Merge master into staging-next

maintainers/maintainer-list.nix

@@ -15536,6 +15536,12 @@
     githubId = 3958212;
     name = "Tom Sorlie";
   };
+  schinmai-akamai = {
+    email = "schinmai@akamai.com";
+    github = "schinmai-akamai";
+    githubId = 70169773;
+    name = "Tarun Chinmai Sekar";
+  };
   schmitthenner = {
     email = "development@schmitthenner.eu";
     github = "fkz";

nixos/modules/security/wrappers/wrapper.c

@@ -26,8 +26,6 @@
 
 // aborts when false, printing the failed expression
 #define ASSERT(expr) ((expr) ? (void) 0 : assert_failure(#expr))
-// aborts when returns non-zero, printing the failed expression and errno
-#define MUSTSUCCEED(expr) ((expr) ? print_errno_and_die(#expr) : (void) 0)
 
 extern char **environ;
 
@@ -48,12 +46,6 @@ static noreturn void assert_failure(const char *assertion) {
     abort();
 }
 
-static noreturn void print_errno_and_die(const char *assertion) {
-    fprintf(stderr, "Call `%s` in NixOS's wrapper.c failed: %s\n", assertion, strerror(errno));
-    fflush(stderr);
-    abort();
-}
-
 int get_last_cap(unsigned *last_cap) {
     FILE* file = fopen("/proc/sys/kernel/cap_last_cap", "r");
     if (file == NULL) {

nixos/modules/services/misc/paperless.nix

@@ -36,18 +36,7 @@ let
 
   # Secure the services
   defaultServiceConfig = {
-    TemporaryFileSystem = "/:ro";
-    BindReadOnlyPaths = [
-      "/nix/store"
-      "-/etc/resolv.conf"
-      "-/etc/nsswitch.conf"
-      "-/etc/hosts"
-      "-/etc/localtime"
-      "-/etc/ssl/certs"
-      "-/etc/static/ssl/certs"
-      "-/run/postgresql"
-    ] ++ (optional enableRedis redisServer.unixSocket);
-    BindPaths = [
+    ReadWritePaths = [
       cfg.consumptionDir
       cfg.dataDir
       cfg.mediaDir
@@ -66,11 +55,9 @@ let
     PrivateUsers = true;
     ProtectClock = true;
     # Breaks if the home dir of the user is in /home
-    # Also does not add much value in combination with the TemporaryFileSystem.
     # ProtectHome = true;
     ProtectHostname = true;
-    # Would re-mount paths ignored by temporary root
-    #ProtectSystem = "strict";
+    ProtectSystem = "strict";
     ProtectControlGroups = true;
     ProtectKernelLogs = true;
     ProtectKernelModules = true;
@@ -319,17 +306,6 @@ in
         Type = "oneshot";
         # Enable internet access
         PrivateNetwork = false;
-        # Restrict write access
-        BindPaths = [];
-        BindReadOnlyPaths = [
-          "/nix/store"
-          "-/etc/resolv.conf"
-          "-/etc/nsswitch.conf"
-          "-/etc/ssl/certs"
-          "-/etc/static/ssl/certs"
-          "-/etc/hosts"
-          "-/etc/localtime"
-        ];
         ExecStart = let pythonWithNltk = pkg.python.withPackages (ps: [ ps.nltk ]); in ''
           ${pythonWithNltk}/bin/python -m nltk.downloader -d '${nltkDir}' punkt snowball_data stopwords
         '';

nixos/tests/paperless.nix

@@ -2,65 +2,88 @@ import ./make-test-python.nix ({ lib, ... }: {
   name = "paperless";
   meta.maintainers = with lib.maintainers; [ erikarvstedt Flakebi ];
 
-  nodes.machine = { pkgs, ... }: {
-    environment.systemPackages = with pkgs; [ imagemagick jq ];
-    services.paperless = {
-      enable = true;
-      passwordFile = builtins.toFile "password" "admin";
+  nodes = let self = {
+    simple = { pkgs, ... }: {
+      environment.systemPackages = with pkgs; [ imagemagick jq ];
+      services.paperless = {
+        enable = true;
+        passwordFile = builtins.toFile "password" "admin";
+      };
     };
-  };
+    postgres = { config, pkgs, ... }: {
+      imports = [ self.simple ];
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "paperless" ];
+        ensureUsers = [
+          { name = config.services.paperless.user;
+            ensurePermissions = { "DATABASE \"paperless\"" = "ALL PRIVILEGES"; };
+          }
+        ];
+      };
+      services.paperless.extraConfig = {
+        PAPERLESS_DBHOST = "/run/postgresql";
+      };
+    };
+  }; in self;
 
   testScript = ''
     import json
 
-    machine.wait_for_unit("paperless-consumer.service")
+    def test_paperless(node):
+      node.wait_for_unit("paperless-consumer.service")
 
-    with subtest("Add a document via the file system"):
-        machine.succeed(
-            "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black "
-            "-annotate +5+20 'hello world 16-10-2005' /var/lib/paperless/consume/doc.png"
+      with subtest("Add a document via the file system"):
+        node.succeed(
+          "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black "
+          "-annotate +5+20 'hello world 16-10-2005' /var/lib/paperless/consume/doc.png"
         )
 
-    with subtest("Web interface gets ready"):
-        machine.wait_for_unit("paperless-web.service")
+      with subtest("Web interface gets ready"):
+        node.wait_for_unit("paperless-web.service")
         # Wait until server accepts connections
-        machine.wait_until_succeeds("curl -fs localhost:28981")
+        node.wait_until_succeeds("curl -fs localhost:28981")
 
-    # Required for consuming documents via the web interface
-    with subtest("Task-queue gets ready"):
-        machine.wait_for_unit("paperless-task-queue.service")
+      # Required for consuming documents via the web interface
+      with subtest("Task-queue gets ready"):
+        node.wait_for_unit("paperless-task-queue.service")
 
-    with subtest("Add a png document via the web interface"):
-        machine.succeed(
-            "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black "
-            "-annotate +5+20 'hello web 16-10-2005' /tmp/webdoc.png"
+      with subtest("Add a png document via the web interface"):
+        node.succeed(
+          "convert -size 400x40 xc:white -font 'DejaVu-Sans' -pointsize 20 -fill black "
+          "-annotate +5+20 'hello web 16-10-2005' /tmp/webdoc.png"
         )
-        machine.wait_until_succeeds("curl -u admin:admin -F document=@/tmp/webdoc.png -fs localhost:28981/api/documents/post_document/")
+        node.wait_until_succeeds("curl -u admin:admin -F document=@/tmp/webdoc.png -fs localhost:28981/api/documents/post_document/")
 
-    with subtest("Add a txt document via the web interface"):
-        machine.succeed(
-            "echo 'hello web 16-10-2005' > /tmp/webdoc.txt"
+      with subtest("Add a txt document via the web interface"):
+        node.succeed(
+          "echo 'hello web 16-10-2005' > /tmp/webdoc.txt"
         )
-        machine.wait_until_succeeds("curl -u admin:admin -F document=@/tmp/webdoc.txt -fs localhost:28981/api/documents/post_document/")
+        node.wait_until_succeeds("curl -u admin:admin -F document=@/tmp/webdoc.txt -fs localhost:28981/api/documents/post_document/")
 
-    with subtest("Documents are consumed"):
-        machine.wait_until_succeeds(
-            "(($(curl -u admin:admin -fs localhost:28981/api/documents/ | jq .count) == 3))"
+      with subtest("Documents are consumed"):
+        node.wait_until_succeeds(
+          "(($(curl -u admin:admin -fs localhost:28981/api/documents/ | jq .count) == 3))"
         )
-        docs = json.loads(machine.succeed("curl -u admin:admin -fs localhost:28981/api/documents/"))['results']
+        docs = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/"))['results']
         assert "2005-10-16" in docs[0]['created']
         assert "2005-10-16" in docs[1]['created']
         assert "2005-10-16" in docs[2]['created']
 
-    # Detects gunicorn issues, see PR #190888
-    with subtest("Document metadata can be accessed"):
-        metadata = json.loads(machine.succeed("curl -u admin:admin -fs localhost:28981/api/documents/1/metadata/"))
+      # Detects gunicorn issues, see PR #190888
+      with subtest("Document metadata can be accessed"):
+        metadata = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/1/metadata/"))
         assert "original_checksum" in metadata
 
-        metadata = json.loads(machine.succeed("curl -u admin:admin -fs localhost:28981/api/documents/2/metadata/"))
+        metadata = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/2/metadata/"))
         assert "original_checksum" in metadata
 
-        metadata = json.loads(machine.succeed("curl -u admin:admin -fs localhost:28981/api/documents/3/metadata/"))
+        metadata = json.loads(node.succeed("curl -u admin:admin -fs localhost:28981/api/documents/3/metadata/"))
         assert "original_checksum" in metadata
+
+    test_paperless(simple)
+    simple.send_monitor_command("quit")
+    simple.wait_for_shutdown()
+    test_paperless(postgres)
   '';
 })

pkgs/applications/misc/gpsprune/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gpsprune";
-  version = "23.1";
+  version = "23.2";
 
   src = fetchurl {
     url = "https://activityworkshop.net/software/gpsprune/gpsprune_${version}.jar";
-    sha256 = "sha256-0Lf/GuqlovVbnk3jSJHFGF688GXABcSVLr1hATaIomk=";
+    sha256 = "sha256-r2iw1vINWgqxoW0Zc8Sloa+wN/GUbUQfJ0e2BSP9vxM=";
   };
 
   dontUnpack = true;

pkgs/applications/science/chemistry/nwchem/default.nix

@@ -54,13 +54,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "nwchem";
-  version = "7.2.0";
+  version = "7.2.1";
 
   src = fetchFromGitHub {
     owner = "nwchemgit";
     repo = "nwchem";
     rev = "v${version}-release";
-    hash = "sha256-/biwHOSMGpdnYRGrGlDounKKLVaG2XkBgCmpE0IKR/Y=";
+    hash = "sha256-nnNTZ+c7VVGAqwOBMkBlW3rImNjs08Ne35XRkI3ssGo=";
   };
 
   nativeBuildInputs = [
@@ -106,6 +106,9 @@ stdenv.mkDerivation rec {
     # Overwrite script, skipping the download
     echo -e '#!/bin/sh\n cd ga-${versionGA};autoreconf -ivf' > src/tools/get-tools-github
 
+    # /usr/bin/env bash fails in sandbox/Makefile setting
+    substituteInPlace src/config/makefile.h --replace '/usr/bin/env bash' "${stdenv.shell}"
+
     patchShebangs ./
   '';
 

pkgs/by-name/co/cowsql/package.nix

@@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, libuv
+, raft-cowsql
+, sqlite
+, incus
+, unstableGitUpdater
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cowsql";
+  version = "unstable-2023-09-21";
+
+  src = fetchFromGitHub {
+    owner = "cowsql";
+    repo = "cowsql";
+    rev = "b728f0a43b9ad416f9c5fa1fda8b205c7a469d80";
+    hash = "sha256-B4ORrsUTfk/7glSpDndw1fCfFmd72iFr+2Xm5CryeZQ=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    libuv
+    raft-cowsql.dev
+    sqlite
+  ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  outputs = [ "dev" "out" ];
+
+  passthru = {
+    tests = {
+      inherit incus;
+    };
+
+    updateScript = unstableGitUpdater { };
+  };
+
+  meta = with lib; {
+    description = "Embeddable, replicated and fault tolerant SQL engine";
+    homepage = "https://github.com/cowsql/cowsql";
+    license = licenses.lgpl3Only;
+    maintainers = with maintainers; [ adamcstephens ];
+    platforms = platforms.unix;
+  };
+}

pkgs/by-name/in/incus-unwrapped/package.nix

@@ -0,0 +1,97 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, acl
+, cowsql
+, hwdata
+, libcap
+, lxc
+, pkg-config
+, sqlite
+, udev
+, installShellFiles
+, gitUpdater
+}:
+
+buildGoModule rec {
+  pname = "incus-unwrapped";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    owner = "lxc";
+    repo = "incus";
+    rev = "refs/tags/incus-${version}";
+    hash = "sha256-DCNMhfSzIpu5Pdg2TiFQ7GgLEScqt/Xqm2X+VSdeaME=";
+  };
+
+  vendorHash = "sha256-Pk0/SfGCqXdXvNHbokSV8ajFHeOv0+Et0JytRCoBLU4=";
+
+  postPatch = ''
+    substituteInPlace internal/usbid/load.go \
+      --replace "/usr/share/misc/usb.ids" "${hwdata}/share/hwdata/usb.ids"
+  '';
+
+  excludedPackages = [
+    "cmd/incus-agent"
+    "cmd/incus-migrate"
+    "cmd/lxd-to-incus"
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+    pkg-config
+  ];
+
+  buildInputs = [
+    lxc
+    acl
+    libcap
+    cowsql.dev
+    sqlite
+    udev.dev
+  ];
+
+  ldflags = [ "-s" "-w" ];
+  tags = [ "libsqlite3" ];
+
+  preBuild = ''
+    # required for go-cowsql.
+    export CGO_LDFLAGS_ALLOW="(-Wl,-wrap,pthread_create)|(-Wl,-z,now)"
+  '';
+
+  postBuild = ''
+    make incus-agent incus-migrate
+  '';
+
+  preCheck =
+    let skippedTests = [
+      "TestValidateConfig"
+      "TestConvertNetworkConfig"
+      "TestConvertStorageConfig"
+      "TestSnapshotCommon"
+      "TestContainerTestSuite"
+    ]; in
+    ''
+      # Disable tests requiring local operations
+      buildFlagsArray+=("-run" "[^(${builtins.concatStringsSep "|" skippedTests})]")
+    '';
+
+  postInstall = ''
+    installShellCompletion --bash --name incus ./scripts/bash/incus
+  '';
+
+  passthru = {
+    updateScript = gitUpdater {
+      rev-prefix = "incus-";
+    };
+  };
+
+  meta = {
+    description = "Powerful system container and virtual machine manager";
+    homepage = "https://linuxcontainers.org/incus";
+    changelog = "https://github.com/lxc/incus/releases/tag/incus-${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ adamcstephens ];
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/by-name/in/incus/package.nix

@@ -0,0 +1,115 @@
+{ lib
+, incus-unwrapped
+, linkFarm
+, makeWrapper
+, stdenv
+, symlinkJoin
+, writeShellScriptBin
+, acl
+, apparmor-parser
+, apparmor-profiles
+, attr
+, bash
+, btrfs-progs
+, criu
+, dnsmasq
+, gnutar
+, gptfdisk
+, gzip
+, iproute2
+, iptables
+, OVMF
+, qemu_kvm
+, qemu-utils
+, rsync
+, spice-gtk
+, squashfsTools
+, virtiofsd
+, xz
+}:
+let
+  binPath = lib.makeBinPath [
+    acl
+    attr
+    bash
+    btrfs-progs
+    criu
+    dnsmasq
+    gnutar
+    gptfdisk
+    gzip
+    iproute2
+    iptables
+    qemu_kvm
+    qemu-utils
+    rsync
+    squashfsTools
+    virtiofsd
+    xz
+
+    (writeShellScriptBin "apparmor_parser" ''
+      exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
+    '')
+  ];
+
+  clientBinPath = [
+    spice-gtk
+  ];
+
+  ovmf-2mb = OVMF.override {
+    secureBoot = true;
+    csmSupport = false;
+    fdSize2MB = true;
+  };
+
+  ovmf-4mb = OVMF.override {
+    secureBoot = true;
+    csmSupport = false;
+    fdSize4MB = true;
+  };
+
+  ovmf-4mb-csm = OVMF.override {
+    secureBoot = true;
+    csmSupport = false;
+    fdSize2MB = false;
+    fdSize4MB = true;
+  };
+
+  ovmf-prefix = if stdenv.hostPlatform.isAarch64 then "AAVMF" else "OVMF";
+
+  # mimic ovmf from https://github.com/canonical/incus-pkg-snap/blob/3abebe1dfeb20f9b7729556960c7e9fe6ad5e17c/snapcraft.yaml#L378
+  # also found in /snap/incus/current/share/qemu/ on a snap install
+  ovmf = linkFarm "incus-ovmf" [
+    { name = "OVMF_CODE.2MB.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd"; }
+    { name = "OVMF_CODE.4MB.CSM.fd"; path = "${ovmf-4mb-csm.fd}/FV/${ovmf-prefix}_CODE.fd"; }
+    { name = "OVMF_CODE.4MB.fd"; path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_CODE.fd"; }
+    { name = "OVMF_CODE.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_CODE.fd"; }
+
+    { name = "OVMF_VARS.2MB.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
+    { name = "OVMF_VARS.2MB.ms.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
+    { name = "OVMF_VARS.4MB.CSM.fd"; path = "${ovmf-4mb-csm.fd}/FV/${ovmf-prefix}_VARS.fd"; }
+    { name = "OVMF_VARS.4MB.fd"; path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
+    { name = "OVMF_VARS.4MB.ms.fd"; path = "${ovmf-4mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
+    { name = "OVMF_VARS.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
+    { name = "OVMF_VARS.ms.fd"; path = "${ovmf-2mb.fd}/FV/${ovmf-prefix}_VARS.fd"; }
+  ];
+in
+symlinkJoin {
+  name = "incus-${incus-unwrapped.version}";
+
+  paths = [ incus-unwrapped ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postBuild = ''
+    wrapProgram $out/bin/incusd --prefix PATH : ${lib.escapeShellArg binPath}:${qemu_kvm}/libexec:$out/bin --set INCUS_OVMF_PATH ${ovmf}
+
+    wrapProgram $out/bin/incus --prefix PATH : ${lib.makeBinPath clientBinPath}
+  '';
+
+  passthru = {
+    inherit (incus-unwrapped) tests;
+  };
+
+  inherit (incus-unwrapped) meta pname version;
+}

pkgs/by-name/lx/lxd-to-incus/package.nix

@@ -0,0 +1,39 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, gitUpdater
+}:
+
+buildGoModule rec {
+  pname = "lxd-to-incus";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    owner = "lxc";
+    repo = "incus";
+    # use commit which fixes 0.1 versioning, use tags for > 0.1
+    rev = "253a06bd8506bf42628d32ccbca6409d051465ec";
+    hash = "sha256-LXCTrZEDnFTJpqVH+gnG9HaV1wcvTFsVv2tAWabWYmg=";
+  };
+
+  modRoot = "cmd/lxd-to-incus";
+
+  vendorHash = "sha256-Kk5sx8UYuip/qik5ez/pxi+DmzjkPIHNYUHVvBm9f9g=";
+
+  # required for go-cowsql.
+  CGO_LDFLAGS_ALLOW="(-Wl,-wrap,pthread_create)|(-Wl,-z,now)";
+
+  passthru = {
+    updateScript = gitUpdater {
+      rev-prefix = "incus-";
+    };
+  };
+
+  meta = {
+    description = "LXD to Incus migration tool";
+    homepage = "https://linuxcontainers.org/incus";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ adamcstephens ];
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/by-name/ra/raft-cowsql/disable-missing-dir-test.patch

@@ -0,0 +1,23 @@
+diff --git a/test/unit/test_uv_fs.c b/test/unit/test_uv_fs.c
+index 638c39c..c8758d2 100644
+--- a/test/unit/test_uv_fs.c
++++ b/test/unit/test_uv_fs.c
+@@ -40,18 +40,6 @@ TEST(UvFsCheckDir, exists, DirSetUp, DirTearDown, 0, NULL)
+     return MUNIT_OK;
+ }
+ 
+-/* If the directory doesn't exist, it an error is returned. */
+-TEST(UvFsCheckDir, doesNotExist, DirSetUp, DirTearDown, 0, NULL)
+-{
+-    const char *parent = data;
+-    char errmsg[RAFT_ERRMSG_BUF_SIZE];
+-    char dir[128];
+-    sprintf(errmsg, "%s/sub", parent);
+-    sprintf(errmsg, "directory '%s' does not exist", dir);
+-    CHECK_DIR_ERROR(dir, RAFT_NOTFOUND, errmsg);
+-    return MUNIT_OK;
+-}
+-
+ /* If the process can't access the directory, an error is returned. */
+ TEST(UvFsCheckDir, permissionDenied, NULL, NULL, 0, NULL)
+ {

pkgs/by-name/ra/raft-cowsql/disable-net-tests.patch

@@ -0,0 +1,16 @@
+diff --git a/Makefile.am b/Makefile.am
+index 2137932..93abdb6 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -198,11 +198,7 @@ test_integration_uv_SOURCES = \
+   test/integration/test_uv_bootstrap.c \
+   test/integration/test_uv_load.c \
+   test/integration/test_uv_recover.c \
+-  test/integration/test_uv_recv.c \
+-  test/integration/test_uv_send.c \
+   test/integration/test_uv_set_term.c \
+-  test/integration/test_uv_tcp_connect.c \
+-  test/integration/test_uv_tcp_listen.c \
+   test/integration/test_uv_snapshot_put.c \
+   test/integration/test_uv_truncate.c \
+   test/integration/test_uv_work.c

pkgs/by-name/ra/raft-cowsql/package.nix

@@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, libuv
+, lz4
+, pkg-config
+, incus
+, gitUpdater
+}:
+
+stdenv.mkDerivation rec {
+  pname = "raft-cowsql";
+  version = "0.17.3";
+
+  src = fetchFromGitHub {
+    owner = "cowsql";
+    repo = "raft";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Ad09giGVsAVtm/0GRU/OaZx7BGjL5TlU8BrzFaFlE9k=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  buildInputs = [ libuv lz4 ];
+
+  enableParallelBuilding = true;
+
+  patches = [
+    # network tests either hang indefinitely, or fail outright
+    ./disable-net-tests.patch
+
+    # missing dir check is flaky
+    ./disable-missing-dir-test.patch
+  ];
+
+  preConfigure = ''
+    substituteInPlace configure --replace /usr/bin/ " "
+  '';
+
+  doCheck = true;
+
+  outputs = [ "dev" "out" ];
+
+  passthru.tests = {
+    inherit incus;
+    updateScript = gitUpdater { };
+  };
+
+  meta = with lib; {
+    description = "Asynchronous C implementation of the Raft consensus protocol";
+    homepage = "https://github.com/cowsql/raft";
+    license = licenses.lgpl3Only;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ adamcstephens ];
+  };
+}

pkgs/by-name/ui/uiua/package.nix

@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "uiua";
-  version = "0.0.17";
+  version = "0.0.18";
 
   src = fetchFromGitHub {
     owner = "uiua-lang";
     repo = "uiua";
     rev = "refs/tags/${version}";
-    hash = "sha256-vZo3JKvvlL//4P+EqcsDXyamAMnCBARSF/H6OJTayF4=";
+    hash = "sha256-EXOBEvUAS0jCj9BAmy63dh0Dy30VOW0PBdsoa/2Jcx0=";
   };
 
-  cargoHash = "sha256-AkBcvFz7mrYUNTokcfoSXwWpw7SupI0+52GL4QXUu24=";
+  cargoHash = "sha256-8Cbks0oo8fgWj9Lxp0bwydYXkJD+fz3y+dZ7ne+RXdU=";
 
   nativeBuildInputs = lib.optionals stdenv.isDarwin [
     rustPlatform.bindgenHook

pkgs/development/compilers/gcc/common/pre-configure.nix

@@ -116,13 +116,12 @@ in lib.optionalString (hostPlatform.isSunOS && hostPlatform.is64bit) ''
 
 # Normally (for host != target case) --without-headers automatically
 # enables 'inhibit_libc=true' in gcc's gcc/configure.ac. But case of
-# gcc->clang "cross"-compilation manages to evade it: there
+# gcc->clang or dynamic->static "cross"-compilation manages to evade it: there
 # hostPlatform != targetPlatform, hostPlatform.config == targetPlatform.config.
 # We explicitly inhibit libc headers use in this case as well.
 + lib.optionalString (targetPlatform != hostPlatform &&
                       withoutTargetLibc &&
-                      targetPlatform.config == hostPlatform.config &&
-                      (stdenv.cc.isClang || stdenv.targetPlatform.useLLVM or false)) ''
+                      targetPlatform.config == hostPlatform.config) ''
   export inhibit_libc=true
 ''
 

pkgs/development/interpreters/micropython/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "micropython";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "micropython";
     repo = "micropython";
     rev = "v${version}";
-    sha256 = "sha256-XTkw0M2an13xlRlDusyHYqwNeHqhq4mryRC5/pk+5Ko=";
+    sha256 = "sha256-nUQSj2grq4fNyqOZyYZfYvLwoEXI4PZCYdVXvxLGmPk=";
     fetchSubmodules = true;
   };
 

pkgs/development/python-modules/faraday-plugins/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "faraday-plugins";
-  version = "1.13.2";
+  version = "1.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "infobyte";
     repo = "faraday_plugins";
     rev = "refs/tags/${version}";
-    hash = "sha256-ZoxIuUeDkhACWGi+njZuMhO8P6nlErcBkub5VCMNm8Q=";
+    hash = "sha256-qFA0AVebHd/Ny8x+rUkueLZhYB/PwL7o/qpUnZCRsEA=";
   };
 
   postPatch = ''

pkgs/development/python-modules/hahomematic/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2023.10.6";
+  version = "2023.10.7";
   format = "pyproject";
 
   disabled = pythonOlder "3.11";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "danielperna84";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-uNf98q4x1usoYWvbDKt2yuTObyUjGgy7aK+VRrpM8wI=";
+    hash = "sha256-m7jBL4qB8ZcGifd6F2/In8JrSMyFeEYKf52Y+y22yK0=";
   };
 
   postPatch = ''

pkgs/development/python-modules/icmplib/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "icmplib";
-  version = "3.0.3";
+  version = "3.0.4";
   disabled = pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "ValentinBELYN";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-EQyu7lV8F/U8cZklYYIMk9ut1FTcoBvGc8Ggx6JerDk=";
+    hash = "sha256-PnBcGiUvftz/KYg9Qd2GaIcF3OW4lYH301uI5/M5CBI=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/levenshtein/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "levenshtein";
-  version = "0.22.0";
+  version = "0.23.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.6";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "maxbachmann";
     repo = "Levenshtein";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rqbZ2+UfWhh5qEd1GL6W9edHPCSNnK3s/Y2aT3R5wCA=";
+    hash = "sha256-O39Xe26WKAGcv6DEvwuOL8NZJBem5SYZDX1TPAY7/uA=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pyduotecno/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "pyduotecno";
-  version = "2023.9.0";
+  version = "2023.10.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.9";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "Cereal2nd";
     repo = "pyDuotecno";
     rev = "refs/tags/${version}";
-    hash = "sha256-UPyx/e06N2cAct6/r1y5LXAzKwANQ/ZpADQsjxBv6/Q=";
+    hash = "sha256-GxCqWgw4OdhJUMsGzCZnl6KYH7HQpGyV7zXMxbShHlg=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/pyweatherflowudp/default.nix

@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pyweatherflowudp";
-  version = "1.4.4";
+  version = "1.4.5";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "briis";
     repo = "pyweatherflowudp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5WdkT4U/+uO9UUIxumrxCKZnK9MdQcvfaO9UfpmpxJE=";
+    hash = "sha256-aTwGFYTtd07BsWFaFc7ns+8oh2AxTUfRFSu81Zv5OoA=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/texttable/default.nix

@@ -1,20 +1,39 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
+, pytestCheckHook
 }:
 
 buildPythonPackage rec {
   pname = "texttable";
-  version = "1.6.7";
+  version = "1.7.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KQNI+2f3dGkxvN/VWsdYTs1OWwhGqxZDM/B5SxIXYPI=";
+    hash = "sha256-LSBo+1URWAfTrHekymj6SIA+hOuw7iNA+FgQejZSJjg=";
   };
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "texttable"
+  ];
+
+  pytestFlagsArray = [
+    "tests.py"
+  ];
+
   meta = with lib; {
-    description = "A module to generate a formatted text table, using ASCII characters";
+    description = "Module to generate a formatted text table, using ASCII characters";
     homepage = "https://github.com/foutaise/texttable";
-    license = licenses.lgpl2;
+    changelog = "https://github.com/foutaise/texttable/blob/v${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ];
   };
 }

pkgs/development/python-modules/xlsxwriter/default.nix

@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "xlsxwriter";
-  version = "3.0.3";
+  version = "3.1.7";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     owner = "jmcnamara";
     repo = "XlsxWriter";
     rev = "RELEASE_${version}";
-    hash = "sha256-9fIxNkOdM+Bz1F9AWq02H3LLQnefxGSAtp9kM2OtJ9M=";
+    hash = "sha256-ZOKS9sTZvlopfIYOEhOk/rq4qtcMrNQ4Bwb8lDtKfxs=";
   };
 
   nativeCheckInputs = [

pkgs/development/python-modules/yfinance/default.nix

@@ -9,6 +9,7 @@
 , multitasking
 , numpy
 , pandas
+, peewee
 , pythonOlder
 , requests
 , lxml
@@ -16,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "yfinance";
-  version = "0.2.28";
+  version = "0.2.31";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -25,7 +26,7 @@ buildPythonPackage rec {
     owner = "ranaroussi";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-kTbQnpha4OHu5Xguo6v90uFpcXY1e8JJsJUo4ZbaCfk=";
+    hash = "sha256-GXnMzIjRx5c3O7J0bPjcdDvEIqTGMe002wYx28FLI6U=";
   };
 
   propagatedBuildInputs = [
@@ -34,11 +35,12 @@ buildPythonPackage rec {
     cryptography
     frozendict
     html5lib
+    lxml
     multitasking
     numpy
     pandas
+    peewee
     requests
-    lxml
   ];
 
   # Tests require internet access

pkgs/development/tools/k6/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "k6";
-  version = "0.46.0";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4ucnq/FTvdDpzf1RWRY+U5A+BCaaQWMTEaZtmU0JD90=";
+    hash = "sha256-90r6dyesYfa/eC/joUDPDfGU8r8qbPzzhwf0EwnGee0=";
   };
 
   subPackages = [ "./" ];

pkgs/development/tools/okteto/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "okteto";
-  version = "2.20.0";
+  version = "2.21.0";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     rev = version;
-    hash = "sha256-AeZ/pp7zWi8liDu247WXetXK/CurV0GUZ/isVdDF3yQ=";
+    hash = "sha256-4arcK/g9j/lv1HWP7rvhAXJpYRMKgmSbGPZjy2UkhyE=";
   };
 
   vendorHash = "sha256-u1oMX2ZplmDGx7ePfA5vKHUuDmWYVCJrYh2HQ23dTfU=";

pkgs/os-specific/linux/kernel/kernels-org.json

@@ -4,35 +4,35 @@
         "hash": "sha256:19hnqly7ins0ycirjwrp3g0am43h2i62qfd1y81yhiy1dpyhbbc9"
     },
     "6.5": {
-        "version": "6.5.6",
-        "hash": "sha256:1xnjjm50ks18ifrp36md2p2xca4lw160y57j9p152w2l2i16vqvq"
+        "version": "6.5.7",
+        "hash": "sha256:135v3y2vgc83dca4xi7q52wqi4dkfal74k1y73jwzj85h12fl28d"
     },
     "6.4": {
         "version": "6.4.16",
         "hash": "sha256:0zgj1z97jyx7wf12zrnlcp0mj4cl43ais9qsy6dh1jwylf2fq9ln"
     },
     "6.1": {
-        "version": "6.1.56",
-        "hash": "sha256:1327in80nl0ghbjignjsdw0w5crj4d06d5fivj4q6af26bggvply"
+        "version": "6.1.57",
+        "hash": "sha256:1ccidrxswblxw9yaa45y6ds16pc7647f6fz36xxxhljivhyzxszr"
     },
     "5.15": {
-        "version": "5.15.134",
-        "hash": "sha256:1lxra3h8pq41hdr1acazwcqk6r8alv9p840ys19nivaprfp84wgk"
+        "version": "5.15.135",
+        "hash": "sha256:0w3i8jvzqvfnlarcvg89k1144ln96fszv16lzrn16zr3kri5x0ql"
     },
     "5.10": {
-        "version": "5.10.197",
-        "hash": "sha256:1awkm7lln5gf6kld9z5h4mg39bd778jsdswwlwb7iv7bn03lafhq"
+        "version": "5.10.198",
+        "hash": "sha256:01gsw96anw44nh8ii3zipp6vh61m1n8yf0bv2fzznr23k771y51b"
     },
     "5.4": {
-        "version": "5.4.257",
-        "hash": "sha256:1w1x91slzg9ggakqhyxnmvz77v2cwfk8bz0knrpgz9qya9q5jxrf"
+        "version": "5.4.258",
+        "hash": "sha256:0gk2xav1ng565l1qsqlr8ja6m4j5g8rfj66vad1fmdd1lwaihw1r"
     },
     "4.19": {
-        "version": "4.19.295",
-        "hash": "sha256:1b1qslpk1kka7nxam48s22xsqd9qmp716hmibgfsjxl5y3jc4cmp"
+        "version": "4.19.296",
+        "hash": "sha256:1bk051canr4fb00j6x9ff2wam2f20whw4h4z767x2cn2kmv6cqb3"
     },
     "4.14": {
-        "version": "4.14.326",
-        "hash": "sha256:0y0lvzidw775mgx211wnc1c6223iqv8amz5y9jkz9h7l3l7y8p2m"
+        "version": "4.14.327",
+        "hash": "sha256:0nharfyxlr17yan86zrhlbq7idm0g3zvvvmy2zbw7m9dhgc8bw5z"
     }
 }

pkgs/servers/monitoring/munin/default.nix

@@ -3,14 +3,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.0.73";
+  version = "2.0.74";
   pname = "munin";
 
   src = fetchFromGitHub {
     owner = "munin-monitoring";
     repo = "munin";
     rev = version;
-    sha256 = "sha256-KyPId549mTm/DrtityM4NHDlZt081UKwfRWS/eWQbXw=";
+    sha256 = "sha256-jiAlqhJyeeoCxUYrUoPW5fdiPCtbuGwXRlmgBHYkF14=";
   };
 
   nativeBuildInputs = [

pkgs/servers/prowlarr/default.nix

@@ -21,15 +21,15 @@ let
   }.${stdenv.hostPlatform.system} or unsupported;
 
   hash = {
-    aarch64-darwin = "sha256-3dKTYw37kmIq9DG4S5qOtjK1QzZeSSCWKeXsfrXctFs=";
-    aarch64-linux = "sha256-SWt1XTWlWcxF3pcSkiyIXBKllwmVkJvoxB3NrIAj9KQ=";
-    x86_64-darwin = "sha256-YC6cH5KHzNVdWaNp4vGoGBM8UzVaiE9WfWj5vL/NZ2w=";
-    x86_64-linux = "sha256-lSar09oOHr2M3pAbF9JlQhYqyd2GoNmVAGmSjm0ZpOg=";
+    aarch64-darwin = "sha256-oYO6XXy+x4+YxgpwpiTG/3AxrEKQdBlWDZ7yDI1Q7iY=";
+    aarch64-linux = "sha256-5A7Rk/3U+GvDmAX/bWBRZCY2t2AFKGORlL60dtzuaOI=";
+    x86_64-darwin = "sha256-E4921TAKduFMph7I4uxL354G1dqO+Nb94W9nMmB3hKs=";
+    x86_64-linux = "sha256-KcFtQmmjfHfI38en83vTcIGXoli2S13JfO2U2tW01pc=";
   }.${stdenv.hostPlatform.system} or unsupported;
 
 in stdenv.mkDerivation rec {
   inherit pname;
-  version = "1.7.4.3769";
+  version = "1.8.6.3946";
 
   src = fetchurl {
     url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.master.${version}.${os}-core-${arch}.tar.gz";

pkgs/tools/misc/qt5ct/default.nix

@@ -4,11 +4,11 @@ let inherit (lib) getDev; in
 
 mkDerivation rec {
   pname = "qt5ct";
-  version = "1.7";
+  version = "1.8";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-7VhUam5MUN/tG5/2oUjUpGj+m017WycnuWUB3ilVuNc=";
+    sha256 = "sha256-I7dAVEFepBJDKHcu+ab5UIOpuGVp4SgDSj/3XfrYCOk=";
   };
 
   nativeBuildInputs = [ qmake qttools ];

pkgs/tools/misc/qt6ct/default.nix

@@ -11,15 +11,15 @@
 let
   inherit (lib) getDev;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qt6ct";
-  version = "0.8";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "trialuser02";
     repo = "qt6ct";
-    rev = version;
-    sha256 = "BFE5aUgn3uFJWTgd4sUwP2L9RZwwwr5jVtAapA9vYbA=";
+    rev = finalAttrs.version;
+    hash = "sha256-MmN/qPBlsF2mBST+3eYeXaq+7B3b+nTN2hi6CmxrILc=";
   };
 
   nativeBuildInputs = [ qmake qttools wrapQtAppsHook ];
@@ -39,4 +39,4 @@ stdenv.mkDerivation rec {
     license = licenses.bsd2;
     maintainers = with maintainers; [ Flakebi Scrumplex ];
   };
-}
+})

pkgs/tools/misc/tgpt/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "tgpt";
-  version = "1.10.0";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "aandrew-me";
     repo = "tgpt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-AnGll0BjvR7xUWGn25M4nz4PIJAscl6Sh0pTn1102h8=";
+    hash = "sha256-WSOsAgWq0ivD5tjrdnRrNoBs/jFjdWGEx32tAtR3JXs=";
   };
 
-  vendorHash = "sha256-2I5JJWxM6aZx0eZu7taUTL11Y/5HIrXYC5aezrTbbsM=";
+  vendorHash = "sha256-HXpSoihk0s218DVCHe9VCGLBggWY8I25sw2qSaiUz4I=";
 
   ldflags = [
     "-s"

pkgs/tools/misc/trash-cli/default.nix

@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "trash-cli";
-  version = "0.23.2.13.2";
+  version = "0.23.9.23";
 
   src = fetchFromGitHub {
     owner = "andreafrancia";
     repo = "trash-cli";
     rev = version;
-    hash = "sha256-TJEi7HKIrfOdb+LLRt2DN5gWdFzUeo6isb59lFLK4bQ=";
+    hash = "sha256-EbW7P9fl7CDA6etOba7qcOtcxB2GkCd+zoi+NW0ZP9c=";
   };
 
   propagatedBuildInputs = with python3Packages; [ psutil six ];

pkgs/tools/misc/xsel/default.nix

@@ -1,24 +1,34 @@
-{ stdenv, lib, fetchFromGitHub, libX11, autoreconfHook }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  autoreconfHook,
+  libX11,
+  libXt
+}:
 
-stdenv.mkDerivation {
-  pname = "xsel-unstable";
-  version = "2020-05-27";
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xsel";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "kfish";
     repo = "xsel";
-    rev = "062e6d373537c60829fa9b5dcddbcd942986b3c3";
-    sha256 = "0fbf80zsc22vcqp59r9fdx4icxhrkv7l3lphw83326jrmkzy6kri";
+    rev = finalAttrs.version;
+    hash = "sha256-F2w/Ad8IWxJNH90/0a9+1M8bLfn1M3m4TH3PNpQmEFI=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
-  buildInputs = [ libX11 ];
+  nativeBuildInputs = [pkg-config autoreconfHook];
+  buildInputs = [libX11 libXt];
 
   meta = with lib; {
     description = "Command-line program for getting and setting the contents of the X selection";
     homepage = "http://www.kfish.org/software/xsel";
+    changelog = "https://github.com/kfish/xsel/releases/tag/${finalAttrs.version}";
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = with maintainers; [cafkafk];
     platforms = lib.platforms.unix;
+    mainProgram = "xsel";
   };
-}
+})

pkgs/tools/networking/goodhosts/default.nix

@@ -0,0 +1,35 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, testers
+}:
+
+buildGoModule rec {
+  pname = "goodhosts";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "goodhosts";
+    repo = "cli";
+    rev = "v${version}";
+    hash = "sha256-VXOMyYM4jS3gYxm3WiKw3uKeC535ppd9iHumPiupGbc=";
+  };
+
+  ldflags = [
+    "-s -w -X main.version=${version}"
+  ];
+
+  postInstall = ''
+    mv $out/bin/cli $out/bin/goodhosts
+  '';
+
+  vendorHash = "sha256-pL1z8cfnzcmX5iMVHQJGXYmzGuf8bp4Txbqoh5wSPWQ=";
+
+  meta = with lib; {
+    description = "A CLI tool for managing hostfiles";
+    license = licenses.mit;
+    homepage = "https://github.com/goodhosts/cli/tree/main";
+    maintainers = with maintainers; [ schinmai-akamai ];
+    mainProgram = "goodhosts";
+  };
+}

pkgs/tools/security/fulcio/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fulcio";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-9FDHMhL2vWyS5o04E3nML/pCL+juA87ZAEU6naIPCdc=";
+    sha256 = "sha256-6muoKiryWTGIoy1U3kWjuka0X1+gcrUQOvbuas26H1M=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -20,7 +20,7 @@ buildGoModule rec {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-dEBHhgy4dyorVbP1TloPTa1h6U/923bYrXX4qiRa/2w=";
+  vendorHash = "sha256-i9RK9kNSB9FOnVbYcHLBHt8KKBQCNsEDONNm1IxgTJc=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/tools/security/metasploit/Gemfile

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.36"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.3.37"

pkgs/tools/security/metasploit/Gemfile.lock

@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: 787e303296c1ac456e76b5980a975993c1e24742
-  ref: refs/tags/6.3.36
+  revision: 40ba61c644b1529ec4493ecb59dd5a8e4b3f16c1
+  ref: refs/tags/6.3.37
   specs:
-    metasploit-framework (6.3.36)
+    metasploit-framework (6.3.37)
       actionpack (~> 7.0)
       activerecord (~> 7.0)
       activesupport (~> 7.0)
@@ -35,7 +35,7 @@ GIT
       metasploit-concern
       metasploit-credential
       metasploit-model
-      metasploit-payloads (= 2.0.148)
+      metasploit-payloads (= 2.0.154)
       metasploit_data_models
       metasploit_payloads-mettle (= 1.0.26)
       mqtt
@@ -252,7 +252,7 @@ GEM
       activemodel (~> 7.0)
       activesupport (~> 7.0)
       railties (~> 7.0)
-    metasploit-payloads (2.0.148)
+    metasploit-payloads (2.0.154)
     metasploit_data_models (6.0.2)
       activerecord (~> 7.0)
       activesupport (~> 7.0)

pkgs/tools/security/metasploit/default.nix

@@ -15,13 +15,13 @@ let
   };
 in stdenv.mkDerivation rec {
   pname = "metasploit-framework";
-  version = "6.3.36";
+  version = "6.3.37";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     rev = version;
-    sha256 = "sha256-oHnVIdVeQsPTAQAMInWRKYYiYT7yHG7CZReoTZzH03s=";
+    sha256 = "sha256-veyBJpRycTBuNQocUss6xBOaiImj4EyLv0261UmI7mM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/tools/security/metasploit/gemset.nix

@@ -654,12 +654,12 @@
     platforms = [];
     source = {
       fetchSubmodules = false;
-      rev = "787e303296c1ac456e76b5980a975993c1e24742";
-      sha256 = "0yykqyf4va0pcp16w77j7rhj51i9j5sj4300079w6hjyslhxayd0";
+      rev = "40ba61c644b1529ec4493ecb59dd5a8e4b3f16c1";
+      sha256 = "0qzfi14xbfjdpy5lrq53i649l4y47b5m470a6mp30wbjjhk83v5x";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.3.36";
+    version = "6.3.37";
   };
   metasploit-model = {
     groups = ["default"];
@@ -676,10 +676,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1iyx853r9j1yr1jm4zawrmlm7sy3a083fv3i594b138qw78rk6hb";
+      sha256 = "0s3iii3y6jhmiymylhpxqcksgm8gwmmm3rhqspmd4n9ab4p4l36s";
       type = "gem";
     };
-    version = "2.0.148";
+    version = "2.0.154";
   };
   metasploit_data_models = {
     groups = ["default"];

pkgs/top-level/all-packages.nix

@@ -1828,6 +1828,8 @@ with pkgs;
 
   godspeed = callPackage ../tools/networking/godspeed { };
 
+  goodhosts = callPackage ../tools/networking/goodhosts { };
+
   goose = callPackage ../tools/misc/goose { };
 
   gp-saml-gui = python3Packages.callPackage ../tools/networking/gp-saml-gui { };
@@ -10687,6 +10689,7 @@ with pkgs;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
   lxcfs = callPackage ../os-specific/linux/lxcfs { };
+
   lxd = callPackage ../tools/admin/lxd/wrapper.nix { };
   lxd-unwrapped = callPackage ../tools/admin/lxd { };