Project import generated by Copybara.

GitOrigin-RevId: 9816b99e71c3504b0b4c1f8b2e004148460029d4

third_party/nixpkgs/doc/contributing/submitting-changes.chapter.md

@@ -174,10 +174,13 @@ digraph {
     "staging-next" -> master [color="#E85EB0"] [label="stabilization ends"] [fontcolor="#E85EB0"]
     "staging" -> "staging-next" [color="#E85EB0"] [label="stabilization starts"] [fontcolor="#E85EB0"]
 
-    master -> "staging-next" -> staging [color="#5F5EE8"] [label="every six hours/any time"] [fontcolor="#5F5EE8"]
+    master -> "staging-next" -> staging [color="#5F5EE8"] [label="every six hours (GitHub Action)"] [fontcolor="#5F5EE8"]
 }
 ```
 
+[This GitHub Action](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/merge-staging.yml) brings changes from `master` to `staging-next` and from `staging-next` to `staging` every 6 hours.
+
+
 ### Master branch {#submitting-changes-master-branch}
 
 The `master` branch is the main development branch. It should only see non-breaking commits that do not cause mass rebuilds.

third_party/nixpkgs/doc/languages-frameworks/qt.section.md

@@ -1,77 +1,88 @@
 # Qt {#sec-language-qt}
 
-This section describes the differences between Nix expressions for Qt libraries and applications and Nix expressions for other C++ software. Some knowledge of the latter is assumed.
+Writing Nix expressions for Qt libraries and applications is largely similar as for other C++ software.
+This section assumes some knowledge of the latter.
+There are two problems that the Nixpkgs Qt infrastructure addresses,
+which are not shared by other C++ software:
 
-There are primarily two problems which the Qt infrastructure is designed to address: ensuring consistent versioning of all dependencies and finding dependencies at runtime.
+1.  There are usually multiple supported versions of Qt in Nixpkgs.
+    All of a package's dependencies must be built with the same version of Qt.
+    This is similar to the version constraints imposed on interpreted languages like Python.
+2.  Qt makes extensive use of runtime dependency detection.
+    Runtime dependencies are made into build dependencies through wrappers.
 
 ## Nix expression for a Qt package (default.nix) {#qt-default-nix}
 
 ```{=docbook}
 <programlisting>
-{ mkDerivation, qtbase }: <co xml:id='qt-default-nix-co-1' />
+{ stdenv, lib, qtbase, wrapQtAppsHook }: <co xml:id='qt-default-nix-co-1' />
 
-mkDerivation { <co xml:id='qt-default-nix-co-2' />
+stdenv.mkDerivation {
   pname = "myapp";
   version = "1.0";
 
-  buildInputs = [ qtbase ]; <co xml:id='qt-default-nix-co-3' />
+  buildInputs = [ qtbase ];
+  nativeBuildInputs = [ wrapQtAppsHook ]; <co xml:id='qt-default-nix-co-2' />
 }
 </programlisting>
 
  <calloutlist>
   <callout arearefs='qt-default-nix-co-1'>
    <para>
-    Import <literal>mkDerivation</literal> and Qt (such as <literal>qtbase</literal> modules directly. <emphasis>Do not</emphasis> import Qt package sets; the Qt versions of dependencies may not be coherent, causing build and runtime failures.
+    Import Qt modules directly, that is: <literal>qtbase</literal>, <literal>qtdeclarative</literal>, etc.
+    <emphasis>Do not</emphasis> import Qt package sets such as <literal>qt5</literal>
+    because the Qt versions of dependencies may not be coherent, causing build and runtime failures.
    </para>
   </callout>
   <callout arearefs='qt-default-nix-co-2'>
-   <para>
+    <para>
-    Use <literal>mkDerivation</literal> instead of <literal>stdenv.mkDerivation</literal>. <literal>mkDerivation</literal> is a wrapper around <literal>stdenv.mkDerivation</literal> which applies some Qt-specific settings. This deriver accepts the same arguments as <literal>stdenv.mkDerivation</literal>; refer to <xref linkend='chap-stdenv' /> for details.
+      All Qt packages must include <literal>wrapQtAppsHook</literal> in
-   </para>
+      <literal>nativeBuildInputs</literal>, or you must explicitly set
-   <para>
+      <literal>dontWrapQtApps</literal>.
-    To use another deriver instead of <literal>stdenv.mkDerivation</literal>, use <literal>mkDerivationWith</literal>:
+    </para>
-<programlisting>
-mkDerivationWith myDeriver {
-  # ...
-}
-</programlisting>
-    If you cannot use <literal>mkDerivationWith</literal>, please refer to <xref linkend='qt-runtime-dependencies' />.
-   </para>
-  </callout>
-  <callout arearefs='qt-default-nix-co-3'>
-   <para>
-    <literal>mkDerivation</literal> accepts the same arguments as <literal>stdenv.mkDerivation</literal>, such as <literal>buildInputs</literal>.
-   </para>
   </callout>
  </calloutlist>
 ```
 
 ## Locating runtime dependencies {#qt-runtime-dependencies}
-Qt applications need to be wrapped to find runtime dependencies. If you cannot use `mkDerivation` or `mkDerivationWith` above, include `wrapQtAppsHook` in `nativeBuildInputs`:
+
+Qt applications must be wrapped to find runtime dependencies.
+Include `wrapQtAppsHook` in `nativeBuildInputs`:
 
 ```nix
+{ stdenv, wrapQtAppsHook }:
+
 stdenv.mkDerivation {
   # ...
-
   nativeBuildInputs = [ wrapQtAppsHook ];
 }
 ```
-Entries added to `qtWrapperArgs` are used to modify the wrappers created by `wrapQtAppsHook`. The entries are passed as arguments to [wrapProgram executable makeWrapperArgs](#fun-wrapProgram).
+
+Add entries to `qtWrapperArgs` are to modify the wrappers created by
+`wrapQtAppsHook`:
 
 ```nix
-mkDerivation {
+{ stdenv, wrapQtAppsHook }:
-  # ...
 
+stdenv.mkDerivation {
+  # ...
+  nativeBuildInputs = [ wrapQtAppsHook ];
   qtWrapperArgs = [ ''--prefix PATH : /path/to/bin'' ];
 }
 ```
 
-Set `dontWrapQtApps` to stop applications from being wrapped automatically. It is required to wrap applications manually with `wrapQtApp`, using the syntax of [wrapProgram executable makeWrapperArgs](#fun-wrapProgram):
+The entries are passed as arguments to [wrapProgram](#fun-wrapProgram).
+
+Set `dontWrapQtApps` to stop applications from being wrapped automatically.
+Wrap programs manually with `wrapQtApp`, using the syntax of
+[wrapProgram](#fun-wrapProgram):
 
 ```nix
-mkDerivation {
+{ stdenv, lib, wrapQtAppsHook }:
-  # ...
 
+stdenv.mkDerivation {
+  # ...
+  nativeBuildInputs = [ wrapQtAppsHook ];
   dontWrapQtApps = true;
   preFixup = ''
       wrapQtApp "$out/bin/myapp" --prefix PATH : /path/to/bin
@@ -79,21 +90,16 @@ mkDerivation {
 }
 ```
 
-> Note: `wrapQtAppsHook` ignores files that are non-ELF executables. This means that scripts won't be automatically wrapped so you'll need to manually wrap them as previously mentioned. An example of when you'd always need to do this is with Python applications that use PyQT.
+::: note
+`wrapQtAppsHook` ignores files that are non-ELF executables.
+This means that scripts won't be automatically wrapped so you'll need to manually wrap them as previously mentioned.
+An example of when you'd always need to do this is with Python applications that use PyQt.
+:::
 
-Libraries are built with every available version of Qt. Use the `meta.broken` attribute to disable the package for unsupported Qt versions:
-
-```nix
-mkDerivation {
-  # ...
-
-  # Disable this library with Qt &lt; 5.9.0
-  meta.broken = builtins.compareVersions qtbase.version "5.9.0" &lt; 0;
-}
-```
 ## Adding a library to Nixpkgs
-Qt libraries are added to `qt5-packages.nix` and are made available for every Qt
+Add Qt libraries to `qt5-packages.nix` to make them available for every
-version supported.
+supported Qt version.
+
 ### Example adding a Qt library {#qt-library-all-packages-nix}
 
 The following represents the contents of `qt5-packages.nix`.
@@ -106,9 +112,23 @@ The following represents the contents of `qt5-packages.nix`.
   # ...
 }
 ```
+
+Libraries are built with every available version of Qt.
+Use the `meta.broken` attribute to disable the package for unsupported Qt versions:
+
+```nix
+{ stdenv, lib, qtbase }:
+
+stdenv.mkDerivation {
+  # ...
+  # Disable this library with Qt &lt; 5.9.0
+  meta.broken = lib.versionOlder qtbase.version "5.9.0";
+}
+```
+
 ## Adding an application to Nixpkgs
-Applications that use Qt are also added to `qt5-packages.nix`. An alias is added
+Add Qt applications to `qt5-packages.nix`. Add an alias to `all-packages.nix`
-in the top-level `all-packages.nix` pointing to the package with the desired Qt5 version.
+to select the Qt 5 version used for the application.
 
 ### Example adding a Qt application {#qt-application-all-packages-nix}
 

third_party/nixpkgs/maintainers/maintainer-list.nix

@@ -2103,6 +2103,12 @@
     email = "christoph.senjak@googlemail.com";
     name = "Christoph-Simon Senjak";
   };
+  davhau = {
+    email = "d.hauer.it@gmail.com";
+    name = "David Hauer";
+    github = "DavHau";
+    githubId = 42246742;
+  };
   david-sawatzke = {
     email = "d-nix@sawatzke.dev";
     github = "david-sawatzke";
@@ -5866,6 +5872,12 @@
     githubId = 35892750;
     name = "Maxine Aubrey";
   };
+  maxhbr = {
+    email = "nixos@maxhbr.dev";
+    github = "maxhbr";
+    githubId = 1187050;
+    name = "Maximilian Huber";
+  };
   maxxk = {
     email = "maxim.krivchikov@gmail.com";
     github = "maxxk";

third_party/nixpkgs/nixos/modules/services/hardware/bluetooth.nix

@@ -104,7 +104,7 @@ in
           # will in fact load the configuration file at /etc/bluetooth/main.conf
           # so force it here to avoid any ambiguity and things suddenly breaking
           # if/when the bluez derivation is changed.
-          args = [ "-f /etc/bluetooth/main.conf" ]
+          args = [ "-f" "/etc/bluetooth/main.conf" ]
             ++ optional hasDisabledPlugins
             "--noplugin=${concatStringsSep "," cfg.disabledPlugins}";
         in

third_party/nixpkgs/nixos/modules/services/printing/cupsd.nix

@@ -270,7 +270,7 @@ in
       drivers = mkOption {
         type = types.listOf types.path;
         default = [];
-        example = literalExample "with pkgs; [ gutenprint hplip splix cups-googlecloudprint ]";
+        example = literalExample "with pkgs; [ gutenprint hplip splix ]";
         description = ''
           CUPS drivers to use. Drivers provided by CUPS, cups-filters,
           Ghostscript and Samba are added unconditionally. If this list contains

third_party/nixpkgs/nixos/modules/services/web-apps/moinmoin.nix

@@ -211,7 +211,7 @@ in
             environment = let
               penv = python.buildEnv.override {
                 # setuptools: https://github.com/benoitc/gunicorn/issues/1716
-                extraLibs = [ python.pkgs.gevent python.pkgs.setuptools pkg ];
+                extraLibs = [ python.pkgs.eventlet python.pkgs.setuptools pkg ];
               };
             in {
               PYTHONPATH = "${dataDir}/${wikiIdent}/config:${penv}/${python.sitePackages}";
@@ -233,7 +233,7 @@ in
               ExecStart = ''${python.pkgs.gunicorn}/bin/gunicorn moin_wsgi \
                 --name gunicorn-${wikiIdent} \
                 --workers ${toString cfg.gunicorn.workers} \
-                --worker-class gevent \
+                --worker-class eventlet \
                 --bind unix:/run/moin/${wikiIdent}/gunicorn.sock
               '';
 

third_party/nixpkgs/nixos/modules/system/boot/loader/grub/install-grub.pl

@@ -356,11 +356,11 @@ else {
         if ($suffix eq ".jpg") {
             $suffix = ".jpeg";
         }
-		if ($backgroundColor) {
+        if ($backgroundColor) {
-			$conf .= "
+            $conf .= "
-		    background_color '$backgroundColor'
+            background_color '$backgroundColor'
-		    ";
+            ";
-		}
+        }
         copy $splashImage, "$bootPath/background$suffix" or die "cannot copy $splashImage to $bootPath: $!\n";
         $conf .= "
             insmod " . substr($suffix, 1) . "

third_party/nixpkgs/nixos/modules/system/boot/luksroot.nix

@@ -56,7 +56,7 @@ let
 
         ykinfo -v 1>/dev/null 2>&1
         if [ $? != 0 ]; then
-            echo -n "Waiting $secs seconds for Yubikey to appear..."
+            echo -n "Waiting $secs seconds for YubiKey to appear..."
             local success=false
             for try in $(seq $secs); do
                 echo -n .
@@ -118,7 +118,7 @@ let
     # Cryptsetup locking directory
     mkdir -p /run/cryptsetup
 
-    # For Yubikey salt storage
+    # For YubiKey salt storage
     mkdir -p /crypt-storage
 
     ${optionalString luks.gpgSupport ''
@@ -218,7 +218,7 @@ let
     }
 
     ${optionalString (luks.yubikeySupport && (yubikey != null)) ''
-    # Yubikey
+    # YubiKey
     rbtohex() {
         ( od -An -vtx1 | tr -d ' \n' )
     }
@@ -244,7 +244,7 @@ let
         local new_k_luks
 
         mount -t ${yubikey.storage.fsType} ${yubikey.storage.device} /crypt-storage || \
-          die "Failed to mount Yubikey salt storage device"
+          die "Failed to mount YubiKey salt storage device"
 
         salt="$(cat /crypt-storage${yubikey.storage.path} | sed -n 1p | tr -d '\n')"
         iterations="$(cat /crypt-storage${yubikey.storage.path} | sed -n 2p | tr -d '\n')"
@@ -254,8 +254,27 @@ let
         for try in $(seq 3); do
             ${optionalString yubikey.twoFactor ''
             echo -n "Enter two-factor passphrase: "
-            read -r k_user
+            k_user=
-            echo
+            while true; do
+                if [ -e /crypt-ramfs/passphrase ]; then
+                    echo "reused"
+                    k_user=$(cat /crypt-ramfs/passphrase)
+                    break
+                else
+                    # Try reading it from /dev/console with a timeout
+                    IFS= read -t 1 -r k_user
+                    if [ -n "$k_user" ]; then
+                       ${if luks.reusePassphrases then ''
+                         # Remember it for the next device
+                         echo -n "$k_user" > /crypt-ramfs/passphrase
+                       '' else ''
+                         # Don't save it to ramfs. We are very paranoid
+                       ''}
+                       echo
+                       break
+                    fi
+                fi
+            done
             ''}
 
             if [ ! -z "$k_user" ]; then
@@ -268,6 +287,11 @@ let
 
             if [ $? == 0 ]; then
                 opened=true
+                ${if luks.reusePassphrases then ''
+                  # We don't rm here because we might reuse it for the next device
+                '' else ''
+                  rm -f /crypt-ramfs/passphrase
+                ''}
                 break
             else
                 opened=false
@@ -317,7 +341,7 @@ let
         if wait_yubikey ${toString yubikey.gracePeriod}; then
             do_open_yubikey
         else
-            echo "No yubikey found, falling back to non-yubikey open procedure"
+            echo "No YubiKey found, falling back to non-YubiKey open procedure"
             open_normally
         fi
     }
@@ -665,8 +689,8 @@ in
           yubikey = mkOption {
             default = null;
             description = ''
-              The options to use for this LUKS device in Yubikey-PBA.
+              The options to use for this LUKS device in YubiKey-PBA.
-              If null (the default), Yubikey-PBA will be disabled for this device.
+              If null (the default), YubiKey-PBA will be disabled for this device.
             '';
 
             type = with types; nullOr (submodule {
@@ -674,13 +698,13 @@ in
                 twoFactor = mkOption {
                   default = true;
                   type = types.bool;
-                  description = "Whether to use a passphrase and a Yubikey (true), or only a Yubikey (false).";
+                  description = "Whether to use a passphrase and a YubiKey (true), or only a YubiKey (false).";
                 };
 
                 slot = mkOption {
                   default = 2;
                   type = types.int;
-                  description = "Which slot on the Yubikey to challenge.";
+                  description = "Which slot on the YubiKey to challenge.";
                 };
 
                 saltLength = mkOption {
@@ -704,7 +728,7 @@ in
                 gracePeriod = mkOption {
                   default = 10;
                   type = types.int;
-                  description = "Time in seconds to wait for the Yubikey.";
+                  description = "Time in seconds to wait for the YubiKey.";
                 };
 
                 /* TODO: Add to the documentation of the current module:
@@ -779,9 +803,9 @@ in
       default = false;
       type = types.bool;
       description = ''
-            Enables support for authenticating with a Yubikey on LUKS devices.
+            Enables support for authenticating with a YubiKey on LUKS devices.
             See the NixOS wiki for information on how to properly setup a LUKS device
-            and a Yubikey to work with this feature.
+            and a YubiKey to work with this feature.
           '';
     };
 
@@ -799,7 +823,7 @@ in
 
     assertions =
       [ { assertion = !(luks.gpgSupport && luks.yubikeySupport);
-          message = "Yubikey and GPG Card may not be used at the same time.";
+          message = "YubiKey and GPG Card may not be used at the same time.";
         }
 
         { assertion = !(luks.gpgSupport && luks.fido2Support);
@@ -807,7 +831,7 @@ in
         }
 
         { assertion = !(luks.fido2Support && luks.yubikeySupport);
-          message = "FIDO2 and Yubikey may not be used at the same time.";
+          message = "FIDO2 and YubiKey may not be used at the same time.";
         }
       ];
 

third_party/nixpkgs/nixos/tests/all-tests.nix

@@ -82,6 +82,7 @@ in
   corerad = handleTest ./corerad.nix {};
   couchdb = handleTest ./couchdb.nix {};
   cri-o = handleTestOn ["x86_64-linux"] ./cri-o.nix {};
+  custom-ca = handleTest ./custom-ca.nix {};
   deluge = handleTest ./deluge.nix {};
   dhparams = handleTest ./dhparams.nix {};
   dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};

third_party/nixpkgs/nixos/tests/custom-ca.nix

@@ -0,0 +1,161 @@
+# Checks that `security.pki` options are working in curl and the main browser
+# engines: Gecko (via Firefox), Chromium, QtWebEngine (Falkon) and WebKitGTK
+# (via Midori). The test checks that certificates issued by a custom trusted
+# CA are accepted but those from an unknown CA are rejected.
+
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+
+let
+  makeCert = { caName, domain }: pkgs.runCommand "example-cert"
+  { buildInputs = [ pkgs.gnutls ]; }
+  ''
+    mkdir $out
+
+    # CA cert template
+    cat >ca.template <<EOF
+    organization = "${caName}"
+    cn = "${caName}"
+    expiration_days = 365
+    ca
+    cert_signing_key
+    crl_signing_key
+    EOF
+
+    # server cert template
+    cat >server.template <<EOF
+    organization = "An example company"
+    cn = "${domain}"
+    expiration_days = 30
+    dns_name = "${domain}"
+    encryption_key
+    signing_key
+    EOF
+
+    # generate CA keypair
+    certtool                \
+      --generate-privkey    \
+      --key-type rsa        \
+      --sec-param High      \
+      --outfile $out/ca.key
+    certtool                     \
+      --generate-self-signed     \
+      --load-privkey $out/ca.key \
+      --template ca.template     \
+      --outfile $out/ca.crt
+
+    # generate server keypair
+    certtool                    \
+      --generate-privkey        \
+      --key-type rsa            \
+      --sec-param High          \
+      --outfile $out/server.key
+    certtool                            \
+      --generate-certificate            \
+      --load-privkey $out/server.key    \
+      --load-ca-privkey $out/ca.key     \
+      --load-ca-certificate $out/ca.crt \
+      --template server.template        \
+      --outfile $out/server.crt
+  '';
+
+  example-good-cert = makeCert
+    { caName = "Example good CA";
+      domain = "good.example.com";
+    };
+
+  example-bad-cert = makeCert
+    { caName = "Unknown CA";
+      domain = "bad.example.com";
+    };
+
+in
+
+{
+  name = "custom-ca";
+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
+  enableOCR = true;
+
+  machine = { pkgs, ... }:
+    { imports = [ ./common/user-account.nix ./common/x11.nix ];
+
+      # chromium-based browsers refuse to run as root
+      test-support.displayManager.auto.user = "alice";
+      # browsers may hang with the default memory
+      virtualisation.memorySize = "500";
+
+      networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
+      security.pki.certificateFiles = [ "${example-good-cert}/ca.crt" ];
+
+      services.nginx.enable = true;
+      services.nginx.virtualHosts."good.example.com" =
+        { onlySSL = true;
+          sslCertificate = "${example-good-cert}/server.crt";
+          sslCertificateKey = "${example-good-cert}/server.key";
+          locations."/".extraConfig = "return 200 'It works!';";
+        };
+      services.nginx.virtualHosts."bad.example.com" =
+        { onlySSL = true;
+          sslCertificate = "${example-bad-cert}/server.crt";
+          sslCertificateKey = "${example-bad-cert}/server.key";
+          locations."/".extraConfig = "return 200 'It does not work!';";
+        };
+
+      environment.systemPackages = with pkgs;
+        [ xdotool firefox chromium falkon midori ];
+    };
+
+  testScript = ''
+    def execute_as(user: str, cmd: str) -> Tuple[int, str]:
+        """
+        Run a shell command as a specific user.
+        """
+        return machine.execute(f"sudo -u {user} {cmd}")
+
+
+    def wait_for_window_as(user: str, cls: str) -> None:
+        """
+        Wait until a X11 window of a given user appears.
+        """
+
+        def window_is_visible(last_try: bool) -> bool:
+            ret, stdout = execute_as(user, f"xdotool search --onlyvisible --class {cls}")
+            if last_try:
+                machine.log(f"Last chance to match {cls} on the window list")
+            return ret == 0
+
+        with machine.nested("Waiting for a window to appear"):
+            retry(window_is_visible)
+
+
+    machine.start()
+
+    with subtest("Good certificate is trusted in curl"):
+        machine.wait_for_unit("nginx")
+        machine.wait_for_open_port(443)
+        machine.succeed("curl -fv https://good.example.com")
+
+    with subtest("Unknown CA is untrusted in curl"):
+        machine.fail("curl -fv https://bad.example.com")
+
+    browsers = ["firefox", "chromium", "falkon", "midori"]
+    errors = ["Security Risk", "not private", "Certificate Error", "Security"]
+
+    machine.wait_for_x()
+    for browser, error in zip(browsers, errors):
+        with subtest("Good certificate is trusted in " + browser):
+            execute_as(
+                "alice", f"env P11_KIT_DEBUG=trust {browser} https://good.example.com & >&2"
+            )
+            wait_for_window_as("alice", browser)
+            machine.wait_for_text("It works!")
+            machine.screenshot("good" + browser)
+            execute_as("alice", "xdotool key ctrl+w")  # close tab
+
+        with subtest("Unknown CA is untrusted in " + browser):
+            execute_as("alice", f"{browser} https://bad.example.com & >&2")
+            machine.wait_for_text(error)
+            machine.screenshot("bad" + browser)
+            machine.succeed("pkill " + browser)
+  '';
+})

third_party/nixpkgs/nixos/tests/installer.nix

@@ -325,10 +325,13 @@ let
             curl
           ]
           ++ optional (bootLoader == "grub" && grubVersion == 1) pkgs.grub
-          ++ optionals (bootLoader == "grub" && grubVersion == 2) [
+          ++ optionals (bootLoader == "grub" && grubVersion == 2) (let
-            (pkgs.grub2.override { zfsSupport = true; })
+            zfsSupport = lib.any (x: x == "zfs")
-            (pkgs.grub2_efi.override { zfsSupport = true; })
+              (extraInstallerConfig.boot.supportedFilesystems or []);
-          ];
+          in [
+            (pkgs.grub2.override { inherit zfsSupport; })
+            (pkgs.grub2_efi.override { inherit zfsSupport; })
+          ]);
 
           nix.binaryCaches = mkForce [ ];
           nix.extraOptions = ''
@@ -398,9 +401,9 @@ let
     createPartitions = ''
       machine.succeed(
           "flock /dev/vda parted --script /dev/vda -- mklabel gpt"
-          + " mkpart ESP fat32 1M 50MiB"  # /boot
+          + " mkpart ESP fat32 1M 100MiB"  # /boot
           + " set 1 boot on"
-          + " mkpart primary linux-swap 50MiB 1024MiB"
+          + " mkpart primary linux-swap 100MiB 1024MiB"
           + " mkpart primary ext2 1024MiB -1MiB",  # /
           "udevadm settle",
           "mkswap /dev/vda2 -L swap",

third_party/nixpkgs/nixos/tests/openldap.nix

@@ -1,4 +1,9 @@
-{ pkgs, system ? builtins.currentSystem, ... }: let
+{ pkgs ? (import ../.. { inherit system; config = { }; })
+, system ? builtins.currentSystem
+, ...
+}:
+
+let
   dbContents = ''
     dn: dc=example
     objectClass: domain
@@ -16,7 +21,7 @@
   '';
 in {
   # New-style configuration
-  current = import ./make-test-python.nix {
+  current = import ./make-test-python.nix ({ pkgs, ... }: {
     inherit testScript;
     name = "openldap";
 
@@ -53,10 +58,10 @@ in {
         declarativeContents."dc=example" = dbContents;
       };
     };
-  };
+  }) { inherit pkgs system; };
 
   # Old-style configuration
-  oldOptions = import ./make-test-python.nix {
+  oldOptions = import ./make-test-python.nix ({ pkgs, ... }: {
     inherit testScript;
     name = "openldap";
 
@@ -72,10 +77,10 @@ in {
         declarativeContents."dc=example" = dbContents;
       };
     };
-  };
+  }) { inherit system pkgs; };
 
   # Manually managed configDir, for example if dynamic config is essential
-  manualConfigDir = import ./make-test-python.nix {
+  manualConfigDir = import ./make-test-python.nix ({ pkgs, ... }: {
     name = "openldap";
 
     machine = { pkgs, ... }: {
@@ -121,5 +126,5 @@ in {
           "systemctl restart openldap",
       )
     '' + testScript;
-  };
+  }) { inherit system pkgs; };
 }

third_party/nixpkgs/pkgs/applications/audio/ashuffle/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ashuffle";
-  version = "3.4.0";
+  version = "3.10.1";
 
   src = fetchFromGitHub {
     owner = "joshkunz";
     repo = "ashuffle";
     rev = "v${version}";
-    sha256 = "09q6lwgc1dc8bg1mb9js9qz3xcsxph3548nxzvyb4v8111gixrp7";
+    sha256 = "103jhajqwryiaf52qqgshajcnsxsz4l8gn3sz6bxs7k0yq5x1knr";
     fetchSubmodules = true;
   };
 

third_party/nixpkgs/pkgs/applications/audio/csound/csound-qt/default.nix

@@ -40,6 +40,8 @@ stdenv.mkDerivation rec {
                  "SHARE_DIR=${placeholder "out"}/share"
                  ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "CsoundQt is a frontend for Csound with editor, integrated help, widgets and other features";
     homepage = "https://csoundqt.github.io/";

third_party/nixpkgs/pkgs/applications/audio/espeak-ng/default.nix

@@ -1,5 +1,6 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, which, libtool, pkg-config
-, ronn
+, ronn, substituteAll
+, mbrolaSupport ? true, mbrola
 , pcaudiolibSupport ? true, pcaudiolib
 , sonicSupport ? true, sonic }:
 
@@ -14,13 +15,26 @@ stdenv.mkDerivation rec {
     sha256 = "0jkqhf2h94vbqq7mg7mmm23bq372fa7mdk941my18c3vkldcir1b";
   };
 
+  patches = lib.optionals mbrolaSupport [
+    # Hardcode correct mbrola paths.
+    (substituteAll {
+      src = ./mbrola.patch;
+      inherit mbrola;
+    })
+  ];
+
   nativeBuildInputs = [ autoconf automake which libtool pkg-config ronn ];
 
-  buildInputs = lib.optional pcaudiolibSupport pcaudiolib
+  buildInputs = lib.optional mbrolaSupport mbrola
+             ++ lib.optional pcaudiolibSupport pcaudiolib
              ++ lib.optional sonicSupport sonic;
 
   preConfigure = "./autogen.sh";
 
+  configureFlags = [
+    "--with-mbrola=${if mbrolaSupport then "yes" else "no"}"
+  ];
+
   postInstall = lib.optionalString stdenv.isLinux ''
     patchelf --set-rpath "$(patchelf --print-rpath $out/bin/espeak-ng)" $out/bin/speak-ng
   '';
@@ -29,7 +43,7 @@ stdenv.mkDerivation rec {
     description = "Open source speech synthesizer that supports over 70 languages, based on eSpeak";
     homepage = "https://github.com/espeak-ng/espeak-ng";
     changelog = "https://github.com/espeak-ng/espeak-ng/blob/${version}/CHANGELOG.md";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ aske ];
     platforms = platforms.all;
   };

third_party/nixpkgs/pkgs/applications/audio/espeak-ng/mbrola.patch

@@ -0,0 +1,22 @@
+--- a/src/libespeak-ng/mbrowrap.c
++++ b/src/libespeak-ng/mbrowrap.c
+@@ -205,7 +205,7 @@
+ 		signal(SIGTERM, SIG_IGN);
+ 
+ 		snprintf(charbuf, sizeof(charbuf), "%g", mbr_volume);
+-		execlp("mbrola", "mbrola", "-e", "-v", charbuf,
++		execlp("@mbrola@/bin/mbrola", "mbrola", "-e", "-v", charbuf,
+ 		       voice_path, "-", "-.wav", (char *)NULL);
+ 		/* if execution reaches this point then the exec() failed */
+ 		snprintf(mbr_errorbuf, sizeof(mbr_errorbuf),
+--- a/src/libespeak-ng/synth_mbrola.c
++++ b/src/libespeak-ng/synth_mbrola.c
+@@ -85,7 +85,7 @@
+ 	if (!load_MBR())
+ 		return ENS_MBROLA_NOT_FOUND;
+ 
+-	sprintf(path, "%s/mbrola/%s", path_home, mbrola_voice);
++	sprintf(path, "@mbrola@/share/mbrola/voices/%s/%s", mbrola_voice, mbrola_voice);
+ #ifdef PLATFORM_POSIX
+ 	// if not found, then also look in
+ 	//   usr/share/mbrola/xx, /usr/share/mbrola/xx/xx, /usr/share/mbrola/voices/xx

third_party/nixpkgs/pkgs/applications/audio/keyfinder/default.nix

@@ -20,6 +20,8 @@ mkDerivation rec {
        --replace "\$\$[QT_INSTALL_PREFIX]" "$out"
   '';
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Musical key detection for digital audio (graphical UI)";
     longDescription = ''

third_party/nixpkgs/pkgs/applications/audio/kmetronome/default.nix

@@ -13,6 +13,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ alsaLib drumstick qtbase qtsvg ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     homepage = "https://kmetronome.sourceforge.io/";
     description = "ALSA MIDI metronome with Qt interface";

third_party/nixpkgs/pkgs/applications/audio/mbrola/default.nix

@@ -0,0 +1,39 @@
+{ stdenv, lib, fetchFromGitHub }:
+
+let
+  voices = fetchFromGitHub {
+    owner = "numediart";
+    repo = "MBROLA-voices";
+    rev = "fe05a0ccef6a941207fd6aaad0b31294a1f93a51";  # using latest commit
+    sha256 = "1w0y2xjp9rndwdjagp2wxh656mdm3d6w9cs411g27rjyfy1205a0";
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "mbrola";
+  version = "3.3";
+
+  src = fetchFromGitHub {
+    owner = "numediart";
+    repo = "MBROLA";
+    rev = version;
+    sha256 = "1w86gv6zs2cbr0731n49z8v6xxw0g8b0hzyv2iqb9mqcfh38l8zy";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    install -D Bin/mbrola $out/bin/mbrola
+
+    # TODO: package separately because it's very big
+    install -d $out/share/mbrola/voices
+    cp -R ${voices}/data/* $out/share/mbrola/voices/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Speech synthesizer based on the concatenation of diphones";
+    homepage = "https://github.com/numediart/MBROLA";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ davidak ];
+    platforms = platforms.linux;
+  };
+}

third_party/nixpkgs/pkgs/applications/audio/mopidy/somafm.nix

@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication rec {
   doCheck = false;
 
   meta = with lib; {
-    homepage = https://www.mopidy.com/;
+    homepage = "https://www.mopidy.com/";
     description = "Mopidy extension for playing music from SomaFM";
     license = licenses.mit;
     maintainers = [ maintainers.nickhu ];

third_party/nixpkgs/pkgs/applications/audio/netease-music-tui/default.nix

@@ -17,7 +17,6 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ alsaLib openssl ];
 
   cargoSha256 = "1kfbnwy3lkbhz0ggxwr5n6qd1plipkr1ycr3z2r7c0amrzzbkc7l";
-  verifyCargoDeps = true;
 
   meta = with lib; {
     homepage = "https://github.com/betta-cyber/netease-music-tui";

third_party/nixpkgs/pkgs/applications/audio/nootka/default.nix

@@ -21,6 +21,8 @@ stdenv.mkDerivation rec {
     "-DENABLE_PULSEAUDIO=ON"
   ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Application for practicing playing musical scores and ear training";
     homepage = "https://nootka.sourceforge.io/";

third_party/nixpkgs/pkgs/applications/audio/nootka/unstable.nix

@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
     qtbase qtdeclarative qtquickcontrols2
   ];
 
+  dontWrapQtApps = true;
+
   cmakeFlags = [
     "-DCMAKE_INCLUDE_PATH=${libjack2}/include/jack;${libpulseaudio.dev}/include/pulse"
     "-DENABLE_JACK=ON"

third_party/nixpkgs/pkgs/applications/audio/ocenaudio/default.nix

@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
   dontUnpack = true;
   dontBuild = true;
   dontStrip = true;
+  dontWrapQtApps = true;
 
   installPhase = ''
     mkdir -p $out

third_party/nixpkgs/pkgs/applications/audio/playbar2/default.nix

@@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
     kwindowsystem
   ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Mpris2 Client for Plasma5";
     homepage = "https://github.com/audoban/PlayBar2";

third_party/nixpkgs/pkgs/applications/audio/seq66/default.nix

@@ -25,6 +25,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     homepage = "https://github.com/ahlstromcj/seq66";
     description = "Loop based midi sequencer with Qt GUI derived from seq24 and sequencer64";

third_party/nixpkgs/pkgs/applications/audio/spectmorph/default.nix

@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Allows to analyze samples of musical instruments, and to combine them (morphing) to construct hybrid sounds";
     homepage = "http://spectmorph.org";

third_party/nixpkgs/pkgs/applications/backup/vorta/default.nix

@@ -6,13 +6,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "vorta";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "borgbase";
     repo = "vorta";
     rev = "v${version}";
-    sha256 = "1amq0fz3xrnxplzd6ih2azx6b4k1w496kcr7f8agfp617f5rkwa5";
+    sha256 = "sha256-nnnGqkT4sAunaT7GPysYQGeV34ZrRFaHK/gJRafvR3U=";
   };
 
   postPatch = ''

third_party/nixpkgs/pkgs/applications/blockchains/bitcoin-classic.nix

@@ -28,6 +28,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  dontWrapQtApps = true;
+
   meta = {
     description = "Peer-to-peer electronic cash system (Classic client)";
     longDescription= ''

third_party/nixpkgs/pkgs/applications/blockchains/openethereum/default.nix

@@ -37,8 +37,14 @@ rustPlatform.buildRustPackage rec {
 
   cargoBuildFlags = [ "--features final" ];
 
-  # test result: FAILED. 88 passed; 13 failed; 0 ignored; 0 measured; 0 filtered out
+  # Fix tests by preventing them from writing to /homeless-shelter.
-  doCheck = false;
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  # Exclude some tests that don't work in the sandbox
+  # - Nat test requires network access
+  checkFlags = "--skip configuration::tests::should_resolve_external_nat_hosts";
 
   meta = with lib; {
     description = "Fast, light, robust Ethereum implementation";

third_party/nixpkgs/pkgs/applications/blockchains/wasabiwallet/default.nix

@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wasabiwallet";
-  version = "1.1.12.3";
+  version = "1.1.12.4";
 
   src = fetchurl {
     url = "https://github.com/zkSNACKs/WalletWasabi/releases/download/v${version}/Wasabi-${version}.tar.gz";
-    sha256 = "1x4gqmiwdp5bjq7c5hjch3srsvf73d92lswnp355l7l7cxh2hcsx";
+    sha256 = "sha256-1yg0C1lJrLxQEs2GA+XEBUx/JAyc+aW0UWjLhSEy0RI=";
   };
 
   dontBuild = true;

third_party/nixpkgs/pkgs/applications/display-managers/lightdm/default.nix

@@ -101,6 +101,8 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  dontWrapQtApps = true;
+
   preConfigure = "NOCONFIGURE=1 ./autogen.sh";
 
   configureFlags = [

third_party/nixpkgs/pkgs/applications/editors/code-browser/default.nix

@@ -39,6 +39,9 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals withQt [ "UI=qt" ]
   ++ lib.optionals withGtk [ "UI=gtk" ];
+
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Folding text editor, designed to hierarchically structure any kind of text file and especially source code";
     homepage = "https://tibleiz.net/code-browser/";

third_party/nixpkgs/pkgs/applications/editors/eclipse/plugins.nix

@@ -413,6 +413,22 @@ rec {
     };
   };
 
+  freemarker = buildEclipseUpdateSite rec {
+    name = "freemarker-${version}";
+    version = "1.5.305";
+
+    src = fetchzip {
+      url = "https://github.com/ddekany/jbosstools-freemarker/releases/download/v${version}/freemarker.site-${version}.zip";
+      sha256 = "1qrhi300vk07gi14r445wvy0bvghbjd6c4k7q09pqpaxv6raiczn";
+      stripRoot = false;
+    };
+
+    meta = with lib; {
+      homepage = "https://github.com/ddekany/jbosstools-freemarker";
+      description = "Plugin that provides an editor for Apache FreeMarker files";
+    };
+  };
+
   gnuarmeclipse = buildEclipseUpdateSite rec {
     name = "gnuarmeclipse-${version}";
     version = "3.1.1-201606210758";

third_party/nixpkgs/pkgs/applications/editors/emacs-modes/elpa-packages.nix

@@ -20,7 +20,7 @@ instantenous and formats commits for you.
 
 */
 
-{ lib, stdenv, texinfo }:
+{ lib, stdenv, texinfo, writeText }:
 
 self: let
 
@@ -31,7 +31,7 @@ self: let
   };
 
   elpaBuild = import ../../../build-support/emacs/elpa.nix {
-    inherit lib stdenv texinfo;
+    inherit lib stdenv texinfo writeText;
     inherit (self) emacs;
   };
 

third_party/nixpkgs/pkgs/applications/editors/emacs-modes/melpa-packages.nix

@@ -47,6 +47,11 @@ let
       });
     }) else null;
 
+  buildWithGit = pkg: pkg.overrideAttrs (attrs: {
+    nativeBuildInputs =
+      (attrs.nativeBuildInputs or [ ]) ++ [ pkgs.git ];
+  });
+
   fix-rtags = pkg:
     if pkg != null then dontConfigure (externalSrc pkg external.rtags)
     else null;
@@ -120,27 +125,10 @@ let
           packageRequires = with self; [ evil ];
         });
 
-        evil-magit = super.evil-magit.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
-        eopengrok = super.eopengrok.overrideAttrs (attrs: {
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
         ess-R-data-view = super.ess-R-data-view.override {
           inherit (self.melpaPackages) ess ctable popup;
         };
 
-        forge = super.forge.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
         flycheck-rtags = fix-rtags super.flycheck-rtags;
 
         pdf-tools = super.pdf-tools.overrideAttrs (old: {
@@ -211,113 +199,81 @@ let
           '';
         });
 
-        magit = super.magit.overrideAttrs (attrs: {
+        evil-magit = buildWithGit super.evil-magit;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-find-file = super.magit-find-file.overrideAttrs (attrs: {
+        eopengrok = buildWithGit super.eopengrok;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-gh-pulls = super.magit-gh-pulls.overrideAttrs (attrs: {
+        forge = buildWithGit super.forge;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-imerge = super.magit-imerge.overrideAttrs (attrs: {
+        magit = buildWithGit super.magit;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-lfs = super.magit-lfs.overrideAttrs (attrs: {
+        magit-find-file = buildWithGit super.magit-find-file;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-org-todos = super.magit-org-todos.overrideAttrs (attrs: {
+        magit-gh-pulls = buildWithGit super.magit-gh-pulls;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-tbdiff = super.magit-tbdiff.overrideAttrs (attrs: {
+        magit-imerge = buildWithGit super.magit-imerge;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-topgit = super.magit-topgit.overrideAttrs (attrs: {
+        magit-lfs = buildWithGit super.magit-lfs;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-vcsh = super.magit-vcsh.overrideAttrs (attrs: {
+        magit-org-todos = buildWithGit super.magit-org-todos;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-gerrit = super.magit-gerrit.overrideAttrs (attrs: {
+        magit-tbdiff = buildWithGit super.magit-tbdiff;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-annex = super.magit-annex.overrideAttrs (attrs: {
+        magit-topgit = buildWithGit super.magit-topgit;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-todos = super.magit-todos.overrideAttrs (attrs: {
+        magit-vcsh = buildWithGit super.magit-vcsh;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-filenotify = super.magit-filenotify.overrideAttrs (attrs: {
+        magit-gerrit = buildWithGit super.magit-gerrit;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-gitflow = super.magit-gitflow.overrideAttrs (attrs: {
+        magit-annex = buildWithGit super.magit-annex;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magithub = super.magithub.overrideAttrs (attrs: {
+        magit-todos = buildWithGit super.magit-todos;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        magit-svn = super.magit-svn.overrideAttrs (attrs: {
+        magit-filenotify = buildWithGit super.magit-filenotify;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        kubernetes = super.kubernetes.overrideAttrs (attrs: {
+        magit-gitflow = buildWithGit super.magit-gitflow;
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
 
-        kubernetes-evil = super.kubernetes-evil.overrideAttrs (attrs: {
+        magithub = buildWithGit super.magithub;
-          # searches for Git at build time
+
-          nativeBuildInputs =
+        magit-svn = buildWithGit super.magit-svn;
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
+
-        });
+        kubernetes = buildWithGit super.kubernetes;
+
+        kubernetes-evil = buildWithGit super.kubernetes-evil;
+
+        egg = buildWithGit super.egg;
+
+        kapacitor = buildWithGit super.kapacitor;
+
+        gerrit = buildWithGit super.gerrit;
+
+        gerrit-download = buildWithGit super.gerrit-download;
+
+        github-pullrequest = buildWithGit super.github-pullrequest;
+
+        jist = buildWithGit super.jist;
+
+        mandoku = buildWithGit super.mandoku;
+
+        mandoku-tls = buildWithGit super.mandoku-tls;
+
+        magit-p4 = buildWithGit super.magit-p4;
+
+        magit-rbr = buildWithGit super.magit-rbr;
+
+        magit-diff-flycheck = buildWithGit super.magit-diff-flycheck;
+
+        magit-reviewboard = buildWithGit super.magit-reviewboard;
+
+        magit-patch-changelog = buildWithGit super.magit-patch-changelog;
+
+        magit-circleci = buildWithGit super.magit-circleci;
+
+        magit-delta = buildWithGit super.magit-delta;
+
+        orgit = buildWithGit super.orgit;
+
+        orgit-forge = buildWithGit super.orgit-forge;
 
         # upstream issue: missing file header
         mhc = super.mhc.override {
@@ -462,106 +418,13 @@ let
           propagatedUserEnvPkgs = [ external.editorconfig-core-c ];
         });
 
-        egg = super.egg.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
         # missing dependencies
         evil-search-highlight-persist = super.evil-search-highlight-persist.overrideAttrs (attrs: {
           packageRequires = with self; [ evil highlight ];
         });
 
-        kapacitor = super.kapacitor.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
-        gerrit = super.gerrit.overrideAttrs (attrs: {
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
-        gerrit-download = super.gerrit-download.overrideAttrs (attrs: {
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
-        github-pullrequest = super.github-pullrequest.overrideAttrs (attrs: {
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
         helm-rtags = fix-rtags super.helm-rtags;
 
-        jist = super.jist.overrideAttrs (attrs: {
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
-        mandoku = super.mandoku.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
-        mandoku-tls = super.mandoku-tls.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
-        magit-p4 = super.magit-p4.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
-        magit-rbr = super.magit-rbr.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
-        magit-diff-flycheck = super.magit-diff-flycheck.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
-        magit-reviewboard = super.magit-reviewboard.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
-        magit-patch-changelog = super.magit-patch-changelog.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
-        magit-circleci = super.magit-circleci.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
-        orgit =
-          (super.orgit.overrideAttrs (attrs: {
-            # searches for Git at build time
-            nativeBuildInputs =
-              (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-          }));
-
-        orgit-forge = super.orgit-forge.overrideAttrs (attrs: {
-          # searches for Git at build time
-          nativeBuildInputs =
-            (attrs.nativeBuildInputs or [ ]) ++ [ external.git ];
-        });
-
         # tries to write to $HOME
         php-auto-yasnippets = super.php-auto-yasnippets.overrideAttrs (attrs: {
           HOME = "/tmp";

third_party/nixpkgs/pkgs/applications/editors/emacs/generic.nix

@@ -159,6 +159,10 @@ let emacs = stdenv.mkDerivation (lib.optionalAttrs nativeComp {
   '' + lib.optionalString (nativeComp && withNS) ''
     ln -snf $out/lib/emacs/*/native-lisp $out/Applications/Emacs.app/Contents/native-lisp
   '' + lib.optionalString nativeComp ''
+    $out/bin/emacs --batch \
+      -l comp --eval "(mapatoms (lambda (s) \
+                        (when (subr-primitive-p (symbol-function s)) \
+                          (comp-trampoline-compile s))))"
     mkdir -p $out/share/emacs/native-lisp
     $out/bin/emacs --batch \
       --eval "(add-to-list 'comp-eln-load-path \"$out/share/emacs/native-lisp\")" \

third_party/nixpkgs/pkgs/applications/editors/formiko/default.nix

@@ -0,0 +1,52 @@
+{ lib
+, buildPythonApplication
+, fetchFromGitHub
+, wrapGAppsHook
+, gobject-introspection
+, gtk3
+, docutils
+, gtksourceview
+, gtkspell3
+, librsvg
+, pygobject3
+, webkitgtk
+}:
+
+buildPythonApplication rec {
+  pname = "formiko";
+  version = "1.4.3";
+
+  src = fetchFromGitHub {
+    owner = "ondratu";
+    repo = "formiko";
+    rev = version;
+    sha256 = "0n7w585gbrpn2xcd5n04hivrjarpr2wj260y2kpxpgh93vn52sdi";
+  };
+
+  nativeBuildInputs = [
+    wrapGAppsHook
+    gobject-introspection
+    gtk3
+  ];
+  propagatedBuildInputs = [
+    docutils
+    gobject-introspection
+    gtk3
+    gtksourceview
+    gtkspell3
+    librsvg
+    pygobject3
+    webkitgtk
+  ];
+
+  # Needs a display
+  doCheck = false;
+
+  meta = with lib; {
+    description = "reStructuredText editor and live previewer";
+    homepage = "https://github.com/ondratu/formiko";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ shamilton ];
+    platforms = platforms.linux;
+  };
+}

third_party/nixpkgs/pkgs/applications/editors/jed/default.nix

@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   ];
 
   configureFlags = [
-    "CC=cc"
+    "CC=${stdenv.cc.targetPrefix}cc"
     "--with-slang=${slang}"
     "JED_ROOT=${placeholder "out"}/share/jed"
   ];

third_party/nixpkgs/pkgs/applications/editors/jetbrains/default.nix

@@ -270,12 +270,12 @@ in
 
   clion = buildClion rec {
     name = "clion-${version}";
-    version = "2020.3.1"; /* updated by script */
+    version = "2020.3.2"; /* updated by script */
     description  = "C/C++ IDE. New. Intelligent. Cross-platform";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "1jfvwir79s0kcqmlx6bbkmc42bplgl7814mnqfcsdzni1qv62pws"; /* updated by script */
+      sha256 = "10120y9ccdlhjrpvfnspfj4s7940b3v3yic78r372wj5ns4bsjax"; /* updated by script */
     };
     wmClass = "jetbrains-clion";
     update-channel = "CLion RELEASE"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@@ -283,12 +283,12 @@ in
 
   datagrip = buildDataGrip rec {
     name = "datagrip-${version}";
-    version = "2020.3.1"; /* updated by script */
+    version = "2020.3.2"; /* updated by script */
     description = "Your Swiss Army Knife for Databases and SQL";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "0jk7ywxk983ld5x71a59dh1hvlnli3sbvg7fbicahas5ml8clxfv"; /* updated by script */
+      sha256 = "1wjaavgslwpz4jniszswdy10rk3622i1w3awdwhgjlcc6mwkwz1f"; /* updated by script */
     };
     wmClass = "jetbrains-datagrip";
     update-channel = "DataGrip RELEASE";
@@ -296,12 +296,12 @@ in
 
   goland = buildGoland rec {
     name = "goland-${version}";
-    version = "2020.3.1"; /* updated by script */
+    version = "2020.3.2"; /* updated by script */
     description = "Up and Coming Go IDE";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "12gi1a2bmafmy7qgqwv3a7b5b46dlhw4ahmkm5pkq6pmxl4y6dmk"; /* updated by script */
+      sha256 = "00wbl4g1wgb9c287z6i7a48bm5zyb1gkmyqmhasmj0n2vamaq6sz"; /* updated by script */
     };
     wmClass = "jetbrains-goland";
     update-channel = "GoLand RELEASE";
@@ -335,12 +335,12 @@ in
 
   mps = buildMps rec {
     name = "mps-${version}";
-    version = "2020.3"; /* updated by script */
+    version = "2020.3.1"; /* updated by script */
     description = "Create your own domain-specific language";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/mps/2020.3/MPS-${version}.tar.gz";
-      sha256 = "0dr1z2sxarz1xif4swxx28hpzsyjd86m0c3xdaw5lmpqwqlzvc5h"; /* updated by script */
+      sha256 = "0qvl724mm53rxfhafl6561rhpwppcadmwr9sh0hpsfgsprh2xznv"; /* updated by script */
     };
     wmClass = "jetbrains-mps";
     update-channel = "MPS RELEASE";
@@ -348,12 +348,12 @@ in
 
   phpstorm = buildPhpStorm rec {
     name = "phpstorm-${version}";
-    version = "2020.3.1"; /* updated by script */
+    version = "2020.3.2"; /* updated by script */
     description = "Professional IDE for Web and PHP developers";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "1c5j3mbg8scsl4c90cjahdk5gs5q72y5a8fhkqa9zmy6di42k99x"; /* updated by script */
+      sha256 = "1dmymlv71syjv8byb9ap9c13fimjl6c3r94dwr9kghdlj3jh7p0k"; /* updated by script */
     };
     wmClass = "jetbrains-phpstorm";
     update-channel = "PhpStorm RELEASE";
@@ -361,12 +361,12 @@ in
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2020.3.2"; /* updated by script */
+    version = "2020.3.3"; /* updated by script */
     description = "PyCharm Community Edition";
     license = lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1z3w6aah635fdrhrzp5af6sgj269jk7mv8vgdd83gxillkx9vq9k"; /* updated by script */
+      sha256 = "0p05pgfmr9515sqbqbjiksg7qzvqxcs119lxfc6dsirdvc1qhnli"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm-ce";
     update-channel = "PyCharm RELEASE";
@@ -374,12 +374,12 @@ in
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2020.3.2"; /* updated by script */
+    version = "2020.3.3"; /* updated by script */
     description = "PyCharm Professional Edition";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1fbb8v40q7vgn5v5dyxb211abr8swnxa3gw18kh3vlk6yc2crzfw"; /* updated by script */
+      sha256 = "1yzv1pxpw6pvsjljqvbnf8qgdx34rs5j232zaq4vb5x2ahswf9mm"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm";
     update-channel = "PyCharm RELEASE";
@@ -400,12 +400,12 @@ in
 
   ruby-mine = buildRubyMine rec {
     name = "ruby-mine-${version}";
-    version = "2020.3.1"; /* updated by script */
+    version = "2020.3.2"; /* updated by script */
     description = "The Most Intelligent Ruby and Rails IDE";
     license = lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "0drxzz6k0cmhir4szg8nwmsi9qh380vrryghmpvx9w83yrcain4c"; /* updated by script */
+      sha256 = "17x3sz4jkz2px25gj813xqrrb2cm7mdl6m5a22zg086phym66g3c"; /* updated by script */
     };
     wmClass = "jetbrains-rubymine";
     update-channel = "RubyMine RELEASE";

third_party/nixpkgs/pkgs/applications/editors/kdevelop5/kdev-php.nix

@@ -12,6 +12,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake extra-cmake-modules ];
   buildInputs = [ kdevelop-pg-qt threadweaver ktexteditor kdevelop-unwrapped ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     maintainers = [ maintainers.aanderse ];
     platforms = platforms.linux;

third_party/nixpkgs/pkgs/applications/editors/kdevelop5/kdev-python.nix

@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake extra-cmake-modules ];
   buildInputs = [ threadweaver ktexteditor kdevelop-unwrapped ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     maintainers = [ maintainers.aanderse ];
     platforms = platforms.linux;

third_party/nixpkgs/pkgs/applications/editors/kdevelop5/kdevelop-pg-qt.nix

@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ qtbase ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     maintainers = [ maintainers.ambrop72 ];
     platforms = platforms.linux;

third_party/nixpkgs/pkgs/applications/editors/qxmledit/default.nix

@@ -19,6 +19,8 @@ stdenv.mkDerivation rec {
     export QXMLEDIT_INST_DOC_DIR="$doc"
   '';
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "Simple XML editor based on qt libraries" ;
     homepage = "https://sourceforge.net/projects/qxmledit";

third_party/nixpkgs/pkgs/applications/editors/texstudio/default.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "texstudio";
-  version = "3.0.4";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "${pname}-org";
     repo = pname;
     rev = version;
-    sha256 = "03q1mdz47crflkvpc364ky52farad7517jhszb1fg1s3c2bnndn0";
+    sha256 = "sha256-40VgWfSjyERHJapiIXSk89O3X1V8rb8JEWqfnAyf1Sc=";
   };
 
   nativeBuildInputs = [ qmake wrapQtAppsHook pkg-config ];

third_party/nixpkgs/pkgs/applications/editors/viw/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ ncurses ];
 
-  makeFlags = [ "CC=cc" ];
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
   checkFlags = [ "test-command" "test-buffer" "test-state" ];
 
   installPhase = ''

third_party/nixpkgs/pkgs/applications/graphics/avocode/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "avocode";
-  version = "4.11.1";
+  version = "4.11.2";
 
   src = fetchurl {
     url = "https://media.avocode.com/download/avocode-app/${version}/avocode-${version}-linux.zip";
-    sha256 = "sha256-Qe5mV9GBLHsmzMQg6dKib/sTnNdyOTj4wYQ9xd/iqJM=";
+    sha256 = "sha256-gE00Pukkf5wXP+SGqJgKJeLR82VtH/iwFNYkBb4Z8q0=";
   };
 
   libPath = lib.makeLibraryPath (with xorg; [

third_party/nixpkgs/pkgs/applications/graphics/gimp/plugins/default.nix

@@ -81,6 +81,29 @@ in
     };
   };
 
+  farbfeld = pluginDerivation rec {
+    pname = "farbfeld";
+    version = "unstable-2019-08-12";
+
+    src = fetchFromGitHub {
+      owner = "ids1024";
+      repo = "gimp-farbfeld";
+      rev = "5feacebf61448bd3c550dda03cd08130fddc5af4";
+      sha256 = "1vmw7k773vrndmfffj0m503digdjmkpcqy2r3p3i5x0qw9vkkkc6";
+    };
+
+    installPhase = ''
+      installPlugin farbfeld
+    '';
+
+    meta = {
+      description = "Gimp plug-in for the farbfeld image format";
+      homepage = "https://github.com/ids1024/gimp-farbfeld";
+      license = lib.licenses.mit;
+      maintainers = with lib.maintainers; [ sikmir ];
+    };
+  };
+
   fourier = pluginDerivation rec {
     /* menu:
        Filters/Generic/FFT Forward

third_party/nixpkgs/pkgs/applications/graphics/inkscape/default.nix

@@ -7,6 +7,7 @@
 , fetchurl
 , gettext
 , gdl
+, ghostscript
 , glib
 , glib-networking
 , glibmm
@@ -74,6 +75,12 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     patchShebangs share/extensions
+    substituteInPlace share/extensions/eps_input.inx \
+      --replace "location=\"path\">ps2pdf" "location=\"absolute\">${ghostscript}/bin/ps2pdf"
+    substituteInPlace share/extensions/ps_input.inx \
+      --replace "location=\"path\">ps2pdf" "location=\"absolute\">${ghostscript}/bin/ps2pdf"
+    substituteInPlace share/extensions/ps_input.py \
+      --replace "call('ps2pdf'" "call('${ghostscript}/bin/ps2pdf'"
     patchShebangs share/templates
     patchShebangs man/fix-roff-punct
   '';

third_party/nixpkgs/pkgs/applications/misc/authy/default.nix

@@ -0,0 +1,110 @@
+{ alsaLib, at-spi2-atk, at-spi2-core, atk, autoPatchelfHook, cairo, cups
+, dbus, electron_9, expat, fetchurl, gdk-pixbuf, glib, gtk3, lib
+, libappindicator-gtk3, libdbusmenu-gtk3, libuuid, makeWrapper
+, nspr, nss, pango, squashfsTools, stdenv, systemd, xorg
+}:
+
+let
+  # Currently only works with electron 9
+  electron = electron_9;
+in
+
+stdenv.mkDerivation rec {
+  pname = "authy";
+  version = "1.8.3";
+  rev = "5";
+
+  buildInputs = [
+    alsaLib
+    at-spi2-atk
+    at-spi2-core
+    atk
+    cairo
+    cups
+    dbus
+    expat
+    gdk-pixbuf
+    glib
+    gtk3
+    libappindicator-gtk3
+    libdbusmenu-gtk3
+    libuuid
+    nspr
+    nss
+    pango
+    stdenv.cc.cc
+    systemd
+    xorg.libX11
+    xorg.libXScrnSaver
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXtst
+    xorg.libxcb
+  ];
+
+  src = fetchurl {
+    url = "https://api.snapcraft.io/api/v1/snaps/download/H8ZpNgIoPyvmkgxOWw5MSzsXK1wRZiHn_${rev}.snap";
+    sha256 = "1yfvkmy34mc1dan9am11yka88jv7a4dslsszy4kcc8vap4cjmgpn";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook makeWrapper squashfsTools ];
+
+  unpackPhase = ''
+    runHook preUnpack
+    unsquashfs "$src"
+    cd squashfs-root
+    if ! grep -q '${version}' meta/snap.yaml; then
+      echo "Package version differs from version found in snap metadata:"
+      grep 'version: ' meta/snap.yaml
+      echo "While the nix package specifies: ${version}."
+      echo "You probably chose the wrong revision or forgot to update the nix version."
+      exit 1
+    fi
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/
+
+    cp -r ./* $out/
+    rm -R ./*
+
+    # The snap package has the `ffmpeg.so` file which is copied over with other .so files
+    mv $out/*.so $out/lib/
+
+    # Replace icon name in Desktop file
+    sed -i 's|''${SNAP}/meta/gui/icon.png|authy|g' "$out/meta/gui/authy.desktop"
+
+    # Move the desktop file, icon, binary to their appropriate locations
+    mkdir -p $out/bin $out/share/applications $out/share/pixmaps/apps
+    cp $out/meta/gui/authy.desktop $out/share/applications/
+    cp $out/meta/gui/icon.png $out/share/pixmaps/authy.png
+    cp $out/${pname} $out/bin/${pname}
+
+    # Cleanup
+    rm -r $out/{data-dir,gnome-platform,meta,scripts,usr,*.sh,*.so}
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
+      --add-flags $out/resources/app.asar
+  '';
+
+  meta = with lib; {
+    homepage = "https://www.authy.com";
+    description = "Twilio Authy two factor authentication desktop application";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ iammrinal0 ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

third_party/nixpkgs/pkgs/applications/misc/dasel/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "dasel";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "TomWright";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-310zrxVjUECg/3+ydo9J8EdF0RbguBIT2PklEgpgRFU=";
+    sha256 = "sha256-fgXhWouqStfxWs6cFNVxWI1INVYswVUTOuLr09utxpY=";
   };
 
   vendorSha256 = "sha256-BdX4DO77mIf/+aBdkNVFUzClsIml1UMcgvikDbbdgcY=";

third_party/nixpkgs/pkgs/applications/misc/far2l/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, makeWrapper, cmake, pkg-config, wxGTK30, glib, pcre, m4, bash
+{ lib, stdenv, fetchFromGitHub, makeWrapper, cmake, pkg-config, wxGTK30, glib, pcre, m4, bash
 , xdg-utils, gvfs, zip, unzip, gzip, bzip2, gnutar, p7zip, xz, imagemagick
 , libuchardet, spdlog, xercesc, fmt, openssl, libssh, samba, neon, libnfs, libarchive }:
 

third_party/nixpkgs/pkgs/applications/misc/gpsbabel/default.nix

@@ -38,6 +38,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  dontWrapQtApps = true;
+
   doCheck = true;
   preCheck = ''
     patchShebangs testo

third_party/nixpkgs/pkgs/applications/misc/gpsbabel/gui.nix

@@ -10,6 +10,8 @@ mkDerivation {
   nativeBuildInputs = [ qmake qttools ];
   buildInputs = [ qtwebkit ];
 
+  dontWrapQtApps = true;
+
   postPatch = ''
     substituteInPlace mainwindow.cc \
       --replace "QApplication::applicationDirPath() + \"/" "\"" \

third_party/nixpkgs/pkgs/applications/misc/gpscorrelate/default.nix

@@ -29,8 +29,8 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "prefix=${placeholder "out"}"
-    "CC=cc"
+    "CC=${stdenv.cc.targetPrefix}cc"
-    "CXX=c++"
+    "CXX=${stdenv.cc.targetPrefix}c++"
     "CFLAGS=-DENABLE_NLS"
   ];
 

third_party/nixpkgs/pkgs/applications/misc/gsimplecal/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gsimplecal";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchurl {
     url = "https://github.com/dmedvinsky/gsimplecal/archive/v${version}.tar.gz";
-    sha256 = "1sa05ifjp41xipfspk5n6l3wzpzmp3i45q88l01p4l6k6drsq336";
+    sha256 = "sha256-f19cnTX83LZT2d01B1EdWSaHcfHqpFPTo5glYkAokq8=";
   };
 
   postPatch = ''

third_party/nixpkgs/pkgs/applications/misc/koreader/default.nix

@@ -11,12 +11,12 @@
 let font-droid = nerdfonts.override { fonts = [ "DroidSansMono" ]; };
 in stdenv.mkDerivation rec {
   pname = "koreader";
-  version = "2021.01.1";
+  version = "2021.02";
 
   src = fetchurl {
     url =
       "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
-    sha256 = "0kignyia2xrg84bqzsp8rid4c79zg11lhw52z1854jw9v9324pja";
+    sha256 = "0v7jx4a2kz1i1k9jqwcxbgdikflk28cnnp69sbhha8pkkbk8c5wh";
   };
 
   sourceRoot = ".";

third_party/nixpkgs/pkgs/applications/misc/mkgmap/default.nix

@@ -14,11 +14,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mkgmap";
-  version = "4600";
+  version = "4601";
 
   src = fetchurl {
     url = "http://www.mkgmap.org.uk/download/mkgmap-r${version}-src.tar.gz";
-    sha256 = "1xnqbyrf5cbxmggkk1pjcj5d1767kbp15v12zy2fpbbn3yf0k3sh";
+    sha256 = "TQ2Ee0sy9q4PUvY3TD6zaQ9oy1xgsw5OAw4RQ7ecCUM=";
   };
 
   patches = [

third_party/nixpkgs/pkgs/applications/misc/nwg-launchers/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nwg-launchers";
-  version = "0.4.3";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vuvYL9N9xdg27uhiTe2OqxZ3/n/9EjlqPxtNMXpqpE8=";
+    sha256 = "sha256-krhFtFQZSwfKPHmVxPGNySPL2Y9+kA0fxjZ/D+mNks4=";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/misc/plasma-applet-volumewin7mixer/default.nix

@@ -16,6 +16,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake extra-cmake-modules ];
   buildInputs = [ plasma-framework kwindowsystem plasma-pa ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "A fork of the default volume plasmoid with a Windows 7 theme (vertical sliders)";
     homepage = "https://github.com/Zren/plasma-applet-volumewin7mixer";

third_party/nixpkgs/pkgs/applications/misc/reddsaver/default.nix

@@ -7,27 +7,27 @@
 }:
 
 rustPlatform.buildRustPackage rec {
-  version = "0.2.3";
   pname = "reddsaver";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "manojkarthick";
     repo = "reddsaver";
     rev = "v${version}";
-    sha256 = "sha256-K6SyfYx8VG0t6yogHwd80AxQuj3TXofHLEqZcDsRs1s=";
+    sha256 = "0wiyzbl9vqx5aq3lpaaqkm3ivj77lqd8bmh8ipgshdflgm1z6yvp";
   };
 
-  cargoSha256 = "sha256-VDr7fcE13Wy7KoGG3U1GSbWqF5Oad4EobgzOL7dtJDo=";
+  cargoSha256 = "0kw5gk7pf4xkmjffs2jxm6sc4chybns88cii2wlgpyvgn4c3cwaa";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ]
     ++ lib.optional stdenv.isDarwin Security;
 
-  # package does not contain tests as of v0.2.3
+  # package does not contain tests as of v0.3.0
   docCheck = false;
 
   meta = with lib; {
-    description = "CLI tool to download saved images from Reddit";
+    description = "CLI tool to download saved media from Reddit";
     homepage = "https://github.com/manojkarthick/reddsaver";
     license = with licenses; [ mit /* or */ asl20 ];
     maintainers = [ maintainers.manojkarthick ];

third_party/nixpkgs/pkgs/applications/misc/redis-desktop-manager/default.nix

@@ -1,5 +1,5 @@
-{ stdenv, lib, fetchFromGitHub, fetchFromGitiles, pkg-config, libssh2
+{ mkDerivation, lib, fetchFromGitHub, fetchFromGitiles, pkg-config, libssh2
-, qtbase, qtdeclarative, qtgraphicaleffects, qtimageformats, qtquickcontrols
+, qtbase, qtdeclarative, qtgraphicaleffects, qtimageformats, qtquickcontrols2
 , qtsvg, qttools, qtquick1, qtcharts
 , qmake
 }:
@@ -13,7 +13,7 @@ let
 
 in
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "redis-desktop-manager";
   version = "0.9.1";
 
@@ -28,10 +28,11 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ pkg-config qmake ];
   buildInputs = [
     libssh2 qtbase qtdeclarative qtgraphicaleffects qtimageformats
-    qtquick1 qtquickcontrols qtsvg qttools qtcharts
+    qtquick1 qtquickcontrols2 qtsvg qttools qtcharts
   ];
 
   dontUseQmakeConfigure = true;
+  dontWrapQtApps = true;
 
   NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated" ];
 
@@ -76,7 +77,7 @@ EOF
   meta = with lib; {
     description = "Cross-platform open source Redis DB management tool";
     homepage = "https://redisdesktop.com/";
-    license = licenses.lgpl21;
+    license = licenses.gpl3Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ cstrahan ];
   };

third_party/nixpkgs/pkgs/applications/misc/redshift-plasma-applet/default.nix

@@ -35,6 +35,8 @@ stdenv.mkDerivation {
     kwindowsystem
   ];
 
+  dontWrapQtApps = true;
+
   meta = with lib; {
     description = "KDE Plasma 5 widget for controlling Redshift";
     homepage = "https://github.com/kotelnik/plasma-applet-redshift-control";

third_party/nixpkgs/pkgs/applications/misc/subsurface/default.nix

@@ -1,16 +1,17 @@
 { lib, stdenv, fetchurl, fetchFromGitHub, autoreconfHook, cmake, wrapQtAppsHook, pkg-config, qmake
 , curl, grantlee, libgit2, libusb-compat-0_1, libssh2, libxml2, libxslt, libzip, zlib
 , qtbase, qtconnectivity, qtlocation, qtsvg, qttools, qtwebkit, libXcomposite
+, bluez
 }:
 
 let
-  version = "4.9.6";
+  version = "4.9.10";
 
   subsurfaceSrc = (fetchFromGitHub {
     owner = "Subsurface";
     repo = "subsurface";
     rev = "v${version}";
-    sha256 = "1w1ak0fi6ljhg2jc4mjqyrbpax3iawrnsaqq6ls7qdzrhi37rggf";
+    sha256 = "12ndhjplz3cwndwzhfc959dc0i6rm2qf3v2d8n9kba8nj63iblfs";
     fetchSubmodules = true;
   });
 
@@ -52,6 +53,8 @@ let
 
     buildInputs = [ qtbase qtlocation libXcomposite ];
 
+    dontWrapQtApps = true;
+
     pluginsSubdir = "lib/qt-${qtbase.qtCompatVersion}/plugins";
 
     installPhase = ''
@@ -82,6 +85,7 @@ in stdenv.mkDerivation {
     libdc googlemaps
     curl grantlee libgit2 libssh2 libusb-compat-0_1 libxml2 libxslt libzip
     qtbase qtconnectivity qtsvg qttools qtwebkit
+    bluez
   ];
 
   nativeBuildInputs = [ cmake wrapQtAppsHook pkg-config ];
@@ -103,7 +107,7 @@ in stdenv.mkDerivation {
     '';
     homepage = "https://subsurface-divelog.org";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ mguentner ];
+    maintainers = with maintainers; [ mguentner adisbladis ];
     platforms = platforms.all;
   };
 }

third_party/nixpkgs/pkgs/applications/misc/swappy/default.nix

@@ -6,25 +6,23 @@
 , pango
 , gtk
 , pkg-config
-, cmake
 , scdoc
 , libnotify
-, gio-sharp
 , glib
 }:
 
 stdenv.mkDerivation rec {
-  name = "swappy-${version}";
+  pname = "swappy";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "jtheoof";
-    repo = "swappy";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "14ac2jmnak7avcz0jhqjm30vk7pv3gq5aq5rdyh84k8c613kkicf";
+    sha256 = "1bm184fbzylymh4kr7n8gy9plsdxif8xahc1zmkgdg1a0kwgws2x";
   };
 
-  nativeBuildInputs = [ glib meson ninja pkg-config cmake scdoc ];
+  nativeBuildInputs = [ glib meson ninja pkg-config scdoc ];
 
   buildInputs = [ cairo pango gtk libnotify wayland glib ];
 
@@ -37,7 +35,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/jtheoof/swappy";
-    description = "A Wayland native snapshot editing tool, inspired by Snappy on macOS ";
+    description = "A Wayland native snapshot editing tool, inspired by Snappy on macOS";
     license = licenses.mit;
     maintainers = [ maintainers.matthiasbeyer ];
     platforms = platforms.linux;

third_party/nixpkgs/pkgs/applications/misc/ticker/default.nix

@@ -0,0 +1,25 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "ticker";
+  version = "3.0.0";
+
+  src = fetchFromGitHub {
+    owner = "achannarasappa";
+    repo = "ticker";
+    rev = "v${version}";
+    sha256 = "sha256-k4ahoaEI2HBoEcRQscpitp2tWsiWmSYaErnth99xOqw=";
+  };
+
+  vendorSha256 = "sha256-8Ew+K/uTFoBAhPQwebtjl6bJPiSEE3PaZCYZsQLOMkw=";
+
+  # Tests require internet
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Terminal stock ticker with live updates and position tracking";
+    homepage = "https://github.com/achannarasappa/ticker";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ siraben ];
+  };
+}

third_party/nixpkgs/pkgs/applications/misc/tickrs/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tickrs";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "tarkah";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Hx/9WW94rDAjlSZoUz5/43MQ6830OELLogRvHTbmWv0=";
+    sha256 = "sha256-F9PyJ2uvnKPcjHS4VeuVJuK48HiqqCG8kFzphGW4QyA=";
   };
 
-  cargoSha256 = "sha256-TYDNx1TNGcREaeHXaejTeMDEITTTUrHCrExZYa+MSHg=";
+  cargoSha256 = "sha256-0JSsCtAsqukFuwtbVS1L2jgLNBjquFBInjsJ1XVocjc=";
 
   nativeBuildInputs = [ perl ];
 

third_party/nixpkgs/pkgs/applications/misc/todoist-electron/default.nix

@@ -1,65 +1,51 @@
-{ stdenv, lib, fetchurl, makeDesktopItem, dpkg, atk, at-spi2-atk, glib, pango, gdk-pixbuf
+{ lib, stdenv, fetchurl, appimageTools, makeWrapper, electron, libsecret }:
-, gtk3, cairo, freetype, fontconfig, dbus, xorg, nss, nspr, alsaLib, cups, expat
-, udev, libpulseaudio, util-linux, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "todoist-electron";
-  version = "1.24.0";
+  version = "0.2.4";
 
   src = fetchurl {
-    url = "https://github.com/KryDos/todoist-linux/releases/download/${version}/Todoist_${version}_amd64.deb";
+    url = "https://electron-dl.todoist.com/linux/Todoist-${version}.AppImage";
-    sha256 = "0g35518z6nf6pnfyx4ax75rq8b8br72mi6wv6jzgac9ric1q4h2s";
+    sha256 = "1xrf2qjhq116z18qx7n1zd7mhvkb2dccaq7az4w6fs216l8q5zf2";
   };
 
-  desktopItem = makeDesktopItem {
+  appimageContents = appimageTools.extractType2 {
-    name = "Todoist";
+    name = "${pname}-${version}";
-    exec = "todoist %U";
+    inherit src;
-    icon = "todoist";
-    comment = "Todoist for Linux";
-    desktopName = "Todoist";
-    categories = "Utility";
   };
 
-  nativeBuildInputs = [ makeWrapper dpkg ];
+  dontUnpack = true;
-  unpackPhase = ''
+  dontConfigure = true;
-    mkdir pkg
+  dontBuild = true;
-    dpkg-deb -x $src pkg
+
-    sourceRoot=pkg
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share/${pname} $out/share/applications $out/share/icons/hicolor/512x512
+
+    cp -a ${appimageContents}/{locales,resources} $out/share/${pname}
+    cp -a ${appimageContents}/todoist.desktop $out/share/applications/${pname}.desktop
+    cp -a ${appimageContents}/usr/share/icons/hicolor/0x0/apps $out/share/icons/hicolor/512x512
+
+    substituteInPlace $out/share/applications/${pname}.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+
+    runHook postInstall
   '';
-  installPhase = let
-    libPath = lib.makeLibraryPath ([
-      stdenv.cc.cc gtk3 atk at-spi2-atk glib pango gdk-pixbuf cairo freetype fontconfig dbus
-      nss nspr alsaLib libpulseaudio cups expat udev util-linux
-    ] ++ (with xorg; [
-      libXi libXcursor libXdamage libXrandr libXcomposite libXext libXfixes libxcb
-      libXrender libX11 libXtst libXScrnSaver
-    ]));
-  in ''
-    mkdir -p "$out/bin"
-    mv opt "$out/"
-    mv usr/share "$out/share"
 
-    # Patch binary
+  postFixup = ''
-    patchelf \
+    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --add-flags $out/share/${pname}/resources/app.asar \
-      --set-rpath "${libPath}:\$ORIGIN" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc libsecret ]}"
-      $out/opt/Todoist/todoist
-
-    # Hacky workaround for RPATH problems
-    makeWrapper $out/opt/Todoist/todoist $out/bin/todoist \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpulseaudio udev ]}
-
-    # Desktop item
-    mkdir -p "$out/share"
-    rm -r "$out/share/applications"
-    cp -r "${desktopItem}/share/applications" "$out/share/applications"
   '';
 
   meta = with lib; {
-    homepage = "https://github.com/KryDos/todoist-linux";
+    homepage = "https://todoist.com";
-    description = "The Linux wrapper for Todoist web version";
+    description = "The official Todoist electron app";
     platforms = [ "x86_64-linux" ];
-    license = licenses.mit;
+    license = licenses.unfree;
-    maintainers = with maintainers; [ i077 ];
+    maintainers = with maintainers; [ i077 kylesferrazza ];
   };
 }

third_party/nixpkgs/pkgs/applications/misc/tty-solitaire/default.nix

@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = "sed -i -e '/^CFLAGS *?= *-g *$/d' Makefile";
 
-  makeFlags = [ "CC=cc" "PREFIX=${placeholder "out"}" ];
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "PREFIX=${placeholder "out"}" ];
 
   meta = with lib; {
     description = "Klondike Solitaire in your ncurses terminal";

third_party/nixpkgs/pkgs/applications/misc/upwork/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, dpkg, wrapGAppsHook, autoPatchelfHook, writeShellScript
+{ lib, stdenv, fetchurl, dpkg, wrapGAppsHook, autoPatchelfHook
 , alsaLib, atk, at-spi2-atk, at-spi2-core, cairo, cups, dbus, expat, fontconfig, freetype
 , gdk-pixbuf, glib, gtk3, libnotify, libX11, libXcomposite, libXcursor, libXdamage, libuuid
 , libXext, libXfixes, libXi, libXrandr, libXrender, libXtst, nspr, nss, libxcb
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "upwork";
-  version = "5.4.9.6";
+  version = "5.5.0.1";
 
   src = fetchurl {
-    url = "https://upwork-usw2-desktopapp.upwork.com/binaries/v5_4_9_6_2565cdd0547940a2/${pname}_${version}_amd64.deb";
+    url = "https://upwork-usw2-desktopapp.upwork.com/binaries/v5_5_0_1_291c031686ed44ff/${pname}_${version}_amd64.deb";
-    sha256 = "ff6246b3b4a1ed79cc9bca2934652fefb40bdac4b7e95997f3a46e354ce52456";
+    sha256 = "49192ecfb10929b5b51cf8899186059649c894109ec172695cd7cfaa50923f6a";
   };
 
   dontWrapGApps = true;
@@ -36,6 +36,7 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
+    runHook preInstall
     mv usr $out
     mv opt $out
     sed -e "s|/opt/Upwork|$out/bin|g" -i $out/share/applications/upwork.desktop
@@ -44,6 +45,7 @@ stdenv.mkDerivation rec {
       $out/bin/upwork \
       --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
       --prefix LD_LIBRARY_PATH : ${libPath}
+    runHook postInstall
   '';
 
   meta = with lib; {

third_party/nixpkgs/pkgs/applications/misc/zettlr/default.nix

@@ -1,13 +1,15 @@
-{ appimageTools, lib, fetchurl, gtk3, gsettings-desktop-schemas}:
+{ appimageTools, lib, fetchurl, gtk3, gsettings-desktop-schemas
+, texlive, pandoc, pandoc-citeproc
+}:
 
 # Based on https://gist.github.com/msteen/96cb7df66a359b827497c5269ccbbf94 and joplin-desktop nixpkgs.
 let
   pname = "zettlr";
-  version = "1.7.5";
+  version = "1.8.7";
   name = "${pname}-${version}";
   src = fetchurl {
     url = "https://github.com/Zettlr/Zettlr/releases/download/v${version}/Zettlr-${version}-x86_64.appimage";
-    sha256 = "040lx01ywdpla34d4abkmh51kchr11s17la6fk6yq77y8zb87xzi";
+    sha256 = "0zbmlk5qk92b3zycs0bmdwgc8fn4a4dv1yvq9q8q2wxz4ammx6c0";
   };
   appimageContents = appimageTools.extractType2 {
     inherit name src;
@@ -20,11 +22,11 @@ in appimageTools.wrapType2 rec {
   '';
 
   multiPkgs = null; # no 32bit needed
-  extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
+  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ texlive pandoc pandoc-citeproc ];
   extraInstallCommands = ''
     mv $out/bin/{${name},${pname}}
-    install -m 444 -D ${appimageContents}/zettlr.desktop $out/share/applications/zettlr.desktop
+    install -m 444 -D ${appimageContents}/Zettlr.desktop $out/share/applications/zettlr.desktop
-    install -m 444 -D ${appimageContents}/zettlr.png $out/share/icons/hicolor/512x512/apps/zettlr.png
+    install -m 444 -D ${appimageContents}/Zettlr.png $out/share/icons/hicolor/512x512/apps/zettlr.png
     substituteInPlace $out/share/applications/zettlr.desktop --replace 'Exec=AppRun' 'Exec=${pname}'
   '';
 

third_party/nixpkgs/pkgs/applications/networking/bee/bee.nix

@@ -9,16 +9,16 @@ let
       rev = "824636a2c2629c329ab10275cef6a0b7395343ad";
       goVersionString = "g" + builtins.substring 0 7 rev;     # this seems to be some kind of standard of git describe...
       sha256 = "0ly1yqjq29arbak8lchdradf39l5bmxpbfir6ljjc7nyqdxz0sxg";
-      vendorSha256 = "0w1db7xpissdpf8i5bb96z92zbasj5x9kk3kcisxn0dwla6n55n3";
+      vendorSha256 = "sha256-w5ZijaK8Adt1ZHPMmXqRWq0v0jdprRKRu03rePtZLXA=";
     };
     release = rec {
       pname = "bee";
-      version = "0.4.2";
+      version = "0.5.0";
       rev = "refs/tags/v${version}";
-      sha256 = "1jg7aivsgdb9bm87dlmwpf1g6gla8j6v55xmzs8h5xmwqcybbmag";
+      sha256 = "sha256-3Oy9RhgMPRFjUs3Dj8XUhAqoxx5BTi32OiK4Y8YEG2Q=";
-      vendorSha256 = "0w1db7xpissdpf8i5bb96z92zbasj5x9kk3kcisxn0dwla6n55n3";
+      vendorSha256 = "sha256-w5ZijaK8Adt1ZHPMmXqRWq0v0jdprRKRu03rePtZLXA=";
     };
-    "0.4.2" = release;
+    "0.5.0" = release;
     "0.4.1" = rec {
       pname = "bee";
       version = "0.4.1";

third_party/nixpkgs/pkgs/applications/networking/browsers/amfora/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "amfora";
-  version = "1.7.2";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "makeworld-the-better-one";
     repo = "amfora";
     rev = "v${version}";
-    sha256 = "KAOIx401G/kB/TclhidOnUja1P+mLo/mUwAqGJfVfyg=";
+    sha256 = "sha256-q83fKs27vkrUs3+AoKZ2342llj6u3bvbLsdnT9DnVUs=";
   };
 
-  vendorSha256 = "rOEM7iEkm42g8yJxY7qdTCSbkPMDHqlAsK7/ud8IDLY=";
+  vendorSha256 = "sha256-0blHwZwOcgC4LcmZSJPRvyQzArCsaMGgIw+cesO+qOo=";
 
   postInstall = lib.optionalString (!stdenv.isDarwin) ''
     sed -i "s:amfora:$out/bin/amfora:" amfora.desktop

third_party/nixpkgs/pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -18,9 +18,9 @@
     }
   },
   "beta": {
-    "version": "89.0.4389.47",
+    "version": "89.0.4389.58",
-    "sha256": "022fq3mbd3j9a7lf02936ks0yvf73bwz1ws6m6zmnn9v8waardj2",
+    "sha256": "1ppjkilfn84hq55wsb33xswlp1x8v34np5hq2wbh62ny6j8dbvwz",
-    "sha256bin64": "09gjbg8678xfh22r3gzjvrkhgda77pr8an4j5ka5672jvhj4hbq9",
+    "sha256bin64": "1k4f380h2rghn81agdw8bkifpb690sr0ykjgbnis3kl68hbkp8a5",
     "deps": {
       "gn": {
         "version": "2021-01-07",
@@ -31,15 +31,15 @@
     }
   },
   "dev": {
-    "version": "90.0.4412.3",
+    "version": "90.0.4421.5",
-    "sha256": "1yjpfircdl38nrjh3an469g7q8178jyvawkfpnzc5aqsgkpkl442",
+    "sha256": "0605ibr2fr13rmmxs7lw4dh25i9r6ic08ykdr7002m4rp8kxwsw6",
-    "sha256bin64": "1asdjicb4l4l2ak3fkxcwdx1avpc1m8wvyhxmj1k3bqa4qmvz3hz",
+    "sha256bin64": "05mlm9l6q1w9rxid7cvaazzbw79wj9fjw6ka7wpr0gz4r3gmazsb",
     "deps": {
       "gn": {
-        "version": "2021-01-25",
+        "version": "2021-02-09",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "55ad154c961d8326315b1c8147f4e504cd95e9e6",
+        "rev": "dfcbc6fed0a8352696f92d67ccad54048ad182b3",
-        "sha256": "0x5i1axkg44z412357sdb6kgs1h9ykzy8p5c7s40bybs4hg33lkc"
+        "sha256": "1941bzg37c4dpsk3sh6ga3696gpq6vjzpcw9rsnf6kdr9mcgdxvn"
       }
     }
   },

third_party/nixpkgs/pkgs/applications/networking/cluster/argo/default.nix

@@ -19,13 +19,13 @@ let
 in
 buildGoModule rec {
   pname = "argo";
-  version = "2.12.8";
+  version = "2.12.9";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo";
     rev = "v${version}";
-    sha256 = "sha256-JtT4SMoozfTWsQ4YsoQ8xLQ/vCO7hnVEp2umg+p7mRw=";
+    sha256 = "sha256-WfyP48qOdFZfQ0+8AZDYokw7WK7lSx5di7z07gsRPZk=";
   };
 
   vendorSha256 = "sha256-4XPMixVNj6PUKobNLwpsOBT7Zs/7pkhDtQacLIB5EfE=";

third_party/nixpkgs/pkgs/applications/networking/cluster/argocd/default.nix

@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "1.8.3";
+  version = "1.8.4";
-  commit = "ef5010c3a0b5e027fd642732d03c5b0391b1e574";
+  commit = "28aea3dfdede00443b52cc584814d80e8f896200";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "sha256-do5DAxaQ1gBdvNN/YGKAkmkFcJ+j/ojBaWPwrXXQko0=";
+    sha256 = "sha256:155396rnihha31jxy0zk1jykiirpv4dhc69w45y6nx3nx4k0gwhk";
   };
 
   vendorSha256 = "sha256-6DOay+aeXz7EQKe5SzQSmg/5KyUI0g6wzPgx/+F2RW4=";

third_party/nixpkgs/pkgs/applications/networking/cluster/fluxcd/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fluxcd";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "fluxcd";
     repo = "flux2";
     rev = "v${version}";
-    sha256 = "1k7zcn8l60qfgiixkjcmp94w87w88n475mmhf58vl5pfz21p9vky";
+    sha256 = "1xxw6zk0lk4is220lydcx57mrsw6pk2rirsp4wjzvawjlv7wdv25";
   };
 
-  vendorSha256 = "16yixz47zrzjkb2k4n03zfivpc2cavcrrv4fz8s5a4xzfrcp4nvx";
+  vendorSha256 = "0acxbmc4j1fcdja0s9g04f0kd34x54yfqismibfi40m2gzbg6ljr";
 
   nativeBuildInputs = [ installShellFiles ];
 

third_party/nixpkgs/pkgs/applications/networking/cluster/fluxctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fluxctl";
-  version = "1.21.1";
+  version = "1.21.2";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = "flux";
     rev = version;
-    sha256 = "sha256-/go8V1EjY/iL3csoNpPyeWORvWCf0WnnaSOgiZ8UFQ8=";
+    sha256 = "sha256-pI/LGAjTWFXiDKSV+dZl0wXK/TZmN9DuWf5Nu8EYNYc=";
   };
 
-  vendorSha256 = "sha256-GEU0Q2Elhiel20xvup+i1DSXCjQdA9s7cWykcbKR5KA=";
+  vendorSha256 = "sha256-Q8gIhJSZqdjBXrIcJfCd25BniDScwVzUwZ9Vc8p/z3c=";
 
   nativeBuildInputs = [ installShellFiles ];
 

third_party/nixpkgs/pkgs/applications/networking/cluster/kubectl-example/default.nix

@@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubectl-example";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "seredot";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "18vp53cda93qjssxygwqp55yc80a93781839gf3138awngf731yq";
+  };
+
+  vendorSha256 = "0sjjj9z1dhilhpc8pq4154czrb79z9cm044jvn75kxcjv6v5l2m5";
+
+  meta = with lib; {
+    description = "kubectl plugin for retrieving resource example YAMLs";
+    homepage = "https://github.com/seredot/kubectl-example";
+    changelog = "https://github.com/seredot/kubectl-example/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = [ maintainers.bryanasdev000 ];
+  };
+}

third_party/nixpkgs/pkgs/applications/networking/cluster/nerdctl/default.nix

@@ -4,17 +4,12 @@
 , makeWrapper
 , buildkit
 , cni-plugins
-, extraPackages ? []
+, extraPackages ? [ ]
 }:
 
-let
-  binPath = lib.makeBinPath ([
-    buildkit
-  ] ++ extraPackages);
-in
 buildGoModule rec {
   pname = "nerdctl";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "AkihiroSuda";
@@ -37,15 +32,25 @@ buildGoModule rec {
 
   postInstall = ''
     wrapProgram $out/bin/nerdctl \
-      --prefix PATH : "${binPath}" \
+      --prefix PATH : "${lib.makeBinPath ([ buildkit ] ++ extraPackages)}" \
       --prefix CNI_PATH : "${cni-plugins}/bin"
   '';
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    $out/bin/nerdctl --help
+    # --version will error without containerd.sock access
+    $out/bin/nerdctl --help | grep "${version}"
+    runHook postInstallCheck
+  '';
+
   meta = with lib; {
+    homepage = "https://github.com/AkihiroSuda/nerdctl/";
+    changelog = "https://github.com/AkihiroSuda/nerdctl/releases/tag/v${version}";
     description = "A Docker-compatible CLI for containerd";
-    homepage = src.meta.homepage;
     license = licenses.asl20;
-    platforms = platforms.linux;
     maintainers = with maintainers; [ jk ];
+    platforms = platforms.linux;
   };
 }

third_party/nixpkgs/pkgs/applications/networking/cluster/nixops/default.nix

@@ -2,7 +2,6 @@
 , poetry2nix
 , lib
 , overrides ? (self: super: {})
-, stdenv
 }:
 
 let

third_party/nixpkgs/pkgs/applications/networking/cluster/terraform/default.nix

@@ -157,8 +157,8 @@ in rec {
   });
 
   terraform_0_14 = pluggable (generic {
-    version = "0.14.6";
+    version = "0.14.7";
-    sha256 = "0ba3vd6lswy4pd0qywdbx8cf71j5z3p8p8kdjs9m4qbyrzsbq0fk";
+    sha256 = "0lnq65ibdxrw2rlyipk469a5hh16vgym1698nmfn62ak8fdrd8la";
     vendorSha256 = "0pk5mgj19a8by7wbn5xd6kgr1kxrazhvg851fvs8mq3j0ayb32nb";
     patches = [ ./provider-path.patch ];
     passthru = { inherit plugins; };

third_party/nixpkgs/pkgs/applications/networking/cluster/terragrunt/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.28.5";
+  version = "0.28.6";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-LSUWEgCajIBgRPiuvGJ9I3tJLXk1JrVDDsgS7lpbVYk=";
+    sha256 = "sha256-DzC/HNwFNNEJhic/8KpHchrBmsSbrn7xf1DjY0JTH08=";
   };
 
   vendorSha256 = "sha256-lRJerUYafpkXAGf8MEM8SeG3aB86mlMo7iLpeHFAnd4=";

third_party/nixpkgs/pkgs/applications/networking/cluster/waypoint/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "waypoint";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-bCvi5xIL6xAtQ9mgf4feh076sAmog/3eGBlgvcLXJyc=";
+    sha256 = "sha256-JeuVrlm6JB8MgSUmgMLQPuPmlKSScSdsVga9jUwLWHM=";
   };
 
   deleteVendor = true;

third_party/nixpkgs/pkgs/applications/networking/feedreaders/feedreader/default.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, nix-update-script, meson, ninja, pkg-config, vala, gettext, python3
 , appstream-glib, desktop-file-utils, wrapGAppsHook, gnome-online-accounts
-, gtk3, libgee, libpeas, librest, webkitgtk, gsettings-desktop-schemas, pantheon
+, gtk3, libgee, libpeas, librest, webkitgtk, gsettings-desktop-schemas
 , curl, glib, gnome3, gst_all_1, json-glib, libnotify, libsecret, sqlite, gumbo, libxml2
 }:
 

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-matrix/default.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     "DATA_ROOT_DIR_PURPLE=${placeholder "out"}/share"
   ];
 
-  buildFlags = [ "CC=cc" ]; # fix build on darwin
+  buildFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ]; # fix build on darwin
 
   meta = with lib; {
     homepage = "https://github.com/matrix-org/purple-matrix";

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -25,7 +25,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.39.6"; # Please backport all updates to the stable channel.
+  version = "1.40.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "04fd81vc0dxk0b47crm5zacf4x79pdn483xicygnc1z6v7mnrmgk";
+    sha256 = "1xd38a9mi23c4r873k37rzip68hfk3a4bk9j4j24v2kb3yvixrpp";
   };
 
   nativeBuildInputs = [

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix

@@ -22,12 +22,12 @@ let
 
 in mkDerivation rec {
   pname = "telegram-desktop";
-  version = "2.5.8";
+  version = "2.5.9";
 
   # Telegram-Desktop with submodules
   src = fetchurl {
     url = "https://github.com/telegramdesktop/tdesktop/releases/download/v${version}/tdesktop-${version}-full.tar.gz";
-    sha256 = "0zj1g24fi4m84p6zj9yk55v8sbhn0jdpdhp33y12d2msz0qwp2cw";
+    sha256 = "1311dab9cil8hl1qlh01ynrczyjbldcsq1l6ibh818wb5lsgvvl2";
   };
 
   postPatch = ''

third_party/nixpkgs/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix

@@ -1,10 +1,11 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, cmake, ninja, yasm
 , libjpeg, openssl, libopus, ffmpeg, alsaLib, libpulseaudio, protobuf
+, xorg, libXtst
 }:
 
 let
-  rev = "be23804afce3bb2e80a1d57a7c1318c71b82b7de";
+  rev = "a19877363082da634a3c851a4698376504d2eaee";
-  sha256 = "0avdxkig8z1ainzyxkm9vmlvkyqbjalwb4h9s9kcail82mnldnhc";
+  sha256 = "03m6fkc3m2wbh821mr3ybsmd7sjllky44mizny96k4b249dkvzx7";
 
 in stdenv.mkDerivation {
   pname = "tg_owt";
@@ -23,6 +24,7 @@ in stdenv.mkDerivation {
 
   buildInputs = [
     libjpeg openssl libopus ffmpeg alsaLib libpulseaudio protobuf
+    xorg.libX11 libXtst
   ];
 
   cmakeFlags = [

third_party/nixpkgs/pkgs/applications/networking/irc/communi/default.nix

@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  dontWrapQtApps = true;
+
   preConfigure = ''
     export QMAKEFEATURES=${libcommuni}/features
   '';

third_party/nixpkgs/pkgs/applications/networking/irc/weechat/scripts/default.nix

@@ -1,8 +1,12 @@
-{ callPackage, luaPackages, python3Packages }:
+{ callPackage, luaPackages, perlPackages, python3Packages }:
 
 {
   colorize_nicks = callPackage ./colorize_nicks { };
 
+  multiline = callPackage ./multiline {
+    inherit (perlPackages) PodParser;
+  };
+
   weechat-matrix-bridge = callPackage ./weechat-matrix-bridge {
     inherit (luaPackages) cjson luaffi;
   };

third_party/nixpkgs/pkgs/applications/networking/irc/weechat/scripts/multiline/default.nix

@@ -0,0 +1,40 @@
+{ stdenv, lib, fetchurl, substituteAll, PodParser }:
+
+stdenv.mkDerivation {
+  pname = "multiline";
+  version = "0.6.3";
+
+  src = fetchurl {
+    url = "https://raw.githubusercontent.com/weechat/scripts/945315bed4bc2beaf1e47f9b946ffe8f638f77fe/perl/multiline.pl";
+    sha256 = "1smialb21ny7brhij4sbw46xvsmrdv6ig2da0ip63ga2afngwsy4";
+  };
+
+  dontUnpack = true;
+  prePatch = ''
+    cp $src multiline.pl
+  '';
+
+  patches = [
+    # The script requires a special Perl environment.
+    (substituteAll {
+      src = ./libpath.patch;
+      env = PodParser;
+    })
+  ];
+
+  passthru.scripts = [ "multiline.pl" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D multiline.pl $out/share/multiline.pl
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Multi-line edit box";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ oxzi ];
+  };
+}

third_party/nixpkgs/pkgs/applications/networking/irc/weechat/scripts/multiline/libpath.patch

@@ -0,0 +1,9 @@
+diff --git a/multiline.pl b/multiline.pl
+index 54474d4..42fbef8 100644
+--- a/multiline.pl
++++ b/multiline.pl
+@@ -1,3 +1,4 @@
++use lib '@env@/lib/perl5/site_perl';
+ use strict; use warnings;
+ $INC{'Encode/ConfigLocal.pm'}=1;
+ require Encode;

third_party/nixpkgs/pkgs/applications/networking/maestral-qt/default.nix

@@ -6,18 +6,17 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "maestral-qt";
-  version = "1.3.1";
+  version = "1.4.2";
   disabled = python3.pkgs.pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "SamSchott";
     repo = "maestral-qt";
     rev = "v${version}";
-    sha256 = "sha256-2S2sa2/HVt3IRsE98PT2XwpONjaYENBzYW+ezBFrJYI=";
+    sha256 = "sha256-cPH0wD7RL3OifDTD48x58I4qeaLALOMFnfWXjE2/lUQ=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
-    bugsnag
     click
     markdown2
     maestral

third_party/nixpkgs/pkgs/applications/networking/mailreaders/aerc/default.nix

@@ -1,7 +1,6 @@
 { lib, buildGoModule, fetchurl
-, go, ncurses, notmuch, scdoc
+, ncurses, notmuch, scdoc
-, python3, perl, w3m, dante
+, python3, w3m, dante
-, fetchFromGitHub
 }:
 
 buildGoModule rec {

third_party/nixpkgs/pkgs/applications/networking/mailreaders/neomutt/default.nix

@@ -1,8 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which, writeScript
+{ lib, stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which
 , ncurses, perl , cyrus_sasl, gss, gpgme, kerberos, libidn, libxml2, notmuch, openssl
-, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, w3m, mailcap, runtimeShell, sqlite, zlib
+, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, w3m, mailcap, sqlite, zlib
-, glibcLocales
-, fetchpatch
 }:
 
 stdenv.mkDerivation rec {

third_party/nixpkgs/pkgs/applications/networking/mailreaders/notmuch/default.nix

@@ -12,7 +12,7 @@
 with lib;
 
 stdenv.mkDerivation rec {
-  version = "0.31.3";
+  version = "0.31.4";
   pname = "notmuch";
 
   passthru = {
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchgit {
     url = "https://git.notmuchmail.org/git/notmuch";
-    sha256 = "1wm1myzacz1dcg7vdfd3akia3xan7ssfspf1fflrwm18hdalss5v";
+    sha256 = "sha256-M+LEf257OcDlHOCYYxzEVQpop+i2gzO/QJPdajz/CRM=";
     rev = version;
   };
 

third_party/nixpkgs/pkgs/applications/networking/mullvad-vpn/default.nix

@@ -41,11 +41,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "mullvad-vpn";
-  version = "2021.1";
+  version = "2021.2";
 
   src = fetchurl {
-    url = "https://www.mullvad.net/media/app/MullvadVPN-${version}_amd64.deb";
+    url = "https://github.com/mullvad/mullvadvpn-app/releases/download/${version}/MullvadVPN-${version}_amd64.deb";
-    sha256 = "1ksa327zaiwmcmzv4n4ycfzc4sqhj2492c5ir0mqlx7x2nnhx6q7";
+    sha256 = "sha256-nNZK11MckiQ+z8NDgDc7aJ6yrXWI1hPOvMZkrGwDDgU=";
   };
 
   nativeBuildInputs = [