Merge master into staging-next

nixos/lib/systemd-lib.nix

@@ -187,11 +187,14 @@ in rec {
         done
       done
 
-      # Symlink all units defined by systemd.units. If these are also
-      # provided by systemd or systemd.packages, then add them as
+      # Symlink units defined by systemd.units where override strategy
+      # shall be automatically detected. If these are also provided by
+      # systemd or systemd.packages, then add them as
       # <unit-name>.d/overrides.conf, which makes them extend the
       # upstream unit.
-      for i in ${toString (mapAttrsToList (n: v: v.unit) units)}; do
+      for i in ${toString (mapAttrsToList
+          (n: v: v.unit)
+          (lib.filterAttrs (n: v: (attrByPath [ "overrideStrategy" ] "asDropinIfExists" v) == "asDropinIfExists") units))}; do
         fn=$(basename $i/*)
         if [ -e $out/$fn ]; then
           if [ "$(readlink -f $i/$fn)" = /dev/null ]; then
@@ -210,6 +213,16 @@ in rec {
         fi
       done
 
+      # Symlink units defined by systemd.units which shall be
+      # treated as drop-in file.
+      for i in ${toString (mapAttrsToList
+          (n: v: v.unit)
+          (lib.filterAttrs (n: v: v ? overrideStrategy && v.overrideStrategy == "asDropin") units))}; do
+        fn=$(basename $i/*)
+        mkdir -p $out/$fn.d
+        ln -s $i/$fn $out/$fn.d/overrides.conf
+      done
+
       # Create service aliases from aliases option.
       ${concatStrings (mapAttrsToList (name: unit:
           concatMapStrings (name2: ''
@@ -340,7 +353,7 @@ in rec {
     '';
 
   targetToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy enable;
+    { inherit (def) aliases wantedBy requiredBy enable overrideStrategy;
       text =
         ''
           [Unit]
@@ -349,7 +362,7 @@ in rec {
     };
 
   serviceToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy enable;
+    { inherit (def) aliases wantedBy requiredBy enable overrideStrategy;
       text = commonUnitText def +
         ''
           [Service]
@@ -371,7 +384,7 @@ in rec {
     };
 
   socketToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy enable;
+    { inherit (def) aliases wantedBy requiredBy enable overrideStrategy;
       text = commonUnitText def +
         ''
           [Socket]
@@ -382,7 +395,7 @@ in rec {
     };
 
   timerToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy enable;
+    { inherit (def) aliases wantedBy requiredBy enable overrideStrategy;
       text = commonUnitText def +
         ''
           [Timer]
@@ -391,7 +404,7 @@ in rec {
     };
 
   pathToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy enable;
+    { inherit (def) aliases wantedBy requiredBy enable overrideStrategy;
       text = commonUnitText def +
         ''
           [Path]
@@ -400,7 +413,7 @@ in rec {
     };
 
   mountToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy enable;
+    { inherit (def) aliases wantedBy requiredBy enable overrideStrategy;
       text = commonUnitText def +
         ''
           [Mount]
@@ -409,7 +422,7 @@ in rec {
     };
 
   automountToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy enable;
+    { inherit (def) aliases wantedBy requiredBy enable overrideStrategy;
       text = commonUnitText def +
         ''
           [Automount]
@@ -418,7 +431,7 @@ in rec {
     };
 
   sliceToUnit = name: def:
-    { inherit (def) aliases wantedBy requiredBy enable;
+    { inherit (def) aliases wantedBy requiredBy enable overrideStrategy;
       text = commonUnitText def +
         ''
           [Slice]

nixos/lib/systemd-unit-options.nix

@@ -48,6 +48,22 @@ in rec {
       '';
     };
 
+    overrideStrategy = mkOption {
+      default = "asDropinIfExists";
+      type = types.enum [ "asDropinIfExists" "asDropin" ];
+      description = lib.mdDoc ''
+        Defines how unit configuration is provided for systemd:
+
+        `asDropinIfExists` creates a unit file when no unit file is provided by the package
+        otherwise a drop-in file name `overrides.conf`.
+
+        `asDropin` creates a drop-in file named `overrides.conf`.
+        Mainly needed to define instances for systemd template units (e.g. `systemd-nspawn@mycontainer.service`).
+
+        See also systemd.unit(1).
+      '';
+    };
+
     requiredBy = mkOption {
       default = [];
       type = types.listOf unitNameType;

nixos/modules/services/networking/mosquitto.nix

@@ -56,8 +56,10 @@ let
         default = null;
         description = mdDoc ''
           Specifies the hashed password for the MQTT User.
-          To generate hashed password install `mosquitto`
-          package and use `mosquitto_passwd`.
+          To generate hashed password install the `mosquitto`
+          package and use `mosquitto_passwd`, then extract
+          the second field (after the `:`) from the generated
+          file.
         '';
       };
 
@@ -68,8 +70,9 @@ let
         description = mdDoc ''
           Specifies the path to a file containing the
           hashed password for the MQTT user.
-          To generate hashed password install `mosquitto`
-          package and use `mosquitto_passwd`.
+          To generate hashed password install the `mosquitto`
+          package and use `mosquitto_passwd`, then remove the
+          `username:` prefix from the generated file.
         '';
       };
 

nixos/tests/mosquitto.nix

@@ -4,7 +4,7 @@ let
   port = 1888;
   tlsPort = 1889;
   anonPort = 1890;
-  bindTestPort = 1891;
+  bindTestPort = 18910;
   password = "VERY_secret";
   hashedPassword = "$7$101$/WJc4Mp+I+uYE9sR$o7z9rD1EYXHPwEP5GqQj6A7k4W1yVbePlb8TqNcuOLV9WNCiDgwHOB0JHC1WCtdkssqTBduBNUnUGd6kmZvDSw==";
   topic = "test/foo";
@@ -165,6 +165,10 @@ in {
         for t in threads: t.start()
         for t in threads: t.join()
 
+    def wait_uuid(uuid):
+        server.wait_for_console_text(uuid)
+        return None
+
 
     start_all()
     server.wait_for_unit("mosquitto.service")
@@ -203,14 +207,14 @@ in {
         parallel(
             lambda: client1.succeed(subscribe("-i 3688cdd7-aa07-42a4-be22-cb9352917e40", "reader")),
             lambda: [
-                server.wait_for_console_text("3688cdd7-aa07-42a4-be22-cb9352917e40"),
+                wait_uuid("3688cdd7-aa07-42a4-be22-cb9352917e40"),
                 client2.succeed(publish("-m test", "writer"))
             ])
 
         parallel(
             lambda: client1.fail(subscribe("-i 24ff16a2-ae33-4a51-9098-1b417153c712", "reader")),
             lambda: [
-                server.wait_for_console_text("24ff16a2-ae33-4a51-9098-1b417153c712"),
+                wait_uuid("24ff16a2-ae33-4a51-9098-1b417153c712"),
                 client2.succeed(publish("-m test", "reader"))
             ])
 
@@ -229,7 +233,7 @@ in {
             lambda: client1.succeed(subscribe("-i fd56032c-d9cb-4813-a3b4-6be0e04c8fc3",
                 "anonReader", port=${toString anonPort})),
             lambda: [
-                server.wait_for_console_text("fd56032c-d9cb-4813-a3b4-6be0e04c8fc3"),
+                wait_uuid("fd56032c-d9cb-4813-a3b4-6be0e04c8fc3"),
                 client2.succeed(publish("-m test", "anonWriter", port=${toString anonPort}))
             ])
   '';

nixos/tests/systemd-machinectl.nix

@@ -44,6 +44,14 @@ import ./make-test-python.nix ({ pkgs, ... }:
 
       # not needed, but we want to test the nspawn file generation
       systemd.nspawn.${containerName} = { };
+
+      systemd.services."systemd-nspawn@${containerName}" = {
+        serviceConfig.Environment = [
+          # Disable tmpfs for /tmp
+          "SYSTEMD_NSPAWN_TMPFS_TMP=0"
+        ];
+        overrideStrategy = "asDropin";
+      };
     };
 
     testScript = ''
@@ -95,6 +103,9 @@ import ./make-test-python.nix ({ pkgs, ... }:
       machine.succeed("machinectl stop ${containerName}");
       machine.wait_until_succeeds("test $(systemctl is-active systemd-nspawn@${containerName}) = inactive");
 
+      # Test tmpfs for /tmp
+      machine.fail("mountpoint /tmp");
+
       # Show to to delete the container
       machine.succeed("chattr -i ${containerRoot}/var/empty");
       machine.succeed("rm -rf ${containerRoot}");

pkgs/applications/audio/mmtc/default.nix

@@ -2,25 +2,25 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mmtc";
-  version = "0.2.15";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "figsoda";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-GQ1SoZE74o8fsXHVdjdEMbdUeefyPb4FXxidcHCy180=";
+    sha256 = "sha256-fWd349IDlN6XNv7MrqJeLwkmevZoKXLSz8a09YWsNcI=";
   };
 
-  cargoSha256 = "sha256-2IcOwjYTRl2tCB/YAuDACpgaRKZ/21IKWpVs+koYH3k=";
+  cargoSha256 = "sha256-WrEC3zWwY1plOn8DrspbJFI3R/fE6yDQT2u2lVubbQU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
-  preFixup = ''
-    completions=($releaseDir/build/mmtc-*/out/completions)
-    installShellCompletion $completions/mmtc.{bash,fish} --zsh $completions/_mmtc
+  postInstall = ''
+    installManPage artifacts/mmtc.1
+    installShellCompletion artifacts/mmtc.{bash,fish} --zsh artifacts/_mmtc
   '';
 
-  GEN_COMPLETIONS = 1;
+  GEN_ARTIFACTS = "artifacts";
 
   meta = with lib; {
     description = "Minimal mpd terminal client that aims to be simple yet highly configurable";

pkgs/applications/editors/emacs/elisp-packages/emacspeak/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "emacspeak";
-  version = "54.0";
+  version = "56.0";
 
   src = fetchFromGitHub {
     owner = "tvraman";
     repo = pname;
     rev = version;
-    hash= "sha256-aOZ8PmkASJKETPhXhE9WQXyJS7SPe+d97fK/piqqzqc=";
+    hash= "sha256-juy+nQ7DrG818/uTH6Dv/lrrzu8qzPWwi0sX7JrhHK8=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/plover/default.nix

@@ -1,5 +1,4 @@
-{ lib, fetchFromGitHub, python27Packages, python3Packages, wmctrl,
-  qtbase, mkDerivationWith }:
+{ lib, fetchFromGitHub, python3Packages, wmctrl, qtbase, mkDerivationWith }:
 
 {
   stable = throw "plover.stable was removed because it used Python 2. Use plover.dev instead."; # added 2022-06-05

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -3,7 +3,7 @@ let
   versions = if stdenv.isLinux then {
     stable = "0.0.21";
     ptb = "0.0.34";
-    canary = "0.0.140";
+    canary = "0.0.142";
   } else {
     stable = "0.0.264";
     ptb = "0.0.59";
@@ -22,7 +22,7 @@ let
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        sha256 = "sha256-AEbjkAMeOJ48RVgbVj35Rp26klCsCsDCX+VD5u1xCM0=";
+        sha256 = "sha256-/EWJC3hFIBqwHa9z4nMWR7CpoaqYY+pvw+1vcq4F0LU=";
       };
     };
     aarch64-darwin = {

pkgs/applications/version-management/git-repo/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "2.29.4";
+  version = "2.29.5";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    sha256 = "sha256-oUPY10B6JHixdfgi5BHzrg9nZ1DlFUhQyuXJj2fCSM4=";
+    sha256 = "sha256-eMuQ0cVVbLvpDsGCob8s7D1Q+52Q2gOHTg7anP5KVAc=";
   };
 
   # Fix 'NameError: name 'ssl' is not defined'

pkgs/development/interpreters/python/default.nix

@@ -33,9 +33,12 @@
     }: let
       pythonPackages = let
         ensurePythonModules = items: let
+          exceptions = [
+            stdenv
+          ];
           providesSetupHook = lib.attrByPath [ "provides" "setupHook"] false;
-          notValid = value: (lib.isDerivation value) && !((pythonPackages.hasPythonModule value) || (providesSetupHook value));
-          func = name: value: if !(notValid value) then value else throw "${name} should use `buildPythonPackage` or `toPythonModule` if it is to be part of the Python packages set.";
+          valid = value: !((lib.isDerivation value) && !((pythonPackages.hasPythonModule value) || (providesSetupHook value))) || (lib.elem value exceptions);
+          func = name: value: if (valid value) then value else throw "${name} should use `buildPythonPackage` or `toPythonModule` if it is to be part of the Python packages set.";
         in lib.mapAttrs func items;
       in ensurePythonModules (callPackage
         # Function that when called

pkgs/development/libraries/cxxtest/default.nix

@@ -1,6 +1,6 @@
-{ lib, buildPythonApplication, fetchFromGitHub }:
+{ lib, python3Packages, fetchFromGitHub }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "cxxtest";
   version = "4.4";
 
@@ -13,15 +13,26 @@ buildPythonApplication rec {
 
   sourceRoot = "source/python";
 
+  checkInputs = [ python3Packages.ply ];
+
+  preCheck = ''
+    cd ../
+  '';
+
   postCheck = ''
-    python scripts/cxxtestgen --error-printer -o build/GoodSuite.cpp ../test/GoodSuite.h
-    $CXX -I.. -o build/GoodSuite build/GoodSuite.cpp
+    cd python3
+    python scripts/cxxtestgen --error-printer -o build/GoodSuite.cpp ../../test/GoodSuite.h
+    $CXX -I../../ -o build/GoodSuite build/GoodSuite.cpp
     build/GoodSuite
   '';
 
+  preInstall = ''
+    cd python3
+  '';
+
   postInstall = ''
     mkdir -p "$out/include"
-    cp -r ../cxxtest "$out/include"
+    cp -r ../../cxxtest "$out/include"
   '';
 
   dontWrapPythonPrograms = true;
@@ -29,8 +40,8 @@ buildPythonApplication rec {
   meta = with lib; {
     homepage = "http://cxxtest.com";
     description = "Unit testing framework for C++";
-    platforms = platforms.unix;
     license = licenses.lgpl3;
-    maintainers = [ maintainers.juliendehos ];
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ juliendehos ];
   };
 }

pkgs/development/node-packages/overrides.nix

@@ -191,6 +191,12 @@ final: prev: {
 
   graphite-cli = prev."@withgraphite/graphite-cli".override {
     name = "graphite-cli";
+    nativeBuildInputs = [ pkgs.installShellFiles ];
+    postInstall = ''
+      installShellCompletion --cmd gt \
+        --bash <($out/bin/gt completion) \
+        --zsh <($out/bin/gt completion)
+    '';
   };
 
   graphql-language-service-cli = prev.graphql-language-service-cli.override {

pkgs/development/python-modules/fastbencode/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "fastbencode";
-  version = "0.0.15";
+  version = "0.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-A1XfgjNV9k4iA3HYf0HlA1CvpwzFh52OaN7f6YLgU+I=";
+    hash = "sha256-wal451pQSLuoM9kNbnSKVZUMqLWfEukXwqLI58p+tvU=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/flask-testing/default.nix

@@ -38,6 +38,8 @@ buildPythonPackage rec {
     "test_assert_redirects"
     "test_server_listening"
     "test_server_process_is_spawned"
+    # change in repr(template) in recent flask
+    "test_assert_template_rendered_signal_sent"
   ];
 
   disabledTestPaths = [

pkgs/development/python-modules/rpyc/default.nix

@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, hatchling
 , plumbum
 , pytestCheckHook
 , pythonOlder
@@ -8,18 +9,22 @@
 
 buildPythonPackage rec {
   pname = "rpyc";
-  version = "5.1.0";
-  format = "setuptools";
+  version = "5.2.3";
+  format = "pyproject";
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "tomerfiliba";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Xeot4QEgTZjvdO0ydmKjccp6zwC93Yp/HkRlSgyDf8k=";
+    hash = "sha256-SDt6Oh+8qRIdM02FEFM+Xw1y/bBn66D6KbOrhGVs6ng=";
   };
 
+  nativeBuildInputs = [
+    hatchling
+  ];
+
   propagatedBuildInputs = [
     plumbum
   ];
@@ -31,6 +36,9 @@ buildPythonPackage rec {
   disabledTests = [
     # Disable tests that requires network access
     "test_api"
+    "test_close_timeout"
+    "test_deploy"
+    "test_listing"
     "test_pruning"
     "test_rpyc"
     # Test is outdated

pkgs/development/python-modules/tubeup/default.nix

@@ -9,19 +9,19 @@
 
 buildPythonPackage rec {
   pname = "tubeup";
-  version = "0.0.33";
+  version = "0.0.34";
+  format = "setuptools";
 
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-RFM0vZeA5PDXf9KzlJ8RTSfM7bz50bpwwszU0gjV1DY=";
+    sha256 = "ae1e606b243fd70742f8b5871c497628d258ee9f416caa46544aca9a5fbfbca0";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace "docopt==0.6.2" "docopt" \
-      --replace "internetarchive==2.0.3" "internetarchive"
+      --replace "docopt==0.6.2" "docopt"
   '';
 
   propagatedBuildInputs = [ internetarchive docopt yt-dlp ];

pkgs/development/tools/flyway/default.nix

@@ -1,10 +1,10 @@
 { lib, stdenv, fetchurl, jre_headless, makeWrapper }:
 stdenv.mkDerivation rec{
   pname = "flyway";
-  version = "9.5.1";
+  version = "9.6.0";
   src = fetchurl {
     url = "mirror://maven/org/flywaydb/flyway-commandline/${version}/flyway-commandline-${version}.tar.gz";
-    sha256 = "sha256-ieGRP9SGI8w42f3BNcO5mv/DB3E4Hzxe0q1P5EaBxK8=";
+    sha256 = "sha256-mf9u4FzKMBXoQ7PLUYZaYpVTuWNdSfplmzu+dKvABl8=";
   };
   nativeBuildInputs = [ makeWrapper ];
   dontBuild = true;

pkgs/development/tools/just/default.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "just";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "casey";
     repo = pname;
     rev = version;
-    hash = "sha256-4ilq/ptDYjfXmkLqky8z8iwfvg9JgdP+uADcv/zeHWs=";
+    hash = "sha256-W8ko9hzZmgF8XEqzbPtCJp5J38m0pAz5wTp3VRUmZOQ=";
   };
 
-  cargoSha256 = "sha256-rugnbuzynQ4lBy977e04xAvueUbViIuFSzXlQkiwM00=";
+  cargoSha256 = "sha256-rC+PcLQHjnaGSEELod6IF9NTCl0tnXvOOkHF0z77Lao=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv ];

pkgs/development/tools/millet/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "millet";
-  version = "0.5.6";
+  version = "0.5.8";
 
   src = fetchFromGitHub {
     owner = "azdavis";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-figP1PgM84jIbjuYzcklzYshedO5UXbxm9sbEXWkLzs=";
+    sha256 = "sha256-AsI0n76ZWzW326/kpzP+6zjVA42WrhPqnid02OJ5fEo=";
   };
 
-  cargoSha256 = "sha256-PF1NxUypOBevGwj5bFySQluhNh7PD1NFXfJvYuKHixQ=";
+  cargoSha256 = "sha256-tHa/DXcWLdOlMlauerSiLsLImYrbnslN6R991mSTyvs=";
 
   postPatch = ''
     rm .cargo/config.toml

pkgs/development/tools/rust/cargo-nextest/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.39";
+  version = "0.9.40";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    sha256 = "sha256-8BPKH5dfLALU1WaiinZx7IHVcUmL2wPckMDU+FVfgBs=";
+    sha256 = "sha256-w6YTnd+v4kvv7e/Zdo4oa1AGfW86Lmjyk4jMeFs/wUE=";
   };
 
-  cargoSha256 = "sha256-GYryj+evMuDsridRD1GaeaTWyD5yQi6pRhpPOrW24nI=";
+  cargoSha256 = "sha256-UhxC3Bv8wohO83k+ndhK9yOK2nQpeVYbc1CW5wpb2B4=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 

pkgs/development/web/deno/default.nix

@@ -17,15 +17,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "1.26.2";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/t1UG8F5sWJ+Zf9+r8oiAFF4pS+tLmXMDlTeY7+2qDQ=";
+    sha256 = "sha256-nvQimTCzcmTI37hFqf0aZvVUS01dy6alxkTTkY9nNPU=";
   };
-  cargoSha256 = "sha256-8CauLXX/ARAyqtQLQKgxuQWcmjSzSindCLkVk+wV/Nk=";
+  cargoSha256 = "sha256-1TrzF9h6OHfDzkKL+zQTf5dIMzB820WFtFi9pFQIgig=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds

pkgs/development/web/deno/librusty_v8.nix

@@ -11,11 +11,11 @@ let
   };
 in
 fetch_librusty_v8 {
-  version = "0.53.1";
+  version = "0.54.0";
   shas = {
-    x86_64-linux = "sha256-jMOzvvjnmauVmyeBlTOeVpQB1TcQ0K8D7xXsgjLcp3M=";
-    aarch64-linux = "sha256-aRcKpPlliO26xJe2zBym5/+hNmJUIrWu3qXJa9R3Irg=";
-    x86_64-darwin = "sha256-JsEx2t8d33xRlh+pmJtk5jvDktfW6nFGdw6oqJ3uYSU=";
-    aarch64-darwin = "sha256-ju/qr65m33IyXFL2VQXhvtL7PsxSpi8RrGteIb9dQTU=";
+    x86_64-linux = "sha256-V7xBGdKtLZRRNoRyvY/8a3Cvw12zo8tz76ZR72xmG6U=";
+    aarch64-linux = "sha256-/KIZ2Feli7VNdgFUU+MC5QZ8dQJ88TKfjz/SOoux1zg=";
+    x86_64-darwin = "sha256-xBDMDvWFZPMwJb3alQe7ZuboTm2aFOh9F7memuHo180=";
+    aarch64-darwin = "sha256-Z62rnm8X0cro7HBBv5pbkvQJd+AW+wF2tthH1+5a0nU=";
   };
 }

pkgs/games/fheroes2/default.nix

@@ -1,8 +1,7 @@
 { stdenv, lib, fetchFromGitHub
 , gettext, glibcLocalesUtf8, libpng, SDL2, SDL2_image, SDL2_mixer, SDL2_ttf, zlib
 
-# updater only
-, nix-update-script
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
@@ -43,8 +42,8 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    updateScript = nix-update-script {
-      attrPath = pname;
+    updateScript = gitUpdater {
+      url = "https://github.com/ihhub/fheroes2.git";
     };
   };
 

pkgs/games/sil-q/default.nix

@@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/bin
     cp sil $out/bin/sil-q
     wrapProgram $out/bin/sil-q \
-      --run "export ANGBAND_PATH=\$HOME/.sil" \
+      --run "export ANGBAND_PATH=\$HOME/.sil-q" \
       --run "${setup} ${src}/lib"
 
     runHook postInstall
@@ -50,7 +50,7 @@ in stdenv.mkDerivation rec {
   passthru.tests = {
     saveDirCreation = pkgs.runCommand "save-dir-creation" {} ''
       HOME=$(pwd) ${lib.getExe pkgs.sil-q} --help
-      test -d .sil && touch $out
+      test -d .sil-q && touch $out
     '';
   };
 

pkgs/servers/jackett/default.nix

@@ -9,13 +9,13 @@
 
 buildDotnetModule rec {
   pname = "jackett";
-  version = "0.20.2169";
+  version = "0.20.2171";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "D1q2nzDxlsFrxZRmZJTiJSWQ/BihuEDUVirv2qKgsnI=";
+    sha256 = "FW/3CkkLeHWw8KrBctAChRE9DMoooOmPkHZVBKp91Jk=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";

pkgs/servers/roon-bridge/default.nix

@@ -9,25 +9,23 @@
 , stdenv
 , zlib
 }:
-stdenv.mkDerivation rec {
+let
+  version = "1.8-1125";
+  urlVersion = builtins.replaceStrings [ "." "-" ] [ "00" "0" ] version;
+  host = stdenv.hostPlatform.system;
+  system = if host == "x86_64-linux" then "linuxx64"
+           else if host == "aarch64-linux" then "linuxarmv8"
+           else throw "Unsupported platform ${host}";
+  src = fetchurl {
+    url = "https://download.roonlabs.com/updates/stable/RoonBridge_${system}_${urlVersion}.tar.bz2";
+    hash = if system == "linuxx64" then "sha256-DbtKPFEz2WIoKTxP+zoehzz+BjfsLZ2ZQk/FMh+zFBM="
+           else if system == "linuxarmv8" then "sha256-+przEj96R+f1z4ewETFarF4oY6tT2VW/ukSTgUBLiYk="
+           else throw "Unsupported platform ${host}";
+  };
+in
+stdenv.mkDerivation {
   pname = "roon-bridge";
-  version = "1.8-943";
-
-  src =
-    let
-      urlVersion = builtins.replaceStrings [ "." "-" ] [ "00" "00" ] version;
-      inherit (stdenv.targetPlatform) system;
-    in
-      {
-        x86_64-linux = fetchurl {
-          url = "http://download.roonlabs.com/builds/RoonBridge_linuxx64_${urlVersion}.tar.bz2";
-          hash = "sha256-knmy2zlRh+ehvYKHC7UN60pMCt8bYPuo9kTz2m0pOW0";
-        };
-        aarch64-linux = fetchurl {
-          url = "http://download.roonlabs.com/builds/RoonBridge_linuxarmv8_${urlVersion}.tar.bz2";
-          hash = "sha256-urMhtBUjP4HpV9EDZOLLnfnMqhmsWPx0M2+Xdvc8YnU=";
-        };
-      }.${system} or (throw "Unsupposed system: ${system}");
+  inherit src version;
 
   dontConfigure = true;
   dontBuild = true;

pkgs/servers/roon-server/default.nix

@@ -15,7 +15,7 @@
 , stdenv
 }:
 let
-  version = "2.0-1128";
+  version = "2.0-1143";
   urlVersion = builtins.replaceStrings [ "." "-" ] [ "00" "0" ] version;
 in
 stdenv.mkDerivation {
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.roonlabs.com/updates/production/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-    hash = "sha256-PR3LR7u9X6eUAyoAW1tXv3LzqoVz3RQ0MZwdF0iAXJ8=";
+    hash = "sha256-qSqSiqO3SzVmRacbbAphVLp0ablQCjR4Zn2HIQaqSPs=";
   };
 
   dontConfigure = true;

pkgs/tools/misc/android-tools/default.nix

@@ -28,6 +28,14 @@ stdenv.mkDerivation rec {
     ./android-tools-kernel-headers-6.0.diff
   ];
 
+  postPatch = lib.optionalString stdenv.isDarwin ''
+    sed -i 's/usb_linux/usb_osx/g' vendor/CMakeLists.{adb,fastboot}.txt
+    sed -i 's/libselinux libsepol/ /g;s#selinux/libselinux/include##g' vendor/CMakeLists.{fastboot,mke2fs}.txt
+    sed -z -i 's/add_library(libselinux.*selinux\/libsepol\/include)//g' vendor/CMakeLists.fastboot.txt
+    sed -i 's/e2fsdroid//g' vendor/CMakeLists.txt
+    sed -z -i 's/add_executable(e2fsdroid.*e2fsprogs\/misc)//g' vendor/CMakeLists.mke2fs.txt
+  '';
+
   nativeBuildInputs = [ cmake perl go ];
   buildInputs = [ protobuf zlib gtest brotli lz4 zstd libusb1 pcre2 fmt_7 ];
   propagatedBuildInputs = [ pythonEnv ];
@@ -35,6 +43,15 @@ stdenv.mkDerivation rec {
   # Don't try to fetch any Go modules via the network:
   GOFLAGS = [ "-mod=vendor" ];
 
+  NIX_CFLAGS_COMPILE = lib.optionals stdenv.isDarwin [
+    "-D_DARWIN_C_SOURCE"
+  ];
+
+  NIX_LDFLAGS = lib.optionals stdenv.isDarwin [
+    "-framework CoreFoundation"
+    "-framework IOKit"
+  ];
+
   preConfigure = ''
     export GOCACHE=$TMPDIR/go-cache
   '';
@@ -63,7 +80,7 @@ stdenv.mkDerivation rec {
     # https://developer.android.com/studio/releases/platform-tools
     homepage = "https://github.com/nmeum/android-tools";
     license = with licenses; [ asl20 unicode-dfs-2015 ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     maintainers = with maintainers; [ primeos ];
   };
 }

pkgs/tools/nix/nix-store-gcs-proxy/default.nix

@@ -1,5 +1,5 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
-buildGoPackage rec {
+{ lib, buildGoModule, fetchFromGitHub }:
+buildGoModule rec {
   pname = "nix-store-gcs-proxy";
   version = "0.1.0";
 
@@ -10,9 +10,9 @@ buildGoPackage rec {
     sha256 = "0804p65px4wd7gzxggpdxsazkd1hbz1p15zzaxf9ygc6sh26ncln";
   };
 
-  goPackagePath = "github.com/tweag/nix-store-gcs-proxy";
+  vendorSha256 = "sha256-Bm3yFzm2LXOPYWQDk/UBusV0lPfc/BCKIb3pPlWgDFo=";
 
-  goDeps = ./deps.nix;
+  ldflags = [ "-s" "-w" ];
 
   meta = {
     description = "A HTTP nix store that proxies requests to Google Storage";

pkgs/tools/nix/nix-store-gcs-proxy/deps.nix

@@ -1,813 +0,0 @@
-# file generated from go.mod using vgo2nix (https://github.com/adisbladis/vgo2nix)
-[
-  {
-    goPackagePath = "cloud.google.com/go";
-    fetch = {
-      type = "git";
-      url = "https://code.googlesource.com/gocloud";
-      rev = "v0.37.2";
-      sha256 = "1w6crdxy9vzd8vm672hng22spwld6d60z58kbr28dkiiz694wqvs";
-    };
-  }
-  {
-    goPackagePath = "github.com/BurntSushi/toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/BurntSushi/toml";
-      rev = "v0.3.1";
-      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
-    };
-  }
-  {
-    goPackagePath = "github.com/Shopify/sarama";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Shopify/sarama";
-      rev = "v1.19.0";
-      sha256 = "0q1z3pvcd011yprwzws2s293v4cjvsszhai6vnfrahjcbsz79q0z";
-    };
-  }
-  {
-    goPackagePath = "github.com/Shopify/toxiproxy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/Shopify/toxiproxy";
-      rev = "v2.1.4";
-      sha256 = "07yhsvscdv1qjfc2fyyh9qsrrdwrrw04wadk5gaq4qddcway7vig";
-    };
-  }
-  {
-    goPackagePath = "github.com/alecthomas/template";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/template";
-      rev = "a0175ee3bccc";
-      sha256 = "0qjgvvh26vk1cyfq9fadyhfgdj36f1iapbmr5xp6zqipldz8ffxj";
-    };
-  }
-  {
-    goPackagePath = "github.com/alecthomas/units";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/units";
-      rev = "2efee857e7cf";
-      sha256 = "1j65b91qb9sbrml9cpabfrcf07wmgzzghrl7809hjjhrmbzri5bl";
-    };
-  }
-  {
-    goPackagePath = "github.com/anmitsu/go-shlex";
-    fetch = {
-      type = "git";
-      url = "https://github.com/anmitsu/go-shlex";
-      rev = "648efa622239";
-      sha256 = "10rgdp5d106iisgz25ic8k6f44s9adh4sjh6fyxq9ccm21gw49b7";
-    };
-  }
-  {
-    goPackagePath = "github.com/apache/thrift";
-    fetch = {
-      type = "git";
-      url = "https://github.com/apache/thrift";
-      rev = "v0.12.0";
-      sha256 = "0g2g61rs189nimg3631wxfwdx12dsdz70qvncczlyvn34pcj7yby";
-    };
-  }
-  {
-    goPackagePath = "github.com/beorn7/perks";
-    fetch = {
-      type = "git";
-      url = "https://github.com/beorn7/perks";
-      rev = "3a771d992973";
-      sha256 = "1l2lns4f5jabp61201sh88zf3b0q793w4zdgp9nll7mmfcxxjif3";
-    };
-  }
-  {
-    goPackagePath = "github.com/bradfitz/go-smtpd";
-    fetch = {
-      type = "git";
-      url = "https://github.com/bradfitz/go-smtpd";
-      rev = "deb6d6237625";
-      sha256 = "1i33brqd44h0a9hbdnclka0hfg0f6qi5xy23f0ap9yixkhj4k9p6";
-    };
-  }
-  {
-    goPackagePath = "github.com/client9/misspell";
-    fetch = {
-      type = "git";
-      url = "https://github.com/client9/misspell";
-      rev = "v0.3.4";
-      sha256 = "1vwf33wsc4la25zk9nylpbp9px3svlmldkm0bha4hp56jws4q9cs";
-    };
-  }
-  {
-    goPackagePath = "github.com/coreos/go-systemd";
-    fetch = {
-      type = "git";
-      url = "https://github.com/coreos/go-systemd";
-      rev = "c6f51f82210d";
-      sha256 = "1vnccmnkjl6n539l4cliz6sznpqn6igf5v7mbmsgahb838742clb";
-    };
-  }
-  {
-    goPackagePath = "github.com/davecgh/go-spew";
-    fetch = {
-      type = "git";
-      url = "https://github.com/davecgh/go-spew";
-      rev = "v1.1.1";
-      sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
-    };
-  }
-  {
-    goPackagePath = "github.com/eapache/go-resiliency";
-    fetch = {
-      type = "git";
-      url = "https://github.com/eapache/go-resiliency";
-      rev = "v1.1.0";
-      sha256 = "1zmgw3c4w5r6m2r340n4jc5l5ll3m3nbszqrmrgbqc2xixxyk2gx";
-    };
-  }
-  {
-    goPackagePath = "github.com/eapache/go-xerial-snappy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/eapache/go-xerial-snappy";
-      rev = "776d5712da21";
-      sha256 = "0ncc41dv7xwb1znyzmzh7cvs6j5fzz0f1n8h1v3grl9ma6s1si9d";
-    };
-  }
-  {
-    goPackagePath = "github.com/eapache/queue";
-    fetch = {
-      type = "git";
-      url = "https://github.com/eapache/queue";
-      rev = "v1.1.0";
-      sha256 = "07dp54n94gn3gsvdcki56yqh7py7wqqigxbamhxwgbr05n61fqyg";
-    };
-  }
-  {
-    goPackagePath = "github.com/flynn/go-shlex";
-    fetch = {
-      type = "git";
-      url = "https://github.com/flynn/go-shlex";
-      rev = "3f9db97f8568";
-      sha256 = "1j743lysygkpa2s2gii2xr32j7bxgc15zv4113b0q9jhn676ysia";
-    };
-  }
-  {
-    goPackagePath = "github.com/fsnotify/fsnotify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fsnotify/fsnotify";
-      rev = "v1.4.7";
-      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
-    };
-  }
-  {
-    goPackagePath = "github.com/gliderlabs/ssh";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gliderlabs/ssh";
-      rev = "v0.1.1";
-      sha256 = "0bylkc7yg8bxxffhchikcnzwli5n95cfmbji6v2a4mn1h5n36mdm";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-kit/kit";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-kit/kit";
-      rev = "v0.8.0";
-      sha256 = "1rcywbc2pvab06qyf8pc2rdfjv7r6kxdv2v4wnpqnjhz225wqvc0";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-logfmt/logfmt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-logfmt/logfmt";
-      rev = "v0.3.0";
-      sha256 = "1gkgh3k5w1xwb2qbjq52p6azq3h1c1rr6pfwjlwj1zrijpzn2xb9";
-    };
-  }
-  {
-    goPackagePath = "github.com/go-stack/stack";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go-stack/stack";
-      rev = "v1.8.0";
-      sha256 = "0wk25751ryyvxclyp8jdk5c3ar0cmfr8lrjb66qbg4808x66b96v";
-    };
-  }
-  {
-    goPackagePath = "github.com/gogo/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gogo/protobuf";
-      rev = "v1.2.0";
-      sha256 = "1c3y5m08mvrgvlw0kb9pldh3kkqcj99pa8gqmk1g3hp8ih3b2dv0";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/glog";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/glog";
-      rev = "23def4e6c14b";
-      sha256 = "0jb2834rw5sykfr937fxi8hxi2zy80sj2bdn9b3jb4b26ksqng30";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/mock";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/mock";
-      rev = "v1.2.0";
-      sha256 = "12ddj2g8ab87id6n2n67vnbhq6p8dvgsq1pzpqfriym4dk8w54fg";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev = "v1.2.0";
-      sha256 = "0kf4b59rcbb1cchfny2dm9jyznp8ri2hsb14n8iak1q8986xa0ab";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/snappy";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/snappy";
-      rev = "2e65f85255db";
-      sha256 = "05w6mpc4qcy0pv8a2bzng8nf4s5rf5phfang4jwy9rgf808q0nxf";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/btree";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/btree";
-      rev = "4030bb1f1f0c";
-      sha256 = "0ba430m9fbnagacp57krgidsyrgp3ycw5r7dj71brgp5r52g82p6";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-cmp";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-cmp";
-      rev = "v0.2.0";
-      sha256 = "1fbv0x27k9sn8svafc0hjwsnckk864lv4yi7bvzrxvmd3d5hskds";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-github";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-github";
-      rev = "v17.0.0";
-      sha256 = "1kvw95l77a5n5rgal9n1xjh58zxb3a40ij1j722b1h4z8yg9jhg4";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/go-querystring";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-querystring";
-      rev = "v1.0.0";
-      sha256 = "0xl12bqyvmn4xcnf8p9ksj9rmnr7s40pvppsdmy8n9bzw1db0iwz";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/martian";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/martian";
-      rev = "v2.1.0";
-      sha256 = "197hil6vrjk50b9wvwyzf61csid83whsjj6ik8mc9r2lryxlyyrp";
-    };
-  }
-  {
-    goPackagePath = "github.com/google/pprof";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/pprof";
-      rev = "3ea8567a2e57";
-      sha256 = "09rhjn3ms0a72dw0yzbp237p7yhqma772zspddn6mgkh3gi3kn4c";
-    };
-  }
-  {
-    goPackagePath = "github.com/googleapis/gax-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/googleapis/gax-go";
-      rev = "v2.0.4";
-      sha256 = "1iwnm6ky1x53lgs44mw3hpdkjzrm5qd0kfs50m0qcq2ml5m1cwdm";
-    };
-  }
-  {
-    goPackagePath = "github.com/gorilla/context";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gorilla/context";
-      rev = "v1.1.1";
-      sha256 = "03p4hn87vcmfih0p9w663qbx9lpsf7i7j3lc7yl7n84la3yz63m4";
-    };
-  }
-  {
-    goPackagePath = "github.com/gorilla/mux";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gorilla/mux";
-      rev = "v1.6.2";
-      sha256 = "0pvzm23hklxysspnz52mih6h1q74vfrdhjfm1l3sa9r8hhqmmld2";
-    };
-  }
-  {
-    goPackagePath = "github.com/gregjones/httpcache";
-    fetch = {
-      type = "git";
-      url = "https://github.com/gregjones/httpcache";
-      rev = "9cad4c3443a7";
-      sha256 = "0wjdwcwqqcx2d5y68qvhg6qyj977il5ijmnn9h9cd6wjbdy0ay6s";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/golang-lru";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/golang-lru";
-      rev = "v0.5.0";
-      sha256 = "12k2cp2k615fjvfa5hyb9k2alian77wivds8s65diwshwv41939f";
-    };
-  }
-  {
-    goPackagePath = "github.com/hpcloud/tail";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hpcloud/tail";
-      rev = "v1.0.0";
-      sha256 = "1njpzc0pi1acg5zx9y6vj9xi6ksbsc5d387rd6904hy6rh2m6kn0";
-    };
-  }
-  {
-    goPackagePath = "github.com/jellevandenhooff/dkim";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jellevandenhooff/dkim";
-      rev = "f50fe3d243e1";
-      sha256 = "0qf5pypxfpciivj0v728i24rfjwhnwm07945mj6p3cw4gdphqhm0";
-    };
-  }
-  {
-    goPackagePath = "github.com/jstemmer/go-junit-report";
-    fetch = {
-      type = "git";
-      url = "https://github.com/jstemmer/go-junit-report";
-      rev = "af01ea7f8024";
-      sha256 = "1lp3n94ris12hac02wi31f3whs88lcrzwgdg43a5j6cafg9p1d0s";
-    };
-  }
-  {
-    goPackagePath = "github.com/julienschmidt/httprouter";
-    fetch = {
-      type = "git";
-      url = "https://github.com/julienschmidt/httprouter";
-      rev = "v1.2.0";
-      sha256 = "1k8bylc9s4vpvf5xhqh9h246dl1snxrzzz0614zz88cdh8yzs666";
-    };
-  }
-  {
-    goPackagePath = "github.com/konsorten/go-windows-terminal-sequences";
-    fetch = {
-      type = "git";
-      url = "https://github.com/konsorten/go-windows-terminal-sequences";
-      rev = "v1.0.1";
-      sha256 = "1lchgf27n276vma6iyxa0v1xds68n2g8lih5lavqnx5x6q5pw2ip";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/logfmt";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/logfmt";
-      rev = "b84e30acd515";
-      sha256 = "02ldzxgznrfdzvghfraslhgp19la1fczcbzh7wm2zdc6lmpd1qq9";
-    };
-  }
-  {
-    goPackagePath = "github.com/kr/pty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/kr/pty";
-      rev = "v1.1.3";
-      sha256 = "0knzlvndfgjm2k23vhp2xj1cv3fm31vbg5b20gdl1vnxk7rh549h";
-    };
-  }
-  {
-    goPackagePath = "github.com/matttproud/golang_protobuf_extensions";
-    fetch = {
-      type = "git";
-      url = "https://github.com/matttproud/golang_protobuf_extensions";
-      rev = "v1.0.1";
-      sha256 = "1d0c1isd2lk9pnfq2nk0aih356j30k3h1gi2w0ixsivi5csl7jya";
-    };
-  }
-  {
-    goPackagePath = "github.com/mwitkow/go-conntrack";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mwitkow/go-conntrack";
-      rev = "cc309e4a2223";
-      sha256 = "0nbrnpk7bkmqg9mzwsxlm0y8m7s9qd9phr1q30qlx2qmdmz7c1mf";
-    };
-  }
-  {
-    goPackagePath = "github.com/onsi/ginkgo";
-    fetch = {
-      type = "git";
-      url = "https://github.com/onsi/ginkgo";
-      rev = "v1.7.0";
-      sha256 = "14wgpdrvpc35rdz3859bz53sc1g4vpr1fysy15wy3ff9gmqs14yg";
-    };
-  }
-  {
-    goPackagePath = "github.com/onsi/gomega";
-    fetch = {
-      type = "git";
-      url = "https://github.com/onsi/gomega";
-      rev = "v1.4.3";
-      sha256 = "1c8rqg5i2hz3snmq7s41yar1zjnzilb0fyiyhkg83v97afcfx79v";
-    };
-  }
-  {
-    goPackagePath = "github.com/openzipkin/zipkin-go";
-    fetch = {
-      type = "git";
-      url = "https://github.com/openzipkin/zipkin-go";
-      rev = "v0.1.6";
-      sha256 = "0fyf69w66khj3dxdpqydwjdhhhyhlh3caxa5ybnd1h2f6b5gbvvv";
-    };
-  }
-  {
-    goPackagePath = "github.com/pierrec/lz4";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pierrec/lz4";
-      rev = "v2.0.5";
-      sha256 = "0y5rh7z01zycd59nnjpkqq0ydyjmcg9j1xw15q1i600l9j9g617p";
-    };
-  }
-  {
-    goPackagePath = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev = "v0.8.0";
-      sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
-    };
-  }
-  {
-    goPackagePath = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev = "v1.0.0";
-      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/client_golang";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_golang";
-      rev = "3c4408c8b829";
-      sha256 = "06d9cxxxkglks8fpfg3spxscyrq4lw7fckm4p6f0wshq65am2lxw";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/client_model";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_model";
-      rev = "56726106282f";
-      sha256 = "19y4qs9mkxiiab5sh3b7cccjpl3xbp6sy8812ig9f1zg8vzkzj7j";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/common";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/common";
-      rev = "v0.2.0";
-      sha256 = "02kym6lcfnlq23qbv277jr0q1n7jj0r14gqg93c7wn7gc44jv3vp";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/procfs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/procfs";
-      rev = "bf6a532e95b1";
-      sha256 = "0k65i2ikf3jp6863mpc1raf928i78r8jd7zn9djx6f4izls6l6j1";
-    };
-  }
-  {
-    goPackagePath = "github.com/rcrowley/go-metrics";
-    fetch = {
-      type = "git";
-      url = "https://github.com/rcrowley/go-metrics";
-      rev = "3113b8401b8a";
-      sha256 = "1m5q5dsvkqz809aag6dyan74wdrp69g2mb9killbv7z4ls2mlfr3";
-    };
-  }
-  {
-    goPackagePath = "github.com/sirupsen/logrus";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sirupsen/logrus";
-      rev = "v1.2.0";
-      sha256 = "0r6334x2bls8ddznvzaldx4g88msjjns4mlks95rqrrg7h0ijigg";
-    };
-  }
-  {
-    goPackagePath = "github.com/stretchr/objx";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/objx";
-      rev = "v0.1.1";
-      sha256 = "0iph0qmpyqg4kwv8jsx6a56a7hhqq8swrazv40ycxk9rzr0s8yls";
-    };
-  }
-  {
-    goPackagePath = "github.com/stretchr/testify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/testify";
-      rev = "v1.2.2";
-      sha256 = "0dlszlshlxbmmfxj5hlwgv3r22x0y1af45gn1vd198nvvs3pnvfs";
-    };
-  }
-  {
-    goPackagePath = "github.com/tarm/serial";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tarm/serial";
-      rev = "98f6abe2eb07";
-      sha256 = "1yj4jiv2f3x3iawxdflrlmdan0k9xsbnccgc9yz658rmif1ag3pb";
-    };
-  }
-  {
-    goPackagePath = "github.com/urfave/cli";
-    fetch = {
-      type = "git";
-      url = "https://github.com/urfave/cli";
-      rev = "v1.20.0";
-      sha256 = "0y6f4sbzkiiwrxbl15biivj8c7qwxnvm3zl2dd3mw4wzg4x10ygj";
-    };
-  }
-  {
-    goPackagePath = "github.com/urfave/negroni";
-    fetch = {
-      type = "git";
-      url = "https://github.com/urfave/negroni";
-      rev = "v1.0.0";
-      sha256 = "1gp6j74adi1cn8fq5v3wzlzhwl4zg43n2746m4fzdcdimihk3ccp";
-    };
-  }
-  {
-    goPackagePath = "go.opencensus.io";
-    fetch = {
-      type = "git";
-      url = "https://github.com/census-instrumentation/opencensus-go";
-      rev = "v0.19.2";
-      sha256 = "1vlik5xwwrhcyy9yx2yc3y02y6hp9q80591hbhncv9c8wwfg9gjc";
-    };
-  }
-  {
-    goPackagePath = "go4.org";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go4org/go4";
-      rev = "417644f6feb5";
-      sha256 = "013cvdg4fj15l9xg84br0vkb2d99j04s5b4g7zssqhng8dkwgr37";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/build";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/build";
-      rev = "5284462c4bec";
-      sha256 = "0w649zbs4n64b6rjx92hy7vc1y9sv4khhk5igbz8w7sxvz8778ij";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev = "c2843e01d9a2";
-      sha256 = "01xgxbj5r79nmisdvpq48zfy8pzaaj90bn6ngd4nf33j9ar1dp8r";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/exp";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/exp";
-      rev = "509febef88a4";
-      sha256 = "02isrh39z8znrp5znplzy0dip2gnrl3jm1355raliyvhnhg04j6q";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/lint";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/lint";
-      rev = "5614ed5bae6f";
-      sha256 = "0fzn0zjv0x92xvfdq3a0v9w5sgkhr7hxkfy9zaqi8i57807z8bnx";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "d8887717615a";
-      sha256 = "1wfm6ngxjyj7v5a2dqib6lw8bb2rdnf1kl48diykxjrsddn0s163";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/oauth2";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/oauth2";
-      rev = "e64efc72b421";
-      sha256 = "0djvwz2avx7knsjbl434vw1wqbrg53xp1kh599gfixn5icrggz4m";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/perf";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/perf";
-      rev = "6e6d33e29852";
-      sha256 = "1cyiy459bkjqnzgk051lsksz46hdkjc34q33zf946kiv3hilp1v2";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sync";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sync";
-      rev = "e225da77a7e6";
-      sha256 = "0bh3583smcfw6jw3w6lp0za93rz7hpxfdz8vhxng75b7a6vdlw4p";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "d0b11bdaac8a";
-      sha256 = "18yfsmw622l7gc5sqriv5qmck6903vvhivpzp8i3xfy3z33dybdl";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev = "17ff2d5776d2";
-      sha256 = "1rrh2mnmyxr45nsvy42zq3w3ly6gw6rl993knwvf1w71kyv0jjnj";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/time";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/time";
-      rev = "85acf8d2951c";
-      sha256 = "0yqnxsrarjk4qkda8kcxzmk7y90kkkxzx9iwryzrk7bzs87ky3xc";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/tools";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/tools";
-      rev = "e65039ee4138";
-      sha256 = "0c094599cf70wdrms49a3879qkq122pqlp2av444gs2pvc8apdcx";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/api";
-    fetch = {
-      type = "git";
-      url = "https://code.googlesource.com/google-api-go-client";
-      rev = "v0.3.0";
-      sha256 = "1vvrhiq2zs677iz2j6s9iv4q3j3nhxz5ci9y4zrak248lrdln0zk";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/appengine";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/appengine";
-      rev = "v1.4.0";
-      sha256 = "06zl7w4sxgdq2pl94wy9ncii6h0z3szl4xpqds0sv3b3wbdlhbnn";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/genproto";
-    fetch = {
-      type = "git";
-      url = "https://github.com/google/go-genproto";
-      rev = "5fe7a883aa19";
-      sha256 = "0qjkwig0r42q0j2qv57s4ahsgmmp41dz3ih3rnaqg0619n5w7lbs";
-    };
-  }
-  {
-    goPackagePath = "google.golang.org/grpc";
-    fetch = {
-      type = "git";
-      url = "https://github.com/grpc/grpc-go";
-      rev = "v1.19.0";
-      sha256 = "1znqwpj7ix3dpzx4zch0q70sdl3z5lvbb7v3q4i8sf8kas3yv71v";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/alecthomas/kingpin.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/alecthomas/kingpin.v2";
-      rev = "v2.2.6";
-      sha256 = "0mndnv3hdngr3bxp7yxfd47cas4prv98sqw534mx7vp38gd88n5r";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/check.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/check.v1";
-      rev = "788fd7840127";
-      sha256 = "0v3bim0j375z81zrpr5qv42knqs0y2qv2vkjiqi5axvb78slki1a";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/fsnotify.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/fsnotify.v1";
-      rev = "v1.4.7";
-      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/inf.v0";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/inf.v0";
-      rev = "v0.9.1";
-      sha256 = "00k5iqjcp371fllqxncv7jkf80hn1zww92zm78cclbcn4ybigkng";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/tomb.v1";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/tomb.v1";
-      rev = "dd632973f1e7";
-      sha256 = "1lqmq1ag7s4b3gc3ddvr792c5xb5k6sfn0cchr3i2s7f1c231zjv";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "v2.2.2";
-      sha256 = "01wj12jzsdqlnidpyjssmj0r4yavlqy7dwrg7adqd8dicjc4ncsa";
-    };
-  }
-  {
-    goPackagePath = "grpc.go4.org";
-    fetch = {
-      type = "git";
-      url = "https://github.com/go4org/grpc";
-      rev = "11d0a25b4919";
-      sha256 = "1d6akp2b3aa2viwbikc3jndhiljgjj87r4z7mg5b03f97f2wmz4f";
-    };
-  }
-  {
-    goPackagePath = "honnef.co/go/tools";
-    fetch = {
-      type = "git";
-      url = "https://github.com/dominikh/go-tools";
-      rev = "3f1c8253044a";
-      sha256 = "0d3vgh0fgfj1z7i648g1s6x2pwxd07sxfjwg1xn3yagr9h06jh3h";
-    };
-  }
-]

pkgs/tools/security/cie-middleware-linux/default.nix

@@ -20,14 +20,13 @@
 
 let
   pname = "cie-middleware-linux";
-  version = "1.4.3.3";
+  version = "1.4.4.0";
 
   src = fetchFromGitHub {
     owner = "M0rf30";
     repo = pname;
-    # use the podofo-vanilla branch
-    rev = "531acc54609eaeccbdd4ef881d7d7e7e0fe0af17";
-    sha256 = "sha256-hUpEkiEQu0R+aCo4bfZfVLLib0o6v2RQJVIte3n+IAk=";
+    rev = "${version}-podofo";
+    sha256 = "sha256-Kyr9OTiY6roJ/wVJS/1aWfrrzDNQbuRTJQqo0akbMUU=";
   };
 
   # Shared libraries needed by the Java application
@@ -59,7 +58,7 @@ let
 
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "sha256-gsb4aH/au7IDh1PX/qY+8o7CmjKJUHpmEa0vYhbAnP0=";
+    outputHash = "sha256-WzT5vYF9yCMU2A7EkLZyjgWrN3gD7pnkPXc3hDFqpD8=";
   };
 
 in

pkgs/tools/security/grype/default.nix

@@ -1,19 +1,20 @@
 { lib
-, stdenv
 , buildGoModule
 , fetchFromGitHub
 , installShellFiles
+
+, openssl
 }:
 
 buildGoModule rec {
   pname = "grype";
-  version = "0.49.0";
+  version = "0.51.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MShlKtrorqXRInQ01dEzVeLDRDua9PISkficF02PrBI=";
+    sha256 = "sha256-WTDUkC+TFVkT/D36hDusqxwidy6O+iMInBpTumdCaw4=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -25,13 +26,15 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-
-  vendorSha256 = "sha256-MusEvYNaMM0kqHSDdenPKo4IrIFmvPHSCRzciKMFiew=";
+  vendorSha256 = "sha256-bpWUo6YA0TkIyDg27mv88X1fh+1Wal362Sqi7loo/Zs=";
 
   nativeBuildInputs = [
     installShellFiles
   ];
 
+  subPackages = [ "." ];
+  excludedPackages = "test/integration";
+
   ldflags = [
     "-s"
     "-w"
@@ -49,8 +52,44 @@ buildGoModule rec {
     ldflags+=" -X github.com/anchore/grype/internal/version.buildDate=$(cat SOURCE_DATE_EPOCH)"
   '';
 
-  # Tests require a running Docker instance
-  doCheck = false;
+  checkInputs = [ openssl ];
+  preCheck = ''
+    # test all dirs (except excluded)
+    unset subPackages
+    # test goldenfiles expect no version
+    unset ldflags
+
+    # patch utility script
+    patchShebangs grype/db/test-fixtures/tls/generate-x509-cert-pair.sh
+
+    # remove tests that depend on docker
+    substituteInPlace test/cli/cmd_test.go \
+      --replace "TestCmd" "SkipCmd"
+    substituteInPlace grype/pkg/provider_test.go \
+      --replace "TestSyftLocationExcludes" "SkipSyftLocationExcludes"
+    substituteInPlace grype/presenter/cyclonedx/presenter_test.go \
+      --replace "TestCycloneDxPresenterImage" "SkipCycloneDxPresenterImage"
+    substituteInPlace grype/presenter/cyclonedxvex/presenter_test.go \
+      --replace "TestCycloneDxPresenterImage" "SkipCycloneDxPresenterImage"
+    substituteInPlace grype/presenter/sarif/presenter_test.go \
+      --replace "Test_imageToSarifReport" "Skip_imageToSarifReport" \
+      --replace "TestSarifPresenterImage" "SkipSarifPresenterImage"
+
+    # remove tests that depend on git
+    substituteInPlace test/cli/db_validations_test.go \
+      --replace "TestDBValidations" "SkipDBValidations"
+    substituteInPlace test/cli/registry_auth_test.go \
+      --replace "TestRegistryAuth" "SkipRegistryAuth"
+    substituteInPlace test/cli/sbom_input_test.go \
+      --replace "TestSBOMInput_FromStdin" "SkipSBOMInput_FromStdin" \
+      --replace "TestSBOMInput_AsArgument" "SkipSBOMInput_AsArgument" \
+      --replace "TestAttestationInput_AsArgument" "SkipAttestationInput_AsArgument"
+    substituteInPlace test/cli/subprocess_test.go \
+      --replace "TestSubprocessStdin" "SkipSubprocessStdin"
+
+    # segfault
+    rm grype/db/v5/namespace/cpe/namespace_test.go
+  '';
 
   postInstall = ''
     installShellCompletion --cmd grype \

pkgs/top-level/all-packages.nix

@@ -2029,9 +2029,10 @@ with pkgs;
 
   android-backup-extractor = callPackage ../tools/backup/android-backup-extractor {};
 
-  android-tools = lowPrio (callPackage ../tools/misc/android-tools {
-    stdenv = if stdenv.targetPlatform.isAarch64 then gcc10Stdenv else stdenv;
-  });
+  android-tools = lowPrio (darwin.apple_sdk_11_0.callPackage ../tools/misc/android-tools
+    (lib.optionalAttrs (stdenv.targetPlatform.isAarch64 && stdenv.targetPlatform.isLinux) {
+      stdenv = gcc10Stdenv;
+    }));
 
   anewer = callPackage ../tools/text/anewer { };
 
@@ -18377,7 +18378,7 @@ with pkgs;
 
   cxxopts = callPackage ../development/libraries/cxxopts { };
 
-  cxxtest = python2Packages.callPackage ../development/libraries/cxxtest { };
+  cxxtest = python3Packages.callPackage ../development/libraries/cxxtest { };
 
   cypress = callPackage ../development/web/cypress { };