Merge master into haskell-updates

nixos/doc/manual/development/writing-nixos-tests.section.md

@@ -393,3 +393,25 @@ with foo_running:
     def foo_running():
         machine.succeed("pgrep -x foo")
     ```
+
+## Adding Python packages to the test script {#ssec-python-packages-in-test-script}
+
+When additional Python libraries are required in the test script, they can be
+added using the parameter `extraPythonPackages`. For example, you could add
+`numpy` like this:
+
+```nix
+import ./make-test-python.nix
+{
+  extraPythonPackages = p: [ p.numpy ];
+
+  nodes = { };
+
+  testScript = ''
+    import numpy as np
+    assert str(np.zeros(4) == "array([0., 0., 0., 0.])")
+  '';
+}
+```
+
+In that case, `numpy` is chosen from the generic `python3Packages`.

nixos/doc/manual/from_md/development/writing-nixos-tests.section.xml

@@ -665,4 +665,30 @@ def foo_running():
 ```
 </programlisting>
   </section>
+  <section xml:id="ssec-python-packages-in-test-script">
+    <title>Adding Python packages to the test script</title>
+    <para>
+      When additional Python libraries are required in the test script,
+      they can be added using the parameter
+      <literal>extraPythonPackages</literal>. For example, you could add
+      <literal>numpy</literal> like this:
+    </para>
+    <programlisting language="bash">
+import ./make-test-python.nix
+{
+  extraPythonPackages = p: [ p.numpy ];
+
+  nodes = { };
+
+  testScript = ''
+    import numpy as np
+    assert str(np.zeros(4) == &quot;array([0., 0., 0., 0.])&quot;)
+  '';
+}
+</programlisting>
+    <para>
+      In that case, <literal>numpy</literal> is chosen from the generic
+      <literal>python3Packages</literal>.
+    </para>
+  </section>
 </section>

nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

@@ -40,7 +40,7 @@
   </section>
   <section xml:id="sec-release-22.11-new-services">
     <title>New Services</title>
-    <itemizedlist spacing="compact">
+    <itemizedlist>
       <listitem>
         <para>
           <link xlink:href="https://github.com/jollheef/appvm">appvm</link>,
@@ -48,6 +48,13 @@
           <link xlink:href="options.html#opt-virtualisation.appvm.enable">virtualisation.appvm</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://github.com/leetronics/infnoise">infnoise</link>,
+          a hardware True Random Number Generator dongle. Available as
+          <link xlink:href="options.html#opt-services.infnoise.enable">services.infnoise</link>.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-22.11-incompatibilities">

nixos/doc/manual/release-notes/rl-2211.section.md

@@ -25,6 +25,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [appvm](https://github.com/jollheef/appvm), Nix based app VMs. Available as [virtualisation.appvm](options.html#opt-virtualisation.appvm.enable).
 
+- [infnoise](https://github.com/leetronics/infnoise), a hardware True Random Number Generator dongle.
+  Available as [services.infnoise](options.html#opt-services.infnoise.enable).
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Backward Incompatibilities {#sec-release-22.11-incompatibilities}

nixos/lib/test-driver/default.nix

@@ -10,6 +10,7 @@
 , socat
 , tesseract4
 , vde2
+, extraPythonPackages ? (_ : [])
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -17,8 +18,17 @@ python3Packages.buildPythonApplication rec {
   version = "1.1";
   src = ./.;
 
-  propagatedBuildInputs = [ coreutils netpbm python3Packages.colorama python3Packages.ptpython qemu_pkg socat vde2 ]
-    ++ (lib.optionals enableOCR [ imagemagick_light tesseract4 ]);
+  propagatedBuildInputs = [
+    coreutils
+    netpbm
+    python3Packages.colorama
+    python3Packages.ptpython
+    qemu_pkg
+    socat
+    vde2
+  ]
+    ++ (lib.optionals enableOCR [ imagemagick_light tesseract4 ])
+    ++ extraPythonPackages python3Packages;
 
   doCheck = true;
   checkInputs = with python3Packages; [ mypy pylint black ];

nixos/lib/testing-python.nix

@@ -53,12 +53,13 @@ rec {
     , skipTypeCheck ? false
     , passthru ? {}
     , interactive ? false
+    , extraPythonPackages ? (_ :[])
   }:
     let
       # Reifies and correctly wraps the python test driver for
       # the respective qemu version and with or without ocr support
       testDriver = pkgs.callPackage ./test-driver {
-        inherit enableOCR;
+        inherit enableOCR extraPythonPackages;
         qemu_pkg = qemu_test;
         imagemagick_light = imagemagick_light.override { inherit libtiff; };
         tesseract4 = tesseract4.override { enableLanguages = [ "eng" ]; };
@@ -184,6 +185,7 @@ rec {
         (if meta.description or null != null
           then builtins.unsafeGetAttrPos "description" meta
           else builtins.unsafeGetAttrPos "testScript" t)
+    , extraPythonPackages ? (_ : [])
     } @ t:
     let
       mkNodes = qemu_pkg:
@@ -236,13 +238,13 @@ rec {
           );
 
       driver = setupDriverForTest {
-        inherit testScript enableOCR skipTypeCheck skipLint passthru;
+        inherit testScript enableOCR skipTypeCheck skipLint passthru extraPythonPackages;
         testName = name;
         qemu_pkg = pkgs.qemu_test;
         nodes = mkNodes pkgs.qemu_test;
       };
       driverInteractive = setupDriverForTest {
-        inherit testScript enableOCR skipTypeCheck skipLint passthru;
+        inherit testScript enableOCR skipTypeCheck skipLint passthru extraPythonPackages;
         testName = name;
         qemu_pkg = pkgs.qemu;
         nodes = mkNodes pkgs.qemu;

nixos/modules/module-list.nix

@@ -983,6 +983,7 @@
   ./services/security/hologram-server.nix
   ./services/security/hologram-agent.nix
   ./services/security/kanidm.nix
+  ./services/security/infnoise.nix
   ./services/security/munge.nix
   ./services/security/nginx-sso.nix
   ./services/security/oauth2_proxy.nix

nixos/modules/services/desktops/pipewire/pipewire.nix

@@ -239,7 +239,7 @@ in {
     };
 
     environment.sessionVariables.LD_LIBRARY_PATH =
-      lib.optional cfg.jack.enable "${cfg.package.jack}/lib";
+      lib.mkIf cfg.jack.enable [ "${cfg.package.jack}/lib" ];
 
     users = lib.mkIf cfg.systemWide {
       users.pipewire = {

nixos/modules/services/misc/uhub.nix

@@ -80,11 +80,12 @@ in {
           tls_enable = cfg.enableTLS;
           file_plugins = pkgs.writeText "uhub-plugins.conf"
             (lib.strings.concatStringsSep "\n" (map ({ plugin, settings }:
-              "plugin ${plugin} ${
-                toString
-                (lib.attrsets.mapAttrsToList (key: value: ''"${key}=${value}"'')
-                  settings)
-              }") cfg.plugins));
+              ''
+                plugin ${plugin} "${
+                  toString
+                  (lib.attrsets.mapAttrsToList (key: value: "${key}=${value}")
+                    settings)
+                }"'') cfg.plugins));
         };
       in {
         name = "uhub/${name}.conf";
@@ -104,6 +105,9 @@ in {
           ExecStart = "${pkg}/bin/uhub -c /etc/uhub/${name}.conf -L";
           ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
           DynamicUser = true;
+
+          AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+          CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
         };
       };
     }) hubs;

nixos/modules/services/monitoring/netdata.nix

@@ -201,6 +201,8 @@ in {
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/netdata -P /run/netdata/netdata.pid -D -c /etc/netdata/netdata.conf";
         ExecReload = "${pkgs.util-linux}/bin/kill -s HUP -s USR1 -s USR2 $MAINPID";
+        ExecPostStart = ''while [ "$(netdatacli ping)" != pong ]; do sleep 0.5; done'';
+
         TimeoutStopSec = 60;
         Restart = "on-failure";
         # User and group

nixos/modules/services/security/infnoise.nix

@@ -0,0 +1,60 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.infnoise;
+in {
+  options = {
+    services.infnoise = {
+      enable = mkEnableOption "the Infinite Noise TRNG driver";
+
+      fillDevRandom = mkOption {
+        description = ''
+          Whether to run the infnoise driver as a daemon to refill /dev/random.
+
+          If disabled, you can use the `infnoise` command-line tool to
+          manually obtain randomness.
+        '';
+        type = types.bool;
+        default = true;
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.infnoise ];
+
+    services.udev.extraRules = ''
+      SUBSYSTEM=="usb", ATTRS{idVendor}=="0403", ATTRS{idProduct}=="6015", SYMLINK+="infnoise", TAG+="systemd", GROUP="dialout", MODE="0664", ENV{SYSTEMD_WANTS}="infnoise.service"
+    '';
+
+    systemd.services.infnoise = mkIf cfg.fillDevRandom {
+      description = "Infinite Noise TRNG driver";
+
+      bindsTo = [ "dev-infnoise.device" ];
+      after = [ "dev-infnoise.device" ];
+
+      serviceConfig = {
+        ExecStart = "${pkgs.infnoise}/bin/infnoise --dev-random --debug";
+        Restart = "always";
+        User = "infnoise";
+        DynamicUser = true;
+        SupplementaryGroups = [ "dialout" ];
+        DeviceAllow = [ "/dev/infnoise" ];
+        DevicePolicy = "closed";
+        PrivateNetwork = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true; # only reads entropy pool size and watermark
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+      };
+    };
+  };
+}

nixos/tests/all-tests.nix

@@ -26,8 +26,22 @@ let
     featureFlags.minimalModules = {};
   };
   evalMinimalConfig = module: nixosLib.evalModules { modules = [ module ]; };
-in
-{
+
+  allDrivers = getDrivers tests;
+
+  getDrivers = ts:
+    if isDerivation ts
+    then ts.driver or null
+    else if isAttrs ts
+    then recurseIntoAttrs (mapAttrs (k: getDrivers) ts)
+    else null;
+
+  tests = {
+
+  # for typechecking of the scripts and evaluation of
+  # the nodes, without running VMs.
+  inherit allDrivers;
+
   _3proxy = handleTest ./3proxy.nix {};
   acme = handleTest ./acme.nix {};
   adguardhome = handleTest ./adguardhome.nix {};
@@ -152,6 +166,7 @@ in
   etcd-cluster = handleTestOn ["x86_64-linux"] ./etcd-cluster.nix {};
   etebase-server = handleTest ./etebase-server.nix {};
   etesync-dav = handleTest ./etesync-dav.nix {};
+  extra-python-packages = handleTest ./extra-python-packages.nix {};
   fancontrol = handleTest ./fancontrol.nix {};
   fcitx = handleTest ./fcitx {};
   fenics = handleTest ./fenics.nix {};
@@ -620,4 +635,5 @@ in
   zookeeper = handleTest ./zookeeper.nix {};
   zrepl = handleTest ./zrepl.nix {};
   zsh-history = handleTest ./zsh-history.nix {};
-}
+};
+in tests

nixos/tests/extra-python-packages.nix

@@ -0,0 +1,13 @@
+import ./make-test-python.nix ({ ... }:
+  {
+    name = "extra-python-packages";
+
+    extraPythonPackages = p: [ p.numpy ];
+
+    nodes = { };
+
+    testScript = ''
+      import numpy as np
+      assert str(np.zeros(4) == "array([0., 0., 0., 0.])")
+    '';
+  })

nixos/tests/nitter.nix

@@ -12,7 +12,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
 
   testScript = ''
     machine.wait_for_unit("nitter.service")
-    machine.wait_for_open_port("80")
+    machine.wait_for_open_port(80)
     machine.succeed("curl --fail http://localhost:80/")
   '';
 })

pkgs/applications/audio/jmusicbot/default.nix

@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Discord music bot that's easy to set up and run yourself";
     homepage = "https://github.com/jagrosh/MusicBot";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.asl20;
     maintainers = with maintainers; [ SuperSandro2000 ];
     platforms = platforms.all;

pkgs/applications/audio/munt/libmt32emu.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libmt32emu";
-  version = "2.5.3";
+  version = "2.6.3";
 
   src = fetchFromGitHub {
     owner = "munt";
     repo = "munt";
     rev = "${pname}_${lib.replaceChars [ "." ] [ "_" ] version}";
-    hash = "sha256-n5VV5Swh1tOVQGT3urEKl64A/w7cY95/0y5wC5ZuLm4=";
+    sha256 = "0ncy55fj9l2s750clxjpv102hrgcndz4qba9w2sf8lwzgy6d1xmp";
   };
 
   outputs = [ "out" "dev" ];

pkgs/applications/audio/munt/mt32emu-qt.nix

@@ -13,15 +13,18 @@
 , withJack ? stdenv.hostPlatform.isUnix, libjack2
 }:
 
+let
+  char2underscore = char: str: lib.replaceChars [ char ] [ "_" ] str;
+in
 mkDerivation rec {
   pname = "mt32emu-qt";
-  version = "1.9.0";
+  version = "1.10.2";
 
   src = fetchFromGitHub {
     owner = "munt";
     repo = "munt";
-    rev = "mt32emu_qt_${lib.replaceChars [ "." ] [ "_" ] version}";
-    hash = "sha256-9vapBKpl1NC3mIDetuCb452IHV6c7c7NCzSyiBry5oo=";
+    rev = "${char2underscore "-" pname}_${char2underscore "." version}";
+    sha256 = "1dh5xpnsgx367ch45mm5c2p26vnxf3shax2afg2cd2lrbrlii7l9";
   };
 
   postPatch = ''
@@ -55,8 +58,8 @@ mkDerivation rec {
 
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir $out/Applications
-    mv $out/bin/${meta.mainProgram}.app $out/Applications/
-    ln -s $out/{Applications/${meta.mainProgram}.app/Contents/MacOS,bin}/${meta.mainProgram}
+    mv $out/bin/${pname}.app $out/Applications/
+    ln -s $out/{Applications/${pname}.app/Contents/MacOS,bin}/${pname}
   '';
 
   meta = with lib; {
@@ -70,6 +73,5 @@ mkDerivation rec {
     license = with licenses; [ gpl3Plus ];
     maintainers = with maintainers; [ OPNA2608 ];
     platforms = platforms.all;
-    mainProgram = "mt32emu-qt";
   };
 }

pkgs/applications/audio/munt/mt32emu-smf2wav.nix

@@ -7,15 +7,18 @@
 , pkg-config
 }:
 
+let
+  char2underscore = char: str: lib.replaceChars [ char ] [ "_" ] str;
+in
 stdenv.mkDerivation rec {
   pname = "mt32emu-smf2wav";
-  version = "1.7.0";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "munt";
     repo = "munt";
-    rev = "mt32emu_smf2wav_${lib.replaceChars [ "." ] [ "_" ] version}";
-    hash = "sha256-FnKlKJxe7P4Yqpv0oVGgV4253dMgSmgtb7EAa2FI+aI=";
+    rev = "${char2underscore "-" pname}_${char2underscore "." version}";
+    sha256 = "1dh5xpnsgx367ch45mm5c2p26vnxf3shax2afg2cd2lrbrlii7l9";
   };
 
   postPatch = ''
@@ -45,6 +48,5 @@ stdenv.mkDerivation rec {
     license = with licenses; [ gpl3Plus ];
     maintainers = with maintainers; [ OPNA2608 ];
     platforms = platforms.all;
-    mainProgram = "mt32emu-smf2wav";
   };
 }

pkgs/applications/audio/noisetorch/default.nix

@@ -2,20 +2,21 @@
 
 buildGoModule rec {
   pname = "NoiseTorch";
-  version = "0.11.5";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
-    owner = "lawl";
+    owner = "noisetorch";
     repo = "NoiseTorch";
-    rev = version;
-    sha256 = "sha256-j/6XB3vA5LvTuCxmeB0HONqEDzYg210AWW/h3nCGOD8=";
+    rev = "v${version}";
+    sha256 = "sha256-A6cX1ck47/ZIn9cnV/Ow4CxVFfOX5J0K0Q+B70jCFdQ=";
+    fetchSubmodules = true;
   };
 
   vendorSha256 = null;
 
   doCheck = false;
 
-  ldflags = [ "-X main.version=${version}"  "-X main.distribution=nix" ];
+  ldflags = [ "-X main.version=${version}" "-X main.distribution=nix" ];
 
   subPackages = [ "." ];
 
@@ -34,9 +35,10 @@ buildGoModule rec {
 
   meta = with lib; {
     insecure = true;
-    knownVulnerabilities = [ "https://github.com/lawl/NoiseTorch/releases/tag/0.11.6" ];
+    knownVulnerabilities =
+      lib.optional (lib.versionOlder version "0.12") "https://github.com/noisetorch/NoiseTorch/releases/tag/v0.12.0";
     description = "Virtual microphone device with noise supression for PulseAudio";
-    homepage = "https://github.com/lawl/NoiseTorch";
+    homepage = "https://github.com/noisetorch/NoiseTorch";
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ panaeon lom ];

pkgs/applications/audio/psst/default.nix

@@ -2,22 +2,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "psst";
-  version = "unstable-2022-01-25";
+  version = "unstable-2022-05-19";
 
   src = fetchFromGitHub {
     owner = "jpochyla";
     repo = pname;
-    rev = "1627cd4a301dd51e9ee3034294cd7b0d94d02ddc";
-    sha256 = "sha256-kepvYhmieXx6Hj79aqaA7tYUnueaBsNx0U4lV7K6LuU=";
+    rev = "e403609e0916fe664fb1f28c7a259d01fa69b0e9";
+    sha256 = "sha256-hpAP/m9aJsfh9FtwLqaKFZllnCQn9OSYLWuNZakZJnk=";
   };
 
-  cargoSha256 = "sha256-DcdlQudGyWUUAacV7pAOLDvhd1fgAkEesdxDkHSYm4M=";
+  cargoSha256 = "sha256-gQ0iI2wTS5n5pItmQCmFXDs5L8nA2w5ZrZyZtpMlUro=";
   # specify the subdirectory of the binary crate to build from the workspace
   buildAndTestSubdir = "psst-gui";
 
-  nativeBuildInputs = [
-    pkg-config
-  ];
+  nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
     alsa-lib
@@ -30,10 +28,14 @@ rustPlatform.buildRustPackage rec {
     pango
   ];
 
+  postInstall = ''
+    install -Dm444 psst-gui/assets/logo_512.png $out/share/icons/${pname}.png
+  '';
+
   meta = with lib; {
     description = "Fast and multi-platform Spotify client with native GUI";
     homepage = "https://github.com/jpochyla/psst";
     license = licenses.mit;
-    maintainers = [ maintainers.vbrandl ];
+    maintainers = with maintainers; [ vbrandl peterhoeg ];
   };
 }

pkgs/applications/blockchains/bisq-desktop/default.nix

@@ -94,6 +94,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A decentralized bitcoin exchange network";
     homepage = "https://bisq.network";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.mit;
     maintainers = with maintainers; [ juaningan emmanuelrosa ];
     platforms = [ "x86_64-linux" ];

pkgs/applications/blockchains/ergo/default.nix

@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Open protocol that implements modern scientific ideas in the blockchain area";
     homepage = "https://ergoplatform.org/en/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.cc0;
     platforms = platforms.all;
     maintainers = with maintainers; [ mmahut ];

pkgs/applications/blockchains/tessera/default.nix

@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Enterprise Implementation of Quorum's transaction manager";
     homepage = "https://github.com/jpmorganchase/tessera";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.asl20;
     maintainers = with maintainers; [ mmahut ];
   };

pkgs/applications/editors/bluej/default.nix

@@ -56,6 +56,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A simple integrated development environment for Java";
     homepage = "https://www.bluej.org/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl2ClasspathPlus;
     maintainers = with maintainers; [ chvp ];
     platforms = platforms.unix;

pkgs/applications/editors/eclipse/plugins.nix

@@ -108,6 +108,7 @@ rec {
     meta = with lib; {
       homepage = "https://github.com/tobiasmelcher/EclipseAceJump";
       description = "Provides fast jumps to text based on initial letter";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.mit;
       platforms = platforms.all;
     };
@@ -130,6 +131,7 @@ rec {
     meta = with lib; {
       homepage = "https://mihai-nita.net/java/#ePluginAEC";
       description = "Adds support for ANSI escape sequences in the Eclipse console";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.asl20;
       platforms = platforms.all;
     };
@@ -152,6 +154,7 @@ rec {
     meta = with lib; {
       description = "A powerful parser generator for processing structured text or binary files";
       homepage = "https://www.antlr.org/";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.bsd3;
       platforms = platforms.all;
     };
@@ -174,6 +177,7 @@ rec {
     meta = with lib; {
       description = "A powerful parser generator for processing structured text or binary files";
       homepage = "https://www.antlr.org/";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.bsd3;
       platforms = platforms.all;
     };
@@ -196,6 +200,7 @@ rec {
     meta = with lib; {
       homepage = "http://andrei.gmxhome.de/anyedit/";
       description = "Adds new tools to the context menu of text-based editors";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.epl10;
       platforms = platforms.all;
     };
@@ -218,6 +223,7 @@ rec {
     meta = with lib; {
       homepage = "https://github.com/cypher256/eclipse-encoding-plugin";
       description = "Show file encoding and line ending for the active editor in the eclipse status bar";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.epl10;
       platforms = platforms.all;
     };
@@ -240,6 +246,7 @@ rec {
     meta = with lib; {
       homepage = "http://andrei.gmxhome.de/bytecode/";
       description = "Shows disassembled bytecode of current java editor or class file";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.bsd2;
       platforms = platforms.all;
     };
@@ -259,6 +266,7 @@ rec {
     meta = with lib; {
       homepage = "https://eclipse.org/cdt/";
       description = "C/C++ development tooling";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.epl10;
       platforms = platforms.all;
       maintainers = [ maintainers.bjornfor ];
@@ -278,6 +286,7 @@ rec {
     meta = with lib; {
       homepage = "https://eclipse-cs.sourceforge.net/";
       description = "Checkstyle integration into the Eclipse IDE";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.lgpl21;
       platforms = platforms.all;
     };
@@ -301,6 +310,7 @@ rec {
     meta = with lib; {
       homepage = "http://eclipsecolorthemes.org/";
       description = "Plugin to switch color themes conveniently and without side effects";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.epl10;
       platforms = platforms.all;
     };
@@ -333,6 +343,7 @@ rec {
     meta = with lib; {
       homepage = "http://www2.cs.tum.edu/projects/cup/eclipse.php";
       description = "IDE for developing CUP based parsers";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       platforms = platforms.all;
       maintainers = [ maintainers.romildo ];
     };
@@ -358,6 +369,7 @@ rec {
     meta = with lib; {
       homepage = "https://www.drools.org/";
       description = "Drools is a Business Rules Management System (BRMS) solution";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.asl20;
     };
   };
@@ -375,6 +387,7 @@ rec {
     meta = with lib; {
       homepage = "https://www.eclemma.org/";
       description = "EclEmma is a free Java code coverage tool for Eclipse";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.epl10;
       platforms = platforms.all;
     };
@@ -397,6 +410,7 @@ rec {
     meta = with lib; {
       homepage = "http://findbugs.sourceforge.net/";
       description = "Plugin that uses static analysis to look for bugs in Java code";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.epl10;
       platforms = platforms.all;
     };
@@ -415,6 +429,7 @@ rec {
     meta = with lib; {
       homepage = "https://github.com/ddekany/jbosstools-freemarker";
       description = "Plugin that provides an editor for Apache FreeMarker files";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
     };
   };
 
@@ -431,6 +446,7 @@ rec {
     meta = with lib; {
       homepage = "http://gnuarmeclipse.livius.net/";
       description = "GNU ARM Eclipse Plug-ins";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.epl10;
       platforms = platforms.all;
       maintainers = [ maintainers.bjornfor ];
@@ -469,6 +485,7 @@ rec {
     meta = with lib; {
       description = "Adds support for JSON files to Eclipse";
       homepage = "https://github.com/boothen/Json-Eclipse-Plugin";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.epl10;
       platforms = platforms.all;
     };
@@ -491,6 +508,7 @@ rec {
     meta = with lib; {
       homepage = "https://github.com/angelozerr/jdt-codemining";
       description = "Provides JDT Java CodeMining";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.epl10;
       platforms = platforms.all;
     };
@@ -516,6 +534,7 @@ rec {
     meta = with lib; {
       homepage = "https://github.com/RustDT";
       description = "Rust development tooling";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.epl10;
       platforms = platforms.all;
     };
@@ -533,6 +552,7 @@ rec {
     meta = with lib; {
       homepage = "http://scala-ide.org/";
       description = "The Scala IDE for Eclipse";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.bsd3;
       platforms = platforms.all;
     };
@@ -551,6 +571,7 @@ rec {
     meta = with lib; {
       homepage = "https://spotbugs.github.io/";
       description = "Plugin that uses static analysis to look for bugs in Java code";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.lgpl21;
       platforms = platforms.all;
     };
@@ -573,6 +594,7 @@ rec {
     meta = with lib; {
       homepage = "https://testng.org/doc/";
       description = "Eclipse plugin for the TestNG testing framework";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.asl20;
       platforms = platforms.all;
     };
@@ -594,6 +616,7 @@ rec {
     meta = with lib; {
       homepage = "https://github.com/vrapper/vrapper";
       description = "A wrapper to provide a Vim-like input scheme for moving around and editing text";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.gpl3;
       platforms = platforms.all;
       maintainers = [ maintainers.stumoss ];
@@ -617,6 +640,7 @@ rec {
     meta = with lib; {
       homepage = "https://github.com/oyse/yedit";
       description = "A YAML editor plugin for Eclipse";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.epl10;
       platforms = platforms.all;
     };
@@ -634,6 +658,7 @@ rec {
     meta = with lib; {
       homepage = "https://www.eclipse.org/gef/zest/";
       description = "The Eclipse Visualization Toolkit";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       platforms = platforms.all;
       maintainers = [ maintainers.romildo ];
     };
@@ -656,6 +681,7 @@ rec {
     meta = with lib; {
       homepage = "https://ant.apache.org/ivy/ivyde/index.html";
       description = "A plugin which integrates Apache Ivy's dependency management";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.asl20;
       platforms = platforms.all;
       maintainers = [ maintainers.r3dl3g ];
@@ -683,6 +709,7 @@ rec {
         Apache IvyDE Resolve Visualizer is an optional dependency of Apache IvyDE since
         it requires additional plugins to be installed (Zest).
       '';
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.asl20;
       platforms = platforms.all;
       maintainers = [ maintainers.r3dl3g ];
@@ -706,6 +733,7 @@ rec {
     meta = with lib; {
       homepage = "https://ant.apache.org/ivy/index.html";
       description = "A popular dependency manager focusing on flexibility and simplicity";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.asl20;
       platforms = platforms.all;
       maintainers = [ maintainers.r3dl3g ];
@@ -729,6 +757,7 @@ rec {
     meta = with lib; {
       homepage = "https://ant.apache.org/ivy/ivyde/index.html";
       description = "Ant Tasks integrated into Eclipse's Ant runtime";
+      sourceProvenance = with sourceTypes; [ binaryBytecode ];
       license = licenses.asl20;
       platforms = platforms.all;
       maintainers = [ maintainers.r3dl3g ];

pkgs/applications/editors/greenfoot/default.nix

@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A simple integrated development environment for Java";
     homepage = "https://www.greenfoot.org/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl2ClasspathPlus;
     maintainers = [ maintainers.chvp ];
     platforms = platforms.unix;

pkgs/applications/editors/jedit/default.nix

@@ -55,6 +55,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Mature programmer's text editor (Java based)";
     homepage = "http://www.jedit.org";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl2;
     platforms = platforms.unix;
     maintainers = [ maintainers.vbgl ];

pkgs/applications/editors/jupyter-kernels/clojupyter/default.nix

@@ -25,6 +25,7 @@ let
   meta = with lib; {
     description = "A Jupyter kernel for Clojure";
     homepage = "https://github.com/clojupyter/clojupyter";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];  # deps from maven
     license = licenses.mit;
     maintainers = with maintainers; [ thomasjm ];
     platforms = jre.meta.platforms;

pkgs/applications/editors/music/tuxguitar/default.nix

@@ -38,6 +38,7 @@ in stdenv.mkDerivation rec {
       in Java-SWT. It can open GuitarPro, PowerTab and TablEdit files.
     '';
     homepage = "http://www.tuxguitar.com.ar/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.lgpl2;
     maintainers = [ maintainers.ardumont ];
     platforms = platforms.linux;

pkgs/applications/emulators/ccemux/default.nix

@@ -61,6 +61,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "A modular ComputerCraft emulator";
     homepage = "https://github.com/CCEmuX/CCEmuX";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.mit;
     maintainers = with maintainers; [ CrazedProgrammer ];
   };

pkgs/applications/emulators/zsnes/default.nix

@@ -32,6 +32,10 @@ in stdenv.mkDerivation {
     done
   '';
 
+  # Workaround build failure on -fno-common toolchains:
+  #   ld: initc.o:(.bss+0x28): multiple definition of `HacksDisable'; cfg.o:(.bss+0x59e3): first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   preConfigure = ''
     cd src
     sed -i "/^STRIP/d" configure

pkgs/applications/finance/irpf/default.nix

@@ -68,6 +68,7 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://www.gov.br/receitafederal/pt-br";
     license = licenses.unfree;
     platforms = platforms.all;
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     maintainers = with maintainers; [ atila ];
   };
 }

pkgs/applications/graphics/ImageMagick/7.0.nix

@@ -45,13 +45,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.1.0-36";
+  version = "7.1.0-37";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    hash = "sha256-fl83O3vVHp12+Vj3WT0NOWe5a6ufmtFlxVlbUhIzfB0=";
+    hash = "sha256-Okp3oPIAEXl+fTnEw0jufSxcRU6ip+on5/IyGEjzx2E=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big

pkgs/applications/graphics/alchemy/default.nix

@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
       an expanded range of ideas and possibilities in a serendipitous way.
     '';
     homepage = "http://al.chemy.org/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.marcweber ];
     platforms = platforms.linux;

pkgs/applications/graphics/fiji/default.nix

@@ -66,6 +66,7 @@ stdenv.mkDerivation rec {
     homepage = "https://imagej.net/software/fiji/";
     description = "batteries-included distribution of ImageJ2, bundling a lot of plugins which facilitate scientific image analysis";
     platforms = [ "x86_64-linux" ];
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = with lib.licenses; [ gpl2Plus gpl3Plus bsd2 publicDomain ];
     maintainers = with maintainers; [ zane ];
   };

pkgs/applications/graphics/imagej/default.nix

@@ -74,6 +74,7 @@ in stdenv.mkDerivation rec {
       inspired by NIH Image for the Macintosh.
       It runs on any computer with a Java 1.4 or later virtual machine.
     '';
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.publicDomain;
     platforms = platforms.unix;
     maintainers = with maintainers; [ yuriaisaka ];

pkgs/applications/graphics/mcomix/default.nix

@@ -0,0 +1,64 @@
+{ lib
+, fetchurl
+, gdk-pixbuf
+, gobject-introspection
+, gtk3
+, mcomix
+, python3
+, testVersion
+, wrapGAppsHook
+
+# Recommended Dependencies:
+, lhasa
+, mupdf
+, p7zip
+, unrar
+, unrarSupport ? false  # unfree software
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "mcomix";
+  version = "2.0.2";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/mcomix/${pname}-${version}.tar.gz";
+    sha256 = "sha256-7zjQcT5WoHxy+YzCDJ6s2ngOOfO4L9exuqBqacecClg=";
+  };
+
+  buildInputs = [ gobject-introspection gtk3 gdk-pixbuf ];
+  nativeBuildInputs = [ wrapGAppsHook ];
+  propagatedBuildInputs = (with python3.pkgs; [ pillow pygobject3 pycairo ]);
+
+  # Tests are broken
+  doCheck = false;
+
+  # Correct wrapper behavior, see https://github.com/NixOS/nixpkgs/issues/56943
+  # until https://github.com/NixOS/nixpkgs/pull/102613
+  strictDeps = false;
+
+  # prevent double wrapping
+  dontWrapGApps = true;
+
+  preFixup = ''
+    makeWrapperArgs+=(
+      "''${gappsWrapperArgs[@]}"
+      "--prefix" "PATH" ":" "${lib.makeBinPath ([ p7zip lhasa mupdf ] ++ lib.optional (unrarSupport) unrar)}"
+    )
+  '';
+
+  passthru.tests.version = testVersion {
+    package = mcomix;
+  };
+
+  meta = with lib; {
+    description = "Comic book reader and image viewer";
+    longDescription = ''
+      User-friendly, customizable image viewer, specifically designed to handle
+      comic books and manga supporting a variety of container formats
+      (including CBR, CBZ, CB7, CBT, LHA and PDF)
+    '';
+    homepage = "https://sourceforge.net/projects/mcomix/";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ thiagokokada ];
+  };
+}

pkgs/applications/graphics/mcomix3/default.nix

@@ -1,105 +0,0 @@
-{ lib
-, fetchFromGitHub
-, wrapGAppsHook
-, installShellFiles
-, python3
-, gobject-introspection
-, gtk3
-, gdk-pixbuf
-
-# Recommended Dependencies:
-, unrarSupport ? false  # unfree software
-, unrar
-, p7zip
-, lhasa
-, mupdf
-}:
-
-python3.pkgs.buildPythonApplication rec {
-  pname = "mcomix3";
-  version = "unstable-2021-04-23";
-
-  # no official release on pypi/github and no build system
-  src = fetchFromGitHub {
-    repo   = "${pname}";
-    owner  = "multiSnow";
-    rev = "139344e23898c28484328fc29fd0c6659affb12d";
-    sha256 = "0q9xgl60ryf7qmy5vgzgfry4rvw5j9rb4d1ilxmpjmvm7dd3fm2k";
-  };
-
-  buildInputs = [ gobject-introspection gtk3 gdk-pixbuf ];
-  nativeBuildInputs = [ wrapGAppsHook installShellFiles ];
-  propagatedBuildInputs = (with python3.pkgs; [ pillow pygobject3 pycairo ]);
-
-  format = "other";
-
-  # Correct wrapper behavior, see https://github.com/NixOS/nixpkgs/issues/56943
-  # until https://github.com/NixOS/nixpkgs/pull/102613
-  strictDeps = false;
-
-  preInstall = ''
-    libdir=$out/lib/${python3.libPrefix}/site-packages
-    mkdir -p $out/share/{icons/hicolor,man/man1,applications,metainfo,thumbnailers}
-    mkdir -p $out/bin $libdir
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    substituteInPlace mime/*.desktop \
-      --replace "Exec=mcomix" "Exec=mcomix3" \
-      --replace "Icon=mcomix" "Icon=${pname}"
-    ${python3.executable} installer.py --srcdir=mcomix --target=$libdir
-    mv $libdir/mcomix/mcomixstarter.py $out/bin/${pname}
-    mv $libdir/mcomix/comicthumb.py $out/bin/comicthumb
-    mv $libdir/mcomix/mcomix/* $libdir/mcomix
-
-    runHook postInstall
-  '';
-
-  postInstall = ''
-    rmdir $libdir/mcomix/mcomix
-    mv man/mcomix.1 man/${pname}.1
-    installManPage man/*
-    cp -r mime/icons/* $out/share/icons/hicolor/
-    cp mime/*.desktop $out/share/applications/
-    cp mime/*.appdata.xml $out/share/metainfo/
-    cp mime/*.thumbnailer $out/share/thumbnailers/
-    for folder in $out/share/icons/hicolor/*; do
-        mkdir $folder/{apps,mimetypes}
-        mv $folder/*.png $folder/mimetypes
-        cp $libdir/mcomix/images/$(basename $folder)/mcomix.png $folder/apps/${pname}.png
-        cp $folder/mimetypes/application-x-cbt.png $folder/mimetypes/application-x-cbr.png
-        cp $folder/mimetypes/application-x-cbt.png $folder/mimetypes/application-x-cbz.png
-    done
-  '';
-
-  # prevent double wrapping
-  dontWrapGApps = true;
-  preFixup = ''
-    makeWrapperArgs+=(
-      "''${gappsWrapperArgs[@]}"
-      "--prefix" "PATH" ":" "${lib.makeBinPath ([ p7zip lhasa mupdf ] ++ lib.optional (unrarSupport) unrar)}"
-    )
-  '';
-
-  # real pytests broken upstream
-  checkPhase = ''
-    $out/bin/comicthumb --help > /dev/null
-    $out/bin/${pname} --help > /dev/null
-  '';
-
-  meta = with lib; {
-    description = "Comic book reader and image viewer; python3 fork of mcomix";
-    longDescription = ''
-      User-friendly, customizable image viewer, specifically designed to handle
-      comic books and manga supporting a variety of container formats
-      (including CBR, CBZ, CB7, CBT, LHA and PDF)
-    '';
-    homepage = "https://github.com/multiSnow/mcomix3";
-    changelog = "https://github.com/multiSnow/mcomix3/blob/gtk3/ChangeLog";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ confus ];
-    platforms = platforms.all;
-  };
-}

pkgs/applications/graphics/swingsane/default.nix

@@ -55,6 +55,7 @@ stdenv.mkDerivation rec {
       crop, etc), PDF and PNG output.
     '';
     homepage = "http://swingsane.com/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.asl20;
     platforms = platforms.all;
   };

pkgs/applications/graphics/yed/default.nix

@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     license = licenses.unfree;
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     homepage = "https://www.yworks.com/products/yed";
     description = "A powerful desktop application that can be used to quickly and effectively generate high-quality diagrams";
     platforms = jre.meta.platforms;

pkgs/applications/graphics/zgrviewer/default.nix

@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
     # Quicker to unpack locally than load Hydra
     hydraPlatforms = [];
     maintainers = with lib.maintainers; [raskin];
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.lgpl21Plus;
     description = "GraphViz graph viewer/navigator";
     platforms = with lib.platforms; unix;

pkgs/applications/misc/HentaiAtHome/default.nix

@@ -31,6 +31,7 @@ buildGraalvmNativeImage rec {
     homepage = "https://ehwiki.org/wiki/Hentai@Home";
     description =
       "Hentai@Home is an open-source P2P gallery distribution system which reduces the load on the E-Hentai Galleries";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl3;
     maintainers = with maintainers; [ terrorjack ];
   };

pkgs/applications/misc/emem/default.nix

@@ -31,6 +31,7 @@ EOF
   meta = with lib; {
     homepage = "https://github.com/ebzzry/emem";
     description = "A trivial Markdown to HTML converter";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.epl10;
     maintainers = [ maintainers.ebzzry ];
     platforms = platforms.unix;

pkgs/applications/misc/gallery-dl/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonApplication rec {
   pname = "gallery_dl";
-  version = "1.22.0";
+  version = "1.22.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-7gslntYAjH2nSyVKjofC2utjpzQo3aNVD1w5StHk288=";
+    sha256 = "sha256-GBG42EH8Ux5ncLPo07rjyHyZnK8/+vd5BjACl4H+kwE=";
   };
 
   propagatedBuildInputs = [ requests yt-dlp ];

pkgs/applications/misc/gpsprune/default.nix

@@ -41,6 +41,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Application for viewing, editing and converting GPS coordinate data";
     homepage = "https://activityworkshop.net/software/gpsprune/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ rycee ];
     platforms = platforms.all;

pkgs/applications/misc/ipmiview/default.nix

@@ -72,6 +72,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.unfree;
     maintainers = with maintainers; [ vlaci ];
     platforms = [ "x86_64-linux" "i686-linux" ];

pkgs/applications/misc/josm/default.nix

@@ -46,6 +46,7 @@ stdenv.mkDerivation rec {
     description = "An extensible editor for OpenStreetMap";
     homepage = "https://josm.openstreetmap.de/";
     changelog = "https://josm.openstreetmap.de/wiki/Changelog";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ rycee sikmir ];
     platforms = platforms.all;

pkgs/applications/misc/jquake/default.nix

@@ -61,6 +61,7 @@ stdenv.mkDerivation rec {
     downloadPage = "https://jquake.net/?down";
     changelog = "https://jquake.net/?docu";
     maintainers = with maintainers; [ nessdoor ];
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.unfree;
     platforms = platforms.linux;
   };

pkgs/applications/misc/keepassx/community.nix

@@ -87,6 +87,11 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ asciidoctor cmake wrapGAppsHook wrapQtAppsHook qttools pkg-config ];
 
+  dontWrapGApps = true;
+  postFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
   buildInputs = [
     curl
     botan2

pkgs/applications/misc/keystore-explorer/default.nix

@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Open source GUI replacement for the Java command-line utilities keytool and jarsigner";
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.gpl3Only;
     maintainers = [ lib.maintainers.numinit ];
     platforms = lib.platforms.unix;

pkgs/applications/misc/mkgmap/default.nix

@@ -76,6 +76,10 @@ stdenv.mkDerivation rec {
     description = "Create maps for Garmin GPS devices from OpenStreetMap (OSM) data";
     homepage = "https://www.mkgmap.org.uk/";
     downloadPage = "https://www.mkgmap.org.uk/download/mkgmap.html";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode  # deps
+    ];
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ sikmir ];
     platforms = platforms.all;

pkgs/applications/misc/mkgmap/splitter/default.nix

@@ -72,6 +72,10 @@ stdenv.mkDerivation rec {
     description = "Utility for splitting OpenStreetMap maps into tiles";
     homepage = "https://www.mkgmap.org.uk/";
     downloadPage = "https://www.mkgmap.org.uk/download/splitter.html";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode  # deps
+    ];
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ sikmir ];
     platforms = platforms.all;

pkgs/applications/misc/mqtt-bench/default.nix

@@ -1,32 +0,0 @@
-{ lib, buildGoPackage, fetchFromGitHub, fetchpatch }:
-
-buildGoPackage rec {
-  pname = "mqtt-bench";
-  version = "0.3.0";
-  rev = "v${version}";
-
-  goPackagePath = "github.com/takanorig/mqtt-bench";
-
-  src = fetchFromGitHub {
-    inherit rev;
-    owner = "takanorig";
-    repo = "mqtt-bench";
-    sha256 = "03b9ak2j303iwq6abd7j10f2cs2ianwnbflwmyx9g96i7zd74f5m";
-  };
-
-  patches = [
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/takanorig/mqtt-bench/pull/13.patch";
-      name = "mqtt-paho-changes.patch";
-      sha256 = "17c8ajrp5dmbsasj6njxrlhy0x08b65fignzm3yccqbhb4ijcvha";
-    })
-  ];
-
-  goDeps = ./deps.nix;
-
-  meta = with lib; {
-    description = "Mosquitto benchmark tool";
-    homepage = "https://github.com/takanorig/mqtt-bench";
-    maintainers = with maintainers; [ disassembler ];
-  };
-}

pkgs/applications/misc/mqtt-bench/deps.nix

@@ -1,21 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/eclipse/paho.mqtt.golang";
-    fetch = {
-      type = "git";
-      url = "https://github.com/eclipse/paho.mqtt.golang";
-      rev = "65f43bda5f7edbbf6b7533d3a5a13b2c67cf3545";
-      sha256 = "1ad136xf78br599ya43j45f8dycjip1k0hkplayy1slg8ckwrhdr";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev = "8351a756f30f1297fe94bbf4b767ec589c6ea6d0";
-      sha256 = "0b6m579i3wrx1m69mqkdng5gjfssprxx0pg45kzrdi68sh0zr5d1";
-    };
-  }
-]

pkgs/applications/misc/omegat.nix

@@ -33,6 +33,7 @@ stdenv.mkDerivation {
       translation leveraging into updated projects.
     '';
     homepage = "http://www.omegat.org/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ t184256 ];
     platforms = [ "i686-linux" "x86_64-linux" ];

pkgs/applications/misc/prusa-slicer/default.nix

@@ -1,8 +1,22 @@
-{ stdenv, lib, fetchFromGitHub, cmake, copyDesktopItems, makeDesktopItem, pkg-config, wrapGAppsHook
-, boost, cereal, cgal_5, curl, dbus, eigen, expat, glew, glib, gmp, gtest, gtk3, hicolor-icon-theme
-, ilmbase, libpng, mpfr, nlopt, openvdb, pcre, qhull, systemd, tbb, wxGTK31-gtk3, xorg, fetchpatch
-}:
-stdenv.mkDerivation rec {
+{ stdenv, lib, fetchFromGitHub, cmake, copyDesktopItems, makeDesktopItem
+, pkg-config, wrapGAppsHook, boost, cereal, cgal_5, curl, dbus, eigen, expat
+, glew, glib, gmp, gtest, gtk3, hicolor-icon-theme, ilmbase, libpng, mpfr, nlopt
+, openvdb, pcre, qhull, systemd, tbb, wxGTK31-gtk3, xorg, fetchpatch
+, wxGTK31-gtk3-override ? null }:
+let
+  wxGTK31-gtk3-prusa = wxGTK31-gtk3.overrideAttrs (old: rec {
+    pname = "wxwidgets-prusa3d-patched";
+    version = "3.1.4";
+    src = fetchFromGitHub {
+      owner = "prusa3d";
+      repo = "wxWidgets";
+      rev = "489f6118256853cf5b299d595868641938566cdb";
+      hash = "sha256-xGL5I2+bPjmZGSTYe1L7VAmvLHbwd934o/cxg9baEvQ=";
+      fetchSubmodules = true;
+    };
+  });
+  wxGTK31-gtk3-override' = if wxGTK31-gtk3-override == null then wxGTK31-gtk3-prusa else wxGTK31-gtk3-override;
+in stdenv.mkDerivation rec {
   pname = "prusa-slicer";
   version = "2.4.2";
 
@@ -34,7 +48,7 @@ stdenv.mkDerivation rec {
     pcre
     systemd
     tbb
-    wxGTK31-gtk3
+    wxGTK31-gtk3-override'
     xorg.libX11
   ] ++ checkInputs;
 

pkgs/applications/misc/prusa-slicer/super-slicer.nix

@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, makeDesktopItem, prusa-slicer }:
+{ lib, fetchFromGitHub, makeDesktopItem, prusa-slicer, wxGTK31-gtk3 }:
 let
   appname = "SuperSlicer";
   pname = "super-slicer";
@@ -54,7 +54,7 @@ let
     passthru = allVersions;
 
   };
-
-  allVersions = builtins.mapAttrs (_name: version: (prusa-slicer.overrideAttrs (override version))) versions;
+  prusa-slicer' = prusa-slicer.override { wxGTK31-gtk3-override = wxGTK31-gtk3; };
+  allVersions = builtins.mapAttrs (_name: version: (prusa-slicer'.overrideAttrs (override version))) versions;
 in
 allVersions.stable

pkgs/applications/misc/tabula-java/default.nix

@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
       programmatically extract tables from PDFs.
     '';
     homepage = "https://tabula.technology/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.mit;
     maintainers = [ maintainers.jakewaksbaum ];
     platforms = platforms.all;

pkgs/applications/misc/tabula/default.nix

@@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
       Microsoft Excel spreadsheet using a simple, easy-to-use interface.
     '';
     homepage = "https://tabula.technology/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.mit;
     maintainers = [ maintainers.dpaetzel ];
     platforms = platforms.all;

pkgs/applications/misc/themechanger/default.nix

@@ -15,14 +15,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "themechanger";
-  version = "0.10.2";
+  version = "0.11.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "ALEX11BR";
     repo = "ThemeChanger";
     rev = "v${version}";
-    sha256 = "00z1npm3lpvf0wc9z2v58pc4nxxh8x9m158kxf1k0qlz536jrzqr";
+    sha256 = "sha256-umRkGPeNDZOmx6pjWLU9rRdHX6QFuHY/dsuQ8oI2YLI=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/tvbrowser/bin.nix

@@ -47,6 +47,7 @@ in stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Electronic TV Program Guide";
     homepage = "https://www.tvbrowser.org/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl3;
     platforms = platforms.linux;
     maintainers = with maintainers; [ jfrankenau ];

pkgs/applications/misc/vue/default.nix

@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
     description = "Visual Understanding Environment - mind mapping software";
     maintainers = with lib.maintainers; [ raskin ];
     platforms = with lib.platforms; linux;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.free; # Apache License fork, actually
   };
 }

pkgs/applications/misc/xmind/default.nix

@@ -85,6 +85,7 @@ stdenv.mkDerivation rec {
       and save to Evernote.
     '';
     homepage = "https://www.xmind.net/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.unfree;
     platforms = platforms.linux;
     maintainers = with maintainers; [ michalrus ];

pkgs/applications/networking/browsers/castor/default.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "castor";
-  version = "0.8.18";
+  version = "0.9.0";
 
   src = fetchFromSourcehut {
     owner = "~julienxx";
     repo = pname;
     rev = version;
-    sha256 = "sha256-sv6hiSTVFe3jxNuaM6Jyn7UeqFqUNmRvYtWfkJTJ4tA=";
+    sha256 = "sha256-yYLDbxmUR86fdpbHQQTiHVUbicnOD75cl3Vhofw5qr0=";
   };
 
-  cargoSha256 = "sha256-/IHxvTW9VYZmgjmDh0zJFDQqfw/H5CXVwEuLKq6Hnys=";
+  cargoSha256 = "sha256-AHhKfy2AAcDBcknzNb8DAzm51RQqFQDuWN+Hp5731Yk=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -19,9 +19,9 @@
     }
   },
   "beta": {
-    "version": "103.0.5060.24",
-    "sha256": "1vdnq7vd0jdxkpc00xwvvk1mmyq2hcydms64l16nv3v8jgvizrha",
-    "sha256bin64": "1rnjgb9v8dr74x0lj00xdkpvp2yx8d79h1kdzp7m7nvh4q34s32w",
+    "version": "103.0.5060.33",
+    "sha256": "00s9nwy5y2vik08snqxv1wbajllb7d81bryl5v4miyihjs511zjb",
+    "sha256bin64": "1l1fmfsl6ms4ps6sixp6chq3p6spik2fsvz5njvj1zf84p90mx4l",
     "deps": {
       "gn": {
         "version": "2022-05-11",

pkgs/applications/networking/browsers/dillo/default.nix

@@ -17,6 +17,11 @@ stdenv.mkDerivation rec {
   buildInputs = with lib;
   [ perl fltk openssl libjpeg libpng libXcursor libXi libXinerama ];
 
+  # Workaround build failure on -fno-common toolchains:
+  #   ld: main.o:/build/dillo-3.0.5/dpid/dpid.h:64: multiple definition of `sock_set';
+  #     dpid.o:/build/dillo-3.0.5/dpid/dpid.h:64: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
   configureFlags = [ "--enable-ssl" ];
 
   meta = with lib; {

pkgs/applications/networking/browsers/firefox/common.nix

@@ -328,7 +328,7 @@ buildStdenv.mkDerivation ({
     # please get your own set of keys at https://location.services.mozilla.com/api.
     echo "dfd7836c-d458-4917-98bb-421c82d3c8a0" > $TMPDIR/mls-api-key
     configureFlagsArray+=("--with-mozilla-api-keyfile=$TMPDIR/mls-api-key")
-  '' + lib.optionalString enableOfficialBranding ''
+  '' + lib.optionalString (enableOfficialBranding && !stdenv.is32bit) ''
     export MOZILLA_OFFICIAL=1
   '';
 

pkgs/applications/networking/charles/default.nix

@@ -57,6 +57,7 @@ let
         description = "Web Debugging Proxy";
         homepage = "https://www.charlesproxy.com/";
         maintainers = with maintainers; [ kalbasit ];
+        sourceProvenance = with sourceTypes; [ binaryBytecode ];
         license = licenses.unfree;
         platforms = platforms.unix;
       };

pkgs/applications/networking/cluster/argocd/default.nix

@@ -2,19 +2,19 @@
 
 buildGoModule rec {
   pname = "argocd";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-cd";
     rev = "v${version}";
-    sha256 = "sha256-ChgWqhkzVKhbyEA+g2flWK/WMxur7UHWXJUcLzp9RTE=";
+    sha256 = "sha256-pWDwmsLCXoK8EzipOPXUdYu75hPm5AIExXmgoA102Dg=";
   };
 
   vendorSha256 = "sha256-XrIIMnn65Y10KnVTsmw6vLE53Zra1lWNFgklmaj3gF8=";
 
-  # Set target as ./cmd per release-cli
-  # https://github.com/argoproj/argo-cd/blob/master/Makefile#L222
+  # Set target as ./cmd per cli-local
+  # https://github.com/argoproj/argo-cd/blob/master/Makefile#L227
   subPackages = [ "cmd" ];
 
   ldflags =
@@ -26,6 +26,11 @@ buildGoModule rec {
       "-X ${package_url}.gitCommit=${src.rev}"
       "-X ${package_url}.gitTag=${src.rev}"
       "-X ${package_url}.gitTreeState=clean"
+      "-X ${package_url}.kubectlVersion=v0.23.1"
+      # NOTE: Update kubectlVersion when upgrading this package with
+      # go list -m k8s.io/client-go | head -n 1 | rev | cut -d' ' -f1 | rev
+      # Per https://github.com/argoproj/argo-cd/blob/master/Makefile#L18
+      # Will need a way to automate it :P
     ];
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/applications/networking/cluster/hadoop/default.nix

@@ -65,6 +65,7 @@ let
         homepage = "https://hadoop.apache.org/";
         description = "Framework for distributed processing of large data sets across clusters of computers";
         license = licenses.asl20;
+        sourceProvenance = with sourceTypes; [ binaryBytecode ];
 
         longDescription = ''
           The Apache Hadoop software library is a framework that allows for

pkgs/applications/networking/cluster/spark/default.nix

@@ -64,6 +64,7 @@ let
       meta = {
         description = "Apache Spark is a fast and general engine for large-scale data processing";
         homepage = "https://spark.apache.org/";
+        sourceProvenance = with sourceTypes; [ binaryBytecode ];
         license = lib.licenses.asl20;
         platforms = lib.platforms.all;
         maintainers = with maintainers; [ thoughtpolice offline kamilchm illustris ];

pkgs/applications/networking/ids/zeek/default.nix

@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "zeek";
-  version = "4.2.1";
+  version = "4.2.2";
 
   src = fetchurl {
     url = "https://download.zeek.org/zeek-${version}.tar.gz";
-    sha256 = "sha256-axNImzBJTHxd2kU/xQmB5ZQ9ZxW2ybW3qFq7gLvm0RY=";
+    sha256 = "sha256-9Q3X24uAmnSnLUAklK+gC0Mu8eh81ZE2h/7uIVc8cAw=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/instant-messengers/jitsi/default.nix

@@ -65,6 +65,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://jitsi.org/";
     description = "Open Source Video Calls and Chat";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.lgpl21Plus;
     platforms = platforms.linux;
     maintainers = teams.jitsi.members;

pkgs/applications/networking/instant-messengers/signald/default.nix

@@ -103,6 +103,10 @@ in stdenv.mkDerivation rec {
       clients.
     '';
     homepage = "https://signald.org";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode  # deps
+    ];
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ expipiplus1 ma27 ];
     platforms = [ "x86_64-linux" "aarch64-linux" ];

pkgs/applications/networking/irc/ircdog/default.nix

@@ -1,14 +1,12 @@
 { lib
-, buildGoPackage
+, buildGoModule
 , fetchFromGitHub
 }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "ircdog";
   version = "0.3.0";
 
-  goPackagePath = "github.com/ergochat/ircdog";
-
   src = fetchFromGitHub {
     owner = "goshuirc";
     repo = pname;
@@ -16,6 +14,7 @@ buildGoPackage rec {
     sha256 = "sha256-x3ihWLgVYu17vG1xQTgIr4TSkeZ467TZBV1fPTPnZgw=";
     fetchSubmodules = true;
   };
+  vendorSha256 = null;
 
   meta = with lib; {
     description = "ircdog is a simple wrapper over the raw IRC protocol that can respond to pings, and interprets formatting codes";

pkgs/applications/networking/jnetmap/default.nix

@@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Graphical network monitoring and documentation tool";
     homepage = "http://www.rakudave.ch/jnetmap/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl3Plus;
     # Upstream supports macOS and Windows too.
     platforms = platforms.linux;

pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-ews";
-  version = "3.44.1";
+  version = "3.44.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "LJNidefwnQtOtWgMVb/4Xw2A0lU4R2Gm0Z3XfOaU/oM=";
+    sha256 = "xXPzlxA8FybyS+Tz+f0gzrvJtEW6CysOt8lI/YQVBho=";
   };
 
   nativeBuildInputs = [ cmake gettext intltool pkg-config ];

pkgs/applications/networking/mailreaders/msgviewer/default.nix

@@ -28,6 +28,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Viewer for .msg files (MS Outlook)";
     homepage    = "https://www.washington.edu/alpine/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license     = licenses.asl20;
     maintainers = with maintainers; [ peterhoeg ];
     platforms   = platforms.all;

pkgs/applications/networking/p2p/freenet/default.nix

@@ -73,6 +73,7 @@ in stdenv.mkDerivation {
   meta = {
     description = "Decentralised and censorship-resistant network";
     homepage = "https://freenetproject.org/";
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.gpl2Plus;
     maintainers = [ ];
     platforms = with lib.platforms; linux;

pkgs/applications/networking/p2p/frostwire/default.nix

@@ -87,6 +87,10 @@ in stdenv.mkDerivation {
   meta = with lib; {
     homepage = "https://www.frostwire.com/";
     description = "BitTorrent Client and Cloud File Downloader";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode  # deps
+    ];
     license = licenses.gpl2;
     maintainers = with maintainers; [ gavin ];
     platforms = [ "x86_64-darwin" "x86_64-linux" "i686-linux" ];

pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix

@@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.frostwire.com/";
     description = "BitTorrent Client and Cloud File Downloader";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ gavin ];
     platforms = [ "x86_64-linux"];

pkgs/applications/networking/soapui/default.nix

@@ -51,6 +51,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "The Most Advanced REST & SOAP Testing Tool in the World";
     homepage = "https://www.soapui.org/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = "SoapUI End User License Agreement";
     maintainers = with maintainers; [ gerschtli ];
     platforms = platforms.all;

pkgs/applications/office/atlassian-cli/default.nix

@@ -42,6 +42,7 @@ stdenv.mkDerivation rec {
     description = "An integrated family of CLI’s for various Atlassian applications";
     homepage = "https://bobswift.atlassian.net/wiki/spaces/ACLI/overview";
     license = licenses.unfreeRedistributable;
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     maintainers = with maintainers; [ twey ];
     inherit (jre.meta) platforms;
   };

pkgs/applications/office/ib/controller/default.nix

@@ -156,6 +156,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Automation Controller for the Trader Work Station of Interactive Brokers";
     homepage = "https://github.com/ib-controller/ib-controller";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl3;
     maintainers = [ maintainers.tstrobel ];
     platforms = platforms.linux;

pkgs/applications/office/ib/tws/default.nix

@@ -89,6 +89,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Trader Work Station of Interactive Brokers";
     homepage = "https://www.interactivebrokers.com";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.unfree;
     maintainers = [ maintainers.tstrobel ];
     platforms = platforms.linux;

pkgs/applications/office/jameica/default.nix

@@ -69,6 +69,10 @@ stdenv.mkDerivation rec {
       Runtime Environment for plugins like Hibiscus (HBCI Online Banking),
       SynTAX (accounting) and JVerein (club management).
     '';
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode  # source bundles dependencies as jars
+    ];
     license = licenses.gpl2Plus;
     platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" ];
     maintainers = with maintainers; [ flokli r3dl3g ];

pkgs/applications/office/libreoffice/default.nix

@@ -584,6 +584,8 @@ in
   meta = with lib; {
     description = "Comprehensive, professional-quality productivity suite, a variant of openoffice.org";
     homepage = "https://libreoffice.org/";
+    # at least one jar in dependencies
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.lgpl3;
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;

pkgs/applications/science/astronomy/astrolabe-generator/default.nix

@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
   meta = with lib;{
     homepage = "https://www.astrolabeproject.com";
     description = "A Java-based tool for generating EPS files for constructing astrolabes and related tools";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl3;
     maintainers = [ ];
     mainProgram = "AstrolabeGenerator";

pkgs/applications/science/astronomy/gprojector/default.nix

@@ -44,6 +44,7 @@ stdenvNoCC.mkDerivation rec {
   meta = {
     description = "G.Projector transforms an input map image into any of about 200 global and regional map projections";
     homepage = "https://www.giss.nasa.gov/tools/gprojector/";
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     maintainers = with lib.maintainers; [ alyaeanyx ];
     license = lib.licenses.unfree;
     inherit (jre.meta) platforms;

pkgs/applications/science/biology/astral/default.nix

@@ -50,6 +50,10 @@ stdenvNoCC.mkDerivation rec {
   meta = with lib; {
     homepage = "https://github.com/smirarab/ASTRAL";
     description = "Tool for estimating an unrooted species tree given a set of unrooted gene trees";
+    sourceProvenance = with sourceTypes; [
+      fromSource
+      binaryBytecode  # source bundles dependencies as jars
+    ];
     license = licenses.asl20;
     maintainers = with maintainers; [ bzizou ];
   };

pkgs/applications/science/biology/bftools/default.nix

@@ -33,6 +33,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A bundle of scripts for using Bio-Formats on the command line with bioformats_package.jar already included";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl2;
     platforms = platforms.all;
     homepage = "https://www.openmicroscopy.org/bio-formats/";

pkgs/applications/science/biology/macse/default.nix

@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Multiple alignment of coding sequences";
     homepage = "https://bioweb.supagro.inra.fr/macse/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.gpl2;
     maintainers = [ maintainers.bzizou ];
     platforms = platforms.all;

pkgs/applications/science/biology/picard-tools/default.nix

@@ -25,6 +25,7 @@ stdenv.mkDerivation rec {
     description = "Tools for high-throughput sequencing (HTS) data and formats such as SAM/BAM/CRAM and VCF";
     license = licenses.mit;
     homepage = "https://broadinstitute.github.io/picard/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     maintainers = with maintainers; [ jbedo ];
     mainProgram = "picard";
     platforms = platforms.all;

pkgs/applications/science/biology/snpeff/default.nix

@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
     description = "Genetic variant annotation and effect prediction toolbox";
     license = licenses.lgpl3;
     homepage = "http://snpeff.sourceforge.net/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     maintainers = with maintainers; [ jbedo ];
     platforms = platforms.all;
   };

pkgs/applications/science/biology/varscan/default.nix

@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
     # University School of Medicine.
     license = licenses.unfree;
     homepage = "https://github.com/dkoboldt/varscan";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     maintainers = with maintainers; [ jbedo ];
     platforms = platforms.all;
   };

pkgs/applications/science/chemistry/jmol/default.nix

@@ -54,6 +54,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
      description = "A Java 3D viewer for chemical structures";
      homepage = "https://sourceforge.net/projects/jmol";
+     sourceProvenance = with sourceTypes; [ binaryBytecode ];
      license = licenses.lgpl2;
      platforms = platforms.all;
      maintainers = with maintainers; [ mounium ] ++ teams.sage.members;

pkgs/applications/science/electronics/diylc/default.nix

@@ -70,6 +70,7 @@ stdenv.mkDerivation rec {
     homepage = "https://bancika.github.io/diy-layout-creator/";
     changelog = "https://github.com/bancika/diy-layout-creator/releases";
     license = licenses.gpl3Plus;
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     platforms = platforms.linux;
     maintainers = with maintainers; [ ];
   };

pkgs/applications/science/electronics/ngspice/default.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ngspice";
-  version = "36";
+  version = "37";
 
   src = fetchurl {
     url = "mirror://sourceforge/ngspice/ngspice-${version}.tar.gz";
-    sha256 = "sha256-T4GCh++6JFNBBGY1t1eugfh5VJsyakMWtfbml6pRf4w=";
+    sha256 = "1gpcic6b6xk3g4956jcsqljf33kj5g43cahmydq6m8rn39sadvlv";
   };
 
   nativeBuildInputs = [ flex bison ];

pkgs/applications/science/logic/alt-ergo/default.nix

@@ -1,4 +1,4 @@
-{ fetchFromGitHub, lib, which, ocamlPackages }:
+{ fetchFromGitHub, fetchpatch, lib, which, ocamlPackages }:
 
 let
   pname = "alt-ergo";
@@ -10,13 +10,11 @@ let
     rev = version;
     sha256 = "0hglj1p0753w2isds01h90knraxa42d2jghr35dpwf9g8a1sm9d3";
   };
-
-  useDune2 = true;
 in
 
 let alt-ergo-lib = ocamlPackages.buildDunePackage rec {
   pname = "alt-ergo-lib";
-  inherit version src useDune2;
+  inherit version src;
   configureFlags = [ pname ];
   nativeBuildInputs = [ which ];
   buildInputs = with ocamlPackages; [ dune-configurator ];
@@ -25,7 +23,7 @@ let alt-ergo-lib = ocamlPackages.buildDunePackage rec {
 
 let alt-ergo-parsers = ocamlPackages.buildDunePackage rec {
   pname = "alt-ergo-parsers";
-  inherit version src useDune2;
+  inherit version src;
   configureFlags = [ pname ];
   nativeBuildInputs = [ which ocamlPackages.menhir ];
   propagatedBuildInputs = [ alt-ergo-lib ] ++ (with ocamlPackages; [ camlzip psmt2-frontend ]);
@@ -33,7 +31,13 @@ let alt-ergo-parsers = ocamlPackages.buildDunePackage rec {
 
 ocamlPackages.buildDunePackage {
 
-  inherit pname version src useDune2;
+  inherit pname version src;
+
+  # Ensure compatibility with Menhir ≥ 20211215
+  patches = fetchpatch {
+    url = "https://github.com/OCamlPro/alt-ergo/commit/0f9c45af352657c3aec32fca63d11d44f5126df8.patch";
+    sha256 = "sha256:0zaj3xbk2s8k8jl0id3nrhdfq9mv0n378cbawwx3sziiizq7djbg";
+  };
 
   configureFlags = [ pname ];
 

pkgs/applications/science/logic/leo3/binary.nix

@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "An automated theorem prover for classical higher-order logic with choice";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.bsd3;
     maintainers = [maintainers.raskin];
     platforms = platforms.linux;