Merge master into haskell-updates

maintainers/maintainer-list.nix

@@ -2289,6 +2289,12 @@
       fingerprint = "1C4E F4FE 7F8E D8B7 1E88 CCDF BAB1 D15F B7B4 D4CE";
     }];
   };
+  d-xo = {
+    email = "hi@d-xo.org";
+    github = "d-xo";
+    githubId = 6689924;
+    name = "David Terry";
+  };
   dadada = {
     name = "dadada";
     email = "dadada@dadada.li";
@@ -3243,6 +3249,12 @@
       fingerprint = "2D37 1AD2 7E2B BC77 97E1  B759 6C79 278F 3FCD CC02";
     }];
   };
+  ereslibre = {
+    email = "ereslibre@ereslibre.es";
+    github = "ereslibre";
+    githubId = 8706;
+    name = "Rafael Fernández López";
+  };
   ericbmerritt = {
     email = "eric@afiniate.com";
     github = "ericbmerritt";
@@ -11710,12 +11722,6 @@
     githubId = 1962985;
     name = "Vincenzo Mantova";
   };
-  xwvvvvwx = {
-    email = "davidterry@posteo.de";
-    github = "xwvvvvwx";
-    githubId = 6689924;
-    name = "David Terry";
-  };
   xzfc = {
     email = "xzfcpw@gmail.com";
     github = "xzfc";

nixos/doc/manual/development/running-nixos-tests-interactively.section.md

@@ -5,7 +5,7 @@ when developing or debugging a test:
 
 ```ShellSession
 $ nix-build nixos/tests/login.nix -A driverInteractive
-$ ./result/bin/nixos-test-driver
+$ ./result/bin/nixos-test-driver --interactive
 starting VDE switch for network 1
 >
 ```
@@ -24,20 +24,11 @@ back into the test driver command line upon its completion. This allows
 you to inspect the state of the VMs after the test (e.g. to debug the
 test script).
 
-To just start and experiment with the VMs, run:
-
-```ShellSession
-$ nix-build nixos/tests/login.nix -A driverInteractive
-$ ./result/bin/nixos-run-vms
-```
-
-The script `nixos-run-vms` starts the virtual machines defined by test.
-
 You can re-use the VM states coming from a previous run by setting the
 `--keep-vm-state` flag.
 
 ```ShellSession
-$ ./result/bin/nixos-run-vms --keep-vm-state
+$ ./result/bin/nixos-test-driver --interactive --keep-vm-state
 ```
 
 The machine state is stored in the `$TMPDIR/vm-state-machinename`

nixos/doc/manual/from_md/development/running-nixos-tests-interactively.section.xml

@@ -6,7 +6,7 @@
   </para>
   <programlisting>
 $ nix-build nixos/tests/login.nix -A driverInteractive
-$ ./result/bin/nixos-test-driver
+$ ./result/bin/nixos-test-driver --interactive
 starting VDE switch for network 1
 &gt;
 </programlisting>
@@ -25,23 +25,12 @@ starting VDE switch for network 1
     completion. This allows you to inspect the state of the VMs after
     the test (e.g. to debug the test script).
   </para>
-  <para>
-    To just start and experiment with the VMs, run:
-  </para>
-  <programlisting>
-$ nix-build nixos/tests/login.nix -A driverInteractive
-$ ./result/bin/nixos-run-vms
-</programlisting>
-  <para>
-    The script <literal>nixos-run-vms</literal> starts the virtual
-    machines defined by test.
-  </para>
   <para>
     You can re-use the VM states coming from a previous run by setting
     the <literal>--keep-vm-state</literal> flag.
   </para>
   <programlisting>
-$ ./result/bin/nixos-run-vms --keep-vm-state
+$ ./result/bin/nixos-test-driver --interactive --keep-vm-state
 </programlisting>
   <para>
     The machine state is stored in the

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

@@ -663,6 +663,15 @@
           group.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>yambar</literal> package has been split into
+          <literal>yambar</literal> and
+          <literal>yambar-wayland</literal>, corresponding to the xorg
+          and wayland backend respectively. Please switch to
+          <literal>yambar-wayland</literal> if you are on wayland.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-notable-changes">
@@ -832,6 +841,15 @@
           version of zfs.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          Nginx will use the value of
+          <literal>sslTrustedCertificate</literal> if provided for a
+          virtual host, even if <literal>enableACME</literal> is set.
+          This is useful for providers not using the same certificate to
+          sign OCSP responses and server certificates.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
 </section>

nixos/doc/manual/release-notes/rl-2111.section.md

@@ -166,6 +166,8 @@ pt-services.clipcat.enable).
 
 - The `openrazer` and `openrazer-daemon` packages as well as the `hardware.openrazer` module now require users to be members of the `openrazer` group instead of `plugdev`. With this change, users no longer need be granted the entire set of `plugdev` group permissions, which can include permissions other than those required by `openrazer`. This is desirable from a security point of view. The setting [`harware.openrazer.users`](options.html#opt-services.hardware.openrazer.users) can be used to add users to the `openrazer` group.
 
+- The `yambar` package has been split into `yambar` and `yambar-wayland`, corresponding to the xorg and wayland backend respectively. Please switch to `yambar-wayland` if you are on wayland.
+
 ## Other Notable Changes {#sec-release-21.11-notable-changes}
 
 - The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.
@@ -211,3 +213,5 @@ pt-services.clipcat.enable).
 - The [services.syncoid.enable](options.html#opt-services.syncoid.enable) module now properly drops ZFS permissions after usage. Before it delegated permissions to whole pools instead of datasets and didn't clean up after execution. You can manually look this up for your pools by running `zfs allow your-pool-name` and use `zfs unallow syncoid your-pool-name` to clean this up.
 
 - Zfs: `latestCompatibleLinuxPackages` is now exported on the zfs package. One can use `boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;` to always track the latest compatible kernel with a given version of zfs.
+
+- Nginx will use the value of `sslTrustedCertificate` if provided for a virtual host, even if `enableACME` is set. This is useful for providers not using the same certificate to sign OCSP responses and server certificates.

nixos/lib/test-driver/test-driver.py

@@ -24,7 +24,6 @@ import sys
 import telnetlib
 import tempfile
 import time
-import traceback
 import unicodedata
 
 CHAR_TO_KEY = {
@@ -930,26 +929,13 @@ def join_all() -> None:
             machine.wait_for_shutdown()
 
 
-def test_script() -> None:
+def run_tests(interactive: bool = False) -> None:
-    exec(os.environ["testScript"])
-
-
-def run_tests() -> None:
     global machines
-    tests = os.environ.get("tests", None)
+    if interactive:
-    if tests is not None:
+        ptpython.repl.embed(globals(), locals())
-        with log.nested("running the VM test script"):
-            try:
-                exec(tests, globals())
-            except Exception as e:
-                eprint("error: ")
-                traceback.print_exc()
-                sys.exit(1)
     else:
-        ptpython.repl.embed(locals(), globals())
+        test_script()
-
         # TODO: Collect coverage data
-
         for machine in machines:
             if machine.is_up():
                 machine.execute("sync")
@@ -965,6 +951,31 @@ def serial_stdout_off() -> None:
     log._print_serial_logs = False
 
 
+class EnvDefault(argparse.Action):
+    """An argpars Action that takes values from the specified
+    environment variable as the flags default value.
+    """
+
+    def __init__(self, envvar, required=False, default=None, nargs=None, **kwargs):  # type: ignore
+        if not default and envvar:
+            if envvar in os.environ:
+                if nargs is not None and (nargs.isdigit() or nargs in ["*", "+"]):
+                    default = os.environ[envvar].split()
+                else:
+                    default = os.environ[envvar]
+                kwargs["help"] = (
+                    kwargs["help"] + f" (default from environment: {default})"
+                )
+        if required and default:
+            required = False
+        super(EnvDefault, self).__init__(
+            default=default, required=required, nargs=nargs, **kwargs
+        )
+
+    def __call__(self, parser, namespace, values, option_string=None):  # type: ignore
+        setattr(namespace, self.dest, values)
+
+
 @contextmanager
 def subtest(name: str) -> Iterator[None]:
     with log.nested(name):
@@ -986,18 +997,52 @@ if __name__ == "__main__":
         help="re-use a VM state coming from a previous run",
         action="store_true",
     )
-    (cli_args, vm_scripts) = arg_parser.parse_known_args()
+    arg_parser.add_argument(
+        "-I",
+        "--interactive",
+        help="drop into a python repl and run the tests interactively",
+        action="store_true",
+    )
+    arg_parser.add_argument(
+        "--start-scripts",
+        metavar="START-SCRIPT",
+        action=EnvDefault,
+        envvar="startScripts",
+        nargs="*",
+        help="start scripts for participating virtual machines",
+    )
+    arg_parser.add_argument(
+        "--vlans",
+        metavar="VLAN",
+        action=EnvDefault,
+        envvar="vlans",
+        nargs="*",
+        help="vlans to span by the driver",
+    )
+    arg_parser.add_argument(
+        "testscript",
+        action=EnvDefault,
+        envvar="testScript",
+        help="the test script to run",
+        type=pathlib.Path,
+    )
+
+    args = arg_parser.parse_args()
+    global test_script
+
+    def test_script() -> None:
+        with log.nested("running the VM test script"):
+            exec(pathlib.Path(args.testscript).read_text(), globals())
 
     log = Logger()
 
-    vlan_nrs = list(dict.fromkeys(os.environ.get("VLANS", "").split()))
+    vde_sockets = [create_vlan(v) for v in args.vlans]
-    vde_sockets = [create_vlan(v) for v in vlan_nrs]
     for nr, vde_socket, _, _ in vde_sockets:
         os.environ["QEMU_VDE_SOCKET_{}".format(nr)] = vde_socket
 
     machines = [
-        create_machine({"startCommand": s, "keepVmState": cli_args.keep_vm_state})
+        create_machine({"startCommand": s, "keepVmState": args.keep_vm_state})
-        for s in vm_scripts
+        for s in args.start_scripts
     ]
     machine_eval = [
         "{0} = machines[{1}]".format(m.name, idx) for idx, m in enumerate(machines)
@@ -1017,6 +1062,6 @@ if __name__ == "__main__":
         log.close()
 
     tic = time.time()
-    run_tests()
+    run_tests(args.interactive)
     toc = time.time()
     print("test script finished in {:.2f}s".format(toc - tic))

nixos/lib/testing-python.nix

@@ -83,7 +83,10 @@ rec {
         ''
           mkdir -p $out
 
-          LOGFILE=/dev/null tests='exec(os.environ["testScript"])' ${driver}/bin/nixos-test-driver
+          # effectively mute the XMLLogger
+          export LOGFILE=/dev/null
+
+          ${driver}/bin/nixos-test-driver
         '';
 
       passthru = driver.passthru // {
@@ -166,7 +169,10 @@ rec {
       ''
         mkdir -p $out/bin
 
+        vmStartScripts=($(for i in ${toString vms}; do echo $i/bin/run-*-vm; done))
         echo -n "$testScript" > $out/test-script
+        ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-test-driver
+
         ${lib.optionalString (!skipLint) ''
           PYFLAKES_BUILTINS="$(
             echo -n ${lib.escapeShellArg (lib.concatStringsSep "," nodeHostNames)},
@@ -174,17 +180,12 @@ rec {
           )" ${python3Packages.pyflakes}/bin/pyflakes $out/test-script
         ''}
 
-        ln -s ${testDriver}/bin/nixos-test-driver $out/bin/
+        # set defaults through environment
-        vms=($(for i in ${toString vms}; do echo $i/bin/run-*-vm; done))
+        # see: ./test-driver/test-driver.py argparse implementation
         wrapProgram $out/bin/nixos-test-driver \
-          --add-flags "''${vms[*]}" \
+          --set startScripts "''${vmStartScripts[*]}" \
-          --run "export testScript=\"\$(${coreutils}/bin/cat $out/test-script)\"" \
+          --set testScript "$out/test-script" \
-          --set VLANS '${toString vlans}'
+          --set vlans '${toString vlans}'
-        ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-run-vms
-        wrapProgram $out/bin/nixos-run-vms \
-          --add-flags "''${vms[*]}" \
-          --set tests 'start_all(); join_all();' \
-          --set VLANS '${toString vlans}'
       '');
 
   # Make a full-blown test

nixos/modules/security/acme.nix

@@ -26,10 +26,46 @@ let
     Group = mkDefault "acme";
     UMask = 0022;
     StateDirectoryMode = 750;
-      ProtectSystem = "full";
+    ProtectSystem = "strict";
+    ReadWritePaths = [
+      "/var/lib/acme"
+    ];
     PrivateTmp = true;
 
     WorkingDirectory = "/tmp";
+
+    CapabilityBoundingSet = [ "" ];
+    DevicePolicy = "closed";
+    LockPersonality = true;
+    MemoryDenyWriteExecute = true;
+    NoNewPrivileges = true;
+    PrivateDevices = true;
+    ProtectClock = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectControlGroups = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProcSubset = "pid";
+    RemoveIPC = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      # 1. allow a reasonable set of syscalls
+      "@system-service"
+      # 2. and deny unreasonable ones
+      "~@privileged @resources"
+      # 3. then allow the required subset within denied groups
+      "@chown"
+    ];
   };
 
   # In order to avoid race conditions creating the CA for selfsigned certs,

nixos/modules/security/polkit.nix

@@ -96,8 +96,10 @@ in
     users.users.polkituser = {
       description = "PolKit daemon";
       uid = config.ids.uids.polkituser;
+      group = "polkituser";
     };
 
+    users.groups.polkituser = {};
   };
 
 }

nixos/modules/services/mail/nullmailer.nix

@@ -220,7 +220,7 @@ with lib;
       after = [ "network.target" ];
 
       preStart = ''
-        mkdir -p /var/spool/nullmailer/{queue,tmp}
+        mkdir -p /var/spool/nullmailer/{queue,tmp,failed}
         rm -f /var/spool/nullmailer/trigger && mkfifo -m 660 /var/spool/nullmailer/trigger
       '';
 

nixos/modules/services/misc/gitea.nix

@@ -522,6 +522,9 @@ in
           (umask 027; gitea_setup)
         ''}
 
+        # run migrations/init the database
+        ${gitea}/bin/gitea migrate
+
         # update all hooks' binary paths
         ${gitea}/bin/gitea admin regenerate hooks
 

nixos/modules/services/misc/nitter.nix

@@ -312,6 +312,31 @@ in
           AmbientCapabilities = lib.mkIf (cfg.server.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
           Restart = "on-failure";
           RestartSec = "5s";
+          # Hardening
+          CapabilityBoundingSet = if (cfg.server.port < 1024) then [ "CAP_NET_BIND_SERVICE" ] else [ "" ];
+          DeviceAllow = [ "" ];
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          PrivateDevices = true;
+          # A private user cannot have process capabilities on the host's user
+          # namespace and thus CAP_NET_BIND_SERVICE has no effect.
+          PrivateUsers = (cfg.server.port >= 1024);
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+          UMask = "0077";
         };
     };
 

nixos/modules/services/networking/mullvad-vpn.nix

@@ -9,6 +9,7 @@ with lib;
     default = false;
     description = ''
       This option enables Mullvad VPN daemon.
+      This sets <option>networking.firewall.checkReversePath</option> to "loose", which might be undesirable for security.
     '';
   };
 
@@ -18,6 +19,9 @@ with lib;
     # mullvad-daemon writes to /etc/iproute2/rt_tables
     networking.iproute2.enable = true;
 
+    # See https://github.com/NixOS/nixpkgs/issues/113589
+    networking.firewall.checkReversePath = "loose";
+
     systemd.services.mullvad-daemon = {
       description = "Mullvad VPN daemon";
       wantedBy = [ "multi-user.target" ];
@@ -42,5 +46,5 @@ with lib;
     };
   };
 
-  meta.maintainers = [ maintainers.xfix ];
+  meta.maintainers = with maintainers; [ ymarkus ];
 }

nixos/modules/services/networking/ntp/chrony.nix

@@ -81,19 +81,28 @@ in
         '';
       };
 
-      initstepslew = mkOption {
+      initstepslew = {
-        type = types.attrsOf (types.either types.bool types.int);
+        enabled = mkOption {
-        default = {
+          type = types.bool;
-          enabled = true;
+          default = true;
-          threshold = 1000; # by default, same threshold as 'ntpd -g' (1000s)
-        };
           description = ''
-          Allow chronyd to make a rapid measurement of the system clock error at
+            Allow chronyd to make a rapid measurement of the system clock error
-          boot time, and to correct the system clock by stepping before normal
+            at boot time, and to correct the system clock by stepping before
-          operation begins.
+            normal operation begins.
           '';
         };
 
+        threshold = mkOption {
+          type = types.either types.float types.int;
+          default = 1000; # by default, same threshold as 'ntpd -g' (1000s)
+          description = ''
+            The threshold of system clock error (in seconds) above which the
+            clock will be stepped. If the correction required is less than the
+            threshold, a slew is used instead.
+          '';
+        };
+      };
+
       directory = mkOption {
         type = types.str;
         default = "/var/lib/chrony";

nixos/modules/services/networking/tinc.nix

@@ -427,9 +427,12 @@ in
       nameValuePair ("tinc.${network}") ({
         description = "Tinc daemon user for ${network}";
         isSystemUser = true;
+        group = "tinc.${network}";
       })
     );
-
+    users.groups = flip mapAttrs' cfg.networks (network: _:
+      nameValuePair "tinc.${network}" {}
+    );
   };
 
   meta.maintainers = with maintainers; [ minijackson ];

nixos/modules/services/networking/wakeonlan.nix

@@ -31,6 +31,20 @@ in
 
     services.wakeonlan.interfaces = mkOption {
       default = [ ];
+      type = types.listOf (types.submodule { options = {
+        interface = mkOption {
+          type = types.str;
+          description = "Interface to enable for Wake-On-Lan.";
+        };
+        method = mkOption {
+          type = types.enum [ "magicpacket" "password"];
+          description = "Wake-On-Lan method for this interface.";
+        };
+        password = mkOption {
+          type = types.strMatching "[a-fA-F0-9]{2}:([a-fA-F0-9]{2}:){4}[a-fA-F0-9]{2}";
+          description = "The password has the shape of six bytes in hexadecimal separated by a colon each.";
+        };
+      };});
       example = [
         {
           interface = "eth0";

nixos/modules/services/web-apps/miniflux.nix

@@ -98,6 +98,29 @@ in
         EnvironmentFile = if cfg.adminCredentialsFile == null
         then defaultCredentials
         else cfg.adminCredentialsFile;
+        # Hardening
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [ "" ];
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+        UMask = "0077";
       };
 
       environment = cfg.config;

nixos/modules/services/web-servers/nginx/default.nix

@@ -22,7 +22,9 @@ let
     } // (optionalAttrs (vhostConfig.enableACME || vhostConfig.useACMEHost != null) {
       sslCertificate = "${certs.${certName}.directory}/fullchain.pem";
       sslCertificateKey = "${certs.${certName}.directory}/key.pem";
-      sslTrustedCertificate = "${certs.${certName}.directory}/chain.pem";
+      sslTrustedCertificate = if vhostConfig.sslTrustedCertificate != null
+                              then vhostConfig.sslTrustedCertificate
+                              else "${certs.${certName}.directory}/chain.pem";
     })
   ) cfg.virtualHosts;
   enableIPv6 = config.networking.enableIPv6;

nixos/modules/services/web-servers/nginx/vhost-options.nix

@@ -145,7 +145,7 @@ with lib;
     sslTrustedCertificate = mkOption {
       type = types.nullOr types.path;
       default = null;
-      example = "/var/root.cert";
+      example = "\${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
       description = "Path to root SSL certificate for stapling and client certificates.";
     };
 

nixos/modules/system/boot/systemd.nix

@@ -1128,6 +1128,7 @@ in
 
     users.groups.systemd-journal.gid = config.ids.gids.systemd-journal;
     users.users.systemd-journal-gateway.uid = config.ids.uids.systemd-journal-gateway;
+    users.users.systemd-journal-gateway.group = "systemd-journal-gateway";
     users.groups.systemd-journal-gateway.gid = config.ids.gids.systemd-journal-gateway;
 
     # Generate timer units for all services that have a ‘startAt’ value.

nixos/modules/virtualisation/containerd.nix

@@ -86,6 +86,7 @@ in
 
         StateDirectory = "containerd";
         RuntimeDirectory = "containerd";
+        RuntimeDirectoryPreserve = "yes";
       };
       unitConfig = {
         StartLimitBurst = "16";

nixos/tests/acme.nix

@@ -105,9 +105,9 @@ in import ./make-test-python.nix ({ lib, ... }: {
         security.acme.certs."a.example.test".keyType = "ec384";
         security.acme.certs."a.example.test".postRun = ''
           set -euo pipefail
-          touch test
+          touch /home/test
-          chown root:root test
+          chown root:root /home/test
-          echo testing > test
+          echo testing > /home/test
         '';
       };
 
@@ -383,7 +383,7 @@ in import ./make-test-python.nix ({ lib, ... }: {
           switch_to(webserver, "cert-change")
           webserver.wait_for_unit("acme-finished-a.example.test.target")
           check_connection_key_bits(client, "a.example.test", "384")
-          webserver.succeed("grep testing /var/lib/acme/a.example.test/test")
+          webserver.succeed("grep testing /home/test")
           # Clean to remove the testing file (and anything else messy we did)
           webserver.succeed("systemctl clean acme-a.example.test.service --what=state")
 

nixos/tests/bazarr.nix

@@ -7,7 +7,7 @@ let
 in
 {
   name = "bazarr";
-  meta.maintainers = with maintainers; [ xwvvvvwx ];
+  meta.maintainers = with maintainers; [ d-xo ];
 
   nodes.machine =
     { pkgs, ... }:

nixos/tests/nitter.nix

@@ -6,11 +6,13 @@ import ./make-test-python.nix ({ pkgs, ... }:
 
   nodes.machine = {
     services.nitter.enable = true;
+    # Test CAP_NET_BIND_SERVICE
+    services.nitter.server.port = 80;
   };
 
   testScript = ''
     machine.wait_for_unit("nitter.service")
-    machine.wait_for_open_port("8080")
+    machine.wait_for_open_port("80")
-    machine.succeed("curl --fail http://localhost:8080/")
+    machine.succeed("curl --fail http://localhost:80/")
   '';
 })

nixos/tests/prometheus-exporters.nix

@@ -360,7 +360,6 @@ let
         systemd.services.prometheus-kea-exporter.after = [ "kea-dhcp6-server.service" ];
 
         services.kea = {
-          enable = true;
           dhcp6 = {
             enable = true;
             settings = {

nixos/tests/wireguard/wg-quick.nix

@@ -8,7 +8,7 @@ import ../make-test-python.nix ({ pkgs, lib, ... }:
   {
     name = "wg-quick";
     meta = with pkgs.lib.maintainers; {
-      maintainers = [ xwvvvvwx ];
+      maintainers = [ d-xo ];
     };
 
     nodes = {

pkgs/applications/audio/boops/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "boops";
-  version = "1.6.0";
+  version = "1.6.4";
 
   src = fetchFromGitHub {
     owner = "sjaehn";
     repo = "BOops";
     rev = version;
-    sha256 = "sha256-7eNvt8PxIZCp83Y5XX5fBolBon4j+HPtu8wrgG8Miok=";
+    sha256 = "sha256-rljUb0fj231MQh+7jTpjAsZm1QkNzfdSpcI1cS5fs/c=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/audio/cozy-audiobooks/default.nix

@@ -8,11 +8,13 @@
 , gtk3
 , gst_all_1
 , gobject-introspection
+, libhandy
 , python3Packages
 , file
 , cairo
 , gettext
 , gnome
+, pantheon
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -20,7 +22,7 @@ python3Packages.buildPythonApplication rec {
   format = "other"; # no setup.py
 
   pname = "cozy";
-  version = "0.7.2";
+  version = "1.0.3";
 
   # Temporary fix
   # See https://github.com/NixOS/nixpkgs/issues/57029
@@ -31,7 +33,7 @@ python3Packages.buildPythonApplication rec {
     owner = "geigi";
     repo = pname;
     rev = version;
-    sha256 = "0fmbddi4ga0bppwg3rm3yjmf7jgqc6zfslmavnr1pglbzkjhy9fs";
+    sha256 = "0m0xiqpb87pwr3fhy0a4qxg67yjhwchcxj3x2anyy0li4inryxag";
   };
 
   nativeBuildInputs = [
@@ -47,6 +49,8 @@ python3Packages.buildPythonApplication rec {
     cairo
     gettext
     gnome.adwaita-icon-theme
+    libhandy
+    pantheon.granite
   ] ++ (with gst_all_1; [
     gstreamer
     gst-plugins-good
@@ -70,8 +74,7 @@ python3Packages.buildPythonApplication rec {
   ];
 
   postPatch = ''
-    chmod +x meson/post_install.py
+    patchShebangs meson/*.py
-    patchShebangs meson/post_install.py
   '';
 
   postInstall = ''

pkgs/applications/audio/helvum/default.nix

@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "helvum";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "ryuukyu";
     repo = pname;
     rev = version;
-    sha256 = "sha256-ZnpdGXK8N8c/s4qC2NXcn0Pdqrqr47iOWvVwXD9pn1A=";
+    sha256 = "sha256-AlHCK4pWaoNjR0eflxHBsuVaaily/RvCbgJv/ByQZK4=";
   };
 
-  cargoSha256 = "sha256-2v2L20rUWftXdhhuE3wiRrDIuSg6VFxfpWYMRaMUyTU=";
+  cargoSha256 = "sha256-mAhh12rGvQjs2xtm+OrtVv0fgG6qni/QM/oRYoFR7U8=";
 
   nativeBuildInputs = [ clang copyDesktopItems pkg-config ];
   buildInputs = [ glib gtk4 pipewire ];

pkgs/applications/blockchains/lndconnect/default.nix

@@ -18,7 +18,7 @@ buildGoPackage rec {
     description = "Generate QRCode to connect apps to lnd Resources";
     license = licenses.mit;
     homepage = "https://github.com/LN-Zap/lndconnect";
-    maintainers = [ maintainers.xwvvvvwx ];
+    maintainers = [ maintainers.d-xo ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/blockchains/turbo-geth/default.nix

@@ -25,6 +25,6 @@ buildGoModule rec {
     homepage = "https://github.com/ledgerwatch/turbo-geth/";
     description = "Ethereum node and geth fork focused on scalability and modularity";
     license = with licenses; [ lgpl3Plus gpl3Plus ];
-    maintainers = with maintainers; [ xwvvvvwx ];
+    maintainers = with maintainers; [ d-xo ];
   };
 }

pkgs/applications/editors/kdevelop5/kdevelop.nix

@@ -10,11 +10,11 @@
 
 mkDerivation rec {
   pname = "kdevelop";
-  version = "5.6.1";
+  version = "5.6.2";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "02ip5r67hjfpywkm3mz86n6wbqcr7996ifzfd2fyzsvm4998hi4y";
+    sha256 = "sha256-D4a8P+U/dhwePj91RFd6DEFDO+i/8xDPLnKfdvQ2O/Y=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/audio/wavrsocvt/default.nix

@@ -8,8 +8,6 @@ stdenv.mkDerivation {
     sha256 = "15qlvdfwbiclljj7075ycm78yzqahzrgl4ky8pymix5179acm05h";
   };
 
-  phases = [ "unpackPhase" "installPhase" ];
-
   unpackPhase = ''
     tar -zxf $src
     '';

pkgs/applications/misc/ausweisapp2/default.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "AusweisApp2";
-  version = "1.22.0";
+  version = "1.22.2";
 
   src = fetchFromGitHub {
     owner = "Governikus";
     repo = "AusweisApp2";
     rev = version;
-    sha256 = "00isb8xcbm419nvxx2ri0n8x5d403733h2whjqjcd3hmpx3x4q1h";
+    sha256 = "sha256-Oci1y6//45Gep4IS6Ym+v9MPCP5mOswAiWPkXqd+zR0=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

pkgs/applications/misc/avrdudess/default.nix

@@ -10,7 +10,8 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ unzip ];
 
-  phases = [ "buildPhase" ];
+  dontUnpack = true;
+  dontInstall = true;
 
   buildPhase = ''
     mkdir -p "$out/avrdudess"

pkgs/applications/misc/azuredatastudio/default.nix

@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     at-spi2-atk
   ];
 
-  phases = "unpackPhase fixupPhase";
+  dontInstall = true;
 
   # change this to azuredatastudio-insiders for insiders releases
   edition = "azuredatastudio";

pkgs/applications/misc/cherrytree/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cherrytree";
-  version = "0.99.39";
+  version = "0.99.40";
 
   src = fetchFromGitHub {
     owner = "giuspen";
     repo = "cherrytree";
     rev = version;
-    sha256 = "sha256-QSRYtnZxLAaq42PvPd5+LxSzq/Hd/Cz5bquBTiGWnAE=";
+    sha256 = "sha256-K1rf8/7kEpfLOPYJGh5U2eTnr5XCDhuc+seoUAKW7aE=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/elogind/default.nix

@@ -29,13 +29,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "elogind";
-  version = "246.9.2";
+  version = "246.10";
 
   src = fetchFromGitHub {
     owner = "elogind";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-EsW19D6eoEO4RJO+jwMA/SMFus+cxq9Fcy2zrcn9pd8=";
+    sha256 = "sha256-+Nv6FL9Yjmfxs24+2mUTP//wbjzGUq4ftgJLfuEqBJg=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/emem/default.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
     sha256 = "18x3s3jrph8k3pc75jgwkfqazygpsx93zjxx68zms58my17cybh1";
   };
 
-  phases = [ "buildPhase" "installPhase" ];
+  dontUnpack = true;
 
   buildPhase = ''
     mkdir -p $out/bin $out/share/java

pkgs/applications/misc/fuzzel/default.nix

@@ -1,22 +1,75 @@
-{ stdenv, lib, fetchzip, pkg-config, meson, ninja, wayland, pixman, cairo, librsvg, wayland-protocols, wlroots, libxkbcommon, scdoc, git, tllist, fcft}:
+{ stdenv
+, lib
+, fetchFromGitea
+, pkg-config
+, meson
+, ninja
+, wayland-scanner
+, wayland
+, pixman
+, wayland-protocols
+, libxkbcommon
+, scdoc
+, tllist
+, fcft
+, enableCairo ? true
+, enablePNG ? true
+, enableSVG ? true
+# Optional dependencies
+, cairo
+, librsvg
+, libpng
+}:
+
+let
+  # Courtesy of sternenseemann and FRidh, commit c9a7fdfcfb420be8e0179214d0d91a34f5974c54
+  mesonFeatureFlag = opt: b: "-D${opt}=${if b then "enabled" else "disabled"}";
+in
 
 stdenv.mkDerivation rec {
   pname = "fuzzel";
   version = "1.6.1";
 
-  src = fetchzip {
+  src = fetchFromGitea {
-    url = "https://codeberg.org/dnkl/fuzzel/archive/${version}.tar.gz";
+    domain = "codeberg.org";
+    owner = "dnkl";
+    repo = "fuzzel";
+    rev = version;
     sha256 = "sha256-JW5sAlTprSRIdFbmSaUreGtNccERgQMGEW+WCSscYQk=";
   };
 
-  nativeBuildInputs = [ pkg-config meson ninja scdoc git ];
+  nativeBuildInputs = [
-  buildInputs = [ wayland pixman cairo librsvg wayland-protocols  wlroots libxkbcommon tllist fcft ];
+    pkg-config
+    wayland-scanner
+    meson
+    ninja
+    scdoc
+  ];
+
+  buildInputs = [
+    wayland
+    pixman
+    wayland-protocols
+    libxkbcommon
+    tllist
+    fcft
+  ] ++ lib.optional enableCairo cairo
+    ++ lib.optional enablePNG libpng
+    ++ lib.optional enableSVG librsvg;
+
+  mesonBuildType = "release";
+
+  mesonFlags = [
+    (mesonFeatureFlag "enable-cairo" enableCairo)
+    (mesonFeatureFlag "enable-png" enablePNG)
+    (mesonFeatureFlag "enable-svg" enableSVG)
+  ];
 
   meta = with lib; {
     description = "Wayland-native application launcher, similar to rofi’s drun mode";
     homepage = "https://codeberg.org/dnkl/fuzzel";
     license = licenses.mit;
-    maintainers = with maintainers; [ fionera ];
+    maintainers = with maintainers; [ fionera polykernel ];
     platforms = with platforms; linux;
     changelog = "https://codeberg.org/dnkl/fuzzel/releases/tag/${version}";
   };

pkgs/applications/misc/ganttproject-bin/default.nix

@@ -15,8 +15,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ jre ];
 
-  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
-
   installPhase = let
 
     desktopItem = makeDesktopItem {

pkgs/applications/misc/gollum/default.nix

@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  phases = [ "installPhase" ];
+  dontUnpack = true;
 
   installPhase = let
     env = bundlerEnv {

pkgs/applications/misc/hello-unfree/default.nix

@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   pname = "example-unfree-package";
   version = "1.0";
 
-  phases = [ "installPhase" "fixupPhase" ];
+  dontUnpack = true;
 
   installPhase = ''
     mkdir -p $out/bin

pkgs/applications/misc/joplin-desktop/default.nix

@@ -55,7 +55,8 @@ let
       install -Dm444 ${appimageContents}/@joplinapp-desktop.desktop -t $out/share/applications
       install -Dm444 ${appimageContents}/@joplinapp-desktop.png -t $out/share/pixmaps
       substituteInPlace $out/share/applications/@joplinapp-desktop.desktop \
-        --replace 'Exec=AppRun' 'Exec=${pname}'
+        --replace 'Exec=AppRun' 'Exec=${pname}' \
+        --replace 'Icon=joplin' "Icon=$out/share/pixmaps/@joplinapp-desktop.png"
     '';
   };
 

pkgs/applications/misc/rtv/default.nix

@@ -1,46 +0,0 @@
-{ lib, fetchFromGitHub, python3Packages }:
-
-with python3Packages;
-buildPythonApplication rec {
-  version = "1.27.0";
-  pname = "rtv";
-
-  src = fetchFromGitHub {
-    owner = "michael-lazar";
-    repo = "rtv";
-    rev = "v${version}";
-    sha256 = "1hw7xy2kjxq7y3wcibcz4l7zj8icvigialqr17l362xry0y17y5j";
-  };
-
-  # Tests try to access network
-  doCheck = false;
-
-  checkPhase = ''
-    py.test
-  '';
-
-  checkInputs = [
-    coverage
-    coveralls
-    docopt
-    mock
-    pylint
-    pytest
-    vcrpy
-  ];
-
-  propagatedBuildInputs = [
-    beautifulsoup4
-    decorator
-    kitchen
-    requests
-    six
-  ];
-
-  meta = with lib; {
-    homepage = "https://github.com/michael-lazar/rtv";
-    description = "Browse Reddit from your Terminal";
-    license = licenses.mit;
-    maintainers = with maintainers; [ matthiasbeyer wedens ];
-  };
-}

pkgs/applications/misc/smos/default.nix

@@ -4,7 +4,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "smos-${version}";
+  pname = "smos";
   version = "0.1.0";
 
   src = fetchurl {
@@ -12,7 +12,8 @@ stdenv.mkDerivation rec {
     sha256 = "sha256:07yavk7xl92yjwwjdig90yq421n8ldv4fjfw7izd4hfpzw849a12";
   };
 
-  phases = [ "unpackPhase" ];
+  dontInstall = true;
+
   unpackCmd = "${unzip}/bin/unzip -d $out $curSrc";
   sourceRoot = ".";
 

pkgs/applications/misc/usql/default.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "usql";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "xo";
     repo = "usql";
     rev = "v${version}";
-    sha256 = "sha256-fcKn4kHIRvMdgGFKDNQg49YxLc0Y5j/8VwKoDLiXbEU=";
+    sha256 = "sha256-vLGoPttl7f4qCVM8e0F0llIODuNqJ7GxXqbUgokv7Qw=";
   };
 
-  vendorSha256 = "sha256-uAV8NLnqXjIDILfnbbkVr2BOIucQ8vX89KI5yIkVtus=";
+  vendorSha256 = "sha256-sGECp1L6WzIPGbQbBoV1IrTgyy4/c95OLAmj9D0FjXs=";
 
   buildInputs = [ unixODBC icu ];
 

pkgs/applications/misc/wbg/default.nix

@@ -1,50 +1,64 @@
 { stdenv
 , lib
-, fetchgit
+, fetchFromGitea
+, pkg-config
 , meson
 , ninja
-, pkg-config
-, git
-, scdoc
-, cairo
-, fcft
-, libpng
-, librsvg
-, libxkbcommon
 , pixman
 , tllist
 , wayland
+, wayland-scanner
 , wayland-protocols
-, wlroots
+, enablePNG ? true
+, enableJPEG ? true
+# Optional dependencies
+, libpng
+, libjpeg
 }:
 
+let
+  # Courtesy of sternenseemann and FRidh, commit c9a7fdfcfb420be8e0179214d0d91a34f5974c54
+  mesonFeatureFlag = opt: b: "-D${opt}=${if b then "enabled" else "disabled"}";
+in
+
 stdenv.mkDerivation rec {
   pname = "wbg";
-  version = "unstable-2020-08-01";
+  version = "1.0.2";
 
-  src = fetchgit {
+  src = fetchFromGitea {
-    url = "https://codeberg.org/dnkl/wbg";
+    domain = "codeberg.org";
-    rev = "1b05bd80d0f40e3ba1e977002d0653f532649269";
+    owner = "dnkl";
-    sha256 = "0i1j7aqvj0vl2ww5cvffqci1kjqjn0sw6sp2j0ljblaif6qk9asc";
+    repo = "wbg";
+    rev = version;
+    sha256 = "sha256-PKEOWRcSAB4Uv5TfameQIEZh6s6xCGdyoZ13etL1TKA=";
   };
 
-  nativeBuildInputs = [ pkg-config meson ninja scdoc git ];
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+    wayland-scanner
+  ];
+
   buildInputs = [
-    cairo
-    fcft
-    libpng
-    librsvg
-    libxkbcommon
     pixman
     tllist
     wayland
     wayland-protocols
-    wlroots
+  ] ++ lib.optional enablePNG libpng
+    ++ lib.optional enableJPEG libjpeg;
+
+  mesonBuildType = "release";
+
+  mesonFlags = [
+    (mesonFeatureFlag "png" enablePNG)
+    (mesonFeatureFlag "jpeg" enableJPEG)
   ];
 
   meta = with lib; {
     description = "Wallpaper application for Wayland compositors";
     homepage = "https://codeberg.org/dnkl/wbg";
+    changelog = "https://codeberg.org/dnkl/wbg/releases/tag/${version}";
     license = licenses.isc;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = with platforms; linux;

pkgs/applications/misc/yambar/default.nix

@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, fetchgit
+, fetchFromGitea
 , pkg-config
 , meson
 , ninja
@@ -9,50 +9,75 @@
 , fcft
 , json_c
 , libmpdclient
-, libxcb
 , libyaml
 , pixman
 , tllist
 , udev
 , wayland
+, wayland-scanner
 , wayland-protocols
+, waylandSupport ? false
+# Xorg backend
+, libxcb
 , xcbutil
 , xcbutilcursor
 , xcbutilerrors
 , xcbutilwm
 }:
 
+let
+  # Courtesy of sternenseemann and FRidh, commit c9a7fdfcfb420be8e0179214d0d91a34f5974c54
+  mesonFeatureFlag = opt: b: "-D${opt}=${if b then "enabled" else "disabled"}";
+in
+
 stdenv.mkDerivation rec {
   pname = "yambar";
   version = "1.6.2";
 
-  src = fetchgit {
+  src = fetchFromGitea {
-    url = "https://codeberg.org/dnkl/yambar.git";
+    domain = "codeberg.org";
+    owner = "dnkl";
+    repo = "yambar";
     rev = version;
-    sha256 = "sha256-oUNkaWrYIcsK2u+aeRg6DHmH4M1VZ0leNSM0lV9Yy1Y=";
+    sha256 = "sha256-GPKR2BYl3ebxxXbVfH/oZLs7639EYwWU4ZsilJn0Ss8=";
   };
 
-  nativeBuildInputs = [ pkg-config meson ninja scdoc ];
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+    scdoc
+    wayland-scanner
+  ];
+
   buildInputs = [
     alsa-lib
     fcft
     json_c
     libmpdclient
-    libxcb
     libyaml
     pixman
     tllist
     udev
     wayland
     wayland-protocols
+  ] ++ lib.optionals (!waylandSupport) [
     xcbutil
     xcbutilcursor
     xcbutilerrors
     xcbutilwm
   ];
 
+  mesonBuildType = "release";
+
+  mesonFlags = [
+    (mesonFeatureFlag "backend-x11" (!waylandSupport))
+    (mesonFeatureFlag "backend-wayland" waylandSupport)
+  ];
+
   meta = with lib; {
     homepage = "https://codeberg.org/dnkl/yambar";
+    changelog = "https://codeberg.org/dnkl/yambar/releases/tag/${version}";
     description = "Modular status panel for X11 and Wayland";
     longDescription = ''
       yambar is a lightweight and configurable status panel (bar, for short) for

pkgs/applications/misc/zola/default.nix

@@ -2,17 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "zola";
-  version = "unstable-2021-07-14";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "getzola";
     repo = pname;
-    # unstable because the latest release fails to build
+    rev = "v${version}";
-    rev = "312ffcb04c06c5f157b9fd2b944b858703238592";
+    sha256 = "1mvin6pfqhsfhaifivbdi6qcn0dsa98w83m1n51q807gh4l1k2yj";
-    sha256 = "0i5zqs1gwxhvsynb540c3azfi4357igr4i5p0bi3h7ras2asas8w";
   };
 
-  cargoSha256 = "0g5z0s837cfwzral2zz0avp0xywyaa3l1adxg520qrnga7z0kbh8";
+  cargoSha256 = "02bk399c7x15a5rkaz7ik65yihkfbjn1q46gx7l8hycqq7xb0xmg";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles];
   buildInputs = [ openssl oniguruma ]
@@ -30,6 +29,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "A fast static site generator with everything built-in";
     homepage = "https://www.getzola.org/";
+    changelog = "https://github.com/getzola/zola/raw/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ dandellion dywedir _0x4A6F ];
     # set because of unstable-* version

pkgs/applications/networking/browsers/lagrange/default.nix

@@ -4,6 +4,8 @@
 , nix-update-script
 , cmake
 , pkg-config
+, fribidi
+, harfbuzz
 , libunistring
 , mpg123
 , openssl
@@ -15,27 +17,36 @@
 
 stdenv.mkDerivation rec {
   pname = "lagrange";
-  version = "1.5.2";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "skyjake";
     repo = "lagrange";
     rev = "v${version}";
-    sha256 = "sha256-NjiTjY2YuxUs/Wny7aDqHGw/2ML1fenjHrl089rLXFI=";
+    sha256 = "sha256-YTWVBQt0X12UDFJv/rPBqlIBC4iXSvpdYi/HIl+BPxc=";
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    rm -r lib/fribidi lib/harfbuzz
+  '';
+
   nativeBuildInputs = [ cmake pkg-config ];
 
-  buildInputs = [ libunistring mpg123 openssl pcre SDL2 zlib ]
+  buildInputs = [ fribidi harfbuzz libunistring mpg123 openssl pcre SDL2 zlib ]
     ++ lib.optional stdenv.isDarwin AppKit;
 
   hardeningDisable = lib.optional (!stdenv.cc.isClang) "format";
 
-  installPhase = if stdenv.isDarwin then ''
+  cmakeFlags = [
+    "-DENABLE_HARFBUZZ_MINIMAL:BOOL=OFF"
+    "-DENABLE_FRIBIDI_BUILD:BOOL=OFF"
+  ];
+
+  installPhase = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
     mv Lagrange.app $out/Applications
-  '' else null;
+  '';
 
   passthru = {
     updateScript = nix-update-script {

pkgs/applications/networking/browsers/lynx/default.nix

@@ -1,12 +1,16 @@
-{ lib, stdenv, buildPackages
+{ lib
-, fetchurl, pkg-config, ncurses, gzip
+, stdenv
-, sslSupport ? true, openssl ? null
+, buildPackages
+, fetchurl
+, pkg-config
+, ncurses
+, gzip
+, sslSupport ? true
+, openssl
 , nukeReferences
 , fetchpatch
 }:
 
-assert sslSupport -> openssl != null;
-
 stdenv.mkDerivation rec {
   pname = "lynx";
   version = "2.8.9rel.1";
@@ -41,7 +45,8 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ nukeReferences ]
     ++ lib.optional sslSupport pkg-config;
 
-  buildInputs = [ ncurses gzip ] ++ lib.optional sslSupport openssl.dev;
+  buildInputs = [ ncurses gzip ]
+    ++ lib.optional sslSupport openssl;
 
   # cfg_defs.h captures lots of references to build-only dependencies, derived
   # from config.cache.
@@ -53,6 +58,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A text-mode web browser";
     homepage = "https://lynx.invisible-island.net/";
+    maintainers = with maintainers; [ ];
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
   };

pkgs/applications/networking/cloudflared/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2021.7.4";
+  version = "2021.8.1";
 
   src = fetchFromGitHub {
     owner  = "cloudflare";
     repo   = "cloudflared";
     rev    = version;
-    sha256 = "sha256-3HK7QLUhU6MUayRYec4LP2BfbwEsvtjtCf++o1cQsQw=";
+    sha256 = "sha256-92Uq7hSqfsiES6dSCw4cotfLJ8TLRRO6QPkwQ8iv124=";
   };
 
   vendorSha256 = null;

pkgs/applications/networking/irc/tiny/default.nix

@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , rustPlatform
-, fetchpatch
 , fetchFromGitHub
 , pkg-config
 , dbus
@@ -11,23 +10,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tiny";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "osa1";
     repo = pname;
     rev = "v${version}";
-    sha256 = "07a50shv6k4fwl2gmv4j0maxaqqkjpwwmqkxkqs0gvx38lc5f7m7";
+    sha256 = "gKyHR3FZHDybaP38rqB8/gvr8T+mDO4QQxoTtWS+TlE=";
   };
 
-  cargoSha256 = "0npkcprcqy2pn7k64jzwg41vk9id6yzw211xw203h80cc5444igr";
+  cargoSha256 = "0ChfW8vaqC2kCp4lpS0HOvhuihPw9G5TOmgwKzVDfws=";
 
-  cargoPatches = [
   # Fix Cargo.lock version. Remove with the next release.
-    (fetchpatch {
+  cargoPatches = [
-      url = "https://github.com/osa1/tiny/commit/b1caf48a6399dad8875de1d965d1ad445e49585d.patch";
+    ./fix-Cargo.lock.patch
-      sha256 = "1zkjhx94nwmd69cfwwwzg51ipcwq01wyvgsmn0vq7iaa2h0d286i";
-    })
   ];
 
   nativeBuildInputs = lib.optional stdenv.isLinux pkg-config;
@@ -38,6 +34,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/osa1/tiny";
     changelog = "https://github.com/osa1/tiny/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
-    maintainers = with maintainers; [ Br1ght0ne ];
+    maintainers = with maintainers; [ Br1ght0ne vyp ];
   };
 }

pkgs/applications/networking/irc/tiny/fix-Cargo.lock.patch

@@ -0,0 +1,13 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 3a184dc..0e58cb1 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1023,7 +1023,7 @@ dependencies = [
+ 
+ [[package]]
+ name = "tiny"
+-version = "0.8.0"
++version = "0.9.0"
+ dependencies = [
+  "clap",
+  "dirs 3.0.1",

pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-ews";
-  version = "3.40.1";
+  version = "3.40.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1kgxdacqqcq8yfkij6vyqlk5r4yqvw7gh7mxqii670hrn1mb2s50";
+    sha256 = "ZAIE5rpPOyZT3VSPYOR143bP8Na7Kv0NQRhQ+p2oxJY=";
   };
 
   nativeBuildInputs = [ cmake gettext intltool pkg-config ];

pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix

@@ -1,7 +1,5 @@
 { lib, stdenv, fetchurl, jre, makeWrapper }:
 
-with lib;
-
 stdenv.mkDerivation rec {
   version = "6.9.4";
   pname = "frostwire";

pkgs/applications/office/atlassian-cli/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "atlassian-cli";
-  version = "9.5.0";
+  version = "9.6.0";
 
   src = fetchzip {
     url  = "https://bobswift.atlassian.net/wiki/download/attachments/16285777/${pname}-${version}-distribution.zip";
-    sha256  = "sha256-EAoydA2lg4K1gTgzn9patNw7pcCdU/OPfaEG1OfEJ18=";
+    sha256  = "sha256-55ydhprVC9NdDMUrKbpSAEQBb9zRYgwOc7k8aP4R89A=";
   };
 
   tools = [

pkgs/applications/office/grisbi/default.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "grisbi";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/grisbi/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-hFLiVHyEekCP9btO75e5ni70ZcLhjbBGCBjF2gERIqs=";
+    sha256 = "sha256-bCO82EWAf/kiMDdojA5goWeWiKWZNOGYixmIJQwovGM=";
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook ];

pkgs/applications/office/pympress/default.nix

@@ -1,21 +1,34 @@
 { lib
+, stdenv
+, fetchpatch
 , python3Packages
 , wrapGAppsHook
 , gtk3
 , gobject-introspection
 , libcanberra-gtk3
 , poppler_gi
+, withGstreamer ? stdenv.isLinux
+, withVLC ? stdenv.isLinux
  }:
 
 python3Packages.buildPythonApplication rec {
   pname = "pympress";
-  version = "1.5.1";
+  version = "1.6.3";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "173d9scf2z29qg279jf33zcl7sgc3wp662fgpm943bn9667q18wf";
+    sha256 = "sha256-f+OjE0x/3yfJYHCLB+on7TT7MJ2vNu87SHRi67qFDCM=";
   };
 
+  patches = [
+    # Should not be needed once v1.6.4 is released
+    (fetchpatch {
+      name = "fix-setuptools-version-parsing.patch";
+      url = "https://github.com/Cimbali/pympress/commit/474514d71396ac065e210fd846e07ed1139602d0.diff";
+      sha256 = "sha256-eiw54sjMrXrNrhtkAXxiSTatzoA0NDA03L+HpTDax58=";
+    })
+  ];
+
   nativeBuildInputs = [
     wrapGAppsHook
   ];
@@ -23,16 +36,15 @@ python3Packages.buildPythonApplication rec {
   buildInputs = [
     gtk3
     gobject-introspection
-    libcanberra-gtk3
     poppler_gi
-  ];
+  ] ++ lib.optional withGstreamer libcanberra-gtk3;
 
   propagatedBuildInputs = with python3Packages; [
     pycairo
     pygobject3
-    python-vlc
+    setuptools
     watchdog
-  ];
+  ] ++ lib.optional withVLC python-vlc;
 
   doCheck = false; # there are no tests
 

pkgs/applications/radio/fldigi/default.nix

@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fldigi";
-  version = "4.1.19";
+  version = "4.1.20";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0zvfkmvxi31ccbpxvimkcrqrkf3wzr1pgja2ny04srrakl8ff5c7";
+    sha256 = "0f64pqijl3jlfmv00hkdxvn1wy5yy3zl33p6vf3fn1b91w590c2h";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/radio/fllog/default.nix

@@ -7,12 +7,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.2.6";
+  version = "1.2.7";
   pname = "fllog";
 
   src = fetchurl {
     url = "mirror://sourceforge/fldigi/${pname}-${version}.tar.gz";
-    sha256 = "18nwqbbg5khpkwlr7dn41g6zf7ms2wzxykd42fwdsj4m4z0ysyyg";
+    sha256 = "sha256-HxToZ+f1IJgDKGPHBeVuS7rRkh3+KfpyoYPBwfyqsC8=";
   };
 
   buildInputs = [

pkgs/applications/science/chemistry/avogadro2/default.nix

@@ -0,0 +1,37 @@
+{ lib, stdenv, fetchFromGitHub, cmake, eigen, avogadrolibs, molequeue, hdf5
+, openbabel, qttools, wrapQtAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "avogadro2";
+  version = "1.94.0";
+
+  src = fetchFromGitHub {
+    owner = "OpenChemistry";
+    repo = "avogadroapp";
+    rev = version;
+    sha256 = "6RaiX23YUMfTYAuSighcLGGlJtqeydNgi3PWGF77Jp8=";
+  };
+
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
+
+  buildInputs = [
+    avogadrolibs
+    molequeue
+    eigen
+    hdf5
+    qttools
+  ];
+
+  propagatedBuildInputs = [ openbabel ];
+
+  qtWrapperArgs = [ "--prefix PATH : ${openbabel}/bin" ];
+
+  meta = with lib; {
+    description = "Molecule editor and visualizer";
+    maintainers = with maintainers; [ sheepforce ];
+    homepage = "https://github.com/OpenChemistry/avogadroapp";
+    platforms = platforms.mesaPlatforms;
+    license = licenses.bsd3;
+  };
+}

pkgs/applications/science/electronics/vhd2vl/default.nix

@@ -4,6 +4,7 @@
 , bison
 , flex
 , verilog
+, which
 }:
 
 stdenv.mkDerivation rec {
@@ -29,6 +30,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     bison
     flex
+    which
   ];
 
   buildInputs = [
@@ -36,8 +38,9 @@ stdenv.mkDerivation rec {
   ];
 
   installPhase = ''
-    mkdir -p $out/bin
+    runHook preInstall
-    cp src/vhd2vl $out/bin/
+    install -D -m755 src/vhd2vl $out/bin/vdh2vl
+    runHook postInstall
   '';
 
   meta = with lib; {

pkgs/applications/science/math/polymake/default.nix

@@ -1,27 +1,32 @@
 { lib, stdenv, fetchurl
-, ninja, libxml2, libxslt, readline, perl, gmp, mpfr, boost
+, perl, gmp, mpfr, flint, boost
 , bliss, ppl, singular, cddlib, lrs, nauty
-, ant, openjdk
+, ninja, ant, openjdk
 , perlPackages
 , makeWrapper
 }:
 
+# polymake compiles its own version of sympol and atint because we
+# don't have those packages. other missing optional dependencies:
+# javaview, libnormaliz, scip, soplex, jreality.
+
 stdenv.mkDerivation rec {
   pname = "polymake";
-  version = "3.2.rc4";
+  version = "4.4";
 
   src = fetchurl {
-    url = "https://polymake.org/lib/exe/fetch.php/download/polymake-3.2r4.tar.bz2";
+    # "The minimal version is a packager friendly version which omits
-    sha256 = "02jpkvy1cc6kc23vkn7nkndzr40fq1gkb3v257bwyi1h5d37fyqy";
+    # the bundled sources of cdd, lrs, libnormaliz, nauty and jReality."
+    url = "https://polymake.org/lib/exe/fetch.php/download/polymake-${version}-minimal.tar.bz2";
+    sha256 = "sha256-2nF5F2xznI77pl2TslrxA8HLpw4fmzVnPOM8N3kOwJE=";
   };
 
   buildInputs = [
-    libxml2 libxslt readline perl gmp mpfr boost
+    perl gmp mpfr flint boost
     bliss ppl singular cddlib lrs nauty
     openjdk
-  ] ++
+  ] ++ (with perlPackages; [
-  (with perlPackages; [
+    JSON TermReadLineGnu TermReadKey XMLSAX
-    XMLLibXML XMLLibXSLT XMLWriter TermReadLineGnu TermReadKey
   ]);
 
   nativeBuildInputs = [
@@ -36,11 +41,11 @@ stdenv.mkDerivation rec {
     done
   '';
 
-  meta = {
+  meta = with lib; {
     description = "Software for research in polyhedral geometry";
-    license = lib.licenses.gpl2 ;
+    license = licenses.gpl2Plus;
-    maintainers = [lib.maintainers.raskin];
+    maintainers = teams.sage.members;
-    platforms = lib.platforms.linux;
+    platforms = platforms.linux;
     homepage = "https://www.polymake.org/doku.php";
   };
 }

pkgs/applications/science/misc/cwltool/default.nix

@@ -0,0 +1,41 @@
+{ lib
+, python3Packages
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "cwltool";
+  version = "3.1.20210628163208";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "21b885f725420413d2f87eadc5e81c08a9c91beceda89b35d1a702ec4df47e52";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace 'prov == 1.5.1' 'prov'
+  '';
+
+  propagatedBuildInputs = with python3Packages; [
+    argcomplete
+    bagit
+    coloredlogs
+    mypy-extensions
+    prov
+    psutil
+    pydot
+    schema-salad
+    shellescape
+    typing-extensions
+  ];
+
+  doCheck = false; # hard to setup
+  pythonImportsCheck = [ "cwltool" ];
+
+  meta = with lib; {
+    homepage = "https://www.commonwl.org";
+    license = with licenses; [ asl20 ];
+    description = "Common Workflow Language reference implementation";
+    maintainers = with maintainers; [ veprbl ];
+  };
+}

pkgs/applications/terminal-emulators/foot/default.nix

@@ -1,6 +1,6 @@
 { stdenv
 , lib
-, fetchzip
+, fetchFromGitea
 , fetchurl
 , fetchpatch
 , runCommandNoCC
@@ -94,8 +94,11 @@ stdenv.mkDerivation rec {
   pname = "foot";
   inherit version;
 
-  src = fetchzip {
+  src = fetchFromGitea {
-    url = "https://codeberg.org/dnkl/${pname}/archive/${version}.tar.gz";
+    domain = "codeberg.org";
+    owner = "dnkl";
+    repo = pname;
+    rev = version;
     sha256 = "1k0alz991cslls4926c5gq02pdq0vfw9jfpprh2a1vb59xgikv7h";
   };
 
@@ -147,8 +150,9 @@ stdenv.mkDerivation rec {
     export AR="${ar}"
   '';
 
+  mesonBuildType = "release";
+
   mesonFlags = [
-    "--buildtype=release"
     "-Db_lto=true"
     "-Dterminfo-install-location=${placeholder "terminfo"}/share/terminfo"
   ];

pkgs/applications/version-management/git-and-tools/ghq/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ghq";
-  version = "1.1.7";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "x-motemen";
     repo = "ghq";
     rev = "v${version}";
-    sha256 = "sha256-kEs844gj1/PW7Kkpn1tvxfruznRIh2pjHCoSWGF1upQ=";
+    sha256 = "sha256-86ZFKkzDAhx3UYWxreQI2OJJmqGnqaH2TgwQunuYhv4=";
   };
 
   vendorSha256 = "sha256-5Eth9v98z1gxf1Fz5Lbn2roX7dSBmA7GRzg8uvT0hTI=";

pkgs/applications/version-management/git-and-tools/radicle-upstream/default.nix

@@ -58,7 +58,7 @@ appimageTools.wrapType2 {
     description = "A decentralized app for code collaboration";
     homepage = "https://radicle.xyz/";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ xwvvvvwx ];
+    maintainers = with maintainers; [ d-xo ];
     platforms = [ "x86_64-linux" ];
   };
 }

pkgs/applications/version-management/gogs/default.nix

@@ -29,9 +29,7 @@ buildGoModule rec {
 
   buildInputs = optional pamSupport pam;
 
-  buildFlags = [ "-tags" ];
+  tags =
-
-  buildFlagsArray =
     (  optional sqliteSupport "sqlite"
     ++ optional pamSupport "pam");
 

pkgs/applications/video/corrscope/default.nix

@@ -30,17 +30,17 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
     })
   ];
 
-  nativeBuildInputs = [ wrapQtAppsHook ];
+  nativeBuildInputs = [ wrapQtAppsHook ] ++ (with python3Packages; [ poetry-core ]);
 
   buildInputs = [ ffmpeg qtbase ];
 
-  propagatedBuildInputs = with python3Packages; [ appdirs atomicwrites attrs click matplotlib numpy poetry-core pyqt5 ruamel_yaml ];
+  propagatedBuildInputs = with python3Packages; [ appdirs atomicwrites attrs click matplotlib numpy pyqt5 ruamel_yaml ];
 
   dontWrapQtApps = true;
 
   preFixup = ''
     makeWrapperArgs+=(
-      --prefix PATH : ${ffmpeg}/bin
+      --prefix PATH : ${lib.makeBinPath [ ffmpeg ]}
       "''${qtWrapperArgs[@]}"
     )
   '';

pkgs/applications/video/filebot/default.nix

@@ -10,11 +10,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "filebot";
-  version = "4.9.3";
+  version = "4.9.4";
 
   src = fetchurl {
     url = "https://web.archive.org/web/20210326102451/https://get.filebot.net/filebot/FileBot_${version}/FileBot_${version}-portable.tar.xz";
-    sha256 = "sha256-T+y8k757/qFCVOCc/SNc7a+KmyscPlowubNQYzMr8jY=";
+    sha256 = "sha256-fz0B9P/UBrlKGPZkheMd/4cFnWHt+brS3zRTv4nVt9o=";
   };
 
   unpackPhase = "tar xvf $src";

pkgs/applications/video/kodi-packages/requests-cache/default.nix

@@ -0,0 +1,29 @@
+{ lib, buildKodiAddon, fetchzip, addonUpdateScript, requests }:
+buildKodiAddon rec {
+  pname = "requests-cache";
+  namespace = "script.module.requests-cache";
+  version = "0.5.2+matrix.2";
+
+  src = fetchzip {
+    url = "https://mirrors.kodi.tv/addons/matrix/${namespace}/${namespace}-${version}.zip";
+    sha256 = "0fgl4jayq6hbhqxg16nfy9qizwf54c8nvg0icv93knaj13zfzkz8";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  passthru = {
+    pythonPath = "lib";
+    updateScript = addonUpdateScript {
+      attrPath = "kodi.packages.requests-cache";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/reclosedev/requests-cache";
+    description = "Persistent cache for requests library";
+    license = licenses.bsd2;
+    maintainers = teams.kodi.members;
+  };
+}

pkgs/applications/video/kodi-packages/routing/default.nix

@@ -0,0 +1,25 @@
+{ lib, buildKodiAddon, fetchzip, addonUpdateScript }:
+buildKodiAddon rec {
+  pname = "routing";
+  namespace = "script.module.routing";
+  version = "0.2.3+matrix.1";
+
+  src = fetchzip {
+    url = "https://mirrors.kodi.tv/addons/matrix/${namespace}/${namespace}-${version}.zip";
+    sha256 = "1qhp40xd8mbcvzwlamqw1j5l224ry086593948g24drpqiiyc8x6";
+  };
+
+  passthru = {
+    pythonPath = "lib";
+    updateScript = addonUpdateScript {
+      attrPath = "kodi.packages.routing";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/tamland/kodi-plugin-routing";
+    description = "A routing module for kodi plugins";
+    license = licenses.gpl3Plus;
+    maintainers = teams.kodi.members;
+  };
+}

pkgs/applications/video/kodi-packages/steam-library/default.nix

@@ -0,0 +1,27 @@
+{ lib, buildKodiAddon, fetchFromGitHub, requests, requests-cache, routing }:
+
+buildKodiAddon rec {
+  pname = "steam-library";
+  namespace = "plugin.program.steam.library";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "aanderse";
+    repo = namespace;
+    rev = "v${version}";
+    sha256 = "1d8n8zkprjql0nw5ff752yr994hw2ikd0ny3m9hjr90s4kdykjzr";
+  };
+
+  propagatedBuildInputs = [
+    requests
+    requests-cache
+    routing
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/aanderse/plugin.program.steam.library";
+    description = "View your entire Steam library right from Kodi";
+    license = licenses.gpl3Plus;
+    maintainers = teams.kodi.members;
+  };
+}

pkgs/applications/virtualization/docker-slim/default.nix

@@ -6,7 +6,7 @@
 
 buildGoPackage rec {
   pname = "docker-slim";
-  version = "1.36.1";
+  version = "1.36.2";
 
   goPackagePath = "github.com/docker-slim/docker-slim";
 
@@ -14,7 +14,7 @@ buildGoPackage rec {
     owner = "docker-slim";
     repo = "docker-slim";
     rev = version;
-    sha256 = "sha256-BoBZBzQYd/HbOCerpvcNcR/7Fds6+weY2QFRjqSfOjU=";
+    sha256 = "sha256-Q8M8+krPC6WRDCxe88gzX5bDG8x6sJ8TduTKjA85WFA=";
   };
 
   subPackages = [ "cmd/docker-slim" "cmd/docker-slim-sensor" ];

pkgs/data/fonts/vista-fonts-cht/default.nix

@@ -0,0 +1,41 @@
+{ lib, stdenvNoCC, fetchurl, cabextract }:
+
+stdenvNoCC.mkDerivation {
+  pname = "vista-fonts-cht";
+  version = "1";
+
+  src = fetchurl {
+    url = https://download.microsoft.com/download/7/6/b/76bd7a77-be02-47f3-8472-fa1de7eda62f/VistaFont_CHT.EXE;
+    sha256 = "sha256-fSnbbxlMPzbhFSQyKxQaS5paiWji8njK7tS8Eppsj6g=";
+  };
+
+  nativeBuildInputs = [ cabextract ];
+
+  unpackPhase = ''
+    cabextract --lowercase --filter '*.TTF' $src
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/fonts/truetype
+    cp *.ttf $out/share/fonts/truetype
+
+    # Set up no-op font configs to override any aliases set up by
+    # other packages.
+    mkdir -p $out/etc/fonts/conf.d
+    substitute ${./no-op.conf} $out/etc/fonts/conf.d/30-msjhenghei.conf \
+      --subst-var-by fontname "Microsoft JhengHei"
+  '';
+
+
+  meta = with lib; {
+    description = "TrueType fonts from Microsoft Windows Vista For Traditional Chinese (Microsoft JhengHei)";
+    homepage = "https://www.microsoft.com/typography/fonts/family.aspx";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ atkinschang ];
+
+    # Set a non-zero priority to allow easy overriding of the
+    # fontconfig configuration files.
+    priority = 5;
+    platforms = platforms.all;
+  };
+}

pkgs/data/fonts/vista-fonts-cht/no-op.conf

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE fontconfig SYSTEM "urn:fontconfig:fonts.dtd">
+<fontconfig>
+  <!-- This configuation is intentionally left empty in order to
+       override any other font package that may wish to set up an
+       alias for the Microsoft @fontname@ font. If you actually do
+       want to have the alias then please change the priority of that
+       package; see the Nix manual page for nix-env for details. -->
+</fontconfig>

pkgs/data/misc/ddccontrol-db/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ddccontrol-db";
-  version = "20210505";
+  version = "20210804";
 
   src = fetchFromGitHub {
     owner = "ddccontrol";
     repo = "ddccontrol-db";
     rev = version;
-    sha256 = "sha256-k0Bcf1I/g2sFnX3y4qyWG7Z3W7K6YeZ9trUFSJ4NhSo=";
+    sha256 = "sha256-+PTw4bDJhWyuEae5ShkIL/KvQ29+gU46iE2RdtTWb8M=";
   };
 
   preConfigure = ''

pkgs/data/themes/orchis-theme/default.nix

@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "orchis-theme";
-  version = "2021-06-09";
+  version = "2021-06-25";
 
   src = fetchFromGitHub {
     repo = "Orchis-theme";
     owner = "vinceliuice";
     rev = version;
-    sha256 = "sha256-YlrocFDk3da2eqxbJ5lPUUxHHvJZx19LOa0MSljWY8Q=";
+    sha256 = "sha256-j0nsw1yR1yOckXiIMtzhC3w6kvfzxQQHgwdY6l0OuXw=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];

pkgs/desktops/gnome/extensions/gsconnect/default.nix

@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-gsconnect";
-  version = "46";
+  version = "47";
 
   outputs = [ "out" "installedTests" ];
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     owner = "andyholmes";
     repo = "gnome-shell-extension-gsconnect";
     rev = "v${version}";
-    sha256 = "161379kipr6z6gbhchb5b17djrkg5fbvblyyabzkc2gv05r3h6fw";
+    sha256 = "sha256-cpyB7ufjKTj7YVbPlQFJ4qaL6Rb/aBReKxCYzErT4+Q=";
   };
 
   patches = [

pkgs/desktops/pantheon/granite/default.nix

@@ -46,16 +46,13 @@ stdenv.mkDerivation rec {
     wrapGAppsHook
   ];
 
-  buildInputs = [
+  propagatedBuildInputs = [
     glib
+    gsettings-desktop-schemas # is_clock_format_12h uses "org.gnome.desktop.interface clock-format"
     gtk3
     libgee
   ];
 
-  propagatedBuildInputs = [
-    gsettings-desktop-schemas # is_clock_format_12h uses "org.gnome.desktop.interface clock-format"
-  ];
-
   postPatch = ''
     chmod +x meson/post_install.py
     patchShebangs meson/post_install.py

pkgs/development/compilers/adoptopenjdk-icedtea-web/default.nix

@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
   pname = "adoptopenjdk-icedtea-web";
 
-  version = "1.8.6";
+  version = "1.8.7";
 
   src = fetchFromGitHub {
     owner = "AdoptOpenJDK";
     repo = "IcedTea-Web";
     rev = "icedtea-web-${version}";
-    sha256 = "sha256-meqbFLGwCMpFoOVAfvtriRAS8ZWr374eSN3m0CdC2aM=";
+    sha256 = "sha256-XY6S1IvDqPxkYgFs7kB9AR0zQ4n3COVbS2lUT5mhTVc=";
   };
 
   nativeBuildInputs = [ autoreconfHook pkg-config bc ];

pkgs/development/compilers/intel-graphics-compiler/default.nix

@@ -1,8 +1,8 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , cmake
-, pkg-config
+, runCommandLocal
-
 , bison
 , flex
 , llvmPackages_8
@@ -46,18 +46,14 @@ stdenv.mkDerivation rec {
   doCheck = false;
 
   # Handholding the braindead build script
-  # We put this in a derivation because the cmake requires an absolute path
+  # cmake requires an absolute path
-  prebuilds = stdenv.mkDerivation {
+  prebuilds = runCommandLocal "igc-cclang-prebuilds" { } ''
-    name = "igc-cclang-prebuilds";
-    phases = [ "installPhase" ];
-    installPhase = ''
     mkdir $out
     ln -s ${clang}/bin/clang $out/
     ln -s clang $out/clang-${versions.major (getVersion clang)}
     ln -s ${opencl-clang}/lib/* $out/
     ln -s ${lib.getLib libclang}/lib/clang/${getVersion clang}/include/opencl-c.h $out/
   '';
-  };
 
   cmakeFlags = [
     "-DCCLANG_BUILD_PREBUILDS=ON"

pkgs/development/compilers/llvm/git/clang/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, llvm_meta, src, cmake, libxml2, libllvm, version, python3
+{ lib, stdenv, llvm_meta, src, substituteAll, cmake, libxml2, libllvm, version, python3
 , buildLlvmTools
 , fixDarwinDylibNames
 , enableManpages ? false
@@ -37,6 +37,10 @@ let
       ./purity.patch
       # https://reviews.llvm.org/D51899
       ./gnu-install-dirs.patch
+      (substituteAll {
+        src = ../../clang-11-12-LLVMgold-path.patch;
+        libllvmLibdir = "${libllvm.lib}/lib";
+      })
     ];
 
     postPatch = ''
@@ -52,12 +56,7 @@ let
 
     outputs = [ "out" "lib" "dev" "python" ];
 
-    # Clang expects to find LLVMgold in its own prefix
     postInstall = ''
-      if [ -e ${libllvm.lib}/lib/LLVMgold.so ]; then
-        ln -sv ${libllvm.lib}/lib/LLVMgold.so $lib/lib
-      fi
-
       ln -sv $out/bin/clang $out/bin/cpp
 
       # Move libclang to 'lib' output

pkgs/development/compilers/llvm/git/compiler-rt/X86-support-extension.patch

@@ -2,9 +2,7 @@ diff --git a/lib/builtins/CMakeLists.txt b/lib/builtins/CMakeLists.txt
 index 3a66dd9c3fb..7efc85d9f9f 100644
 --- a/lib/builtins/CMakeLists.txt
 +++ b/lib/builtins/CMakeLists.txt
-@@ -301,6 +301,10 @@ if (NOT MSVC)
+@@ -345,4 +345,8 @@ if (NOT MSVC)
-     i386/umoddi3.S
-   )
  
 +  set(i486_SOURCES ${i386_SOURCES})
 +  set(i586_SOURCES ${i386_SOURCES})

pkgs/development/compilers/llvm/git/compiler-rt/darwin-targetconditionals.patch

@@ -0,0 +1,71 @@
+diff --git a/lib/sanitizer_common/sanitizer_mac.cpp b/lib/sanitizer_common/sanitizer_mac.cpp
+--- a/lib/sanitizer_common/sanitizer_mac.cpp
++++ b/lib/sanitizer_common/sanitizer_mac.cpp
+@@ -613,9 +613,15 @@ HandleSignalMode GetHandleSignalMode(int signum) {
+ // Offset example:
+ // XNU 17 -- macOS 10.13 -- iOS 11 -- tvOS 11 -- watchOS 4
+ constexpr u16 GetOSMajorKernelOffset() {
+-  if (TARGET_OS_OSX) return 4;
+-  if (TARGET_OS_IOS || TARGET_OS_TV) return 6;
+-  if (TARGET_OS_WATCH) return 13;
++#if TARGET_OS_OSX
++  return 4;
++#endif
++#if TARGET_OS_IOS || TARGET_OS_TV
++  return 6;
++#endif
++#if TARGET_OS_WATCH
++  return 13;
++#endif
+ }
+ 
+ using VersStr = char[64];
+@@ -627,13 +633,13 @@ static uptr ApproximateOSVersionViaKernelVersion(VersStr vers) {
+   u16 os_major = kernel_major - offset;
+ 
+   const char *format = "%d.0";
+-  if (TARGET_OS_OSX) {
+-    if (os_major >= 16) {  // macOS 11+
+-      os_major -= 5;
+-    } else {  // macOS 10.15 and below
+-      format = "10.%d";
+-    }
++#if TARGET_OS_OSX
++  if (os_major >= 16) {  // macOS 11+
++    os_major -= 5;
++  } else {  // macOS 10.15 and below
++    format = "10.%d";
+   }
++#endif
+   return internal_snprintf(vers, sizeof(VersStr), format, os_major);
+ }
+ 
+@@ -681,15 +687,14 @@ void ParseVersion(const char *vers, u16 *major, u16 *minor) {
+ // Aligned versions example:
+ // macOS 10.15 -- iOS 13 -- tvOS 13 -- watchOS 6
+ static void MapToMacos(u16 *major, u16 *minor) {
+-  if (TARGET_OS_OSX)
+-    return;
+-
+-  if (TARGET_OS_IOS || TARGET_OS_TV)
++#if !TARGET_OS_OSX
++#if TARGET_OS_IOS || TARGET_OS_TV
+     *major += 2;
+-  else if (TARGET_OS_WATCH)
++#elif TARGET_OS_WATCH
+     *major += 9;
+-  else
++#else
+     UNREACHABLE("unsupported platform");
++#endif
+ 
+   if (*major >= 16) {  // macOS 11+
+     *major -= 5;
+@@ -697,6 +702,7 @@ static void MapToMacos(u16 *major, u16 *minor) {
+     *minor = *major;
+     *major = 10;
+   }
++#endif
+ }
+ 
+ static MacosVersion GetMacosAlignedVersionInternal() {

pkgs/development/compilers/llvm/git/compiler-rt/default.nix

@@ -60,6 +60,8 @@ stdenv.mkDerivation {
     # extra `/`.
     ./normalize-var.patch
   ]# ++ lib.optional stdenv.hostPlatform.isMusl ./sanitizers-nongnu.patch
+    # Prevent a compilation error on darwin
+    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-targetconditionals.patch
     ++ lib.optional stdenv.hostPlatform.isAarch32 ./armv7l.patch;
 
   # TSAN requires XPC on Darwin, which we have no public/free source files for. We can depend on the Apple frameworks

pkgs/development/compilers/llvm/git/lldb/default.nix

@@ -19,6 +19,7 @@
 , Carbon
 , Cocoa
 , lit
+, makeWrapper
 , enableManpages ? false
 }:
 
@@ -42,7 +43,7 @@ stdenv.mkDerivation (rec {
   outputs = [ "out" "lib" "dev" ];
 
   nativeBuildInputs = [
-    cmake python3 which swig lit
+    cmake python3 which swig lit makeWrapper
   ] ++ lib.optionals enableManpages [
     python3.pkgs.sphinx python3.pkgs.recommonmark
   ];
@@ -84,7 +85,15 @@ stdenv.mkDerivation (rec {
 
   doCheck = false;
 
+  installCheckPhase = ''
+    if [ ! -e "$lib/${python3.sitePackages}/lldb/_lldb.so" ] ; then
+        return 1;
+    fi
+  '';
+
   postInstall = ''
+    wrapProgram $out/bin/lldb --prefix PYTHONPATH : $lib/${python3.sitePackages}/
+
     # Editor support
     # vscode:
     install -D ../tools/lldb-vscode/package.json $out/share/vscode/extensions/llvm-org.lldb-vscode-0.1.0/package.json

pkgs/development/compilers/llvm/git/lldb/gnu-install-dirs.patch

@@ -63,3 +63,29 @@ index 734167e51bc5..f95761b5df58 100644
  install(TARGETS lldbIntelFeatures
 -  LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX})
 +  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+diff --git a/cmake/modules/LLDBStandalone.cmake b/cmake/modules/LLDBStandalone.cmake
+index 752113b..010f187 100644
+--- a/cmake/modules/LLDBStandalone.cmake
++++ b/cmake/modules/LLDBStandalone.cmake
+@@ -62,7 +62,7 @@ endif()
+
+ # They are used as destination of target generators.
+ set(LLVM_RUNTIME_OUTPUT_INTDIR ${CMAKE_BINARY_DIR}/${CMAKE_CFG_INTDIR}/bin)
+-set(LLVM_LIBRARY_OUTPUT_INTDIR ${CMAKE_BINARY_DIR}/${CMAKE_CFG_INTDIR}/lib${LLVM_LIBDIR_SUFFIX})
++set(LLVM_LIBRARY_OUTPUT_INTDIR ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+ if(WIN32 OR CYGWIN)
+   # DLL platform -- put DLLs into bin.
+   set(LLVM_SHLIB_OUTPUT_INTDIR ${LLVM_RUNTIME_OUTPUT_INTDIR})
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b5633e2..86e4738 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -79,7 +79,7 @@ if (LLDB_ENABLE_PYTHON)
+   if(LLDB_BUILD_FRAMEWORK)
+     set(lldb_python_target_dir "${LLDB_FRAMEWORK_ABSOLUTE_BUILD_DIR}/LLDB.framework/Resources/Python/lldb")
+   else()
+-    set(lldb_python_target_dir "${CMAKE_BINARY_DIR}/${CMAKE_CFG_INTDIR}/${LLDB_PYTHON_RELATIVE_PATH}/lldb")
++    set(lldb_python_target_dir "${CMAKE_INSTALL_LIBDIR}/../${LLDB_PYTHON_RELATIVE_PATH}/lldb")
+   endif()
+   get_target_property(lldb_python_bindings_dir swig_wrapper_python BINARY_DIR)
+   finish_swig_python("lldb-python" "${lldb_python_bindings_dir}" "${lldb_python_target_dir}")

pkgs/development/compilers/mit-scheme/default.nix

@@ -1,12 +1,15 @@
 { fetchurl, lib, stdenv, makeWrapper, gnum4, texinfo, texLive, automake,
-  enableX11 ? false, xlibsWrapper ? null }:
+  autoconf, libtool, ghostscript, ncurses,
+  enableX11 ? false, xlibsWrapper }:
 
 let
-  version = "10.1.10";
+  version = "11.2";
-  bootstrapFromC = ! (stdenv.isi686 || stdenv.isx86_64);
+  bootstrapFromC = ! ((stdenv.isLinux && stdenv.isAarch64) || stdenv.isx86_64);
 
-  arch = if      stdenv.isi686   then "-i386"
+  arch = if stdenv.isLinux && stdenv.isAarch64 then
-         else                         "-x86-64";
+    "-aarch64le"
+   else
+     "-x86-64";
 in
 stdenv.mkDerivation {
   name = if enableX11 then "mit-scheme-x11-${version}" else "mit-scheme-${version}";
@@ -16,49 +19,55 @@ stdenv.mkDerivation {
   # leads to more efficient code than when building the tarball that contains
   # generated C code instead of those binaries.
   src =
-    if stdenv.isi686
+    if stdenv.isLinux && stdenv.isAarch64
     then fetchurl {
-      url = "mirror://gnu/mit-scheme/stable.pkg/${version}/mit-scheme-${version}-i386.tar.gz";
+      url = "mirror://gnu/mit-scheme/stable.pkg/${version}/mit-scheme-${version}-aarch64le.tar.gz";
-      sha256 = "117lf06vcdbaa5432hwqnskpywc6x8ai0gj99h480a4wzkp3vhy6";
+      sha256 = "11maixldk20wqb5js5p4imq221zz9nf27649v9pqkdf8fv7rnrs9";
   } else fetchurl {
       url = "mirror://gnu/mit-scheme/stable.pkg/${version}/mit-scheme-${version}-x86-64.tar.gz";
-      sha256 = "1rljv6iddrbssm91c0nn08myj92af36hkix88cc6qwq38xsxs52g";
+      sha256 = "17822hs9y07vcviv2af17p3va7qh79dird49nj50bwi9rz64ia3w";
     };
 
-  buildInputs = if enableX11 then [xlibsWrapper] else [];
+  buildInputs = [ ncurses ] ++ lib.optional enableX11 xlibsWrapper;
 
-  configurePhase =
+  configurePhase = ''
-    '' (cd src && ./configure)
+    runHook preConfigure
+    (cd src && ./configure)
     (cd doc && ./configure)
+    runHook postConfigure
   '';
 
-  buildPhase =
+  buildPhase = ''
-    '' cd src
+    runHook preBuild
+    cd src
+
    ${if bootstrapFromC
       then "./etc/make-liarc.sh --prefix=$out"
       else "make compile-microcode"}
 
     cd ../doc
 
-       # Provide a `texinfo.tex'.
-       export TEXINPUTS="$(echo ${automake}/share/automake-*)"
-       echo "\$TEXINPUTS is \`$TEXINPUTS'"
     make
 
     cd ..
+
+    runHook postBuild
   '';
 
-  installPhase =
+
-    '' make prefix=$out install -C src
+  installPhase = ''
+    runHook preInstall
+    make prefix=$out install -C src
     make prefix=$out install -C doc
+    runHook postInstall
   '';
 
-  fixupPhase =
+  postFixup =
     '' wrapProgram $out/bin/mit-scheme${arch} --set MITSCHEME_LIBRARY_PATH \
          $out/lib/mit-scheme${arch}
     '';
 
-  nativeBuildInputs = [ makeWrapper gnum4 texinfo texLive automake ];
+  nativeBuildInputs = [ makeWrapper gnum4 texinfo texLive automake ghostscript autoconf libtool ];
 
   # XXX: The `check' target doesn't exist.
   doCheck = false;

pkgs/development/coq-modules/coqeal/default.nix

@@ -7,11 +7,13 @@ with lib; mkCoqDerivation {
   owner = "CoqEAL";
   inherit version;
   defaultVersion = with versions; switch [ coq.version mathcomp.version ]  [
+      { cases = [ (isGe "8.10") "1.12.0" ]; out = "1.0.6"; }
       { cases = [ (isGe "8.10") (range "1.11.0" "1.12.0") ]; out = "1.0.5"; }
       { cases = [ (isGe "8.7") "1.11.0" ]; out = "1.0.4"; }
       { cases = [ (isGe "8.7") "1.10.0" ]; out = "1.0.3"; }
     ] null;
 
+  release."1.0.6".sha256 = "0lqkyfj4qbq8wr3yk8qgn7mclw582n3fjl9l19yp8cnchspzywx0";
   release."1.0.5".sha256 = "0cmvky8glb5z2dy3q62aln6qbav4lrf2q1589f6h1gn5bgjrbzkm";
   release."1.0.4".sha256 = "1g5m26lr2lwxh6ld2gykailhay4d0ayql4bfh0aiwqpmmczmxipk";
   release."1.0.3".sha256 = "0hc63ny7phzbihy8l7wxjvn3haxx8jfnhi91iw8hkq8n29i23v24";

pkgs/development/interpreters/clojure/default.nix

@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
       echo "Installing libs into $clojure_lib_dir"
       install -Dm644 deps.edn "$clojure_lib_dir/deps.edn"
       install -Dm644 example-deps.edn "$clojure_lib_dir/example-deps.edn"
+      install -Dm644 tools.edn "$clojure_lib_dir/tools.edn"
       install -Dm644 exec.jar "$clojure_lib_dir/libexec/exec.jar"
       install -Dm644 clojure-tools-${version}.jar "$clojure_lib_dir/libexec/clojure-tools-${version}.jar"
 
@@ -48,7 +49,7 @@ stdenv.mkDerivation rec {
 
   doInstallCheck = true;
   installCheckPhase = ''
-    CLJ_CONFIG=$out CLJ_CACHE=$out/libexec $out/bin/clojure \
+    CLJ_CONFIG=$TMPDIR CLJ_CACHE=$TMPDIR/.clj_cache $out/bin/clojure \
       -Spath \
       -Sverbose \
       -Scp $out/libexec/clojure-tools-${version}.jar

pkgs/development/libraries/dqlite/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dqlite";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0ghvwlgj5574kpgc53bfhqp4437xxvr05061wwxplpjxn37hy26d";
+    sha256 = "0zalsvr0vy7632nhm96a29lrfy18iqsmbxpyz2lvq80mrjlbrzsn";
   };
 
   nativeBuildInputs = [ autoreconfHook file pkg-config ];

pkgs/development/libraries/entt/default.nix

@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
   pname = "entt";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchFromGitHub {
     owner = "skypjack";
     repo = "entt";
     rev = "v${version}";
-    sha256 = "sha256-gieft0sErTr3aB6mZLdALSx+RkmCQuE9lopAwJbOXnA=";
+    sha256 = "sha256-vg2tpGyZZM8c97Qko88JMP5YNPZx5kI5qRkkRclvZtA=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/fcft/default.nix

@@ -1,15 +1,23 @@
-{ stdenv, lib, fetchzip, pkg-config, meson, ninja, scdoc
+{ stdenv, lib, fetchFromGitea, pkg-config, meson, ninja, scdoc
 , freetype, fontconfig, pixman, tllist, check
 , withHarfBuzz ? true
 , harfbuzz
 }:
 
+let
+  # Courtesy of sternenseemann and FRidh, commit c9a7fdfcfb420be8e0179214d0d91a34f5974c54
+  mesonFeatureFlag = opt: b: "-D${opt}=${if b then "enabled" else "disabled"}";
+in
+
 stdenv.mkDerivation rec {
   pname = "fcft";
   version = "2.4.4";
 
-  src = fetchzip {
+  src = fetchFromGitea {
-    url = "https://codeberg.org/dnkl/fcft/archive/${version}.tar.gz";
+    domain = "codeberg.org";
+    owner = "dnkl";
+    repo = "fcft";
+    rev = version;
     sha256 = "0ycc2xy9jhxcxwbfk9d4jdxgf2zsc664phbf859kshb822m3jf57";
   };
 
@@ -19,15 +27,16 @@ stdenv.mkDerivation rec {
     ++ lib.optional withHarfBuzz harfbuzz;
   checkInputs = [ check ];
 
+  mesonBuildType = "release";
   mesonFlags = [
-    "--buildtype=release"
+    (mesonFeatureFlag "text-shaping" withHarfBuzz)
-    "-Dtext-shaping=${if withHarfBuzz then "enabled" else "disabled"}"
   ];
 
   doCheck = true;
 
   meta = with lib; {
     homepage = "https://codeberg.org/dnkl/fcft";
+    changelog = "https://codeberg.org/dnkl/fcft/releases/tag/${version}";
     description = "Simple library for font loading and glyph rasterization";
     maintainers = with maintainers; [
       fionera

pkgs/development/libraries/gbenchmark/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gbenchmark";
-  version = "1.5.2";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "benchmark";
     rev = "v${version}";
-    sha256 = "13rxagpzw6bal6ajlmrxlh9kgfvcixn6j734b2bvfqz7lch8n0pa";
+    sha256 = "sha256-h/e2vJacUp7PITez9HPzGc5+ofz7Oplso44VibECmsI=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/java/commons/compress/default.nix

@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl }:
 
 stdenv.mkDerivation rec {
-  version = "1.20";
+  version = "1.21";
   pname = "commons-compress";
 
   src = fetchurl {
     url    = "mirror://apache/commons/compress/binaries/${pname}-${version}-bin.tar.gz";
-    sha256 = "0zx1sc0rw3vzjan69vxr2qw82y9b0hqdzp4plcahc3c1y0vkz3fg";
+    sha256 = "sha256-sWF0K5MSOSXUxBLC9+1/RF5ST4tIzVKGnKQvStuVLvM=";
   };
 
   installPhase = ''

pkgs/development/libraries/java/hsqldb/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "hsqldb";
-  version = "2.5.1";
+  version = "2.6.0";
   underscoreMajMin = lib.strings.replaceChars ["."] ["_"] (lib.versions.majorMinor version);
 
   src = fetchurl {
     url = "mirror://sourceforge/project/hsqldb/hsqldb/hsqldb_${underscoreMajMin}/hsqldb-${version}.zip";
-    sha256 = "0yd9px85y036bp3q1assj3fgaykxrwnhnc7cbjgic39cykfy5hrg";
+    sha256 = "sha256-GhuTBJl1E+aoWa8pTWEqzghHDXXiCQFIt++8pjCQYik=";
   };
 
   nativeBuildInputs = [ unzip makeWrapper ];

pkgs/development/libraries/kmsxx/default.nix

@@ -1,22 +1,37 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libdrm
+{ lib
-, withPython ? false, python ? null }:
+, stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, cmake
+, pkg-config
+, libdrm
+, fmt
+, libevdev
+, withPython ? false
+, python3Packages
+}:
 
 stdenv.mkDerivation {
   pname = "kmsxx";
-  version = "2020-08-04";
+  version = "2021-07-26";
 
   src = fetchFromGitHub {
     owner = "tomba";
     repo = "kmsxx";
     fetchSubmodules = true;
-    rev = "38bee3092f2d477f1baebfcae464f888d3d04bbe";
+    rev = "54f591ec0de61dd192baf781c9b2ec87d5b461f7";
-    sha256 = "0xz4m9bk0naawxwpx5cy1j3cm6c8c9m5y551csk88y88x1g0z0xh";
+    sha256 = "sha256-j+20WY4a2iTKZnYjXhxbNnZZ53K3dHpDMTp+ZulS+7c=";
   };
 
-  cmakeFlags = lib.optional (!withPython) "-DKMSXX_ENABLE_PYTHON=OFF";
+  # Didn't detect pybind11 without cmake
+  nativeBuildInputs = [ meson ninja pkg-config ] ++ lib.optionals withPython [ cmake ];
+  buildInputs = [ libdrm fmt libevdev ]
+    ++ lib.optionals withPython (with python3Packages; [ python pybind11 ]);
 
-  nativeBuildInputs = [ cmake pkg-config ];
+  dontUseCmakeConfigure = true;
-  buildInputs = [ libdrm ] ++ lib.optionals withPython [ python ];
+
+  mesonFlags = lib.optional (!withPython) "-Dpykms=disabled";
 
   meta = with lib; {
     description = "C++11 library, utilities and python bindings for Linux kernel mode setting";
@@ -24,6 +39,5 @@ stdenv.mkDerivation {
     license = licenses.mpl20;
     maintainers = with maintainers; [ ];
     platforms = platforms.linux;
-    broken = true; # marked broken 2021-03-26
   };
 }