Merge master into staging-next

nixos/modules/services/security/privacyidea.nix

@@ -204,6 +204,7 @@ in
       systemd.services.privacyidea = let
         piuwsgi = pkgs.writeText "uwsgi.json" (builtins.toJSON {
           uwsgi = {
+            buffer-size = 8192;
             plugins = [ "python3" ];
             pythonpath = "${penv}/${uwsgi.python3.sitePackages}";
             socket = "/run/privacyidea/socket";

nixos/modules/services/web-servers/nginx/default.nix

@@ -317,9 +317,12 @@ let
           ${optionalString (hasSSL && vhost.sslTrustedCertificate != null) ''
             ssl_trusted_certificate ${vhost.sslTrustedCertificate};
           ''}
-          ${optionalString vhost.rejectSSL ''
+          ${optionalString (hasSSL && vhost.rejectSSL) ''
             ssl_reject_handshake on;
           ''}
+          ${optionalString (hasSSL && vhost.kTLS) ''
+            ssl_conf_command Options KTLS;
+          ''}
 
           ${mkBasicAuth vhostName vhost}
 
@@ -824,6 +827,14 @@ in
         '';
       }
 
+      {
+        assertion = any (host: host.kTLS) (attrValues virtualHosts) -> versionAtLeast cfg.package.version "1.21.4";
+        message = ''
+          services.nginx.virtualHosts.<name>.kTLS requires nginx version
+          1.21.4 or above; see the documentation for services.nginx.package.
+        '';
+      }
+
       {
         assertion = all (host: !(host.enableACME && host.useACMEHost != null)) (attrValues virtualHosts);
         message = ''
@@ -900,7 +911,7 @@ in
         PrivateMounts = true;
         # System Call Filtering
         SystemCallArchitectures = "native";
-        SystemCallFilter = "~@cpu-emulation @debug @keyring @ipc @mount @obsolete @privileged @setuid @mincore";
+        SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid @mincore" ] ++ optionals (cfg.package != pkgs.tengine) [ "~@ipc" ];
       };
     };
 

nixos/modules/services/web-servers/nginx/vhost-options.nix

@@ -147,6 +147,17 @@ with lib;
       '';
     };
 
+    kTLS = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to enable kTLS support.
+        Implementing TLS in the kernel (kTLS) improves performance by significantly
+        reducing the need for copying operations between user space and the kernel.
+        Required Nginx version 1.21.4 or later.
+      '';
+    };
+
     sslCertificate = mkOption {
       type = types.path;
       example = "/var/host.cert";

pkgs/applications/audio/helvum/default.nix

@@ -1,47 +1,73 @@
 { lib
-, fetchFromGitLab
-, makeDesktopItem
-, copyDesktopItems
-, rustPlatform
-, pkg-config
 , clang
-, libclang
+, desktop-file-utils
+, fetchFromGitLab
+, fetchpatch
 , glib
 , gtk4
+, libclang
+, meson
+, ninja
 , pipewire
+, pkg-config
+, rustPlatform
+, stdenv
 }:
 
-rustPlatform.buildRustPackage rec {
+stdenv.mkDerivation rec {
   pname = "helvum";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "ryuukyu";
     repo = pname;
     rev = version;
-    sha256 = "sha256-f6+6Qicg5J6oWcafG4DF0HovTmF4r6yfw6p/3dJHmB4=";
+    sha256 = "sha256-Kt6gnMRTOVXqjAjEZKlylcGhzl52ZzPNVbJhwzLhzkM=";
   };
 
-  cargoSha256 = "sha256-zGa6nAmOOrpiMr865J06Ez3L6lPL0j18/lW8lw1jPyU=";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-kxJRY9GSPwnb431iYCfJdGcl5HjpFr2KkWrFDpGajp8=";
+  };
 
-  nativeBuildInputs = [ clang copyDesktopItems pkg-config ];
-  buildInputs = [ glib gtk4 pipewire ];
+  nativeBuildInputs = [
+    clang
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustPlatform.rust.cargo
+    rustPlatform.rust.rustc
+  ];
+
+  buildInputs = [
+    desktop-file-utils
+    glib
+    gtk4
+    pipewire
+  ];
 
   LIBCLANG_PATH = "${libclang.lib}/lib";
 
-  desktopItems = makeDesktopItem {
-    name = "Helvum";
-    exec = pname;
-    desktopName = "Helvum";
-    genericName = "Helvum";
-    categories = "AudioVideo;";
-  };
+  patches = [
+    # enables us to use gtk4-update-icon-cache instead of gtk3 one
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/ryuukyu/helvum/-/merge_requests/24.patch";
+      sha256 = "sha256-WmI6taBL/6t587j06n0mwByQ8x0eUA5ECvGNjg2/vtk=";
+    })
+  ];
+
+  postPatch = ''
+    patchShebangs build-aux/cargo.sh
+  '';
 
   meta = with lib; {
     description = "A GTK patchbay for pipewire";
     homepage = "https://gitlab.freedesktop.org/ryuukyu/helvum";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ fufexan ];
+    platforms = platforms.linux;
   };
 }

pkgs/applications/editors/cudatext/default.nix

@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cudatext";
-  version = "1.152.0";
+  version = "1.152.1";
 
   src = fetchFromGitHub {
     owner = "Alexey-T";
     repo = "CudaText";
     rev = version;
-    sha256 = "sha256-LwPlWfna+/LsQxOBuTFpE7e7Qr5g9NN14rVasMZVImQ=";
+    sha256 = "sha256-rFmgf/wg6/jIObBDN+viKX3KrewVWgxs8uVF1gCY72s=";
   };
 
   postPatch = ''

pkgs/applications/editors/cudatext/deps.json

@@ -16,8 +16,8 @@
   },
   "ATSynEdit": {
     "owner": "Alexey-T",
-    "rev": "2021.12.12",
-    "sha256": "sha256-glP2Srw3Lw1JNQO+DIwixf4Xdbo5M6pBdYufwGERPW4="
+    "rev": "2021.12.22",
+    "sha256": "sha256-MmRJ3XDq7b9doPFfW7njSOasHej5ut0nYcJMFj+Y/Dc="
   },
   "ATSynEdit_Cmp": {
     "owner": "Alexey-T",

pkgs/applications/graphics/image-roll/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "image-roll";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "weclaw1";
     repo = pname;
     rev = version;
-    sha256 = "007jzmrn4cnqbi6fy5lxanbwa4pc72fbcv9irk3pfd0wspp05s8j";
+    sha256 = "sha256-NhZ0W9WBOIRe2nE4jQJ9WgfduKhHd+222feUCay4atw=";
   };
 
-  cargoSha256 = "sha256-dRRBfdGTXtoNbp7OWqOdNECXHCpj0ipkCOvcdekW+G4=";
+  cargoSha256 = "sha256-7sV8v/npmdOgTMtnww/VoK1Kp4Na9Go95XLcfdgkTik=";
 
   nativeBuildInputs = [ glib pkg-config wrapGAppsHook ];
 

pkgs/applications/networking/browsers/lagrange/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lagrange";
-  version = "1.9.2";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "skyjake";
     repo = "lagrange";
     rev = "v${version}";
-    sha256 = "sha256-ZiG3KSEk4l9FFxfftQNb1UHQV//SlK8thp5Tr8ek5v4=";
+    sha256 = "sha256-0+NY21oIbRMCYnneWxw48yQ3UOXW0Ves2A4JTXyLnCE=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix

@@ -87,7 +87,7 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "11.0.2";
+  version = "11.0.3";
 
   lang = "en-US";
 
@@ -97,7 +97,7 @@ let
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
       ];
-      sha256 = "1bqlb8dlh92dpl9gmfh3yclq5ii09vv333yisa0i5gpwwzajnh5s";
+      sha256 = "1a2nxxmjg1gk8p0bxxjqx2g9bwv4ivz8hndabg31nglzv83r7p35";
     };
 
     i686-linux = fetchurl {
@@ -105,7 +105,7 @@ let
         "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
       ];
-      sha256 = "1blp4z9rmnnsvl3bk0ajdccvpzfshnpyijjfiqb9ma02qw2z0gff";
+      sha256 = "0fjq6bj2b6rd66ky9i4p7asda0ghdcm6q0fnr92yan5x77pji73m";
     };
   };
 in

pkgs/data/themes/flat-remix-gnome/default.nix

@@ -7,25 +7,25 @@
 let
   # make install will use dconf to find desktop background file uri.
   # consider adding an args to allow specify pictures manually.
-  # https://github.com/daniruiz/flat-remix-gnome/blob/20211113/Makefile#L38
+  # https://github.com/daniruiz/flat-remix-gnome/blob/20211223/Makefile#L38
   fake-dconf = writeScriptBin "dconf" "echo -n";
 in
 stdenv.mkDerivation rec {
   pname = "flat-remix-gnome";
-  version = "20211202";
+  version = "20211223";
 
   src = fetchFromGitHub {
     owner = "daniruiz";
     repo = pname;
     rev = version;
-    hash = "sha256-aq4hnr581dNYoULeqdB9gWetDcuOthPNJuzHFVGNFc8=";
+    hash = "sha256-hAehJNDr8r0Jhhz0h7ygXI08ouNiWDT16SPm49i90lM=";
   };
 
   nativeBuildInputs = [ glib fake-dconf ];
   makeFlags = [ "PREFIX=$(out)" ];
   preInstall = ''
     # make install will back up this file, it will fail if the file doesn't exist.
-    # https://github.com/daniruiz/flat-remix-gnome/blob/20211202/Makefile#L56
+    # https://github.com/daniruiz/flat-remix-gnome/blob/20211223/Makefile#L56
     mkdir -p $out/share/gnome-shell/
     touch $out/share/gnome-shell/gnome-shell-theme.gresource
   '';

pkgs/development/compilers/chez-racket/default.nix

@@ -0,0 +1,52 @@
+{ stdenv, buildPackages, callPackage }:
+
+let
+  chezSystemMap = {
+    # See `/workarea` of source code for list of systems
+    "aarch64-darwin" = "tarm64osx";
+    "aarch64-linux" = "tarm64le";
+    "armv7l-linux" = "tarm32le";
+    "x86_64-darwin" = "ta6osx";
+    "x86_64-linux" = "ta6le";
+  };
+  inherit (stdenv.hostPlatform) system;
+  chezSystem = chezSystemMap.${system} or (throw "Add ${system} to chezSystemMap to enable building chez-racket");
+  # Chez Scheme uses an ad-hoc `configure`, hence we don't use the usual
+  # stdenv abstractions.
+  forBoot = {
+    pname = "chez-scheme-racket-boot";
+    configurePhase = ''
+      runHook preConfigure
+      ./configure --pb ZLIB=$ZLIB LZ4=$LZ4
+      runHook postConfigure
+    '';
+    makeFlags = [ "${chezSystem}.bootquick" ];
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out
+      pushd boot
+      mv $(ls -1 | grep -v "^pb$") -t $out
+      popd
+      runHook postInstall
+    '';
+  };
+  boot = buildPackages.callPackage (import ./shared.nix forBoot) {};
+  forFinal = {
+    pname = "chez-scheme-racket";
+    configurePhase = ''
+      runHook preConfigure
+      cp -r ${boot}/* -t ./boot
+      ./configure -m=${chezSystem} --installprefix=$out --installman=$out/share/man ZLIB=$ZLIB LZ4=$LZ4
+      runHook postConfigure
+    '';
+    preBuild = ''
+      pushd ${chezSystem}/c
+    '';
+    postBuild = ''
+      popd
+    '';
+    setupHook = ./setup-hook.sh;
+  };
+  final = callPackage (import ./shared.nix forFinal) {};
+in
+final

pkgs/development/compilers/chez-racket/setup-hook.sh

@@ -0,0 +1,5 @@
+addChezLibraryPath() {
+  addToSearchPath CHEZSCHEMELIBDIRS "$1/lib/csv-site"
+}
+
+addEnvHooks "$targetOffset" addChezLibraryPath

pkgs/development/compilers/chez-racket/shared.nix

@@ -0,0 +1,41 @@
+args:
+{ stdenv, lib, fetchFromGitHub, coreutils, darwin
+, ncurses, libiconv, libX11, zlib, lz4
+}:
+
+stdenv.mkDerivation (args // {
+  version = "unstable-2021-12-11";
+
+  src = fetchFromGitHub {
+    owner  = "racket";
+    repo   = "ChezScheme";
+    rev    = "8846c96b08561f05a937d5ecfe4edc96cc99be39";
+    sha256 = "IYJQzT88T8kFahx2BusDOyzz6lQDCbZIfSz9rZoNF7A=";
+    fetchSubmodules = true;
+  };
+
+  prePatch = ''
+    rm -rf zlib/*.c lz4/lib/*.c
+  '';
+
+  postPatch = ''
+    export ZLIB="$(find ${zlib.out}/lib -type f | sort | head -n1)"
+    export LZ4="$(find ${lz4.out}/lib -type f | sort | head -n1)"
+  '';
+
+  nativeBuildInputs = lib.optionals stdenv.isDarwin (with darwin; [ cctools autoSignDarwinBinariesHook ]);
+  buildInputs = [ ncurses libX11 zlib lz4 ]
+    ++ lib.optional stdenv.isDarwin libiconv;
+
+  enableParallelBuilding = true;
+
+  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-Wno-error=format-truncation";
+
+  meta = {
+    description  = "Fork of Chez Scheme for Racket";
+    homepage     = "https://github.com/racket/ChezScheme";
+    license      = lib.licenses.asl20;
+    maintainers  = with lib.maintainers; [ l-as ];
+    platforms    = lib.platforms.unix;
+  };
+})

pkgs/development/coq-modules/mathcomp-word/default.nix

@@ -0,0 +1,27 @@
+{ coq, mkCoqDerivation, mathcomp, lib, version ? null }:
+
+with lib;
+mkCoqDerivation {
+  namePrefix = [ "coq" "mathcomp" ];
+  pname = "word";
+  owner = "jasmin-lang";
+  repo = "coqword";
+  useDune2 = true;
+
+  releaseRev = v: "v${v}";
+
+  release."1.0".sha256 = "sha256:0703m97rnivcbc7vvbd9rl2dxs6l8n52cbykynw61c6w9rhxspcg";
+
+  inherit version;
+  defaultVersion = with versions; switch [ coq.version mathcomp.version ] [
+    { cases = [ (range "8.12" "8.14") (range "1.12" "1.13") ]; out = "1.0"; }
+  ] null;
+
+  propagatedBuildInputs = [ mathcomp.algebra ];
+
+  meta = {
+    description = "Yet Another Coq Library on Machine Words";
+    maintainers = [ maintainers.vbgl ];
+    license = licenses.mit;
+  };
+}

pkgs/development/libraries/ace/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ace";
-  version = "7.0.3";
+  version = "7.0.5";
 
   src = fetchurl {
     url = "https://download.dre.vanderbilt.edu/previous_versions/ACE-${version}.tar.bz2";
-    sha256 = "sha256-aKSxKYJ2OmxCDHwBrfUMenT9LYzFYH5P3R8q/QhkM+c=";
+    sha256 = "sha256-Q4v0HhhKUmLit5+V7bb9g4T7fqaeJJxU512vBZqNl1c=";
   };
 
   enableParallelBuilding = true;

pkgs/development/libraries/leptonica/default.nix

@@ -4,11 +4,11 @@
 
 stdenv.mkDerivation rec {
   pname = "leptonica";
-  version = "1.81.1";
+  version = "1.82.0";
 
   src = fetchurl {
     url = "http://www.leptonica.org/source/${pname}-${version}.tar.gz";
-    sha256 = "sha256-D06zFem93deX9MVf3qTh9F/Kfjs1ii/Gk/2VfOLEPKk=";
+    sha256 = "sha256-FVMC7pFGaMJ7b+PKn/LaY7JF9tYvMGHI8nVjd0uK4tY=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config ];

pkgs/development/libraries/openssl/default.nix

@@ -108,6 +108,7 @@ let
       "-DUSE_CRYPTODEV_DIGESTS"
     ] ++ lib.optional enableSSL2 "enable-ssl2"
       ++ lib.optional enableSSL3 "enable-ssl3"
+      ++ lib.optional (versionAtLeast version "3.0.0") "enable-ktls"
       ++ lib.optional (versionAtLeast version "1.1.0" && stdenv.hostPlatform.isAarch64) "no-afalgeng"
       # OpenSSL needs a specific `no-shared` configure flag.
       # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options

pkgs/development/python-modules/chess/default.nix

@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "chess";
-  version = "1.7.0";
+  version = "1.8.0";
 
   disabled = pythonOlder "3.7";
 
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "niklasf";
     repo = "python-${pname}";
     rev = "v${version}";
-    sha256 = "0f2q9sif1rqjlgzkf7dnxrclmw8v84hzyrnq21g8k1cwqj5fx9j2";
+    sha256 = "sha256-ghBX0yRnggXliVREtrGxB/Xf0JWICeIi8XriSxS26Go=";
   };
 
   pythonImportsCheck = [ "chess" ];

pkgs/development/tools/cargo-flamegraph/default.nix

@@ -4,16 +4,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-flamegraph";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "flamegraph-rs";
     repo = "flamegraph";
     rev = "v${version}";
-    sha256 = "sha256-qxUYqqz6dlpkw6MGHH8iPfZcbc3/ZF1E+C8arISSTdY=";
+    sha256 = "sha256-Q930PIGncUX2Wz3hA1OQu0TEPMfOu2jMpBPbaAVlUMU=";
   };
 
-  cargoSha256 = "sha256-qJEhcqa78QW9X5ZD3Jy2BfRh/SkOhqBLzTT00u4DM0Q=";
+  cargoSha256 = "sha256-ENL1FeIn9HESyp1VhePr4q7BLCc0SS8NAuHKv1crJE8=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [ makeWrapper ];
   buildInputs = lib.optionals stdenv.isDarwin [

pkgs/development/tools/rust/cargo-fuzz/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-fuzz";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "rust-fuzz";
     repo = "cargo-fuzz";
     rev = version;
-    sha256 = "sha256-txlHXboQi3Z8AMIJJBZsBrCA7xggF0zGDpKqcD8UxMo=";
+    sha256 = "sha256-5dHEUGn2CrEpSTJsbnSRx/hKXx6dLCDcuD1dPOH49d4=";
   };
 
-  cargoSha256 = "sha256-eEfry6Q2YiIkNEHu6C8p17pUTF43eS1/iTP2oATZ/F8=";
+  cargoSha256 = "sha256-vZPd8Zzyp0PgIdyp5qY57ex0cCihplw/FY+xf3etuu8=";
 
   buildInputs = lib.optional stdenv.isDarwin libiconv;
 

pkgs/games/fheroes2/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fheroes2";
-  version = "0.9.10";
+  version = "0.9.11";
 
   src = fetchFromGitHub {
     owner = "ihhub";
     repo = "fheroes2";
     rev = version;
-    sha256 = "sha256-8HXFt4SsQ+qXu/VJmdAdYX7XoNjA4AHItnwS/nyY6H8=";
+    sha256 = "sha256-p2FG4oWLTGflOoxsp8A+FpoVHfKiEw3DEnK8n3UiBtU=";
   };
 
   buildInputs = [ gettext libpng SDL2 SDL2_image SDL2_mixer SDL2_ttf zlib ];

pkgs/os-specific/linux/powercap/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "powercap";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "powercap";
     repo = "powercap";
     rev = "v${version}";
-    sha256 = "sha256-9THXWDGflqTafOMIFg+w0L9L+6xevf0ksWCXFFqI4sI=";
+    sha256 = "sha256-VvepbABc7daRE0/sJqsCb+m2my8O3B1ICXywBqsjSO8=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/os-specific/linux/radeontop/default.nix

@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
 
   patchPhase = ''
     substituteInPlace getver.sh --replace ver=unknown ver=${version}
+    substituteInPlace Makefile --replace pkg-config "$PKG_CONFIG"
   '';
 
   makeFlags = [ "PREFIX=$(out)" ];

pkgs/os-specific/linux/rdma-core/default.nix

@@ -14,8 +14,9 @@ stdenv.mkDerivation rec {
     sha256 = "1z9yrkqdknzidg4g1g5rqrs7i0325nmzzw0nf2ki1nzlfwqxy9qv";
   };
 
-  nativeBuildInputs = [ cmake pkg-config pandoc docutils ];
-  buildInputs = [ libnl ethtool iproute2 udev python3 perl ];
+  strictDeps = true;
+  nativeBuildInputs = [ cmake pkg-config pandoc docutils python3 ];
+  buildInputs = [ libnl ethtool iproute2 udev perl ];
 
   cmakeFlags = [
     "-DCMAKE_INSTALL_RUNDIR=/run"

pkgs/servers/computing/slurm/default.nix

@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "slurm";
-  version = "21.08.4.1";
+  version = "21.08.5.1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     repo = "slurm";
     # The release tags use - instead of .
     rev = "${pname}-${builtins.replaceStrings ["."] ["-"] version}";
-    sha256 = "0xaswxm54lxahjn5pkm8b1x1ny3iclyp07h7fzhadgbqmla26np2";
+    sha256 = "sha256-2ctJnCZCziPnfWeDNvvcE0tPGVdhzjjhqMWJhWhitGo=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/servers/http/nginx/generic.nix

@@ -3,6 +3,7 @@
 , nixosTests
 , substituteAll, gd, geoip, perl
 , withDebug ? false
+, withKTLS ? false
 , withStream ? true
 , withMail ? false
 , withPerl ? true
@@ -80,6 +81,8 @@ stdenv.mkDerivation {
     "--http-scgi-temp-path=/var/cache/nginx/scgi"
   ] ++ optionals withDebug [
     "--with-debug"
+  ] ++ optionals withKTLS [
+    "--with-openssl-opt=enable-ktls"
   ] ++ optionals withStream [
     "--with-stream"
     "--with-stream_realip_module"

pkgs/servers/mbtileserver/default.nix

@@ -1,17 +1,23 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub }:
 
 buildGoModule rec {
   pname = "mbtileserver";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "consbio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QdirExVv7p7Mnhp8EGdTVRlmEiYpzoXVQbtO8aS9Kas=";
+    sha256 = "sha256-0wSc2DIfK6o3kSiH2sSQcYRR5dHnQbnJC6SX6DwVk1c=";
   };
 
-  vendorSha256 = "sha256-mUUxUZn8out6WNvKJKHoz+R44RDB0oWJb+57w72+E5w=";
+  # https://github.com/consbio/mbtileserver/issues/130
+  postPatch = lib.optionalString stdenv.isAarch64 ''
+    substituteInPlace handlers/tile_test.go \
+      --replace "Test_CalcScaleResolution" "Skip_CalcScaleResolution"
+  '';
+
+  vendorSha256 = "sha256-36tUTZud0hxH9oZlnKxeK/xzoEzfw3xFMnd/r0srw6U=";
 
   meta = with lib; {
     description = "A simple Go-based server for map tiles stored in mbtiles format";

pkgs/tools/system/rsyslog/default.nix

@@ -14,11 +14,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "rsyslog";
-  version = "8.2110.0";
+  version = "8.2112.0";
 
   src = fetchurl {
     url = "https://www.rsyslog.com/files/download/rsyslog/${pname}-${version}.tar.gz";
-    sha256 = "sha256-P5BOwTfKZBLoJz94ltli7LWJ99DFib3xaxcJ7CfiTzE=";
+    sha256 = "sha256-aiqXOGHpJm2ze9K3ufZytrlwv810Ojl7ju5rDcSFLEE=";
   };
 
   #patches = [ ./fix-gnutls-detection.patch ];

pkgs/top-level/all-packages.nix

@@ -11620,6 +11620,8 @@ with pkgs;
     inherit (darwin) cctools;
   };
 
+  chez-racket = callPackage ../development/compilers/chez-racket {};
+
   chez-srfi = callPackage ../development/chez-modules/chez-srfi { };
 
   chez-mit = callPackage ../development/chez-modules/chez-mit { };
@@ -21209,6 +21211,7 @@ with pkgs;
 
   nginxMainline = callPackage ../servers/http/nginx/mainline.nix {
     zlib = zlib-ng.override { withZlibCompat = true; };
+    withKTLS = true;
     withPerl = false;
     # We don't use `with` statement here on purpose!
     # See https://github.com/NixOS/nixpkgs/pull/10474#discussion_r42369334

pkgs/top-level/coq-packages.nix

@@ -73,6 +73,7 @@ let
       mathcomp-finmap = callPackage ../development/coq-modules/mathcomp-finmap {};
       mathcomp-bigenough = callPackage ../development/coq-modules/mathcomp-bigenough {};
       mathcomp-real-closed = callPackage ../development/coq-modules/mathcomp-real-closed {};
+      mathcomp-word = callPackage ../development/coq-modules/mathcomp-word {};
       mathcomp-zify = callPackage ../development/coq-modules/mathcomp-zify {};
       mathcomp-tarjan = callPackage ../development/coq-modules/mathcomp-tarjan {};
       metalib = callPackage ../development/coq-modules/metalib { };