Merge master into staging-next

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

···
           <literal>coursier</literal>, you can create a shell alias.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>services.mosquitto</literal> module has been
+          rewritten to support multiple listeners and per-listener
+          configuration. Module configurations from previous releases
+          will no longer work and must be updated.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-notable-changes">

nixos/doc/manual/release-notes/rl-2111.section.md

···
 
 - The `coursier` package's binary was renamed from `coursier` to `cs`. Completions which haven't worked for a while should now work with the renamed binary. To keep using `coursier`, you can create a shell alias.
 
+- The `services.mosquitto` module has been rewritten to support multiple listeners and per-listener configuration.
+  Module configurations from previous releases will no longer work and must be updated.
+
 ## Other Notable Changes {#sec-release-21.11-notable-changes}
 
 

nixos/modules/services/backup/borgbackup.nix

···
       ${cfg.postInit}
     fi
   '' + ''
-    borg create $extraArgs \
-      --compression ${cfg.compression} \
-      --exclude-from ${mkExcludeFile cfg} \
-      $extraCreateArgs \
-      "::$archiveName$archiveSuffix" \
-      ${escapeShellArgs cfg.paths}
+    (
+      set -o pipefail
+      ${optionalString (cfg.dumpCommand != null) ''${escapeShellArg cfg.dumpCommand} | \''}
+      borg create $extraArgs \
+        --compression ${cfg.compression} \
+        --exclude-from ${mkExcludeFile cfg} \
+        $extraCreateArgs \
+        "::$archiveName$archiveSuffix" \
+        ${if cfg.paths == null then "-" else escapeShellArgs cfg.paths}
+    )
   '' + optionalString cfg.appendFailedSuffix ''
     borg rename $extraArgs \
       "::$archiveName$archiveSuffix" "$archiveName"
···
       + " without at least one public key";
   };
 
+  mkSourceAssertions = name: cfg: {
+    assertion = count isNull [ cfg.dumpCommand cfg.paths ] == 1;
+    message = ''
+      Exactly one of borgbackup.jobs.${name}.paths or borgbackup.jobs.${name}.dumpCommand
+      must be set.
+    '';
+  };
+
   mkRemovableDeviceAssertions = name: cfg: {
     assertion = !(isLocalPath cfg.repo) -> !cfg.removableDevice;
     message = ''
···
         options = {
 
           paths = mkOption {
-            type = with types; coercedTo str lib.singleton (listOf str);
-            description = "Path(s) to back up.";
+            type = with types; nullOr (coercedTo str lib.singleton (listOf str));
+            default = null;
+            description = ''
+              Path(s) to back up.
+              Mutually exclusive with <option>dumpCommand</option>.
+            '';
             example = "/home/user";
+          };
+
+          dumpCommand = mkOption {
+            type = with types; nullOr path;
+            default = null;
+            description = ''
+              Backup the stdout of this program instead of filesystem paths.
+              Mutually exclusive with <option>paths</option>.
+            '';
+            example = "/path/to/createZFSsend.sh";
           };
 
           repo = mkOption {
···
       assertions =
         mapAttrsToList mkPassAssertion jobs
         ++ mapAttrsToList mkKeysAssertion repos
+        ++ mapAttrsToList mkSourceAssertions jobs
         ++ mapAttrsToList mkRemovableDeviceAssertions jobs;
 
       system.activationScripts = mapAttrs' mkActivationScript jobs;

nixos/modules/services/networking/mosquitto.nix

···
 let
   cfg = config.services.mosquitto;
 
-  listenerConf = optionalString cfg.ssl.enable ''
-    listener ${toString cfg.ssl.port} ${cfg.ssl.host}
-    cafile ${cfg.ssl.cafile}
-    certfile ${cfg.ssl.certfile}
-    keyfile ${cfg.ssl.keyfile}
-  '';
+  # note that mosquitto config parsing is very simplistic as of may 2021.
+  # often times they'll e.g. strtok() a line, check the first two tokens, and ignore the rest.
+  # there's no escaping available either, so we have to prevent any being necessary.
+  str = types.strMatching "[^\r\n]*" // {
+    description = "single-line string";
+  };
+  path = types.addCheck types.path (p: str.check "${p}");
+  configKey = types.strMatching "[^\r\n\t ]+";
+  optionType = with types; oneOf [ str path bool int ] // {
+    description = "string, path, bool, or integer";
+  };
+  optionToString = v:
+    if isBool v then boolToString v
+    else if path.check v then "${v}"
+    else toString v;
 
-  passwordConf = optionalString cfg.checkPasswords ''
-    password_file ${cfg.dataDir}/passwd
-  '';
+  assertKeysValid = prefix: valid: config:
+    mapAttrsToList
+      (n: _: {
+        assertion = valid ? ${n};
+        message = "Invalid config key ${prefix}.${n}.";
+      })
+      config;
 
-  mosquittoConf = pkgs.writeText "mosquitto.conf" ''
-    acl_file ${aclFile}
-    persistence true
-    allow_anonymous ${boolToString cfg.allowAnonymous}
-    listener ${toString cfg.port} ${cfg.host}
-    ${passwordConf}
-    ${listenerConf}
-    ${cfg.extraConf}
-  '';
+  formatFreeform = { prefix ? "" }: mapAttrsToList (n: v: "${prefix}${n} ${optionToString v}");
 
-  userAcl = (concatStringsSep "\n\n" (mapAttrsToList (n: c:
-    "user ${n}\n" + (concatStringsSep "\n" c.acl)) cfg.users
-  ));
+  userOptions = with types; submodule {
+    options = {
+      password = mkOption {
+        type = uniq (nullOr str);
+        default = null;
+        description = ''
+          Specifies the (clear text) password for the MQTT User.
+        '';
+      };
 
-  aclFile = pkgs.writeText "mosquitto.acl" ''
-    ${cfg.aclExtraConf}
-    ${userAcl}
-  '';
+      passwordFile = mkOption {
+        type = uniq (nullOr types.path);
+        example = "/path/to/file";
+        default = null;
+        description = ''
+          Specifies the path to a file containing the
+          clear text password for the MQTT user.
+        '';
+      };
 
-in
+      hashedPassword = mkOption {
+        type = uniq (nullOr str);
+        default = null;
+        description = ''
+          Specifies the hashed password for the MQTT User.
+          To generate hashed password install <literal>mosquitto</literal>
+          package and use <literal>mosquitto_passwd</literal>.
+        '';
+      };
 
-{
+      hashedPasswordFile = mkOption {
+        type = uniq (nullOr types.path);
+        example = "/path/to/file";
+        default = null;
+        description = ''
+          Specifies the path to a file containing the
+          hashed password for the MQTT user.
+          To generate hashed password install <literal>mosquitto</literal>
+          package and use <literal>mosquitto_passwd</literal>.
+        '';
+      };
 
-  ###### Interface
+      acl = mkOption {
+        type = listOf str;
+        example = [ "read A/B" "readwrite A/#" ];
+        default = [];
+        description = ''
+          Control client access to topics on the broker.
+        '';
+      };
+    };
+  };
+
+  userAsserts = prefix: users:
+    mapAttrsToList
+      (n: _: {
+        assertion = builtins.match "[^:\r\n]+" n != null;
+        message = "Invalid user name ${n} in ${prefix}";
+      })
+      users
+    ++ mapAttrsToList
+      (n: u: {
+        assertion = count (s: s != null) [
+          u.password u.passwordFile u.hashedPassword u.hashedPasswordFile
+        ] <= 1;
+        message = "Cannot set more than one password option for user ${n} in ${prefix}";
+      }) users;
+
+  makePasswordFile = users: path:
+    let
+      makeLines = store: file:
+        mapAttrsToList
+          (n: u: "addLine ${escapeShellArg n} ${escapeShellArg u.${store}}")
+          (filterAttrs (_: u: u.${store} != null) users)
+        ++ mapAttrsToList
+          (n: u: "addFile ${escapeShellArg n} ${escapeShellArg "${u.${file}}"}")
+          (filterAttrs (_: u: u.${file} != null) users);
+      plainLines = makeLines "password" "passwordFile";
+      hashedLines = makeLines "hashedPassword" "hashedPasswordFile";
+    in
+      pkgs.writeScript "make-mosquitto-passwd"
+        (''
+          #! ${pkgs.runtimeShell}
+
+          set -eu
+
+          file=${escapeShellArg path}
 
-  options = {
-    services.mosquitto = {
-      enable = mkEnableOption "the MQTT Mosquitto broker";
+          rm -f "$file"
+          touch "$file"
 
-      host = mkOption {
-        default = "127.0.0.1";
-        example = "0.0.0.0";
-        type = types.str;
+          addLine() {
+            echo "$1:$2" >> "$file"
+          }
+          addFile() {
+            if [ $(wc -l <"$2") -gt 1 ]; then
+              echo "invalid mosquitto password file $2" >&2
+              return 1
+            fi
+            echo "$1:$(cat "$2")" >> "$file"
+          }
+        ''
+        + concatStringsSep "\n"
+          (plainLines
+           ++ optional (plainLines != []) ''
+             ${pkgs.mosquitto}/bin/mosquitto_passwd -U "$file"
+           ''
+           ++ hashedLines));
+
+  makeACLFile = idx: users: supplement:
+    pkgs.writeText "mosquitto-acl-${toString idx}.conf"
+      (concatStringsSep
+        "\n"
+        (flatten [
+          supplement
+          (mapAttrsToList
+            (n: u: [ "user ${n}" ] ++ map (t: "topic ${t}") u.acl)
+            users)
+        ]));
+
+  authPluginOptions = with types; submodule {
+    options = {
+      plugin = mkOption {
+        type = path;
         description = ''
-          Host to listen on without SSL.
+          Plugin path to load, should be a <literal>.so</literal> file.
         '';
       };
 
-      port = mkOption {
-        default = 1883;
-        type = types.int;
+      denySpecialChars = mkOption {
+        type = bool;
         description = ''
-          Port on which to listen without SSL.
+          Automatically disallow all clients using <literal>#</literal>
+          or <literal>+</literal> in their name/id.
         '';
+        default = true;
       };
 
-      ssl = {
-        enable = mkEnableOption "SSL listener";
+      options = mkOption {
+        type = attrsOf optionType;
+        description = ''
+          Options for the auth plugin. Each key turns into a <literal>auth_opt_*</literal>
+           line in the config.
+        '';
+        default = {};
+      };
+    };
+  };
 
-        cafile = mkOption {
-          type = types.nullOr types.path;
-          default = null;
-          description = "Path to PEM encoded CA certificates.";
-        };
+  authAsserts = prefix: auth:
+    mapAttrsToList
+      (n: _: {
+        assertion = configKey.check n;
+        message = "Invalid auth plugin key ${prefix}.${n}";
+      })
+      auth;
 
-        certfile = mkOption {
-          type = types.nullOr types.path;
-          default = null;
-          description = "Path to PEM encoded server certificate.";
-        };
+  formatAuthPlugin = plugin:
+    [
+      "auth_plugin ${plugin.plugin}"
+      "auth_plugin_deny_special_chars ${optionToString plugin.denySpecialChars}"
+    ]
+    ++ formatFreeform { prefix = "auth_opt_"; } plugin.options;
 
-        keyfile = mkOption {
-          type = types.nullOr types.path;
-          default = null;
-          description = "Path to PEM encoded server key.";
-        };
+  freeformListenerKeys = {
+    allow_anonymous = 1;
+    allow_zero_length_clientid = 1;
+    auto_id_prefix = 1;
+    cafile = 1;
+    capath = 1;
+    certfile = 1;
+    ciphers = 1;
+    "ciphers_tls1.3" = 1;
+    crlfile = 1;
+    dhparamfile = 1;
+    http_dir = 1;
+    keyfile = 1;
+    max_connections = 1;
+    max_qos = 1;
+    max_topic_alias = 1;
+    mount_point = 1;
+    protocol = 1;
+    psk_file = 1;
+    psk_hint = 1;
+    require_certificate = 1;
+    socket_domain = 1;
+    tls_engine = 1;
+    tls_engine_kpass_sha1 = 1;
+    tls_keyform = 1;
+    tls_version = 1;
+    use_identity_as_username = 1;
+    use_subject_as_username = 1;
+    use_username_as_clientid = 1;
+  };
 
-        host = mkOption {
-          default = "0.0.0.0";
-          example = "localhost";
-          type = types.str;
-          description = ''
-            Host to listen on with SSL.
-          '';
-        };
+  listenerOptions = with types; submodule {
+    options = {
+      port = mkOption {
+        type = port;
+        description = ''
+          Port to listen on. Must be set to 0 to listen on a unix domain socket.
+        '';
+        default = 1883;
+      };
 
-        port = mkOption {
-          default = 8883;
-          type = types.int;
-          description = ''
-            Port on which to listen with SSL.
-          '';
-        };
+      address = mkOption {
+        type = nullOr str;
+        description = ''
+          Address to listen on. Listen on <literal>0.0.0.0</literal>/<literal>::</literal>
+          when unset.
+        '';
+        default = null;
       };
 
-      dataDir = mkOption {
-        default = "/var/lib/mosquitto";
-        type = types.path;
+      authPlugins = mkOption {
+        type = listOf authPluginOptions;
         description = ''
-          The data directory.
+          Authentication plugin to attach to this listener.
+          Refer to the <link xlink:href="https://mosquitto.org/man/mosquitto-conf-5.html">
+          mosquitto.conf documentation</link> for details on authentication plugins.
         '';
+        default = [];
       };
 
       users = mkOption {
-        type = types.attrsOf (types.submodule {
-          options = {
-            password = mkOption {
-              type = with types; uniq (nullOr str);
-              default = null;
-              description = ''
-                Specifies the (clear text) password for the MQTT User.
-              '';
-            };
+        type = attrsOf userOptions;
+        example = { john = { password = "123456"; acl = [ "topic readwrite john/#" ]; }; };
+        description = ''
+          A set of users and their passwords and ACLs.
+        '';
+        default = {};
+      };
 
-            passwordFile = mkOption {
-              type = with types; uniq (nullOr str);
-              example = "/path/to/file";
-              default = null;
-              description = ''
-                Specifies the path to a file containing the
-                clear text password for the MQTT user.
-              '';
-            };
+      acl = mkOption {
+        type = listOf str;
+        description = ''
+          Additional ACL items to prepend to the generated ACL file.
+        '';
+        default = [];
+      };
 
-            hashedPassword = mkOption {
-              type = with types; uniq (nullOr str);
-              default = null;
-              description = ''
-                Specifies the hashed password for the MQTT User.
-                To generate hashed password install <literal>mosquitto</literal>
-                package and use <literal>mosquitto_passwd</literal>.
-              '';
-            };
+      settings = mkOption {
+        type = submodule {
+          freeformType = attrsOf optionType;
+        };
+        description = ''
+          Additional settings for this listener.
+        '';
+        default = {};
+      };
+    };
+  };
 
-            hashedPasswordFile = mkOption {
-              type = with types; uniq (nullOr str);
-              example = "/path/to/file";
-              default = null;
+  listenerAsserts = prefix: listener:
+    assertKeysValid prefix freeformListenerKeys listener.settings
+    ++ userAsserts prefix listener.users
+    ++ imap0
+      (i: v: authAsserts "${prefix}.authPlugins.${toString i}" v)
+      listener.authPlugins;
+
+  formatListener = idx: listener:
+    [
+      "listener ${toString listener.port} ${toString listener.address}"
+      "password_file ${cfg.dataDir}/passwd-${toString idx}"
+      "acl_file ${makeACLFile idx listener.users listener.acl}"
+    ]
+    ++ formatFreeform {} listener.settings
+    ++ concatMap formatAuthPlugin listener.authPlugins;
+
+  freeformBridgeKeys = {
+    bridge_alpn = 1;
+    bridge_attempt_unsubscribe = 1;
+    bridge_bind_address = 1;
+    bridge_cafile = 1;
+    bridge_capath = 1;
+    bridge_certfile = 1;
+    bridge_identity = 1;
+    bridge_insecure = 1;
+    bridge_keyfile = 1;
+    bridge_max_packet_size = 1;
+    bridge_outgoing_retain = 1;
+    bridge_protocol_version = 1;
+    bridge_psk = 1;
+    bridge_require_ocsp = 1;
+    bridge_tls_version = 1;
+    cleansession = 1;
+    idle_timeout = 1;
+    keepalive_interval = 1;
+    local_cleansession = 1;
+    local_clientid = 1;
+    local_password = 1;
+    local_username = 1;
+    notification_topic = 1;
+    notifications = 1;
+    notifications_local_only = 1;
+    remote_clientid = 1;
+    remote_password = 1;
+    remote_username = 1;
+    restart_timeout = 1;
+    round_robin = 1;
+    start_type = 1;
+    threshold = 1;
+    try_private = 1;
+  };
+
+  bridgeOptions = with types; submodule {
+    options = {
+      addresses = mkOption {
+        type = listOf (submodule {
+          options = {
+            address = mkOption {
+              type = str;
               description = ''
-                Specifies the path to a file containing the
-                hashed password for the MQTT user.
-                To generate hashed password install <literal>mosquitto</literal>
-                package and use <literal>mosquitto_passwd</literal>.
+                Address of the remote MQTT broker.
               '';
             };
 
-            acl = mkOption {
-              type = types.listOf types.str;
-              example = [ "topic read A/B" "topic A/#" ];
+            port = mkOption {
+              type = port;
               description = ''
-                Control client access to topics on the broker.
+                Port of the remote MQTT broker.
               '';
+              default = 1883;
             };
           };
         });
-        example = { john = { password = "123456"; acl = [ "topic readwrite john/#" ]; }; };
+        default = [];
         description = ''
-          A set of users and their passwords and ACLs.
+          Remote endpoints for the bridge.
         '';
       };
 
-      allowAnonymous = mkOption {
-        default = false;
-        type = types.bool;
+      topics = mkOption {
+        type = listOf str;
         description = ''
-          Allow clients to connect without authentication.
+          Topic patterns to be shared between the two brokers.
+          Refer to the <link xlink:href="https://mosquitto.org/man/mosquitto-conf-5.html">
+          mosquitto.conf documentation</link> for details on the format.
         '';
+        default = [];
+        example = [ "# both 2 local/topic/ remote/topic/" ];
       };
 
-      checkPasswords = mkOption {
-        default = false;
-        example = true;
-        type = types.bool;
+      settings = mkOption {
+        type = submodule {
+          freeformType = attrsOf optionType;
+        };
         description = ''
-          Refuse connection when clients provide incorrect passwords.
+          Additional settings for this bridge.
         '';
+        default = {};
       };
+    };
+  };
 
-      extraConf = mkOption {
-        default = "";
-        type = types.lines;
-        description = ''
-          Extra config to append to `mosquitto.conf` file.
-        '';
-      };
+  bridgeAsserts = prefix: bridge:
+    assertKeysValid prefix freeformBridgeKeys bridge.settings
+    ++ [ {
+      assertion = length bridge.addresses > 0;
+      message = "Bridge ${prefix} needs remote broker addresses";
+    } ];
+
+  formatBridge = name: bridge:
+    [
+      "connection ${name}"
+      "addresses ${concatMapStringsSep " " (a: "${a.address}:${toString a.port}") bridge.addresses}"
+    ]
+    ++ map (t: "topic ${t}") bridge.topics
+    ++ formatFreeform {} bridge.settings;
+
+  freeformGlobalKeys = {
+    allow_duplicate_messages = 1;
+    autosave_interval = 1;
+    autosave_on_changes = 1;
+    check_retain_source = 1;
+    connection_messages = 1;
+    log_facility = 1;
+    log_timestamp = 1;
+    log_timestamp_format = 1;
+    max_inflight_bytes = 1;
+    max_inflight_messages = 1;
+    max_keepalive = 1;
+    max_packet_size = 1;
+    max_queued_bytes = 1;
+    max_queued_messages = 1;
+    memory_limit = 1;
+    message_size_limit = 1;
+    persistence_file = 1;
+    persistence_location = 1;
+    persistent_client_expiration = 1;
+    pid_file = 1;
+    queue_qos0_messages = 1;
+    retain_available = 1;
+    set_tcp_nodelay = 1;
+    sys_interval = 1;
+    upgrade_outgoing_qos = 1;
+    websockets_headers_size = 1;
+    websockets_log_level = 1;
+  };
+
+  globalOptions = with types; {
+    enable = mkEnableOption "the MQTT Mosquitto broker";
+
+    bridges = mkOption {
+      type = attrsOf bridgeOptions;
+      default = {};
+      description = ''
+        Bridges to build to other MQTT brokers.
+      '';
+    };
+
+    listeners = mkOption {
+      type = listOf listenerOptions;
+      default = {};
+      description = ''
+        Listeners to configure on this broker.
+      '';
+    };
+
+    includeDirs = mkOption {
+      type = listOf path;
+      description = ''
+        Directories to be scanned for further config files to include.
+        Directories will processed in the order given,
+        <literal>*.conf</literal> files in the directory will be
+        read in case-sensistive alphabetical order.
+      '';
+      default = [];
+    };
+
+    logDest = mkOption {
+      type = listOf (either path (enum [ "stdout" "stderr" "syslog" "topic" "dlt" ]));
+      description = ''
+        Destinations to send log messages to.
+      '';
+      default = [ "stderr" ];
+    };
+
+    logType = mkOption {
+      type = listOf (enum [ "debug" "error" "warning" "notice" "information"
+                            "subscribe" "unsubscribe" "websockets" "none" "all" ]);
+      description = ''
+        Types of messages to log.
+      '';
+      default = [];
+    };
+
+    persistence = mkOption {
+      type = bool;
+      description = ''
+        Enable persistent storage of subscriptions and messages.
+      '';
+      default = true;
+    };
 
-      aclExtraConf = mkOption {
-        default = "";
-        type = types.lines;
-        description = ''
-          Extra config to prepend to the ACL file.
-        '';
-      };
+    dataDir = mkOption {
+      default = "/var/lib/mosquitto";
+      type = types.path;
+      description = ''
+        The data directory.
+      '';
+    };
 
+    settings = mkOption {
+      type = submodule {
+        freeformType = attrsOf optionType;
+      };
+      description = ''
+        Global configuration options for the mosquitto broker.
+      '';
+      default = {};
     };
   };
 
+  globalAsserts = prefix: cfg:
+    flatten [
+      (assertKeysValid prefix freeformGlobalKeys cfg.settings)
+      (imap0 (n: l: listenerAsserts "${prefix}.listener.${toString n}" l) cfg.listeners)
+      (mapAttrsToList (n: b: bridgeAsserts "${prefix}.bridge.${n}" b) cfg.bridges)
+    ];
+
+  formatGlobal = cfg:
+    [
+      "per_listener_settings true"
+      "persistence ${optionToString cfg.persistence}"
+    ]
+    ++ map
+      (d: if path.check d then "log_dest file ${d}" else "log_dest ${d}")
+      cfg.logDest
+    ++ map (t: "log_type ${t}") cfg.logType
+    ++ formatFreeform {} cfg.settings
+    ++ concatLists (imap0 formatListener cfg.listeners)
+    ++ concatLists (mapAttrsToList formatBridge cfg.bridges)
+    ++ map (d: "include_dir ${d}") cfg.includeDirs;
+
+  configFile = pkgs.writeText "mosquitto.conf"
+    (concatStringsSep "\n" (formatGlobal cfg));
+
+in
+
+{
+
+  ###### Interface
+
+  options.services.mosquitto = globalOptions;
 
   ###### Implementation
 
   config = mkIf cfg.enable {
 
-    assertions = mapAttrsToList (name: cfg: {
-      assertion = length (filter (s: s != null) (with cfg; [
-        password passwordFile hashedPassword hashedPasswordFile
-      ])) <= 1;
-      message = "Cannot set more than one password option";
-    }) cfg.users;
+    assertions = globalAsserts "services.mosquitto" cfg;
 
     systemd.services.mosquitto = {
       description = "Mosquitto MQTT Broker Daemon";
···
         RuntimeDirectory = "mosquitto";
         WorkingDirectory = cfg.dataDir;
         Restart = "on-failure";
-        ExecStart = "${pkgs.mosquitto}/bin/mosquitto -c ${mosquittoConf}";
+        ExecStart = "${pkgs.mosquitto}/bin/mosquitto -c ${configFile}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
 
         # Hardening
···
         ReadWritePaths = [
           cfg.dataDir
           "/tmp"  # mosquitto_passwd creates files in /tmp before moving them
-        ];
-        ReadOnlyPaths = with cfg.ssl; lib.optionals (enable) [
-          certfile
-          keyfile
-          cafile
-        ];
+        ] ++ filter path.check cfg.logDest;
+        ReadOnlyPaths =
+          map (p: "${p}")
+            (cfg.includeDirs
+             ++ filter
+               (v: v != null)
+               (flatten [
+                 (map
+                   (l: [
+                     (l.settings.psk_file or null)
+                     (l.settings.http_dir or null)
+                     (l.settings.cafile or null)
+                     (l.settings.capath or null)
+                     (l.settings.certfile or null)
+                     (l.settings.crlfile or null)
+                     (l.settings.dhparamfile or null)
+                     (l.settings.keyfile or null)
+                   ])
+                   cfg.listeners)
+                 (mapAttrsToList
+                   (_: b: [
+                     (b.settings.bridge_cafile or null)
+                     (b.settings.bridge_capath or null)
+                     (b.settings.bridge_certfile or null)
+                     (b.settings.bridge_keyfile or null)
+                   ])
+                   cfg.bridges)
+               ]));
         RemoveIPC = true;
         RestrictAddressFamilies = [
           "AF_UNIX"  # for sd_notify() call
···
         ];
         UMask = "0077";
       };
-      preStart = ''
-        rm -f ${cfg.dataDir}/passwd
-        touch ${cfg.dataDir}/passwd
-      '' + concatStringsSep "\n" (
-        mapAttrsToList (n: c:
-          if c.hashedPasswordFile != null then
-            "echo '${n}:'$(cat '${c.hashedPasswordFile}') >> ${cfg.dataDir}/passwd"
-          else if c.passwordFile != null then
-            "${pkgs.mosquitto}/bin/mosquitto_passwd -b ${cfg.dataDir}/passwd ${n} $(cat '${c.passwordFile}')"
-          else if c.hashedPassword != null then
-            "echo '${n}:${c.hashedPassword}' >> ${cfg.dataDir}/passwd"
-          else optionalString (c.password != null)
-            "${pkgs.mosquitto}/bin/mosquitto_passwd -b ${cfg.dataDir}/passwd ${n} '${c.password}'"
-        ) cfg.users);
+      preStart =
+        concatStringsSep
+          "\n"
+          (imap0
+            (idx: listener: makePasswordFile listener.users "${cfg.dataDir}/passwd-${toString idx}")
+            cfg.listeners);
     };
 
     users.users.mosquitto = {
···
     users.groups.mosquitto.gid = config.ids.gids.mosquitto;
 
   };
+
+  meta.maintainers = with lib.maintainers; [ pennae ];
 }

nixos/tests/borgbackup.nix

···
           environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519.appendOnly";
         };
 
+        commandSuccess = {
+          dumpCommand = pkgs.writeScript "commandSuccess" ''
+            echo -n test
+          '';
+          repo = remoteRepo;
+          encryption.mode = "none";
+          startAt = [ ];
+          environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519";
+        };
+
+        commandFail = {
+          dumpCommand = "${pkgs.coreutils}/bin/false";
+          repo = remoteRepo;
+          encryption.mode = "none";
+          startAt = [ ];
+          environment.BORG_RSH = "ssh -oStrictHostKeyChecking=no -i /root/id_ed25519";
+        };
+
       };
     };
 
···
         client.fail("{} list borg\@server:wrong".format(borg))
 
         # TODO: Make sure that data is not actually deleted
+
+    with subtest("commandSuccess"):
+        server.wait_for_unit("sshd.service")
+        client.wait_for_unit("network.target")
+        client.systemctl("start --wait borgbackup-job-commandSuccess")
+        client.fail("systemctl is-failed borgbackup-job-commandSuccess")
+        id = client.succeed("borg-job-commandSuccess list | tail -n1 | cut -d' ' -f1").strip()
+        client.succeed(f"borg-job-commandSuccess extract ::{id} stdin")
+        assert "test" == client.succeed("cat stdin")
+
+    with subtest("commandFail"):
+        server.wait_for_unit("sshd.service")
+        client.wait_for_unit("network.target")
+        client.systemctl("start --wait borgbackup-job-commandFail")
+        client.succeed("systemctl is-failed borgbackup-job-commandFail")
   '';
 })

nixos/tests/home-assistant.nix

···
     environment.systemPackages = with pkgs; [ mosquitto ];
     services.mosquitto = {
       enable = true;
-      checkPasswords = true;
-      users = {
-        "${mqttUsername}" = {
-          acl = [ "topic readwrite #" ];
-          password = mqttPassword;
+      listeners = [ {
+        users = {
+          "${mqttUsername}" = {
+            acl = [ "readwrite #" ];
+            password = mqttPassword;
+          };
         };
-      };
+      } ];
     };
     services.home-assistant = {
       inherit configDir;

nixos/tests/mosquitto.nix

···
 
 let
   port = 1888;
-  username = "mqtt";
+  tlsPort = 1889;
   password = "VERY_secret";
+  hashedPassword = "$7$101$/WJc4Mp+I+uYE9sR$o7z9rD1EYXHPwEP5GqQj6A7k4W1yVbePlb8TqNcuOLV9WNCiDgwHOB0JHC1WCtdkssqTBduBNUnUGd6kmZvDSw==";
   topic = "test/foo";
+
+  snakeOil = pkgs.runCommand "snakeoil-certs" {
+    buildInputs = [ pkgs.gnutls.bin ];
+    caTemplate = pkgs.writeText "snakeoil-ca.template" ''
+      cn = server
+      expiration_days = -1
+      cert_signing_key
+      ca
+    '';
+    certTemplate = pkgs.writeText "snakeoil-cert.template" ''
+      cn = server
+      expiration_days = -1
+      tls_www_server
+      encryption_key
+      signing_key
+    '';
+    userCertTemplate = pkgs.writeText "snakeoil-user-cert.template" ''
+      organization = snakeoil
+      cn = client1
+      expiration_days = -1
+      tls_www_client
+      encryption_key
+      signing_key
+    '';
+  } ''
+    mkdir "$out"
+
+    certtool -p --bits 2048 --outfile "$out/ca.key"
+    certtool -s --template "$caTemplate" --load-privkey "$out/ca.key" \
+                --outfile "$out/ca.crt"
+    certtool -p --bits 2048 --outfile "$out/server.key"
+    certtool -c --template "$certTemplate" \
+                --load-ca-privkey "$out/ca.key" \
+                --load-ca-certificate "$out/ca.crt" \
+                --load-privkey "$out/server.key" \
+                --outfile "$out/server.crt"
+
+    certtool -p --bits 2048 --outfile "$out/client1.key"
+    certtool -c --template "$userCertTemplate" \
+                --load-privkey "$out/client1.key" \
+                --load-ca-privkey "$out/ca.key" \
+                --load-ca-certificate "$out/ca.crt" \
+                --outfile "$out/client1.crt"
+  '';
+
 in {
   name = "mosquitto";
   meta = with pkgs.lib; {
-    maintainers = with maintainers; [ peterhoeg ];
+    maintainers = with maintainers; [ pennae peterhoeg ];
   };
 
   nodes = let
···
     };
   in {
     server = { pkgs, ... }: {
-      networking.firewall.allowedTCPPorts = [ port ];
+      networking.firewall.allowedTCPPorts = [ port tlsPort ];
       services.mosquitto = {
-        inherit port;
         enable = true;
-        host = "0.0.0.0";
-        checkPasswords = true;
-        users.${username} = {
-          inherit password;
-          acl = [
-            "topic readwrite ${topic}"
-          ];
+        settings = {
+          sys_interval = 1;
         };
-      };
+        listeners = [
+          {
+            inherit port;
+            users = {
+              password_store = {
+                inherit password;
+              };
+              password_file = {
+                passwordFile = pkgs.writeText "mqtt-password" password;
+              };
+              hashed_store = {
+                inherit hashedPassword;
+              };
+              hashed_file = {
+                hashedPasswordFile = pkgs.writeText "mqtt-hashed-password" hashedPassword;
+              };
 
-      # disable private /tmp for this test
-      systemd.services.mosquitto.serviceConfig.PrivateTmp = lib.mkForce false;
+              reader = {
+                inherit password;
+                acl = [
+                  "read ${topic}"
+                  "read $SYS/#" # so we always have something to read
+                ];
+              };
+              writer = {
+                inherit password;
+                acl = [ "write ${topic}" ];
+              };
+            };
+          }
+          {
+            port = tlsPort;
+            users.client1 = {
+              acl = [ "read $SYS/#" ];
+            };
+            settings = {
+              cafile = "${snakeOil}/ca.crt";
+              certfile = "${snakeOil}/server.crt";
+              keyfile = "${snakeOil}/server.key";
+              require_certificate = true;
+              use_identity_as_username = true;
+            };
+          }
+        ];
+      };
     };
 
     client1 = client;
     client2 = client;
   };
 
-  testScript = let
-    file = "/tmp/msg";
-  in ''
-    def mosquitto_cmd(binary):
+  testScript = ''
+    def mosquitto_cmd(binary, user, topic, port):
         return (
-            "${pkgs.mosquitto}/bin/mosquitto_{} "
+            "mosquitto_{} "
             "-V mqttv311 "
             "-h server "
-            "-p ${toString port} "
-            "-u ${username} "
+            "-p {} "
+            "-u {} "
             "-P '${password}' "
-            "-t ${topic}"
-        ).format(binary)
+            "-t '{}'"
+        ).format(binary, port, user, topic)
 
 
-    def publish(args):
-        return "{} {}".format(mosquitto_cmd("pub"), args)
+    def publish(args, user, topic="${topic}", port=${toString port}):
+        return "{} {}".format(mosquitto_cmd("pub", user, topic, port), args)
 
 
-    def subscribe(args):
-        return "({} -C 1 {} | tee ${file} &)".format(mosquitto_cmd("sub"), args)
+    def subscribe(args, user, topic="${topic}", port=${toString port}):
+        return "{} -C 1 {}".format(mosquitto_cmd("sub", user, topic, port), args)
+
+    def parallel(*fns):
+        from threading import Thread
+        threads = [ Thread(target=fn) for fn in fns ]
+        for t in threads: t.start()
+        for t in threads: t.join()
 
 
     start_all()
     server.wait_for_unit("mosquitto.service")
 
-    for machine in server, client1, client2:
-        machine.fail("test -f ${file}")
+    def check_passwords():
+        client1.succeed(publish("-m test", "password_store"))
+        client1.succeed(publish("-m test", "password_file"))
+        client1.succeed(publish("-m test", "hashed_store"))
+        client1.succeed(publish("-m test", "hashed_file"))
 
-    # QoS = 0, so only one subscribers should get it
-    server.execute(subscribe("-q 0"))
+    check_passwords()
 
-    # we need to give the subscribers some time to connect
-    client2.execute("sleep 5")
-    client2.succeed(publish("-m FOO -q 0"))
+    def check_acl():
+        client1.succeed(subscribe("", "reader", topic="$SYS/#"))
+        client1.fail(subscribe("-W 5", "writer", topic="$SYS/#"))
 
-    server.wait_until_succeeds("grep -q FOO ${file}")
-    server.execute("rm ${file}")
+        parallel(
+            lambda: client1.succeed(subscribe("-i 3688cdd7-aa07-42a4-be22-cb9352917e40", "reader")),
+            lambda: [
+                server.wait_for_console_text("3688cdd7-aa07-42a4-be22-cb9352917e40"),
+                client2.succeed(publish("-m test", "writer"))
+            ])
+
+        parallel(
+            lambda: client1.fail(subscribe("-W 5 -i 24ff16a2-ae33-4a51-9098-1b417153c712", "reader")),
+            lambda: [
+                server.wait_for_console_text("24ff16a2-ae33-4a51-9098-1b417153c712"),
+                client2.succeed(publish("-m test", "reader"))
+            ])
 
-    # QoS = 1, so both subscribers should get it
-    server.execute(subscribe("-q 1"))
-    client1.execute(subscribe("-q 1"))
+    check_acl()
 
-    # we need to give the subscribers some time to connect
-    client2.execute("sleep 5")
-    client2.succeed(publish("-m BAR -q 1"))
+    def check_tls():
+        client1.succeed(
+            subscribe(
+                "--cafile ${snakeOil}/ca.crt "
+                "--cert ${snakeOil}/client1.crt "
+                "--key ${snakeOil}/client1.key",
+                topic="$SYS/#",
+                port=${toString tlsPort},
+                user="no_such_user"))
 
-    for machine in server, client1:
-        machine.wait_until_succeeds("grep -q BAR ${file}")
-        machine.execute("rm ${file}")
+    check_tls()
   '';
 })

pkgs/applications/networking/browsers/angelfish/default.nix

···
-{ lib
-, mkDerivation
-, fetchurl
-, cmake
-, corrosion
-, extra-cmake-modules
-, kconfig
-, kcoreaddons
-, kdbusaddons
-, ki18n
-, kirigami2
-, knotifications
-, kpurpose
-, kwindowsystem
-, qtfeedback
-, qtquickcontrols2
-, qtwebengine
-, rustPlatform
-}:
-
-mkDerivation rec {
-  pname = "angelfish";
-  version = "21.08";
-
-  src = fetchurl {
-    url = "mirror://kde/stable/plasma-mobile/${version}/angelfish-${version}.tar.xz";
-    sha256 = "1gzvlha159bw767mj8lisn89592j4j4dazzfws3v4anddjh60xnh";
-  };
-
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
-    sha256 = "1pbvw9hdzn3i97mahdy9y6jnjsmwmjs3lxfz7q6r9r10i8swbkak";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    corrosion
-    extra-cmake-modules
-  ] ++ (with rustPlatform; [
-    cargoSetupHook
-    rust.cargo
-    rust.rustc
-  ]);
-
-  cmakeFlags = [
-    "-DRust_CARGO=${rustPlatform.rust.cargo}/bin/cargo"
-  ];
-
-  buildInputs = [
-    kconfig
-    kcoreaddons
-    kdbusaddons
-    ki18n
-    kirigami2
-    knotifications
-    kpurpose
-    kwindowsystem
-    qtfeedback
-    qtquickcontrols2
-    qtwebengine
-  ];
-
-  meta = with lib; {
-    description = "Web browser for Plasma Mobile";
-    homepage = "https://invent.kde.org/plasma-mobile/angelfish";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ dotlambda ];
-  };
-}

pkgs/applications/networking/browsers/chromium/upstream-info.json

···
     }
   },
   "dev": {
-    "version": "96.0.4664.18",
-    "sha256": "0z7hplfl9mlbn07svcavzcb2gqn1hchwhhlpz0qykf6kd441kxpf",
-    "sha256bin64": "0y09aginw5qg7apm9wvxny7y8nxhsq7gnxp1jmghfjhv5xq7pdn9",
+    "version": "97.0.4676.0",
+    "sha256": "1cf660h7n1d4ds63747zfc4wmwxm348grcv40zg614cpjm4q68b5",
+    "sha256bin64": "116a4d47s3sx1pq8hhqybdsjxcv8657xaldrlix2z7jh94ip2nwh",
     "deps": {
       "gn": {
-        "version": "2021-09-24",
+        "version": "2021-10-08",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "0153d369bbccc908f4da4993b1ba82728055926a",
-        "sha256": "0y4414h8jqsbz5af6pn91c0vkfp4s281s85g992xfyl785c5zbsi"
+        "rev": "693f9fb87e4febdd4299db9f73d8d2c958e63148",
+        "sha256": "1qfjj2mdpflry4f9fkagvb76zwfibys4nqz9lddy1zh5nnbd9mff"
       }
     }
   },

pkgs/applications/networking/cluster/flink/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "flink";
-  version = "1.13.2";
+  version = "1.14.0";
 
   src = fetchurl {
     url = "mirror://apache/flink/${pname}-${version}/${pname}-${version}-bin-scala_2.11.tgz";
-    sha256 = "sha256-GPiHV19Z2Htt75hCXK2nCeQMIBQFEEUxXlBembenFL0=";
+    sha256 = "149b9ae774022acc0109dced893ca2d73430627a612be17ff12de8734464aff8";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/networking/sync/unison/default.nix

···
 , makeWrapper
 , ncurses
 , gnugrep
-, fetchpatch
 , copyDesktopItems
 , makeDesktopItem
 , enableX11 ? true
···
 
 stdenv.mkDerivation rec {
   pname = "unison";
-  version = "2.51.3";
+  version = "2.51.4";
 
   src = fetchFromGitHub {
     owner = "bcpierce00";
     repo = "unison";
     rev = "v${version}";
-    sha256 = "sha256-42hmdMwOYSWGiDCmhuqtpCWtvtyD2l+kA/bhHD/Qh5Y=";
+    sha256 = "sha256-jcfq4X+r98bQqbQ3gRqJyryLdt1Y/2CLawqqIiUaQOo=";
   };
 
   nativeBuildInputs = [ makeWrapper ]
     ++ lib.optional enableX11 copyDesktopItems;
   buildInputs = [ ocamlPackages.ocaml ncurses ];
-
-  patches = [
-    # Patch to fix build with ocaml 4.12. Remove in 2.51.4
-    # https://github.com/bcpierce00/unison/pull/481
-    (fetchpatch {
-      name = "fix-compile-with-ocaml-4.12.patch";
-      url = "https://github.com/bcpierce00/unison/commit/14b885316e0a4b41cb80fe3daef7950f88be5c8f.patch?full_index=1";
-      sha256 = "0j1rma1cwdsfql19zvzhfj2ys5c4lbhjcp6jrnck04xnckxxiy3d";
-    })
-  ];
 
   preBuild = lib.optionalString enableX11 ''
     sed -i "s|\(OCAMLOPT=.*\)$|\1 -I $(echo "${ocamlPackages.lablgtk}"/lib/ocaml/*/site-lib/lablgtk2)|" src/Makefile.OCaml

pkgs/applications/plasma-mobile/angelfish.nix

···
+{ lib
+, mkDerivation
+, fetchurl
+, cmake
+, corrosion
+, extra-cmake-modules
+, kconfig
+, kcoreaddons
+, kdbusaddons
+, ki18n
+, kirigami2
+, knotifications
+, kpurpose
+, kwindowsystem
+, qtfeedback
+, qtquickcontrols2
+, qtwebengine
+, rustPlatform
+, srcs
+
+# These must be updated in tandem with package updates.
+, cargoShaForVersion ? "21.08"
+, cargoSha256 ? "1pbvw9hdzn3i97mahdy9y6jnjsmwmjs3lxfz7q6r9r10i8swbkak"
+}:
+
+# Guard against incomplete updates.
+# Values are provided as callPackage inputs to enable easier overrides through overlays.
+if cargoShaForVersion != srcs.angelfish.version
+then builtins.throw ''
+  angelfish package update is incomplete.
+         Hash for cargo dependencies is declared for version ${cargoShaForVersion}, but we're building ${srcs.angelfish.version}.
+         Update the cargoSha256 and cargoShaForVersion for angelfish.
+'' else
+
+mkDerivation rec {
+  pname = "angelfish";
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    src = srcs.angelfish.src;
+    name = "${pname}-${srcs.angelfish.version}";
+    sha256 = cargoSha256;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    corrosion
+    extra-cmake-modules
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);
+
+  cmakeFlags = [
+    "-DRust_CARGO=${rustPlatform.rust.cargo}/bin/cargo"
+  ];
+
+  buildInputs = [
+    kconfig
+    kcoreaddons
+    kdbusaddons
+    ki18n
+    kirigami2
+    knotifications
+    kpurpose
+    kwindowsystem
+    qtfeedback
+    qtquickcontrols2
+    qtwebengine
+  ];
+
+  meta = with lib; {
+    description = "Web browser for Plasma Mobile";
+    homepage = "https://invent.kde.org/plasma-mobile/angelfish";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}

pkgs/applications/plasma-mobile/audiotube.nix

···
+{ lib
+, mkDerivation
+, fetchpatch
+
+, extra-cmake-modules
+
+, kcoreaddons
+, kcrash
+, ki18n
+, kirigami2
+, qtmultimedia
+, qtquickcontrols2
+, python3Packages
+}:
+
+mkDerivation rec {
+  pname = "audiotube";
+
+  patches = [
+    # Fix compatibility with ytmusicapi 0.19.1
+    (fetchpatch {
+      url = "https://invent.kde.org/plasma-mobile/audiotube/-/commit/734caa02805988200f923b88d1590b3f7dac8ac2.patch";
+      sha256 = "0zq4f0w84dv0630bpvmqkfmhxbvibr2fxhzy6d2mnf098028gzyd";
+    })
+  ];
+
+  nativeBuildInputs = [
+    extra-cmake-modules
+    python3Packages.wrapPython
+    python3Packages.pybind11
+  ];
+
+  buildInputs = [
+    kcoreaddons
+    kcrash
+    ki18n
+    kirigami2
+    qtmultimedia
+    qtquickcontrols2
+    python3Packages.youtube-dl
+    python3Packages.ytmusicapi
+  ];
+
+  pythonPath = [
+    python3Packages.youtube-dl
+    python3Packages.ytmusicapi
+  ];
+
+  preFixup = ''
+    buildPythonPath "$pythonPath"
+    qtWrapperArgs+=(--prefix PYTHONPATH : "$program_PYTHONPATH")
+  '';
+
+  meta = with lib; {
+    description = "Client for YouTube Music";
+    homepage = "https://invent.kde.org/plasma-mobile/audiotube";
+    # https://invent.kde.org/plasma-mobile/audiotube/-/tree/c503d0607a3386112beaa9cf990ab85fe33ef115/LICENSES
+    license = with licenses; [ bsd2 cc0 gpl2Only gpl3Only ];
+    maintainers = with maintainers; [ samueldr ];
+  };
+}

pkgs/applications/plasma-mobile/default.nix

···
       };
     in {
       alligator = callPackage ./alligator.nix {};
+      angelfish = callPackage ./angelfish.nix { inherit srcs; };
+      audiotube = callPackage ./audiotube.nix {};
       calindori = callPackage ./calindori.nix {};
       kalk = callPackage ./kalk.nix {};
+      kasts = callPackage ./kasts.nix {};
       kclock = callPackage ./kclock.nix {};
+      keysmith = callPackage ./keysmith.nix {};
       koko = callPackage ./koko.nix {};
       krecorder = callPackage ./krecorder.nix {};
       ktrip = callPackage ./ktrip.nix {};
+      kweather = callPackage ./kweather.nix {};
       plasma-dialer = callPackage ./plasma-dialer.nix {};
       plasma-phonebook = callPackage ./plasma-phonebook.nix {};
       spacebar = callPackage ./spacebar.nix {};

pkgs/applications/plasma-mobile/fetch.sh

···
-WGET_ARGS=( http://download.kde.org/stable/plasma-mobile/21.05 -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma-mobile/21.08/ -A '*.tar.xz' )

pkgs/applications/plasma-mobile/kasts.nix

···
+{ lib
+, mkDerivation
+
+, cmake
+, extra-cmake-modules
+, wrapGAppsHook
+
+, gst_all_1
+, kconfig
+, kcoreaddons
+, ki18n
+, kirigami2
+, qtmultimedia
+, qtquickcontrols2
+, syndication
+}:
+
+let
+  inherit (gst_all_1) gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad;
+in
+mkDerivation rec {
+  pname = "kasts";
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gst-plugins-bad
+    gst-plugins-base
+    gst-plugins-good
+    gstreamer
+
+    kconfig
+    kcoreaddons
+    ki18n
+    kirigami2
+    qtquickcontrols2
+    qtmultimedia
+    syndication
+  ];
+
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+  dontWrapGApps = true;
+
+  meta = with lib; {
+    description = "Mobile podcast application";
+    homepage = "https://apps.kde.org/kasts/";
+    # https://invent.kde.org/plasma-mobile/kasts/-/tree/master/LICENSES
+    license = with licenses; [ bsd2 cc-by-sa-40 cc0 gpl2Only gpl2Plus gpl3Only gpl3Plus lgpl3Plus ];
+    maintainers = with maintainers; [ samueldr ];
+  };
+}

pkgs/applications/plasma-mobile/keysmith.nix

···
+{ lib
+, mkDerivation
+
+, cmake
+, extra-cmake-modules
+
+, kdbusaddons
+, ki18n
+, kirigami2
+, kwindowsystem
+, libsodium
+, qtquickcontrols2
+}:
+
+mkDerivation rec {
+  pname = "keysmith";
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+  ];
+
+  buildInputs = [
+    kdbusaddons
+    ki18n
+    kirigami2
+    kwindowsystem
+    libsodium
+    qtquickcontrols2
+  ];
+
+  meta = with lib; {
+    description = "OTP client for Plasma Mobile and Desktop";
+    license = licenses.gpl3;
+    homepage = "https://github.com/KDE/keysmith";
+    maintainers = with maintainers; [ samueldr shamilton ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/plasma-mobile/ktrip.nix

···
 , kirigami2
 , kitemmodels
 , kpublictransport
+, qqc2-desktop-style
 , qtquickcontrols2
 }:
 
···
     kirigami2
     kitemmodels
     kpublictransport
+    qqc2-desktop-style
     qtquickcontrols2
   ];
 

pkgs/applications/plasma-mobile/kweather.nix

···
+{ lib
+, mkDerivation
+
+, cmake
+, extra-cmake-modules
+
+, kconfig
+, ki18n
+, kirigami2
+, knotifications
+, kquickcharts
+, kweathercore
+, plasma-framework
+, qtcharts
+, qtquickcontrols2
+}:
+
+mkDerivation rec {
+  pname = "kweather";
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+  ];
+
+  buildInputs = [
+    kconfig
+    ki18n
+    kirigami2
+    knotifications
+    kquickcharts
+    kweathercore
+    plasma-framework
+    qtcharts
+    qtquickcontrols2
+  ];
+
+  meta = with lib; {
+    description = "Weather application for Plasma Mobile";
+    homepage = "https://invent.kde.org/plasma-mobile/kweather";
+    license = with licenses; [ gpl2Plus cc-by-40 ];
+    maintainers = with maintainers; [ samueldr ];
+  };
+}

pkgs/applications/plasma-mobile/spacebar.nix

···
 , kirigami2
 , knotifications
 , kpeople
+, libphonenumber
 , libqofono
+, protobuf
 , telepathy
 }:
 
···
     kirigami2
     knotifications
     kpeople
+    libphonenumber
     libqofono
+    protobuf # Needed by libphonenumber
     telepathy
   ];
 

pkgs/applications/plasma-mobile/srcs.nix

···
 # DO NOT EDIT! This file is generated automatically.
-# Command: ./maintainers/scripts/fetch-kde-qt.sh pkgs/applications/plasma-mobile/
+# Command: ./maintainers/scripts/fetch-kde-qt.sh pkgs/applications/plasma-mobile
 { fetchurl, mirror }:
 
 {
   alligator = {
-    version = "21.05";
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/alligator-21.05.tar.xz";
-      sha256 = "04zgxfx2zmn1p2ap08i5sfsnrly3smip4ylr07ghkhkiyjzbv9w6";
-      name = "alligator-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/alligator-21.08.tar.xz";
+      sha256 = "1dhwfwd1v5wmx3sldpygb79kz87j13wd0arhlkm94z1whsixan0q";
+      name = "alligator-21.08.tar.xz";
     };
   };
   angelfish = {
-    version = "21.05";
+    version = "21.08";
+    src = fetchurl {
+      url = "${mirror}/stable/plasma-mobile/21.08/angelfish-21.08.tar.xz";
+      sha256 = "1gzvlha159bw767mj8lisn89592j4j4dazzfws3v4anddjh60xnh";
+      name = "angelfish-21.08.tar.xz";
+    };
+  };
+  audiotube = {
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/angelfish-21.05.tar.xz";
-      sha256 = "11jd5dwy0xa7kh5z5rc29xy3wfn20hm31908zjax4x83qqjrm075";
-      name = "angelfish-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/audiotube-21.08.tar.xz";
+      sha256 = "14h4xna9v70lmp7cfpvdnz0f5a4gwgj0q3byccmawm38xsv15v8c";
+      name = "audiotube-21.08.tar.xz";
     };
   };
   calindori = {
-    version = "21.05";
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/calindori-21.05.tar.xz";
-      sha256 = "110f9ri9r1nb6q1ybhkfxljl4q5gqxikh9z0xkzjjbxjjqfscqcj";
-      name = "calindori-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/calindori-21.08.tar.xz";
+      sha256 = "08s16a8skh02n8ygqwryxpzczj5aqr5k58aijaz2gzx45m7ym31b";
+      name = "calindori-21.08.tar.xz";
     };
   };
   kalk = {
-    version = "21.05";
+    version = "21.08";
+    src = fetchurl {
+      url = "${mirror}/stable/plasma-mobile/21.08/kalk-21.08.tar.xz";
+      sha256 = "0xzrahpz47yajalsfmpzmavxjwmr4bgljwyz2dhxdg40ryjxdy23";
+      name = "kalk-21.08.tar.xz";
+    };
+  };
+  kasts = {
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/kalk-21.05.tar.xz";
-      sha256 = "04n65hx0j9rx6b3jq69zgypi8qjd4ig3rfw7d44c3q7dgh4k451l";
-      name = "kalk-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/kasts-21.08.tar.xz";
+      sha256 = "10v6icxwv46nihzbdi0n2w71bsg7l166z7jf9rb7vf2mjh1gqavn";
+      name = "kasts-21.08.tar.xz";
     };
   };
   kclock = {
-    version = "21.05";
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/kclock-21.05.tar.xz";
-      sha256 = "0pa5hvax0y80l8yrqczh9mcknfm3z0vdq3xc35cxdiz1vc6fwqmd";
-      name = "kclock-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/kclock-21.08.tar.xz";
+      sha256 = "1zq0fxlwd7l3b6dgfqsmv1x4wvhmrjz5r0a38hbd7j7pzgyix47d";
+      name = "kclock-21.08.tar.xz";
+    };
+  };
+  keysmith = {
+    version = "21.08";
+    src = fetchurl {
+      url = "${mirror}/stable/plasma-mobile/21.08/keysmith-21.08.tar.xz";
+      sha256 = "0fa8inli7cwmb75af0mr2cflng0r6k3pd6ckih6ph7szqbpg2x90";
+      name = "keysmith-21.08.tar.xz";
     };
   };
   koko = {
-    version = "21.05";
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/koko-21.05.tar.xz";
-      sha256 = "00hnzkl8dvf15psrcfh96b8wfb3pbggd2f7xnadzcb87sbaml035";
-      name = "koko-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/koko-21.08.tar.xz";
+      sha256 = "1sqlcl871m6dlrnkkhqa3xfwix01d74d7jf94r1a3p32hqljv76p";
+      name = "koko-21.08.tar.xz";
     };
   };
   kongress = {
-    version = "21.05";
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/kongress-21.05.tar.xz";
-      sha256 = "0qxgpi04ra9crc6drgbdm9arjbvcx52pprjr1dj8acch07f6i2gs";
-      name = "kongress-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/kongress-21.08.tar.xz";
+      sha256 = "099ds4bv4ngx21f28hxcvc17wd2nk786kydwf2h5n3mdd2mgz3ka";
+      name = "kongress-21.08.tar.xz";
     };
   };
   krecorder = {
-    version = "21.05";
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/krecorder-21.05.tar.xz";
-      sha256 = "0ydaidxx2616bixihyaagvyym1r5s9rjkgg04vq9k4608d4vnn5c";
-      name = "krecorder-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/krecorder-21.08.tar.xz";
+      sha256 = "1381x889h37saf6k875iqhwz5vbixrp7650smxp31r56ycrqq26i";
+      name = "krecorder-21.08.tar.xz";
     };
   };
   ktrip = {
-    version = "21.05";
+    version = "21.08";
+    src = fetchurl {
+      url = "${mirror}/stable/plasma-mobile/21.08/ktrip-21.08.tar.xz";
+      sha256 = "0ipxi3pqd7mznq3qjf9j9w3wyck85lxnr81ay6b3ricfb08ry68x";
+      name = "ktrip-21.08.tar.xz";
+    };
+  };
+  kweather = {
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/ktrip-21.05.tar.xz";
-      sha256 = "0hxgnncyc2ir6i9p6s9fy1r4mhxgm643pxvp8lj3j5y0c5wk2kp9";
-      name = "ktrip-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/kweather-21.08.tar.xz";
+      sha256 = "0b1zjwsakwsnh6827zjhypvb04c78gwwygr7k1cy2x3finrp5if5";
+      name = "kweather-21.08.tar.xz";
     };
   };
   plasma-dialer = {
-    version = "21.05";
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/plasma-dialer-21.05.tar.xz";
-      sha256 = "0kwkjn7ry6snc86qi1j7kcq5qa6rbyk5i7v6gqf7a7wywkk9n045";
-      name = "plasma-dialer-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/plasma-dialer-21.08.tar.xz";
+      sha256 = "14vgjg0nihhm446cfrrld1l43r50dlah5xs2ypdnm68618bdc7p1";
+      name = "plasma-dialer-21.08.tar.xz";
     };
   };
   plasma-phonebook = {
-    version = "21.05";
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/plasma-phonebook-21.05.tar.xz";
-      sha256 = "0aqqi3gvcsh4zg41zf8y0c626lwrabjchhr8pxj4n9la7y0wdvca";
-      name = "plasma-phonebook-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/plasma-phonebook-21.08.tar.xz";
+      sha256 = "09gr5mkwhayx6k6bhm29bmcvdlqqw8jj7gydh5fz40g9z98c84km";
+      name = "plasma-phonebook-21.08.tar.xz";
     };
   };
   plasma-settings = {
-    version = "21.05";
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/plasma-settings-21.05.tar.xz";
-      sha256 = "16bhx0i8gvi9ina4jxzx02xyzypyjic9646lahxvzvzmd9hn9ipi";
-      name = "plasma-settings-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/plasma-settings-21.08.tar.xz";
+      sha256 = "005v1gyrzl9b0k875p2wipja3l8l4awp8nl2d1jx7c28lqaspz2j";
+      name = "plasma-settings-21.08.tar.xz";
     };
   };
   qmlkonsole = {
-    version = "21.05";
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/qmlkonsole-21.05.tar.xz";
-      sha256 = "1ga48n09zlgvf5vvk2m26ak3ih5gjf361xxnyfprimmd7yj23han";
-      name = "qmlkonsole-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/qmlkonsole-21.08.tar.xz";
+      sha256 = "1p3ysf6sgiji86400523hm67rvw3znj3a7k6g6s83dxynxdh2faq";
+      name = "qmlkonsole-21.08.tar.xz";
     };
   };
   spacebar = {
-    version = "21.05";
+    version = "21.08";
+    src = fetchurl {
+      url = "${mirror}/stable/plasma-mobile/21.08/spacebar-21.08.tar.xz";
+      sha256 = "1cg36iys4x7p97ywilnp2lzz1ry5a1m7jz38yh2yiw6m8wvzfqff";
+      name = "spacebar-21.08.tar.xz";
+    };
+  };
+  tokodon = {
+    version = "21.08";
     src = fetchurl {
-      url = "${mirror}/stable/plasma-mobile/21.05/spacebar-21.05.tar.xz";
-      sha256 = "16lvi5yzmvk6gb5m7csk44y2jbkk7psn1lkljmj1938p2475b94c";
-      name = "spacebar-21.05.tar.xz";
+      url = "${mirror}/stable/plasma-mobile/21.08/tokodon-21.08.tar.xz";
+      sha256 = "0j9zfcdss1872hv8xxrmy0jjmcz3y5kdz8gdrd6qmig5scrzjvnf";
+      name = "tokodon-21.08.tar.xz";
     };
   };
 }

pkgs/applications/radio/freedv/default.nix

···
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, codec2
+, libsamplerate
+, libsndfile
+, lpcnetfreedv
+, portaudio
+, speexdsp
+, hamlib
+, wxGTK31-gtk3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "freedv";
+  version = "1.6.1";
+
+  src = fetchFromGitHub {
+    owner = "drowe67";
+    repo = "freedv-gui";
+    rev = "v${version}";
+    sha256 = "1dzhf944vgla9a5ilcgwivhzgdbfaknqnwbpb071a0rz8rajnv0q";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [
+    codec2
+    libsamplerate
+    libsndfile
+    lpcnetfreedv
+    portaudio
+    speexdsp
+    hamlib
+    wxGTK31-gtk3
+  ];
+
+  cmakeFlags = [
+    "-DUSE_INTERNAL_CODEC2:BOOL=FALSE"
+    "-DUSE_STATIC_DEPS:BOOL=FALSE"
+  ];
+
+  meta = with lib; {
+    homepage = "https://freedv.org/";
+    description = "Digital voice for HF radio";
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [ mvs ];
+  };
+}

pkgs/applications/radio/sdrangel/default.nix

···
 
 mkDerivation rec {
   pname = "sdrangel";
-  version = "6.16.3";
+  version = "6.17.1";
 
   src = fetchFromGitHub {
     owner = "f4exb";
     repo = "sdrangel";
     rev = "v${version}";
-    sha256 = "sha256-qgFnl9IliKRI4TptpXyK9JHzpLEUQ7NZLIfc0AROCvA=";
+    sha256 = "sha256-VWHFrgJVyI3CtLXUiG3/4/cRTD8jSdunbrro34yLKvs=";
     fetchSubmodules = false;
   };
 

pkgs/applications/version-management/gitoxide/default.nix

···
-{ lib, stdenv, rustPlatform, cmake, fetchFromGitHub, pkg-config, openssl
-, libiconv, Security, SystemConfiguration }:
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, cmake
+, pkg-config
+, stdenv
+, libiconv
+, Security
+, SystemConfiguration
+, openssl
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "gitoxide";
-  version = "0.8.4";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "gitoxide";
     rev = "v${version}";
-    sha256 = "WH8YiW1X7TkURjncm0OefxrZhnhGHaGLwxRNxe17g/0=";
+    sha256 = "sha256-c29gmmkIOyS+HNq2kv53yq+sdEDmQbSmcvVGcd55/hk=";
   };
 
-  cargoSha256 = "eTPJMYl9m81o4PJKfpDs61KmehSvKnY+bgybEodOhAM=";
+  cargoSha256 = "sha256-oc7XpiOZj4bfqdwrEHj/CzNtWzYWFkgMJOySJNgxAGQ=";
 
   nativeBuildInputs = [ cmake pkg-config ];
   buildInputs = if stdenv.isDarwin
-    then [ libiconv Security SystemConfiguration]
+    then [ libiconv Security SystemConfiguration ]
     else [ openssl ];
 
   # Needed to get openssl-sys to use pkg-config.
···
   meta = with lib; {
     description = "A command-line application for interacting with git repositories";
     homepage = "https://github.com/Byron/gitoxide";
+    changelog = "https://github.com/Byron/gitoxide/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit /* or */ asl20 ];
-    maintainers = [ maintainers.syberant ];
+    maintainers = with maintainers; [ syberant ];
   };
 }

pkgs/development/compilers/crystal/default.nix

···
   };
 
   crystal_1_2 = generic {
-    version = "1.2.0";
-    sha256 = "sha256-38mmsolzmCnv+MFUMc+AEiklDLBHIr/jqXMLzc0nVq4=";
+    version = "1.2.1";
+    sha256 = "sha256-jyNmY3n+u8WoVqHY8B5H9Vr9Ix3RogCtm8irkXZ3aek=";
     binary = crystal_1_1;
   };
 

pkgs/development/libraries/kweathercore/default.nix

···
+{ mkDerivation
+, lib
+, fetchFromGitLab
+, extra-cmake-modules
+, ki18n
+, qtlocation
+}:
+
+mkDerivation rec {
+  pname = "kweathercore";
+  version = "0.5";
+
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "libraries";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "08ipabskhsbspkzzdlpwl89r070q8d0vc9500ma6d5i9fnpmkz6d";
+  };
+
+  buildInputs = [
+    ki18n
+    qtlocation
+  ];
+
+  nativeBuildInputs = [ extra-cmake-modules ];
+
+  meta = with lib; {
+    license = [ licenses.cc0 ];
+    maintainers = [ maintainers.samueldr ];
+    description = ''
+      Library to facilitate retrieval of weather information including forecasts and alerts
+    '';
+  };
+}

pkgs/development/libraries/lpcnetfreedv/default.nix

···
+{ lib, stdenv, fetchFromGitHub, fetchurl, cmake, codec2 }:
+
+let
+  dataVersion = "191005_v1.0";
+  data = fetchurl {
+    url = "http://rowetel.com/downloads/deep/lpcnet_${dataVersion}.tgz";
+    sha256 = "1j1695hm2pg6ri611f9kr3spm4yxvpikws55z9zxizai8y94152h";
+  };
+in stdenv.mkDerivation rec {
+  pname = "lpcnetfreedv";
+  version = "unstable-2021-06-29";
+
+  src = fetchFromGitHub {
+    owner = "drowe67";
+    repo = "LPCNet";
+    rev = "0dc5935bbf49ff3ba3c9654cc2f802838ebbaead";
+    sha256 = "0r6488z40fkar11ync8achpg5l6qz7y7cbh7cs3b3w4fsxn58q9i";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ codec2 ];
+
+  postPatch = ''
+    mkdir build
+    ln -s ${data} build/lpcnet_${dataVersion}.tgz
+  '';
+
+  meta = with lib; {
+    homepage = "https://freedv.org/";
+    description = "Experimental Neural Net speech coding for FreeDV";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ mvs ];
+  };
+}

pkgs/development/libraries/pulseaudio-qt/default.nix

···
 
 mkDerivation rec {
   pname = "pulseaudio-qt";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${pname}-${lib.versions.majorMinor version}.tar.xz";
-    sha256 = "1i0ql68kxv9jxs24rsd3s7jhjid3f2fq56fj4wbp16zb4wd14099";
+    sha256 = "1i4yb0v1mmhih8c2i61hybg6q60qys3pc5wbjb7a0vwl1mihgsxw";
   };
 
   buildInputs = [

pkgs/development/tools/delve/default.nix

···
 
 buildGoPackage rec {
   pname = "delve";
-  version = "1.7.1";
+  version = "1.7.2";
 
   goPackagePath = "github.com/go-delve/delve";
   excludedPackages = "\\(_fixtures\\|scripts\\|service/test\\)";
···
     owner = "go-delve";
     repo = "delve";
     rev = "v${version}";
-    sha256 = "sha256-dnmV7LZjq86AwLWXfWBGm1pmFM0uipv1FwR6EhV8CZQ=";
+    sha256 = "sha256-Mye8Gh73yQ1fhjVpEOKBQGjdOzgMUqzdNiBjRRTteTg=";
   };
 
   subPackages = [ "cmd/dlv" ];
···
     # fortify source breaks build since delve compiles with -O0
     wrapProgram $out/bin/dlv \
       --prefix disableHardening " " fortify
+
+    # add symlink for vscode golang extension
+    # https://github.com/golang/vscode-go/blob/master/docs/debugging.md#manually-installing-dlv-dap
+    ln $out/bin/dlv $out/bin/dlv-dap
   '';
 
   meta = with lib; {
     description = "debugger for the Go programming language";
     homepage = "https://github.com/derekparker/delve";
-    maintainers = with maintainers; [ vdemeester ];
+    maintainers = with maintainers; [ SuperSandro2000 vdemeester ];
     license = licenses.mit;
     platforms = [ "x86_64-linux" ] ++ platforms.darwin;
   };

pkgs/development/tools/qtcreator/default.nix

···
 
 mkDerivation rec {
   pname = "qtcreator";
-  version = "4.14.0";
+  version = "5.0.2";
   baseVersion = builtins.concatStringsSep "." (lib.take 2 (builtins.splitVersion version));
 
   src = fetchurl {
     url = "http://download.qt-project.org/official_releases/${pname}/${baseVersion}/${version}/qt-creator-opensource-src-${version}.tar.xz";
-    sha256 = "07i045mzwbfhwj2jlijhz9xs6ay03qs5dgcw2kzlcr79a69i0h6j";
+    sha256 = "1bf07150226da46237f26f5eaa9f090ce81ed79b9bc75e0dfa6328043e360103";
   };
 
   buildInputs = [ qtbase qtscript qtquickcontrols qtdeclarative elfutils.dev ] ++
···
   '';
 
   postInstall = ''
+    mkdir -p $out/share/applications
+    cp share/applications/org.qt-project.qtcreator.desktop $out/share/applications
     substituteInPlace $out/share/applications/org.qt-project.qtcreator.desktop \
       --replace "Exec=qtcreator" "Exec=$out/bin/qtcreator"
   '';

pkgs/games/factorio/update.py

···
     for system in SYSTEMS:
         for release_type in RELEASE_TYPES:
             for release_channel in RELEASE_CHANNELS:
-                version = factorio_versions[release_channel.name][release_type.name]
+                version = factorio_versions[release_channel.name].get(release_type.name)
+                if version == None:
+                    continue
                 this_release = {
                     "name":         f"factorio_{release_type.name}_{system.tar_name}-{version}.tar.xz",
                     "url":          f"https://factorio.com/get-download/{version}/{release_type.name}/{system.url_name}",

pkgs/games/factorio/versions.json

···
   "x86_64-linux": {
     "alpha": {
       "experimental": {
-        "name": "factorio_alpha_x64-1.1.39.tar.xz",
+        "name": "factorio_alpha_x64-1.1.42.tar.xz",
         "needsAuth": true,
-        "sha256": "1wyvk0niyppg7h9ayfsiy6x309bjwsbgf62nah13aps89jk8n1pc",
+        "sha256": "08h2pxzsk7sigjqnqm1jxya3i9i5g2mgl378gmbp2jcy2mnn4dvm",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.39/alpha/linux64",
-        "version": "1.1.39"
+        "url": "https://factorio.com/get-download/1.1.42/alpha/linux64",
+        "version": "1.1.42"
       },
       "stable": {
-        "name": "factorio_alpha_x64-1.1.38.tar.xz",
+        "name": "factorio_alpha_x64-1.1.42.tar.xz",
         "needsAuth": true,
-        "sha256": "0cjhfyz4j06yn08n239ajjjpgykh39hzifhmd0ygr5szw9gdc851",
+        "sha256": "08h2pxzsk7sigjqnqm1jxya3i9i5g2mgl378gmbp2jcy2mnn4dvm",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.38/alpha/linux64",
-        "version": "1.1.38"
+        "url": "https://factorio.com/get-download/1.1.42/alpha/linux64",
+        "version": "1.1.42"
       }
     },
     "demo": {
-      "experimental": {
-        "name": "factorio_demo_x64-1.1.37.tar.xz",
-        "needsAuth": false,
-        "sha256": "06qwx9wd3990d3256y9y5qsxa0936076jgwhinmrlvjp9lxwl4ly",
-        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.37/demo/linux64",
-        "version": "1.1.37"
-      },
       "stable": {
-        "name": "factorio_demo_x64-1.1.38.tar.xz",
+        "name": "factorio_demo_x64-1.1.42.tar.xz",
         "needsAuth": false,
-        "sha256": "0y53w01dyfmavw1yxbjqjiirmvw32bnf9bqz0isnd72dvkg0kziv",
+        "sha256": "155m1ijdbc7szhpdw8f8g82ysd7av9zb6llqq4z96nn834px9m2d",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.38/demo/linux64",
-        "version": "1.1.38"
+        "url": "https://factorio.com/get-download/1.1.42/demo/linux64",
+        "version": "1.1.42"
       }
     },
     "headless": {
       "experimental": {
-        "name": "factorio_headless_x64-1.1.39.tar.xz",
+        "name": "factorio_headless_x64-1.1.42.tar.xz",
         "needsAuth": false,
-        "sha256": "06figqmyd5bgwhpppziag4hs7x3ixr7wd8186cza3ly57bibha2m",
+        "sha256": "1l217fcjcwfi0g5dilsi703cl0wyxsqdqn422hwdbp2ql839k422",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.39/headless/linux64",
-        "version": "1.1.39"
+        "url": "https://factorio.com/get-download/1.1.42/headless/linux64",
+        "version": "1.1.42"
       },
       "stable": {
-        "name": "factorio_headless_x64-1.1.38.tar.xz",
+        "name": "factorio_headless_x64-1.1.42.tar.xz",
         "needsAuth": false,
-        "sha256": "1c929pa9ifz0cvmx9k5yd267hjd5p7fdbln0czl3dq1vlskk1w71",
+        "sha256": "1l217fcjcwfi0g5dilsi703cl0wyxsqdqn422hwdbp2ql839k422",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/1.1.38/headless/linux64",
-        "version": "1.1.38"
+        "url": "https://factorio.com/get-download/1.1.42/headless/linux64",
+        "version": "1.1.42"
       }
     }
   }

pkgs/servers/hqplayerd/default.nix

···
 { stdenv
 , alsa-lib
+, addOpenGLRunpath
 , autoPatchelfHook
 , cairo
 , fetchurl
···
     ${rpmextract}/bin/rpmextract $src
   '';
 
-  nativeBuildInputs = [ autoPatchelfHook rpmextract ];
+  nativeBuildInputs = [ addOpenGLRunpath autoPatchelfHook rpmextract ];
 
   buildInputs = [
     alsa-lib
···
       --replace "NetworkManager-wait-online.service" ""
   '';
 
-  postFixup = ''
-    patchelf --replace-needed libomp.so.5 libomp.so $out/bin/hqplayerd
+  # NB: addOpenGLRunpath needs to run _after_ autoPatchelfHook, which runs in
+  # postFixup, so we tack it on here.
+  doInstallCheck = true;
+  installCheckPhase = ''
+    addOpenGLRunpath $out/bin/hqplayerd
+    $out/bin/hqplayerd --version
   '';
 
   meta = with lib; {

pkgs/servers/sql/postgresql/packages.nix

···
 self: super: {
 
-    age = super.callPackage ./ext/age.nix {
-      bison = self.bison_3_5;
-    };
+    age = super.callPackage ./ext/age.nix { };
 
     periods = super.callPackage ./ext/periods.nix { };
 

pkgs/servers/web-apps/discourse/default.nix

···
 
       # Make sure the notification email setting applies
       ./notification_email.patch
+
+      # Change the path to the public directory reported by Discourse
+      # to its real path instead of the symlink in the store, since
+      # the store path won't be matched by any nginx rules
+      ./public_dir_path.patch
     ];
 
     postPatch = ''

pkgs/servers/web-apps/discourse/public_dir_path.patch

···
+diff --git a/lib/file_store/local_store.rb b/lib/file_store/local_store.rb
+index 25649532c0..614e062dc1 100644
+--- a/lib/file_store/local_store.rb
++++ b/lib/file_store/local_store.rb
+@@ -88,7 +88,7 @@ module FileStore
+     end
+ 
+     def public_dir
+-      File.join(Rails.root, "public")
++      "/run/discourse/public"
+     end
+ 
+     def tombstone_dir

pkgs/tools/misc/ethtool/default.nix

···
-{ lib, stdenv, fetchurl, pkg-config, libmnl }:
+{ lib
+, stdenv
+, fetchurl
+, libmnl
+, pkg-config
+}:
 
 stdenv.mkDerivation rec {
   pname = "ethtool";
-  version = "5.13";
+  version = "5.14";
 
   src = fetchurl {
     url = "mirror://kernel/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1wwcwiav0fbl75axmx8wms4xfdp1ji5c7j49k4yl8bngqra74fp6";
+    sha256 = "sha256-uxPbkZFcrNekkrZbZd8Hpn5Ll03b6vdiBbGUWiPSdoY=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ libmnl ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libmnl
+  ];
 
   meta = with lib; {
     description = "Utility for controlling network drivers and hardware";
     homepage = "https://www.kernel.org/pub/software/network/ethtool/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
     platforms = platforms.linux;
-    maintainers = [ maintainers.bjornfor ];
+    maintainers = with maintainers; [ bjornfor ];
   };
 }

pkgs/tools/security/keysmith/default.nix

···
-{ lib
-, mkDerivation
-, makeWrapper
-, fetchFromGitHub
-, cmake
-, extra-cmake-modules
-, qtbase
-, qtquickcontrols2
-, qtdeclarative
-, qtgraphicaleffects
-, kirigami2
-, oathToolkit
-, ki18n
-, libsodium
-}:
-mkDerivation rec {
-
-  pname = "keysmith";
-  version = "0.2";
-
-  src = fetchFromGitHub {
-    owner = "KDE";
-    repo = "keysmith";
-    rev = "v${version}";
-    sha256 = "1gvzw23mly8cp7ag3xpbngpid9gqrfj8cyv9dar6i9j660bh03km";
-  };
-
-  nativeBuildInputs = [ cmake extra-cmake-modules makeWrapper ];
-
-  buildInputs = [ libsodium ki18n oathToolkit kirigami2 qtquickcontrols2 qtbase ];
-  propagatedBuildInput = [ oathToolkit ];
-
-  meta = with lib; {
-    description = "OTP client for Plasma Mobile and Desktop";
-    license = licenses.gpl3;
-    homepage = "https://github.com/KDE/keysmith";
-    maintainers = with maintainers; [ shamilton ];
-    platforms = platforms.linux;
-  };
-}

pkgs/tools/text/anewer/default.nix

···
+{ lib, rustPlatform, fetchFromGitHub }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "anewer";
+  version = "0.1.6";
+
+  src = fetchFromGitHub {
+    owner = "ysf";
+    repo = pname;
+    rev = version;
+    sha256 = "181mi674354bddnq894yyq587w7skjh35vn61i41vfi6lqz5dy3d";
+  };
+
+  cargoSha256 = "sha256-LJ0l5CZM5NqdbCZe4ELkYf9EkKyBxL/LrNmFy+JS6gM=";
+
+  meta = with lib; {
+    description = "Append lines from stdin to a file if they don't already exist in the file";
+    homepage = "https://github.com/ysf/anewer";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}

pkgs/top-level/aliases.nix

···
   aminal = throw "aminal was renamed to darktile."; # added 2021-09-28
   ammonite-repl = ammonite; # added 2017-05-02
   amsn = throw "amsn has been removed due to being unmaintained."; # added 2020-12-09
+  angelfish = libsForQt5.plasmaMobileGear.angelfish; # added 2021-10-06
   antimicro = throw "antimicro has been removed as it was broken, see antimicroX instead."; # added 2020-08-06
   arduino_core = arduino-core;  # added 2015-02-04
   ardour_5 = throw "ardour_5 has been removed. see https://github.com/NixOS/nixpkgs/issues/139549"; # added 2021-09-28
···
   keepassx2-http = keepassx-reboot; # added 2016-10-17
   kexectools = kexec-tools; # added 2021-09-03
   keybase-go = keybase;  # added 2016-08-24
+  keysmith = libsForQt5.plasmaMobileGear.keysmith; # added 2021-07-14
   kinetic-cpp-client = throw "kinetic-cpp-client has been removed from nixpkgs, as it's abandoned."; # 2020-04-28
   kicad-with-packages3d = kicad; # added 2019-11-25
   kindlegen = throw "kindlegen has been removed from nixpkgs, as it's abandoned and no longer available for download."; # 2021-03-09

pkgs/top-level/all-packages.nix

···
     stdenv = if stdenv.targetPlatform.isAarch64 then gcc10Stdenv else stdenv;
   });
 
+  anewer = callPackage ../tools/text/anewer { };
+
   angle-grinder = callPackage ../tools/text/angle-grinder {};
 
   ansifilter = callPackage ../tools/text/ansifilter {};
···
 
   lottieconverter = callPackage ../tools/misc/lottieconverter { };
 
+  lpcnetfreedv = callPackage ../development/libraries/lpcnetfreedv { };
+
   lsd = callPackage ../tools/misc/lsd { };
 
   lsdvd = callPackage ../tools/cd-dvd/lsdvd {};
···
   kcollectd = libsForQt5.callPackage ../tools/misc/kcollectd {};
 
   kea = callPackage ../tools/networking/kea { };
-
-  keysmith = libsForQt5.callPackage ../tools/security/keysmith { };
 
   ispell = callPackage ../tools/text/ispell {};
 
···
     });
   android-studio = androidStudioPackages.stable;
 
-  angelfish = libsForQt5.callPackage ../applications/networking/browsers/angelfish { };
-
   animbar = callPackage ../applications/graphics/animbar { };
 
   antfs-cli = callPackage ../applications/misc/antfs-cli {};
···
       scipy
       shiboken2;
   };
+
+  freedv = callPackage ../applications/radio/freedv { };
 
   freemind = callPackage ../applications/misc/freemind {
     jdk = jdk8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731

pkgs/top-level/qt5-packages.nix

···
 
   kquickimageedit = callPackage ../development/libraries/kquickimageedit { };
 
+  kweathercore = libsForQt5.callPackage ../development/libraries/kweathercore { };
+
   ldutils = callPackage ../development/libraries/ldutils { };
 
   libcommuni = callPackage ../development/libraries/libcommuni { };