Project import generated by Copybara.

GitOrigin-RevId: b839d4a8557adc80e522f674529e586ab2a88d23

third_party/nixpkgs/.github/CODEOWNERS

@@ -207,7 +207,7 @@
 /nixos/tests/podman.nix                      @NixOS/podman @zowoq
 
 # Docker tools
-/pkgs/build-support/docker                   @roberth
+/pkgs/build-support/docker                   @roberth @utdemir
 /nixos/tests/docker-tools-overlay.nix        @roberth
 /nixos/tests/docker-tools.nix                @roberth
 /doc/builders/images/dockertools.xml         @roberth

third_party/nixpkgs/maintainers/maintainer-list.nix

@@ -514,6 +514,12 @@
     githubId = 69135;
     name = "Andrea Bedini";
   };
+  andreasfelix = {
+    email = "fandreas@physik.hu-berlin.de";
+    github = "andreasfelix";
+    githubId = 24651767;
+    name = "Felix Andreas";
+  };
   andres = {
     email = "ksnixos@andres-loeh.de";
     github = "kosmikus";
@@ -3487,6 +3493,12 @@
     email = "t@larkery.com";
     name = "Tom Hinton";
   };
+  hjones2199 = {
+    email = "hjones2199@gmail.com";
+    github = "hjones2199";
+    githubId = 5525217;
+    name = "Hunter Jones";
+  };
   hkjn = {
     email = "me@hkjn.me";
     name = "Henrik Jonsson";

third_party/nixpkgs/nixos/doc/manual/configuration/configuration.xml

@@ -18,6 +18,7 @@
  <xi:include href="user-mgmt.xml" />
  <xi:include href="file-systems.xml" />
  <xi:include href="x-windows.xml" />
+ <xi:include href="wayland.xml" />
  <xi:include href="gpu-accel.xml" />
  <xi:include href="xfce.xml" />
  <xi:include href="networking.xml" />

third_party/nixpkgs/nixos/doc/manual/configuration/wayland.xml

@@ -0,0 +1,23 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-wayland">
+ <title>Wayland</title>
+
+ <para>
+  While X11 (see <xref linkend="sec-x11"/>) is still the primary display
+  technology on NixOS, Wayland support is steadily improving.
+  Where X11 separates the X Server and the window manager, on Wayland those
+  are combined: a Wayland Compositor is like an X11 window manager, but also
+  embeds the Wayland 'Server' functionality. This means it is sufficient to
+  install a Wayland Compositor such as <package>sway</package> without
+  separately enabling a Wayland server:
+<programlisting>
+<xref linkend="opt-programs.sway.enable"/> = true;
+</programlisting>
+  This installs the <package>sway</package> compositor along with some
+  essential utilities. Now you can start <package>sway</package> from the TTY
+  console.
+ </para>
+</chapter>

third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2009.xml

@@ -879,12 +879,23 @@ php.override {
    <listitem>
      <para>
        Nginx web server now starting with additional sandbox/hardening options. By default, write access
-       to <literal>services.nginx.stateDir</literal> is allowed. To allow writing to other folders,
+       to <literal>/var/log/nginx</literal> and <literal>/var/cache/nginx</literal> is allowed. To allow writing to other folders,
        use <literal>systemd.services.nginx.serviceConfig.ReadWritePaths</literal>
        <programlisting>
 systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
        </programlisting>
      </para>
+     <para>
+       Nginx is also started with the systemd option <literal>ProtectHome = mkDefault true;</literal>
+       which forbids it to read anything from <literal>/home</literal>, <literal>/root</literal>
+       and <literal>/run/user</literal> (see
+       <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.exec.html#ProtectHome=">ProtectHome docs</link>
+       for details).
+       If you require serving files from home directories, you may choose to set e.g.
+<programlisting>
+systemd.services.nginx.serviceConfig.ProtectHome = "read-only";
+</programlisting>
+     </para>
    </listitem>
    <listitem>
     <para>

third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2103.xml

@@ -136,6 +136,13 @@
     <package>stanchion</package> package removed along with <varname>services.stanchion</varname> module.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     <package>mutt</package> has been updated to a new major version (2.x), which comes with
+     some backward incompatible changes that are described in the
+     <link xlink:href="http://www.mutt.org/relnotes/2.0/">release notes for Mutt 2.0</link>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -159,6 +166,11 @@
      to <package>nextcloud20</package>.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The setting <xref linkend="opt-services.redis.bind" /> defaults to <literal>127.0.0.1</literal> now, making Redis listen on the loopback interface only, and not all public network interfaces.
+    </para>
+   </listitem>
    <listitem>
     <para>
      NixOS now emits a deprecation warning if systemd's <literal>StartLimitInterval</literal> setting is used in a <literal>serviceConfig</literal> section instead of in a <literal>unitConfig</literal>; that setting is deprecated and now undocumented for the service section by systemd upstream, but still effective and somewhat buggy there, which can be confusing. See <link xlink:href="https://github.com/NixOS/nixpkgs/issues/45785">#45785</link> for details.
@@ -167,6 +179,62 @@
      All services should use <xref linkend="opt-systemd.services._name_.startLimitIntervalSec" /> or <literal>StartLimitIntervalSec</literal> in <xref linkend="opt-systemd.services._name_.unitConfig" /> instead.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The Unbound DNS resolver service (<literal>services.unbound</literal>) has been refactored to allow reloading, control sockets and to fix startup ordering issues.
+    </para>
+
+    <para>
+     It is now possible to enable a local UNIX control socket for unbound by setting the <xref linkend="opt-services.unbound.localControlSocketPath" />
+     option.
+    </para>
+
+    <para>
+     Previously we just applied a very minimal set of restrictions and
+     trusted unbound to properly drop root privs and capabilities.
+    </para>
+
+    <para>
+     As of this we are (for the most part) just using the upstream
+     example unit file for unbound. The main difference is that we start
+     unbound as <literal>unbound</literal> user with the required capabilities instead of
+     letting unbound do the chroot &amp; uid/gid changes.
+    </para>
+
+    <para>
+     The upstream unit configuration this is based on is a lot stricter with
+     all kinds of permissions then our previous variant. It also came with
+     the default of having the <literal>Type</literal> set to <literal>notify</literal>, therefore we are now also
+     using the <literal>unbound-with-systemd</literal> package here. Unbound will start up,
+     read the configuration files and start listening on the configured ports
+     before systemd will declare the unit <literal>active (running)</literal>.
+     This will likely help with startup order and the occasional race condition during system
+     activation where the DNS service is started but not yet ready to answer
+     queries. Services depending on <literal>nss-lookup.target</literal> or <literal>unbound.service</literal>
+     are now be able to use unbound when those targets have been reached.
+    </para>
+
+    <para>
+     Aditionally to the much stricter runtime environmet the
+     <literal>/dev/urandom</literal> mount lines we previously had in the code (that would
+     randomly failed during the stop-phase) have been removed as systemd will take care of those for us.
+    </para>
+
+    <para>
+     The <literal>preStart</literal> script is now only required if we enabled the trust
+      anchor updates (which are still enabled by default).
+    </para>
+
+    <para>
+     Another benefit of the refactoring is that we can now issue reloads via
+     either <literal>pkill -HUP unbound</literal> and <literal>systemctl reload unbound</literal> to reload the
+     running configuration without taking the daemon offline. A prerequisite
+     of this was that unbound configuration is available on a well known path
+     on the file system. We are using the path <literal>/etc/unbound/unbound.conf</literal> as that is the
+     default in the CLI tooling which in turn enables us to use
+     <literal>unbound-control</literal> without passing a custom configuration location.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>

third_party/nixpkgs/nixos/modules/services/databases/redis.nix

@@ -87,9 +87,12 @@ in
 
       bind = mkOption {
         type = with types; nullOr str;
-        default = null; # All interfaces
+        default = "127.0.0.1";
-        description = "The IP interface to bind to.";
+        description = ''
-        example = "127.0.0.1";
+          The IP interface to bind to.
+          <literal>null</literal> means "all interfaces".
+        '';
+        example = "192.0.2.1";
       };
 
       unixSocket = mkOption {

third_party/nixpkgs/nixos/modules/services/mail/roundcube.nix

@@ -204,6 +204,11 @@ in
     };
     systemd.services.phpfpm-roundcube.after = [ "roundcube-setup.service" ];
 
+    # Restart on config changes.
+    systemd.services.phpfpm-roundcube.restartTriggers = [
+      config.environment.etc."roundcube/config.inc.php".source
+    ];
+
     systemd.services.roundcube-setup = mkMerge [
       (mkIf (cfg.database.host == "localhost") {
         requires = [ "postgresql.service" ];

third_party/nixpkgs/nixos/modules/services/misc/octoprint.nix

@@ -68,7 +68,7 @@ in
       plugins = mkOption {
         default = plugins: [];
         defaultText = "plugins: []";
-        example = literalExample "plugins: with plugins; [ m33-fio stlviewer ]";
+        example = literalExample "plugins: with plugins; [ themeify stlviewer ]";
         description = "Additional plugins to be used. Available plugins are passed through the plugins input.";
       };
 

third_party/nixpkgs/nixos/modules/services/networking/unbound.nix

@@ -1,9 +1,7 @@
 { config, lib, pkgs, ... }:
 
 with lib;
-
 let
-
   cfg = config.services.unbound;
 
   stateDir = "/var/lib/unbound";
@@ -17,12 +15,12 @@ let
   forward =
     optionalString (any isLocalAddress cfg.forwardAddresses) ''
       do-not-query-localhost: no
-    '' +
+    ''
-    optionalString (cfg.forwardAddresses != []) ''
+    + optionalString (cfg.forwardAddresses != []) ''
       forward-zone:
         name: .
-    '' +
+    ''
-    concatMapStringsSep "\n" (x: "    forward-addr: ${x}") cfg.forwardAddresses;
+    + concatMapStringsSep "\n" (x: "    forward-addr: ${x}") cfg.forwardAddresses;
 
   rootTrustAnchorFile = "${stateDir}/root.key";
 
@@ -31,19 +29,25 @@ let
 
   confFile = pkgs.writeText "unbound.conf" ''
     server:
+      ip-freebind: yes
       directory: "${stateDir}"
       username: unbound
-      chroot: "${stateDir}"
+      chroot: ""
       pidfile: ""
+      # when running under systemd there is no need to daemonize
+      do-daemonize: no
       ${interfaces}
       ${access}
       ${trustAnchor}
+    ${lib.optionalString (cfg.localControlSocketPath != null) ''
+      remote-control:
+        control-enable: yes
+        control-interface: ${cfg.localControlSocketPath}
+    ''}
     ${cfg.extraConfig}
     ${forward}
   '';
-
 in
-
 {
 
   ###### interface
@@ -55,8 +59,8 @@ in
 
       package = mkOption {
         type = types.package;
-        default = pkgs.unbound;
+        default = pkgs.unbound-with-systemd;
-        defaultText = "pkgs.unbound";
+        defaultText = "pkgs.unbound-with-systemd";
         description = "The unbound package to use";
       };
 
@@ -69,11 +73,14 @@ in
       interfaces = mkOption {
         default = [ "127.0.0.1" ] ++ optional config.networking.enableIPv6 "::1";
         type = types.listOf types.str;
-        description = "What addresses the server should listen on.";
+        description =  ''
+          What addresses the server should listen on. This supports the interface syntax documented in
+          <citerefentry><refentrytitle>unbound.conf</refentrytitle><manvolnum>8</manvolnum></citerefentry>.
+        '';
       };
 
       forwardAddresses = mkOption {
-        default = [ ];
+        default = [];
         type = types.listOf types.str;
         description = "What servers to forward queries to.";
       };
@@ -84,6 +91,28 @@ in
         description = "Use and update root trust anchor for DNSSEC validation.";
       };
 
+      localControlSocketPath = mkOption {
+        default = null;
+        # FIXME: What is the proper type here so users can specify strings,
+        # paths and null?
+        # My guess would be `types.nullOr (types.either types.str types.path)`
+        # but I haven't verified yet.
+        type = types.nullOr types.str;
+        example = "/run/unbound/unbound.ctl";
+        description = ''
+          When not set to <literal>null</literal> this option defines the path
+          at which the unbound remote control socket should be created at. The
+          socket will be owned by the unbound user (<literal>unbound</literal>)
+          and group will be <literal>nogroup</literal>.
+
+          Users that should be permitted to access the socket must be in the
+          <literal>unbound</literal> group.
+
+          If this option is <literal>null</literal> remote control will not be
+          configured at all. Unbounds default values apply.
+        '';
+      };
+
       extraConfig = mkOption {
         default = "";
         type = types.lines;
@@ -106,43 +135,85 @@ in
     users.users.unbound = {
       description = "unbound daemon user";
       isSystemUser = true;
+      group = lib.mkIf (cfg.localControlSocketPath != null) (lib.mkDefault "unbound");
+    };
+
+    # We need a group so that we can give users access to the configured
+    # control socket. Unbound allows access to the socket only to the unbound
+    # user and the primary group.
+    users.groups = lib.mkIf (cfg.localControlSocketPath != null) {
+      unbound = {};
     };
 
     networking.resolvconf.useLocalResolver = mkDefault true;
 
+
+    environment.etc."unbound/unbound.conf".source = confFile;
+
     systemd.services.unbound = {
       description = "Unbound recursive Domain Name Server";
       after = [ "network.target" ];
       before = [ "nss-lookup.target" ];
-      wants = [ "nss-lookup.target" ];
+      wantedBy = [ "multi-user.target" "nss-lookup.target" ];
-      wantedBy = [ "multi-user.target" ];
 
-      preStart = ''
+      preStart = lib.mkIf cfg.enableRootTrustAnchor ''
-        mkdir -m 0755 -p ${stateDir}/dev/
+        ${cfg.package}/bin/unbound-anchor -a ${rootTrustAnchorFile} || echo "Root anchor updated!"
-        cp ${confFile} ${stateDir}/unbound.conf
-        ${optionalString cfg.enableRootTrustAnchor ''
-          ${cfg.package}/bin/unbound-anchor -a ${rootTrustAnchorFile} || echo "Root anchor updated!"
-          chown unbound ${stateDir} ${rootTrustAnchorFile}
-        ''}
-        touch ${stateDir}/dev/random
-        ${pkgs.utillinux}/bin/mount --bind -n /dev/urandom ${stateDir}/dev/random
       '';
 
-      serviceConfig = {
+      restartTriggers = [
-        ExecStart = "${cfg.package}/bin/unbound -d -c ${stateDir}/unbound.conf";
+        confFile
-        ExecStopPost="${pkgs.utillinux}/bin/umount ${stateDir}/dev/random";
+      ];
 
-        ProtectSystem = true;
+      serviceConfig = {
-        ProtectHome = true;
+        ExecStart = "${cfg.package}/bin/unbound -p -d -c /etc/unbound/unbound.conf";
+        ExecReload = "+/run/current-system/sw/bin/kill -HUP $MAINPID";
+
+        NotifyAccess = "main";
+        Type = "notify";
+
+        # FIXME: Which of these do we actualy need, can we drop the chroot flag?
+        AmbientCapabilities = [
+          "CAP_NET_BIND_SERVICE"
+          "CAP_NET_RAW"
+          "CAP_SETGID"
+          "CAP_SETUID"
+          "CAP_SYS_CHROOT"
+          "CAP_SYS_RESOURCE"
+        ];
+
+        User = "unbound";
+        Group = lib.mkIf (cfg.localControlSocketPath != null) (lib.mkDefault "unbound");
+
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
         PrivateDevices = true;
-        Restart = "always";
+        PrivateTmp = true;
-        RestartSec = "5s";
+        ProtectHome = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        ProtectSystem = "strict";
+        RuntimeDirectory = "unbound";
+        ConfigurationDirectory = "unbound";
+        StateDirectory = "unbound";
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "~@clock"
+          "@cpu-emulation"
+          "@debug"
+          "@keyring"
+          "@module"
+          "mount"
+          "@obsolete"
+          "@resources"
+        ];
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        RestrictSUIDSGID = true;
       };
     };
-
     # If networkmanager is enabled, ask it to interface with unbound.
     networking.networkmanager.dns = "unbound";
-
   };
-
 }

third_party/nixpkgs/nixos/modules/system/boot/luksroot.nix

@@ -404,7 +404,7 @@ let
           echo "Please move your mouse to create needed randomness."
         ''}
           echo "Waiting for your FIDO2 device..."
-          fido2luks -i open ${device} ${name} ${fido2.credential} --await-dev ${toString fido2.gracePeriod} --salt string:$passphrase
+          fido2luks open ${device} ${name} ${fido2.credential} --await-dev ${toString fido2.gracePeriod} --salt string:$passphrase
         if [ $? -ne 0 ]; then
           echo "No FIDO2 key found, falling back to normal open procedure"
           open_normally

third_party/nixpkgs/nixos/modules/system/boot/pbkdf2-sha512.c

@@ -35,4 +35,4 @@ int main(int argc, char** argv)
 	fwrite(key, 1, key_length, stdout);
 
 	return 0;
-}
+}

third_party/nixpkgs/nixos/tests/all-tests.nix

@@ -368,6 +368,7 @@ in
   trezord = handleTest ./trezord.nix {};
   trickster = handleTest ./trickster.nix {};
   tuptime = handleTest ./tuptime.nix {};
+  unbound = handleTest ./unbound.nix {};
   udisks2 = handleTest ./udisks2.nix {};
   unit-php = handleTest ./web-servers/unit-php.nix {};
   upnp = handleTest ./upnp.nix {};

third_party/nixpkgs/nixos/tests/unbound.nix

@@ -0,0 +1,278 @@
+/*
+ Test that our unbound module indeed works as most users would expect.
+ There are a few settings that we must consider when modifying the test. The
+ ususal use-cases for unbound are
+   * running a recursive DNS resolver on the local machine
+   * running a recursive DNS resolver on the local machine, forwarding to a local DNS server via UDP/53 & TCP/53
+   * running a recursive DNS resolver on the local machine, forwarding to a local DNS server via TCP/853 (DoT)
+   * running a recursive DNS resolver on a machine in the network awaiting input from clients over TCP/53 & UDP/53
+   * running a recursive DNS resolver on a machine in the network awaiting input from clients over TCP/853 (DoT)
+
+ In the below test setup we are trying to implement all of those use cases.
+
+ Another aspect that we cover is access to the local control UNIX socket. It
+ can optionally be enabled and users can optionally be in a group to gain
+ access. Users that are not in the group (except for root) should not have
+ access to that socket. Also, when there is no socket configured, users
+ shouldn't be able to access the control socket at all. Not even root.
+*/
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+  let
+    # common client configuration that we can just use for the multitude of
+    # clients we are constructing
+    common = { lib, pkgs, ... }: {
+      config = {
+        environment.systemPackages = [ pkgs.knot-dns ];
+
+        # disable the root anchor update as we do not have internet access during
+        # the test execution
+        services.unbound.enableRootTrustAnchor = false;
+      };
+    };
+
+    cert = pkgs.runCommandNoCC "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+      openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=dns.example.local'
+      mkdir -p $out
+      cp key.pem cert.pem $out
+    '';
+  in
+  {
+    name = "unbound";
+    meta = with pkgs.stdenv.lib.maintainers; {
+      maintainers = [ andir ];
+    };
+
+    nodes = {
+
+      # The server that actually serves our zones, this tests unbounds authoriative mode
+      authoritative = { lib, pkgs, config, ... }: {
+        imports = [ common ];
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          { address = "192.168.0.1"; prefixLength = 24; }
+        ];
+        networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
+          { address = "fd21::1"; prefixLength = 64; }
+        ];
+        networking.firewall.allowedTCPPorts = [ 53 ];
+        networking.firewall.allowedUDPPorts = [ 53 ];
+
+        services.unbound = {
+          enable = true;
+          interfaces = [ "192.168.0.1" "fd21::1" "::1" "127.0.0.1" ];
+          allowedAccess = [ "192.168.0.0/24" "fd21::/64" "::1" "127.0.0.0/8" ];
+          extraConfig = ''
+            server:
+              local-data: "example.local. IN A 1.2.3.4"
+              local-data: "example.local. IN AAAA abcd::eeff"
+          '';
+        };
+      };
+
+      # The resolver that knows that fowards (only) to the authoritative server
+      # and listens on UDP/53, TCP/53 & TCP/853.
+      resolver = { lib, nodes, ... }: {
+        imports = [ common ];
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          { address = "192.168.0.2"; prefixLength = 24; }
+        ];
+        networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
+          { address = "fd21::2"; prefixLength = 64; }
+        ];
+        networking.firewall.allowedTCPPorts = [
+          53 # regular DNS
+          853 # DNS over TLS
+        ];
+        networking.firewall.allowedUDPPorts = [ 53 ];
+
+        services.unbound = {
+          enable = true;
+          allowedAccess = [ "192.168.0.0/24" "fd21::/64" "::1" "127.0.0.0/8" ];
+          interfaces = [ "::1" "127.0.0.1" "192.168.0.2" "fd21::2" "192.168.0.2@853" "fd21::2@853" "::1@853" "127.0.0.1@853" ];
+          forwardAddresses = [
+            (lib.head nodes.authoritative.config.networking.interfaces.eth1.ipv6.addresses).address
+            (lib.head nodes.authoritative.config.networking.interfaces.eth1.ipv4.addresses).address
+          ];
+          extraConfig = ''
+            server:
+              tls-service-pem: ${cert}/cert.pem
+              tls-service-key: ${cert}/key.pem
+          '';
+        };
+      };
+
+      # machine that runs a local unbound that will be reconfigured during test execution
+      local_resolver = { lib, nodes, config, ... }: {
+        imports = [ common ];
+        networking.interfaces.eth1.ipv4.addresses = lib.mkForce [
+          { address = "192.168.0.3"; prefixLength = 24; }
+        ];
+        networking.interfaces.eth1.ipv6.addresses = lib.mkForce [
+          { address = "fd21::3"; prefixLength = 64; }
+        ];
+        networking.firewall.allowedTCPPorts = [
+          53 # regular DNS
+        ];
+        networking.firewall.allowedUDPPorts = [ 53 ];
+
+        services.unbound = {
+          enable = true;
+          allowedAccess = [ "::1" "127.0.0.0/8" ];
+          interfaces = [ "::1" "127.0.0.1" ];
+          localControlSocketPath = "/run/unbound/unbound.ctl";
+          extraConfig = ''
+            include: "/etc/unbound/extra*.conf"
+          '';
+        };
+
+        users.users = {
+          # user that is permitted to access the unix socket
+          someuser.extraGroups = [
+            config.users.users.unbound.group
+          ];
+
+          # user that is not permitted to access the unix socket
+          unauthorizeduser = {};
+        };
+
+        environment.etc = {
+          "unbound-extra1.conf".text = ''
+            forward-zone:
+              name: "example.local."
+              forward-addr: ${(lib.head nodes.resolver.config.networking.interfaces.eth1.ipv6.addresses).address}
+              forward-addr: ${(lib.head nodes.resolver.config.networking.interfaces.eth1.ipv4.addresses).address}
+          '';
+          "unbound-extra2.conf".text = ''
+            auth-zone:
+              name: something.local.
+              zonefile: ${pkgs.writeText "zone" ''
+                something.local. IN A 3.4.5.6
+              ''}
+          '';
+        };
+      };
+
+
+      # plain node that only has network access and doesn't run any part of the
+      # resolver software locally
+      client = { lib, nodes, ... }: {
+        imports = [ common ];
+        networking.nameservers = [
+          (lib.head nodes.resolver.config.networking.interfaces.eth1.ipv6.addresses).address
+          (lib.head nodes.resolver.config.networking.interfaces.eth1.ipv4.addresses).address
+        ];
+        networking.interfaces.eth1.ipv4.addresses = [
+          { address = "192.168.0.10"; prefixLength = 24; }
+        ];
+        networking.interfaces.eth1.ipv6.addresses = [
+          { address = "fd21::10"; prefixLength = 64; }
+        ];
+      };
+    };
+
+    testScript = { nodes, ... }: ''
+      import typing
+      import json
+
+      zone = "example.local."
+      records = [("AAAA", "abcd::eeff"), ("A", "1.2.3.4")]
+
+
+      def query(
+          machine,
+          host: str,
+          query_type: str,
+          query: str,
+          expected: typing.Optional[str] = None,
+          args: typing.Optional[typing.List[str]] = None,
+      ):
+          """
+          Execute a single query and compare the result with expectation
+          """
+          text_args = ""
+          if args:
+              text_args = " ".join(args)
+
+          out = machine.succeed(
+              f"kdig {text_args} {query} {query_type} @{host} +short"
+          ).strip()
+          machine.log(f"{host} replied with {out}")
+          if expected:
+              assert expected == out, f"Expected `{expected}` but got `{out}`"
+
+
+      def test(machine, remotes, /, doh=False, zone=zone, records=records, args=[]):
+          """
+          Run queries for the given remotes on the given machine.
+          """
+          for query_type, expected in records:
+              for remote in remotes:
+                  query(machine, remote, query_type, zone, expected, args)
+                  query(machine, remote, query_type, zone, expected, ["+tcp"] + args)
+                  if doh:
+                      query(
+                          machine,
+                          remote,
+                          query_type,
+                          zone,
+                          expected,
+                          ["+tcp", "+tls"] + args,
+                      )
+
+
+      client.start()
+      authoritative.wait_for_unit("unbound.service")
+
+      # verify that we can resolve locally
+      with subtest("test the authoritative servers local responses"):
+          test(authoritative, ["::1", "127.0.0.1"])
+
+      resolver.wait_for_unit("unbound.service")
+
+      with subtest("root is unable to use unbounc-control when the socket is not configured"):
+          resolver.succeed("which unbound-control")  # the binary must exist
+          resolver.fail("unbound-control list_forwards")  # the invocation must fail
+
+      # verify that the resolver is able to resolve on all the local protocols
+      with subtest("test that the resolver resolves on all protocols and transports"):
+          test(resolver, ["::1", "127.0.0.1"], doh=True)
+
+      resolver.wait_for_unit("multi-user.target")
+
+      with subtest("client should be able to query the resolver"):
+          test(client, ["${(lib.head nodes.resolver.config.networking.interfaces.eth1.ipv6.addresses).address}", "${(lib.head nodes.resolver.config.networking.interfaces.eth1.ipv4.addresses).address}"], doh=True)
+
+      # discard the client we do not need anymore
+      client.shutdown()
+
+      local_resolver.wait_for_unit("multi-user.target")
+
+      # link a new config file to /etc/unbound/extra.conf
+      local_resolver.succeed("ln -s /etc/unbound-extra1.conf /etc/unbound/extra1.conf")
+
+      # reload the server & ensure the forwarding works
+      with subtest("test that the local resolver resolves on all protocols and transports"):
+          local_resolver.succeed("systemctl reload unbound")
+          print(local_resolver.succeed("journalctl -u unbound -n 1000"))
+          test(local_resolver, ["::1", "127.0.0.1"], args=["+timeout=60"])
+
+      with subtest("test that we can use the unbound control socket"):
+          out = local_resolver.succeed(
+              "sudo -u someuser -- unbound-control list_forwards"
+          ).strip()
+
+          # Thank you black! Can't really break this line into a readable version.
+          expected = "example.local. IN forward ${(lib.head nodes.resolver.config.networking.interfaces.eth1.ipv6.addresses).address} ${(lib.head nodes.resolver.config.networking.interfaces.eth1.ipv4.addresses).address}"
+          assert out == expected, f"Expected `{expected}` but got `{out}` instead."
+          local_resolver.fail("sudo -u unauthorizeduser -- unbound-control list_forwards")
+
+
+      # link a new config file to /etc/unbound/extra.conf
+      local_resolver.succeed("ln -sf /etc/unbound-extra2.conf /etc/unbound/extra2.conf")
+
+      # reload the server & ensure the new local zone works
+      with subtest("test that we can query the new local zone"):
+          local_resolver.succeed("unbound-control reload")
+          r = [("A", "3.4.5.6")]
+          test(local_resolver, ["::1", "127.0.0.1"], zone="something.local.", records=r)
+    '';
+  })

third_party/nixpkgs/pkgs/applications/blockchains/namecoin.nix

@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     description = "Decentralized open source information registration and transfer system based on the Bitcoin cryptocurrency";
     homepage = "https://namecoin.org";
     license = licenses.mit;
-    maintainers = with maintainers; [ doublec infinisil ];
+    maintainers = with maintainers; [ infinisil ];
     platforms = platforms.linux;
   };
 }

third_party/nixpkgs/pkgs/applications/editors/android-studio/default.nix

@@ -19,9 +19,9 @@ let
     sha256Hash = "sha256-qbxmR9g8DSKzcP09bJuc+am79BSXWG39UQxFEb1bZ88=";
   };
   latestVersion = { # canary & dev
-    version = "4.2.0.15"; # "Android Studio 4.2 Canary 15"
+    version = "4.2.0.16"; # "Android Studio 4.2 Canary 16"
-    build = "202.6922807";
+    build = "202.6939830";
-    sha256Hash = "sha256-PXFNnPSJbdp9NtkMDR3Vq+vpWqd85Io2FmXPhRLRk/8=";
+    sha256Hash = "sha256-2Xh0GR4BHZI6ofdyMI2icrztI2BmiHWT+1bEZIZ58IE=";
   };
 in {
   # Attributes are named by their corresponding release channels

third_party/nixpkgs/pkgs/applications/editors/qxmledit/qxmledit.json

@@ -3,4 +3,4 @@
     "repo": "qxmledit",
     "rev": "6136dca50ceb3b4447c91a7a18dcf84785ea11d1",
     "sha256": "1wcnphalwf0a5gz9r44jgk8wcv1w2qipbwjkbzkra2kxanxns834"
-}
+}

third_party/nixpkgs/pkgs/applications/editors/texmacs/default.nix

@@ -16,7 +16,7 @@
 
 let
   pname = "TeXmacs";
-  version = "1.99.13";
+  version = "1.99.14";
   common = callPackage ./common.nix {
     inherit tex extraFonts chineseFonts japaneseFonts koreanFonts;
   };
@@ -26,22 +26,9 @@ mkDerivation {
 
   src = fetchurl {
     url = "https://www.texmacs.org/Download/ftp/tmftp/source/TeXmacs-${version}-src.tar.gz";
-    sha256 = "Aq0cS47QqmFQHelxRjANeJlgXCXagnYRykpAq7wHqbQ=";
+    sha256 = "1zbl1ddhppgnn3j213jl1b9mn8zmwnknxiqswm25p4llj0mqcgna";
   };
 
-  patches = [
-    # Minor patch for Qt 5.15 support, should be included in next release.
-    (fetchpatch {
-      url = "https://github.com/texmacs/texmacs/commit/3cf56af92326b74538f5e943928199ba6e963d0b.patch";
-      sha256 = "+OBQmnKgvQZZkLx6ea773Dwq0o7L92Sex/kcVUhmg6Q=";
-    })
-    # Fix returned version, lets hope they remember to bump the version next release.
-    (fetchpatch {
-      url = "https://github.com/texmacs/texmacs/commit/da5b67005d2fc31bb32ea1ead882c26af12d8cbb.patch";
-      sha256 = "czMgdraQErrdvN83jY76P673L52BpQkDwntmKvF0Ykg=";
-    })
-  ];
-
   enableParallelBuilding = true;
 
   nativeBuildInputs = [ cmake pkgconfig ];

third_party/nixpkgs/pkgs/applications/gis/qgis/unwrapped.nix

@@ -10,7 +10,7 @@ let
     [ qscintilla-qt5 gdal jinja2 numpy psycopg2
       chardet dateutil pyyaml pytz requests urllib3 pygments pyqt5 sip owslib six ];
 in mkDerivation rec {
-  version = "3.10.10";
+  version = "3.10.11";
   pname = "qgis";
   name = "${pname}-unwrapped-${version}";
 
@@ -18,7 +18,7 @@ in mkDerivation rec {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "yZBG+bpJA7iKkUEjVo45d+bmRp9WS7mk8z96FLf0ZQ0=";
+    sha256 = "157hwi9sgnsf0csbfg4x3c7vh0zgf1hnqgn04lhg9xa1n8jjbv2q";
   };
 
   passthru = {

third_party/nixpkgs/pkgs/applications/kde/elisa.nix

@@ -3,6 +3,7 @@
 , lib
 , extra-cmake-modules
 , kdoctools
+, qtbase
 , qtmultimedia
 , qtquickcontrols2
 , qtwebsockets
@@ -42,5 +43,6 @@ mkDerivation rec {
     description = "A simple media player for KDE";
     license = licenses.gpl3;
     maintainers = with maintainers; [ peterhoeg ];
+    broken = lib.versionOlder qtbase.version "5.14";
   };
 }

third_party/nixpkgs/pkgs/applications/kde/kwave.nix

@@ -1,14 +1,17 @@
-{ mkDerivation, lib, extra-cmake-modules, kdoctools, qtmultimedia, kcompletion, kconfig, kcrash, kiconthemes, kio, audiofile, libsamplerate
+{ mkDerivation, lib, extra-cmake-modules, kdoctools, qtmultimedia, kcompletion, kconfig
-, alsaLib, libpulseaudio, flac, id3lib, libogg, libmad, libopus, libvorbis, fftw, librsvg }:
+, kcrash, kiconthemes, kio, audiofile, libsamplerate, alsaLib, libpulseaudio, flac, id3lib
+, libogg, libmad, libopus, libvorbis, fftw, librsvg, qtbase }:
 
 mkDerivation {
   name = "kwave";
+
   meta = with lib; {
     homepage = "https://kde.org/applications/en/multimedia/org.kde.kwave";
     description = "A simple media player";
     maintainers = with maintainers; [ freezeboy ];
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
+    broken = lib.versionOlder qtbase.version "5.14";
   };
   nativeBuildInputs = [
     extra-cmake-modules

third_party/nixpkgs/pkgs/applications/kde/minuet.nix

@@ -1,4 +1,4 @@
-{ mkDerivation
+{ mkDerivation, qtbase
 , lib, extra-cmake-modules, gettext, python
 , drumstick, fluidsynth
 , kcoreaddons, kcrash, kdoctools
@@ -10,6 +10,7 @@ mkDerivation {
   meta = with lib; {
     license = with licenses; [ lgpl21 gpl3 ];
     maintainers = with maintainers; [ peterhoeg HaoZeke ];
+    broken = lib.versionOlder qtbase.version "5.14";
   };
 
   nativeBuildInputs = [ extra-cmake-modules gettext kdoctools python qtdeclarative ];

third_party/nixpkgs/pkgs/applications/misc/nwg-launchers/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nwg-launchers";
-  version = "0.4.0";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0r0wj4w3jj3l56z1lx6ypkzz4fsgx4vzqbvs95661l8q362pndzw";
+    sha256 = "0flp7mwj1pgcwx3k9pzc8pmqlkhbddj0maimdnvlazk87kzxpfd0";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/misc/octoprint/m33-fio-one-library.patch

@@ -1,175 +0,0 @@
-From 314bcebfcd1759981ce12255be29d8ae68cd400b Mon Sep 17 00:00:00 2001
-From: Nikolay Amiantov <ab@fmap.me>
-Date: Wed, 23 Nov 2016 00:40:48 +0300
-Subject: [PATCH] Build and use one version of preprocessor library
-
----
- octoprint_m33fio/__init__.py   | 73 ++----------------------------------------
- shared library source/Makefile | 62 +++--------------------------------
- 2 files changed, 6 insertions(+), 129 deletions(-)
-
-diff --git a/octoprint_m33fio/__init__.py b/octoprint_m33fio/__init__.py
-index 054870a..4d5ecc1 100755
---- a/octoprint_m33fio/__init__.py
-+++ b/octoprint_m33fio/__init__.py
-@@ -1189,78 +1189,9 @@ class M33FioPlugin(
- 		# Check if using shared library or checking if it is usable
- 		if self._settings.get_boolean(["UseSharedLibrary"]) or isUsable :
- 	
--			# Check if running on Linux
--			if platform.uname()[0].startswith("Linux") :
--
--				# Check if running on a Raspberry Pi 1
--				if platform.uname()[4].startswith("armv6l") and self.getCpuHardware() == "BCM2708" :
--	
--					# Set shared library
--					self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace("\\", "/") + "/static/libraries/preprocessor_arm1176jzf-s.so")
--	
--				# Otherwise check if running on a Raspberry Pi 2 or Raspberry Pi 3
--				elif platform.uname()[4].startswith("armv7l") and self.getCpuHardware() == "BCM2709" :
--	
--					# Set shared library
--					self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace("\\", "/") + "/static/libraries/preprocessor_arm_cortex-a7.so")
--	
--				# Otherwise check if running on an ARM7 device
--				elif platform.uname()[4].startswith("armv7") :
--	
--					# Set shared library
--					self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace("\\", "/") + "/static/libraries/preprocessor_arm7.so")
--	
--				# Otherwise check if using an i386 or x86-64 device
--				elif platform.uname()[4].endswith("86") or platform.uname()[4].endswith("64") :
--
--					# Check if Python is running as 32-bit
--					if platform.architecture()[0].startswith("32") :
--		
--						# Set shared library
--						self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace("\\", "/") + "/static/libraries/preprocessor_i386.so")
--	
--					# Otherwise check if Python is running as 64-bit
--					elif platform.architecture()[0].startswith("64") :
--		
--						# Set shared library
--						self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace("\\", "/") + "/static/libraries/preprocessor_x86-64.so")
--
--			# Otherwise check if running on Windows and using an i386 or x86-64 device
--			elif platform.uname()[0].startswith("Windows") and (platform.uname()[4].endswith("86") or platform.uname()[4].endswith("64")) :
-+			# Set shared library
-+			self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace('\\', '/') + "/static/libraries/libpreprocessor.so")
- 
--				# Check if Python is running as 32-bit
--				if platform.architecture()[0].startswith("32") :
--	
--					# Set shared library
--					self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace("\\", "/") + "/static/libraries/preprocessor_i386.dll")
--
--				# Otherwise check if Python is running as 64-bit
--				elif platform.architecture()[0].startswith("64") :
--	
--					# Set shared library
--					self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace("\\", "/") + "/static/libraries/preprocessor_x86-64.dll")
--
--			# Otherwise check if running on macOS and using an i386 or x86-64 device
--			elif platform.uname()[0].startswith("Darwin") and (platform.uname()[4].endswith("86") or platform.uname()[4].endswith("64")) :
--
--				# Check if Python is running as 32-bit
--				if platform.architecture()[0].startswith("32") :
--	
--					# Set shared library
--					self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace("\\", "/") + "/static/libraries/preprocessor_i386.dylib")
--
--				# Otherwise check if Python is running as 64-bit
--				elif platform.architecture()[0].startswith("64") :
--	
--					# Set shared library
--					self.sharedLibrary = ctypes.cdll.LoadLibrary(self._basefolder.replace("\\", "/") + "/static/libraries/preprocessor_x86-64.dylib")
--			
--			# Otherwise check if running FreeBSD
--			elif platform.uname()[0].startswith("FreeBSD") :
--			
--				# TODO: Compile FreeBSD shared library pre-processors
--				pass
--			
- 			# Check if shared library was set
- 			if self.sharedLibrary :
- 
-diff --git a/shared library source/Makefile b/shared library source/Makefile
-index 792b4f4..4c74f5c 100755
---- a/shared library source/Makefile	
-+++ b/shared library source/Makefile	
-@@ -1,68 +1,14 @@
--# Target platform options: LINUX32, LINUX64, WINDOWS32, WINDOWS64, PI, PI2, ARM7, MACOS32, MACOS64
--LIBRARY_NAME = preprocessor
--TARGET_PLATFORM = LINUX64
-+LIBRARY_NAME = libpreprocessor
- VER = .1
- 
--ifeq ($(TARGET_PLATFORM), LINUX32)
--	PROG = $(LIBRARY_NAME)_i386.so
--	CC = g++
--	CFLAGS = -fPIC -m32 -static-libgcc -O3 -Wl,-soname,$(PROG)$(VER) -static-libstdc++
--endif
--
--ifeq ($(TARGET_PLATFORM), LINUX64)
--	PROG = $(LIBRARY_NAME)_x86-64.so
--	CC = g++
--	CFLAGS = -fPIC -m64 -static-libgcc -O3 -Wl,-soname,$(PROG)$(VER) -static-libstdc++
--endif
--
--ifeq ($(TARGET_PLATFORM), WINDOWS32)
--	PROG = $(LIBRARY_NAME)_i386.dll
--	CC = i686-w64-mingw32-g++
--	CFLAGS = -static-libgcc -O3 -Wl,-soname,$(PROG)$(VER) -static-libstdc++
--endif
--
--ifeq ($(TARGET_PLATFORM), WINDOWS64)
--	PROG = $(LIBRARY_NAME)_x86-64.dll
--	CC = x86_64-w64-mingw32-g++
--	CFLAGS = -static-libgcc -O3 -Wl,-soname,$(PROG)$(VER) -static-libstdc++
--endif
--
--ifeq ($(TARGET_PLATFORM), PI)
--	PROG = $(LIBRARY_NAME)_arm1176jzf-s.so
--	CC = /opt/arm-toolchain/arm-bcm2708/arm-rpi-4.9.3-linux-gnueabihf/bin/arm-linux-gnueabihf-g++
--	CFLAGS = -fPIC -mcpu=arm1176jzf-s -mfpu=vfp -mfloat-abi=hard -static-libgcc -O3 -Wl,-soname,$(PROG)$(VER) -static-libstdc++
--endif
--
--ifeq ($(TARGET_PLATFORM), PI2)
--	PROG = $(LIBRARY_NAME)_arm_cortex-a7.so
--	CC = /opt/arm-toolchain/arm-bcm2708/arm-rpi-4.9.3-linux-gnueabihf/bin/arm-linux-gnueabihf-g++
--	CFLAGS = -fPIC -mcpu=cortex-a7 -mfpu=neon-vfpv4 -mfloat-abi=hard -static-libgcc -O3 -Wl,-soname,$(PROG)$(VER) -static-libstdc++
--endif
--
--ifeq ($(TARGET_PLATFORM), ARM7)
--	PROG = $(LIBRARY_NAME)_arm7.so
--	CC = /opt/arm-toolchain/arm-bcm2708/gcc-linaro-arm-linux-gnueabihf-raspbian-x64/bin/arm-linux-gnueabihf-g++
--	CFLAGS = -fPIC -mcpu=generic-armv7-a -mfpu=vfp -mfloat-abi=hard -static-libgcc -O3 -Wl,-soname,$(PROG)$(VER) -static-libstdc++
--endif
--
--ifeq ($(TARGET_PLATFORM), MACOS32)
--	PROG = $(LIBRARY_NAME)_i386.dylib
--	CC = clang++
--	CFLAGS = -fPIC -m32 -stdlib=libc++ -O3 -Wl,-install_name,$(PROG)$(VER)
--
--endif
--
--ifeq ($(TARGET_PLATFORM), MACOS64)
--	PROG = $(LIBRARY_NAME)_x86-64.dylib
--	CC = clang++
--	CFLAGS = -fPIC -m64 -stdlib=libc++ -O3 -Wl,-install_name,$(PROG)$(VER)
--endif
-+PROG = $(LIBRARY_NAME).so
-+CFLAGS = -fPIC -O3 -Wl,-soname,$(PROG)$(VER)
- 
- SRCS = preprocessor.cpp gcode.cpp vector.cpp
- CFLAGS += -Wall -std=c++11 -fvisibility=hidden -shared
- 
- all:
--	$(CC) $(CFLAGS) -o ../octoprint_m33fio/static/libraries/$(PROG) $(SRCS)
-+	$(CXX) $(CFLAGS) -o ../octoprint_m33fio/static/libraries/$(PROG) $(SRCS)
- 
- clean:
- 	rm -f ../octoprint_m33fio/static/libraries/$(PROG)
--- 
-2.14.1
-

third_party/nixpkgs/pkgs/applications/misc/octoprint/plugins.nix

@@ -109,6 +109,25 @@ in {
     };
   };
 
+  marlingcodedocumentation = buildPlugin rec {
+    pname = "MarlinGcodeDocumentation";
+    version = "0.11.0";
+
+    src = fetchFromGitHub {
+      owner = "costas-basdekis";
+      repo = pname;
+      rev = "v${version}";
+      sha256 = "0vx06w9hqwy0k4r8g67y8gdckfdx7wl8ghfx6hmxc1s8fgkghfkc";
+    };
+
+    meta = with stdenv.lib; {
+      description = "Displays GCode documentation for Marlin in the Octoprint terminal command line";
+      homepage = "https://github.com/costas-basdekis/MarlinGcodeDocumentation";
+      license = licenses.agpl3;
+      maintainers = with maintainers; [ lovesegfault ];
+    };
+  };
+
   mqtt = buildPlugin rec {
     pname = "MQTT";
     version = "0.8.7";

third_party/nixpkgs/pkgs/applications/misc/plater/default.nix

@@ -0,0 +1,30 @@
+{ mkDerivation
+, cmake
+, fetchFromGitHub
+, lib
+, libGLU
+, qtbase
+}:
+
+mkDerivation rec {
+  pname = "plater";
+  version = "2020-07-30";
+
+  src = fetchFromGitHub {
+    owner = "Rhoban";
+    repo = "Plater";
+    rev = "f8de6d038f95a9edebfcfe142c8e9783697d5b47";
+    sha256 = "0r20mbzd16zv1aiadjqdy7z6sp09rr6lgfxhvir4ll3cpakkynr4";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ libGLU qtbase ];
+
+  meta = with lib; {
+    description = "3D-printer parts placer and plate generator";
+    homepage = "https://github.com/Rhoban/Plater";
+    maintainers = with maintainers; [ lovesegfault ];
+    platforms = platforms.linux;
+    license = licenses.cc-by-nc-30;
+  };
+}

third_party/nixpkgs/pkgs/applications/misc/wtf/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "wtf";
-  version = "0.33.0";
+  version = "0.34.0";
 
   src = fetchFromGitHub {
     owner = "wtfutil";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0dszc3igfvlb6dgf5whyhw72id39lqqmgpd42kyqx5yjf5dw2wg7";
+    sha256 = "01zydr1w8byjhxf4xj6z001q4ynq0452cn332ap1l1w0dmx9mxyr";
    };
 
-  vendorSha256 = "1wcqk8lfv3jq7dfaj9dj8bzsmq2qislzs1m38gx1hh4jwg1rn2cn";
+  vendorSha256 = "1xyai417l8q44b562ssp5qqw04klrhg5397ahr4pc3i30csz8a7a";
 
   doCheck = false;
 

third_party/nixpkgs/pkgs/applications/misc/xautoclick/default.nix

@@ -1,32 +1,30 @@
-{ stdenv, fetchurl, xorg, pkgconfig
+{ stdenv, fetchFromGitHub, xorg, pkg-config
-, gtkSupport ? true, gtk2
+, cmake, libevdev
-, qtSupport ? true, qt4
+, gtkSupport ? true, gtk3, pcre, glib, wrapGAppsHook
+, fltkSupport ? true, fltk
+, qtSupport ? true, qt5
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  version = "0.31";
   pname = "xautoclick";
-  src = fetchurl {
+  version = "0.34";
-    url = "mirror://sourceforge/project/xautoclick/xautoclick/xautoclick-0.31/xautoclick-0.31.tar.gz";
+
-    sha256 = "0h522f12a7v2b89411xm51iwixmjp2mp90rnizjgiakx9ajnmqnm";
+  src = fetchFromGitHub {
+    owner = "qarkai";
+    repo = "xautoclick";
+    rev = "v${version}";
+    sha256 = "GN3zI5LQnVmRC0KWffzUTHKrxcqnstiL55hopwTTwpE=";
   };
-  nativeBuildInputs = [ pkgconfig ];
+
-  buildInputs = [ xorg.libX11 xorg.libXtst xorg.xinput xorg.libXi xorg.libXext ]
+  nativeBuildInputs = [ cmake pkg-config ];
-    ++ stdenv.lib.optionals gtkSupport [ gtk2 ]
+  buildInputs = [ libevdev xorg.libXtst ]
-    ++ stdenv.lib.optionals qtSupport [ qt4 ];
+    ++ stdenv.lib.optionals gtkSupport [ gtk3 pcre glib wrapGAppsHook ]
-  patchPhase = ''
+    ++ stdenv.lib.optionals fltkSupport [ fltk ]
-    substituteInPlace configure --replace /usr/X11R6 ${xorg.libX11.dev}
+    ++ stdenv.lib.optionals qtSupport [ qt5.qtbase qt5.wrapQtAppsHook ];
-  '';
-  preConfigure = stdenv.lib.optional qtSupport ''
-    mkdir .bin
-    ln -s ${qt4}/bin/moc .bin/moc-qt4
-    addToSearchPath PATH .bin
-    sed -i -e "s@LD=\$_cc@LD=\$_cxx@" configure
-  '';
 
   meta = with stdenv.lib; {
     description = "Autoclicker application, which enables you to automatically click the left mousebutton";
-    homepage = "http://xautoclick.sourceforge.net";
+    homepage = "https://github.com/qarkai/xautoclick";
     license = licenses.gpl2;
     platforms = platforms.linux;
   };

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/common.nix

@@ -22,7 +22,7 @@
 # optional dependencies
 , libgcrypt ? null # gnomeSupport || cupsSupport
 , libva ? null # useVaapi
-, libdrm ? null, wayland ? null, mesa_drivers ? null, libxkbcommon ? null # useOzone
+, libdrm ? null, wayland ? null, mesa ? null, libxkbcommon ? null # useOzone
 
 # package customization
 , useOzone ? false
@@ -146,7 +146,7 @@ let
       ++ optionals gnomeSupport [ gnome.GConf libgcrypt ]
       ++ optionals cupsSupport [ libgcrypt cups ]
       ++ optional pulseSupport libpulseaudio
-      ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];
+      ++ optionals useOzone [ libdrm wayland mesa.drivers libxkbcommon ];
 
     patches = [
       ./patches/no-build-timestamps.patch # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed)

third_party/nixpkgs/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix

@@ -403,7 +403,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.torproject.org/";
     changelog = "https://gitweb.torproject.org/builders/tor-browser-build.git/plain/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt?h=maint-${version}";
     platforms = attrNames srcs;
-    maintainers = with maintainers; [ offline matejc doublec thoughtpolice joachifm hax404 cap KarlJoad ];
+    maintainers = with maintainers; [ offline matejc thoughtpolice joachifm hax404 cap KarlJoad ];
     hydraPlatforms = [];
     # MPL2.0+, GPL+, &c.  While it's not entirely clear whether
     # the compound is "libre" in a strict sense (some components place certain

third_party/nixpkgs/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix

@@ -22,7 +22,7 @@
 # optional dependencies
 , libgcrypt ? null # gnomeSupport || cupsSupport
 , libva ? null # useVaapi
-, libdrm ? null, wayland ? null, mesa_drivers ? null, libxkbcommon ? null # useOzone
+, libdrm ? null, wayland ? null, mesa ? null, libxkbcommon ? null # useOzone
 
 # package customization
 , useOzone ? false
@@ -153,7 +153,7 @@ let
       ++ optionals gnomeSupport [ gnome.GConf libgcrypt ]
       ++ optionals cupsSupport [ libgcrypt cups ]
       ++ optional pulseSupport libpulseaudio
-      ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];
+      ++ optionals useOzone [ libdrm wayland mesa.drivers libxkbcommon ];
 
     patches = [
       ./patches/no-build-timestamps.patch # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed)

third_party/nixpkgs/pkgs/applications/networking/cluster/argocd/default.nix

@@ -2,24 +2,22 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "1.4.2";
+  version = "1.7.8";
-  commit = "48cced9d925b5bc94f6aa9fa4a8a19b2a59e128a";
+  commit = "ef5010c3a0b5e027fd642732d03c5b0391b1e574";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "01vsyrks1k5yfvrarv8ia0isr7snilr21b7lfiy860si82r2r8hj";
+    sha256 = "1pwk6mzmlsx43c75wl5lglpxgc2jkgzra4443hwp6n0wfgzajfp4";
   };
 
-  vendorSha256 = "0r2nh7v00m6zbdnhsgjn01q9pkiz41ckkqgfnpqmkxaqmjz31iyj";
+  vendorSha256 = "0c5gykijwjrq3cx9qg9hm5j7axccngc1kp5qj3429a2ilw80l8pl";
 
   doCheck = false;
 
   nativeBuildInputs = [ packr ];
 
-  patches = [ ./use-go-module.patch ];
-
   buildFlagsArray = ''
      -ldflags=
       -X github.com/argoproj/argo-cd/common.version=${version}

third_party/nixpkgs/pkgs/applications/networking/cluster/k3s/default.nix

@@ -222,6 +222,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "k3s";
+  version = k3sVersion;
 
   # Important utilities used by  the kubelet, see
   # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494

third_party/nixpkgs/pkgs/applications/networking/cluster/minikube/default.nix

@@ -11,7 +11,7 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.14.1";
+  version = "1.14.2";
 
   vendorSha256 = "057mlmja3mygfdf0cp0bcm0chq7s30bjcs5hqacwl6c79ivrjf89";
 
@@ -21,7 +21,7 @@ buildGoModule rec {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "000i30qsjx1h2x6b8vb5piq9lhjrz5hj9wza7gxsrzsf2z9rhryg";
+    sha256 = "1fidvfm9x3rbqfjn9zm5kx9smk94dmjm4gb98rrdmgsld5fg99xj";
   };
 
   nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];

third_party/nixpkgs/pkgs/applications/networking/cluster/nomad/0.11.nix

@@ -2,6 +2,6 @@
 
 callPackage ./generic.nix {
   inherit buildGoPackage;
-  version = "0.11.4";
+  version = "0.11.6";
-  sha256 = "1sykp9sji6f564s7bz0cvnr9w5x92n0l1r1djf1bl7jvv2mi1mcb";
+  sha256 = "09ym9fd4fp2461ddhrb5nlz8l24iq4hsbqikzc21ainagq2g1azf";
 }

third_party/nixpkgs/pkgs/applications/networking/cluster/nomad/0.12.nix

@@ -2,6 +2,6 @@
 
 callPackage ./generic.nix {
   inherit buildGoPackage;
-  version = "0.12.3";
+  version = "0.12.7";
-  sha256 = "100ynhc4nm4mmjxx1jhq2kjbqshxvi5x8y482520j8gsyn40g6zc";
+  sha256 = "0y1nwmpc4fqgjyb19n1f2w4y5k7fy4p68v2vnnry11nj3im7ia14";
 }

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix

@@ -7,7 +7,7 @@ let
 
   # Please keep the version x.y.0.z and do not update to x.y.76.z because the
   # source of the latter disappears much faster.
-  version = "8.65.0.78";
+  version = "8.66.0.74";
 
   rpath = stdenv.lib.makeLibraryPath [
     alsaLib
@@ -65,7 +65,7 @@ let
           "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
           "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
         ];
-        sha256 = "04qcpz3w2clpa23axh0xx68rm792d2l029r3wy1hfzbxd51z09lh";
+        sha256 = "11bpzr3j6fa5x62xrx2q2sr1wxjrn0a37053j4prxjcvdrc5in8f";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";

third_party/nixpkgs/pkgs/applications/networking/mailreaders/mutt/default.nix

@@ -27,11 +27,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "1.14.7";
+  version = "2.0.0";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "0r58xnjgkw0kmnnzhb32mk5gkkani5kbi5krybpbag156fqhgxg4";
+    sha256 = "1bxf8976mrl3vbn3s5i32i1lf908yag5rsf84n76dllmly61794k";
   };
 
   patches = optional smimeSupport (fetchpatch {

third_party/nixpkgs/pkgs/applications/networking/p2p/freenet/default.nix

@@ -74,7 +74,7 @@ in stdenv.mkDerivation {
     description = "Decentralised and censorship-resistant network";
     homepage = "https://freenetproject.org/";
     license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = [ stdenv.lib.maintainers.doublec ];
+    maintainers = [ ];
     platforms = with stdenv.lib.platforms; linux;
   };
 }

third_party/nixpkgs/pkgs/applications/networking/p2p/qbittorrent/default.nix

@@ -10,13 +10,13 @@ with lib;
 
 mkDerivation rec {
   pname = "qbittorrent";
-  version = "4.2.5";
+  version = "4.3.0.1";
 
   src = fetchFromGitHub {
     owner = "qbittorrent";
     repo = "qbittorrent";
     rev = "release-${version}";
-    sha256 = "1n613ylg6i9gisgk0dbr2kpfasyizrkdjff1r8smd4vri2qrdksn";
+    sha256 = "068sf24mjvc2idimgpzvf7gjk8n9xrr3qqlqfx5j3j598ckm3yfp";
   };
 
   # NOTE: 2018-05-31: CMake is working but it is not officially supported

third_party/nixpkgs/pkgs/applications/networking/sniffers/wireshark/default.nix

@@ -10,7 +10,7 @@ assert withQt  -> qt5  != null;
 with stdenv.lib;
 
 let
-  version = "3.2.7";
+  version = "3.4.0";
   variant = if withQt then "qt" else "cli";
   pcap = libpcap.override { withBluez = stdenv.isLinux; };
 
@@ -21,7 +21,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz";
-    sha256 = "1nkhglzxj05hwhgzrgan4glv0z67rmasf9djx1dmqicwdnw2z0xy";
+    sha256 = "1bm8jj2rviis9j9l6nixvhxcfx362y9iphkxssgmiz2kj6yypr37";
   };
 
   cmakeFlags = [

third_party/nixpkgs/pkgs/applications/office/libreoffice/default.nix

@@ -6,11 +6,11 @@
 , openssl, gperf, cppunit, poppler, utillinux
 , librsvg, libGLU, libGL, bsh, CoinMP, libwps, libabw, libmysqlclient
 , autoconf, automake, openldap, bash, hunspell, librdf_redland, nss, nspr
-, libwpg, dbus-glib, clucene_core, libcdr, lcms, vigra
+, libwpg, dbus-glib, clucene_core, libcdr, lcms
 , unixODBC, mdds, sane-backends, mythes, libexttextcat, libvisio
 , fontsConf, pkgconfig, bluez5, libtool, carlito
 , libatomic_ops, graphite2, harfbuzz, libodfgen, libzmf
-, librevenge, libe-book, libmwaw, glm, glew, gst_all_1
+, librevenge, libe-book, libmwaw, glm, gst_all_1
 , gdb, commonsLogging, librdf_rasqal, wrapGAppsHook
 , gnome3, glib, ncurses, epoxy, gpgme
 , langs ? [ "ca" "cs" "da" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sl" "zh-CN" ]
@@ -394,10 +394,10 @@ in (mkDrv rec {
       libXdmcp libpthreadstubs libGLU libGL mythes
       glib libmysqlclient
       neon nspr nss openldap openssl pam perl pkgconfig poppler
-      python3 sane-backends unzip vigra which zip zlib
+      python3 sane-backends unzip which zip zlib
       mdds bluez5 libcmis libwps libabw libzmf
       libxshmfence libatomic_ops graphite2 harfbuzz gpgme utillinux
-      librevenge libe-book libmwaw glm glew ncurses epoxy
+      librevenge libe-book libmwaw glm ncurses epoxy
       libodfgen CoinMP librdf_rasqal gnome3.adwaita-icon-theme gettext
     ]
     ++ (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good ])

third_party/nixpkgs/pkgs/applications/office/libreoffice/generate-libreoffice-srcs.py

@@ -53,10 +53,10 @@ def main():
 
 def construct_url(x):
     if x['brief']:
-        return 'http://dev-www.libreoffice.org/src/{}{}'.format(
+        return 'https://dev-www.libreoffice.org/src/{}{}'.format(
             x.get('subdir', ''), x['tarball'])
     else:
-        return 'http://dev-www.libreoffice.org/src/{}{}-{}'.format(
+        return 'https://dev-www.libreoffice.org/src/{}{}-{}'.format(
             x.get('subdir', ''), x['md5'], x['tarball'])
 
 

third_party/nixpkgs/pkgs/applications/office/libreoffice/src-fresh/primary.nix

@@ -8,8 +8,8 @@ rec {
 
   major = "7";
   minor = "0";
-  patch = "0";
+  patch = "3";
-  tweak = "3";
+  tweak = "1";
 
   subdir = "${major}.${minor}.${patch}";
 
@@ -17,13 +17,13 @@ rec {
 
   src = fetchurl {
     url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "sha256-sl+vgnLGIWtyw8Y/ovVsxThdOMg2Gby4SRaiaqvZVB0=";
+    sha256 = "0b998k2dxbbj7hn3srn07fgsah236h14ncyyahamdff6h3hvqrk5";
   };
 
   # FIXME rename
   translations = fetchSrc {
     name = "translations";
-    sha256 = "sha256-i3yfD5cmM6D9BctjablIFRqfibjrwLAaxxPIsQdk0sY=";
+    sha256 = "0s3ic79q0c16hbd6r06mwkyqhw4fdfy9z3xbqvdxp7jl64cjlaj4";
   };
 
   # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
@@ -31,6 +31,6 @@ rec {
 
   help = fetchSrc {
     name = "help";
-    sha256 = "sha256-hYBEEPRmh16zgGZBUN20xfTY6qL07aKMC1lC/0ij9/0=";
+    sha256 = "14wjkcdmcflfcc7264jx64s6clk5rdsprx7nkbv08z0bp6ff677b";
   };
 }

third_party/nixpkgs/pkgs/applications/science/astronomy/kstars/default.nix

@@ -1,27 +1,30 @@
 {
-  mkDerivation, lib, fetchgit,
+  stdenv, extra-cmake-modules, fetchurl,
-  extra-cmake-modules,
 
   kconfig, kdoctools, kguiaddons, ki18n, kinit, kiconthemes, kio,
-  knewstuff, kplotting, kwidgetsaddons, kxmlgui,
+  knewstuff, kplotting, kwidgetsaddons, kxmlgui, wrapQtAppsHook,
 
   qtx11extras, qtwebsockets,
 
   eigen, zlib,
 
-  cfitsio, indilib, xplanet
+  cfitsio, indilib, xplanet, libnova, gsl
 }:
 
-mkDerivation {
+stdenv.mkDerivation rec {
-  name = "kstars";
+  pname = "kstars";
-  
+  version = "3.4.3";
-  src = fetchgit {
+
-    url = "https://anongit.kde.org/kstars.git";
+  src = fetchurl {
-    rev = "7acc527939280edd22823371dc4e22494c6c626a";
+    url = "https://mirrors.mit.edu/kde/stable/kstars/kstars-${version}.tar.xz";
-    sha256 = "1n1lgi7p3dj893fdnzjbnrha40p4apl0dy8zppcabxwrb1khb84v";
+    sha256 = "0j5yxg6ay6sic194skz6vjzg6yvrpb3gvypvs0frjrcjbsl1j4f8";
   };
-  
+
-  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
+  patches = [
+    ./indi-fix.patch
+  ];
+
+  nativeBuildInputs = [ extra-cmake-modules kdoctools wrapQtAppsHook ];
   buildInputs = [
     kconfig kdoctools kguiaddons ki18n kinit kiconthemes kio
     knewstuff kplotting kwidgetsaddons kxmlgui
@@ -30,10 +33,14 @@ mkDerivation {
 
     eigen zlib
 
-    cfitsio indilib xplanet
+    cfitsio indilib xplanet libnova gsl
   ];
 
-  meta = with lib; {
+  cmakeFlags = [
+    "-DINDI_NIX_ROOT=${indilib}"
+  ];
+
+  meta = with stdenv.lib; {
     description = "Virtual planetarium astronomy software";
     homepage = "https://kde.org/applications/education/org.kde.kstars";
     longDescription = ''

third_party/nixpkgs/pkgs/applications/science/astronomy/kstars/indi-fix.patch

@@ -0,0 +1,50 @@
+--- CMakeLists.txt	2020-11-02 13:58:06.119743710 -0600
++++ kstars-3.4.3/CMakeLists.txt	2020-11-02 14:05:01.707799274 -0600
+@@ -4,5 +4,7 @@
+ set (KStars_VERSION_REVISION 3)
+ set (CMAKE_CXX_STANDARD 11)
+ 
++add_definitions(-DINDI_NIX_ROOT=${INDI_NIX_ROOT})
++
+ # Build KStars Lite with -DBUILD_KSTARS_LITE=ON
+ option(BUILD_KSTARS_LITE "Build KStars Lite" OFF)
+
+--- ksutils.cpp	2020-11-02 13:47:44.883596916 -0600
++++ kstars-3.4.3/kstars/auxiliary/ksutils.cpp	2020-11-02 17:41:44.961937090 -0600
+@@ -1076,6 +1076,9 @@
+ {
+     QString snap = QProcessEnvironment::systemEnvironment().value("SNAP");
+     QString flat = QProcessEnvironment::systemEnvironment().value("FLATPAK_DEST");
++#define STR_EXPAND(x) #x
++#define STR(x) STR_EXPAND(x)
++    QString nix = QString(STR(INDI_NIX_ROOT));
+ 
+     if (option == "fitsDir")
+     {
+@@ -1089,7 +1091,7 @@
+         if (flat.isEmpty() == false)
+             return flat + "/bin/indiserver";
+         else
+-            return snap + "/usr/bin/indiserver";
++            return nix + "/bin/indiserver";
+     }
+     else if (option == "INDIHubAgent")
+     {
+@@ -1099,7 +1101,7 @@
+         if (flat.isEmpty() == false)
+             return flat + "/bin/indihub-agent";
+         else
+-            return snap + "/usr/bin/indihub-agent";
++            return nix + "/bin/indihub-agent";
+     }
+     else if (option == "indiDriversDir")
+     {
+@@ -1109,7 +1111,7 @@
+         if (flat.isEmpty() == false)
+             return flat + "/share/indi";
+         else
+-            return snap + "/usr/share/indi";
++            return nix + "/share/indi";
+ #else
+         return QStandardPaths::locate(QStandardPaths::GenericDataLocation, "indi", QStandardPaths::LocateDirectory);
+ #endif

third_party/nixpkgs/pkgs/applications/science/electronics/librepcb/default.nix

@@ -1,15 +1,15 @@
 { lib, mkDerivation, fetchFromGitHub, qtbase, qttools, qmake, wrapQtAppsHook }:
 
-mkDerivation {
+mkDerivation rec {
   pname = "librepcb";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "LibrePCB";
     repo = "LibrePCB";
     fetchSubmodules = true;
-    rev = "ae04eef5a71b5ba66ae2cee6b631c1c933ace535";
+    rev = version;
-    sha256 = "0wk5qny1jb6n4mwyyrs7syir3hmwxlwazcd80bpxharmsj7p0rzc";
+    sha256 = "0ag8h3id2c1k9ds22rfrvyhf2vjhkv82xnrdrz4n1hnlr9566vcx";
   };
 
   enableParallelBuilding = true;

third_party/nixpkgs/pkgs/applications/science/math/maxima/default.nix

@@ -1,10 +1,10 @@
-{ stdenv, fetchurl, fetchpatch, sbcl, texinfo, perl, python, makeWrapper, rlwrap ? null
+{ stdenv, fetchurl, fetchpatch, sbcl, texinfo, perl, python, makeWrapper, autoreconfHook
-, tk ? null, gnuplot ? null, ecl ? null, ecl-fasl ? false
+, rlwrap ? null, tk ? null, gnuplot ? null, ecl ? null, ecl-fasl ? false
 }:
 
 let
   name    = "maxima";
-  version = "5.42.2";
+  version = "5.44.0";
 
   searchPath =
     stdenv.lib.makeBinPath
@@ -16,14 +16,20 @@ stdenv.mkDerivation ({
 
   src = fetchurl {
     url = "mirror://sourceforge/${name}/${name}-${version}.tar.gz";
-    sha256 = "0kdncy6137sg3rradirxzj10mkcvafxd892zlclwhr9sa7b12zhn";
+    sha256 = "1v6jr5s6hhj6r18gfk6hgxk2qd6z1dxkrjq9ss2z1y6sqi45wgyr";
   };
 
+  nativeBuildInputs = [ autoreconfHook ];
+
   buildInputs = stdenv.lib.filter (x: x != null) [
     sbcl ecl texinfo perl python makeWrapper
     gnuplot   # required in the test suite
   ];
 
+  postPatch = ''
+    substituteInPlace doc/info/Makefile.am --replace "/usr/bin/env perl" "${perl}/bin/perl"
+  '';
+
   postInstall = ''
     # Make sure that maxima can find its runtime dependencies.
     for prog in "$out/bin/"*; do
@@ -57,13 +63,6 @@ stdenv.mkDerivation ({
       url = "https://git.sagemath.org/sage.git/plain/build/pkgs/maxima/patches/undoing_true_false_printing_patch.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
       sha256 = "0fvi3rcjv6743sqsbgdzazy9jb6r1p1yq63zyj9fx42wd1hgf7yx";
     })
-
-    # upstream bug https://sourceforge.net/p/maxima/bugs/2520/ (not fixed)
-    # introduced in https://trac.sagemath.org/ticket/13364
-    (fetchpatch {
-      url = "https://git.sagemath.org/sage.git/plain/build/pkgs/maxima/patches/0001-taylor2-Avoid-blowing-the-stack-when-diff-expand-isn.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
-      sha256 = "0xa0b6cr458zp7lc7qi0flv5ar0r3ivsqhjl0c3clv86di2y522d";
-    })
   ] ++ stdenv.lib.optionals ecl-fasl [
     # build fasl, needed for ECL support
     (fetchpatch {
@@ -74,11 +73,13 @@ stdenv.mkDerivation ({
 
   # The test suite is disabled since 5.42.2 because of the following issues:
   #
-  #   Errors found in /build/maxima-5.42.2/share/linearalgebra/rtest_matrixexp.mac, problems:
+  #   Error(s) found:
+  #   /build/maxima-5.44.0/share/linearalgebra/rtest_matrixexp.mac problems:
   #   (20 21 22)
-  #   Error found in rtest_arag, problem:
+  #   Tests that were expected to fail but passed:
-  #   (error break)
+  #   /build/maxima-5.44.0/share/vector/rtest_vect.mac problem:
-  #   3 tests failed out of 3,881 total tests.
+  #   (19)
+  #   3 tests failed out of 16,184 total tests.
   #
   # These failures don't look serious. It would be nice to fix them, but I
   # don't know how and probably won't have the time to find out.

third_party/nixpkgs/pkgs/applications/science/misc/convertall/default.nix

@@ -0,0 +1,37 @@
+{ stdenv, fetchFromGitHub, python3, wrapQtAppsHook }:
+
+let
+  inherit (python3.pkgs) wrapPython pyqt5;
+in stdenv.mkDerivation rec {
+  pname = "convertall";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "doug-101";
+    repo = "ConvertAll";
+    rev = "v${version}";
+    sha256 = "02xxasgbjbivsbhyfpn3cpv52lscdx5kc95s6ns1dvnmdg0fpng0";
+  };
+
+  nativeBuildInputs = [ python3 wrapPython wrapQtAppsHook ];
+
+  propagatedBuildInputs = [ pyqt5 ];
+
+  installPhase = ''
+    python3 install.py -p $out -x
+  '';
+
+  postFixup = ''
+    buildPythonPath $out
+    patchPythonScript $out/share/convertall/convertall.py
+    makeQtWrapper $out/share/convertall/convertall.py $out/bin/convertall
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://convertall.bellz.org/";
+    description = "Graphical unit converter";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ orivej ];
+    platforms = pyqt5.meta.platforms;
+  };
+}

third_party/nixpkgs/pkgs/applications/science/molecular-dynamics/gromacs/default.nix

@@ -9,11 +9,11 @@
 }:
 
 stdenv.mkDerivation {
-  name = "gromacs-2020.3";
+  name = "gromacs-2020.4";
 
   src = fetchurl {
-    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-2020.3.tar.gz";
+    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-2020.4.tar.gz";
-    sha256 = "1acjrhcfzpqy2dncblhj97602jbg9gdha4q1bgji9nrj25lq6cch";
+    sha256 = "1rplvgna60nqyb8nspaz3bfkwb044kv3zxdaa5whql5m441nj6am";
   };
 
   nativeBuildInputs = [ cmake ];

third_party/nixpkgs/pkgs/applications/science/physics/xflr5/default.nix

@@ -20,4 +20,4 @@ stdenv.mkDerivation rec {
     maintainers = [ maintainers.esclear ];
     platforms = platforms.linux;
   };
-}
+}

third_party/nixpkgs/pkgs/applications/terminal-emulators/mlterm/default.nix

@@ -1,10 +1,11 @@
-{ stdenv, fetchurl, pkgconfig, autoconf, makeDesktopItem
+{ stdenv, lib, fetchurl, pkgconfig, autoconf, makeDesktopItem
 , libX11, gdk-pixbuf, cairo, libXft, gtk3, vte
 , harfbuzz #substituting glyphs with opentype fonts
 , fribidi, m17n_lib #bidi and encoding
 , openssl, libssh2 #build-in ssh
 , fcitx, ibus, uim #IME
 , wrapGAppsHook #color picker in mlconfig
+, Cocoa #Darwin
 }:
 
 stdenv.mkDerivation rec {
@@ -18,9 +19,25 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkgconfig autoconf wrapGAppsHook ];
   buildInputs = [
-    libX11 gdk-pixbuf.dev cairo libXft gtk3 vte
+    libX11
-    harfbuzz fribidi m17n_lib openssl libssh2
+    gdk-pixbuf.dev
-    fcitx ibus uim
+    cairo
+    libXft
+    gtk3
+    harfbuzz
+    fribidi
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    # need linker magic, not adapted for Darwin yet
+    openssl
+    libssh2
+
+    # Not supported on Darwin
+    vte
+    m17n_lib
+
+    fcitx
+    ibus
+    uim
   ];
 
   #bad configure.ac and Makefile.in everywhere
@@ -42,34 +59,41 @@ stdenv.mkDerivation rec {
       --replace "-m 2755 -g utmp" " " \
       --replace "-m 4755 -o root" " "
   '';
-  NIX_LDFLAGS = "
+  NIX_LDFLAGS = lib.optionalString (!stdenv.isDarwin) "
     -L${stdenv.cc.cc.lib}/lib
     -lX11 -lgdk_pixbuf-2.0 -lcairo -lfontconfig -lfreetype -lXft
     -lvte-2.91 -lgtk-3 -lharfbuzz -lfribidi -lm17n
-  " + stdenv.lib.optionalString (openssl != null) "
+  " + lib.optionalString (openssl != null) "
     -lcrypto
-  " + stdenv.lib.optionalString (libssh2 != null) "
+  " + lib.optionalString (libssh2 != null) "
     -lssh2
   ";
 
   configureFlags = [
-    "--with-x=yes"
-    "--with-gui=xlib,fb"
     "--with-imagelib=gdk-pixbuf" #or mlimgloader depending on your bugs of choice
     "--with-type-engines=cairo,xft,xcore"
     "--with-gtk=3.0"
     "--enable-ind" #indic scripts
     "--enable-fribidi" #bidi scripts
-    "--enable-m17nlib" #character encodings
     "--with-tools=mlclient,mlconfig,mlcc,mlterm-menu,mlimgloader,registobmp,mlfc"
      #mlterm-menu and mlconfig depend on enabling gnome3.at-spi2-core
      #and configuring ~/.mlterm/key correctly.
- ] ++ stdenv.lib.optional (libssh2 == null) "--disable-ssh2";
+ ] ++ lib.optionals (!stdenv.isDarwin) [
+   "--with-x=yes"
+   "--with-gui=xlib,fb"
+    "--enable-m17nlib" #character encodings
+ ] ++ lib.optionals stdenv.isDarwin [
+    "--with-gui=quartz"
+ ] ++ lib.optionals (libssh2 == null) [ " --disable-ssh2" ];
 
   postInstall = ''
     install -D contrib/icon/mlterm-icon.svg "$out/share/icons/hicolor/scalable/apps/mlterm.svg"
     install -D contrib/icon/mlterm-icon-gnome2.png "$out/share/icons/hicolor/48x48/apps/mlterm.png"
     install -D -t $out/share/applications $desktopItem/share/applications/*
+  '' + lib.optionalString stdenv.isDarwin ''
+    mkdir -p $out/Applications/
+    cp -a cocoa/mlterm.app $out/Applications/
+    install $out/bin/mlterm -Dt $out/Applications/mlterm.app/Contents/MacOS/
   '';
 
   desktopItem = makeDesktopItem {
@@ -80,17 +104,17 @@ stdenv.mkDerivation rec {
     comment = "Terminal emulator";
     desktopName = "mlterm";
     genericName = "Terminal emulator";
-    categories = stdenv.lib.concatStringsSep ";" [
+    categories = lib.concatStringsSep ";" [
       "Application" "System" "TerminalEmulator"
     ];
     startupNotify = "false";
   };
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
-    description = "Multi Lingual TERMinal emulator on X11";
+    description = "Multi Lingual TERMinal emulator";
     homepage = "http://mlterm.sourceforge.net/";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ vrthra ramkromberg ];
+    maintainers = with maintainers; [ vrthra ramkromberg atemu ];
-    platforms = with platforms; linux;
+    platforms = with platforms; linux ++ darwin;
   };
 }

third_party/nixpkgs/pkgs/applications/video/kodi/default.nix

@@ -45,14 +45,14 @@ assert useWayland -> wayland != null && wayland-protocols != null && waylandpp !
 
 let
   kodiReleaseDate = "20200728";
-  kodiVersion = "18.8";
+  kodiVersion = "18.9";
   rel = "Leia";
 
   kodi_src = fetchFromGitHub {
     owner  = "xbmc";
     repo   = "xbmc";
     rev    = "${kodiVersion}-${rel}";
-    sha256 = "0qpkpz43s207msvv3qkiy6vzqwcgmydxv3py7vc29mv6h30chrva";
+    sha256 = "0nnf7823pixj6n2fkjc8rbdjwayvhlbglij2by4rnjzzfgmqmw20";
   };
 
   cmakeProto = fetchurl {

third_party/nixpkgs/pkgs/applications/virtualization/looking-glass-client/default.nix

@@ -1,36 +1,30 @@
-{ stdenv, fetchFromGitHub, fetchpatch
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, SDL2, SDL2_ttf, spice-protocol
-, cmake, pkgconfig, SDL2, SDL, SDL2_ttf, openssl, spice-protocol, fontconfig
+, fontconfig, libX11, freefont_ttf, nettle, libpthreadstubs, libXau, libXdmcp
-, libX11, freefont_ttf, nettle, libconfig, wayland, libpthreadstubs, libXdmcp
+, libXi, libXext, wayland, libffi, libGLU, expat, libbfd
-, libXfixes, libbfd
 }:
 
 stdenv.mkDerivation rec {
   pname = "looking-glass-client";
-  version = "B1";
+  version = "B2";
 
   src = fetchFromGitHub {
     owner = "gnif";
     repo = "LookingGlass";
     rev = version;
-    sha256 = "0vykv7yjz4fima9d82m83acd8ab72nq4wyzyfs1c499i27wz91ia";
+    sha256 = "100b5kzh8gr81kzw5fdqz2jsms25hv3815d31vy3qd6lrlm5gs3d";
+    fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ cmake pkgconfig ];
 
   buildInputs = [
-    SDL SDL2 SDL2_ttf openssl spice-protocol fontconfig
+    SDL2 SDL2_ttf spice-protocol fontconfig libX11 freefont_ttf nettle
-    libX11 freefont_ttf nettle libconfig wayland libpthreadstubs
+    libpthreadstubs libXau libXdmcp libXi libXext wayland libffi libGLU expat
-    libXdmcp libXfixes libbfd cmake
+    libbfd
   ];
 
-  enableParallelBuilding = true;
-
   sourceRoot = "source/client";
-
+  NIX_CFLAGS_COMPILE = "-mavx"; # Fix some sort of AVX compiler problem.
-  installPhase = ''
-    mkdir -p $out/bin
-    mv looking-glass-client $out/bin
-  '';
 
   meta = with stdenv.lib; {
     description = "A KVM Frame Relay (KVMFR) implementation";
@@ -41,9 +35,9 @@ stdenv.mkDerivation rec {
       step required to move away from dual booting with other operating systems
       for legacy programs that require high performance graphics.
     '';
-    homepage = "https://looking-glass.hostfission.com/";
+    homepage = "https://looking-glass.io/";
     license = licenses.gpl2Plus;
-    maintainers = [ maintainers.alexbakker ];
+    maintainers = with maintainers; [ alexbakker ];
     platforms = [ "x86_64-linux" ];
   };
 }

third_party/nixpkgs/pkgs/applications/window-managers/picom/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "picom";
-  version = "8.1";
+  version = "8.2";
 
   src = fetchFromGitHub {
     owner  = "yshui";
     repo   = "picom";
     rev    = "v${version}";
-    sha256 = "0iwixf3gaichmpvhczxdg5srkb72yh61i5wh7m3fab657h3r7di6";
+    sha256 = "0gjksayz2xpmgglvw17ppsan2imrd1fijs579kbf27xwp503xgfl";
     fetchSubmodules = true;
   };
 

third_party/nixpkgs/pkgs/applications/window-managers/sway/default.nix

@@ -22,7 +22,9 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    substituteInPlace meson.build --replace "v1.5" "1.5"
+    substituteInPlace meson.build \
+      --replace "v1.5" "1.5" \
+      --replace "wlroots_version = ['>=0.11.0', '<0.12.0']" "wlroots_version = ['>=0.11.0', '<0.13.0']"
   '';
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/window-managers/sway/lock-effects.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "swaylock-effects";
-  version = "v1.6-1";
+  version = "v1.6-2";
 
   src = fetchFromGitHub {
     owner = "mortie";
     repo = "swaylock-effects";
     rev = version;
-    sha256 = "044fc4makjx8v29fkx5xlil6vr1v4r0k6c8741pl67gzvlm4cx3i";
+    sha256 = "0fs3c4liajgkax0a2pdc7117v1g9k73nv87g3kyv9wsnkfbbz534";
   };
 
   postPatch = ''

third_party/nixpkgs/pkgs/applications/window-managers/windowlab/default.nix

@@ -33,4 +33,4 @@ stdenv.mkDerivation {
       maintainers = with maintainers; [ ehmry ];
       platforms   = platforms.linux;
     };
-}
+}

third_party/nixpkgs/pkgs/build-support/docker/detjson.py

@@ -37,4 +37,4 @@ def main():
     json.dump(j, sys.stdout, sort_keys=True)
 
 if __name__ == '__main__':
-    main()
+    main()

third_party/nixpkgs/pkgs/build-support/fetchsvnrevision/default.nix

@@ -7,4 +7,4 @@ runCommand: subversion: repository:
       rev=$(echo p | svn ls -v --depth empty  ${repository} |awk '{ print $1 }')
       echo "[ \"$rev\" ]" > $out
       echo Latest revision is $rev
-    '')
+    '')

third_party/nixpkgs/pkgs/desktops/cdesktopenv/0001-all-remove-deprecated-sys_errlist-and-replace-with-A.patch

@@ -0,0 +1,336 @@
+From 67f62e5a8acd70d30f7067f1f44ac7b15c67011a Mon Sep 17 00:00:00 2001
+From: Peter Howkins <flibble@users.sf.net>
+Date: Mon, 2 Nov 2020 05:30:08 +0000
+Subject: [PATCH] all: remove deprecated sys_errlist[] and replace with ANSI C
+ strerror()
+
+---
+ cde/config/imake/imake.c                            | 13 -------------
+ cde/lib/tt/bin/dbck/spec.C                          |  8 --------
+ cde/lib/tt/lib/tt_options.h                         | 12 ------------
+ cde/programs/dtcm/dtcm/dnd.c                        |  4 ----
+ cde/programs/dtcm/libDtCmP/util.c                   |  5 +----
+ .../dthelp/parser.ccdf/volumegen/Volumegen.c        |  1 -
+ cde/programs/dtimsstart/remote.c                    |  4 ----
+ cde/programs/dtimsstart/start.c                     | 12 +++---------
+ cde/programs/dtinfo/dtinfo/src/external-api/comm.c  |  5 +----
+ .../dtksh/ksh93/src/lib/libast/string/fmterror.c    |  9 +--------
+ .../dtksh/ksh93/src/lib/libast/string/strerror.c    |  8 +-------
+ cde/programs/dtlogin/dm.h                           |  7 +------
+ 12 files changed, 8 insertions(+), 80 deletions(-)
+
+diff --git a/cde/config/imake/imake.c b/cde/config/imake/imake.c
+index 574af7c7..83834aa7 100644
+--- a/cde/config/imake/imake.c
++++ b/config/imake/imake.c
+@@ -242,19 +242,6 @@ extern int	errno;
+ #include <stdarg.h>
+ #include "imakemdep.h"
+ 
+-/*
+- * This define of strerror is copied from (and should be identical to)
+- * Xos.h, which we don't want to include here for bootstrapping reasons.
+- */
+-#if defined(X_NOT_STDC_ENV) || (defined(sun) && !defined(SVR4))
+-# ifndef strerror
+-extern char *sys_errlist[];
+-extern int sys_nerr;
+-#  define strerror(n) \
+-    (((n) >= 0 && (n) < sys_nerr) ? sys_errlist[n] : "unknown error")
+-# endif
+-#endif
+-
+ #define	TRUE		1
+ #define	FALSE		0
+ 
+diff --git a/cde/lib/tt/bin/dbck/spec.C b/cde/lib/tt/bin/dbck/spec.C
+index 18bba3fb..eaf2d6b7 100644
+--- a/cde/lib/tt/bin/dbck/spec.C
++++ b/lib/tt/bin/dbck/spec.C
+@@ -44,14 +44,6 @@
+ #include "ttdbck.h"
+ #include "tt_db_server_consts.h"
+ 
+-#if !defined(OPT_STRERROR)
+-// No strerror(), fake it
+-char *
+-strerror(int e)
+-{
+-	return ((e<sys_nerr) ? sys_errlist[e] : "unknown");
+-}
+-#endif
+ 
+ Spec::
+ Spec()     
+diff --git a/cde/lib/tt/lib/tt_options.h b/cde/lib/tt/lib/tt_options.h
+index e23bb9e5..de3a30e2 100644
+--- a/cde/lib/tt/lib/tt_options.h
++++ b/lib/tt/lib/tt_options.h
+@@ -107,10 +107,6 @@
+  * OPT_CPP_OPTIONS - string, options to pass to cpp. For example, on
+  *   some platforms -B is used so C++ comments are processed by cpp.
+  *
+- *
+- * OPT_STRERROR - set if strerror() is available, otherwise we assume
+- *   global symbol sys_errlist is defined in errno.h.
+- *
+  * OPT_SVR4_GETMNTENT - set to use new SVR4 flavor of getmntent.
+  *
+  * OPT_LOCKF_MNTTAB - set to hold a lockf lock on MNTTAB while doing
+@@ -242,7 +238,6 @@
+ # undef  OPT_SYSINFO
+ # define OPT_CPP_PATH		"/usr/ccs/lib/cpp"
+ # define OPT_CPP_OPTIONS	""
+-# define OPT_STRERROR
+ # undef  OPT_SVR4_GETMNTENT
+ # undef  OPT_LOCKF_MNTENT
+ # define OPT_DEFINE_SIG_PF
+@@ -273,7 +268,6 @@
+ # undef  OPT_SYSINFO
+ # define OPT_CPP_PATH		"/usr/lib/cpp"
+ # define OPT_CPP_OPTIONS	 "-B"
+-# undef  OPT_STRERROR
+ # undef  OPT_SVR4_GETMNTENT
+ # undef  OPT_LOCKF_MNTENT
+ # define OPT_LOCAL_MOUNT_TYPE	MNTTYPE_42
+@@ -302,7 +296,6 @@
+ # define OPT_CATGETS
+ # undef  OPT_GETDTABLESIZE
+ # define OPT_SYSINFO
+-# define OPT_STRERROR
+ # define OPT_CPP_PATH		"/usr/ccs/lib/cpp"
+ # define OPT_CPP_OPTIONS	"-B"
+ # define OPT_SVR4_GETMNTENT
+@@ -389,7 +382,6 @@
+ #  define OPT_CPP_PATH		"/opt/langtools/lbin/cpp"
+ # endif
+ # define OPT_CPP_OPTIONS	""
+-# define OPT_STRERROR
+ # undef  OPT_SVR4_GETMNTENT
+ # undef  OPT_LOCKF_MNTENT
+ # define OPT_LOCAL_MOUNT_TYPE	MNTTYPE_HFS
+@@ -415,7 +407,6 @@
+ # undef  OPT_SYSINFO
+ # define OPT_CPP_PATH		"/usr/bin/cpp"
+ # define OPT_CPP_OPTIONS	 ""
+-# define OPT_STRERROR
+ # undef  OPT_SVR4_GETMNTENT
+ # undef  OPT_LOCKF_MNTENT
+ # define OPT_LOCAL_MOUNT_TYPE	"ext2fs"
+@@ -446,7 +437,6 @@
+ # undef  OPT_SYSINFO
+ # define OPT_CPP_PATH		"/usr/libexec/cpp"
+ # define OPT_CPP_OPTIONS	""
+-# define OPT_STRERROR
+ # undef  OPT_SVR4_GETMNTENT
+ # undef  OPT_LOCKF_MNTENT
+ # define OPT_LOCAL_MOUNT_TYPE	MNTTYPE_UFS
+@@ -479,7 +469,6 @@
+ #  define OPT_CPP_PATH		"/usr/libexec/cpp"
+ # endif
+ # define OPT_CPP_OPTIONS	""
+-# define OPT_STRERROR
+ # undef  OPT_SVR4_GETMNTENT
+ # undef  OPT_LOCKF_MNTENT
+ # define OPT_LOCAL_MOUNT_TYPE	MNTTYPE_UFS
+@@ -509,7 +498,6 @@
+ # undef  OPT_SYSINFO
+ # define OPT_CPP_PATH		"/usr/bin/cpp"
+ # define OPT_CPP_OPTIONS	""
+-# define OPT_STRERROR
+ # undef  OPT_SVR4_GETMNTENT
+ # undef  OPT_LOCKF_MNTENT
+ # define OPT_LOCAL_MOUNT_TYPE	MNTTYPE_UFS
+diff --git a/cde/programs/dtcm/dtcm/dnd.c b/cde/programs/dtcm/dtcm/dnd.c
+index abc58c12..f37f19a6 100644
+--- a/cde/programs/dtcm/dtcm/dnd.c
++++ b/programs/dtcm/dtcm/dnd.c
+@@ -72,10 +72,6 @@
+ 
+ static Bool lookForButton(Display *, XEvent *, XPointer);
+ 
+-#if !defined(__linux__) && !defined(CSRG_BASED)
+-extern char	*sys_errlist[];
+-#endif
+-
+ extern int	drag_load_proc(char*, Calendar *);
+ static char	dnd_filename[20];
+ 
+diff --git a/cde/programs/dtcm/libDtCmP/util.c b/cde/programs/dtcm/libDtCmP/util.c
+index d33b8ba1..6de4739d 100644
+--- a/cde/programs/dtcm/libDtCmP/util.c
++++ b/programs/dtcm/libDtCmP/util.c
+@@ -306,10 +306,7 @@ syserr(char *msg, int a1, int a2, int a3)
+ #if 0
+ 	/* print the error, if any */
+ 	if (saveerr != 0) {
+-		if (saveerr < 0 || saveerr > sys_nerr) 
+-			(void) fprintf(stderr, ":Unknown error %d", saveerr);
+-		else 
+-			(void) fprintf(stderr, ":%s", sys_errlist[saveerr]);
++			(void) fprintf(stderr, ":%s", strerror(saveerr));
+ 	}
+ #endif
+ 
+diff --git a/cde/programs/dthelp/parser.ccdf/volumegen/Volumegen.c b/cde/programs/dthelp/parser.ccdf/volumegen/Volumegen.c
+index d9a42943..08de4809 100644
+--- a/cde/programs/dthelp/parser.ccdf/volumegen/Volumegen.c
++++ b/programs/dthelp/parser.ccdf/volumegen/Volumegen.c
+@@ -56,7 +56,6 @@
+ typedef int Boolean;
+ 
+ /* extern int errno; */
+-/* extern char *sys_errlist[]; */
+ /* extern int sys_nerr; */
+ 
+ static void GenTopicList (
+diff --git a/cde/programs/dtimsstart/remote.c b/cde/programs/dtimsstart/remote.c
+index 68773673..71d32977 100644
+--- a/cde/programs/dtimsstart/remote.c
++++ b/programs/dtimsstart/remote.c
+@@ -37,10 +37,6 @@
+ #include	<X11/Xproto.h>		/* for X_ChangeHosts */
+ #include	<X11/Xatom.h>		/* for XA_STRING */
+ 
+-#if !defined(__linux__) && !defined(CSRG_BASED)
+-extern char	*sys_errlist[];
+-#endif
+-
+ static char	*conf_msg_id = STR_CONFDATA;
+ 
+ #define	CONF_MSG_ID_LEN		strlen(conf_msg_id)
+diff --git a/cde/programs/dtimsstart/start.c b/cde/programs/dtimsstart/start.c
+index 78fc2a38..1dafa189 100644
+--- a/cde/programs/dtimsstart/start.c
++++ b/programs/dtimsstart/start.c
+@@ -27,14 +27,10 @@
+ #include	<sys/wait.h>
+ #include	<setjmp.h>
+ #include	<unistd.h>
++#include    <errno.h>
+ 
+ #if (defined(__linux__) || defined(CSRG_BASED)) && !defined(_NFILE)
+ #define _NFILE FOPEN_MAX
+-#endif
+-
+-#if !defined(__linux__) && !defined(CSRG_BASED)
+-extern char	*sys_errlist[];
+-extern int	sys_nerr;
+ #endif
+ 
+     /* local functions */
+@@ -599,8 +595,7 @@ static int	invoke_ims(UserSelection *sel)
+ 
+     pid = fork();
+     if (pid == (pid_t) -1) {
+-	put_xims_log("fork failed [%s]",
+-		(errno <= sys_nerr) ? sys_errlist[errno] : NULL, 0, 0);
++	put_xims_log("fork failed [%s]", strerror(errno), 0, 0);
+ #ifdef	DEBUG
+ 	perror("fork");
+ #endif
+@@ -617,8 +612,7 @@ static int	invoke_ims(UserSelection *sel)
+ #endif
+ 	execl(SH_PATH, "sh", "-c", renv->cmdbuf, NULL);
+ 
+-	put_xims_log("%s: exec failed [%s]", SH_PATH,
+-		(errno <= sys_nerr) ? sys_errlist[errno] : NULL, 0, 0);
++	put_xims_log("%s: exec failed [%s]", SH_PATH, strerror(errno) , 0, 0);
+ 	/* perror(SH_PATH); */
+ 	sleep(1);
+ 	_exit(1);
+diff --git a/cde/programs/dtinfo/dtinfo/src/external-api/comm.c b/cde/programs/dtinfo/dtinfo/src/external-api/comm.c
+index d61ccb7a..6aa2fc91 100644
+--- a/cde/programs/dtinfo/dtinfo/src/external-api/comm.c
++++ b/programs/dtinfo/dtinfo/src/external-api/comm.c
+@@ -53,9 +53,6 @@
+ #include <sys/select.h>
+ #endif
+ 
+-extern char *sys_errlist[];
+-
+-
+ static OliasEvent *current_event;
+ static int reply_status;
+ #define NO_REPLY 0
+@@ -332,7 +329,7 @@ wait_for_reply (Widget toplevel)
+ 	      XtAppWarningMsg (XtWidgetToApplicationContext (toplevel),
+ 			       "communicationsError", "select",
+ 			       "Olias API", "Select failed: %s",
+-			       &sys_errlist[errno], &num_params);
++			       strerror(errno), &num_params);
+ 	      continue;
+ 	    }
+ 	  continue;
+diff --git a/cde/programs/dtksh/ksh93/src/lib/libast/string/fmterror.c b/cde/programs/dtksh/ksh93/src/lib/libast/string/fmterror.c
+index 313b67bc..8dd87ab8 100644
+--- a/cde/programs/dtksh/ksh93/src/lib/libast/string/fmterror.c
++++ b/programs/dtksh/ksh93/src/lib/libast/string/fmterror.c
+@@ -92,14 +92,7 @@
+ #endif
+ #include <ast.h>
+ 
+-extern __MANGLE__ int	sys_nerr;
+-extern __MANGLE__ char*	sys_errlist[];
+-
+ char*
+ fmterror __PARAM__((int err), (err)) __OTORP__(int err;){
+-	static char	msg[28];
+-
+-	if (err > 0 && err <= sys_nerr) return(sys_errlist[err]);
+-	sfsprintf(msg, sizeof(msg), "Error %d", err);
+-	return(msg);
++    return strerror(err);
+ }
+diff --git a/cde/programs/dtksh/ksh93/src/lib/libast/string/strerror.c b/cde/programs/dtksh/ksh93/src/lib/libast/string/strerror.c
+index 7686a54d..a6aa7ce8 100644
+--- a/cde/programs/dtksh/ksh93/src/lib/libast/string/strerror.c
++++ b/programs/dtksh/ksh93/src/lib/libast/string/strerror.c
+@@ -108,18 +108,12 @@ NoN(strerror)
+ 
+ #include <ast.h>
+ 
+-extern __MANGLE__ int	sys_nerr;
+-extern __MANGLE__ char*	sys_errlist[];
+ 
+ char*
+ strerror __PARAM__((int err), (err)) __OTORP__(int err;)
+ #line 25
+ {
+-	static char	msg[28];
+-
+-	if (err > 0 && err <= sys_nerr) return(sys_errlist[err]);
+-	sfsprintf(msg, sizeof(msg), "Error %d", err);
+-	return(msg);
++	return strerror(err);
+ }
+ 
+ #endif
+diff --git a/cde/programs/dtlogin/dm.h b/cde/programs/dtlogin/dm.h
+index 3e0f2499..e67edc3c 100644
+--- a/cde/programs/dtlogin/dm.h
++++ b/programs/dtlogin/dm.h
+@@ -68,8 +68,7 @@
+ # include       <pwd.h>                 /* for passwd structure            */
+ # include	<stdio.h>
+ # include	<stdlib.h>		/* for exit(), malloc(), abort()   */
+-# include	<string.h>		/* for string functions, bcopy(),
+-					   sys_errlist			   */
++# include	<string.h>		/* for string functions, bcopy()   */
+ # include	<sys/param.h>		/* for NGROUPS			   */
+ # include	<sys/types.h>   	/* for fd_set			   */
+ # include	<netinet/in.h>		/* for Internet socket stuff	   */
+@@ -475,10 +474,6 @@ struct verify_info {
+  *
+  ***************************************************************************/
+ 
+-#if !defined(__linux__) && !defined(CSRG_BASED)
+-extern char	*sys_errlist[];		/* system error msgs		   */
+-extern int	sys_nerr;		/* system error msgs		   */
+-#endif
+ extern XrmDatabase  XresourceDB; 
+ 
+ 
+-- 
+2.28.0
+

third_party/nixpkgs/pkgs/desktops/cdesktopenv/default.nix

@@ -2,7 +2,8 @@
 , libXinerama, libXt, libXext, libtirpc, motif, libXft, xbitmaps
 , libjpeg, libXmu, libXdmcp, libXScrnSaver, symlinkJoin, bdftopcf
 , ncompress, mkfontdir, tcl, libXaw, gcc, glibcLocales, gawk
-, autoPatchelfHook, libredirect, makeWrapper, xset, xrdb, fakeroot }:
+, autoPatchelfHook, libredirect, makeWrapper, xset, xrdb, fakeroot
+, rpcsvc-proto }:
 
 let
   x11ProjectRoot = symlinkJoin {
@@ -25,6 +26,7 @@ in stdenv.mkDerivation rec {
   # remove with next release
   patches = [
     ./2.3.2.patch
+    ./0001-all-remove-deprecated-sys_errlist-and-replace-with-A.patch
   ];
 
   buildInputs = [
@@ -33,6 +35,7 @@ in stdenv.mkDerivation rec {
   ];
   nativeBuildInputs = [
     bison ncompress gawk autoPatchelfHook makeWrapper fakeroot
+    rpcsvc-proto
   ];
 
   makeFlags = [
@@ -74,6 +77,5 @@ EOF
     license = licenses.lgpl2;
     maintainers = [ maintainers.gnidorah ];
     platforms = [ "i686-linux" "x86_64-linux" ];
-    broken = true; # not compatible with glibc 2.32
   };
 }

third_party/nixpkgs/pkgs/development/compilers/gambit/build.nix

@@ -35,6 +35,7 @@ gccStdenv.mkDerivation rec {
   #runtimeDeps = [ gnused gnugrep ];
 
   configureFlags = [
+    "--enable-targets=${gambit-params.targets}"
     "--enable-single-host"
     "--enable-c-opt=${optimizationSetting}"
     "--enable-gcc-opts"
@@ -94,6 +95,7 @@ gccStdenv.mkDerivation rec {
 
     # Now use the bootstrap compiler to build the real thing!
     make -j$NIX_BUILD_CORES from-scratch
+    ${lib.optionalString gambit-params.modules "make -j$NIX_BUILD_CORES modules"}
   '';
 
   postInstall = ''

third_party/nixpkgs/pkgs/development/compilers/gambit/gambit-support.nix

@@ -2,12 +2,16 @@
 
 rec {
   stable-params = {
+    stable = true;
     defaultRuntimeOptions = "f8,-8,t8";
     buildRuntimeOptions = "f8,-8,t8";
     fix-stamp = git-version : "";
+    targets = "java,js,php,python,ruby";
+    modules = false;
   };
 
   unstable-params = {
+    stable = false;
     defaultRuntimeOptions = "iL,fL,-L,tL";
     buildRuntimeOptions = "i8,f8,-8,t8";
     fix-stamp = git-version : ''
@@ -15,6 +19,8 @@ rec {
         --replace "$(grep '^PACKAGE_VERSION=.*$' configure)" 'PACKAGE_VERSION="v${git-version}"' \
         --replace "$(grep '^PACKAGE_STRING=.*$' configure)" 'PACKAGE_STRING="Gambit v${git-version}"' ;
     '';
+    targets = "arm,java,js,php,python,riscv-32,riscv-64,ruby,x86,x86-64"; # eats 100% cpu on _digest
+    modules = false;
   };
 
   export-gambopt = params : "export GAMBOPT=${params.buildRuntimeOptions} ;";

third_party/nixpkgs/pkgs/development/compilers/gambit/unstable.nix

@@ -1,13 +1,13 @@
 { callPackage, fetchFromGitHub, gambit-support }:
 
 callPackage ./build.nix {
-  version = "unstable-2020-07-29";
+  version = "unstable-2020-09-20";
-  git-version = "4.9.3-1232-gbba388b8";
+  git-version = "4.9.3-1234-g6acd87df";
   src = fetchFromGitHub {
     owner = "feeley";
     repo = "gambit";
-    rev = "bba388b80ca62a77883a8936d64b03316808696a";
+    rev = "6acd87dfa95bfca33082a431e72f023345dc07ee";
-    sha256 = "0iqlp1mvxz8g32kqrqm0phnnp1i5c4jrapqh2wqwa8fh1vgnizg1";
+    sha256 = "0a3dy4ij8hzlp3sjam4b6dp6yvyz5d7g2x784qm3gp89fi2ck56r";
   };
   gambit-params = gambit-support.unstable-params;
 }

third_party/nixpkgs/pkgs/development/compilers/gerbil/gerbil-ethereum.nix

@@ -2,8 +2,8 @@
 
 gerbil-support.gerbilPackage {
   pname = "gerbil-ethereum";
-  version = "unstable-2020-08-02";
+  version = "unstable-2020-10-18";
-  git-version = "0.0-15-g7cd2dd7";
+  git-version = "0.0-26-gf27ada8";
   gerbil-package = "mukn/ethereum";
   gerbil = gerbil-unstable;
   gerbilInputs = with gerbil-support.gerbilPackages-unstable;
@@ -15,8 +15,8 @@ gerbil-support.gerbilPackage {
   src = fetchFromGitHub {
     owner = "fare";
     repo = "gerbil-ethereum";
-    rev = "7cd2dd7436b11917d0729dbafe087cfa8ec38f86";
+    rev = "f27ada8e7f4de4f8fbdfede9fe055914b254d8e7";
-    sha256 = "0qq3ch2dg735yrj3l2c9pb9qlvz98x3vjfi2xyr4fwr78smpqgb5";
+    sha256 = "1lykjqim6a44whj1r8kkpiz68wghkfqx5vjlrc2ldxlmgd4r9gvd";
   };
   meta = {
     description = "Gerbil Ethereum: a Scheme alternative to web3.js";

third_party/nixpkgs/pkgs/development/compilers/gerbil/gerbil-libp2p.nix

@@ -0,0 +1,27 @@
+{ pkgs, lib, fetchFromGitHub, gerbil-unstable, gerbil-support, gambit-support }:
+
+gerbil-support.gerbilPackage {
+  pname = "gerbil-libp2p";
+  version = "unstable-2018-12-27";
+  git-version = "2376b3f";
+  gerbil-package = "vyzo";
+  gerbil = gerbil-unstable;
+  gerbilInputs = [];
+  buildInputs = []; # Note: at *runtime*, depends on go-libp2p-daemon
+  gambit-params = gambit-support.unstable-params;
+  version-path = "version";
+  softwareName = "Gerbil-libp2p";
+  src = fetchFromGitHub {
+    owner = "vyzo";
+    repo = "gerbil-libp2p";
+    rev = "2376b3f39cee04dd4ec455c8ea4e5faa93c2bf88";
+    sha256 = "0jcy7hfg953078msigyfwp2g4ii44pi6q7vcpmq01cbbvxpxz6zw";
+  };
+  meta = {
+    description = "Gerbil libp2p: use libp2p from Gerbil";
+    homepage    = "https://github.com/vyzo/gerbil-libp2p";
+    license     = lib.licenses.mit;
+    platforms   = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ fare ];
+  };
+}

third_party/nixpkgs/pkgs/development/compilers/gerbil/gerbil-persist.nix

@@ -2,8 +2,8 @@
 
 gerbil-support.gerbilPackage {
   pname = "gerbil-persist";
-  version = "unstable-2020-08-02";
+  version = "unstable-2020-08-31";
-  git-version = "0.0-4-ga3b2bd1";
+  git-version = "0.0-8-gd211390";
   gerbil-package = "clan/persist";
   gerbil = gerbil-unstable;
   gerbilInputs = with gerbil-support.gerbilPackages-unstable; [gerbil-utils gerbil-crypto gerbil-poo];
@@ -14,8 +14,8 @@ gerbil-support.gerbilPackage {
   src = fetchFromGitHub {
     owner = "fare";
     repo = "gerbil-persist";
-    rev = "a3b2bd104612db0e4492737f09f72adea6684483";
+    rev = "d211390c8a199cf2b8c7400cd98977524e960015";
-    sha256 = "0mc01wva26ww1i7n8naa95mfw7i6lj8qg0bwsik7gb3dsj2acjvh";
+    sha256 = "13s6ws8ziwalfp23nalss41qnz667z2712lr3y123sypm5n5axk7";
   };
   meta = {
     description = "Gerbil Persist: Persistent data and activities";

third_party/nixpkgs/pkgs/development/compilers/gerbil/gerbil-poo.nix

@@ -2,8 +2,8 @@
 
 gerbil-support.gerbilPackage {
   pname = "gerbil-ethereum";
-  version = "unstable-2020-08-02";
+  version = "unstable-2020-10-17";
-  git-version = "0.0-13-g1014154";
+  git-version = "0.0-35-g44d490d";
   gerbil-package = "clan/poo";
   gerbil = gerbil-unstable;
   gerbilInputs = with gerbil-support.gerbilPackages-unstable; [gerbil-utils gerbil-crypto];
@@ -14,8 +14,8 @@ gerbil-support.gerbilPackage {
   src = fetchFromGitHub {
     owner = "fare";
     repo = "gerbil-poo";
-    rev = "1014154fe4943dfbec7524666c831b601ba88559";
+    rev = "44d490d95b9d1b5d54eaedf2602419af8e086837";
-    sha256 = "0g8l5mi007n07qs79m9h3h3am1p7h0kzq7yb49h562b8frh5gp97";
+    sha256 = "082ndpy281saybcnp3bdidcibkk2ih6glrkbb5fdj1524ban4d0k";
   };
   meta = {
     description = "Gerbil POO: Prototype Object Orientation for Gerbil Scheme";

third_party/nixpkgs/pkgs/development/compilers/gerbil/gerbil-support.nix

@@ -1,14 +1,16 @@
-{ pkgs, gccStdenv, callPackage, fetchFromGitHub }:
+{ pkgs, lib, gccStdenv, callPackage, fetchFromGitHub }:
 # See ../gambit/build.nix regarding gccStdenv
 
 rec {
   # Gerbil libraries
   gerbilPackages-unstable = {
+    gerbil-libp2p = callPackage ./gerbil-libp2p.nix { };
     gerbil-utils = callPackage ./gerbil-utils.nix { };
     gerbil-crypto = callPackage ./gerbil-crypto.nix { };
     gerbil-poo = callPackage ./gerbil-poo.nix { };
     gerbil-persist = callPackage ./gerbil-persist.nix { };
     gerbil-ethereum = callPackage ./gerbil-ethereum.nix { };
+    smug-gerbil = callPackage ./smug-gerbil.nix { };
   };
 
   # Use this function in any package that uses Gerbil libraries, to define the GERBIL_LOADPATH.
@@ -23,6 +25,7 @@ rec {
     gambit-params ? pkgs.gambit-support.stable-params,
     gerbilInputs ? [],
     buildInputs ? [],
+    buildScript ? "./build.ss",
     softwareName ? ""} :
     let buildInputs_ = buildInputs; in
     gccStdenv.mkDerivation rec {
@@ -33,8 +36,8 @@ rec {
         set -e ;
         if [ -n "${version-path}.ss" ] ; then
           echo -e '(import :clan/versioning${builtins.concatStringsSep ""
-                     (map (x : if x.passthru.version-path != ""
+                     (map (x : lib.optionalString (x.passthru.version-path != "")
-                               then " :${x.passthru.gerbil-package}/${x.passthru.version-path}" else "")
+                               " :${x.passthru.gerbil-package}/${x.passthru.version-path}")
                           gerbilInputs)
                      })\n(register-software "${softwareName}" "v${git-version}")\n' > "${passthru.version-path}.ss"
         fi
@@ -50,7 +53,7 @@ rec {
 
       buildPhase = ''
         runHook preBuild
-        ./build.ss
+        ${buildScript}
         runHook postBuild
       '';
 

third_party/nixpkgs/pkgs/development/compilers/gerbil/gerbil-utils.nix

@@ -2,8 +2,8 @@
 
 gerbil-support.gerbilPackage {
   pname = "gerbil-utils";
-  version = "unstable-2020-08-02";
+  version = "unstable-2020-10-18";
-  git-version = "0.2-21-g7e7d053";
+  git-version = "0.2-36-g8b481b7";
   gerbil-package = "clan";
   gerbil = gerbil-unstable;
   gambit-params = gambit-support.unstable-params;
@@ -12,8 +12,8 @@ gerbil-support.gerbilPackage {
   src = fetchFromGitHub {
     owner = "fare";
     repo = "gerbil-utils";
-    rev = "7e7d053ec5e78cc58d38cb03baf554d83b31b0c6";
+    rev = "8b481b787e13e07e14d0718d670aab016131a090";
-    sha256 = "078vqdcddfavqq0d9pw430iz1562cgx1ck3fw6dpwxjkyc6m4bms";
+    sha256 = "0br8k5b2wcv4wcp65r2bfhji3af2qgqjspf41syqslq9awx47f3m";
   };
   meta = {
     description = "Gerbil Clan: Community curated Collection of Common Utilities";

third_party/nixpkgs/pkgs/development/compilers/gerbil/smug-gerbil.nix

@@ -0,0 +1,30 @@
+{ pkgs, lib, fetchFromGitHub, gerbil-unstable, gerbil-support, gambit-support }:
+
+gerbil-support.gerbilPackage {
+  pname = "smug-gerbil";
+  version = "unstable-2019-12-24";
+  git-version = "95d60d4";
+  gerbil-package = "drewc/smug";
+  gerbil = gerbil-unstable;
+  gerbilInputs = [];
+  buildInputs = [];
+  gambit-params = gambit-support.unstable-params;
+  version-path = ""; #"version";
+  softwareName = "Smug-Gerbil";
+  src = fetchFromGitHub {
+    owner = "drewc";
+    repo = "smug-gerbil";
+    rev = "95d60d486c1603743c6d3c525e6d5f5761b984e5";
+    sha256 = "0ys07z78gq60z833si2j7xa1scqvbljlx1zb32vdf32f1b27c04j";
+  };
+  meta = {
+    description = "Super Monadic Über Go-into : Parsers and Gerbil Scheme";
+    homepage    = "https://github.com/drewc/smug-gerbil";
+    license     = lib.licenses.mit;
+    platforms   = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ fare ];
+  };
+  buildScript = ''
+    for i in primitive simple tokens smug ; do gxc -O $i.ss ; done
+  '';
+}

third_party/nixpkgs/pkgs/development/compilers/gerbil/unstable.nix

@@ -1,13 +1,13 @@
 { callPackage, fetchFromGitHub, gambit-unstable, gambit-support }:
 
 callPackage ./build.nix rec {
-  version = "unstable-2020-08-02";
+  version = "unstable-2020-11-05";
-  git-version = "0.16-120-g3f248e13";
+  git-version = "0.16-152-g808929ae";
   src = fetchFromGitHub {
     owner = "vyzo";
     repo = "gerbil";
-    rev = "3f248e139dfa11be74284fc812253fbecafbaf31";
+    rev = "808929aeb8823959191f35df53bc0c0150911b4b";
-    sha256 = "18v192cypj0nbmfcyflm8qnwp27qwy65m0a19ggs47wwbzhgvgqh";
+    sha256 = "0d9k2gkrs9qvlnk7xa3gjzs3gln3ydds7yd2313pvbw4q2lcz8iw";
   };
   inherit gambit-support;
   gambit = gambit-unstable;

third_party/nixpkgs/pkgs/development/compilers/mercury/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mercury";
-  version = "20.06";
+  version = "20.06.1";
 
   src = fetchurl {
     url    = "https://dl.mercurylang.org/release/mercury-srcdist-${version}.tar.gz";
-    sha256 = "1gkr9w8lsdzqykqwd3f1a1phsqv090648i14ilhv8jdg85frdimr";
+    sha256 = "ef093ae81424c4f3fe696eff9aefb5fb66899e11bb17ae0326adfb70d09c1c1f";
   };
 
   buildInputs = [ gcc flex bison texinfo jdk erlang makeWrapper

third_party/nixpkgs/pkgs/development/compilers/ponyc/default.nix

@@ -107,7 +107,7 @@ stdenv.mkDerivation (rec {
     description = "Pony is an Object-oriented, actor-model, capabilities-secure, high performance programming language";
     homepage = "https://www.ponylang.org";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ doublec kamilchm patternspandemic redvers ];
+    maintainers = with maintainers; [ kamilchm patternspandemic redvers ];
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
   };
 })

third_party/nixpkgs/pkgs/development/compilers/rust/make-rust-platform.nix

@@ -18,4 +18,8 @@ rec {
   rustcSrc = callPackage ./rust-src.nix {
     inherit rustc;
   };
+
+  rustLibSrc = callPackage ./rust-lib-src.nix {
+    inherit rustc;
+  };
 }

third_party/nixpkgs/pkgs/development/compilers/rust/rust-lib-src.nix

@@ -0,0 +1,11 @@
+{ stdenv, rustc }:
+
+stdenv.mkDerivation {
+  name = "rust-lib-src";
+  src = rustc.src;
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    mv library $out
+  '';
+}

third_party/nixpkgs/pkgs/development/idris-modules/TODO.md

@@ -1,3 +1,3 @@
 * Build the RTS separately from Idris
 * idris2nix
-* Only require gmp, rts when compiling executables
+* Only require gmp, rts when compiling executables

third_party/nixpkgs/pkgs/development/interpreters/clojure/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "clojure";
-  version = "1.10.1.645";
+  version = "1.10.1.727";
 
   src = fetchurl {
     url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "1z6a9an8ls992y4japmzdxay7c5d2z9s2q1xl4g615r23jwpcsf9";
+    sha256 = "1mnxvy4n7g72vcwhvrgr0xqri3p9d9w76c8a78kphhmd8lq0m92q";
   };
 
   nativeBuildInputs = [
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
       cp clojure-tools-${version}.jar $out/libexec
       cp example-deps.edn $out
       cp deps.edn $out
-      cp clj_exec.clj $out
+      cp exec.jar $out
 
       substituteInPlace clojure --replace PREFIX $out
 

third_party/nixpkgs/pkgs/development/interpreters/dart/default.nix

@@ -77,9 +77,7 @@ stdenv.mkDerivation {
     mkdir -p $out
     cp -R * $out/
     echo $libPath
-    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+    find $out/bin -executable -type f -exec patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) {} \;
-             --set-rpath $libPath \
-             $out/bin/dart
   '';
 
   libPath = makeLibraryPath [ stdenv.cc.cc ];

third_party/nixpkgs/pkgs/development/interpreters/elixir/1.11.nix

@@ -3,7 +3,7 @@
 # How to obtain `sha256`:
 # nix-prefetch-url --unpack https://github.com/elixir-lang/elixir/archive/v${version}.tar.gz
 mkDerivation {
-  version = "1.11.1";
+  version = "1.11.2";
-  sha256 = "0czyv98sq9drlvdwv3gw9vnhn8qa3va4xh5vdqpg7m6b93l1r3p1";
+  sha256 = "0b4nfgxhmi4gwba9h9k103zrkpbxxvk0gmdl0ggrd5xlg6v288ky";
   minimumOTPVersion = "21";
 }

third_party/nixpkgs/pkgs/development/interpreters/erlang/R23.nix

@@ -3,8 +3,8 @@
 # How to obtain `sha256`:
 # nix-prefetch-url --unpack https://github.com/erlang/otp/archive/OTP-${version}.tar.gz
 mkDerivation {
-  version = "23.1";
+  version = "23.1.2";
-  sha256 = "1k74g6m2lidhp04vrcwrg0jszj3zwxyrm4fsma09sfn9rfsra36g";
+  sha256 = "06dp2sw486khy2lc34cw5dca58ii5jvi26dpchiqxnmyvd6995z0";
 
   prePatch = ''
     substituteInPlace make/configure.in --replace '`sw_vers -productVersion`' "''${MACOSX_DEPLOYMENT_TARGET:-10.12}"

third_party/nixpkgs/pkgs/development/interpreters/groovy/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "groovy";
-  version = "3.0.3";
+  version = "3.0.6";
 
   src = fetchurl {
     url = "http://dl.bintray.com/groovy/maven/apache-groovy-binary-${version}.zip";
-    sha256 = "0xdm70b61pdj8z3g08az16y9b6cpz5hv7iwvwfyfyxrjdi47h419";
+    sha256 = "1wimpcg4nyxykbkh407d7h0b828vmrf7sv412mgmif57p3aw433f";
   };
 
   buildInputs = [ unzip makeWrapper ];

third_party/nixpkgs/pkgs/development/interpreters/python/update-python-libraries/default.nix

@@ -9,4 +9,4 @@ runCommand "update-python-libraries" {
   cp ${./update-python-libraries.py} $out
   patchShebangs $out
   substituteInPlace $out --replace 'GIT = "git"' 'GIT = "${git}/bin/git"'
-''
+''

third_party/nixpkgs/pkgs/development/libraries/SDL_image/default.nix

@@ -17,7 +17,12 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  configureFlags = stdenv.lib.optional stdenv.isDarwin "--disable-sdltest";
+  configureFlags = [
+    # Disable its dynamic loading or dlopen will fail because of no proper rpath
+    "--disable-jpg-shared"
+    "--disable-png-shared"
+    "--disable-tif-shared"
+  ] ++ stdenv.lib.optional stdenv.isDarwin "--disable-sdltest";
 
   buildInputs = [ SDL libpng libjpeg libtiff libungif libXpm ];
 

third_party/nixpkgs/pkgs/development/libraries/agda/agda-categories/default.nix

@@ -8,7 +8,7 @@ mkDerivation rec {
     owner = "agda";
     repo = "agda-categories";
     rev = "v${version}";
-    sha256 = "0n6y9xarqhj95i4h56klx10gy0fyckxbfwgiissfknpfq6l0m7r6";
+    sha256 = "1bcvmxcnl1ig38fxqkx8ydidhxq6a0kn2k9waf0lygh4ap928sgk";
   };
 
   buildInputs = [ standard-library ];

third_party/nixpkgs/pkgs/development/libraries/aspell/aspell-with-dicts.nix

@@ -33,4 +33,4 @@ in buildEnv {
     done
     popd
   '';
-}
+}

third_party/nixpkgs/pkgs/development/libraries/hpx/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hpx";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "STEllAR-GROUP";
     repo = "hpx";
     rev = version;
-    sha256 = "10hgjavhvn33y3k5j3l1326x13bxffghg2arxjrh7i7zd3qprfv5";
+    sha256 = "1ld2k00500p107jarw379hsd1nlnm33972nv9c3ssfq619bj01c9";
   };
 
   buildInputs = [ boost hwloc gperftools ];

third_party/nixpkgs/pkgs/development/libraries/indilib/default.nix

@@ -1,5 +1,5 @@
 { stdenv
-, fetchurl
+, fetchFromGitHub
 , cmake
 , cfitsio
 , libusb1
@@ -9,14 +9,18 @@
 , curl
 , libjpeg
 , gsl
+, fftw
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "indilib-1.1.0";
+  pname = "indilib";
+  version = "1.8.6";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "mirror://sourceforge/indi/libindi_1.1.0.tar.gz";
+    owner = "indilib";
-    sha256 = "1bs6lkwqd4aashg93mqqkc7nrg7fbx9mdw85qs5263jqa6sr780w";
+    repo = "indi";
+    rev = "v${version}";
+    sha256 = "1yzvcm7lwhwssnvv6gp8f7igmnvs35bpidmzz6z15awm5841yw30";
   };
 
   patches = [
@@ -36,12 +40,14 @@ stdenv.mkDerivation {
     libnova
     libjpeg
     gsl
+    fftw
   ];
 
-  meta = {
+  meta = with stdenv.lib; {
     homepage = "https://www.indilib.org/";
-    license = stdenv.lib.licenses.lgpl2Plus;
+    description = "Implementation of the INDI protocol for POSIX operating systems";
-    description = "Implementaion of the INDI protocol for POSIX operating systems";
+    license = licenses.lgpl2Plus;
-    platforms = stdenv.lib.platforms.unix;
+    maintainers = with maintainers; [ hjones2199 ];
+    platforms = [ "x86_64-linux" ];
   };
 }

third_party/nixpkgs/pkgs/development/libraries/indilib/udev-dir.patch

@@ -1,12 +1,11 @@
-diff -Naur libindi-1.0.0-upstream/CMakeLists.txt libindi-1.0.0/CMakeLists.txt
+--- indi-1.8.6/CMakeLists.txt	2020-08-21 05:56:59.000000000 -0500
---- libindi-1.0.0-upstream/CMakeLists.txt	2015-03-28 21:06:49.576863460 -0430
++++ CMakeLists.txt	2020-11-01 12:50:57.621293870 -0600
-+++ libindi-1.0.0/CMakeLists.txt	2015-03-28 21:07:48.420677548 -0430
+@@ -77,7 +77,7 @@
-@@ -28,7 +28,7 @@
+ ## the following are directories where stuff will be installed to
- ## the following are directories where stuff will be installed to
+ set(INCLUDE_INSTALL_DIR      "${CMAKE_INSTALL_PREFIX}/include/")
- set(INCLUDE_INSTALL_DIR      "${CMAKE_INSTALL_PREFIX}/include/")
+ set(PKGCONFIG_INSTALL_PREFIX "${CMAKE_INSTALL_LIBDIR}/pkgconfig/")
- set(PKGCONFIG_INSTALL_PREFIX "${LIB_DESTINATION}/pkgconfig/")
+-set(UDEVRULES_INSTALL_DIR "/lib/udev/rules.d" CACHE STRING "Base directory for udev rules")
--set(UDEVRULES_INSTALL_DIR "/lib/udev/rules.d" CACHE STRING "Base directory for udev rules")
++set(UDEVRULES_INSTALL_DIR "${CMAKE_INSTALL_PREFIX}/lib/udev/rules.d" CACHE STRING "Base directory for udev rules")
-+set(UDEVRULES_INSTALL_DIR "${CMAKE_INSTALL_PREFIX}/lib/udev/rules.d" CACHE STRING "Base directory for udev rules")
+ 
- 
+ set(PKG_CONFIG_LIBDIR ${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_LIBDIR})
- ##################  Includes  ################################
+ 
- Include (CheckCXXSourceCompiles)

third_party/nixpkgs/pkgs/development/libraries/jsoncpp/default.nix

@@ -2,13 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "jsoncpp";
-  version = "1.9.2";
+  version = "1.9.4";
+
+  outputs = ["out" "dev"];
 
   src = fetchFromGitHub {
     owner = "open-source-parsers";
     repo = "jsoncpp";
     rev = version;
-    sha256 = "037d1b1qdmn3rksmn1j71j26bv4hkjv7sn7da261k853xb5899sg";
+    sha256 = "0qnx5y6c90fphl9mj9d20j2dfgy6s5yr5l0xnzid0vh71zrp6jwv";
   };
 
   /* During darwin bootstrap, we have a cp that doesn't understand the
@@ -23,30 +25,17 @@ stdenv.mkDerivation rec {
   # Hack to be able to run the test, broken because we use
   # CMAKE_SKIP_BUILD_RPATH to avoid cmake resetting rpath on install
   preBuild = if stdenv.isDarwin then ''
-    export DYLD_LIBRARY_PATH="`pwd`/src/lib_json''${DYLD_LIBRARY_PATH:+:}$DYLD_LIBRARY_PATH"
+    export DYLD_LIBRARY_PATH="$PWD/lib''${DYLD_LIBRARY_PATH:+:}$DYLD_LIBRARY_PATH"
   '' else ''
-    export LD_LIBRARY_PATH="`pwd`/src/lib_json''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
+    export LD_LIBRARY_PATH="$PWD/lib''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH"
   '';
 
   nativeBuildInputs = [ cmake python validatePkgConfig ];
 
-  patches = [
-    # Fix generation of pkg-config file (https://github.com/open-source-parsers/jsoncpp/pull/1199)
-    (fetchpatch {
-      url = "https://github.com/open-source-parsers/jsoncpp/commit/b05a21342a646a986b11c28ba6b19665756d21d2.patch";
-      sha256 = "0dn4cvvkcp9mnxbzyaqb49z6bv5yqsx1wlf1lyki1n2rni2hn63p";
-    })
-  ] ++ stdenv.lib.optionals (stdenv.isAarch64 || stdenv.isAarch32) [
-    # fix inverted sense in isAnyCharRequiredQuoting on arm. See: https://github.com/open-source-parsers/jsoncpp/pull/1120
-    (fetchpatch {
-      url = "https://github.com/open-source-parsers/jsoncpp/commit/9093358efae9e5981aa60013487fc7215f040a59.patch";
-      sha256 = "1wiqp70sck2md14sfc0zdkblqk9750cl55ykf9d6b9vs1ifzzzq5";
-     })
-  ];
-
   cmakeFlags = [
     "-DBUILD_SHARED_LIBS=ON"
     "-DBUILD_STATIC_LIBS=OFF"
+    "-DBUILD_OBJECT_LIBS=OFF"
     "-DJSONCPP_WITH_CMAKE_PACKAGE=ON"
   ];
 

third_party/nixpkgs/pkgs/development/libraries/libexif/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, autoreconfHook, gettext }:
+{ stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, gettext }:
 
 stdenv.mkDerivation rec {
   pname = "libexif";
@@ -11,6 +11,20 @@ stdenv.mkDerivation rec {
     sha256 = "0mzndakdi816zcs13z7yzp7hj031p2dcyfq2p391r63d9z21jmy1";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2020-0198.patch";
+      url = "https://github.com/libexif/libexif/commit/ce03ad7ef4e8aeefce79192bf5b6f69fae396f0c.patch";
+      sha256 = "1040278g5dbq3vvlyk8cmzb7flpi9bfsp99268hw69i6ilwbdf2k";
+    })
+    (fetchpatch {
+      name = "CVE-2020-0452.patch";
+      url = "https://github.com/libexif/libexif/commit/9266d14b5ca4e29b970fa03272318e5f99386e06.patch";
+      excludes = [ "NEWS" ];
+      sha256 = "0k4z1gbbkli6wwyy9qm2qvn0h00qda6wqym61nmmbys7yc2zryj6";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook gettext ];
 
   meta = with stdenv.lib; {

third_party/nixpkgs/pkgs/development/libraries/libngspice/default.nix

@@ -4,11 +4,11 @@
 # the ngspice derivation.
 stdenv.mkDerivation rec {
   pname = "libngspice";
-  version = "31";
+  version = "33";
 
   src = fetchurl {
     url = "mirror://sourceforge/ngspice/ngspice-${version}.tar.gz";
-    sha256 = "10n2lnfrpsv4vyrirkphr4jwjjhy7i617g6za78dwirfjq63npw4";
+    sha256 = "1wa1hmpn13spmxqgbb1m7vgy32mwvjqwrxhymzll8z65q5nbd7dr";
   };
 
   nativeBuildInputs = [ flex bison ];

third_party/nixpkgs/pkgs/development/libraries/nuspell/default.nix

@@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, cmake, pkgconfig, boost, icu, catch2, ronn }:
+{ stdenv, fetchFromGitHub, cmake, pkgconfig, boost, icu, catch2, pandoc }:
 
 stdenv.mkDerivation rec {
   pname = "nuspell";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "nuspell";
     repo = "nuspell";
     rev = "v${version}";
-    sha256 = "1jfnwva2i67i9pyh123a5h2zs5p7gw77qh4w7qkx61jigsyxc5v7";
+    sha256 = "1p90a3wv4b8m5fdpbnr9cyd1x3a504q9rc4cghq02xff63h5gclf";
   };
 
-  nativeBuildInputs = [ cmake pkgconfig ronn ];
+  nativeBuildInputs = [ cmake pkgconfig pandoc ];
   buildInputs = [ boost icu ];
 
   outputs = [ "out" "lib" "dev" "man" ];

third_party/nixpkgs/pkgs/development/libraries/pmix/default.nix

@@ -1,9 +1,9 @@
 { stdenv, fetchFromGitHub, perl, autoconf, automake
-, libtool, flex, libevent, hwloc, munge, zlib
+, libtool, flex, libevent, hwloc, munge, zlib, pandoc
 } :
 
 let
-  version = "3.1.5";
+  version = "3.2.0";
 
 in stdenv.mkDerivation {
   pname = "pmix";
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
     repo = "openpmix";
     owner = "openpmix";
     rev = "v${version}";
-    sha256 = "0fvfsig20amcigyn4v3gcdxc0jif44vqg37b8zzh0s8jqqj7jz5w";
+    sha256 = "171hpz0m6lpyjd1hkxy7fl06fcgymz8cssqgbxzg92b7x595276b";
   };
 
   postPatch = ''
@@ -21,7 +21,7 @@ in stdenv.mkDerivation {
     patchShebangs ./config
   '';
 
-  nativeBuildInputs = [ perl autoconf automake libtool flex ];
+  nativeBuildInputs = [ pandoc perl autoconf automake libtool flex ];
 
   buildInputs = [ libevent hwloc munge zlib ];
 

third_party/nixpkgs/pkgs/development/libraries/protobuf/2.5.nix

@@ -7,4 +7,4 @@ callPackage ./generic.nix (args // rec {
     url = "http://protobuf.googlecode.com/files/${version}.tar.bz2";
     sha256 = "0xxn9gxhvsgzz2sgmihzf6pf75clr05mqj6218camwrwajpcbgqk";
   };
-})
+})

third_party/nixpkgs/pkgs/development/libraries/science/math/libtorch/bin.nix

@@ -100,7 +100,7 @@ in stdenv.mkDerivation {
 
   outputs = [ "out" "dev" ];
 
-  passthru.tests = callPackage ./test { };
+  passthru.tests.cmake = callPackage ./test { };
 
   meta = with stdenv.lib; {
     description = "C++ API of the PyTorch machine learning framework";

third_party/nixpkgs/pkgs/development/libraries/science/math/libtorch/test/default.nix

@@ -6,16 +6,12 @@ stdenv.mkDerivation {
 
   src = ./.;
 
-  postPatch = ''
-    cat CMakeLists.txt
-  '';
-
-  makeFlags = [ "VERBOSE=1" ];
-
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [ libtorch-bin ];
 
+  doCheck = true;
+
   installPhase = ''
     touch $out
   '';