Merge staging-next into staging

doc/.gitignore

···
 out
 result
 result-*
+media

doc/builders/special.xml

···
  <xi:include href="special/makesetuphook.section.xml" />
  <xi:include href="special/mkshell.section.xml" />
  <xi:include href="special/darwin-builder.section.xml" />
+ <xi:include href="special/vm-tools.section.xml" />
 </chapter>

doc/builders/special/vm-tools.section.md

···
+# vmTools {#sec-vm-tools}
+
+A set of VM related utilities, that help in building some packages in more advanced scenarios.
+
+## `vmTools.createEmptyImage` {#vm-tools-createEmptyImage}
+
+A bash script fragment that produces a disk image at `destination`.
+
+### Attributes
+
+* `size`. The disk size, in MiB.
+* `fullName`. Name that will be written to `${destination}/nix-support/full-name`.
+* `destination` (optional, default `$out`). Where to write the image files.
+
+## `vmTools.runInLinuxVM` {#vm-tools-runInLinuxVM}
+
+Run a derivation in a Linux virtual machine (using Qemu/KVM).
+By default, there is no disk image; the root filesystem is a `tmpfs`, and the Nix store is shared with the host (via the [9P protocol](https://wiki.qemu.org/Documentation/9p#9p_Protocol)).
+Thus, any pure Nix derivation should run unmodified.
+
+If the build fails and Nix is run with the `-K/--keep-failed` option, a script `run-vm` will be left behind in the temporary build directory that allows you to boot into the VM and debug it interactively.
+
+### Attributes
+
+* `preVM` (optional). Shell command to be evaluated *before* the VM is started (i.e., on the host).
+* `memSize` (optional, default `512`). The memory size of the VM in MiB.
+* `diskImage` (optional). A file system image to be attached to `/dev/sda`.
+  Note that currently we expect the image to contain a filesystem, not a full disk image with a partition table etc.
+
+### Examples
+
+Build the derivation hello inside a VM:
+```nix
+{ pkgs }: with pkgs; with vmTools;
+runInLinuxVM hello
+```
+
+Build inside a VM with extra memory:
+```nix
+{ pkgs }: with pkgs; with vmTools;
+runInLinuxVM (hello.overrideAttrs (_: { memSize = 1024; }))
+```
+
+Use VM with a disk image (implicitly sets `diskImage`, see [`vmTools.createEmptyImage`](#vm-tools-createEmptyImage)):
+```nix
+{ pkgs }: with pkgs; with vmTools;
+runInLinuxVM (hello.overrideAttrs (_: {
+  preVM = createEmptyImage {
+    size = 1024;
+    fullName = "vm-image";
+  };
+}))
+```
+
+## `vmTools.extractFs` {#vm-tools-extractFs}
+
+Takes a file, such as an ISO, and extracts its contents into the store.
+
+### Attributes
+
+* `file`. Path to the file to be extracted.
+  Note that currently we expect the image to contain a filesystem, not a full disk image with a partition table etc.
+* `fs` (optional). Filesystem of the contents of the file.
+
+### Examples
+
+Extract the contents of an ISO file:
+```nix
+{ pkgs }: with pkgs; with vmTools;
+extractFs { file = ./image.iso; }
+```
+
+## `vmTools.extractMTDfs` {#vm-tools-extractMTDfs}
+
+Like [](#vm-tools-extractFs), but it makes use of a [Memory Technology Device (MTD)](https://en.wikipedia.org/wiki/Memory_Technology_Device).
+
+## `vmTools.runInLinuxImage` {#vm-tools-runInLinuxImage}
+
+Like [](#vm-tools-runInLinuxVM), but instead of using `stdenv` from the Nix store, run the build using the tools provided by `/bin`, `/usr/bin`, etc. from the specified filesystem image, which typically is a filesystem containing a [FHS](https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard)-based Linux distribution.
+
+## `vmTools.makeImageTestScript` {#vm-tools-makeImageTestScript}
+
+Generate a script that can be used to run an interactive session in the given image.
+
+### Examples
+
+Create a script for running a Fedora 27 VM:
+```nix
+{ pkgs }: with pkgs; with vmTools;
+makeImageTestScript diskImages.fedora27x86_64
+```
+
+Create a script for running an Ubuntu 20.04 VM:
+```nix
+{ pkgs }: with pkgs; with vmTools;
+makeImageTestScript diskImages.ubuntu2004x86_64
+```
+
+## `vmTools.diskImageFuns` {#vm-tools-diskImageFuns}
+
+A set of functions that build a predefined set of minimal Linux distributions images.
+
+### Images
+
+* Fedora
+  * `fedora26x86_64`
+  * `fedora27x86_64`
+* CentOS
+  * `centos6i386`
+  * `centos6x86_64`
+  * `centos7x86_64`
+* Ubuntu
+  * `ubuntu1404i386`
+  * `ubuntu1404x86_64`
+  * `ubuntu1604i386`
+  * `ubuntu1604x86_64`
+  * `ubuntu1804i386`
+  * `ubuntu1804x86_64`
+  * `ubuntu2004i386`
+  * `ubuntu2004x86_64`
+  * `ubuntu2204i386`
+  * `ubuntu2204x86_64`
+* Debian
+  * `debian10i386`
+  * `debian10x86_64`
+  * `debian11i386`
+  * `debian11x86_64`
+
+### Attributes
+
+* `size` (optional, defaults to `4096`). The size of the image, in MiB.
+* `extraPackages` (optional). A list names of additional packages from the distribution that should be included in the image.
+
+### Examples
+
+8GiB image containing Firefox in addition to the default packages:
+```nix
+{ pkgs }: with pkgs; with vmTools;
+diskImageFuns.ubuntu2004x86_64 { extraPackages = [ "firefox" ]; size = 8192; }
+```
+
+## `vmTools.diskImageExtraFuns` {#vm-tools-diskImageExtraFuns}
+
+Shorthand for `vmTools.diskImageFuns.<attr> { extraPackages = ... }`.
+
+## `vmTools.diskImages` {#vm-tools-diskImages}
+
+Shorthand for `vmTools.diskImageFuns.<attr> { }`.

maintainers/maintainer-list.nix

···
       fingerprint = "F7D3 7890 228A 9074 40E1  FD48 46B9 228E 814A 2AAC";
     }];
   };
+  hacker1024 = {
+    name = "hacker1024";
+    email = "[e-mail]";
+    github = "hacker1024";
+    githubId = 20849728;
+  };
   hagl = {
     email = "[e-mail]";
     github = "hagl";

nixos/doc/manual/release-notes/rl-2305.section.md

···
     [headscale's example configuration](https://github.com/juanfont/headscale/blob/main/config-example.yaml)
     can be directly written as attribute-set in Nix within this option.
 
+- `services.kubo` now unmounts `ipfsMountDir` and `ipnsMountDir` even if it is killed unexpectedly when 'autoMount` is enabled.
+
 - `nixos/lib/make-disk-image.nix` can now mutate EFI variables, run user-provided EFI firmware or variable templates. This is now extensively documented in the NixOS manual.
 
 - `services.grafana` listens only on localhost by default again. This was changed to upstreams default of `0.0.0.0` by accident in the freeform setting conversion.

nixos/modules/services/network-filesystems/kubo.nix

···
           # change when the changes are applied. Whyyyyyy.....
           ipfs --offline config replace -
       '';
+      postStop = mkIf cfg.autoMount ''
+        # After an unclean shutdown the fuse mounts at cfg.ipnsMountDir and cfg.ipfsMountDir are locked
+        umount --quiet '${cfg.ipnsMountDir}' '${cfg.ipfsMountDir}' || true
+      '';
       serviceConfig = {
         ExecStart = [ "" "${cfg.package}/bin/ipfs daemon ${kuboFlags}" ];
         User = cfg.user;

nixos/tests/kubo.nix

···
     machine.succeed("test ! -e /var/lib/ipfs/")
 
     # Test FUSE mountpoint
+    # The FUSE mount functionality is broken as of v0.13.0 and v0.17.0.
+    # See https://github.com/ipfs/kubo/issues/9044.
+    # Workaround: using CID Version 1 avoids that.
     ipfs_hash = fuse.succeed(
-        "echo fnord3 | ipfs --api /ip4/127.0.0.1/tcp/2324 add --quieter"
-    )
+        "echo fnord3 | ipfs --api /ip4/127.0.0.1/tcp/2324 add --quieter --cid-version=1"
+    ).strip()
 
-    # The FUSE mount functionality is broken as of v0.13.0.
-    # See https://github.com/ipfs/kubo/issues/9044.
-    # fuse.succeed(f"cat /ipfs/{ipfs_hash.strip()} | grep fnord3")
+    fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
+
+    # Force Kubo to crash and wait for it to restart
+    # Tests the unmounting of /ipns and /ipfs
+    fuse.systemctl("kill --signal=SIGKILL ipfs.service")
+    fuse.wait_for_unit("ipfs.service", timeout = 30)
+
+    fuse.succeed(f"cat /ipfs/{ipfs_hash} | grep fnord3")
   '';
 })

pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix

···
       })
     generatedDerivations;
 
+  grammarToPlugin = grammar:
+    let
+      name = lib.pipe grammar [
+        lib.getName
+
+        # added in buildGrammar
+        (lib.removeSuffix "-grammar")
+
+        # grammars from tree-sitter.builtGrammars
+        (lib.removePrefix "tree-sitter-")
+        (lib.replaceStrings [ "-" ] [ "_" ])
+      ];
+    in
+
+    runCommand "nvim-treesitter-grammar-${name}" { } ''
+      mkdir -p $out/parser
+      ln -s ${grammar}/parser $out/parser/${name}.so
+    '';
+
   allGrammars = lib.attrValues generatedDerivations;
 
   # Usage:
···
   # pkgs.vimPlugins.nvim-treesitter.withAllGrammars
   withPlugins =
     f: self.nvim-treesitter.overrideAttrs (_: {
-      passthru.dependencies = map
-        (grammar:
-          let
-            name = lib.pipe grammar [
-              lib.getName
-
-              # added in buildGrammar
-              (lib.removeSuffix "-grammar")
-
-              # grammars from tree-sitter.builtGrammars
-              (lib.removePrefix "tree-sitter-")
-              (lib.replaceStrings [ "-" ] [ "_" ])
-            ];
-          in
-
-          runCommand "nvim-treesitter-${name}-grammar" { } ''
-            mkdir -p $out/parser
-            ln -s ${grammar}/parser $out/parser/${name}.so
-          ''
-        )
+      passthru.dependencies = map grammarToPlugin
         (f (tree-sitter.builtGrammars // builtGrammars));
     });
 
···
   '';
 
   passthru = {
-    inherit builtGrammars allGrammars withPlugins withAllGrammars;
+    inherit builtGrammars allGrammars grammarToPlugin withPlugins withAllGrammars;
+
+    grammarPlugins = lib.mapAttrs (_: grammarToPlugin) generatedDerivations;
 
     tests.check-queries =
       let

pkgs/applications/networking/cloudflared/default.nix

···
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2023.3.0";
+  version = "2023.4.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
     rev = "refs/tags/${version}";
-    hash = "sha256-LEK809MswDVwPJ6CuC13Fxb7fvliugixS/NOKBajqKM=";
+    hash = "sha256-+lmSztMstz8tYFP9rPmh99bkbCVea6wbiCrpbJUI/qc=";
   };
 
   vendorSha256 = null;

pkgs/applications/networking/cluster/tektoncd-cli/default.nix

···
 
 buildGoModule rec {
   pname = "tektoncd-cli";
-  version = "0.28.0";
+  version = "0.30.1";
 
   src = fetchFromGitHub {
     owner = "tektoncd";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-8OW0n6aS7bDDbzbrMfJLL8Yvq3vJg47qHQB4zY0xxAw=";
+    sha256 = "sha256-tn7nK5YTdEYJf9UBajOZEc8fQ0cx3qM0X/7UYnDklj8=";
   };
 
   vendorSha256 = null;

pkgs/applications/networking/feedreaders/newsboat/default.nix

···
 { lib, stdenv, rustPlatform, fetchFromGitHub, stfl, sqlite, curl, gettext, pkg-config, libxml2, json_c, ncurses
-, asciidoctor, libiconv, Security, Foundation, makeWrapper }:
+, asciidoctor, libiconv, Security, Foundation, makeWrapper, nix-update-script }:
 
 rustPlatform.buildRustPackage rec {
   pname = "newsboat";
···
       wrapProgram "$prog" --prefix DYLD_LIBRARY_PATH : "${stfl}/lib"
     done
   '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
 
   meta = with lib; {
     homepage    = "https://newsboat.org/";

pkgs/applications/networking/mailreaders/notmuch/default.nix

···
 { fetchurl, lib, stdenv
 , pkg-config, gnupg
-, xapian, gmime, talloc, zlib
+, xapian, gmime3, talloc, zlib
 , doxygen, perl, texinfo
 , notmuch
 , pythonPackages
···
 
   buildInputs = [
     gnupg                     # undefined dependencies
-    xapian gmime talloc zlib  # dependencies described in INSTALL
+    xapian gmime3 talloc zlib  # dependencies described in INSTALL
     perl
     pythonPackages.python
   ] ++ lib.optional withRuby ruby;
···
     ln -s ${test-database} test/test-databases/database-v1.tar.xz
   '';
 
-  doCheck = !stdenv.hostPlatform.isDarwin && (lib.versionAtLeast gmime.version "3.0.3");
+  doCheck = !stdenv.hostPlatform.isDarwin && (lib.versionAtLeast gmime3.version "3.0.3");
   checkTarget = "test";
   nativeCheckInputs = [
     which dtach openssl bash

pkgs/applications/networking/remote/remmina/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "remmina";
-  version = "1.4.29";
+  version = "1.4.30";
 
   src = fetchFromGitLab {
     owner  = "Remmina";
     repo   = "Remmina";
     rev    = "v${version}";
-    sha256 = "sha256-8B19rqbOYY+lS3Q/vh3Eu696KW03SOvlP9dgXPYYDiU=";
+    sha256 = "sha256-VYBolB6VJ3lT/rNl87qMW5DU5rdFCNvKezSLzx5y1JI=";
   };
 
   nativeBuildInputs = [ cmake ninja pkg-config wrapGAppsHook ];

pkgs/applications/radio/sdrangel/default.nix

···
 
 mkDerivation rec {
   pname = "sdrangel";
-  version = "7.11.0";
+  version = "7.13.0";
 
   src = fetchFromGitHub {
     owner = "f4exb";
     repo = "sdrangel";
     rev = "v${version}";
-    hash = "sha256-zWux84a1MCK0XJXRXcaLHieJ47d4n/wO/xdwTYuuGJw=";
+    hash = "sha256-xG41FNlMfqH5MaGVFFENP0UFEkZYiWhtpNSPh2s4Irk=";
   };
 
   nativeBuildInputs = [ cmake ninja pkg-config ];

pkgs/development/compilers/codon/Add-a-hash-to-the-googletest-binary.patch

···
+From 5c158213fc3afe39ee96be84e255c12d5886ca18 Mon Sep 17 00:00:00 2001
+From: Pavel Sobolev <[e-mail]>
+Date: Sat, 1 Apr 2023 17:38:37 +0300
+Subject: [PATCH] Add a hash to the `googletest` binary.
+
+---
+ CMakeLists.txt | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 0a06e6f..a614025 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -434,6 +434,7 @@ include(FetchContent)
+ FetchContent_Declare(
+   googletest
+   URL https://github.com/google/googletest/archive/609281088cfefc76f9d0ce82e1ff6c30cc3591e5.zip
++  URL_HASH SHA256=5cf189eb6847b4f8fc603a3ffff3b0771c08eec7dd4bd961bfd45477dd13eb73
+ )
+ # For Windows: Prevent overriding the parent project's compiler/linker settings
+ set(gtest_force_shared_crt ON CACHE BOOL "" FORCE)
+--
+2.39.2

pkgs/development/compilers/codon/default.nix

···
+{ cacert
+, cmake
+, fetchFromGitHub
+, git
+, lib
+, lld
+, ninja
+, nix-update-script
+, perl
+, python3
+, stdenv
+}:
+
+let
+  version = "0.15.5";
+
+  src = fetchFromGitHub {
+    owner = "exaloop";
+    repo = "codon";
+    rev = "v${version}";
+    sha256 = "sha256-/IUGX5iSRvZzwyRdkGe0IVHp44D+GXZtbkdtswekwSU=";
+  };
+
+  depsDir = "deps";
+
+  codon-llvm = stdenv.mkDerivation {
+    pname = "codon-llvm";
+    version = "unstable-2022-09-23";
+
+    src = fetchFromGitHub {
+      owner = "exaloop";
+      repo = "llvm-project";
+      rev = "55b0b8fa1c9f9082b535628fc9fa6313280c0b9a";
+      sha256 = "sha256-03SPQgNdrpR6/JZ5aR/ntoh/FnZvCjT/6bTAcZaFafw=";
+    };
+
+    nativeBuildInputs = [
+      cmake
+      git
+      lld
+      ninja
+      python3
+    ];
+
+    cmakeFlags = [
+      "-DCMAKE_CXX_COMPILER=clang++"
+      "-DCMAKE_C_COMPILER=clang"
+      "-DLLVM_ENABLE_RTTI=ON"
+      "-DLLVM_ENABLE_TERMINFO=OFF"
+      "-DLLVM_ENABLE_ZLIB=OFF"
+      "-DLLVM_INCLUDE_TESTS=OFF"
+      "-DLLVM_TARGETS_TO_BUILD=all"
+      "-DLLVM_USE_LINKER=lld"
+      "-S ../llvm"
+    ];
+  };
+
+  codon-deps = stdenv.mkDerivation {
+    name = "codon-deps-${version}.tar.gz";
+
+    inherit src;
+
+    nativeBuildInputs = [
+      cacert
+      cmake
+      git
+      perl
+      python3
+    ];
+
+    dontBuild = true;
+
+    cmakeFlags = [
+      "-DCPM_DOWNLOAD_ALL=ON"
+      "-DCPM_SOURCE_CACHE=${depsDir}"
+      "-DLLVM_DIR=${codon-llvm}/lib/cmake/llvm"
+    ];
+
+    installPhase = ''
+      # Prune the `.git` directories
+      find ${depsDir} -name .git -type d -prune -exec rm -rf {} \;;
+      # Build a reproducible tar, per instructions at https://reproducible-builds.org/docs/archives/
+      tar --owner=0 --group=0 --numeric-owner --format=gnu \
+          --sort=name --mtime="@$SOURCE_DATE_EPOCH" \
+          -czf $out \
+            ${depsDir} \
+            cmake \
+            _deps/googletest-subbuild/googletest-populate-prefix/src/*.zip
+    '';
+
+    outputHash = "sha256-a1zGSpbMjfQBrcgW/aiIdKX8+uI3p/S9pgZjHe2HtWs=";
+    outputHashAlgo = "sha256";
+  };
+in
+stdenv.mkDerivation {
+  pname = "codon";
+
+  inherit src version;
+
+  patches = [
+    # Without the hash, CMake will try to replace the `.zip` file
+    ./Add-a-hash-to-the-googletest-binary.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    git
+    lld
+    ninja
+    perl
+    python3
+  ];
+
+  postUnpack = ''
+    mkdir -p $sourceRoot/build
+    tar -xf ${codon-deps} -C $sourceRoot/build
+  '';
+
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE=Release"
+    "-DCMAKE_CXX_COMPILER=clang++"
+    "-DCMAKE_C_COMPILER=clang"
+    "-DCPM_SOURCE_CACHE=${depsDir}"
+    "-DLLVM_DIR=${codon-llvm}/lib/cmake/llvm"
+    "-DLLVM_USE_LINKER=lld"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "A high-performance, zero-overhead, extensible Python compiler using LLVM";
+    homepage = "https://docs.exaloop.io/codon";
+    maintainers = [ lib.maintainers.paveloom ];
+    license = lib.licenses.bsl11;
+    platforms = lib.platforms.all;
+  };
+}

pkgs/development/libraries/qt-6/default.nix

···
       qt5compat = callPackage ./modules/qt5compat.nix { };
       qtcharts = callPackage ./modules/qtcharts.nix { };
       qtconnectivity = callPackage ./modules/qtconnectivity.nix {
-        inherit (darwin.apple_sdk_11_0.frameworks) PCSC;
+        inherit (darwin.apple_sdk_11_0.frameworks) IOBluetooth PCSC;
       };
       qtdatavis3d = callPackage ./modules/qtdatavis3d.nix { };
       qtdeclarative = callPackage ./modules/qtdeclarative.nix { };

pkgs/development/libraries/qt-6/modules/qtconnectivity.nix

···
 , qtdeclarative
 , bluez
 , pkg-config
+, IOBluetooth
 , PCSC
 }:
 
···
   qtInputs = [ qtbase qtdeclarative ];
   nativeBuildInputs = [ pkg-config ];
   buildInputs = lib.optionals stdenv.isLinux [ bluez ];
-  propagatedBuildInputs = lib.optionals stdenv.isDarwin [ PCSC ];
+  propagatedBuildInputs = lib.optionals stdenv.isDarwin [ IOBluetooth PCSC ];
 }

pkgs/development/python-modules/peaqevcore/default.nix

···
 
 buildPythonPackage rec {
   pname = "peaqevcore";
-  version = "15.2.1";
+  version = "15.2.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-71ea8r1g52SyWxG+aTl53WanM5z4XAj9k5E26ivpYoE=";
+    hash = "sha256-+k1G4A4bJJzRfYRISp869NeCBTsVldWb+c6Z1tNZNg0=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pytoml/default.nix

···
-{ lib
-, buildPythonPackage
-, fetchFromGitHub
-, python
-, pytest
-}:
-
-buildPythonPackage rec {
-  pname = "pytoml";
-  version = "0.1.20";
-
-  src = fetchFromGitHub {
-    owner = "avakar";
-    repo = "pytoml";
-    rev = "v${version}";
-    fetchSubmodules = true; # ensure test submodule is available
-    sha256 = "02hjq44zhh6z0fsbm3hvz34sav6fic90sjrw8g1pkdvskzzl46mz";
-  };
-
-  nativeCheckInputs = [ pytest ];
-
-  checkPhase = ''
-    ${python.interpreter} test/test.py
-    pytest test
-  '';
-
-
-  meta = with lib; {
-    description = "A TOML parser/writer for Python";
-    homepage    = "https://github.com/avakar/pytoml";
-    license     = licenses.mit;
-    maintainers = with maintainers; [ peterhoeg ];
-  };
-}

pkgs/games/fheroes2/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "fheroes2";
-  version = "1.0.2";
+  version = "1.0.3";
 
   src = fetchFromGitHub {
     owner = "ihhub";
     repo = "fheroes2";
     rev = version;
-    sha256 = "sha256-Y1D9oLqO4al+1OXV9QhlzlZxSZtcQJtBQAzXqyhBFKI=";
+    sha256 = "sha256-msFuBKG/uuXxOcPf0KT3TWOiQrQ4rYHFxOcJ56QBkEU=";
   };
 
   nativeBuildInputs = [ imagemagick ];

pkgs/os-specific/darwin/apple-sdk-11.0/apple_sdk.nix

···
             $out/Library/Frameworks/CoreVideo.framework/Headers/CVBase.h
         '';
       });
+
+      System = lib.overrideDerivation super.System (drv: {
+        installPhase = drv.installPhase + ''
+          # Contrarily to the other frameworks, System framework's TBD file
+          # is a symlink pointing to ${MacOSX-SDK}/usr/lib/libSystem.B.tbd.
+          # This produces an error when installing the framework as:
+          #   1. The original file is not copied into the output directory
+          #   2. Even if it was copied, the relative path wouldn't match
+          # Thus, it is easier to replace the file than to fix the symlink.
+          cp --remove-destination ${MacOSX-SDK}/usr/lib/libSystem.B.tbd \
+            $out/Library/Frameworks/System.framework/Versions/B/System.tbd
+        '';
+      });
     };
 
     # Merge extraDeps into generatedDeps.

pkgs/os-specific/darwin/raycast/default.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "raycast";
-  version = "1.49.2";
+  version = "1.49.3";
 
   src = fetchurl {
     # https://github.com/NixOS/nixpkgs/pull/223495
···
     # to host GitHub Actions to periodically check for updates
     # and re-release the `.dmg` file to Internet Archive (https://archive.org/details/raycast)
     url = "https://archive.org/download/raycast/raycast-${version}.dmg";
-    sha256 = "sha256-3evuSRSCZkhxRy/85ohzIVF1tKRlWy+G5BOmuCWF2hU=";
+    sha256 = "sha256-Irn99/49fRQg73cX8aKZ72D1o+mDPg44Q1pXAMdXrb0=";
   };
 
   dontPatch = true;

pkgs/servers/monitoring/prometheus/smokeping-prober.nix

···
 { lib, buildGoModule, fetchFromGitHub, nixosTests }:
 
-let
-  baseVersion = "0.4.2";
-  commit = "722200c4adbd6d1e5d847dfbbd9dec07aa4ca38d";
-in
 buildGoModule rec {
   pname = "smokeping_prober";
-  version = "${baseVersion}-g${commit}";
+  version = "0.4.2";
 
   ldflags = let
-    setVars = {
-      Version = baseVersion;
-      Revision = commit;
-      Branch = commit;
+    setVars = rec {
+      Version = version;
+      Revision = "722200c4adbd6d1e5d847dfbbd9dec07aa4ca38d";
+      Branch = Revision;
       BuildUser = "nix";
     };
     varFlags = lib.concatStringsSep " " (lib.mapAttrsToList (name: value: "-X github.com/prometheus/common/version.${name}=${value}") setVars);
···
   ];
 
   src = fetchFromGitHub {
-    rev = commit;
     owner = "SuperQ";
     repo = "smokeping_prober";
+    rev = "v${version}";
     sha256 = "1lpcjip6qxhalldgm6i2kgbajfqy3vwfyv9jy0jdpii13lv6mzlz";
   };
   vendorSha256 = "0p2jmlxpvpaqc445j39b4z4i3mnjrm25khv3sq6ylldcgfd31vz8";

pkgs/tools/admin/qovery-cli/default.nix

···
 
 buildGoModule rec {
   pname = "qovery-cli";
-  version = "0.56.3";
+  version = "0.57.1";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-DJkVIZBuKM5magrhW/+9IdvU5IVEFfF293X6vbFCfmI=";
+    hash = "sha256-i60u9U3SLu2EzRlLJliXrRC+SozreAsVI2Vd6gDDVE4=";
   };
 
   vendorHash = "sha256-1krHpwjs4kGhPMBF5j3iqUBo8TGKs1h+nDCmDmviPu4=";

pkgs/tools/backup/rustic-rs/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "rustic-rs";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "rustic-rs";
     repo = "rustic";
     rev = "refs/tags/v${version}";
-    hash = "sha256-r4hOjX/LKv2wX720FMEztUo9rf2hDBLfcHtENSZNA3U=";
+    hash = "sha256-r1h21J+pR8HiFfSxBwTVhuPFtc7HP+XnI3Xtx4oRKzY=";
   };
 
-  cargoHash = "sha256-sNxD8rDkfUw5aVhRYpYftpPMiWhiTYDdShlVZvx2BHk=";
+  cargoHash = "sha256-HiGBp79bxxZaupPo5s6cjXa4Q83O9i8VLzB9psjKSfo=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/tools/misc/libpff/default.nix

···
+{ stdenv
+, lib
+, fetchzip
+, pkg-config
+, autoreconfHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libpff";
+  version = "20211114";
+
+  src = fetchzip {
+    url = "https://github.com/libyal/libpff/releases/download/${version}/libpff-alpha-${version}.tar.gz";
+    sha256 = "sha256-UmGRBgi78nDSuuOXi/WmODojWU5AbQGKNQwLseoh714=";
+  };
+
+  nativeBuildInputs = [ pkg-config autoreconfHook ];
+  outputs = [ "bin" "dev" "out" ];
+
+  meta = {
+    description = "Library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format";
+    homepage = "https://github.com/libyal/libpff";
+    downloadPage = "https://github.com/libyal/libpff/releases";
+    changelog = "https://github.com/libyal/libpff/blob/${version}/ChangeLog";
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ hacker1024 ];
+  };
+}

pkgs/tools/misc/wasm-tools/Cargo.lock

···
 
 [[package]]
 name = "wasm-compose"
-version = "0.2.10"
+version = "0.2.12"
 dependencies = [
  "anyhow",
  "clap 4.1.8",
···
  "serde_yaml",
  "smallvec",
  "wasm-encoder",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wat",
 ]
···
  "anyhow",
  "leb128",
  "tempfile",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
 ]
 
 [[package]]
 name = "wasm-metadata"
-version = "0.3.1"
+version = "0.4.0"
 dependencies = [
  "anyhow",
  "clap 4.1.8",
  "indexmap",
  "serde",
  "wasm-encoder",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wat",
 ]
 
 [[package]]
 name = "wasm-mutate"
-version = "0.2.21"
+version = "0.2.23"
 dependencies = [
  "anyhow",
  "clap 4.1.8",
···
  "rand",
  "thiserror",
  "wasm-encoder",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wat",
 ]
···
  "num_cpus",
  "rand",
  "wasm-mutate",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wasmtime",
 ]
 
 [[package]]
 name = "wasm-shrink"
-version = "0.1.22"
+version = "0.1.24"
 dependencies = [
  "anyhow",
  "blake3",
···
  "log",
  "rand",
  "wasm-mutate",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wat",
 ]
 
 [[package]]
 name = "wasm-smith"
-version = "0.12.5"
+version = "0.12.6"
 dependencies = [
  "arbitrary",
  "criterion",
···
  "rand",
  "serde",
  "wasm-encoder",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wat",
 ]
 
 [[package]]
 name = "wasm-tools"
-version = "1.0.27"
+version = "1.0.30"
 dependencies = [
  "anyhow",
  "arbitrary",
···
  "wasm-mutate",
  "wasm-shrink",
  "wasm-smith",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wast",
  "wat",
···
  "wasm-mutate",
  "wasm-shrink",
  "wasm-smith",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wast",
  "wat",
···
  "wasm-encoder",
  "wasm-mutate",
  "wasm-smith",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wasmtime",
  "wast",
···
 
 [[package]]
 name = "wasmparser"
-version = "0.102.0"
+version = "0.103.0"
 dependencies = [
  "anyhow",
  "criterion",
···
 
 [[package]]
 name = "wasmprinter"
-version = "0.2.53"
+version = "0.2.55"
 dependencies = [
  "anyhow",
  "diff",
  "rayon",
  "tempfile",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wast",
  "wat",
 ]
···
 
 [[package]]
 name = "wast"
-version = "55.0.0"
+version = "56.0.0"
 dependencies = [
  "anyhow",
  "leb128",
···
  "rayon",
  "unicode-width",
  "wasm-encoder",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wat",
 ]
 
 [[package]]
 name = "wat"
-version = "1.0.61"
+version = "1.0.62"
 dependencies = [
  "wast",
 ]
···
 
 [[package]]
 name = "wit-component"
-version = "0.7.3"
+version = "0.8.1"
 dependencies = [
  "anyhow",
  "bitflags",
···
  "url",
  "wasm-encoder",
  "wasm-metadata",
- "wasmparser 0.102.0",
+ "wasmparser 0.103.0",
  "wasmprinter",
  "wat",
  "wit-parser",
···
 
 [[package]]
 name = "wit-parser"
-version = "0.6.4"
+version = "0.7.0"
 dependencies = [
  "anyhow",
  "env_logger",

pkgs/tools/misc/wasm-tools/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "wasm-tools";
-  version = "1.0.27";
+  version = "1.0.30";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = pname;
     rev = "${pname}-${version}";
-    hash = "sha256-kuTcxZLtQyDcj8SFfpJRNwto1e5iuXjxqZ46CnLOVIc=";
+    hash = "sha256-Sd4oYHywXejLPDbNmQ73bWGw48QNQ8M+2l3CjC6D6Iw=";
     fetchSubmodules = true;
   };
 

pkgs/tools/misc/wv/default.nix

···
 
   hardeningDisable = [ "format" ];
 
+  enableParallelBuilding = true;
+
   # autoreconfHook fails hard if these two files do not exist
   postPatch = ''
     touch AUTHORS ChangeLog

pkgs/tools/networking/networkmanager/strongswan/default.nix

···
   ];
 
   configureFlags = [
+    "--disable-more-warnings" # disables -Werror
     "--with-charon=${strongswanNM}/libexec/ipsec/charon-nm"
     "--with-nm-libexecdir=${placeholder "out"}/libexec"
     "--with-nm-plugindir=${placeholder "out"}/lib/NetworkManager"

pkgs/tools/networking/nuttcp/default.nix

···
-{ lib, stdenv, fetchurl }:
+{ lib
+, stdenv
+, fetchurl
+, installShellFiles
+}:
 
 stdenv.mkDerivation rec {
   pname = "nuttcp";
-  version = "8.1.4";
+  version = "8.2.2";
 
   src = fetchurl {
-    urls = [
-      "http://nuttcp.net/nuttcp/latest/${pname}-${version}.c"
-      "http://nuttcp.net/nuttcp/${pname}-${version}/${pname}-${version}.c"
-      "http://nuttcp.net/nuttcp/beta/${pname}-${version}.c"
-    ];
-    sha256 = "1mygfhwxfi6xg0iycivx98ckak2abc3vwndq74278kpd8g0yyqyh";
+    url = "http://nuttcp.net/nuttcp/nuttcp-${version}.tar.bz2";
+    sha256 = "sha256-fq16ieeqoFnSDjQELFihmMKYHK1ylVDROI3fyQNtOYM=";
   };
 
-  man = fetchurl {
-    url = "http://nuttcp.net/nuttcp/${pname}-${version}/nuttcp.8";
-    sha256 = "1yang94mcdqg362qbi85b63746hk6gczxrk619hyj91v5763n4vx";
-  };
-
-  dontUnpack = true;
-
-  buildPhase = ''
-    cc -O2 -o nuttcp $src
-  '';
+  nativeBuildInputs = [
+    installShellFiles
+  ];
 
   installPhase = ''
     mkdir -p $out/bin
-    cp nuttcp $out/bin
+    cp nuttcp-${version} $out/bin/nuttcp
+  '';
+
+  postInstall = ''
+    installManPage nuttcp.8
   '';
 
   meta = with lib; {
···
       system, and wall-clock time, transmitter and receiver CPU utilization,
       and loss percentage (for UDP transfers).
     '';
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     homepage = "http://nuttcp.net/";
     maintainers = with maintainers; [ ];
     platforms = platforms.unix;

pkgs/tools/networking/zap/default.nix

···
     #!${runtimeShell}
     export PATH="${lib.makeBinPath [ jre ]}:\$PATH"
     export JAVA_HOME='${jre}'
-    if ! [ -f "~/.ZAP/config.xml" ];then
+    if ! [ -f "\$HOME/.ZAP/config.xml" ];then
       mkdir -p "\$HOME/.ZAP"
       head -n 2 $out/share/${pname}/xml/config.xml > "\$HOME/.ZAP/config.xml"
       echo "<version>${version_tag}</version>" >> "\$HOME/.ZAP/config.xml"
···
   meta = with lib; {
     homepage = "https://www.owasp.org/index.php/ZAP";
     description = "Java application for web penetration testing";
-    maintainers = with maintainers; [ mog ];
+    maintainers = with maintainers; [ mog rafael ];
     platforms = platforms.linux;
     license = licenses.asl20;
   };

pkgs/tools/security/pynitrokey/default.nix

···
 
 buildPythonApplication rec {
   pname = "pynitrokey";
-  version = "0.4.34";
+  version = "0.4.36";
   format = "flit";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lMXoDkNiAmGb6e4u/vZMcmXUclwW402YUGihLjWIr+U=";
+    hash = "sha256-Y+6T1iUp9TVYbAjpXVHozC6WT061r0VYv/ifu8lcN6E=";
   };
 
   propagatedBuildInputs = [
···
 
   pythonRelaxDeps = [
     "cryptography"
+    "protobuf"
     "python-dateutil"
     "spsdk"
     "typing_extensions"

pkgs/tools/text/d2/default.nix

···
 , buildGoModule
 , fetchFromGitHub
 , installShellFiles
+, git
 , testers
 , d2
 }:
 
 buildGoModule rec {
   pname = "d2";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "terrastruct";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-ll6kOmHJZRsN6DkQRAUXyxz61tjwwi+p5eOuLfGDpI8=";
+    hash = "sha256-vMgOFZJwlWjNfOp4QsFoq1y9JQm16qDkP7uoOwICuTo=";
   };
 
   vendorHash = "sha256-jfGolYHWX/9Zr5JHiWl8mCfaaRT2AU8v32PtgM1KI8c=";
+
+  excludedPackages = [ "./e2etests" ];
 
   ldflags = [
     "-s"
···
     installManPage ci/release/template/man/d2.1
   '';
 
-  subPackages = [ "." ];
+  nativeCheckInputs = [ git ];
+
+  preCheck = ''
+    # See https://github.com/terrastruct/d2/blob/master/docs/CONTRIBUTING.md#running-tests.
+    export TESTDATA_ACCEPT=1
+  '';
 
   passthru.tests.version = testers.testVersion { package = d2; };
 

pkgs/tools/typesetting/tex/auctex/default.nix

···
   buildInputs = [
     emacs
     ghostscript
-    texlive.combined.scheme-basic
+    (texlive.combine { inherit (texlive) scheme-basic hypdoc;  })
   ];
 
   preConfigure = ''

pkgs/top-level/all-packages.nix

···
 
   libgen-cli = callPackage ../tools/misc/libgen-cli { };
 
+  libpff = callPackage ../tools/misc/libpff {};
+
   licensor = callPackage ../tools/misc/licensor { };
 
   lesspipe = callPackage ../tools/misc/lesspipe { };
···
   cakelisp = callPackage ../development/compilers/cakelisp { };
 
   ciao = callPackage ../development/compilers/ciao { };
+
+  codon = callPackage ../development/compilers/codon {
+    inherit (llvmPackages_latest) lld stdenv;
+  };
 
   colm = callPackage ../development/compilers/colm { };
 
···
   notepadqq = libsForQt5.callPackage ../applications/editors/notepadqq { };
 
   notmuch = callPackage ../applications/networking/mailreaders/notmuch {
-    gmime = gmime3;
     pythonPackages = python3Packages;
   };
 

pkgs/top-level/python-aliases.nix

···
   python-subunit = subunit; # added 2021-09-10
   pytest_xdist = pytest-xdist; # added 2021-01-04
   python_simple_hipchat = python-simple-hipchat; # added 2021-07-21
+  pytoml = throw "pytoml has been removed because it is unmaintained and is superseded by toml"; # Added 2023-04-11
   pytorch = torch; # added 2022-09-30
   pytorch-bin = torch-bin; # added 2022-09-30
   pytorchWithCuda = torchWithCuda; # added 2022-09-30

pkgs/top-level/python-packages.nix

···
 
   pytmx = callPackage ../development/python-modules/pytmx { };
 
-  pytoml = callPackage ../development/python-modules/pytoml { };
-
   pytomlpp = callPackage ../development/python-modules/pytomlpp { };
 
   pytoolconfig = callPackage ../development/python-modules/pytoolconfig { };