Merge origin/master into haskell-updates.

maintainers/maintainer-list.nix

@@ -118,6 +118,12 @@
     githubId = 2258953;
     name = "Aaron Schif";
   };
+  aaschmid = {
+    email = "service@aaschmid.de";
+    github = "aaschmid";
+    githubId = 567653;
+    name = "Andreas Schmid";
+  };
   abaldeau = {
     email = "andreas@baldeau.net";
     github = "baldo";
@@ -1707,6 +1713,12 @@
     githubId = 3086255;
     name = "Barry Moore II";
   };
+  chivay = {
+    email = "hubert.jasudowicz@gmail.com";
+    github = "chivay";
+    githubId = 14790226;
+    name = "Hubert Jasudowicz";
+  };
   chkno = {
     email = "chuck@intelligence.org";
     github = "chkno";
@@ -3699,6 +3711,12 @@
     githubId = 201997;
     name = "Eric Seidel";
   };
+  gspia = {
+    email = "iahogsp@gmail.com";
+    github = "gspia";
+    githubId = 3320792;
+    name = "gspia";
+  };
   guibert = {
     email = "david.guibert@gmail.com";
     github = "dguibert";
@@ -7523,6 +7541,12 @@
     githubId = 3438604;
     name = "Petter Storvik";
   };
+  p-h = {
+    email = "p@hurlimann.org";
+    github = "p-h";
+    githubId = 645664;
+    name = "Philippe Hürlimann";
+  };
   philandstuff = {
     email = "philip.g.potter@gmail.com";
     github = "philandstuff";
@@ -10554,6 +10578,12 @@
     githubId = 13378502;
     name = "Wulfsta";
   };
+  wunderbrick = {
+    name = "Andrew Phipps";
+    email = "lambdafuzz@tutanota.com";
+    github = "wunderbrick";
+    githubId = 52174714;
+  };
   wyvie = {
     email = "elijahrum@gmail.com";
     github = "wyvie";
@@ -10638,6 +10668,12 @@
     githubId = 11824817;
     name = "Marti Serra";
   };
+  xworld21 = {
+    email = "1962985+xworld21@users.noreply.github.com";
+    github = "xworld21";
+    githubId = 1962985;
+    name = "Vincenzo Mantova";
+  };
   xwvvvvwx = {
     email = "davidterry@posteo.de";
     github = "xwvvvvwx";

nixos/modules/module-list.nix

@@ -288,6 +288,7 @@
   ./services/continuous-integration/hail.nix
   ./services/continuous-integration/hercules-ci-agent/default.nix
   ./services/continuous-integration/hydra/default.nix
+  ./services/continuous-integration/github-runner.nix
   ./services/continuous-integration/gitlab-runner.nix
   ./services/continuous-integration/gocd-agent/default.nix
   ./services/continuous-integration/gocd-server/default.nix

nixos/modules/services/continuous-integration/github-runner.nix

@@ -0,0 +1,299 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  cfg = config.services.github-runner;
+  svcName = "github-runner";
+  systemdDir = "${svcName}/${cfg.name}";
+  # %t: Runtime directory root (usually /run); see systemd.unit(5)
+  runtimeDir = "%t/${systemdDir}";
+  # %S: State directory root (usually /var/lib); see systemd.unit(5)
+  stateDir = "%S/${systemdDir}";
+  # %L: Log directory root (usually /var/log); see systemd.unit(5)
+  logsDir = "%L/${systemdDir}";
+in
+{
+  options.services.github-runner = {
+    enable = mkOption {
+      default = false;
+      example = true;
+      description = ''
+        Whether to enable GitHub Actions runner.
+
+        Note: GitHub recommends using self-hosted runners with private repositories only. Learn more here:
+        <link xlink:href="https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners"
+        >About self-hosted runners</link>.
+      '';
+      type = lib.types.bool;
+    };
+
+    url = mkOption {
+      type = types.str;
+      description = ''
+        Repository to add the runner to.
+
+        Changing this option triggers a new runner registration.
+      '';
+      example = "https://github.com/nixos/nixpkgs";
+    };
+
+    tokenFile = mkOption {
+      type = types.path;
+      description = ''
+        The full path to a file which contains the runner registration token.
+        The file should contain exactly one line with the token without any newline.
+        The token can be used to re-register a runner of the same name but is time-limited.
+
+        Changing this option or the file's content triggers a new runner registration.
+      '';
+      example = "/run/secrets/github-runner/nixos.token";
+    };
+
+    name = mkOption {
+      # Same pattern as for `networking.hostName`
+      type = types.strMatching "^$|^[[:alnum:]]([[:alnum:]_-]{0,61}[[:alnum:]])?$";
+      description = ''
+        Name of the runner to configure. Defaults to the hostname.
+
+        Changing this option triggers a new runner registration.
+      '';
+      example = "nixos";
+      default = config.networking.hostName;
+    };
+
+    runnerGroup = mkOption {
+      type = types.nullOr types.str;
+      description = ''
+        Name of the runner group to add this runner to (defaults to the default runner group).
+
+        Changing this option triggers a new runner registration.
+      '';
+      default = null;
+    };
+
+    extraLabels = mkOption {
+      type = types.listOf types.str;
+      description = ''
+        Extra labels in addition to the default (<literal>["self-hosted", "Linux", "X64"]</literal>).
+
+        Changing this option triggers a new runner registration.
+      '';
+      example = literalExample ''[ "nixos" ]'';
+      default = [ ];
+    };
+
+    replace = mkOption {
+      type = types.bool;
+      description = ''
+        Replace any existing runner with the same name.
+
+        Without this flag, registering a new runner with the same name fails.
+      '';
+      default = false;
+    };
+
+    extraPackages = mkOption {
+      type = types.listOf types.package;
+      description = ''
+        Extra packages to add to <literal>PATH</literal> of the service to make them available to workflows.
+      '';
+      default = [ ];
+    };
+  };
+
+  config = mkIf cfg.enable {
+    warnings = optionals (isStorePath cfg.tokenFile) [
+      ''
+        `services.github-runner.tokenFile` points to the Nix store and, therefore, is world-readable.
+        Consider using a path outside of the Nix store to keep the token private.
+      ''
+    ];
+
+    systemd.services.${svcName} = {
+      description = "GitHub Actions runner";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network.target" "network-online.target" ];
+
+      environment = {
+        HOME = runtimeDir;
+        RUNNER_ROOT = runtimeDir;
+      };
+
+      path = (with pkgs; [
+        bash
+        coreutils
+        git
+        gnutar
+        gzip
+      ]) ++ [
+        config.nix.package
+      ] ++ cfg.extraPackages;
+
+      serviceConfig = rec {
+        ExecStart = "${pkgs.github-runner}/bin/runsvc.sh";
+
+        # Does the following, sequentially:
+        # - Copy the current and the previous `tokenFile` to the $RUNTIME_DIRECTORY
+        #   and make it accessible to the service user to allow for a content
+        #   comparison.
+        # - If the module configuration or the token has changed, clear the state directory.
+        # - Configure the runner.
+        # - Copy the configured `tokenFile` to the $STATE_DIRECTORY and make it
+        #   inaccessible to the service user.
+        # - Set up the directory structure by creating the necessary symlinks.
+        ExecStartPre =
+          let
+            # Wrapper script which expects the full path of the state, runtime and logs
+            # directory as arguments. Overrides the respective systemd variables to provide
+            # unambiguous directory names. This becomes relevant, for example, if the
+            # caller overrides any of the StateDirectory=, RuntimeDirectory= or LogDirectory=
+            # to contain more than one directory. This causes systemd to set the respective
+            # environment variables with the path of all of the given directories, separated
+            # by a colon.
+            writeScript = name: lines: pkgs.writeShellScript "${svcName}-${name}.sh" ''
+              set -euo pipefail
+
+              STATE_DIRECTORY="$1"
+              RUNTIME_DIRECTORY="$2"
+              LOGS_DIRECTORY="$3"
+
+              ${lines}
+            '';
+            currentConfigPath = "$STATE_DIRECTORY/.nixos-current-config.json";
+            runnerRegistrationConfig = getAttrs [ "name" "tokenFile" "url" "runnerGroup" "extraLabels" ] cfg;
+            newConfigPath = builtins.toFile "${svcName}-config.json" (builtins.toJSON runnerRegistrationConfig);
+            currentConfigTokenFilename = ".current-token";
+            newConfigTokenFilename = ".new-token";
+            runnerCredFiles = [
+              ".credentials"
+              ".credentials_rsaparams"
+              ".runner"
+            ];
+            ownConfigTokens = writeScript "own-config-tokens" ''
+              # Copy current and new token file to runtime dir and make it accessible to the service user
+              cp ${escapeShellArg cfg.tokenFile} "$RUNTIME_DIRECTORY/${newConfigTokenFilename}"
+              chmod 600 "$RUNTIME_DIRECTORY/${newConfigTokenFilename}"
+              chown "$USER" "$RUNTIME_DIRECTORY/${newConfigTokenFilename}"
+
+              if [[ -e "$STATE_DIRECTORY/${currentConfigTokenFilename}" ]]; then
+                cp "$STATE_DIRECTORY/${currentConfigTokenFilename}" "$RUNTIME_DIRECTORY/${currentConfigTokenFilename}"
+                chmod 600 "$RUNTIME_DIRECTORY/${currentConfigTokenFilename}"
+                chown "$USER" "$RUNTIME_DIRECTORY/${currentConfigTokenFilename}"
+              fi
+            '';
+            disownConfigTokens = writeScript "disown-config-tokens" ''
+              # Make the token inaccessible to the runner service user
+              chmod 600 "$STATE_DIRECTORY/${currentConfigTokenFilename}"
+              chown root:root "$STATE_DIRECTORY/${currentConfigTokenFilename}"
+            '';
+            unconfigureRunner = writeScript "unconfigure" ''
+              differs=
+              # Set `differs = 1` if current and new runner config differ or if `currentConfigPath` does not exist
+              ${pkgs.diffutils}/bin/diff -q '${newConfigPath}' "${currentConfigPath}" >/dev/null 2>&1 || differs=1
+              # Also trigger a registration if the token content changed
+              ${pkgs.diffutils}/bin/diff -q \
+                "$RUNTIME_DIRECTORY"/{${currentConfigTokenFilename},${newConfigTokenFilename}} \
+                >/dev/null 2>&1 || differs=1
+
+              if [[ -n "$differs" ]]; then
+                echo "Config has changed, removing old runner state."
+                echo "The old runner will still appear in the GitHub Actions UI." \
+                  "You have to remove it manually."
+                find "$STATE_DIRECTORY/" -mindepth 1 -delete
+              fi
+            '';
+            configureRunner = writeScript "configure" ''
+              empty=$(ls -A "$STATE_DIRECTORY")
+              if [[ -z "$empty" ]]; then
+                echo "Configuring GitHub Actions Runner"
+                token=$(< "$RUNTIME_DIRECTORY"/${newConfigTokenFilename})
+                RUNNER_ROOT="$STATE_DIRECTORY" ${pkgs.github-runner}/bin/config.sh \
+                  --unattended \
+                  --work "$RUNTIME_DIRECTORY" \
+                  --url ${escapeShellArg cfg.url} \
+                  --token "$token" \
+                  --labels ${escapeShellArg (concatStringsSep "," cfg.extraLabels)} \
+                  --name ${escapeShellArg cfg.name} \
+                  ${optionalString cfg.replace "--replace"} \
+                  ${optionalString (cfg.runnerGroup != null) "--runnergroup ${escapeShellArg cfg.runnerGroup}"}
+
+                # Move the automatically created _diag dir to the logs dir
+                mkdir -p  "$STATE_DIRECTORY/_diag"
+                cp    -r  "$STATE_DIRECTORY/_diag/." "$LOGS_DIRECTORY/"
+                rm    -rf "$STATE_DIRECTORY/_diag/"
+
+                # Cleanup token from config
+                rm -f "$RUNTIME_DIRECTORY"/${currentConfigTokenFilename}
+                mv    "$RUNTIME_DIRECTORY"/${newConfigTokenFilename} "$STATE_DIRECTORY/${currentConfigTokenFilename}"
+
+                # Symlink to new config
+                ln -s '${newConfigPath}' "${currentConfigPath}"
+              fi
+            '';
+            setupRuntimeDir = writeScript "setup-runtime-dirs" ''
+              # Link _diag dir
+              ln -s "$LOGS_DIRECTORY" "$RUNTIME_DIRECTORY/_diag"
+
+              # Link the runner credentials to the runtime dir
+              ln -s "$STATE_DIRECTORY"/{${lib.concatStringsSep "," runnerCredFiles}} "$RUNTIME_DIRECTORY/"
+            '';
+          in
+          map (x: "${x} ${escapeShellArgs [ stateDir runtimeDir logsDir ]}") [
+            "+${ownConfigTokens}" # runs as root
+            unconfigureRunner
+            configureRunner
+            "+${disownConfigTokens}" # runs as root
+            setupRuntimeDir
+          ];
+
+        # Contains _diag
+        LogsDirectory = [ systemdDir ];
+        # Default RUNNER_ROOT which contains ephemeral Runner data
+        RuntimeDirectory = [ systemdDir ];
+        # Home of persistent runner data, e.g., credentials
+        StateDirectory = [ systemdDir ];
+        StateDirectoryMode = "0700";
+        WorkingDirectory = runtimeDir;
+
+        # By default, use a dynamically allocated user
+        DynamicUser = true;
+
+        KillMode = "process";
+        KillSignal = "SIGTERM";
+
+        # Hardening (may overlap with DynamicUser=)
+        # The following options are only for optimizing:
+        # systemd-analyze security github-runner
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        # ProtectClock= adds DeviceAllow=char-rtc r
+        DeviceAllow = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        UMask = "0066";
+
+        # Needs network access
+        PrivateNetwork = false;
+        # Cannot be true due to Node
+        MemoryDenyWriteExecute = false;
+      };
+    };
+  };
+}

nixos/modules/services/databases/postgresql.nix

@@ -163,7 +163,7 @@ in
               '';
               example = literalExample ''
                 {
-                  "DATABASE nextcloud" = "ALL PRIVILEGES";
+                  "DATABASE \"nextcloud\"" = "ALL PRIVILEGES";
                   "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
                 }
               '';

nixos/modules/services/databases/redis.nix

@@ -88,6 +88,13 @@ in
         example = "/run/redis/redis.sock";
       };
 
+      unixSocketPerm = mkOption {
+        type = types.int;
+        default = 750;
+        description = "Change permissions for the socket";
+        example = 700;
+      };
+
       logLevel = mkOption {
         type = types.str;
         default = "notice"; # debug, verbose, notice, warning
@@ -204,7 +211,6 @@ in
         '';
         example = literalExample ''
           {
-            unixsocketperm = "700";
             loadmodule = [ "/path/to/my_module.so" "/path/to/other_module.so" ];
           }
         '';
@@ -256,7 +262,7 @@ in
         slowlog-max-len = cfg.slowLogMaxLen;
       }
       (mkIf (cfg.bind != null) { bind = cfg.bind; })
-      (mkIf (cfg.unixSocket != null) { unixsocket = cfg.unixSocket; })
+      (mkIf (cfg.unixSocket != null) { unixsocket = cfg.unixSocket; unixsocketperm = "${toString cfg.unixSocketPerm}"; })
       (mkIf (cfg.slaveOf != null) { slaveof = "${cfg.slaveOf.ip} ${cfg.slaveOf.port}"; })
       (mkIf (cfg.masterAuth != null) { masterauth = cfg.masterAuth; })
       (mkIf (cfg.requirePass != null) { requirepass = cfg.requirePass; })
@@ -277,11 +283,18 @@ in
 
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/redis-server /run/redis/redis.conf";
-        RuntimeDirectory = "redis";
-        StateDirectory = "redis";
         Type = "notify";
+        # User and group
         User = "redis";
         Group = "redis";
+        # Runtime directory and mode
+        RuntimeDirectory = "redis";
+        RuntimeDirectoryMode = "0750";
+        # State directory and mode
+        StateDirectory = "redis";
+        StateDirectoryMode = "0700";
+        # Access write directories
+        UMask = "0077";
       };
     };
   };

nixos/modules/services/mail/postfix.nix

@@ -11,6 +11,7 @@ let
 
   haveAliases = cfg.postmasterAlias != "" || cfg.rootAlias != ""
                       || cfg.extraAliases != "";
+  haveCanonical = cfg.canonical != "";
   haveTransport = cfg.transport != "";
   haveVirtual = cfg.virtual != "";
   haveLocalRecipients = cfg.localRecipients != null;
@@ -244,6 +245,7 @@ let
   ;
 
   aliasesFile = pkgs.writeText "postfix-aliases" aliases;
+  canonicalFile = pkgs.writeText "postfix-canonical" cfg.canonical;
   virtualFile = pkgs.writeText "postfix-virtual" cfg.virtual;
   localRecipientMapFile = pkgs.writeText "postfix-local-recipient-map" (concatMapStrings (x: x + " ACCEPT\n") cfg.localRecipients);
   checkClientAccessFile = pkgs.writeText "postfix-check-client-access" cfg.dnsBlacklistOverrides;
@@ -529,6 +531,15 @@ in
         ";
       };
 
+      canonical = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Entries for the <citerefentry><refentrytitle>canonical</refentrytitle>
+          <manvolnum>5</manvolnum></citerefentry> table.
+        '';
+      };
+
       virtual = mkOption {
         type = types.lines;
         default = "";
@@ -941,6 +952,9 @@ in
     (mkIf haveAliases {
       services.postfix.aliasFiles.aliases = aliasesFile;
     })
+    (mkIf haveCanonical {
+      services.postfix.mapFiles.canonical = canonicalFile;
+    })
     (mkIf haveTransport {
       services.postfix.mapFiles.transport = transportFile;
     })

nixos/modules/services/misc/jellyfin.nix

@@ -29,6 +29,16 @@ in
         default = "jellyfin";
         description = "Group under which jellyfin runs.";
       };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open the default ports in the firewall for the media server. The
+          HTTP/HTTPS ports can be changed in the Web UI, so this option should
+          only be used if they are unchanged.
+        '';
+      };
     };
   };
 
@@ -104,6 +114,12 @@ in
       jellyfin = {};
     };
 
+    networking.firewall = mkIf cfg.openFirewall {
+      # from https://jellyfin.org/docs/general/networking/index.html
+      allowedTCPPorts = [ 8096 8920 ];
+      allowedUDPPorts = [ 1900 7359 ];
+    };
+
   };
 
   meta.maintainers = with lib.maintainers; [ minijackson ];

nixos/modules/services/networking/spacecookie.nix

@@ -4,10 +4,22 @@ with lib;
 
 let
   cfg = config.services.spacecookie;
-  configFile = pkgs.writeText "spacecookie.json" (lib.generators.toJSON {} {
+
-    inherit (cfg) hostname port root;
+  spacecookieConfig = {
-  });
+    listen = {
+      inherit (cfg) port;
+    };
+  } // cfg.settings;
+
+  format = pkgs.formats.json {};
+
+  configFile = format.generate "spacecookie.json" spacecookieConfig;
+
 in {
+  imports = [
+    (mkRenamedOptionModule [ "services" "spacecookie" "root" ] [ "services" "spacecookie" "settings" "root" ])
+    (mkRenamedOptionModule [ "services" "spacecookie" "hostname" ] [ "services" "spacecookie" "settings" "hostname" ])
+  ];
 
   options = {
 
@@ -15,32 +27,149 @@ in {
 
       enable = mkEnableOption "spacecookie";
 
-      hostname = mkOption {
+      package = mkOption {
-        type = types.str;
+        type = types.package;
-        default = "localhost";
+        default = pkgs.spacecookie;
-        description = "The hostname the service is reachable via. Clients will use this hostname for further requests after loading the initial gopher menu.";
+        defaultText = literalExample "pkgs.spacecookie";
+        example = literalExample "pkgs.haskellPackages.spacecookie";
+        description = ''
+          The spacecookie derivation to use. This can be used to
+          override the used package or to use another version.
+        '';
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open the necessary port in the firewall for spacecookie.
+        '';
       };
 
       port = mkOption {
         type = types.port;
         default = 70;
-        description = "Port the gopher service should be exposed on.";
+        description = ''
+          Port the gopher service should be exposed on.
+        '';
       };
 
-      root = mkOption {
+      address = mkOption {
+        type = types.str;
+        default = "[::]";
+        description = ''
+          Address to listen on. Must be in the
+          <literal>ListenStream=</literal> syntax of
+          <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.socket.html">systemd.socket(5)</link>.
+        '';
+      };
+
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = format.type;
+
+          options.hostname = mkOption {
+            type = types.str;
+            default = "localhost";
+            description = ''
+              The hostname the service is reachable via. Clients
+              will use this hostname for further requests after
+              loading the initial gopher menu.
+            '';
+          };
+
+          options.root = mkOption {
             type = types.path;
             default = "/srv/gopher";
-        description = "The root directory spacecookie serves via gopher.";
+            description = ''
+              The directory spacecookie should serve via gopher.
+              Files in there need to be world-readable since
+              the spacecookie service file sets
+              <literal>DynamicUser=true</literal>.
+            '';
+          };
+
+          options.log = {
+            enable = mkEnableOption "logging for spacecookie"
+              // { default = true; example = false; };
+
+            hide-ips = mkOption {
+              type = types.bool;
+              default = true;
+              description = ''
+                If enabled, spacecookie will hide personal
+                information of users like IP addresses from
+                log output.
+              '';
+            };
+
+            hide-time = mkOption {
+              type = types.bool;
+              # since we are starting with systemd anyways
+              # we deviate from the default behavior here:
+              # journald will add timestamps, so no need
+              # to double up.
+              default = true;
+              description = ''
+                If enabled, spacecookie will not print timestamps
+                at the beginning of every log line.
+              '';
+            };
+
+            level = mkOption {
+              type = types.enum [
+                "info"
+                "warn"
+                "error"
+              ];
+              default = "info";
+              description = ''
+                Log level for the spacecookie service.
+              '';
+            };
+          };
+        };
+
+        description = ''
+          Settings for spacecookie. The settings set here are
+          directly translated to the spacecookie JSON config
+          file. See
+          <link xlink:href="https://sternenseemann.github.io/spacecookie/spacecookie.json.5.html">spacecookie.json(5)</link>
+          for explanations of all options.
+        '';
       };
     };
   };
 
   config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.settings ? user);
+        message = ''
+          spacecookie is started as a normal user, so the setuid
+          feature doesn't work. If you want to run spacecookie as
+          a specific user, set:
+          systemd.services.spacecookie.serviceConfig = {
+            DynamicUser = false;
+            User = "youruser";
+            Group = "yourgroup";
+          }
+        '';
+      }
+      {
+        assertion = !(cfg.settings ? listen || cfg.settings ? port);
+        message = ''
+          The NixOS spacecookie module uses socket activation,
+          so the listen options have no effect. Use the port
+          and address options in services.spacecookie instead.
+        '';
+      }
+    ];
 
     systemd.sockets.spacecookie = {
       description = "Socket for the Spacecookie Gopher Server";
       wantedBy = [ "sockets.target" ];
-      listenStreams = [ "[::]:${toString cfg.port}" ];
+      listenStreams = [ "${cfg.address}:${toString cfg.port}" ];
       socketConfig = {
         BindIPv6Only = "both";
       };
@@ -53,7 +182,7 @@ in {
 
       serviceConfig = {
         Type = "notify";
-        ExecStart = "${pkgs.haskellPackages.spacecookie}/bin/spacecookie ${configFile}";
+        ExecStart = "${lib.getBin cfg.package}/bin/spacecookie ${configFile}";
         FileDescriptorStoreMax = 1;
 
         DynamicUser = true;
@@ -79,5 +208,9 @@ in {
         RestrictAddressFamilies = "AF_UNIX AF_INET6";
       };
     };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
   };
 }

nixos/tests/redis.nix

@@ -17,7 +17,7 @@ in
         services.redis.unixSocket = redisSocket;
 
         # Allow access to the unix socket for the "redis" group.
-        services.redis.settings.unixsocketperm = "770";
+        services.redis.unixSocketPerm = 770;
 
         users.users."member" = {
           createHome = false;

nixos/tests/spacecookie.nix

@@ -1,47 +1,52 @@
 let
   gopherRoot   = "/tmp/gopher";
   gopherHost   = "gopherd";
-  fileContent = "Hello Gopher!";
+  gopherClient = "client";
+  fileContent  = "Hello Gopher!\n";
   fileName     = "file.txt";
 in
   import ./make-test-python.nix ({...}: {
     name = "spacecookie";
     nodes = {
       ${gopherHost} = {
-        networking.firewall.allowedTCPPorts = [ 70 ];
         systemd.services.spacecookie = {
           preStart = ''
             mkdir -p ${gopherRoot}/directory
-            echo "${fileContent}" > ${gopherRoot}/${fileName}
+            printf "%s" "${fileContent}" > ${gopherRoot}/${fileName}
           '';
         };
 
         services.spacecookie = {
           enable = true;
+          openFirewall = true;
+          settings = {
             root = gopherRoot;
             hostname = gopherHost;
           };
         };
+      };
 
-      client = {};
+      ${gopherClient} = {};
     };
 
     testScript = ''
       start_all()
-      ${gopherHost}.wait_for_open_port(70)
-      ${gopherHost}.wait_for_unit("spacecookie.service")
-      client.wait_for_unit("network.target")
 
-      fileResponse = client.succeed("curl -f -s gopher://${gopherHost}//${fileName}")
+      # with daemon type notify, the unit being started
+      # should also mean the port is open
+      ${gopherHost}.wait_for_unit("spacecookie.service")
+      ${gopherClient}.wait_for_unit("network.target")
+
+      fileResponse = ${gopherClient}.succeed("curl -f -s gopher://${gopherHost}/0/${fileName}")
 
       # the file response should return our created file exactly
-      if not (fileResponse == "${fileContent}\n"):
+      if not (fileResponse == "${builtins.replaceStrings [ "\n" ] [ "\\n" ] fileContent}"):
           raise Exception("Unexpected file response")
 
       # sanity check on the directory listing: we serve a directory and a file
       # via gopher, so the directory listing should have exactly two entries,
       # one with gopher file type 0 (file) and one with file type 1 (directory).
-      dirResponse = client.succeed("curl -f -s gopher://${gopherHost}")
+      dirResponse = ${gopherClient}.succeed("curl -f -s gopher://${gopherHost}")
       dirEntries = [l[0] for l in dirResponse.split("\n") if len(l) > 0]
       dirEntries.sort()
 

pkgs/applications/audio/bschaffl/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bschaffl";
-  version = "1.4.4";
+  version = "1.4.6";
 
   src = fetchFromGitHub {
     owner = "sjaehn";
     repo = pname;
     rev = version;
-    sha256 = "sha256-tu5JL0vcqRsZYmoaYGYm/aj95i7wLtnKYGbEPD7AsoM=";
+    sha256 = "sha256-tD4LsIXb2II+TNEfzXBviMR2fq/FtCSsaL2YGun1vu0=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/audio/distrho/default.nix

@@ -1,12 +1,21 @@
-{ lib, stdenv
+{ stdenv
 , alsaLib
+, curl
 , fetchFromGitHub
+, fftwFloat
 , freetype
+, glib
+, lib
 , libGL
 , libX11
 , libXcursor
 , libXext
+, libXinerama
+, libXrandr
 , libXrender
+, libgcc
+, libglvnd
+, libsecret
 , meson
 , ninja
 , pkg-config
@@ -14,25 +23,33 @@
 
 stdenv.mkDerivation rec {
   pname = "distrho-ports";
-  version = "2020-07-14";
+  version = "2021-03-15";
 
   src = fetchFromGitHub {
     owner = "DISTRHO";
     repo = "DISTRHO-Ports";
     rev = version;
-    sha256 = "03ji41i6dpknws1vjwfxnl8c8bgisv2ng8xa4vqy2473k7wgdw4v";
+    sha256 = "00fgqwayd20akww3n2imyqscmyrjyc9jj0ar13k9dhpaxqk2jxbf";
   };
 
   nativeBuildInputs = [ pkg-config meson ninja ];
 
   buildInputs = [
     alsaLib
+    curl
+    fftwFloat
     freetype
+    glib
     libGL
     libX11
     libXcursor
     libXext
+    libXinerama
+    libXrandr
     libXrender
+    libgcc
+    libglvnd
+    libsecret
   ];
 
   meta = with lib; {
@@ -61,6 +78,7 @@ stdenv.mkDerivation rec {
         pitchedDelay
         refine
         stereosourceseparation
+        swankyamp
         tal-dub-3
         tal-filter
         tal-filter-2
@@ -71,9 +89,10 @@ stdenv.mkDerivation rec {
         tal-vocoder-2
         temper
         vex
+        vitalium
         wolpertinger
     '';
-    license = with licenses; [ gpl2 gpl3 gpl2Plus lgpl3 mit ];
+    license = with licenses; [ gpl2Only gpl3Only gpl2Plus lgpl2Plus lgpl3Only mit ];
     maintainers = [ maintainers.goibhniu ];
     platforms = [ "x86_64-linux" ];
   };

pkgs/applications/audio/snd/default.nix

@@ -1,30 +1,30 @@
 { lib, stdenv, fetchurl, pkg-config
-, gtk2, alsaLib
+, alsaLib, fftw, gsl, motif, xorg
-, fftw, gsl
 }:
 
 stdenv.mkDerivation rec {
-  name = "snd-20.3";
+  pname = "snd";
+  version = "21.1";
 
   src = fetchurl {
-    url = "mirror://sourceforge/snd/${name}.tar.gz";
+    url = "mirror://sourceforge/snd/snd-${version}.tar.gz";
-    sha256 = "016slh34gb6qqb38m8k9yg48rbhc5p12084szcwvanhh5v7fc7mk";
+    sha256 = "1jxvpgx1vqa6bwdzlzyzrjn2swjf9nfhzi9r1r96ivi0870vvjk3";
   };
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [
+  buildInputs = [ alsaLib fftw gsl motif ]
-    gtk2 alsaLib
+    ++ (with xorg; [ libXext libXft libXpm libXt ]);
-    fftw gsl
-  ];
 
-  meta = {
+  configureFlags = [ "--with-motif" ];
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
     description = "Sound editor";
-    homepage = "http://ccrma.stanford.edu/software/snd";
+    homepage = "https://ccrma.stanford.edu/software/snd/";
-    platforms = lib.platforms.linux;
+    platforms = platforms.unix;
-    license = lib.licenses.free;
+    license = licenses.free;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with maintainers; [ ];
   };
-
-
 }

pkgs/applications/blockchains/go-ethereum.nix

@@ -8,17 +8,17 @@ let
 
 in buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.10.1";
+  version = "1.10.2";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4lHT0P8Euau0AJNtg1YstJJRQ58WTUlIH+HCKEjCq/s=";
+    sha256 = "sha256-PJaJ9fCva9UUBcQrnVa2c7dk4koi6AyX6bj3JStUMwM=";
   };
 
   runVend = true;
-  vendorSha256 = "sha256-DgyOvplk1JWn6D/z4zbXHLNLuAVQ5beEHi0NuSv236A=";
+  vendorSha256 = "sha256-qLpwrV9NkmUO0yoK2/gwb5oe/lky/w/P0QVoFSTNuMU=";
 
   doCheck = false;
 

pkgs/applications/blockchains/polkadot/default.nix

@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "0.8.29";
+  version = "0.8.30";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot";
     rev = "v${version}";
-    sha256 = "sha256-O5GIbX7qp+Te5QQuqytC9rsQJ5FuXtUl5h2DZXsfMPk=";
+    sha256 = "sha256-9GCk1gqlQJhuoiKRi7J1qcJlZjlq2ObGicp5tGGDhrY=";
   };
 
-  cargoSha256 = "sha256-4VmRIrd79odnYrHuBLdFwere+7bvtUI3daVs3ZUKsdY=";
+  cargoSha256 = "sha256-pWqbcargCEkisdGnj08VQdRqjocR7zZhWukhYjfZDqI=";
 
   nativeBuildInputs = [ clang ];
 

pkgs/applications/editors/cudatext/default.nix

@@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "cudatext";
-  version = "1.129.3";
+  version = "1.131.0";
 
   src = fetchFromGitHub {
     owner = "Alexey-T";
     repo = "CudaText";
     rev = version;
-    sha256 = "1sg9wg6w3w0phrnnzpj7h2g22y0x7a3dl57djzydayxmg8fnn2ys";
+    sha256 = "1zq17yi5zn4hdgrrn3c3cdk6s38fv36r66dl0dqz2z8jjd6vy4p3";
   };
 
   postPatch = ''
@@ -106,8 +106,8 @@ stdenv.mkDerivation rec {
       Config system in JSON files. Multi-carets and multi-selections.
       Search and replace with RegEx. Extendable by Python plugins and themes.
     '';
-    homepage = "http://www.uvviewsoft.com/cudatext/";
+    homepage = "https://cudatext.github.io/";
-    changelog = "http://uvviewsoft.com/cudatext/history.txt";
+    changelog = "https://cudatext.github.io/history.txt";
     license = licenses.mpl20;
     maintainers = with maintainers; [ sikmir ];
     platforms = platforms.linux;

pkgs/applications/editors/cudatext/deps.json

@@ -11,18 +11,18 @@
   },
   "ATFlatControls": {
     "owner": "Alexey-T",
-    "rev": "2021.03.05",
+    "rev": "2021.04.01",
-    "sha256": "1p2pzha5dd4p23j2bv6jxphj596dlb5v8ixjzg4x2zglz2hir6yz"
+    "sha256": "12sncivsv6pvwflzzy12rpn1fjiq64n2n3bcj7630xxlrbygkhxb"
   },
   "ATSynEdit": {
     "owner": "Alexey-T",
-    "rev": "2021.03.16",
+    "rev": "2021.04.09",
-    "sha256": "1sq9j2zaif019gl6nf391lyp8k9s38f5s6ci7k3z5v90hkz1dcql"
+    "sha256": "1ldr2z88zywn0ccgs17vfhq55ibihjcmfjjxcqsjifrbm0y6wipp"
   },
   "ATSynEdit_Cmp": {
     "owner": "Alexey-T",
-    "rev": "2021.03.08",
+    "rev": "2021.04.01",
-    "sha256": "0xvnvx4qzp6nxi912i4zlnal91k6vbcsyfbz05ib73sz68xqd5qv"
+    "sha256": "1g6zp9d7vwjisad3y1mfnk1jcbjqxp3yimm0sh1655al6qwn886m"
   },
   "EControl": {
     "owner": "Alexey-T",
@@ -31,8 +31,8 @@
   },
   "ATSynEdit_Ex": {
     "owner": "Alexey-T",
-    "rev": "2021.03.16",
+    "rev": "2021.04.01",
-    "sha256": "1a4mxcwjm9naxh4piqm5y93w2xd5rgl0vcn108wy1pkr221agg2q"
+    "sha256": "1hq9hbv81mcymjcms97wcwcfqfpxis6h6v5m0syyih4r53khv0az"
   },
   "Python-for-Lazarus": {
     "owner": "Alexey-T",

pkgs/applications/graphics/ImageMagick/7.0.nix

@@ -16,13 +16,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.0.11-5";
+  version = "7.0.11-6";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    sha256 = "sha256-HJUC8lUHORZMHvSv1/EYM+JOsd89quFaU1Fz08AckG8=";
+    sha256 = "sha256-QClOS58l17KHeQXya+IKNx6nIkd6jCKp8uupRH7Fwnk=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big

pkgs/applications/graphics/fig2dev/default.nix

@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fig2dev";
-  version = "3.2.8";
+  version = "3.2.8a";
 
   src = fetchurl {
     url = "mirror://sourceforge/mcj/fig2dev-${version}.tar.xz";
-    sha256 = "0zg29yqknfafyzmmln4k7kydfb2dapk3r8ffvlqhj3cm8fp5h4lk";
+    sha256 = "1bm75lf9j54qpbjx8hzp6ixaayp1x9w4v3yxl6vxyw8g5m4sqdk3";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/graphics/pdfcpu/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pdfcpu";
-  version = "0.3.9";
+  version = "0.3.11";
 
   src = fetchFromGitHub {
     owner = "pdfcpu";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-btkGn/67KVFB272j7u5MKZCeby2fyRthLLeXj8VgX7s=";
+    sha256 = "sha256-kLRxZW89Bm2N/KxFYetIq+auPBW/vFoUnB8uaEcM8Yo=";
   };
 
-  vendorSha256 = "sha256-/SsDDFveovJfuEdnOkxHAWccS8PJW5k9IHSxSJAgHMQ=";
+  vendorSha256 = "sha256-p/2Bu5h2P3ebgvSC12jdR2Zpd27xCFwtB/KZV0AULAM=";
 
   # No tests
   doCheck = false;

pkgs/applications/graphics/xfig/default.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xfig";
-  version = "3.2.8";
+  version = "3.2.8a";
 
   src = fetchurl {
     url = "mirror://sourceforge/mcj/xfig-${version}.tar.xz";
-    sha256 = "1czamqp0xn0j6qjnasa3fjnrzi072v6qknylr6jrs4gwsfw4ybyw";
+    sha256 = "0y45i1gqg3r0aq55jk047l1hnv90kqis6ld9lppx6c5jhpmc0hxs";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/misc/blender/default.nix

@@ -35,7 +35,8 @@ stdenv.mkDerivation rec {
 
   patches = lib.optional stdenv.isDarwin ./darwin.patch;
 
-  nativeBuildInputs = [ cmake makeWrapper ] ++ optional cudaSupport addOpenGLRunpath;
+  nativeBuildInputs = [ cmake makeWrapper python3Packages.wrapPython ]
+    ++ optionals cudaSupport [ addOpenGLRunpath ];
   buildInputs =
     [ boost ffmpeg gettext glew ilmbase
       freetype libjpeg libpng libsamplerate libsndfile libtiff
@@ -63,6 +64,7 @@ stdenv.mkDerivation rec {
     ++ optional cudaSupport cudatoolkit
     ++ optional colladaSupport opencollada
     ++ optional spaceNavSupport libspnav;
+  pythonPath = with python3Packages; [ numpy requests ];
 
   postPatch = ''
     # allow usage of dynamically linked embree
@@ -109,6 +111,7 @@ stdenv.mkDerivation rec {
       "-DWITH_PYTHON_INSTALL_NUMPY=OFF"
       "-DPYTHON_NUMPY_PATH=${python3Packages.numpy}/${python.sitePackages}"
       "-DPYTHON_NUMPY_INCLUDE_DIRS=${python3Packages.numpy}/${python.sitePackages}/numpy/core/include"
+      "-DWITH_PYTHON_INSTALL_REQUESTS=OFF"
       "-DWITH_OPENVDB=ON"
       "-DWITH_TBB=ON"
       "-DWITH_IMAGE_OPENJPEG=ON"
@@ -137,10 +140,11 @@ stdenv.mkDerivation rec {
 
   blenderExecutable =
     placeholder "out" + (if stdenv.isDarwin then "/Blender.app/Contents/MacOS/Blender" else "/bin/blender");
-  # --python-expr is used to workaround https://developer.blender.org/T74304
   postInstall = ''
+    buildPythonPath "$pythonPath"
     wrapProgram $blenderExecutable \
-      --prefix PYTHONPATH : ${python3Packages.numpy}/${python.sitePackages} \
+      --prefix PATH : $program_PATH \
+      --prefix PYTHONPATH : "$program_PYTHONPATH" \
       --add-flags '--python-use-system-env'
   '';
 

pkgs/applications/misc/foxitreader/default.nix

@@ -0,0 +1,79 @@
+{ mkDerivation, lib, fetchzip, libarchive, autoPatchelfHook, libsecret, libGL, zlib, openssl, qtbase, qtwebkit, qtxmlpatterns }:
+
+mkDerivation rec {
+  pname = "foxitreader";
+  version = "2.4.4.0911";
+
+  src = fetchzip {
+    url = "https://cdn01.foxitsoftware.com/pub/foxit/reader/desktop/linux/${lib.versions.major version}.x/${lib.versions.majorMinor version}/en_us/FoxitReader.enu.setup.${version}.x64.run.tar.gz";
+    sha256 = "0ff4xs9ipc7sswq0czfhpsd7qw7niw0zsf9wgsqhbbgzcpbdhcb7";
+    stripRoot = false;
+  };
+
+  buildInputs = [ libGL libsecret openssl qtbase qtwebkit qtxmlpatterns zlib ];
+
+  nativeBuildInputs = [ autoPatchelfHook libarchive ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    input_file=$src/*.run
+    mkdir -p extracted
+    # Look for all 7z files and extract them
+    grep --only-matching --byte-offset --binary \
+      --text -P '7z\xBC\xAF\x27\x1C\x00\x03' $input_file | cut -d: -f1 |
+      while read position; do
+        tail -c +$(($position + 1)) $input_file > file.7z
+        bsdtar xf file.7z -C extracted
+      done
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    cd extracted
+
+    cp -r  \
+      CollectStrategy.txt \
+      cpdf_settings \
+      fxplugins \
+      lang \
+      resource \
+      run \
+      stamps \
+      welcome \
+      Wrappers \
+      $out/lib/
+
+    patchelf $out/lib/fxplugins/librms.so \
+      --replace-needed libssl.so.10 libssl.so \
+      --replace-needed libcrypto.so.10 libcrypto.so
+
+    # FIXME: Doing this with one invocation is broken right now
+    patchelf $out/lib/fxplugins/librmscrypto.so \
+      --replace-needed libssl.so.10 libssl.so
+    patchelf $out/lib/fxplugins/librmscrypto.so \
+      --replace-needed libcrypto.so.10 libcrypto.so
+
+    install -D -m 755 FoxitReader -t $out/bin
+
+    # Install icon and desktop files
+    install -D -m 644 images/FoxitReader.png -t $out/share/pixmaps/
+    install -D -m 644 FoxitReader.desktop -t $out/share/applications/
+    echo Exec=FoxitReader %F >> $out/share/applications/FoxitReader.desktop
+
+    runHook postInstall
+  '';
+
+  qtWrapperArgs = [ "--set appname FoxitReader" "--set selfpath $out/lib" ];
+
+  meta = with lib; {
+    description = "A viewer for PDF documents";
+    homepage = "https://www.foxitsoftware.com/";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ p-h rhoriguchi ];
+  };
+}

pkgs/applications/misc/megasync/default.nix

@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , autoconf
 , automake
 , c-ares
@@ -24,21 +25,29 @@
 , unzip
 , wget
 }:
-
 mkDerivation rec {
   pname = "megasync";
-  version = "4.3.5.0";
+  version = "4.4.0.0";
 
   src = fetchFromGitHub {
     owner = "meganz";
     repo = "MEGAsync";
     rev = "v${version}_Linux";
-    sha256 = "0rr1jjy0n5bj1lh6xi3nbbcikvq69j3r9qnajp4mhywr5izpccvs";
+    sha256 = "1xggca7283943070mmpsfhh7c9avy809h0kgmf7497f4ca5zkg2y";
     fetchSubmodules = true;
   };
 
-  nativeBuildInputs =
+  nativeBuildInputs = [
-    [ autoconf automake doxygen lsb-release pkg-config qttools swig unzip ];
+    autoconf
+    automake
+    doxygen
+    libtool
+    lsb-release
+    pkg-config
+    qttools
+    swig
+    unzip
+  ];
   buildInputs = [
     c-ares
     cryptopp
@@ -47,7 +56,6 @@ mkDerivation rec {
     libmediainfo
     libraw
     libsodium
-    libtool
     libuv
     libzen
     qtbase

pkgs/applications/misc/obsidian/default.nix

@@ -30,12 +30,12 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "obsidian";
-  version = "0.11.9";
+  version = "0.11.13";
 
   src = fetchurl {
     url =
       "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/obsidian-${version}.tar.gz";
-    sha256 = "XymM3qma8H2dm2tq8Zg+oKxOzb48azqlqn701pN5gdI=";
+    sha256 = "0QL1rP37pmdIdGM9eHa7PfW1GVrvn2fX4bQPqQ8FOpI=";
   };
 
   nativeBuildInputs = [ makeWrapper graphicsmagick ];

pkgs/applications/misc/udiskie/default.nix

@@ -19,13 +19,13 @@
 
 buildPythonApplication rec {
   pname = "udiskie";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "coldfix";
     repo = "udiskie";
     rev = "v${version}";
-    hash = "sha256-eucAFMzLf2RfMfVgFTfPAgVNpDADddvTUZQO/XbBhGo=";
+    hash = "sha256-OeNAcL7jd8GiPVUGxWwX4N/G/jzxfyifaoSD/hXXwyM=";
   };
 
   nativeBuildInputs = [
@@ -58,8 +58,8 @@ buildPythonApplication rec {
   '';
 
   checkInputs = [
-    nose
     keyutils
+    nose
   ];
 
   checkPhase = ''

pkgs/applications/networking/browsers/chromium/browser.nix

@@ -89,6 +89,6 @@ mkChromiumDerivation (base: rec {
       then ["aarch64-linux" "x86_64-linux"]
       else [];
     timeout = 172800; # 48 hours (increased from the Hydra default of 10h)
-    broken = elem channel [ "beta" "dev" ];
+    broken = elem channel [ "dev" ];
   };
 })

pkgs/applications/networking/browsers/chromium/common.nix

@@ -156,7 +156,12 @@ let
       # To fix the build of chromiumBeta and chromiumDev:
       "b5b80df7dafba8cafa4c6c0ba2153dfda467dfc9" # add dependency on opus in webcodecs
       "1r4wmwaxz5xbffmj5wspv2xj8s32j9p6jnwimjmalqg3al2ba64x"
-    );
+    ) ++ optional (versionRange "89" "90.0.4422.0") (fetchpatch {
+      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/61b0ab526d2aa3c62fa20bb756461ca9a482f6c6/trunk/chromium-fix-libva-redef.patch";
+      sha256 = "1qj4sn1ngz0p1l1w3346kanr1sqlr3xdzk1f1i86lqa45mhv77ny";
+    }) ++ optional (chromiumVersionAtLeast "90")
+      ./fix-missing-atspi2-dependency.patch
+    ;
 
     postPatch = ''
       # remove unused third-party

pkgs/applications/networking/browsers/chromium/fix-missing-atspi2-dependency.patch

@@ -0,0 +1,26 @@
+From 6c5b9197076f6f384112e6566039116c56600909 Mon Sep 17 00:00:00 2001
+From: Michael Weiss <dev.primeos@gmail.com>
+Date: Sat, 10 Apr 2021 13:53:50 +0200
+Subject: [PATCH] Fix a missing atspi2 dependency
+
+See https://bugs.chromium.org/p/chromium/issues/detail?id=1197837 for
+more details.
+---
+ content/public/browser/BUILD.gn | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/content/public/browser/BUILD.gn b/content/public/browser/BUILD.gn
+index 7e7c436d90c7..20ef832f1d8c 100644
+--- a/content/public/browser/BUILD.gn
++++ b/content/public/browser/BUILD.gn
+@@ -535,6 +535,7 @@ source_set("browser_sources") {
+ 
+   if (use_atk) {
+     sources += [ "ax_inspect_factory_auralinux.cc" ]
++    configs += [ "//build/config/linux/atspi2" ]
+   }
+ 
+   if (is_linux || is_chromeos) {
+-- 
+2.20.1
+

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -115,8 +115,7 @@ let
                 };
               }
             ) {} extensions;
-          } //
+          } // lib.optionalAttrs usesNixExtensions {
-          {
             Extensions = {
               Install = lib.foldr (e: ret:
                 ret ++ [ "${e.outPath}/${e.extid}.xpi" ]

pkgs/applications/networking/browsers/lagrange/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lagrange";
-  version = "1.3.0";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "skyjake";
     repo = "lagrange";
     rev = "v${version}";
-    sha256 = "sha256-85KshJEL7ri10mSm/KgcT03WLEwRMMTGczb6mGx66Jw=";
+    sha256 = "sha256-90MN7JH84h10dSXt5Kwc2V3FKVutQ7AmNcR4TK2bpBY=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/cluster/argo/default.nix

@@ -19,16 +19,16 @@ let
 in
 buildGoModule rec {
   pname = "argo";
-  version = "2.12.10";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo";
     rev = "v${version}";
-    sha256 = "sha256-A4s6D3/1FsqrJ+Jaql4IuyD9ySChL3SXqVvl8wUDRDE=";
+    sha256 = "sha256-TbNqwTVND09WzUH8ZH7YFRwcHV8eX1G0FXtZJi67Sk4=";
   };
 
-  vendorSha256 = "sha256-4XPMixVNj6PUKobNLwpsOBT7Zs/7pkhDtQacLIB5EfE=";
+  vendorSha256 = "sha256-YjVAoMyGKMHLGEPeOOkCKCzeWFiUsXfJIKcw5GYoljg=";
 
   doCheck = false;
 

pkgs/applications/networking/cluster/octant/default.nix

@@ -1,26 +1,26 @@
 { lib, stdenv, fetchzip }:
 
-let
+stdenv.mkDerivation rec {
+  pname = "octant";
+  version = "0.19.0";
+
+  src =
+    let
       inherit (stdenv.hostPlatform) system;
       suffix = {
         x86_64-linux = "Linux-64bit";
         aarch64-linux = "Linux-arm64";
         x86_64-darwin = "macOS-64bit";
-  }."${system}" or (throw "Unsupported system: ${system}");
+      }.${system} or (throw "Unsupported system: ${system}");
-  baseurl = "https://github.com/vmware-tanzu/octant/releases/download";
       fetchsrc = version: sha256: fetchzip {
-      url = "${baseurl}/v${version}/octant_${version}_${suffix}.tar.gz";
+        url = "https://github.com/vmware-tanzu/octant/releases/download/v${version}/octant_${version}_${suffix}.tar.gz";
-      sha256 = sha256."${system}";
+        sha256 = sha256.${system};
       };
-in
+    in
-stdenv.mkDerivation rec {
+    fetchsrc version {
-  pname = "octant";
+      x86_64-linux = "sha256-TKvUBof4TLcHr9hg6AOLjVd1NcAX9HHVuuABdFKRNQA=";
-  version = "0.18.0";
+      aarch64-linux = "sha256-BJb7h6kJZ3QhdlEqNHkiFp91uYLXzYHvKftxEAhjY38=";
-
+      x86_64-darwin = "sha256-Ig98IqLmlN9D4iXrP9SXYwTrQOvbtQ/tQW+uEmntm+I=";
-  src = fetchsrc version {
-    x86_64-linux = "sha256-D/pHOXR7XQoJCGqUep1lBAY4239HH35m+evFd21pcK0=";
-    aarch64-linux = "sha256-aL1axz3ebqrKQ3xK2UgDMQ+o6ZKgIvwy6Phici7WT2c=";
-    x86_64-darwin = "sha256-MFxOAAEnLur0LJJNU0SSlO+bH4f18zOfZNA49fKEQEw=";
     };
 
   dontConfigure = true;
@@ -48,12 +48,14 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://octant.dev/";
     changelog = "https://github.com/vmware-tanzu/octant/blob/v${version}/CHANGELOG.md";
-    description = "Highly extensible platform for developers to better understand the complexity of Kubernetes clusters.";
+    description = "Highly extensible platform for developers to better understand the complexity of Kubernetes clusters";
     longDescription = ''
-      Octant is a tool for developers to understand how applications run on a Kubernetes cluster.
+      Octant is a tool for developers to understand how applications run on a
-      It aims to be part of the developer's toolkit for gaining insight and approaching complexity found in Kubernetes.
+      Kubernetes cluster.
-      Octant offers a combination of introspective tooling, cluster navigation, and object management along with a
+      It aims to be part of the developer's toolkit for gaining insight and
-      plugin system to further extend its capabilities.
+      approaching complexity found in Kubernetes. Octant offers a combination of
+      introspective tooling, cluster navigation, and object management along
+      with a plugin system to further extend its capabilities.
     '';
     license = licenses.asl20;
     maintainers = with maintainers; [ jk ];

pkgs/applications/networking/cluster/octant/desktop.nix

@@ -0,0 +1,78 @@
+{ lib, stdenv, appimageTools, fetchurl, gsettings-desktop-schemas, gtk3, undmg }:
+
+let
+  pname = "octant-desktop";
+  version = "0.19.0";
+  name = "${pname}-${version}";
+
+  inherit (stdenv.hostPlatform) system;
+
+  suffix = {
+    x86_64-linux = "AppImage";
+    x86_64-darwin = "dmg";
+  }.${system} or (throw "Unsupported system: ${system}");
+
+  src = fetchurl {
+    url = "https://github.com/vmware-tanzu/octant/releases/download/v${version}/Octant-${version}.${suffix}";
+    sha256 = {
+      x86_64-linux = "sha256-1XFb0zuyOy8XEUd9hoexItjq4assuWlWIzqw7pZxHx0=";
+      x86_64-darwin = "sha256-e3v5BFX7wnx4sAQrOq+dBIDVPJYzQZKKvKjSX+dis2U=";
+    }.${system};
+  };
+
+  linux = appimageTools.wrapType2 {
+    inherit name src passthru meta;
+
+    profile = ''
+      export LC_ALL=C.UTF-8
+      export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
+    '';
+
+    multiPkgs = null; # no 32bit needed
+    extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
+    extraInstallCommands =
+      let appimageContents = appimageTools.extractType2 { inherit name src; }; in
+      ''
+        mv $out/bin/{${name},${pname}}
+        install -Dm444 ${appimageContents}/octant.desktop -t $out/share/applications
+        substituteInPlace $out/share/applications/octant.desktop \
+          --replace 'Exec=AppRun --no-sandbox' 'Exec=${pname}'
+        install -m 444 -D ${appimageContents}/octant.png \
+          $out/share/icons/hicolor/512x512/apps/octant.png
+      '';
+  };
+
+  darwin = stdenv.mkDerivation {
+    inherit name src passthru meta;
+
+    nativeBuildInputs = [ undmg ];
+    sourceRoot = "Octant.app";
+    installPhase = ''
+      mkdir -p $out/Applications/Octant.app
+      cp -R . $out/Applications/Octant.app
+    '';
+  };
+
+  passthru = { updateScript = ./update-desktop.sh; };
+
+  meta = with lib; {
+    homepage = "https://octant.dev/";
+    changelog = "https://github.com/vmware-tanzu/octant/blob/v${version}/CHANGELOG.md";
+    description = "Highly extensible platform for developers to better understand the complexity of Kubernetes clusters";
+    longDescription = ''
+      Octant is a tool for developers to understand how applications run on a
+      Kubernetes cluster.
+      It aims to be part of the developer's toolkit for gaining insight and
+      approaching complexity found in Kubernetes. Octant offers a combination of
+      introspective tooling, cluster navigation, and object management along
+      with a plugin system to further extend its capabilities.
+    '';
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jk ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+  };
+
+in
+if stdenv.isDarwin
+then darwin
+else linux

pkgs/applications/networking/cluster/octant/update-desktop.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused gawk nix-prefetch
+
+set -euo pipefail
+
+ROOT="$(dirname "$(readlink -f "$0")")"
+NIX_DRV="$ROOT/desktop.nix"
+if [ ! -f "$NIX_DRV" ]; then
+  echo "ERROR: cannot find desktop.nix in $ROOT"
+  exit 1
+fi
+
+fetch_arch() {
+  VER="$1"; SUFFIX="$2"
+  URL="https://github.com/vmware-tanzu/octant/releases/download/v${VER}/Octant-${VER}.${SUFFIX}"
+  nix-prefetch "{ stdenv, fetchurl }:
+stdenv.mkDerivation rec {
+  pname = \"octant-desktop\"; version = \"${VER}\";
+  src = fetchurl { url = \"$URL\"; };
+}
+"
+}
+
+replace_sha() {
+  sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
+}
+
+OCTANT_VER=$(curl -Ls -w "%{url_effective}" -o /dev/null https://github.com/vmware-tanzu/octant/releases/latest | awk -F'/' '{print $NF}' | sed 's/v//')
+
+OCTANT_DESKTOP_LINUX_X64_SHA256=$(fetch_arch "$OCTANT_VER" "AppImage")
+OCTANT_DESKTOP_DARWIN_X64_SHA256=$(fetch_arch "$OCTANT_VER" "dmg")
+
+sed -i "s/version = \".*\"/version = \"$OCTANT_VER\"/" "$NIX_DRV"
+
+replace_sha "x86_64-linux" "$OCTANT_DESKTOP_LINUX_X64_SHA256"
+replace_sha "x86_64-darwin" "$OCTANT_DESKTOP_DARWIN_X64_SHA256"

pkgs/applications/networking/cluster/octant/update.sh

@@ -28,11 +28,11 @@ replace_sha() {
 OCTANT_VER=$(curl -Ls -w "%{url_effective}" -o /dev/null https://github.com/vmware-tanzu/octant/releases/latest | awk -F'/' '{print $NF}' | sed 's/v//')
 
 OCTANT_LINUX_X64_SHA256=$(fetch_arch "$OCTANT_VER" "Linux-64bit")
-OCTANT_DARWIN_X64_SHA256=$(fetch_arch "$OCTANT_VER" "Linux-arm64")
+OCTANT_LINUX_AARCH64_SHA256=$(fetch_arch "$OCTANT_VER" "Linux-arm64")
-OCTANT_LINUX_AARCH64_SHA256=$(fetch_arch "$OCTANT_VER" "macOS-64bit")
+OCTANT_DARWIN_X64_SHA256=$(fetch_arch "$OCTANT_VER" "macOS-64bit")
 
 sed -i "s/version = \".*\"/version = \"$OCTANT_VER\"/" "$NIX_DRV"
 
 replace_sha "x86_64-linux" "$OCTANT_LINUX_X64_SHA256"
-replace_sha "x86_64-darwin" "$OCTANT_LINUX_AARCH64_SHA256"
+replace_sha "aarch64-linux" "$OCTANT_LINUX_AARCH64_SHA256"
-replace_sha "aarch64-linux" "$OCTANT_DARWIN_X64_SHA256"
+replace_sha "x86_64-darwin" "$OCTANT_DARWIN_X64_SHA256"

pkgs/applications/networking/feedreaders/rssguard/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rssguard";
-  version = "3.9.0";
+  version = "3.9.1";
 
   src = fetchFromGitHub {
     owner = "martinrotter";
     repo = pname;
     rev = version;
-    sha256 = "sha256-pprWJIYAFYSTPhWVCW4dz3GWeAS53Vo8UXiyQ56Mwjo=";
+    sha256 = "sha256-zSnSCbBNySc5GQSm0O8NztCKNqdNs6bGNWL/RkmGsUw=";
   };
 
   buildInputs =  [ qtwebengine qttools ];

pkgs/applications/networking/irc/irssi/default.nix

@@ -1,19 +1,12 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, ncurses, glib, openssl, perl, libintl, libgcrypt, libotr }:
+{ lib, stdenv, fetchurl, pkg-config, ncurses, glib, openssl, perl, libintl, libgcrypt, libotr }:
 
 stdenv.mkDerivation rec {
   pname = "irssi";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchurl {
     url = "https://github.com/irssi/irssi/releases/download/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0g2nxazn4lszmd6mf1s36x5ablk4999g1qx7byrnvgnjsihjh62k";
+    sha256 = "09cwz5ff1i5lp35qhhmw6kbw5dwcn9pl16gpzkc92xg5sx3bgjr9";
-  };
-
-  # Fix irssi on GLib >2.62 input being stuck after entering a NUL byte
-  # See https://github.com/irssi/irssi/issues/1180 - remove after next update.
-  patches = fetchpatch {
-    url = "https://github.com/irssi/irssi/releases/download/1.2.2/glib-2-63.patch";
-    sha256 = "1ad1p7395n8dfmv97wrf751wwzgncqfh9fp27kq5kfdvh661da1i";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/networking/remote/aws-workspaces/default.nix

@@ -5,15 +5,15 @@
 
 stdenv.mkDerivation rec {
   pname = "aws-workspaces";
-  version = "3.1.3.925";
+  version = "3.1.5.1105";
 
   src = fetchurl {
     # ref https://d3nt0h4h6pmmc4.cloudfront.net/ubuntu/dists/bionic/main/binary-amd64/Packages
     urls = [
       "https://d3nt0h4h6pmmc4.cloudfront.net/ubuntu/dists/bionic/main/binary-amd64/workspacesclient_${version}_amd64.deb"
-      "https://web.archive.org/web/20210307233836/https://d3nt0h4h6pmmc4.cloudfront.net/ubuntu/dists/bionic/main/binary-amd64/workspacesclient_${version}_amd64.deb"
+      "https://web.archive.org/web/20210411145948/https://d3nt0h4h6pmmc4.cloudfront.net/ubuntu/dists/bionic/main/binary-amd64/workspacesclient_${version}_amd64.deb"
     ];
-    sha256 = "5b57edb4f6f8c950164fd8104bf62df4c452ab5b16cb65d48db3636959a0f0ad";
+    sha256 = "08c8912502d27e61cc2399bf99947e26c1daa1f317d5aa8cc7348d7bf8734e1b";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/syncthing/add-stcli-target.patch

@@ -1,17 +0,0 @@
-diff --git a/build.go b/build.go
-index c8a5c1cf..d75a8491 100644
---- a/build.go
-+++ b/build.go
-@@ -202,6 +202,12 @@ var targets = map[string]target{
- 			{src: "AUTHORS", dst: "deb/usr/share/doc/syncthing-relaypoolsrv/AUTHORS.txt", perm: 0644},
- 		},
- 	},
-+	"stcli": {
-+		name:        "stcli",
-+		description: "Syncthing CLI",
-+		buildPkgs:   []string{"github.com/syncthing/syncthing/cmd/stcli"},
-+		binaryName:  "stcli",
-+	},
- }
- 
- // These are repos we need to clone to run "go generate"

pkgs/applications/networking/syncthing/default.nix

@@ -3,23 +3,20 @@
 let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
-      version = "1.14.0";
+      pname = stname;
-      name = "${stname}-${version}";
+      version = "1.15.1";
 
       src = fetchFromGitHub {
         owner  = "syncthing";
         repo   = "syncthing";
         rev    = "v${version}";
-        sha256 = "1nkjbikin341v74fcwdaa2v5f3zhd8xr6pjhpka1fdw6vvnn4lnd";
+        sha256 = "sha256-d7b1hqW0ZWg74DyW1ZYMT7sIR7H89Ph38XE2Mhh7ySg=";
       };
 
-      vendorSha256 = "1kr6yyigi7bbi4xwpk009q801wvmf3aaw4m40ki0s6gjn0wjl4j3";
+      vendorSha256 = "sha256-00DdGJNCZ94Wj6yvVXJYNJZEiGxYbqTkX6wwon0O1tc=";
 
       doCheck = false;
 
-      patches = [
-        ./add-stcli-target.patch
-      ];
       BUILD_USER="nix";
       BUILD_HOST="nix";
 
@@ -83,12 +80,6 @@ in {
     '';
   };
 
-  syncthing-cli = common {
-    stname = "syncthing-cli";
-
-    target = "stcli";
-  };
-
   syncthing-discovery = common {
     stname = "syncthing-discovery";
     target = "stdiscosrv";

pkgs/applications/office/fava/default.nix

@@ -13,17 +13,17 @@ python3.pkgs.buildPythonApplication rec {
 
   propagatedBuildInputs = with python3.pkgs; [
     Babel
-    cheroot
-    flaskbabel
-    flask
-    jinja2
     beancount
+    cheroot
     click
+    flask
+    flaskbabel
+    jaraco_functools
+    jinja2
     markdown2
     ply
     simplejson
     werkzeug
-    jaraco_functools
   ];
 
   checkInputs = with python3.pkgs; [
@@ -39,10 +39,11 @@ python3.pkgs.buildPythonApplication rec {
     "test_cli"
   ];
 
-  meta = {
+  meta = with lib; {
-    homepage = "https://beancount.github.io/fava";
     description = "Web interface for beancount";
-    license = lib.licenses.mit;
+    homepage = "https://beancount.github.io/fava";
-    maintainers = with lib.maintainers; [ matthiasbeyer ];
+    changelog = "https://beancount.github.io/fava/changelog.html";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bhipple ];
   };
 }

pkgs/applications/office/foliate/default.nix

@@ -0,0 +1,45 @@
+{ stdenv, lib, fetchFromGitHub, meson, gettext, glib, gjs, ninja, python3, gtk3
+, webkitgtk, gsettings-desktop-schemas, wrapGAppsHook, desktop-file-utils
+, gobject-introspection }:
+
+stdenv.mkDerivation rec {
+  pname = "foliate";
+  version = "2.6.3";
+
+  src = fetchFromGitHub {
+    owner = "johnfactotum";
+    repo = pname;
+    rev = version;
+    sha256 = "0ribqaxl8g1i83fxbn288afwbzzls48ni57xqi07d19p9ka892mr";
+  };
+
+  nativeBuildInputs = [ meson ninja python3 wrapGAppsHook ];
+
+  postPatch = ''
+    patchShebangs build-aux/meson/postinstall.py
+  '';
+
+  postFixup = ''
+    echo "fixing wrapper"
+    sed -i "1 a imports.package._findEffectiveEntryPointName = () => 'com.github.johnfactotum.Foliate';" $out/bin/.com.github.johnfactotum.Foliate-wrapped
+    ln -s $out/bin/com.github.johnfactotum.Foliate $out/bin/foliate
+  '';
+
+  buildInputs = [
+    gettext
+    glib
+    gjs
+    gtk3
+    webkitgtk
+    desktop-file-utils
+    gobject-introspection
+    gsettings-desktop-schemas
+  ];
+
+  meta = with lib; {
+    description = "A simple and modern GTK eBook reader";
+    homepage = "https://johnfactotum.github.io/foliate/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ onny ];
+  };
+}

pkgs/applications/office/gtg/default.nix

@@ -16,13 +16,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gtg";
-  version = "unstable-2020-10-22";
+  version = "0.5";
 
   src = fetchFromGitHub {
     owner = "getting-things-gnome";
     repo = "gtg";
-    rev = "144814c16723fa9d00e17e047df5d79ab443fc5f";
+    rev = "v${version}";
-    sha256 = "1lpanfbj8y8b6cqp92lgbvfs8irrc5bsdffzcjcycazv19qm7z2n";
+    sha256 = "0b2slm7kjq6q8c7v4m7aqc8m1ynjxn3bl7445srpv1xc0dilq403";
   };
 
 
@@ -56,6 +56,10 @@ python3Packages.buildPythonApplication rec {
     xvfb_run
   ];
 
+  preBuild = ''
+    export HOME="$TMP"
+  '';
+
   format = "other";
   strictDeps = false; # gobject-introspection does not run with strictDeps (https://github.com/NixOS/nixpkgs/issues/56943)
 

pkgs/applications/office/kitsas/default.nix

@@ -0,0 +1,51 @@
+{ lib, mkDerivation, fetchFromGitHub, qmake, qtsvg, qtcreator, poppler, libzip, pkg-config }:
+
+mkDerivation rec {
+  pname = "kitsas";
+  version = "2.3";
+
+  src = fetchFromGitHub {
+    owner = "artoh";
+    repo = "kitupiikki";
+    rev = "v${version}";
+    sha256 = "1qac6cxkb45rs5pschsf2rvpa789g27shmrwpshwahqzhw42xvgl";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ qmake qtsvg poppler libzip ];
+
+  # We use a separate build-dir as otherwise ld seems to get confused between
+  # directory and executable name on buildPhase.
+  preConfigure = ''
+    mkdir build-linux
+    cd build-linux
+  '';
+
+  qmakeFlags = [
+    "../kitsas/kitsas.pro"
+    "-spec"
+    "linux-g++"
+    "CONFIG+=release"
+  ];
+
+  preFixup = ''
+    make clean
+    rm Makefile
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin $out/share/applications
+    cp kitsas $out/bin
+    cp $src/kitsas.png $out/share/applications
+    cp $src/kitsas.desktop $out/share/applications
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/artoh/kitupiikki";
+    description = "An accounting tool suitable for Finnish associations and small business";
+    maintainers = with maintainers; [ gspia ];
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/office/qownnotes/default.nix

@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "qownnotes";
-  version = "21.3.2";
+  version = "21.4.0";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
     # Can grab official version like so:
-    # $ curl https://download.tuxfamily.org/qownnotes/src/qownnotes-21.3.2.tar.xz.sha256
+    # $ curl https://download.tuxfamily.org/qownnotes/src/qownnotes-21.4.0.tar.xz.sha256
-    sha256 = "a8e8ab2ca1ef6684407adeb8fc63abcafff407a367471e053c583a1c4215e5ee";
+    sha256 = "bda454031a79a768b472677036ada7501ea430482277f1694757066922428eec";
   };
 
   nativeBuildInputs = [ qmake qttools ];

pkgs/applications/office/watson/default.nix

@@ -4,26 +4,22 @@ with pythonPackages;
 
 buildPythonApplication rec {
   pname = "watson";
-  version = "1.10.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "TailorDev";
     repo = "Watson";
     rev = version;
-    sha256 = "1s0k86ldqky6avwjaxkw1y02wyf59qwqldcahy3lhjn1b5dgsb3s";
+    sha256 = "1yxqjirv7cpg4hqj4l3a53p3p3kl82bcx6drgvl9v849vcc3l7s0";
   };
 
-  checkPhase = ''
-    pytest -vs tests
-  '';
-
   postInstall = ''
     installShellCompletion --bash --name watson watson.completion
     installShellCompletion --zsh --name _watson watson.zsh-completion
   '';
 
-  checkInputs = [ py pytest pytest-datafiles pytest-mock pytestrunner ];
+  checkInputs = [ pytestCheckHook pytest-mock mock pytest-datafiles ];
-  propagatedBuildInputs = [ arrow click click-didyoumean requests ];
+  propagatedBuildInputs = [ arrow_1 click click-didyoumean requests ];
   nativeBuildInputs = [ installShellFiles ];
 
   meta = with lib; {

pkgs/applications/science/misc/rink/default.nix

@@ -1,17 +1,17 @@
 { lib, fetchFromGitHub, rustPlatform, openssl, pkg-config, ncurses }:
 
 rustPlatform.buildRustPackage rec {
-  version = "0.5.1";
+  version = "0.6.0";
   pname = "rink";
 
   src = fetchFromGitHub {
     owner = "tiffany352";
     repo = "rink-rs";
     rev = "v${version}";
-    sha256 = "1s67drjzd4cf93hpm7b2facfd6y1x0s60aq6pygj7i02bm0cb9l9";
+    sha256 = "sha256-3uhKevuUVh7AObn2GDW2T+5wttX20SbVP+sFaFj3Jmk=";
   };
 
-  cargoSha256 = "1wd70y13lly7nccaqlv7w8znxfal0fzyf9d67y5c3aikj7hkzfin";
+  cargoSha256 = "sha256-luJzIGdcitH+PNgr86AYX6wKEkQlsRhwwylo+hzeovE=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ncurses ];
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "Unit-aware calculator";
     homepage = "https://rinkcalc.app";
-    license = with licenses; [ mpl20 gpl3 ];
+    license = with licenses; [ mpl20 gpl3Plus ];
     maintainers = with maintainers; [ sb0 Br1ght0ne ];
   };
 }

pkgs/applications/version-management/git-review/default.nix

@@ -2,7 +2,7 @@
 
 buildPythonApplication rec {
   pname = "git-review";
-  version = "1.28.0";
+  version = "2.0.0";
 
   # Manually set version because prb wants to get it from the git
   # upstream repository (and we are installing from tarball instead)
@@ -10,7 +10,7 @@ buildPythonApplication rec {
 
   src = fetchurl {
     url = "https://opendev.org/opendev/${pname}/archive/${version}.tar.gz";
-    sha256 = "1y1jzb0hlprynwwr4q5y4x06641qrhj0k69mclabnmhfam9g8ygm";
+    sha256 = "0dkyd5g2xmvsa114is3cd9qmki3hi6c06wjnra0f4xq3aqm0ajnj";
   };
 
   propagatedBuildInputs = [ pbr requests setuptools ];

pkgs/applications/video/kooha/default.nix

@@ -0,0 +1,58 @@
+{ lib, fetchFromGitHub, appstream-glib, desktop-file-utils, glib
+, gobject-introspection, gst_all_1, gtk3, libhandy, librsvg, meson, ninja
+, pkg-config, python3, wrapGAppsHook }:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "kooha";
+  version = "1.1.1";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "SeaDve";
+    repo = "Kooha";
+    rev = "v${version}";
+    sha256 = "05515xccs6y3wy28a6lkyn2jgi0fli53548l8qs73li8mdbxzd4c";
+  };
+
+  buildInputs = [
+    glib
+    gobject-introspection
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gtk3
+    libhandy
+    librsvg
+  ];
+
+  nativeBuildInputs = [
+    appstream-glib
+    desktop-file-utils
+    meson
+    ninja
+    python3
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  propagatedBuildInputs = [ python3.pkgs.pygobject3 ];
+
+  strictDeps = false;
+
+  buildPhase = ''
+    export GST_PLUGIN_SYSTEM_PATH_1_0="$out/lib/gstreamer-1.0/:$GST_PLUGIN_SYSTEM_PATH_1_0"
+  '';
+
+  # Fixes https://github.com/NixOS/nixpkgs/issues/31168
+  postPatch = ''
+    chmod +x build-aux/meson/postinstall.py
+    patchShebangs build-aux/meson/postinstall.py
+  '';
+
+  meta = with lib; {
+    description = "Simple screen recorder";
+    homepage = "https://github.com/SeaDve/Kooha";
+    license = licenses.gpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ austinbutler ];
+  };
+}

pkgs/applications/video/obs-studio/obs-multi-rtmp.nix

@@ -0,0 +1,43 @@
+{ lib, stdenv, fetchFromGitHub, obs-studio, cmake, qtbase }:
+
+stdenv.mkDerivation rec {
+  pname = "obs-multi-rtmp";
+  version = "0.2.6";
+
+  src = fetchFromGitHub {
+    owner = "sorayuki";
+    repo = "obs-multi-rtmp";
+    rev = version;
+    sha256 = "sha256-SMcVL54HwFIc7/wejEol2XiZhlZCMVCwHHtIKJ/CoYY=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ obs-studio qtbase ];
+
+  cmakeFlags = [
+    "-DLIBOBS_INCLUDE_DIR=${obs-studio}/include/obs"
+  ];
+
+  dontWrapQtApps = true;
+
+  # obs-studio expects the shared object to be located in bin/32bit or bin/64bit
+  # https://github.com/obsproject/obs-studio/blob/d60c736cb0ec0491013293c8a483d3a6573165cb/libobs/obs-nix.c#L48
+  postInstall = let
+    pluginPath = {
+      i686-linux = "bin/32bit";
+      x86_64-linux = "bin/64bit";
+    }.${stdenv.targetPlatform.system} or (throw "Unsupported system: ${stdenv.targetPlatform.system}");
+  in ''
+    mkdir -p $out/share/obs/obs-plugins/obs-multi-rtmp/${pluginPath}
+    ln -s $out/lib/obs-plugins/obs-multi-rtmp.so $out/share/obs/obs-plugins/obs-multi-rtmp/${pluginPath}
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/sorayuki/obs-multi-rtmp/";
+    changelog = "https://github.com/sorayuki/obs-multi-rtmp/releases/tag/${version}";
+    description = "Multi-site simultaneous broadcast plugin for OBS Studio";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ jk ];
+    platforms = [ "x86_64-linux" "i686-linux" ];
+  };
+}

pkgs/build-support/cc-wrapper/default.nix

@@ -299,10 +299,11 @@ stdenv.mkDerivation {
     # vs libstdc++, etc.) since Darwin isn't `useLLVM` on all counts. (See
     # https://clang.llvm.org/docs/Toolchain.html for all the axes one might
     # break `useLLVM` into.)
-    + optionalString (isClang && gccForLibs != null
+    + optionalString (isClang
                       && targetPlatform.isLinux
                       && !(stdenv.targetPlatform.useAndroidPrebuilt or false)
-                      && !(stdenv.targetPlatform.useLLVM or false)) ''
+                      && !(stdenv.targetPlatform.useLLVM or false)
+                      && gccForLibs != null) ''
       echo "--gcc-toolchain=${gccForLibs}" >> $out/nix-support/cc-cflags
     ''
 

pkgs/data/themes/matcha/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "matcha-gtk-theme";
-  version = "2021-04-05";
+  version = "2021-04-09";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
     rev = version;
-    sha256 = "0bm7hr4lqqz3z2miif38628r4qcy7i5hdk6sm0ngjacm43cl0qvg";
+    sha256 = "1989v2924g1pwycp44zlgryr73p82n9hmf71d0acs455jajf0pvv";
   };
 
   buildInputs = [ gdk-pixbuf librsvg ];

pkgs/desktops/gnome-3/extensions/unite/default.nix

@@ -1,13 +1,13 @@
 { lib, stdenv, gnome3, fetchFromGitHub, xprop, glib }:
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-unite";
-  version = "48";
+  version = "49";
 
   src = fetchFromGitHub {
     owner = "hardpixel";
     repo = "unite-shell";
     rev = "v${version}";
-    sha256 = "1rc9h7zrg9pvyl619ychcp0w7wmnf4ndaq2knv490kzhy0idj18j";
+    sha256 = "12kjljw253hshaz6x886kg3mc93lb4pxwd05qihww6m5k4lqjcy5";
   };
 
   uuid = "unite@hardpixel.eu";

pkgs/development/chez-modules/chez-matchable/default.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   doCheck = false;
 
   meta = with lib; {
-    description = "This is a Library for ChezScheme providing the protable hygenic pattern matcher by Alex Shinn";
+    description = "This is a Library for ChezScheme providing the portable hygenic pattern matcher by Alex Shinn";
     homepage = "https://github.com/fedeinthemix/chez-matchable/";
     maintainers = [ maintainers.jitwit ];
     license = licenses.publicDomain;

pkgs/development/compilers/ciao/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "ciao";
-  version = "1.19.0";
+  version = "1.20.0";
   src = fetchFromGitHub {
     owner = "ciao-lang";
     repo = "ciao";
     rev = "v${version}";
-    sha256 = "03qzcb4ivgkiwdpw7a94dn74xqyxjwz5ilrr53rcblsh5ng299jp";
+    sha256 = "sha256-Xp0ZQRi7mOO2WN/2hO6zgobDG3S0BEV+SgsaduBZ30U=";
   };
 
   configurePhase = ''

pkgs/development/compilers/juniper/default.nix

@@ -0,0 +1,41 @@
+{ lib, stdenv, fetchzip, makeWrapper, mono }:
+
+stdenv.mkDerivation rec {
+  pname = "juniper";
+  version = "2.3.0";
+
+  src = fetchzip {
+    url = "http://www.juniper-lang.org/installers/Juniper-${version}.zip";
+    sha256 = "10am6fribyl7742yk6ag0da4rld924jphxja30gynzqysly8j0vg";
+    stripRoot = false;
+  };
+
+  doCheck = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [ mono ];
+
+  installPhase = ''
+    runHook preInstall
+    rm juniper # original script with regular Linux assumptions
+    mkdir -p $out/bin
+    cp -r ./* $out
+    makeWrapper ${mono}/bin/mono $out/bin/juniper \
+      --add-flags "$out/Juniper.exe \$@"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Functional reactive programming language for programming Arduino";
+    longDescription = ''
+      Juniper targets Arduino and supports many features typical of functional programming languages, including algebraic data types, tuples, records,
+      pattern matching, immutable data structures, parametric polymorphic functions, and anonymous functions (lambdas).
+      Some imperative programming concepts are also present in Juniper, such as for, while and do while loops, the ability to mark variables as mutable, and mutable references.
+    '';
+    homepage = "https://www.juniper-lang.org/";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wunderbrick ];
+    platforms = platforms.linux;
+  };
+}

pkgs/development/libraries/aws-c-common/default.nix

@@ -1,24 +1,20 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+}:
 
 stdenv.mkDerivation rec {
   pname = "aws-c-common";
-  version = "0.5.2";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0rd2qzaa9mmn5f6f2bl1wgv54f17pqx3vwyy9f8ylh59qfnilpmg";
+    sha256 = "sha256-NH66WAOqAaMm/IIu8L5R7CUFhX56yTLH7mPY1Q4jDC4=";
   };
 
-  patches = [
-    # Remove once https://github.com/awslabs/aws-c-common/pull/764 is merged
-    (fetchpatch {
-      url = "https://github.com/awslabs/aws-c-common/commit/4f85fb3e398d4e4d320d3559235267b26cbc9531.patch";
-      sha256 = "1jg3mz507w4kwgmg57kvz419gvw47pd9rkjr6jhsmvardmyyskap";
-    })
-  ];
-
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [

pkgs/development/libraries/cpp-utilities/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpp-utilities";
-  version = "5.10.1";
+  version = "5.10.2";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8upRrk2x2gaS+JwCmZblrRSRxy0uNfFLTW7ua2ix2wI=";
+    sha256 = "sha256-hPcmO2nzXCuhU2GjE0B1Bz9OkJ4mY2txFr+cWGaw1bo=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/jasper/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jasper";
-  version = "2.0.26";
+  version = "2.0.28";
 
   src = fetchFromGitHub {
     owner = "jasper-software";
     repo = pname;
     rev = "version-${version}";
-    hash = "sha256-zmoC8nIsQm2u2cSzu2prdyofo3JFNzJ1bjbIZ3YaAn4=";
+    hash = "sha256-f3UG5w8GbwZcsFBaQN6v8kdEkKIGgizcAgaVZtKwS78=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libqalculate/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libqalculate";
-  version = "3.17.0";
+  version = "3.18.0";
 
   src = fetchFromGitHub {
     owner = "qalculate";
     repo = "libqalculate";
     rev = "v${version}";
-    sha256 = "sha256-VlKJrGZOMmnWFmdwV3SchBfyRsHM78eNV+uWONLZbJI=";
+    sha256 = "sha256-cQNcKa/mEdeH1MaLhj203MOphfYDTQ5pn/GzUmSZGcE=";
   };
 
   outputs = [ "out" "dev" "doc" ];

pkgs/development/libraries/librealsense/default.nix

@@ -7,7 +7,7 @@ assert enablePython -> pythonPackages != null;
 
 stdenv.mkDerivation rec {
   pname = "librealsense";
-  version = "2.42.0";
+  version = "2.43.0";
 
   outputs = [ "out" "dev" ];
 
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     owner = "IntelRealSense";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-8r8j0g7EaSUWujX+BNdkIJhzaLITMLsozjhOtQBriTA=";
+    sha256 = "sha256-N7EvpcJjtK3INHK7PgoiEVIMq9zGcHKMeI+/dwZ3bNs=";
   };
 
   buildInputs = [

pkgs/development/libraries/librsync/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "librsync";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "librsync";
     repo = "librsync";
     rev = "v${version}";
-    sha256 = "131cd4asmpm4nskidzgiy8xibbnpibvvbq857a0pcky77min5g4z";
+    sha256 = "sha256-GNwOIZ2UjvsYIthotiPDBrabYzCGFG/YVEbwVa9Nwi4=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/medfile/default.nix

@@ -9,6 +9,10 @@ stdenv.mkDerivation rec {
     sha256 = "1khzclkrd1yn9mz3g14ndgpsbj8j50v8dsjarcj6kkn9zgbbazc4";
   };
 
+  patches = [
+    ./hdf5-1.12.patch
+  ];
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ hdf5 ];
 

pkgs/development/libraries/medfile/hdf5-1.12.patch

@@ -0,0 +1,86 @@
+--- a/config/cmake_files/medMacros.cmake
++++ b/config/cmake_files/medMacros.cmake
+@@ -447,7 +447,7 @@ MACRO(MED_FIND_HDF5)
+     ##
+     ## Requires 1.10.x version
+     ##
+-    IF (NOT HDF_VERSION_MAJOR_REF EQUAL 1 OR NOT HDF_VERSION_MINOR_REF EQUAL 10 OR NOT HDF_VERSION_RELEASE_REF GREATER 1)
++    IF (HDF5_VERSION VERSION_LESS 1.10.2)
+         MESSAGE(FATAL_ERROR "HDF5 version is ${HDF_VERSION_REF}. Only versions >= 1.10.2 are supported.")
+     ENDIF()
+     ##
+--- a/src/ci/MEDfileCompatibility.c
++++ b/src/ci/MEDfileCompatibility.c
+@@ -71,7 +71,7 @@ MEDfileCompatibility(const char* const filename,
+   _hversionMMR=10000*_hmajeur+100*_hmineur+_hrelease;
+   /* ISCRUTE(_hversionMMR); */
+   /* ISCRUTE(HDF_VERSION_NUM_REF); */
+-  if ( (_hversionMMR >= HDF_VERSION_NUM_REF) && (_hmineur == HDF_VERSION_MINOR_REF) ) *hdfok = MED_TRUE;
++  if ( ((_hversionMMR >= HDF_VERSION_NUM_REF) && (_hmineur == HDF_VERSION_MINOR_REF)) || _hversionMMR > HDF_VERSION_NUM_REF ) *hdfok = MED_TRUE;
+ 
+   /* TODO : Vérifier si la version mineure HDF du fichier est supérieure
+      à la version mineure de la bibliothèque HDF utilisée :
+@@ -113,7 +113,7 @@ MEDfileCompatibility(const char* const filename,
+ #if MED_NUM_MAJEUR != 4
+ #error "Don't forget to update the test version here when you change the major version of the library !"
+ #endif
+-#if H5_VERS_MINOR > 10
++#if H5_VERS_MINOR > 12
+ #error "Don't forget to check the compatibility version of the library, depending on the internal hdf model choice !"
+ #error "Cf. _MEDfileCreate ..."
+ #endif
+--- a/src/hdfi/_MEDfileCreate.c
++++ b/src/hdfi/_MEDfileCreate.c
+@@ -159,7 +159,7 @@ med_idt _MEDfileCreate(const char * const filename, const med_access_mode access
+    * En HDF5-1.10.0p1 cela n'a aucun effet ! 
+    * Un test autoconf permet de fixer un intervalle de version HDF à MED.
+    */
+-#if H5_VERS_MINOR > 10
++#if H5_VERS_MINOR > 12
+ #error "Don't forget to change the compatibility version of the library !"
+ #endif
+    
+--- a/src/hdfi/_MEDfileOpen.c
++++ b/src/hdfi/_MEDfileOpen.c
+@@ -72,7 +72,7 @@ med_idt _MEDfileOpen(const char * const filename,const med_access_mode accessmod
+ 
+    •   The creation order tracking property, H5P_CRT_ORDER_TRACKED, has been set in the group creation property list (see H5Pset_link_creation_order). 
+   */
+-#if H5_VERS_MINOR > 10
++#if H5_VERS_MINOR > 12
+ #error "Don't forget to change the compatibility version of the library !"
+ #endif
+ /* L'avantage de bloquer le modèle interne HDF5 
+--- a/src/hdfi/_MEDmemFileOpen.c
++++ b/src/hdfi/_MEDmemFileOpen.c
+@@ -434,7 +434,7 @@ med_idt _MEDmemFileOpen(const char * const filename, med_memfile * const memfile
+     goto ERROR;
+   }
+ 
+-#if H5_VERS_MINOR > 10
++#if H5_VERS_MINOR > 12
+ #error "Don't forget to change the compatibility version of the library !"
+ #endif
+   if ( H5Pset_libver_bounds( _fapl, H5F_LIBVER_18, H5F_LIBVER_18) ) {
+--- a/src/hdfi/_MEDparFileCreate.c
++++ b/src/hdfi/_MEDparFileCreate.c
+@@ -64,7 +64,7 @@ med_idt _MEDparFileCreate(const char * const filename, const med_access_mode acc
+    * En HDF5-1.10.0p1 cela n'a aucun effet ! 
+    * Un test autoconf permet de fixer un intervalle de version HDF à MED.
+    */
+-#if H5_VERS_MINOR > 10
++#if H5_VERS_MINOR > 12
+ #error "Don't forget to change the compatibility version of the library !"
+ #endif
+    
+--- a/src/hdfi/_MEDparFileOpen.c
++++ b/src/hdfi/_MEDparFileOpen.c
+@@ -55,7 +55,7 @@ med_idt _MEDparFileOpen(const char * const filename,const med_access_mode access
+     MED_ERR_(_fid,MED_ERR_INIT,MED_ERR_PROPERTY,MED_ERR_PARALLEL_MSG);
+     goto ERROR;
+   }
+-#if H5_VERS_MINOR > 10
++#if H5_VERS_MINOR > 12
+ #error "Don't forget to change the compatibility version of the library !"
+ #endif
+   if ( H5Pset_libver_bounds( _fapl, H5F_LIBVER_18, H5F_LIBVER_18 ) ) {

pkgs/development/libraries/motif/Use-correct-header-for-malloc.patch

@@ -1,19 +0,0 @@
---- a/demos/programs/workspace/xrmLib.c
-+++ b/demos/programs/workspace/xrmLib.c
-@@ -30,7 +30,14 @@ static char rcsid[] = "$XConsortium: xrmLib.c /main/6 1995/07/14 10:01:41 drk $"
- #endif
- 
- #include <stdio.h>
--#include <malloc.h>
-+#if defined(__cplusplus) || defined(__STDC__) || defined(__EXTENSIONS__)
-+#  include <stdlib.h>
-+#  if defined(HAVE_MALLOC_H)
-+#  include <malloc.h>
-+#  elif defined(HAVE_SYS_MALLOC_H)
-+#  include <sys/malloc.h>
-+#  endif
-+#endif
- #include <Xm/Xm.h>
- #include "wsm.h"
- #include "wsmDebug.h"
-

pkgs/development/libraries/motif/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, libtool
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, libtool
 , xlibsWrapper, xbitmaps, libXrender, libXmu, libXt
 , expat, libjpeg, libpng, libiconv
 , flex
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "motif";
-  version = "2.3.6";
+  version = "2.3.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/motif/${pname}-${version}.tar.gz";
-    sha256 = "1ksqbp0bzdw6wcrx8s4hj4ivvxmw54hz85l2xfigb87cxmmhx0gs";
+    sha256 = "1rxwkrhmj8sfg7dwmkhq885valwqbh26d79033q7vb7fcqv756w5";
   };
 
   buildInputs = [
@@ -26,26 +26,27 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ libXp libXau ];
 
-  hardeningDisable = [ "format" ];
+  prePatch = lib.optionalString (!demoSupport) ''
-
-  makeFlags = [ "CFLAGS=-fno-strict-aliasing" ];
-
-  prePatch = ''
-    rm lib/Xm/Xm.h
-  '' + lib.optionalString (!demoSupport) ''
     sed '/^SUBDIRS =,^$/s/\<demos\>//' -i Makefile.{am,in}
   '';
 
-  patches = [ ./Remove-unsupported-weak-refs-on-darwin.patch
+  patches = [
-              ./Use-correct-header-for-malloc.patch
+    ./Remove-unsupported-weak-refs-on-darwin.patch
     ./Add-X.Org-to-bindings-file.patch
+    (fetchpatch rec {
+      name = "fix-format-security.patch";
+      url = "https://raw.githubusercontent.com/void-linux/void-packages/b9a1110dabb01c052dadc1abae1413bd4afe3652/srcpkgs/motif/patches/02-${name}";
+      sha256 = "13vzpf8yxvhf4gl7q0yzlr6ak1yzx382fsqsrv5lc8jbbg4nwrrq";
+    })
   ];
 
+  enableParallelBuilding = true;
+
   meta = with lib; {
     homepage = "https://motif.ics.com";
     description = "Unix standard widget-toolkit and window-manager";
-    platforms = with platforms; linux ++ darwin;
+    platforms = platforms.unix;
-    license = with licenses; [ lgpl21 ];
+    license = with licenses; [ lgpl21Plus ];
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ qyliss ];
   };
 }

pkgs/development/libraries/oneDNN/default.nix

@@ -5,13 +5,13 @@
 # https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
 stdenv.mkDerivation rec {
   pname = "oneDNN";
-  version = "2.1.3";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "oneDNN";
     rev = "v${version}";
-    sha256 = "sha256-xByu0HWeyDg5WV/zVO4HO/uwZ2RPrud0FlZHPfFom1E=";
+    sha256 = "sha256-orsllgBt2EHuZOy9vkgDK3XT6BfbtyIPvO4REB9tAgs=";
   };
 
   outputs = [ "out" "dev" "doc" ];

pkgs/development/libraries/physics/pythia/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pythia";
-  version = "8.303";
+  version = "8.304";
 
   src = fetchurl {
     url = "http://home.thep.lu.se/~torbjorn/pythia8/pythia${builtins.replaceStrings ["."] [""] version}.tgz";
-    sha256 = "0gli6zf8931i7kyminppisc9d0q69xxnalvhld5fgnkh4q82nz6d";
+    sha256 = "18frx7xyvxnz57fxjncjyjzsk169h0jz6hxzjfpmwm3dzcc712fk";
   };
 
   buildInputs = [ boost fastjet hepmc zlib rsync lhapdf ];

pkgs/development/libraries/physics/rivet/darwin.patch

@@ -1,33 +0,0 @@
-diff --git a/include/Rivet/Tools/osdir.hh b/include/Rivet/Tools/osdir.hh
-index 05f06ca..59af7de 100644
---- a/include/Rivet/Tools/osdir.hh
-+++ b/include/Rivet/Tools/osdir.hh
-@@ -21,7 +21,7 @@
- 
- /// @cond OSDIR
- 
--#if defined(unix) || defined(__unix) || defined(__unix__)
-+#if defined(unix) || defined(__unix) || defined(__unix__) || defined(__APPLE__)
- #define OSLINK_OSDIR_POSIX
- #elif defined(_WIN32)
- #define OSLINK_OSDIR_WINDOWS
-@@ -32,18 +32,7 @@
- #include <string>
- 
- #if defined(OSLINK_OSDIR_NOTSUPPORTED)
--
--namespace oslink
--{
--	class directory
--	{
--		public:
--			directory(const std::string&)		{ }
--			operator void*() const				{ return (void*)0; }
--			std::string next()					{ return ""; }
--	};
--}
--
-+#error Platform misdetected or oslink is not implemented
- #elif defined(OSLINK_OSDIR_POSIX)
- 
- #include <sys/types.h>

pkgs/development/libraries/physics/rivet/default.nix

@@ -1,50 +1,14 @@
-{ lib, stdenv, fetchurl, fetchpatch, fastjet, fastjet-contrib, ghostscript, hepmc, imagemagick, less, python3, rsync, texlive, yoda, which, makeWrapper }:
+{ lib, stdenv, fetchurl, fastjet, fastjet-contrib, ghostscript, hepmc, imagemagick, less, python3, rsync, texlive, yoda, which, makeWrapper }:
 
 stdenv.mkDerivation rec {
   pname = "rivet";
-  version = "3.1.3";
+  version = "3.1.4";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/rivet/Rivet-${version}.tar.bz2";
-    sha256 = "08g0f84l7r6vm4n7gn36qi3bzacscpv061m9xar2572vf10wxpak";
+    sha256 = "sha256-N+3ICilozhAxWJ5DumtJKHfKeQG+o4+Lt1NqXIz4EA0=";
   };
 
-  patches = [
-    ./darwin.patch # configure relies on impure sw_vers to -Dunix
-
-    # fix compilation errors (fails depending on number of cores filesystem ordering?)
-    # https://gitlab.com/hepcedar/rivet/-/merge_requests/220
-    (fetchpatch {
-      url = "https://gitlab.com/hepcedar/rivet/commit/3203bf12a4bef81f880789eb9cde7ff489ae5115.diff";
-      sha256 = "0zn5yxlv6dk4vcqgz0syzb9mp4qc9smpmgshcqimcvii7qcp20mc";
-    })
-    # https://gitlab.com/hepcedar/rivet/-/merge_requests/223
-    (fetchpatch {
-      url = "https://gitlab.com/hepcedar/rivet/commit/476f267c46b126fa163a92aa6cbcb7806c4624c3.diff";
-      sha256 = "0dhkraddzp06v5z0d2wf0c8vsd50hl5pqsjgsrb8x14d0vwi8rnc";
-    })
-
-    # fix for new python and fix transparency gs 9.52
-    # gs 9.52 opacity fix
-    (fetchpatch {
-      url = "https://gitlab.com/hepcedar/rivet/commit/25c4bee19882fc56407b0a438f86e1a11753d5e6.diff";
-      sha256 = "18p2wk54r0qfq6l27z6805zq1z5jhk5sbxbjixgibzq8prj1a78v";
-    })
-
-    # make-plots: fix wrong logic in Plot.set_xmax()
-    (fetchpatch {
-      url = "https://gitlab.com/hepcedar/rivet/commit/d371c6c10cf67a41c0e4e27c16ff5723d6276ad2.diff";
-      sha256 = "0w622rd5darj7qafbbc84blznvy5rnhsdyr2n1i1fkz19mrf5h2p";
-    })
-
-    # fix https://gitlab.com/hepcedar/rivet/-/issues/200
-    (fetchpatch {
-      url = "https://gitlab.com/hepcedar/rivet/commit/442dbd17dcb3bd6e30b26e54c50f6a8237f966f9.diff";
-      includes = [ "bin/make-pgfplots" "bin/make-plots" "bin/make-plots-fast" ];
-      sha256 = "0c3rysgcib49km1zdpgsdai3xi4s6ijqgxp4whn04mrh3qf4bmr3";
-    })
-  ];
-
   latex = texlive.combine { inherit (texlive)
     scheme-basic
     collection-pstricks

pkgs/development/ocaml-modules/janestreet/0.12.nix

@@ -1,13 +1,10 @@
-{ janePackage
+{ self
-, ctypes
-, num
-, octavius
-, ppxlib
-, re
 , openssl
 }:
 
-rec {
+with self;
+
+{
 
   ocaml-compiler-libs = janePackage {
     pname = "ocaml-compiler-libs";

pkgs/development/ocaml-modules/janestreet/0.14.nix

@@ -1,30 +1,11 @@
-{ janePackage
+{ self
-, alcotest
-, angstrom
-, angstrom-async
-, base64
-, cryptokit
-, ctypes
-, dune-configurator
-, faraday
-, inotify
-, js_of_ocaml
-, js_of_ocaml-ppx
-, lambdasoup
-, magic-mime
-, num
-, octavius
-, ppxlib
-, re
-, tyxml
-, uri-sexp
-, zarith
 , openssl
-, ounit
 , zstd
 }:
 
-rec {
+with self;
+
+{
 
   accessor = janePackage {
     pname = "accessor";

pkgs/development/ocaml-modules/janestreet/default.nix

@@ -1,10 +1,10 @@
-{ janePackage, ocamlbuild, angstrom, cryptokit, ctypes,
+{ self
-  magic-mime, ocaml-migrate-parsetree, octavius, ounit, ppx_deriving, re,
+, openssl
-  num, openssl
-, ppxlib
 }:
 
-rec {
+with self;
+
+{
 
   ocaml-compiler-libs = janePackage {
     pname = "ocaml-compiler-libs";

pkgs/development/ocaml-modules/janestreet/old.nix

@@ -1,8 +1,32 @@
-{ stdenv, lib, janePackage, ocaml, ocamlbuild, cryptokit, ctypes, magic-mime,
+{ self
-  ocaml-migrate-parsetree, octavius, ounit, ppx_deriving, re, zarith, num,
+, super
-  openssl }:
+, lib
+, stdenv
+, openssl
+}:
 
-rec {
+let
+  inherit (super)
+    janePackage
+    ocaml
+    ocamlbuild
+    cryptokit
+    ctypes
+    magic-mime
+    ocaml-migrate-parsetree
+    octavius
+    ounit
+    ppx_deriving
+    re
+    zarith
+    num
+    ;
+
+in
+
+with self;
+
+{
 
   # Jane Street packages, up to ppx_core
 

pkgs/development/ocaml-modules/printbox/default.nix

@@ -1,21 +1,24 @@
-{ lib, fetchFromGitHub, buildDunePackage, uucp, uutf }:
+{ lib, fetchFromGitHub, buildDunePackage, ocaml, uucp, uutf, mdx }:
 
 buildDunePackage rec {
   pname = "printbox";
-  version = "0.4";
+  version = "0.5";
 
-  minimumOCamlVersion = "4.05";
+  useDune2 = true;
+
+  minimumOCamlVersion = "4.03";
 
   src = fetchFromGitHub {
     owner = "c-cube";
     repo = pname;
     rev = version;
-    sha256 = "0bq2v37v144i00h1zwyqhkfycxailr245n97yff0f7qnidxprix0";
+    sha256 = "099yxpp7d9bms6dwzp9im7dv1qb801hg5rx6awpx3rpfl4cvqfn2";
   };
 
-  checkInputs = lib.optionals doCheck [ uucp uutf ];
+  checkInputs = [ uucp uutf mdx.bin ];
 
-  doCheck = true;
+  # mdx is not available for OCaml < 4.07
+  doCheck = lib.versionAtLeast ocaml.version "4.07";
 
   meta = {
     homepage = "https://github.com/c-cube/printbox/";

pkgs/development/python-modules/aioemonitor/default.nix

@@ -0,0 +1,49 @@
+{ lib
+, aiohttp
+, aioresponses
+, buildPythonPackage
+, fetchFromGitHub
+, pytest-asyncio
+, pytest-raises
+, pytestCheckHook
+, pythonOlder
+, xmltodict
+}:
+
+buildPythonPackage rec {
+  pname = "aioemonitor";
+  version = "1.0.5";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "bdraco";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0h8zqqy8v8r1fl9bp3m8icr2sy44p0mbfl1hbb0zni17r9r50dhn";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    xmltodict
+  ];
+
+  checkInputs = [
+    aioresponses
+    pytest-asyncio
+    pytest-raises
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py --replace '"pytest-runner>=5.2",' ""
+  '';
+
+  pythonImportsCheck = [ "aioemonitor" ];
+
+  meta = with lib; {
+    description = "Python client for SiteSage Emonitor";
+    homepage = "https://github.com/bdraco/aioemonitor";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/aiohttp-wsgi/default.nix

@@ -0,0 +1,37 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "aiohttp-wsgi";
+  version = "0.8.2";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "etianen";
+    repo = pname;
+    rev = version;
+    sha256 = "0wirn3xqxxgkpy5spicd7p1bkdnsrch61x2kcpdwpixmx961pq7x";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "aiohttp_wsgi" ];
+
+  meta = with lib; {
+    description = "WSGI adapter for aiohttp";
+    homepage = "https://github.com/etianen/aiohttp-wsgi";
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/aiolip/default.nix

@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "aiolip";
+  version = "1.1.4";
+  disabled = pythonOlder "3.5";
+
+  src = fetchFromGitHub {
+    owner = "bdraco";
+    repo = pname;
+    rev = version;
+    sha256 = "1f8mlvbnfcn3sigsmjdpdpgxmnbvcjhfr7lzch61i8sy25dgakji";
+  };
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py --replace "'pytest-runner'," ""
+  '';
+
+  pythonImportsCheck = [ "aiolip" ];
+
+  meta = with lib; {
+    description = "Python module for the Lutron Integration Protocol";
+    homepage = "https://github.com/bdraco/aiolip";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/aiosyncthing/default.nix

@@ -0,0 +1,45 @@
+{ lib
+, aiohttp
+, aioresponses
+, buildPythonPackage
+, fetchFromGitHub
+, expects
+, pytest-asyncio
+, pytest-mock
+, pytestCheckHook
+, yarl
+}:
+
+buildPythonPackage rec {
+  pname = "aiosyncthing";
+  version = "0.5.1";
+
+  src = fetchFromGitHub {
+    owner = "zhulik";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0704qbg3jy80vaw3bcvhy988s1qs3fahpfwkja71fy70bh0vc860";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    yarl
+  ];
+
+  checkInputs = [
+    aioresponses
+    expects
+    pytestCheckHook
+    pytest-asyncio
+    pytest-mock
+  ];
+
+  pythonImportsCheck = [ "aiosyncthing" ];
+
+  meta = with lib; {
+    description = "Python client for the Syncthing REST API";
+    homepage = "https://github.com/zhulik/aiosyncthing";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/arrow/1.nix

@@ -0,0 +1,41 @@
+{ lib, buildPythonPackage, fetchPypi, pythonOlder
+, simplejson, typing-extensions, python-dateutil, pytz, pytest-mock, sphinx
+, dateparser, pytestcov, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "arrow";
+  version = "1.0.3";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0793badh4hgbk2c5g70hmbl7n3d4g5d87bcflld0w9rjwy59r71r";
+  };
+
+  propagatedBuildInputs = [ python-dateutil ]
+    ++ lib.optionals (!pythonOlder "3.8") [ typing-extensions ];
+
+  checkInputs = [
+    dateparser
+    pytestCheckHook
+    pytestcov
+    pytest-mock
+    pytz
+    simplejson
+    sphinx
+  ];
+
+  # ParserError: Could not parse timezone expression "America/Nuuk"
+  disabledTests = [
+    "test_parse_tz_name_zzz"
+  ];
+
+  meta = with lib; {
+    description = "Python library for date manipulation";
+    homepage = "https://github.com/crsmithdev/arrow";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ thoughtpolice oxzi ];
+  };
+}

pkgs/development/python-modules/datadog/default.nix

@@ -17,11 +17,11 @@
 
 buildPythonPackage rec {
   pname = "datadog";
-  version = "0.39.0";
+  version = "0.40.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "b0ef69a27aad0e4412c1ac3e6894fa1b5741db735515c34dfe1606d8cf30e4e5";
+    sha256 = "4bbd66a02bbcf9cd03ba05194d605a64c9efb7aed90d5e69c6ec42655c3c01a4";
   };
 
   postPatch = ''

pkgs/development/python-modules/devolo-home-control-api/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "devolo-home-control-api";
-  version = "0.17.1";
+  version = "0.17.3";
   disabled = pythonOlder "3.6";
 
   src = fetchFromGitHub {
     owner = "2Fake";
     repo = "devolo_home_control_api";
     rev = "v${version}";
-    sha256 = "sha256-5PaIZPwikDmT4kmh0Qfg65gBAUYralmO6a22GtzoB7A=";
+    sha256 = "1h7admqb1l28sxwhhkkhw0sfzgpn8zpczvmi3h28f68csflkv379";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/discordpy/default.nix

@@ -1,35 +1,40 @@
 { lib
-, fetchFromGitHub
-, buildPythonPackage
-, pythonOlder
-, withVoice ? true, libopus
 , aiohttp
+, buildPythonPackage
+, fetchFromGitHub
+, libopus
+, pynacl
+, pythonOlder
 , websockets
+, withVoice ? true
 }:
 
 buildPythonPackage rec {
   pname = "discord.py";
-  version = "1.7.0";
+  version = "1.7.1";
-  disabled = pythonOlder "3.5.3";
+  disabled = pythonOlder "3.8";
 
-  # only distributes wheels on pypi now
   src = fetchFromGitHub {
     owner = "Rapptz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1i5k2qb894rjksn21pk9shash1y7v4138rkk8mqr1a1yvgnr5ibg";
+    sha256 = "sha256-dpASIqe6rJEyiWJyPbQhq9M54lX1ilfp4UuGnbJcFLo=";
   };
 
-  propagatedBuildInputs = [ aiohttp websockets ];
+  propagatedBuildInputs = [
+    aiohttp
+    websockets
+  ] ++ lib.optionalString withVoice [
+    libopus
+    pynacl
+  ];
+
   patchPhase = ''
-    substituteInPlace "requirements.txt" \
-      --replace "websockets>=6.0,!=7.0,!=8.0,!=8.0.1,<9.0" "websockets"
-  '' + lib.optionalString withVoice ''
     substituteInPlace "discord/opus.py" \
       --replace "ctypes.util.find_library('opus')" "'${libopus}/lib/libopus.so.0'"
   '';
 
-  # only have integration tests with discord
+  # Only have integration tests with discord
   doCheck = false;
 
   pythonImportsCheck = [
@@ -44,7 +49,7 @@ buildPythonPackage rec {
   ];
 
   meta = with lib; {
-    description = "A python wrapper for the Discord API";
+    description = "Python wrapper for the Discord API";
     homepage = "https://discordpy.rtfd.org/";
     maintainers = [ maintainers.ivar ];
     license = licenses.mit;

pkgs/development/python-modules/expects/default.nix

@@ -0,0 +1,28 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+}:
+
+buildPythonPackage rec {
+  pname = "expects";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "jaimegildesagredo";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0mk1mhh8n9ly820krkhazn1w96f10vmgh21y2wr44sn8vwr4ngyy";
+  };
+
+  # mamba is used as test runner. Not available and should not be used as
+  # it's just another unmaintained test runner.
+  doCheck = false;
+  pythonImportsCheck = [ "expects" ];
+
+  meta = with lib; {
+    description = "Expressive and extensible TDD/BDD assertion library for Python";
+    homepage = "https://expects.readthedocs.io/";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/hass-nabucasa/default.nix

@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "hass-nabucasa";
-  version = "0.42.0";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "nabucasa";
     repo = pname;
     rev = version;
-    sha256 = "sha256-vDgjuNgwNp9cDgiCNxhACOcuaxcrR+0DW/U5OaSW0n4=";
+    sha256 = "sha256-mfVSiquZrCtAza4q9Ocle22e4ZMoTgxguevuOlZEUm8=";
   };
 
   postPatch = ''

pkgs/development/python-modules/homematicip/default.nix

@@ -0,0 +1,77 @@
+{ lib
+, aenum
+, aiohttp
+, aiohttp-wsgi
+, async-timeout
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, pytest-aiohttp
+, pytest-asyncio
+, requests
+, websocket_client
+, websockets
+}:
+
+buildPythonPackage rec {
+  pname = "homematicip";
+  version = "1.0.0";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "coreGreenberet";
+    repo = "homematicip-rest-api";
+    rev = version;
+    sha256 = "0bgvrjcf10kiqqkbl56sxx3jydd722b08q2j9c8sxpk0qdrmrinv";
+  };
+
+  propagatedBuildInputs = [
+    aenum
+    aiohttp
+    async-timeout
+    requests
+    websocket_client
+    websockets
+  ];
+
+  checkInputs = [
+    aiohttp-wsgi
+    pytest-aiohttp
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Assert issues with datetime
+    "test_contact_interface_device"
+    "test_dimmer"
+    "test_heating_failure_alert_group"
+    "test_heating"
+    "test_humidity_warning_rule_group"
+    "test_meta_group"
+    "test_pluggable_switch_measuring"
+    "test_rotary_handle_sensor"
+    "test_security_group"
+    "test_shutter_device"
+    "test_smoke_detector"
+    "test_switching_group"
+    "test_temperature_humidity_sensor_outdoor"
+    "test_wall_mounted_thermostat_pro"
+    "test_weather_sensor"
+    # Random failures
+    "test_home_getSecurityJournal"
+    "test_home_unknown_types"
+    # Requires network access
+    "test_websocket"
+  ];
+
+  pythonImportsCheck = [ "homematicip" ];
+
+  meta = with lib; {
+    description = "Python module for the homematicIP REST API";
+    homepage = "https://github.com/coreGreenberet/homematicip-rest-api";
+    license = with licenses; [ gpl3Only ];
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/ifcopenshell/default.nix

@@ -1,11 +1,10 @@
 { lib, stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, substituteAll
 , python
 , gcc10
 , cmake
-, boost172
+, boost17x
 , icu
 , swig
 , pcre
@@ -16,29 +15,21 @@
 
 buildPythonPackage rec {
   pname = "ifcopenshell";
-  version = "0.6.0b0";
+  version = "210410";
   format = "other";
 
   src = fetchFromGitHub {
     owner  = "IfcOpenShell";
     repo   = "IfcOpenShell";
-    rev    = "v${version}";
+    rev    = "blenderbim-${version}";
     fetchSubmodules = true;
-    sha256 = "1ad1s9az41z2f46rbi1jnr46mgc0q4h5kz1jm9xdlwifqv9y04g1";
+    sha256 = "1g52asxrqcfj01iqvf03k3bb6rg3v04hh1wc3nmn329a2lwjbxpw";
   };
 
-  patches = [
-    (substituteAll {
-      name = "site-packages.patch";
-      src = ./site-packages.patch;
-      site_packages = "lib/${python.libPrefix}/site-packages";
-    })
-  ];
-
   nativeBuildInputs = [ gcc10 cmake ];
 
   buildInputs = [
-    boost172
+    boost17x
     icu
     pcre
     libxml2
@@ -48,7 +39,9 @@ buildPythonPackage rec {
     cd cmake
   '';
 
+  PYTHONUSERBASE=".";
   cmakeFlags = [
+    "-DUSERSPACE_PYTHON_PREFIX=ON"
     "-DOCC_INCLUDE_DIR=${opencascade-occt}/include/opencascade"
     "-DOCC_LIBRARY_DIR=${opencascade-occt}/lib"
     "-DOPENCOLLADA_INCLUDE_DIR=${opencollada}/include/opencollada"

pkgs/development/python-modules/ifcopenshell/site-packages.patch

@@ -1,32 +0,0 @@
---- a/src/ifcwrap/CMakeLists.txt
-+++ b/src/ifcwrap/CMakeLists.txt
-@@ -68,26 +68,17 @@ endif()
- # directory in which the wrapper can be installed.
- FIND_PACKAGE(PythonInterp)
- IF(PYTHONINTERP_FOUND AND NOT "${PYTHON_EXECUTABLE}" STREQUAL "")
--    EXECUTE_PROCESS(
--        COMMAND ${PYTHON_EXECUTABLE} -c "import sys; from distutils.sysconfig import get_python_lib; sys.stdout.write(get_python_lib(1))"
--        OUTPUT_VARIABLE python_package_dir
--    )
--
--    IF("${python_package_dir}" STREQUAL "")
--        MESSAGE(WARNING "Unable to locate Python site-package directory, unable to install the Python wrapper")
--    ELSE()
-         FILE(GLOB_RECURSE sourcefiles "${CMAKE_CURRENT_SOURCE_DIR}/../ifcopenshell-python/ifcopenshell/*.py")
-         FOREACH(file ${sourcefiles})
-             FILE(RELATIVE_PATH relative "${CMAKE_CURRENT_SOURCE_DIR}/../ifcopenshell-python/ifcopenshell/" "${file}")
-             GET_FILENAME_COMPONENT(dir "${relative}" DIRECTORY)
- 			INSTALL(FILES "${file}"
--                    DESTINATION "${python_package_dir}/ifcopenshell/${dir}")
-+                    DESTINATION "@site_packages@/ifcopenshell/${dir}")
-         ENDFOREACH()
-         INSTALL(FILES "${CMAKE_BINARY_DIR}/ifcwrap/ifcopenshell_wrapper.py"
--                DESTINATION "${python_package_dir}/ifcopenshell")
-+                DESTINATION "@site_packages@/ifcopenshell")
-         INSTALL(TARGETS _ifcopenshell_wrapper
--                DESTINATION "${python_package_dir}/ifcopenshell")
--    ENDIF()
-+                DESTINATION "@site_packages@/ifcopenshell")
- ELSE()
-     MESSAGE(WARNING "No Python interpreter found, unable to install the Python wrapper")
- ENDIF()

pkgs/development/python-modules/jsonrpc-async/default.nix

@@ -1,20 +1,37 @@
-{ lib, buildPythonPackage, fetchPypi
+{ lib
-, aiohttp, jsonrpc-base }:
+, buildPythonPackage
+, fetchFromGitHub
+, aiohttp
+, jsonrpc-base
+, pytest-aiohttp
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "jsonrpc-async";
-  version = "1.1.1";
+  version = "2.0.0";
 
-  src = fetchPypi {
+  src = fetchFromGitHub {
-    inherit pname version;
+    owner = "emlove";
-    sha256 = "383f331e28cd8f6e3fa86f3e7052efa541b7ae8bf328a4e692aa045cfc0ecf25";
+    repo = pname;
+    rev = version;
+    sha256 = "1ff3523rwgira5llmf5iriwqag7b6ln9vmj0s70yyc6k98yg06rp";
   };
 
   propagatedBuildInputs = [ aiohttp jsonrpc-base ];
 
+  checkInputs = [
+    pytest-aiohttp
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "tests.py"
+  ];
+
   meta = with lib; {
     description = "A JSON-RPC client library for asyncio";
-    homepage = "https://github.com/armills/jsonrpc-async";
+    homepage = "https://github.com/emlove/jsonrpc-async";
     license = licenses.bsd3;
     maintainers = with maintainers; [ peterhoeg ];
   };

pkgs/development/python-modules/jsonrpc-base/default.nix

@@ -1,19 +1,31 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+}:
 
 buildPythonPackage rec {
   pname = "jsonrpc-base";
-  version = "1.1.0";
+  version = "2.0.0";
 
-  src = fetchPypi {
+  src = fetchFromGitHub {
-    inherit pname version;
+    owner = "emlove";
-    sha256 = "7f374c57bfa1cb16d1f340d270bc0d9f1f5608fb1ac6c9ea15768c0e6ece48b7";
+    repo = pname;
+    rev = version;
+    sha256 = "0xxhn0vb7mr8k1w9xbqhhyx9qkgkc318qkyflgfbvjc926n50680";
   };
 
-  propagatedBuildInputs = [ ];
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    "tests.py"
+  ];
 
   meta = with lib; {
     description = "A JSON-RPC client library base interface";
-    homepage = "https://github.com/armills/jsonrpc-base";
+    homepage = "https://github.com/emlove/jsonrpc-base";
     license = licenses.bsd3;
     maintainers = with maintainers; [ peterhoeg ];
   };

pkgs/development/python-modules/jsonrpc-websocket/default.nix

@@ -1,28 +1,36 @@
-{ lib, buildPythonPackage, fetchPypi
+{ lib
-, aiohttp, jsonrpc-base, pep8
+, buildPythonPackage
-, pytestCheckHook
+, fetchPypi
+, aiohttp
+, jsonrpc-base
 , pytest-asyncio
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "jsonrpc-websocket";
-  version = "1.2.1";
+  version = "3.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c343d057b572791ed3107b771c17358bc710772a9a6156047a3cfafb409ed895";
+    sha256 = "0fmw8xjzlhi7r84swn4w3njy389qqll5ad5ljdq5n2wpg424k98h";
   };
 
-  nativeBuildInputs = [ pep8 ];
+  propagatedBuildInputs = [
+    aiohttp
+    jsonrpc-base
+  ];
 
-  propagatedBuildInputs = [ aiohttp jsonrpc-base ];
+  checkInputs = [
+    pytestCheckHook
+    pytest-asyncio
+  ];
 
-  checkInputs = [ pytestCheckHook pytest-asyncio ];
   pytestFlagsArray = [ "tests.py" ];
 
   meta = with lib; {
     description = "A JSON-RPC websocket client library for asyncio";
-    homepage = "https://github.com/armills/jsonrpc-websocket";
+    homepage = "https://github.com/emlove/jsonrpc-websocket";
     license = licenses.bsd3;
     maintainers = with maintainers; [ peterhoeg ];
   };

pkgs/development/python-modules/karton-classifier/default.nix

@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, chardet
+, fetchFromGitHub
+, karton-core
+, python
+, python_magic
+}:
+
+buildPythonPackage rec {
+  pname = "karton-classifier";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "CERT-Polska";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "05pxv0smrzgmljykc6yx0rx8b85ck7fa09xjkjw0dd7lb6bb19a6";
+  };
+
+  propagatedBuildInputs = [
+    chardet
+    karton-core
+    python_magic
+  ];
+
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace "chardet==3.0.4" "chardet" \
+      --replace "karton-core==4.0.4" "karton-core" \
+      --replace "python-magic==0.4.18" "python-magic"
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} -m unittest discover
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [ "karton.classifier" ];
+
+  meta = with lib; {
+    description = "File type classifier for the Karton framework";
+    homepage = "https://github.com/CERT-Polska/karton-classifier";
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/karton-core/default.nix

@@ -0,0 +1,34 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, minio
+, python
+, redis
+}:
+
+buildPythonPackage rec {
+  pname = "karton-core";
+  version = "4.2.0";
+
+  src = fetchFromGitHub {
+    owner = "CERT-Polska";
+    repo = "karton";
+    rev = "v${version}";
+    sha256 = "08j1bm9g58576sswcrpfczaki24nlqqaypp7qv1rxxwsyp5pq6h6";
+  };
+
+  propagatedBuildInputs = [ minio redis ];
+
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} -m unittest discover
+    runHook postCheck
+  '';
+
+  meta = with lib; {
+    description = "Distributed malware processing framework";
+    homepage = "https://karton-core.readthedocs.io/";
+    maintainers = with maintainers; [ chivay ];
+    license = licenses.bsd3;
+  };
+}

pkgs/development/python-modules/manhole/default.nix

@@ -8,11 +8,11 @@
 
 buildPythonPackage rec {
   pname = "manhole";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "d4ab98198481ed54a5b95c0439f41131f56d7d3755eedaedce5a45ca7ff4aa42";
+    sha256 = "224985bf1dd032f2dc0ca4107f727835b6f50e1df6d78781d6c9f4cae8b585e2";
   };
 
   # test_help expects architecture-dependent Linux signal numbers.

pkgs/development/python-modules/nad-receiver/default.nix

@@ -0,0 +1,35 @@
+{ lib
+, pyserial
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "nad-receiver";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "joopert";
+    repo = "nad_receiver";
+    rev = version;
+    sha256 = "1mylrrvxczhplscayf4hvj56vaqkh7mv32fn9pcvla83y39kg8rw";
+  };
+
+  propagatedBuildInputs = [
+    pyserial
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "nad_receiver" ];
+
+  meta = with lib; {
+    description = "Python interface for NAD receivers";
+    homepage = "https://github.com/joopert/nad_receiver";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/nexia/default.nix

@@ -0,0 +1,43 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, requests
+, requests-mock
+}:
+
+buildPythonPackage rec {
+  pname = "nexia";
+  version = "0.9.6";
+  disabled = pythonOlder "3.5";
+
+  src = fetchFromGitHub {
+    owner = "bdraco";
+    repo = pname;
+    rev = version;
+    sha256 = "1k8h1p2zqm8gghff03jh8q3zik7jw2l686cyyg36r3qrgz6zi19q";
+  };
+
+  propagatedBuildInputs = [
+    requests
+  ];
+
+  checkInputs = [
+    requests-mock
+    pytestCheckHook
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py --replace '"pytest-runner",' ""
+  '';
+
+  pythonImportsCheck = [ "nexia" ];
+
+  meta = with lib; {
+    description = "Python module for Nexia thermostats";
+    homepage = "https://github.com/bdraco/nexia";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/omnilogic/default.nix

@@ -0,0 +1,39 @@
+{ lib
+, aiohttp
+, xmltodict
+, buildPythonPackage
+, fetchFromGitHub
+}:
+
+buildPythonPackage rec {
+  pname = "omnilogic";
+  version = "0.4.3";
+
+  src = fetchFromGitHub {
+    owner = "djtimca";
+    repo = "omnilogic-api";
+    rev = "v${version}";
+    sha256 = "19pmbykq0mckk23aj33xbhg3gjx557xy9a481mp6pkmihf2lsc8z";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    xmltodict
+  ];
+
+  postPatch = ''
+    # Is not used but still present in setup.py
+    substituteInPlace setup.py --replace "'config'," ""
+  '';
+
+  # Project has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "omnilogic" ];
+
+  meta = with lib; {
+    description = "Python interface for the Hayward Omnilogic pool control system";
+    homepage = "https://github.com/djtimca/omnilogic-api";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/poetry/default.nix

@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "poetry";
-  version = "1.1.4";
+  version = "1.1.5";
   format = "pyproject";
   disabled = isPy27;
 
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "python-poetry";
     repo = pname;
     rev = version;
-    sha256 = "0lx3qpz5dad0is7ki5a4vxphvc8cm8fnv4bmrx226a6nvvaj6ahs";
+    sha256 = "0bv6irpscpak6pldkzrx4j12dqnpfz5h8fy5lliglizv0avh60hf";
   };
 
   postPatch = ''

pkgs/development/python-modules/pyclimacell/default.nix

@@ -0,0 +1,39 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, pytz
+}:
+
+buildPythonPackage rec {
+  pname = "pyclimacell";
+  version = "0.18.0";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "raman325";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0pxlh3lwd1az6v7vbaz9kv6ngqxf34iddp7vr0d0p8apbvinwrha";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    pytz
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "pyclimacell" ];
+
+  meta = with lib; {
+    description = "Python client for ClimaCell API";
+    homepage = "https://github.com/raman325/pyclimacell";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}