Merge master into haskell-updates

2024-11-18 02:05:51 +03:00 · 2022-02-11 00:09:24 +00:00 · 2022-02-11 00:09:24 +00:00 · 0648f0d8a3
commit 0648f0d8a3
parent 3755a52ac8 06ff90f540
769 changed files with 8481 additions and 5935 deletions
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@ -276,7 +276,7 @@ rec {


  /* Like `mapAttrsRecursive', but it takes an additional predicate
-     function that tells it whether to recursive into an attribute
+     function that tells it whether to recurse into an attribute
     set.  If it returns false, `mapAttrsRecursiveCond' does not
     recurse, but does apply the map function.  If it returns true, it
     does recurse, and does not apply the map function.
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@ -465,6 +465,11 @@ in mkLicense lset) ({
    spdxId = "imagemagick";
  };

+  imlib2 = {
+    spdxId = "Imlib2";
+    fullName = "Imlib2 License";
+  };
+
  inria-compcert = {
    fullName  = "INRIA Non-Commercial License Agreement for the CompCert verified compiler";
    url       = "https://compcert.org/doc/LICENSE.txt";
@ -592,6 +597,11 @@ in mkLicense lset) ({
    fullName = "MIT License";
  };

+  mitAdvertising = {
+    spdxId = "MIT-advertising";
+    fullName = "Enlightenment License (e16)";
+  };
+
  mpl10 = {
    spdxId = "MPL-1.0";
    fullName = "Mozilla Public License 1.0";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1179,14 +1179,14 @@
    name = "Artturi N";
  };
  azahi = {
-    email = "azahi@teknik.io";
-    matrix = "@azahi:matrix.org";
+    name = "Azat Bahawi";
+    email = "azat@bahawi.net";
+    matrix = "@azahi:azahi.cc";
    github = "azahi";
    githubId = 22211000;
-    name = "Azat Bahawi";
    keys = [{
-      longkeyid = "rsa2048/0xB40FCB6608BBE3B6";
-      fingerprint = "E9F3 483F 31C7 29B4 4CA2  7C38 B40F CB66 08BB E3B6";
+      longkeyid = "rsa4096/0xC8C6BDDB3847F72B";
+      fingerprint = "2688 0377 C31D 9E81 9BDF  83A8 C8C6 BDDB 3847 F72B";
    }];
  };
  ayazhafiz = {
@ -2382,6 +2382,13 @@
    githubId = 11145016;
    name = "J.C.";
  };
+  congee = {
+    email = "changshengwu@pm.me";
+    matrix = "@congeec:matrix.org";
+    github = "congee";
+    name = "Changsheng Wu";
+    githubId = 2083950;
+  };
  contrun = {
    email = "uuuuuu@protonmail.com";
    github = "contrun";
@ -3736,6 +3743,12 @@
    githubId = 222467;
    name = "Dmitry Ivanov";
  };
+  Etjean = {
+    email = "et.jean@outlook.fr";
+    github = "Etjean";
+    githubId = 32169529;
+    name = "Etienne Jean";
+  };
  etu = {
    email = "elis@hirwing.se";
    matrix = "@etu:semi.social";
@ -5462,6 +5475,12 @@
    githubId = 221929;
    name = "Jean-Baptiste Giraudeau";
  };
+  jc = {
+    name = "Josh Cooper";
+    email = "josh@cooper.is";
+    github = "joshua-cooper";
+    githubId = 35612334;
+  };
  jceb = {
    name = "jceb";
    email = "jceb@e-jc.de";
@ -5590,6 +5609,16 @@
    githubId = 143075;
    name = "James Felix Black";
  };
+  jfchevrette = {
+    email = "jfchevrette@gmail.com";
+    github = "jfchevrette";
+    githubId = 3001;
+    name = "Jean-Francois Chevrette";
+    keys = [{
+      longkeyid = "rsa4096/0x67A0585801290DC6";
+      fingerprint = "B612 96A9 498E EECD D5E9  C0F0 67A0 5858 0129 0DC6";
+    }];
+  };
  jflanglois = {
    email = "yourstruly@julienlanglois.me";
    github = "jflanglois";
@ -7929,6 +7958,12 @@
      fingerprint = "FEF0 AE2D 5449 3482 5F06  40AA 186A 1EDA C5C6 3F83";
    }];
  };
+  mihnea-s = {
+    email = "mihn.stn@gmail.com";
+    github = "mihnea-s";
+    githubId = 43088426;
+    name = "Mihnea Stoian";
+  };
  mikefaille = {
    email = "michael@faille.io";
    github = "mikefaille";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -278,6 +278,13 @@ with lib.maintainers; {
    scope = "Maintain SageMath and the dependencies that are likely to break it.";
  };

+  sphinx = {
+    members = [
+      SuperSandro2000
+    ];
+    scope = "Maintain Sphinx related packages.";
+  };
+
  serokell = {
    # Verify additions by approval of an already existing member of the team.
    members = [
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -802,6 +802,13 @@
          loaded in the initrd.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>nixos-generate-config</literal> now puts the dhcp
+          configuration in <literal>hardware-configuration.nix</literal>
+          instead of <literal>configuration.nix</literal>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>fetchFromSourcehut</literal> now allows fetching
@ -894,6 +901,17 @@
          warning.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The option
+          <link linkend="opt-services.networking.networkmanager.enableFccUnlock">services.networking.networkmanager.enableFccUnlock</link>
+          was added to support FCC unlock procedures. Since release
+          1.18.4, the ModemManager daemon no longer automatically
+          performs the FCC unlock procedure by default. See
+          <link xlink:href="https://modemmanager.org/docs/modemmanager/fcc-unlock/">the
+          docs</link> for more details.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>programs.tmux</literal> has a new option
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -274,6 +274,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - A new option `boot.initrd.extraModprobeConfig` has been added which can be used to configure kernel modules that are loaded in the initrd.

+- `nixos-generate-config` now puts the dhcp configuration in `hardware-configuration.nix` instead of `configuration.nix`.
+
 - `fetchFromSourcehut` now allows fetching repositories recursively
  using `fetchgit` or `fetchhg` if the argument `fetchSubmodules`
  is set to `true`.
@ -301,6 +303,12 @@ In addition to numerous new and upgraded packages, this release has the followin
  Reason is that the old name has been deprecated upstream.
  Using the old option name will still work, but produce a warning.

+- The option
+  [services.networking.networkmanager.enableFccUnlock](#opt-services.networking.networkmanager.enableFccUnlock)
+  was added to support FCC unlock procedures. Since release 1.18.4, the ModemManager
+  daemon no longer automatically performs the FCC unlock procedure by default. See
+  [the docs](https://modemmanager.org/docs/modemmanager/fcc-unlock/) for more details.
+
 - `programs.tmux` has a new option `plugins` that accepts a list of packages from the `tmuxPlugins` group. The specified packages are added to the system and loaded by `tmux`.

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/lib/qemu-common.nix
+++ b/nixos/lib/qemu-common.nix
@ -22,7 +22,7 @@ rec {
        else throw "Unknown QEMU serial device for system '${pkgs.stdenv.hostPlatform.system}'";

  qemuBinary = qemuPkg: {
-    x86_64-linux = "${qemuPkg}/bin/qemu-kvm -cpu qemu64";
+    x86_64-linux = "${qemuPkg}/bin/qemu-kvm -cpu max";
    armv7l-linux = "${qemuPkg}/bin/qemu-system-arm -enable-kvm -machine virt -cpu host";
    aarch64-linux = "${qemuPkg}/bin/qemu-system-aarch64 -enable-kvm -machine virt,gic-version=host -cpu host";
    powerpc64le-linux = "${qemuPkg}/bin/qemu-system-ppc64 -machine powernv";
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@ -279,7 +279,7 @@ if (`lsblk -o TYPE` =~ "lvm") {
    push @initrdKernelModules, "dm-snapshot";
 }

-my $virt = `systemd-detect-virt`;
+my $virt = `@detectvirt@`;
 chomp $virt;


@ -398,7 +398,7 @@ foreach my $fs (read_file("/proc/self/mountinfo")) {
    # Maybe this is a bind-mount of a filesystem we saw earlier?
    if (defined $fsByDev{$fields[2]}) {
        # Make sure this isn't a btrfs subvolume.
-        my $msg = `btrfs subvol show $rootDir$mountPoint`;
+        my $msg = `@btrfs@ subvol show $rootDir$mountPoint`;
        if ($? != 0 || $msg =~ /ERROR:/s) {
            my $path = $fields[3]; $path = "" if $path eq "/";
            my $base = $fsByDev{$fields[2]};
@ -436,7 +436,7 @@ EOF

    # Is this a btrfs filesystem?
    if ($fsType eq "btrfs") {
-        my ($status, @info) = runCommand("btrfs subvol show $rootDir$mountPoint");
+        my ($status, @info) = runCommand("@btrfs@ subvol show $rootDir$mountPoint");
        if ($status != 0 || join("", @info) =~ /ERROR:/) {
            die "Failed to retrieve subvolume info for $mountPoint\n";
        }
@ -558,6 +558,8 @@ if (!$noFilesystems) {
    $fsAndSwap .= "swapDevices =" . multiLineList("    ", @swapDevices) . ";\n";
 }

+my $networkingDhcpConfig = generateNetworkingDhcpConfig();
+
 my $hwConfig = <<EOF;
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
@ -572,6 +574,7 @@ my $hwConfig = <<EOF;
  boot.kernelModules = [$kernelModules ];
  boot.extraModulePackages = [$modulePackages ];
 $fsAndSwap
+$networkingDhcpConfig
 ${\join "", (map { "  $_\n" } (uniq @attrs))}}
 EOF

@ -580,13 +583,13 @@ sub generateNetworkingDhcpConfig {
  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
  # Per-interface useDHCP will be mandatory in the future, so this generated config
  # replicates the default behaviour.
-  networking.useDHCP = false;
+  networking.useDHCP = lib.mkDefault false;
 EOF

    foreach my $path (glob "/sys/class/net/*") {
        my $dev = basename($path);
        if ($dev ne "lo") {
-            $config .= "  networking.interfaces.$dev.useDHCP = true;\n";
+            $config .= "  networking.interfaces.$dev.useDHCP = lib.mkDefault true;\n";
        }
    }

--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@ -33,8 +33,9 @@ let
  nixos-generate-config = makeProg {
    name = "nixos-generate-config";
    src = ./nixos-generate-config.pl;
-    path = lib.optionals (lib.elem "btrfs" config.boot.supportedFilesystems) [ pkgs.btrfs-progs ];
    perl = "${pkgs.perl.withPackages (p: [ p.FileSlurp ])}/bin/perl";
+    detectvirt = "${pkgs.systemd}/bin/systemd-detect-virt";
+    btrfs = "${pkgs.btrfs-progs}/bin/btrfs";
    inherit (config.system.nixos-generate-config) configuration desktopConfiguration;
    xserverEnabled = config.services.xserver.enable;
  };
@ -133,12 +134,13 @@ in

      $bootLoaderConfig
        # networking.hostName = "nixos"; # Define your hostname.
+        # Pick only one of the below networking options.
        # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+        # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.

        # Set your time zone.
        # time.timeZone = "Europe/Amsterdam";

-      $networkingDhcpConfig
        # Configure network proxy if necessary
        # networking.proxy.default = "http://user:password\@proxy:port/";
        # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
@ -148,6 +150,7 @@ in
        # console = {
        #   font = "Lat2-Terminus16";
        #   keyMap = "us";
+        #   useXkbConfig = true; # use xkbOptions in tty.
        # };

      $xserverConfig
@ -155,7 +158,10 @@ in
      $desktopConfiguration
        # Configure keymap in X11
        # services.xserver.layout = "us";
-        # services.xserver.xkbOptions = "eurosign:e";
+        # services.xserver.xkbOptions = {
+        #   "eurosign:e";
+        #   "caps:escape" # map caps to escape.
+        # };

        # Enable CUPS to print documents.
        # services.printing.enable = true;
--- a/nixos/modules/services/network-filesystems/ceph.nix
+++ b/nixos/modules/services/network-filesystems/ceph.nix
@ -181,8 +181,8 @@ in

      rgwMimeTypesFile = mkOption {
        type = with types; nullOr path;
-        default = "${pkgs.mime-types}/etc/mime.types";
-        defaultText = literalExpression ''"''${pkgs.mime-types}/etc/mime.types"'';
+        default = "${pkgs.mailcap}/etc/mime.types";
+        defaultText = literalExpression ''"''${pkgs.mailcap}/etc/mime.types"'';
        description = ''
          Path to mime types used by radosgw.
        '';
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@ -384,6 +384,17 @@ in {
          so you don't need to to that yourself.
        '';
      };
+
+      enableFccUnlock = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable FCC unlock procedures. Since release 1.18.4, the ModemManager daemon no longer
+          automatically performs the FCC unlock procedure by default. See
+          <link xlink:href="https://modemmanager.org/docs/modemmanager/fcc-unlock/">the docs</link>
+          for more details.
+        '';
+      };
    };
  };

@ -438,7 +449,13 @@ in {

      "NetworkManager/VPN/nm-sstp-service.name".source =
        "${networkmanager-sstp}/lib/NetworkManager/VPN/nm-sstp-service.name";
+
      }
+      // optionalAttrs cfg.enableFccUnlock
+         {
+           "ModemManager/fcc-unlock.d".source =
+             "${pkgs.modemmanager}/share/ModemManager/fcc-unlock.available.d/*";
+         }
      // optionalAttrs (cfg.appendNameservers != [] || cfg.insertNameservers != [])
         {
           "NetworkManager/dispatcher.d/02overridedns".source = overrideNameserversScript;
--- a/nixos/modules/services/security/haveged.nix
+++ b/nixos/modules/services/security/haveged.nix
@ -3,12 +3,10 @@
 with lib;

 let
-
  cfg = config.services.haveged;

 in

-
 {

  ###### interface
@ -17,14 +15,11 @@ in

    services.haveged = {

-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether to enable to haveged entropy daemon, which refills
-          /dev/random when low.
-        '';
-      };
+      enable = mkEnableOption ''
+        haveged entropy daemon, which refills /dev/random when low.
+        NOTE: does nothing on kernels newer than 5.6.
+      '';
+      # source for the note https://github.com/jirka-h/haveged/issues/57

      refill_threshold = mkOption {
        type = types.int;
@ -39,29 +34,44 @@ in

  };

-
-  ###### implementation
-
  config = mkIf cfg.enable {

-    systemd.services.haveged =
-      { description = "Entropy Harvesting Daemon";
-        unitConfig.Documentation = "man:haveged(8)";
-        wantedBy = [ "multi-user.target" ];
+    # https://github.com/jirka-h/haveged/blob/a4b69d65a8dfc5a9f52ff8505c7f58dcf8b9234f/contrib/Fedora/haveged.service
+    systemd.services.haveged = {
+      description = "Entropy Daemon based on the HAVEGE algorithm";
+      unitConfig = {
+        Documentation = "man:haveged(8)";
+        DefaultDependencies = false;
+        ConditionKernelVersion = "<5.6";
+      };
+      wantedBy = [ "sysinit.target" ];
+      after = [ "systemd-tmpfiles-setup-dev.service" ];
+      before = [ "sysinit.target" "shutdown.target" "systemd-journald.service" ];

-        path = [ pkgs.haveged ];
-
-        serviceConfig = {
-          ExecStart = "${pkgs.haveged}/bin/haveged -F -w ${toString cfg.refill_threshold} -v 1";
-          SuccessExitStatus = 143;
-          PrivateTmp = true;
-          PrivateDevices = true;
-          PrivateNetwork = true;
-          ProtectSystem = "full";
-          ProtectHome = true;
-        };
+      serviceConfig = {
+        ExecStart = "${pkgs.haveged}/bin/haveged -w ${toString cfg.refill_threshold} --Foreground -v 1";
+        Restart = "always";
+        SuccessExitStatus = "137 143";
+        SecureBits = "noroot-locked";
+        CapabilityBoundingSet = [ "CAP_SYS_ADMIN" "CAP_SYS_CHROOT" ];
+        # We can *not* set PrivateTmp=true as it can cause an ordering cycle.
+        PrivateTmp = false;
+        PrivateDevices = true;
+        ProtectSystem = "full";
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "newuname" "~@mount" ];
+        SystemCallErrorNumber = "EPERM";
      };

+    };
  };

 }
--- a/nixos/modules/services/x11/desktop-managers/default.nix
+++ b/nixos/modules/services/x11/desktop-managers/default.nix
@ -19,7 +19,7 @@ in
  # E.g., if Plasma 5 is enabled, it supersedes xterm.
  imports = [
    ./none.nix ./xterm.nix ./xfce.nix ./plasma5.nix ./lumina.nix
-    ./lxqt.nix ./enlightenment.nix ./gnome.nix ./kodi.nix
+    ./lxqt.nix ./enlightenment.nix ./gnome.nix ./retroarch.nix ./kodi.nix
    ./mate.nix ./pantheon.nix ./surf-display.nix ./cde.nix
    ./cinnamon.nix
  ];
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -135,6 +135,7 @@ in
      services.bamf.enable = true;
      services.colord.enable = mkDefault true;
      services.fwupd.enable = mkDefault true;
+      services.packagekit.enable = mkDefault true;
      services.touchegg.enable = mkDefault true;
      services.touchegg.package = pkgs.pantheon.touchegg;
      services.tumbler.enable = mkDefault true;
@ -272,7 +273,7 @@ in
    })

    (mkIf serviceCfg.apps.enable {
-      environment.systemPackages = (with pkgs.pantheon; pkgs.gnome.removePackagesByName [
+      environment.systemPackages = with pkgs.pantheon; pkgs.gnome.removePackagesByName ([
        elementary-calculator
        elementary-calendar
        elementary-camera
@ -286,7 +287,11 @@ in
        elementary-terminal
        elementary-videos
        epiphany
-      ] config.environment.pantheon.excludePackages);
+      ] ++ lib.optionals config.services.flatpak.enable [
+        # Only install appcenter if flatpak is enabled before
+        # https://github.com/NixOS/nixpkgs/issues/15932 is resolved.
+        appcenter
+      ]) config.environment.pantheon.excludePackages;

      # needed by screenshot
      fonts.fonts = [
--- a/nixos/modules/services/x11/desktop-managers/pantheon.xml
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.xml
@ -105,10 +105,10 @@ switchboard-with-plugs.override {
    </term>
    <listitem>
     <para>
-      AppCenter has been available since 20.03, but it is of little use. This is because there is no functioning PackageKit backend for Nix 2.0. Starting from 21.11, the Flatpak backend should work so you can install some Flatpak applications using it. See this <link xlink:href="https://github.com/NixOS/nixpkgs/issues/70214">issue</link>.
+      AppCenter has been available since 20.03. Starting from 21.11, the Flatpak backend should work so you can install some Flatpak applications using it. However, due to missing appstream metadata, the Packagekit backend does not function currently. See this <link xlink:href="https://github.com/NixOS/nixpkgs/issues/15932">issue</link>.
     </para>
     <para>
-      To use AppCenter on NixOS, add <literal>pantheon.appcenter</literal> to <xref linkend="opt-environment.systemPackages" />, <link linkend="module-services-flatpak">enable Flatpak support</link> and optionally add the <literal>appcenter</literal> Flatpak remote:
+      If you are using Pantheon, AppCenter should be installed by default if you have <link linkend="module-services-flatpak">Flatpak support</link> enabled. If you also wish to add the <literal>appcenter</literal> Flatpak remote:
     </para>
 <screen>
 <prompt>$ </prompt>flatpak remote-add --if-not-exists appcenter https://flatpak.elementary.io/repo.flatpakrepo
--- a/nixos/modules/services/x11/desktop-managers/retroarch.nix
+++ b/nixos/modules/services/x11/desktop-managers/retroarch.nix
@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let cfg = config.services.xserver.desktopManager.retroarch;
+
+in {
+  options.services.xserver.desktopManager.retroarch = {
+    enable = mkEnableOption "RetroArch";
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.retroarch;
+      defaultText = literalExpression "pkgs.retroarch";
+      example = literalExpression "pkgs.retroarch-full";
+      description = "RetroArch package to use.";
+    };
+
+    extraArgs = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "--verbose" "--host" ];
+      description = "Extra arguments to pass to RetroArch.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.xserver.desktopManager.session = [{
+      name = "RetroArch";
+      start = ''
+        ${cfg.package}/bin/retroarch -f ${escapeShellArgs cfg.extraArgs} &
+        waitPID=$!
+      '';
+    }];
+
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with maintainers; [ j0hax ];
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -441,6 +441,7 @@ in
  resolv = handleTest ./resolv.nix {};
  restartByActivationScript = handleTest ./restart-by-activation-script.nix {};
  restic = handleTest ./restic.nix {};
+  retroarch = handleTest ./retroarch.nix {};
  riak = handleTest ./riak.nix {};
  robustirc-bridge = handleTest ./robustirc-bridge.nix {};
  roundcube = handleTest ./roundcube.nix {};
--- a/nixos/tests/retroarch.nix
+++ b/nixos/tests/retroarch.nix
@ -0,0 +1,49 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+  {
+    name = "retroarch";
+    meta = with pkgs.lib.maintainers; { maintainers = [ j0hax ]; };
+
+    machine = { ... }:
+
+      {
+        imports = [ ./common/user-account.nix ];
+        services.xserver.enable = true;
+        services.xserver.desktopManager.retroarch = {
+          enable = true;
+          package = pkgs.retroarchFull;
+        };
+        services.xserver.displayManager = {
+          sddm.enable = true;
+          defaultSession = "RetroArch";
+          autoLogin = {
+            enable = true;
+            user = "alice";
+          };
+        };
+      };
+
+    testScript = { nodes, ... }:
+      let
+        user = nodes.machine.config.users.users.alice;
+        xdo = "${pkgs.xdotool}/bin/xdotool";
+      in ''
+        with subtest("Wait for login"):
+            start_all()
+            machine.wait_for_file("${user.home}/.Xauthority")
+            machine.succeed("xauth merge ${user.home}/.Xauthority")
+
+        with subtest("Check RetroArch started"):
+            machine.wait_until_succeeds("pgrep retroarch")
+            machine.wait_for_window("^RetroArch ")
+
+        with subtest("Check configuration created"):
+            machine.wait_for_file("${user.home}/.config/retroarch/retroarch.cfg")
+
+        with subtest("Wait to get a screenshot"):
+            machine.execute(
+                "${xdo} key Alt+F1 sleep 10"
+            )
+            machine.screenshot("screen")
+      '';
+  })
--- a/pkgs/applications/audio/audacity/default.nix
+++ b/pkgs/applications/audio/audacity/default.nix
@ -24,7 +24,7 @@
 , expat
 , libid3tag
 , libopus
-, ffmpeg
+, ffmpeg_4
 , soundtouch
 , pcre
 /*, portaudio - given up fighting their portaudio.patch */
@ -123,7 +123,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    expat
-    ffmpeg
+    ffmpeg_4
    file
    flac
    libid3tag
--- a/pkgs/applications/audio/redux/default.nix
+++ b/pkgs/applications/audio/redux/default.nix
@ -0,0 +1,49 @@
+{ lib
+, stdenv
+, fetchurl
+, libX11
+, alsa-lib
+, autoPatchelfHook
+, releasePath ? null
+}:
+
+# To use the full release version (same as renoise):
+# 1) Sign into https://backstage.renoise.com and download the release version to some stable location.
+# 2) Override the releasePath attribute to point to the location of the newly downloaded bundle.
+# Note: Renoise creates an individual build for each license which screws somewhat with the
+# use of functions like requireFile as the hash will be different for every user.
+
+stdenv.mkDerivation rec {
+  pname = "redux";
+  version = "1.2.2";
+
+  src = if releasePath != null then releasePath
+    else fetchurl {
+      url = "https://files.renoise.com/demo/Renoise_Redux_${lib.replaceStrings ["."] ["_"] version}_Demo_Linux.tar.gz";
+      sha256 = "0zbwsg7nh9x3q29jv2kpqb3vwi0ksdwybhb4m2qr95rxrpx1kxhm";
+    };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  buildInputs = [ libX11 alsa-lib stdenv.cc.cc.lib ];
+
+  installPhase = ''
+    runHook preInstall
+
+    OUTDIR=$out/lib/vst2/RenoiseRedux.vst2
+    mkdir -p $OUTDIR
+    cp -r ./renoise_redux_x86_64/* $OUTDIR
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Sample-based instrument, with a powerful phrase sequencer";
+    homepage = "https://www.renoise.com/products/redux";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ mihnea-s ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/audio/snd/default.nix
+++ b/pkgs/applications/audio/snd/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "snd";
-  version = "22.0";
+  version = "22.1";

  src = fetchurl {
    url = "mirror://sourceforge/snd/snd-${version}.tar.gz";
-    sha256 = "sha256-QK5lq2ek1yn3G0Ecs+TFIG5ST3lAETiyxuXIic3v1ik=";
+    sha256 = "sha256-jrH0XRvPj9ySd8FSrOKf6qP5T1YSKrYBNHl6fz5dhkI=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "tiled";
-  version = "1.7.2";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "bjorn";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-yQWe27zLWOnRQk+MEpuWs8CFP/le3PQ+yziB0ikNang=";
+    sha256 = "sha256-rJY2PNUxKAv+uQKBwu5kPuwyWkzOK9bg8NJViSgG29I=";
  };

  nativeBuildInputs = [ pkg-config qmake ];
--- a/pkgs/applications/editors/vim/common.nix
+++ b/pkgs/applications/editors/vim/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.4186";
+  version = "8.2.4227";

  src = fetchFromGitHub {
    owner = "vim";
    repo = "vim";
    rev = "v${version}";
-    sha256 = "0g276mbmq69z7c4kgj59r0azxmx9ih2sd8v83dx2gfph6wgw65ph";
+    sha256 = "sha256-Xj4ymkrWY5GWpQhEDYtPtaRovBa6j19dW9GWg9WSdig=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/graphics/graphicsmagick/default.nix
+++ b/pkgs/applications/graphics/graphicsmagick/default.nix
@ -1,6 +1,9 @@
 { lib, stdenv, fetchurl, bzip2, freetype, graphviz, ghostscript
 , libjpeg, libpng, libtiff, libxml2, zlib, libtool, xz, libX11
-, libwebp, quantumdepth ? 8, fixDarwinDylibNames, nukeReferences }:
+, libwebp, quantumdepth ? 8, fixDarwinDylibNames, nukeReferences
+, runCommand
+, graphicsmagick  # for passthru.tests
+}:

 stdenv.mkDerivation rec {
  pname = "graphicsmagick";
@ -33,13 +36,23 @@ stdenv.mkDerivation rec {
  # Remove CFLAGS from the binaries to avoid closure bloat.
  # In the past we have had -dev packages in the closure of the binaries soley due to the string references.
  postConfigure = ''
-    nuke-refs ./magick/magick_config.h
+    nuke-refs -e $out ./magick/magick_config.h
  '';

  postInstall = ''
    sed -i 's/-ltiff.*'\'/\'/ $out/bin/*
  '';

+  passthru = {
+    tests = {
+      issue-157920 = runCommand "issue-157920-regression-test" {
+        buildInputs = [ graphicsmagick ];
+      } ''
+        gm convert ${graphviz}/share/graphviz/doc/pdf/neatoguide.pdf jpg:$out
+      '';
+    };
+  };
+
  meta = {
    homepage = "http://www.graphicsmagick.org";
    description = "Swiss army knife of image processing";
--- a/pkgs/applications/graphics/imlibsetroot/default.nix
+++ b/pkgs/applications/graphics/imlibsetroot/default.nix
@ -9,20 +9,27 @@ stdenv.mkDerivation {
  };

  buildInputs = [ libX11 imlib2 libXinerama ];
+
  buildPhase = ''
-    gcc -g imlibsetroot.c -o imlibsetroot             \
-      `imlib2-config --cflags` `imlib2-config --libs` \
-      -I/include/X11/extensions -lXinerama -lX11
+    runHook preBuild
+
+    gcc -g imlibsetroot.c -o imlibsetroot              \
+      -I${imlib2.dev}/include -L${imlib2}/lib -lImlib2 \
+      -I${libX11.dev}/include -lXinerama -lX11
+
+    runHook postBuild
  '';
+
  installPhase = ''
-    mkdir -p $out/bin
-    install -m 755 imlibsetroot $out/bin
+    runHook preInstall
+    install -D -m 0755 imlibsetroot -t $out/bin
+    runHook postInstall
  '';

  meta = with lib; {
    description = "A Xinerama Aware Background Changer";
    homepage = "http://robotmonkeys.net/2010/03/30/imlibsetroot/";
-    license = licenses.gpl2;
+    license = licenses.mitAdvertising;
    platforms = platforms.linux;
    maintainers = with maintainers; [ dwarfmaster ];
  };
--- a/pkgs/applications/graphics/pixinsight/default.nix
+++ b/pkgs/applications/graphics/pixinsight/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, requireFile, wrapQtAppsHook, autoPatchelfHook, makeWrapper, unixtools, fakeroot
-, mime-types, libGL, libpulseaudio, alsa-lib, nss, gd, gst_all_1, nspr, expat, fontconfig
+, mailcap, libGL, libpulseaudio, alsa-lib, nss, gd, gst_all_1, nspr, expat, fontconfig
 , dbus, glib, zlib, openssl, libdrm, cups, avahi-compat, xorg, wayland, libudev0-shim
 # Qt 5 subpackages
 , qtbase, qtgamepad, qtserialport, qtserialbus, qtvirtualkeyboard, qtmultimedia, qtwebkit, qt3d, mlt
@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    fakeroot
    wrapQtAppsHook
    autoPatchelfHook
-    mime-types
+    mailcap
    libudev0-shim
  ];

--- a/pkgs/applications/misc/batsignal/default.nix
+++ b/pkgs/applications/misc/batsignal/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "batsignal";
-  version = "1.3.2";
+  version = "1.3.4";

  src = fetchFromGitHub {
    owner = "electrickite";
    repo = "batsignal";
    rev = version;
-    sha256 = "sha256-+5yAwBUyhqmoV8l8VwIQMxnSgjNZNbGfGajPhA+IFwA=";
+    sha256 = "sha256-B2HAEJj8TX44YagJ993d7js/wi1D39/Hi85rxJoKa3U=";
  };

  buildInputs = [ libnotify glib ];
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -77,6 +77,11 @@ python3.pkgs.buildPythonApplication {
  postPatch = ''
    substituteInPlace contrib/requirements/requirements.txt \
      --replace "dnspython>=2.0,<2.1" "dnspython>=2.0"
+
+    # according to upstream, this is fine
+    # https://github.com/spesmilo/electrum/issues/7361
+    substituteInPlace contrib/requirements/requirements.txt \
+      --replace "qdarkstyle<2.9" "qdarkstyle>=2.7"
  '';

  patches = [
--- a/pkgs/applications/misc/electrum/ltc.nix
+++ b/pkgs/applications/misc/electrum/ltc.nix
@ -76,6 +76,11 @@ python3.pkgs.buildPythonApplication {
  prePatch = ''
    substituteInPlace contrib/requirements/requirements.txt \
      --replace "dnspython>=2.0,<2.1" "dnspython>=2.0"
+
+    # according to upstream, this is fine
+    # https://github.com/spesmilo/electrum/issues/7361
+    substituteInPlace contrib/requirements/requirements.txt \
+      --replace "qdarkstyle<2.9" "qdarkstyle>=2.7"
  '';

  nativeBuildInputs = lib.optionals enableQt [ wrapQtAppsHook ];
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@ -2,11 +2,11 @@

 buildPythonApplication rec {
  pname = "gallery_dl";
-  version = "1.20.3";
+  version = "1.20.4";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "6d1d97bd08a2a0dcfb0578e759fb83c4902b395405b3e3238673f684973b0556";
+    sha256 = "sha256-K22ee6qcVXbJJKH5/6EMvSdSNKBb7xAP++1s+A5ENu4=";
  };

  propagatedBuildInputs = [ requests yt-dlp ];
--- a/pkgs/applications/misc/leetcode-cli/default.nix
+++ b/pkgs/applications/misc/leetcode-cli/default.nix
@ -0,0 +1,41 @@
+{ lib
+, fetchCrate
+, rustPlatform
+, pkg-config
+, openssl
+, dbus
+, sqlite
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "leetcode-cli";
+  version = "0.3.10";
+
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "SkJLA49AXNTpiWZByII2saYLyN3bAAJTlCvhamlOEXA=";
+  };
+
+  cargoSha256 = "xhKF4qYOTdt8iCSPY5yT8tH3l54HdkOAIS2SBGzqsdo=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    dbus
+    sqlite
+  ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+
+  meta = with lib; {
+    description = "May the code be with you 👻";
+    longDescription = "Use leetcode.com in command line";
+    homepage = "https://github.com/clearloop/leetcode-cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ congee ];
+    mainProgram = "leetcode";
+  };
+}
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@ -21,10 +21,11 @@ mkDerivation rec {
  version = "3.27.1.6";

  src = fetchFromGitHub {
+    name = "qcad-${version}-src";
    owner = "qcad";
    repo = "qcad";
    rev = "v${version}";
-    sha256 = "sha256-ouvWE1fa4DfPLqFYuMsUPWDx/NUaoCc7TfR6Ed0uuF4=";
+    sha256 = "sha256-NnaCwbk8w0ZPnBz7xxs5LMFMUSnEERCSRBXpJL0u+s0=";
  };

  patches = [
--- a/pkgs/applications/misc/tty-share/default.nix
+++ b/pkgs/applications/misc/tty-share/default.nix
@ -3,13 +3,13 @@
 # Upstream has a `./vendor` directory with all deps which we rely upon.
 buildGoPackage rec {
  pname = "tty-share";
-  version = "2.2.0";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = "elisescu";
    repo = "tty-share";
    rev = "v${version}";
-    sha256 = "sha256-+bdQ7KyGEdJJAopzGnDOcLvFNyiKqpagPR1EoU1VR5E=";
+    sha256 = "sha256-aAqKfi0ZX0UB07yGY6x0HcMspvq4rcJXKHSONxAwMlc=";
  };

  goPackagePath = "github.com/elisescu/tty-share";
--- a/pkgs/applications/misc/wike/default.nix
+++ b/pkgs/applications/misc/wike/default.nix
@ -14,13 +14,13 @@ let
  ]);
 in stdenv.mkDerivation rec {
  pname = "wike";
-  version = "1.7.0";
+  version = "1.7.1";

  src = fetchFromGitHub {
    owner = "hugolabe";
    repo = "Wike";
    rev = version;
-    sha256 = "sha256-Cv4gmAUqViHJEAgueLOUX+cI775QopfRA6vmHgQvCUY=";
+    sha256 = "sha256-QLhfzGRrc2En0Hu+UdtPM572PdtXqOFL0W3LoAki4jI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -93,11 +93,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.35.100";
+  version = "1.35.101";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "ToPh2uhWHMR6CS7wtos26iVuyKLXi3ctOP/dFyeosoM=";
+    sha256 = "q5GL6R87b3iYLiM9oJQgCOVeXzyNFY6x8fQ9KsDN7gk=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/lagrange/default.nix
+++ b/pkgs/applications/networking/browsers/lagrange/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "lagrange";
-  version = "1.10.3";
+  version = "1.10.4";

  src = fetchFromGitHub {
    owner = "skyjake";
    repo = "lagrange";
    rev = "v${version}";
-    sha256 = "sha256-4Xjm4P4uK0aZxUT0WzcSDdY6rEeh5YFwsMfVtFB14No=";
+    sha256 = "sha256-tj/RDGPu1hB67eTdq7NrbRd+OwBhIAm1lBgoft5m4v4=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/browsers/nyxt/default.nix
+++ b/pkgs/applications/networking/browsers/nyxt/default.nix
@ -1,7 +1,7 @@
 { stdenv, lib, lispPackages
 , makeWrapper, wrapGAppsHook, gst_all_1
 , glib, gdk-pixbuf, cairo
-, mime-types, pango, gtk3
+, mailcap, pango, gtk3
 , glib-networking, gsettings-desktop-schemas
 , xclip, notify-osd, enchant
 }:
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
  ];
  buildInputs = [
    glib gdk-pixbuf cairo
-    mime-types pango gtk3
+    mailcap pango gtk3
    glib-networking gsettings-desktop-schemas
    xclip notify-osd enchant
  ] ++ gstBuildInputs;
--- a/pkgs/applications/networking/cluster/clusterctl/default.nix
+++ b/pkgs/applications/networking/cluster/clusterctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "clusterctl";
-  version = "1.1.0";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "cluster-api";
    rev = "v${version}";
-    sha256 = "sha256-mebxbS0PVP2EdYt31G0HQ0Z+wxpXOe9/xaKdH0wwB60=";
+    sha256 = "sha256-bgc9M7shcgL1gQ9klUP0JIY4UeraO1oLsLEdG5tOLpY=";
  };

  vendorSha256 = "sha256-T2a5FBjISXprgMA6ye2xwAFLE62Qb3AUQVjpGtnduU0=";
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:

 let
-  version = "0.26.2";
-  sha256 = "1p99bjqlwyibycpby9fnzfmfd826zaw7k7d4f4p4gjpd7dphlrp1";
-  manifestsSha256 = "1s1hx754xa63s7in7gcrr146nkyvadba6vmy1bagjcxibxc3qdqy";
+  version = "0.26.3";
+  sha256 = "0j6zvcjykk775nnj8s0n5154lqslgfpi8884gh6sv204z2drfjff";
+  manifestsSha256 = "1pfk0fj228zy0m1cz0400l4r41l7p0gsdq5lqnl3a8vgb4f6i41q";

  manifests = fetchzip {
    url =
@ -23,7 +23,7 @@ in buildGoModule rec {
    inherit sha256;
  };

-  vendorSha256 = "sha256-9MMEqJiplg7kmMmbHnTBEQ+GF+dBL7bpzs5Q0IYcMXU=";
+  vendorSha256 = "sha256-34hSbOB7n9OFpVqe8y1+jAC3j0HEBg9LhYOvVGH9kLY=";

  postUnpack = ''
    cp -r ${manifests} source/cmd/flux/manifests
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@ -0,0 +1,36 @@
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
+
+buildGoModule rec {
+  pname = "glooctl";
+  version = "1.10.6";
+
+  src = fetchFromGitHub {
+    owner = "solo-io";
+    repo = "gloo";
+    rev = "v${version}";
+    sha256 = "sha256-t63tK0hwbVnUP9UxS8g3uzL3rBvKR10vu1E85mNV3E0=";
+  };
+
+  subPackages = [ "projects/gloo/cli/cmd" ];
+  vendorSha256 = "sha256-IBuAUKbX1esx2p4Q/b3UxQH9S3VVNYZcn5vRKtmhO0A=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/glooctl
+
+    export HOME=$TMP
+    installShellCompletion --cmd glooctl \
+      --bash <($out/bin/glooctl completion bash) \
+      --zsh <($out/bin/glooctl completion zsh)
+  '';
+
+  ldflags = [ "-s" "-w" "-X github.com/solo-io/gloo/pkg/version.Version=${version}" ];
+
+  meta = with lib; {
+    description = "glooctl is the unified CLI for Gloo";
+    homepage = "https://docs.solo.io/gloo-edge/latest/reference/cli/glooctl/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ nelsonjeppesen ];
+  };
+}
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@ -5,13 +5,13 @@ buildGoModule rec {
  /* Do not use "dev" as a version. If you do, Tilt will consider itself
    running in development environment and try to serve assets from the
    source tree, which is not there once build completes.  */
-  version = "0.23.9";
+  version = "0.24.1";

  src = fetchFromGitHub {
    owner  = "tilt-dev";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "sha256-sxOUO5dLWBgNvbi42/aoN4YQStuNuXxWuM3WJxh1ucg=";
+    sha256 = "sha256-lvls/2ukwcHSJCgZkumuFMtJTKOBl0CXijedjcGJePw=";
  };
  vendorSha256 = null;

--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -11,15 +11,15 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.60";
+  version = "1.2.65";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    sha256 = "sha256-EEceAIlbwfKD2K0pJxmCRn6+yc5RVBassENuMS48794=";
+    sha256 = "sha256-uQO8zJ3+eAu/F5vmaGCd2qqwK8GRlensqypRlK6CXSk=";
  };
-  vendorSha256 = "sha256-3hNqCIx6S1pEzLMRVmr04pmQrrc3T/Q/FsB/DCAVRCY=";
+  vendorSha256 = "sha256-dRevwdLiSsM2zzNQ913ytXf2XxZOfLWAUiJjk04mY28=";
  proxyVendor = true;

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@ -12,6 +12,7 @@
 , Security
 , AppKit
 , CoreServices
+, desktopToDarwinBundle
 }:

 let
@ -36,7 +37,7 @@ mkYarnPackage rec {
    sha256 = pinData.desktopYarnHash;
  };

-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ] ++ lib.optionals stdenv.isDarwin [ desktopToDarwinBundle ];

  seshat = callPackage ./seshat { inherit CoreServices; };
  keytar = callPackage ./keytar { inherit Security AppKit; };
--- a/pkgs/applications/networking/instant-messengers/jami/daemon.nix
+++ b/pkgs/applications/networking/instant-messengers/jami/daemon.nix
@ -7,7 +7,7 @@
 , autoreconfHook
 , pkg-config
 , perl # for pod2man
-, ffmpeg
+, ffmpeg_4
 , pjsip
 , alsa-lib
 , asio
@ -39,7 +39,7 @@
 let
  readLinesToList = with builtins; file: filter (s: isString s && stringLength s > 0) (split "\n" (readFile file));

-  ffmpeg-jami = ffmpeg.overrideAttrs (old:
+  ffmpeg-jami = ffmpeg_4.overrideAttrs (old:
    let
      patch-src = src + "/daemon/contrib/src/ffmpeg/";
    in
--- a/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/tg_owt.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, cmake, ninja, yasm
-, libjpeg, openssl, libopus, ffmpeg, alsa-lib, libpulseaudio, protobuf
+, libjpeg, openssl, libopus, ffmpeg_4, alsa-lib, libpulseaudio, protobuf
 , xorg, libXtst
 }:

@ -23,7 +23,7 @@ in stdenv.mkDerivation {
  nativeBuildInputs = [ pkg-config cmake ninja yasm ];

  buildInputs = [
-    libjpeg openssl libopus ffmpeg alsa-lib libpulseaudio protobuf
+    libjpeg openssl libopus ffmpeg_4 alsa-lib libpulseaudio protobuf
    xorg.libX11 libXtst
  ];

--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -5,13 +5,13 @@

 mkDerivation rec {
  pname = "qownnotes";
-  version = "22.2.1";
+  version = "22.2.2";

  src = fetchurl {
    url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
    # Fetch the checksum of current version with curl:
    # curl https://download.tuxfamily.org/qownnotes/src/qownnotes-<version>.tar.xz.sha256
-    sha256 = "26dfd41430e9efa5cc93c2d67156387a564efd0843c2020284658100b298d54c";
+    sha256 = "sha256-b2yoy1WhnPTE2fNeHVvkwKLzjeaSBhHiQgSZ9VHwkGY=";
  };

  nativeBuildInputs = [ qmake qttools ];
--- a/pkgs/applications/science/electronics/lepton-eda/default.nix
+++ b/pkgs/applications/science/electronics/lepton-eda/default.nix
@ -19,11 +19,11 @@

 stdenv.mkDerivation rec {
  pname = "lepton-eda";
-  version = "1.9.16-20210731";
+  version = "1.9.17-20211219";

  src = fetchurl {
    url = "https://github.com/lepton-eda/lepton-eda/releases/download/${version}/lepton-eda-${builtins.head (lib.splitString "-" version)}.tar.gz";
-    sha256 = "sha256-xdJ11M4RXNF6ePZD6Y+/DUdO21AFLbydZcq9nWg0+Yk=";
+    sha256 = "sha256-lOneKeJUcw6jOX/3iv9BDWOJ3xip/vGhzxHHNAbtsS8=";
  };

  nativeBuildInputs = [ pkg-config makeWrapper texinfo autoreconfHook ];
--- a/pkgs/applications/science/math/rofi-calc/default.nix
+++ b/pkgs/applications/science/math/rofi-calc/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "rofi-calc";
-  version = "2.0.0";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "svenstaro";
    repo = pname;
    rev = "v${version}";
-    sha256 = "NbWXMash0pK7Y9gOEBbL7zXjFytoeZBN9/wIbRTvQ8g=";
+    sha256 = "sha256-sfUcBSUYf/+neBAhEd5LAtMOfIbdXM/ieUOztjk8Pwg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -114,18 +114,26 @@ stdenv.mkDerivation rec {
    # strictly necessary, but keeps us from littering in the user's HOME.
    ./patches/sympow-cache.patch

+    # Upstream will wait until Sage 9.7 to upgrade to linbox 1.7 because it
+    # does not support gcc 6. We can upgrade earlier.
+    # https://trac.sagemath.org/ticket/32959
+    ./patches/linbox-1.7-upgrade.patch
+
    # https://trac.sagemath.org/ticket/32968
    (fetchSageDiff {
-      base = "9.5.beta8";
+      base = "9.5";
      name = "sphinx-4.3-update.patch";
      rev = "fc84f82f52b6f05f512cb359ec7c100f93cf8841";
      sha256 = "sha256-bBbfdcnw/9LUOlY8rHJRbFJEdMXK4shosqTNaobTS1Q=";
    })

-    # Upstream has not upgraded to linbox 1.7 yet because it conflicts with
-    # pre-4.2.1p3 versions of Singular, but we don't have this problem.
-    # https://trac.sagemath.org/ticket/32959
-    ./patches/linbox-1.7-upgrade.patch
+    # https://trac.sagemath.org/ticket/33189
+    (fetchSageDiff {
+      base = "9.5";
+      name = "arb-2.22-update.patch";
+      rev = "53532ddd4e2dc92469c1590ebf0c40f8f69bf579";
+      sha256 = "sha256-6SoSBvIlqvNwZV3jTB6uPdUtaWIOeNmddi2poK/WvGs=";
+    })
  ];

  patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
--- a/pkgs/applications/science/math/scilab-bin/default.nix
+++ b/pkgs/applications/science/math/scilab-bin/default.nix
@ -3,7 +3,7 @@
 let
  name = "scilab-bin-${ver}";

-  ver = "6.0.2";
+  ver = "6.1.1";

  badArch = throw "${name} requires i686-linux or x86_64-linux";

@ -24,7 +24,7 @@ stdenv.mkDerivation {
      if stdenv.hostPlatform.system == "i686-linux" then
        "0fgjc2ak3b2qi6yin3fy50qwk2bcj0zbz1h4lyyic9n1n1qcliib"
      else if stdenv.hostPlatform.system == "x86_64-linux" then
-        "05clcdgry90drirl3swbxn5q36fmgknnhs6h5pr7mmrzfr6r818w"
+        "sha256-PuGnz2YdAhriavwnuf5Qyy0cnCeRHlWC6dQzfr7bLHk="
      else
        badArch;
  };
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -25,7 +25,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;

 let
-  version = "2.34.1";
+  version = "2.35.1";
  svn = subversionClient.override { perlBindings = perlSupport; };

  gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@ -37,7 +37,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "0b40vf315s1kz65x1wq47g8srl4wqac39pwnvlj1mdzs3kfma1rs";
+    sha256 = "100h37cpw49pmlpf6lcpm1xi578gllf6y9in60h5mxj3cj754s6p";
  };

  outputs = [ "out" ] ++ lib.optional withManual "doc";
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mkvtoolnix";
-  version = "64.0.0";
+  version = "65.0.0";

  src = fetchFromGitLab {
    owner = "mbunkus";
    repo = "mkvtoolnix";
    rev = "release-${version}";
-    sha256 = "sha256-tg9rjTbprcVkzUUVWCKqF1dzIjFKjzIqrVADtuUU9Fk=";
+    sha256 = "1zphcpfrzic9ialx3xxi2ywzxnllys667vy140bgdshzr798sg2p";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/video/mplayer/default.nix
+++ b/pkgs/applications/video/mplayer/default.nix
@ -1,4 +1,4 @@
-{ config, lib, stdenv, fetchurl, pkg-config, freetype, yasm, ffmpeg
+{ config, lib, stdenv, fetchurl, fetchsvn, pkg-config, freetype, yasm, ffmpeg
 , aalibSupport ? true, aalib ? null
 , fontconfigSupport ? true, fontconfig ? null, freefont_ttf ? null
 , fribidiSupport ? true, fribidi ? null
@ -93,11 +93,12 @@ in

 stdenv.mkDerivation rec {
  pname = "mplayer";
-  version = "1.4";
+  version = "unstable-2022-02-03";

-  src = fetchurl {
-    url = "http://www.mplayerhq.hu/MPlayer/releases/MPlayer-${version}.tar.xz";
-    sha256 = "0j5mflr0wnklxsvnpmxvk704hscyn2785hvvihj2i3a7b3anwnc2";
+  src = fetchsvn {
+    url = "svn://svn.mplayerhq.hu/mplayer/trunk";
+    rev = "38331";
+    sha256 = "1vpic8i6zvg0zsy50vhm45ysqag561bpn9jycfbvvwl9ji7l55zi";
  };

  prePatch = ''
@ -106,8 +107,6 @@ stdenv.mkDerivation rec {
    rm -rf ffmpeg
  '';

-  patches = [ ./svn-r38199-ffmpeg44fix.patch ];
-
  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [ pkg-config yasm ];
  buildInputs = with lib;
@ -163,7 +162,6 @@ stdenv.mkDerivation rec {
    (if pulseSupport then "--enable-pulse" else "--disable-pulse")
    (if v4lSupport then "--enable-v4l2 --enable-tv-v4l2" else "--disable-v4l2 --disable-tv-v4l2")
    "--disable-xanim"
-    "--disable-ivtv"
    "--disable-xvid --disable-xvid-lavc"
    "--disable-ossaudio"
    "--disable-ffmpeg_a"
--- a/pkgs/applications/video/mplayer/svn-r38199-ffmpeg44fix.patch
+++ b/pkgs/applications/video/mplayer/svn-r38199-ffmpeg44fix.patch
@ -1,22 +0,0 @@
-Index: libmpcodecs/ad_spdif.c
-===================================================================
-diff --git a/libmpcodecs/ad_spdif.c b/libmpcodecs/ad_spdif.c
--- a/libmpcodecs/ad_spdif.c	(revision 38198)
-+++ b/libmpcodecs/ad_spdif.c	(revision 38199)
-@@ -298,14 +298,8 @@
-         if (spdif_ctx->header_written)
-             av_write_trailer(lavf_ctx);
-         av_freep(&lavf_ctx->pb);
-        if (lavf_ctx->streams) {
-            av_freep(&lavf_ctx->streams[0]->codec);
-            av_freep(&lavf_ctx->streams[0]->info);
-            av_freep(&lavf_ctx->streams[0]);
-        }
-        av_freep(&lavf_ctx->streams);
-        av_freep(&lavf_ctx->priv_data);
-+        avformat_free_context(lavf_ctx);
-+        lavf_ctx = NULL;
-     }
-    av_freep(&lavf_ctx);
-     av_freep(&spdif_ctx);
- }
--- a/pkgs/applications/video/obs-studio/default.nix
+++ b/pkgs/applications/video/obs-studio/default.nix
@ -6,7 +6,7 @@
 , addOpenGLRunpath
 , cmake
 , fdk_aac
-, ffmpeg
+, ffmpeg_4
 , jansson
 , libjack2
 , libxkbcommon
@ -73,7 +73,7 @@ mkDerivation rec {
  buildInputs = [
    curl
    fdk_aac
-    ffmpeg
+    ffmpeg_4
    jansson
    libcef
    libjack2
--- a/pkgs/applications/video/ustreamer/default.nix
+++ b/pkgs/applications/video/ustreamer/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "ustreamer";
-  version = "4.9";
+  version = "4.11";

  src = fetchFromGitHub {
    owner = "pikvm";
    repo = "ustreamer";
    rev = "v${version}";
-    sha256 = "sha256-dYwR+D2g4PxYyhsH9mGwgzTQ2Vw5UpMSomTl828gFvM=";
+    sha256 = "sha256-MTzlhnnDVZzS3lnYe3P/Hi6pi6f4B0+ejmDwV0f9juI=";
  };

  buildInputs = [ libbsd libevent libjpeg ];
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@ -10,7 +10,7 @@
 , avahi
 , dbus
 , faad2
-, ffmpeg
+, ffmpeg_4
 , flac
 , fluidsynth
 , freefont_ttf
@ -100,7 +100,7 @@ stdenv.mkDerivation rec {
    avahi
    dbus
    faad2
-    ffmpeg
+    ffmpeg_4
    flac
    fluidsynth
    fribidi
--- a/pkgs/applications/virtualization/charliecloud/default.nix
+++ b/pkgs/applications/virtualization/charliecloud/default.nix
@ -15,11 +15,11 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ autoreconfHook makeWrapper ];
  buildInputs = [
    docker
-    (python3.withPackages (ps: [ ps.lark-parser ps.requests ]))
+    (python3.withPackages (ps: [ ps.lark ps.requests ]))
  ];

  configureFlags = let
-    pythonEnv = python3.withPackages (ps: [ ps.lark-parser ps.requests ]);
+    pythonEnv = python3.withPackages (ps: [ ps.lark ps.requests ]);
  in [
    "--with-python=${pythonEnv}/bin/python3"
  ];
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@ -15,13 +15,13 @@

 buildGoModule rec {
  pname = "cri-o";
-  version = "1.22.1";
+  version = "1.23.0";

  src = fetchFromGitHub {
    owner = "cri-o";
    repo = "cri-o";
    rev = "v${version}";
-    sha256 = "sha256-x1bnDksmEjKuzjwPBENP9xpQbzo8HAW+0i2l2Ra/48Y=";
+    sha256 = "sha256-F6eWC1GhPJRyra7U80tBxfokY1PIJmsuF3H9536tPxA=";
  };
  vendorSha256 = null;

--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -33,24 +33,16 @@
 , nixosTestRunner ? false
 }:

-let
-  audio = lib.optionalString alsaSupport "alsa,"
-    + lib.optionalString pulseSupport "pa,"
-    + lib.optionalString sdlSupport "sdl,"
-    + lib.optionalString jackSupport "jack,";
-
-in
-
 stdenv.mkDerivation rec {
  pname = "qemu"
    + lib.optionalString xenSupport "-xen"
    + lib.optionalString hostCpuOnly "-host-cpu-only"
    + lib.optionalString nixosTestRunner "-for-vm-tests";
-  version = "6.1.0";
+  version = "6.2.0";

  src = fetchurl {
    url= "https://download.qemu.org/qemu-${version}.tar.xz";
-    sha256 = "15iw7982g6vc4jy1l9kk1z9sl5bm1bdbwr74y7nvwjs1nffhig7f";
+    sha256 = "0iavlsy9hin8k38230j8lfmyipx3965zljls1dp34mmc8n75vqb8";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
@ -101,55 +93,7 @@ stdenv.mkDerivation rec {
      sha256 = "09xz06g57wxbacic617pq9c0qb7nly42gif0raplldn5lw964xl2";
      revert = true;
    })
-    (fetchpatch {
-      name = "CVE-2021-3713.patch"; # remove with next release
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/13b250b12ad3c59114a6a17d59caf073ce45b33a.patch";
-      sha256 = "0lkzfc7gdlvj4rz9wk07fskidaqysmx8911g914ds1jnczgk71mf";
-    })
-    # Fixes a crash that frequently happens in some setups that share /nix/store over 9p like nixos tests
-    # on some systems. Remove with next release.
-    (fetchpatch {
-      name = "fix-crash-in-v9fs_walk.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/f83df00900816476cca41bb536e4d532b297d76e.patch";
-      sha256 = "sha256-LYGbBLS5YVgq8Bf7NVk7HBFxXq34NmZRPCEG79JPwk8=";
-    })
-    # Fixes an io error on discard/unmap operation for aio/file backend. Remove with next release.
-    (fetchpatch {
-      name = "fix-aio-discard-return-value.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/13a028336f2c05e7ff47dfdaf30dfac7f4883e80.patch";
-      sha256 = "sha256-23xVixVl+JDBNdhe5j5WY8CB4MsnUo+sjrkAkG+JS6M=";
-    })
-    # Fixes managedsave (snapshot creation) with QXL video device. Remove with next release.
-    (fetchpatch {
-      name = "qxl-fix-pre-save-logic.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/eb94846280df3f1e2a91b6179fc05f9890b7e384.patch";
-      sha256 = "sha256-p31fd47RTSw928DOMrubQQybnzDAGm23z4Yhe+hGJQ8=";
-    })
-    # Fixes socket_sockaddr_to_address_unix assertion errors in some setups. Remove with next release.
-    (fetchpatch {
-      name = "fix-unix-socket-path-copy-again.patch";
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/118d527f2e4baec5fe8060b22a6212468b8e4d3f.patch";
-      sha256 = "sha256-ox+JSpc0pqd3bMi5Ot7ljQyk70SX8g+BLufR06mZPps=";
-    })
-  ] ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch
-    ++ lib.optionals stdenv.hostPlatform.isMusl [
-    ./sigrtminmax.patch
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/alpinelinux/aports/2bb133986e8fa90e2e76d53369f03861a87a74ef/main/qemu/fix-sigevent-and-sigval_t.patch";
-      sha256 = "0wk0rrcqywhrw9hygy6ap0lfg314m9z1wr2hn8338r5gfcw75mav";
-    })
-  ] ++ lib.optionals stdenv.isDarwin [
-    # The Hypervisor.framework support patch converted something that can be applied:
-    # * https://patchwork.kernel.org/project/qemu-devel/list/?series=548227
-    # The base revision is whatever commit there is before the series starts:
-    # * https://github.com/patchew-project/qemu/commits/patchew/20210916155404.86958-1-agraf%40csgraf.de
-    # The target revision is what patchew has as the series tag from patchwork:
-    # * https://github.com/patchew-project/qemu/releases/tag/patchew%2F20210916155404.86958-1-agraf%40csgraf.de
-    (fetchpatch {
-      url = "https://github.com/patchew-project/qemu/compare/7adb961995a3744f51396502b33ad04a56a317c3..d2603c06d9c4a28e714b9b70fe5a9d0c7b0f934d.diff";
-      sha256 = "sha256-nSi5pFf9+EefUmyJzSEKeuxOt39ztgkXQyUB8fTHlcY=";
-    })
-  ];
+  ] ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch;

  postPatch = ''
    # Otherwise tries to ensure /var/run exists.
@ -180,12 +124,9 @@ stdenv.mkDerivation rec {
      --replace '$source_path/VERSION' '$source_path/QEMU_VERSION'
    substituteInPlace meson.build \
      --replace "'VERSION'" "'QEMU_VERSION'"
-  '' + lib.optionalString stdenv.hostPlatform.isMusl ''
-    NIX_CFLAGS_COMPILE+=" -D_LINUX_SYSINFO_H"
  '';

  configureFlags = [
-    "--audio-drv-list=${audio}"
    "--disable-strip" # We'll strip ourselves after separating debug info.
    "--enable-docs"
    "--enable-tools"
--- a/pkgs/applications/virtualization/qemu/sigrtminmax.patch
+++ b/pkgs/applications/virtualization/qemu/sigrtminmax.patch
@ -1,30 +0,0 @@
-From 2697fcc42546e814a2d2617671cb8398b15256fb Mon Sep 17 00:00:00 2001
-From: Will Dietz <w@wdtz.org>
-Date: Fri, 17 Aug 2018 00:22:35 -0500
-Subject: [PATCH] quick port __SIGRTMIN/__SIGRTMAX patch for qemu 3.0
-
---
- linux-user/signal.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/linux-user/signal.c b/linux-user/signal.c
-index 602b631b92..87f9240134 100644
--- a/linux-user/signal.c
-+++ b/linux-user/signal.c
-@@ -26,6 +26,13 @@
- #include "trace.h"
- #include "signal-common.h"
- 
-+#ifndef __SIGRTMIN
-+#define __SIGRTMIN 32
-+#endif
-+#ifndef __SIGRTMAX
-+#define __SIGRTMAX (NSIG-1)
-+#endif
-+
- struct target_sigaltstack target_sigaltstack_used = {
-     .ss_sp = 0,
-     .ss_size = 0,
-- 
-2.18.0
-
--- a/pkgs/applications/virtualization/seabios/default.nix
+++ b/pkgs/applications/virtualization/seabios/default.nix
@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {

  pname = "seabios";
-  version = "1.14.0";
+  version = "1.15.0";

  src = fetchurl {
    url = "https://www.seabios.org/downloads/${pname}-${version}.tar.gz";
-    sha256 = "1zc1brgafbbf5hmdr1qc1p859cabpz73l8sklq83xa4sn9icqw7b";
+    sha256 = "sha256-YownF8mUMmtFMlFXPRBZ4qOhEtSqSIds4nyz8d4ZiPg=";
  };

  nativeBuildInputs = [ python3 ];
--- a/pkgs/applications/virtualization/singularity/default.nix
+++ b/pkgs/applications/virtualization/singularity/default.nix
@ -15,11 +15,11 @@ with lib;

 buildGoPackage rec {
  pname = "singularity";
-  version = "3.8.5";
+  version = "3.8.6";

  src = fetchurl {
    url = "https://github.com/hpcng/singularity/releases/download/v${version}/singularity-${version}.tar.gz";
-    sha256 = "sha256-f/94tcB7XU0IJpvSZ6xemUOQ+TMyHlTv1rfIZoMVPOQ=";
+    sha256 = "sha256-u1o7dnCsnHpLPOWyyfPWtb5g4hsI0zjJ39q7eyqZ9Sg=";
  };

  goPackagePath = "github.com/sylabs/singularity";
--- a/pkgs/build-support/fetchgithub/default.nix
+++ b/pkgs/build-support/fetchgithub/default.nix
@ -5,10 +5,23 @@
 , deepClone ? false, private ? false, forceFetchGit ? false
 , sparseCheckout ? ""
 , githubBase ? "github.com", varPrefix ? null
+, meta ? { }
 , ... # For hash agility
 }@args:
+
 let
+
+  position = (if args.meta.description or null != null
+    then builtins.unsafeGetAttrPos "description" args.meta
+    else builtins.unsafeGetAttrPos "rev" args
+  );
  baseUrl = "https://${githubBase}/${owner}/${repo}";
+  newMeta = meta // {
+    homepage = meta.homepage or baseUrl;
+
+    # to indicate where derivation originates, similar to make-derivation.nix's mkDerivation
+    position = "${position.file}:${toString position.line}";
+  };
  passthruAttrs = removeAttrs args [ "owner" "repo" "rev" "fetchSubmodules" "forceFetchGit" "private" "githubBase" "varPrefix" ];
  varBase = "NIX${if varPrefix == null then "" else "_${varPrefix}"}_GITHUB_PRIVATE_";
  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit || (sparseCheckout != "");
@ -37,4 +50,4 @@ let
  ) // privateAttrs // passthruAttrs // { inherit name; };
 in

-fetcher fetcherArgs // { meta.homepage = baseUrl; inherit rev; }
+fetcher fetcherArgs // { meta = newMeta; inherit rev; }
--- a/pkgs/build-support/libredirect/default.nix
+++ b/pkgs/build-support/libredirect/default.nix
@ -57,7 +57,9 @@ else stdenv.mkDerivation rec {
    ''}

    if [ -n "$doInstallCheck" ]; then
-      $CC -Wall -std=c99 -O3 test.c -o test
+      $CC -Wall -std=c99 \
+        ${lib.optionalString (!stdenv.isDarwin) "-D_GNU_SOURCE"} \
+        -O3 test.c -o test
    fi

    runHook postBuild
@ -97,7 +99,7 @@ else stdenv.mkDerivation rec {
  installCheckPhase = ''
    (
      source "$hook/nix-support/setup-hook"
-      NIX_REDIRECTS="/foo/bar/test=${coreutils}/bin/true" ./test
+      NIX_REDIRECTS="/foo/bar/test=${coreutils}/bin/true:/bar/baz=$(mktemp -d)" ./test
    )
  '';

--- a/pkgs/build-support/libredirect/libredirect.c
+++ b/pkgs/build-support/libredirect/libredirect.c
@ -84,6 +84,13 @@ static const char * rewrite(const char * path, char * buf)
    return path;
 }

+static char * rewrite_non_const(char * path, char * buf)
+{
+    // as long as the argument `path` is non-const, we can consider discarding
+    // the const qualifier of the return value to be safe.
+    return (char *)rewrite(path, buf);
+}
+
 static int open_needs_mode(int flags)
 {
 #ifdef O_TMPFILE
@ -354,3 +361,117 @@ WRAPPER(int, mkdirat)(int dirfd, const char *path, mode_t mode)
    return mkdirat_real(dirfd, rewrite(path, buf), mode);
 }
 WRAPPER_DEF(mkdirat)
+
+WRAPPER(int, unlink)(const char *path)
+{
+    int (*unlink_real) (const char *path) = LOOKUP_REAL(unlink);
+    char buf[PATH_MAX];
+    return unlink_real(rewrite(path, buf));
+}
+WRAPPER_DEF(unlink)
+
+WRAPPER(int, unlinkat)(int dirfd, const char *path, int flags)
+{
+    int (*unlinkat_real) (int dirfd, const char *path, int flags) = LOOKUP_REAL(unlinkat);
+    char buf[PATH_MAX];
+    return unlinkat_real(dirfd, rewrite(path, buf), flags);
+}
+WRAPPER_DEF(unlinkat)
+
+WRAPPER(int, rmdir)(const char *path)
+{
+    int (*rmdir_real) (const char *path) = LOOKUP_REAL(rmdir);
+    char buf[PATH_MAX];
+    return rmdir_real(rewrite(path, buf));
+}
+WRAPPER_DEF(rmdir)
+
+static void copy_temp_wildcard(char * dest, char * src, int suffixlen) {
+    int dest_len = strnlen(dest, PATH_MAX);
+    int src_len = strnlen(src, PATH_MAX);
+    memcpy(dest + dest_len - (6 + suffixlen), src + src_len - (6 + suffixlen), 6);
+}
+
+WRAPPER(int, mkstemp)(char *template)
+{
+    int (*mkstemp_real) (char *template) = LOOKUP_REAL(mkstemp);
+    char buf[PATH_MAX];
+    char * rewritten = rewrite_non_const(template, buf);
+    int retval = mkstemp_real(rewritten);
+    if (retval >= 0 && rewritten != template) {
+        copy_temp_wildcard(template, rewritten, 0);
+    }
+    return retval;
+}
+WRAPPER_DEF(mkstemp)
+
+WRAPPER(int, mkostemp)(char *template, int flags)
+{
+    int (*mkostemp_real) (char *template, int flags) = LOOKUP_REAL(mkostemp);
+    char buf[PATH_MAX];
+    char * rewritten = rewrite_non_const(template, buf);
+    int retval = mkostemp_real(rewritten, flags);
+    if (retval >= 0 && rewritten != template) {
+        copy_temp_wildcard(template, rewritten, 0);
+    }
+    return retval;
+}
+WRAPPER_DEF(mkostemp)
+
+WRAPPER(int, mkstemps)(char *template, int suffixlen)
+{
+    int (*mkstemps_real) (char *template, int suffixlen) = LOOKUP_REAL(mkstemps);
+    char buf[PATH_MAX];
+    char * rewritten = rewrite_non_const(template, buf);
+    int retval = mkstemps_real(rewritten, suffixlen);
+    if (retval >= 0 && rewritten != template) {
+        copy_temp_wildcard(template, rewritten, suffixlen);
+    }
+    return retval;
+}
+WRAPPER_DEF(mkstemps)
+
+WRAPPER(int, mkostemps)(char *template, int suffixlen, int flags)
+{
+    int (*mkostemps_real) (char *template, int suffixlen, int flags) = LOOKUP_REAL(mkostemps);
+    char buf[PATH_MAX];
+    char * rewritten = rewrite_non_const(template, buf);
+    int retval = mkostemps_real(rewritten, suffixlen, flags);
+    if (retval >= 0 && rewritten != template) {
+        copy_temp_wildcard(template, rewritten, suffixlen);
+    }
+    return retval;
+}
+WRAPPER_DEF(mkostemps)
+
+WRAPPER(char *, mkdtemp)(char *template)
+{
+    char * (*mkdtemp_real) (char *template) = LOOKUP_REAL(mkdtemp);
+    char buf[PATH_MAX];
+    char * rewritten = rewrite_non_const(template, buf);
+    char * retval = mkdtemp_real(rewritten);
+    if (retval == NULL) {
+        return retval;
+    };
+    if (rewritten != template) {
+        copy_temp_wildcard(template, rewritten, 0);
+    }
+    return template;
+}
+WRAPPER_DEF(mkdtemp)
+
+WRAPPER(char *, mktemp)(char *template)
+{
+    char * (*mktemp_real) (char *template) = LOOKUP_REAL(mktemp);
+    char buf[PATH_MAX];
+    char * rewritten = rewrite_non_const(template, buf);
+    char * retval = mktemp_real(rewritten);
+    if (retval == NULL) {
+        return retval;
+    };
+    if (rewritten != template) {
+        copy_temp_wildcard(template, rewritten, 0);
+    }
+    return template;
+}
+WRAPPER_DEF(mktemp)
--- a/pkgs/build-support/libredirect/test.c
+++ b/pkgs/build-support/libredirect/test.c
@ -1,14 +1,18 @@
 #include <assert.h>
+#include <errno.h>
 #include <fcntl.h>
+#include <limits.h>
 #include <spawn.h>
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
 #include <unistd.h>

 #include <sys/stat.h>
 #include <sys/types.h>
 #include <sys/wait.h>

+#define TESTDIR "/bar/baz"
 #define TESTPATH "/foo/bar/test"
 #define SUBTEST "./test sub"

@ -41,11 +45,25 @@ void test_subprocess(void) {
    assert(system(SUBTEST) == 0);
 }

+void assert_mktemp_path(
+    const char * orig_prefix,
+    const char * orig_suffix,
+    const char * updated
+) {
+    // prefix unchanged
+    assert(strncmp(updated, orig_prefix, strlen(orig_prefix)) == 0);
+    // wildcards replaced
+    assert(strcmp(updated + strlen(orig_prefix), "XXXXXX") != 0);
+    // suffix unchanged
+    assert(strcmp(updated + strlen(orig_prefix) + 6, orig_suffix) == 0);
+}
+
 int main(int argc, char *argv[])
 {
    FILE *testfp;
    int testfd;
    struct stat testsb;
+    char buf[PATH_MAX];

    testfp = fopen(TESTPATH, "r");
    assert(testfp != NULL);
@ -59,6 +77,54 @@ int main(int argc, char *argv[])

    assert(stat(TESTPATH, &testsb) != -1);

+    assert(mkdir(TESTDIR "/dir-mkdir", 0777) == 0);
+    assert(unlink(TESTDIR "/dir-mkdir") == -1); // it's a directory!
+#ifndef __APPLE__
+    assert(errno == EISDIR);
+#endif
+    assert(rmdir(TESTDIR "/dir-mkdir") == 0);
+    assert(unlink(TESTDIR "/dir-mkdir") == -1);
+    assert(errno == ENOENT);
+
+    assert(mkdirat(123, TESTDIR "/dir-mkdirat", 0777) == 0);
+    assert(unlinkat(123, TESTDIR "/dir-mkdirat", 0) == -1); // it's a directory!
+#ifndef __APPLE__
+    assert(errno == EISDIR);
+#endif
+    assert(unlinkat(123, TESTDIR "/dir-mkdirat", AT_REMOVEDIR) == 0);
+
+    strncpy(buf, TESTDIR "/tempXXXXXX", PATH_MAX);
+    testfd = mkstemp(buf);
+    assert(testfd > 0);
+    assert_mktemp_path(TESTDIR "/temp", "", buf);
+    close(testfd);
+
+    strncpy(buf, TESTDIR "/tempXXXXXX", PATH_MAX);
+    testfd = mkostemp(buf, 0);
+    assert(testfd > 0);
+    assert_mktemp_path(TESTDIR "/temp", "", buf);
+    close(testfd);
+
+    strncpy(buf, TESTDIR "/tempXXXXXX.test", PATH_MAX);
+    testfd = mkstemps(buf, strlen(".test"));
+    assert(testfd > 0);
+    assert_mktemp_path(TESTDIR "/temp", ".test", buf);
+    close(testfd);
+
+    strncpy(buf, TESTDIR "/tempXXXXXX.test", PATH_MAX);
+    testfd = mkostemps(buf, strlen(".test"), 0);
+    assert(testfd > 0);
+    assert_mktemp_path(TESTDIR "/temp", ".test", buf);
+    close(testfd);
+
+    strncpy(buf, TESTDIR "/tempXXXXXX", PATH_MAX);
+    assert(mkdtemp(buf) == buf);
+    assert_mktemp_path(TESTDIR "/temp", "", buf);
+
+    strncpy(buf, TESTDIR "/tempXXXXXX", PATH_MAX);
+    assert(mktemp(buf) == buf);
+    assert_mktemp_path(TESTDIR "/temp", "", buf);
+
    test_spawn();
    test_system();

--- a/pkgs/build-support/make-darwin-bundle/default.nix
+++ b/pkgs/build-support/make-darwin-bundle/default.nix
@ -0,0 +1,26 @@
+# given a package with an executable and an icon, make a darwin bundle for
+# it. This package should be used when generating launchers for native Darwin
+# applications. If the package conatins a .desktop file use
+# `desktopToDarwinLauncher` instead.
+
+{ lib, writeShellScript, writeDarwinBundle }:
+
+{ name # The name of the Application file.
+, exec # Executable file.
+, icon ? "" # Optional icon file.
+}:
+
+writeShellScript "make-darwin-bundle-${name}" (''
+  function makeDarwinBundlePhase() {
+    mkdir -p "$out/Applications/${name}.app/Contents/MacOS"
+    mkdir -p "$out/Applications/${name}.app/Contents/Resources"
+
+    if [ -n "${icon}" ]; then
+      ln -s "${icon}" "$out/Applications/${name}.app/Contents/Resources"
+    fi
+
+    ${writeDarwinBundle}/bin/write-darwin-bundle "$out" "${name}" "${exec}"
+  }
+
+  preDistPhases+=" makeDarwinBundlePhase"
+'')
--- a/pkgs/build-support/make-darwin-bundle/write-darwin-bundle.nix
+++ b/pkgs/build-support/make-darwin-bundle/write-darwin-bundle.nix
@ -0,0 +1,40 @@
+{ writeScriptBin, lib, ... }:
+
+let
+  pListText = lib.generators.toPlist { } {
+    CFBundleDevelopmentRegion = "English";
+    CFBundleExecutable = "$name";
+    CFBundleIconFiles = [ "$iconPlistArray" ];
+    CFBundleIdentifier = "org.nixos.$name";
+    CFBundleInfoDictionaryVersion = "6.0";
+    CFBundleName = "$name";
+    CFBundlePackageType = "APPL";
+    CFBundleSignature = "???";
+  };
+
+# The generation of the CFBundleIconFiles array is a bit of a hack, since we
+# will always end up with an empty first element (<string></string>) but macOS
+# appears to ignore this which allows us to use the nix PList generator.
+in writeScriptBin "write-darwin-bundle" ''
+    shopt -s nullglob
+
+    readonly prefix="$1"
+    readonly name="$2"
+    readonly exec="$3"
+    iconPlistArray=""
+
+    for icon in "$prefix/Applications/$name.app/Contents/Resources"/*; do
+        iconPlistArray="$iconPlistArray</string><string>"$(basename "$icon")""
+    done
+
+    cat > "$prefix/Applications/$name.app/Contents/Info.plist" <<EOF
+${pListText}
+EOF
+
+    cat > "$prefix/Applications/$name.app/Contents/MacOS/$name" <<EOF
+#!/bin/bash
+exec $prefix/bin/$exec
+EOF
+
+    chmod +x "$prefix/Applications/$name.app/Contents/MacOS/$name"
+''
--- a/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
+++ b/pkgs/build-support/setup-hooks/desktop-to-darwin-bundle.sh
@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+fixupOutputHooks+=('convertDesktopFiles $prefix')
+
+# Get a param out of a desktop file. First parameter is the file and the second
+# is a pattern of the key who's value we should fetch.
+getDesktopParam() {
+    local file="$1";
+    local pattern="$2";
+
+    awk -F "=" "/${pattern}/ {print \$2}" "${file}"
+}
+
+# For a given .desktop file, generate a darwin '.app' bundle for it.
+convertDesktopFile() {
+    local -r file="$1"
+    local -r name=$(getDesktopParam "${file}" "^Name")
+    local -r exec=$(getDesktopParam "${file}" "Exec")
+    local -r iconName=$(getDesktopParam "${file}" "Icon")
+    local -r iconFiles=$(find "$out/share/icons/" -name "${iconName}.*" 2>/dev/null);
+    local -r pixMaps=$(find "$out/share/pixmaps/" -name "${iconName}.xpm" 2>/dev/null);
+
+    mkdir -p "$out/Applications/${name}.app/Contents/MacOS"
+    mkdir -p "$out/Applications/${name}.app/Contents/Resources"
+
+    local i=0;
+    for icon in $iconFiles; do
+      ln -s "$icon" "$out/Applications/${name}.app/Contents/Resources/$i-$(basename "$icon")"
+      (( i +=1 ));
+    done
+
+    for pixmap in $pixMaps; do
+      local newIconName="$i-$(basename "$pixmap")";
+      convert "$pixmap" "$out/Applications/${name}.app/Contents/Resources/${newIconName%.xpm}.png"
+      (( i +=1 ));
+    done
+
+    write-darwin-bundle "$out" "$name" "$exec"
+}
+
+convertDesktopFiles() {
+    local dir="$1/share/applications/"
+
+    if [ -d "${dir}" ]; then
+        for desktopFile in $(find "$dir" -iname "*.desktop"); do
+            convertDesktopFile "$desktopFile";
+        done
+    fi
+}
--- a/pkgs/build-support/setup-hooks/make-wrapper.sh
+++ b/pkgs/build-support/setup-hooks/make-wrapper.sh
@ -36,6 +36,58 @@ makeWrapper() {

    assertExecutable "$original"

+    # Write wrapper code which adds `value` to the beginning or end of
+    # the list variable named by `varName`, depending on the `mode`
+    # specified.
+    #
+    # A value which is already part of the list will not be added
+    # again. If this is the case and the `suffix` mode is used, the
+    # list won't be touched at all. The `prefix` mode will however
+    # move the last matching instance of the value to the beginning
+    # of the list. Any remaining duplicates of the value will be left
+    # as-is.
+    addValue() {
+        local mode="$1"       # `prefix` or `suffix` to add to the beginning or end respectively
+        local varName="$2"    # name of list variable to add to
+        local separator="$3"  # character used to separate elements of list
+        local value="$4"      # one value, or multiple values separated by `separator`, to add to list
+        if test -n "$value"; then
+            local old_ifs=$IFS
+            IFS=$separator
+
+            if [[ "$mode" == '--prefix'* ]]; then
+                # Keep the order of the components as written when
+                # prefixing; normally, they would be added in the
+                # reverse order.
+                local tmp=
+                for v in $value; do
+                    tmp=$v${tmp:+$separator}$tmp
+                done
+                value="$tmp"
+            fi
+            for v in $value; do
+                {
+                    echo "$varName=\${$varName:+${separator@Q}\$$varName${separator@Q}}"               # add separators on both ends unless empty
+                    if [[ "$mode" == '--prefix'* ]]; then                                              # -- in prefix mode --
+                        echo "$varName=\${$varName/${separator@Q}${v@Q}${separator@Q}/${separator@Q}}" # remove the first instance of the value (if any)
+                        echo "$varName=${v@Q}\$$varName"                                               # prepend the value
+                    elif [[ "$mode" == '--suffix'* ]]; then                                            # -- in suffix mode --
+                        echo "if [[ \$$varName != *${separator@Q}${v@Q}${separator@Q}* ]]; then"       # if the value isn't already in the list
+                        echo "    $varName=\$$varName${v@Q}"                                           # append the value
+                        echo "fi"
+                    else
+                        echo "unknown mode $mode!" 1>&2
+                        exit 1
+                    fi
+                    echo "$varName=\${$varName#${separator@Q}}"                                        # remove leading separator
+                    echo "$varName=\${$varName%${separator@Q}}"                                        # remove trailing separator
+                    echo "export $varName"
+                } >> "$wrapper"
+            done
+            IFS=$old_ifs
+        fi
+    }
+
    mkdir -p "$(dirname "$wrapper")"

    echo "#! @shell@ -e" > "$wrapper"
@ -67,28 +119,14 @@ makeWrapper() {
            separator="${params[$((n + 2))]}"
            value="${params[$((n + 3))]}"
            n=$((n + 3))
-            if test -n "$value"; then
-                if test "$p" = "--suffix"; then
-                    echo "export $varName=\$$varName\${$varName:+${separator@Q}}${value@Q}" >> "$wrapper"
-                else
-                    echo "export $varName=${value@Q}\${$varName:+${separator@Q}}\$$varName" >> "$wrapper"
-                fi
-            fi
-        elif [[ "$p" == "--prefix-each" ]]; then
+            addValue "$p" "$varName" "$separator" "$value"
+        elif [[ ("$p" == "--suffix-each") || ("$p" == "--prefix-each") ]]; then
            varName="${params[$((n + 1))]}"
            separator="${params[$((n + 2))]}"
            values="${params[$((n + 3))]}"
            n=$((n + 3))
            for value in $values; do
-                echo "export $varName=${value@Q}\${$varName:+${separator@Q}}\$$varName" >> "$wrapper"
-            done
-        elif [[ "$p" == "--suffix-each" ]]; then
-            varName="${params[$((n + 1))]}"
-            separator="${params[$((n + 2))]}"
-            values="${params[$((n + 3))]}"
-            n=$((n + 3))
-            for value in $values; do
-                echo "export $varName=\$$varName\${$varName:+$separator}${value@Q}" >> "$wrapper"
+                addValue "$p" "$varName" "$separator" "$value"
            done
        elif [[ ("$p" == "--suffix-contents") || ("$p" == "--prefix-contents") ]]; then
            varName="${params[$((n + 1))]}"
@ -97,11 +135,7 @@ makeWrapper() {
            n=$((n + 3))
            for fileName in $fileNames; do
                contents="$(cat "$fileName")"
-                if test "$p" = "--suffix-contents"; then
-                    echo "export $varName=\$$varName\${$varName:+$separator}${contents@Q}" >> "$wrapper"
-                else
-                    echo "export $varName=${contents@Q}\${$varName:+$separator}\$$varName" >> "$wrapper"
-                fi
+                addValue "$p" "$varName" "$separator" "$contents"
            done
        elif [[ "$p" == "--add-flags" ]]; then
            flags="${params[$((n + 1))]}"
--- a/pkgs/data/fonts/julia-mono/default.nix
+++ b/pkgs/data/fonts/julia-mono/default.nix
@ -1,13 +1,13 @@
 { lib, fetchzip }:

 let
-  version = "0.043";
+  version = "0.044";

 in
 fetchzip {
  name = "JuliaMono-ttf-${version}";
  url = "https://github.com/cormullion/juliamono/releases/download/v${version}/JuliaMono-ttf.tar.gz";
-  sha256 = "sha256-oxQRrFhTf37OrJSbDlmzh/7xOuKrtxO7v2+j7QcsAmE=";
+  sha256 = "sha256-KCU1eOSEWjYh6kPda/iCtZUIWIq5lK79uUCLl2w7SEg=";

  postFetch = ''
    mkdir -p $out/share/fonts/truetype
--- a/pkgs/data/misc/mime-types/default.nix
+++ b/pkgs/data/misc/mime-types/default.nix
@ -1,21 +0,0 @@
-{ lib, fetchzip }:
-
-let
-  version = "9";
-in fetchzip rec {
-  name = "mime-types-${version}";
-  url = "https://mirrors.kernel.org/gentoo/distfiles/${name}.tar.bz2";
-  postFetch = ''
-    mkdir -p $out/etc
-    tar xjvf $downloadedFile --directory=$out/etc --strip-components=1
-  '';
-  sha256 = "0gyla4wfiaccs0qh0hw7n08kdpnkkssglcg0z2jblb2lsdr4qna0";
-
-  meta = with lib; {
-    description = "A database of common mappings of file extensions to MIME types";
-    homepage = "https://packages.gentoo.org/packages/app-misc/mime-types";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ peterhoeg ];
-    platforms = platforms.all;
-  };
-}
--- a/pkgs/desktops/gnome/extensions/dash-to-panel/default.nix
+++ b/pkgs/desktops/gnome/extensions/dash-to-panel/default.nix
@ -1,31 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, glib, gettext }:
-
-stdenv.mkDerivation rec {
-  pname = "gnome-shell-extension-dash-to-panel";
-  version = "45";
-
-  src = fetchFromGitHub {
-    owner = "home-sweet-gnome";
-    repo = "dash-to-panel";
-    rev = "v${version}";
-    sha256 = "05bfd3b1g9zd86pl1rpgfqsmip271lasyfj8phpqf1gdds5yz6f6";
-  };
-
-  buildInputs = [
-    glib gettext
-  ];
-
-  makeFlags = [ "INSTALLBASE=$(out)/share/gnome-shell/extensions" ];
-
-  passthru = {
-    extensionUuid = "dash-to-panel@jderose9.github.com";
-    extensionPortalSlug = "dash-to-panel";
-  };
-
-  meta = with lib; {
-    description = "An icon taskbar for Gnome Shell";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ mounium ];
-    homepage = "https://github.com/jderose9/dash-to-panel";
-  };
-}
--- a/pkgs/desktops/gnome/extensions/manuallyPackaged.nix
+++ b/pkgs/desktops/gnome/extensions/manuallyPackaged.nix
@ -2,7 +2,6 @@
 {
  "arcmenu@arcmenu.com" = callPackage ./arcmenu { };
  "clock-override@gnomeshell.kryogenix.org" = callPackage ./clock-override { };
-  "dash-to-panel@jderose9.github.com" = callPackage ./dash-to-panel { };
  "drop-down-terminal@gs-extensions.zzrough.org" = callPackage ./drop-down-terminal { };
  "EasyScreenCast@iacopodeenosee.gmail.com" = callPackage ./EasyScreenCast { };
  "emoji-selector@maestroschan.fr" = callPackage ./emoji-selector { };
--- a/pkgs/desktops/pantheon/apps/appcenter/add-packagekit-backend-option.patch
+++ b/pkgs/desktops/pantheon/apps/appcenter/add-packagekit-backend-option.patch
@ -1,240 +0,0 @@
-From b5d7cb20713eff3b3729e5c5fdd2f15680a29385 Mon Sep 17 00:00:00 2001
-From: Bobby Rong <rjl931189261@126.com>
-Date: Sun, 31 Oct 2021 23:12:46 +0800
-Subject: [PATCH] build: add packagekit_backend option
-
---
- .github/workflows/main.yml      |  7 +++++++
- meson_options.txt               |  1 +
- src/Application.vala            |  4 ++++
- src/Core/BackendAggregator.vala |  2 ++
- src/Core/Package.vala           | 21 +++++++++++++--------
- src/Core/UpdateManager.vala     |  6 ++++++
- src/Views/Homepage.vala         |  4 ++++
- src/meson.build                 | 10 ++++++++--
- 8 files changed, 45 insertions(+), 10 deletions(-)
-
-diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
-index daf13654..5dc5a2fb 100644
--- a/.github/workflows/main.yml
-+++ b/.github/workflows/main.yml
-@@ -42,6 +42,13 @@ jobs:
-         meson configure -Dcurated=false -Dpayments=false -Dsharing=false -Dname=Pop\!_Shop build
-         ninja -C build install
- 
-+    - name: Build (NixOS)
-+      env:
-+        DESTDIR: out
-+      run: |
-+        meson configure -Dcurated=false -Dpayments=false -Dpackagekit_backend=false build
-+        ninja -C build install
-+
-   lint:
- 
-     runs-on: ubuntu-latest
-diff --git a/meson_options.txt b/meson_options.txt
-index 0ae93d07..37a6cd8a 100644
--- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -4,3 +4,4 @@ option('name', type : 'string', value : 'AppCenter', description : 'The name of
- option('payments', type : 'boolean', value : true, description : 'Enable payment features and display paid apps')
- option('sharing', type : 'boolean', value : true, description : 'Display sharing features, i.e. copyable URLs to appcenter.elementary.io')
- option('hide_upstream_distro_apps', type : 'boolean', value : true, description : 'Used for hiding Ubuntu repo apps on elementary OS')
-+option('packagekit_backend', type : 'boolean', value : true, description : 'Enable PackageKit backend')
-diff --git a/src/Application.vala b/src/Application.vala
-index 65fae5aa..7c075076 100644
--- a/src/Application.vala
-+++ b/src/Application.vala
-@@ -167,9 +167,11 @@ public class AppCenter.App : Gtk.Application {
- 
-         var client = AppCenterCore.Client.get_default ();
- 
-+#if PACKAGEKIT_BACKEND
-         if (fake_update_packages != null) {
-             AppCenterCore.PackageKitBackend.get_default ().fake_packages = fake_update_packages;
-         }
-+#endif
- 
-         if (silent) {
-             NetworkMonitor.get_default ().network_changed.connect ((available) => {
-@@ -183,6 +185,7 @@ public class AppCenter.App : Gtk.Application {
-             return;
-         }
- 
-+#if PACKAGEKIT_BACKEND
-         if (local_path != null) {
-             var file = File.new_for_commandline_arg (local_path);
- 
-@@ -192,6 +195,7 @@ public class AppCenter.App : Gtk.Application {
-                 warning ("Failed to load local AppStream XML file: %s", e.message);
-             }
-         }
-+#endif
- 
-         if (main_window == null) {
-             main_window = new MainWindow (this);
-diff --git a/src/Core/BackendAggregator.vala b/src/Core/BackendAggregator.vala
-index 539dba98..feb1eaa9 100644
--- a/src/Core/BackendAggregator.vala
-+++ b/src/Core/BackendAggregator.vala
-@@ -26,8 +26,10 @@ public class AppCenterCore.BackendAggregator : Backend, Object {
- 
-     construct {
-         backends = new Gee.ArrayList<unowned Backend> ();
-+#if PACKAGEKIT_BACKEND
-         backends.add (PackageKitBackend.get_default ());
-         backends.add (UbuntuDriversBackend.get_default ());
-+#endif
-         backends.add (FlatpakBackend.get_default ());
- 
-         unowned Gtk.Application app = (Gtk.Application) GLib.Application.get_default ();
-diff --git a/src/Core/Package.vala b/src/Core/Package.vala
-index d6f12f15..8dbd7a22 100644
--- a/src/Core/Package.vala
-+++ b/src/Core/Package.vala
-@@ -328,7 +328,14 @@ public class AppCenterCore.Package : Object {
-     public string origin_description {
-         owned get {
-             unowned string origin = component.get_origin ();
-            if (backend is PackageKitBackend) {
-+            if (backend is FlatpakBackend) {
-+                var fp_package = this as FlatpakPackage;
-+                if (fp_package != null && fp_package.installation == FlatpakBackend.system_installation) {
-+                    return _("%s (system-wide)").printf (origin);
-+                }
-+                return origin;
-+#if PACKAGEKIT_BACKEND
-+            } else if (backend is PackageKitBackend) {
-                 if (origin == APPCENTER_PACKAGE_ORIGIN) {
-                     return _("AppCenter");
-                 } else if (origin == ELEMENTARY_STABLE_PACKAGE_ORIGIN) {
-@@ -336,15 +343,9 @@ public class AppCenterCore.Package : Object {
-                 } else if (origin.has_prefix ("ubuntu-")) {
-                     return _("Ubuntu (non-curated)");
-                 }
-            } else if (backend is FlatpakBackend) {
-                var fp_package = this as FlatpakPackage;
-                if (fp_package != null && fp_package.installation == FlatpakBackend.system_installation) {
-                    return _("%s (system-wide)").printf (origin);
-                }
-
-                return origin;
-             } else if (backend is UbuntuDriversBackend) {
-                 return _("Ubuntu Drivers");
-+#endif
-             }
- 
-             return _("Unknown Origin (non-curated)");
-@@ -434,11 +435,15 @@ public class AppCenterCore.Package : Object {
-         _author_title = null;
-         backend_details = null;
- 
-+#if PACKAGEKIT_BACKEND
-         // The version on a PackageKit package comes from the package not AppStream, so only reset the version
-         // on other backends
-         if (!(backend is PackageKitBackend)) {
-             _latest_version = null;
-         }
-+#else
-+        _latest_version = null;
-+#endif
- 
-         this.component = component;
-     }
-diff --git a/src/Core/UpdateManager.vala b/src/Core/UpdateManager.vala
-index 9deceaf5..c92c0d37 100644
--- a/src/Core/UpdateManager.vala
-+++ b/src/Core/UpdateManager.vala
-@@ -52,6 +52,7 @@ public class AppCenterCore.UpdateManager : Object {
-             installed_package.update_state ();
-         }
- 
-+#if PACKAGEKIT_BACKEND
-         Pk.Results pk_updates;
-         unowned PackageKitBackend client = PackageKitBackend.get_default ();
-         try {
-@@ -60,10 +61,12 @@ public class AppCenterCore.UpdateManager : Object {
-             warning ("Unable to get updates from PackageKit backend: %s", e.message);
-             return 0;
-         }
-+#endif
- 
-         uint os_count = 0;
-         string os_desc = "";
- 
-+#if PACKAGEKIT_BACKEND
-         var package_array = pk_updates.get_package_array ();
-         debug ("PackageKit backend reports %d updates", package_array.length);
- 
-@@ -87,6 +90,7 @@ public class AppCenterCore.UpdateManager : Object {
-                 );
-             }
-         });
-+#endif
- 
-         os_updates.component.set_pkgnames ({});
-         os_updates.change_information.clear_update_info ();
-@@ -159,6 +163,7 @@ public class AppCenterCore.UpdateManager : Object {
-             count += 1;
-         }
- 
-+#if PACKAGEKIT_BACKEND
-         pk_updates.get_details_array ().foreach ((pk_detail) => {
-             var pk_package = new Pk.Package ();
-             try {
-@@ -181,6 +186,7 @@ public class AppCenterCore.UpdateManager : Object {
-                 critical (e.message);
-             }
-         });
-+#endif
- 
-         os_updates.update_state ();
-         return count;
-diff --git a/src/Views/Homepage.vala b/src/Views/Homepage.vala
-index 3673903f..2e128e77 100644
--- a/src/Views/Homepage.vala
-+++ b/src/Views/Homepage.vala
-@@ -107,9 +107,13 @@ public class AppCenter.Homepage : AbstractView {
-             column_spacing = 24,
-             orientation = Gtk.Orientation.VERTICAL
-         };
-+#if PACKAGEKIT_BACKEND
-         grid.add (banner_revealer);
-         grid.add (recently_updated_revealer);
-         grid.add (categories_label);
-+#else
-+        category_flow.margin_top = 12;
-+#endif
-         grid.add (category_flow);
- 
-         scrolled_window = new Gtk.ScrolledWindow (null, null) {
-diff --git a/src/meson.build b/src/meson.build
-index 7b319fc6..d1d77931 100644
--- a/src/meson.build
-+++ b/src/meson.build
-@@ -12,10 +12,8 @@ appcenter_files = files(
-     'Core/FlatpakBackend.vala',
-     'Core/Job.vala',
-     'Core/Package.vala',
-    'Core/PackageKitBackend.vala',
-     'Core/ScreenshotCache.vala',
-     'Core/Task.vala',
-    'Core/UbuntuDriversBackend.vala',
-     'Core/UpdateManager.vala',
-     'Dialogs/InstallFailDialog.vala',
-     'Dialogs/NonCuratedWarningDialog.vala',
-@@ -76,6 +74,14 @@ if get_option('hide_upstream_distro_apps')
-     args += '--define=HIDE_UPSTREAM_DISTRO_APPS'
- endif
- 
-+if get_option('packagekit_backend')
-+    args += '--define=PACKAGEKIT_BACKEND'
-+    appcenter_files += files(
-+        'Core/PackageKitBackend.vala',
-+        'Core/UbuntuDriversBackend.vala',
-+    )
-+endif
-+
- executable(
-     meson.project_name(),
-     appcenter_files,
--- a/pkgs/desktops/pantheon/apps/appcenter/default.nix
+++ b/pkgs/desktops/pantheon/apps/appcenter/default.nix
@ -38,13 +38,6 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-xktIHQHmz5gh72NEz9UQ9fMvBlj1BihWxHgxsHmTIB0=";
  };

-  patches = [
-    # Introduces a packagekit_backend meson flag.
-    # Makes appcenter actually work by using only the flatpak backend.
-    # https://github.com/elementary/appcenter/pull/1739
-    ./add-packagekit-backend-option.patch
-  ];
-
  nativeBuildInputs = [
    appstream-glib
    dbus # for pkg-config
@ -77,8 +70,6 @@ stdenv.mkDerivation rec {
  mesonFlags = [
    "-Dpayments=false"
    "-Dcurated=false"
-    # This option is introduced in add-packagekit-backend-option.patch
-    "-Dpackagekit_backend=false"
  ];

  postPatch = ''
--- a/pkgs/desktops/pantheon/desktop/elementary-default-settings/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-default-settings/default.nix
@ -47,8 +47,7 @@ stdenv.mkDerivation rec {
  '';

  preInstall = ''
-    # Install our override for plank dockitems as Appcenter is not ready to be preinstalled.
-    # See: https://github.com/NixOS/nixpkgs/issues/70214.
+    # Install our override for plank dockitems as the desktop file path is different.
    schema_dir=$out/share/glib-2.0/schemas
    install -D ${./overrides/plank-dockitems.gschema.override} $schema_dir/plank-dockitems.gschema.override

--- a/pkgs/desktops/pantheon/desktop/elementary-default-settings/launchers/io.elementary.appcenter.dockitem
+++ b/pkgs/desktops/pantheon/desktop/elementary-default-settings/launchers/io.elementary.appcenter.dockitem
@ -0,0 +1,2 @@
+[PlankDockItemPreferences]
+Launcher=file:///run/current-system/sw/share/applications/io.elementary.appcenter.desktop
--- a/pkgs/desktops/pantheon/desktop/elementary-default-settings/overrides/plank-dockitems.gschema.override
+++ b/pkgs/desktops/pantheon/desktop/elementary-default-settings/overrides/plank-dockitems.gschema.override
@ -1,2 +1,2 @@
 [net.launchpad.plank.dock.settings]
-dock-items=['gala-multitaskingview.dockitem','org.gnome.Epiphany.dockitem','io.elementary.mail.dockitem','io.elementary.tasks.dockitem','io.elementary.calendar.dockitem','io.elementary.music.dockitem','io.elementary.videos.dockitem','io.elementary.photos.dockitem','io.elementary.switchboard.dockitem']
+dock-items=['gala-multitaskingview.dockitem','org.gnome.Epiphany.dockitem','io.elementary.mail.dockitem','io.elementary.tasks.dockitem','io.elementary.calendar.dockitem','io.elementary.music.dockitem','io.elementary.videos.dockitem','io.elementary.photos.dockitem','io.elementary.switchboard.dockitem','io.elementary.appcenter.dockitem']
--- a/pkgs/development/beam-modules/erlang-ls/default.nix
+++ b/pkgs/development/beam-modules/erlang-ls/default.nix
@ -1,7 +1,7 @@
 { fetchFromGitHub, fetchgit, fetchHex, rebar3Relx, buildRebar3, rebar3-proper
 , stdenv, writeScript, lib }:
 let
-  version = "0.21.2";
+  version = "0.22.0";
  owner = "erlang-ls";
  repo = "erlang_ls";
  deps = import ./rebar-deps.nix {
@ -19,7 +19,7 @@ rebar3Relx {
  inherit version;
  src = fetchFromGitHub {
    inherit owner repo;
-    sha256 = "sha256-CiA71mvmq3HrJvgrEDMwp3CQ4Dl05BpTO5HusAL5FAQ=";
+    sha256 = "sha256-s5gCqQ0gJViS8t/jCAFtNYfmXQ7SBarlRLKUWHHEgSg=";
    rev = version;
  };
  releaseType = "escript";
--- a/pkgs/development/beam-modules/erlang-ls/rebar-deps.nix
+++ b/pkgs/development/beam-modules/erlang-ls/rebar-deps.nix
@ -137,11 +137,12 @@ let
    };
    erlfmt = builder {
      name = "erlfmt";
-      version = "1.0.0";
-      src = fetchHex {
-        pkg = "erlfmt";
-        version = "1.0.0";
-        sha256 = "sha256-RL4L4DzmmQLcbc2PZeezre1qr10L5wlkGIyr1K0k8E4=";
+      version = "git";
+      src = fetchFromGitHub {
+        owner = "gomoripeti";
+        repo = "erlfmt";
+        rev = "d4422d1fd79a73ef534c2bcbe5b5da4da5338833";
+        sha256 = "07jp4g6a41w7318lh8ndsvgivkj0ahz3spnrsnx4cqkdb97yjaid";
      };
      beamDeps = [ ];
    };
@ -157,11 +158,11 @@ let
    };
    elvis_core = builder {
      name = "elvis_core";
-      version = "1.1.1";
+      version = "1.3.1";
      src = fetchHex {
        pkg = "elvis_core";
-        version = "1.1.1";
-        sha256 = "sha256-ORyVuqSfJxjX+0mLzwgEbd/CAs8Kq2Oy5DknFIXJ3EI=";
+        version = "1.3.1";
+        sha256 = "sha256-eoiQv4GFoyUs1OvYJv5fita5MCTt+IV26yeunl3BnWk=";
      };
      beamDeps = [ katana_code zipper ];
    };
--- a/pkgs/development/compilers/openjdk/openjfx/11.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/11.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, writeText, gradle_4, pkg-config, perl, cmake
-, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg, python2, ruby
+, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib, ffmpeg_4, python2, ruby
 , openjdk11-bootstrap }:

 let
@ -19,7 +19,7 @@ let
      sha256 = "1h7qsylr7rnwnbimqjyn3whszp9kv4h3gpicsrb3mradxc9yv194";
    };

-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg ];
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 ];
    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python2 ruby ];

    dontUseCmakeConfigure = true;
--- a/pkgs/development/compilers/openjdk/openjfx/15.nix
+++ b/pkgs/development/compilers/openjdk/openjfx/15.nix
@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, writeText, openjdk11_headless, gradle_5
 , pkg-config, perl, cmake, gperf, gtk2, gtk3, libXtst, libXxf86vm, glib, alsa-lib
-, ffmpeg, python3, ruby }:
+, ffmpeg_4, python3, ruby }:

 let
  major = "15";
@ -21,7 +21,7 @@ let
      sha256 = "019glq8rhn6amy3n5jc17vi2wpf1pxpmmywvyz1ga8n09w7xscq1";
    };

-    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg ];
+    buildInputs = [ gtk2 gtk3 libXtst libXxf86vm glib alsa-lib ffmpeg_4 ];
    nativeBuildInputs = [ gradle_ perl pkg-config cmake gperf python3 ruby ];

    dontUseCmakeConfigure = true;
--- a/pkgs/development/compilers/rust/1_58.nix
+++ b/pkgs/development/compilers/rust/1_58.nix
@ -20,8 +20,8 @@
 } @ args:

 import ./default.nix {
-  rustcVersion = "1.57.0";
-  rustcSha256 = "06jw8ka2p3kls8p0gd4p0chhhb1ia1mlvj96zn78n7qvp71zjiim";
+  rustcVersion = "1.58.1";
+  rustcSha256 = "1iq7kj16qfpkx8gvw50d8rf7glbm6s0pj2y1qkrz7mi56vfsyfd8";

  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
  llvmSharedForHost = pkgsBuildHost.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
@ -37,24 +37,24 @@ import ./default.nix {

  # Note: the version MUST be one version prior to the version we're
  # building
-  bootstrapVersion = "1.56.1";
+  bootstrapVersion = "1.57.0";

  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
  bootstrapHashes = {
-    i686-unknown-linux-gnu = "84db34603ce22d93312ff8bccd5580fe112e932bbeb0361e7cc37668a9803a27";
-    x86_64-unknown-linux-gnu = "a6be5d045183a0b12dddf0d81633e2a64e63e4c2dfa44eb7593970c1ef93a98f";
-    x86_64-unknown-linux-musl = "3c09058d104d9a88943fb343af1fb70422f9c4a987e6703666ee8a8051211190";
-    arm-unknown-linux-gnueabihf = "c445706d109bb74de4c889687ae08a48af5808676fda15b84b7ef5970a82a5f6";
-    armv7-unknown-linux-gnueabihf = "29ec65af502370c0c1a49faecd7131f1243fe3005b419ead4b40b267af2b2db0";
-    aarch64-unknown-linux-gnu = "69792887357c8dd78c5424f0b4a624578296796d99edf6c30ebe2acc2b939aa3";
-    aarch64-unknown-linux-musl = "971d13d41657e50e3ac54f17f52b4198c3d8bc25ec489a6a9e6d12c18226dda5";
-    x86_64-apple-darwin = "8d65ef02a123c23be00101fb204d28b60498b9145dd2ee8edabf0afde6e01e55";
-    aarch64-apple-darwin = "e71c14c1368048a22e4d1851f301872ac2e6f4c574f04d2a7ae4d64b0e7c7235";
-    powerpc64le-unknown-linux-gnu = "fa78b28fe1ef3cd4add9ec151e5eab756dfc83c8bc3e5a576a6eddd350c4de7a";
-    riscv64gc-unknown-linux-gnu = "5ec327d1bd3ba8d00afbe9be4a1f0fb8ab845063fcf9be479be9493c52a4dbb6";
+    i686-unknown-linux-gnu = "7e4ac8ca2874897099a3ceb89039ceee170f474a98ee247589fd6bca8dda7cfa";
+    x86_64-unknown-linux-gnu = "ea0253784b2e5c22659ff148d492a68d2e11da734491714ebc61cc93896efcda";
+    x86_64-unknown-linux-musl = "56876ebca0e46236208c8bd3c3425dba553abe49639e1040ee8b95bc66a45d33";
+    arm-unknown-linux-gnueabihf = "b4448f7a96da4feee99a2c4b16b5738b99ab7e86e22d284ea6f7dca5921bca9b";
+    armv7-unknown-linux-gnueabihf = "577682b1405e8901f971839407daaad06d8ae68ad370305b75d569ba293c4fb4";
+    aarch64-unknown-linux-gnu = "d66847f7cf7b548ecb328c400ac4f691ee2aea6ff5cd9286ad8733239569556c";
+    aarch64-unknown-linux-musl = "91c8e5171e5715261f7f635142a10a9415a4e5ba55374daf76f0b713c8b08132";
+    x86_64-apple-darwin = "15ceffc4743434c19d08f73fb4edd6642b7fd8162ed7101d3e6ca2c691fcb699";
+    aarch64-apple-darwin = "7511075e28b715e2d9c7ee74221779f8444681a4bb60ac3a0270a5fdf08bdd5a";
+    powerpc64le-unknown-linux-gnu = "3ddc1abed6b7535c4150bf54291901fa856806c948bc21b711e24a3c8d810be7";
+    riscv64gc-unknown-linux-gnu = "f809df1c6ac0adc9bd37eb871dfb0d9809f3ed7f61ba611f9305e9eb8f8c9226";
  };

-  selectRustPackage = pkgs: pkgs.rust_1_57;
+  selectRustPackage = pkgs: pkgs.rust_1_58;

  rustcPatches = [
  ];
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "babashka";
-  version = "0.7.3";
+  version = "0.7.4";

  src = fetchurl {
    url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-zbxFMc02hbsU2ERlUzqMBHwHYfORB7TkMINrKC52PPU=";
+    sha256 = "sha256-GphF32CFxZYaoTG1k9pP+cRNs/PIKtwevTcIyjG7CpQ=";
  };

  executable = "bb";
--- a/pkgs/development/interpreters/clojure/default.nix
+++ b/pkgs/development/interpreters/clojure/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "clojure";
-  version = "1.10.3.1058";
+  version = "1.10.3.1075";

  src = fetchurl {
    # https://clojure.org/releases/tools
    url = "https://download.clojure.org/install/clojure-tools-${version}.tar.gz";
-    sha256 = "guIQjiWyulITZZSjt/kCtU5qo4FG/2IK2rwBI6Ttfe0=";
+    sha256 = "5uJtr6uz6mrkoFfzUmUb6vy5H4s1Lag3CNCsGwsQZ9Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/interpreters/nextflow/default.nix
+++ b/pkgs/development/interpreters/nextflow/default.nix
@ -0,0 +1,56 @@
+{ lib
+, stdenv
+, fetchurl
+, makeWrapper
+, jre
+, wget
+, which
+, gnused
+, gawk
+, coreutils
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nextflow";
+  version = "21.10.6";
+
+  src = fetchurl {
+    url = "https://github.com/nextflow-io/nextflow/releases/download/v${version}/nextflow-${version}-all";
+    sha256 = "0l9hi51vrhvfx3px2pxw7lp4h21n8ks50x4icfk3hbgl2hwf7fvx";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ jre wget which gnused gawk coreutils ];
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    install -Dm755 $src $out/bin/nextflow
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/nextflow --prefix PATH : ${lib.makeBinPath buildInputs}
+  '';
+
+  meta = with lib; {
+    description = "A DSL for data-driven computational pipelines";
+    longDescription = ''
+      Nextflow is a bioinformatics workflow manager that enables the development of portable and reproducible workflows.
+
+      It supports deploying workflows on a variety of execution platforms including local, HPC schedulers, AWS Batch, Google Cloud Life Sciences, and Kubernetes.
+
+      Additionally, it provides support for manage your workflow dependencies through built-in support for Conda, Docker, Singularity, and Modules.
+    '';
+    homepage = "https://www.nextflow.io/";
+    changelog = "https://github.com/nextflow-io/nextflow/releases";
+    license = licenses.asl20;
+    maintainers = [ maintainers.Etjean ];
+    mainProgram = "nextflow";
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -4,7 +4,7 @@
 , libffi
 , gdbm
 , xz
-, mime-types ? null, mimetypesSupport ? true
+, mailcap, mimetypesSupport ? true
 , ncurses
 , openssl
 , readline
@ -17,6 +17,7 @@
 , configd
 , autoreconfHook
 , autoconf-archive
+, pkg-config
 , python-setup-hook
 , nukeReferences
 # For the Python package set
@ -62,8 +63,6 @@ assert x11Support -> tcl != null

 assert bluezSupport -> bluez != null;

-assert mimetypesSupport -> mime-types != null;
-
 assert lib.assertMsg (enableOptimizations -> (!stdenv.cc.isClang))
  "Optimizations with clang are not supported. configure: error: llvm-profdata is required for a --enable-optimizations build but could not be found.";

@ -105,7 +104,7 @@ let

  nativeBuildInputs = optionals (!stdenv.isDarwin) [
    autoreconfHook
-  ] ++ optionals (!stdenv.isDarwin && passthru.pythonAtLeast "3.10") [
+    pkg-config
    autoconf-archive # needed for AX_CHECK_COMPILE_FLAG
  ] ++ [
    nukeReferences
@ -277,7 +276,7 @@ in with passthru; stdenv.mkDerivation {
      --replace "'/bin/sh'" "'${bash}/bin/sh'"
  '' + optionalString mimetypesSupport ''
    substituteInPlace Lib/mimetypes.py \
-      --replace "@mime-types@" "${mime-types}"
+      --replace "@mime-types@" "${mailcap}"
  '' + optionalString (x11Support && (tix != null)) ''
    substituteInPlace "Lib/tkinter/tix.py" --replace "os.environ.get('TIX_LIBRARY')" "os.environ.get('TIX_LIBRARY') or '${tix}/lib'"
  '';
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -133,10 +133,19 @@ with pkgs;
      sourceVersion = {
        major = "3";
        minor = "9";
-        patch = "9";
+        patch = "10";
        suffix = "";
      };
-      sha256 = "sha256-BoKMBKVzwHOk5RxCkqJ8G+SuJmIcPtx8+TGEGM47bSc=";
+      sha256 = "sha256-Co+/tSh+vDoT6brz1U4I+gZ3j/7M9jEa74Ibs6ZYbMg=";
+    };
+    python310 = {
+      sourceVersion = {
+        major = "3";
+        minor = "10";
+        patch = "2";
+        suffix = "";
+      };
+      sha256 = "sha256-F946x9qfJRmqnWQ3jGA6c6DprVjf+ogS5FFgwIbeZMc=";
    };
  };

@ -180,18 +189,11 @@ in {
    inherit passthruFun;
  } // sources.python39);

-  python310 = callPackage ./cpython {
+  python310 = callPackage ./cpython ({
    self = python310;
-    sourceVersion = {
-      major = "3";
-      minor = "10";
-      patch = "1";
-      suffix = "";
-    };
-    sha256 = "0xz1wrd6xi20sbli30vm6jclc4rlnnd03irybknf2p8sdrdjdwd7";
    inherit (darwin) configd;
    inherit passthruFun;
-  };
+  } // sources.python310);

  python311 = callPackage ./cpython {
    self = python311;
@ -199,9 +201,9 @@ in {
      major = "3";
      minor = "11";
      patch = "0";
-      suffix = "a2";
+      suffix = "a4";
    };
-    sha256 = "sha256-aKjE1s4lSKe2F9aZ+9s0iTe9rODPltsaoIOEnfXa0T8=";
+    sha256 = "sha256-Q3/nN2w2Pa+vNM6A8ERrQfyaQsDiqMflGdPwoLfPs+0=";
    inherit (darwin) configd;
    inherit passthruFun;
  };
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@ -166,6 +166,8 @@ let
        # Bundler tries to create this directory
        postInstall = ''
          rbConfig=$(find $out/lib/ruby -name rbconfig.rb)
+          # Remove references to the build environment from the closure
+          sed -i '/^  CONFIG\["\(BASERUBY\|SHELL\|GREP\|EGREP\|MKDIR_P\|MAKEDIRS\|INSTALL\)"\]/d' $rbConfig
          # Remove unnecessary groff reference from runtime closure, since it's big
          sed -i '/NROFF/d' $rbConfig
          ${
@ -203,7 +205,6 @@ let
          # Add rbconfig shim so ri can find docs
          mkdir -p $devdoc/lib/ruby/site_ruby
          cp ${./rbconfig.rb} $devdoc/lib/ruby/site_ruby/rbconfig.rb
-          sed -i '/^  CONFIG\["\(BASERUBY\|SHELL\|GREP\|EGREP\|MKDIR_P\|MAKEDIRS\|INSTALL\)"\]/d' $rbConfig
        '' + opString useBaseRuby ''
          # Prevent the baseruby from being included in the closure.
          ${removeReferencesTo}/bin/remove-references-to \
--- a/pkgs/development/libraries/abseil-cpp/default.nix
+++ b/pkgs/development/libraries/abseil-cpp/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
    owner = "abseil";
    repo = "abseil-cpp";
    rev = version;
-    sha256 = "0g9rbhk3mwjdfxk7cscd04vm8fphd5flz9yykpgvyy1nwa34zk3x";
+    sha256 = "sha256-fcxPhuI2eL/fnd6nT11p8DpUNwGNaXZmd03yOiZcOT0=";
  };

  patches = [
--- a/pkgs/development/libraries/abseil-cpp/202111.nix
+++ b/pkgs/development/libraries/abseil-cpp/202111.nix
@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, cmake
+, static ? stdenv.hostPlatform.isStatic
+, cxxStandard ? null
+}:
+
+stdenv.mkDerivation rec {
+  pname = "abseil-cpp";
+  version = "20211102.0";
+
+  src = fetchFromGitHub {
+    owner = "abseil";
+    repo = "abseil-cpp";
+    rev = version;
+    sha256 = "sha256-sSXT6D4JSrk3dA7kVaxfKkzOMBpqXQb0WbMYWG+nGwk=";
+  };
+
+  cmakeFlags = [
+    "-DBUILD_SHARED_LIBS=${if static then "OFF" else "ON"}"
+  ] ++ lib.optionals (cxxStandard != null) [
+    "-DCMAKE_CXX_STANDARD=${cxxStandard}"
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "An open-source collection of C++ code designed to augment the C++ standard library";
+    homepage = "https://abseil.io/";
+    license = licenses.asl20;
+    platforms = platforms.all;
+    maintainers = [ maintainers.andersk ];
+  };
+}
--- a/pkgs/development/libraries/ace/default.nix
+++ b/pkgs/development/libraries/ace/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ace";
-  version = "7.0.5";
+  version = "7.0.6";

  src = fetchurl {
    url = "https://download.dre.vanderbilt.edu/previous_versions/ACE-${version}.tar.bz2";
-    sha256 = "sha256-Q4v0HhhKUmLit5+V7bb9g4T7fqaeJJxU512vBZqNl1c=";
+    sha256 = "sha256-SgzX2khR92n9388z9mPrpK+tgk7+/59Z8TTEZA7oAhY=";
  };

  enableParallelBuilding = true;
--- a/pkgs/development/libraries/arb/default.nix
+++ b/pkgs/development/libraries/arb/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "arb";
-  version = "2.21.1";
+  version = "2.22.1";

  src = fetchFromGitHub {
    owner = "fredrik-johansson";
    repo = pname;
    rev = version;
-    sha256 = "sha256-OBY2gKVnvrZLVrv+d6rXQLo026mrGB9eyNV4LESgrNI=";
+    sha256 = "sha256-Xd3dy7zr4i3pULLFOYtedpS5Yj9Ljwyu6r4kfhRynmE=";
  };

  buildInputs = [ mpir gmp mpfr flint ];
@ -27,6 +27,8 @@ stdenv.mkDerivation rec {
    "--with-flint=${flint}"
  ];

+  enableParallelBuilding = true;
+
  doCheck = true;

  meta = with lib; {
--- a/pkgs/development/libraries/boehm-gc/default.nix
+++ b/pkgs/development/libraries/boehm-gc/default.nix
@ -19,10 +19,6 @@ stdenv.mkDerivation rec {
  outputs = [ "out" "dev" "doc" ];
  separateDebugInfo = stdenv.isLinux && stdenv.hostPlatform.libc != "musl";

-  preConfigure = lib.optionalString (stdenv.hostPlatform.libc == "musl") ''
-    export NIX_CFLAGS_COMPILE+=" -D_GNU_SOURCE -DUSE_MMAP -DHAVE_DL_ITERATE_PHDR"
-  '';
-
  # boehm-gc whitelists GCC threading models
  patches = lib.optional stdenv.hostPlatform.isMinGW ./mcfgthread.patch;

--- a/pkgs/development/libraries/catch2/default.nix
+++ b/pkgs/development/libraries/catch2/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "catch2";
-  version = "2.13.7";
+  version = "2.13.8";

  src = fetchFromGitHub {
    owner = "catchorg";
    repo = "Catch2";
    rev = "v${version}";
-    sha256="sha256-NhZ8Hh7dka7KggEKKZyEbIZahuuTYeCT7cYYSUvkPzI=";
+    sha256="sha256-jOA2TxDgaJUJ2Jn7dVGZUbjmphTDuVZahzSaxfJpRqE=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/chromaprint/default.nix
+++ b/pkgs/development/libraries/chromaprint/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, cmake, boost, ffmpeg, darwin, zlib }:
+{ lib, stdenv, fetchurl, cmake, boost, ffmpeg_4, darwin, zlib }:

 stdenv.mkDerivation rec {
  pname = "chromaprint";
@ -11,7 +11,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake ];

-  buildInputs = [ boost ffmpeg ] ++ lib.optionals stdenv.isDarwin
+  buildInputs = [ boost ffmpeg_4 ] ++ lib.optionals stdenv.isDarwin
    (with darwin.apple_sdk.frameworks; [Accelerate CoreGraphics CoreVideo zlib]);

  cmakeFlags = [ "-DBUILD_EXAMPLES=ON" "-DBUILD_TOOLS=ON" ];
--- a/pkgs/development/libraries/expat/default.nix
+++ b/pkgs/development/libraries/expat/default.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  pname = "expat";
-  version = "2.4.2";
+  version = "2.4.4";

  src = fetchurl {
    url = "https://github.com/libexpat/libexpat/releases/download/R_${lib.replaceStrings ["."] ["_"] version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-vC/1j0nCmqx7/3BabBZ6gh8mxRIHn/CKxDL9D9ybsZk=";
+    sha256 = "sha256-tdJdbjczUcLtGbVitHMtAdJYmsjI6eeWLY3xIHzDEbg=";
  };

  outputs = [ "out" "dev" ]; # TODO: fix referrers
--- a/pkgs/development/libraries/faad2/default.nix
+++ b/pkgs/development/libraries/faad2/default.nix
@ -21,7 +21,7 @@ stdenv.mkDerivation rec {

  meta = {
    description = "An open source MPEG-4 and MPEG-2 AAC decoder";
-    license     = licenses.gpl2;
+    license     = licenses.gpl2Plus;
    maintainers = with maintainers; [ codyopel ];
    platforms   = platforms.all;
  };
--- a/Show More
+++ b/Show More