+    libGLU
+    libid3tag
+    libkeyfinder
+    libmad
+    libmodplug
+    libopus
+    libsecret
+    libshout
+    libsndfile
+    libusb1
+    libvorbis
+    libxcb
+    lilv
+    lv2
+    mp4v2
+    opusfile
+    pcre
+    portaudio
+    portmidi
+    protobuf
+    qtbase
+    qtkeychain
+    qtscript
+    qtsvg
+    qtx11extras
+    rubberband
+    serd
+    sord
+    soundtouch
+    sratom
+    sqlite
+    taglib
+    upower
+    vamp-plugin-sdk
+    wavpack
   ];
 
   enableParallelBuilding = true;
 
-  sconsFlags = [
-    "build=release"
-    "qtdir=${qtbase}"
-    "faad=1"
-    "opus=1"
-  ];
-
   qtWrapperArgs = [
     "--set LOCALE_ARCHIVE ${glibcLocales}/lib/locale/locale-archive"
   ];
@@ -52,7 +120,7 @@ mkDerivation rec {
     homepage = "https://mixxx.org";
     description = "Digital DJ mixing software";
     license = licenses.gpl2Plus;
-    maintainers = [ maintainers.goibhniu maintainers.bfortz ];
+    maintainers = with maintainers; [ goibhniu bfortz ];
     platforms = platforms.linux;
   };
 }

third_party/nixpkgs/pkgs/applications/audio/scream/default.nix

@@ -1,26 +1,29 @@
 { stdenv, lib, config, fetchFromGitHub, cmake, pkg-config
 , alsaSupport ? stdenv.isLinux, alsa-lib
 , pulseSupport ? config.pulseaudio or stdenv.isLinux, libpulseaudio
+, jackSupport ? false, libjack2
 }:
 
 stdenv.mkDerivation rec {
   pname = "scream";
-  version = "3.6";
+  version = "3.7";
 
   src = fetchFromGitHub {
     owner = "duncanthrax";
     repo = pname;
     rev = version;
-    sha256 = "01k2zhfb781gfj3apmcjqbm5m05m6pvnh7fb5k81zwvqibai000v";
+    sha256 = "0d9abrw62cd08lcg4il415b7ap89iggbljvbl5jqv2y23il0pvyz";
   };
 
   buildInputs = lib.optional pulseSupport libpulseaudio
+    ++ lib.optional jackSupport libjack2
     ++ lib.optional alsaSupport alsa-lib;
   nativeBuildInputs = [ cmake pkg-config ];
 
   cmakeFlags = [
     "-DPULSEAUDIO_ENABLE=${if pulseSupport then "ON" else "OFF"}"
     "-DALSA_ENABLE=${if alsaSupport then "ON" else "OFF"}"
+    "-DJACK_ENABLE=${if jackSupport then "ON" else "OFF"}"
   ];
 
   cmakeDir = "../Receivers/unix";

third_party/nixpkgs/pkgs/applications/backup/restique/default.nix

@@ -0,0 +1,41 @@
+{ lib
+, mkDerivation
+, fetchFromGitea
+, cmake
+, libsecret
+, qtkeychain
+, restic
+}:
+
+mkDerivation rec {
+  pname = "restique";
+  version = "unstable-2021-05-03";
+
+  src = fetchFromGitea {
+    domain = "git.srcbox.net";
+    owner = "stefan";
+    repo = "restique";
+    rev = "f83ea63c2e2f2a41e845f54c7fe2c391a528a121";
+    sha256 = "0j1qihv7hd90xkfm4ksv74q6m7cq781fbdnc3l4spcd7h2p8lh0z";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libsecret
+    qtkeychain
+  ];
+
+  qtWrapperArgs = [
+    "--prefix" "PATH" ":" (lib.makeBinPath [ restic ])
+  ];
+
+  meta = with lib; {
+    description = "Restic GUI for Desktop/Laptop Backups";
+    homepage = "https://git.srcbox.net/stefan/restique";
+    license = with licenses; [ gpl3Plus cc-by-sa-40 cc0 ];
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}

third_party/nixpkgs/pkgs/applications/blockchains/bisq-desktop/default.nix

@@ -0,0 +1,99 @@
+{ stdenv
+, lib
+, makeWrapper
+, fetchurl
+, makeDesktopItem
+, copyDesktopItems
+, imagemagick
+, openjdk11
+, dpkg
+, writeScript
+, coreutils
+, bash
+, tor
+, psmisc
+}:
+let
+  bisq-launcher = writeScript "bisq-launcher" ''
+    #! ${bash}/bin/bash
+
+    # Setup a temporary Tor instance
+    TMPDIR=$(${coreutils}/bin/mktemp -d)
+    CONTROLPORT=$(${coreutils}/bin/shuf -i 9100-9499 -n 1)
+    SOCKSPORT=$(${coreutils}/bin/shuf -i 9500-9999 -n 1)
+    ${coreutils}/bin/head -c 1024 < /dev/urandom > $TMPDIR/cookie
+
+    ${tor}/bin/tor --SocksPort $SOCKSPORT --ControlPort $CONTROLPORT \
+      --ControlPortWriteToFile $TMPDIR/port --CookieAuthFile $TMPDIR/cookie \
+      --CookieAuthentication 1 >$TMPDIR/tor.log --RunAsDaemon 1
+
+    torpid=$(${psmisc}/bin/fuser $CONTROLPORT/tcp)
+
+    echo Temp directory: $TMPDIR
+    echo Tor PID: $torpid
+    echo Tor control port: $CONTROLPORT
+    echo Tor SOCKS port: $SOCKSPORT
+    echo Tor log: $TMPDIR/tor.log
+    echo Bisq log file: $TMPDIR/bisq.log
+
+    JAVA_TOOL_OPTIONS="-XX:MaxRAM=4g" bisq-desktop-wrapped \
+      --torControlCookieFile=$TMPDIR/cookie \
+      --torControlUseSafeCookieAuth \
+      --torControlPort $CONTROLPORT "$@" > $TMPDIR/bisq.log
+
+    echo Bisq exited. Killing Tor...
+    kill $torpid
+  '';
+in
+stdenv.mkDerivation rec {
+  version = "1.7.0";
+  pname = "bisq-desktop";
+  nativeBuildInputs = [ makeWrapper copyDesktopItems dpkg ];
+
+  src = fetchurl {
+    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
+    sha256 = "0crry5k7crmrqn14wxiyrnhk09ac8a9ksqrwwky7jsnyah0bx5k4";
+  };
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "Bisq";
+      exec = "bisq-desktop";
+      icon = "bisq";
+      desktopName = "Bisq";
+      genericName = "Decentralized bitcoin exchange";
+      categories = "Network;Utility;";
+    })
+  ];
+
+  unpackPhase = ''
+    dpkg -x $src .
+  '';
+
+  installPhase = ''
+    mkdir -p $out/lib $out/bin
+    cp opt/bisq/lib/app/desktop-${version}-all.jar $out/lib
+
+    makeWrapper ${openjdk11}/bin/java $out/bin/bisq-desktop-wrapped \
+      --add-flags "-jar $out/lib/desktop-${version}-all.jar bisq.desktop.app.BisqAppMain"
+
+    makeWrapper ${bisq-launcher} $out/bin/bisq-desktop \
+      --prefix PATH : $out/bin
+
+    copyDesktopItems
+
+    for n in 16 24 32 48 64 96 128 256; do
+      size=$n"x"$n
+      ${imagemagick}/bin/convert opt/bisq/lib/Bisq.png -resize $size bisq.png
+      install -Dm644 -t $out/share/icons/hicolor/$size/apps bisq.png
+    done;
+  '';
+
+  meta = with lib; {
+    description = "A decentralized bitcoin exchange network";
+    homepage = "https://bisq.network";
+    license = licenses.mit;
+    maintainers = with maintainers; [ juaningan emmanuelrosa ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

third_party/nixpkgs/pkgs/applications/blockchains/ledger-live-desktop/default.nix

@@ -2,12 +2,12 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.26.1";
+  version = "2.29.0";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/LedgerHQ/${pname}/releases/download/v${version}/${pname}-${version}-linux-x86_64.AppImage";
-    sha256 = "0zbzqq3c0q45dz4vvgfbvqcgda7413mnwixi7yi78qb9mp8zxkhy";
+    sha256 = "1y4xvnwh2mqbc39pmnpgjg8mlx208s2pipm7dazq4bgmay7k9zh0";
   };
 
   appimageContents = appimageTools.extractType2 {

third_party/nixpkgs/pkgs/applications/blockchains/trezor-suite/default.nix

@@ -46,7 +46,7 @@ appimageTools.wrapType2 rec {
     install -m 444 -D ${appimageContents}/${pname}.png $out/share/icons/hicolor/512x512/apps/${pname}.png
     install -m 444 -D ${appimageContents}/resources/images/icons/512x512.png $out/share/icons/hicolor/512x512/apps/${pname}.png
     substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace 'Exec=AppRun' 'Exec=${pname}'
+      --replace 'Exec=AppRun --no-sandbox %U' 'Exec=${pname}'
 
     # symlink system binaries instead bundled ones
     mkdir -p $out/share/${pname}/resources/bin/{bridge,tor}

third_party/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix

@@ -640,10 +640,10 @@
       elpaBuild {
         pname = "consult";
         ename = "consult";
-        version = "0.8";
+        version = "0.9";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/consult-0.8.tar";
+          url = "https://elpa.gnu.org/packages/consult-0.9.tar";
-          sha256 = "0vkq8dsj6k3gsdhiyg6ccv49fqgjw6f0db4wjsvm5zbkadjvlm86";
+          sha256 = "1n3bnvgj92fjd9dai9f95wvyfb20yhaw7b722lkqjg42i10jqzfn";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -670,10 +670,10 @@
       elpaBuild {
         pname = "corfu";
         ename = "corfu";
-        version = "0.8";
+        version = "0.9";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/corfu-0.8.tar";
+          url = "https://elpa.gnu.org/packages/corfu-0.9.tar";
-          sha256 = "1qrrky1g4k5vw56435dgkwnmnri7i51gkydd76as3l0ixm4pnp05";
+          sha256 = "0710bq07j6w6zm49ci1bbx580frdbc62b3hbxwzkwm5204nf78bf";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -835,10 +835,10 @@
       elpaBuild {
         pname = "devdocs";
         ename = "devdocs";
-        version = "0.1";
+        version = "0.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/devdocs-0.1.tar";
+          url = "https://elpa.gnu.org/packages/devdocs-0.2.tar";
-          sha256 = "1ps2jpp1ckq9839l63p6npqrf85b8zb5akwvjvv7fkm8nvspdkil";
+          sha256 = "1npc7yra7pvf86ahmz1h7hnjxrz15ar1vjcalg4ilizypycpgrwj";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1015,10 +1015,10 @@
       elpaBuild {
         pname = "ebdb";
         ename = "ebdb";
-        version = "0.6.23";
+        version = "0.6.24";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ebdb-0.6.23.tar";
+          url = "https://elpa.gnu.org/packages/ebdb-0.6.24.tar";
-          sha256 = "0j3jvy9s606qjqcmcjzgck3dp8bhpgly2g00wnswzcgk4makdzld";
+          sha256 = "0156rh6fkv2yp509h6i8qzh4gsda2mcmfrxl4r6ywn1z5ahijc3r";
         };
         packageRequires = [ cl-lib emacs seq ];
         meta = {
@@ -1075,10 +1075,10 @@
       elpaBuild {
         pname = "eev";
         ename = "eev";
-        version = "20210607";
+        version = "20210618";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/eev-20210607.tar";
+          url = "https://elpa.gnu.org/packages/eev-20210618.tar";
-          sha256 = "0avd58m8630s4d3ys9g84csscdmf2y1swwwkgzjkrrq8q0j5yd3l";
+          sha256 = "13sb9shpj9fhns8sl3dxdgnn8z4wf14mgi4s87k5x4nrr012sscf";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1198,10 +1198,10 @@
       elpaBuild {
         pname = "emms";
         ename = "emms";
-        version = "7.2";
+        version = "7.5";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/emms-7.2.tar";
+          url = "https://elpa.gnu.org/packages/emms-7.5.tar";
-          sha256 = "11vqqh9rnzibsfw7wx62rgzl8i8ldpf0hv1sj43nhl5c6dlc8d5z";
+          sha256 = "0d7nsx2idzbp6d5im5rrsnwppbr2cimvxgx31bhwsm2aq3ya5v2j";
         };
         packageRequires = [ cl-lib nadvice seq ];
         meta = {
@@ -1867,10 +1867,10 @@
       elpaBuild {
         pname = "ivy-posframe";
         ename = "ivy-posframe";
-        version = "0.6.0";
+        version = "0.6.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ivy-posframe-0.6.0.tar";
+          url = "https://elpa.gnu.org/packages/ivy-posframe-0.6.1.tar";
-          sha256 = "07dzglrcdl54lkznyphw97xwd9bcwzdcgzkav0vqfk7f5cwh1wkf";
+          sha256 = "1nay2sfbwm2fkp3f1y89innd9h6j3q70q9y4yddrwa69cxlj9m23";
         };
         packageRequires = [ emacs ivy posframe ];
         meta = {
@@ -2017,10 +2017,10 @@
       elpaBuild {
         pname = "leaf";
         ename = "leaf";
-        version = "4.4.8";
+        version = "4.5.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/leaf-4.4.8.tar";
+          url = "https://elpa.gnu.org/packages/leaf-4.5.2.tar";
-          sha256 = "0h0ksmgrhn29ci6z8y54dbbzcqlvfs1ra0kmf226gz0dqzk45vb3";
+          sha256 = "0i90shhhkpdcwmfi8zv0008qgmg4g3cqd2yvpycfv9n2axvhag54";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2152,10 +2152,10 @@
       elpaBuild {
         pname = "marginalia";
         ename = "marginalia";
-        version = "0.6";
+        version = "0.7";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/marginalia-0.6.tar";
+          url = "https://elpa.gnu.org/packages/marginalia-0.7.tar";
-          sha256 = "05pwaz9643shxnv63l6r9m2c0qf1nc1hy6jiqw01bkvvgg8g4jag";
+          sha256 = "1nz55nx6xp72nahs4g6asl5y5yrlnlnza58bjrlwwzmwsf7daz18";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2829,10 +2829,10 @@
       elpaBuild {
         pname = "posframe";
         ename = "posframe";
-        version = "1.0.3";
+        version = "1.0.4";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/posframe-1.0.3.tar";
+          url = "https://elpa.gnu.org/packages/posframe-1.0.4.tar";
-          sha256 = "0c3lnrydsysv8j25brgc0cckf1hz54yhkginncmw81y1ia43rqmx";
+          sha256 = "0i2pw90gw9zb22gj8yyvcp3b2k1bxxhbjj0idvr5iz1vd9023bc6";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2889,10 +2889,10 @@
       elpaBuild {
         pname = "pyim";
         ename = "pyim";
-        version = "3.7.9";
+        version = "3.8.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/pyim-3.7.9.tar";
+          url = "https://elpa.gnu.org/packages/pyim-3.8.2.tar";
-          sha256 = "00ff1izdwcy53dcwpdn18wwndnw2jsw4bhg8gkqaa60xm468xzkl";
+          sha256 = "05sgciqb0hzy07j8pvbg7h2vpa9z5z60m6pknxd3b1kpi45vaihw";
         };
         packageRequires = [ async emacs xr ];
         meta = {
@@ -3355,10 +3355,10 @@
       elpaBuild {
         pname = "setup";
         ename = "setup";
-        version = "0.2.0";
+        version = "0.2.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/setup-0.2.0.tar";
+          url = "https://elpa.gnu.org/packages/setup-0.2.1.tar";
-          sha256 = "1xhjkyksilw1vbx12a4yz4bpj0dhl3m02yi8d9nyd19z098cfa9y";
+          sha256 = "15paand086g33w2vb6jkyxd3i2pmpp84f31y3j5v8w9ia68pjzms";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -3595,10 +3595,10 @@
       elpaBuild {
         pname = "sql-indent";
         ename = "sql-indent";
-        version = "1.5";
+        version = "1.6";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/sql-indent-1.5.tar";
+          url = "https://elpa.gnu.org/packages/sql-indent-1.6.tar";
-          sha256 = "07k5rn9hbxppnka7nq0a3a6zyqqa1hp8j6qrb344js6zyak0cb63";
+          sha256 = "000pimlg0k4mrv2wpqq8w8l51wpr1lzlaq6ai8iaximm2a92ap5b";
         };
         packageRequires = [ cl-lib ];
         meta = {
@@ -3610,10 +3610,10 @@
       elpaBuild {
         pname = "ssh-deploy";
         ename = "ssh-deploy";
-        version = "3.1.12";
+        version = "3.1.13";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ssh-deploy-3.1.12.tar";
+          url = "https://elpa.gnu.org/packages/ssh-deploy-3.1.13.tar";
-          sha256 = "0fz49l63jfw9zy459f07bq2irdb8ispnx8m2c3wxwiim9yw5xnjg";
+          sha256 = "006jr8yc5qvxdfk0pn40604a2b7a1ah6l6hi6rhxm3p5b08d9i5w";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -3779,10 +3779,10 @@
       elpaBuild {
         pname = "tramp";
         ename = "tramp";
-        version = "2.5.0.5";
+        version = "2.5.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/tramp-2.5.0.5.tar";
+          url = "https://elpa.gnu.org/packages/tramp-2.5.1.tar";
-          sha256 = "1dclxffynfacvwi2scpda35sxjb42603yyf2p0477qa9b0i4xha0";
+          sha256 = "1r7wifhzy2ipdlc4fqnx6549fnx45ggz57wh0cp7s6y25761si7q";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -3824,10 +3824,10 @@
       elpaBuild {
         pname = "transient";
         ename = "transient";
-        version = "0.3.4";
+        version = "0.3.5";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/transient-0.3.4.tar";
+          url = "https://elpa.gnu.org/packages/transient-0.3.5.tar";
-          sha256 = "1m71w52cr8f9wm6lybfa003w408lkrl6q9whs53hpp3pl5phhfvb";
+          sha256 = "15dlj21gn0zxywic9wdcp5zc8skm1s170bq7smgkpd3p3lxslf68";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -3949,6 +3949,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    vc-hgcmd = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "vc-hgcmd";
+        ename = "vc-hgcmd";
+        version = "1.14";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/vc-hgcmd-1.14.tar";
+          sha256 = "0pg6fg0znsmky3iwdpxn2sx5bbn72kw83s077000ilawi6zqwc2d";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/vc-hgcmd.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     vcard = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "vcard";
@@ -4015,10 +4030,10 @@
       elpaBuild {
         pname = "vertico";
         ename = "vertico";
-        version = "0.11";
+        version = "0.12";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/vertico-0.11.tar";
+          url = "https://elpa.gnu.org/packages/vertico-0.12.tar";
-          sha256 = "0hzwddkac85i449173az8crlksj9ivrqf969r81kbr45ksgr1ij6";
+          sha256 = "14qlc438bysg23wfj04zpvpraqzzi4jlz3r11vc56vd0k2hfmvmn";
         };
         packageRequires = [ emacs ];
         meta = {

third_party/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/org-generated.nix

@@ -4,10 +4,10 @@
       elpaBuild {
         pname = "org";
         ename = "org";
-        version = "20210607";
+        version = "20210628";
         src = fetchurl {
-          url = "https://orgmode.org/elpa/org-20210607.tar";
+          url = "https://orgmode.org/elpa/org-20210628.tar";
-          sha256 = "178z9bnzcdaymnwxf0kkw1yzlzkj5dmdjjwdklc9qb9iv6rckfji";
+          sha256 = "1sn2yyynndk8qf43ss8bayll33r4ina8xfx4ywzcs3m1lm6xy1zl";
         };
         packageRequires = [];
         meta = {
@@ -19,10 +19,10 @@
       elpaBuild {
         pname = "org-plus-contrib";
         ename = "org-plus-contrib";
-        version = "20210607";
+        version = "20210628";
         src = fetchurl {
-          url = "https://orgmode.org/elpa/org-plus-contrib-20210607.tar";
+          url = "https://orgmode.org/elpa/org-plus-contrib-20210628.tar";
-          sha256 = "03liivgfcmp0lh6p57bh2gyn85n3sc4p91y374kq8kzc7fzrgzyr";
+          sha256 = "0r4kxp1hbhkwvi7939fglng8db4h4n7vigy8pd2gia3a02xcw8l5";
         };
         packageRequires = [];
         meta = {

third_party/nixpkgs/pkgs/applications/editors/greenfoot/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "greenfoot";
-  version = "3.6.1";
+  version = "3.7.0";
   src = fetchurl {
     # We use the deb here. First instinct might be to go for the "generic" JAR
     # download, but that is actually a graphical installer that is much harder
     # to unpack than the deb.
     url = "https://www.greenfoot.org/download/files/Greenfoot-linux-${builtins.replaceStrings ["."] [""] version}.deb";
-    sha256 = "112h6plpclj8kbv093m4pcczljhpd8d47d7a2am1yfgbyckx6hf0";
+    sha256 = "sha256-K9faU3ZarcR4g8riHpoZYVH0sXtueqfm3Fo+sZAHJA8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

third_party/nixpkgs/pkgs/applications/editors/helix/default.nix

@@ -0,0 +1,25 @@
+{ fetchFromGitHub, lib, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "helix";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "helix-editor";
+    repo = pname;
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-dI5yIP5uUmM9pyMpvvdrk8/0jE/REkU/m9BF081LwMU=";
+  };
+
+  cargoSha256 = "sha256-l3Ikr4IyUsHItJIC4BaIZZb6vio3bchumbbPI+nxIjQ=";
+
+  cargoBuildFlags = [ "--features embed_runtime" ];
+
+  meta = with lib; {
+    description = "A post-modern modal text editor";
+    homepage = "https://helix-editor.com";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ yusdacra ];
+  };
+}

third_party/nixpkgs/pkgs/applications/editors/jetbrains/default.nix

@@ -255,12 +255,12 @@ in
 
   datagrip = buildDataGrip rec {
     name = "datagrip-${version}";
-    version = "2021.1.2"; /* updated by script */
+    version = "2021.1.3"; /* updated by script */
     description = "Your Swiss Army Knife for Databases and SQL";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "1znb4m7sv7xqi1mq3yw0m51m06wfwmhhxmvck0xkv8s0cfg18qim"; /* updated by script */
+      sha256 = "0lhi3vwhwb359va4sa17y071i03l4mfwqpsp7haqxjf900dcld7d"; /* updated by script */
     };
     wmClass = "jetbrains-datagrip";
     update-channel = "DataGrip RELEASE";
@@ -268,12 +268,12 @@ in
 
   goland = buildGoland rec {
     name = "goland-${version}";
-    version = "2021.1.2"; /* updated by script */
+    version = "2021.1.3"; /* updated by script */
     description = "Up and Coming Go IDE";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0g20r7yn4r2h08wv3i8bnnma8x4jljixsbmfml8kixk0pzfhv4px"; /* updated by script */
+      sha256 = "0xy9k90v3kcm9sj48l809qn0vws4ygsxxyqwsg6y9a3r1raqgqxd"; /* updated by script */
     };
     wmClass = "jetbrains-goland";
     update-channel = "GoLand RELEASE";
@@ -281,12 +281,12 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2021.1.2"; /* updated by script */
+    version = "2021.1.3"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "03i5f6p0abr9yfs9fg90fg7hb1a7zar9q4d4iiag30cmndwpslg2"; /* updated by script */
+      sha256 = "1phpfa9i3k7g92ankmibp53c1469ifnb12g6s8gklln7v7xxakmi"; /* updated by script */
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IntelliJ IDEA RELEASE";
@@ -294,12 +294,12 @@ in
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2021.1.2"; /* updated by script */
+    version = "2021.1.3"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
-      sha256 = "0mw4acaik1bkr7gqbwgs3i8f8px8zw95hm1zxgd5gd5kh88n17x5"; /* updated by script */
+      sha256 = "13c7a96zbw05w1gy4ds4wzac853hdlnbflww2xaz60jnr1k24gnp"; /* updated by script */
     };
     wmClass = "jetbrains-idea";
     update-channel = "IntelliJ IDEA RELEASE";
@@ -320,12 +320,12 @@ in
 
   phpstorm = buildPhpStorm rec {
     name = "phpstorm-${version}";
-    version = "2021.1.3"; /* updated by script */
+    version = "2021.1.4"; /* updated by script */
     description = "Professional IDE for Web and PHP developers";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "05hjv1nz1b82bkakadjvsy23v0qv8fyni6h31lcg9198h1890f7v"; /* updated by script */
+      sha256 = "0p9a8l2bpjm25x4af1hlqhmw5xsirsfajznd6y723yqmjy8hs46l"; /* updated by script */
     };
     wmClass = "jetbrains-phpstorm";
     update-channel = "PhpStorm RELEASE";
@@ -333,12 +333,12 @@ in
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2021.1.2"; /* updated by script */
+    version = "2021.1.3"; /* updated by script */
     description = "PyCharm Community Edition";
     license = lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0sp7w1xrl0y36dai08kqfd0jk06yr7jdbaf1a9f3fgxp5pmspxp1"; /* updated by script */
+      sha256 = "0c03grsrjydb6jcnbq1qi4158c14vni3znr7vysnbvldi8al6w8m"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm-ce";
     update-channel = "PyCharm RELEASE";
@@ -346,12 +346,12 @@ in
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2021.1.2"; /* updated by script */
+    version = "2021.1.3"; /* updated by script */
     description = "PyCharm Professional Edition";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0ny7rbl8g5azpqnlcq8l6bwh6hrp8rgp06lf4a8gdr9rpvw9xsqb"; /* updated by script */
+      sha256 = "01nwc9nprlyrwyij98px915w66g6vxbznsmmmg56rv3rvjvjp7yl"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm";
     update-channel = "PyCharm RELEASE";

third_party/nixpkgs/pkgs/applications/editors/jetbrains/update.pl

@@ -14,7 +14,7 @@ sub semantic_less {
 }
 
 sub get_latest_versions {
-  my @channels = get("http://www.jetbrains.com/updates/updates.xml") =~ /(<channel .+?<\/channel>)/gs;
+  my @channels = get("https://www.jetbrains.com/updates/updates.xml") =~ /(<channel .+?<\/channel>)/gs;
   my %h = {};
   for my $ch (@channels) {
     my ($id) = $ch =~ /^<channel id="[^"]+" name="([^"]+)"/;

third_party/nixpkgs/pkgs/applications/editors/neovim/default.nix

@@ -2,6 +2,7 @@
 , libuv, lua, ncurses, pkg-config
 , unibilium, xsel, gperf
 , libvterm-neovim
+, tree-sitter
 , glibcLocales ? null, procps ? null
 
 # now defaults to false because some tests can be flaky (clipboard etc)
@@ -31,13 +32,13 @@ let
 in
   stdenv.mkDerivation rec {
     pname = "neovim-unwrapped";
-    version = "0.4.4";
+    version = "0.5.0";
 
     src = fetchFromGitHub {
       owner = "neovim";
       repo = "neovim";
       rev = "v${version}";
-      sha256 = "11zyj6jvkwas3n6w1ckj3pk6jf81z1g7ngg4smmwm7c27y2a6f2m";
+      sha256 = "0lgbf90sbachdag1zm9pmnlbn35964l3khs27qy4462qzpqyi9fi";
     };
 
     patches = [
@@ -58,6 +59,7 @@ in
       msgpack
       ncurses
       neovimLuaEnv
+      tree-sitter
       unibilium
     ] ++ optional stdenv.isDarwin libiconv
       ++ optionals doCheck [ glibcLocales procps ]
@@ -96,6 +98,7 @@ in
       "-DGPERF_PRG=${gperf}/bin/gperf"
       "-DLUA_PRG=${neovimLuaEnv.interpreter}"
       "-DLIBLUV_LIBRARY=${luvpath}"
+      "-DUSE_BUNDLED=OFF"
     ]
     ++ optional doCheck "-DBUSTED_PRG=${neovimLuaEnv}/bin/busted"
     ++ optional (!lua.pkgs.isLuaJIT) "-DPREFER_LUA=ON"

third_party/nixpkgs/pkgs/applications/editors/vscode/generic.nix

@@ -10,6 +10,9 @@
 # Attributes inherit from specific versions
 , version, src, meta, sourceRoot
 , executableName, longName, shortName, pname, updateScript
+# sourceExecutableName is the name of the binary in the source archive, over
+# which we have no control
+, sourceExecutableName ? executableName
 }:
 
 let
@@ -77,12 +80,12 @@ let
     '' + (if system == "x86_64-darwin" then ''
       mkdir -p "$out/Applications/${longName}.app" $out/bin
       cp -r ./* "$out/Applications/${longName}.app"
-      ln -s "$out/Applications/${longName}.app/Contents/Resources/app/bin/${executableName}" $out/bin/${executableName}
+      ln -s "$out/Applications/${longName}.app/Contents/Resources/app/bin/${sourceExecutableName}" $out/bin/${executableName}
     '' else ''
       mkdir -p $out/lib/vscode $out/bin
       cp -r ./* $out/lib/vscode
 
-      ln -s $out/lib/vscode/bin/${executableName} $out/bin
+      ln -s $out/lib/vscode/bin/${sourceExecutableName} $out/bin/${executableName}
 
       mkdir -p $out/share/applications
       ln -s $desktopItem/share/applications/${executableName}.desktop $out/share/applications/${executableName}.desktop

third_party/nixpkgs/pkgs/applications/editors/vscode/vscode.nix

@@ -25,6 +25,7 @@ in
     version = "1.57.1";
     pname = "vscode";
 
+    sourceExecutableName = "code";
     executableName = "code" + lib.optionalString isInsiders "-insiders";
     longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
     shortName = "Code" + lib.optionalString isInsiders " - Insiders";

third_party/nixpkgs/pkgs/applications/graphics/avocode/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "avocode";
-  version = "4.14.3";
+  version = "4.15.0";
 
   src = fetchurl {
     url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "sha256-6OEgSnW96jufc/Z+B17ghtAbj9SLulue26ffKREGzbY=";
+    sha256 = "sha256-Au1m7CfZkeOczcO/JvIzyVCp6Gn/nhSq0yJOdP8i+0w=";
   };
 
   libPath = lib.makeLibraryPath (with xorg; [

third_party/nixpkgs/pkgs/applications/logging/humioctl/default.nix

@@ -1,8 +1,8 @@
 { buildGoModule, fetchFromGitHub, installShellFiles, lib }:
 
 let
-  humioCtlVersion = "0.28.3";
+  humioCtlVersion = "0.28.4";
-  sha256 = "sha256-GUn5hg4gPGjQ6U2dboGE22u8XuZ578+EnkmHLASXd3Q=";
+  sha256 = "sha256-X2pc15InfCzVbZ2fmBdr+GKgOySIruA1yD61HcLO164=";
   vendorSha256 = "sha256-867x33Aq27D2m14NqqsdByC39pjjyJZbfX3jmwVU2yo=";
 in buildGoModule {
     name = "humioctl-${humioCtlVersion}";

third_party/nixpkgs/pkgs/applications/misc/cherrytree/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cherrytree";
-  version = "0.99.37";
+  version = "0.99.38";
 
   src = fetchFromGitHub {
     owner = "giuspen";
     repo = "cherrytree";
     rev = version;
-    sha256 = "1a2scwjrjijxwyfpqih23zzay3yqhyzpxnp66388fcir1cmp8zih";
+    sha256 = "sha256-04MRw6pMtJGxTMKwOzPNGg1T85SfVY5bMkF3gt2V0e0=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/misc/expenses/default.nix

@@ -7,18 +7,18 @@
 
 buildGoModule rec {
   pname = "expenses";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "manojkarthick";
     repo = "expenses";
     rev = "v${version}";
-    sha256 = "11wxaqbnrrg0rykx5905chi6rhmai1nqggdbhh6hiappr5rksl0j";
+    sha256 = "sha256-CaIbLtP7ziv9UBQE+QsNnqX65OV+6GIvkLwKm1G++iY=";
   };
 
-  vendorSha256 = "1kwj63wl4kb16zl3lmi9bzj1az7vi453asdy52na0mjx4ymmjyk1";
+  vendorSha256 = "sha256-NWTFxF4QCH1q1xx+hmVmpvDeOlqH5Ai2+0ParE5px9M=";
 
-  # package does not contain any tests as of v0.2.1
+  # package does not contain any tests as of v0.2.2
   doCheck = false;
 
   buildInputs = [ sqlite ];

third_party/nixpkgs/pkgs/applications/misc/flavours/default.nix

@@ -1,20 +1,28 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, libiconv }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, libiconv, installShellFiles }:
 
 rustPlatform.buildRustPackage rec {
   pname = "flavours";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "Misterio77";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rDy859jg+F8XC4sJogIgdn1FoT8cf7S+KORt+7kboAc=";
+    sha256 = "1bgi6p7l0bh9k4vkwvngk7q19ynia0z1ninb1cq8qnwwpll6kbya";
   };
 
-  buildInputs = [ ]
+  buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];
-    ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
-  cargoSha256 = "sha256-I8ZH35L2CVLy6ypmdOPd8VEG/sQeGaHyT1HWNdwyZVo=";
+  cargoSha256 = "07hwxhfcbqbwb3hz18w92h1lhdiwwy7abhwpimzx7syyavp4rmn4";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd flavours \
+      --zsh <($out/bin/flavours --completions zsh) \
+      --fish <($out/bin/flavours --completions fish) \
+      --bash <($out/bin/flavours --completions bash)
+  '';
 
   meta = with lib; {
     description = "An easy to use base16 scheme manager/builder that integrates with any workflow";

third_party/nixpkgs/pkgs/applications/misc/houdini/default.nix

@@ -1,4 +1,4 @@
-{ callPackage, buildFHSUserEnv, undaemonize }:
+{ callPackage, buildFHSUserEnv, undaemonize, unwrapped ? callPackage ./runtime.nix {} }:
 
 let
   houdini-runtime = callPackage ./runtime.nix { };
@@ -9,6 +9,10 @@ in buildFHSUserEnv {
     mkdir -p $out/usr/lib/sesi
   '';
 
+  passthru = {
+    unwrapped = houdini-runtime;
+  };
+
   runScript = "${undaemonize}/bin/undaemonize ${houdini-runtime}/bin/houdini";
 }
 

third_party/nixpkgs/pkgs/applications/misc/houdini/runtime.nix

@@ -1,6 +1,9 @@
-{ lib, stdenv, requireFile, zlib, libpng, libSM, libICE, fontconfig, xorg, libGLU, libGL, alsa-lib, dbus, xkeyboardconfig, bc, addOpenGLRunpath }:
+{ lib, stdenv, requireFile, zlib, libpng, libSM, libICE, fontconfig, xorg, libGLU, libGL, alsa-lib
+, dbus, xkeyboardconfig, nss, nspr, expat, pciutils, libxkbcommon, bc, addOpenGLRunpath
+}:
 
 let
+  # NOTE: Some dependencies only show in errors when run with QT_DEBUG_PLUGINS=1
   ld_library_path = builtins.concatStringsSep ":" [
     "${stdenv.cc.cc.lib}/lib64"
     (lib.makeLibraryPath [
@@ -17,6 +20,8 @@ let
       xorg.libXcomposite
       xorg.libXdamage
       xorg.libXtst
+      xorg.libxcb
+      xorg.libXScrnSaver
       alsa-lib
       fontconfig
       libSM
@@ -25,26 +30,22 @@ let
       libpng
       dbus
       addOpenGLRunpath.driverLink
+      nss
+      nspr
+      expat
+      pciutils
+      libxkbcommon
     ])
   ];
   license_dir = "~/.config/houdini";
 in
 stdenv.mkDerivation rec {
-  version = "17.5.327";
+  version = "18.0.460";
   pname = "houdini-runtime";
   src = requireFile rec {
     name = "houdini-${version}-linux_x86_64_gcc6.3.tar.gz";
-    sha256 = "1byigmhmby8lgi2vmgxy9jlrrqk7jyr507zqkihq5bv8kfsanv1x";
+    sha256 = "18rbwszcks2zfn9zbax62rxmq50z9mc3h39b13jpd39qjqdd3jsd";
-    message = ''
+    url = meta.homepage;
-      This nix expression requires that ${name} is already part of the store.
-      Download it from https://www.sidefx.com and add it to the nix store with:
-
-          nix-prefetch-url <URL>
-
-      This can't be done automatically because you need to create an account on
-      their website and agree to their license terms before you can download
-      it. That's what you get for using proprietary software.
-    '';
   };
 
   buildInputs = [ bc ];
@@ -82,7 +83,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.unfree;
     platforms = lib.platforms.linux;
     hydraPlatforms = [ ]; # requireFile src's should be excluded
-    maintainers = [ lib.maintainers.canndrew ];
+    maintainers = with lib.maintainers; [ canndrew kwohlfahrt ];
   };
 }
-

third_party/nixpkgs/pkgs/applications/misc/hugo/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.84.1";
+  version = "0.84.3";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ULZa0tepq00v2VHDR3+aYYvRfbxYKcjcltRgRmbVmRA=";
+    sha256 = "sha256-3SbF4JsanNup0JmtEoZlyu3SvMn01r+nhnPgIi/W8pA=";
   };
 
-  vendorSha256 = "sha256-jY/g92ON5OxjuZzPHJNduXYMgPU8/0ioAYvp4iqjGnU=";
+  vendorSha256 = "sha256-ImXTOtN6kQL7Q8IBlmK7+i47cWtyZT0xcnQdCw3NvWM=";
 
   doCheck = false;
 

third_party/nixpkgs/pkgs/applications/misc/logseq/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "logseq";
-  version = "0.2.0";
+  version = "0.2.2";
 
   src = fetchurl {
     url = "https://github.com/logseq/logseq/releases/download/${version}/logseq-linux-x64-${version}.AppImage";
-    sha256 = "uFINB8WXFbtI/WMFvqirAygzwK7I/8+8YPeyCd+xQ5w=";
+    sha256 = "03l5w0fg3laiz85k4g4w98ngaziyfr9s24xshjrfl71q6r9s813m";
     name = "${pname}-${version}.AppImage";
   };
 

third_party/nixpkgs/pkgs/applications/misc/nwg-panel/default.nix

@@ -0,0 +1,57 @@
+{ lib, fetchFromGitHub
+, python3Packages, wrapGAppsHook, gobject-introspection
+, gtk-layer-shell, pango, gdk-pixbuf, atk
+# Extra packages called by various internal nwg-panel modules
+, sway             # swaylock, swaymsg
+, systemd          # systemctl
+, wlr-randr        # wlr-randr
+, nwg-menu         # nwg-menu
+, light            # light
+, pamixer          # pamixer
+, pulseaudio       # pactl
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "nwg-panel";
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "nwg-piotr";
+    repo = "nwg-panel";
+    rev = "v${version}";
+    hash = "sha256-x5lGVF6eRhOVXrsBatdsiUiWs/+FxRlCtp79zA206RY=";
+  };
+
+  # No tests
+  doCheck = false;
+
+  # Because of wrapGAppsHook
+  strictDeps = false;
+  dontWrapGApps = true;
+
+  buildInputs = [ atk gdk-pixbuf gtk-layer-shell pango ];
+  nativeBuildInputs = [ wrapGAppsHook gobject-introspection ];
+  propagatedBuildInputs = with python3Packages; [ i3ipc netifaces psutil pybluez pygobject3 ];
+
+  postInstall = ''
+    mkdir -p $out/share/{applications,pixmaps}
+    cp $src/nwg-panel-config.desktop $out/share/applications/
+    cp $src/nwg-shell.svg $src/nwg-panel.svg $out/share/pixmaps/
+  '';
+
+  preFixup = ''
+    makeWrapperArgs+=(
+      "''${gappsWrapperArgs[@]}"
+      --prefix XDG_DATA_DIRS : "$out/share"
+      --prefix PATH : "${lib.makeBinPath [ light nwg-menu pamixer pulseaudio sway systemd wlr-randr ]}"
+    )
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/nwg-piotr/nwg-panel";
+    description = "GTK3-based panel for Sway window manager";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ berbiche ];
+  };
+}

third_party/nixpkgs/pkgs/applications/misc/octoprint/default.nix

@@ -44,6 +44,7 @@ let
                   inherit version;
                   sha256 = "63509b41d158ae5b7f67eb4ad20fecbb4eee99434e73e140354dc3ff8e09716f";
                 };
+                propagatedBuildInputs = [ self.six ];
               }
             );
           }

third_party/nixpkgs/pkgs/applications/misc/openring/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "openring";
-  version = "unstable-2021-04-03";
+  version = "unstable-2021-06-28";
 
   src = fetchFromSourcehut {
     owner = "~sircmpwn";
     repo = pname;
-    rev = "f13edb5dfd882ce608d61cf6b6740650ce9d84a3";
+    rev = "e566294050776355ca0d3bfd7a1f6f70767cd08b";
-    sha256 = "sha256-Z65V77JZ9jCzBg7T2+d5Agxxd+MV2R7nYcLedYP5eOE=";
+    sha256 = "sha256-h9Tout3KGiv6jbq9Ui3crb5NdTOHcn7BIy+aPoWG5sM=";
   };
 
   vendorSha256 = "sha256-BbBTmkGyLrIWphXC+dBaHaVzHuXRZ+4N/Jt2k3nF7Z4=";

third_party/nixpkgs/pkgs/applications/misc/reddsaver/default.nix

@@ -8,22 +8,22 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reddsaver";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "manojkarthick";
     repo = "reddsaver";
     rev = "v${version}";
-    sha256 = "0ffci3as50f55n1v36hji4n0b3lkch5ylc75awjz65jz2gd2y2j4";
+    sha256 = "1czsy1bb0ja650sndwzq9rcbbhcci7s7ablw0agaynhi403shavv";
   };
 
-  cargoSha256 = "1xf26ldgfinzpakcp65w52fdl3arsm053vfnq7gk2fwnq55cjwl0";
+  cargoSha256 = "0wr6y7mfffaqdh6i5nqhx692dih159121sm6k0i37wcdvxhvd51z";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ]
     ++ lib.optional stdenv.isDarwin Security;
 
-  # package does not contain tests as of v0.3.2
+  # package does not contain tests as of v0.3.3
   docCheck = false;
 
   meta = with lib; {

third_party/nixpkgs/pkgs/applications/misc/seatd/default.nix

@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
 
   outputs = [ "bin" "out" "dev" "man" ];
 
+  depsBuildBuild = [ pkg-config ];
+
   nativeBuildInputs = [ meson ninja pkg-config scdoc ];
 
   buildInputs = [ systemd ];

third_party/nixpkgs/pkgs/applications/misc/sfm/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sfm";
-  version = "0.1";
+  version = "0.2";
 
   src = fetchFromGitHub {
     owner = "afify";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-i4WzYaJKityIt+LPWCbd6UsPBaYoaS397l5BInOXQQA=";
+    hash = "sha256-DwXKrSqcebNI5N9REXyMV16W2kr72IH9+sKSVehc5zw=";
   };
 
   configFile = lib.optionalString (conf!=null) (lib.writeText "config.def.h" conf);

third_party/nixpkgs/pkgs/applications/misc/slides/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "slides";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "maaslalani";
     repo = "slides";
     rev = "v${version}";
-    sha256 = "00sml6b9q3df9dgl7fpsn6a3qkq6xklnbfvvblf91xdf4ssn7wrx";
+    sha256 = "15f4sn1zsqqhzxnmwb1igh8xhka6li31ygdqgbjvxzm93lkarxvs";
   };
 
   checkInputs = [

third_party/nixpkgs/pkgs/applications/misc/tut/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tut";
-  version = "0.0.17";
+  version = "0.0.20";
 
   src = fetchFromGitHub {
     owner = "RasmusLindroth";
     repo = pname;
     rev = version;
-    sha256 = "0g4kbprsdjk2lbx81azdvz8kkhyk370id3622xxssr894v0i7iwj";
+    sha256 = "03jiv5m807z96796fbpi6ny22am3sq4jfni37fxbld05sxdzwcnd";
   };
 
-  vendorSha256 = "1kf7ynmxrzvhl028b4nbz9h9v9x5srarsbynpgpp4vicmxqlvrmh";
+  vendorSha256 = "1in5b7ixnm5iizkzziqclvgaq87ccdh507amkgfhfy5sxsgbfb1g";
 
   meta = with lib; {
     description = "A TUI for Mastodon with vim inspired keys";

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -18,9 +18,9 @@
     }
   },
   "beta": {
-    "version": "92.0.4515.70",
+    "version": "92.0.4515.80",
-    "sha256": "06yhpxr5bg0gx7hmrhc6zg4gr1d9s34y2rb98rpl4dilmc548i6q",
+    "sha256": "142v8y275mysgksvfprc83a7r1dlcnb5rqi8a451fmfnj6wrsq8i",
-    "sha256bin64": "1fkakh1r87pg5nr101m6v86y8iyyfba8vnzrg0229kcar7v8wzf7",
+    "sha256bin64": "0sz2fvg6l7q7syc5pysa246p03sganmgjdfvind42i8cqxw8gycp",
     "deps": {
       "gn": {
         "version": "2021-05-07",
@@ -31,15 +31,15 @@
     }
   },
   "dev": {
-    "version": "93.0.4549.3",
+    "version": "93.0.4557.4",
-    "sha256": "0bkr67n1d75ayd1d9sa57c99j85r83gadzfs8iw7kwiha9g0mjgp",
+    "sha256": "06397k5mkrrdrmd7icyvd1ifnmhincgw5nskgc3m436qzzifsab9",
-    "sha256bin64": "1hac6m668nrdzvfqx3vyc74pnx8lf973m1jxnm3cfy83g7wynphz",
+    "sha256bin64": "1q2c2dhx1yya6vhr82asf7h2zrv6kjzjv1a0zlfxkp3i6lnivgrd",
     "deps": {
       "gn": {
-        "version": "2021-06-18",
+        "version": "2021-06-25",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "170c2dba1e0c0299fe8c6a441caf2f2352a42ae0",
+        "rev": "4d207c94eab41f09c9a8505eb47f3d2919e47943",
-        "sha256": "1ylx8a5fxq7aciqs0mx7fld763sqkqn39lb9k951w6gksm15lrn3"
+        "sha256": "1jfgksa7rifh3ynnmd7m8xxggwxckz0jnwjaq9m5xapksb89hbn1"
       }
     }
   },

third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix

@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    ffversion = "89.0.1";
+    ffversion = "89.0.2";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "67da387b3b6c5a110c83208f9a15d6064adf423bbebfb0fcad2d85f6c4b615b27da0cbd5486b817f0d5e040bc3e70d74d9af72599b24384397fef1dd153bd3f3";
+      sha512 = "ffd98ab0887611c5b4aba68346c49a7a31a58150fd8bbae610a4d941c4cff0acef0daaebfbb577787a759b4c1ef3c1199f02681148612f4f5b709983e07e0ccb";
     };
 
     meta = {

third_party/nixpkgs/pkgs/applications/networking/browsers/qutebrowser/default.nix

@@ -31,12 +31,12 @@ let
 
 in mkDerivationWith python3Packages.buildPythonApplication rec {
   pname = "qutebrowser";
-  version = "2.2.3";
+  version = "2.3.0";
 
   # the release tarballs are different from the git checkout!
   src = fetchurl {
     url = "https://github.com/qutebrowser/qutebrowser/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-BoP168jxj94nvkrcgC83fPw/TPRsI2PbCooqzWNF62I=";
+    sha256 = "09fz6rd0laisq7pqf9nrllcx58yb129fc05kdk45zrwwggq03b8h";
   };
 
   # Needs tox

third_party/nixpkgs/pkgs/applications/networking/cluster/argo/default.nix

@@ -19,16 +19,16 @@ let
 in
 buildGoModule rec {
   pname = "argo";
-  version = "3.0.7";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo";
     rev = "v${version}";
-    sha256 = "sha256-lZTSUNtmJZKONt0Bv42dBAc+87L14HaPxvPxhFe8nyc=";
+    sha256 = "sha256-WErNPofVnV6L7DkYU/dh4mWm+u7UJNFUmRN6IZzMb2g=";
   };
 
-  vendorSha256 = "sha256-YjVAoMyGKMHLGEPeOOkCKCzeWFiUsXfJIKcw5GYoljg=";
+  vendorSha256 = "sha256-99N//woGPx9QEtkFsktaiAbu7TS+3DHArBA52OUJFU4=";
 
   doCheck = false;
 

third_party/nixpkgs/pkgs/applications/networking/cluster/helm/default.nix

@@ -2,20 +2,25 @@
 
 buildGoModule rec {
   pname = "helm";
-  version = "3.6.1";
+  version = "3.6.2";
+  gitCommit = "ee407bdf364942bcb8e8c665f82e15aa28009b71";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "sha256-MXMgCqdFNRMJaStoFMx8BO8OI1B7FqSETk0zW6a/vbE=";
+    sha256 = "1s40zbk83s1kylcglydw356282virf1828v9waj1zs1gjnjml69h";
   };
-  vendorSha256 = "sha256-PTAyRG6PZK+vaiheUd3oiu4iBGlnFjoCrci0CYbXjBk=";
+  vendorSha256 = "06ccsy30kd68ml13l5k7d4225vlax3fm2pi8dapsyr4gdr234c1x";
 
   doCheck = false;
 
   subPackages = [ "cmd/helm" ];
-  buildFlagsArray = [ "-ldflags=-w -s -X helm.sh/helm/v3/internal/version.version=v${version}" ];
+  ldflags = [
+    "-w" "-s"
+    "-X helm.sh/helm/v3/internal/version.version=v${version}"
+    "-X helm.sh/helm/v3/internal/version.gitCommit=${gitCommit}"
+  ];
 
   nativeBuildInputs = [ installShellFiles ];
   postInstall = ''

third_party/nixpkgs/pkgs/applications/networking/cluster/helm/plugins/helm-secrets.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "helm-secrets";
-  version = "3.7.0";
+  version = "3.8.1";
 
   src = fetchFromGitHub {
     owner = "jkroepke";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-AM+TLeSrXjn10DiQzXSqSwTqsc7CjTdnf6TWetden7g=";
+    hash = "sha256-UZu3jChEK59UrtUR2ze68Kkc6MkHRtTsfTOS/B96sLM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

third_party/nixpkgs/pkgs/applications/networking/cluster/k9s/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "k9s";
-  version = "0.24.10";
+  version = "0.24.12";
 
   src = fetchFromGitHub {
     owner  = "derailed";
     repo   = "k9s";
     rev    = "v${version}";
-    sha256 = "sha256-ImWIR112q59hyKHXBmb9W6eVvu4xr+U4+uh2ZGcXv1g=";
+    sha256 = "sha256-GuN+OAzuNus1B32ZSsnrJPrE7MQ0ZqNKDmoNe7Sa7Zs=";
   };
 
   buildFlagsArray = ''
@@ -18,7 +18,7 @@ buildGoModule rec {
       -X github.com/derailed/k9s/cmd.commit=${src.rev}
   '';
 
-  vendorSha256 = "sha256-EEN3nKQBtAGG7MAa9h11KFPZ9g7xtNxhFB1i/2QS66g=";
+  vendorSha256 = "sha256-JBWQxRaMvIbUiOD7sJiZH1SHNCdysgh5FeSmYf+FdG4=";
 
   doCheck = false;
 

third_party/nixpkgs/pkgs/applications/networking/cluster/minikube/default.nix

@@ -12,9 +12,9 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.20.0";
+  version = "1.21.0";
 
-  vendorSha256 = "sha256-ncgf2C4PZMoVMZIMDn9LwP2EDqg7T/WbUPRd/SqGGnU=";
+  vendorSha256 = "sha256-3G9QO5OMnMkMCsGIze/E9bvx6fvlXtOqiv8lGTkLN3s=";
 
   doCheck = false;
 
@@ -22,7 +22,7 @@ buildGoModule rec {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "sha256-TnvbO8OLjnI5WGy3QR4OZbesOBat2VsL7ElCnj2Tkmk=";
+    sha256 = "sha256-PbCwGPJZvnJCIVK7FYa1gI4aO4sIeh8iQtYOHAQBaZE=";
   };
 
   nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];

third_party/nixpkgs/pkgs/applications/networking/cluster/stern/default.nix

@@ -4,16 +4,18 @@ let isCrossBuild = stdenv.hostPlatform != stdenv.buildPlatform;
 in
 buildGoModule rec {
   pname = "stern";
-  version = "1.14.0";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "stern";
     repo = "stern";
     rev = "v${version}";
-    sha256 = "sha256-8l/Tr+IxR3yPmt9hI70XuUQ4YEYzRTMLbo8BsngoU60=";
+    sha256 = "sha256-jgmURvc1did3YgtqWlAzFbWxc3jHHylOfCVOLeAC7V8=";
   };
 
-  vendorSha256 = "sha256-pvFT4A7bDBvBf1odyv3z4inw1/IsvOA+++OPbfNjzxM=";
+  vendorSha256 = "sha256-p8WoFDwABXcO54WKP5bszoht2JdjHlRJjbG8cMyNo6A=";
+
+  subPackages = [ "." ];
 
   nativeBuildInputs = [ installShellFiles ];
 

third_party/nixpkgs/pkgs/applications/networking/cluster/tektoncd-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "tektoncd-cli";
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "tektoncd";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-fWcHjpfbpj2lrJ0FawhQJuSxAEX1WwOY7m+CAgag4qk=";
+    sha256 = "sha256-duJSTk5LmJWbaVYybZZHWDe8E/ZqZLCCsdPIiH5d/G4=";
   };
 
   vendorSha256 = null;

third_party/nixpkgs/pkgs/applications/networking/dnscontrol/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "3.9.0";
+  version = "3.10.0";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9lIjQaMYy0FGMkR29Es3BMIAcn+jQYudyFJHwezlXKM=";
+    sha256 = "sha256-22wYc6W4a5P9+JW7NW+s85IlQ+tfLhYzDarN6PGkFk4=";
   };
 
-  vendorSha256 = "sha256-thvbqDhLdY+g/byFHJ9Tdiw8WYRccu4X1Rb0pdhE34E=";
+  vendorSha256 = "sha256-TPvO/E/uOyVSMNRQ3zzt15+i0UK0uHvI4qM5PqmHY20=";
 
   subPackages = [ "." ];
 

third_party/nixpkgs/pkgs/applications/networking/ids/snort/default.nix

@@ -3,13 +3,13 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.9.16.1";
+  version = "2.9.18";
   pname = "snort";
 
   src = fetchurl {
     name = "${pname}-${version}.tar.gz";
     url = "https://snort.org/downloads/archive/snort/${pname}-${version}.tar.gz";
-    sha256 = "13lzvjli6kbsnkd7lf0rm71l2mnz38pxk76ia9yrjb6clfhlbb73";
+    sha256 = "0xrc7crchflfrk4x5dq5zx22zkmgcrbkww5r1pvkc3cyyr18cc6h";
   };
 
   nativeBuildInputs = [ makeWrapper ];

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/dino/default.nix

@@ -4,7 +4,6 @@
 , xorg, libXdmcp, libxkbcommon
 , libnotify, libsoup, libgee
 , librsvg, libsignal-protocol-c
-, fetchpatch
 , libgcrypt
 , epoxy
 , at-spi2-core

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -28,7 +28,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.6.2"; # Please backport all updates to the stable channel.
+  version = "5.7.1"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -38,7 +38,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0cdzww741l4s95n5gq5zx5l3zvxinxbqa9y6wf8wjq7rzn6bwqx3";
+    sha256 = "1hjykjqf3n20aab9g3bwk5w8x8v61320xv6z4iqrwwdzfkb3ly20";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/teams/default.nix

@@ -13,6 +13,7 @@
 , gawk
 , xdg-utils
 , systemd
+, nodePackages
 , enableRectOverlay ? false }:
 
 stdenv.mkDerivation rec {
@@ -24,7 +25,7 @@ stdenv.mkDerivation rec {
     sha256 = "1kx4j837fd344zy90nl0j3r8cdvihy6i6gf56wd5n56zngx1fhjv";
   };
 
-  nativeBuildInputs = [ dpkg autoPatchelfHook wrapGAppsHook ];
+  nativeBuildInputs = [ dpkg autoPatchelfHook wrapGAppsHook nodePackages.asar ];
 
   unpackCmd = "dpkg -x $curSrc .";
 
@@ -40,11 +41,27 @@ stdenv.mkDerivation rec {
   ];
 
   preFixup = ''
-    gappsWrapperArgs+=(--prefix PATH : "${coreutils}/bin:${gawk}/bin:${xdg-utils}/bin")
+    gappsWrapperArgs+=(--prefix PATH : "${coreutils}/bin:${gawk}/bin")
     gappsWrapperArgs+=(--add-flags --disable-namespace-sandbox)
     gappsWrapperArgs+=(--add-flags --disable-setuid-sandbox)
   '';
 
+
+  buildPhase = ''
+    runHook preBuild
+
+    asar extract share/teams/resources/app.asar "$TMP/work"
+    substituteInPlace $TMP/work/main.bundle.js \
+        --replace "/usr/share/pixmaps/" "$out/share/pixmaps" \
+        --replace "/usr/bin/xdg-mime" "${xdg-utils}/bin/xdg-mime" \
+        --replace "Exec=/usr/bin/" "Exec=" # Remove usage of absolute path in autostart.
+    asar pack --unpack='{*.node,*.ftz,rect-overlay}' "$TMP/work" share/teams/resources/app.asar
+
+    runHook postBuild
+  '';
+
+  preferLocalBuild = true;
+
   installPhase = ''
     runHook preInstall
 

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/wire-desktop/default.nix

@@ -22,13 +22,13 @@ let
   pname = "wire-desktop";
 
   version = {
-    x86_64-darwin = "3.25.4095";
+    x86_64-darwin = "3.26.4145";
-    x86_64-linux = "3.25.2940";
+    x86_64-linux = "3.26.2941";
   }.${system} or throwSystem;
 
   sha256 = {
-    x86_64-darwin = "01gbmbxs3w7lwsy5wjpr7fgqkb20rj5fv1r3dsmjkfwy45pd835j";
+    x86_64-darwin = "1ck74a9z2mrwmljrqm347bqhjiaf1v0bf1jfnp58cqngh5ygqnf2";
-    x86_64-linux = "1vb2fy8hijjp0193d32d8hw7h00w6wympf3zc96skk8hz3ks6xz8";
+    x86_64-linux = "01gy84gr0gw5ap7hpy72azaf6hlzac7vxkn5cgad5sfbyzxgjgc9";
   }.${system} or throwSystem;
 
   meta = with lib; {

third_party/nixpkgs/pkgs/applications/networking/irc/kirc/default.nix

@@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation rec {
+  pname = "kirc";
+  version = "0.2.7";
+
+  src = fetchFromGitHub {
+    owner = "mcpcpc";
+    repo = pname;
+    rev = version;
+    hash = "sha256-iaqj4xB15DB3w/RaiCOMdAu8eONhTw1Dz0j5kykAHV4=";
+  };
+
+  dontConfigure = true;
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  meta = with lib; {
+    homepage = "http://kirc.io/";
+    description = "Tiny IRC client written in C99";
+    longDescription = ''
+      kirc is a tiny open-source Internet Relay Chat (IRC) client designed with
+      usability and cross-platform compatibility in mind.
+
+      It features:
+      - No dependencies other than a C99 compiler.
+      - Simple Authentication and Security Layer (SASL) procotol support.
+      - Client-to-client (CTCP) protocol support.
+      - Transport Layer Security (TLS) protocol support (via external
+        utilities).
+      - Simple chat history logging.
+      - Asynchronous message handling.
+      - Multi-channel joining at server connection.
+      - Full support for all RFC 2812 commands.
+      - Easy customized color scheme definition.
+    '';
+    license = licenses.mit;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = platforms.unix;
+  };
+}

third_party/nixpkgs/pkgs/applications/networking/irc/weechat/scripts/default.nix

@@ -20,4 +20,6 @@
   weechat-autosort = callPackage ./weechat-autosort { };
 
   weechat-otr = callPackage ./weechat-otr { };
+
+  weechat-go = callPackage ./weechat-go { };
 }

third_party/nixpkgs/pkgs/applications/networking/irc/weechat/scripts/weechat-go/default.nix

@@ -0,0 +1,26 @@
+{ lib, stdenv, fetchurl, weechat }:
+
+stdenv.mkDerivation {
+  pname = "weechat-go";
+  version = "2.7";
+
+  src = fetchurl {
+    url = "https://github.com/weechat/scripts/raw/414cff3ee605ba204b607742430a21443c035b08/python/go.py";
+    sha256 = "0bnbfpj1qg4yzwbikh1aw5ajc8l44lkb0y0m6mz8grpf5bxk5cwm";
+  };
+
+  dontUnpack = true;
+
+  passthru.scripts = [ "go.py" ];
+
+  installPhase = ''
+    install -D $src $out/share/go.py
+  '';
+
+  meta = with lib; {
+    inherit (weechat.meta) platforms;
+    description = "go.py is a weechat script to quickly jump to different buffers";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ govanify ];
+  };
+}