Merge master into haskell-updates

2022-01-04 00:08:21 +00:00 · 2022-01-04 00:08:21 +00:00 · 354eadb4b4
commit 354eadb4b4
parent 187ac25b8e 988f3adf00
241 changed files with 4423 additions and 6032 deletions
--- a/doc/build-aux/pandoc-filters/link-unix-man-references.lua
+++ b/doc/build-aux/pandoc-filters/link-unix-man-references.lua
@ -1,6 +1,5 @@
 --[[
-Turns a manpage reference into a link, when a mapping is defined
-in the unix-man-urls.lua file.
+Turns a manpage reference into a link, when a mapping is defined below.
 ]]

 local man_urls = {
--- a/doc/contributing/contributing-to-documentation.chapter.md
+++ b/doc/contributing/contributing-to-documentation.chapter.md
@ -55,7 +55,7 @@ Additionally, the following syntax extensions are currently used:
 - []{#ssec-contributing-markup-inline-roles}
  If you want to link to a man page, you can use `` {manpage}`nix.conf(5)` ``, which will turn into {manpage}`nix.conf(5)`.

-  The references will turn into links when a mapping exists in {file}`doc/build-aux/pandoc-filters/unix-man-urls.lua`.
+  The references will turn into links when a mapping exists in {file}`doc/build-aux/pandoc-filters/link-unix-man-references.lua`.

  This syntax is taken from [MyST](https://myst-parser.readthedocs.io/en/latest/syntax/syntax.html#roles-an-in-line-extension-point). Though, the feature originates from [reStructuredText](https://www.sphinx-doc.org/en/master/usage/restructuredtext/roles.html#role-manpage) with slightly different syntax.

--- a/doc/languages-frameworks/beam.section.md
+++ b/doc/languages-frameworks/beam.section.md
@ -280,6 +280,30 @@ mkShell {
 }
 ```

+### Using an overlay
+
+If you need to use an overlay to change some attributes of a derivation, e.g. if you need a bugfix from a version that is not yet available in nixpkgs, you can override attributes such as `version` (and the corresponding `sha256`) and then use this overlay in your development environment:
+
+#### `shell.nix`
+
+```nix
+let
+  elixir_1_13_1_overlay = (self: super: {
+      elixir_1_13 = super.elixir_1_13.override {
+        version = "1.13.1";
+        sha256 = "0z0b1w2vvw4vsnb99779c2jgn9bgslg7b1pmd9vlbv02nza9qj5p";
+      };
+    });
+  pkgs = import <nixpkgs> { overlays = [ elixir_1_13_1_overlay ]; };
+in
+with pkgs;
+mkShell {
+  buildInputs = [
+    elixir_1_13
+  ];
+}
+```
+
 #### Elixir - Phoenix project {#elixir---phoenix-project}

 Here is an example `shell.nix`.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -95,6 +95,12 @@
    githubId = 7414843;
    name = "Nicholas von Klitzing";
  };
+  _13r0ck = {
+    name = "Brock Szuszczewicz";
+    email = "bnr@tuta.io";
+    github = "13r0ck";
+    githubId = 58987761;
+  };
  _3noch = {
    email = "eacameron@gmail.com";
    github = "3noch";
@ -1888,6 +1894,13 @@
    githubId = 495429;
    name = "Claas Augner";
  };
+  cawilliamson = {
+    email = "home@chrisaw.com";
+    github = "cawilliamson";
+    githubId = 1141769;
+    matrix = "@cawilliamson:nixos.dev";
+    name = "Christopher A. Williamson";
+  };
  cbley = {
    email = "claudio.bley@gmail.com";
    github = "avdv";
@ -2081,12 +2094,6 @@
    githubId = 399718;
    name = "Chris Martin";
  };
-  chrisaw = {
-    email = "home@chrisaw.com";
-    github = "cawilliamson";
-    githubId = 1141769;
-    name = "Christopher A. Williamson";
-  };
  chrisjefferson = {
    email = "chris@bubblescope.net";
    github = "chrisjefferson";
@ -4759,6 +4766,12 @@
    github = "higebu";
    githubId = 733288;
  };
+  hiljusti = {
+    name = "J.R. Hill";
+    email = "hiljusti@so.dang.cool";
+    github = "hiljusti";
+    githubId = 17605298;
+  };
  hinton = {
    email = "t@larkery.com";
    name = "Tom Hinton";
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -59,6 +59,14 @@
          <link xlink:href="options.html#opt-virtualisation.docker.rootless.enable">virtualisation.docker.rootless.enable</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://conduit.rs/">matrix-conduit</link>,
+          a simple, fast and reliable chat server powered by matrix.
+          Available as
+          <link xlink:href="option.html#opt-services.matrix-conduit.enable">services.matrix-conduit</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <link xlink:href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html">filebeat</link>,
@ -67,6 +75,13 @@
          <link linkend="opt-services.filebeat.enable">services.filebeat</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://github.com/hifi/heisenbridge">heisenbridge</link>,
+          a bouncer-style Matrix IRC bridge. Available as
+          <link xlink:href="options.html#opt-services.heisenbridge.enable">services.heisenbridge</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <link xlink:href="https://github.com/ngoduykhanh/PowerDNS-Admin">PowerDNS-Admin</link>,
@ -288,7 +303,7 @@
      <listitem>
        <para>
          The option
-          <link linkend="opt-services.ssh.enableAskPassword">services.ssh.enableAskPassword</link>
+          <link linkend="opt-programs.ssh.enableAskPassword">programs.ssh.enableAskPassword</link>
          was added, decoupling the setting of
          <literal>SSH_ASKPASS</literal> from
          <literal>services.xserver.enable</literal>. This allows easy
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -21,8 +21,12 @@ In addition to numerous new and upgraded packages, this release has the followin
 - [aesmd](https://github.com/intel/linux-sgx#install-the-intelr-sgx-psw), the Intel SGX Architectural Enclave Service Manager. Available as [services.aesmd](#opt-services.aesmd.enable).
 - [rootless Docker](https://docs.docker.com/engine/security/rootless/), a `systemd --user` Docker service which runs without root permissions. Available as [virtualisation.docker.rootless.enable](options.html#opt-virtualisation.docker.rootless.enable).

+- [matrix-conduit](https://conduit.rs/), a simple, fast and reliable chat server powered by matrix. Available as [services.matrix-conduit](option.html#opt-services.matrix-conduit.enable).
+
 - [filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-overview.html), a lightweight shipper for forwarding and centralizing log data. Available as [services.filebeat](#opt-services.filebeat.enable).

+- [heisenbridge](https://github.com/hifi/heisenbridge), a bouncer-style Matrix IRC bridge. Available as [services.heisenbridge](options.html#opt-services.heisenbridge.enable).
+
 - [PowerDNS-Admin](https://github.com/ngoduykhanh/PowerDNS-Admin), a web interface for the PowerDNS server. Available at [services.powerdns-admin](options.html#opt-services.powerdns-admin.enable).

 - [maddy](https://maddy.email), a composable all-in-one mail server. Available as [services.maddy](options.html#opt-services.maddy.enable).
@ -108,7 +112,7 @@ In addition to numerous new and upgraded packages, this release has the followin
  will now correctly remove those domains during rebuild/renew.

 - The option
-  [services.ssh.enableAskPassword](#opt-services.ssh.enableAskPassword) was
+  [programs.ssh.enableAskPassword](#opt-programs.ssh.enableAskPassword) was
  added, decoupling the setting of `SSH_ASKPASS` from
  `services.xserver.enable`. This allows easy usage in non-X11 environments,
  e.g. Wayland.
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -296,7 +296,7 @@ in
      infinoted = 264;
      sickbeard = 265;
      headphones = 266;
-      couchpotato = 267;
+      # couchpotato = 267; # unused, removed 2022-01-01
      gogs = 268;
      #pdns-recursor = 269; # dynamically allocated as of 2020-20-18
      #kresd = 270; # switched to "knot-resolver" with dynamic ID
@ -603,7 +603,7 @@ in
      infinoted = 264;
      sickbeard = 265;
      headphones = 266;
-      couchpotato = 267;
+      # couchpotato = 267; # unused, removed 2022-01-01
      gogs = 268;
      #kresd = 270; # switched to "knot-resolver" with dynamic ID
      #rpc = 271; # unused
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -511,7 +511,6 @@
  ./services/misc/cpuminer-cryptonight.nix
  ./services/misc/cgminer.nix
  ./services/misc/confd.nix
-  ./services/misc/couchpotato.nix
  ./services/misc/dendrite.nix
  ./services/misc/devmon.nix
  ./services/misc/dictd.nix
@ -556,6 +555,7 @@
  ./services/misc/mame.nix
  ./services/misc/matrix-appservice-discord.nix
  ./services/misc/matrix-appservice-irc.nix
+  ./services/misc/matrix-conduit.nix
  ./services/misc/matrix-synapse.nix
  ./services/misc/mautrix-facebook.nix
  ./services/misc/mautrix-telegram.nix
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -20,6 +20,7 @@ with lib;
    (mkRemovedOptionModule [ "fonts" "fontconfig" "penultimate" ] "The corresponding package has removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "quagga" ] "the corresponding package has been removed from nixpkgs")
    (mkRemovedOptionModule [ "services" "chronos" ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "services" "couchpotato" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "deepin" ] "The corresponding packages were removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "firefox" "syncserver" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "services" "marathon" ] "The corresponding package was removed from nixpkgs.")
--- a/nixos/modules/services/backup/restic-rest-server.nix
+++ b/nixos/modules/services/backup/restic-rest-server.nix
@ -95,6 +95,10 @@ in
      };
    };

+    systemd.tmpfiles.rules = mkIf cfg.privateRepos [
+        "f ${cfg.dataDir}/.htpasswd 0700 restic restic -"
+    ];
+
    users.users.restic = {
      group = "restic";
      home = cfg.dataDir;
--- a/nixos/modules/services/games/minecraft-server.nix
+++ b/nixos/modules/services/games/minecraft-server.nix
@ -182,6 +182,27 @@ in {
        Restart = "always";
        User = "minecraft";
        WorkingDirectory = cfg.dataDir;
+        # Hardening
+        CapabilityBoundingSet = [ "" ];
+        DeviceAllow = [ "" ];
+        LockPersonality = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        UMask = "0077";
      };

      preStart = ''
--- a/nixos/modules/services/logging/logrotate.nix
+++ b/nixos/modules/services/logging/logrotate.nix
@ -4,8 +4,9 @@ with lib;

 let
  cfg = config.services.logrotate;
+  inherit (config.users) groups;

-  pathOpts = {
+  pathOpts = { name, ... }:  {
    options = {
      enable = mkOption {
        type = types.bool;
@ -16,10 +17,19 @@ let
        '';
      };

-      path = mkOption {
+      name = mkOption {
        type = types.str;
+        internal = true;
+      };
+
+      path = mkOption {
+        type = with types; either str (listOf str);
+        default = name;
+        defaultText = "attribute name";
        description = ''
          The path to log files to be rotated.
+          Spaces are allowed and normal shell quoting rules apply,
+          with ', ", and \ characters supported.
        '';
      };

@ -74,6 +84,7 @@ let
      };
    };

+    config.name = name;
    config.extraConfig = ''
      missingok
      notifempty
@ -82,7 +93,7 @@ let

  mkConf = pathOpts: ''
    # generated by NixOS using the `services.logrotate.paths.${pathOpts.name}` attribute set
-    "${pathOpts.path}" {
+    ${concatMapStringsSep " " (path: ''"${path}"'') (toList pathOpts.path)} {
      ${optionalString (pathOpts.user != null || pathOpts.group != null) "su ${pathOpts.user} ${pathOpts.group}"}
      ${pathOpts.frequency}
      rotate ${toString pathOpts.keep}
@ -90,7 +101,7 @@ let
    }
  '';

-  paths = sortProperties (mapAttrsToList (name: pathOpts: pathOpts // { name = name; }) (filterAttrs (_: pathOpts: pathOpts.enable) cfg.paths));
+  paths = sortProperties (attrValues (filterAttrs (_: pathOpts: pathOpts.enable) cfg.paths));
  configFile = pkgs.writeText "logrotate.conf" (concatStringsSep "\n" ((map mkConf paths) ++ [ cfg.extraConfig ]));

 in
@ -152,17 +163,34 @@ in
      }
    ) cfg.paths;

+    services.logrotate = {
+      paths = {
+        "/var/log/btmp" = {
+          frequency = mkDefault "monthly";
+          keep = mkDefault 1;
+          extraConfig = ''
+            create 0660 root ${groups.utmp.name}
+          '';
+        };
+        "/var/log/wtmp" = {
+          frequency = mkDefault "monthly";
+          keep = mkDefault 1;
+          extraConfig = ''
+            create 0664 root ${groups.utmp.name}
+          '';
+        };
+      };
+    };
+
    systemd.services.logrotate = {
      description = "Logrotate Service";
      wantedBy = [ "multi-user.target" ];
      startAt = "hourly";
-      script = ''
-        exec ${pkgs.logrotate}/sbin/logrotate ${configFile}
-      '';

      serviceConfig = {
        Restart = "no";
        User = "root";
+        ExecStart = "${pkgs.logrotate}/sbin/logrotate ${configFile}";
      };
    };
  };
--- a/nixos/modules/services/misc/couchpotato.nix
+++ b/nixos/modules/services/misc/couchpotato.nix
@ -1,42 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-let
-  cfg = config.services.couchpotato;
-
-in
-{
-  options = {
-    services.couchpotato = {
-      enable = mkEnableOption "CouchPotato Server";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    systemd.services.couchpotato = {
-      description = "CouchPotato Server";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-
-      serviceConfig = {
-        Type = "simple";
-        User = "couchpotato";
-        Group = "couchpotato";
-        StateDirectory = "couchpotato";
-        ExecStart = "${pkgs.couchpotato}/bin/couchpotato";
-        Restart = "on-failure";
-      };
-    };
-
-    users.users.couchpotato =
-      { group = "couchpotato";
-        home = "/var/lib/couchpotato/";
-        description = "CouchPotato daemon user";
-        uid = config.ids.uids.couchpotato;
-      };
-
-    users.groups.couchpotato =
-      { gid = config.ids.gids.couchpotato; };
-  };
-}
--- a/nixos/modules/services/misc/heisenbridge.nix
+++ b/nixos/modules/services/misc/heisenbridge.nix
@ -0,0 +1,208 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.heisenbridge;
+
+  pkg = config.services.heisenbridge.package;
+  bin = "${pkg}/bin/heisenbridge";
+
+  jsonType = (pkgs.formats.json { }).type;
+
+  registrationFile = "/var/lib/heisenbridge/registration.yml";
+  # JSON is a proper subset of YAML
+  bridgeConfig = builtins.toFile "heisenbridge-registration.yml" (builtins.toJSON {
+    id = "heisenbridge";
+    url = cfg.registrationUrl;
+    # Don't specify as_token and hs_token
+    rate_limited = false;
+    sender_localpart = "heisenbridge";
+    namespaces = cfg.namespaces;
+  });
+in
+{
+  options.services.heisenbridge = {
+    enable = mkEnableOption "the Matrix<->IRC bridge";
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.heisenbridge;
+      defaultText = "pkgs.heisenbridge";
+      example = "pkgs.heisenbridge.override { … = …; }";
+      description = ''
+        Package of the application to run, exposed for overriding purposes.
+      '';
+    };
+
+    homeserver = mkOption {
+      type = types.str;
+      description = "The URL to the home server for client-server API calls";
+      example = "http://localhost:8008";
+    };
+
+    registrationUrl = mkOption {
+      type = types.str;
+      description = ''
+        The URL where the application service is listening for HS requests, from the Matrix HS perspective.#
+        The default value assumes the bridge runs on the same host as the home server, in the same network.
+      '';
+      example = "https://matrix.example.org";
+      default = "http://${cfg.address}:${toString cfg.port}";
+      defaultText = "http://$${cfg.address}:$${toString cfg.port}";
+    };
+
+    address = mkOption {
+      type = types.str;
+      description = "Address to listen on. IPv6 does not seem to be supported.";
+      default = "127.0.0.1";
+      example = "0.0.0.0";
+    };
+
+    port = mkOption {
+      type = types.port;
+      description = "The port to listen on";
+      default = 9898;
+    };
+
+    debug = mkOption {
+      type = types.bool;
+      description = "More verbose logging. Recommended during initial setup.";
+      default = false;
+    };
+
+    owner = mkOption {
+      type = types.nullOr types.str;
+      description = ''
+        Set owner MXID otherwise first talking local user will claim the bridge
+      '';
+      default = null;
+      example = "@admin:example.org";
+    };
+
+    namespaces = mkOption {
+      description = "Configure the 'namespaces' section of the registration.yml for the bridge and the server";
+      # TODO link to Matrix documentation of the format
+      type = types.submodule {
+        freeformType = jsonType;
+      };
+
+      default = {
+        users = [
+          {
+            regex = "@irc_.*";
+            exclusive = true;
+          }
+        ];
+        aliases = [ ];
+        rooms = [ ];
+      };
+    };
+
+    identd.enable = mkEnableOption "identd service support";
+    identd.port = mkOption {
+      type = types.port;
+      description = "identd listen port";
+      default = 113;
+    };
+
+    extraArgs = mkOption {
+      type = types.listOf types.str;
+      description = "Heisenbridge is configured over the command line. Append extra arguments here";
+      default = [ ];
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.heisenbridge = {
+      description = "Matrix<->IRC bridge";
+      before = [ "matrix-synapse.service" ]; # So the registration file can be used by Synapse
+      wantedBy = [ "multi-user.target" ];
+
+      preStart = ''
+        umask 077
+        set -e -u -o pipefail
+
+        if ! [ -f "${registrationFile}" ]; then
+          # Generate registration file if not present (actually, we only care about the tokens in it)
+          ${bin} --generate --config ${registrationFile}
+        fi
+
+        # Overwrite the registration file with our generated one (the config may have changed since then),
+        # but keep the tokens. Two step procedure to be failure safe
+        ${pkgs.yq}/bin/yq --slurp \
+          '.[0] + (.[1] | {as_token, hs_token})' \
+          ${bridgeConfig} \
+          ${registrationFile} \
+          > ${registrationFile}.new
+        mv -f ${registrationFile}.new ${registrationFile}
+
+        # Grant Synapse access to the registration
+        if ${getBin pkgs.glibc}/bin/getent group matrix-synapse > /dev/null; then
+          chgrp -v matrix-synapse ${registrationFile}
+          chmod -v g+r ${registrationFile}
+        fi
+      '';
+
+      serviceConfig = rec {
+        Type = "simple";
+        ExecStart = lib.concatStringsSep " " (
+          [
+            bin
+            (if cfg.debug then "-vvv" else "-v")
+            "--config"
+            registrationFile
+            "--listen-address"
+            (lib.escapeShellArg cfg.address)
+            "--listen-port"
+            (toString cfg.port)
+          ]
+          ++ (lib.optionals (cfg.owner != null) [
+            "--owner"
+            (lib.escapeShellArg cfg.owner)
+          ])
+          ++ (lib.optionals cfg.identd.enable [
+            "--identd"
+            "--identd-port"
+            (toString cfg.identd.port)
+          ])
+          ++ [
+            (lib.escapeShellArg cfg.homeserver)
+          ]
+          ++ (map (lib.escapeShellArg) cfg.extraArgs)
+        );
+
+        ProtectHome = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        StateDirectory = "heisenbridge";
+        StateDirectoryMode = "755";
+
+        User = "heisenbridge";
+        Group = "heisenbridge";
+
+        CapabilityBoundingSet = [ "CAP_CHOWN" ] ++ optional (cfg.port < 1024 || cfg.identd.port < 1024) "CAP_NET_BIND_SERVICE";
+        AmbientCapabilities = CapabilityBoundingSet;
+        NoNewPrivileges = true;
+
+        LockPersonality = true;
+        RestrictRealtime = true;
+        PrivateMounts = true;
+        SystemCallFilter = "~@aio @clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @raw-io @setuid @swap";
+        SystemCallArchitectures = "native";
+        RestrictAddressFamilies = "AF_INET AF_INET6";
+      };
+    };
+
+    users.groups.heisenbridge = {};
+    users.users.heisenbridge = {
+      description = "Service user for the Heisenbridge";
+      group = "heisenbridge";
+      isSystemUser = true;
+    };
+  };
+
+  meta.maintainers = [ lib.maintainers.piegames ];
+}
--- a/nixos/modules/services/misc/matrix-conduit.nix
+++ b/nixos/modules/services/misc/matrix-conduit.nix
@ -0,0 +1,140 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.matrix-conduit;
+
+  format = pkgs.formats.toml {};
+  configFile = format.generate "conduit.toml" cfg.settings;
+in
+  {
+    meta.maintainers = with maintainers; [ pstn piegames ];
+    options.services.matrix-conduit = {
+      enable = mkEnableOption "matrix-conduit";
+
+      extraEnvironment = mkOption {
+        type = types.attrsOf types.str;
+        description = "Extra Environment variables to pass to the conduit server.";
+        default = {};
+        example = { RUST_BACKTRACE="yes"; };
+      };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.matrix-conduit;
+        defaultText = "pkgs.matrix-conduit";
+        example = "pkgs.matrix-conduit";
+        description = ''
+          Package of the conduit matrix server to use.
+        '';
+      };
+
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = format.type;
+          options = {
+            global.server_name = mkOption {
+              type = types.str;
+              example = "example.com";
+              description = "The server_name is the name of this server. It is used as a suffix for user # and room ids.";
+            };
+            global.port = mkOption {
+              type = types.port;
+              default = 6167;
+              description = "The port Conduit will be running on. You need to set up a reverse proxy in your web server (e.g. apache or nginx), so all requests to /_matrix on port 443 and 8448 will be forwarded to the Conduit instance running on this port";
+            };
+            global.max_request_size = mkOption {
+              type = types.ints.positive;
+              default = 20000000;
+              description = "Max request size in bytes. Don't forget to also change it in the proxy.";
+            };
+            global.allow_registration = mkOption {
+              type = types.bool;
+              default = false;
+              description = "Whether new users can register on this server.";
+            };
+            global.allow_encryption = mkOption {
+              type = types.bool;
+              default = true;
+              description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work.";
+            };
+            global.allow_federation = mkOption {
+              type = types.bool;
+              default = true;
+              description = ''
+                Whether this server federates with other servers.
+              '';
+            };
+            global.trusted_servers = mkOption {
+              type = types.listOf types.str;
+              default = [ "matrix.org" ];
+              description = "Servers trusted with signing server keys.";
+            };
+            global.address = mkOption {
+              type = types.str;
+              default = "::1";
+              description = "Address to listen on for connections by the reverse proxy/tls terminator.";
+            };
+            global.database_path = mkOption {
+              type = types.str;
+              default = "/var/lib/matrix-conduit/";
+              readOnly = true;
+              description = ''
+                Path to the conduit database, the directory where conduit will save its data.
+                Note that due to using the DynamicUser feature of systemd, this value should not be changed
+                and is set to be read only.
+              '';
+            };
+          };
+        };
+        default = {};
+        description = ''
+            Generates the conduit.toml configuration file. Refer to
+            <link xlink:href="https://gitlab.com/famedly/conduit/-/blob/master/conduit-example.toml"/>
+            for details on supported values.
+            Note that database_path can not be edited because the service's reliance on systemd StateDir.
+        '';
+      };
+    };
+
+    config = mkIf cfg.enable {
+      systemd.services.conduit = {
+        description = "Conduit Matrix Server";
+        documentation = [ "https://gitlab.com/famedly/conduit/" ];
+        wantedBy = [ "multi-user.target" ];
+        environment = lib.mkMerge ([
+          { CONDUIT_CONFIG = configFile; }
+          cfg.extraEnvironment
+        ]);
+        serviceConfig = {
+          DynamicUser = true;
+          User = "conduit";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          PrivateDevices = true;
+          PrivateMounts = true;
+          PrivateUsers = true;
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+          ];
+          StateDirectory = "matrix-conduit";
+          ExecStart = "${cfg.package}/bin/conduit";
+          Restart = "on-failure";
+          RestartSec = 10;
+          StartLimitBurst = 5;
+        };
+      };
+    };
+  }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -260,6 +260,7 @@ in
  mariadb-galera-rsync = handleTest ./mysql/mariadb-galera-rsync.nix {};
  matomo = handleTest ./matomo.nix {};
  matrix-appservice-irc = handleTest ./matrix-appservice-irc.nix {};
+  matrix-conduit = handleTest ./matrix-conduit.nix {};
  matrix-synapse = handleTest ./matrix-synapse.nix {};
  mattermost = handleTest ./mattermost.nix {};
  mediawiki = handleTest ./mediawiki.nix {};
@ -280,6 +281,13 @@ in
  mosquitto = handleTest ./mosquitto.nix {};
  mpd = handleTest ./mpd.nix {};
  mpv = handleTest ./mpv.nix {};
+  mtp = let
+    olderQemu = (import (fetchTarball {
+      url = "https://github.com/nixos/nixpkgs/archive/e1fc1a80a071c90ab65fb6eafae5520579163783.tar.gz";
+      sha256 = "19a0qrx31lp2r8cgk9hv4p6j6six6l82qisxr68y7wb7drw7dhkz";
+    }) { inherit system; }).qemu_test;
+    myPkgs = import ../.. { inherit system; overlays = [ (self: super: { qemu_test = olderQemu; }) ]; };
+  in handleTest ./mtp.nix { pkgs = myPkgs; };
  mumble = handleTest ./mumble.nix {};
  musescore = handleTest ./musescore.nix {};
  munin = handleTest ./munin.nix {};
--- a/nixos/tests/matrix-conduit.nix
+++ b/nixos/tests/matrix-conduit.nix
@ -0,0 +1,95 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+  let
+    name = "conduit";
+  in
+  {
+    nodes = {
+      conduit = args: {
+        services.matrix-conduit = {
+          enable = true;
+          settings.global.server_name = name;
+          settings.global.allow_registration = true;
+          extraEnvironment.RUST_BACKTRACE = "yes";
+        };
+        services.nginx = {
+          enable = true;
+          virtualHosts.${name} = {
+            enableACME = false;
+            forceSSL = false;
+            enableSSL = false;
+
+            locations."/_matrix" = {
+              proxyPass = "http://[::1]:6167";
+            };
+          };
+        };
+        networking.firewall.allowedTCPPorts = [ 80 ];
+      };
+      client = { pkgs, ... }: {
+        environment.systemPackages = [
+          (
+            pkgs.writers.writePython3Bin "do_test"
+              { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
+              import asyncio
+
+              from nio import AsyncClient
+
+
+              async def main() -> None:
+                  # Connect to conduit
+                  client = AsyncClient("http://conduit:80", "alice")
+
+                  # Register as user alice
+                  response = await client.register("alice", "my-secret-password")
+
+                  # Log in as user alice
+                  response = await client.login("my-secret-password")
+
+                  # Create a new room
+                  response = await client.room_create(federate=False)
+                  room_id = response.room_id
+
+                  # Join the room
+                  response = await client.join(room_id)
+
+                  # Send a message to the room
+                  response = await client.room_send(
+                      room_id=room_id,
+                      message_type="m.room.message",
+                      content={
+                          "msgtype": "m.text",
+                          "body": "Hello conduit!"
+                      }
+                  )
+
+                  # Sync responses
+                  response = await client.sync(timeout=30000)
+
+                  # Check the message was received by conduit
+                  last_message = response.rooms.join[room_id].timeline.events[-1].body
+                  assert last_message == "Hello conduit!"
+
+                  # Leave the room
+                  response = await client.room_leave(room_id)
+
+                  # Close the client
+                  await client.close()
+
+              asyncio.get_event_loop().run_until_complete(main())
+            ''
+          )
+        ];
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      with subtest("start conduit"):
+            conduit.wait_for_unit("conduit.service")
+            conduit.wait_for_open_port(80)
+
+      with subtest("ensure messages can be exchanged"):
+            client.succeed("do_test")
+    '';
+  })
--- a/nixos/tests/mtp.nix
+++ b/nixos/tests/mtp.nix
@ -0,0 +1,108 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "mtp";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ matthewcroughan nixinator ];
+  };
+
+  nodes =
+  {
+    client = { config, pkgs, ... }: {
+      # DBUS runs only once a user session is created, which means a user has to
+      # login. Here, we log in as root. Once logged in, the gvfs-daemon service runs
+      # as UID 0 in User-0.service
+      services.getty.autologinUser = "root";
+
+      # XDG_RUNTIME_DIR is needed for running systemd-user services such as
+      # gvfs-daemon as root.
+      environment.variables.XDG_RUNTIME_DIR = "/run/user/0";
+
+      environment.systemPackages = with pkgs; [ usbutils glib jmtpfs tree ];
+      services.gvfs.enable = true;
+
+      # Creates a usb-mtp device inside the VM, which is mapped to the host's
+      # /tmp folder, it is able to write files to this location, but only has
+      # permissions to read its own creations.
+      virtualisation.qemu.options = [
+        "-usb"
+        "-device usb-mtp,rootdir=/tmp,readonly=false"
+      ];
+    };
+  };
+
+
+  testScript = { nodes, ... }:
+    let
+      # Creates a list of QEMU MTP devices matching USB ID (46f4:0004). This
+      # value can be sourced in a shell script. This is so we can loop over the
+      # devices we find, as this test may want to use more than one MTP device
+      # in future.
+      mtpDevices = pkgs.writeScript "mtpDevices.sh" ''
+        export mtpDevices=$(lsusb -d 46f4:0004 | awk {'print $2","$4'} | sed 's/[:-]/ /g')
+      '';
+      # Qemu is only capable of creating an MTP device with Picture Transfer
+      # Protocol. This means that gvfs must use gphoto2:// rather than mtp://
+      # when mounting.
+      # https://github.com/qemu/qemu/blob/970bc16f60937bcfd334f14c614bd4407c247961/hw/usb/dev-mtp.c#L278
+      gvfs = rec {
+        mountAllMtpDevices = pkgs.writeScript "mountAllMtpDevices.sh" ''
+          set -e
+          source ${mtpDevices}
+          for i in $mtpDevices
+          do
+            gio mount "gphoto2://[usb:$i]/"
+          done
+        '';
+        unmountAllMtpDevices = pkgs.writeScript "unmountAllMtpDevices.sh" ''
+          set -e
+          source ${mtpDevices}
+          for i in $mtpDevices
+          do
+            gio mount -u "gphoto2://[usb:$i]/"
+          done
+        '';
+        # gvfsTest:
+        # 1. Creates a 10M test file
+        # 2. Copies it to the device using GIO tools
+        # 3. Checks for corruption with `diff`
+        # 4. Removes the file, then unmounts the disks.
+        gvfsTest = pkgs.writeScript "gvfsTest.sh" ''
+          set -e
+          source ${mtpDevices}
+          ${mountAllMtpDevices}
+          dd if=/dev/urandom of=testFile10M bs=1M count=10
+          for i in $mtpDevices
+          do
+            gio copy ./testFile10M gphoto2://[usb:$i]/
+            ls -lah /run/user/0/gvfs/*/testFile10M
+            gio remove gphoto2://[usb:$i]/testFile10M
+          done
+          ${unmountAllMtpDevices}
+        '';
+      };
+      jmtpfs = {
+        # jmtpfsTest:
+        # 1. Mounts the device on a dir named `phone` using jmtpfs
+        # 2. Puts the current Nixpkgs libmtp version into a file
+        # 3. Checks for corruption with `diff`
+        # 4. Prints the directory tree
+        jmtpfsTest = pkgs.writeScript "jmtpfsTest.sh" ''
+          mkdir phone
+          jmtpfs phone
+          echo "${pkgs.libmtp.version}" > phone/tmp/testFile
+          echo "${pkgs.libmtp.version}" > testFile
+          diff phone/tmp/testFile testFile
+          tree phone
+        '';
+      };
+    in
+    # Using >&2 allows the results of the scripts to be printed to the terminal
+    # when building this test with Nix. Scripts would otherwise complete
+    # silently.
+    ''
+    start_all()
+    client.wait_for_unit("multi-user.target")
+    client.wait_for_unit("dbus.service")
+    client.succeed("${gvfs.gvfsTest} >&2")
+    client.succeed("${jmtpfs.jmtpfsTest} >&2")
+  '';
+})
--- a/pkgs/applications/audio/gtklick/default.nix
+++ b/pkgs/applications/audio/gtklick/default.nix
@ -1,34 +0,0 @@
-{ lib, fetchurl, python2Packages, gettext, klick}:
-
-python2Packages.buildPythonApplication rec {
-  pname = "gtklick";
-  version = "0.6.4";
-
-  src = fetchurl {
-    url = "http://das.nasophon.de/download/${pname}-${version}.tar.gz";
-    sha256 = "7799d884126ccc818678aed79d58057f8cf3528e9f1be771c3fa5b694d9d0137";
-  };
-
-  pythonPath = with python2Packages; [
-    pyliblo
-    pyGtkGlade
-  ];
-
-  nativeBuildInputs = [ gettext ];
-
-  propagatedBuildInputs = [ klick ];
-
-  # wrapPythonPrograms breaks gtklick in the postFixup phase.
-  # To fix it, apply wrapPythonPrograms and then clean up the wrapped file.
-  postFixup = ''
-    wrapPythonPrograms
-
-    sed -i "/import sys; sys.argv\[0\] = 'gtklick'/d" $out/bin/.gtklick-wrapped
-  '';
-
-  meta = {
-    homepage = "http://das.nasophon.de/gtklick/";
-    description = "Simple metronome with an easy-to-use GTK interface";
-    license = lib.licenses.gpl2Plus;
-  };
-}
--- a/pkgs/applications/audio/lastfmsubmitd/default.nix
+++ b/pkgs/applications/audio/lastfmsubmitd/default.nix
@ -1,21 +0,0 @@
-{ lib, fetchurl, python2Packages }:
-
-python2Packages.buildPythonApplication rec {
-  pname = "lastfmsubmitd";
-  version = "1.0.6";
-
-  src = fetchurl {
-    url = "https://www.red-bean.com/decklin/lastfmsubmitd/lastfmsubmitd-${version}.tar.gz";
-    sha256 = "c2636d5095a95167366bacd458624d67b046e060244fa54ba2c2e3efb79f9b0e";
-  };
-
-  doCheck = false;
-
-  installCommand = "python setup.py install --prefix=$out";
-
-  meta = {
-    homepage = "https://www.red-bean.com/decklin/lastfmsubmitd/";
-    license = lib.licenses.mit;
-    description = "An last.fm audio scrobbler and daemon";
-  };
-}
--- a/pkgs/applications/audio/mimms/default.nix
+++ b/pkgs/applications/audio/mimms/default.nix
@ -1,31 +0,0 @@
-{ fetchurl, lib, python2Packages, libmms }:
-
-python2Packages.buildPythonApplication rec {
-  pname = "mimms";
-  version = "3.2";
-
-  src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/mimms/mimms-${version}.tar.bz2";
-    sha256 = "0zmcd670mpq85cs3nvdq3i805ba0d1alqahfy1m9cpf7kxrivfml";
-  };
-
-  postInstall = ''
-    wrapProgram $out/bin/mimms \
-      --prefix LD_LIBRARY_PATH : ${libmms}/lib
-  '';
-
-  meta = {
-    homepage = "https://savannah.nongnu.org/projects/mimms/";
-    license = lib.licenses.gpl3;
-    description = "An mms (e.g. mms://) stream downloader";
-
-    longDescription = ''
-      mimms is a program designed to allow you to download streams
-      using the MMS protocol and save them to your computer, as
-      opposed to watching them live. Similar functionality is
-      available in full media player suites such as Xine, MPlayer,
-      and VLC, but mimms is quick and easy to use and, for the time
-      being, remains a useful program.
-    '';
-  };
-}
--- a/pkgs/applications/audio/setbfree/default.nix
+++ b/pkgs/applications/audio/setbfree/default.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation  rec {

  meta = with lib; {
    description = "A DSP tonewheel organ emulator";
-    homepage = "http://setbfree.org";
+    homepage = "https://setbfree.org";
    license = licenses.gpl2;
    platforms = [ "x86_64-linux" "i686-linux" ]; # fails on ARM and Darwin
    maintainers = [ maintainers.goibhniu ];
--- a/pkgs/applications/audio/spectmorph/default.nix
+++ b/pkgs/applications/audio/spectmorph/default.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Allows to analyze samples of musical instruments, and to combine them (morphing) to construct hybrid sounds";
-    homepage = "http://spectmorph.org";
+    homepage = "https://spectmorph.org";
    license = licenses.gpl3;
    platforms = [ "x86_64-linux" "i686-linux" ];
    maintainers = [ maintainers.magnetophon ];
--- a/pkgs/applications/blockchains/wasabibackend/create_deps.sh
+++ b/pkgs/applications/blockchains/wasabibackend/create_deps.sh
@ -1,98 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p dotnet-sdk_3 jq xmlstarlet curl nixpkgs-fmt
-set -euo pipefail
-
-# Run this script to generate deps.nix
-
-# TODO: consolidate with other dotnet deps generation scripts by which
-#       this script is inspired:
-#       - pkgs/servers/nosql/eventstore/create-deps.sh
-#       - pkgs/development/dotnet-modules/python-language-server/create_deps.sh
-#       - pkgs/misc/emulators/ryujinx/updater.sh
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-deps_file="$(realpath "./deps.nix")"
-
-exec 2>&1 6> "$deps_file"
-
-store_src="$( nix-build ../../../.. -A wasabibackend.src --no-out-link )"
-src="$(mktemp -d)"
-cp -rT "$store_src" "$src"
-chmod -R +w "$src"
-pushd "$src"
-
-URLBASE="https://www.nuget.org/api/v2/package"
-
-DEPS_HEADER="
-{ fetchurl }:
-let
-  nugetUrlBase = \"$URLBASE\";
-  fetchNuGet = { name, version, sha256 }: fetchurl {
-    inherit sha256;
-    url = \"\${nugetUrlBase}/\${name}/\${version}\";
-  };
-in ["
-
-DEPS_FOOTER="]"
-
-DEPS_TEMPLATE="
-(fetchNuGet {
-  name = \"%s\";
-  version = \"%s\";
-  sha256 = \"%s\";
-})"
-
-tmpdir="$(mktemp -d -p "$(pwd)")" # must be under source root
-trap 'rm -rf "$tmpdir"' EXIT
-
-HOME="$tmpdir" dotnet restore --packages "$tmpdir"/.nuget/packages \
-        --no-cache --force --runtime linux-x64 \
-        WalletWasabi.Backend/WalletWasabi.Backend.csproj >&2
-
-mapfile -t repos < <(
-    xmlstarlet sel -t -v 'configuration/packageSources/add/@value' -n NuGet.config "$tmpdir"/.nuget/NuGet/NuGet.Config |
-        while IFS= read index
-        do
-            curl --compressed -fsL "$index" | \
-                jq -r '.resources[] | select(."@type" == "PackageBaseAddress/3.0.0")."@id"'
-        done
-)
-
-echo $DEPS_HEADER >&6
-
-cd "$tmpdir/.nuget/packages"
-for package in *
-do
-    cd "$package"
-    for version in *
-    do
-        found=false
-        for repo in "${repos[@]}"
-        do
-            url="$repo$package/$version/$package.$version.nupkg"
-            if curl -fsL "$url" -o /dev/null
-            then
-                found=true
-                break
-            fi
-        done
-
-        if ! $found
-        then
-            echo "couldn't find $package $version" >&2
-            exit 1
-        fi
-
-        sha256=$(nix-prefetch-url "$url" 2>/dev/null)
-
-        printf "$DEPS_TEMPLATE" $package $version $sha256 >&6
-    done
-    cd ..
-done
-
-echo $DEPS_FOOTER >&6
-
-exec 6>&-
-
-nixpkgs-fmt "$deps_file"
--- a/pkgs/applications/blockchains/wasabibackend/default.nix
+++ b/pkgs/applications/blockchains/wasabibackend/default.nix
@ -1,95 +1,45 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, fetchurl
-, makeWrapper
-, Nuget
+, buildDotnetModule
 , dotnetCorePackages
-, openssl
+, autoPatchelfHook
 , zlib
+, openssl
 }:

-let
-  deps = import ./deps.nix { inherit fetchurl; };
-
-  dotnet-sdk = dotnetCorePackages.sdk_3_1;
-  dotnet-aspnetcore = dotnetCorePackages.aspnetcore_3_1;
-
-  nugetSource = stdenv.mkDerivation {
-    pname = "${pname}-nuget-deps";
-    inherit version;
-
-    dontUnpack = true;
-    dontInstall = true;
-
-    nativeBuildInputs = [ Nuget ];
-
-    buildPhase = ''
-      export HOME=$(mktemp -d)
-      mkdir -p $out/lib
-
-      nuget sources Disable -Name "nuget.org"
-      for package in ${toString deps}; do
-        nuget add $package -Source $out/lib
-      done
-    '';
-  };
-
-  pname = "WasabiBackend";
-  version = "1.1.12";
-
-  projectName = "WalletWasabi.Backend";
-  projectConfiguration = "Release";
-  projectRuntime = "linux-x64";
-in
-
-stdenv.mkDerivation rec {
-  inherit pname version;
+buildDotnetModule rec {
+  pname = "wasabibackend";
+  version = "1.1.13.0";

  src = fetchFromGitHub {
    owner = "zkSNACKs";
    repo = "WalletWasabi";
    rev = "v${version}";
-    sha256 = "001k43z2jxvs03csyzndlzlk034aclzc4n8ddrqxykgrq508xk1d";
+    sha256 = "sha256-zDOk8MurT5NXOr4kvm5mnsphY+eDFWuVBcpeTZpcHOo=";
  };

-  buildInputs = [
-    Nuget
-    dotnet-sdk
-    makeWrapper
-  ];
+  projectFile = "WalletWasabi.Backend/WalletWasabi.Backend.csproj";
+  nugetDeps = ./deps.nix;

-  buildPhase = ''
-    export HOME=$(mktemp -d)
-    export DOTNET_CLI_TELEMETRY_OPTOUT=1
-    export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
-    export DOTNET_ROOT="${dotnet-sdk}/bin"
+  dotnet-sdk = dotnetCorePackages.sdk_3_1;
+  dotnet-runtime = dotnetCorePackages.aspnetcore_3_1;

-    nuget sources Disable -Name "nuget.org"
+  nativeBuildInputs = [ autoPatchelfHook ];
+  buildInputs = [ stdenv.cc.cc.lib zlib ];

-    dotnet restore \
-      --source ${nugetSource}/lib \
-      --runtime ${projectRuntime} \
-      ${projectName}
+  runtimeDeps = [ openssl zlib ];

-    dotnet publish \
-      --no-restore \
-      --runtime ${projectRuntime} \
-      --configuration ${projectConfiguration} \
-      ${projectName}
+  preConfigure = ''
+    makeWrapperArgs+=(
+      --run "cd $out/lib/${pname}"
+    )
  '';

-  installPhase = ''
-    mkdir -p $out
-    cp -r ${projectName}/bin/${projectConfiguration}/netcoreapp3.1/${projectRuntime}/publish $out/lib
-    mkdir -p $out/bin
-    makeWrapper $out/lib/WalletWasabi.Backend $out/bin/${pname} \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ openssl zlib ]} \
-      --run "cd $out/lib"
+  postInstall = ''
+    mv $out/bin/WalletWasabi.Backend $out/bin/WasabiBackend
  '';

-  # If we don't disable stripping the executable fails to start with segfault
-  dontStrip = true;
-
  meta = with lib; {
    description = "Backend for the Wasabi Wallet";
    homepage = "https://wasabiwallet.io/";
--- a/pkgs/applications/blockchains/wasabibackend/deps.nix
+++ b/pkgs/applications/blockchains/wasabibackend/deps.nix
--- a/pkgs/applications/editors/manuskript/default.nix
+++ b/pkgs/applications/editors/manuskript/default.nix
@ -2,7 +2,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "manuskript";
-  version = "0.11.0";
+  version = "0.13.1";

  format = "other";

@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
    repo = pname;
    owner = "olivierkes";
    rev = version;
-    sha256 = "1l6l9k6k69yv8xqpll0zv9cwdqqg4zvxy90l6sx5nv2yywh5crla";
+    hash = "sha256-TEmAamNdqBK7bu62tLtJl05wBI6hga84PQSrWiMPROY=";
  };

  nativeBuildInputs = [ wrapQtAppsHook ];
@ -42,7 +42,7 @@ python3Packages.buildPythonApplication rec {

  meta = {
    description = "A open-source tool for writers";
-    homepage = "http://www.theologeek.ch/manuskript";
+    homepage = "https://www.theologeek.ch/manuskript";
    longDescription = ''
    Manuskript is a tool for those writer who like to organize and
    plan everything before writing.  The snowflake method can help you
--- a/pkgs/applications/editors/mg/default.nix
+++ b/pkgs/applications/editors/mg/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "mg";
-  version = "6.9";
+  version = "7.0";

  src = fetchFromGitHub {
    owner = "ibara";
    repo = "mg";
    rev = "mg-${version}";
-    sha256 = "1w49yb9v1657rv1w5w7rc9ih1d2vzv6ym3mzhf2wgmh04pdm6hid";
+    sha256 = "sha256-qnb0yB/NNJV257dsLmP84brajoRG03U+Ja1ACYbBvbE=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/misc/electrum/dash.nix
+++ b/pkgs/applications/misc/electrum/dash.nix
@ -1,47 +0,0 @@
-{ lib, fetchurl, python2Packages }:
-
-python2Packages.buildPythonApplication rec {
-  version = "2.9.3.1";
-  pname = "electrum-dash";
-
-  src = fetchurl {
-    url = "https://github.com/akhavr/electrum-dash/releases/download/${version}/Electrum-DASH-${version}.tar.gz";
-    #"https://github.com/dashpay/electrum-dash/releases/download/v${version}/Electrum-DASH-${version}.tar.gz";
-    sha256 = "9b7ac205f63fd4bfb15d77a34a4451ef82caecf096f31048a7603bd276dfc33e";
-  };
-
-  propagatedBuildInputs = with python2Packages; [
-    dnspython
-    ecdsa
-    pbkdf2
-    protobuf
-    pyasn1
-    pyasn1-modules
-    pycrypto
-    pyqt4
-    qrcode
-    requests
-    pyaes
-    tlslite-ng
-    x11_hash
-    mnemonic
-    jsonrpclib
-
-    # plugins
-    trezor
-  ];
-
-  preInstall = ''
-    mkdir -p $out/share
-    sed -i 's@usr_share = .*@usr_share = os.getenv("out")+"/share"@' setup.py
-    pyrcc4 icons.qrc -o gui/qt/icons_rc.py
-  '';
-
-  meta = with lib; {
-    description = "Electrum DASH";
-    homepage = "https://github.com/dashpay/electrum-dash";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ np ];
-    knownVulnerabilities = [ "CVE-2018-1000022" ];
-  };
-}
--- a/pkgs/applications/misc/fetchmail/default.nix
+++ b/pkgs/applications/misc/fetchmail/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "fetchmail";
-  version = "6.4.24";
+  version = "6.4.25";

  src = fetchurl {
    url = "mirror://sourceforge/fetchmail/fetchmail-${version}.tar.xz";
-    sha256 = "sha256-nJYd8lzZIvU5IYsLVqd+ekd3jkntkH7apbSUGtOyU88=";
+    sha256 = "sha256-fr776JFy/Vnw/YMX2HQ6hDbzdczcqzkA5MPsBqj78n8=";
  };

  buildInputs = [ openssl ];
--- a/pkgs/applications/misc/jquake/default.nix
+++ b/pkgs/applications/misc/jquake/default.nix
@ -57,7 +57,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Real-time earthquake map of Japan";
-    homepage = "http://jquake.net";
+    homepage = "https://jquake.net";
    downloadPage = "https://jquake.net/?down";
    changelog = "https://jquake.net/?docu";
    maintainers = with maintainers; [ nessdoor ];
--- a/pkgs/applications/misc/kanboard/default.nix
+++ b/pkgs/applications/misc/kanboard/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "kanboard";
-  version = "1.2.20";
+  version = "1.2.21";

  src = fetchFromGitHub {
    owner = "kanboard";
    repo = "kanboard";
    rev = "v${version}";
-    sha256 = "sha256-IB+GhUZvjngjf1UHKc7B/PkZHVXKYUTk6CVA5XSiF5Y=";
+    sha256 = "sha256-0CIemSdgNnYfpwZqfTerd/RZ+mYeFUWTE+v2hwu+9gI=";
  };

  dontBuild = true;
--- a/pkgs/applications/misc/megacmd/default.nix
+++ b/pkgs/applications/misc/megacmd/default.nix
@ -1,7 +1,7 @@
 { lib
 , stdenv
 , autoconf
-, automake
+, automake115x
 , c-ares
 , cryptopp
 , curl
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    autoconf
-    automake
+    automake115x
    libtool
    pkg-config
  ];
--- a/pkgs/applications/misc/sigi/default.nix
+++ b/pkgs/applications/misc/sigi/default.nix
@ -0,0 +1,24 @@
+{ lib, rustPlatform, fetchFromGitHub, testVersion, sigi }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "sigi";
+  version = "2.1.1";
+
+  src = fetchFromGitHub {
+    owner = "hiljusti";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-y0m1AQE5qoUfPZjJfo7w5h+zZ1pbz8FkLFDM13MTWvQ=";
+  };
+
+  cargoSha256 = "sha256-NTjL57Y1Uzk5F34BW3lB3xUpD60Opt0fGWuXHQU5L3g=";
+
+  passthru.tests.version = testVersion { package = sigi; };
+
+  meta = with lib; {
+    description = "CLI tool for organization and planning";
+    homepage = "https://github.com/hiljusti/sigi";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ hiljusti ];
+  };
+}
--- a/pkgs/applications/networking/browsers/chromium/update.py
+++ b/pkgs/applications/networking/browsers/chromium/update.py
@ -68,7 +68,8 @@ def get_matching_chromedriver(version):
        return {
            'version': chromedriver_version,
            'sha256_linux': nix_prefetch_url(get_chromedriver_url('linux64')),
-            'sha256_darwin': nix_prefetch_url(get_chromedriver_url('mac64'))
+            'sha256_darwin': nix_prefetch_url(get_chromedriver_url('mac64')),
+            'sha256_darwin_aarch64': nix_prefetch_url(get_chromedriver_url('mac64_m1'))
        }


--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -14,7 +14,8 @@
    "chromedriver": {
      "version": "96.0.4664.45",
      "sha256_linux": "15wybxlh38sw7f2bzalf9ivfp8262cpcvhq08nw9d2cj3j39f13m",
-      "sha256_darwin": "0r3b8wgbd8xjb09f4vc402gp77y2aqjk9hpqvvr6xgdr7nqym20f"
+      "sha256_darwin": "0r3b8wgbd8xjb09f4vc402gp77y2aqjk9hpqvvr6xgdr7nqym20f",
+      "sha256_darwin_aarch64": "1yynw8ngs2655blnf1s6r9flbxlwgaybdvgl6r6h7ppl974dl7rm"
    }
  },
  "beta": {
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -189,7 +189,7 @@ let
        ];
      };

-      nativeBuildInputs = [ makeWrapper lndir ];
+      nativeBuildInputs = [ makeWrapper lndir replace ];
      buildInputs = [ browser.gtk3 ];


@ -226,14 +226,14 @@ let
        cd "${browser}"

        find . -type l -print0 | while read -d $'\0' l; do
-          target="$(readlink "$l" | ${replace}/bin/replace-literal -es -- "${browser}" "$out")"
+          target="$(readlink "$l" | replace-literal -es -- "${browser}" "$out")"
          ln -sfT "$target" "$out/$l"
        done

        # This will not patch binaries, only "text" files.
        # Its there for the wrapper mostly.
        cd "$out"
-        ${replace}/bin/replace-literal -esfR -- "${browser}" "$out"
+        replace-literal -esfR -- "${browser}" "$out"

        # create the wrapper

--- a/pkgs/applications/networking/cluster/kube-capacity/default.nix
+++ b/pkgs/applications/networking/cluster/kube-capacity/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "kube-capacity";
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "robscott";
    repo = pname;
-    sha256 = "sha256-4UdNmuxJsPekA0y4mP302AYIFkG3ee3n99Redb/rPHw=";
+    sha256 = "sha256-rpCocokLj1iJonOt3rP+n1BpijjWlTie/a7vT2dMYnA=";
  };

-  vendorSha256 = "sha256-PQlOuBqn+b7fO9eHgtTAKxo3YdWmgbxx2JomklttCrM=";
+  vendorSha256 = "sha256-1D+nQ6WrHwJwcszCvoZ08SHX0anksdI69Jra5b9jPCY=";

  meta = with lib; {
    description =
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@ -1,6 +1,5 @@
 { lib
 , buildGoModule
-, buildGoPackage
 , fetchFromGitHub
 , callPackage
 , config
@ -11,13 +10,12 @@ let
  buildWithGoModule = data:
    buildGoModule {
      pname = data.repo;
-      version = data.version;
+      inherit (data) vendorSha256 version;
      subPackages = [ "." ];
      doCheck = false;
      src = fetchFromGitHub {
        inherit (data) owner repo rev sha256;
      };
-      vendorSha256 = data.vendorSha256 or null;
      deleteVendor = data.deleteVendor or false;
      proxyVendor = data.proxyVendor or false;

@ -27,32 +25,16 @@ let
      passthru = data;
    };

-  buildWithGoPackage = data:
-    buildGoPackage {
-      pname = data.repo;
-      version = data.version;
-      goPackagePath = "github.com/${data.owner}/${data.repo}";
-      subPackages = [ "." ];
-      doCheck = false;
-      src = fetchFromGitHub {
-        inherit (data) owner repo rev sha256;
-      };
-      # Terraform allow checking the provider versions, but this breaks
-      # if the versions are not provided via file paths.
-      postBuild = "mv $NIX_BUILD_TOP/go/bin/${data.repo}{,_v${data.version}}";
-      passthru = data;
-    };
-
  # Our generic constructor to build new providers
  mkProvider = attrs:
-    (if (lib.hasAttr "vendorSha256" attrs) then buildWithGoModule else buildWithGoPackage)
+    (if (lib.hasAttr "vendorSha256" attrs) then buildWithGoModule else throw /* added 2022/01 */ "vendorSha256 missing: please use `buildGoModule`")
      attrs;

  # These providers are managed with the ./update-all script
  automated-providers = lib.mapAttrs (_: attrs: mkProvider attrs) list;

  # These are the providers that don't fall in line with the default model
-  special-providers = let archived = throw "the provider has been archived by upsteam"; in {
+  special-providers = let archived = throw "the provider has been archived by upstream"; in {
    # Packages that don't fit the default model
    gandi = callPackage ./gandi { };
    libvirt = callPackage ./libvirt { };
@ -64,6 +46,7 @@ let
    chef = archived; # added 2022/01
    cherryservers = archived; # added 2022/01
    clc = archived; # added 2022/01
+    cloudstack = throw "removed from nixpkgs"; # added 2022/01
    cobbler = archived; # added 2022/01
    cohesity = archived; # added 2022/01
    dyn = archived; # added 2022/01
@ -86,10 +69,12 @@ let
    rancher = archived; # added 2022/01
    rightscale = archived; # added 2022/01
    runscope = archived; # added 2022/01
+    segment = throw "removed from nixpkgs"; # added 2022/01
    softlayer = archived; # added 2022/01
    telefonicaopencloud = archived; # added 2022/01
    terraform = archived; # added 2022/01
    ultradns = archived; # added 2022/01
+    vthunder = throw "provider was renamed to thunder"; # added 2022/01
  });
 in
 automated-providers // special-providers // { inherit mkProvider; }
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -153,6 +153,15 @@
    "vendorSha256": "07mznpp2mr1n9izgk2s8aibfvqsamj533666s46x1k49p0sh7lqx",
    "version": "2.0.6"
  },
+  "checkly": {
+    "owner": "checkly",
+    "provider-source-address": "registry.terraform.io/checkly/checkly",
+    "repo": "terraform-provider-checkly",
+    "rev": "v1.3.0",
+    "sha256": "11vwl983lh983c1x3f7zc8b7i9f4pymk4j1ikf04vz2kgxry49yr",
+    "vendorSha256": "14wp5sa2fm3hlmyacfy4aacx2cz5bxf24r4fjwd6f2hskzjz6825",
+    "version": "1.3.0"
+  },
  "checkpoint": {
    "deleteVendor": true,
    "owner": "CheckPointSW",
@ -208,13 +217,6 @@
    "vendorSha256": null,
    "version": "3.2.0"
  },
-  "cloudstack": {
-    "owner": "terraform-providers",
-    "repo": "terraform-provider-cloudstack",
-    "rev": "v0.3.0",
-    "sha256": "0zmyww6z3j839ydlmv254hr8gcsixng4lcvmiwkhxb3hj1nw8hcw",
-    "version": "0.3.0"
-  },
  "constellix": {
    "owner": "Constellix",
    "provider-source-address": "registry.terraform.io/Constellix/constellix",
@ -923,13 +925,6 @@
    "vendorSha256": null,
    "version": "1.2.0"
  },
-  "segment": {
-    "owner": "ajbosco",
-    "repo": "terraform-provider-segment",
-    "rev": "v0.2.0",
-    "sha256": "0ic5b9djhnb1bs2bz3zdprgy3r55dng09xgc4d9l9fyp85g2amaz",
-    "version": "0.2.0"
-  },
  "selectel": {
    "owner": "selectel",
    "provider-source-address": "registry.terraform.io/selectel/selectel",
@ -1047,6 +1042,15 @@
    "vendorSha256": "1g77ghz4928kfpidqd92cy6xkrqmz2y97x7g7lb55mw3mxg2bsx5",
    "version": "0.27.0"
  },
+  "thunder": {
+    "owner": "a10networks",
+    "provider-source-address": "registry.terraform.io/a10networks/thunder",
+    "repo": "terraform-provider-thunder",
+    "rev": "v0.5.21-beta",
+    "sha256": "1z52ifdi0nj3miwjz96zkmszh13l3vcbijgacfa28j2shasjyfwd",
+    "vendorSha256": null,
+    "version": "0.5.21-beta"
+  },
  "time": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/time",
@ -1148,13 +1152,6 @@
    "vendorSha256": null,
    "version": "2.0.2"
  },
-  "vthunder": {
-    "owner": "terraform-providers",
-    "repo": "terraform-provider-vthunder",
-    "rev": "v0.1.0",
-    "sha256": "1mw55g0kjgp300p6y4s8wc91fgfxjm0cbszfzgbc8ca4b00j8cc2",
-    "version": "0.1.0"
-  },
  "vultr": {
    "owner": "vultr",
    "provider-source-address": "registry.terraform.io/vultr/vultr",
--- a/pkgs/applications/networking/feedreaders/rawdog/default.nix
+++ b/pkgs/applications/networking/feedreaders/rawdog/default.nix
@ -1,26 +0,0 @@
-{ lib, fetchurl, python2Packages }:
-
-python2Packages.buildPythonApplication rec {
-  pname = "rawdog";
-  version = "2.23";
-
-  src = fetchurl {
-    url = "https://offog.org/files/${pname}-${version}.tar.gz";
-    sha256 = "18nyg19mwxyqdnykplkqmzb4n27vvrhvp639zai8f81gg9vdbsjp";
-  };
-
-  propagatedBuildInputs = with python2Packages; [ feedparser ];
-
-  # Requested by @SuperSandro20001
-  pythonImportsCheck = [ "feedparser" ];
-  doCheck = false;
-
-  namePrefix = "";
-
-  meta = with lib; {
-    homepage = "https://offog.org/code/rawdog/";
-    description = "RSS Aggregator Without Delusions Of Grandeur";
-    license = licenses.gpl2;
-    platforms = platforms.unix;
-  };
-}
--- a/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jitsi-meet-electron/default.nix
@ -4,6 +4,7 @@
 , makeWrapper
 , electron
 , xorg
+, pipewire
 }:

 stdenv.mkDerivation rec {
@ -45,7 +46,7 @@ stdenv.mkDerivation rec {
  postFixup = ''
    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
      --add-flags $out/share/${pname}/resources/app.asar \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc xorg.libXtst ]}"
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc xorg.libXtst pipewire ]}"
  '';

  meta = with lib; {
--- a/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix
+++ b/pkgs/applications/networking/instant-messengers/kdeltachat/default.nix
@ -14,13 +14,13 @@

 mkDerivation rec {
  pname = "kdeltachat";
-  version = "unstable-2021-11-14";
+  version = "unstable-2021-12-26";

  src = fetchFromSourcehut {
    owner = "~link2xt";
    repo = "kdeltachat";
-    rev = "796b5ce8a11e294e6325dbe92cd1834d140368ff";
-    hash = "sha256-Zjh83TrAm9pWieqz1e+Wzoy6g/xfsjhI/3Ll73iJoD4=";
+    rev = "aabe9421cb26f8e2537d49df5392e428bca8d72d";
+    hash = "sha256-5ql4KGMie9EbhHbPSNHIUQrvNpO//WgpTDIK6ETwdkg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/pybitmessage/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pybitmessage/default.nix
@ -1,40 +0,0 @@
-{ lib, fetchFromGitHub, python2Packages, openssl }:
-
-python2Packages.buildPythonApplication rec {
-  pname = "pybitmessage";
-
-  version = "0.6.3.2";
-
-  src = fetchFromGitHub {
-    owner = "bitmessage";
-    repo = "PyBitmessage";
-    rev = version;
-    sha256 = "1lmhbpwsqh1v93krlqqhafw2pc3y0qp8zby186yllbph6s8kdp35";
-  };
-
-  propagatedBuildInputs = with python2Packages; [ msgpack pyqt4 numpy pyopencl setuptools ] ++ [ openssl ];
-
-  preConfigure = ''
-    # Remove interaction and misleading output
-    substituteInPlace setup.py \
-      --replace "nothing = raw_input()" pass \
-      --replace 'print "It looks like building the package failed.\n" \' pass \
-      --replace '    "You may be missing a C++ compiler and the OpenSSL headers."' pass \
-      --replace 'msgpack-python' 'msgpack'
-
-    substituteInPlace src/pyelliptic/openssl.py \
-      --replace "libdir.append(find_library('ssl'))" "libdir.append('${openssl.out}/lib/libssl.so')"
-
-    substituteInPlace src/depends.py \
-      --replace "ctypes.util.find_library('ssl')" "'${openssl.out}/lib/libssl.so'"
-
-  '';
-
-  meta = with lib; {
-    homepage = "https://bitmessage.org/";
-    description = "The official Bitmessage client";
-    license = licenses.mit;
-    maintainers = with maintainers; [ jgillich ];
-    platforms = with platforms; linux;
-  };
-}
--- a/pkgs/applications/networking/instant-messengers/rambox/pro.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/pro.nix
@ -19,7 +19,7 @@ in mkRambox rec {
    description = "Messaging and emailing app that combines common web applications into one";
    homepage = "https://rambox.pro";
    license = licenses.unfree;
-    maintainers = with maintainers; [ chrisaw ];
+    maintainers = with maintainers; [ cawilliamson ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/networking/instant-messengers/viber/default.nix
+++ b/pkgs/applications/networking/instant-messengers/viber/default.nix
@ -99,7 +99,7 @@ stdenv.mkDerivation {
  dontPatchELF = true;

  meta = {
-    homepage = "http://www.viber.com";
+    homepage = "https://www.viber.com";
    description = "An instant messaging and Voice over IP (VoIP) app";
    license = lib.licenses.unfree;
    platforms = [ "x86_64-linux" ];
--- a/pkgs/applications/networking/remote/teamviewer/default.nix
+++ b/pkgs/applications/networking/remote/teamviewer/default.nix
@ -93,7 +93,7 @@ mkDerivation rec {
  preferLocalBuild = true;

  meta = with lib; {
-    homepage = "http://www.teamviewer.com";
+    homepage = "https://www.teamviewer.com";
    license = licenses.unfree;
    description = "Desktop sharing application, providing remote support and online meetings";
    platforms = [ "x86_64-linux" ];
--- a/pkgs/applications/office/gnucash/default.nix
+++ b/pkgs/applications/office/gnucash/default.nix
@ -26,11 +26,11 @@ in

 stdenv.mkDerivation rec {
  pname = "gnucash";
-  version = "4.8";
+  version = "4.9";

  src = fetchurl {
    url = "mirror://sourceforge/gnucash/${pname}-${version}.tar.bz2";
-    sha256 = "04pbgx08lfm3l46ndd28ivq5yp3y6zgalbzgi2x8w5inhgzy9f0m";
+    sha256 = "sha256-mlUcMMG3EhmfwiJ6EJr7mE177xjhOBcLvHIlxsH6ty0=";
  };

  nativeBuildInputs = [ pkg-config makeWrapper cmake gtest swig ];
--- a/pkgs/applications/office/keepnote/default.nix
+++ b/pkgs/applications/office/keepnote/default.nix
@ -1,23 +0,0 @@
-{ lib, fetchurl, python2Packages }:
-
-python2Packages.buildPythonApplication rec {
-  pname = "keepnote";
-  version = "0.7.8";
-  namePrefix = "";
-
-  src = fetchurl {
-    url = "http://keepnote.org/download/keepnote-${version}.tar.gz";
-    sha256 = "0nhkkv1n0lqf3zn17pxg5cgryv1wwlj4hfmhixwd76rcy8gs45dh";
-  };
-
-  propagatedBuildInputs = with python2Packages; [ pyGtkGlade ];
-
-  # Testing fails.
-  doCheck = false;
-
-  meta = {
-    description = "Note taking application";
-    homepage = "http://keepnote.org";
-    license = lib.licenses.gpl2Plus;
-  };
-}
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
      planning, requirements gathering, presentation of information, etc.
    '';

-    homepage    = "http://strlen.com/treesheets/";
+    homepage    = "https://strlen.com/treesheets/";
    maintainers = with maintainers; [ obadz avery ];
    platforms   = platforms.linux;
    license     = licenses.zlib;
--- a/pkgs/applications/science/biology/messer-slim/default.nix
+++ b/pkgs/applications/science/biology/messer-slim/default.nix
@ -1,14 +1,14 @@
 { lib, stdenv, fetchFromGitHub, cmake, gcc, gcc-unwrapped }:

 stdenv.mkDerivation rec {
-  version = "3.6";
+  version = "3.7";
  pname = "messer-slim";

  src = fetchFromGitHub {
    owner = "MesserLab";
    repo = "SLiM";
    rev = "v${version}";
-    sha256 = "sha256-TSbGUfr8YzTRYTkbMfM2+K04Z3h5W4jakw+V4axOKm8=";
+    sha256 = "sha256-YEIpdW7W/Dezezh9r6q0fLkF4zb+oH36bAZ/YYqkr8k=";
  };

  nativeBuildInputs = [ cmake gcc gcc-unwrapped ];
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "lean";
-  version = "3.35.0";
+  version = "3.35.1";

  src = fetchFromGitHub {
    owner  = "leanprover-community";
@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
    # from. this is then used to check whether an olean file should be
    # rebuilt. don't use a tag as rev because this will get replaced into
    # src/githash.h.in in preConfigure.
-    rev    = "a68d251bfc57341d8f1f6d8c6e548a0b08ff3b92";
-    sha256 = "0f91kvd4z7rsjyagfx56y1vxmf4wjds7bnz6yh3sd4xx770z58d4";
+    rev    = "4887d8a30621941c883f208e151e61ab268c006d";
+    sha256 = "0xmiysmq80dnzq1lw9jmprc85kfimw0sl8m5rbi05z8f782gzv1z";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/version-management/commitizen/default.nix
+++ b/pkgs/applications/version-management/commitizen/default.nix
@ -7,6 +7,7 @@ let
  };
 in
 nodePackages.commitizen.override {
+  name = "cz-cli";
  meta = with lib; {
    description = "The commitizen command line utility";
    homepage = "https://commitizen.github.io/cz-cli";
--- a/pkgs/applications/version-management/commitizen/generate-dependencies.sh
+++ b/pkgs/applications/version-management/commitizen/generate-dependencies.sh
--- a/pkgs/applications/version-management/commitizen/node-composition.nix
+++ b/pkgs/applications/version-management/commitizen/node-composition.nix
--- a/pkgs/applications/version-management/commitizen/node-env.nix
+++ b/pkgs/applications/version-management/commitizen/node-env.nix
--- a/pkgs/applications/version-management/commitizen/node-packages.nix
+++ b/pkgs/applications/version-management/commitizen/node-packages.nix
--- a/pkgs/applications/version-management/commitizen/package.json
+++ b/pkgs/applications/version-management/commitizen/package.json
--- a/pkgs/applications/version-management/git-and-tools/git-bz/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-bz/default.nix
@ -1,54 +0,0 @@
-{ lib, stdenv, fetchgit
-, asciidoc, docbook_xml_dtd_45, docbook_xsl, libxslt, makeWrapper, xmlto
-, python2Packages }:
-
-stdenv.mkDerivation {
-  pname = "git-bz";
-  version = "3.2015-09-08";
-
-  src = fetchgit {
-    sha256 = "146z57m8nblgsxm4z6qnsvcy81p11d0w88v93ybacc6w21plh8hc";
-    rev = "e17bbae7a2ce454d9f69c32fc40066995d44913d";
-    url = "git://git.fishsoup.net/git-bz";
-  };
-
-  nativeBuildInputs = [
-    asciidoc docbook_xml_dtd_45 docbook_xsl libxslt makeWrapper xmlto
-  ];
-  buildInputs = []
-    ++ (with python2Packages; [ python pysqlite ]);
-
-  postPatch = ''
-    patchShebangs configure
-
-    # Don't create a .html copy of the man page that isn't installed anyway:
-    substituteInPlace Makefile --replace "git-bz.html" ""
-  '';
-
-  postInstall = ''
-    wrapProgram $out/bin/git-bz \
-      --prefix PYTHONPATH : "$(toPythonPath "${python2Packages.pycrypto}")" \
-      --prefix PYTHONPATH : "$(toPythonPath "${python2Packages.pysqlite}")"
-  '';
-
-  meta = with lib; {
-    description = "Bugzilla integration for git";
-    longDescription = ''
-      git-bz is a tool for integrating the Git command line with the
-      Bugzilla bug-tracking system. Operations such as attaching patches to
-      bugs, applying patches in bugs to your current tree, and closing bugs
-      once you've pushed the fixes publicly can be done completely from
-      the command line without having to go to your web browser.
-
-      Authentication for git-bz is done by reading the cookies for the
-      Bugzilla host from your web browser. In order to do this, git-bz needs
-      to know how to access the cookies for your web browser; git-bz
-      currently is able to do this for Firefox, Epiphany, Galeon and
-      Chromium on Linux.
-    '';
-    license = licenses.gpl2Plus;
-    homepage = "http://git.fishsoup.net/cgit/git-bz/";
-
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/version-management/git-and-tools/subgit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/subgit/default.nix
@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "A tool for a smooth, stress-free SVN to Git migration";
    longDescription = "Create writable Git mirror of a local or remote Subversion repository and use both Subversion and Git as long as you like. You may also do a fast one-time import from Subversion to Git.";
-    homepage = "http://subgit.com";
+    homepage = "https://subgit.com";
    license = lib.licenses.unfree;
    platforms = lib.platforms.all;
  };
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@ -106,7 +106,7 @@ let
    meta = with lib; {
      description = "A version control system intended to be a compelling replacement for CVS in the open source community";
      license = licenses.asl20;
-      homepage = "http://subversion.apache.org/";
+      homepage = "https://subversion.apache.org/";
      maintainers = with maintainers; [ eelco lovek323 ];
      platforms = platforms.linux ++ platforms.darwin;
    };
--- a/pkgs/applications/video/kodi/addons/future/default.nix
+++ b/pkgs/applications/video/kodi/addons/future/default.nix
@ -0,0 +1,26 @@
+{ lib, buildKodiAddon, fetchzip, addonUpdateScript }:
+
+buildKodiAddon rec {
+  pname = "future";
+  namespace = "script.module.future";
+  version = "0.18.2+matrix.1";
+
+  src = fetchzip {
+    url = "https://mirrors.kodi.tv/addons/matrix/${namespace}/${namespace}-${version}.zip";
+    sha256 = "sha256-QBG7V70Dwmfq8ISILxGNvtmQT9fJp2e5gs2C9skRwIw=";
+  };
+
+  passthru = {
+    pythonPath = "lib";
+    updateScript = addonUpdateScript {
+      attrPath = "kodi.packages.future";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "http://python-future.org";
+    description = "The missing compatibility layer between Python 2 and Python 3";
+    license = licenses.mit;
+    maintainers = teams.kodi.members;
+  };
+}
--- a/pkgs/applications/video/kodi/addons/orftvthek/default.nix
+++ b/pkgs/applications/video/kodi/addons/orftvthek/default.nix
@ -0,0 +1,28 @@
+{ lib, buildKodiAddon, fetchFromGitHub, future, kodi-six, simplejson, inputstreamhelper }:
+
+buildKodiAddon rec {
+  pname = "orftvthek";
+  namespace = "plugin.video.orftvthek";
+  version = "0.12.3-1";
+
+  src = fetchFromGitHub {
+    owner = "s0faking";
+    repo = namespace;
+    rev = version;
+    sha256 = "sha256-+J1NtmjbDWtS8d4nO9P/lR5GNmvtc1YjTW+bulGaU2Q=";
+  };
+
+  propagatedBuildInputs = [
+    future
+    kodi-six
+    simplejson
+    inputstreamhelper
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/s0faking/plugin.video.orftvthek";
+    description = "An addon that gives you access to the ORF TVthek Video Platform";
+    license = licenses.gpl2Only;
+    maintainers = teams.kodi.members;
+  };
+}
--- a/pkgs/applications/video/kodi/addons/simplejson/default.nix
+++ b/pkgs/applications/video/kodi/addons/simplejson/default.nix
@ -0,0 +1,26 @@
+{ lib, buildKodiAddon, fetchzip, addonUpdateScript }:
+
+buildKodiAddon rec {
+  pname = "simplejson";
+  namespace = "script.module.simplejson";
+  version = "3.17.0+matrix.2";
+
+  src = fetchzip {
+    url = "https://mirrors.kodi.tv/addons/matrix/${namespace}/${namespace}-${version}.zip";
+    sha256 = "sha256-XLE4x0qr3CFwWqh1BfSg9q+w6pWgFBXG7TyVJWeGQIs=";
+  };
+
+  passthru = {
+    pythonPath = "lib";
+    updateScript = addonUpdateScript {
+      attrPath = "kodi.packages.simplejson";
+    };
+  };
+
+  meta = with lib; {
+    homepage = "https://github.com/simplejson/simplejson";
+    description = "Simple, fast, extensible JSON encoder/decoder for Python";
+    license = licenses.mit;
+    maintainers = teams.kodi.members;
+  };
+}
--- a/pkgs/applications/video/kodi/wrapper.nix
+++ b/pkgs/applications/video/kodi/wrapper.nix
@ -35,5 +35,11 @@ buildEnv {
          (lib.concatMap
            (plugin: plugin.extraRuntimeDependencies or []) addons)}"
    done
+
+    # makeWrapper just created webinterface.default as a symlink. However,
+    # kodi's webserver carefully refuses to follow symlinks, so we need to copy
+    # these assets instead.
+    rm $out/share/kodi/addons/webinterface.default
+    cp -r ${kodi}/share/kodi/addons/webinterface.default/ $out/share/kodi/addons/webinterface.default
  '';
 }
--- a/pkgs/applications/video/mkclean/default.nix
+++ b/pkgs/applications/video/mkclean/default.nix
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
    description = "Command line tool to clean and optimize Matroska (.mkv / .mka / .mks / .mk3d) and WebM (.webm / .weba) files that have already been muxed";
    homepage = "https://www.matroska.org";
    license = licenses.bsdOriginal;
-    maintainers = with maintainers; [ chrisaw ];
+    maintainers = with maintainers; [ cawilliamson ];
    platforms = [ "i686-linux" "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -81,7 +81,7 @@ let

 in stdenv.mkDerivation rec {
  pname = "mpv";
-  version = "0.34.0";
+  version = "0.34.1";

  outputs = [ "out" "dev" "man" ];

@ -89,7 +89,7 @@ in stdenv.mkDerivation rec {
    owner = "mpv-player";
    repo = "mpv";
    rev = "v${version}";
-    sha256 = "sha256-qa6xZV4aLcHBMa2bIqoKjte4+KWEGGZre4L0u1+eDE8=";
+    sha256 = "12qxwm1ww5vhjddl8yvj1xa0n1fi9z3lmzwhaiday2v59ca0qgsk";
  };

  postPatch = ''
--- a/pkgs/applications/video/obs-studio/plugins/obs-nvfbc.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-nvfbc.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "obs-nvfbc";
-  version = "0.0.4";
+  version = "0.0.5";

  src = fetchFromGitLab {
    owner = "fzwoch";
    repo = "obs-nvfbc";
    rev = "v${version}";
-    sha256 = "sha256-U/zma1BrOTRAJAYMOcmaeL0UqF3ihysDwceyeW1r0b8=";
+    sha256 = "sha256-Si+TGYWpNPtUUFT+M571lCYslPyeYX92MdYV9EGgcyQ=";
  };

  nativeBuildInputs = [ meson pkg-config ninja ];
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@ -1,28 +1,87 @@
-{ lib, stdenv, fetchurl, autoreconfHook, fetchpatch
-, libarchive, perl, xorg, libdvdnav, libbluray
-, zlib, a52dec, libmad, faad2, ffmpeg, alsa-lib
-, pkg-config, dbus, fribidi, freefont_ttf, libebml, libmatroska
-, libvorbis, libtheora, speex, lua5, libgcrypt, libgpg-error, libupnp
-, libcaca, libpulseaudio, flac, schroedinger, libxml2, librsvg
-, mpeg2dec, systemd, gnutls, avahi, libcddb, libjack2, SDL, SDL_image
-, libmtp, unzip, taglib, libkate, libtiger, libv4l, samba, libssh2, liboggz
-, libass, libva, libdvbpsi, libdc1394, libraw1394, libopus
-, libvdpau, libsamplerate, libspatialaudio, live555, fluidsynth
-, wayland, wayland-protocols, ncurses, srt
-, onlyLibVLC ? false
-, withQt5 ? true, qtbase, qtsvg, qtx11extras, wrapQtAppsHook
-, jackSupport ? false
-, skins2Support ? !onlyLibVLC, freetype
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, SDL
+, SDL_image
+, a52dec
+, alsa-lib
+, autoreconfHook
+, avahi
+, dbus
+, faad2
+, ffmpeg
+, flac
+, fluidsynth
+, freefont_ttf
+, fribidi
+, gnutls
+, libarchive
+, libass
+, libbluray
+, libcaca
+, libcddb
+, libdc1394
+, libdvbpsi
+, libdvdnav
+, libebml
+, libgcrypt
+, libgpg-error
+, libjack2
+, libkate
+, libmad
+, libmatroska
+, libmtp
+, liboggz
+, libopus
+, libpulseaudio
+, libraw1394
+, librsvg
+, libsamplerate
+, libspatialaudio
+, libssh2
+, libtheora
+, libtiger
+, libupnp
+, libv4l
+, libva
+, libvdpau
+, libvorbis
+, libxml2
+, live555
+, lua5
+, mpeg2dec
+, ncurses
+, perl
+, pkg-config
 , removeReferencesTo
-, chromecastSupport ? true, protobuf, libmicrodns
+, samba
+, schroedinger
+, speex
+, srt
+, systemd
+, taglib
+, unzip
+, wayland
+, wayland-protocols
+, xorg
+, zlib
+
+, chromecastSupport ? true, libmicrodns, protobuf
+, jackSupport ? false
+, onlyLibVLC ? false
+, skins2Support ? !onlyLibVLC, freetype
+, withQt5 ? true, qtbase, qtsvg, qtx11extras, wrapQtAppsHook
 }:

 # chromecastSupport requires TCP port 8010 to be open for it to work.
 # If your firewall is enabled, make sure to have something like:
 #   networking.firewall.allowedTCPPorts = [ 8010 ];

-with lib;
-
+let
+  inherit (lib) optionalString optional optionals;
+  hostIsAarch = stdenv.hostPlatform.isAarch32 || stdenv.hostPlatform.isAarch64;
+in
 stdenv.mkDerivation rec {
  pname = "${optionalString onlyLibVLC "lib"}vlc";
  version = "3.0.16";
@ -36,32 +95,95 @@ stdenv.mkDerivation rec {
  # which are not included here for no other reason that nobody has mentioned
  # needing them
  buildInputs = [
-    zlib a52dec libmad faad2 ffmpeg alsa-lib libdvdnav libdvdnav.libdvdread
-    libbluray dbus fribidi libvorbis libtheora speex lua5 libgcrypt libgpg-error
-    libupnp libcaca libpulseaudio flac schroedinger libxml2 librsvg mpeg2dec
-    systemd gnutls avahi libcddb SDL SDL_image libmtp taglib libarchive
-    libkate libtiger libv4l samba libssh2 liboggz libass libdvbpsi libva
-    xorg.xlibsWrapper xorg.libXv xorg.libXvMC xorg.libXpm xorg.xcbutilkeysyms
-    libdc1394 libraw1394 libopus libebml libmatroska libvdpau libsamplerate
-    libspatialaudio fluidsynth wayland wayland-protocols ncurses srt
-  ] ++ optional (!stdenv.hostPlatform.isAarch64 && !stdenv.hostPlatform.isAarch32) live555
-    ++ optionals withQt5    [ qtbase qtsvg qtx11extras ]
-    ++ optionals skins2Support (with xorg; [ libXpm freetype libXext libXinerama ])
-    ++ optional jackSupport libjack2
-    ++ optionals chromecastSupport [ protobuf libmicrodns ];
+    SDL
+    SDL_image
+    a52dec
+    alsa-lib
+    avahi
+    dbus
+    faad2
+    ffmpeg
+    flac
+    fluidsynth
+    fribidi
+    gnutls
+    libarchive
+    libass
+    libbluray
+    libcaca
+    libcddb
+    libdc1394
+    libdvbpsi
+    libdvdnav
+    libdvdnav.libdvdread
+    libebml
+    libgcrypt
+    libgpg-error
+    libkate
+    libmad
+    libmatroska
+    libmtp
+    liboggz
+    libopus
+    libpulseaudio
+    libraw1394
+    librsvg
+    libsamplerate
+    libspatialaudio
+    libssh2
+    libtheora
+    libtiger
+    libupnp
+    libv4l
+    libva
+    libvdpau
+    libvorbis
+    libxml2
+    lua5
+    mpeg2dec
+    ncurses
+    samba
+    schroedinger
+    speex
+    srt
+    systemd
+    taglib
+    wayland
+    wayland-protocols
+    zlib
+  ]
+  ++ (with xorg; [
+    libXpm
+    libXv
+    libXvMC
+    xcbutilkeysyms
+    xlibsWrapper
+  ])
+  ++ optional (!hostIsAarch) live555
+  ++ optional jackSupport libjack2
+  ++ optionals chromecastSupport [ libmicrodns protobuf ]
+  ++ optionals skins2Support (with xorg; [ freetype libXext libXinerama libXpm ])
+  ++ optionals withQt5 [ qtbase qtsvg qtx11extras ];

-  nativeBuildInputs = [ autoreconfHook perl pkg-config removeReferencesTo unzip ]
-    ++ optionals withQt5 [ wrapQtAppsHook ];
+  nativeBuildInputs = [
+    autoreconfHook
+    perl
+    pkg-config
+    removeReferencesTo
+    unzip
+  ]
+  ++ optionals withQt5 [ wrapQtAppsHook ];

  enableParallelBuilding = true;

-  LIVE555_PREFIX = if (!stdenv.hostPlatform.isAarch64 && !stdenv.hostPlatform.isAarch32) then live555 else null;
+  LIVE555_PREFIX = if hostIsAarch then null else live555;

  # vlc depends on a c11-gcc wrapper script which we don't have so we need to
  # set the path to the compiler
  BUILDCC = "${stdenv.cc}/bin/gcc";

  patches = [
+    # Required in order to run newer srt plugin. Remove it when next release arrives
    (fetchpatch {
      url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/4250fe8f28c220d883db454cec2b2c76a07473eb/trunk/vlc-3.0.11.1-srt_1.4.2.patch";
      sha256 = "53poWjZfwq/6l316sqiCp0AtcGweyXBntcLDFPSokHQ=";
@ -86,8 +208,8 @@ stdenv.mkDerivation rec {
  # Most of the libraries are auto-detected so we don't need to set a bunch of
  # "--enable-foo" flags here
  configureFlags = [
-    "--with-kde-solid=$out/share/apps/solid/actions"
    "--enable-srt" # Explicit enable srt to ensure the patch is applied.
+    "--with-kde-solid=$out/share/apps/solid/actions"
  ] ++ optional onlyLibVLC "--disable-vlc"
    ++ optional skins2Support "--enable-skins2"
    ++ optionals chromecastSupport [
@ -111,6 +233,7 @@ stdenv.mkDerivation rec {
    description = "Cross-platform media player and streaming server";
    homepage = "http://www.videolan.org/vlc/";
    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/window-managers/pekwm/default.nix
+++ b/pkgs/applications/window-managers/pekwm/default.nix
@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
        appear as they should when starting applications.
      - Chainable Keygrabber, usability for everyone.
    '';
-      homepage = "https://www.pekwm.org/";
+      homepage = "https://www.pekwm.se/";
      license = licenses.gpl2Plus;
      maintainers = [ maintainers.AndersonTorres ];
      platforms = platforms.linux;
--- a/pkgs/desktops/enlightenment/efl/default.nix
+++ b/pkgs/desktops/enlightenment/efl/default.nix
@ -56,11 +56,11 @@

 stdenv.mkDerivation rec {
  pname = "efl";
-  version = "1.25.1";
+  version = "1.26.0";

  src = fetchurl {
    url = "http://download.enlightenment.org/rel/libs/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0svybbrvpf6q955y6fclxh3md64z0dgmh0x54x2j60503hhs071m";
+    sha256 = "0k10mwpdjn57r2kflbzpybhvwl25yqqa2i2fhx0qazyjbzjbrad4";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/enlightenment/enlightenment/0001-wrapped-setuid-executables.patch
+++ b/pkgs/desktops/enlightenment/enlightenment/0001-wrapped-setuid-executables.patch
@ -1,4 +1,4 @@
-From a1e54ae0097a3b6a0dabf4639fe8bc594c4f602d Mon Sep 17 00:00:00 2001
+From 2c563889fcad37df4ee4251bf0a63316d8b7b612 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jos=C3=A9=20Romildo=20Malaquias?= <malaquias@gmail.com>
 Date: Thu, 14 May 2020 16:36:34 -0300
 Subject: [PATCH] wrapped setuid executables
@ -11,9 +11,9 @@ instead.
 meson/meson_inst.sh           | 4 ++--
 src/bin/e_auth.c              | 6 ++----
 src/bin/e_fm/e_fm_main_eeze.c | 6 +++---
- src/bin/e_start_main.c        | 2 +-
+ src/bin/e_start_main.c        | 3 +--
 src/bin/e_system.c            | 2 +-
- 5 files changed, 9 insertions(+), 11 deletions(-)
+ 5 files changed, 9 insertions(+), 12 deletions(-)

 diff --git a/meson/meson_inst.sh b/meson/meson_inst.sh
 index 321143e40..cd2399306 100755
@ -29,11 +29,11 @@ index 321143e40..cd2399306 100755
 +	echo TODO: chmod a=rx,u+xs "$DESTDIR/$x"
 done
 diff --git a/src/bin/e_auth.c b/src/bin/e_auth.c
-index 8b0aa6641..63c68c4bc 100644
+index 6d07a0ac3..d519f0649 100644
 --- a/src/bin/e_auth.c
 +++ b/src/bin/e_auth.c
-@@ -12,8 +12,7 @@ e_auth_begin(char *passwd)
-    if (pwlen == 0) goto out;
+@@ -38,8 +38,7 @@ e_auth_begin(char *passwd)
+    pwlen = strlen(passwd);
 
    snprintf(buf, sizeof(buf),
 -            "%s/enlightenment/utils/enlightenment_ckpasswd pw",
@ -41,9 +41,9 @@ index 8b0aa6641..63c68c4bc 100644
 +            "/run/wrappers/bin/enlightenment_ckpasswd pw");
    exe = ecore_exe_pipe_run(buf, ECORE_EXE_PIPE_WRITE, NULL);
    if (!exe) goto out;
-    if (ecore_exe_send(exe, passwd, pwlen) != EINA_TRUE) goto out;
-@@ -47,8 +46,7 @@ e_auth_polkit_begin(char *passwd, const char *cookie, unsigned int uid)
-    if (pwlen == 0) goto out;
+    snprintf(buf, sizeof(buf), "pw %s", passwd);
+@@ -75,8 +74,7 @@ e_auth_polkit_begin(char *passwd, const char *cookie, unsigned int uid)
+    pwlen = strlen(passwd);
 
    snprintf(buf, sizeof(buf),
 -            "%s/enlightenment/utils/enlightenment_ckpasswd pk",
@ -84,23 +84,24 @@ index 9b10b3117..0f0aa5b53 100644
      }
    v->guard = ecore_timer_loop_add(E_FM_MOUNT_TIMEOUT, (Ecore_Task_Cb)_e_fm_main_eeze_vol_mount_timeout, v);
 diff --git a/src/bin/e_start_main.c b/src/bin/e_start_main.c
-index 8534a7a8e..f0f0061a4 100644
+index 722063339..ee85aa9f1 100644
 --- a/src/bin/e_start_main.c
 +++ b/src/bin/e_start_main.c
-@@ -709,7 +709,7 @@ main(int argc, char **argv)
-             "E_ALERT_FONT_DIR=%s/data/fonts", eina_prefix_data_get(pfx));
+@@ -596,8 +596,7 @@ main(int argc, char **argv)
+               eina_prefix_data_get(pfx));
    putenv(buf2);
-    snprintf(buf3, sizeof(buf3),
-            "E_ALERT_SYSTEM_BIN=%s/enlightenment/utils/enlightenment_system", eina_prefix_lib_get(pfx));
-+            "E_ALERT_SYSTEM_BIN=/run/wrappers/bin/enlightenment_system");
+    myasprintf(&buf3,
+-              "E_ALERT_SYSTEM_BIN=%s/enlightenment/utils/enlightenment_system",
+-              eina_prefix_lib_get(pfx));
+              "E_ALERT_SYSTEM_BIN=/run/wrappers/bin/enlightenment_system");
    putenv(buf3);
 
-    if ((valgrind_mode || valgrind_tool) &&
+    home = getenv("HOME");
 diff --git a/src/bin/e_system.c b/src/bin/e_system.c
-index 1e7aabb64..5084933a1 100644
+index bfd43e7e2..6bf48e31f 100644
 --- a/src/bin/e_system.c
 +++ b/src/bin/e_system.c
-@@ -132,7 +132,7 @@ _system_spawn(void)
+@@ -133,7 +133,7 @@ _system_spawn(void)
    else _respawn_count = 0;
    if (_respawn_count > 5) return;
    snprintf(buf, sizeof(buf),
@ -110,5 +111,5 @@ index 1e7aabb64..5084933a1 100644
      (buf, ECORE_EXE_NOT_LEADER | ECORE_EXE_TERM_WITH_PARENT |
       ECORE_EXE_PIPE_READ | ECORE_EXE_PIPE_WRITE, NULL);
 -- 
-2.26.2
+2.34.0

--- a/pkgs/desktops/enlightenment/enlightenment/default.nix
+++ b/pkgs/desktops/enlightenment/enlightenment/default.nix
@ -9,6 +9,7 @@
 , bc
 , ddcutil
 , efl
+, libexif
 , pam
 , xkeyboard_config
 , udisks2
@ -20,11 +21,11 @@

 stdenv.mkDerivation rec {
  pname = "enlightenment";
-  version = "0.24.2";
+  version = "0.25.0";

  src = fetchurl {
    url = "http://download.enlightenment.org/rel/apps/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "1wfz0rwwsx7c1mkswn4hc9xw1i6bsdirhxiycf7ha2vcipqy465y";
+    sha256 = "01nzyvjy06043m01fdb1309xx3wxxg0s3hj9g9di7jjsxp774vkx";
  };

  nativeBuildInputs = [
@ -40,6 +41,7 @@ stdenv.mkDerivation rec {
    bc # for the Everything module calculator mode
    ddcutil # specifically libddcutil.so.2 for backlight control
    efl
+    libexif
    pam
    xkeyboard_config
    udisks2 # for removable storage mounting/unmounting
--- a/pkgs/desktops/enlightenment/ephoto/default.nix
+++ b/pkgs/desktops/enlightenment/ephoto/default.nix
@ -1,30 +1,36 @@
-{ lib, stdenv, fetchurl, pkg-config, efl, pcre, mesa, makeWrapper }:
+{ lib
+, stdenv
+, fetchurl
+, meson
+, ninja
+, pkg-config
+, efl
+}:

 stdenv.mkDerivation rec {
  pname = "ephoto";
-  version = "1.5";
+  version = "1.6.0";

  src = fetchurl {
-    url = "http://www.smhouston.us/stuff/${pname}-${version}.tar.gz";
-    sha256 = "09kraa5zz45728h2dw1ssh23b87j01bkfzf977m48y1r507sy3vb";
+    url = "http://download.enlightenment.org/rel/apps/${pname}/${pname}-${version}.tar.xz";
+    sha256 = "1lvhcs4ba8h3z78nyycbww8mj4cscb8k200dcc3cdy8vrvrp7g1n";
  };

  nativeBuildInputs = [
+    meson
+    ninja
    pkg-config
-    mesa.dev # otherwise pkg-config does not find gbm
-    makeWrapper
  ];

  buildInputs = [
    efl
-    pcre
  ];

-  meta = {
+  meta = with lib; {
    description = "Image viewer and editor written using the Enlightenment Foundation Libraries";
-    homepage = "https://smhouston.us/projects/ephoto/";
-    license = lib.licenses.bsd2;
-    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.romildo ];
+    homepage = "https://www.smhouston.us/ephoto/";
+    license = licenses.bsd2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ romildo ];
  };
 }
--- a/pkgs/desktops/enlightenment/evisum/default.nix
+++ b/pkgs/desktops/enlightenment/evisum/default.nix
@ -1,12 +1,19 @@
-{ lib, stdenv, fetchurl, meson, ninja, pkg-config, efl }:
+{ lib
+, stdenv
+, fetchurl
+, meson
+, ninja
+, pkg-config
+, efl
+}:

 stdenv.mkDerivation rec {
  pname = "evisum";
-  version = "0.5.13";
+  version = "0.6.0";

  src = fetchurl {
    url = "https://download.enlightenment.org/rel/apps/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-TMVxx7D9wdujyN6PcbIxC8M6zby5myvxO9AqolrcWOY=";
+    sha256 = "1ip3rmp0hcn0pk6lv089cayx18p1b2wycgvwpnf7ghbdxg7n4q15";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/enlightenment/rage/default.nix
+++ b/pkgs/desktops/enlightenment/rage/default.nix
@ -1,19 +1,27 @@
-{ lib, stdenv, fetchurl, meson, ninja, pkg-config, efl, gst_all_1, pcre, mesa, wrapGAppsHook }:
+{ lib
+, stdenv
+, fetchurl
+, meson
+, ninja
+, pkg-config
+, efl
+, gst_all_1
+, wrapGAppsHook
+}:

 stdenv.mkDerivation rec {
  pname = "rage";
-  version = "0.3.1";
+  version = "0.4.0";

  src = fetchurl {
    url = "http://download.enlightenment.org/rel/apps/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "04fdk23bbgvni212zrfy4ndg7vmshbsjgicrhckdvhay87pk9i75";
+    sha256 = "03yal7ajh57x2jhmygc6msf3gzvqkpmzkqzj6dnam5sim8cq9rbw";
  };

  nativeBuildInputs = [
    meson
    ninja
    pkg-config
-    mesa.dev
    wrapGAppsHook
  ];

@ -24,14 +32,13 @@ stdenv.mkDerivation rec {
    gst_all_1.gst-plugins-good
    gst_all_1.gst-plugins-bad
    gst_all_1.gst-libav
-    pcre
  ];

-  meta = {
-    description = "Video + Audio player along the lines of mplayer";
+  meta = with lib; {
+    description = "Video and audio player along the lines of mplayer";
    homepage = "https://enlightenment.org/";
-    maintainers = with lib.maintainers; [ matejc ftrvxmtrx romildo ];
-    platforms = lib.platforms.linux;
-    license = lib.licenses.bsd2;
+    license = licenses.bsd2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ matejc ftrvxmtrx romildo ];
  };
 }
--- a/pkgs/desktops/gnustep/base/default.nix
+++ b/pkgs/desktops/gnustep/base/default.nix
@ -2,6 +2,7 @@
 , gsmakeDerivation
 , cups
 , fetchzip
+, fetchpatch
 , gmp, gnutls
 , libffi, binutils-unwrapped
 , libjpeg, libtiff, libpng, giflib
@ -33,6 +34,12 @@ gsmakeDerivation rec {
  ];
  patches = [
    ./fixup-paths.patch
+    # https://github.com/gnustep/libs-base/issues/212 / https://www.sogo.nu/bugs/view.php?id=5416#c15585
+    (fetchpatch {
+      url = "https://github.com/gnustep/libs-base/commit/bd5f2909e6edc8012a0a6e44ea1402dfbe1353a4.patch";
+      revert = true;
+      sha256 = "02awigkbhqa60hfhqfh2wjsa960y3q6557qck1k2l231piz2xasa";
+    })
  ];

  meta = {
--- a/pkgs/desktops/lxqt/lxqt-session/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-session/default.nix
@ -19,13 +19,13 @@

 mkDerivation rec {
  pname = "lxqt-session";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = pname;
    rev = version;
-    sha256 = "0g355dmlyz8iljw953gp5jqlz02abd1ksssah826hxcy4j89mk7s";
+    sha256 = "6/HTCngjz0GpNAYf66CUiCZtEs5EsBbjDjcObIe3qSk=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
+++ b/pkgs/desktops/xfce/panel-plugins/xfce4-whiskermenu-plugin/default.nix
@ -3,10 +3,10 @@
 mkXfceDerivation {
  category = "panel-plugins";
  pname = "xfce4-whiskermenu-plugin";
-  version = "2.7.0";
+  version = "2.7.1";
  rev-prefix = "v";
  odd-unstable = false;
-  sha256 = "sha256-wrFp+YMFfi1UZKQGkHnojAh+l170xW56ls9UJZXmzOo=";
+  sha256 = "sha256-aN8PwH5YIbjiyS5tTcU2AU4LAYC2tBStDxhCXi/dvkQ=";

  nativeBuildInputs = [ cmake ];

--- a/pkgs/development/compilers/rgbds/default.nix
+++ b/pkgs/development/compilers/rgbds/default.nix
@ -2,15 +2,17 @@

 stdenv.mkDerivation rec {
  pname = "rgbds";
-  version = "0.5.1";
+  version = "0.5.2";
  src = fetchFromGitHub {
    owner = "gbdev";
    repo = "rgbds";
    rev = "v${version}";
-    sha256 = "11b1hg2m2f60q5622rb0nxhrzzylsxjx0c8inbxifi6lvmj9ak4x";
+    sha256 = "sha256-/GjxdB3Nt+XuKKQWjU12mS91U4FFoeP+9t0L+HsB/o8=";
  };
-  nativeBuildInputs = [ bison flex pkg-config libpng ];
-  installFlags = [ "PREFIX=\${out}" ];
+  nativeBuildInputs = [ bison flex pkg-config ];
+  buildInputs = [ libpng ];
+  NIX_CFLAGS_COMPILE = lib.optional stdenv.isDarwin "-fno-lto";
+  installFlags = [ "PREFIX=${placeholder "out"}" ];

  meta = with lib; {
    homepage = "https://rgbds.gbdev.io/";
--- a/pkgs/development/embedded/avrdude/default.nix
+++ b/pkgs/development/embedded/avrdude/default.nix
@ -7,11 +7,11 @@ assert docSupport -> texLive != null && texinfo != null && texi2html != null;

 stdenv.mkDerivation rec {
  pname = "avrdude";
-  version = "6.3";
+  version = "6.4";

  src = fetchurl {
    url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "15m1w1qad3dj7r8n5ng1qqcaiyx1gyd6hnc3p2apgjllccdp77qg";
+    sha256 = "sha256-qb5wZvcKnc9L8HNvz1MdtqMlCu0aJMxkOt0nZBtxEPk=";
  };

  configureFlags = lib.optionals docSupport "--enable-doc";
--- a/pkgs/development/interpreters/guile/3.0.nix
+++ b/pkgs/development/interpreters/guile/3.0.nix
@ -99,7 +99,10 @@ builder rec {

    # See below.
    "--without-threads"
-  ];
+  ]
+  # Disable JIT on Apple Silicon, as it is not yet supported
+  # https://debbugs.gnu.org/cgi/bugreport.cgi?bug=44505";
+  ++ lib.optional (stdenv.isDarwin && stdenv.isAarch64) "--enable-jit=no";

  postInstall = ''
    wrapProgram $out/bin/guile-snarf --prefix PATH : "${gawk}/bin"
--- a/pkgs/development/libraries/apr-util/default.nix
+++ b/pkgs/development/libraries/apr-util/default.nix
@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
  };

  meta = with lib; {
-    homepage = "http://apr.apache.org/";
+    homepage = "https://apr.apache.org/";
    description = "A companion library to APR, the Apache Portable Runtime";
    maintainers = [ maintainers.eelco ];
    platforms = platforms.unix;
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "armadillo";
-  version = "10.7.4";
+  version = "10.7.5";

  src = fetchurl {
    url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "sha256-LBsyxbJZsF40vC3N4cq1ic/LtYF5xyqTxdquoeOVBlI=";
+    sha256 = "sha256-XQ2f1rNO/Lpqb87/VMDS0T/L6RXXr4owxecs8xfSCU8=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/aws-c-s3/default.nix
+++ b/pkgs/development/libraries/aws-c-s3/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "aws-c-s3";
-  version = "0.1.27";
+  version = "0.1.30";

  src = fetchFromGitHub {
    owner = "awslabs";
    repo = "aws-c-s3";
    rev = "v${version}";
-    sha256 = "sha256-GtBUC5cKMN9rd5GQbYoipVvxrUCCNKbb5vhHUGQpeH8=";
+    sha256 = "sha256-vsKQJPYdaBveb9kpZitmXFTqEeWWA4h0BkqxRzdOu28=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/codec2/default.nix
+++ b/pkgs/development/libraries/codec2/default.nix
@ -20,7 +20,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Speech codec designed for communications quality speech at low data rates";
-    homepage = "http://www.rowetel.com/blog/?page_id=452";
+    homepage = "https://www.rowetel.com/codec2.html";
    license = licenses.lgpl21Only;
    platforms = platforms.unix;
    maintainers = with maintainers; [ markuskowa ];
--- a/pkgs/development/libraries/funambol/default.nix
+++ b/pkgs/development/libraries/funambol/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "SyncML client sdk by Funambol project";
-    homepage = "http://www.funambol.com";
+    homepage = "https://www.funambol.com";
    license = licenses.agpl3;
    platforms = platforms.unix;
  };
--- a/pkgs/development/libraries/java/commons/bcel/default.nix
+++ b/pkgs/development/libraries/java/commons/bcel/default.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
  '';

  meta = {
-    homepage    = "http://commons.apache.org/proper/commons-bcel/";
+    homepage    = "https://commons.apache.org/proper/commons-bcel/";
    description = "Gives users a convenient way to analyze, create, and manipulate (binary) Java class files";
    maintainers = with lib.maintainers; [ copumpkin ];
    license     = lib.licenses.asl20;
--- a/pkgs/development/libraries/java/commons/bsf/default.nix
+++ b/pkgs/development/libraries/java/commons/bsf/default.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Interface to scripting languages, including JSR-223";
-    homepage = "http://commons.apache.org/proper/commons-bsf/";
+    homepage = "https://commons.apache.org/proper/commons-bsf/";
    license = lib.licenses.asl20;
    platforms = lib.platforms.unix;
  };
--- a/pkgs/development/libraries/java/commons/compress/default.nix
+++ b/pkgs/development/libraries/java/commons/compress/default.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
  '';

  meta = {
-    homepage    = "http://commons.apache.org/proper/commons-compress";
+    homepage    = "https://commons.apache.org/proper/commons-compress";
    description = "Allows manipulation of ar, cpio, Unix dump, tar, zip, gzip, XZ, Pack200, bzip2, 7z, arj, lzma, snappy, DEFLATE and Z files";
    maintainers = with lib.maintainers; [ copumpkin ];
    license     = lib.licenses.asl20;
--- a/pkgs/development/libraries/java/commons/fileupload/default.nix
+++ b/pkgs/development/libraries/java/commons/fileupload/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
  '';

  meta = {
-    homepage    = "http://commons.apache.org/proper/commons-fileupload";
+    homepage    = "https://commons.apache.org/proper/commons-fileupload";
    description = "Makes it easy to add robust, high-performance, file upload capability to your servlets and web applications";
    maintainers = with lib.maintainers; [ copumpkin ];
    license     = lib.licenses.asl20;
--- a/pkgs/development/libraries/java/commons/io/default.nix
+++ b/pkgs/development/libraries/java/commons/io/default.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
  '';

  meta = {
-    homepage    = "http://commons.apache.org/proper/commons-io";
+    homepage    = "https://commons.apache.org/proper/commons-io";
    description = "A library of utilities to assist with developing IO functionality";
    maintainers = with lib.maintainers; [ copumpkin ];
    license     = lib.licenses.asl20;
--- a/pkgs/development/libraries/java/commons/lang/default.nix
+++ b/pkgs/development/libraries/java/commons/lang/default.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
  '';

  meta = {
-    homepage    = "http://commons.apache.org/proper/commons-lang";
+    homepage    = "https://commons.apache.org/proper/commons-lang";
    description = "Provides additional methods to manipulate standard Java library classes";
    maintainers = with lib.maintainers; [ copumpkin ];
    license     = lib.licenses.asl20;
--- a/pkgs/development/libraries/java/commons/logging/default.nix
+++ b/pkgs/development/libraries/java/commons/logging/default.nix
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Wrapper around a variety of logging API implementations";
-    homepage = "http://commons.apache.org/proper/commons-logging";
+    homepage = "https://commons.apache.org/proper/commons-logging";
    license = lib.licenses.asl20;
    platforms = lib.platforms.unix;
  };
--- a/pkgs/development/libraries/libcello/default.nix
+++ b/pkgs/development/libraries/libcello/default.nix
@ -5,14 +5,14 @@ stdenv.mkDerivation rec {
  version = "2.1.0";

  src = fetchurl {
-    url = "http://libcello.org/static/libCello-${version}.tar.gz";
+    url = "https://libcello.org/static/libCello-${version}.tar.gz";
    sha256 = "0a1b2x5ni07vd9ridnl7zv7h2s32070wsphjy94qr066b99gdb29";
  };

  makeFlags = [ "PREFIX=$(out)" ];

  meta = {
-    homepage = "http://libcello.org/";
+    homepage = "https://libcello.org/";
    description = "Higher level programming in C";
    license = lib.licenses.bsd3;
    maintainers = [ lib.maintainers.MostAwesomeDude ];
--- a/pkgs/development/libraries/libfaketime/default.nix
+++ b/pkgs/development/libraries/libfaketime/default.nix
@ -1,12 +1,14 @@
-{ lib, stdenv, fetchurl, perl, coreutils }:
+{ lib, stdenv, fetchFromGitHub, perl, coreutils }:

 stdenv.mkDerivation rec {
  pname = "libfaketime";
  version = "0.9.9";

-  src = fetchurl {
-    url = "https://github.com/wolfcw/libfaketime/archive/v${version}.tar.gz";
-    sha256 = "sha256-V9AYEVA2HAqbXI7vBbETkvYTStosLZmOkuY9rtY5ZHw=";
+  src = fetchFromGitHub {
+    owner = "wolfcw";
+    repo = "libfaketime";
+    rev = "v${version}";
+    sha256 = "sha256-P1guVggteGtoq8+eeE966hDPkRwsn0m7oLCohyPrIb4=";
  };

  patches = [
--- a/pkgs/development/libraries/libinotify-kqueue/default.nix
+++ b/pkgs/development/libraries/libinotify-kqueue/default.nix
@ -1,12 +1,14 @@
-{ lib, stdenv, fetchzip, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook }:

 stdenv.mkDerivation rec {
  pname = "libinotify-kqueue";
  version = "20180201";

-  src = fetchzip {
-    url = "https://github.com/libinotify-kqueue/libinotify-kqueue/archive/${version}.tar.gz";
-    sha256 = "0dkh6n0ghhcl7cjkjmpin118h7al6i4vlkmw57vip5f6ngr6q3pl";
+  src = fetchFromGitHub {
+    owner = "libinotify-kqueue";
+    repo = "libinotify-kqueue";
+    rev = version;
+    sha256 = "sha256-9A5s8rPGlRv3KbxOukk0VB2IQrDxVjklO5RB+IA1cDY=";
  };

  nativeBuildInputs = [ autoreconfHook ];
--- a/pkgs/development/libraries/libmowgli/default.nix
+++ b/pkgs/development/libraries/libmowgli/default.nix
@ -1,12 +1,14 @@
-{ lib, stdenv, fetchurl }:
+{ lib, stdenv, fetchFromGitHub }:

 stdenv.mkDerivation rec {
  pname = "libmowgli";
  version = "2.1.3";

-  src = fetchurl {
-    url = "https://github.com/atheme/libmowgli-2/archive/v${version}.tar.gz";
-    sha256 = "0xx4vndmwz40pxa5gikl8z8cskpdl9a30i2i5fjncqzlp4pspymp";
+  src = fetchFromGitHub {
+    owner = "atheme";
+    repo = "libmowgli-2";
+    rev = "v${version}";
+    sha256 = "sha256-jlw6ixMoIdIjmQ86N+KN+Gez218sw894POkcCYnT0s0=";
  };

  meta = with lib; {
--- a/pkgs/development/libraries/libmx/default.nix
+++ b/pkgs/development/libraries/libmx/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl
+{ lib, stdenv, fetchFromGitHub
 , libtool, pkg-config, automake, autoconf, intltool
 , glib, gobject-introspection, gtk2, gtk-doc
 , clutter, clutter-gtk
@ -8,9 +8,11 @@ stdenv.mkDerivation rec {
  pname = "libmx";
  version = "1.4.7";

-  src = fetchurl {
-    url = "https://github.com/clutter-project/mx/archive/${version}.tar.gz";
-    sha256 = "8a7514ea33c1dec7251d0141e24a702e7701dc9f00348cbcf1816925b7f74dbc";
+  src = fetchFromGitHub {
+    owner = "clutter-project";
+    repo = "mx";
+    rev = version;
+    sha256 = "sha256-+heIPSkg3d22xsU48UOTJ9FPLXC7zLivcnabQOM9aEk=";
  };

  # remove the following superfluous checks
--- a/pkgs/development/libraries/libshout/default.nix
+++ b/pkgs/development/libraries/libshout/default.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
      bad data from getting to the icecast server.
    '';

-    homepage = "http://www.icecast.org";
+    homepage = "https://www.icecast.org";
    license = lib.licenses.gpl2;
    maintainers = with lib.maintainers; [ jcumming ];
    platforms = with lib.platforms; unix;
--- a/Show more
+++ b/Show more