Merge remote-tracking branch 'origin/master' into staging-next

Conflicts:
nixos/doc/manual/release-notes/rl-2105.xml
pkgs/tools/security/sequoia/default.nix

maintainers/maintainer-list.nix

···
     githubId = 606000;
     name = "Gabriel Adomnicai";
   };
+  Gabriel439 = {
+    email = "[e-mail]";
+    github = "Gabriel439";
+    githubId = 1313787;
+    name = "Gabriel Gonzalez";
+  };
   gal_bolle = {
     email = "[e-mail]";
     github = "FlorentBecker";

maintainers/scripts/haskell/hydra-report.hs

···
 {-# LANGUAGE BlockArguments #-}
 {-# LANGUAGE DeriveAnyClass #-}
 {-# LANGUAGE DeriveGeneric #-}
+{-# LANGUAGE DerivingStrategies #-}
 {-# LANGUAGE DuplicateRecordFields #-}
 {-# LANGUAGE LambdaCase #-}
 {-# LANGUAGE MultiWayIf #-}
···
    encodeFile,
  )
 import Data.Foldable (Foldable (toList), foldl')
-import Data.Function ((&))
-import Data.Functor ((<&>))
 import Data.List.NonEmpty (NonEmpty, nonEmpty)
 import qualified Data.List.NonEmpty as NonEmpty
 import Data.Map.Strict (Map)
···
 import System.Environment (getArgs)
 import System.Process (readProcess)
 import Prelude hiding (id)
-import qualified Prelude
 
 newtype JobsetEvals = JobsetEvals
    { evals :: Seq Eval
···
 
 hydraEvalCommand :: FilePath
 hydraEvalCommand = "hydra-eval-jobs"
+
 hydraEvalParams :: [String]
 hydraEvalParams = ["-I", ".", "pkgs/top-level/release-haskell.nix"]
+
 handlesCommand :: FilePath
 handlesCommand = "nix-instantiate"
+
 handlesParams :: [String]
 handlesParams = ["--eval", "--strict", "--json", "-"]
+
 handlesExpression :: String
 handlesExpression = "with import ./. {}; with lib; zipAttrsWith (_: builtins.head) (mapAttrsToList (_: v: if v ? github then { \"${v.email}\" = v.github; } else {}) (import maintainers/maintainer-list.nix))"
 
-newtype Maintainers = Maintainers {maintainers :: Maybe Text} deriving (Generic, ToJSON, FromJSON)
+-- | This newtype is used to parse a Hydra job output from @hydra-eval-jobs@.
+-- The only field we are interested in is @maintainers@, which is why this
+-- is just a newtype.
+--
+-- Note that there are occassionally jobs that don't have a maintainers
+-- field, which is why this has to be @Maybe Text@.
+newtype Maintainers = Maintainers { maintainers :: Maybe Text }
+  deriving stock (Generic, Show)
+  deriving anyclass (FromJSON, ToJSON)
 
+-- | This is a 'Map' from Hydra job name to maintainer email addresses.
+--
+-- It has values similar to the following:
+--
+-- @@
+--  fromList
+--    [ ("arion.aarch64-linux", Maintainers (Just "[e-mail]"))
+--    , ("bench.x86_64-linux", Maintainers (Just ""))
+--    , ("conduit.x86_64-linux", Maintainers (Just "[e-mail], [e-mail]"))
+--    , ("lens.x86_64-darwin", Maintainers (Just "[e-mail]"))
+--    ]
+-- @@
+--
+-- Note that Hydra jobs without maintainers will have an empty string for the
+-- maintainer list.
 type HydraJobs = Map Text Maintainers
+
+-- | Map of email addresses to GitHub handles.
+-- This is built from the file @../../maintainer-list.nix@.
+--
+-- It has values similar to the following:
+--
+-- @@
+--  fromList
+--    [ ("[e-mail]", "rob22")
+--    , ("[e-mail]", "edkm")
+--    ]
+-- @@
+type EmailToGitHubHandles = Map Text Text
+
+-- | Map of Hydra jobs to maintainer GitHub handles.
+--
+-- It has values similar to the following:
+--
+-- @@
+--  fromList
+--    [ ("arion.aarch64-linux", ["rob22"])
+--    , ("conduit.x86_64-darwin", ["snoyb", "webber"])
+--    ]
+-- @@
 type MaintainerMap = Map Text (NonEmpty Text)
 
+-- | Generate a mapping of Hydra job names to maintainer GitHub handles.
 getMaintainerMap :: IO MaintainerMap
 getMaintainerMap = do
-   hydraJobs :: HydraJobs <- get hydraEvalCommand hydraEvalParams "" "Failed to decode hydra-eval-jobs output: "
-   handlesMap :: Map Text Text <- get handlesCommand handlesParams handlesExpression "Failed to decode nix output for lookup of github handles: "
-   pure $ hydraJobs & Map.mapMaybe (nonEmpty . mapMaybe (`Map.lookup` handlesMap) . Text.splitOn ", " . fromMaybe "" . maintainers)
-  where
-   get c p i e = readProcess c p i <&> \x -> either (error . (<> " Raw:'" <> take 1000 x <> "'") . (e <>)) Prelude.id . eitherDecodeStrict' . encodeUtf8 . Text.pack $ x
+   hydraJobs :: HydraJobs <-
+      readJSONProcess hydraEvalCommand hydraEvalParams "" "Failed to decode hydra-eval-jobs output: "
+   handlesMap :: EmailToGitHubHandles <-
+      readJSONProcess handlesCommand handlesParams handlesExpression "Failed to decode nix output for lookup of github handles: "
+   pure $ Map.mapMaybe (splitMaintainersToGitHubHandles handlesMap) hydraJobs
+   where
+   -- Split a comma-spearated string of Maintainers into a NonEmpty list of
+   -- GitHub handles.
+   splitMaintainersToGitHubHandles
+      :: EmailToGitHubHandles -> Maintainers -> Maybe (NonEmpty Text)
+   splitMaintainersToGitHubHandles handlesMap (Maintainers maint) =
+      nonEmpty .  mapMaybe (`Map.lookup` handlesMap) .  Text.splitOn ", " $ fromMaybe "" maint
+
+-- | Run a process that produces JSON on stdout and and decode the JSON to a
+-- data type.
+--
+-- If the JSON-decoding fails, throw the JSON-decoding error.
+readJSONProcess
+   :: FromJSON a
+   => FilePath -- ^ Filename of executable.
+   -> [String] -- ^ Arguments
+   -> String -- ^ stdin to pass to the process
+   -> String -- ^ String to prefix to JSON-decode error.
+   -> IO a
+readJSONProcess exe args input err = do
+   output <- readProcess exe args input
+   let eitherDecodedOutput = eitherDecodeStrict' . encodeUtf8 . Text.pack $ output
+   case eitherDecodedOutput of
+     Left decodeErr -> error $ err <> decodeErr <> "\nRaw: '" <> take 1000 output <> "'"
+     Right decodedOutput -> pure decodedOutput
 
 -- BuildStates are sorted by subjective importance/concerningness
-data BuildState = Failed | DependencyFailed | OutputLimitExceeded | Unknown (Maybe Int) | TimedOut | Canceled | HydraFailure | Unfinished | Success deriving (Show, Eq, Ord)
+data BuildState
+  = Failed
+  | DependencyFailed
+  | OutputLimitExceeded
+  | Unknown (Maybe Int)
+  | TimedOut
+  | Canceled
+  | HydraFailure
+  | Unfinished
+  | Success
+  deriving stock (Show, Eq, Ord)
 
 icon :: BuildState -> Text
 icon = \case
···
    printSingleRow set = "- [ ] " <> printState set <> " " <> makeJobSearchLink set (makePkgName set) <> " " <> maintainers
    makePkgName set = (if Text.null set then "" else set <> ".") <> name
    printState set = Text.intercalate " " $ map (\pf -> maybe "" (label pf) $ Map.lookup (set, pf) mapping) platforms
-   makeJobSearchLink set linkLabel= makeSearchLink evalId linkLabel (makePkgName set <> ".") -- Append '.' to the search query to prevent e.g. "hspec." matching "hspec-golden.x86_64-linux"
+   makeJobSearchLink set linkLabel= makeSearchLink evalId linkLabel (makePkgName set)
    sets = toList $ Set.fromList (fst <$> Map.keys mapping)
    platforms = toList $ Set.fromList (snd <$> Map.keys mapping)
    label pf (BuildResult s i) = "[[" <> platformIcon pf <> icon s <> "]](https://hydra.nixos.org/build/" <> showT i <> ")"

nixos/doc/manual/installation/installing-from-other-distro.xml

···
    </para>
    <para>
     You'll need <literal>nixos-generate-config</literal> and
-    <literal>nixos-install</literal> and we'll throw in some man pages and
-    <literal>nixos-enter</literal> just in case you want to chroot into your
-    NixOS partition. They are installed by default on NixOS, but you don't have
+    <literal>nixos-install</literal>, but this also makes some man pages
+    and <literal>nixos-enter</literal> available, just in case you want to chroot into your
+    NixOS partition. NixOS installs these by default, but you don't have
     NixOS yet..
    </para>
-<screen><prompt>$ </prompt>nix-env -f '&lt;nixpkgs/nixos&gt;' --arg configuration {} -iA config.system.build.{nixos-generate-config,nixos-install,nixos-enter,manual.manpages}</screen>
+   <screen><prompt>$ </prompt>nix-env -f '&lt;nixpkgs>' -iA nixos-install-tools</screen>
   </listitem>
   <listitem>
    <note>

nixos/doc/manual/release-notes/rl-2105.xml

···
      it is deprecated.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     <link xlink:href="https://libreswan.org/">Libreswan</link> has been updated
+     to version 4.4. The package now includes example configurations and manual
+     pages by default. The NixOS module has been changed to use the upstream
+     systemd units and write the configuration in the <literal>/etc/ipsec.d/
+     </literal> directory. In addition, two new options have been added to
+     specify connection policies
+     (<xref linkend="opt-services.libreswan.policies"/>)
+     and disable send/receive redirects
+     (<xref linkend="opt-services.libreswan.disableRedirects"/>).
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 

nixos/modules/services/audio/mpd.nix

···
         {
           User = "${cfg.user}";
           ExecStart = "${pkgs.mpd}/bin/mpd --no-daemon /run/mpd/mpd.conf";
-          ExecStartPre = pkgs.writeShellScript "mpd-start-pre" ''
+          ExecStartPre = pkgs.writeShellScript "mpd-start-pre" (''
             set -euo pipefail
             install -m 600 ${mpdConf} /run/mpd/mpd.conf
-            ${optionalString (cfg.credentials != [])
-            "${pkgs.replace}/bin/replace-literal -fe ${
-              concatStringsSep " -a " (imap0 (i: c: "\"{{password-${toString i}}}\" \"$(cat ${c.passwordFile})\"") cfg.credentials)
-            } /run/mpd/mpd.conf"}
-          '';
+          '' + optionalString (cfg.credentials != [])
+            (concatStringsSep "\n"
+              (imap0
+                (i: c: ''${pkgs.replace-secret}/bin/replace-secret '{{password-${toString i}}}' '${c.passwordFile}' /run/mpd/mpd.conf'')
+                cfg.credentials))
+          );
           RuntimeDirectory = "mpd";
           Type = "notify";
           LimitRTPRIO = 50;

nixos/modules/services/audio/mpdscribble.nix

···
 
   replaceSecret = secretFile: placeholder: targetFile:
     optionalString (secretFile != null) ''
-      ${pkgs.replace}/bin/replace-literal -ef ${placeholder} "$(cat ${secretFile})" ${targetFile}'';
+      ${pkgs.replace-secret}/bin/replace-secret '${placeholder}' '${secretFile}' '${targetFile}' '';
 
   preStart = pkgs.writeShellScript "mpdscribble-pre-start" ''
     cp -f "${cfgTemplate}" "${cfgFile}"

nixos/modules/services/desktops/flatpak.nix

···
   options = {
     services.flatpak = {
       enable = mkEnableOption "flatpak";
-
-      guiPackages = mkOption {
-        internal = true;
-        type = types.listOf types.package;
-        default = [];
-        example = literalExample "[ pkgs.gnome.gnome-software ]";
-        description = ''
-          Packages that provide an interface for flatpak
-          (like gnome-software) that will be automatically available
-          to all users when flatpak is enabled.
-        '';
-      };
     };
   };
 
···
       }
     ];
 
-    environment.systemPackages = [ pkgs.flatpak ] ++ cfg.guiPackages;
+    environment.systemPackages = [ pkgs.flatpak ];
 
     services.dbus.packages = [ pkgs.flatpak ];
 

nixos/modules/services/misc/gitlab.nix

···
       path = with pkgs; [
         jq
         openssl
-        replace
+        replace-secret
         git
       ];
       serviceConfig = {
···
           ${optionalString cfg.smtp.enable ''
               install -m u=rw ${smtpSettings} ${cfg.statePath}/config/initializers/smtp_settings.rb
               ${optionalString (cfg.smtp.passwordFile != null) ''
-                  smtp_password=$(<'${cfg.smtp.passwordFile}')
-                  replace-literal -e '@smtpPassword@' "$smtp_password" '${cfg.statePath}/config/initializers/smtp_settings.rb'
+                  replace-secret '@smtpPassword@' '${cfg.smtp.passwordFile}' '${cfg.statePath}/config/initializers/smtp_settings.rb'
               ''}
           ''}
 

nixos/modules/services/misc/matrix-synapse.nix

···
   ${optionalString (cfg.account_threepid_delegates.email != null) "email: ${cfg.account_threepid_delegates.email}"}
   ${optionalString (cfg.account_threepid_delegates.msisdn != null) "msisdn: ${cfg.account_threepid_delegates.msisdn}"}
 
-room_invite_state_types: ${builtins.toJSON cfg.room_invite_state_types}
+room_prejoin_state:
+  disable_default_event_types: ${boolToString cfg.room_prejoin_state.disable_default_event_types}
+  additional_event_types: ${builtins.toJSON cfg.room_prejoin_state.additional_event_types}
 ${optionalString (cfg.macaroon_secret_key != null) ''
   macaroon_secret_key: "${cfg.macaroon_secret_key}"
 ''}
···
           Delegate SMS sending to this local process (https://localhost:8090)
         '';
       };
-      room_invite_state_types = mkOption {
+      room_prejoin_state.additional_event_types = mkOption {
+        default = [];
         type = types.listOf types.str;
-        default = ["m.room.join_rules" "m.room.canonical_alias" "m.room.avatar" "m.room.name"];
         description = ''
-          A list of event types that will be included in the room_invite_state
+          Additional events to share with users who received an invite.
+        '';
+      };
+      room_prejoin_state.disable_default_event_types = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Whether to disable the default state-event types for users invited to a room.
+          These are:
+
+          <itemizedlist>
+          <listitem><para>m.room.join_rules</para></listitem>
+          <listitem><para>m.room.canonical_alias</para></listitem>
+          <listitem><para>m.room.avatar</para></listitem>
+          <listitem><para>m.room.encryption</para></listitem>
+          <listitem><para>m.room.name</para></listitem>
+          <listitem><para>m.room.create</para></listitem>
+          </itemizedlist>
         '';
       };
       macaroon_secret_key = mkOption {
···
       <nixpkgs/nixos/tests/matrix-synapse.nix>
     '')
     (mkRemovedOptionModule [ "services" "matrix-synapse" "web_client" ] "")
+    (mkRemovedOptionModule [ "services" "matrix-synapse" "room_invite_state_types" ] ''
+      You may add additional event types via
+      `services.matrix-synapse.room_prejoin_state.additional_event_types` and
+      disable the default events via
+      `services.matrix-synapse.room_prejoin_state.disable_default_event_types`.
+    '')
   ];
 
   meta.doc = ./matrix-synapse.xml;

nixos/modules/services/monitoring/grafana.nix

···
     AUTH_ANONYMOUS_ENABLED = boolToString cfg.auth.anonymous.enable;
     AUTH_ANONYMOUS_ORG_NAME = cfg.auth.anonymous.org_name;
     AUTH_ANONYMOUS_ORG_ROLE = cfg.auth.anonymous.org_role;
+    AUTH_GOOGLE_ENABLED = boolToString cfg.auth.google.enable;
+    AUTH_GOOGLE_ALLOW_SIGN_UP = boolToString cfg.auth.google.allowSignUp;
+    AUTH_GOOGLE_CLIENT_ID = cfg.auth.google.clientId;
 
     ANALYTICS_REPORTING_ENABLED = boolToString cfg.analytics.reporting.enable;
 
···
       };
     };
 
-    auth.anonymous = {
-      enable = mkOption {
-        description = "Whether to allow anonymous access.";
-        default = false;
-        type = types.bool;
+    auth = {
+      anonymous = {
+        enable = mkOption {
+          description = "Whether to allow anonymous access.";
+          default = false;
+          type = types.bool;
+        };
+        org_name = mkOption {
+          description = "Which organization to allow anonymous access to.";
+          default = "Main Org.";
+          type = types.str;
+        };
+        org_role = mkOption {
+          description = "Which role anonymous users have in the organization.";
+          default = "Viewer";
+          type = types.str;
+        };
       };
-      org_name = mkOption {
-        description = "Which organization to allow anonymous access to.";
-        default = "Main Org.";
-        type = types.str;
-      };
-      org_role = mkOption {
-        description = "Which role anonymous users have in the organization.";
-        default = "Viewer";
-        type = types.str;
+      google = {
+        enable = mkOption {
+          description = "Whether to allow Google OAuth2.";
+          default = false;
+          type = types.bool;
+        };
+        allowSignUp = mkOption {
+          description = "Whether to allow sign up with Google OAuth2.";
+          default = false;
+          type = types.bool;
+        };
+        clientId = mkOption {
+          description = "Google OAuth2 client ID.";
+          default = "";
+          type = types.str;
+        };
+        clientSecretFile = mkOption {
+          description = "Google OAuth2 client secret.";
+          default = null;
+          type = types.nullOr types.path;
+        };
       };
-
     };
 
     analytics.reporting = {
···
         QT_QPA_PLATFORM = "offscreen";
       } // mapAttrs' (n: v: nameValuePair "GF_${n}" (toString v)) envOptions;
       script = ''
+        ${optionalString (cfg.auth.google.clientSecretFile != null) ''
+          export GF_AUTH_GOOGLE_CLIENT_SECRET="$(cat ${escapeShellArg cfg.auth.google.clientSecretFile})"
+        ''}
         ${optionalString (cfg.database.passwordFile != null) ''
           export GF_DATABASE_PASSWORD="$(cat ${escapeShellArg cfg.database.passwordFile})"
         ''}

nixos/modules/services/networking/libreswan.nix

···
   libexec = "${pkgs.libreswan}/libexec/ipsec";
   ipsec = "${pkgs.libreswan}/sbin/ipsec";
 
-  trim = chars: str: let
-      nonchars = filter (x : !(elem x.value chars))
-                  (imap0 (i: v: {ind = i; value = v;}) (stringToCharacters str));
-    in
-      if length nonchars == 0 then ""
-      else substring (head nonchars).ind (add 1 (sub (last nonchars).ind (head nonchars).ind)) str;
+  trim = chars: str:
+  let
+    nonchars = filter (x : !(elem x.value chars))
+               (imap0 (i: v: {ind = i; value = v;}) (stringToCharacters str));
+  in
+    if length nonchars == 0 then ""
+    else substring (head nonchars).ind (add 1 (sub (last nonchars).ind (head nonchars).ind)) str;
   indent = str: concatStrings (concatMap (s: ["  " (trim [" " "\t"] s) "\n"]) (splitString "\n" str));
   configText = indent (toString cfg.configSetup);
   connectionText = concatStrings (mapAttrsToList (n: v:
     ''
       conn ${n}
       ${indent v}
+    '') cfg.connections);
 
-    '') cfg.connections);
-  configFile = pkgs.writeText "ipsec.conf"
+  configFile = pkgs.writeText "ipsec-nixos.conf"
     ''
       config setup
       ${configText}
···
       ${connectionText}
     '';
 
+  policyFiles = mapAttrs' (name: text:
+    { name = "ipsec.d/policies/${name}";
+      value.source = pkgs.writeText "ipsec-policy-${name}" text;
+    }) cfg.policies;
+
 in
 
 {
···
 
     services.libreswan = {
 
-      enable = mkEnableOption "libreswan ipsec service";
+      enable = mkEnableOption "Libreswan IPsec service";
 
       configSetup = mkOption {
         type = types.lines;
         default = ''
             protostack=netkey
-            nat_traversal=yes
             virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
         '';
         example = ''
             secretsfile=/root/ipsec.secrets
             protostack=netkey
-            nat_traversal=yes
             virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:25.0.0.0/8,%v4:100.64.0.0/10,%v6:fd00::/8,%v6:fe80::/10
         '';
-        description = "Options to go in the 'config setup' section of the libreswan ipsec configuration";
+        description = "Options to go in the 'config setup' section of the Libreswan IPsec configuration";
       };
 
       connections = mkOption {
         type = types.attrsOf types.lines;
         default = {};
-        example = {
-          myconnection = ''
-            auto=add
-            left=%defaultroute
-            leftid=@user
+        example = literalExample ''
+          { myconnection = '''
+              auto=add
+              left=%defaultroute
+              leftid=@user
+
+              right=my.vpn.com
+
+              ikev2=no
+              ikelifetime=8h
+            ''';
+          }
+        '';
+        description = "A set of connections to define for the Libreswan IPsec service";
+      };
+
+      policies = mkOption {
+        type = types.attrsOf types.lines;
+        default = {};
+        example = literalExample ''
+          { private-or-clear = '''
+              # Attempt opportunistic IPsec for the entire Internet
+              0.0.0.0/0
+              ::/0
+            ''';
+          }
+        '';
+        description = ''
+          A set of policies to apply to the IPsec connections.
 
-            right=my.vpn.com
+          <note><para>
+            The policy name must match the one of connection it needs to apply to.
+          </para></note>
+        '';
+      };
 
-            ikev2=no
-            ikelifetime=8h
-          '';
-        };
-        description = "A set of connections to define for the libreswan ipsec service";
+      disableRedirects = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to disable send and accept redirects for all nework interfaces.
+          See the Libreswan <link xlink:href="https://libreswan.org/wiki/FAQ#Why_is_it_recommended_to_disable_send_redirects_in_.2Fproc.2Fsys.2Fnet_.3F">
+          FAQ</link> page for why this is recommended.
+        '';
       };
+
     };
 
   };
···
 
   config = mkIf cfg.enable {
 
+    # Install package, systemd units, etc.
     environment.systemPackages = [ pkgs.libreswan pkgs.iproute2 ];
+    systemd.packages = [ pkgs.libreswan ];
+    systemd.tmpfiles.packages = [ pkgs.libreswan ];
+
+    # Install configuration files
+    environment.etc = {
+      "ipsec.secrets".source = "${pkgs.libreswan}/etc/ipsec.secrets";
+      "ipsec.conf".source = "${pkgs.libreswan}/etc/ipsec.conf";
+      "ipsec.d/01-nixos.conf".source = configFile;
+    } // policyFiles;
+
+    # Create NSS database directory
+    systemd.tmpfiles.rules = [ "d /var/lib/ipsec/nss 755 root root -" ];
 
     systemd.services.ipsec = {
       description = "Internet Key Exchange (IKE) Protocol Daemon for IPsec";
-      path = [
-        "${pkgs.libreswan}"
-        "${pkgs.iproute2}"
-        "${pkgs.procps}"
-        "${pkgs.nssTools}"
-        "${pkgs.iptables}"
-        "${pkgs.nettools}"
-      ];
-
-      wants = [ "network-online.target" ];
-      after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
-
-      serviceConfig = {
-        Type = "simple";
-        Restart = "always";
-        EnvironmentFile = "-${pkgs.libreswan}/etc/sysconfig/pluto";
-        ExecStartPre = [
-          "${libexec}/addconn --config ${configFile} --checkconfig"
-          "${libexec}/_stackmanager start"
-          "${ipsec} --checknss"
-          "${ipsec} --checknflog"
-        ];
-        ExecStart = "${libexec}/pluto --config ${configFile} --nofork \$PLUTO_OPTIONS";
-        ExecStop = "${libexec}/whack --shutdown";
-        ExecStopPost = [
-          "${pkgs.iproute2}/bin/ip xfrm policy flush"
-          "${pkgs.iproute2}/bin/ip xfrm state flush"
-          "${ipsec} --stopnflog"
-        ];
-        ExecReload = "${libexec}/whack --listen";
-      };
-
+      restartTriggers = [ configFile ] ++ mapAttrsToList (n: v: v.source) policyFiles;
+      path = with pkgs; [
+        libreswan
+        iproute2
+        procps
+        nssTools
+        iptables
+        nettools
+      ];
+      preStart = optionalString cfg.disableRedirects ''
+        # Disable send/receive redirects
+        echo 0 | tee /proc/sys/net/ipv4/conf/*/send_redirects
+        echo 0 | tee /proc/sys/net/ipv{4,6}/conf/*/accept_redirects
+      '';
     };
 
   };

nixos/modules/services/web-apps/discourse.nix

···
       ];
       path = cfg.package.runtimeDeps ++ [
         postgresqlPackage
-        pkgs.replace
+        pkgs.replace-secret
         cfg.package.rake
       ];
       environment = cfg.package.runtimeEnv // {
···
 
           mkSecretReplacement = file:
             lib.optionalString (file != null) ''
-              (
-                  password=$(<'${file}')
-                  replace-literal -fe '${file}' "$password" /run/discourse/config/discourse.conf
-              )
+              replace-secret '${file}' '${file}' /run/discourse/config/discourse.conf
             '';
         in ''
           set -o errexit -o pipefail -o nounset -o errtrace
···
                   cfg.siteSettings
                   "/run/discourse/config/nixos_site_settings.json"
               }
-              install -T -m 0400 -o discourse ${discourseConf} /run/discourse/config/discourse.conf
+              install -T -m 0600 -o discourse ${discourseConf} /run/discourse/config/discourse.conf
               ${mkSecretReplacement cfg.database.passwordFile}
               ${mkSecretReplacement cfg.mail.outgoing.passwordFile}
               ${mkSecretReplacement cfg.redis.passwordFile}
               ${mkSecretReplacement cfg.secretKeyBaseFile}
+              chmod 0400 /run/discourse/config/discourse.conf
           )
 
           discourse-rake db:migrate >>/var/log/discourse/db_migration.log

nixos/modules/services/web-apps/keycloak.nix

···
             after = databaseServices;
             bindsTo = databaseServices;
             wantedBy = [ "multi-user.target" ];
+            path = with pkgs; [
+              replace-secret
+            ];
             environment = {
               JBOSS_LOG_DIR = "/var/log/keycloak";
               JBOSS_BASE_DIR = "/run/keycloak";
···
                   install -m 0600 ${cfg.package}/standalone/configuration/*.properties /run/keycloak/configuration
                   install -T -m 0600 ${keycloakConfig} /run/keycloak/configuration/standalone.xml
 
-                  db_password="$(</run/keycloak/secrets/db_password)"
-                  ${pkgs.replace}/bin/replace-literal -fe '@db-password@' "$db_password" /run/keycloak/configuration/standalone.xml
+                  replace-secret '@db-password@' '/run/keycloak/secrets/db_password' /run/keycloak/configuration/standalone.xml
 
                   export JAVA_OPTS=-Djboss.server.config.user.dir=/run/keycloak/configuration
                   ${cfg.package}/bin/add-user-keycloak.sh -u admin -p '${cfg.initialAdminPassword}'

nixos/modules/services/x11/desktop-managers/gnome.nix

···
 
        # If gnome is installed, build vim for gtk3 too.
       nixpkgs.config.vim.gui = "gtk3";
-
-      # Install gnome-software if flatpak is enabled
-      services.flatpak.guiPackages = [
-        pkgs.gnome.gnome-software
-      ];
     })
 
     (mkIf flashbackEnabled {
···
 
     # Adapt from https://gitlab.gnome.org/GNOME/gnome-build-meta/blob/gnome-3-38/elements/core/meta-gnome-core-utilities.bst
     (mkIf serviceCfg.core-utilities.enable {
-      environment.systemPackages = (with pkgs.gnome; removePackagesByName [
-        baobab
-        cheese
-        eog
-        epiphany
-        gedit
-        gnome-calculator
-        gnome-calendar
-        gnome-characters
-        gnome-clocks
-        gnome-contacts
-        gnome-font-viewer
-        gnome-logs
-        gnome-maps
-        gnome-music
-        pkgs.gnome-photos
-        gnome-screenshot
-        gnome-system-monitor
-        gnome-weather
-        nautilus
-        pkgs.gnome-connections
-        simple-scan
-        totem
-        yelp
-      ] config.environment.gnome.excludePackages);
+      environment.systemPackages =
+        with pkgs.gnome;
+        removePackagesByName
+          ([
+            baobab
+            cheese
+            eog
+            epiphany
+            gedit
+            gnome-calculator
+            gnome-calendar
+            gnome-characters
+            gnome-clocks
+            gnome-contacts
+            gnome-font-viewer
+            gnome-logs
+            gnome-maps
+            gnome-music
+            pkgs.gnome-photos
+            gnome-screenshot
+            gnome-system-monitor
+            gnome-weather
+            nautilus
+            pkgs.gnome-connections
+            simple-scan
+            totem
+            yelp
+          ] ++ lib.optionals config.services.flatpak.enable [
+            # Since PackageKit Nix support is not there yet,
+            # only install gnome-software if flatpak is enabled.
+            gnome-software
+          ])
+          config.environment.gnome.excludePackages;
 
       # Enable default program modules
       # Since some of these have a corresponding package, we only

nixos/modules/virtualisation/qemu-guest-agent.nix

···
       systemd.services.qemu-guest-agent = {
         description = "Run the QEMU Guest Agent";
         serviceConfig = {
-          ExecStart = "${cfg.package}/bin/qemu-ga";
+          ExecStart = "${cfg.package}/bin/qemu-ga --statedir /run/qemu-ga";
           Restart = "always";
           RestartSec = 0;
+          # Runtime directory and mode
+          RuntimeDirectory = "qemu-ga";
+          RuntimeDirectoryMode = "0755";
         };
       };
     }

nixos/tests/all-tests.nix

···
   latestKernel.login = handleTest ./login.nix { latestKernel = true; };
   leaps = handleTest ./leaps.nix {};
   lidarr = handleTest ./lidarr.nix {};
+  libreswan = handleTest ./libreswan.nix {};
   lightdm = handleTest ./lightdm.nix {};
   limesurvey = handleTest ./limesurvey.nix {};
   locate = handleTest ./locate.nix {};

nixos/tests/cagebreak.nix

···
 
     hardware.opengl.enable = true;
     programs.xwayland.enable = true;
-    environment.systemPackages = [ pkgs.cagebreak pkgs.wallutils ];
+    environment.systemPackages = [ pkgs.cagebreak pkgs.wayland-utils ];
 
     virtualisation.memorySize = 1024;
     # Need to switch to a different VGA card / GPU driver than the default one (std) so that Cagebreak can launch:
···
     machine.wait_for_file("${XDG_RUNTIME_DIR}/wayland-0")
 
     with subtest("ensure wayland works with wayinfo from wallutils"):
-        print(machine.succeed("env XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR} wayinfo"))
+        print(machine.succeed("env XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR} wayland-info"))
 
     # TODO: Fix the XWayland test (log the cagebreak output to debug):
     # with subtest("ensure xwayland works with xterm"):

nixos/tests/libreswan.nix

···
+# This test sets up a host-to-host IPsec VPN between Alice and Bob, each on its
+# own network and with Eve as the only route between each other. We check that
+# Eve can eavesdrop the plaintext traffic between Alice and Bob, but once they
+# enable the secure tunnel Eve's spying becomes ineffective.
+
+import ./make-test-python.nix ({ lib, pkgs, ... }:
+
+let
+
+  # IPsec tunnel between Alice and Bob
+  tunnelConfig = {
+    services.libreswan.enable = true;
+    services.libreswan.connections.tunnel =
+      ''
+        leftid=@alice
+        left=fd::a
+        rightid=@bob
+        right=fd::b
+        authby=secret
+        auto=add
+      '';
+    environment.etc."ipsec.d/tunnel.secrets" =
+      { text = ''@alice @bob : PSK "j1JbIi9WY07rxwcNQ6nbyThKCf9DGxWOyokXIQcAQUnafsNTUJxfsxwk9WYK8fHj"'';
+        mode = "600";
+      };
+  };
+
+  # Common network setup
+  baseNetwork = {
+    # shared hosts file
+    extraHosts = lib.mkVMOverride ''
+      fd::a alice
+      fd::b bob
+      fd::e eve
+    '';
+    # remove all automatic addresses
+    useDHCP = false;
+    interfaces.eth1.ipv4.addresses = lib.mkVMOverride [];
+    interfaces.eth2.ipv4.addresses = lib.mkVMOverride [];
+    # open a port for testing
+    firewall.allowedUDPPorts = [ 1234 ];
+  };
+
+  # Adds an address and route from a to b via Eve
+  addRoute = a: b: {
+    interfaces.eth1.ipv6.addresses =
+      [ { address = a; prefixLength = 64; } ];
+    interfaces.eth1.ipv6.routes =
+      [ { address = b; prefixLength = 128; via = "fd::e"; } ];
+  };
+
+in
+
+{
+  name = "libreswan";
+  meta = with lib.maintainers; {
+    maintainers = [ rnhmjoj ];
+  };
+
+  # Our protagonist
+  nodes.alice = { ... }: {
+    virtualisation.vlans = [ 1 ];
+    networking = baseNetwork // addRoute "fd::a" "fd::b";
+  } // tunnelConfig;
+
+  # Her best friend
+  nodes.bob = { ... }: {
+    virtualisation.vlans = [ 2 ];
+    networking = baseNetwork // addRoute "fd::b" "fd::a";
+  } // tunnelConfig;
+
+  # The malicious network operator
+  nodes.eve = { ... }: {
+    virtualisation.vlans = [ 1 2 ];
+    networking = lib.mkMerge
+      [ baseNetwork
+        { interfaces.br0.ipv6.addresses =
+            [ { address = "fd::e"; prefixLength = 64; } ];
+          bridges.br0.interfaces = [ "eth1" "eth2" ];
+        }
+      ];
+    environment.systemPackages = [ pkgs.tcpdump ];
+    boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = true;
+  };
+
+  testScript =
+    ''
+      def alice_to_bob(msg: str):
+          """
+          Sends a message as Alice to Bob
+          """
+          bob.execute("nc -lu ::0 1234 >/tmp/msg &")
+          alice.sleep(1)
+          alice.succeed(f"echo '{msg}' | nc -uw 0 bob 1234")
+          bob.succeed(f"grep '{msg}' /tmp/msg")
+
+
+      def eavesdrop():
+          """
+          Starts eavesdropping on Alice and Bob
+          """
+          match = "src host alice and dst host bob"
+          eve.execute(f"tcpdump -i br0 -c 1 -Avv {match} >/tmp/log &")
+
+
+      start_all()
+
+      with subtest("Network is up"):
+          alice.wait_until_succeeds("ping -c1 bob")
+
+      with subtest("Eve can eavesdrop cleartext traffic"):
+          eavesdrop()
+          alice_to_bob("I secretly love turnip")
+          eve.sleep(1)
+          eve.succeed("grep turnip /tmp/log")
+
+      with subtest("Libreswan is ready"):
+          alice.wait_for_unit("ipsec")
+          bob.wait_for_unit("ipsec")
+          alice.succeed("ipsec verify 1>&2")
+
+      with subtest("Alice and Bob can start the tunnel"):
+          alice.execute("ipsec auto --start tunnel &")
+          bob.succeed("ipsec auto --start tunnel")
+          # apparently this is needed to "wake" the tunnel
+          bob.execute("ping -c1 alice")
+
+      with subtest("Eve no longer can eavesdrop"):
+          eavesdrop()
+          alice_to_bob("Just kidding, I actually like rhubarb")
+          eve.sleep(1)
+          eve.fail("grep rhubarb /tmp/log")
+    '';
+})

pkgs/applications/audio/gnome-podcasts/default.nix

···
 , python3
 , pkg-config
 , glib
-, cmake
 , libhandy
 , gtk3
 , appstream-glib
···
 
   buildInputs = [
     appstream-glib
-    cmake
     desktop-file-utils
     glib
     gtk3

pkgs/applications/blockchains/trezor-suite/default.nix

···
 
 let
   pname = "trezor-suite";
-  version = "21.4.1";
+  version = "21.5.1";
   name = "${pname}-${version}";
 
   suffix = {
···
 
   src = fetchurl {
     url = "https://github.com/trezor/${pname}/releases/download/v${version}/Trezor-Suite-${version}-${suffix}.AppImage";
-    sha256 = {
-      aarch64-linux = "51ea8a5210f008d13a729ac42085563b5e8b971b17ed766f84d69d76dcb2db0c";
-      x86_64-linux  = "9219168a504356152b3b807e1e7282e21952461d277596c6b82ddfe81ac2419c";
+    # sha512 hashes are obtained from latest-linux-arm64.yml and latest-linux.yml
+    sha512 = {
+      aarch64-linux = "sha512-nqwfonWySc+wBSJjC8BW9vm+v5zHbKqbbrTTRmoZdEYBJg2SthMtTULNLVpXaX9NHxr6guZnOWdBlzVk2dQkfQ==";
+      x86_64-linux  = "sha512-tfvdNXsjMe8YXJwTuujz4tKTdfsCuR/9VECF8EkcRP95YM7vuDV8dumru1jKtdiv0gaS1GT3SPEeAfmczY5jGg==";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 

pkgs/applications/graphics/krita/default.nix

···
 { mkDerivation, lib, stdenv, makeWrapper, fetchurl, cmake, extra-cmake-modules
 , karchive, kconfig, kwidgetsaddons, kcompletion, kcoreaddons
 , kguiaddons, ki18n, kitemmodels, kitemviews, kwindowsystem
-, kio, kcrash
+, kio, kcrash, breeze-icons
 , boost, libraw, fftw, eigen, exiv2, libheif, lcms2, gsl, openexr, giflib
 , openjpeg, opencolorio, vc, poppler, curl, ilmbase
 , qtmultimedia, qtx11extras, quazip
···
 
   buildInputs = [
     karchive kconfig kwidgetsaddons kcompletion kcoreaddons kguiaddons
-    ki18n kitemmodels kitemviews kwindowsystem kio kcrash
+    ki18n kitemmodels kitemviews kwindowsystem kio kcrash breeze-icons
     boost libraw fftw eigen exiv2 lcms2 gsl openexr libheif giflib
     openjpeg opencolorio poppler curl ilmbase
     qtmultimedia qtx11extras quazip

pkgs/applications/misc/megasync/default.nix

···
 , curl
 , doxygen
 , fetchFromGitHub
-, ffmpeg
+  #, ffmpeg
 , libmediainfo
 , libraw
 , libsodium
···
     c-ares
     cryptopp
     curl
-    ffmpeg
+    # temporarily disable until patched for ffmpeg 4.4
+    #ffmpeg
     libmediainfo
     libraw
     libsodium
···
     "--with-cares"
     "--with-cryptopp"
     "--with-curl"
-    "--with-ffmpeg"
+    # temporarily disable until patched for ffmpeg 4.4
+    #"--with-ffmpeg"
     "--without-freeimage" # unreferenced even when found
     "--without-readline"
     "--without-termcap"

pkgs/applications/misc/spacenav-cube-example/default.nix

···
 
   buildInputs = [ libX11 mesa_glu libspnav ];
 
-  configureFlags = [ "--disable-debug" ];
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
 
   installPhase = ''
     runHook preInstall

pkgs/applications/networking/cluster/argo/default.nix

···
 in
 buildGoModule rec {
   pname = "argo";
-  version = "3.0.3";
+  version = "3.0.4";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo";
     rev = "v${version}";
-    sha256 = "sha256-6w0FwVmzICsjWH7lE2ZnIhictNFTpo8pQ2Wvsyn925A=";
+    sha256 = "sha256-zswX6nt7AxxTMznbY4Rk0A8j2PpSNht+gbTMbDr2yuY=";
   };
 
   vendorSha256 = "sha256-YjVAoMyGKMHLGEPeOOkCKCzeWFiUsXfJIKcw5GYoljg=";

pkgs/applications/networking/instant-messengers/kdeltachat/default.nix

···
 
 mkDerivation rec {
   pname = "kdeltachat";
-  version = "unstable-2021-05-16";
+  version = "unstable-2021-05-18";
 
   src = fetchFromSourcehut {
     owner = "~link2xt";
     repo = "kdeltachat";
-    rev = "670960e18a7e9a1d994f26af27a12c73a7413c9a";
-    sha256 = "1k065pvz1p2wm1rvw4nlcmknc4z10ya4qfch5kz77bbhkf9vfw2l";
+    rev = "837336dc93b66912d48a3b7a2e8c1991b4d3650f";
+    sha256 = "17ms6dcfdz0y24285fqpmgvw391bxrkagsiiy4g5cyp8gfppkgaj";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/sniffers/etherape/default.nix

···
 popt, itstool, libxml2 }:
 
 stdenv.mkDerivation rec {
-  name = "etherape-0.9.19";
+  name = "etherape-0.9.20";
   src = fetchurl {
     url = "mirror://sourceforge/etherape/${name}.tar.gz";
-    sha256 = "0w63vg2q6if3wvy2md66in8b6cdw9q40hny5xy6yrxky58l4kmg7";
+    sha256 = "sha256-9UsQtWOXB1yYofGS4rMIF+ISWBsJKd0DBOFfqOr1n5Y=";
   };
 
   nativeBuildInputs = [ itstool pkg-config (lib.getBin libxml2) ];

pkgs/applications/science/math/bcal/default.nix

···
-{ lib, stdenv, fetchFromGitHub, python3Packages, readline, bc }:
-
-with lib;
+{ lib
+, stdenv
+, fetchFromGitHub
+, readline
+, bc
+, python3Packages
+}:
 
 stdenv.mkDerivation rec {
   pname = "bcal";
···
     sha256 = "4vR5rcbNkoEdSRNoMH9qMHP3iWFxejkVfXNiYfwbo/A=";
   };
 
-  nativeBuildInputs = [ python3Packages.pytest ];
-
   buildInputs = [ readline ];
 
+  installFlags = [ "PREFIX=$(out)" ];
+
   doCheck = true;
-  checkInputs = [ bc ];
-  checkPhase = ''
-    python3 -m pytest test.py
-  '';
+
+  checkInputs = [ bc python3Packages.pytestCheckHook ];
 
-  installFlags = [ "DESTDIR=$(out)" "PREFIX=" ];
+  pytestFlagsArray = [ "test.py" ];
 
-  meta = {
+  meta = with lib; {
     description = "Storage conversion and expression calculator";
     homepage = "https://github.com/jarun/bcal";
     license = licenses.gpl3Only;
-    platforms = [ "aarch64-linux" "x86_64-darwin" "x86_64-linux" ];
+    platforms = platforms.unix;
     maintainers = with maintainers; [ jfrankenau ];
   };
 }

pkgs/applications/science/math/pari/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "pari";
-  version = "2.11.4";
+  version = "2.13.1";
 
   src = fetchurl {
-    # Versions with current majorMinor values are at http://pari.math.u-bordeaux.fr/pub/pari/unix/${pname}-${version}.tar.gz
-    url = "https://pari.math.u-bordeaux.fr/pub/pari/OLD/${lib.versions.majorMinor version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-v8iPxPc1L0hA5uNSxy8DacvqikVAOxg0piafNwmXCxw=";
+    urls = [
+      "https://pari.math.u-bordeaux.fr/pub/pari/unix/${pname}-${version}.tar.gz"
+      # old versions are at the url below
+      "https://pari.math.u-bordeaux.fr/pub/pari/OLD/${lib.versions.majorMinor version}/${pname}-${version}.tar.gz"
+    ];
+    sha256 = "sha256-gez31wzNquIwFlz/Ynyc4uwpe48i+fQHQiedhfht/LE=";
   };
+
+  patches = [
+    # rebased version of 3edb98db78, see
+    # https://pari.math.u-bordeaux.fr/cgi-bin/bugreport.cgi?bug=2284
+    ./rnfdisc.patch
+  ];
 
   buildInputs = [
     gmp

pkgs/applications/science/math/pari/rnfdisc.patch

···
+commit 0d8a3ac970291c62b56104172418b3f2ca30927c
+Author: Bill Allombert <[e-mail]>
+Date:   Sun Mar 28 13:27:24 2021 +0200
+
+    rnfdisc_factored: remove spurious Q_primpart [#2284]
+
+diff --git a/src/basemath/base2.c b/src/basemath/base2.c
+index 7e7d0db9d..c461826f4 100644
+--- a/src/basemath/base2.c
++++ b/src/basemath/base2.c
+@@ -3582,7 +3582,7 @@ rnfdisc_factored(GEN nf, GEN pol, GEN *pd)
+ 
+   nf = checknf(nf);
+   pol = rnfdisc_get_T(nf, pol, &lim);
+-  disc = nf_to_scalar_or_basis(nf, nfX_disc(nf, Q_primpart(pol)));
++  disc = nf_to_scalar_or_basis(nf, nfX_disc(nf, pol));
+   pol = nfX_to_monic(nf, pol, NULL);
+   fa = idealfactor_partial(nf, disc, lim);
+   P = gel(fa,1); l = lg(P);
+diff --git a/src/test/32/rnf b/src/test/32/rnf
+index 1e743f415..c016dce00 100644
+--- a/src/test/32/rnf
++++ b/src/test/32/rnf
+@@ -853,9 +853,10 @@ error("inconsistent dimensions in idealtwoelt.")
+ 0
+ 0
+ 1
+-[[7361, 3786, 318, 5823; 0, 1, 0, 0; 0, 0, 1, 0; 0, 0, 0, 1], [-3, 6, -2, 0]
+-~]
+-[2, -1]
++[[433, 322, 318, 1318/17; 0, 1, 0, 12/17; 0, 0, 1, 5/17; 0, 0, 0, 1/17], [25
++/17, -12/17, 12/17, 16/17]~]
++[1, -1]
++[[12, 0, 0, 0; 0, 12, 4, 0; 0, 0, 4, 0; 0, 0, 0, 4], [6, 5, -1, 2]~]
+   ***   at top-level: rnfdedekind(nf,P,pr2,1)
+   ***                 ^-----------------------
+   *** rnfdedekind: sorry, Dedekind in the difficult case is not yet implemented.
+diff --git a/src/test/in/rnf b/src/test/in/rnf
+index 7851ae291..318d5349e 100644
+--- a/src/test/in/rnf
++++ b/src/test/in/rnf
+@@ -212,6 +212,9 @@ k = nfinit(y^4 + 10*y^2 + 17);
+ rnfdisc(k, x^2 - x + 1/Mod(y,k.pol))
+ rnfdisc(k, x^2 - x + 1/2)
+ 
++k = nfinit(y^4 - 10*y^2 + 1);
++rnfdisc(k,x^2-(y^3/2+y^2-5*y/2+1))
++
+ \\ ERRORS, keep at end of file
+ rnfdedekind(nf, P, pr2, 1)
+ rnfdedekind(nf, P)

pkgs/applications/science/math/sage/sage-src.nix

···
 
     # ignore a deprecation warning for usage of `cmp` in the attrs library in the doctests
     ./patches/ignore-cmp-deprecation.patch
+
+    # https://trac.sagemath.org/ticket/30801. this patch has
+    # positive_review but has not been merged upstream yet, so we
+    # don't use fetchSageDiff because it returns a file that contains
+    # each commit as a separate patch instead of a single diff, and
+    # some commits from the pari update branch are already in 9.3.rc5
+    # (auto-resolvable merge conflicts).
+    (fetchpatch {
+      name = "pari-2.13.1.patch";
+      url = "https://github.com/sagemath/sagetrac-mirror/compare/d6c5cd9be78cc448ee4c54bac93385b1244a234c...10a4531721d2700fd717e2b3a1364508ffd971c3.diff";
+      sha256 = "sha256-zMjRMEReoiTvmt+vvV0Ij1jtyLSLwSXBEVXqgvmq1D4=";
+    })
   ];
 
   patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;

pkgs/applications/version-management/git-and-tools/gh/default.nix

···
 
 buildGoModule rec {
   pname = "gh";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-nQc10uTb7yQoH9rlMQiexttdAnnPRGaHCrzZNqkZcIc=";
+    sha256 = "sha256-ESwgG1sMkR44KpO7k5HNR3gPBgOqIADpS6fSOqqNn2Q=";
   };
 
   vendorSha256 = "sha256-A7Bo0HQ5Z2SXY32jWCYgwvvInD3xYLSXvipzeaQTDiM=";

pkgs/applications/virtualization/podman-compose/default.nix

···
-{ lib, buildPythonApplication, fetchPypi, pyyaml }:
+{ lib, buildPythonApplication, fetchFromGitHub, pyyaml }:
 
 buildPythonApplication rec {
-  version = "0.1.5";
+  version = "0.2.0pre-2021-05-18";
   pname = "podman-compose";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1sgbc889zq127qhxa9frhswa1mid19fs5qnyzfihx648y5i968pv";
+  # "This project is still under development." -- README.md
+  #
+  # As of May 2021, the latest release (0.1.5) has fewer than half of all
+  # commits. This project seems to have no release management, so the last
+  # commit is the best one until proven otherwise.
+  src = fetchFromGitHub {
+    repo = "podman-compose";
+    owner = "containers";
+    rev = "62d2024feecf312e9591cc145f49cee9c70ab4fe";
+    sha256 = "17992imkvi6129wvajsp0iz5iicfmh53i20qy2mzz17kcz30r2pp";
   };
 
   propagatedBuildInputs = [ pyyaml ];

pkgs/applications/virtualization/runc/default.nix

···
 
 buildGoPackage rec {
   pname = "runc";
-  version = "1.0.0-rc94";
+  version = "1.0.0-rc95";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
     rev = "v${version}";
-    sha256 = "sha256-53P48jNSfC6ELpZNI30yAf7kofUsrJpNY96u0UT+ITg=";
+    sha256 = "sha256-q4sXcvJO9gyo7m0vlaMrwh7ZZHYa58FJy3GatWndS6M=";
   };
 
   goPackagePath = "github.com/opencontainers/runc";

pkgs/build-support/replace-secret/replace-secret.nix

···
+{ stdenv, lib, python3 }:
+
+stdenv.mkDerivation {
+  name = "replace-secret";
+  buildInputs = [ python3 ];
+  phases = [ "installPhase" "checkPhase" ];
+  installPhase = ''
+    install -D ${./replace-secret.py} $out/bin/replace-secret
+    patchShebangs $out
+  '';
+  doCheck = true;
+  checkPhase = ''
+    install -m 0600 ${./test/input_file} long_test
+    $out/bin/replace-secret "replace this" ${./test/passwd} long_test
+    $out/bin/replace-secret "and this" ${./test/rsa} long_test
+    diff ${./test/expected_long_output} long_test
+
+    install -m 0600 ${./test/input_file} short_test
+    $out/bin/replace-secret "replace this" <(echo "a") short_test
+    $out/bin/replace-secret "and this" <(echo "b") short_test
+    diff ${./test/expected_short_output} short_test
+  '';
+  meta = with lib; {
+    platforms = platforms.all;
+    maintainers = with maintainers; [ talyz ];
+    license = licenses.mit;
+    description = "Replace a string in one file with a secret from a second file";
+    longDescription = ''
+      Replace a string in one file with a secret from a second file.
+
+      Since the secret is read from a file, it won't be leaked through
+      '/proc/<pid>/cmdline', unlike when 'sed' or 'replace' is used.
+    '';
+  };
+}

pkgs/build-support/replace-secret/replace-secret.py

···
+#!/usr/bin/env python
+
+import argparse
+from argparse import RawDescriptionHelpFormatter
+
+description = """
+Replace a string in one file with a secret from a second file.
+
+Since the secret is read from a file, it won't be leaked through
+'/proc/<pid>/cmdline', unlike when 'sed' or 'replace' is used.
+"""
+
+parser = argparse.ArgumentParser(
+    description=description,
+    formatter_class=RawDescriptionHelpFormatter
+)
+parser.add_argument("string_to_replace", help="the string to replace")
+parser.add_argument("secret_file", help="the file containing the secret")
+parser.add_argument("file", help="the file to perform the replacement on")
+args = parser.parse_args()
+
+with open(args.secret_file) as sf, open(args.file, 'r+') as f:
+    old = f.read()
+    secret = sf.read().strip("\n")
+    new_content = old.replace(args.string_to_replace, secret)
+    f.seek(0)
+    f.write(new_content)
+    f.truncate()

pkgs/build-support/replace-secret/test/expected_long_output

···
+beginning
+middle $6$UcbJUl5g$HRMfKNKsLTfVbcQb.P5o0bmZUfHDYkWseMSuZ8F5jSIGZZcI3Jnit23f8ZeZOGi4KL86HVM9RYqrpYySOu/fl0 not this
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAzrru6v5tfwQl6L+rOUjtLo8kbhMUlCLXP7TYngSGrkzPMWe+
+0gB04UAmiPZXfBmvj5fPqYiFjIaEDHE/SD41vJB/RJKKtId2gCAIHhBLkbr+4+60
+yEbLkJci5i4kJC1dt8OKFEzXkaVnwOSgjH+0NwO3bstZ+E70zMXS9+NS71qGsIEb
+5J1TnacwW/u6CdFyakLljWOXOR14rLIpiPBBFLf+oZiepjIhlWXWHqsxZOb7zMI0
+T4W5WJ2dwGFsJ8rkYaGZ+A5qzYbi/KmHqaSPaNDsyoi7yJhAhKPByALJU916+8QO
+xOnqZxWGki3PDzCslRwW4i3mGbZlBQMnlfbN3QIDAQABAoIBAHDn1W7QkFrLmCy6
+6bf6pVdFZF8d2qJhOPAZRClhTXFKj+pqv+QPzcXr9F/fMr6bhK/G+Oqdnlq2aM4m
+16oMF+spe+impEyeo1CsreJFghBQcb9o8qFjUPBiKvROBP0hLcscZ4BYy29HSBgo
+harWYEWfqQJA251q+fYQoP0z0WrZKddOZbRRnJ0ICRxAE7IEtDT6EYt8R9oGi2j4
+/rpdW+rYGjW3TcmzdR7lpVMJRLlbMbSdR8n6cI6rnfySygcoE5tFX5t/YZSNbBPg
+GebKCbEHYNTTG8bC1qjUyzlbEQ6XYWvFO7HTKU7105XpjYTQFByeo0IVkin0o5KW
+t7eQWb0CgYEA6zZUWsYoQ13nXEU6Ky89Q9uhesMfaJ/F2X5ikQSRqRvrR3QR+ULe
+eNnCl10O9SiFpR4b5gSbLSHMffxGN60P1nEO4CiIKE+gOii8Kdk5htIJFy/dcZUc
+PuPM+zD9/6Is5sAWUZo45bnT6685h6EjM2+6zNZtx/XMjSfWbHaY+HMCgYEA4QAy
+6ZEgd6FHnNfM/q2o8XU3d6OCdhcu26u6ydnCalbSpPSKWOi6gnHK4ZnGdryXgIYw
+hRkvYINfiONkShYytotIh4YxUbgpwdvJRyKa2ZdWhcMmtFzZOcEVzQTKBasFT74C
+Wo0iybZ++XZh3M0+n7oyyx39aR7diZ+/zq6PnG8CgYB8B1QH4cHNdDDRqPd5WhmW
+NLQ7xbREOSvc+hYDnkMoxz4TmZL4u1gQpdNEeZ+visSeQvg3HGqvK8lnDaYBKdLW
+IxvS+8yAZSx6PoyqDI+XFh4RCf5dLGGOkBTAyB7Hs761lsiuEwK5sHmdJ/LQIBot
+v1bjOJb/AA/yxvT8kLUtHQKBgGIA9iwqXJv/EfRNQytDdS0HQ4vHGtJZMr3YRVoa
+kcZD3yieo4wqguLCsf4mPv4FE3CWAphW6f39+yTi9xIWLSy56nOtjdnsf7PDCh8E
+AbL5amSFJly1fKDda6OLjHt/jKa5Osk6ZIa8CP6cA/BrLfXg4rL6cyDQouqJPMDH
+5CHdAoGBAIChjbTyoYvANkoANCK4SuqLUYeiYREfiM3sqHe1xirK1PPHw03ZLITl
+ltjo9qE6kPXWcTBVckTKGFlntyCT283FC0/vMmHo8dTdtxF4/wSbkqs3ORuJ3p5J
+cNtLYGD3vgwLmg6tTur4U60XN+tYDzWGteez8J9GwTMfKJmuS9af
+-----END RSA PRIVATE KEY-----
+end

pkgs/build-support/replace-secret/test/expected_short_output

···
+beginning
+middle a not this
+b
+end

pkgs/build-support/replace-secret/test/input_file

···
+beginning
+middle replace this not this
+and this
+end

pkgs/build-support/replace-secret/test/passwd

···
+$6$UcbJUl5g$HRMfKNKsLTfVbcQb.P5o0bmZUfHDYkWseMSuZ8F5jSIGZZcI3Jnit23f8ZeZOGi4KL86HVM9RYqrpYySOu/fl0

pkgs/build-support/replace-secret/test/rsa

···
+-----BEGIN RSA PRIVATE KEY-----
+MIIEowIBAAKCAQEAzrru6v5tfwQl6L+rOUjtLo8kbhMUlCLXP7TYngSGrkzPMWe+
+0gB04UAmiPZXfBmvj5fPqYiFjIaEDHE/SD41vJB/RJKKtId2gCAIHhBLkbr+4+60
+yEbLkJci5i4kJC1dt8OKFEzXkaVnwOSgjH+0NwO3bstZ+E70zMXS9+NS71qGsIEb
+5J1TnacwW/u6CdFyakLljWOXOR14rLIpiPBBFLf+oZiepjIhlWXWHqsxZOb7zMI0
+T4W5WJ2dwGFsJ8rkYaGZ+A5qzYbi/KmHqaSPaNDsyoi7yJhAhKPByALJU916+8QO
+xOnqZxWGki3PDzCslRwW4i3mGbZlBQMnlfbN3QIDAQABAoIBAHDn1W7QkFrLmCy6
+6bf6pVdFZF8d2qJhOPAZRClhTXFKj+pqv+QPzcXr9F/fMr6bhK/G+Oqdnlq2aM4m
+16oMF+spe+impEyeo1CsreJFghBQcb9o8qFjUPBiKvROBP0hLcscZ4BYy29HSBgo
+harWYEWfqQJA251q+fYQoP0z0WrZKddOZbRRnJ0ICRxAE7IEtDT6EYt8R9oGi2j4
+/rpdW+rYGjW3TcmzdR7lpVMJRLlbMbSdR8n6cI6rnfySygcoE5tFX5t/YZSNbBPg
+GebKCbEHYNTTG8bC1qjUyzlbEQ6XYWvFO7HTKU7105XpjYTQFByeo0IVkin0o5KW
+t7eQWb0CgYEA6zZUWsYoQ13nXEU6Ky89Q9uhesMfaJ/F2X5ikQSRqRvrR3QR+ULe
+eNnCl10O9SiFpR4b5gSbLSHMffxGN60P1nEO4CiIKE+gOii8Kdk5htIJFy/dcZUc
+PuPM+zD9/6Is5sAWUZo45bnT6685h6EjM2+6zNZtx/XMjSfWbHaY+HMCgYEA4QAy
+6ZEgd6FHnNfM/q2o8XU3d6OCdhcu26u6ydnCalbSpPSKWOi6gnHK4ZnGdryXgIYw
+hRkvYINfiONkShYytotIh4YxUbgpwdvJRyKa2ZdWhcMmtFzZOcEVzQTKBasFT74C
+Wo0iybZ++XZh3M0+n7oyyx39aR7diZ+/zq6PnG8CgYB8B1QH4cHNdDDRqPd5WhmW
+NLQ7xbREOSvc+hYDnkMoxz4TmZL4u1gQpdNEeZ+visSeQvg3HGqvK8lnDaYBKdLW
+IxvS+8yAZSx6PoyqDI+XFh4RCf5dLGGOkBTAyB7Hs761lsiuEwK5sHmdJ/LQIBot
+v1bjOJb/AA/yxvT8kLUtHQKBgGIA9iwqXJv/EfRNQytDdS0HQ4vHGtJZMr3YRVoa
+kcZD3yieo4wqguLCsf4mPv4FE3CWAphW6f39+yTi9xIWLSy56nOtjdnsf7PDCh8E
+AbL5amSFJly1fKDda6OLjHt/jKa5Osk6ZIa8CP6cA/BrLfXg4rL6cyDQouqJPMDH
+5CHdAoGBAIChjbTyoYvANkoANCK4SuqLUYeiYREfiM3sqHe1xirK1PPHw03ZLITl
+ltjo9qE6kPXWcTBVckTKGFlntyCT283FC0/vMmHo8dTdtxF4/wSbkqs3ORuJ3p5J
+cNtLYGD3vgwLmg6tTur4U60XN+tYDzWGteez8J9GwTMfKJmuS9af
+-----END RSA PRIVATE KEY-----

pkgs/build-support/trivial-builders/test.nix

···
-{ lib, nixosTest, path, writeText, hello, figlet, stdenvNoCC }:
+{ lib, nixosTest, pkgs, writeText, hello, figlet, stdenvNoCC }:
 
+# -------------------------------------------------------------------------- #
+#
+#                         trivial-builders test
+#
+# -------------------------------------------------------------------------- #
+#
+#  This file can be run independently (quick):
+#
+#      $ pkgs/build-support/trivial-builders/test.sh
+#
+#  or in the build sandbox with a ~20s VM overhead
+#
+#      $ nix-build -A tests.trivial-builders
+#
+# -------------------------------------------------------------------------- #
+
+let
+  invokeSamples = file:
+    lib.concatStringsSep " " (
+      lib.attrValues (import file { inherit pkgs; })
+    );
+in
 nixosTest {
   name = "nixpkgs-trivial-builders";
   nodes.machine = { ... }: {
···
     environment.etc."pre-built-paths".source = writeText "pre-built-paths" (
       builtins.toJSON [hello figlet stdenvNoCC]
     );
+    environment.variables = {
+      SAMPLE = invokeSamples ./test/sample.nix;
+      REFERENCES = invokeSamples ./test/invoke-writeReferencesToFile.nix;
+      DIRECT_REFS = invokeSamples ./test/invoke-writeDirectReferencesToFile.nix;
+    };
   };
   testScript = ''
     machine.succeed("""
-      cd ${lib.cleanSource path}
-      ./pkgs/build-support/trivial-builders/test.sh 2>/dev/console
+      ${./test.sh} 2>/dev/console
     """)
   '';
+  meta = {
+    license = lib.licenses.mit; # nixpkgs license
+    maintainers = with lib.maintainers; [
+      roberth
+    ];
+    description = "Run the Nixpkgs trivial builders tests";
+  };
 }

pkgs/build-support/trivial-builders/test.sh

···
 
 cd "$(dirname ${BASH_SOURCE[0]})"  # nixpkgs root
 
-testDirectReferences() {
-  expr="$1"
+if [[ -z ${SAMPLE:-} ]]; then
+  sample=( `nix-build test/sample.nix` )
+  directRefs=( `nix-build test/invoke-writeDirectReferencesToFile.nix` )
+  references=( `nix-build test/invoke-writeReferencesToFile.nix` )
+else
+  # Injected by Nix (to avoid evaluating in a derivation)
+  # turn them into arrays
+  sample=($SAMPLE)
+  directRefs=($DIRECT_REFS)
+  references=($REFERENCES)
+fi
+
+echo >&2 Testing direct references...
+for i in "${!sample[@]}"; do
+  echo >&2 Checking '#'$i ${sample[$i]} ${directRefs[$i]}
   diff -U3 \
-    <(sort <$(nix-build --no-out-link --expr "with import ../../.. {}; writeDirectReferencesToFile ($expr)")) \
-    <(nix-store -q --references $(nix-build --no-out-link --expr "with import ../../.. {}; ($expr)") | sort)
-}
+    <(sort <${directRefs[$i]}) \
+    <(nix-store -q --references ${sample[$i]} | sort)
+done
 
-testDirectReferences 'hello'
-testDirectReferences 'figlet'
-testDirectReferences 'writeText "hi" "hello"'
-testDirectReferences 'writeText "hi" "hello ${hello}"'
-testDirectReferences 'writeText "hi" "hello ${hello} ${figlet}"'
-
-
-
-testClosure() {
-  expr="$1"
+echo >&2 Testing closure...
+for i in "${!sample[@]}"; do
+  echo >&2 Checking '#'$i ${sample[$i]} ${references[$i]}
   diff -U3 \
-    <(sort <$(nix-build --no-out-link --expr "with import ../../.. {}; writeReferencesToFile ($expr)")) \
-    <(nix-store -q --requisites $(nix-build --no-out-link --expr "with import ../../.. {}; ($expr)") | sort)
-}
-
-testClosure 'hello'
-testClosure 'figlet'
-testClosure 'writeText "hi" "hello"'
-testClosure 'writeText "hi" "hello ${hello}"'
-testClosure 'writeText "hi" "hello ${hello} ${figlet}"'
-
+    <(sort <${references[$i]}) \
+    <(nix-store -q --requisites ${sample[$i]} | sort)
+done
 
 echo 'OK!'

pkgs/build-support/trivial-builders/test/invoke-writeDirectReferencesToFile.nix

···
+{ pkgs ? import ../../../.. { config = {}; overlays = []; } }:
+pkgs.lib.mapAttrs
+  (k: v: pkgs.writeDirectReferencesToFile v)
+  (import ./sample.nix { inherit pkgs; })

pkgs/build-support/trivial-builders/test/invoke-writeReferencesToFile.nix

···
+{ pkgs ? import ../../../.. { config = {}; overlays = []; } }:
+pkgs.lib.mapAttrs
+  (k: v: pkgs.writeReferencesToFile v)
+  (import ./sample.nix { inherit pkgs; })

pkgs/build-support/trivial-builders/test/sample.nix

···
+{ pkgs ? import ../../../.. { config = {}; overlays = []; } }:
+let
+  inherit (pkgs)
+    figlet
+    hello
+    writeText
+    ;
+in
+{
+  hello = hello;
+  figlet = figlet;
+  norefs = writeText "hi" "hello";
+  helloRef = writeText "hi" "hello ${hello}";
+  helloFigletRef = writeText "hi" "hello ${hello} ${figlet}";
+}

pkgs/data/misc/hackage/pin.json

···
 {
-  "commit": "b963dde27c24394c4be0031039dae4cb6a363aed",
-  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/b963dde27c24394c4be0031039dae4cb6a363aed.tar.gz",
-  "sha256": "1yr9j4ldpi2p2zgdq4mky6y5yh7nilasdmskapbdxp9fxwba2r0x",
-  "msg": "Update from Hackage at 2021-05-10T22:01:59Z"
+  "commit": "2295bd36e0d36af6e862dfdb7b0694fba2e7cb58",
+  "url": "https://github.com/commercialhaskell/all-cabal-hashes/archive/2295bd36e0d36af6e862dfdb7b0694fba2e7cb58.tar.gz",
+  "sha256": "1bzqy6kbw0i1ryg3ia5spg6m62zkc46xhhn0h76pfq7mfmm3fqf8",
+  "msg": "Update from Hackage at 2021-05-12T11:46:04Z"
 }

pkgs/data/themes/adwaita-qt/default.nix

···
-{ mkDerivation, lib, fetchFromGitHub, nix-update-script, cmake, ninja, qtbase, pantheon }:
+{ mkDerivation
+, stdenv
+, lib
+, fetchFromGitHub
+, nix-update-script
+, cmake
+, ninja
+, qtbase
+, qt5
+, xorg
+}:
 
 mkDerivation rec {
   pname = "adwaita-qt";
-  version = "1.1.4";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "FedoraQt";
     repo = pname;
     rev = version;
-    sha256 = "19s97wm96g3828dp8m85j3lsn1n6h5h2zqk4652hcqcgq6xb6gv5";
+    sha256 = "1fkivdiz4al84nhgg1srj33l109j9si63biw3asy339cyyzj28c9";
   };
 
   nativeBuildInputs = [
···
 
   buildInputs = [
     qtbase
+    qt5.qtx11extras
+  ] ++ lib.optionals stdenv.isLinux [
+    xorg.libxcb
   ];
 
   postPatch = ''
     # Fix plugin dir
-    substituteInPlace style/CMakeLists.txt \
+    substituteInPlace src/style/CMakeLists.txt \
        --replace "DESTINATION \"\''${QT_PLUGINS_DIR}/styles" "DESTINATION \"$qtPluginPrefix/styles"
   '';
 
···
     homepage = "https://github.com/FedoraQt/adwaita-qt";
     license = licenses.gpl2Plus;
     maintainers = teams.gnome.members ++ (with maintainers; [ ]);
-    platforms = platforms.linux;
+    platforms = platforms.all;
   };
 }

pkgs/desktops/gnome/extensions/fuzzy-app-search/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-fuzzy-app-search";
-  version = "4";
+  version = "4.0.1";
 
   src = fetchFromGitLab {
     owner = "Czarlie";
     repo = "gnome-fuzzy-app-search";
-    rev = "da9c15d39958d9c3b38df3b616fd40b85aed24e5";
-    sha256 = "1r3qha530s97x818znn1wi76f4x9bhlgi7jlxfwjnrwys62cv5fn";
+    rev = "v${version}";
+    sha256 = "127n3jc5d6cl0yrpjf8acdj76br97knks1wx4f6jcswkx9x47w0a";
   };
 
   uuid = "[e-mail]";
 
   nativeBuildInputs = [ glib ];
-
-  patches = [ ./fix-desktop-file-paths.patch ];
 
   makeFlags = [ "INSTALL_PATH=$(out)/share/gnome-shell/extensions" ];
 

pkgs/desktops/gnome/extensions/fuzzy-app-search/fix-desktop-file-paths.patch

···
-diff --git a/applicationsUtils.js b/applicationsUtils.js
-index 728223b..aa9f291 100644
---- a/applicationsUtils.js
-+++ b/applicationsUtils.js
-@@ -44,27 +44,24 @@ var Search = new Lang.Class({
-      * @return {Void}
-      */
-     _init: function () {
--        let dir = [
--            "/usr/share/applications",
--            GLib.get_home_dir() + "/.local/share/applications",
--        ];
--
--        // listen object - file/monitor list
--        this._listen = dir.map((path) => {
--            let file = Gio.File.new_for_path(path);
--            let monitor = file.monitor(Gio.FileMonitorFlags.NONE, null);
--
--            // refresh on each directory change
--            monitor.connect(
--                "changed",
--                Lang.bind(this, this._handleMonitorChanged)
--            );
--
--            return {
--                file: file,
--                monitor: monitor,
--            };
--        });
-+        this._listen = [...new Set(GLib.get_system_data_dirs())]
-+            .filter((path) => path.endsWith("/share"))
-+            .map((path) => Gio.File.new_for_path(path + "/applications"))
-+            .filter((file) => file.query_exists(null))
-+            .map((file) => {
-+                let monitor = file.monitor(Gio.FileMonitorFlags.NONE, null);
-+
-+                // refresh on each directory change
-+                monitor.connect(
-+                    "changed",
-+                    Lang.bind(this, this._handleMonitorChanged)
-+                );
-+
-+                return {
-+                    file: file,
-+                    monitor: monitor,
-+                };
-+            });
-         this._interval = null;
-         this._data = {};
- 

pkgs/development/arduino/platformio/core.nix

···
   postPatch = ''
     substitute platformio/package/manifest/schema.py platformio/package/manifest/schema.py \
       --subst-var-by SPDX_LICENSE_LIST_DATA '${spdx-license-list-data}'
+
+    substituteInPlace setup.py \
+      --replace "zeroconf==0.28.*" "zeroconf"
   '';
 
   meta = with lib; {

pkgs/development/compilers/ghc/head.nix

···
 , # GHC can be built with system libffi or a bundled one.
   libffi ? null
 
-, enableDwarf ? !stdenv.targetPlatform.isDarwin &&
+  # Libdw.c only supports x86_64, i686 and s390x
+, enableDwarf ? stdenv.targetPlatform.isx86 &&
+                !stdenv.targetPlatform.isDarwin &&
                 !stdenv.targetPlatform.isWindows
 , elfutils # for DWARF support
 
···
     description = "The Glasgow Haskell Compiler";
     maintainers = with lib.maintainers; [ marcweber andres peti ];
     inherit (ghc.meta) license platforms;
+    # ghcHEAD times out on aarch64-linux on Hydra.
+    hydraPlatforms = builtins.filter (p: p != "aarch64-linux") ghc.meta.platforms;
   };
 
   dontStrip = (targetPlatform.useAndroidPrebuilt || targetPlatform.isWasm);

pkgs/development/haskell-modules/configuration-arm.nix

···
   hsemail-ns = dontCheck super.hsemail-ns;
   openapi3 = dontCheck super.openapi3;
   strict-writer = dontCheck super.strict-writer;
+  xml-html-qq = dontCheck super.xml-html-qq;
+  static = dontCheck super.static;
+  hhp = dontCheck super.hhp;
+  groupBy = dontCheck super.groupBy;
+  greskell = dontCheck super.greskell;
+  html-validator-cli = dontCheck super.html-validator-cli;
+  hw-fingertree-strict = dontCheck super.hw-fingertree-strict;
+  hw-prim = dontCheck super.hw-prim;
+  hw-packed-vector = dontCheck super.hw-packed-vector;
+  hw-xml = dontCheck super.hw-xml;
+  lens-regex = dontCheck super.lens-regex;
+  meep = dontCheck super.meep;
+  ranged-list = dontCheck super.ranged-list;
+  rank2classes = dontCheck super.rank2classes;
+  schedule = dontCheck super.schedule;
+  twiml = dontCheck super.twiml;
+  twitter-conduit = dontCheck super.twitter-conduit;
+  validationt = dontCheck super.validationt;
+  vgrep = dontCheck super.vgrep;
+  vulkan-utils = dontCheck super.vulkan-utils;
+  yaml-combinators = dontCheck super.yaml-combinators;
+  yesod-paginator = dontCheck super.yesod-paginator;
+  grammatical-parsers = dontCheck super.grammatical-parsers;
+  construct = dontCheck super.construct;
 
   # https://github.com/ekmett/half/issues/35
   half = dontCheck super.half;

pkgs/development/haskell-modules/configuration-common.nix

···
   # base bound
   digit = doJailbreak super.digit;
 
-  # 2020-06-05: HACK: does not pass own build suite - `dontCheck`
   hnix = generateOptparseApplicativeCompletion "hnix"
     (overrideCabal super.hnix (drv: {
+      # 2020-06-05: HACK: does not pass own build suite - `dontCheck`
       doCheck = false;
-      prePatch = ''
-        # fix encoding problems when patching
-        ${pkgs.dos2unix}/bin/dos2unix hnix.cabal
-      '' + (drv.prePatch or "");
+      # 2021-05-12: Revert a few dependency cleanups which depend on release
+      # that are not in stackage yet:
+      # * Depend on semialign-indexed for Data.Semialign.Indexed
+      #   (remove when semialign >= 1.2 in stackage)
+      # * Readd dependencies to text and unordered-containers.
+      #   (remove when relude >= 1.0.0.0 is in stackage, see
+      #   https://github.com/haskell-nix/hnix/issues/933)
+      libraryHaskellDepends = [
+        self.semialign-indexed
+      ] ++ drv.libraryHaskellDepends;
       patches = [
-        # support ref-tf in hnix 0.12.0.1, can be removed after
-        # https://github.com/haskell-nix/hnix/pull/918
-        ./patches/hnix-ref-tf-0.5-support.patch
+        # depend on semialign-indexed again
+        (pkgs.fetchpatch {
+          url = "https://github.com/haskell-nix/hnix/commit/16fc342a4f2974f855968472252cd9274609f177.patch";
+          sha256 = "0gm4gy3jpn4dqnrhnqlsavfpw9c1j1xa8002v54knnlw6vpk9niy";
+          revert = true;
+        })
+        # depend on text again
+        (pkgs.fetchpatch {
+          url = "https://github.com/haskell-nix/hnix/commit/73057618576e86bb87dfd42f62b855d24bbdf469.patch";
+          sha256 = "03cyk96d5ad362i1pnz9bs8ifr84kpv8phnr628gys4j6a0bqwzc";
+          revert = true;
+        })
+        # depend on unordered-containers again
+        (pkgs.fetchpatch {
+          url = "https://github.com/haskell-nix/hnix/commit/70643481883ed448b51221a030a76026fb5eb731.patch";
+          sha256 = "0pqmijfkysjixg3gb4kmrqdif7s2saz8qi6k337jf15i0npzln8d";
+          revert = true;
+        })
       ] ++ (drv.patches or []);
     }));
 
···
   # https://github.com/commercialhaskell/stackage/issues/5795
   # This issue can be mitigated with 'dontCheck' which skips the tests and their compilation.
   dhall-json = generateOptparseApplicativeCompletions ["dhall-to-json" "dhall-to-yaml"] (dontCheck super.dhall-json);
-  dhall-nix = generateOptparseApplicativeCompletion "dhall-to-nix" super.dhall-nix;
+  # dhall-nix, dhall-nixpkgs: pull updated cabal files with updated bounds.
+  # Remove at next hackage update.
+  dhall-nix = generateOptparseApplicativeCompletion "dhall-to-nix" (overrideCabal super.dhall-nix {
+    revision = "2";
+    editedCabalFile = "1w90jrkzmbv5nasafkkv0kyfmnqkngldx2lr891113h2mqbbr3wx";
+  });
+  dhall-nixpkgs = overrideCabal super.dhall-nixpkgs {
+    revision = "1";
+    editedCabalFile = "1y08jxg51sbxx0i7ra45ii2v81plzf4hssmwlrw35l8n5gib1vcg";
+  };
   dhall-yaml = generateOptparseApplicativeCompletions ["dhall-to-yaml-ng" "yaml-to-dhall"] super.dhall-yaml;
 
   # https://github.com/haskell-hvr/netrc/pull/2#issuecomment-469526558
···
       # 2021-04-09: test failure
       # PR pending https://github.com/expipiplus1/update-nix-fetchgit/pull/60
       doCheck = false;
+
+      patches = [
+        # 2021-05-17 compile with hnix >= 0.13
+        # https://github.com/expipiplus1/update-nix-fetchgit/pull/64
+        (pkgs.fetchpatch {
+          url = "https://github.com/expipiplus1/update-nix-fetchgit/commit/bc28c8b26c38093aa950574802012c0cd8447ce8.patch";
+          sha256 = "1dwd1jdsrx3ss6ql1bk2ch7ln74mkq6jy9ms8vi8kmf3gbg8l9fg";
+        })
+      ] ++ (drv.patches or []);
     }));
 
   # Our quickcheck-instances is too old for the newer binary-instances, but
···
   bson = appendConfigureFlag (super.bson.override {
     network = self.network-bsd;
   }) "-f-_old_network";
+
+  # 2021-05-14: Testsuite is failing.
+  # https://github.com/kcsongor/generic-lens/issues/133
+  generic-optics = dontCheck super.generic-optics;
 
 } // import ./configuration-tensorflow.nix {inherit pkgs haskellLib;} self super

pkgs/development/haskell-modules/configuration-hackage2nix/broken.yaml

···
   - generic-lens-labels
   - generic-lucid-scaffold
   - generic-maybe
-  - generic-optics
   - generic-override-aeson
   - generic-pretty
   - genericserialize
···
   - grasp
   - gray-code
   - greencard
+  - greenclip
   - greg-client
   - gremlin-haskell
   - Grempa
···
   - multext-east-msd
   - multiaddr
   - multiarg
+  - multi-except
   - multihash
   - multi-instance
   - multilinear
···
   - yampa-glut
   - yampa-sdl2
   - YampaSynth
+  - yampa-test
   - yam-servant
   - yandex-translate
   - yaop

pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml

···
   - ghcide == 1.2.*
   - hls-plugin-api == 1.1.0.0
   - hls-explicit-imports-plugin < 1.0.0.2
+  # 2021-05-12: remove once versions >= 5.0.0 is in stackage
+  - futhark < 0.19.5
 
 extra-packages:
   - base16-bytestring < 1               # required for cabal-install etc.
···
   - ShellCheck == 0.7.1                 # 2021-05-09: haskell-ci 0.12.1 pins this version
 
 package-maintainers:
+  abbradar:
+    - Agda
+  bdesham:
+    - pinboard-notes-backup
+  cdepillabout:
+    - password
+    - password-instances
+    - pretty-simple
+    - spago
+    - termonad
+  Gabriel439:
+    - annah
+    - bench
+    - break
+    - dhall-bash
+    - dhall-docs
+    - dhall-json
+    - dhall-lsp-server
+    - dhall-nix
+    - dhall-nixpkgs
+    - dhall-openapi
+    - dhall-text
+    - dhall-yaml
+    - dhall
+    - dirstream
+    - errors
+    - foldl
+    - index-core
+    - lens-tutorial
+    - list-transformer
+    - managed
+    - mmorph
+    - morte
+    - mvc-updates
+    - mvc
+    - nix-derivation
+    - nix-diff
+    - optional-args
+    - optparse-generic
+    - pipes-bytestring
+    - pipes-concurrency
+    - pipes-csv
+    - pipes-extras
+    - pipes-group
+    - pipes-http
+    - pipes-parse
+    - pipes-safe
+    - pipes
+    - server-generic
+    - total
+    - turtle
+    - typed-spreadsheet
+  gridaphobe:
+    - located-base
+  jb55:
+    # - bson-lens
+    - cased
+    - elm-export-persistent
+    # - pipes-mongodb
+    - streaming-wai
+  kiwi:
+    - config-schema
+    - config-value
+    - glirc
+    - irc-core
+    - matterhorn
+    - mattermost-api
+    - mattermost-api-qc
+    - Unique
+  maralorn:
+    - arbtt
+    - cabal-fmt
+    - generic-optics
+    - ghcup
+    - haskell-language-server
+    - hedgehog
+    - hmatrix
+    - iCalendar
+    - neuron
+    - optics
+    - reflex-dom
+    - releaser
+    - req
+    - shake-bench
+    - shh
+    - snap
+    - stm-containers
+    - streamly
+    - taskwarrior
+  pacien:
+    - ldgallery-compiler
   peti:
     - cabal-install
     - cabal2nix
···
     - titlecase
     - xmonad
     - xmonad-contrib
-  gridaphobe:
-    - located-base
-  jb55:
-    # - bson-lens
-    - cased
-    - elm-export-persistent
-    # - pipes-mongodb
-    - streaming-wai
-  kiwi:
-    - config-schema
-    - config-value
-    - glirc
-    - irc-core
-    - matterhorn
-    - mattermost-api
-    - mattermost-api-qc
-    - Unique
+  poscat:
+    - hinit
   psibi:
     - path-pieces
     - persistent
     - persistent-sqlite
     - persistent-template
     - shakespeare
-  abbradar:
-    - Agda
   roberth:
     - arion-compose
     - hercules-ci-agent
···
     - hercules-ci-cli
     - hercules-ci-cnix-expr
     - hercules-ci-cnix-store
-  cdepillabout:
-    - pretty-simple
-    - spago
-  terlar:
-    - nix-diff
-  maralorn:
-    - reflex-dom
-    - cabal-fmt
-    - shh
-    - neuron
-    - releaser
-    - taskwarrior
-    - haskell-language-server
-    - shake-bench
-    - iCalendar
-    - stm-containers
+  rvl:
+    - taffybar
+    - arbtt
+    - lentil
   sorki:
     - cayenne-lpp
     - data-stm32
···
     - ttn-client
     - update-nix-fetchgit
     - zre
-  utdemir:
-    - nix-tree
-  turion:
-    - rhine
-    - rhine-gloss
-    - essence-of-live-coding
-    - essence-of-live-coding-gloss
-    - essence-of-live-coding-pulse
-    - essence-of-live-coding-quickcheck
-    - Agda
-    - dunai
-    - finite-typelits
-    - pulse-simple
-    - simple-affine-space
   sternenseemann:
     # also maintain upstream package
     - spacecookie
···
     - yarn-lock
     - yarn2nix
     - large-hashable
-  poscat:
-    - hinit
-  bdesham:
-    - pinboard-notes-backup
-  rvl:
-    - taffybar
-    - arbtt
-    - lentil
+  terlar:
+    - nix-diff
+  turion:
+    - rhine
+    - rhine-gloss
+    - essence-of-live-coding
+    - essence-of-live-coding-gloss
+    - essence-of-live-coding-pulse
+    - essence-of-live-coding-quickcheck
+    - Agda
+    - dunai
+    - finite-typelits
+    - pulse-simple
+    - simple-affine-space
+  utdemir:
+    - nix-tree
 
 unsupported-platforms:
   Allure:                                       [ x86_64-darwin ]
···
   bdcs-api:                                     [ x86_64-darwin ]
   bindings-directfb:                            [ x86_64-darwin ]
   bindings-sane:                                [ x86_64-darwin ]
+  charsetdetect:                                [ aarch64-linux ] # not supported by vendored lib / not configured properly https://github.com/batterseapower/libcharsetdetect/issues/3
   cut-the-crap:                                 [ x86_64-darwin ]
   d3d11binding:                                 [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
   DirectSound:                                  [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
···
   dx9d3d:                                       [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
   dx9d3dx:                                      [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
   Euterpea:                                     [ x86_64-darwin ]
+  follow-file:                                  [ x86_64-darwin ]
   freenect:                                     [ x86_64-darwin ]
   FTGL:                                         [ x86_64-darwin ]
   ghcjs-dom-hello:                              [ x86_64-darwin ]
+  gi-dbusmenugtk3:                              [ x86_64-darwin ]
   gi-dbusmenu:                                  [ x86_64-darwin ]
-  gi-dbusmenugtk3:                              [ x86_64-darwin ]
   gi-ggit:                                      [ x86_64-darwin ]
   gi-ibus:                                      [ x86_64-darwin ]
   gi-ostree:                                    [ x86_64-darwin ]
···
   hcwiid:                                       [ x86_64-darwin ]
   HFuse:                                        [ x86_64-darwin ]
   hidapi:                                       [ x86_64-darwin ]
+  hinotify-bytestring:                          [ x86_64-darwin ]
   hommage-ds:                                   [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
+  honk:                                         [ x86_64-darwin ]
   hpapi:                                        [ x86_64-darwin ]
   HSoM:                                         [ x86_64-darwin ]
   iwlib:                                        [ x86_64-darwin ]
···
   libtelnet:                                    [ x86_64-darwin ]
   libzfs:                                       [ x86_64-darwin ]
   linearEqSolver:                               [ aarch64-linux ]
+  linux-evdev:                                  [ x86_64-darwin ]
+  linux-file-extents:                           [ x86_64-darwin ]
+  linux-inotify:                                [ x86_64-darwin ]
+  linux-mount:                                  [ x86_64-darwin ]
+  linux-namespaces:                             [ x86_64-darwin ]
   lio-fs:                                       [ x86_64-darwin ]
   logging-facade-journald:                      [ x86_64-darwin ]
   midi-alsa:                                    [ x86_64-darwin ]
+  mpi-hs:                                       [ aarch64-linux, x86_64-darwin ]
   mpi-hs-binary:                                [ aarch64-linux, x86_64-darwin ]
   mpi-hs-cereal:                                [ aarch64-linux, x86_64-darwin ]
   mpi-hs-store:                                 [ aarch64-linux, x86_64-darwin ]
-  mpi-hs:                                       [ aarch64-linux, x86_64-darwin ]
   mplayer-spot:                                 [ aarch64-linux ]
+  netlink:                                      [ x86_64-darwin ]
   oculus:                                       [ x86_64-darwin ]
   pam:                                          [ x86_64-darwin ]
+  parport:                                      [ x86_64-darwin ]
+  password:                                     [ aarch64-linux, armv7l-linux ] # uses scrypt, which requries x86
+  password-instances:                           [ aarch64-linux, armv7l-linux ] # uses scrypt, which requries x86
+  persist-state:                                [ aarch64-linux, armv7l-linux ] # https://github.com/minad/persist-state/blob/6fd68c0b8b93dec78218f6d5a1f4fa06ced4e896/src/Data/PersistState.hs#L122-L128
   piyo:                                         [ x86_64-darwin ]
   PortMidi-simple:                              [ x86_64-darwin ]
   PortMidi:                                     [ x86_64-darwin ]
···
   rtlsdr:                                       [ x86_64-darwin ]
   rubberband:                                   [ x86_64-darwin ]
   sbv:                                          [ aarch64-linux ]
+  scat:                                         [ aarch64-linux, armv7l-linux ] # uses scrypt, which requries x86
+  scrypt:                                       [ aarch64-linux, armv7l-linux ] # https://github.com/informatikr/scrypt/issues/8
   sdl2-mixer:                                   [ x86_64-darwin ]
   sdl2-ttf:                                     [ x86_64-darwin ]
   synthesizer-alsa:                             [ x86_64-darwin ]
···
   termonad:                                     [ x86_64-darwin ]
   tokyotyrant-haskell:                          [ x86_64-darwin ]
   udev:                                         [ x86_64-darwin ]
+  Unixutils-shadow:                             [ x86_64-darwin ]
   verifiable-expressions:                       [ aarch64-linux ]
   vrpn:                                         [ x86_64-darwin ]
-  vulkan-utils:                                 [ x86_64-darwin ]
   vulkan:                                       [ i686-linux, armv7l-linux, x86_64-darwin ]
   VulkanMemoryAllocator:                        [ i686-linux, armv7l-linux, x86_64-darwin ]
+  vulkan-utils:                                 [ x86_64-darwin ]
   webkit2gtk3-javascriptcore:                   [ x86_64-darwin ]
   Win32-console:                                [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
   Win32-dhcp-server:                            [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
   Win32-errors:                                 [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
   Win32-extras:                                 [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
+  Win32:                                        [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
   Win32-junction-point:                         [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
   Win32-notify:                                 [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
   Win32-security:                               [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
-  Win32-services-wrapper:                       [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
   Win32-services:                               [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
-  Win32:                                        [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
+  Win32-services-wrapper:                       [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]
   xattr:                                        [ x86_64-darwin ]
   xgboost-haskell:                              [ aarch64-linux, armv7l-linux ]
   XInput:                                       [ i686-linux, x86_64-linux, x86_64-darwin, aarch64-linux, armv7l-linux ]

pkgs/development/haskell-modules/configuration-hackage2nix/transitive-broken.yaml

···
  - ghcjs-hplay
  - ghc-mod
  - ghc-tags-plugin
- - ghcup
  - ghc-vis
  - ght
  - gi-cairo-again
···
  - yu-launch
  - yuuko
  - zasni-gerna
+ - Z-Botan
  - zephyr
  - zerobin
  - zeromq3-conduit

pkgs/development/haskell-modules/configuration-nix.nix

···
 
   # Compile manpages (which are in RST and are compiled with Sphinx).
   futhark = with pkgs;
-    overrideCabal (addBuildTools super.futhark [makeWrapper python37Packages.sphinx])
+    overrideCabal (addBuildTools super.futhark [makeWrapper python3Packages.sphinx])
       (_drv: {
         postBuild = (_drv.postBuild or "") + ''
         make -C docs man
···
   primitive_0_7_1_0 = dontCheck super.primitive_0_7_1_0;
 
   cut-the-crap =
-    let path = pkgs.lib.makeBinPath [ pkgs.ffmpeg_3 pkgs.youtube-dl ];
+    let path = pkgs.lib.makeBinPath [ pkgs.ffmpeg pkgs.youtube-dl ];
     in overrideCabal (addBuildTool super.cut-the-crap pkgs.makeWrapper) (_drv: {
       postInstall = ''
         wrapProgram $out/bin/cut-the-crap \
···
     platforms = pkgs.lib.platforms.x86;
   };
 
+  # uses x86 intrinsics
+  blake3 = overrideCabal super.blake3 {
+    platforms = pkgs.lib.platforms.x86;
+  };
+
+  # uses x86 intrinsics, see also https://github.com/NixOS/nixpkgs/issues/122014
+  crc32c = overrideCabal super.crc32c {
+    platforms = pkgs.lib.platforms.x86;
+  };
+
+  # uses x86 intrinsics
+  seqalign = overrideCabal super.seqalign {
+    platforms = pkgs.lib.platforms.x86;
+  };
+
   hls-brittany-plugin = overrideCabal super.hls-brittany-plugin (drv: {
     testToolDepends = [ pkgs.git ];
     preCheck = ''
···
       export HOME=$TMPDIR/home
     '';
   });
+
+  taglib = overrideCabal super.taglib (drv: {
+    librarySystemDepends = [
+      pkgs.zlib
+    ] ++ (drv.librarySystemDepends or []);
+  });
+
+  # uses x86 assembler
+  inline-asm = overrideCabal super.inline-asm {
+    platforms = pkgs.lib.platforms.x86;
+  };
+
+  # uses x86 assembler in C bits
+  hw-prim-bits = overrideCabal super.hw-prim-bits {
+    platforms = pkgs.lib.platforms.x86;
+  };
 }

pkgs/development/haskell-modules/hackage-packages.nix

···
        libraryHaskellDepends = [ base unix ];
        description = "A simple interface to shadow passwords (aka, shadow.h)";
        license = lib.licenses.bsd3;
+       platforms = [
+         "aarch64-linux" "armv7l-linux" "i686-linux" "x86_64-linux"
+       ];
      }) {};
 
   "Updater" = callPackage
···
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
      }) {inherit (pkgs) readline;};
+
+  "Z-Botan" = callPackage
+    ({ mkDerivation, base, Cabal, directory, filepath, ghc-prim, hspec
+     , hspec-discover, HUnit, integer-gmp, QuickCheck
+     , quickcheck-instances, scientific, stm, time, Z-Data, Z-IO
+     }:
+     mkDerivation {
+       pname = "Z-Botan";
+       version = "0.2.0.0";
+       sha256 = "0xxi19gfzglp93jxxq7sq9z1ijxa5jys917a156gd4hrcqqhwi63";
+       enableSeparateDataOutput = true;
+       setupHaskellDepends = [ base Cabal directory filepath ];
+       libraryHaskellDepends = [
+         base ghc-prim integer-gmp scientific stm time Z-Data Z-IO
+       ];
+       libraryToolDepends = [ hspec-discover ];
+       testHaskellDepends = [
+         base hspec HUnit QuickCheck quickcheck-instances Z-Data Z-IO
+       ];
+       description = "Crypto for Haskell";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
 
   "Z-Data" = callPackage
     ({ mkDerivation, base, bytestring, Cabal, case-insensitive
···
        license = lib.licenses.gpl3Only;
      }) {};
 
+  "amqp-utils_0_6_1_1" = callPackage
+    ({ mkDerivation, amqp, base, bytestring, connection, containers
+     , data-default-class, directory, hinotify, magic, network, process
+     , text, time, tls, unix, utf8-string, x509-system
+     }:
+     mkDerivation {
+       pname = "amqp-utils";
+       version = "0.6.1.1";
+       sha256 = "1lffc76ybvk73k57qn5m6788m2nkfsqavs7mfs1kaqw38pya940c";
+       isLibrary = false;
+       isExecutable = true;
+       executableHaskellDepends = [
+         amqp base bytestring connection containers data-default-class
+         directory hinotify magic network process text time tls unix
+         utf8-string x509-system
+       ];
+       description = "AMQP toolset for the command line";
+       license = lib.licenses.gpl3Only;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "amqp-worker" = callPackage
     ({ mkDerivation, aeson, amqp, base, bytestring, data-default
      , exceptions, monad-control, monad-loops, mtl, resource-pool
···
        description = "Medium-level language that desugars to Morte";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "annihilator" = callPackage
···
        ];
        description = "Automatic Rule-Based Time Tracker";
        license = lib.licenses.gpl2Only;
-       maintainers = with lib.maintainers; [ rvl ];
+       maintainers = with lib.maintainers; [ maralorn rvl ];
      }) {};
 
   "arcgrid" = callPackage
···
        ];
        description = "Command-line benchmark tool";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "bench-graph" = callPackage
···
      }) {};
 
   "bisc" = callPackage
-    ({ mkDerivation, base, configurator, directory, filepath, mtl
-     , selda, selda-sqlite, text
+    ({ mkDerivation, base, bytestring, configurator, data-default
+     , directory, exceptions, filepath, leveldb-haskell, mtl, selda
+     , selda-sqlite, snappy, text
      }:
      mkDerivation {
        pname = "bisc";
-       version = "0.2.3.0";
-       sha256 = "0x03smkfx0qnsxznlp1591gi938f15w057hywfp9497mhvkr7mxg";
+       version = "0.3.0.0";
+       sha256 = "097b25pp6pi7rq4xhk19g1i5v7v9hyx7ldyq0y3aj1cm50s2356m";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
-         base configurator directory filepath mtl selda selda-sqlite text
+         base bytestring configurator data-default directory exceptions
+         filepath leveldb-haskell mtl selda selda-sqlite text
        ];
-       description = "A small tool that clears qutebrowser cookies";
+       executableSystemDepends = [ snappy ];
+       description = "A small tool that clears cookies (and more)";
        license = lib.licenses.gpl3Only;
-     }) {};
+     }) {inherit (pkgs) snappy;};
 
   "bisect-binary" = callPackage
     ({ mkDerivation, base, bytestring, directory, filepath, hashable
···
        libraryHaskellDepends = [ base mtl transformers ];
        description = "Break from a loop";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "breakout" = callPackage
···
        libraryHaskellDepends = [ base bytestring ];
        description = "Character set detection using Mozilla's Universal Character Set Detector";
        license = "LGPL";
+       platforms = [
+         "armv7l-linux" "i686-linux" "x86_64-darwin" "x86_64-linux"
+       ];
      }) {};
 
   "charsetdetect-ae" = callPackage
···
      }:
      mkDerivation {
        pname = "code-conjure";
-       version = "0.2.2";
-       sha256 = "1rf9d6mwg965r4bnjxbcw2dzcf4fxqn9hnysxzyqxnyhrr8q4149";
+       version = "0.2.4";
+       sha256 = "1xb8c791zcbfywz4pcqx5n5iq6a2fh0fl2mzwl6cxapj2y700dbp";
        libraryHaskellDepends = [
          base express leancheck speculate template-haskell
        ];
···
        license = lib.licenses.bsd3;
      }) {};
 
+  "collect-errors_0_1_3_0" = callPackage
+    ({ mkDerivation, base, containers, deepseq, QuickCheck }:
+     mkDerivation {
+       pname = "collect-errors";
+       version = "0.1.3.0";
+       sha256 = "03gzaqlgivlzlsqrzr8g1ijvi825p9kxzihhrrd06vib34bqswv8";
+       libraryHaskellDepends = [ base containers deepseq QuickCheck ];
+       description = "Error monad with a Float instance";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "collection-json" = callPackage
     ({ mkDerivation, aeson, base, bytestring, hspec, hspec-discover
      , network-arbitrary, network-uri, network-uri-json, QuickCheck
···
      }:
      mkDerivation {
        pname = "css-easings";
-       version = "0.2.0.0";
-       sha256 = "0i969cp4j154ddq7x2821p53qh8dnsr7f74rsdi4y9rbbls1fnpv";
+       version = "0.2.1.0";
+       sha256 = "0mn3h7fqp4bs7rqjzc05k29man8i77dg1avcajdyysf84azklyrw";
        libraryHaskellDepends = [
          aeson base blaze-markup data-default QuickCheck scientific
          shakespeare text
···
      }:
      mkDerivation {
        pname = "css-selectors";
-       version = "0.4.0.1";
-       sha256 = "0wj16835xcr33kqpwlrqgsain0dv6dl9cxcxncxhp0c0z5bl4ysd";
+       version = "0.4.0.2";
+       sha256 = "1299xqp1ssxarz2i9wgzcyj4zmjry6cq02jb2a9n0vw61gw6z5g4";
        libraryHaskellDepends = [
          aeson array base binary blaze-markup bytestring data-default
          Decimal hashable QuickCheck shakespeare template-haskell text zlib
···
        description = "A configuration language guaranteed to terminate";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "dhall" = callPackage
···
        pname = "dhall";
        version = "1.38.1";
        sha256 = "0g70x2crdrkwf41gvwr718am25dmbn9bg4cml9f9va7i1vx5rsgk";
+       revision = "1";
+       editedCabalFile = "1830jbh5q7g7r4i5n1vhs1h8fj8zzig3l6qr9kbkk00dhhgywv8b";
        isLibrary = true;
        isExecutable = true;
        enableSeparateDataOutput = true;
···
        doCheck = false;
        description = "A configuration language guaranteed to terminate";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "dhall-bash" = callPackage
···
        ];
        description = "Compile Dhall to Bash";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "dhall-check" = callPackage
···
        pname = "dhall-docs";
        version = "1.0.5";
        sha256 = "00s1vhwilnr6hvv56w98kc1md08lw6v80v8a7yhwrmg9qggwdc12";
+       revision = "1";
+       editedCabalFile = "0y8a02jxz5cap0q4b2106ck4av7haxqlv5vjhm0nmrsq10cl4nss";
        isLibrary = true;
        isExecutable = true;
        enableSeparateDataOutput = true;
···
        description = "Generate HTML docs from a dhall package";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "dhall-fly" = callPackage
···
        ];
        description = "Convert between Dhall and JSON or YAML";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "dhall-lex" = callPackage
···
        ];
        description = "Language Server Protocol (LSP) server for Dhall";
        license = lib.licenses.mit;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "dhall-nix" = callPackage
···
        ];
        description = "Dhall to Nix compiler";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "dhall-nixpkgs" = callPackage
···
        ];
        description = "Convert Dhall projects to Nix packages";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "dhall-openapi" = callPackage
···
        ];
        description = "Convert an OpenAPI specification to a Dhall package";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "dhall-recursive-adt" = callPackage
···
        description = "Template text using Dhall";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
        broken = true;
      }) {};
 
···
        ];
        description = "Convert between Dhall and YAML";
        license = lib.licenses.gpl3Only;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "dhcp-lease-parser" = callPackage
···
        ];
        description = "Easily stream directory contents in constant memory";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "dirtree" = callPackage
···
      }:
      mkDerivation {
        pname = "dual-tree";
-       version = "0.2.2.1";
-       sha256 = "17kdfnf0df0z5pkiifxrlmyd1xd7hjjaazd2kzyajl0gd00vbszx";
+       version = "0.2.3.0";
+       sha256 = "0qyn7kb42wvlcvb1wbf1qx3isc2y6k3hzp5iq6ab0r0llw9g6qlg";
        libraryHaskellDepends = [
          base monoid-extras newtype-generics semigroups
        ];
···
        ];
        description = "Simplified error-handling";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "errors-ext" = callPackage
···
        benchmarkHaskellDepends = [ base criterion ];
        description = "Composable, streaming, and efficient left folds";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "foldl-exceptions" = callPackage
···
        ];
        description = "Be notified when a file gets appended, solely with what was added. Warning - only works on linux and for files that are strictly appended, like log files.";
        license = lib.licenses.bsd3;
+       platforms = [
+         "aarch64-linux" "armv7l-linux" "i686-linux" "x86_64-linux"
+       ];
      }) {};
 
   "follower" = callPackage
···
        license = lib.licenses.isc;
      }) {};
 
+  "futhark_0_19_5" = callPackage
+    ({ mkDerivation, aeson, alex, ansi-terminal, array, base, binary
+     , blaze-html, bmp, bytestring, bytestring-to-vector, cmark-gfm
+     , containers, directory, directory-tree, dlist, file-embed
+     , filepath, free, gitrev, happy, hashable, haskeline
+     , language-c-quote, mainland-pretty, megaparsec, mtl
+     , neat-interpolation, parallel, parser-combinators, pcg-random
+     , process, process-extras, QuickCheck, regex-tdfa, srcloc, tasty
+     , tasty-hunit, tasty-quickcheck, template-haskell, temporary
+     , terminal-size, text, time, transformers, unordered-containers
+     , utf8-string, vector, vector-binary-instances, versions
+     , zip-archive, zlib
+     }:
+     mkDerivation {
+       pname = "futhark";
+       version = "0.19.5";
+       sha256 = "1x922g3iq50an8jv75370qr0qslmxnrrqbwr7adca30ljaa7nfvh";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         aeson ansi-terminal array base binary blaze-html bmp bytestring
+         bytestring-to-vector cmark-gfm containers directory directory-tree
+         dlist file-embed filepath free gitrev hashable haskeline
+         language-c-quote mainland-pretty megaparsec mtl neat-interpolation
+         parallel pcg-random process process-extras regex-tdfa srcloc
+         template-haskell temporary terminal-size text time transformers
+         unordered-containers utf8-string vector vector-binary-instances
+         versions zip-archive zlib
+       ];
+       libraryToolDepends = [ alex happy ];
+       executableHaskellDepends = [ base text ];
+       testHaskellDepends = [
+         base containers megaparsec mtl parser-combinators QuickCheck tasty
+         tasty-hunit tasty-quickcheck text
+       ];
+       description = "An optimising compiler for a functional, array-oriented language";
+       license = lib.licenses.isc;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "futhask" = callPackage
     ({ mkDerivation, base, directory, raw-strings-qq, split }:
      mkDerivation {
···
        ];
        description = "Generically derive traversals, lenses and prisms";
        license = lib.licenses.bsd3;
-       hydraPlatforms = lib.platforms.none;
-       broken = true;
+       maintainers = with lib.maintainers; [ maralorn ];
      }) {};
 
   "generic-optics-lite" = callPackage
···
        pname = "ghcide";
        version = "1.2.0.2";
        sha256 = "0r3n23i4b51bb92q6pch9knj079a26jbz0q70qfpv66154d00wld";
+       revision = "1";
+       editedCabalFile = "1hv74yx0x6hh506kwg7ygkajkcczfn3l00f8rc4jnr3hkhkm5v85";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
···
      }) {};
 
   "ghcup" = callPackage
-    ({ mkDerivation, aeson, aeson-pretty, ascii-string, async, base
+    ({ mkDerivation, aeson, aeson-pretty, async, base
      , base16-bytestring, binary, bytestring, bz2, case-insensitive
      , casing, concurrent-output, containers, cryptohash-sha256
      , generic-arbitrary, generics-sop, haskus-utils-types
···
      }:
      mkDerivation {
        pname = "ghcup";
-       version = "0.1.14.1";
-       sha256 = "1lx6ahn4mvjzs3x4qm32sdn1n8w4v7jqj2jslvan008zk664d5l2";
-       revision = "1";
-       editedCabalFile = "0a9c2ha61mlz9ci652djy4vmmzi4s1g8rwl1a2miymrw5b36zsmq";
+       version = "0.1.14.2";
+       sha256 = "1k18ira2i2ja4hd65fdxk3ab21xzh4fvd982q2rfjshzkds1a3hv";
        isLibrary = true;
        isExecutable = true;
        libraryHaskellDepends = [
-         aeson ascii-string async base base16-bytestring binary bytestring
-         bz2 case-insensitive casing concurrent-output containers
+         aeson async base base16-bytestring binary bytestring bz2
+         case-insensitive casing concurrent-output containers
          cryptohash-sha256 generics-sop haskus-utils-types
          haskus-utils-variant hpath hpath-directory hpath-filepath hpath-io
          hpath-posix libarchive lzma-static megaparsec monad-logger mtl
···
        ];
        description = "ghc toolchain installer";
        license = lib.licenses.lgpl3Only;
-       hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ maralorn ];
      }) {};
 
   "ghczdecode" = callPackage
···
 
   "greenclip" = callPackage
     ({ mkDerivation, base, binary, bytestring, directory, exceptions
-     , hashable, libXau, microlens, microlens-mtl, protolude, text, unix
-     , vector, wordexp, X11, xcb, xdmcp, xlibsWrapper
+     , hashable, libXau, microlens, microlens-mtl, protolude, text
+     , tomland, unix, vector, wordexp, X11, xcb, xdmcp, xlibsWrapper
+     , xscrnsaver
      }:
      mkDerivation {
        pname = "greenclip";
-       version = "3.4.0";
-       sha256 = "0763nnh7k4blkamlswnapwxyqfn1l0g6ibpz7k1w2w2asj7a3q98";
+       version = "4.1.0";
+       sha256 = "1z52ffb3f0iflls3bjlwzpz4w3a904vj67c1zsdyql6j2xpln6n4";
        isLibrary = false;
        isExecutable = true;
        executableHaskellDepends = [
          base binary bytestring directory exceptions hashable microlens
-         microlens-mtl protolude text unix vector wordexp X11
+         microlens-mtl protolude text tomland unix vector wordexp X11
        ];
-       executablePkgconfigDepends = [ libXau xcb xdmcp xlibsWrapper ];
+       executablePkgconfigDepends = [
+         libXau xcb xdmcp xlibsWrapper xscrnsaver
+       ];
        description = "Simple clipboard manager to be integrated with rofi";
        license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {inherit (pkgs.xorg) libXau; xcb = null; xdmcp = null; 
-         inherit (pkgs) xlibsWrapper;};
+         inherit (pkgs) xlibsWrapper; xscrnsaver = null;};
 
   "greg-client" = callPackage
     ({ mkDerivation, base, binary, bytestring, clock, hostname, network
···
        ];
        description = "Access cabal-install's Hackage database via Data.Map";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ peti ];
+     }) {};
+
+  "hackage-db_2_1_1" = callPackage
+    ({ mkDerivation, aeson, base, bytestring, Cabal, containers
+     , directory, exceptions, filepath, tar, time, utf8-string
+     }:
+     mkDerivation {
+       pname = "hackage-db";
+       version = "2.1.1";
+       sha256 = "16y1iqb3y019hjdsq7q3zx51qy834ky3mw5vszqmzzhflqpicd31";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         aeson base bytestring Cabal containers directory exceptions
+         filepath tar time utf8-string
+       ];
+       description = "Access cabal-install's Hackage database via Data.Map";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
        maintainers = with lib.maintainers; [ peti ];
      }) {};
 
···
        ];
        description = "Release with confidence";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ maralorn ];
      }) {};
 
   "hedgehog-checkers" = callPackage
···
        ];
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
        license = lib.licenses.bsd3;
+       platforms = [
+         "aarch64-linux" "armv7l-linux" "i686-linux" "x86_64-linux"
+       ];
      }) {};
 
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
···
        librarySystemDepends = [ openblasCompat ];
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ maralorn ];
      }) {inherit (pkgs) openblasCompat;};
 
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
···
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
+     , prettyprinter, process, ref-tf, regex-tdfa, relude, repline
+     , scientific, semialign, serialise, some, split, syb, tasty
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
+     , th-lift-instances, these, time, transformers, transformers-base
+     , unix, unordered-containers, vector, xml
      }:
      mkDerivation {
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-       version = "0.12.0.1";
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-       revision = "1";
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
+       version = "0.13.0.1";
+       sha256 = "1c01ns9h7va6ri568c0hzcdkmr0jdiay5z1vwwva7cv7dlvn6wl7";
        isLibrary = true;
        isExecutable = true;
        enableSeparateDataOutput = true;
···
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
+         regex-tdfa relude scientific semialign serialise some split syb
+         template-haskell text th-lift-instances these time transformers
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
        ];
        executableHaskellDepends = [
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-         text time transformers unordered-containers
+         aeson base comonad containers data-fix deepseq exceptions filepath
+         free haskeline optparse-applicative pretty-show prettyprinter
+         ref-tf relude repline serialise template-haskell time
        ];
        testHaskellDepends = [
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-         template-haskell text time transformers unix unordered-containers
+         base containers data-fix Diff directory exceptions filepath Glob
+         hedgehog megaparsec neat-interpolation optparse-applicative
+         pretty-show prettyprinter process relude serialise split tasty
+         tasty-hedgehog tasty-hunit tasty-th template-haskell time unix
        ];
        benchmarkHaskellDepends = [
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
-         template-haskell text time transformers unordered-containers
+         base criterion data-fix exceptions filepath optparse-applicative
+         relude serialise template-haskell time
        ];
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
        license = lib.licenses.bsd3;
···
        libraryHaskellDepends = [ base ];
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
        license = lib.licenses.asl20;
+       platforms = [
+         "aarch64-linux" "armv7l-linux" "i686-linux" "x86_64-linux"
+       ];
      }) {};
 
     ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
···
        license = lib.licenses.mit;
      }) {};
 
+  "hspec_2_8_1" = callPackage
+    ({ mkDerivation, base, hspec-core, hspec-discover
+     , hspec-expectations, QuickCheck
+     }:
+     mkDerivation {
+       pname = "hspec";
+       version = "2.8.1";
+       sha256 = "1lk7xylld960wld755j1f81zaydxgxq3840np4h6xcp729cf0cq5";
+       libraryHaskellDepends = [
+         base hspec-core hspec-discover hspec-expectations QuickCheck
+       ];
+       description = "A Testing Framework for Haskell";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "hspec-attoparsec" = callPackage
     ({ mkDerivation, attoparsec, base, bytestring, hspec
      , hspec-expectations, text
···
        license = lib.licenses.mit;
      }) {};
 
+  "hspec-core_2_8_1" = callPackage
+    ({ mkDerivation, ansi-terminal, array, base, call-stack, clock
+     , deepseq, directory, filepath, hspec-expectations, hspec-meta
+     , HUnit, process, QuickCheck, quickcheck-io, random, setenv
+     , silently, stm, temporary, tf-random, transformers
+     }:
+     mkDerivation {
+       pname = "hspec-core";
+       version = "2.8.1";
+       sha256 = "1yha64zfc226pc4952zqwv229kbl8p5grhl7c6wxn2y948rb688a";
+       libraryHaskellDepends = [
+         ansi-terminal array base call-stack clock deepseq directory
+         filepath hspec-expectations HUnit QuickCheck quickcheck-io random
+         setenv stm tf-random transformers
+       ];
+       testHaskellDepends = [
+         ansi-terminal array base call-stack clock deepseq directory
+         filepath hspec-expectations hspec-meta HUnit process QuickCheck
+         quickcheck-io random setenv silently stm temporary tf-random
+         transformers
+       ];
+       testToolDepends = [ hspec-meta ];
+       testTarget = "--test-option=--skip --test-option='Test.Hspec.Core.Runner.hspecResult runs specs in parallel'";
+       description = "A Testing Framework for Haskell";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "hspec-dirstream" = callPackage
     ({ mkDerivation, base, dirstream, filepath, hspec, hspec-core
      , pipes, pipes-safe, system-filepath, text
···
        license = lib.licenses.mit;
      }) {};
 
+  "hspec-discover_2_8_1" = callPackage
+    ({ mkDerivation, base, directory, filepath, hspec-meta, QuickCheck
+     }:
+     mkDerivation {
+       pname = "hspec-discover";
+       version = "2.8.1";
+       sha256 = "05xzxsxpxf7hyg6zdf7mxx6xb79rxrhd3pz3pwj32a0phbjkicdn";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [ base directory filepath ];
+       executableHaskellDepends = [ base directory filepath ];
+       testHaskellDepends = [
+         base directory filepath hspec-meta QuickCheck
+       ];
+       testToolDepends = [ hspec-meta ];
+       description = "Automatically discover and run Hspec tests";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "hspec-expectations" = callPackage
     ({ mkDerivation, base, call-stack, HUnit, nanospec }:
      mkDerivation {
···
        description = "Indexed Types";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
        broken = true;
      }) {};
 
···
      }:
      mkDerivation {
        pname = "jvm-binary";
-       version = "0.9.0";
-       sha256 = "1ks5mbp1anrgm100sf3ycv1prwm3vj1vyag7l0ihs4cr2sqzq3a2";
+       version = "0.10.0";
+       sha256 = "11c3rhny06zjw8xv830khq1kdjbpzkr7wmzzymld4zcmhfmk9qda";
        enableSeparateDataOutput = true;
        libraryHaskellDepends = [
          attoparsec base binary bytestring containers data-binary-ieee754
···
        description = "Tutorial for the lens library";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
        broken = true;
      }) {};
 
···
        libraryHaskellDepends = [ base bytestring time unix ];
        description = "Bindings to Linux evdev input device interface";
        license = lib.licenses.bsd3;
+       platforms = [
+         "aarch64-linux" "armv7l-linux" "i686-linux" "x86_64-linux"
+       ];
      }) {};
 
   "linux-file-extents" = callPackage
···
        libraryHaskellDepends = [ base unix ];
        description = "Retrieve file fragmentation information under Linux";
        license = lib.licenses.bsd3;
+       platforms = [
+         "aarch64-linux" "armv7l-linux" "i686-linux" "x86_64-linux"
+       ];
      }) {};
 
   "linux-framebuffer" = callPackage
···
        libraryHaskellDepends = [ base bytestring hashable unix ];
        description = "Thinner binding to the Linux Kernel's inotify interface";
        license = lib.licenses.bsd3;
+       platforms = [
+         "aarch64-linux" "armv7l-linux" "i686-linux" "x86_64-linux"
+       ];
      }) {};
 
   "linux-kmod" = callPackage
···
        libraryHaskellDepends = [ base bytestring ];
        description = "Mount and unmount filesystems";
        license = lib.licenses.bsd3;
+       platforms = [
+         "aarch64-linux" "armv7l-linux" "i686-linux" "x86_64-linux"
+       ];
      }) {};
 
   "linux-namespaces" = callPackage
···
        libraryHaskellDepends = [ base bytestring unix ];
        description = "Work with linux namespaces: create new or enter existing ones";
        license = lib.licenses.bsd3;
+       platforms = [
+         "aarch64-linux" "armv7l-linux" "i686-linux" "x86_64-linux"
+       ];
      }) {};
 
   "linux-perf" = callPackage
···
        testHaskellDepends = [ base doctest ];
        description = "List monad transformer";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "list-tries" = callPackage
···
        libraryHaskellDepends = [ base transformers ];
        description = "A monad for managed values";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "manatee" = callPackage
···
        license = lib.licenses.bsd3;
      }) {};
 
+  "mixed-types-num_0_5_1_0" = callPackage
+    ({ mkDerivation, base, collect-errors, hspec, hspec-smallcheck, mtl
+     , QuickCheck, smallcheck, template-haskell
+     }:
+     mkDerivation {
+       pname = "mixed-types-num";
+       version = "0.5.1.0";
+       sha256 = "09dkrx05mlbdvy1334q6zg3ay6k0ydl87naxhg4zr5p51i9p8lsg";
+       libraryHaskellDepends = [
+         base collect-errors hspec hspec-smallcheck mtl QuickCheck
+         smallcheck template-haskell
+       ];
+       testHaskellDepends = [
+         base collect-errors hspec hspec-smallcheck QuickCheck smallcheck
+       ];
+       description = "Alternative Prelude with numeric and logic expressions typed bottom-up";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "mixpanel-client" = callPackage
     ({ mkDerivation, aeson, base, base64-bytestring, bytestring, hspec
      , hspec-discover, http-client, http-client-tls, markdown-unlit
···
        description = "Monad morphisms";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "mmorph" = callPackage
···
        ];
        description = "Monad morphisms";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "mmsyn2" = callPackage
···
 
   "mnist-idx-conduit" = callPackage
     ({ mkDerivation, base, binary, bytestring, conduit, containers
-     , exceptions, resourcet, vector
+     , exceptions, hspec, resourcet, vector
      }:
      mkDerivation {
        pname = "mnist-idx-conduit";
-       version = "0.2.0.0";
-       sha256 = "1m6xxw59yyf60zp0s3qd2pmsps482qws2vlnfqjz2wgr4rj0cp1x";
+       version = "0.3.0.0";
+       sha256 = "0vqb4yhb51lykcd66kgh9dn14nf4xfr74hamg72s35aa22lhw932";
        libraryHaskellDepends = [
-         base binary bytestring conduit containers exceptions resourcet
-         vector
+         base binary bytestring conduit containers exceptions hspec
+         resourcet vector
        ];
+       testHaskellDepends = [ base bytestring conduit hspec vector ];
        description = "conduit utilities for MNIST IDX files";
        license = lib.licenses.bsd3;
      }) {};
···
        description = "A bare-bones calculus of constructions";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
        broken = true;
      }) {};
 
···
        license = lib.licenses.bsd3;
      }) {};
 
+  "multi-except" = callPackage
+    ({ mkDerivation, base, dlist }:
+     mkDerivation {
+       pname = "multi-except";
+       version = "0.1.0.0";
+       sha256 = "0gqmj28anzl596akgkqpgk5cd4b1ic2m6dxzv3hhnvifyxxflli8";
+       revision = "1";
+       editedCabalFile = "1w1zzsd87qzzad8yqq28hf5amg17i94x9snxvya4pn5raibn24sm";
+       libraryHaskellDepends = [ base dlist ];
+       description = "Multiple Exceptions";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
+     }) {};
+
   "multi-instance" = callPackage
     ({ mkDerivation, base, doctest }:
      mkDerivation {
···
        description = "Model-view-controller";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
        broken = true;
      }) {};
 
···
        description = "Concurrent and combinable updates";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "mvclient" = callPackage
···
        executableHaskellDepends = [ base ];
        description = "Netlink communication for Haskell";
        license = lib.licenses.bsd3;
+       platforms = [
+         "aarch64-linux" "armv7l-linux" "i686-linux" "x86_64-linux"
+       ];
      }) {};
 
   "netlist" = callPackage
···
        benchmarkHaskellDepends = [ attoparsec base criterion text ];
        description = "Parse and render *.drv files";
        license = lib.licenses.bsd3;
-       maintainers = with lib.maintainers; [ sorki ];
+       maintainers = with lib.maintainers; [ Gabriel439 sorki ];
      }) {};
 
   "nix-diff" = callPackage
···
        ];
        description = "Explain why two Nix derivations differ";
        license = lib.licenses.bsd3;
-       maintainers = with lib.maintainers; [ terlar ];
+       maintainers = with lib.maintainers; [ Gabriel439 terlar ];
      }) {};
 
   "nix-eval" = callPackage
···
        ];
        description = "Optics as an abstract interface";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ maralorn ];
      }) {};
 
   "optics_0_4" = callPackage
···
        description = "Optics as an abstract interface";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ maralorn ];
      }) {};
 
   "optics-core" = callPackage
···
        libraryHaskellDepends = [ base ];
        description = "Optional function arguments";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "options" = callPackage
···
        ];
        description = "Auto-generate a command-line parser for your datatype";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "optparse-helper" = callPackage
···
      }:
      mkDerivation {
        pname = "ordinal";
-       version = "0.4.0.0";
-       sha256 = "1k0hpp5p546zlvwsy1d8hypryfwqvqdifmk3cqifw3xsdrqv3d8y";
+       version = "0.4.0.3";
+       sha256 = "1ar7l68cx9zci7mi6qx7a6ja7vp9axxjczyzxrbnjrvd2k3zxg51";
        libraryHaskellDepends = [
-         base containers data-default regex template-haskell text time
-         vector
+         base containers data-default QuickCheck regex template-haskell text
+         time vector
        ];
        testHaskellDepends = [ base hspec QuickCheck text ];
        testToolDepends = [ hspec-discover ];
···
        license = lib.licenses.bsd3;
      }) {};
 
+  "pantry_0_5_2" = callPackage
+    ({ mkDerivation, aeson, ansi-terminal, base, bytestring, Cabal
+     , casa-client, casa-types, conduit, conduit-extra, containers
+     , cryptonite, cryptonite-conduit, digest, exceptions, filelock
+     , generic-deriving, hackage-security, hedgehog, hpack, hspec
+     , http-client, http-client-tls, http-conduit, http-download
+     , http-types, memory, mtl, network-uri, path, path-io, persistent
+     , persistent-sqlite, persistent-template, primitive, QuickCheck
+     , raw-strings-qq, resourcet, rio, rio-orphans, rio-prettyprint
+     , tar-conduit, text, text-metrics, time, transformers, unix-compat
+     , unliftio, unordered-containers, vector, yaml, zip-archive
+     }:
+     mkDerivation {
+       pname = "pantry";
+       version = "0.5.2";
+       sha256 = "0gg4fzqsh4c41vydrwr12kb8ahj0xy0vy7axwpd9j39dzxwcksnv";
+       libraryHaskellDepends = [
+         aeson ansi-terminal base bytestring Cabal casa-client casa-types
+         conduit conduit-extra containers cryptonite cryptonite-conduit
+         digest filelock generic-deriving hackage-security hpack http-client
+         http-client-tls http-conduit http-download http-types memory mtl
+         network-uri path path-io persistent persistent-sqlite
+         persistent-template primitive resourcet rio rio-orphans
+         rio-prettyprint tar-conduit text text-metrics time transformers
+         unix-compat unliftio unordered-containers vector yaml zip-archive
+       ];
+       testHaskellDepends = [
+         aeson ansi-terminal base bytestring Cabal casa-client casa-types
+         conduit conduit-extra containers cryptonite cryptonite-conduit
+         digest exceptions filelock generic-deriving hackage-security
+         hedgehog hpack hspec http-client http-client-tls http-conduit
+         http-download http-types memory mtl network-uri path path-io
+         persistent persistent-sqlite persistent-template primitive
+         QuickCheck raw-strings-qq resourcet rio rio-orphans rio-prettyprint
+         tar-conduit text text-metrics time transformers unix-compat
+         unliftio unordered-containers vector yaml zip-archive
+       ];
+       description = "Content addressable Haskell package management";
+       license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "pantry-tmp" = callPackage
     ({ mkDerivation, aeson, ansi-terminal, array, base, base-orphans
      , base64-bytestring, bytestring, Cabal, conduit, conduit-extra
···
        libraryHaskellDepends = [ array base ];
        description = "Simply interfacing the parallel port on linux";
        license = "GPL";
+       platforms = [
+         "aarch64-linux" "armv7l-linux" "i686-linux" "x86_64-linux"
+       ];
      }) {};
 
   "parquet-hs" = callPackage
···
        ];
        description = "Hashing and checking of passwords";
        license = lib.licenses.bsd3;
+       platforms = [ "i686-linux" "x86_64-darwin" "x86_64-linux" ];
+       maintainers = with lib.maintainers; [ cdepillabout ];
      }) {};
 
   "password-instances" = callPackage
···
        ];
        description = "typeclass instances for password package";
        license = lib.licenses.bsd3;
+       platforms = [ "i686-linux" "x86_64-darwin" "x86_64-linux" ];
+       maintainers = with lib.maintainers; [ cdepillabout ];
      }) {};
 
   "password-types" = callPackage
···
        ];
        description = "Serialization library with state and leb128 encoding";
        license = lib.licenses.bsd3;
+       platforms = [ "i686-linux" "x86_64-darwin" "x86_64-linux" ];
      }) {};
 
   "persist2er" = callPackage
···
        maintainers = with lib.maintainers; [ psibi ];
      }) {};
 
-  "persistent_2_13_0_0" = callPackage
+  "persistent_2_13_0_1" = callPackage
     ({ mkDerivation, aeson, attoparsec, base, base64-bytestring
      , blaze-html, bytestring, conduit, containers, criterion, deepseq
      , deepseq-generics, fast-logger, file-embed, hspec, http-api-data
···
      }:
      mkDerivation {
        pname = "persistent";
-       version = "2.13.0.0";
-       sha256 = "1addkfiaixk076qkdlhjmx97f8bgfmxwna9dv0h7hfvnq8v35bkf";
-       revision = "2";
-       editedCabalFile = "12ylw4rzrjlk2m0qfgqx481k0ifhv5i8z0vy70knjrkgx8d9sfvx";
+       version = "2.13.0.1";
+       sha256 = "0yvipx9y33pr1vz7818w2ylr5zf9bmng8ka70mdb4f563l4ynp96";
        libraryHaskellDepends = [
          aeson attoparsec base base64-bytestring blaze-html bytestring
          conduit containers fast-logger http-api-data lift-type monad-logger
···
        ];
        description = "Compositional pipelines";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "pipes-aeson" = callPackage
···
        ];
        description = "ByteString support for pipes";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "pipes-bzip" = callPackage
···
        testHaskellDepends = [ async base pipes stm ];
        description = "Concurrency for the pipes ecosystem";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "pipes-conduit" = callPackage
···
        ];
        description = "Fast, streaming csv parser";
        license = lib.licenses.mit;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "pipes-errors" = callPackage
···
        ];
        description = "Extra utilities for pipes";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "pipes-fastx" = callPackage
···
        testHaskellDepends = [ base doctest lens-family-core ];
        description = "Group streams into substreams";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "pipes-http" = callPackage
···
        ];
        description = "HTTP client with pipes interface";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "pipes-illumina" = callPackage
···
        libraryHaskellDepends = [ base pipes transformers ];
        description = "Parsing infrastructure for the pipes ecosystem";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "pipes-postgresql-simple" = callPackage
···
        ];
        description = "Safety for the pipes ecosystem";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "pipes-shell" = callPackage
···
        ];
        description = "Example binaries for plot-light";
        license = lib.licenses.bsd3;
+     }) {};
+
+  "ploterific" = callPackage
+    ({ mkDerivation, base, bytestring, cassava, containers, hvega
+     , hvega-theme, lens, mtl, optparse-generic, text
+     }:
+     mkDerivation {
+       pname = "ploterific";
+       version = "0.1.0.1";
+       sha256 = "03m0zi7izlv8n5jsisym595sn7cfl2p1mhch086ajyd2g6zlxya7";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         base bytestring cassava containers hvega hvega-theme lens mtl
+         optparse-generic text
+       ];
+       executableHaskellDepends = [ base mtl optparse-generic text ];
+       description = "Basic plotting of tabular data for the command line";
+       license = lib.licenses.gpl3Only;
      }) {};
 
   "plotfont" = callPackage
···
        license = lib.licenses.asl20;
      }) {};
 
+  "proto3-wire_1_2_2" = callPackage
+    ({ mkDerivation, base, bytestring, cereal, containers, deepseq
+     , doctest, ghc-prim, hashable, parameterized, primitive, QuickCheck
+     , safe, tasty, tasty-hunit, tasty-quickcheck, text, transformers
+     , unordered-containers, vector
+     }:
+     mkDerivation {
+       pname = "proto3-wire";
+       version = "1.2.2";
+       sha256 = "1fdzml0nsbz1bqf3lskvmfn46pgl5rnrc4b7azq8f0csm0v9ah4d";
+       libraryHaskellDepends = [
+         base bytestring cereal containers deepseq ghc-prim hashable
+         parameterized primitive QuickCheck safe text transformers
+         unordered-containers vector
+       ];
+       testHaskellDepends = [
+         base bytestring cereal doctest QuickCheck tasty tasty-hunit
+         tasty-quickcheck text transformers vector
+       ];
+       description = "A low-level implementation of the Protocol Buffers (version 3) wire format";
+       license = lib.licenses.asl20;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "protobuf" = callPackage
     ({ mkDerivation, base, base-orphans, bytestring, cereal, containers
      , data-binary-ieee754, deepseq, hex, HUnit, mtl, QuickCheck, tagged
···
        doCheck = false;
        description = "Easy-to-use, type-safe, expandable, high-level HTTP client library";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ maralorn ];
      }) {};
 
   "req-conduit" = callPackage
···
        ];
        description = "Generates unique passwords for various websites from a single password";
        license = lib.licenses.bsd3;
+       platforms = [ "i686-linux" "x86_64-darwin" "x86_64-linux" ];
      }) {};
 
   "scc" = callPackage
···
        ];
        description = "Stronger password hashing via sequential memory-hard functions";
        license = lib.licenses.bsd3;
+       platforms = [ "i686-linux" "x86_64-darwin" "x86_64-linux" ];
      }) {};
 
   "scrz" = callPackage
···
        description = "Auto-generate a server for your datatype";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
        broken = true;
      }) {};
 
···
        ];
        description = "Top-level package for the Snap Web Framework";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ maralorn ];
      }) {};
 
   "snap-accept" = callPackage
···
        ];
        description = "Beautiful Streaming, Concurrent and Reactive Composition";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ maralorn ];
      }) {};
 
   "streamly-archive" = callPackage
···
     ({ mkDerivation, base, bytestring, text }:
      mkDerivation {
        pname = "string-like";
-       version = "0.1.0.0";
-       sha256 = "1b87532fhv2wn6pnzsaw20lzj5j399smlfn7lai0h0ph2axb2dbi";
+       version = "0.1.0.1";
+       sha256 = "1sadf4cdxs3ilax99w1yvkfz2v1n77rj9grck4csjbwswxw2d2dn";
        libraryHaskellDepends = [ base bytestring text ];
        description = "A package that aims to provide a uniform interface to string-like types";
        license = lib.licenses.bsd3;
···
        platforms = [
          "aarch64-linux" "armv7l-linux" "i686-linux" "x86_64-linux"
        ];
+       maintainers = with lib.maintainers; [ cdepillabout ];
      }) {inherit (pkgs) gtk3; inherit (pkgs) pcre2; 
          vte_291 = pkgs.vte;};
 
···
        libraryHaskellDepends = [ base void ];
        description = "Exhaustive pattern matching using lenses, traversals, and prisms";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "total-alternative" = callPackage
···
        benchmarkHaskellDepends = [ base criterion text ];
        description = "Shell programming, Haskell-style";
        license = lib.licenses.bsd3;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "turtle-options" = callPackage
···
        license = lib.licenses.bsd3;
      }) {};
 
+  "twain" = callPackage
+    ({ mkDerivation, aeson, base, bytestring, case-insensitive, cookie
+     , either, http-types, text, time, transformers, wai, wai-extra
+     , warp
+     }:
+     mkDerivation {
+       pname = "twain";
+       version = "1.0.0.0";
+       sha256 = "0brxvqddnhxs4q5hm9g8fzkznk3xjagivy0glfiqrx24p4k8s9yb";
+       libraryHaskellDepends = [
+         aeson base bytestring case-insensitive cookie either http-types
+         text time transformers wai wai-extra warp
+       ];
+       description = "Tiny web application framework for WAI";
+       license = lib.licenses.bsd3;
+     }) {};
+
   "tweak" = callPackage
     ({ mkDerivation, base, containers, lens, stm, transformers }:
      mkDerivation {
···
        description = "Typed and composable spreadsheets";
        license = lib.licenses.bsd3;
        hydraPlatforms = lib.platforms.none;
+       maintainers = with lib.maintainers; [ Gabriel439 ];
      }) {};
 
   "typed-streams" = callPackage
···
        ];
        description = "Testing library for Yampa";
        license = lib.licenses.bsd3;
+       hydraPlatforms = lib.platforms.none;
+       broken = true;
      }) {};
 
   "yampa2048" = callPackage
···
        license = lib.licenses.mit;
      }) {};
 
+  "yesod-auth-oauth2_0_6_3_1" = callPackage
+    ({ mkDerivation, aeson, base, bytestring, cryptonite, errors
+     , hoauth2, hspec, http-client, http-conduit, http-types, memory
+     , microlens, mtl, safe-exceptions, text, unliftio, uri-bytestring
+     , yesod-auth, yesod-core
+     }:
+     mkDerivation {
+       pname = "yesod-auth-oauth2";
+       version = "0.6.3.1";
+       sha256 = "1q49a99n2h1b06zm0smqqxr9jr487b14cf8xmayvkqr0q1q5xrwa";
+       isLibrary = true;
+       isExecutable = true;
+       libraryHaskellDepends = [
+         aeson base bytestring cryptonite errors hoauth2 http-client
+         http-conduit http-types memory microlens mtl safe-exceptions text
+         unliftio uri-bytestring yesod-auth yesod-core
+       ];
+       testHaskellDepends = [ base hspec uri-bytestring ];
+       description = "OAuth 2.0 authentication plugins";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
+     }) {};
+
   "yesod-auth-pam" = callPackage
     ({ mkDerivation, base, hamlet, pam, text, yesod-auth, yesod-core
      , yesod-form
···
        ];
        description = "Creation of type-safe, RESTful web applications";
        license = lib.licenses.mit;
+     }) {};
+
+  "yesod-core_1_6_20" = callPackage
+    ({ mkDerivation, aeson, async, auto-update, base, blaze-html
+     , blaze-markup, bytestring, case-insensitive, cereal, clientsession
+     , conduit, conduit-extra, containers, cookie, deepseq, entropy
+     , fast-logger, gauge, hspec, hspec-expectations, http-types, HUnit
+     , memory, monad-logger, mtl, network, parsec, path-pieces
+     , primitive, random, resourcet, shakespeare, streaming-commons
+     , template-haskell, text, time, transformers, unix-compat, unliftio
+     , unordered-containers, vector, wai, wai-extra, wai-logger, warp
+     , word8
+     }:
+     mkDerivation {
+       pname = "yesod-core";
+       version = "1.6.20";
+       sha256 = "1f3imbd22i9vl30760063p308byddwxafpl5hdric2z7vmnxayqy";
+       libraryHaskellDepends = [
+         aeson auto-update base blaze-html blaze-markup bytestring
+         case-insensitive cereal clientsession conduit conduit-extra
+         containers cookie deepseq entropy fast-logger http-types memory
+         monad-logger mtl parsec path-pieces primitive random resourcet
+    ({ mkDerivation, base, bytestring, bytestring-nums, bytestring-trie
+         unliftio unordered-containers vector wai wai-extra wai-logger warp
+         word8
+       ];
+       testHaskellDepends = [
+         async base bytestring clientsession conduit conduit-extra
+         containers cookie hspec hspec-expectations http-types HUnit network
+         path-pieces random resourcet shakespeare streaming-commons
+         template-haskell text transformers unliftio wai wai-extra warp
+       ];
+       benchmarkHaskellDepends = [
+         base blaze-html bytestring gauge shakespeare text
+       ];
+       description = "Creation of type-safe, RESTful web applications";
+       license = lib.licenses.mit;
+       hydraPlatforms = lib.platforms.none;
      }) {};
 
   "yesod-crud" = callPackage

pkgs/development/haskell-modules/patches/hnix-ref-tf-0.5-support.patch

···
-diff '--color=auto' '--color=never' -r --unified hnix-0.12.0.1/hnix.cabal hnix-patched/hnix.cabal
---- hnix-0.12.0.1/hnix.cabal	2001-09-09 03:46:40.000000000 +0200
-+++ hnix-patched/hnix.cabal	2021-05-05 12:07:38.388267353 +0200
-@@ -430,7 +430,7 @@
-     , parser-combinators >= 1.0.1 && < 1.3
-     , prettyprinter >= 1.7.0 && < 1.8
-     , process >= 1.6.3 && < 1.7
--    , ref-tf >= 0.4.0 && < 0.5
-+    , ref-tf >= 0.5
-     , regex-tdfa >= 1.2.3 && < 1.4
-     , scientific >= 0.3.6 && < 0.4
-     , semialign >= 1 && < 1.2
-diff '--color=auto' '--color=never' -r --unified hnix-0.12.0.1/src/Nix/Fresh.hs hnix-patched/src/Nix/Fresh.hs
---- hnix-0.12.0.1/src/Nix/Fresh.hs	2001-09-09 03:46:40.000000000 +0200
-+++ hnix-patched/src/Nix/Fresh.hs	2021-05-05 12:07:45.841267497 +0200
-@@ -65,18 +65,3 @@
- 
- runFreshIdT :: Functor m => Var m i -> FreshIdT i m a -> m a
- runFreshIdT i m = runReaderT (unFreshIdT m) i
--
---- Orphan instance needed by Infer.hs and Lint.hs
--
---- Since there's no forking, it's automatically atomic.
--instance MonadAtomicRef (ST s) where
--  atomicModifyRef r f = do
--    v <- readRef r
--    let (a, b) = f v
--    writeRef r a
--    return b
--  atomicModifyRef' r f = do
--    v <- readRef r
--    let (a, b) = f v
--    writeRef r $! a
--    return b

pkgs/development/libraries/gensio/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "gensio";
-  version = "2.2.4";
+  version = "2.2.5";
 
   src = fetchFromGitHub {
     owner = "cminyard";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tdMdIudB8zZWXF+Q0YhFo9Q4VHjLJh3rdfQsYhgo2DU=";
+    sha256 = "sha256-QC07NGgZa++qHyGZY3fjosjJVuRFfc7HYmdGxQHAz4s=";
   };
 
   passthru = {

pkgs/development/libraries/gtk-sharp/3.0.nix

···
       url = "https://github.com/mono/gtk-sharp/commit/401df51bc461de93c1a78b6a7a0d5adc63cf186c.patch";
       sha256 = "0hrkcr5a7wkixnyp60v4d6j3arsb63h54rd30lc5ajfjb3p92kcf";
     })
+    # @see https://github.com/mono/gtk-sharp/pull/263
+    (fetchpatch {
+      name = "disambiguate_Gtk.Range.patch";
+      url = "https://github.com/mono/gtk-sharp/commit/a00552ad68ae349e89e440dca21b86dbd6bccd30.patch";
+      sha256 = "1ylplr9g9x7ybsgrydsgr6p3g7w6i46yng1hnl3afgn4vj45rag2";
+    })
   ];
 
   dontStrip = true;

pkgs/development/libraries/libspnav/default.nix

···
-{ stdenv, lib, fetchFromGitHub, libX11}:
+{ stdenv, lib, fetchFromGitHub, libX11, fixDarwinDylibNames }:
 
 stdenv.mkDerivation rec {
   version = "0.2.3";
···
     sha256 = "098h1jhlj87axpza5zgy58prp0zn94wyrbch6x0s7q4mzh7dc8ba";
   };
 
+  nativeBuildInputs = lib.optional stdenv.isDarwin fixDarwinDylibNames;
   buildInputs = [ libX11 ];
 
   configureFlags = [ "--disable-debug"];

pkgs/development/python-modules/brother/default.nix

···
 
 buildPythonPackage rec {
   pname = "brother";
-  version = "1.0.1";
+  version = "1.0.2";
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Cfut6Y4Hln32g4V13xbOo5JdjPv2cH6FCDqvRRyijIA=";
+    sha256 = "sha256-xs/GIsJUuKKbDotV1BeT/ng86UVkNsH48uHR4i3vqow=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/clickhouse-driver/default.nix

···
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , setuptools
 , pytz
 , tzlocal
···
 , freezegun
 , mock
 , nose
+, pytestCheckHook
+, pytest-xdist
 }:
 
 buildPythonPackage rec {
   pname = "clickhouse-driver";
   version = "0.2.0";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "62d37f93872d5a13eb6b0d52bab2b593ed0e14cf9200949aa2d02f9801064c0f";
+  # pypi source doesn't contain tests
+  src = fetchFromGitHub {
+    owner = "mymarilyn";
+    repo = "clickhouse-driver";
+    rev = "96b7ba448c63ca2670cc9aa70d4a0e08826fb650";
+    sha256 = "sha256-HFKUxJOlBCVlu7Ia8heGpwX6+HdKuwSy92s3v+GKGwE=";
   };
 
   propagatedBuildInputs = [
···
     freezegun
     mock
     nose
+    pytest-xdist
+    pytestCheckHook
   ];
 
-  doCheck = true;
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "lz4<=3.0.1" "lz4<=4"
+  '';
+
+  # remove source to prevent pytest testing source instead of the build artifacts
+  # (the source doesn't contain the extension modules)
+  preCheck = ''
+    rm -rf clickhouse_driver
+  '';
+
+  # some test in test_buffered_reader.py doesn't seem to return
+  disabledTestPaths = [ "tests/test_buffered_reader.py" ];
+
+  pytestFlagsArray = [ "-n" "$NIX_BUILD_CORES" ];
+
+  # most tests require `clickhouse`
+  # TODO: enable tests after `clickhouse` unbroken
+  doCheck = false;
+
   pythonImportsCheck = [ "clickhouse_driver" ];
 
   meta = with lib; {

pkgs/development/python-modules/flask-appbuilder/default.nix

···
 { lib
 , buildPythonPackage
 , fetchPypi
-, nose
 , apispec
 , colorama
 , click
···
 
 buildPythonPackage rec {
   pname = "flask-appbuilder";
-  version = "3.2.3";
+  version = "3.3.0";
 
   src = fetchPypi {
     pname = "Flask-AppBuilder";
     inherit version;
-    sha256 = "sha256-+ZYrn2LnVORyYsnZtsH3JX+4XbGgAZZ/Eh6O5gUP+y4=";
+    sha256 = "00dsfv1apl6483wy20aj91f9h5ak2casbx5vcajv2nd3i7c7v8gx";
   };
 
   patches = [
+    # https://github.com/dpgaspar/Flask-AppBuilder/pull/1610
     (fetchpatch {
       name = "flask_jwt_extended-and-pyjwt-patch";
       url = "https://github.com/dpgaspar/Flask-AppBuilder/commit/7097a7b133f27c78d2b54d2a46e4a4c24478a066.patch";
···
       --replace "marshmallow-sqlalchemy>=0.22.0, <0.24.0" "marshmallow-sqlalchemy >=0.22.0, <0.25.0"
   '';
 
-  # majority of tests require network access or mongo
+  # Majority of tests require network access or mongo
   doCheck = false;
 
   pythonImportsCheck = [ "flask_appbuilder" ];

pkgs/development/python-modules/karton-asciimagic/default.nix

···
 
 buildPythonPackage rec {
   pname = "karton-asciimagic";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0yvd0plpwy5qkd2jljpd6wm6dlj2g8csvj1q2md23vsgx7h7v2vm";
+    sha256 = "0d15fhb3y0jpwdfm4y11i6pmfa9szr943cm6slvf0ir31f9nznyz";
   };
 
   propagatedBuildInputs = [
     karton-core
   ];
-
-  postPatch = ''
-    substituteInPlace requirements.txt \
-      --replace "karton.core==4.0.5" "karton-core"
-  '';
 
   checkPhase = ''
     runHook preCheck

pkgs/development/python-modules/karton-classifier/default.nix

···
 
 buildPythonPackage rec {
   pname = "karton-classifier";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = pname;
     rev = "v${version}";
-    sha256 = "05pxv0smrzgmljykc6yx0rx8b85ck7fa09xjkjw0dd7lb6bb19a6";
+    sha256 = "0s09mzsw546klnvm59wzj9vdwd2hyzgxvapi20k86q3prs9ncds6";
   };
 
   propagatedBuildInputs = [
···
   postPatch = ''
     substituteInPlace requirements.txt \
       --replace "chardet==3.0.4" "chardet" \
-      --replace "karton-core==4.0.4" "karton-core" \
       --replace "python-magic==0.4.18" "python-magic"
   '';
 

pkgs/development/python-modules/karton-config-extractor/default.nix

···
 
 buildPythonPackage rec {
   pname = "karton-config-extractor";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vijyqki2x813H2xbmz2JIXlh87J5l6NFoZcOu8xi61o=";
+    sha256 = "1kq0gbfz9y0n0bcblyrmwv4la3lcf86lf80794sdvyvn49g0brny";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/karton-dashboard/default.nix

···
 
 buildPythonPackage rec {
   pname = "karton-dashboard";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = pname;
     rev = "v${version}";
-    sha256 = "101qmx6nmiim0vrz2ldk973ns498hnxla1xy7nys9kh9wijg4msk";
+    sha256 = "0qygv9lkd1jad5b4l0zz6hsi7m8q0fmpwaa6hpp7p9x6ql7gnyl8";
   };
 
   propagatedBuildInputs = [
···
 
   postPatch = ''
     substituteInPlace requirements.txt \
-      --replace "Flask==1.1.1" "Flask" \
-      --replace "karton-core==4.1.0" "karton-core"
+      --replace "Flask==1.1.1" "Flask"
   '';
 
   # Project has no tests. pythonImportsCheck requires MinIO configuration

pkgs/development/python-modules/karton-mwdb-reporter/default.nix

···
 
 buildPythonPackage rec {
   pname = "karton-mwdb-reporter";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "CERT-Polska";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ks8jrc4v87q6zhwqg40w6xv2wfkzslmnfmsmmkfjj8mak8nk70f";
+    sha256 = "0jrn5c83nhcjny4bc879wrsgcr7mbazm51jzdkxmxyqf543cc841";
   };
 
   propagatedBuildInputs = [
···
 
   postPatch = ''
     substituteInPlace requirements.txt \
-      --replace "karton-core==4.0.4" "karton-core" \
-      --replace "mwdblib==3.3.1" "mwdblib"
+      --replace "mwdblib==3.4.0" "mwdblib"
   '';
 
   # Project has no tests

pkgs/development/python-modules/pyflume/default.nix

···
 
 buildPythonPackage rec {
   pname = "pyflume";
-  version = "0.6.4";
+  version = "0.7.0";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ChrisMandich";
     repo = "PyFlume";
     rev = "v${version}";
-    sha256 = "1dm560hh6fl1waiwsq8m31apmvvwhc3y95bfdb7449bs8k96dmxq";
+    sha256 = "129sz33a270v120bzl9l98nmvdzn7ns4cf9w2v18lmzlldbyz2vn";
   };
 
   prePatch = ''

pkgs/development/python-modules/pysonos/default.nix

···
 
 buildPythonPackage rec {
   pname = "pysonos";
-  version = "0.0.46";
+  version = "0.0.49";
 
   disabled = !isPy3k;
 
···
     owner = "amelchio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-5vQBSKDgzwdWkyGduq2cWa7Eq5l01gbs236H2Syc/Dc=";
+    sha256 = "sha256-f8MBf2E7kHzvdt7oBwdJZ91jlU6I5np1FhOmxgxbqYw=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/pythonnet/default.nix

···
 , fetchPypi
 , fetchNuGet
 , buildPythonPackage
-, python
-, pytest
+, pytestCheckHook
 , pycparser
 , psutil
 , pkg-config
···
 
 let
 
-  UnmanagedExports127 = fetchNuGet {
-    baseName = "UnmanagedExports";
-    version = "1.2.7";
-    sha256 = "0bfrhpmq556p0swd9ssapw4f2aafmgp930jgf00sy89hzg2bfijf";
-    outputFiles = [ "*" ];
-  };
-
-  NUnit371 = fetchNuGet {
-    baseName = "NUnit";
-    version = "3.7.1";
-    sha256 = "1yc6dwaam4w2ss1193v735nnl79id78yswmpvmjr1w4bgcbdza4l";
-    outputFiles = [ "*" ];
-  };
+  dotnetPkgs = [
+    (fetchNuGet {
+      baseName = "UnmanagedExports";
+      version = "1.2.7";
+      sha256 = "0bfrhpmq556p0swd9ssapw4f2aafmgp930jgf00sy89hzg2bfijf";
+      outputFiles = [ "*" ];
+    })
+    (fetchNuGet {
+      baseName = "NUnit";
+      version = "3.12.0";
+      sha256 = "1880j2xwavi8f28vxan3hyvdnph4nlh5sbmh285s4lc9l0b7bdk2";
+      outputFiles = [ "*" ];
+    })
+    (fetchNuGet {
+      baseName = "System.ValueTuple";
+      version = "4.5.0";
+      sha256 = "00k8ja51d0f9wrq4vv5z2jhq8hy31kac2rg0rv06prylcybzl8cy";
+      outputFiles = [ "*" ];
+    })
+  ];
 
 in
 
 buildPythonPackage rec {
   pname = "pythonnet";
-  version = "2.4.0";
+  version = "2.5.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1ach9jic7a9rd3vmc4bphkr9fq01a0qk81f8a7gr9npwzmkqx8x3";
+    sha256 = "1qzdc6jd7i9j7p6bcihnr98y005gv1358xqdr1plpbpnl6078a5p";
   };
 
   postPatch = ''
···
   '';
 
   nativeBuildInputs = [
-    pytest
     pycparser
 
     pkg-config
···
 
     mono
 
-    NUnit371
-    UnmanagedExports127
-  ];
+  ] ++ dotnetPkgs;
 
   buildInputs = [
     glib
     mono
+  ];
+
+  checkInputs = [
+    pytestCheckHook
     psutil # needed for memory leak tests
   ];
 
···
     rm -rf packages
     mkdir packages
 
-    ln -s ${NUnit371}/lib/dotnet/NUnit/ packages/NUnit.3.7.1
-    ln -s ${UnmanagedExports127}/lib/dotnet/NUnit/ packages/UnmanagedExports.1.2.7
+    ${builtins.concatStringsSep "\n" (
+        builtins.map (
+            x: ''ln -s ${x}/lib/dotnet/${x.baseName} ./packages/${x.baseName}.${x.version}''
+          ) dotnetPkgs)}
 
     # Setting TERM=xterm fixes an issue with terminfo in mono: System.Exception: Magic number is wrong: 542
     export TERM=xterm
   '';
 
-  checkPhase = ''
-    ${python.interpreter} -m pytest
-  '';
-
   meta = with lib; {
     description = ".Net and Mono integration for Python";
     homepage = "https://pythonnet.github.io";
     license = licenses.mit;
+    # <https://github.com/pythonnet/pythonnet/issues/898>
+    badPlatforms = [ "aarch64-linux" ];
     maintainers = with maintainers; [ jraygauthier ];
-    broken = true;
   };
 }

pkgs/development/python-modules/requests-http-signature/default.nix

···
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, requests
 , cryptography
-, python
+, requests
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "requests-http-signature";
-  version = "0.1.0";
+  version = "0.2.0";
 
   # .pem files for tests aren't present on PyPI
   src = fetchFromGitHub {
     owner = "pyauth";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0y96wsbci296m1rcxx0ybx8r44rdvyb59p1jl27p7rgz7isr3kx1";
+    sha256 = "1jsplqrxadjsc86f0kb6dgpblgwplxrpi0ql1a714w8pbbz4z3h7";
   };
 
-  propagatedBuildInputs = [ requests cryptography ];
+  propagatedBuildInputs = [
+    cryptography
+    requests
+  ];
 
-  checkPhase = ''
-    ${python.interpreter} test/test.py
-  '';
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [ "test/test.py" ];
+
+  disabledTests = [
+    # Test require network access
+    "test_readme_example"
+  ];
+
+  pythonImportsCheck = [ "requests_http_signature" ];
 
   meta = with lib; {
     description = "A Requests auth module for HTTP Signature";

pkgs/development/python-modules/sphinxcontrib-actdiag/default.nix

···
+{ lib
+, buildPythonPackage
+, fetchPypi
+, sphinx
+, actdiag
+, blockdiag
+}:
+
+buildPythonPackage rec {
+  pname = "sphinxcontrib-actdiag";
+  version = "2.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-TtuFZOLkig4MULLndDQlrTTx8RiGw34MsjmXoPladMY=";
+  };
+
+  propagatedBuildInputs = [ sphinx actdiag blockdiag ];
+
+  pythonImportsCheck = [ "sphinxcontrib.actdiag" ];
+
+  meta = with lib; {
+    description = "Sphinx actdiag extension";
+    homepage = "https://github.com/blockdiag/sphinxcontrib-actdiag";
+    maintainers = with maintainers; [ davidtwco ];
+    license = licenses.bsd2;
+  };
+}

pkgs/development/python-modules/sphinxcontrib-nwdiag/default.nix

···
+{ lib
+, buildPythonPackage
+, fetchPypi
+, sphinx
+, blockdiag
+, nwdiag
+}:
+
+buildPythonPackage rec {
+  pname = "sphinxcontrib-nwdiag";
+  version = "2.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-bula1DutRv6NwfZRhciZfLHRZmXu42p+qvbeExN/+Fk=";
+  };
+
+  propagatedBuildInputs = [ sphinx blockdiag nwdiag ];
+
+  pythonImportsCheck = [ "sphinxcontrib.nwdiag" ];
+
+  meta = with lib; {
+    description = "Sphinx nwdiag extension";
+    homepage = "https://github.com/blockdiag/sphinxcontrib-nwdiag";
+    maintainers = with maintainers; [ davidtwco ];
+    license = licenses.bsd2;
+  };
+}

pkgs/development/python-modules/sphinxcontrib-seqdiag/default.nix

···
+{ lib
+, buildPythonPackage
+, fetchPypi
+, sphinx
+, blockdiag
+, seqdiag
+}:
+
+buildPythonPackage rec {
+  pname = "sphinxcontrib-seqdiag";
+  version = "2.0.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-THJ1ra/W2X/lQaDjGbL27VMn0lWPJApwgKMrPhL0JY0=";
+  };
+
+  propagatedBuildInputs = [ sphinx blockdiag seqdiag ];
+
+  pythonImportsCheck = [ "sphinxcontrib.seqdiag" ];
+
+  meta = with lib; {
+    description = "Sphinx seqdiag extension";
+    homepage = "https://github.com/blockdiag/sphinxcontrib-seqdiag";
+    maintainers = with maintainers; [ davidtwco ];
+    license = licenses.bsd2;
+  };
+}

pkgs/development/python-modules/stem/default.nix

···
   postPatch = ''
     rm test/unit/installation.py
     sed -i "/test.unit.installation/d" test/settings.cfg
+    # https://github.com/torproject/stem/issues/56
+    sed -i '/MOCK_VERSION/d' run_tests.py
   '';
 
   checkInputs = [ mock ];

pkgs/development/python-modules/zeroconf/default.nix

···
 
 buildPythonPackage rec {
   pname = "zeroconf";
-  version = "0.30.0";
+  version = "0.31.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-elpjZq4FpI2wTf1ciILumKE/LQ4fxtCaXxvQo9HRCcc=";
+    sha256 = "sha256-U6GAJIRxxvgb0f/8vOA+2T19jq8QkFyRIaweqZbRmEQ=";
   };
 
   propagatedBuildInputs = [ ifaddr ];

pkgs/development/r-modules/default.nix

···
   packagesWithBuildInputs = {
     # sort -t '=' -k 2
     gam = lib.optionals stdenv.isDarwin [ pkgs.libiconv ];
+    RcppArmadillo = lib.optionals stdenv.isDarwin [ pkgs.libiconv ];
     quantreg = lib.optionals stdenv.isDarwin [ pkgs.libiconv ];
     rmutil = lib.optionals stdenv.isDarwin [ pkgs.libiconv ];
     robustbase = lib.optionals stdenv.isDarwin [ pkgs.libiconv ];

pkgs/development/tools/analysis/nix-linter/default.nix

···
 , containers
 , hnix
 , bytestring
+, fetchpatch
 }:
 
 mkDerivation rec {
···
   executableHaskellDepends = [ streamly mtl path pretty-terminal text base aeson cmdargs containers hnix bytestring path-io ];
   testHaskellDepends = [ tasty tasty-hunit tasty-th ];
 
-  # Relax upper bound on hnix https://github.com/Synthetica9/nix-linter/pull/46
-  postPatch = ''
-    substituteInPlace nix-linter.cabal --replace "hnix >=0.8 && < 0.11" "hnix >=0.8"
-  '';
+  patches = [
+    # Fix compatibility with hnix≥0.13.0 https://github.com/Synthetica9/nix-linter/pull/51
+    (fetchpatch {
+      url = "https://github.com/Synthetica9/nix-linter/commit/f73acacd8623dc25c9a35f8e04e4ff33cc596af8.patch";
+      sha256 = "139fm21hdg3vcw8hv35kxj4awd52bjqbb76mpzx191hzi9plj8qc";
+    })
+  ];
 
   description = "Linter for Nix(pkgs), based on hnix";
   homepage = "https://github.com/Synthetica9/nix-linter";

pkgs/development/tools/luaformatter/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "luaformatter";
-  version = "1.3.5";
+  version = "1.3.6";
 
   src = fetchFromGitHub {
     owner = "koihik";
     repo = "luaformatter";
     rev = version;
-    sha256 = "sha256-TMo6zRfhVAXVh0tIC0PecaJCKr0ev45jOKm2+reTtS4=";
+    sha256 = "0440kdab5i0vhlk71sbprdrhg362al8jqpy7w2vdhcz1fpi5cm0b";
     fetchSubmodules = true;
   };
 

pkgs/development/tools/misc/texlab/default.nix

···
 , rustPlatform
 , fetchFromGitHub
 , installShellFiles
+, libiconv
 , Security
+, CoreServices
 }:
 
 rustPlatform.buildRustPackage rec {
···
 
   nativeBuildInputs = [ installShellFiles ];
 
-  buildInputs = lib.optionals stdenv.isDarwin [ Security ];
+  buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security CoreServices ];
 
   postInstall = ''
     installManPage texlab.1
···
     # links to the generated rlib and doesn't reference the dylib. I
     # couldn't find any way to prevent building this by passing cargo flags.
     # See https://gitlab.com/Kanedias/html2md/-/blob/0.2.10/Cargo.toml#L20
-    rm "$out/lib/libhtml2md.so"
+    rm "$out/lib/libhtml2md${stdenv.hostPlatform.extensions.sharedLibrary}"
     rmdir "$out/lib"
- '';
+  '';
 
   meta = with lib; {
     description = "An implementation of the Language Server Protocol for LaTeX";

pkgs/development/tools/ocaml/dune/1.nix

···
 
 if !lib.versionAtLeast ocaml.version "4.02"
 || lib.versionAtLeast ocaml.version "4.12"
-then throw "dune is not available for OCaml ${ocaml.version}"
+then throw "dune 1 is not available for OCaml ${ocaml.version}"
 else
 
 stdenv.mkDerivation rec {

pkgs/development/tools/ocaml/dune/2.nix

···
 { lib, stdenv, fetchurl, ocaml, findlib }:
 
 if lib.versionOlder ocaml.version "4.08"
-then throw "dune is not available for OCaml ${ocaml.version}"
+then throw "dune 2 is not available for OCaml ${ocaml.version}"
 else
 
 stdenv.mkDerivation rec {

pkgs/development/tools/scenebuilder/default.nix

···
-{ lib, stdenv, fetchFromGitHub, jdk, gradleGen, makeDesktopItem, copyDesktopItems, perl, writeText, runtimeShell, makeWrapper, glib, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, jdk11, gradleGen, makeDesktopItem, copyDesktopItems, perl, writeText, runtimeShell, makeWrapper, glib, wrapGAppsHook }:
 let
-  # The default one still uses jdk8 (#89731)
-  gradle = (gradleGen.override (old: { java = jdk; })).gradle_6_8;
+  gradle = (gradleGen.override (old: { java = jdk11; })).gradle_6_8;
 
   pname = "scenebuilder";
   version = "15.0.1";
···
     name = "${pname}-deps";
     inherit src;
 
-    nativeBuildInputs = [ jdk perl gradle ];
+    nativeBuildInputs = [ jdk11 perl gradle ];
 
     buildPhase = ''
       export GRADLE_USER_HOME=$(mktemp -d);
···
 in stdenv.mkDerivation rec {
   inherit pname src version;
 
-  nativeBuildInputs = [ jdk gradle makeWrapper glib wrapGAppsHook ];
+  nativeBuildInputs = [ jdk11 gradle makeWrapper glib wrapGAppsHook ];
 
   dontWrapGApps = true; # prevent double wrapping
 
···
   '';
 
   postFixup = ''
-    makeWrapper ${jdk}/bin/java $out/bin/${pname} --add-flags "-jar $out/share/${pname}/${pname}.jar" "''${gappsWrapperArgs[@]}"
+    makeWrapper ${jdk11}/bin/java $out/bin/${pname} --add-flags "-jar $out/share/${pname}/${pname}.jar" "''${gappsWrapperArgs[@]}"
     '';
 
   desktopItems = [ desktopItem ];

pkgs/development/web/cog/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "cog";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "igalia";
     repo = "cog";
     rev = "v${version}";
-    sha256 = "sha256-E6rACj25rdV5dww91PzYEX1r2A9YLNgAVyiYceP1KI8=";
+    sha256 = "sha256-eF7rvOjZntcMmn622342yqfp4ksZ6R/FFBT36bYCViE=";
   };
 
   buildInputs = [

pkgs/development/web/deno/default.nix

···
 , CoreServices
 , Metal
 , Foundation
+, QuartzCore
 , librusty_v8 ? callPackage ./librusty_v8.nix { }
 }:
 
···
 
   buildAndTestSubdir = "cli";
 
-  buildInputs = lib.optionals stdenv.isDarwin [ libiconv libobjc Security CoreServices Metal Foundation ];
+  buildInputs = lib.optionals stdenv.isDarwin
+    [ libiconv libobjc Security CoreServices Metal Foundation QuartzCore ];
 
   # The rusty_v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem
   # To avoid this we pre-download the file and place it in the locations it will require it in advance

pkgs/misc/drivers/spacenavd/default.nix

···
-{ stdenv, lib, fetchFromGitHub, libX11 }:
+{ stdenv, lib, fetchFromGitHub, fetchpatch, libX11, IOKit }:
 
 stdenv.mkDerivation rec {
   version = "0.8";
···
     sha256 = "1zz0cm5cgvp9s5n4nzksl8rb11c7sw214bdafzra74smvqfjcjcf";
   };
 
-  buildInputs = [ libX11 ];
+  patches = [
+    # Fixes Darwin: https://github.com/FreeSpacenav/spacenavd/pull/38
+    (fetchpatch {
+      url = "https://github.com/FreeSpacenav/spacenavd/commit/d6a25d5c3f49b9676d039775efc8bf854737c43c.patch";
+      sha256 = "02pdgcvaqc20qf9hi3r73nb9ds7yk2ps9nnxaj0x9p50xjnhfg5c";
+    })
+  ];
 
-  configureFlags = [ "--disable-debug"];
+  buildInputs = [ libX11 ]
+    ++ lib.optional stdenv.isDarwin IOKit;
+
+  configureFlags = [ "--disable-debug" ];
+
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
 
   meta = with lib; {
     homepage = "http://spacenav.sourceforge.net/";

pkgs/misc/t-rec/default.nix

···
-{ lib, imagemagick, ffmpeg, rustPlatform, fetchFromGitHub, makeWrapper }:
+{ lib, stdenv, imagemagick, ffmpeg, rustPlatform, fetchFromGitHub, makeWrapper
+, libiconv, Foundation }:
 
 let
   binPath = lib.makeBinPath [
···
     sha256 = "InArrBqfhDrsonjmCIPTBVOA/s2vYml9Ay6cdrKLd7c=";
   };
 
-  buildInputs = [ imagemagick ];
   nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ imagemagick ]
+    ++ lib.optionals stdenv.isDarwin [ libiconv Foundation ];
+
   postInstall = ''
     wrapProgram "$out/bin/t-rec" --prefix PATH : "${binPath}"
   '';

pkgs/misc/vscode-extensions/terraform/default.nix

···
   mktplcRef = {
     name = "terraform";
     publisher = "hashicorp";
-    version = "2.10.2";
+    version = "2.11.0";
   };
 
   vsix = fetchurl {
     name = "${mktplcRef.publisher}-${mktplcRef.name}.zip";
     url = "https://github.com/hashicorp/vscode-terraform/releases/download/v${mktplcRef.version}/${mktplcRef.name}-${mktplcRef.version}.vsix";
-    sha256 = "0fkkjkybjshgzbkc933jscxyxqwmqnhq3718pnw9hsac8qv0grrz";
+    sha256 = "0wqdya353b415qxs8jczmis3q6d8fddv1pdd8jdd0w64s1ibv3sy";
   };
 
   patches = [ ./fix-terraform-ls.patch ];

pkgs/misc/vscode-extensions/terraform/fix-terraform-ls.patch

···
 diff --git a/out/extension.js b/out/extension.js
-index e815393..aeade0e 100644
+index e932d27..099126b 100644
 --- a/out/extension.js
 +++ b/out/extension.js
-@@ -141,25 +141,6 @@ function updateLanguageServer() {
+@@ -143,25 +143,6 @@ function updateLanguageServer() {
      return __awaiter(this, void 0, void 0, function* () {
-         const delay = 1000 * 60 * 24;
-         setTimeout(updateLanguageServer, delay); // check for new updates every 24hrs
+         const delay = 1000 * 60 * 60 * 24;
+         languageServerUpdater.timeout(updateLanguageServer, delay); // check for new updates every 24hrs
 -        // skip install if a language server binary path is set
 -        if (!vscodeUtils_1.config('terraform').get('languageServer.pathToBinary')) {
 -            const installer = new languageServerInstaller_1.LanguageServerInstaller(installPath, reporter);
···
          return startClients(); // on repeat runs with no install, this will be a no-op
      });
  }
-@@ -257,7 +238,7 @@ function pathToBinary() {
+@@ -259,7 +240,7 @@ function pathToBinary() {
                  reporter.sendTelemetryEvent('usePathToBinary');
              }
              else {

pkgs/os-specific/linux/ati-drivers/builder.sh

···
-# TODO gentoo removes some tools because there are xorg sources (?)
-
-source $stdenv/setup
-set -x
-
-die(){ echo $@; exit 1; }
-
-unzip $src
-run_file=fglrx-$build/amd-driver-installer-$build-x86.x86_64.run
-sh $run_file --extract .
-
-for patch in $patches;do
-    patch -p1 < $patch
-done
-
-case "$system" in
-  x86_64-linux)
-    arch=x86_64
-    lib_arch=lib64
-    DIR_DEPENDING_ON_XORG_VERSION=xpic_64a
-  ;;
-  i686-linux)
-    arch=x86
-    lib_arch=lib
-    DIR_DEPENDING_ON_XORG_VERSION=xpic
-  ;;
-  *) exit 1;;
-esac
-
-# Handle/Build the kernel module.
-
-if test -z "$libsOnly"; then
-
-  kernelVersion=$(cd ${kernelDir}/lib/modules && ls)
-  kernelBuild=$(echo ${kernelDir}/lib/modules/$kernelVersion/build)
-  linuxsources=$(echo ${kernelDir}/lib/modules/$kernelVersion/source)
-
-  # note: maybe the .config file should be used to determine this ?
-  # current kbuild infrastructure allows using CONFIG_* defines
-  # but ati sources don't use them yet..
-  # copy paste from make.sh
-
-  setSMP(){
-
-    linuxincludes=$kernelBuild/include
-
-    # copied and stripped. source: make.sh:
-    # 3
-    # linux/autoconf.h may contain this: #define CONFIG_SMP 1
-
-    # Before 2.6.33 autoconf.h is under linux/.
-    # For 2.6.33 and later autoconf.h is under generated/.
-    if [ -f $linuxincludes/generated/autoconf.h ]; then
-        autoconf_h=$linuxincludes/generated/autoconf.h
-    else
-        autoconf_h=$linuxincludes/linux/autoconf.h
-    fi
-    src_file=$autoconf_h
-
-    [ -e $src_file ] || die "$src_file not found"
-
-    if [ `cat $src_file | grep "#undef" | grep "CONFIG_SMP" -c` = 0 ]; then
-      SMP=`cat $src_file | grep CONFIG_SMP | cut -d' ' -f3`
-      echo "file $src_file says: SMP=$SMP"
-    fi
-
-    if [ "$SMP" = 0 ]; then
-      echo "assuming default: SMP=$SMP"
-    fi
-    # act on final result
-    if [ ! "$SMP" = 0 ]; then
-      smp="-SMP"
-      def_smp=-D__SMP__
-    fi
-
-  }
-
-  setModVersions(){
-    ! grep CONFIG_MODVERSIONS=y $kernelBuild/.config ||
-    def_modversions="-DMODVERSIONS"
-    # make.sh contains much more code to determine this whether its enabled
-  }
-
-  # ==============================================================
-  # resolve if we are building for a kernel with a fix for CVE-2010-3081
-  # On kernels with the fix, use arch_compat_alloc_user_space instead
-  # of compat_alloc_user_space since the latter is GPL-only
-
-  COMPAT_ALLOC_USER_SPACE=arch_compat_alloc_user_space
-
-  for src_file in \
-    $kernelBuild/arch/x86/include/asm/compat.h \
-    $linuxsources/arch/x86/include/asm/compat.h \
-    $kernelBuild/include/asm-x86_64/compat.h \
-    $linuxsources/include/asm-x86_64/compat.h \
-    $kernelBuild/include/asm/compat.h;
-  do
-    if [ -e $src_file ];
-    then
-      break
-    fi
-  done
-  if [ ! -e $src_file ];
-    then
-    echo "Warning: x86 compat.h not found in kernel headers"
-    echo "neither arch/x86/include/asm/compat.h nor include/asm-x86_64/compat.h"
-    echo "could be found in $kernelBuild or $linuxsources"
-    echo ""
-  else
-    if [ `cat $src_file | grep -c arch_compat_alloc_user_space` -gt 0 ]
-    then
-      COMPAT_ALLOC_USER_SPACE=arch_compat_alloc_user_space
-    fi
-    echo "file $src_file says: COMPAT_ALLOC_USER_SPACE=$COMPAT_ALLOC_USER_SPACE"
-  fi
-
-  # make.sh contains some code figuring out whether to use these or not..
-  PAGE_ATTR_FIX=0
-  setSMP
-  setModVersions
-  CC=gcc
-  MODULE=fglrx
-  LIBIP_PREFIX=$TMP/arch/$arch/lib/modules/fglrx/build_mod
-  [ -d $LIBIP_PREFIX ]
-  GCC_MAJOR="`gcc --version | grep -o -e ") ." | head -1 | cut -d " " -f 2`"
-
-  { # build .ko module
-    cd ./common/lib/modules/fglrx/build_mod/2.6.x
-    echo .lib${MODULE}_ip.a.GCC${GCC_MAJOR}.cmd
-    echo 'This is a dummy file created to suppress this warning: could not find /lib/modules/fglrx/build_mod/2.6.x/.libfglrx_ip.a.GCC4.cmd for /lib/modules/fglrx/build_mod/2.6.x/libfglrx_ip.a.GCC4' > lib${MODULE}_ip.a.GCC${GCC_MAJOR}.cmd
-
-    sed -i -e "s@COMPAT_ALLOC_USER_SPACE@$COMPAT_ALLOC_USER_SPACE@" ../kcl_ioctl.c
-
-    make CC=${CC} \
-      LIBIP_PREFIX=$(echo "$LIBIP_PREFIX" | sed -e 's|^\([^/]\)|../\1|') \
-      MODFLAGS="-DMODULE -DATI -DFGL -DPAGE_ATTR_FIX=$PAGE_ATTR_FIX -DCOMPAT_ALLOC_USER_SPACE=$COMPAT_ALLOC_USER_SPACE $def_smp $def_modversions" \
-      KVER=$kernelVersion \
-      KDIR=$kernelBuild \
-      PAGE_ATTR_FIX=$PAGE_ATTR_FIX \
-      -j4
-
-    cd $TMP
-  }
-
-fi
-
-{ # install
-  mkdir -p $out/lib/xorg
-  cp -r common/usr/include $out
-  cp -r common/usr/sbin $out
-  cp -r common/usr/share $out
-  mkdir $out/bin/
-  cp -f common/usr/X11R6/bin/* $out/bin/
-  # cp -r arch/$arch/lib $out/lib
-  # what are those files used for?
-  cp -r common/etc $out
-  cp -r $DIR_DEPENDING_ON_XORG_VERSION/usr/X11R6/$lib_arch/* $out/lib/xorg
-
-  # install kernel module
-  if test -z "$libsOnly"; then
-    t=$out/lib/modules/${kernelVersion}/kernel/drivers/misc
-    mkdir -p $t
-
-    cp ./common/lib/modules/fglrx/build_mod/2.6.x/fglrx.ko $t
-  fi
-
-  # should this be installed at all?
-  # its used by the example fglrx_gamma only
-  # don't use $out/lib/modules/dri because this will cause the kernel module
-  # aggregator code to see both: kernel version and the dri direcotry. It'll
-  # fail saying different kernel versions
-  cp -r $TMP/arch/$arch/usr/X11R6/$lib_arch/modules/dri $out/lib
-  cp -r $TMP/arch/$arch/usr/X11R6/$lib_arch/modules/dri/* $out/lib
-  cp -r $TMP/arch/$arch/usr/X11R6/$lib_arch/*.so* $out/lib
-  cp -r $TMP/arch/$arch/usr/X11R6/$lib_arch/fglrx/fglrx-libGL.so.1.2 $out/lib/fglrx-libGL.so.1.2
-  cp -r $TMP/arch/$arch/usr/$lib_arch/* $out/lib
-  ln -s libatiuki.so.1.0 $out/lib/libatiuki.so.1
-  ln -s fglrx-libGL.so.1.2 $out/lib/libGL.so.1
-  ln -s fglrx-libGL.so.1.2 $out/lib/libGL.so
-  # FIXME : This file is missing or has changed versions
-  #ln -s libfglrx_gamma.so.1.0 $out/lib/libfglrx_gamma.so.1
-  # make xorg use the ati version
-  ln -s $out/lib/xorg/modules/extensions/{fglrx/fglrx-libglx.so,libglx.so}
-  # Correct some paths that are hardcoded into binary libs.
-  if [ "$arch" ==  "x86_64" ]; then
-    for lib in \
-      xorg/modules/extensions/fglrx/fglrx-libglx.so \
-      xorg/modules/glesx.so \
-      dri/fglrx_dri.so \
-      fglrx_dri.so \
-      fglrx-libGL.so.1.2
-    do
-      oldPaths="/usr/X11R6/lib/modules/dri"
-      newPaths="/run/opengl-driver/lib/dri"
-      sed -i -e "s|$oldPaths|$newPaths|" $out/lib/$lib
-    done
-  else
-    oldPaths="/usr/X11R6/lib32/modules/dri\x00/usr/lib32/dri"
-    newPaths="/run/opengl-driver-32/lib/dri\x00/dev/null/dri"
-    sed -i -e "s|$oldPaths|$newPaths|" \
-      $out/lib/xorg/modules/extensions/fglrx/fglrx-libglx.so
-
-    for lib in \
-      dri/fglrx_dri.so \
-      fglrx_dri.so \
-      xorg/modules/glesx.so
-    do
-      oldPaths="/usr/X11R6/lib32/modules/dri/"
-      newPaths="/run/opengl-driver-32/lib/dri"
-      sed -i -e "s|$oldPaths|$newPaths|" $out/lib/$lib
-    done
-
-    oldPaths="/usr/X11R6/lib32/modules/dri\x00"
-    newPaths="/run/opengl-driver-32/lib/dri"
-    sed -i -e "s|$oldPaths|$newPaths|" $out/lib/fglrx-libGL.so.1.2
-  fi
-  # libstdc++ and gcc are needed by some libs
-  for pelib1 in \
-    fglrx_dri.so \
-    dri/fglrx_dri.so
-  do
-    patchelf --remove-needed libX11.so.6 $out/lib/$pelib1
-  done
-
-  for pelib2 in \
-    libatiadlxx.so \
-    xorg/modules/glesx.so \
-    dri/fglrx_dri.so \
-    fglrx_dri.so \
-    libaticaldd.so
-  do
-    patchelf --set-rpath $glibcDir/lib/:$libStdCxx/lib/ $out/lib/$pelib2
-  done
-}
-
-if test -z "$libsOnly"; then
-
-{ # build samples
-  mkdir -p $out/bin
-  mkdir -p samples
-  cd samples
-  tar xfz ../common/usr/src/ati/fglrx_sample_source.tgz
-  eval "$patchPhaseSamples"
-
-
-  ( # build and install fgl_glxgears
-    cd fgl_glxgears;
-    gcc -DGL_ARB_texture_multisample=1 -g \
-    -I$libGL/include -I$libGLU/include \
-    -I$out/include \
-    -L$libGL/lib -L$libGLU/lib -lGL -lGLU -lX11 -lm \
-    -o $out/bin/fgl_glxgears -Wall fgl_glxgears.c
-  )
-
-  true || ( # build and install
-
-    ###
-    ## FIXME ?
-    # doesn't build  undefined reference to `FGLRX_X11SetGamma'
-    # which should be contained in -lfglrx_gamma
-    # This should create $out/lib/libfglrx_gamma.so.1.0 ? because there is
-    # a symlink named libfglrx_gamma.so.1 linking to libfglrx_gamma.so.1.0 in $out/lib/
-
-    cd programs/fglrx_gamma
-    gcc -fPIC -I${libXxf86vm.dev}/include \
-      -I${xorgproto}/include \
-      -I$out/X11R6/include \
-      -L$out/lib \
-      -Wall -lm -lfglrx_gamma -lX11 -lXext -o $out/bin/fglrx_xgamma fglrx_xgamma.c
-  )
-
-  {
-    # patch and copy statically linked qt libs used by amdcccle
-    patchelf --set-interpreter $(echo $glibcDir/lib/ld-linux*.so.2) $TMP/arch/$arch/usr/share/ati/$lib_arch/libQtCore.so.4 &&
-    patchelf  --set-rpath $gcc/$lib_arch/ $TMP/arch/$arch/usr/share/ati/$lib_arch/libQtCore.so.4 &&
-    patchelf --set-rpath $gcc/$lib_arch/:$out/share/ati/:$libXrender/lib/:$libSM/lib/:$libICE/lib/:$libfontconfig/lib/:$libfreetype/lib/ $TMP/arch/$arch/usr/share/ati/$lib_arch/libQtGui.so.4 &&
-    mkdir -p $out/share/ati
-    cp -r $TMP/arch/$arch/usr/share/ati/$lib_arch/libQtCore.so.4 $out/share/ati/
-    cp -r $TMP/arch/$arch/usr/share/ati/$lib_arch/libQtGui.so.4 $out/share/ati/
-    # copy binaries and wrap them:
-    BIN=$TMP/arch/$arch/usr/X11R6/bin
-    patchelf --set-rpath $gcc/$lib_arch/:$out/share/ati/:$libXinerama/lib/:$libXrandr/lib/ $TMP/arch/$arch/usr/X11R6/bin/amdcccle
-    patchelf --set-rpath $libXrender/lib/:$libXrandr/lib/ $TMP/arch/$arch/usr/X11R6/bin/aticonfig
-    patchelf --shrink-rpath $BIN/amdcccle
-    for prog in $BIN/*; do
-      cp -f $prog $out/bin &&
-      patchelf --set-interpreter $(echo $glibcDir/lib/ld-linux*.so.2) $out/bin/$(basename $prog) &&
-      wrapProgram $out/bin/$(basename $prog) --prefix LD_LIBRARY_PATH : $out/lib/:$gcc/lib/:$out/share/ati/:$libXinerama/lib/:$libXrandr/lib/:$libfontconfig/lib/:$libfreetype/lib/${LD_LIBRARY_PATH:+:}$LD_LIBRARY_PATH
-    done
-  }
-
-  rm -f $out/lib/fglrx/switchlibglx && rm -f $out/lib/fglrx/switchlibGL
-
-}
-
-fi
-
-for p in $extraDRIlibs; do
-  for lib in $p/lib/*.so*; do
-    ln -s $lib $out/lib/
-  done
-done

pkgs/os-specific/linux/ati-drivers/default.nix

···
-{ stdenv, lib, fetchurl, kernel ? null, which
-, xorg, makeWrapper, glibc, patchelf, unzip
-, fontconfig, freetype, libGLU, libGL # for fgl_glxgears
-, # Whether to build the libraries only (i.e. not the kernel module or
-  # driver utils). Used to support 32-bit binaries on 64-bit
-  # Linux.
-  libsOnly ? false
-}:
-
-assert (!libsOnly) -> kernel != null;
-
-with lib;
-
-# This derivation requires a maximum of gcc49, Linux kernel 4.1 and xorg.xserver 1.17
-# and will not build or run using versions newer
-
-# If you want to use a different Xorg version probably
-# DIR_DEPENDING_ON_XORG_VERSION in builder.sh has to be adopted (?)
-# make sure libglx.so of ati is used. xorg.xorgserver does provide it as well
-# which is a problem because it doesn't contain the xorgserver patch supporting
-# the XORG_DRI_DRIVER_PATH env var.
-# See https://marc.info/?l=nix-dev&m=139641585515351 for a
-# workaround (TODO)
-
-# The gentoo ebuild contains much more "magic" and is usually a great resource to
-# find patches XD
-
-# http://wiki.cchtml.com/index.php/Main_Page
-
-# /usr/lib/dri/fglrx_dri.so must point to /run/opengl-driver/lib/fglrx_dri.so
-# This is done in the builder script.
-
-stdenv.mkDerivation rec {
-
-  version = "15.12";
-  pname = "ati-drivers";
-  build = "15.302";
-
-  linuxonly =
-    if stdenv.hostPlatform.system == "i686-linux" then
-      true
-    else if stdenv.hostPlatform.system == "x86_64-linux" then
-      true
-    else throw "ati-drivers are Linux only. Sorry. The build was stopped.";
-
-  name = pname + "-" + version + (optionalString (!libsOnly) "-${kernelDir.version}");
-
-  builder = ./builder.sh;
-  gcc = stdenv.cc.cc;
-  libXinerama = xorg.libXinerama;
-  libXrandr = xorg.libXrandr;
-  libXrender = xorg.libXrender;
-  libXxf86vm = xorg.libXxf86vm;
-  xorgproto = xorg.xorgproto;
-  libSM = xorg.libSM;
-  libICE = xorg.libICE;
-  libfreetype = freetype;
-  libfontconfig = fontconfig;
-  libStdCxx = stdenv.cc.cc.lib;
-
-  src = fetchurl {
-    url =
-    "https://www2.ati.com/drivers/linux/radeon-crimson-15.12-15.302-151217a-297685e.zip";
-    sha256 = "704f2dfc14681f76dae3b4120c87b1ded33cf43d5a1d800b6de5ca292bb61e58";
-    curlOpts = "--referer https://www.amd.com/en/support";
-  };
-
-  hardeningDisable = [ "pic" "format" ];
-
-  patchPhaseSamples = "patch -p2 < ${./patches/patch-samples.patch}";
-  patches = [
-    ./patches/15.12-xstate-fp.patch
-    ./patches/15.9-kcl_str.patch
-    ./patches/15.9-mtrr.patch
-    ./patches/15.9-preempt.patch
-    ./patches/15.9-sep_printf.patch ]
-  ++ optionals ( kernel != null &&
-                 (lib.versionAtLeast kernel.version "4.6") )
-               [ ./patches/kernel-4.6-get_user_pages.patch
-                 ./patches/kernel-4.6-page_cache_release-put_page.patch ]
-  ++ optionals ( kernel != null &&
-                 (lib.versionAtLeast kernel.version "4.7") )
-               [ ./patches/4.7-arch-cpu_has_pge-v2.patch ]
-  ++ optionals ( kernel != null &&
-                 (lib.versionAtLeast kernel.version "4.9") )
-               [ ./patches/4.9-get_user_pages.patch ];
-
-  nativeBuildInputs = [ unzip ];
-  buildInputs =
-    [ xorg.libXrender xorg.libXext xorg.libX11 xorg.libXinerama xorg.libSM
-      xorg.libXrandr xorg.libXxf86vm xorg.xorgproto xorg.imake xorg.libICE
-      patchelf
-      libGLU libGL
-      fontconfig
-      freetype
-      makeWrapper
-      which
-    ];
-
-  inherit libsOnly;
-
-  kernelDir = if libsOnly then null else kernel.dev;
-
-  # glibc only used for setting the binaries interpreter
-  glibcDir = glibc.out;
-
-  # outputs TODO: probably many fixes are needed;
-  LD_LIBRARY_PATH = makeLibraryPath
-    [ xorg.libXrender xorg.libXext xorg.libX11 xorg.libXinerama xorg.libSM
-      xorg.libXrandr xorg.libXxf86vm xorg.xorgproto xorg.imake xorg.libICE
-      libGLU libGL
-      fontconfig
-      freetype
-      stdenv.cc.cc
-    ];
-
-  # without this some applications like blender don't start, but they start
-  # with nvidia. This causes them to be symlinked to $out/lib so that they
-  # appear in /run/opengl-driver/lib which get's added to LD_LIBRARY_PATH
-
-  extraDRIlibs = [ xorg.libXrandr.out xorg.libXrender.out xorg.libXext.out
-                   xorg.libX11.out xorg.libXinerama.out xorg.libSM.out
-                   xorg.libICE.out ];
-
-  inherit libGLU libGL; # only required to build the examples
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "ATI Catalyst display drivers";
-    homepage = "http://support.amd.com/us/gpudownload/Pages/index.aspx";
-    license = licenses.unfree;
-    maintainers = with maintainers; [ marcweber offline jerith666 ];
-    platforms = platforms.linux;
-    hydraPlatforms = [];
-    # Copied from the nvidia default.nix to prevent a store collision.
-    priority = 4;
-  };
-
-}

pkgs/os-specific/linux/ati-drivers/patches/15.12-xstate-fp.patch

···
-From: Krzysztof Kolasa <[e-mail]>
-Date: Thu, 26 Nov 2015 14:28:46 +0100
-Subject: [PATCH] Patch for kernel 4.4.0-rc2
-
-constant change of name XSTATE_XP to name XFEATURE_MASK_FP
----
- firegl_public.c | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/common/lib/modules/fglrx/build_mod/firegl_public.c b/common/lib/modules/fglrx/build_mod/firegl_public.c
-index 3626c7b..f071d42 100644
---- a/common/lib/modules/fglrx/build_mod/firegl_public.c
-+++ b/common/lib/modules/fglrx/build_mod//firegl_public.c
-@@ -6463,7 +6463,11 @@ static int KCL_fpu_save_init(struct task_struct *tsk)
-       if (!(fpu->state->xsave.xsave_hdr.xstate_bv & XSTATE_FP))
- #else
- 	  copy_xregs_to_kernel(&fpu->state.xsave);
--      if (!(fpu->state.xsave.header.xfeatures & XSTATE_FP))
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,4,0)
-+      if (!(fpu->state.xsave.header.xfeatures & XFEATURE_MASK_FP))
-+#else
-+      if (!(fpu->state.xsave.header.xfeatures & XSTATE_FP))
-+#endif
- #endif
-          return 1;
-    } else if (static_cpu_has(X86_FEATURE_FXSR)) {

pkgs/os-specific/linux/ati-drivers/patches/15.9-kcl_str.patch

···
---- a/common/lib/modules/fglrx/build_mod/kcl_str.c	2015-09-13 13:47:30.000000000 -0400
-+++ b/common/lib/modules/fglrx/build_mod/kcl_str.c	2015-09-13 13:49:42.000000000 -0400
-@@ -169,7 +169,11 @@ int ATI_API_CALL KCL_STR_Strnicmp(const
-                                   const char* s2,
-                                   KCL_TYPE_SizeSigned count)
- {
-+#if LINUX_VERSION_CODE < KERNEL_VERSION(4,0,0)
-     return strnicmp(s1, s2, count);
-+#else
-+    return strncasecmp(s1, s2, count);
-+#endif
- }
- 
- /** \brief Locate character in string

pkgs/os-specific/linux/ati-drivers/patches/15.9-mtrr.patch

···
---- a/common/lib/modules/fglrx/build_mod/firegl_public.c	2015-09-19 23:43:22.000000000 -0400
-+++ b/common/lib/modules/fglrx/build_mod/firegl_public.c	2015-09-19 23:52:07.000000000 -0400
-@@ -3442,7 +3442,11 @@ int ATI_API_CALL KCL_MEM_MTRR_Support(vo
- int ATI_API_CALL KCL_MEM_MTRR_AddRegionWc(unsigned long base, unsigned long size)
- {
- #ifdef CONFIG_MTRR
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,3,0)
-+    return arch_phys_wc_add(base, size);
-+#else
-     return mtrr_add(base, size, MTRR_TYPE_WRCOMB, 1);
-+#endif
- #else /* !CONFIG_MTRR */
-     return -EPERM;
- #endif /* !CONFIG_MTRR */
-@@ -3451,7 +3455,12 @@ int ATI_API_CALL KCL_MEM_MTRR_AddRegionW
- int ATI_API_CALL KCL_MEM_MTRR_DeleteRegion(int reg, unsigned long base, unsigned long size)
- {
- #ifdef CONFIG_MTRR
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,3,0)
-+    arch_phys_wc_del(reg);
-+    return reg;
-+#else
-     return mtrr_del(reg, base, size);
-+#endif
- #else /* !CONFIG_MTRR */
-     return -EPERM;
- #endif /* !CONFIG_MTRR */

pkgs/os-specific/linux/ati-drivers/patches/15.9-preempt.patch

···
---- a/common/lib/modules/fglrx/build_mod/firegl_public.c	2015-08-30 17:36:02.000000000 -0400
-+++ b/common/lib/modules/fglrx/build_mod/firegl_public.c	2015-08-30 17:39:36.000000000 -0400
-@@ -21,6 +21,8 @@
- !!! since it requires changes to linux/init/main.c.
- #endif /* !MODULE */
- 
-+#include <linux/preempt.h>
-+
- // ============================================================
- #include <linux/version.h>
- 
-@@ -4997,7 +4999,9 @@ static unsigned int kas_spin_unlock(kas_
- unsigned long ATI_API_CALL KAS_GetExecutionLevel(void)
- {
-     unsigned long ret;
-+    preempt_disable();
-     ret = kas_GetExecutionLevel();
-+    preempt_enable();
-     return ret;
- }
- 
-@@ -5022,8 +5026,10 @@ unsigned int ATI_API_CALL KAS_Ih_Execute
-     KCL_DEBUG5(FN_FIREGL_KAS,"0x%08X, 0x%08X\n", ih_routine, ih_context);
- 
-     //Prevent simultaneous entry on some SMP systems.
-+    preempt_disable();
-     if (test_and_set_bit(0, (void *)&(kasContext.in_interrupts[smp_processor_id()])))
-     {
-+    	preempt_enable();
-         KCL_DEBUG1(FN_FIREGL_KAS, "The processor is handling the interrupt\n");
-         return IRQ_NONE;
-     }
-@@ -5036,9 +5042,9 @@ unsigned int ATI_API_CALL KAS_Ih_Execute
- 
-     kasSetExecutionLevel(orig_level);
-     spin_unlock(&kasContext.lock_ih); 
--
-     clear_bit(0, (void *)&(kasContext.in_interrupts[smp_processor_id()]));
-     KCL_DEBUG5(FN_FIREGL_KAS,"%d\n", ret);
-+    preempt_enable();
- 
-     return ret;
- }
-@@ -5256,6 +5262,7 @@ unsigned int ATI_API_CALL KAS_Spinlock_A
- 
-     KCL_DEBUG5(FN_FIREGL_KAS,"0x%08X\n", hSpinLock);
- 
-+    preempt_disable();
-     spin_lock_info.routine_type = spinlock_obj->routine_type;
-     spin_lock_info.plock = &(spinlock_obj->lock);
- 
-@@ -5263,6 +5270,7 @@ unsigned int ATI_API_CALL KAS_Spinlock_A
- 
-     spinlock_obj->acquire_type = spin_lock_info.acquire_type;
-     spinlock_obj->flags = spin_lock_info.flags;
-+    preempt_enable();
- 
-     KCL_DEBUG5(FN_FIREGL_KAS,"%d\n", ret);
-     return ret;
-@@ -6034,6 +6042,8 @@ unsigned int ATI_API_CALL KAS_Interlocke
- 
-     KCL_DEBUG5(FN_FIREGL_KAS,"0x%08X, 0x%08X, 0x%08X\n", hListHead, hListEntry, phPrevEntry);
- 
-+    preempt_disable();
-+
-     /* Protect the operation with spinlock */
-     spin_lock_info.routine_type = listhead_obj->routine_type;
-     spin_lock_info.plock = &(listhead_obj->lock);
-@@ -6041,6 +6051,7 @@ unsigned int ATI_API_CALL KAS_Interlocke
-     if (!kas_spin_lock(&spin_lock_info))
-     {
-         KCL_DEBUG_ERROR("Unable to grab list spinlock\n");
-+	preempt_enable();
-         return 0; /* No spinlock - no operation */
-     }
- 
-@@ -6065,6 +6076,7 @@ unsigned int ATI_API_CALL KAS_Interlocke
-     spin_unlock_info.flags = spin_lock_info.flags;
- 
-     ret = kas_spin_unlock(&spin_unlock_info);
-+    preempt_enable();
-     KCL_DEBUG5(FN_FIREGL_KAS,"%d", ret);
-     return ret;
- }
-@@ -6153,8 +6165,10 @@ unsigned int ATI_API_CALL KAS_Interlocke
-     spin_lock_info.routine_type = listhead_obj->routine_type;
-     spin_lock_info.plock = &(listhead_obj->lock);
- 
-+    preempt_disable();
-     if (!kas_spin_lock(&spin_lock_info))
-     {
-+        preempt_enable();
-         KCL_DEBUG_ERROR("Unable to grab list spinlock");
-         return 0; /* No spinlock - no operation */
-     }
-@@ -6178,6 +6192,7 @@ unsigned int ATI_API_CALL KAS_Interlocke
-     spin_unlock_info.flags = spin_lock_info.flags;
- 
-     ret = kas_spin_unlock(&spin_unlock_info);
-+    preempt_enable();
-     KCL_DEBUG5(FN_FIREGL_KAS,"%d", ret);
-     return ret;
- }

pkgs/os-specific/linux/ati-drivers/patches/15.9-sep_printf.patch

···
---- a/common/lib/modules/fglrx/build_mod/firegl_public.c	2015-09-14 15:14:36.000000000 -0400
-+++ b/common/lib/modules/fglrx/build_mod/firegl_public.c	2015-09-14 16:18:58.000000000 -0400
-@@ -649,6 +649,8 @@ static int firegl_major_proc_read(struct
-     *eof = 1;
- 
-     len = snprintf(buf, request, "%d\n", major);
-+#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4,3,0)
-+    seq_printf(m, "%d\n", major);
- #else
-     len = seq_printf(m, "%d\n", major);
- #endif

pkgs/os-specific/linux/ati-drivers/patches/4.7-arch-cpu_has_pge-v2.patch

···
-diff -uNr 16.8/common/lib/modules/fglrx/build_mod/firegl_public.c 16.8b/common/lib/modules/fglrx/build_mod/firegl_public.c
---- 16.8/common/lib/modules/fglrx/build_mod/firegl_public.c	2015-12-18 19:47:41.000000000 +0100
-+++ 16.8b/common/lib/modules/fglrx/build_mod/firegl_public.c	2016-08-15 15:09:37.228538907 +0200
-@@ -4518,7 +4518,11 @@
-     write_cr0(cr0);
-     wbinvd();
- 
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0)
-+    if (boot_cpu_has(X86_FEATURE_PGE))
-+#else
-     if (cpu_has_pge)
-+#endif
-     {
-         cr4 = READ_CR4();
-         WRITE_CR4(cr4 & ~X86_CR4_PGE);
-@@ -4532,7 +4536,11 @@
-     wbinvd();
-     __flush_tlb();
-     write_cr0(cr0 & 0xbfffffff);
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0)
-+    if (boot_cpu_has(X86_FEATURE_PGE))
-+#else
-     if (cpu_has_pge)
-+#endif
-     {
-         WRITE_CR4(cr4);
-     }
-@@ -4559,7 +4567,11 @@
-     write_cr0(cr0);
-     wbinvd();
- 
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0)
-+    if (boot_cpu_has(X86_FEATURE_PGE))
-+#else
-     if (cpu_has_pge)
-+#endif
-     {
-         cr4 = READ_CR4();
-         WRITE_CR4(cr4 & ~X86_CR4_PGE);
-@@ -4572,7 +4584,11 @@
-     wbinvd();
-     __flush_tlb();
-     write_cr0(cr0 & 0xbfffffff);
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0)
-+    if (boot_cpu_has(X86_FEATURE_PGE))
-+#else
-     if (cpu_has_pge)
-+#endif
-     {
-         WRITE_CR4(cr4);
-     }
-diff -uNr 16.8/common/lib/modules/fglrx/build_mod/firegl_public.h 16.8b/common/lib/modules/fglrx/build_mod/firegl_public.h
---- 16.8/common/lib/modules/fglrx/build_mod/firegl_public.h	2015-12-18 19:47:41.000000000 +0100
-+++ 16.8b/common/lib/modules/fglrx/build_mod/firegl_public.h	2016-08-15 15:09:05.815141238 +0200
-@@ -650,9 +650,15 @@
- #define cpu_has_pat  test_bit(X86_FEATURE_PAT, (void *) &boot_cpu_data.x86_capability)
- #endif
- 
-+#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,7,0)
-+#ifndef boot_cpu_has(X86_FEATURE_PGE)
-+#define boot_cpu_has(X86_FEATURE_PGE) test_bit(X86_FEATURE_PGE, &boot_cpu_data.x86_capability)
-+#endif
-+#else
- #ifndef cpu_has_pge
- #define cpu_has_pge test_bit(X86_FEATURE_PGE, &boot_cpu_data.x86_capability)
- #endif
-+#endif
- 
- /* 2.6.29 defines pgprot_writecombine as a macro which resolves to a
-  * GPL-only function with the same name. So we always use our own

pkgs/os-specific/linux/ati-drivers/patches/4.9-get_user_pages.patch

···
-commit b3e4353fc68a6a024dcb95e2d61aa0afd7370233
-Author: Matt McHenry <[e-mail]>
-Date:   Fri Feb 3 20:19:41 2017
-
-    patch for 4.9 only
-
-diff --git a/common/lib/modules/fglrx/build_mod/firegl_public.c b/common/lib/modules/fglrx/build_mod/firegl_public.c
-index 4ce095f..3b591e1 100755
---- a/common/lib/modules/fglrx/build_mod/firegl_public.c
-+++ b/common/lib/modules/fglrx/build_mod/firegl_public.c
-@@ -3224,7 +3224,7 @@ int ATI_API_CALL KCL_LockUserPages(unsigned long vaddr, unsigned long* page_list
-     int ret;
- 
-     down_read(&current->mm->mmap_sem);
--    ret = get_user_pages(vaddr, page_cnt, 1, 0, (struct page **)page_list, NULL);
-+    ret = get_user_pages(vaddr, page_cnt, 1, (struct page **)page_list, NULL);
-     up_read(&current->mm->mmap_sem);
- 
-     return ret;
-@@ -3242,7 +3242,7 @@ int ATI_API_CALL KCL_LockReadOnlyUserPages(unsigned long vaddr, unsigned long* p
-     int ret;
- 
-     down_read(&current->mm->mmap_sem);
--    ret = get_user_pages(vaddr, page_cnt, 0, 0, (struct page **)page_list, NULL);
-+    ret = get_user_pages(vaddr, page_cnt, 0, (struct page **)page_list, NULL);
-     up_read(&current->mm->mmap_sem);
- 
-     return ret;

pkgs/os-specific/linux/ati-drivers/patches/kernel-4.6-get_user_pages.patch

···
-diff --git a/common/lib/modules/fglrx/build_mod/firegl_public.c b/common/lib/modules/fglrx/build_mod/firegl_public.c
-index 9c70211..b2242af 100755
---- a/common/lib/modules/fglrx/build_mod/firegl_public.c
-+++ b/common/lib/modules/fglrx/build_mod/firegl_public.c
-@@ -3220,7 +3220,7 @@ int ATI_API_CALL KCL_LockUserPages(unsigned long vaddr, unsigned long* page_list
-     int ret;
- 
-     down_read(&current->mm->mmap_sem);
--    ret = get_user_pages(current, current->mm, vaddr, page_cnt, 1, 0, (struct page **)page_list, NULL);
-+    ret = get_user_pages(vaddr, page_cnt, 1, 0, (struct page **)page_list, NULL);
-     up_read(&current->mm->mmap_sem);
- 
-     return ret;
-@@ -3238,7 +3238,7 @@ int ATI_API_CALL KCL_LockReadOnlyUserPages(unsigned long vaddr, unsigned long* p
-     int ret;
- 
-     down_read(&current->mm->mmap_sem);
--    ret = get_user_pages(current, current->mm, vaddr, page_cnt, 0, 0, (struct page **)page_list, NULL);
-+    ret = get_user_pages(vaddr, page_cnt, 0, 0, (struct page **)page_list, NULL);
-     up_read(&current->mm->mmap_sem);
- 
-     return ret;
--- 
-2.9.2
-

pkgs/os-specific/linux/ati-drivers/patches/kernel-4.6-page_cache_release-put_page.patch

···
-diff --git a/common/lib/modules/fglrx/build_mod/firegl_public.c b/common/lib/modules/fglrx/build_mod/firegl_public.c
-index b2242af..586129c 100755
---- a/common/lib/modules/fglrx/build_mod/firegl_public.c
-+++ b/common/lib/modules/fglrx/build_mod/firegl_public.c
-@@ -3249,7 +3249,7 @@ void ATI_API_CALL KCL_UnlockUserPages(unsigned long* page_list, unsigned int pag
-     unsigned int i;
-     for (i=0; i<page_cnt; i++)
-     {
--        page_cache_release((struct page*)page_list[i]);
-+        put_page((struct page*)page_list[i]);
-     }
- }
- 
--- 
-2.9.2
-

pkgs/os-specific/linux/ati-drivers/patches/patch-samples.patch

···
-diff --git a/samples/fgl_glxgears/fgl_glxgears.c b/samples/fgl_glxgears/fgl_glxgears.c
-index 6c8e313..2b8d035 100644
---- a/samples/fgl_glxgears/fgl_glxgears.c
-+++ b/samples/fgl_glxgears/fgl_glxgears.c
-@@ -1096,8 +1096,6 @@ static void event_loop(void)
-                   view_rotx -= 5.0;
-                }
-                else {
--                  r = XLookupString(&event.xkey, buffer, sizeof(buffer),
--                                    NULL, NULL);
-                   if (buffer[0] == 27) {
-                      /* escape */
-                      return;
-
-
-diff -Nur a/samples/fgl_glxgears/fgl_glxgears.c b/samples/fgl_glxgears/fgl_glxgears.c
---- a/samples/fgl_glxgears/fgl_glxgears.c	2012-08-29 09:59:03.000000000 +0300
-+++ b/samples/fgl_glxgears/fgl_glxgears.c	2013-09-07 09:26:11.034723135 +0300
-@@ -78,7 +78,6 @@
- #endif // _WIN32
- 
- #define INT_PTR ptrdiff_t
--#include <GL/glATI.h>
- 
- #ifdef _WIN32
- #include <GL/wglATI.h>

pkgs/os-specific/linux/ena/default.nix

···
 { lib, stdenv, fetchFromGitHub, kernel }:
 
 stdenv.mkDerivation rec {
-  version = "2.4.1";
+  version = "2.5.0";
   name = "ena-${version}-${kernel.version}";
 
   src = fetchFromGitHub {
     owner = "amzn";
     repo = "amzn-drivers";
     rev = "ena_linux_${version}";
-    sha256 = "0f3i878g11yfw6n68p3qf125jsnggy706jhc8sc0z1xgap6qgh09";
+    sha256 = "sha256-uOf/1624UtjaZtrk7XyQpeUGdTNVDnzZJZMgU86i+SM=";
   };
 
   hardeningDisable = [ "pic" ];

pkgs/os-specific/linux/rtl8814au/default.nix

···
 { lib, stdenv, fetchFromGitHub, kernel }:
 
-stdenv.mkDerivation rec {
-  name = "rtl8814au-${kernel.version}-${version}";
-  version = "4.3.21";
+stdenv.mkDerivation {
+  pname = "rtl8814au";
+  version = "${kernel.version}-unstable-2021-05-18";
 
   src = fetchFromGitHub {
-    owner = "zebulon2";
-    repo = "rtl8814au";
-    rev = "a58c56a5a6cb99ffb872f07cb67b68197911854f";
-    sha256 = "1ffm67da183nz009gm5v9w1bab081hrm113kk8knl9s5qbqnn13q";
+    owner = "morrownr";
+    repo = "8814au";
+    rev = "388786c864f9b1437fc4d934b1eccf6d7f1e1355";
+    sha256 = "sha256-2EnheODPFWTGN/fz45LWRSOGeV6pTENEUrehahj+PJ4=";
   };
 
   buildInputs = kernel.moduleBuildDependencies;
···
 
   meta = with lib; {
     description = "Realtek 8814AU USB WiFi driver";
-    homepage = "https://github.com/zebulon2/rtl8814au";
-    license = licenses.gpl2;
+    homepage = "https://github.com/morrownr/8814au";
+    license = licenses.gpl2Only;
     maintainers = [ maintainers.lassulus ];
-    platforms = [ "x86_64-linux" "i686-linux" ];
   };
 }

pkgs/os-specific/linux/rtl8821ce/default.nix

···
     homepage = "https://github.com/tomaspinho/rtl8821ce";
     license = licenses.gpl2Only;
     platforms = platforms.linux;
+    broken = stdenv.isAarch64;
     maintainers = with maintainers; [ hhm ];
   };
 }

pkgs/servers/home-assistant/component-packages.nix

···
     "bloomsky" = ps: with ps; [ ];
     "blueprint" = ps: with ps; [ ];
     "bluesound" = ps: with ps; [ xmltodict ];
-    "bluetooth_le_tracker" = ps: with ps; [ ]; # missing inputs: pygatt[GATTTOOL]
+    "bluetooth_le_tracker" = ps: with ps; [ pygatt ];
     "bluetooth_tracker" = ps: with ps; [ bt_proximity pybluez ];
     "bme280" = ps: with ps; [ smbus-cffi ]; # missing inputs: i2csense
     "bme680" = ps: with ps; [ bme680 smbus-cffi ];
···
     "sinch" = ps: with ps; [ ]; # missing inputs: clx-sdk-xms
     "sisyphus" = ps: with ps; [ ]; # missing inputs: sisyphus-control
     "sky_hub" = ps: with ps; [ ]; # missing inputs: pyskyqhub
-    "skybeacon" = ps: with ps; [ ]; # missing inputs: pygatt[GATTTOOL]
+    "skybeacon" = ps: with ps; [ pygatt ];
     "skybell" = ps: with ps; [ skybellpy ];
     "slack" = ps: with ps; [ slackclient ];
     "sleepiq" = ps: with ps; [ sleepyq ];

pkgs/servers/home-assistant/default.nix

···
 , lib
 , fetchFromGitHub
 , python3
+, inetutils
 , nixosTests
 
 # Look up dependencies of specified components in component-packages.nix
···
     # https://github.com/tchellomello/python-ring-doorbell/issues/240
     (mkOverride "ring-doorbell" "0.6.2"
       "fbd537722a27b3b854c26506d894b7399bb8dc57ff36083285971227a2d46560")
+
+    # Pinned due to API changes in pyflunearyou>=2.0
+    (self: super: {
+      pyflunearyou = super.pyflunearyou.overridePythonAttrs (oldAttrs: rec {
+        version = "1.0.7";
+        src = fetchFromGitHub {
+          owner = "bachya";
+          repo = "pyflunearyou";
+          rev = version;
+          sha256 = "0hq55k298m9a90qb3lasw9bi093hzndrah00rfq94bp53aq0is99";
+        };
+        postPatch = ''
+          substituteInPlace pyproject.toml \
+            --replace "poetry.masonry.api" "poetry.core.masonry.api" \
+            --replace 'msgpack = "^0.6.2"' 'msgpack = "*"' \
+            --replace 'ujson = "^1.35"' 'ujson = "*"'
+        '';
+      });
+    })
+
+    # Pinned due to API changes in pylast 4.2.1
+    (mkOverride "pylast" "4.2.0"
+      "0zd0dn2l738ndz62vpa751z0ldnm91dcz9zzbvxv53r08l0s9yf3")
+
+    # Pinned due to API changes in pyopenuv>=1.1.0
+    (self: super: {
+      pyopenuv = super.pyopenuv.overridePythonAttrs (oldAttrs: rec {
+        version = "1.0.13";
+        src = fetchFromGitHub {
+          owner = "bachya";
+          repo = "pyopenuv";
+          rev = version;
+          sha256 = "1gx9xjkyvqqy8410lnbshq1j5y4cb0cdc4m505g17rwdzdwb01y8";
+        };
+        postPatch = ''
+          substituteInPlace pyproject.toml \
+            --replace "poetry.masonry.api" "poetry.core.masonry.api"
+        '';
+      });
+    })
 
     # Pinned due to API changes in pyruckus>0.12
     (self: super: {
···
   # services. Before adding new components to this list make sure we have all
   # its dependencies packaged and listed in ./component-packages.nix.
   componentTests = [
+    "abode"
     "accuweather"
+    "acmeda"
+    "adguard"
+    "advantage_air"
+    "agent_dvr"
+    "air_quality"
     "airly"
+    "airnow"
+    "airvisual"
+    "alarm_control_panel"
+    "alarmdecoder"
+    "alert"
+    "alexa"
+    "almond"
+    "ambiclimate"
+    "ambient_station"
     "analytics"
     "androidtv"
-    "alert"
+    "apache_kafka"
     "api"
+    "apple_tv"
+    "apprise"
+    "arlo"
+    "asuswrt"
+    "august"
+    "aurora"
     "auth"
     "automation"
+    "awair"
+    "aws"
     "axis"
     "bayesian"
     "binary_sensor"
+    "blackbird"
+    "blueprint"
+    "bluetooth_le_tracker"
+    "braviatv"
+    "broadlink"
     "brother"
+    "bsblan"
     "caldav"
     "calendar"
     "camera"
     "canary"
     "cast"
+    "cert_expiry"
     "climacell"
     "climate"
     "cloud"
+    "cloudflare"
     "comfoconnect"
     "command_line"
+    "compensation"
     "config"
     "configurator"
     "conversation"
+    "coronavirus"
     "counter"
     "cover"
+    "daikin"
+    "darksky"
+    "datadog"
     "deconz"
     "default_config"
     "demo"
···
     "device_sun_light_trigger"
     "device_tracker"
     "devolo_home_control"
+    "dexcom"
     "dhcp"
+    "dialogflow"
     "discovery"
     "dsmr"
+    "dte_energy_bridge"
+    "duckdns"
+    "dyson"
+    "eafm"
     "econet"
+    "efergy"
+    "emonitor"
     "emulated_hue"
     "esphome"
+    "everlights"
+    "ezviz"
+    "faa_delays"
+    "facebook"
+    "facebox"
+    "fail2ban"
     "fan"
-    "faa_delays"
+    "feedreader"
     "ffmpeg"
+    "fido"
     "file"
     "filesize"
     "filter"
+    "firmata"
+    "flo"
+    "flume"
+    "flunearyou"
     "flux"
     "folder"
     "folder_watcher"
     "freebox"
+    "freedns"
     "fritz"
     "fritzbox"
     "fritzbox_callmonitor"
···
     "generic_thermostat"
     "geo_json_events"
     "geo_location"
+    "geofency"
+    "glances"
+    "google"
+    "google_assistant"
+    "google_domains"
+    "google_pubsub"
+    "google_translate"
+    "google_travel_time"
+    "google_wifi"
+    "gpslogger"
+    "graphite"
     "group"
+    "guardian"
+    "harmony"
+    "hassio"
     "hddtemp"
     "history"
     "history_stats"
     "home_connect"
     "home_plus_control"
+    "homeassistant"
     "homekit"
     "homekit_controller"
-    "homeassistant"
     "homematic"
     "homematicip_cloud"
     "html5"
     "http"
     "hue"
+    "humidifier"
     "hyperion"
+    "ialarm"
     "iaqualink"
+    "icloud"
     "ifttt"
     "image"
     "image_processing"
+    "imap_email_content"
     "influxdb"
     "input_boolean"
     "input_datetime"
-    "input_text"
     "input_number"
     "input_select"
+    "input_text"
+    "insteon"
+    "integration"
     "intent"
     "intent_script"
+    "ios"
     "ipp"
+    "iqvia"
     "islamic_prayer_times"
     "jewish_calendar"
+    "kira"
     "kmtronic"
     "knx"
     "kodi"
+    "lastfm"
+    "lcn"
     "light"
     "litterrobot"
     "local_file"
     "local_ip"
+    "locative"
     "lock"
     "logbook"
     "logentries"
     "logger"
+    "london_air"
     "lovelace"
+    "luftdaten"
     "lutron_caseta"
+    "lyric"
+    "mailbox"
     "manual"
     "manual_mqtt"
     "mazda"
     "media_player"
     "media_source"
+    "meraki"
     "met"
     "met_eireann"
+    "microsoft_face"
+    "microsoft_face_detect"
+    "microsoft_face_identify"
+    "mikrotik"
+    "min_max"
     "minecraft_server"
+    "minio"
     "mobile_app"
     "modbus"
+    "mold_indicator"
     "moon"
     "motioneye"
     "mqtt"
···
     "mqtt_statestream"
     "mullvad"
     "mutesync"
+    "my"
+    "myq"
+    "mysensors"
+    "namecheapdns"
+    "neato"
+    "netatmo"
     "nexia"
+    "no_ip"
     "notify"
     "notion"
+    "nuki"
     "number"
+    "nws"
     "nx584"
     "omnilogic"
+    "onboarding"
     "ondilo_ico"
+    "openalpr_cloud"
+    "openalpr_local"
     "openerz"
+    "openhardwaremonitor"
     "opentherm_gw"
+    "openuv"
+    "openweathermap"
+    "opnsense"
     "ovo_energy"
+    "owntracks"
     "ozw"
     "panel_custom"
     "panel_iframe"
     "persistent_notification"
     "person"
     "philips_js"
+    "pi_hole"
+    "picnic"
+    "ping"
     "plaato"
+    "plant"
+    "plex"
     "plugwise"
+    "poolsense"
+    "profiler"
     "prometheus"
     "proximity"
     "push"
+    "pushbullet"
     "pvpc_hourly_pricing"
     "python_script"
+    "rachio"
+    "radarr"
+    "rainmachine"
     "random"
+    "recollect_waste"
     "recorder"
+    "reddit"
+    "remote"
     "rest"
     "rest_command"
+    "ring"
+    "risco"
     "rituals_perfume_genie"
     "rmvtransport"
     "roku"
···
     "rss_feed_template"
     "ruckus_unleashed"
     "safe_mode"
+    "samsungtv"
     "scene"
     "screenlogic"
     "script"
     "search"
+    "season"
+    "sensor"
+    "sentry"
+    "sharkiq"
     "shell_command"
+    "shelly"
     "shopping_list"
+    "sigfox"
+    "sighthound"
     "simplisafe"
     "simulated"
+    "slack"
     "sleepiq"
     "sma"
-    "smhi"
-    "sensor"
-    "slack"
+    "smappee"
     "smartthings"
     "smarttub"
+    "smhi"
     "smtp"
-    "smappee"
+    "snips"
     "solaredge"
+    "soma"
+    "somfy"
     "sonos"
+    "soundtouch"
+    "spaceapi"
+    "speedtestdotnet"
     "spotify"
     "sql"
+    "squeezebox"
     "ssdp"
+    "startca"
+    "statistics"
+    "statsd"
     "stream"
+    "stt"
     "subaru"
     "sun"
     "surepetcare"
     "switch"
+    "switcher_kis"
     "system_health"
     "system_log"
+    "tado"
     "tag"
     "tasmota"
     "tcp"
+    "telegram"
+    "tellduslive"
     "template"
     "tesla"
     "threshold"
+    "tile"
     "time_date"
     "timer"
     "tod"
+    "tomato"
+    "toon"
+    "tplink"
     "trace"
+    "transmission"
+    "trend"
     "tts"
+    "tuya"
+    "twentemilieu"
+    "twilio"
+    "twinkly"
+    "twitch"
+    "uk_transport"
+    "unifi"
+    "unifi_direct"
     "universal"
     "updater"
     "upnp"
     "uptime"
+    "usgs_earthquakes_feed"
+    "utility_meter"
+    "uvc"
     "vacuum"
+    "velbus"
+    "vera"
     "verisure"
     "version"
     "vesync"
+    "vizio"
+    "voicerss"
+    "volumio"
+    "vultr"
+    "wake_on_lan"
+    "water_heater"
+    "waze_travel_time"
     "weather"
     "webhook"
+    "webostv"
     "websocket_api"
     "wemo"
+    "wiffi"
+    "wilight"
     "wled"
     "workday"
     "worldclock"
+    "wsdot"
+    "wunderground"
+    "xiaomi"
+    "xiaomi_aqara"
     "xiaomi_miio"
+    "yamaha"
     "yandex_transport"
+    "yandextts"
     "yeelight"
     "zeroconf"
+    "zerproc"
     "zha"
+    "zodiac"
     "zone"
     "zwave"
     "zwave_js"
···
   ];
 
   pytestFlagsArray = [
-    # limit amout of runners to reduce race conditions
-    "-n auto"
+    # parallelize test run
+    "--numprocesses auto"
+    # assign tests grouped by file to workers
+    "--dist loadfile"
     # retry racy tests that end in "RuntimeError: Event loop is closed"
     "--reruns 3"
     "--only-rerun RuntimeError"
-    # assign tests grouped by file to workers
-    "--dist loadfile"
     # enable full variable printing on error
     "--showlocals"
-    # tests are located in tests/
-    "tests"
     # screenlogic/test_config_flow.py: Tries to send out UDP broadcasts
     "--deselect tests/components/screenlogic/test_config_flow.py::test_form_cannot_connect"
+    # asuswrt/test_config_flow.py: Sandbox network limitations, fails with unexpected error
+    "--deselect tests/components/asuswrt/test_config_flow.py::test_on_connect_failed"
+    # shelly/test_config_flow.py: Tries to join multicast group
+    "--deselect tests/components/shelly/test_config_flow.py::test_form"
+    "--deselect tests/components/shelly/test_config_flow.py::test_title_without_name"
+    "--deselect tests/components/shelly/test_config_flow.py::test_form_auth"
+    "--deselect tests/components/shelly/test_config_flow.py::test_form_errors_test_connection"
+    "--deselect tests/components/shelly/test_config_flow.py::test_user_setup_ignored_device"
+    "--deselect tests/components/shelly/test_config_flow.py::test_form_auth_errors_test_connection"
+    "--deselect tests/components/shelly/test_config_flow.py::test_form_auth_errors_test_connection"
+    "--deselect tests/components/shelly/test_config_flow.py::test_form_auth_errors_test_connection"
+    "--deselect tests/components/shelly/test_config_flow.py::test_zeroconf"
+    "--deselect tests/components/shelly/test_config_flow.py::test_zeroconf_sleeping_device"
+    "--deselect tests/components/shelly/test_config_flow.py::test_zeroconf_sleeping_device_error"
+    "--deselect tests/components/shelly/test_config_flow.py::test_zeroconf_sleeping_device_error"
+    "--deselect tests/components/shelly/test_config_flow.py::test_zeroconf_require_auth"
+    # tests are located in tests/
+    "tests"
     # dynamically add packages required for component tests
   ] ++ map (component: "tests/components/" + component) componentTests;
 
···
     "test_executor_shutdown_can_interrupt_threads"
     # {'theme_color': '#03A9F4'} != {'theme_color': 'blue'}
     "test_webhook_handle_get_config"
+    # onboarding tests rpi_power component, for which we are lacking rpi_bad_power library
+    "test_onboarding_core_sets_up_rpi_power"
+    "test_onboarding_core_no_rpi_power"
   ];
 
   preCheck = ''
···
 
     # the tests require the existance of a media dir
     mkdir /build/media
+
+    # put ping binary into PATH, e.g. for wake_on_lan tests
+    export PATH=${inetutils}/bin:$PATH
 
     # error out when component test directory is missing, otherwise hidden by xdist execution :(
     for component in ${lib.concatStringsSep " " (map lib.escapeShellArg componentTests)}; do

pkgs/servers/http/gitlab-pages/default.nix

···
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "1.38.0";
+  version = "1.39.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    sha256 = "sha256-QaqZGTkNAzQEqlwccAWPDP91BSc9vRDEsCBca/lEXW4=";
+    sha256 = "sha256-eyg2o/5k7/zagYjkYJOnJrHeoszbRkmdl7UgO+rmKyc=";
   };
 
-  vendorSha256 = "sha256-uuwuiGQWLIQ5UJuCKDBEvCPo2+AXtJ54ARK431qiakc=";
+  vendorSha256 = "sha256-aedJ7vsv70aybjqBfUnSr4qhlFdY7jUUOSas3vXskpM=";
   subPackages = [ "." ];
 
   meta = with lib; {

pkgs/servers/jackett/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "jackett";
-  version = "0.17.1027";
+  version = "0.18.15";
 
   src = fetchurl {
     url = "https://github.com/Jackett/Jackett/releases/download/v${version}/Jackett.Binaries.Mono.tar.gz";
-    sha256 = "sha256:1kmi4f1ghx82rfd8y4laggg8cs9apnhcdkakfi0mah7hqcnqmhm3";
+    sha256 = "sha256-z2xmF4FIv+z7ybPE7b8ZeC1+jlFi2H2J7HT09Bqyyhs=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/servers/matrix-synapse/default.nix

···
 in
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.33.2";
+  version = "1.34.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-9WZjuVvWpzCR1MjeMXfja/YV2YFHdo7QbjgUWDymCpM=";
+    sha256 = "sha256-lXVJfhcH9lKOCHn5f4Lc/OjgEYa5IpauKRhBsFXNWLw=";
   };
 
   patches = [

pkgs/tools/filesystems/blobfuse/default.nix

···
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, curl, gnutls, libgcrypt, libuuid, fuse }:
-
-stdenv.mkDerivation rec {
-  pname = "blobfuse";
-  version = "1.0.2";
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, curl, gnutls, libgcrypt, libuuid, fuse, boost }:
 
+let
+  version = "1.3.7";
   src = fetchFromGitHub {
     owner  = "Azure";
     repo   = "azure-storage-fuse";
-    rev    = "v${version}";
-    sha256 = "1qh04z1fsj1l6l12sz9yl2sy9hwlrnzac54hwrr7wvsgv90n9gbp";
+    rev    = "blobfuse-${version}-Linux";
+    sha256 = "sha256-yihIuS4AG489U7eBi/p7H6S7Cg54kkQeNVCexxQZ60A=";
+  };
+  cpplite = stdenv.mkDerivation rec {
+    pname = "cpplite";
+    inherit version src;
+
+    sourceRoot = "source/cpplite";
+    patches = [ ./install-adls.patch ];
+
+    cmakeFlags = [ "-DBUILD_ADLS=ON" "-DUSE_OPENSSL=OFF" ];
+
+    buildInputs = [ curl libuuid gnutls ];
+    nativeBuildInputs = [ cmake pkg-config ];
   };
+in stdenv.mkDerivation rec {
+  pname = "blobfuse";
+  inherit version src;
 
   NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
-  buildInputs = [ curl gnutls libgcrypt libuuid fuse ];
+  buildInputs = [ curl gnutls libgcrypt libuuid fuse boost cpplite ];
   nativeBuildInputs = [ cmake pkg-config ];
 
   meta = with lib; {

pkgs/tools/filesystems/blobfuse/install-adls.patch

···
+diff --git a/adls/CMakeLists.txt b/adls/CMakeLists.txt
+index 1fb7146..22e663a 100644
+--- a/adls/CMakeLists.txt
++++ b/adls/CMakeLists.txt
+@@ -50,3 +50,9 @@ if(BUILD_TESTS)
+   string(REGEX REPLACE "([^;]+)" "${CMAKE_CURRENT_SOURCE_DIR}/\\1" AZURE_STORAGE_ADLS_TEST_SOURCES "${AZURE_STORAGE_ADLS_TEST_SOURCES}")
+   set(AZURE_STORAGE_ADLS_TEST_SOURCES ${AZURE_STORAGE_ADLS_TEST_SOURCES} PARENT_SCOPE)
+ endif()
++
++install(TARGETS azure-storage-adls
++        ARCHIVE DESTINATION lib
++        LIBRARY DESTINATION lib
++        RUNTIME DESTINATION bin)
++

pkgs/tools/misc/macchina/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "macchina";
-  version = "0.7.2";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "Macchina-CLI";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ICiU0emo5lEs6996TwkauuBWb2+Yy6lL+/x7zQgO470=";
+    sha256 = "04ya8sa0qhj0g3h5fi5fmx0xg1glg993xad4glfm317spgkff6z7";
   };
 
-  cargoSha256 = "sha256-OfOh0YXeLT/kBuR9SOV7pHa8Z4b6+JvtVwqqwd1hCJY=";
+  cargoSha256 = "1gch2742zv0f23mq8ppmi75lmjj5m3s14wlsr72nd8hyn3ff7kbw";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Foundation ];

pkgs/tools/misc/silicon/default.nix

···
 , AppKit
 , CoreText
 , Security
+, fira-code
 }:
 
 rustPlatform.buildRustPackage rec {
···
 
   cargoSha256 = "sha256-sUPOf9er+BOMqDJ8C6+Xjjqj6NQUV2JTzGA4yUWtDWM=";
 
-  buildInputs = [ llvmPackages.libclang expat freetype ]
+  buildInputs = [ llvmPackages.libclang expat freetype fira-code ]
     ++ lib.optionals stdenv.isLinux [ libxcb ]
     ++ lib.optionals stdenv.isDarwin [ libiconv AppKit CoreText Security ];
 

pkgs/tools/misc/xvfb-run/default.nix

···
   '';
 
   meta = with lib; {
-    platforms = platforms.unix;
+    platforms = platforms.linux;
     license = licenses.gpl2;
   };
 }

pkgs/tools/networking/libreswan/default.nix

···
-{ lib, stdenv, fetchurl, makeWrapper,
-  pkg-config, systemd, gmp, unbound, bison, flex, pam, libevent, libcap_ng, curl, nspr,
-  bash, iproute2, iptables, procps, coreutils, gnused, gawk, nss, which, python3,
-  docs ? false, xmlto, libselinux, ldns
-  }:
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, nixosTests
+, pkg-config
+, systemd
+, gmp
+, unbound
+, bison
+, flex
+, pam
+, libevent
+, libcap_ng
+, curl
+, nspr
+, bash
+, iproute2
+, iptables
+, procps
+, coreutils
+, gnused
+, gawk
+, nss
+, which
+, python3
+, libselinux
+, ldns
+, xmlto
+, docbook_xml_dtd_412
+, docbook_xsl
+, findXMLCatalogs
+}:
 
 let
+  # Tools needed by ipsec scripts
   binPath = lib.makeBinPath [
-    bash iproute2 iptables procps coreutils gnused gawk nss.tools which python3
+    iproute2 iptables procps
+    coreutils gnused gawk
+    nss.tools which
   ];
 in
 
-assert docs -> xmlto != null;
-assert stdenv.isLinux -> libselinux != null;
-
 stdenv.mkDerivation rec {
   pname = "libreswan";
-  version = "3.32";
+  version = "4.4";
 
   src = fetchurl {
     url = "https://download.libreswan.org/${pname}-${version}.tar.gz";
-    sha256 = "0bj3g6qwd3ir3gk6hdl9npy3k44shf56vcgjahn30qpmx3z5fsr3";
+    sha256 = "0xj974yc0y1r7235zl4jhvxqz3bpb8js2fy9ic820zq9swh0lgsz";
   };
 
   strictDeps = true;
 
-  # These flags were added to compile v3.18. Try to lift them when updating.
-  NIX_CFLAGS_COMPILE = toString [ "-Wno-error=redundant-decls" "-Wno-error=format-nonliteral"
-    # these flags were added to build with gcc7
-    "-Wno-error=implicit-fallthrough"
-    "-Wno-error=format-truncation"
-    "-Wno-error=pointer-compare"
-    "-Wno-error=stringop-truncation"
-    # The following flag allows libreswan v3.32 to work with NSS 3.22, see
-    # https://github.com/libreswan/libreswan/issues/334.
-    # This flag should not be needed for libreswan v3.33 (which is not yet released).
-    "-DNSS_PKCS11_2_0_COMPAT=1"
-  ];
-
   nativeBuildInputs = [
     bison
     flex
-    makeWrapper
     pkg-config
+    xmlto
+    docbook_xml_dtd_412
+    docbook_xsl
+    findXMLCatalogs
   ];
 
-  buildInputs = [ bash iproute2 iptables systemd coreutils gnused gawk gmp unbound pam libevent
-                  libcap_ng curl nspr nss python3 ldns ]
-                ++ lib.optional docs xmlto
-                ++ lib.optional stdenv.isLinux libselinux;
+  buildInputs = [
+    systemd coreutils
+    gnused gawk gmp unbound pam libevent
+    libcap_ng curl nspr nss ldns
+    # needed to patch shebangs
+    python3 bash
+  ] ++ lib.optional stdenv.isLinux libselinux;
+
+  patches = [
+    # Fix compilation on aarch64, remove on next update
+    (fetchpatch {
+      url = "https://github.com/libreswan/libreswan/commit/ea50d36d2886e44317ba5ba841de1d1bf91aee6c.patch";
+      sha256 = "1jp89rm9jp55zmiyimyhg7yadj0fwwxaw7i5gyclrs38w3y1aacj";
+    })
+  ];
 
   prePatch = ''
-    # Correct bash path
-    sed -i -e 's|/bin/bash|/usr/bin/env bash|' mk/config.mk
+    # Correct iproute2 path
+    sed -e 's|"/sbin/ip"|"${iproute2}/bin/ip"|' \
+        -e 's|"/sbin/iptables"|"${iptables}/bin/iptables"|' \
+        -i initsystems/systemd/ipsec.service.in \
+           programs/verify/verify.in
 
-    # Fix systemd unit directory, and prevent the makefile from trying to reload the
-    # systemd daemon or create tmpfiles
-    sed -i -e 's|UNITDIR=.*$|UNITDIR=$\{out}/etc/systemd/system/|g' \
-      -e 's|TMPFILESDIR=.*$|TMPFILESDIR=$\{out}/tmpfiles.d/|g' \
-      -e 's|systemctl|true|g' \
-      -e 's|systemd-tmpfiles|true|g' \
-      initsystems/systemd/Makefile
+    # Prevent the makefile from trying to
+    # reload the systemd daemon or create tmpfiles
+    sed -e 's|systemctl|true|g' \
+        -e 's|systemd-tmpfiles|true|g' \
+        -i initsystems/systemd/Makefile
 
     # Fix the ipsec program from crushing the PATH
-    sed -i -e 's|\(PATH=".*"\):.*$|\1:$PATH|' programs/ipsec/ipsec.in
+    sed -e 's|\(PATH=".*"\):.*$|\1:$PATH|' -i programs/ipsec/ipsec.in
 
     # Fix python script to use the correct python
-    sed -i -e 's|#!/usr/bin/python|#!/usr/bin/env python|' -e 's/^\(\W*\)installstartcheck()/\1sscmd = "ss"\n\0/' programs/verify/verify.in
+    sed -e 's/^\(\W*\)installstartcheck()/\1sscmd = "ss"\n\0/' \
+        -i programs/verify/verify.in
+
+    # Replace wget with curl to save a dependency
+    curlArgs='-s --remote-name-all --output-dir'
+    sed -e "s|wget -q -P|${curl}/bin/curl $curlArgs|g" \
+        -i programs/letsencrypt/letsencrypt.in
+
+    # Patch the Makefile:
+    # 1. correct the pam.d directory install path
+    # 2. do not create the /var/lib/ directory
+    sed -e 's|$(DESTDIR)/etc/pam.d|$(out)/etc/pam.d|' \
+        -e '/test ! -d $(NSSDIR)/,+3d' \
+        -i configs/Makefile
   '';
 
   # Set appropriate paths for build
···
 
   makeFlags = [
     "INITSYSTEM=systemd"
-    (if docs then "all" else "base")
+    "UNITDIR=$(out)/etc/systemd/system/"
+    "TMPFILESDIR=$(out)/lib/tmpfiles.d/"
   ];
 
-  installTargets = [ (if docs then "install" else "install-base") ];
   # Hack to make install work
   installFlags = [
     "FINALVARDIR=\${out}/var"
···
   ];
 
   postInstall = ''
-    for i in $out/bin/* $out/libexec/ipsec/*; do
-      wrapProgram "$i" --prefix PATH ':' "$out/bin:${binPath}"
-    done
+    # Install examples directory (needed for letsencrypt)
+    cp -r docs/examples $out/share/doc/libreswan/examples
   '';
 
-  enableParallelBuilding = true;
+  postFixup = ''
+    # Add a PATH to the main "ipsec" script
+    sed -e '0,/^$/{s||export PATH=${binPath}:$PATH|}' \
+        -i $out/bin/ipsec
+  '';
+
+  passthru.tests.libreswan = nixosTests.libreswan;
 
   meta = with lib; {
     homepage = "https://libreswan.org";
     description = "A free software implementation of the VPN protocol based on IPSec and the Internet Key Exchange";
     platforms = platforms.linux ++ platforms.freebsd;
-    license = licenses.gpl2;
-    maintainers = [ maintainers.afranchuk ];
+    license = with licenses; [ gpl2Plus mpl20 ] ;
+    maintainers = with maintainers; [ afranchuk rnhmjoj ];
   };
 }

pkgs/tools/networking/tinyproxy/default.nix

···
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, asciidoc, libxml2,
-  libxslt, docbook_xsl }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, perl, withDebug ? false }:
 
 stdenv.mkDerivation rec {
   pname = "tinyproxy";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
-    sha256 = "0gzapnllzyc005l3rs6iarjk1p5fc8mf9ysbck1mbzbd8xg6w35s";
+    sha256 = "13fhkmmrwzl657dq04x2wagkpjwdrzhkl141qvzr7y7sli8j0w1n";
     rev = version;
     repo = "tinyproxy";
     owner = "tinyproxy";
   };
 
-  nativeBuildInputs = [ autoreconfHook asciidoc libxml2 libxslt docbook_xsl ];
-
-  # -z flag is not supported in darwin
-  preAutoreconf = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace configure.ac --replace \
-          'LDFLAGS="-Wl,-z,defs $LDFLAGS"' \
-          'LDFLAGS="-Wl, $LDFLAGS"'
-  '';
-
-  # See: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=154624
-  postConfigure = ''
-    substituteInPlace docs/man5/Makefile --replace \
-          "-f manpage" \
-          "--xsltproc-opts=--nonet \\
-           -f manpage \\
-           -L"
-    substituteInPlace docs/man8/Makefile --replace \
-          "-f manpage" \
-          "--xsltproc-opts=--nonet \\
-           -f manpage \\
-           -L"
-  '';
+  # perl is needed for man page generation.
+  nativeBuildInputs = [ autoreconfHook perl ];
 
-  configureFlags = [
-    "--disable-debug"      # Turn off debugging
-    "--enable-xtinyproxy"  # Compile in support for the XTinyproxy header, which is sent to any web server in your domain.
-    "--enable-filter"      # Allows Tinyproxy to filter out certain domains and URLs.
-    "--enable-upstream"    # Enable support for proxying connections through another proxy server.
-    "--enable-transparent" # Allow Tinyproxy to be used as a transparent proxy daemon.
-    "--enable-reverse"     # Enable reverse proxying.
-  ] ++
-  # See: https://github.com/tinyproxy/tinyproxy/issues/1
-  lib.optional stdenv.isDarwin "--disable-regexcheck";
+  configureFlags = lib.optionals withDebug [ "--enable-debug" ]; # Enable debugging support code and methods.
 
   meta = with lib; {
     homepage = "https://tinyproxy.github.io/";
     description = "A light-weight HTTP/HTTPS proxy daemon for POSIX operating systems";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.all;
     maintainers = [ maintainers.carlosdagos ];
   };

pkgs/tools/nix/nixos-install-tools/default.nix

···
+{
+  buildEnv,
+  lib,
+  man,
+  nixos,
+  # TODO: replace indirect self-reference by proper self-reference
+  #       https://github.com/NixOS/nixpkgs/pull/119942
+  nixos-install-tools,
+  runCommand,
+}:
+let
+  inherit (nixos {}) config;
+  version = config.system.nixos.version;
+in
+(buildEnv {
+  name = "nixos-install-tools-${version}";
+  paths = lib.attrValues {
+    # See nixos/modules/installer/tools/tools.nix
+    inherit (config.system.build)
+      nixos-install nixos-generate-config nixos-enter;
+
+    # Required for --help.
+    inherit (config.system.build.manual) manpages;
+  };
+
+  extraOutputsToInstall = ["man"];
+
+  meta = {
+    description = "The essential commands from the NixOS installer as a package";
+    longDescription = ''
+      With this package, you get the commands like nixos-generate-config and
+      nixos-install that you would otherwise only find on a NixOS system, such
+      as an installer image.
+
+      This way, you can install NixOS using a machine that only has Nix.
+    '';
+    license = lib.licenses.mit;
+    homepage = "https://nixos.org";
+    platforms = lib.platforms.linux;
+  };
+
+  passthru.tests = {
+    nixos-install-help = runCommand "test-nixos-install-help" {
+      nativeBuildInputs = [
+        man
+        nixos-install-tools
+      ];
+      meta.description = ''
+        Make sure that --help works. It's somewhat non-trivial because it
+        requires man.
+      '';
+    } ''
+      nixos-install --help | grep -F 'NixOS Reference Pages'
+      nixos-install --help | grep -F 'configuration.nix'
+      nixos-generate-config --help | grep -F 'NixOS Reference Pages'
+      nixos-generate-config --help | grep -F 'hardware-configuration.nix'
+
+      # FIXME: Tries to call unshare, which it must not do for --help
+      # nixos-enter --help | grep -F 'NixOS Reference Pages'
+
+      touch $out
+    '';
+  };
+}).overrideAttrs (o: {
+  inherit version;
+  pname = "nixos-install-tools";
+})

pkgs/tools/security/sequoia/default.nix

···
   pname = "sequoia";
   # Upstream has separate version numbering for the library and the CLI frontend.
   # This derivation provides the CLI frontend, and thus uses its version number.
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitLab {
     owner = "sequoia-pgp";
     repo = "sequoia";
     rev = "sq/v${version}";
-    sha256 = "0zavkf0grkqljyiywcprsiv8igidk8vc3yfj3fzqvbhm43vnnbdw";
+    sha256 = "13f582g10vba0cpbdmqkkfzgd5jgagb640jaz1w425wf5nbh6q50";
   };
 
-  cargoSha256 = "0zv6mnjbp44vp85rw4l1nqk4yb7dzqp031r8rgqq2avbnq018yhk";
+  cargoSha256 = "sha256-qIGP48uj2iQ6MVgy5anKI9QrX9vnuKh46Fmmcczda4w=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/tools/system/gdu/default.nix

···
 { lib
+, stdenv
 , buildGoModule
 , fetchFromGitHub
 , installShellFiles
···
 
 buildGoModule rec {
   pname = "gdu";
-  version = "4.11.1";
+  version = "4.11.2";
 
   src = fetchFromGitHub {
     owner = "dundee";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-e9TYArmNWnK8XXcniAQCegrfWAUfTKKuClgdSTQep0U=";
+    sha256 = "sha256-IrlyHYAcoRvF5CA0LMKHTb8aYSawvEcU7s+a03QYI1c=";
   };
 
   vendorSha256 = "sha256-QiO5p0x8kmIN6f0uYS0IR2MlWtRYTHeZpW6Nmupjias=";
···
   ];
 
   postPatch = ''
-    substituteInPlace cmd/app/app_test.go --replace "development" "${version}"
+    substituteInPlace cmd/gdu/app/app_test.go --replace "development" "${version}"
   '';
 
   postInstall = ''
     installManPage gdu.1
   '';
 
-  # tests fail with:
-  #  dir_test.go:76:
-  #              Error Trace:    dir_test.go:76
-  #              Error:          Not equal:
-  #                              expected: 0
-  #                              actual  : 512
-  #              Test:           TestFlags
-  doCheck = false;
+  doCheck = !(stdenv.isAarch64 || stdenv.isDarwin);
 
   meta = with lib; {
     description = "Disk usage analyzer with console interface";

pkgs/top-level/all-packages.nix

···
 
   deno = callPackage ../development/web/deno {
     inherit (darwin) libobjc;
-    inherit (darwin.apple_sdk.frameworks) Security CoreServices Metal Foundation;
+    inherit (darwin.apple_sdk.frameworks)
+      Security CoreServices Metal Foundation QuartzCore;
   };
 
   detox = callPackage ../tools/misc/detox { };
···
 
   lttv = callPackage ../development/tools/misc/lttv { };
 
-  luaformatter = callPackage ../development/tools/luaformatter { };
+  luaformatter = callPackage ../development/tools/luaformatter
+    (lib.optionalAttrs stdenv.isDarwin {
+      stdenv = overrideCC stdenv llvmPackages_latest.clang;
+    });
 
   massif-visualizer = libsForQt5.callPackage ../development/tools/analysis/massif-visualizer { };
 
···
 
   remake = callPackage ../development/tools/build-managers/remake { };
 
+  replace-secret = callPackage ../build-support/replace-secret/replace-secret.nix { };
+
   replacement = callPackage ../development/tools/misc/replacement { };
 
   retdec = callPackage ../development/tools/analysis/retdec {
···
   texi2mdoc = callPackage ../tools/misc/texi2mdoc { };
 
   texlab = callPackage ../development/tools/misc/texlab {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) Security CoreServices;
   };
 
   tflint = callPackage ../development/tools/analysis/tflint { };
···
 
     bbswitch = callPackage ../os-specific/linux/bbswitch {};
 
-    ati_drivers_x11 = callPackage ../os-specific/linux/ati-drivers { };
+    ati_drivers_x11 = throw "ati drivers are no longer supported by any kernel >=4.1"; # added 2021-05-18
 
     chipsec = callPackage ../tools/security/chipsec {
       inherit kernel;
···
 
   lavalauncher = callPackage ../applications/misc/lavalauncher { };
 
-  t-rec = callPackage ../misc/t-rec { };
+  t-rec = callPackage ../misc/t-rec {
+    inherit (darwin.apple_sdk.frameworks) Foundation;
+  };
 
   ulauncher = callPackage ../applications/misc/ulauncher { };
 
···
 
   utox = callPackage ../applications/networking/instant-messengers/utox { };
 
-  valentina = libsForQt514.callPackage ../applications/misc/valentina { };
+  valentina = libsForQt512.callPackage ../applications/misc/valentina { };
 
   vbindiff = callPackage ../applications/editors/vbindiff { };
 
···
     (import ../../nixos/lib/make-options-doc/default.nix)
     ({ inherit pkgs lib; } // attrs);
 
+  nixos-install-tools = callPackage ../tools/nix/nixos-install-tools { };
+
   nixui = callPackage ../tools/package-management/nixui { node_webkit = nwjs_0_12; };
 
   nixdoc = callPackage ../tools/nix/nixdoc {};
···
     hasktags = haskellPackages.hasktags;
   };
 
-  spacenavd = callPackage ../misc/drivers/spacenavd { };
+  spacenavd = callPackage ../misc/drivers/spacenavd {
+    inherit (darwin.apple_sdk.frameworks) IOKit;
+  };
 
   spacenav-cube-example = callPackage ../applications/misc/spacenav-cube-example { };
 

pkgs/top-level/haskell-packages.nix

···
       llvmPackages = pkgs.llvmPackages_10;
     };
     ghcHEAD = callPackage ../development/compilers/ghc/head.nix {
-      bootPkgs = packages.ghc8104; # no binary yet
+      bootPkgs = packages.ghc901; # no binary yet
       inherit (buildPackages.python3Packages) sphinx;
       buildLlvmPackages = buildPackages.llvmPackages_10;
       llvmPackages = pkgs.llvmPackages_10;

pkgs/top-level/python-packages.nix

···
 
   pythonnet = callPackage
     ../development/python-modules/pythonnet {
-      # `mono >= 4.6` required to prevent crashes encountered with earlier versions.
-      mono = pkgs.mono4;
+      # Using `mono > 5`, tests are failing..
+      mono = pkgs.mono5;
     };
 
   python-nmap = callPackage ../development/python-modules/python-nmap { };
···
 
   spinners = callPackage ../development/python-modules/spinners { };
 
+  sphinxcontrib-actdiag = callPackage ../development/python-modules/sphinxcontrib-actdiag { };
+
   sphinxcontrib-applehelp = callPackage ../development/python-modules/sphinxcontrib-applehelp { };
 
   sphinxcontrib-autoapi = callPackage ../development/python-modules/sphinxcontrib-autoapi { };
···
 
   sphinxcontrib-katex = callPackage ../development/python-modules/sphinxcontrib-katex { };
 
+  sphinxcontrib-nwdiag = callPackage ../development/python-modules/sphinxcontrib-nwdiag { };
+
   sphinxcontrib_newsfeed = callPackage ../development/python-modules/sphinxcontrib_newsfeed { };
 
   sphinxcontrib-openapi = callPackage ../development/python-modules/sphinxcontrib-openapi { };
···
   sphinxcontrib-qthelp = callPackage ../development/python-modules/sphinxcontrib-qthelp { };
 
   sphinxcontrib-serializinghtml = callPackage ../development/python-modules/sphinxcontrib-serializinghtml { };
+
+  sphinxcontrib-seqdiag = callPackage ../development/python-modules/sphinxcontrib-seqdiag { };
 
   sphinxcontrib-spelling = callPackage ../development/python-modules/sphinxcontrib-spelling { };
 

pkgs/top-level/release-haskell.nix

···
 /*
+  This is the Hydra jobset for the `haskell-updates` branch in Nixpkgs.
+  You can see the status of this jobset at
+  https://hydra.nixos.org/jobset/nixpkgs/haskell-updates.
+
   To debug this expression you can use `hydra-eval-jobs` from
   `pkgs.hydra-unstable` which prints the jobset description
   to `stdout`:
···
         koka
         krank
         lambdabot
-        ldgallery
         madlang
         matterhorn
         mueval
···
       cabal-install = all;
       Cabal_3_4_0_0 = with compilerNames; [ ghc884 ghc8104 ];
       funcmp = all;
-      haskell-language-server = all;
+      # Doesn't currently work on ghc-9.0:
+      # https://github.com/haskell/haskell-language-server/issues/297
+      haskell-language-server = with compilerNames; [ ghc884 ghc8104 ];
       hoogle = all;
       hsdns = all;
       jailbreak-cabal = all;
···
         constituents = accumulateDerivations [
           # haskell specific tests
           jobs.tests.haskell
-          jobs.tests.writers # writeHaskell{,Bin}
+          # writeHaskell and writeHaskellBin
+          # TODO: writeHaskell currently fails on darwin
+          jobs.tests.writers.x86_64-linux
+          jobs.tests.writers.aarch64-linux
           # important top-level packages
           jobs.cabal-install
           jobs.cabal2nix