Merge master into haskell-updates

2023-01-04 00:12:52 +00:00 · 2023-01-04 00:12:52 +00:00 · 20d97c0508
commit 20d97c0508
parent 413c75fa1a 6ff1cd277c
165 changed files with 2365 additions and 805 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -28,6 +28,7 @@
 /lib/cli.nix                @edolstra @nbp @Profpatsch
 /lib/debug.nix              @edolstra @nbp @Profpatsch
 /lib/asserts.nix            @edolstra @nbp @Profpatsch
+/lib/path.*                 @infinisil @fricklerhandwerk

 # Nixpkgs Internals
 /default.nix                                     @nbp
@ -106,7 +107,7 @@
 /pkgs/top-level/python-packages.nix                         @FRidh @jonringer
 /pkgs/development/interpreters/python                       @FRidh
 /pkgs/development/python-modules                            @FRidh @jonringer
-/doc/languages-frameworks/python.section.md                 @FRidh
+/doc/languages-frameworks/python.section.md                 @FRidh @mweinelt
 /pkgs/development/tools/poetry2nix                          @adisbladis
 /pkgs/development/interpreters/python/hooks                 @FRidh @jonringer

--- a/doc/doc-support/default.nix
+++ b/doc/doc-support/default.nix
@ -12,6 +12,7 @@ let
    { name = "lists"; description = "list manipulation functions"; }
    { name = "debug"; description = "debugging functions"; }
    { name = "options"; description = "NixOS / nixpkgs option handling"; }
+    { name = "path"; description = "path functions"; }
    { name = "filesystem"; description = "filesystem functions"; }
    { name = "sources"; description = "source filtering functions"; }
    { name = "cli"; description = "command-line serialization functions"; }
--- a/doc/doc-support/lib-function-docs.nix
+++ b/doc/doc-support/lib-function-docs.nix
@ -10,7 +10,11 @@ with pkgs; stdenv.mkDerivation {
  installPhase = ''
    function docgen {
      # TODO: wrap lib.$1 in <literal>, make nixdoc not escape it
-      nixdoc -c "$1" -d "lib.$1: $2" -f "$1.nix" > "$out/$1.xml"
+      if [[ -e "../lib/$1.nix" ]]; then
+        nixdoc -c "$1" -d "lib.$1: $2" -f "$1.nix" > "$out/$1.xml"
+      else
+        nixdoc -c "$1" -d "lib.$1: $2" -f "$1/default.nix" > "$out/$1.xml"
+      fi
      echo "<xi:include href='$1.xml' />" >> "$out/index.xml"
    }

--- a/doc/doc-support/lib-function-locations.nix
+++ b/doc/doc-support/lib-function-locations.nix
@ -2,19 +2,21 @@
 let
  revision = pkgs.lib.trivial.revisionWithDefault (nixpkgs.revision or "master");

-  libDefPos = set:
-    builtins.map
-      (name: {
-        name = name;
+  libDefPos = prefix: set:
+    builtins.concatMap
+      (name: [{
+        name = builtins.concatStringsSep "." (prefix ++ [name]);
        location = builtins.unsafeGetAttrPos name set;
-      })
-      (builtins.attrNames set);
+      }] ++ nixpkgsLib.optionals
+        (builtins.length prefix == 0 && builtins.isAttrs set.${name})
+        (libDefPos (prefix ++ [name]) set.${name})
+      ) (builtins.attrNames set);

  libset = toplib:
    builtins.map
      (subsetname: {
        subsetname = subsetname;
-        functions = libDefPos toplib.${subsetname};
+        functions = libDefPos [] toplib.${subsetname};
      })
      (builtins.map (x: x.name) libsets);

--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -570,7 +570,13 @@ test run would be:

 ```
  checkInputs = [ pytest ];
-  checkPhase = "pytest";
+  checkPhase = ''
+    runHook preCheck
+
+    pytest
+
+    runHook postCheck
+  '';
 ```

 However, many repositories' test suites do not translate well to nix's build
@ -582,7 +588,11 @@ To filter tests using pytest, one can do the following:
  checkInputs = [ pytest ];
  # avoid tests which need additional data or touch network
  checkPhase = ''
+    runHook preCheck
+
    pytest tests/ --ignore=tests/integration -k 'not download and not update'
+
+    runHook postCheck
  '';
 ```

@ -1408,7 +1418,11 @@ example of such a situation is when `py.test` is used.
    # assumes the tests are located in tests
    checkInputs = [ pytest ];
    checkPhase = ''
+      runHook preCheck
+
      py.test -k 'not function_name and not other_function' tests
+
+      runHook postCheck
    '';
  }
  ```
--- a/lib/default.nix
+++ b/lib/default.nix
@ -27,7 +27,6 @@ let
    maintainers = import ../maintainers/maintainer-list.nix;
    teams = callLibs ../maintainers/team-list.nix;
    meta = callLibs ./meta.nix;
-    sources = callLibs ./sources.nix;
    versions = callLibs ./versions.nix;

    # module system
@ -53,7 +52,9 @@ let
    fetchers = callLibs ./fetchers.nix;

    # Eval-time filesystem handling
+    path = callLibs ./path;
    filesystem = callLibs ./filesystem.nix;
+    sources = callLibs ./sources.nix;

    # back-compat aliases
    platforms = self.systems.doubles;
--- a/lib/path/README.md
+++ b/lib/path/README.md
@ -0,0 +1,196 @@
+# Path library
+
+This document explains why the `lib.path` library is designed the way it is.
+
+The purpose of this library is to process [filesystem paths]. It does not read files from the filesystem.
+It exists to support the native Nix [path value type] with extra functionality.
+
+[filesystem paths]: https://en.m.wikipedia.org/wiki/Path_(computing)
+[path value type]: https://nixos.org/manual/nix/stable/language/values.html#type-path
+
+As an extension of the path value type, it inherits the same intended use cases and limitations:
+- Only use paths to access files at evaluation time, such as the local project source.
+- Paths cannot point to derivations, so they are unfit to represent dependencies.
+- A path implicitly imports the referenced files into the Nix store when interpolated to a string. Therefore paths are not suitable to access files at build- or run-time, as you risk importing the path from the evaluation system instead.
+
+Overall, this library works with two types of paths:
+- Absolute paths are represented with the Nix [path value type]. Nix automatically normalises these paths.
+- Subpaths are represented with the [string value type] since path value types don't support relative paths. This library normalises these paths as safely as possible. Absolute paths in strings are not supported.
+
+  A subpath refers to a specific file or directory within an absolute base directory.
+  It is a stricter form of a relative path, notably [without support for `..` components][parents] since those could escape the base directory.
+
+[string value type]: https://nixos.org/manual/nix/stable/language/values.html#type-string
+
+This library is designed to be as safe and intuitive as possible, throwing errors when operations are attempted that would produce surprising results, and giving the expected result otherwise.
+
+This library is designed to work well as a dependency for the `lib.filesystem` and `lib.sources` library components. Contrary to these library components, `lib.path` does not read any paths from the filesystem.
+
+This library makes only these assumptions about paths and no others:
+- `dirOf path` returns the path to the parent directory of `path`, unless `path` is the filesystem root, in which case `path` is returned.
+  - There can be multiple filesystem roots: `p == dirOf p` and `q == dirOf q` does not imply `p == q`.
+    - While there's only a single filesystem root in stable Nix, the [lazy trees feature](https://github.com/NixOS/nix/pull/6530) introduces [additional filesystem roots](https://github.com/NixOS/nix/pull/6530#discussion_r1041442173).
+- `path + ("/" + string)` returns the path to the `string` subdirectory in `path`.
+  - If `string` contains no `/` characters, then `dirOf (path + ("/" + string)) == path`.
+  - If `string` contains no `/` characters, then `baseNameOf (path + ("/" + string)) == string`.
+- `path1 == path2` returns `true` only if `path1` points to the same filesystem path as `path2`.
+
+Notably we do not make the assumption that we can turn paths into strings using `toString path`.
+
+## Design decisions
+
+Each subsection here contains a decision along with arguments and counter-arguments for (+) and against (-) that decision.
+
+### Leading dots for relative paths
+[leading-dots]: #leading-dots-for-relative-paths
+
+Observing: Since subpaths are a form of relative paths, they can have a leading `./` to indicate it being a relative path, this is generally not necessary for tools though.
+
+Considering: Paths should be as explicit, consistent and unambiguous as possible.
+
+Decision: Returned subpaths should always have a leading `./`.
+
+<details>
+<summary>Arguments</summary>
+
+- (+) In shells, just running `foo` as a command wouldn't execute the file `foo`, whereas `./foo` would execute the file. In contrast, `foo/bar` does execute that file without the need for `./`. This can lead to confusion about when a `./` needs to be prefixed. If a `./` is always included, this becomes a non-issue. This effectively then means that paths don't overlap with command names.
+- (+) Prepending with `./` makes the subpaths always valid as relative Nix path expressions.
+- (+) Using paths in command line arguments could give problems if not escaped properly, e.g. if a path was `--version`. This is not a problem with `./--version`. This effectively then means that paths don't overlap with GNU-style command line options.
+- (-) `./` is not required to resolve relative paths, resolution always has an implicit `./` as prefix.
+- (-) It's less noisy without the `./`, e.g. in error messages.
+  - (+) But similarly, it could be confusing whether something was even a path.
+    e.g. `foo` could be anything, but `./foo` is more clearly a path.
+- (+) Makes it more uniform with absolute paths (those always start with `/`).
+  - (-) That is not relevant for practical purposes.
+- (+) `find` also outputs results with `./`.
+  - (-) But only if you give it an argument of `.`. If you give it the argument `some-directory`, it won't prefix that.
+- (-) `realpath --relative-to` doesn't prefix relative paths with `./`.
+  - (+) There is no need to return the same result as `realpath`.
+
+</details>
+
+### Representation of the current directory
+[curdir]: #representation-of-the-current-directory
+
+Observing: The subpath that produces the base directory can be represented with `.` or `./` or `./.`.
+
+Considering: Paths should be as consistent and unambiguous as possible.
+
+Decision: It should be `./.`.
+
+<details>
+<summary>Arguments</summary>
+
+- (+) `./` would be inconsistent with [the decision to not persist trailing slashes][trailing-slashes].
+- (-) `.` is how `realpath` normalises paths.
+- (+) `.` can be interpreted as a shell command (it's a builtin for sourcing files in `bash` and `zsh`).
+- (+) `.` would be the only path without a `/`. It could not be used as a Nix path expression, since those require at least one `/` to be parsed as such.
+- (-) `./.` is rather long.
+  - (-) We don't require users to type this though, as it's only output by the library.
+    As inputs all three variants are supported for subpaths (and we can't do anything about absolute paths)
+- (-) `builtins.dirOf "foo" == "."`, so `.` would be consistent with that.
+- (+) `./.` is consistent with the [decision to have leading `./`][leading-dots].
+- (+) `./.` is a valid Nix path expression, although this property does not hold for every relative path or subpath.
+
+</details>
+
+### Subpath representation
+[relrepr]: #subpath-representation
+
+Observing: Subpaths such as `foo/bar` can be represented in various ways:
+- string: `"foo/bar"`
+- list with all the components: `[ "foo" "bar" ]`
+- attribute set: `{ type = "relative-path"; components = [ "foo" "bar" ]; }`
+
+Considering: Paths should be as safe to use as possible. We should generate string outputs in the library and not encourage users to do that themselves.
+
+Decision: Paths are represented as strings.
+
+<details>
+<summary>Arguments</summary>
+
+- (+) It's simpler for the users of the library. One doesn't have to convert a path a string before it can be used.
+  - (+) Naively converting the list representation to a string with `concatStringsSep "/"` would break for `[]`, requiring library users to be more careful.
+- (+) It doesn't encourage people to do their own path processing and instead use the library.
+  With a list representation it would seem easy to just use `lib.lists.init` to get the parent directory, but then it breaks for `.`, which would be represented as `[ ]`.
+- (+) `+` is convenient and doesn't work on lists and attribute sets.
+  - (-) Shouldn't use `+` anyways, we export safer functions for path manipulation.
+
+</details>
+
+### Parent directory
+[parents]: #parent-directory
+
+Observing: Relative paths can have `..` components, which refer to the parent directory.
+
+Considering: Paths should be as safe and unambiguous as possible.
+
+Decision: `..` path components in string paths are not supported, neither as inputs nor as outputs. Hence, string paths are called subpaths, rather than relative paths.
+
+<details>
+<summary>Arguments</summary>
+
+- (+) If we wanted relative paths to behave according to the "physical" interpretation (as a directory tree with relations between nodes), it would require resolving symlinks, since e.g. `foo/..` would not be the same as `.` if `foo` is a symlink.
+  - (-) The "logical" interpretation is also valid (treating paths as a sequence of names), and is used by some software. It is simpler, and not using symlinks at all is safer.
+  - (+) Mixing both models can lead to surprises.
+  - (+) We can't resolve symlinks without filesystem access.
+  - (+) Nix also doesn't support reading symlinks at evaluation time.
+  - (-) We could just not handle such cases, e.g. `equals "foo" "foo/bar/.. == false`. The paths are different, we don't need to check whether the paths point to the same thing.
+    - (+) Assume we said `relativeTo /foo /bar == "../bar"`. If this is used like `/bar/../foo` in the end, and `bar` turns out to be a symlink to somewhere else, this won't be accurate.
+      - (-) We could decide to not support such ambiguous operations, or mark them as such, e.g. the normal `relativeTo` will error on such a case, but there could be `extendedRelativeTo` supporting that.
+- (-) `..` are a part of paths, a path library should therefore support it.
+  - (+) If we can convincingly argue that all such use cases are better done e.g. with runtime tools, the library not supporting it can nudge people towards using those.
+- (-) We could allow "..", but only in the prefix.
+  - (+) Then we'd have to throw an error for doing `append /some/path "../foo"`, making it non-composable.
+  - (+) The same is for returning paths with `..`: `relativeTo /foo /bar => "../bar"` would produce a non-composable path.
+- (+) We argue that `..` is not needed at the Nix evaluation level, since we'd always start evaluation from the project root and don't go up from there.
+  - (+) `..` is supported in Nix paths, turning them into absolute paths.
+    - (-) This is ambiguous in the presence of symlinks.
+- (+) If you need `..` for building or runtime, you can use build-/run-time tooling to create those (e.g. `realpath` with `--relative-to`), or use absolute paths instead.
+  This also gives you the ability to correctly handle symlinks.
+
+</details>
+
+### Trailing slashes
+[trailing-slashes]: #trailing-slashes
+
+Observing: Subpaths can contain trailing slashes, like `foo/`, indicating that the path points to a directory and not a file.
+
+Considering: Paths should be as consistent as possible, there should only be a single normalisation for the same path.
+
+Decision: All functions remove trailing slashes in their results.
+
+<details>
+<summary>Arguments</summary>
+
+- (+) It allows normalisations to be unique, in that there's only a single normalisation for the same path. If trailing slashes were preserved, both `foo/bar` and `foo/bar/` would be valid but different normalisations for the same path.
+- Comparison to other frameworks to figure out the least surprising behavior:
+  - (+) Nix itself doesn't support trailing slashes when parsing and doesn't preserve them when appending paths.
+  - (-) [Rust's std::path](https://doc.rust-lang.org/std/path/index.html) does preserve them during [construction](https://doc.rust-lang.org/std/path/struct.Path.html#method.new).
+    - (+) Doesn't preserve them when returning individual [components](https://doc.rust-lang.org/std/path/struct.Path.html#method.components).
+    - (+) Doesn't preserve them when [canonicalizing](https://doc.rust-lang.org/std/path/struct.Path.html#method.canonicalize).
+  - (+) [Python 3's pathlib](https://docs.python.org/3/library/pathlib.html#module-pathlib) doesn't preserve them during [construction](https://docs.python.org/3/library/pathlib.html#pathlib.PurePath).
+    - Notably it represents the individual components as a list internally.
+  - (-) [Haskell's filepath](https://hackage.haskell.org/package/filepath-1.4.100.0) has [explicit support](https://hackage.haskell.org/package/filepath-1.4.100.0/docs/System-FilePath.html#g:6) for handling trailing slashes.
+    - (-) Does preserve them for [normalisation](https://hackage.haskell.org/package/filepath-1.4.100.0/docs/System-FilePath.html#v:normalise).
+  - (-) [NodeJS's Path library](https://nodejs.org/api/path.html) preserves trailing slashes for [normalisation](https://nodejs.org/api/path.html#pathnormalizepath).
+    - (+) For [parsing a path](https://nodejs.org/api/path.html#pathparsepath) into its significant elements, trailing slashes are not preserved.
+- (+) Nix's builtin function `dirOf` gives an unexpected result for paths with trailing slashes: `dirOf "foo/bar/" == "foo/bar"`.
+  Inconsistently, `baseNameOf` works correctly though: `baseNameOf "foo/bar/" == "bar"`.
+  - (-) We are writing a path library to improve handling of paths though, so we shouldn't use these functions and discourage their use.
+- (-) Unexpected result when normalising intermediate paths, like `relative.normalise ("foo" + "/") + "bar" == "foobar"`.
+  - (+) This is not a practical use case though.
+  - (+) Don't use `+` to append paths, this library has a `join` function for that.
+    - (-) Users might use `+` out of habit though.
+- (+) The `realpath` command also removes trailing slashes.
+- (+) Even with a trailing slash, the path is the same, it's only an indication that it's a directory.
+
+</details>
+
+## Other implementations and references
+
+- [Rust](https://doc.rust-lang.org/std/path/struct.Path.html)
+- [Python](https://docs.python.org/3/library/pathlib.html)
+- [Haskell](https://hackage.haskell.org/package/filepath-1.4.100.0/docs/System-FilePath.html)
+- [Nodejs](https://nodejs.org/api/path.html)
+- [POSIX.1-2017](https://pubs.opengroup.org/onlinepubs/9699919799/nframe.html)
--- a/lib/path/default.nix
+++ b/lib/path/default.nix
@ -0,0 +1,218 @@
+# Functions for working with paths, see ./path.md
+{ lib }:
+let
+
+  inherit (builtins)
+    isString
+    split
+    match
+    ;
+
+  inherit (lib.lists)
+    length
+    head
+    last
+    genList
+    elemAt
+    ;
+
+  inherit (lib.strings)
+    concatStringsSep
+    substring
+    ;
+
+  inherit (lib.asserts)
+    assertMsg
+    ;
+
+  # Return the reason why a subpath is invalid, or `null` if it's valid
+  subpathInvalidReason = value:
+    if ! isString value then
+      "The given value is of type ${builtins.typeOf value}, but a string was expected"
+    else if value == "" then
+      "The given string is empty"
+    else if substring 0 1 value == "/" then
+      "The given string \"${value}\" starts with a `/`, representing an absolute path"
+    # We don't support ".." components, see ./path.md#parent-directory
+    else if match "(.*/)?\\.\\.(/.*)?" value != null then
+      "The given string \"${value}\" contains a `..` component, which is not allowed in subpaths"
+    else null;
+
+  # Split and normalise a relative path string into its components.
+  # Error for ".." components and doesn't include "." components
+  splitRelPath = path:
+    let
+      # Split the string into its parts using regex for efficiency. This regex
+      # matches patterns like "/", "/./", "/././", with arbitrarily many "/"s
+      # together. These are the main special cases:
+      # - Leading "./" gets split into a leading "." part
+      # - Trailing "/." or "/" get split into a trailing "." or ""
+      #   part respectively
+      #
+      # These are the only cases where "." and "" parts can occur
+      parts = split "/+(\\./+)*" path;
+
+      # `split` creates a list of 2 * k + 1 elements, containing the k +
+      # 1 parts, interleaved with k matches where k is the number of
+      # (non-overlapping) matches. This calculation here gets the number of parts
+      # back from the list length
+      # floor( (2 * k + 1) / 2 ) + 1 == floor( k + 1/2 ) + 1 == k + 1
+      partCount = length parts / 2 + 1;
+
+      # To assemble the final list of components we want to:
+      # - Skip a potential leading ".", normalising "./foo" to "foo"
+      # - Skip a potential trailing "." or "", normalising "foo/" and "foo/." to
+      #   "foo". See ./path.md#trailing-slashes
+      skipStart = if head parts == "." then 1 else 0;
+      skipEnd = if last parts == "." || last parts == "" then 1 else 0;
+
+      # We can now know the length of the result by removing the number of
+      # skipped parts from the total number
+      componentCount = partCount - skipEnd - skipStart;
+
+    in
+      # Special case of a single "." path component. Such a case leaves a
+      # componentCount of -1 due to the skipStart/skipEnd not verifying that
+      # they don't refer to the same character
+      if path == "." then []
+
+      # Generate the result list directly. This is more efficient than a
+      # combination of `filter`, `init` and `tail`, because here we don't
+      # allocate any intermediate lists
+      else genList (index:
+        # To get to the element we need to add the number of parts we skip and
+        # multiply by two due to the interleaved layout of `parts`
+        elemAt parts ((skipStart + index) * 2)
+      ) componentCount;
+
+  # Join relative path components together
+  joinRelPath = components:
+    # Always return relative paths with `./` as a prefix (./path.md#leading-dots-for-relative-paths)
+    "./" +
+    # An empty string is not a valid relative path, so we need to return a `.` when we have no components
+    (if components == [] then "." else concatStringsSep "/" components);
+
+in /* No rec! Add dependencies on this file at the top. */ {
+
+
+  /* Whether a value is a valid subpath string.
+
+  - The value is a string
+
+  - The string is not empty
+
+  - The string doesn't start with a `/`
+
+  - The string doesn't contain any `..` path components
+
+  Type:
+    subpath.isValid :: String -> Bool
+
+  Example:
+    # Not a string
+    subpath.isValid null
+    => false
+
+    # Empty string
+    subpath.isValid ""
+    => false
+
+    # Absolute path
+    subpath.isValid "/foo"
+    => false
+
+    # Contains a `..` path component
+    subpath.isValid "../foo"
+    => false
+
+    # Valid subpath
+    subpath.isValid "foo/bar"
+    => true
+
+    # Doesn't need to be normalised
+    subpath.isValid "./foo//bar/"
+    => true
+  */
+  subpath.isValid = value:
+    subpathInvalidReason value == null;
+
+
+  /* Normalise a subpath. Throw an error if the subpath isn't valid, see
+  `lib.path.subpath.isValid`
+
+  - Limit repeating `/` to a single one
+
+  - Remove redundant `.` components
+
+  - Remove trailing `/` and `/.`
+
+  - Add leading `./`
+
+  Laws:
+
+  - (Idempotency) Normalising multiple times gives the same result:
+
+        subpath.normalise (subpath.normalise p) == subpath.normalise p
+
+  - (Uniqueness) There's only a single normalisation for the paths that lead to the same file system node:
+
+        subpath.normalise p != subpath.normalise q -> $(realpath ${p}) != $(realpath ${q})
+
+  - Don't change the result when appended to a Nix path value:
+
+        base + ("/" + p) == base + ("/" + subpath.normalise p)
+
+  - Don't change the path according to `realpath`:
+
+        $(realpath ${p}) == $(realpath ${subpath.normalise p})
+
+  - Only error on invalid subpaths:
+
+        builtins.tryEval (subpath.normalise p)).success == subpath.isValid p
+
+  Type:
+    subpath.normalise :: String -> String
+
+  Example:
+    # limit repeating `/` to a single one
+    subpath.normalise "foo//bar"
+    => "./foo/bar"
+
+    # remove redundant `.` components
+    subpath.normalise "foo/./bar"
+    => "./foo/bar"
+
+    # add leading `./`
+    subpath.normalise "foo/bar"
+    => "./foo/bar"
+
+    # remove trailing `/`
+    subpath.normalise "foo/bar/"
+    => "./foo/bar"
+
+    # remove trailing `/.`
+    subpath.normalise "foo/bar/."
+    => "./foo/bar"
+
+    # Return the current directory as `./.`
+    subpath.normalise "."
+    => "./."
+
+    # error on `..` path components
+    subpath.normalise "foo/../bar"
+    => <error>
+
+    # error on empty string
+    subpath.normalise ""
+    => <error>
+
+    # error on absolute path
+    subpath.normalise "/foo"
+    => <error>
+  */
+  subpath.normalise = path:
+    assert assertMsg (subpathInvalidReason path == null)
+      "lib.path.subpath.normalise: Argument is not a valid subpath string: ${subpathInvalidReason path}";
+    joinRelPath (splitRelPath path);
+
+}
--- a/lib/path/tests/default.nix
+++ b/lib/path/tests/default.nix
@ -0,0 +1,34 @@
+{
+  nixpkgs ? ../../..,
+  system ? builtins.currentSystem,
+  pkgs ? import nixpkgs {
+    config = {};
+    overlays = [];
+    inherit system;
+  },
+  libpath ? ../..,
+  # Random seed
+  seed ? null,
+}:
+pkgs.runCommand "lib-path-tests" {
+  nativeBuildInputs = with pkgs; [
+    nix
+    jq
+    bc
+  ];
+} ''
+  # Needed to make Nix evaluation work
+  export NIX_STATE_DIR=$(mktemp -d)
+
+  cp -r ${libpath} lib
+  export TEST_LIB=$PWD/lib
+
+  echo "Running unit tests lib/path/tests/unit.nix"
+  nix-instantiate --eval lib/path/tests/unit.nix \
+    --argstr libpath "$TEST_LIB"
+
+  echo "Running property tests lib/path/tests/prop.sh"
+  bash lib/path/tests/prop.sh ${toString seed}
+
+  touch $out
+''
--- a/lib/path/tests/generate.awk
+++ b/lib/path/tests/generate.awk
@ -0,0 +1,64 @@
+# Generate random path-like strings, separated by null characters.
+#
+# Invocation:
+#
+#     awk -f ./generate.awk -v <variable>=<value> | tr '\0' '\n'
+#
+# Customizable variables (all default to 0):
+# - seed: Deterministic random seed to use for generation
+# - count: Number of paths to generate
+# - extradotweight: Give extra weight to dots being generated
+# - extraslashweight: Give extra weight to slashes being generated
+# - extranullweight: Give extra weight to null being generated, making paths shorter
+BEGIN {
+  # Random seed, passed explicitly for reproducibility
+  srand(seed)
+
+  # Don't include special characters below 32
+  minascii = 32
+  # Don't include DEL at 128
+  maxascii = 127
+  upperascii = maxascii - minascii
+
+  # add extra weight for ., in addition to the one weight from the ascii range
+  upperdot = upperascii + extradotweight
+
+  # add extra weight for /, in addition to the one weight from the ascii range
+  upperslash = upperdot + extraslashweight
+
+  # add extra weight for null, indicating the end of the string
+  # Must be at least 1 to have strings end at all
+  total = upperslash + 1 + extranullweight
+
+  # new=1 indicates that it's a new string
+  new=1
+  while (count > 0) {
+
+    # Random integer between [0, total)
+    value = int(rand() * total)
+
+    if (value < upperascii) {
+      # Ascii range
+      printf("%c", value + minascii)
+      new=0
+
+    } else if (value < upperdot) {
+      # Dot range
+      printf "."
+      new=0
+
+    } else if (value < upperslash) {
+      # If it's the start of a new path, only generate a / in 10% of cases
+      # This is always an invalid subpath, which is not a very interesting case
+      if (new && rand() > 0.1) continue
+      printf "/"
+
+    } else {
+      # Do not generate empty strings
+      if (new) continue
+      printf "\x00"
+      count--
+      new=1
+    }
+  }
+}
--- a/lib/path/tests/prop.nix
+++ b/lib/path/tests/prop.nix
@ -0,0 +1,60 @@
+# Given a list of path-like strings, check some properties of the path library
+# using those paths and return a list of attribute sets of the following form:
+#
+#     { <string> = <lib.path.subpath.normalise string>; }
+#
+# If `normalise` fails to evaluate, the attribute value is set to `""`.
+# If not, the resulting value is normalised again and an appropriate attribute set added to the output list.
+{
+  # The path to the nixpkgs lib to use
+  libpath,
+  # A flat directory containing files with randomly-generated
+  # path-like values
+  dir,
+}:
+let
+  lib = import libpath;
+
+  # read each file into a string
+  strings = map (name:
+    builtins.readFile (dir + "/${name}")
+  ) (builtins.attrNames (builtins.readDir dir));
+
+  inherit (lib.path.subpath) normalise isValid;
+  inherit (lib.asserts) assertMsg;
+
+  normaliseAndCheck = str:
+    let
+      originalValid = isValid str;
+
+      tryOnce = builtins.tryEval (normalise str);
+      tryTwice = builtins.tryEval (normalise tryOnce.value);
+
+      absConcatOrig = /. + ("/" + str);
+      absConcatNormalised = /. + ("/" + tryOnce.value);
+    in
+      # Check the lib.path.subpath.normalise property to only error on invalid subpaths
+      assert assertMsg
+        (originalValid -> tryOnce.success)
+        "Even though string \"${str}\" is valid as a subpath, the normalisation for it failed";
+      assert assertMsg
+        (! originalValid -> ! tryOnce.success)
+        "Even though string \"${str}\" is invalid as a subpath, the normalisation for it succeeded";
+
+      # Check normalisation idempotency
+      assert assertMsg
+        (originalValid -> tryTwice.success)
+        "For valid subpath \"${str}\", the normalisation \"${tryOnce.value}\" was not a valid subpath";
+      assert assertMsg
+        (originalValid -> tryOnce.value == tryTwice.value)
+        "For valid subpath \"${str}\", normalising it once gives \"${tryOnce.value}\" but normalising it twice gives a different result: \"${tryTwice.value}\"";
+
+      # Check that normalisation doesn't change a string when appended to an absolute Nix path value
+      assert assertMsg
+        (originalValid -> absConcatOrig == absConcatNormalised)
+        "For valid subpath \"${str}\", appending to an absolute Nix path value gives \"${absConcatOrig}\", but appending the normalised result \"${tryOnce.value}\" gives a different value \"${absConcatNormalised}\"";
+
+      # Return an empty string when failed
+      if tryOnce.success then tryOnce.value else "";
+
+in lib.genAttrs strings normaliseAndCheck
--- a/lib/path/tests/prop.sh
+++ b/lib/path/tests/prop.sh
@ -0,0 +1,179 @@
+#!/usr/bin/env bash
+
+# Property tests for the `lib.path` library
+#
+# It generates random path-like strings and runs the functions on
+# them, checking that the expected laws of the functions hold
+
+set -euo pipefail
+shopt -s inherit_errexit
+
+# https://stackoverflow.com/a/246128
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+if test -z "${TEST_LIB:-}"; then
+    TEST_LIB=$SCRIPT_DIR/../..
+fi
+
+tmp="$(mktemp -d)"
+clean_up() {
+    rm -rf "$tmp"
+}
+trap clean_up EXIT
+mkdir -p "$tmp/work"
+cd "$tmp/work"
+
+# Defaulting to a random seed but the first argument can override this
+seed=${1:-$RANDOM}
+echo >&2 "Using seed $seed, use \`lib/path/tests/prop.sh $seed\` to reproduce this result"
+
+# The number of random paths to generate. This specific number was chosen to
+# be fast enough while still generating enough variety to detect bugs.
+count=500
+
+debug=0
+# debug=1 # print some extra info
+# debug=2 # print generated values
+
+# Fine tuning parameters to balance the number of generated invalid paths
+# to the variance in generated paths.
+extradotweight=64   # Larger value: more dots
+extraslashweight=64 # Larger value: more slashes
+extranullweight=16  # Larger value: shorter strings
+
+die() {
+    echo >&2 "test case failed: " "$@"
+    exit 1
+}
+
+if [[ "$debug" -ge 1 ]]; then
+    echo >&2 "Generating $count random path-like strings"
+fi
+
+# Read stream of null-terminated strings entry-by-entry into bash,
+# write it to a file and the `strings` array.
+declare -a strings=()
+mkdir -p "$tmp/strings"
+while IFS= read -r -d $'\0' str; do
+    echo -n "$str" > "$tmp/strings/${#strings[@]}"
+    strings+=("$str")
+done < <(awk \
+    -f "$SCRIPT_DIR"/generate.awk \
+    -v seed="$seed" \
+    -v count="$count" \
+    -v extradotweight="$extradotweight" \
+    -v extraslashweight="$extraslashweight" \
+    -v extranullweight="$extranullweight")
+
+if [[ "$debug" -ge 1 ]]; then
+    echo >&2 "Trying to normalise the generated path-like strings with Nix"
+fi
+
+# Precalculate all normalisations with a single Nix call. Calling Nix for each
+# string individually would take way too long
+nix-instantiate --eval --strict --json \
+    --argstr libpath "$TEST_LIB" \
+    --argstr dir "$tmp/strings" \
+    "$SCRIPT_DIR"/prop.nix \
+    >"$tmp/result.json"
+
+# Uses some jq magic to turn the resulting attribute set into an associative
+# bash array assignment
+declare -A normalised_result="($(jq '
+    to_entries
+    | map("[\(.key | @sh)]=\(.value | @sh)")
+    | join(" \n")' -r < "$tmp/result.json"))"
+
+# Looks up a normalisation result for a string
+# Checks that the normalisation is only failing iff it's an invalid subpath
+# For valid subpaths, returns 0 and prints the normalisation result
+# For invalid subpaths, returns 1
+normalise() {
+    local str=$1
+    # Uses the same check for validity as in the library implementation
+    if [[ "$str" == "" || "$str" == /* || "$str" =~ ^(.*/)?\.\.(/.*)?$ ]]; then
+        valid=
+    else
+        valid=1
+    fi
+
+    normalised=${normalised_result[$str]}
+    # An empty string indicates failure, this is encoded in ./prop.nix
+    if [[ -n "$normalised" ]]; then
+        if [[ -n "$valid" ]]; then
+            echo "$normalised"
+        else
+            die "For invalid subpath \"$str\", lib.path.subpath.normalise returned this result: \"$normalised\""
+        fi
+    else
+        if [[ -n "$valid" ]]; then
+            die "For valid subpath \"$str\", lib.path.subpath.normalise failed"
+        else
+            if [[ "$debug" -ge 2 ]]; then
+                echo >&2 "String \"$str\" is not a valid subpath"
+            fi
+            # Invalid and it correctly failed, we let the caller continue if they catch the exit code
+            return 1
+        fi
+    fi
+}
+
+# Intermediate result populated by test_idempotency_realpath
+# and used in test_normalise_uniqueness
+#
+# Contains a mapping from a normalised subpath to the realpath result it represents
+declare -A norm_to_real
+
+test_idempotency_realpath() {
+    if [[ "$debug" -ge 1 ]]; then
+        echo >&2 "Checking idempotency of each result and making sure the realpath result isn't changed"
+    fi
+
+    # Count invalid subpaths to display stats
+    invalid=0
+    for str in "${strings[@]}"; do
+        if ! result=$(normalise "$str"); then
+            ((invalid++)) || true
+            continue
+        fi
+
+        # Check the law that it doesn't change the result of a realpath
+        mkdir -p -- "$str" "$result"
+        real_orig=$(realpath -- "$str")
+        real_norm=$(realpath -- "$result")
+
+        if [[ "$real_orig" != "$real_norm" ]]; then
+            die "realpath of the original string \"$str\" (\"$real_orig\") is not the same as realpath of the normalisation \"$result\" (\"$real_norm\")"
+        fi
+
+        if [[ "$debug" -ge 2 ]]; then
+            echo >&2 "String \"$str\" gets normalised to \"$result\" and file path \"$real_orig\""
+        fi
+        norm_to_real["$result"]="$real_orig"
+    done
+    if [[ "$debug" -ge 1 ]]; then
+        echo >&2 "$(bc <<< "scale=1; 100 / $count * $invalid")% of the total $count generated strings were invalid subpath strings, and were therefore ignored"
+    fi
+}
+
+test_normalise_uniqueness() {
+    if [[ "$debug" -ge 1 ]]; then
+        echo >&2 "Checking for the uniqueness law"
+    fi
+
+    for norm_p in "${!norm_to_real[@]}"; do
+        real_p=${norm_to_real["$norm_p"]}
+        for norm_q in "${!norm_to_real[@]}"; do
+            real_q=${norm_to_real["$norm_q"]}
+            # Checks normalisation uniqueness law for each pair of values
+            if [[ "$norm_p" != "$norm_q" && "$real_p" == "$real_q" ]]; then
+                die "Normalisations \"$norm_p\" and \"$norm_q\" are different, but the realpath of them is the same: \"$real_p\""
+            fi
+        done
+    done
+}
+
+test_idempotency_realpath
+test_normalise_uniqueness
+
+echo >&2 tests ok
--- a/lib/path/tests/unit.nix
+++ b/lib/path/tests/unit.nix
@ -0,0 +1,125 @@
+# Unit tests for lib.path functions. Use `nix-build` in this directory to
+# run these
+{ libpath }:
+let
+  lib = import libpath;
+  inherit (lib.path) subpath;
+
+  cases = lib.runTests {
+    testSubpathIsValidExample1 = {
+      expr = subpath.isValid null;
+      expected = false;
+    };
+    testSubpathIsValidExample2 = {
+      expr = subpath.isValid "";
+      expected = false;
+    };
+    testSubpathIsValidExample3 = {
+      expr = subpath.isValid "/foo";
+      expected = false;
+    };
+    testSubpathIsValidExample4 = {
+      expr = subpath.isValid "../foo";
+      expected = false;
+    };
+    testSubpathIsValidExample5 = {
+      expr = subpath.isValid "foo/bar";
+      expected = true;
+    };
+    testSubpathIsValidExample6 = {
+      expr = subpath.isValid "./foo//bar/";
+      expected = true;
+    };
+    testSubpathIsValidTwoDotsEnd = {
+      expr = subpath.isValid "foo/..";
+      expected = false;
+    };
+    testSubpathIsValidTwoDotsMiddle = {
+      expr = subpath.isValid "foo/../bar";
+      expected = false;
+    };
+    testSubpathIsValidTwoDotsPrefix = {
+      expr = subpath.isValid "..foo";
+      expected = true;
+    };
+    testSubpathIsValidTwoDotsSuffix = {
+      expr = subpath.isValid "foo..";
+      expected = true;
+    };
+    testSubpathIsValidTwoDotsPrefixComponent = {
+      expr = subpath.isValid "foo/..bar/baz";
+      expected = true;
+    };
+    testSubpathIsValidTwoDotsSuffixComponent = {
+      expr = subpath.isValid "foo/bar../baz";
+      expected = true;
+    };
+    testSubpathIsValidThreeDots = {
+      expr = subpath.isValid "...";
+      expected = true;
+    };
+    testSubpathIsValidFourDots = {
+      expr = subpath.isValid "....";
+      expected = true;
+    };
+    testSubpathIsValidThreeDotsComponent = {
+      expr = subpath.isValid "foo/.../bar";
+      expected = true;
+    };
+    testSubpathIsValidFourDotsComponent = {
+      expr = subpath.isValid "foo/..../bar";
+      expected = true;
+    };
+
+    testSubpathNormaliseExample1 = {
+      expr = subpath.normalise "foo//bar";
+      expected = "./foo/bar";
+    };
+    testSubpathNormaliseExample2 = {
+      expr = subpath.normalise "foo/./bar";
+      expected = "./foo/bar";
+    };
+    testSubpathNormaliseExample3 = {
+      expr = subpath.normalise "foo/bar";
+      expected = "./foo/bar";
+    };
+    testSubpathNormaliseExample4 = {
+      expr = subpath.normalise "foo/bar/";
+      expected = "./foo/bar";
+    };
+    testSubpathNormaliseExample5 = {
+      expr = subpath.normalise "foo/bar/.";
+      expected = "./foo/bar";
+    };
+    testSubpathNormaliseExample6 = {
+      expr = subpath.normalise ".";
+      expected = "./.";
+    };
+    testSubpathNormaliseExample7 = {
+      expr = (builtins.tryEval (subpath.normalise "foo/../bar")).success;
+      expected = false;
+    };
+    testSubpathNormaliseExample8 = {
+      expr = (builtins.tryEval (subpath.normalise "")).success;
+      expected = false;
+    };
+    testSubpathNormaliseExample9 = {
+      expr = (builtins.tryEval (subpath.normalise "/foo")).success;
+      expected = false;
+    };
+    testSubpathNormaliseIsValidDots = {
+      expr = subpath.normalise "./foo/.bar/.../baz...qux";
+      expected = "./foo/.bar/.../baz...qux";
+    };
+    testSubpathNormaliseWrongType = {
+      expr = (builtins.tryEval (subpath.normalise null)).success;
+      expected = false;
+    };
+    testSubpathNormaliseTwoDots = {
+      expr = (builtins.tryEval (subpath.normalise "..")).success;
+      expected = false;
+    };
+  };
+in
+  if cases == [] then "Unit tests successful"
+  else throw "Path unit tests failed: ${lib.generators.toPretty {} cases}"
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@ -48,6 +48,7 @@ rec {

    is32bit        = { cpu = { bits = 32; }; };
    is64bit        = { cpu = { bits = 64; }; };
+    isILP32        = map (a: { abi = { abi = a; }; }) [ "n32" "ilp32" "x32" ];
    isBigEndian    = { cpu = { significantByte = significantBytes.bigEndian; }; };
    isLittleEndian = { cpu = { significantByte = significantBytes.littleEndian; }; };

--- a/lib/tests/release.nix
+++ b/lib/tests/release.nix
@ -15,6 +15,9 @@ pkgs.runCommand "nixpkgs-lib-tests" {
      inherit pkgs;
      lib = import ../.;
    })
+    (import ../path/tests {
+      inherit pkgs;
+    })
  ];
 } ''
    datadir="${pkgs.nix}/share"
--- a/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2305.section.xml
@ -339,6 +339,13 @@
          And backup your data.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>services.chronyd</literal> is now started with
+          additional systemd sandbox/hardening options for better
+          security.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The module <literal>services.headscale</literal> was
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@ -94,6 +94,8 @@ In addition to numerous new and upgraded packages, this release has the followin

  And backup your data.

+- `services.chronyd` is now started with additional systemd sandbox/hardening options for better security.
+
 - The module `services.headscale` was refactored to be compliant with [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md). To be precise, this means that the following things have changed:

  - Most settings has been migrated under [services.headscale.settings](#opt-services.headscale.settings) which is an attribute-set that
--- a/nixos/modules/programs/gnupg.nix
+++ b/nixos/modules/programs/gnupg.nix
@ -135,7 +135,7 @@ in
      # The SSH agent protocol doesn't have support for changing TTYs; however we
      # can simulate this with the `exec` feature of openssh (see ssh_config(5))
      # that hooks a command to the shell currently running the ssh program.
-      Match host * exec "${cfg.package}/bin/gpg-connect-agent --quiet updatestartuptty /bye >/dev/null 2>&1"
+      Match host * exec "${pkgs.runtimeShell} -c '${cfg.package}/bin/gpg-connect-agent --quiet updatestartuptty /bye >/dev/null 2>&1'"
    '';

    environment.extraInit = mkIf cfg.agent.enableSSHSupport ''
--- a/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/jack.conf.json
@ -33,6 +33,31 @@
      "actions": {
        "update-props": {}
      }
+    },
+    {
+      "matches": [
+        {
+          "application.process.binary": "jack_bufsize"
+        }
+      ],
+      "actions": {
+        "update-props": {
+          "jack.global-buffer-size": true
+        }
+      }
+    },
+    {
+      "matches": [
+        {
+          "application.process.binary": "qsynth"
+        }
+      ],
+      "actions": {
+        "update-props": {
+          "node.pause-on-idle": false,
+          "node.passive": true
+        }
+      }
    }
  ]
 }
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
@ -32,10 +32,12 @@
      "args": {}
    }
  ],
-  "context.exec": [
+  "context.exec": [],
+  "pulse.cmd": [
    {
-      "path": "pactl",
-      "args": "load-module module-always-sink"
+      "cmd": "load-module",
+      "args": "module-always-sink",
+      "flags": []
    }
  ],
  "stream.properties": {},
@ -89,13 +91,14 @@
    {
      "matches": [
        {
-          "application.name": "~speech-dispatcher*"
+          "application.name": "~speech-dispatcher.*"
        }
      ],
      "actions": {
        "update-props": {
-          "pulse.min.req": "1024/48000",
-          "pulse.min.quantum": "1024/48000"
+          "pulse.min.req": "512/48000",
+          "pulse.min.quantum": "512/48000",
+          "pulse.idle.timeout": 5
        }
      }
    }
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/pipewire.conf.json
@ -70,6 +70,14 @@
    },
    {
      "name": "libpipewire-module-session-manager"
+    },
+    {
+      "name": "libpipewire-module-x11-bell",
+      "args": {},
+      "flags": [
+        "ifexists",
+        "nofail"
+      ]
    }
  ],
  "context.objects": [
--- a/nixos/modules/services/monitoring/parsedmarc.md
+++ b/nixos/modules/services/monitoring/parsedmarc.md
@ -17,7 +17,6 @@ services.parsedmarc = {
    host = "imap.example.com";
    user = "alice@example.com";
    password = "/path/to/imap_password_file";
-    watch = true;
  };
  provision.geoIp = false; # Not recommended!
 };
--- a/nixos/modules/services/monitoring/parsedmarc.nix
+++ b/nixos/modules/services/monitoring/parsedmarc.nix
@ -123,7 +123,10 @@ in
            host = "imap.example.com";
            user = "alice@example.com";
            password = { _secret = "/run/keys/imap_password" };
+          };
+          mailbox = {
            watch = true;
+            batch_size = 30;
          };
          splunk_hec = {
            url = "https://splunkhec.example.com";
@ -170,6 +173,24 @@ in
            };
          };

+          mailbox = {
+            watch = lib.mkOption {
+              type = lib.types.bool;
+              default = true;
+              description = lib.mdDoc ''
+                Use the IMAP IDLE command to process messages as they arrive.
+              '';
+            };
+
+            delete = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = lib.mdDoc ''
+                Delete messages after processing them, instead of archiving them.
+              '';
+            };
+          };
+
          imap = {
            host = lib.mkOption {
              type = lib.types.str;
@ -216,22 +237,6 @@ in
              '';
              apply = x: if isAttrs x || x == null then x else { _secret = x; };
            };
-
-            watch = lib.mkOption {
-              type = lib.types.bool;
-              default = true;
-              description = lib.mdDoc ''
-                Use the IMAP IDLE command to process messages as they arrive.
-              '';
-            };
-
-            delete = lib.mkOption {
-              type = lib.types.bool;
-              default = false;
-              description = lib.mdDoc ''
-                Delete messages after processing them, instead of archiving them.
-              '';
-            };
          };

          smtp = {
@ -360,6 +365,13 @@ in

  config = lib.mkIf cfg.enable {

+    warnings = let
+      deprecationWarning = optname: "Starting in 8.0.0, the `${optname}` option has been moved from the `services.parsedmarc.settings.imap`"
+        + "configuration section to the `services.parsedmarc.settings.mailbox` configuration section.";
+      hasImapOpt = lib.flip builtins.hasAttr cfg.settings.imap;
+      movedOptions = [ "reports_folder" "archive_folder" "watch" "delete" "test" "batch_size" ];
+    in builtins.map deprecationWarning (builtins.filter hasImapOpt movedOptions);
+
    services.elasticsearch.enable = lib.mkDefault cfg.provision.elasticsearch;

    services.geoipupdate = lib.mkIf cfg.provision.geoIp {
@ -444,6 +456,8 @@ in
          ssl = false;
          user = cfg.provision.localMail.recipientName;
          password = "${pkgs.writeText "imap-password" "@imap-password@"}";
+        };
+        mailbox = {
          watch = true;
        };
      })
--- a/nixos/modules/services/monitoring/parsedmarc.xml
+++ b/nixos/modules/services/monitoring/parsedmarc.xml
@ -15,14 +15,13 @@
      email address and saves them to a local Elasticsearch instance
      looks like this:
    </para>
-    <programlisting language="bash">
+    <programlisting>
 services.parsedmarc = {
  enable = true;
  settings.imap = {
    host = &quot;imap.example.com&quot;;
    user = &quot;alice@example.com&quot;;
    password = &quot;/path/to/imap_password_file&quot;;
-    watch = true;
  };
  provision.geoIp = false; # Not recommended!
 };
@ -45,7 +44,7 @@ services.parsedmarc = {
      email address that should be configured in the domain’s dmarc
      policy is <literal>dmarc@monitoring.example.com</literal>.
    </para>
-    <programlisting language="bash">
+    <programlisting>
 services.parsedmarc = {
  enable = true;
  provision = {
@ -68,7 +67,7 @@ services.parsedmarc = {
      Elasticsearch instance is automatically added as a Grafana
      datasource, and the dashboard is added to Grafana as well.
    </para>
-    <programlisting language="bash">
+    <programlisting>
 services.parsedmarc = {
  enable = true;
  provision = {
--- a/nixos/modules/services/networking/ntp/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@ -147,9 +147,9 @@ in
    systemd.services.systemd-timedated.environment = { SYSTEMD_TIMEDATED_NTP_SERVICES = "chronyd.service"; };

    systemd.tmpfiles.rules = [
-      "d ${stateDir} 0755 chrony chrony - -"
-      "f ${driftFile} 0640 chrony chrony -"
-      "f ${keyFile} 0640 chrony chrony -"
+      "d ${stateDir} 0750 chrony chrony - -"
+      "f ${driftFile} 0640 chrony chrony - -"
+      "f ${keyFile} 0640 chrony chrony - -"
    ];

    systemd.services.chronyd =
@ -164,15 +164,47 @@ in
        path = [ chronyPkg ];

        unitConfig.ConditionCapability = "CAP_SYS_TIME";
-        serviceConfig =
-          { Type = "simple";
-            ExecStart = "${chronyPkg}/bin/chronyd ${builtins.toString chronyFlags}";
-
-            ProtectHome = "yes";
-            ProtectSystem = "full";
-            PrivateTmp = "yes";
-          };
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${chronyPkg}/bin/chronyd ${builtins.toString chronyFlags}";

+          # Proc filesystem
+          ProcSubset = "pid";
+          ProtectProc = "invisible";
+          # Access write directories
+          ReadWritePaths = [ "${stateDir}" ];
+          UMask = "0027";
+          # Capabilities
+          CapabilityBoundingSet = [ "CAP_CHOWN" "CAP_DAC_OVERRIDE" "CAP_NET_BIND_SERVICE" "CAP_SETGID" "CAP_SETUID" "CAP_SYS_RESOURCE" "CAP_SYS_TIME" ];
+          # Device Access
+          DeviceAllow = [ "char-pps rw" "char-ptp rw" "char-rtc rw" ];
+          DevicePolicy = "closed";
+          # Security
+          NoNewPrivileges = true;
+          # Sandboxing
+          ProtectSystem = "full";
+          ProtectHome = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          PrivateUsers = false;
+          ProtectHostname = true;
+          ProtectClock = false;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RemoveIPC = true;
+          PrivateMounts = true;
+          # System Call Filtering
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [ "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @resources" "@clock" "@setuid" "capset" "chown" ];
+        };
      };
  };
 }
--- a/nixos/modules/services/web-apps/snipe-it.nix
+++ b/nixos/modules/services/web-apps/snipe-it.nix
@ -454,8 +454,9 @@ in {

          # A placeholder file for invalid barcodes
          invalid_barcode_location="${cfg.dataDir}/public/uploads/barcodes/invalid_barcode.gif"
-          [ ! -e "$invalid_barcode_location" ] \
-              && cp ${snipe-it}/share/snipe-it/invalid_barcode.gif "$invalid_barcode_location"
+          if [ ! -e "$invalid_barcode_location" ]; then
+              cp ${snipe-it}/share/snipe-it/invalid_barcode.gif "$invalid_barcode_location"
+          fi
        '';
    };

--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -571,7 +571,7 @@ in
        defaultText = literalExpression "pkgs.nginxStable";
        type = types.package;
        apply = p: p.override {
-          modules = p.modules ++ cfg.additionalModules;
+          modules = lib.unique (p.modules ++ cfg.additionalModules);
        };
        description = lib.mdDoc ''
          Nginx package to use. This defaults to the stable version. Note
--- a/nixos/modules/services/x11/desktop-managers/plasma5.nix
+++ b/nixos/modules/services/x11/desktop-managers/plasma5.nix
@ -32,7 +32,7 @@ let
  inherit (lib)
    getBin optionalString literalExpression
    mkRemovedOptionModule mkRenamedOptionModule
-    mkDefault mkIf mkMerge mkOption types;
+    mkDefault mkIf mkMerge mkOption mkPackageOption types;

  ini = pkgs.formats.ini { };

@ -198,6 +198,11 @@ in
      example = literalExpression "[ pkgs.plasma5Packages.oxygen ]";
    };

+    notoPackage = mkPackageOption pkgs "Noto fonts" {
+      default = [ "noto-fonts" ];
+      example = "noto-fonts-lgc-plus";
+    };
+
    # Internally allows configuring kdeglobals globally
    kdeglobals = mkOption {
      internal = true;
@ -401,7 +406,7 @@ in
      # Enable GTK applications to load SVG icons
      services.xserver.gdk-pixbuf.modulePackages = [ pkgs.librsvg ];

-      fonts.fonts = with pkgs; [ noto-fonts hack-font ];
+      fonts.fonts = with pkgs; [ cfg.notoPackage hack-font ];
      fonts.fontconfig.defaultFonts = {
        monospace = [ "Hack" "Noto Sans Mono" ];
        sansSerif = [ "Noto Sans" ];
@ -545,7 +550,7 @@ in
        }
        {
          # The user interface breaks without pulse
-          assertion = config.hardware.pulseaudio.enable;
+          assertion = config.hardware.pulseaudio.enable || (config.services.pipewire.enable && config.services.pipewire.pulse.enable);
          message = "Plasma Mobile requires pulseaudio.";
        }
      ];
--- a/nixos/modules/services/x11/window-managers/i3.nix
+++ b/nixos/modules/services/x11/window-managers/i3.nix
@ -31,7 +31,6 @@ in
      type        = types.package;
      default     = pkgs.i3;
      defaultText = literalExpression "pkgs.i3";
-      example     = literalExpression "pkgs.i3-gaps";
      description = lib.mdDoc ''
        i3 package to use.
      '';
@ -73,6 +72,6 @@ in

  imports = [
    (mkRemovedOptionModule [ "services" "xserver" "windowManager" "i3-gaps" "enable" ]
-      "Use services.xserver.windowManager.i3.enable and set services.xserver.windowManager.i3.package to pkgs.i3-gaps to use i3-gaps.")
+      "i3-gaps was merged into i3. Use services.xserver.windowManager.i3.enable instead.")
  ];
 }
--- a/nixos/modules/virtualisation/waydroid.nix
+++ b/nixos/modules/virtualisation/waydroid.nix
@ -56,12 +56,8 @@ in

      wantedBy = [ "multi-user.target" ];

-      unitConfig = {
-        ConditionPathExists = "/var/lib/waydroid/lxc/waydroid";
-      };
-
      serviceConfig = {
-        ExecStart = "${pkgs.waydroid}/bin/waydroid container start";
+        ExecStart = "${pkgs.waydroid}/bin/waydroid -w container start";
        ExecStop = "${pkgs.waydroid}/bin/waydroid container stop";
        ExecStopPost = "${pkgs.waydroid}/bin/waydroid session stop";
      };
--- a/nixos/tests/parsedmarc/default.nix
+++ b/nixos/tests/parsedmarc/default.nix
@ -155,7 +155,6 @@ in
                  ssl = true;
                  user = "alice";
                  password = "${pkgs.writeText "imap-password" "foobar"}";
-                  watch = true;
                };
              };

--- a/pkgs/applications/audio/ocenaudio/default.nix
+++ b/pkgs/applications/audio/ocenaudio/default.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "ocenaudio";
-  version = "3.11.20";
+  version = "3.11.21";

  src = fetchurl {
    url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian9_64.deb?version=${version}";
-    sha256 = "sha256-ifzth9qd2YX9WeF6QeXSWkMqRyTGBxPyTm5tkanPiFQ=";
+    sha256 = "sha256-nItqx3g4W3s1phHe6F8EtOL4nwJQ0XnKB8Ujg71/Q3Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/rosegarden/default.nix
+++ b/pkgs/applications/audio/rosegarden/default.nix
@ -23,11 +23,11 @@

 stdenv.mkDerivation rec {
  pname = "rosegarden";
-  version = "20.12";
+  version = "22.12.1";

  src = fetchurl {
    url = "mirror://sourceforge/rosegarden/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-iGaEr8WFipV4I00fhFGI2xMBFPf784IIxNXs2hUTHFs=";
+    sha256 = "sha256-fqeif37lxJeBcI+cYVpRkZuJImSlmeZO3yzSNzPZkgY=";
  };

  postPhase = ''
--- a/pkgs/applications/audio/spek/default.nix
+++ b/pkgs/applications/audio/spek/default.nix
@ -1,22 +1,19 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK30, gtk3, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, intltool, pkg-config, ffmpeg, wxGTK32, gtk3, wrapGAppsHook }:

 stdenv.mkDerivation rec {
  pname = "spek";
-  version = "unstable-2018-12-29";
+  version = "0.8.4";

  src = fetchFromGitHub {
    owner = "alexkay";
    repo = "spek";
-    rev = "f071c2956176ad53c7c8059e5c00e694ded31ded";
-    sha256 = "1l9gj9c1n92zlcjnyjyk211h83dk0idk644xnm5rs7q40p2zliy5";
+    rev = "v${version}";
+    sha256 = "sha256-JLQx5LlnVe1TT1KVO3/QSVRqYL+pAMCxoDWrnkUNmRU=";
  };

-  # needed for autoreconfHook
-  AUTOPOINT="intltoolize --automake --copy";
-
  nativeBuildInputs = [ autoreconfHook intltool pkg-config wrapGAppsHook ];

-  buildInputs = [ ffmpeg wxGTK30 gtk3 ];
+  buildInputs = [ ffmpeg wxGTK32 gtk3 ];

  meta = with lib; {
    description = "Analyse your audio files by showing their spectrogram";
--- a/pkgs/applications/audio/spotifyd/default.nix
+++ b/pkgs/applications/audio/spotifyd/default.nix
@ -9,16 +9,16 @@

 rustPackages.rustPlatform.buildRustPackage rec {
  pname = "spotifyd";
-  version = "0.3.3";
+  version = "0.3.4";

  src = fetchFromGitHub {
    owner = "Spotifyd";
    repo = "spotifyd";
    rev = "v${version}";
-    sha256 = "1liql2wp7cx0x4ha1578wx3m4byd295m4ph268s05yw2wrnr3v6c";
+    sha256 = "sha256-9zwHBDrdvE2R/cdrWgjsfHlm3wEZ9SB2VNcqezB/Op0=";
  };

-  cargoSha256 = "1plvqd55d1gj0ydimv3154pwgj2sh1fqx2182nw8akzdfmzg1150";
+  cargoSha256 = "sha256-fQm7imXpm5AcKdg0cU/Rf2mAeg2ebZKRisJZSnG0REI=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/blockchains/ledger-live-desktop/default.nix
+++ b/pkgs/applications/blockchains/ledger-live-desktop/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchurl, appimageTools, imagemagick, systemd }:
+{ lib, fetchurl, appimageTools, imagemagick }:

 let
  pname = "ledger-live-desktop";
--- a/pkgs/applications/emulators/melonDS/default.nix
+++ b/pkgs/applications/emulators/melonDS/default.nix
@ -1,34 +1,44 @@
 { lib
 , fetchFromGitHub
-, mkDerivation
+, stdenv
 , cmake
-, libepoxy
+, extra-cmake-modules
 , libarchive
 , libpcap
 , libslirp
 , pkg-config
 , qtbase
+, qtmultimedia
 , SDL2
+, wayland
+, wrapQtAppsHook
 }:

-mkDerivation rec {
+stdenv.mkDerivation rec {
  pname = "melonDS";
-  version = "0.9.4";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "Arisotura";
    repo = pname;
    rev = version;
-    sha256 = "sha256-FSacau7DixU6R4eKNIYVRZiMb/GhijTzHbcGlZ6WG/I=";
+    sha256 = "sha256-n4Vkxb/7fr214PgB6VFNgH1tMDgTBS/UHUQ6V4uGkDA=";
  };

-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    pkg-config
+    wrapQtAppsHook
+  ];
+
  buildInputs = [
-    libepoxy
    libarchive
    libslirp
    qtbase
+    qtmultimedia
    SDL2
+    wayland
  ];

  qtWrapperArgs = [ "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libpcap ]}" ];
--- a/pkgs/applications/emulators/wibo/default.nix
+++ b/pkgs/applications/emulators/wibo/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "wibo";
-  version = "0.2.4";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "decompals";
    repo = "wibo";
    rev = version;
-    hash = "sha256-dpfKSiIWE9L5BLPH2t8RsUz7Ufkdo/5zn1dewaEgJl0=";
+    hash = "sha256-J5h/RpF+twb5fBjSDQMVB5SoTWWs8VD/EUuikuj73YA=";
  };

  nativeBuildInputs = [
@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
      meta.license = lib.licenses.unfree;
    };
  in lib.optionalString doCheck ''
-    MWCIncludes=. ./wibo ${gc}/GC/2.7/mwcceppc.exe -c ../test/test.c
+    MWCIncludes=../test ./wibo ${gc}/GC/2.7/mwcceppc.exe -c ../test/test.c
    file test.o | grep "ELF 32-bit"
  '';

--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@ -28,11 +28,12 @@
 , qtkeychain
 , qt3d
 , qscintilla
+, qtlocation
 , qtserialport
 , qtxmlpatterns
 , withGrass ? true
 , grass
-, withWebKit ? true
+, withWebKit ? false
 , qtwebkit
 , pdal
 , zstd
@ -109,6 +110,7 @@ in mkDerivation rec {
    qca-qt5
    qtkeychain
    qscintilla
+    qtlocation
    qtserialport
    qtxmlpatterns
    qt3d
@ -132,7 +134,11 @@ in mkDerivation rec {
    "-DWITH_3D=True"
    "-DWITH_PDAL=TRUE"
  ] ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
-    ++ lib.optional withGrass "-DGRASS_PREFIX7=${grass}/grass78";
+    ++ lib.optional withGrass (let
+        gmajor = lib.versions.major grass.version;
+        gminor = lib.versions.minor grass.version;
+      in "-DGRASS_PREFIX${gmajor}=${grass}/grass${gmajor}${gminor}"
+    );

  dontWrapGApps = true; # wrapper params passed below

--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@ -28,11 +28,12 @@
 , qtkeychain
 , qt3d
 , qscintilla
+, qtlocation
 , qtserialport
 , qtxmlpatterns
 , withGrass ? true
 , grass
-, withWebKit ? true
+, withWebKit ? false
 , qtwebkit
 , pdal
 , zstd
@ -109,6 +110,7 @@ in mkDerivation rec {
    qca-qt5
    qtkeychain
    qscintilla
+    qtlocation
    qtserialport
    qtxmlpatterns
    qt3d
@ -132,7 +134,11 @@ in mkDerivation rec {
    "-DWITH_3D=True"
    "-DWITH_PDAL=TRUE"
  ] ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
-    ++ lib.optional withGrass "-DGRASS_PREFIX7=${grass}/grass78";
+    ++ lib.optional withGrass (let
+        gmajor = lib.versions.major grass.version;
+        gminor = lib.versions.minor grass.version;
+      in "-DGRASS_PREFIX${gmajor}=${grass}/grass${gmajor}${gminor}"
+    );

  dontWrapGApps = true; # wrapper params passed below

--- a/pkgs/applications/gis/saga/default.nix
+++ b/pkgs/applications/gis/saga/default.nix
@ -31,11 +31,11 @@

 mkDerivation rec {
  pname = "saga";
-  version = "8.4.0";
+  version = "8.5.0";

  src = fetchurl {
    url = "mirror://sourceforge/saga-gis/SAGA%20-%20${lib.versions.major version}/SAGA%20-%20${version}/saga-${version}.tar.gz";
-    sha256 = "sha256-v6DPwV20fcsznrEaFJk0/ewU4z3cTjzYYuLkyMwSLV0=";
+    sha256 = "sha256-JzSuu1wGfCkxIDcTbP5jpHtJNvl8eAP3jznXvwSPeY0=";
  };

  sourceRoot = "saga-${version}/saga-gis";
--- a/pkgs/applications/graphics/eyedropper/default.nix
+++ b/pkgs/applications/graphics/eyedropper/default.nix
@ -15,19 +15,19 @@

 stdenv.mkDerivation rec {
  pname = "eyedropper";
-  version = "0.4.0";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "FineFindus";
    repo = pname;
-    rev = version;
-    hash = "sha256-bOpwHaFOoUlh+yyC1go6BeFxfJhUmwZPi6kYAqCagEI=";
+    rev = "v${version}";
+    hash = "sha256-sDrMIryVFkjMGHbYvNDmKb1HyJNGb3Hd+muxUJKhogE=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-TkdOq+icU2zNbXzN6nbkXjL1o/Lfumqr/5S0pQaxY5Q=";
+    hash = "sha256-mztc44hHdqzR3WbG6tkCL38EfgBajRLlpMC8ElpXnlo=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/grip/default.nix
+++ b/pkgs/applications/misc/grip/default.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "grip";
-  version = "4.2.3";
+  version = "4.2.4";

  src = fetchurl {
    url = "mirror://sourceforge/grip/grip-${version}.tar.gz";
-    sha256 = "sha256-5Qgsf4+xs0ckhYJk2csKulXC3nWaLRAsQ15qaTkKkjw=";
+    sha256 = "sha256-lXu0mLLfcX8K1EmoFH0vp2cHluyRwhTL0/bW5Ax36mI=";
  };

  nativeBuildInputs = [ pkg-config libtool ];
--- a/pkgs/applications/misc/librecad/default.nix
+++ b/pkgs/applications/misc/librecad/default.nix
@ -1,7 +1,6 @@
 { lib
 , boost
 , fetchFromGitHub
-, fetchpatch
 , installShellFiles
 , mkDerivation
 , muparser
@ -15,38 +14,42 @@

 mkDerivation rec {
  pname = "librecad";
-  version = "2.2.0-rc2";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "LibreCAD";
    repo = "LibreCAD";
    rev = version;
-    sha256 = "sha256-RNg7ioMriH4A7V65+4mh8NhsUHs/8IbTt38nVkYilCE=";
+    sha256 = "sha256-horKTegmvcMg4m5NbZ4nzy4J6Ac/6+E5OkiZl0v6TBc=";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://github.com/LibreCAD/LibreCAD/pull/1465/commits/4edcbe72679f95cb60979c77a348c1522a20b0f4.patch";
-      sha256 = "sha256-P0G2O5sL7Ip860ByxFQ87TfV/lq06wCQnzPxADGqFPs=";
-      name = "CVE-2021-45342.patch";
-    })
+  buildInputs = [
+    boost
+    muparser
+    qtbase
+    qtsvg
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+    pkg-config
+    qmake
+    qttools
+  ];
+
+  qmakeFlags = [
+    "MUPARSER_DIR=${muparser}"
+    "BOOST_DIR=${boost.dev}"
  ];

  postPatch = ''
    substituteInPlace scripts/postprocess-unix.sh \
      --replace /bin/sh ${runtimeShell}

-    substituteInPlace librecad/src/lib/engine/rs_system.cpp \
-      --replace /usr/share $out/share
-
    substituteInPlace librecad/src/main/qc_applicationwindow.cpp \
      --replace __DATE__ 0
  '';

-  qmakeFlags = [
-    "MUPARSER_DIR=${muparser}"
-    "BOOST_DIR=${boost.dev}"
-  ];

  installPhase = ''
    runHook preInstall
@ -65,20 +68,6 @@ mkDerivation rec {
    runHook postInstall
  '';

-  buildInputs = [
-    boost
-    muparser
-    qtbase
-    qtsvg
-  ];
-
-  nativeBuildInputs = [
-    installShellFiles
-    pkg-config
-    qmake
-    qttools
-  ];
-
  meta = with lib; {
    description = "2D CAD package based on Qt";
    homepage = "https://librecad.org";
--- a/pkgs/applications/misc/termpdf.py/default.nix
+++ b/pkgs/applications/misc/termpdf.py/default.nix
@ -1,26 +1,15 @@
-{ lib
-, buildPythonApplication
-, fetchFromGitHub
-, bibtool
-, pybtex
-, pymupdf
-, pynvim
-, pyperclip
-, roman
-, pdfrw
-, pagelabels
-, setuptools
-}:
+{ lib, buildPythonApplication, fetchFromGitHub, bibtool, pybtex, pymupdf, pynvim
+, pyperclip, roman, pdfrw, pagelabels, setuptools }:

 buildPythonApplication {
  pname = "termpdf.py";
-  version = "2019-10-03";
+  version = "2022-03-28";

  src = fetchFromGitHub {
    owner = "dsanson";
    repo = "termpdf.py";
-    rev = "4f3bdf4b5a00801631f2498f2c38c81e0a588ae2";
-    sha256 = "05gbj2fqzqndq1mx6g9asa7i6z8a9jdjrvilfwx8lg23cs356m6m";
+    rev = "e7bd0824cb7d340b8dba7d862e696dba9cb5e5e2";
+    sha256 = "HLQZBaDoZFVBs4JfJcwhrLx8pxdEI56/iTpUjT5pBhk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -90,11 +90,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.46.133";
+  version = "1.46.144";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-362XVFFsVWR/H0mcn1XQh3tsemksEnqR5quOIwf2QQE=";
+    sha256 = "sha256-RivuyMPrqBXeTENrH4wApqHglPAZHVXMd863Wlh+EHY=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -19,9 +19,9 @@
    }
  },
  "beta": {
-    "version": "109.0.5414.46",
-    "sha256": "17wzll9024c80fhgxi33ix1rpmqh9sbpx6qvw9cvhdlmhn0b5017",
-    "sha256bin64": "199n8a7pjnhbgkm2dwh9hq7pzf39x932bh6b056jqp032d5c00ns",
+    "version": "109.0.5414.61",
+    "sha256": "1dk832ishjhba0rnf57w7vqrr8dyqga6zsgw9945i7zz997fpjyi",
+    "sha256bin64": "1s1d7h9ygzpa5b39pdivn5vvpm7fpnhw5p3lz8blrgn61m8h6jg6",
    "deps": {
      "gn": {
        "version": "2022-11-10",
--- a/pkgs/applications/networking/cluster/crc/default.nix
+++ b/pkgs/applications/networking/cluster/crc/default.nix
@ -10,20 +10,22 @@
 }:

 let
-  openShiftVersion = "4.10.22";
-  podmanVersion = "4.1.0";
+  openShiftVersion = "4.11.13";
+  okdVersion = "4.11.0-0.okd-2022-11-05-030711";
+  podmanVersion = "4.2.0";
  writeKey = "cvpHsNcmGCJqVzf6YxrSnVlwFSAZaYtp";
 in
 buildGoModule rec {
-  version = "2.6.0";
+  version = "2.11.0";
  pname = "crc";
-  gitCommit = "6b954d40ec3280ca63e825805503d4414a3ff55b";
+  gitCommit = "a5f90a25abcacd4aa334490f0d204329abeaa691";
+  modRoot = "cmd/crc";

  src = fetchFromGitHub {
-    owner = "code-ready";
+    owner = "crc-org";
    repo = "crc";
    rev = "v${version}";
-    sha256 = "sha256-4EaonL+7/zPEbuM12jQFx8wLR62iLYZ3LkHAibdGQZc=";
+    sha256 = "sha256-0e62mQ01pt0kClrEx4ss2T8BN1+0aQiCFPyDg5agbTU";
  };

  vendorSha256 = null;
@ -41,21 +43,18 @@ buildGoModule rec {
  tags = [ "containers_image_openpgp" ];

  ldflags = [
-    "-X github.com/code-ready/crc/pkg/crc/version.crcVersion=${version}"
-    "-X github.com/code-ready/crc/pkg/crc/version.bundleVersion=${openShiftVersion}"
-    "-X github.com/code-ready/crc/pkg/crc/version.podmanVersion=${podmanVersion}"
-    "-X github.com/code-ready/crc/pkg/crc/version.commitSha=${gitCommit}"
-    "-X github.com/code-ready/crc/pkg/crc/segment.WriteKey=${writeKey}"
+    "-X github.com/crc-org/crc/pkg/crc/version.crcVersion=${version}"
+    "-X github.com/crc-org/crc/pkg/crc/version.ocpVersion=${openShiftVersion}"
+    "-X github.com/crc-org/crc/pkg/crc/version.okdVersion=${okdVersion}"
+    "-X github.com/crc-org/crc/pkg/crc/version.podmanVersion=${podmanVersion}"
+    "-X github.com/crc-org/crc/pkg/crc/version.commitSha=${builtins.substring 0 8 gitCommit}"
+    "-X github.com/crc-org/crc/pkg/crc/segment.WriteKey=${writeKey}"
  ];

  preBuild = ''
    export HOME=$(mktemp -d)
  '';

-  # tests are currently broken on aarch64-darwin
-  # https://github.com/code-ready/crc/issues/3237
-  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
-  checkFlags = [ "-args --crc-binary=$out/bin/crc" ];

  passthru.tests.version = testers.testVersion {
    package = crc;
--- a/pkgs/applications/networking/cluster/crc/update.sh
+++ b/pkgs/applications/networking/cluster/crc/update.sh
@ -14,7 +14,7 @@ cd ${NIXPKGS_CRC_FOLDER}

 LATEST_TAG_RAWFILE=${WORKDIR}/latest_tag.json
 curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
-    https://api.github.com/repos/code-ready/crc/releases >${LATEST_TAG_RAWFILE}
+    https://api.github.com/repos/crc-org/crc/releases  >${LATEST_TAG_RAWFILE}

 LATEST_TAG_NAME=$(jq 'map(.tag_name)' ${LATEST_TAG_RAWFILE} |
    grep -v -e rc -e engine | tail -n +2 | head -n -1 | sed 's|[", ]||g' | sort -rV | head -n1)
@ -22,15 +22,18 @@ LATEST_TAG_NAME=$(jq 'map(.tag_name)' ${LATEST_TAG_RAWFILE} |
 CRC_VERSION=$(echo ${LATEST_TAG_NAME} | sed 's/^v//')

 CRC_COMMIT=$(curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
-    https://api.github.com/repos/code-ready/crc/tags |
+    https://api.github.com/repos/crc-org/crc/tags |
    jq -r "map(select(.name == \"${LATEST_TAG_NAME}\")) | .[0] | .commit.sha")

 FILE_MAKEFILE=${WORKDIR}/Makefile
-curl --silent https://raw.githubusercontent.com/code-ready/crc/${CRC_COMMIT}/Makefile >$FILE_MAKEFILE
+curl --silent https://raw.githubusercontent.com/crc-org/crc/${CRC_COMMIT}/Makefile >$FILE_MAKEFILE

 OPENSHIFT_VERSION=$(grep 'OPENSHIFT_VERSION' ${FILE_MAKEFILE} |
    head -n1 | awk '{print $3}')

+OKD_VERSION=$(grep 'OKD_VERSION' ${FILE_MAKEFILE} |
+    head -n1 | awk '{print $3}')
+
 PODMAN_VERSION=$(grep 'PODMAN_VERSION' ${FILE_MAKEFILE} |
    head -n1 | awk '{print $3}')

@ -46,6 +49,9 @@ sed -i "s|gitCommit = \".*\"|gitCommit = \"${CRC_COMMIT:-}\"|" \
 sed -i "s|openShiftVersion = \".*\"|openShiftVersion = \"${OPENSHIFT_VERSION:-}\"|" \
    ${NIXPKGS_CRC_FOLDER}/default.nix

+sed -i "s|okdVersion = \".*\"|okdVersion = \"${OKD_VERSION:-}\"|" \
+    ${NIXPKGS_CRC_FOLDER}/default.nix
+
 sed -i "s|podmanVersion = \".*\"|podmanVersion = \"${PODMAN_VERSION:-}\"|" \
    ${NIXPKGS_CRC_FOLDER}/default.nix

--- a/pkgs/applications/networking/cluster/karmor/default.nix
+++ b/pkgs/applications/networking/cluster/karmor/default.nix
@ -0,0 +1,36 @@
+{ buildGoModule, fetchFromGitHub, installShellFiles, lib }:
+
+buildGoModule rec {
+  pname = "karmor";
+  version = "0.11.1";
+
+  src = fetchFromGitHub {
+    owner = "kubearmor";
+    repo = "kubearmor-client";
+    rev = "v${version}";
+    hash = "sha256-s1G5ZcXtjL9TxYpEUvnqiQXaY7OFUwCDXFongRM48Xk=";
+  };
+
+  vendorHash = "sha256-VvjcGiBxK2OVvIEc/ScwUT6zJZTccnXu/JfXKXc5WNY=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  # integration tests require network access
+  doCheck = false;
+
+  postInstall = ''
+    mv $out/bin/{kubearmor-client,karmor}
+    installShellCompletion --cmd karmor \
+      --bash <($out/bin/karmor completion bash) \
+      --fish <($out/bin/karmor completion fish) \
+      --zsh  <($out/bin/karmor completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "A client tool to help manage KubeArmor";
+    homepage = "https://kubearmor.io";
+    changelog = "https://github.com/kubearmor/kubearmor-client/releases/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ urandom ];
+  };
+}
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -48,11 +48,11 @@
    "vendorHash": "sha256-pz+h8vbdCEgNSH9AoPlIP7zprViAMawXk64SV0wnVPo="
  },
  "alicloud": {
-    "hash": "sha256-m5IZ6JiEbyAuNo2LiuuP05yApvoHypjFnGioWJ/4ETQ=",
+    "hash": "sha256-Ym3ZN4bRcLXyjnSvWxq/RNvjkfGdpyfkp4sH1D/Ll28=",
    "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
    "owner": "aliyun",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.194.1",
+    "rev": "v1.195.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -167,13 +167,13 @@
    "vendorHash": null
  },
  "bitbucket": {
-    "hash": "sha256-rE9kEMC/b3J5YjF94HBqUhorjcsMAx40jnxgsShNNUc=",
+    "hash": "sha256-xDUL9W6lQGMZPQBe4eghW9JcQeTUgm+3ND6erikVFMM=",
    "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
    "owner": "DrFaust92",
    "repo": "terraform-provider-bitbucket",
-    "rev": "v2.27.0",
+    "rev": "v2.29.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-8/ZEO0cxseXqQHx+/wKjsM0T3l+tBdCTFZqNfjaTOpo="
+    "vendorHash": "sha256-foMmZbNPLww1MN4UZwuynBDgt2w40aMqVINRw//Q0d0="
  },
  "brightbox": {
    "hash": "sha256-ISK6cpE4DVrVzjC0N5BdyR3Z5LfF9qfg/ACTgDP+WqY=",
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -5,7 +5,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.5.13";
+  version = "3.5.16";
  format = "pyproject";

  # Fetch from GitHub in order to use `requirements.in`
@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
    owner = "flexget";
    repo = "flexget";
    rev = "refs/tags/v${version}";
-    hash = "sha256-0yO4prnYJkD7eiyrEOPHlDTsgGgRhQujsp8k2FsLYKI=";
+    hash = "sha256-9hcl7OZLi86hZHLotsN1QlPzQ1Ep5vJumAyZxSxxIE8=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20221208";
+  version = "20221227-1";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    sha256 = "sha256-GSZy2zW9Ek9nP9zoBfvq3wLghEsaGqmC1f4cs+OVaFE=";
+    sha256 = "sha256-yOOKgB7MO9LW6qkr/JZOYtteQTW/Yms4CMAg4EIJGc8=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/libcoap/default.nix
+++ b/pkgs/applications/networking/libcoap/default.nix
@ -4,13 +4,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "libcoap";
-  version = "4.3.0";
+  version = "4.3.1";
  src = fetchFromGitHub {
    repo = "libcoap";
    owner = "obgm";
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "1l031ys833gch600g9g3lvbsr4nysx6glbbj4lwvx3ywl0jr6l9k";
+    sha256 = "sha256-4XcAo5StyYIfe9wD0cPHKFZalMcBAuiVV2qFZ126KT8=";
  };
  nativeBuildInputs = [
    automake
--- a/pkgs/applications/networking/msmtp/default.nix
+++ b/pkgs/applications/networking/msmtp/default.nix
@ -128,4 +128,5 @@ symlinkJoin {
  name = "msmtp-${version}";
  inherit version meta;
  paths = [ binaries scripts ];
+  passthru = { inherit binaries scripts; };
 }
--- a/pkgs/applications/networking/netmaker/default.nix
+++ b/pkgs/applications/networking/netmaker/default.nix
@ -0,0 +1,39 @@
+{ buildGoModule, fetchFromGitHub, installShellFiles, lib, libglvnd, pkg-config, xorg }:
+
+buildGoModule rec {
+  pname = "netmaker";
+  version = "0.17.1";
+
+  src = fetchFromGitHub {
+    owner = "gravitl";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-8uxPPhy1/FqPGouqzUxY2lGnO/giqH9bJbAqQ9rZI0g=";
+  };
+
+  vendorHash = "sha256-4LaGwwDu3pKd6I6r/F3isCi9CuFqPGvc5SdVTV34qOI=";
+
+  subPackages = [
+    "."
+    "netclient"
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    libglvnd
+    xorg.libX11
+    xorg.libXcursor
+    xorg.libXi
+    xorg.libXinerama
+    xorg.libXrandr
+  ];
+
+  meta = with lib; {
+    description = "WireGuard automation from homelab to enterprise";
+    homepage = "https://netmaker.io";
+    changelog = "https://github.com/gravitl/netmaker/-/releases/v${version}";
+    license = licenses.sspl;
+    maintainers = with maintainers; [ urandom ];
+  };
+}
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "protonmail-bridge";
-  version = "2.1.3";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "ProtonMail";
    repo = "proton-bridge";
    rev = "br-${version}";
-    sha256 = "sha256-+XeNhjwtH1T5p8iydMQk22nXztyamSn6yY56/qqvkmk=";
+    sha256 = "sha256-7p+Q6/BphE/dxNQe+gfcIty6TAWHUcPpvSJWfmf4OQg=";
  };

-  vendorSha256 = "sha256-YTGjiteYfuRkDC4M9c/JKqURq4WiC5n9pFRqRVYhyxU=";
+  vendorSha256 = "sha256-dhrn6xQ0IJzBYeO6ko2PUCO+idopC2An0ylqCnx5jKg=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -4,16 +4,16 @@ let
  common = { stname, target, postInstall ? "" }:
    buildGoModule rec {
      pname = stname;
-      version = "1.22.2";
+      version = "1.23.0";

      src = fetchFromGitHub {
        owner = "syncthing";
        repo = "syncthing";
        rev = "v${version}";
-        hash = "sha256-t1JIkUjSEshSm3Zi5Ck8IOmTv2tC0dUYyJvlKua/BcI=";
+        hash = "sha256-Z4YVU45na4BgIbN/IlORpTCuf2EuSuOyppDRzswn3EI=";
      };

-      vendorSha256 = "sha256-UdzWD8I8ulPBXdF5wZQ7hQoVO9Bnj18Gw5t4wqolSPA=";
+      vendorHash = "sha256-q63iaRxJRvPY0Np20O6JmdMEjSg/kxRneBfs8fRTwXk=";

      doCheck = false;

--- a/pkgs/applications/office/ledger/default.nix
+++ b/pkgs/applications/office/ledger/default.nix
@ -41,6 +41,13 @@ stdenv.mkDerivation rec {
      sha256 = "sha256-vwVQnY9EUCXPzhDJ4PSOmQStb9eF6H0yAOiEmL6sAlk=";
      excludes = [ "doc/NEWS.md" ];
    })
+
+    # Fix included bug with boost >= 1.76. Remove with the next release
+    (fetchpatch {
+      url = "https://github.com/ledger/ledger/commit/1cb9b84fdecc5604bd1172cdd781859ff3871a52.patch";
+      sha256 = "sha256-ipVkRcTmnEvpfyPgMzLVJ9Sz8QxHeCURQI5dX8xh758=";
+      excludes = [ "test/regress/*" ];
+    })
  ];

  installTargets = [ "doc" "install" ];
--- a/pkgs/applications/science/biology/igv/default.nix
+++ b/pkgs/applications/science/biology/igv/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "igv";
-  version = "2.15.1";
+  version = "2.15.4";
  src = fetchzip {
    url = "https://data.broadinstitute.org/igv/projects/downloads/${lib.versions.majorMinor version}/IGV_${version}.zip";
-    sha256 = "sha256-hwZ6Pl6BxoVbJI5e3b0s7jhQ/AADhVJVqM9Q8ppERuk=";
+    sha256 = "sha256-nDD0QTtLDe//VFMsIPKIykZ6dY85p3aomrCaF1p9HQM=";
  };

  installPhase = ''
--- a/pkgs/applications/science/electronics/dataexplorer/default.nix
+++ b/pkgs/applications/science/electronics/dataexplorer/default.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "dataexplorer";
-  version = "3.7.3";
+  version = "3.7.4";

  src = fetchurl {
    url = "mirror://savannah/dataexplorer/dataexplorer-${version}-src.tar.gz";
-    sha256 = "sha256-cqvlPV4i9m0x3hbruC5y2APsyjfI5y9RT8XVzsDaT/Q=";
+    sha256 = "sha256-bghI7Hun7ZKUVEj7T58K0oaclnhUGd4z+eIqZF3eXHQ=";
  };

  nativeBuildInputs = [ ant makeWrapper ];
--- a/pkgs/applications/version-management/deepgit/default.nix
+++ b/pkgs/applications/version-management/deepgit/default.nix
@ -0,0 +1,86 @@
+{ copyDesktopItems
+, fetchurl
+, glib
+, gnome
+, gtk3
+, jre
+, lib
+, makeDesktopItem
+, stdenv
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "deepgit";
+  version = "4.3";
+
+  src = fetchurl {
+    url = "https://www.syntevo.com/downloads/deepgit/deepgit-linux-${lib.replaceStrings [ "." ] [ "_" ] version}.tar.gz";
+    hash = "sha256-bA/EySZjuSDYaZplwHcpeP1VakcnG5K1hYTk7cSVbz0=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gnome.adwaita-icon-theme
+    gtk3
+    jre
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ glib gtk3 ]}
+      --set DEEPGIT_JAVA_HOME ${jre}
+    )
+    patchShebangs bin/deepgit.sh
+  '';
+
+  desktopItems = [(makeDesktopItem rec {
+    name = pname;
+    desktopName = "DeepGit";
+    keywords = [ "git" ];
+    comment = "Git-Client";
+    categories = [
+      "Development"
+      "RevisionControl"
+    ];
+    terminal = false;
+    startupNotify = true;
+    startupWMClass = desktopName;
+    exec = pname;
+    mimeTypes = [
+      "x-scheme-handler/${pname}"
+      "x-scheme-handler/sourcetree"
+    ];
+    icon = pname;
+  })];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -pv $out/{bin,share/icons/hicolor/scalable/apps/}
+    cp -a lib license.html $out
+    mv bin/deepgit.sh $out/bin/deepgit
+
+    for icon_size in 32 48 64 128 256; do
+      path=$icon_size'x'$icon_size
+      icon=bin/deepgit-$icon_size.png
+      mkdir -p $out/share/icons/hicolor/$path/apps
+      cp $icon $out/share/icons/hicolor/$path/apps/deepgit.png
+    done
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A tool to investigate the history of source code";
+    homepage = "https://www.syntevo.com/deepgit";
+    changelog = "https://www.syntevo.com/deepgit/changelog.txt";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ urandom ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/version-management/gh/default.nix
+++ b/pkgs/applications/version-management/gh/default.nix
@ -1,17 +1,17 @@
-{ lib, fetchFromGitHub, buildGoModule, installShellFiles }:
+{ lib, fetchFromGitHub, buildGoModule, installShellFiles, testers, gh }:

 buildGoModule rec {
  pname = "gh";
-  version = "2.21.1";
+  version = "2.21.2";

  src = fetchFromGitHub {
    owner = "cli";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-DVdbyHGBnbFkKu0h01i0d1qw5OuBYydyP7qHc6B1qs0=";
+    sha256 = "sha256-syd7OMBEMv9uJUDjIIqVkJ3pvuyKnD5pubG4d3TbkY8=";
  };

-  vendorSha256 = "sha256-b4pNcOfG+W+l2cqn4ncvR47zJltKYIcE3W1GvrWEOFY=";
+  vendorSha256 = "sha256-m9K43Ns8j82nMkz+zkmC7HueOA6q6T4mFPQ1GSdqo24=";

  nativeBuildInputs = [ installShellFiles ];

@ -42,6 +42,10 @@ buildGoModule rec {
  # most tests require network access
  doCheck = false;

+  passthru.tests.version = testers.testVersion {
+    package = gh;
+  };
+
  meta = with lib; {
    description = "GitHub CLI tool";
    homepage = "https://cli.github.com/";
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mkvtoolnix";
-  version = "71.1.0";
+  version = "72.0.0";

  src = fetchFromGitLab {
    owner = "mbunkus";
    repo = "mkvtoolnix";
    rev = "release-${version}";
-    sha256 = "sha256-JHbnjcXOctB6HQeHXykWbykdn35S2fCYegMkc3GLmAI=";
+    sha256 = "sha256-3XKvcV6vwXrn2mf8ziclKgEPOwn3IPyLYy6+d0DscHs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -8,7 +8,7 @@
 , ninja
 , pkg-config
 , python3
-, ffmpeg
+, ffmpeg_5
 , freefont_ttf
 , freetype
 , libass
@ -129,7 +129,7 @@ in stdenv.mkDerivation rec {
  ++ lib.optionals waylandSupport [ wayland-scanner ];

  buildInputs = [
-    ffmpeg
+    ffmpeg_5
    freetype
    libass
    libpthreadstubs
--- a/pkgs/applications/virtualization/nixpacks/default.nix
+++ b/pkgs/applications/virtualization/nixpacks/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "nixpacks";
-  version = "0.16.0";
+  version = "1.0.3";

  src = fetchFromGitHub {
    owner = "railwayapp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-p9kKTNtZoWl2rZyL1cD7fK9+IwDtBCfdRzWjKQmje5M=";
+    sha256 = "sha256-0Q0G2vUIkKRTSbQQrXoInzaPfFNWwT/NQ1/NKQeVpHU=";
  };

-  cargoSha256 = "sha256-UWefCe5DLaxUFNbQV0XNyqNI1dx9HPHfwj+aJaEasFc=";
+  cargoSha256 = "sha256-vLUR8Rs33GukkRihoB9jD3G4ailJc8oakm7NSjoZdok=";

  # skip test due FHS dependency
  doCheck = false;
--- a/pkgs/applications/window-managers/i3/default.nix
+++ b/pkgs/applications/window-managers/i3/default.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  pname = "i3";
-  version = "4.21.1";
+  version = "4.22";

  src = fetchurl {
    url = "https://i3wm.org/downloads/${pname}-${version}.tar.xz";
-    sha256 = "sha256-7f14EoXGVKBdxtsnLOAwDEQo5vvYddmZZOV94ltBvB4=";
+    sha256 = "sha256-KGOZEeWdlWOfCSZCqYL14d6lkiUMK1zpjtoQCDNRPks=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/window-managers/i3/gaps.nix
+++ b/pkgs/applications/window-managers/i3/gaps.nix
@ -1,29 +0,0 @@
-{ fetchFromGitHub, lib, i3 }:
-
-i3.overrideAttrs (oldAttrs : rec {
-  pname = "i3-gaps";
-  version = "4.21.1";
-
-  src = fetchFromGitHub {
-    owner = "Airblader";
-    repo = "i3";
-    rev = version;
-    sha256 = "sha256-+JxJjvzEuAA4CH+gufzAzIqd5BSvHtPvLm2zTfXc/xk=";
-  };
-
-  meta = with lib; {
-    description = "A fork of the i3 tiling window manager with some additional features";
-    homepage    = "https://github.com/Airblader/i3";
-    maintainers = with maintainers; [ fmthoma ];
-    license     = licenses.bsd3;
-    platforms   = platforms.linux ++ platforms.netbsd ++ platforms.openbsd;
-
-    longDescription = ''
-      Fork of i3wm, a tiling window manager primarily targeted at advanced users
-      and developers. Based on a tree as data structure, supports tiling,
-      stacking, and tabbing layouts, handled dynamically, as well as floating
-      windows. This fork adds a few features such as gaps between windows.
-      Configured via plain text file. Multi-monitor. UTF-8 clean.
-    '';
-  };
-})
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -11,7 +11,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "16.8.2";
+  version = "17.0.2";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,95 +1,95 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1zdjwczfmb6swa4yza4nydhvspj9wvi1lvd4d9inr9ssc0ky0h0k";
-  iosevka-aile = "15ahii9597g8p2m0abx3zha26093gsnihn66nm9l1jqrda8s3bfx";
-  iosevka-curly = "1xqxzj9zxfxy3mpq9kjfzjxpi106qp6dq9x32vdfm192l2kcz4dq";
-  iosevka-curly-slab = "0rp6p5v1jd4ihgkshmzm90b9i2kafz94ng2f0lxqrjkh88xg2qkz";
-  iosevka-etoile = "1ml7wmkq7im97z9zgg184bw0a3wzk5rd10jx29ybb4hfklp5mpgk";
-  iosevka-slab = "1dydq9pw0n9kj1nwbyrcb7cxsmjbs69fj91rnl9ayjp6fis2npfl";
-  iosevka-ss01 = "0q26f6n986cs6bzbyqsd0rnk064cxyr7z6iskn1gbf3138cj1q2j";
-  iosevka-ss02 = "1g93qx9b7l5fq5lbxjgvfxmzzmmplgd3cygc3kl7z0xdqfzqh735";
-  iosevka-ss03 = "0vfg0qr0w22yq0igzm0wpd3gf74n2w1xsk7lpzsxcrpljzmjrry5";
-  iosevka-ss04 = "10phf294w91b4m259pgddpih5r9ys49fib419vnh0rcn3f3c0vmz";
-  iosevka-ss05 = "074551ir5a45c7k00bfsbp162vc537xyqdqgi6h7j7lkhn7rfjvg";
-  iosevka-ss06 = "09jn7lk0gc3ns3640g2ng2jh44g180kjcx4fcyacipx5sfwwhjaf";
-  iosevka-ss07 = "18jn9png6jqh5g7883v50za44sa1h78ni8jmpzmfpnhhsvxfq6f2";
-  iosevka-ss08 = "0drgk3r1p4pn5vvdjrms3vivzizd7jkpla40z0gvi7832cssxk0d";
-  iosevka-ss09 = "0xynk2m5nhhlk34c2d3962mcz8mh7n2f64jd4n8l6v3mibcmjh8n";
-  iosevka-ss10 = "1yygdiikbdklk7ddyg3mmvypcmwbm9iym63qvabv0n2dxm5fjylz";
-  iosevka-ss11 = "0as42f552xdpla332sabrxf98l33rv17qzig8f2g38cvwhdp7wc1";
-  iosevka-ss12 = "179499aa1yh5hp0zlwvbyfixi72qky59lba5hd9b53s81jxph778";
-  iosevka-ss13 = "0dprpbcykq5a4gz9941vbiaj7l36xvwip19l1g0422ffg9yrlqvg";
-  iosevka-ss14 = "04843xsmab4y3hxicpkv6ard7kynm6dhyxxsmyz0n3rvl0jk4krj";
-  iosevka-ss15 = "1j0ljgpz3x5wkcj1jx8dnb5ccp1fcyg4i8p40cr01azmbxhwj5m5";
-  iosevka-ss16 = "0gn6x6f03mccfq6lfglbfzxgg74v30k7nadqjlj08fsxp37iiqzc";
-  iosevka-ss17 = "1qnh6bqz15h1xaxcqjsbiidaqbrjikc20fys5fwjflh213csy2n8";
-  iosevka-ss18 = "0p85kp81ylm8fm5fgyp6sv9rcf8gvznpfgn7mbw26y1lx7gmh6xy";
-  sgr-iosevka = "1g97vv4n020r8j9k4w7dzam2xvfqs80nbfvmxkswsnfg3kys1n58";
-  sgr-iosevka-aile = "0ysds3663psv1nr6nyzwxm47vg02jhpgssm3lmdls4g07y93f1fl";
-  sgr-iosevka-curly = "1kzclraj9ndcask13f4iwvf360zm7p78xqf645wbfa9h4rzd93l5";
-  sgr-iosevka-curly-slab = "12y4fyf22mzrnbzl9785ffg6pqcgbdbss1hambf03av2cdvc7sfi";
-  sgr-iosevka-etoile = "1d04q0wnsymfv3zklfz77yvq1xa1zlj1fi2ihljlzrlfw8ybn90c";
-  sgr-iosevka-fixed = "0p6h9hhqbjn9y7dvf78fm0jy6wd884gh4cn4k6070v0psm5xp0y1";
-  sgr-iosevka-fixed-curly = "0l4yd4p8gzsmxgfh90l7z2x6l8v56v5jwsyshq6jawc8xcbny3rb";
-  sgr-iosevka-fixed-curly-slab = "13cg8by9j57r2vbh0anms61dcxvxrzf3yw91s1g6nmhllqd5aqrq";
-  sgr-iosevka-fixed-slab = "03v8i2p2sww6p2dmzq1xqrrik2k1qz91xn9d9ww2zwz47hkgbysm";
-  sgr-iosevka-fixed-ss01 = "1caliz8g63cny7zrq5gkan2366c381d2rl48jnqmmpij3zsx8axz";
-  sgr-iosevka-fixed-ss02 = "01sgb5mrrry2nln0yfzm5z00x5rv28iav3xpww33xcrgwvvvxfp0";
-  sgr-iosevka-fixed-ss03 = "076ayn5y5gxla7w9ildg445wlc2r36vfnhqim7wkphach9mqjn1j";
-  sgr-iosevka-fixed-ss04 = "0x1bd9vy8a0afykb97yl669hsf5mn2gjm9ly5hlb3bnmxaw8dchj";
-  sgr-iosevka-fixed-ss05 = "0f6yn9z3sv28ilx1j0sh0yw19m0kzi81razq7q601k7q4klzm7dw";
-  sgr-iosevka-fixed-ss06 = "0qjsg1xl6x6355c5x2lakh5cbv1vjs1z1s13ikbqhv8wckklmbb0";
-  sgr-iosevka-fixed-ss07 = "0z8yy005l4srqgi2sh64vj1238ydw04kg4vqzj612bmydp5r4vbj";
-  sgr-iosevka-fixed-ss08 = "0dh9gr3qhpw2ap3j69nnsbiqi04y59rgvpwxgw2z8jcdksh7syal";
-  sgr-iosevka-fixed-ss09 = "1lf4vi363rz7mchin262zwz21lpnp1k77v934858qyspc8fkgf1j";
-  sgr-iosevka-fixed-ss10 = "0i7lkr892mq1nks2fsll2lhrzgad0q4hpvl4wafd2jx9wi21b158";
-  sgr-iosevka-fixed-ss11 = "13p1z9x9yi064p1jh0gybrbv2np5ynyggmasf7259cs1l89fqci4";
-  sgr-iosevka-fixed-ss12 = "1ydkj92f9nyyxhvcscxahnjp75pd66ps0flj09f8kk7lbs9vcx4f";
-  sgr-iosevka-fixed-ss13 = "1gkzv8l298kyvgkil47d6gshjvjfdgr0chjhnkl7yqqmwwl23rn2";
-  sgr-iosevka-fixed-ss14 = "0klm69qmirappqijsl0si5yv8pk56k5d5jqpib8l0scb99pxvi2y";
-  sgr-iosevka-fixed-ss15 = "0ym7zdvh0g52jkpijls572hjyv8jk47srq4nqvig0qygkx3w24nf";
-  sgr-iosevka-fixed-ss16 = "0clhkh8lxn0garhsj9jca2iw173gihac10bcm12i0mq8ca8qxrhl";
-  sgr-iosevka-fixed-ss17 = "1225rd8w2c65zvmq5gbg2f8n7bnmqdjf9g0cjqi42gwns840k81h";
-  sgr-iosevka-fixed-ss18 = "0r47grjpbdk6ccrdvdz7vsln5923wl4xb4xcm3q803p8sfb4h38x";
-  sgr-iosevka-slab = "1f96ml19ph39bnkdfrag84z1w7d6r7l5sk8vl2gw55hqwb9h423y";
-  sgr-iosevka-ss01 = "167s8175qcq544d0j21rwrjispdrw8q41p3dfd9kri4x3cbgqndy";
-  sgr-iosevka-ss02 = "0hj18h8hz18ggqm4mj4cdqhp7aa2w8p647y2my5rh989k8y5pgw8";
-  sgr-iosevka-ss03 = "012mxn8azidrjq39jvvscmlazvx4lv94ibvfp3acfp7chhgshi4g";
-  sgr-iosevka-ss04 = "1g1wi82baa71p1596430akdd0hhxzp7fa1gimjkvl871h7nal5r3";
-  sgr-iosevka-ss05 = "1s1jmr4aam0584gy9jbk8fxymn2y9vfz6yd12bkd7l8m73y819bw";
-  sgr-iosevka-ss06 = "1bqrm6g8q77g8b9b14dbwnj9gc0g68niw32fw7fjzpypgsgwh5y3";
-  sgr-iosevka-ss07 = "0mw4qmfnjdncyk8r30km1pvcmv46dlps6zkq7c8szy2lsnlshspf";
-  sgr-iosevka-ss08 = "0kikssw16p3bnlm796fbdkzl5vwm496lz4j9c5ms9hgpk7j1qxcc";
-  sgr-iosevka-ss09 = "02vrzi199qszm10jmnijx786lmkcx0npfaachp51n9lpsvs23i64";
-  sgr-iosevka-ss10 = "138lhzjxq9ar8dmm1cdjdvdkn3blhi423hcvhr6wfxps629xvlw2";
-  sgr-iosevka-ss11 = "08ry7fbfswri4vq20513lj4xfjv70dqvs8aadqx0gwkcknmdawq2";
-  sgr-iosevka-ss12 = "1nlzzxkp2gn5hx2js33c86w7823ircpi2d2s63a6irgqwzm0dc53";
-  sgr-iosevka-ss13 = "0yrzqhns7a82fpwl7gndjpaln3251s89vc91rc1lc4rcmqzpjdfy";
-  sgr-iosevka-ss14 = "1km2bvnrp5g1axfl59agh9qrkdayh5h23pdmf6dxw8a8s3sknf7w";
-  sgr-iosevka-ss15 = "0fym1sgf375d8y8qbgyjx9x2y5h0iidnbd7fxqk1jdzcm4ndnrv5";
-  sgr-iosevka-ss16 = "0h5rcvqw1xwvhkcdb082zbd3hl0ymnv8nxvf9g8lprpwb222ag8b";
-  sgr-iosevka-ss17 = "1s7p4ydpgkhxfjsp3vqn059l43gpxmlf54pawl6i53ldzgjsfx1a";
-  sgr-iosevka-ss18 = "0rpfvl3yffpg5c3155pmswpg31qj2wd2zh1k42r5k84ws9l9ns7d";
-  sgr-iosevka-term = "0i2bxrfpvcg4agrsj6d6dfiim2lz9p7xm17b5928xbk5cxl08v9b";
-  sgr-iosevka-term-curly = "0k0zqfkkjk8fi88gqnr44hcbm3y4wpx4p99dqv51ssra7ggqbs5z";
-  sgr-iosevka-term-curly-slab = "1krc6mva1mif6xlnfxxqnxxfaljszg3zkivgvmbkaqgb7y39ph87";
-  sgr-iosevka-term-slab = "0r4f29218l2mql9bld488bdmzzgqav81i757vfj6qrc5m6w6znah";
-  sgr-iosevka-term-ss01 = "1hvi8xc0zagx267vfhwymnyq5y1bb9p6d7vs5nijrkq7hlkyl8j3";
-  sgr-iosevka-term-ss02 = "0pha6nz5736ygv6mhf6xk5kp29wxg5sn336rh45w3q9dh3df2bh0";
-  sgr-iosevka-term-ss03 = "169lxbrr6i40cpa45381r04q0q8vgmhaypdzp30lg8gm69wpgs87";
-  sgr-iosevka-term-ss04 = "0273cinikxp1xrxzcs0dn51xsi1h59yw7pdvaciqys62vb09cai8";
-  sgr-iosevka-term-ss05 = "0rax2nwzgy9pmw4qld2spfpsv98vs4mpqz0zw6zr1dd6jdhzvr3b";
-  sgr-iosevka-term-ss06 = "1r2ja3idf68kvsk7r3mjx2zqjdx41rvsb9xhxnp9llga51r3y4f7";
-  sgr-iosevka-term-ss07 = "0rb1wq206p4g6i5v32x0y2lr1vs93qg5hfichbpi3bdjjpwlvg10";
-  sgr-iosevka-term-ss08 = "1bsnmvdabnrj65s9d9i0s3q4zn1b2w2xvsqsjjgs3iwsbhy5b7n3";
-  sgr-iosevka-term-ss09 = "1vm3jkv58n1zf96hgd28mrqls23zdk8cpml9wvmlj7p9y7x0qcxs";
-  sgr-iosevka-term-ss10 = "0120gip4r40dzmc5vpl9avhzyfh16w0vdqw8ks259arcd72s0j4v";
-  sgr-iosevka-term-ss11 = "14rf4h9zdnvkjsvwcikmgpnlpypk1qpdld1sw5wf1drbarpxynkl";
-  sgr-iosevka-term-ss12 = "0g6rrsz0fc2szjxp4hxsw0ji4vcdhq5qx32hq83is2iqkkbylsz9";
-  sgr-iosevka-term-ss13 = "19nk2wn13xnacih8qydxsjcpqwaqyklc6dsrx9b2rv7x8ksxyzdp";
-  sgr-iosevka-term-ss14 = "16cjsfk5gn77f4h5g29cx5jj3zrxcl26izyivs5n161xvrq95inb";
-  sgr-iosevka-term-ss15 = "07y306f40dmfdzzgfk2mmq3aipwzqcsff7yjcd3g9hn6cznn85jq";
-  sgr-iosevka-term-ss16 = "0lbmqlsd7zlrfy9fxrj6ngnw2lwvv437z3ibw33qgch1vv4qz4yz";
-  sgr-iosevka-term-ss17 = "08w4x5dd7klnafp6ifnd61m1s3q9ncbr1llx8ywa00s1dfxxsc0f";
-  sgr-iosevka-term-ss18 = "0b2vxkc8c2jmpxlvj2gdy2ghygsiifrp4pivmpgp3amwa913smsk";
+  iosevka = "004vj7r84kansfvdh0d7qmp9xdsrbw4x0iqa8k37pvg0czzvzz14";
+  iosevka-aile = "0mm9y56z6rlfj1w3giql4n12190i95rizd182id9jgjiap75nqdi";
+  iosevka-curly = "0z3hd4wbpz4r1njdprafad8jlq77scwjyy60j6nb900bid0s130b";
+  iosevka-curly-slab = "1v3wrydar72l3nrnjajlrqkz3brqwc5g8vsix1c2acw7k8pj4adq";
+  iosevka-etoile = "04vlvi5dzfpz6qvkv8r4ba0zp36bwdxqyspf7za8a1cqpwg6dhv1";
+  iosevka-slab = "0b7n3rvf6irp4scpm5g9pr5ikik2q7mkw35qdy63wq0d7vy7k67m";
+  iosevka-ss01 = "0xa0hrn6hjzj094xs1wilp9csb3i3yfpngfw9g9p59wnsphq12k7";
+  iosevka-ss02 = "00ygpybyq5qa1fva5d5lbmpl34cf6w18kba958rjzydc5zj4hfk1";
+  iosevka-ss03 = "1l2s01a32mblgmd7c6n11nwk9fxh7iflba6da9wb9rszwj9kh7fb";
+  iosevka-ss04 = "1pqvclbhw8nrlaasi03l3mjmg8sh48fhh6fl1ngmsc86k15ym8xy";
+  iosevka-ss05 = "1vg827f694kx841fnsjkmwvs4nbcy9jpbxfr6cbjmhr9g9hp8qis";
+  iosevka-ss06 = "1zkndj11ld5crkkyf8pbn6bd8xigm4mvs9h0mb15hqym09phsvbf";
+  iosevka-ss07 = "0ssalch56zkdr7q97s215iwjsiny0a4svjp5qij0w0w9vfh1c8q4";
+  iosevka-ss08 = "0i1v47ji7wn13vmad9jkskislqg1zgi3vsk2fjygx8z9b39svs1h";
+  iosevka-ss09 = "1bk9lr4zafj97p53pdqryi01malijniqhn9mkz984m0z7fnyh35j";
+  iosevka-ss10 = "1rqmak3bwmj32s9s85ipxfyplcxqljj1z8p1s3i6l8njqfx9hmv9";
+  iosevka-ss11 = "0d13sgam6kpw0pp0g0ibhi7ji63yijfjgrid32fs99i7l636f7y0";
+  iosevka-ss12 = "1ya76hfizg56ryfmf12lmb9wivdhx8wps55m3mryldaqw3ys5fh5";
+  iosevka-ss13 = "0gdz4g9l2p4ah5ms2nhnwz14h8bvw1mszxzjj6v474za2py989dh";
+  iosevka-ss14 = "14l6vk0yzk4c2gk28s30ys9k26ic3p9sywbbwinzm7y67knqsc2b";
+  iosevka-ss15 = "1vpx2ksdjmlp37difs12b4cs25x73v5qlqzjvck2z9ikbgf9drn7";
+  iosevka-ss16 = "088zf8q75v4qgpdinlf80rfkblviwxk94kzf0qa7zsk1hg9xmb59";
+  iosevka-ss17 = "0wz5z58aalk4xp9xhcq3xrm6mf2l28gp5qydxgajgzz7lh405znh";
+  iosevka-ss18 = "12r294lrwy1a663dzfs0hxsg113v127365nwb2wn5q7jksmaxxd6";
+  sgr-iosevka = "13fy2vyslhrikf9vf668754gdqfz1dyqfx9kk0r5yzi0g6ysvdkx";
+  sgr-iosevka-aile = "0qjyag5axpcfqng6cqv4j0fh0a6f0v834iwhf8zx7qgh1h6j1vvy";
+  sgr-iosevka-curly = "1gvi7clwyl24dyrmrcb2i4n96p9rqhxxl6cvl1bdv9v6qi9y65lc";
+  sgr-iosevka-curly-slab = "10ha1h64w2189azpszdg328c0p1nfg8r9rwrk1qxs7cv7mkmr5fj";
+  sgr-iosevka-etoile = "0yd95kn3ickra7ssb62m8c61c8aarxkljcxk9j470rf679fsj3rp";
+  sgr-iosevka-fixed = "00qiswcfhqf1jsw4xwbqdpaq2jhxvkcdq5vhjg26q97nv5hdqk9w";
+  sgr-iosevka-fixed-curly = "1bqcsqysxf3x5g5970hgsazy0qgdkqhjdh1pqknqng2r8awrpi45";
+  sgr-iosevka-fixed-curly-slab = "1jcxc19q83k7rxcsyg99ahg267i7q86kf9kxzb06bj48f52ypkd3";
+  sgr-iosevka-fixed-slab = "1dgjqn7pniq45f5m2sqj47nmdmrgkk2g1860f262b48aydh3lfnh";
+  sgr-iosevka-fixed-ss01 = "0g9jwlc616b52r9wakpdi61ny79vr64zg2cch5jrvsn03gkp47jv";
+  sgr-iosevka-fixed-ss02 = "0lvc2m8cwrfsp1lnnl3fshqj6xskv0gdj4xr3m16axkwa60h2qcb";
+  sgr-iosevka-fixed-ss03 = "0fhsrmbvwwnrg3jicark56r0zirnq5yp1lg2xaznx8wmw08221z5";
+  sgr-iosevka-fixed-ss04 = "0wy4mja82xrxwfmdpkmil9d8q6681a8dj44wb3h8hvybd40qm8xf";
+  sgr-iosevka-fixed-ss05 = "1rhilqnw3kay2mgjmjzxaappgyz3rib4gq142j717m0scbd7c5dw";
+  sgr-iosevka-fixed-ss06 = "0ci3sfy39850zks4glnlr7ml40akhh290rz43s4qd7lcpsyiqaw8";
+  sgr-iosevka-fixed-ss07 = "1i0r4sb9jpipp08cw43n8ajskfyzk5yz2d08h4z0bfd4k8ap9vd0";
+  sgr-iosevka-fixed-ss08 = "1jgqdr09gpv2rysi8yj3p6wc79xhx81hncaim3vmj32gkv3pqpbx";
+  sgr-iosevka-fixed-ss09 = "1m9085hmpljn3pfnxjc3h2q0agkidqdi5b2dl744xs9p1nzm7y9c";
+  sgr-iosevka-fixed-ss10 = "03j0bv0yfd15jjc2ssffsbhq7vcg38prxycvzh1nbc9g0rl3ji24";
+  sgr-iosevka-fixed-ss11 = "0kgjjnsihycxyqlgc4zngfqiynqp8agnic7mydni8mqwl1jxaw17";
+  sgr-iosevka-fixed-ss12 = "0v0gva1v3q9xhvzyv1qlggb0dy96a9fm2vm682jj913j925mh23m";
+  sgr-iosevka-fixed-ss13 = "06jd2lggi8i9lmaqjhss837wplaypc60k8fnjall16wzdg3an8di";
+  sgr-iosevka-fixed-ss14 = "1qvdyran2c56wrzwnz5l42ld1iy6y7bvadw3mgrjfi01xfs43ncb";
+  sgr-iosevka-fixed-ss15 = "06kpf9fzvq8flvn2fw6cg5n9c629qnwpxh8vx0z9bqn29kqvf0d1";
+  sgr-iosevka-fixed-ss16 = "0sdm5h1zbr812pa2i1c8qz1a884pcdcng47xyk7li5v1y2gznmij";
+  sgr-iosevka-fixed-ss17 = "109d2cl2cs8wzqq2g9sjcfbxl8x2zl4pssh3jsns8n2yx63lmkxf";
+  sgr-iosevka-fixed-ss18 = "1pjy2zb0qgjqy11mbj4ia8pdxm8h888ifwsjyjy0zm9q6v8y5xcb";
+  sgr-iosevka-slab = "0vak6d76ignsik1561s8dm1r4pqn02w32vavls668mjg3i051llq";
+  sgr-iosevka-ss01 = "0p195gvj4ljjw4difg78hq139l5hmpk4jbjm8pzfrxmn643z0yi4";
+  sgr-iosevka-ss02 = "01llc2hykx7i7r9bp7gcc650iw9ry5c17s2ap06j0vv7gz0a47h5";
+  sgr-iosevka-ss03 = "0m208v1mdxm2w5c92cijpvbcqh4hxg2mchghwchq9kyk00b1ld2d";
+  sgr-iosevka-ss04 = "15x7i8pxy5i512whh6464x4l72qygvrd0rs1y3y1kbavp1scb5ck";
+  sgr-iosevka-ss05 = "1xqxc66nfb5n38hyr8s3r7yrm4v27ymr8mfkqp10jnpyyi47mwg5";
+  sgr-iosevka-ss06 = "1wskdfz3y24ia402b0mn34393w9nbjszqryg7x8ka1c4fjvccwdn";
+  sgr-iosevka-ss07 = "09ahix65wcspjmsjnw9f7mad8pl7m9yl4kzlh2awv3ag448cgj3s";
+  sgr-iosevka-ss08 = "03g23ni2jqvwjbibhpbn6i2ddc3yr5znvxhinwgag45vrjfr629m";
+  sgr-iosevka-ss09 = "0n1vi5r5yjxrrdx0w5ab1hd31dwzrg9n8cp6gcj1d532mk6y7y74";
+  sgr-iosevka-ss10 = "034ai6djsw32jd0y037svfp2mlrsg99gwxl9awjvip219n6gqly2";
+  sgr-iosevka-ss11 = "1ngkjmgiq99p51ar2hff8xf27xq18m32wrw2igk8mr58r35xzkpi";
+  sgr-iosevka-ss12 = "1wdh48px6ywj990nm45w8nmllvl9f8k9pj2jf5frfrr9qshvzsmz";
+  sgr-iosevka-ss13 = "0wh2dq3crpdx002wv6lzznirx7bvgkl04x429nzfvkkwp28y2jj9";
+  sgr-iosevka-ss14 = "05w3bl8kxj9qgm2vqhl93bz0zyhkdhbsmxh82fwl74mxs530sjpj";
+  sgr-iosevka-ss15 = "09xf5xlzz4d4whw4blwa9hlyij0kfihi8q3q448p40r116kvl2zy";
+  sgr-iosevka-ss16 = "1d6jfaxz8ivn3a7zsk408z0hr9rjh2gv93zqq41a191zpgd7zj3g";
+  sgr-iosevka-ss17 = "12x3nlcq89c6ldq70bi5w418iqwmb2i8jq7csh9cg7ghbl4bmr9x";
+  sgr-iosevka-ss18 = "0z9pg0y56ix679br1zdfmqsf9an704gb1gf420mypkr9dyf2yh50";
+  sgr-iosevka-term = "1ry11xwl715lpiy6psh4l4bwjsf5f14igrv6wzag60xk0ip91qgv";
+  sgr-iosevka-term-curly = "0jkblgqmpixh4qjr96sjv6mag1faak2yz7251g63x4gbf2sbahlq";
+  sgr-iosevka-term-curly-slab = "1yjcy6y31nyilkxmid6laxwsrmf61akgsaz5ybjy20vhhkylj1hj";
+  sgr-iosevka-term-slab = "1cxv8qh4mjs0xl0v3ckgz916dir3n4wvmibhv161valvd5cswrci";
+  sgr-iosevka-term-ss01 = "0i6qkxwgbq2iz4gzqcfi5jdnw7rdrasdh5cmbah72fxrxmwbwxrx";
+  sgr-iosevka-term-ss02 = "13hgq4airgimi26c2bi54m6405w7gi3pl3i76nxr009vkia50nsk";
+  sgr-iosevka-term-ss03 = "1n0f4kmnaibsf7ss34shc1yhdjsfsia76qycpsl2jhhq3531z080";
+  sgr-iosevka-term-ss04 = "11fq16w1h4ajzs24qx6ng0nnh0c0pbqa9m75bavn47vjhl10d1v9";
+  sgr-iosevka-term-ss05 = "1ym9hq8hk687b4ahg2dq1hp7gb7xjxnak12ijsppzsgp42dmjbjl";
+  sgr-iosevka-term-ss06 = "1zc70ywxzk2m69rrmcah8kq994j9y40bhm0wnb9cbl45zkgacms1";
+  sgr-iosevka-term-ss07 = "03cd38wnjmqkm93v23ga4yd03w5l58yb8ipw1pi9s8i7vicicvb5";
+  sgr-iosevka-term-ss08 = "0226qnp4nabsynd7nxvis237vm31785k7msh2vpxnmbl8m2h54b6";
+  sgr-iosevka-term-ss09 = "1c63qiiz8pw49x7xjfxbnm36isc486bk9d19zbfhylchbd0yfbxx";
+  sgr-iosevka-term-ss10 = "1pl3b935mbdf126m0bjq17wfy80rdcvq3zmh13w2hb8pmx0m31gg";
+  sgr-iosevka-term-ss11 = "1nqzh75ia7z74f3v6m9jkh51qhjpxnmhqxnz3ks5s5rb3qgvj1h6";
+  sgr-iosevka-term-ss12 = "0z9xafdp75c88g1mf5hyh6h88n1w3qs6fid7bvwy1jjnsnai835s";
+  sgr-iosevka-term-ss13 = "0bccy0fhr5kqx1b53wb6gcijn7axlbg2x24vp8mh72mnw306qnf3";
+  sgr-iosevka-term-ss14 = "174srnn43rwsc1l8qjk6hrqg3qndk2sf61cii3v2hk1pnrqxs85r";
+  sgr-iosevka-term-ss15 = "15lg2p7hpdkd21f8nkywxzp8gmxg3wpi2q33m0bchvcr1cb6p326";
+  sgr-iosevka-term-ss16 = "0b20m1akm95nbkjy7cqgn4gfiaashdkwc1nf6abwhpm8iydwas3v";
+  sgr-iosevka-term-ss17 = "1x0n4z4si9qzkqanbdp1lqn73hynbxa7s59rwc9z0s902vyqpgcx";
+  sgr-iosevka-term-ss18 = "19b3nx5mvdr6r6hbcqjxrdsyr975ym42v0i670l4550bg0z24cyl";
 }
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@ -11,21 +11,43 @@
 , imagemagick
 , zopfli
 , buildPackages
+, variants ? [ ]
 }:
-
 let
-  mkNoto = { pname, weights }:
-    stdenvNoCC.mkDerivation {
+  notoLongDescription = ''
+    When text is rendered by a computer, sometimes characters are
+    displayed as “tofu”. They are little boxes to indicate your device
+    doesn’t have a font to display the text.
+
+    Google has been developing a font family called Noto, which aims to
+    support all languages with a harmonious look and feel. Noto is
+    Google’s answer to tofu. The name noto is to convey the idea that
+    Google’s goal is to see “no more tofu”.  Noto has multiple styles and
+    weights, and freely available to all.
+
+    This package also includes the Arimo, Cousine, and Tinos fonts.
+  '';
+in
+rec {
+  mkNoto =
+    { pname
+    , weights
+    , variants ? [ ]
+    , longDescription ? notoLongDescription
+    }:
+    stdenvNoCC.mkDerivation rec {
      inherit pname;
-      version = "2020-01-23";
+      version = "20201206-phase3";

      src = fetchFromGitHub {
        owner = "googlefonts";
        repo = "noto-fonts";
-        rev = "f4726a2ec36169abd02a6d8abe67c8ff0236f6d8";
-        sha256 = "0zc1r7zph62qmvzxqfflsprazjf6x1qnwc2ma27kyzh6v36gaykw";
+        rev = "v${version}";
+        hash = "sha256-x60RvCRFLoGe0CNvswROnDkIsUFbWH+/laN8q2qkUPk=";
      };

+      _variants = map (variant: builtins.replaceStrings [ " " ] [ "" ] variant) variants;
+
      installPhase = ''
        # We copy in reverse preference order -- unhinted first, then
        # hinted -- to get the "best" version of each font while
@ -33,29 +55,24 @@ let
        #
        # TODO: install OpenType, variable versions?
        local out_ttf=$out/share/fonts/truetype/noto
-        install -m444 -Dt $out_ttf phaseIII_only/unhinted/ttf/*/*-${weights}.ttf
-        install -m444 -Dt $out_ttf phaseIII_only/hinted/ttf/*/*-${weights}.ttf
-        install -m444 -Dt $out_ttf unhinted/*/*-${weights}.ttf
-        install -m444 -Dt $out_ttf hinted/*/*-${weights}.ttf
-      '';
+      '' + (if _variants == [ ] then ''
+        install -m444 -Dt $out_ttf archive/unhinted/*/*-${weights}.ttf
+        install -m444 -Dt $out_ttf archive/hinted/*/*-${weights}.ttf
+        install -m444 -Dt $out_ttf unhinted/*/*/*-${weights}.ttf
+        install -m444 -Dt $out_ttf hinted/*/*/*-${weights}.ttf
+      '' else ''
+        for variant in $_variants; do
+          install -m444 -Dt $out_ttf archive/unhinted/$variant/*-${weights}.ttf
+          install -m444 -Dt $out_ttf archive/hinted/$variant/*-${weights}.ttf
+          install -m444 -Dt $out_ttf unhinted/*/$variant/*-${weights}.ttf
+          install -m444 -Dt $out_ttf hinted/*/$variant/*-${weights}.ttf
+        done
+      '');

      meta = with lib; {
        description = "Beautiful and free fonts for many languages";
        homepage = "https://www.google.com/get/noto/";
-        longDescription =
-        ''
-          When text is rendered by a computer, sometimes characters are
-          displayed as “tofu”. They are little boxes to indicate your device
-          doesn’t have a font to display the text.
-
-          Google has been developing a font family called Noto, which aims to
-          support all languages with a harmonious look and feel. Noto is
-          Google’s answer to tofu. The name noto is to convey the idea that
-          Google’s goal is to see “no more tofu”.  Noto has multiple styles and
-          weights, and freely available to all.
-
-          This package also includes the Arimo, Cousine, and Tinos fonts.
-        '';
+        inherit longDescription;
        license = licenses.ofl;
        platforms = platforms.all;
        maintainers = with maintainers; [ mathnerd314 emily ];
@ -100,14 +117,34 @@ let
        maintainers = with maintainers; [ mathnerd314 emily ];
      };
    };
-in

-{
  noto-fonts = mkNoto {
    pname = "noto-fonts";
    weights = "{Regular,Bold,Light,Italic,BoldItalic,LightItalic}";
  };

+  noto-fonts-lgc-plus = mkNoto {
+    pname = "noto-fonts-lgc-plus";
+    weights = "{Regular,Bold,Light,Italic,BoldItalic,LightItalic}";
+    variants = [
+      "Noto Sans"
+      "Noto Serif"
+      "Noto Sans Display"
+      "Noto Serif Display"
+      "Noto Sans Mono"
+      "Noto Music"
+      "Noto Sans Symbols"
+      "Noto Sans Symbols 2"
+      "Noto Sans Math"
+    ];
+    longDescription = ''
+      This package provides the Noto Fonts, but only for latin, greek
+      and cyrillic scripts, as well as some extra fonts. To create a
+      custom Noto package with custom variants, see the `mkNoto`
+      helper function.
+    '';
+  };
+
  noto-fonts-extra = mkNoto {
    pname = "noto-fonts-extra";
    weights = "{Black,Condensed,Extra,Medium,Semi,Thin}*";
@ -127,65 +164,67 @@ in
    sha256 = "sha256-1w66Ge7DZjbONGhxSz69uFhfsjMsDiDkrGl6NsoB7dY=";
  };

-  noto-fonts-emoji = let
-    version = "2.038";
-    emojiPythonEnv =
-      buildPackages.python3.withPackages (p: with p; [ fonttools nototools ]);
-  in stdenvNoCC.mkDerivation {
-    pname = "noto-fonts-emoji";
-    inherit version;
+  noto-fonts-emoji =
+    let
+      version = "2.038";
+      emojiPythonEnv =
+        buildPackages.python3.withPackages (p: with p; [ fonttools nototools ]);
+    in
+    stdenvNoCC.mkDerivation {
+      pname = "noto-fonts-emoji";
+      inherit version;

-    src = fetchFromGitHub {
-      owner = "googlefonts";
-      repo = "noto-emoji";
-      rev = "v${version}";
-      sha256 = "1rgmcc6nqq805iqr8kvxxlk5cf50q714xaxk3ld6rjrd69kb8ix9";
+      src = fetchFromGitHub {
+        owner = "googlefonts";
+        repo = "noto-emoji";
+        rev = "v${version}";
+        sha256 = "1rgmcc6nqq805iqr8kvxxlk5cf50q714xaxk3ld6rjrd69kb8ix9";
+      };
+
+      depsBuildBuild = [
+        buildPackages.stdenv.cc
+        pkg-config
+        cairo
+      ];
+
+      nativeBuildInputs = [
+        imagemagick
+        zopfli
+        pngquant
+        which
+        emojiPythonEnv
+      ];
+
+      postPatch = ''
+        patchShebangs *.py
+        patchShebangs third_party/color_emoji/*.py
+        # remove check for virtualenv, since we handle
+        # python requirements using python.withPackages
+        sed -i '/ifndef VIRTUAL_ENV/,+2d' Makefile
+
+        # Make the build verbose so it won't get culled by Hydra thinking that
+        # it somehow got stuck doing nothing.
+        sed -i 's;\t@;\t;' Makefile
+      '';
+
+      enableParallelBuilding = true;
+
+      installPhase = ''
+        runHook preInstall
+        mkdir -p $out/share/fonts/noto
+        cp NotoColorEmoji.ttf $out/share/fonts/noto
+        runHook postInstall
+      '';
+
+      meta = with lib; {
+        description = "Color and Black-and-White emoji fonts";
+        homepage = "https://github.com/googlefonts/noto-emoji";
+        license = with licenses; [ ofl asl20 ];
+        platforms = platforms.all;
+        maintainers = with maintainers; [ mathnerd314 sternenseemann ];
+      };
    };

-    depsBuildBuild = [
-      buildPackages.stdenv.cc
-      pkg-config
-      cairo
-    ];
-
-    nativeBuildInputs = [
-      imagemagick
-      zopfli
-      pngquant
-      which
-      emojiPythonEnv
-    ];
-
-    postPatch = ''
-      patchShebangs *.py
-      patchShebangs third_party/color_emoji/*.py
-      # remove check for virtualenv, since we handle
-      # python requirements using python.withPackages
-      sed -i '/ifndef VIRTUAL_ENV/,+2d' Makefile
-
-      # Make the build verbose so it won't get culled by Hydra thinking that
-      # it somehow got stuck doing nothing.
-      sed -i 's;\t@;\t;' Makefile
-    '';
-
-    enableParallelBuilding = true;
-
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/share/fonts/noto
-      cp NotoColorEmoji.ttf $out/share/fonts/noto
-      runHook postInstall
-    '';
-
-    meta = with lib; {
-      description = "Color and Black-and-White emoji fonts";
-      homepage = "https://github.com/googlefonts/noto-emoji";
-      license = with licenses; [ ofl asl20 ];
-      platforms = platforms.all;
-      maintainers = with maintainers; [ mathnerd314 sternenseemann ];
-    };
-  };
-
  noto-fonts-emoji-blob-bin =
    let
      pname = "noto-fonts-emoji-blob-bin";
--- a/pkgs/development/compilers/gcc-arm-embedded/12/default.nix
+++ b/pkgs/development/compilers/gcc-arm-embedded/12/default.nix
@ -0,0 +1,52 @@
+{ lib
+, stdenv
+, fetchurl
+, ncurses5
+, python38
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gcc-arm-embedded";
+  version = "12.2.rel1";
+
+  platform = {
+    aarch64-linux = "aarch64";
+    x86_64-darwin = "darwin-x86_64";
+    x86_64-linux  = "x86_64";
+  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  src = fetchurl {
+    url = "https://developer.arm.com/-/media/Files/downloads/gnu/${version}/binrel/arm-gnu-toolchain-${version}-${platform}-arm-none-eabi.tar.xz";
+    sha256 = {
+      aarch64-linux = "131ydgndff7dyhkivfchbk43lv3cv2p172knkqilx64aapvk5qvy";
+      x86_64-darwin = "00i9gd1ny00681pwinh6ng9x45xsyrnwc6hm2vr348z9gasyxh00";
+      x86_64-linux  = "0rv8r5zh0a5621v0xygxi8f6932qgwinw2s9vnniasp9z7897gl4";
+    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+  dontPatchELF = true;
+  dontStrip = true;
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r * $out
+  '';
+
+  preFixup = ''
+    find $out -type f | while read f; do
+      patchelf "$f" > /dev/null 2>&1 || continue
+      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
+      patchelf --set-rpath ${lib.makeLibraryPath [ "$out" stdenv.cc.cc ncurses5 python38 ]} "$f" || true
+    done
+  '';
+
+  meta = with lib; {
+    description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
+    homepage = "https://developer.arm.com/open-source/gnu-toolchain/gnu-rm";
+    license = with licenses; [ bsd2 gpl2 gpl3 lgpl21 lgpl3 mit ];
+    maintainers = with maintainers; [ prusnak ];
+    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
+  };
+}
--- a/pkgs/development/compilers/ispc/default.nix
+++ b/pkgs/development/compilers/ispc/default.nix
@ -2,7 +2,7 @@
 , cmake, which, m4, python3, bison, flex, llvmPackages, ncurses

  # the default test target is sse4, but that is not supported by all Hydra agents
-, testedTargets ? [ "sse2-i32x4" ]
+, testedTargets ? if stdenv.isAarch64 || stdenv.isAarch32 then [ "neon-i32x4" ] else [ "sse2-i32x4" ]
 }:

 stdenv.mkDerivation rec {
@ -58,14 +58,15 @@ stdenv.mkDerivation rec {
    "-DCLANGPP_EXECUTABLE=${llvmPackages.clang}/bin/clang++"
    "-DISPC_INCLUDE_EXAMPLES=OFF"
    "-DISPC_INCLUDE_UTILS=OFF"
-    "-DARM_ENABLED=FALSE"
+    ("-DARM_ENABLED=" + (if stdenv.isAarch64 || stdenv.isAarch32 then "TRUE" else "FALSE"))
+    ("-DX86_ENABLED=" + (if stdenv.isx86_64 || stdenv.isx86_32 then "TRUE" else "FALSE"))
  ];

  meta = with lib; {
    homepage    = "https://ispc.github.io/";
    description = "Intel 'Single Program, Multiple Data' Compiler, a vectorised language";
    license     = licenses.bsd3;
-    platforms   = [ "x86_64-linux" "x86_64-darwin" ]; # TODO: buildable on more platforms?
+    platforms   = [ "x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin" ]; # TODO: buildable on more platforms?
    maintainers = with maintainers; [ aristid thoughtpolice athas ];
  };
 }
--- a/pkgs/development/compilers/julia/1.8.nix
+++ b/pkgs/development/compilers/julia/1.8.nix
@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
    # https://github.com/JuliaCI/julia-buildbot/blob/master/master/inventory.py
    "JULIA_CPU_TARGET=generic;sandybridge,-xsaveopt,clone_all;haswell,-rdrnd,base(1)"
  ] ++ lib.optionals stdenv.isAarch64 [
-    "JULIA_CPU_TERGET=generic;cortex-a57;thunderx2t99;armv8.2-a,crypto,fullfp16,lse,rdm"
+    "JULIA_CPU_TARGET=generic;cortex-a57;thunderx2t99;armv8.2-a,crypto,fullfp16,lse,rdm"
  ];

  # remove forbidden reference to $TMPDIR
--- a/pkgs/development/compilers/llvm/8/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/8/lldb/default.nix
@ -23,6 +23,9 @@ stdenv.mkDerivation rec {

  patches = [
    ./gnu-install-dirs.patch
+
+    # Fix darwin build
+    ./lldb-gdb-remote-no-libcompress.patch
  ];

  postPatch = ''
@ -33,6 +36,9 @@ stdenv.mkDerivation rec {
      cmake/modules/LLDBStandalone.cmake
    sed -i 's,"$.LLVM_LIBRARY_DIR.",${libllvm.lib}/lib ${libclang.lib}/lib,' \
      cmake/modules/LLDBStandalone.cmake
+
+    substituteInPlace tools/CMakeLists.txt \
+      --replace "add_subdirectory(debugserver)" ""
  '';

  outputs = [ "out" "lib" "dev" ];
@ -46,7 +52,11 @@ stdenv.mkDerivation rec {
  ] ++ lib.optionals stdenv.isDarwin [
    darwin.libobjc
    darwin.apple_sdk.libs.xpc
-    darwin.apple_sdk.frameworks.Foundation darwin.bootstrap_cmds darwin.apple_sdk.frameworks.Carbon darwin.apple_sdk.frameworks.Cocoa
+    darwin.apple_sdk.frameworks.Foundation
+    darwin.bootstrap_cmds
+    darwin.apple_sdk.frameworks.Carbon
+    darwin.apple_sdk.frameworks.Cocoa
+    darwin.apple_sdk.frameworks.DebugSymbols
  ];

  CXXFLAGS = "-fno-rtti";
@ -55,6 +65,9 @@ stdenv.mkDerivation rec {
  cmakeFlags = [
    "-DLLDB_INCLUDE_TESTS=${if doCheck then "YES" else "NO"}"
    "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Building debugserver requires the proprietary libcompression
+    "-DLLDB_NO_DEBUGSERVER=ON"
  ] ++ lib.optionals doCheck [
    "-DLLDB_TEST_C_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
    "-DLLDB_TEST_CXX_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++"
@ -80,7 +93,7 @@ stdenv.mkDerivation rec {
  '';

  meta = llvm_meta // {
-    broken = stdenv.isDarwin;
+    broken = stdenv.isDarwin && stdenv.isAarch64;
    homepage = "https://lldb.llvm.org/";
    description = "A next-generation high-performance debugger";
    longDescription = ''
--- a/pkgs/development/compilers/llvm/8/lldb/lldb-gdb-remote-no-libcompress.patch
+++ b/pkgs/development/compilers/llvm/8/lldb/lldb-gdb-remote-no-libcompress.patch
@ -0,0 +1,30 @@
+diff -ru a/source/Plugins/Process/gdb-remote/GDBRemoteCommunication.cpp b/source/Plugins/Process/gdb-remote/GDBRemoteCommunication.cpp
+--- a/source/Plugins/Process/gdb-remote/GDBRemoteCommunication.cpp	2019-01-09 19:46:09.000000000 -0500
+++ b/source/Plugins/Process/gdb-remote/GDBRemoteCommunication.cpp	2021-11-27 00:23:08.000000000 -0500
+@@ -42,11 +42,6 @@
+ #define DEBUGSERVER_BASENAME "lldb-server"
+ #endif
+ 
+-#if defined(__APPLE__)
+-#define HAVE_LIBCOMPRESSION
+-#include <compression.h>
+-#endif
+-
+ #if defined(HAVE_LIBZ)
+ #include <zlib.h>
+ #endif
+diff -ru a/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp b/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp
+--- a/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp	2018-12-18 18:02:50.000000000 -0500
+++ b/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp	2021-11-27 00:09:07.000000000 -0500
+@@ -37,11 +37,6 @@
+ 
+ #include "llvm/ADT/StringSwitch.h"
+ 
+-#if defined(__APPLE__)
+-#define HAVE_LIBCOMPRESSION
+-#include <compression.h>
+-#endif
+-
+ using namespace lldb;
+ using namespace lldb_private;
+ using namespace lldb_private::process_gdb_remote;
--- a/pkgs/development/compilers/llvm/9/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/9/lldb/default.nix
@ -1,5 +1,6 @@
 { lib, stdenv, llvm_meta
 , fetch
+, fetchpatch
 , cmake
 , zlib
 , ncurses
@ -13,6 +14,7 @@
 , version
 , darwin
 , makeWrapper
+, perl
 , lit
 }:

@ -25,12 +27,27 @@ stdenv.mkDerivation rec {
  patches = [
    ./procfs.patch
    ./gnu-install-dirs.patch
+
+    # Fix darwin build
+    (fetchpatch {
+      name = "lldb-use-system-debugserver-fix.patch";
+      url = "https://github.com/llvm-mirror/lldb/commit/be770754cc43da22eacdb70c6203f4582eeb011f.diff";
+      sha256 = "sha256-tKkk6sn//0Hu0nlzoKWs5fXMWc+O2JAWOEJ1ZnaLuVU=";
+      excludes = [ "packages/*" ];
+      postFetch = ''
+        substituteInPlace "$out" --replace add_lldb_tool_subdirectory add_subdirectory
+      '';
+    })
+    ./lldb-gdb-remote-no-libcompress.patch
  ];

  outputs = [ "out" "lib" "dev" ];

  nativeBuildInputs = [
    cmake python3 which swig lit makeWrapper
+  ] ++ lib.optionals stdenv.isDarwin [
+    # for scripts/generate-vers.pl
+    perl
  ];

  buildInputs = [
@ -42,6 +59,7 @@ stdenv.mkDerivation rec {
    darwin.bootstrap_cmds
    darwin.apple_sdk.frameworks.Carbon
    darwin.apple_sdk.frameworks.Cocoa
+    darwin.apple_sdk.frameworks.DebugSymbols
  ];

  CXXFLAGS = "-fno-rtti";
@ -52,6 +70,9 @@ stdenv.mkDerivation rec {
    "-DClang_DIR=${libclang.dev}/lib/cmake"
    "-DLLVM_EXTERNAL_LIT=${lit}/bin/lit"
    "-DLLDB_CODESIGN_IDENTITY=" # codesigning makes nondeterministic
+  ] ++ lib.optionals stdenv.isDarwin [
+    # Building debugserver requires the proprietary libcompression
+    "-DLLDB_USE_SYSTEM_DEBUGSERVER=ON"
  ] ++ lib.optionals doCheck [
    "-DLLDB_TEST_C_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
    "-DLLDB_TEST_CXX_COMPILER=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}c++"
@ -80,7 +101,7 @@ stdenv.mkDerivation rec {
  '';

  meta = llvm_meta // {
-    broken = stdenv.isDarwin;
+    broken = stdenv.isDarwin && stdenv.isAarch64;
    homepage = "https://lldb.llvm.org/";
    description = "A next-generation high-performance debugger";
    longDescription = ''
--- a/pkgs/development/compilers/llvm/9/lldb/lldb-gdb-remote-no-libcompress.patch
+++ b/pkgs/development/compilers/llvm/9/lldb/lldb-gdb-remote-no-libcompress.patch
@ -0,0 +1,17 @@
+diff -ru a/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp b/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp
+--- a/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp	2019-12-11 14:15:30.000000000 -0500
+++ b/source/Plugins/Process/gdb-remote/GDBRemoteCommunicationClient.cpp	2021-11-26 23:44:28.000000000 -0500
+@@ -36,13 +36,6 @@
+ 
+ #include "llvm/ADT/StringSwitch.h"
+ 
+-#if defined(__APPLE__)
+-#ifndef HAVE_LIBCOMPRESSION
+-#define HAVE_LIBCOMPRESSION
+-#endif
+-#include <compression.h>
+-#endif
+-
+ using namespace lldb;
+ using namespace lldb_private;
+ using namespace lldb_private::process_gdb_remote;
--- a/pkgs/development/compilers/osl/default.nix
+++ b/pkgs/development/compilers/osl/default.nix
@ -33,6 +33,7 @@ in stdenv.mkDerivation rec {
  };

  cmakeFlags = [
+    "-DBoost_ROOT=${boost}"
    "-DUSE_BOOST_WAVE=ON"
    "-DENABLE_RTTI=ON"

@ -73,7 +74,6 @@ in stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64);
    description = "Advanced shading language for production GI renderers";
    homepage = "https://opensource.imageworks.com/osl.html";
    maintainers = with maintainers; [ hodapp ];
--- a/pkgs/development/compilers/tinycc/default.nix
+++ b/pkgs/development/compilers/tinycc/default.nix
@ -78,6 +78,10 @@ stdenv.mkDerivation rec {

  doCheck = true;
  checkTarget = "test";
+  # https://www.mail-archive.com/tinycc-devel@nongnu.org/msg10142.html
+  preCheck = lib.optionalString (stdenv.isDarwin && stdenv.isx86_64) ''
+    rm tests/tests2/{108,114}*
+  '';

  meta = with lib; {
    homepage = "https://repo.or.cz/tinycc.git";
@ -106,7 +110,8 @@ stdenv.mkDerivation rec {
    license = licenses.lgpl21Only;
    maintainers = with maintainers; [ joachifm AndersonTorres ];
    platforms = platforms.unix;
-    broken = stdenv.isDarwin;
+    # https://www.mail-archive.com/tinycc-devel@nongnu.org/msg10199.html
+    broken = stdenv.isDarwin && stdenv.isAarch64;
  };
 }
 # TODO: more multiple outputs
--- a/pkgs/development/interpreters/chibi/default.nix
+++ b/pkgs/development/interpreters/chibi/default.nix
@ -19,7 +19,8 @@ stdenv.mkDerivation rec {

  fixupPhase = ''
    wrapProgram "$out/bin/chibi-scheme" \
-      --prefix CHIBI_MODULE_PATH : "$out/share/chibi:$out/lib/chibi"
+      --prefix CHIBI_MODULE_PATH : "$out/share/chibi:$out/lib/chibi" \
+      ${lib.optionalString stdenv.isDarwin "--prefix DYLD_LIBRARY_PATH : $out/lib"}

    for f in chibi-doc chibi-ffi snow-chibi; do
      substituteInPlace "$out/bin/$f" \
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@ -248,7 +248,7 @@ let
            inherit lib stdenv makeWrapper buildRubyGem buildEnv;
            gemConfig = defaultGemConfig;
            ruby = self;
-          }) withPackages gems;
+          }) withPackages buildGems gems;

        } // lib.optionalAttrs useBaseRuby {
          inherit baseRuby;
--- a/pkgs/development/libraries/ada/spark2014/default.nix
+++ b/pkgs/development/libraries/ada/spark2014/default.nix
@ -5,7 +5,6 @@
 , gnatcoll-core
 , gprbuild
 , python3
-, why3
 , ocaml
 , ocamlPackages
 , makeWrapper
@ -53,11 +52,9 @@ stdenv.mkDerivation rec {
    make setup
  '';

-  postInstall = ''
+  installPhase = ''
+    make install-all
    cp -a ./install/. $out
-    # help gnatprove to locate why3server
-    wrapProgram "$out/bin/gnatprove" \
-        --prefix PATH : "${why3}/lib/why3"
  '';

  meta = with lib; {
--- a/pkgs/development/libraries/gtksourceview/5.x.nix
+++ b/pkgs/development/libraries/gtksourceview/5.x.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch2
 , meson
 , ninja
 , pkg-config
@ -37,6 +38,13 @@ stdenv.mkDerivation rec {
    # but not from its own datadr (it assumes it will be in XDG_DATA_DIRS).
    # Since this is not generally true with Nix, let’s add $out/share unconditionally.
    ./4.x-nix_share_path.patch
+
+    # Add Nix syntax highlighting.
+    # https://gitlab.gnome.org/GNOME/gtksourceview/-/merge_requests/303
+    (fetchpatch2 {
+      url = "https://gitlab.gnome.org/GNOME/gtksourceview/-/commit/2cc7fd079f9fc8b593c727c68a2c783c82299562.patch";
+      sha256 = "bTYWjEDpdbnUxcYNKl2YtSLfYlMfcbQSSYQjhixOGS8=";
+    })
  ];

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libftdi/1.x.nix
+++ b/pkgs/development/libraries/libftdi/1.x.nix
@ -44,6 +44,7 @@ stdenv.mkDerivation rec {
    "-DLINK_PYTHON_LIBRARY=${onOff pythonSupport}"
    "-DPYTHON_BINDINGS=${onOff pythonSupport}"
    "-DDOCUMENTATION=${onOff docSupport}"
+  ] ++ lib.optionals pythonSupport [
    "-DPYTHON_EXECUTABLE=${python3.pythonForBuild.interpreter}"
    "-DPYTHON_LIBRARY=${python3}/lib/libpython${python3.pythonVersion}${stdenv.hostPlatform.extensions.sharedLibrary}"
  ];
--- a/pkgs/development/libraries/libmilter/darwin.patch
+++ b/pkgs/development/libraries/libmilter/darwin.patch
@ -13,16 +13,16 @@ Fix build issues on Darwin.
 define(`confLDOPTS', `${Extra_LD_Flags}')
 --- a/sendmail/sendmail.h	2020-05-18 14:51:17.000000000 +0200
 +++ b/sendmail/sendmail.h	2020-05-18 14:51:00.000000000 +0200
-@@ -104,7 +104,11 @@
- # endif /* NETX25 */
+@@ -122,7 +122,11 @@
+ # endif
 
- # if NAMED_BIND
-#  include <arpa/nameser.h>
-+#  ifdef __APPLE__
-+#   include <arpa/nameser_compat.h>
-+#  else
-+#   include <arpa/nameser.h>
-+#  endif
- #  ifdef NOERROR
- #   undef NOERROR		/* avoid <sys/streams.h> conflict */
- #  endif /* NOERROR */
+ #if NAMED_BIND
+-# include <arpa/nameser.h>
+# ifdef __APPLE__
+#  include <arpa/nameser_compat.h>
+# else
+#  include <arpa/nameser.h>
+# endif
+ # ifdef NOERROR
+ #  undef NOERROR		/* avoid <sys/streams.h> conflict */
+ # endif
--- a/pkgs/development/libraries/libmilter/default.nix
+++ b/pkgs/development/libraries/libmilter/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "libmilter";
-  version = "8.15.2";
+  version = "8.17.1";

  src = fetchurl {
    url = "ftp://ftp.sendmail.org/pub/sendmail/sendmail.${version}.tar.gz";
-    sha256 = "0fdl9ndmspqspdlmghzxlaqk56j3yajk52d7jxcg21b7sxglpy94";
+    sha256 = "sha256-BLx2tsiG5tERvn/Y2qMrjOABKKKItrUuBnvCnzhUpuY=";
  };

  buildPhase = ''
@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
    sh Build -f ./a.m4
  '';

-  patches = [ ./install.patch ./sharedlib.patch ./glibc-2.30.patch ./darwin.patch ];
+  patches = [ ./install.patch ./sharedlib.patch ./darwin.patch ];

  nativeBuildInputs = [ m4 ] ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;

--- a/pkgs/development/libraries/libmilter/glibc-2.30.patch
+++ b/pkgs/development/libraries/libmilter/glibc-2.30.patch
@ -1,44 +0,0 @@
-diff --git a/libmilter/sm_gethost.c b/libmilter/sm_gethost.c
-index 2423c34..f00468c 100644
--- a/libmilter/sm_gethost.c
-+++ b/libmilter/sm_gethost.c
-@@ -52,16 +52,8 @@ sm_getipnodebyname(name, family, flags, err)
- 	bool resv6 = true;
- 	struct hostent *h;
- 
-	if (family == AF_INET6)
-	{
-		/* From RFC2133, section 6.1 */
-		resv6 = bitset(RES_USE_INET6, _res.options);
-		_res.options |= RES_USE_INET6;
-	}
- 	SM_SET_H_ERRNO(0);
-	h = gethostbyname(name);
-	if (family == AF_INET6 && !resv6)
-		_res.options &= ~RES_USE_INET6;
-+	h = gethostbyname2(name, family);
- 
- 	/* the function is supposed to return only the requested family */
- 	if (h != NULL && h->h_addrtype != family)
-diff --git a/sendmail/conf.c b/sendmail/conf.c
-index c73334e..500dafb 100644
--- a/sendmail/conf.c
-+++ b/sendmail/conf.c
-@@ -4243,16 +4243,8 @@ sm_getipnodebyname(name, family, flags, err)
- # else /* HAS_GETHOSTBYNAME2 */
- 	bool resv6 = true;
- 
-	if (family == AF_INET6)
-	{
-		/* From RFC2133, section 6.1 */
-		resv6 = bitset(RES_USE_INET6, _res.options);
-		_res.options |= RES_USE_INET6;
-	}
- 	SM_SET_H_ERRNO(0);
-	h = gethostbyname(name);
-	if (!resv6)
-		_res.options &= ~RES_USE_INET6;
-+	h = gethostbyname2(name, family);
- 
- 	/* the function is supposed to return only the requested family */
- 	if (h != NULL && h->h_addrtype != family)
--- a/pkgs/development/libraries/libpg_query/default.nix
+++ b/pkgs/development/libraries/libpg_query/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libpg_query";
-  version = "14-3.0.0";
+  version = "15-4.0.0";

  src = fetchFromGitHub {
    owner = "pganalyze";
    repo = "libpg_query";
    rev = version;
-    sha256 = "sha256-rICN8fkPcYw32N6TdpbrszGUoRzwQdfRSW6A0AC8toM=";
+    sha256 = "sha256-2BZT/jGfGwia+Map5OkeTcWVFJssykhrdRT2IDAzrfs=";
  };

  nativeBuildInputs = [ which ];
--- a/pkgs/development/libraries/lime/default.nix
+++ b/pkgs/development/libraries/lime/default.nix
@ -10,7 +10,7 @@

 stdenv.mkDerivation rec {
  pname = "lime";
-  version = "5.1.61";
+  version = "5.2.6";

  src = fetchFromGitLab {
    domain = "gitlab.linphone.org";
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
    group = "BC";
    repo = pname;
    rev = version;
-    sha256 = "sha256-cgc3123UvOzasBp/ImzXjt1JCkdqwPLnnk0PiStVcB8=";
+    sha256 = "sha256-WQ6AcJpQSvWR5m2edVNji5u6ZiS4QOH45vQN2q+39NU=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/nss/generic.nix
+++ b/pkgs/development/libraries/nss/generic.nix
@ -103,7 +103,11 @@ stdenv.mkDerivation rec {
      runHook postBuild
    '';

-  NIX_CFLAGS_COMPILE = "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\" " + lib.optionalString stdenv.hostPlatform.is64bit "-DNSS_USE_64=1";
+  NIX_CFLAGS_COMPILE =
+    "-Wno-error -DNIX_NSS_LIBDIR=\"${placeholder "out"}/lib/\" "
+    + lib.optionalString stdenv.hostPlatform.is64bit "-DNSS_USE_64=1"
+    + lib.optionalString stdenv.hostPlatform.isILP32 " -DNS_PTR_LE_32=1" # See RNG_RandomUpdate() in drdbg.c
+  ;

  installPhase = ''
    runHook preInstall
--- a/pkgs/development/libraries/nv-codec-headers/11_x.nix
+++ b/pkgs/development/libraries/nv-codec-headers/11_x.nix
@ -5,12 +5,12 @@

 stdenv.mkDerivation rec {
  pname = "nv-codec-headers";
-  version = "11.1.5.1";
+  version = "11.1.5.2";

  src = fetchgit {
    url = "https://git.videolan.org/git/ffmpeg/nv-codec-headers.git";
    rev = "n${version}";
-    sha256 = "sha256-yTOKLjyYLxT/nI1FBOMwHpkDhfuua3+6Z5Mpb7ZrRhU=";
+    sha256 = "sha256-KzaqwpzISHB7tSTruynEOJmSlJnAFK2h7/cRI/zkNPk=";
  };

  makeFlags = [
--- a/pkgs/development/libraries/openfec/default.nix
+++ b/pkgs/development/libraries/openfec/default.nix
@ -27,6 +27,9 @@ stdenv.mkDerivation rec {
      find $dev/include -type f -a ! -iname '*.h' -delete

      install -D -m755 -t $out/lib ../bin/Release/libopenfec${so}
+    '' + lib.optionalString stdenv.isDarwin ''
+      install_name_tool -id $out/lib/libopenfec${so} $out/lib/libopenfec${so}
+    '' + ''
      ln -s libopenfec${so} $out/lib/libopenfec${so}.1
    '';

--- a/pkgs/development/libraries/openvdb/default.nix
+++ b/pkgs/development/libraries/openvdb/default.nix
@ -3,19 +3,29 @@
 stdenv.mkDerivation rec
 {
  pname = "openvdb";
-  version = "9.1.0";
+  version = "10.0.1";
+
+  outputs = [ "out" "dev" ];

  src = fetchFromGitHub {
-    owner = "dreamworksanimation";
+    owner = "AcademySoftwareFoundation";
    repo = "openvdb";
    rev = "v${version}";
-    sha256 = "sha256-OP1xCR1YW60125mhhrW5+8/4uk+EBGIeoWGEU9OiIGY=";
+    sha256 = "sha256-kaf5gpGYVWinmnRwR/IafE1SJcwmP2psfe/UZdtH1Og=";
  };

  nativeBuildInputs = [ cmake ];

  buildInputs = [ openexr boost tbb jemalloc c-blosc ilmbase ];

+  cmakeFlags = [ "-DOPENVDB_CORE_STATIC=OFF" ];
+
+  postFixup = ''
+    substituteInPlace $dev/lib/cmake/OpenVDB/FindOpenVDB.cmake \
+      --replace \''${OPENVDB_LIBRARYDIR} $out/lib \
+      --replace \''${OPENVDB_INCLUDEDIR} $dev/include
+  '';
+
  meta = with lib; {
    description = "An open framework for voxel";
    homepage = "https://www.openvdb.org";
--- a/pkgs/development/libraries/tkrzw/default.nix
+++ b/pkgs/development/libraries/tkrzw/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchurl, nimPackages }:

 stdenv.mkDerivation rec {
  pname = "tkrzw";
@ -19,6 +19,7 @@ stdenv.mkDerivation rec {

  doCheck = false; # memory intensive

+  passthru.tests.nim = nimPackages.tkrzw;
  meta = with lib; {
    description = "A set of implementations of DBM";
    homepage = "https://dbmx.net/tkrzw/";
--- a/pkgs/development/nim-packages/base32/default.nix
+++ b/pkgs/development/nim-packages/base32/default.nix
@ -0,0 +1,18 @@
+{ lib, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage rec {
+  pname = "base32";
+  version = "0.1.3";
+  src = fetchFromGitHub {
+    owner = "OpenSystemsLab";
+    repo = "${pname}.nim";
+    rev = version;
+    hash = "sha256-BsDly13xsY2bu4N9LGHB0OGej/JhAx3B01TDdF0M8Jk=";
+  };
+  doCheck = true;
+  meta = src.meta // {
+    description = "Base32 library for Nim";
+    maintainers = with lib.maintainers; [ ehmry ];
+    license = lib.licenses.mit;
+  };
+}
--- a/pkgs/development/nim-packages/cbor/default.nix
+++ b/pkgs/development/nim-packages/cbor/default.nix
@ -0,0 +1,21 @@
+{ lib, buildNimPackage, fetchFromSourcehut }:
+
+buildNimPackage rec {
+  pname = "cbor";
+  version = "20221007";
+  src = fetchFromSourcehut {
+    owner = "~ehmry";
+    repo = "nim_${pname}";
+    rev = version;
+    hash = "sha256-zFkYsXFRAiBrfz3VNML3l+rYrdJmczl0bfZcJSbHHbM=";
+  };
+  doCheck = true;
+  meta = with lib;
+    src.meta // {
+      description =
+        "Concise Binary Object Representation decoder and encoder (RFC8949)";
+      license = licenses.unlicense;
+      maintainers = [ maintainers.ehmry ];
+      mainProgram = "cbordiag";
+    };
+}
--- a/pkgs/development/nim-packages/nimSHA2/default.nix
+++ b/pkgs/development/nim-packages/nimSHA2/default.nix
@ -0,0 +1,18 @@
+{ lib, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage rec {
+  pname = "nimSHA2";
+  version = "unstable-2021-09-09";
+  src = fetchFromGitHub {
+    owner = "jangko";
+    repo = pname;
+    rev = "b8f666069dff1ed0c5142dd1ca692f0e71434716";
+    hash = "sha256-Wqb3mQ7638UOTze71mf6WMyGiw9qTwhbJiGGb+9OR2k=";
+  };
+  doCheck = true;
+  meta = src.meta // {
+    description = "Secure Hash Algorithm 2";
+    maintainers = with lib.maintainers; [ ehmry ];
+    license = lib.licenses.mit;
+  };
+}
--- a/pkgs/development/nim-packages/npeg/default.nix
+++ b/pkgs/development/nim-packages/npeg/default.nix
@ -0,0 +1,18 @@
+{ lib, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage rec {
+  pname = "npeg";
+  version = "1.0.1";
+  src = fetchFromGitHub {
+    owner = "zevv";
+    repo = pname;
+    rev = version;
+    hash = "sha256-EN3wTSa+WveO7V29A2lJgWLwIlHzQE8t7T2m4u7niMc=";
+  };
+  doCheck = true;
+  meta = src.meta // {
+    description = "NPeg is a pure Nim pattern matching library";
+    maintainers = with lib.maintainers; [ ehmry ];
+    license = lib.licenses.mit;
+  };
+}
--- a/pkgs/development/nim-packages/taps/default.nix
+++ b/pkgs/development/nim-packages/taps/default.nix
@ -0,0 +1,19 @@
+{ lib, buildNimPackage, fetchFromSourcehut, getdns }:
+
+buildNimPackage rec {
+  pname = "taps";
+  version = "20221228";
+  src = fetchFromSourcehut {
+    owner = "~ehmry";
+    repo = "nim_${pname}";
+    rev = version;
+    hash = "sha256-0EjMP5pIPJg4/3nzj6ECC68f709TS06OrJlTZ0tavEo=";
+  };
+  propagatedBuildInputs = [ getdns ];
+  doCheck = false;
+  meta = src.meta // {
+    description = "Transport Services Interface";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.ehmry ];
+  };
+}
--- a/Show more
+++ b/Show more