Merge master into staging-next

flake.nix

@@ -56,7 +56,7 @@
       legacyPackages = forAllSystems (system: import ./. { inherit system; });
 
       nixosModules = {
-        notDetected = import ./nixos/modules/installer/scan/not-detected.nix;
+        notDetected = ./nixos/modules/installer/scan/not-detected.nix;
       };
     };
 }

maintainers/maintainer-list.nix

@@ -5298,6 +5298,16 @@
     github = "gytis-ivaskevicius";
     githubId = 23264966;
   };
+  h7x4 = {
+    name = "h7x4";
+    email = "h7x4@nani.wtf";
+    matrix = "@h7x4:nani.wtf";
+    github = "h7x4";
+    githubId = 14929991;
+    keys = [{
+      fingerprint = "F7D3 7890 228A 9074 40E1  FD48 46B9 228E 814A 2AAC";
+    }];
+  };
   hagl = {
     email = "harald@glie.be";
     github = "hagl";

nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

@@ -993,6 +993,16 @@ signald -d /var/lib/signald/db \
           longer accepted.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The Syncthing service now only allows absolute paths—starting
+          with <literal>/</literal> or <literal>~/</literal>—for
+          <literal>services.syncthing.folders.&lt;name&gt;.path</literal>.
+          In a future release other paths will be allowed again and
+          interpreted relative to
+          <literal>services.syncthing.dataDir</literal>.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-22.11-notable-changes">

nixos/doc/manual/release-notes/rl-2211.section.md

@@ -307,6 +307,11 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
   apply patches. This means that your hashes are out-of-date and the (previously required) attributes `name` and `version`
   are no longer accepted.
 
+- The Syncthing service now only allows absolute paths---starting with `/` or
+  `~/`---for `services.syncthing.folders.<name>.path`.
+  In a future release other paths will be allowed again and interpreted
+  relative to `services.syncthing.dataDir`.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Other Notable Changes {#sec-release-22.11-notable-changes}

nixos/modules/misc/man-db.nix

@@ -52,7 +52,7 @@ in
     environment.systemPackages = [ cfg.package ];
     environment.etc."man_db.conf".text =
       let
-        manualCache = pkgs.runCommandLocal "man-cache" { } ''
+        manualCache = pkgs.runCommand "man-cache" { } ''
           echo "MANDB_MAP ${cfg.manualPages}/share/man $out" > man.conf
           ${cfg.package}/bin/mandb -C man.conf -psc >/dev/null 2>&1
         '';

nixos/modules/services/blockchain/ethereum/erigon.nix

@@ -13,13 +13,13 @@ in {
     services.erigon = {
       enable = mkEnableOption (lib.mdDoc "Ethereum implementation on the efficiency frontier");
 
-      group = mkOption {
+      secretJwtPath = mkOption {
-        type = types.str;
+        type = types.path;
-        default = "ethereum";
         description = lib.mdDoc ''
-          Group of the user running the lighthouse process. This is used to share the jwt
+          Path to the secret jwt used for the http api authentication.
-          secret with the execution layer.
         '';
+        default = "";
+        example = "config.age.secrets.ERIGON_JWT.path";
       };
 
       settings = mkOption {
@@ -64,19 +64,6 @@ in {
   };
 
   config = mkIf cfg.enable {
-    users = {
-      users.erigon = {
-        name = "erigon";
-        group = cfg.group;
-        description = "Erigon user";
-        home = "/var/lib/erigon";
-        isSystemUser = true;
-      };
-      groups = mkIf (cfg.group == "ethereum") {
-        ethereum = {};
-      };
-    };
-
     # Default values are the same as in the binary, they are just written here for convenience.
     services.erigon.settings = {
       datadir = mkDefault "/var/lib/erigon";
@@ -98,9 +85,9 @@ in {
       after = [ "network.target" ];
 
       serviceConfig = {
-        ExecStart = "${pkgs.erigon}/bin/erigon --config ${configFile}";
+        LoadCredential = "ERIGON_JWT:${cfg.secretJwtPath}";
-        User = "erigon";
+        ExecStart = "${pkgs.erigon}/bin/erigon --config ${configFile} --authrpc.jwtsecret=%d/ERIGON_JWT";
-        Group = cfg.group;
+        DynamicUser = true;
         Restart = "on-failure";
         StateDirectory = "erigon";
         CapabilityBoundingSet = "";

nixos/modules/services/blockchain/ethereum/lighthouse.nix

@@ -57,15 +57,6 @@ in {
               '';
             };
 
-            group = mkOption {
-              type = types.str;
-              default = "ethereum";
-              description = lib.mdDoc ''
-                Group of the user running the lighthouse process. This is used to share the jwt
-                secret with the execution layer.
-              '';
-            };
-
             execution = {
               address = mkOption {
                 type = types.str;
@@ -221,19 +212,6 @@ in {
 
   config = mkIf (cfg.beacon.enable || cfg.validator.enable) {
 
-    users = {
-      users.lighthouse-beacon = {
-        name = "lighthouse-beacon";
-        group = cfg.beacon.group;
-        description = "Lighthouse beacon node user";
-        home = "${cfg.beacon.dataDir}";
-        isSystemUser = true;
-      };
-      groups = mkIf (cfg.beacon.group == "ethereum") {
-        ethereum = {};
-      };
-    };
-
     environment.systemPackages = [ pkgs.lighthouse ] ;
 
     networking.firewall = mkIf cfg.beacon.enable {
@@ -259,14 +237,14 @@ in {
           --network ${cfg.network} \
           --datadir ${cfg.beacon.dataDir}/${cfg.network} \
           --execution-endpoint http://${cfg.beacon.execution.address}:${toString cfg.beacon.execution.port} \
-          --execution-jwt ${cfg.beacon.execution.jwtPath} \
+          --execution-jwt ''${CREDENTIALS_DIRECTORY}/LIGHTHOUSE_JWT \
           ${lib.optionalString cfg.beacon.http.enable '' --http --http-address ${cfg.beacon.http.address} --http-port ${toString cfg.beacon.http.port}''} \
           ${lib.optionalString cfg.beacon.metrics.enable '' --metrics --metrics-address ${cfg.beacon.metrics.address} --metrics-port ${toString cfg.beacon.metrics.port}''} \
           ${cfg.extraArgs} ${cfg.beacon.extraArgs}
       '';
       serviceConfig = {
-        User = "lighthouse-beacon";
+        LoadCredential = "LIGHTHOUSE_JWT:${cfg.beacon.execution.jwtPath}";
-        Group = cfg.beacon.group;
+        DynamicUser = true;
         Restart = "on-failure";
         StateDirectory = "lighthouse-beacon";
         NoNewPrivileges = true;

nixos/modules/services/networking/syncthing.nix

@@ -212,10 +212,18 @@ in {
             };
 
             path = mkOption {
-              type = types.str;
+              # TODO for release 23.05: allow relative paths again and set
+              # working directory to cfg.dataDir
+              type = types.str // {
+                check = x: types.str.check x && (substring 0 1 x == "/" || substring 0 2 x == "~/");
+                description = types.str.description + " starting with / or ~/";
+              };
               default = name;
               description = lib.mdDoc ''
                 The path to the folder which should be shared.
+                Only absolute paths (starting with `/`) and paths relative to
+                the [user](#opt-services.syncthing.user)'s home directory
+                (starting with `~/`) are allowed.
               '';
             };
 
@@ -405,7 +413,8 @@ in {
         example = "yourUser";
         description = mdDoc ''
           The user to run Syncthing as.
-          By default, a user named `${defaultUser}` will be created.
+          By default, a user named `${defaultUser}` will be created whose home
+          directory is [dataDir](#opt-services.syncthing.dataDir).
         '';
       };
 

nixos/modules/services/web-apps/mastodon.nix

@@ -623,15 +623,15 @@ in {
       environment = env;
       serviceConfig = {
         Type = "oneshot";
-        script = let
-          olderThanDays = toString cfg.mediaAutoRemove.olderThanDays;
-        in ''
-          ${cfg.package}/bin/tootctl media remove --days=${olderThanDays}
-          ${cfg.package}/bin/tootctl preview_cards remove --days=${olderThanDays}
-        '';
         EnvironmentFile = "/var/lib/mastodon/.secrets_env";
-        startAt = cfg.mediaAutoRemove.startAt;
       } // cfgService;
+      script = let
+        olderThanDays = toString cfg.mediaAutoRemove.olderThanDays;
+      in ''
+        ${cfg.package}/bin/tootctl media remove --days=${olderThanDays}
+        ${cfg.package}/bin/tootctl preview_cards remove --days=${olderThanDays}
+      '';
+      startAt = cfg.mediaAutoRemove.startAt;
     };
 
     services.nginx = lib.mkIf cfg.configureNginx {

nixos/modules/system/activation/top-level.nix

@@ -14,7 +14,7 @@ let
 
       # Containers don't have their own kernel or initrd.  They boot
       # directly into stage 2.
-      ${optionalString (!config.boot.isContainer) ''
+      ${optionalString config.boot.kernel.enable ''
         if [ ! -f ${kernelPath} ]; then
           echo "The bootloader cannot find the proper kernel image."
           echo "(Expecting ${kernelPath})"

nixos/modules/system/boot/kernel.nix

@@ -20,6 +20,9 @@ in
   ###### interface
 
   options = {
+    boot.kernel.enable = mkEnableOption (lib.mdDoc "the Linux kernel. This is useful for systemd-like containers which do not require a kernel.") // {
+      default = true;
+    };
 
     boot.kernel.features = mkOption {
       default = {};
@@ -258,7 +261,7 @@ in
           ];
       })
 
-      (mkIf (!config.boot.isContainer) {
+      (mkIf config.boot.kernel.enable {
         system.build = { inherit kernel; };
 
         system.modulesTree = [ kernel ] ++ config.boot.extraModulePackages;

nixos/modules/virtualisation/container-config.nix

@@ -7,6 +7,8 @@ with lib;
   config = mkIf config.boot.isContainer {
 
     # Disable some features that are not useful in a container.
+    boot.kernel.enable = false;
+
     nix.optimise.automatic = mkDefault false; # the store is host managed
     powerManagement.enable = mkDefault false;
     documentation.nixos.enable = mkDefault false;

nixos/tests/web-apps/mastodon.nix

@@ -129,6 +129,9 @@ in
     ca.wait_for_unit("step-ca.service")
     ca.wait_for_open_port(8443)
 
+    # Check that mastodon-media-auto-remove is scheduled
+    server.succeed("systemctl status mastodon-media-auto-remove.timer")
+
     server.wait_for_unit("nginx.service")
     server.wait_for_unit("redis-mastodon.service")
     server.wait_for_unit("postgresql.service")

pkgs/applications/audio/youtube-music/default.nix

@@ -0,0 +1,36 @@
+{ lib, fetchurl, appimageTools, }:
+
+let
+  pname = "youtube-music";
+  version = "1.17.0";
+
+  src = fetchurl {
+    url = "https://github.com/th-ch/youtube-music/releases/download/v${version}/YouTube-Music-${version}.AppImage";
+    sha256 = "sha256-3QNmCek6UD0WNaqalIksYWLHGfMgetLRLi8mEM1J39I=";
+  };
+
+  appimageContents = appimageTools.extract { inherit pname version src; };
+in
+appimageTools.wrapType2 rec {
+  inherit pname version src;
+
+  extraInstallCommands = ''
+    mv $out/bin/{${pname}-${version},${pname}}
+    install -m 444 \
+        -D ${appimageContents}/youtube-music.desktop \
+        -t $out/share/applications
+    substituteInPlace \
+        $out/share/applications/youtube-music.desktop \
+        --replace 'Exec=AppRun' 'Exec=${pname}'
+    cp -r ${appimageContents}/usr/share/icons $out/share
+  '';
+
+  meta = with lib; {
+    description = "Electron wrapper around YouTube Music";
+    homepage = "https://th-ch.github.io/youtube-music/";
+    license = licenses.mit;
+    sourceProvenance = with sourceTypes; [ fromSource ];
+    platforms = platforms.linux;
+    maintainers = [ maintainers.aacebedo ];
+  };
+}

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2083,6 +2083,16 @@ let
         };
       };
 
+      redhat.vscode-xml = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "vscode-xml";
+          publisher = "redhat";
+          version = "0.22.0";
+          sha256 = "sha256-7QOw0EVcfa7MFnZAHAsUtDZHXD5AFlW54f1qaN3h+2U=";
+        };
+        meta.license = lib.licenses.epl20;
+      };
+
       redhat.vscode-yaml = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "vscode-yaml";

pkgs/applications/graphics/renderdoc/default.nix

@@ -32,13 +32,13 @@ let
 in
 mkDerivation rec {
   pname = "renderdoc";
-  version = "1.21";
+  version = "1.22";
 
   src = fetchFromGitHub {
     owner = "baldurk";
     repo = "renderdoc";
     rev = "v${version}";
-    sha256 = "sha256-T6OAr6Pl4VmXVSlNHF6kh8jIKs3FSTZsZ+Y4IH3SPTE=";
+    sha256 = "sha256-eqMIOb9XAgXtoCJABvZkkS/rhHK7jNqabIFwdCgcSJU=";
   };
 
   buildInputs = [

pkgs/applications/maui/booth.nix

@@ -0,0 +1,52 @@
+{ lib
+, mkDerivation
+, cmake
+, extra-cmake-modules
+, kcoreaddons
+, ki18n
+, kirigami2
+, mauikit
+, mauikit-filebrowsing
+, qtgraphicaleffects
+, qtmultimedia
+, qtquickcontrols2
+, gst_all_1
+}:
+
+mkDerivation {
+  pname = "booth";
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+  ];
+
+  buildInputs = [
+    kcoreaddons
+    ki18n
+    kirigami2
+    mauikit
+    mauikit-filebrowsing
+    qtgraphicaleffects
+    qtmultimedia
+    qtquickcontrols2
+  ] ++ (with gst_all_1; [
+    gst-plugins-bad
+    gst-plugins-base
+    gst-plugins-good
+    gstreamer
+  ]);
+
+  preFixup = ''
+    qtWrapperArgs+=(
+      --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
+    )
+  '';
+
+  meta = with lib; {
+    description = "Camera application";
+    homepage = "https://invent.kde.org/maui/booth";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ milahu ];
+  };
+}

pkgs/applications/maui/default.nix

@@ -14,7 +14,7 @@ See also `pkgs/applications/kde` as this is what this is based on.
 
 # Updates
 
-1. Update the URL in `callPackage ./fetch.sh`.
+1. Update the URL in `./fetch.sh`.
 2. Run `callPackage ./maintainers/scripts/fetch-kde-qt.sh pkgs/applications/maui`
    from the top of the Nixpkgs tree.
 3. Use `nixpkgs-review wip` to check that everything builds.
@@ -67,8 +67,10 @@ let
       mauikit-filebrowsing = callPackage ./mauikit-filebrowsing.nix { };
       mauikit-imagetools = callPackage ./mauikit-imagetools.nix { };
       mauikit-texteditor = callPackage ./mauikit-texteditor.nix { };
+      mauiman = callPackage ./mauiman.nix { };
 
       # applications
+      booth = callPackage ./booth.nix { };
       buho = callPackage ./buho.nix { };
       clip = callPackage ./clip.nix { };
       communicator = callPackage ./communicator.nix { };

pkgs/applications/maui/fetch.sh

@@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/maui/ -A '*-2.1.2.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/maui/ -A '*.tar.xz' )

pkgs/applications/maui/mauikit.nix

@@ -6,6 +6,7 @@
 , kcoreaddons
 , ki18n
 , knotifications
+, mauiman
 , qtbase
 , qtquickcontrols2
 , qtx11extras
@@ -24,6 +25,7 @@ mkDerivation {
     kcoreaddons
     ki18n
     knotifications
+    mauiman
     qtquickcontrols2
     qtx11extras
   ];

pkgs/applications/maui/mauiman.nix

@@ -0,0 +1,27 @@
+{ lib
+, mkDerivation
+, cmake
+, extra-cmake-modules
+, kconfig
+, kcoreaddons
+, ki18n
+, knotifications
+, qtbase
+, qtquickcontrols2
+, qtx11extras
+}:
+
+mkDerivation {
+  pname = "mauiman";
+
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+  ];
+
+  meta = with lib; {
+    homepage = "https://invent.kde.org/maui/mauiman";
+    description = "Maui Manager Library. Server and public library API";
+    maintainers = with maintainers; [ dotlambda ];
+  };
+}

pkgs/applications/maui/srcs.nix

@@ -3,116 +3,148 @@
 { fetchurl, mirror }:
 
 {
-  buho = {
+  bonsai = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/buho/2.1.2/buho-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/bonsai/1.0.0/bonsai-2.2.0.tar.xz";
-      sha256 = "0xc623w1zp0yh929b8h6mf9r4frnfabd30634ba43x4ac12jk7g8";
+      sha256 = "0gpqdj30brqv9nsiis93w9lad4xn7d301gxncj04pcpybmbksg4r";
-      name = "buho-2.1.2.tar.xz";
+      name = "bonsai-2.2.0.tar.xz";
+    };
+  };
+  booth = {
+    version = "1.0.0";
+    src = fetchurl {
+      url = "${mirror}/stable/maui/booth/1.0.0/booth-1.0.0.tar.xz";
+      sha256 = "0cdn3vkbf1mlq32akz86mdyjfrq661h4jrfmp1x62ih63930hix2";
+      name = "booth-1.0.0.tar.xz";
+    };
+  };
+  buho = {
+    version = "2.2.0";
+    src = fetchurl {
+      url = "${mirror}/stable/maui/buho/2.2.0/buho-2.2.0.tar.xz";
+      sha256 = "1jj9kygh5b88ksg22969zlsrbgps6z7z2n77g6ldqzvg8mmh2cwr";
+      name = "buho-2.2.0.tar.xz";
     };
   };
   clip = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/clip/2.1.2/clip-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/clip/2.2.0/clip-2.2.0.tar.xz";
-      sha256 = "168lz2qi4y56pwfwyzqnhwz4lgh2763w260l860527aw049crv4z";
+      sha256 = "0ggymdscd7c942vvii3mswkq84lkygdcbvpg3s2lhqaqxpivy96z";
-      name = "clip-2.1.2.tar.xz";
+      name = "clip-2.2.0.tar.xz";
     };
   };
   communicator = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/communicator/2.1.2/communicator-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/communicator/2.2.0/communicator-2.2.0.tar.xz";
-      sha256 = "0m7axdjpl7s9cz6fcaj4kwr9wdxybwdb76k9rz5yigyy35vigcfi";
+      sha256 = "0njyjzf8w2aamrj1yajjw7551dc72db9m0iv14mnb0gcd9pphni7";
-      name = "communicator-2.1.2.tar.xz";
+      name = "communicator-2.2.0.tar.xz";
     };
   };
   index-fm = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/index/2.1.2/index-fm-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/index/2.2.0/index-fm-2.2.0.tar.xz";
-      sha256 = "1yawnzx51h6yrlnivbwz9d7481k382pzg3jnczrajfjnv7ir29dn";
+      sha256 = "0v39sfdqb21669cx96nd78vprwaxsvg3cpp3lly43n09nv6gkw41";
-      name = "index-fm-2.1.2.tar.xz";
+      name = "index-fm-2.2.0.tar.xz";
     };
   };
   mauikit = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauikit/2.1.2/mauikit-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/mauikit/2.2.0/mauikit-2.2.0.tar.xz";
-      sha256 = "1n5p8107lwa4m5gbwlcqmmdlyw15vjaq0dfaz5zal733s6rq2gm7";
+      sha256 = "05bvgwl1yfbfrlxhl6ngvkdk34rg4y12fsrddm8f19b6dkvjzxq2";
-      name = "mauikit-2.1.2.tar.xz";
+      name = "mauikit-2.2.0.tar.xz";
     };
   };
   mauikit-accounts = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauikit-accounts/2.1.2/mauikit-accounts-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/mauikit-accounts/2.2.0/mauikit-accounts-2.2.0.tar.xz";
-      sha256 = "00nc54gi34r8z6cwa0h8490gd0w01a245rh2g4d9fvbkrybwg7sk";
+      sha256 = "1wc67mhhmxq0dq1g10338zm52kx274yry2ja34kagva3qkbhbb2i";
-      name = "mauikit-accounts-2.1.2.tar.xz";
+      name = "mauikit-accounts-2.2.0.tar.xz";
     };
   };
   mauikit-filebrowsing = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauikit-filebrowsing/2.1.2/mauikit-filebrowsing-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/mauikit-filebrowsing/2.2.0/mauikit-filebrowsing-2.2.0.tar.xz";
-      sha256 = "09pfjr449mkf27ywmwsvflzq0dgaiprw8b2lcms3m5ad7i6jvvyq";
+      sha256 = "1377mgkx1q66jzdlra87airqkmkl9cfj6n5xw1my1nihxcjq9bz1";
-      name = "mauikit-filebrowsing-2.1.2.tar.xz";
+      name = "mauikit-filebrowsing-2.2.0.tar.xz";
     };
   };
   mauikit-imagetools = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauikit-imagetools/2.1.2/mauikit-imagetools-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/mauikit-imagetools/2.2.0/mauikit-imagetools-2.2.0.tar.xz";
-      sha256 = "1830x8xwyjs7bj0qi63pl1dk5h2qi6f84mki1schviddddq5cv6j";
+      sha256 = "07clir651sfi4c9awv0jnq4pck2cfzfv0fdkwcapl6hh0zq9qvpr";
-      name = "mauikit-imagetools-2.1.2.tar.xz";
+      name = "mauikit-imagetools-2.2.0.tar.xz";
     };
   };
   mauikit-texteditor = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/mauikit-texteditor/2.1.2/mauikit-texteditor-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/mauikit-texteditor/2.2.0/mauikit-texteditor-2.2.0.tar.xz";
-      sha256 = "19z9qry56h2624kdx5xnfjzd3spv5shc87p2m6ix33x9mmrf92p1";
+      sha256 = "0x1cblydgqkhcy86x6yd8dipwhy9l5d7xlmk5igh5dllnzvcaicq";
-      name = "mauikit-texteditor-2.1.2.tar.xz";
+      name = "mauikit-texteditor-2.2.0.tar.xz";
+    };
+  };
+  mauiman = {
+    version = "1.0.0";
+    src = fetchurl {
+      url = "${mirror}/stable/maui/mauiman/1.0.0/mauiman-1.0.0.tar.xz";
+      sha256 = "1risxzgjg684c8zwmwl03ihfrxx44lbb4j43v8z3wnjkq7p44w82";
+      name = "mauiman-1.0.0.tar.xz";
     };
   };
   nota = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/nota/2.1.2/nota-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/nota/2.2.0/nota-2.2.0.tar.xz";
-      sha256 = "11z1mw6yhwin3wj19gj9495az4p40yjkwrn0nb6i8h9b0nh44pn7";
+      sha256 = "1nr8craafima1khkcxv47v1868yfwykjzaczlmmqmjha7bm1dlbd";
-      name = "nota-2.1.2.tar.xz";
+      name = "nota-2.2.0.tar.xz";
     };
   };
   pix = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/pix/2.1.2/pix-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/pix/2.2.0/pix-2.2.0.tar.xz";
-      sha256 = "0ycpazi267pl4l178i34lwzc0ssjklp0indz79r7mcfpr1vicz1s";
+      sha256 = "0nghp69ax73yf0wybd724a3lgbj7jiiznnmwp67n2ls74q8yrwwy";
-      name = "pix-2.1.2.tar.xz";
+      name = "pix-2.2.0.tar.xz";
     };
   };
   shelf = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/shelf/2.1.2/shelf-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/shelf/2.2.0/shelf-2.2.0.tar.xz";
-      sha256 = "0f3781l8wfbpj0irmri0zkp3ia3qlik4aaq3w6qk97xjv24d98xh";
+      sha256 = "028ll3pi4h3jxgilsf4s5ic2rq0z9q8kh9pram9dsjvgz24p7g0c";
-      name = "shelf-2.1.2.tar.xz";
+      name = "shelf-2.2.0.tar.xz";
     };
   };
   station = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/station/2.1.2/station-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/station/2.2.0/station-2.2.0.tar.xz";
-      sha256 = "0lrw7rf8i277nl9bwyx5sc05bswgll00k1jzad1i69rwdfiy9ghg";
+      sha256 = "0za3jh5clkx8xf436vzs83nrsw5fyna4wcy73ihlf3xbra0358v1";
-      name = "station-2.1.2.tar.xz";
+      name = "station-2.2.0.tar.xz";
+    };
+  };
+  strike = {
+    version = "2.2.0";
+    src = fetchurl {
+      url = "${mirror}/stable/maui/strike/1.0.0/strike-2.2.0.tar.xz";
+      sha256 = "159l1i0mi3q5avcg45aq5ixz8wjfryhip61h9gynxr1m77qdpfnc";
+      name = "strike-2.2.0.tar.xz";
     };
   };
   vvave = {
-    version = "2.1.2";
+    version = "2.2.0";
     src = fetchurl {
-      url = "${mirror}/stable/maui/vvave/2.1.2/vvave-2.1.2.tar.xz";
+      url = "${mirror}/stable/maui/vvave/2.2.0/vvave-2.2.0.tar.xz";
-      sha256 = "14b6b034899vyvvhzl2jqifqq715lb26dnw3d5wxzxhdplfd7pdf";
+      sha256 = "0qnwklc875j6g2rg610dmvcizg3m4q80fhjk4c3i1xzn8dybbg5s";
-      name = "vvave-2.1.2.tar.xz";
+      name = "vvave-2.2.0.tar.xz";
     };
   };
 }

pkgs/applications/networking/cluster/kfctl/default.nix

@@ -11,7 +11,7 @@ buildGoModule rec {
     sha256 = "sha256-FY7o4QULobLY1djfcc2l6awE/v2stN7cc2lffMkjoPc=";
   };
 
-  vendorSha256 = "sha256-+6sxXp0LKegZjEFv1CIQ6xYh+hXLn+o9LggRYamCzpI=";
+  vendorSha256 = null; #vendorSha256 = "";
 
   subPackages = [ "cmd/kfctl" ];
 
@@ -28,5 +28,6 @@ buildGoModule rec {
     homepage = "https://github.com/kubeflow/kfctl";
     license = licenses.asl20;
     maintainers = with maintainers; [ mvnetbiz ];
+    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
   };
 }

pkgs/applications/networking/cluster/kubemqctl/default.nix

@@ -14,12 +14,13 @@ buildGoModule rec {
 
   doCheck = false; # TODO tests are failing
 
-  vendorSha256 = "1agn6i7cnsb5igvvbjzlaa5fgssr5h7h25y440q44bk16jxk6s74";
+  vendorSha256 = null; #vendorSha256 = "";
 
   meta = {
     homepage = "https://github.com/kubemq-io/kubemqctl";
     description = "Kubemqctl is a command line interface (CLI) for Kubemq Kubernetes Message Broker.";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ brianmcgee ];
+    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
   };
 }

pkgs/applications/networking/cluster/kubetail/default.nix

@@ -1,21 +1,23 @@
-{ stdenv, fetchFromGitHub, lib, ... }:
+{ stdenv, fetchFromGitHub, lib, installShellFiles, makeWrapper, kubectl }:
 
 stdenv.mkDerivation rec {
   pname = "kubetail";
-  version = "1.6.13";
+  version = "1.6.16";
 
   src = fetchFromGitHub {
     owner = "johanhaleby";
     repo = "kubetail";
     rev = version;
-    sha256 = "sha256-EkOewNInzEEEgMOffYoRaKwhgYuBXgHaCkVgWg2mIDE=";
+    sha256 = "sha256-kkbhhAaiKP01LR7F5JVMgy6Ujji8JDc+Aaho1vft3XQ=";
   };
 
+  nativeBuildInputs = [ installShellFiles makeWrapper ];
+
   installPhase = ''
-    install -Dm755 kubetail                 "$out/bin/kubetail"
+    install -Dm755 kubetail "$out/bin/kubetail"
-    install -Dm755 completion/kubetail.bash "$out/share/bash-completion/completions/kubetail"
+    wrapProgram $out/bin/kubetail --prefix PATH : ${lib.makeBinPath [ kubectl ]}
-    install -Dm755 completion/kubetail.fish "$out/share/fish/vendor_completions.d/kubetail.fish"
+
-    install -Dm755 completion/kubetail.zsh  "$out/share/zsh/site-functions/_kubetail"
+    installShellCompletion completion/kubetail.{bash,fish,zsh}
   '';
 
   meta = with lib; {

pkgs/applications/networking/cluster/kuttl/default.nix

@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "kuttl";
-  version = "0.13.0";
+  version = "0.14.0";
   cli = "kubectl-kuttl";
 
   src = fetchFromGitHub {
     owner = "kudobuilder";
     repo = "kuttl";
     rev = "v${version}";
-    sha256 = "sha256-liuP8ALcPxbU+hZ54KDFj2r2yZpAbVago0IxIv52N3o=";
+    sha256 = "sha256-xQS7qCUTM3X4SpUZfxKHb08poJ2W52R7+TNe4BFL5sY=";
   };
 
   vendorSha256 = "sha256-u8Ezk78CrAhSeeMVXj09/Hiegtx+ZNKlr/Fg0O7+iOY=";

pkgs/applications/networking/dnscontrol/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "3.22.0";
+  version = "3.22.1";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-idcgBaUOOFsQmId9I8X5ixxGkfrX9NG328DliHNzk6s=";
+    sha256 = "sha256-Lv4ZX8QXRkicPH69kvUAPcgesGvhQkNiwZiNcFbReSU=";
   };
 
-  vendorSha256 = "sha256-h3UOFs7pxf9gwVAcjih8Kxr0b+68W1DanYoTpmeirg8=";
+  vendorSha256 = "sha256-gKsYy3izx8i7nOazBF4w1SPUJT9D2hbjOr6LqonVqno=";
 
   ldflags = [ "-s" "-w" ];
 

pkgs/applications/networking/hyprspace/default.nix

@@ -21,5 +21,6 @@ buildGoModule rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ yusdacra ];
     platforms = platforms.linux ++ platforms.darwin;
+    broken = true; # build fails with go > 1.17
   };
 }

pkgs/applications/networking/ncgopher/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ncgopher";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "jansc";
     repo = "ncgopher";
     rev = "v${version}";
-    sha256 = "sha256-GLt+ByZzQ9v+PPyebTa8LFqySixXw85RjGZ2e3yLRss=";
+    sha256 = "sha256-KrvTwcIeINIBkia6PTnKXp4jFd6GEMBh/xbn0Ot/wmE=";
   };
 
-  cargoSha256 = "sha256-VI+BTxgocv434wTr7nBeJRdt12wE53fEeqczE3o3768=";
+  cargoSha256 = "sha256-Zft/ip+/uJbUIqCDDEa4hchmZZiYWGdaVnzWC74FgU8=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [

pkgs/applications/networking/soulseek/nicotine-plus/default.nix

@@ -11,16 +11,16 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nicotine-plus";
-  version = "3.2.4";
+  version = "3.2.6";
 
   src = fetchFromGitHub {
     owner = "nicotine-plus";
     repo = "nicotine-plus";
     rev = "refs/tags/${version}";
-    sha256 = "sha256-swFNFw2a5PXwBkh0FBrCy5u3m5gErq29ZmWhMP7MpmQ=";
+    sha256 = "sha256-ELpM5hnyHsqTqB0R1JPcbxkw9XR19CnasIYXJCbKBho=";
   };
 
-  nativeBuildInputs = [ gettext wrapGAppsHook ];
+  nativeBuildInputs = [ gettext wrapGAppsHook gobject-introspection ];
 
   propagatedBuildInputs = [
     gdk-pixbuf

pkgs/applications/office/zim/default.nix

@@ -7,11 +7,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "zim";
-  version = "0.74.3";
+  version = "0.75.1";
 
   src = fetchurl {
     url = "https://zim-wiki.org/downloads/zim-${version}.tar.gz";
-    sha256 = "sha256-3ehPIkhsf1JnC9Qx3kQ6ilvRaBB7auBm2C1HOuNGzRU=";
+    sha256 = "sha256-iOF11/fhQYlvnpWJidJS1yJVavF7xLxvBl59VCh9A4U=";
   };
 
   buildInputs = [ gtk3 gobject-introspection gnome.adwaita-icon-theme ];
@@ -23,6 +23,7 @@ python3Packages.buildPythonApplication rec {
 
   preFixup = ''
     makeWrapperArgs+=(--prefix XDG_DATA_DIRS : $out/share)
+    makeWrapperArgs+=(--prefix XDG_DATA_DIRS : ${gnome.adwaita-icon-theme}/share)
     makeWrapperArgs+=(--argv0 $out/bin/.zim-wrapped)
     makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
   '';

pkgs/applications/plasma-mobile/angelfish.nix

@@ -52,10 +52,6 @@ mkDerivation rec {
     rust.rustc
   ]);
 
-  cmakeFlags = [
-    "-DRust_CARGO=${rustPlatform.rust.cargo}/bin/cargo"
-  ];
-
   buildInputs = [
     kconfig
     kcoreaddons

pkgs/applications/science/misc/gplates/default.nix

@@ -14,13 +14,15 @@
 , libGLU
 , mpfr
 , proj
-, python3
+# build with Python 3.10 fails, because boost <= 1.78 can't find
+# pythons with double digits in minor versions, like X.YZ
+, python39
 , qtxmlpatterns
 , qwt
 }:
 
 let
-  python = python3.withPackages (ps: with ps; [
+  python = python39.withPackages (ps: with ps; [
     numpy
   ]);
   boost' = boost.override {

pkgs/applications/video/go-chromecast/default.nix

@@ -20,5 +20,6 @@ buildGoModule rec {
     description = "CLI for Google Chromecast, Home devices and Cast Groups";
     license = licenses.asl20;
     maintainers = with maintainers; [ marsam ];
+    broken = true; # build fails with go > 1.17
   };
 }

pkgs/applications/virtualization/ecs-agent/default.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname   = "amazon-ecs-agent";
-  version = "1.65.1";
+  version = "1.66.2";
 
   goPackagePath = "github.com/aws/${pname}";
   subPackages   = [ "agent" ];
@@ -11,12 +11,15 @@ buildGoPackage rec {
     rev    = "v${version}";
     owner  = "aws";
     repo   = pname;
-    sha256 = "sha256-IsbY2ZQQq8eOhdT/ws1Yu7YlnQOyjhDaIr1knOHB4Yc=";
+    sha256 = "sha256-mZzDvD+40YiC8cBpLlYd7K1p5UBYpso9OMCDijopuik=";
   };
 
+  ldflags = [ "-s" "-w" ];
+
   meta = with lib; {
     description = "The agent that runs on AWS EC2 container instances and starts containers on behalf of Amazon ECS";
     homepage    = "https://github.com/aws/amazon-ecs-agent";
+    changelog   = "https://github.com/aws/amazon-ecs-agent/raw/v${version}/CHANGELOG.md";
     license     = licenses.asl20;
     platforms   = platforms.unix;
     maintainers = with maintainers; [ copumpkin ];

pkgs/applications/virtualization/nixpacks/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uxy0/Ngzzh96YZDR9whLVYNnQOlj3wkCEuuJTQjT6GE=";
+    sha256 = "sha256-az4DllTkGP80Jf0NeaKrBI0zz56chPizJGu97cqXrJ4=";
   };
 
-  cargoSha256 = "sha256-99J4ucjE0yTPQSdM6PDTWEjBltJdIU6yEDqhgSfOaJU=";
+  cargoSha256 = "sha256-ghbJBhoU41yJ3qZBaKzEybNuCLdSqoL30+1h9d56b4A=";
 
   # skip test due FHS dependency
   doCheck = false;

pkgs/data/icons/super-tiny-icons/default.nix

@@ -0,0 +1,34 @@
+{ pkgs, lib, stdenvNoCC, fetchFromGitHub, }:
+
+stdenvNoCC.mkDerivation {
+  pname = "super-tiny-icons";
+  version = "unstable-2022-11-07";
+
+  src = fetchFromGitHub {
+    owner = "edent";
+    repo = "SuperTinyIcons";
+    rev = "b4d5a3be04c99ec0a309ac9e0d0b21207c237c7d";
+    sha256 = "670ndAuBrZBr7YOTQm2zHJfpiBC56aPk+ZKMneREEoI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/icons/SuperTinyIcons
+    find $src/images -type d -exec cp -r {} $out/share/icons/SuperTinyIcons/ \;
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Miniscule SVG versions of common logos";
+    longDescription = ''
+      Super Tiny Web Icons are minuscule SVG versions of your favourite logos.
+      The average size is under 568 bytes!
+    '';
+    homepage = "https://github.com/edent/SuperTinyIcons";
+    license = licenses.mit;
+    maintainers = [ maintainers.h7x4 ];
+    platforms = platforms.all;
+  };
+}

pkgs/data/misc/cldr-annotations/default.nix

@@ -1,18 +1,22 @@
 { lib, fetchzip }:
 
-let
+fetchzip rec {
-  version = "41.0";
+  pname = "cldr-annotations";
-in fetchzip rec {
+  version = "42.0";
-  name = "cldr-annotations-${version}";
 
   url = "https://unicode.org/Public/cldr/${lib.versions.major version}/cldr-common-${version}.zip";
 
+  stripRoot = false;
   postFetch = ''
-    mkdir -p $out/share/unicode/cldr
+    mkdir -p $out/share/unicode/cldr/common
-    unzip -d $out/share/unicode/cldr $downloadedFile 'common/annotations/*' 'common/annotationsDerived/*'
+    mv $out/common/annotations{,Derived} -t $out/share/unicode/cldr/common
+
+    shopt -s extglob dotglob
+    rm -rf $out/!(share)
+    shopt -u extglob dotglob
   '';
 
-  sha256 = "sha256-3dHVZGx3FmR97fzhlTSx/xp6YTAV+sMExl6gpLzl1MY=";
+  hash = "sha256-9OOd69nBaDSt+ilL3PTGpcQgC60PnHqd8/CYa2LgeI0=";
 
   meta = with lib; {
     description = "Names and keywords for Unicode characters from the Common Locale Data Repository";

pkgs/desktops/gnome/apps/gedit/default.nix

@@ -7,12 +7,15 @@
 , gtk3
 , gtk-mac-integration
 , glib
-, adwaita-icon-theme
+, amtk
+, tepl
 , libpeas
 , libxml2
 , gtksourceview4
 , gsettings-desktop-schemas
 , wrapGAppsHook
+, gtk-doc
+, docbook-xsl-nons
 , ninja
 , libsoup
 , gnome
@@ -25,11 +28,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gedit";
-  version = "43.alpha";
+  version = "43.1";
+
+  outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gedit/${lib.versions.major version}/${pname}-${version}.tar.xz";
+    url = "mirror://gnome/sources/gedit/${lib.versions.major version}/gedit-${version}.tar.xz";
-    sha256 = "K3iOqhbYeeOVdGmS/OdmC5WtIpQ5OgHs0t5CzdWW95o=";
+    sha256 = "mDg7Sv0/0eoYzcdP7G4SjneFgvOyP1NgGRQT//jw5qY=";
   };
 
   patches = [
@@ -49,10 +54,13 @@ stdenv.mkDerivation rec {
     python3
     vala
     wrapGAppsHook
+    gtk-doc
+    docbook-xsl-nons
   ];
 
   buildInputs = [
-    adwaita-icon-theme
+    amtk
+    tepl
     glib
     gsettings-desktop-schemas
     gspell

pkgs/desktops/gnome/misc/gnome-packagekit/default.nix

@@ -1,20 +1,43 @@
-{ lib, stdenv, fetchurl, pkg-config, meson, ninja, gettext, gnome, packagekit, polkit
+{ lib
-, gtk3, systemd, wrapGAppsHook, desktop-file-utils }:
+, stdenv
+, fetchurl
+, pkg-config
+, meson
+, ninja
+, gettext
+, gnome
+, packagekit
+, polkit
+, gtk3
+, systemd
+, wrapGAppsHook
+, desktop-file-utils
+}:
 
 stdenv.mkDerivation rec {
   pname = "gnome-packagekit";
-  version = "3.32.0";
+  version = "43.0";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/gnome-packagekit/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    url = "mirror://gnome/sources/gnome-packagekit/${lib.versions.major version}/gnome-packagekit-${version}.tar.xz";
-    sha256 = "08rhsisdvx7pnx3rrg5v7c09jbw4grglkdj979gwl4a31j24zjsd";
+    sha256 = "zaRVplKpI7LqL3Axa9D92Clve2Lu8/r9nOUMjmbF8ZU=";
   };
 
   nativeBuildInputs = [
-    pkg-config meson ninja gettext wrapGAppsHook desktop-file-utils
+    pkg-config
+    meson
+    ninja
+    gettext
+    wrapGAppsHook
+    desktop-file-utils
   ];
 
-  buildInputs = [ gtk3 packagekit systemd polkit ];
+  buildInputs = [
+    gtk3
+    packagekit
+    systemd
+    polkit
+  ];
 
   postPatch = ''
     patchShebangs meson_post_install.sh

pkgs/development/compilers/go/1.17.nix

@@ -1,282 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, tzdata
-, iana-etc
-, perl
-, which
-, pkg-config
-, procps
-, pcre
-, cacert
-, Security
-, Foundation
-, xcbuild
-, mailcap
-, runtimeShell
-, buildPackages
-, pkgsBuildTarget
-, threadsCross
-}:
-
-let
-  goBootstrap = buildPackages.callPackage ./bootstrap116.nix { };
-
-  goarch = platform: {
-    "aarch64" = "arm64";
-    "arm" = "arm";
-    "armv5tel" = "arm";
-    "armv6l" = "arm";
-    "armv7l" = "arm";
-    "i686" = "386";
-    "mips" = "mips";
-    "mips64el" = "mips64le";
-    "mipsel" = "mipsle";
-    "powerpc64le" = "ppc64le";
-    "riscv64" = "riscv64";
-    "s390x" = "s390x";
-    "x86_64" = "amd64";
-  }.${platform.parsed.cpu.name} or (throw "Unsupported system: ${platform.parsed.cpu.name}");
-
-  # We need a target compiler which is still runnable at build time,
-  # to handle the cross-building case where build != host == target
-  targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
-
-  isCross = stdenv.buildPlatform != stdenv.targetPlatform;
-in
-stdenv.mkDerivation rec {
-  pname = "go";
-  version = "1.17.13";
-
-  src = fetchurl {
-    url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "sha256-oaSLI6+yBvlee7qpuJjZZfkIJvbx0fwMHXhK2gzTAP0=";
-  };
-
-  strictDeps = true;
-  # perl is used for testing go vet
-  nativeBuildInputs = [ perl which pkg-config procps ];
-  buildInputs = [ cacert pcre ]
-    ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
-    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
-
-  propagatedBuildInputs = lib.optionals stdenv.isDarwin [ xcbuild ];
-
-  depsTargetTargetPropagated = lib.optionals stdenv.isDarwin [ Security Foundation ];
-
-  depsBuildTarget = lib.optional isCross targetCC;
-
-  depsTargetTarget = lib.optional stdenv.targetPlatform.isWindows threadsCross;
-
-  hardeningDisable = [ "all" ];
-
-  prePatch = ''
-    patchShebangs ./ # replace /bin/bash
-
-    # This source produces shell script at run time,
-    # and thus it is not corrected by patchShebangs.
-    substituteInPlace misc/cgo/testcarchive/carchive_test.go \
-      --replace '#!/usr/bin/env bash' '#!${runtimeShell}'
-
-    # Patch the mimetype database location which is missing on NixOS.
-    # but also allow static binaries built with NixOS to run outside nix
-    sed -i 's,\"/etc/mime.types,"${mailcap}/etc/mime.types\"\,\n\t&,' src/mime/type_unix.go
-
-    # Disabling the 'os/http/net' tests (they want files not available in
-    # chroot builds)
-    rm src/net/{listen,parse}_test.go
-    rm src/syscall/exec_linux_test.go
-
-    # !!! substituteInPlace does not seems to be effective.
-    # The os test wants to read files in an existing path. Just don't let it be /usr/bin.
-    sed -i 's,/usr/bin,'"`pwd`", src/os/os_test.go
-    sed -i 's,/bin/pwd,'"`type -P pwd`", src/os/os_test.go
-    # Fails on aarch64
-    sed -i '/TestFallocate/aif true \{ return\; \}' src/cmd/link/internal/ld/fallocate_test.go
-    # Skip this test since ssl patches mess it up.
-    sed -i '/TestLoadSystemCertsLoadColonSeparatedDirs/aif true \{ return\; \}' src/crypto/x509/root_unix_test.go
-    # Disable another PIE test which breaks.
-    sed -i '/TestTrivialPIE/aif true \{ return\; \}' misc/cgo/testshared/shared_test.go
-    # Disable the BuildModePie test
-    sed -i '/TestBuildmodePIE/aif true \{ return\; \}' src/cmd/go/go_test.go
-    # Disable the unix socket test
-    sed -i '/TestShutdownUnix/aif true \{ return\; \}' src/net/net_test.go
-    # Disable the hostname test
-    sed -i '/TestHostname/aif true \{ return\; \}' src/os/os_test.go
-    # ParseInLocation fails the test
-    sed -i '/TestParseInSydney/aif true \{ return\; \}' src/time/format_test.go
-    # Remove the api check as it never worked
-    sed -i '/src\/cmd\/api\/run.go/ireturn nil' src/cmd/dist/test.go
-    # Remove the coverage test as we have removed this utility
-    sed -i '/TestCoverageWithCgo/aif true \{ return\; \}' src/cmd/go/go_test.go
-    # Remove the timezone naming test
-    sed -i '/TestLoadFixed/aif true \{ return\; \}' src/time/time_test.go
-    # Remove disable setgid test
-    sed -i '/TestRespectSetgidDir/aif true \{ return\; \}' src/cmd/go/internal/work/build_test.go
-    # Remove cert tests that conflict with NixOS's cert resolution
-    sed -i '/TestEnvVars/aif true \{ return\; \}' src/crypto/x509/root_unix_test.go
-    # TestWritevError hangs sometimes
-    sed -i '/TestWritevError/aif true \{ return\; \}' src/net/writev_test.go
-    # TestVariousDeadlines fails sometimes
-    sed -i '/TestVariousDeadlines/aif true \{ return\; \}' src/net/timeout_test.go
-
-    sed -i 's,/etc/protocols,${iana-etc}/etc/protocols,' src/net/lookup_unix.go
-    sed -i 's,/etc/services,${iana-etc}/etc/services,' src/net/port_unix.go
-
-    # Disable cgo lookup tests not works, they depend on resolver
-    rm src/net/cgo_unix_test.go
-
-    # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
-    # that run outside a nix server
-    sed -i 's,\"/usr/share/zoneinfo/,"${tzdata}/share/zoneinfo/\"\,\n\t&,' src/time/zoneinfo_unix.go
-
-  '' + lib.optionalString stdenv.isAarch32 ''
-    echo '#!${runtimeShell}' > misc/cgo/testplugin/test.bash
-  '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace src/race.bash --replace \
-      "sysctl machdep.cpu.extfeatures | grep -qv EM64T" true
-    sed -i 's,strings.Contains(.*sysctl.*,true {,' src/cmd/dist/util.go
-    sed -i 's,"/etc","'"$TMPDIR"'",' src/os/os_test.go
-    sed -i 's,/_go_os_test,'"$TMPDIR"'/_go_os_test,' src/os/path_test.go
-
-    sed -i '/TestChdirAndGetwd/aif true \{ return\; \}' src/os/os_test.go
-    sed -i '/TestCredentialNoSetGroups/aif true \{ return\; \}' src/os/exec/exec_posix_test.go
-    sed -i '/TestRead0/aif true \{ return\; \}' src/os/os_test.go
-    sed -i '/TestSystemRoots/aif true \{ return\; \}' src/crypto/x509/root_darwin_test.go
-
-    sed -i '/TestGoInstallRebuildsStalePackagesInOtherGOPATH/aif true \{ return\; \}' src/cmd/go/go_test.go
-    sed -i '/TestBuildDashIInstallsDependencies/aif true \{ return\; \}' src/cmd/go/go_test.go
-
-    sed -i '/TestDisasmExtld/aif true \{ return\; \}' src/cmd/objdump/objdump_test.go
-
-    sed -i 's/unrecognized/unknown/' src/cmd/link/internal/ld/lib.go
-
-    # TestCurrent fails because Current is not implemented on Darwin
-    sed -i 's/TestCurrent/testCurrent/g' src/os/user/user_test.go
-    sed -i 's/TestLookup/testLookup/g' src/os/user/user_test.go
-
-    touch $TMPDIR/group $TMPDIR/hosts $TMPDIR/passwd
-  '';
-
-  patches = [
-    ./remove-tools-1.11.patch
-    ./ssl-cert-file-1.16.patch
-    ./remove-test-pie-1.15.patch
-    ./creds-test.patch
-    ./go-1.9-skip-flaky-19608.patch
-    ./skip-chown-tests-1.16.patch
-    ./skip-external-network-tests-1.16.patch
-    ./skip-nohup-tests.patch
-    ./skip-cgo-tests-1.15.patch
-    ./go_no_vendor_checks-1.16.patch
-  ] ++ [
-    # breaks under load: https://github.com/golang/go/issues/25628
-    (if stdenv.isAarch32
-    then ./skip-test-extra-files-on-aarch32-1.14.patch
-    else ./skip-test-extra-files-on-386-1.14.patch)
-  ];
-
-  postPatch = ''
-    find . -name '*.orig' -exec rm {} ';'
-  '';
-
-  GOOS = stdenv.targetPlatform.parsed.kernel.name;
-  GOARCH = goarch stdenv.targetPlatform;
-  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
-  # Go will nevertheless build a for host system that we will copy over in
-  # the install phase.
-  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
-  GOHOSTARCH = goarch stdenv.buildPlatform;
-
-  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
-  # to be different from CC/CXX
-  CC_FOR_TARGET =
-    if isCross then
-      "${targetCC}/bin/${targetCC.targetPrefix}cc"
-    else
-      null;
-  CXX_FOR_TARGET =
-    if isCross then
-      "${targetCC}/bin/${targetCC.targetPrefix}c++"
-    else
-      null;
-
-  GOARM = toString (lib.intersectLists [ (stdenv.hostPlatform.parsed.cpu.version or "") ] [ "5" "6" "7" ]);
-  GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
-  CGO_ENABLED = 1;
-  # Hopefully avoids test timeouts on Hydra
-  GO_TEST_TIMEOUT_SCALE = 3;
-
-  # Indicate that we are running on build infrastructure
-  # Some tests assume things like home directories and users exists
-  GO_BUILDER_NAME = "nix";
-
-  GOROOT_BOOTSTRAP = "${goBootstrap}/share/go";
-
-  postConfigure = ''
-    export GOCACHE=$TMPDIR/go-cache
-    # this is compiled into the binary
-    export GOROOT_FINAL=$out/share/go
-
-    export PATH=$(pwd)/bin:$PATH
-
-    ${lib.optionalString isCross ''
-    # Independent from host/target, CC should produce code for the building system.
-    # We only set it when cross-compiling.
-    export CC=${buildPackages.stdenv.cc}/bin/cc
-    ''}
-    ulimit -a
-  '';
-
-  postBuild = ''
-    (cd src && ./make.bash)
-  '';
-
-  doCheck = stdenv.hostPlatform == stdenv.targetPlatform && !stdenv.isDarwin;
-
-  checkPhase = ''
-    runHook preCheck
-    (cd src && HOME=$TMPDIR GOCACHE=$TMPDIR/go-cache ./run.bash --no-rebuild)
-    runHook postCheck
-  '';
-
-  preInstall = ''
-    rm -r pkg/obj
-    # Contains the wrong perl shebang when cross compiling,
-    # since it is not used for anything we can deleted as well.
-    rm src/regexp/syntax/make_perl_groups.pl
-  '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then ''
-    mv bin/*_*/* bin
-    rmdir bin/*_*
-    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
-    ''}
-  '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then ''
-    rm -rf bin/*_*
-    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
-      rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
-    ''}
-  '' else "");
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $GOROOT_FINAL
-    cp -a bin pkg src lib misc api doc $GOROOT_FINAL
-    ln -s $GOROOT_FINAL/bin $out/bin
-    runHook postInstall
-  '';
-
-  disallowedReferences = [ goBootstrap ];
-
-  passthru = {
-    inherit goBootstrap;
-  };
-
-  meta = with lib; {
-    description = "The Go Programming language";
-    homepage = "https://go.dev/";
-    license = licenses.bsd3;
-    maintainers = teams.golang.members;
-    platforms = platforms.darwin ++ platforms.linux;
-  };
-}

pkgs/development/compilers/go/creds-test.patch

@@ -1,13 +0,0 @@
---- source.org/src/syscall/creds_test.go	1970-01-01 01:00:01.000000000 +0100
-+++ source/src/syscall/creds_test.go	2018-02-22 10:43:47.223615358 +0000
-@@ -76,8 +76,8 @@
- 			if sys, ok := err.(*os.SyscallError); ok {
- 				err = sys.Err
- 			}
--			if err != syscall.EPERM {
--				t.Fatalf("WriteMsgUnix failed with %v, want EPERM", err)
-+			if err != syscall.EPERM && err != syscall.EINVAL {
-+				t.Fatalf("WriteMsgUnix failed with %v, want EPERM or EINVAL", err)
- 			}
- 		}
- 

pkgs/development/compilers/go/go-1.9-skip-flaky-19608.patch

@@ -1,12 +0,0 @@
-diff --git a/src/net/http/serve_test.go b/src/net/http/serve_test.go
-index 7137599..43cca2e 100644
---- a/src/net/http/serve_test.go
-+++ b/src/net/http/serve_test.go
-@@ -5361,6 +5361,7 @@ func testServerKeepAlivesEnabled(t *testing.T, h2 bool) {
- // the server's doing its 1-byte background read between requests,
- // waiting for the connection to maybe close.
- func TestServerCancelsReadTimeoutWhenIdle(t *testing.T) {
-+	testenv.SkipFlaky(t, 19608)
- 	setParallel(t)
- 	defer afterTest(t)
- 	const timeout = 250 * time.Millisecond

pkgs/development/compilers/go/remove-test-pie-1.15.patch

@@ -1,34 +0,0 @@
-diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
-index e1cd4965c3..66bf980fc6 100644
---- a/src/cmd/dist/test.go
-+++ b/src/cmd/dist/test.go
-@@ -584,29 +584,6 @@ func (t *tester) registerTests() {
- 		})
- 	}
- 
--	// Test internal linking of PIE binaries where it is supported.
--	if t.internalLinkPIE() {
--		t.tests = append(t.tests, distTest{
--			name:    "pie_internal",
--			heading: "internal linking of -buildmode=pie",
--			fn: func(dt *distTest) error {
--				t.addCmd(dt, "src", t.goTest(), "reflect", "-buildmode=pie", "-ldflags=-linkmode=internal", t.timeout(60))
--				return nil
--			},
--		})
--		// Also test a cgo package.
--		if t.cgoEnabled && t.internalLink() {
--			t.tests = append(t.tests, distTest{
--				name:    "pie_internal_cgo",
--				heading: "internal linking of -buildmode=pie",
--				fn: func(dt *distTest) error {
--					t.addCmd(dt, "src", t.goTest(), "os/user", "-buildmode=pie", "-ldflags=-linkmode=internal", t.timeout(60))
--					return nil
--				},
--			})
--		}
--	}
--
- 	// sync tests
- 	if goos != "js" { // js doesn't support -cpu=10
- 		t.tests = append(t.tests, distTest{

pkgs/development/compilers/go/skip-cgo-tests-1.15.patch

@@ -1,13 +0,0 @@
-diff --git a/src/cmd/dist/test.go b/src/cmd/dist/test.go
-index e1cd4965c3..0980d044df 100644
---- a/src/cmd/dist/test.go
-+++ b/src/cmd/dist/test.go
-@@ -1136,7 +1136,7 @@ func (t *tester) cgoTest(dt *distTest) error {
- 					t.addCmd(dt, "misc/cgo/test", t.goTest(), "-buildmode=pie", "-ldflags=-linkmode=internal")
- 				}
- 				t.addCmd(dt, "misc/cgo/testtls", t.goTest(), "-buildmode=pie")
--				t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-buildmode=pie")
-+				//t.addCmd(dt, "misc/cgo/nocgo", t.goTest(), "-buildmode=pie")
- 			}
- 		}
- 	}

pkgs/development/compilers/go/skip-chown-tests-1.16.patch

@@ -1,42 +0,0 @@
-From 9a6718a6355d89b73011fbd1eb1bba8dcfa021e6 Mon Sep 17 00:00:00 2001
-From: regnat <rg@regnat.ovh>
-Date: Wed, 3 Nov 2021 10:17:28 +0100
-Subject: [PATCH] Disable the chown tests
-
-See https://github.com/golang/go/issues/42525 and
-https://github.com/NixOS/nix/issues/3245
----
- os/os_unix_test.go | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/os/os_unix_test.go b/os/os_unix_test.go
-index 51693fd..0936542 100644
---- a/src/os/os_unix_test.go
-+++ b/src/os/os_unix_test.go
-@@ -40,6 +40,7 @@ func checkUidGid(t *testing.T, path string, uid, gid int) {
- }
- 
- func TestChown(t *testing.T) {
-+        t.Skipf("https://github.com/golang/go/issues/42525")
- 	// Use TempDir() to make sure we're on a local file system,
- 	// so that the group ids returned by Getgroups will be allowed
- 	// on the file. On NFS, the Getgroups groups are
-@@ -83,6 +84,7 @@ func TestChown(t *testing.T) {
- }
- 
- func TestFileChown(t *testing.T) {
-+        t.Skipf("https://github.com/golang/go/issues/42525")
- 	// Use TempDir() to make sure we're on a local file system,
- 	// so that the group ids returned by Getgroups will be allowed
- 	// on the file. On NFS, the Getgroups groups are
-@@ -126,6 +128,7 @@ func TestFileChown(t *testing.T) {
- }
- 
- func TestLchown(t *testing.T) {
-+        t.Skipf("https://github.com/golang/go/issues/42525")
- 	// Use TempDir() to make sure we're on a local file system,
- 	// so that the group ids returned by Getgroups will be allowed
- 	// on the file. On NFS, the Getgroups groups are
--- 
-2.31.1
-

pkgs/development/compilers/go/skip-external-network-tests-1.16.patch

@@ -1,33 +0,0 @@
-diff --git a/src/internal/testenv/testenv.go b/src/internal/testenv/testenv.go
-index c902b1404f..66016088a2 100644
---- a/src/internal/testenv/testenv.go
-+++ b/src/internal/testenv/testenv.go
-@@ -163,13 +163,15 @@ func MustHaveExecPath(t testing.TB, path string) {
- // HasExternalNetwork reports whether the current system can use
- // external (non-localhost) networks.
- func HasExternalNetwork() bool {
--	return !testing.Short() && runtime.GOOS != "js"
-+	// Nix sandbox does not external network in sandbox
-+	return false
- }
- 
- // MustHaveExternalNetwork checks that the current system can use
- // external (non-localhost) networks.
- // If not, MustHaveExternalNetwork calls t.Skip with an explanation.
- func MustHaveExternalNetwork(t testing.TB) {
-+	t.Skipf("Nix sandbox does not have networking")
- 	if runtime.GOOS == "js" {
- 		t.Skipf("skipping test: no external network on %s", runtime.GOOS)
- 	}
-diff --git a/src/net/dial_test.go b/src/net/dial_test.go
-index 57cf5554ad..d00be53b2c 100644
---- a/src/net/dial_test.go
-+++ b/src/net/dial_test.go
-@@ -990,6 +990,7 @@ func TestDialerControl(t *testing.T) {
- // except that it won't skip testing on non-mobile builders.
- func mustHaveExternalNetwork(t *testing.T) {
- 	t.Helper()
-+	t.Skipf("Nix sandbox does not have networking")
- 	mobile := runtime.GOOS == "android" || runtime.GOOS == "ios"
- 	if testenv.Builder() == "" || mobile {
- 		testenv.MustHaveExternalNetwork(t)

pkgs/development/compilers/go/skip-nohup-tests.patch

@@ -1,22 +0,0 @@
-diff --git a/src/os/signal/signal_test.go b/src/os/signal/signal_test.go
-index 3d79c7a..6e0f7b4 100644
---- a/src/os/signal/signal_test.go
-+++ b/src/os/signal/signal_test.go
-@@ -217,6 +217,8 @@ var checkSighupIgnored = flag.Bool("check_sighup_ignored", false, "if true, Test
- 
- // Test that Ignored(SIGHUP) correctly detects whether it is being run under nohup.
- func TestDetectNohup(t *testing.T) {
-+	t.Skip("Fails in nix build environment")
-+
- 	if *checkSighupIgnored {
- 		if !Ignored(syscall.SIGHUP) {
- 			t.Fatal("SIGHUP is not ignored.")
-@@ -306,6 +308,8 @@ func TestStop(t *testing.T) {
- // Test that when run under nohup, an uncaught SIGHUP does not kill the program,
- // but a
- func TestNohup(t *testing.T) {
-+	t.Skip("Fails in nix build environment")
-+
- 	// Ugly: ask for SIGHUP so that child will not have no-hup set
- 	// even if test is running under nohup environment.
- 	// We have no intention of reading from c.

pkgs/development/compilers/go/skip-test-extra-files-on-386-1.14.patch

@@ -1,15 +0,0 @@
-diff --git a/src/os/exec/exec_test.go b/src/os/exec/exec_test.go
-index dce66c5c2e..2532224376 100644
---- a/src/os/exec/exec_test.go
-+++ b/src/os/exec/exec_test.go
-@@ -627,6 +627,10 @@ func TestExtraFiles(t *testing.T) {
- 		t.Skipf("skipping test on %q", runtime.GOOS)
- 	}
- 
-+	if runtime.GOOS == "linux" && runtime.GOARCH  == "386" {
-+		t.Skipf("skipping test on %q %q", runtime.GOARCH, runtime.GOOS)
-+	}
-+
- 	// Force network usage, to verify the epoll (or whatever) fd
- 	// doesn't leak to the child,
- 	ln, err := net.Listen("tcp", "127.0.0.1:0")

pkgs/development/compilers/go/skip-test-extra-files-on-aarch32-1.14.patch

@@ -1,15 +0,0 @@
-diff --git a/src/os/exec/exec_test.go b/src/os/exec/exec_test.go
-index dce66c5c2e..2532224376 100644
---- a/src/os/exec/exec_test.go
-+++ b/src/os/exec/exec_test.go
-@@ -627,6 +627,10 @@ func TestExtraFiles(t *testing.T) {
- 		t.Skipf("skipping test on %q", runtime.GOOS)
- 	}
- 
-+	if runtime.GOOS == "linux" && runtime.GOARCH  == "arm" {
-+		t.Skipf("skipping test on %q %q", runtime.GOARCH, runtime.GOOS)
-+	}
-+
- 	// Force network usage, to verify the epoll (or whatever) fd
- 	// doesn't leak to the child,
- 	ln, err := net.Listen("tcp", "127.0.0.1:0")

pkgs/development/compilers/go/ssl-cert-file-1.16.patch

@@ -1,34 +0,0 @@
-diff --git a/src/crypto/x509/root.go b/src/crypto/x509/root.go
-index ac92915128..fb1d70c735 100644
---- a/src/crypto/x509/root.go
-+++ b/src/crypto/x509/root.go
-@@ -6,7 +6,11 @@ package x509
- 
- //go:generate go run root_ios_gen.go -version 55161.140.3
- 
--import "sync"
-+import (
-+	"io/ioutil"
-+	"os"
-+	"sync"
-+)
- 
- var (
- 	once           sync.Once
-@@ -20,6 +24,16 @@ func systemRootsPool() *CertPool {
- }
- 
- func initSystemRoots() {
-+	if file := os.Getenv("NIX_SSL_CERT_FILE"); file != "" {
-+		data, err := ioutil.ReadFile(file)
-+		if err == nil {
-+			roots := NewCertPool()
-+			roots.AppendCertsFromPEM(data)
-+			systemRoots = roots
-+			return
-+		}
-+	}
-+
- 	systemRoots, systemRootsErr = loadSystemRoots()
- 	if systemRootsErr != nil {
- 		systemRoots = nil

pkgs/development/libraries/clutter-gst/default.nix

@@ -31,6 +31,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.lgpl2Plus;
 
     maintainers = with lib.maintainers; [ ];
-    platforms = lib.platforms.gnu ++ lib.platforms.linux;  # arbitrary choice
+    platforms = lib.platforms.unix;
   };
 }

pkgs/development/libraries/clutter-gtk/default.nix

@@ -1,5 +1,14 @@
-{ fetchurl, lib, stdenv, pkg-config, meson, ninja
+{ fetchurl
-, gobject-introspection, clutter, gtk3, gnome }:
+, lib
+, stdenv
+, pkg-config
+, meson
+, ninja
+, gobject-introspection
+, clutter
+, gtk3
+, gnome
+}:
 
 let
   pname = "clutter-gtk";
@@ -19,6 +28,12 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ clutter gtk3 ];
   nativeBuildInputs = [ meson ninja pkg-config gobject-introspection ];
 
+  postPatch = ''
+    # ld: malformed 32-bit x.y.z version number: =1
+    substituteInPlace meson.build \
+      --replace "host_system == 'darwin'" "false"
+  '';
+
   postBuild = "rm -rf $out/share/gtk-doc";
 
   passthru = {
@@ -33,6 +48,6 @@ stdenv.mkDerivation rec {
     homepage = "http://www.clutter-project.org/";
     license = lib.licenses.lgpl2Plus;
     maintainers = with lib.maintainers; [ ];
-    platforms = lib.platforms.gnu ++ lib.platforms.linux;  # arbitrary choice
+    platforms = lib.platforms.unix;
   };
 }

pkgs/development/libraries/clutter/default.nix

@@ -1,6 +1,26 @@
-{ lib, stdenv, fetchurl, pkg-config, libGLU, libGL, libX11, libXext, libXfixes
+{ lib
-, libXdamage, libXcomposite, libXi, libxcb, cogl, pango, atk, json-glib
+, stdenv
-, gobject-introspection, gtk3, gnome, libinput, libgudev, libxkbcommon
+, fetchurl
+, pkg-config
+, libGLU
+, libGL
+, libX11
+, libXext
+, libXfixes
+, libXdamage
+, libXcomposite
+, libXi
+, libxcb
+, cogl
+, pango
+, atk
+, json-glib
+, gobject-introspection
+, gtk3
+, gnome
+, libinput
+, libgudev
+, libxkbcommon
 }:
 
 let
@@ -19,12 +39,34 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ gtk3 ];
   nativeBuildInputs = [ pkg-config gobject-introspection ];
-  propagatedBuildInputs =
+  propagatedBuildInputs = [
-    [ libX11 libGL libGLU libXext libXfixes libXdamage libXcomposite libXi cogl pango
+    cogl
-      atk json-glib gobject-introspection libxcb libinput libgudev libxkbcommon
+    pango
-    ];
+    atk
+    json-glib
+    gobject-introspection
+  ] ++ lib.optionals (!stdenv.isDarwin) [
+    libX11
+    libGL
+    libGLU
+    libXext
+    libXfixes
+    libXdamage
+    libXcomposite
+    libXi
+    libxcb
+    libinput
+    libgudev
+    libxkbcommon
+  ];
 
-  configureFlags = [ "--enable-introspection" ]; # needed by muffin AFAIK
+  configureFlags = [
+    "--enable-introspection" # needed by muffin AFAIK
+  ] ++ lib.optionals stdenv.isDarwin [
+    "--without-x"
+    "--enable-x11-backend=no"
+    "--enable-quartz-backend=yes"
+  ];
 
   #doCheck = true; # no tests possible without a display
 
@@ -57,6 +99,6 @@ stdenv.mkDerivation rec {
     homepage = "http://www.clutter-project.org/";
 
     maintainers = with lib.maintainers; [ ];
-    platforms = lib.platforms.mesaPlatforms;
+    platforms = lib.platforms.unix;
   };
 }

pkgs/development/libraries/cogl/default.nix

@@ -1,7 +1,27 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, libGL, glib, gdk-pixbuf, xorg, libintl
+{ lib
-, pangoSupport ? true, pango, cairo, gobject-introspection, wayland, gnome
+, stdenv
-, mesa, automake, autoconf
+, fetchurl
-, gstreamerSupport ? true, gst_all_1 }:
+, fetchpatch
+, pkg-config
+, libGL
+, glib
+, gdk-pixbuf
+, xorg
+, libintl
+, pangoSupport ? true
+, pango
+, cairo
+, gobject-introspection
+, wayland
+, gnome
+, mesa
+, automake
+, autoconf
+, gstreamerSupport ? true
+, gst_all_1
+, harfbuzz
+, OpenGL
+}:
 
 stdenv.mkDerivation rec {
   pname = "cogl";
@@ -35,26 +55,46 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--enable-introspection"
+  ] ++ lib.optionals (!stdenv.isDarwin) [
     "--enable-kms-egl-platform"
     "--enable-wayland-egl-platform"
     "--enable-wayland-egl-server"
-  ] ++ lib.optional gstreamerSupport "--enable-cogl-gst"
+    "--enable-gles1"
-  ++ lib.optionals (!stdenv.isDarwin) [ "--enable-gles1" "--enable-gles2" ];
+    "--enable-gles2"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "--disable-glx"
+    "--without-x"
+  ] ++ lib.optionals gstreamerSupport [
+    "--enable-cogl-gst"
+  ];
 
   # TODO: this shouldn't propagate so many things
   # especially not gobject-introspection
-  propagatedBuildInputs = with xorg; [
+  propagatedBuildInputs = [
-      glib gdk-pixbuf gobject-introspection wayland mesa
+    glib
-      libGL libXrandr libXfixes libXcomposite libXdamage
+    gdk-pixbuf
-    ]
+    gobject-introspection
-    ++ lib.optionals gstreamerSupport [ gst_all_1.gstreamer
+  ] ++ lib.optionals stdenv.isLinux [
-                                               gst_all_1.gst-plugins-base ];
+    wayland
+    mesa
+    libGL
+    xorg.libXrandr
+    xorg.libXfixes
+    xorg.libXcomposite
+    xorg.libXdamage
+  ] ++ lib.optionals gstreamerSupport [
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+  ];
 
-  buildInputs = lib.optionals pangoSupport [ pango cairo ];
+  buildInputs = lib.optionals pangoSupport [ pango cairo harfbuzz ]
+    ++ lib.optionals stdenv.isDarwin [ OpenGL ];
 
-  COGL_PANGO_DEP_CFLAGS
+  COGL_PANGO_DEP_CFLAGS = toString (lib.optionals (stdenv.isDarwin && pangoSupport) [
-    = lib.optionalString (stdenv.isDarwin && pangoSupport)
+    "-I${pango.dev}/include/pango-1.0"
-      "-I${pango.dev}/include/pango-1.0 -I${cairo.dev}/include/cairo";
+    "-I${cairo.dev}/include/cairo"
+    "-I${harfbuzz.dev}/include/harfbuzz"
+  ]);
 
   #doCheck = true; # all tests fail (no idea why)
 
@@ -76,7 +116,7 @@ stdenv.mkDerivation rec {
       render without stepping on each other's toes.
     '';
 
-    platforms = platforms.mesaPlatforms;
+    platforms = platforms.unix;
     license = with licenses; [ mit bsd3 publicDomain sgi-b-20 ];
   };
 }

pkgs/development/libraries/gssdp/1.6.nix

@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gssdp";
-  version = "1.6.0";
+  version = "1.6.1";
 
   outputs = [ "out" "dev" ]
     ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gssdp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "FI7UFijI8XM2osj6SxSrD7rpi2Amvi2s/d6nv0OGZok=";
+    sha256 = "0r4KbiWREJpuQlhRFhpKU7xUtPBqAhTHlwVmMpvVYzA=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gssdp/default.nix

@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gssdp";
-  version = "1.4.0.1";
+  version = "1.4.1";
 
   outputs = [ "out" "dev" ]
     ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gssdp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "hnaEnVf7giuHKIVtut6/OGf4nuR6DsR6IARdAR9DFYI=";
+    sha256 = "VySWVDV9PVGxQDFRaaJMBnHeeqUsb3XIxcmr1Ao1JSk=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gupnp/1.6.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gupnp";
-  version = "1.6.0";
+  version = "1.6.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gupnp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-MsSdrkd4zT74/Zpg9jdenId2ju5sPAWzPYp5+R4Ivcs=";
+    sha256 = "sha256-hTgUUtKvlbjhSyTUqYljPQ2DzYjRJy8nzLJBbMyDbUc=";
   };
 
   depsBuildBuild = [

pkgs/development/libraries/gupnp/default.nix

@@ -9,7 +9,7 @@
 , gtk-doc
 , docbook_xsl
 , docbook_xml_dtd_412
-, docbook_xml_dtd_44
+, docbook_xml_dtd_45
 , glib
 , gssdp
 , libsoup
@@ -20,14 +20,14 @@
 
 stdenv.mkDerivation rec {
   pname = "gupnp";
-  version = "1.4.3";
+  version = "1.4.4";
 
   outputs = [ "out" "dev" ]
     ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [ "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gupnp/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-FO2nd5NNot90PQckiZM72YETMre1v0Fia4Ay77KLM7o=";
+    sha256 = "sha256-N2GxXLBjYh+Efz7/t9djfwMXUA/Ka9oeGQT3OSF1Ch8=";
   };
 
   patches = [
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     gtk-doc
     docbook_xsl
     docbook_xml_dtd_412
-    docbook_xml_dtd_44
+    docbook_xml_dtd_45
   ];
 
   buildInputs = [

pkgs/development/python-modules/boltons/default.nix

@@ -34,6 +34,9 @@ buildPythonPackage rec {
     })
   ];
 
+  # Tests bind to localhost
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [
     "boltons"
   ];

pkgs/development/python-modules/colored/default.nix

@@ -1,24 +1,34 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, nose
 }:
 
 buildPythonPackage rec {
   pname = "colored";
-  version = "1.4.3";
+  version = "1.4.4";
+  format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b7b48b9f40e8a65bbb54813d5d79dd008dc8b8c5638d5bbfd30fc5a82e6def7a";
+    sha256 = "sha256-BP9NTdUUJ0/juZohu1L7lvJojAHpP7p77zciHny1bOA=";
   };
 
-  # No proper test suite
+  checkInputs = [ nose ];
-  doCheck = false;
+
+  checkPhase = ''
+    nosetests
+  '';
+
+  pythonImportsCheck = [
+    "colored"
+  ];
 
   meta = with lib; {
-    homepage = "https://gitlab.com/dslackw/colored";
     description = "Simple library for color and formatting to terminal";
+    homepage = "https://gitlab.com/dslackw/colored";
+    changelog = "https://gitlab.com/dslackw/colored/-/raw/${version}/CHANGES.md";
+    maintainers = with maintainers; [ ];
     license = licenses.mit;
   };
-
 }

pkgs/development/python-modules/dill/default.nix

@@ -1,41 +1,31 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
-, pytestCheckHook
+, python
+, setuptools
 }:
 
 buildPythonPackage rec {
   pname = "dill";
-  version = "0.3.5.1";
+  version = "0.3.6";
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "uqfoundation";
     repo = pname;
     rev = "refs/tags/dill-${version}";
-    sha256 = "sha256-gWE7aQodblgHjUqGAzOJGgxJ4qx9wHo/DU4KRE6JMWo=";
+    hash = "sha256-lh1o/TqnqtYN9xTZom33y1/7ZhMEAFpheLdtalwgObQ=";
   };
 
-  checkInputs = [
+  nativeBuildInputs = [
-    pytestCheckHook
+    setuptools
   ];
 
-  # Tests seem to fail because of import pathing and referencing items/classes in modules.
+  checkPhase = ''
-  # Seems to be a Nix/pathing related issue, not the codebase, so disabling failing tests.
+    runHook preCheck
-  disabledTestPaths = [
+    ${python.interpreter} dill/tests/__main__.py
-    "tests/test_diff.py"
+    runHook postCheck
-    "tests/test_module.py"
+  '';
-    "tests/test_objects.py"
-    "tests/test_session.py"
-  ];
-
-  disabledTests = [
-    "test_class_objects"
-    "test_importable"
-    "test_method_decorator"
-    "test_the_rest"
-    # test exception catching needs updating, can probably be removed with next update
-    "test_recursive_function"
-  ];
 
   pythonImportsCheck = [ "dill" ];
 
@@ -43,6 +33,6 @@ buildPythonPackage rec {
     description = "Serialize all of python (almost)";
     homepage = "https://github.com/uqfoundation/dill/";
     license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ tjni ];
   };
 }

pkgs/development/python-modules/django-reversion/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "django-reversion";
-  version = "5.0.3";
+  version = "5.0.4";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
 src = fetchPypi {
     inherit pname version;
-    hash = "sha256-rLYA+EghRzEqJ71Y5jdmqgODMQGB5IXm6qL0LSZQLJs=";
+    hash = "sha256-wSurRS0x3TwkRFbPHfODrPFLoUfPmUBMXkRBJZbeQvw=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/eve/default.nix

@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "eve";
-  version = "2.0.3";
+  version = "2.0.4";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "Eve";
-    sha256 = "sha256-UiOhnJyEy5bPIIRHAhuWo8AqHOCp0OE5d0btujfeq4o=";
+    sha256 = "sha256-RZ6dwekCKA+PomBp2Ht7/0elOLLUs/sO0KgdxxTOjtc=";
   };
 
   disabled = pythonOlder "3.7";

pkgs/development/python-modules/heatzypy/default.nix

@@ -18,15 +18,21 @@ buildPythonPackage rec {
     owner = "Cyr-ius";
     repo = pname;
     rev = "refs/tags/${version}";
-    sha256 = "sha256-4/v0xodpJzVi6/ciW5icqDFGCtBFKtGoMB92CknH9xw=";
+    hash = "sha256-4/v0xodpJzVi6/ciW5icqDFGCtBFKtGoMB92CknH9xw=";
   };
 
+  postPatch = ''
+    # https://github.com/Cyr-ius/heatzypy/issues/7
+    substituteInPlace setup.py \
+      --replace 'version="replace_by_workflow"' 'version="${version}"'
+  '';
+
   propagatedBuildInputs = [
     aiohttp
     requests
   ];
 
-  # Project has no tests
+  # Module has no tests
   doCheck = false;
 
   pythonImportsCheck = [

pkgs/development/python-modules/imap-tools/default.nix

@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "imap-tools";
-  version = "0.56.0";
+  version = "0.57.0";
 
   disabled = isPy27;
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "ikvk";
     repo = "imap_tools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-g1m44hUtD/x7zEe/ELY6zj2hJikSmZB6S8ZHEHPrvz0=";
+    hash = "sha256-plJ+X4RtZT77fWEAXAsyi5YnonjaWfZfKbSNFKE1DKc=";
   };
 
   checkInputs = [

pkgs/development/python-modules/pamqp/default.nix

@@ -6,7 +6,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "3.1.0";
+  version = "3.2.1";
   pname = "pamqp";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "gmr";
     repo = "pamqp";
     rev = version;
-    hash = "sha256-qiYfQsyYvG6pyRFDt3pyYKNNWNP88maj+VAeGD68OmY=";
+    hash = "sha256-zvvRoGMNP4NMy3Etjif5MYUPdRqmQXATbFgxaPp1TaM=";
   };
 
   checkInputs = [

pkgs/development/python-modules/pulumi/default.nix

@@ -1,42 +1,22 @@
 { lib
 , buildPythonPackage
-, fetchpatch
 , fetchFromGitHub
 , protobuf
 , dill
 , grpcio
-, pulumi-bin
+, pulumi
 , isPy27
 , semver
+, pytestCheckHook
 , pyyaml
 , six
-
-
-# for tests
-, go
-, pulumictl
-, pylint
-, pytest
-, pytest-timeout
-, wheel
-, pytest-asyncio
-
-, mypy
 }:
-let
-  data = import ./data.nix {};
-in
 buildPythonPackage rec {
-  pname = "pulumi";
+  inherit (pulumi) version src;
-  version = pulumi-bin.version;
-  disabled = isPy27;
 
-  src = fetchFromGitHub {
+  pname = "pulumi";
-    owner = "pulumi";
+
-    repo = "pulumi";
+  disabled = isPy27;
-    rev = "v${pulumi-bin.version}";
-    sha256 = "sha256-vqEZEHTpJV65a3leWwYhyi3dzAsN67BXOvk5hnTPeuI=";
-  };
 
   propagatedBuildInputs = [
     semver
@@ -48,28 +28,35 @@ buildPythonPackage rec {
   ];
 
   checkInputs = [
-    pulumi-bin
+    pulumi.pkgs.pulumi-language-python
-    pulumictl
+    pytestCheckHook
-    mypy
-    go
-    pytest
-    pytest-timeout
-    pytest-asyncio
-    wheel
   ];
 
-  sourceRoot="source/sdk/python/lib";
+  pytestFlagsArray = [
+    "test/"
+  ];
+
+  sourceRoot = "source/sdk/python/lib";
+
   # we apply the modifications done in the pulumi/sdk/python/Makefile
   # but without the venv code
   postPatch = ''
     cp ../../README.md .
-    sed -i "s/\''${VERSION}/${version}/g" setup.py
+    substituteInPlace setup.py \
+      --replace "3.0.0" "${version}" \
+      --replace "grpcio==1.47" "grpcio"
   '';
 
-  # disabled because tests try to fetch go packages from the net
+  # Allow local networking in tests on Darwin
-  doCheck = false;
+  __darwinAllowLocalNetworking = true;
 
-  pythonImportsCheck = ["pulumi"];
+  # Verify that the version substitution works
+  preCheck = ''
+    pip show "${pname}" | grep "Version: ${version}" > /dev/null \
+      || (echo "ERROR: Version substitution seems to be broken"; exit 1)
+  '';
+
+  pythonImportsCheck = [ "pulumi" ];
 
   meta = with lib; {
     description = "Modern Infrastructure as Code. Any cloud, any language";

pkgs/development/python-modules/pyrogram/default.nix

@@ -4,30 +4,28 @@
 , fetchFromGitHub
 , pyaes
 , pysocks
-, async-lru
-, tgcrypto
 , pytestCheckHook
 , pytest-asyncio
 }:
 
 buildPythonPackage rec {
   pname = "pyrogram";
-  version = "2.0.30";
+  version = "2.0.59";
 
   disabled = pythonOlder "3.7";
 
+  format = "setuptools";
+
   src = fetchFromGitHub {
     owner = "pyrogram";
     repo = "pyrogram";
     rev = "v${version}";
-    hash = "sha256-EG9LafZHqCC4klYm5gAlShnznGoaDOGsak4cEOh2OA4=";
+    hash = "sha256-vGgtVXvi/zvbU8f+LBQJN8GSxyVqdv/fBYfsBR4BKf4=";
   };
 
   propagatedBuildInputs = [
     pyaes
     pysocks
-    async-lru
-    tgcrypto
   ];
 
   checkInputs = [

pkgs/development/python-modules/tgcrypto/default.nix

@@ -2,22 +2,29 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
+, setuptools
 , pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "tgcrypto";
-  version = "1.2.4";
+  version = "1.2.5";
 
   disabled = pythonOlder "3.6";
 
+  format = "pyproject";
+
   src = fetchFromGitHub {
     owner = "pyrogram";
     repo = "tgcrypto";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-hifRWVEvNZVFyIJPwYY+CDR04F1I9GyAi3dt2kx+81c=";
+    sha256 = "sha256-u+mXzkmM79NBi4oHnb32RbN9WPnba/cm1q2Ko0uNEZg=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   checkInputs = [
     pytestCheckHook
   ];

pkgs/development/tools/analysis/jacoco/default.nix

@@ -0,0 +1,43 @@
+{ lib
+, stdenv
+, fetchzip
+, makeWrapper
+, jre
+}:
+
+stdenv.mkDerivation rec {
+  pname = "jacoco";
+  version = "0.8.8";
+
+  src = fetchzip {
+    url = "https://search.maven.org/remotecontent?filepath=org/jacoco/jacoco/${version}/jacoco-${version}.zip";
+    stripRoot = false;
+    sha256 = "sha256-NfXkMAFG1yMj1o06Hlhg9+B4RzL0I36fAGjZx3IC+NQ=";
+  };
+
+  outputs = [ "out" "doc" ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $doc/share/doc $out/bin
+
+    cp -r doc $doc/share/doc/jacoco
+    install -Dm444 lib/* -t $out/share/java
+
+    makeWrapper ${jre}/bin/java $out/bin/jacoco \
+      --add-flags "-jar $out/share/java/jacococli.jar"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A free code coverage library for Java";
+    homepage = "https://jacoco.org/jacoco";
+    license = licenses.epl20;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}

pkgs/development/tools/build-managers/corrosion/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "corrosion";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "corrosion-rs";
     repo = "corrosion";
     rev = "v${version}";
-    hash = "sha256-nJ4ercNykECDBqecuL8cdCl4DHgbgIUmbiFBG/jiOaA=";
+    hash = "sha256-HZdKnS0M8q4C42b7J93LZBXJycxYVahy2ywT6rISOzo=";
   };
 
   cargoRoot = "generator";
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     inherit src;
     sourceRoot = "${src.name}/${cargoRoot}";
     name = "${pname}-${version}";
-    hash = "sha256-4JVbHYlMOKztWPYW7tXQdvdNh/ygfpi0CY6Ly93VxsI=";
+    hash = "sha256-vrAK5BrMSC8FMLvtP0rxw4sHRU9ySbnrZM50oXMJV1Q=";
   };
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
@@ -36,13 +36,6 @@ stdenv.mkDerivation rec {
     rust.rustc
   ]);
 
-  cmakeFlags = [
-    "-DRust_CARGO=${rustPlatform.rust.cargo}/bin/cargo"
-
-    # tests cannot find cargo because Rust_CARGO is unset before tests
-    "-DCORROSION_BUILD_TESTS=OFF"
-  ];
-
   meta = with lib; {
     description = "Tool for integrating Rust into an existing CMake project";
     homepage = "https://github.com/corrosion-rs/corrosion";

pkgs/development/tools/fblog/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fblog";
-  version = "4.1.0";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "brocode";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1lj0cv1rmcqg36rxnnjh1dazn0sdggfc9kigjg3id6h0y8k7d9b3";
+    sha256 = "sha256-A5/TwISGsk9L0Z/ZF9Z/fxiMG+rcPgtAr2BNVJ+1Xfo=";
   };
 
-  cargoSha256 = "sha256-xHvnxRPxe09EmxUK9j7+V2AA1xJFP3ibwbkSs3FBgcw=";
+  cargoSha256 = "sha256-BrhYHUx28Sb6eNU3nTMlMewtokyY6+I5ww+bBVshQqk=";
 
   meta = with lib; {
     description = "A small command-line JSON log viewer";

pkgs/development/tools/jdt-language-server/default.nix

@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation rec {
   pname = "jdt-language-server";
-  version = "1.16.0";
+  version = "1.17.0";
-  timestamp = "202209291445";
+  timestamp = "202210271413";
 
   src = fetchurl {
     url = "https://download.eclipse.org/jdtls/milestones/${version}/jdt-language-server-${version}-${timestamp}.tar.gz";
-    sha256 = "bf16a0c3a7034260f646206c51fba14b3c10ef68cece23b7a3c681248f5c1f3a";
+    sha256 = "sha256-3NVzL3o/8LXR94/3Yma42XHfwNEFEVrmUijkeMs/vL0=";
   };
 
   sourceRoot = ".";

pkgs/development/tools/kcli/default.nix

@@ -11,7 +11,7 @@ buildGoModule rec {
     sha256 = "0whijr2r2j5bvfy8jgmpxsa0zvwk5kfjlpnkw4za5k35q7bjffls";
   };
 
-  vendorSha256 = "0zj2hls8m0l9xsfv680wiwq1g2qjdjslv2yx3yd4rzxdsv2wz09a";
+  vendorSha256 = null; #vendorSha256 = "";
 
   subPackages = [ "." ];
 
@@ -20,5 +20,6 @@ buildGoModule rec {
     homepage = "https://github.com/cswank/kcli";
     license = licenses.mit;
     maintainers = with maintainers; [ cswank ];
+    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
   };
 }

pkgs/development/tools/rust/cargo-unused-features/default.nix

@@ -0,0 +1,42 @@
+{ lib
+, rustPlatform
+, fetchCrate
+, curl
+, pkg-config
+, openssl
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-unused-features";
+  version = "0.1.7";
+
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-PdSR2nZbRzV2Kg2LNEpI7/Us+r8Gy6XLdUzMLei5r8c=";
+  };
+
+  cargoSha256 = "sha256-Y0U5Qzj+S7zoXWemcSfMn0YS7wCAPj+ER0jao+f2B28=";
+
+  nativeBuildInputs = [
+    curl.dev
+    pkg-config
+  ];
+
+  buildInputs = [
+    curl
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [
+    CoreFoundation
+    Security
+  ]);
+
+  meta = with lib; {
+    description = "A tool to find potential unused enabled feature flags and prune them";
+    homepage = "https://github.com/timonpost/cargo-unused-features";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "unused-features";
+  };
+}

pkgs/development/tools/yq-go/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "yq-go";
-  version = "4.29.2";
+  version = "4.30.1";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     rev = "v${version}";
-    sha256 = "sha256-ZHl0FTxWdoxHrbWx6mp5qR/l/FtC3bBkzGuR0T2NouA=";
+    sha256 = "sha256-S4O/5iqX7P6oCONLHu/PucATVVJf2lgae1YtZmJCuns=";
   };
 
   vendorSha256 = "sha256-L3l6wH4bR1/R6MtQTHYsyRE5E/EPnpNwa310zUONo+s=";

pkgs/games/super-tux-kart/default.nix

@@ -24,6 +24,7 @@
 , Cocoa
 , IOKit
 , libsamplerate
+, shaderc
 }:
 let
   assets = fetchsvn {
@@ -48,6 +49,8 @@ let
     "graphics_engine"
     # Internal library of STK, nothing to do about it
     "graphics_utils"
+    # Internal library.
+    "simd_wrapper"
     # This irrlicht is bundled with cmake
     # whereas upstream irrlicht still uses
     # archaic Makefiles, too complicated to switch to.
@@ -65,13 +68,13 @@ in
 stdenv.mkDerivation rec {
 
   pname = "supertuxkart";
-  version = "1.3";
+  version = "1.4";
 
   src = fetchFromGitHub {
     owner = "supertuxkart";
     repo = "stk-code";
     rev = version;
-    sha256 = "1llyxkdc4m9gnjxqaxlpwvv3ayvpw2bfjzfkkrljaxhznq811g0l";
+    hash = "sha256-gqdaVvgNfCN40ZO/9y8+vTeIJPSq6udKxYZ/MAi4ZMM=";
   };
 
   postPatch = ''
@@ -91,6 +94,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    shaderc
     SDL2
     glew
     libvorbis

pkgs/os-specific/linux/fatrace/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fatrace";
-  version = "0.16.3";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "martinpitt";
     repo = pname;
     rev = version;
-    sha256 = "sha256-w7leZPdmiTc+avihP203e6GLvbRzbCtNOJdF8MM2v68=";
+    sha256 = "sha256-MRHM+hyuRevK4L3u6dGw1S3O7w+BJBsprJVcSz6Q9xg=";
   };
 
   buildInputs = [ python3 which ];

pkgs/os-specific/linux/nvidia-x11/generic.nix

@@ -127,7 +127,8 @@ let
       platforms = [ "x86_64-linux" ] ++ optionals (!i686bundled) [ "i686-linux" ];
       maintainers = with maintainers; [ jonringer ];
       priority = 4; # resolves collision with xorg-server's "lib/xorg/modules/extensions/libglx.so"
-      inherit broken;
+      # proprietary driver currently does not support X86_KERNEL_IBT, which is scheduled to be added in linux 6.2
+      broken = broken || (kernel != null && kernel.kernelAtLeast "6.2");
     };
   };
 

pkgs/os-specific/linux/pam_ussh/default.nix

@@ -23,7 +23,7 @@ buildGoModule rec {
     inherit prePatch;
   });
 
-  vendorSha256 = "0hjifc3kbwmx7kjn858vi05cwwra6q19cqjfd94k726pwhk37qkw";
+  vendorSha256 = null; #vendorSha256 = "";
 
   buildInputs = [
     pam
@@ -63,5 +63,6 @@ buildGoModule rec {
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ lukegb ];
+    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
   };
 }

pkgs/servers/dgraph/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dgraph";
-  version = "22.0.0";
+  version = "22.0.1";
 
   src = fetchFromGitHub {
     owner = "dgraph-io";
     repo = "dgraph";
     rev = "v${version}";
-    sha256 = "sha256-2ZLZ1emsXmt1RjVq5Pdsbi+ItzxN/fEImOq7VBg5pxA=";
+    sha256 = "sha256-c4gNkT1N1yPotDhRjZvuVvO5TTaL2bqR5I+Z2PcvW10=";
   };
 
   vendorSha256 = "sha256-K2Q2QBP6fJ3E2LEmZO2U/0DiQifrJVG0lcs4pO5yqrY=";

pkgs/servers/filtron/default.nix

@@ -11,7 +11,7 @@ buildGoModule rec {
     sha256 = "18d3h0i2sfqbc0bjx26jm2n9f37zwp8z9z4wd17sw7nvkfa72a26";
   };
 
-  vendorSha256 = "05q2g591xl08h387mm6njabvki19yih63dfsafgpc9hyk5ydf2n9";
+  vendorSha256 = null; #vendorSha256 = "";
 
   # The upstream test checks are obsolete/unmaintained.
   doCheck = false;
@@ -22,5 +22,6 @@ buildGoModule rec {
     license = licenses.agpl3;
     maintainers = [ maintainers.dasj19 ];
     platforms = platforms.linux;
+    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
   };
 }

pkgs/servers/geospatial/pg_featureserv/default.nix

@@ -11,7 +11,7 @@ buildGoModule rec {
     sha256 = "0lfsbsgcb7z8ljxn1by37rbx02vaprrpacybk1kja1rjli7ik7m9";
   };
 
-  vendorSha256 = "1jqrkx850ghmpnfjhqky93r8fq7q63m5ivs0lzljzbvn7ya75f2r";
+  vendorSha256 = null; #vendorSha256 = "";
 
   ldflags = [ "-s" "-w" "-X github.com/CrunchyData/pg_featureserv/conf.setVersion=${version}" ];
 
@@ -21,5 +21,6 @@ buildGoModule rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ sikmir ];
     platforms = platforms.unix;
+    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
   };
 }

pkgs/servers/gobetween/default.nix

@@ -21,7 +21,7 @@ buildGoModule rec {
     make -e build${lib.optionalString enableStatic "-static"}
   '';
 
-  vendorSha256 = "1nkni9ikpc0wngh5v0qmlpn5s9v85lb2ih22f3h3lih7nc29yv87";
+  vendorSha256 = null; #vendorSha256 = "";
 
   installPhase = ''
     mkdir -p $out/bin
@@ -35,5 +35,6 @@ buildGoModule rec {
     homepage = "https://gobetween.io";
     license = licenses.mit;
     maintainers = with maintainers; [ tomberek ];
+    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
   };
 }

pkgs/servers/monitoring/alertmanager-bot/default.nix

@@ -11,7 +11,7 @@ buildGoModule rec {
     sha256 = "1hjfkksqb675gabzjc221b33h2m4s6qsanmkm382d3fyzqj71dh9";
   };
 
-  vendorSha256 = "1v0fgin8dn81b559zz4lqmrl7hikr46g4gb18sci4riql5qs1isj";
+  vendorSha256 = null; #vendorSha256 = "";
 
   postPatch = ''
     sed "s;/templates/default.tmpl;$out/share&;" -i cmd/alertmanager-bot/main.go
@@ -30,5 +30,6 @@ buildGoModule rec {
     homepage = "https://github.com/metalmatze/alertmanager-bot";
     license = licenses.mit;
     maintainers = with maintainers; [ mmahut ];
+    broken = true; # vendor isn't reproducible with go > 1.17: nix-build -A $name.go-modules --check
   };
 }

pkgs/servers/redpanda/default.nix

@@ -1,13 +1,13 @@
 { lib, stdenv, fetchzip }:
 
 let
-  version = "22.2.7";
+  version = "22.3.1";
   platform = if stdenv.isLinux then "linux" else "darwin";
   arch = if stdenv.isAarch64 then "arm" else "amd";
   sha256s = {
     darwin.amd = "sha256-AXk3aP1SGiHTfHTCBRTagX0DAVmdcVVIkxWaTnZxB8g=";
     darwin.arm = "sha256-pvOVvNc8lZ2d2fVZVYWvumVWYpnLORNY/3o1t4BN2N4=";
-    linux.amd = "sha256-hUChGYimCFXEvSxb49QgPo/LYlef0ZMVhKNy9i3SpVA=";
+    linux.amd = "sha256-liUFM9f7OQocb5j/qvZNVWiJGIf651ULMlRmX67qyoQ=";
     linux.arm = "sha256-WHjYAbytiu747jFqN0KZ/CkIwAVI7fb32ywtRiQOBm8=";
   };
 in stdenv.mkDerivation rec {

pkgs/servers/sql/mysql/8.0.x.nix

@@ -16,6 +16,10 @@ self = stdenv.mkDerivation rec {
   nativeBuildInputs = [ bison cmake pkg-config ]
     ++ lib.optionals (!stdenv.isDarwin) [ rpcsvc-proto ];
 
+  patches = [
+    ./no-force-outline-atomics.patch # Do not force compilers to turn on -moutline-atomics switch
+  ];
+
   ## NOTE: MySQL upstream frequently twiddles the invocations of libtool. When updating, you might proactively grep for libtool references.
   postPatch = ''
     substituteInPlace cmake/libutils.cmake --replace /usr/bin/libtool libtool

pkgs/servers/sql/mysql/no-force-outline-atomics.patch

@@ -0,0 +1,24 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 727d66011f9..acae1aada57 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1338,19 +1338,6 @@ IF(UNIX AND MY_COMPILER_IS_GNU_OR_CLANG
+   ENDIF()
+ ENDIF()
+ 
+-# For aarch64 some sub-architectures support LSE atomics and some don't. Thus,
+-# compiling for the common denominator (-march=armv8-a) means LSE is not used.
+-# The -moutline-atomics switch enables run-time detection of LSE support.
+-# There are compilers (gcc 9.3.1 for example) which support this switch, but
+-# do not enable it by default, even though it seems to help. So, we force it.
+-IF(CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64")
+-  MY_CHECK_CXX_COMPILER_FLAG( "-moutline-atomics" HAVE_OUTLINE_ATOMICS)
+-  IF(HAVE_OUTLINE_ATOMICS)
+-    STRING_APPEND(CMAKE_C_FLAGS   " -moutline-atomics")
+-    STRING_APPEND(CMAKE_CXX_FLAGS " -moutline-atomics")
+-  ENDIF()
+-ENDIF()
+-
+ IF(LINUX)
+   OPTION(LINK_RANDOMIZE "Randomize the order of all symbols in the binary" OFF)
+   SET(LINK_RANDOMIZE_SEED "mysql"

pkgs/servers/web-apps/invoiceplane/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "invoiceplane";
-  version = "1.6-beta-1";
+  version = "1.6-beta-3";
 
   src = fetchurl {
     url = "https://github.com/InvoicePlane/InvoicePlane/releases/download/v${version}/v${version}.zip";
-    sha256 = "sha256-hIbk9zzqbwv2kSFClgPfTObB1YHj7KR4swKjGoN2v2E=";
+    sha256 = "sha256-sw5LaU3v4MIdX99WGKOaerVc9m3d8aQVuvrLn7KvcKE=";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/tools/admin/bubblewrap/default.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bubblewrap";
-  version = "0.6.2";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "bubblewrap";
     rev = "v${version}";
-    hash = "sha256-J+VFla3sWO+DfB2IxxrKzbiG+KWFJr9caf8sTHyWXY4=";
+    hash = "sha256-ddxEtBw6JcSsZCN5uKyuBMVkWwSoThfxrcvHZGZzFr4=";
   };
 
   postPatch = ''

pkgs/tools/admin/pulumi-bin/default.nix

@@ -0,0 +1,43 @@
+{ lib, stdenv, fetchurl, autoPatchelfHook, makeWrapper, installShellFiles }:
+
+with lib;
+
+let
+  data = import ./data.nix {};
+in stdenv.mkDerivation {
+  pname = "pulumi";
+  version = data.version;
+
+  postUnpack = ''
+    mv pulumi-* pulumi
+  '';
+
+  srcs = map (x: fetchurl x) data.pulumiPkgs.${stdenv.hostPlatform.system};
+
+  installPhase = ''
+    install -D -t $out/bin/ *
+  '' + optionalString stdenv.isLinux ''
+    wrapProgram $out/bin/pulumi --set LD_LIBRARY_PATH "${stdenv.cc.cc.lib}/lib"
+  '' + ''
+    installShellCompletion --cmd pulumi \
+      --bash <($out/bin/pulumi completion bash) \
+      --fish <($out/bin/pulumi completion fish) \
+      --zsh  <($out/bin/pulumi completion zsh)
+  '';
+
+  nativeBuildInputs = [ installShellFiles ] ++ optionals stdenv.isLinux [ autoPatchelfHook makeWrapper ];
+
+  meta = {
+    homepage = "https://pulumi.io/";
+    description = "Pulumi is a cloud development platform that makes creating cloud programs easy and productive";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = with licenses; [ asl20 ];
+    platforms = builtins.attrNames data.pulumiPkgs;
+    maintainers = with maintainers; [
+      ghuntley
+      peterromfeldhk
+      jlesquembre
+      cpcloud
+    ];
+  };
+}

pkgs/tools/admin/pulumi-packages/base.nix

@@ -0,0 +1,128 @@
+{ buildGoModule
+, fetchFromGitHub
+, python3Packages
+}:
+let
+  mkBasePackage =
+    { pname
+    , src
+    , version
+    , vendorHash
+    , cmd
+    , extraLdflags
+    , ...
+    }@args: buildGoModule (rec {
+      inherit pname src vendorHash version;
+
+      sourceRoot = "${src.name}/provider";
+
+      subPackages = [ "cmd/${cmd}" ];
+
+      doCheck = false;
+
+      ldflags = [
+        "-s"
+        "-w"
+      ] ++ extraLdflags;
+    } // args);
+
+  mkPythonPackage =
+    { meta
+    , pname
+    , src
+    , version
+    , ...
+    }: python3Packages.callPackage
+      ({ buildPythonPackage, pythonOlder, parver, pulumi, semver }:
+      buildPythonPackage rec {
+        inherit pname meta src version;
+        format = "setuptools";
+
+        disabled = pythonOlder "3.7";
+
+        sourceRoot = "${src.name}/sdk/python";
+
+        propagatedBuildInputs = [
+          parver
+          pulumi
+          semver
+        ];
+
+        postPatch = ''
+          sed -i \
+            -e 's/^VERSION = .*/VERSION = "${version}"/g' \
+            -e 's/^PLUGIN_VERSION = .*/PLUGIN_VERSION = "${version}"/g' \
+            setup.py
+        '';
+
+        # Auto-generated; upstream does not have any tests.
+        # Verify that the version substitution works
+        checkPhase = ''
+          runHook preCheck
+
+          pip show "${pname}" | grep "Version: ${version}" > /dev/null \
+            || (echo "ERROR: Version substitution seems to be broken"; exit 1)
+
+          runHook postCheck
+        '';
+
+        pythonImportsCheck = [
+          (builtins.replaceStrings [ "-" ] [ "_" ] pname)
+        ];
+      })
+      { };
+in
+{ owner
+, repo
+, rev
+, version
+, hash
+, vendorHash
+, cmdGen
+, cmdRes
+, extraLdflags
+, meta
+, fetchSubmodules ? false
+, ...
+}@args:
+let
+  src = fetchFromGitHub {
+    name = "source-${repo}-${rev}";
+    inherit owner repo rev hash fetchSubmodules;
+  };
+
+  pulumi-gen = mkBasePackage rec {
+    inherit src version vendorHash extraLdflags;
+
+    cmd = cmdGen;
+    pname = cmdGen;
+  };
+in
+mkBasePackage ({
+  inherit meta src version vendorHash extraLdflags;
+
+  pname = repo;
+
+  nativeBuildInputs = [
+    pulumi-gen
+  ];
+
+  cmd = cmdRes;
+
+  postConfigure = ''
+    pushd ..
+
+    chmod +w sdk/
+    ${cmdGen} schema
+
+    popd
+
+    VERSION=v${version} go generate cmd/${cmdRes}/main.go
+  '';
+
+  passthru.sdks.python = mkPythonPackage {
+    inherit meta src version;
+
+    pname = repo;
+  };
+} // args)

pkgs/tools/admin/pulumi-packages/default.nix

@@ -0,0 +1,11 @@
+{ callPackage }:
+let
+  mkPulumiPackage = callPackage ./base.nix { };
+  callPackage' = p: args: callPackage p (args // { inherit mkPulumiPackage; });
+in
+{
+  pulumi-aws-native = callPackage' ./pulumi-aws-native.nix { };
+  pulumi-azure-native = callPackage' ./pulumi-azure-native.nix { };
+  pulumi-language-python = callPackage ./pulumi-language-python.nix { };
+  pulumi-random = callPackage' ./pulumi-random.nix { };
+}

pkgs/tools/admin/pulumi-packages/pulumi-aws-native.nix

@@ -0,0 +1,34 @@
+{ lib
+, mkPulumiPackage
+}:
+mkPulumiPackage rec {
+  owner = "pulumi";
+  repo = "pulumi-aws-native";
+  version = "0.38.0";
+  rev = "v${version}";
+  hash = "sha256-v7jNPCrjtfi9KYD4RhiphMIpV23g/CBV/sKPBkMulu0=";
+  vendorHash = "sha256-Yu9tNakwXWYdrjzI6/MFRzVBhJAEOjsmq9iBAQlR0AI=";
+  cmdGen = "pulumi-gen-aws-native";
+  cmdRes = "pulumi-resource-aws-native";
+  extraLdflags = [
+    "-X github.com/pulumi/${repo}/provider/pkg/version.Version=v${version}"
+  ];
+
+  fetchSubmodules = true;
+  postConfigure = ''
+    pushd ..
+
+    ${cmdGen} schema aws-cloudformation-schema ${version}
+
+    popd
+  '';
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = with lib; {
+    description = "Native AWS Pulumi Provider";
+    homepage = "https://github.com/pulumi/pulumi-aws-native";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ veehaitch trundle ];
+  };
+}

pkgs/tools/admin/pulumi-packages/pulumi-azure-native.nix

@@ -0,0 +1,24 @@
+{ lib
+, mkPulumiPackage
+}:
+mkPulumiPackage rec {
+  owner = "pulumi";
+  repo = "pulumi-azure-native";
+  version = "1.81.0";
+  rev = "v${version}";
+  hash = "sha256-xiifVjvtt4bKi0fBYLU/Gfkx2tziLIq2vddRNWwuyz0=";
+  vendorHash = "sha256-VSwT5I5casJiBpXAcV9vLEWU9XWuDTktmfGqE6H/HX4=";
+  cmdGen = "pulumi-gen-azure-native";
+  cmdRes = "pulumi-resource-azure-native";
+  extraLdflags = [
+    "-X github.com/pulumi/${repo}/provider/pkg/version.Version=v${version}"
+  ];
+  fetchSubmodules = true;
+  __darwinAllowLocalNetworking = true;
+  meta = with lib; {
+    description = "Native Azure Pulumi Provider";
+    homepage = "https://github.com/pulumi/pulumi-azure-native";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ veehaitch trundle ];
+  };
+}

pkgs/tools/admin/pulumi-packages/pulumi-language-python.nix

@@ -0,0 +1,45 @@
+{ lib
+, buildGoModule
+, pulumi
+, python3
+}:
+buildGoModule rec {
+  inherit (pulumi) version src;
+
+  pname = "pulumi-language-python";
+
+  sourceRoot = "${src.name}/sdk";
+
+  vendorHash = "sha256-IZIdLmNGMFjRdkLPoE9UyON3pX/GBIgz/rv108v8iLY=";
+
+  postPatch = ''
+    # Requires network
+    substituteInPlace python/python_test.go \
+      --replace "TestRunningPipInVirtualEnvironment" \
+                "SkipTestRunningPipInVirtualEnvironment"
+
+    substituteInPlace python/cmd/pulumi-language-python/main_test.go \
+      --replace "TestDeterminePulumiPackages" \
+                "SkipTestDeterminePulumiPackages"
+  '';
+
+  subPackages = [
+    "python/cmd/pulumi-language-python"
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/pulumi/pulumi/sdk/v3/go/common/version.Version=${version}"
+  ];
+
+  checkInputs = [
+    python3
+  ];
+
+  postInstall = ''
+    cp python/cmd/pulumi-language-python-exec    $out/bin
+    cp python/dist/pulumi-resource-pulumi-python $out/bin
+    cp python/dist/pulumi-analyzer-policy-python $out/bin
+  '';
+}