Merge branch 'master' into staging-next

maintainers/maintainer-list.nix

@@ -3431,6 +3431,12 @@
     githubId = 2129135;
     name = "Frederik Rietdijk";
   };
+  friedelino = {
+    email = "friede.mann@posteo.de";
+    github = "friedelino";
+    githubId = 46672819;
+    name = "Frido Friedemann";
+  };
   frlan = {
     email = "frank@frank.uvena.de";
     github = "frlan";

nixos/doc/manual/development/settings-options.xml

@@ -167,7 +167,7 @@ in {
 
     # We know that the `user` attribute exists because we set a default value
     # for it above, allowing us to use it without worries here
-    users.users.${cfg.settings.user} = {};
+    users.users.${cfg.settings.user} = { isSystemUser = true; };
 
     # ...
   };

nixos/doc/manual/release-notes/rl-2105.xml

@@ -845,6 +845,13 @@ environment.systemPackages = [
      The option's description was incorrect regarding ownership management and has been simplified greatly.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      When defining a new user, one of <xref linkend="opt-users.users._name_.isNormalUser" /> and <xref linkend="opt-users.users._name_.isSystemUser" /> is now required.
+      This is to prevent accidentally giving a UID above 1000 to system users, which could have unexpected consequences, like running user activation scripts for system users.
+      Note that users defined with an explicit UID below 500 are exempted from this check, as <xref linkend="opt-users.users._name_.isSystemUser" /> has no effect for those.
+    </para>
+   </listitem>
    <listitem>
      <para>
        The GNOME desktop manager once again installs <package>gnome3.epiphany</package> by default.

nixos/modules/config/pulseaudio.nix

@@ -306,6 +306,7 @@ in {
         description = "PulseAudio system service user";
         home = stateDir;
         createHome = true;
+        isSystemUser = true;
       };
 
       users.groups.pulse.gid = gid;

nixos/modules/config/users-groups.nix

@@ -92,6 +92,8 @@ let
           the user's UID is allocated in the range for system users
           (below 500) or in the range for normal users (starting at
           1000).
+          Exactly one of <literal>isNormalUser</literal> and
+          <literal>isSystemUser</literal> must be true.
         '';
       };
 
@@ -107,6 +109,8 @@ let
           <option>useDefaultShell</option> to <literal>true</literal>,
           and <option>isSystemUser</option> to
           <literal>false</literal>.
+          Exactly one of <literal>isNormalUser</literal> and
+          <literal>isSystemUser</literal> must be true.
         '';
       };
 
@@ -521,6 +525,7 @@ in {
       };
       nobody = {
         uid = ids.uids.nobody;
+        isSystemUser = true;
         description = "Unprivileged account (don't use!)";
         group = "nogroup";
       };
@@ -608,7 +613,8 @@ in {
           Neither the root account nor any wheel user has a password or SSH authorized key.
           You must set one to prevent being locked out of your system.'';
       }
-    ] ++ flip mapAttrsToList cfg.users (name: user:
+    ] ++ flatten (flip mapAttrsToList cfg.users (name: user:
+      [
         {
         assertion = (user.hashedPassword != null)
         -> (builtins.match ".*:.*" user.hashedPassword == null);
@@ -618,7 +624,17 @@ in {
             of /etc/shadow (file where hashes are stored) are colon-separated.
             Please check the value of option `users.users."${user.name}".hashedPassword`.'';
           }
-    );
+          {
+            assertion = let
+              xor = a: b: a && !b || b && !a;
+              isEffectivelySystemUser = user.isSystemUser || (user.uid != null && user.uid < 500);
+            in xor isEffectivelySystemUser user.isNormalUser;
+            message = ''
+              Exactly one of users.users.${user.name}.isSystemUser and users.users.${user.name}.isNormalUser must be set.
+            '';
+          }
+        ]
+    ));
 
     warnings =
       builtins.filter (x: x != null) (

nixos/modules/services/backup/borgbackup.nix

@@ -169,6 +169,7 @@ let
         (map (mkAuthorizedKey cfg false) cfg.authorizedKeys
         ++ map (mkAuthorizedKey cfg true) cfg.authorizedKeysAppendOnly);
       useDefaultShell = true;
+      isSystemUser = true;
     };
     groups.${cfg.group} = { };
   };

nixos/modules/services/databases/pgmanage.nix

@@ -197,6 +197,7 @@ in {
         group = pgmanage;
         home  = cfg.sqlRoot;
         createHome = true;
+        isSystemUser = true;
       };
       groups.${pgmanage} = {
         name = pgmanage;

nixos/modules/services/misc/bazarr.nix

@@ -64,6 +64,7 @@ in
 
     users.users = mkIf (cfg.user == "bazarr") {
       bazarr = {
+        isSystemUser = true;
         group = cfg.group;
         home = "/var/lib/${config.systemd.services.bazarr.serviceConfig.StateDirectory}";
       };

nixos/modules/services/misc/nix-daemon.nix

@@ -21,6 +21,7 @@ let
          calls in `libstore/build.cc', don't add any supplementary group
          here except "nixbld".  */
       uid = builtins.add config.ids.uids.nixbld nr;
+      isSystemUser = true;
       group = "nixbld";
       extraGroups = [ "nixbld" ];
     };

nixos/modules/services/monitoring/tuptime.nix

@@ -34,7 +34,10 @@ in {
 
     users = {
       groups._tuptime.members = [ "_tuptime" ];
-      users._tuptime.description = "tuptime database owner";
+      users._tuptime = {
+        isSystemUser = true;
+        description = "tuptime database owner";
+      };
     };
 
     systemd = {

nixos/modules/services/networking/bird.nix

@@ -73,6 +73,7 @@ let
           users.${variant} = {
             description = "BIRD Internet Routing Daemon user";
             group = variant;
+            isSystemUser = true;
           };
           groups.${variant} = {};
         };

nixos/modules/services/networking/ncdns.nix

@@ -243,8 +243,10 @@ in
         xlog.journal = true;
     };
 
-    users.users.ncdns =
+    users.users.ncdns = {
-      { description = "ncdns daemon user"; };
+      isSystemUser = true;
+      description = "ncdns daemon user";
+    };
 
     systemd.services.ncdns = {
       description = "ncdns daemon";

nixos/modules/services/networking/pixiecore.nix

@@ -93,6 +93,7 @@ in
     users.users.pixiecore = {
       description = "Pixiecore daemon user";
       group = "pixiecore";
+      isSystemUser = true;
     };
 
     networking.firewall = mkIf cfg.openFirewall {

nixos/modules/services/networking/pleroma.nix

@@ -75,6 +75,7 @@ in {
         description = "Pleroma user";
         home = cfg.stateDir;
         extraGroups = [ cfg.group ];
+        isSystemUser = true;
       };
       groups."${cfg.group}" = {};
     };

nixos/modules/services/security/privacyidea.nix

@@ -264,6 +264,7 @@ in
 
       users.users.privacyidea = mkIf (cfg.user == "privacyidea") {
         group = cfg.group;
+        isSystemUser = true;
       };
 
       users.groups.privacyidea = mkIf (cfg.group == "privacyidea") {};
@@ -294,6 +295,7 @@ in
 
       users.users.pi-ldap-proxy = mkIf (cfg.ldap-proxy.user == "pi-ldap-proxy") {
         group = cfg.ldap-proxy.group;
+        isSystemUser = true;
       };
 
       users.groups.pi-ldap-proxy = mkIf (cfg.ldap-proxy.group == "pi-ldap-proxy") {};

nixos/modules/services/web-apps/nextcloud.nix

@@ -607,6 +607,7 @@ in {
         home = "${cfg.home}";
         group = "nextcloud";
         createHome = true;
+        isSystemUser = true;
       };
       users.groups.nextcloud.members = [ "nextcloud" config.services.nginx.user ];
 

nixos/tests/mysql/mariadb-galera-mariabackup.nix

@@ -31,7 +31,7 @@ in {
         firewall.allowedTCPPorts = [ 3306 4444 4567 4568 ];
         firewall.allowedUDPPorts = [ 4567 ];
       };
-      users.users.testuser = { };
+      users.users.testuser = { isSystemUser = true; };
       systemd.services.mysql = with pkgs; {
         path = [ mysqlenv-common mysqlenv-mariabackup ];
       };
@@ -89,7 +89,7 @@ in {
         firewall.allowedTCPPorts = [ 3306 4444 4567 4568 ];
         firewall.allowedUDPPorts = [ 4567 ];
       };
-      users.users.testuser = { };
+      users.users.testuser = { isSystemUser = true; };
       systemd.services.mysql = with pkgs; {
         path = [ mysqlenv-common mysqlenv-mariabackup ];
       };
@@ -136,7 +136,7 @@ in {
         firewall.allowedTCPPorts = [ 3306 4444 4567 4568 ];
         firewall.allowedUDPPorts = [ 4567 ];
       };
-      users.users.testuser = { };
+      users.users.testuser = { isSystemUser = true; };
       systemd.services.mysql = with pkgs; {
         path = [ mysqlenv-common mysqlenv-mariabackup ];
       };

nixos/tests/mysql/mariadb-galera-rsync.nix

@@ -31,7 +31,7 @@ in {
         firewall.allowedTCPPorts = [ 3306 4444 4567 4568 ];
         firewall.allowedUDPPorts = [ 4567 ];
       };
-      users.users.testuser = { };
+      users.users.testuser = { isSystemUser = true; };
       systemd.services.mysql = with pkgs; {
         path = [ mysqlenv-common mysqlenv-rsync ];
       };
@@ -84,7 +84,7 @@ in {
         firewall.allowedTCPPorts = [ 3306 4444 4567 4568 ];
         firewall.allowedUDPPorts = [ 4567 ];
       };
-      users.users.testuser = { };
+      users.users.testuser = { isSystemUser = true; };
       systemd.services.mysql = with pkgs; {
         path = [ mysqlenv-common mysqlenv-rsync ];
       };
@@ -130,7 +130,7 @@ in {
         firewall.allowedTCPPorts = [ 3306 4444 4567 4568 ];
         firewall.allowedUDPPorts = [ 4567 ];
       };
-      users.users.testuser = { };
+      users.users.testuser = { isSystemUser = true; };
       systemd.services.mysql = with pkgs; {
         path = [ mysqlenv-common mysqlenv-rsync ];
       };

nixos/tests/mysql/mysql.nix

@@ -9,8 +9,8 @@ import ./../make-test-python.nix ({ pkgs, ...} : {
       { pkgs, ... }:
 
       {
-        users.users.testuser = { };
+        users.users.testuser = { isSystemUser = true; };
-        users.users.testuser2 = { };
+        users.users.testuser2 = { isSystemUser = true; };
         services.mysql.enable = true;
         services.mysql.initialDatabases = [
           { name = "testdb3"; schema = ./testdb.sql; }
@@ -44,8 +44,8 @@ import ./../make-test-python.nix ({ pkgs, ...} : {
         # Kernel panic - not syncing: Out of memory: compulsory panic_on_oom is enabled
         virtualisation.memorySize = 1024;
 
-        users.users.testuser = { };
+        users.users.testuser = { isSystemUser = true; };
-        users.users.testuser2 = { };
+        users.users.testuser2 = { isSystemUser = true; };
         services.mysql.enable = true;
         services.mysql.initialDatabases = [
           { name = "testdb3"; schema = ./testdb.sql; }
@@ -75,8 +75,8 @@ import ./../make-test-python.nix ({ pkgs, ...} : {
       { pkgs, ... }:
 
       {
-        users.users.testuser = { };
+        users.users.testuser = { isSystemUser = true; };
-        users.users.testuser2 = { };
+        users.users.testuser2 = { isSystemUser = true; };
         services.mysql.enable = true;
         services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
           ALTER USER root@localhost IDENTIFIED WITH unix_socket;

nixos/tests/redis.nix

@@ -22,11 +22,10 @@ in
         users.users."member" = {
           createHome = false;
           description = "A member of the redis group";
+          isNormalUser = true;
           extraGroups = [
             "redis"
           ];
-          group = "users";
-          shell = "/bin/sh";
         };
       };
   };

nixos/tests/rspamd.nix

@@ -274,7 +274,10 @@ in
 
         I find cows to be evil don't you?
       '';
-      users.users.tester.password = "test";
+      users.users.tester = {
+        isNormalUser = true;
+        password = "test";
+      };
       services.postfix = {
         enable = true;
         destination = ["example.com"];

nixos/tests/shadow.nix

@@ -13,14 +13,17 @@ in import ./make-test-python.nix ({ pkgs, ... }: {
     users = {
       mutableUsers = true;
       users.emma = {
+        isNormalUser = true;
         password = password1;
         shell = pkgs.bash;
       };
       users.layla = {
+        isNormalUser = true;
         password = password2;
         shell = pkgs.shadow;
       };
       users.ash = {
+        isNormalUser = true;
         password = password4;
         shell = pkgs.bash;
       };

nixos/tests/systemd-confinement.nix

@@ -150,6 +150,7 @@ import ./make-test-python.nix {
 
     config.users.groups.chroot-testgroup = {};
     config.users.users.chroot-testuser = {
+      isSystemUser = true;
       description = "Chroot Test User";
       group = "chroot-testgroup";
     };

nixos/tests/unbound.nix

@@ -132,12 +132,15 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
 
         users.users = {
           # user that is permitted to access the unix socket
-          someuser.extraGroups = [
+          someuser = {
+            isSystemUser = true;
+            extraGroups = [
               config.users.users.unbound.group
             ];
+          };
 
           # user that is not permitted to access the unix socket
-          unauthorizeduser = {};
+          unauthorizeduser = { isSystemUser = true; };
         };
 
         environment.etc = {

pkgs/applications/editors/vscode/vscode.nix

@@ -13,10 +13,10 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0z1diiiykv4ilsiljffz9sl2mlvrxq0xwm8ga2ralfvjwbhzr6dn";
+    x86_64-linux = "08151qdhf4chg9gfbs0dl0v0k5vla2gz5dfy439jzdg1d022d5rw";
-    x86_64-darwin = "02gzw46w3kzw1ya9nx8fkhvzi0mbpz2fyp47n58jki2zkdsfiwzh";
+    x86_64-darwin = "1vlxxkv3wvds3xl3ir93l5q5yq2d7mcragsicfayj9x9r49ilqn3";
-    aarch64-linux = "0bkvgdxch95dqcb41ncsjkaaswmwv6zad4hzdsr3famjm2vym1ky";
+    aarch64-linux = "0rxw1wsi555z41ak817sxqyyan0rm7hma640zsh8dz0yvhzdv1h8";
-    armv7l-linux = "0wdp97ihdnx9bcyn2dh6wzhb7qvdj6x730r7ng1q3i9jhd19wfi3";
+    armv7l-linux = "1ijvd7r2fxxlw4zv3zx5h70b3d0b4gcq3aljsi02v1lr2zm8f8gb";
   }.${system};
 in
   callPackage ./generic.nix rec {
@@ -25,7 +25,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.55.0";
+    version = "1.55.2";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";

pkgs/applications/misc/googleearth-pro/default.nix

@@ -0,0 +1,111 @@
+{ lib, stdenv, fetchurl, glibc, libGLU, libGL, freetype, glib, libSM, libICE, libXi, libXv
+, libXrender, libXrandr, libXfixes, libXcursor, libXinerama, libXext, libX11, libXcomposite
+, libxcb, sqlite, zlib, fontconfig, dpkg, libproxy, libxml2, gst_all_1, dbus, makeWrapper }:
+
+let
+  arch =
+    if stdenv.hostPlatform.system == "x86_64-linux" then "amd64"
+    else throw "Unsupported system ${stdenv.hostPlatform.system} ";
+  fullPath = lib.makeLibraryPath [
+    glibc
+    glib
+    stdenv.cc.cc
+    libSM
+    libICE
+    libXi
+    libXv
+    libGLU libGL
+    libXrender
+    libXrandr
+    libXfixes
+    libXcursor
+    libXinerama
+    libXcomposite
+    freetype
+    libXext
+    libX11
+    libxcb
+    sqlite
+    zlib
+    fontconfig
+    libproxy
+    libxml2
+    dbus
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "googleearth-pro";
+  version = "7.3.3.7786";
+
+  src = fetchurl {
+    url = "https://dl.google.com/linux/earth/deb/pool/main/g/google-earth-pro-stable/google-earth-pro-stable_${version}-r0_${arch}.deb";
+    sha256 = "1s3cakwrgf702g33rh8qs657d8bl68wgg8k89rksgvswwpd2zbb3";
+  };
+
+  nativeBuildInputs = [ dpkg makeWrapper ];
+
+  doInstallCheck = true;
+
+  dontBuild = true;
+
+  dontPatchELF = true;
+
+  unpackPhase = ''
+    # deb file contains a setuid binary, so 'dpkg -x' doesn't work here
+    dpkg --fsys-tarfile ${src} | tar --extract
+  '';
+
+  installPhase =''
+    mkdir $out
+    mv usr/* $out/
+    rmdir usr
+    mv * $out/
+    rm $out/bin/google-earth-pro $out/opt/google/earth/pro/googleearth
+
+    # patch and link googleearth binary
+    ln -s $out/opt/google/earth/pro/googleearth-bin $out/bin/googleearth-pro
+    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${fullPath}:\$ORIGIN" \
+      $out/opt/google/earth/pro/googleearth-bin
+
+    # patch and link gpsbabel binary
+    ln -s $out/opt/google/earth/pro/gpsbabel $out/bin/gpsbabel
+    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${fullPath}:\$ORIGIN" \
+      $out/opt/google/earth/pro/gpsbabel
+
+    # patch libraries
+    for a in $out/opt/google/earth/pro/*.so* ; do
+      patchelf --set-rpath "${fullPath}:\$ORIGIN" $a
+    done
+
+    # Add desktop config file and icons
+    mkdir -p $out/share/{applications,icons/hicolor/{16x16,22x22,24x24,32x32,48x48,64x64,128x128,256x256}/apps,pixmaps}
+    ln -s $out/opt/google/earth/pro/google-earth-pro.desktop $out/share/applications/google-earth-pro.desktop
+    sed -i -e "s|Exec=.*|Exec=$out/bin/googleearth-pro|g" $out/opt/google/earth/pro/google-earth-pro.desktop
+    for size in 16 22 24 32 48 64 128 256; do
+      ln -s $out/opt/google/earth/pro/product_logo_"$size".png $out/share/icons/hicolor/"$size"x"$size"/apps/google-earth-pro.png
+    done
+    ln -s $out/opt/google/earth/pro/product_logo_256.png $out/share/pixmaps/google-earth-pro.png
+  '';
+
+  installCheckPhase = ''
+    $out/bin/gpsbabel -V > /dev/null
+  '';
+
+  # wayland is not supported by Qt included in binary package, so make sure it uses xcb
+  fixupPhase = ''
+    wrapProgram $out/bin/googleearth-pro --set QT_QPA_PLATFORM xcb
+  '';
+
+
+  meta = with lib; {
+    description = "A world sphere viewer";
+    homepage = "https://earth.google.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ friedelino ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/misc/simplenote/default.nix

@@ -17,10 +17,10 @@ let
 
   pname = "simplenote";
 
-  version = "2.8.0";
+  version = "2.9.0";
 
   sha256 = {
-    x86_64-linux = "sha256-W8+LzWMPDCrFZCm9p/Gcj7OXqJw/gs7lMxTKjOQChQY=";
+    x86_64-linux = "sha256-uwd9fYqZepJ/BBttprqkJhswqMepGsHDTd5Md9gjI68=";
   }.${system} or throwSystem;
 
   meta = with lib; {

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -1,8 +1,8 @@
 {
   "stable": {
-    "version": "89.0.4389.114",
+    "version": "89.0.4389.128",
-    "sha256": "007df9p78bbmk3iyfi8qn57mmn68qqrdhx6z8n2hl8ksd7lspw7j",
+    "sha256": "0nysvsck91yxcb3wf6v3nzar77k7j9bby7xfzsvd7wlqxdmflx8s",
-    "sha256bin64": "06wblyvyr93032fbzwm6qpzz4jjm6adziq4i4n6kmfdix2ajif8a",
+    "sha256bin64": "07m43yqq6j7mfhdnm127p29b2611l8lmbq87iszlgg6dgkqxa0qr",
     "deps": {
       "gn": {
         "version": "2021-01-07",
@@ -18,9 +18,9 @@
     }
   },
   "beta": {
-    "version": "90.0.4430.70",
+    "version": "90.0.4430.72",
-    "sha256": "0jnyqnqwdccv3i55grd12wr2w5ffxyzmj2l3c1i24xawf2zdzyym",
+    "sha256": "0hw916j55lm3qnidfp92i8w6zywdd47rhihn9pn23b7ziz58ik55",
-    "sha256bin64": "1lv9gz6llphyvlvn92yw1cyhj4i6jzhy1l7hk01418prmhb4nfws",
+    "sha256bin64": "1ddj2pk4m26dpl1ja0r56fvm67c1z1hq5rq5an8px6ixy78s2760",
     "deps": {
       "gn": {
         "version": "2021-02-09",

pkgs/applications/networking/cluster/terraform-providers/default.nix

@@ -3,7 +3,6 @@
 , buildGoPackage
 , fetchFromGitHub
 , callPackage
-, runtimeShell
 }:
 let
   list = lib.importJSON ./providers.json;
@@ -58,7 +57,6 @@ let
     cloudfoundry = callPackage ./cloudfoundry {};
     gandi = callPackage ./gandi {};
     hcloud = callPackage ./hcloud {};
-    keycloak = callPackage ./keycloak {};
     libvirt = callPackage ./libvirt {};
     linuxbox = callPackage ./linuxbox {};
     lxd = callPackage ./lxd {};

pkgs/applications/networking/cluster/terraform-providers/keycloak/default.nix

@@ -1,30 +0,0 @@
-{ lib
-, fetchFromGitHub
-, buildGoModule
-}:
-
-buildGoModule rec {
-  pname = "terraform-provider-keycloak";
-  version = "1.20.0";
-
-  src = fetchFromGitHub {
-    owner = "mrparkers";
-    repo = "terraform-provider-keycloak";
-    rev = version;
-    sha256 = "1h8780k8345pf0s14k1pmwdjbv2j08h4rq3jwds81mmv6qgj1r2n";
-  };
-
-  vendorSha256 = "12iary7p5qsbl4xdhfd1wh92mvf2fiylnb3m1d3m7cdcn32rfimq";
-
-  doCheck = false;
-
-  postInstall = "mv $out/bin/terraform-provider-keycloak{,_v${version}}";
-
-  meta = with lib; {
-    description = "Terraform provider for keycloak";
-    homepage = "https://github.com/mrparkers/terraform-provider-keycloak";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ eonpatapon ];
-  };
-
-}

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -493,6 +493,14 @@
     "vendorSha256": "08wg16g4mvn6kl8xwn89195a826cb132ijvrgf32c6p7zp4lgmjd",
     "version": "0.2.12"
   },
+  "keycloak": {
+    "owner": "mrparkers",
+    "repo": "terraform-provider-keycloak",
+    "rev": "v3.0.0",
+    "sha256": "1q9vzmj9c7mznv6al58d3rs5kk1fh28k1qccx46hcbk82z52da3a",
+    "vendorSha256": "0kh6lljvqd577s19gx0fmfsmx9wm3ikla3jz16lbwwb8ahbqcw1f",
+    "version": "3.0.0"
+  },
   "ksyun": {
     "owner": "terraform-providers",
     "repo": "terraform-provider-ksyun",

pkgs/applications/office/todofi.sh/default.nix

@@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, coreutils
+, gawk
+, gnugrep
+, gnused
+, rofi
+, todo-txt-cli
+}:
+
+stdenv.mkDerivation rec {
+  pname = "todofi.sh";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "hugokernel";
+    repo = "todofi.sh";
+    rev = "v${version}";
+    sha256 = "1gmy5inlghycsxiwnyyjyv81jn2fmfk3s9x78kcgyf7khzb5kwvj";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    install -Dm 755 todofi.sh -t $out/bin
+  '';
+
+  postFixup = ''
+    patchShebangs $out/bin
+    wrapProgram $out/bin/todofi.sh --prefix PATH : "${lib.makeBinPath [ coreutils gawk gnugrep gnused rofi todo-txt-cli ]}"
+  '';
+
+  meta = with lib; {
+    description = "Todo-txt + Rofi = Todofi.sh";
+    homepage = "https://github.com/hugokernel/todofi.sh";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ewok ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/science/biology/MACS2/default.nix

@@ -0,0 +1,25 @@
+{ lib, python3, fetchurl }:
+
+python3.pkgs.buildPythonPackage rec {
+  pname = "MACS2";
+  version = "2.2.7.1";
+
+  src = python3.pkgs.fetchPypi {
+    inherit pname version;
+    sha256 = "1rcxj943kgzs746f5jrb72x1cp4v50rk3qmad0m99a02vndscb5d";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [ numpy ];
+
+  # To prevent ERROR: diffpeak_cmd (unittest.loader._FailedTest) for obsolete
+  # function (ImportError: Failed to import test module: diffpeak_cmd)
+  doCheck = false;
+  pythonImportsCheck = [ "MACS2" ];
+
+  meta = with lib; {
+    description = "Model-based Analysis for ChIP-Seq";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ gschwartz ];
+    platforms = platforms.linux;
+  };
+}

pkgs/data/icons/numix-icon-theme-circle/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "numix-icon-theme-circle";
-  version = "20.09.19";
+  version = "21.04.14";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "1rqlq5ssxqj0nc0i8av7zprj94km5645xzqi5j5i0sxd3jbmyfjx";
+    sha256 = "1z8c0179r8g0y9zh4383brsfhkcyfy79dc8hw94p9zjn5a66547w";
   };
 
   nativeBuildInputs = [ gtk3 ];
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Numix icon theme (circle version)";
     homepage = "https://numixproject.github.io";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
     # darwin cannot deal with file names differing only in case
     platforms = platforms.linux;
     maintainers = with maintainers; [ romildo ];

pkgs/data/icons/numix-icon-theme-square/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "numix-icon-theme-square";
-  version = "20.09.19";
+  version = "21.04.14";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "0afraarfcd66mpidmn0l90wif8kmwzdj3s09g704kwszyijxs80z";
+    sha256 = "0ndxjp173dwz78m41mn818mh4bdsxa2ypv4wrwicx0v4d8z90ddj";
   };
 
   nativeBuildInputs = [ gtk3 ];
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Numix icon theme (square version)";
     homepage = "https://numixproject.github.io";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
     # darwin cannot deal with file names differing only in case
     platforms = platforms.linux;
     maintainers = with maintainers; [ romildo ];

pkgs/data/icons/numix-icon-theme/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "numix-icon-theme";
-  version = "20.06.07";
+  version = "21.04.14";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "1yp9parc8ihmai8pswf4qzrqd88qpls87ipq8ylx38yqns7wsn4h";
+    sha256 = "1ilzqh9f7skdfg5sl97zfgwrzvwa1zna22dpq0954gyyzvy7k7lg";
   };
 
   nativeBuildInputs = [ gtk3 ];
@@ -18,18 +18,22 @@ stdenv.mkDerivation rec {
   dontDropIconThemeCache = true;
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/icons
     cp -a Numix{,-Light} $out/share/icons/
 
     for theme in $out/share/icons/*; do
       gtk-update-icon-cache $theme
     done
+
+    runHook postInstall
   '';
 
   meta = with lib; {
     description = "Numix icon theme";
     homepage = "https://numixproject.github.io";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
     # darwin cannot deal with file names differing only in case
     platforms = platforms.linux;
     maintainers = with maintainers; [ romildo ];

pkgs/development/compilers/jetbrains-jdk/default.nix

@@ -2,12 +2,12 @@
 
 openjdk11.overrideAttrs (oldAttrs: rec {
   pname = "jetbrains-jdk";
-  version = "11.0.10-b37";
+  version = "11.0.10-b1427";
   src = fetchFromGitHub {
     owner = "JetBrains";
     repo = "JetBrainsRuntime";
     rev = "jb${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "0bcvwnwi29z000b1bk5dhfkd33xfp9899zc3idzifdwl7q42zi02";
+    sha256 = "sha256-2cn+FiFfGpp7CBeQMAASVZwTm6DOFaXaWxAL/nVC2Nk=";
   };
   patches = [];
   meta = with lib; {

pkgs/development/compilers/llvm/11/llvm/default.nix

@@ -70,7 +70,7 @@ in stdenv.mkDerivation (rec {
       --replace "Path.cpp" ""
     rm unittests/Support/Path.cpp
   '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../TLI-musl.patch}
+    patch -p1 -i ${../../TLI-musl.patch}
     substituteInPlace unittests/Support/CMakeLists.txt \
       --replace "add_subdirectory(DynamicLibrary)" ""
     rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp

pkgs/development/node-packages/default.nix

@@ -13,6 +13,19 @@ let
         export NG_CLI_ANALYTICS=false
       '';
     };
+
+    aws-azure-login = super.aws-azure-login.override {
+      meta.platforms = pkgs.lib.platforms.linux;
+      nativeBuildInputs = [ pkgs.makeWrapper ];
+      prePatch = ''
+        export PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=1
+      '';
+      postInstall = ''
+        wrapProgram $out/bin/aws-azure-login \
+            --set PUPPETEER_EXECUTABLE_PATH ${pkgs.chromium}/bin/chromium
+      '';
+    };
+
     bower2nix = super.bower2nix.override {
       buildInputs = [ pkgs.makeWrapper ];
       postInstall = ''

pkgs/development/node-packages/node-packages.json

@@ -12,6 +12,7 @@
 , "@webassemblyjs/wast-refmt"
 , "alloy"
 , "asar"
+, "aws-azure-login"
 , "balanceofsatoshis"
 , "bash-language-server"
 , "bower"

pkgs/development/ocaml-modules/postgresql/default.nix

@@ -1,8 +1,10 @@
-{ lib, fetchFromGitHub, buildDunePackage, postgresql }:
+{ lib, fetchFromGitHub, buildDunePackage, dune-configurator, postgresql }:
 
 buildDunePackage rec {
   pname = "postgresql";
-  version = "4.6.3";
+  version = "5.0.0";
+
+  useDune2 = true;
 
   minimumOCamlVersion = "4.08";
 
@@ -10,10 +12,10 @@ buildDunePackage rec {
     owner = "mmottl";
     repo = "postgresql-ocaml";
     rev = version;
-    sha256 = "0fd96qqwkwjhv6pawk4wivwncszkif0sq05f0g5gd28jzwrsvpqr";
+    sha256 = "1i4pnh2v00i0s7s9pcwz1x6s4xcd77d08gjjkvy0fmda6mqq6ghn";
   };
 
-  buildInputs = [ postgresql ];
+  buildInputs = [ dune-configurator postgresql ];
 
   meta = {
     description = "Bindings to the PostgreSQL library";

pkgs/development/python-modules/clickhouse-cli/default.nix

@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, click
+, prompt_toolkit
+, pygments
+, requests
+, sqlparse
+}:
+
+buildPythonPackage rec {
+  pname = "clickhouse-cli";
+  version = "0.3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-fDvUdL6LzgCv6LDmB0R0M7v6BbnbL68p9pHMebP58h8=";
+  };
+
+  propagatedBuildInputs = [
+    click
+    prompt_toolkit
+    pygments
+    requests
+    sqlparse
+  ];
+
+  pythonImportsCheck = [ "clickhouse_cli" ];
+
+  meta = with lib; {
+    description = "A third-party client for the Clickhouse DBMS server";
+    homepage = "https://github.com/hatarist/clickhouse-cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ivan-babrou ];
+  };
+}

pkgs/development/python-modules/mcstatus/default.nix

@@ -5,6 +5,7 @@
 , dnspython
 , fetchFromGitHub
 , mock
+, pytest-asyncio
 , pytestCheckHook
 , pythonOlder
 , six
@@ -12,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "mcstatus";
-  version = "5.1.2";
+  version = "5.1.4";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "Dinnerbone";
     repo = pname;
-    rev = "release-${version}";
+    rev = "v${version}";
-    sha256 = "16k5vcqpd9r7mm1cg9khzba42rcxs491h8gk2klymav249yzrwk7";
+    sha256 = "1k8hjv965svbm95m7jaawlhdbxqpkjchlwvjwn1n7z90dfgn5kih";
   };
 
   propagatedBuildInputs = [
@@ -31,6 +32,7 @@ buildPythonPackage rec {
 
   checkInputs = [
     mock
+    pytest-asyncio
     pytestCheckHook
   ];
 

pkgs/development/python-modules/oci/default.nix

@@ -0,0 +1,45 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, certifi
+, configparser
+, cryptography
+, pyopenssl
+, dateutil
+, pytz
+}:
+
+buildPythonPackage rec {
+  pname = "oci";
+  version = "2.36.0";
+
+  src = fetchFromGitHub {
+    owner = "oracle";
+    repo = "oci-python-sdk";
+    rev = "v${version}";
+    hash = "sha256-scG/ZhWeiCgXp7iD6arWIN8KZecSjKLsCW4oXeJvx6M=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "configparser==4.0.2" "configparser" \
+      --replace "cryptography==3.2.1" "cryptography" \
+      --replace "pyOpenSSL>=17.5.0,<=19.1.0" "pyOpenSSL"
+  '';
+
+  propagatedBuildInputs = [
+    certifi configparser cryptography pyopenssl dateutil pytz
+  ];
+
+  # Tests fail: https://github.com/oracle/oci-python-sdk/issues/164
+  doCheck = false;
+
+  pythonImportsCheck = [ "oci" ];
+
+  meta = with lib; {
+    description = "Oracle Cloud Infrastructure Python SDK";
+    homepage = "https://oracle-cloud-infrastructure-python-sdk.readthedocs.io/en/latest/index.html";
+    maintainers = with maintainers; [ ilian ];
+    license = with licenses; [ asl20 upl ];
+  };
+}

pkgs/development/python-modules/pikepdf/default.nix

@@ -17,18 +17,19 @@
 , python-dateutil
 , python-xmp-toolkit
 , qpdf
+, setuptools
 , setuptools-scm
 , setuptools-scm-git-archive
 }:
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "2.9.1";
+  version = "2.11.1";
   disabled = ! isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "99c19cf0dd0fc89fc9e6a0de61e974e34d4111dd69802aeaee3e61fb1a74a3d8";
+    sha256 = "0vs7qa3s4scfhyldfw99hhxpna6rj49rsbr2k0j6b4qx1bw8h141";
   };
 
   buildInputs = [
@@ -58,6 +59,7 @@ buildPythonPackage rec {
     defusedxml
     lxml
     pillow
+    setuptools
   ];
 
   preBuild = ''
@@ -71,5 +73,6 @@ buildPythonPackage rec {
     description = "Read and write PDFs with Python, powered by qpdf";
     license = licenses.mpl20;
     maintainers = [ maintainers.kiwi ];
+    changelog = "https://github.com/pikepdf/pikepdf/blob/${version}/docs/release_notes.rst";
   };
 }

pkgs/development/python-modules/pulsectl/default.nix

@@ -6,7 +6,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "faa8b9336237565990298f20870e13dd1678a4586847ca5a7ff2abf10752f356";
+    sha256 = "sha256-+qi5M2I3VlmQKY8ghw4T3RZ4pFhoR8paf/Kr8QdS81Y=";
   };
 
   patches = [

pkgs/development/python-modules/spotipy/default.nix

@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "spotipy";
-  version = "2.17.1";
+  version = "2.18.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-KcYMi5naHEufDXIhabwx5iS4wH1xhrjq3ZwC6NLULL8=";
+    sha256 = "sha256-9yk7gIaWgH6azsa9z/Y/fcw8wbFIwMS0KZ70PJZvcXc=";
   };
 
   propagatedBuildInputs = [ requests six ];

pkgs/development/python-modules/systembridge/default.nix

@@ -0,0 +1,32 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, fetchFromGitHub
+}:
+
+buildPythonPackage rec {
+  pname = "systembridge";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "timmo001";
+    repo = "system-bridge-connector-py";
+    rev = "v${version}";
+    sha256 = "0vyfi7nyzkzsgg84n5wh4hzwvx6fybgqdzbabnsmvszb9sm1vlb2";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+  ];
+
+  # Project has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "systembridge" ];
+
+  meta = with lib; {
+    description = "Python module for connecting to System Bridge";
+    homepage = "https://github.com/timmo001/system-bridge-connector-py";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/twitterapi/default.nix

@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "twitterapi";
-  version = "2.6.10";
+  version = "2.7.1";
 
   src = fetchFromGitHub {
     owner = "geduldig";
     repo = "TwitterAPI";
     rev = "v${version}";
-    sha256 = "sha256-ylxjeIK9cjT4r71j+sULYs6yyYWfKDkpm0bESMo7s3o=";
+    sha256 = "sha256-fLexFlnoh58b9q4mo9atGQmMttKytTfAYmaPj6xmPj8=";
   };
 
   propagatedBuildInputs = [

pkgs/development/tools/buildah/default.nix

@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "buildah";
-  version = "1.20.0";
+  version = "1.20.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "buildah";
     rev = "v${version}";
-    sha256 = "12gmn61mfrr58071x3cdsksad6swn1b23ghih128hjdpdzk1zxs3";
+    sha256 = "sha256-nlZblUPS0678dR0hyp+V9uH/nHL9YH81+O1Zzq8T8Pw=";
   };
 
   outputs = [ "out" "man" ];

pkgs/development/tools/godot/default.nix

@@ -58,11 +58,11 @@ in stdenv.mkDerivation rec {
       --replace "Exec=godot" "Exec=$out/bin/godot"
   '';
 
-  meta = {
+  meta = with lib; {
     homepage    = "https://godotengine.org";
     description = "Free and Open Source 2D and 3D game engine";
-    license     = lib.licenses.mit;
+    license     = licenses.mit;
     platforms   = [ "i686-linux" "x86_64-linux" ];
-    maintainers = [ lib.maintainers.twey ];
+    maintainers = with maintainers; [ twey ];
   };
 }

pkgs/games/scummvm/default.nix

@@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, nasm
 , alsaLib, curl, flac, fluidsynth, freetype, libjpeg, libmad, libmpeg2, libogg, libvorbis, libGLU, libGL, SDL2, zlib
+, Cocoa, AudioToolbox, Carbon, CoreMIDI, AudioUnit, cctools
 }:
 
 stdenv.mkDerivation rec {
@@ -13,8 +14,12 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ nasm ];
 
-  buildInputs = [
+  buildInputs = lib.optionals stdenv.isLinux [
-    alsaLib curl freetype flac fluidsynth libjpeg libmad libmpeg2 libogg libvorbis libGLU libGL SDL2 zlib
+    alsaLib
+  ] ++ lib.optionals stdenv.isDarwin [
+    Cocoa AudioToolbox Carbon CoreMIDI AudioUnit
+  ] ++ [
+    curl freetype flac fluidsynth libjpeg libmad libmpeg2 libogg libvorbis libGLU libGL SDL2 zlib
   ];
 
   dontDisableStatic = true;
@@ -30,6 +35,8 @@ stdenv.mkDerivation rec {
   # They use 'install -s', that calls the native strip instead of the cross
   postConfigure = ''
     sed -i "s/-c -s/-c -s --strip-program=''${STRIP@Q}/" ports.mk
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace config.mk --replace x86_64-apple-darwin-ranlib ${cctools}/bin/ranlib
   '';
 
   meta = with lib; {
@@ -37,6 +44,6 @@ stdenv.mkDerivation rec {
     homepage = "https://www.scummvm.org/";
     license = licenses.gpl2;
     maintainers = [ maintainers.peterhoeg ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }

pkgs/misc/vscode-extensions/default.nix

@@ -390,6 +390,21 @@ let
         };
       };
 
+      foxundermoon.shell-format = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "shell-format";
+          publisher = "foxundermoon";
+          version = "7.1.0";
+          sha256 = "09z72mdr5bfdcb67xyzlv7lb9vyjlc3k9ackj4jgixfk40c68cnj";
+        };
+        meta = with lib; {
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=foxundermoon.shell-format";
+          homepage = "https://github.com/foxundermoon/vs-shell-format";
+          license = licenses.mit;
+          maintainers = with maintainers; [ dbirks ];
+        };
+      };
+
       freebroccolo.reasonml = buildVscodeMarketplaceExtension {
         meta = with lib; {
           changelog = "https://marketplace.visualstudio.com/items/freebroccolo.reasonml/changelog";

pkgs/os-specific/bsd/netbsd/default.nix

@@ -1,8 +1,8 @@
-{ stdenv, stdenvNoCC, lib, groff, mandoc, zlib, bison, flex
+{ stdenv, stdenvNoCC, fetchcvs, lib, groff, mandoc, zlib, bison, flex
 , writeText, buildPackages, splicePackages, symlinkJoin }:
 
 let
-  fetchNetBSD = path: version: sha256: buildPackages.fetchcvs {
+  fetchNetBSD = path: version: sha256: fetchcvs {
     cvsRoot = ":pserver:anoncvs@anoncvs.NetBSD.org:/cvsroot";
     module = "src/${path}";
     inherit sha256;

pkgs/servers/monitoring/alertmanager-irc-relay/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "alertmanager-irc-relay";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "alertmanager-irc-relay";
     rev = "v${version}";
-    sha256 = "sha256-SmyKk0vSXfHzRxOdbULD2Emju/VjDcXZZ7cgVbZxGIA=";
+    sha256 = "sha256-IlWXsQZtDXG8sJBV+82BzEFj+JtUbfTOZyqYOrZFTXA=";
   };
 
-  vendorSha256 = "sha256-aJVA9MJ9DK/dCo7aSB9OLfgKGN5L6Sw2k2aOR4J2LE4=";
+  vendorSha256 = "sha256-VLG15IXS/fXFMTCJKEqGW6qZ9aOLPhazidVsOywG+w4=";
 
   buildFlagsArray = [ "-ldflags=-s -w" ];
 

pkgs/tools/admin/oci-cli/default.nix

@@ -0,0 +1,58 @@
+{ lib, fetchFromGitHub, python3Packages, locale }:
+
+let
+  # https://github.com/oracle/oci-cli/issues/189
+  pinned_click = python3Packages.click.overridePythonAttrs (old: rec {
+    pname = "click";
+    version = "6.7";
+    src = python3Packages.fetchPypi {
+      inherit pname version;
+      hash = "sha256-8VUW30eNWlYYD7+A5o8gYBDm0WD8OfpQi2XgNf11Ews=";
+    };
+
+    postPatch = ''
+      substituteInPlace click/_unicodefun.py \
+      --replace "'locale'" "'${locale}/bin/locale'"
+    '';
+
+    # Issue that wasn't resolved when this version was released:
+    # https://github.com/pallets/click/issues/823
+    doCheck = false;
+  });
+in
+
+python3Packages.buildPythonApplication rec {
+  pname = "oci-cli";
+  version = "2.23.0";
+
+  src = fetchFromGitHub {
+    owner = "oracle";
+    repo = "oci-cli";
+    rev = "v${version}";
+    hash = "sha256-XRkycJrUSOZQAGiSyQZGA/SnlxnFumYL82kOkYd7s2o=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    oci arrow certifi pinned_click configparser cryptography jmespath dateutil
+    pytz retrying six terminaltables pyopenssl pyyaml
+  ];
+
+  # https://github.com/oracle/oci-cli/issues/187
+  doCheck = false;
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "configparser==4.0.2" "configparser" \
+      --replace "cryptography==3.2.1" "cryptography" \
+      --replace "pyOpenSSL==19.1.0" "pyOpenSSL" \
+      --replace "PyYAML==5.3.1" "PyYAML" \
+      --replace "six==1.14.0" "six"
+  '';
+
+  meta = with lib; {
+    description = "Command Line Interface for Oracle Cloud Infrastructure";
+    homepage = "https://docs.cloud.oracle.com/iaas/Content/API/Concepts/cliconcepts.htm";
+    maintainers = with maintainers; [ ilian ];
+    license = with licenses; [ asl20 upl ];
+  };
+}

pkgs/tools/text/ocrmypdf/default.nix

@@ -30,14 +30,14 @@ let
 in
 buildPythonApplication rec {
   pname = "ocrmypdf";
-  version = "11.6.0";
+  version = "11.7.3";
   disabled = ! python3Packages.isPy3k;
 
   src = fetchFromGitHub {
     owner = "jbarlow83";
     repo = "OCRmyPDF";
     rev = "v${version}";
-    sha256 = "0inmmpam0vcm5n4sm6lh9p5swk44clknvm1cdwk9cax01mdqljza";
+    sha256 = "0gs2w9kl5wwrs0hx2sivq3pdvpf3lkaifblwfbz5g31yl770blji";
   };
 
   nativeBuildInputs = with python3Packages; [
@@ -85,5 +85,6 @@ buildPythonApplication rec {
     license = with licenses; [ mpl20 mit ];
     platforms = platforms.linux;
     maintainers = [ maintainers.kiwi ];
+    changelog  = "https://github.com/jbarlow83/OCRmyPDF/blob/v${version}/docs/release_notes.rst";
   };
 }

pkgs/top-level/all-packages.nix

@@ -375,7 +375,10 @@ in
 
   fetchbzr = callPackage ../build-support/fetchbzr { };
 
-  fetchcvs = callPackage ../build-support/fetchcvs { };
+  fetchcvs = if stdenv.buildPlatform != stdenv.hostPlatform
+    # hack around splicing being crummy with things that (correctly) don't eval.
+    then buildPackages.fetchcvs
+    else callPackage ../build-support/fetchcvs { };
 
   fetchdarcs = callPackage ../build-support/fetchdarcs { };
 
@@ -427,7 +430,10 @@ in
 
   fetchs3 = callPackage ../build-support/fetchs3 { };
 
-  fetchsvn = callPackage ../build-support/fetchsvn { };
+  fetchsvn = if stdenv.buildPlatform != stdenv.hostPlatform
+    # hack around splicing being crummy with things that (correctly) don't eval.
+    then buildPackages.fetchsvn
+    else callPackage ../build-support/fetchsvn { };
 
   fetchsvnrevision = import ../build-support/fetchsvnrevision runCommand subversion;
 
@@ -2841,6 +2847,8 @@ in
 
   nyx = callPackage ../tools/networking/nyx { };
 
+  oci-cli = callPackage ../tools/admin/oci-cli { };
+
   ocrmypdf = callPackage ../tools/text/ocrmypdf { };
 
   ocrfeeder = callPackage ../applications/graphics/ocrfeeder { };
@@ -18332,6 +18340,8 @@ in
     inherit (llvmPackages_10) clang-unwrapped lld lldClang llvm;
   };
 
+  clickhouse-cli = with python3Packages; toPythonApplication clickhouse-cli;
+
   couchdb = callPackage ../servers/http/couchdb {
     sphinx = python27Packages.sphinx;
     erlang = erlangR19;
@@ -23336,6 +23346,8 @@ in
 
   googleearth = callPackage ../applications/misc/googleearth { };
 
+  googleearth-pro = callPackage ../applications/misc/googleearth-pro { };
+
   google-chrome = callPackage ../applications/networking/browsers/google-chrome { gconf = gnome2.GConf; };
 
   google-chrome-beta = google-chrome.override { chromium = chromiumBeta; channel = "beta"; };
@@ -26130,6 +26142,8 @@ in
 
   todo-txt-cli = callPackage ../applications/office/todo.txt-cli { };
 
+  todofi-sh = callPackage ../applications/office/todofi.sh { };
+
   todoman = callPackage ../applications/office/todoman { };
 
   toggldesktop = libsForQt514.callPackage ../applications/misc/toggldesktop { };
@@ -27949,7 +27963,10 @@ in
     tk = tk-8_6;
   };
 
-  scummvm = callPackage ../games/scummvm { };
+  scummvm = callPackage ../games/scummvm {
+    inherit (darwin) cctools;
+    inherit (darwin.apple_sdk.frameworks) Cocoa AudioToolbox Carbon CoreMIDI AudioUnit;
+  };
 
   inherit (callPackage ../games/scummvm/games.nix { })
     beneath-a-steel-sky
@@ -28553,6 +28570,8 @@ in
 
   macse = callPackage ../applications/science/biology/macse { };
 
+  MACS2 = callPackage ../applications/science/biology/MACS2 { };
+
   migrate = callPackage ../applications/science/biology/migrate { };
 
   minia = callPackage ../applications/science/biology/minia {

pkgs/top-level/python-packages.nix

@@ -1367,6 +1367,8 @@ in {
 
   clickhouse-cityhash = callPackage ../development/python-modules/clickhouse-cityhash {};
 
+  clickhouse-cli = callPackage ../development/python-modules/clickhouse-cli { };
+
   clickhouse-driver = callPackage ../development/python-modules/clickhouse-driver {};
 
   cliff = callPackage ../development/python-modules/cliff { };
@@ -4478,6 +4480,8 @@ in {
     graphvizPkgs = pkgs.graphviz;
   };
 
+  oci = callPackage ../development/python-modules/oci { };
+
   od = callPackage ../development/python-modules/od { };
 
   odfpy = callPackage ../development/python-modules/odfpy { };
@@ -7651,6 +7655,8 @@ in {
 
   sympy = callPackage ../development/python-modules/sympy { };
 
+  systembridge = callPackage ../development/python-modules/systembridge { };
+
   systemd = callPackage ../development/python-modules/systemd {
     inherit (pkgs) systemd;
   };