Merge master into staging-next

maintainers/maintainer-list.nix

···
     keys = [{
       longkeyid = "rsa4096/0xAAA50652F0479205";
       fingerprint = "BF8B F725 DA30 E53E 7F11  4ED8 AAA5 0652 F047 9205";
-   }];
+    }];
   };
   ar1a = {
     email = "[e-mail]";
···
     github = "kho-dialga";
     githubId = 55767703;
     name = "Iván Brito";
-    };
+  };
   khumba = {
     email = "[e-mail]";
     github = "khumba";
···
     githubId = 7243783;
     name = "Bernardo Meurer";
     keys = [{
-        longkeyid = "rsa4096/0xF4C0D53B8D14C246";
-        fingerprint = "F193 7596 57D5 6DA4 CCD4  786B F4C0 D53B 8D14 C246";
+      longkeyid = "rsa4096/0xF4C0D53B8D14C246";
+      fingerprint = "F193 7596 57D5 6DA4 CCD4  786B F4C0 D53B 8D14 C246";
     }];
   };
   lowfatcomputing = {
···
     github = "poscat0x04";
     githubId = 53291983;
     name = "Poscat Tarski";
-    keys = [
-      {
-        longkeyid = "rsa4096/2D2595A00D08ACE0";
-        fingerprint = "48AD DE10 F27B AFB4 7BB0  CCAF 2D25 95A0 0D08 ACE0";
-      }
-    ];
+    keys = [{
+      longkeyid = "rsa4096/2D2595A00D08ACE0";
+      fingerprint = "48AD DE10 F27B AFB4 7BB0  CCAF 2D25 95A0 0D08 ACE0";
+    }];
   };
   pradeepchhetri = {
     email = "[e-mail]";
···
       fingerprint = "A317 37B3 693C 921B 480C  C629 4A2A AAA3 82F8 294C";
     }];
   };
+  seylerius = {
+    name = "Sable Seyler";
+    email = "[e-mail]";
+    github = "seylerius";
+    githubId = 1145981;
+    keys = [{
+      longkeyid = "rsa4096/0xDC26B921A9E9DBDE";
+      fingerprint = "7246 B6E1 ABB9 9A48 4395  FD11 DC26 B921 A9E9 DBDE";
+    }];
+  };
   sfrijters = {
     email = "[e-mail]";
     github = "sfrijters";
···
     name = "Felix Bühler";
   };
   stupremee = {
-      email = "[e-mail]";
-      github = "Stupremee";
-      githubId = 39732259;
-      name = "Justus K";
+    email = "[e-mail]";
+    github = "Stupremee";
+    githubId = 39732259;
+    name = "Justus K";
   };
   SubhrajyotiSen = {
       email = "[e-mail]";

nixos/modules/services/misc/home-assistant.nix

···
           "CAP_NET_BIND_SERVICE"
           "CAP_NET_RAW"
         ]));
+        componentsUsingBluetooth = [
+          # Components that require the AF_BLUETOOTH address family
+          "bluetooth_tracker"
+          "bluetooth_le_tracker"
+        ];
+        componentsUsingSerialDevices = [
+          # Components that require access to serial devices (/dev/tty*)
+          # List generated from home-assistant documentation:
+          #   git clone https://github.com/home-assistant/home-assistant.io/
+          #   cd source/_integrations
+          #   rg "/dev/tty" -l | cut -d'/' -f3 | cut -d'.' -f1 | sort
+          # And then extended by references found in the source code, these
+          # mostly the ones using config flows already.
+          "acer_projector"
+          "alarmdecoder"
+          "arduino"
+          "blackbird"
+          "dsmr"
+          "edl21"
+          "elkm1"
+          "elv"
+          "enocean"
+          "firmata"
+          "flexit"
+          "gpsd"
+          "insteon"
+          "kwb"
+          "lacrosse"
+          "mhz19"
+          "modbus"
+          "modem_callerid"
+          "mysensors"
+          "nad"
+          "numato"
+          "rflink"
+          "rfxtrx"
+          "scsgate"
+          "serial"
+          "serial_pm"
+          "sms"
+          "upb"
+          "velbus"
+          "w800rf32"
+          "xbee"
+          "zha"
+        ];
       in {
         ExecStart = "${package}/bin/hass --runner --config '${cfg.configDir}'";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
···
         # Hardening
         AmbientCapabilities = capabilities;
         CapabilityBoundingSet = capabilities;
-        DeviceAllow = [
+        DeviceAllow = (optionals (any useComponent componentsUsingSerialDevices) [
           "char-ttyACM rw"
           "char-ttyAMA rw"
           "char-ttyUSB rw"
-        ];
+        ]);
         DevicePolicy = "closed";
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
···
           "AF_INET6"
           "AF_NETLINK"
           "AF_UNIX"
-        ] ++ optionals (useComponent "bluetooth_tracker" || useComponent "bluetooth_le_tracker") [
+        ] ++ optionals (any useComponent componentsUsingBluetooth) [
           "AF_BLUETOOTH"
         ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
-        SupplementaryGroups = [ "dialout" ];
+        SupplementaryGroups = optionals (any useComponent componentsUsingSerialDevices) [
+          "dialout"
+        ];
         SystemCallArchitectures = "native";
         SystemCallFilter = [
           "@system-service"

nixos/tests/home-assistant.nix

···
           payload_on = "let_there_be_light";
           payload_off = "off";
         }];
+        # tests component-based capability assignment (CAP_NET_BIND_SERVICE)
         emulated_hue = {
           host_ip = "127.0.0.1";
           listen_port = 80;
···
         assert "let_there_be_light" in output_log
 
     with subtest("Check systemd unit hardening"):
+        hass.log(hass.succeed("systemctl show home-assistant.service"))
         hass.log(hass.succeed("systemd-analyze security home-assistant.service"))
   '';
 })

pkgs/applications/networking/cluster/bosh-cli/default.nix

···
 buildGoModule rec {
   pname = "bosh-cli";
 
-  version = "6.4.3";
+  version = "6.4.4";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1glxwk0fv52rjim7ihcxkjx19fsn9k7gzg9zmwxgx8wpsjrdcq3f";
+    sha256 = "sha256-N7GrxePNewxhHnkQP/XBdUIEL5FsFD4avouZaIO+BKc=";
   };
   vendorSha256 = null;
 

pkgs/applications/version-management/gitea/default.nix

···
 
 buildGoPackage rec {
   pname = "gitea";
-  version = "1.14.2";
+  version = "1.14.3";
 
   # not fetching directly from the git repo, because that lacks several vendor files for the web UI
   src = fetchurl {
     url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "sha256-0EvKk0/ro1YAqvc5yCt8vn2LkRoIbXrFTwcQtomoWsM=";
+    sha256 = "sha256-ieQxqZO84sYBcCzWYn40tRGLgSs2PpLlcNkI4vFq+wE=";
   };
 
   unpackPhase = ''

pkgs/development/compilers/terra/default.nix

···
-{ lib, stdenv, fetchurl, fetchFromGitHub
-, llvmPackages, ncurses, lua
-}:
+{ lib, stdenv, fetchFromGitHub, llvmPackages, ncurses, cmake, libxml2
+, symlinkJoin, breakpointHook, cudaPackages, enableCUDA ? false }:
 
 let
-  luajitArchive = "LuaJIT-2.0.5.tar.gz";
-  luajitSrc = fetchurl {
-    url    = "http://luajit.org/download/${luajitArchive}";
-    sha256 = "0yg9q4q6v028bgh85317ykc9whgxgysp76qzaqgq55y6jy11yjw7";
+  luajitRev = "9143e86498436892cb4316550be4d45b68a61224";
+  luajitBase = "LuaJIT-${luajitRev}";
+  luajitArchive = "${luajitBase}.tar.gz";
+  luajitSrc = fetchFromGitHub {
+    owner = "LuaJIT";
+    repo = "LuaJIT";
+    rev = luajitRev;
+    sha256 = "1zw1yr0375d6jr5x20zvkvk76hkaqamjynbswpl604w6r6id070b";
   };
-in
-stdenv.mkDerivation rec {
+
+  llvmMerged = symlinkJoin {
+    name = "llvmClangMerged";
+    paths = with llvmPackages; [
+      llvm.out
+      llvm.dev
+      llvm.lib
+      clang-unwrapped.out
+      clang-unwrapped.dev
+      clang-unwrapped.lib
+    ];
+  };
+
+  cuda = cudaPackages.cudatoolkit_11;
+
+  clangVersion = llvmPackages.clang-unwrapped.version;
+
+in stdenv.mkDerivation rec {
   pname = "terra";
-  version = "1.0.0pre1175_${builtins.substring 0 7 src.rev}";
+  version = "1.0.0-beta3_${builtins.substring 0 7 src.rev}";
 
   src = fetchFromGitHub {
-    owner  = "zdevito";
-    repo   = "terra";
-    rev    = "ef6a75ffee15a30f3c74f4e6943851cfbc0fec3d";
-    sha256 = "0aky17vbv3d9zng34hp17p9zb00dbzwhvzsdjzrrqvk9lmyvix0s";
+    owner = "terralang";
+    repo = "terra";
+    rev = "99ff93f8c60c89bbe2dc7c63eab9bfe2f4c4833e";
+    sha256 = "0ww54xjvv6p8jwsh6hml3v527zgnv2gj58gpb818bbg4k1jwa5fl";
   };
 
-  nativeBuildInputs = [ lua ];
-  buildInputs = with llvmPackages; [ llvm clang-unwrapped ncurses ];
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ llvmMerged ncurses libxml2 ] ++ lib.optional enableCUDA cuda;
+
+  cmakeFlags = [
+    "-DHAS_TERRA_VERSION=0"
+    "-DTERRA_VERSION=${version}"
+    "-DTERRA_LUA=luajit"
+    "-DCLANG_RESOURCE_DIR=${llvmMerged}/lib/clang/${clangVersion}"
+  ] ++ lib.optional enableCUDA "-DTERRA_ENABLE_CUDA=ON";
 
   doCheck = true;
   enableParallelBuilding = true;
···
   outputs = [ "bin" "dev" "out" "static" ];
 
   patches = [ ./nix-cflags.patch ];
+
   postPatch = ''
-    substituteInPlace Makefile \
-      --replace '-lcurses' '-lncurses'
+    sed -i '/file(DOWNLOAD "''${LUAJIT_URL}" "''${LUAJIT_TAR}")/d' \
+      cmake/Modules/GetLuaJIT.cmake
 
     substituteInPlace src/terralib.lua \
       --subst-var-by NIX_LIBC_INCLUDE ${lib.getDev stdenv.cc.libc}/include
   '';
 
-  preBuild = ''
-    cat >Makefile.inc<<EOF
-    CLANG = ${lib.getBin llvmPackages.clang-unwrapped}/bin/clang
-    LLVM_CONFIG = ${lib.getBin llvmPackages.llvm}/bin/llvm-config
-    EOF
-
+  preConfigure = ''
     mkdir -p build
-    cp ${luajitSrc} build/${luajitArchive}
+    ln -s ${luajitSrc} build/${luajitBase}
+    tar --mode="a+rwX" -chzf build/${luajitArchive} -C build ${luajitBase}
+    rm build/${luajitBase}
   '';
 
-  checkPhase = "(cd tests && ../terra run)";
-
   installPhase = ''
-    install -Dm755 -t $bin/bin release/bin/terra
-    install -Dm755 -t $out/lib release/lib/terra${stdenv.hostPlatform.extensions.sharedLibrary}
-    install -Dm644 -t $static/lib release/lib/libterra.a
+    install -Dm755 -t $bin/bin bin/terra
+    install -Dm755 -t $out/lib lib/terra${stdenv.hostPlatform.extensions.sharedLibrary}
+    install -Dm644 -t $static/lib lib/libterra_s.a
 
     mkdir -pv $dev/include
-    cp -rv release/include/terra $dev/include
+    cp -rv include/terra $dev/include
   '';
 
   meta = with lib; {
     description = "A low-level counterpart to Lua";
-    homepage    = "http://terralang.org/";
-    platforms   = platforms.x86_64;
-    maintainers = with maintainers; [ jb55 thoughtpolice ];
-    license     = licenses.mit;
+    homepage = "http://terralang.org/";
+    platforms = platforms.x86_64;
+    maintainers = with maintainers; [ jb55 seylerius thoughtpolice ];
+    license = licenses.mit;
   };
 }

pkgs/development/compilers/terra/nix-cflags.patch

···
 diff --git a/src/terralib.lua b/src/terralib.lua
-index 351238d..e638c90 100644
+index 532ed18..2c265dc 100644
 --- a/src/terralib.lua
 +++ b/src/terralib.lua
-@@ -3395,6 +3395,17 @@ function terra.includecstring(code,cargs,target)
+@@ -3426,6 +3426,16 @@ function terra.includecstring(code,cargs,target)
      	args:insert("-internal-isystem")
      	args:insert(path)
      end
-+
 +    -- NOTE(aseipp): include relevant Nix header files
 +    args:insert("-isystem")
 +    args:insert("@NIX_LIBC_INCLUDE@")
···
 +          args:insert(w)
 +        end
 +    end
-     
-     if cargs then
-         args:insertall(cargs)
+     -- Obey the SDKROOT variable on macOS to match Clang behavior.
+     local sdkroot = os.getenv("SDKROOT")
+     if sdkroot then

pkgs/development/guile-modules/guile-json/default.nix

···
+{ lib
+, stdenv
+, fetchurl
+, guile
+, texinfo
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "guile-json";
+  version = "4.4.1";
+
+  src = fetchurl {
+    url = "mirror://savannah/guile-json/${pname}-${version}.tar.gz";
+    sha256 = "sha256-UqZt3pqXQzeHpzEiMvOMKSh1gK/K2KaJ70jMllNxBPc=";
+  };
+
+  postConfigure = ''
+    sed -i '/moddir\s*=/s%=.*%=''${out}/share/guile/site%' Makefile;
+    sed -i '/objdir\s*=/s%=.*%=''${out}/share/guile/ccache%' Makefile;
+    sed -i '/moddir\s*=/s%=.*%=''${out}/share/guile/site/json%' json/Makefile;
+    sed -i '/objdir\s*=/s%=.*%=''${out}/share/guile/ccache/json%' json/Makefile;
+  '';
+
+  nativeBuildInputs = [
+    pkg-config texinfo
+  ];
+  buildInputs = [
+    guile
+  ];
+
+  meta = with lib; {
+    description = "JSON Bindings for GNU Guile";
+    homepage = "https://savannah.nongnu.org/projects/guile-json";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ ethancedwards8 ];
+    platforms = platforms.linux;
+  };
+}

pkgs/development/libraries/libvori/default.nix

···
+{ stdenv, lib, fetchurl, cmake }:
+
+stdenv.mkDerivation rec {
+  pname = "libvori";
+  version = "210412";
+
+  src = fetchurl {
+    url = "https://brehm-research.de/files/${pname}-${version}.tar.gz";
+    sha256 = "1b4hpwibf3k7gl6n984l3wdi0zyl2fmpz84m9g2di4yhm6p8c61k";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "Library for Voronoi intergration of electron densities";
+    homepage = "https://brehm-research.de/libvori.php";
+    license = with licenses; [ lgpl3Only ];
+    platforms = platforms.unix;
+    maintainers = [ maintainers.sheepforce ];
+  };
+}

pkgs/development/python-modules/emulated-roku/default.nix

···
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, aiohttp
+}:
+
+buildPythonPackage rec {
+  pname = "emulated-roku";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "mindigmarton";
+    repo = "emulated_roku";
+    rev = version;
+    sha256 = "02cbg5wrph19p6x44jlw6cn3jli0kwbgfh6klb3c4k5jfrkhgghw";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+  ];
+
+  # no tests implemented
+  doCheck = false;
+
+  pythonImportsCheck = [ "emulated_roku" ];
+
+  meta = with lib; {
+    description = "Library to emulate a roku server to serve as a proxy for remotes such as Harmony";
+    homepage = "https://github.com/mindigmarton/emulated_roku";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}

pkgs/development/python-modules/enocean/default.nix

···
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, beautifulsoup4
+, enum-compat
+, pyserial
+, nose
+}:
+
+buildPythonPackage rec {
+  pname = "enocean";
+  version = "0.60.1";
+
+  src = fetchFromGitHub {
+    owner = "kipe";
+    repo = "enocean";
+    rev = version;
+    sha256 = "0cbcvvy3qaqv8925z608qmkc1l914crzw79krwrz2vpm2fyribab";
+  };
+
+  propagatedBuildInputs = [
+    beautifulsoup4
+    enum-compat
+    pyserial
+  ];
+
+  checkInputs = [
+    nose
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    nosetests
+
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [
+    "enocean.communicators"
+    "enocean.protocol.packet"
+    "enocean.utils"
+  ];
+
+  meta = with lib; {
+    description = "EnOcean serial protocol implementation";
+    homepage = "https://github.com/kipe/enocean";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}

pkgs/development/python-modules/pecan/default.nix

···
 { lib
 , fetchPypi
+, fetchpatch
 , buildPythonPackage
 , isPy27
 # Python deps
···
     sha256 = "4b2acd6802a04b59e306d0a6ccf37701d24376f4dc044bbbafba3afdf9d3389a";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "Support-SQLAlchemy-1.4x.patch";
+      url = "https://github.com/pecan/pecan/commit/a520bd544c0b02a02dbf692b8d6e2f7a503ee6d4.patch";
+      sha256 = "sha256-QCHRjwnpy8ndCvcuyE5Y65BybKYthJXDySUtmpJD8gY=";
+    })
+  ];
+
   propagatedBuildInputs = [
     logutils
     Mako
···
   ];
 
   meta = with lib; {
-    description = "Pecan";
-    homepage = "http://www.pecanpy.org/";
+    description = "WSGI object-dispatching web framework, designed to be lean and fast";
+    homepage = "https://www.pecanpy.org/";
     changelog = "https://pecan.readthedocs.io/en/latest/changes.html";
+    maintainers = with maintainers; [ applePrincess ];
   };
 }

pkgs/development/python-modules/pytest-subprocess/default.nix

···
 
 buildPythonPackage rec {
   pname = "pytest-subprocess";
-  version = "1.1.0";
+  version = "1.1.1";
 
   disabled = pythonOlder "3.6";
 
···
     owner = "aklajnert";
     repo = "pytest-subprocess";
     rev = version;
-    sha256 = "sha256-r6WNDdvZAHMG1kPtLJlCwvhbVG1gC1NEvRfta+Chxnk=";
+    sha256 = "sha256-o8wDZhNHGPV1BQ5Zi2kFNlWq5w0cqebaJUhUUwTK6So=";
   };
 
   buildInputs = [
···
     pytestCheckHook
     docutils
     pygments
-  ];
-
-  disabledTests = [
-    "test_multiple_wait" # https://github.com/aklajnert/pytest-subprocess/issues/36
   ];
 
   meta = with lib; {

pkgs/servers/home-assistant/component-packages.nix

···
     "emonitor" = ps: with ps; [ aioemonitor ];
     "emulated_hue" = ps: with ps; [ aiohttp-cors ];
     "emulated_kasa" = ps: with ps; [ sense-energy ];
-    "emulated_roku" = ps: with ps; [ ]; # missing inputs: emulated_roku
+    "emulated_roku" = ps: with ps; [ emulated-roku ];
     "enigma2" = ps: with ps; [ openwebifpy ];
-    "enocean" = ps: with ps; [ ]; # missing inputs: enocean
+    "enocean" = ps: with ps; [ enocean ];
     "enphase_envoy" = ps: with ps; [ envoy-reader ];
     "entur_public_transport" = ps: with ps; [ ]; # missing inputs: enturclient
     "environment_canada" = ps: with ps; [ ]; # missing inputs: env_canada

pkgs/servers/home-assistant/default.nix

···
     "emonitor"
     "emulated_hue"
     "emulated_kasa"
+    "emulated_roku"
+    "enocean"
     "enphase_envoy"
     "epson"
     "esphome"

pkgs/tools/networking/connman/connman.nix

···
 
 stdenv.mkDerivation rec {
   pname = "connman";
-  version = "1.39";
+  version = "1.40";
   src = fetchurl {
     url = "mirror://kernel/linux/network/connman/${pname}-${version}.tar.xz";
-    sha256 = "sha256-n2KnFpt0kcZwof8uM1sNlmMI+y9i4oXHgRBeuQ8YGvM=";
+    sha256 = "sha256-GleufOI0qjoXRKrDvlwhIdmNzpmUQO+KucxO39XtyxI=";
   };
 
   buildInputs = [
···
     libmnl
     gnutls
     readline
-  ];
+  ] ++ optionals (enableOpenconnect) [ openconnect ];
 
   nativeBuildInputs = [
     pkg-config

pkgs/top-level/all-packages.nix

···
   tbb = callPackage ../development/libraries/tbb { };
 
   terra = callPackage ../development/compilers/terra {
-    llvmPackages = llvmPackages_6;
-    lua = lua5_1;
+    llvmPackages = llvmPackages_10;
   };
 
   teyjus = callPackage ../development/compilers/teyjus (
···
     guile = guile_2_0;
     inherit (gnome2) gnome_vfs libglade libgnome libgnomecanvas libgnomeui;
   };
+
+  guile-json = callPackage ../development/guile-modules/guile-json { };
 
   guile-lib = callPackage ../development/guile-modules/guile-lib { };
 
···
   libvterm-neovim = callPackage ../development/libraries/libvterm-neovim { };
 
   libvorbis = callPackage ../development/libraries/libvorbis { };
+
+  libvori = callPackage ../development/libraries/libvori { };
 
   libwebcam = callPackage ../os-specific/linux/libwebcam { };
 

pkgs/top-level/python-packages.nix

···
 
   emoji = callPackage ../development/python-modules/emoji { };
 
+  emulated-roku = callPackage ../development/python-modules/emulated-roku { };
+
   enaml = callPackage ../development/python-modules/enaml { };
 
   enamlx = callPackage ../development/python-modules/enamlx { };
+
+  enocean = callPackage ../development/python-modules/enocean { };
 
   enrich = callPackage ../development/python-modules/enrich { };