Project import generated by Copybara.

GitOrigin-RevId: fc4148a47fa927319186061aa42633c8aa5777f1

third_party/nixpkgs/flake.nix

@@ -18,6 +18,9 @@
     in
     {
       lib = lib.extend (final: prev: {
+
+        nixos = import ./nixos/lib { lib = final; };
+
         nixosSystem = { modules, ... } @ args:
           import ./nixos/lib/eval-config.nix (args // {
             modules =

third_party/nixpkgs/lib/types.nix

@@ -300,6 +300,19 @@ rec {
       inherit (str) merge;
     };
 
+    # Allow a newline character at the end and trim it in the merge function.
+    singleLineStr =
+      let
+        inherit (strMatching "[^\n\r]*\n?") check merge;
+      in
+      mkOptionType {
+        name = "singleLineStr";
+        description = "(optionally newline-terminated) single-line string";
+        inherit check;
+        merge = loc: defs:
+          lib.removeSuffix "\n" (merge loc defs);
+      };
+
     strMatching = pattern: mkOptionType {
       name = "strMatching ${escapeNixString pattern}";
       description = "string matching the pattern ${pattern}";

third_party/nixpkgs/maintainers/maintainer-list.nix

@@ -2291,6 +2291,12 @@
     githubId = 34317;
     name = "Corey O'Connor";
   };
+  CodeLongAndProsper90 = {
+    github = "CodeLongAndProsper90";
+    githubId = 50145141;
+    email = "jupiter@m.rdis.dev";
+    name = "Scott Little";
+  };
   codsl = {
     email = "codsl@riseup.net";
     github = "codsl";
@@ -6604,7 +6610,7 @@
   };
   kylesferrazza = {
     name = "Kyle Sferrazza";
-    email = "kyle.sferrazza@gmail.com";
+    email = "nixpkgs@kylesferrazza.com";
 
     github = "kylesferrazza";
     githubId = 6677292;
@@ -6981,6 +6987,12 @@
     githubId = 22085373;
     name = "Luis Hebendanz";
   };
+  lunarequest = {
+    email = "nullarequest@vivlaid.net";
+    github = "Lunarequest";
+    githubId = 30698906;
+    name = "Advaith Madhukar"; #this is my legal name, I prefer Luna; please keep that in mind!
+  };
   lionello = {
     email = "lio@lunesu.com";
     github = "lionello";
@@ -7227,6 +7239,12 @@
     email = "wheatdoge@gmail.com";
     name = "Tim Liou";
   };
+  m00wl = {
+    name = "Moritz Lumme";
+    email = "moritz.lumme@gmail.com";
+    github = "m00wl";
+    githubId = 46034439;
+  };
   m1cr0man = {
     email = "lucas+nix@m1cr0man.com";
     github = "m1cr0man";
@@ -12708,6 +12726,16 @@
     githubId = 3889405;
     name = "vyp";
   };
+  wackbyte = {
+    name = "wackbyte";
+    email = "wackbyte@pm.me";
+    github = "wackbyte";
+    githubId = 29505620;
+    keys = [{
+      longkeyid = "rsa4096/0x937F2AE5CCEFBF59";
+      fingerprint = "E595 7FE4 FEF6 714B 1AD3  1483 937F 2AE5 CCEF BF59";
+    }];
+  };
   wakira = {
     name = "Sheng Wang";
     email = "sheng@a64.work";
@@ -12740,6 +12768,12 @@
     email = "kirill.wedens@gmail.com";
     name = "wedens";
   };
+  wegank = {
+    name = "Weijia Wang";
+    email = "contact@weijia.wang";
+    github = "wegank";
+    githubId = 9713184;
+  };
   weihua = {
     email = "luwh364@gmail.com";
     github = "weihua-lu";

third_party/nixpkgs/maintainers/scripts/pluginupdate.py

@@ -81,29 +81,71 @@ def make_request(url: str) -> urllib.request.Request:
         headers["Authorization"] = f"token {token}"
     return urllib.request.Request(url, headers=headers)
 
-@dataclass
-class PluginDesc:
-    owner: str
-    repo: str
-    branch: str
-    alias: Optional[str]
-
-
 class Repo:
     def __init__(
-        self, owner: str, name: str, branch: str, alias: Optional[str]
+        self, uri: str, branch: str, alias: Optional[str]
     ) -> None:
-        self.owner = owner
+        self.uri = uri
-        self.name = name
+        '''Url to the repo'''
         self.branch = branch
         self.alias = alias
         self.redirect: Dict[str, str] = {}
 
-    def url(self, path: str) -> str:
+    @property
-        return urljoin(f"https://github.com/{self.owner}/{self.name}/", path)
+    def name(self):
+        return self.uri.split('/')[-1]
 
     def __repr__(self) -> str:
-        return f"Repo({self.owner}, {self.name})"
+        return f"Repo({self.name}, {self.uri})"
+
+    @retry(urllib.error.URLError, tries=4, delay=3, backoff=2)
+    def has_submodules(self) -> bool:
+        return True
+
+    @retry(urllib.error.URLError, tries=4, delay=3, backoff=2)
+    def latest_commit(self) -> Tuple[str, datetime]:
+        loaded = self._prefetch(None)
+        updated = datetime.strptime(loaded['date'], "%Y-%m-%dT%H:%M:%S%z")
+
+        return loaded['rev'], updated
+
+    def _prefetch(self, ref: Optional[str]):
+        cmd = ["nix-prefetch-git", "--quiet", "--fetch-submodules", self.uri]
+        if ref is not None:
+            cmd.append(ref)
+        log.debug(cmd)
+        data = subprocess.check_output(cmd)
+        loaded = json.loads(data)
+        return loaded
+
+    def prefetch(self, ref: Optional[str]) -> str:
+        loaded = self._prefetch(ref)
+        return loaded["sha256"]
+
+    def as_nix(self, plugin: "Plugin") -> str:
+        return f'''fetchgit {{
+            url = "{self.uri}";
+            rev = "{plugin.commit}";
+            sha256 = "{plugin.sha256}";
+        }}'''
+
+
+class RepoGitHub(Repo):
+    def __init__(
+            self, owner: str, repo: str, branch: str, alias: Optional[str]
+    ) -> None:
+        self.owner = owner
+        self.repo = repo
+        '''Url to the repo'''
+        super().__init__(self.url(""), branch, alias)
+        log.debug("Instantiating github repo %s/%s", self.owner, self.repo)
+
+    @property
+    def name(self):
+        return self.repo
+
+    def url(self, path: str) -> str:
+        return urljoin(f"https://github.com/{self.owner}/{self.name}/", path)
 
     @retry(urllib.error.URLError, tries=4, delay=3, backoff=2)
     def has_submodules(self) -> bool:
@@ -122,7 +164,7 @@ class Repo:
         commit_url = self.url(f"commits/{self.branch}.atom")
         commit_req = make_request(commit_url)
         with urllib.request.urlopen(commit_req, timeout=10) as req:
-            self.check_for_redirect(commit_url, req)
+            self._check_for_redirect(commit_url, req)
             xml = req.read()
             root = ET.fromstring(xml)
             latest_entry = root.find(ATOM_ENTRY)
@@ -137,7 +179,7 @@ class Repo:
             updated = datetime.strptime(updated_tag.text, "%Y-%m-%dT%H:%M:%SZ")
             return Path(str(url.path)).name, updated
 
-    def check_for_redirect(self, url: str, req: http.client.HTTPResponse):
+    def _check_for_redirect(self, url: str, req: http.client.HTTPResponse):
         response_url = req.geturl()
         if url != response_url:
             new_owner, new_name = (
@@ -150,11 +192,13 @@ class Repo:
             new_plugin = plugin_line.format(owner=new_owner, name=new_name)
             self.redirect[old_plugin] = new_plugin
 
-    def prefetch_git(self, ref: str) -> str:
+
-        data = subprocess.check_output(
+    def prefetch(self, commit: str) -> str:
-            ["nix-prefetch-git", "--fetch-submodules", self.url(""), ref]
+        if self.has_submodules():
-        )
+            sha256 = super().prefetch(commit)
-        return json.loads(data)["sha256"]
+        else:
+            sha256 = self.prefetch_github(commit)
+        return sha256
 
     def prefetch_github(self, ref: str) -> str:
         data = subprocess.check_output(
@@ -162,6 +206,33 @@ class Repo:
         )
         return data.strip().decode("utf-8")
 
+    def as_nix(self, plugin: "Plugin") -> str:
+        if plugin.has_submodules:
+            submodule_attr = "\n      fetchSubmodules = true;"
+        else:
+            submodule_attr = ""
+
+        return f'''fetchFromGitHub {{
+      owner = "{self.owner}";
+      repo = "{self.repo}";
+      rev = "{plugin.commit}";
+      sha256 = "{plugin.sha256}";{submodule_attr}
+    }}'''
+
+
+@dataclass
+class PluginDesc:
+    repo: Repo
+    branch: str
+    alias: Optional[str]
+
+    @property
+    def name(self):
+        if self.alias is None:
+            return self.repo.name
+        else:
+            return self.alias
+
 
 class Plugin:
     def __init__(
@@ -193,6 +264,7 @@ class Plugin:
         return copy
 
 
+
 class Editor:
     """The configuration of the update script."""
 
@@ -241,9 +313,9 @@ class Editor:
 
     def create_parser(self):
         parser = argparse.ArgumentParser(
-            description=(
+            description=(f"""
-                f"Updates nix derivations for {self.name} plugins"
+                Updates nix derivations for {self.name} plugins.\n
-                f"By default from {self.default_in} to {self.default_out}"
+                By default from {self.default_in} to {self.default_out}"""
             )
         )
         parser.add_argument(
@@ -273,7 +345,7 @@ class Editor:
             dest="proc",
             type=int,
             default=30,
-            help="Number of concurrent processes to spawn.",
+            help="Number of concurrent processes to spawn. Export GITHUB_API_TOKEN allows higher values.",
         )
         parser.add_argument(
             "--no-commit", "-n", action="store_true", default=False,
@@ -320,26 +392,24 @@ def prefetch_plugin(
     p: PluginDesc,
     cache: "Optional[Cache]" = None,
 ) -> Tuple[Plugin, Dict[str, str]]:
-    user, repo_name, branch, alias = p.owner, p.repo, p.branch, p.alias
+    repo, branch, alias = p.repo, p.branch, p.alias
-    log.info(f"Fetching last commit for plugin {user}/{repo_name}@{branch}")
+    name = alias or p.repo.name
-    repo = Repo(user, repo_name, branch, alias)
+    commit = None
+    log.info(f"Fetching last commit for plugin {name} from {repo.uri}@{branch}")
     commit, date = repo.latest_commit()
-    has_submodules = repo.has_submodules()
     cached_plugin = cache[commit] if cache else None
     if cached_plugin is not None:
         log.debug("Cache hit !")
-        cached_plugin.name = alias or repo_name
+        cached_plugin.name = name
         cached_plugin.date = date
         return cached_plugin, repo.redirect
 
-    print(f"prefetch {user}/{repo_name}")
+    has_submodules = repo.has_submodules()
-    if has_submodules:
+    print(f"prefetch {name}")
-        sha256 = repo.prefetch_git(commit)
+    sha256 = repo.prefetch(commit)
-    else:
-        sha256 = repo.prefetch_github(commit)
 
     return (
-        Plugin(alias or repo_name, commit, has_submodules, sha256, date=date),
+        Plugin(name, commit, has_submodules, sha256, date=date),
         repo.redirect,
     )
 
@@ -360,16 +430,17 @@ def print_download_error(plugin: str, ex: Exception):
 
 
 def check_results(
-    results: List[Tuple[str, str, Union[Exception, Plugin], Dict[str, str]]]
+    results: List[Tuple[PluginDesc, Union[Exception, Plugin], Dict[str, str]]]
-) -> Tuple[List[Tuple[str, str, Plugin]], Dict[str, str]]:
+) -> Tuple[List[Tuple[PluginDesc, Plugin]], Dict[str, str]]:
+    ''' '''
     failures: List[Tuple[str, Exception]] = []
     plugins = []
     redirects: Dict[str, str] = {}
-    for (owner, name, result, redirect) in results:
+    for (pdesc, result, redirect) in results:
         if isinstance(result, Exception):
-            failures.append((name, result))
+            failures.append((pdesc.name, result))
         else:
-            plugins.append((owner, name, result))
+            plugins.append((pdesc, result))
             redirects.update(redirect)
 
     print(f"{len(results) - len(failures)} plugins were checked", end="")
@@ -384,17 +455,29 @@ def check_results(
 
         sys.exit(1)
 
+def make_repo(uri, branch, alias) -> Repo:
+    '''Instantiate a Repo with the correct specialization depending on server (gitub spec)'''
+    # dumb check to see if it's of the form owner/repo (=> github) or https://...
+    res = uri.split('/')
+    if len(res) <= 2:
+        repo = RepoGitHub(res[0], res[1], branch, alias)
+    else:
+        repo = Repo(uri.strip(), branch, alias)
+    return repo
+
 def parse_plugin_line(line: str) -> PluginDesc:
     branch = "HEAD"
     alias = None
-    name, repo = line.split("/")
+    uri = line
-    if " as " in repo:
+    if " as " in uri:
-        repo, alias = repo.split(" as ")
+        uri, alias = uri.split(" as ")
         alias = alias.strip()
-    if "@" in repo:
+    if "@" in uri:
-        repo, branch = repo.split("@")
+        uri, branch = uri.split("@")
 
-    return PluginDesc(name.strip(), repo.strip(), branch.strip(), alias)
+    repo = make_repo(uri.strip(), branch.strip(), alias)
+
+    return PluginDesc(repo, branch.strip(), alias)
 
 
 def load_plugin_spec(plugin_file: str) -> List[PluginDesc]:
@@ -404,10 +487,6 @@ def load_plugin_spec(plugin_file: str) -> List[PluginDesc]:
             if line.startswith("#"):
                 continue
             plugin = parse_plugin_line(line)
-            if not plugin.owner:
-                msg = f"Invalid repository {line}, must be in the format owner/repo[ as alias]"
-                print(msg, file=sys.stderr)
-                sys.exit(1)
             plugins.append(plugin)
     return plugins
 
@@ -467,14 +546,13 @@ class Cache:
 
 def prefetch(
     pluginDesc: PluginDesc, cache: Cache
-) -> Tuple[str, str, Union[Exception, Plugin], dict]:
+) -> Tuple[PluginDesc, Union[Exception, Plugin], dict]:
-    owner, repo = pluginDesc.owner, pluginDesc.repo
     try:
         plugin, redirect = prefetch_plugin(pluginDesc, cache)
         cache[plugin.commit] = plugin
-        return (owner, repo, plugin, redirect)
+        return (pluginDesc, plugin, redirect)
     except Exception as e:
-        return (owner, repo, e, {})
+        return (pluginDesc, e, {})
 
 
 def rewrite_input(

third_party/nixpkgs/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml

@@ -108,6 +108,14 @@
           <link xlink:href="options.html#opt-services.powerdns-admin.enable">services.powerdns-admin</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://invoiceplane.com">InvoicePlane</link>,
+          web application for managing and creating invoices. Available
+          at
+          <link xlink:href="options.html#opt-services.invoiceplane.enable">services.invoiceplane</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://maddy.email">maddy</link>, a
@@ -353,6 +361,18 @@
           unmaintained
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The options
+          <literal>networking.interfaces.&lt;name&gt;.ipv4.routes</literal>
+          and
+          <literal>networking.interfaces.&lt;name&gt;.ipv6.routes</literal>
+          are no longer ignored when using networkd instead of the
+          default scripted network backend by setting
+          <literal>networking.useNetworkd</literal> to
+          <literal>true</literal>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           MultiMC has been replaced with the fork PolyMC due to upstream
@@ -524,6 +544,15 @@
           usage in non-X11 environments, e.g. Wayland.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link linkend="opt-programs.ssh.knownHosts">programs.ssh.knownHosts</link>
+          has gained an <literal>extraHostNames</literal> option to
+          replace <literal>hostNames</literal>.
+          <literal>hostNames</literal> is deprecated, but still
+          available for now.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>services.stubby</literal> module was converted to

third_party/nixpkgs/nixos/doc/manual/release-notes/rl-2205.section.md

@@ -35,6 +35,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [PowerDNS-Admin](https://github.com/ngoduykhanh/PowerDNS-Admin), a web interface for the PowerDNS server. Available at [services.powerdns-admin](options.html#opt-services.powerdns-admin.enable).
 
+- [InvoicePlane](https://invoiceplane.com), web application for managing and creating invoices. Available at [services.invoiceplane](options.html#opt-services.invoiceplane.enable).
+
 - [maddy](https://maddy.email), a composable all-in-one mail server. Available as [services.maddy](options.html#opt-services.maddy.enable).
 
 - [mtr-exporter](https://github.com/mgumz/mtr-exporter), a Prometheus exporter for mtr metrics. Available as [services.mtr-exporter](options.html#opt-services.mtr-exporter.enable).
@@ -114,6 +116,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - `pkgs.docbookrx` was removed since it's unmaintained
 
+- The options `networking.interfaces.<name>.ipv4.routes` and `networking.interfaces.<name>.ipv6.routes` are no longer ignored when using networkd instead of the default scripted network backend by setting `networking.useNetworkd` to `true`.
+
 - MultiMC has been replaced with the fork PolyMC due to upstream developers being hostile to 3rd party package maintainers. PolyMC removes all MultiMC branding and is aimed at providing proper 3rd party packages like the one contained in Nixpkgs. This change affects the data folder where game instances and other save and configuration files are stored. Users with existing installations should rename `~/.local/share/multimc` to `~/.local/share/polymc`. The main config file's path has also moved from `~/.local/share/multimc/multimc.cfg` to `~/.local/share/polymc/polymc.cfg`.
 
 - `pkgs.noto-fonts-cjk` is now deprecated in favor of `pkgs.noto-fonts-cjk-sans`
@@ -186,6 +190,9 @@ In addition to numerous new and upgraded packages, this release has the followin
   `services.xserver.enable`. This allows easy usage in non-X11 environments,
   e.g. Wayland.
 
+- [programs.ssh.knownHosts](#opt-programs.ssh.knownHosts) has gained an `extraHostNames`
+  option to replace `hostNames`. `hostNames` is deprecated, but still available for now.
+
 - The `services.stubby` module was converted to a [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
 
 - The option `services.duplicati.dataDir` has been added to allow changing the location of duplicati's files.

third_party/nixpkgs/nixos/lib/default.nix

@@ -0,0 +1,33 @@
+let
+  # The warning is in a top-level let binding so it is only printed once.
+  minimalModulesWarning = warn "lib.nixos.evalModules is experimental and subject to change. See nixos/lib/default.nix" null;
+  inherit (nonExtendedLib) warn;
+  nonExtendedLib = import ../../lib;
+in
+{ # Optional. Allows an extended `lib` to be used instead of the regular Nixpkgs lib.
+  lib ? nonExtendedLib,
+
+  # Feature flags allow you to opt in to unfinished code. These may change some
+  # behavior or disable warnings.
+  featureFlags ? {},
+
+  # This file itself is rather new, so we accept unknown parameters to be forward
+  # compatible. This is generally not recommended, because typos go undetected.
+  ...
+}:
+let
+  seqIf = cond: if cond then builtins.seq else a: b: b;
+  # If cond, force `a` before returning any attr
+  seqAttrsIf = cond: a: lib.mapAttrs (_: v: seqIf cond a v);
+
+  eval-config-minimal = import ./eval-config-minimal.nix { inherit lib; };
+in
+/*
+  This attribute set appears as lib.nixos in the flake, or can be imported
+  using a binding like `nixosLib = import (nixpkgs + "/nixos/lib") { }`.
+*/
+{
+  inherit (seqAttrsIf (!featureFlags?minimalModules) minimalModulesWarning eval-config-minimal)
+    evalModules
+    ;
+}

third_party/nixpkgs/nixos/lib/eval-config-minimal.nix

@@ -0,0 +1,49 @@
+
+# DO NOT IMPORT. Use nixpkgsFlake.lib.nixos, or import (nixpkgs + "/nixos/lib")
+{ lib }: # read -^
+
+let
+
+  /*
+    Invoke NixOS. Unlike traditional NixOS, this does not include all modules.
+    Any such modules have to be explicitly added via the `modules` parameter,
+    or imported using `imports` in a module.
+
+    A minimal module list improves NixOS evaluation performance and allows
+    modules to be independently usable, supporting new use cases.
+
+    Parameters:
+
+      modules:        A list of modules that constitute the configuration.
+
+      specialArgs:    An attribute set of module arguments. Unlike
+                      `config._module.args`, these are available for use in
+                      `imports`.
+                      `config._module.args` should be preferred when possible.
+
+    Return:
+
+      An attribute set containing `config.system.build.toplevel` among other
+      attributes. See `lib.evalModules` in the Nixpkgs library.
+
+   */
+  evalModules = {
+    prefix ? [],
+    modules ? [],
+    specialArgs ? {},
+  }:
+  # NOTE: Regular NixOS currently does use this function! Don't break it!
+  #       Ideally we don't diverge, unless we learn that we should.
+  #       In other words, only the public interface of nixos.evalModules
+  #       is experimental.
+  lib.evalModules {
+    inherit prefix modules;
+    specialArgs = {
+      modulesPath = builtins.toString ../modules;
+    } // specialArgs;
+  };
+
+in
+{
+  inherit evalModules;
+}

third_party/nixpkgs/nixos/lib/eval-config.nix

@@ -33,6 +33,12 @@ let pkgs_ = pkgs;
 in
 
 let
+  evalModulesMinimal = (import ./default.nix {
+    inherit lib;
+    # Implicit use of feature is noted in implementation.
+    featureFlags.minimalModules = { };
+  }).evalModules;
+
   pkgsModule = rec {
     _file = ./eval-config.nix;
     key = _file;
@@ -70,11 +76,9 @@ let
     };
   allUserModules = modules ++ legacyModules;
 
-  noUserModules = lib.evalModules ({
+  noUserModules = evalModulesMinimal ({
-    inherit prefix;
+    inherit prefix specialArgs;
     modules = baseModules ++ extraModules ++ [ pkgsModule modulesModule ];
-    specialArgs =
-      { modulesPath = builtins.toString ../modules; } // specialArgs;
   });
 
   # Extra arguments that are useful for constructing a similar configuration.

third_party/nixpkgs/nixos/modules/misc/nixpkgs.nix

@@ -64,6 +64,11 @@ let
 in
 
 {
+  imports = [
+    ./assertions.nix
+    ./meta.nix
+  ];
+
   options.nixpkgs = {
 
     pkgs = mkOption {

third_party/nixpkgs/nixos/modules/misc/nixpkgs/test.nix

@@ -0,0 +1,8 @@
+{ evalMinimalConfig, pkgs, lib, stdenv }:
+lib.recurseIntoAttrs {
+  invokeNixpkgsSimple =
+    (evalMinimalConfig ({ config, modulesPath, ... }: {
+      imports = [ (modulesPath + "/misc/nixpkgs.nix") ];
+      nixpkgs.system = stdenv.hostPlatform.system;
+    }))._module.args.pkgs.hello;
+}

third_party/nixpkgs/nixos/modules/module-list.nix

@@ -1022,6 +1022,7 @@
   ./services/web-apps/keycloak.nix
   ./services/web-apps/lemmy.nix
   ./services/web-apps/invidious.nix
+  ./services/web-apps/invoiceplane.nix
   ./services/web-apps/limesurvey.nix
   ./services/web-apps/mastodon.nix
   ./services/web-apps/mattermost.nix

third_party/nixpkgs/nixos/modules/programs/ssh.nix

@@ -17,7 +17,7 @@ let
       exec ${askPassword} "$@"
     '';
 
-  knownHosts = map (h: getAttr h cfg.knownHosts) (attrNames cfg.knownHosts);
+  knownHosts = attrValues cfg.knownHosts;
 
   knownHostsText = (flip (concatMapStringsSep "\n") knownHosts
     (h: assert h.hostNames != [];
@@ -142,7 +142,7 @@ in
 
       knownHosts = mkOption {
         default = {};
-        type = types.attrsOf (types.submodule ({ name, ... }: {
+        type = types.attrsOf (types.submodule ({ name, config, options, ... }: {
           options = {
             certAuthority = mkOption {
               type = types.bool;
@@ -154,12 +154,22 @@ in
             };
             hostNames = mkOption {
               type = types.listOf types.str;
-              default = [];
+              default = [ name ] ++ config.extraHostNames;
+              defaultText = literalExpression "[ ${name} ] ++ config.${options.extraHostNames}";
               description = ''
+                DEPRECATED, please use <literal>extraHostNames</literal>.
                 A list of host names and/or IP numbers used for accessing
                 the host's ssh service.
               '';
             };
+            extraHostNames = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              description = ''
+                A list of additional host names and/or IP numbers used for
+                accessing the host's ssh service.
+              '';
+            };
             publicKey = mkOption {
               default = null;
               type = types.nullOr types.str;
@@ -186,9 +196,6 @@ in
               '';
             };
           };
-          config = {
-            hostNames = mkDefault [ name ];
-          };
         }));
         description = ''
           The set of system-wide known SSH hosts.
@@ -196,13 +203,10 @@ in
         example = literalExpression ''
           {
             myhost = {
-              hostNames = [ "myhost" "myhost.mydomain.com" "10.10.1.4" ];
+              extraHostNames = [ "myhost.mydomain.com" "10.10.1.4" ];
               publicKeyFile = ./pubkeys/myhost_ssh_host_dsa_key.pub;
             };
-            myhost2 = {
+            "myhost2.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILIRuJ8p1Fi+m6WkHV0KWnRfpM1WxoW8XAS+XvsSKsTK";
-              hostNames = [ "myhost2" ];
-              publicKeyFile = ./pubkeys/myhost2_ssh_host_dsa_key.pub;
-            };
           }
         '';
       };
@@ -275,6 +279,9 @@ in
         message = "knownHost ${name} must contain either a publicKey or publicKeyFile";
       });
 
+    warnings = mapAttrsToList (name: _: ''programs.ssh.knownHosts.${name}.hostNames is deprecated, use programs.ssh.knownHosts.${name}.extraHostNames'')
+      (filterAttrs (name: {hostNames, extraHostNames, ...}: hostNames != [ name ] ++ extraHostNames) cfg.knownHosts);
+
     # SSH configuration. Slight duplication of the sshd_config
     # generation in the sshd service.
     environment.etc."ssh/ssh_config".text =

third_party/nixpkgs/nixos/modules/services/backup/borgbackup.nix

@@ -336,7 +336,7 @@ in {
             default = false;
             type = types.bool;
             example = true;
-            description = literalDocBook ''
+            description = ''
               Set the <literal>persistentTimer</literal> option for the
               <citerefentry><refentrytitle>systemd.timer</refentrytitle>
               <manvolnum>5</manvolnum></citerefentry>

third_party/nixpkgs/nixos/modules/services/misc/gitea.nix

@@ -177,6 +177,19 @@ in
           defaultText = literalExpression ''"''${config.${opt.stateDir}}/dump"'';
           description = "Path to the dump files.";
         };
+
+        type = mkOption {
+          type = types.enum [ "zip" "rar" "tar" "sz" "tar.gz" "tar.xz" "tar.bz2" "tar.br" "tar.lz4" ];
+          default = "zip";
+          description = "Archive format used to store the dump file.";
+        };
+
+        file = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = "Filename to be used for the dump. If `null` a default name is choosen by gitea.";
+          example = "gitea-dump";
+        };
       };
 
       ssh = {
@@ -634,7 +647,7 @@ in
        serviceConfig = {
          Type = "oneshot";
          User = cfg.user;
-         ExecStart = "${gitea}/bin/gitea dump";
+         ExecStart = "${gitea}/bin/gitea dump --type ${cfg.dump.type}" + optionalString (cfg.dump.file != null) " --file ${cfg.dump.file}";
          WorkingDirectory = cfg.dump.backupDir;
        };
     };

third_party/nixpkgs/nixos/modules/services/networking/bind.nix

@@ -59,7 +59,7 @@ let
         listen-on-v6 { ${concatMapStrings (entry: " ${entry}; ") cfg.listenOnIpv6} };
         allow-query { cachenetworks; };
         blackhole { badnetworks; };
-        forward first;
+        forward ${cfg.forward};
         forwarders { ${concatMapStrings (entry: " ${entry}; ") cfg.forwarders} };
         directory "${cfg.directory}";
         pid-file "/run/named/named.pid";
@@ -151,6 +151,14 @@ in
         ";
       };
 
+      forward = mkOption {
+        default = "first";
+        type = types.enum ["first" "only"];
+        description = "
+          Whether to forward 'first' (try forwarding but lookup directly if forwarding fails) or 'only'.
+        ";
+      };
+
       listenOn = mkOption {
         default = [ "any" ];
         type = types.listOf types.str;

third_party/nixpkgs/nixos/modules/services/networking/ssh/sshd.nix

@@ -30,7 +30,7 @@ let
 
     options.openssh.authorizedKeys = {
       keys = mkOption {
-        type = types.listOf types.str;
+        type = types.listOf types.singleLineStr;
         default = [];
         description = ''
           A list of verbatim OpenSSH public keys that should be added to the

third_party/nixpkgs/nixos/modules/services/web-apps/invoiceplane.nix

@@ -0,0 +1,305 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.invoiceplane;
+  eachSite = cfg.sites;
+  user = "invoiceplane";
+  webserver = config.services.${cfg.webserver};
+
+  invoiceplane-config = hostName: cfg: pkgs.writeText "ipconfig.php" ''
+    IP_URL=http://${hostName}
+    ENABLE_DEBUG=false
+    DISABLE_SETUP=false
+    REMOVE_INDEXPHP=false
+    DB_HOSTNAME=${cfg.database.host}
+    DB_USERNAME=${cfg.database.user}
+    # NOTE: file_get_contents adds newline at the end of returned string
+    DB_PASSWORD=${if cfg.database.passwordFile == null then "" else "trim(file_get_contents('${cfg.database.passwordFile}'), \"\\r\\n\")"}
+    DB_DATABASE=${cfg.database.name}
+    DB_PORT=${toString cfg.database.port}
+    SESS_EXPIRATION=864000
+    ENABLE_INVOICE_DELETION=false
+    DISABLE_READ_ONLY=false
+    ENCRYPTION_KEY=
+    ENCRYPTION_CIPHER=AES-256
+    SETUP_COMPLETED=false
+  '';
+
+  extraConfig = hostName: cfg: pkgs.writeText "extraConfig.php" ''
+    ${toString cfg.extraConfig}
+  '';
+
+  pkg = hostName: cfg: pkgs.stdenv.mkDerivation rec {
+    pname = "invoiceplane-${hostName}";
+    version = src.version;
+    src = pkgs.invoiceplane;
+
+    patchPhase = ''
+      # Patch index.php file to load additional config file
+      substituteInPlace index.php \
+        --replace "require('vendor/autoload.php');" "require('vendor/autoload.php'); \$dotenv = new \Dotenv\Dotenv(__DIR__, 'extraConfig.php'); \$dotenv->load();";
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp -r * $out/
+
+      # symlink uploads and log directories
+      rm -r $out/uploads $out/application/logs $out/vendor/mpdf/mpdf/tmp
+      ln -sf ${cfg.stateDir}/uploads $out/
+      ln -sf ${cfg.stateDir}/logs $out/application/
+      ln -sf ${cfg.stateDir}/tmp $out/vendor/mpdf/mpdf/
+
+      # symlink the InvoicePlane config
+      ln -s ${cfg.stateDir}/ipconfig.php $out/ipconfig.php
+
+      # symlink the extraConfig file
+      ln -s ${extraConfig hostName cfg} $out/extraConfig.php
+
+      # symlink additional templates
+      ${concatMapStringsSep "\n" (template: "cp -r ${template}/. $out/application/views/invoice_templates/pdf/") cfg.invoiceTemplates}
+    '';
+  };
+
+  siteOpts = { lib, name, ... }:
+    {
+      options = {
+
+        enable = mkEnableOption "InvoicePlane web application";
+
+        stateDir = mkOption {
+          type = types.path;
+          default = "/var/lib/invoiceplane/${name}";
+          description = ''
+            This directory is used for uploads of attachements and cache.
+            The directory passed here is automatically created and permissions
+            adjusted as required.
+          '';
+        };
+
+        database = {
+          host = mkOption {
+            type = types.str;
+            default = "localhost";
+            description = "Database host address.";
+          };
+
+          port = mkOption {
+            type = types.port;
+            default = 3306;
+            description = "Database host port.";
+          };
+
+          name = mkOption {
+            type = types.str;
+            default = "invoiceplane";
+            description = "Database name.";
+          };
+
+          user = mkOption {
+            type = types.str;
+            default = "invoiceplane";
+            description = "Database user.";
+          };
+
+          passwordFile = mkOption {
+            type = types.nullOr types.path;
+            default = null;
+            example = "/run/keys/invoiceplane-dbpassword";
+            description = ''
+              A file containing the password corresponding to
+              <option>database.user</option>.
+            '';
+          };
+
+          createLocally = mkOption {
+            type = types.bool;
+            default = true;
+            description = "Create the database and database user locally.";
+          };
+        };
+
+        invoiceTemplates = mkOption {
+          type = types.listOf types.path;
+          default = [];
+          description = ''
+            List of path(s) to respective template(s) which are copied from the 'invoice_templates/pdf' directory.
+            <note><para>These templates need to be packaged before use, see example.</para></note>
+          '';
+          example = literalExpression ''
+            let
+              # Let's package an example template
+              template-vtdirektmarketing = pkgs.stdenv.mkDerivation {
+                name = "vtdirektmarketing";
+                # Download the template from a public repository
+                src = pkgs.fetchgit {
+                  url = "https://git.project-insanity.org/onny/invoiceplane-vtdirektmarketing.git";
+                  sha256 = "1hh0q7wzsh8v8x03i82p6qrgbxr4v5fb05xylyrpp975l8axyg2z";
+                };
+                sourceRoot = ".";
+                # Installing simply means copying template php file to the output directory
+                installPhase = ""
+                  mkdir -p $out
+                  cp invoiceplane-vtdirektmarketing/vtdirektmarketing.php $out/
+                "";
+              };
+            # And then pass this package to the template list like this:
+            in [ template-vtdirektmarketing ]
+          '';
+        };
+
+        poolConfig = mkOption {
+          type = with types; attrsOf (oneOf [ str int bool ]);
+          default = {
+            "pm" = "dynamic";
+            "pm.max_children" = 32;
+            "pm.start_servers" = 2;
+            "pm.min_spare_servers" = 2;
+            "pm.max_spare_servers" = 4;
+            "pm.max_requests" = 500;
+          };
+          description = ''
+            Options for the InvoicePlane PHP pool. See the documentation on <literal>php-fpm.conf</literal>
+            for details on configuration directives.
+          '';
+        };
+
+        extraConfig = mkOption {
+          type = types.nullOr types.lines;
+          default = null;
+          example = ''
+            SETUP_COMPLETED=true
+            DISABLE_SETUP=true
+            IP_URL=https://invoice.example.com
+          '';
+          description = ''
+            InvoicePlane configuration. Refer to
+            <link xlink:href="https://github.com/InvoicePlane/InvoicePlane/blob/master/ipconfig.php.example"/>
+            for details on supported values.
+          '';
+        };
+
+      };
+
+    };
+in
+{
+  # interface
+  options = {
+    services.invoiceplane = mkOption {
+      type = types.submodule {
+
+        options.sites = mkOption {
+          type = types.attrsOf (types.submodule siteOpts);
+          default = {};
+          description = "Specification of one or more WordPress sites to serve";
+        };
+
+        options.webserver = mkOption {
+          type = types.enum [ "caddy" ];
+          default = "caddy";
+          description = ''
+            Which webserver to use for virtual host management. Currently only
+            caddy is supported.
+          '';
+        };
+      };
+      default = {};
+      description = "InvoicePlane configuration.";
+    };
+
+  };
+
+  # implementation
+  config = mkIf (eachSite != {}) (mkMerge [{
+
+    assertions = flatten (mapAttrsToList (hostName: cfg:
+      [{ assertion = cfg.database.createLocally -> cfg.database.user == user;
+        message = ''services.invoiceplane.sites."${hostName}".database.user must be ${user} if the database is to be automatically provisioned'';
+      }
+      { assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+        message = ''services.invoiceplane.sites."${hostName}".database.passwordFile cannot be specified if services.invoiceplane.sites."${hostName}".database.createLocally is set to true.'';
+      }]
+    ) eachSite);
+
+    services.mysql = mkIf (any (v: v.database.createLocally) (attrValues eachSite)) {
+      enable = true;
+      package = mkDefault pkgs.mariadb;
+      ensureDatabases = mapAttrsToList (hostName: cfg: cfg.database.name) eachSite;
+      ensureUsers = mapAttrsToList (hostName: cfg:
+        { name = cfg.database.user;
+          ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
+        }
+      ) eachSite;
+    };
+
+    services.phpfpm = {
+      phpPackage = pkgs.php74;
+      pools = mapAttrs' (hostName: cfg: (
+        nameValuePair "invoiceplane-${hostName}" {
+          inherit user;
+          group = webserver.group;
+          settings = {
+            "listen.owner" = webserver.user;
+            "listen.group" = webserver.group;
+          } // cfg.poolConfig;
+        }
+      )) eachSite;
+    };
+
+  }
+
+  {
+    systemd.tmpfiles.rules = flatten (mapAttrsToList (hostName: cfg: [
+      "d ${cfg.stateDir} 0750 ${user} ${webserver.group} - -"
+      "f ${cfg.stateDir}/ipconfig.php 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/logs 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/uploads 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/uploads/archive 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/uploads/customer_files 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/uploads/temp 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/uploads/temp/mpdf 0750 ${user} ${webserver.group} - -"
+      "d ${cfg.stateDir}/tmp 0750 ${user} ${webserver.group} - -"
+    ]) eachSite);
+
+    systemd.services.invoiceplane-config = {
+      serviceConfig.Type = "oneshot";
+      script = concatStrings (mapAttrsToList (hostName: cfg:
+        ''
+          mkdir -p ${cfg.stateDir}/logs \
+                   ${cfg.stateDir}/uploads
+          if ! grep -q IP_URL "${cfg.stateDir}/ipconfig.php"; then
+            cp "${invoiceplane-config hostName cfg}" "${cfg.stateDir}/ipconfig.php"
+          fi
+        '') eachSite);
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    users.users.${user} = {
+      group = webserver.group;
+      isSystemUser = true;
+    };
+  }
+
+  (mkIf (cfg.webserver == "caddy") {
+    services.caddy = {
+      enable = true;
+      virtualHosts = mapAttrs' (hostName: cfg: (
+        nameValuePair "http://${hostName}" {
+          extraConfig = ''
+            root    * ${pkg hostName cfg}
+            file_server
+
+            php_fastcgi unix/${config.services.phpfpm.pools."invoiceplane-${hostName}".socket}
+          '';
+        }
+      )) eachSite;
+    };
+  })
+
+
+  ]);
+}
+

third_party/nixpkgs/nixos/modules/services/web-apps/nextcloud.nix

@@ -505,6 +505,12 @@ in {
         The nextcloud-occ program preconfigured to target this Nextcloud instance.
       '';
     };
+
+    nginx.recommendedHttpHeaders = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Enable additional recommended HTTP response headers";
+    };
   };
 
   config = mkIf cfg.enable (mkMerge [
@@ -904,6 +910,7 @@ in {
         };
         extraConfig = ''
           index index.php index.html /index.php$request_uri;
+          ${optionalString (cfg.nginx.recommendedHttpHeaders) ''
             add_header X-Content-Type-Options nosniff;
             add_header X-XSS-Protection "1; mode=block";
             add_header X-Robots-Tag none;
@@ -912,6 +919,7 @@ in {
             add_header X-Frame-Options sameorigin;
             add_header Referrer-Policy no-referrer;
             add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+          ''}
           client_max_body_size ${cfg.maxUploadSize};
           fastcgi_buffers 64 4K;
           fastcgi_hide_header X-Powered-By;

third_party/nixpkgs/nixos/modules/services/x11/window-managers/xmonad.nix

@@ -2,7 +2,7 @@
 
 with lib;
 let
-  inherit (lib) mkOption mkIf optionals literalExpression;
+  inherit (lib) mkOption mkIf optionals literalExpression optionalString;
   cfg = config.services.xserver.windowManager.xmonad;
 
   ghcWithPackages = cfg.haskellPackages.ghcWithPackages;
@@ -26,11 +26,14 @@ let
     in
       pkgs.runCommandLocal "xmonad" {
         nativeBuildInputs = [ pkgs.makeWrapper ];
-      } ''
+      } (''
         install -D ${xmonadEnv}/share/man/man1/xmonad.1.gz $out/share/man/man1/xmonad.1.gz
         makeWrapper ${configured}/bin/xmonad $out/bin/xmonad \
+      '' + optionalString cfg.enableConfiguredRecompile ''
+          --set NIX_GHC "${xmonadEnv}/bin/ghc" \
+      '' + ''
           --set XMONAD_XMESSAGE "${pkgs.xorg.xmessage}/bin/xmessage"
-      '';
+      '');
 
   xmonad = if (cfg.config != null) then xmonad-config else xmonad-vanilla;
 in {
@@ -95,12 +98,14 @@ in {
           xmonad from PATH. This allows e.g. switching to the new xmonad binary
           after rebuilding your system with nixos-rebuild.
           For the same reason, ghc is not added to the environment when this
-          option is set.
+          option is set, unless <option>enableConfiguredRecompile</option> is
+          set to <literal>true</literal>.
 
           If you actually want to run xmonad with a config specified here, but
           also be able to recompile and restart it from a copy of that source in
-          $HOME/.xmonad on the fly, you will have to implement that yourself
+          $HOME/.xmonad on the fly, set <option>enableConfiguredRecompile</option>
-          using something like "compileRestart" from the example.
+          to <literal>true</literal> and implement something like "compileRestart"
+          from the example.
           This should allow you to switch at will between the local xmonad and
           the one NixOS puts in your PATH.
         '';
@@ -116,6 +121,29 @@ in {
 
           compiledConfig = printf "xmonad-%s-%s" arch os
 
+          myConfig = defaultConfig
+            { modMask = mod4Mask -- Use Super instead of Alt
+            , terminal = "urxvt" }
+            `additionalKeys`
+            [ ( (mod4Mask,xK_r), compileRestart True)
+            , ( (mod4Mask,xK_q), restart "xmonad" True ) ]
+
+          --------------------------------------------
+          {- version 0.17.0 -}
+          --------------------------------------------
+          -- compileRestart resume =
+          --   dirs <- io getDirectories
+          --   whenX (recompile dirs True) $
+          --     when resume writeStateToFile
+          --       *> catchIO
+          --         ( do
+          --             args <- getArgs
+          --             executeFile (cacheDir dirs </> compiledConfig) False args Nothing
+          --         )
+          --
+          -- main = getDirectories >>= launch myConfig
+          --------------------------------------------
+
           compileRestart resume =
             whenX (recompile True) $
               when resume writeStateToFile
@@ -126,12 +154,17 @@ in {
                       executeFile (dir </> compiledConfig) False args Nothing
                   )
 
-          main = launch defaultConfig
+          main = launch myConfig
-              { modMask = mod4Mask -- Use Super instead of Alt
+        '';
-              , terminal = "urxvt" }
+      };
-              `additionalKeys`
+
-              [ ( (mod4Mask,xK_r), compileRestart True)
+      enableConfiguredRecompile = mkOption {
-              , ( (mod4Mask,xK_q), restart "xmonad" True ) ]
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Enable recompilation even if <option>config</option> is set to a
+          non-null value. This adds the necessary Haskell dependencies (GHC with
+          packages) to the xmonad binary's environment.
         '';
       };
 

third_party/nixpkgs/nixos/modules/system/activation/activation-script.nix

@@ -56,6 +56,7 @@ let
       ln -sfn "$(readlink -f "$systemConfig")" /run/current-system
 
       # Prevent the current configuration from being garbage-collected.
+      mkdir -p /nix/var/nix/gcroots
       ln -sfn /run/current-system /nix/var/nix/gcroots/current-system
 
       exit $_status

third_party/nixpkgs/nixos/modules/system/activation/top-level.nix

@@ -148,7 +148,7 @@ in
     system.build = mkOption {
       internal = true;
       default = {};
-      type = types.lazyAttrsOf types.unspecified;
+      type = with types; lazyAttrsOf (uniq unspecified);
       description = ''
         Attribute set of derivations used to setup the system.
       '';

third_party/nixpkgs/nixos/modules/system/boot/networkd.nix

@@ -513,7 +513,7 @@ let
         (assertValueOneOf "EmitLLDP" (boolValues ++ ["nearest-bridge" "non-tpmr-bridge" "customer-bridge"]))
         (assertValueOneOf "DNSDefaultRoute" boolValues)
         (assertValueOneOf "IPForward" (boolValues ++ ["ipv4" "ipv6"]))
-        (assertValueOneOf "IPMasquerade" boolValues)
+        (assertValueOneOf "IPMasquerade" (boolValues ++ ["ipv4" "ipv6" "both"]))
         (assertValueOneOf "IPv6PrivacyExtensions" (boolValues ++ ["prefer-public" "kernel"]))
         (assertValueOneOf "IPv6AcceptRA" boolValues)
         (assertInt "IPv6DuplicateAddressDetection")

third_party/nixpkgs/nixos/modules/system/boot/stage-1-init.sh

@@ -81,16 +81,20 @@ ln -s /proc/mounts /etc/mtab # to shut up mke2fs
 touch /etc/udev/hwdb.bin # to shut up udev
 touch /etc/initrd-release
 
-# Function for waiting a device to appear.
+# Function for waiting for device(s) to appear.
 waitDevice() {
     local device="$1"
+    # Split device string using ':' as a delimiter as bcachefs
+    # uses this for multi-device filesystems, i.e. /dev/sda1:/dev/sda2:/dev/sda3
+    local IFS=':'
 
     # USB storage devices tend to appear with some delay.  It would be
     # great if we had a way to synchronously wait for them, but
     # alas...  So just wait for a few seconds for the device to
     # appear.
-    if test ! -e $device; then
+    for dev in $device; do
-        echo -n "waiting for device $device to appear..."
+        if test ! -e $dev; then
+            echo -n "waiting for device $dev to appear..."
             try=20
             while [ $try -gt 0 ]; do
                 sleep 1
@@ -98,13 +102,14 @@ waitDevice() {
                 lvm vgchange -ay
                 # and tell udev to create nodes for the new LVs
                 udevadm trigger --action=add
-            if test -e $device; then break; fi
+                if test -e $dev; then break; fi
                 echo -n "."
                 try=$((try - 1))
             done
             echo
             [ $try -ne 0 ]
         fi
+    done
 }
 
 # Mount special file systems.

third_party/nixpkgs/nixos/modules/tasks/network-interfaces-systemd.nix

@@ -12,6 +12,10 @@ let
     i.ipv4.addresses
     ++ optionals cfg.enableIPv6 i.ipv6.addresses;
 
+  interfaceRoutes = i:
+    i.ipv4.routes
+    ++ optionals cfg.enableIPv6 i.ipv6.routes;
+
   dhcpStr = useDHCP: if useDHCP == true || useDHCP == null then "yes" else "no";
 
   slaves =
@@ -88,12 +92,69 @@ in
             };
           };
         });
-        networks."40-${i.name}" = mkMerge [ (genericNetwork mkDefault) {
+        networks."40-${i.name}" = mkMerge [ (genericNetwork id) {
           name = mkDefault i.name;
           DHCP = mkForce (dhcpStr
             (if i.useDHCP != null then i.useDHCP else false));
           address = forEach (interfaceIps i)
             (ip: "${ip.address}/${toString ip.prefixLength}");
+          routes = forEach (interfaceRoutes i)
+            (route: {
+              # Most of these route options have not been tested.
+              # Please fix or report any mistakes you may find.
+              routeConfig =
+                optionalAttrs (route.prefixLength > 0) {
+                  Destination = "${route.address}/${toString route.prefixLength}";
+                } //
+                optionalAttrs (route.options ? fastopen_no_cookie) {
+                  FastOpenNoCookie = route.options.fastopen_no_cookie;
+                } //
+                optionalAttrs (route.via != null) {
+                  Gateway = route.via;
+                } //
+                optionalAttrs (route.options ? onlink) {
+                  GatewayOnLink = true;
+                } //
+                optionalAttrs (route.options ? initrwnd) {
+                  InitialAdvertisedReceiveWindow = route.options.initrwnd;
+                } //
+                optionalAttrs (route.options ? initcwnd) {
+                  InitialCongestionWindow = route.options.initcwnd;
+                } //
+                optionalAttrs (route.options ? pref) {
+                  IPv6Preference = route.options.pref;
+                } //
+                optionalAttrs (route.options ? mtu) {
+                  MTUBytes = route.options.mtu;
+                } //
+                optionalAttrs (route.options ? metric) {
+                  Metric = route.options.metric;
+                } //
+                optionalAttrs (route.options ? src) {
+                  PreferredSource = route.options.src;
+                } //
+                optionalAttrs (route.options ? protocol) {
+                  Protocol = route.options.protocol;
+                } //
+                optionalAttrs (route.options ? quickack) {
+                  QuickAck = route.options.quickack;
+                } //
+                optionalAttrs (route.options ? scope) {
+                  Scope = route.options.scope;
+                } //
+                optionalAttrs (route.options ? from) {
+                  Source = route.options.from;
+                } //
+                optionalAttrs (route.options ? table) {
+                  Table = route.options.table;
+                } //
+                optionalAttrs (route.options ? advmss) {
+                  TCPAdvertisedMaximumSegmentSize = route.options.advmss;
+                } //
+                optionalAttrs (route.options ? ttl-propagate) {
+                  TTLPropagate = route.options.ttl-propagate == "enabled";
+                };
+            });
           networkConfig.IPv6PrivacyExtensions = "kernel";
           linkConfig = optionalAttrs (i.macAddress != null) {
             MACAddress = i.macAddress;

third_party/nixpkgs/nixos/modules/tasks/network-interfaces.nix

@@ -103,6 +103,11 @@ let
         description = ''
           Other route options. See the symbol <literal>OPTIONS</literal>
           in the <literal>ip-route(8)</literal> manual page for the details.
+          You may also specify <literal>metric</literal>,
+          <literal>src</literal>, <literal>protocol</literal>,
+          <literal>scope</literal>, <literal>from</literal>
+          and <literal>table</literal>, which are technically
+          not route options, in the sense used in the manual.
         '';
       };
 
@@ -208,6 +213,14 @@ let
         type = with types; listOf (submodule (routeOpts 4));
         description = ''
           List of extra IPv4 static routes that will be assigned to the interface.
+          <warning><para>If the route type is the default <literal>unicast</literal>, then the scope
+          is set differently depending on the value of <option>networking.useNetworkd</option>:
+          the script-based backend sets it to <literal>link</literal>, while networkd sets
+          it to <literal>global</literal>.</para></warning>
+          If you want consistency between the two implementations,
+          set the scope of the route manually with
+          <literal>networking.interfaces.eth0.ipv4.routes = [{ options.scope = "global"; }]</literal>
+          for example.
         '';
       };
 

third_party/nixpkgs/nixos/modules/virtualisation/container-config.nix

@@ -18,7 +18,7 @@ with lib;
     services.openssh.startWhenNeeded = mkDefault true;
 
     # Shut up warnings about not having a boot loader.
-    system.build.installBootLoader = "${pkgs.coreutils}/bin/true";
+    system.build.installBootLoader = lib.mkDefault "${pkgs.coreutils}/bin/true";
 
     # Not supported in systemd-nspawn containers.
     security.audit.enable = false;

third_party/nixpkgs/nixos/tests/all-tests.nix

@@ -19,6 +19,13 @@ let
   handleTestOn = systems: path: args:
     if elem system systems then handleTest path args
     else {};
+
+  nixosLib = import ../lib {
+    # Experimental features need testing too, but there's no point in warning
+    # about it, so we enable the feature flag.
+    featureFlags.minimalModules = {};
+  };
+  evalMinimalConfig = module: nixosLib.evalModules { modules = [ module ]; };
 in
 {
   _3proxy = handleTest ./3proxy.nix {};
@@ -208,6 +215,7 @@ in
   initrd-secrets = handleTest ./initrd-secrets.nix {};
   inspircd = handleTest ./inspircd.nix {};
   installer = handleTest ./installer.nix {};
+  invoiceplane = handleTest ./invoiceplane.nix {};
   iodine = handleTest ./iodine.nix {};
   ipfs = handleTest ./ipfs.nix {};
   ipv6 = handleTest ./ipv6.nix {};
@@ -331,6 +339,7 @@ in
   nix-serve-ssh = handleTest ./nix-serve-ssh.nix {};
   nixops = handleTest ./nixops/default.nix {};
   nixos-generate-config = handleTest ./nixos-generate-config.nix {};
+  nixpkgs = pkgs.callPackage ../modules/misc/nixpkgs/test.nix { inherit evalMinimalConfig; };
   node-red = handleTest ./node-red.nix {};
   nomad = handleTest ./nomad.nix {};
   novacomd = handleTestOn ["x86_64-linux"] ./novacomd.nix {};

third_party/nixpkgs/nixos/tests/gnome.nix

@@ -18,8 +18,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
           enable = true;
           user = "alice";
         };
-        # Catch GDM failures that don't happen with AutomaticLoginEnable, e.g. https://github.com/NixOS/nixpkgs/issues/149539
-        gdm.autoLogin.delay = 1;
       };
 
       services.xserver.desktopManager.gnome.enable = true;

third_party/nixpkgs/nixos/tests/invoiceplane.nix

@@ -0,0 +1,82 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+{
+  name = "invoiceplane";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      onny
+    ];
+  };
+
+  nodes = {
+    invoiceplane_caddy = { ... }: {
+      services.invoiceplane.webserver = "caddy";
+      services.invoiceplane.sites = {
+        "site1.local" = {
+          #database.name = "invoiceplane1";
+          database.createLocally = true;
+          enable = true;
+        };
+        "site2.local" = {
+          #database.name = "invoiceplane2";
+          database.createLocally = true;
+          enable = true;
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [ 80 ];
+      networking.hosts."127.0.0.1" = [ "site1.local" "site2.local" ];
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    invoiceplane_caddy.wait_for_unit("caddy")
+    invoiceplane_caddy.wait_for_open_port(80)
+    invoiceplane_caddy.wait_for_open_port(3306)
+
+    site_names = ["site1.local", "site2.local"]
+
+    for site_name in site_names:
+        machine.wait_for_unit(f"phpfpm-invoiceplane-{site_name}")
+
+        with subtest("Website returns welcome screen"):
+            assert "Please install InvoicePlane" in machine.succeed(f"curl -L {site_name}")
+
+        with subtest("Finish InvoicePlane setup"):
+          machine.succeed(
+            f"curl -sSfL --cookie-jar cjar {site_name}/index.php/setup/language"
+          )
+          csrf_token = machine.succeed(
+            "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+          )
+          machine.succeed(
+            f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&ip_lang=english&btn_continue=Continue' {site_name}/index.php/setup/language"
+          )
+          csrf_token = machine.succeed(
+            "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+          )
+          machine.succeed(
+            f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/index.php/setup/prerequisites"
+          )
+          csrf_token = machine.succeed(
+            "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+          )
+          machine.succeed(
+            f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/index.php/setup/configure_database"
+          )
+          csrf_token = machine.succeed(
+            "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+          )
+          machine.succeed(
+            f"curl -sSfl --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/index.php/setup/install_tables"
+          )
+          csrf_token = machine.succeed(
+            "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+          )
+          machine.succeed(
+            f"curl -sSfl --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/index.php/setup/upgrade_tables"
+          )
+  '';
+})

third_party/nixpkgs/nixos/tests/k3s-single-node-docker.nix

@@ -0,0 +1,84 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+  let
+    imageEnv = pkgs.buildEnv {
+      name = "k3s-pause-image-env";
+      paths = with pkgs; [ tini (hiPrio coreutils) busybox ];
+    };
+    pauseImage = pkgs.dockerTools.streamLayeredImage {
+      name = "test.local/pause";
+      tag = "local";
+      contents = imageEnv;
+      config.Entrypoint = [ "/bin/tini" "--" "/bin/sleep" "inf" ];
+    };
+    # Don't use the default service account because there's a race where it may
+    # not be created yet; make our own instead.
+    testPodYaml = pkgs.writeText "test.yml" ''
+      apiVersion: v1
+      kind: ServiceAccount
+      metadata:
+        name: test
+      ---
+      apiVersion: v1
+      kind: Pod
+      metadata:
+        name: test
+      spec:
+        serviceAccountName: test
+        containers:
+        - name: test
+          image: test.local/pause:local
+          imagePullPolicy: Never
+          command: ["sh", "-c", "sleep inf"]
+    '';
+  in
+  {
+    name = "k3s";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ euank ];
+    };
+
+    machine = { pkgs, ... }: {
+      environment.systemPackages = with pkgs; [ k3s gzip ];
+
+      # k3s uses enough resources the default vm fails.
+      virtualisation.memorySize = 1536;
+      virtualisation.diskSize = 4096;
+
+      services.k3s = {
+        enable = true;
+        role = "server";
+        docker = true;
+        # Slightly reduce resource usage
+        extraFlags = "--no-deploy coredns,servicelb,traefik,local-storage,metrics-server --pause-image test.local/pause:local";
+      };
+
+      users.users = {
+        noprivs = {
+          isNormalUser = true;
+          description = "Can't access k3s by default";
+          password = "*";
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      machine.wait_for_unit("k3s")
+      machine.succeed("k3s kubectl cluster-info")
+      machine.fail("sudo -u noprivs k3s kubectl cluster-info")
+      # FIXME: this fails with the current nixos kernel config; once it passes, we should uncomment it
+      # machine.succeed("k3s check-config")
+
+      machine.succeed(
+          "${pauseImage} | docker load"
+      )
+
+      machine.succeed("k3s kubectl apply -f ${testPodYaml}")
+      machine.succeed("k3s kubectl wait --for 'condition=Ready' pod/test")
+      machine.succeed("k3s kubectl delete -f ${testPodYaml}")
+
+      machine.shutdown()
+    '';
+  })

third_party/nixpkgs/nixos/tests/k3s-single-node.nix

@@ -0,0 +1,82 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+  let
+    imageEnv = pkgs.buildEnv {
+      name = "k3s-pause-image-env";
+      paths = with pkgs; [ tini (hiPrio coreutils) busybox ];
+    };
+    pauseImage = pkgs.dockerTools.streamLayeredImage {
+      name = "test.local/pause";
+      tag = "local";
+      contents = imageEnv;
+      config.Entrypoint = [ "/bin/tini" "--" "/bin/sleep" "inf" ];
+    };
+    # Don't use the default service account because there's a race where it may
+    # not be created yet; make our own instead.
+    testPodYaml = pkgs.writeText "test.yml" ''
+      apiVersion: v1
+      kind: ServiceAccount
+      metadata:
+        name: test
+      ---
+      apiVersion: v1
+      kind: Pod
+      metadata:
+        name: test
+      spec:
+        serviceAccountName: test
+        containers:
+        - name: test
+          image: test.local/pause:local
+          imagePullPolicy: Never
+          command: ["sh", "-c", "sleep inf"]
+    '';
+  in
+  {
+    name = "k3s";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ euank ];
+    };
+
+    machine = { pkgs, ... }: {
+      environment.systemPackages = with pkgs; [ k3s gzip ];
+
+      # k3s uses enough resources the default vm fails.
+      virtualisation.memorySize = 1536;
+      virtualisation.diskSize = 4096;
+
+      services.k3s.enable = true;
+      services.k3s.role = "server";
+      services.k3s.package = pkgs.k3s;
+      # Slightly reduce resource usage
+      services.k3s.extraFlags = "--no-deploy coredns,servicelb,traefik,local-storage,metrics-server --pause-image test.local/pause:local";
+
+      users.users = {
+        noprivs = {
+          isNormalUser = true;
+          description = "Can't access k3s by default";
+          password = "*";
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      machine.wait_for_unit("k3s")
+      machine.succeed("k3s kubectl cluster-info")
+      machine.fail("sudo -u noprivs k3s kubectl cluster-info")
+      # FIXME: this fails with the current nixos kernel config; once it passes, we should uncomment it
+      # machine.succeed("k3s check-config")
+
+      machine.succeed(
+          "${pauseImage} | k3s ctr image import -"
+      )
+
+      machine.succeed("k3s kubectl apply -f ${testPodYaml}")
+      machine.succeed("k3s kubectl wait --for 'condition=Ready' pod/test")
+      machine.succeed("k3s kubectl delete -f ${testPodYaml}")
+
+      machine.shutdown()
+    '';
+  })

third_party/nixpkgs/nixos/tests/k3s.nix

@@ -1,78 +0,0 @@
-import ./make-test-python.nix ({ pkgs, ... }:
-
-let
-  # A suitable k3s pause image, also used for the test pod
-  pauseImage = pkgs.dockerTools.buildImage {
-    name = "test.local/pause";
-    tag = "local";
-    contents = with pkgs; [ tini coreutils busybox ];
-    config.Entrypoint = [ "/bin/tini" "--" "/bin/sleep" "inf" ];
-  };
-  testPodYaml = pkgs.writeText "test.yml" ''
-    # Don't use the default service account because there's a race where it may
-    # not be created yet; make our own instead.
-    apiVersion: v1
-    kind: ServiceAccount
-    metadata:
-      name: test
-    ---
-    apiVersion: v1
-    kind: Pod
-    metadata:
-      name: test
-    spec:
-      serviceAccountName: test
-      containers:
-      - name: test
-        image: test.local/pause:local
-        imagePullPolicy: Never
-        command: ["sh", "-c", "sleep inf"]
-  '';
-in
-{
-  name = "k3s";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ euank ];
-  };
-
-  nodes = {
-    k3s =
-      { pkgs, ... }: {
-        environment.systemPackages = [ pkgs.k3s pkgs.gzip ];
-
-        # k3s uses enough resources the default vm fails.
-        virtualisation.memorySize = pkgs.lib.mkDefault 1536;
-        virtualisation.diskSize = pkgs.lib.mkDefault 4096;
-
-        services.k3s.enable = true;
-        services.k3s.role = "server";
-        services.k3s.package = pkgs.k3s;
-        # Slightly reduce resource usage
-        services.k3s.extraFlags = "--no-deploy coredns,servicelb,traefik,local-storage,metrics-server --pause-image test.local/pause:local";
-
-        users.users = {
-          noprivs = {
-            isNormalUser = true;
-            description = "Can't access k3s by default";
-            password = "*";
-          };
-        };
-      };
-  };
-
-  testScript = ''
-    start_all()
-
-    k3s.wait_for_unit("k3s")
-    k3s.succeed("k3s kubectl cluster-info")
-    k3s.fail("sudo -u noprivs k3s kubectl cluster-info")
-    # k3s.succeed("k3s check-config") # fails with the current nixos kernel config, uncomment once this passes
-
-    k3s.succeed(
-        "zcat ${pauseImage} | k3s ctr image import -"
-    )
-
-    k3s.succeed("k3s kubectl apply -f ${testPodYaml}")
-    k3s.succeed("k3s kubectl wait --for 'condition=Ready' pod/test")
-  '';
-})

third_party/nixpkgs/nixos/tests/networking.nix

@@ -740,6 +740,7 @@ let
     routes = {
       name = "routes";
       machine = {
+        networking.useNetworkd = networkd;
         networking.useDHCP = false;
         networking.interfaces.eth0 = {
           ipv4.addresses = [ { address = "192.168.1.2"; prefixLength = 24; } ];
@@ -749,7 +750,13 @@ let
             { address = "2001:1470:fffd:2098::"; prefixLength = 64; via = "fdfd:b3f0::1"; }
           ];
           ipv4.routes = [
-            { address = "10.0.0.0"; prefixLength = 16; options = { mtu = "1500"; }; }
+            { address = "10.0.0.0"; prefixLength = 16; options = {
+              mtu = "1500";
+              # Explicitly set scope because iproute and systemd-networkd
+              # disagree on what the scope should be
+              # if the type is the default "unicast"
+              scope = "link";
+            }; }
             { address = "192.168.2.0"; prefixLength = 24; via = "192.168.1.1"; }
           ];
         };
@@ -798,6 +805,7 @@ let
                 ipv6Table, targetIPv6Table
             )
 
+      '' + optionalString (!networkd) ''
         with subtest("test clean-up of the tables"):
             machine.succeed("systemctl stop network-addresses-eth0")
             ipv4Residue = machine.succeed("ip -4 route list dev eth0 | head -n-3").strip()

third_party/nixpkgs/nixos/tests/xmonad.nix

@@ -1,7 +1,58 @@
-import ./make-test-python.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...}:
+
+let
+  mkConfig = name: keys: ''
+    import XMonad
+    import XMonad.Operations (restart)
+    import XMonad.Util.EZConfig
+    import XMonad.Util.SessionStart
+    import Control.Monad (when)
+    import Text.Printf (printf)
+    import System.Posix.Process (executeFile)
+    import System.Info (arch,os)
+    import System.Environment (getArgs)
+    import System.FilePath ((</>))
+
+    main = launch $ def { startupHook = startup } `additionalKeysP` myKeys
+
+    startup = isSessionStart >>= \sessInit ->
+      spawn "touch /tmp/${name}"
+        >> if sessInit then setSessionStarted else spawn "xterm"
+
+    myKeys = [${builtins.concatStringsSep ", " keys}]
+
+    compiledConfig = printf "xmonad-%s-%s" arch os
+
+    compileRestart resume =
+      whenX (recompile True) $
+        when resume writeStateToFile
+          *> catchIO
+            ( do
+                dir <- getXMonadDataDir
+                args <- getArgs
+                executeFile (dir </> compiledConfig) False args Nothing
+            )
+  '';
+
+  oldKeys =
+    [ ''("M-C-x", spawn "xterm")''
+      ''("M-q", restart "xmonad" True)''
+      ''("M-C-q", compileRestart True)''
+      ''("M-C-t", spawn "touch /tmp/somefile")'' # create somefile
+    ];
+
+  newKeys =
+    [ ''("M-C-x", spawn "xterm")''
+      ''("M-q", restart "xmonad" True)''
+      ''("M-C-q", compileRestart True)''
+      ''("M-C-r", spawn "rm /tmp/somefile")'' # delete somefile
+    ];
+
+  newConfig = pkgs.writeText "xmonad.hs" (mkConfig "newXMonad" newKeys);
+in {
   name = "xmonad";
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ nequissimus ];
+    maintainers = [ nequissimus ivanbrennan ];
   };
 
   machine = { pkgs, ... }: {
@@ -10,21 +61,10 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     services.xserver.displayManager.defaultSession = "none+xmonad";
     services.xserver.windowManager.xmonad = {
       enable = true;
+      enableConfiguredRecompile = true;
       enableContribAndExtras = true;
       extraPackages = with pkgs.haskellPackages; haskellPackages: [ xmobar ];
-      config = ''
+      config = mkConfig "oldXMonad" oldKeys;
-        import XMonad
-        import XMonad.Operations (restart)
-        import XMonad.Util.EZConfig
-        import XMonad.Util.SessionStart
-
-        main = launch $ def { startupHook = startup } `additionalKeysP` myKeys
-
-        startup = isSessionStart >>= \sessInit ->
-          if sessInit then setSessionStarted else spawn "xterm"
-
-        myKeys = [ ("M-C-x", spawn "xterm"), ("M-q", restart "xmonad" True) ]
-      '';
     };
   };
 
@@ -38,10 +78,37 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     machine.wait_for_window("${user.name}.*machine")
     machine.sleep(1)
     machine.screenshot("terminal1")
+    machine.succeed("rm /tmp/oldXMonad")
     machine.send_key("alt-q")
-    machine.sleep(3)
+    machine.wait_for_file("/tmp/oldXMonad")
     machine.wait_for_window("${user.name}.*machine")
     machine.sleep(1)
     machine.screenshot("terminal2")
+
+    # /tmp/somefile should not exist yet
+    machine.fail("stat /tmp/somefile")
+
+    # original config has a keybinding that creates somefile
+    machine.send_key("alt-ctrl-t")
+    machine.wait_for_file("/tmp/somefile")
+
+    # set up the new config
+    machine.succeed("mkdir -p ${user.home}/.xmonad")
+    machine.copy_from_host("${newConfig}", "${user.home}/.xmonad/xmonad.hs")
+
+    # recompile xmonad using the new config
+    machine.send_key("alt-ctrl-q")
+    machine.wait_for_file("/tmp/newXMonad")
+
+    # new config has a keybinding that deletes somefile
+    machine.send_key("alt-ctrl-r")
+    machine.wait_until_fails("stat /tmp/somefile", timeout=30)
+
+    # restart with the old config, and confirm the old keybinding is back
+    machine.succeed("rm /tmp/oldXMonad")
+    machine.send_key("alt-q")
+    machine.wait_for_file("/tmp/oldXMonad")
+    machine.send_key("alt-ctrl-t")
+    machine.wait_for_file("/tmp/somefile")
   '';
 })

third_party/nixpkgs/pkgs/applications/audio/pithos/default.nix

@@ -4,13 +4,13 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "pithos";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo  = pname;
     rev = version;
-    sha256 = "10nnm55ql86x1qfmq6dx9a1igf7myjxibmvyhd7fyv06vdhfifgy";
+    sha256 = "03j04b1mk2fq0ni2ydpw40fdd36k545z8a1pq9x5c779080cwpla";
   };
 
   format = "other";

third_party/nixpkgs/pkgs/applications/audio/pyradio/default.nix

@@ -2,13 +2,19 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pyradio";
-  version = "0.8.9.9";
+  version = "0.8.9.10";
+
+  propagatedBuildInputs = with python3Packages; [
+    requests
+    psutil
+    dnspython
+  ];
 
   src = fetchFromGitHub {
     owner = "coderholic";
     repo = pname;
     rev = version;
-    sha256 = "04asw5alkkf2q5iixswarj6ddb0y4a6ixm7cckl6204jiyxpv6kc";
+    sha256 = "1cvrvy5ll97yyrzakxr8lb25qxmzk9fvcabsgc98jf89ikxgax4w";
   };
 
   checkPhase = ''

third_party/nixpkgs/pkgs/applications/audio/scream/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "scream";
-  version = "3.8";
+  version = "3.9";
 
   src = fetchFromGitHub {
     owner = "duncanthrax";
     repo = pname;
     rev = version;
-    sha256 = "sha256-7UzwEoZujTN8i056Wf+0QtjyU+/UZlqcSompiAGHT54=";
+    sha256 = "sha256-JxDR7UhS4/+oGQ9Fwm4f+yBM9OyX0Srvr9n/vaZVvxQ=";
   };
 
   buildInputs = lib.optional pulseSupport libpulseaudio

third_party/nixpkgs/pkgs/applications/audio/sfxr-qt/default.nix

@@ -2,6 +2,7 @@
 , mkDerivation
 , fetchFromGitHub
 , cmake
+, extra-cmake-modules
 , qtbase
 , qtquickcontrols2
 , SDL
@@ -10,18 +11,22 @@
 
 mkDerivation rec {
   pname = "sfxr-qt";
-  version = "1.3.0";
+  version = "1.4.0";
+
   src = fetchFromGitHub {
     owner = "agateau";
     repo = "sfxr-qt";
     rev = version;
-    sha256 = "15yjgjl1c5k816mnpc09104zq0ack2a3mjsxmhcik7cmjkfiipr5";
+    sha256 = "sha256-Mn+wcwu70BwsTLFlc12sOOe6U1AJ8hR7bCIPlPnCooE=";
     fetchSubmodules = true;
   };
+
   nativeBuildInputs = [
     cmake
+    extra-cmake-modules
     (python3.withPackages (pp: with pp; [ pyyaml jinja2 setuptools ]))
   ];
+
   buildInputs = [
     qtbase
     qtquickcontrols2
@@ -36,4 +41,3 @@ mkDerivation rec {
     platforms = platforms.linux;
   };
 }
-

third_party/nixpkgs/pkgs/applications/audio/snd/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "snd";
-  version = "21.8";
+  version = "22.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/snd/snd-${version}.tar.gz";
-    sha256 = "sha256-sI2xa37eSBDr/ucQ7RF3YfsszKfWcmOCoAJENALSlTo=";
+    sha256 = "sha256-QK5lq2ek1yn3G0Ecs+TFIG5ST3lAETiyxuXIic3v1ik=";
   };
 
   nativeBuildInputs = [ pkg-config ];

third_party/nixpkgs/pkgs/applications/audio/spotify-qt/default.nix

@@ -9,13 +9,13 @@
 
 mkDerivation rec {
    pname = "spotify-qt";
-   version = "3.7";
+   version = "3.8";
 
    src = fetchFromGitHub {
       owner = "kraxarn";
       repo = pname;
       rev = "v${version}";
-      sha256 = "sha256-oRrgZtSDebbUVPc+hxE9GJ2n1AmGvZt/2aWrBMmRtNA=";
+      sha256 = "sha256-Rgtw+nrM8YUBHPIIe9zVhLij/ep07piPf/2MSmTVQKk=";
    };
 
    buildInputs = [ libxcb qtbase qtsvg ];

third_party/nixpkgs/pkgs/applications/editors/cudatext/default.nix

@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cudatext";
-  version = "1.153.0";
+  version = "1.155.0";
 
   src = fetchFromGitHub {
     owner = "Alexey-T";
     repo = "CudaText";
     rev = version;
-    sha256 = "sha256-3p5wb3buZtd1gnNoEJOclNO8xEYJBZYc86HfrkFrBWU=";
+    sha256 = "sha256-k6ALTbA2PhMZscinXKceM7MSzgr759Y6GxMrQAXMgwM=";
   };
 
   postPatch = ''

third_party/nixpkgs/pkgs/applications/editors/cudatext/deps.json

@@ -16,8 +16,8 @@
   },
   "ATSynEdit": {
     "owner": "Alexey-T",
-    "rev": "2022.01.07",
+    "rev": "2022.01.20",
-    "sha256": "sha256-KxeaTXv0qig3O2hqjJ5HG1KCN0TTQdnd3g9jBsEc0a4="
+    "sha256": "sha256-4UJ6t8j8uHB27jprqnlsGB8ytOMQLe4ZzSaYKiw4y70="
   },
   "ATSynEdit_Cmp": {
     "owner": "Alexey-T",
@@ -31,8 +31,8 @@
   },
   "ATSynEdit_Ex": {
     "owner": "Alexey-T",
-    "rev": "2022.01.07",
+    "rev": "2022.01.20",
-    "sha256": "sha256-7QDHf0PYGMc611qrk+a8pNJHF1v1DFMWlt5hbaU/oD8="
+    "sha256": "sha256-CaGo38NV+mbwekzkgw0DxM4TZf2xwHtYFnC6RbWH+ts="
   },
   "Python-for-Lazarus": {
     "owner": "Alexey-T",

third_party/nixpkgs/pkgs/applications/editors/emacs/elisp-packages/nongnu-generated.nix

@@ -140,6 +140,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    better-jumper = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "better-jumper";
+        ename = "better-jumper";
+        version = "1.0.1";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/better-jumper-1.0.1.tar";
+          sha256 = "0jykcz4g0q29k7rawsp2n5zmx88kdh3kbh0497vvpks74vvk2c9f";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/better-jumper.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     bison-mode = callPackage ({ elpaBuild, fetchurl, lib }:
       elpaBuild {
         pname = "bison-mode";
@@ -409,6 +424,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    evil-goggles = callPackage ({ elpaBuild, emacs, evil, fetchurl, lib }:
+      elpaBuild {
+        pname = "evil-goggles";
+        ename = "evil-goggles";
+        version = "0.0.2";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/evil-goggles-0.0.2.tar";
+          sha256 = "0cpxbl2vls52dydaa1x4jkizhnd3vmvs30ivihdl964vmpb1s7yl";
+        };
+        packageRequires = [ emacs evil ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/evil-goggles.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     evil-indent-plus = callPackage ({ cl-lib ? null
                                     , elpaBuild
                                     , evil
@@ -617,10 +647,10 @@
       elpaBuild {
         pname = "geiser-guile";
         ename = "geiser-guile";
-        version = "0.20.1";
+        version = "0.21.1";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/geiser-guile-0.20.1.tar";
+          url = "https://elpa.nongnu.org/nongnu/geiser-guile-0.21.1.tar";
-          sha256 = "0psm53ryh1wica2730xcw4lc2jv06d08wnjfyd8f61952zzj57k7";
+          sha256 = "1sm19jmaxzxkxd4jksgvc064jv90bc6q0yf8zz0s77y0aldw8sf5";
         };
         packageRequires = [ emacs geiser ];
         meta = {
@@ -739,16 +769,16 @@
           license = lib.licenses.free;
         };
       }) {};
-    go-mode = callPackage ({ elpaBuild, fetchurl, lib }:
+    go-mode = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "go-mode";
         ename = "go-mode";
-        version = "1.5.0";
+        version = "1.6.0";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/go-mode-1.5.0.tar";
+          url = "https://elpa.nongnu.org/nongnu/go-mode-1.6.0.tar";
-          sha256 = "0v4lw5dkijajpxyigin4cd5q4ldrabljaz65zr5f7mgqn5sizj3q";
+          sha256 = "1j83i56ldkf79l7dyjbv9rvy3ki2xlvgj2y7jnap92hbd2q50jsy";
         };
-        packageRequires = [];
+        packageRequires = [ emacs ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/go-mode.html";
           license = lib.licenses.free;
@@ -912,6 +942,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    iedit = callPackage ({ elpaBuild, fetchurl, lib }:
+      elpaBuild {
+        pname = "iedit";
+        ename = "iedit";
+        version = "0.9.9.9";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/iedit-0.9.9.9.tar";
+          sha256 = "1kwm7pa1x5dbn9irdrz9vg5zivrqx1w2ywrbpglk2lgd9kff0nsj";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/iedit.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     inf-clojure = callPackage ({ clojure-mode
                                , elpaBuild
                                , emacs
@@ -946,6 +991,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    jinja2-mode = callPackage ({ elpaBuild, fetchurl, lib }:
+      elpaBuild {
+        pname = "jinja2-mode";
+        ename = "jinja2-mode";
+        version = "0.3";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/jinja2-mode-0.3.tar";
+          sha256 = "1zkyac4akwnz8a136xyn6915j6jgpf0xilbf4krw7q6k8nkks2m4";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/jinja2-mode.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     julia-mode = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "julia-mode";
@@ -961,6 +1021,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    keycast = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "keycast";
+        ename = "keycast";
+        version = "1.1.3";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/keycast-1.1.3.tar";
+          sha256 = "0b4vyaxqdw11ai81vnvif8i02jcaf5hk64kbb7bs90527zwz2fw0";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/keycast.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     lua-mode = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "lua-mode";
@@ -1199,6 +1274,27 @@
           license = lib.licenses.free;
         };
       }) {};
+    org-drill = callPackage ({ elpaBuild
+                             , emacs
+                             , fetchurl
+                             , lib
+                             , org
+                             , persist
+                             , seq }:
+      elpaBuild {
+        pname = "org-drill";
+        ename = "org-drill";
+        version = "2.7.0";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/org-drill-2.7.0.tar";
+          sha256 = "0f61cfw7qy8w5835hh0rh33ai5i50dzliymdpkvmvffgkx7mikx5";
+        };
+        packageRequires = [ emacs org persist seq ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/org-drill.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     org-journal = callPackage ({ elpaBuild, emacs, fetchurl, lib, org }:
       elpaBuild {
         pname = "org-journal";
@@ -1229,6 +1325,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    org-present = callPackage ({ elpaBuild, fetchurl, lib, org }:
+      elpaBuild {
+        pname = "org-present";
+        ename = "org-present";
+        version = "0.1";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/org-present-0.1.tar";
+          sha256 = "1b32faz4nv5s4fv0rxkr70dkjlmpiwzds513wpkwr6fvqmcz4kdy";
+        };
+        packageRequires = [ org ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/org-present.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     org-superstar = callPackage ({ elpaBuild, emacs, fetchurl, lib, org }:
       elpaBuild {
         pname = "org-superstar";
@@ -1244,6 +1355,36 @@
           license = lib.licenses.free;
         };
       }) {};
+    org-tree-slide = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "org-tree-slide";
+        ename = "org-tree-slide";
+        version = "2.8.18";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/org-tree-slide-2.8.18.tar";
+          sha256 = "0xx8svbh6ks5112rac4chms0f8drhiwxnc3knrzaj8i1zb89l0n3";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/org-tree-slide.html";
+          license = lib.licenses.free;
+        };
+      }) {};
+    orgit = callPackage ({ elpaBuild, emacs, fetchurl, lib, magit, org }:
+      elpaBuild {
+        pname = "orgit";
+        ename = "orgit";
+        version = "1.7.2";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/orgit-1.7.2.tar";
+          sha256 = "1kf72l8h3wqgnrchy6wvhm3nmc9drh82yw5211f4xgg2ckr60rn1";
+        };
+        packageRequires = [ emacs magit org ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/orgit.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     pacmacs = callPackage ({ cl-lib ? null
                            , dash
                            , elpaBuild
@@ -1559,6 +1700,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    spacemacs-theme = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "spacemacs-theme";
+        ename = "spacemacs-theme";
+        version = "0.2";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/spacemacs-theme-0.2.tar";
+          sha256 = "07lkaj6gm5iz503p5l6sm1y62mc5wk13nrwzv81f899jw99jcgml";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/spacemacs-theme.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     subatomic-theme = callPackage ({ elpaBuild, fetchurl, lib }:
       elpaBuild {
         pname = "subatomic-theme";
@@ -1810,6 +1966,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    with-simulated-input = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "with-simulated-input";
+        ename = "with-simulated-input";
+        version = "3.0";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/with-simulated-input-3.0.tar";
+          sha256 = "0ws8z82kb0bh6z4yvw2kz3ib0j7v47c5l5dxlrn3kr1qk99z65l6";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/with-simulated-input.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     ws-butler = callPackage ({ elpaBuild, fetchurl, lib }:
       elpaBuild {
         pname = "ws-butler";

third_party/nixpkgs/pkgs/applications/editors/gophernotes/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "gophernotes";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "gopherdata";
     repo = "gophernotes";
     rev = "v${version}";
-    sha256 = "sha256-LiYPos6Ic+se5bTTkvggmyxyS20uhgALkDU2LoXTci8=";
+    sha256 = "sha256-ZyZ5VOZEgFn9QrFBC1bNHKA2g8msDUnd1c5plooO+b8=";
   };
 
-  vendorSha256 = "sha256-wDMx3B47Vv87/3YEPX8/70Q5/REJ7IPvw8dA/viJiSY=";
+  vendorSha256 = "sha256-NH8Hz9SzmDksvGqCpggi6hG4kW+AoA1tctF6rGgy4H4=";
 
   meta = with lib; {
     description = "Go kernel for Jupyter notebooks";

third_party/nixpkgs/pkgs/applications/editors/jove/default.nix

@@ -39,5 +39,6 @@ stdenv.mkDerivation rec {
     license = licenses.bsd2;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.unix;
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/jove.x86_64-darwin
   };
 }

third_party/nixpkgs/pkgs/applications/graphics/drawing/default.nix

@@ -17,7 +17,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "drawing";
-  version = "0.8.3";
+  version = "0.8.5";
 
   format = "other";
 
@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "maoschanz";
     repo = pname;
     rev = version;
-    sha256 = "sha256-qDLJ+Mw4z66ro9/zoEIzDJpA+jJLYw0WgsP7mA+56XM=";
+    sha256 = "1q4a1gwmzz0rm10cnd4nzd51zfc2bjc6dsvf90qk1di9x7svis64";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/graphics/geeqie/default.nix

@@ -1,17 +1,17 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, autoconf, automake, gettext, intltool
 , gtk3, lcms2, exiv2, libchamplain, clutter-gtk, ffmpegthumbnailer, fbida
-, wrapGAppsHook, fetchpatch
+, wrapGAppsHook, fetchpatch, bash, doxygen
 }:
 
 stdenv.mkDerivation rec {
   pname = "geeqie";
-  version = "1.6";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "BestImageViewer";
     repo = "geeqie";
     rev = "v${version}";
-    sha256 = "sha256-fvqpimrtzNy2UStOw3qLfC8i8V1fSrmTTsvc1ihqPsU=";
+    sha256 = "sha256-0E1TeAhkiK+hFJ4oMoeZLvfRehTzdGF3AtEVwf/MaF8=";
   };
 
   patches = [
@@ -23,11 +23,15 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postPatch = ''
+    patchShebangs .
+  '';
+
   preConfigure = "./autogen.sh";
 
   nativeBuildInputs =
     [ pkg-config autoconf automake gettext intltool
-      wrapGAppsHook
+      wrapGAppsHook bash doxygen
     ];
 
   buildInputs = [
@@ -59,7 +63,7 @@ stdenv.mkDerivation rec {
 
     license = licenses.gpl2Plus;
 
-    homepage = "http://geeqie.sourceforge.net";
+    homepage = "https://www.geeqie.org/";
 
     maintainers = with maintainers; [ jfrankenau pSub markus1189 ];
     platforms = platforms.gnu ++ platforms.linux;

third_party/nixpkgs/pkgs/applications/graphics/hydrus/default.nix

@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "469";
+  version = "470b";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "v${version}";
-    sha256 = "sha256-1E85SIsLXeG+AUqQYCJxOlSwiT26OG+n/d9GbyryGCE=";
+    sha256 = "0v52krjcqykrm3zqj6idzvbpjv4fhbgvq2jr8k0g63f7db7p08h9";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/graphics/inkscape/default.nix

@@ -88,7 +88,13 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.com/inkscape/inkscape/-/commit/b3dabef2245d4e4e977ee9d6776be9a134493515.patch";
       sha256 = "YhqUlRBKL1vJ/iCM/DvdwbmPIsAHQpcgf4TPpjlnBng=";
     })
-
+    # Fix build against gcc-12
+    # https://gitlab.com/inkscape/inkscape/-/merge_requests/3683
+    (fetchpatch {
+      name = "gcc-12.patch";
+      url = "https://gitlab.com/inkscape/inkscape/-/commit/3825abc637ac2d3bc6ff997503b0631ac14e16b5.patch";
+      sha256 = "sha256-VzKrWCkcVA1Co/xBTyh28Zhm2zFE/2jfZ3LveK0raO4=";
+    })
   ];
 
   postPatch = ''

third_party/nixpkgs/pkgs/applications/misc/bukut/default.nix

@@ -0,0 +1,28 @@
+{ lib, python3, fetchFromGitHub }:
+
+with python3.pkgs; buildPythonApplication rec {
+  pname = "bukut";
+  version = "0.11";
+
+  src = fetchFromGitHub {
+    owner = "peterjschroeder";
+    repo = "bukut";
+    rev = "v${version}";
+    sha256 = "sha256-Hp9/tSdRNAoll/fYNJuhYC7cgy5AK3PUtYUsS6zsz1Y=";
+  };
+
+  propagatedBuildInputs = [
+    asciimatics
+    beautifulsoup4
+    natsort
+    pyperclip
+    pyxdg
+  ];
+
+  meta = with lib; {
+    description = "Text user interface for buku bookmark manager";
+    homepage = "https://github.com/peterjschroeder/bukut";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ taha ];
+  };
+}

third_party/nixpkgs/pkgs/applications/misc/far2l/default.nix

@@ -1,79 +1,79 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper, cmake, pkg-config, wxGTK30, glib, pcre, m4, bash
+{ lib, stdenv, fetchFromGitHub, makeWrapper, cmake, ninja, pkg-config, m4, bash
-, xdg-utils, gvfs, zip, unzip, gzip, bzip2, gnutar, p7zip, xz, imagemagick
+, xdg-utils, zip, unzip, gzip, bzip2, gnutar, p7zip, xz
-, libuchardet, spdlog, xercesc, openssl, libssh, samba, neon, libnfs, libarchive }:
+, IOKit, Carbon, Cocoa, AudioToolbox, OpenGL
+, withTTYX ? true, libX11
+, withGUI ? true, wxGTK30, wxmac
+, withUCD ? true, libuchardet
 
+# Plugins
+, withColorer ? true, spdlog, xercesc
+, withMultiArc ? true, libarchive, pcre
+, withNetRocks ? true, openssl, libssh, samba, libnfs, neon
+, withPython ? false, python3Packages
+}:
+
+let
+  wxWidgets = (if stdenv.isDarwin then wxmac else wxGTK30);
+in
 stdenv.mkDerivation rec {
   pname = "far2l";
-  version = "2020-12-30.git${builtins.substring 0 7 src.rev}";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "elfmz";
     repo = "far2l";
-    rev = "52c1372441443aafd1a7dff6f17969a6ec19885d";
+    rev = "v_${version}";
-    sha256 = "0s7427fgxzj5zkyy6mhb4y5hqa6adsr30m0bigycp12b0495ryx0";
+    sha256 = "sha256-nfoAElPLQ97lj65MBX4JMEdgTFbkdEbR1BazYZgV/lg=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config m4 makeWrapper imagemagick ];
+  patches = [ ./python_prebuild.patch ];
 
-  buildInputs = [ wxGTK30 glib pcre libuchardet spdlog xercesc ] # base requirements of the build
+  nativeBuildInputs = [ cmake ninja pkg-config m4 makeWrapper ];
-    ++ [ openssl libssh samba neon libnfs libarchive ]; # optional feature packages, like protocol support for Network panel, or archive formats
-    #++ lib.optional stdenv.isDarwin Cocoa # Mac support -- disabled, see "meta.broken" below
 
-  postPatch = lib.optionalString stdenv.isLinux ''
+  buildInputs = lib.optional withTTYX libX11
-    substituteInPlace far2l/bootstrap/trash.sh \
+    ++ lib.optional withGUI wxWidgets
-      --replace 'gvfs-trash'  '${gvfs}/bin/gvfs-trash'
+    ++ lib.optional withUCD libuchardet
-  '' + lib.optionalString stdenv.isDarwin ''
+    ++ lib.optionals withColorer [ spdlog xercesc ]
-    substituteInPlace far2l/CMakeLists.txt \
+    ++ lib.optionals withMultiArc [ libarchive pcre ]
-      --replace "-framework System" -lSystem
+    ++ lib.optionals withNetRocks [ openssl libssh libnfs neon ]
-  '' + ''
+    ++ lib.optional (withNetRocks && !stdenv.isDarwin) samba # broken on darwin
-    echo 'echo ${version}' > far2l/bootstrap/scripts/vbuild.sh
+    ++ lib.optionals withPython (with python3Packages; [ python cffi debugpy pcpp ])
-    substituteInPlace far2l/bootstrap/open.sh              \
+    ++ lib.optionals stdenv.isDarwin [ IOKit Carbon Cocoa AudioToolbox OpenGL ];
-      --replace 'xdg-open'    '${xdg-utils}/bin/xdg-open'
+
-    substituteInPlace far2l/vtcompletor.cpp                \
+  postPatch = ''
+    patchShebangs python/src/prebuild.sh
+    substituteInPlace far2l/src/vt/vtcompletor.cpp \
+      --replace '"/bin/bash"' '"${bash}/bin/bash"'
+    substituteInPlace far2l/src/cfg/config.cpp \
       --replace '"/bin/bash"' '"${bash}/bin/bash"'
-    substituteInPlace multiarc/src/formats/zip/zip.cpp     \
-      --replace '"unzip '     '"${unzip}/bin/unzip '       \
-      --replace '"zip '       '"${zip}/bin/zip '
-    substituteInPlace multiarc/src/formats/7z/7z.cpp       \
-      --replace '"^7z '       '"^${p7zip}/lib/p7zip/7z '   \
-      --replace '"7z '        '"${p7zip}/lib/p7zip/7z '
-    substituteInPlace multiarc/src/formats/targz/targz.cpp \
-      --replace '"xz '        '"${xz}/bin/xz '             \
-      --replace '"gzip '      '"${gzip}/bin/gzip '         \
-      --replace '"bzip2 '     '"${bzip2}/bin/bzip2 '       \
-      --replace '"tar '       '"${gnutar}/bin/tar '
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin $out/share/applications $out/share/icons/hicolor/scalable/apps
-    cp -dpR install $out/share/far2l
-    mv $out/share/far2l/far2l $out/bin/
-    ln -s -r --force $out/bin/far2l $out/share/far2l/far2l_askpass
-    ln -s -r --force $out/bin/far2l $out/share/far2l/far2l_sudoapp
-
-    cp ../far2l/DE/far2l.desktop $out/share/applications/far2l.desktop
-    substituteInPlace $out/share/applications/far2l.desktop --replace \''${CMAKE_INSTALL_PREFIX} "$out"
-
-    cp ../far2l/DE/icons/hicolor/1024x1024/apps/far2l.svg $out/share/icons/hicolor/scalable/apps/
-    convert -size 128x128 ../far2l/DE/icons/far2l.svg $out/share/icons/far2l.png
-    for size in 16x16 24x24 32x32 48x48 64x64 72x72 96x96 128x128 192x192 256x256 512x512 1024x1024; do
-      mkdir -p $out/share/icons/hicolor/$size/apps
-      convert -size $size ../far2l/DE/icons/hicolor/$size/apps/far2l.svg $out/share/icons/hicolor/$size/apps/far2l.png
-    done
   '' + lib.optionalString stdenv.isDarwin ''
-    wrapProgram $out/bin/far2l --argv0 $out/bin/far2l
+    substituteInPlace WinPort/src/Backend/WX/CMakeLists.txt \
+      --replace "-framework System" -lSystem
   '';
 
-  stripDebugList = [ "bin" "share" ];
+  cmakeFlags = lib.mapAttrsToList (k: v: "-D${k}=${if v then "yes" else "no"}") {
+    TTYX = withTTYX;
+    USEWX = withGUI;
+    USEUCD = withUCD;
+    COLORER = withColorer;
+    MULTIARC = withMultiArc;
+    NETROCKS = withNetRocks;
+    PYTHON = withPython;
+  };
+
+  runtimeDeps = [ unzip zip p7zip xz gzip bzip2 gnutar xdg-utils ];
+
+  postInstall = ''
+    wrapProgram $out/bin/far2l \
+      --argv0 $out/bin/far2l \
+      --prefix PATH : ${lib.makeBinPath runtimeDeps}
+  '';
 
   meta = with lib; {
     description = "Linux port of FAR Manager v2, a program for managing files and archives in Windows operating systems";
     homepage = "https://github.com/elfmz/far2l";
     license = licenses.gpl2Plus; # NOTE: might change in far2l repo soon, check next time
     maintainers = with maintainers; [ volth hypersw ];
-    platforms = platforms.all;
+    platforms = platforms.unix;
-    # fails to compile with:
-    # error: no member named 'st_ctim' in 'stat'
-    broken = stdenv.isDarwin;
   };
 }

third_party/nixpkgs/pkgs/applications/misc/far2l/python_prebuild.patch

@@ -0,0 +1,20 @@
+diff --git i/python/src/prebuild.sh w/python/src/prebuild.sh
+index d2847ee5..aa1ecc53 100755
+--- i/python/src/prebuild.sh
++++ w/python/src/prebuild.sh
+@@ -12,9 +12,6 @@ mkdir -p "$DST/incpy"
+ if [ ! -f "$DST/python/.prepared" ]; then
+ 	echo "Preparing python virtual env at $DST/python using $PYTHON"
+ 	mkdir -p "$DST/python"
+-	$PYTHON -m venv --system-site-packages "$DST/python"
+-	"$DST/python/bin/python" -m pip install --upgrade pip || true
+-	"$DST/python/bin/python" -m pip install --ignore-installed cffi debugpy pcpp
+ 	$PREPROCESSOR "$SRC/python/src/consts.gen" | sh > "${DST}/incpy/consts.h"
+ 
+ 	echo "1" > "$DST/python/.prepared"
+@@ -26,4 +23,4 @@ cp -f -R \
+ 	"$SRC/python/configs/plug/far2l/"* \
+ 	"$DST/incpy/"
+ 
+-"$DST/python/bin/python" "$SRC/python/src/pythongen.py" "${SRC}" "${DST}/incpy"
++"python" "$SRC/python/src/pythongen.py" "${SRC}" "${DST}/incpy"

third_party/nixpkgs/pkgs/applications/misc/liberasurecode/default.nix

@@ -1,10 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, zlib }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, doxygen
+, installShellFiles
+, zlib
+}:
 
 stdenv.mkDerivation rec {
   pname = "liberasurecode";
   version = "1.6.2";
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "doc" ];
 
   src = fetchFromGitHub {
     owner = "openstack";
@@ -13,10 +20,27 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-qV7DL/7zrwrYOaPj6iHnChGA6KHFwYKjeaMnrGrTPrQ=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  postPatch = ''
+    substituteInPlace doc/doxygen.cfg.in \
+      --replace "GENERATE_MAN           = NO" "GENERATE_MAN           = YES"
+  '';
+
+  nativeBuildInputs = [ autoreconfHook doxygen installShellFiles ];
 
   buildInputs = [ zlib ];
 
+  configureFlags = [ "--enable-doxygen" ];
+
+  postInstall = ''
+    # remove useless man pages about directories
+    rm doc/man/man*/_*
+    installManPage doc/man/man*/*
+
+    moveToOutput share/liberasurecode/ $doc
+  '';
+
+  checkTarget = "test";
+
   meta = with lib; {
     description = "Erasure Code API library written in C with pluggable Erasure Code backends";
     homepage = "https://github.com/openstack/liberasurecode";

third_party/nixpkgs/pkgs/applications/misc/pdfarranger/default.nix

@@ -5,13 +5,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pdfarranger";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "1lcmlr7x4143f7wcn0m1ijlvch07nww2qfp3jfnacgy889ijvbfx";
+    sha256 = "18bpnnwjx72d5ps06dr89mkixiwzc9hf5gr75k8qcnrkshl038v2";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/misc/pdfstudioviewer/default.nix

@@ -0,0 +1,81 @@
+{ stdenv
+, lib
+, fetchurl
+, dpkg
+, makeDesktopItem
+, copyDesktopItems
+, autoPatchelfHook
+, sane-backends
+, jdk11
+}:
+
+let year = "2021";
+in stdenv.mkDerivation rec {
+  pname = "pdfstudioviewer";
+  version = "${year}.1.2";
+  autoPatchelfIgnoreMissingDeps = false;
+  strictDeps = true;
+
+  src = fetchurl {
+    url = "https://download.qoppa.com/${pname}/v${year}/PDFStudioViewer_v${
+        builtins.replaceStrings [ "." ] [ "_" ] version
+      }_linux64.deb";
+    sha256 = "128k3fm8m8zdykx4s30g5m2zl7cgmvs4qinf1w525zh84v56agz6";
+  };
+
+  buildInputs = [
+    sane-backends
+    jdk11
+  ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    dpkg
+    copyDesktopItems
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "${pname}${year}";
+      desktopName = "PDF Studio";
+      genericName = "View and edit PDF files";
+      exec = "${pname} %f";
+      icon = "${pname}${year}";
+      comment = "Views and edits PDF files";
+      mimeType = "application/pdf";
+      categories = "Office";
+      type = "Application";
+      terminal = false;
+    })
+  ];
+
+  unpackPhase = "dpkg-deb -x $src .";
+  dontBuild = true;
+
+  postPatch = ''
+    substituteInPlace opt/${pname}${year}/${pname}${year} --replace "# INSTALL4J_JAVA_HOME_OVERRIDE=" "INSTALL4J_JAVA_HOME_OVERRIDE=${jdk11.out}"
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    mkdir -p $out/share
+    mkdir -p $out/share/pixmaps
+    cp -r opt/${pname}${year} $out/share/
+    rm -rf $out/share/${pname}${year}/jre
+    ln -s $out/share/${pname}${year}/.install4j/${pname}${year}.png  $out/share/pixmaps/
+    ln -s $out/share/${pname}${year}/${pname}${year} $out/bin/${pname}
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.qoppa.com/pdfstudio/";
+    description = "An easy to use, full-featured PDF editing software";
+    license = licenses.unfree;
+    platforms = platforms.linux;
+    mainProgram = pname;
+    maintainers = [ maintainers.pwoelfel ];
+  };
+}

third_party/nixpkgs/pkgs/applications/misc/remarkable/rmview/default.nix

@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "rmview";
-  version = "3.0";
+  version = "3.1";
 
   src = fetchFromGitHub {
     owner = "bordaigorl";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-zEl2uduSJvqhO5YPrH5ixps+IR5A0CIDwXHI+KvoT4Q=";
+    sha256 = "11p62dglxnvml3x95mi2sfai1k0gmvzwixzijr3gls2ss73maffw";
   };
 
   nativeBuildInputs = with python3Packages; [ pyqt5 wrapQtAppsHook ];

third_party/nixpkgs/pkgs/applications/misc/solaar/default.nix

@@ -13,13 +13,13 @@
 # logitech-udev-rules instead of adding this to services.udev.packages on NixOS
 python3Packages.buildPythonApplication rec {
   pname = "solaar";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "pwr-Solaar";
     repo = "Solaar";
     rev = version;
-    sha256 = "sha256-rNz296pKw2/WaryxHekWHSAS1jdTviZxXDgO/L/PJCU=";
+    sha256 = "1yqxk6nfxc1xhk59qbz9m3wqkxv446g17pazvanpavriiysjzbrs";
   };
 
   nativeBuildInputs = [ wrapGAppsHook gdk-pixbuf ];

third_party/nixpkgs/pkgs/applications/misc/wike/default.nix

@@ -14,13 +14,13 @@ let
   ]);
 in stdenv.mkDerivation rec {
   pname = "wike";
-  version = "1.6.3";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "hugolabe";
     repo = "Wike";
     rev = version;
-    sha256 = "sha256-yyifRUf7oITV9lpnHnadZwHOKHr0Z+4bjCV/WoYs6vY=";
+    sha256 = "sha256-Cv4gmAUqViHJEAgueLOUX+cI775QopfRA6vmHgQvCUY=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/misc/xplr/default.nix

@@ -2,18 +2,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xplr";
-  version = "0.15.2";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "sayanarijit";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1znb6n9xbzbi9sif76xlwnqrzkh50g9yz6k36m0hm5iacd1fapab";
+    sha256 = "sha256-eRA9v5C6FFYs01a8cwnaVGliuNj026/ANSPC2FxEUws=";
   };
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 
-  cargoSha256 = "0gbhkpha02ymr861av0fmyz6h007ajwkqcajq8hrnfzjk8rii47m";
+  cargoSha256 = "sha256-xali/nvYVpvKIFRlOZpDNE/rv7iUHJCU9QV6RctJSO8=";
 
   meta = with lib; {
     description = "A hackable, minimal, fast TUI file explorer";

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "97.0.4692.71",
+    "version": "97.0.4692.99",
-    "sha256": "0z7ximvm4a78kxyp4j0i2jzklxazpw6jcqi9jkaf8bvq9ga8kqca",
+    "sha256": "1fpc07zvashaqqalwn7wxnswxclrxvhjrxy1rzr6gcq5awhaw6y9",
-    "sha256bin64": "1z1d50i5pvqaw6hjdxwasbznzgqwrnd1z8jmy2x05b6i49vd7r9j",
+    "sha256bin64": "18afashha667rzcscq3frkp5ixa7nrirs7i3061njqi4z9ql0cs8",
     "deps": {
       "gn": {
         "version": "2021-11-03",
@@ -12,10 +12,10 @@
       }
     },
     "chromedriver": {
-      "version": "97.0.4692.36",
+      "version": "97.0.4692.71",
-      "sha256_linux": "11x28m31bsfq1flqrsa5mawss39kznia2ig5ams5qkm2v5p3y39d",
+      "sha256_linux": "0lw74ycw8vh3qz4nxynnvrw8sngy3g0vcaana15y4b2ks73gcvci",
-      "sha256_darwin": "1ysnfvj0795yc3g8sbz7g9mhc5j0sxm2r3ad2fh13sarnhn6wrs4",
+      "sha256_darwin": "1zv1ndv1d7a29yvg0b242g8dw5f8s9vxhr454zd9vahn0ar4ksbs",
-      "sha256_darwin_aarch64": "09m1qpk6901gqs4c7isgryffhb92szfzbxfybxhn2g5i4wrns6j7"
+      "sha256_darwin_aarch64": "0jzn75rrjw3y1bqg0ywfjcm2zn9dd2h3lswih51glvdrlcz3vw2a"
     }
   },
   "beta": {
@@ -45,9 +45,9 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "97.0.4692.71",
+    "version": "97.0.4692.99",
-    "sha256": "0z7ximvm4a78kxyp4j0i2jzklxazpw6jcqi9jkaf8bvq9ga8kqca",
+    "sha256": "1fpc07zvashaqqalwn7wxnswxclrxvhjrxy1rzr6gcq5awhaw6y9",
-    "sha256bin64": "1z1d50i5pvqaw6hjdxwasbznzgqwrnd1z8jmy2x05b6i49vd7r9j",
+    "sha256bin64": "18afashha667rzcscq3frkp5ixa7nrirs7i3061njqi4z9ql0cs8",
     "deps": {
       "gn": {
         "version": "2021-11-03",
@@ -56,8 +56,8 @@
         "sha256": "0n0jml8s00ayy186jzrf207hbz70pxiq426znxwxd4gjcp60scsa"
       },
       "ungoogled-patches": {
-        "rev": "97.0.4692.71-1",
+        "rev": "97.0.4692.99-1",
-        "sha256": "0a1172kj93lg3ip4im1s5s7bdm2q41w4m6ylyxc92w29rbhbxjxp"
+        "sha256": "1jgxpp3wl24hq39291mgmdwcxbarxg4rpa6il53k8z3rf6gd2s4i"
       }
     }
   }

third_party/nixpkgs/pkgs/applications/networking/browsers/firefox/packages.nix

@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    version = "96.0.1";
+    version = "96.0.2";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "c0d2ccf9ca930def63dcb9dc269e47f60fd4bbbdcbc01463df0c30e11109a543e310fb36f2334d17b90cb9c96b8dcdd97d0e2d6c589a779de5e4f197c052f9a5";
+      sha512 = "5ceb1f023a9217c6a9c08b6525882d4091f989859cf209cc1d0ea22c846d05a967e1c47102ae052f7a5029d18118a558dd96da00437ee2c6fbf2896caf99d9dd";
     };
 
     meta = {

third_party/nixpkgs/pkgs/applications/networking/browsers/lagrange/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lagrange";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "skyjake";
     repo = "lagrange";
     rev = "v${version}";
-    sha256 = "sha256-5K2Fm7CkzVcHM3JC1rgh/vCyXfVTTY47nZFzqgQcoSs";
+    sha256 = "sha256-HwrIdQv4LDVLLuvukzp28AuKKbEMQeHSb0ZW+a9q4ug=";
     fetchSubmodules = true;
   };
 

third_party/nixpkgs/pkgs/applications/networking/browsers/palemoon/default.nix

@@ -44,12 +44,12 @@ assert with lib.strings; (
 
 stdenv.mkDerivation rec {
   pname = "palemoon";
-  version = "29.4.3";
+  version = "29.4.4";
 
   src = fetchzip {
     name = "${pname}-${version}";
     url = "http://archive.palemoon.org/source/${pname}-${version}.source.tar.xz";
-    sha256 = "sha256-9Qut7zgzDrU6T/sWbSF2Me7E02VJVL/B2bzJw14KWFs=";
+    sha256 = "sha256-0R0IJd4rd7NqnxQxkHSx10cNlwECqpKgJnlfYAMx4wc=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/networking/browsers/vivaldi/widevine.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "widevine";
-  version = "4.10.1582.1";
+  version = "4.10.2391.0";
 
   src = fetchurl {
     url = "https://dl.google.com/widevine-cdm/${version}-linux-x64.zip";
-    sha256 = "0l743f2yyaq1vvc3iicajgnfpjxjsfvjcqvanndbxs23skgjcv6r";
+    sha256 = "sha256-7gH808C67m/s09e4rQUQHb/t+iGVdzW+YzrB1ZxGIdo=";
   };
 
   nativeBuildInputs = [ unzip ];

third_party/nixpkgs/pkgs/applications/networking/cluster/helm-docs/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "helm-docs";
-  version = "1.5.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "norwoodj";
     repo = "helm-docs";
     rev = "v${version}";
-    sha256 = "sha256-eyFuF03rqwfXyjEkqNRkjrJlHBazGYij1EtN0LAKdFk=";
+    sha256 = "sha256-TXwEVyRYRiVqCDL7IR+DIu1iKqaq81W5xkvz+laxVek=";
   };
 
-  vendorSha256 = "sha256-aAn969C4UhFGu5/qXIG/rc1cErQIDtPwEA+f0d43y0w=";
+  vendorSha256 = "sha256-XTV0gyUWe6G5gxucsXOaDOUQoKMCfhrWzlKwUOaA6y4=";
 
   subPackages = [ "cmd/helm-docs" ];
   ldflags = [

third_party/nixpkgs/pkgs/applications/networking/cluster/helmfile/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "helmfile";
-  version = "0.142.0";
+  version = "0.143.0";
 
   src = fetchFromGitHub {
     owner = "roboll";
     repo = "helmfile";
     rev = "v${version}";
-    sha256 = "sha256-kz5U9MPpN+14Eb1D1hjwDfvTOygzg0unyIgrFTFhE0Q=";
+    sha256 = "sha256-3Kuj3umyD7fooa4alNJAm7Adu+7EQvoB7Gt/LRjgW94=";
   };
 
-  vendorSha256 = "sha256-HKHMeDnIDmQ7AjuS2lYCMphTHGD1JgQuBYDJe2+PEk4=";
+  vendorSha256 = "sha256-/MbKYPcZ7cOPQKT+nYQaaCiahKLcesrSVKNo8hKFlf0=";
 
   doCheck = false;
 

third_party/nixpkgs/pkgs/applications/networking/cluster/helmsman/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helmsman";
-  version = "3.7.7";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "Praqma";
     repo = "helmsman";
     rev = "v${version}";
-    sha256 = "sha256-duNkvRMq3CKAGDDsrDWKydFZRt6fxuO0uP2Ff3HA+ek=";
+    sha256 = "sha256-KZrv447Yz4WxtkmQkGLsnZC0ok0rWCM2Fs+m8LVTGfM=";
   };
 
   vendorSha256 = "sha256-4imZrZfpR/5tw9ZFSTr7Gx4G9O1iHNE9YRYMOJFKvHU=";

third_party/nixpkgs/pkgs/applications/networking/cluster/kube3d/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kube3d";
-  version = "5.2.1";
+  version = "5.2.2";
 
   src = fetchFromGitHub {
     owner = "rancher";
     repo = "k3d";
     rev = "v${version}";
-    sha256 = "sha256-rKiOPpRupoCRtGJ3DVBUY9483EEBxaaECZRdWiyxaEk=";
+    sha256 = "sha256-yOrxEY2UpupVmbDSAhgruTUOhNVAGCpSJsvzDEFFccw=";
   };
 
   vendorSha256 = null;

third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/default.nix

@@ -53,8 +53,6 @@ let
       # mkisofs needed to create ISOs holding cloud-init data,
       # and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
       libvirt = automated-providers.libvirt.overrideAttrs (_: { propagatedBuildInputs = [ cdrtools ]; });
-      teleport = callPackage ./teleport { };
-      vpsadmin = callPackage ./vpsadmin { };
     };
 
   # Put all the providers we not longer support in this list.
@@ -95,6 +93,7 @@ let
       segment = removed "2022/01";
       softlayer = archived "2022/01";
       telefonicaopencloud = archived "2022/01";
+      teleport = removed "2022/01";
       terraform = archived "2022/01";
       ultradns = archived "2022/01";
       vthunder = throw "provider was renamed to thunder on 2022/01";

third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1161,6 +1161,15 @@
     "vendorSha256": "0s0kf1v2217q9hfmc7r2yybcfk33k566dfvs2jiq63kyjnadhb0k",
     "version": "2.1.0"
   },
+  "vpsadmin": {
+    "owner": "vpsfreecz",
+    "provider-source-address": "registry.terraform.io/vpsfreecz/vpsadmin",
+    "repo": "terraform-provider-vpsadmin",
+    "rev": "v0.2.0",
+    "sha256": "1jb5s8lv8az1az9an8kj8bi0hh71zcaw5mpa4zyba5xk1vqig0kv",
+    "vendorSha256": "1xnscd7yir736y913r7nvn3a78h8cwc7m206h0vcc0hrl1jvf45i",
+    "version": "0.2.0"
+  },
   "vra7": {
     "owner": "vmware",
     "provider-source-address": "registry.terraform.io/vmware/vra7",

third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/teleport/default.nix

@@ -1,33 +0,0 @@
-{ lib, fetchFromGitHub, buildGoModule, teleport }:
-
-buildGoModule rec {
-  pname = "terraform-provider-teleport";
-  version = "8.0.6";
-
-  src = fetchFromGitHub {
-    owner = "gravitational";
-    repo = "teleport-plugins";
-    rev = "v${version}";
-    sha256 = "1rhvpbw4dga256dp2cr5f912d2j7rh8pd1v88dlgq3mmw8n5c7vy";
-  };
-  vendorSha256 = null;
-
-  checkInputs = [ teleport ];
-
-  sourceRoot = "source/terraform";
-
-  # Terraform allow checking the provider versions, but this breaks
-  # if the versions are not provided via file paths.
-  postBuild = ''
-    mv $NIX_BUILD_TOP/go/bin/{terraform,terraform-provider-teleport_v${version}}
-  '';
-
-  passthru.provider-source-address = "gravitational.com/teleport/teleport";
-
-  meta = with lib; {
-    description = "Provider for managing resources in Teleport access plane";
-    homepage = "https://github.com/gravitational/teleport-plugins";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ justinas ];
-  };
-}

third_party/nixpkgs/pkgs/applications/networking/cluster/terraform-providers/vpsadmin/default.nix

@@ -1,29 +0,0 @@
-{ lib, fetchFromGitHub, buildGoModule }:
-buildGoModule rec {
-  pname = "terraform-provider-vpsadmin";
-  version = "0.1.0";
-
-  src = fetchFromGitHub {
-    owner = "vpsfreecz";
-    repo = "terraform-provider-vpsadmin";
-    rev = "v${version}";
-    sha256 = "1vny6w9arbbra04bjjafisaswinm93ic1phy59l0g78sqf6x3a7v";
-  };
-
-  vendorSha256 = "0j90fnzba23mwf9bzf9w5h0hszkl3h61p5i780s9v9c0hbzhbqsh";
-
-  doCheck = false;
-
-  subPackages = [ "." ];
-
-  # Terraform allow checking the provider versions, but this breaks
-  # if the versions are not provided via file paths.
-  postInstall = "mv $out/bin/${pname}{,_v${version}}";
-
-  meta = with lib; {
-    description = "Terraform provider for vpsAdmin";
-    homepage = "https://github.com/vpsfreecz/terraform-provider-vpsadmin";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ zimbatm ];
-  };
-}

third_party/nixpkgs/pkgs/applications/networking/cluster/terragrunt/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.35.16";
+  version = "0.35.20";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-m32QhQUG3Dkh0odfqYhNmJ5Rrt0qf5wCvxePPusyRyI=";
+    sha256 = "sha256-iSD036rDZvvMUGMHnjKh69eVUVQakI8muSCCq2ytODM=";
   };
 
   vendorSha256 = "sha256-tNgEepKqwiqXhmoRCIEg7VJw7Y0TGt+R+6dZzd8aECg=";

third_party/nixpkgs/pkgs/applications/networking/cluster/vcluster/default.nix

@@ -0,0 +1,45 @@
+{ lib, buildGo117Module, fetchFromGitHub, installShellFiles }:
+
+buildGo117Module rec {
+  pname = "vcluster";
+  version = "0.5.3";
+
+  src = fetchFromGitHub {
+    owner = "loft-sh";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-+rLDRVfB6wZ1wYoLE2wwRxzS6GmI6KYtOKdXZd+LnnU=";
+  };
+
+  vendorSha256 = null;
+
+  subPackages = [ "cmd/vclusterctl" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  ldflags = [ "-s" "-w" ];
+
+  # Test is disabled because e2e tests expect k8s.
+  doCheck = false;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin
+    install -Dm755 "$GOPATH/bin/vclusterctl" -T $out/bin/vcluster
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    installShellCompletion --cmd vcluster \
+      --bash <($out/bin/vcluster completion bash) \
+      --zsh <($out/bin/vcluster completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "Create fully functional virtual Kubernetes clusters";
+    downloadPage = "https://github.com/loft-sh/vcluster";
+    homepage = "https://www.vcluster.com/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ peterromfeldhk ];
+  };
+}

third_party/nixpkgs/pkgs/applications/networking/cluster/werf/default.nix

@@ -11,15 +11,15 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.55";
+  version = "1.2.56";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    sha256 = "sha256-yLrCE0C8+LIXnBm4xG4q0vXtjTyau6mjkZ+/o/lbGhI=";
+    sha256 = "sha256-6gDSH/YWkXeYyEwJDYNNCAWTBjwGx7kNcsCqmmwqJy0=";
   };
-  vendorSha256 = "sha256-2pJpzu6TDkZ7tecwf7NfxN/gwSBIZmCFi2aJ+KTPkbM=";
+  vendorSha256 = "sha256-Cod7nFLu6au0uxrJLBf7SG1YBasRzmDjt+FmtZqMw3U=";
   proxyVendor = true;
 
   nativeBuildInputs = [ pkg-config ];

third_party/nixpkgs/pkgs/applications/networking/compactor/default.nix

@@ -1,59 +1,71 @@
-{ autoconf, automake, boost, cbor-diag, cddl, fetchFromGitHub, file, libctemplate, libmaxminddb
+{ lib, stdenv, fetchFromGitHub
-, libpcap, libtins, libtool, xz, openssl, pkg-config, lib, stdenv, tcpdump, wireshark-cli
+, asciidoctor, autoreconfHook, pkg-config
+, boost, libctemplate, libmaxminddb, libpcap, libtins, openssl, protobuf, xz, zlib
+, cbor-diag, cddl, diffutils, file, mktemp, netcat, tcpdump, wireshark-cli
 }:
 
 stdenv.mkDerivation rec {
   pname = "compactor";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "dns-stats";
     repo = pname;
     rev = version;
-    sha256 = "0qykdnwi2q9sajkkc2sl5f00lvxjfymqjzqm0limsziykanh87c0";
+    fetchSubmodules = true;
+    hash = "sha256-AUNPUk70VwJ0nZgMPLMU258nqkL4QP6km0USrZi2ea0=";
   };
 
-  # cbor-diag, cddl and wireshark-cli are only used for tests.
+  nativeBuildInputs = [
-  nativeBuildInputs = [ autoconf automake libtool pkg-config cbor-diag cddl wireshark-cli ];
+    asciidoctor
+    autoreconfHook
+    pkg-config
+  ];
   buildInputs = [
     boost
-    libpcap
-    openssl
-    libtins
-    xz
     libctemplate
     libmaxminddb
+    libpcap
+    libtins
+    openssl
+    protobuf
+    xz
+    zlib
   ];
 
-  prePatch = ''
+  postPatch = ''
     patchShebangs test-scripts/
   '';
 
   preConfigure = ''
-    ${stdenv.shell} autogen.sh
     substituteInPlace configure \
       --replace "/usr/bin/file" "${file}/bin/file"
   '';
-  CXXFLAGS = "-std=c++11";
+
   configureFlags = [
     "--with-boost-libdir=${boost.out}/lib"
     "--with-boost=${boost.dev}"
   ];
   enableParallelBuilding = true;
 
-  doCheck = true;
+  doCheck = !stdenv.isDarwin; # check-dnstap.sh failing on Darwin
-  preCheck = ''
+  checkInputs = [
-    substituteInPlace test-scripts/check-live-pcap.sh \
+    cbor-diag
-      --replace "/usr/sbin/tcpdump" "${tcpdump}/bin/tcpdump"
+    cddl
-    rm test-scripts/same-tshark-output.sh
+    diffutils
-  ''; # TODO: https://github.com/dns-stats/compactor/issues/49  (failing test)
+    file
+    mktemp
+    netcat
+    tcpdump
+    wireshark-cli
+  ];
 
   meta = with lib; {
     description = "Tools to capture DNS traffic and record it in C-DNS files";
-    homepage    = "http://dns-stats.org/";
+    homepage    = "https://dns-stats.org/";
     changelog   = "https://github.com/dns-stats/${pname}/raw/${version}/ChangeLog.txt";
-    license     = [ licenses.boost licenses.mpl20 licenses.openssl ];
+    license     = licenses.mpl20;
     maintainers = with maintainers; [ fdns ];
-    platforms   = lib.platforms.unix;
+    platforms   = platforms.unix;
   };
 }

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix

@@ -4,11 +4,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "rocketchat-desktop";
-  version = "3.7.4";
+  version = "3.7.6";
 
   src = fetchurl {
     url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat_${version}_amd64.deb";
-    sha256 = "sha256-yYUMVMSGUMAXbBm40jNCaFusWsWxoIgLDeAwNqSewX8=";
+    sha256 = "sha256-lOiYj0eC/Mw2icdizK7wvBG2xuIBRkCF0aBJ24qzyK8=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/signal-cli/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-cli";
-  version = "0.10.0";
+  version = "0.10.1";
 
   # Building from source would be preferred, but is much more involved.
   src = fetchurl {
     url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}.tar.gz";
-    sha256 = "sha256-2JofDCq9HsF+2DO5wzObzAALbJmJ9HJgmuuSJQDu1vY=";
+    sha256 = "sha256-xj/fR/scfzOPxkWB79OhA129V7QG7QUkAbw1bNgzVas=";
   };
 
   buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix

@@ -70,7 +70,7 @@ let
 in
 env.mkDerivation rec {
   pname = "telegram-desktop";
-  version = "3.4.3";
+  version = "3.4.8";
   # Note: Update via pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py
 
   # Telegram-Desktop with submodules
@@ -79,7 +79,7 @@ env.mkDerivation rec {
     repo = "tdesktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "0w8llqc4ffhp4gkvk6cyxah16yxm15am0msg3qn39fi2qqnm01x8";
+    sha256 = "11h2w82i10zn55iz9xda8ihsnv6s8rxm3wkmmmkpa4zfzinryqb4";
   };
 
   postPatch = ''

third_party/nixpkgs/pkgs/applications/networking/mailreaders/aerc/default.nix

@@ -5,17 +5,17 @@
 
 buildGoModule rec {
   pname = "aerc";
-  version = "0.6.0";
+  version = "0.7.1";
 
   src = fetchFromSourcehut {
     owner = "~rjarry";
     repo = pname;
     rev = version;
-    sha256 = "sha256-RaHigTp1YGkjQ46gFLhKcJuajekcCgfozu0ndCNq5Ac=";
+    sha256 = "sha256-wiylBBqnivDnMUyCg3Zateu4jcjicTfrQFALT8dg5No=";
   };
 
   proxyVendor = true;
-  vendorSha256 = "sha256-ZFs2CXmNZpGae7bD15yTh3w6b00C7AgOwGuz72d2wHs=";
+  vendorSha256 = "sha256-3BbKf2xSzXznCB5UU/cThVg329GSeJG9KwjaS+tN3Rs=";
 
   doCheck = false;
 

third_party/nixpkgs/pkgs/applications/networking/mailreaders/evolution/evolution/default.nix

@@ -42,11 +42,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.42.2";
+  version = "3.42.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "C+QT8W3WjsjUNCpPJpVlryp0oZpb+hxcv2Y1I6W1ujg=";
+    sha256 = "RGKeagIojsEApm/VlBOgaLa5zWJL7TJVqimhZuom0LY=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/networking/p2p/tixati/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tixati";
-  version = "2.87";
+  version = "2.88";
 
   src = fetchurl {
     url = "https://download2.tixati.com/download/tixati-${version}-1.x86_64.manualinstall.tar.gz";
-    sha256 = "sha256-URWLuZ/gtv/sX5+11ORu9SUZFIZUuKPn0CUQ1xaSQcQ=";
+    sha256 = "sha256-9d9Z+3Uyxy4Bj8STtzHWwyyhWeMv3wo0IH6uxGTaA0I=";
   };
 
   installPhase = ''

third_party/nixpkgs/pkgs/applications/networking/protonvpn-gui/default.nix

@@ -3,13 +3,13 @@ wrapGAppsHook, python3Packages, gtk3, networkmanager, webkitgtk }:
 
 python3Packages.buildPythonApplication rec {
   pname = "protonvpn-linux-gui";
-  version = "1.4.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "linux-app";
     rev = version;
-    sha256 = "sha256-08gXEKm8udgNltRdqvAMFL0pDCWZu/kfl1xGQtZPBCc=";
+    sha256 = "sha256-uzooFQBq2mhqTBr/cgea5cVQ889P70sgSk2vjXBQEfw=";
   };
 
   strictDeps = false;

third_party/nixpkgs/pkgs/applications/networking/remote/remmina/default.nix

@@ -13,13 +13,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "remmina";
-  version = "1.4.20";
+  version = "1.4.23";
 
   src = fetchFromGitLab {
     owner  = "Remmina";
     repo   = "Remmina";
     rev    = "v${version}";
-    sha256 = "sha256-m3DUaoOD8COxMwCVBTipzCAz3mqIdunEbVPjyjAl9So=";
+    sha256 = "sha256-MyemiSAMZEa9Ng6WHEyHgrze8YtIbzMCR8CTb86PDsg=";
   };
 
   nativeBuildInputs = [ cmake ninja pkg-config wrapGAppsHook ];

third_party/nixpkgs/pkgs/applications/networking/remote/waypipe/default.nix

@@ -15,8 +15,9 @@ stdenv.mkDerivation rec {
     sha256 = "02q8l1qaahmd41h6v3r46akh7xlqz7fpwwsy15qww4jdvypg6vg4";
   };
 
+  strictDeps = true;
+  depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ meson ninja pkg-config scdoc ];
-
   buildInputs = [
     # Optional dependencies:
     mesa lz4 zstd ffmpeg libva

third_party/nixpkgs/pkgs/applications/networking/synology-drive-client/default.nix

@@ -8,12 +8,12 @@ let
     description = "Desktop application to synchronize files and folders between the computer and the Synology Drive server.";
     homepage = "https://www.synology.com/en-global/dsm/feature/drive";
     license = licenses.unfree;
-    maintainers = with maintainers; [ jcouyang ];
+    maintainers = with maintainers; [ jcouyang MoritzBoehme ];
     platforms = [ "x86_64-linux" "x86_64-darwin" ];
   };
 
   linux = qt5.mkDerivation {
-    inherit pname version;
+    inherit pname version meta;
 
     src = fetchurl {
       url = "${baseUrl}/${version}-${buildNumber}/Ubuntu/Installer/x86_64/synology-drive-client-${buildNumber}.x86_64.deb";
@@ -43,7 +43,7 @@ let
   };
 
   darwin = stdenv.mkDerivation {
-    inherit pname version;
+    inherit pname version meta;
 
     src = fetchurl {
       url = "${baseUrl}/${version}-${buildNumber}/Mac/Installer/synology-drive-client-${buildNumber}.dmg";

third_party/nixpkgs/pkgs/applications/networking/synology-drive/default.nix

@@ -1,45 +0,0 @@
-{ lib, mkDerivation, fetchurl, autoPatchelfHook, dpkg, glibc, gnome }:
-
-mkDerivation rec {
-  pname = "synology-drive";
-  subVersion = "12674";
-  version = "3.0.1-${subVersion}";
-
-  src = fetchurl {
-    url = "https://global.download.synology.com/download/Utility/SynologyDriveClient/${version}/Ubuntu/Installer/x86_64/synology-drive-client-${subVersion}.x86_64.deb";
-    sha256 = "1yyv6zgszsym22kf4jvlan7n9lw09fw24fyrh7c8pzbb2029gp8a";
-  };
-
-  nativeBuildInputs = [ autoPatchelfHook dpkg ];
-
-  buildInputs = [ glibc gnome.nautilus ];
-
-  unpackPhase = ''
-    mkdir -p $out
-    dpkg -x $src $out
-  '';
-
-  installPhase = ''
-    # synology-drive executable
-    cp -av $out/usr/* $out
-    rm -rf $out/usr
-
-    runHook postInstall
-  '';
-
-  postInstall = ''
-    substituteInPlace $out/bin/synology-drive --replace /opt $out/opt
-  '';
-
-  meta = with lib; {
-    homepage = "https://www.synology.com/";
-    description = "Synchronize files between client and Synology NAS.";
-    longDescription = ''
-      Drive for PC, the desktop utility of the DSM add-on package.
-      Drive, allows you to sync and share files owned by you or shared by others between a centralized Synology NAS and multiple client computers.
-    '';
-    license = licenses.unfree;
-    maintainers = with maintainers; [ MoritzBoehme ];
-    platforms = [ "x86_64-linux" ];
-  };
-}

third_party/nixpkgs/pkgs/applications/office/gnucash/0002-disable-gnc-fq-update.patch

@@ -0,0 +1,18 @@
+diff --git a/libgnucash/quotes/CMakeLists.txt b/libgnucash/quotes/CMakeLists.txt
+index b33569d39..fdbfa10a9 100644
+--- a/libgnucash/quotes/CMakeLists.txt
++++ b/libgnucash/quotes/CMakeLists.txt
+@@ -1,6 +1,6 @@
+ 
+ set(_BIN_FILES "")
+-foreach(file gnc-fq-check.in gnc-fq-helper.in gnc-fq-update.in gnc-fq-dump.in)
++foreach(file gnc-fq-check.in gnc-fq-helper.in gnc-fq-dump.in)
+   string(REPLACE ".in" "" _OUTPUT_FILE_NAME ${file})
+   set(_ABS_OUTPUT_FILE ${BINDIR_BUILD}/${_OUTPUT_FILE_NAME})
+   configure_file( ${file} ${_ABS_OUTPUT_FILE} @ONLY)
+@@ -26,4 +26,4 @@ add_custom_target(quotes-bin ALL DEPENDS ${_BIN_FILES})
+ install(FILES ${_MAN_FILES} DESTINATION  ${CMAKE_INSTALL_MANDIR}/man1)
+ install(PROGRAMS ${_BIN_FILES} DESTINATION ${CMAKE_INSTALL_BINDIR})
+ 
+-set_dist_list(quotes_DIST CMakeLists.txt gnc-fq-check.in gnc-fq-dump.in gnc-fq-helper.in gnc-fq-update.in Quote_example.pl README)
++set_dist_list(quotes_DIST CMakeLists.txt gnc-fq-check.in gnc-fq-dump.in gnc-fq-helper.in Quote_example.pl README)

third_party/nixpkgs/pkgs/applications/office/gnucash/0003-remove-valgrind.patch

@@ -0,0 +1,35 @@
+diff --git a/gnucash/CMakeLists.txt b/gnucash/CMakeLists.txt
+index 8e6e339d1..3936a8cb6 100644
+--- a/gnucash/CMakeLists.txt
++++ b/gnucash/CMakeLists.txt
+@@ -163,13 +163,6 @@ set(GNUCASH_BIN_INSTALL_NAME "gnucash")
+ 
+ set(VALGRIND_OUTDIR ${BINDIR_BUILD})
+ 
+-configure_file(gnucash-valgrind.in ${CMAKE_CURRENT_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/gnucash-valgrind @ONLY)
+-
+-file(COPY ${CMAKE_CURRENT_BINARY_DIR}${CMAKE_FILES_DIRECTORY}/gnucash-valgrind
+-          DESTINATION ${VALGRIND_OUTDIR}
+-          FILE_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE
+-)
+-
+ ## Create the environment file
+ 
+ file(STRINGS ${CMAKE_CURRENT_SOURCE_DIR}/environment.in ENV_STRINGS_IN)
+@@ -253,7 +246,6 @@ file(COPY ${ENV_FILE_OUT}
+   FILE_PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE
+ )
+ 
+-install(FILES ${SCRIPT_LIST} ${VALGRIND_OUTDIR}/gnucash-valgrind DESTINATION ${CMAKE_INSTALL_BINDIR})
+ install(FILES ${ENVIRONMENT_FILE_DIR}/environment DESTINATION
+   ${CMAKE_INSTALL_FULL_SYSCONFDIR}/gnucash)
+ 
+@@ -274,7 +266,7 @@ gnc_add_scheme_targets(price-quotes
+ 
+ set_local_dist(gnucash_DIST_local CMakeLists.txt environment.in generate-gnc-script
+     gnucash.cpp gnucash-commands.cpp gnucash-cli.cpp gnucash-core-app.cpp
+-    gnucash-locale-macos.mm gnucash-locale-windows.c gnucash.rc.in gnucash-valgrind.in
++    gnucash-locale-macos.mm gnucash-locale-windows.c gnucash.rc.in
+     gnucash-gresources.xml ${gresource_files} price-quotes.scm
+     ${gnucash_noinst_HEADERS} ${gnucash_EXTRA_DIST})
+ 

third_party/nixpkgs/pkgs/applications/office/gnucash/default.nix

@@ -1,106 +1,190 @@
-{ fetchurl, lib, stdenv, pkg-config, makeWrapper, cmake, gtest
+{ fetchurl
-, boost, icu, libxml2, libxslt, gettext, swig, isocodes, gtk3, glibcLocales
+, lib
-, webkitgtk, dconf, hicolor-icon-theme, libofx, aqbanking, gwenhywfar, libdbi
+, stdenv
-, libdbiDrivers, guile, perl, perlPackages
+, aqbanking
+, boost
+, cmake
+, glib
+, glibcLocales
+, gtest
+, guile
+, gwenhywfar
+, icu
+, libdbi
+, libdbiDrivers
+, libofx
+, libxml2
+, libxslt
+, makeWrapper
+, perl
+, perlPackages
+, pkg-config
+, swig
+, webkitgtk
+, wrapGAppsHook
 }:
 
-let
-
-  # Enable gnc-fq-* to run in command line.
-  perlWrapper = stdenv.mkDerivation {
-    name = perl.name + "-wrapper-for-gnucash";
-    nativeBuildInputs = [ makeWrapper ];
-    buildInputs = [ perl ] ++ (with perlPackages; [ FinanceQuote DateManip ]);
-    dontUnpack = true;
-
-    installPhase = ''
-      mkdir -p $out/bin
-      for script in ${perl}/bin/*; do
-        makeWrapper $script $out''${script#${perl}} \
-          --prefix "PERL5LIB" ":" "$PERL5LIB"
-      done
-    '';
-  };
-
-in
-
 stdenv.mkDerivation rec {
   pname = "gnucash";
   version = "4.9";
 
   src = fetchurl {
-    url = "mirror://sourceforge/gnucash/${pname}-${version}.tar.bz2";
+    url = "https://github.com/Gnucash/gnucash/releases/download/${version}/gnucash-${version}.tar.bz2";
-    sha256 = "sha256-mlUcMMG3EhmfwiJ6EJr7mE177xjhOBcLvHIlxsH6ty0=";
+    sha256 = "0bdpzb0wc9bjph5iff7133ppnkcqzfd10yi2qagij4mpq4q1qmcs";
   };
 
-  nativeBuildInputs = [ pkg-config makeWrapper cmake gtest swig ];
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+    wrapGAppsHook
+  ];
 
   buildInputs = [
-    boost icu libxml2 libxslt gettext isocodes gtk3 glibcLocales
+    aqbanking
-    webkitgtk dconf libofx aqbanking gwenhywfar libdbi
+    boost
-    libdbiDrivers guile
+    glib
-    perlWrapper perl
+    glibcLocales
+    gtest
+    guile
+    gwenhywfar
+    icu
+    libdbi
+    libdbiDrivers
+    libofx
+    libxml2
+    libxslt
+    perl
+    pkg-config
+    swig
+    webkitgtk
   ] ++ (with perlPackages; [ FinanceQuote DateManip ]);
 
-  propagatedUserEnvPkgs = [ dconf ];
+  patches = [
-
-  # glib-2.62 deprecations
-  NIX_CFLAGS_COMPILE = "-DGLIB_DISABLE_DEPRECATION_WARNINGS";
-
     # this patch disables test-gnc-timezone and test-gnc-datetime which fail due to nix datetime challenges
-  patches = [ ./0001-changes.patch ];
+    ./0001-disable-date-and-time-tests.patch
+    # this patch prevents the building of gnc-fq-update, a utility which updates the GnuCash cli utils
+    ./0002-disable-gnc-fq-update.patch
+    # this patch prevents the building of gnucash-valgrind
+    ./0003-remove-valgrind.patch
+  ];
 
-  postPatch = ''
+  preConfigure = ''
-    patchShebangs .
+    export GUILE_AUTO_COMPILE=0 # this needs to be an env variable and not a cmake flag to suppress guile warning
   '';
 
-  makeFlags = [ "GUILE_AUTO_COMPILE=0" ];
+  doCheck = true;
-
-  postInstall = ''
-    # Auto-updaters don't make sense in Nix.
-    rm $out/bin/gnc-fq-update
-
-    # Unnecessary in the release build.
-    rm $out/bin/gnucash-valgrind
-
-    wrapProgram "$out/bin/gnucash" \
-      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH:$out/share/gsettings-schemas/${pname}-${version}" \
-      --prefix XDG_DATA_DIRS : "${hicolor-icon-theme}/share" \
-      --prefix PERL5LIB ":" "$PERL5LIB" \
-      --set GNC_DBD_DIR ${libdbiDrivers}/lib/dbd \
-      --prefix GIO_EXTRA_MODULES : "${lib.getLib dconf}/lib/gio/modules"
-  '';
 
   /*
     GNUcash's `make check` target does not define its prerequisites but expects them to have already been built.
     The list of targets below was built through trial and error based on failing tests.
   */
   preCheck = ''
-    export LD_LIBRARY_PATH=$PWD/lib:$PWD/lib/gnucash:$PWD/lib/gnucash/test:$PWD/lib/gnucash/test/future''${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
+    make \
-    export NIX_CFLAGS_LINK="-lgtest -lgtest_main"
+      test-account-object \
-    make test-scm-query test-split-register-copy-ops test-link-ofx test-import-backend test-import-account-matcher test-import-pending-matches test-qofquerycore test-import-map test-gnc-numeric test-gnc-rational test-gnc-int128 test-qofsession test-kvp-value test-gnc-guid test-numeric test-vendor test-job test-employee test-customer test-address test-business test-recurrence test-transaction-voiding test-transaction-reversal test-split-vs-account test-tokenizer test-aqb test-import-parse test-link-module-tax-us test-dynload test-agedver test-incompatdep test-modsysver test-load-c test-gnc-path-util test-xml2-is-file test-load-example-account test-query test-querynew test-lots test-group-vs-book test-account-object test-engine test-qof test-commodities test-object test-guid test-load-engine test-userdata-dir-invalid-home test-userdata-dir test-resolve-file-path test-gnc-glib-utils test-sqlbe test-column-types test-backend-dbi test-xml-transaction test-xml-pricedb test-xml-commodity test-xml-account test-string-converters test-load-backend test-kvp-frames test-dom-converters1 test-autoclear test-sx test-print-parse-amount gncmod-futuremodsys
+      test-address \
+      test-agedver \
+      test-app-utils \
+      test-aqb \
+      test-autoclear \
+      test-backend-dbi \
+      test-business \
+      test-column-types \
+      test-commodities \
+      test-customer \
+      test-dom-converters1 \
+      test-dynload \
+      test-employee \
+      test-engine \
+      test-exp-parser \
+      test-gnc-glib-utils \
+      test-gnc-guid \
+      test-gnc-int128 \
+      test-gnc-numeric \
+      test-gnc-path-util \
+      test-gnc-rational \
+      test-group-vs-book \
+      test-guid \
+      test-import-account-matcher \
+      test-import-backend \
+      test-import-map \
+      test-import-parse \
+      test-import-pending-matches \
+      test-incompatdep \
+      test-job \
+      test-kvp-frames \
+      test-kvp-value \
+      test-link-module-tax-us \
+      test-link-ofx \
+      test-load-backend \
+      test-load-c \
+      test-load-engine \
+      test-load-example-account \
+      test-load-xml2 \
+      test-lots \
+      test-modsysver \
+      test-numeric \
+      test-object \
+      test-print-parse-amount \
+      test-qof \
+      test-qofquerycore \
+      test-qofsession \
+      test-query \
+      test-querynew \
+      test-recurrence \
+      test-resolve-file-path \
+      test-scm-query \
+      test-scm-query-string \
+      test-split-register-copy-ops \
+      test-split-vs-account \
+      test-sqlbe \
+      test-string-converters \
+      test-sx \
+      test-tokenizer \
+      test-transaction-reversal \
+      test-transaction-voiding \
+      test-userdata-dir \
+      test-userdata-dir-invalid-home \
+      test-vendor \
+      test-xml-account \
+      test-xml-commodity \
+      test-xml-pricedb \
+      test-xml-transaction \
+      test-xml2-is-file
+
+      export LD_LIBRARY_PATH="$PWD/lib:$PWD/lib/gnucash:$PWD/lib/gnucash/test:$PWD/lib/gnucash/test/future"
   '';
-  doCheck = true;
 
-  meta = {
+  preFixup = ''
-    description = "Personal and small-business financial-accounting application";
+    gappsWrapperArgs+=(
+      --set GNC_DBD_DIR ${libdbiDrivers}/lib/dbd                                      # specify where db drivers are
+      --set GSETTINGS_SCHEMA_DIR ${glib.makeSchemaPath "$out" "${pname}-${version}"}  # specify where nix puts the gnome settings schemas
+    )
+  '';
 
+  # wrapGAppsHook would wrap all binaries including the cli utils which need Perl wrapping
+  dontWrapGApps = true;
+
+  # gnucash is wrapped using the args constructed for wrapGAppsHook.
+  # gnc-fq-* are cli utils written in Perl hence the extra wrapping
+  postFixup = ''
+    wrapProgram $out/bin/gnucash "''${gappsWrapperArgs[@]}"
+
+    for file in $out/bin/gnc-fq-check $out/bin/gnc-fq-dump $out/bin/gnc-fq-helper; do
+      wrapProgram $file \
+      --prefix PERL5LIB : "${with perlPackages; makeFullPerlPath [ DateManip FinanceQuote ]}"
+    done
+  '';
+
+  meta = with lib; {
+    description = "Personal and small business double entry accounting application.";
     longDescription = ''
-      GnuCash is personal and small-business financial-accounting software,
+      Designed to be easy to use, yet powerful and flexible, GnuCash allows you to track bank accounts, stocks, income and expenses.
-      freely licensed under the GNU GPL and available for GNU/Linux, BSD,
+      As quick and intuitive to use as a checkbook register, it is based on professional accounting principles to ensure balanced books and accurate reports.
-      Solaris, macOS and Microsoft Windows.
-
-      Designed to be easy to use, yet powerful and flexible, GnuCash allows
-      you to track bank accounts, stocks, income and expenses.  As quick and
-      intuitive to use as a checkbook register, it is based on professional
-      accounting principles to ensure balanced books and accurate reports.
     '';
 
-    license = lib.licenses.gpl2Plus;
+    homepage = "https://www.gnucash.org/";
-
+    license = licenses.gpl2Plus;
-    homepage = "http://www.gnucash.org/";
+    maintainers = [ maintainers.domenkozar ];
-
+    platforms = platforms.linux;
-    maintainers = [ lib.maintainers.domenkozar ];
-    platforms = lib.platforms.gnu ++ lib.platforms.linux;
   };
 }

third_party/nixpkgs/pkgs/applications/office/vnote/default.nix

@@ -8,14 +8,14 @@
 
 mkDerivation rec {
   pname = "vnote";
-  version = "3.11.0";
+  version = "3.12.0";
 
   src = fetchFromGitHub {
     owner = "vnotex";
     repo = pname;
     fetchSubmodules = true;
     rev = "v${version}";
-    sha256 = "sha256-JZqV+ZDYRWiuKLSctB2L2SGPmboLeL3HeecMoaNXY+4=";
+    sha256 = "sha256-hlB/G7qFYbkdIk9f2N+q1Do3V1ON8UUQZ6AUmBfK8x0=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/science/chemistry/molden/default.nix

@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   pname = "molden";
 
   src = fetchurl {
-    url = "ftp://ftp.cmbi.umcn.nl/pub/molgraph/molden/molden${version}.tar.gz";
+    url = "https://ftp.science.ru.nl/Molden//molden${version}.tar.gz";
     sha256 = "02qi16pz2wffn3cc47dpjqhfafzwfmb79waw4nnhfyir8a4h3cq1";
   };
 

third_party/nixpkgs/pkgs/applications/science/misc/cwltool/default.nix

@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cwltool";
-  version = "3.1.20211107152837";
+  version = "3.1.20220119140128";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "common-workflow-language";
     repo = pname;
     rev = version;
-    sha256 = "sha256-hIkRzFLG9MujSaQrhWFPXegLLKTV96lVYP79+xpPfUQ=";
+    sha256 = "1jmrm0qrqgka79avc1kq63fgh20gx6g07fc8p3iih4k85vhdyl3f";
   };
 
   postPatch = ''

third_party/nixpkgs/pkgs/applications/science/physics/sherpa/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sherpa";
-  version = "2.2.11";
+  version = "2.2.12";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/sherpa/SHERPA-MC-${version}.tar.gz";
-    sha256 = "sha256-DrA/h/f/MjGylKxAtVMq6OLvEdb6yB7pRt8UJXNmwi0=";
+    sha256 = "sha256-UpRkd1yoKLncllEQUm80DedDtgA8Hm+Kvi/BRVCu0AE=";
   };
 
   postPatch = lib.optionalString (stdenv.hostPlatform.libc == "glibc") ''

third_party/nixpkgs/pkgs/applications/version-management/git-and-tools/git-cola/default.nix

@@ -5,13 +5,13 @@ let
 
 in buildPythonApplication rec {
   pname = "git-cola";
-  version = "3.11.0";
+  version = "3.12.0";
 
   src = fetchFromGitHub {
     owner = "git-cola";
     repo = "git-cola";
     rev = "v${version}";
-    sha256 = "1s58wlpnndypx1q0m9fx8jmcd6hzqvrwdaxxrk7gn5nf423wq4xv";
+    sha256 = "1f8jpfa916nszj431cmp41bxj2m76k2n8qnscqgxrc0k3pnnp3wc";
   };
 
   buildInputs = [ git gettext ];

third_party/nixpkgs/pkgs/applications/version-management/meld/default.nix

@@ -18,13 +18,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meld";
-  version = "3.21.0";
+  version = "3.21.1";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "toARTVq3kzJFSf1Y9OsgLY4oDAYzoLdl7ebfs0FgqBs=";
+    sha256 = "cP6Y65Ms4h1nFw47D2pzF+gT6GLemJM+pROYLpoDMgI=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/video/iina/default.nix

@@ -0,0 +1,32 @@
+{ lib
+, fetchurl
+, stdenv
+, undmg
+}:
+
+stdenv.mkDerivation rec {
+  pname = "iina";
+  version = "1.2.0";
+
+  src = fetchurl {
+    url = "https://github.com/iina/iina/releases/download/v${version}/IINA.v${version}.dmg";
+    sha256 = "sha256-kbh+gAVfCXoct6jJGXnetTAzFfIGdVLL5zh/SL/EJzY=";
+  };
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = "IINA.app";
+
+  installPhase = ''
+    mkdir -p "$out/Applications/IINA.app"
+    cp -R . "$out/Applications/IINA.app"
+  '';
+
+  meta = with lib; {
+    homepage = "https://iina.io/";
+    description = "The modern media player for macOS";
+    platforms = platforms.darwin;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ arkivm ];
+  };
+}