Merge staging-next into staging

nixos/modules/services/x11/desktop-managers/plasma5.nix

@@ -295,7 +295,7 @@ in
         ++ lib.optional config.powerManagement.enable powerdevil
         ++ lib.optional config.services.colord.enable pkgs.colord-kde
         ++ lib.optional config.services.hardware.bolt.enable pkgs.plasma5Packages.plasma-thunderbolt
-        ++ lib.optionals config.services.samba.enable [ kdenetwork-filesharing pkgs.samba ]
+        ++ lib.optional config.services.samba.enable kdenetwork-filesharing
         ++ lib.optional config.services.xserver.wacom.enable pkgs.wacomtablet
         ++ lib.optional config.services.flatpak.enable flatpak-kcm;
 

pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix

@@ -2,7 +2,7 @@
 callPackage ./generic.nix {} rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "6.40.0";
+  version = "6.42.0";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-vyXHlycPSyEyv938IKzGM6pdERHHerx2CLY/U+WMrH4=";
+  hash = "sha256-uGsVv/J8eMjPOdUs+8GcYopy9D2g3SUhS09banrA6hY=";
 }

pkgs/applications/version-management/git-lfs/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "git-lfs";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner = "git-lfs";
     repo = "git-lfs";
     rev = "v${version}";
-    hash = "sha256-lZx+sJQttclZPET0jkv3dmpQysCpsYani+La7yfSUlI=";
+    hash = "sha256-XqxkNCC2yzUTVOi/1iDsnxtLkw4jfQuBh9UsjtZ1zVc=";
   };
 
   vendorHash = "sha256-VmPeQYWOHFqFLHKcKH3WHz50yx7GMHVIDPzqiVwwjSg=";

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -149,6 +149,13 @@ let
       done
     fi
 
+    # propagate /etc from the actual host if nested
+    if [[ -e /.host-etc ]]; then
+      ro_mounts+=(--ro-bind /.host-etc /.host-etc)
+    else
+      ro_mounts+=(--ro-bind /etc /.host-etc)
+    fi
+
     for i in ${lib.escapeShellArgs etcBindEntries}; do
       if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
         continue
@@ -193,7 +200,6 @@ let
       ${lib.optionalString unshareCgroup "--unshare-cgroup"}
       ${lib.optionalString dieWithParent "--die-with-parent"}
       --ro-bind /nix /nix
-      --ro-bind /etc /.host-etc
       ${lib.optionalString privateTmp "--tmpfs /tmp"}
       # Our glibc will look for the cache in its own path in `/nix/store`.
       # As such, we need a cache to exist there, because pressure-vessel

pkgs/by-name/de/dependabot-cli/package.nix

@@ -0,0 +1,62 @@
+{ buildGoModule
+, dependabot-cli
+, fetchFromGitHub
+, fetchpatch
+, installShellFiles
+, lib
+, testers
+}:
+let
+  pname = "dependabot-cli";
+  version = "1.39.0";
+in
+buildGoModule {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "dependabot";
+    repo = "cli";
+    rev = "v${version}";
+    hash = "sha256-QuhgFWF97B72KTX/QKSXNl/4RDAKUMDga7vLYiZw4SM=";
+  };
+
+  vendorHash = "sha256-mNpNp/zeQGgcljj2VhGl4IN1HG1R8CJSTWKzrgC0z44=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/dependabot/cli/cmd/dependabot/internal/cmd.version=v${version}"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd dependabot \
+      --bash <($out/bin/dependabot completion bash) \
+      --fish <($out/bin/dependabot completion fish) \
+      --zsh <($out/bin/dependabot completion zsh)
+  '';
+
+  checkFlags = [
+    "-skip=TestIntegration|TestNewProxy_customCert|TestRun"
+  ];
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/dependabot --help
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = dependabot-cli;
+    command = "dependabot --version";
+    version = "v${version}";
+  };
+
+  meta = with lib; {
+    changelog = "https://github.com/dependabot/cli/releases/tag/v${version}";
+    description = "A tool for testing and debugging Dependabot update jobs";
+    homepage = "https://github.com/dependabot/cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ l0b0 ];
+  };
+}

pkgs/development/embedded/platformio/core.nix

@@ -1,42 +1,53 @@
-{ stdenv, lib, python3
+{ lib
+, python3Packages
 , fetchFromGitHub
-, fetchPypi
+, fetchpatch
 , git
 , spdx-license-list-data
+, substituteAll
 }:
 
-with python3.pkgs; buildPythonApplication rec {
-  pname = "platformio";
 
-  version = "6.1.6";
+with python3Packages; buildPythonApplication rec {
+  pname = "platformio";
+  version = "6.1.11";
+  pyproject = true;
 
   # pypi tarballs don't contain tests - https://github.com/platformio/platformio-core/issues/1964
   src = fetchFromGitHub {
     owner = "platformio";
     repo = "platformio-core";
     rev = "v${version}";
-    sha256 = "sha256-BEeMfdmAWqFbQUu8YKKrookQVgmhfZBqXnzeb2gfhms=";
+    hash = "sha256-NR4UyAt8q5sUGtz1Sy6E8Of7y9WrH9xpcAWzLBeDQmo=";
   };
 
   outputs = [ "out" "udev" ];
 
   patches = [
-    ./fix-searchpath.patch
-    ./use-local-spdx-license-list.patch
+    (substituteAll {
+      src = ./interpreter.patch;
+      interpreter = (python3Packages.python.withPackages (_: propagatedBuildInputs)).interpreter;
+    })
+    (substituteAll {
+      src = ./use-local-spdx-license-list.patch;
+      spdx_license_list_data = spdx-license-list-data.json;
+    })
     ./missing-udev-rules-nixos.patch
+    (fetchpatch {
+      # restore PYTHONPATH when calling scons
+      # https://github.com/platformio/platformio-core/commit/097de2be98af533578671baa903a3ae825d90b94
+      url = "https://github.com/platformio/platformio-core/commit/097de2be98af533578671baa903a3ae825d90b94.patch";
+      hash = "sha256-yq+/QHCkhAkFND11MbKFiiWT3oF1cHhgWj5JkYjwuY0=";
+      revert = true;
+    })
   ];
 
-  postPatch = ''
-    substitute platformio/package/manifest/schema.py platformio/package/manifest/schema.py \
-      --subst-var-by SPDX_LICENSE_LIST_DATA '${spdx-license-list-data.json}'
+  nativeBuildInputs = [
+    pythonRelaxDepsHook
+    setuptools
+  ];
 
-    substituteInPlace setup.py \
-      --replace 'aiofiles==%s" % ("0.8.0" if PY36 else "22.1.*")' 'aiofiles"' \
-      --replace 'starlette==%s" % ("0.19.1" if PY36 else "0.23.*")' 'starlette"' \
-      --replace 'uvicorn==%s" % ("0.16.0" if PY36 else "0.20.*")' 'uvicorn"' \
-      --replace 'tabulate==%s" % ("0.8.10" if PY36 else "0.9.*")' 'tabulate>=0.8.10,<=0.9"' \
-      --replace 'wsproto==%s" % ("1.0.0" if PY36 else "1.2.*")' 'wsproto"'
-  '';
+  pythonRelaxDeps = true;
 
   propagatedBuildInputs = [
     aiofiles
@@ -52,12 +63,14 @@ with python3.pkgs; buildPythonApplication rec {
     pyserial
     requests
     semantic-version
+    setuptools
     spdx-license-list-data.json
     starlette
     tabulate
     uvicorn
     wsproto
     zeroconf
+
   ];
 
   preCheck = ''
@@ -163,11 +176,13 @@ with python3.pkgs; buildPythonApplication rec {
   ]);
 
   passthru = {
-    python = python3;
+    python = python3Packages.python;
   };
 
   meta = with lib; {
+    changelog = "https://github.com/platformio/platformio-core/releases/tag/v${version}";
     description = "An open source ecosystem for IoT development";
+    downloadPage = "https://github.com/platformio/platformio-core";
     homepage = "https://platformio.org";
     license = licenses.asl20;
     maintainers = with maintainers; [ mog makefu ];

pkgs/development/embedded/platformio/interpreter.patch

@@ -1,9 +1,18 @@
 diff --git a/platformio/proc.py b/platformio/proc.py
-index 80e50201..15cee5a5 100644
+index 707245a1..cae17a29 100644
 --- a/platformio/proc.py
 +++ b/platformio/proc.py
+@@ -165,7 +165,7 @@ def is_container():
+ 
+ 
+ def get_pythonexe_path():
+-    return os.environ.get("PYTHONEXEPATH", os.path.normpath(sys.executable))
++    return "@interpreter@"
+ 
+ 
+ def copy_pythonpath_to_osenv():
 @@ -181,7 +181,7 @@ def copy_pythonpath_to_osenv():
-             conditions.append(isdir(join(p, "click")) or isdir(join(p, "platformio")))
+             )
          if all(conditions):
              _PYTHONPATH.append(p)
 -    os.environ["PYTHONPATH"] = os.pathsep.join(_PYTHONPATH)

pkgs/development/embedded/platformio/missing-udev-rules-nixos.patch

@@ -1,10 +1,12 @@
 diff --git a/platformio/exception.py b/platformio/exception.py
-index ef1d3bab..445174fc 100644
+index 80ffb496..ea064f97 100644
 --- a/platformio/exception.py
 +++ b/platformio/exception.py
-@@ -57,6 +57,7 @@ class MissedUdevRules(InvalidUdevRules):
+@@ -49,6 +49,7 @@ class MissedUdevRules(InvalidUdevRules):
      MESSAGE = (
          "Warning! Please install `99-platformio-udev.rules`. \nMore details: "
          "https://docs.platformio.org/en/latest/core/installation/udev-rules.html"
-+        "On NixOS add the platformio-core.udev package to services.udev.packages"
++        "On NixOS set `services.udev.packages = with pkgs; [ platformio-core.udev ];`."
      )
+ 
+ 

pkgs/development/embedded/platformio/use-local-spdx-license-list.patch

@@ -1,23 +1,17 @@
 diff --git a/platformio/package/manifest/schema.py b/platformio/package/manifest/schema.py
-index 1e5f935a..26d1ac6a 100644
+index 95e08108..6c2cfaed 100644
 --- a/platformio/package/manifest/schema.py
 +++ b/platformio/package/manifest/schema.py
-@@ -276,9 +276,12 @@ class ManifestSchema(BaseSchema):
+@@ -276,9 +276,6 @@ class ManifestSchema(BaseSchema):
      @staticmethod
      @memoized(expire="1h")
      def load_spdx_licenses():
--        version = "3.19"
+-        version = "3.21"
 -        spdx_data_url = (
 -            "https://raw.githubusercontent.com/spdx/license-list-data/"
--            "v%s/json/licenses.json" % version
+-            f"v{version}/json/licenses.json"
 -        )
 -        return json.loads(fetch_remote_content(spdx_data_url))
-+        # version = "3.19"
-+        # spdx_data_url = (
-+            # "https://raw.githubusercontent.com/spdx/license-list-data/"
-+            # "v%s/json/licenses.json" % version
-+        # )
-+        # return json.loads(fetch_remote_content(spdx_data_url))
-+        with open("@SPDX_LICENSE_LIST_DATA@/json/licenses.json") as f:
-+            spdx = json.load(f)
++        with open("@spdx_license_list_data@/json/licenses.json") as fd:
++            spdx = json.load(fd)
 +        return spdx

pkgs/development/tools/clj-kondo/default.nix

@@ -3,12 +3,12 @@
 
 buildGraalvmNativeImage rec {
   pname = "clj-kondo";
-  version = "2023.10.20";
+  version = "2023.12.15";
 
   src = fetchurl {
     url =
       "https://github.com/clj-kondo/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-f9u/pk3CEEmiLgnS2biaUHpsMHjVEwZL2jyB/1PiZUY=";
+    sha256 = "sha256-YVFG7eY0wOB41kKJWydXfil8uyDSHRxPVry9L3u2P4k=";
   };
 
   graalvmDrv = graalvmCEPackages.graalvm-ce;

pkgs/games/vcmi/default.nix

@@ -27,14 +27,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vcmi";
-  version = "1.3.2";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "vcmi";
     repo = "vcmi";
     rev = version;
-    fetchSubmodules = true;
-    hash = "sha256-dwTQRpu+IrKhuiiw/uYBt8i/BYlQ5XCy/jUhDAo6aa4=";
+    hash = "sha256-MhY3tpKlrIgq6QXZwAkMnObYYpUxsPcysTR5CZH1rhE=";
   };
 
   nativeBuildInputs = [
@@ -63,10 +62,10 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DENABLE_LUA:BOOL=ON"
-    "-DENABLE_ERM:BOOL=OFF"
+    "-DENABLE_ERM:BOOL=ON"
     "-DENABLE_GITVERSION:BOOL=OFF"
     "-DENABLE_PCH:BOOL=OFF"
-    "-DENABLE_TEST:BOOL=OFF"
+    "-DENABLE_TEST:BOOL=OFF" # Tests require HOMM3 data files.
     "-DFORCE_BUNDLED_MINIZIP:BOOL=OFF"
     "-DFORCE_BUNDLED_FL:BOOL=OFF"
     "-DCMAKE_INSTALL_RPATH:STRING=$out/lib/vcmi"
@@ -80,12 +79,10 @@ stdenv.mkDerivation rec {
       --prefix PATH : "${lib.makeBinPath [ innoextract ffmpeg unshield ]}"
   '';
 
-  doCheck = true;
-
   passthru.tests.version = testers.testVersion {
     package = vcmi;
     command = ''
-      XDG_DATA_HOME=$PWD XDG_CACHE_HOME=$PWD XDG_CONFIG_HOME=$PWD \
+      XDG_DATA_HOME="$TMPDIR" XDG_CACHE_HOME="$TMPDIR" XDG_CONFIG_HOME="$TMPDIR" \
         vcmiclient --version
     '';
   };
@@ -93,8 +90,8 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "An open-source engine for Heroes of Might and Magic III";
     homepage = "https://vcmi.eu";
-    changelog = "https://github.com/vcmi/vcmi/blob/${src.rev}/ChangeLog";
-    license = with licenses; [ gpl2Only cc-by-sa-40 ];
+    changelog = "https://github.com/vcmi/vcmi/blob/${src.rev}/ChangeLog.md";
+    license = with licenses; [ gpl2Plus cc-by-sa-40 ];
     maintainers = with maintainers; [ azahi ];
     platforms = platforms.linux;
     mainProgram = "vcmilauncher";

pkgs/servers/dns/knot-dns/default.nix

@@ -46,7 +46,9 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  CFLAGS = [ "-O2" "-DNDEBUG" ];
+  CFLAGS = [ "-O2" "-DNDEBUG" ]
+    # https://gitlab.nic.cz/knot/knot-dns/-/issues/909
+    ++ lib.optional stdenv.isDarwin "-D__APPLE_USE_RFC_3542";
 
   doCheck = true;
   checkFlags = [ "V=1" ]; # verbose output in case some test fails

pkgs/servers/klipper/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "klipper";
-  version = "unstable-2023-11-16";
+  version = "unstable-2023-12-13";
 
   src = fetchFromGitHub {
     owner = "KevinOConnor";
     repo = "klipper";
-    rev = "187cc2f1b89e3870d694f8db6a64b116992106b7";
-    sha256 = "sha256-CmnWgX8MvQs/5jQuAR8+1bKM4VsFXF2pV/jme75WJLY=";
+    rev = "f0753bd3381a86826082d5bf7a349c1f0b9f7e48";
+    sha256 = "sha256-4xaee/7tXmR4/249lxHocana0KoesdH22/7HXWq1xwk=";
   };
 
   sourceRoot = "${src.name}/klippy";

pkgs/tools/misc/esphome/default.nix

@@ -3,7 +3,7 @@
 , python3Packages
 , fetchFromGitHub
 , platformio
-, esptool_3
+, esptool
 , git
 }:
 
@@ -17,7 +17,7 @@ in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
   version = "2023.11.6";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = pname;
@@ -26,6 +26,10 @@ python.pkgs.buildPythonApplication rec {
     hash = "sha256-9LqZlhCt+7p6tnSHFhbnUzkEOJQDsg/Pd/hgd/Il0ZQ=";
   };
 
+  nativeBuildInputs = with python.pkgs; [
+    setuptools
+  ];
+
   postPatch = ''
     # remove all version pinning (E.g tornado==5.1.1 -> tornado)
     sed -i -e "s/==[0-9.]*//" requirements.txt
@@ -70,7 +74,7 @@ python.pkgs.buildPythonApplication rec {
     # platformio is used in esphomeyaml/platformio_api.py
     # esptool is used in esphomeyaml/__main__.py
     # git is used in esphomeyaml/writer.py
-    "--prefix PATH : ${lib.makeBinPath [ platformio esptool_3 git ]}"
+    "--prefix PATH : ${lib.makeBinPath [ platformio esptool git ]}"
     "--set ESPHOME_USE_SUBPROCESS ''"
   ];
 

pkgs/tools/misc/esptool/3.nix

@@ -1,73 +0,0 @@
-{ lib, fetchFromGitHub, fetchpatch, python3 }:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "esptool";
-  version = "3.3.2";
-
-  src = fetchFromGitHub {
-    owner = "espressif";
-    repo = "esptool";
-    rev = "v${version}";
-    hash = "sha256-hpPL9KNPA+S57SJoKnQewBCOybDbKep0t5RKw9a9GjM=";
-  };
-
-  patches = [
-    # https://github.com/espressif/esptool/pull/802
-    (fetchpatch {
-      name = "bitstring-4-compatibility.patch";
-      url = "https://github.com/espressif/esptool/commit/16fa58415be2a7ff059ece40d4545288565d0a23.patch";
-      hash = "sha256-FYa9EvyET4P8VkdyMzJBkdxVYm0tFt2GPnfsjzBnevE=";
-      excludes = [ "setup.py" ];
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace test/test_imagegen.py \
-      --replace "sys.executable, ESPTOOL_PY" "ESPTOOL_PY"
-  '';
-
-  propagatedBuildInputs = with python3.pkgs; [
-    bitstring
-    cryptography
-    ecdsa
-    pyserial
-    reedsolo
-  ];
-
-  # wrapPythonPrograms will overwrite esptool.py with a bash script,
-  # but espefuse.py tries to import it. Since we don't add any binary paths,
-  # use patchPythonScript directly.
-  dontWrapPythonPrograms = true;
-  postFixup = ''
-    buildPythonPath "$out $pythonPath"
-    for f in $out/bin/*.py; do
-        echo "Patching $f"
-        patchPythonScript "$f"
-    done
-  '';
-
-  nativeCheckInputs = with python3.pkgs; [
-    pyelftools
-  ];
-
-  # tests mentioned in `.github/workflows/test_esptool.yml`
-  checkPhase = ''
-    runHook preCheck
-
-    export ESPTOOL_PY=$out/bin/esptool.py
-    ${python3.interpreter} test/test_imagegen.py
-    ${python3.interpreter} test/test_espsecure.py
-    ${python3.interpreter} test/test_merge_bin.py
-    ${python3.interpreter} test/test_modules.py
-
-    runHook postCheck
-  '';
-
-  meta = with lib; {
-    description = "ESP8266 and ESP32 serial bootloader utility";
-    homepage = "https://github.com/espressif/esptool";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ hexa ];
-    platforms = with platforms; linux ++ darwin;
-  };
-}

pkgs/tools/security/exploitdb/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2023-12-15";
+  version = "2023-12-16";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-ArPcg66mWu4i/H8KWKkGG/tW0wxwWMyIr4VuQiqpyKo=";
+    hash = "sha256-GIoOX3/TpUiXDyG2ZY6KO4twPYNXA8HaHOo1dJA4dc4=";
   };
 
   nativeBuildInputs = [

pkgs/tools/security/ldapnomnom/default.nix

@@ -5,17 +5,22 @@
 
 buildGoModule rec {
   pname = "ldapnomnom";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "lkarlslund";
-    repo = pname;
+    repo = "ldapnomnom";
     rev = "refs/tags/v${version}";
-    hash = "sha256-o29vcPKRX8TWRCpa20DVsh/4K7d3IbaLS3B+jJGBEmo=";
+    hash = "sha256-3s2mLNqnJ+wZ17gy8Yr2Ze0S62A1bmE91E2ciLNO14E=";
   };
 
   vendorHash = "sha256-3ucnLD+qhBSWY2wLtBcsOcuEf1woqHP17qQg7LlERA8=";
 
+  ldflags = [
+    "-w"
+    "-s"
+  ];
+
   meta = with lib; {
     description = "Tool to anonymously bruteforce usernames from Domain controllers";
     homepage = "https://github.com/lkarlslund/ldapnomnom";

pkgs/top-level/all-packages.nix

@@ -5305,8 +5305,6 @@ with pkgs;
 
   esptool = callPackage ../tools/misc/esptool { };
 
-  esptool_3 = callPackage ../tools/misc/esptool/3.nix { };
-
   esptool-ck = callPackage ../tools/misc/esptool-ck { };
 
   ephemeralpg = callPackage ../development/tools/database/ephemeralpg { };