From a7fc0b6e7016aa62c8a1e1f038d28d4b33f96e5c Mon Sep 17 00:00:00 2001
From: Hummeltech <6109326+hummeltech@users.noreply.github.com>
Date: Mon, 5 Jun 2023 16:18:21 -0700
Subject: [PATCH 01/42] mod_tile: testing enabled

It looks like the commit used to build `mapnik` was just missing some additional variable definitions in `libmapnik.pc` which are relied upon by the commit used to build `mod_tile`
---
 pkgs/servers/http/apache-modules/mod_tile/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/http/apache-modules/mod_tile/default.nix b/pkgs/servers/http/apache-modules/mod_tile/default.nix
index 359dc17b390d..f346008937ba 100644
--- a/pkgs/servers/http/apache-modules/mod_tile/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_tile/default.nix
@@ -50,16 +50,16 @@ stdenv.mkDerivation rec {
   ];
 
   # the install script wants to install mod_tile.so into apache's modules dir
+  # also mapnik pkg-config config is missing this patch: https://github.com/mapnik/mapnik/commit/692c2faa0ef168a8c908d262c2bbfe51a74a8336.patch
   postPatch = ''
     sed -i "s|\''${HTTPD_MODULES_DIR}|$out/modules|" CMakeLists.txt
+    sed -i -e "s|@MAPNIK_FONTS_DIR@|$(mapnik-config --fonts)|" -e "s|@MAPNIK_PLUGINS_DIR@|$(mapnik-config --input-plugins)|" tests/renderd.conf.in
   '';
 
   enableParallelBuilding = true;
 
-  # We need to either disable the `render_speedtest` and `download_tile` tests
-  # or fix the URLs they try to download from
-  #cmakeFlags = [ "-DENABLE_TESTS=1" ];
-  #doCheck = true;
+  cmakeFlags = [ "-DENABLE_TESTS=1" ];
+  doCheck = true;
 
   meta = with lib; {
     homepage = "https://github.com/openstreetmap/mod_tile";

From e1fedfdf455e381d2657c84fe4ea41478d5a5479 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 14 Jun 2023 18:59:11 +0200
Subject: [PATCH 02/42] nixos/ceph: run statix fix

---
 .../services/network-filesystems/ceph.nix     | 23 +++++++++----------
 1 file changed, 11 insertions(+), 12 deletions(-)

diff --git a/nixos/modules/services/network-filesystems/ceph.nix b/nixos/modules/services/network-filesystems/ceph.nix
index 22d58f29cb81..642c2b2de3e0 100644
--- a/nixos/modules/services/network-filesystems/ceph.nix
+++ b/nixos/modules/services/network-filesystems/ceph.nix
@@ -3,18 +3,18 @@
 with lib;
 
 let
-  cfg  = config.services.ceph;
+  cfg = config.services.ceph;
 
   # function that translates "camelCaseOptions" to "camel case options", credits to tilpner in #nixos@freenode
   expandCamelCase = replaceStrings upperChars (map (s: " ${s}") lowerChars);
   expandCamelCaseAttrs = mapAttrs' (name: value: nameValuePair (expandCamelCase name) value);
 
-  makeServices = (daemonType: daemonIds:
+  makeServices = daemonType: daemonIds:
     mkMerge (map (daemonId:
       { "ceph-${daemonType}-${daemonId}" = makeService daemonType daemonId cfg.global.clusterName pkgs.ceph; })
-      daemonIds));
+      daemonIds);
 
-  makeService = (daemonType: daemonId: clusterName: ceph:
+  makeService = daemonType: daemonId: clusterName: ceph:
     let
       stateDirectory = "ceph/${if daemonType == "rgw" then "radosgw" else daemonType}/${clusterName}-${daemonId}"; in {
     enable = true;
@@ -54,9 +54,9 @@ let
     } // optionalAttrs ( daemonType == "mon") {
       RestartSec = "10";
     };
-  });
+  };
 
-  makeTarget = (daemonType:
+  makeTarget = daemonType:
     {
       "ceph-${daemonType}" = {
         description = "Ceph target allowing to start/stop all ceph-${daemonType} services at once";
@@ -65,8 +65,7 @@ let
         before = [ "ceph.target" ];
         unitConfig.StopWhenUnneeded = true;
       };
-    }
-  );
+    };
 in
 {
   options.services.ceph = {
@@ -328,16 +327,16 @@ in
       { assertion = cfg.global.fsid != "";
         message = "fsid has to be set to a valid uuid for the cluster to function";
       }
-      { assertion = cfg.mon.enable == true -> cfg.mon.daemons != [];
+      { assertion = cfg.mon.enable -> cfg.mon.daemons != [];
         message = "have to set id of atleast one MON if you're going to enable Monitor";
       }
-      { assertion = cfg.mds.enable == true -> cfg.mds.daemons != [];
+      { assertion = cfg.mds.enable -> cfg.mds.daemons != [];
         message = "have to set id of atleast one MDS if you're going to enable Metadata Service";
       }
-      { assertion = cfg.osd.enable == true -> cfg.osd.daemons != [];
+      { assertion = cfg.osd.enable -> cfg.osd.daemons != [];
         message = "have to set id of atleast one OSD if you're going to enable OSD";
       }
-      { assertion = cfg.mgr.enable == true -> cfg.mgr.daemons != [];
+      { assertion = cfg.mgr.enable -> cfg.mgr.daemons != [];
         message = "have to set id of atleast one MGR if you're going to enable MGR";
       }
     ];

From d64e1f0b405bee479b191cdde71ddfdce2c4387d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 14 Jun 2023 19:18:49 +0200
Subject: [PATCH 03/42] nixos/ceph: add options to configure package used by
 each component

This makes updates following the upstream guide possible.
---
 nixos/modules/services/network-filesystems/ceph.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/network-filesystems/ceph.nix b/nixos/modules/services/network-filesystems/ceph.nix
index 642c2b2de3e0..aad03728b203 100644
--- a/nixos/modules/services/network-filesystems/ceph.nix
+++ b/nixos/modules/services/network-filesystems/ceph.nix
@@ -11,7 +11,7 @@ let
 
   makeServices = daemonType: daemonIds:
     mkMerge (map (daemonId:
-      { "ceph-${daemonType}-${daemonId}" = makeService daemonType daemonId cfg.global.clusterName pkgs.ceph; })
+      { "ceph-${daemonType}-${daemonId}" = makeService daemonType daemonId cfg.global.clusterName cfg.${daemonType}.package; })
       daemonIds);
 
   makeService = daemonType: daemonId: clusterName: ceph:
@@ -210,6 +210,7 @@ in
           to the id part in ceph i.e. [ "name1" ] would result in mgr.name1
         '';
       };
+      package = mkPackageOptionMD pkgs "ceph" { };
       extraConfig = mkOption {
         type = with types; attrsOf str;
         default = {};
@@ -230,6 +231,7 @@ in
           to the id part in ceph i.e. [ "name1" ] would result in mon.name1
         '';
       };
+      package = mkPackageOptionMD pkgs "ceph" { };
       extraConfig = mkOption {
         type = with types; attrsOf str;
         default = {};
@@ -250,7 +252,7 @@ in
           to the id part in ceph i.e. [ "name1" ] would result in osd.name1
         '';
       };
-
+      package = mkPackageOptionMD pkgs "ceph" { };
       extraConfig = mkOption {
         type = with types; attrsOf str;
         default = {
@@ -278,6 +280,7 @@ in
           to the id part in ceph i.e. [ "name1" ] would result in mds.name1
         '';
       };
+      package = mkPackageOptionMD pkgs "ceph" { };
       extraConfig = mkOption {
         type = with types; attrsOf str;
         default = {};
@@ -289,6 +292,7 @@ in
 
     rgw = {
       enable = mkEnableOption (lib.mdDoc "Ceph RadosGW daemon");
+      package = mkPackageOptionMD pkgs "ceph" { };
       daemons = mkOption {
         type = with types; listOf str;
         default = [];

From 0000006fe82e889af95a716d02702866968187f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 2 Jul 2023 04:41:57 +0200
Subject: [PATCH 04/42] python310Packages.matplotlib: disable tkinter for PyPy

PyPy doesn't support tkinter and matplotlib uses tkagg instead for it.
---
 pkgs/development/python-modules/matplotlib/default.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index b35d6ec4a0a2..a61a1ae559cd 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -3,6 +3,7 @@
 , fetchPypi
 , writeText
 , buildPythonPackage
+, isPyPy
 , pythonOlder
 
 # https://github.com/matplotlib/matplotlib/blob/main/doc/devel/dependencies.rst
@@ -39,7 +40,8 @@
 , pygobject3
 
 # Tk
-, enableTk ? !stdenv.isDarwin # darwin has its own "MacOSX" backend
+# Darwin has its own "MacOSX" backend, PyPy has tkagg backend and does not support tkinter
+, enableTk ? (!stdenv.isDarwin && !isPyPy)
 , tcl
 , tk
 , tkinter

From 28216d7debb565a85bb308a34081b1bf4b691d5d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 2 Jul 2023 21:38:09 +0200
Subject: [PATCH 05/42] python311Packages.nose3: disable tests also on python
 3.11

---
 pkgs/development/python-modules/nose3/default.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/nose3/default.nix b/pkgs/development/python-modules/nose3/default.nix
index 8af1be25d0a7..c452a3431cf5 100644
--- a/pkgs/development/python-modules/nose3/default.nix
+++ b/pkgs/development/python-modules/nose3/default.nix
@@ -3,6 +3,7 @@
 , coverage
 , fetchPypi
 , isPyPy
+, isPy311
 , python
 , stdenv
 }:
@@ -19,8 +20,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ coverage ];
 
   # PyPy hangs for unknwon reason
-  # darwin fails an assertion and I didn't find a way to find skip that test
-  doCheck = !isPyPy && !stdenv.isDarwin;
+  # Darwin and python 3.11 fail at various assertions and I didn't find an easy way to find skip those tests
+  doCheck = !isPyPy && !stdenv.isDarwin && !isPy311;
 
   checkPhase = ''
     ${python.pythonForBuild.interpreter} selftest.py

From 7b337580a3e56dfb7cfde8fe8cc31e2e71cc74eb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 2 Jul 2023 21:52:33 +0200
Subject: [PATCH 06/42] pypy3Packages.sphinx: disable broken tests

---
 .../development/python-modules/sphinx/default.nix | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/sphinx/default.nix b/pkgs/development/python-modules/sphinx/default.nix
index 1e14bc7a6133..eb559c414860 100644
--- a/pkgs/development/python-modules/sphinx/default.nix
+++ b/pkgs/development/python-modules/sphinx/default.nix
@@ -3,7 +3,7 @@
 , buildPythonPackage
 , pythonOlder
 , fetchFromGitHub
-, fetchpatch
+, isPyPy
 
 # nativeBuildInputs
 , flit-core
@@ -144,6 +144,19 @@ buildPythonPackage rec {
     "test_auth_header_no_match"
     "test_follows_redirects_on_GET"
     "test_connect_to_selfsigned_fails"
+  ] ++ lib.optionals isPyPy [
+    # PyPy has not __builtins__ which get asserted
+    # https://doc.pypy.org/en/latest/cpython_differences.html#miscellaneous
+    "test_autosummary_generate_content_for_module"
+    "test_autosummary_generate_content_for_module_skipped"
+    # internals are asserted which are sightly different in PyPy
+    "test_autodoc_inherited_members_None"
+    "test_automethod_for_builtin"
+    "test_builtin_function"
+    "test_cython"
+    "test_isattributedescriptor"
+    "test_methoddescriptor"
+    "test_partialfunction"
   ];
 
   meta = with lib; {

From 5b77f8a209a40a55f192072f5e8e097b32c81462 Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Wed, 5 Jul 2023 02:58:15 +0000
Subject: [PATCH 07/42] robustirc-bridge: 1.8 -> 1.9.0

---
 pkgs/servers/irc/robustirc-bridge/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/irc/robustirc-bridge/default.nix b/pkgs/servers/irc/robustirc-bridge/default.nix
index bc42fd12629e..985b17945d09 100644
--- a/pkgs/servers/irc/robustirc-bridge/default.nix
+++ b/pkgs/servers/irc/robustirc-bridge/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "robustirc-bridge";
-  version = "1.8";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "robustirc";
     repo = "bridge";
     rev = "v${version}";
-    sha256 = "12jzil97147f978shdgm6whz7699db0shh0c1fzgrjh512dw502c";
+    hash = "sha256-8SNy3xqVahBuEXCrG21zIggXeahbzJtqtFMxfp+r48g=";
   };
 
-  vendorSha256 = "0lm8j2iz0yysgi0bbh78ca629kb6sxvyy9al3aj2587hpvy79q85";
+  vendorHash = "sha256-NBouR+AwQd7IszEcnYRxHFKtCdVTdfOWnzYjdZ5fXfs=";
 
   postInstall = ''
     install -D robustirc-bridge.1 $out/share/man/man1/robustirc-bridge.1

From a79e78905d88c5c80db99159b16554b36aa03633 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 4 Jul 2023 23:37:49 +0200
Subject: [PATCH 08/42] betterbird: 102.8.0-bb30 -> 102.12.0-bb37

---
 .../mailreaders/betterbird/betterbird.diff    | 44 -----------
 .../mailreaders/betterbird/default.nix        | 75 +++++++++++--------
 2 files changed, 42 insertions(+), 77 deletions(-)
 delete mode 100644 pkgs/applications/networking/mailreaders/betterbird/betterbird.diff

diff --git a/pkgs/applications/networking/mailreaders/betterbird/betterbird.diff b/pkgs/applications/networking/mailreaders/betterbird/betterbird.diff
deleted file mode 100644
index 93d12b1ccfdd..000000000000
--- a/pkgs/applications/networking/mailreaders/betterbird/betterbird.diff
+++ /dev/null
@@ -1,44 +0,0 @@
---- a/12-feature-linux-systray-example.patch
-+++ b/12-feature-linux-systray-example.patch
-@@ -8,18 +8,15 @@ diff --git a/third_party/appindicator/Makefile b/third_party/appindicator/Makefi
- new file mode 100644
- --- /dev/null
- +++ b/third_party/appindicator/Makefile
--@@ -0,0 +1,34 @@
-+@@ -0,0 +1,31 @@
- +# Code from https://github.com/AyatanaIndicators/libayatana-appindicator
- +# and related repositories.
- +# See https://github.com/AyatanaIndicators/libayatana-appindicator/issues/46 for build instructions.
- +# You need: sudo aptitude install libdbusmenu-gtk3-dev
- +
--+CFLAGS=`pkg-config --cflags gtk+-3.0 glib-2.0` \
--+  -I/usr/include/libdbusmenu-glib-0.4/ \
--+  -I/usr/include/libdbusmenu-gtk3-0.4/ \
--+  -I/usr/include/glib-2.0
-++CFLAGS=`pkg-config --cflags gtk+-3.0 glib-2.0 dbusmenu-gtk3-0.4` \
- +
--+LDFLAGS=`pkg-config --libs gtk+-3.0 glib-2.0` -ldbusmenu-glib -ldbusmenu-gtk3
-++LDFLAGS=`pkg-config --libs dbusmenu-gtk3-0.4`
- +
- +OBJECTS=betterbird-systray-icon.o \
- +  app-indicator.o \
---- a/1790619-send-progress-width.patch
-+++ b/1790619-send-progress-width.patch
-@@ -31,6 +21,7 @@
-        scrolling="false">
-  <head>
-    <title>&sendDialog.title;</title>
-+   <link rel="localization" href="branding/brand.ftl" />
- +  <script defer="defer" src="chrome://messenger/content/dialogShadowDom.js"></script>
-    <script defer="defer" src="chrome://messenger/content/messengercompose/sendProgress.js"></script>
- -  <script defer="defer" src="chrome://messenger/content/dialogShadowDom.js"></script>
---- a/1777788-fix-dialog-size.patch
-+++ b/1777788-fix-dialog-size.patch
-@@ -22,6 +22,7 @@ diff --git a/mailnews/compose/content/sendProgress.xhtml b/mailnews/compose/cont
-        scrolling="false">
-  <head>
-    <title>&sendDialog.title;</title>
-+   <link rel="localization" href="branding/brand.ftl" />
-    <script defer="defer" src="chrome://messenger/content/dialogShadowDom.js"></script>
-    <script defer="defer" src="chrome://messenger/content/messengercompose/sendProgress.js"></script>
-  </head>
diff --git a/pkgs/applications/networking/mailreaders/betterbird/default.nix b/pkgs/applications/networking/mailreaders/betterbird/default.nix
index 1112bb39f74c..1b08cc3eb082 100644
--- a/pkgs/applications/networking/mailreaders/betterbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/betterbird/default.nix
@@ -9,54 +9,60 @@
 , thunderbird-unwrapped
 }:
 
-((buildMozillaMach rec {
+let
+  version = "102.12.0";
+  majVer = lib.versions.major version;
+
+  betterbird-patches = fetchFromGitHub {
+    owner = "Betterbird";
+    repo = "thunderbird-patches";
+    rev = "${version}-bb37";
+    postFetch = ''
+      echo "Retrieving external patches"
+
+      echo "#!${runtimeShell}" > external.sh
+      # if no external patches need to be downloaded, don't fail
+      { grep " # " $out/${majVer}/series-M-C || true ; } >> external.sh
+      { grep " # " $out/${majVer}/series || true ; } >> external.sh
+      sed -i -e '/^#/d' external.sh
+      sed -i -e 's/\/rev\//\/raw-rev\//' external.sh
+      sed -i -e 's|\(.*\) # \(.*\)|curl \2 -o $out/${majVer}/external/\1|' external.sh
+      chmod 700 external.sh
+
+      mkdir $out/${majVer}/external
+      SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
+      . ./external.sh
+      rm external.sh
+    '';
+    sha256 = "sha256-LH0dgWqariutfaOCPIUZrHzZ8oCbZF1VaaKQIQS4aL8=";
+  };
+in ((buildMozillaMach {
   pname = "betterbird";
-  version = "102.8.0";
+  inherit version;
 
   applicationName = "Betterbird";
   binaryName = "betterbird";
   inherit (thunderbird-unwrapped) application extraPatches;
 
   src = fetchurl {
-    # https://download.cdn.mozilla.net/pub/mozilla.org/thunderbird/releases/
+    # https://download.cdn.mozilla.net/pub/thunderbird/releases/
     url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-    sha512 = "2431eb8799184b261609c96bed3c9368bec9035a831aa5f744fa89e48aedb130385b268dd90f03bbddfec449dc3e5fad1b5f8727fe9e11e1d1f123a81b97ddf8";
+    sha512 = "303787a8f22a204e48784d54320d5f4adaeeeedbe4c2294cd26ad75792272ffc9453be7f0ab1434214b61a2cc46982c23c4fd447c4d80d588df4a7800225ddee";
   };
 
-  extraPostPatch = let
-    majVer = lib.versions.major version;
-    betterbird = fetchFromGitHub {
-      owner = "Betterbird";
-      repo = "thunderbird-patches";
-      rev = "${version}-bb30";
-      postFetch = ''
-        echo "Retrieving external patches"
-
-        echo "#!${runtimeShell}" > external.sh
-        grep " # " $out/${majVer}/series-M-C >> external.sh
-        grep " # " $out/${majVer}/series >> external.sh
-        sed -i -e 's/\/rev\//\/raw-rev\//' external.sh
-        sed -i -e 's|\(.*\) # \(.*\)|curl \2 -o $out/${majVer}/external/\1|' external.sh
-        chmod 700 external.sh
-
-        mkdir $out/${majVer}/external
-        SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
-        . ./external.sh
-        rm external.sh
-      '';
-      sha256 = "sha256-ouJSFz/5shNR9puVjrZRJq90DHTeSx7hAnDpuhkBsDo=";
-    };
-  in thunderbird-unwrapped.extraPostPatch or "" + /* bash */ ''
+  extraPostPatch = thunderbird-unwrapped.extraPostPatch or "" + /* bash */ ''
     PATH=$PATH:${lib.makeBinPath [ git ]}
     patches=$(mktemp -d)
     for dir in branding bugs external features misc; do
-      cp -r ${betterbird}/${majVer}/$dir/*.patch $patches/
+      cp -r ${betterbird-patches}/${majVer}/$dir/*.patch $patches/
+      # files is not in series file and duplicated with external patch
+      [[ $dir == bugs ]] && rm $patches/1820504-optimise-grapheme-m-c.patch
     done
-    cp ${betterbird}/${majVer}/series* $patches/
+    cp ${betterbird-patches}/${majVer}/series* $patches/
     chmod -R +w $patches
 
     cd $patches
-    patch -p1 < ${./betterbird.diff}
+    # fix FHS paths to libdbusmenu
     substituteInPlace 12-feature-linux-systray.patch \
       --replace "/usr/include/libdbusmenu-glib-0.4/" "${lib.getDev libdbusmenu-gtk3}/include/libdbusmenu-glib-0.4/" \
       --replace "/usr/include/libdbusmenu-gtk3-0.4/" "${lib.getDev libdbusmenu-gtk3}/include/libdbusmenu-gtk3-0.4/"
@@ -103,7 +109,7 @@
   webrtcSupport = false;
 
   pgoSupport = false; # console.warn: feeds: "downloadFeed: network connection unavailable"
-}).overrideAttrs(oldAttrs: {
+}).overrideAttrs (oldAttrs: {
   postInstall = oldAttrs.postInstall or "" + ''
     mv $out/lib/thunderbird/* $out/lib/betterbird
     rmdir $out/lib/thunderbird/
@@ -112,5 +118,8 @@
   '';
 
   doInstallCheck = false;
-  requiredSystemFeatures = [];
+
+  passthru = oldAttrs.passthru // {
+    inherit betterbird-patches;
+  };
 })

From 67e412012d182f994cb63d7551c882bfb278bc0b Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Thu, 6 Jul 2023 06:06:07 +0000
Subject: [PATCH 09/42] github-commenter: 0.9.0 -> 0.19.0

---
 pkgs/development/tools/github-commenter/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/github-commenter/default.nix b/pkgs/development/tools/github-commenter/default.nix
index 196d078c3027..28986288f6c3 100644
--- a/pkgs/development/tools/github-commenter/default.nix
+++ b/pkgs/development/tools/github-commenter/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "github-commenter";
-  version = "0.9.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = pname;
     rev = version;
-    sha256 = "sha256-IBo4FAoYX1FmrmQ9mlyyu1TGLY7dlH7pWalBoRb2puE=";
+    hash = "sha256-pCcTdj2ZgGIpa6784xkBX29LVu1o5ORqqk9j9wR/V8k=";
   };
 
-  vendorSha256 = "sha256-H1SnNG+/ALYs7h/oT8zWBhAXOuCFY0Sto2ATBBZg2ek=";
+  vendorHash = "sha256-etR//FfHRzCL6WEZSqeaKYu3eLjxA0x5mZJRe1yvycQ=";
 
   meta = with lib; {
     description = "Command line utility for creating GitHub comments on Commits, Pull Request Reviews or Issues";

From fdf0c98ff44782c16c0eff45d58d2fdde50dc50e Mon Sep 17 00:00:00 2001
From: Ilan Joselevich <personal@ilanjoselevich.com>
Date: Wed, 17 May 2023 19:00:07 +0300
Subject: [PATCH 10/42] nixos-rebuild: make --use-substitutes work with flakes

---
 .../linux/nixos-rebuild/nixos-rebuild.sh         | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
index bc0b6507ecb8..89871056c482 100755
--- a/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
+++ b/pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh
@@ -17,7 +17,7 @@ showSyntax() {
 
 # Parse the command line.
 origArgs=("$@")
-copyClosureFlags=()
+copyFlags=()
 extraBuildFlags=()
 lockFlags=()
 flakeFlags=(--extra-experimental-features 'nix-command flakes')
@@ -74,8 +74,8 @@ while [ "$#" -gt 0 ]; do
         upgrade=1
         upgrade_all=1
         ;;
-      --use-substitutes|-s)
-        copyClosureFlags+=("$i")
+      --use-substitutes|--substitute-on-destination|-s)
+        copyFlags+=("-s")
         ;;
       -I|--max-jobs|-j|--cores|--builders|--log-format)
         j="$1"; shift 1
@@ -192,12 +192,12 @@ copyToTarget() {
     if ! [ "$targetHost" = "$buildHost" ]; then
         if [ -z "$targetHost" ]; then
             logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
-            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyClosureFlags[@]}" --from "$buildHost" "$1"
+            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --from "$buildHost" "$1"
         elif [ -z "$buildHost" ]; then
             logVerbose "Running nix-copy-closure with these NIX_SSHOPTS: $SSHOPTS"
-            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyClosureFlags[@]}" --to "$targetHost" "$1"
+            NIX_SSHOPTS=$SSHOPTS runCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
         else
-            buildHostCmd nix-copy-closure "${copyClosureFlags[@]}" --to "$targetHost" "$1"
+            buildHostCmd nix-copy-closure "${copyFlags[@]}" --to "$targetHost" "$1"
         fi
     fi
 }
@@ -292,7 +292,7 @@ nixFlakeBuild() {
         drv="$(runCmd nix "${flakeFlags[@]}" eval --raw "${attr}.drvPath" "${evalArgs[@]}" "${extraBuildFlags[@]}")"
         if [ -a "$drv" ]; then
             logVerbose "Running nix with these NIX_SSHOPTS: $SSHOPTS"
-            NIX_SSHOPTS=$SSHOPTS runCmd nix "${flakeFlags[@]}" copy --derivation --to "ssh://$buildHost" "$drv"
+            NIX_SSHOPTS=$SSHOPTS runCmd nix "${flakeFlags[@]}" copy "${copyFlags[@]}" --derivation --to "ssh://$buildHost" "$drv"
             buildHostCmd nix-store -r "$drv" "${buildArgs[@]}"
         else
             log "nix eval failed"
@@ -480,7 +480,7 @@ if [[ -n $buildNix && -z $flake ]]; then
     if [ -a "$nixDrv" ]; then
         nix-store -r "$nixDrv"'!'"out" --add-root "$tmpDir/nix" --indirect >/dev/null
         if [ -n "$buildHost" ]; then
-            nix-copy-closure "${copyClosureFlags[@]}" --to "$buildHost" "$nixDrv"
+            nix-copy-closure "${copyFlags[@]}" --to "$buildHost" "$nixDrv"
             # The nix build produces multiple outputs, we add them all to the remote path
             for p in $(buildHostCmd nix-store -r "$(readlink "$nixDrv")" "${buildArgs[@]}"); do
                 remoteNix="$remoteNix${remoteNix:+:}$p/bin"

From 555555d0dd7ff4927b88b0be7cff20c10278bf55 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 7 Jul 2023 23:41:58 +0200
Subject: [PATCH 11/42] python3Packages.py-radix: remove

---
 .../python-modules/py-radix/default.nix       | 31 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 --
 3 files changed, 1 insertion(+), 33 deletions(-)
 delete mode 100644 pkgs/development/python-modules/py-radix/default.nix

diff --git a/pkgs/development/python-modules/py-radix/default.nix b/pkgs/development/python-modules/py-radix/default.nix
deleted file mode 100644
index 579311776f34..000000000000
--- a/pkgs/development/python-modules/py-radix/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ lib
-, buildPythonPackage
-, pythonAtLeast
-, fetchFromGitHub
-, coverage
-, nose
-}:
-
-buildPythonPackage rec {
-  pname = "py-radix";
-  version = "0.10.0";
-
-  disabled = pythonAtLeast "3.10"; # abandoned, remove when we move to py310/py311
-
-  src = fetchFromGitHub {
-    owner = "mjschultz";
-    repo = "py-radix";
-    rev = "v${version}";
-    sha256 = "01xyn9lg6laavnzczf5bck1l1c2718ihxx0hvdkclnnxjqhbrqis";
-  };
-
-  doCheck = true;
-  nativeCheckInputs = [ coverage nose ];
-
-  meta = with lib; {
-    description = "Python radix tree for IPv4 and IPv6 prefix matching";
-    homepage = "https://github.com/mjschultz/py-radix";
-    license = with licenses; [ isc bsdOriginal ];
-    maintainers = with maintainers; [ mkg ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index f1eb90ef0ecc..f449ca2c2174 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -210,6 +210,7 @@ mapAliases ({
   pur = throw "pur has been renamed to pkgs.pur"; # added 2021-11-08
   pushbullet = pushbullet-py;  # Added 2022-10-15
   Pweave = pweave; # added 2023-02-19
+  py-radix = throw "py-radix has been removed, since it abandoned"; # added 2023-07-07
   pyalmond = throw "pyalmond has been removed, since its API endpoints have been shutdown"; # added 2023-02-02
   pyblake2 = throw "pyblake2 is deprecated in favor of hashlib"; # added 2023-04-23
   pyblock = throw "pyblock has been removed, since it is abandoned and broken"; # added 2023-06-20
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 98f340025331..b34e4921356a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9382,8 +9382,6 @@ self: super: with self; {
 
   pyradios = callPackage ../development/python-modules/pyradios { };
 
-  py-radix = callPackage ../development/python-modules/py-radix { };
-
   pyrainbird = callPackage ../development/python-modules/pyrainbird { };
 
   pyramid_beaker = callPackage ../development/python-modules/pyramid_beaker { };

From 6666666f37d071158547241d8bfccc5ee5a6358e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 7 Jul 2023 23:42:30 +0200
Subject: [PATCH 12/42] python3Packages.validictory: remove

---
 .../python-modules/validictory/default.nix    | 26 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 --
 3 files changed, 1 insertion(+), 28 deletions(-)
 delete mode 100644 pkgs/development/python-modules/validictory/default.nix

diff --git a/pkgs/development/python-modules/validictory/default.nix b/pkgs/development/python-modules/validictory/default.nix
deleted file mode 100644
index c4172079a607..000000000000
--- a/pkgs/development/python-modules/validictory/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib
-, buildPythonPackage
-, pythonAtLeast
-, fetchPypi
-}:
-
-buildPythonPackage rec {
-  pname = "validictory";
-  version = "1.1.2";
-
-  disabled = pythonAtLeast "3.10"; # abandoned, should be removed when we move to py310/311
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1fim11vj990rmn59qd67knccjx1p4an7gavbgprpabsrb13bi1rs";
-  };
-
-  doCheck = false;
-
-  meta = with lib; {
-    description = "Validate dicts against a schema";
-    homepage = "https://github.com/sunlightlabs/validictory";
-    license = licenses.mit;
-  };
-
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index f449ca2c2174..fed5ea3eed93 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -340,6 +340,7 @@ mapAliases ({
   unittest2 = throw "unittest2 has been removed as it's a backport of unittest that's unmaintained and not needed beyond Python 3.4."; # added 2022-12-01
   uproot3 = throw "uproot3 has been removed, use uproot instead"; # added 2022-12-13
   uproot3-methods = throw "uproot3-methods has been removed"; # added 2022-12-13
+  validictory = throw "validictory has been removed, since it abandoned"; # added 2023-07-07
   virtual-display = throw "virtual-display has been renamed to PyVirtualDisplay"; # added 2023-01-07
   Wand = wand; # added 2022-11-13
   wasm = throw "wasm has been removed because it no longer builds and is unmaintained"; # added 2023-05-20
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b34e4921356a..b34f25432bc3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12999,8 +12999,6 @@ self: super: with self; {
 
   validators = callPackage ../development/python-modules/validators { };
 
-  validictory = callPackage ../development/python-modules/validictory { };
-
   validobj = callPackage ../development/python-modules/validobj { };
 
   validphys2 = callPackage ../development/python-modules/validphys2 { };

From d0b989dd16b837f2a44b97df0d2e41fa6d007a45 Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Sat, 8 Jul 2023 02:24:19 +0000
Subject: [PATCH 13/42] go-license-detector: 4.3.0 -> 4.3.1

---
 pkgs/development/tools/misc/go-license-detector/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/misc/go-license-detector/default.nix b/pkgs/development/tools/misc/go-license-detector/default.nix
index 155324aa49cb..cbef7ae0d9da 100644
--- a/pkgs/development/tools/misc/go-license-detector/default.nix
+++ b/pkgs/development/tools/misc/go-license-detector/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-license-detector";
-  version = "4.3.0";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "go-enry";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MubQpxpUCPDBVsEz4NmY8MFEoECXQtzAaZJ89vv5bDc=";
+    hash = "sha256-S9LKXjn5dL5FETOOAk+bs7bIVdu2x7MIhfjpZuXzuLo=";
   };
 
-  vendorSha256 = "sha256-a9yCnGg+4f+UoHbGG8a47z2duBD3qXcAzPKnE4PQsvM=";
+  vendorHash = "sha256-MtQsUsFd9zQGbP7NGZ4zcSoa6O2WSWvGig0GUwCc6uM=";
 
   nativeCheckInputs = [ git ];
 

From 04a952d36293c6988d57cc356d5b1f14566f999d Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Sat, 8 Jul 2023 02:58:54 +0000
Subject: [PATCH 14/42] prometheus-rabbitmq-exporter: 1.0.0-RC8 -> 1.0.0-RC19

---
 pkgs/servers/monitoring/prometheus/rabbitmq-exporter.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/monitoring/prometheus/rabbitmq-exporter.nix b/pkgs/servers/monitoring/prometheus/rabbitmq-exporter.nix
index dca320ccd403..90207be3343a 100644
--- a/pkgs/servers/monitoring/prometheus/rabbitmq-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/rabbitmq-exporter.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "rabbitmq_exporter";
-  version = "1.0.0-RC8";
+  version = "1.0.0-RC19";
 
   src = fetchFromGitHub {
     owner = "kbudde";
     repo = "rabbitmq_exporter";
     rev = "v${version}";
-    sha256 = "162rjp1j56kcq0vdi0ch09ka101zslxp684x6jvw0jq0aix4zj3r";
+    hash = "sha256-31A0afmARdHxflR3n59DaqmLpTXws4OqROHfnc6cLKw=";
   };
 
-  vendorSha256 = "1cvdqf5pdwczhqz6xb6w86h7gdr0l8fc3lav88xq26r4x75cm6v0";
+  vendorHash = "sha256-ER0vK0xYUbQT3bqUosQMFT7HBycb3U8oI4Eak72myzs=";
 
   meta = with lib; {
     description = "Prometheus exporter for RabbitMQ";

From 6acad9dd01cfd85263298e38ce4d9dd1fbb9f728 Mon Sep 17 00:00:00 2001
From: Aaron Jheng <wentworth@outlook.com>
Date: Sat, 8 Jul 2023 03:08:38 +0000
Subject: [PATCH 15/42] prometheus-lnd-exporter: unstable-2021-03-26 -> 0.2.7

---
 pkgs/servers/monitoring/prometheus/lnd-exporter.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/monitoring/prometheus/lnd-exporter.nix b/pkgs/servers/monitoring/prometheus/lnd-exporter.nix
index 034d5a0c3861..e66ab8852f1d 100644
--- a/pkgs/servers/monitoring/prometheus/lnd-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/lnd-exporter.nix
@@ -2,16 +2,19 @@
 
 buildGoModule rec {
   pname = "lndmon";
-  version = "unstable-2021-03-26";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "lightninglabs";
     repo = "lndmon";
-    sha256 = "14lmmjq61p8yhc86swigs43risqi31vlmz7ri8j0n0fyp8lm2kxs";
-    rev = "3aa925aa4f633a6c4d132601922e78f173ae8ac1";
+    rev = "v${version}";
+    hash = "sha256-j9T60J7n9sya9/nN0Y6wsPDXN2h35pXxMdadsOkAMWI=";
   };
 
-  vendorSha256 = "06if387b9m02ciqgcissih1x06l33djp87vgspwzz589f77vczk8";
+  vendorHash = "sha256-h9+/BOy1KFiqUUV35M548fDKFC3Q5mBaANuD7t1rpp8=";
+
+  # Irrelevant tools dependencies.
+  excludedPackages = [ "./tools" ];
 
   passthru.tests = { inherit (nixosTests.prometheus-exporters) lnd; };
 

From 79ceb03e0316d69eeb19833f994f0a5f678a7a59 Mon Sep 17 00:00:00 2001
From: wackbyte <wackbyte@pm.me>
Date: Fri, 7 Jul 2023 22:44:38 -0400
Subject: [PATCH 16/42] vencord: 1.2.8 -> 1.3.4

---
 pkgs/misc/vencord/default.nix       | 6 +++---
 pkgs/misc/vencord/package-lock.json | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/misc/vencord/default.nix b/pkgs/misc/vencord/default.nix
index 38dbc1fa8f81..99d11b06976f 100644
--- a/pkgs/misc/vencord/default.nix
+++ b/pkgs/misc/vencord/default.nix
@@ -8,13 +8,13 @@
 }:
 buildNpmPackage rec {
   pname = "vencord";
-  version = "1.2.8";
+  version = "1.3.4";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     rev = "v${version}";
-    sha256 = "sha256-l3h4LrpMQ944i4QivKeL3dhZxZCr5uG29pQMY1XNbqc=";
+    sha256 = "sha256-r+VgxXwsBOfMggcVlr5q1/ONfp13CpX4ssrLQtmdLe8=";
   };
 
   ESBUILD_BINARY_PATH = lib.getExe (esbuild.override {
@@ -33,7 +33,7 @@ buildNpmPackage rec {
   # Supresses an error about esbuild's version.
   npmRebuildFlags = [ "|| true" ];
 
-  npmDepsHash = "sha256-m+hczXog03Gz81CP/blkRJPaTrEhmLQFvVtOfWKYQL4=";
+  npmDepsHash = "sha256-HJK88z4Gs8mqd28zKrsTtk34VcRqIyb6aURbvRZLN0I=";
   npmFlags = [ "--legacy-peer-deps" ];
   npmBuildScript = if buildWebExtension then "buildWeb" else "build";
   npmBuildFlags = [ "--" "--standalone" ];
diff --git a/pkgs/misc/vencord/package-lock.json b/pkgs/misc/vencord/package-lock.json
index 50bdbd220f6a..c75130a7e6fa 100644
--- a/pkgs/misc/vencord/package-lock.json
+++ b/pkgs/misc/vencord/package-lock.json
@@ -1,12 +1,12 @@
 {
     "name": "vencord",
-    "version": "1.2.8",
+    "version": "1.3.4",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "vencord",
-            "version": "1.2.8",
+            "version": "1.3.4",
             "license": "GPL-3.0",
             "dependencies": {
                 "@vap/core": "0.0.12",

From 32c711043ea9b14fd4e9094ffdbd5124956ba420 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Jul 2023 00:06:08 +0000
Subject: [PATCH 17/42] libmediainfo: 23.04 -> 23.06

---
 pkgs/development/libraries/libmediainfo/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/libmediainfo/default.nix b/pkgs/development/libraries/libmediainfo/default.nix
index 6f85e9e05b66..03d08945d1b0 100644
--- a/pkgs/development/libraries/libmediainfo/default.nix
+++ b/pkgs/development/libraries/libmediainfo/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libmediainfo";
-  version = "23.04";
+  version = "23.06";
 
   src = fetchurl {
     url = "https://mediaarea.net/download/source/libmediainfo/${version}/libmediainfo_${version}.tar.xz";
-    sha256 = "sha256-NlDt6jJv5U0/Y0YUdkSZUI++7ErphAAvCGrfHQwHGSY=";
+    sha256 = "sha256-xrGuiyu89AM0BRizyU8q51yOsAaCv7vRiyJELkLcz80=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];

From 2d4dd7c4f889367dd254a9ed83985464bb15f07f Mon Sep 17 00:00:00 2001
From: Mario Rodas <marsam@users.noreply.github.com>
Date: Sun, 9 Jul 2023 00:07:00 +0000
Subject: [PATCH 18/42] libmediainfo: add changelog to meta

---
 pkgs/development/libraries/libmediainfo/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/libraries/libmediainfo/default.nix b/pkgs/development/libraries/libmediainfo/default.nix
index 03d08945d1b0..a74c4e7140fa 100644
--- a/pkgs/development/libraries/libmediainfo/default.nix
+++ b/pkgs/development/libraries/libmediainfo/default.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Shared library for mediainfo";
     homepage = "https://mediaarea.net/";
+    changelog = "https://mediaarea.net/MediaInfo/ChangeLog";
     license = licenses.bsd2;
     platforms = platforms.unix;
     maintainers = [ maintainers.devhell ];

From 65219ede1c7bf12c229ad2f38c42960d1ce8bc87 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 9 Jul 2023 09:59:05 +0200
Subject: [PATCH 19/42] python311Packages.google-auth: 2.19.1 -> 2.21.0

Changelog: https://github.com/googleapis/google-auth-library-python/blob/v2.21.0/CHANGELOG.md
---
 pkgs/development/python-modules/google-auth/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-auth/default.nix b/pkgs/development/python-modules/google-auth/default.nix
index a3247b4ea938..11902659185c 100644
--- a/pkgs/development/python-modules/google-auth/default.nix
+++ b/pkgs/development/python-modules/google-auth/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "google-auth";
-  version = "2.19.1";
+  version = "2.21.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-qc+oiz4WGWhF5ko2WOuVOZISnROsczewZMZUb3fBcYM=";
+    hash = "sha256-so6ASOV3J+fPDlvY5ydrISrvR2ZUoJURNUqoJ1O0XGY=";
   };
 
   propagatedBuildInputs = [

From 33c64b520ad0d5233165e0190ecb77b972fe811b Mon Sep 17 00:00:00 2001
From: Martino Fontana <tinozzo123@tutanota.com>
Date: Mon, 3 Jul 2023 00:40:26 +0200
Subject: [PATCH 20/42] lapce: use upstream .desktop file

---
 pkgs/applications/editors/lapce/default.nix | 16 ++--------------
 1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/editors/lapce/default.nix b/pkgs/applications/editors/lapce/default.nix
index d06647579b9a..6b955bdb180b 100644
--- a/pkgs/applications/editors/lapce/default.nix
+++ b/pkgs/applications/editors/lapce/default.nix
@@ -7,8 +7,6 @@
 , pkg-config
 , perl
 , fontconfig
-, copyDesktopItems
-, makeDesktopItem
 , glib
 , gtk3
 , openssl
@@ -92,7 +90,6 @@ rustPlatform.buildRustPackage rec {
     cmake
     pkg-config
     perl
-    copyDesktopItems
     wrapGAppsHook # FIX: No GSettings schemas are installed on the system
     gobject-introspection
   ];
@@ -116,19 +113,10 @@ rustPlatform.buildRustPackage rec {
   ];
 
   postInstall = ''
-    install -Dm0644 $src/extra/images/logo.svg $out/share/icons/hicolor/scalable/apps/lapce.svg
+    install -Dm0644 $src/extra/images/logo.svg $out/share/icons/hicolor/scalable/apps/dev.lapce.lapce.svg
+    install -Dm0644 $src/extra/linux/dev.lapce.lapce.desktop $out/share/applications/lapce.desktop
   '';
 
-  desktopItems = [ (makeDesktopItem {
-    name = "lapce";
-    exec = "lapce %F";
-    icon = "lapce";
-    desktopName = "Lapce";
-    comment = meta.description;
-    genericName = "Code Editor";
-    categories = [ "Development" "Utility" "TextEditor" ];
-  }) ];
-
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {

From e82a7d86f393224511fd8bc0742e732274a921ea Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Jul 2023 13:45:33 +0000
Subject: [PATCH 21/42] ode: 0.16.3 -> 0.16.4

---
 pkgs/development/libraries/ode/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/ode/default.nix b/pkgs/development/libraries/ode/default.nix
index f82a67b76e1c..d35976932663 100644
--- a/pkgs/development/libraries/ode/default.nix
+++ b/pkgs/development/libraries/ode/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ode";
-  version = "0.16.3";
+  version = "0.16.4";
 
   src = fetchurl {
     url = "https://bitbucket.org/odedevs/${pname}/downloads/${pname}-${version}.tar.gz";
-    sha256 = "sha256-x0Hb9Jv8Rozilkgk5bw/kG6pVrGuNZTFDTUcOD8DxBM=";
+    sha256 = "sha256-cQN7goHGyGsKVXKfkNXbaXq+TL7B2BGBV+ANSOwlNGc=";
   };
 
   meta = with lib; {

From 87a22b1807c39c53b56368a6775c710db810ebbd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Jul 2023 14:13:34 +0000
Subject: [PATCH 22/42] python310Packages.google-cloud-compute: 1.12.0 ->
 1.12.1

---
 .../python-modules/google-cloud-compute/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-compute/default.nix b/pkgs/development/python-modules/google-cloud-compute/default.nix
index 41a7f6937ce5..09c335b8d655 100644
--- a/pkgs/development/python-modules/google-cloud-compute/default.nix
+++ b/pkgs/development/python-modules/google-cloud-compute/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-compute";
-  version = "1.12.0";
+  version = "1.12.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-d5L0/GiKVCfqHx8UGSx7BLClhgf0fGjw/q0p8N5h6X4=";
+    hash = "sha256-6P8jDASYoFuN7J6BVD50Ww2jZ21soyWUN6QpyNKsqiU=";
   };
 
   propagatedBuildInputs = [

From b9fb0b5d60be3fa46b391c1f29940aed18ba0b4b Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Sun, 9 Jul 2023 10:24:16 -0400
Subject: [PATCH 23/42] kube-score: fix version

---
 .../applications/networking/cluster/kube-score/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/applications/networking/cluster/kube-score/default.nix b/pkgs/applications/networking/cluster/kube-score/default.nix
index f8b75cd73329..720bf00ff6b3 100644
--- a/pkgs/applications/networking/cluster/kube-score/default.nix
+++ b/pkgs/applications/networking/cluster/kube-score/default.nix
@@ -16,6 +16,13 @@ buildGoModule rec {
 
   vendorHash = "sha256-UpuwkQHcNg3rohr+AdALakIdHroIySlTnXHgoUdY+EQ=";
 
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${version}"
+    "-X=main.commit=${src.rev}"
+  ];
+
   meta = with lib; {
     description = "Kubernetes object analysis with recommendations for improved reliability and security";
     homepage = "https://github.com/zegl/kube-score";

From a112a598a3cd0dd65399486287201705c2ee16c0 Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Sun, 9 Jul 2023 10:26:42 -0400
Subject: [PATCH 24/42] kube-score: add version test

---
 .../networking/cluster/kube-score/default.nix            | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/applications/networking/cluster/kube-score/default.nix b/pkgs/applications/networking/cluster/kube-score/default.nix
index 720bf00ff6b3..3caa17c2a5e2 100644
--- a/pkgs/applications/networking/cluster/kube-score/default.nix
+++ b/pkgs/applications/networking/cluster/kube-score/default.nix
@@ -1,6 +1,8 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, testers
+, kube-score
 }:
 
 buildGoModule rec {
@@ -23,6 +25,13 @@ buildGoModule rec {
     "-X=main.commit=${src.rev}"
   ];
 
+  passthru.tests = {
+    version = testers.testVersion {
+      package = kube-score;
+      command = "kube-score version";
+    };
+  };
+
   meta = with lib; {
     description = "Kubernetes object analysis with recommendations for improved reliability and security";
     homepage = "https://github.com/zegl/kube-score";

From d638a3934bd56c7a1143963e430bae64e5142c0d Mon Sep 17 00:00:00 2001
From: rewine <lhongxu@outlook.com>
Date: Sun, 9 Jul 2023 22:41:44 +0800
Subject: [PATCH 25/42] pineapple-pictures: 0.7.0 -> 0.7.1

---
 pkgs/applications/graphics/pineapple-pictures/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/pineapple-pictures/default.nix b/pkgs/applications/graphics/pineapple-pictures/default.nix
index a80e9a35a560..61dca70c2a50 100644
--- a/pkgs/applications/graphics/pineapple-pictures/default.nix
+++ b/pkgs/applications/graphics/pineapple-pictures/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pineapple-pictures";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "BLumia";
     repo = "pineapple-pictures";
     rev = version;
-    hash = "sha256-fNme11zoQBoFz4qJxBWzA8qHPwwxirM9rxxT36tjiQs";
+    hash = "sha256-6peNZc+rrQrUFSrn1AK8lZsy4RQf9DwpmXY0McfEus8=";
   };
 
   nativeBuildInputs = [

From 6216aa01f30090be4552374453563ed2061cfbd7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Jul 2023 14:44:20 +0000
Subject: [PATCH 26/42] argocd: 2.7.6 -> 2.7.7

---
 pkgs/applications/networking/cluster/argocd/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/argocd/default.nix b/pkgs/applications/networking/cluster/argocd/default.nix
index 2b4bc40daffe..478200cf616c 100644
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.7.6";
+  version = "2.7.7";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "sha256-YEQ5vLE13FzcE0dt/RRxuM2qRuvuHrTgGlF+3D4aox4=";
+    sha256 = "sha256-1GFA/zGX9geHgGRWx+sgszr9bJnMhAiiTjrnfvkTzuA=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-PQys3jXpwBsBQAMLW6WUUsIc+l1knSAvUicQug9fCmU=";
+  vendorHash = "sha256-h4TKomZSG6fEUVxIDhsxNHaIO+1Xl40+pFWgJJ2VH4E=";
 
   # Set target as ./cmd per cli-local
   # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227

From dd93b8a0cab90ed1d0ef36b494e058896a6dbfdb Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Sun, 9 Jul 2023 18:01:23 +0300
Subject: [PATCH 27/42] linuxPackages_latest.prl-tools: 18.3.1-53614 ->
 18.3.2-53621

---
 pkgs/os-specific/linux/prl-tools/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/prl-tools/default.nix b/pkgs/os-specific/linux/prl-tools/default.nix
index 561925b870d0..7e5fca7a354b 100644
--- a/pkgs/os-specific/linux/prl-tools/default.nix
+++ b/pkgs/os-specific/linux/prl-tools/default.nix
@@ -34,15 +34,15 @@ let
     "${util-linux}/bin"
   ];
 in
-stdenv.mkDerivation rec {
-  version = "18.3.1-53614";
+stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
+  version = "18.3.2-53621";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
-    url = "https://download.parallels.com/desktop/v${lib.versions.major version}/${version}/ParallelsDesktop-${version}.dmg";
-    hash = "sha256-MZtNxByY2GSoPFeH9mPieCPPNfUgfla+lYgpeD+SgOc=";
+    url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
+    hash = "sha256-mPETZiCI/i6xJ3+ououDKaVwrAxK5cr6L6A16oEgIqk=";
   };
 
   hardeningDisable = [ "pic" "format" ];
@@ -173,4 +173,4 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ catap wegank ];
     platforms = platforms.linux;
   };
-}
+})

From 1701fdcfbc3baa1a2b0b9d4981acb79a43df0d00 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Jul 2023 16:14:25 +0000
Subject: [PATCH 28/42] sqlcmd: 1.1.0 -> 1.2.0

---
 pkgs/development/tools/database/sqlcmd/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/database/sqlcmd/default.nix b/pkgs/development/tools/database/sqlcmd/default.nix
index 86e85279fea4..b29efd0b15e4 100644
--- a/pkgs/development/tools/database/sqlcmd/default.nix
+++ b/pkgs/development/tools/database/sqlcmd/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "sqlcmd";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     repo = "go-sqlcmd";
     owner = "microsoft";
     rev = "v${version}";
-    sha256 = "sha256-sBOCUlhqXShcF+KA7NXaUEC6c5+Rz9zutGOw6i2FSsQ=";
+    sha256 = "sha256-nMTC4bOv2Mgmt0GFXoBkbSayJ85i1mS/mcCsP8/x00A=";
   };
 
-  vendorHash = "sha256-1KnMFTadgTmHan2E/9+iHRPgakXi9F3tEOnuwGR+FXw=";
+  vendorHash = "sha256-+buoX9etR34p1N2G8+48ZvF6cg/y4uKb89sSIwkoeuY=";
   proxyVendor = true;
 
   ldflags = [ "-s" "-w" "-X main.version=${version}" ];

From b5e04f0bc7dd8dc1f0db335e4288895e080c3b60 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Jul 2023 17:19:43 +0000
Subject: [PATCH 29/42] kallisto: 0.48.0 -> 0.50.0

---
 pkgs/applications/science/biology/kallisto/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/science/biology/kallisto/default.nix b/pkgs/applications/science/biology/kallisto/default.nix
index 156f55161291..3ff7ae1161e4 100644
--- a/pkgs/applications/science/biology/kallisto/default.nix
+++ b/pkgs/applications/science/biology/kallisto/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kallisto";
-  version = "0.48.0";
+  version = "0.50.0";
 
   src = fetchFromGitHub {
     repo = "kallisto";
     owner = "pachterlab";
     rev = "v${version}";
-    sha256 = "sha256-r0cdR0jTRa1wu/LDKW6NdxI3XaKj6wcIVbIlct0fFvI=";
+    sha256 = "sha256-GJ8xMbHrnTzvPoMSczpugbIjh79cT3ngX3tLtwzlfEQ=";
   };
 
   nativeBuildInputs = [ autoconf cmake ];

From d4ade4dde8ecb7f459ba51355c9e5db667c8bf54 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Jul 2023 17:25:24 +0000
Subject: [PATCH 30/42] kics: 1.7.2 -> 1.7.3

---
 pkgs/tools/admin/kics/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/admin/kics/default.nix b/pkgs/tools/admin/kics/default.nix
index d91d6afa6742..b06c2fde645a 100644
--- a/pkgs/tools/admin/kics/default.nix
+++ b/pkgs/tools/admin/kics/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "kics";
-  version = "1.7.2";
+  version = "1.7.3";
 
   src = fetchFromGitHub {
     owner = "Checkmarx";
     repo = "kics";
     rev = "v${version}";
-    sha256 = "sha256-D5w/Wt6Dlu6ouwwyZkGa6Ttu367s7SrnlGI0lQqSpfI=";
+    sha256 = "sha256-IYyGZ0eJcGLQoQyfgbwxzzoEZ2dUKLlEaZ4NhuP5Q30=";
   };
 
   vendorHash = "sha256-cMKEUH/teEfyhHgBz3pMD8sotZ51t6O+4EiQ9BJt2Qg=";

From aca01299e9410ef6bf3b958902bd004a20c38b72 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Jul 2023 17:37:19 +0000
Subject: [PATCH 31/42] nwg-dock: 0.3.4 -> 0.3.5

---
 pkgs/applications/misc/nwg-dock/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/misc/nwg-dock/default.nix b/pkgs/applications/misc/nwg-dock/default.nix
index 71b1bccb0891..b2d57d098ee7 100644
--- a/pkgs/applications/misc/nwg-dock/default.nix
+++ b/pkgs/applications/misc/nwg-dock/default.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "nwg-dock";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4cyhE9CJz/4omvzucLuTR4QLQnd5iVANCG/BI6Sdhq8=";
+    sha256 = "sha256-kLvVP+hwv8Xgvp1YqrXZ2xpEcU92yvNMT5YCcDcg7xQ=";
   };
 
   vendorHash = "sha256-WDygnKdldZda4GadfStHWsDel1KLdzjVjw0RxmnFPRE=";

From f35c48d921b88df142958b332f7e27e5bde3ba46 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Jul 2023 18:29:39 +0000
Subject: [PATCH 32/42] cargo-crev: 0.24.2 -> 0.24.3

---
 pkgs/development/tools/rust/cargo-crev/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/rust/cargo-crev/default.nix b/pkgs/development/tools/rust/cargo-crev/default.nix
index a029aca6d95e..61a8e94a436b 100644
--- a/pkgs/development/tools/rust/cargo-crev/default.nix
+++ b/pkgs/development/tools/rust/cargo-crev/default.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-crev";
-  version = "0.24.2";
+  version = "0.24.3";
 
   src = fetchFromGitHub {
     owner = "crev-dev";
     repo = "cargo-crev";
     rev = "v${version}";
-    sha256 = "sha256-9jP/GPI+KXtHA54mCIaoN9hK16Xwlkoe7Qqxo4TbQh8=";
+    sha256 = "sha256-CCTG58dwO9gYe0WSUXFeaBSgvZ7pbX9S3B3hzabzkjo=";
   };
 
-  cargoHash = "sha256-wVLPcPPzrXU26BgB4TznGyIAsVmBbKNkNPuLfrS2+MQ=";
+  cargoHash = "sha256-p2qAWAZ1Y0GI0t9wHmn5Ww3o5vXpA6rsA/D7HD2x6o0=";
 
   preCheck = ''
     export HOME=$(mktemp -d)

From 17b5dc87059840742cbdd60b259f2201b8ba3020 Mon Sep 17 00:00:00 2001
From: Jacob Moody <moody@posixcafe.org>
Date: Sat, 1 Jul 2023 13:24:17 -0500
Subject: [PATCH 33/42] tlsclient: init at 1.5

---
 pkgs/tools/admin/tlsclient/default.nix | 40 ++++++++++++++++++++++++++
 pkgs/top-level/all-packages.nix        |  2 ++
 2 files changed, 42 insertions(+)
 create mode 100644 pkgs/tools/admin/tlsclient/default.nix

diff --git a/pkgs/tools/admin/tlsclient/default.nix b/pkgs/tools/admin/tlsclient/default.nix
new file mode 100644
index 000000000000..b26cb85a6e99
--- /dev/null
+++ b/pkgs/tools/admin/tlsclient/default.nix
@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromSourcehut
+, pkg-config
+, openssl
+, installShellFiles
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tlsclient";
+  version = "1.5";
+
+  src = fetchFromSourcehut {
+    owner = "~moody";
+    repo = "tlsclient";
+    rev = "v${version}";
+    hash = "sha256-9LKx9x5Kx7Mo4EL/b89Mdsdu8NqVYxohn98XnF+IWXs=";
+  };
+
+  strictDeps = true;
+  enableParallelBuilding = true;
+  nativeBuildInputs = [ pkg-config installShellFiles ];
+  buildInputs = [ openssl ];
+
+  makeFlags = [ "tlsclient" ];
+  installPhase = ''
+    install -Dm755 -t $out/bin tlsclient
+    installManPage tlsclient.1
+  '';
+
+  meta = with lib; {
+    description = "tlsclient command line utility";
+    longDescription = "unix port of 9front's tlsclient(1) and rcpu(1)";
+    homepage = "https://git.sr.ht/~moody/tlsclient";
+    license = licenses.mit;
+    maintainers = with maintainers; [ moody ];
+    mainProgram = "tlsclient";
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0f7e82707481..6808609d4146 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13345,6 +13345,8 @@ with pkgs;
 
   tldr-hs = haskellPackages.tldr;
 
+  tlsclient = callPackage ../tools/admin/tlsclient { };
+
   tlsx = callPackage ../tools/security/tlsx { };
 
   tmate = callPackage ../tools/misc/tmate { };

From 5f97e78c64c672361cb18b67c1383363274d7521 Mon Sep 17 00:00:00 2001
From: Jacob Moody <moody@posixcafe.org>
Date: Sat, 1 Jul 2023 14:48:38 -0500
Subject: [PATCH 34/42] pam_dp9ik: init at 1.5

---
 nixos/modules/security/pam.nix               | 29 +++++++++++++++++++
 pkgs/os-specific/linux/pam_dp9ik/default.nix | 30 ++++++++++++++++++++
 pkgs/top-level/all-packages.nix              |  2 ++
 3 files changed, 61 insertions(+)
 create mode 100644 pkgs/os-specific/linux/pam_dp9ik/default.nix

diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 4172bc6fbe1e..ac9da4a823b7 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -548,6 +548,9 @@ let
           (let yubi = config.security.pam.yubico; in optionalString cfg.yubicoAuth ''
             auth ${yubi.control} ${pkgs.yubico-pam}/lib/security/pam_yubico.so mode=${toString yubi.mode} ${optionalString (yubi.challengeResponsePath != null) "chalresp_path=${yubi.challengeResponsePath}"} ${optionalString (yubi.mode == "client") "id=${toString yubi.id}"} ${optionalString yubi.debug "debug"}
           '') +
+          (let dp9ik = config.security.pam.dp9ik; in optionalString dp9ik.enable ''
+            auth ${dp9ik.control} ${pkgs.pam_dp9ik}/lib/security/pam_p9.so ${dp9ik.authserver}
+          '') +
           optionalString cfg.fprintAuth ''
             auth sufficient ${pkgs.fprintd}/lib/security/pam_fprintd.so
           '' +
@@ -913,6 +916,32 @@ in
 
     security.pam.enableOTPW = mkEnableOption (lib.mdDoc "the OTPW (one-time password) PAM module");
 
+    security.pam.dp9ik = {
+      enable = mkEnableOption (
+        lib.mdDoc ''
+          the dp9ik pam module provided by tlsclient.
+
+          If set, users can be authenticated against the 9front
+          authentication server given in {option}`security.pam.dp9ik.authserver`.
+        ''
+      );
+      control = mkOption {
+        default = "sufficient";
+        type = types.str;
+        description = lib.mdDoc ''
+          This option sets the pam "control" used for this module.
+        '';
+      };
+      authserver = mkOption {
+        default = null;
+        type = with types; nullOr string;
+        description = lib.mdDoc ''
+          This controls the hostname for the 9front authentication server
+          that users will be authenticated against.
+        '';
+      };
+    };
+
     security.pam.krb5 = {
       enable = mkOption {
         default = config.krb5.enable;
diff --git a/pkgs/os-specific/linux/pam_dp9ik/default.nix b/pkgs/os-specific/linux/pam_dp9ik/default.nix
new file mode 100644
index 000000000000..382a3ca7b179
--- /dev/null
+++ b/pkgs/os-specific/linux/pam_dp9ik/default.nix
@@ -0,0 +1,30 @@
+{ lib
+, tlsclient
+, stdenv
+, pkg-config
+, pam
+}:
+
+stdenv.mkDerivation {
+  inherit (tlsclient) src version enableParallelBuilding;
+
+  pname = "pam_dp9ik";
+
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ pam ];
+
+  makeFlags = [ "pam_p9.so" ];
+  installPhase = ''
+    install -Dm755 -t $out/lib/security/ pam_p9.so
+  '';
+
+  meta = with lib; {
+    description = "dp9ik pam module";
+    longDescription = "Uses tlsclient to authenticate users against a 9front auth server";
+    homepage = "https://git.sr.ht/~moody/tlsclient";
+    license = licenses.mit;
+    maintainers = with maintainers; [ moody ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6808609d4146..41a5a35d93ae 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -27957,6 +27957,8 @@ with pkgs;
 
   pam_ccreds = callPackage ../os-specific/linux/pam_ccreds { };
 
+  pam_dp9ik = callPackage ../os-specific/linux/pam_dp9ik { };
+
   pam_gnupg = callPackage ../os-specific/linux/pam_gnupg { };
 
   pam_krb5 = callPackage ../os-specific/linux/pam_krb5 { };

From 1dca2bd42727b1400952609e392686141c65b28e Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 9 Jul 2023 21:37:13 +0200
Subject: [PATCH 35/42] python311Packages.rns: 0.5.5 -> 0.5.6

Diff: https://github.com/markqvist/Reticulum/compare/refs/tags/0.5.5...0.5.6

Changelog: https://github.com/markqvist/Reticulum/releases/tag/0.5.6
---
 pkgs/development/python-modules/rns/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 27f6517d420e..84b8c975f15d 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "rns";
-  version = "0.5.5";
+  version = "0.5.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "markqvist";
     repo = "Reticulum";
     rev = "refs/tags/${version}";
-    hash = "sha256-gyEf6Sck+qmbnepiBoHrN9t018BwBM4iJQBjU9Iqhn4=";
+    hash = "sha256-s/rOU9FEWdb0vmRsMq/yPkP/ZTNc5wjlfdB0V+ltryQ=";
   };
 
   propagatedBuildInputs = [

From 7d11433876f37d30e8cbf0748ac8a249c68c858b Mon Sep 17 00:00:00 2001
From: Artturin <Artturin@artturin.com>
Date: Sun, 9 Jul 2023 07:02:31 +0300
Subject: [PATCH 36/42] botan: split dev

out size 28M -> 27M
dev output 1.6M
---
 pkgs/development/libraries/botan/generic.nix | 4 ++++
 pkgs/tools/security/softhsm/default.nix      | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/botan/generic.nix b/pkgs/development/libraries/botan/generic.nix
index 1c5126584c2c..8c9c1a88a8b6 100644
--- a/pkgs/development/libraries/botan/generic.nix
+++ b/pkgs/development/libraries/botan/generic.nix
@@ -15,6 +15,8 @@ stdenv.mkDerivation rec {
   pname = "botan";
   version = "${baseVersion}.${revision}";
 
+  outputs = [ "out" "dev" ];
+
   src = fetchurl {
     name = "Botan-${version}.${sourceExtension}";
     urls = [
@@ -30,7 +32,9 @@ stdenv.mkDerivation rec {
     ++ lib.optionals stdenv.isDarwin [ CoreServices Security ];
 
   configurePhase = ''
+    runHook preConfigure
     python configure.py --prefix=$out --with-bzip2 --with-zlib ${extraConfigureFlags}${lib.optionalString stdenv.cc.isClang " --cc=clang"}
+    runHook postConfigure
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/tools/security/softhsm/default.nix b/pkgs/tools/security/softhsm/default.nix
index b218a3241f9f..648a4bc6515b 100644
--- a/pkgs/tools/security/softhsm/default.nix
+++ b/pkgs/tools/security/softhsm/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   configureFlags = [
     "--with-crypto-backend=botan"
-    "--with-botan=${botan2}"
+    "--with-botan=${lib.getDev botan2}"
     "--sysconfdir=$out/etc"
     "--localstatedir=$out/var"
     ];

From 0000010be9d79d75de0bb742d2a2d0f31152043b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 9 Jul 2023 16:00:54 +0000
Subject: [PATCH 37/42] wander: 0.9.0 -> 0.10.1

Removed version test as I couldn't find a way to make it work with github.com/carlmjohnson/versioninfo
---
 pkgs/tools/admin/wander/default.nix | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/pkgs/tools/admin/wander/default.nix b/pkgs/tools/admin/wander/default.nix
index b2df5a856cea..ddad76e4132a 100644
--- a/pkgs/tools/admin/wander/default.nix
+++ b/pkgs/tools/admin/wander/default.nix
@@ -1,19 +1,19 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles, testers, wander }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 
 buildGoModule rec {
   pname = "wander";
-  version = "0.9.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "robinovitch61";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-g9QAdwAqy3OA+nYsSpVLUPv1gn6N12339fgmYFT6Iys=";
+    sha256 = "sha256-jg83GHNlzPPzzhrLWw686vrmLlDL5L0+OUYqMoYUiJw=";
   };
 
-  vendorHash = "sha256-iTaZ5/0UrLJ3JE3FwQpvjKKrhqklG4n1WFTJhWfj/rI=";
+  vendorHash = "sha256-SqDGXV8MpvEQFAkcE1NWvWjdzYsvbO5vA6k+hpY0js0=";
 
-  ldflags = [ "-s" "-w" "-X=github.com/robinovitch61/wander/cmd.Version=v${version}" ];
+  ldflags = [ "-s" "-w" ];
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -24,12 +24,6 @@ buildGoModule rec {
       --zsh <($out/bin/wander completion zsh)
   '';
 
-  passthru.tests.version = testers.testVersion {
-    package = wander;
-    command = "wander --version";
-    version = "v${version}";
-  };
-
   meta = with lib; {
     description = "Terminal app/TUI for HashiCorp Nomad";
     license = licenses.mit;

From 33333335763f3109950ef0d9f009b8308f59bd7c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 3 Jul 2023 00:19:30 +0200
Subject: [PATCH 38/42] matrix-synapse: limit parallelism to 4 cores to be
 improve stability, formatting

On high core machines those easily can fail similar to:

matrix-synapse> tests.storage.test_room_search.MessageSearchTest.test_postgres_web_search_for_phrase
matrix-synapse> ===============================================================================
matrix-synapse> [ERROR]
matrix-synapse> Traceback (most recent call last):
matrix-synapse>   File "/build/source/tests/unittest.py", line 122, in new
matrix-synapse>     return code(orig, *args, **kwargs)
matrix-synapse>   File "/build/source/tests/unittest.py", line 216, in setUp
matrix-synapse>     return orig()
matrix-synapse>   File "/build/source/tests/unittest.py", line 338, in setUp
matrix-synapse>     self.hs = self.make_homeserver(self.reactor, self.clock)
matrix-synapse>   File "/build/source/tests/app/test_openid_listener.py", line 34, in make_homeserver
matrix-synapse>     hs = self.setup_test_homeserver(
matrix-synapse>   File "/build/source/tests/unittest.py", line 606, in setup_test_homeserver
matrix-synapse>     hs = setup_test_homeserver(self.addCleanup, **kwargs)
matrix-synapse>   File "/build/source/tests/server.py", line 921, in setup_test_homeserver
matrix-synapse>     prepare_database(
matrix-synapse>   File "/nix/store/2cc0p5apn2yg2fr5ii9mvb7fcwd74y26-matrix-synapse-1.86.0/lib/python3.10/site-packages/synapse/storage/prepare_database.py", line 155, in prepare_database
matrix-synapse>     raise UpgradeDatabaseException(EMPTY_DATABASE_ON_WORKER_ERROR)
matrix-synapse> synapse.storage.prepare_database.UpgradeDatabaseException: Uninitialised database: run the main synapse process to prepare the database schema before starting worker processes.
matrix-synapse>
---
 pkgs/servers/matrix-synapse/default.nix | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index 78458382c7e4..e278fc3aab00 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -86,21 +86,29 @@ buildPythonApplication rec {
 
   doCheck = !stdenv.isDarwin;
 
-  checkPhase = let testFlags = lib.optionalString (!stdenv.isAarch64) "-j $NIX_BUILD_CORES"; in ''
+  checkPhase = ''
     runHook preCheck
 
     # remove src module, so tests use the installed module instead
     rm -rf ./synapse
 
-    PYTHONPATH=".:$PYTHONPATH" ${python3.interpreter} -m twisted.trial ${testFlags} tests
+    # high parallelisem makes test suite unstable
+    # upstream uses 2 cores but 4 seems to be also stable
+    # https://github.com/matrix-org/synapse/blob/develop/.github/workflows/latest_deps.yml#L103
+    if (( $NIX_BUILD_CORES > 4)); then
+      NIX_BUILD_CORES=4
+    fi
+
+    PYTHONPATH=".:$PYTHONPATH" ${python3.interpreter} -m twisted.trial -j $NIX_BUILD_CORES tests
 
     runHook postCheck
   '';
 
-  passthru.tests = { inherit (nixosTests) matrix-synapse; };
-  passthru.plugins = plugins;
-  passthru.tools = tools;
-  passthru.python = python3;
+  passthru = {
+    tests = { inherit (nixosTests) matrix-synapse; };
+    inherit plugins tools;
+    python = python3;
+  };
 
   meta = with lib; {
     homepage = "https://matrix.org";

From 77777777dc42299b7efdf4be48e50978b938bd0d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 2 Jul 2023 16:22:20 +0200
Subject: [PATCH 39/42] pypy3Packages.skia-pathops: mark broken, update
 homepage

---
 pkgs/development/python-modules/skia-pathops/default.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/skia-pathops/default.nix b/pkgs/development/python-modules/skia-pathops/default.nix
index 9cb4775fa13c..0fefc6d41f7c 100644
--- a/pkgs/development/python-modules/skia-pathops/default.nix
+++ b/pkgs/development/python-modules/skia-pathops/default.nix
@@ -2,6 +2,7 @@
 , stdenv
 , buildPythonPackage
 , cython
+, isPyPy
 , ninja
 , setuptools-scm
 , setuptools
@@ -50,8 +51,10 @@ buildPythonPackage rec {
 
   meta = {
     description = "Python access to operations on paths using the Skia library";
-    homepage = "https://skia.org/dev/present/pathops";
+    homepage = "https://github.com/fonttools/skia-pathops";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.BarinovMaxim ];
+    # ERROR at //gn/BUILDCONFIG.gn:87:14: Script returned non-zero exit code.
+    broken = isPyPy;
   };
 }

From 19c40caf2c4743d48c28fb413af6422cfb4de4a9 Mon Sep 17 00:00:00 2001
From: Yt <raphael@megzari.com>
Date: Mon, 10 Jul 2023 07:06:52 +0800
Subject: [PATCH 40/42] cargo-espflash: 1.7.0 -> 2.0.0 (#242381)

---
 .../tools/rust/cargo-espflash/default.nix     | 27 +++++++++++++++----
 pkgs/top-level/all-packages.nix               |  2 +-
 2 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/tools/rust/cargo-espflash/default.nix b/pkgs/development/tools/rust/cargo-espflash/default.nix
index 26f935c58725..1439e9598783 100644
--- a/pkgs/development/tools/rust/cargo-espflash/default.nix
+++ b/pkgs/development/tools/rust/cargo-espflash/default.nix
@@ -1,27 +1,44 @@
-{ lib, rustPlatform, fetchFromGitHub, pkg-config, udev, stdenv, Security }:
+{
+  lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, udev
+, stdenv
+, Security
+, nix-update-script
+, openssl
+, SystemConfiguration
+}:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-espflash";
-  version = "1.7.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "esp-rs";
     repo = "espflash";
     rev = "v${version}";
-    sha256 = "sha256-AauIneSnacnY4mulD/qUgfN4K9tLzZXFug0oEsDuj18=";
+    hash = "sha256-3E0OC8DVP2muLyoN4DQfrdnK+idQEm7IpaA/CUIyYnU=";
   };
 
   nativeBuildInputs = [
     pkg-config
   ];
 
-  buildInputs = lib.optionals stdenv.isLinux [
+  # Needed to get openssl-sys to use pkg-config.
+  OPENSSL_NO_VENDOR = 1;
+
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isLinux [
     udev
   ] ++ lib.optionals stdenv.isDarwin [
     Security
+    SystemConfiguration
   ];
 
-  cargoSha256 = "sha256-82o3B6qmBVPpBVAogClmTbxrBRXY8Lmd2sHmonP5/s8=";
+  cargoHash = "sha256-8VIAmmtaQoIvD7wN+W3yUM0CEDadOQrv1wnJ4/AWKFA=";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     description = "Serial flasher utility for Espressif SoCs and modules based on esptool.py";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 41a5a35d93ae..c94b2b8aa504 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16666,7 +16666,7 @@ with pkgs;
   cargo2junit = callPackage ../development/tools/rust/cargo2junit { };
 
   cargo-espflash = callPackage ../development/tools/rust/cargo-espflash {
-    inherit (darwin.apple_sdk.frameworks) Security;
+    inherit (darwin.apple_sdk.frameworks) Security SystemConfiguration;
   };
 
   cargo-web = callPackage ../development/tools/rust/cargo-web {

From 6cd4468d96ad049ab2fbc67312ea84dee6799180 Mon Sep 17 00:00:00 2001
From: Vincenzo Mantova <1962985+xworld21@users.noreply.github.com>
Date: Mon, 10 Jul 2023 00:14:02 +0100
Subject: [PATCH 41/42] texlive: use lib.recursiveUpdate for tlpdb overrides
 (#242118)

---
 .../tools/typesetting/tex/texlive/default.nix | 38 +++++++------------
 1 file changed, 14 insertions(+), 24 deletions(-)

diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index def8b112011c..6ed1ba7e7942 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -34,40 +34,30 @@ let
   tl = let
     orig = removeAttrs tlpdb [ "00texlive.config" ];
 
-    overridden = orig // {
+    overridden = lib.recursiveUpdate orig {
       # overrides of texlive.tlpdb
 
       # only *.po for tlmgr
-      texlive-msg-translations = builtins.removeAttrs orig.texlive-msg-translations [ "hasTlpkg" ];
+      texlive-msg-translations.hasTlpkg = false;
 
-      xdvi = orig.xdvi // { # it seems to need it to transform fonts
-        deps = (orig.xdvi.deps or []) ++  [ "metafont" ];
-      };
+      # it seems to need it to transform fonts
+      xdvi.deps = (orig.xdvi.deps or []) ++  [ "metafont" ];
 
-      arabi-add = orig.arabi-add // {
-        # tlpdb lists license as "unknown", but the README says lppl13: http://mirrors.ctan.org/language/arabic/arabi-add/README
-        license = [  "lppl13c" ];
-      };
+      # tlpdb lists license as "unknown", but the README says lppl13: http://mirrors.ctan.org/language/arabic/arabi-add/README
+      arabi-add.license = [  "lppl13c" ];
 
       # TODO: remove this when updating to texlive-2023, npp-for-context is no longer in texlive
-      npp-for-context = orig.npp-for-context // {
-        # tlpdb lists license as "noinfo", but it's gpl3: https://github.com/luigiScarso/context-npp
-        license = [  "gpl3Only" ];
-      };
+      # tlpdb lists license as "noinfo", but it's gpl3: https://github.com/luigiScarso/context-npp
+      npp-for-context.license = [  "gpl3Only" ];
 
       # remove dependency-heavy packages from the basic collections
-      collection-basic = orig.collection-basic // {
-        deps = lib.filter (n: n != "metafont" && n != "xdvi") orig.collection-basic.deps;
-      };
-      # add them elsewhere so that collections cover all packages
-      collection-metapost = orig.collection-metapost // {
-        deps = orig.collection-metapost.deps ++ [ "metafont" ];
-      };
-      collection-plaingeneric = orig.collection-plaingeneric // {
-        deps = orig.collection-plaingeneric.deps ++ [ "xdvi" ];
-      };
+      collection-basic.deps = lib.subtractLists [ "metafont" "xdvi" ] orig.collection-basic.deps;
 
-      texdoc = orig.texdoc // {
+      # add them elsewhere so that collections cover all packages
+      collection-metapost.deps = orig.collection-metapost.deps ++ [ "metafont" ];
+      collection-plaingeneric.deps = orig.collection-plaingeneric.deps ++ [ "xdvi" ];
+
+      texdoc = {
         extraRevision = ".tlpdb${toString tlpdbVersion.revision}";
         extraVersion = "-tlpdb-${toString tlpdbVersion.revision}";
 

From cb34ad4c161f33d95888a91e9ccdb0096e63e516 Mon Sep 17 00:00:00 2001
From: icyrockcom <icyrock.com@icyrock.com>
Date: Sat, 8 Jul 2023 12:03:44 -0400
Subject: [PATCH 42/42] fuse-archive: init at 0.1.14

---
 .../filesystems/fuse-archive/default.nix      | 44 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 2 files changed, 46 insertions(+)
 create mode 100644 pkgs/tools/filesystems/fuse-archive/default.nix

diff --git a/pkgs/tools/filesystems/fuse-archive/default.nix b/pkgs/tools/filesystems/fuse-archive/default.nix
new file mode 100644
index 000000000000..031232acbe38
--- /dev/null
+++ b/pkgs/tools/filesystems/fuse-archive/default.nix
@@ -0,0 +1,44 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fuse
+, libarchive
+, pkg-config
+}:
+
+stdenv.mkDerivation rec {
+  pname = "fuse-archive";
+  version = "0.1.14";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "fuse-archive";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-l4tIK157Qo4m611etwMSk564+eC28x4RbmjX3J57/7Q=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    fuse
+    libarchive
+  ];
+
+  env.NIX_CFLAGS_COMPILE = "-D_FILE_OFFSET_BITS=64";
+
+  makeFlags = [
+    "prefix=${placeholder "out"}"
+  ];
+
+  meta = with lib; {
+    description = "Serve an archive or a compressed file as a read-only FUSE file system";
+    homepage = "https://github.com/google/fuse-archive";
+    changelog = "https://github.com/google/fuse-archive/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ icyrockcom ];
+  };
+
+  inherit (fuse.meta) platforms;
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c94b2b8aa504..75f7c262c4da 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7984,6 +7984,8 @@ with pkgs;
 
   fuse-7z-ng = callPackage ../tools/filesystems/fuse-7z-ng { };
 
+  fuse-archive = callPackage ../tools/filesystems/fuse-archive { };
+
   fuse-overlayfs = callPackage ../tools/filesystems/fuse-overlayfs { };
 
   fusee-interfacee-tk = callPackage ../applications/misc/fusee-interfacee-tk { };