Merge staging-next into staging

nixos/modules/security/pam.nix

···
           (let yubi = config.security.pam.yubico; in optionalString cfg.yubicoAuth ''
             auth ${yubi.control} ${pkgs.yubico-pam}/lib/security/pam_yubico.so mode=${toString yubi.mode} ${optionalString (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}"} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"}
           '') +
+          (let dp9ik = config.security.pam.dp9ik; in optionalString dp9ik.enable ''
+            auth ${dp9ik.control} ${pkgs.pam_dp9ik}/lib/security/pam_p9.so ${dp9ik.authserver}
+          '') +
           optionalString cfg.fprintAuth ''
             auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so
           '' +
···
     };
 
     security.pam.enableOTPW = mkEnableOption (lib.mdDoc "the OTPW (one-time password) PAM module");
+
+    security.pam.dp9ik = {
+      enable = mkEnableOption (
+        lib.mdDoc ''
+          the dp9ik pam module provided by tlsclient.
+
+          If set, users can be authenticated against the 9front
+          authentication server given in {option}`security.pam.dp9ik.authserver`.
+        ''
+      );
+      control = mkOption {
+        default = "sufficient";
+        type = types.str;
+        description = lib.mdDoc ''
+          This option sets the pam "control" used for this module.
+        '';
+      };
+      authserver = mkOption {
+        default = null;
+        type = with types; nullOr string;
+        description = lib.mdDoc ''
+          This controls the hostname for the 9front authentication server
+          that users will be authenticated against.
+        '';
+      };
+    };
 
     security.pam.krb5 = {
       enable = mkOption {

nixos/modules/services/network-filesystems/ceph.nix

···
 with lib;
 
 let
-  cfg  = config.services.ceph;
+  cfg = config.services.ceph;
 
   # function that translates "camelCaseOptions" to "camel case options", credits to tilpner in #nixos@freenode
   expandCamelCase = replaceStrings upperChars (map (s: " ${s}") lowerChars);
   expandCamelCaseAttrs = mapAttrs' (name: value: nameValuePair (expandCamelCase name) value);
 
-  makeServices = (daemonType: daemonIds:
+  makeServices = daemonType: daemonIds:
     mkMerge (map (daemonId:
-      { "ceph-${daemonType}-${daemonId}" = makeService daemonType daemonId cfg.global.clusterName pkgs.ceph; })
-      daemonIds));
+      { "ceph-${daemonType}-${daemonId}" = makeService daemonType daemonId cfg.global.clusterName cfg.${daemonType}.package; })
+      daemonIds);
 
-  makeService = (daemonType: daemonId: clusterName: ceph:
+  makeService = daemonType: daemonId: clusterName: ceph:
     let
       stateDirectory = "ceph/${if daemonType == "rgw" then "radosgw" else daemonType}/${clusterName}-${daemonId}"; in {
     enable = true;
···
     } // optionalAttrs ( daemonType == "mon") {
       RestartSec = "10";
     };
-  });
+  };
 
-  makeTarget = (daemonType:
+  makeTarget = daemonType:
     {
       "ceph-${daemonType}" = {
         description = "Ceph target allowing to start/stop all ceph-${daemonType} services at once";
···
         before = [ "ceph.target" ];
         unitConfig.StopWhenUnneeded = true;
       };
-    }
-  );
+    };
 in
 {
   options.services.ceph = {
···
           to the id part in ceph i.e. [ "name1" ] would result in mgr.name1
         '';
       };
+      package = mkPackageOptionMD pkgs "ceph" { };
       extraConfig = mkOption {
         type = with types; attrsOf str;
         default = {};
···
           to the id part in ceph i.e. [ "name1" ] would result in mon.name1
         '';
       };
+      package = mkPackageOptionMD pkgs "ceph" { };
       extraConfig = mkOption {
         type = with types; attrsOf str;
         default = {};
···
           to the id part in ceph i.e. [ "name1" ] would result in osd.name1
         '';
       };
-
+      package = mkPackageOptionMD pkgs "ceph" { };
       extraConfig = mkOption {
         type = with types; attrsOf str;
         default = {
···
           to the id part in ceph i.e. [ "name1" ] would result in mds.name1
         '';
       };
+      package = mkPackageOptionMD pkgs "ceph" { };
       extraConfig = mkOption {
         type = with types; attrsOf str;
         default = {};
···
 
     rgw = {
       enable = mkEnableOption (lib.mdDoc "Ceph RadosGW daemon");
+      package = mkPackageOptionMD pkgs "ceph" { };
       daemons = mkOption {
         type = with types; listOf str;
         default = [];
···
       { assertion = cfg.global.fsid != "";
         message = "fsid has to be set to a valid uuid for the cluster to function";
       }
-      { assertion = cfg.mon.enable == true -> cfg.mon.daemons != [];
+      { assertion = cfg.mon.enable -> cfg.mon.daemons != [];
         message = "have to set id of atleast one MON if you're going to enable Monitor";
       }
-      { assertion = cfg.mds.enable == true -> cfg.mds.daemons != [];
+      { assertion = cfg.mds.enable -> cfg.mds.daemons != [];
         message = "have to set id of atleast one MDS if you're going to enable Metadata Service";
       }
-      { assertion = cfg.osd.enable == true -> cfg.osd.daemons != [];
+      { assertion = cfg.osd.enable -> cfg.osd.daemons != [];
         message = "have to set id of atleast one OSD if you're going to enable OSD";
       }
-      { assertion = cfg.mgr.enable == true -> cfg.mgr.daemons != [];
+      { assertion = cfg.mgr.enable -> cfg.mgr.daemons != [];
         message = "have to set id of atleast one MGR if you're going to enable MGR";
       }
     ];

pkgs/applications/editors/lapce/default.nix

···
 , pkg-config
 , perl
 , fontconfig
-, copyDesktopItems
-, makeDesktopItem
 , glib
 , gtk3
 , openssl
···
     cmake
     pkg-config
     perl
-    copyDesktopItems
     wrapGAppsHook # FIX: No GSettings schemas are installed on the system
     gobject-introspection
   ];
···
   ];
 
   postInstall = ''
-    install -Dm0644 $src/extra/images/logo.svg $out/share/icons/hicolor/scalable/apps/lapce.svg
+    install -Dm0644 $src/extra/images/logo.svg $out/share/icons/hicolor/scalable/apps/dev.lapce.lapce.svg
+    install -Dm0644 $src/extra/linux/dev.lapce.lapce.desktop $out/share/applications/lapce.desktop
   '';
-
-  desktopItems = [ (makeDesktopItem {
-    name = "lapce";
-    exec = "lapce %F";
-    icon = "lapce";
-    desktopName = "Lapce";
-    comment = meta.description;
-    genericName = "Code Editor";
-    categories = [ "Development" "Utility" "TextEditor" ];
-  }) ];
 
   passthru.updateScript = nix-update-script { };
 

pkgs/applications/graphics/pineapple-pictures/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "pineapple-pictures";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "BLumia";
     repo = "pineapple-pictures";
     rev = version;
-    hash = "sha256-fNme11zoQBoFz4qJxBWzA8qHPwwxirM9rxxT36tjiQs";
+    hash = "sha256-6peNZc+rrQrUFSrn1AK8lZsy4RQf9DwpmXY0McfEus8=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/nwg-dock/default.nix

···
 
 buildGoModule rec {
   pname = "nwg-dock";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4cyhE9CJz/4omvzucLuTR4QLQnd5iVANCG/BI6Sdhq8=";
+    sha256 = "sha256-kLvVP+hwv8Xgvp1YqrXZ2xpEcU92yvNMT5YCcDcg7xQ=";
   };
 
   vendorHash = "sha256-WDygnKdldZda4GadfStHWsDel1KLdzjVjw0RxmnFPRE=";

pkgs/applications/networking/cluster/argocd/default.nix

···
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.7.6";
+  version = "2.7.7";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "sha256-YEQ5vLE13FzcE0dt/RRxuM2qRuvuHrTgGlF+3D4aox4=";
+    sha256 = "sha256-1GFA/zGX9geHgGRWx+sgszr9bJnMhAiiTjrnfvkTzuA=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-PQys3jXpwBsBQAMLW6WUUsIc+l1knSAvUicQug9fCmU=";
+  vendorHash = "sha256-h4TKomZSG6fEUVxIDhsxNHaIO+1Xl40+pFWgJJ2VH4E=";
 
   # Set target as ./cmd per cli-local
   # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227

pkgs/applications/networking/cluster/kube-score/default.nix

···
 { lib
 , buildGoModule
 , fetchFromGitHub
+, testers
+, kube-score
 }:
 
 buildGoModule rec {
···
   };
 
   vendorHash = "sha256-UpuwkQHcNg3rohr+AdALakIdHroIySlTnXHgoUdY+EQ=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${version}"
+    "-X=main.commit=${src.rev}"
+  ];
+
+  passthru.tests = {
+    version = testers.testVersion {
+      package = kube-score;
+      command = "kube-score version";
+    };
+  };
 
   meta = with lib; {
     description = "Kubernetes object analysis with recommendations for improved reliability and security";

pkgs/applications/networking/mailreaders/betterbird/betterbird.diff

···
---- a/12-feature-linux-systray-example.patch
-+++ b/12-feature-linux-systray-example.patch
-@@ -8,18 +8,15 @@ diff --git a/third_party/appindicator/Makefile b/third_party/appindicator/Makefi
- new file mode 100644
- --- /dev/null
- +++ b/third_party/appindicator/Makefile
--@@ -0,0 +1,34 @@
-+@@ -0,0 +1,31 @@
- +# Code from https://github.com/AyatanaIndicators/libayatana-appindicator
- +# and related repositories.
- +# See https://github.com/AyatanaIndicators/libayatana-appindicator/issues/46 for build instructions.
- +# You need: sudo aptitude install libdbusmenu-gtk3-dev
- +
--+CFLAGS=`pkg-config --cflags gtk+-3.0 glib-2.0` \
--+  -I/usr/include/libdbusmenu-glib-0.4/ \
--+  -I/usr/include/libdbusmenu-gtk3-0.4/ \
--+  -I/usr/include/glib-2.0
-++CFLAGS=`pkg-config --cflags gtk+-3.0 glib-2.0 dbusmenu-gtk3-0.4` \
- +
--+LDFLAGS=`pkg-config --libs gtk+-3.0 glib-2.0` -ldbusmenu-glib -ldbusmenu-gtk3
-++LDFLAGS=`pkg-config --libs dbusmenu-gtk3-0.4`
- +
- +OBJECTS=betterbird-systray-icon.o \
- +  app-indicator.o \
---- a/1790619-send-progress-width.patch
-+++ b/1790619-send-progress-width.patch
-@@ -31,6 +21,7 @@
-        scrolling="false">
-  <head>
-    <title>&sendDialog.title;</title>
-+   <link rel="localization" href="branding/brand.ftl" />
- +  <script defer="defer" src="chrome://messenger/content/dialogShadowDom.js"></script>
-    <script defer="defer" src="chrome://messenger/content/messengercompose/sendProgress.js"></script>
- -  <script defer="defer" src="chrome://messenger/content/dialogShadowDom.js"></script>
---- a/1777788-fix-dialog-size.patch
-+++ b/1777788-fix-dialog-size.patch
-@@ -22,6 +22,7 @@ diff --git a/mailnews/compose/content/sendProgress.xhtml b/mailnews/compose/cont
-        scrolling="false">
-  <head>
-    <title>&sendDialog.title;</title>
-+   <link rel="localization" href="branding/brand.ftl" />
-    <script defer="defer" src="chrome://messenger/content/dialogShadowDom.js"></script>
-    <script defer="defer" src="chrome://messenger/content/messengercompose/sendProgress.js"></script>
-  </head>

pkgs/applications/networking/mailreaders/betterbird/default.nix

···
 , thunderbird-unwrapped
 }:
 
-((buildMozillaMach rec {
+let
+  version = "102.12.0";
+  majVer = lib.versions.major version;
+
+  betterbird-patches = fetchFromGitHub {
+    owner = "Betterbird";
+    repo = "thunderbird-patches";
+    rev = "${version}-bb37";
+    postFetch = ''
+      echo "Retrieving external patches"
+
+      echo "#!${runtimeShell}" > external.sh
+      # if no external patches need to be downloaded, don't fail
+      { grep " # " $out/${majVer}/series-M-C || true ; } >> external.sh
+      { grep " # " $out/${majVer}/series || true ; } >> external.sh
+      sed -i -e '/^#/d' external.sh
+      sed -i -e 's/\/rev\//\/raw-rev\//' external.sh
+      sed -i -e 's|\(.*\) # \(.*\)|curl \2 -o $out/${majVer}/external/\1|' external.sh
+      chmod 700 external.sh
+
+      mkdir $out/${majVer}/external
+      SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
+      . ./external.sh
+      rm external.sh
+    '';
+    sha256 = "sha256-LH0dgWqariutfaOCPIUZrHzZ8oCbZF1VaaKQIQS4aL8=";
+  };
+in ((buildMozillaMach {
   pname = "betterbird";
-  version = "102.8.0";
+  inherit version;
 
   applicationName = "Betterbird";
   binaryName = "betterbird";
   inherit (thunderbird-unwrapped) application extraPatches;
 
   src = fetchurl {
-    # https://download.cdn.mozilla.net/pub/mozilla.org/thunderbird/releases/
+    # https://download.cdn.mozilla.net/pub/thunderbird/releases/
     url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-    sha512 = "2431eb8799184b261609c96bed3c9368bec9035a831aa5f744fa89e48aedb130385b268dd90f03bbddfec449dc3e5fad1b5f8727fe9e11e1d1f123a81b97ddf8";
+    sha512 = "303787a8f22a204e48784d54320d5f4adaeeeedbe4c2294cd26ad75792272ffc9453be7f0ab1434214b61a2cc46982c23c4fd447c4d80d588df4a7800225ddee";
   };
 
-  extraPostPatch = let
-    majVer = lib.versions.major version;
-    betterbird = fetchFromGitHub {
-      owner = "Betterbird";
-      repo = "thunderbird-patches";
-      rev = "${version}-bb30";
-      postFetch = ''
-        echo "Retrieving external patches"
-
-        echo "#!${runtimeShell}" > external.sh
-        grep " # " $out/${majVer}/series-M-C >> external.sh
-        grep " # " $out/${majVer}/series >> external.sh
-        sed -i -e 's/\/rev\//\/raw-rev\//' external.sh
-        sed -i -e 's|\(.*\) # \(.*\)|curl \2 -o $out/${majVer}/external/\1|' external.sh
-        chmod 700 external.sh
-
-        mkdir $out/${majVer}/external
-        SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
-        . ./external.sh
-        rm external.sh
-      '';
-      sha256 = "sha256-ouJSFz/5shNR9puVjrZRJq90DHTeSx7hAnDpuhkBsDo=";
-    };
-  in thunderbird-unwrapped.extraPostPatch or "" + /* bash */ ''
+  extraPostPatch = thunderbird-unwrapped.extraPostPatch or "" + /* bash */ ''
     PATH=$PATH:${lib.makeBinPath [ git ]}
     patches=$(mktemp -d)
     for dir in branding bugs external features misc; do
-      cp -r ${betterbird}/${majVer}/$dir/*.patch $patches/
+      cp -r ${betterbird-patches}/${majVer}/$dir/*.patch $patches/
+      # files is not in series file and duplicated with external patch
+      [[ $dir == bugs ]] && rm $patches/1820504-optimise-grapheme-m-c.patch
     done
-    cp ${betterbird}/${majVer}/series* $patches/
+    cp ${betterbird-patches}/${majVer}/series* $patches/
     chmod -R +w $patches
 
     cd $patches
-    patch -p1 < ${./betterbird.diff}
+    # fix FHS paths to libdbusmenu
     substituteInPlace 12-feature-linux-systray.patch \
       --replace "/usr/include/libdbusmenu-glib-0.4/" "${lib.getDev libdbusmenu-gtk3}/include/libdbusmenu-glib-0.4/" \
       --replace "/usr/include/libdbusmenu-gtk3-0.4/" "${lib.getDev libdbusmenu-gtk3}/include/libdbusmenu-gtk3-0.4/"
···
   webrtcSupport = false;
 
   pgoSupport = false; # console.warn: feeds: "downloadFeed: network connection unavailable"
-}).overrideAttrs(oldAttrs: {
+}).overrideAttrs (oldAttrs: {
   postInstall = oldAttrs.postInstall or "" + ''
     mv $out/lib/thunderbird/* $out/lib/betterbird
     rmdir $out/lib/thunderbird/
···
   '';
 
   doInstallCheck = false;
-  requiredSystemFeatures = [];
+
+  passthru = oldAttrs.passthru // {
+    inherit betterbird-patches;
+  };
 })

pkgs/applications/science/biology/kallisto/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "kallisto";
-  version = "0.48.0";
+  version = "0.50.0";
 
   src = fetchFromGitHub {
     repo = "kallisto";
     owner = "pachterlab";
     rev = "v${version}";
-    sha256 = "sha256-r0cdR0jTRa1wu/LDKW6NdxI3XaKj6wcIVbIlct0fFvI=";
+    sha256 = "sha256-GJ8xMbHrnTzvPoMSczpugbIjh79cT3ngX3tLtwzlfEQ=";
   };
 
   nativeBuildInputs = [ autoconf cmake ];

pkgs/development/libraries/botan/generic.nix

···
   pname = "botan";
   version = "${baseVersion}.${revision}";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     name = "Botan-${version}.${sourceExtension}";
     urls = [
···
     ++ lib.optionals stdenv.isDarwin [ CoreServices Security ];
 
   configurePhase = ''
+    runHook preConfigure
     python configure.py --prefix=$out --with-bzip2 --with-zlib ${extraConfigureFlags}${lib.optionalString stdenv.cc.isClang " --cc=clang"}
+    runHook postConfigure
   '';
 
   enableParallelBuilding = true;

pkgs/development/libraries/libmediainfo/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "libmediainfo";
-  version = "23.04";
+  version = "23.06";
 
   src = fetchurl {
     url = "https://mediaarea.net/download/source/libmediainfo/${version}/libmediainfo_${version}.tar.xz";
-    sha256 = "sha256-NlDt6jJv5U0/Y0YUdkSZUI++7ErphAAvCGrfHQwHGSY=";
+    sha256 = "sha256-xrGuiyu89AM0BRizyU8q51yOsAaCv7vRiyJELkLcz80=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];
···
   meta = with lib; {
     description = "Shared library for mediainfo";
     homepage = "https://mediaarea.net/";
+    changelog = "https://mediaarea.net/MediaInfo/ChangeLog";
     license = licenses.bsd2;
     platforms = platforms.unix;
     maintainers = [ maintainers.devhell ];

pkgs/development/libraries/ode/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "ode";
-  version = "0.16.3";
+  version = "0.16.4";
 
   src = fetchurl {
     url = "https://bitbucket.org/odedevs/${pname}/downloads/${pname}-${version}.tar.gz";
-    sha256 = "sha256-x0Hb9Jv8Rozilkgk5bw/kG6pVrGuNZTFDTUcOD8DxBM=";
+    sha256 = "sha256-cQN7goHGyGsKVXKfkNXbaXq+TL7B2BGBV+ANSOwlNGc=";
   };
 
   meta = with lib; {

pkgs/development/python-modules/google-auth/default.nix

···
 
 buildPythonPackage rec {
   pname = "google-auth";
-  version = "2.19.1";
+  version = "2.21.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qc+oiz4WGWhF5ko2WOuVOZISnROsczewZMZUb3fBcYM=";
+    hash = "sha256-so6ASOV3J+fPDlvY5ydrISrvR2ZUoJURNUqoJ1O0XGY=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/google-cloud-compute/default.nix

···
 
 buildPythonPackage rec {
   pname = "google-cloud-compute";
-  version = "1.12.0";
+  version = "1.12.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-d5L0/GiKVCfqHx8UGSx7BLClhgf0fGjw/q0p8N5h6X4=";
+    hash = "sha256-6P8jDASYoFuN7J6BVD50Ww2jZ21soyWUN6QpyNKsqiU=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/matplotlib/default.nix

···
 , fetchPypi
 , writeText
 , buildPythonPackage
+, isPyPy
 , pythonOlder
 
 # https://github.com/matplotlib/matplotlib/blob/main/doc/devel/dependencies.rst
···
 , pygobject3
 
 # Tk
-, enableTk ? !stdenv.isDarwin # darwin has its own "MacOSX" backend
+# Darwin has its own "MacOSX" backend, PyPy has tkagg backend and does not support tkinter
+, enableTk ? (!stdenv.isDarwin && !isPyPy)
 , tcl
 , tk
 , tkinter

pkgs/development/python-modules/nose3/default.nix

···
 , coverage
 , fetchPypi
 , isPyPy
+, isPy311
 , python
 , stdenv
 }:
···
   propagatedBuildInputs = [ coverage ];
 
   # PyPy hangs for unknwon reason
-  # darwin fails an assertion and I didn't find a way to find skip that test
-  doCheck = !isPyPy && !stdenv.isDarwin;
+  # Darwin and python 3.11 fail at various assertions and I didn't find an easy way to find skip those tests
+  doCheck = !isPyPy && !stdenv.isDarwin && !isPy311;
 
   checkPhase = ''
     ${python.pythonForBuild.interpreter} selftest.py

pkgs/development/python-modules/py-radix/default.nix

···
-{ lib
-, buildPythonPackage
-, pythonAtLeast
-, fetchFromGitHub
-, coverage
-, nose
-}:
-
-buildPythonPackage rec {
-  pname = "py-radix";
-  version = "0.10.0";
-
-  disabled = pythonAtLeast "3.10"; # abandoned, remove when we move to py310/py311
-
-  src = fetchFromGitHub {
-    owner = "mjschultz";
-    repo = "py-radix";
-    rev = "v${version}";
-    sha256 = "01xyn9lg6laavnzczf5bck1l1c2718ihxx0hvdkclnnxjqhbrqis";
-  };
-
-  doCheck = true;
-  nativeCheckInputs = [ coverage nose ];
-
-  meta = with lib; {
-    description = "Python radix tree for IPv4 and IPv6 prefix matching";
-    homepage = "https://github.com/mjschultz/py-radix";
-    license = with licenses; [ isc bsdOriginal ];
-    maintainers = with maintainers; [ mkg ];
-  };
-}

pkgs/development/python-modules/rns/default.nix

···
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.5.5";
+  version = "0.5.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
···
     owner = "markqvist";
     repo = "Reticulum";
     rev = "refs/tags/${version}";
-    hash = "sha256-gyEf6Sck+qmbnepiBoHrN9t018BwBM4iJQBjU9Iqhn4=";
+    hash = "sha256-s/rOU9FEWdb0vmRsMq/yPkP/ZTNc5wjlfdB0V+ltryQ=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/skia-pathops/default.nix

···
 , stdenv
 , buildPythonPackage
 , cython
+, isPyPy
 , ninja
 , setuptools-scm
 , setuptools
···
 
   meta = {
     description = "Python access to operations on paths using the Skia library";
-    homepage = "https://skia.org/dev/present/pathops";
+    homepage = "https://github.com/fonttools/skia-pathops";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.BarinovMaxim ];
+    # ERROR at //gn/BUILDCONFIG.gn:87:14: Script returned non-zero exit code.
+    broken = isPyPy;
   };
 }

pkgs/development/python-modules/sphinx/default.nix

···
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, fetchpatch
+, isPyPy
 
 # nativeBuildInputs
 , flit-core
···
     "test_auth_header_no_match"
     "test_follows_redirects_on_GET"
     "test_connect_to_selfsigned_fails"
+  ] ++ lib.optionals isPyPy [
+    # PyPy has not __builtins__ which get asserted
+    # https://doc.pypy.org/en/latest/cpython_differences.html#miscellaneous
+    "test_autosummary_generate_content_for_module"
+    "test_autosummary_generate_content_for_module_skipped"
+    # internals are asserted which are sightly different in PyPy
+    "test_autodoc_inherited_members_None"
+    "test_automethod_for_builtin"
+    "test_builtin_function"
+    "test_cython"
+    "test_isattributedescriptor"
+    "test_methoddescriptor"
+    "test_partialfunction"
   ];
 
   meta = with lib; {

pkgs/development/python-modules/validictory/default.nix

···
-{ lib
-, buildPythonPackage
-, pythonAtLeast
-, fetchPypi
-}:
-
-buildPythonPackage rec {
-  pname = "validictory";
-  version = "1.1.2";
-
-  disabled = pythonAtLeast "3.10"; # abandoned, should be removed when we move to py310/311
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1fim11vj990rmn59qd67knccjx1p4an7gavbgprpabsrb13bi1rs";
-  };
-
-  doCheck = false;
-
-  meta = with lib; {
-    description = "Validate dicts against a schema";
-    homepage = "https://github.com/sunlightlabs/validictory";
-    license = licenses.mit;
-  };
-
-}

pkgs/development/tools/database/sqlcmd/default.nix

···
 
 buildGoModule rec {
   pname = "sqlcmd";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     repo = "go-sqlcmd";
     owner = "microsoft";
     rev = "v${version}";
-    sha256 = "sha256-sBOCUlhqXShcF+KA7NXaUEC6c5+Rz9zutGOw6i2FSsQ=";
+    sha256 = "sha256-nMTC4bOv2Mgmt0GFXoBkbSayJ85i1mS/mcCsP8/x00A=";
   };
 
-  vendorHash = "sha256-1KnMFTadgTmHan2E/9+iHRPgakXi9F3tEOnuwGR+FXw=";
+  vendorHash = "sha256-+buoX9etR34p1N2G8+48ZvF6cg/y4uKb89sSIwkoeuY=";
   proxyVendor = true;
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];

pkgs/development/tools/github-commenter/default.nix

···
 
 buildGoModule rec {
   pname = "github-commenter";
-  version = "0.9.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = pname;
     rev = version;
-    sha256 = "sha256-IBo4FAoYX1FmrmQ9mlyyu1TGLY7dlH7pWalBoRb2puE=";
+    hash = "sha256-pCcTdj2ZgGIpa6784xkBX29LVu1o5ORqqk9j9wR/V8k=";
   };
 
-  vendorSha256 = "sha256-H1SnNG+/ALYs7h/oT8zWBhAXOuCFY0Sto2ATBBZg2ek=";
+  vendorHash = "sha256-etR//FfHRzCL6WEZSqeaKYu3eLjxA0x5mZJRe1yvycQ=";
 
   meta = with lib; {
     description = "Command line utility for creating GitHub comments on Commits, Pull Request Reviews or Issues";

pkgs/development/tools/misc/go-license-detector/default.nix

···
 
 buildGoModule rec {
   pname = "go-license-detector";
-  version = "4.3.0";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "go-enry";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MubQpxpUCPDBVsEz4NmY8MFEoECXQtzAaZJ89vv5bDc=";
+    hash = "sha256-S9LKXjn5dL5FETOOAk+bs7bIVdu2x7MIhfjpZuXzuLo=";
   };
 
-  vendorSha256 = "sha256-a9yCnGg+4f+UoHbGG8a47z2duBD3qXcAzPKnE4PQsvM=";
+  vendorHash = "sha256-MtQsUsFd9zQGbP7NGZ4zcSoa6O2WSWvGig0GUwCc6uM=";
 
   nativeCheckInputs = [ git ];
 

pkgs/development/tools/rust/cargo-crev/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-crev";
-  version = "0.24.2";
+  version = "0.24.3";
 
   src = fetchFromGitHub {
     owner = "crev-dev";
     repo = "cargo-crev";
     rev = "v${version}";
-    sha256 = "sha256-9jP/GPI+KXtHA54mCIaoN9hK16Xwlkoe7Qqxo4TbQh8=";
+    sha256 = "sha256-CCTG58dwO9gYe0WSUXFeaBSgvZ7pbX9S3B3hzabzkjo=";
   };
 
-  cargoHash = "sha256-wVLPcPPzrXU26BgB4TznGyIAsVmBbKNkNPuLfrS2+MQ=";
+  cargoHash = "sha256-p2qAWAZ1Y0GI0t9wHmn5Ww3o5vXpA6rsA/D7HD2x6o0=";
 
   preCheck = ''
     export HOME=$(mktemp -d)

pkgs/development/tools/rust/cargo-espflash/default.nix

···
-{ lib, rustPlatform, fetchFromGitHub, pkg-config, udev, stdenv, Security }:
+{
+  lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, udev
+, stdenv
+, Security
+, nix-update-script
+, openssl
+, SystemConfiguration
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-espflash";
-  version = "1.7.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "esp-rs";
     repo = "espflash";
     rev = "v${version}";
-    sha256 = "sha256-AauIneSnacnY4mulD/qUgfN4K9tLzZXFug0oEsDuj18=";
+    hash = "sha256-3E0OC8DVP2muLyoN4DQfrdnK+idQEm7IpaA/CUIyYnU=";
   };
 
   nativeBuildInputs = [
     pkg-config
   ];
 
-  buildInputs = lib.optionals stdenv.isLinux [
+  # Needed to get openssl-sys to use pkg-config.
+  OPENSSL_NO_VENDOR = 1;
+
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isLinux [
     udev
   ] ++ lib.optionals stdenv.isDarwin [
     Security
+    SystemConfiguration
   ];
 
-  cargoSha256 = "sha256-82o3B6qmBVPpBVAogClmTbxrBRXY8Lmd2sHmonP5/s8=";
+  cargoHash = "sha256-8VIAmmtaQoIvD7wN+W3yUM0CEDadOQrv1wnJ4/AWKFA=";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     description = "Serial flasher utility for Espressif SoCs and modules based on esptool.py";

pkgs/misc/vencord/default.nix

···
 }:
 buildNpmPackage rec {
   pname = "vencord";
-  version = "1.2.8";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     rev = "v${version}";
-    sha256 = "sha256-l3h4LrpMQ944i4QivKeL3dhZxZCr5uG29pQMY1XNbqc=";
+    sha256 = "sha256-r+VgxXwsBOfMggcVlr5q1/ONfp13CpX4ssrLQtmdLe8=";
   };
 
   ESBUILD_BINARY_PATH = lib.getExe (esbuild.override {
···
   # Supresses an error about esbuild's version.
   npmRebuildFlags = [ "|| true" ];
 
-  npmDepsHash = "sha256-m+hczXog03Gz81CP/blkRJPaTrEhmLQFvVtOfWKYQL4=";
+  npmDepsHash = "sha256-HJK88z4Gs8mqd28zKrsTtk34VcRqIyb6aURbvRZLN0I=";
   npmFlags = [ "--legacy-peer-deps" ];
   npmBuildScript = if buildWebExtension then "buildWeb" else "build";
   npmBuildFlags = [ "--" "--standalone" ];

pkgs/misc/vencord/package-lock.json

···
 {
     "name": "vencord",
-    "version": "1.2.8",
+    "version": "1.3.4",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "vencord",
-            "version": "1.2.8",
+            "version": "1.3.4",
             "license": "GPL-3.0",
             "dependencies": {
                 "@vap/core": "0.0.12",

pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh

···
 
 # Parse the command line.
 origArgs=("$@")
-copyClosureFlags=()
+copyFlags=()
 extraBuildFlags=()
 lockFlags=()
 flakeFlags=(--extra-experimental-features 'nix-command flakes')
···
         upgrade=1
         upgrade_all=1
         ;;
-      --use-substitutes|-s)
-        copyClosureFlags+=("$i")
+      --use-substitutes|--substitute-on-destination|-s)
+        copyFlags+=("-s")
         ;;
       -I|--max-jobs|-j|--cores|--builders|--log-format)
         j="$1"; shift 1
···
     if ! [ "$targetHost" = "$buildHost" ]; then
         if [ -z "$targetHost" ]; then
             logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
-            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyClosureFlags[@]}" --from "$buildHost" "$1"
+            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --from "$buildHost" "$1"
         elif [ -z "$buildHost" ]; then
             logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
-            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyClosureFlags[@]}" --to "$targetHost" "$1"
+            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
         else
-            buildHostCmd nix-copy-closure "${copyClosureFlags[@]}" --to "$targetHost" "$1"
+            buildHostCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
         fi
     fi
 }
···
         drv="$(runCmd nix "${flakeFlags[@]}" eval --raw "${attr}.drvPath" "${evalArgs[@]}" "${extraBuildFlags[@]}")"
         if [ -a "$drv" ]; then
             logVerbose "Running nix with these NIX_SSHOPTS: $SSHOPTS"
-            NIX_SSHOPTS=$SSHOPTS runCmd nix "${flakeFlags[@]}" copy --derivation --to "ssh://$buildHost" "$drv"
+            NIX_SSHOPTS=$SSHOPTS runCmd nix "${flakeFlags[@]}" copy "${copyFlags[@]}" --derivation --to "ssh://$buildHost" "$drv"
             buildHostCmd nix-store -r "$drv" "${buildArgs[@]}"
         else
             log "nix eval failed"
···
     if [ -a "$nixDrv" ]; then
         nix-store -r "$nixDrv"'!'"out" --add-root "$tmpDir/nix" --indirect >/dev/null
         if [ -n "$buildHost" ]; then
-            nix-copy-closure "${copyClosureFlags[@]}" --to "$buildHost" "$nixDrv"
+            nix-copy-closure "${copyFlags[@]}" --to "$buildHost" "$nixDrv"
             # The nix build produces multiple outputs, we add them all to the remote path
             for p in $(buildHostCmd nix-store -r "$(readlink "$nixDrv")" "${buildArgs[@]}"); do
                 remoteNix="$remoteNix${remoteNix:+:}$p/bin"

pkgs/os-specific/linux/pam_dp9ik/default.nix

···
+{ lib
+, tlsclient
+, stdenv
+, pkg-config
+, pam
+}:
+
+stdenv.mkDerivation {
+  inherit (tlsclient) src version enableParallelBuilding;
+
+  pname = "pam_dp9ik";
+
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ pam ];
+
+  makeFlags = [ "pam_p9.so" ];
+  installPhase = ''
+    install -Dm755 -t $out/lib/security/ pam_p9.so
+  '';
+
+  meta = with lib; {
+    description = "dp9ik pam module";
+    longDescription = "Uses tlsclient to authenticate users against a 9front auth server";
+    homepage = "https://git.sr.ht/~moody/tlsclient";
+    license = licenses.mit;
+    maintainers = with maintainers; [ moody ];
+    platforms = platforms.linux;
+  };
+}

pkgs/os-specific/linux/prl-tools/default.nix

···
     "${util-linux}/bin"
   ];
 in
-stdenv.mkDerivation rec {
-  version = "18.3.1-53614";
+stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
+  version = "18.3.2-53621";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
-    url = "https://download.parallels.com/desktop/v${lib.versions.major version}/${version}/ParallelsDesktop-${version}.dmg";
-    hash = "sha256-MZtNxByY2GSoPFeH9mPieCPPNfUgfla+lYgpeD+SgOc=";
+    url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
+    hash = "sha256-mPETZiCI/i6xJ3+ououDKaVwrAxK5cr6L6A16oEgIqk=";
   };
 
   hardeningDisable = [ "pic" "format" ];
···
     maintainers = with maintainers; [ catap wegank ];
     platforms = platforms.linux;
   };
-}
+})

pkgs/servers/http/apache-modules/mod_tile/default.nix

···
   ];
 
   # the install script wants to install mod_tile.so into apache's modules dir
+  # also mapnik pkg-config config is missing this patch: https://github.com/mapnik/mapnik/commit/692c2faa0ef168a8c908d262c2bbfe51a74a8336.patch
   postPatch = ''
     sed -i "s|\''${HTTPD_MODULES_DIR}|$out/modules|" CMakeLists.txt
+    sed -i -e "s|@MAPNIK_FONTS_DIR@|$(mapnik-config --fonts)|" -e "s|@MAPNIK_PLUGINS_DIR@|$(mapnik-config --input-plugins)|" tests/renderd.conf.in
   '';
 
   enableParallelBuilding = true;
 
-  # We need to either disable the `render_speedtest` and `download_tile` tests
-  # or fix the URLs they try to download from
-  #cmakeFlags = [ "-DENABLE_TESTS=1" ];
-  #doCheck = true;
+  cmakeFlags = [ "-DENABLE_TESTS=1" ];
+  doCheck = true;
 
   meta = with lib; {
     homepage = "https://github.com/openstreetmap/mod_tile";

pkgs/servers/irc/robustirc-bridge/default.nix

···
 
 buildGoModule rec {
   pname = "robustirc-bridge";
-  version = "1.8";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "robustirc";
     repo = "bridge";
     rev = "v${version}";
-    sha256 = "12jzil97147f978shdgm6whz7699db0shh0c1fzgrjh512dw502c";
+    hash = "sha256-8SNy3xqVahBuEXCrG21zIggXeahbzJtqtFMxfp+r48g=";
   };
 
-  vendorSha256 = "0lm8j2iz0yysgi0bbh78ca629kb6sxvyy9al3aj2587hpvy79q85";
+  vendorHash = "sha256-NBouR+AwQd7IszEcnYRxHFKtCdVTdfOWnzYjdZ5fXfs=";
 
   postInstall = ''
     install -D robustirc-bridge.1 $out/share/man/man1/robustirc-bridge.1

pkgs/servers/matrix-synapse/default.nix

···
 
   doCheck = !stdenv.isDarwin;
 
-  checkPhase = let testFlags = lib.optionalString (!stdenv.isAarch64) "-j $NIX_BUILD_CORES"; in ''
+  checkPhase = ''
     runHook preCheck
 
     # remove src module, so tests use the installed module instead
     rm -rf ./synapse
 
-    PYTHONPATH=".:$PYTHONPATH" ${python3.interpreter} -m twisted.trial ${testFlags} tests
+    # high parallelisem makes test suite unstable
+    # upstream uses 2 cores but 4 seems to be also stable
+    # https://github.com/matrix-org/synapse/blob/develop/.github/workflows/latest_deps.yml#L103
+    if (( $NIX_BUILD_CORES > 4)); then
+      NIX_BUILD_CORES=4
+    fi
+
+    PYTHONPATH=".:$PYTHONPATH" ${python3.interpreter} -m twisted.trial -j $NIX_BUILD_CORES tests
 
     runHook postCheck
   '';
 
-  passthru.tests = { inherit (nixosTests) matrix-synapse; };
-  passthru.plugins = plugins;
-  passthru.tools = tools;
-  passthru.python = python3;
+  passthru = {
+    tests = { inherit (nixosTests) matrix-synapse; };
+    inherit plugins tools;
+    python = python3;
+  };
 
   meta = with lib; {
     homepage = "https://matrix.org";

pkgs/servers/monitoring/prometheus/lnd-exporter.nix

···
 
 buildGoModule rec {
   pname = "lndmon";
-  version = "unstable-2021-03-26";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "lightninglabs";
     repo = "lndmon";
-    sha256 = "14lmmjq61p8yhc86swigs43risqi31vlmz7ri8j0n0fyp8lm2kxs";
-    rev = "3aa925aa4f633a6c4d132601922e78f173ae8ac1";
+    rev = "v${version}";
+    hash = "sha256-j9T60J7n9sya9/nN0Y6wsPDXN2h35pXxMdadsOkAMWI=";
   };
 
-  vendorSha256 = "06if387b9m02ciqgcissih1x06l33djp87vgspwzz589f77vczk8";
+  vendorHash = "sha256-h9+/BOy1KFiqUUV35M548fDKFC3Q5mBaANuD7t1rpp8=";
+
+  # Irrelevant tools dependencies.
+  excludedPackages = [ "./tools" ];
 
   passthru.tests = { inherit (nixosTests.prometheus-exporters) lnd; };
 

pkgs/servers/monitoring/prometheus/rabbitmq-exporter.nix

···
 
 buildGoModule rec {
   pname = "rabbitmq_exporter";
-  version = "1.0.0-RC8";
+  version = "1.0.0-RC19";
 
   src = fetchFromGitHub {
     owner = "kbudde";
     repo = "rabbitmq_exporter";
     rev = "v${version}";
-    sha256 = "162rjp1j56kcq0vdi0ch09ka101zslxp684x6jvw0jq0aix4zj3r";
+    hash = "sha256-31A0afmARdHxflR3n59DaqmLpTXws4OqROHfnc6cLKw=";
   };
 
-  vendorSha256 = "1cvdqf5pdwczhqz6xb6w86h7gdr0l8fc3lav88xq26r4x75cm6v0";
+  vendorHash = "sha256-ER0vK0xYUbQT3bqUosQMFT7HBycb3U8oI4Eak72myzs=";
 
   meta = with lib; {
     description = "Prometheus exporter for RabbitMQ";

pkgs/tools/admin/kics/default.nix

···
 
 buildGoModule rec {
   pname = "kics";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "Checkmarx";
     repo = "kics";
     rev = "v${version}";
-    sha256 = "sha256-D5w/Wt6Dlu6ouwwyZkGa6Ttu367s7SrnlGI0lQqSpfI=";
+    sha256 = "sha256-IYyGZ0eJcGLQoQyfgbwxzzoEZ2dUKLlEaZ4NhuP5Q30=";
   };
 
   vendorHash = "sha256-cMKEUH/teEfyhHgBz3pMD8sotZ51t6O+4EiQ9BJt2Qg=";

pkgs/tools/admin/tlsclient/default.nix

···
+{ lib
+, stdenv
+, fetchFromSourcehut
+, pkg-config
+, openssl
+, installShellFiles
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tlsclient";
+  version = "1.5";
+
+  src = fetchFromSourcehut {
+    owner = "~moody";
+    repo = "tlsclient";
+    rev = "v${version}";
+    hash = "sha256-9LKx9x5Kx7Mo4EL/b89Mdsdu8NqVYxohn98XnF+IWXs=";
+  };
+
+  strictDeps = true;
+  enableParallelBuilding = true;
+  nativeBuildInputs = [ pkg-config installShellFiles ];
+  buildInputs = [ openssl ];
+
+  makeFlags = [ "tlsclient" ];
+  installPhase = ''
+    install -Dm755 -t $out/bin tlsclient
+    installManPage tlsclient.1
+  '';
+
+  meta = with lib; {
+    description = "tlsclient command line utility";
+    longDescription = "unix port of 9front's tlsclient(1) and rcpu(1)";
+    homepage = "https://git.sr.ht/~moody/tlsclient";
+    license = licenses.mit;
+    maintainers = with maintainers; [ moody ];
+    mainProgram = "tlsclient";
+    platforms = platforms.all;
+  };
+}

pkgs/tools/admin/wander/default.nix

···
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles, testers, wander }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 
 buildGoModule rec {
   pname = "wander";
-  version = "0.9.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "robinovitch61";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-g9QAdwAqy3OA+nYsSpVLUPv1gn6N12339fgmYFT6Iys=";
+    sha256 = "sha256-jg83GHNlzPPzzhrLWw686vrmLlDL5L0+OUYqMoYUiJw=";
   };
 
-  vendorHash = "sha256-iTaZ5/0UrLJ3JE3FwQpvjKKrhqklG4n1WFTJhWfj/rI=";
+  vendorHash = "sha256-SqDGXV8MpvEQFAkcE1NWvWjdzYsvbO5vA6k+hpY0js0=";
 
-  ldflags = [ "-s" "-w" "-X=github.com/robinovitch61/wander/cmd.Version=v${version}" ];
+  ldflags = [ "-s" "-w" ];
 
   nativeBuildInputs = [ installShellFiles ];
 
···
       --bash <($out/bin/wander completion bash) \
       --zsh <($out/bin/wander completion zsh)
   '';
-
-  passthru.tests.version = testers.testVersion {
-    package = wander;
-    command = "wander --version";
-    version = "v${version}";
-  };
 
   meta = with lib; {
     description = "Terminal app/TUI for HashiCorp Nomad";

pkgs/tools/filesystems/fuse-archive/default.nix

···
+{ lib
+, stdenv
+, fetchFromGitHub
+, fuse
+, libarchive
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "fuse-archive";
+  version = "0.1.14";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "fuse-archive";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-l4tIK157Qo4m611etwMSk564+eC28x4RbmjX3J57/7Q=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    fuse
+    libarchive
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-D_FILE_OFFSET_BITS=64";
+
+  makeFlags = [
+    "prefix=${placeholder "out"}"
+  ];
+
+  meta = with lib; {
+    description = "Serve an archive or a compressed file as a read-only FUSE file system";
+    homepage = "https://github.com/google/fuse-archive";
+    changelog = "https://github.com/google/fuse-archive/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ icyrockcom ];
+  };
+
+  inherit (fuse.meta) platforms;
+}

pkgs/tools/security/softhsm/default.nix

···
 
   configureFlags = [
     "--with-crypto-backend=botan"
-    "--with-botan=${botan2}"
+    "--with-botan=${lib.getDev botan2}"
     "--sysconfdir=$out/etc"
     "--localstatedir=$out/var"
     ];

pkgs/tools/typesetting/tex/texlive/default.nix

···
   tl = let
     orig = removeAttrs tlpdb [ "00texlive.config" ];
 
-    overridden = orig // {
+    overridden = lib.recursiveUpdate orig {
       # overrides of texlive.tlpdb
 
       # only *.po for tlmgr
-      texlive-msg-translations = builtins.removeAttrs orig.texlive-msg-translations [ "hasTlpkg" ];
+      texlive-msg-translations.hasTlpkg = false;
 
-      xdvi = orig.xdvi // { # it seems to need it to transform fonts
-        deps = (orig.xdvi.deps or []) ++  [ "metafont" ];
-      };
+      # it seems to need it to transform fonts
+      xdvi.deps = (orig.xdvi.deps or []) ++  [ "metafont" ];
 
-      arabi-add = orig.arabi-add // {
-        # tlpdb lists license as "unknown", but the README says lppl13: http://mirrors.ctan.org/language/arabic/arabi-add/README
-        license = [  "lppl13c" ];
-      };
+      # tlpdb lists license as "unknown", but the README says lppl13: http://mirrors.ctan.org/language/arabic/arabi-add/README
+      arabi-add.license = [  "lppl13c" ];
 
       # TODO: remove this when updating to texlive-2023, npp-for-context is no longer in texlive
-      npp-for-context = orig.npp-for-context // {
-        # tlpdb lists license as "noinfo", but it's gpl3: https://github.com/luigiScarso/context-npp
-        license = [  "gpl3Only" ];
-      };
+      # tlpdb lists license as "noinfo", but it's gpl3: https://github.com/luigiScarso/context-npp
+      npp-for-context.license = [  "gpl3Only" ];
 
       # remove dependency-heavy packages from the basic collections
-      collection-basic = orig.collection-basic // {
-        deps = lib.filter (n: n != "metafont" && n != "xdvi") orig.collection-basic.deps;
-      };
-      # add them elsewhere so that collections cover all packages
-      collection-metapost = orig.collection-metapost // {
-        deps = orig.collection-metapost.deps ++ [ "metafont" ];
-      };
-      collection-plaingeneric = orig.collection-plaingeneric // {
-        deps = orig.collection-plaingeneric.deps ++ [ "xdvi" ];
-      };
+      collection-basic.deps = lib.subtractLists [ "metafont" "xdvi" ] orig.collection-basic.deps;
 
-      texdoc = orig.texdoc // {
+      # add them elsewhere so that collections cover all packages
+      collection-metapost.deps = orig.collection-metapost.deps ++ [ "metafont" ];
+      collection-plaingeneric.deps = orig.collection-plaingeneric.deps ++ [ "xdvi" ];
+
+      texdoc = {
         extraRevision = ".tlpdb${toString tlpdbVersion.revision}";
         extraVersion = "-tlpdb-${toString tlpdbVersion.revision}";
 

pkgs/top-level/all-packages.nix

···
 
   fuse-7z-ng = callPackage ../tools/filesystems/fuse-7z-ng { };
 
+  fuse-archive = callPackage ../tools/filesystems/fuse-archive { };
+
   fuse-overlayfs = callPackage ../tools/filesystems/fuse-overlayfs { };
 
   fusee-interfacee-tk = callPackage ../applications/misc/fusee-interfacee-tk { };
···
 
   tldr-hs = haskellPackages.tldr;
 
+  tlsclient = callPackage ../tools/admin/tlsclient { };
+
   tlsx = callPackage ../tools/security/tlsx { };
 
   tmate = callPackage ../tools/misc/tmate { };
···
   cargo2junit = callPackage ../development/tools/rust/cargo2junit { };
 
   cargo-espflash = callPackage ../development/tools/rust/cargo-espflash {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
 
   cargo-web = callPackage ../development/tools/rust/cargo-web {
···
   # pam_bioapi ( see http://www.thinkwiki.org/wiki/How_to_enable_the_fingerprint_reader )
 
   pam_ccreds = callPackage ../os-specific/linux/pam_ccreds { };
+
+  pam_dp9ik = callPackage ../os-specific/linux/pam_dp9ik { };
 
   pam_gnupg = callPackage ../os-specific/linux/pam_gnupg { };
 

pkgs/top-level/python-aliases.nix

···
   pur = throw "pur has been renamed to pkgs.pur"; # added 2021-11-08
   pushbullet = pushbullet-py;  # Added 2022-10-15
   Pweave = pweave; # added 2023-02-19
+  py-radix = throw "py-radix has been removed, since it abandoned"; # added 2023-07-07
   pyalmond = throw "pyalmond has been removed, since its API endpoints have been shutdown"; # added 2023-02-02
   pyblake2 = throw "pyblake2 is deprecated in favor of hashlib"; # added 2023-04-23
   pyblock = throw "pyblock has been removed, since it is abandoned and broken"; # added 2023-06-20
···
   unittest2 = throw "unittest2 has been removed as it's a backport of unittest that's unmaintained and not needed beyond Python 3.4."; # added 2022-12-01
   uproot3 = throw "uproot3 has been removed, use uproot instead"; # added 2022-12-13
   uproot3-methods = throw "uproot3-methods has been removed"; # added 2022-12-13
+  validictory = throw "validictory has been removed, since it abandoned"; # added 2023-07-07
   virtual-display = throw "virtual-display has been renamed to PyVirtualDisplay"; # added 2023-01-07
   Wand = wand; # added 2022-11-13
   wasm = throw "wasm has been removed because it no longer builds and is unmaintained"; # added 2023-05-20

pkgs/top-level/python-packages.nix

···
 
   pyradios = callPackage ../development/python-modules/pyradios { };
 
-  py-radix = callPackage ../development/python-modules/py-radix { };
-
   pyrainbird = callPackage ../development/python-modules/pyrainbird { };
 
   pyramid_beaker = callPackage ../development/python-modules/pyramid_beaker { };
···
   validate-email = callPackage ../development/python-modules/validate-email { };
 
   validators = callPackage ../development/python-modules/validators { };
-
-  validictory = callPackage ../development/python-modules/validictory { };
 
   validobj = callPackage ../development/python-modules/validobj { };