Merge master into staging-next

doc/contributing/coding-conventions.chapter.md

@@ -487,12 +487,12 @@ Preferred source hash type is sha256. There are several ways to get it.
    - `lib.fakeHash`
    - `lib.fakeSha256`
    - `lib.fakeSha512`
-   
+
    in the package expression, attempt build and extract correct hash from error messages.
 
    ::: {.warning}
    You must use one of these four fake hashes and not some arbitrarily-chosen hash.
-   
+
    See [](#sec-source-hashes-security).
    :::
 
@@ -670,3 +670,18 @@ stdenv.mkDerivation {
   ...
 }
 ```
+
+### Import From Derivation {#ssec-import-from-derivation}
+
+Import From Derivation (IFD) is disallowed in Nixpkgs for performance reasons:
+[Hydra] evaluates the entire package set, and sequential builds during evaluation would increase evaluation times to become impractical.
+
+[Hydra]: https://github.com/NixOS/hydra
+
+Import From Derivation can be worked around in some cases by committing generated intermediate files to version control and reading those instead.
+
+<!-- TODO: remove the following and link to Nix manual once https://github.com/NixOS/nix/pull/7332 is merged -->
+
+See also [NixOS Wiki: Import From Derivation].
+
+[NixOS Wiki: Import From Derivation]: https://nixos.wiki/wiki/Import_From_Derivation

doc/languages-frameworks/javascript.section.md

@@ -330,13 +330,16 @@ mkYarnPackage rec {
   - The `echo 9` steps comes from this answer: <https://stackoverflow.com/a/49139496>
   - Exporting the headers in `npm_config_nodedir` comes from this issue: <https://github.com/nodejs/node-gyp/issues/1191#issuecomment-301243919>
 
-## Outside of nixpkgs {#javascript-outside-nixpkgs}
+## Outside Nixpkgs {#javascript-outside-nixpkgs}
 
-There are some other options available that can't be used inside nixpkgs. Those other options are written in Nix. Importing them in nixpkgs will require moving the source code into nixpkgs. Using [Import From Derivation](https://nixos.wiki/wiki/Import_From_Derivation) is not allowed in Hydra at present. If you are packaging something outside nixpkgs, those can be considered
+There are some other tools available, which are written in the Nix language.
+These that can't be used inside Nixpkgs because they require [Import From Derivation](#ssec-import-from-derivation), which is not allowed in Nixpkgs.
+
+If you are packaging something outside Nixpkgs, consider the following:
 
 ### npmlock2nix {#javascript-npmlock2nix}
 
-[npmlock2nix](https://github.com/nix-community/npmlock2nix) aims at building node_modules without code generation. It hasn't reached v1 yet, the API might be subject to change.
+[npmlock2nix](https://github.com/nix-community/npmlock2nix) aims at building `node_modules` without code generation. It hasn't reached v1 yet, the API might be subject to change.
 
 #### Pitfalls {#javascript-npmlock2nix-pitfalls}
 
@@ -344,7 +347,7 @@ There are some [problems with npm v7](https://github.com/tweag/npmlock2nix/issue
 
 ### nix-npm-buildpackage {#javascript-nix-npm-buildpackage}
 
-[nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage) aims at building node_modules without code generation. It hasn't reached v1 yet, the API might change. It supports both package-lock.json and yarn.lock.
+[nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage) aims at building `node_modules` without code generation. It hasn't reached v1 yet, the API might change. It supports both `package-lock.json` and yarn.lock.
 
 #### Pitfalls {#javascript-nix-npm-buildpackage-pitfalls}
 

lib/strings.nix

@@ -860,9 +860,9 @@ rec {
   */
   toInt = str:
     let
-      # RegEx: Match any leading whitespace, then any digits, and finally match any trailing
-      # whitespace.
-      strippedInput = match "[[:space:]]*([[:digit:]]+)[[:space:]]*" str;
+      # RegEx: Match any leading whitespace, possibly a '-', one or more digits,
+      # and finally match any trailing whitespace.
+      strippedInput = match "[[:space:]]*(-?[[:digit:]]+)[[:space:]]*" str;
 
       # RegEx: Match a leading '0' then one or more digits.
       isLeadingZero = match "0[[:digit:]]+" (head strippedInput) == [];
@@ -911,9 +911,10 @@ rec {
   */
   toIntBase10 = str:
     let
-      # RegEx: Match any leading whitespace, then match any zero padding, capture any remaining
-      # digits after that, and finally match any trailing whitespace.
-      strippedInput = match "[[:space:]]*0*([[:digit:]]+)[[:space:]]*" str;
+      # RegEx: Match any leading whitespace, then match any zero padding,
+      # capture possibly a '-' followed by one or more digits,
+      # and finally match any trailing whitespace.
+      strippedInput = match "[[:space:]]*0*(-?[[:digit:]]+)[[:space:]]*" str;
 
       # RegEx: Match at least one '0'.
       isZero = match "0+" (head strippedInput) == [];

lib/tests/misc.nix

@@ -339,6 +339,8 @@ runTests {
     (0 == toInt " 0")
     (0 == toInt "0 ")
     (0 == toInt " 0 ")
+    (-1 == toInt "-1")
+    (-1 == toInt " -1 ")
   ];
 
   testToIntFails = testAllTrue [
@@ -383,6 +385,8 @@ runTests {
     (0 == toIntBase10 " 000000")
     (0 == toIntBase10 "000000 ")
     (0 == toIntBase10 " 000000 ")
+    (-1 == toIntBase10 "-1")
+    (-1 == toIntBase10 " -1 ")
   ];
 
   testToIntBase10Fails = testAllTrue [

nixos/modules/services/home-automation/evcc.nix

@@ -48,7 +48,10 @@ in
       wantedBy = [
         "multi-user.target"
       ];
-
+      environment.HOME = "/var/lib/evcc";
+      path = with pkgs; [
+        glibc # requires getent
+      ];
       serviceConfig = {
         ExecStart = "${package}/bin/evcc --config ${configFile} ${escapeShellArgs cfg.extraArgs}";
         CapabilityBoundingSet = [ "" ];
@@ -77,6 +80,7 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
+        StateDirectory = "evcc";
         SystemCallArchitectures = "native";
         SystemCallFilter = [
           "@system-service"

nixos/tests/evcc.nix

@@ -87,6 +87,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} :
 
     with subtest("Check journal for errors"):
         _, output = machine.execute("journalctl -o cat -u evcc.service")
+        assert "FATAL" not in output
         assert "ERROR" not in output
 
     with subtest("Check systemd hardening"):

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -167,13 +167,13 @@
     "vendorHash": null
   },
   "bitbucket": {
-    "hash": "sha256-tT5JSiUPeezQFn4tnKrsUxfm/llaBk8R2eOGqGIbEH4=",
+    "hash": "sha256-NPcAYceokJHqfQU/cx9S2c8riFbU2tTTJEuHXPPP+eE=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.23.0",
+    "rev": "v2.24.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-CFRZSdQnbhV7n10r2R1+cGxn7nKD+GvXWf85rYFRPVI="
+    "vendorHash": "sha256-Db8mo4XOjWi3n8Ni94f4/urWkU3/WfEVQsmXEGFmpQI="
   },
   "brightbox": {
     "hash": "sha256-F/AQq45ADM0+PbFpMPtpMvbYw8F41GDBzk7LoY/L/Qg=",

pkgs/desktops/pantheon/apps/elementary-code/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , appstream
 , desktop-file-utils
@@ -36,6 +37,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-QhJNRhYgGbPMd7B1X3kG+pnC/lGUoF7gc7O1PdG49LI=";
   };
 
+  patches = [
+    # Fix drag and drop of accented text and between tabs
+    # https://github.com/elementary/code/pull/1194
+    (fetchpatch {
+      url = "https://github.com/elementary/code/commit/1ed7b590768ea9cb5b4658e27d9dc7ac224442ae.patch";
+      sha256 = "sha256-VrYcEbkzQKi5gFB/Vw/0NITZvSXKXfuEv2R3m0VALVM=";
+    })
+  ];
+
   nativeBuildInputs = [
     appstream
     desktop-file-utils

pkgs/desktops/pantheon/apps/elementary-videos/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-videos";
-  version = "2.8.4";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "videos";
     rev = version;
-    sha256 = "sha256-IUIY/WgGPVRYk9O+ZocopoBF7TlLnTtScNwO6gDCALw=";
+    sha256 = "sha256-QQcuhYe3/ZMqQEFJS72+vr1AzJC9Y7mr5Fa5yFsNYIc=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/pantheon/services/elementary-capnet-assist/default.nix

@@ -13,19 +13,19 @@
 , libgee
 , libhandy
 , gcr
-, webkitgtk
+, webkitgtk_4_1
 , wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
   pname = "elementary-capnet-assist";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "capnet-assist";
     rev = version;
-    sha256 = "sha256-aA71kxu4/dwODZt+DSp3vvely3P0dL23Ykqhd84hrZw=";
+    sha256 = "sha256-06DWkLkVpdSYnKOR8zqA0tvWXYrglBM9R/XEIfIkwQU=";
   };
 
   nativeBuildInputs = [
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     gtk3
     libgee
     libhandy
-    webkitgtk
+    webkitgtk_4_1
   ];
 
   postPatch = ''

pkgs/development/libraries/httplib/default.nix

@@ -5,13 +5,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "httplib";
-  version = "0.11.1";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "yhirose";
     repo = "cpp-httplib";
     rev = "v${version}";
-    sha256 = "sha256-rsElqtoRz/sOXpAsfSJbMlwIKdaGJkSZfKHzB/wMhY8=";
+    hash = "sha256-gly0AQ2DCZJQCAPQL5Xsc/kTvFK2twIDbHwbjvrW+P4=";
   };
 
   # Header-only library.
@@ -25,6 +25,7 @@ stdenvNoCC.mkDerivation rec {
   meta = with lib; {
     description = "A C++ header-only HTTP/HTTPS server and client library";
     homepage = "https://github.com/yhirose/cpp-httplib";
+    changelog = "https://github.com/yhirose/cpp-httplib/releases/tag/v${version}";
     maintainers = with maintainers; [ aidalgol ];
     license = licenses.mit;
   };

pkgs/development/python-modules/notify-py/default.nix

@@ -1,12 +1,14 @@
 { lib
 , stdenv
 , buildPythonPackage
-, isPy3k
+, pythonOlder
 , fetchFromGitHub
 , substituteAll
 , alsa-utils
 , libnotify
 , which
+, poetry-core
+, pythonRelaxDepsHook
 , jeepney
 , loguru
 , pytest
@@ -16,15 +18,17 @@
 
 buildPythonPackage rec {
   pname = "notify-py";
-  version = "0.3.3";
+  version = "0.3.38";
 
-  disabled = !isPy3k;
+  disabled = pythonOlder "3.6";
+
+  format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "ms7m";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1n35adwsyhz304n4ifnsz6qzkymwhyqc8sg8d76qv5psv2xsnzlf";
+    hash = "sha256-wlA7a10f4PYP3dYYwZqMULQ5FMCXpOUOTxXzEEVZCsI=";
   };
 
   patches = lib.optionals stdenv.isLinux [
@@ -42,6 +46,15 @@ buildPythonPackage rec {
     })
   ];
 
+  nativeBuildInputs = [
+    poetry-core
+    pythonRelaxDepsHook
+  ];
+
+  pythonRelaxDeps = [
+    "loguru"
+  ];
+
   propagatedBuildInputs = [
     loguru
   ] ++ lib.optionals stdenv.isLinux [
@@ -67,6 +80,10 @@ buildPythonPackage rec {
     pytest
   '';
 
+  # GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name
+  # org.freedesktop.Notifications was not provided by any .service files
+  doCheck = false;
+
   pythonImportsCheck = [ "notifypy" ];
 
   meta = with lib; {

pkgs/development/python-modules/notify-py/linux-paths.patch

@@ -1,54 +1,22 @@
 diff --git a/notifypy/os_notifiers/linux.py b/notifypy/os_notifiers/linux.py
-index ee89216..5201574 100644
+index 5882481..e26eaaf 100644
 --- a/notifypy/os_notifiers/linux.py
 +++ b/notifypy/os_notifiers/linux.py
-@@ -53,30 +53,12 @@ class LinuxNotifierLibNotify(BaseNotifier):
-     @staticmethod
-     def _find_installed_aplay():
-         """Function to find the path for notify-send"""
--        try:
--            run_which_for_aplay = subprocess.check_output(["which", "aplay"])
--            return run_which_for_aplay.decode("utf-8")
--        except subprocess.CalledProcessError:
--            logger.exception("Unable to find aplay.")
--            return False
--        except Exception:
--            logger.exception("Unhandled exception for finding aplay.")
--            return False
-+        return "@aplay@"
+@@ -10,7 +10,7 @@ try:
+     from jeepney.io.blocking import open_dbus_connection
+     from shutil import which
  
-     @staticmethod
-     def _find_installed_notify_send():
-         """Function to find the path for notify-send"""
--        try:
--            run_which_for_notify_send = subprocess.check_output(
--                ["which", "notify-send"]
--            )
--            return run_which_for_notify_send.decode("utf-8")
--        except subprocess.CalledProcessError:
--            logger.exception("Unable to find notify-send.")
--            return False
--        except Exception:
--            logger.exception("Unhandled exception for finding notify-send.")
--            return False
-+        return "@notifysend@"
+-    NOTIFY = which('notify-send') # alternatively: from ctypes.util import find_library 
++    NOTIFY = '@notifysend@' # alternatively: from ctypes.util import find_library 
  
-     def send_notification(
-         self,
-@@ -159,15 +141,7 @@ class LinuxNotifier(BaseNotifier):
-     @staticmethod
-     def _find_installed_aplay():
-         """Function to find the path for notify-send"""
--        try:
--            run_which_for_aplay = subprocess.check_output(["which", "aplay"])
--            return run_which_for_aplay.decode("utf-8")
--        except subprocess.CalledProcessError:
--            logger.exception("Unable to find aplay.")
--            return False
--        except Exception:
--            logger.exception("Unhandled exception for finding aplay.")
--            return False
-+        return "@aplay@"
+     if NOTIFY:
+         logger.info("libnotify found, using it for notifications")
+@@ -22,7 +22,7 @@ try:
+         else:
+             raise ImportError
  
-     def send_notification(
-         self,
+-    APLAY = which('aplay')
++    APLAY = '@aplay@'
+ 
+     if APLAY == None:
+         logger.debug("aplay binary not installed.. audio will not work!")

pkgs/development/python-modules/toggl-cli/default.nix

@@ -57,7 +57,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace requirements.txt \
-      --replace "notify-py==0.3.1" "notify-py>=0.3.1" \
+      --replace "notify-py==0.3.3" "notify-py>=0.3.3" \
       --replace "click==8.0.3" "click>=8.0.3" \
       --replace "pbr==5.8.0" "pbr>=5.8.0" \
       --replace "inquirer==2.9.1" "inquirer>=2.9.1"

pkgs/development/tools/continuous-integration/github-runner/default.nix

@@ -263,8 +263,8 @@ stdenv.mkDerivation rec {
   '' + lib.optionalString stdenv.isLinux ''
     # Make binary paths absolute
     substituteInPlace $out/lib/config.sh \
-      --replace 'ldd' '${glibc}/bin/ldd' \
-      --replace '/sbin/ldconfig' '${glibc}/bin/ldconfig'
+      --replace 'ldd' '${glibc.bin}/bin/ldd' \
+      --replace '/sbin/ldconfig' '${glibc.bin}/bin/ldconfig'
   '' + ''
     # Remove uneeded copy for run-helper template
     substituteInPlace $out/lib/run.sh --replace 'cp -f "$DIR"/run-helper.sh.template "$DIR"/run-helper.sh' ' '

pkgs/development/tools/ruff/default.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ruff";
-  version = "0.0.171";
+  version = "0.0.173";
 
   src = fetchFromGitHub {
     owner = "charliermarsh";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-2aqpQo7U17wqQ/YUMreOOKkcVWiKHAdFAUL/6HP6zN8=";
+    sha256 = "sha256-Z2BcLgqtIWYFq2go0a35WmQXvnWMrj+7OxHmmb2dgxk=";
   };
 
-  cargoSha256 = "sha256-N/WoPc2BxujqE/OSp9RWS7dBHGKxIixtBqwDwR3p6TM=";
+  cargoSha256 = "sha256-uhMTikyfbMMAf122Nc5NFbOqsICc6nK7s1n1+97mzxQ=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices

pkgs/development/tools/rust/cargo-nextest/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.45";
+  version = "0.9.47";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    sha256 = "sha256-Sb5xJCxUz60TfDMqv7Q7hTRVXvligpWkTG4FRAO/H3c=";
+    sha256 = "sha256-G7Y2x9aRcQB28uR2TlyG8JW9kYSD9iMPASd0VFXOxcE=";
   };
 
-  cargoSha256 = "sha256-LzhrPQXr+CfzNoMWrPekDvtoPn0iqLhBV+3NO5AV0Po=";
+  cargoSha256 = "sha256-7fesLvkHPpPS4xKn3r6hLjQzP0udm92BsVPhdckTk7c=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ Security ];
 

pkgs/development/tools/rust/rust-script/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-script";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "fornwall";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-5T5DivfT7/MkBJo5YgLAVnfct84nBhw/OXWQ/4TMm2A=";
+    rev = version;
+    sha256 = "sha256-R9L53ThJKf68M4idNiWfO6fUDJNqiyrzCmdbEvo8OMM=";
   };
 
-  cargoSha256 = "sha256-mDH3R9gn64DXVoe3Vkl2Kwhr7OTOUWKBLW5Y+Uo4aXM=";
+  cargoSha256 = "sha256-hi0jtI6KtvBjyhhOEEE1x2l7DSIAC4tkRIF9SLFwFQI=";
 
   # tests require network access
   doCheck = false;

pkgs/servers/piping-server-rust/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "piping-server-rust";
-  version = "0.14.1";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "nwtgck";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-QgOrKAPLphvIMqcOrbYuo4ra65IV8dK5+6tyh+YyyP4=";
+    sha256 = "sha256-s7tfGt1P/GmvjkIcy8DEwz+ObPxoMsIL7meAc5vMkKo=";
   };
 
-  cargoSha256 = "sha256-Nd+Frhospp6ERYFuxzEzKbkLAFqTv7Lp7MWwv09S+KA=";
+  cargoSha256 = "sha256-gqKEFqf49sKZy+L0X4MxUfx2+iYoNIU415xHqOy8MZA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices Security ];
 

pkgs/servers/redpanda/default.nix

@@ -1,13 +1,13 @@
 { lib, stdenv, fetchzip }:
 
 let
-  version = "22.3.1";
+  version = "22.3.5";
   platform = if stdenv.isLinux then "linux" else "darwin";
   arch = if stdenv.isAarch64 then "arm" else "amd";
   sha256s = {
     darwin.amd = "sha256-AXk3aP1SGiHTfHTCBRTagX0DAVmdcVVIkxWaTnZxB8g=";
     darwin.arm = "sha256-pvOVvNc8lZ2d2fVZVYWvumVWYpnLORNY/3o1t4BN2N4=";
-    linux.amd = "sha256-liUFM9f7OQocb5j/qvZNVWiJGIf651ULMlRmX67qyoQ=";
+    linux.amd = "sha256-wsUuSCstYucjMpFsqssPGEhm3zCrAdE9Mldtkypbthg=";
     linux.arm = "sha256-WHjYAbytiu747jFqN0KZ/CkIwAVI7fb32ywtRiQOBm8=";
   };
 in stdenv.mkDerivation rec {

pkgs/tools/admin/wander/default.nix

@@ -2,24 +2,17 @@
 
 buildGoModule rec {
   pname = "wander";
-  version = "0.8.0";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "robinovitch61";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-G/TrfnmEyomdUCN5nUS9v5iqeUzgZzMLUZnfroQLZuk=";
+    sha256 = "sha256-BcjK1GNj6URk6PmZIqG/t6vvy5ZXo3Z6wDqY1kbLSfw=";
   };
 
   vendorSha256 = "sha256-iTaZ5/0UrLJ3JE3FwQpvjKKrhqklG4n1WFTJhWfj/rI=";
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/robinovitch61/wander/commit/b3d3249541de005404a41c17a15218a4f73f68e5.patch";
-      sha256 = "sha256-z8bdSFcAqnwEu0gupxW/L1o/asyxbvTYIdtLZNmQpz8=";
-    })
-  ];
-
   ldflags = [ "-X github.com/robinovitch61/wander/cmd.Version=v${version}" ];
 
   nativeBuildInputs = [ installShellFiles ];