Merge staging-next into staging

nixos/modules/module-list.nix

···
   ./services/network-filesystems/glusterfs.nix
   ./services/network-filesystems/kbfs.nix
   ./services/network-filesystems/ipfs.nix
+  ./services/network-filesystems/litestream/default.nix
   ./services/network-filesystems/netatalk.nix
   ./services/network-filesystems/nfsd.nix
   ./services/network-filesystems/openafs/client.nix
···
   ./services/web-apps/moodle.nix
   ./services/web-apps/nextcloud.nix
   ./services/web-apps/nexus.nix
+  ./services/web-apps/node-red.nix
   ./services/web-apps/plantuml-server.nix
   ./services/web-apps/plausible.nix
   ./services/web-apps/pgpkeyserver-lite.nix

nixos/modules/services/network-filesystems/litestream/default.nix

···
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.litestream;
+  settingsFormat = pkgs.formats.yaml {};
+in
+{
+  options.services.litestream = {
+    enable = mkEnableOption "litestream";
+
+    package = mkOption {
+      description = "Package to use.";
+      default = pkgs.litestream;
+      defaultText = "pkgs.litestream";
+      type = types.package;
+    };
+
+    settings = mkOption {
+      description = ''
+        See the <link xlink:href="https://litestream.io/reference/config/">documentation</link>.
+      '';
+      type = settingsFormat.type;
+      example = {
+        dbs = [
+          {
+            path = "/var/lib/db1";
+            replicas = [
+              {
+                url = "s3://mybkt.litestream.io/db1";
+              }
+            ];
+          }
+        ];
+      };
+    };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/litestream";
+      description = ''
+        Environment file as defined in <citerefentry>
+        <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
+        </citerefentry>.
+
+        Secrets may be passed to the service without adding them to the
+        world-readable Nix store, by specifying placeholder variables as
+        the option value in Nix and setting these variables accordingly in the
+        environment file.
+
+        By default, Litestream will perform environment variable expansion
+        within the config file before reading it. Any references to ''$VAR or
+        ''${VAR} formatted variables will be replaced with their environment
+        variable values. If no value is set then it will be replaced with an
+        empty string.
+
+        <programlisting>
+          # Content of the environment file
+          LITESTREAM_ACCESS_KEY_ID=AKIAxxxxxxxxxxxxxxxx
+          LITESTREAM_SECRET_ACCESS_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxx
+        </programlisting>
+
+        Note that this file needs to be available on the host on which
+        this exporter is running.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    environment.etc = {
+      "litestream.yml" = {
+        source = settingsFormat.generate "litestream-config.yaml" cfg.settings;
+      };
+    };
+
+    systemd.services.litestream = {
+      description = "Litestream";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "networking.target" ];
+      serviceConfig = {
+        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        ExecStart = "${cfg.package}/bin/litestream replicate";
+        Restart = "always";
+        User = "litestream";
+        Group = "litestream";
+      };
+    };
+
+    users.users.litestream = {
+      description = "Litestream user";
+      group = "litestream";
+      isSystemUser = true;
+    };
+    users.groups.litestream = {};
+  };
+  meta.doc = ./litestream.xml;
+}

nixos/modules/services/network-filesystems/litestream/litestream.xml

···
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="module-services-litestream">
+ <title>Litestream</title>
+ <para>
+  <link xlink:href="https://litestream.io/">Litestream</link> is a standalone streaming
+  replication tool for SQLite.
+ </para>
+
+ <section xml:id="module-services-litestream-configuration">
+  <title>Configuration</title>
+
+  <para>
+   Litestream service is managed by a dedicated user named <literal>litestream</literal>
+   which needs permission to the database file. Here's an example config which gives
+   required permissions to access <link linkend="opt-services.grafana.database.path">
+   grafana database</link>:
+<programlisting>
+{ pkgs, ... }:
+{
+  users.users.litestream.extraGroups = [ "grafana" ];
+
+  systemd.services.grafana.serviceConfig.ExecStartPost = "+" + pkgs.writeShellScript "grant-grafana-permissions" ''
+    timeout=10
+
+    while [ ! -f /var/lib/grafana/data/grafana.db ];
+    do
+      if [ "$timeout" == 0 ]; then
+        echo "ERROR: Timeout while waiting for /var/lib/grafana/data/grafana.db."
+        exit 1
+      fi
+
+      sleep 1
+
+      ((timeout--))
+    done
+
+    find /var/lib/grafana -type d -exec chmod -v 775 {} \;
+    find /var/lib/grafana -type f -exec chmod -v 660 {} \;
+  '';
+
+  services.litestream = {
+    enable = true;
+
+    environmentFile = "/run/secrets/litestream";
+
+    settings = {
+      dbs = [
+        {
+          path = "/var/lib/grafana/data/grafana.db";
+          replicas = [{
+            url = "s3://mybkt.litestream.io/grafana";
+          }];
+        }
+      ];
+    };
+  };
+}
+</programlisting>
+  </para>
+ </section>
+
+</chapter>

nixos/modules/services/web-apps/node-red.nix

···
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.node-red;
+  defaultUser = "node-red";
+  finalPackage = if cfg.withNpmAndGcc then node-red_withNpmAndGcc else cfg.package;
+  node-red_withNpmAndGcc = pkgs.runCommandNoCC "node-red" {
+    nativeBuildInputs = [ pkgs.makeWrapper ];
+  }
+  ''
+    mkdir -p $out/bin
+    makeWrapper ${pkgs.nodePackages.node-red}/bin/node-red $out/bin/node-red \
+      --set PATH '${lib.makeBinPath [ pkgs.nodePackages.npm pkgs.gcc ]}:$PATH' \
+  '';
+in
+{
+  options.services.node-red = {
+    enable = mkEnableOption "the Node-RED service";
+
+    package = mkOption {
+      default = pkgs.nodePackages.node-red;
+      defaultText = "pkgs.nodePackages.node-red";
+      type = types.package;
+      description = "Node-RED package to use.";
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Open ports in the firewall for the server.
+      '';
+    };
+
+    withNpmAndGcc = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Give Node-RED access to NPM and GCC at runtime, so 'Nodes' can be
+        downloaded and managed imperatively via the 'Palette Manager'.
+      '';
+    };
+
+    configFile = mkOption {
+      type = types.path;
+      default = "${cfg.package}/lib/node_modules/node-red/settings.js";
+      defaultText = "\${cfg.package}/lib/node_modules/node-red/settings.js";
+      description = ''
+        Path to the JavaScript configuration file.
+        See <link
+        xlink:href="https://github.com/node-red/node-red/blob/master/packages/node_modules/node-red/settings.js"/>
+        for a configuration example.
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 1880;
+      description = "Listening port.";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = defaultUser;
+      description = ''
+        User under which Node-RED runs.If left as the default value this user
+        will automatically be created on system activation, otherwise the
+        sysadmin is responsible for ensuring the user exists.
+      '';
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = defaultUser;
+      description = ''
+        Group under which Node-RED runs.If left as the default value this group
+        will automatically be created on system activation, otherwise the
+        sysadmin is responsible for ensuring the group exists.
+      '';
+    };
+
+    userDir = mkOption {
+      type = types.path;
+      default = "/var/lib/node-red";
+      description = ''
+        The directory to store all user data, such as flow and credential files and all library data. If left
+        as the default value this directory will automatically be created before the node-red service starts,
+        otherwise the sysadmin is responsible for ensuring the directory exists with appropriate ownership
+        and permissions.
+      '';
+    };
+
+    safe = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to launch Node-RED in --safe mode.";
+    };
+
+    define = mkOption {
+      type = types.attrs;
+      default = {};
+      description = "List of settings.js overrides to pass via -D to Node-RED.";
+      example = literalExample ''
+        {
+          "logging.console.level" = "trace";
+        }
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users = optionalAttrs (cfg.user == defaultUser) {
+      ${defaultUser} = {
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = optionalAttrs (cfg.group == defaultUser) {
+      ${defaultUser} = { };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+
+    systemd.services.node-red = {
+      description = "Node-RED Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "networking.target" ];
+      environment = {
+        HOME = cfg.userDir;
+      };
+      serviceConfig = mkMerge [
+        {
+          User = cfg.user;
+          Group = cfg.group;
+          ExecStart = "${finalPackage}/bin/node-red ${pkgs.lib.optionalString cfg.safe "--safe"} --settings ${cfg.configFile} --port ${toString cfg.port} --userDir ${cfg.userDir} ${concatStringsSep " " (mapAttrsToList (name: value: "-D ${name}=${value}") cfg.define)}";
+          PrivateTmp = true;
+          Restart = "always";
+          WorkingDirectory = cfg.userDir;
+        }
+        (mkIf (cfg.userDir == "/var/lib/node-red") { StateDirectory = "node-red"; })
+      ];
+    };
+  };
+}

nixos/tests/all-tests.nix

···
   libreswan = handleTest ./libreswan.nix {};
   lightdm = handleTest ./lightdm.nix {};
   limesurvey = handleTest ./limesurvey.nix {};
+  litestream = handleTest ./litestream.nix {};
   locate = handleTest ./locate.nix {};
   login = handleTest ./login.nix {};
   loki = handleTest ./loki.nix {};
···
   morty = handleTest ./morty.nix {};
   mosquitto = handleTest ./mosquitto.nix {};
   mpd = handleTest ./mpd.nix {};
+  mpv = handleTest ./mpv.nix {};
   mumble = handleTest ./mumble.nix {};
   musescore = handleTest ./musescore.nix {};
   munin = handleTest ./munin.nix {};
···
   nix-serve = handleTest ./nix-ssh-serve.nix {};
   nix-ssh-serve = handleTest ./nix-ssh-serve.nix {};
   nixos-generate-config = handleTest ./nixos-generate-config.nix {};
+  node-red = handleTest ./node-red.nix {};
   nomad = handleTest ./nomad.nix {};
   novacomd = handleTestOn ["x86_64-linux"] ./novacomd.nix {};
   nsd = handleTest ./nsd.nix {};

nixos/tests/litestream.nix

···
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "litestream";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jwygoda ];
+  };
+
+  machine =
+    { pkgs, ... }:
+    { services.litestream = {
+        enable = true;
+        settings = {
+          dbs = [
+            {
+              path = "/var/lib/grafana/data/grafana.db";
+              replicas = [{
+                url = "sftp://foo:bar@127.0.0.1:22/home/foo/grafana";
+              }];
+            }
+          ];
+        };
+      };
+      systemd.services.grafana.serviceConfig.ExecStartPost = "+" + pkgs.writeShellScript "grant-grafana-permissions" ''
+        timeout=10
+
+        while [ ! -f /var/lib/grafana/data/grafana.db ];
+        do
+          if [ "$timeout" == 0 ]; then
+            echo "ERROR: Timeout while waiting for /var/lib/grafana/data/grafana.db."
+            exit 1
+          fi
+
+          sleep 1
+
+          ((timeout--))
+        done
+
+        find /var/lib/grafana -type d -exec chmod -v 775 {} \;
+        find /var/lib/grafana -type f -exec chmod -v 660 {} \;
+      '';
+      services.openssh = {
+        enable = true;
+        allowSFTP = true;
+        listenAddresses = [ { addr = "127.0.0.1"; port = 22; } ];
+      };
+      services.grafana = {
+        enable = true;
+        security = {
+          adminUser = "admin";
+          adminPassword = "admin";
+        };
+        addr = "localhost";
+        port = 3000;
+        extraOptions = {
+          DATABASE_URL = "sqlite3:///var/lib/grafana/data/grafana.db?cache=private&mode=rwc&_journal_mode=WAL";
+        };
+      };
+      users.users.foo = {
+        isNormalUser = true;
+        password = "bar";
+      };
+      users.users.litestream.extraGroups = [ "grafana" ];
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_until_succeeds("test -d /home/foo/grafana")
+    machine.wait_for_open_port(3000)
+    machine.succeed("""
+        curl -sSfN -X PUT -H "Content-Type: application/json" -d '{
+          "oldPassword": "admin",
+          "newPassword": "newpass",
+          "confirmNew": "newpass"
+        }' http://admin:admin@127.0.0.1:3000/api/user/password
+    """)
+    # https://litestream.io/guides/systemd/#simulating-a-disaster
+    machine.systemctl("stop litestream.service")
+    machine.succeed(
+        "rm -f /var/lib/grafana/data/grafana.db "
+        "/var/lib/grafana/data/grafana.db-shm "
+        "/var/lib/grafana/data/grafana.db-wal"
+    )
+    machine.succeed(
+        "litestream restore /var/lib/grafana/data/grafana.db "
+        "&& chown grafana:grafana /var/lib/grafana/data/grafana.db "
+        "&& chmod 660 /var/lib/grafana/data/grafana.db"
+    )
+    machine.systemctl("restart grafana.service")
+    machine.wait_for_open_port(3000)
+    machine.succeed(
+        "curl -sSfN -u admin:newpass http://127.0.0.1:3000/api/org/users | grep admin\@localhost"
+    )
+  '';
+})

nixos/tests/mpv.nix

···
+import ./make-test-python.nix ({ lib, ... }:
+
+with lib;
+
+let
+  port = toString 4321;
+in
+{
+  name = "mpv";
+  meta.maintainers = with maintainers; [ zopieux ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.curl
+        (pkgs.mpv-with-scripts.override {
+          scripts = [ pkgs.mpvScripts.simple-mpv-webui ];
+        })
+      ];
+    };
+
+  testScript = ''
+    machine.execute("set -m; mpv --script-opts=webui-port=${port} --idle=yes &")
+    machine.wait_for_open_port(${port})
+    assert "<title>simple-mpv-webui" in machine.succeed("curl -s localhost:${port}")
+  '';
+})

nixos/tests/node-red.nix

···
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "nodered";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ matthewcroughan ];
+  };
+
+  nodes = {
+    client = { config, pkgs, ... }: {
+      environment.systemPackages = [ pkgs.curl ];
+    };
+    nodered = { config, pkgs, ... }: {
+      services.node-red = {
+        enable = true;
+        openFirewall = true;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    nodered.wait_for_unit("node-red.service")
+    nodered.wait_for_open_port("1880")
+
+    client.wait_for_unit("multi-user.target")
+
+    with subtest("Check that the Node-RED webserver can be reached."):
+        assert "<title>Node-RED</title>" in client.succeed(
+            "curl -sSf http:/nodered:1880/ | grep title"
+        )
+  '';
+})

pkgs/applications/misc/calibre/default.nix

···
 , libmtp
 , xdg-utils
 , removeReferencesTo
+, libstemmer
 }:
 
 mkDerivation rec {
   pname = "calibre";
-  version = "5.17.0";
+  version = "5.24.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-rdiBL3Y3q/0wFfWGE4jGkWakgV8hA9HjDcKXso6tVrs=";
+    hash = "sha256:18dr577nv7ijw3ar6mrk2xrc54mlrqkaj5jrc6s5sirl0710fdfg";
   };
 
   patches = [
···
     libjpeg
     libmtp
     libpng
+    libstemmer
     libusb1
     podofo
     poppler_utils
···
     xdg-utils
   ] ++ (
     with python3Packages; [
-      apsw
+      (apsw.overrideAttrs (oldAttrs: rec {
+        setupPyBuildFlags = [ "--enable=load_extension" ];
+      }))
       beautifulsoup4
       cchardet
       css-parser
···
       python
       regex
       sip
-      (zeroconf.overrideAttrs (oldAttrs: rec {
-        version = "0.31.0";
-        src = fetchFromGitHub {
-          owner = "jstasiak";
-          repo = "python-zeroconf";
-          rev = version;
-          sha256 = "158dqay74zvnz6kmpvip4ml0kw59nf2aaajwgaamx0zc8ci1p5pj";
-        };
-      }))
+      zeroconf
       # the following are distributed with calibre, but we use upstream instead
       odfpy
     ] ++ lib.optional (unrarSupport) unrardll

pkgs/applications/misc/freeplane/default.nix

···
 
 let
   pname = "freeplane";
-  version = "1.8.11";
+  version = "1.9.5";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "release-${version}";
-    sha256 = "07xjx9pf62dvy8lx6vnbwwcn1zqy89cmdmwy792k7gb12wz81nnc";
+    sha256 = "qfhhmF3mePxcL4U8izkEmWaiaOLi4slsaymVnDoO3sY=";
   };
 
   deps = stdenv.mkDerivation {
···
 
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "0r7f6713m0whh5hlk1id7z9j5v9494r41sivn9fzl63q70kzz92g";
+    outputHash = "xphTzaSXTGpP7vI/t4oIiv1ZpbekG2dFRzyl3ub6qnA=";
   };
 
   # Point to our local deps repo

pkgs/applications/misc/yambar/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "yambar";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchgit {
     url = "https://codeberg.org/dnkl/yambar.git";
     rev = version;
-    sha256 = "p47tFsEWsYNe6IVV65xGG211u6Vm2biRf4pmUDylBOQ=";
+    sha256 = "sha256-oUNkaWrYIcsK2u+aeRg6DHmH4M1VZ0leNSM0lV9Yy1Y=";
   };
 
   nativeBuildInputs = [ pkg-config meson ninja scdoc ];

pkgs/applications/networking/instant-messengers/zulip/default.nix

···
 
 let
   pname = "zulip";
-  version = "5.8.0";
+  version = "5.8.1";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/zulip/zulip-desktop/releases/download/v${version}/Zulip-${version}-x86_64.AppImage";
-    sha256 = "0z8lp56j6qvm57sfqdyqrqzj9add3drh1z4zsckg45jfw6yn3jdv";
+    sha256 = "02m18y5j6jmmlygv8ycwaaq6n7mvj97ljhd3l9pvii0adwcvrpfz";
     name="${pname}-${version}.AppImage";
   };
 

pkgs/applications/science/robotics/mavproxy/default.nix

···
 
 buildPythonApplication rec {
   pname = "MAVProxy";
-  version = "1.8.39";
+  version = "1.8.40";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-1RXuAiz9i5ZnLtDGQ+o3DNgWJ2FDJGIoelmlDmEzrts=";
+    sha256 = "cad317e2e879f1f7cb59af078788aaf0d09cd761ecd91ad091adf7ac6cc1bcdb";
   };
 
   postPatch = ''

pkgs/applications/video/mpv/scripts/simple-mpv-webui.nix

···
 , fetchFromGitHub }:
 stdenvNoCC.mkDerivation rec {
   pname = "simple-mpv-ui";
-  version = "1.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "open-dynaMIX";
     repo = "simple-mpv-webui";
     rev = "v${version}";
-    sha256 = "1glrnnl1slcl0ri0zs4j64lc9aa52p9ffh6av0d81fk95nm98917";
+    sha256 = "1z0y8sdv5mbxznxqh43w5592ym688vkvqg7w26p8cinrhf09pbw8";
   };
 
   dontBuild = true;
···
   meta = with lib; {
     description = "A web based user interface with controls for the mpv mediaplayer";
     homepage = "https://github.com/open-dynaMIX/simple-mpv-webui";
-    maintainers = [ maintainers.cript0nauta ];
+    maintainers = with maintainers; [ cript0nauta zopieux ];
     longDescription = ''
       You can access the webui when accessing http://127.0.0.1:8080 or
       http://[::1]:8080 in your webbrowser. By default it listens on

pkgs/desktops/arcan/arcan.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "arcan";
-  version = "0.6.1pre1+unstable=2021-07-10";
+  version = "0.6.1pre1+unstable=2021-07-30";
 
   src = fetchFromGitHub {
     owner = "letoram";
     repo = "arcan";
-    rev = "25da999e6e03688c71c7df3852314c01ed610e0d";
-    hash = "sha256-+ZF6mD/Z0N/5QCjXe80z4L6JOE33+Yv4ZlwKvlG/c44=";
+    rev = "885b2f0c9e031fd157af21302af2027ecbe3fe1f";
+    hash = "sha256-tj5kPa5OWCGt7LTzo4ZYV1UjBpOrjQHER/K+ZfL3h+8=";
   };
 
   postUnpack = ''

pkgs/desktops/arcan/wrapper.nix

···
         --set ARCAN_BINPATH "${placeholder "out"}/bin/arcan_frameserver" \
         --set ARCAN_LIBPATH "${placeholder "out"}/lib/" \
         --set ARCAN_RESOURCEPATH "${placeholder "out"}/share/arcan/resources/" \
-        --set ARCAN_SCRIPTPATH "${placeholder "out"}/share/arcan/scripts/" \
-        --set ARCAN_STATEBASEPATH "\$HOME/.arcan/resources/savestates/"
+        --set ARCAN_SCRIPTPATH "${placeholder "out"}/share/arcan/scripts/"
     done
   '';
 }
 # TODO: set ARCAN_FONTPATH to a set of fonts that can be provided in a parameter
+# TODO: set ARCAN_STATEBASEPATH to $HOME/.arcan/resources/savestates/ - possibly
+# via a suitable script

pkgs/development/libraries/gensio/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "gensio";
-  version = "2.2.7";
+  version = "2.2.8";
 
   src = fetchFromGitHub {
     owner = "cminyard";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2wxsPHrQ9GgyUE4p6zYuR1mPU2OyjtgiPnMApEscR2g=";
+    sha256 = "sha256-6+hYytLMg5E1KTBPWSteVu2VjF0APkcoOiigqzrBI+U=";
   };
 
   passthru = {

pkgs/development/libraries/libcanberra/default.nix

···
 { stdenv, lib, fetchurl, fetchpatch, pkg-config, libtool
-, gtk ? null
+, gtk2-x11, gtk3-x11 , gtkSupport ? null
 , libpulseaudio, gst_all_1, libvorbis, libcap
-, CoreServices
+, Carbon, CoreServices
 , withAlsa ? stdenv.isLinux, alsa-lib }:
 
 stdenv.mkDerivation rec {
-  name = "libcanberra-0.30";
+  pname = "libcanberra";
+  version = "0.30";
 
   src = fetchurl {
-    url = "http://0pointer.de/lennart/projects/libcanberra/${name}.tar.xz";
+    url = "http://0pointer.de/lennart/projects/libcanberra/${pname}-${version}.tar.xz";
     sha256 = "0wps39h8rx2b00vyvkia5j40fkak3dpipp1kzilqla0cgvk73dn2";
   };
 
   nativeBuildInputs = [ pkg-config libtool ];
   buildInputs = [
-    libpulseaudio libvorbis gtk
+    libpulseaudio libvorbis
   ] ++ (with gst_all_1; [ gstreamer gst-plugins-base ])
-    ++ lib.optional stdenv.isDarwin CoreServices
+    ++ lib.optional (gtkSupport == "gtk2") gtk2-x11
+    ++ lib.optional (gtkSupport == "gtk3") gtk3-x11
+    ++ lib.optionals stdenv.isDarwin [Carbon CoreServices]
     ++ lib.optional stdenv.isLinux libcap
     ++ lib.optional withAlsa alsa-lib;
 
···
     })
   ];
 
-  postPatch = (lib.optional stdenv.isDarwin) ''
+  postPatch = lib.optionalString stdenv.isDarwin ''
     patch -p0 < ${fetchpatch {
       url = "https://raw.githubusercontent.com/macports/macports-ports/master/audio/libcanberra/files/patch-configure.diff";
       sha256 = "1f7h7ifpqvbfhqygn1b7klvwi80zmpv3538vbmq7ql7bkf1q8h31";
···
     done
   '';
 
-  passthru = {
-    gtkModule = "/lib/gtk-2.0/";
+  passthru = lib.optionalAttrs (gtkSupport != null) {
+    gtkModule = if gtkSupport == "gtk2" then "/lib/gtk-2.0" else "/lib/gtk-3.0/";
   };
 
   meta = with lib; {
···
     platforms = platforms.unix;
     # canberra-gtk-module.c:28:10: fatal error: 'gdk/gdkx.h' file not found
     # #include <gdk/gdkx.h>
-    broken = stdenv.isDarwin;
+    broken = stdenv.isDarwin && (gtkSupport == "gtk3");
   };
 }

pkgs/development/libraries/zchunk/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "zchunk";
-  version = "1.1.11";
-
-  outputs = [ "out" "lib" "dev" ];
+  version = "1.1.16";
 
   src = fetchFromGitHub {
     owner = "zchunk";
     repo = pname;
     rev = version;
-    hash = "sha256-r+qWJOUnTyPJjM9eW44Q2DMKxx4HloyfNrQ6xWDO9vQ=";
+    hash = "sha256-+8FkivLTZXdu0+1wu+7T98y6rQzIHbG9l15Abrbln1o=";
   };
 
   nativeBuildInputs = [
···
     curl
     zstd
   ] ++ lib.optional stdenv.isDarwin argp-standalone;
+
+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
 
   meta = with lib; {
     homepage = "https://github.com/zchunk/zchunk";

pkgs/development/ocaml-modules/opam-repository/download-tool.patch

···
 index c2954c1d..528fc621 100644
 --- a/src/repository/opamRepositoryConfig.ml
 +++ b/src/repository/opamRepositoryConfig.ml
-@@ -27,23 +27,7 @@ type 'a options_fun =
+@@ -27,31 +27,7 @@ type 'a options_fun =
    'a
  
  let default = {
 -  download_tool = lazy (
+-    let os = OpamStd.Sys.os () in
 -    try
+-      let curl = "curl", `Curl in
 -      let tools =
--        if OpamStd.Sys.(os () = Darwin)
--        then ["wget", `Default; "curl", `Curl]
--        else ["curl", `Curl; "wget", `Default]
+-        match os with
+-        | Darwin  -> ["wget", `Default; curl]
+-        | FreeBSD -> ["fetch", `Default ; curl]
+-        | OpenBSD -> ["ftp", `Default; curl]
+-        | _ -> [curl; "wget", `Default]
 -      in
 -      let cmd, kind =
 -        List.find (fun (c,_) -> OpamSystem.resolve_command c <> None) tools
···
 -    with Not_found ->
 -      OpamConsole.error_and_exit `Configuration_error
 -        "Could not find a suitable download command. Please make sure you \
--         have either \"curl\" or \"wget\" installed, or specify a custom \
--         command through variable OPAMFETCH."
+-         have %s installed, or specify a custom command through variable \
+-         OPAMFETCH."
+-        (match os with
+-         | FreeBSD -> "fetch"
+-         | OpenBSD -> "ftp"
+-         | _ -> "either \"curl\" or \"wget\"")
 -  );
 +  download_tool = lazy ([ CIdent SUBSTITUTE_NIXOS_CURL_PATH, None ], `Curl);
    validation_hook = None;

pkgs/development/python-modules/aioambient/default.nix

···
 
 buildPythonPackage rec {
   pname = "aioambient";
-  version = "1.2.4";
+  version = "1.2.5";
   format = "pyproject";
   disabled = pythonOlder "3.6";
 
···
     owner = "bachya";
     repo = pname;
     rev = version;
-    sha256 = "sha256-uqvM5F0rpw+xeCXYl4lGMt3r0ugPsUmSvujmTJ9HABk=";
+    sha256 = "1v8xr69y9cajyrdfz8wdksz1hclh5cvgxppf9lpygwfj4q70wh88";
   };
 
   nativeBuildInputs = [
···
     pytest-asyncio
     pytestCheckHook
   ];
-
-  postPatch = ''
-    # https://github.com/bachya/aioambient/pull/84
-    substituteInPlace pyproject.toml \
-      --replace 'websockets = "^8.1"' 'websockets = ">=8.1,<10.0"'
-  '';
 
   # Ignore the examples directory as the files are prefixed with test_
   disabledTestPaths = [ "examples/" ];

pkgs/development/python-modules/bitstring/default.nix

···
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, python
+}:
 
 buildPythonPackage rec {
   pname = "bitstring";
-  version = "3.1.7";
+  version = "3.1.9";
 
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0jl6192dwrlm5ybkbh7ywmyaymrc3cmz9y07nm7qdli9n9rfpwzx";
+  src = fetchFromGitHub {
+    owner = "scott-griffiths";
+    repo = pname;
+    rev = "bitstring-${version}";
+    sha256 = "0y2kcq58psvl038r6dhahhlhp1wjgr5zsms45wyz1naq6ri8x9qa";
   };
+
+  checkPhase = ''
+    cd test
+    ${python.interpreter} -m unittest discover
+  '';
+
+  pythonImportsCheck = [ "bitstring" ];
 
   meta = with lib; {
     description = "Module for binary data manipulation";

pkgs/development/python-modules/emoji/default.nix

···
 
 buildPythonPackage rec {
   pname = "emoji";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "carpedm20";
     repo = pname;
     rev = "v.${version}";
-    sha256 = "0xksxdld20sh3c2s6pry1fm2br9xq8ypdq5pf971fpg5pk2f4iy9";
+    sha256 = "0gakvh8hfmfdjyp46bl18b2zm3grm3k5shiqrpzqlipbaxb7ifrk";
   };
 
   checkInputs = [

pkgs/development/python-modules/motioneye-client/default.nix

···
 
 buildPythonPackage rec {
   pname = "motioneye-client";
-  version = "0.3.10";
+  version = "0.3.11";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
···
     owner = "dermotduffy";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ilh9wfzggnbfz068vkz66g64ar6isl3m2vcp7jf2zbaj0bqsjax";
+    sha256 = "0f34ig8njyn7dzy8272m0b1nlnnhir58ar3vx4zps10i0dc32hb2";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/nbxmpp/default.nix

···
-{ lib, buildPythonPackage, pythonOlder, fetchFromGitLab
-, gobject-introspection, idna, libsoup, precis-i18n, pygobject3, pyopenssl
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitLab
+, gobject-introspection
+, idna
+, libsoup
+, precis-i18n
+, pygobject3
+, pyopenssl
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "nbxmpp";
-  version = "2.0.2";
+  version = "2.0.3";
 
   disabled = pythonOlder "3.7";
 
-  # Tests aren't included in PyPI tarball.
   src = fetchFromGitLab {
     domain = "dev.gajim.org";
     owner = "gajim";
     repo = "python-nbxmpp";
     rev = "nbxmpp-${version}";
-    sha256 = "0z27mxgfk7hvpx0xdrd8g9441rywv74yk7s83zjnc2mc7xvpwhf4";
+    sha256 = "0gzyd25sja7n49f1ihyg6gch1b0r409r0p3qpwn8w8xy7jgn6ysc";
   };
 
-  buildInputs = [ precis-i18n ];
-  propagatedBuildInputs = [ gobject-introspection idna libsoup pygobject3 pyopenssl ];
+  buildInputs = [
+    precis-i18n
+  ];
+
+  propagatedBuildInputs = [
+    gobject-introspection
+    idna
+    libsoup
+    pygobject3
+    pyopenssl
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
 
   pythonImportsCheck = [ "nbxmpp" ];
 

pkgs/development/python-modules/neo/default.nix

···
 , nose
 , numpy
 , quantities
+, pythonOlder
 }:
 
 buildPythonPackage rec {
   pname = "neo";
-  version = "0.9.0";
+  version = "0.10.0";
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6e31c88d7c52174fa2512df589b2b5003e9471fde27fca9f315f4770ba3bd3cb";
+    sha256 = "0lw3r9p1ky1cswhrs9radc0vq1qfzbrk7qd00f34g96g30zab4g5";
   };
 
   propagatedBuildInputs = [ numpy quantities ];

pkgs/development/python-modules/pg8000/default.nix

···
 
 buildPythonPackage rec {
   pname = "pg8000";
-  version = "1.20.0";
+  version = "1.21.0";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-SQ7CKpJgHwRUs+1MjU7N3DD2bA4/eD8OzFgQN3SajFU=";
+    sha256 = "1msj0vk14fbsis8yfk0my1ygpcli9jz3ivwdi9k6ii5i6330i4f9";
   };
 
   propagatedBuildInputs = [
     passlib
     scramp
   ];
-
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "scramp==1.4.0" "scramp>=1.4.0"
-  '';
 
   # Tests require a running PostgreSQL instance
   doCheck = false;

pkgs/development/python-modules/phonenumbers/default.nix

···
 
 buildPythonPackage rec {
   pname = "phonenumbers";
-  version = "8.12.26";
+  version = "8.12.28";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-Zbq269vg7FGWx0YmlJdI21M30jiVqrwe+PXXKEeHmYo=";
+    sha256 = "1g86bf791lr9ggrfgllah9liwa3bx917h9ffrdb01kjwdna4zsj2";
   };
 
   checkInputs = [

pkgs/development/python-modules/pipdate/default.nix

···
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, isPy27
 , appdirs
 , importlib-metadata
 , requests
-, pytest
+, rich
+, setuptools
 , wheel
 }:
 
 buildPythonPackage rec {
   pname = "pipdate";
-  version = "0.5.2";
+  version = "0.5.5";
   format = "pyproject";
-  disabled = isPy27; # abandoned
+  disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "507065231f2d50b6319d483432cba82aadad78be21b7a2969b5881ed8dee9ab4";
+    sha256 = "03hr9i691cpg9q2xc1xr4lpd90xs8rba0xjh6qmc1vg7lgcdgbaa";
   };
 
   nativeBuildInputs = [ wheel ];
···
   propagatedBuildInputs = [
     appdirs
     requests
+    rich
+    setuptools
   ] ++ lib.optionals (pythonOlder "3.8") [
     importlib-metadata
   ];
 
-  checkInputs = [
-    pytest
-  ];
-
-  checkPhase = ''
-    HOME=$(mktemp -d) pytest test/test_pipdate.py
-  '';
-
-  # tests require network access
+  # Tests require network access and pythonImportsCheck requires configuration file
   doCheck = false;
 
   meta = with lib; {
     description = "pip update helpers";
     homepage = "https://github.com/nschloe/pipdate";
-    license = licenses.mit;
-    maintainers = [ maintainers.costrouc ];
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ costrouc ];
   };
 }

pkgs/development/python-modules/plexapi/default.nix

···
 , requests
 , tqdm
 , websocket-client
-, isPy27
+, pythonOlder
 }:
 
 buildPythonPackage rec {
-  pname = "PlexAPI";
-  version = "4.6.1";
-  disabled = isPy27;
+  pname = "plexapi";
+  version = "4.7.0";
+  disabled = pythonOlder "3.5";
 
   src = fetchFromGitHub {
     owner = "pkkid";
     repo = "python-plexapi";
     rev = version;
-    sha256 = "sha256-WL5UBsvAdtfOCkVX9NI0Z2fJ2CAO+NwD8wvkvkJ2uww=";
+    sha256 = "1gh36ln9ki69rs7ml9syqq956i996rdi145qffjwb3736zylrzkp";
   };
 
   propagatedBuildInputs = [
···
 
   # Tests require a running Plex instance
   doCheck = false;
+
   pythonImportsCheck = [ "plexapi" ];
 
   meta = with lib; {

pkgs/development/python-modules/pypck/default.nix

···
 , buildPythonPackage
 , fetchFromGitHub
 , pytest-asyncio
-, pytest-cov
 , pytest-timeout
 , pytestCheckHook
 , pythonOlder
···
 
 buildPythonPackage rec {
   pname = "pypck";
-  version = "0.7.10";
+  version = "0.7.11";
   disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "alengwenus";
     repo = pname;
     rev = version;
-    sha256 = "sha256-B2imewEONewj1Y+Q316reIBZB/b9WQAu67x9cLMkRTU=";
+    sha256 = "1jj0y487qcxrprx4x2rs6r7rqsf5m9khk0xhigbvnbyvh8rsd2jr";
   };
 
   checkInputs = [
     pytest-asyncio
-    pytest-cov
     pytest-timeout
     pytestCheckHook
   ];

pkgs/development/python-modules/pysma/default.nix

···
 
 buildPythonPackage rec {
   pname = "pysma";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-hnvbQOilsoHn1qc/pKJ2Eq1VwJi+HbGlAAJwiME1Pgc=";
+    sha256 = "0kabwx8mi2kkbxxg7abnxwggxvidjrzgp5yidiyll5iba0ghhgnw";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/sentry-sdk/default.nix

···
 
 buildPythonPackage rec {
   pname = "sentry-sdk";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-UhCnEt1X2I0iXB/D/jo2Jv7kk2N7zVTiBIJs8EuNdpw=";
+    sha256 = "0v72zzghlk6kvjg7fg4c4mfr1kasnwlpjzk1wyqd864nz9293sgb";
   };
 
   checkInputs = [ blinker botocore chalice django flask tornado bottle rq falcon sqlalchemy werkzeug trytond

pkgs/development/python-modules/tensorflow/default.nix

···
 { stdenv, bazel_3, buildBazelPackage, isPy3k, lib, fetchFromGitHub, symlinkJoin
-, addOpenGLRunpath
+, addOpenGLRunpath, fetchpatch
 # Python deps
 , buildPythonPackage, pythonOlder, pythonAtLeast, python
 # Python libraries
···
     };
 
     patches = [
+      # included from 2.6.0 onwards
+      (fetchpatch {
+        name = "fix-numpy-1.20-notimplementederror.patch";
+        url = "https://github.com/tensorflow/tensorflow/commit/b258941525f496763d4277045b6513c815720e3a.patch";
+        sha256 = "19f9bzrcfsynk11s2hqvscin5c65zf7r6g3nb10jnimw79vafiry";
+      })
       # Relax too strict Python packages versions dependencies.
       ./relax-dependencies.patch
       # Add missing `io_bazel_rules_docker` dependency.

pkgs/development/tools/database/liquibase/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "liquibase";
-  version = "4.4.1";
+  version = "4.4.2";
 
   src = fetchurl {
     url = "https://github.com/liquibase/liquibase/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-2Y/eRIkskuk+7GC/br178XzWTnP4iXSFfa5ybLjvqDA=";
+    sha256 = "sha256-qOKMyqf3KX7pWjslVgcPiGlTiwvMZLvm7DiatmSLd1U=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/development/tools/ocaml/dune-release/default.nix

···
 { lib, buildDunePackage, fetchurl, makeWrapper
 , curly, fmt, bos, cmdliner, re, rresult, logs
-, odoc, opam-format, opam-core, opam-state, yojson
+, odoc, opam-format, opam-core, opam-state, yojson, astring
 , opam, git, findlib, mercurial, bzip2, gnutar, coreutils
 , alcotest, mdx
 }:
···
 let runtimeInputs = [ opam findlib git mercurial bzip2 gnutar coreutils ];
 in buildDunePackage rec {
   pname = "dune-release";
-  version = "1.4.0";
+  version = "1.5.0";
 
   minimumOCamlVersion = "4.06";
 
   src = fetchurl {
     url = "https://github.com/ocamllabs/${pname}/releases/download/${version}/${pname}-${version}.tbz";
-    sha256 = "1frinv1rsrm30q6jclicsswpshkdwwdgxx7sp6q9w4c2p211n1ln";
+    sha256 = "1lyfaczskdbqnhmpiy6wga9437frds3m8prfk2rhwyb96h69y3pv";
   };
 
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ curly fmt cmdliner re opam-format opam-state opam-core
-                  rresult logs odoc bos yojson ];
+                  rresult logs odoc bos yojson astring ];
   checkInputs = [ alcotest mdx ] ++ runtimeInputs;
   doCheck = true;
 
···
     # to have a fixed path to the binary in nix store
     sed -i '/must_exist (Cmd\.v "curl"/d' lib/github.ml
 
-    # fix problems with git invocations in tests
-    for f in tests/bin/{delegate_info,errors,tag,no_doc,x-commit-hash}/run.t; do
-      # set bogus user info in git so git commit doesn't fail
-      sed -i '/git init/ a \    $ git config user.name test; git config user.email "[e-mail]"' "$f"
-      # surpress hint to set default branch name
-      substituteInPlace "$f" --replace "git init" "git init -b main"
-    done
+    # ignore weird yes error message
+    sed -i 's/yes |/yes 2>\/dev\/null |/' \
+      tests/bin/no_doc/run.t \
+      tests/bin/draft/run.t \
+      tests/bin/url-file/run.t
+  '';
 
-    # ignore weird yes error message
-    sed -i 's/yes |/yes 2>\/dev\/null |/' tests/bin/no_doc/run.t
+  preCheck = ''
+    # it fails when it tries to reference "./make_check_deterministic.exe"
+    rm -fr tests/bin/check
   '';
 
   # tool specific env vars have been deprecated, use PATH

pkgs/development/tools/ocaml/opam/default.nix

···
 
 let
   srcs = {
-    cmdliner = fetchurl {
-      url = "http://erratique.ch/software/cmdliner/releases/cmdliner-1.0.2.tbz";
-      sha256 = "18jqphjiifljlh9jg8zpl6310p3iwyaqphdkmf89acyaix0s4kj1";
+    "0install-solver" = fetchurl {
+      url = "https://github.com/0install/0install/releases/download/v2.17/0install-v2.17.tbz";
+      sha256 = "08q95mzmf9pyyqs68ff52422f834hi313cxmypwrxmxsabcfa10p";
     };
-    cppo = fetchurl {
-      url = "https://github.com/ocaml-community/cppo/releases/download/v1.6.6/cppo-v1.6.6.tbz";
-      sha256 = "185q0x54id7pfc6rkbjscav8sjkrg78fz65rgfw7b4bqlyb2j9z7";
+    "cmdliner" = fetchurl {
+      url = "http://erratique.ch/software/cmdliner/releases/cmdliner-1.0.4.tbz";
+      sha256 = "1h04q0zkasd0mw64ggh4y58lgzkhg6yhzy60lab8k8zq9ba96ajw";
     };
-    cudf = fetchurl {
+    "cppo" = fetchurl {
+      url = "https://github.com/ocaml-community/cppo/releases/download/v1.6.7/cppo-v1.6.7.tbz";
+      sha256 = "17ajdzrnmnyfig3s6hinb56mcmhywbssxhsq32dz0v90dhz3wmfv";
+    };
+    "cudf" = fetchurl {
       url = "https://gforge.inria.fr/frs/download.php/36602/cudf-0.9.tar.gz";
       sha256 = "0771lwljqwwn3cryl0plny5a5dyyrj4z6bw66ha5n8yfbpcy8clr";
     };
-    dose3 = fetchurl {
+    "dose3" = fetchurl {
       url = "https://gforge.inria.fr/frs/download.php/file/36063/dose3-5.0.1.tar.gz";
       sha256 = "00yvyfm4j423zqndvgc1ycnmiffaa2l9ab40cyg23pf51qmzk2jm";
     };
-    dune-local = fetchurl {
-      url = "https://github.com/ocaml/dune/releases/download/1.6.3/dune-1.6.3.tbz";
-      sha256 = "0dmf0wbfmgdy5plz1bjiisc2hjgblvxsnrqjmw2c8y45v1h23mdz";
+    "dune-local" = fetchurl {
+      url = "https://github.com/ocaml/dune/releases/download/2.9.0/dune-2.9.0.tbz";
+      sha256 = "07m476kgagpd6kzm3jq30yfxqspr2hychah0xfqs14z82zxpq8dv";
     };
-    extlib = fetchurl {
+    "extlib" = fetchurl {
       url = "https://ygrek.org/p/release/ocaml-extlib/extlib-1.7.7.tar.gz";
       sha256 = "1sxmzc1mx3kg62j8kbk0dxkx8mkf1rn70h542cjzrziflznap0s1";
     };
-    mccs = fetchurl {
-      url = "https://github.com/AltGr/ocaml-mccs/archive/1.1+11.tar.gz";
-      sha256 = "0mswapf37rav8nvvbjc4c7c7wnl6qwgd3c5v0nfifmr910qygz72";
+    "mccs" = fetchurl {
+      url = "https://github.com/AltGr/ocaml-mccs/archive/1.1+13.tar.gz";
+      sha256 = "05nnji9h8mss3hzjr5faid2v3xfr7rcv2ywmpcxxp28y6h2kv9gv";
     };
-    ocamlgraph = fetchurl {
-      url = "http://ocamlgraph.lri.fr/download/ocamlgraph-1.8.8.tar.gz";
-      sha256 = "0m9g16wrrr86gw4fz2fazrh8nkqms0n863w7ndcvrmyafgxvxsnr";
+    "ocamlgraph" = fetchurl {
+      url = "https://github.com/backtracking/ocamlgraph/releases/download/2.0.0/ocamlgraph-2.0.0.tbz";
+      sha256 = "029692bvdz3hxpva9a2jg5w5381fkcw55ysdi8424lyyjxvjdzi0";
     };
-    opam-file-format = fetchurl {
-      url = "https://github.com/ocaml/opam-file-format/archive/2.0.0.tar.gz";
-      sha256 = "0cjw69r7iilidi7b6arr92kjnjspchvwnmwr1b1gyaxqxpr2s98m";
+    "opam-0install-cudf" = fetchurl {
+      url = "https://github.com/ocaml-opam/opam-0install-solver/releases/download/v0.4.2/opam-0install-cudf-v0.4.2.tbz";
+      sha256 = "10wma4hh9l8hk49rl8nql6ixsvlz3163gcxspay5fwrpbg51fmxr";
+    };
+    "opam-file-format" = fetchurl {
+      url = "https://github.com/ocaml/opam-file-format/archive/2.1.3.tar.gz";
+      sha256 = "1bqyrlsvmjf4gqzmzbiyja9m1ph30ic9i18x23p5ziymyylw2sfg";
     };
-    re = fetchurl {
+    "re" = fetchurl {
       url = "https://github.com/ocaml/ocaml-re/releases/download/1.9.0/re-1.9.0.tbz";
       sha256 = "1gas4ky49zgxph3870nffzkr6y41kkpqp4nj38pz1gh49zcf12aj";
     };
-    result = fetchurl {
-      url = "https://github.com/janestreet/result/archive/1.4.tar.gz";
-      sha256 = "1cjlncnzkwc6zr4v8dgy8nin490blbyxzwwp0qh0cla7s3q2jw0n";
+    "result" = fetchurl {
+      url = "https://github.com/janestreet/result/releases/download/1.5/result-1.5.tbz";
+      sha256 = "0cpfp35fdwnv3p30a06wd0py3805qxmq3jmcynjc3x2qhlimwfkw";
     };
-    seq = fetchurl {
-      url = "https://github.com/c-cube/seq/archive/0.1.tar.gz";
-      sha256 = "02lb2d9i12bxrz2ba5wygk2bycan316skqlyri0597q7j9210g8r";
+    "seq" = fetchurl {
+      url = "https://github.com/c-cube/seq/archive/0.2.2.tar.gz";
+      sha256 = "1ck15v3pg8bacdg6d6iyp2jc3kgrzxk5jsgzx3287x2ycb897j53";
+    };
+    "stdlib-shims" = fetchurl {
+      url = "https://github.com/ocaml/stdlib-shims/releases/download/0.3.0/stdlib-shims-0.3.0.tbz";
+      sha256 = "0jnqsv6pqp5b5g7lcjwgd75zqqvcwcl5a32zi03zg1kvj79p5gxs";
     };
     opam = fetchurl {
-      url = "https://github.com/ocaml/opam/archive/2.0.8.zip";
-      sha256 = "1h55jh4nnx1fcn7v7ss3fgxrn6ixkgnq7pvg5njz8c9xq4njwbc1";
+      url = "https://github.com/ocaml/opam/archive/2.1.0.zip";
+      sha256 = "063df5gsvp4yrbqbnd8k7a1f04cf12prc5wh4f1200acs3jwjxwb";
     };
   };
 in stdenv.mkDerivation {
   pname = "opam";
-  version = "2.0.8";
+  version = "2.1.0";
 
   nativeBuildInputs = [ makeWrapper unzip ];
   buildInputs = [ curl ncurses ocaml getconf ] ++ lib.optional stdenv.isLinux bubblewrap;
···
   src = srcs.opam;
 
   postUnpack = ''
-    ln -sv ${srcs.cmdliner} $sourceRoot/src_ext/cmdliner.tbz
-    ln -sv ${srcs.cppo} $sourceRoot/src_ext/cppo.tbz
-    ln -sv ${srcs.cudf} $sourceRoot/src_ext/cudf.tar.gz
-    ln -sv ${srcs.dose3} $sourceRoot/src_ext/dose3.tar.gz
-    ln -sv ${srcs.dune-local} $sourceRoot/src_ext/dune-local.tbz
-    ln -sv ${srcs.extlib} $sourceRoot/src_ext/extlib.tar.gz
-    ln -sv ${srcs.mccs} $sourceRoot/src_ext/mccs.tar.gz
-    ln -sv ${srcs.ocamlgraph} $sourceRoot/src_ext/ocamlgraph.tar.gz
-    ln -sv ${srcs.opam-file-format} $sourceRoot/src_ext/opam-file-format.tar.gz
-    ln -sv ${srcs.re} $sourceRoot/src_ext/re.tbz
-    ln -sv ${srcs.result} $sourceRoot/src_ext/result.tar.gz
-    ln -sv ${srcs.seq} $sourceRoot/src_ext/seq.tar.gz
+    ln -sv ${srcs."0install-solver"} $sourceRoot/src_ext/0install-solver.tbz
+    ln -sv ${srcs."cmdliner"} $sourceRoot/src_ext/cmdliner.tbz
+    ln -sv ${srcs."cppo"} $sourceRoot/src_ext/cppo.tbz
+    ln -sv ${srcs."cudf"} $sourceRoot/src_ext/cudf.tar.gz
+    ln -sv ${srcs."dose3"} $sourceRoot/src_ext/dose3.tar.gz
+    ln -sv ${srcs."dune-local"} $sourceRoot/src_ext/dune-local.tbz
+    ln -sv ${srcs."extlib"} $sourceRoot/src_ext/extlib.tar.gz
+    ln -sv ${srcs."mccs"} $sourceRoot/src_ext/mccs.tar.gz
+    ln -sv ${srcs."ocamlgraph"} $sourceRoot/src_ext/ocamlgraph.tbz
+    ln -sv ${srcs."opam-0install-cudf"} $sourceRoot/src_ext/opam-0install-cudf.tbz
+    ln -sv ${srcs."opam-file-format"} $sourceRoot/src_ext/opam-file-format.tar.gz
+    ln -sv ${srcs."re"} $sourceRoot/src_ext/re.tbz
+    ln -sv ${srcs."result"} $sourceRoot/src_ext/result.tbz
+    ln -sv ${srcs."seq"} $sourceRoot/src_ext/seq.tar.gz
+    ln -sv ${srcs."stdlib-shims"} $sourceRoot/src_ext/stdlib-shims.tbz
   '';
 
   patches = [ ./opam-shebangs.patch ];
···
     platforms = platforms.all;
   };
 }
-# Generated by: ./opam.nix.pl -v 2.0.8 -p opam-shebangs.patch
+# Generated by: ./opam.nix.pl -v 2.1.0 -p opam-shebangs.patch

pkgs/development/tools/ocaml/opam/opam-shebangs.patch

···
 index eca13a7c..1fd66f43 100644
 --- a/src/client/opamInitDefaults.ml
 +++ b/src/client/opamInitDefaults.ml
-@@ -35,11 +35,15 @@ let eval_variables = [
+@@ -35,14 +35,18 @@ let eval_variables = [
  let os_filter os =
    FOp (FIdent ([], OpamVariable.of_string "os", None), `Eq, FString os)
  
···
  let macos_filter = os_filter "macos"
  let openbsd_filter = os_filter "openbsd"
  let freebsd_filter = os_filter "freebsd"
+ let not_open_free_bsd_filter =
+   FNot (FOr (openbsd_filter,  freebsd_filter))
+ let win32_filter = os_filter "win32"
  let sandbox_filter = FOr (linux_filter, macos_filter)
 +let nixos_filter = os_distribution_filter "nixos"
  

pkgs/development/tools/ocaml/opam/opam.nix.pl

···
   system "echo \Q$md5s{$src}\E' *'\Q$store_path\E | md5sum -c 1>&2";
   die "md5 check failed for $urls{$src}\n" if $?;
   print <<"EOF";
-    $src = fetchurl {
+    "$src" = fetchurl {
       url = "$urls{$src}";
       sha256 = "$sha256";
     };
···
   pname = "opam";
   version = "$OPAM_RELEASE";
 
-  nativeBuildInputs = [ unzip ];
-  buildInputs = [ curl ncurses ocaml makeWrapper getconf ] ++ lib.optional stdenv.isLinux bubblewrap;
+  nativeBuildInputs = [ makeWrapper unzip ];
+  buildInputs = [ curl ncurses ocaml getconf ] ++ lib.optional stdenv.isLinux bubblewrap;
 
   src = srcs.opam;
 
···
   my($ext) = $urls{$src} =~ /(\.(?:t(?:ar\.|)|)(?:gz|bz2?))$/
     or die "could not find extension for $urls{$src}\n";
   print <<"EOF";
-    ln -sv \${srcs.$src} \$sourceRoot/src_ext/$src$ext
+    ln -sv \${srcs."$src"} \$sourceRoot/src_ext/$src$ext
 EOF
 }
 print <<'EOF';

pkgs/games/dwarf-fortress/twbt/default.nix

···
     };
     "0.47.05" = {
       twbtRelease = "6.xx";
-      dfhackRelease = "0.47.05-beta1";
-      sha256 = "sha256-Y6G0qBMHvotp/oyiqANlzXZVklL270dhskd135PnE9Q=";
+      dfhackRelease = "0.47.05-r1";
+      sha256 = "1nqhaf7271bm9rq9dmilhhk9q7v3841d0rv4y3fid40vfi4gpi3p";
       prerelease = true;
     };
   };

pkgs/tools/cd-dvd/unetbootin/default.nix

···
-{ lib, stdenv, fetchFromGitHub, makeWrapper, qt4, util-linux, coreutils, which, qmake4Hook
-, p7zip, mtools, syslinux }:
+{ lib
+, stdenv
+, coreutils
+, fetchFromGitHub
+, libsForQt5
+, mtools
+, p7zip
+, qt5
+, syslinux
+, util-linux
+, which
+}:
 
 stdenv.mkDerivation rec {
   pname = "unetbootin";
-  version = "681";
+  version = "702";
 
   src = fetchFromGitHub {
-    owner  = "unetbootin";
-    repo   = "unetbootin";
-    rev    = version;
-    sha256 = "0ppqb7ywh4cpcjr5nw6f65dx4s8kx09gnhihnby3zjhxdf4l99fm";
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-psX15XicPXAsd36BhuvK0G3GQS8hV/hazzO0HByCqV4=";
   };
 
   setSourceRoot = ''
     sourceRoot=$(echo */src/unetbootin)
   '';
 
-  buildInputs = [ qt4 ];
-  nativeBuildInputs = [ makeWrapper qmake4Hook ];
+  buildInputs = [
+    qt5.qtbase
+    qt5.qttools
+    libsForQt5.qmake
+  ];
+
+  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+
   enableParallelBuilding = true;
 
   # Lots of nice hard-coded paths...
···
     install -Dm644 -t $out/share/unetbootin   unetbootin_*.qm
     install -Dm644 -t $out/share/applications unetbootin.desktop
 
-    wrapProgram $out/bin/unetbootin \
-      --prefix PATH : ${lib.makeBinPath [ mtools p7zip which ]} \
-      --set QT_X11_NO_MITSHM 1
-
     runHook postInstall
   '';
 
+  qtWrapperArgs = [
+    "--prefix PATH : ${lib.makeBinPath [ mtools p7zip which ]}"
+    "--set QT_X11_NO_MITSHM 1"
+  ];
+
   meta = with lib; {
-    homepage    = "http://unetbootin.sourceforge.net/";
     description = "A tool to create bootable live USB drives from ISO images";
-    license     = licenses.gpl2Plus;
-    platforms   = platforms.linux;
+    homepage = "http://unetbootin.github.io/";
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ ebzzry ];
+    platforms = platforms.linux;
   };
 }

pkgs/tools/misc/vial/default.nix

···
 { lib, fetchurl, appimageTools }:
 let
   name = "vial-${version}";
-  version = "0.4";
+  version = "0.4.1";
   pname = "Vial";
 
   src = fetchurl {
     url = "https://github.com/vial-kb/vial-gui/releases/download/v${version}/${pname}-v${version}-x86_64.AppImage";
-    sha256 = "sha256-4EDEVSqjQ6Ybqx4BoNwE4pT5yFLYM05FBHc5deQU9f8=";
+    sha256 = "sha256-aN0wvgahWPNSXP/JmV1JWaEnARIOTyRdz1ko6eC7Y5s=";
   };
 
   appimageContents = appimageTools.extractType2 { inherit name src; };
···
   meta = with lib; {
     description = "An Open-source cross-platform (Windows, Linux and Mac) GUI and a QMK fork for configuring your keyboard in real time";
     homepage = "https://get.vial.today";
-    license = licenses.gpl2Only;
+    license = licenses.gpl2Plus;
     maintainers = with maintainers; [ kranzes ];
     platforms = [ "x86_64-linux" ];
   };

pkgs/tools/networking/ghostunnel/default.nix

···
 
 buildGoModule rec {
   pname = "ghostunnel";
-  version = "1.5.3";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "ghostunnel";
     repo = "ghostunnel";
     rev = "v${version}";
-    sha256 = "15rmd89j7sfpznzznss899smizbyshprsrvsdmrbhb617myd9fpy";
+    sha256 = "sha256-EE8gCm/gOp3lmCx1q4PahulipLoBZnEatNAVUXzHIVw=";
   };
 
-  vendorSha256 = "1i95fx4a0fh6id6iy6afbva4pazr7ym6sbwi9r7la6gxzyncd023";
+  vendorSha256 = "sha256-XgmvqB1PCfL2gSDqwqauSixk8vlINHRmX6U0h9EXXdU=";
+
+  deleteVendor = true;
+
+  # The certstore directory isn't recognized as a subpackage, but is when moved
+  # into the vendor directory.
+  postUnpack = ''
+    mkdir -p $sourceRoot/vendor/ghostunnel
+    mv $sourceRoot/certstore $sourceRoot/vendor/ghostunnel/
+  '';
 
   meta = with lib; {
     description = "A simple TLS proxy with mutual authentication support for securing non-TLS backend applications";
···
   };
 
   passthru.tests.nixos = nixosTests.ghostunnel;
+  passthru.tests.podman = nixosTests.podman-tls-ghostunnel;
 }

pkgs/tools/text/rst2html5/default.nix

···
 { lib, python3Packages }:
 
-let
+python3Packages.buildPythonPackage rec {
   pname = "rst2html5";
-  version = "1.10.6";
-  format = "wheel";
-in python3Packages.buildPythonPackage {
-  inherit pname version format;
+  version = "2.0";
 
   src = python3Packages.fetchPypi {
-    inherit pname version format;
-    sha256 = "sha256-jmToDFLQODqgTycBp2J8LyoJ1Zxho9w1VdhFMzvDFkg=";
+    inherit pname version;
+    hash = "sha256-Ejjja/fm6wXTf9YtjCYZsNDB8X5oAtyPoUIsYFDuZfc=";
   };
 
-  propagatedBuildInputs = with python3Packages;
-  [ docutils genshi pygments beautifulsoup4 ];
+  buildInputs = with python3Packages; [
+    beautifulsoup4
+    docutils
+    genshi
+    pygments
+  ];
 
   meta = with lib;{
-    homepage = "https://pypi.org/project/rst2html5/";
+    homepage = "https://rst2html5.readthedocs.io/en/latest/";
     description = "Converts ReSTructuredText to (X)HTML5";
     license = licenses.mit;
     maintainers = with maintainers; [ AndersonTorres ];

pkgs/top-level/all-packages.nix

···
   libcacard = callPackage ../development/libraries/libcacard { };
 
   libcanberra = callPackage ../development/libraries/libcanberra {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
+    inherit (darwin.apple_sdk.frameworks) Carbon CoreServices;
   };
   libcanberra-gtk2 = pkgs.libcanberra.override {
-    gtk = gtk2-x11;
+    gtkSupport = "gtk2";
   };
   libcanberra-gtk3 = pkgs.libcanberra.override {
-    gtk = gtk3-x11;
+    gtkSupport = "gtk3";
   };
 
   libcanberra_kde = if (config.kde_runtime.libcanberraWithoutGTK or true)