Merge master into staging-next

nixos/modules/security/sudo.nix

···
       '';
     };
 
-    enable = mkEnableOption (mdDoc ''
-      the {command}`sudo` command, which allows non-root users to execute commands as root.
-    '');
+    enable = mkOption {
+      type = types.bool;
+      default = true;
+      description =
+        lib.mdDoc ''
+          Whether to enable the {command}`sudo` command, which
+          allows non-root users to execute commands as root.
+        '';
+    };
 
     package = mkPackageOption pkgs "sudo" { };
 

nixos/tests/sudo.nix

···
         };
 
         security.sudo = {
-          enable = true;
+          # Explicitly _not_ defining 'enable = true;' here, to check that sudo is enabled by default
+
           wheelNeedsPassword = false;
 
           extraConfig = ''

pkgs/applications/audio/qpwgraph/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qpwgraph";
-  version = "0.5.3";
+  version = "0.6.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "rncbc";
     repo = "qpwgraph";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-50KaVpNB5/CTLs2bRbXEinYM23AZxZO/ForrVPFDN8U=";
+    sha256 = "sha256-wJ+vUw16yBBFjMdJogF1nkLnAh3o2ndN9+0png8ZVJ4=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];

pkgs/applications/science/misc/root/5.nix

···
       url = "https://github.com/root-project/root/commit/c75458024082de0cc35b45505c652b8460a9e71b.patch";
       sha256 = "sha256-A5zEjQE9OGPFp/L1HUs4NIdxQMRiwbwCRNWOLN2ENrM=";
     })
+    # Backport Python 3.11 fix to v5 from v6.26
+    # https://github.com/root-project/root/commit/484deb056dacf768aba4954073b41105c431bffc
+    ./root5-python311-fix.patch
   ];
 
   # https://github.com/root-project/root/issues/13216

pkgs/applications/science/misc/root/root5-python311-fix.patch

···
+diff --git a/bindings/pyroot/src/MethodProxy.cxx b/bindings/pyroot/src/MethodProxy.cxx
+--- a/bindings/pyroot/src/MethodProxy.cxx
++++ b/bindings/pyroot/src/MethodProxy.cxx
+@@ -4,10 +4,10 @@
+ // Bindings
+ #include "PyROOT.h"
+ #include "structmember.h"    // from Python
+-#if PY_VERSION_HEX >= 0x02050000
+-#include "code.h"            // from Python
+-#else
++#if PY_VERSION_HEX < 0x02050000
+ #include "compile.h"         // from Python
++#elif PY_VERSION_HEX < 0x030b0000
++#include "code.h"            // from Python
+ #endif
+ #ifndef CO_NOFREE
+ // python2.2 does not have CO_NOFREE defined

pkgs/by-name/oa/oauth2l/package.nix

···
+{ stdenv
+, lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "oauth2l";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "oauth2l";
+    rev = "v${version}";
+    hash = "sha256-bL1bys/CBo/P9VfWc/FB8JHW/aBwC521V8DB1sFBIAA=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [ "-s" "-w" ];
+
+  # Fix tests by preventing them from writing to /homeless-shelter.
+  preCheck = "export HOME=$(mktemp -d)";
+
+  # tests fail on linux for some reason
+  doCheck = stdenv.isDarwin;
+
+  meta = with lib; {
+    description = "Simple CLI for interacting with Google API authentication";
+    homepage = "https://github.com/google/oauth2l";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ happysalada ];
+    mainProgram = "oauth2l";
+  };
+}

pkgs/development/libraries/physics/apfelgrid/default.nix

···
   meta = with lib; {
     description = "Ultra-fast theory predictions for collider observables";
     license     = licenses.mit;
-    homepage    = "http://nhartland.github.io/APFELgrid/";
+    homepage    = "https://nhartland.github.io/APFELgrid/";
     platforms   = platforms.unix;
     maintainers = with maintainers; [ veprbl ];
   };

pkgs/development/libraries/webrtc-audio-processing/default.nix

···
-{ lib, stdenv, fetchFromGitLab
+{ lib
+, stdenv
+, fetchFromGitLab
 , darwin
 , abseil-cpp
 , meson
···
     abseil-cpp
   ];
 
-  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ ApplicationServices ]);
+  buildInputs = lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ ApplicationServices Foundation ]);
 
   meta = with lib; {
     homepage = "https://www.freedesktop.org/software/pulseaudio/webrtc-audio-processing";

pkgs/development/python-modules/eigenpy/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "eigenpy";
-  version = "3.1.1";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "stack-of-tasks";
     repo = finalAttrs.pname;
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-mUwckBelFVRCXp3hspB8WRFFaLVyRsfp6XbqU8HeHvw=";
+    hash = "sha256-8UuJA96pkXXRKDzQTjoz7w8TQrS5+nfLdsT0j9/oqz0=";
   };
 
   strictDeps = true;

pkgs/development/python-modules/timetagger/default.nix

···
 
 buildPythonPackage rec {
   pname = "timetagger";
-  version = "23.9.2";
+  version = "23.11.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
···
     owner = "almarklein";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-pg4lKRsgi4SZrKYnVmMfU5hzJriRqVa3InYW9emFLy8=";
+    hash = "sha256-PPB/BTZLuHmbKmUIe5gZMAwV+TUDqXBYg6fKsokTotg=";
   };
 
   propagatedBuildInputs = [

pkgs/os-specific/linux/tomb/default.nix

···
-{ stdenv, lib, fetchFromGitHub, makeWrapper
-, gettext, zsh, pinentry, cryptsetup, gnupg, util-linux, e2fsprogs, sudo
+{ stdenv
+, lib
+, fetchFromGitHub
+, substituteAll
+, makeWrapper
+, zsh
+, coreutils
+, cryptsetup
+, e2fsprogs
+, file
+, gawk
+, getent
+, gettext
+, gnugrep
+, gnupg
+, libargon2
+, lsof
+, pinentry
+, util-linux
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "tomb";
-  version = "2.9";
+  version = "2.10";
 
   src = fetchFromGitHub {
-    owner  = "dyne";
-    repo   = "Tomb";
-    rev    = "v${version}";
-    sha256 = "0d6vmfcf4kd0p2bcljmdnyc2fmbwvar81cc472zx86r7yc3ih102";
+    owner = "dyne";
+    repo = "Tomb";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-lLxQJX0P6b6lbXEcrq45EsX9iKiayZ9XkhqgMfpN3/w=";
   };
 
-  buildInputs = [ sudo zsh pinentry ];
+  buildInputs = [ zsh pinentry ];
 
   nativeBuildInputs = [ makeWrapper ];
 
···
       --replace 'TOMBEXEC=$0' 'TOMBEXEC=tomb'
   '';
 
-  doInstallCheck = true;
-  installCheckPhase = "$out/bin/tomb -h";
-
   installPhase = ''
-    install -Dm755 tomb       $out/bin/tomb
+    install -Dm755 tomb $out/bin/tomb
     install -Dm644 doc/tomb.1 $out/share/man/man1/tomb.1
 
     wrapProgram $out/bin/tomb \
-      --prefix PATH : $out/bin:${lib.makeBinPath [ cryptsetup gettext gnupg pinentry util-linux e2fsprogs ]}
+      --prefix PATH : $out/bin:${lib.makeBinPath [
+          coreutils
+          cryptsetup
+          e2fsprogs
+          file
+          gawk
+          getent
+          gettext
+          gnugrep
+          gnupg
+          libargon2
+          lsof
+          pinentry
+          util-linux
+        ]}
   '';
 
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = with lib; {
     description = "File encryption on GNU/Linux";
-    homepage    = "https://www.dyne.org/software/tomb/";
-    license     = licenses.gpl3;
-    maintainers = with maintainers; [ peterhoeg ];
-    platforms   = platforms.linux;
+    homepage = "https://www.dyne.org/software/tomb/";
+    changelog = "https://github.com/dyne/Tomb/blob/v${version}/ChangeLog.md";
+    license = licenses.gpl3Only;
+    mainProgram = "tomb";
+    maintainers = with maintainers; [ peterhoeg anthonyroussel ];
+    platforms = platforms.linux;
   };
 }

pkgs/servers/networking/rustus/default.nix

···
 
 let
   pname = "rustus";
-  version = "0.7.4";
+  version = "0.7.6";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
···
     owner = "s3rius";
     repo = pname;
     rev = version;
-    hash = "sha256-RmtkGemFGqvDYd+om/2o4Ki3NWKjJ4/cJ0z40J+L+SY=";
+    hash = "sha256-osxdqwNUONCScFarpQV48C7CR1DVR/mCttaglqiAKPo=";
   };
 
-  cargoHash = "sha256-Ayki+hJTyaITOZhiyY8X6d5tR3+CLHZe94zJ9d/Kn4I=";
+  cargoHash = "sha256-M0mJ+9VznzHDmdKAsT3YamyG/P0JF8oPeVHaX44NWM4=";
 
   env.OPENSSL_NO_VENDOR = 1;
 

pkgs/servers/plex/raw.nix

···
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.32.6.7557-1cf77d501";
+  version = "1.32.7.7621-871adbd44";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "0ym2s425084l5lzpw9j1aqw2nc6f4l5vzizvpj1gicf4yp2dyk91";
+    sha256 = "0894hwbl05rsv80p3k0wjs1hv5jwn2zakv758kzx1dvqcmjzhy2w";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "1jqgglyzlfzq5saa21338vn2v3x25vl24x1w17j5wq30ca7nmzdr";
+    sha256 = "0r2i4y00pcd6hkrypzmgd03w4vj2hchhicgdy3zdwjmfk3aqs4jf";
   };
 
   outputs = [ "out" "basedb" ];

pkgs/tools/package-management/dnf5/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dnf5";
-  version = "5.1.6";
+  version = "5.1.7";
 
   src = fetchFromGitHub {
     owner = "rpm-software-management";
     repo = "dnf5";
     rev = finalAttrs.version;
-    hash = "sha256-yIv29mwCBk2H1HjJr2IYm/1eZU379jTNEuTuaoIu4TA=";
+    hash = "sha256-SXgl4YFWl1A3N2/IkDftvBl6Rwhnymxe8AqqaekGHTc=";
   };
 
   nativeBuildInputs = [ cmake createrepo_c gettext help2man pkg-config ];
···
     homepage = "https://github.com/rpm-software-management/dnf5";
     changelog = "https://github.com/rpm-software-management/dnf5/releases/tag/${version}";
     license = licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ malt3 ];
+    maintainers = with lib.maintainers; [ malt3 katexochen ];
     mainProgram = "dnf5";
     platforms = platforms.linux ++ platforms.darwin;
   };