Merge master into staging-next

.github/CODEOWNERS

···
 /pkgs/build-support/writers @lassulus @Profpatsch
 
 # Nixpkgs documentation
+/doc @fricklerhandwerk
 /maintainers/scripts/db-to-md.sh @jtojnar @ryantm
 /maintainers/scripts/doc @jtojnar @ryantm
 /doc/build-aux/pandoc-filters @jtojnar

doc/stdenv/stdenv.chapter.md

···
 source $stdenv/setup
 ```
 
-to let `stdenv` set up the environment (e.g., process the `buildInputs`). If you want, you can still use `stdenv`’s generic builder:
+to let `stdenv` set up the environment (e.g. by resetting `PATH` and populating it from build inputs). If you want, you can still use `stdenv`’s generic builder:
 
 ```bash
 source $stdenv/setup
···
 
 ### The fixup phase {#ssec-fixup-phase}
 
-The fixup phase performs some (Nix-specific) post-processing actions on the files installed under `$out` by the install phase. The default `fixupPhase` does the following:
+The fixup phase performs (Nix-specific) post-processing actions on the files installed under `$out` by the install phase. The default `fixupPhase` does the following:
 
 - It moves the `man/`, `doc/` and `info/` subdirectories of `$out` to `share/`.
 - It strips libraries and executables of debug information.
 - On Linux, it applies the `patchelf` command to ELF executables and libraries to remove unused directories from the `RPATH` in order to prevent unnecessary runtime dependencies.
-- It rewrites the interpreter paths of shell scripts to paths found in `PATH`. E.g., `/usr/bin/perl` will be rewritten to `/nix/store/some-perl/bin/perl` found in `PATH`.
+- It rewrites the interpreter paths of shell scripts to paths found in `PATH`. E.g., `/usr/bin/perl` will be rewritten to `/nix/store/some-perl/bin/perl` found in `PATH`. See [](#patch-shebangs.sh) for details.
 
 #### Variables controlling the fixup phase {#variables-controlling-the-fixup-phase}
 
···
 
 ##### `dontPatchShebangs` {#var-stdenv-dontPatchShebangs}
 
-If set, scripts starting with `#!` do not have their interpreter paths rewritten to paths in the Nix store.
+If set, scripts starting with `#!` do not have their interpreter paths rewritten to paths in the Nix store. See [](#patch-shebangs.sh) on how patching shebangs works.
 
 ##### `dontPruneLibtoolFiles` {#var-stdenv-dontPruneLibtoolFiles}
 
···
 
 The *existence* of setups hooks has long been documented and packages inside Nixpkgs are free to use this mechanism. Other packages, however, should not rely on these mechanisms not changing between Nixpkgs versions. Because of the existing issues with this system, there’s little benefit from mandating it be stable for any period of time.
 
-First, let’s cover some setup hooks that are part of Nixpkgs default stdenv. This means that they are run for every package built using `stdenv.mkDerivation`. Some of these are platform specific, so they may run on Linux but not Darwin or vice-versa.
+First, let’s cover some setup hooks that are part of Nixpkgs default `stdenv`. This means that they are run for every package built using `stdenv.mkDerivation` or when using a custom builder that has `source $stdenv/setup`. Some of these are platform specific, so they may run on Linux but not Darwin or vice-versa.
 
 ### `move-docs.sh` {#move-docs.sh}
 
···
 
 ### `patch-shebangs.sh` {#patch-shebangs.sh}
 
-This setup hook patches installed scripts to use the full path to the shebang interpreter. A shebang interpreter is the first commented line of a script telling the operating system which program will run the script (e.g `#!/bin/bash`). In Nix, we want an exact path to that interpreter to be used. This often replaces `/bin/sh` with a path in the Nix store.
+This setup hook patches installed scripts to add Nix store paths to their shebang interpreter as found in the build environment. The [shebang](https://en.wikipedia.org/wiki/Shebang_(Unix)) line tells a Unix-like operating system which interpreter to use to execute the script's contents.
+
+::: note
+The [generic builder][generic-builder] populates `PATH` from inputs of the derivation.
+:::
+
+[generic-builder]: https://github.com/NixOS/nixpkgs/blob/19d4f7dc485f74109bd66ef74231285ff797a823/pkgs/stdenv/generic/builder.sh
+
+#### Invocation {#patch-shebangs.sh-invocation}
+
+Multiple paths can be specified.
+
+```
+patchShebangs [--build | --host] PATH...
+```
+
+##### Flags
+
+`--build`
+: Look up commands available at build time
+
+`--host`
+: Look up commands available at run time
+
+##### Examples
+
+```sh
+patchShebangs --host /nix/store/<hash>-hello-1.0/bin
+```
+
+```sh
+patchShebangs --build configure
+```
+
+`#!/bin/sh` will be rewritten to `#!/nix/store/<hash>-some-bash/bin/sh`.
+
+`#!/usr/bin/env` gets special treatment: `#!/usr/bin/env python` is rewritten to `/nix/store/<hash>/bin/python`.
+
+Interpreter paths that point to a valid Nix store location are not changed.
+
+::: note
+A script file must be marked as executable, otherwise it will not be
+considered.
+:::
+
+This mechanism ensures that the interpreter for a given script is always found and is exactly the one specified by the build.
+
+It can be disabled by setting [`dontPatchShebangs`](#var-stdenv-dontPatchShebangs):
+
+```nix
+stdenv.mkDerivation {
+  # ...
+  dontPatchShebangs = true;
+  # ...
+}
+```
+
+The file [`patch-shebangs.sh`][patch-shebangs.sh] defines the [`patchShebangs`][patchShebangs] function. It is used to implement [`patchShebangsAuto`][patchShebangsAuto], the [setup hook](#ssec-setup-hooks) that is registered to run during the [fixup phase](#ssec-fixup-phase) by default.
+
+If you need to run `patchShebangs` at build time, it must be called explicitly within [one of the build phases](#sec-stdenv-phases).
+
+[patch-shebangs.sh]: https://github.com/NixOS/nixpkgs/blob/19d4f7dc485f74109bd66ef74231285ff797a823/pkgs/build-support/setup-hooks/patch-shebangs.sh
+[patchShebangs]: https://github.com/NixOS/nixpkgs/blob/19d4f7dc485f74109bd66ef74231285ff797a823/pkgs/build-support/setup-hooks/patch-shebangs.sh#L24-L105
+[patchShebangsAuto]: https://github.com/NixOS/nixpkgs/blob/19d4f7dc485f74109bd66ef74231285ff797a823/pkgs/build-support/setup-hooks/patch-shebangs.sh#L107-L119
 
 ### `audit-tmpdir.sh` {#audit-tmpdir.sh}
 
···
 
 [^footnote-stdenv-ignored-build-platform]: The build platform is ignored because it is a mere implementation detail of the package satisfying the dependency: As a general programming principle, dependencies are always *specified* as interfaces, not concrete implementation.
 [^footnote-stdenv-native-dependencies-in-path]: Currently, this means for native builds all dependencies are put on the `PATH`. But in the future that may not be the case for sake of matching cross: the platforms would be assumed to be unique for native and cross builds alike, so only the `depsBuild*` and `nativeBuildInputs` would be added to the `PATH`.
-[^footnote-stdenv-propagated-dependencies]: Nix itself already takes a package’s transitive dependencies into account, but this propagation ensures nixpkgs-specific infrastructure like setup hooks (mentioned above) also are run as if the propagated dependency.
+[^footnote-stdenv-propagated-dependencies]: Nix itself already takes a package’s transitive dependencies into account, but this propagation ensures nixpkgs-specific infrastructure like [setup hooks](#ssec-setup-hooks) also are run as if it were a propagated dependency.
 [^footnote-stdenv-find-inputs-location]: The `findInputs` function, currently residing in `pkgs/stdenv/generic/setup.sh`, implements the propagation logic.
 [^footnote-stdenv-sys-lib-search-path]: It clears the `sys_lib_*search_path` variables in the Libtool script to prevent Libtool from using libraries in `/usr/lib` and such.
 [^footnote-stdenv-build-time-guessing-impurity]: Eventually these will be passed building natively as well, to improve determinism: build-time guessing, as is done today, is a risk of impurity.

nixos/modules/virtualisation/proxmox-image.nix

···
       name = "proxmox-${cfg.filenameSuffix}";
       postVM = let
         # Build qemu with PVE's patch that adds support for the VMA format
-        vma = pkgs.qemu_kvm.overrideAttrs ( super: {
+        vma = pkgs.qemu_kvm.overrideAttrs ( super: rec {
+
+          # proxmox's VMA patch doesn't work with qemu 7.0 yet
+          version = "6.2.0";
+          src = pkgs.fetchurl {
+            url= "https://download.qemu.org/qemu-${version}.tar.xz";
+            hash = "sha256-aOFdjkWsVjJuC5pK+otJo9/oq6NIgiHQmMhGmLymW0U=";
+          };
+
           patches = let
-            rev = "cc707c362ea5c8d832aac270d1ffa7ac66a8908f";
-            path = "debian/patches/pve/0025-PVE-Backup-add-vma-backup-format-code.patch";
+            rev = "b37b17c286da3d32945fbee8ee4fd97a418a50db";
+            path = "debian/patches/pve/0026-PVE-Backup-add-vma-backup-format-code.patch";
             vma-patch = pkgs.fetchpatch {
-              url = "https://git.proxmox.com/?p=pve-qemu.git;a=blob_plain;hb=${rev};f=${path}";
-              sha256 = "1z467xnmfmry3pjy7p34psd5xdil9x0apnbvfz8qbj0bf9fgc8zf";
+              url = "https://git.proxmox.com/?p=pve-qemu.git;a=blob_plain;h=${rev};f=${path}";
+              hash = "sha256-siuDWDUnM9Zq0/L2Faww3ELAOUHhVIHu5RAQn6L4Atc=";
             };
-          in super.patches ++ [ vma-patch ];
+          in [ vma-patch ];
+
           buildInputs = super.buildInputs ++ [ pkgs.libuuid ];
+
         });
       in
       ''

nixos/release.nix

···
 
   );
 
+  # KVM image for proxmox in VMA format
+  proxmoxImage = forMatchingSystems [ "x86_64-linux" ] (system:
+    with import ./.. { inherit system; };
+
+    hydraJob ((import lib/eval-config.nix {
+      inherit system;
+      modules = [
+        ./modules/virtualisation/proxmox-image.nix
+      ];
+    }).config.system.build.VMA)
+  );
+
+  # LXC tarball for proxmox
+  proxmoxLXC = forMatchingSystems [ "x86_64-linux" ] (system:
+    with import ./.. { inherit system; };
+
+    hydraJob ((import lib/eval-config.nix {
+      inherit system;
+      modules = [
+        ./modules/virtualisation/proxmox-lxc.nix
+      ];
+    }).config.system.build.tarball)
+  );
 
   # A disk image that can be imported to Amazon EC2 and registered as an AMI
   amazonImage = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (system:

pkgs/applications/blockchains/exodus/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "exodus";
-  version = "22.2.25";
+  version = "22.6.17";
 
   src = fetchurl {
     url = "https://downloads.exodus.io/releases/${pname}-linux-x64-${version}.zip";
-    sha256 = "sha256-YbApI9rIk1653Hp3hsXJrxBMpaGn6Wv3WhZiQWAfPQM=";
+    sha256 = "1gllmrmc1gylw54yrgy1ggpn3kvkyxf7ydjvd5n5kvd8d9xh78ng";
   };
 
   sourceRoot = ".";

pkgs/applications/editors/neovim/neovim-remote.nix

···
     "test_escape_double_quotes_in_filenames"
   ];
 
+  doCheck = !stdenv.isDarwin;
+
   meta = with lib; {
     description = "A tool that helps controlling nvim processes from a terminal";
     homepage = "https://github.com/mhinz/neovim-remote/";

pkgs/applications/misc/albert/default.nix

···
-{ mkDerivation, lib, fetchFromGitHub, makeWrapper, qtbase,
-  qtdeclarative, qtsvg, qtx11extras, muparser, cmake, python3,
-  qtcharts }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, muparser
+, python3
+, qtbase
+, qtcharts
+, qtdeclarative
+, qtgraphicaleffects
+, qtsvg
+, qtx11extras
+, wrapQtAppsHook
+, nix-update-script
+}:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "albert";
-  version = "0.17.2";
+  version = "0.17.3";
 
   src = fetchFromGitHub {
-    owner  = "albertlauncher";
-    repo   = "albert";
-    rev    = "v${version}";
-    sha256 = "0lpp8rqx5b6rwdpcdldfdlw5327harr378wnfbc6rp3ajmlb4p7w";
+    owner = "albertlauncher";
+    repo = "albert";
+    rev = "v${version}";
+    sha256 = "sha256-UIG6yLkIcdf5IszhNPwkBcSfZe4/CyI5shK/QPOmpPE=";
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ cmake makeWrapper ];
-
-  buildInputs = [ qtbase qtdeclarative qtsvg qtx11extras muparser python3 qtcharts ];
+  nativeBuildInputs = [
+    cmake
+    wrapQtAppsHook
+  ];
 
-  # We don't have virtualbox sdk so disable plugin
-  cmakeFlags = [ "-DBUILD_VIRTUALBOX=OFF" "-DCMAKE_INSTALL_LIBDIR=libs" ];
+  buildInputs = [
+    muparser
+    python3
+    qtbase
+    qtcharts
+    qtdeclarative
+    qtgraphicaleffects
+    qtsvg
+    qtx11extras
+  ];
 
   postPatch = ''
-    sed -i "/QStringList dirs = {/a    \"$out/libs\"," \
-      src/app/main.cpp
+    find -type f -name CMakeLists.txt -exec sed -i {} -e '/INSTALL_RPATH/d' \;
+
+    sed -i src/app/main.cpp \
+      -e "/QStringList dirs = {/a    QFileInfo(\"$out/lib\").canonicalFilePath(),"
   '';
 
-  preBuild = ''
-    mkdir -p "$out/"
-    ln -s "$PWD/lib" "$out/lib"
+  postFixup = ''
+    for i in $out/{bin/.albert-wrapped,lib/albert/plugins/*.so}; do
+      patchelf $i --add-rpath $out/lib/albert
+    done
   '';
 
-  postBuild = ''
-    rm "$out/lib"
-  '';
+  passthru.updateScript = nix-update-script {
+    attrPath = pname;
+  };
 
   meta = with lib; {
-    homepage    = "https://albertlauncher.github.io/";
-    description = "Desktop agnostic launcher";
-    license     = licenses.gpl3Plus;
+    description = "A fast and flexible keyboard launcher";
+    longDescription = ''
+      Albert is a desktop agnostic launcher. Its goals are usability and beauty,
+      performance and extensibility. It is written in C++ and based on the Qt
+      framework.
+    '';
+    homepage = "https://albertlauncher.github.io";
+    changelog = "https://github.com/albertlauncher/albert/blob/${src.rev}/CHANGELOG.md";
+    license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ericsagnes synthetica ];
-    platforms   = platforms.linux;
+    platforms = platforms.linux;
   };
 }

pkgs/applications/networking/cluster/velero/default.nix

···
 
   ldflags = [
     "-s" "-w"
-    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.Version=${version}"
+    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.Version=v${version}"
     "-X github.com/vmware-tanzu/velero/pkg/buildinfo.ImageRegistry=velero"
     "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitTreeState=clean"
     "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitSHA=none"

pkgs/applications/office/qownnotes/default.nix

···
 
 mkDerivation rec {
   pname = "qownnotes";
-  version = "22.6.1";
+  version = "22.7.1";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
     # Fetch the checksum of current version with curl:
     # curl https://download.tuxfamily.org/qownnotes/src/qownnotes-<version>.tar.xz.sha256
-    sha256 = "c5b2075d42298d28f901ad2df8eb65f5a61aa59727fae9eeb1f92dac1b63d8ba";
+    sha256 = "9431a3315a533799525217e5ba03757b3c39e8259bf307c81330304f043b8b77";
   };
 
   nativeBuildInputs = [ qmake qttools ];

pkgs/applications/terminal-emulators/gnome-console/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "gnome-console";
-  version = "42.beta";
+  version = "42.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-console/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "Lq/shyAhDcwB5HqpihvGx2+xwVU2Xax7/NerFwR36DQ=";
+    sha256 = "Fae8i72047ZZ//DFK2GdxilxkPhnRp2D4wOvSzibuaM=";
   };
 
   buildInputs = [

pkgs/development/compilers/terra/default.nix

···
 , symlinkJoin, breakpointHook, cudaPackages, enableCUDA ? false }:
 
 let
-  luajitRev = "9143e86498436892cb4316550be4d45b68a61224";
+  luajitRev = "6053b04815ecbc8eec1e361ceb64e68fb8fac1b3";
   luajitBase = "LuaJIT-${luajitRev}";
   luajitArchive = "${luajitBase}.tar.gz";
   luajitSrc = fetchFromGitHub {
     owner = "LuaJIT";
     repo = "LuaJIT";
     rev = luajitRev;
-    sha256 = "1zw1yr0375d6jr5x20zvkvk76hkaqamjynbswpl604w6r6id070b";
+    sha256 = "1caxm1js877mky8hci1km3ycz2hbwpm6xbyjha72gfc7lr6pc429";
   };
 
   llvmMerged = symlinkJoin {
···
 
 in stdenv.mkDerivation rec {
   pname = "terra";
-  version = "1.0.0-beta5";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "terralang";
     repo = "terra";
-    rev = "bcc5a81649cb91aaaff33790b39c87feb5f7a4c2";
-    sha256 = "0jb147vbvix3zvrq6ln321jdxjgr6z68pdrirjp4zqmx78yqlcx3";
+    rev = "release-${version}";
+    sha256 = "07715qsc316h0mmsjifr1ja5fbp216ji70hpq665r0v5ikiqjfsv";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/gjs/default.nix

···
   ];
 in stdenv.mkDerivation rec {
   pname = "gjs";
-  version = "1.72.0";
+  version = "1.72.1";
 
   outputs = [ "out" "dev" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-PvDK9xbjkg3WH3dI9tVuR2zA/Bg1GtBUjn3xoKub3K0=";
+    sha256 = "sha256-F8Cx7D8JZnH/i/q6bku/FBmMcBPGBL/Wd6mFjaB5wKs=";
   };
 
   patches = [

pkgs/development/libraries/gnome-desktop/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "gnome-desktop";
-  version = "42.2";
+  version = "42.3";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-desktop/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-9CsU6sjRRWwr/B+8l+9q/knI3W9XeW6P1f6zkzHtVb0=";
+    sha256 = "sha256-2lBBC48Z/X53WwDR/g26Z/xeEVHe0pkVjcJd2tw/qKk=";
   };
 
   patches = [

pkgs/development/libraries/librest/1.0.nix

···
 , gi-docgen
 , glib
 , json-glib
-, libsoup
+, libsoup_3
+, libxml2
 , gobject-introspection
 , gnome
 }:
 
 stdenv.mkDerivation rec {
   pname = "rest";
-  version = "0.9.0";
+  version = "0.9.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "hbK8k0ESgTlTm1PuU/BTMxC8ljkv1kWGOgQEELgevmY=";
+    sha256 = "kmalwQ7OOD4ZPft/+we1CcwfUVIauNrXavlu0UISwuM=";
   };
 
   nativeBuildInputs = [
···
   buildInputs = [
     glib
     json-glib
-    libsoup
+    libsoup_3
+    libxml2
   ];
 
   mesonFlags = [

pkgs/development/python-modules/google-cloud-iot/default.nix

···
 
 buildPythonPackage rec {
   pname = "google-cloud-iot";
-  version = "2.5.1";
+  version = "2.6.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Y71v505bwXEV1u28WFAHs12Qx0tKY7BDjFCc+oBgZcw=";
+    sha256 = "sha256-XfF4+F4+LmRyxn8Zs3gI2RegFb3Y+uoAinEqcLeWCGM=";
   };
 
   propagatedBuildInputs = [ grpc-google-iam-v1 google-api-core libcst proto-plus ];

pkgs/development/python-modules/google-cloud-logging/default.nix

···
 
 buildPythonPackage rec {
   pname = "google-cloud-logging";
-  version = "3.1.2";
+  version = "3.2.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-PtAKi9IHb+56HcBTiA/LPJcxhIB+JA+MPAkp3XSOr38=";
+    hash = "sha256-DHFg4s1saEVhTk+IDqrmLaIM4nwjmBj72osp16YnruY=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/google-cloud-runtimeconfig/default.nix

···
 
 buildPythonPackage rec {
   pname = "google-cloud-runtimeconfig";
-  version = "0.33.1";
+  version = "0.33.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-SKinB6fiBh+oe+lb2IGMD6248DDOrG7g3kiFpMGX4BU=";
+    sha256 = "sha256-MPmyvm2FSrUzb1y5i4xl5Cqea6sxixLoZ7V1hxNi7hw=";
   };
 
   propagatedBuildInputs = [ google-api-core google-cloud-core ];

pkgs/development/tools/misc/d-spy/default.nix

···
 { stdenv
 , lib
 , desktop-file-utils
-, fetchpatch
 , fetchurl
 , glib
+, gettext
 , gtk4
 , libadwaita
 , meson
···
 
 stdenv.mkDerivation rec {
   pname = "d-spy";
-  version = "1.2.0";
+  version = "1.2.1";
 
   outputs = [ "out" "lib" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/dspy/${lib.versions.majorMinor version}/dspy-${version}.tar.xz";
-    sha256 = "XKL0z00w0va9m1OfuVq5YJyE1jzeynBxb50jc+O99tQ=";
+    sha256 = "TjnA1to687eJASJd0VEjOFe+Ihtfs62CwdsVhyNrZlI=";
   };
 
-  patches = [
-    # Remove pointless dependencies
-    # https://gitlab.gnome.org/GNOME/d-spy/-/merge_requests/6
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/d-spy/-/commit/5a0ec8d53d006e95e93c6d6e32a381eb248b12a1.patch";
-      sha256 = "jalfdAXcH8GZ50qb2peG+2841cGan4EhwN88z5Ewf+k=";
-    })
-  ];
-
   nativeBuildInputs = [
     meson
     ninja
     pkg-config
     desktop-file-utils
     wrapGAppsHook4
+    gettext
+    glib
   ];
 
   buildInputs = [

pkgs/tools/graphics/wkhtmltopdf/default.nix

···
-{ mkDerivation, lib, fetchFromGitHub, qtwebkit, qtsvg, qtxmlpatterns
-, fontconfig, freetype, libpng, zlib, libjpeg
+{ stdenv, lib, fetchFromGitHub, qtwebkit, qtsvg, qtxmlpatterns
+, fontconfig, freetype, libpng, zlib, libjpeg, wrapQtAppsHook
 , openssl, libX11, libXext, libXrender }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   version = "0.12.6";
   pname = "wkhtmltopdf";
 
···
     sha256 = "0m2zy986kzcpg0g3bvvm815ap9n5ann5f6bdy7pfj6jv482bm5mg";
   };
 
+  nativeBuildInputs = [
+    wrapQtAppsHook
+  ];
+
   buildInputs = [
     fontconfig freetype libpng zlib libjpeg openssl
     libX11 libXext libXrender
···
     for f in src/image/image.pro src/pdf/pdf.pro ; do
       substituteInPlace $f --replace '$(INSTALL_ROOT)' ""
     done
+  '';
+
+  # rewrite library path
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    install_name_tool -change libwkhtmltox.0.dylib $out/lib/libwkhtmltox.0.dylib $out/bin/wkhtmltopdf
+    install_name_tool -change libwkhtmltox.0.dylib $out/lib/libwkhtmltox.0.dylib $out/bin/wkhtmltoimage
   '';
 
   configurePhase = "qmake wkhtmltopdf.pro INSTALLBASE=$out";
···
     '';
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ jb55 ];
-    platforms = with platforms; linux;
+    platforms = platforms.unix;
   };
 }

pkgs/tools/inputmethods/remote-touchpad/default.nix

···
 
 buildGoModule rec {
   pname = "remote-touchpad";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "unrud";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-GjXcQyv55yJSAFeNNB+YeCVWav7vMGo/d1FCPoujYjA=";
+    sha256 = "sha256-A7/NLopJkIXwS5rAsf7J6tDL10kNOKCoyAj0tCTW6jQ=";
   };
 
   buildInputs = [ libX11 libXi libXt libXtst ];
   tags = [ "portal,x11" ];
 
-  vendorSha256 = "sha256-WG8OjtfVemtmHkrMg4O0oofsjtFKmIvcmCn9AYAGIrc=";
+  vendorSha256 = "sha256-UbDbUjC8R6LcYUPVWZID5dtu5tCV4NB268K6qTXYmZY=";
 
   meta = with lib; {
     description = "Control mouse and keyboard from the webbrowser of a smartphone.";