Merge master into haskell-updates

2022-01-12 00:08:56 +00:00 · 2022-01-12 00:08:56 +00:00 · d15d1eee10
parent 8cfaa61875 9ed7e66d81
commit d15d1eee10
232 changed files with 3070 additions and 1401 deletions
--- a/2
+++ b/2
@ -1,4 +1,4 @@
-Copyright (c) 2003-2021 Eelco Dolstra and the Nixpkgs/NixOS contributors
+Copyright (c) 2003-2022 Eelco Dolstra and the Nixpkgs/NixOS contributors

 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@ -3,9 +3,9 @@

 let
  inherit (builtins) head tail length;
-  inherit (lib.trivial) and;
+  inherit (lib.trivial) id;
  inherit (lib.strings) concatStringsSep sanitizeDerivationName;
-  inherit (lib.lists) foldr foldl' concatMap concatLists elemAt;
+  inherit (lib.lists) foldr foldl' concatMap concatLists elemAt all;
 in

 rec {
@ -73,9 +73,9 @@ rec {
       getAttrFromPath ["z" "z"] x
       => error: cannot find attribute `z.z'
  */
-  getAttrFromPath = attrPath: set:
+  getAttrFromPath = attrPath:
    let errorMsg = "cannot find attribute `" + concatStringsSep "." attrPath + "'";
-    in attrByPath attrPath (abort errorMsg) set;
+    in attrByPath attrPath (abort errorMsg);


  /* Return the specified attributes from a set.
@ -154,12 +154,12 @@ rec {
       foldAttrs (n: a: [n] ++ a) [] [{ a = 2; } { a = 3; }]
       => { a = [ 2 3 ]; }
  */
-  foldAttrs = op: nul: list_of_attrs:
+  foldAttrs = op: nul:
    foldr (n: a:
        foldr (name: o:
          o // { ${name} = op n.${name} (a.${name} or nul); }
        ) a (attrNames n)
-    ) {} list_of_attrs;
+    ) {};


  /* Recursively collect sets that verify a given predicate named `pred'
@ -295,14 +295,14 @@ rec {
  */
  mapAttrsRecursiveCond = cond: f: set:
    let
-      recurse = path: set:
+      recurse = path:
        let
          g =
            name: value:
            if isAttrs value && cond value
              then recurse (path ++ [name]) value
              else f (path ++ [name]) value;
-        in mapAttrs g set;
+        in mapAttrs g;
    in recurse [] set;


@ -369,7 +369,7 @@ rec {
      value = f name (catAttrs name sets);
    }) names);

-  /* Implementation note: Common names  appear multiple times in the list of
+  /* Implementation note: Common names appear multiple times in the list of
     names, hopefully this does not affect the system because the maximal
     laziness avoid computing twice the same expression and listToAttrs does
     not care about duplicated attribute names.
@ -420,8 +420,8 @@ rec {
    let f = attrPath:
      zipAttrsWith (n: values:
        let here = attrPath ++ [n]; in
-        if tail values == []
-        || pred here (head (tail values)) (head values) then
+        if length values == 1
+        || pred here (elemAt values 1) (head values) then
          head values
        else
          f here values
@ -447,10 +447,7 @@ rec {
       }

     */
-  recursiveUpdate = lhs: rhs:
-    recursiveUpdateUntil (path: lhs: rhs:
-      !(isAttrs lhs && isAttrs rhs)
-    ) lhs rhs;
+  recursiveUpdate = recursiveUpdateUntil (path: lhs: rhs: !(isAttrs lhs && isAttrs rhs));

  /* Returns true if the pattern is contained in the set. False otherwise.

@ -459,8 +456,8 @@ rec {
       => true
   */
  matchAttrs = pattern: attrs: assert isAttrs pattern;
-    foldr and true (attrValues (zipAttrsWithNames (attrNames pattern) (n: values:
-      let pat = head values; val = head (tail values); in
+    all id (attrValues (zipAttrsWithNames (attrNames pattern) (n: values:
+      let pat = head values; val = elemAt values 1; in
      if length values == 1 then false
      else if isAttrs pat then isAttrs val && matchAttrs pat val
      else pat == val
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3435,6 +3435,12 @@
    githubId = 4742;
    name = "Aaron Bull Schaefer";
  };
+  elatov = {
+    email = "elatov@gmail.com";
+    github = "elatov";
+    githubId = 7494394;
+    name = "Karim Elatov";
+  };
  eleanor = {
    email = "dejan@proteansec.com";
    github = "proteansec";
@ -4116,12 +4122,6 @@
    githubId = 7551358;
    name = "Frede Emil";
  };
-  freepotion = {
-    email = "42352817+freepotion@users.noreply.github.com";
-    github = "freepotion";
-    githubId = 42352817;
-    name = "Free Potion";
-  };
  freezeboy = {
    email = "freezeboy@users.noreply.github.com";
    github = "freezeboy";
@ -6374,7 +6374,7 @@
  };

  kmein = {
-    email = "kieran.meinhardt@gmail.com";
+    email = "kmein@posteo.de";
    name = "Kierán Meinhardt";
    github = "kmein";
    githubId = 10352507;
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -119,6 +119,22 @@
          <link xlink:href="options.html#opt-services.archisteamfarm.enable">services.archisteamfarm</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://goteleport.com">teleport</link>,
+          allows engineers and security professionals to unify access
+          for SSH servers, Kubernetes clusters, web applications, and
+          databases across all environments. Available at
+          <link linkend="opt-services.teleport.enable">services.teleport</link>.
+        </para>
+      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://loic-sharma.github.io/BaGet/">BaGet</link>,
+          a lightweight NuGet and symbol server. Available at
+          <link linkend="opt-services.baget.enable">services.baget</link>.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-22.05-incompatibilities">
@ -206,6 +222,12 @@
          <literal>virtualisation.docker.daemon.settings</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          opensmtpd-extras is no longer build with python2 scripting
+          support due to python2 deprecation in nixpkgs
+        </para>
+      </listitem>
      <listitem>
        <para>
          The <literal>autorestic</literal> package has been upgraded
@ -252,6 +274,15 @@
          set <literal>autoSubUidGidRange = true</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>idris2</literal> now requires
+          <literal>--package</literal> when using packages
+          <literal>contrib</literal> and <literal>network</literal>,
+          while previously these idris2 packages were automatically
+          loaded.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>services.thelounge.private</literal> was removed in
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -37,6 +37,10 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](options.html#opt-services.archisteamfarm.enable).

+- [teleport](https://goteleport.com), allows engineers and security professionals to unify access for SSH servers, Kubernetes clusters, web applications, and databases across all environments. Available at [services.teleport](#opt-services.teleport.enable).
+
+- [BaGet](https://loic-sharma.github.io/BaGet/), a lightweight NuGet and symbol server. Available at [services.baget](#opt-services.baget.enable).
+
 ## Backward Incompatibilities {#sec-release-22.05-incompatibilities}

 - `pkgs.ghc` now refers to `pkgs.targetPackages.haskellPackages.ghc`.
@ -70,6 +74,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - If you previously used `/etc/docker/daemon.json`, you need to incorporate the changes into the new option `virtualisation.docker.daemon.settings`.

+- opensmtpd-extras is no longer build with python2 scripting support due to python2 deprecation in nixpkgs
+
 - The `autorestic` package has been upgraded from 1.3.0 to 1.5.0 which introduces breaking changes in config file, check [their migration guide](https://autorestic.vercel.app/migration/1.4_1.5) for more details.

 - For `pkgs.python3.pkgs.ipython`, its direct dependency `pkgs.python3.pkgs.matplotlib-inline`
@ -83,6 +89,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - Normal users (with `isNormalUser = true`) which have non-empty `subUidRanges` or `subGidRanges` set no longer have additional implicit ranges allocated. To enable automatic allocation back set `autoSubUidGidRange = true`.

+- `idris2` now requires `--package` when using packages `contrib` and `network`, while previously these idris2 packages were automatically loaded.
+
 - `services.thelounge.private` was removed in favor of `services.thelounge.public`, to follow with upstream changes.

 ## Other Notable Changes {#sec-release-22.05-notable-changes}
--- a/nixos/modules/hardware/hackrf.nix
+++ b/nixos/modules/hardware/hackrf.nix
@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.hardware.hackrf;
+
+in
+{
+  options.hardware.hackrf = {
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enables hackrf udev rules and ensures 'plugdev' group exists.
+        This is a prerequisite to using HackRF devices without being root, since HackRF USB descriptors will be owned by plugdev through udev.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.udev.packages = [ pkgs.hackrf ];
+    users.groups.plugdev = { };
+  };
+}
--- a/nixos/modules/hardware/rtl-sdr.nix
+++ b/nixos/modules/hardware/rtl-sdr.nix
@ -5,10 +5,14 @@ let

 in {
  options.hardware.rtl-sdr = {
-    enable = lib.mkEnableOption ''
-      Enables rtl-sdr udev rules, ensures 'plugdev' group exists, and blacklists DVB kernel modules.
-      This is a prerequisite to using devices supported by rtl-sdr without being root, since rtl-sdr USB descriptors will be owned by plugdev through udev.
-    '';
+    enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Enables rtl-sdr udev rules, ensures 'plugdev' group exists, and blacklists DVB kernel modules.
+        This is a prerequisite to using devices supported by rtl-sdr without being root, since rtl-sdr USB descriptors will be owned by plugdev through udev.
+       '';
+    };
  };

  config = lib.mkIf cfg.enable {
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -53,6 +53,7 @@
  ./hardware/flirc.nix
  ./hardware/gpgsmartcards.nix
  ./hardware/i2c.nix
+  ./hardware/hackrf.nix
  ./hardware/sensor/hddtemp.nix
  ./hardware/sensor/iio.nix
  ./hardware/keyboard/teck.nix
@ -226,7 +227,7 @@
  ./programs/zsh/zsh-autosuggestions.nix
  ./programs/zsh/zsh-syntax-highlighting.nix
  ./rename.nix
-  ./security/acme.nix
+  ./security/acme
  ./security/apparmor.nix
  ./security/audit.nix
  ./security/auditd.nix
@ -891,6 +892,7 @@
  ./services/networking/tcpcrypt.nix
  ./services/networking/teamspeak3.nix
  ./services/networking/tedicross.nix
+  ./services/networking/teleport.nix
  ./services/networking/thelounge.nix
  ./services/networking/tinc.nix
  ./services/networking/tinydns.nix
@ -991,6 +993,7 @@
  ./services/web-apps/bookstack.nix
  ./services/web-apps/calibre-web.nix
  ./services/web-apps/code-server.nix
+  ./services/web-apps/baget.nix
  ./services/web-apps/convos.nix
  ./services/web-apps/cryptpad.nix
  ./services/web-apps/dex.nix
--- a/nixos/modules/programs/ssh.nix
+++ b/nixos/modules/programs/ssh.nix
@ -25,6 +25,9 @@ let
      + (if h.publicKey != null then h.publicKey else readFile h.publicKeyFile)
    )) + "\n";

+  knownHostsFiles = [ "/etc/ssh/ssh_known_hosts" "/etc/ssh/ssh_known_hosts2" ]
+    ++ map pkgs.copyPathToStore cfg.knownHostsFiles;
+
 in
 {
  ###### interface
@ -177,7 +180,9 @@ in
                You can fetch a public key file from a running SSH server
                with the <command>ssh-keyscan</command> command. The content
                of the file should follow the same format as described for
-                the <literal>publicKey</literal> option.
+                the <literal>publicKey</literal> option. Only a single key
+                is supported. If a host has multiple keys, use
+                <option>programs.ssh.knownHostsFiles</option> instead.
              '';
            };
          };
@ -202,6 +207,28 @@ in
        '';
      };

+      knownHostsFiles = mkOption {
+        default = [];
+        type = with types; listOf path;
+        description = ''
+          Files containing SSH host keys to set as global known hosts.
+          <literal>/etc/ssh/ssh_known_hosts</literal> (which is
+          generated by <option>programs.ssh.knownHosts</option>) and
+          <literal>/etc/ssh/ssh_known_hosts2</literal> are always
+          included.
+        '';
+        example = literalExpression ''
+          [
+            ./known_hosts
+            (writeText "github.keys" '''
+              github.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==
+              github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
+              github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
+            ''')
+          ]
+        '';
+      };
+
      kexAlgorithms = mkOption {
        type = types.nullOr (types.listOf types.str);
        default = null;
@ -258,6 +285,7 @@ in
        # Generated options from other settings
        Host *
        AddressFamily ${if config.networking.enableIPv6 then "any" else "inet"}
+        GlobalKnownHostsFile ${concatStringsSep " " knownHostsFiles}

        ${optionalString cfg.setXAuthLocation ''
          XAuthLocation ${pkgs.xorg.xauth}/bin/xauth
--- a/nixos/modules/security/acme/default.nix
+++ b/nixos/modules/security/acme/default.nix
@ -916,6 +916,6 @@ in {

  meta = {
    maintainers = lib.teams.acme.members;
-    doc = ./acme.xml;
+    doc = ./doc.xml;
  };
 }
--- a/nixos/modules/security/acme/doc.xml
+++ b/nixos/modules/security/acme/doc.xml
--- a/nixos/modules/security/acme/mk-cert-ownership-assertion.nix
+++ b/nixos/modules/security/acme/mk-cert-ownership-assertion.nix
@ -0,0 +1,4 @@
+{ cert, group, groups, user }: {
+  assertion = cert.group == group || builtins.any (u: u == user) groups.${cert.group}.members;
+  message = "Group for certificate ${cert.domain} must be ${group}, or user ${user} must be a member of group ${cert.group}";
+}
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@ -7,15 +7,16 @@ let

  # Convert systemd-style address specification to kresd config line(s).
  # On Nix level we don't attempt to precisely validate the address specifications.
+  # The optional IPv6 scope spec comes *after* port, perhaps surprisingly.
  mkListen = kind: addr: let
-    al_v4 = builtins.match "([0-9.]+):([0-9]+)" addr;
-    al_v6 = builtins.match "\\[(.+)]:([0-9]+)" addr;
+    al_v4 = builtins.match "([0-9.]+):([0-9]+)()" addr;
+    al_v6 = builtins.match "\\[(.+)]:([0-9]+)(%.*|$)" addr;
    al_portOnly = builtins.match "([0-9]+)" addr;
    al = findFirst (a: a != null)
      (throw "services.kresd.*: incorrect address specification '${addr}'")
      [ al_v4 al_v6 al_portOnly ];
-    port = last al;
-    addrSpec = if al_portOnly == null then "'${head al}'" else "{'::', '0.0.0.0'}";
+    port = elemAt al 1;
+    addrSpec = if al_portOnly == null then "'${head al}${elemAt al 2}'" else "{'::', '0.0.0.0'}";
    in # freebind is set for compatibility with earlier kresd services;
       # it could be configurable, for example.
      ''
--- a/nixos/modules/services/networking/teleport.nix
+++ b/nixos/modules/services/networking/teleport.nix
@ -0,0 +1,99 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.teleport;
+  settingsYaml = pkgs.formats.yaml { };
+in
+{
+  options = {
+    services.teleport = with lib.types; {
+      enable = mkEnableOption "the Teleport service";
+
+      settings = mkOption {
+        type = settingsYaml.type;
+        default = { };
+        example = literalExpression ''
+          {
+            teleport = {
+              nodename = "client";
+              advertise_ip = "192.168.1.2";
+              auth_token = "60bdc117-8ff4-478d-95e4-9914597847eb";
+              auth_servers = [ "192.168.1.1:3025" ];
+              log.severity = "DEBUG";
+            };
+            ssh_service = {
+              enabled = true;
+              labels = {
+                role = "client";
+              };
+            };
+            proxy_service.enabled = false;
+            auth_service.enabled = false;
+          }
+        '';
+        description = ''
+          Contents of the <literal>teleport.yaml</literal> config file.
+          The <literal>--config</literal> arguments will only be passed if this set is not empty.
+
+          See <link xlink:href="https://goteleport.com/docs/setup/reference/config/"/>.
+        '';
+      };
+
+      insecure.enable = mkEnableOption ''
+        starting teleport in insecure mode.
+
+        This is dangerous!
+        Sensitive information will be logged to console and certificates will not be verified.
+        Proceed with caution!
+
+        Teleport starts with disabled certificate validation on Proxy Service, validation still occurs on Auth Service
+      '';
+
+      diag = {
+        enable = mkEnableOption ''
+          endpoints for monitoring purposes.
+
+          See <link xlink:href="https://goteleport.com/docs/setup/admin/troubleshooting/#troubleshooting/"/>
+        '';
+
+        addr = mkOption {
+          type = str;
+          default = "127.0.0.1";
+          description = "Metrics and diagnostics address.";
+        };
+
+        port = mkOption {
+          type = int;
+          default = 3000;
+          description = "Metrics and diagnostics port.";
+        };
+      };
+    };
+  };
+
+  config = mkIf config.services.teleport.enable {
+    environment.systemPackages = [ pkgs.teleport ];
+
+    systemd.services.teleport = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      serviceConfig = {
+        ExecStart = ''
+          ${pkgs.teleport}/bin/teleport start \
+            ${optionalString cfg.insecure.enable "--insecure"} \
+            ${optionalString cfg.diag.enable "--diag-addr=${cfg.diag.addr}:${toString cfg.diag.port}"} \
+            ${optionalString (cfg.settings != { }) "--config=${settingsYaml.generate "teleport.yaml" cfg.settings}"}
+        '';
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        LimitNOFILE = 65536;
+        Restart = "always";
+        RestartSec = "5s";
+        RuntimeDirectory = "teleport";
+        Type = "simple";
+      };
+    };
+  };
+}
+
--- a/nixos/modules/services/search/elasticsearch.nix
+++ b/nixos/modules/services/search/elasticsearch.nix
@ -204,7 +204,7 @@ in
      postStart = ''
        # Make sure elasticsearch is up and running before dependents
        # are started
-        while ! ${pkgs.curl}/bin/curl -sS -f http://localhost:${toString cfg.port} 2>/dev/null; do
+        while ! ${pkgs.curl}/bin/curl -sS -f http://${cfg.listenAddress}:${toString cfg.port} 2>/dev/null; do
          sleep 1
        done
      '';
--- a/nixos/modules/services/system/nscd.nix
+++ b/nixos/modules/services/system/nscd.nix
@ -50,7 +50,9 @@ in
    systemd.services.nscd =
      { description = "Name Service Cache Daemon";

-        wantedBy = [ "nss-lookup.target" "nss-user-lookup.target" ];
+        before = [ "nss-lookup.target" "nss-user-lookup.target" ];
+        wants = [ "nss-lookup.target" "nss-user-lookup.target" ];
+        wantedBy = [ "multi-user.target" ];

        environment = { LD_LIBRARY_PATH = nssModulesPath; };

--- a/nixos/modules/services/web-apps/baget.nix
+++ b/nixos/modules/services/web-apps/baget.nix
@ -0,0 +1,170 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.baget;
+
+  defaultConfig = {
+    "PackageDeletionBehavior" = "Unlist";
+    "AllowPackageOverwrites" = false;
+
+    "Database" = {
+      "Type" = "Sqlite";
+      "ConnectionString" = "Data Source=baget.db";
+    };
+
+    "Storage" = {
+      "Type" = "FileSystem";
+      "Path" = "";
+    };
+
+    "Search" = {
+      "Type" = "Database";
+    };
+
+    "Mirror" = {
+      "Enabled" = false;
+      "PackageSource" = "https://api.nuget.org/v3/index.json";
+    };
+
+    "Logging" = {
+      "IncludeScopes" = false;
+      "Debug" = {
+        "LogLevel" = {
+          "Default" = "Warning";
+        };
+      };
+      "Console" = {
+        "LogLevel" = {
+          "Microsoft.Hosting.Lifetime" = "Information";
+          "Default" = "Warning";
+        };
+      };
+    };
+  };
+
+  configAttrs = recursiveUpdate defaultConfig cfg.extraConfig;
+
+  configFormat = pkgs.formats.json {};
+  configFile = configFormat.generate "appsettings.json" configAttrs;
+
+in
+{
+  options.services.baget = {
+    enable = mkEnableOption "BaGet NuGet-compatible server";
+
+    apiKeyFile = mkOption {
+      type = types.path;
+      example = "/root/baget.key";
+      description = ''
+        Private API key for BaGet.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = configFormat.type;
+      default = {};
+      example = {
+        "Database" = {
+          "Type" = "PostgreSql";
+          "ConnectionString" = "Server=/run/postgresql;Port=5432;";
+        };
+      };
+      defaultText = literalExpression ''
+        {
+          "PackageDeletionBehavior" = "Unlist";
+          "AllowPackageOverwrites" = false;
+
+          "Database" = {
+            "Type" = "Sqlite";
+            "ConnectionString" = "Data Source=baget.db";
+          };
+
+          "Storage" = {
+            "Type" = "FileSystem";
+            "Path" = "";
+          };
+
+          "Search" = {
+            "Type" = "Database";
+          };
+
+          "Mirror" = {
+            "Enabled" = false;
+            "PackageSource" = "https://api.nuget.org/v3/index.json";
+          };
+
+          "Logging" = {
+            "IncludeScopes" = false;
+            "Debug" = {
+              "LogLevel" = {
+                "Default" = "Warning";
+              };
+            };
+            "Console" = {
+              "LogLevel" = {
+                "Microsoft.Hosting.Lifetime" = "Information";
+                "Default" = "Warning";
+              };
+            };
+          };
+        }
+      '';
+      description = ''
+        Extra configuration options for BaGet. Refer to <link xlink:href="https://loic-sharma.github.io/BaGet/configuration/"/> for details.
+        Default value is merged with values from here.
+      '';
+    };
+  };
+
+  # implementation
+
+  config = mkIf cfg.enable {
+
+    systemd.services.baget = {
+      description = "BaGet server";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network.target" "network-online.target" ];
+      path = [ pkgs.jq ];
+      serviceConfig = {
+        WorkingDirectory = "/var/lib/baget";
+        DynamicUser = true;
+        StateDirectory = "baget";
+        StateDirectoryMode = "0700";
+        LoadCredential = "api_key:${cfg.apiKeyFile}";
+
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        PrivateMounts = true;
+        ProtectHome = true;
+        ProtectClock = true;
+        ProtectProc = "noaccess";
+        ProcSubset = "pid";
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        RestrictSUIDSGID = true;
+        RestrictRealtime = true;
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
+      };
+      script = ''
+        jq --slurpfile apiKeys <(jq -R . "$CREDENTIALS_DIRECTORY/api_key") '.ApiKey = $apiKeys[0]' ${configFile} > appsettings.json
+        ln -snf ${pkgs.baget}/lib/BaGet/wwwroot wwwroot
+        exec ${pkgs.baget}/bin/BaGet
+      '';
+    };
+
+  };
+}
--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@ -370,6 +370,8 @@ let
      cat ${php.phpIni} > $out
      echo "$options" >> $out
    '';
+
+  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix;
 in


@ -657,7 +659,11 @@ in
          `services.httpd.virtualHosts.<name>.useACMEHost` are mutually exclusive.
        '';
      }
-    ];
+    ] ++ map (name: mkCertOwnershipAssertion {
+      inherit (cfg) group user;
+      cert = config.security.acme.certs.${name};
+      groups = config.users.groups;
+    }) dependentCertNames;

    warnings =
      mapAttrsToList (name: hostOpts: ''
--- a/nixos/modules/services/web-servers/caddy/default.nix
+++ b/nixos/modules/services/web-servers/caddy/default.nix
@ -38,6 +38,10 @@ let
      '';
    in
      if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform then Caddyfile-formatted else Caddyfile;
+
+  acmeHosts = unique (catAttrs "useACMEHost" acmeVHosts);
+
+  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix;
 in
 {
  imports = [
@ -266,7 +270,11 @@ in
      { assertion = cfg.adapter != "caddyfile" -> cfg.configFile != configFile;
        message = "Any value other than 'caddyfile' is only valid when providing your own `services.caddy.configFile`";
      }
-    ];
+    ] ++ map (name: mkCertOwnershipAssertion {
+      inherit (cfg) group user;
+      cert = config.security.acme.certs.${name};
+      groups = config.users.groups;
+    }) acmeHosts;

    services.caddy.extraConfig = concatMapStringsSep "\n" mkVHostConf virtualHosts;
    services.caddy.globalConfig = ''
@ -323,8 +331,7 @@ in

    security.acme.certs =
      let
-        eachACMEHost = unique (catAttrs "useACMEHost" acmeVHosts);
-        reloads = map (useACMEHost: nameValuePair useACMEHost { reloadServices = [ "caddy.service" ]; }) eachACMEHost;
+        reloads = map (useACMEHost: nameValuePair useACMEHost { reloadServices = [ "caddy.service" ]; }) acmeHosts;
      in
        listToAttrs reloads;

--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -374,6 +374,8 @@ let
      ${user}:{PLAIN}${password}
    '') authDef)
  );
+
+  mkCertOwnershipAssertion = import ../../../security/acme/mk-cert-ownership-assertion.nix;
 in

 {
@ -842,7 +844,11 @@ in
          services.nginx.virtualHosts.<name>.useACMEHost are mutually exclusive.
        '';
      }
-    ];
+    ] ++ map (name: mkCertOwnershipAssertion {
+      inherit (cfg) group user;
+      cert = config.security.acme.certs.${name};
+      groups = config.users.groups;
+    }) dependentCertNames;

    systemd.services.nginx = {
      description = "Nginx Web Server";
--- a/nixos/modules/virtualisation/vmware-guest.nix
+++ b/nixos/modules/virtualisation/vmware-guest.nix
@ -27,6 +27,7 @@ in
      message = "VMWare guest is not currently supported on ${pkgs.stdenv.hostPlatform.system}";
    } ];

+    boot.initrd.availableKernelModules = [ "mptspi" ];
    boot.initrd.kernelModules = [ "vmw_pvscsi" ];

    environment.systemPackages = [ open-vm-tools ];
--- a/nixos/tests/acme.nix
+++ b/nixos/tests/acme.nix
@ -54,15 +54,15 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: let
    baseConfig = { nodes, config, specialConfig ? {} }: lib.mkMerge [
      {
        security.acme = {
-          defaults = (dnsConfig nodes) // {
-            inherit group;
-          };
+          defaults = (dnsConfig nodes);
          # One manual wildcard cert
          certs."example.test" = {
            domain = "*.example.test";
          };
        };

+        users.users."${config.services."${server}".user}".extraGroups = ["acme"];
+
        services."${server}" = {
          enable = true;
          virtualHosts = {
@ -252,15 +252,15 @@ in {
      } // (let
        baseCaddyConfig = { nodes, config, ... }: {
          security.acme = {
-            defaults = (dnsConfig nodes) // {
-              group = config.services.caddy.group;
-            };
+            defaults = (dnsConfig nodes);
            # One manual wildcard cert
            certs."example.test" = {
              domain = "*.example.test";
            };
          };

+          users.users."${config.services.caddy.user}".extraGroups = ["acme"];
+
          services.caddy = {
            enable = true;
            virtualHosts."a.exmaple.test" = {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -471,6 +471,7 @@ in
  systemd-unit-path = handleTest ./systemd-unit-path.nix {};
  taskserver = handleTest ./taskserver.nix {};
  telegraf = handleTest ./telegraf.nix {};
+  teleport = handleTest ./teleport.nix {};
  tiddlywiki = handleTest ./tiddlywiki.nix {};
  tigervnc = handleTest ./tigervnc.nix {};
  timezone = handleTest ./timezone.nix {};
--- a/nixos/tests/teleport.nix
+++ b/nixos/tests/teleport.nix
@ -0,0 +1,99 @@
+{ system ? builtins.currentSystem
+, config ? { }
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+
+let
+  minimal = { config, ... }: {
+    services.teleport.enable = true;
+  };
+
+  client = { config, ... }: {
+    services.teleport = {
+      enable = true;
+      settings = {
+        teleport = {
+          nodename = "client";
+          advertise_ip = "192.168.1.20";
+          auth_token = "8d1957b2-2ded-40e6-8297-d48156a898a9";
+          auth_servers = [ "192.168.1.10:3025" ];
+          log.severity = "DEBUG";
+        };
+        ssh_service = {
+          enabled = true;
+          labels = {
+            role = "client";
+          };
+        };
+        proxy_service.enabled = false;
+        auth_service.enabled = false;
+      };
+    };
+    networking.interfaces.eth1.ipv4.addresses = [{
+      address = "192.168.1.20";
+      prefixLength = 24;
+    }];
+  };
+
+  server = { config, ... }: {
+    services.teleport = {
+      enable = true;
+      settings = {
+        teleport = {
+          nodename = "server";
+          advertise_ip = "192.168.1.10";
+        };
+        ssh_service.enabled = true;
+        proxy_service.enabled = true;
+        auth_service = {
+          enabled = true;
+          tokens = [ "node:8d1957b2-2ded-40e6-8297-d48156a898a9" ];
+        };
+      };
+      diag.enable = true;
+      insecure.enable = true;
+    };
+    networking = {
+      firewall.allowedTCPPorts = [ 3025 ];
+      interfaces.eth1.ipv4.addresses = [{
+        address = "192.168.1.10";
+        prefixLength = 24;
+      }];
+    };
+  };
+in
+{
+  minimal = makeTest {
+    # minimal setup should always work
+    name = "teleport-minimal-setup";
+    meta.maintainers = with pkgs.lib.maintainers; [ ymatsiuk ];
+    nodes = { inherit minimal; };
+
+    testScript = ''
+      minimal.wait_for_open_port("3025")
+      minimal.wait_for_open_port("3080")
+      minimal.wait_for_open_port("3022")
+    '';
+  };
+
+  basic = makeTest {
+    # basic server and client test
+    name = "teleport-server-client";
+    meta.maintainers = with pkgs.lib.maintainers; [ ymatsiuk ];
+    nodes = { inherit server client; };
+
+    testScript = ''
+      with subtest("teleport ready"):
+          server.wait_for_open_port("3025")
+          client.wait_for_open_port("3022")
+
+      with subtest("check applied configuration"):
+          server.wait_until_succeeds("tctl get nodes --format=json | ${pkgs.jq}/bin/jq -e '.[] | select(.spec.hostname==\"client\") | .metadata.labels.role==\"client\"'")
+          server.wait_for_open_port("3000")
+          client.succeed("journalctl -u teleport.service --grep='DEBU'")
+          server.succeed("journalctl -u teleport.service --grep='Starting teleport in insecure mode.'")
+    '';
+  };
+}
--- a/pkgs/applications/accessibility/svkbd/default.nix
+++ b/pkgs/applications/accessibility/svkbd/default.nix
@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "svkbd";
-  version = "0.4";
+  version = "0.4.1";

  src = fetchurl {
    url = "https://dl.suckless.org/tools/svkbd-${version}.tar.gz";
-    sha256 = "sha256-j9RW5/4cb8l3FK9jpFf206l1rQhCR5H/WMiu7I6rzV8=";
+    sha256 = "sha256-+8Jh/D4dgULhRXtC1tZQg6AK4POh9czyRyrMi0auD1o=";
  };

  inherit patches;
--- a/pkgs/applications/blockchains/monero-gui/default.nix
+++ b/pkgs/applications/blockchains/monero-gui/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "monero-gui";
-  version = "0.17.3.0";
+  version = "0.17.3.1";

  src = fetchFromGitHub {
    owner  = "monero-project";
    repo   = "monero-gui";
    rev    = "v${version}";
-    sha256 = "0rc1p0k16icgfhc7yvkvb8p6570zz0cvigs648l05fcm3mf787rp";
+    sha256 = "sha256-RrchaqFmL4W9F8DhZfvxm7mHMkx/OX8K9e8uNFXWubo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/blockchains/parity-ui/default.nix
+++ b/pkgs/applications/blockchains/parity-ui/default.nix
@ -1,48 +0,0 @@
-{ lib, stdenv, pkgs, fetchurl, makeWrapper, nodePackages }:
-
-let
-
-uiEnv = pkgs.callPackage ./env.nix { };
-
-in stdenv.mkDerivation rec {
-  pname = "parity-ui";
-  version = "0.3.4";
-
-  src = fetchurl {
-    url = "https://github.com/parity-js/shell/releases/download/v${version}/parity-ui_${version}_amd64.deb";
-    sha256 = "1xbd00r9ph8w2d6d2c5xg4b5l74ljzs50rpc6kahfznypmh4kr73";
-    name = "${pname}-${version}.deb";
-  };
-
-  nativeBuildInputs = [ makeWrapper nodePackages.asar ];
-
-  buildCommand = ''
-    mkdir -p $out/usr/
-    ar p $src data.tar.xz | tar -C $out -xJ .
-    substituteInPlace $out/usr/share/applications/parity-ui.desktop \
-      --replace "/opt/Parity UI" $out/bin
-    mv $out/usr/* $out/
-    mv "$out/opt/Parity UI" $out/share/parity-ui
-    rm -r $out/usr/
-    rm -r $out/opt/
-
-    fixupPhase
-
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${uiEnv.libPath}:$out/share/parity-ui" \
-      $out/share/parity-ui/parity-ui
-
-    find $out/share/parity-ui -name "*.node" -exec patchelf --set-rpath "${uiEnv.libPath}:$out/share/parity-ui" {} \;
-
-    mkdir -p $out/bin
-    ln -s $out/share/parity-ui/parity-ui $out/bin/parity-ui
-  '';
-
-  meta = with lib; {
-    description = "UI for Parity. Fast, light, robust Ethereum implementation";
-    homepage = "http://parity.io";
-    license = licenses.gpl3;
-    maintainers = [ maintainers.sorpaas ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/blockchains/parity-ui/env.nix
+++ b/pkgs/applications/blockchains/parity-ui/env.nix
@ -1,19 +0,0 @@
-{ stdenv, lib, zlib, glib, alsa-lib, dbus, gtk2, atk, pango, freetype, fontconfig
-, libgnome-keyring3, gdk-pixbuf, cairo, cups, expat, libgpg-error, nspr
-, nss, xorg, libcap, systemd, libnotify, libsecret, gnome2 }:
-
-let
-  packages = [
-    stdenv.cc.cc zlib glib dbus gtk2 atk pango freetype libgnome-keyring3
-    fontconfig gdk-pixbuf cairo cups expat libgpg-error alsa-lib nspr nss
-    xorg.libXrender xorg.libX11 xorg.libXext xorg.libXdamage xorg.libXtst
-    xorg.libXcomposite xorg.libXi xorg.libXfixes xorg.libXrandr
-    xorg.libXcursor xorg.libxkbfile xorg.libXScrnSaver libcap systemd libnotify
-    xorg.libxcb libsecret gnome2.GConf
-  ];
-
-  libPathNative = lib.makeLibraryPath packages;
-  libPath64 = lib.makeSearchPathOutput "lib" "lib64" packages;
-  libPath = "${libPathNative}:${libPath64}";
-
-in { inherit packages libPath; }
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@ -371,7 +371,8 @@ let
              --replace 'defcustom telega-server-command "telega-server"' \
                        "defcustom telega-server-command \"$out/bin/telega-server\""

-            substituteInPlace telega-sticker.el --replace '"dwebp"' '"${pkgs.libwebp}/bin/dwebp"'
+            substituteInPlace telega-sticker.el --replace '"dwebp' '"${pkgs.libwebp}/bin/dwebp'
+            substituteInPlace telega-sticker.el --replace '"ffmpeg' '"${pkgs.ffmpeg}/bin/ffmpeg'

            substituteInPlace telega-vvnote.el --replace '"ffmpeg' '"${pkgs.ffmpeg}/bin/ffmpeg'
          '';
--- a/pkgs/applications/graphics/imgbrd-grabber/default.nix
+++ b/pkgs/applications/graphics/imgbrd-grabber/default.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "imgbrd-grabber";
-  version = "7.5.1";
+  version = "7.7.0";

  src = fetchFromGitHub {
    owner = "Bionus";
    repo = "imgbrd-grabber";
    rev = "v${version}";
-    sha256 = "sha256-40JCdtRhAQpz2lBGmYh2MgA9rRzHmOZx7lWW0IbfjP4=";
+    sha256 = "sha256-Mym/fuV9YVyj5w8U9KlZ/wuwnnC3K5TGNo9RrAFHI5g=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@ -9,7 +9,6 @@
 , gettext
 , ghostscript
 , glib
-, glib-networking
 , glibmm
 , gsl
 , gspell
@ -118,7 +117,6 @@ stdenv.mkDerivation rec {
    boost
    gettext
    glib
-    glib-networking
    glibmm
    gsl
    gtkmm3
--- a/pkgs/applications/graphics/k3d/default.nix
+++ b/pkgs/applications/graphics/k3d/default.nix
@ -1,51 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, ftgl, glew, asciidoc
-, cmake, ninja, libGLU, libGL, zlib, python2, expat, libxml2, libsigcxx, libuuid, freetype
-, libpng, boost, doxygen, cairomm, pkg-config, libjpeg, libtiff
-, gettext, intltool, perl, gtkmm2, glibmm, gtkglext, libXmu }:
-
-stdenv.mkDerivation rec {
-  version = "0.8.0.6";
-  pname = "k3d";
-  src = fetchFromGitHub {
-    owner = "K-3D";
-    repo = "k3d";
-    rev = "${pname}-${version}";
-    sha256 = "0vdjjg6h8mxm2n8mvkkg2mvd27jn2xx90hnmx23cbd35mpz9p4aa";
-  };
-
-  patches = [
-    (fetchpatch { /* glibmm 2.50 fix */
-      url = "https://github.com/K-3D/k3d/commit/c65889d0652490d88a573e47de7a9324bf27bff2.patch";
-      sha256 = "162icv1hicr2dirkb9ijacvg9bhz5j30yfwg7b45ijavk8rns62j";
-    })
-  ];
-
-  cmakeFlags = [
-    "-DK3D_BUILD_DOCS=false"
-    "-DK3D_BUILD_GUIDE=false"
-  ];
-
-  preConfigure = ''
-    export LD_LIBRARY_PATH="$LD_LIBRARY_PATH''${LD_LIBRARY_PATH:+:}$PWD/build/lib"
-  '';
-
-  nativeBuildInputs = [ cmake ninja gettext intltool doxygen pkg-config perl asciidoc ];
-
-  buildInputs = [
-     libGLU libGL zlib python2 expat libxml2 libsigcxx libuuid freetype libpng
-     boost cairomm libjpeg libtiff
-     ftgl glew gtkmm2 glibmm gtkglext libXmu
-    ];
-
-  #doCheck = false;
-
-  NIX_CFLAGS_COMPILE = "-Wno-deprecated-declarations";
-
-  meta = with lib; {
-    description = "A 3D editor with support for procedural editing";
-    homepage = "http://www.k-3d.org/";
-    platforms = platforms.linux;
-    maintainers = [ maintainers.raskin ];
-    license = licenses.gpl2;
-  };
-}
--- a/pkgs/applications/misc/inherd-quake/default.nix
+++ b/pkgs/applications/misc/inherd-quake/default.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "inherd-quake";
-  version = "0.3.0";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "phodal";
    repo = "quake";
    rev = "v${version}";
-    sha256 = "1f7k68g18g3dpnrsmhgmz753bly1i3f4lmsljiyp9ap0c6w8ahgg";
+    sha256 = "UujcsvjbXda1DdV4hevUP4PbdbOKHQ3O/FBDlhAjfq0=";
  };

-  cargoSha256 = "17q9sjypa331gdfvmx1kbcbvnj34rnsf37b9rnji4jrqfysgrs5w";
+  cargoSha256 = "HkdF7hLgThOWExociNgxvTxF4qL3F5CPK/j/ZKLg/m4=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/misc/kondo/default.nix
+++ b/pkgs/applications/misc/kondo/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "kondo";
-  version = "0.4";
+  version = "0.5";

  src = fetchFromGitHub {
    owner = "tbillington";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0kl2zn6ir3w75ny25ksgxl93vlyb13gzx2795zyimqqnsrdpbbrf";
+    sha256 = "sha256-TTgsfoJ3TEK7wyRJfBIxvPA53wZbq7KJ4LxjUbrHE4Y=";
  };

-  cargoSha256 = "0sddsm0jys1bsj2bsr39lcyx8k2hzw17nlsv6aql0v82x8qbsiv4";
+  cargoSha256 = "sha256-s5e997I7YiDKF6rOB0XwcxbnHR8AifYPX9ctvdz8VTw=";

  meta = with lib; {
    description = "Save disk space by cleaning unneeded files from software projects";
--- a/pkgs/applications/misc/mob/default.nix
+++ b/pkgs/applications/misc/mob/default.nix
@ -9,13 +9,13 @@

 buildGoPackage rec {
  pname = "mob";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "remotemobprogramming";
    repo = pname;
-    sha256 = "sha256-K8ID8cetzCaMc/PVRNMyIhrshtEUiD6U/jI4e0TcOO4=";
+    sha256 = "sha256-nf0FSaUi8qX1f4Luo0cP4ZLoOKbyvgmpilMOWXbzzIM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/moolticute/default.nix
+++ b/pkgs/applications/misc/moolticute/default.nix
@ -9,13 +9,13 @@

 mkDerivation rec {
  pname = "moolticute";
-  version = "0.53.2";
+  version = "0.53.7";

  src = fetchFromGitHub {
    owner = "mooltipass";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-CJVOmFX2wqftQt8j9Tlw93YBiTWE8l1RLprG0cmHeUE=";
+    sha256 = "sha256-1hVvpfrfL/+DIeiPW5iVBEnoc8dy8vVWim4JjhsBlzM=";
  };

  outputs = [ "out" "udev" ];
--- a/pkgs/applications/misc/moonlight-embedded/default.nix
+++ b/pkgs/applications/misc/moonlight-embedded/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "moonlight-embedded";
-  version = "2.5.1";
+  version = "2.5.2";

  src = fetchFromGitHub {
    owner = "moonlight-stream";
    repo = "moonlight-embedded";
    rev = "v${version}";
-    sha256 = "0wn6yjpqyjv52278xsx1ivnqrwca4fnk09a01fwzk4adpry1q9ck";
+    sha256 = "sha256-YZEPm+k0YzJB8OQAiFUOPc0QR2C0AkSgpNYdoh8jX8E=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/octoprint/plugins.nix
+++ b/pkgs/applications/misc/octoprint/plugins.nix
@ -75,13 +75,13 @@ in

  costestimation = buildPlugin rec {
    pname = "CostEstimation";
-    version = "3.3.0";
+    version = "3.4.0";

    src = fetchFromGitHub {
      owner = "OllisGit";
      repo = "OctoPrint-${pname}";
      rev = version;
-      sha256 = "sha256-d7miGMCNJD0siaZb6EnoMZCkKot7vnZjxNZX2TunJcs=";
+      sha256 = "sha256-04OPa/RpM8WehUmOp195ocsAjAvKdVY7iD5ybzQO7Dg=";
    };

    meta = with lib; {
--- a/pkgs/applications/misc/ratt/default.nix
+++ b/pkgs/applications/misc/ratt/default.nix
@ -0,0 +1,26 @@
+{ buildGoModule, fetchFromSourcehut, lib }:
+buildGoModule rec {
+  pname = "ratt";
+  version = "unstable-2022-01-11";
+
+  src = fetchFromSourcehut {
+    owner = "~ghost08";
+    repo = "ratt";
+    rev = "eac7e14b15ad4e916e7d072780397c414c740630";
+    hash = "sha256-/WzPF98MovNg4t5NJhL2Z1bAFDG/3I56M9YgRJF7Wjk=";
+  };
+
+  proxyVendor = true;
+  vendorSha256 = "sha256-NW5B9oO/LJqPigvOcMeL4hQLKmAL01I2Ff41y169BTQ=";
+
+  # tests try to access the internet to scrape websites
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A tool for converting websites to rss/atom feeds";
+    homepage = "https://git.sr.ht/~ghost08/ratt";
+    license = licenses.mit;
+    maintainers = with maintainers; [ kmein ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.8.3";
+  version = "2.8.4";

  src = fetchFromGitHub {
    owner = "khanhas";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Ht+EDCoPn1dA8VHTEiq5xPm34lcsiug8jQHvQdCG2yg=";
+    sha256 = "sha256-WsNiMlqr9ya06Urvw/m3yPsGLCTOvYFaO0oNHuVKNTs=";
  };

  vendorSha256 = "sha256-g0RYIVIq4oMXdRZDBDnVYg7ombN5WEo/6O9hChQvOYs=";
--- a/pkgs/applications/misc/xchm/default.nix
+++ b/pkgs/applications/misc/xchm/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "xchm";
-  version = "1.32";
+  version = "1.33";

  src = fetchFromGitHub {
    owner = "rzvncj";
    repo = "xCHM";
    rev = version;
-    sha256 = "sha256-Ss8kdfUAMC8v05rdt2SoO6vPyssG5v8gOzdf/v18cdg=";
+    sha256 = "sha256-8HQaXxZQwfBaWc22GivKri1vZEnZ23anSfriCvmLHHw=";
  };

  nativeBuildInputs = [ autoreconfHook ];
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -9,7 +9,7 @@
 , yasm, libGLU, libGL, sqlite, unzip, makeWrapper
 , hunspell, libevent, libstartup_notification
 , libvpx
-, icu69, libpng, glib, pciutils
+, icu70, libpng, glib, pciutils
 , autoconf213, which, gnused, rustPackages
 , rust-cbindgen, nodejs, nasm, fetchpatch
 , gnum4
@ -129,12 +129,14 @@ buildStdenv.mkDerivation ({
  inherit src unpackPhase meta;

  patches = [
-    # Upstream bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1745560:
-    ./fix-build-with-wayland-1.20.patch
  ] ++
  lib.optional (lib.versionAtLeast version "86") ./env_var_for_system_dir-ff86.patch ++
  lib.optional (lib.versionAtLeast version "90" && lib.versionOlder version "95") ./no-buildconfig-ffx90.patch ++
-  lib.optional (lib.versionAtLeast version "95") ./no-buildconfig-ffx95.patch ++
+  lib.optional (lib.versionAtLeast version "96") ./no-buildconfig-ffx96.patch ++
+
+  # Fix wayland 1.20 compatibility (https://bugzilla.mozilla.org/show_bug.cgi?id=1745560:)
+  lib.optional (lib.versionOlder version "96") ./fix-build-with-wayland-1.20.patch ++
+
  patches;

  # Ignore trivial whitespace changes in patches, this fixes compatibility of
@ -150,9 +152,10 @@ buildStdenv.mkDerivation ({
    xorg.xorgproto
    xorg.libXdamage
    xorg.libXext
+    xorg.libXtst
    libevent libstartup_notification /* cairo */
    libpng glib
-    nasm icu69 libvpx
+    nasm icu70 libvpx
    # >= 66 requires nasm for the AV1 lib dav1d
    # yasm can potentially be removed in future versions
    # https://bugzilla.mozilla.org/show_bug.cgi?id=1501796
--- a/pkgs/applications/networking/browsers/firefox/no-buildconfig-ffx96.patch
+++ b/pkgs/applications/networking/browsers/firefox/no-buildconfig-ffx96.patch
@ -1,5 +1,5 @@
 diff --git a/docshell/base/nsAboutRedirector.cpp b/docshell/base/nsAboutRedirector.cpp
-index 038136a..1709f1f 100644
+index e7be91a248..5eb98534ee 100644
 --- a/docshell/base/nsAboutRedirector.cpp
 +++ b/docshell/base/nsAboutRedirector.cpp
@@ -66,9 +66,6 @@ static const RedirEntry kRedirMap[] = {
@ -13,13 +13,13 @@ index 038136a..1709f1f 100644
      nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
          nsIAboutModule::ALLOW_SCRIPT},
 diff --git a/toolkit/content/jar.mn b/toolkit/content/jar.mn
-index 9ac4305..916b4ad 100644
+index 74c0ae8f34..a5d9645a96 100644
 --- a/toolkit/content/jar.mn
 +++ b/toolkit/content/jar.mn
-@@ -39,8 +39,6 @@ toolkit.jar:
-    content/global/plugins.html
+@@ -41,8 +41,6 @@ toolkit.jar:
    content/global/plugins.css
    content/global/plugins.js
+ #endif
 -*   content/global/buildconfig.html
 -   content/global/buildconfig.css
    content/global/contentAreaUtils.js
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -7,10 +7,10 @@ in
 rec {
  firefox = common rec {
    pname = "firefox";
-    version = "95.0.2";
+    version = "96.0";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "1b9eb91d72a6975b4d2558a7c5de0e008095398b9862498623656ab6d8056e3cffc12263f58aa07feeddc91ccfb512aa4b582dfeadb142d548d96c3d50204196";
+      sha512 = "39f553474537eb4e521f4182e38f0ddff039fa6b40b939d461937d2cef27f7182097b478f08f90d64fdcbe9c063e78f14f6863a8a82a16207ec7a1d3fdfda4ff";
    };

    meta = {
@ -32,10 +32,10 @@ rec {

  firefox-esr-91 = common rec {
    pname = "firefox-esr";
-    version = "91.4.1esr";
+    version = "91.5.0esr";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "1b9f17c4e58e3753f8507754bba93e3b7f76df5b6845d6173719fbdd98b70af2a90242df42fe274217f56d0280e5dbae17962f5b6bf111421260790f770f5337";
+      sha512 = "1712415b6b73c6a21edfefc39eaba5fcbbca54032f78627c0005d291501d16ef4daffb8b9a160d1d5361113ceba04eb5ddb21d903e3dd8d58838aa9596f2d781";
    };

    meta = {
--- a/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix
@ -1,21 +1,18 @@
-{ lib, stdenv, fetchurl
-, dpkg
-}:
+{ dpkg, fetchurl, lib, stdenv }:

 stdenv.mkDerivation rec {
  pname = "chromium-codecs-ffmpeg-extra";
-  version = "94.0.4606.50";
+  version = "97.0.4692.56";

  src = fetchurl {
-    url = "https://launchpadlibrarian.net/558847674/${pname}_${version}-0ubuntu0.18.04.1_amd64.deb";
-    sha256 = "sha256-H7Tzd8tkaoLClXtNiwEO5nD4+PPt7Jgs+gtLiag/KN4=";
+    url = "https://launchpadlibrarian.net/574348729/${pname}_${version}-0ubuntu0.18.04.1_amd64.deb";
+    sha256 = "sha256-v5DHJxQjHjBeIS/psaM+LyUaHKlwzrKncLarErbUGVU=";
  };

  buildInputs = [ dpkg ];

  unpackPhase = ''
    dpkg-deb -x $src .
-    find .
  '';

  installPhase = ''
@ -26,7 +23,7 @@ stdenv.mkDerivation rec {
    description = "Additional support for proprietary codecs for Vivaldi";
    homepage    = "https://ffmpeg.org/";
    license     = licenses.lgpl21;
-    maintainers = with maintainers; [ betaboon lluchs ];
+    maintainers = with maintainers; [ betaboon cawilliamson lluchs ];
    platforms   = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/networking/cluster/driftctl/default.nix
+++ b/pkgs/applications/networking/cluster/driftctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "driftctl";
-  version = "0.17";
+  version = "0.18.3";

  src = fetchFromGitHub {
    owner = "cloudskiff";
    repo = "driftctl";
    rev = "v${version}";
-    sha256 = "sha256-JloeRoW+1tepSJzhcOQu38TDQfY10NtG2EyeVhP26BQ=";
+    sha256 = "sha256-JD3T0dCRg0UQlG0pWnI8RJZuRrIFfSMVHMoaEIymdWE=";
  };

-  vendorSha256 = "sha256-aaJ5fpS+BiVq1K8OxN+/CBD96wy3flGDhch8O2ACIh8=";
+  vendorSha256 = "sha256-g3+g+mPXEO2ZcVraKuVYZCMBD5zEr1l8ogcYt3r4UjU=";

  postUnpack = ''
    # Without this, tests fail to locate aws/3.19.0.json
--- a/pkgs/applications/networking/feedreaders/photon/default.nix
+++ b/pkgs/applications/networking/feedreaders/photon/default.nix
@ -0,0 +1,27 @@
+{ buildGoModule, fetchFromSourcehut, lib, xorg }:
+
+buildGoModule rec {
+  pname = "photon";
+  version = "unstable-2022-01-11";
+
+  src = fetchFromSourcehut {
+    owner = "~ghost08";
+    repo = "photon";
+    rev = "5d1f7dd8d0d526096886b03c7bc0ef56cbdd6d79";
+    sha256 = "sha256-2RSGLWfthcChd5YhDSBfLSch6wuTUv1Sh1f7flgzQwc=";
+  };
+
+  buildInputs = [ xorg.libX11 ];
+
+  proxyVendor = true;
+
+  vendorSha256 = "sha256-MLNgaxxvPGRzBEWRuKTDskl0J2IVushW11E5prpYsE4=";
+
+  meta = with lib; {
+    description = "RSS/Atom reader with the focus on speed, usability and a bit of unix philosophy";
+    homepage = "https://sr.ht/~ghost08/photon";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ kmein ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/networking/irc/senpai/default.nix
+++ b/pkgs/applications/networking/irc/senpai/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "senpai";
-  version = "unstable-2021-11-29";
+  version = "unstable-2021-12-14";

  src = fetchFromSourcehut {
    owner = "~taiite";
    repo = "senpai";
-    rev = "3904c9190d94f273c0ae9937d3161b9fe4adf856";
-    sha256 = "sha256-4ZhJuAxcoGjRO5xVqzlmaUvipnyiFMuJ1A3n8vlhYxU=";
+    rev = "8091752a67781273944e7a79a803b7a671378313";
+    sha256 = "sha256-tZp0ra/Sq/5MAFlAFHPJ94jYxtHbDiG1wSD4NOH1x7I=";
  };

  vendorSha256 = "sha256-xkJh7k8GZmoZqE0HgbFp2xMJQOVDkPEXOZEl6bJZz1A=";
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@ -18,6 +18,11 @@ stdenv.mkDerivation rec {
    sha256 = "wfLO7kf2iXESItcgWvKj/npKnYwy5OCyStZviN9qR9M=";
  };

+  patches = [
+    # https://nmbug.notmuchmail.org/nmweb/show/87o84iza9r.fsf%40starbuck.i-did-not-set--mail-host-address--so-tickle-me
+    ./test-fix-support-for-gpgsm-in-gnupg-2.3.patch
+  ];
+
  nativeBuildInputs = [
    pkg-config
    doxygen                   # (optional) api docs
--- a/pkgs/applications/networking/mailreaders/notmuch/test-fix-support-for-gpgsm-in-gnupg-2.3.patch
+++ b/pkgs/applications/networking/mailreaders/notmuch/test-fix-support-for-gpgsm-in-gnupg-2.3.patch
@ -0,0 +1,28 @@
+From a642ad542e3d3f34e949c5c66923ca8a6e6cbbd8 Mon Sep 17 00:00:00 2001
+From: Stig Palmquist <stig@stig.io>
+Date: Tue, 11 Jan 2022 13:23:13 +0100
+Subject: [PATCH] test: fix support for gpgsm in gnupg 2.3
+
+gpgsm --list-keys output changed the label for fingerprints from
+"fingerprint: " to "sha[12] fpr: " breaking tests with gnupg 2.3. this
+adds support for both.
+---
+ test/test-lib.sh | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/test/test-lib.sh b/test/test-lib.sh
+index 6bc0b723..3de608f9 100644
+--- a/test/test-lib.sh
+++ b/test/test-lib.sh
+@@ -145,7 +145,7 @@ add_gpgsm_home () {
+     mkdir -p -m 0700 "$GNUPGHOME"
+     gpgsm --batch --no-tty --no-common-certs-import --pinentry-mode=loopback --passphrase-fd 3 \
+ 	  --disable-dirmngr --import  >"$GNUPGHOME"/import.log 2>&1 3<<<'' <$NOTMUCH_SRCDIR/test/smime/0xE0972A47.p12
+-    fpr=$(gpgsm --batch --list-key test_suite@notmuchmail.org | sed -n 's/.*fingerprint: //p')
+    fpr=$(gpgsm --batch --list-key test_suite@notmuchmail.org | sed -n 's/.*\(fingerprint\|sha1 fpr\): //p')
+     echo "$fpr S relax" >> "$GNUPGHOME/trustlist.txt"
+     gpgsm --quiet --batch --no-tty --no-common-certs-import --disable-dirmngr --import < $NOTMUCH_SRCDIR/test/smime/ca.crt
+     echo "4D:E0:FF:63:C0:E9:EC:01:29:11:C8:7A:EE:DA:3A:9A:7F:6E:C1:0D S" >> "$GNUPGHOME/trustlist.txt"
+-- 
+2.34.1
+
--- a/pkgs/applications/office/kalendar/default.nix
+++ b/pkgs/applications/office/kalendar/default.nix
@ -38,14 +38,14 @@

 mkDerivation rec {
  pname = "kalendar";
-  version = "0.3.1";
+  version = "0.4.0";

  src = fetchFromGitLab {
    domain = "invent.kde.org";
    owner = "pim";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-foG8j/MRbDZyzM9KmxEARfWUQXMz8ylQgersE1/gtnQ=";
+    sha256 = "sha256-j383I40lChsI/VOgceaHYGhE61p3SpvInUrkUV5HnHY=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@ -24,13 +24,13 @@ assert !(pulseaudioSupport && portaudioSupport);

 gnuradio3_8Minimal.pkgs.mkDerivation rec {
  pname = "gqrx";
-  version = "2.15.1";
+  version = "2.15.2";

  src = fetchFromGitHub {
    owner = "gqrx-sdr";
    repo = "gqrx";
    rev = "v${version}";
-    sha256 = "sha256-OL83l3A27rggfGbfLT1CUaPAQHEKXgoGS1jYJZ9eHPQ=";
+    sha256 = "sha256-LWuSJbzQKHoCbkyRQ7KqUxFXzA99kuafPibH8Xx7mXs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/logic/isabelle/default.nix
+++ b/pkgs/applications/science/logic/isabelle/default.nix
@ -7,18 +7,22 @@ stdenv.mkDerivation rec {

  dirname = "Isabelle${version}";

-  src = if stdenv.isDarwin
-    then fetchurl {
-      url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_macos.tar.gz";
-      sha256 = "0n1ls9vwf0ps1x8zpb7c1xz1wkasgvc34h5bz280hy2z6iqwmwbc";
-    }
-    else fetchurl {
-      url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_linux.tar.gz";
-      sha256 = "0jfaqckhg388jh9b4msrpkv6wrd6xzlw18m0bngbby8k8ywalp9i";
-    };
+  src =
+    if stdenv.isDarwin
+    then
+      fetchurl
+        {
+          url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_macos.tar.gz";
+          sha256 = "0n1ls9vwf0ps1x8zpb7c1xz1wkasgvc34h5bz280hy2z6iqwmwbc";
+        }
+    else
+      fetchurl {
+        url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_linux.tar.gz";
+        sha256 = "0jfaqckhg388jh9b4msrpkv6wrd6xzlw18m0bngbby8k8ywalp9i";
+      };

  buildInputs = [ polyml z3 veriT vampire eprover-ho ]
-             ++ lib.optionals (!stdenv.isDarwin) [ nettools java ];
+    ++ lib.optionals (!stdenv.isDarwin) [ nettools java ];

  sourceRoot = dirname;

@ -69,12 +73,15 @@ stdenv.mkDerivation rec {
    for comp in contrib/jdk* contrib/polyml-* contrib/z3-* contrib/verit-* contrib/vampire-* contrib/e-*; do
      rm -rf $comp/x86*
    done
-    '' + (if ! stdenv.isLinux then "" else ''
+  '' + (if ! stdenv.isLinux then "" else ''
    arch=${if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux" else "x86-linux"}
-    for f in contrib/*/$arch/{bash_process,epclextract,nunchaku,SPASS}; do
+    for f in contrib/*/$arch/{bash_process,epclextract,nunchaku,SPASS,zipperposition}; do
      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f"
    done
-    '');
+    for d in contrib/kodkodi-*/jni/$arch; do
+      patchelf --set-rpath "${lib.concatStringsSep ":" [ "${java}/lib/openjdk/lib/server" "${stdenv.cc.cc.lib}/lib" ]}" $d/*.so
+    done
+  '');

  installPhase = ''
    mkdir -p $out/bin
--- a/pkgs/applications/version-management/git-and-tools/glab/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/glab/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "glab";
-  version = "1.21.1";
+  version = "1.22.0";

  src = fetchFromGitHub {
    owner = "profclems";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-naCCJ9s63UPDxRWbVjVikXtGUlM4Lp7vyDHlESEtXeI=";
+    sha256 = "sha256-7w6cbeZYhmV0EXXcWlXFq2pQGGxc5Ok4bba0g3fcgmE=";
  };

-  vendorSha256 = "sha256-rciT4UcsLu/vI0PqdTlMjbYXVumzo3ASsopkgiHGM60=";
+  vendorSha256 = "sha256-P7gHCyFafjWOYLEtK9Eh2S2KA0e2hzc1G/ZqVaEWWB0=";

  ldflags = [
    "-X main.version=${version}"
--- a/pkgs/applications/video/go-chromecast/default.nix
+++ b/pkgs/applications/video/go-chromecast/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "go-chromecast";
-  version = "0.2.10";
+  version = "0.2.11";

  src = fetchFromGitHub {
    owner = "vishen";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-8216YaDgjy9Fp94Y5SQwEQpAP4NwvEhsJHe6xpQLAk8=";
+    sha256 = "sha256-BCOyeXo3uoR4ry/nFbF+//U62/hHnPK+tbG+8Rv6Rv0=";
  };

  vendorSha256 = "sha256-idxElk4Sy7SE9G1OMRw8YH4o8orBa80qhBXPA+ar620=";
--- a/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@ -2,19 +2,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "cloud-hypervisor";
-  version = "20.1";
+  version = "20.2";

  src = fetchFromGitHub {
    owner = "cloud-hypervisor";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1r55ykxwa0xr1f9sp7mnv8nqf0dr7vw62b1w8r7mmyrndwnq6z5b";
+    sha256 = "sha256-yIp1p8GyBojWKmvFRZ/OeyF2bjlqYsuXUrYTVunYV8Y=";
  };

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ] ++ lib.optional stdenv.isAarch64 dtc;

-  cargoSha256 = "07wpfhlp82hp3hr8vc52vhkrxd8xpyvdvfqh1dn1fnhxk3b1z7lz";
+  cargoSha256 = "sha256-s2u6e2JbukPo3pXYzQJXP5d2G213u1+1ke9gZFnB+5g=";

  meta = with lib; {
    homepage = "https://github.com/cloud-hypervisor/cloud-hypervisor";
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "v2ray-geoip";
-  version = "202112300030";
+  version = "202201060033";

  src = fetchFromGitHub {
    owner = "v2fly";
    repo = "geoip";
-    rev = "570a09062b1b6dbd3b8cb1785c0ce4a0ed3c50f4";
-    sha256 = "sha256-YGKHruyVShFrMbE0eXzb2Qp3BMfM+4SLaK8pqR2sloM=";
+    rev = "57f0e64ece0582314958c027198b8e50daa353d2";
+    sha256 = "sha256-RG7sLp9u8k1U5XVFcwAF57UcvwhF3pFKCFLLJ2x7q00=";
  };

  installPhase = ''
--- a/pkgs/desktops/gnome/core/gnome-software/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-software/default.nix
@ -42,11 +42,11 @@ in

 stdenv.mkDerivation rec {
  pname = "gnome-software";
-  version = "41.2";
+  version = "41.3";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-software/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "OErdrMh4QlOoeXGBSweS+9LJQfpEiw+UOLv1dJgszBc=";
+    sha256 = "ZQVjN3q2mxAQXfdxuz8hY3lVO7evQISNjDBljgEAmLw=";
  };

  patches = [
--- a/pkgs/desktops/pantheon/apps/elementary-videos/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-videos/default.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "elementary-videos";
-  version = "2.8.1";
+  version = "2.8.3";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = "videos";
    rev = version;
-    sha256 = "sha256-Ki6i9u+oXOBTH+dVJ9RgBxszD7Wvdrfahd9abyjFYJY=";
+    sha256 = "sha256-3V8iDy68ngdFTJxAGimuGi4vPru32pHYevThA0RwNpE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/flutter/flutter.nix
+++ b/pkgs/development/compilers/flutter/flutter.nix
@ -174,6 +174,9 @@ runCommand drvName
 } ''
  mkdir -p $out/bin

+  mkdir -p $out/bin/cache/
+  ln -sf ${dart} $out/bin/cache/dart-sdk
+
  echo -n "$startScript" > $out/bin/${pname}
  chmod +x $out/bin/${pname}
 ''
--- a/pkgs/development/compilers/idris2/default.nix
+++ b/pkgs/development/compilers/idris2/default.nix
@ -1,18 +1,27 @@
-{ lib
-, stdenv
+# Almost 1:1 copy of idris2's nix/platform.nix. Some work done in their flake.nix
+# we do here instead.
+{ stdenv
+, lib
+, chez
+, chez-racket
+, clang
+, gmp
 , fetchFromGitHub
 , makeWrapper
-, clang
-, chez
-, gmp
+, gambit
+, nodejs
 , zsh
 , callPackage
 }:

 # NOTICE: An `idris2WithPackages` is available at: https://github.com/claymager/idris2-pkgs

+let
+  # Taken from Idris2/idris2/flake.nix. Check if the idris2 project does it this
+  # way, still, every now and then.
+  platformChez = if stdenv.system == "x86_64-linux" then chez else chez-racket;
 # Uses scheme to bootstrap the build of idris2
-stdenv.mkDerivation rec {
+in stdenv.mkDerivation rec {
  pname = "idris2";
  version = "0.5.1";

@ -23,14 +32,10 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-6CTn8o5geWSesXO7vTrrV/2EOQ3f+nPQ2M5cem13ZSY=";
  };

-  # We do not add any propagatedNativeBuildInputs because we do not want the
-  # executables idris2 produces to depend on the nix-store. As such, it is left
-  # to the user to guarantee chez (or any other codgen dependency) is available
-  # in the path during compilation of programs with idris2.
  strictDeps = true;
-  nativeBuildInputs = [ makeWrapper clang chez ]
+  nativeBuildInputs = [ makeWrapper clang platformChez ]
    ++ lib.optional stdenv.isDarwin [ zsh ];
-  buildInputs = [ gmp ];
+  buildInputs = [ platformChez gmp ];

  prePatch = ''
    patchShebangs --build tests
@ -43,44 +48,40 @@ stdenv.mkDerivation rec {
  buildFlags = [ "bootstrap" "SCHEME=scheme" ];

  checkTarget = "test";
+  checkInputs = [ gambit nodejs ]; # racket ];
+  checkFlags = [ "INTERACTIVE=" ];

  # TODO: Move this into its own derivation, such that this can be changed
  #       without having to recompile idris2 every time.
  postInstall = let
-    includedLibs = [ "base" "contrib" "network" "prelude" ];
    name = "${pname}-${version}";
-    packagePaths =
-      builtins.map (l: "$out/${name}/${l}-${version}") includedLibs;
-    additionalIdris2Paths = builtins.concatStringsSep ":" packagePaths;
+    globalLibraries = [
+      "\\$HOME/.nix-profile/lib/${name}"
+      "/run/current-system/sw/lib/${name}"
+      "$out/${name}"
+    ];
+    globalLibrariesPath = builtins.concatStringsSep ":" globalLibraries;
  in ''
    # Remove existing idris2 wrapper that sets incorrect LD_LIBRARY_PATH
    rm $out/bin/idris2
-    # Move actual idris2 binary
+    # The only thing we need from idris2_app is the actual binary
    mv $out/bin/idris2_app/idris2.so $out/bin/idris2
-
-    # After moving the binary, there is nothing left in idris2_app that isn't
-    # either contained in lib/ or is useless to us.
    rm $out/bin/idris2_app/*
    rmdir $out/bin/idris2_app
-
    # idris2 needs to find scheme at runtime to compile
-    # idris2 installs packages with --install into the path given by PREFIX.
-    # Since PREFIX is in nix-store, it is immutable so --install does not work.
-    # If the user redefines PREFIX to be able to install packages, idris2 will
-    # not find the libraries and packages since all paths are relative to
-    # PREFIX by default.
-    # We explicitly make all paths to point to nix-store, such that they are
-    # independent of what IDRIS2_PREFIX is. This allows the user to redefine
-    # IDRIS2_PREFIX and use --install as expected.
+    # idris2 installs packages with --install into the path given by
+    #   IDRIS2_PREFIX. We set that to a default of ~/.idris2, to mirror the
+    #   behaviour of the standard Makefile install.
    # TODO: Make support libraries their own derivation such that
    #       overriding LD_LIBRARY_PATH is unnecessary
-    # TODO: Maybe set IDRIS2_PREFIX to the users home directory
    wrapProgram "$out/bin/idris2" \
-      --set-default CHEZ "${chez}/bin/scheme" \
+      --set-default CHEZ "${platformChez}/bin/scheme" \
+      --run 'export IDRIS2_PREFIX=''${IDRIS2_PREFIX-"$HOME/.idris2"}' \
      --suffix IDRIS2_LIBS ':' "$out/${name}/lib" \
      --suffix IDRIS2_DATA ':' "$out/${name}/support" \
-      --suffix IDRIS2_PATH ':' "${additionalIdris2Paths}" \
-      --suffix ${if stdenv.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH"} ':' "$out/${name}/lib"
+      --suffix IDRIS2_PACKAGE_PATH ':' "${globalLibrariesPath}" \
+      --suffix DYLD_LIBRARY_PATH ':' "$out/${name}/lib" \
+      --suffix LD_LIBRARY_PATH ':' "$out/${name}/lib"
  '';

  # Run package tests
--- a/pkgs/development/compilers/idris2/tests.nix
+++ b/pkgs/development/compilers/idris2/tests.nix
@ -50,6 +50,7 @@ in {
  # Data.Vect.Sort is available via --package contrib
  use-contrib = testCompileAndRun {
    testName = "use-contrib";
+    packages = [ "contrib" ];
    code = ''
      module Main

--- a/pkgs/development/compilers/vyper/default.nix
+++ b/pkgs/development/compilers/vyper/default.nix
@ -14,11 +14,11 @@ in

 buildPythonPackage rec {
  pname = "vyper";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "3e50cd802696ea3f5e6ab1bf4c9a90a39c332591d416c99f3d2fa93d7d7ba394";
+    sha256 = "sha256-fXug5v3zstz19uexMWokHBVsfcl2ZCdIOIXKeLVyh/Q=";
  };

  nativeBuildInputs = [ pytest-runner ];
--- a/pkgs/development/interpreters/cyclone/default.nix
+++ b/pkgs/development/interpreters/cyclone/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, libck, darwin }:

 let
-  version = "0.30.0";
+  version = "0.34.0";
  bootstrap = stdenv.mkDerivation {
    pname = "cyclone-bootstrap";
    inherit version;
@ -10,7 +10,7 @@ let
      owner = "justinethier";
      repo = "cyclone-bootstrap";
      rev = "v${version}";
-      sha256 = "sha256-/zAcCBdJ7YQXsspdjrMca1Oj9SUUFXQKLwZPoZLhHYg=";
+      sha256 = "sha256-kJBPb0Ej32HveY/vdGpH2gyxSwq8Xq7muneFIw3Y7hM=";
    };

    enableParallelBuilding = true;
@ -30,7 +30,7 @@ stdenv.mkDerivation {
    owner = "justinethier";
    repo = "cyclone";
    rev = "v${version}";
-    sha256 = "sha256-a3wiqKlIbnvIhyrI0lyVGciQiM7KSuYH5iUfGFrgOuM=";
+    sha256 = "sha256-4U/uOTbFpPTC9BmO6Wkhy4PY8UCFVt5eHSGqrOlKT/U=";
  };

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/gbenchmark/default.nix
+++ b/pkgs/development/libraries/gbenchmark/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "gbenchmark";
-  version = "1.6.0";
+  version = "1.6.1";

  src = fetchFromGitHub {
    owner = "google";
    repo = "benchmark";
    rev = "v${version}";
-    sha256 = "sha256-EAJk3JhLdkuGKRMtspTLejck8doWPd7Z0Lv/Mvf3KFY=";
+    sha256 = "sha256-yUiFxi80FWBmTZgqmqTMf9oqcBeg3o4I4vKd4djyRWY=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/glew/default.nix
+++ b/pkgs/development/libraries/glew/default.nix
@ -1,9 +1,8 @@
-{ lib, stdenv, fetchurl, libGLU, xlibsWrapper, libXmu, libXi
+{ lib, stdenv, fetchurl, fetchpatch, cmake, libGLU, xlibsWrapper, libXmu, libXi
 , OpenGL
+, enableEGL ? false
 }:

-with lib;
-
 stdenv.mkDerivation rec {
  pname = "glew";
  version = "2.2.0";
@ -13,48 +12,46 @@ stdenv.mkDerivation rec {
    sha256 = "1qak8f7g1iswgswrgkzc7idk7jmqgwrs58fhg2ai007v7j4q5z6l";
  };

-  outputs = [ "bin" "out" "dev" "doc" ];
+  outputs = [ "bin" "out" "dev" ];

-  buildInputs = optionals (!stdenv.isDarwin) [ xlibsWrapper libXmu libXi ];
-  propagatedBuildInputs = if stdenv.isDarwin then [ OpenGL ] else [ libGLU ]; # GL/glew.h includes GL/glu.h
-
-  patchPhase = ''
-    sed -i 's|lib64|lib|' config/Makefile.linux
-    substituteInPlace config/Makefile.darwin --replace /usr/local "$out"
-    ${optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
-      sed -i -e 's/\(INSTALL.*\)-s/\1/' Makefile
-    ''}
-  '';
-
-  buildFlags = [ "all" ];
-  installFlags = [ "install.all" ];
-
-  preInstall = ''
-    makeFlagsArray+=(GLEW_DEST=$out BINDIR=$bin/bin INCDIR=$dev/include/GL)
-  '';
-
-  postInstall = ''
-    mkdir -pv $out/share/doc/glew
-    mkdir -p $out/lib/pkgconfig
-    cp glew*.pc $out/lib/pkgconfig
-    cp -r README.md LICENSE.txt doc $out/share/doc/glew
-    rm $out/lib/*.a
-  '';
-
-  makeFlags = [
-    "SYSTEM=${if stdenv.hostPlatform.isMinGW then "mingw" else stdenv.hostPlatform.parsed.kernel.name}"
-    "CC=${stdenv.cc.targetPrefix}cc"
-    "LD=${stdenv.cc.targetPrefix}cc"
-    "AR=${stdenv.cc.targetPrefix}ar"
+  patches = [
+    # https://github.com/nigels-com/glew/pull/342
+    (fetchpatch {
+      url = "https://github.com/nigels-com/glew/commit/966e53fa153175864e151ec8a8e11f688c3e752d.diff";
+      sha256 = "sha256-xsSwdAbdWZA4KVoQhaLlkYvO711i3QlHGtv6v1Omkhw=";
+    })
  ];

-  enableParallelBuilding = true;
+  nativeBuildInputs = [ cmake ];
+  buildInputs = lib.optionals (!stdenv.isDarwin) [ xlibsWrapper libXmu libXi ];
+  propagatedBuildInputs = if stdenv.isDarwin then [ OpenGL ] else [ libGLU ]; # GL/glew.h includes GL/glu.h
+
+  cmakeDir = "cmake";
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=ON"
+  ] ++ lib.optional enableEGL "-DGLEW_EGL=ON";
+
+  postInstall = ''
+    moveToOutput lib/cmake "''${!outputDev}"
+    moveToOutput lib/pkgconfig "''${!outputDev}"
+
+    cat >> "''${!outputDev}"/lib/cmake/glew/glew-config.cmake <<EOF
+    # nixpkg's workaround for a cmake bug
+    # https://discourse.cmake.org/t/the-findglew-cmake-module-does-not-set-glew-libraries-in-some-cases/989/3
+    set(GLEW_VERSION "$version")
+    set(GLEW_LIBRARIES GLEW::glew\''${_glew_target_postfix})
+    get_target_property(GLEW_INCLUDE_DIRS GLEW::glew\''${_glew_target_postfix} INTERFACE_INCLUDE_DIRECTORIES)
+    EOF
+  '';

  meta = with lib; {
-    description = "An OpenGL extension loading library for C(++)";
+    description = "An OpenGL extension loading library for C/C++";
    homepage = "http://glew.sourceforge.net/";
-    license = licenses.free; # different files under different licenses
-      #["BSD" "GLX" "SGI-B" "GPL2"]
-    platforms = platforms.mesaPlatforms;
+    license = with licenses; [ /* modified bsd */ free mit gpl2Only ]; # For full details, see https://github.com/nigels-com/glew#copyright-and-licensing
+    platforms = with platforms;
+      if enableEGL then
+        subtractLists darwin mesaPlatforms
+      else
+        mesaPlatforms;
  };
 }
--- a/pkgs/development/libraries/liburing/default.nix
+++ b/pkgs/development/libraries/liburing/default.nix
@ -4,7 +4,7 @@

 stdenv.mkDerivation rec {
  pname = "liburing";
-  version = "2.1";
+  version = "2.1"; # remove patch when updating

  src = fetchgit {
    url    = "http://git.kernel.dk/${pname}";
@ -43,6 +43,15 @@ stdenv.mkDerivation rec {
    cp ./examples/ucontext-cp $bin/bin/io_uring-ucontext-cp
  '';

+  # fix for compilation on 32-bit ARM, merged by upstream but not released; remove when
+  # upstream releases an update
+  patches = lib.optional stdenv.isAarch32 [
+    (fetchpatch {
+      url = "https://github.com/axboe/liburing/commit/e75a6cfa085fc9b5dbf5140fc1efb5a07b6b829e.diff";
+      sha256 = "sha256-qQEQXYm5mkws2klLxwuuoPSPRkpP1s6tuylAAEp7+9E=";
+    })
+  ];
+
  meta = with lib; {
    description = "Userspace library for the Linux io_uring API";
    homepage    = "https://git.kernel.dk/cgit/liburing/";
--- a/pkgs/development/libraries/umockdev/default.nix
+++ b/pkgs/development/libraries/umockdev/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "umockdev";
-  version = "0.17.1";
+  version = "0.17.2";

  outputs = [ "bin" "out" "dev" "devdoc" ];

  src = fetchurl {
    url = "https://github.com/martinpitt/umockdev/releases/download/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-lq8lVQlSZpFGDL7nGV8pPe+AClK8PjzWoPmhfWvHpJs=";
+    sha256 = "sha256-D9Kb67HACi8guMoT5n3Yp9INigjuuGAIyKMgcICBJmA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/xgboost/default.nix
+++ b/pkgs/development/libraries/xgboost/default.nix
@ -16,14 +16,14 @@ assert ncclSupport -> cudaSupport;

 stdenv.mkDerivation rec {
  pname = "xgboost";
-  version = "1.5.0";
+  version = "1.5.1";

  src = fetchFromGitHub {
    owner = "dmlc";
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-xrRKpZ6NSBtEL2CBN7KggDwIvQKIPD8EBlA0oCJv8mw=";
+    sha256 = "sha256-WvYMfJYDF4azXkz2tBI9R9EpSOhFxpEja4RLuAfYAtE=";
  };

  nativeBuildInputs = [ cmake ] ++ lib.optional stdenv.isDarwin llvmPackages.openmp;
--- a/pkgs/development/python-modules/GitPython/default.nix
+++ b/pkgs/development/python-modules/GitPython/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "gitpython";
-  version = "3.1.24";
+  version = "3.1.25";
  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "gitpython-developers";
    repo = "GitPython";
    rev = version;
-    sha256 = "sha256-KfR14EqXsDgIZUerk/hHDB0Z7IuqncbTNd/yNwrV9I0=";
+    sha256 = "sha256-ienc7zvLe6t8rkMtC6wVIewUqQBFdFbLc8iPT6aPVrE=";
  };

  patches = [
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@ -6,13 +6,13 @@

 buildPythonPackage rec {
  pname = "adafruit-platformdetect";
-  version = "3.19.1";
+  version = "3.19.2";
  format = "setuptools";

  src = fetchPypi {
    pname = "Adafruit-PlatformDetect";
    inherit version;
-    sha256 = "sha256-mJ121SSoO7v2p+qCF5Va5+ppHQsHcFuyJDpyc6lykRI=";
+    sha256 = "sha256-zsnv3Lw+CWhNQ9ovXAuIujAXfkjiiWm797ncHIN3y/E=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aioconsole/default.nix
+++ b/pkgs/development/python-modules/aioconsole/default.nix
@ -17,7 +17,9 @@
 buildPythonPackage rec {
  pname = "aioconsole";
  version = "0.3.3";
-  disabled = pythonOlder "3.6";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "vxgmichel";
@ -36,7 +38,13 @@ buildPythonPackage rec {
      --replace "--cov aioconsole --count 2" ""
  '';

-  pythonImportsCheck = [ "aioconsole" ];
+  disabledTests = [
+    "test_interact_syntax_error"
+  ];
+
+  pythonImportsCheck = [
+    "aioconsole"
+  ];

  meta = with lib; {
    description = "Asynchronous console and interfaces for asyncio";
--- a/pkgs/development/python-modules/aiocurrencylayer/default.nix
+++ b/pkgs/development/python-modules/aiocurrencylayer/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "aiocurrencylayer";
-  version = "1.0.2";
+  version = "1.0.3";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "home-assistant-ecosystem";
    repo = pname;
    rev = version;
-    sha256 = "EVqnrMatOk2I6hiCkiT5FOWvMY9LEK8LlSHqi0x9kuQ=";
+    sha256 = "sha256-t2Pcoakk25vtUYajIZVITsrEUSdwwiA3fbdswy3n9P8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aioitertools/default.nix
+++ b/pkgs/development/python-modules/aioitertools/default.nix
@ -1,7 +1,9 @@
 { lib

 , buildPythonPackage
+, fetchpatch
 , fetchPypi
+, pythonAtLeast
 , pythonOlder
 , typing-extensions
 , coverage
@ -19,6 +21,15 @@ buildPythonPackage rec {
    sha256 = "8b02facfbc9b0f1867739949a223f3d3267ed8663691cc95abd94e2c1d8c2b46";
  };

+  patches = lib.optionals (pythonAtLeast "3.10") [
+    (fetchpatch {
+      # Fix TypeError: wait() got an unexpected keyword argument 'loop'
+      # See https://github.com/omnilib/aioitertools/issues/84
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-community/packages/python-aioitertools/trunk/python310.patch";
+      sha256 = "sha256-F10sduGaLBcxEoP83N/lGpZIlzkM2JTnQnhHKFwc7P0=";
+    })
+  ];
+
  propagatedBuildInputs = [ typing-extensions ];
  checkInputs = [ coverage toml ];

--- a/pkgs/development/python-modules/aiopvpc/default.nix
+++ b/pkgs/development/python-modules/aiopvpc/default.nix
@ -33,10 +33,11 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    aiohttp
-    backports-zoneinfo
    holidays
    tzdata
    async-timeout
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    backports-zoneinfo
  ];

  checkInputs = [
--- a/pkgs/development/python-modules/aioridwell/default.nix
+++ b/pkgs/development/python-modules/aioridwell/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "aioridwell";
-  version = "2021.10.0";
+  version = "2021.12.2";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "bachya";
    repo = pname;
    rev = version;
-    sha256 = "sha256-h89gfdZvk7H22xAczaPMscTYZu0YeFxvFfL6/Oz2cJw=";
+    sha256 = "sha256-QFUXWleHRMBgaRsMNt2xFb3XcbCNI2kKQHKCBrUuG6Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/amaranth-boards/default.nix
+++ b/pkgs/development/python-modules/amaranth-boards/default.nix
@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, amaranth
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "amaranth-boards";
+  version = "unstable-2021-12-17";
+  # python setup.py --version
+  realVersion = "0.1.dev202+g${lib.substring 0 7 src.rev}";
+
+  src = fetchFromGitHub {
+    owner = "amaranth-lang";
+    repo = "amaranth-boards";
+    rev = "8e2615765e255144403431ca95c5cdf6c78eb638";
+    sha256 = "3EOG8SO5xBNevshXMRrxKWoJUbeaVi8ckbkmqd6Tw70=";
+  };
+
+  nativeBuildInputs = [ setuptools-scm ];
+  propagatedBuildInputs = [ setuptools amaranth ];
+
+  preBuild = ''
+    export SETUPTOOLS_SCM_PRETEND_VERSION="${realVersion}"
+  '';
+
+  # no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Board definitions for Amaranth HDL";
+    homepage = "https://github.com/amaranth-lang/amaranth-boards";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ emily thoughtpolice ];
+  };
+}
--- a/pkgs/development/python-modules/amaranth-soc/default.nix
+++ b/pkgs/development/python-modules/amaranth-soc/default.nix
@ -0,0 +1,35 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, amaranth
+, setuptools
+, setuptools-scm
+}:
+
+buildPythonPackage rec {
+  pname = "amaranth-soc";
+  version = "unstable-2021-12-10";
+  # python setup.py --version
+  realVersion = "0.1.dev49+g${lib.substring 0 7 src.rev}";
+
+  src = fetchFromGitHub {
+    owner = "amaranth-lang";
+    repo = "amaranth-soc";
+    rev = "217d4ea76ad3b3bbf146980d168bc7b3b9d95a18";
+    sha256 = "dMip82L7faUn16RDeG3NgMv0nougpwTwDWLX0doD2YA=";
+  };
+
+  nativeBuildInputs = [ setuptools-scm ];
+  propagatedBuildInputs = [ setuptools amaranth ];
+
+  preBuild = ''
+    export SETUPTOOLS_SCM_PRETEND_VERSION="${realVersion}"
+  '';
+
+  meta = with lib; {
+    description = "System on Chip toolkit for Amaranth HDL";
+    homepage = "https://github.com/amaranth-lang/amaranth-soc";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ emily thoughtpolice ];
+  };
+}
--- a/pkgs/development/python-modules/amaranth/default.nix
+++ b/pkgs/development/python-modules/amaranth/default.nix
@ -18,17 +18,17 @@
 }:

 buildPythonPackage rec {
-  pname = "nmigen";
-  version = "unstable-2021-02-09";
+  pname = "amaranth";
+  version = "0.3";
  # python setup.py --version
-  realVersion = "0.3.dev243+g${lib.substring 0 7 src.rev}";
+  realVersion = "0.3";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
-    owner = "nmigen";
-    repo = "nmigen";
-    rev = "f7c2b9419f9de450be76a0e9cf681931295df65f";
-    sha256 = "0cjs9wgmxa76xqmjhsw4fsb2mhgvd85jgs2mrjxqp6fwp8rlgnl1";
+    owner = "amaranth-lang";
+    repo = "amaranth";
+    rev = "39a83f4d995d16364cc9b99da646ff8db6394166";
+    sha256 = "P9AG3t30eGeeCN5+t7mjhRoOWIGZVzWQji9eYXphjA0=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION="${realVersion}";
@ -59,12 +59,12 @@ buildPythonPackage rec {
      --replace "pyvcd~=0.2.2" "pyvcd"
  '';

-  pythonImportsCheck = [ "nmigen" ];
+  pythonImportsCheck = [ "amaranth" ];

  meta = with lib; {
-    description = "A refreshed Python toolbox for building complex digital hardware";
-    homepage = "https://nmigen.info/nmigen";
+    description = "A modern hardware definition language and toolchain based on Python";
+    homepage = "https://amaranth-lang.org/docs/amaranth";
    license = licenses.bsd2;
-    maintainers = with maintainers; [ emily ];
+    maintainers = with maintainers; [ emily thoughtpolice ];
  };
 }
--- a/pkgs/development/python-modules/annexremote/default.nix
+++ b/pkgs/development/python-modules/annexremote/default.nix
@ -2,33 +2,41 @@
 , isPy3k
 , buildPythonPackage
 , fetchFromGitHub
-, future
-, mock
+, pytestCheckHook
 , nose
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "annexremote";
  version = "1.6.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

-  # use fetchFromGitHub instead of fetchPypi because the test suite of
-  # the package is not included into the PyPI tarball
  src = fetchFromGitHub {
-    rev = "v${version}";
    owner = "Lykos153";
    repo = "AnnexRemote";
+    rev = "v${version}";
    sha256 = "08myswj1vqkl4s1glykq6xn76a070nv5mxj0z8ibl6axz89bvypi";
  };

-  propagatedBuildInputs = [ future ];
+  checkInputs = [
+    nose
+  ];

-  checkInputs = [ nose ] ++ lib.optional (!isPy3k) mock;
-  checkPhase = "nosetests -v";
+  checkPhase = ''
+    nosetests -v -e "^TestExport_MissingName" -e "^TestRemoveexportdirectory"
+  '';
+
+  pythonImportsCheck = [
+    "annexremote"
+  ];

  meta = with lib; {
    description = "Helper module to easily develop git-annex remotes";
    homepage = "https://github.com/Lykos153/AnnexRemote";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
    maintainers = with maintainers; [ montag451 ];
  };
 }
--- a/pkgs/development/python-modules/ansible-lint/default.nix
+++ b/pkgs/development/python-modules/ansible-lint/default.nix
@ -18,13 +18,13 @@

 buildPythonPackage rec {
  pname = "ansible-lint";
-  version = "5.3.1";
+  version = "5.3.2";
  disabled = isPy27;
  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-fXvHS5uQxZgr5cJ0wq/LpbgHPsiMznk/q0Y/5kGKJfY=";
+    sha256 = "sha256-m6iG20xE5ZNgvI1mjwvq5hk8Ch/LuedhJwAMo6ztfCg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/bleak/default.nix
+++ b/pkgs/development/python-modules/bleak/default.nix
@ -4,13 +4,13 @@

 buildPythonPackage rec {
  pname = "bleak";
-  version = "0.13.0";
+  version = "0.14.0";

  disabled = !isPy3k;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1vnwk36qfws9amqrdaynf63dcj2gzxm0ns1l75hrczmd5j2ic1zb";
+    sha256 = "b449cc63f769c2d219c67e23ffb9f3a5b5f23eb2d68d05878743dbed83a14360";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/cherrypy/default.nix
+++ b/pkgs/development/python-modules/cherrypy/default.nix
@ -1,73 +1,99 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi, isPy3k
-, setuptools-scm
-, cheroot, portend, more-itertools, zc_lockfile, routes
+{ lib
+, stdenv
+, buildPythonPackage
+, cheroot
+, fetchPypi
 , jaraco_collections
-, objgraph, pytest, pytest-cov, pathpy, requests-toolbelt, pytest-services
-, fetchpatch
+, more-itertools
+, objgraph
+, pathpy
+, portend
+, pytest-forked
+, pytest-services
+, pytestCheckHook
+, pythonAtLeast
+, pythonOlder
+, requests-toolbelt
+, routes
+, setuptools-scm
+, simplejson
+, zc_lockfile
 }:

 buildPythonPackage rec {
  pname = "cherrypy";
-  version = "18.6.0";
+  version = "18.6.1";
+  format = "setuptools";

-  disabled = !isPy3k;
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    pname = "CherryPy";
    inherit version;
-    sha256 = "16f410izp2c4qhn4n3l5l3qirmkf43h2amjqms8hkl0shgfqwq2n";
+    hash = "sha256-8z6HKG57PjCeBOciXY5JOC2dd3PmCSJB1/YTiTxWNJU=";
  };

-  patches = [
-    # 1/3 Fix compatibility with pytest 6. Will be part of the next release after 18.6
-    (fetchpatch {
-      url = "https://github.com/cherrypy/cherrypy/pull/1897/commits/59c0e19d7df8680e36afc96756dce72435121448.patch";
-      sha256 = "1jachbvp505gndccdhny0c3grzdrmvmbzq4kw55jx93ay94ni6p0";
-    })
-    # 2/3 Fix compatibility with pytest 6. Will be part of the next release after 18.6
-    (fetchpatch {
-      url = "https://github.com/cherrypy/cherrypy/pull/1897/commits/4a6287b73539adcb7b0ae72d69644a1ced1f7eaa.patch";
-      sha256 = "0nz40qmgxknkbjsdzfzcqfxdsmsxx3v104fb0h04yvs76mqvw3i4";
-    })
-    # 3/3 Fix compatibility with pytest 6. Will be part of the next release after 18.6
-    (fetchpatch {
-      url = "https://github.com/cherrypy/cherrypy/commit/3bae7f06868553b006915f05ff14d86163f59a7d.patch";
-      sha256 = "1z0bv23ybyw87rf1i8alsdi3gc2bzmdj9d0kjsghdkvi3zdp4n8q";
-    })
+  nativeBuildInputs = [
+    setuptools-scm
  ];

-  nativeBuildInputs = [ setuptools-scm ];
-
  propagatedBuildInputs = [
    # required
-    cheroot portend more-itertools zc_lockfile
+    cheroot
+    portend
+    more-itertools
+    zc_lockfile
    jaraco_collections
    # optional
    routes
+    simplejson
  ];

  checkInputs = [
-    objgraph pytest pytest-cov pathpy requests-toolbelt pytest-services
+    objgraph
+    pathpy
+    pytest-forked
+    pytest-services
+    pytestCheckHook
+    requests-toolbelt
  ];

-  # Keyboard interrupt ends test suite run
-  # daemonize and autoreload tests have issue with sockets within sandbox
-  # Disable doctest plugin because times out
-  checkPhase = ''
-    substituteInPlace pytest.ini --replace "--doctest-modules" ""
-    pytest \
-      -k 'not KeyboardInterrupt and not daemonize and not Autoreload' \
-      --deselect=cherrypy/test/test_static.py::StaticTest::test_null_bytes \
-      --deselect=cherrypy/test/test_tools.py::ToolTests::testCombinedTools \
-      ${lib.optionalString stdenv.isDarwin
-        "--deselect=cherrypy/test/test_bus.py::BusMethodTests::test_block --deselect=cherrypy/test/test_config_server.py"}
+  preCheck = ''
+    # Disable doctest plugin because times out
+    substituteInPlace pytest.ini \
+      --replace "--doctest-modules" "-vvv"
+    sed -i "/--cov/d" pytest.ini
  '';

+  pytestFlagsArray = [
+    "-W"
+    "ignore::DeprecationWarning"
+  ];
+
+  disabledTests = [
+    # Keyboard interrupt ends test suite run
+    "KeyboardInterrupt"
+    # daemonize and autoreload tests have issue with sockets within sandbox
+    "daemonize"
+    "Autoreload"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "test_block"
+  ];
+
+  disabledTestPaths = lib.optionals stdenv.isDarwin [
+    "cherrypy/test/test_config_server.py"
+  ];
+
  __darwinAllowLocalNetworking = true;

+  pythonImportsCheck = [
+    "cherrypy"
+  ];
+
  meta = with lib; {
+    description = "Object-oriented HTTP framework";
    homepage = "https://www.cherrypy.org";
-    description = "A pythonic, object-oriented HTTP framework";
    license = licenses.bsd3;
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/development/python-modules/chiapos/default.nix
+++ b/pkgs/development/python-modules/chiapos/default.nix
@ -15,12 +15,12 @@

 buildPythonPackage rec {
  pname = "chiapos";
-  version = "1.0.7";
+  version = "1.0.8";
  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1e10ce00730d293ed83ed3a3c630d525c9256fe4e31e64abbda7aa054b8a753f";
+    sha256 = "64529b7f03e9ec0c1b9be7c7c1f30d4498e5d931ff2dbb10a9cc4597029d69f0";
  };

  patches = [
--- a/pkgs/development/python-modules/chiavdf/default.nix
+++ b/pkgs/development/python-modules/chiavdf/default.nix
@ -14,12 +14,12 @@

 buildPythonPackage rec {
  pname = "chiavdf";
-  version = "1.0.3";
+  version = "1.0.4";
  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-XbmK7ZJnUy3Zg9XWt0t/Qb2k5qIlu4vIbxdDFYFjFPI=";
+    hash = "sha256-i6ylxtw1dMtylS4m0mz6rATU1trbMpcmsB2WhD++CeM=";
  };

  patches = [
--- a/pkgs/development/python-modules/cirq-google/default.nix
+++ b/pkgs/development/python-modules/cirq-google/default.nix
@ -15,7 +15,6 @@ buildPythonPackage rec {

  postPatch = ''
    substituteInPlace requirements.txt \
-      --replace "protobuf~=3.13.0" "protobuf" \
      --replace "google-api-core[grpc] >= 1.14.0, < 2.0.0dev" "google-api-core[grpc] >= 1.14.0, < 3.0.0dev"
  '';

@ -29,4 +28,10 @@ buildPythonPackage rec {
    freezegun
    pytestCheckHook
  ];
+
+  disabledTests = [
+    # unittest.mock.InvalidSpecError: Cannot autospec attr 'QuantumEngineServiceClient'
+    "test_get_engine_sampler_explicit_project_id"
+    "test_get_engine_sampler"
+  ];
 }
--- a/pkgs/development/python-modules/cirq-rigetti/default.nix
+++ b/pkgs/development/python-modules/cirq-rigetti/default.nix
@ -40,7 +40,9 @@ buildPythonPackage rec {
      --replace "httpx~=0.15.5" "httpx" \
      --replace "idna~=2.10" "idna" \
      --replace "pyjwt~=1.7.1" "pyjwt" \
-      --replace "qcs-api-client~=0.8.0" "qcs-api-client"
+      --replace "qcs-api-client~=0.8.0" "qcs-api-client" \
+      --replace "iso8601~=0.1.14" "iso8601" \
+      --replace "pydantic~=1.8.2" "pydantic"
    # Remove outdated test
    rm cirq_rigetti/service_test.py
  '';
--- a/pkgs/development/python-modules/confluent-kafka/default.nix
+++ b/pkgs/development/python-modules/confluent-kafka/default.nix
@ -1,12 +1,12 @@
 { lib, buildPythonPackage, fetchPypi, isPy3k, rdkafka, requests, avro3k, avro ? null, futures ? null, enum34 ? null }:

 buildPythonPackage rec {
-  version = "1.7.0";
+  version = "1.8.2";
  pname = "confluent-kafka";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "80e01b4791513c27eded8517af847530dfdf04c43d99ff132ed9c3085933b75b";
+    sha256 = "b79e836c3554bc51c6837a8a0152f7521c9bf31342f5b8e21eba6b28044fa585";
  };

  buildInputs = [ rdkafka requests ] ++ (if isPy3k then [ avro3k ] else [ enum34 avro futures ]) ;
--- a/pkgs/development/python-modules/datadog/default.nix
+++ b/pkgs/development/python-modules/datadog/default.nix
@ -17,11 +17,11 @@

 buildPythonPackage rec {
  pname = "datadog";
-  version = "0.42.0";
+  version = "0.43.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-em+sF6fQnxiDq5pFzk/3oWqhpes8xMbN2sf4xT59Hps=";
+    sha256 = "1f2123083d9e1add6f238c62714b76ac2fc134d7d1c435cd82b976487b191b96";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/denonavr/default.nix
+++ b/pkgs/development/python-modules/denonavr/default.nix
@ -16,6 +16,8 @@
 buildPythonPackage rec {
  pname = "denonavr";
  version = "0.10.9";
+  format = "setuptools";
+
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
@ -40,7 +42,14 @@ buildPythonPackage rec {
    pytest-timeout
  ];

-  pythonImportsCheck = [ "denonavr" ];
+  disabledTestPaths = [
+    # https://github.com/ol-iver/denonavr/issues/228
+    "tests/test_denonavr.py"
+  ];
+
+  pythonImportsCheck = [
+    "denonavr"
+  ];

  meta = with lib; {
    description = "Automation Library for Denon AVR receivers";
--- a/pkgs/development/python-modules/devolo-plc-api/default.nix
+++ b/pkgs/development/python-modules/devolo-plc-api/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , httpx
 , protobuf
 , pytest-asyncio
@ -14,7 +15,7 @@

 buildPythonPackage rec {
  pname = "devolo-plc-api";
-  version = "0.7.0";
+  version = "0.7.1";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -23,7 +24,7 @@ buildPythonPackage rec {
    owner = "2Fake";
    repo = "devolo_plc_api";
    rev = "v${version}";
-    sha256 = "sha256-qzjH52bKQ/oSFd580V92uE2/Z2g+2nLh/JXOXYqVfSY=";
+    sha256 = "sha256-XR/daDrnfbLBrUTTMFYtndr6+RxPwnF4qbXAdXsXKHk=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
@ -38,7 +39,6 @@ buildPythonPackage rec {
    zeroconf
  ];

-
  checkInputs = [
    pytest-asyncio
    pytest-httpx
@ -46,6 +46,8 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+
+
  pythonImportsCheck = [
    "devolo_plc_api"
  ];
--- a/pkgs/development/python-modules/django-taggit/default.nix
+++ b/pkgs/development/python-modules/django-taggit/default.nix
@ -9,13 +9,13 @@

 buildPythonPackage rec {
  pname = "django-taggit";
-  version = "1.5.1";
+  version = "2.0.0";
  format = "setuptools";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "e5bb62891f458d55332e36a32e19c08d20142c43f74bc5656c803f8af25c084a";
+    sha256 = "a23ca776ee2709b455c3a95625be1e4b891ddf1ffb4173153c41806de4038d72";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "flux-led";
-  version = "0.27.44";
+  version = "0.28.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "Danielhiversen";
    repo = "flux_led";
    rev = version;
-    sha256 = "sha256-ImtXcT6CxW6bhtL4uJM8PAvQOm36pxgTGZp4BCJXTUQ=";
+    sha256 = "sha256-6IJxOQIRUfmf+tE5CxIlu7EZBp6j8BeVO2mKKW0VWBY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/formbox/default.nix
+++ b/pkgs/development/python-modules/formbox/default.nix
@ -2,15 +2,15 @@

 buildPythonPackage rec {
  pname = "formbox";
-  version = "0.1.0";
+  version = "0.3.0";
  format = "flit";
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.6";

  src = fetchFromSourcehut {
    owner = "~cnx";
    repo = pname;
    rev = version;
-    sha256 = "sha256-6OzmYqUC3mmrAMeMExI4rdVGUoWrxRuBfjKFYbHUlgE=";
+    sha256 = "sha256-K8NqMi80UurirAZaw67nhW5hFC3+dbdoT84hW7iIcaM=";
  };

  propagatedBuildInputs = [ bleach markdown ];
--- a/pkgs/development/python-modules/glances-api/default.nix
+++ b/pkgs/development/python-modules/glances-api/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "glances-api";
-  version = "0.3.2";
+  version = "0.3.3";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "home-assistant-ecosystem";
    repo = "python-glances-api";
    rev = version;
-    sha256 = "sha256-zVK63SI8ZeVrY2iEEkgp8pq6RDheKeApb9/RWgZCKGI=";
+    sha256 = "sha256-F3jmYBZNzI4hRmH1J+S5RwxjouZNcUJOnD3QpX1J39s=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/glasgow/default.nix
+++ b/pkgs/development/python-modules/glasgow/default.nix
@ -5,7 +5,7 @@
 , setuptools-scm
 , pythonOlder
 , sdcc
-, nmigen
+, amaranth
 , fx2
 , libusb1
 , aiohttp
@ -19,23 +19,23 @@

 buildPythonPackage rec {
  pname = "glasgow";
-  version = "unstable-2021-03-02";
+  version = "unstable-2021-12-12";
  disabled = pythonOlder "3.7";
  # python software/setup.py --version
-  realVersion = "0.1.dev1660+g${lib.substring 0 7 src.rev}";
+  realVersion = "0.1.dev1679+g${lib.substring 0 7 src.rev}";

  src = fetchFromGitHub {
    owner = "GlasgowEmbedded";
    repo = "glasgow";
-    rev = "41c48bbcee284d024e4249a81419fbbae674cf40";
-    sha256 = "1fg8ps228930d70bczwmcwnrd1gvm02a58mxbpn8pyakwbwwa6hq";
+    rev = "e640a778c446b7e9812727e73c560d12aeb41d7c";
+    sha256 = "EsQ9ZjalKDQ54JOonra4yPDI56cF5n86y/Rd798cZsU=";
  };

  nativeBuildInputs = [ setuptools-scm sdcc ];

  propagatedBuildInputs = [
    setuptools
-    nmigen
+    amaranth
    fx2
    libusb1
    aiohttp
@ -72,6 +72,6 @@ buildPythonPackage rec {
    description = "Software for Glasgow, a digital interface multitool";
    homepage = "https://github.com/GlasgowEmbedded/Glasgow";
    license = licenses.bsd0;
-    maintainers = with maintainers; [ emily ];
+    maintainers = with maintainers; [ emily thoughtpolice ];
  };
 }
--- a/pkgs/development/python-modules/goodwe/default.nix
+++ b/pkgs/development/python-modules/goodwe/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "goodwe";
-  version = "0.2.13";
+  version = "0.2.14";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -16,7 +16,7 @@ buildPythonPackage rec {
    owner = "marcelblijleven";
    repo = pname;
    rev = "v${version}";
-    sha256 = "189szff4sl5pc670wv8syl6zcv3p748s33w11biig0vbd59kdr1l";
+    sha256 = "1q314mq83n9cfkhw3rmx6ka6ga6n2c5q5irh1bsf3f0i7m7m1k3j";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/grappelli_safe/default.nix
+++ b/pkgs/development/python-modules/grappelli_safe/default.nix
@ -4,12 +4,12 @@
 }:

 buildPythonPackage rec {
-  version = "1.0.0";
+  version = "1.1.1";
  pname = "grappelli_safe";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "84c03ec5373341d980a76480d992389e286fbc50048e91bc2e5c876d02873cc5";
+    sha256 = "ee34b3e2a3711498b1f8da3d9daa8a1239efdf255a212181742b6a5890fac039";
  };

  meta = with lib; {
--- a/pkgs/development/python-modules/hahomematic/default.nix
+++ b/pkgs/development/python-modules/hahomematic/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "hahomematic";
-  version = "0.16.0";
+  version = "0.18.0";
  format = "setuptools";

  disabled = pythonOlder "3.9";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "danielperna84";
    repo = pname;
    rev = version;
-    sha256 = "sha256-+l6VeF3vOO5MBW9FLlnE/Anm8vps2Sl6Nmf2N9QiArQ=";
+    sha256 = "sha256-SkEI5uWKtszSBZblDBvbEmJh0OdvqDcwY6PG3JK4djY=";
  };

  propagatedBuildInputs = [
--- a/Show more
+++ b/Show more