From 58497175be8c3046186127064ec14fc62191282d Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Mon, 10 May 2021 09:57:52 +0300
Subject: [PATCH 01/20] nixos/netdata: cgroup-network: don't use
 AmbientCapabilities

---
 nixos/modules/services/monitoring/netdata.nix | 15 ++++++++++++---
 pkgs/tools/system/netdata/default.nix         |  2 ++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index c2ee1c0df7f..ae3bfcbbb97 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -8,6 +8,7 @@ let
   wrappedPlugins = pkgs.runCommand "wrapped-plugins" { preferLocalBuild = true; } ''
     mkdir -p $out/libexec/netdata/plugins.d
     ln -s /run/wrappers/bin/apps.plugin $out/libexec/netdata/plugins.d/apps.plugin
+    ln -s /run/wrappers/bin/cgroup-network $out/libexec/netdata/plugins.d/cgroup-network
     ln -s /run/wrappers/bin/freeipmi.plugin $out/libexec/netdata/plugins.d/freeipmi.plugin
     ln -s /run/wrappers/bin/perf.plugin $out/libexec/netdata/plugins.d/perf.plugin
     ln -s /run/wrappers/bin/slabinfo.plugin $out/libexec/netdata/plugins.d/slabinfo.plugin
@@ -26,6 +27,9 @@ let
       "web files owner" = "root";
       "web files group" = "root";
     };
+    "plugin:cgroups" = {
+      "script to get cgroup network interfaces" = "${wrappedPlugins}/libexec/netdata/plugins.d/cgroup-network";
+    };
   };
   mkConfig = generators.toINI {} (recursiveUpdate localConfig cfg.config);
   configFile = pkgs.writeText "netdata.conf" (if cfg.configText != null then cfg.configText else mkConfig);
@@ -183,9 +187,6 @@ in {
         ConfigurationDirectory = "netdata";
         ConfigurationDirectoryMode = "0755";
         # Capabilities
-        AmbientCapabilities = [
-          "CAP_SETUID"            # is required for cgroups and cgroups-network plugins
-        ];
         CapabilityBoundingSet = [
           "CAP_DAC_OVERRIDE"      # is required for freeipmi and slabinfo plugins
           "CAP_DAC_READ_SEARCH"   # is required for apps plugin
@@ -217,6 +218,14 @@ in {
       permissions = "u+rx,g+rx,o-rwx";
     };
 
+    security.wrappers."cgroup-network" = {
+      source = "${cfg.package}/libexec/netdata/plugins.d/cgroup-network.org";
+      capabilities = "cap_setuid+ep";
+      owner = cfg.user;
+      group = cfg.group;
+      permissions = "u+rx,g+rx,o-rwx";
+    };
+
     security.wrappers."freeipmi.plugin" = {
       source = "${cfg.package}/libexec/netdata/plugins.d/freeipmi.plugin.org";
       capabilities = "cap_dac_override,cap_fowner+ep";
diff --git a/pkgs/tools/system/netdata/default.nix b/pkgs/tools/system/netdata/default.nix
index 5eb39c7f6d8..4dc0d80b3b5 100644
--- a/pkgs/tools/system/netdata/default.nix
+++ b/pkgs/tools/system/netdata/default.nix
@@ -56,6 +56,8 @@ in stdenv.mkDerivation rec {
     # rename this plugin so netdata will look for setuid wrapper
     mv $out/libexec/netdata/plugins.d/apps.plugin \
        $out/libexec/netdata/plugins.d/apps.plugin.org
+    mv $out/libexec/netdata/plugins.d/cgroup-network \
+       $out/libexec/netdata/plugins.d/cgroup-network.org
     mv $out/libexec/netdata/plugins.d/perf.plugin \
        $out/libexec/netdata/plugins.d/perf.plugin.org
     mv $out/libexec/netdata/plugins.d/slabinfo.plugin \

From 859633ee4351835c0180427d34d188b489c3ca65 Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Mon, 10 May 2021 10:24:31 +0300
Subject: [PATCH 02/20] nixos/netdata: use cgroup v2

---
 nixos/modules/services/monitoring/netdata.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index ae3bfcbbb97..2028e3875f9 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -29,6 +29,7 @@ let
     };
     "plugin:cgroups" = {
       "script to get cgroup network interfaces" = "${wrappedPlugins}/libexec/netdata/plugins.d/cgroup-network";
+      "use unified cgroups" = "yes";
     };
   };
   mkConfig = generators.toINI {} (recursiveUpdate localConfig cfg.config);

From 85914bc01d7ba185158c0a8f3694ee81ceaf2a1b Mon Sep 17 00:00:00 2001
From: Izorkin <izorkin@elven.pw>
Date: Mon, 10 May 2021 10:35:29 +0300
Subject: [PATCH 03/20] nixos/netdata: change wrappers permissions

---
 nixos/modules/services/monitoring/netdata.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index 2028e3875f9..561ce3eec62 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -216,7 +216,7 @@ in {
       capabilities = "cap_dac_read_search,cap_sys_ptrace+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rwx";
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.wrappers."cgroup-network" = {
@@ -224,7 +224,7 @@ in {
       capabilities = "cap_setuid+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rwx";
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.wrappers."freeipmi.plugin" = {
@@ -232,7 +232,7 @@ in {
       capabilities = "cap_dac_override,cap_fowner+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rwx";
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.wrappers."perf.plugin" = {
@@ -240,7 +240,7 @@ in {
       capabilities = "cap_sys_admin+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rx";
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.wrappers."slabinfo.plugin" = {
@@ -248,7 +248,7 @@ in {
       capabilities = "cap_dac_override+ep";
       owner = cfg.user;
       group = cfg.group;
-      permissions = "u+rx,g+rx,o-rx";
+      permissions = "u+rx,g+x,o-rwx";
     };
 
     security.pam.loginLimits = [

From c7703958948f46d5568672a4e67187f9da3fc526 Mon Sep 17 00:00:00 2001
From: Konstantin Alekseev <mail@kalekseev.com>
Date: Mon, 10 May 2021 12:37:42 +0300
Subject: [PATCH 04/20] overmind: 2.2.0 -> 2.2.2

---
 pkgs/applications/misc/overmind/default.nix |  11 +-
 pkgs/applications/misc/overmind/deps.nix    | 129 --------------------
 2 files changed, 5 insertions(+), 135 deletions(-)
 delete mode 100644 pkgs/applications/misc/overmind/deps.nix

diff --git a/pkgs/applications/misc/overmind/default.nix b/pkgs/applications/misc/overmind/default.nix
index 537ae3741ef..80a423a3c83 100644
--- a/pkgs/applications/misc/overmind/default.nix
+++ b/pkgs/applications/misc/overmind/default.nix
@@ -1,9 +1,8 @@
-{ lib, buildGoPackage, fetchFromGitHub, tmux, which, makeWrapper }:
+{ lib, buildGoModule, fetchFromGitHub, tmux, which, makeWrapper }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "overmind";
-  version = "2.2.0";
-  goPackagePath = "github.com/DarthSim/overmind";
+  version = "2.2.2";
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -15,10 +14,10 @@ buildGoPackage rec {
     owner = "DarthSim";
     repo = pname;
     rev = "v${version}";
-    sha256 = "00v6l4138vv32bqfkzrhk4hfl52a00rlg9ywhp4difgrnz7zj6xb";
+    sha256 = "zDjIwnhDoUj+zTAhtBa94dx7QhYMCTxv2DNUpeP8CP0=";
   };
 
-  goDeps = ./deps.nix;
+  vendorSha256 = "KDMzR6qAruscgS6/bHTN6RnHOlLKCm9lxkr9k3oLY+Y=";
 
   meta = with lib; {
     homepage = "https://github.com/DarthSim/overmind";
diff --git a/pkgs/applications/misc/overmind/deps.nix b/pkgs/applications/misc/overmind/deps.nix
deleted file mode 100644
index b4c9211a24a..00000000000
--- a/pkgs/applications/misc/overmind/deps.nix
+++ /dev/null
@@ -1,129 +0,0 @@
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "v0.3.1";
-      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
-    };
-  }
-  {
-    goPackagePath = "github.com/DarthSim/godotenv";
-    fetch = {
-      type = "git";
-      url = "https://github.com/DarthSim/godotenv";
-      rev = "v1.3.1";
-      sha256 = "0fb9nl5qrnv7f9w0pgg00ak34afw9kjgcql0l38z22faz2bhgl1q";
-    };
-  }
-  {
-    goPackagePath = "github.com/cpuguy83/go-md2man";
-    fetch = {
-      type = "git";
-      url = "https://github.com/cpuguy83/go-md2man";
-      rev = "f79a8a8ca69d";
-      sha256 = "0r1f7v475dxxgzqci1mxfliwadcrk86ippflx9n411325l4g3ghv";
-    };
-  }
-  {
-    goPackagePath = "github.com/kardianos/osext";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kardianos/osext";
-      rev = "2bc1f35cddc0";
-      sha256 = "1pvrbrvmrf4mx0fxbfaphbzgqgwn8v6lkfk2vyrs0znxrs1xyc5r";
-    };
-  }
-  {
-    goPackagePath = "github.com/matoous/go-nanoid";
-    fetch = {
-      type = "git";
-      url = "https://github.com/matoous/go-nanoid";
-      rev = "eab626deece6";
-      sha256 = "1a82lclk56y7c44jg7wn5vq733dmn0g20r5yqbchrxnpfl75dw89";
-    };
-  }
-  {
-    goPackagePath = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev = "v1.0.0";
-      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
-    };
-  }
-  {
-    goPackagePath = "github.com/russross/blackfriday";
-    fetch = {
-      type = "git";
-      url = "https://github.com/russross/blackfriday";
-      rev = "v2.0.1";
-      sha256 = "0nlz7isdd4rgnwzs68499hlwicxz34j2k2a0b8jy0y7ycd2bcr5j";
-    };
-  }
-  {
-    goPackagePath = "github.com/sevlyar/go-daemon";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sevlyar/go-daemon";
-      rev = "v0.1.5";
-      sha256 = "1y3gnxaifykcjcbzx91lz9bc93b95w3xj4rjxjbii26pm3j7gqyk";
-    };
-  }
-  {
-    goPackagePath = "github.com/shurcooL/sanitized_anchor_name";
-    fetch = {
-      type = "git";
-      url = "https://github.com/shurcooL/sanitized_anchor_name";
-      rev = "v1.0.0";
-      sha256 = "1gv9p2nr46z80dnfjsklc6zxbgk96349sdsxjz05f3z6wb6m5l8f";
-    };
-  }
-  {
-    goPackagePath = "github.com/urfave/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/urfave/cli";
-      rev = "v1.22.2";
-      sha256 = "10mcnvi5qmn00vpyk6si8gjka7p654wr9hac4zc9w5h3ickhvbdc";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "88737f569e3a";
-      sha256 = "02vkqfd6kc28zm6lffagw8nr78sayv6jabfgk9dcifl7826vi3k7";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "81d4e9dc473e";
-      sha256 = "0074zjpkhclz5qbgjv0zmdwy6hmf5k2ri5yagnm6i12ahxaa48dr";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/check.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/check.v1";
-      rev = "20d25e280405";
-      sha256 = "0k1m83ji9l1a7ng8a7v40psbymxasmssbrrhpdv2wl4rhs0nc3np";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "v2.2.2";
-      sha256 = "01wj12jzsdqlnidpyjssmj0r4yavlqy7dwrg7adqd8dicjc4ncsa";
-    };
-  }
-]

From e4b05d9af55b403baaa6fdd738ee16c4498c4299 Mon Sep 17 00:00:00 2001
From: Henri Menke <henri@henrimenke.de>
Date: Mon, 10 May 2021 20:34:54 +0200
Subject: [PATCH 05/20] zfs: remove trace output

We cannot have trace output if the package is marked broken, because
ofborg will consider the evaluation failed if there is any output. Hence
if there is any unsupported kernel version in nixpkgs, the trace will
show up and ofborg will complain.
---
 pkgs/os-specific/linux/zfs/default.nix | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index adfd0cda819..e10be635b1c 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -182,13 +182,9 @@ let
         license = licenses.cddl;
         platforms = platforms.linux;
         maintainers = with maintainers; [ hmenke jcumming jonringer wizeman fpletz globin mic92 ];
-        broken = if
-          buildKernel && (kernelCompatible != null) && !kernelCompatible
-          then builtins.trace ''
-            Linux v${kernel.version} is not yet supported by zfsonlinux v${version}.
-            ${lib.optionalString (!isUnstable) "Try zfsUnstable or set the NixOS option boot.zfs.enableUnstable."}
-          '' true
-          else false;
+        # If your Linux kernel version is not yet supported by zfs, try zfsUnstable.
+        # On NixOS set the option boot.zfs.enableUnstable.
+        broken = buildKernel && (kernelCompatible != null) && !kernelCompatible;
       };
     };
 in {

From 0e9fcd6e85bdcd09454841cdabfd9aabf979cf29 Mon Sep 17 00:00:00 2001
From: "Robert T. McGibbon" <rmcgibbo@gmail.com>
Date: Mon, 10 May 2021 17:11:52 -0400
Subject: [PATCH 06/20] python3Packages.tablib: fix build

---
 pkgs/development/python-modules/tablib/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/tablib/default.nix b/pkgs/development/python-modules/tablib/default.nix
index 5216fc7d0d9..b6754e15ad5 100644
--- a/pkgs/development/python-modules/tablib/default.nix
+++ b/pkgs/development/python-modules/tablib/default.nix
@@ -2,6 +2,7 @@
 , odfpy
 , openpyxl
 , pandas
+, setuptools-scm
 , pytest
 , pytestcov
 , pyyaml
@@ -20,6 +21,7 @@ buildPythonPackage rec {
     sha256 = "f83cac08454f225a34a305daa20e2110d5e6335135d505f93bc66583a5f9c10d";
   };
 
+  nativeBuildInputs = [ setuptools-scm ];
   propagatedBuildInputs = [ xlwt openpyxl pyyaml xlrd odfpy ];
   checkInputs = [ pytest pytestcov unicodecsv pandas ];
 

From f4839bfc43864ded5ba47ba1adcae67e3a9e456c Mon Sep 17 00:00:00 2001
From: Andrey Kuznetsov <fear@loathing.in>
Date: Tue, 11 May 2021 00:35:08 +0300
Subject: [PATCH 07/20] nym: fix build on darwin

---
 pkgs/applications/networking/nym/default.nix | 7 +++++--
 pkgs/top-level/all-packages.nix              | 4 +++-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/nym/default.nix b/pkgs/applications/networking/nym/default.nix
index 9251862ba6e..1dc41f3af97 100644
--- a/pkgs/applications/networking/nym/default.nix
+++ b/pkgs/applications/networking/nym/default.nix
@@ -1,8 +1,11 @@
-{ lib
+{ stdenv
+, lib
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
 , openssl
+, Security
+, libiconv
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -20,7 +23,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security libiconv ];
 
   patches = [ ./ignore-networking-tests.patch ];
   checkType = "debug";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 24fbb63792b..13073bf6a9c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7146,7 +7146,9 @@ in
 
   nylon = callPackage ../tools/networking/nylon { };
 
-  nym = callPackage ../applications/networking/nym { };
+  nym = callPackage ../applications/networking/nym {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   nzbget = callPackage ../tools/networking/nzbget { };
 

From 0d3bc3db3e5c1a72487eed9fa2b95559e874787c Mon Sep 17 00:00:00 2001
From: Andrey Kuznetsov <fear@loathing.in>
Date: Tue, 11 May 2021 02:11:49 +0300
Subject: [PATCH 08/20] nym: all platforms

---
 pkgs/applications/networking/nym/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/networking/nym/default.nix b/pkgs/applications/networking/nym/default.nix
index 1dc41f3af97..b7bffcd694e 100644
--- a/pkgs/applications/networking/nym/default.nix
+++ b/pkgs/applications/networking/nym/default.nix
@@ -39,6 +39,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://nymtech.net";
     license = licenses.asl20;
     maintainers = [ maintainers.ehmry ];
-    platforms = with platforms; intersectLists (linux ++ darwin) (concatLists [ x86 x86_64 aarch64 arm ]);
+    platforms = platforms.all;
   };
 }

From 81310256a99929d2f65f5198aad6503e4e2e855f Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Mon, 10 May 2021 23:16:19 +0200
Subject: [PATCH 09/20] home-assistant: 2021.5.1 -> 2021.5.2

---
 pkgs/servers/home-assistant/component-packages.nix | 4 ++--
 pkgs/servers/home-assistant/default.nix            | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 923e18bd586..afaef82d372 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2021.5.1";
+  version = "2021.5.2";
   components = {
     "abode" = ps: with ps; [ abodepy ];
     "accuweather" = ps: with ps; [ accuweather ];
@@ -375,7 +375,7 @@
     "hvv_departures" = ps: with ps; [ ]; # missing inputs: pygti
     "hydrawise" = ps: with ps; [ hydrawiser ];
     "hyperion" = ps: with ps; [ hyperion-py ];
-    "ialarm" = ps: with ps; [ ]; # missing inputs: pyialarm
+    "ialarm" = ps: with ps; [ pyialarm ];
     "iammeter" = ps: with ps; [ ]; # missing inputs: iammeter
     "iaqualink" = ps: with ps; [ iaqualink ];
     "icloud" = ps: with ps; [ pyicloud ];
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 5383ae33d13..11bf2c744d3 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -114,7 +114,7 @@ let
   extraBuildInputs = extraPackages py.pkgs;
 
   # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2021.5.1";
+  hassVersion = "2021.5.2";
 
 in with py.pkgs; buildPythonApplication rec {
   pname = "homeassistant";
@@ -133,7 +133,7 @@ in with py.pkgs; buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     rev = version;
-    sha256 = "0bipjfkz4zqhy84jgrn3qxvs4nxya3j08lcsq3xa31xfz8wnpxwj";
+    sha256 = "1v1ah0kdkhx0pkma2qnk56iv00r2lb4i3sfpwlcr64gfkpzpakv8";
   };
 
   # leave this in, so users don't have to constantly update their downstream patch handling

From 206f155928ca63ff297ce50bedb6c8198483e8a0 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 11 May 2021 01:03:29 +0200
Subject: [PATCH 10/20] python3Packages.pysonos: 0.0.44 -> 0.0.45

---
 pkgs/development/python-modules/pysonos/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pysonos/default.nix b/pkgs/development/python-modules/pysonos/default.nix
index 3219bd53ac1..e4296a4f0b5 100644
--- a/pkgs/development/python-modules/pysonos/default.nix
+++ b/pkgs/development/python-modules/pysonos/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "pysonos";
-  version = "0.0.44";
+  version = "0.0.45";
 
   disabled = !isPy3k;
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "amelchio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "108818mkb037zs4ikilrskfppcbmqslsm6zaxmy8pphjh7c299mz";
+    sha256 = "0wzmrd9ja5makvsgf0ckil99wr8vw91dml8fi9miiq4la0100q0n";
   };
 
   propagatedBuildInputs = [ ifaddr requests xmltodict ];

From 4b9a7b96dc36ae87da93152c8f57c91823ae9969 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Tue, 11 May 2021 00:34:00 +0000
Subject: [PATCH 11/20] agi: 1.1.0-dev-20210506 -> 1.1.0-dev-20210507

---
 pkgs/tools/graphics/agi/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/graphics/agi/default.nix b/pkgs/tools/graphics/agi/default.nix
index b7cfefe70cb..9c9356371b6 100644
--- a/pkgs/tools/graphics/agi/default.nix
+++ b/pkgs/tools/graphics/agi/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "agi";
-  version = "1.1.0-dev-20210506";
+  version = "1.1.0-dev-20210507";
 
   src = fetchzip {
     url = "https://github.com/google/agi-dev-releases/releases/download/v${version}/agi-${version}-linux.zip";
-    sha256 = "sha256-VB9AL2h+e+92lhsfdYHbSgv5AIrgEPJsa74VGncDHGo=";
+    sha256 = "sha256-Tbxbsh40Lel4kGnCIWyNRge15Y71ao+oUixClBdj4f4=";
   };
 
   nativeBuildInputs = [

From b8a7603c6d3582bdaf24688579014429a70cfc2e Mon Sep 17 00:00:00 2001
From: Evils <evils.devils@protonmail.com>
Date: Sun, 9 May 2021 02:30:09 +0200
Subject: [PATCH 12/20] pycflow2dot: init at 0.2.3

---
 .../python-modules/pycflow2dot/default.nix    | 41 +++++++++++++++++++
 pkgs/top-level/all-packages.nix               |  2 +
 pkgs/top-level/python-packages.nix            |  4 ++
 3 files changed, 47 insertions(+)
 create mode 100644 pkgs/development/python-modules/pycflow2dot/default.nix

diff --git a/pkgs/development/python-modules/pycflow2dot/default.nix b/pkgs/development/python-modules/pycflow2dot/default.nix
new file mode 100644
index 00000000000..db1ac8fabb2
--- /dev/null
+++ b/pkgs/development/python-modules/pycflow2dot/default.nix
@@ -0,0 +1,41 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, cflow
+, graphviz
+, pydot
+, networkx
+, which
+}:
+
+buildPythonPackage rec {
+  pname = "pycflow2dot";
+  version = "0.2.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1zm8x2pd0q6zza0fw7hg9g1qvybfnjq6ql9b8mh2fc45l7l25655";
+  };
+
+  propagatedBuildInputs = [
+    cflow
+    graphviz
+    pydot
+    networkx
+    which
+  ];
+
+  pythonImportsCheck = [ "pycflow2dot" ];
+  checkPhase = ''
+    cd tests
+    export PATH=$out/bin:$PATH
+    make all
+  '';
+
+  meta = with lib; {
+    description = "Layout C call graphs from cflow using GraphViz dot";
+    homepage    = "https://github.com/johnyf/pycflow2dot";
+    license     = licenses.gpl3Plus;
+    maintainers = with maintainers; [ evils ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e7cfe7eaf95..d592008e241 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7820,6 +7820,8 @@ in
 
   pycangjie = pythonPackages.pycangjie;
 
+  pycflow2dot = with python.pkgs; toPythonApplication pycflow2dot;
+
   pydb = callPackage ../development/tools/pydb { };
 
   pydf = callPackage ../applications/misc/pydf { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f4f6a4d6e36..0d75625019b 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5410,6 +5410,10 @@ in {
 
   pycfdns = callPackage ../development/python-modules/pycfdns { };
 
+  pycflow2dot = callPackage ../development/python-modules/pycflow2dot {
+    inherit (pkgs) graphviz;
+  };
+
   pychannels = callPackage ../development/python-modules/pychannels { };
 
   pychart = callPackage ../development/python-modules/pychart { };

From 63872607cd5f5c550189b0788eb59224c614e996 Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 11 May 2021 09:22:26 +0800
Subject: [PATCH 13/20] vimPlugins: update

---
 pkgs/misc/vim-plugins/generated.nix | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index a0eb16763f7..705e7ec7902 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -389,12 +389,12 @@ let
 
   chadtree = buildVimPluginFrom2Nix {
     pname = "chadtree";
-    version = "2021-05-10";
+    version = "2021-05-11";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "chadtree";
-      rev = "d6ddb11b13a28f858344cdfafbe4d76fe032803a";
-      sha256 = "0wr6m0i0lj5dpp0rbqyx534jnwpmrrywjq55xai5z799dh4in42k";
+      rev = "2ccce5fa035176b51fa628ba6c672dedf78813e8";
+      sha256 = "0nrxxwf4wy6g5222qf4bjbyai8gym1k0b4wdyjpldfk5pdxd81zg";
     };
     meta.homepage = "https://github.com/ms-jpq/chadtree/";
   };
@@ -702,12 +702,12 @@ let
 
   context_filetype-vim = buildVimPluginFrom2Nix {
     pname = "context_filetype-vim";
-    version = "2021-03-04";
+    version = "2021-05-11";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "context_filetype.vim";
-      rev = "f5e4ed8f7847cd5474017459c2a0f2dfd2bf971c";
-      sha256 = "039mnsd6k0sgs8l1a8ngl3y817c8g657nv8v9bdw9h8l5a934cb2";
+      rev = "39a552866c83946127f244912b6d408525f03364";
+      sha256 = "0m2w4f3bn8miplxb9q76fcipdkc9lbfyp47193q57s555b1g0x0k";
     };
     meta.homepage = "https://github.com/Shougo/context_filetype.vim/";
   };
@@ -1503,8 +1503,8 @@ let
     src = fetchFromGitHub {
       owner = "rafamadriz";
       repo = "friendly-snippets";
-      rev = "83de9287ad388f55b7d74f66b8ea5b89bb6abf24";
-      sha256 = "13jp8bg85yyxyl390ymrp6qasg4p6a57x08m2l9ld8wiq33ps6yp";
+      rev = "9178101a99226fb4a973fd88ba6e84972c7b0a94";
+      sha256 = "1dy9b5ipzs412sz31mqqrr6rfjs24569pw17z9b3z40dipmzg1x8";
     };
     meta.homepage = "https://github.com/rafamadriz/friendly-snippets/";
   };
@@ -7087,12 +7087,12 @@ let
 
   vim-matchup = buildVimPluginFrom2Nix {
     pname = "vim-matchup";
-    version = "2021-05-09";
+    version = "2021-05-10";
     src = fetchFromGitHub {
       owner = "andymass";
       repo = "vim-matchup";
-      rev = "2032562ba91b9904fdbaac8a586d93fc69d5aec6";
-      sha256 = "1d38dx5s89113iglbji3q4va3hnjqa6cx141faldp283v39y2qv2";
+      rev = "ea2612d87a38ef2261f66063571eef06689bbb8e";
+      sha256 = "0a7dxvl8p3n8kfm1abm1k2r9l6s230585521scgh8y1sh88zkpay";
     };
     meta.homepage = "https://github.com/andymass/vim-matchup/";
   };

From 28ed9e7f3c934bccdcd716a9364b4d4e87088602 Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 11 May 2021 09:25:08 +0800
Subject: [PATCH 14/20] vimPlugins.Shade-nvim: init at 2021-04-29

---
 pkgs/misc/vim-plugins/generated.nix    | 12 ++++++++++++
 pkgs/misc/vim-plugins/vim-plugin-names |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index 705e7ec7902..d391f145b48 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -4127,6 +4127,18 @@ let
     meta.homepage = "https://github.com/osyo-manga/shabadou.vim/";
   };
 
+  Shade-nvim = buildVimPluginFrom2Nix {
+    pname = "Shade-nvim";
+    version = "2021-04-29";
+    src = fetchFromGitHub {
+      owner = "sunjon";
+      repo = "Shade.nvim";
+      rev = "0196387bba50b8d36cec99cd6483583ff2dedb42";
+      sha256 = "0831k71gm8rpl54x63v7mgp9i1fgxydp2wig3yyd98dc7z9d8f48";
+    };
+    meta.homepage = "https://github.com/sunjon/Shade.nvim/";
+  };
+
   ShowMultiBase = buildVimPluginFrom2Nix {
     pname = "ShowMultiBase";
     version = "2010-10-18";
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index 50b26968f8c..292f30997da 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -596,6 +596,7 @@ steelsojka/completion-buffers
 stefandtw/quickfix-reflector.vim
 stephpy/vim-yaml
 sunaku/vim-dasht
+sunjon/Shade.nvim
 svermeulen/vim-subversive
 t9md/vim-choosewin
 t9md/vim-smalls

From 8e5211de812c1e2b8eb8c6069cdd9e95983efad0 Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 11 May 2021 09:33:11 +0800
Subject: [PATCH 15/20] vimPlugins.floating-nvim: init at 2021-05-08

---
 pkgs/misc/vim-plugins/generated.nix    | 12 ++++++++++++
 pkgs/misc/vim-plugins/vim-plugin-names |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index d391f145b48..f7890b076ca 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -1473,6 +1473,18 @@ let
     meta.homepage = "https://github.com/ncm2/float-preview.nvim/";
   };
 
+  floating-nvim = buildVimPluginFrom2Nix {
+    pname = "floating-nvim";
+    version = "2021-05-08";
+    src = fetchFromGitHub {
+      owner = "fhill2";
+      repo = "floating.nvim";
+      rev = "c47af010aa8e88758995858f0ed2771a99cd3e98";
+      sha256 = "0cvs6c903bq4jk4l197vvdrk8q85rl7z7iy7cvd5m4k7yd937r50";
+    };
+    meta.homepage = "https://github.com/fhill2/floating.nvim/";
+  };
+
   floobits-neovim = buildVimPluginFrom2Nix {
     pname = "floobits-neovim";
     version = "2018-08-01";
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index 292f30997da..fec94771389 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -131,6 +131,7 @@ fatih/vim-go
 fcpg/vim-osc52
 FelikZ/ctrlp-py-matcher
 fenetikm/falcon
+fhill2/floating.nvim
 fiatjaf/neuron.vim
 fisadev/vim-isort
 flazz/vim-colorschemes

From 7cda01fcb817f58af5022cf8804c57018646136f Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 11 May 2021 09:37:03 +0800
Subject: [PATCH 16/20] vimPlugins.fwatch-nvim: init at 2021-04-26

---
 pkgs/misc/vim-plugins/generated.nix    | 12 ++++++++++++
 pkgs/misc/vim-plugins/vim-plugin-names |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index f7890b076ca..349cc7c42b6 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -1545,6 +1545,18 @@ let
     meta.homepage = "https://github.com/shumphrey/fugitive-gitlab.vim/";
   };
 
+  fwatch-nvim = buildVimPluginFrom2Nix {
+    pname = "fwatch-nvim";
+    version = "2021-04-26";
+    src = fetchFromGitHub {
+      owner = "rktjmp";
+      repo = "fwatch.nvim";
+      rev = "5fd6bff00d7fa432cdc847819563dad90bcf649d";
+      sha256 = "1jc3kv0w3767593p9capif3p0msf8ac5xal170757ghfiy2jhsp9";
+    };
+    meta.homepage = "https://github.com/rktjmp/fwatch.nvim/";
+  };
+
   fzf-lsp-nvim = buildVimPluginFrom2Nix {
     pname = "fzf-lsp-nvim";
     version = "2021-02-04";
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index fec94771389..58a8bb61890 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -531,6 +531,7 @@ rhysd/vim-grammarous
 rhysd/vim-operator-surround
 RishabhRD/nvim-lsputils
 RishabhRD/popfix
+rktjmp/fwatch.nvim@main
 rktjmp/lush.nvim@main
 rmagatti/auto-session@main
 rodjek/vim-puppet

From ee4520e789864f3441f3ec488e16d9f548b22ca5 Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 11 May 2021 09:41:59 +0800
Subject: [PATCH 17/20] vimPlugins.aurora: init at 2021-05-10

---
 pkgs/misc/vim-plugins/generated.nix    | 12 ++++++++++++
 pkgs/misc/vim-plugins/vim-plugin-names |  1 +
 2 files changed, 13 insertions(+)

diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index 349cc7c42b6..459f768a379 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -183,6 +183,18 @@ let
     meta.homepage = "https://github.com/vmchale/ats-vim/";
   };
 
+  aurora = buildVimPluginFrom2Nix {
+    pname = "aurora";
+    version = "2021-05-10";
+    src = fetchFromGitHub {
+      owner = "ray-x";
+      repo = "aurora";
+      rev = "bf185b9c5aaaad7cfd20f29f92d3b77164f8f1e7";
+      sha256 = "17ir0daw3rsfgprgvrskip2r19g15z05spdk14dz105nrgv4hh4y";
+    };
+    meta.homepage = "https://github.com/ray-x/aurora/";
+  };
+
   auto-git-diff = buildVimPluginFrom2Nix {
     pname = "auto-git-diff";
     version = "2019-09-23";
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index 58a8bb61890..8dd07b20256 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -521,6 +521,7 @@ raghur/fruzzy
 raghur/vim-ghost
 Raimondi/delimitMate
 rakr/vim-one
+ray-x/aurora
 rbgrouleff/bclose.vim
 rbong/vim-flog
 rhysd/committia.vim

From e97d557475a2f7a8da811256b7df769514560d1f Mon Sep 17 00:00:00 2001
From: fortuneteller2k <lythe1107@gmail.com>
Date: Tue, 11 May 2021 11:35:33 +0800
Subject: [PATCH 18/20] zfsUnstable: 2.1.0-rc4 -> 2.1.0-rc5

---
 pkgs/os-specific/linux/zfs/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/os-specific/linux/zfs/default.nix b/pkgs/os-specific/linux/zfs/default.nix
index e10be635b1c..6db953ae4ef 100644
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@@ -203,12 +203,12 @@ in {
 
   zfsUnstable = common {
     # check the release notes for compatible kernels
-    kernelCompatible = kernel.kernelAtLeast "3.10" && kernel.kernelOlder "5.12";
+    kernelCompatible = kernel.kernelAtLeast "3.10" && kernel.kernelOlder "5.13";
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2.1.0-rc4";
+    version = "2.1.0-rc5";
 
-    sha256 = "sha256-eakOEA7LCJOYDsZH24Y5JbEd2wh1KfCN+qX3QxQZ4e8=";
+    sha256 = "sha256-cj0P2bw6sTO+Y74pYn/WEpBuVGMMYCreJQjUdC3DMTE=";
 
     isUnstable = true;
   };

From 768075ffb90da1dc66e5e4603a77b76b5a67d343 Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Tue, 11 May 2021 04:13:56 +0000
Subject: [PATCH 19/20] golangci-lint: 1.39.0 -> 1.40.0

---
 pkgs/development/tools/golangci-lint/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/golangci-lint/default.nix b/pkgs/development/tools/golangci-lint/default.nix
index 83bc3f473d3..647e8b58490 100644
--- a/pkgs/development/tools/golangci-lint/default.nix
+++ b/pkgs/development/tools/golangci-lint/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.39.0";
+  version = "1.40.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    sha256 = "0c9yka27k4v1waijk7mn7k31l5a373sclykypflchy7xnlrsa18v";
+    sha256 = "sha256-/AKDwX4W9MCPXNy2izSGTugLV8DVX4A2djZla8bqDCs=";
   };
 
-  vendorSha256 = "1685iv1lsal462c8xqvs76x9dwvbwazrak902j0p12s0fyb66lpl";
+  vendorSha256 = "sha256-HkVt0Nkq7+gvn5VNeROAmuhlCFGYx2niWb1NwJfLtRc=";
 
   doCheck = false;
 

From f93d83d21b6a2d485006c4832f4850545ab7824e Mon Sep 17 00:00:00 2001
From: sterni <0rpkxez4ksa01gb3typccl0i@systemli.org>
Date: Tue, 11 May 2021 06:54:15 +0200
Subject: [PATCH 20/20] ocamlPackages: cohttp: 2.5.0 -> 4.0.0; conduit: 2.2.2
 -> 4.0.0 (#118144)

* ocamlPackages.x509: 0.12.0 -> 0.13.0

https://github.com/mirleft/ocaml-x509/releases/tag/v0.13.0

* ocamlPackages.tls{,-mirage}: 0.12.8 -> 0.13.1

https://github.com/mirleft/ocaml-tls/releases/tag/v0.13.0
https://github.com/mirleft/ocaml-tls/releases/tag/v0.13.1

* ocamlPackages.ca-certs: 0.2.0 -> 0.2.1

Adds support for NIX_SSL_CERT_FILE, so we can finally run its test
suite! https://github.com/mirage/ca-certs/releases/tag/v0.2.1

* ocamlPackages.dns*: 4.6.3 -> 5.0.0

* jackline: unstable-2020-09-03 -> unstable-2021-04-23

Compatibility with tls >= 0.13.0

* ocamlPackages.ca-certs-nss: init at 3.64.0.1

* ocamlPackages.conduit: 2.2.2 -> 2.3.0

https://github.com/mirage/ocaml-conduit/releases/tag/v2.3.0

* ocamlPackages.curly: fix tests with new ca-certs behavior

* ocamlPackages.cohttp: 2.5.0 -> 4.0.0

ocamlPackages.cohttp-lwt-unix: add description

https://github.com/mirage/ocaml-cohttp/releases/tag/v4.0.0

* ocamlPackages.mirage{,-runtime,-types*}: 3.10.1 -> 3.10.3

Adjust to a few changed dependencies:
https://github.com/mirage/mirage/releases/tag/v3.10.2
https://github.com/mirage/mirage/releases/tag/v3.10.3

* ocamlPackages.conduit*: 2.3.0 -> 4.0.0

https://github.com/mirage/ocaml-conduit/releases/tag/v4.0.0

* ocamlPackages.cohttp-lwt-unix: disable tests

* ocamlPackages.dns*: 5.0.0 -> 5.0.1

https://github.com/mirage/ocaml-dns/releases/tag/v5.0.1

* ocamlPackages.awa*: 0.0.1 -> 0.0.3

https://github.com/mirage/awa-ssh/releases/tag/v0.0.2
https://github.com/mirage/awa-ssh/releases/tag/v0.0.3

* ocamlPackages.optint: 0.0.4 -> 0.1.0

https://github.com/mirage/optint/releases/tag/v0.0.5
https://github.com/mirage/optint/releases/tag/v0.1.0

* ocamlPackages.decompress: 1.3.0 -> 1.4.0

https://github.com/mirage/decompress/releases/tag/v1.4.0

* ocamlPackages.checkseum: 0.2.1 -> 0.3.1

https://github.com/mirage/checkseum/releases/tag/v0.3.0
https://github.com/mirage/checkseum/releases/tag/v0.3.1

* ocamlPackages.checkseum: allow compilation with ocaml-freestanding

* ocamlPackages.carton: 0.4.0 -> 0.4.1

https://github.com/mirage/ocaml-git/releases/tag/carton-v0.4.1

* ocamlPackages.mimic: 0.0.2 -> 0.0.3

* Upstream changed.
* https://github.com/dinosaure/mimic/releases/tag/0.0.3

* ocamlPackages.letsencrypt: 0.2.4 -> 0.2.5

* ocamlPackages.paf: 0.0.1 -> 0.0.3

* ocamlPackages.git-cohttp-mirage: remove at 3.3.3

Will be replaced by git-paf 3.4.0.

* ocamlPackages.git*: 3.3.3 -> 3.4.0

ocamlPackages.git-paf: init at 3.4.0

https://github.com/mirage/ocaml-git/releases/tag/3.4.0

* ocamlPackages.irmin*: 2.5.3 -> 2.6.0

https://github.com/mirage/irmin/releases/tag/2.6.0
---
 .../instant-messengers/jackline/default.nix   |  6 +-
 .../development/ocaml-modules/awa/default.nix |  4 +-
 .../ocaml-modules/ca-certs-nss/default.nix    | 55 ++++++++++++++
 .../ocaml-modules/ca-certs/default.nix        | 12 ++--
 .../ocaml-modules/carton/default.nix          |  6 +-
 .../ocaml-modules/checkseum/default.nix       | 39 +++++++---
 .../checkseum/makefile-no-opam.patch          | 12 ++++
 .../ocaml-modules/cohttp/async.nix            | 72 ++++++++++++++-----
 .../ocaml-modules/cohttp/default.nix          | 13 ++--
 .../ocaml-modules/cohttp/lwt-unix.nix         | 25 ++++---
 pkgs/development/ocaml-modules/cohttp/lwt.nix | 25 ++++---
 .../ocaml-modules/cohttp/mirage.nix           |  3 +
 .../ocaml-modules/conduit/async.nix           | 18 ++---
 .../ocaml-modules/conduit/default.nix         | 10 +--
 .../ocaml-modules/conduit/lwt-unix.nix        | 27 +++++--
 .../ocaml-modules/conduit/mirage.nix          |  7 +-
 .../ocaml-modules/curly/default.nix           |  6 +-
 .../ocaml-modules/decompress/default.nix      |  4 +-
 .../development/ocaml-modules/dns/certify.nix |  4 +-
 .../development/ocaml-modules/dns/default.nix |  4 +-
 .../ocaml-modules/git/cohttp-mirage.nix       | 18 -----
 .../development/ocaml-modules/git/default.nix | 13 ++--
 pkgs/development/ocaml-modules/git/paf.nix    | 49 +++++++++++++
 pkgs/development/ocaml-modules/git/unix.nix   | 11 ++-
 .../ocaml-modules/irmin/containers.nix        |  4 +-
 pkgs/development/ocaml-modules/irmin/git.nix  |  4 +-
 .../ocaml-modules/irmin/graphql.nix           |  3 +-
 pkgs/development/ocaml-modules/irmin/http.nix |  5 +-
 .../ocaml-modules/irmin/mirage-git.nix        |  4 +-
 pkgs/development/ocaml-modules/irmin/ppx.nix  |  4 +-
 pkgs/development/ocaml-modules/irmin/unix.nix |  6 +-
 .../ocaml-modules/letsencrypt/default.nix     |  4 +-
 .../ocaml-modules/mimic/default.nix           | 14 ++--
 .../ocaml-modules/mirage/runtime.nix          |  4 +-
 .../ocaml-modules/optint/default.nix          |  6 +-
 .../development/ocaml-modules/paf/default.nix |  6 +-
 .../development/ocaml-modules/tls/default.nix | 12 ++--
 pkgs/development/ocaml-modules/tls/mirage.nix |  5 +-
 .../ocaml-modules/x509/default.nix            |  4 +-
 pkgs/top-level/ocaml-packages.nix             |  4 +-
 40 files changed, 371 insertions(+), 161 deletions(-)
 create mode 100644 pkgs/development/ocaml-modules/ca-certs-nss/default.nix
 create mode 100644 pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch
 delete mode 100644 pkgs/development/ocaml-modules/git/cohttp-mirage.nix
 create mode 100644 pkgs/development/ocaml-modules/git/paf.nix

diff --git a/pkgs/applications/networking/instant-messengers/jackline/default.nix b/pkgs/applications/networking/instant-messengers/jackline/default.nix
index 4c067e384f9..89d4931a2fe 100644
--- a/pkgs/applications/networking/instant-messengers/jackline/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jackline/default.nix
@@ -4,7 +4,7 @@ with ocamlPackages;
 
 buildDunePackage rec {
   pname = "jackline";
-  version = "unstable-2020-09-03";
+  version = "unstable-2021-04-23";
 
   minimumOCamlVersion = "4.08";
 
@@ -13,8 +13,8 @@ buildDunePackage rec {
   src = fetchFromGitHub {
     owner  = "hannesm";
     repo   = "jackline";
-    rev    = "dd5f19636c9b99b72c348f0f639452d87b7c017c";
-    sha256 = "076smdgig4nwvqsqxa6gsl0c3daq5agwgzp4n2y8xxm3qiq91y89";
+    rev    = "861c59bb7cd27ad5c7558ff94cb0d0e8dca249e5";
+    sha256 = "00waw5qr0n70i9l9b25r9ryfi836x4qrj046bb4k9qa4d0p8q1sa";
   };
 
   nativeBuildInpts = [
diff --git a/pkgs/development/ocaml-modules/awa/default.nix b/pkgs/development/ocaml-modules/awa/default.nix
index 49d614cda88..14f99bb6f8d 100644
--- a/pkgs/development/ocaml-modules/awa/default.nix
+++ b/pkgs/development/ocaml-modules/awa/default.nix
@@ -8,14 +8,14 @@
 
 buildDunePackage rec {
   pname = "awa";
-  version = "0.0.1";
+  version = "0.0.3";
 
   minimumOCamlVersion = "4.07";
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-v${version}.tbz";
-    sha256 = "c1d604645517b191184a5800f5c48a6a9a3e5a2fce4a0e2ecfeee74586301400";
+    sha256 = "5a7927363ffe672cccf12d5425386e84f6f553a17ffec2b01ae5dc28180c831a";
   };
 
   nativeBuildInputs = [ ppx_sexp_conv ppx_cstruct ];
diff --git a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
new file mode 100644
index 00000000000..5e6691a9feb
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@@ -0,0 +1,55 @@
+{ lib
+, buildDunePackage
+, fetchurl
+, rresult
+, mirage-crypto
+, mirage-clock
+, x509
+, logs
+, fmt
+, hex
+, bos
+, astring
+, cmdliner
+, alcotest
+}:
+
+buildDunePackage rec {
+  pname = "ca-certs-nss";
+  version = "3.64.0.1";
+
+  minimumOCamlVersion = "4.07";
+
+  src = fetchurl {
+    url = "https://github.com/mirage/ca-certs-nss/releases/download/v${version}/ca-certs-nss-v${version}.tbz";
+    sha256 = "909c64076491647471f785527bfdd9a886a34504edabf88542b43f27b86067f9";
+  };
+
+  useDune2 = true;
+
+  propagatedBuildInputs = [
+    rresult
+    mirage-crypto
+    mirage-clock
+    x509
+  ];
+
+  buildInputs = [
+    logs
+    fmt
+    hex
+    bos
+    astring
+    cmdliner
+  ];
+
+  doCheck = true;
+  checkInputs = [ alcotest ];
+
+  meta = with lib; {
+    license = licenses.isc;
+    description = "X.509 trust anchors extracted from Mozilla's NSS";
+    maintainers = [ maintainers.sternenseemann ];
+    homepage = "https://github.com/mirage/ca-certs-nss";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/ca-certs/default.nix b/pkgs/development/ocaml-modules/ca-certs/default.nix
index dacc181f751..acf869dbd27 100644
--- a/pkgs/development/ocaml-modules/ca-certs/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs/default.nix
@@ -1,24 +1,28 @@
 { lib, buildDunePackage, fetchurl
 , bos, fpath, rresult, ptime, mirage-crypto, x509, astring, logs
+, cacert, alcotest
 }:
 
 buildDunePackage rec {
   pname = "ca-certs";
-  version = "0.2.0";
+  version = "0.2.1";
 
   minimumOCamlVersion = "4.07";
 
   src = fetchurl {
     url = "https://github.com/mirage/ca-certs/releases/download/v${version}/ca-certs-v${version}.tbz";
-    sha256 = "15jfb5zvahs90jsfs7ridqihlka5198z2xrvplj8ddchxfmpx868";
+    sha256 = "d43109496a5129feff967d557c556af96f8b10456896a405c43b7cf0c35d0af3";
   };
 
   useDune2 = true;
 
   propagatedBuildInputs = [ bos fpath rresult ptime mirage-crypto x509 astring logs ];
 
-  # tests need access to network and systemwide ca cert chain
-  doCheck = false;
+  doCheck = true;
+  checkInputs = [
+    cacert    # for /etc/ssl/certs/ca-bundle.crt
+    alcotest
+  ];
 
   meta = with lib; {
     description = "Detect root CA certificates from the operating system";
diff --git a/pkgs/development/ocaml-modules/carton/default.nix b/pkgs/development/ocaml-modules/carton/default.nix
index 31b864e29d3..c10537d5d50 100644
--- a/pkgs/development/ocaml-modules/carton/default.nix
+++ b/pkgs/development/ocaml-modules/carton/default.nix
@@ -7,19 +7,19 @@
 
 buildDunePackage rec {
   pname = "carton";
-  version = "0.4.0";
+  version = "0.4.1";
 
   useDune2 = true;
   minimumOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-git/releases/download/${pname}-v${version}/${pname}-${pname}-v${version}.tbz";
-    sha256 = "777f9692b83cd63570c17527a32c5045818ab9242d923cbbde72fc23d0da0140";
+    sha256 = "d16aad5560d9ab1e3b4d93d2e8fdea638c216ff47338fb630a8aefd22b452665";
   };
 
   # remove changelogs for mimic and the git* packages
   postPatch = ''
-    rm CHANGES.md CHANGES.mimic.md
+    rm CHANGES.md
   '';
 
   buildInputs = [
diff --git a/pkgs/development/ocaml-modules/checkseum/default.nix b/pkgs/development/ocaml-modules/checkseum/default.nix
index 81009981047..527afec33eb 100644
--- a/pkgs/development/ocaml-modules/checkseum/default.nix
+++ b/pkgs/development/ocaml-modules/checkseum/default.nix
@@ -1,23 +1,46 @@
-{ lib, fetchurl, buildDunePackage, dune-configurator
+{ lib, fetchurl, buildDunePackage, dune-configurator, pkg-config
 , bigarray-compat, optint
-, fmt, rresult
-, alcotest
+, fmt, rresult, bos, fpath, astring, alcotest
+, withFreestanding ? false
+, ocaml-freestanding
 }:
 
 buildDunePackage rec {
-  version = "0.2.1";
+  version = "0.3.1";
   pname = "checkseum";
 
   useDune2 = true;
 
+  minimumOCamlVersion = "4.07";
+
   src = fetchurl {
     url = "https://github.com/mirage/checkseum/releases/download/v${version}/checkseum-v${version}.tbz";
-    sha256 = "1swb44c64pcs4dh9ka9lig6d398qwwkd3kkiajicww6qk7jbh3n5";
+    sha256 = "b9e4d054e17618b1faed8c0eb15afe0614b2f093e58b59a180bda4500a5d2da1";
   };
 
-  buildInputs = [ dune-configurator fmt rresult ];
-  propagatedBuildInputs = [ bigarray-compat optint ];
-  checkInputs = lib.optionals doCheck [ alcotest ];
+  patches = [
+    ./makefile-no-opam.patch
+  ];
+
+  nativeBuildInputs = [
+    dune-configurator
+    pkg-config
+  ];
+  propagatedBuildInputs = [
+    bigarray-compat
+    optint
+  ] ++ lib.optionals withFreestanding [
+    ocaml-freestanding
+  ];
+
+  checkInputs = [
+    alcotest
+    bos
+    astring
+    fmt
+    fpath
+    rresult
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch b/pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch
new file mode 100644
index 00000000000..49fb41b2e00
--- /dev/null
+++ b/pkgs/development/ocaml-modules/checkseum/makefile-no-opam.patch
@@ -0,0 +1,12 @@
+diff --git a/freestanding/Makefile b/freestanding/Makefile
+index d535050..bb286bd 100644
+--- a/freestanding/Makefile
++++ b/freestanding/Makefile
+@@ -1,4 +1,6 @@
+-PKG_CONFIG_PATH := $(shell opam config var prefix)/lib/pkgconfig
++ifneq (, $(shell command -v opam))
++PKG_CONFIG_PATH ?= $(shell opam var prefix)/lib/pkgconfig
++endif
+ 
+ EXISTS := $(shell PKG_CONFIG_PATH=$(PKG_CONFIG_PATH) pkg-config --exists ocaml-freestanding; echo $$?)
+ 
diff --git a/pkgs/development/ocaml-modules/cohttp/async.nix b/pkgs/development/ocaml-modules/cohttp/async.nix
index 21e22533f1b..060d2c6fb6a 100644
--- a/pkgs/development/ocaml-modules/cohttp/async.nix
+++ b/pkgs/development/ocaml-modules/cohttp/async.nix
@@ -1,22 +1,60 @@
-{ lib, buildDunePackage, async, cohttp, conduit-async, uri, ppx_sexp_conv
-, logs, magic-mime }:
+{ lib
+, buildDunePackage
+, ppx_sexp_conv
+, base
+, async
+, async_kernel
+, async_unix
+, cohttp
+, conduit-async
+, uri
+, uri-sexp
+, logs
+, fmt
+, sexplib0
+, ipaddr
+, magic-mime
+, ounit
+, mirage-crypto
+, core
+}:
 
-if !lib.versionAtLeast cohttp.version "0.99" then
-  cohttp
-else if !lib.versionAtLeast async.version "0.13" then
-  throw "cohttp-async needs async-0.13 (hence OCaml >= 4.08)"
-else
+buildDunePackage {
+  pname = "cohttp-async";
 
-  buildDunePackage {
-    pname = "cohttp-async";
-    useDune2 = true;
-    inherit (cohttp) version src;
+  inherit (cohttp)
+    version
+    src
+    minimumOCamlVersion
+    useDune2
+    ;
 
-    buildInputs = [ ppx_sexp_conv ];
+  buildInputs = [ ppx_sexp_conv ];
 
-    propagatedBuildInputs = [ async cohttp conduit-async logs magic-mime uri ];
+  propagatedBuildInputs = [
+    cohttp
+    conduit-async
+    async_kernel
+    async_unix
+    async
+    base
+    magic-mime
+    logs
+    fmt
+    sexplib0
+    uri
+    uri-sexp
+    ipaddr
+  ];
 
-    meta = cohttp.meta // {
-      description = "CoHTTP implementation for the Async concurrency library";
-    };
-  }
+  doCheck = true;
+  checkInputs = [
+    ounit
+    mirage-crypto
+    core
+  ];
+
+  meta = cohttp.meta // {
+    description = "CoHTTP implementation for the Async concurrency library";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/cohttp/default.nix b/pkgs/development/ocaml-modules/cohttp/default.nix
index 1cbc43bc280..c1dc973d0ee 100644
--- a/pkgs/development/ocaml-modules/cohttp/default.nix
+++ b/pkgs/development/ocaml-modules/cohttp/default.nix
@@ -1,25 +1,24 @@
 { lib, fetchurl, buildDunePackage
-, ppx_fields_conv, ppx_sexp_conv, stdlib-shims
-, base64, fieldslib, jsonm, re, stringext, uri-sexp
+, ppx_sexp_conv, base64, jsonm, re, stringext, uri-sexp
 , ocaml, fmt, alcotest
 }:
 
 buildDunePackage rec {
   pname = "cohttp";
-  version = "2.5.5";
+  version = "4.0.0";
 
   useDune2 = true;
 
-  minimumOCamlVersion = "4.04.1";
+  minimumOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-cohttp/releases/download/v${version}/cohttp-v${version}.tbz";
-    sha256 = "0ywmql4lp6ps2gd064ixbjzsdnnn5vk3pipm005sswl553qqwaim";
+    sha256 = "bd7aa4cd2c82744990ed7c49e3ee7a40324c64cb3d8509804809155e2bacd1d2";
   };
 
-  buildInputs = [ jsonm ppx_fields_conv ppx_sexp_conv ];
+  buildInputs = [ jsonm ppx_sexp_conv ];
 
-  propagatedBuildInputs = [ base64 fieldslib re stringext uri-sexp stdlib-shims ];
+  propagatedBuildInputs = [ base64 re stringext uri-sexp ];
 
   doCheck = lib.versionAtLeast ocaml.version "4.05";
   checkInputs = [ fmt alcotest ];
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix b/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
index 845df2a3f54..57885b0e65e 100644
--- a/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
+++ b/pkgs/development/ocaml-modules/cohttp/lwt-unix.nix
@@ -1,19 +1,28 @@
 { lib, buildDunePackage, cohttp-lwt
-, conduit-lwt-unix, ppx_sexp_conv
-, cmdliner, fmt, magic-mime
+, conduit-lwt-unix, conduit-lwt, ppx_sexp_conv
+, cmdliner, fmt, logs, magic-mime
+, ounit
+, cacert
 }:
 
-if !lib.versionAtLeast cohttp-lwt.version "0.99"
-then cohttp-lwt
-else
-
 buildDunePackage {
   pname = "cohttp-lwt-unix";
-  inherit (cohttp-lwt) version src meta;
+  inherit (cohttp-lwt) version src;
 
   useDune2 = true;
 
   buildInputs = [ cmdliner ppx_sexp_conv ];
 
-  propagatedBuildInputs = [ cohttp-lwt conduit-lwt-unix fmt magic-mime ];
+  propagatedBuildInputs = [
+    cohttp-lwt conduit-lwt conduit-lwt-unix fmt logs magic-mime
+  ];
+
+  # TODO(@sternenseemann): fail for unknown reason
+  # https://github.com/mirage/ocaml-cohttp/issues/675#issuecomment-830692742
+  doCheck = false;
+  checkInputs = [ ounit cacert ];
+
+  meta = cohttp-lwt.meta // {
+    description = "CoHTTP implementation for Unix and Windows using Lwt";
+  };
 }
diff --git a/pkgs/development/ocaml-modules/cohttp/lwt.nix b/pkgs/development/ocaml-modules/cohttp/lwt.nix
index 36831d94613..158aa3b27b2 100644
--- a/pkgs/development/ocaml-modules/cohttp/lwt.nix
+++ b/pkgs/development/ocaml-modules/cohttp/lwt.nix
@@ -1,16 +1,21 @@
-{ lib, buildDunePackage, cohttp, ocaml_lwt, uri, ppx_sexp_conv, logs }:
-
-if !lib.versionAtLeast cohttp.version "0.99"
-then cohttp
-else if !lib.versionAtLeast ppx_sexp_conv.version "0.13"
-then throw "cohttp-lwt is not available for ppx_sexp_conv version ${ppx_sexp_conv.version}"
-else
+{ lib, buildDunePackage, cohttp, ocaml_lwt, uri, ppx_sexp_conv, logs, sexplib0 }:
 
 buildDunePackage {
   pname = "cohttp-lwt";
-  inherit (cohttp) version src useDune2 meta;
+  inherit (cohttp)
+    version
+    src
+    useDune2
+    minimumOCamlVersion
+    ;
 
-  buildInputs = [ uri ppx_sexp_conv ];
+  buildInputs = [ ppx_sexp_conv ];
 
-  propagatedBuildInputs = [ cohttp ocaml_lwt logs ];
+  propagatedBuildInputs = [
+    cohttp ocaml_lwt logs sexplib0 uri
+  ];
+
+  meta = cohttp.meta // {
+    description = "CoHTTP implementation using the Lwt concurrency library";
+  };
 }
diff --git a/pkgs/development/ocaml-modules/cohttp/mirage.nix b/pkgs/development/ocaml-modules/cohttp/mirage.nix
index e7b172349cb..d2d3e945645 100644
--- a/pkgs/development/ocaml-modules/cohttp/mirage.nix
+++ b/pkgs/development/ocaml-modules/cohttp/mirage.nix
@@ -2,6 +2,7 @@
 , mirage-flow, mirage-channel, mirage-kv
 , conduit, conduit-mirage, lwt
 , astring, magic-mime
+, ppx_sexp_conv
 }:
 
 buildDunePackage {
@@ -9,6 +10,8 @@ buildDunePackage {
 
   inherit (cohttp) version src minimumOCamlVersion useDune2;
 
+  nativeBuildInputs = [ ppx_sexp_conv ];
+
   propagatedBuildInputs = [
     mirage-flow mirage-channel conduit conduit-mirage mirage-kv
     lwt cohttp cohttp-lwt astring magic-mime
diff --git a/pkgs/development/ocaml-modules/conduit/async.nix b/pkgs/development/ocaml-modules/conduit/async.nix
index c15ad0520fb..e78cb2bc516 100644
--- a/pkgs/development/ocaml-modules/conduit/async.nix
+++ b/pkgs/development/ocaml-modules/conduit/async.nix
@@ -1,17 +1,17 @@
-{ lib, buildDunePackage, async, async_ssl, ppx_sexp_conv, conduit }:
-
-if !lib.versionAtLeast conduit.version "1.0"
-then conduit
-else
+{ lib, buildDunePackage, async, async_ssl, ppx_sexp_conv, ppx_here, uri, conduit }:
 
 buildDunePackage {
   pname = "conduit-async";
-  useDune2 = true;
-  inherit (conduit) version src;
+  inherit (conduit)
+    version
+    src
+    minimumOCamlVersion
+    useDune2
+    ;
 
-  buildInputs = [ ppx_sexp_conv ];
+  buildInputs = [ ppx_sexp_conv ppx_here ];
 
-  propagatedBuildInputs = [ async async_ssl conduit ];
+  propagatedBuildInputs = [ async async_ssl conduit uri ];
 
   meta = conduit.meta // {
     description = "A network connection establishment library for Async";
diff --git a/pkgs/development/ocaml-modules/conduit/default.nix b/pkgs/development/ocaml-modules/conduit/default.nix
index 8c9b757f87c..96f5bf43d21 100644
--- a/pkgs/development/ocaml-modules/conduit/default.nix
+++ b/pkgs/development/ocaml-modules/conduit/default.nix
@@ -5,18 +5,18 @@
 
 buildDunePackage rec {
   pname = "conduit";
-  version = "2.2.2";
+  version = "4.0.0";
   useDune2 = true;
 
-  minimumOCamlVersion = "4.07";
+  minimumOCamlVersion = "4.03";
 
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-conduit/releases/download/v2.2.2/conduit-v2.2.2.tbz";
-    sha256 = "1zb83w2pq9c8xrappfxa6y5q93772f5dj22x78camsm77a2c2z55";
+    url = "https://github.com/mirage/ocaml-conduit/releases/download/v${version}/conduit-v${version}.tbz";
+    sha256 = "74b29d72bf47adc5d5c4cae6130ad5a2a4923118b9c571331bd1cb3c56decd2a";
   };
 
   buildInputs = [ ppx_sexp_conv ];
-  propagatedBuildInputs = [ astring ipaddr ipaddr-sexp sexplib uri ];
+  propagatedBuildInputs = [ astring ipaddr ipaddr-sexp sexplib uri logs ];
 
   meta = {
     description = "A network connection establishment library";
diff --git a/pkgs/development/ocaml-modules/conduit/lwt-unix.nix b/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
index ab6449b50a1..ce6016012d7 100644
--- a/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
+++ b/pkgs/development/ocaml-modules/conduit/lwt-unix.nix
@@ -1,18 +1,31 @@
 { buildDunePackage
-, conduit-lwt, ppx_sexp_conv, ocaml_lwt, uri, ipaddr, ipaddr-sexp
-, lwt_ssl, tls
+, conduit-lwt, ppx_sexp_conv, ocaml_lwt, uri, ipaddr, ipaddr-sexp, ca-certs, logs
+, lwt_ssl, tls, lwt_log, ssl
 }:
 
 buildDunePackage {
   pname = "conduit-lwt-unix";
-  inherit (conduit-lwt) version src minimumOCamlVersion;
-
-  useDune2 = true;
+  inherit (conduit-lwt) version src minimumOCamlVersion useDune2;
 
   buildInputs = [ ppx_sexp_conv ];
 
-  propagatedBuildInputs =
-    [ conduit-lwt ocaml_lwt uri ipaddr ipaddr-sexp tls lwt_ssl ];
+  propagatedBuildInputs = [
+    conduit-lwt
+    ocaml_lwt
+    uri
+    ipaddr
+    ipaddr-sexp
+    tls
+    ca-certs
+    logs
+    lwt_ssl
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    lwt_log
+    ssl
+  ];
 
   meta = conduit-lwt.meta // {
     description = "A network connection establishment library for Lwt_unix";
diff --git a/pkgs/development/ocaml-modules/conduit/mirage.nix b/pkgs/development/ocaml-modules/conduit/mirage.nix
index 6100908f785..d1f636be93c 100644
--- a/pkgs/development/ocaml-modules/conduit/mirage.nix
+++ b/pkgs/development/ocaml-modules/conduit/mirage.nix
@@ -1,7 +1,8 @@
 { buildDunePackage, conduit-lwt
-, ppx_sexp_conv, sexplib, cstruct, mirage-stack, mirage-flow
+, ppx_sexp_conv, sexplib, uri, cstruct, mirage-stack, mirage-flow
 , mirage-flow-combinators, mirage-random, mirage-time, mirage-clock
 , dns-client, vchan, xenstore, tls, tls-mirage, ipaddr, ipaddr-sexp
+, tcpip, ca-certs-nss
 }:
 
 buildDunePackage {
@@ -12,10 +13,10 @@ buildDunePackage {
   nativeBuildInputs = [ ppx_sexp_conv ];
 
   propagatedBuildInputs = [
-    sexplib cstruct mirage-stack mirage-clock mirage-flow
+    sexplib uri cstruct mirage-stack mirage-clock mirage-flow
     mirage-flow-combinators mirage-random mirage-time
     dns-client conduit-lwt vchan xenstore tls tls-mirage
-    ipaddr ipaddr-sexp
+    ipaddr ipaddr-sexp tcpip ca-certs-nss
   ];
 
   meta = conduit-lwt.meta // {
diff --git a/pkgs/development/ocaml-modules/curly/default.nix b/pkgs/development/ocaml-modules/curly/default.nix
index 1c48b509c41..20197e207af 100644
--- a/pkgs/development/ocaml-modules/curly/default.nix
+++ b/pkgs/development/ocaml-modules/curly/default.nix
@@ -1,5 +1,6 @@
 { stdenv, lib, buildDunePackage, fetchurl, ocaml
-, result, alcotest, cohttp-lwt-unix, odoc, curl }:
+, result, alcotest, cohttp-lwt-unix, odoc, curl, cacert
+}:
 
 buildDunePackage rec {
   pname = "curly";
@@ -15,8 +16,9 @@ buildDunePackage rec {
   };
 
   propagatedBuildInputs = [ result ];
-  checkInputs = [ alcotest cohttp-lwt-unix ];
+  checkInputs = [ alcotest cohttp-lwt-unix cacert ];
   # test dependencies are only available for >= 4.08
+  # https://github.com/mirage/ca-certs/issues/16
   doCheck = lib.versionAtLeast ocaml.version "4.08"
     # Some test fails in macOS sandbox
     # > Fatal error: exception Unix.Unix_error(Unix.EPERM, "bind", "")
diff --git a/pkgs/development/ocaml-modules/decompress/default.nix b/pkgs/development/ocaml-modules/decompress/default.nix
index d2cba68d732..505ffe3c425 100644
--- a/pkgs/development/ocaml-modules/decompress/default.nix
+++ b/pkgs/development/ocaml-modules/decompress/default.nix
@@ -4,7 +4,7 @@
 }:
 
 buildDunePackage rec {
-  version = "1.3.0";
+  version = "1.4.0";
   pname = "decompress";
 
   minimumOCamlVersion = "4.07";
@@ -13,7 +13,7 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/mirage/decompress/releases/download/v${version}/decompress-v${version}.tbz";
-    sha256 = "de149896939be13fedec46a4581121d5ab74850a2241d08e6aa8ae4bb18c52c4";
+    sha256 = "d1669e07446d73dd5e16f020d4a1682abcbb1b7a1e3bf19b805429636c26a19b";
   };
 
   buildInputs = [ cmdliner ];
diff --git a/pkgs/development/ocaml-modules/dns/certify.nix b/pkgs/development/ocaml-modules/dns/certify.nix
index 1835114d707..31b39d18225 100644
--- a/pkgs/development/ocaml-modules/dns/certify.nix
+++ b/pkgs/development/ocaml-modules/dns/certify.nix
@@ -1,6 +1,6 @@
 { buildDunePackage, dns, dns-tsig, dns-mirage, randomconv, x509
 , mirage-random, mirage-time, mirage-clock, mirage-stack
-, logs, mirage-crypto-pk, mirage-crypto-rng, tls, lwt
+, logs, mirage-crypto-pk, mirage-crypto-rng, mirage-crypto-ec, lwt
 }:
 
 buildDunePackage {
@@ -21,7 +21,7 @@ buildDunePackage {
     logs
     mirage-crypto-pk
     mirage-crypto-rng
-    tls
+    mirage-crypto-ec
     lwt
   ];
 
diff --git a/pkgs/development/ocaml-modules/dns/default.nix b/pkgs/development/ocaml-modules/dns/default.nix
index 4f0b95da6cb..8a5115f10f0 100644
--- a/pkgs/development/ocaml-modules/dns/default.nix
+++ b/pkgs/development/ocaml-modules/dns/default.nix
@@ -4,14 +4,14 @@
 
 buildDunePackage rec {
   pname = "dns";
-  version = "4.6.3";
+  version = "5.0.1";
 
   useDune2 = true;
   minimumOCamlVersion = "4.07";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-dns/releases/download/v${version}/dns-v${version}.tbz";
-    sha256 = "0g7xw43jm5hv0w9lsnhhi0w3243mxl615cdsvz29yh39fcqvqsdy";
+    sha256 = "72c0a1a91c8e409bd448c8e0ea28d16d13177c326aea403ee1c30ddcb5969adc";
   };
 
   propagatedBuildInputs = [ rresult astring fmt logs ptime domain-name gmap cstruct ipaddr lru duration metrics ];
diff --git a/pkgs/development/ocaml-modules/git/cohttp-mirage.nix b/pkgs/development/ocaml-modules/git/cohttp-mirage.nix
deleted file mode 100644
index d3088400641..00000000000
--- a/pkgs/development/ocaml-modules/git/cohttp-mirage.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ lib, buildDunePackage
-, git, mimic, cohttp-mirage, cohttp, cohttp-lwt
-, fmt, lwt, result, rresult, uri
-}:
-
-buildDunePackage {
-  pname = "git-cohttp-mirage";
-
-  inherit (git) version src minimumOCamlVersion useDune2;
-
-  propagatedBuildInputs = [
-    git mimic cohttp-mirage cohttp cohttp-lwt fmt lwt result rresult uri
-  ];
-
-  meta = git.meta // {
-    description = "A package to use HTTP-based ocaml-git with MirageOS backend";
-  };
-}
diff --git a/pkgs/development/ocaml-modules/git/default.nix b/pkgs/development/ocaml-modules/git/default.nix
index b8d73178d09..954e4956c81 100644
--- a/pkgs/development/ocaml-modules/git/default.nix
+++ b/pkgs/development/ocaml-modules/git/default.nix
@@ -1,30 +1,35 @@
 { stdenv, lib, fetchurl, buildDunePackage
 , alcotest, mtime, mirage-crypto-rng, tls, git-binary
 , angstrom, astring, cstruct, decompress, digestif, encore, duff, fmt, checkseum
-, fpath, ke, logs, lwt, ocamlgraph, uri, rresult, base64
+, fpath, ke, logs, lwt, ocamlgraph, uri, rresult, base64, hxd
 , result, bigstringaf, optint, mirage-flow, domain-name, emile
 , mimic, carton, carton-lwt, carton-git, ipaddr, psq, crowbar, alcotest-lwt
 }:
 
 buildDunePackage rec {
   pname = "git";
-  version = "3.3.3";
+  version = "3.4.0";
 
   minimumOCamlVersion = "4.08";
   useDune2 = true;
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-git/releases/download/${version}/git-${version}.tbz";
-    sha256 = "0j8pw9w74bfhrjsqr8zm8g7h1az94z9vg7qgc6z6649zm9yjiax3";
+    sha256 = "6eef1240c7c85a8e495b82ef863c509ad41d75e0c45cf73c34ed1bdafd03413f";
   };
 
+  # remove changelog for the carton package
+  postPatch = ''
+    rm CHANGES.carton.md
+  '';
+
   buildInputs = [
     base64
   ];
   propagatedBuildInputs = [
     angstrom astring checkseum cstruct decompress digestif encore duff fmt fpath
     ke logs lwt ocamlgraph uri rresult result bigstringaf optint mirage-flow
-    domain-name emile mimic carton carton-lwt carton-git ipaddr psq
+    domain-name emile mimic carton carton-lwt carton-git ipaddr psq hxd
   ];
   checkInputs = [
     alcotest alcotest-lwt mtime mirage-crypto-rng tls git-binary crowbar
diff --git a/pkgs/development/ocaml-modules/git/paf.nix b/pkgs/development/ocaml-modules/git/paf.nix
new file mode 100644
index 00000000000..cf0272ddf3b
--- /dev/null
+++ b/pkgs/development/ocaml-modules/git/paf.nix
@@ -0,0 +1,49 @@
+{ lib, buildDunePackage
+, git
+, mimic
+, paf
+, ca-certs-nss
+, cohttp
+, cohttp-lwt
+, fmt
+, ipaddr
+, logs
+, lwt
+, mirage-clock
+, mirage-stack
+, mirage-time
+, result
+, rresult
+, tls
+, uri
+}:
+
+buildDunePackage {
+  pname = "git-paf";
+
+  inherit (git) version src minimumOCamlVersion useDune2;
+
+  propagatedBuildInputs = [
+    git
+    mimic
+    paf
+    ca-certs-nss
+    cohttp
+    cohttp-lwt
+    fmt
+    lwt
+    result
+    rresult
+    ipaddr
+    logs
+    mirage-clock
+    mirage-stack
+    mirage-time
+    tls
+    uri
+  ];
+
+  meta = git.meta // {
+    description = "A package to use HTTP-based ocaml-git with MirageOS backend";
+  };
+}
diff --git a/pkgs/development/ocaml-modules/git/unix.nix b/pkgs/development/ocaml-modules/git/unix.nix
index f4cea472886..3e5f464cea0 100644
--- a/pkgs/development/ocaml-modules/git/unix.nix
+++ b/pkgs/development/ocaml-modules/git/unix.nix
@@ -6,7 +6,8 @@
 , tcpip, awa-mirage, mirage-flow
 , alcotest, alcotest-lwt, base64, cstruct
 , ke, mirage-crypto-rng, ocurl, git-binary
-, ptime
+, ptime, mimic, ca-certs-nss, tls, tls-mirage
+, cacert
 }:
 
 buildDunePackage {
@@ -24,10 +25,14 @@ buildDunePackage {
     fmt bos fpath uri digestif logs lwt
     astring cohttp-lwt-unix decompress
     domain-name ipaddr mtime mirage-flow
+    cstruct ptime mimic ca-certs-nss
+    tls tls-mirage
   ];
   checkInputs = [
-    alcotest alcotest-lwt base64 cstruct ke
-    mirage-crypto-rng ocurl git-binary ptime
+    alcotest alcotest-lwt base64 ke
+    mirage-crypto-rng git-binary
+    cohttp-lwt-unix
+    cacert # sets up NIX_SSL_CERT_FILE
   ];
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/irmin/containers.nix b/pkgs/development/ocaml-modules/irmin/containers.nix
index 761e9bf5619..76383099a41 100644
--- a/pkgs/development/ocaml-modules/irmin/containers.nix
+++ b/pkgs/development/ocaml-modules/irmin/containers.nix
@@ -1,6 +1,6 @@
 { buildDunePackage
 , irmin, irmin-unix, irmin-git, ppx_irmin, lwt, mtime
-, alcotest, alcotest-lwt
+, alcotest, alcotest-lwt, cacert
 }:
 
 buildDunePackage {
@@ -18,7 +18,7 @@ buildDunePackage {
 
   doCheck = true;
   checkInputs = [
-    alcotest alcotest-lwt
+    alcotest alcotest-lwt cacert
   ];
 
   meta = ppx_irmin.meta // {
diff --git a/pkgs/development/ocaml-modules/irmin/git.nix b/pkgs/development/ocaml-modules/irmin/git.nix
index a6c1e8af8fa..d477c932928 100644
--- a/pkgs/development/ocaml-modules/irmin/git.nix
+++ b/pkgs/development/ocaml-modules/irmin/git.nix
@@ -1,7 +1,7 @@
 { lib, buildDunePackage
 , git, irmin, irmin-test, ppx_irmin, git-cohttp-unix, git-unix
 , digestif, cstruct, fmt, astring, fpath, logs, lwt, uri
-, mtime, alcotest
+, mtime, alcotest, cacert
 }:
 
 buildDunePackage {
@@ -26,7 +26,7 @@ buildDunePackage {
     uri
   ];
 
-  checkInputs = [ mtime alcotest git-cohttp-unix git-unix irmin-test ];
+  checkInputs = [ mtime alcotest git-cohttp-unix git-unix irmin-test cacert ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/irmin/graphql.nix b/pkgs/development/ocaml-modules/irmin/graphql.nix
index ca205cac4e1..03c8f1eca29 100644
--- a/pkgs/development/ocaml-modules/irmin/graphql.nix
+++ b/pkgs/development/ocaml-modules/irmin/graphql.nix
@@ -1,5 +1,5 @@
 { lib, buildDunePackage, cohttp-lwt, graphql-cohttp, graphql-lwt, irmin
-, alcotest, alcotest-lwt, logs, yojson, cohttp-lwt-unix
+, alcotest, alcotest-lwt, logs, yojson, cohttp-lwt-unix, cacert
 }:
 
 buildDunePackage rec {
@@ -19,6 +19,7 @@ buildDunePackage rec {
     logs
     cohttp-lwt-unix
     yojson
+    cacert
   ];
 
   meta = irmin.meta // {
diff --git a/pkgs/development/ocaml-modules/irmin/http.nix b/pkgs/development/ocaml-modules/irmin/http.nix
index b50e0b87345..7bfae998202 100644
--- a/pkgs/development/ocaml-modules/irmin/http.nix
+++ b/pkgs/development/ocaml-modules/irmin/http.nix
@@ -1,5 +1,6 @@
 { lib, buildDunePackage, cohttp-lwt, irmin, webmachine
 , checkseum, git-unix, irmin-git, irmin-test, digestif, git-cohttp-unix
+, cacert
 }:
 
 buildDunePackage rec {
@@ -12,7 +13,9 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ cohttp-lwt irmin webmachine ];
 
-  checkInputs = [ digestif checkseum git-cohttp-unix git-unix irmin-git irmin-test ];
+  checkInputs = [
+    digestif checkseum git-cohttp-unix git-unix irmin-git irmin-test cacert
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/irmin/mirage-git.nix b/pkgs/development/ocaml-modules/irmin/mirage-git.nix
index dfa84ff2335..e33b766bd4c 100644
--- a/pkgs/development/ocaml-modules/irmin/mirage-git.nix
+++ b/pkgs/development/ocaml-modules/irmin/mirage-git.nix
@@ -1,6 +1,6 @@
 { buildDunePackage, irmin-mirage, irmin-git
 , mirage-kv, cohttp, conduit-lwt, conduit-mirage
-, git-cohttp-mirage, fmt, git, lwt, mirage-clock, uri
+, git-paf, fmt, git, lwt, mirage-clock, uri
 }:
 
 buildDunePackage {
@@ -15,7 +15,7 @@ buildDunePackage {
     cohttp
     conduit-lwt
     conduit-mirage
-    git-cohttp-mirage
+    git-paf
     fmt
     git
     lwt
diff --git a/pkgs/development/ocaml-modules/irmin/ppx.nix b/pkgs/development/ocaml-modules/irmin/ppx.nix
index 7c59e1eaef3..c7eed70d9d9 100644
--- a/pkgs/development/ocaml-modules/irmin/ppx.nix
+++ b/pkgs/development/ocaml-modules/irmin/ppx.nix
@@ -2,11 +2,11 @@
 
 buildDunePackage rec {
   pname = "ppx_irmin";
-  version = "2.5.3";
+  version = "2.6.0";
 
   src = fetchurl {
     url = "https://github.com/mirage/irmin/releases/download/${version}/irmin-${version}.tbz";
-    sha256 = "2c8ef24cc57379c3a138f121fea350ee7b6077abc22a4fdc6a47d0c81585f3f6";
+    sha256 = "1db134221e82c424260a0e206b640fcb82902be35eea4137af2bcd9c98d3ac0f";
   };
 
   minimumOCamlVersion = "4.08";
diff --git a/pkgs/development/ocaml-modules/irmin/unix.nix b/pkgs/development/ocaml-modules/irmin/unix.nix
index a3dfb5d508c..89cf36979bd 100644
--- a/pkgs/development/ocaml-modules/irmin/unix.nix
+++ b/pkgs/development/ocaml-modules/irmin/unix.nix
@@ -1,7 +1,7 @@
 { lib, buildDunePackage
 , checkseum, cmdliner, git-unix, git-cohttp-unix, yaml, fpath
 , irmin, irmin-fs, irmin-git, irmin-graphql, irmin-http
-, irmin-pack, irmin-watcher, irmin-test
+, irmin-pack, irmin-watcher, irmin-test, cacert
 }:
 
 buildDunePackage rec {
@@ -18,7 +18,9 @@ buildDunePackage rec {
     irmin-pack irmin-watcher git-cohttp-unix
   ];
 
-  checkInputs = lib.optional doCheck irmin-test;
+  checkInputs = [
+    irmin-test cacert
+  ];
 
   doCheck = true;
 
diff --git a/pkgs/development/ocaml-modules/letsencrypt/default.nix b/pkgs/development/ocaml-modules/letsencrypt/default.nix
index b3c0d4f8941..0a70bf30242 100644
--- a/pkgs/development/ocaml-modules/letsencrypt/default.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/default.nix
@@ -31,11 +31,11 @@
 
 buildDunePackage rec {
   pname = "letsencrypt";
-  version = "0.2.4";
+  version = "0.2.5";
 
   src = fetchurl {
     url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${version}/letsencrypt-v${version}.tbz";
-    sha256 = "91c79828a50243804da29c17563c54d2d528a79207e5b874dce6a3e7fedf7567";
+    sha256 = "6e3bbb5f593823d49e83e698c06cf9ed48818695ec8318507b311ae74731e607";
   };
 
   minimumOCamlVersion = "4.08";
diff --git a/pkgs/development/ocaml-modules/mimic/default.nix b/pkgs/development/ocaml-modules/mimic/default.nix
index 3ddae57e9e8..ea163642703 100644
--- a/pkgs/development/ocaml-modules/mimic/default.nix
+++ b/pkgs/development/ocaml-modules/mimic/default.nix
@@ -1,27 +1,23 @@
 { lib, buildDunePackage, fetchurl
-, fmt, mirage-flow, result, rresult, cstruct, logs, ke
+, fmt, mirage-flow, result, rresult, cstruct, logs, ke, lwt
 , alcotest, alcotest-lwt, bigstringaf, bigarray-compat
 }:
 
 buildDunePackage rec {
   pname = "mimic";
-  version = "0.0.2";
+  version = "0.0.3";
 
   minimumOCamlVersion = "4.08";
   useDune2 = true;
 
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-git/releases/download/${pname}-v${version}/${pname}-${pname}-v${version}.tbz";
-    sha256 = "3ad5af3caa1120ecfdf022de41ba5be8edfbf50270fc99238b82d3d2d6e7c317";
+    url = "https://github.com/dinosaure/mimic/releases/download/${version}/mimic-${version}.tbz";
+    sha256 = "e4743cd2e4f8242eb1ce9d8086fd2affba0eb6a62131309ffa279108bd3dbbcb";
   };
 
-  # don't install changelogs for other packages
-  postPatch = ''
-    rm -f CHANGES.md CHANGES.carton.md
-  '';
-
   propagatedBuildInputs = [
     fmt
+    lwt
     mirage-flow
     result
     rresult
diff --git a/pkgs/development/ocaml-modules/mirage/runtime.nix b/pkgs/development/ocaml-modules/mirage/runtime.nix
index 50121ad6280..aaa51aa276c 100644
--- a/pkgs/development/ocaml-modules/mirage/runtime.nix
+++ b/pkgs/development/ocaml-modules/mirage/runtime.nix
@@ -3,7 +3,7 @@
 
 buildDunePackage rec {
   pname = "mirage-runtime";
-  version = "3.10.1";
+  version = "3.10.3";
 
   useDune2 = true;
 
@@ -11,7 +11,7 @@ buildDunePackage rec {
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage/releases/download/v${version}/mirage-v${version}.tbz";
-    sha256 = "1glmsz2znhfkk4w6d6nsr7q5jqvivhmi8zwagzw2d8pah0c8bhm4";
+    sha256 = "7c8059ef9e330eaef1ed51c0d89afe17900310f8083a426cd8099602222c2281";
   };
 
   propagatedBuildInputs = [ ipaddr functoria-runtime fmt logs ocaml_lwt ];
diff --git a/pkgs/development/ocaml-modules/optint/default.nix b/pkgs/development/ocaml-modules/optint/default.nix
index 7f8ded5feb6..2227f6e033c 100644
--- a/pkgs/development/ocaml-modules/optint/default.nix
+++ b/pkgs/development/ocaml-modules/optint/default.nix
@@ -1,12 +1,12 @@
 { lib, buildDunePackage, fetchurl }:
 
 buildDunePackage rec {
-  minimumOCamlVersion = "4.03";
-  version = "0.0.4";
+  minimumOCamlVersion = "4.07";
+  version = "0.1.0";
   pname = "optint";
   src = fetchurl {
     url = "https://github.com/mirage/optint/releases/download/v${version}/optint-v${version}.tbz";
-    sha256 = "1a7gabxqmfvii8qnxq1clx43md2h9glskxhac8y8r0rhzblx3s1a";
+    sha256 = "27847660223c16cc7eaf8fcd9d5589a0b802114330a2529578f8007d3b01185d";
   };
 
   useDune2 = true;
diff --git a/pkgs/development/ocaml-modules/paf/default.nix b/pkgs/development/ocaml-modules/paf/default.nix
index 0c91051e243..375ba1c125e 100644
--- a/pkgs/development/ocaml-modules/paf/default.nix
+++ b/pkgs/development/ocaml-modules/paf/default.nix
@@ -5,6 +5,7 @@
 , mirage-stack
 , mirage-time
 , httpaf
+, h2
 , tls-mirage
 , mimic
 , cohttp-lwt
@@ -31,11 +32,11 @@
 
 buildDunePackage rec {
   pname = "paf";
-  version = "0.0.1";
+  version = "0.0.3";
 
   src = fetchurl {
     url = "https://github.com/dinosaure/paf-le-chien/releases/download/${version}/paf-${version}.tbz";
-    sha256 = "7a794c21ce458bda302553b0f5ac128c067579fbb3b7b8fba9b410446c43e790";
+    sha256 = "a0bbb84b19e1f0255337fc4d7017f3ea3611b241746e391b11c1d8b1f5f30a2b";
   };
 
   useDune2 = true;
@@ -45,6 +46,7 @@ buildDunePackage rec {
     mirage-stack
     mirage-time
     httpaf
+    h2
     tls-mirage
     mimic
     cohttp-lwt
diff --git a/pkgs/development/ocaml-modules/tls/default.nix b/pkgs/development/ocaml-modules/tls/default.nix
index 2ee01ed8219..dadeb5a98ea 100644
--- a/pkgs/development/ocaml-modules/tls/default.nix
+++ b/pkgs/development/ocaml-modules/tls/default.nix
@@ -1,17 +1,17 @@
 { lib, fetchurl, buildDunePackage, ppx_sexp_conv, ppx_cstruct, cstruct
 , cstruct-sexp, sexplib, mirage-crypto, mirage-crypto-pk, mirage-crypto-rng
-, x509, domain-name, fmt, cstruct-unix, ounit2, ocaml_lwt, ptime
-, hacl_x25519, fiat-p256, hkdf, logs, alcotest }:
+, x509, domain-name, fmt, cstruct-unix, ounit2, ocaml_lwt, ptime, rresult
+, mirage-crypto-ec, hkdf, logs, alcotest }:
 
 buildDunePackage rec {
   minimumOCamlVersion = "4.08";
 
-  version = "0.12.8";
+  version = "0.13.1";
   pname = "tls";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-v${version}.tbz";
-    sha256 = "0sgppvfnamfnsglw1cl801i1xqkxbs33g40kwmmqj2vqjcarm26a";
+    sha256 = "ca95fa59a82f7d38b0b495fc0cd1ff54e7728492a292895d0067c1ba9de81b7b";
   };
 
   useDune2 = true;
@@ -21,8 +21,8 @@ buildDunePackage rec {
 
   propagatedBuildInputs = [ ppx_sexp_conv ppx_cstruct cstruct cstruct-sexp
                             sexplib mirage-crypto mirage-crypto-pk mirage-crypto-rng
-                            x509 domain-name fmt ocaml_lwt ptime hacl_x25519 fiat-p256
-                            hkdf logs ];
+                            x509 domain-name fmt ocaml_lwt ptime mirage-crypto-ec
+                            hkdf logs rresult ];
 
   meta = with lib; {
     homepage = "https://github.com/mirleft/ocaml-tls";
diff --git a/pkgs/development/ocaml-modules/tls/mirage.nix b/pkgs/development/ocaml-modules/tls/mirage.nix
index ad81c03c35d..18d0f08357d 100644
--- a/pkgs/development/ocaml-modules/tls/mirage.nix
+++ b/pkgs/development/ocaml-modules/tls/mirage.nix
@@ -1,6 +1,6 @@
 { buildDunePackage, tls
 , x509, lwt, fmt, mirage-flow, mirage-kv, mirage-clock, ptime
-, mirage-crypto, mirage-crypto-pk, hacl_x25519, fiat-p256
+, mirage-crypto, mirage-crypto-pk, mirage-crypto-ec
 }:
 
 buildDunePackage {
@@ -19,8 +19,7 @@ buildDunePackage {
     ptime
     mirage-crypto
     mirage-crypto-pk
-    hacl_x25519
-    fiat-p256
+    mirage-crypto-ec
   ];
 
   meta = tls.meta // {
diff --git a/pkgs/development/ocaml-modules/x509/default.nix b/pkgs/development/ocaml-modules/x509/default.nix
index 637105361fd..0ce57b07168 100644
--- a/pkgs/development/ocaml-modules/x509/default.nix
+++ b/pkgs/development/ocaml-modules/x509/default.nix
@@ -8,11 +8,11 @@ buildDunePackage rec {
   minimumOCamlVersion = "4.07";
 
   pname = "x509";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-x509/releases/download/v${version}/x509-v${version}.tbz";
-    sha256 = "04g59j8sn8am0z0a94h8cyvr6cqzd5gkn2lj6g51nb5dkwajj19h";
+    sha256 = "4577c2a616bda45cc777869fc44e272397d63a029135a993df8937bcfd6f6c49";
   };
 
   useDune2 = true;
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 71da1aa5c0a..b6c551158c0 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -82,6 +82,8 @@ let
 
     ca-certs = callPackage ../development/ocaml-modules/ca-certs { };
 
+    ca-certs-nss = callPackage ../development/ocaml-modules/ca-certs-nss { };
+
     carton = callPackage ../development/ocaml-modules/carton { };
 
     carton-git = callPackage ../development/ocaml-modules/carton/git.nix { };
@@ -457,7 +459,7 @@ let
 
     git-cohttp-unix = callPackage ../development/ocaml-modules/git/cohttp-unix.nix { };
 
-    git-cohttp-mirage = callPackage ../development/ocaml-modules/git/cohttp-mirage.nix { };
+    git-paf = callPackage ../development/ocaml-modules/git/paf.nix { };
 
     git-unix = callPackage ../development/ocaml-modules/git/unix.nix {
       git-binary = pkgs.git;