Merge staging-next into staging

nixos/modules/module-list.nix

@@ -177,7 +177,6 @@
   ./programs/tsm-client.nix
   ./programs/udevil.nix
   ./programs/usbtop.nix
-  ./programs/venus.nix
   ./programs/vim.nix
   ./programs/wavemon.nix
   ./programs/waybar.nix

nixos/modules/programs/venus.nix

@@ -1,173 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-let
-  cfg = config.services.venus;
-
-  configFile = pkgs.writeText "venus.ini"
-    ''
-      [Planet]
-      name = ${cfg.name}
-      link = ${cfg.link}
-      owner_name = ${cfg.ownerName}
-      owner_email = ${cfg.ownerEmail}
-      output_theme = ${cfg.cacheDirectory}/theme
-      output_dir = ${cfg.outputDirectory}
-      cache_directory = ${cfg.cacheDirectory}
-      items_per_page = ${toString cfg.itemsPerPage}
-      ${(concatStringsSep "\n\n"
-            (map ({ name, feedUrl, homepageUrl }:
-            ''
-              [${feedUrl}]
-              name = ${name}
-              link = ${homepageUrl}
-            '') cfg.feeds))}
-    '';
-
-in
-{
-
-  options = {
-    services.venus = {
-      enable = mkOption {
-        default = false;
-        type = types.bool;
-        description = ''
-          Planet Venus is an awesome ‘river of news’ feed reader. It downloads
-          news feeds published by web sites and aggregates their content
-          together into a single combined feed, latest news first.
-        '';
-      };
-
-      dates = mkOption {
-        default = "*:0/15";
-        type = types.str;
-        description = ''
-          Specification (in the format described by
-          <citerefentry><refentrytitle>systemd.time</refentrytitle>
-          <manvolnum>7</manvolnum></citerefentry>) of the time at
-          which the Venus will collect feeds.
-        '';
-      };
-
-      user = mkOption {
-        default = "root";
-        type = types.str;
-        description = ''
-          User for running venus script.
-        '';
-      };
-
-      group = mkOption {
-        default = "root";
-        type = types.str;
-        description = ''
-          Group for running venus script.
-        '';
-      };
-
-      name = mkOption {
-        default = "NixOS Planet";
-        type = types.str;
-        description = ''
-          Your planet's name.
-        '';
-      };
-
-      link = mkOption {
-        default = "https://planet.nixos.org";
-        type = types.str;
-        description = ''
-          Link to the main page.
-        '';
-      };
-
-      ownerName = mkOption {
-        default = "Rok Garbas";
-        type = types.str;
-        description = ''
-          Your name.
-        '';
-      };
-
-      ownerEmail = mkOption {
-        default = "some@example.com";
-        type = types.str;
-        description = ''
-          Your e-mail address.
-        '';
-      };
-
-      outputTheme = mkOption {
-        default = "${pkgs.venus}/themes/classic_fancy";
-        type = types.path;
-        description = ''
-          Directory containing a config.ini file which is merged with this one.
-          This is typically used to specify templating and bill of material
-          information.
-        '';
-      };
-
-      outputDirectory = mkOption {
-        type = types.path;
-        description = ''
-          Directory to place output files.
-        '';
-      };
-
-      cacheDirectory = mkOption {
-        default = "/var/cache/venus";
-        type = types.path;
-        description = ''
-            Where cached feeds are stored.
-        '';
-      };
-
-      itemsPerPage = mkOption {
-        default = 15;
-        type = types.int;
-        description = ''
-          How many items to put on each page.
-        '';
-      };
-
-      feeds = mkOption {
-        default = [];
-        example = [
-          {
-            name = "Rok Garbas";
-            feedUrl= "http://url/to/rss/feed.xml";
-            homepageUrl = "http://garbas.si";
-          }
-        ];
-        description = ''
-          List of feeds.
-        '';
-      };
-
-    };
-  };
-
-  config = mkIf cfg.enable {
-
-    system.activationScripts.venus =
-      ''
-        mkdir -p ${cfg.outputDirectory}
-        chown ${cfg.user}:${cfg.group} ${cfg.outputDirectory} -R
-        rm -rf ${cfg.cacheDirectory}/theme
-        mkdir -p ${cfg.cacheDirectory}/theme
-        cp -R ${cfg.outputTheme}/* ${cfg.cacheDirectory}/theme
-        chown ${cfg.user}:${cfg.group} ${cfg.cacheDirectory} -R
-      '';
-
-    systemd.services.venus =
-      { description = "Planet Venus Feed Reader";
-        path  = [ pkgs.venus ];
-        script = "exec venus-planet ${configFile}";
-        serviceConfig.User = "${cfg.user}";
-        serviceConfig.Group = "${cfg.group}";
-        startAt = cfg.dates;
-      };
-
-  };
-}

nixos/modules/rename.nix

@@ -70,6 +70,7 @@ with lib;
     '')
 
     (mkRemovedOptionModule [ "services" "seeks" ] "")
+    (mkRemovedOptionModule [ "services" "venus" ] "The corresponding package was removed from nixpkgs.")
 
     # Do NOT add any option renames here, see top of the file
   ];

nixos/modules/virtualisation/cri-o.nix

@@ -103,7 +103,10 @@ in
       cgroup_manager = "systemd"
       log_level = "${cfg.logLevel}"
       pinns_path = "${cfg.package}/bin/pinns"
-      hooks_dir = []
+      hooks_dir = [
+      ${lib.optionalString config.virtualisation.containers.ociSeccompBpfHook.enable
+        ''"${config.boot.kernelPackages.oci-seccomp-bpf-hook}",''}
+      ]
 
       ${optionalString (cfg.runtime != null) ''
       default_runtime = "${cfg.runtime}"

nixos/modules/virtualisation/nixos-containers.nix

@@ -463,21 +463,15 @@ in
         { config, options, name, ... }:
         {
           options = {
-
             config = mkOption {
               description = ''
                 A specification of the desired configuration of this
                 container, as a NixOS module.
               '';
-              type = let
+              type = lib.mkOptionType {
-                confPkgs = if config.pkgs == null then pkgs else config.pkgs;
-              in lib.mkOptionType {
                 name = "Toplevel NixOS config";
-                merge = loc: defs: (import (confPkgs.path + "/nixos/lib/eval-config.nix") {
+                merge = loc: defs: (import "${toString config.nixpkgs}/nixos/lib/eval-config.nix" {
                   inherit system;
-                  pkgs = confPkgs;
-                  baseModules = import (confPkgs.path + "/nixos/modules/module-list.nix");
-                  inherit (confPkgs) lib;
                   modules =
                     let
                       extraConfig = {
@@ -526,12 +520,18 @@ in
               '';
             };
 
-            pkgs = mkOption {
+            nixpkgs = mkOption {
-              type = types.nullOr types.attrs;
+              type = types.path;
-              default = null;
+              default = pkgs.path;
-              example = literalExample "pkgs";
+              defaultText = "pkgs.path";
               description = ''
-                Customise which nixpkgs to use for this container.
+                A path to the nixpkgs that provide the modules, pkgs and lib for evaluating the container.
+
+                To only change the <literal>pkgs</literal> argument used inside the container modules,
+                set the <literal>nixpkgs.*</literal> options in the container <option>config</option>.
+                Setting <literal>config.nixpkgs.pkgs = pkgs</literal> speeds up the container evaluation
+                by reusing the system pkgs, but the <literal>nixpkgs.config</literal> option in the
+                container config is ignored in this case.
               '';
             };
 
@@ -672,14 +672,31 @@ in
               '';
             };
 
+            # Removed option. See `checkAssertion` below for the accompanying error message.
+            pkgs = mkOption { visible = false; };
           } // networkOptions;
 
-          config = mkMerge
+          config = let
-            [
+            # Throw an error when removed option `pkgs` is used.
-              (mkIf options.config.isDefined {
+            # Because this is a submodule we cannot use `mkRemovedOptionModule` or option `assertions`.
-                path = config.config.system.build.toplevel;
+            optionPath = "containers.${name}.pkgs";
-              })
+            files = showFiles options.pkgs.files;
-            ];
+            checkAssertion = if options.pkgs.isDefined then throw ''
+              The option definition `${optionPath}' in ${files} no longer has any effect; please remove it.
+
+              Alternatively, you can use the following options:
+              - containers.${name}.nixpkgs
+                This sets the nixpkgs (and thereby the modules, pkgs and lib) that
+                are used for evaluating the container.
+
+              - containers.${name}.config.nixpkgs.pkgs
+                This only sets the `pkgs` argument used inside the container modules.
+            ''
+            else null;
+          in {
+            path = builtins.seq checkAssertion
+              mkIf options.config.isDefined config.config.system.build.toplevel;
+          };
         }));
 
       default = {};

nixos/tests/containers-custom-pkgs.nix

@@ -1,42 +1,34 @@
-# Test for NixOS' container support.
-
 import ./make-test-python.nix ({ pkgs, lib, ...} : let
 
-  customPkgs = pkgs // {
+  customPkgs = pkgs.appendOverlays [ (self: super: {
-    hello = pkgs.hello.overrideAttrs(old: {
+    hello = super.hello.overrideAttrs (old: {
-      name = "custom-hello";
+       name = "custom-hello";
     });
-  };
+  }) ];
 
 in {
-  name = "containers-hosts";
+  name = "containers-custom-pkgs";
   meta = with lib.maintainers; {
-    maintainers = [ adisbladis ];
+    maintainers = [ adisbladis earvstedt ];
   };
 
-  machine =
+  machine = { config, ... }: {
-    { ... }:
+    assertions = let
-    {
+      helloName = (builtins.head config.containers.test.config.system.extraDependencies).name;
-      virtualisation.memorySize = 256;
+    in [ {
-      virtualisation.vlans = [];
+      assertion = helloName == "custom-hello";
+      message = "Unexpected value: ${helloName}";
+    } ];
 
-      containers.simple = {
+    containers.test = {
-        autoStart = true;
+      autoStart = true;
-        pkgs = customPkgs;
+      config = { pkgs, config, ... }: {
-        config = {pkgs, config, ... }: {
+        nixpkgs.pkgs = customPkgs;
-          environment.systemPackages = [
+        system.extraDependencies = [ pkgs.hello ];
-            pkgs.hello
-          ];
-        };
       };
-
     };
+  };
 
-  testScript = ''
+  # This test only consists of evaluating the test machine
-    start_all()
+  testScript = "";
-    machine.wait_for_unit("default.target")
-    machine.succeed(
-        "test $(nixos-container run simple -- readlink -f /run/current-system/sw/bin/hello) = ${customPkgs.hello}/bin/hello"
-    )
-  '';
 })

pkgs/applications/editors/ht/default.nix

@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
 
   patches = [ ./gcc7.patch ];
 
+  NIX_CFLAGS_COMPILE = [ "-Wno-narrowing" ];
+
   meta = with lib; {
     description = "File editor/viewer/analyzer for executables";
     homepage = "http://hte.sourceforge.net";

pkgs/applications/networking/browsers/chromium/common.nix

@@ -19,13 +19,12 @@
 , jre8
 , pipewire_0_2
 , libva
+, libdrm, wayland, mesa, libxkbcommon # Ozone
 
 # optional dependencies
 , libgcrypt ? null # gnomeSupport || cupsSupport
-, libdrm ? null, wayland ? null, mesa ? null, libxkbcommon ? null # useOzone
 
 # package customization
-, useOzone ? true
 , gnomeSupport ? false, gnome ? null
 , gnomeKeyringSupport ? false, libgnome-keyring3 ? null
 , proprietaryCodecs ? true
@@ -143,11 +142,11 @@ let
       jre
       pipewire_0_2
       libva
+      libdrm wayland mesa.drivers libxkbcommon
     ] ++ optional gnomeKeyringSupport libgnome-keyring3
       ++ optionals gnomeSupport [ gnome.GConf libgcrypt ]
       ++ optionals cupsSupport [ libgcrypt cups ]
-      ++ optional pulseSupport libpulseaudio
+      ++ optional pulseSupport libpulseaudio;
-      ++ optionals useOzone [ libdrm wayland mesa.drivers libxkbcommon ];
 
     patches = [
       ./patches/no-build-timestamps.patch # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed)
@@ -226,11 +225,11 @@ let
     '';
 
     gnFlags = mkGnFlags ({
+      is_official_build = true;
       custom_toolchain = "//build/toolchain/linux/unbundle:default";
       host_toolchain = "//build/toolchain/linux/unbundle:default";
-      is_official_build = true;
+      system_wayland_scanner_path = "${wayland}/bin/wayland-scanner";
 
-      use_vaapi = !stdenv.isAarch64; # TODO: Remove once M88 is released
       use_sysroot = false;
       use_gnome_keyring = gnomeKeyringSupport;
       use_gio = gnomeSupport;
@@ -266,15 +265,6 @@ let
     } // optionalAttrs pulseSupport {
       use_pulseaudio = true;
       link_pulseaudio = true;
-    } // optionalAttrs useOzone {
-      use_ozone = true;
-      use_xkbcommon = true;
-      use_glib = true;
-      use_gtk = true;
-      use_system_libwayland = true;
-      use_system_minigbm = true;
-      use_system_libdrm = true;
-      system_wayland_scanner_path = "${wayland}/bin/wayland-scanner";
     } // optionalAttrs (chromiumVersionAtLeast "89") {
       # Disable PGO (defaults to 2 since M89) because it fails without additional changes:
       # error: Could not read profile ../../chrome/build/pgo_profiles/chrome-linux-master-1610647094-405a32bcf15e5a84949640f99f84a5b9f61e2f2e.profdata: Unsupported instrumentation profile format version

pkgs/applications/networking/cluster/cni/plugins.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cni-plugins";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "containernetworking";
     repo = "plugins";
     rev = "v${version}";
-    sha256 = "1nkaspz96yglq1fr8a3xr39qmbs98pk7qpqav3cfd82qwbq7vs06";
+    sha256 = "sha256-n+OtFXgFmW0xsGEtC6ua0qjdsJSbEjn08mAl5Z51Kp8=";
   };
 
   vendorSha256 = null;

pkgs/applications/version-management/git-and-tools/delta/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "delta";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "dandavison";
     repo = pname;
     rev = version;
-    sha256 = "17cmwkha25hwsvnjcp388zd9kwacfq7adjp0sjw59y0vyr1maf22";
+    sha256 = "sha256-cEVYU7vMgVxVIKztL6LHcvQjrNRRMrB5XMP/7gPCr5A=";
   };
 
-  cargoSha256 = "1bji818cmkl0286a4qcnfiwibnqd5q5fvzmzgk5cabrdwaag2ia5";
+  cargoSha256 = "sha256-iD3Cr1vo0FNyWvAN5m6ND+8sGyekgbkYmIxGTJkPEYE=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/development/ocaml-modules/lwt_ssl/default.nix

@@ -5,6 +5,7 @@ buildDunePackage rec {
   version = "1.1.3";
 
   minimumOCamlVersion = "4.02";
+  useDune2 = true;
 
   src = fetchzip {
     url = "https://github.com/aantron/${pname}/archive/${version}.tar.gz";

pkgs/development/ocaml-modules/ssl/default.nix

@@ -1,17 +1,20 @@
-{ lib, buildDunePackage, fetchFromGitHub, pkg-config, openssl }:
+{ lib, buildDunePackage, fetchFromGitHub, pkg-config, openssl
+, dune-configurator }:
 
 buildDunePackage rec {
   pname = "ssl";
-  version = "0.5.9";
+  version = "0.5.10";
 
   src = fetchFromGitHub {
     owner = "savonet";
     repo = "ocaml-ssl";
-    rev = version;
+    rev = "v${version}";
-    sha256 = "04h02rvzrwp886n5hsx84rnc9b150iggy38g5v1x1rwz3pkdnmf0";
+    sha256 = "1rszqiqayh67xlwd5411k8vib47x9kapdr037z1majd2c14z3kcb";
   };
 
+  useDune2 = true;
   nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [openssl];
 
   meta = {
@@ -20,6 +23,7 @@ buildDunePackage rec {
     license = "LGPL+link exception";
     maintainers = [
       lib.maintainers.maggesi
+      lib.maintainers.anmonteiro
     ];
   };
 }

pkgs/development/php-packages/phpstan/default.nix

@@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, pkgs, lib, php }:
 let
   pname = "phpstan";
-  version = "0.12.70";
+  version = "0.12.71";
 in
 mkDerivation {
   inherit pname version;
 
   src = pkgs.fetchurl {
     url = "https://github.com/phpstan/phpstan/releases/download/${version}/phpstan.phar";
-    sha256 = "sha256-bQvLGrDUh66lipmML1VwrdNKkI6NezBckdlOqnDe7Qk=";
+    sha256 = "sha256-VSA/37LTawwIL1qdyp35auml7we3xDdrZN21/V3BWlM=";
   };
 
   phases = [ "installPhase" ];

pkgs/development/php-packages/redis/default.nix

@@ -3,8 +3,8 @@
 buildPecl {
   pname = "redis";
 
-  version = "5.3.2";
+  version = "5.3.3";
-  sha256 = "1cfsbxf3q3im0cmalgk76jpz581zr92z03c1viy93jxb53k2vsgl";
+  sha256 = "sha256-N3iRYeFkzVIjmjDJojjaYf7FyDlc2sOFtu2PDFD9kvA=";
 
   internalDeps = with php.extensions; [
     session

pkgs/development/python-modules/casbin/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "casbin";
-  version = "0.16.1";
+  version = "0.16.2";
 
   disabled = isPy27;
 
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "pycasbin";
     rev = "v${version}";
-    sha256 = "1bjrg0ig40rjk5x65x7ac9xsl332r0ypqgrqjdivb5dvplifnw36";
+    sha256 = "0jan4xikyi1p92rsir8camc6ify81wnd9l57v1pgmjf5fgb5r2w8";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/django/3.nix

@@ -13,13 +13,13 @@
 
 buildPythonPackage rec {
   pname = "Django";
-  version = "3.1.5";
+  version = "3.1.6";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2d78425ba74c7a1a74b196058b261b9733a8570782f4e2828974777ccca7edf7";
+    sha256 = "c6c0462b8b361f8691171af1fb87eceb4442da28477e12200c40420176206ba7";
   };
 
   patches = lib.optional withGdal

pkgs/development/python-modules/flask-paginate/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "flask-paginate";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "60b2a696bf63d2bc1c90a5b1a861c280461732b88f079c267dc98021911a007b";
+    sha256 = "31133c29c718aed95276425f7795d0a32b8d45a992ddd359c69600f22f869254";
   };
 
   propagatedBuildInputs = [ flask ];

pkgs/os-specific/linux/fuse/default.nix

@@ -11,7 +11,7 @@ in {
   };
 
   fuse_3 = mkFuse {
-    version = "3.10.1";
+    version = "3.10.2";
-    sha256Hash = "0bb22mac8m0z6qp0s6g4r0x4aj6gc19pfyqr6sdy4hkpwxicgmaf";
+    sha256Hash = "0m44hhk6jxkgkvk2jsjcwa3pqgzzqnpm606n3n8wn1ldypkvpsps";
   };
 }

pkgs/tools/misc/venus/default.nix

@@ -1,53 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, python, pythonPackages, libxslt, libxml2, makeWrapper }:
-
-stdenv.mkDerivation rec {
-  pname = "venus";
-  version = "unstable-2011-02-18";
-
-  src = fetchFromGitHub {
-    owner = "rubys";
-    repo = "venus";
-    rev = "9de21094a8cf565bdfcf75688e121a5ad1f5397b";
-    sha256 = "10yyx4jaxxbwhica12aiw119aywghcr7b24gs9lrmafpa6xd3an2";
-  };
-
-  preConfigure = ''
-    substituteInPlace tests/test_spider.py \
-        --replace "urllib.urlopen('http://127.0.0.1:%d/' % _PORT).read()" "" \
-        --replace "[200,200,200,200,404]" "[200,200,200,404]"
-    substituteInPlace planet.py \
-        --replace "#!/usr/bin/env python" "#!${python}/bin/python"
-    substituteInPlace tests/test_apply.py \
-        --replace "'xsltproc" "'${libxslt.bin}/bin/xsltproc"
-    substituteInPlace planet/shell/xslt.py \
-        --replace "'xsltproc" "'${libxslt.bin}/bin/xsltproc"
-  '';
-
-  doCheck = true;
-  checkPhase = "python runtests.py";
-
-  buildInputs = [ python libxslt
-    libxml2 pythonPackages.genshi pythonPackages.lxml makeWrapper ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp -R ./* $out/
-    ln -s $out/planet.py $out/bin/venus-planet
-    wrapProgram $out/planet.py \
-        --prefix PYTHONPATH : $PYTHONPATH:${pythonPackages.lxml}/lib/${python.libPrefix}/site-packages:${pythonPackages.genshi}/lib/${python.libPrefix}/site-packages
-    python runtests.py
-  '';
-
-  meta = {
-    description = "News feed reader";
-    longDescription = ''
-      Planet Venus is an awesome ‘river of news’ feed reader. It downloads news
-      feeds published by web sites and aggregates their content together into a
-      single combined feed, latest news first.
-    '';
-    homepage = "http://intertwingly.net/code/venus/docs/index.html";
-    license = lib.licenses.psfl;
-    platforms = lib.platforms.all;
-    maintainers = [];
-  };
-}

pkgs/tools/networking/nebula/default.nix

@@ -17,7 +17,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/nebula" "cmd/nebula-cert" ];
 
-  buildFlagsArray = [ "-ldflags='-X main.Build=${version}'" ];
+  buildFlagsArray = [ "-ldflags=" "-X main.Build=${version}" ];
 
   meta = with lib; {
     description = "A scalable overlay networking tool with a focus on performance, simplicity and security";

pkgs/top-level/aliases.nix

@@ -717,6 +717,7 @@ mapAliases ({
   v8_3_16_14 = throw "v8_3_16_14 was removed in 2019-11-01: no longer referenced by other packages";
   valadoc = throw "valadoc was deprecated on 2019-10-10: valadoc was merged into vala 0.38";
   vamp = { vampSDK = vamp-plugin-sdk; }; # added 2020-03-26
+  venus = throw "venus has been removed from nixpkgs, as it's unmaintained"; # added 2021-02-05
   vdirsyncerStable  = vdirsyncer; # added 2020-11-08, see https://github.com/NixOS/nixpkgs/issues/103026#issuecomment-723428168
   vimbWrapper = vimb; # added 2015-01
   vimprobable2 = throw "vimprobable2 has been removed from nixpkgs. It relied on webkitgtk24x that has been removed."; # added 2019-12-05

pkgs/top-level/all-packages.nix

@@ -8972,10 +8972,6 @@ in
 
   hitch = callPackage ../servers/hitch { };
 
-  venus = callPackage ../tools/misc/venus {
-    python = python27;
-  };
-
   veracrypt = callPackage ../applications/misc/veracrypt {
     wxGTK = wxGTK30;
   };