Merge branch 'master' into staging-next

2024-11-20 20:02:14 +03:00 · 2021-04-15 01:01:26 +02:00 · 2021-04-15 01:01:26 +02:00 · 7cf67850c0
commit 7cf67850c0
parent eb8e023674 85cf6bed94
60 changed files with 979 additions and 274 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3431,6 +3431,12 @@
    githubId = 2129135;
    name = "Frederik Rietdijk";
  };
+  friedelino = {
+    email = "friede.mann@posteo.de";
+    github = "friedelino";
+    githubId = 46672819;
+    name = "Frido Friedemann";
+  };
  frlan = {
    email = "frank@frank.uvena.de";
    github = "frlan";
--- a/nixos/doc/manual/development/settings-options.xml
+++ b/nixos/doc/manual/development/settings-options.xml
@ -167,7 +167,7 @@ in {

    # We know that the `user` attribute exists because we set a default value
    # for it above, allowing us to use it without worries here
-    users.users.${cfg.settings.user} = {};
+    users.users.${cfg.settings.user} = { isSystemUser = true; };

    # ...
  };
--- a/nixos/doc/manual/release-notes/rl-2105.xml
+++ b/nixos/doc/manual/release-notes/rl-2105.xml
@ -845,6 +845,13 @@ environment.systemPackages = [
     The option's description was incorrect regarding ownership management and has been simplified greatly.
    </para>
   </listitem>
+   <listitem>
+    <para>
+      When defining a new user, one of <xref linkend="opt-users.users._name_.isNormalUser" /> and <xref linkend="opt-users.users._name_.isSystemUser" /> is now required.
+      This is to prevent accidentally giving a UID above 1000 to system users, which could have unexpected consequences, like running user activation scripts for system users.
+      Note that users defined with an explicit UID below 500 are exempted from this check, as <xref linkend="opt-users.users._name_.isSystemUser" /> has no effect for those.
+    </para>
+   </listitem>
   <listitem>
     <para>
       The GNOME desktop manager once again installs <package>gnome3.epiphany</package> by default.
--- a/nixos/modules/config/pulseaudio.nix
+++ b/nixos/modules/config/pulseaudio.nix
@ -306,6 +306,7 @@ in {
        description = "PulseAudio system service user";
        home = stateDir;
        createHome = true;
+        isSystemUser = true;
      };

      users.groups.pulse.gid = gid;
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@ -92,6 +92,8 @@ let
          the user's UID is allocated in the range for system users
          (below 500) or in the range for normal users (starting at
          1000).
+          Exactly one of <literal>isNormalUser</literal> and
+          <literal>isSystemUser</literal> must be true.
        '';
      };

@ -107,6 +109,8 @@ let
          <option>useDefaultShell</option> to <literal>true</literal>,
          and <option>isSystemUser</option> to
          <literal>false</literal>.
+          Exactly one of <literal>isNormalUser</literal> and
+          <literal>isSystemUser</literal> must be true.
        '';
      };

@ -521,6 +525,7 @@ in {
      };
      nobody = {
        uid = ids.uids.nobody;
+        isSystemUser = true;
        description = "Unprivileged account (don't use!)";
        group = "nogroup";
      };
@ -608,17 +613,28 @@ in {
          Neither the root account nor any wheel user has a password or SSH authorized key.
          You must set one to prevent being locked out of your system.'';
      }
-    ] ++ flip mapAttrsToList cfg.users (name: user:
-      {
+    ] ++ flatten (flip mapAttrsToList cfg.users (name: user:
+      [
+        {
        assertion = (user.hashedPassword != null)
-                    -> (builtins.match ".*:.*" user.hashedPassword == null);
+        -> (builtins.match ".*:.*" user.hashedPassword == null);
        message = ''
-          The password hash of user "${user.name}" contains a ":" character.
-          This is invalid and would break the login system because the fields
-          of /etc/shadow (file where hashes are stored) are colon-separated.
-          Please check the value of option `users.users."${user.name}".hashedPassword`.'';
-      }
-    );
+            The password hash of user "${user.name}" contains a ":" character.
+            This is invalid and would break the login system because the fields
+            of /etc/shadow (file where hashes are stored) are colon-separated.
+            Please check the value of option `users.users."${user.name}".hashedPassword`.'';
+          }
+          {
+            assertion = let
+              xor = a: b: a && !b || b && !a;
+              isEffectivelySystemUser = user.isSystemUser || (user.uid != null && user.uid < 500);
+            in xor isEffectivelySystemUser user.isNormalUser;
+            message = ''
+              Exactly one of users.users.${user.name}.isSystemUser and users.users.${user.name}.isNormalUser must be set.
+            '';
+          }
+        ]
+    ));

    warnings =
      builtins.filter (x: x != null) (
--- a/nixos/modules/services/backup/borgbackup.nix
+++ b/nixos/modules/services/backup/borgbackup.nix
@ -169,6 +169,7 @@ let
        (map (mkAuthorizedKey cfg false) cfg.authorizedKeys
        ++ map (mkAuthorizedKey cfg true) cfg.authorizedKeysAppendOnly);
      useDefaultShell = true;
+      isSystemUser = true;
    };
    groups.${cfg.group} = { };
  };
--- a/nixos/modules/services/databases/pgmanage.nix
+++ b/nixos/modules/services/databases/pgmanage.nix
@ -197,6 +197,7 @@ in {
        group = pgmanage;
        home  = cfg.sqlRoot;
        createHome = true;
+        isSystemUser = true;
      };
      groups.${pgmanage} = {
        name = pgmanage;
--- a/nixos/modules/services/misc/bazarr.nix
+++ b/nixos/modules/services/misc/bazarr.nix
@ -64,6 +64,7 @@ in

    users.users = mkIf (cfg.user == "bazarr") {
      bazarr = {
+        isSystemUser = true;
        group = cfg.group;
        home = "/var/lib/${config.systemd.services.bazarr.serviceConfig.StateDirectory}";
      };
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@ -21,6 +21,7 @@ let
         calls in `libstore/build.cc', don't add any supplementary group
         here except "nixbld".  */
      uid = builtins.add config.ids.uids.nixbld nr;
+      isSystemUser = true;
      group = "nixbld";
      extraGroups = [ "nixbld" ];
    };
--- a/nixos/modules/services/monitoring/tuptime.nix
+++ b/nixos/modules/services/monitoring/tuptime.nix
@ -34,7 +34,10 @@ in {

    users = {
      groups._tuptime.members = [ "_tuptime" ];
-      users._tuptime.description = "tuptime database owner";
+      users._tuptime = {
+        isSystemUser = true;
+        description = "tuptime database owner";
+      };
    };

    systemd = {
--- a/nixos/modules/services/networking/bird.nix
+++ b/nixos/modules/services/networking/bird.nix
@ -73,6 +73,7 @@ let
          users.${variant} = {
            description = "BIRD Internet Routing Daemon user";
            group = variant;
+            isSystemUser = true;
          };
          groups.${variant} = {};
        };
--- a/nixos/modules/services/networking/ncdns.nix
+++ b/nixos/modules/services/networking/ncdns.nix
@ -243,8 +243,10 @@ in
        xlog.journal = true;
    };

-    users.users.ncdns =
-      { description = "ncdns daemon user"; };
+    users.users.ncdns = {
+      isSystemUser = true;
+      description = "ncdns daemon user";
+    };

    systemd.services.ncdns = {
      description = "ncdns daemon";
--- a/nixos/modules/services/networking/pixiecore.nix
+++ b/nixos/modules/services/networking/pixiecore.nix
@ -93,6 +93,7 @@ in
    users.users.pixiecore = {
      description = "Pixiecore daemon user";
      group = "pixiecore";
+      isSystemUser = true;
    };

    networking.firewall = mkIf cfg.openFirewall {
--- a/nixos/modules/services/networking/pleroma.nix
+++ b/nixos/modules/services/networking/pleroma.nix
@ -75,6 +75,7 @@ in {
        description = "Pleroma user";
        home = cfg.stateDir;
        extraGroups = [ cfg.group ];
+        isSystemUser = true;
      };
      groups."${cfg.group}" = {};
    };
--- a/nixos/modules/services/security/privacyidea.nix
+++ b/nixos/modules/services/security/privacyidea.nix
@ -264,6 +264,7 @@ in

      users.users.privacyidea = mkIf (cfg.user == "privacyidea") {
        group = cfg.group;
+        isSystemUser = true;
      };

      users.groups.privacyidea = mkIf (cfg.group == "privacyidea") {};
@ -294,6 +295,7 @@ in

      users.users.pi-ldap-proxy = mkIf (cfg.ldap-proxy.user == "pi-ldap-proxy") {
        group = cfg.ldap-proxy.group;
+        isSystemUser = true;
      };

      users.groups.pi-ldap-proxy = mkIf (cfg.ldap-proxy.group == "pi-ldap-proxy") {};
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@ -607,6 +607,7 @@ in {
        home = "${cfg.home}";
        group = "nextcloud";
        createHome = true;
+        isSystemUser = true;
      };
      users.groups.nextcloud.members = [ "nextcloud" config.services.nginx.user ];

--- a/nixos/tests/mysql/mariadb-galera-mariabackup.nix
+++ b/nixos/tests/mysql/mariadb-galera-mariabackup.nix
@ -31,7 +31,7 @@ in {
        firewall.allowedTCPPorts = [ 3306 4444 4567 4568 ];
        firewall.allowedUDPPorts = [ 4567 ];
      };
-      users.users.testuser = { };
+      users.users.testuser = { isSystemUser = true; };
      systemd.services.mysql = with pkgs; {
        path = [ mysqlenv-common mysqlenv-mariabackup ];
      };
@ -89,7 +89,7 @@ in {
        firewall.allowedTCPPorts = [ 3306 4444 4567 4568 ];
        firewall.allowedUDPPorts = [ 4567 ];
      };
-      users.users.testuser = { };
+      users.users.testuser = { isSystemUser = true; };
      systemd.services.mysql = with pkgs; {
        path = [ mysqlenv-common mysqlenv-mariabackup ];
      };
@ -136,7 +136,7 @@ in {
        firewall.allowedTCPPorts = [ 3306 4444 4567 4568 ];
        firewall.allowedUDPPorts = [ 4567 ];
      };
-      users.users.testuser = { };
+      users.users.testuser = { isSystemUser = true; };
      systemd.services.mysql = with pkgs; {
        path = [ mysqlenv-common mysqlenv-mariabackup ];
      };
--- a/nixos/tests/mysql/mariadb-galera-rsync.nix
+++ b/nixos/tests/mysql/mariadb-galera-rsync.nix
@ -31,7 +31,7 @@ in {
        firewall.allowedTCPPorts = [ 3306 4444 4567 4568 ];
        firewall.allowedUDPPorts = [ 4567 ];
      };
-      users.users.testuser = { };
+      users.users.testuser = { isSystemUser = true; };
      systemd.services.mysql = with pkgs; {
        path = [ mysqlenv-common mysqlenv-rsync ];
      };
@ -84,7 +84,7 @@ in {
        firewall.allowedTCPPorts = [ 3306 4444 4567 4568 ];
        firewall.allowedUDPPorts = [ 4567 ];
      };
-      users.users.testuser = { };
+      users.users.testuser = { isSystemUser = true; };
      systemd.services.mysql = with pkgs; {
        path = [ mysqlenv-common mysqlenv-rsync ];
      };
@ -130,7 +130,7 @@ in {
        firewall.allowedTCPPorts = [ 3306 4444 4567 4568 ];
        firewall.allowedUDPPorts = [ 4567 ];
      };
-      users.users.testuser = { };
+      users.users.testuser = { isSystemUser = true; };
      systemd.services.mysql = with pkgs; {
        path = [ mysqlenv-common mysqlenv-rsync ];
      };
--- a/nixos/tests/mysql/mysql.nix
+++ b/nixos/tests/mysql/mysql.nix
@ -9,8 +9,8 @@ import ./../make-test-python.nix ({ pkgs, ...} : {
      { pkgs, ... }:

      {
-        users.users.testuser = { };
-        users.users.testuser2 = { };
+        users.users.testuser = { isSystemUser = true; };
+        users.users.testuser2 = { isSystemUser = true; };
        services.mysql.enable = true;
        services.mysql.initialDatabases = [
          { name = "testdb3"; schema = ./testdb.sql; }
@ -44,8 +44,8 @@ import ./../make-test-python.nix ({ pkgs, ...} : {
        # Kernel panic - not syncing: Out of memory: compulsory panic_on_oom is enabled
        virtualisation.memorySize = 1024;

-        users.users.testuser = { };
-        users.users.testuser2 = { };
+        users.users.testuser = { isSystemUser = true; };
+        users.users.testuser2 = { isSystemUser = true; };
        services.mysql.enable = true;
        services.mysql.initialDatabases = [
          { name = "testdb3"; schema = ./testdb.sql; }
@ -75,8 +75,8 @@ import ./../make-test-python.nix ({ pkgs, ...} : {
      { pkgs, ... }:

      {
-        users.users.testuser = { };
-        users.users.testuser2 = { };
+        users.users.testuser = { isSystemUser = true; };
+        users.users.testuser2 = { isSystemUser = true; };
        services.mysql.enable = true;
        services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
          ALTER USER root@localhost IDENTIFIED WITH unix_socket;
--- a/nixos/tests/redis.nix
+++ b/nixos/tests/redis.nix
@ -22,11 +22,10 @@ in
        users.users."member" = {
          createHome = false;
          description = "A member of the redis group";
+          isNormalUser = true;
          extraGroups = [
            "redis"
          ];
-          group = "users";
-          shell = "/bin/sh";
        };
      };
  };
--- a/nixos/tests/rspamd.nix
+++ b/nixos/tests/rspamd.nix
@ -274,7 +274,10 @@ in

        I find cows to be evil don't you?
      '';
-      users.users.tester.password = "test";
+      users.users.tester = {
+        isNormalUser = true;
+        password = "test";
+      };
      services.postfix = {
        enable = true;
        destination = ["example.com"];
--- a/nixos/tests/shadow.nix
+++ b/nixos/tests/shadow.nix
@ -13,14 +13,17 @@ in import ./make-test-python.nix ({ pkgs, ... }: {
    users = {
      mutableUsers = true;
      users.emma = {
+        isNormalUser = true;
        password = password1;
        shell = pkgs.bash;
      };
      users.layla = {
+        isNormalUser = true;
        password = password2;
        shell = pkgs.shadow;
      };
      users.ash = {
+        isNormalUser = true;
        password = password4;
        shell = pkgs.bash;
      };
--- a/nixos/tests/systemd-confinement.nix
+++ b/nixos/tests/systemd-confinement.nix
@ -150,6 +150,7 @@ import ./make-test-python.nix {

    config.users.groups.chroot-testgroup = {};
    config.users.users.chroot-testuser = {
+      isSystemUser = true;
      description = "Chroot Test User";
      group = "chroot-testgroup";
    };
--- a/nixos/tests/unbound.nix
+++ b/nixos/tests/unbound.nix
@ -132,12 +132,15 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:

        users.users = {
          # user that is permitted to access the unix socket
-          someuser.extraGroups = [
-            config.users.users.unbound.group
-          ];
+          someuser = {
+            isSystemUser = true;
+            extraGroups = [
+              config.users.users.unbound.group
+            ];
+          };

          # user that is not permitted to access the unix socket
-          unauthorizeduser = {};
+          unauthorizeduser = { isSystemUser = true; };
        };

        environment.etc = {
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@ -13,10 +13,10 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "0z1diiiykv4ilsiljffz9sl2mlvrxq0xwm8ga2ralfvjwbhzr6dn";
-    x86_64-darwin = "02gzw46w3kzw1ya9nx8fkhvzi0mbpz2fyp47n58jki2zkdsfiwzh";
-    aarch64-linux = "0bkvgdxch95dqcb41ncsjkaaswmwv6zad4hzdsr3famjm2vym1ky";
-    armv7l-linux = "0wdp97ihdnx9bcyn2dh6wzhb7qvdj6x730r7ng1q3i9jhd19wfi3";
+    x86_64-linux = "08151qdhf4chg9gfbs0dl0v0k5vla2gz5dfy439jzdg1d022d5rw";
+    x86_64-darwin = "1vlxxkv3wvds3xl3ir93l5q5yq2d7mcragsicfayj9x9r49ilqn3";
+    aarch64-linux = "0rxw1wsi555z41ak817sxqyyan0rm7hma640zsh8dz0yvhzdv1h8";
+    armv7l-linux = "1ijvd7r2fxxlw4zv3zx5h70b3d0b4gcq3aljsi02v1lr2zm8f8gb";
  }.${system};
 in
  callPackage ./generic.nix rec {
@ -25,7 +25,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.55.0";
+    version = "1.55.2";
    pname = "vscode";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
--- a/pkgs/applications/misc/googleearth-pro/default.nix
+++ b/pkgs/applications/misc/googleearth-pro/default.nix
@ -0,0 +1,111 @@
+{ lib, stdenv, fetchurl, glibc, libGLU, libGL, freetype, glib, libSM, libICE, libXi, libXv
+, libXrender, libXrandr, libXfixes, libXcursor, libXinerama, libXext, libX11, libXcomposite
+, libxcb, sqlite, zlib, fontconfig, dpkg, libproxy, libxml2, gst_all_1, dbus, makeWrapper }:
+
+let
+  arch =
+    if stdenv.hostPlatform.system == "x86_64-linux" then "amd64"
+    else throw "Unsupported system ${stdenv.hostPlatform.system} ";
+  fullPath = lib.makeLibraryPath [
+    glibc
+    glib
+    stdenv.cc.cc
+    libSM
+    libICE
+    libXi
+    libXv
+    libGLU libGL
+    libXrender
+    libXrandr
+    libXfixes
+    libXcursor
+    libXinerama
+    libXcomposite
+    freetype
+    libXext
+    libX11
+    libxcb
+    sqlite
+    zlib
+    fontconfig
+    libproxy
+    libxml2
+    dbus
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+  ];
+in
+stdenv.mkDerivation rec {
+  pname = "googleearth-pro";
+  version = "7.3.3.7786";
+
+  src = fetchurl {
+    url = "https://dl.google.com/linux/earth/deb/pool/main/g/google-earth-pro-stable/google-earth-pro-stable_${version}-r0_${arch}.deb";
+    sha256 = "1s3cakwrgf702g33rh8qs657d8bl68wgg8k89rksgvswwpd2zbb3";
+  };
+
+  nativeBuildInputs = [ dpkg makeWrapper ];
+
+  doInstallCheck = true;
+
+  dontBuild = true;
+
+  dontPatchELF = true;
+
+  unpackPhase = ''
+    # deb file contains a setuid binary, so 'dpkg -x' doesn't work here
+    dpkg --fsys-tarfile ${src} | tar --extract
+  '';
+
+  installPhase =''
+    mkdir $out
+    mv usr/* $out/
+    rmdir usr
+    mv * $out/
+    rm $out/bin/google-earth-pro $out/opt/google/earth/pro/googleearth
+
+    # patch and link googleearth binary
+    ln -s $out/opt/google/earth/pro/googleearth-bin $out/bin/googleearth-pro
+    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${fullPath}:\$ORIGIN" \
+      $out/opt/google/earth/pro/googleearth-bin
+
+    # patch and link gpsbabel binary
+    ln -s $out/opt/google/earth/pro/gpsbabel $out/bin/gpsbabel
+    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${fullPath}:\$ORIGIN" \
+      $out/opt/google/earth/pro/gpsbabel
+
+    # patch libraries
+    for a in $out/opt/google/earth/pro/*.so* ; do
+      patchelf --set-rpath "${fullPath}:\$ORIGIN" $a
+    done
+
+    # Add desktop config file and icons
+    mkdir -p $out/share/{applications,icons/hicolor/{16x16,22x22,24x24,32x32,48x48,64x64,128x128,256x256}/apps,pixmaps}
+    ln -s $out/opt/google/earth/pro/google-earth-pro.desktop $out/share/applications/google-earth-pro.desktop
+    sed -i -e "s|Exec=.*|Exec=$out/bin/googleearth-pro|g" $out/opt/google/earth/pro/google-earth-pro.desktop
+    for size in 16 22 24 32 48 64 128 256; do
+      ln -s $out/opt/google/earth/pro/product_logo_"$size".png $out/share/icons/hicolor/"$size"x"$size"/apps/google-earth-pro.png
+    done
+    ln -s $out/opt/google/earth/pro/product_logo_256.png $out/share/pixmaps/google-earth-pro.png
+  '';
+
+  installCheckPhase = ''
+    $out/bin/gpsbabel -V > /dev/null
+  '';
+
+  # wayland is not supported by Qt included in binary package, so make sure it uses xcb
+  fixupPhase = ''
+    wrapProgram $out/bin/googleearth-pro --set QT_QPA_PLATFORM xcb
+  '';
+
+
+  meta = with lib; {
+    description = "A world sphere viewer";
+    homepage = "https://earth.google.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ friedelino ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/misc/simplenote/default.nix
+++ b/pkgs/applications/misc/simplenote/default.nix
@ -17,10 +17,10 @@ let

  pname = "simplenote";

-  version = "2.8.0";
+  version = "2.9.0";

  sha256 = {
-    x86_64-linux = "sha256-W8+LzWMPDCrFZCm9p/Gcj7OXqJw/gs7lMxTKjOQChQY=";
+    x86_64-linux = "sha256-uwd9fYqZepJ/BBttprqkJhswqMepGsHDTd5Md9gjI68=";
  }.${system} or throwSystem;

  meta = with lib; {
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -1,8 +1,8 @@
 {
  "stable": {
-    "version": "89.0.4389.114",
-    "sha256": "007df9p78bbmk3iyfi8qn57mmn68qqrdhx6z8n2hl8ksd7lspw7j",
-    "sha256bin64": "06wblyvyr93032fbzwm6qpzz4jjm6adziq4i4n6kmfdix2ajif8a",
+    "version": "89.0.4389.128",
+    "sha256": "0nysvsck91yxcb3wf6v3nzar77k7j9bby7xfzsvd7wlqxdmflx8s",
+    "sha256bin64": "07m43yqq6j7mfhdnm127p29b2611l8lmbq87iszlgg6dgkqxa0qr",
    "deps": {
      "gn": {
        "version": "2021-01-07",
@ -18,9 +18,9 @@
    }
  },
  "beta": {
-    "version": "90.0.4430.70",
-    "sha256": "0jnyqnqwdccv3i55grd12wr2w5ffxyzmj2l3c1i24xawf2zdzyym",
-    "sha256bin64": "1lv9gz6llphyvlvn92yw1cyhj4i6jzhy1l7hk01418prmhb4nfws",
+    "version": "90.0.4430.72",
+    "sha256": "0hw916j55lm3qnidfp92i8w6zywdd47rhihn9pn23b7ziz58ik55",
+    "sha256bin64": "1ddj2pk4m26dpl1ja0r56fvm67c1z1hq5rq5an8px6ixy78s2760",
    "deps": {
      "gn": {
        "version": "2021-02-09",
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@ -3,7 +3,6 @@
 , buildGoPackage
 , fetchFromGitHub
 , callPackage
-, runtimeShell
 }:
 let
  list = lib.importJSON ./providers.json;
@ -58,7 +57,6 @@ let
    cloudfoundry = callPackage ./cloudfoundry {};
    gandi = callPackage ./gandi {};
    hcloud = callPackage ./hcloud {};
-    keycloak = callPackage ./keycloak {};
    libvirt = callPackage ./libvirt {};
    linuxbox = callPackage ./linuxbox {};
    lxd = callPackage ./lxd {};
--- a/pkgs/applications/networking/cluster/terraform-providers/keycloak/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/keycloak/default.nix
@ -1,30 +0,0 @@
-{ lib
-, fetchFromGitHub
-, buildGoModule
-}:
-
-buildGoModule rec {
-  pname = "terraform-provider-keycloak";
-  version = "1.20.0";
-
-  src = fetchFromGitHub {
-    owner = "mrparkers";
-    repo = "terraform-provider-keycloak";
-    rev = version;
-    sha256 = "1h8780k8345pf0s14k1pmwdjbv2j08h4rq3jwds81mmv6qgj1r2n";
-  };
-
-  vendorSha256 = "12iary7p5qsbl4xdhfd1wh92mvf2fiylnb3m1d3m7cdcn32rfimq";
-
-  doCheck = false;
-
-  postInstall = "mv $out/bin/terraform-provider-keycloak{,_v${version}}";
-
-  meta = with lib; {
-    description = "Terraform provider for keycloak";
-    homepage = "https://github.com/mrparkers/terraform-provider-keycloak";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ eonpatapon ];
-  };
-
-}
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -493,6 +493,14 @@
    "vendorSha256": "08wg16g4mvn6kl8xwn89195a826cb132ijvrgf32c6p7zp4lgmjd",
    "version": "0.2.12"
  },
+  "keycloak": {
+    "owner": "mrparkers",
+    "repo": "terraform-provider-keycloak",
+    "rev": "v3.0.0",
+    "sha256": "1q9vzmj9c7mznv6al58d3rs5kk1fh28k1qccx46hcbk82z52da3a",
+    "vendorSha256": "0kh6lljvqd577s19gx0fmfsmx9wm3ikla3jz16lbwwb8ahbqcw1f",
+    "version": "3.0.0"
+  },
  "ksyun": {
    "owner": "terraform-providers",
    "repo": "terraform-provider-ksyun",
--- a/pkgs/applications/office/todofi.sh/default.nix
+++ b/pkgs/applications/office/todofi.sh/default.nix
@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, makeWrapper
+, coreutils
+, gawk
+, gnugrep
+, gnused
+, rofi
+, todo-txt-cli
+}:
+
+stdenv.mkDerivation rec {
+  pname = "todofi.sh";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "hugokernel";
+    repo = "todofi.sh";
+    rev = "v${version}";
+    sha256 = "1gmy5inlghycsxiwnyyjyv81jn2fmfk3s9x78kcgyf7khzb5kwvj";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    install -Dm 755 todofi.sh -t $out/bin
+  '';
+
+  postFixup = ''
+    patchShebangs $out/bin
+    wrapProgram $out/bin/todofi.sh --prefix PATH : "${lib.makeBinPath [ coreutils gawk gnugrep gnused rofi todo-txt-cli ]}"
+  '';
+
+  meta = with lib; {
+    description = "Todo-txt + Rofi = Todofi.sh";
+    homepage = "https://github.com/hugokernel/todofi.sh";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ewok ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/science/biology/MACS2/default.nix
+++ b/pkgs/applications/science/biology/MACS2/default.nix
@ -0,0 +1,25 @@
+{ lib, python3, fetchurl }:
+
+python3.pkgs.buildPythonPackage rec {
+  pname = "MACS2";
+  version = "2.2.7.1";
+
+  src = python3.pkgs.fetchPypi {
+    inherit pname version;
+    sha256 = "1rcxj943kgzs746f5jrb72x1cp4v50rk3qmad0m99a02vndscb5d";
+  };
+
+  propagatedBuildInputs = with python3.pkgs; [ numpy ];
+
+  # To prevent ERROR: diffpeak_cmd (unittest.loader._FailedTest) for obsolete
+  # function (ImportError: Failed to import test module: diffpeak_cmd)
+  doCheck = false;
+  pythonImportsCheck = [ "MACS2" ];
+
+  meta = with lib; {
+    description = "Model-based Analysis for ChIP-Seq";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ gschwartz ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "numix-icon-theme-circle";
-  version = "20.09.19";
+  version = "21.04.14";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = pname;
    rev = version;
-    sha256 = "1rqlq5ssxqj0nc0i8av7zprj94km5645xzqi5j5i0sxd3jbmyfjx";
+    sha256 = "1z8c0179r8g0y9zh4383brsfhkcyfy79dc8hw94p9zjn5a66547w";
  };

  nativeBuildInputs = [ gtk3 ];
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Numix icon theme (circle version)";
    homepage = "https://numixproject.github.io";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
    # darwin cannot deal with file names differing only in case
    platforms = platforms.linux;
    maintainers = with maintainers; [ romildo ];
--- a/pkgs/data/icons/numix-icon-theme-square/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-square/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "numix-icon-theme-square";
-  version = "20.09.19";
+  version = "21.04.14";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = pname;
    rev = version;
-    sha256 = "0afraarfcd66mpidmn0l90wif8kmwzdj3s09g704kwszyijxs80z";
+    sha256 = "0ndxjp173dwz78m41mn818mh4bdsxa2ypv4wrwicx0v4d8z90ddj";
  };

  nativeBuildInputs = [ gtk3 ];
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Numix icon theme (square version)";
    homepage = "https://numixproject.github.io";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
    # darwin cannot deal with file names differing only in case
    platforms = platforms.linux;
    maintainers = with maintainers; [ romildo ];
--- a/pkgs/data/icons/numix-icon-theme/default.nix
+++ b/pkgs/data/icons/numix-icon-theme/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "numix-icon-theme";
-  version = "20.06.07";
+  version = "21.04.14";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = pname;
    rev = version;
-    sha256 = "1yp9parc8ihmai8pswf4qzrqd88qpls87ipq8ylx38yqns7wsn4h";
+    sha256 = "1ilzqh9f7skdfg5sl97zfgwrzvwa1zna22dpq0954gyyzvy7k7lg";
  };

  nativeBuildInputs = [ gtk3 ];
@ -18,18 +18,22 @@ stdenv.mkDerivation rec {
  dontDropIconThemeCache = true;

  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/share/icons
    cp -a Numix{,-Light} $out/share/icons/

    for theme in $out/share/icons/*; do
      gtk-update-icon-cache $theme
    done
+
+    runHook postInstall
  '';

  meta = with lib; {
    description = "Numix icon theme";
    homepage = "https://numixproject.github.io";
-    license = licenses.gpl3;
+    license = licenses.gpl3Only;
    # darwin cannot deal with file names differing only in case
    platforms = platforms.linux;
    maintainers = with maintainers; [ romildo ];
--- a/pkgs/development/compilers/jetbrains-jdk/default.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/default.nix
@ -2,12 +2,12 @@

 openjdk11.overrideAttrs (oldAttrs: rec {
  pname = "jetbrains-jdk";
-  version = "11.0.10-b37";
+  version = "11.0.10-b1427";
  src = fetchFromGitHub {
    owner = "JetBrains";
    repo = "JetBrainsRuntime";
    rev = "jb${lib.replaceStrings ["."] ["_"] version}";
-    sha256 = "0bcvwnwi29z000b1bk5dhfkd33xfp9899zc3idzifdwl7q42zi02";
+    sha256 = "sha256-2cn+FiFfGpp7CBeQMAASVZwTm6DOFaXaWxAL/nVC2Nk=";
  };
  patches = [];
  meta = with lib; {
--- a/pkgs/development/compilers/llvm/11/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/11/llvm/default.nix
@ -70,7 +70,7 @@ in stdenv.mkDerivation (rec {
      --replace "Path.cpp" ""
    rm unittests/Support/Path.cpp
  '' + optionalString stdenv.hostPlatform.isMusl ''
-    patch -p1 -i ${../TLI-musl.patch}
+    patch -p1 -i ${../../TLI-musl.patch}
    substituteInPlace unittests/Support/CMakeLists.txt \
      --replace "add_subdirectory(DynamicLibrary)" ""
    rm unittests/Support/DynamicLibrary/DynamicLibraryTest.cpp
--- a/pkgs/development/node-packages/default.nix
+++ b/pkgs/development/node-packages/default.nix
@ -13,6 +13,19 @@ let
        export NG_CLI_ANALYTICS=false
      '';
    };
+
+    aws-azure-login = super.aws-azure-login.override {
+      meta.platforms = pkgs.lib.platforms.linux;
+      nativeBuildInputs = [ pkgs.makeWrapper ];
+      prePatch = ''
+        export PUPPETEER_SKIP_CHROMIUM_DOWNLOAD=1
+      '';
+      postInstall = ''
+        wrapProgram $out/bin/aws-azure-login \
+            --set PUPPETEER_EXECUTABLE_PATH ${pkgs.chromium}/bin/chromium
+      '';
+    };
+
    bower2nix = super.bower2nix.override {
      buildInputs = [ pkgs.makeWrapper ];
      postInstall = ''
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -12,6 +12,7 @@
 , "@webassemblyjs/wast-refmt"
 , "alloy"
 , "asar"
+, "aws-azure-login"
 , "balanceofsatoshis"
 , "bash-language-server"
 , "bower"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/ocaml-modules/postgresql/default.nix
+++ b/pkgs/development/ocaml-modules/postgresql/default.nix
@ -1,8 +1,10 @@
-{ lib, fetchFromGitHub, buildDunePackage, postgresql }:
+{ lib, fetchFromGitHub, buildDunePackage, dune-configurator, postgresql }:

 buildDunePackage rec {
  pname = "postgresql";
-  version = "4.6.3";
+  version = "5.0.0";
+
+  useDune2 = true;

  minimumOCamlVersion = "4.08";

@ -10,10 +12,10 @@ buildDunePackage rec {
    owner = "mmottl";
    repo = "postgresql-ocaml";
    rev = version;
-    sha256 = "0fd96qqwkwjhv6pawk4wivwncszkif0sq05f0g5gd28jzwrsvpqr";
+    sha256 = "1i4pnh2v00i0s7s9pcwz1x6s4xcd77d08gjjkvy0fmda6mqq6ghn";
  };

-  buildInputs = [ postgresql ];
+  buildInputs = [ dune-configurator postgresql ];

  meta = {
    description = "Bindings to the PostgreSQL library";
--- a/pkgs/development/python-modules/clickhouse-cli/default.nix
+++ b/pkgs/development/python-modules/clickhouse-cli/default.nix
@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, click
+, prompt_toolkit
+, pygments
+, requests
+, sqlparse
+}:
+
+buildPythonPackage rec {
+  pname = "clickhouse-cli";
+  version = "0.3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-fDvUdL6LzgCv6LDmB0R0M7v6BbnbL68p9pHMebP58h8=";
+  };
+
+  propagatedBuildInputs = [
+    click
+    prompt_toolkit
+    pygments
+    requests
+    sqlparse
+  ];
+
+  pythonImportsCheck = [ "clickhouse_cli" ];
+
+  meta = with lib; {
+    description = "A third-party client for the Clickhouse DBMS server";
+    homepage = "https://github.com/hatarist/clickhouse-cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ivan-babrou ];
+  };
+}
--- a/pkgs/development/python-modules/mcstatus/default.nix
+++ b/pkgs/development/python-modules/mcstatus/default.nix
@ -5,6 +5,7 @@
 , dnspython
 , fetchFromGitHub
 , mock
+, pytest-asyncio
 , pytestCheckHook
 , pythonOlder
 , six
@ -12,14 +13,14 @@

 buildPythonPackage rec {
  pname = "mcstatus";
-  version = "5.1.2";
+  version = "5.1.4";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "Dinnerbone";
    repo = pname;
-    rev = "release-${version}";
-    sha256 = "16k5vcqpd9r7mm1cg9khzba42rcxs491h8gk2klymav249yzrwk7";
+    rev = "v${version}";
+    sha256 = "1k8hjv965svbm95m7jaawlhdbxqpkjchlwvjwn1n7z90dfgn5kih";
  };

  propagatedBuildInputs = [
@ -31,6 +32,7 @@ buildPythonPackage rec {

  checkInputs = [
    mock
+    pytest-asyncio
    pytestCheckHook
  ];

--- a/pkgs/development/python-modules/oci/default.nix
+++ b/pkgs/development/python-modules/oci/default.nix
@ -0,0 +1,45 @@
+{ lib
+, fetchFromGitHub
+, buildPythonPackage
+, certifi
+, configparser
+, cryptography
+, pyopenssl
+, dateutil
+, pytz
+}:
+
+buildPythonPackage rec {
+  pname = "oci";
+  version = "2.36.0";
+
+  src = fetchFromGitHub {
+    owner = "oracle";
+    repo = "oci-python-sdk";
+    rev = "v${version}";
+    hash = "sha256-scG/ZhWeiCgXp7iD6arWIN8KZecSjKLsCW4oXeJvx6M=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "configparser==4.0.2" "configparser" \
+      --replace "cryptography==3.2.1" "cryptography" \
+      --replace "pyOpenSSL>=17.5.0,<=19.1.0" "pyOpenSSL"
+  '';
+
+  propagatedBuildInputs = [
+    certifi configparser cryptography pyopenssl dateutil pytz
+  ];
+
+  # Tests fail: https://github.com/oracle/oci-python-sdk/issues/164
+  doCheck = false;
+
+  pythonImportsCheck = [ "oci" ];
+
+  meta = with lib; {
+    description = "Oracle Cloud Infrastructure Python SDK";
+    homepage = "https://oracle-cloud-infrastructure-python-sdk.readthedocs.io/en/latest/index.html";
+    maintainers = with maintainers; [ ilian ];
+    license = with licenses; [ asl20 upl ];
+  };
+}
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@ -17,18 +17,19 @@
 , python-dateutil
 , python-xmp-toolkit
 , qpdf
+, setuptools
 , setuptools-scm
 , setuptools-scm-git-archive
 }:

 buildPythonPackage rec {
  pname = "pikepdf";
-  version = "2.9.1";
+  version = "2.11.1";
  disabled = ! isPy3k;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "99c19cf0dd0fc89fc9e6a0de61e974e34d4111dd69802aeaee3e61fb1a74a3d8";
+    sha256 = "0vs7qa3s4scfhyldfw99hhxpna6rj49rsbr2k0j6b4qx1bw8h141";
  };

  buildInputs = [
@ -58,6 +59,7 @@ buildPythonPackage rec {
    defusedxml
    lxml
    pillow
+    setuptools
  ];

  preBuild = ''
@ -71,5 +73,6 @@ buildPythonPackage rec {
    description = "Read and write PDFs with Python, powered by qpdf";
    license = licenses.mpl20;
    maintainers = [ maintainers.kiwi ];
+    changelog = "https://github.com/pikepdf/pikepdf/blob/${version}/docs/release_notes.rst";
  };
 }
--- a/pkgs/development/python-modules/pulsectl/default.nix
+++ b/pkgs/development/python-modules/pulsectl/default.nix
@ -6,7 +6,7 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    sha256 = "faa8b9336237565990298f20870e13dd1678a4586847ca5a7ff2abf10752f356";
+    sha256 = "sha256-+qi5M2I3VlmQKY8ghw4T3RZ4pFhoR8paf/Kr8QdS81Y=";
  };

  patches = [
--- a/pkgs/development/python-modules/spotipy/default.nix
+++ b/pkgs/development/python-modules/spotipy/default.nix
@ -6,11 +6,11 @@

 buildPythonPackage rec {
  pname = "spotipy";
-  version = "2.17.1";
+  version = "2.18.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-KcYMi5naHEufDXIhabwx5iS4wH1xhrjq3ZwC6NLULL8=";
+    sha256 = "sha256-9yk7gIaWgH6azsa9z/Y/fcw8wbFIwMS0KZ70PJZvcXc=";
  };

  propagatedBuildInputs = [ requests six ];
--- a/pkgs/development/python-modules/systembridge/default.nix
+++ b/pkgs/development/python-modules/systembridge/default.nix
@ -0,0 +1,32 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, fetchFromGitHub
+}:
+
+buildPythonPackage rec {
+  pname = "systembridge";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "timmo001";
+    repo = "system-bridge-connector-py";
+    rev = "v${version}";
+    sha256 = "0vyfi7nyzkzsgg84n5wh4hzwvx6fybgqdzbabnsmvszb9sm1vlb2";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+  ];
+
+  # Project has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "systembridge" ];
+
+  meta = with lib; {
+    description = "Python module for connecting to System Bridge";
+    homepage = "https://github.com/timmo001/system-bridge-connector-py";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/twitterapi/default.nix
+++ b/pkgs/development/python-modules/twitterapi/default.nix
@ -7,13 +7,13 @@

 buildPythonPackage rec {
  pname = "twitterapi";
-  version = "2.6.10";
+  version = "2.7.1";

  src = fetchFromGitHub {
    owner = "geduldig";
    repo = "TwitterAPI";
    rev = "v${version}";
-    sha256 = "sha256-ylxjeIK9cjT4r71j+sULYs6yyYWfKDkpm0bESMo7s3o=";
+    sha256 = "sha256-fLexFlnoh58b9q4mo9atGQmMttKytTfAYmaPj6xmPj8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@ -14,13 +14,13 @@

 buildGoModule rec {
  pname = "buildah";
-  version = "1.20.0";
+  version = "1.20.1";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "buildah";
    rev = "v${version}";
-    sha256 = "12gmn61mfrr58071x3cdsksad6swn1b23ghih128hjdpdzk1zxs3";
+    sha256 = "sha256-nlZblUPS0678dR0hyp+V9uH/nHL9YH81+O1Zzq8T8Pw=";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/development/tools/godot/default.nix
+++ b/pkgs/development/tools/godot/default.nix
@ -58,11 +58,11 @@ in stdenv.mkDerivation rec {
      --replace "Exec=godot" "Exec=$out/bin/godot"
  '';

-  meta = {
+  meta = with lib; {
    homepage    = "https://godotengine.org";
    description = "Free and Open Source 2D and 3D game engine";
-    license     = lib.licenses.mit;
+    license     = licenses.mit;
    platforms   = [ "i686-linux" "x86_64-linux" ];
-    maintainers = [ lib.maintainers.twey ];
+    maintainers = with maintainers; [ twey ];
  };
 }
--- a/pkgs/games/scummvm/default.nix
+++ b/pkgs/games/scummvm/default.nix
@ -1,5 +1,6 @@
 { lib, stdenv, fetchurl, nasm
 , alsaLib, curl, flac, fluidsynth, freetype, libjpeg, libmad, libmpeg2, libogg, libvorbis, libGLU, libGL, SDL2, zlib
+, Cocoa, AudioToolbox, Carbon, CoreMIDI, AudioUnit, cctools
 }:

 stdenv.mkDerivation rec {
@ -13,8 +14,12 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ nasm ];

-  buildInputs = [
-    alsaLib curl freetype flac fluidsynth libjpeg libmad libmpeg2 libogg libvorbis libGLU libGL SDL2 zlib
+  buildInputs = lib.optionals stdenv.isLinux [
+    alsaLib
+  ] ++ lib.optionals stdenv.isDarwin [
+    Cocoa AudioToolbox Carbon CoreMIDI AudioUnit
+  ] ++ [
+    curl freetype flac fluidsynth libjpeg libmad libmpeg2 libogg libvorbis libGLU libGL SDL2 zlib
  ];

  dontDisableStatic = true;
@ -30,6 +35,8 @@ stdenv.mkDerivation rec {
  # They use 'install -s', that calls the native strip instead of the cross
  postConfigure = ''
    sed -i "s/-c -s/-c -s --strip-program=''${STRIP@Q}/" ports.mk
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace config.mk --replace x86_64-apple-darwin-ranlib ${cctools}/bin/ranlib
  '';

  meta = with lib; {
@ -37,6 +44,6 @@ stdenv.mkDerivation rec {
    homepage = "https://www.scummvm.org/";
    license = licenses.gpl2;
    maintainers = [ maintainers.peterhoeg ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@ -390,6 +390,21 @@ let
        };
      };

+      foxundermoon.shell-format = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "shell-format";
+          publisher = "foxundermoon";
+          version = "7.1.0";
+          sha256 = "09z72mdr5bfdcb67xyzlv7lb9vyjlc3k9ackj4jgixfk40c68cnj";
+        };
+        meta = with lib; {
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=foxundermoon.shell-format";
+          homepage = "https://github.com/foxundermoon/vs-shell-format";
+          license = licenses.mit;
+          maintainers = with maintainers; [ dbirks ];
+        };
+      };
+
      freebroccolo.reasonml = buildVscodeMarketplaceExtension {
        meta = with lib; {
          changelog = "https://marketplace.visualstudio.com/items/freebroccolo.reasonml/changelog";
--- a/pkgs/os-specific/bsd/netbsd/default.nix
+++ b/pkgs/os-specific/bsd/netbsd/default.nix
@ -1,8 +1,8 @@
-{ stdenv, stdenvNoCC, lib, groff, mandoc, zlib, bison, flex
+{ stdenv, stdenvNoCC, fetchcvs, lib, groff, mandoc, zlib, bison, flex
 , writeText, buildPackages, splicePackages, symlinkJoin }:

 let
-  fetchNetBSD = path: version: sha256: buildPackages.fetchcvs {
+  fetchNetBSD = path: version: sha256: fetchcvs {
    cvsRoot = ":pserver:anoncvs@anoncvs.NetBSD.org:/cvsroot";
    module = "src/${path}";
    inherit sha256;
--- a/pkgs/servers/monitoring/alertmanager-irc-relay/default.nix
+++ b/pkgs/servers/monitoring/alertmanager-irc-relay/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "alertmanager-irc-relay";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "google";
    repo = "alertmanager-irc-relay";
    rev = "v${version}";
-    sha256 = "sha256-SmyKk0vSXfHzRxOdbULD2Emju/VjDcXZZ7cgVbZxGIA=";
+    sha256 = "sha256-IlWXsQZtDXG8sJBV+82BzEFj+JtUbfTOZyqYOrZFTXA=";
  };

-  vendorSha256 = "sha256-aJVA9MJ9DK/dCo7aSB9OLfgKGN5L6Sw2k2aOR4J2LE4=";
+  vendorSha256 = "sha256-VLG15IXS/fXFMTCJKEqGW6qZ9aOLPhazidVsOywG+w4=";

  buildFlagsArray = [ "-ldflags=-s -w" ];

--- a/pkgs/tools/admin/oci-cli/default.nix
+++ b/pkgs/tools/admin/oci-cli/default.nix
@ -0,0 +1,58 @@
+{ lib, fetchFromGitHub, python3Packages, locale }:
+
+let
+  # https://github.com/oracle/oci-cli/issues/189
+  pinned_click = python3Packages.click.overridePythonAttrs (old: rec {
+    pname = "click";
+    version = "6.7";
+    src = python3Packages.fetchPypi {
+      inherit pname version;
+      hash = "sha256-8VUW30eNWlYYD7+A5o8gYBDm0WD8OfpQi2XgNf11Ews=";
+    };
+
+    postPatch = ''
+      substituteInPlace click/_unicodefun.py \
+      --replace "'locale'" "'${locale}/bin/locale'"
+    '';
+
+    # Issue that wasn't resolved when this version was released:
+    # https://github.com/pallets/click/issues/823
+    doCheck = false;
+  });
+in
+
+python3Packages.buildPythonApplication rec {
+  pname = "oci-cli";
+  version = "2.23.0";
+
+  src = fetchFromGitHub {
+    owner = "oracle";
+    repo = "oci-cli";
+    rev = "v${version}";
+    hash = "sha256-XRkycJrUSOZQAGiSyQZGA/SnlxnFumYL82kOkYd7s2o=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    oci arrow certifi pinned_click configparser cryptography jmespath dateutil
+    pytz retrying six terminaltables pyopenssl pyyaml
+  ];
+
+  # https://github.com/oracle/oci-cli/issues/187
+  doCheck = false;
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "configparser==4.0.2" "configparser" \
+      --replace "cryptography==3.2.1" "cryptography" \
+      --replace "pyOpenSSL==19.1.0" "pyOpenSSL" \
+      --replace "PyYAML==5.3.1" "PyYAML" \
+      --replace "six==1.14.0" "six"
+  '';
+
+  meta = with lib; {
+    description = "Command Line Interface for Oracle Cloud Infrastructure";
+    homepage = "https://docs.cloud.oracle.com/iaas/Content/API/Concepts/cliconcepts.htm";
+    maintainers = with maintainers; [ ilian ];
+    license = with licenses; [ asl20 upl ];
+  };
+}
--- a/pkgs/tools/text/ocrmypdf/default.nix
+++ b/pkgs/tools/text/ocrmypdf/default.nix
@ -30,14 +30,14 @@ let
 in
 buildPythonApplication rec {
  pname = "ocrmypdf";
-  version = "11.6.0";
+  version = "11.7.3";
  disabled = ! python3Packages.isPy3k;

  src = fetchFromGitHub {
    owner = "jbarlow83";
    repo = "OCRmyPDF";
    rev = "v${version}";
-    sha256 = "0inmmpam0vcm5n4sm6lh9p5swk44clknvm1cdwk9cax01mdqljza";
+    sha256 = "0gs2w9kl5wwrs0hx2sivq3pdvpf3lkaifblwfbz5g31yl770blji";
  };

  nativeBuildInputs = with python3Packages; [
@ -85,5 +85,6 @@ buildPythonApplication rec {
    license = with licenses; [ mpl20 mit ];
    platforms = platforms.linux;
    maintainers = [ maintainers.kiwi ];
+    changelog  = "https://github.com/jbarlow83/OCRmyPDF/blob/v${version}/docs/release_notes.rst";
  };
 }
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -375,7 +375,10 @@ in

  fetchbzr = callPackage ../build-support/fetchbzr { };

-  fetchcvs = callPackage ../build-support/fetchcvs { };
+  fetchcvs = if stdenv.buildPlatform != stdenv.hostPlatform
+    # hack around splicing being crummy with things that (correctly) don't eval.
+    then buildPackages.fetchcvs
+    else callPackage ../build-support/fetchcvs { };

  fetchdarcs = callPackage ../build-support/fetchdarcs { };

@ -427,7 +430,10 @@ in

  fetchs3 = callPackage ../build-support/fetchs3 { };

-  fetchsvn = callPackage ../build-support/fetchsvn { };
+  fetchsvn = if stdenv.buildPlatform != stdenv.hostPlatform
+    # hack around splicing being crummy with things that (correctly) don't eval.
+    then buildPackages.fetchsvn
+    else callPackage ../build-support/fetchsvn { };

  fetchsvnrevision = import ../build-support/fetchsvnrevision runCommand subversion;

@ -2841,6 +2847,8 @@ in

  nyx = callPackage ../tools/networking/nyx { };

+  oci-cli = callPackage ../tools/admin/oci-cli { };
+
  ocrmypdf = callPackage ../tools/text/ocrmypdf { };

  ocrfeeder = callPackage ../applications/graphics/ocrfeeder { };
@ -18332,6 +18340,8 @@ in
    inherit (llvmPackages_10) clang-unwrapped lld lldClang llvm;
  };

+  clickhouse-cli = with python3Packages; toPythonApplication clickhouse-cli;
+
  couchdb = callPackage ../servers/http/couchdb {
    sphinx = python27Packages.sphinx;
    erlang = erlangR19;
@ -23336,6 +23346,8 @@ in

  googleearth = callPackage ../applications/misc/googleearth { };

+  googleearth-pro = callPackage ../applications/misc/googleearth-pro { };
+
  google-chrome = callPackage ../applications/networking/browsers/google-chrome { gconf = gnome2.GConf; };

  google-chrome-beta = google-chrome.override { chromium = chromiumBeta; channel = "beta"; };
@ -26130,6 +26142,8 @@ in

  todo-txt-cli = callPackage ../applications/office/todo.txt-cli { };

+  todofi-sh = callPackage ../applications/office/todofi.sh { };
+
  todoman = callPackage ../applications/office/todoman { };

  toggldesktop = libsForQt514.callPackage ../applications/misc/toggldesktop { };
@ -27949,7 +27963,10 @@ in
    tk = tk-8_6;
  };

-  scummvm = callPackage ../games/scummvm { };
+  scummvm = callPackage ../games/scummvm {
+    inherit (darwin) cctools;
+    inherit (darwin.apple_sdk.frameworks) Cocoa AudioToolbox Carbon CoreMIDI AudioUnit;
+  };

  inherit (callPackage ../games/scummvm/games.nix { })
    beneath-a-steel-sky
@ -28553,6 +28570,8 @@ in

  macse = callPackage ../applications/science/biology/macse { };

+  MACS2 = callPackage ../applications/science/biology/MACS2 { };
+
  migrate = callPackage ../applications/science/biology/migrate { };

  minia = callPackage ../applications/science/biology/minia {
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -1367,6 +1367,8 @@ in {

  clickhouse-cityhash = callPackage ../development/python-modules/clickhouse-cityhash {};

+  clickhouse-cli = callPackage ../development/python-modules/clickhouse-cli { };
+
  clickhouse-driver = callPackage ../development/python-modules/clickhouse-driver {};

  cliff = callPackage ../development/python-modules/cliff { };
@ -4478,6 +4480,8 @@ in {
    graphvizPkgs = pkgs.graphviz;
  };

+  oci = callPackage ../development/python-modules/oci { };
+
  od = callPackage ../development/python-modules/od { };

  odfpy = callPackage ../development/python-modules/odfpy { };
@ -7651,6 +7655,8 @@ in {

  sympy = callPackage ../development/python-modules/sympy { };

+  systembridge = callPackage ../development/python-modules/systembridge { };
+
  systemd = callPackage ../development/python-modules/systemd {
    inherit (pkgs) systemd;
  };