Merge origin/master into haskell-updates.

Conflicts:
    pkgs/development/haskell-modules/configuration-common.nix

.github/CODEOWNERS

@@ -79,11 +79,11 @@
 /pkgs/development/tools/poetry2nix @adisbladis
 
 # Haskell
-/pkgs/development/compilers/ghc                       @cdepillabout
+/pkgs/development/compilers/ghc                       @cdepillabout @sternenseemann
-/pkgs/development/haskell-modules		      @cdepillabout
+/pkgs/development/haskell-modules		      @cdepillabout @sternenseemann
-/pkgs/development/haskell-modules/default.nix	      @cdepillabout
+/pkgs/development/haskell-modules/default.nix	      @cdepillabout @sternenseemann
-/pkgs/development/haskell-modules/generic-builder.nix @cdepillabout
+/pkgs/development/haskell-modules/generic-builder.nix @cdepillabout @sternenseemann
-/pkgs/development/haskell-modules/hoogle.nix	      @cdepillabout
+/pkgs/development/haskell-modules/hoogle.nix	      @cdepillabout @sternenseemann
 
 # Perl
 /pkgs/development/interpreters/perl @volth @stigtsp

doc/builders/images/dockertools.section.md

@@ -111,6 +111,12 @@ Create a Docker image with many of the store paths being on their own layer to i
 
     *Default:* the output path's hash
 
+`fromImage` _optional_
+
+: The repository tarball containing the base image. It must be a valid Docker image, such as one exported by `docker save`.
+
+    *Default:* `null`, which can be seen as equivalent to `FROM scratch` of a `Dockerfile`.
+
 `contents` _optional_
 
 : Top level paths in the container. Either a single derivation, or a list of derivations.

doc/builders/packages/fuse.section.md

@@ -0,0 +1,19 @@
+# FUSE {#sec-fuse}
+
+Some packages rely on
+[FUSE](https://www.kernel.org/doc/html/latest/filesystems/fuse.html) to provide
+support for additional filesystems not supported by the kernel.
+
+In general, FUSE software are primarily developed for Linux but many of them can
+also run on macOS. Nixpkgs supports FUSE packages on macOS, but it requires
+[macFUSE](https://osxfuse.github.io) to be installed outside of Nix. macFUSE
+currently isn't packaged in Nixpkgs mainly because it includes a kernel
+extension, which isn't supported by Nix outside of NixOS.
+
+If a package fails to run on macOS with an error message similar to the
+following, it's a likely sign that you need to have macFUSE installed.
+
+    dyld: Library not loaded: /usr/local/lib/libfuse.2.dylib
+    Referenced from: /nix/store/w8bi72bssv0bnxhwfw3xr1mvn7myf37x-sshfs-fuse-2.10/bin/sshfs
+    Reason: image not found
+    [1]    92299 abort      /nix/store/w8bi72bssv0bnxhwfw3xr1mvn7myf37x-sshfs-fuse-2.10/bin/sshfs

doc/builders/packages/index.xml

@@ -12,6 +12,7 @@
  <xi:include href="emacs.section.xml" />
  <xi:include href="firefox.section.xml" />
  <xi:include href="fish.section.xml" />
+ <xi:include href="fuse.section.xml" />
  <xi:include href="ibus.section.xml" />
  <xi:include href="kakoune.section.xml" />
  <xi:include href="linux.section.xml" />

doc/languages-frameworks/python.section.md

@@ -638,7 +638,7 @@ are disabled.
 
 #### Using pythonImportsCheck
 
-Although unit tests are highly prefered to valid correctness of a package. Not
+Although unit tests are highly prefered to validate correctness of a package, not
 all packages have test suites that can be ran easily, and some have none at all.
 To help ensure the package still works, `pythonImportsCheck` can attempt to import
 the listed modules.
@@ -1551,13 +1551,11 @@ In a `setup.py` or `setup.cfg` it is common to declare dependencies:
 
 ### Contributing guidelines
 
-Following rules are desired to be respected:
+The following rules are desired to be respected:
 
 * Python libraries are called from `python-packages.nix` and packaged with
   `buildPythonPackage`. The expression of a library should be in
   `pkgs/development/python-modules/<name>/default.nix`.
-* Libraries in `pkgs/top-level/python-packages.nix` are sorted
-  alphanumerically to avoid merge conflicts and ease locating attributes.
 * Python applications live outside of `python-packages.nix` and are packaged
   with `buildPythonApplication`.
 * Make sure libraries build for all Python interpreters.
@@ -1567,8 +1565,11 @@ Following rules are desired to be respected:
   case, when you disable tests, leave a comment explaining why.
 * Commit names of Python libraries should reflect that they are Python
   libraries, so write for example `pythonPackages.numpy: 1.11 -> 1.12`.
-* Attribute names in `python-packages.nix` should be normalized according to
+* Attribute names in `python-packages.nix` as well as `pname`s should match the
-  [PEP 0503](https://www.python.org/dev/peps/pep-0503/#normalized-names). This
+  library's name on PyPI, but be normalized according to [PEP
-  means that characters should be converted to lowercase and `.` and `_` should
+  0503](https://www.python.org/dev/peps/pep-0503/#normalized-names). This means
-  be replaced by a single `-` (foo-bar-baz instead of Foo__Bar.baz )
+  that characters should be converted to lowercase and `.` and `_` should be
-* Attribute names in `python-packages.nix` should be sorted alphanumerically.
+  replaced by a single `-` (foo-bar-baz instead of Foo__Bar.baz).
+  If necessary, `pname` has to be given a different value within `fetchPypi`.
+* Attribute names in `python-packages.nix` should be sorted alphanumerically to
+  avoid merge conflicts and ease locating attributes.

lib/modules.nix

@@ -361,6 +361,17 @@ rec {
       */
       byName = attr: f: modules:
         foldl' (acc: module:
+              if !(builtins.isAttrs module.${attr}) then
+                throw ''
+                  You're trying to declare a value of type `${builtins.typeOf module.${attr}}'
+                  rather than an attribute-set for the option
+                  `${builtins.concatStringsSep "." prefix}'!
+
+                  This usually happens if `${builtins.concatStringsSep "." prefix}' has option
+                  definitions inside that are not matched. Please check how to properly define
+                  this option by e.g. referring to `man 5 configuration.nix'!
+                ''
+              else
                 acc // (mapAttrs (n: v:
                                    (acc.${n} or []) ++ f module v
                                  ) module.${attr}

lib/tests/modules.sh

@@ -169,7 +169,7 @@ checkConfigOutput "foo" config.submodule.foo ./declare-submoduleWith-special.nix
 ## shorthandOnlyDefines config behaves as expected
 checkConfigOutput "true" config.submodule.config ./declare-submoduleWith-shorthand.nix ./define-submoduleWith-shorthand.nix
 checkConfigError 'is not of type `boolean' config.submodule.config ./declare-submoduleWith-shorthand.nix ./define-submoduleWith-noshorthand.nix
-checkConfigError 'value is a boolean while a set was expected' config.submodule.config ./declare-submoduleWith-noshorthand.nix ./define-submoduleWith-shorthand.nix
+checkConfigError "You're trying to declare a value of type \`bool'\nrather than an attribute-set for the option" config.submodule.config ./declare-submoduleWith-noshorthand.nix ./define-submoduleWith-shorthand.nix
 checkConfigOutput "true" config.submodule.config ./declare-submoduleWith-noshorthand.nix ./define-submoduleWith-noshorthand.nix
 
 ## submoduleWith should merge all modules in one swoop

maintainers/maintainer-list.nix

@@ -2942,7 +2942,7 @@
     name = "Adam Copp";
   };
   ethancedwards8 = {
-    email = "ethancarteredwards@gmail.com";
+    email = "ethan@ethancedwards.com";
     github = "ethancedwards8";
     githubId = 60861925;
     name = "Ethan Carter Edwards";
@@ -6905,6 +6905,12 @@
     githubId = 16385648;
     name = "Niko Pavlinek";
   };
+  nixinator = {
+    email = "33lockdown33@protonmail.com";
+    github = "nixinator";
+    githubId = 66913205;
+    name = "Rick Sanchez";
+  };
   nixy = {
     email = "nixy@nixy.moe";
     github = "nixy";
@@ -10186,6 +10192,12 @@
     email = "vq@erq.se";
     name = "Daniel Nilsson";
   };
+  vrinek = {
+    email = "vrinek@hey.com";
+    github = "vrinek";
+    name = "Kostas Karachalios";
+    githubId = 81346;
+  };
   vrthra = {
     email = "rahul@gopinath.org";
     github = "vrthra";
@@ -10800,6 +10812,12 @@
     githubId = 3674056;
     name = "Asad Saeeduddin";
   };
+  matthewcroughan = {
+    email = "matt@croughan.sh";
+    github = "matthewcroughan";
+    githubId = 26458780;
+    name = "Matthew Croughan";
+  };
   ngerstle = {
     name = "Nicholas Gerstle";
     email = "ngerstle@gmail.com";

nixos/doc/manual/Makefile

@@ -1,5 +1,5 @@
 .PHONY: all
-all: manual-combined.xml format
+all: manual-combined.xml
 
 .PHONY: debug
 debug: generated manual-combined.xml

nixos/doc/manual/development/writing-documentation.xml

@@ -25,7 +25,8 @@
 
 <screen>
 <prompt>$ </prompt>cd /path/to/nixpkgs/nixos/doc/manual
-<prompt>$ </prompt>make
+<prompt>$ </prompt>nix-shell
+<prompt>nix-shell$ </prompt>make
 </screen>
 
   <para>

nixos/doc/manual/release-notes/rl-2105.xml

@@ -720,8 +720,8 @@ environment.systemPackages = [
     </para>
 
     <para>
-     Aditionally to the much stricter runtime environmet the
+     Additionally to the much stricter runtime environment the
-     <literal>/dev/urandom</literal> mount lines we previously had in the code (that would
+     <literal>/dev/urandom</literal> mount lines we previously had in the code (that
      randomly failed during the stop-phase) have been removed as systemd will take care of those for us.
     </para>
 
@@ -809,7 +809,7 @@ environment.systemPackages = [
    <listitem>
     <para>
      Platforms, like <varname>stdenv.hostPlatform</varname>, no longer have a <varname>platform</varname> attribute.
-     It has been (mostly) flattoned away:
+     It has been (mostly) flattened away:
     </para>
     <itemizedlist>
      <listitem><para><varname>platform.gcc</varname> is now <varname>gcc</varname></para></listitem>

nixos/maintainers/scripts/gce/create-gce.sh

@@ -17,7 +17,19 @@ nix-build '<nixpkgs/nixos/lib/eval-config.nix>' \
 img_path=$(echo gce/*.tar.gz)
 img_name=${IMAGE_NAME:-$(basename "$img_path")}
 img_id=$(echo "$img_name" | sed 's|.raw.tar.gz$||;s|\.|-|g;s|_|-|g')
+img_family=$(echo "$img_id" | cut -d - -f1-4)
+
 if ! gsutil ls "gs://${BUCKET_NAME}/$img_name"; then
   gsutil cp "$img_path" "gs://${BUCKET_NAME}/$img_name"
   gsutil acl ch -u AllUsers:R "gs://${BUCKET_NAME}/$img_name"
+
+  gcloud compute images create \
+    "$img_id" \
+    --source-uri "gs://${BUCKET_NAME}/$img_name" \
+    --family="$img_family"
+
+  gcloud compute images add-iam-policy-binding \
+    "$img_id" \
+    --member='allAuthenticatedUsers' \
+    --role='roles/compute.imageUser'
 fi

nixos/modules/module-list.nix

@@ -682,6 +682,7 @@
   ./services/networking/i2p.nix
   ./services/networking/icecream/scheduler.nix
   ./services/networking/icecream/daemon.nix
+  ./services/networking/inspircd.nix
   ./services/networking/iodine.nix
   ./services/networking/iperf3.nix
   ./services/networking/ircd-hybrid/default.nix

nixos/modules/programs/less.nix

@@ -40,7 +40,7 @@ in
       configFile = mkOption {
         type = types.nullOr types.path;
         default = null;
-        example = literalExample "$${pkgs.my-configs}/lesskey";
+        example = literalExample "\${pkgs.my-configs}/lesskey";
         description = ''
           Path to lesskey configuration file.
 

nixos/modules/security/acme.nix

@@ -24,7 +24,7 @@ let
       Type = "oneshot";
       User = "acme";
       Group = mkDefault "acme";
-      UMask = 0023;
+      UMask = 0022;
       StateDirectoryMode = 750;
       ProtectSystem = "full";
       PrivateTmp = true;
@@ -303,9 +303,15 @@ let
         }
 
         ${optionalString (data.webroot != null) ''
-          # Ensure the webroot exists
+          # Ensure the webroot exists. Fixing group is required in case configuration was changed between runs.
-          mkdir -p '${data.webroot}/.well-known/acme-challenge'
+          # Lego will fail if the webroot does not exist at all.
-          chown 'acme:${data.group}' ${data.webroot}/{.well-known,.well-known/acme-challenge}
+          (
+            mkdir -p '${data.webroot}/.well-known/acme-challenge' \
+            && chgrp '${data.group}' ${data.webroot}/.well-known/acme-challenge
+          ) || (
+            echo 'Please ensure ${data.webroot}/.well-known/acme-challenge exists and is writable by acme:${data.group}' \
+            && exit 1
+          )
         ''}
 
         echo '${domainHash}' > domainhash.txt

nixos/modules/services/networking/bird.nix

@@ -1,7 +1,7 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (lib) mkEnableOption mkIf mkOption types;
+  inherit (lib) mkEnableOption mkIf mkOption optionalString types;
 
   generic = variant:
     let
@@ -26,6 +26,14 @@ let
               <link xlink:href='http://bird.network.cz/'/>
             '';
           };
+          checkConfig = mkOption {
+            type = types.bool;
+            default = true;
+            description = ''
+              Whether the config should be checked at build time.
+              Disabling this might become necessary if the config includes files not present during build time.
+            '';
+          };
         };
       };
 
@@ -36,7 +44,7 @@ let
         environment.etc."bird/${variant}.conf".source = pkgs.writeTextFile {
           name = "${variant}.conf";
           text = cfg.config;
-          checkPhase = ''
+          checkPhase = optionalString cfg.checkConfig ''
             ${pkg}/bin/${birdBin} -d -p -c $out
           '';
         };
@@ -50,7 +58,7 @@ let
             Type = "forking";
             Restart = "on-failure";
             ExecStart = "${pkg}/bin/${birdBin} -c /etc/bird/${variant}.conf -u ${variant} -g ${variant}";
-            ExecReload = "${pkg}/bin/${birdc} configure";
+            ExecReload = "/bin/sh -c '${pkg}/bin/${birdBin} -c /etc/bird/${variant}.conf -p && ${pkg}/bin/${birdc} configure'";
             ExecStop = "${pkg}/bin/${birdc} down";
             CapabilityBoundingSet = [ "CAP_CHOWN" "CAP_FOWNER" "CAP_DAC_OVERRIDE" "CAP_SETUID" "CAP_SETGID"
                                       # see bird/sysdep/linux/syspriv.h

nixos/modules/services/networking/cjdns.nix

@@ -245,7 +245,7 @@ in
         fi
 
         if [ -z "$CJDNS_ADMIN_PASSWORD" ]; then
-            echo "CJDNS_ADMIN_PASSWORD=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 96)" \
+            echo "CJDNS_ADMIN_PASSWORD=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 32)" \
                 >> /etc/cjdns.keys
         fi
       '';

nixos/modules/services/networking/inspircd.nix

@@ -0,0 +1,62 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.inspircd;
+
+  configFile = pkgs.writeText "inspircd.conf" cfg.config;
+
+in {
+  meta = {
+    maintainers = [ lib.maintainers.sternenseemann ];
+  };
+
+  options = {
+    services.inspircd = {
+      enable = lib.mkEnableOption "InspIRCd";
+
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.inspircd;
+        defaultText = lib.literalExample "pkgs.inspircd";
+        example = lib.literalExample "pkgs.inspircdMinimal";
+        description = ''
+          The InspIRCd package to use. This is mainly useful
+          to specify an overridden version of the
+          <literal>pkgs.inspircd</literal> dervivation, for
+          example if you want to use a more minimal InspIRCd
+          distribution with less modules enabled or with
+          modules enabled which can't be distributed in binary
+          form due to licensing issues.
+        '';
+      };
+
+      config = lib.mkOption {
+        type = lib.types.lines;
+        description = ''
+          Verbatim <literal>inspircd.conf</literal> file.
+          For a list of options, consult the
+          <link xlink:href="https://docs.inspircd.org/3/configuration/">InspIRCd documentation</link>, the
+          <link xlink:href="https://docs.inspircd.org/3/modules/">Module documentation</link>
+          and the example configuration files distributed
+          with <literal>pkgs.inspircd.doc</literal>
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.inspircd = {
+      description = "InspIRCd - the stable, high-performance and modular Internet Relay Chat Daemon";
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "network.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = ''
+          ${lib.getBin cfg.package}/bin/inspircd start --config ${configFile} --nofork --nopid
+        '';
+        DynamicUser = true;
+      };
+    };
+  };
+}

nixos/modules/services/networking/wireguard.nix

@@ -238,7 +238,7 @@ let
         wantedBy = [ "wireguard-${name}.service" ];
         requiredBy = [ "wireguard-${name}.service" ];
         before = [ "wireguard-${name}.service" ];
-        path = with pkgs; [ wireguard ];
+        path = with pkgs; [ wireguard-tools ];
 
         serviceConfig = {
           Type = "oneshot";

nixos/modules/services/web-apps/mastodon.nix

@@ -43,8 +43,32 @@ let
     LogsDirectoryMode = "0750";
     # Access write directories
     UMask = "0027";
+    # Capabilities
+    CapabilityBoundingSet = "";
+    # Security
+    NoNewPrivileges = true;
     # Sandboxing
+    ProtectSystem = "strict";
+    ProtectHome = true;
     PrivateTmp = true;
+    PrivateDevices = true;
+    PrivateUsers = true;
+    ProtectClock = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectControlGroups = true;
+    RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" "AF_NETLINK" ];
+    RestrictNamespaces = true;
+    LockPersonality = true;
+    MemoryDenyWriteExecute = false;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    PrivateMounts = true;
+    # System Call Filtering
+    SystemCallArchitectures = "native";
+    SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @reboot @resources @setuid @swap";
   };
 
   envFile = pkgs.writeText "mastodon.env" (lib.concatMapStrings (s: s + "\n") (

nixos/modules/system/boot/stage-2-init.sh

@@ -167,6 +167,7 @@ exec {logOutFd}>&- {logErrFd}>&-
 
 # Start systemd.
 echo "starting systemd..."
+
 PATH=/run/current-system/systemd/lib/systemd:@fsPackagesPath@ \
-    LOCALE_ARCHIVE=/run/current-system/sw/lib/locale/locale-archive \
+    LOCALE_ARCHIVE=/run/current-system/sw/lib/locale/locale-archive @systemdUnitPathEnvVar@ \
     exec @systemdExecutable@

nixos/modules/system/boot/stage-2.nix

@@ -10,7 +10,7 @@ let
     src = ./stage-2-init.sh;
     shellDebug = "${pkgs.bashInteractive}/bin/bash";
     shell = "${pkgs.bash}/bin/bash";
-    inherit (config.boot) systemdExecutable;
+    inherit (config.boot) systemdExecutable extraSystemdUnitPaths;
     isExecutable = true;
     inherit (config.nix) readOnlyStore;
     inherit useHostResolvConf;
@@ -20,6 +20,10 @@ let
       pkgs.util-linux
     ] ++ lib.optional useHostResolvConf pkgs.openresolv);
     fsPackagesPath = lib.makeBinPath config.system.fsPackages;
+    systemdUnitPathEnvVar = lib.optionalString (config.boot.extraSystemdUnitPaths != [])
+      ("SYSTEMD_UNIT_PATH="
+      + builtins.concatStringsSep ":" config.boot.extraSystemdUnitPaths
+      + ":"); # If SYSTEMD_UNIT_PATH ends with an empty component (":"), the usual unit load path will be appended to the contents of the variable
     postBootCommands = pkgs.writeText "local-cmds"
       ''
         ${config.boot.postBootCommands}
@@ -82,6 +86,15 @@ in
           PATH.
         '';
       };
+
+      extraSystemdUnitPaths = mkOption {
+        default = [];
+        type = types.listOf types.str;
+        description = ''
+          Additional paths that get appended to the SYSTEMD_UNIT_PATH environment variable
+          that can contain mutable unit files.
+        '';
+      };
     };
 
   };

nixos/modules/system/boot/systemd.nix

@@ -175,8 +175,10 @@ let
       "timers.target.wants"
     ];
 
-  upstreamUserUnits =
+    upstreamUserUnits = [
-    [ "basic.target"
+      "app.slice"
+      "background.slice"
+      "basic.target"
       "bluetooth.target"
       "default.target"
       "exit.target"
@@ -184,6 +186,7 @@ let
       "graphical-session.target"
       "paths.target"
       "printer.target"
+      "session.slice"
       "shutdown.target"
       "smartcard.target"
       "sockets.target"
@@ -193,6 +196,7 @@ let
       "systemd-tmpfiles-clean.timer"
       "systemd-tmpfiles-setup.service"
       "timers.target"
+      "xdg-desktop-autostart.target"
     ];
 
   makeJobScript = name: text:

nixos/modules/virtualisation/gce-images.nix

@@ -5,5 +5,13 @@ let self = {
   "17.03" = "gs://nixos-cloud-images/nixos-image-17.03.1082.4aab5c5798-x86_64-linux.raw.tar.gz";
   "18.03" = "gs://nixos-cloud-images/nixos-image-18.03.132536.fdb5ba4cdf9-x86_64-linux.raw.tar.gz";
   "18.09" = "gs://nixos-cloud-images/nixos-image-18.09.1228.a4c4cbb613c-x86_64-linux.raw.tar.gz";
-  latest = self."18.09";
+
+  # This format will be handled by the upcoming NixOPS 2.0 release.
+  # The old images based on a GS object are deprecated.
+  "20.09" = {
+    project = "nixos-cloud";
+    name = "nixos-image-20-09-3531-3858fbc08e6-x86-64-linux";
+  };
+
+  latest = self."20.09";
 }; in self

nixos/tests/acme.nix

@@ -253,7 +253,7 @@ in import ./make-test-python.nix ({ lib, ... }: {
 
 
       def check_connection(node, domain, retries=3):
-          assert retries >= 0
+          assert retries >= 0, f"Failed to connect to https://{domain}"
 
           result = node.succeed(
               "openssl s_client -brief -verify 2 -CAfile /tmp/ca.crt"
@@ -262,12 +262,12 @@ in import ./make-test-python.nix ({ lib, ... }: {
 
           for line in result.lower().split("\n"):
               if "verification" in line and "error" in line:
-                  time.sleep(1)
+                  time.sleep(3)
                   return check_connection(node, domain, retries - 1)
 
 
       def check_connection_key_bits(node, domain, bits, retries=3):
-          assert retries >= 0
+          assert retries >= 0, f"Did not find expected number of bits ({bits}) in key"
 
           result = node.succeed(
               "openssl s_client -CAfile /tmp/ca.crt"
@@ -277,12 +277,12 @@ in import ./make-test-python.nix ({ lib, ... }: {
           print("Key type:", result)
 
           if bits not in result:
-              time.sleep(1)
+              time.sleep(3)
               return check_connection_key_bits(node, domain, bits, retries - 1)
 
 
       def check_stapling(node, domain, retries=3):
-          assert retries >= 0
+          assert retries >= 0, "OCSP Stapling check failed"
 
           # Pebble doesn't provide a full OCSP responder, so just check the URL
           result = node.succeed(
@@ -293,10 +293,23 @@ in import ./make-test-python.nix ({ lib, ... }: {
           print("OCSP Responder URL:", result)
 
           if "${caDomain}:4002" not in result.lower():
-              time.sleep(1)
+              time.sleep(3)
               return check_stapling(node, domain, retries - 1)
 
 
+      def download_ca_certs(node, retries=5):
+          assert retries >= 0, "Failed to connect to pebble to download root CA certs"
+
+          exit_code, _ = node.execute("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt")
+          exit_code_2, _ = node.execute(
+              "curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt"
+          )
+
+          if exit_code + exit_code_2 > 0:
+              time.sleep(3)
+              return download_ca_certs(node, retries - 1)
+
+
       client.start()
       dnsserver.start()
 
@@ -313,8 +326,7 @@ in import ./make-test-python.nix ({ lib, ... }: {
       acme.wait_for_unit("network-online.target")
       acme.wait_for_unit("pebble.service")
 
-      client.succeed("curl https://${caDomain}:15000/roots/0 > /tmp/ca.crt")
+      download_ca_certs(client)
-      client.succeed("curl https://${caDomain}:15000/intermediate-keys/0 >> /tmp/ca.crt")
 
       with subtest("Can request certificate with HTTPS-01 challenge"):
           webserver.wait_for_unit("acme-finished-a.example.test.target")
@@ -322,6 +334,21 @@ in import ./make-test-python.nix ({ lib, ... }: {
           check_issuer(webserver, "a.example.test", "pebble")
           check_connection(client, "a.example.test")
 
+      with subtest("Certificates and accounts have safe + valid permissions"):
+          group = "${nodes.webserver.config.security.acme.certs."a.example.test".group}"
+          webserver.succeed(
+              f"test $(stat -L -c \"%a %U %G\" /var/lib/acme/a.example.test/* | tee /dev/stderr | grep '640 acme {group}' | wc -l) -eq 5"
+          )
+          webserver.succeed(
+              f"test $(stat -L -c \"%a %U %G\" /var/lib/acme/.lego/a.example.test/**/* | tee /dev/stderr | grep '640 acme {group}' | wc -l) -eq 5"
+          )
+          webserver.succeed(
+              f"test $(stat -L -c \"%a %U %G\" /var/lib/acme/a.example.test | tee /dev/stderr | grep '750 acme {group}' | wc -l) -eq 1"
+          )
+          webserver.succeed(
+              f"test $(find /var/lib/acme/accounts -type f -exec stat -L -c \"%a %U %G\" {{}} \\; | tee /dev/stderr | grep -v '600 acme {group}' | wc -l) -eq 0"
+          )
+
       with subtest("Can generate valid selfsigned certs"):
           webserver.succeed("systemctl clean acme-a.example.test.service --what=state")
           webserver.succeed("systemctl start acme-selfsigned-a.example.test.service")
@@ -375,8 +402,15 @@ in import ./make-test-python.nix ({ lib, ... }: {
           assert keyhash_old == keyhash_new
 
       with subtest("Can request certificates for vhost + aliases (apache-httpd)"):
-          switch_to(webserver, "httpd-aliases")
+          try:
-          webserver.wait_for_unit("acme-finished-c.example.test.target")
+              switch_to(webserver, "httpd-aliases")
+              webserver.wait_for_unit("acme-finished-c.example.test.target")
+          except Exception as err:
+              _, output = webserver.execute(
+                  "cat /var/log/httpd/*.log && ls -al /var/lib/acme/acme-challenge"
+              )
+              print(output)
+              raise err
           check_issuer(webserver, "c.example.test", "pebble")
           check_connection(client, "c.example.test")
           check_connection(client, "d.example.test")

nixos/tests/all-tests.nix

@@ -176,6 +176,7 @@ in
   initrd-network-ssh = handleTest ./initrd-network-ssh {};
   initrdNetwork = handleTest ./initrd-network.nix {};
   initrd-secrets = handleTest ./initrd-secrets.nix {};
+  inspircd = handleTest ./inspircd.nix {};
   installer = handleTest ./installer.nix {};
   iodine = handleTest ./iodine.nix {};
   ipfs = handleTest ./ipfs.nix {};
@@ -393,6 +394,7 @@ in
   systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix {};
   systemd-nspawn = handleTest ./systemd-nspawn.nix {};
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
+  systemd-unit-path = handleTest ./systemd-unit-path.nix {};
   taskserver = handleTest ./taskserver.nix {};
   telegraf = handleTest ./telegraf.nix {};
   tiddlywiki = handleTest ./tiddlywiki.nix {};

nixos/tests/docker-tools.nix

@@ -161,12 +161,18 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             "docker run --rm ${examples.layered-image.imageName} cat extraCommands",
         )
 
-    with subtest("Ensure building an image on top of a layered Docker images work"):
+    with subtest("Ensure images built on top of layered Docker images work"):
         docker.succeed(
             "docker load --input='${examples.layered-on-top}'",
             "docker run --rm ${examples.layered-on-top.imageName}",
         )
 
+    with subtest("Ensure layered images built on top of layered Docker images work"):
+        docker.succeed(
+            "docker load --input='${examples.layered-on-top-layered}'",
+            "docker run --rm ${examples.layered-on-top-layered.imageName}",
+        )
+
 
     def set_of_layers(image_name):
         return set(
@@ -205,6 +211,31 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         assert "FROM_CHILD=true" in env, "envvars from the child should be preserved"
         assert "LAST_LAYER=child" in env, "envvars from the child should take priority"
 
+    with subtest("Ensure environment variables of layered images are correctly inherited"):
+        docker.succeed(
+            "docker load --input='${examples.environmentVariablesLayered}'"
+        )
+        out = docker.succeed("docker run --rm ${examples.environmentVariablesLayered.imageName} env")
+        env = out.splitlines()
+        assert "FROM_PARENT=true" in env, "envvars from the parent should be preserved"
+        assert "FROM_CHILD=true" in env, "envvars from the child should be preserved"
+        assert "LAST_LAYER=child" in env, "envvars from the child should take priority"
+
+    with subtest(
+        "Ensure inherited environment variables of layered images are correctly resolved"
+    ):
+        # Read environment variables as stored in image config
+        config = docker.succeed(
+            "tar -xOf ${examples.environmentVariablesLayered} manifest.json | ${pkgs.jq}/bin/jq -r .[].Config"
+        ).strip()
+        out = docker.succeed(
+            f"tar -xOf ${examples.environmentVariablesLayered} {config} | ${pkgs.jq}/bin/jq -r '.config.Env | .[]'"
+        )
+        env = out.splitlines()
+        assert (
+            sum(entry.startswith("LAST_LAYER") for entry in env) == 1
+        ), "envvars overridden by child should be unique"
+
     with subtest("Ensure image with only 2 layers can be loaded"):
         docker.succeed(
             "docker load --input='${examples.two-layered-image}'"
@@ -219,6 +250,18 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             "docker run bulk-layer ls /bin/hello",
         )
 
+    with subtest(
+        "Ensure the bulk layer with a base image respects the number of maxLayers"
+    ):
+        docker.succeed(
+            "docker load --input='${pkgs.dockerTools.examples.layered-bulk-layer}'",
+            # Ensure the image runs correctly
+            "docker run layered-bulk-layer ls /bin/hello",
+        )
+
+        # Ensure the image has the correct number of layers
+        assert len(set_of_layers("layered-bulk-layer")) == 4
+
     with subtest("Ensure correct behavior when no store is needed"):
         # This check tests that buildLayeredImage can build images that don't need a store.
         docker.succeed(

nixos/tests/inspircd.nix

@@ -0,0 +1,93 @@
+let
+  clients = [
+    "ircclient1"
+    "ircclient2"
+  ];
+  server = "inspircd";
+  ircPort = 6667;
+  channel = "nixos-cat";
+  iiDir = "/tmp/irc";
+in
+
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "inspircd";
+  nodes = {
+    "${server}" = {
+      networking.firewall.allowedTCPPorts = [ ircPort ];
+      services.inspircd = {
+        enable = true;
+        package = pkgs.inspircdMinimal;
+        config = ''
+          <bind address="" port="${toString ircPort}" type="clients">
+          <connect name="main" allow="*" pingfreq="15">
+        '';
+      };
+    };
+  } // lib.listToAttrs (builtins.map (client: lib.nameValuePair client {
+    imports = [
+      ./common/user-account.nix
+    ];
+
+    systemd.services.ii = {
+      requires = [ "network.target" ];
+      wantedBy = [ "default.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        ExecPreStartPre = "mkdir -p ${iiDir}";
+        ExecStart = ''
+          ${lib.getBin pkgs.ii}/bin/ii -n ${client} -s ${server} -i ${iiDir}
+        '';
+        User = "alice";
+      };
+    };
+  }) clients);
+
+  testScript =
+    let
+      msg = client: "Hello, my name is ${client}";
+      clientScript = client: [
+        ''
+          ${client}.wait_for_unit("network.target")
+          ${client}.systemctl("start ii")
+          ${client}.wait_for_unit("ii")
+          ${client}.wait_for_file("${iiDir}/${server}/out")
+        ''
+        # wait until first PING from server arrives before joining,
+        # so we don't try it too early
+        ''
+          ${client}.wait_until_succeeds("grep 'PING' ${iiDir}/${server}/out")
+        ''
+        # join ${channel}
+        ''
+          ${client}.succeed("echo '/j #${channel}' > ${iiDir}/${server}/in")
+          ${client}.wait_for_file("${iiDir}/${server}/#${channel}/in")
+        ''
+        # send a greeting
+        ''
+          ${client}.succeed(
+              "echo '${msg client}' > ${iiDir}/${server}/#${channel}/in"
+          )
+        ''
+        # check that all greetings arrived on all clients
+      ] ++ builtins.map (other: ''
+        ${client}.succeed(
+            "grep '${msg other}$' ${iiDir}/${server}/#${channel}/out"
+        )
+      '') clients;
+
+      # foldl', but requires a non-empty list instead of a start value
+      reduce = f: list:
+        builtins.foldl' f (builtins.head list) (builtins.tail list);
+    in ''
+      start_all()
+      ${server}.wait_for_open_port(${toString ircPort})
+
+      # run clientScript for all clients so that every list
+      # entry is executed by every client before advancing
+      # to the next one.
+    '' + lib.concatStrings
+      (reduce
+        (lib.zipListsWith (cs: c: cs + c))
+        (builtins.map clientScript clients));
+})

nixos/tests/systemd-unit-path.nix

@@ -0,0 +1,47 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+let
+  exampleScript = pkgs.writeTextFile {
+    name = "example.sh";
+    text = ''
+      #! ${pkgs.runtimeShell} -e
+
+      while true; do
+          echo "Example script running" >&2
+          ${pkgs.coreutils}/bin/sleep 1
+      done
+    '';
+    executable = true;
+  };
+
+  unitFile = pkgs.writeTextFile {
+    name = "example.service";
+    text = ''
+      [Unit]
+      Description=Example systemd service unit file
+
+      [Service]
+      ExecStart=${exampleScript}
+
+      [Install]
+      WantedBy=multi-user.target
+    '';
+  };
+in
+{
+  name = "systemd-unit-path";
+
+  machine = { pkgs, lib, ... }: {
+    boot.extraSystemdUnitPaths = [ "/etc/systemd-rw/system" ];
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("mkdir -p /etc/systemd-rw/system")
+    machine.succeed(
+        "cp ${unitFile} /etc/systemd-rw/system/example.service"
+    )
+    machine.succeed("systemctl start example.service")
+    machine.succeed("systemctl status example.service | grep 'Active: active'")
+  '';
+})

pkgs/applications/audio/clementine/default.nix

@@ -10,7 +10,7 @@ let
   withCD = config.clementine.cd or true;
   withCloud = config.clementine.cloud or true;
 
-  # On the update after all 1.4rc, qt5.15 will be supported.
+  # On the update after all 1.4rc, qt5.15 and protobuf 3.15 will be supported.
   version = "1.4.0rc1";
 
   src = fetchFromGitHub {

pkgs/applications/audio/clerk/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper, rofi, mpc_cli, perl,
-util-linux, pythonPackages, libnotify }:
+util-linux, python3Packages, libnotify }:
 
 stdenv.mkDerivation {
   name = "clerk-2016-10-14";
@@ -12,10 +12,12 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ pythonPackages.mpd2 ];
+  buildInputs = [ python3Packages.mpd2 ];
 
   dontBuild = true;
 
+  strictDeps = true;
+
   installPhase = ''
     DESTDIR=$out PREFIX=/ make install
     wrapProgram $out/bin/clerk \

pkgs/applications/audio/helio-workstation/default.nix

@@ -5,14 +5,14 @@
 
 stdenv.mkDerivation rec {
   pname = "helio-workstation";
-  version = "3.3";
+  version = "3.4";
 
   src = fetchFromGitHub {
     owner = "helio-fm";
     repo = pname;
     rev = version;
     fetchSubmodules = true;
-    sha256 = "sha256-meeNqV1jKUwWc7P3p/LicPsbpzpKKFmQ1wP9DuXc9NY=";
+    sha256 = "sha256-zXsDu/xi7OV6VtnZK9ZJ8uwPeA5uTgNpAQsqe90iwG4=";
   };
 
   buildInputs = [

pkgs/applications/audio/jamulus/default.nix

@@ -1,14 +1,14 @@
-{ mkDerivation, lib, fetchFromGitHub, fetchpatch, pkg-config, qtscript, qmake, libjack2
+{ mkDerivation, lib, fetchFromGitHub, pkg-config, qtscript, qmake, libjack2
 }:
 
 mkDerivation rec {
   pname = "jamulus";
-  version = "3.6.2";
+  version = "3.7.0";
   src = fetchFromGitHub {
-    owner = "corrados";
+    owner = "jamulussoftware";
     repo = "jamulus";
     rev = "r${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-b187Q8KXcU32C2hGFqs6R2CqWgmieq6ewQDx+elEgP4=";
+    sha256 = "sha256-8zCPT0jo4ExgmZWxGinumv3JauH4csM9DtuHmOiJQAM=";
   };
 
   nativeBuildInputs = [ pkg-config qmake ];
@@ -20,7 +20,7 @@ mkDerivation rec {
     description = "Enables musicians to perform real-time jam sessions over the internet";
     longDescription = "You also need to enable JACK and should enable several real-time optimizations. See project website for details";
     homepage = "https://github.com/corrados/jamulus/wiki";
-    license = lib.licenses.gpl2; # linked in git repo, at least
+    license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.seb314 ];
   };

pkgs/applications/audio/openmpt123/default.nix

@@ -2,14 +2,14 @@
 , usePulseAudio ? config.pulseaudio or false, libpulseaudio }:
 
 let
-  version = "0.5.5";
+  version = "0.5.6";
 in stdenv.mkDerivation {
   pname = "openmpt123";
   inherit version;
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "sha256-8eAUg+vxpoDZ7AMMmvIPXypawPHgZCwYvVWTz6qc62s=";
+    sha256 = "sha256-F96ngrM0wUb0rNlIx8Mf/dKvyJnrNH6+Ab4WBup59Lg=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/audio/spotify/default.nix

@@ -1,7 +1,7 @@
 { fetchurl, lib, stdenv, squashfsTools, xorg, alsaLib, makeWrapper, openssl, freetype
-, glib, pango, cairo, atk, gdk-pixbuf, gtk2, cups, nspr, nss, libpng, libnotify
+, glib, pango, cairo, atk, gdk-pixbuf, gtk3, cups, nspr, nss, libpng, libnotify
 , libgcrypt, systemd, fontconfig, dbus, expat, ffmpeg_3, curl, zlib, gnome3
-, at-spi2-atk, at-spi2-core, libpulseaudio, libdrm, mesa
+, at-spi2-atk, at-spi2-core, libpulseaudio, libdrm, mesa, libxkbcommon
 }:
 
 let
@@ -10,14 +10,14 @@ let
   # If an update breaks things, one of those might have valuable info:
   # https://aur.archlinux.org/packages/spotify/
   # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.1.46.916.g416cacf1";
+  version = "1.1.55.494.gca75f788";
   # To get the latest stable revision:
   # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
   # To get general information:
   # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
   # More examples of api usage:
   # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "43";
+  rev = "45";
 
   deps = [
     alsaLib
@@ -34,12 +34,13 @@ let
     freetype
     gdk-pixbuf
     glib
-    gtk2
+    gtk3
     libdrm
     libgcrypt
     libnotify
     libpng
     libpulseaudio
+    libxkbcommon
     mesa
     nss
     pango
@@ -78,11 +79,10 @@ stdenv.mkDerivation {
   # https://community.spotify.com/t5/Desktop-Linux/Redistribute-Spotify-on-Linux-Distributions/td-p/1695334
   src = fetchurl {
     url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    sha512 = "5b3d5d1f52a554c8e775b8aed16ef84e96bf3b61a2b53266e10d3c47e341899310af13cc8513b04424fc14532e36543a6fae677f80a036e3f51c75166d8d53d1";
+    sha512 = "5d61a2d5b26be651620ab5d18d3a204d8d7b09dcec8a733ddc176c44cb43e9176c4350933ebe4498b065ba219113f3226c13bea9659da738fe635f41d01db303";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper squashfsTools ];
-  buildInputs = [ squashfsTools ];
 
   dontStrip = true;
   dontPatchELF = true;

pkgs/applications/backup/pika-backup/default.nix

@@ -19,20 +19,20 @@
 
 stdenv.mkDerivation rec {
   pname = "pika-backup";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "pika-backup";
     rev = "v${version}";
-    sha256 = "0fm6vwpw0pa98v2yn8p3818rrlv9lk3pmgnal1b2kh52im5ll7m8";
+    sha256 = "16284gv31wdwmb99056962d1gh6xz26ami6synr47nsbbp5l0s6k";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    sha256 = "1f5s6a0wjrs2spsicirhbvb5xlz9iflwsaqchij9k02hfcsr308y";
+    sha256 = "12ymjwpxx3sdna8w5j9fnwwfk8ynk9ziwl0lkpq68y0vyllln5an";
   };
 
   patches = [

pkgs/applications/blockchains/btcpayserver/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, fetchurl, linkFarmFromDrvs, makeWrapper,
-  dotnetPackages, dotnetCorePackages, writeScript, bash
+  dotnetPackages, dotnetCorePackages
 }:
 
 let
@@ -15,13 +15,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "btcpayserver";
-  version = "1.0.6.8";
+  version = "1.0.7.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1znmix9w7ahzyb933lxzqv6j8j5qycknq3gmnkakj749ksshql1b";
+    sha256 = "1pbq0kik29sx1lwlic7fvhnjhrpnlk94w53wmywqnlpgjscx8x8a";
   };
 
   nativeBuildInputs = [ dotnetSdk dotnetPackages.Nuget makeWrapper ];

pkgs/applications/blockchains/btcpayserver/deps.nix

@@ -19,6 +19,11 @@
     version = "3.3.110.10";
     sha256 = "1lf1hfbx792dpa1hxgn0a0jrrvldd16hgbxx229dk2qcz5qlnc38";
   })
+  (fetchNuGet {
+    name = "BIP78.Sender";
+    version = "0.2.0";
+    sha256 = "0gyynn15rc1x9p2703ffi4jnbpbd0k3wvg839xrk2skmaw8nxamf";
+  })
   (fetchNuGet {
     name = "BTCPayServer.Hwi";
     version = "1.1.3";
@@ -26,38 +31,43 @@
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.All";
-    version = "1.2.4";
+    version = "1.2.7";
-    sha256 = "1f4wgs8ijk1wmppz5lmas7l6m83szz57jyk6ak0dxhccdld9rdaj";
+    sha256 = "0jzmzvlpf6iba2fsc6cyi69vlaim9slqm2sapknmd7drl3gcn2zj";
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.Charge";
-    version = "1.2.1";
+    version = "1.2.3";
-    sha256 = "0iv9frbr6xfxif3pnfd7c87y8mv31nqkdrnhvnaswrx43nv6s272";
+    sha256 = "1rdrwmijx0v4z0xsq4acyvdcj7hv6arfh3hwjy89rqnkkznrzgwv";
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.CLightning";
-    version = "1.2.1";
+    version = "1.2.3";
-    sha256 = "14km69jzmnyqg19w27g6znml4z0xkm8l4j7rj0x36bw67cjmgahv";
+    sha256 = "02197rh03q8d0mv40zf67wp1rd2gbxi5l8krd2rzj84n267bcfvc";
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.Common";
     version = "1.2.0";
     sha256 = "17di8ndkw8z0ci0zk15mcrqpmganwkz9ys2snr2rqpw5mrlhpwa0";
   })
+  (fetchNuGet {
+    name = "BTCPayServer.Lightning.Common";
+    version = "1.2.2";
+    sha256 = "07xb7fsqvfjmcawxylriw60i73h0cvfb765aznhp9ffyrmjaql7z";
+  })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.Eclair";
-    version = "1.2.0";
+    version = "1.2.2";
-    sha256 = "0w7nwsr0n2hrqak023xa294palsk3r96wlgw2ks8d3p5kxm8kskp";
+    sha256 = "03dymhwxb5s28kb187g5h4aysnz2xzml89p47nmwz9lkg2h4s73h";
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.LND";
-    version = "1.2.1";
+    version = "1.2.4";
-    sha256 = "0ql4qyvz0rms6ls46pi3bgak3r6hj2c5ivnzahiq6cb84pbl61cr";
+    sha256 = "0qnj5rsp6hnybsr58zny9dfbsxksg1674q0z9944jwkzm7pcqyg4";
   })
   (fetchNuGet {
     name = "BTCPayServer.Lightning.Ptarmigan";
-    version = "1.2.0";
+    version = "1.2.2";
-    sha256 = "1yd6nhlssb9k08p5491knlwwjij9324ildir99sa9cp24rlq5nis";
+    sha256 = "17yl85vqfp7l12bv3f3w1b861hm41i7cfhs78gaq04s4drvcnj6k";
   })
   (fetchNuGet {
     name = "BuildBundlerMinifier";
@@ -79,11 +89,6 @@
     version = "15.0.5";
     sha256 = "01y8bhsnxghn3flz0pr11vj6wjrpmia8rpdrsp7kjfc1zmhqlgma";
   })
-  (fetchNuGet {
-    name = "DBriize";
-    version = "1.0.1.3";
-    sha256 = "0rsm68hwq2ky8i6mv3ckdjkj4vjygnkgk3disva0skl3apk833dc";
-  })
   (fetchNuGet {
     name = "DigitalRuby.ExchangeSharp";
     version = "0.6.3";
@@ -666,13 +671,8 @@
   })
   (fetchNuGet {
     name = "NBitcoin.Altcoins";
-    version = "2.0.21";
+    version = "2.0.28";
-    sha256 = "0xmygiwjlia7fbxy63893jb15g6fxggxxr9bbm8znd9bs3jzp2g1";
+    sha256 = "1zfirfmhgigp733km9rqkgz560h5wg88bpba499x49h5j650cnn4";
-  })
-  (fetchNuGet {
-    name = "NBitcoin";
-    version = "5.0.33";
-    sha256 = "030q609b9lhapq4wfl1w3impjw5m40kz2rg1s9jn3bn8yjfmsi4a";
   })
   (fetchNuGet {
     name = "NBitcoin";
@@ -686,13 +686,13 @@
   })
   (fetchNuGet {
     name = "NBitcoin";
-    version = "5.0.60";
+    version = "5.0.67";
-    sha256 = "0pin4ldfz5lfxyd47mj1ypyp8lmj0v5nq5zvygdjna956vphd39v";
+    sha256 = "049marx1jwr7srlpqspimrqqgahh53gi2iyp7bpzn5npsbzh9v3h";
   })
   (fetchNuGet {
     name = "NBitcoin";
-    version = "5.0.68";
+    version = "5.0.73";
-    sha256 = "0k275mbp9wannm10pqj4nv8agjc1f6hsrfhl0m6ax1apv81sfxcd";
+    sha256 = "0vqgcb0ws5fnkrdzqfkyh78041c6q4l22b93rr0006dd4bmqrmg1";
   })
   (fetchNuGet {
     name = "NBitpayClient";
@@ -701,8 +701,8 @@
   })
   (fetchNuGet {
     name = "NBXplorer.Client";
-    version = "3.0.19";
+    version = "3.0.20";
-    sha256 = "0nahfxdsryf5snjy87770m51v2jcry02lmb10ilsg4h2ig4pjdk4";
+    sha256 = "1mwa6ncmg5r6q7yn6skm9dgqm631c7r7nadcg9mvbw81113h0xxy";
   })
   (fetchNuGet {
     name = "NETStandard.Library";
@@ -729,11 +729,6 @@
     version = "10.0.3";
     sha256 = "06vy67bkshclpz69kps4vgzc9h2cgg41c8vlqmdbwclfky7c4haq";
   })
-  (fetchNuGet {
-    name = "Newtonsoft.Json";
-    version = "11.0.1";
-    sha256 = "1z68j07if1xf71lbsrgbia52r812i2dv541sy44ph4dzjjp7pd4m";
-  })
   (fetchNuGet {
     name = "Newtonsoft.Json";
     version = "11.0.2";
@@ -921,8 +916,8 @@
   })
   (fetchNuGet {
     name = "Selenium.WebDriver.ChromeDriver";
-    version = "87.0.4280.8800";
+    version = "88.0.4324.9600";
-    sha256 = "1zrizydlhjv81r1fa5g8wzxrx1cxly3ip7pargj48hdx419iblfr";
+    sha256 = "0jm8dpfp329xsrg69lzq2m6x9yin1m43qgrhs15cz2qx9f02pdx9";
   })
   (fetchNuGet {
     name = "Selenium.WebDriver";

pkgs/applications/blockchains/monero/default.nix

@@ -63,6 +63,6 @@ stdenv.mkDerivation rec {
     homepage    = "https://getmonero.org/";
     license     = licenses.bsd3;
     platforms   = platforms.all;
-    maintainers = with maintainers; [ ehmry rnhmjoj ];
+    maintainers = with maintainers; [ rnhmjoj ];
   };
 }

pkgs/applications/display-managers/sddm/default.nix

@@ -1,4 +1,4 @@
-{ mkDerivation, lib, fetchFromGitHub
+{ mkDerivation, lib, fetchFromGitHub, fetchpatch
 , cmake, extra-cmake-modules, pkg-config, libxcb, libpthreadstubs
 , libXdmcp, libXau, qtbase, qtdeclarative, qtquickcontrols2, qttools, pam, systemd
 }:
@@ -19,6 +19,12 @@ in mkDerivation {
 
   patches = [
     ./sddm-ignore-config-mtime.patch
+    # Load `/etc/profile` for `environment.variables` with zsh default shell.
+    # See: https://github.com/sddm/sddm/pull/1382
+    (fetchpatch {
+      url = "https://github.com/sddm/sddm/commit/e1dedeeab6de565e043f26ac16033e613c222ef9.patch";
+      sha256 = "sha256-OPyrUI3bbH+PGDBfoL4Ohb4wIvmy9TeYZhE0JxR/D58=";
+    })
   ];
 
   postPatch =

pkgs/applications/editors/bluefish/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, intltool, wrapGAppsHook, pkg-config , gtk, libxml2
-, enchant, gucharmap, python, gnome3
+, enchant, gucharmap, python3, gnome3
 }:
 
 stdenv.mkDerivation rec {
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ intltool pkg-config wrapGAppsHook ];
   buildInputs = [ gnome3.adwaita-icon-theme gtk libxml2
-    enchant gucharmap python ];
+    enchant gucharmap python3 ];
 
   meta = with lib; {
     description = "A powerful editor targeted towards programmers and webdevelopers";

pkgs/applications/editors/ghostwriter/default.nix

@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "ghostwriter";
-  version = "2.0.0-rc4";
+  version = "2.0.0-rc5";
 
   src = fetchFromGitHub {
     owner = "wereturtle";
     repo = pname;
     rev = version;
-    sha256 = "07547503a209hc0fcg902w3x0s1m899c10nj3gqz3hak0cmrasi3";
+    sha256 = "sha256-Gc0/AHxxJd5Cq3dBQ0Xy2TF78CBmQFYUzm4s7q1aHEE=";
   };
 
   nativeBuildInputs = [ qmake pkg-config qttools ];

pkgs/applications/editors/kakoune/plugins/overrides.nix

@@ -34,13 +34,13 @@ self: super: {
 
   kak-ansi = stdenv.mkDerivation rec {
     pname = "kak-ansi";
-    version = "0.2.1";
+    version = "0.2.3";
 
     src = fetchFromGitHub {
       owner = "eraserhd";
       repo = "kak-ansi";
       rev = "v${version}";
-      sha256 = "0ddjih8hfyf6s4g7y46p1355kklaw1ydzzh61141i0r45wyb2d0d";
+      sha256 = "pO7M3MjKMJQew9O20KALEvsXLuCKPYGGTtuN/q/kj8Q=";
     };
 
     installPhase = ''

pkgs/applications/editors/neovim/neovim-qt.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, mkDerivation, fetchFromGitHub, cmake, doxygen, makeWrapper
+{ lib, mkDerivation, fetchFromGitHub, cmake, doxygen, makeWrapper
 , msgpack, neovim, pythonPackages, qtbase }:
 
 mkDerivation rec {

pkgs/applications/editors/poke/default.nix

@@ -19,11 +19,11 @@ let
   isCross = stdenv.hostPlatform != stdenv.buildPlatform;
 in stdenv.mkDerivation rec {
   pname = "poke";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchurl {
     url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-3pMLhwDAdys8LNDQyjX1D9PXe9+CxiUetRa0noyiWwo=";
+    hash = "sha256-zWjfY8dBtBYLEsvqAvJ8RxWCeUZuNEOTDSU1pFLAatY=";
   };
 
   postPatch = ''

pkgs/applications/editors/textadept/11/default.nix

@@ -1,20 +1,20 @@
-{ lib, stdenv, fetchhg, fetchFromGitHub, fetchurl, gtk2, glib, pkg-config, unzip, ncurses, zip }:
+{ lib, stdenv, fetchFromGitHub, fetchurl, gtk2, glib, pkg-config, unzip, ncurses, zip }:
 
 stdenv.mkDerivation rec {
-  version = "11.0_beta";
+  version = "11.1";
   pname = "textadept11";
 
-  nativeBuildInputs = [ pkg-config unzip ];
+  nativeBuildInputs = [ pkg-config unzip zip ];
   buildInputs = [
-    gtk2 ncurses glib zip
+    gtk2 ncurses glib
   ];
 
   src = fetchFromGitHub {
     name = "textadept11";
     owner = "orbitalquark";
     repo = "textadept";
-    rev = "8da5f6b4a13f14b9dd3cb9dc23ad4f7bf41e91c1";
+    rev = "1df99d561dd2055a01efa9183bb9e1b2ad43babc";
-    sha256 = "0v11v3x8g6v696m3l1bm52zy2g9xzz7hlmn912sn30nhcag3raxs";
+    sha256 = "0g4bh5dp391vi32aa796vszpbxyl2dm5231v9dwc8l9v0b2786qn";
   };
 
   preConfigure =
@@ -40,7 +40,9 @@ stdenv.mkDerivation rec {
   '';
 
   makeFlags = [
-    "PREFIX=$(out) WGET=true PIXMAPS_DIR=$(out)/share/pixmaps"
+    "PREFIX=$(out)"
+    "WGET=true"
+    "PIXMAPS_DIR=$(out)/share/pixmaps"
   ];
 
   meta = with lib; {

pkgs/applications/editors/textadept/11/deps.nix

@@ -3,13 +3,13 @@
       url = "https://www.scintilla.org/scintilla445.tgz";
       sha256 = "1v1kyxj7rv5rxadbg8gl8wh1jafpy7zj0wr6dcyxq9209dl6h8ag";
     };
-    "9e2ffa159299899c9345aea15c17ba1941953871.zip" = {
+    "6a774158d8a3c7bc7ea120bc01cdb016fa351a7e.zip" = {
-      url = "https://github.com/orbitalquark/scinterm/archive/9e2ffa159299899c9345aea15c17ba1941953871.zip";
+      url = "https://github.com/orbitalquark/scinterm/archive/6a774158d8a3c7bc7ea120bc01cdb016fa351a7e.zip";
-      sha256 = "12h7prgp689w45p4scxd8vvsyw8fkv27g6gvgis55xr44daa6122";
+      sha256 = "083xvpw14dxbyrv4i48q76bmr44hs637qv363n6ibfs8xv1kq7iv";
     };
-    "scintillua_4.4.5-1.zip" = {
+    "scintillua_4.4.5-2.zip" = {
-      url = "https://github.com/orbitalquark/scintillua/archive/scintillua_4.4.5-1.zip";
+      url = "https://github.com/orbitalquark/scintillua/archive/scintillua_4.4.5-2.zip";
-      sha256 = "095wpbid2kvr5xgkhd5bd4sd7ljgk6gd9palrjkmdcwfgsf1lp04";
+      sha256 = "1061y2gg78zb2mml8msyarxgdwbf7g8g2v08fr1qqsqi2pbb7mfc";
     };
     "lua-5.3.5.tar.gz" = {
       url = "http://www.lua.org/ftp/lua-5.3.5.tar.gz";
@@ -19,17 +19,17 @@
       url = "http://www.inf.puc-rio.br/~roberto/lpeg/lpeg-1.0.2.tar.gz";
       sha256 = "1zjzl7acvcdavmcg5l7wi12jd4rh95q9pl5aiww7hv0v0mv6bmj8";
     };
-    "v1_7_0_2.zip" = {
+    "v1_8_0.zip" = {
-      url = "https://github.com/keplerproject/luafilesystem/archive/v1_7_0_2.zip";
+      url = "https://github.com/keplerproject/luafilesystem/archive/v1_8_0.zip";
-      sha256 = "0y44ymc7higz5dd2w3c6ib7mwmpr6yvszcl7lm12nf8x3y4snx4i";
+      sha256 = "12p1p5qpdql44y3cc035h8rs8rgdqp6nrnrixlp5544agb5bx9p3";
     };
     "64587546482a1a6324706d75c80b77d2f87118a4.zip" = {
       url = "https://github.com/orbitalquark/gtdialog/archive/64587546482a1a6324706d75c80b77d2f87118a4.zip";
       sha256 = "10mglbnn8r1cakqn9h285pwfnh7kfa98v7j8qh83c24n66blyfh9";
     };
-    "cdk-5.0-20150928.tgz" = {
+    "cdk-5.0-20200923.tgz" = {
-      url = "http://invisible-mirror.net/archives/cdk/cdk-5.0-20150928.tgz";
+      url = "http://invisible-mirror.net/archives/cdk/cdk-5.0-20200923.tgz";
-      sha256 = "0j74l874y33i26y5kjg3pf1vswyjif8k93pqhi0iqykpbxfsg382";
+      sha256 = "1vdakz119a13d7p7w53hk56fdmbkhv6y9xvdapcfnbnbh3l5szq0";
     };
     "libtermkey-0.20.tar.gz" = {
       url = "http://www.leonerd.org.uk/code/libtermkey/libtermkey-0.20.tar.gz";

pkgs/applications/editors/vim/configurable.nix

@@ -75,7 +75,6 @@ in stdenv.mkDerivation rec {
   patches = [ ./cflags-prune.diff ] ++ lib.optional ftNixSupport ./ft-nix-support.patch;
 
   configureFlags = [
-    "--enable-gui=${guiSupport}"
     "--with-features=${features}"
     "--disable-xsmp"              # XSMP session management
     "--disable-xsmp_interact"     # XSMP interaction
@@ -95,6 +94,7 @@ in stdenv.mkDerivation rec {
     "--disable-carbon_check"
     "--disable-gtktest"
   ]
+    ++ lib.optional (guiSupport == "gtk2" || guiSupport == "gtk3") "--enable-gui=${guiSupport}"
   ++ lib.optional stdenv.isDarwin
      (if darwinSupport then "--enable-darwin" else "--disable-darwin")
   ++ lib.optionals luaSupport [
@@ -127,8 +127,22 @@ in stdenv.mkDerivation rec {
   ++ lib.optional (guiSupport == "gtk3") wrapGAppsHook
   ;
 
-  buildInputs = [ ncurses libX11 libXext libSM libXpm libXt libXaw libXau
+  buildInputs = [
-    libXmu glib libICE ]
+    ncurses
+    glib
+  ]
+    # All X related dependencies
+    ++ lib.optionals (guiSupport == "gtk2" || guiSupport == "gtk3") [
+      libSM
+      libICE
+      libX11
+      libXext
+      libXpm
+      libXt
+      libXaw
+      libXau
+      libXmu
+    ]
     ++ lib.optional (guiSupport == "gtk2") gtk2-x11
     ++ lib.optional (guiSupport == "gtk3") gtk3-x11
     ++ lib.optionals darwinSupport [ CoreServices CoreData Cocoa Foundation libobjc ]

pkgs/applications/editors/vscode/update-vscode.sh

@@ -19,18 +19,18 @@ fi
 VSCODE_VER=$(curl --fail --silent https://api.github.com/repos/Microsoft/vscode/releases/latest | jq --raw-output .tag_name)
 sed -i "s/version = \".*\"/version = \"${VSCODE_VER}\"/" "$ROOT/vscode.nix"
 
-VSCODE_LINUX_URL="https://vscode-update.azurewebsites.net/${VSCODE_VER}/linux-x64/stable"
+VSCODE_LINUX_URL="https://update.code.visualstudio.com/${VSCODE_VER}/linux-x64/stable"
 VSCODE_LINUX_SHA256=$(nix-prefetch-url ${VSCODE_LINUX_URL})
 sed -i "s/x86_64-linux = \".\{52\}\"/x86_64-linux = \"${VSCODE_LINUX_SHA256}\"/" "$ROOT/vscode.nix"
 
-VSCODE_DARWIN_URL="https://vscode-update.azurewebsites.net/${VSCODE_VER}/darwin/stable"
+VSCODE_DARWIN_URL="https://update.code.visualstudio.com/${VSCODE_VER}/darwin/stable"
 VSCODE_DARWIN_SHA256=$(nix-prefetch-url ${VSCODE_DARWIN_URL})
 sed -i "s/x86_64-darwin = \".\{52\}\"/x86_64-darwin = \"${VSCODE_DARWIN_SHA256}\"/" "$ROOT/vscode.nix"
 
-VSCODE_LINUX_AARCH64_URL="https://vscode-update.azurewebsites.net/${VSCODE_VER}/linux-arm64/stable"
+VSCODE_LINUX_AARCH64_URL="https://update.code.visualstudio.com/${VSCODE_VER}/linux-arm64/stable"
 VSCODE_LINUX_AARCH64_SHA256=$(nix-prefetch-url ${VSCODE_LINUX_AARCH64_URL})
 sed -i "s/aarch64-linux = \".\{52\}\"/aarch64-linux = \"${VSCODE_LINUX_AARCH64_SHA256}\"/" "$ROOT/vscode.nix"
 
-VSCODE_LINUX_ARMV7L_URL="https://vscode-update.azurewebsites.net/${VSCODE_VER}/linux-armhf/stable"
+VSCODE_LINUX_ARMV7L_URL="https://update.code.visualstudio.com/${VSCODE_VER}/linux-armhf/stable"
 VSCODE_LINUX_ARMV7L_SHA256=$(nix-prefetch-url ${VSCODE_LINUX_ARMV7L_URL})
 sed -i "s/armv7l-linux = \".\{52\}\"/armv7l-linux = \"${VSCODE_LINUX_ARMV7L_SHA256}\"/" "$ROOT/vscode.nix"

pkgs/applications/editors/vscode/vscode.nix

@@ -13,10 +13,10 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1px6x99cv8nb8lcy3vgcicr4ar0bfj5rfnc5a1yw8rs5p1qnflgw";
+    x86_64-linux = "0fpa3b807hy3wrb98h5s0p6ljya279bikv2qwq30nvr0f4zn48bk";
-    x86_64-darwin = "0grzivqb2fyvwh0fjh9vr205fjcsrd1iqhkwk3mgv792zfrb7ksf";
+    x86_64-darwin = "0bw7pdzn0a0zr7x8fpwck7v73dq5vh71ja00z11mhjrkjnvmmd9k";
-    aarch64-linux = "0p0msxgc13kqmpq7wk61igc1qbgmgg9463s44dp4ii3630iyr4lw";
+    aarch64-linux = "04wrqcmyamhwiwcyay1z0q0dvf6g7k3pcs93x7hahy16l65w7s2c";
-    armv7l-linux = "147lki1wr5nzsg1mq12jmdjq9qr6vbdpmzbpr5nrvq23cak94ff8";
+    armv7l-linux = "1hkc9i4z021jwjn275w790bppfvi63g0cnwvkssqdh1c94939rhv";
   }.${system};
 in
   callPackage ./generic.nix rec {
@@ -25,7 +25,7 @@ in
 
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.54.2";
+    version = "1.54.3";
     pname = "vscode";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
@@ -34,7 +34,7 @@ in
 
     src = fetchurl {
       name = "VSCode_${version}_${plat}.${archive_fmt}";
-      url = "https://vscode-update.azurewebsites.net/${version}/${plat}/stable";
+      url = "https://update.code.visualstudio.com/${version}/${plat}/stable";
       inherit sha256;
     };
 

pkgs/applications/gis/openorienteering-mapper/default.nix

@@ -1,6 +1,7 @@
 { lib, stdenv
 , mkDerivation
 , fetchFromGitHub
+, fetchpatch
 , substituteAll
 , gdal
 , cmake
@@ -19,7 +20,7 @@
 
 mkDerivation rec {
   pname = "OpenOrienteering-Mapper";
-  version = "0.9.4";
+  version = "0.9.5";
 
   buildInputs = [
     gdal
@@ -38,14 +39,21 @@ mkDerivation rec {
     owner = "OpenOrienteering";
     repo = "mapper";
     rev = "v${version}";
-    sha256 = "13k9dirqm74lknhr8w121zr1hjd9gm1y73cj4rrj98rx44dzmk7b";
+    sha256 = "1w8ikqpgi0ksrzjal5ihfaik4grc5v3gdnnv79j20xkr2p4yn1h5";
   };
 
-  patches = (substituteAll {
+  patches = [
-    # See https://github.com/NixOS/nixpkgs/issues/86054
+    # https://github.com/NixOS/nixpkgs/issues/86054
-    src = ./fix-qttranslations-path.diff;
+    (substituteAll {
-    inherit qttranslations;
+      src = ./fix-qttranslations-path.diff;
-  });
+      inherit qttranslations;
+    })
+    # https://github.com/OpenOrienteering/mapper/pull/1907
+    (fetchpatch {
+      url = "https://github.com/OpenOrienteering/mapper/commit/bc52aa567e90a58d6963b44d5ae1909f3f841508.patch";
+      sha256 = "1bkckapzccn6k0ri6bgrr0nhis9498fnwj7b32s2ysym8zcg0355";
+    })
+  ];
 
   cmakeFlags = [
     # Building the manual and bundling licenses fails
@@ -81,7 +89,8 @@ mkDerivation rec {
       and provides a free alternative to the existing proprietary solution.
     '';
     homepage = "https://www.openorienteering.org/apps/mapper/";
-    license = licenses.gpl3;
+    changelog = "https://github.com/OpenOrienteering/mapper/releases/tag/v${version}";
+    license = licenses.gpl3Plus;
     platforms = with platforms; linux ++ darwin;
     maintainers = with maintainers; [ mpickering sikmir ];
   };

pkgs/applications/graphics/dia/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchgit, autoconf, automake, libtool, gtk2, pkg-config, perlPackages,
-libxml2, gettext, python, libxml2Python, docbook5, docbook_xsl,
+libxml2, gettext, python2, libxml2Python, docbook5, docbook_xsl,
 libxslt, intltool, libart_lgpl, withGNOME ? false, libgnomeui,
 gtk-mac-integration-gtk2 }:
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation {
   ];
 
   buildInputs =
-    [ gtk2 libxml2 gettext python libxml2Python docbook5
+    [ gtk2 libxml2 gettext python2 libxml2Python docbook5
       libxslt docbook_xsl libart_lgpl ]
       ++ lib.optional withGNOME libgnomeui
       ++ lib.optional stdenv.isDarwin gtk-mac-integration-gtk2;

pkgs/applications/graphics/lightburn/default.nix

@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lightburn";
-  version = "0.9.20";
+  version = "0.9.21";
 
   nativeBuildInputs = [
     p7zip
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/LightBurnSoftware/deployment/releases/download/${version}/LightBurn-Linux64-v${version}.7z";
-    sha256 = "sha256-FtkBIoz5u70DbZZBH4uSaAkmOphWA9H0uYuukIPVGUM=";
+    sha256 = "sha256-Tnv+vfKOdDWIU36T9ZqwdTwuMd2AOGyKBY0IkPfrZlc=";
   };
 
   buildInputs = [

pkgs/applications/graphics/openimageio/2.x.nix

@@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchFromGitHub
-, fetchpatch
 , boost
 , cmake
 , ilmbase
@@ -11,26 +10,20 @@
 , openexr
 , robin-map
 , unzip
+, fmt
 }:
 
 stdenv.mkDerivation rec {
   pname = "openimageio";
-  version = "2.1.9.0";
+  version = "2.2.12.0";
 
   src = fetchFromGitHub {
     owner = "OpenImageIO";
     repo = "oiio";
     rev = "Release-${version}";
-    sha256 = "1bbxx3bcc5jlb90ffxbk29gb8227097rdr8vg97vj9axw2mjd5si";
+    sha256 = "16z8lnsqhljbfaarfwx9rc95p0a9wxf4p271j6kxdfknjb88p56i";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/OpenImageIO/oiio/pull/2441/commits/e9bdd69596103edf41b659ad8ab0ca4ce002f6f5.patch";
-      sha256 = "0x1wmjf1jrm19d1izhs1cs3y1if9al1zx48lahkfswyjag3r5dn0";
-    })
-  ];
-
   outputs = [ "bin" "out" "dev" "doc" ];
 
   nativeBuildInputs = [
@@ -47,6 +40,7 @@ stdenv.mkDerivation rec {
     opencolorio
     openexr
     robin-map
+    fmt
   ];
 
   cmakeFlags = [

pkgs/applications/graphics/openimageio/2539_backport.patch

@@ -0,0 +1,31 @@
+diff --git a/src/libOpenImageIO/exif.cpp b/src/libOpenImageIO/exif.cpp
+index 10b75c21..0287d9c5 100644
+--- a/src/libOpenImageIO/exif.cpp
++++ b/src/libOpenImageIO/exif.cpp
+@@ -213,6 +213,9 @@ static const EXIF_tag_info exif_tag_table[] = {
+ 
+ 
+ 
++// libtiff > 4.1.0 defines these in tiff.h. For older libtiff, let's define
++// them ourselves.
++#ifndef GPSTAG_VERSIONID
+ enum GPSTag {
+     GPSTAG_VERSIONID = 0, 
+     GPSTAG_LATITUDEREF = 1,  GPSTAG_LATITUDE = 2,
+@@ -237,6 +240,7 @@ enum GPSTag {
+     GPSTAG_DIFFERENTIAL = 30,
+     GPSTAG_HPOSITIONINGERROR = 31
+ };
++#endif
+ 
+ static const EXIF_tag_info gps_tag_table[] = {
+     { GPSTAG_VERSIONID,		"GPS:VersionID",	TIFF_BYTE, 4 }, 
+@@ -270,7 +274,7 @@ static const EXIF_tag_info gps_tag_table[] = {
+     { GPSTAG_AREAINFORMATION,	"GPS:AreaInformation",	TIFF_UNDEFINED, 1 },
+     { GPSTAG_DATESTAMP,		"GPS:DateStamp",	TIFF_ASCII, 0 },
+     { GPSTAG_DIFFERENTIAL,	"GPS:Differential",	TIFF_SHORT, 1 },
+-    { GPSTAG_HPOSITIONINGERROR,	"GPS:HPositioningError",TIFF_RATIONAL, 1 },
++    { GPSTAG_GPSHPOSITIONINGERROR,     "GPS:HPositioningError",TIFF_RATIONAL, 1 },
+     { -1, NULL }  // signal end of table
+ };
+ 

pkgs/applications/graphics/openimageio/default.nix

@@ -33,6 +33,11 @@ stdenv.mkDerivation rec {
     "dist_dir="
   ];
 
+  patches = [
+    # Backported from https://github.com/OpenImageIO/oiio/pull/2539 for 1.8.17
+    ./2539_backport.patch
+  ];
+
   meta = with lib; {
     homepage = "http://www.openimageio.org";
     description = "A library and tools for reading and writing images";

pkgs/applications/misc/1password-gui/default.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "1password";
-  version = "8.0.28";
+  version = "8.0.30";
 
   src = fetchurl {
     url = "https://onepassword.s3.amazonaws.com/linux/appimage/${pname}-${version}.AppImage";
-    hash = "sha256-okLeyok/5rihGXaQaUR06dGkpuqqW02qJ6q6VVLtZsE=";
+    hash = "sha256-j+fp/f8nta+OOuOFU4mmUrGYlVmAqdaXO4rLJ0in+m8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/misc/bashSnippets/default.nix

@@ -1,10 +1,10 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper
-, curl, python, bind, iproute, bc, gitMinimal }:
+, curl, python3, bind, iproute, bc, gitMinimal }:
 let
   version = "1.23.0";
   deps = lib.makeBinPath [
     curl
-    python
+    python3
     bind.dnsutils
     iproute
     bc
@@ -24,11 +24,13 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [ makeWrapper ];
 
-  patchPhase = ''
+  postPatch = ''
     patchShebangs install.sh
     substituteInPlace install.sh --replace /usr/local "$out"
   '';
 
+  strictDeps = true;
+
   dontBuild = true;
 
   installPhase = ''

pkgs/applications/misc/blender/default.nix

@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   patches = lib.optional stdenv.isDarwin ./darwin.patch;
 
-  nativeBuildInputs = [ cmake ] ++ optional cudaSupport addOpenGLRunpath;
+  nativeBuildInputs = [ cmake makeWrapper ] ++ optional cudaSupport addOpenGLRunpath;
   buildInputs =
     [ boost ffmpeg gettext glew ilmbase
       freetype libjpeg libpng libsamplerate libsndfile libtiff
@@ -41,9 +41,9 @@ stdenv.mkDerivation rec {
       alembic
       (opensubdiv.override { inherit cudaSupport; })
       tbb
-      makeWrapper
       embree
       gmp
+      pugixml
     ]
     ++ (if (!stdenv.isDarwin) then [
       libXi libX11 libXext libXrender
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
       openvdb
     ]
     else [
-      pugixml llvmPackages.openmp SDL Cocoa CoreGraphics ForceFeedback OpenAL OpenGL
+      llvmPackages.openmp SDL Cocoa CoreGraphics ForceFeedback OpenAL OpenGL
     ])
     ++ optional jackaudioSupport libjack2
     ++ optional cudaSupport cudatoolkit

pkgs/applications/misc/cherrytree/default.nix

@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, pythonPackages, gettext }:
+{ lib, fetchFromGitHub, python2Packages, gettext }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   pname = "cherrytree";
   version = "0.39.4";
 
@@ -14,7 +14,7 @@ pythonPackages.buildPythonApplication rec {
 
   nativeBuildInputs = [ gettext ];
 
-  propagatedBuildInputs = with pythonPackages; [ pygtk dbus-python pygtksourceview ];
+  propagatedBuildInputs = with python2Packages; [ pygtk dbus-python pygtksourceview ];
 
   patches = [ ./subprocess.patch ];
 

pkgs/applications/misc/curabydagoma/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, runtimeShell, lib, fetchurl, python, pythonPackages, unzip }:
+{ stdenv, runtimeShell, lib, fetchurl, python2Packages, unzip }:
 
 # This package uses a precompiled "binary" distribution of CuraByDagoma,
 # distributed by the editor.
@@ -13,7 +13,9 @@
 # I guess people owning a 3D printer generally don't use i686.
 # If, however, someone needs it, we certainly can find a solution.
 
-stdenv.mkDerivation rec {
+let
+  pythonPackages = python2Packages;
+in stdenv.mkDerivation rec {
   pname = "curabydagoma";
   # Version is the date, UNIX format
   version = "1520506579";
@@ -26,7 +28,7 @@ stdenv.mkDerivation rec {
   };
   unpackCmd = "unzip $curSrc && tar zxf CuraByDagoma_amd64.tar.gz";
   nativeBuildInputs = [ unzip ];
-  buildInputs = [ python pythonPackages.pyopengl pythonPackages.wxPython pythonPackages.pyserial pythonPackages.numpy ];
+  buildInputs = [ pythonPackages.python pythonPackages.pyopengl pythonPackages.wxPython pythonPackages.pyserial pythonPackages.numpy ];
 
   # Compile all pyc files because the included pyc files may be older than the
   # py files. However, Python doesn't realize that because the packages
@@ -46,7 +48,7 @@ stdenv.mkDerivation rec {
     cat > $out/bin/curabydago <<EOF
     #!${runtimeShell}
     export PYTHONPATH=$PYTHONPATH
-    ${python.out}/bin/python $out/curabydago/cura.py
+    ${pythonPackages.python.interpreter} $out/curabydago/cura.py
     EOF
     chmod a+x $out/bin/curabydago
 

pkgs/applications/misc/dasel/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "dasel";
-  version = "1.13.4";
+  version = "1.13.5";
 
   src = fetchFromGitHub {
     owner = "TomWright";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4/67GwNIRcbC6qYe5s8DD16b2uVcG0DI1ScQk31Ffk0=";
+    sha256 = "sha256-Fy202w1lUrymnpnCmWwnbpMsda7JrZ3B0c+a9UtKsSA=";
   };
 
   vendorSha256 = "sha256-BdX4DO77mIf/+aBdkNVFUzClsIml1UMcgvikDbbdgcY=";

pkgs/applications/misc/dockbarx/default.nix

@@ -1,6 +1,6 @@
-{ lib, fetchFromGitHub, pythonPackages, gnome2, keybinder }:
+{ lib, fetchFromGitHub, python2Packages, gnome2, keybinder }:
 
-pythonPackages.buildPythonApplication rec {
+python2Packages.buildPythonApplication rec {
   ver = "0.93";
   name = "dockbarx-${ver}";
 
@@ -24,7 +24,7 @@ pythonPackages.buildPythonApplication rec {
     substituteInPlace dockx_applets/volume-control.py         --replace /usr/share/             $out/share/
   '';
 
-  propagatedBuildInputs = (with pythonPackages; [ pygtk pyxdg dbus-python pillow xlib ])
+  propagatedBuildInputs = (with python2Packages; [ pygtk pyxdg dbus-python pillow xlib ])
     ++ (with gnome2; [ gnome_python gnome_python_desktop ])
     ++ [ keybinder ];
 

pkgs/applications/misc/dotfiles/default.nix

@@ -1,10 +1,10 @@
-{ lib, pythonPackages }:
+{ lib, python3Packages }:
 
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "dotfiles";
   version = "0.6.4";
 
-  src = pythonPackages.fetchPypi {
+  src = python3Packages.fetchPypi {
     inherit version pname;
     sha256 = "03qis6m9r2qh00sqbgwsm883s4bj1ibwpgk86yh4l235mdw8jywv";
   };
@@ -12,8 +12,8 @@ pythonPackages.buildPythonApplication rec {
   # No tests in archive
   doCheck = false;
 
-  checkInputs = with pythonPackages; [ pytest ];
+  checkInputs = with python3Packages; [ pytest ];
-  propagatedBuildInputs = with pythonPackages; [ click ];
+  propagatedBuildInputs = with python3Packages; [ click ];
 
   meta = with lib; {
     description = "Easily manage your dotfiles";

pkgs/applications/misc/electrum/default.nix

@@ -150,6 +150,6 @@ python3.pkgs.buildPythonApplication {
     homepage = "https://electrum.org/";
     license = licenses.mit;
     platforms = platforms.all;
-    maintainers = with maintainers; [ ehmry joachifm np prusnak ];
+    maintainers = with maintainers; [ joachifm np prusnak ];
   };
 }

pkgs/applications/misc/gammu/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, python, pkg-config, cmake, bluez, libusb1, curl
+{ lib, stdenv, fetchFromGitHub, pkg-config, cmake, bluez, libusb1, curl
 , libiconv, gettext, sqlite
 , dbiSupport ? false, libdbi ? null, libdbiDrivers ? null
 , postgresSupport ? false, postgresql ? null
@@ -21,7 +21,9 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config cmake ];
 
-  buildInputs = [ python bluez libusb1 curl gettext sqlite libiconv ]
+  strictDeps = true;
+
+  buildInputs = [ bluez libusb1 curl gettext sqlite libiconv ]
   ++ optionals dbiSupport [ libdbi libdbiDrivers ]
   ++ optionals postgresSupport [ postgresql ];
 

pkgs/applications/misc/gpxsee/default.nix

@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "gpxsee";
-  version = "8.8";
+  version = "8.9";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "sha256-eAXMmjPcfnJA5w6w/SRc6T5KHss77t0JijTB6+ctjzo=";
+    sha256 = "sha256-nl9iu8ezgMZ1wy2swDXYRDLlkSz1II+C65UUWNvGBxg=";
   };
 
   patches = (substituteAll {

pkgs/applications/misc/hugo/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.81.0";
+  version = "0.82.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9YroUxcLixu+MNL37JByCulCHv0WxWGwqBQ/+FGtZLw=";
+    sha256 = "sha256-D0bwy8LJihlfM+E3oys85yjadjZNfPv5xnq4ekaZPCU=";
   };
 
-  vendorSha256 = "sha256-5gQyoLirXajkzxKxzcuPnjECL2mJPiHS65lYkyIpKs8=";
+  vendorSha256 = "sha256-pJBm+yyy1DbH28oVBQA+PHSDtSg3RcgbRlurrwnnEls=";
 
   doCheck = false;
 

pkgs/applications/misc/josm/default.nix

@@ -1,20 +1,20 @@
 { lib, stdenv, fetchurl, fetchsvn, makeWrapper, unzip, jre, libXxf86vm }:
 let
   pname = "josm";
-  version = "17560";
+  version = "17580";
   srcs = {
     jar = fetchurl {
       url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      sha256 = "1ffrbg2d4s2dmc9zy9b4fbsqnp9g0pvp6vnrq7gbsmxh0y23sw56";
+      sha256 = "05y1g48llnpbyv0r8dn3kyhcfqylsg4fbp540xn1n7sk3h17gwsw";
     };
     macosx = fetchurl {
-      url = "https://josm.openstreetmap.de/download/macosx/josm-macosx-${version}.zip";
+      url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java16.zip";
-      sha256 = "17qrilj20bvzd8ydfjjirpqjrsbqbkxyj4q35q87z9j3pgnd1h71";
+      sha256 = "0aqkr6951zbi7a6zawvpsh51i0c4nyz2xkj52gg8n4vxli5pp3y1";
     };
     pkg = fetchsvn {
       url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
       rev = version;
-      sha256 = "0wmncbi5g3ijn19qvmvwszb2m79wnv4jpdmpjd7332d3qi5rfmwn";
+      sha256 = "04mxrirlyjy8i5s6y8w84kxv3wjlhhdfmlaxxlxd25viim73g3zv";
     };
   };
 in

pkgs/applications/misc/pure-maps/default.nix

@@ -1,7 +1,7 @@
-{ lib, mkDerivation, fetchFromGitHub, wrapQtAppsHook
+{ lib, mkDerivation, fetchFromGitHub
 , qmake, qttools, kirigami2, qtquickcontrols2, qtlocation, qtsensors
 , nemo-qml-plugin-dbus, mapbox-gl-qml, s2geometry
-, python3, pyotherside, python3Packages
+, python3, pyotherside
 }:
 
 mkDerivation rec {
@@ -16,12 +16,14 @@ mkDerivation rec {
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs = [ qmake python3 qttools wrapQtAppsHook ];
+  nativeBuildInputs = [
+    qmake python3 qttools python3.pkgs.wrapPython
+  ];
+
   buildInputs = [
     kirigami2 qtquickcontrols2 qtlocation qtsensors
     nemo-qml-plugin-dbus pyotherside mapbox-gl-qml s2geometry
   ];
-  propagatedBuildInputs = with python3Packages; [ gpxpy pyxdg ];
 
   postPatch = ''
     substituteInPlace pure-maps.pro \
@@ -30,10 +32,11 @@ mkDerivation rec {
 
   qmakeFlags = [ "FLAVOR=kirigami" ];
 
-  dontWrapQtApps = true;
+  pythonPath = with python3.pkgs; [ gpxpy ];
-  postInstall = ''
+
-    wrapQtApp $out/bin/pure-maps \
+  preInstall = ''
-      --prefix PYTHONPATH : "$out/share"
+    buildPythonPath "$pythonPath"
+    qtWrapperArgs+=(--prefix PYTHONPATH : "$program_PYTHONPATH")
   '';
 
   meta = with lib; {

pkgs/applications/misc/qtbitcointrader/default.nix

@@ -31,6 +31,5 @@ mkDerivation {
     homepage = "https://centrabit.com/";
     license = licenses.gpl3;
     platforms = qt5.qtbase.meta.platforms;
-    maintainers = [ maintainers.ehmry ];
   };
 }

pkgs/applications/misc/simplenote/default.nix

@@ -17,10 +17,10 @@ let
 
   pname = "simplenote";
 
-  version = "2.5.0";
+  version = "2.8.0";
 
   sha256 = {
-    x86_64-linux = "sha256-Mn1oie+YHNtYKriIAIHdO+tUQDqaA34dkAJgZvQy76I=";
+    x86_64-linux = "sha256-W8+LzWMPDCrFZCm9p/Gcj7OXqJw/gs7lMxTKjOQChQY=";
   }.${system} or throwSystem;
 
   meta = with lib; {

pkgs/applications/misc/wtf/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "wtf";
-  version = "0.35.0";
+  version = "0.36.0";
 
   src = fetchFromGitHub {
     owner = "wtfutil";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-xzMXbF0M7asZtyo8DmM5yyNoHKy0H6amRDhu6hjHgq4=";
+    sha256 = "sha256-JVHcunpS+2/0d7XaUZ95m9QpVHCG1Tq8LJ9KNURSRy8=";
    };
 
-  vendorSha256 = "sha256-6ij0NQMjDnZJhuqkUR7MdBLAMS5Xa2HKIgQjegKJyvc=";
+  vendorSha256 = "sha256-4uRhbRPfCRYwFlfucXOYhLruj7hkV4G9Sxjh9yQkDEQ=";
 
   doCheck = false;
 

pkgs/applications/misc/xchm/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xchm";
-  version = "1.31";
+  version = "1.32";
 
   src = fetchFromGitHub {
     owner = "rzvncj";
     repo = "xCHM";
     rev = version;
-    sha256 = "1mzafbpc1c211byf8bnwl13by7vi8xvxlaykyrajb1bj0ynbmmgp";
+    sha256 = "sha256-Ss8kdfUAMC8v05rdt2SoO6vPyssG5v8gOzdf/v18cdg=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/applications/misc/zettlr/default.nix

@@ -1,5 +1,10 @@
-{ appimageTools, lib, fetchurl, gtk3, gsettings-desktop-schemas
+{ appimageTools
-, texlive, pandoc, pandoc-citeproc
+, lib
+, fetchurl
+, gtk3
+, gsettings-desktop-schemas
+, texlive
+, pandoc
 }:
 
 # Based on https://gist.github.com/msteen/96cb7df66a359b827497c5269ccbbf94 and joplin-desktop nixpkgs.
@@ -14,7 +19,8 @@ let
   appimageContents = appimageTools.extractType2 {
     inherit name src;
   };
-in appimageTools.wrapType2 rec {
+in
+appimageTools.wrapType2 rec {
   inherit name src;
 
   profile = ''
@@ -22,7 +28,7 @@ in appimageTools.wrapType2 rec {
   '';
 
   multiPkgs = null; # no 32bit needed
-  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ texlive pandoc pandoc-citeproc ];
+  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ texlive pandoc ];
   extraInstallCommands = ''
     mv $out/bin/{${name},${pname}}
     install -m 444 -D ${appimageContents}/Zettlr.desktop $out/share/applications/zettlr.desktop

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -18,9 +18,9 @@
     }
   },
   "beta": {
-    "version": "90.0.4430.30",
+    "version": "90.0.4430.40",
-    "sha256": "01b6naziii72pvw35wphfqz3inih75is038yf1mdp1847jbvxpwp",
+    "sha256": "0n7g4j981h3fn5wgpb3azpili9682nq0yikhd4z7dr7agvpnfr3k",
-    "sha256bin64": "0k48mfzmyjb0w75fkm2j7ll340qgmzvmskz12awc2l19hgnw1s8p",
+    "sha256bin64": "120rbh8bpcj3z5kqdaicqnsd2mh0xcr8y1411kl0zpwa6hfvgm3r",
     "deps": {
       "gn": {
         "version": "2021-02-09",
@@ -31,9 +31,9 @@
     }
   },
   "dev": {
-    "version": "91.0.4449.6",
+    "version": "91.0.4455.2",
-    "sha256": "1y6z7p64fi4dxyrxrnlmg0wwczgw58cinrsywhnrpl2wp2y3v6m3",
+    "sha256": "0nqw1jxysyl72dg2bqls7w9cm366j6i1p4sadf3s5vc0i7yr7h3i",
-    "sha256bin64": "1baxra0hg981awinyyvm1x46rlskjmhs2m1h0zf72l11y1jyj5vc",
+    "sha256bin64": "0d7s7bg58489ph4i92yj4vkww0cl7473pk9sir64gcmm9z18yjc3",
     "deps": {
       "gn": {
         "version": "2021-03-12",

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -7,16 +7,16 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    ffversion = "86.0.1";
+    ffversion = "87.0";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "e613cdcadfd71a01800a72c08c590032605ca8a8a0ba93326ffba93c2819f629fd620c23d00ca1274b203adc20acfe5d7913fee240ff14819fb1377ed08b1214";
+      sha512 = "c1c08be2283e7a162c8be2f2647ec2bb85cab592738dc45e4b4ffb72969229cc0019a30782a4cb27f09a13b088c63841071dd202b3543dfba295140a7d6246a4";
     };
 
     meta = {
       description = "A web browser built from Firefox source tree";
       homepage = "http://www.mozilla.com/en-US/firefox/";
-      maintainers = with lib.maintainers; [ eelco lovesegfault ];
+      maintainers = with lib.maintainers; [ eelco lovesegfault hexa ];
       platforms = lib.platforms.unix;
       badPlatforms = lib.platforms.darwin;
       broken = stdenv.buildPlatform.is32bit; # since Firefox 60, build on 32-bit platforms fails with "out of memory".
@@ -32,16 +32,16 @@ rec {
 
   firefox-esr-78 = common rec {
     pname = "firefox-esr";
-    ffversion = "78.8.0esr";
+    ffversion = "78.9.0esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "0160aa6c408c2af66d24b74cf98e1a07ab1604e7b93ffcde79201f9d68e41e896ef965f1904de52d5dd82ffedae33ac96e93b871727bf5dd5983c5af2f1f439f";
+      sha512 = "28582fc0a03fb50c0a817deb1083817bb7f2f5d38e98439bf655ed4ee18c83568b3002a59ef76edf357bfb11f55832a221d14130f116aac19d850768fba3ac8b";
     };
 
     meta = {
       description = "A web browser built from Firefox Extended Support Release source tree";
       homepage = "http://www.mozilla.com/en-US/firefox/";
-      maintainers = with lib.maintainers; [ eelco ];
+      maintainers = with lib.maintainers; [ eelco hexa ];
       platforms = lib.platforms.unix;
       badPlatforms = lib.platforms.darwin;
       broken = stdenv.buildPlatform.is32bit; # since Firefox 60, build on 32-bit platforms fails with "out of memory".

pkgs/applications/networking/browsers/links2/default.nix

@@ -8,12 +8,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.21";
+  version = "2.22";
   pname = "links2";
 
   src = fetchurl {
     url = "${meta.homepage}/download/links-${version}.tar.bz2";
-    sha256 = "0qqdcghsdqm7l6kyi0k752ws3ak5crw85pqkcb11wy67j62yspi8";
+    sha256 = "sha256-A2SYazp/Ho4xcb6jYrU/ceHdM2CohC1m/cZVgOvCCE0=";
   };
 
   buildInputs = with lib;

pkgs/applications/networking/cloudflared/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2021.2.1";
+  version = "2021.3.3";
 
   src = fetchFromGitHub {
     owner  = "cloudflare";
     repo   = "cloudflared";
     rev    = version;
-    sha256 = "sha256-kmlyj6Q+OAJ0cKMeWxajPDBm99WpRf+Gpvc+Jy79DCo=";
+    sha256 = "sha256-St2WBdy76OVFlYoY1RGwQj1WsUpPtsL7yX1MFwztKgs=";
   };
 
   vendorSha256 = null;

pkgs/applications/networking/cluster/helm/wrapper.nix

@@ -1,6 +1,4 @@
-{ stdenv, symlinkJoin, lib, makeWrapper
+{ symlinkJoin, lib, makeWrapper, writeText }:
-, writeText
-}:
 
 helm:
 

pkgs/applications/networking/cluster/helmsman/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helmsman";
-  version = "3.6.5";
+  version = "3.6.6";
 
   src = fetchFromGitHub {
     owner = "Praqma";
     repo = "helmsman";
     rev = "v${version}";
-    sha256 = "sha256-FOBSGXVIb4mLDHMqOljZ04W0q/H/HOuFm9Cl2kK027s=";
+    sha256 = "sha256-SGVch7mMtHi5GYFOrSss4dk29aRTQmBzkPYOetPdF88=";
   };
 
   vendorSha256 = "sha256-mktq5Dnk1mBO2yy5SeMDxa/akXdO5i2WafMTGtH53H8=";

pkgs/applications/networking/cluster/k3s/default.nix

@@ -19,6 +19,7 @@
 , fetchurl
 , fetchzip
 , fetchgit
+, zstd
 }:
 
 with lib;
@@ -43,9 +44,9 @@ with lib;
 # Those pieces of software we entirely ignore upstream's handling of, and just
 # make sure they're in the path if desired.
 let
-  k3sVersion = "1.19.4+k3s2";     # k3s git tag
+  k3sVersion = "1.20.4+k3s1";     # k3s git tag
   traefikChartVersion = "1.81.0"; # taken from ./scripts/download at the above k3s tag
-  k3sRootVersion = "0.7.1";       # taken from ./scripts/download at the above k3s tag
+  k3sRootVersion = "0.8.1";       # taken from ./scripts/download at the above k3s tag
   k3sCNIVersion = "0.8.6-k3s1";   # taken from ./scripts/version.sh at the above k3s tag
   # bundled into the k3s binary
   traefikChart = fetchurl {
@@ -64,7 +65,7 @@ let
   k3sRoot = fetchzip {
     # Note: marked as apache 2.0 license
     url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
-    sha256 = "1wjg54816plbdwgv0dibq6dzmcakcmx0wiqijvr4f3gsxgk59zwf";
+    sha256 = "sha256-r3Nkzl9ccry7cgD3YWlHvEWOsWnnFGIkyRH9sx12gks=";
     stripRoot = false;
   };
   k3sPlugins = buildGoPackage rec {
@@ -95,7 +96,7 @@ let
     url = "https://github.com/k3s-io/k3s";
     rev = "v${k3sVersion}";
     leaveDotGit = true; # ./scripts/version.sh depends on git
-    sha256 = "1qxjdgnq8mf54760f0vngcqa2y3b048pcmfsf1g593b2ij1kg1zi";
+    sha256 = "0rmn3nh8a94axv6lb2xjnn3gpq0scnvj69bvcs74azvw62fvq016";
   };
   # Stage 1 of the k3s build:
   # Let's talk about how k3s is structured.
@@ -126,7 +127,12 @@ let
 
     src = k3sRepo;
 
-    patches = [ ./patches/0001-Use-rm-from-path-in-go-generate.patch ./patches/0002-Add-nixpkgs-patches.patch ];
+    # Patch build scripts so that we can use them.
+    # This makes things more dynamically linked (because nix can deal with
+    # dynamically linked dependencies just fine), removes the upload at the
+    # end, and skips building runc + cni, since we have our own derivations for
+    # those.
+    patches = [ ./patches/0002-Add-nixpkgs-patches.patch ];
 
     nativeBuildInputs = [ git pkg-config ];
     buildInputs = [ libseccomp ];
@@ -166,9 +172,10 @@ let
 
     src = k3sRepo;
 
-    patches = [ ./patches/0001-Use-rm-from-path-in-go-generate.patch ./patches/0002-Add-nixpkgs-patches.patch ];
+    # See the above comment in k3sBuildStage1
+    patches = [ ./patches/0002-Add-nixpkgs-patches.patch ];
 
-    nativeBuildInputs = [ git pkg-config ];
+    nativeBuildInputs = [ git pkg-config zstd ];
     # These dependencies are embedded as compressed files in k3s at runtime.
     # Propagate them to avoid broken runtime references to libraries.
     propagatedBuildInputs = [ k3sPlugins k3sBuildStage1 runc ];
@@ -255,10 +262,12 @@ stdenv.mkDerivation rec {
   # Use a wrapper script to reference all the binaries that k3s tries to
   # execute, but that we didn't bundle with it.
   installPhase = ''
+    runHook preInstall
     mkdir -p "$out/bin"
     makeWrapper ${k3sBin}/bin/k3s "$out/bin/k3s" \
       --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
       --prefix PATH : "$out/bin"
+    runHook postInstall
   '';
 
   meta = {

pkgs/applications/networking/cluster/k3s/patches/0001-Use-rm-from-path-in-go-generate.patch

@@ -1,25 +0,0 @@
-From e79ddef65d08599ae3fe8ff39d202ea2416650b8 Mon Sep 17 00:00:00 2001
-From: Euan Kemp <euank@euank.com>
-Date: Sun, 31 May 2020 17:27:05 -0700
-Subject: [PATCH 1/2] Use 'rm' from path in go generate
-
-/bin/rm is less portable. On some distros, like nixos, it doesn't exist
-at all.
----
- main.go | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/main.go b/main.go
-index 62908bb7bb..0527222887 100644
---- a/main.go
-+++ b/main.go
-@@ -1,5 +1,5 @@
- //go:generate go run pkg/codegen/cleanup/main.go
--//go:generate /bin/rm -rf pkg/generated
-+//go:generate rm -rf pkg/generated
- //go:generate go run pkg/codegen/main.go
- //go:generate go fmt pkg/deploy/zz_generated_bindata.go
- //go:generate go fmt pkg/static/zz_generated_bindata.go
--- 
-2.25.4
-

pkgs/applications/networking/cluster/k9s/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "k9s";
-  version = "0.24.2";
+  version = "0.24.3";
 
   src = fetchFromGitHub {
     owner  = "derailed";
     repo   = "k9s";
     rev    = "v${version}";
-    sha256 = "0cr7ap9yfd9flcph98rxap2f46fc3v689v31mc8n7vxi9jr07irh";
+    sha256 = "sha256-xxWbojMY0je1mkp2TMuIhIsimVKdHvbkTMozlU9RbTQ=";
   };
 
   buildFlagsArray = ''
@@ -18,7 +18,7 @@ buildGoModule rec {
       -X github.com/derailed/k9s/cmd.commit=${src.rev}
   '';
 
-  vendorSha256 = "01g50sfk0k7v60m3anfiq2w9pzl2wpa985s22ciq911h3fscka3f";
+  vendorSha256 = "sha256-Q/l/GH6NSZdMMwTJ5spVEGZclnzcWpUW+zOwRXYQjxc=";
 
   doCheck = false;
 

pkgs/applications/networking/cluster/kube-score/default.nix

@@ -0,0 +1,22 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kube-score";
+  version = "1.10.1";
+
+  src = fetchFromGitHub {
+    owner = "zegl";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-TYsuSPWTiIlPscul/QO59+lt6sbjJdt7pJuJYO5R9Tc=";
+  };
+
+  vendorSha256 = "sha256-ob7mNheyeTcDWml4gi1SD3Pq+oWtJeySIUg2ZrCj0y0=";
+
+  meta = with lib; {
+    description = "Kubernetes object analysis with recommendations for improved reliability and security";
+    homepage    = "https://github.com/zegl/kube-score";
+    license     = licenses.mit;
+    maintainers = [ maintainers.j4m3s ];
+  };
+}

pkgs/applications/networking/cluster/kubeconform/default.nix

@@ -0,0 +1,22 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubeconform";
+  version = "0.4.6";
+
+  src = fetchFromGitHub {
+    owner = "yannh";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-lduHYYskEPUimEX54ymOyo5jY7GGBB42YTefDMNS4qo=";
+  };
+
+  vendorSha256 = null;
+
+  meta = with lib; {
+    description = "A FAST Kubernetes manifests validator, with support for Custom Resources!";
+    homepage    = "https://github.com/yannh/kubeconform/";
+    license     = licenses.asl20;
+    maintainers = [ maintainers.j4m3s ];
+  };
+}

pkgs/applications/networking/cluster/octant/default.nix

@@ -15,12 +15,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "octant";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchsrc version {
-    x86_64-linux = "sha256-kYS8o97HBjNgwmrG4fjsqFWxZy6ATFOhxt6j3KMZbEc=";
+    x86_64-linux = "sha256-D/pHOXR7XQoJCGqUep1lBAY4239HH35m+evFd21pcK0=";
-    aarch64-linux = "sha256-/Tpna2Y8+PQt+SeOJ9NDweRWGiQXU/sN+Wh/vLYQPwM=";
+    aarch64-linux = "sha256-aL1axz3ebqrKQ3xK2UgDMQ+o6ZKgIvwy6Phici7WT2c=";
-    x86_64-darwin = "sha256-aOUmnD+l/Cc5qTiHxFLBjCatszmPdUc4YYZ6Oy5DT3U=";
+    x86_64-darwin = "sha256-MFxOAAEnLur0LJJNU0SSlO+bH4f18zOfZNA49fKEQEw=";
   };
 
   dontConfigure = true;

pkgs/applications/networking/cluster/sonobuoy/default.nix

@@ -5,7 +5,7 @@ let rev = "f6e19140201d6bf2f1274bf6567087bc25154210";
 in
 buildGoModule rec {
   pname = "sonobuoy";
-  version = "0.20.0"; # Do not forget to update `rev` above
+  version = "0.50.0"; # Do not forget to update `rev` above
 
   buildFlagsArray =
     let t = "github.com/vmware-tanzu/sonobuoy";
@@ -17,13 +17,13 @@ buildGoModule rec {
     '';
 
   src = fetchFromGitHub {
-    sha256 = "11qawsv82i1pl4mwfc85wb4fbq961bplvmygnjfm79m8z87863ri";
+    sha256 = "sha256-LhprsDlWZjNRE6pu7V9WBszy/+bNpn5KoRopIoWvdsg=";
     rev = "v${version}";
     repo = "sonobuoy";
     owner = "vmware-tanzu";
   };
 
-  vendorSha256 = "1kxzd4czv8992y7y47la5jjrbhk76sxcj3v5sx0k4xplgki7np6i";
+  vendorSha256 = "sha256-0Vx74nz0djJB12UPybo2Z8KVpSyKHuKPFymh/Rlpv88=";
 
   subPackages = [ "." ];
 

pkgs/applications/networking/cluster/terraform-docs/default.nix

@@ -1,16 +1,16 @@
 { lib, buildGoModule, fetchFromGitHub }:
 buildGoModule rec {
   pname = "terraform-docs";
-  version = "0.11.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "terraform-docs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-x2YTd4ZnimTRkFWbwFp4qz6BymD6ESVxBy6YE+QqQ6k=";
+    sha256 = "sha256-6jUYntnMB/LxyZuRkSaOVcrzJOIoucdaY+5GVHwJL8Y=";
   };
 
-  vendorSha256 = "sha256-drfhfY03Ao0fqleBdzbAnPsE4kVrJMcUbec0txaEIP0=";
+  vendorSha256 = "sha256-HO2E8i5A/2Xi7Pq+Mqb/2ogK1to8IvZjRuDXfzGvOXk=";
 
   subPackages = [ "." ];
 

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -511,10 +511,12 @@
   },
   "kubernetes-alpha": {
     "owner": "hashicorp",
+    "provider-source-address": "registry.terraform.io/hashicorp/kubernetes-alpha",
     "repo": "terraform-provider-kubernetes-alpha",
-    "rev": "nightly20200608",
+    "rev": "v0.3.2",
-    "sha256": "1g171sppf3kq5qlp6g0qqdm0x8lnpizgw8bxjlhp9b6cl4kym70m",
+    "sha256": "0lgh42fvfwvj6cw8i7800k016ay4babqiz38q0y7apq4s7vs62sb",
-    "version": "nightly20200608"
+    "vendorSha256": null,
+    "version": "0.3.2"
   },
   "launchdarkly": {
     "owner": "terraform-providers",
@@ -1084,10 +1086,11 @@
     "version": "2.3.0"
   },
   "yandex": {
-    "owner": "terraform-providers",
+    "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.40.0",
+    "rev": "v0.54.0",
-    "sha256": "0dymhdrdm00m9xn4xka3zbvjqnckhl06vz5zm6rqivkmw8m2q0mz",
+    "sha256": "0q9m7520zl7q1liri6x849xjp221wbc9l2w6dj19mmgfwspqv02l",
-    "version": "0.40.0"
+    "vendorSha256": "0rzldsb8gyhvnsd26wg9byqngzzj64pi86v2hb4i63rlfmnn77xi",
+    "version": "0.54.0"
   }
 }

pkgs/applications/networking/cluster/terraform/default.nix

@@ -157,8 +157,8 @@ in rec {
   });
 
   terraform_0_14 = pluggable (generic {
-    version = "0.14.8";
+    version = "0.14.9";
-    sha256 = "0kpw8w28pfyr136z5d4pxw7g9ch6rk2lfwh3lwz25mngq1lljmn0";
+    sha256 = "0r9d28mbj7h9prr39gm5kd49l7sm8l1ab9rwrkpyhwgr119zf35b";
     vendorSha256 = "1d93aqkjdrvabkvix6h1qaxpjzv7w1wa7xa44czdnjs2lapx4smm";
     patches = [ ./provider-path.patch ];
     passthru = { inherit plugins; };

pkgs/applications/networking/cluster/terragrunt/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.28.15";
+  version = "0.28.16";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PhTFgYoSaGv54uak8QB7p963OBSgo9s1UM9/XBmYC8g=";
+    sha256 = "sha256-xt04gYxInW9UNxPG4kmMagfAQyQ+T0/u7m39grFCdAc=";
   };
 
   vendorSha256 = "sha256-vHKqowc3euQQyvgfaTbIgSXOhPcf2nSoteQK0a574Kc=";

pkgs/applications/networking/cluster/velero/default.nix

@@ -40,6 +40,6 @@ buildGoModule rec {
       "https://github.com/vmware-tanzu/velero/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = [ maintainers.mbode maintainers.bryanasdev000 ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }

pkgs/applications/networking/ftp/filezilla/default.nix

@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "filezilla";
-  version = "3.52.2";
+  version = "3.53.0";
 
   src = fetchurl {
     url = "https://download.filezilla-project.org/client/FileZilla_${version}_src.tar.bz2";
-    sha256 = "sha256-wHiIFpKKJuiGPH3CaxWGROcb7ylAbffS7aN9xIENbN8=";
+    sha256 = "sha256-MJXnYN9PVADttNqj3hshLElHk2Dy9FzE67clMMh85CA=";
   };
 
   # https://www.linuxquestions.org/questions/slackware-14/trouble-building-filezilla-3-47-2-1-current-4175671182/#post6099769

pkgs/applications/networking/instant-messengers/bitlbee/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchurl, fetchpatch, stdenv, gnutls, glib, pkg-config, check, libotr, python
+{ lib, fetchurl, fetchpatch, stdenv, gnutls, glib, pkg-config, check, libotr, python2
 , enableLibPurple ? false, pidgin ? null
 , enablePam ? false, pam ? null
 }:
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ] ++ optional doCheck check;
 
-  buildInputs = [ gnutls libotr python ]
+  buildInputs = [ gnutls libotr python2 ]
     ++ optional enableLibPurple pidgin
     ++ optional enablePam pam;
 

pkgs/applications/networking/instant-messengers/blink/default.nix

@@ -1,7 +1,7 @@
-{ lib, fetchdarcs, pythonPackages, libvncserver, zlib
+{ lib, fetchdarcs, python2Packages, libvncserver, zlib
 , gnutls, libvpx, makeDesktopItem, mkDerivationWith }:
 
-mkDerivationWith pythonPackages.buildPythonApplication rec {
+mkDerivationWith python2Packages.buildPythonApplication rec {
 
   pname = "blink";
   version = "3.2.0";
@@ -17,7 +17,7 @@ mkDerivationWith pythonPackages.buildPythonApplication rec {
     sed -i 's|@out@|'"''${out}"'|g' blink/resources.py
   '';
 
-  propagatedBuildInputs = with pythonPackages; [
+  propagatedBuildInputs = with python2Packages; [
     pyqt5_with_qtwebkit
     cjson
     sipsimple
@@ -26,7 +26,7 @@ mkDerivationWith pythonPackages.buildPythonApplication rec {
   ];
 
   buildInputs = [
-    pythonPackages.cython
+    python2Packages.cython
     zlib
     libvncserver
     libvpx

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -7,10 +7,10 @@ in {
     pname = "discord";
     binaryName = "Discord";
     desktopName = "Discord";
-    version = "0.0.13";
+    version = "0.0.14";
     src = fetchurl {
       url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-      sha256 = "0d5z6cbj9dg3hjw84pyg75f8dwdvi2mqxb9ic8dfqzk064ssiv7y";
+      sha256 = "1rq490fdl5pinhxk8lkfcfmfq7apj79jzf3m14yql1rc9gpilrf2";
     };
   };
   ptb = callPackage ./base.nix rec {

pkgs/applications/networking/instant-messengers/teamspeak/server.nix

@@ -4,13 +4,13 @@ let
   arch = if stdenv.is64bit then "amd64" else "x86";
 in stdenv.mkDerivation rec {
   pname = "teamspeak-server";
-  version = "3.13.2";
+  version = "3.13.3";
 
   src = fetchurl {
     url = "https://files.teamspeak-services.com/releases/server/${version}/teamspeak3-server_linux_${arch}-${version}.tar.bz2";
     sha256 = if stdenv.is64bit
-      then "1l9i9667wppwxbbnf6kxamnqlbxzkz9ync4rsypfla124b6cidpz"
+      then "sha256-+b9S0ekQmXF5KwvVcmHIDpp0iZRO2W1ls8eYhDzjUUw="
-      else "0qhd05abiycsgc16r1p6y8bfdrl6zji21xaqwdizpr0jb01z335g";
+      else "sha256-Qu6xPzbUdqO93j353cfQILlFYqmwFSnFWG9TjniX0+c=";
   };
 
   buildInputs = [ stdenv.cc.cc postgresql.lib ];

pkgs/applications/networking/irc/weechat/scripts/weechat-notify-send/default.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "A WeeChat script that sends highlight and message notifications through notify-send";
-    homepage = "https://github.com/s3rvac/weechat-notify-srnd";
+    homepage = "https://github.com/s3rvac/weechat-notify-send";
     license = licenses.mit;
     maintainers = with maintainers; [ tobim ];
   };