Merge master into staging-next

2024-11-23 07:23:20 +00:00 · 2021-07-25 00:01:35 +00:00 · 2021-07-25 00:01:35 +00:00 · a37fbac53b
commit a37fbac53b
parent 859acbc1bc ecaf3da934
67 changed files with 775 additions and 312 deletions
--- a/nixos/modules/services/backup/syncoid.nix
+++ b/nixos/modules/services/backup/syncoid.nix
@ -5,14 +5,15 @@ with lib;
 let
  cfg = config.services.syncoid;

-  # Extract pool names of local datasets (ones that don't contain "@") that
-  # have the specified type (either "source" or "target")
-  getPools = type: unique (map (d: head (builtins.match "([^/]+).*" d)) (
-    # Filter local datasets
-    filter (d: !hasInfix "@" d)
-    # Get datasets of the specified type
-    (catAttrs type (attrValues cfg.commands))
-  ));
+  # Extract the pool name of a local dataset (any dataset not containing "@")
+  localPoolName = d: optionals (d != null) (
+    let m = builtins.match "([^/@]+)[^@]*" d; in
+    optionals (m != null) m);
+
+  # Escape as required by: https://www.freedesktop.org/software/systemd/man/systemd.unit.html
+  escapeUnitName = name:
+    lib.concatMapStrings (s: if lib.isList s then "-" else s)
+    (builtins.split "[^a-zA-Z0-9_.\\-]+" name);
 in {

    # Interface
@ -77,6 +78,14 @@ in {
        '';
      };

+      service = mkOption {
+        type = types.attrs;
+        default = {};
+        description = ''
+          Systemd configuration common to all syncoid services.
+        '';
+      };
+
      commands = mkOption {
        type = types.attrsOf (types.submodule ({ name, ... }: {
          options = {
@ -99,13 +108,7 @@ in {
              '';
            };

-            recursive = mkOption {
-              type = types.bool;
-              default = false;
-              description = ''
-                Whether to also transfer child datasets.
-              '';
-            };
+            recursive = mkEnableOption ''the transfer of child datasets'';

            sshKey = mkOption {
              type = types.nullOr types.path;
@ -145,6 +148,14 @@ in {
              '';
            };

+            service = mkOption {
+              type = types.attrs;
+              default = {};
+              description = ''
+                Systemd configuration specific to this syncoid service.
+              '';
+            };
+
            extraArgs = mkOption {
              type = types.listOf types.str;
              default = [];
@ -170,11 +181,15 @@ in {
    # Implementation

    config = mkIf cfg.enable {
-      users =  {
+      users = {
        users = mkIf (cfg.user == "syncoid") {
          syncoid = {
            group = cfg.group;
            isSystemUser = true;
+            # For syncoid to be able to create /var/lib/syncoid/.ssh/
+            # and to use custom ssh_config or known_hosts.
+            home = "/var/lib/syncoid";
+            createHome = false;
          };
        };
        groups = mkIf (cfg.group == "syncoid") {
@ -182,35 +197,99 @@ in {
        };
      };

-      systemd.services.syncoid = {
-        description = "Syncoid ZFS synchronization service";
-        script = concatMapStringsSep "\n" (c: lib.escapeShellArgs
-          ([ "${pkgs.sanoid}/bin/syncoid" ]
-            ++ (optionals c.useCommonArgs cfg.commonArgs)
-            ++ (optional c.recursive "-r")
-            ++ (optionals (c.sshKey != null) [ "--sshkey" c.sshKey ])
-            ++ c.extraArgs
-            ++ [ "--sendoptions" c.sendOptions
-                 "--recvoptions" c.recvOptions
-                 "--no-privilege-elevation"
-                 c.source c.target
-               ])) (attrValues cfg.commands);
-        after = [ "zfs.target" ];
-        serviceConfig = {
-          ExecStartPre = let
-            allowCmd = permissions: pool: lib.escapeShellArgs [
-              "+/run/booted-system/sw/bin/zfs" "allow"
-              cfg.user (concatStringsSep "," permissions) pool
-            ];
-          in
-            (map (allowCmd [ "hold" "send" "snapshot" "destroy" ]) (getPools "source")) ++
-            (map (allowCmd [ "create" "mount" "receive" "rollback" ]) (getPools "target"));
-          User = cfg.user;
-          Group = cfg.group;
-        };
-        startAt = cfg.interval;
-      };
+      systemd.services = mapAttrs' (name: c:
+        nameValuePair "syncoid-${escapeUnitName name}" (mkMerge [
+          { description = "Syncoid ZFS synchronization from ${c.source} to ${c.target}";
+            after = [ "zfs.target" ];
+            startAt = cfg.interval;
+            # syncoid may need zpool to get feature@extensible_dataset
+            path = [ "/run/booted-system/sw/bin/" ];
+            serviceConfig = {
+              ExecStartPre =
+                map (pool: lib.escapeShellArgs [
+                  "+/run/booted-system/sw/bin/zfs" "allow"
+                  cfg.user "bookmark,hold,send,snapshot,destroy" pool
+                  # Permissions snapshot and destroy are in case --no-sync-snap is not used
+                ]) (localPoolName c.source) ++
+                map (pool: lib.escapeShellArgs [
+                  "+/run/booted-system/sw/bin/zfs" "allow"
+                  cfg.user "create,mount,receive,rollback" pool
+                ]) (localPoolName c.target);
+              ExecStart = lib.escapeShellArgs ([ "${pkgs.sanoid}/bin/syncoid" ]
+                ++ optionals c.useCommonArgs cfg.commonArgs
+                ++ optional c.recursive "-r"
+                ++ optionals (c.sshKey != null) [ "--sshkey" c.sshKey ]
+                ++ c.extraArgs
+                ++ [ "--sendoptions" c.sendOptions
+                     "--recvoptions" c.recvOptions
+                     "--no-privilege-elevation"
+                     c.source c.target
+                   ]);
+              User = cfg.user;
+              Group = cfg.group;
+              StateDirectory = [ "syncoid" ];
+              StateDirectoryMode = "700";
+              # Prevent SSH control sockets of different syncoid services from interfering
+              PrivateTmp = true;
+              # Permissive access to /proc because syncoid
+              # calls ps(1) to detect ongoing `zfs receive`.
+              ProcSubset = "all";
+              ProtectProc = "default";
+
+              # The following options are only for optimizing:
+              # systemd-analyze security | grep syncoid-'*'
+              AmbientCapabilities = "";
+              CapabilityBoundingSet = "";
+              DeviceAllow = ["/dev/zfs"];
+              LockPersonality = true;
+              MemoryDenyWriteExecute = true;
+              NoNewPrivileges = true;
+              PrivateDevices = true;
+              PrivateMounts = true;
+              PrivateNetwork = mkDefault false;
+              PrivateUsers = true;
+              ProtectClock = true;
+              ProtectControlGroups = true;
+              ProtectHome = true;
+              ProtectHostname = true;
+              ProtectKernelLogs = true;
+              ProtectKernelModules = true;
+              ProtectKernelTunables = true;
+              ProtectSystem = "strict";
+              RemoveIPC = true;
+              RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+              RestrictNamespaces = true;
+              RestrictRealtime = true;
+              RestrictSUIDSGID = true;
+              RootDirectory = "/run/syncoid/${escapeUnitName name}";
+              RootDirectoryStartOnly = true;
+              BindPaths = [ "/dev/zfs" ];
+              BindReadOnlyPaths = [ builtins.storeDir "/etc" "/run" "/bin/sh" ];
+              # Avoid useless mounting of RootDirectory= in the own RootDirectory= of ExecStart='s mount namespace.
+              InaccessiblePaths = ["-+/run/syncoid/${escapeUnitName name}"];
+              MountAPIVFS = true;
+              # Create RootDirectory= in the host's mount namespace.
+              RuntimeDirectory = [ "syncoid/${escapeUnitName name}" ];
+              RuntimeDirectoryMode = "700";
+              SystemCallFilter = [
+                "@system-service"
+                # Groups in @system-service which do not contain a syscall listed by:
+                # perf stat -x, 2>perf.log -e 'syscalls:sys_enter_*' syncoid …
+                # awk >perf.syscalls -F "," '$1 > 0 {sub("syscalls:sys_enter_","",$3); print $3}' perf.log
+                # systemd-analyze syscall-filter | grep -v -e '#' | sed -e ':loop; /^[^ ]/N; s/\n //; t loop' | grep $(printf ' -e \\<%s\\>' $(cat perf.syscalls)) | cut -f 1 -d ' '
+                "~@aio" "~@chown" "~@keyring" "~@memlock" "~@privileged"
+                "~@resources" "~@setuid" "~@sync" "~@timer"
+              ];
+              SystemCallArchitectures = "native";
+              # This is for BindPaths= and BindReadOnlyPaths=
+              # to allow traversal of directories they create in RootDirectory=.
+              UMask = "0066";
+            };
+          }
+          cfg.service
+          c.service
+        ])) cfg.commands;
    };

-    meta.maintainers = with maintainers; [ lopsided98 ];
+    meta.maintainers = with maintainers; [ julm lopsided98 ];
  }
--- a/nixos/tests/sanoid.nix
+++ b/nixos/tests/sanoid.nix
@ -44,7 +44,7 @@ in {
          # Sync snapshot taken by sanoid
          "pool/sanoid" = {
            target = "root@target:pool/sanoid";
-            extraArgs = [ "--no-sync-snap" ];
+            extraArgs = [ "--no-sync-snap" "--create-bookmark" ];
          };
          # Take snapshot and sync
          "pool/syncoid".target = "root@target:pool/syncoid";
@ -92,8 +92,9 @@ in {
    # Sync snapshots
    target.wait_for_open_port(22)
    source.succeed("touch /mnt/pool/syncoid/test.txt")
-    source.systemctl("start --wait syncoid.service")
+    source.systemctl("start --wait syncoid-pool-sanoid.service")
    target.succeed("cat /mnt/pool/sanoid/test.txt")
+    source.systemctl("start --wait syncoid-pool-syncoid.service")
    target.succeed("cat /mnt/pool/syncoid/test.txt")
  '';
 })
--- a/pkgs/applications/editors/aseprite/skia.nix
+++ b/pkgs/applications/editors/aseprite/skia.nix
@ -16,7 +16,8 @@ let
  });
 in
 stdenv.mkDerivation {
-  name = "skia-aseprite-m71";
+  pname = "skia";
+  version = "aseprite-m71";

  src = fetchFromGitHub {
    owner = "aseprite";
@ -73,4 +74,12 @@ stdenv.mkDerivation {
      third_party/externals/angle2/include \
      third_party/skcms/**/*.h
  '';
+
+  meta = with lib; {
+    description = "Skia is a complete 2D graphic library for drawing Text, Geometries, and Images";
+    homepage = "https://skia.org/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
+    platforms = platforms.all;
+  };
 }
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@ -1,53 +1,56 @@
 { lib
 , fetchFromGitHub
-, xz
 , wrapQtAppsHook
 , miniupnpc_2
+, ffmpeg
 , enableSwftools ? false
 , swftools
-, pythonPackages
+, python3Packages
 }:

-pythonPackages.buildPythonPackage rec {
+python3Packages.buildPythonPackage rec {
  pname = "hydrus";
-  version = "441";
+  version = "447";
  format = "other";

  src = fetchFromGitHub {
    owner = "hydrusnetwork";
    repo = "hydrus";
    rev = "v${version}";
-    sha256 = "13h4qcz0iqba4mwyvgmdqh99jy22x7kw20f3g43b5aq3qyk9ca2h";
+    sha256 = "0a9nrsbw3w1229bm90xayixvkpvr6g338w64x4v75sqxvpbx84lz";
  };

  nativeBuildInputs = [
    wrapQtAppsHook
  ];

-  propagatedBuildInputs = with pythonPackages; [
+  propagatedBuildInputs = with python3Packages; [
    beautifulsoup4
+    chardet
+    cloudscraper
    html5lib
    lxml
+    lz4
+    nose
    numpy
    opencv4
    pillow
    psutil
+    pylzma
    pyopenssl
+    pyside2
+    pysocks
+    pythonPackages.mpv
    pyyaml
+    qtpy
    requests
    send2trash
    service-identity
+    six
    twisted
-    lz4
-    xz
-    pysocks
-    matplotlib
-    qtpy
-    pyside2
-    mpv
  ];

-  checkInputs = with pythonPackages; [ nose httmock ];
+  checkInputs = with python3Packages; [ nose mock httmock ];

  # most tests are failing, presumably because we are not using test.py
  checkPhase = ''
@ -77,37 +80,34 @@ pythonPackages.buildPythonPackage rec {

  outputs = [ "out" "doc" ];

-  postPatch = ''
-    sed 's;os\.path\.join(\sHC\.BIN_DIR,.*;"${miniupnpc_2}/bin/upnpc";' \
-      -i ./hydrus/core/networking/HydrusNATPunch.py
-  '' + lib.optionalString enableSwftools ''
-    sed 's;os\.path\.join(\sHC\.BIN_DIR,.*;"${swftools}/bin/swfrender";' \
-      -i ./hydrus/core/HydrusFlashHandling.py
-  '';
-
-  #doCheck = true;
-
  installPhase = ''
    # Move the hydrus module and related directories
-    mkdir -p $out/${pythonPackages.python.sitePackages}
-    mv {hydrus,static} $out/${pythonPackages.python.sitePackages}
+    mkdir -p $out/${python3Packages.python.sitePackages}
+    mv {hydrus,static} $out/${python3Packages.python.sitePackages}
    mv help $out/doc/

    # install the hydrus binaries
    mkdir -p $out/bin
    install -m0755 server.py $out/bin/hydrus-server
    install -m0755 client.py $out/bin/hydrus-client
+  '' + lib.optionalString enableSwftools ''
+    mkdir -p $out/${python3Packages.python.sitePackages}/bin
+    # swfrender seems to have to be called sfwrender_linux
+    # not sure if it can be loaded through PATH, but this is simpler
+    # $out/python3Packages.python.sitePackages/bin is correct NOT .../hydrus/bin
+    ln -s ${swftools}/bin/swfrender $out/${python3Packages.python.sitePackages}/bin/swfrender_linux
  '';

  dontWrapQtApps = true;
  preFixup = ''
    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+    makeWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ ffmpeg miniupnpc_2 ]})
  '';

  meta = with lib; {
    description = "Danbooru-like image tagging and searching system for the desktop";
    license = licenses.wtfpl;
    homepage = "https://hydrusnetwork.github.io/hydrus/";
-    maintainers = [ maintainers.evanjs ];
+    maintainers = with maintainers; [ dandellion evanjs ];
  };
 }
--- a/pkgs/applications/graphics/xournalpp/default.nix
+++ b/pkgs/applications/graphics/xournalpp/default.nix
@ -9,6 +9,7 @@
 , glib
 , gsettings-desktop-schemas
 , gtk3
+, librsvg
 , libsndfile
 , libxml2
 , libzip
@ -22,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "xournalpp";
-  version = "1.0.20";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "xournalpp";
    repo = pname;
    rev = version;
-    sha256 = "1c7n03xm3m4lwcwxgplkn25i8c6s3i7rijbkcx86br1j4jadcs3k";
+    sha256 = "sha256-FIIpWgWvq1uo/lIQXpOkUTZ6YJPtOtxKF8VjXSgqrlE=";
  };

  nativeBuildInputs = [ cmake gettext pkg-config wrapGAppsHook ];
@ -36,6 +37,7 @@ stdenv.mkDerivation rec {
    [ glib
      gsettings-desktop-schemas
      gtk3
+      librsvg
      libsndfile
      libxml2
      libzip
--- a/pkgs/applications/misc/josm/default.nix
+++ b/pkgs/applications/misc/josm/default.nix
@ -3,20 +3,20 @@
 }:
 let
  pname = "josm";
-  version = "17919";
+  version = "18004";
  srcs = {
    jar = fetchurl {
      url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      sha256 = "sha256-Bj1s3vFSHPiZNTjp7hQhu1X2v8nlynC37Cm6sMNOi3g=";
+      sha256 = "sha256-Cd+/sE6A0MddHeAxy3gx7ev+9UR3ZNcR0tCTmdX2FtY=";
    };
    macosx = fetchurl {
      url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java16.zip";
-      sha256 = "sha256-W+s6ARA5lyRwTuRD89wm4HChb2Up5AXQwh5uk0U7pQk=";
+      sha256 = "sha256-QSVh8043K/f7gPEjosGo/DNj1d75LUFwf6EMeHk68fM=";
    };
    pkg = fetchsvn {
      url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
      rev = version;
-      sha256 = "sha256-IjCFngixh2+7SifrV3Ohi1BjIOP+QSWg/QjeqbbP7aw=";
+      sha256 = "sha256-Ic6RtQPqpQIci1IbKgTcFmLfMdPxSVybrEAk+ttM0j8=";
    };
  };
 in
--- a/pkgs/applications/misc/snixembed/default.nix
+++ b/pkgs/applications/misc/snixembed/default.nix
@ -0,0 +1,28 @@
+{ fetchFromSourcehut, gtk3, lib, libdbusmenu-gtk3, pkg-config, stdenv, vala }:
+
+stdenv.mkDerivation rec {
+  pname = "snixembed";
+  version = "0.3.1";
+
+  src = fetchFromSourcehut {
+    owner = "~steef";
+    repo = pname;
+    rev = version;
+    sha256 = "0yy1i4463q43aq98qk4nvvzpw4i6bid2bywwgf6iq545pr3glfj5";
+  };
+
+  nativeBuildInputs = [ pkg-config vala ];
+
+  buildInputs = [ gtk3 libdbusmenu-gtk3 ];
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    description = "Proxy StatusNotifierItems as XEmbedded systemtray-spec icons";
+    homepage = "https://git.sr.ht/~steef/snixembed";
+    changelog = "https://git.sr.ht/~steef/snixembed/refs/${version}";
+    license = licenses.isc;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
--- a/pkgs/applications/networking/cluster/linkerd/default.nix
+++ b/pkgs/applications/networking/cluster/linkerd/default.nix
@ -64,8 +64,8 @@ in
    };
    edge = generic {
      channel = "edge";
-      version = "21.7.3";
-      sha256 = "sha256-fEkqZ/4BQVnmOKUrrLmi6DKlMVNeqvW95bxbZX0o7iI=";
-      vendorSha256 = "sha256-NqOmmeEGWvy/LYfSpIdnJZX4lGweCgiL008ed05XIFs=";
+      version = "21.7.4";
+      sha256 = "sha256-yorxP4SQVV6MWlx8+8l0f7qOaF7aJ1XiPfnMqKC8m/o=";
+      vendorSha256 = "sha256-2ZDsBiIV9ng8P0cDURbqDqMTxFKUFcBxHsPGWp5WjPo=";
    };
  }
--- a/pkgs/applications/networking/cluster/temporal/default.nix
+++ b/pkgs/applications/networking/cluster/temporal/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "temporal";
-  version = "1.11.1";
+  version = "1.11.2";

  src = fetchFromGitHub {
    owner = "temporalio";
    repo = "temporal";
    rev = "v${version}";
-    sha256 = "sha256-upoWftm82QBdax0lbeu+Nmwscsj/fsOzGUPI+fzcKUM=";
+    sha256 = "sha256-DskJtZGp8zmSWC5GJijNbhwKQF0Y0FXXh7wCzlbAgy8=";
  };

-  vendorSha256 = "sha256-eO/23MQpdXQNPCIzMC9nxvrgUFuEPABJ7vkBZKv+XZI";
+  vendorSha256 = "sha256-eO/23MQpdXQNPCIzMC9nxvrgUFuEPABJ7vkBZKv+XZI=";

  # Errors:
  #  > === RUN   TestNamespaceHandlerGlobalNamespaceDisabledSuite
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -375,19 +375,19 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/google",
    "repo": "terraform-provider-google",
-    "rev": "v3.62.0",
-    "sha256": "0x0qp8nk88667hvlpgxrdjsgirw8iwv85gn3k9xb37a3lw7xs4qz",
-    "vendorSha256": "0w6aavj1c4blpvsy00vz4dcj8rnxx6a586b16lqp6s1flqmlqrbi",
-    "version": "3.62.0"
+    "rev": "v3.76.0",
+    "sha256": "1j3q07v4r0a3mlkmpqw8nav5z09fwyms9xmlyk6k6xkkzr520xcp",
+    "vendorSha256": "1ffxfracj4545fzh6p6b0wal0j07807qc2q83qzchbalqvi7yhky",
+    "version": "3.76.0"
  },
  "google-beta": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
    "repo": "terraform-provider-google-beta",
-    "rev": "v3.47.0",
-    "sha256": "1nk0bg2q7dg65rn3j5pkdjv07x0gs7bkv1bpfvlhi9p4fzx9g4by",
-    "vendorSha256": "0c2q4d2khsi3v9b659q1kmncnlshv4px6ch99jpcymwqg3xrxda2",
-    "version": "3.47.0"
+    "rev": "v3.76.0",
+    "sha256": "1bdhk4vfn8pn7ql5q8m4r8js8d73zyp3dbhrmh4p07g7i5z57pjq",
+    "vendorSha256": "0cwvkzw45b057gwbj24z9gyldjpyfgv3fyr5x160spj0ksfn0ki0",
+    "version": "3.76.0"
  },
  "grafana": {
    "owner": "grafana",
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator/default.nix
@ -0,0 +1,33 @@
+{ autoreconfHook
+, fetchFromGitHub
+, glib
+, intltool
+, lib
+, libappindicator-gtk2
+, libtool
+, pidgin
+, stdenv
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pidgin-indicator";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "philipl";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-CdA/aUu+CmCRbVBKpJGydicqFQa/rEsLWS3MBKlH2/M=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ glib intltool libappindicator-gtk2 libtool pidgin ];
+
+  meta = with lib; {
+    description = "An AppIndicator and KStatusNotifierItem Plugin for Pidgin";
+    homepage = "https://github.com/philipl/pidgin-indicator";
+    maintainers = with maintainers; [ imalison ];
+    license = licenses.gpl2;
+    platforms = with platforms; linux;
+  };
+}
--- a/pkgs/applications/science/biology/bedops/default.nix
+++ b/pkgs/applications/science/biology/bedops/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "bedops";
-  version = "2.4.39";
+  version = "2.4.40";

  src = fetchFromGitHub {
    owner = "bedops";
    repo = "bedops";
    rev = "v${version}";
-    sha256 = "sha256-vPrut3uhZK1Eg9vPcyxVNWW4zKeypdsb28oM1xbbpJo=";
+    sha256 = "sha256-rJVl3KbzGblyQZ7FtJXeEv/wjQJmzYGNjzhvkoMoBWY=";
  };

  buildInputs = [ zlib bzip2 jansson ];
--- a/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-annex-remote-googledrive/default.nix
@ -10,11 +10,11 @@

 buildPythonApplication rec {
  pname = "git-annex-remote-googledrive";
-  version = "1.3.0";
+  version = "1.3.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "118w0fyy6pck8hyj925ym6ak0xxqhkaq2vharnpl9b97nab4mqg8";
+    sha256 = "0rwjcdvfgzdlfgrn1rrqwwwiqqzyh114qddrbfwd46ld5spry6r1";
  };

  propagatedBuildInputs = [ annexremote drivelib GitPython tenacity humanfriendly ];
--- a/pkgs/applications/window-managers/hikari/default.nix
+++ b/pkgs/applications/window-managers/hikari/default.nix
@ -1,8 +1,8 @@
-{ lib, stdenv, fetchzip, fetchpatch,
-  pkg-config, bmake,
-  cairo, glib, libevdev, libinput, libxkbcommon, linux-pam, pango, pixman,
-  libucl, wayland, wayland-protocols, wlroots, mesa,
-  features ? {
+{ lib, stdenv, fetchzip
+, pkg-config, bmake
+, cairo, glib, libevdev, libinput, libxkbcommon, linux-pam, pango, pixman
+, libucl, wayland, wayland-protocols, wlroots, mesa
+, features ? {
    gammacontrol = true;
    layershell   = true;
    screencopy   = true;
@ -10,17 +10,13 @@
  }
 }:

-let
+stdenv.mkDerivation rec {
  pname = "hikari";
-  version = "2.3.1";
-in
-
-stdenv.mkDerivation {
-  inherit pname version;
+  version = "2.3.2";

  src = fetchzip {
    url = "https://hikari.acmelabs.space/releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-o6YsUATcWHSuAEfU7WnwxKNxRNuBt069qCv0FKDWStg=";
+    sha256 = "sha256-At4b6mkArKe6knNWouLdZ9v8XhfHaUW+aB+CHyEBg8o=";
  };

  nativeBuildInputs = [ pkg-config bmake ];
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@ -110,7 +110,7 @@ in
  };

  noto-fonts-emoji = let
-    version = "2020-09-16-unicode13_1";
+    version = "2.028";
    emojiPythonEnv =
      python3.withPackages (p: with p; [ fonttools nototools ]);
  in stdenv.mkDerivation {
@ -121,7 +121,7 @@ in
      owner = "googlefonts";
      repo = "noto-emoji";
      rev = "v${version}";
-      sha256 = "0659336dp0l2nkac153jpcb9yvp0p3dx1crcyxjd14i8cqkfi2hh";
+      sha256 = "0dy7px7wfl6bqkfzz82jm4gvbjp338ddsx0mwfl6m7z48l7ng4v6";
    };

    nativeBuildInputs = [
--- a/pkgs/development/libraries/drogon/default.nix
+++ b/pkgs/development/libraries/drogon/default.nix
@ -1,7 +1,7 @@
-{ stdenv, fetchFromGitHub, cmake, jsoncpp, libossp_uuid, zlib, openssl, lib
-# miscellaneous
-, brotli, c-ares
-# databases
+{ stdenv, fetchFromGitHub, cmake, jsoncpp, libossp_uuid, zlib, lib
+# optional but of negligible size
+, openssl, brotli, c-ares
+# optional databases
 , sqliteSupport ? true, sqlite
 , postgresSupport ? false, postgresql
 , redisSupport ? false, hiredis
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
  version = "1.7.1";

  src = fetchFromGitHub {
-    owner = "an-tao";
+    owner = "drogonframework";
    repo = "drogon";
    rev = "v${version}";
    sha256 = "0rhwbz3m5x3vy5zllfs8r347wqprg29pff5q7i53f25bh8y0n49i";
@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
  ] ++ lib.optional sqliteSupport sqlite
    ++ lib.optional postgresSupport postgresql
    ++ lib.optional redisSupport hiredis
-    # drogon uses mariadb for mysql (see https://github.com/an-tao/drogon/wiki/ENG-02-Installation#Library-Dependencies)
+    # drogon uses mariadb for mysql (see https://github.com/drogonframework/drogon/wiki/ENG-02-Installation#Library-Dependencies)
    ++ lib.optional mysqlSupport [ libmysqlclient mariadb ];

  patches = [
@ -48,17 +48,16 @@ stdenv.mkDerivation rec {
  # modifying PATH here makes drogon_ctl visible to the test
  installCheckPhase = ''
    cd ..
-    patchShebangs test.sh
-    PATH=$PATH:$out/bin ./test.sh
+    PATH=$PATH:$out/bin bash test.sh
  '';

  doInstallCheck = true;

  meta = with lib; {
-    homepage = "https://github.com/an-tao/drogon";
+    homepage = "https://github.com/drogonframework/drogon";
    description = "C++14/17 based HTTP web application framework";
    license = licenses.mit;
-    maintainers = [ maintainers.urlordjames ];
+    maintainers = with maintainers; [ urlordjames ];
    platforms = platforms.all;
  };
 }
--- a/pkgs/development/libraries/ffmpeg-full/default.nix
+++ b/pkgs/development/libraries/ffmpeg-full/default.nix
@ -74,6 +74,7 @@
 , libcaca ? null # Textual display (ASCII art)
 #, libcdio-paranoia ? null # Audio CD grabbing
 , libdc1394 ? null, libraw1394 ? null # IIDC-1394 grabbing (ieee 1394)
+, libdrm ? null # libdrm support
 , libiconv ? null
 #, libiec61883 ? null, libavc1394 ? null # iec61883 (also uses libraw1394)
 , libmfx ? null # Hardware acceleration vis libmfx
@ -348,6 +349,7 @@ stdenv.mkDerivation rec {
    #(enableFeature (libcaca != null) "libcaca")
    #(enableFeature (cdio-paranoia != null && gplLicensing) "libcdio")
    (enableFeature (if isLinux then libdc1394 != null && libraw1394 != null else false) "libdc1394")
+    (enableFeature ((isLinux || isFreeBSD) && libdrm != null) "libdrm")
    (enableFeature (libiconv != null) "iconv")
    (enableFeature (libjack2 != null) "libjack")
    #(enableFeature (if isLinux then libiec61883 != null && libavc1394 != null && libraw1394 != null else false) "libiec61883")
@ -432,6 +434,7 @@ stdenv.mkDerivation rec {
  ] ++ optionals openglExtlib [ libGL libGLU ]
    ++ optionals nonfreeLicensing [ fdk_aac openssl ]
    ++ optional ((isLinux || isFreeBSD) && libva != null) libva
+    ++ optional ((isLinux || isFreeBSD) && libdrm != null) libdrm
    ++ optional (!isAarch64 && libvmaf != null && version3Licensing) libvmaf
    ++ optionals isLinux [ alsa-lib libraw1394 libv4l vulkan-loader glslang ]
    ++ optional (isLinux && !isAarch64 && libmfx != null) libmfx
--- a/pkgs/development/libraries/gstreamer/default.nix
+++ b/pkgs/development/libraries/gstreamer/default.nix
@ -1,29 +1,27 @@
 { callPackage, AudioToolbox, AVFoundation, Cocoa, CoreFoundation, CoreMedia, CoreServices, CoreVideo, DiskArbitration, Foundation, IOKit, MediaToolbox, OpenGL, VideoToolbox }:

-rec {
+{
  gstreamer = callPackage ./core { inherit CoreServices; };

  gstreamermm = callPackage ./gstreamermm { };

-  gst-plugins-base = callPackage ./base { inherit gstreamer Cocoa OpenGL; };
+  gst-plugins-base = callPackage ./base { inherit Cocoa OpenGL; };

-  gst-plugins-good = callPackage ./good { inherit gst-plugins-base Cocoa; };
+  gst-plugins-good = callPackage ./good { inherit Cocoa; };

-  gst-plugins-bad = callPackage ./bad { inherit gst-plugins-base AudioToolbox AVFoundation CoreMedia CoreVideo Foundation MediaToolbox VideoToolbox; };
+  gst-plugins-bad = callPackage ./bad { inherit AudioToolbox AVFoundation CoreMedia CoreVideo Foundation MediaToolbox VideoToolbox; };

-  gst-plugins-ugly = callPackage ./ugly { inherit gst-plugins-base CoreFoundation DiskArbitration IOKit; };
+  gst-plugins-ugly = callPackage ./ugly { inherit CoreFoundation DiskArbitration IOKit; };

-  gst-rtsp-server = callPackage ./rtsp-server { inherit gst-plugins-base gst-plugins-bad; };
+  gst-rtsp-server = callPackage ./rtsp-server { };

-  gst-libav = callPackage ./libav { inherit gst-plugins-base; };
+  gst-libav = callPackage ./libav { };

-  gst-devtools = callPackage ./devtools { inherit gstreamer gst-plugins-base; };
+  gst-devtools = callPackage ./devtools { };

-  gst-editing-services = callPackage ./ges { inherit gst-plugins-base gst-plugins-bad gst-devtools; };
+  gst-editing-services = callPackage ./ges { };

-  gst-vaapi = callPackage ./vaapi {
-    inherit gst-plugins-base gstreamer gst-plugins-bad;
-  };
+  gst-vaapi = callPackage ./vaapi { };

  # note: gst-python is in ./python/default.nix - called under pythonPackages
 }
--- a/pkgs/development/libraries/hamlib/4.nix
+++ b/pkgs/development/libraries/hamlib/4.nix
@ -0,0 +1,64 @@
+{ lib
+, stdenv
+, fetchurl
+, perl
+, swig
+, gd
+, ncurses
+, python3
+, libxml2
+, tcl
+, libusb-compat-0_1
+, pkg-config
+, boost
+, libtool
+, perlPackages
+, pythonBindings ? true
+, tclBindings ? true
+, perlBindings ? true
+}:
+
+stdenv.mkDerivation rec {
+  pname = "hamlib";
+  version = "4.2";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
+    sha256 = "1m8gb20i8ga6ndnnw187ry1h4z8wx27v1hl7c610r6ky60pv4072";
+  };
+
+  nativeBuildInputs = [
+    swig
+    pkg-config
+    libtool
+  ];
+
+  buildInputs = [
+    gd
+    libxml2
+    libusb-compat-0_1
+    boost
+  ] ++ lib.optionals pythonBindings [ python3 ncurses ]
+    ++ lib.optionals tclBindings [ tcl ]
+    ++ lib.optionals perlBindings [ perl perlPackages.ExtUtilsMakeMaker ];
+
+  configureFlags = lib.optionals perlBindings [ "--with-perl-binding" ]
+    ++ lib.optionals tclBindings [ "--with-tcl-binding" "--with-tcl=${tcl}/lib/" ]
+    ++ lib.optionals pythonBindings [ "--with-python-binding" ];
+
+  meta = with lib; {
+    description = "Runtime library to control radio transceivers and receivers";
+    longDescription = ''
+    Hamlib provides a standardized programming interface that applications
+    can use to send the appropriate commands to a radio.
+
+    Also included in the package is a simple radio control program 'rigctl',
+    which lets one control a radio transceiver or receiver, either from
+    command line interface or in a text-oriented interactive interface.
+    '';
+    license = with licenses; [ gpl2Plus lgpl2Plus ];
+    homepage = "http://hamlib.sourceforge.net";
+    maintainers = with maintainers; [ relrod ];
+    platforms = with platforms; unix;
+  };
+}
--- a/pkgs/development/libraries/hamlib/default.nix
+++ b/pkgs/development/libraries/hamlib/default.nix
@ -1,5 +1,22 @@
-{lib, stdenv, fetchurl, perl, python2, swig, gd, libxml2, tcl, libusb-compat-0_1, pkg-config,
- boost, libtool, perlPackages }:
+{ lib
+, stdenv
+, fetchurl
+, perl
+, swig
+, gd
+, ncurses
+, python3
+, libxml2
+, tcl
+, libusb-compat-0_1
+, pkg-config
+, boost
+, libtool
+, perlPackages
+, pythonBindings ? true
+, tclBindings ? true
+, perlBindings ? true
+}:

 stdenv.mkDerivation rec {
  pname = "hamlib";
@ -10,13 +27,26 @@ stdenv.mkDerivation rec {
    sha256 = "10788mgrhbc57zpzakcxv5aqnr2819pcshml6fbh8zvnkja562y9";
  };

-  buildInputs = [ perl perlPackages.ExtUtilsMakeMaker python2 swig gd libxml2
-                  tcl libusb-compat-0_1 pkg-config boost libtool ];
+  nativeBuildInputs = [
+    swig
+    pkg-config
+    libtool
+  ];

-  configureFlags = [ "--with-perl-binding" "--with-python-binding"
-                     "--with-tcl-binding" "--with-rigmatrix" ];
+  buildInputs = [
+    gd
+    libxml2
+    libusb-compat-0_1
+    boost
+  ] ++ lib.optionals pythonBindings [ python3 ncurses ]
+    ++ lib.optionals tclBindings [ tcl ]
+    ++ lib.optionals perlBindings [ perl perlPackages.ExtUtilsMakeMaker ];

-  meta = {
+  configureFlags = lib.optionals perlBindings [ "--with-perl-binding" ]
+    ++ lib.optionals tclBindings [ "--with-tcl-binding" "--with-tcl=${tcl}/lib/" ]
+    ++ lib.optionals pythonBindings [ "--with-python-binding" ];
+
+  meta = with lib; {
    description = "Runtime library to control radio transceivers and receivers";
    longDescription = ''
    Hamlib provides a standardized programming interface that applications
@ -26,9 +56,9 @@ stdenv.mkDerivation rec {
    which lets one control a radio transceiver or receiver, either from
    command line interface or in a text-oriented interactive interface.
    '';
-    license = with lib.licenses; [ gpl2Plus lgpl2Plus ];
+    license = with licenses; [ gpl2Plus lgpl2Plus ];
    homepage = "http://hamlib.sourceforge.net";
-    maintainers = with lib.maintainers; [ relrod ];
-    platforms = with lib.platforms; unix;
+    maintainers = with maintainers; [ relrod ];
+    platforms = with platforms; unix;
  };
 }
--- a/pkgs/development/libraries/librsync/0.9.nix
+++ b/pkgs/development/libraries/librsync/0.9.nix
@ -1,26 +0,0 @@
-{ lib, stdenv, fetchurl }:
-
-stdenv.mkDerivation {
-  name = "librsync-0.9.7";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/librsync/librsync-0.9.7.tar.gz";
-    sha256 = "1mj1pj99mgf1a59q9f2mxjli2fzxpnf55233pc1klxk2arhf8cv6";
-  };
-
-  hardeningDisable = [ "format" ];
-
-  configureFlags = [
-    (lib.enableFeature stdenv.isCygwin    "static")
-    (lib.enableFeature (!stdenv.isCygwin) "shared")
-  ];
-
-  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
-
-  meta = {
-    homepage = "http://librsync.sourceforge.net/";
-    license = lib.licenses.lgpl2Plus;
-    description = "Implementation of the rsync remote-delta algorithm";
-    platforms = lib.platforms.unix;
-  };
-}
--- a/pkgs/development/libraries/libxlsxwriter/default.nix
+++ b/pkgs/development/libraries/libxlsxwriter/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "libxlsxwriter";
-  version = "1.0.9";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "jmcnamara";
    repo = "libxlsxwriter";
    rev = "RELEASE_${version}";
-    sha256 = "sha256-6MMQr0ynMmfZj+RFoKtLB/f1nTBfn9tcYpzyUwnfB3M=";
+    sha256 = "1bi8a1pj18836yfqsnmfp45nqhq2d9r2r7gzi2v1y0qyk9jh6xln";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/GitPython/default.nix
+++ b/pkgs/development/python-modules/GitPython/default.nix
@ -12,12 +12,12 @@

 buildPythonPackage rec {
  pname = "GitPython";
-  version = "3.1.18";
-  disabled = isPy27; # no longer supported
+  version = "3.1.19";
+  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "b838a895977b45ab6f0cc926a9045c8d1c44e2b653c1fcc39fe91f42c6e8f05b";
+    sha256 = "0lqf5plm02aw9zl73kffk7aa4mp4girm3f2yfk27nmmmjsdh7x0q";
  };

  patches = [
@ -30,12 +30,13 @@ buildPythonPackage rec {
  propagatedBuildInputs = [
    gitdb
    ddt
-  ] ++ lib.optionals (pythonOlder "3.8") [
+  ] ++ lib.optionals (pythonOlder "3.10") [
    typing-extensions
  ];

  # Tests require a git repo
  doCheck = false;
+
  pythonImportsCheck = [ "git" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/apache-airflow/default.nix
+++ b/pkgs/development/python-modules/apache-airflow/default.nix
@ -3,7 +3,6 @@
 , python
 , buildPythonPackage
 , fetchFromGitHub
-, writeText
 , alembic
 , argcomplete
 , attrs
--- a/pkgs/development/python-modules/boost-histogram/default.nix
+++ b/pkgs/development/python-modules/boost-histogram/default.nix
@ -2,13 +2,13 @@

 buildPythonPackage rec {
  pname = "boost-histogram";
-  version = "1.0.2";
+  version = "1.1.0";
  disabled = !isPy3k;

  src = fetchPypi {
    pname = "boost_histogram";
    inherit version;
-    sha256 = "b79cb9a00c5b8e44ff24ffcbec0ce5d3048dd1570c8592066344b6d2f2369fa2";
+    sha256 = "370e8e44a0bac4ebbedb7e62570be3a75a7a3807a297d6e82a94301b4681fc22";
  };

  buildInputs = [ boost ];
--- a/pkgs/development/python-modules/channels/default.nix
+++ b/pkgs/development/python-modules/channels/default.nix
@ -1,23 +1,43 @@
-{ lib, buildPythonPackage, fetchPypi,
-  asgiref, django, daphne
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, asgiref
+, django
+, daphne
+, pytest-asyncio
+, pytest-django
+, pytestCheckHook
 }:
+
 buildPythonPackage rec {
  pname = "channels";
-  version = "3.0.3";
+  version = "3.0.4";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "056b72e51080a517a0f33a0a30003e03833b551d75394d6636c885d4edb8188f";
+  src = fetchFromGitHub {
+    owner = "django";
+    repo = pname;
+    rev = version;
+    sha256 = "0jdylcb77n04rqyzg9v6qfzaxp1dnvdvnxddwh3x1qazw3csi5y2";
  };

-  # Files are missing in the distribution
-  doCheck = false;
+  propagatedBuildInputs = [
+    asgiref
+    django
+    daphne
+  ];

-  propagatedBuildInputs = [ asgiref django daphne ];
+  checkInputs = [
+    pytest-asyncio
+    pytest-django
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "channels" ];

  meta = with lib; {
    description = "Brings event-driven capabilities to Django with a channel system";
    license = licenses.bsd3;
    homepage = "https://github.com/django/channels";
+    maintainers = with maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/debugpy/default.nix
+++ b/pkgs/development/python-modules/debugpy/default.nix
@ -2,7 +2,6 @@
 , stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, fetchpatch
 , substituteAll
 , gdb
 , flask
@ -18,13 +17,13 @@

 buildPythonPackage rec {
  pname = "debugpy";
-  version = "1.3.0";
+  version = "1.4.1";

  src = fetchFromGitHub {
    owner = "Microsoft";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-YGzc9mMIzPTmUgIXuZROLdYKjUm69x9SR+JtYRVpn24=";
+    hash = "sha256-W51Y9tZB1Uyp175+hWCpXChwL+MBpDWjudF87F1MRso=";
  };

  patches = [
@ -49,12 +48,6 @@ buildPythonPackage rec {
    # To avoid this issue, debugpy should be installed using python.withPackages:
    # python.withPackages (ps: with ps; [ debugpy ])
    ./fix-test-pythonpath.patch
-
-    # Fix tests with flask>=2.0
-    (fetchpatch {
-      url = "https://github.com/microsoft/debugpy/commit/0a7f2cd67dda27ea4d38389b49a4e2a1899b834e.patch";
-      sha256 = "1g070fn07n7jj01jaf5s570zn70akf6klkamigs3ix11gh736rpn";
-    })
  ];

  # Remove pre-compiled "attach" libraries and recompile for host platform
--- a/pkgs/development/python-modules/debugpy/hardcode-gdb.patch
+++ b/pkgs/development/python-modules/debugpy/hardcode-gdb.patch
@ -1,8 +1,8 @@
 diff --git a/src/debugpy/_vendored/pydevd/pydevd_attach_to_process/add_code_to_python_process.py b/src/debugpy/_vendored/pydevd/pydevd_attach_to_process/add_code_to_python_process.py
-index 6d031b4..ecf21f2 100644
+index 51017f2..46654ab 100644
 --- a/src/debugpy/_vendored/pydevd/pydevd_attach_to_process/add_code_to_python_process.py
 +++ b/src/debugpy/_vendored/pydevd/pydevd_attach_to_process/add_code_to_python_process.py
-@@ -293,7 +293,7 @@ def run_python_code_linux(pid, python_code, connect_debugger_tracing=False, show
+@@ -398,7 +398,7 @@ def run_python_code_linux(pid, python_code, connect_debugger_tracing=False, show
     is_debug = 0
     # Note that the space in the beginning of each line in the multi-line is important!
     cmd = [
--- a/pkgs/development/python-modules/flower/default.nix
+++ b/pkgs/development/python-modules/flower/default.nix
@ -7,22 +7,22 @@
 , pytz
 , tornado
 , prometheus_client
+, pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "flower";
-  version = "0.9.7";
+  version = "1.0.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "cf27a254268bb06fd4972408d0518237fcd847f7da4b4cd8055e228150ace8f3";
+    sha256 = "1gcczr04g7wx99h7pxxx1p9n50sbyi0zxrzy7f7m0sf5apxw85rf";
  };

  postPatch = ''
    # rely on using example programs (flowers/examples/tasks.py) which
    # are not part of the distribution
    rm tests/load.py
-    substituteInPlace  requirements/default.txt --replace "prometheus_client==0.8.0" "prometheus_client>=0.8.0"
  '';

  propagatedBuildInputs = [
@ -33,7 +33,10 @@ buildPythonPackage rec {
    prometheus_client
  ];

-  checkInputs = [ mock ];
+  checkInputs = [
+    mock
+    pytestCheckHook
+  ];

  pythonImportsCheck = [ "flower" ];

@ -41,7 +44,6 @@ buildPythonPackage rec {
    description = "Celery Flower";
    homepage = "https://github.com/mher/flower";
    license = licenses.bsdOriginal;
-    maintainers = [ maintainers.arnoldfarkas ];
-    broken = (celery.version >= "5.0.2"); # currently broken with celery>=5.0 by https://github.com/mher/flower/pull/1021
+    maintainers = with maintainers; [ arnoldfarkas ];
  };
 }
--- a/pkgs/development/python-modules/frilouz/default.nix
+++ b/pkgs/development/python-modules/frilouz/default.nix
@ -0,0 +1,38 @@
+{ lib
+, astunparse
+, buildPythonPackage
+, fetchFromGitHub
+, isPy3k
+}:
+
+buildPythonPackage rec {
+  pname = "frilouz";
+  version = "0.0.2";
+  disabled = !isPy3k;
+
+  src = fetchFromGitHub {
+    owner = "QuantStack";
+    repo = "frilouz";
+    rev = version;
+    sha256 = "0w2qzi4zb10r9iw64151ay01vf0yzyhh0bsjkx1apxp8fs15cdiw";
+  };
+
+  checkInputs = [ astunparse ];
+
+  preCheck = "cd test";
+
+  checkPhase = ''
+    runHook preCheck
+    python -m unittest
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [ "frilouz" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/QuantStack/frilouz";
+    description = "Python AST parser adapter with partial error recovery";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}
--- a/pkgs/development/python-modules/hap-python/default.nix
+++ b/pkgs/development/python-modules/hap-python/default.nix
@ -4,7 +4,6 @@
 , cryptography
 , curve25519-donna
 , ecdsa
-, ed25519
 , fetchFromGitHub
 , h11
 , pyqrcode
@ -17,15 +16,14 @@

 buildPythonPackage rec {
  pname = "hap-python";
-  version = "3.5.1";
+  version = "3.5.2";
  disabled = pythonOlder "3.6";

-  # pypi package does not include tests
  src = fetchFromGitHub {
    owner = "ikalchev";
    repo = "HAP-python";
    rev = "v${version}";
-    sha256 = "sha256-ZHTqlb7LIDp8MFNW8MFg6jX7QwaxT40cLi3H13ONLCI=";
+    sha256 = "1irf4dcq9fcqvvjbijkymm63n2s7a19igs1zsbv7y8fa5a2yprhd";
  };

  propagatedBuildInputs = [
@ -33,7 +31,6 @@ buildPythonPackage rec {
    cryptography
    curve25519-donna
    ecdsa
-    ed25519
    h11
    pyqrcode
    zeroconf
--- a/pkgs/development/python-modules/influxdb-client/default.nix
+++ b/pkgs/development/python-modules/influxdb-client/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "influxdb-client";
-  version = "1.18.0";
+  version = "1.19.0";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "influxdata";
    repo = "influxdb-client-python";
    rev = "v${version}";
-    sha256 = "0xgp1wxdfa4y316dfkpmj38chlh68mndr8kqphckpnw16qxsl3d9";
+    sha256 = "0k1qcwd2qdw8mcr8ywy3wi1x9j6i57axgcps5kmkbx773s8qf155";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/jeepney/default.nix
+++ b/pkgs/development/python-modules/jeepney/default.nix
@ -12,13 +12,13 @@

 buildPythonPackage rec {
  pname = "jeepney";
-  version = "0.6.0";
+  version = "0.7.0";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "7d59b6622675ca9e993a6bd38de845051d315f8b0c72cca3aef733a20b648657";
+    sha256 = "1237cd64c8f7ac3aa4b3f332c4d0fb4a8216f39eaa662ec904302d4d77de5a54";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/meshio/default.nix
+++ b/pkgs/development/python-modules/meshio/default.nix
@ -10,12 +10,12 @@

 buildPythonPackage rec {
  pname = "meshio";
-  version = "4.3.10";
+  version = "4.4.6";
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1i34bk8bbc0dnizrlgj0yxnbzyvndkmnl6ryymxgcl9rv1abkfki";
+    sha256 = "0kv832s2vyff30zz8yqypw5jifwdanvh5x56d2bzkvy94h4jlddy";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pylzma/default.nix
+++ b/pkgs/development/python-modules/pylzma/default.nix
@ -0,0 +1,23 @@
+{ lib, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "pylzma";
+  version = "0.5.0";
+
+  # This vendors an old LZMA SDK
+  # After some discussion, it seemed most reasonable to keep it that way
+  # xz, and uefi-firmware-parser also does this
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "074anvhyjgsv2iby2ql1ixfvjgmhnvcwjbdz8gk70xzkzcm1fx5q";
+  };
+
+  pythonImportsCheck = [ "pylzma" ];
+
+  meta = with lib; {
+    homepage = "https://www.joachim-bauch.de/projects/pylzma/";
+    description = "Platform independent python bindings for the LZMA compression library";
+    license = licenses.lgpl21Only;
+    maintainers = with maintainers; [ dandellion ];
+  };
+}
--- a/pkgs/development/python-modules/pysyncthru/default.nix
+++ b/pkgs/development/python-modules/pysyncthru/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "pysyncthru";
-  version = "0.7.3";
+  version = "0.7.5";

  disabled = isPy27;

--- a/pkgs/development/python-modules/requests-unixsocket/default.nix
+++ b/pkgs/development/python-modules/requests-unixsocket/default.nix
@ -1,6 +1,11 @@
-{ lib, buildPythonPackage, fetchPypi
-, pbr, requests
-, pytest, waitress }:
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pbr
+, requests
+, pytestCheckHook
+, waitress
+}:

 buildPythonPackage rec {
  pname = "requests-unixsocket";
@ -14,10 +19,10 @@ buildPythonPackage rec {
  nativeBuildInputs = [ pbr ];
  propagatedBuildInputs = [ requests ];

-  checkInputs = [ pytest waitress ];
-  checkPhase = ''
+  checkInputs = [ pytestCheckHook waitress ];
+
+  preCheck = ''
    rm pytest.ini
-    py.test
  '';

  meta = with lib; {
--- a/pkgs/development/python-modules/synergy/default.nix
+++ b/pkgs/development/python-modules/synergy/default.nix
@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, numpy
+, scipy
+, matplotlib
+, plotly
+, pandas
+}:
+
+buildPythonPackage rec {
+  pname = "synergy";
+  version = "0.5.1";
+  disabled = pythonOlder "3.5";
+
+  # Pypi does not contain unit tests
+  src = fetchFromGitHub {
+    owner = "djwooten";
+    repo = "synergy";
+    rev = "v${version}";
+    sha256 = "1c60dpvr72g4wjqg6bc601kssl5z55v9bg09xbyh9ahch58bi212";
+  };
+
+  propagatedBuildInputs = [
+    numpy
+    scipy
+    matplotlib
+    plotly
+    pandas
+  ];
+
+  checkInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "synergy" ];
+
+  meta = with lib; {
+    description = "A Python library for calculating, analyzing, and visualizing drug combination synergy";
+    homepage = "https://github.com/djwooten/synergy";
+    maintainers = [ maintainers.ivar ];
+    license = licenses.gpl3Plus;
+  };
+}
--- a/pkgs/development/tools/analysis/frama-c/default.nix
+++ b/pkgs/development/tools/analysis/frama-c/default.nix
@ -31,12 +31,12 @@ in

 stdenv.mkDerivation rec {
  pname = "frama-c";
-  version = "23.0";
+  version = "23.1";
  slang   = "Vanadium";

  src = fetchurl {
    url    = "https://frama-c.com/download/frama-c-${version}-${slang}.tar.gz";
-    sha256 = "0pdm3y2nfyjhpnicv1pg9j48llq86dmb591d2imnafp4xfqani0s";
+    sha256 = "1rgkq9sg436smw005ag0j6y3xryhjn18a07m5wjfrfp0s1438nnj";
  };

  preConfigure = lib.optionalString stdenv.cc.isClang "configureFlagsArray=(\"--with-cpp=clang -E -C\")";
--- a/pkgs/development/tools/apksigcopier/default.nix
+++ b/pkgs/development/tools/apksigcopier/default.nix
@ -4,10 +4,9 @@
 , installShellFiles
 , bash
 , pandoc
+, apksigner
 }:

-# FIXME: how to "recommend" apksigner like the Debian package?
-
 python3.pkgs.buildPythonApplication rec {
  pname = "apksigcopier";
  version = "1.0.1";
@ -22,6 +21,7 @@ python3.pkgs.buildPythonApplication rec {
  nativeBuildInputs = [ installShellFiles pandoc ];
  propagatedBuildInputs = with python3.pkgs; [ click ];
  checkInputs = with python3.pkgs; [ flake8 mypy pylint ];
+  makeWrapperArgs = [ "--prefix" "PATH" ":" "${lib.makeBinPath [ apksigner ]}" ];

  postPatch = ''
    substituteInPlace Makefile \
--- a/pkgs/development/tools/apksigner/default.nix
+++ b/pkgs/development/tools/apksigner/default.nix
@ -0,0 +1,15 @@
+{ runCommand
+, makeWrapper
+, jre
+, build-tools
+}:
+let
+  tools = builtins.head build-tools;
+in
+runCommand "apksigner" {
+  nativeBuildInputs = [ makeWrapper ];
+} ''
+  mkdir -p $out/bin
+  makeWrapper "${jre}/bin/java" "$out/bin/apksigner" \
+    --add-flags "-jar ${tools}/libexec/android-sdk/build-tools/${tools.version}/lib/apksigner.jar"
+''
--- a/pkgs/development/tools/fdroidserver/default.nix
+++ b/pkgs/development/tools/fdroidserver/default.nix
@ -1,7 +1,8 @@
-{ docker
-, fetchFromGitLab
+{ fetchFromGitLab
 , python
-, lib }:
+, lib
+, apksigner
+}:

 python.pkgs.buildPythonApplication rec {
  version = "2.0.3";
@ -47,6 +48,8 @@ python.pkgs.buildPythonApplication rec {
    yamllint
  ];

+  makeWrapperArgs = [ "--prefix" "PATH" ":" "${lib.makeBinPath [ apksigner ]}" ];
+
  # no tests
  doCheck = false;

--- a/pkgs/development/tools/misc/remarkable/remarkable-toolchain/default.nix
+++ b/pkgs/development/tools/misc/remarkable/remarkable-toolchain/default.nix
@ -1,18 +1,18 @@
-{ lib, stdenv, fetchurl, libarchive, python, file, which }:
+{ lib, stdenv, fetchurl, libarchive, python3, file, which }:

 stdenv.mkDerivation rec {
  pname = "remarkable-toolchain";
-  version = "1.8-23.9.2019";
+  version = "3.1.2";

  src = fetchurl {
-    url = "https://remarkable.engineering/oecore-x86_64-cortexa9hf-neon-toolchain-zero-gravitas-${version}.sh";
-    sha256 = "1rk1r80m5d18sw6hrybj6f78s8pna0wrsa40ax6j8jzfwahgzmfb";
+    url = "https://storage.googleapis.com/remarkable-codex-toolchain/codex-x86_64-cortexa9hf-neon-rm10x-toolchain-${version}.sh";
+    sha256 = "sha256-ocODUUx2pgmqxMk8J+D+OvqlSHBSay6YzcqnxC9n59w=";
    executable = true;
  };

  nativeBuildInputs = [
    libarchive
-    python
+    python3
    file
    which
  ];
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "A toolchain for cross-compiling to reMarkable tablets";
    homepage = "https://remarkable.engineering/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ nickhu siraben ];
    platforms = [ "x86_64-linux" ];
  };
--- a/pkgs/development/tools/misc/remarkable/remarkable2-toolchain/default.nix
+++ b/pkgs/development/tools/misc/remarkable/remarkable2-toolchain/default.nix
@ -1,32 +1,28 @@
-{ lib, stdenv, fetchurl, libarchive, python3, file }:
+{ lib, stdenv, fetchurl, libarchive, python3, file, which }:

 stdenv.mkDerivation rec {
  pname = "remarkable2-toolchain";
-  version = "2.5.2";
+  version = "3.1.2";

  src = fetchurl {
-    url = "https://storage.googleapis.com/codex-public-bucket/codex-x86_64-cortexa7hf-neon-rm11x-toolchain-${version}.sh";
-    sha256 = "1v410q1jn8flisdpkrymxd4pa1ylawd0rh3rljjpkqw1bp8a5vw1";
+    url = "https://storage.googleapis.com/remarkable-codex-toolchain/codex-x86_64-cortexa7hf-neon-rm11x-toolchain-${version}.sh";
+    sha256 = "sha256-JKMDRbkvoxwHiTm/o4JdLn3Mm2Ld1LyxTnCCwvnxk4c=";
+    executable = true;
  };

  nativeBuildInputs = [
    libarchive
    python3
    file
+    which
  ];

-  unpackCmd = ''
-    mkdir src
-    install $curSrc src/install-toolchain.sh
-  '';
-
+  dontUnpack = true;
  dontBuild = true;

  installPhase = ''
-    patchShebangs install-toolchain.sh
-    sed -i -e '3,9d' install-toolchain.sh # breaks PATH
-    sed -i 's|PYTHON=.*$|PYTHON=${python3}/bin/python|' install-toolchain.sh
-    ./install-toolchain.sh -D -y -d $out
+    mkdir -p $out
+    ENVCLEANED=1 $src -y -d $out
  '';

  meta = with lib; {
@ -34,6 +30,6 @@ stdenv.mkDerivation rec {
    homepage = "https://remarkable.engineering/";
    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ tadfisher ];
-    platforms = platforms.x86_64;
+    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/development/tools/scalafix/default.nix
+++ b/pkgs/development/tools/scalafix/default.nix
@ -17,21 +17,20 @@ let
  };
 in
 stdenv.mkDerivation {
-  name = "${baseName}-${version}";
+  pname = baseName;
+  inherit version;

  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ jdk deps ];

-  doCheck = true;
-
-  phases = [ "installPhase" "checkPhase" ];
+  dontUnpack = true;

  installPhase = ''
    makeWrapper ${jre}/bin/java $out/bin/${baseName} \
      --add-flags "-cp $CLASSPATH scalafix.cli.Cli"
  '';

-  checkPhase = ''
+  installCheckPhase = ''
    $out/bin/${baseName} --version | grep -q "${version}"
  '';

--- a/pkgs/games/minecraft-server/default.nix
+++ b/pkgs/games/minecraft-server/default.nix
@ -23,7 +23,7 @@ stdenv.mkDerivation {
    chmod +x $out/bin/minecraft-server
  '';

-  phases = "installPhase";
+  dontUnpack = true;

  passthru = {
    tests = { inherit (nixosTests) minecraft-server; };
--- a/pkgs/games/tcl2048/default.nix
+++ b/pkgs/games/tcl2048/default.nix
@ -10,7 +10,7 @@ tcl.mkTclDerivation rec {
  };

  buildInputs = [ tcllib ];
-  phases = "installPhase fixupPhase";
+  dontUnpack = true;

  installPhase = ''
    mkdir -pv $out/bin
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@ -1,4 +1,6 @@
-{ config, lib, buildEnv, callPackage, vscode-utils, asciidoctor, nodePackages, jdk, llvmPackages_8, nixpkgs-fmt, jq, shellcheck, moreutils, racket-minimal }:
+{ config, lib, buildEnv, callPackage, vscode-utils, asciidoctor, nodePackages, jdk, llvmPackages_8, nixpkgs-fmt, jq
+, shellcheck, moreutils, racket-minimal, clojure-lsp
+}:

 let
  inherit (vscode-utils) buildVscodeMarketplaceExtension;
@ -206,6 +208,23 @@ let
        };
      };

+      betterthantomorrow.calva = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "calva";
+          publisher = "betterthantomorrow";
+          version = "2.0.205";
+          sha256 = "sha256-umnG1uLB42fUNKjANaKcABjVmqbdOQakd/6TPsEpF9c";
+        };
+        nativeBuildInputs = [ jq moreutils ];
+        postInstall = ''
+          cd "$out/$installPrefix"
+          jq '.contributes.configuration[0].properties."calva.clojureLspPath".default = "${clojure-lsp}/bin/clojure-lsp"' package.json | sponge package.json
+        '';
+        meta = with lib; {
+          license = licenses.mit;
+        };
+      };
+
      bodil.file-browser = buildVscodeMarketplaceExtension {
        mktplcRef = {
          name = "file-browser";
--- a/pkgs/servers/atlassian/crowd.nix
+++ b/pkgs/servers/atlassian/crowd.nix
@ -10,8 +10,6 @@ stdenv.mkDerivation rec {
    sha256 = "1gg4jcwvk4za6j4260dx1vz2dprrnqv8paqf6z86s7ka3y1nx1aj";
  };

-  phases = [ "unpackPhase" "buildPhase" "installPhase" "fixupPhase" ];
-
  buildPhase = ''
    mv apache-tomcat/conf/server.xml apache-tomcat/conf/server.xml.dist
    ln -s /run/atlassian-crowd/server.xml apache-tomcat/conf/server.xml
--- a/pkgs/servers/http/jboss/default.nix
+++ b/pkgs/servers/http/jboss/default.nix
@ -8,8 +8,6 @@ stdenv.mkDerivation rec {
    sha256 = "1bdjw0ib9qr498vpfbg8klqw6rl11vbz7vwn6gp1r5gpqkd3zzc8";
  };

-  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
-
  installPhase = ''
    mv $PWD $out
    find $out/bin -name \*.sh -print0 | xargs -0 sed -i -e '/#!\/bin\/sh/aJAVA_HOME=${jdk}'
--- a/pkgs/servers/mastodon/update.nix
+++ b/pkgs/servers/mastodon/update.nix
@ -8,7 +8,6 @@ stdenv.mkDerivation rec {
    patchShebangs $out/bin/update.sh
    wrapProgram $out/bin/update.sh --prefix PATH : ${lib.makeBinPath buildInputs}
  '';
-  phases = [ "installPhase" ];

  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ yarn2nix bundix coreutils diffutils nix-prefetch-github gnused jq ];
--- a/pkgs/servers/misc/subsonic/default.nix
+++ b/pkgs/servers/misc/subsonic/default.nix
@ -33,6 +33,4 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ telotortium ];
    platforms = platforms.unix;
  };
-
-  phases = ["unpackPhase" "installPhase"];
 }
--- a/pkgs/servers/monitoring/prometheus/jmx-httpserver.nix
+++ b/pkgs/servers/monitoring/prometheus/jmx-httpserver.nix
@ -17,7 +17,7 @@ in stdenv.mkDerivation {
  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ jre ];

-  phases = "installPhase";
+  dontUnpack = true;

  installPhase = ''
    mkdir -p $out/libexec
--- a/pkgs/servers/monitoring/riemann/default.nix
+++ b/pkgs/servers/monitoring/riemann/default.nix
@ -11,8 +11,6 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ makeWrapper ];

-  phases = [ "unpackPhase" "installPhase" ];
-
  installPhase = ''
    substituteInPlace bin/riemann --replace '$top/lib/riemann.jar' "$out/share/java/riemann.jar"

--- a/pkgs/servers/tautulli/default.nix
+++ b/pkgs/servers/tautulli/default.nix
@ -2,7 +2,7 @@

 buildPythonApplication rec {
  pname = "Tautulli";
-  version = "2.7.3";
+  version = "2.7.5";
  format = "other";

  pythonPath = [ setuptools ];
@ -12,7 +12,7 @@ buildPythonApplication rec {
    owner = "Tautulli";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1ig2vq19sb6n2x2w2zbf54izynaqay9l8xq1zds116v0z729wlkh";
+    sha256 = "h4IRPUaqgb/AgqKJJEsHBydJOH2i//fpWzMFa0VM2ns=";
  };

  installPhase = ''
--- a/pkgs/tools/backup/btar/default.nix
+++ b/pkgs/tools/backup/btar/default.nix
@ -1,21 +1,30 @@
-{ lib, stdenv, fetchurl, librsync }:
+{ lib, stdenv, fetchurl, fetchpatch, librsync }:

 stdenv.mkDerivation rec {
-  name = "btar-1.1.1";
+  pname = "btar";
+  version = "1.1.1";
+
  src = fetchurl {
-    url = "http://vicerveza.homeunix.net/~viric/soft/btar/${name}.tar.gz";
+    url = "https://vicerveza.homeunix.net/~viric/soft/btar/btar-${version}.tar.gz";
    sha256 = "0miklk4bqblpyzh1bni4x6lqn88fa8fjn15x1k1n8bxkx60nlymd";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://build.opensuse.org/public/source/openSUSE:Factory/btar/btar-librsync.patch?rev=2";
+      sha256 = "1awqny9489vsfffav19s73xxg26m7zrhvsgf1wxb8c2izazwr785";
+    })
+  ];
+
  buildInputs = [ librsync ];

-  installPhase = "make install PREFIX=$out";
+  makeFlags = [ "PREFIX=$(out)" ];

-  meta = {
+  meta = with lib; {
    description = "Tar-compatible block-based archiver";
    license = lib.licenses.gpl3Plus;
-    homepage = "http://viric.name/cgi-bin/btar";
-    platforms = with lib.platforms; all;
-    maintainers = with lib.maintainers; [viric];
+    homepage = "https://viric.name/cgi-bin/btar";
+    platforms = platforms.all;
+    maintainers = with maintainers; [ viric ];
  };
 }
--- a/pkgs/tools/graphics/astc-encoder/default.nix
+++ b/pkgs/tools/graphics/astc-encoder/default.nix
@ -31,13 +31,13 @@ with rec {

 gccStdenv.mkDerivation rec {
  pname = "astc-encoder";
-  version = "3.0";
+  version = "3.1";

  src = fetchFromGitHub {
    owner = "ARM-software";
    repo = "astc-encoder";
    rev = version;
-    sha256 = "sha256-+vYEO2zS144ZuVN8b4/EpvTcakC9U0uc/eV4pB7lHiY=";
+    sha256 = "sha256-WWxk8F1MtFv1tWbSs45fmu4k9VCAAOjJP8zBz80zLTo=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/tools/graphics/goverlay/default.nix
+++ b/pkgs/tools/graphics/goverlay/default.nix
@ -34,13 +34,13 @@ let
  '';
 in stdenv.mkDerivation rec {
  pname = "goverlay";
-  version = "0.5.1";
+  version = "0.6";

  src = fetchFromGitHub {
    owner = "benjamimgois";
    repo = pname;
    rev = version;
-    hash = "sha256-Zl1pq2MeGJsPdNlwUEpov5MHlsr9pSMkWHVprt8ImKs=";
+    hash = "sha256-E4SMUL9rpDSSdprX4fPyGCHCowdQavjhGIhV3r4jeiw=";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/tools/graphics/goverlay/find-xdg-data-files.patch
+++ b/pkgs/tools/graphics/goverlay/find-xdg-data-files.patch
@ -1,8 +1,8 @@
 diff --git a/overlayunit.pas b/overlayunit.pas
-index 59f6a81..a096543 100644
+index de8725f..005f171 100644
 --- a/overlayunit.pas
 +++ b/overlayunit.pas
-@@ -4871,7 +4871,7 @@ begin
+@@ -5377,7 +5377,7 @@ begin
    //Determine Mangohud dependency status
 
           //locate MangoHud and store result in tmp folder
@ -11,7 +11,7 @@ index 59f6a81..a096543 100644
 
           // Assign Text file dependency_mangohud to variable mangohudVAR
           AssignFile(mangohudVAR, '/tmp/goverlay/dependency_mangohud');
-@@ -4880,7 +4880,7 @@ begin
+@@ -5386,7 +5386,7 @@ begin
           CloseFile(mangohudVAR);
 
           // Read String and store value on mangohuddependencyVALUE based on result
@ -20,7 +20,7 @@ index 59f6a81..a096543 100644
           mangohuddependencyVALUE := 1
           else
           mangohuddependencyVALUE := 0;
-@@ -4889,7 +4889,7 @@ begin
+@@ -5395,7 +5395,7 @@ begin
    //Determine vkBasalt dependency staus
 
            //locate vkBasalt and store result in tmp folder
@ -29,7 +29,7 @@ index 59f6a81..a096543 100644
 
            // Assign Text file dependency_mangohud to variable mangohudVAR
            AssignFile(vkbasaltVAR, '/tmp/goverlay/dependency_vkbasalt');
-@@ -4898,7 +4898,7 @@ begin
+@@ -5404,7 +5404,7 @@ begin
            CloseFile(vkbasaltVAR);
 
            // Read String and store value on vkbasaltdependencyVALUE based on result
--- a/pkgs/tools/misc/diffoscope/default.nix
+++ b/pkgs/tools/misc/diffoscope/default.nix
@ -1,5 +1,5 @@
-{ lib, stdenv, fetchurl, runCommand, makeWrapper, python3Packages, docutils, help2man, installShellFiles
-, abootimg, acl, apktool, binutils-unwrapped, build-tools, bzip2, cbfstool, cdrkit, colord, colordiff, coreutils, cpio, db, diffutils, dtc
+{ lib, stdenv, fetchurl, python3Packages, docutils, help2man, installShellFiles
+, abootimg, acl, apksigner, apktool, binutils-unwrapped, bzip2, cbfstool, cdrkit, colord, colordiff, coreutils, cpio, db, diffutils, dtc
 , e2fsprogs, file, findutils, fontforge-fonttools, ffmpeg, fpc, gettext, ghc, ghostscriptX, giflib, gnumeric, gnupg, gnutar
 , gzip, hdf5, imagemagick, jdk, libarchive, libcaca, llvm, lz4, mono, openssh, openssl, pdftk, pgpdump, poppler_utils, qemu, R
 , radare2, sng, sqlite, squashfsTools, tcpdump, odt2txt, unzip, wabt, xxd, xz, zip, zstd
@ -7,13 +7,6 @@
 }:

 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
-let
-  apksigner = runCommand "apksigner" { nativeBuildInputs = [ makeWrapper ]; } ''
-    mkdir -p $out/bin
-    makeWrapper "${jdk}/bin/java" "$out/bin/apksigner" \
-      --add-flags "-jar ${builtins.head build-tools}/libexec/android-sdk/build-tools/28.0.3/lib/apksigner.jar"
-  '';
-in
 python3Packages.buildPythonApplication rec {
  pname = "diffoscope";
  version = "178";
--- a/pkgs/tools/security/fail2ban/default.nix
+++ b/pkgs/tools/security/fail2ban/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, python3 }:

-let version = "0.11.1"; in
+let version = "0.11.2"; in

 python3.pkgs.buildPythonApplication {
  pname = "fail2ban";
@ -10,7 +10,7 @@ python3.pkgs.buildPythonApplication {
    owner  = "fail2ban";
    repo   = "fail2ban";
    rev    = version;
-    sha256 = "0kqvkxpb72y3kgmxf6g36w67499c6gcd2a9yyblagwx12y05f1sh";
+    sha256 = "q4U9iWCa1zg8sA+6pPNejt6v/41WGIKN5wITJCrCqQE=";
  };

  pythonPath = with python3.pkgs;
--- a/pkgs/tools/security/minio-certgen/default.nix
+++ b/pkgs/tools/security/minio-certgen/default.nix
@ -0,0 +1,22 @@
+{ lib, fetchFromGitHub, buildGoModule }:
+
+buildGoModule rec {
+  pname = "minio-certgen";
+  version = "0.0.2";
+
+  src = fetchFromGitHub {
+    owner = "minio";
+    repo = "certgen";
+    rev = "v${version}";
+    sha256 = "sha256-HtzcoEUMt3LpQNyT0wGcmc4Q70QqHx7QpjrDh4YSO/Q=";
+  };
+
+  vendorSha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
+
+  meta = with lib; {
+    description = "A simple Minio tool to generate self-signed certificates, and provides SAN certificates with DNS and IP entries";
+    downloadPage = "https://github.com/minio/certgen";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ superherointj ];
+  };
+}
--- a/pkgs/tools/typesetting/pdfchain/default.nix
+++ b/pkgs/tools/typesetting/pdfchain/default.nix
@ -0,0 +1,56 @@
+{ lib, stdenv, fetchurl, fetchpatch
+, autoconf, gtkmm3, glib, pdftk, pkg-config, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pdfchain";
+  version = "0.4.4.2";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/${pname}/${pname}-${version}/${pname}-${version}.tar.gz";
+    sha256 = "sha256-Hu4Pk9voyc75+f5OwKEOCkXKjN5nzWzv+izmyEN1Lz0=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config wrapGAppsHook autoconf
+  ];
+
+  buildInputs = [
+    gtkmm3 pdftk glib
+  ];
+
+  patches = let
+    fetchDebianPatch = {name, sha256}: fetchpatch {
+      url = "https://salsa.debian.org/debian/pdfchain/raw/2d29107756a3194fb522bdea8e9b9e393b15a8f3/debian/patches/${name}";
+      inherit name sha256;
+    };
+  in
+  [
+    (fetchDebianPatch {
+      name = "fix_crash_on_startup";
+      sha256 = "sha256-1UyMHHGrmUIFhY53ILdMMsyocSIbcV6CKQ7sLVNhNQw=";
+    })
+    (fetchDebianPatch {
+      name = "fix_desktop_file";
+      sha256 = "sha256-L6lhUs7GqVN1XOQO6bbz6BT29n4upsJtlHCAIGzk1Bw=";
+    })
+    (fetchDebianPatch {
+      name = "fix_spelling";
+      sha256 = "sha256-sOUUslPfcOo2K3zuaLcux+CNdgfWM0phsfe6g4GUFes=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace src/constant.h \
+        --replace '"pdftk"' '"${pdftk}/bin/pdftk"' \
+        --replace "/usr/share" "$out/share"
+  '';
+
+  meta = with lib; {
+    description = "A graphical user interface for the PDF Toolkit (PDFtk)";
+    homepage = "https://pdfchain.sourceforge.io";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ hqurve ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/tools/video/swftools/default.nix
+++ b/pkgs/tools/video/swftools/default.nix
@ -19,7 +19,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl2Only;
    maintainers = [ maintainers.koral ];
    platforms = lib.platforms.unix;
-    broken = true;
    knownVulnerabilities = [
      "CVE-2017-10976"
      "CVE-2017-11096"
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -424,6 +424,7 @@ mapAliases ({
  libqrencode = qrencode;  # added 2019-01-01
  librdf = lrdf; # added 2020-03-22
  librecad2 = librecad;  # backwards compatibility alias, added 2015-10
+  librsync_0_9 = throw "librsync_0_9 has been removed"; # added 2021-07-24
  libseat = seatd; # added 2021-06-24
  libsysfs = sysfsutils; # added 2018-04-25
  libtidy = html-tidy;  # added 2014-12-21
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1105,6 +1105,10 @@ in

  apksigcopier = callPackage ../development/tools/apksigcopier { };

+  apksigner = callPackage ../development/tools/apksigner {
+    inherit (androidenv.androidPkgs_9_0) build-tools;
+  };
+
  apktool = callPackage ../development/tools/apktool {
    inherit (androidenv.androidPkgs_9_0) build-tools;
  };
@ -3543,9 +3547,7 @@ in

  bsdiff = callPackage ../tools/compression/bsdiff { };

-  btar = callPackage ../tools/backup/btar {
-    librsync = librsync_0_9;
-  };
+  btar = callPackage ../tools/backup/btar { };

  bud = callPackage ../tools/networking/bud { };

@ -4202,7 +4204,6 @@ in
  diff-so-fancy = callPackage ../applications/version-management/git-and-tools/diff-so-fancy { };

  diffoscopeMinimal = callPackage ../tools/misc/diffoscope {
-    inherit (androidenv.androidPkgs_9_0) build-tools;
    jdk = jdk8;
  };

@ -5509,7 +5510,9 @@ in

  gpp = callPackage ../development/tools/gpp { };

-  gpredict = callPackage ../applications/science/astronomy/gpredict { };
+  gpredict = callPackage ../applications/science/astronomy/gpredict {
+    hamlib = hamlib_4;
+  };

  gptfdisk = callPackage ../tools/system/gptfdisk { };

@ -7075,6 +7078,8 @@ in

  minio-client = callPackage ../tools/networking/minio-client { };

+  minio-certgen = callPackage ../tools/security/minio-certgen { };
+
  minissdpd = callPackage ../tools/networking/minissdpd { };

  inherit (callPackage ../tools/networking/miniupnpc
@ -15537,7 +15542,7 @@ in
  gsettings-qt = libsForQt5.callPackage ../development/libraries/gsettings-qt { };

  gst_all_1 = recurseIntoAttrs(callPackage ../development/libraries/gstreamer {
-    callPackage = newScope { libav = pkgs.ffmpeg; };
+    callPackage = newScope (gst_all_1 // { libav = pkgs.ffmpeg; });
    inherit (darwin.apple_sdk.frameworks) AudioToolbox AVFoundation Cocoa CoreFoundation CoreMedia CoreServices CoreVideo DiskArbitration Foundation IOKit MediaToolbox OpenGL VideoToolbox;
  });

@ -15760,7 +15765,9 @@ in

  gwenhywfar = callPackage ../development/libraries/aqbanking/gwenhywfar.nix { };

-  hamlib = callPackage ../development/libraries/hamlib { };
+  hamlib = hamlib_3;
+  hamlib_3 = callPackage ../development/libraries/hamlib { };
+  hamlib_4 = callPackage ../development/libraries/hamlib/4.nix { };

  heimdal = callPackage ../development/libraries/kerberos/heimdal.nix {
    inherit (darwin.apple_sdk.frameworks) CoreFoundation Security SystemConfiguration;
@ -17043,8 +17050,6 @@ in

  librsync = callPackage ../development/libraries/librsync { };

-  librsync_0_9 = callPackage ../development/libraries/librsync/0.9.nix { };
-
  librttopo = callPackage ../development/libraries/librttopo { };

  libs3 = callPackage ../development/libraries/libs3 { };
@ -23517,7 +23522,9 @@ in
    python3Packages = python37Packages;
  };

-  cqrlog = callPackage ../applications/radio/cqrlog { };
+  cqrlog = callPackage ../applications/radio/cqrlog {
+    hamlib = hamlib_4;
+  };

  crun = callPackage ../applications/virtualization/crun {};

@ -23596,7 +23603,9 @@ in
    inherit (pkgs.gnome2) libart_lgpl libgnomeui;
  };

-  direwolf = callPackage ../applications/radio/direwolf { };
+  direwolf = callPackage ../applications/radio/direwolf {
+    hamlib = hamlib_4;
+  };

  dirt = callPackage ../applications/audio/dirt {};

@ -23928,7 +23937,9 @@ in

  flexget = callPackage ../applications/networking/flexget { };

-  fldigi = callPackage ../applications/radio/fldigi { };
+  fldigi = callPackage ../applications/radio/fldigi {
+    hamlib = hamlib_4;
+  };

  flink = callPackage ../applications/networking/cluster/flink { };

@ -26374,6 +26385,8 @@ in
    inherit (gnome2) libgnomecanvas;
  };

+  pdfchain = callPackage ../tools/typesetting/pdfchain { };
+
  pdfcpu = callPackage ../applications/graphics/pdfcpu { };
  pdftk = callPackage ../tools/typesetting/pdftk {
    jre = jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
@ -26435,6 +26448,8 @@ in
    plugins = [];
  };

+  pidgin-indicator = callPackage ../applications/networking/instant-messengers/pidgin-plugins/pidgin-indicator { };
+
  pidgin-latex = callPackage ../applications/networking/instant-messengers/pidgin-plugins/pidgin-latex {
    texLive = texlive.combined.scheme-basic;
  };
@ -26962,6 +26977,8 @@ in

  sniproxy = callPackage ../applications/networking/sniproxy { };

+  snixembed = callPackage ../applications/misc/snixembed { };
+
  sooperlooper = callPackage ../applications/audio/sooperlooper { };

  sops = callPackage ../tools/security/sops { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -2734,6 +2734,8 @@ in {

  freezegun = callPackage ../development/python-modules/freezegun { };

+  frilouz = callPackage ../development/python-modules/frilouz { };
+
  fritzconnection = callPackage ../development/python-modules/fritzconnection { };

  fritzprofiles = callPackage ../development/python-modules/fritzprofiles { };
@ -6215,6 +6217,8 @@ in {

  pylxd = callPackage ../development/python-modules/pylxd { };

+  pylzma = callPackage ../development/python-modules/pylzma { };
+
  pymacaroons = callPackage ../development/python-modules/pymacaroons { };

  pymaging = callPackage ../development/python-modules/pymaging { };
@ -8458,6 +8462,8 @@ in {

  syncer = callPackage ../development/python-modules/syncer { };

+  synergy = callPackage ../development/python-modules/synergy { };
+
  synologydsm-api = callPackage ../development/python-modules/synologydsm-api { };

  systembridge = callPackage ../development/python-modules/systembridge { };