Merge staging-next into staging

.github/workflows/update-terraform-providers.yml

@@ -18,6 +18,8 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - uses: cachix/install-nix-action@v17
+        with:
+          nix_path: nixpkgs=channel:nixpkgs-unstable
       - name: setup
         id: setup
         run: |

doc/hooks/postgresql-test-hook.section.md

@@ -40,7 +40,7 @@ Exported variables:
 
 Bash-only variables:
 
- - `postgresqlTestUserOptions`: SQL options to use when creating the `$PGUSER` role, default: `LOGIN`.
+ - `postgresqlTestUserOptions`: SQL options to use when creating the `$PGUSER` role, default: `"LOGIN"`. Example: `"LOGIN SUPERUSER"`
  - `postgresqlTestSetupSQL`: SQL commands to run as database administrator after startup, default: statements that create `$PGUSER` and `$PGDATABASE`.
  - `postgresqlTestSetupCommands`: bash commands to run after database start, defaults to running `$postgresqlTestSetupSQL` as database administrator.
  - `postgresqlEnableTCP`: set to `1` to enable TCP listening. Flaky; not recommended.

nixos/tests/docker-tools.nix

@@ -424,5 +424,12 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         docker.succeed("docker run --rm etc | grep localhost")
         docker.succeed("docker image rm etc:latest")
 
+    with subtest("image-with-certs"):
+        docker.succeed("<${examples.image-with-certs} docker load")
+        docker.succeed("docker run --rm image-with-certs:latest test -r /etc/ssl/certs/ca-bundle.crt")
+        docker.succeed("docker run --rm image-with-certs:latest test -r /etc/ssl/certs/ca-certificates.crt")
+        docker.succeed("docker run --rm image-with-certs:latest test -r /etc/pki/tls/certs/ca-bundle.crt")
+        docker.succeed("docker image rm image-with-certs:latest")
+
   '';
 })

pkgs/applications/editors/emacs/elisp-packages/libgenerated.nix

@@ -45,6 +45,18 @@ let
           inherit sha256 url;
         }
       ) {};
+      sourcehut = self.callPackage ({ fetchzip }:
+        fetchzip {
+          url = "https://git.sr.ht/~${repo}/archive/${commit}.tar.gz";
+          inherit sha256;
+        }
+      ) {};
+      codeberg = self.callPackage ({ fetchzip }:
+        fetchzip {
+          url = "https://codeberg.org/${repo}/archive/${commit}.tar.gz";
+          inherit sha256;
+        }
+      ) {};
     };
 
 in {

pkgs/applications/editors/emacs/elisp-packages/update-melpa.el

@@ -214,7 +214,9 @@ return Promise to resolve in that process."
                             `((fetcher . ,fetcher))
                             (if (or (equal "github" fetcher)
                                     (equal "bitbucket" fetcher)
-                                    (equal "gitlab" fetcher))
+                                    (equal "gitlab" fetcher)
+                                    (equal "sourcehut" fetcher)
+                                    (equal "codeberg" fetcher))
                                 `((repo . ,repo))
                               `((url . ,url)))
                             (when unstable-aprops `((unstable . ,(source-info entry unstable-archive unstable-sha))))

pkgs/applications/file-managers/doublecmd/default.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "doublecmd";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchFromGitHub {
     owner = "doublecmd";
     repo = "doublecmd";
     rev = "v${version}";
-    hash = "sha256-HscDzeWM9lp6ba+VrXHIFmbWfE8ILg6WDn6q5WCOaOg=";
+    hash = "sha256-kuqleoDoxzOj3baTK0lBJpbDECoHeFubWhLXAVkEqAk=";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/mpv/default.nix

@@ -61,7 +61,7 @@
 , libpngSupport      ? true,           libpng
 , openalSupport      ? true,           openalSoft
 , pulseSupport       ? config.pulseaudio or stdenv.isLinux, libpulseaudio
-, rubberbandSupport  ? stdenv.isLinux, rubberband
+, rubberbandSupport  ? true,           rubberband
 , screenSaverSupport ? true,           libXScrnSaver
 , sdl2Support        ? true,           SDL2
 , sixelSupport       ? false,          libsixel

pkgs/applications/video/popcorntime/default.nix

@@ -0,0 +1,80 @@
+{ autoPatchelfHook
+, fetchurl
+, gcc-unwrapped
+, gsettings-desktop-schemas
+, gtk3
+, lib
+, makeDesktopItem
+, makeWrapper
+, nwjs
+, stdenv
+, unzip
+, udev
+, wrapGAppsHook
+, copyDesktopItems
+}:
+
+stdenv.mkDerivation rec {
+  pname = "popcorntime";
+  version = "0.4.9";
+
+  src = fetchurl {
+    url = "https://github.com/popcorn-official/popcorn-desktop/releases/download/v${version}/Popcorn-Time-${version}-linux64.zip";
+    sha256 = "sha256-cbKL5bgweZD/yfi/8KS0L7Raha8PTHqIm4qSPFidjUc=";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+    unzip
+    wrapGAppsHook
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    gcc-unwrapped
+    gsettings-desktop-schemas
+    gtk3
+    nwjs
+    udev
+  ];
+
+  sourceRoot = ".";
+
+  dontWrapGApps = true;
+  dontUnpack = true;
+
+  makeWrapperArgs = [
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ gcc-unwrapped.lib gtk3 udev ]}"
+    "--prefix PATH : ${lib.makeBinPath [ stdenv.cc ]}"
+  ];
+
+  # Extract and copy executable in $out/bin
+  installPhase = ''
+    mkdir -p $out/share/applications $out/bin $out/opt/bin $out/share/icons/hicolor/scalable/apps/
+    # we can't unzip it in $out/lib, because nw.js will start with
+    # an empty screen. Therefore it will be unzipped in a non-typical
+    # folder and symlinked.
+    unzip -q $src -d $out/opt/popcorntime
+
+    ln -s $out/opt/popcorntime/Popcorn-Time $out/bin/popcorntime
+
+    ln -s $out/opt/popcorntime/src/app/images/icon.png $out/share/icons/hicolor/scalable/apps/popcorntime.png
+  '';
+
+  # GSETTINGS_SCHEMAS_PATH is not set in installPhase
+  preFixup = ''
+    wrapProgram $out/bin/popcorntime \
+      ''${makeWrapperArgs[@]} \
+      ''${gappsWrapperArgs[@]}
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/popcorn-official/popcorn-desktop";
+    description = "An application that streams movies and TV shows from torrents";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.gpl3;
+    maintainers = with maintainers; [ onny ];
+  };
+}

pkgs/build-support/docker/default.nix

@@ -794,6 +794,7 @@ rec {
 
   # This provides the ca bundle in common locations
   caCertificates = runCommand "ca-certificates" { } ''
+    mkdir -p $out/etc/ssl/certs $out/etc/pki/tls/certs
     # Old NixOS compatibility.
     ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt $out/etc/ssl/certs/ca-bundle.crt
     # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.

pkgs/build-support/docker/examples.nix

@@ -698,4 +698,21 @@ rec {
     tag = "latest";
     contents = [ pkgs.bashInteractive ./test-dummy ];
   };
+
+  # ensure that caCertificates builds
+  image-with-certs = buildImage {
+    name = "image-with-certs";
+    tag = "latest";
+
+    copyToRoot = pkgs.buildEnv {
+      name = "image-with-certs-root";
+      paths = [
+        pkgs.coreutils
+        pkgs.dockerTools.caCertificates
+      ];
+    };
+
+    config = {
+    };
+  };
 }

pkgs/build-support/emacs/melpa.nix

@@ -35,11 +35,24 @@ import ./generic.nix { inherit lib stdenv emacs texinfo writeText gcc; } ({
     then pname
     else ename;
 
-  packageBuild = fetchFromGitHub {
-    owner = "melpa";
-    repo = "package-build";
-    rev = "35017a2d87376c70c3239f48bdbac7efca85aa10";
-    sha256 = "07hdmam85452v4r2vaabj1qfyami1hgbh0jgj9dcwbkpr0y1gvqj";
+  packageBuild = stdenv.mkDerivation {
+    name = "package-build";
+    src = fetchFromGitHub {
+      owner = "melpa";
+      repo = "package-build";
+      rev = "c3c535e93d9dc92acd21ebc4b15016b5c3b90e7d";
+      sha256 = "17z0wbqdd6fspbj43yq8biff6wfggk74xgnaf1xx6ynsp1i74is5";
+    };
+
+    patches = [ ./package-build-dont-use-mtime.patch ];
+
+    dontConfigure = true;
+    dontBuild = true;
+
+    installPhase = "
+      mkdir -p $out
+      cp -r * $out
+    ";
   };
 
   elpa2nix = ./elpa2nix.el;

pkgs/build-support/emacs/package-build-dont-use-mtime.patch

@@ -0,0 +1,40 @@
+diff --git a/package-build.el b/package-build.el
+index e572045..9eb0f82 100644
+--- a/package-build.el
++++ b/package-build.el
+@@ -415,7 +415,7 @@ (defun package-build--write-pkg-file (desc dir)
+       (princ ";; Local Variables:\n;; no-byte-compile: t\n;; End:\n"
+              (current-buffer)))))
+ 
+-(defun package-build--create-tar (name version directory mtime)
++(defun package-build--create-tar (name version directory)
+   "Create a tar file containing the contents of VERSION of package NAME.
+ DIRECTORY is a temporary directory that contains the directory
+ that is put in the tarball.  MTIME is used as the modification
+@@ -434,7 +434,7 @@ (defun package-build--create-tar (name version directory mtime)
+        ;; prevent a reproducable tarball as described at
+        ;; https://reproducible-builds.org/docs/archives.
+        "--sort=name"
+-       (format "--mtime=@%d" mtime)
++       "--mtime=@0"
+        "--owner=0" "--group=0" "--numeric-owner"
+        "--pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime"))
+     (when (and package-build-verbose noninteractive)
+@@ -848,12 +848,11 @@ (defun package-build--build-multi-file-package (rcp version commit files source-
+                            (package-build--desc-from-library
+                             name version commit files 'tar)
+                            (error "%s[-pkg].el matching package name is missing"
+-                                  name))))
+-               (mtime (package-build--get-commit-time rcp commit)))
++                                  name)))))
+           (package-build--copy-package-files files source-dir target)
+           (package-build--write-pkg-file desc target)
+           (package-build--generate-info-files files source-dir target)
+-          (package-build--create-tar name version tmp-dir mtime)
++          (package-build--create-tar name version tmp-dir)
+           (package-build--write-pkg-readme name files source-dir)
+           (package-build--write-archive-entry desc))
+       (delete-directory tmp-dir t nil))))
+-- 
+2.37.2
+

pkgs/development/compilers/gleam/default.nix

@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gleam";
-  version = "0.22.1";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "gleam-lang";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-/mP15jPZiiavnZ7fwFehSSzJUtVVmksj1xfbDOycxmQ=";
+    sha256 = "sha256-7KoJ00EMFWv14Zs9thCHqS7i7V4TdWIGcnEaOtHpKF4=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ] ++
     lib.optionals stdenv.isDarwin [ Security libiconv ];
 
-  cargoSha256 = "sha256-JAQQiCnl/EMKCMqoL8WkwUcjng+MSz2Cjb3L5yyrQ+E=";
+  cargoSha256 = "sha256-YgQQK8Ojz+s+OohhpcsweW8hEdhmba/YcgDj6M6Ae00=";
 
   meta = with lib; {
     description = "A statically typed language for the Erlang VM";

pkgs/top-level/all-packages.nix

@@ -30563,6 +30563,8 @@ with pkgs;
 
   ponymix = callPackage ../applications/audio/ponymix { };
 
+  popcorntime = callPackage ../applications/video/popcorntime {};
+
   pothos = libsForQt5.callPackage ../applications/radio/pothos { };
 
   potrace = callPackage ../applications/graphics/potrace {};