Merge master into staging-next

2021-12-29 06:01:11 +00:00 · 2021-12-29 06:01:11 +00:00 · 129083edcf
parent 3961a789eb 4fd03856a4
commit 129083edcf
75 changed files with 2497 additions and 509 deletions
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -149,6 +149,20 @@
          migration guide</link> for more details.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          For <literal>pkgs.python3.pkgs.ipython</literal>, its direct
+          dependency
+          <literal>pkgs.python3.pkgs.matplotlib-inline</literal> (which
+          is really an adapter to integrate matplotlib in ipython if it
+          is installed) does not depend on
+          <literal>pkgs.python3.pkgs.matplotlib</literal> anymore. This
+          is closer to a non-Nix install of ipython. This has the added
+          benefit to reduce the closure size of
+          <literal>ipython</literal> from ~400MB to ~160MB (including
+          ~100MB for python itself).
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-22.05-notable-changes">
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -53,6 +53,13 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The `autorestic` package has been upgraded from 1.3.0 to 1.5.0 which introduces breaking changes in config file, check [their migration guide](https://autorestic.vercel.app/migration/1.4_1.5) for more details.

+- For `pkgs.python3.pkgs.ipython`, its direct dependency `pkgs.python3.pkgs.matplotlib-inline`
+  (which is really an adapter to integrate matplotlib in ipython if it is installed) does
+  not depend on `pkgs.python3.pkgs.matplotlib` anymore.
+  This is closer to a non-Nix install of ipython.
+  This has the added benefit to reduce the closure size of `ipython` from ~400MB to ~160MB
+  (including ~100MB for python itself).
+
 ## Other Notable Changes {#sec-release-22.05-notable-changes}

 - The option [services.redis.servers](#opt-services.redis.servers) was added
--- a/nixos/lib/make-options-doc/options-to-docbook.xsl
+++ b/nixos/lib/make-options-doc/options-to-docbook.xsl
@ -20,7 +20,7 @@
      <title>Configuration Options</title>
      <variablelist xml:id="configuration-variable-list">
        <xsl:for-each select="attrs">
-          <xsl:variable name="id" select="concat('opt-', str:replace(str:replace(str:replace(attr[@name = 'name']/string/@value, '*', '_'), '&lt;', '_'), '>', '_'))" />
+          <xsl:variable name="id" select="concat('opt-', str:replace(str:replace(str:replace(str:replace(attr[@name = 'name']/string/@value, '*', '_'), '&lt;', '_'), '>', '_'), ':', '_'))" />
          <varlistentry>
            <term xlink:href="#{$id}">
              <xsl:attribute name="xml:id"><xsl:value-of select="$id"/></xsl:attribute>
--- a/nixos/modules/services/misc/sourcehut/default.nix
+++ b/nixos/modules/services/misc/sourcehut/default.nix
--- a/nixos/modules/services/misc/sourcehut/service.nix
+++ b/nixos/modules/services/misc/sourcehut/service.nix
@ -1,66 +1,375 @@
-{ config, pkgs, lib }:
-serviceCfg: serviceDrv: iniKey: attrs:
+srv:
+{ configIniOfService
+, srvsrht ? "${srv}srht" # Because "buildsrht" does not follow that pattern (missing an "s").
+, iniKey ? "${srv}.sr.ht"
+, webhooks ? false
+, extraTimers ? {}
+, mainService ? {}
+, extraServices ? {}
+, extraConfig ? {}
+, port
+}:
+{ config, lib, pkgs, ... }:
+
+with lib;
 let
+  inherit (config.services) postgresql;
+  redis = config.services.redis.servers."sourcehut-${srvsrht}";
+  inherit (config.users) users;
  cfg = config.services.sourcehut;
-  cfgIni = cfg.settings."${iniKey}";
-  pgSuperUser = config.services.postgresql.superUser;
-
-  setupDB = pkgs.writeScript "${serviceDrv.pname}-gen-db" ''
-    #! ${cfg.python}/bin/python
-    from ${serviceDrv.pname}.app import db
-    db.create()
-  '';
+  configIni = configIniOfService srv;
+  srvCfg = cfg.${srv};
+  baseService = serviceName: { allowStripe ? false }: extraService: let
+    runDir = "/run/sourcehut/${serviceName}";
+    rootDir = "/run/sourcehut/chroots/${serviceName}";
+    in
+    mkMerge [ extraService {
+    after = [ "network.target" ] ++
+      optional cfg.postgresql.enable "postgresql.service" ++
+      optional cfg.redis.enable "redis-sourcehut-${srvsrht}.service";
+    requires =
+      optional cfg.postgresql.enable "postgresql.service" ++
+      optional cfg.redis.enable "redis-sourcehut-${srvsrht}.service";
+    path = [ pkgs.gawk ];
+    environment.HOME = runDir;
+    serviceConfig = {
+      User = mkDefault srvCfg.user;
+      Group = mkDefault srvCfg.group;
+      RuntimeDirectory = [
+        "sourcehut/${serviceName}"
+        # Used by *srht-keys which reads ../config.ini
+        "sourcehut/${serviceName}/subdir"
+        "sourcehut/chroots/${serviceName}"
+      ];
+      RuntimeDirectoryMode = "2750";
+      # No need for the chroot path once inside the chroot
+      InaccessiblePaths = [ "-+${rootDir}" ];
+      # g+rx is for group members (eg. fcgiwrap or nginx)
+      # to read Git/Mercurial repositories, buildlogs, etc.
+      # o+x is for intermediate directories created by BindPaths= and like,
+      # as they're owned by root:root.
+      UMask = "0026";
+      RootDirectory = rootDir;
+      RootDirectoryStartOnly = true;
+      PrivateTmp = true;
+      MountAPIVFS = true;
+      # config.ini is looked up in there, before /etc/srht/config.ini
+      # Note that it fails to be set in ExecStartPre=
+      WorkingDirectory = mkDefault ("-"+runDir);
+      BindReadOnlyPaths = [
+        builtins.storeDir
+        "/etc"
+        "/run/booted-system"
+        "/run/current-system"
+        "/run/systemd"
+        ] ++
+        optional cfg.postgresql.enable "/run/postgresql" ++
+        optional cfg.redis.enable "/run/redis-sourcehut-${srvsrht}";
+      # LoadCredential= are unfortunately not available in ExecStartPre=
+      # Hence this one is run as root (the +) with RootDirectoryStartOnly=
+      # to reach credentials wherever they are.
+      # Note that each systemd service gets its own ${runDir}/config.ini file.
+      ExecStartPre = mkBefore [("+"+pkgs.writeShellScript "${serviceName}-credentials" ''
+        set -x
+        # Replace values begining with a '<' by the content of the file whose name is after.
+        gawk '{ if (match($0,/^([^=]+=)<(.+)/,m)) { getline f < m[2]; print m[1] f } else print $0 }' ${configIni} |
+        ${optionalString (!allowStripe) "gawk '!/^stripe-secret-key=/' |"}
+        install -o ${srvCfg.user} -g root -m 400 /dev/stdin ${runDir}/config.ini
+      '')];
+      # The following options are only for optimizing:
+      # systemd-analyze security
+      AmbientCapabilities = "";
+      CapabilityBoundingSet = "";
+      # ProtectClock= adds DeviceAllow=char-rtc r
+      DeviceAllow = "";
+      LockPersonality = true;
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      PrivateDevices = true;
+      PrivateMounts = true;
+      PrivateNetwork = mkDefault false;
+      PrivateUsers = true;
+      ProcSubset = "pid";
+      ProtectClock = true;
+      ProtectControlGroups = true;
+      ProtectHome = true;
+      ProtectHostname = true;
+      ProtectKernelLogs = true;
+      ProtectKernelModules = true;
+      ProtectKernelTunables = true;
+      ProtectProc = "invisible";
+      ProtectSystem = "strict";
+      RemoveIPC = true;
+      RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      RestrictSUIDSGID = true;
+      #SocketBindAllow = [ "tcp:${toString srvCfg.port}" "tcp:${toString srvCfg.prometheusPort}" ];
+      #SocketBindDeny = "any";
+      SystemCallFilter = [
+        "@system-service"
+        "~@aio" "~@keyring" "~@memlock" "~@privileged" "~@resources" "~@timer"
+        "@chown" "@setuid"
+      ];
+      SystemCallArchitectures = "native";
+    };
+  } ];
 in
-with serviceCfg; with lib; recursiveUpdate
 {
-  environment.HOME = statePath;
-  path = [ config.services.postgresql.package ] ++ (attrs.path or [ ]);
-  restartTriggers = [ config.environment.etc."sr.ht/config.ini".source ];
-  serviceConfig = {
-    Type = "simple";
-    User = user;
-    Group = user;
-    Restart = "always";
-    WorkingDirectory = statePath;
-  } // (if (cfg.statePath == "/var/lib/sourcehut/${serviceDrv.pname}") then {
-          StateDirectory = [ "sourcehut/${serviceDrv.pname}" ];
-        } else {})
-  ;
+  options.services.sourcehut.${srv} = {
+    enable = mkEnableOption "${srv} service";

-  preStart = ''
-    if ! test -e ${statePath}/db; then
-      # Setup the initial database
-      ${setupDB}
+    user = mkOption {
+      type = types.str;
+      default = srvsrht;
+      description = ''
+        User for ${srv}.sr.ht.
+      '';
+    };

-      # Set the initial state of the database for future database upgrades
-      if test -e ${cfg.python}/bin/${serviceDrv.pname}-migrate; then
-        # Run alembic stamp head once to tell alembic the schema is up-to-date
-        ${cfg.python}/bin/${serviceDrv.pname}-migrate stamp head
-      fi
+    group = mkOption {
+      type = types.str;
+      default = srvsrht;
+      description = ''
+        Group for ${srv}.sr.ht.
+        Membership grants access to the Git/Mercurial repositories by default,
+        but not to the config.ini file (where secrets are).
+      '';
+    };

-      printf "%s" "${serviceDrv.version}" > ${statePath}/db
-    fi
+    port = mkOption {
+      type = types.port;
+      default = port;
+      description = ''
+        Port on which the "${srv}" backend should listen.
+      '';
+    };

-    # Update copy of each users' profile to the latest
-    # See https://lists.sr.ht/~sircmpwn/sr.ht-admins/<20190302181207.GA13778%40cirno.my.domain>
-    if ! test -e ${statePath}/webhook; then
-      # Update ${iniKey}'s users' profile copy to the latest
-      ${cfg.python}/bin/srht-update-profiles ${iniKey}
+    redis = {
+      host = mkOption {
+        type = types.str;
+        default = "unix:/run/redis-sourcehut-${srvsrht}/redis.sock?db=0";
+        example = "redis://shared.wireguard:6379/0";
+        description = ''
+          The redis host URL. This is used for caching and temporary storage, and must
+          be shared between nodes (e.g. git1.sr.ht and git2.sr.ht), but need not be
+          shared between services. It may be shared between services, however, with no
+          ill effect, if this better suits your infrastructure.
+        '';
+      };
+    };

-      touch ${statePath}/webhook
-    fi
+    postgresql = {
+      database = mkOption {
+        type = types.str;
+        default = "${srv}.sr.ht";
+        description = ''
+          PostgreSQL database name for the ${srv}.sr.ht service,
+          used if <xref linkend="opt-services.sourcehut.postgresql.enable"/> is <literal>true</literal>.
+        '';
+      };
+    };

-    ${optionalString (builtins.hasAttr "migrate-on-upgrade" cfgIni && cfgIni.migrate-on-upgrade == "yes") ''
-      if [ "$(cat ${statePath}/db)" != "${serviceDrv.version}" ]; then
-        # Manage schema migrations using alembic
-        ${cfg.python}/bin/${serviceDrv.pname}-migrate -a upgrade head
+    gunicorn = {
+      extraArgs = mkOption {
+        type = with types; listOf str;
+        default = ["--timeout 120" "--workers 1" "--log-level=info"];
+        description = "Extra arguments passed to Gunicorn.";
+      };
+    };
+  } // optionalAttrs webhooks {
+    webhooks = {
+      extraArgs = mkOption {
+        type = with types; listOf str;
+        default = ["--loglevel DEBUG" "--pool eventlet" "--without-heartbeat"];
+        description = "Extra arguments passed to the Celery responsible for webhooks.";
+      };
+      celeryConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = "Content of the <literal>celeryconfig.py</literal> used by the Celery responsible for webhooks.";
+      };
+    };
+  };

-        # Mark down current package version
-        printf "%s" "${serviceDrv.version}" > ${statePath}/db
-      fi
-    ''}
+  config = lib.mkIf (cfg.enable && srvCfg.enable) (mkMerge [ extraConfig {
+    users = {
+      users = {
+        "${srvCfg.user}" = {
+          isSystemUser = true;
+          group = mkDefault srvCfg.group;
+          description = mkDefault "sourcehut user for ${srv}.sr.ht";
+        };
+      };
+      groups = {
+        "${srvCfg.group}" = { };
+      } // optionalAttrs (cfg.postgresql.enable
+        && hasSuffix "0" (postgresql.settings.unix_socket_permissions or "")) {
+        "postgres".members = [ srvCfg.user ];
+      } // optionalAttrs (cfg.redis.enable
+        && hasSuffix "0" (redis.settings.unixsocketperm or "")) {
+        "redis-sourcehut-${srvsrht}".members = [ srvCfg.user ];
+      };
+    };

-    ${attrs.preStart or ""}
-  '';
+    services.nginx = mkIf cfg.nginx.enable {
+      virtualHosts."${srv}.${cfg.settings."sr.ht".global-domain}" = mkMerge [ {
+        forceSSL = mkDefault true;
+        locations."/".proxyPass = "http://${cfg.listenAddress}:${toString srvCfg.port}";
+        locations."/static" = {
+          root = "${pkgs.sourcehut.${srvsrht}}/${pkgs.sourcehut.python.sitePackages}/${srvsrht}";
+          extraConfig = mkDefault ''
+            expires 30d;
+          '';
+        };
+      } cfg.nginx.virtualHost ];
+    };
+
+    services.postgresql = mkIf cfg.postgresql.enable {
+      authentication = ''
+        local ${srvCfg.postgresql.database} ${srvCfg.user} trust
+      '';
+      ensureDatabases = [ srvCfg.postgresql.database ];
+      ensureUsers = map (name: {
+          inherit name;
+          ensurePermissions = { "DATABASE \"${srvCfg.postgresql.database}\"" = "ALL PRIVILEGES"; };
+        }) [srvCfg.user];
+    };
+
+    services.sourcehut.services = mkDefault (filter (s: cfg.${s}.enable)
+      [ "builds" "dispatch" "git" "hg" "hub" "lists" "man" "meta" "pages" "paste" "todo" ]);
+
+    services.sourcehut.settings = mkMerge [
+      {
+        "${srv}.sr.ht".origin = mkDefault "https://${srv}.${cfg.settings."sr.ht".global-domain}";
+      }
+
+      (mkIf cfg.postgresql.enable {
+        "${srv}.sr.ht".connection-string = mkDefault "postgresql:///${srvCfg.postgresql.database}?user=${srvCfg.user}&host=/run/postgresql";
+      })
+    ];
+
+    services.redis.servers."sourcehut-${srvsrht}" = mkIf cfg.redis.enable {
+      enable = true;
+      databases = 3;
+      syslog = true;
+      # TODO: set a more informed value
+      save = mkDefault [ [1800 10] [300 100] ];
+      settings = {
+        # TODO: set a more informed value
+        maxmemory = "128MB";
+        maxmemory-policy = "volatile-ttl";
+      };
+    };
+
+    systemd.services = mkMerge [
+      {
+        "${srvsrht}" = baseService srvsrht { allowStripe = srv == "meta"; } (mkMerge [
+        {
+          description = "sourcehut ${srv}.sr.ht website service";
+          before = optional cfg.nginx.enable "nginx.service";
+          wants = optional cfg.nginx.enable "nginx.service";
+          wantedBy = [ "multi-user.target" ];
+          path = optional cfg.postgresql.enable postgresql.package;
+          # Beware: change in credentials' content will not trigger restart.
+          restartTriggers = [ configIni ];
+          serviceConfig = {
+            Type = "simple";
+            Restart = mkDefault "always";
+            #RestartSec = mkDefault "2min";
+            StateDirectory = [ "sourcehut/${srvsrht}" ];
+            StateDirectoryMode = "2750";
+            ExecStart = "${cfg.python}/bin/gunicorn ${srvsrht}.app:app --name ${srvsrht} --bind ${cfg.listenAddress}:${toString srvCfg.port} " + concatStringsSep " " srvCfg.gunicorn.extraArgs;
+          };
+          preStart = let
+            version = pkgs.sourcehut.${srvsrht}.version;
+            stateDir = "/var/lib/sourcehut/${srvsrht}";
+            in mkBefore ''
+            set -x
+            # Use the /run/sourcehut/${srvsrht}/config.ini
+            # installed by a previous ExecStartPre= in baseService
+            cd /run/sourcehut/${srvsrht}
+
+            if test ! -e ${stateDir}/db; then
+              # Setup the initial database.
+              # Note that it stamps the alembic head afterward
+              ${cfg.python}/bin/${srvsrht}-initdb
+              echo ${version} >${stateDir}/db
+            fi
+
+            ${optionalString cfg.settings.${iniKey}.migrate-on-upgrade ''
+              if [ "$(cat ${stateDir}/db)" != "${version}" ]; then
+                # Manage schema migrations using alembic
+                ${cfg.python}/bin/${srvsrht}-migrate -a upgrade head
+                echo ${version} >${stateDir}/db
+              fi
+            ''}
+
+            # Update copy of each users' profile to the latest
+            # See https://lists.sr.ht/~sircmpwn/sr.ht-admins/<20190302181207.GA13778%40cirno.my.domain>
+            if test ! -e ${stateDir}/webhook; then
+              # Update ${iniKey}'s users' profile copy to the latest
+              ${cfg.python}/bin/srht-update-profiles ${iniKey}
+              touch ${stateDir}/webhook
+            fi
+          '';
+        } mainService ]);
+      }
+
+      (mkIf webhooks {
+        "${srvsrht}-webhooks" = baseService "${srvsrht}-webhooks" {}
+          {
+            description = "sourcehut ${srv}.sr.ht webhooks service";
+            after = [ "${srvsrht}.service" ];
+            wantedBy = [ "${srvsrht}.service" ];
+            partOf = [ "${srvsrht}.service" ];
+            preStart = ''
+              cp ${pkgs.writeText "${srvsrht}-webhooks-celeryconfig.py" srvCfg.webhooks.celeryConfig} \
+                 /run/sourcehut/${srvsrht}-webhooks/celeryconfig.py
+            '';
+            serviceConfig = {
+              Type = "simple";
+              Restart = "always";
+              ExecStart = "${cfg.python}/bin/celery --app ${srvsrht}.webhooks worker --hostname ${srvsrht}-webhooks@%%h " + concatStringsSep " " srvCfg.webhooks.extraArgs;
+              # Avoid crashing: os.getloadavg()
+              ProcSubset = mkForce "all";
+            };
+          };
+      })
+
+      (mapAttrs (timerName: timer: (baseService timerName {} (mkMerge [
+        {
+          description = "sourcehut ${timerName} service";
+          after = [ "network.target" "${srvsrht}.service" ];
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${cfg.python}/bin/${timerName}";
+          };
+        }
+        (timer.service or {})
+      ]))) extraTimers)
+
+      (mapAttrs (serviceName: extraService: baseService serviceName {} (mkMerge [
+        {
+          description = "sourcehut ${serviceName} service";
+          # So that extraServices have the PostgreSQL database initialized.
+          after = [ "${srvsrht}.service" ];
+          wantedBy = [ "${srvsrht}.service" ];
+          partOf = [ "${srvsrht}.service" ];
+          serviceConfig = {
+            Type = "simple";
+            Restart = mkDefault "always";
+          };
+        }
+        extraService
+      ])) extraServices)
+    ];
+
+    systemd.timers = mapAttrs (timerName: timer:
+      {
+        description = "sourcehut timer for ${timerName}";
+        wantedBy = [ "timers.target" ];
+        inherit (timer) timerConfig;
+      }) extraTimers;
+  } ]);
 }
-  (builtins.removeAttrs attrs [ "path" "preStart" ])
--- a/nixos/modules/services/misc/sourcehut/sourcehut.xml
+++ b/nixos/modules/services/misc/sourcehut/sourcehut.xml
@ -14,13 +14,12 @@
  <title>Basic usage</title>
  <para>
   Sourcehut is a Python and Go based set of applications.
-   <literal><link linkend="opt-services.sourcehut.enable">services.sourcehut</link></literal>
-   by default will use
+   This NixOS module also provides basic configuration integrating Sourcehut into locally running
   <literal><link linkend="opt-services.nginx.enable">services.nginx</link></literal>,
-   <literal><link linkend="opt-services.nginx.enable">services.redis</link></literal>,
-   <literal><link linkend="opt-services.nginx.enable">services.cron</link></literal>,
+   <literal><link linkend="opt-services.redis.servers">services.redis.servers.sourcehut</link></literal>,
+   <literal><link linkend="opt-services.postfix.enable">services.postfix</link></literal>
   and
-   <literal><link linkend="opt-services.postgresql.enable">services.postgresql</link></literal>.
+   <literal><link linkend="opt-services.postgresql.enable">services.postgresql</link></literal> services.
  </para>

  <para>
@ -42,18 +41,23 @@ in {

  services.sourcehut = {
    <link linkend="opt-services.sourcehut.enable">enable</link> = true;
-    <link linkend="opt-services.sourcehut.originBase">originBase</link> = fqdn;
-    <link linkend="opt-services.sourcehut.services">services</link> = [ "meta" "man" "git" ];
+    <link linkend="opt-services.sourcehut.git.enable">git.enable</link> = true;
+    <link linkend="opt-services.sourcehut.man.enable">man.enable</link> = true;
+    <link linkend="opt-services.sourcehut.meta.enable">meta.enable</link> = true;
+    <link linkend="opt-services.sourcehut.nginx.enable">nginx.enable</link> = true;
+    <link linkend="opt-services.sourcehut.postfix.enable">postfix.enable</link> = true;
+    <link linkend="opt-services.sourcehut.postgresql.enable">postgresql.enable</link> = true;
+    <link linkend="opt-services.sourcehut.redis.enable">redis.enable</link> = true;
    <link linkend="opt-services.sourcehut.settings">settings</link> = {
        "sr.ht" = {
          environment = "production";
          global-domain = fqdn;
          origin = "https://${fqdn}";
          # Produce keys with srht-keygen from <package>sourcehut.coresrht</package>.
-          network-key = "SECRET";
-          service-key = "SECRET";
+          network-key = "/run/keys/path/to/network-key";
+          service-key = "/run/keys/path/to/service-key";
        };
-        webhooks.private-key= "SECRET";
+        webhooks.private-key= "/run/keys/path/to/webhook-key";
    };
  };

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -436,6 +436,7 @@ in
  solanum = handleTest ./solanum.nix {};
  solr = handleTest ./solr.nix {};
  sonarr = handleTest ./sonarr.nix {};
+  sourcehut = handleTest ./sourcehut.nix {};
  spacecookie = handleTest ./spacecookie.nix {};
  spark = handleTestOn ["x86_64-linux"] ./spark {};
  sslh = handleTest ./sslh.nix {};
--- a/nixos/tests/sourcehut.nix
+++ b/nixos/tests/sourcehut.nix
@ -1,29 +1,197 @@
-import ./make-test-python.nix ({ pkgs, ... }:
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+let
+  domain = "sourcehut.localdomain";

+  # Note that wildcard certificates just under the TLD (eg. *.com)
+  # would be rejected by clients like curl.
+  tls-cert = pkgs.runCommand "selfSignedCerts" { buildInputs = [ pkgs.openssl ]; } ''
+    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -days 36500 \
+      -subj '/CN=${domain}' -extensions v3_req \
+      -addext 'subjectAltName = DNS:*.${domain}'
+    install -D -t $out key.pem cert.pem
+  '';
+
+  images = {
+    nixos.unstable.x86_64 =
+      let
+        systemConfig = { pkgs, ... }: {
+          # passwordless ssh server
+          services.openssh = {
+            enable = true;
+            permitRootLogin = "yes";
+            extraConfig = "PermitEmptyPasswords yes";
+          };
+
+          users = {
+            mutableUsers = false;
+            # build user
+            extraUsers."build" = {
+              isNormalUser = true;
+              uid = 1000;
+              extraGroups = [ "wheel" ];
+              password = "";
+            };
+            users.root.password = "";
+          };
+
+          security.sudo.wheelNeedsPassword = false;
+          nix.trustedUsers = [ "root" "build" ];
+          documentation.nixos.enable = false;
+
+          # builds.sr.ht-image-specific network settings
+          networking = {
+            hostName = "build";
+            dhcpcd.enable = false;
+            defaultGateway.address = "10.0.2.2";
+            usePredictableInterfaceNames = false;
+            interfaces."eth0".ipv4.addresses = [{
+              address = "10.0.2.15";
+              prefixLength = 25;
+            }];
+            enableIPv6 = false;
+            nameservers = [
+              # OpenNIC anycast
+              "185.121.177.177"
+              "169.239.202.202"
+              # Google
+              "8.8.8.8"
+            ];
+            firewall.allowedTCPPorts = [ 22 ];
+          };
+
+          environment.systemPackages = [
+            pkgs.gitMinimal
+            #pkgs.mercurial
+            pkgs.curl
+            pkgs.gnupg
+          ];
+        };
+        qemuConfig = { pkgs, ... }: {
+          imports = [ systemConfig ];
+          fileSystems."/".device = "/dev/disk/by-label/nixos";
+          boot.initrd.availableKernelModules = [
+            "ahci"
+            "ehci_pci"
+            "sd_mod"
+            "usb_storage"
+            "usbhid"
+            "virtio_balloon"
+            "virtio_blk"
+            "virtio_pci"
+            "virtio_ring"
+            "xhci_pci"
+          ];
+          boot.loader = {
+            grub = {
+              version = 2;
+              device = "/dev/vda";
+            };
+            timeout = 0;
+          };
+        };
+        config = (import (pkgs.path + "/nixos/lib/eval-config.nix") {
+          inherit pkgs; modules = [ qemuConfig ];
+          system = "x86_64-linux";
+        }).config;
+      in
+      import (pkgs.path + "/nixos/lib/make-disk-image.nix") {
+        inherit pkgs lib config;
+        diskSize = 16000;
+        format = "qcow2-compressed";
+        contents = [
+          { source = pkgs.writeText "gitconfig" ''
+              [user]
+                name = builds.sr.ht
+                email = build@sr.ht
+            '';
+            target = "/home/build/.gitconfig";
+            user = "build";
+            group = "users";
+            mode = "644";
+          }
+        ];
+      };
+  };
+
+in
 {
  name = "sourcehut";

  meta.maintainers = [ pkgs.lib.maintainers.tomberek ];

-  machine = { config, pkgs, ... }: {
-    virtualisation.memorySize = 2048;
-    networking.firewall.allowedTCPPorts = [ 80 ];
+  machine = { config, pkgs, nodes, ... }: {
+    # buildsrht needs space
+    virtualisation.diskSize = 4 * 1024;
+    virtualisation.memorySize = 2 * 1024;
+    networking.domain = domain;
+    networking.extraHosts = ''
+      ${config.networking.primaryIPAddress} meta.${domain}
+      ${config.networking.primaryIPAddress} builds.${domain}
+    '';

    services.sourcehut = {
      enable = true;
-      services = [ "meta" ];
-      originBase = "sourcehut";
-      settings."sr.ht".service-key =   "8888888888888888888888888888888888888888888888888888888888888888";
-      settings."sr.ht".network-key = "0000000000000000000000000000000000000000000=";
-      settings.webhooks.private-key = "0000000000000000000000000000000000000000000=";
+      services = [ "meta" "builds" ];
+      nginx.enable = true;
+      nginx.virtualHost = {
+        forceSSL = true;
+        sslCertificate = "${tls-cert}/cert.pem";
+        sslCertificateKey = "${tls-cert}/key.pem";
+      };
+      postgresql.enable = true;
+      redis.enable = true;
+
+      meta.enable = true;
+      builds = {
+        enable = true;
+        # FIXME: see why it does not seem to activate fully.
+        #enableWorker = true;
+        inherit images;
+      };
+      settings."sr.ht" = {
+        global-domain = config.networking.domain;
+        service-key = pkgs.writeText "service-key" "8b327279b77e32a3620e2fc9aabce491cc46e7d821fd6713b2a2e650ce114d01";
+        network-key = pkgs.writeText "network-key" "cEEmc30BRBGkgQZcHFksiG7hjc6_dK1XR2Oo5Jb9_nQ=";
+      };
+      settings."builds.sr.ht" = {
+        oauth-client-secret = pkgs.writeText "buildsrht-oauth-client-secret" "2260e9c4d9b8dcedcef642860e0504bc";
+        oauth-client-id = "299db9f9c2013170";
+      };
+      settings.webhooks.private-key = pkgs.writeText "webhook-key" "Ra3IjxgFiwG9jxgp4WALQIZw/BMYt30xWiOsqD0J7EA=";
+    };
+
+    networking.firewall.allowedTCPPorts = [ 443 ];
+    security.pki.certificateFiles = [ "${tls-cert}/cert.pem" ];
+    services.nginx = {
+      enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedTlsSettings = true;
+      recommendedProxySettings = true;
+    };
+
+    services.postgresql = {
+      enable = true;
+      enableTCPIP = false;
+      settings.unix_socket_permissions = "0770";
    };
  };

  testScript = ''
    start_all()
    machine.wait_for_unit("multi-user.target")
+
+    # Testing metasrht
+    machine.wait_for_unit("metasrht-api.service")
    machine.wait_for_unit("metasrht.service")
    machine.wait_for_open_port(5000)
-    machine.succeed("curl -sL http://localhost:5000 | grep meta.sourcehut")
+    machine.succeed("curl -sL http://localhost:5000 | grep meta.${domain}")
+    machine.succeed("curl -sL http://meta.${domain} | grep meta.${domain}")
+
+    # Testing buildsrht
+    machine.wait_for_unit("buildsrht.service")
+    machine.wait_for_open_port(5002)
+    machine.succeed("curl -sL http://localhost:5002 | grep builds.${domain}")
+    #machine.wait_for_unit("buildsrht-worker.service")
  '';
 })
--- a/pkgs/applications/audio/sfizz/default.nix
+++ b/pkgs/applications/audio/sfizz/default.nix
@ -1,18 +1,16 @@
-{ lib, stdenv, fetchFromGitHub
-, libjack2, libsndfile, xorg, freetype, libxkbcommon
-, cairo, glib, gnome, flac, libogg, libvorbis, libopus
-, cmake, pkg-config
-}:
+{ lib, stdenv, fetchFromGitHub, libjack2, libsndfile, xorg, freetype
+, libxkbcommon, cairo, glib, gnome, flac, libogg, libvorbis, libopus, cmake
+, pango, pkg-config }:

 stdenv.mkDerivation rec {
  pname = "sfizz";
-  version = "0.5.1";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "sfztools";
    repo = pname;
    rev = version;
-    sha256 = "sha256-3RdY5+BPsdk6vctDy24w5aJsVOV9qzSgXs62Pm5UEKs=";
+    sha256 = "1gzpbns89j6ggzfjjvyhgigynsv20synrs7lmc32hwp4g73l0j7n";
    fetchSubmodules = true;
  };

@ -37,18 +35,18 @@ stdenv.mkDerivation rec {
    glib
    gnome.zenity
    freetype
+    pango
  ];
  nativeBuildInputs = [ cmake pkg-config ];

  postPatch = ''
-  substituteInPlace editor/external/vstgui4/vstgui/lib/platform/linux/x11fileselector.cpp \
-    --replace '"/usr/bin/zenity' '"${gnome.zenity}/bin/zenity'
+    substituteInPlace plugins/editor/external/vstgui4/vstgui/lib/platform/linux/x11fileselector.cpp \
+      --replace 'zenitypath = "zenity"' 'zenitypath = "${gnome.zenity}/bin/zenity"'
+    substituteInPlace plugins/editor/src/editor/NativeHelpers.cpp \
+      --replace '/usr/bin/zenity' '${gnome.zenity}/bin/zenity'
  '';

-  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=Release"
-    "-DSFIZZ_TESTS=ON"
-  ];
+  cmakeFlags = [ "-DCMAKE_BUILD_TYPE=Release" "-DSFIZZ_TESTS=ON" ];

  meta = with lib; {
    homepage = "https://github.com/sfztools/sfizz";
--- a/pkgs/applications/kde/kalzium.nix
+++ b/pkgs/applications/kde/kalzium.nix
@ -3,7 +3,7 @@
 mkDerivation {
  pname = "kalzium";
  meta = with lib; {
-    homepage = "https://kde.org/applications/en/utilities/org.kde.kalzium";
+    homepage = "https://edu.kde.org/kalzium/";
    description = "Program that shows you the Periodic Table of Elements";
    maintainers = with maintainers; [ freezeboy ];
    license = licenses.gpl2Plus;
--- a/pkgs/applications/kde/kipi-plugins.nix
+++ b/pkgs/applications/kde/kipi-plugins.nix
@ -17,7 +17,7 @@ mkDerivation {
  meta = {
    description = "Plugins for KDE-based image applications";
    license = lib.licenses.gpl2;
-    homepage = "https://cgit.kde.org/kipi-plugins.git";
+    homepage = "https://github.com/KDE/kipi-plugins";
    maintainers = with lib.maintainers; [ ttuegel ];
  };
 }
--- a/pkgs/applications/misc/inherd-quake/default.nix
+++ b/pkgs/applications/misc/inherd-quake/default.nix
@ -9,17 +9,17 @@
 }:

 rustPlatform.buildRustPackage rec {
-  pname = "quake";
+  pname = "inherd-quake";
  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "phodal";
-    repo = pname;
+    repo = "quake";
    rev = "v${version}";
    sha256 = "1f7k68g18g3dpnrsmhgmz753bly1i3f4lmsljiyp9ap0c6w8ahgg";
  };

-  cargoSha256 = "1yqj9rq770j116138bqn4ycggy13vvym1cz50myfddb9rjjzafrl";
+  cargoSha256 = "17q9sjypa331gdfvmx1kbcbvnj34rnsf37b9rnji4jrqfysgrs5w";

  nativeBuildInputs = [ pkg-config ];

@ -35,5 +35,6 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/phodal/quake";
    license = licenses.mit;
    maintainers = [ maintainers.elliot ];
+    mainProgram = "quake";
  };
 }
--- a/pkgs/applications/misc/marktext/default.nix
+++ b/pkgs/applications/misc/marktext/default.nix
@ -50,5 +50,6 @@ appimageTools.wrapType2 rec {
    license = licenses.mit;
    maintainers = with maintainers; [ nh2 ];
    platforms = [ "x86_64-linux" ];
+    mainProgram = "marktext";
  };
 }
--- a/pkgs/applications/misc/metadata-cleaner/default.nix
+++ b/pkgs/applications/misc/metadata-cleaner/default.nix
@ -9,7 +9,7 @@
 , itstool
 , libadwaita
 , librsvg
-, meson
+, meson_0_60
 , ninja
 , pkg-config
 , poppler_gi
@ -18,7 +18,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "metadata-cleaner";
-  version = "2.0.1";
+  version = "2.1.3";

  format = "other";

@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "rmnvgr";
    repo = "metadata-cleaner";
    rev = "v${version}";
-    sha256 = "sha256-iTKs3DEZSzqRARXJKPPygvCS5JNUMbQBkfjacwd168Y=";
+    hash = "sha256-9sLjgqqQBXcudlBRmqAwWcWMUXoIUyAK272zaNKbJNY=";
  };

  nativeBuildInputs = [
@ -35,7 +35,7 @@ python3.pkgs.buildPythonApplication rec {
    glib
    gtk4
    itstool
-    meson
+    meson_0_60
    ninja
    pkg-config
    wrapGAppsHook
--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@ -46,7 +46,7 @@ let

      meta = {
        description      = "Apache Spark is a fast and general engine for large-scale data processing";
-        homepage         = "http://spark.apache.org";
+        homepage         = "https://spark.apache.org";
        license          = lib.licenses.asl20;
        platforms        = lib.platforms.all;
        maintainers      = with maintainers; [ thoughtpolice offline kamilchm illustris ];
--- a/pkgs/applications/radio/flex-ncat/default.nix
+++ b/pkgs/applications/radio/flex-ncat/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "flex-ncat";
-  version = "0.0-20210420.0";
+  version = "0.1-20211223.0";

  src = fetchFromGitHub {
    owner = "kc2g-flex-tools";
    repo = "nCAT";
    rev = "v${version}";
-    sha256 = "0wrdmlp9rrr4n0g9pj0j20ddskllyr59dr3p5fm9z0avkncn3a0m";
+    hash = "sha256-l5IH6EtWqxMLqUfIYpaKgZE9Jq8q4+WgZIazQ2scyxg=";
  };

-  vendorSha256 = "0npzhvpyaxvfaivycnscvh45lp0ycdg9xrlfm8vhfr835yj2adiv";
+  vendorSha256 = "sha256-OzYlpC8DZQc3qo7mnl5jHlxaCNxMW+Z3VG535e+G/1o=";

  meta = with lib; {
    homepage = "https://github.com/kc2g-flex-tools/nCAT";
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,14 +1,14 @@
 {
-  "version": "14.5.2",
-  "repo_hash": "sha256-sXRVnxb7b3grosg0YXwd+GBXHF7mDxIRXhWHcswZjdA=",
-  "yarn_hash": "134x774vz1w9qhxs6xfk7vnajxzqwfyb9f55qhpwqprg6ldwivkr",
+  "version": "14.6.0",
+  "repo_hash": "0b77nh7xq5qalzhvfmsymmkrb78lmaffk464b074wi5c8gy3f5dn",
+  "yarn_hash": "1kcjbf8xn3bwac2s9i2i7dpgbkwcjh09wvgbgysm5yffpdswg6nl",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v14.5.2-ee",
+  "rev": "v14.6.0-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "14.5.2",
-    "GITLAB_PAGES_VERSION": "1.48.0",
+    "GITALY_SERVER_VERSION": "14.6.0",
+    "GITLAB_PAGES_VERSION": "1.49.0",
    "GITLAB_SHELL_VERSION": "13.22.1",
-    "GITLAB_WORKHORSE_VERSION": "14.5.2"
+    "GITLAB_WORKHORSE_VERSION": "14.6.0"
  }
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile
@ -31,3 +31,11 @@ group :development, :test do

  gem 'grpc-tools', '= 1.30.2'
 end
+
+# Gems required in omnibus-gitlab pipeline
+group :development, :test, :omnibus do
+  # Using a fork until https://github.com/pivotal/LicenseFinder/pull/816 is
+  # resolved. For details, check discussion in
+  # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74881
+  gem 'gitlab-license_finder', require: false
+end
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@ -26,7 +26,7 @@ GEM
      memoizable (~> 0.4.0)
    addressable (2.7.0)
      public_suffix (>= 2.0.2, < 5.0)
-    ast (2.4.1)
+    ast (2.4.2)
    binding_ninja (0.2.3)
    builder (3.2.4)
    charlock_holmes (0.7.7)
@ -73,6 +73,13 @@ GEM
      opentracing (~> 0.4)
      pg_query (~> 2.1)
      redis (> 3.0.0, < 5.0.0)
+    gitlab-license_finder (6.14.2.1)
+      bundler
+      rubyzip (>= 1, < 3)
+      thor (~> 1.0)
+      tomlrb (>= 1.3, < 2.1)
+      with_env (= 1.1.0)
+      xml-simple (~> 1.1.5)
    gitlab-markup (1.7.1)
    google-protobuf (3.17.3)
    googleapis-common-protos-types (1.1.0)
@ -119,7 +126,7 @@ GEM
    opentracing (0.5.0)
    optimist (3.0.1)
    parallel (1.19.2)
-    parser (2.7.2.0)
+    parser (3.0.3.2)
      ast (~> 2.4.1)
    pg_query (2.1.1)
      google-protobuf (>= 3.17.1)
@ -184,6 +191,7 @@ GEM
    rubocop-ast (0.2.0)
      parser (>= 2.7.0.1)
    ruby-progressbar (1.10.1)
+    rubyzip (2.3.2)
    rugged (1.2.0)
    sanitize (4.6.6)
      crass (~> 1.0.2)
@ -199,6 +207,7 @@ GEM
    thread_safe (0.3.6)
    thrift (0.15.0)
    timecop (0.9.1)
+    tomlrb (2.0.1)
    tzinfo (2.0.4)
      concurrent-ruby (~> 1.0)
    unicode-display_width (1.7.0)
@ -210,6 +219,9 @@ GEM
      equalizer (~> 0.0.9)
      parser (>= 2.6.5)
      procto (~> 0.0.2)
+    with_env (1.1.0)
+    xml-simple (1.1.9)
+      rexml
    zeitwerk (2.4.2)

 PLATFORMS
@ -223,6 +235,7 @@ DEPENDENCIES
  gitlab-gollum-lib (~> 4.2.7.10.gitlab.1)
  gitlab-gollum-rugged_adapter (~> 0.4.4.4.gitlab.1)
  gitlab-labkit (~> 0.21.1)
+  gitlab-license_finder
  gitlab-markup (~> 1.7.1)
  google-protobuf (~> 3.17.0)
  grpc (~> 1.30.2)
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -33,7 +33,7 @@ let
      };
  };

-  version = "14.5.2";
+  version = "14.6.0";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in

@ -45,7 +45,7 @@ buildGoModule {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "sha256-x8LRBd0bw1JipBu3MbV0d8WFIFPD7joZDBGOr1gstMg=";
+    sha256 = "sha256-YiDZtWRb1PnCAv+UCPRQFoCA12vf3xoHoJ1i/hW+vMg=";
  };

  vendorSha256 = "sha256-ZLd4E3+e25Hqmd6ZyF3X6BveMEg7OF0FX9IvNBWn3v0=";
--- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@ -65,10 +65,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1l3468czzjmxl93ap40hp7z94yxp4nbag0bxqs789bm30md90m2a";
+      sha256 = "04nc8x27hlzlrr5c2gn7mar4vdr0apw5xg22wp6m8dx3wqr04a0y";
      type = "gem";
    };
-    version = "2.4.1";
+    version = "2.4.2";
  };
  binding_ninja = {
    groups = ["default" "development" "test"];
@ -274,6 +274,17 @@
    };
    version = "0.21.2";
  };
+  gitlab-license_finder = {
+    dependencies = ["rubyzip" "thor" "tomlrb" "with_env" "xml-simple"];
+    groups = ["development" "omnibus" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fzrv96kbzyqnsdj762x7n0y006rsgsi8k23nad4xsa43d065i71";
+      type = "gem";
+    };
+    version = "6.14.2.1";
+  };
  gitlab-markup = {
    groups = ["default"];
    platforms = [];
@ -543,10 +554,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1f7gmm60yla325wlnd3qkxs59qm2y0aan8ljpg6k18rwzrrfil6z";
+      sha256 = "0sszdl9mpzqzn9kxrp28sqmg47mjxcwypr4d60vbajqba4v885di";
      type = "gem";
    };
-    version = "2.7.2.0";
+    version = "3.0.3.2";
  };
  pg_query = {
    dependencies = ["google-protobuf"];
@ -825,6 +836,16 @@
    };
    version = "1.10.1";
  };
+  rubyzip = {
+    groups = ["default" "development" "omnibus" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0grps9197qyxakbpw02pda59v45lfgbgiyw48i0mq9f2bn9y6mrz";
+      type = "gem";
+    };
+    version = "2.3.2";
+  };
  rugged = {
    groups = ["default"];
    platforms = [];
@ -912,6 +933,16 @@
    };
    version = "0.9.1";
  };
+  tomlrb = {
+    groups = ["default" "development" "omnibus" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0a83cb5xpyzlr651d46rk5xgq37s46hs9nfqy9baawzs31hm9k2g";
+      type = "gem";
+    };
+    version = "2.0.1";
+  };
  tzinfo = {
    dependencies = ["concurrent-ruby"];
    groups = ["default" "development" "test"];
@ -944,6 +975,27 @@
    };
    version = "0.4.7";
  };
+  with_env = {
+    groups = ["default" "development" "omnibus" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1r5ns064mbb99hf1dyxsk9183hznc5i7mn3bi86zka6dlvqf9csh";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  xml-simple = {
+    dependencies = ["rexml"];
+    groups = ["default" "development" "omnibus" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0pb9plyl71mdbjr4kllfy53qx6g68ryxblmnq9dilvy837jk24fj";
+      type = "gem";
+    };
+    version = "1.1.9";
+  };
  zeitwerk = {
    groups = ["default" "development" "test"];
    platforms = [];
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "14.5.2";
+  version = "14.6.0";

  src = fetchFromGitLab {
    owner = data.owner;
@ -16,7 +16,7 @@ buildGoModule rec {

  sourceRoot = "source/workhorse";

-  vendorSha256 = "sha256-yLZY9FFUS4nJl4TkE6MwICCEwtPTXFc5zuj4FgiIy74=";
+  vendorSha256 = "sha256-ps/MjNY2woHrfcsNZTurnO2TbasWdS3LiuPUfVD2Ypc=";
  buildInputs = [ git ];
  ldflags = [ "-X main.Version=${version}" ];
  doCheck = false;
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -153,7 +153,7 @@ gem 'faraday_middleware-aws-sigv4', '~>0.3.0'
 # Markdown and HTML processing
 gem 'html-pipeline', '~> 2.13.2'
 gem 'deckar01-task_list', '2.3.1'
-gem 'gitlab-markup', '~> 1.7.1'
+gem 'gitlab-markup', '~> 1.8.0'
 gem 'github-markup', '~> 1.7.0', require: 'github/markup'
 gem 'commonmarker', '~> 0.23.2'
 gem 'kramdown', '~> 2.3.1'
@ -185,7 +185,7 @@ gem 'rack', '~> 2.2.3'
 gem 'rack-timeout', '~> 0.5.1', require: 'rack/timeout/base'

 group :puma do
-  gem 'puma', '~> 5.3.1', require: false
+  gem 'puma', '~> 5.5.2', require: false
  gem 'puma_worker_killer', '~> 0.3.1', require: false
  gem 'sd_notify', '~> 0.1.0', require: false
 end
@ -194,10 +194,10 @@ end
 gem 'state_machines-activerecord', '~> 0.8.0'

 # Issue tags
-gem 'acts-as-taggable-on', '~> 7.0'
+gem 'acts-as-taggable-on', '~> 8.1'

 # Background jobs
-gem 'sidekiq', '~> 6.2.2'
+gem 'sidekiq', '~> 6.3'
 gem 'sidekiq-cron', '~> 1.0'
 gem 'redis-namespace', '~> 1.8.1'
 gem 'gitlab-sidekiq-fetcher', '0.8.0', require: 'sidekiq-reliable-fetch'
@ -376,7 +376,7 @@ group :development, :test do
  gem 'spring', '~> 2.1.0'
  gem 'spring-commands-rspec', '~> 1.0.4'

-  gem 'gitlab-styles', '~> 6.4.0', require: false
+  gem 'gitlab-styles', '~> 6.6.0', require: false

  gem 'haml_lint', '~> 0.36.0', require: false
  gem 'bundler-audit', '~> 0.7.0.1', require: false
@ -400,17 +400,22 @@ group :development, :test do
 end

 group :development, :test, :danger do
-  gem 'gitlab-dangerfiles', '~> 2.5.0', require: false
+  gem 'gitlab-dangerfiles', '~> 2.6.1', require: false
 end

 group :development, :test, :coverage do
  gem 'simplecov', '~> 0.18.5', require: false
+  gem 'simplecov-lcov', '~> 0.8.0', require: false
  gem 'simplecov-cobertura', '~> 1.3.1', require: false
+  gem 'undercover', '~> 0.4.4', require: false
 end

 # Gems required in omnibus-gitlab pipeline
 group :development, :test, :omnibus do
-  gem 'license_finder', '~> 6.0', require: false
+  # Using a fork until https://github.com/pivotal/LicenseFinder/pull/816 is
+  # resolved. For details, check discussion in
+  # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/74881
+  gem 'gitlab-license_finder', '~> 6.0', require: false
 end

 group :test do
@ -459,7 +464,7 @@ gem 'health_check', '~> 3.0'

 # System information
 gem 'vmstat', '~> 2.3.0'
-gem 'sys-filesystem', '~> 1.1.6'
+gem 'sys-filesystem', '~> 1.4.3'

 # NTP client
 gem 'net-ntp'
@ -471,7 +476,7 @@ gem 'sshkey', '~> 2.0'
 # Required for ED25519 SSH host key support
 group :ed25519 do
  gem 'ed25519', '~> 1.2'
-  gem 'bcrypt_pbkdf', '~> 1.0'
+  gem 'bcrypt_pbkdf', '~> 1.1'
 end

 # Spamcheck GRPC protocol definitions
@ -494,7 +499,7 @@ gem 'flipper', '~> 0.21.0'
 gem 'flipper-active_record', '~> 0.21.0'
 gem 'flipper-active_support_cache_store', '~> 0.21.0'
 gem 'unleash', '~> 3.2.2'
-gem 'gitlab-experiment', '~> 0.6.4'
+gem 'gitlab-experiment', '~> 0.6.5'

 # Structured logging
 gem 'lograge', '~> 0.5'
@ -539,4 +544,4 @@ gem 'ipaddress', '~> 0.8.3'

 gem 'parslet', '~> 1.8'

-gem 'ipynbdiff', '0.3.7'
+gem 'ipynbdiff', '0.3.8'
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@ -66,7 +66,7 @@ GEM
      minitest (>= 5.1)
      tzinfo (~> 2.0)
      zeitwerk (~> 2.3)
-    acts-as-taggable-on (7.0.0)
+    acts-as-taggable-on (8.1.0)
      activerecord (>= 5.0, < 6.2)
    addressable (2.8.0)
      public_suffix (>= 2.0.2, < 5.0)
@ -130,7 +130,7 @@ GEM
    base32 (0.3.2)
    batch-loader (2.0.1)
    bcrypt (3.1.16)
-    bcrypt_pbkdf (1.0.0)
+    bcrypt_pbkdf (1.1.0)
    benchmark (0.1.1)
    benchmark-ips (2.3.0)
    benchmark-memory (0.1.2)
@ -215,7 +215,7 @@ GEM
    css_parser (1.7.0)
      addressable
    daemons (1.3.1)
-    danger (8.4.1)
+    danger (8.4.2)
      claide (~> 1.0)
      claide-plugins (>= 0.9.2)
      colored2 (~> 3.1)
@ -451,10 +451,10 @@ GEM
      terminal-table (~> 1.5, >= 1.5.1)
    gitlab-chronic (0.10.5)
      numerizer (~> 0.2)
-    gitlab-dangerfiles (2.5.0)
+    gitlab-dangerfiles (2.6.1)
      danger (>= 8.3.1)
      danger-gitlab (>= 8.0.0)
-    gitlab-experiment (0.6.4)
+    gitlab-experiment (0.6.5)
      activesupport (>= 3.0)
      request_store (>= 1.0)
      scientist (~> 1.6, >= 1.6.0)
@ -474,8 +474,15 @@ GEM
      pg_query (~> 2.1)
      redis (> 3.0.0, < 5.0.0)
    gitlab-license (2.0.0)
+    gitlab-license_finder (6.14.2.1)
+      bundler
+      rubyzip (>= 1, < 3)
+      thor (~> 1.0)
+      tomlrb (>= 1.3, < 2.1)
+      with_env (= 1.1.0)
+      xml-simple (~> 1.1.5)
    gitlab-mail_room (0.0.9)
-    gitlab-markup (1.7.1)
+    gitlab-markup (1.8.0)
    gitlab-net-dns (0.9.1)
    gitlab-omniauth-openid-connect (0.8.0)
      addressable (~> 2.7)
@ -483,9 +490,10 @@ GEM
      openid_connect (~> 1.2)
    gitlab-sidekiq-fetcher (0.8.0)
      sidekiq (~> 6.1)
-    gitlab-styles (6.4.0)
+    gitlab-styles (6.6.0)
      rubocop (~> 0.91, >= 0.91.1)
      rubocop-gitlab-security (~> 0.1.1)
+      rubocop-graphql (~> 0.10)
      rubocop-performance (~> 1.9.2)
      rubocop-rails (~> 2.9)
      rubocop-rspec (~> 1.44)
@ -626,14 +634,16 @@ GEM
      mime-types (~> 3.0)
      multi_xml (>= 0.5.2)
    httpclient (2.8.3)
-    i18n (1.8.10)
+    i18n (1.8.11)
      concurrent-ruby (~> 1.0)
    i18n_data (0.8.0)
    icalendar (2.4.1)
+    imagen (0.1.8)
+      parser (>= 2.5, != 2.5.1.1)
    invisible_captcha (1.1.0)
      rails (>= 4.2)
    ipaddress (0.8.3)
-    ipynbdiff (0.3.7)
+    ipynbdiff (0.3.8)
      diffy (= 3.3.0)
      json (= 2.5.1)
    jaeger-client (1.1.0)
@ -699,13 +709,6 @@ GEM
      railties (>= 5.2)
      rexml
    libyajl2 (1.2.0)
-    license_finder (6.0.0)
-      bundler
-      rubyzip (>= 1, < 3)
-      thor
-      toml (= 0.2.0)
-      with_env (= 1.1.0)
-      xml-simple
    licensee (9.14.1)
      dotenv (~> 2.0)
      octokit (~> 4.17)
@ -896,7 +899,7 @@ GEM
    orm_adapter (0.5.0)
    os (1.1.1)
    parallel (1.20.1)
-    parser (3.0.2.0)
+    parser (3.0.3.2)
      ast (~> 2.4.1)
    parslet (1.8.2)
    pastel (0.8.0)
@ -935,7 +938,7 @@ GEM
      tty-markdown
      tty-prompt
    public_suffix (4.0.6)
-    puma (5.3.2)
+    puma (5.5.2)
      nio4r (~> 2.0)
    puma_worker_killer (0.3.1)
      get_process_mem (~> 0.2)
@ -1100,6 +1103,8 @@ GEM
      parser (>= 2.7.1.5)
    rubocop-gitlab-security (0.1.1)
      rubocop (>= 0.51)
+    rubocop-graphql (0.10.3)
+      rubocop (>= 0.87, < 2)
    rubocop-performance (1.9.2)
      rubocop (>= 0.90.0, < 2.0)
      rubocop-ast (>= 0.4.0)
@ -1151,7 +1156,7 @@ GEM
    sawyer (0.8.2)
      addressable (>= 2.3.5)
      faraday (> 0.8, < 2.0)
-    scientist (1.6.0)
+    scientist (1.6.2)
    sd_notify (0.1.0)
    securecompare (1.0.0)
    seed-fu (2.3.7)
@ -1168,7 +1173,7 @@ GEM
    shellany (0.0.1)
    shoulda-matchers (4.0.1)
      activesupport (>= 4.2.0)
-    sidekiq (6.2.2)
+    sidekiq (6.3.1)
      connection_pool (>= 2.2.2)
      rack (~> 2.0)
      redis (>= 4.2.0)
@ -1187,6 +1192,7 @@ GEM
    simplecov-cobertura (1.3.1)
      simplecov (~> 0.8)
    simplecov-html (0.12.3)
+    simplecov-lcov (0.8.0)
    sixarm_ruby_unaccent (1.2.0)
    slack-messenger (2.3.4)
    snowplow-tracker (0.6.1)
@ -1242,8 +1248,8 @@ GEM
      activesupport (>= 3)
      attr_required (>= 0.0.5)
      httpclient (>= 2.4)
-    sys-filesystem (1.1.9)
-      ffi
+    sys-filesystem (1.4.3)
+      ffi (~> 1.1)
    sysexits (1.2.0)
    tanuki_emoji (0.5.0)
    temple (0.8.2)
@ -1265,8 +1271,6 @@ GEM
    timecop (0.9.1)
    timeliness (0.3.10)
    timfel-krb5-auth (0.8.3)
-    toml (0.2.0)
-      parslet (~> 1.8.0)
    toml-rb (2.0.1)
      citrus (~> 3.0, > 3.0)
    tomlrb (1.3.0)
@ -1304,6 +1308,10 @@ GEM
      concurrent-ruby (~> 1.0)
    u2f (0.2.1)
    uber (0.1.0)
+    undercover (0.4.4)
+      imagen (>= 0.1.8)
+      rainbow (>= 2.1, < 4.0)
+      rugged (>= 0.27, < 1.3)
    unf (0.1.4)
      unf_ext
    unf_ext (0.0.7.7)
@ -1366,7 +1374,7 @@ GEM
      nokogiri (~> 1.8)
    yajl-ruby (1.4.1)
    yard (0.9.26)
-    zeitwerk (2.4.2)
+    zeitwerk (2.5.1)

 PLATFORMS
  ruby
@ -1375,7 +1383,7 @@ DEPENDENCIES
  RedCloth (~> 4.3.2)
  acme-client (~> 2.0, >= 2.0.6)
  activerecord-explain-analyze (~> 0.1)
-  acts-as-taggable-on (~> 7.0)
+  acts-as-taggable-on (~> 8.1)
  addressable (~> 2.8)
  akismet (~> 3.0)
  apollo_upload_server (~> 2.1.0)
@ -1395,7 +1403,7 @@ DEPENDENCIES
  base32 (~> 0.3.0)
  batch-loader (~> 2.0.1)
  bcrypt (~> 3.1, >= 3.1.14)
-  bcrypt_pbkdf (~> 1.0)
+  bcrypt_pbkdf (~> 1.1)
  benchmark-ips (~> 2.3.0)
  benchmark-memory (~> 0.1)
  better_errors (~> 2.9.0)
@ -1460,17 +1468,18 @@ DEPENDENCIES
  gitaly (~> 14.4.0.pre.rc43)
  github-markup (~> 1.7.0)
  gitlab-chronic (~> 0.10.5)
-  gitlab-dangerfiles (~> 2.5.0)
-  gitlab-experiment (~> 0.6.4)
+  gitlab-dangerfiles (~> 2.6.1)
+  gitlab-experiment (~> 0.6.5)
  gitlab-fog-azure-rm (~> 1.2.0)
  gitlab-labkit (~> 0.21.1)
  gitlab-license (~> 2.0)
+  gitlab-license_finder (~> 6.0)
  gitlab-mail_room (~> 0.0.9)
-  gitlab-markup (~> 1.7.1)
+  gitlab-markup (~> 1.8.0)
  gitlab-net-dns (~> 0.9.1)
  gitlab-omniauth-openid-connect (~> 0.8.0)
  gitlab-sidekiq-fetcher (= 0.8.0)
-  gitlab-styles (~> 6.4.0)
+  gitlab-styles (~> 6.6.0)
  gitlab_chronic_duration (~> 0.10.6.2)
  gitlab_omniauth-ldap (~> 2.1.1)
  gon (~> 6.4.0)
@ -1500,7 +1509,7 @@ DEPENDENCIES
  icalendar
  invisible_captcha (~> 1.1.0)
  ipaddress (~> 0.8.3)
-  ipynbdiff (= 0.3.7)
+  ipynbdiff (= 0.3.8)
  jira-ruby (~> 2.1.4)
  js_regex (~> 3.7)
  json (~> 2.5.1)
@ -1513,7 +1522,6 @@ DEPENDENCIES
  kubeclient (~> 4.9.2)
  lefthook (~> 0.7.0)
  letter_opener_web (~> 2.0.0)
-  license_finder (~> 6.0)
  licensee (~> 9.14.1)
  lockbox (~> 0.6.2)
  lograge (~> 0.5)
@ -1565,7 +1573,7 @@ DEPENDENCIES
  pry-byebug
  pry-rails (~> 0.3.9)
  pry-shell (~> 0.5.0)
-  puma (~> 5.3.1)
+  puma (~> 5.5.2)
  puma_worker_killer (~> 0.3.1)
  rack (~> 2.2.3)
  rack-attack (~> 6.3.0)
@ -1612,11 +1620,12 @@ DEPENDENCIES
  sentry-raven (~> 3.1)
  settingslogic (~> 2.0.9)
  shoulda-matchers (~> 4.0.1)
-  sidekiq (~> 6.2.2)
+  sidekiq (~> 6.3)
  sidekiq-cron (~> 1.0)
  simple_po_parser (~> 1.1.2)
  simplecov (~> 0.18.5)
  simplecov-cobertura (~> 1.3.1)
+  simplecov-lcov (~> 0.8.0)
  slack-messenger (~> 2.3.4)
  snowplow-tracker (~> 0.6.1)
  solargraph (~> 0.43)
@ -1628,7 +1637,7 @@ DEPENDENCIES
  sshkey (~> 2.0)
  stackprof (~> 0.2.15)
  state_machines-activerecord (~> 0.8.0)
-  sys-filesystem (~> 1.1.6)
+  sys-filesystem (~> 1.4.3)
  tanuki_emoji (~> 0.5)
  terser (= 1.0.2)
  test-prof (~> 1.0.7)
@ -1639,6 +1648,7 @@ DEPENDENCIES
  toml-rb (~> 2.0)
  truncato (~> 0.7.11)
  u2f (~> 0.2.1)
+  undercover (~> 0.4.4)
  unf (~> 0.1.4)
  unleash (~> 3.2.2)
  valid_email (~> 0.1)
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@ -148,10 +148,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "09m7lvm6id8mm8y9qycjr54l9gyqfb43x6yjz23cggisjg0px1fv";
+      sha256 = "0kfnyix173bazjswab21bx7hmqmik71awj2kz090fsa2nv58c4mw";
      type = "gem";
    };
-    version = "7.0.0";
+    version = "8.1.0";
  };
  addressable = {
    dependencies = ["public_suffix"];
@ -484,10 +484,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0cj4k13c7qvvck7y25i3xarvyqq8d27vl61jddifkc7llnnap1hv";
+      sha256 = "0ndamfaivnkhc6hy0yqyk2gkwr6f3bz6216lh74hsiiyk3axz445";
      type = "gem";
    };
-    version = "1.0.0";
+    version = "1.1.0";
  };
  benchmark = {
    groups = ["default" "development"];
@ -931,10 +931,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1f9p7sdj542cbn352qz58m4n26kamv6vbnxzpc06j0pxi50z3i0v";
+      sha256 = "07mxkgksgilfipd97rgfhx7c421j1fx7rk6lf0k18bkccyg1r8vn";
      type = "gem";
    };
-    version = "8.4.1";
+    version = "8.4.2";
  };
  danger-gitlab = {
    dependencies = ["danger" "gitlab"];
@ -1942,10 +1942,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1488s24c9fm55z2a2pbry2fjx72fzgzv0y48krgldvf0qy43l0kz";
+      sha256 = "0pgb0v41qn2cnzzn4fizffds07vhz9sf09bpmm0lw86x8lz6vfdq";
      type = "gem";
    };
-    version = "2.5.0";
+    version = "2.6.1";
  };
  gitlab-experiment = {
    dependencies = ["activesupport" "request_store" "scientist"];
@ -1953,10 +1953,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "07b7fb8vkpwjf668mircz6lavr8yp5xc7f7yp1v1h7izhzhn7m8g";
+      sha256 = "064iy0pgjfvfcxynclmk70cdi10hwx7xzq1c14p68cilg569vma2";
      type = "gem";
    };
-    version = "0.6.4";
+    version = "0.6.5";
  };
  gitlab-fog-azure-rm = {
    dependencies = ["azure-storage-blob" "azure-storage-common" "fog-core" "fog-json" "mime-types" "ms_rest_azure"];
@ -1990,6 +1990,17 @@
    };
    version = "2.0.0";
  };
+  gitlab-license_finder = {
+    dependencies = ["rubyzip" "thor" "tomlrb" "with_env" "xml-simple"];
+    groups = ["development" "omnibus" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fzrv96kbzyqnsdj762x7n0y006rsgsi8k23nad4xsa43d065i71";
+      type = "gem";
+    };
+    version = "6.14.2.1";
+  };
  gitlab-mail_room = {
    groups = ["default"];
    platforms = [];
@ -2005,10 +2016,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0xnlra517pfj3hx07kasbqlcw51ix4xajr6bsd3mwg8bc92dlwy7";
+      sha256 = "11kc33j6m0nayppkb7645w0ldh8g18pgmxgb8wz39pd5vilr6qpv";
      type = "gem";
    };
-    version = "1.7.1";
+    version = "1.8.0";
  };
  gitlab-net-dns = {
    groups = ["default"];
@ -2043,15 +2054,15 @@
    version = "0.8.0";
  };
  gitlab-styles = {
-    dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-performance" "rubocop-rails" "rubocop-rspec"];
+    dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-graphql" "rubocop-performance" "rubocop-rails" "rubocop-rspec"];
    groups = ["development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "16d90sd0x6qfkhgfjysswwrzk82zs82xs9azn9w287irpzdkvj7f";
+      sha256 = "1xs7v0sj3j4d5yflfn8n5azh5qwxsrc432q7v4nckg9irwqj99js";
      type = "gem";
    };
-    version = "6.4.0";
+    version = "6.6.0";
  };
  gitlab_chronic_duration = {
    dependencies = ["numerizer"];
@ -2532,10 +2543,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0g2fnag935zn2ggm5cn6k4s4xvv53v2givj1j90szmvavlpya96a";
+      sha256 = "0vdd1kii40qhbr9n8qx71k2gskq6rkl8ygy8hw5hfj8bb5a364xf";
      type = "gem";
    };
-    version = "1.8.10";
+    version = "1.8.11";
  };
  i18n_data = {
    groups = ["default"];
@ -2557,6 +2568,17 @@
    };
    version = "2.4.1";
  };
+  imagen = {
+    dependencies = ["parser"];
+    groups = ["coverage" "default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qm1jcprs0xys8m72kgm9pasd1xzhiqiyv64baxwcygyshkvgrzx";
+      type = "gem";
+    };
+    version = "0.1.8";
+  };
  invisible_captcha = {
    dependencies = ["rails"];
    groups = ["default"];
@ -2584,10 +2606,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "18337bzcwssmnyg2wf3za50z0zh2b1sh17wgaapavd1ffr24svkx";
+      sha256 = "0raj4xwp2dz1xrzcpqqdp5ygfpjdy7jx28ziqg9f73hf850j90d1";
      type = "gem";
    };
-    version = "0.3.7";
+    version = "0.3.8";
  };
  jaeger-client = {
    dependencies = ["opentracing" "thrift"];
@ -2846,17 +2868,6 @@
    };
    version = "1.2.0";
  };
-  license_finder = {
-    dependencies = ["rubyzip" "thor" "toml" "with_env" "xml-simple"];
-    groups = ["development" "omnibus" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0kc4bkaxy6mm6kpbpg8hdjsqpzybh7cy5b45qydc7bfa9c35vr93";
-      type = "gem";
-    };
-    version = "6.0.0";
-  };
  licensee = {
    dependencies = ["dotenv" "octokit" "reverse_markdown" "rugged" "thor"];
    groups = ["default"];
@ -3758,14 +3769,14 @@
  };
  parser = {
    dependencies = ["ast"];
-    groups = ["default" "development" "test"];
+    groups = ["coverage" "default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "06ma6w87ph8lnc9z4hi40ynmcdnjv0p8x53x0s3fjkz4q2p6sxh5";
+      sha256 = "0sszdl9mpzqzn9kxrp28sqmg47mjxcwypr4d60vbajqba4v885di";
      type = "gem";
    };
-    version = "3.0.2.0";
+    version = "3.0.3.2";
  };
  parslet = {
    groups = ["default" "development" "test"];
@ -3958,10 +3969,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0lmaq05a257m9588a81wql3a5p039f221f0dmq57bm2qjwxydjmj";
+      sha256 = "1xblxnrs0c5m326v7kgr32k4m00cl2ipcf5m0qvyisrw62vd5dbn";
      type = "gem";
    };
-    version = "5.3.2";
+    version = "5.5.2";
  };
  puma_worker_killer = {
    dependencies = ["get_process_mem" "puma"];
@ -4637,6 +4648,17 @@
    };
    version = "0.1.1";
  };
+  rubocop-graphql = {
+    dependencies = ["rubocop"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0hvm17hm7xjqcfn70c7h3rrz2y2mrazqmkp5ains08j0zd39x7rh";
+      type = "gem";
+    };
+    version = "0.10.3";
+  };
  rubocop-performance = {
    dependencies = ["rubocop" "rubocop-ast"];
    groups = ["default" "development" "test"];
@ -4886,10 +4908,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0jklwk9aldvlmdv17m77g2f82j383alqd4jjnwn4c564q9wvz3fp";
+      sha256 = "05xiv6kznhawbkjrz97s6lp2ld0w95x1l2s80gm8m49f273399s2";
      type = "gem";
    };
-    version = "1.6.0";
+    version = "1.6.2";
  };
  sd_notify = {
    groups = ["puma"];
@ -5001,10 +5023,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "104a97cl94aclg71ngrr097zjbdf6cibnz4q3rqjb88izmd7cfk6";
+      sha256 = "0k38cbwhcj9ncfzlgfmvq2zqfdvldln58w8s8v89m0jqlhnhsqhj";
      type = "gem";
    };
-    version = "6.2.2";
+    version = "6.3.1";
  };
  sidekiq-cron = {
    dependencies = ["fugit" "sidekiq"];
@ -5070,6 +5092,16 @@
    };
    version = "0.12.3";
  };
+  simplecov-lcov = {
+    groups = ["coverage" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1h8kswnshgb9zidvc88f4zjy4gflgz3854sx9wrw8ppgnwfg6581";
+      type = "gem";
+    };
+    version = "0.8.0";
+  };
  sixarm_ruby_unaccent = {
    groups = ["default"];
    platforms = [];
@ -5297,10 +5329,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "03y0mnn5mp9ydi5jc4d3y0gnk5fxwljzzfzj9rg7q94kslwi1kx4";
+      sha256 = "08bln6c3qmylakgpmpswv4zdis8bf96nkbrxpb9xcal2i7g1j29r";
      type = "gem";
    };
-    version = "1.1.9";
+    version = "1.4.3";
  };
  sysexits = {
    groups = ["default" "development" "test"];
@ -5456,17 +5488,6 @@
    };
    version = "0.8.3";
  };
-  toml = {
-    dependencies = ["parslet"];
-    groups = ["default" "development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0xj460rkyqvg74xc8kivmbvgc46c6mm7r8mbjs5m2gq8khf8sbki";
-      type = "gem";
-    };
-    version = "0.2.0";
-  };
  toml-rb = {
    dependencies = ["citrus"];
    groups = ["default"];
@ -5615,6 +5636,17 @@
    };
    version = "0.1.0";
  };
+  undercover = {
+    dependencies = ["imagen" "rainbow" "rugged"];
+    groups = ["coverage" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "19gnc5sr41z3rqbw03k8v3sdpn7rccmgivnc0x5pdq4x7bhcpi31";
+      type = "gem";
+    };
+    version = "0.4.4";
+  };
  unf = {
    dependencies = ["unf_ext"];
    groups = ["default"];
@ -5934,9 +5966,9 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1746czsjarixq0x05f7p3hpzi38ldg6wxnxxw74kbjzh1sdjgmpl";
+      sha256 = "18l4r6layck0d80ydc692mv1lxak5xbf6w2paj1x7m2ggbggzxgj";
      type = "gem";
    };
-    version = "2.4.2";
+    version = "2.5.1";
  };
 }
--- a/pkgs/applications/version-management/sourcehut/builds.nix
+++ b/pkgs/applications/version-management/sourcehut/builds.nix
@ -11,26 +11,31 @@
 , python
 }:
 let
-  version = "0.66.7";
-
-  buildWorker = src: buildGoModule {
-    inherit src version;
-    pname = "builds-sr-ht-worker";
-
-    vendorSha256 = "sha256-giOaldV46aBqXyFH/cQVsbUr6Rb4VMhbBO86o48tRZY=";
-  };
-in
-buildPythonPackage rec {
-  inherit version;
-  pname = "buildsrht";
+  version = "0.74.17";

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "builds.sr.ht";
    rev = version;
-    sha256 = "sha256-2MLs/DOXHjEYarXDVUcPZe3o0fmZbzVxn528SE72lhM=";
+    sha256 = "sha256-6Yc33lkhozpnx8e6yukUfo+/Qw5mwpJQQKuYbC7uqcU=";
  };

+  buildWorker = src: buildGoModule {
+    inherit src version;
+    pname = "builds-sr-ht-worker";
+
+    vendorSha256 = "sha256-Pf1M9a43eK4jr6QMi6kRHA8DodXQU0pqq9ua5VC3ER0=";
+  };
+in
+buildPythonPackage rec {
+  inherit src version;
+  pname = "buildsrht";
+
+  patches = [
+    # Revert change breaking Unix socket support for Redis
+    patches/redis-socket/build/0001-Revert-Add-build-submission-and-queue-monitoring.patch
+  ];
+
  nativeBuildInputs = srht.nativeBuildInputs;

  propagatedBuildInputs = [
@ -56,10 +61,12 @@ buildPythonPackage rec {
    cp ${buildWorker "${src}/worker"}/bin/worker $out/bin/builds.sr.ht-worker
  '';

+  pythonImportsCheck = [ "buildsrht" ];
+
  meta = with lib; {
    homepage = "https://git.sr.ht/~sircmpwn/builds.sr.ht";
    description = "Continuous integration service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
    maintainers = with maintainers; [ eadwu ];
  };
 }
--- a/pkgs/applications/version-management/sourcehut/core.nix
+++ b/pkgs/applications/version-management/sourcehut/core.nix
@ -25,17 +25,16 @@
 , sassc
 , nodejs
 , redis
-, writeText
 }:

 buildPythonPackage rec {
  pname = "srht";
-  version = "0.67.4";
+  version = "0.68.13";

  src = fetchgit {
    url = "https://git.sr.ht/~sircmpwn/core.sr.ht";
    rev = version;
-    sha256 = "sha256-XvzFfcBK5Mq8p7xEBAF/eupUE1kkUBh5k+ByM/WA9bc=";
+    sha256 = "sha256-LPyEfpNlmod18Fj16xpihKOrsU/hQUfAeOmWMmUeVPQ=";
    fetchSubmodules = true;
  };

@ -46,6 +45,7 @@ buildPythonPackage rec {
  };

  patches = [
+    # Disable check for npm
    ./disable-npm-install.patch
  ];

@ -87,6 +87,7 @@ buildPythonPackage rec {
  '';

  dontUseSetuptoolsCheck = true;
+  pythonImportsCheck = [ "srht" ];

  meta = with lib; {
    homepage = "https://git.sr.ht/~sircmpwn/srht";
--- a/pkgs/applications/version-management/sourcehut/default.nix
+++ b/pkgs/applications/version-management/sourcehut/default.nix
@ -22,6 +22,7 @@ let
      listssrht = self.callPackage ./lists.nix { };
      mansrht = self.callPackage ./man.nix { };
      metasrht = self.callPackage ./meta.nix { };
+      pagessrht = self.callPackage ./pages.nix { };
      pastesrht = self.callPackage ./paste.nix { };
      todosrht = self.callPackage ./todo.nix { };

@ -40,6 +41,7 @@ with python.pkgs; recurseIntoAttrs {
  listssrht = toPythonApplication listssrht;
  mansrht = toPythonApplication mansrht;
  metasrht = toPythonApplication metasrht;
+  pagessrht = pagessrht;
  pastesrht = toPythonApplication pastesrht;
  todosrht = toPythonApplication todosrht;
 }
--- a/pkgs/applications/version-management/sourcehut/dispatch.nix
+++ b/pkgs/applications/version-management/sourcehut/dispatch.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "dispatchsrht";
-  version = "0.15.8";
+  version = "0.15.34";

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "dispatch.sr.ht";
    rev = version;
-    sha256 = "sha256-zWCGPjIgMKHXHJUs9aciV7IFgo0rpahon6KXHDwcfss=";
+    sha256 = "sha256-bZ4ZKohMozZIyP0TUgxETOECib4XGUv29+Mg8ZsoMf8=";
  };

  nativeBuildInputs = srht.nativeBuildInputs;
@ -31,10 +31,12 @@ buildPythonPackage rec {
    export SRHT_PATH=${srht}/${python.sitePackages}/srht
  '';

+  pythonImportsCheck = [ "dispatchsrht" ];
+
  meta = with lib; {
    homepage = "https://dispatch.sr.ht/~sircmpwn/dispatch.sr.ht";
    description = "Task dispatcher and service integration tool for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
    maintainers = with maintainers; [ eadwu ];
  };
 }
--- a/pkgs/applications/version-management/sourcehut/git.nix
+++ b/pkgs/applications/version-management/sourcehut/git.nix
@ -8,13 +8,13 @@
 , scmsrht
 }:
 let
-  version = "0.72.8";
+  version = "0.76.4";

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "git.sr.ht";
    rev = version;
-    sha256 = "sha256-AB2uzajO5PtcpJfbOOTfuDFM6is5K39v3AZJ1hShRNc=";
+    sha256 = "sha256-diUkQpB/ivg8JTaoTcSyKr9Q9LZiMo6qVInBDPceklc=";
  };

  buildShell = src: buildGoModule {
@ -32,13 +32,13 @@ let
  buildKeys = src: buildGoModule {
    inherit src version;
    pname = "gitsrht-keys";
-    vendorSha256 = "1d94cqy7x0q0agwg515xxsbl70b3qrzxbzsyjhn1pbyj532brn7f";
+    vendorSha256 = "sha256-9pojS69HCKVHUceyOpGtv9ewcxFD4WsOVsEzkmWJkF4=";
  };

  buildUpdateHook = src: buildGoModule {
    inherit src version;
    pname = "gitsrht-update-hook";
-    vendorSha256 = "0fwzqpjv8x5y3w3bfjd0x0cvqjjak23m0zj88hf32jpw49xmjkih";
+    vendorSha256 = "sha256-sBlG7EFqdDm7CkAHVX50Mf4N3sl1rPNmWExG/bfbfGA=";
  };

  updateHook = buildUpdateHook "${src}/gitsrht-update-hook";
@ -72,10 +72,12 @@ buildPythonPackage rec {
    inherit updateHook;
  };

+  pythonImportsCheck = [ "gitsrht" ];
+
  meta = with lib; {
    homepage = "https://git.sr.ht/~sircmpwn/git.sr.ht";
    description = "Git repository hosting service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
    maintainers = with maintainers; [ eadwu ];
  };
 }
--- a/pkgs/applications/version-management/sourcehut/hg.nix
+++ b/pkgs/applications/version-management/sourcehut/hg.nix
@ -10,12 +10,12 @@

 buildPythonPackage rec {
  pname = "hgsrht";
-  version = "0.27.4";
+  version = "0.29.3";

  src = fetchhg {
    url = "https://hg.sr.ht/~sircmpwn/hg.sr.ht";
    rev = version;
-    sha256 = "1c0qfi0gmbfngvds6917fy9ii2iglawn429757rh7b4bvzn7n6mr";
+    sha256 = "y8gKaamwD5lsYqO1SkxMcn3E2TWidHAo2slvEU+8ovg=";
  };

  nativeBuildInputs = srht.nativeBuildInputs;
@ -32,10 +32,12 @@ buildPythonPackage rec {
    export SRHT_PATH=${srht}/${python.sitePackages}/srht
  '';

+  pythonImportsCheck = [ "hgsrht" ];
+
  meta = with lib; {
    homepage = "https://git.sr.ht/~sircmpwn/hg.sr.ht";
    description = "Mercurial repository hosting service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
    maintainers = with maintainers; [ eadwu ];
  };
 }
--- a/pkgs/applications/version-management/sourcehut/hub.nix
+++ b/pkgs/applications/version-management/sourcehut/hub.nix
@ -6,13 +6,13 @@

 buildPythonPackage rec {
  pname = "hubsrht";
-  version = "0.13.1";
+  version = "0.14.4";

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "hub.sr.ht";
    rev = version;
-    sha256 = "sha256-Kqzy4mh5Nn1emzHBco/LVuXro/tW3NX+OYqdEwBSQ/U=";
+    sha256 = "sha256-7HF+jykWGqzPWA0YtJZQZU7pnID1yexcqLkEf2HpnSs=";
  };

  nativeBuildInputs = srht.nativeBuildInputs;
@ -26,11 +26,12 @@ buildPythonPackage rec {
  '';

  dontUseSetuptoolsCheck = true;
+  pythonImportsCheck = [ "hubsrht" ];

  meta = with lib; {
    homepage = "https://git.sr.ht/~sircmpwn/hub.sr.ht";
    description = "Project hub service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
    maintainers = with maintainers; [ eadwu ];
  };
 }
--- a/pkgs/applications/version-management/sourcehut/lists.nix
+++ b/pkgs/applications/version-management/sourcehut/lists.nix
@ -12,13 +12,13 @@

 buildPythonPackage rec {
  pname = "listssrht";
-  version = "0.48.19";
+  version = "0.51.0";

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "lists.sr.ht";
    rev = version;
-    sha256 = "sha256-bsakEMyvWaxiE4/SGcAP4mlGG9jkdHfFxpt9H+TJn/8=";
+    sha256 = "sha256-iywZ6G5E4AJevg/Q1LoB7JMJxBcsAnbhiND++mFy/bw=";
  };

  nativeBuildInputs = srht.nativeBuildInputs;
@ -37,10 +37,12 @@ buildPythonPackage rec {
    export SRHT_PATH=${srht}/${python.sitePackages}/srht
  '';

+  pythonImportsCheck = [ "listssrht" ];
+
  meta = with lib; {
    homepage = "https://git.sr.ht/~sircmpwn/lists.sr.ht";
    description = "Mailing list service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
    maintainers = with maintainers; [ eadwu ];
  };
 }
--- a/pkgs/applications/version-management/sourcehut/man.nix
+++ b/pkgs/applications/version-management/sourcehut/man.nix
@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "mansrht";
-  version = "0.15.12";
+  version = "0.15.22";

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "man.sr.ht";
    rev = version;
-    sha256 = "sha256-MqH/8K9XRvEg6P7GHE6XXtWnhDP3wT8iGoNaFtYQbio=";
+    sha256 = "sha256-curouf+eNCKprDI23blGs4AzJMry6zlCLDt/+0j5c8A=";
  };

  nativeBuildInputs = srht.nativeBuildInputs;
@ -29,10 +29,12 @@ buildPythonPackage rec {
    export SRHT_PATH=${srht}/${python.sitePackages}/srht
  '';

+  pythonImportsCheck = [ "mansrht" ];
+
  meta = with lib; {
    homepage = "https://git.sr.ht/~sircmpwn/man.sr.ht";
    description = "Wiki service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
    maintainers = with maintainers; [ eadwu ];
  };
 }
--- a/pkgs/applications/version-management/sourcehut/meta.nix
+++ b/pkgs/applications/version-management/sourcehut/meta.nix
@ -18,19 +18,19 @@
 , python
 }:
 let
-  version = "0.53.14";
+  version = "0.57.2";

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "meta.sr.ht";
    rev = version;
-    sha256 = "sha256-/+r/XLDkcSTW647xPMh5bcJmR2xZNNH74AJ5jemna2k=";
+    sha256 = "sha256-+ksfAOuch/fLkFLYU52Ug0Hf0EoERy+oCwa9g+GKuAA=";
  };

  buildApi = src: buildGoModule {
    inherit src version;
    pname = "metasrht-api";
-    vendorSha256 = "sha256-eZyDrr2VcNMxI++18qUy7LA1Q1YDlWCoRtl00L8lfR4=";
+    vendorSha256 = "sha256-vo+YbMyo/Eal7hbFxP9hwIW2cePJcGFszoDRCCzFYdM=";
  };

 in
@ -38,6 +38,11 @@ buildPythonPackage rec {
  pname = "metasrht";
  inherit version src;

+  patches = [
+    # Revert change breaking Unix socket support for Redis
+    patches/redis-socket/meta/0001-Revert-Add-webhook-queue-monitoring.patch
+  ];
+
  nativeBuildInputs = srht.nativeBuildInputs;

  propagatedBuildInputs = [
@ -66,10 +71,12 @@ buildPythonPackage rec {
    cp ${buildApi "${src}/api/"}/bin/api $out/bin/metasrht-api
  '';

+  pythonImportsCheck = [ "metasrht" ];
+
  meta = with lib; {
    homepage = "https://git.sr.ht/~sircmpwn/meta.sr.ht";
    description = "Account management service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
    maintainers = with maintainers; [ eadwu ];
  };
 }
--- a/pkgs/applications/version-management/sourcehut/pages.nix
+++ b/pkgs/applications/version-management/sourcehut/pages.nix
@ -0,0 +1,30 @@
+{ lib
+, fetchFromSourcehut
+, buildGoModule
+}:
+
+buildGoModule rec {
+  pname = "pagessrht";
+  version = "0.5.2";
+
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "pages.sr.ht";
+    rev = version;
+    sha256 = "sha256-yEM122uhF0MNkMlNXyvBSfkLogRQETeuBl2K66kivac=";
+  };
+
+  vendorSha256 = "sha256-udr+1y5ApQCSPhs3yQTTi9QfzRbz0A9COYuFMjQGa74=";
+
+  postInstall = ''
+    mkdir -p $out/share/sql/
+    cp -r -t $out/share/sql/ schema.sql migrations
+  '';
+
+  meta = with lib; {
+    homepage = "https://git.sr.ht/~sircmpwn/pages.sr.ht";
+    description = "Web hosting service for the sr.ht network";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ eadwu ];
+  };
+}
--- a/pkgs/applications/version-management/sourcehut/paste.nix
+++ b/pkgs/applications/version-management/sourcehut/paste.nix
@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "pastesrht";
-  version = "0.12.1";
+  version = "0.13.6";

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "paste.sr.ht";
    rev = version;
-    sha256 = "sha256-QQhd2LeH9BLmlHilhsv+9fZ+RPNmEMSmOpFA3dsMBFc=";
+    sha256 = "sha256-Khcqk86iD9nxiKXN3+8mSLNoDau2qXNFOrLdkVu+rH8=";
  };

  nativeBuildInputs = srht.nativeBuildInputs;
@ -29,10 +29,12 @@ buildPythonPackage rec {
    export SRHT_PATH=${srht}/${python.sitePackages}/srht
  '';

+  pythonImportsCheck = [ "pastesrht" ];
+
  meta = with lib; {
    homepage = "https://git.sr.ht/~sircmpwn/paste.sr.ht";
    description = "Ad-hoc text file hosting service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
    maintainers = with maintainers; [ eadwu ];
  };
 }
--- a/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/0001-Revert-Add-build-submission-and-queue-monitoring.patch
+++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/0001-Revert-Add-build-submission-and-queue-monitoring.patch
@ -0,0 +1,69 @@
+From 069b03f85847ed4a9223183b62ee53f420838911 Mon Sep 17 00:00:00 2001
+From: Julien Moutinho <julm+srht@sourcephile.fr>
+Date: Thu, 16 Dec 2021 04:54:24 +0100
+Subject: [PATCH builds.sr.ht] Revert "Add build submission and queue
+ monitoring"
+
+This reverts commit 690f1aa16c77e418dc40109cd5e8fdf4a7ed947a.
+
+This has broken Unix socket support for Redis
+See https://lists.sr.ht/~sircmpwn/sr.ht-dev/%3C20211208082636.65665-1-me%40ignaskiela.eu%3E#%3C20211216033723.wefibfulfjhqnhem@sourcephile.fr%3E
+---
+ buildsrht/app.py    | 3 ---
+ buildsrht/runner.py | 9 +--------
+ 2 files changed, 1 insertion(+), 11 deletions(-)
+
+diff --git a/buildsrht/app.py b/buildsrht/app.py
+index e5321a2..7c9977c 100644
+--- a/buildsrht/app.py
+++ b/buildsrht/app.py
+@@ -36,9 +36,6 @@ class BuildApp(SrhtFlask):
+         self.register_blueprint(secrets)
+         self.register_blueprint(gql_blueprint)
+ 
+-        from buildsrht.runner import builds_queue_metrics_collector
+-        self.metrics_registry.register(builds_queue_metrics_collector)
+-
+         @self.context_processor
+         def inject():
+             return {
+diff --git a/buildsrht/runner.py b/buildsrht/runner.py
+index 7773452..0389c8e 100644
+--- a/buildsrht/runner.py
+++ b/buildsrht/runner.py
+@@ -5,13 +5,10 @@ from srht.config import cfg
+ from srht.database import db
+ from srht.email import send_email
+ from srht.oauth import UserType
+-from srht.metrics import RedisQueueCollector
+-from prometheus_client import Counter
+ 
+ allow_free = cfg("builds.sr.ht", "allow-free", default="no") == "yes"
+ 
+-builds_broker = cfg("builds.sr.ht", "redis")
+-runner = Celery('builds', broker=builds_broker, config_source={
+runner = Celery('builds', broker=cfg("builds.sr.ht", "redis"), config_source={
+     "CELERY_TASK_SERIALIZER": "json",
+     "CELERY_ACCEPT_CONTENT": ["json"],
+     "CELERY_RESULT_SERIALIZER": "json",
+@@ -19,9 +16,6 @@ runner = Celery('builds', broker=builds_broker, config_source={
+     "CELERY_TASK_PROTOCOL": 1
+ })
+ 
+-builds_queue_metrics_collector = RedisQueueCollector(builds_broker, "buildsrht_builds", "Number of builds currently in queue")
+-builds_submitted = Counter("buildsrht_builds_submited", "Number of builds submitted")
+-
+ def queue_build(job, manifest):
+     from buildsrht.types import JobStatus
+     job.status = JobStatus.queued
+@@ -34,7 +28,6 @@ def queue_build(job, manifest):
+                 cfg("sr.ht", "owner-email"),
+                 "Cryptocurrency mining attempt on builds.sr.ht")
+     else:
+-        builds_submitted.inc()
+         run_build.delay(job.id, manifest.to_dict())
+ 
+ def requires_payment(user):
+-- 
+2.34.0
+
--- a/pkgs/applications/version-management/sourcehut/patches/redis-socket/meta/0001-Revert-Add-webhook-queue-monitoring.patch
+++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/meta/0001-Revert-Add-webhook-queue-monitoring.patch
@ -0,0 +1,48 @@
+From d88bee195797c6c294320617ff14798da94cd0f3 Mon Sep 17 00:00:00 2001
+From: Julien Moutinho <julm+srht@sourcephile.fr>
+Date: Thu, 16 Dec 2021 04:52:08 +0100
+Subject: [PATCH meta.sr.ht] Revert "Add webhook queue monitoring"
+
+This reverts commit 9931df3c23094af5179df9ef019ca732b8125dac.
+
+This has broken Unix socket support for Redis.
+See https://lists.sr.ht/~sircmpwn/sr.ht-dev/%3C20211208082636.65665-1-me%40ignaskiela.eu%3E#%3C20211216033723.wefibfulfjhqnhem@sourcephile.fr%3E
+---
+ metasrht/app.py      | 3 ---
+ metasrht/webhooks.py | 5 +----
+ 2 files changed, 1 insertion(+), 7 deletions(-)
+
+diff --git a/metasrht/app.py b/metasrht/app.py
+index b190875..89c59bc 100644
+--- a/metasrht/app.py
+++ b/metasrht/app.py
+@@ -49,9 +49,6 @@ class MetaApp(SrhtFlask):
+             from metasrht.blueprints.billing import billing
+             self.register_blueprint(billing)
+ 
+-        from metasrht.webhooks import webhook_metrics_collector
+-        self.metrics_registry.register(webhook_metrics_collector)
+-
+         @self.context_processor
+         def inject():
+             return {
+diff --git a/metasrht/webhooks.py b/metasrht/webhooks.py
+index 3e1149e..3f0ba01 100644
+--- a/metasrht/webhooks.py
+++ b/metasrht/webhooks.py
+@@ -7,11 +7,8 @@ if not hasattr(db, "session"):
+     db.init()
+ from srht.webhook import Event
+ from srht.webhook.celery import CeleryWebhook, make_worker
+-from srht.metrics import RedisQueueCollector
+ 
+-webhook_broker = cfg("meta.sr.ht", "webhooks", "redis://")
+-worker = make_worker(broker=webhook_broker)
+-webhook_metrics_collector = RedisQueueCollector(webhook_broker, "srht_webhooks", "Webhook queue length")
+worker = make_worker(broker=cfg("meta.sr.ht", "webhooks", "redis://"))
+ 
+ class UserWebhook(CeleryWebhook):
+     events = [
+-- 
+2.34.0
+
--- a/pkgs/applications/version-management/sourcehut/scm.nix
+++ b/pkgs/applications/version-management/sourcehut/scm.nix
@ -5,18 +5,17 @@
 , redis
 , pyyaml
 , buildsrht
-, writeText
 }:

 buildPythonPackage rec {
  pname = "scmsrht";
-  version = "0.22.9";
+  version = "0.22.16"; # Untagged version

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "scm.sr.ht";
    rev = version;
-    sha256 = "sha256-327G6C8FW+iZx+167D7TQsFtV6FGc8MpMVo9L/cUUqU=";
+    sha256 = "sha256-A4Q7wUc4ag7KRWOkdYXCsbzuFHyJJsM15OjrCoVt9UQ=";
  };

  nativeBuildInputs = srht.nativeBuildInputs;
@ -33,11 +32,12 @@ buildPythonPackage rec {
  '';

  dontUseSetuptoolsCheck = true;
+  pythonImportsCheck = [ "scmsrht" ];

  meta = with lib; {
-    homepage = "https://git.sr.ht/~sircmpwn/git.sr.ht";
+    homepage = "https://git.sr.ht/~sircmpwn/scm.sr.ht";
    description = "Shared support code for sr.ht source control services.";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
    maintainers = with maintainers; [ eadwu ];
  };
 }
--- a/pkgs/applications/version-management/sourcehut/todo.nix
+++ b/pkgs/applications/version-management/sourcehut/todo.nix
@ -12,13 +12,13 @@

 buildPythonPackage rec {
  pname = "todosrht";
-  version = "0.64.14";
+  version = "0.66.1";

  src = fetchFromSourcehut {
    owner = "~sircmpwn";
    repo = "todo.sr.ht";
    rev = version;
-    sha256 = "sha256-huIAhn6h1F5w5ST4/yBwr82kAzyYwhLu+gpRuOQgnsE=";
+    sha256 = "sha256-P0xaQpK7O9zipGSIa5jL1O0L/fKt51EMNGt7XndYQ+g=";
  };

  nativeBuildInputs = srht.nativeBuildInputs;
@ -42,11 +42,12 @@ buildPythonPackage rec {
  ];

  dontUseSetuptoolsCheck = true;
+  pythonImportsCheck = [ "todosrht" ];

  meta = with lib; {
    homepage = "https://todo.sr.ht/~sircmpwn/todo.sr.ht";
    description = "Ticket tracking service for the sr.ht network";
-    license = licenses.agpl3;
+    license = licenses.agpl3Only;
    maintainers = with maintainers; [ eadwu ];
  };
 }
--- a/pkgs/applications/version-management/sourcehut/update.sh
+++ b/pkgs/applications/version-management/sourcehut/update.sh
@ -1,8 +1,11 @@
 #! /usr/bin/env nix-shell
 #! nix-shell -i bash -p git mercurial common-updater-scripts
+set -eux -o pipefail

-cd "$(dirname "${BASH_SOURCE[0]}")"
+cd "$(dirname "${BASH_SOURCE[0]}")" || exit 1
 root=../../../..
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT

 default() {
  (cd "$root" && nix-instantiate --eval --strict -A "sourcehut.python.pkgs.$1.meta.position" | sed -re 's/^"(.*):[0-9]+"$/\1/')
@ -13,42 +16,61 @@ version() {
 }

 src_url() {
-  (cd "$root" && nix-instantiate --eval --strict -A "sourcehut.python.pkgs.$1.src.drvAttrs.url" | tr -d '"')
+  nix-instantiate --eval --strict --expr " with import $root {}; let src = sourcehut.python.pkgs.$1.drvAttrs.src; in src.url or src.meta.homepage" | tr -d '"'
 }

 get_latest_version() {
  src="$(src_url "$1")"
-  tmp=$(mktemp -d)
-
+  rm -rf "$tmp"
  if [ "$1" = "hgsrht" ]; then
-    hg clone "$src" "$tmp" &> /dev/null
+    hg clone "$src" "$tmp" >/dev/null
    printf "%s" "$(cd "$tmp" && hg log --limit 1 --template '{latesttag}')"
  else
-    git clone "$src" "$tmp"
-    printf "%s" "$(cd "$tmp" && git describe $(git rev-list --tags --max-count=1))"
+    git clone "$src" "$tmp" >/dev/null
+    printf "%s" "$(cd "$tmp" && git describe "$(git rev-list --tags --max-count=1)")"
  fi
 }

 update_version() {
  default_nix="$(default "$1")"
-  version_old="$(version "$1")"
+  oldVersion="$(version "$1")"
  version="$(get_latest_version "$1")"

  (cd "$root" && update-source-version "sourcehut.python.pkgs.$1" "$version")

-  git add "$default_nix"
-  git commit -m "$1: $version_old -> $version"
+  # Update vendorSha256 of Go modules
+  retry=true
+  while "$retry"; do
+    retry=false;
+    exec < <(exec nix -L build -f "$root" sourcehut.python.pkgs."$1" 2>&1)
+    while IFS=' :' read -r origin hash; do
+      case "$origin" in
+        (expected|specified) oldHash="$hash";;
+        (got) sed -i "s|$oldHash|$hash|" "$default_nix"; retry=true; break;;
+        (*) printf >&2 "%s\n" "$origin${hash:+:$hash}"
+      esac
+    done
+  done
+
+  if [ "$oldVersion" != "$version" ]; then
+    git add "$default_nix"
+    git commit -m "sourcehut.$1: $oldVersion -> $version"
+  fi
 }

-services=( "srht" "buildsrht" "dispatchsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht"
-           "metasrht" "pastesrht" "todosrht" "scmsrht" )
-
-# Whether or not a specific service is requested
-if [ -n "$1" ]; then
-  version="$(get_latest_version "$1")"
-  (cd "$root" && update-source-version "sourcehut.python.pkgs.$1" "$version")
+if [ $# -gt 0 ]; then
+  services=("$@")
 else
-  for service in "${services[@]}"; do
-    update_version "$service"
-  done
+  # Beware that some packages must be updated before others,
+  # eg. buildsrht must be updated before gitsrht,
+  # otherwise this script would enter an infinite loop
+  # because the reported $oldHash to be changed
+  # may not actually be in $default_nix
+  # but in the file of one of its dependencies.
+  services=( "srht" "scmsrht" "buildsrht" "dispatchsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht"
+             "metasrht" "pagessrht" "pastesrht" "todosrht" )
 fi
+
+for service in "${services[@]}"; do
+  update_version "$service"
+done
--- a/pkgs/desktops/gnome/apps/gnome-power-manager/default.nix
+++ b/pkgs/desktops/gnome/apps/gnome-power-manager/default.nix
@ -51,7 +51,7 @@ in stdenv.mkDerivation rec {
  ];

  meta = with lib; {
-    homepage = "https://projects-old.gnome.org/gnome-power-manager/";
+    homepage = "https://gitlab.gnome.org/GNOME/gnome-power-manager";
    description = "View battery and power statistics provided by UPower";
    maintainers = teams.gnome.members;
    license = licenses.gpl2Plus;
--- a/pkgs/development/go-modules/generic/default.nix
+++ b/pkgs/development/go-modules/generic/default.nix
@ -71,6 +71,7 @@ let
    inherit (go) GOOS GOARCH;

    patches = args.patches or [];
+    patchFlags = args.patchFlags or [];
    preBuild = args.preBuild or "";
    sourceRoot = args.sourceRoot or "";

--- a/pkgs/development/interpreters/lfe/generic-builder.nix
+++ b/pkgs/development/interpreters/lfe/generic-builder.nix
@ -83,7 +83,7 @@ buildRebar3 {
      code. An LFE evaluator and shell is also included.
    '';

-    homepage     = "http://lfe.io";
+    homepage     = "https://lfe.io";
    downloadPage = "https://github.com/rvirding/lfe/releases";

    license      = licenses.asl20;
--- a/pkgs/development/libraries/gf2x/default.nix
+++ b/pkgs/development/libraries/gf2x/default.nix
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Routines for fast arithmetic in GF(2)[x]";
-    homepage = "http://gf2x.gforge.inria.fr";
+    homepage = "https://gitlab.inria.fr/gf2x/gf2x/";
    license = licenses.gpl2Plus;
    maintainers = teams.sage.members;
    platforms = platforms.unix;
--- a/pkgs/development/libraries/grantlee/5/default.nix
+++ b/pkgs/development/libraries/grantlee/5/default.nix
@ -46,7 +46,7 @@ mkDerivation rec {
      The syntax is intended to follow the syntax of the Django template system,
      and the design of Django is reused in Grantlee.'';

-    homepage = "http://gitorious.org/grantlee";
+    homepage = "https://github.com/steveire/grantlee";
    maintainers = [ maintainers.ttuegel ];
    license = licenses.lgpl21;
    inherit (qtbase.meta) platforms;
--- a/pkgs/development/libraries/grantlee/default.nix
+++ b/pkgs/development/libraries/grantlee/default.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
      The syntax is intended to follow the syntax of the Django template system,
      and the design of Django is reused in Grantlee.'';

-    homepage = "http://gitorious.org/grantlee";
+    homepage = "https://github.com/steveire/grantlee";
    license = lib.licenses.lgpl21;
    inherit (qt4.meta) platforms;
  };
--- a/pkgs/development/libraries/gtksourceviewmm/4.x.nix
+++ b/pkgs/development/libraries/gtksourceviewmm/4.x.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    platforms = platforms.linux;
-    homepage = "https://developer.gnome.org/gtksourceviewmm/";
+    homepage = "https://gitlab.gnome.org/GNOME/gtksourceviewmm";
    description = "C++ wrapper for gtksourceview";
    license = licenses.lgpl2;
    maintainers = teams.gnome.members;
--- a/pkgs/development/libraries/gtksourceviewmm/default.nix
+++ b/pkgs/development/libraries/gtksourceviewmm/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    platforms = platforms.unix;
-    homepage = "https://developer.gnome.org/gtksourceviewmm/";
+    homepage = "https://gitlab.gnome.org/GNOME/gtksourceviewmm";
    description = "C++ wrapper for gtksourceview";
    license = licenses.lgpl2;
    maintainers = [ maintainers.juliendehos ];
--- a/pkgs/development/libraries/libnotify/default.nix
+++ b/pkgs/development/libraries/libnotify/default.nix
@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
  };

  meta = with lib; {
-    homepage = "https://developer.gnome.org/notification-spec/";
+    homepage = "https://gitlab.gnome.org/GNOME/libnotify";
    description = "A library that sends desktop notifications to a notification daemon";
    platforms = platforms.unix;
    maintainers = teams.gnome.members;
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@ -605,7 +605,7 @@ buildLuarocksPackage {
  propagatedBuildInputs = [ lua ];

  meta = {
-    homepage = "http://github.com/pavouk/lgi";
+    homepage = "https://github.com/pavouk/lgi";
    description = "Lua bindings to GObject libraries";
    license.fullName = "MIT/X11";
  };
--- a/pkgs/development/python-modules/angrcli/default.nix
+++ b/pkgs/development/python-modules/angrcli/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "angrcli";
-  version = "1.1.1";
+  version = "1.2.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "fmagin";
    repo = "angr-cli";
    rev = "v${version}";
-    sha256 = "0mz3yzsw08xwpj6188rxmr7darilh4ismcnh8nhp9945wjyzl4kr";
+    sha256 = "sha256-a5ajUBQwt3xUNkeSOeGOAFf47wd4UVk+LcuAHGqbq4s=";
  };

  propagatedBuildInputs = [
@ -35,9 +35,6 @@ buildPythonPackage rec {
  ];

  postPatch = ''
-    # Version mismatch, https://github.com/fmagin/angr-cli/pull/11
-    substituteInPlace setup.py \
-      --replace "version='1.1.0'," "version='${version}',"
    substituteInPlace tests/test_derefs.py \
      --replace "/bin/ls" "${coreutils}/bin/ls"
  '';
--- a/pkgs/development/python-modules/apache-airflow/default.nix
+++ b/pkgs/development/python-modules/apache-airflow/default.nix
@ -234,7 +234,7 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Programmatically author, schedule and monitor data pipelines";
-    homepage = "http://airflow.apache.org/";
+    homepage = "https://airflow.apache.org/";
    license = licenses.asl20;
    maintainers = with maintainers; [ bhipple costrouc ingenieroariel ];
  };
--- a/pkgs/development/python-modules/certifi/default.nix
+++ b/pkgs/development/python-modules/certifi/default.nix
@ -25,7 +25,7 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "certifi" ];

  meta = with lib; {
-    homepage = "https://certifi.io/";
+    homepage = "https://github.com/certifi/python-certifi";
    description = "Python package for providing Mozilla's CA Bundle";
    license = licenses.isc;
    maintainers = with maintainers; [ koral ];
--- a/pkgs/development/python-modules/certifi/python2.nix
+++ b/pkgs/development/python-modules/certifi/python2.nix
@ -26,7 +26,7 @@ in buildPythonPackage rec {
  doCheck = false;

  meta = with lib; {
-    homepage = "https://certifi.io/";
+    homepage = "https://github.com/certifi/python-certifi";
    description = "Python package for providing Mozilla's CA Bundle";
    license = licenses.isc;
    maintainers = with maintainers; [ ]; # NixOps team
--- a/pkgs/development/python-modules/iso4217/default.nix
+++ b/pkgs/development/python-modules/iso4217/default.nix
@ -2,27 +2,34 @@
 , buildPythonPackage
 , fetchFromGitHub
 , fetchurl
+, importlib-resources
 , pytestCheckHook
 , python
+, pythonOlder
 }:
 let
  table = fetchurl {
-    # See https://github.com/dahlia/iso4217/blob/main/setup.py#L18
+    # See https://github.com/dahlia/iso4217/blob/main/setup.py#L19
    url = "http://www.currency-iso.org/dam/downloads/lists/list_one.xml";
-    sha256 = "0frhicc7s8gqglr41hzx61fic3ckvr4sg773ahp1s28n5by3y7ac";
+    hash = "sha256-bp8uTMR1YRaI2cJLo0kdt9xD4nNaWK+LdlheWQ26qy0=";
  };
 in
 buildPythonPackage rec {
  pname = "iso4217";
-  version = "1.6";
+  version = "1.7";
+  format = "setuptools";

  src = fetchFromGitHub {
    owner = "dahlia";
    repo = pname;
    rev = version;
-    sha256 = "0mdpf5a0xr5lrcfgvqi1sdn7ln2w6pkc3lg0laqkbx5mhxky0fla";
+    hash = "sha256-Ih2l6bGM7i5TUkzJPkgx8EOOL4a3/qE28SUZS6M4sQc=";
  };

+  propagatedBuildInputs = lib.optionals (pythonOlder "3.9") [
+    importlib-resources
+  ];
+
  checkInputs = [
    pytestCheckHook
  ];
@ -39,9 +46,13 @@ buildPythonPackage rec {
    cp -r ${table} $out/${python.sitePackages}/$pname/table.xml
  '';

-  pytestFlagsArray = [ "$pname/test.py" ];
+  pytestFlagsArray = [
+    "$pname/test.py"
+  ];

-  pythonImportsCheck = [ "iso4217" ];
+  pythonImportsCheck = [
+    "iso4217"
+  ];

  meta = with lib; {
    description = "ISO 4217 currency data package for Python";
--- a/pkgs/development/python-modules/pipx/default.nix
+++ b/pkgs/development/python-modules/pipx/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "pipx";
-  version = "0.16.5";
+  version = "0.17.0";

  disabled = pythonOlder "3.6";

@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "pipxproject";
    repo = pname;
    rev = version;
-    sha256 = "sha256-gBeaHEig47XWKoPx3jzvgk/jJPJXtr5R5qUL0LgvbDg=";
+    sha256 = "sha256-vR/tKV+ZB0nZaxEcB83dwoSI7kBC1rA+6fo30rizroM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pyupgrade/default.nix
+++ b/pkgs/development/python-modules/pyupgrade/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "pyupgrade";
-  version = "2.29.1";
+  version = "2.30.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "asottile";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-fN0+4/EeoMD2c16OgepjDWuUhowMxzM7nB3mkL3iDjc=";
+    sha256 = "sha256-Fku95ar5i+QV21GhomO6/ivlJcnOhPyximyPsh2/dc0=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/types-pytz/default.nix
+++ b/pkgs/development/python-modules/types-pytz/default.nix
@ -5,17 +5,20 @@

 buildPythonPackage rec {
  pname = "types-pytz";
-  version = "2021.3.2";
+  version = "2021.3.3";
+  format = "setuptools";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-xO42Rm+u2a8zTRUJPQXOpBYyPS0EMVi7WCu5TAQav1E=";
+    sha256 = "sha256-9tIdZoeTWhYV20ZLHh34ANGVAsNrwEhvQ759/SxASUc=";
  };

  # Modules doesn't have tests
  doCheck = false;

-  pythonImportsCheck = [ "pytz-stubs" ];
+  pythonImportsCheck = [
+    "pytz-stubs"
+  ];

  meta = with lib; {
    description = "Typing stubs for pytz";
--- a/pkgs/development/tools/build-managers/apache-ant/default.nix
+++ b/pkgs/development/tools/build-managers/apache-ant/default.nix
@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
    ''; # */

  meta = {
-    homepage = "http://ant.apache.org/";
+    homepage = "https://ant.apache.org/";
    description = "A Java-based build tool";

    longDescription = ''
--- a/pkgs/development/tools/rust/rust-analyzer/default.nix
+++ b/pkgs/development/tools/rust/rust-analyzer/default.nix
@ -11,23 +11,20 @@

 rustPlatform.buildRustPackage rec {
  pname = "rust-analyzer-unwrapped";
-  version = "2021-12-13";
-  cargoSha256 = "sha256-VF4pwSl3Wei7KxyQFOPj7hVX/NG2zImRLv4iN+ijAs8=";
+  version = "2021-12-27";
+  cargoSha256 = "sha256-yok7kLcvKvDwrdgJR0540QLJi5/zXi0NyZxhtoQ8Xno=";

  src = fetchFromGitHub {
    owner = "rust-analyzer";
    repo = "rust-analyzer";
    rev = version;
-    sha256 = "sha256-xt7iDfIoaBhStgqsgttyOFF4NYPQ8jeVwDoYUwrvtrA=";
+    sha256 = "sha256-/195+NsV6Mku2roi8zVy4dw8QGL6rQcnPcQ29Os8oqs=";
  };

  patches = [
    # Code format and git history check require more dependencies but don't really matter for packaging.
    # So just ignore them.
    ./ignore-git-and-rustfmt-tests.patch
-
-    # Remove when we have rustc >= 1.57.0.
-    ./no-1-57-map-while.patch
  ];

  buildAndTestSubdir = "crates/rust-analyzer";
--- a/pkgs/development/tools/rust/rust-analyzer/no-1-57-map-while.patch
+++ b/pkgs/development/tools/rust/rust-analyzer/no-1-57-map-while.patch
@ -1,20 +0,0 @@
--- a/crates/ide_db/src/helpers.rs
-+++ b/crates/ide_db/src/helpers.rs
-@@ -309,7 +309,7 @@ pub fn lint_eq_or_in_group(lint: &str, lint_is: &str) -> bool {
- pub fn parse_tt_as_comma_sep_paths(input: ast::TokenTree) -> Option<Vec<ast::Path>> {
-     let r_paren = input.r_paren_token();
-     let tokens =
-        input.syntax().children_with_tokens().skip(1).map_while(|it| match it.into_token() {
-+        input.syntax().children_with_tokens().skip(1).map(|it| match it.into_token() {
-             // seeing a keyword means the attribute is unclosed so stop parsing here
-             Some(tok) if tok.kind().is_keyword() => None,
-             // don't include the right token tree parenthesis if it exists
-@@ -317,7 +317,7 @@ pub fn parse_tt_as_comma_sep_paths(input: ast::TokenTree) -> Option<Vec<ast::Pat
-             // only nodes that we can find are other TokenTrees, those are unexpected in this parse though
-             None => None,
-             Some(tok) => Some(tok),
-        });
-+        }).take_while(|tok| tok.is_some()).map(|tok| tok.unwrap());
-     let input_expressions = tokens.into_iter().group_by(|tok| tok.kind() == T![,]);
-     let paths = input_expressions
-         .into_iter()
--- a/pkgs/os-specific/linux/phc-intel/default.nix
+++ b/pkgs/os-specific/linux/phc-intel/default.nix
@ -44,8 +44,7 @@ in stdenv.mkDerivation rec {
      while noticably reducing fan noise. This driver works only on supported
      Intel architectures.
    '';
-    homepage = "http://www.linux-phc.org/";
-    downloadPage = "http://www.linux-phc.org/forum/viewtopic.php?f=7&t=267";
+    homepage = "https://github.com/danielw86dev/phc-intel-dkms";
    license = licenses.gpl2;
    platforms = [ "x86_64-linux" "i686-linux" ];
    broken = lib.versionAtLeast kernel.version "4.18";
--- a/pkgs/servers/apache-kafka/default.nix
+++ b/pkgs/servers/apache-kafka/default.nix
@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    homepage = "http://kafka.apache.org";
+    homepage = "https://kafka.apache.org";
    description = "A high-throughput distributed messaging system";
    license = licenses.asl20;
    maintainers = [ maintainers.ragge ];
--- a/pkgs/servers/heisenbridge/default.nix
+++ b/pkgs/servers/heisenbridge/default.nix
@ -2,23 +2,15 @@

 python3Packages.buildPythonApplication rec {
  pname = "heisenbridge";
-  version = "1.7.1";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "hifi";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-q1Rj8BehvYnV/Kah5YKAxBUz4j9WziSqn1fVeaKpy7g=";
+    sha256 = "173prcd56rwlxjxlw67arnm12k1l317xi5s6m7jhmp8zbbrj5vwr";
  };

-  patches = [
-    # Compatibility with aiohttp 3.8.0
-    (fetchpatch {
-      url = "https://github.com/hifi/heisenbridge/commit/cff5d33e0b617e6cf3a44dc00c72b98743175c9e.patch";
-      sha256 = "sha256-y5X4mWvX1bq0XNZNTYUc0iK3SzvaHpS7px53I7xC9c8=";
-    })
-  ];
-
  postPatch = ''
    echo "${version}" > heisenbridge/version.txt
  '';
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -320,6 +320,7 @@ in with py.pkgs; buildPythonApplication rec {
    ciso8601
    cryptography
    httpx
+    ifaddr
    jinja2
    pip
    pyjwt
--- a/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix
+++ b/pkgs/servers/mail/dovecot/plugins/fts_xapian/default.nix
@ -31,5 +31,6 @@ stdenv.mkDerivation rec {
    license = licenses.lgpl21Only;
    maintainers = with maintainers; [ julm symphorien ];
    platforms = platforms.unix;
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/dovecot_fts_xapian.x86_64-darwin
  };
 }
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@ -85,7 +85,7 @@ let
  };

  getMeta = description: with lib; {
-     homepage = "https://ceph.com/";
+     homepage = "https://ceph.io/";
     inherit description;
     license = with licenses; [ lgpl21 gpl2 bsd3 mit publicDomain ];
     maintainers = with maintainers; [ adev ak johanot krav ];
--- a/pkgs/tools/graphics/ibniz/default.nix
+++ b/pkgs/tools/graphics/ibniz/default.nix
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Virtual machine designed for extremely compact low-level audiovisual programs";
-    homepage = "http://www.pelulamu.net/ibniz/";
+    homepage = "https://github.com/viznut/IBNIZ";
    license = licenses.zlib;
    platforms = platforms.linux;
    maintainers = [ maintainers.dezgeg ];
--- a/pkgs/tools/misc/libbitcoin/libbitcoin-network.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-network.nix
@ -28,7 +28,7 @@ in stdenv.mkDerivation {

  meta = with lib; {
    description = "Bitcoin P2P Network Library";
-    homepage = "https://libbitcoin.org/";
+    homepage = "https://libbitcoin.info/";
    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ asymmetric ];

--- a/pkgs/tools/misc/libbitcoin/libbitcoin-protocol.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin-protocol.nix
@ -29,7 +29,7 @@ in stdenv.mkDerivation {

  meta = with lib; {
    description = "Bitcoin Blockchain Query Protocol";
-    homepage = "https://libbitcoin.org/";
+    homepage = "https://libbitcoin.info/";
    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ asymmetric ];

--- a/pkgs/tools/misc/libbitcoin/libbitcoin.nix
+++ b/pkgs/tools/misc/libbitcoin/libbitcoin.nix
@ -29,7 +29,7 @@ in stdenv.mkDerivation {

  meta = with lib; {
    description = "C++ library for building bitcoin applications";
-    homepage = "https://libbitcoin.org/";
+    homepage = "https://libbitcoin.info/";
    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ ];

--- a/pkgs/tools/security/rekor/default.nix
+++ b/pkgs/tools/security/rekor/default.nix
@ -4,20 +4,20 @@ let
  generic = { pname, packageToBuild, description }:
    buildGoModule rec {
      inherit pname;
-      version = "0.3.0";
+      version = "0.4.0";

      src = fetchFromGitHub {
        owner = "sigstore";
        repo = "rekor";
        rev = "v${version}";
-        sha256 = "sha256-FaVZm9C1pewJCZlYgNyD/ZYr/UIRvhqVTUhFTmysxeg=";
+        sha256 = "sha256-15p4hm4Cvs/yLaQIcxctVdMKRWPjIIFwBcbru6QcjXo=";
      };

-      vendorSha256 = "sha256-EBKj/+ruE88qvlbOme4GBfAqt3/1jHcqhY0IHxh6Y5U=";
+      vendorSha256 = "sha256-XCCO4Vamzj5pJFmu1A8mpTLlVAtocrn20myYJVWtBrY=";

      subPackages = [ packageToBuild ];

-      ldflags = [ "-s" "-w" "-X github.com/sigstore/rekor/${packageToBuild}/app.gitVersion=v${version}" ];
+      ldflags = [ "-s" "-w" "-X github.com/sigstore/rekor/${packageToBuild}/app.GitVersion=v${version}" ];

      meta = with lib; {
        inherit description;
--- a/pkgs/tools/security/scorecard/default.nix
+++ b/pkgs/tools/security/scorecard/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "scorecard";
-  version = "3.0.1";
+  version = "3.2.1";

  src = fetchFromGitHub {
    owner = "ossf";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-19XDAgv9ARCZ7eNlWUPcsbGNyKA9vYFry8m6D3+vQP8=";
+    sha256 = "sha256-MVFhw/r1sws82oofV4LHmiSlKxyYd8abYq8oFiB0HH8=";
    # populate values otherwise taken care of by goreleaser,
    # unfortunately these require us to use git. By doing
    # this in postFetch we can delete .git afterwards and
@ -27,7 +27,7 @@ buildGoModule rec {
      find "$out" -name .git -print0 | xargs -0 rm -rf
    '';
  };
-  vendorSha256 = "sha256-ucF26pTEvG8tkzsyC9WNbvl8QCeetKBvBIcQL2NTfjo=";
+  vendorSha256 = "sha256-WrM2aE0z6SnfoPEBqgn1TO6sSGPMrQvL6+ddvOS2w1k=";

  # Install completions post-install
  nativeBuildInputs = [ installShellFiles ];