Merge staging-next into staging

2024-11-13 09:17:07 +03:00 · 2021-05-03 12:26:48 +00:00 · 2021-05-03 12:26:48 +00:00 · a4c3a2d732
commit a4c3a2d732
parent cdbc90b67a 4373197059
54 changed files with 5375 additions and 722 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2445,6 +2445,12 @@
    githubId = 8404455;
    name = "Diego Lelis";
  };
+  diogox = {
+    name = "Diogo Xavier";
+    email = "13244408+diogox@users.noreply.github.com";
+    github = "diogox";
+    githubId = 13244408;
+  };
  dipinhora = {
    email = "dipinhora+github@gmail.com";
    github = "dipinhora";
@ -4747,6 +4753,12 @@
    githubId = 1102396;
    name = "Jussi Maki";
  };
+  joaquinito2051 = {
+    email = "joaquinito2051@gmail.com";
+    github = "heroku-miraheze";
+    githubId = 61781343;
+    name = "Joaquín Rufo Gutierrez";
+  };
  jobojeha = {
    email = "jobojeha@jeppener.de";
    github = "jobojeha";
--- a/nixos/doc/manual/release-notes/rl-2105.xml
+++ b/nixos/doc/manual/release-notes/rl-2105.xml
@ -710,6 +710,11 @@ environment.systemPackages = [
      now follows <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">RFC 0042</link>.
     </para>
   </listitem>
+   <listitem>
+    <para>
+     The <package>yadm</package> dotfile manager has been updated from 2.x to 3.x, which has new (XDG) default locations for some data/state files. Most yadm commands will fail and print a legacy path warning (which describes how to upgrade/migrate your repository). If you have scripts, daemons, scheduled jobs, shell profiles, etc. that invoke yadm, expect them to fail or misbehave until you perform this migration and prepare accordingly.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

@ -1012,6 +1017,24 @@ environment.systemPackages = [
     PostgreSQL 9.5 is scheduled EOL during the 21.05 life cycle and has been removed.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     <link xlink:href="https://www.xfce.org/">Xfce4</link> relies on
+     GIO/GVfs for userspace virtual filesystem access in applications
+     like <link xlink:href="https://docs.xfce.org/xfce/thunar/">thunar</link> and
+     <link xlink:href="https://docs.xfce.org/apps/gigolo/">gigolo</link>.
+     For that to work, the gvfs nixos service is enabled by default,
+     and it can be configured with the specific package that provides
+     GVfs. Until now Xfce4 was setting it to use a lighter version of
+     GVfs (without support for samba). To avoid conflicts with other
+     desktop environments this setting has been dropped. Users that
+     still want it should add the following to their system
+     configuration:
+     <programlisting>
+<xref linkend="opt-services.gvfs.package" /> = pkgs.gvfs.override { samba = null; };
+     </programlisting>
+    </para>
+   </listitem>
  </itemizedlist>
 </section>
 </section>
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@ -55,7 +55,7 @@ rec {

  # Run an automated test suite in the given virtual network.
  # `driver' is the script that runs the network.
-  runTests = driver:
+  runTests = { driver, pos }:
    stdenv.mkDerivation {
      name = "vm-test-run-${driver.testName}";

@ -69,6 +69,8 @@ rec {
        '';

      passthru = driver.passthru;
+
+      inherit pos;
    };


@ -79,6 +81,11 @@ rec {
      # Skip linting (mainly intended for faster dev cycles)
    , skipLint ? false
    , passthru ? {}
+    , # For meta.position
+      pos ? # position used in error messages and for meta.position
+        (if t.meta.description or null != null
+          then builtins.unsafeGetAttrPos "description" t.meta
+          else builtins.unsafeGetAttrPos "testScript" t)
    , ...
    } @ t:
    let
@ -174,7 +181,7 @@ rec {
      driver = mkDriver null;
      driverInteractive = mkDriver pkgs.qemu;

-      test = passMeta (runTests driver);
+      test = passMeta (runTests { inherit driver pos; });

      nodeNames = builtins.attrNames driver.nodes;
      invalidNodeNames = lib.filter
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -976,6 +976,7 @@
  ./services/web-servers/shellinabox.nix
  ./services/web-servers/tomcat.nix
  ./services/web-servers/traefik.nix
+  ./services/web-servers/trafficserver.nix
  ./services/web-servers/ttyd.nix
  ./services/web-servers/uwsgi.nix
  ./services/web-servers/varnish/default.nix
--- a/nixos/modules/services/databases/cassandra.nix
+++ b/nixos/modules/services/databases/cassandra.nix
@ -1,79 +1,108 @@
 { config, lib, pkgs, ... }:

-with lib;
-
 let
+  inherit (lib)
+    concatStringsSep
+    flip
+    literalExample
+    optionalAttrs
+    optionals
+    recursiveUpdate
+    mkEnableOption
+    mkIf
+    mkOption
+    types
+    versionAtLeast
+    ;
+
  cfg = config.services.cassandra;
+
  defaultUser = "cassandra";
-  cassandraConfig = flip recursiveUpdate cfg.extraConfig
-    ({ commitlog_sync = "batch";
-       commitlog_sync_batch_window_in_ms = 2;
-       start_native_transport = cfg.allowClients;
-       cluster_name = cfg.clusterName;
-       partitioner = "org.apache.cassandra.dht.Murmur3Partitioner";
-       endpoint_snitch = "SimpleSnitch";
-       data_file_directories = [ "${cfg.homeDir}/data" ];
-       commitlog_directory = "${cfg.homeDir}/commitlog";
-       saved_caches_directory = "${cfg.homeDir}/saved_caches";
-     } // (lib.optionalAttrs (cfg.seedAddresses != []) {
-       seed_provider = [{
-         class_name = "org.apache.cassandra.locator.SimpleSeedProvider";
-         parameters = [ { seeds = concatStringsSep "," cfg.seedAddresses; } ];
-       }];
-     }) // (lib.optionalAttrs (lib.versionAtLeast cfg.package.version "3") {
-       hints_directory = "${cfg.homeDir}/hints";
-     })
-    );
-  cassandraConfigWithAddresses = cassandraConfig //
-    ( if cfg.listenAddress == null
-        then { listen_interface = cfg.listenInterface; }
-        else { listen_address = cfg.listenAddress; }
-    ) // (
-      if cfg.rpcAddress == null
-        then { rpc_interface = cfg.rpcInterface; }
-        else { rpc_address = cfg.rpcAddress; }
-    );
-  cassandraEtc = pkgs.stdenv.mkDerivation
-    { name = "cassandra-etc";
-      cassandraYaml = builtins.toJSON cassandraConfigWithAddresses;
-      cassandraEnvPkg = "${cfg.package}/conf/cassandra-env.sh";
-      cassandraLogbackConfig = pkgs.writeText "logback.xml" cfg.logbackConfig;
-      passAsFile = [ "extraEnvSh" ];
-      inherit (cfg) extraEnvSh;
-      buildCommand = ''
-        mkdir -p "$out"

-        echo "$cassandraYaml" > "$out/cassandra.yaml"
-        ln -s "$cassandraLogbackConfig" "$out/logback.xml"
+  cassandraConfig = flip recursiveUpdate cfg.extraConfig (
+    {
+      commitlog_sync = "batch";
+      commitlog_sync_batch_window_in_ms = 2;
+      start_native_transport = cfg.allowClients;
+      cluster_name = cfg.clusterName;
+      partitioner = "org.apache.cassandra.dht.Murmur3Partitioner";
+      endpoint_snitch = "SimpleSnitch";
+      data_file_directories = [ "${cfg.homeDir}/data" ];
+      commitlog_directory = "${cfg.homeDir}/commitlog";
+      saved_caches_directory = "${cfg.homeDir}/saved_caches";
+    } // optionalAttrs (cfg.seedAddresses != [ ]) {
+      seed_provider = [
+        {
+          class_name = "org.apache.cassandra.locator.SimpleSeedProvider";
+          parameters = [{ seeds = concatStringsSep "," cfg.seedAddresses; }];
+        }
+      ];
+    } // optionalAttrs (versionAtLeast cfg.package.version "3") {
+      hints_directory = "${cfg.homeDir}/hints";
+    }
+  );

-        ( cat "$cassandraEnvPkg"
-          echo "# lines from services.cassandra.extraEnvSh: "
-          cat "$extraEnvShPath"
-        ) > "$out/cassandra-env.sh"
+  cassandraConfigWithAddresses = cassandraConfig // (
+    if cfg.listenAddress == null
+    then { listen_interface = cfg.listenInterface; }
+    else { listen_address = cfg.listenAddress; }
+  ) // (
+    if cfg.rpcAddress == null
+    then { rpc_interface = cfg.rpcInterface; }
+    else { rpc_address = cfg.rpcAddress; }
+  );

-        # Delete default JMX Port, otherwise we can't set it using env variable
-        sed -i '/JMX_PORT="7199"/d' "$out/cassandra-env.sh"
+  cassandraEtc = pkgs.stdenv.mkDerivation {
+    name = "cassandra-etc";

-        # Delete default password file
-        sed -i '/-Dcom.sun.management.jmxremote.password.file=\/etc\/cassandra\/jmxremote.password/d' "$out/cassandra-env.sh"
-      '';
-    };
-  defaultJmxRolesFile = builtins.foldl'
-     (left: right: left + right) ""
-     (map (role: "${role.username} ${role.password}") cfg.jmxRoles);
-  fullJvmOptions = cfg.jvmOpts
-    ++ lib.optionals (cfg.jmxRoles != []) [
+    cassandraYaml = builtins.toJSON cassandraConfigWithAddresses;
+    cassandraEnvPkg = "${cfg.package}/conf/cassandra-env.sh";
+    cassandraLogbackConfig = pkgs.writeText "logback.xml" cfg.logbackConfig;
+
+    passAsFile = [ "extraEnvSh" ];
+    inherit (cfg) extraEnvSh;
+
+    buildCommand = ''
+      mkdir -p "$out"
+
+      echo "$cassandraYaml" > "$out/cassandra.yaml"
+      ln -s "$cassandraLogbackConfig" "$out/logback.xml"
+
+      ( cat "$cassandraEnvPkg"
+        echo "# lines from services.cassandra.extraEnvSh: "
+        cat "$extraEnvShPath"
+      ) > "$out/cassandra-env.sh"
+
+      # Delete default JMX Port, otherwise we can't set it using env variable
+      sed -i '/JMX_PORT="7199"/d' "$out/cassandra-env.sh"
+
+      # Delete default password file
+      sed -i '/-Dcom.sun.management.jmxremote.password.file=\/etc\/cassandra\/jmxremote.password/d' "$out/cassandra-env.sh"
+    '';
+  };
+
+  defaultJmxRolesFile =
+    builtins.foldl'
+      (left: right: left + right) ""
+      (map (role: "${role.username} ${role.password}") cfg.jmxRoles);
+
+  fullJvmOptions =
+    cfg.jvmOpts
+    ++ optionals (cfg.jmxRoles != [ ]) [
      "-Dcom.sun.management.jmxremote.authenticate=true"
      "-Dcom.sun.management.jmxremote.password.file=${cfg.jmxRolesFile}"
-    ]
-    ++ lib.optionals cfg.remoteJmx [
+    ] ++ optionals cfg.remoteJmx [
      "-Djava.rmi.server.hostname=${cfg.rpcAddress}"
    ];
-in {
+
+in
+{
  options.services.cassandra = {
+
    enable = mkEnableOption ''
      Apache Cassandra – Scalable and highly available database.
    '';
+
    clusterName = mkOption {
      type = types.str;
      default = "Test Cluster";
@ -83,16 +112,19 @@ in {
        another. All nodes in a cluster must have the same value.
      '';
    };
+
    user = mkOption {
      type = types.str;
      default = defaultUser;
      description = "Run Apache Cassandra under this user.";
    };
+
    group = mkOption {
      type = types.str;
      default = defaultUser;
      description = "Run Apache Cassandra under this group.";
    };
+
    homeDir = mkOption {
      type = types.path;
      default = "/var/lib/cassandra";
@ -100,6 +132,7 @@ in {
        Home directory for Apache Cassandra.
      '';
    };
+
    package = mkOption {
      type = types.package;
      default = pkgs.cassandra;
@ -109,17 +142,19 @@ in {
        The Apache Cassandra package to use.
      '';
    };
+
    jvmOpts = mkOption {
      type = types.listOf types.str;
-      default = [];
+      default = [ ];
      description = ''
        Populate the JVM_OPT environment variable.
      '';
    };
+
    listenAddress = mkOption {
      type = types.nullOr types.str;
      default = "127.0.0.1";
-      example = literalExample "null";
+      example = null;
      description = ''
        Address or interface to bind to and tell other Cassandra nodes
        to connect to. You _must_ change this if you want multiple
@ -136,6 +171,7 @@ in {
        Setting listen_address to 0.0.0.0 is always wrong.
      '';
    };
+
    listenInterface = mkOption {
      type = types.nullOr types.str;
      default = null;
@ -146,10 +182,11 @@ in {
        supported.
      '';
    };
+
    rpcAddress = mkOption {
      type = types.nullOr types.str;
      default = "127.0.0.1";
-      example = literalExample "null";
+      example = null;
      description = ''
        The address or interface to bind the native transport server to.

@ -167,6 +204,7 @@ in {
        internet. Firewall it if needed.
      '';
    };
+
    rpcInterface = mkOption {
      type = types.nullOr types.str;
      default = null;
@ -176,6 +214,7 @@ in {
        correspond to a single address, IP aliasing is not supported.
      '';
    };
+
    logbackConfig = mkOption {
      type = types.lines;
      default = ''
@ -197,6 +236,7 @@ in {
        XML logback configuration for cassandra
      '';
    };
+
    seedAddresses = mkOption {
      type = types.listOf types.str;
      default = [ "127.0.0.1" ];
@ -207,6 +247,7 @@ in {
        Set to 127.0.0.1 for a single node cluster.
      '';
    };
+
    allowClients = mkOption {
      type = types.bool;
      default = true;
@ -219,16 +260,19 @@ in {
        <literal>extraConfig</literal>.
      '';
    };
+
    extraConfig = mkOption {
      type = types.attrs;
-      default = {};
+      default = { };
      example =
-        { commitlog_sync_batch_window_in_ms = 3;
+        {
+          commitlog_sync_batch_window_in_ms = 3;
        };
      description = ''
        Extra options to be merged into cassandra.yaml as nix attribute set.
      '';
    };
+
    extraEnvSh = mkOption {
      type = types.lines;
      default = "";
@ -237,48 +281,53 @@ in {
        Extra shell lines to be appended onto cassandra-env.sh.
      '';
    };
+
    fullRepairInterval = mkOption {
      type = types.nullOr types.str;
      default = "3w";
-      example = literalExample "null";
+      example = null;
      description = ''
-          Set the interval how often full repairs are run, i.e.
-          <literal>nodetool repair --full</literal> is executed. See
-          https://cassandra.apache.org/doc/latest/operating/repair.html
-          for more information.
+        Set the interval how often full repairs are run, i.e.
+        <literal>nodetool repair --full</literal> is executed. See
+        https://cassandra.apache.org/doc/latest/operating/repair.html
+        for more information.

-          Set to <literal>null</literal> to disable full repairs.
-        '';
+        Set to <literal>null</literal> to disable full repairs.
+      '';
    };
+
    fullRepairOptions = mkOption {
      type = types.listOf types.str;
-      default = [];
+      default = [ ];
      example = [ "--partitioner-range" ];
      description = ''
-          Options passed through to the full repair command.
-        '';
+        Options passed through to the full repair command.
+      '';
    };
+
    incrementalRepairInterval = mkOption {
      type = types.nullOr types.str;
      default = "3d";
-      example = literalExample "null";
+      example = null;
      description = ''
-          Set the interval how often incremental repairs are run, i.e.
-          <literal>nodetool repair</literal> is executed. See
-          https://cassandra.apache.org/doc/latest/operating/repair.html
-          for more information.
+        Set the interval how often incremental repairs are run, i.e.
+        <literal>nodetool repair</literal> is executed. See
+        https://cassandra.apache.org/doc/latest/operating/repair.html
+        for more information.

-          Set to <literal>null</literal> to disable incremental repairs.
-        '';
+        Set to <literal>null</literal> to disable incremental repairs.
+      '';
    };
+
    incrementalRepairOptions = mkOption {
      type = types.listOf types.str;
-      default = [];
+      default = [ ];
      example = [ "--partitioner-range" ];
      description = ''
-          Options passed through to the incremental repair command.
-        '';
+        Options passed through to the incremental repair command.
+      '';
    };
+
    maxHeapSize = mkOption {
      type = types.nullOr types.str;
      default = null;
@ -299,6 +348,7 @@ in {
        expensive GC will be (usually).
      '';
    };
+
    heapNewSize = mkOption {
      type = types.nullOr types.str;
      default = null;
@ -322,6 +372,7 @@ in {
        100 MB per physical CPU core.
      '';
    };
+
    mallocArenaMax = mkOption {
      type = types.nullOr types.int;
      default = null;
@ -330,6 +381,7 @@ in {
        Set this to control the amount of arenas per-thread in glibc.
      '';
    };
+
    remoteJmx = mkOption {
      type = types.bool;
      default = false;
@ -341,6 +393,7 @@ in {
        See: https://wiki.apache.org/cassandra/JmxSecurity
      '';
    };
+
    jmxPort = mkOption {
      type = types.int;
      default = 7199;
@ -351,8 +404,9 @@ in {
        Firewall it if needed.
      '';
    };
+
    jmxRoles = mkOption {
-      default = [];
+      default = [ ];
      description = ''
        Roles that are allowed to access the JMX (e.g. nodetool)
        BEWARE: The passwords will be stored world readable in the nix-store.
@ -375,11 +429,13 @@ in {
        };
      });
    };
+
    jmxRolesFile = mkOption {
      type = types.nullOr types.path;
-      default = if (lib.versionAtLeast cfg.package.version "3.11")
-                then pkgs.writeText "jmx-roles-file" defaultJmxRolesFile
-                else null;
+      default =
+        if versionAtLeast cfg.package.version "3.11"
+        then pkgs.writeText "jmx-roles-file" defaultJmxRolesFile
+        else null;
      example = "/var/lib/cassandra/jmx.password";
      description = ''
        Specify your own jmx roles file.
@ -391,102 +447,115 @@ in {
  };

  config = mkIf cfg.enable {
-    assertions =
-      [ { assertion = (cfg.listenAddress == null) != (cfg.listenInterface == null);
-          message = "You have to set either listenAddress or listenInterface";
-        }
-        { assertion = (cfg.rpcAddress == null) != (cfg.rpcInterface == null);
-          message = "You have to set either rpcAddress or rpcInterface";
-        }
-        { assertion = (cfg.maxHeapSize == null) == (cfg.heapNewSize == null);
-          message = "If you set either of maxHeapSize or heapNewSize you have to set both";
-        }
-        { assertion = cfg.remoteJmx -> cfg.jmxRolesFile != null;
-          message = ''
-            If you want JMX available remotely you need to set a password using
-            <literal>jmxRoles</literal> or <literal>jmxRolesFile</literal> if
-            using Cassandra older than v3.11.
-          '';
-        }
-      ];
+    assertions = [
+      {
+        assertion = (cfg.listenAddress == null) != (cfg.listenInterface == null);
+        message = "You have to set either listenAddress or listenInterface";
+      }
+      {
+        assertion = (cfg.rpcAddress == null) != (cfg.rpcInterface == null);
+        message = "You have to set either rpcAddress or rpcInterface";
+      }
+      {
+        assertion = (cfg.maxHeapSize == null) == (cfg.heapNewSize == null);
+        message = "If you set either of maxHeapSize or heapNewSize you have to set both";
+      }
+      {
+        assertion = cfg.remoteJmx -> cfg.jmxRolesFile != null;
+        message = ''
+          If you want JMX available remotely you need to set a password using
+          <literal>jmxRoles</literal> or <literal>jmxRolesFile</literal> if
+          using Cassandra older than v3.11.
+        '';
+      }
+    ];
    users = mkIf (cfg.user == defaultUser) {
-      extraUsers.${defaultUser} =
-        {  group = cfg.group;
-           home = cfg.homeDir;
-           createHome = true;
-           uid = config.ids.uids.cassandra;
-           description = "Cassandra service user";
-        };
-      extraGroups.${defaultUser}.gid = config.ids.gids.cassandra;
+      users.${defaultUser} = {
+        group = cfg.group;
+        home = cfg.homeDir;
+        createHome = true;
+        uid = config.ids.uids.cassandra;
+        description = "Cassandra service user";
+      };
+      groups.${defaultUser}.gid = config.ids.gids.cassandra;
    };

-    systemd.services.cassandra =
-      { description = "Apache Cassandra service";
-        after = [ "network.target" ];
-        environment =
-          { CASSANDRA_CONF = "${cassandraEtc}";
-            JVM_OPTS = builtins.concatStringsSep " " fullJvmOptions;
-            MAX_HEAP_SIZE = toString cfg.maxHeapSize;
-            HEAP_NEWSIZE = toString cfg.heapNewSize;
-            MALLOC_ARENA_MAX = toString cfg.mallocArenaMax;
-            LOCAL_JMX = if cfg.remoteJmx then "no" else "yes";
-            JMX_PORT = toString cfg.jmxPort;
-          };
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig =
-          { User = cfg.user;
-            Group = cfg.group;
-            ExecStart = "${cfg.package}/bin/cassandra -f";
-            SuccessExitStatus = 143;
-          };
+    systemd.services.cassandra = {
+      description = "Apache Cassandra service";
+      after = [ "network.target" ];
+      environment = {
+        CASSANDRA_CONF = "${cassandraEtc}";
+        JVM_OPTS = builtins.concatStringsSep " " fullJvmOptions;
+        MAX_HEAP_SIZE = toString cfg.maxHeapSize;
+        HEAP_NEWSIZE = toString cfg.heapNewSize;
+        MALLOC_ARENA_MAX = toString cfg.mallocArenaMax;
+        LOCAL_JMX = if cfg.remoteJmx then "no" else "yes";
+        JMX_PORT = toString cfg.jmxPort;
      };
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart = "${cfg.package}/bin/cassandra -f";
+        SuccessExitStatus = 143;
+      };
+    };

-    systemd.services.cassandra-full-repair =
-      { description = "Perform a full repair on this Cassandra node";
-        after = [ "cassandra.service" ];
-        requires = [ "cassandra.service" ];
-        serviceConfig =
-          { User = cfg.user;
-            Group = cfg.group;
-            ExecStart =
-              lib.concatStringsSep " "
-                ([ "${cfg.package}/bin/nodetool" "repair" "--full"
-                 ] ++ cfg.fullRepairOptions);
-          };
+    systemd.services.cassandra-full-repair = {
+      description = "Perform a full repair on this Cassandra node";
+      after = [ "cassandra.service" ];
+      requires = [ "cassandra.service" ];
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart =
+          concatStringsSep " "
+            ([
+              "${cfg.package}/bin/nodetool"
+              "repair"
+              "--full"
+            ] ++ cfg.fullRepairOptions);
      };
+    };
+
    systemd.timers.cassandra-full-repair =
      mkIf (cfg.fullRepairInterval != null) {
        description = "Schedule full repairs on Cassandra";
        wantedBy = [ "timers.target" ];
-        timerConfig =
-          { OnBootSec = cfg.fullRepairInterval;
-            OnUnitActiveSec = cfg.fullRepairInterval;
-            Persistent = true;
-          };
+        timerConfig = {
+          OnBootSec = cfg.fullRepairInterval;
+          OnUnitActiveSec = cfg.fullRepairInterval;
+          Persistent = true;
+        };
      };

-    systemd.services.cassandra-incremental-repair =
-      { description = "Perform an incremental repair on this cassandra node.";
-        after = [ "cassandra.service" ];
-        requires = [ "cassandra.service" ];
-        serviceConfig =
-          { User = cfg.user;
-            Group = cfg.group;
-            ExecStart =
-              lib.concatStringsSep " "
-                ([ "${cfg.package}/bin/nodetool" "repair"
-                 ] ++ cfg.incrementalRepairOptions);
-          };
+    systemd.services.cassandra-incremental-repair = {
+      description = "Perform an incremental repair on this cassandra node.";
+      after = [ "cassandra.service" ];
+      requires = [ "cassandra.service" ];
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        ExecStart =
+          concatStringsSep " "
+            ([
+              "${cfg.package}/bin/nodetool"
+              "repair"
+            ] ++ cfg.incrementalRepairOptions);
      };
+    };
+
    systemd.timers.cassandra-incremental-repair =
      mkIf (cfg.incrementalRepairInterval != null) {
        description = "Schedule incremental repairs on Cassandra";
        wantedBy = [ "timers.target" ];
-        timerConfig =
-          { OnBootSec = cfg.incrementalRepairInterval;
-            OnUnitActiveSec = cfg.incrementalRepairInterval;
-            Persistent = true;
-          };
+        timerConfig = {
+          OnBootSec = cfg.incrementalRepairInterval;
+          OnUnitActiveSec = cfg.incrementalRepairInterval;
+          Persistent = true;
+        };
      };
  };
+
+  meta.maintainers = with lib.maintainers; [ roberth ];
 }
--- a/nixos/modules/services/networking/babeld.nix
+++ b/nixos/modules/services/networking/babeld.nix
@ -32,6 +32,8 @@ in

 {

+  meta.maintainers = with maintainers; [ hexa ];
+
  ###### interface

  options = {
--- a/nixos/modules/services/web-servers/trafficserver.nix
+++ b/nixos/modules/services/web-servers/trafficserver.nix
@ -0,0 +1,318 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.trafficserver;
+  user = config.users.users.trafficserver.name;
+  group = config.users.groups.trafficserver.name;
+
+  getManualUrl = name: "https://docs.trafficserver.apache.org/en/latest/admin-guide/files/${name}.en.html";
+  getConfPath = name: "${pkgs.trafficserver}/etc/trafficserver/${name}";
+
+  yaml = pkgs.formats.yaml { };
+
+  fromYAML = f:
+    let
+      jsonFile = pkgs.runCommand "in.json"
+        {
+          nativeBuildInputs = [ pkgs.remarshal ];
+        } ''
+        yaml2json < "${f}" > "$out"
+      '';
+    in
+    builtins.fromJSON (builtins.readFile jsonFile);
+
+  mkYamlConf = name: cfg:
+    if cfg != null then {
+      "trafficserver/${name}.yaml".source = yaml.generate "${name}.yaml" cfg;
+    } else {
+      "trafficserver/${name}.yaml".text = "";
+    };
+
+  mkRecordLines = path: value:
+    if isAttrs value then
+      lib.mapAttrsToList (n: v: mkRecordLines (path ++ [ n ]) v) value
+    else if isInt value then
+      "CONFIG ${concatStringsSep "." path} INT ${toString value}"
+    else if isFloat value then
+      "CONFIG ${concatStringsSep "." path} FLOAT ${toString value}"
+    else
+      "CONFIG ${concatStringsSep "." path} STRING ${toString value}";
+
+  mkRecordsConfig = cfg: concatStringsSep "\n" (flatten (mkRecordLines [ ] cfg));
+  mkPluginConfig = cfg: concatStringsSep "\n" (map (p: "${p.path} ${p.arg}") cfg);
+in
+{
+  options.services.trafficserver = {
+    enable = mkEnableOption "Apache Traffic Server";
+
+    cache = mkOption {
+      type = types.lines;
+      default = "";
+      example = "dest_domain=example.com suffix=js action=never-cache";
+      description = ''
+        Caching rules that overrule the origin's caching policy.
+
+        Consult the <link xlink:href="${getManualUrl "cache.config"}">upstream
+        documentation</link> for more details.
+      '';
+    };
+
+    hosting = mkOption {
+      type = types.lines;
+      default = "";
+      example = "domain=example.com volume=1";
+      description = ''
+        Partition the cache according to origin server or domain
+
+        Consult the <link xlink:href="${getManualUrl "hosting.config"}">
+        upstream documentation</link> for more details.
+      '';
+    };
+
+    ipAllow = mkOption {
+      type = types.nullOr yaml.type;
+      default = fromYAML (getConfPath "ip_allow.yaml");
+      defaultText = "upstream defaults";
+      example = literalExample {
+        ip_allow = [{
+          apply = "in";
+          ip_addrs = "127.0.0.1";
+          action = "allow";
+          methods = "ALL";
+        }];
+      };
+      description = ''
+        Control client access to Traffic Server and Traffic Server connections
+        to upstream servers.
+
+        Consult the <link xlink:href="${getManualUrl "ip_allow.yaml"}">upstream
+        documentation</link> for more details.
+      '';
+    };
+
+    logging = mkOption {
+      type = types.nullOr yaml.type;
+      default = fromYAML (getConfPath "logging.yaml");
+      defaultText = "upstream defaults";
+      example = literalExample { };
+      description = ''
+        Configure logs.
+
+        Consult the <link xlink:href="${getManualUrl "logging.yaml"}">upstream
+        documentation</link> for more details.
+      '';
+    };
+
+    parent = mkOption {
+      type = types.lines;
+      default = "";
+      example = ''
+        dest_domain=. method=get parent="p1.example:8080; p2.example:8080" round_robin=true
+      '';
+      description = ''
+        Identify the parent proxies used in an cache hierarchy.
+
+        Consult the <link xlink:href="${getManualUrl "parent.config"}">upstream
+        documentation</link> for more details.
+      '';
+    };
+
+    plugins = mkOption {
+      default = [ ];
+
+      description = ''
+        Controls run-time loadable plugins available to Traffic Server, as
+        well as their configuration.
+
+        Consult the <link xlink:href="${getManualUrl "plugin.config"}">upstream
+        documentation</link> for more details.
+      '';
+
+      type = with types;
+        listOf (submodule {
+          options.path = mkOption {
+            type = str;
+            example = "xdebug.so";
+            description = ''
+              Path to plugin. The path can either be absolute, or relative to
+              the plugin directory.
+            '';
+          };
+          options.arg = mkOption {
+            type = str;
+            default = "";
+            example = "--header=ATS-My-Debug";
+            description = "arguments to pass to the plugin";
+          };
+        });
+    };
+
+    records = mkOption {
+      type = with types;
+        let valueType = (attrsOf (oneOf [ int float str valueType ])) // {
+          description = "Traffic Server records value";
+        };
+        in
+        valueType;
+      default = { };
+      example = literalExample { proxy.config.proxy_name = "my_server"; };
+      description = ''
+        List of configurable variables used by Traffic Server.
+
+        Consult the <link xlink:href="${getManualUrl "records.config"}">
+        upstream documentation</link> for more details.
+      '';
+    };
+
+    remap = mkOption {
+      type = types.lines;
+      default = "";
+      example = "map http://from.example http://origin.example";
+      description = ''
+        URL remapping rules used by Traffic Server.
+
+        Consult the <link xlink:href="${getManualUrl "remap.config"}">
+        upstream documentation</link> for more details.
+      '';
+    };
+
+    splitDns = mkOption {
+      type = types.lines;
+      default = "";
+      example = ''
+        dest_domain=internal.corp.example named="255.255.255.255:212 255.255.255.254" def_domain=corp.example search_list="corp.example corp1.example"
+        dest_domain=!internal.corp.example named=255.255.255.253
+      '';
+      description = ''
+        Specify the DNS server that Traffic Server should use under specific
+        conditions.
+
+        Consult the <link xlink:href="${getManualUrl "splitdns.config"}">
+        upstream documentation</link> for more details.
+      '';
+    };
+
+    sslMulticert = mkOption {
+      type = types.lines;
+      default = "";
+      example = "dest_ip=* ssl_cert_name=default.pem";
+      description = ''
+        Configure SSL server certificates to terminate the SSL sessions.
+
+        Consult the <link xlink:href="${getManualUrl "ssl_multicert.config"}">
+        upstream documentation</link> for more details.
+      '';
+    };
+
+    sni = mkOption {
+      type = types.nullOr yaml.type;
+      default = null;
+      example = literalExample {
+        sni = [{
+          fqdn = "no-http2.example.com";
+          https = "off";
+        }];
+      };
+      description = ''
+        Configure aspects of TLS connection handling for both inbound and
+        outbound connections.
+
+        Consult the <link xlink:href="${getManualUrl "sni.yaml"}">upstream
+        documentation</link> for more details.
+      '';
+    };
+
+    storage = mkOption {
+      type = types.lines;
+      default = "/var/cache/trafficserver 256M";
+      example = "/dev/disk/by-id/XXXXX volume=1";
+      description = ''
+        List all the storage that make up the Traffic Server cache.
+
+        Consult the <link xlink:href="${getManualUrl "storage.config"}">
+        upstream documentation</link> for more details.
+      '';
+    };
+
+    strategies = mkOption {
+      type = types.nullOr yaml.type;
+      default = null;
+      description = ''
+        Specify the next hop proxies used in an cache hierarchy and the
+        algorithms used to select the next proxy.
+
+        Consult the <link xlink:href="${getManualUrl "strategies.yaml"}">
+        upstream documentation</link> for more details.
+      '';
+    };
+
+    volume = mkOption {
+      type = types.nullOr yaml.type;
+      default = "";
+      example = "volume=1 scheme=http size=20%";
+      description = ''
+        Manage cache space more efficiently and restrict disk usage by
+        creating cache volumes of different sizes.
+
+        Consult the <link xlink:href="${getManualUrl "volume.config"}">
+        upstream documentation</link> for more details.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.etc = {
+      "trafficserver/cache.config".text = cfg.cache;
+      "trafficserver/hosting.config".text = cfg.hosting;
+      "trafficserver/parent.config".text = cfg.parent;
+      "trafficserver/plugin.config".text = mkPluginConfig cfg.plugins;
+      "trafficserver/records.config".text = mkRecordsConfig cfg.records;
+      "trafficserver/remap.config".text = cfg.remap;
+      "trafficserver/splitdns.config".text = cfg.splitDns;
+      "trafficserver/ssl_multicert.config".text = cfg.sslMulticert;
+      "trafficserver/storage.config".text = cfg.storage;
+      "trafficserver/volume.config".text = cfg.volume;
+    } // (mkYamlConf "ip_allow" cfg.ipAllow)
+    // (mkYamlConf "logging" cfg.logging)
+    // (mkYamlConf "sni" cfg.sni)
+    // (mkYamlConf "strategies" cfg.strategies);
+
+    environment.systemPackages = [ pkgs.trafficserver ];
+    systemd.packages = [ pkgs.trafficserver ];
+
+    # Traffic Server does privilege handling independently of systemd, and
+    # therefore should be started as root
+    systemd.services.trafficserver = {
+      enable = true;
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    # These directories can't be created by systemd because:
+    #
+    #   1. Traffic Servers starts as root and switches to an unprivileged user
+    #      afterwards. The runtime directories defined below are assumed to be
+    #      owned by that user.
+    #   2. The bin/trafficserver script assumes these directories exist.
+    systemd.tmpfiles.rules = [
+      "d '/run/trafficserver' - ${user} ${group} - -"
+      "d '/var/cache/trafficserver' - ${user} ${group} - -"
+      "d '/var/lib/trafficserver' - ${user} ${group} - -"
+      "d '/var/log/trafficserver' - ${user} ${group} - -"
+    ];
+
+    services.trafficserver = {
+      records.proxy.config.admin.user_id = user;
+      records.proxy.config.body_factory.template_sets_dir =
+        "${pkgs.trafficserver}/etc/trafficserver/body_factory";
+    };
+
+    users.users.trafficserver = {
+      description = "Apache Traffic Server";
+      isSystemUser = true;
+      inherit group;
+    };
+    users.groups.trafficserver = { };
+  };
+}
--- a/nixos/modules/services/x11/desktop-managers/xfce.nix
+++ b/nixos/modules/services/x11/desktop-managers/xfce.nix
@ -151,7 +151,6 @@ in
    services.upower.enable = config.powerManagement.enable;
    services.gnome3.glib-networking.enable = true;
    services.gvfs.enable = true;
-    services.gvfs.package = pkgs.xfce.gvfs;
    services.tumbler.enable = true;
    services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
    services.xserver.libinput.enable = mkDefault true; # used in xfce4-settings-manager
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -414,6 +414,7 @@ in
  # traefik test relies on docker-containers
  trac = handleTest ./trac.nix {};
  traefik = handleTestOn ["x86_64-linux"] ./traefik.nix {};
+  trafficserver = handleTest ./trafficserver.nix {};
  transmission = handleTest ./transmission.nix {};
  trezord = handleTest ./trezord.nix {};
  trickster = handleTest ./trickster.nix {};
--- a/nixos/tests/custom-ca.nix
+++ b/nixos/tests/custom-ca.nix
@ -92,13 +92,19 @@ in
        { onlySSL = true;
          sslCertificate = "${example-good-cert}/server.crt";
          sslCertificateKey = "${example-good-cert}/server.key";
-          locations."/".extraConfig = "return 200 'It works!';";
+          locations."/".extraConfig = ''
+            add_header Content-Type text/plain;
+            return 200 'It works!';
+          '';
        };
      services.nginx.virtualHosts."bad.example.com" =
        { onlySSL = true;
          sslCertificate = "${example-bad-cert}/server.crt";
          sslCertificateKey = "${example-bad-cert}/server.key";
-          locations."/".extraConfig = "return 200 'It does not work!';";
+          locations."/".extraConfig = ''
+            add_header Content-Type text/plain;
+            return 200 'It does not work!';
+          '';
        };

      environment.systemPackages = with pkgs;
--- a/nixos/tests/trafficserver.nix
+++ b/nixos/tests/trafficserver.nix
@ -0,0 +1,176 @@
+# verifies:
+#   1. Traffic Server is able to start
+#   2. Traffic Server spawns traffic_crashlog upon startup
+#   3. Traffic Server proxies HTTP requests according to URL remapping rules
+#      in 'services.trafficserver.remap'
+#   4. Traffic Server applies per-map settings specified with the conf_remap
+#      plugin
+#   5. Traffic Server caches HTTP responses
+#   6. Traffic Server processes HTTP PUSH requests
+#   7. Traffic Server can load the healthchecks plugin
+#   8. Traffic Server logs HTTP traffic as configured
+#
+# uses:
+#   - bin/traffic_manager
+#   - bin/traffic_server
+#   - bin/traffic_crashlog
+#   - bin/traffic_cache_tool
+#   - bin/traffic_ctl
+#   - bin/traffic_logcat
+#   - bin/traffic_logstats
+#   - bin/tspush
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "trafficserver";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ midchildan ];
+  };
+
+  nodes = {
+    ats = { pkgs, lib, config, ... }: let
+      user = config.users.users.trafficserver.name;
+      group = config.users.groups.trafficserver.name;
+      healthchecks = pkgs.writeText "healthchecks.conf" ''
+        /status /tmp/ats.status text/plain 200 500
+      '';
+    in {
+      services.trafficserver.enable = true;
+
+      services.trafficserver.records = {
+        proxy.config.http.server_ports = "80 80:ipv6";
+        proxy.config.hostdb.host_file.path = "/etc/hosts";
+        proxy.config.log.max_space_mb_headroom = 0;
+        proxy.config.http.push_method_enabled = 1;
+
+        # check that cache storage is usable before accepting traffic
+        proxy.config.http.wait_for_cache = 2;
+      };
+
+      services.trafficserver.plugins = [
+        { path = "healthchecks.so"; arg = toString healthchecks; }
+        { path = "xdebug.so"; }
+      ];
+
+      services.trafficserver.remap = ''
+        map http://httpbin.test http://httpbin
+        map http://pristine-host-hdr.test http://httpbin \
+          @plugin=conf_remap.so \
+          @pparam=proxy.config.url_remap.pristine_host_hdr=1
+        map http://ats/tspush http://httpbin/cache \
+          @plugin=conf_remap.so \
+          @pparam=proxy.config.http.cache.required_headers=0
+      '';
+
+      services.trafficserver.storage = ''
+        /dev/vdb volume=1
+      '';
+
+      networking.firewall.allowedTCPPorts = [ 80 ];
+      virtualisation.emptyDiskImages = [ 256 ];
+      services.udev.extraRules = ''
+        KERNEL=="vdb", OWNER="${user}", GROUP="${group}"
+      '';
+    };
+
+    httpbin = { pkgs, lib, ... }: let
+      python = pkgs.python3.withPackages
+        (ps: with ps; [ httpbin gunicorn gevent ]);
+    in {
+      systemd.services.httpbin = {
+        enable = true;
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = "${python}/bin/gunicorn -b 0.0.0.0:80 httpbin:app -k gevent";
+        };
+      };
+
+      networking.firewall.allowedTCPPorts = [ 80 ];
+    };
+
+    client = { pkgs, lib, ... }: {
+      environment.systemPackages = with pkgs; [ curl ];
+    };
+  };
+
+  testScript = { nodes, ... }: let
+    sampleFile = pkgs.writeText "sample.txt" ''
+      It's the season of White Album.
+    '';
+  in ''
+    import json
+    import re
+
+    ats.wait_for_unit("trafficserver")
+    ats.wait_for_open_port(80)
+    httpbin.wait_for_unit("httpbin")
+    httpbin.wait_for_open_port(80)
+
+    with subtest("Traffic Server is running"):
+        out = ats.succeed("traffic_ctl server status")
+        assert out.strip() == "Proxy -- on"
+
+    with subtest("traffic_crashlog is running"):
+        ats.succeed("pgrep -f traffic_crashlog")
+
+    with subtest("basic remapping works"):
+        out = client.succeed("curl -vv -H 'Host: httpbin.test' http://ats/headers")
+        assert json.loads(out)["headers"]["Host"] == "httpbin"
+
+    with subtest("conf_remap plugin works"):
+        out = client.succeed(
+            "curl -vv -H 'Host: pristine-host-hdr.test' http://ats/headers"
+        )
+        assert json.loads(out)["headers"]["Host"] == "pristine-host-hdr.test"
+
+    with subtest("caching works"):
+        out = client.succeed(
+            "curl -vv -D - -H 'Host: httpbin.test' -H 'X-Debug: X-Cache' http://ats/cache/60 -o /dev/null"
+        )
+        assert "X-Cache: miss" in out
+
+        out = client.succeed(
+            "curl -vv -D - -H 'Host: httpbin.test' -H 'X-Debug: X-Cache' http://ats/cache/60 -o /dev/null"
+        )
+        assert "X-Cache: hit-fresh" in out
+
+    with subtest("pushing to cache works"):
+        url = "http://ats/tspush"
+
+        ats.succeed(f"echo {url} > /tmp/urls.txt")
+        out = ats.succeed(
+            f"tspush -f '${sampleFile}' -u {url}"
+        )
+        assert "HTTP/1.0 201 Created" in out, "cache push failed"
+
+        out = ats.succeed(
+            "traffic_cache_tool --spans /etc/trafficserver/storage.config find --input /tmp/urls.txt"
+        )
+        assert "Span: /dev/vdb" in out, "cache not stored on disk"
+
+        out = client.succeed(f"curl {url}").strip()
+        expected = (
+            open("${sampleFile}").read().strip()
+        )
+        assert out == expected, "cache content mismatch"
+
+    with subtest("healthcheck plugin works"):
+        out = client.succeed("curl -vv http://ats/status -o /dev/null -w '%{http_code}'")
+        assert out.strip() == "500"
+
+        ats.succeed("touch /tmp/ats.status")
+
+        out = client.succeed("curl -vv http://ats/status -o /dev/null -w '%{http_code}'")
+        assert out.strip() == "200"
+
+    with subtest("logging works"):
+        access_log_path = "/var/log/trafficserver/squid.blog"
+        ats.wait_for_file(access_log_path)
+
+        out = ats.succeed(f"traffic_logcat {access_log_path}").split("\n")[0]
+        expected = "^\S+ \S+ \S+ TCP_MISS/200 \S+ GET http://httpbin/headers - DIRECT/httpbin application/json$"
+        assert re.fullmatch(expected, out) is not None, "no matching logs"
+
+        out = json.loads(ats.succeed(f"traffic_logstats -jf {access_log_path}"))
+        assert out["total"]["error.total"]["req"] == "0", "unexpected log stat"
+  '';
+})
--- a/pkgs/applications/audio/bucklespring/default.nix
+++ b/pkgs/applications/audio/bucklespring/default.nix
@ -0,0 +1,63 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+
+, legacy ? false
+, libinput
+
+, pkg-config
+, makeWrapper
+
+, openal
+, alure
+, libXtst
+, libX11
+}:
+
+let
+  inherit (lib) optionals;
+in
+stdenv.mkDerivation rec {
+  pname = "bucklespring";
+  version = "unstable-2021-01-21";
+
+  src = fetchFromGitHub {
+    owner = "zevv";
+    repo = pname;
+    rev = "d63100c4561dd7c57efe6440c12fa8d9e9604145";
+    sha256 = "114dib4npb7r1z2zd1fwsx71xbf9r6psxqd7n7590cwz1w3r51mz";
+  };
+
+  nativeBuildInputs = [ pkg-config makeWrapper ];
+
+  buildInputs = [ openal alure ]
+    ++ optionals (legacy) [ libXtst libX11 ]
+    ++ optionals (!legacy) [ libinput ];
+
+  makeFlags = optionals (!legacy) [ "libinput=1" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/wav
+    cp -r $src/wav $out/share/.
+    install -D ./buckle.desktop $out/share/applications/buckle.desktop
+    install -D ./buckle $out/bin/buckle
+    wrapProgram $out/bin/buckle --add-flags "-p $out/share/wav"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Nostalgia bucklespring keyboard sound";
+    longDescription = ''
+      When built with libinput (wayland or bare console),
+      users need to be in the input group to use this:
+      <code>users.users.alice.extraGroups = [ "input" ];</code>
+    '';
+    homepage = "https://github.com/zevv/bucklespring";
+    license = licenses.gpl2Only;
+    platforms  = platforms.unix;
+    maintainers = [ maintainers.evils ];
+  };
+}
--- a/pkgs/applications/editors/bluej/default.nix
+++ b/pkgs/applications/editors/bluej/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "bluej";
-  version = "5.0.0";
+  version = "5.0.1";
  src = fetchurl {
    # We use the deb here. First instinct might be to go for the "generic" JAR
    # download, but that is actually a graphical installer that is much harder
    # to unpack than the deb.
    url = "https://www.bluej.org/download/files/BlueJ-linux-${builtins.replaceStrings ["."] [""] version}.deb";
-    sha256 = "sha256-U81FIf67Qm/86+hA9iUCHt61dxiZsTkkequlVjft6/0=";
+    sha256 = "sha256-KhNhJ2xsw1g2yemwP6NQmJvk4cxZAQQNPEUBuLso5qM=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/graphics/foxotron/default.nix
+++ b/pkgs/applications/graphics/foxotron/default.nix
@ -25,14 +25,14 @@

 stdenv.mkDerivation rec {
  pname = "foxotron";
-  version = "2021-03-12";
+  version = "2021-04-19";

  src = fetchFromGitHub {
    owner = "Gargaj";
    repo = "Foxotron";
    rev = version;
    fetchSubmodules = true;
-    sha256 = "1finvbs3pbfyvm525blwgwl5jci2zjxb1923i0cm8rmf7wasaapb";
+    sha256 = "sha256-YTCnWHXBNqvJmhRqRQRFCVvBcqbjKzcc3AKVXS0jvno=";
  };

  nativeBuildInputs = [ cmake pkg-config makeWrapper ];
@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
      Revision 2021 3D Graphics Competition.
    '';
    homepage = "https://github.com/Gargaj/Foxotron";
-    license = licenses.publicDomain;
+    license = licenses.unlicense;
    maintainers = with maintainers; [ OPNA2608 ];
    platforms = platforms.all;
  };
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@ -2,7 +2,6 @@
 , stdenv
 , copyDesktopItems
 , fetchFromGitHub
-, fetchpatch
 , makeDesktopItem
 , makeWrapper
 , fontconfig
@ -19,18 +18,18 @@

 stdenv.mkDerivation rec {
  pname = "dbeaver-ce";
-  version = "21.0.3"; # When updating also update fetchedMavenDeps.sha256
+  version = "21.0.4"; # When updating also update fetchedMavenDeps.sha256

  src = fetchFromGitHub {
    owner = "dbeaver";
    repo = "dbeaver";
    rev = version;
-    sha256 = "sha256-ItM8t+gqE0ccuuimfEMUddykl+xt2eZIBd3MbpreRwA=";
+    sha256 = "sha256-jV7Pe4MsLQnIrkDnlI2SrPzSjiDHM59GbMy4G7oeQK8=";
  };

  fetchedMavenDeps = stdenv.mkDerivation {
    name = "dbeaver-${version}-maven-deps";
-    inherit src patches;
+    inherit src;

    buildInputs = [
      maven
@ -51,18 +50,9 @@ stdenv.mkDerivation rec {
    dontFixup = true;
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
-    outputHash = "sha256-rsK/B39ogNu5nC41OfyAsLiwBz4gWyH+8Fj7E6+rOng=";
+    outputHash = "sha256-RspJTWVM0ZpAz4yDeKsG7wSHZ//bi3SSV5c0gbsqZKY=";
  };

-  patches = [
-    # Fix eclipse-color-theme URL (https://github.com/dbeaver/dbeaver/pull/12133)
-    # After April 15, 2021 eclipse-color-theme.github.com no longer redirects to eclipse-color-theme.github.io
-    (fetchpatch {
-      url = "https://github.com/dbeaver/dbeaver/commit/65d65e2c2c711cc87fddcec425a6915aa80f4ced.patch";
-      sha256 = "sha256-pxOcRYkV/5o+tHcRhHDZ1TmZSHMnKBmkNTVAlIf9nUE=";
-    })
-  ];
-
  nativeBuildInputs = [
    copyDesktopItems
    makeWrapper
--- a/pkgs/applications/misc/googleearth-pro/default.nix
+++ b/pkgs/applications/misc/googleearth-pro/default.nix
@ -1,41 +1,54 @@
-{ lib, stdenv, fetchurl, glibc, libGLU, libGL, freetype, glib, libSM, libICE, libXi, libXv
-, libXrender, libXrandr, libXfixes, libXcursor, libXinerama, libXext, libX11, libXcomposite
-, libxcb, sqlite, zlib, fontconfig, dpkg, libproxy, libxml2, gst_all_1, dbus, makeWrapper }:
+{ lib
+, stdenv
+, mkDerivation
+, fetchurl
+, ffmpeg_3
+, freetype
+, gdal_2
+, glib
+, libGL
+, libGLU
+, libICE
+, libSM
+, libXi
+, libXv
+, libav_12

+, libXrender
+, libXrandr
+, libXfixes
+, libXcursor
+, libXinerama
+, libXext
+, libX11
+, libXcomposite
+
+, libxcb
+, sqlite
+, zlib
+, fontconfig
+, dpkg
+, libproxy
+, libxml2
+, gst_all_1
+, dbus
+, makeWrapper
+
+, qtlocation
+, qtwebkit
+, qtx11extras
+, qtsensors
+, qtscript
+
+, xkeyboardconfig
+, autoPatchelfHook
+}:
 let
  arch =
    if stdenv.hostPlatform.system == "x86_64-linux" then "amd64"
    else throw "Unsupported system ${stdenv.hostPlatform.system} ";
-  fullPath = lib.makeLibraryPath [
-    glibc
-    glib
-    stdenv.cc.cc
-    libSM
-    libICE
-    libXi
-    libXv
-    libGLU libGL
-    libXrender
-    libXrandr
-    libXfixes
-    libXcursor
-    libXinerama
-    libXcomposite
-    freetype
-    libXext
-    libX11
-    libxcb
-    sqlite
-    zlib
-    fontconfig
-    libproxy
-    libxml2
-    dbus
-    gst_all_1.gstreamer
-    gst_all_1.gst-plugins-base
-  ];
 in
-stdenv.mkDerivation rec {
+mkDerivation rec {
  pname = "googleearth-pro";
  version = "7.3.3.7786";

@ -44,20 +57,56 @@ stdenv.mkDerivation rec {
    sha256 = "1s3cakwrgf702g33rh8qs657d8bl68wgg8k89rksgvswwpd2zbb3";
  };

-  nativeBuildInputs = [ dpkg makeWrapper ];
+  nativeBuildInputs = [ dpkg makeWrapper autoPatchelfHook ];
+  propagatedBuildInputs = [ xkeyboardconfig ];
+  buildInputs = [
+    dbus
+    ffmpeg_3
+    fontconfig
+    freetype
+    gdal_2
+    glib
+    gst_all_1.gst-plugins-base
+    gst_all_1.gstreamer
+    libGL
+    libGLU
+    libICE
+    libSM
+    libX11
+    libXcomposite
+    libXcursor
+    libXext
+    libXfixes
+    libXi
+    libXinerama
+    libXrandr
+    libXrender
+    libXv
+    libav_12
+    libproxy
+    libxcb
+    libxml2
+    qtlocation
+    qtscript
+    qtsensors
+    qtwebkit
+    qtx11extras
+    sqlite
+    zlib
+  ];

  doInstallCheck = true;

  dontBuild = true;

-  dontPatchELF = true;
-
  unpackPhase = ''
    # deb file contains a setuid binary, so 'dpkg -x' doesn't work here
    dpkg --fsys-tarfile ${src} | tar --extract
  '';

  installPhase =''
+    runHook preInstall
+
    mkdir $out
    mv usr/* $out/
    rmdir usr
@ -66,20 +115,9 @@ stdenv.mkDerivation rec {

    # patch and link googleearth binary
    ln -s $out/opt/google/earth/pro/googleearth-bin $out/bin/googleearth-pro
-    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${fullPath}:\$ORIGIN" \
-      $out/opt/google/earth/pro/googleearth-bin

    # patch and link gpsbabel binary
    ln -s $out/opt/google/earth/pro/gpsbabel $out/bin/gpsbabel
-    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${fullPath}:\$ORIGIN" \
-      $out/opt/google/earth/pro/gpsbabel
-
-    # patch libraries
-    for a in $out/opt/google/earth/pro/*.so* ; do
-      patchelf --set-rpath "${fullPath}:\$ORIGIN" $a
-    done

    # Add desktop config file and icons
    mkdir -p $out/share/{applications,icons/hicolor/{16x16,22x22,24x24,32x32,48x48,64x64,128x128,256x256}/apps,pixmaps}
@ -89,23 +127,37 @@ stdenv.mkDerivation rec {
      ln -s $out/opt/google/earth/pro/product_logo_"$size".png $out/share/icons/hicolor/"$size"x"$size"/apps/google-earth-pro.png
    done
    ln -s $out/opt/google/earth/pro/product_logo_256.png $out/share/pixmaps/google-earth-pro.png
+
+    runHook postInstall
  '';

+  postInstall = ''
+    find "$out/opt/google/earth/pro" -name "*.so.*" | \
+      egrep -v 'libssl*|libcrypto*|libicu*' | \
+      xargs rm
+    find "$out/opt/google/earth/pro" -name "*.so" | \
+      egrep -v 'libgoogle*|libauth*|libbase*|libcommon*|libcommon_gui*|libcommon_platform*|libcommon_webbrowser*|libcomponentframework*|libgeobase*|libgeobaseutils*|libge_net*|libgdata*|libgoogleapi*|libmath*|libmoduleframework*|libmaps*|libport*|libprintmodule*|libprofile*|librender*|libreporting*|libsgutil*|libspatial*|libxsltransform*|libbase*|libport*|libport*|libbase*|libcomponentframework*|libIGCore*|libIGUtils*|libaction*|libapiloader*|libapiloader*|libIGCore*|libIGUtils*|libIGMath*|libfusioncommon*|libge_exif*|libaction*|libfusioncommon*|libapiloader*|liblayer*|libapiloader*|libIGAttrs*|libIGCore*|libIGGfx*|libIGMath*|libIGSg*|libIGUtils*|libwmsbase*|libwebbrowser*|libevllpro*|libalchemyext*|libge_cache*|libflightsim*|libnpgeinprocessplugin*|libmeasure*|libviewsync*|libcapture*|libtheme*|libgps*|libgisingest*|libsearchmodule*|libinput_plugin*|libnavigate*|libspnav*|libsearch*|libLeap*' | \
+      xargs rm
+  '';
+
+  autoPatchelfIgnoreMissingDeps=true;
+
  installCheckPhase = ''
    $out/bin/gpsbabel -V > /dev/null
  '';

  # wayland is not supported by Qt included in binary package, so make sure it uses xcb
-  fixupPhase = ''
-    wrapProgram $out/bin/googleearth-pro --set QT_QPA_PLATFORM xcb
+  postFixup = ''
+    wrapProgram $out/bin/googleearth-pro \
+      --set QT_QPA_PLATFORM xcb \
+      --set QT_XKB_CONFIG_ROOT "${xkeyboardconfig}/share/X11/xkb"
  '';

-
  meta = with lib; {
    description = "A world sphere viewer";
-    homepage = "https://earth.google.com";
+    homepage = "https://www.google.com/earth/";
    license = licenses.unfree;
-    maintainers = with maintainers; [ friedelino ];
+    maintainers = with maintainers; [ friedelino shamilton ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/metadata-cleaner/default.nix
+++ b/pkgs/applications/misc/metadata-cleaner/default.nix
@ -17,7 +17,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "metadata-cleaner";
-  version = "1.0.4";
+  version = "1.0.5";

  format = "other";

@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "rmnvgr";
    repo = "metadata-cleaner";
    rev = "v${version}";
-    sha256 = "sha256-F/xh4dFX7W50kFzpWpGKyMUhxOlDO3WDXBzXVsDViY8=";
+    sha256 = "sha256-9s9i703Svql1Nn1M1sFp3FOtLGjuxXi6YR6nsUJCkeg=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
+++ b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "tektoncd-cli";
-  version = "0.17.2";
+  version = "0.18.0";

  src = fetchFromGitHub {
    owner = "tektoncd";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-7VG9OFt1yVt4st8EM1aiRqLCHwjSqib28GoamoJHHnM=";
+    sha256 = "sha256-vZxpfVMUl1EZwCuLlwmSKWrz86aTjWYlAIwO4b9ACqk=";
  };

  vendorSha256 = null;
@ -24,6 +24,8 @@ buildGoModule rec {
  excludedPackages = "\\(third_party\\|cmd/docs\\)";

  preCheck = ''
+    # Some tests try to write to the home dir
+    export HOME="$TMPDIR"
    # Change the golden files to match our desired version
    sed -i "s/dev/${version}/" pkg/cmd/version/testdata/TestGetVersions-*.golden
  '';
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@ -42,11 +42,11 @@ let

  pname = "slack";

-  x86_64-darwin-version = "4.14.0";
-  x86_64-darwin-sha256 = "0kpjsnriav6rcddjkz0z9arxjd09i6bw2krnmf3dc31my64nmxs6";
+  x86_64-darwin-version = "4.15.0";
+  x86_64-darwin-sha256 = "12mfha0f7nciszsv7fb0zk4y10p63mh7kaw8gbk3q2fmyp8aij6l";

-  x86_64-linux-version = "4.14.0";
-  x86_64-linux-sha256 = "0xy9i8ssjba62ca7lfan58rhwx69wkapfd0jzkaj95qhqnv019fg";
+  x86_64-linux-version = "4.15.0";
+  x86_64-linux-sha256 = "1xzp7ql4i3n3fqfwk0400hkg4xn0pi66sy5jzqn68z33zzf7raii";

  version = {
    x86_64-darwin = x86_64-darwin-version;
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "lean";
-  version = "3.29.0";
+  version = "3.30.0";

  src = fetchFromGitHub {
    owner  = "leanprover-community";
    repo   = "lean";
    rev    = "v${version}";
-    sha256 = "sha256-f2Gp76c+4R+ww52f1AyVZqixpei1WZPwr7pfgxMMb9Q=";
+    sha256 = "sha256-gJhbkl19iilNyfCt2TfPmghYA3yCjg6kS+yk/x/k14Y=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/version-management/redmine/Gemfile.lock
+++ b/pkgs/applications/version-management/redmine/Gemfile.lock
@ -70,28 +70,28 @@ GEM
    globalid (0.4.2)
      activesupport (>= 4.2.0)
    htmlentities (4.3.4)
-    i18n (1.8.9)
+    i18n (1.8.10)
      concurrent-ruby (~> 1.0)
-    loofah (2.9.0)
+    loofah (2.9.1)
      crass (~> 1.0.2)
      nokogiri (>= 1.5.9)
    mail (2.7.1)
      mini_mime (>= 0.1.1)
-    marcel (1.0.0)
+    marcel (1.0.1)
    method_source (1.0.0)
    mini_magick (4.11.0)
    mini_mime (1.0.3)
-    mini_portile2 (2.5.0)
+    mini_portile2 (2.5.1)
    minitest (5.14.4)
    mocha (1.12.0)
    mysql2 (0.5.3)
    net-ldap (0.17.0)
    nio4r (2.5.7)
-    nokogiri (1.11.2)
+    nokogiri (1.11.3)
      mini_portile2 (~> 2.5.0)
      racc (~> 1.4)
    parallel (1.20.1)
-    parser (3.0.0.0)
+    parser (3.0.1.0)
      ast (~> 2.4.1)
    pg (1.2.3)
    public_suffix (4.0.6)
@ -138,7 +138,7 @@ GEM
    regexp_parser (1.8.2)
    request_store (1.5.0)
      rack (>= 1.4)
-    rexml (3.2.4)
+    rexml (3.2.5)
    roadie (4.0.0)
      css_parser (~> 1.4)
      nokogiri (~> 1.8)
@ -151,7 +151,7 @@ GEM
      chunky_png (~> 1.0)
      rqrcode_core (~> 0.2)
    rqrcode_core (0.2.0)
-    rubocop (1.12.0)
+    rubocop (1.12.1)
      parallel (~> 1.10)
      parser (>= 3.0.0.0)
      rainbow (>= 2.2.2, < 4.0)
--- a/pkgs/applications/version-management/redmine/default.nix
+++ b/pkgs/applications/version-management/redmine/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, bundlerEnv, ruby, makeWrapper }:

 let
-  version = "4.2.0";
+  version = "4.2.1";
  rubyEnv = bundlerEnv {
    name = "redmine-env-${version}";

@ -16,7 +16,7 @@ in

    src = fetchurl {
      url = "https://www.redmine.org/releases/${pname}-${version}.tar.gz";
-      sha256 = "1r87gy73dclnvcz55vziv6kbgyck0v8jlzx1wwkak8mgh32n8n19";
+      sha256 = "1d217fhyvncpwahwlinr3vc20vn7jijaxxk1i56gw72z8b1hjhdd";
    };

    nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/version-management/redmine/gemset.nix
+++ b/pkgs/applications/version-management/redmine/gemset.nix
@ -269,10 +269,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "08p6b13p99j1rrcrw1l3v0kb9mxbsvy6nk31r8h4rnszdgzpga32";
+      sha256 = "0g2fnag935zn2ggm5cn6k4s4xvv53v2givj1j90szmvavlpya96a";
      type = "gem";
    };
-    version = "1.8.9";
+    version = "1.8.10";
  };
  loofah = {
    dependencies = ["crass" "nokogiri"];
@ -280,10 +280,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0bzwvxvilx7w1p3pg028ks38925y9i0xm870lm7s12w7598hiyck";
+      sha256 = "1w9mbii8515p28xd4k72f3ab2g6xiyq15497ys5r8jn6m355lgi7";
      type = "gem";
    };
-    version = "2.9.0";
+    version = "2.9.1";
  };
  mail = {
    dependencies = ["mini_mime"];
@ -301,10 +301,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1vhp6lifwvqs2b0a276lj61n86c1l7d1xiswjj2w23f54gl51mpk";
+      sha256 = "0bp001p687nsa4a8sp3q1iv8pfhs24w7s3avychjp64sdkg6jxq3";
      type = "gem";
    };
-    version = "1.0.0";
+    version = "1.0.1";
  };
  method_source = {
    groups = ["default"];
@ -341,10 +341,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1hdbpmamx8js53yk3h8cqy12kgv6ca06k0c9n3pxh6b6cjfs19x7";
+      sha256 = "0xg1x4708a4pn2wk8qs2d8kfzzdyv9kjjachg2f1phsx62ap2rx2";
      type = "gem";
    };
-    version = "2.5.0";
+    version = "2.5.1";
  };
  minitest = {
    groups = ["default" "test"];
@ -410,10 +410,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0b51df8fwadak075cvi17w0nch6qz1r66564qp29qwfj67j9qp0p";
+      sha256 = "19d78mdg2lbz9jb4ph6nk783c9jbsdm8rnllwhga6pd53xffp6x0";
      type = "gem";
    };
-    version = "1.11.2";
+    version = "1.11.3";
  };
  parallel = {
    groups = ["default" "test"];
@ -431,10 +431,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1jixakyzmy0j5c1rb0fjrrdhgnyryvrr6vgcybs14jfw09akv5ml";
+      sha256 = "04ri489irbbx6sbkclpgri7j7p99v2qib5g2i70xx5fay12ilny8";
      type = "gem";
    };
-    version = "3.0.0.0";
+    version = "3.0.1.0";
  };
  pg = {
    groups = ["default"];
@ -638,10 +638,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1mkvkcw9fhpaizrhca0pdgjcrbns48rlz4g6lavl5gjjq3rk2sq3";
+      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
      type = "gem";
    };
-    version = "3.2.4";
+    version = "3.2.5";
  };
  roadie = {
    dependencies = ["css_parser" "nokogiri"];
@ -712,10 +712,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1i3y0h6awywx4rdmjdan908jmnyk589pndbjypxkfbkqvjx514fw";
+      sha256 = "0hi2c3a6alya9yx07nirnjzlc0mvmidnx67874njp6wf7d5xqqr9";
      type = "gem";
    };
-    version = "1.12.0";
+    version = "1.12.1";
  };
  rubocop-ast = {
    dependencies = ["parser"];
--- a/pkgs/applications/virtualization/cloud-hypervisor/default.nix
+++ b/pkgs/applications/virtualization/cloud-hypervisor/default.nix
@ -2,19 +2,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "cloud-hypervisor";
-  version = "0.14.1";
+  version = "15.0";

  src = fetchFromGitHub {
    owner = "cloud-hypervisor";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0pnfg6dzpz8v40cwg3dmlj52x8pblavv7mkczar814dwbk01y7vr";
+    sha256 = "14s80vs7j5fxzl2a6k44fjlbk8i13lln28i37xaa6yk1q3d9jwic";
  };

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ] ++ lib.optional stdenv.isAarch64 dtc;

-  cargoSha256 = "0dbjds40znly11i0ssfv66w82ynxp00ixw1349m5ln9i9ms94sr4";
+  cargoSha256 = "02q4k7j1hyibsiwsbqa5bd4vr3fs1vngnnhqa4kzvih73bkagvk7";

  meta = with lib; {
    homepage = "https://github.com/cloud-hypervisor/cloud-hypervisor";
--- a/pkgs/desktops/xfce/applications/gigolo/default.nix
+++ b/pkgs/desktops/xfce/applications/gigolo/default.nix
@ -1,4 +1,4 @@
-{ lib, mkXfceDerivation, gtk3, gvfs, glib }:
+{ lib, mkXfceDerivation, gtk3, glib }:

 mkXfceDerivation {
  category = "apps";
@ -8,12 +8,7 @@ mkXfceDerivation {

  sha256 = "8UDb4H3zxRKx2y+MRsozQoR3es0fs5ooR/5wBIE11bY=";

-  buildInputs = [ gtk3 glib gvfs ];
-
-  postPatch = ''
-    # exo-csource has been dropped from exo
-    substituteInPlace src/Makefile.am --replace exo-csource xdt-csource
-  '';
+  buildInputs = [ gtk3 glib ];

  meta = {
    description = "A frontend to easily manage connections to remote filesystems";
--- a/pkgs/desktops/xfce/core/thunar/default.nix
+++ b/pkgs/desktops/xfce/core/thunar/default.nix
@ -12,7 +12,6 @@
 , libxslt
 , xfconf
 , gobject-introspection
-, gvfs
 , makeWrapper
 , symlinkJoin
 , thunarPlugins ? []
@ -35,7 +34,6 @@ let unwrapped = mkXfceDerivation {
    exo
    gdk-pixbuf
    gtk3
-    gvfs
    libX11
    libgudev
    libnotify
--- a/pkgs/desktops/xfce/default.nix
+++ b/pkgs/desktops/xfce/default.nix
@ -15,9 +15,6 @@ lib.makeScope pkgs.newScope (self: with self; {

  automakeAddFlags = pkgs.makeSetupHook { } ./automakeAddFlags.sh;

-  # Samba is a rather heavy dependency
-  gvfs = pkgs.gvfs.override { samba = null; };
-
  #### CORE

  exo = callPackage ./core/exo { };
--- a/pkgs/development/libraries/cjose/default.nix
+++ b/pkgs/development/libraries/cjose/default.nix
@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, doxygen
+, check
+, jansson
+, openssl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cjose";
+  version = "0.6.1";
+
+  src = fetchFromGitHub {
+    owner = "cisco";
+    repo = "cjose";
+    rev = version;
+    sha256 = "1msyjwmylb5c7jc16ryx3xb9cdwx682ihsm0ni766y6dfwx8bkhp";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config doxygen ];
+  buildInputs = [ jansson openssl ];
+  checkInputs = [ check ];
+
+  configureFlags = [
+    "--with-jansson=${jansson}"
+    "--with-openssl=${openssl.dev}"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/cisco/cjose";
+    changelog = "https://github.com/cisco/cjose/blob/${version}/CHANGELOG.md";
+    description = "C library for Javascript Object Signing and Encryption";
+    license = licenses.mit;
+    maintainers = with maintainers; [ midchildan ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/python-modules/autoit-ripper/default.nix
+++ b/pkgs/development/python-modules/autoit-ripper/default.nix
@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, lief
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "autoit-ripper";
+  version = "1.0.1";
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0mbsrfa72n7y1vkm9jhwhn1z3k45jxrlgx58ia1l2bp6chnnn2zy";
+  };
+
+  propagatedBuildInputs = [
+    lief
+  ];
+
+  postPatch = ''
+    substituteInPlace requirements.txt --replace "lief==0.10.1" "lief>=0.10.1"
+  '';
+
+  # Project has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "autoit_ripper" ];
+
+  meta = with lib; {
+    description = "Python module to extract AutoIt scripts embedded in PE binaries";
+    homepage = "https://github.com/nazywam/AutoIt-Ripper";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/beancount_docverif/default.nix
+++ b/pkgs/development/python-modules/beancount_docverif/default.nix
@ -1,4 +1,5 @@
 { lib, buildPythonPackage, fetchPypi, isPy3k
+, setuptools-scm
 , beancount
 , pytest, sh
 }:
@ -14,6 +15,10 @@ buildPythonPackage rec {
    sha256 = "1kjc0axrxpvm828lqq5m2ikq0ls8xksbmm7312zw867gdx56x5aj";
  };

+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
  propagatedBuildInputs = [
    beancount
  ];
--- a/pkgs/development/python-modules/graphene/default.nix
+++ b/pkgs/development/python-modules/graphene/default.nix
@ -11,6 +11,7 @@
 , pytest-mock
 , pytz
 , snapshottest
+, fetchpatch
 }:

 buildPythonPackage rec {
@ -24,6 +25,13 @@ buildPythonPackage rec {
    sha256 = "sha256-bVCCLPnV5F8PqLMg3GwcpwpGldrxsU+WryL6gj6y338=";
  };

+  # Allow later aniso8601 releases
+  # https://github.com/graphql-python/graphene/pull/1331
+  patches = [ (fetchpatch {
+    url = "https://github.com/graphql-python/graphene/commit/26b16f75b125e35eeb2274b7be503ec29f2e8a45.patch";
+    sha256 = "qm96pNOoxPieEy1CFZpa2Mx010pY3QU/vRyuL0qO3Tk=";
+  }) ];
+
  propagatedBuildInputs = [
    aniso8601
    graphql-core
--- a/pkgs/development/python-modules/karton-autoit-ripper/default.nix
+++ b/pkgs/development/python-modules/karton-autoit-ripper/default.nix
@ -0,0 +1,46 @@
+{ lib
+, autoit-ripper
+, buildPythonPackage
+, fetchFromGitHub
+, karton-core
+, malduck
+, regex
+}:
+
+buildPythonPackage rec {
+  pname = "karton-autoit-ripper";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "CERT-Polska";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0vdsxkbjcr0inpcfjh45gl72ipzklkhgs06fdpkyy9y0cfx3zq7z";
+  };
+
+  propagatedBuildInputs = [
+    autoit-ripper
+    karton-core
+    malduck
+    regex
+  ];
+
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace "autoit-ripper==1.0.0" "autoit-ripper" \
+      --replace "karton.core==4.0.4" "karton-core" \
+      --replace "malduck==3.1.0" "malduck>=3.1.0" \
+      --replace "regex==2020.2.20" "regex>=2020.2.20"
+  '';
+
+  # Project has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "karton.autoit_ripper" ];
+
+  meta = with lib; {
+    description = "AutoIt script ripper for Karton framework";
+    homepage = "https://github.com/CERT-Polska/karton-autoit-ripper";
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/poppler-qt5/default.nix
+++ b/pkgs/development/python-modules/poppler-qt5/default.nix
@ -1,44 +1,64 @@
-{ buildPythonPackage, fetchPypi, lib, sip, qtbase, pyqt5, poppler, pkg-config, fetchpatch
-, substituteAll
+{ stdenv
+, lib
+, buildPythonPackage
+, isPy3k
+, fetchPypi
+, pythonPackages
+, sip_5
+, qtbase
+, qmake
+, pyqt5
+, pyqt-builder
+, poppler
+, pkg-config
+, fetchpatch
 }:

 buildPythonPackage rec {
  pname = "python-poppler-qt5";
-  version = "0.24.2";
+  version = "21.1.0";
+
+  disabled = !isPy3k;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0l69llw1fzwz8y90q0qp9q5pifbrqjjbwii7di54dwghw5fc6w1r";
+    sha256 = "0b82gm4i75q5v19kfbq0h4y0b2vcwr2213zkhxh6l0h45kdndmxd";
  };

  patches = [
-    (substituteAll {
-      src = ./poppler-include-dir.patch;
-      poppler_include_dir = "${poppler.dev}/include/poppler";
-    })
+    # Fix for https://github.com/frescobaldi/python-poppler-qt5/issues/43 (from PR #45)
    (fetchpatch {
-      url = "https://github.com/wbsoft/python-poppler-qt5/commit/faf4d1308f89560b0d849671226e3080dfc72e79.patch";
-      sha256 = "18krhh6wzsnpxzlzv02nginb1vralla8ai24zqk10nc4mj6fkj86";
+      url = "https://github.com/frescobaldi/python-poppler-qt5/commit/40e71ad88173d02648bceb2438bc0567e60dacd5.patch";
+      sha256 = "0c93d0k7b1n2s2njl8g92x6vw3z96da1fczah9qx07x08iw8dzi5";
    })
  ];

-  setupPyBuildFlags = [
-    "--pyqt-sip-dir ${pyqt5}/share/sip/PyQt5"
-    "--qt-include-dir ${qtbase.dev}/include"
-  ];
+  buildInputs = [ qtbase.dev poppler pyqt-builder ];
+  nativeBuildInputs = [ pkg-config qmake sip_5 ];
+  propagatedBuildInputs = [ pyqt5.dev ];

-  buildInputs = [ qtbase.dev poppler ];
-  nativeBuildInputs = [ pkg-config ];
-  propagatedBuildInputs = [ sip pyqt5.dev ];
+  format = "pyproject";
+  dontConfigure = true;
+
+  postPatch = ''
+    cat <<EOF >> pyproject.toml
+    sip-include-dirs = ["${pyqt5}/share/sip/PyQt5"]
+
+    [tool.sip.bindings.Poppler-Qt5]
+    include-dirs = ["${poppler.dev}/include/poppler"]
+    tags = ["${sip_5.platform_tag}"]
+    EOF
+  '';

  # no tests, just bindings for `poppler_qt5`
  doCheck = false;
+  pythonImportsCheck = [ "popplerqt5" ];

  dontWrapQtApps = true;

  meta = with lib; {
-    homepage = "https://github.com/wbsoft/python-poppler-qt5";
-    license = licenses.gpl2;
-    maintainers = with maintainers; [ ];
+    homepage = "https://github.com/frescobaldi/python-poppler-qt5";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ eduardosm ];
  };
 }
--- a/pkgs/development/python-modules/poppler-qt5/poppler-include-dir.patch
+++ b/pkgs/development/python-modules/poppler-qt5/poppler-include-dir.patch
@ -1,12 +0,0 @@
-diff --git a/setup.py b/setup.py
-index 59a75b0..0a73268 100644
--- a/setup.py
-+++ b/setup.py
-@@ -169,6 +169,7 @@ class build_ext(build_ext_base):
-                              'Please specify via --pyqt-sip-flags=')
- 
-         self.include_dirs += (self.qt_include_dir,
-+                              '@poppler_include_dir@',
-                               os.path.join(self.qt_include_dir, 'QtCore'),
-                               os.path.join(self.qt_include_dir, 'QtGui'),
-                               os.path.join(self.qt_include_dir, 'QtXml'))
--- a/pkgs/development/tools/ecpdap/default.nix
+++ b/pkgs/development/tools/ecpdap/default.nix
@ -2,26 +2,26 @@

 rustPlatform.buildRustPackage rec {
  pname = "ecpdap";
-  version = "0.1.5";
+  version = "0.1.6";

  src = fetchFromGitHub {
    owner = "adamgreig";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1z8w37i6wjz6cr453md54ip21y26605vrx4vpq5wwd11mfvc1jsg";
+    sha256 = "1va96hxm22a2lfy141x1sv5f5g8f6mp965an4jsff9qzi55kfv2g";
  };

-  # The lock file was not up to date with cargo.toml for this release
-  #
-  # This patch is the lock file after running `cargo update`
-  cargoPatches = [ ./lock-update.patch ];
-
-  cargoSha256 = "08xcnvbxm508v03b3hmz71mpa3yd8lamvazxivp6qsv46ri163mn";
+  cargoSha256 = "1dk6x2f36c546qr415kzmqr2r4550iwdmj4chrb46p3hr64jddhd";

  nativeBuildInputs = [ pkg-config ];

  buildInputs = [ libusb1 ];

+  postInstall = ''
+    mkdir -p $out/etc/udev/rules.d
+    cp drivers/*.rules $out/etc/udev/rules.d
+  '';
+
  meta = with lib; {
    description = "A tool to program ECP5 FPGAs";
    longDescription = ''
--- a/pkgs/development/tools/ecpdap/lock-update.patch
+++ b/pkgs/development/tools/ecpdap/lock-update.patch
@ -1,345 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 91f7e0c..1610002 100644
--- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -26,9 +26,9 @@ dependencies = [
- 
- [[package]]
- name = "anyhow"
-version = "1.0.37"
-+version = "1.0.40"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee67c11feeac938fae061b232e38e0b6d94f97a9df10e6271319325ac4c56a86"
-+checksum = "28b2cd92db5cbd74e8e5028f7e27dd7aa3090e89e4f2a197cc7c8dfb69c7063b"
- 
- [[package]]
- name = "atty"
-@@ -49,15 +49,9 @@ checksum = "cf1de2fe8c75bc145a2f577add951f8134889b4795d47466a54a5c846d691693"
- 
- [[package]]
- name = "cc"
-version = "1.0.66"
-+version = "1.0.67"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c0496836a84f8d0495758516b8621a622beb77c0fed418570e50764093ced48"
-
-[[package]]
-name = "cfg-if"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
-+checksum = "e3c69b077ad434294d3ce9f1f6143a2a4b89a8a2d54ef813d85003a4fd1137fd"
- 
- [[package]]
- name = "cfg-if"
-@@ -82,9 +76,9 @@ dependencies = [
- 
- [[package]]
- name = "console"
-version = "0.14.0"
-+version = "0.14.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cc80946b3480f421c2f17ed1cb841753a371c7c5104f51d507e13f532c856aa"
-+checksum = "3993e6445baa160675931ec041a5e03ca84b9c6e32a056150d3aa2bdda0a1f45"
- dependencies = [
-  "encode_unicode",
-  "lazy_static",
-@@ -101,14 +95,14 @@ version = "1.2.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "81156fece84ab6a9f2afdb109ce3ae577e42b1228441eded99bd77f627953b1a"
- dependencies = [
- "cfg-if 1.0.0",
-+ "cfg-if",
- ]
- 
- [[package]]
- name = "derivative"
-version = "2.1.1"
-+version = "2.2.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb582b60359da160a9477ee80f15c8d784c477e69c217ef2cdd4169c24ea380f"
-+checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
- dependencies = [
-  "proc-macro2",
-  "quote",
-@@ -117,7 +111,7 @@ dependencies = [
- 
- [[package]]
- name = "ecpdap"
-version = "0.1.4"
-+version = "0.1.5"
- dependencies = [
-  "anyhow",
-  "clap",
-@@ -153,11 +147,11 @@ dependencies = [
- 
- [[package]]
- name = "filetime"
-version = "0.2.13"
-+version = "0.2.14"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c122a393ea57648015bf06fbd3d372378992e86b9ff5a7a497b076a28c79efe"
-+checksum = "1d34cfa13a63ae058bfa601fe9e313bbdb3746427c1459185464ce0fcf62e1e8"
- dependencies = [
- "cfg-if 1.0.0",
-+ "cfg-if",
-  "libc",
-  "redox_syscall",
-  "winapi",
-@@ -165,9 +159,9 @@ dependencies = [
- 
- [[package]]
- name = "hermit-abi"
-version = "0.1.17"
-+version = "0.1.18"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aca5565f760fb5b220e499d72710ed156fdb74e631659e99377d9ebfbd13ae8"
-+checksum = "322f4de77956e22ed0e5032c359a0f1273f1f7f0d79bfa3b8ffbc730d7fbcc5c"
- dependencies = [
-  "libc",
- ]
-@@ -206,9 +200,9 @@ dependencies = [
- 
- [[package]]
- name = "jep106"
-version = "0.2.4"
-+version = "0.2.5"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f57cd08ee4fbc8043949150a59e34ea5f2afeb172f875db9607689e48600c653"
-+checksum = "939876d20519325db0883757e29e9858ee02919d0f03e43c74f69296caa314f4"
- dependencies = [
-  "serde",
- ]
-@@ -221,33 +215,35 @@ checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
- 
- [[package]]
- name = "libc"
-version = "0.2.81"
-+version = "0.2.94"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1482821306169ec4d07f6aca392a4681f66c75c9918aa49641a2595db64053cb"
-+checksum = "18794a8ad5b29321f790b55d93dfba91e125cb1a9edbd4f8e3150acc771c1a5e"
- 
- [[package]]
- name = "libflate"
-version = "1.0.3"
-+version = "1.1.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "389de7875e06476365974da3e7ff85d55f1972188ccd9f6020dd7c8156e17914"
-+checksum = "6d87eae36b3f680f7f01645121b782798b56ef33c53f83d1c66ba3a22b60bfe3"
- dependencies = [
-  "adler32",
-  "crc32fast",
-  "libflate_lz77",
- "rle-decode-fast",
- ]
- 
- [[package]]
- name = "libflate_lz77"
-version = "1.0.0"
-+version = "1.1.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3286f09f7d4926fc486334f28d8d2e6ebe4f7f9994494b6dab27ddfad2c9b11b"
-+checksum = "39a734c0493409afcd49deee13c006a04e3586b9761a03543c6272c9c51f2f5a"
-+dependencies = [
-+ "rle-decode-fast",
-+]
- 
- [[package]]
- name = "libusb1-sys"
-version = "0.4.3"
-+version = "0.4.4"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e3b8385bdc8931a82a0865a3a7285e2c28e41287824dc92c7724b7759a0c685"
-+checksum = "be241693102a24766d0b8526c8988771edac2842630d7e730f8e9fbc014f3703"
- dependencies = [
-  "cc",
-  "libc",
-@@ -259,11 +255,11 @@ dependencies = [
- 
- [[package]]
- name = "log"
-version = "0.4.11"
-+version = "0.4.14"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fabed175da42fed1fa0746b0ea71f412aa9d35e76e95e59b192c64b9dc2bf8b"
-+checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
- dependencies = [
- "cfg-if 0.1.10",
-+ "cfg-if",
- ]
- 
- [[package]]
-@@ -327,9 +323,9 @@ dependencies = [
- 
- [[package]]
- name = "proc-macro2"
-version = "1.0.24"
-+version = "1.0.26"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e0704ee1a7e00d7bb417d0770ea303c1bccbabf0ef1667dae92b5967f5f8a71"
-+checksum = "a152013215dca273577e18d2bf00fa862b89b24169fb78c4c95aeb07992c9cec"
- dependencies = [
-  "unicode-xid",
- ]
-@@ -342,36 +338,38 @@ checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
- 
- [[package]]
- name = "quote"
-version = "1.0.8"
-+version = "1.0.9"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "991431c3519a3f36861882da93630ce66b52918dcf1b8e2fd66b397fc96f28df"
-+checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
- dependencies = [
-  "proc-macro2",
- ]
- 
- [[package]]
- name = "redox_syscall"
-version = "0.1.57"
-+version = "0.2.6"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce"
-+checksum = "8270314b5ccceb518e7e578952f0b72b88222d02e8f77f5ecf7abbb673539041"
-+dependencies = [
-+ "bitflags",
-+]
- 
- [[package]]
- name = "regex"
-version = "1.4.2"
-+version = "1.4.6"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38cf2c13ed4745de91a5eb834e11c00bcc3709e773173b2ce4c56c9fbde04b9c"
-+checksum = "2a26af418b574bd56588335b3a3659a65725d4e636eb1016c2f9e3b38c7cc759"
- dependencies = [
-  "aho-corasick",
-  "memchr",
-  "regex-syntax",
- "thread_local",
- ]
- 
- [[package]]
- name = "regex-syntax"
-version = "0.6.21"
-+version = "0.6.23"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b181ba2dcf07aaccad5448e8ead58db5b742cf85dfe035e2227f137a539a189"
-+checksum = "24d5f089152e60f62d28b835fbff2cd2e8dc0baf1ac13343bef92ab7eed84548"
- 
- [[package]]
- name = "rle-decode-fast"
-@@ -391,18 +389,18 @@ dependencies = [
- 
- [[package]]
- name = "serde"
-version = "1.0.118"
-+version = "1.0.125"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06c64263859d87aa2eb554587e2d23183398d617427327cf2b3d0ed8c69e4800"
-+checksum = "558dc50e1a5a5fa7112ca2ce4effcb321b0300c0d4ccf0776a9f60cd89031171"
- dependencies = [
-  "serde_derive",
- ]
- 
- [[package]]
- name = "serde_derive"
-version = "1.0.118"
-+version = "1.0.125"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c84d3526699cd55261af4b941e4e725444df67aa4f9e6a3564f18030d12672df"
-+checksum = "b093b7a2bb58203b5da3056c05b4ec1fed827dcfdb37347a8841695263b3d06d"
- dependencies = [
-  "proc-macro2",
-  "quote",
-@@ -431,9 +429,9 @@ checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
- 
- [[package]]
- name = "syn"
-version = "1.0.57"
-+version = "1.0.71"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4211ce9909eb971f111059df92c45640aad50a619cf55cd76476be803c4c68e6"
-+checksum = "ad184cc9470f9117b2ac6817bfe297307418819ba40552f9b3846f05c33d5373"
- dependencies = [
-  "proc-macro2",
-  "quote",
-@@ -442,13 +440,12 @@ dependencies = [
- 
- [[package]]
- name = "tar"
-version = "0.4.30"
-+version = "0.4.33"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "489997b7557e9a43e192c527face4feacc78bfbe6eed67fd55c4c9e381cba290"
-+checksum = "c0bcfbd6a598361fda270d82469fff3d65089dc33e175c9a131f7b4cd395f228"
- dependencies = [
-  "filetime",
-  "libc",
- "redox_syscall",
-  "xattr",
- ]
- 
-@@ -463,9 +460,9 @@ dependencies = [
- 
- [[package]]
- name = "terminal_size"
-version = "0.1.15"
-+version = "0.1.16"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bd2d183bd3fac5f5fe38ddbeb4dc9aec4a39a9d7d59e7491d900302da01cbe1"
-+checksum = "86ca8ced750734db02076f44132d802af0b33b09942331f4459dde8636fd2406"
- dependencies = [
-  "libc",
-  "winapi",
-@@ -482,33 +479,24 @@ dependencies = [
- 
- [[package]]
- name = "thiserror"
-version = "1.0.23"
-+version = "1.0.24"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76cc616c6abf8c8928e2fdcc0dbfab37175edd8fb49a4641066ad1364fdab146"
-+checksum = "e0f4a65597094d4483ddaed134f409b2cb7c1beccf25201a9f73c719254fa98e"
- dependencies = [
-  "thiserror-impl",
- ]
- 
- [[package]]
- name = "thiserror-impl"
-version = "1.0.23"
-+version = "1.0.24"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9be73a2caec27583d0046ef3796c3794f868a5bc813db689eed00c7631275cd1"
-+checksum = "7765189610d8241a44529806d6fd1f2e0a08734313a35d5b3a556f92b381f3c0"
- dependencies = [
-  "proc-macro2",
-  "quote",
-  "syn",
- ]
- 
-[[package]]
-name = "thread_local"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d40c6d1b69745a6ec6fb1ca717914848da4b44ae29d9b3080cbee91d72a69b14"
-dependencies = [
- "lazy_static",
-]
-
- [[package]]
- name = "toml"
- version = "0.5.8"
-@@ -532,9 +520,9 @@ checksum = "f7fe0bb3479651439c9112f72b6c505038574c9fbb575ed1bf3b797fa39dd564"
- 
- [[package]]
- name = "vcpkg"
-version = "0.2.11"
-+version = "0.2.12"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b00bca6106a5e23f3eee943593759b7fcddb00554332e856d990c893966879fb"
-+checksum = "cbdbff6266a24120518560b5dc983096efb98462e51d0d68169895b237be3e5d"
- 
- [[package]]
- name = "vec_map"
--- a/pkgs/development/tools/frugal/default.nix
+++ b/pkgs/development/tools/frugal/default.nix
@ -0,0 +1,24 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "frugal";
+  version = "3.14.3";
+
+  src = fetchFromGitHub {
+    owner = "Workiva";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-zns2XcydY4xxgF8FB6eje0pAt0DZnFOIAqXaSX0xoMg=";
+  };
+
+  subPackages = [ "." ];
+
+  vendorSha256 = "sha256-hyupBMRKuw77SJNIk3mEUixV0LV5mEmZx8M70qGmYJY=";
+
+  meta = with lib; {
+    description = "Thrift improved";
+    homepage = "https://github.com/Workiva/frugal";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ diogox ];
+  };
+}
--- a/pkgs/development/tools/rgp/default.nix
+++ b/pkgs/development/tools/rgp/default.nix
@ -19,15 +19,15 @@
 }:

 let
-  buildNum = "2020-11-19-376";
+  buildNum = "2021-03-31-696";
 in
 stdenv.mkDerivation rec {
  pname = "rgp";
-  version = "1.9";
+  version = "1.10";

  src = fetchurl {
    url = "https://gpuopen.com/download/radeon-developer-tool-suite/RadeonDeveloperToolSuite-${buildNum}.tgz";
-    sha256 = "f71ibuMerd0SmXKSDjaTj7xtyy1dWzkZ5s0PlGtQ1+k=";
+    sha256 = "1GUV75KpYbeq7KkE86QqTfGnf/t3VEgviaAsbg/LWJI=";
  };

  nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
@ -59,6 +59,9 @@ stdenv.mkDerivation rec {
    mkdir -p $out/opt/rgp $out/bin
    cp -r . $out/opt/rgp/

+    chmod +x $out/opt/rgp/scripts/*
+    patchShebangs $out/opt/rgp/scripts
+
    for prog in RadeonDeveloperPanel RadeonDeveloperService RadeonDeveloperServiceCLI RadeonGPUAnalyzer RadeonGPUProfiler rga rtda; do
      # makeWrapper is needed so that executables are started from the opt
      # directory, where qt.conf and other tools are
--- a/pkgs/servers/dante/default.nix
+++ b/pkgs/servers/dante/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "dante";
-  version = "1.4.2";
+  version = "1.4.3";

  src = fetchurl {
    url = "https://www.inet.no/dante/files/${pname}-${version}.tar.gz";
-    sha256 = "1bfafnm445afrmyxvvcl8ckq0p59yzykmr3y8qvryzrscd85g8ms";
+    sha256 = "0pbahkj43rx7rmv2x40mf5p3g3x9d6i2sz7pzglarf54w5ghd2j1";
  };

  buildInputs = [ pam libkrb5 cyrus_sasl miniupnpc ];
--- a/pkgs/servers/http/trafficserver/default.nix
+++ b/pkgs/servers/http/trafficserver/default.nix
@ -0,0 +1,207 @@
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, makeWrapper
+, nixosTests
+, pkg-config
+, file
+, linuxHeaders
+, openssl
+, pcre
+, perlPackages
+, python3
+, xz
+, zlib
+# recommended dependencies
+, withHwloc ? true
+, hwloc
+, withCurl ? true
+, curl
+, withCurses ? true
+, ncurses
+, withCap ? stdenv.isLinux
+, libcap
+, withUnwind ? stdenv.isLinux
+, libunwind
+# optional dependencies
+, withBrotli ? false
+, brotli
+, withCjose ? false
+, cjose
+, withGeoIP ? false
+, geoip
+, withHiredis ? false
+, hiredis
+, withImageMagick ? false
+, imagemagick
+, withJansson ? false
+, jansson
+, withKyotoCabinet ? false
+, kyotocabinet
+, withLuaJIT ? false
+, luajit
+, withMaxmindDB ? false
+, libmaxminddb
+# optional features
+, enableWCCP ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "trafficserver";
+  version = "9.0.1";
+
+  src = fetchurl {
+    url = "mirror://apache/trafficserver/trafficserver-${version}.tar.bz2";
+    sha256 = "1q164pvfmbqh3gzy3bqy96lwd0fdbhz78r06pd92p7rmkqwx005z";
+  };
+
+  patches = [
+    # Adds support for NixOS
+    # https://github.com/apache/trafficserver/pull/7697
+    (fetchpatch {
+      url = "https://github.com/apache/trafficserver/commit/19d3af481cf74c91fbf713fc9d2f8b138ed5fbaf.diff";
+      sha256 = "0z1ikgpp00rzrrcqh97931586yn9wbksgai9xlkcjd5cg8gq0150";
+    })
+
+    # Fixes a bug in tspush which pushes incorrect contents to cache
+    # https://github.com/apache/trafficserver/pull/7696
+    (fetchpatch {
+      url = "https://github.com/apache/trafficserver/commit/b08215272872f452787915cd3a8e0b0ea0b88385.diff";
+      sha256 = "0axk8x1xvd8wvpgcxgyqqg7kgxyxwfgwmisq3xnk1da0cqv9cx9f";
+    })
+  ];
+
+  # NOTE: The upstream README indicates that flex is needed for some features,
+  # but it actually seems to be unnecessary as of this commit[1]. The detection
+  # logic for bison and flex is still present in the build script[2], but no
+  # other code seems to depend on it. This situation is susceptible to change
+  # though, so it's a good idea to inspect the build scripts periodically.
+  #
+  # [1]: https://github.com/apache/trafficserver/pull/5617
+  # [2]: https://github.com/apache/trafficserver/blob/3fd2c60/configure.ac#L742-L788
+  nativeBuildInputs = [ makeWrapper pkg-config file python3 ]
+    ++ (with perlPackages; [ perl ExtUtilsMakeMaker ])
+    ++ lib.optionals stdenv.isLinux [ linuxHeaders ];
+
+  buildInputs = [
+    openssl
+    pcre
+    perlPackages.perl
+  ] ++ lib.optional withBrotli brotli
+  ++ lib.optional withCap libcap
+  ++ lib.optional withCjose cjose
+  ++ lib.optional withCurl curl
+  ++ lib.optional withGeoIP geoip
+  ++ lib.optional withHiredis hiredis
+  ++ lib.optional withHwloc hwloc
+  ++ lib.optional withImageMagick imagemagick
+  ++ lib.optional withJansson jansson
+  ++ lib.optional withKyotoCabinet kyotocabinet
+  ++ lib.optional withCurses ncurses
+  ++ lib.optional withLuaJIT luajit
+  ++ lib.optional withUnwind libunwind
+  ++ lib.optional withMaxmindDB libmaxminddb;
+
+  outputs = [ "out" "man" ];
+
+  postPatch = ''
+    patchShebangs \
+      iocore/aio/test_AIO.sample \
+      src/traffic_via/test_traffic_via \
+      src/traffic_logstats/tests \
+      tools/check-unused-dependencies
+
+    substituteInPlace configure --replace '/usr/bin/file' '${file}/bin/file'
+  '' + lib.optionalString stdenv.isLinux ''
+    substituteInPlace configure \
+      --replace '/usr/include/linux' '${linuxHeaders}/include/linux'
+  '' + lib.optionalString stdenv.isDarwin ''
+    # 'xcrun leaks' probably requires non-free XCode
+    substituteInPlace iocore/net/test_certlookup.cc \
+      --replace 'xcrun leaks' 'true'
+  '';
+
+  configureFlags = [
+    "--enable-layout=NixOS"
+    "--enable-experimental-plugins"
+    (lib.enableFeature enableWCCP "wccp")
+
+    # the configure script can't auto-locate the following from buildInputs
+    "--with-lzma=${xz.dev}"
+    "--with-zlib=${zlib.dev}"
+    (lib.withFeatureAs withHiredis "hiredis" hiredis)
+  ];
+
+  installFlags = [
+    "pkgsysconfdir=${placeholder "out"}/etc/trafficserver"
+
+    # replace runtime directories with an install-time placeholder directory
+    "pkgcachedir=${placeholder "out"}/.install-trafficserver"
+    "pkglocalstatedir=${placeholder "out"}/.install-trafficserver"
+    "pkglogdir=${placeholder "out"}/.install-trafficserver"
+    "pkgruntimedir=${placeholder "out"}/.install-trafficserver"
+  ];
+
+  postInstall = ''
+    substituteInPlace rc/trafficserver.service --replace "syslog.target" ""
+    install -Dm644 rc/trafficserver.service $out/lib/systemd/system/trafficserver.service
+
+    wrapProgram $out/bin/tspush \
+      --set PERL5LIB '${with perlPackages; makePerlPath [ URI ]}' \
+      --prefix PATH : "${lib.makeBinPath [ file ]}"
+
+    find "$out" -name '*.la' -delete
+
+    # ensure no files actually exist in this directory
+    rmdir $out/.install-trafficserver
+  '';
+
+  installCheckPhase = let
+    expected = ''
+      Via header is [uScMsEf p eC:t cCMp sF], Length is 22
+      Via Header Details:
+      Request headers received from client                   :simple request (not conditional)
+      Result of Traffic Server cache lookup for URL          :miss (a cache "MISS")
+      Response information received from origin server       :error in response
+      Result of document write-to-cache:                     :no cache write performed
+      Proxy operation result                                 :unknown
+      Error codes (if any)                                   :connection to server failed
+      Tunnel info                                            :no tunneling
+      Cache Type                                             :cache
+      Cache Lookup Result                                    :cache miss (url not in cache)
+      Parent proxy connection status                         :no parent proxy or unknown
+      Origin server connection status                        :connection open failed
+    '';
+  in ''
+    runHook preInstallCheck
+    diff -Naur <($out/bin/traffic_via '[uScMsEf p eC:t cCMp sF]') - <<EOF
+    ${lib.removeSuffix "\n" expected}
+    EOF
+    runHook postInstallCheck
+  '';
+
+  doCheck = true;
+  doInstallCheck = true;
+  enableParallelBuilding = true;
+
+  passthru.tests = { inherit (nixosTests) trafficserver; };
+
+  meta = with lib; {
+    homepage = "https://trafficserver.apache.org";
+    changelog = "https://raw.githubusercontent.com/apache/trafficserver/${version}/CHANGELOG-${version}";
+    description = "Fast, scalable, and extensible HTTP caching proxy server";
+    longDescription = ''
+      Apache Traffic Server is a high-performance web proxy cache that improves
+      network efficiency and performance by caching frequently-accessed
+      information at the edge of the network. This brings content physically
+      closer to end users, while enabling faster delivery and reduced bandwidth
+      use. Traffic Server is designed to improve content delivery for
+      enterprises, Internet service providers (ISPs), backbone providers, and
+      large intranets by maximizing existing and available bandwidth.
+    '';
+    license = licenses.asl20;
+    maintainers = with maintainers; [ midchildan joaquinito2051 ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/servers/mx-puppet-discord/default.nix
+++ b/pkgs/servers/mx-puppet-discord/default.nix
@ -0,0 +1,45 @@
+{ stdenv, fetchFromGitHub, pkgs, lib, nodejs, nodePackages, pkg-config, libjpeg
+, pixman, cairo, pango }:
+
+let
+  # No official version ever released
+  src = fetchFromGitHub {
+    owner = "matrix-discord";
+    repo = "mx-puppet-discord";
+    rev = "c17384a6a12a42a528e0b1259f8073e8db89b8f4";
+    sha256 = "1yczhfpa4qzvijcpgc2pr10s009qb6jwlfwpcbb17g2wsx6zj0c2";
+  };
+
+  myNodePackages = import ./node-composition.nix {
+    inherit pkgs nodejs;
+    inherit (stdenv.hostPlatform) system;
+  };
+
+in myNodePackages.package.override {
+  inherit src;
+  nativeBuildInputs = [ nodePackages.node-pre-gyp pkg-config ];
+  buildInputs = [ libjpeg pixman cairo pango ];
+
+  postInstall = ''
+    # Patch shebangs in node_modules, otherwise the webpack build fails with interpreter problems
+    patchShebangs --build "$out/lib/node_modules/mx-puppet-discord/node_modules/"
+    # compile Typescript sources
+    npm run build
+
+    # Make an executable to run the server
+    mkdir -p $out/bin
+    cat <<EOF > $out/bin/mx-puppet-discord
+    #!/bin/sh
+    exec ${nodejs}/bin/node $out/lib/node_modules/mx-puppet-discord/build/index.js "\$@"
+    EOF
+    chmod +x $out/bin/mx-puppet-discord
+  '';
+
+  meta = with lib; {
+    description = "A discord puppeting bridge for matrix";
+    license = licenses.asl20;
+    homepage = "https://github.com/matrix-discord/mx-puppet-discord";
+    maintainers = with maintainers; [ expipiplus1 ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/servers/mx-puppet-discord/generate.sh
+++ b/pkgs/servers/mx-puppet-discord/generate.sh
@ -0,0 +1,21 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p nodePackages.node2nix
+
+# No official release
+rev=c17384a6a12a42a528e0b1259f8073e8db89b8f4
+u=https://raw.githubusercontent.com/matrix-discord/mx-puppet-discord/$rev
+# Download package.json and package-lock.json
+curl -O $u/package.json
+curl -O $u/package-lock.json
+
+node2nix \
+  --nodejs-12 \
+  --node-env ../../development/node-packages/node-env.nix \
+  --input package.json \
+  --lock package-lock.json \
+  --output node-packages.nix \
+  --composition node-composition.nix
+
+sed -i 's|<nixpkgs>|../../..|' node-composition.nix
+
+rm -f package.json package-lock.json
--- a/pkgs/servers/mx-puppet-discord/node-composition.nix
+++ b/pkgs/servers/mx-puppet-discord/node-composition.nix
@ -0,0 +1,17 @@
+# This file has been generated by node2nix 1.9.0. Do not edit!
+
+{pkgs ? import ../../.. {
+    inherit system;
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-12_x"}:
+
+let
+  nodeEnv = import ../../development/node-packages/node-env.nix {
+    inherit (pkgs) stdenv lib python2 runCommand writeTextFile;
+    inherit pkgs nodejs;
+    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
+  };
+in
+import ./node-packages.nix {
+  inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit;
+  inherit nodeEnv;
+}
--- a/pkgs/servers/mx-puppet-discord/node-packages.nix
+++ b/pkgs/servers/mx-puppet-discord/node-packages.nix
--- a/pkgs/servers/nosql/cassandra/generic.nix
+++ b/pkgs/servers/nosql/cassandra/generic.nix
@ -1,22 +1,34 @@
-{ lib, stdenv, fetchurl, python, makeWrapper, gawk, bash, getopt, procps
-, which, jre, coreutils, nixosTests
-# generation is the attribute version suffix such as 3_11 in pkgs.cassandra_3_11
+{ lib
+, stdenv
+, fetchurl
+, python
+, makeWrapper
+, gawk
+, bash
+, getopt
+, procps
+, which
+, jre
+, coreutils
+, nixosTests
+  # generation is the attribute version suffix such as 3_11 in pkgs.cassandra_3_11
 , generation
-, version, sha256
-, extraMeta ? {}
+, version
+, sha256
+, extraMeta ? { }
 , ...
 }:

 let
  libPath = lib.makeLibraryPath [ stdenv.cc.cc ];
-  binPath = with lib; makeBinPath ([
+  binPath = lib.makeBinPath [
    bash
    getopt
    gawk
    which
    jre
    procps
-  ]);
+  ];
 in

 stdenv.mkDerivation rec {
@ -90,13 +102,14 @@ stdenv.mkDerivation rec {
    wrapProgram $out/bin/cqlsh --prefix PATH : ${python}/bin

    runHook postInstall
-    '';
+  '';

  passthru = {
    tests =
      let
        test = nixosTests."cassandra_${generation}";
-      in {
+      in
+      {
        nixos =
          assert test.testPackage.version == version;
          test;
--- a/pkgs/tools/admin/rset/default.nix
+++ b/pkgs/tools/admin/rset/default.nix
@ -0,0 +1,48 @@
+{ lib, stdenv, fetchurl, coreutils, openssh, gnutar }:
+
+stdenv.mkDerivation rec {
+  pname = "rset";
+  version = "2.1";
+
+  src = fetchurl {
+    url = "https://scriptedconfiguration.org/code/${pname}-${version}.tar.gz";
+    sha256 = "0916f96afl8kcn2hpj4qhg92g2j93ycp2sb94nsz3q44sqc6ddhb";
+  };
+
+  patches = [ ./paths.patch ];
+
+  postPatch = ''
+    substituteInPlace rset.c \
+      --replace @ssh@       ${openssh}/bin/ssh \
+      --replace @miniquark@ $out/bin/miniquark \
+      --replace @rinstall@  $out/bin/rinstall \
+      --replace @rsub@      $out/bin/rsub
+
+    substituteInPlace execute.c \
+      --replace @ssh@     ${openssh}/bin/ssh \
+      --replace @ssh-add@ ${openssh}/bin/ssh-add \
+      --replace @tar@     ${gnutar}/bin/tar
+
+    substituteInPlace rutils.c \
+      --replace @install@ ${coreutils}/bin/install
+  '';
+
+  # these are to be run on the remote host,
+  # so we want to preserve the original shebang.
+  postFixup = ''
+    sed -i "1s@.*@#!/bin/sh@" $out/bin/rinstall
+    sed -i "1s@.*@#!/bin/sh@" $out/bin/rsub
+  '';
+
+  dontAddPrefix = true;
+  installFlags = [ "PREFIX=$(out)" ];
+
+  meta = with lib; {
+    homepage = "https://scriptedconfiguration.org/";
+    description = "Configure systems using any scripting language";
+    changelog = "https://github.com/eradman/rset/raw/${version}/NEWS";
+    license = licenses.isc;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ cstrahan ];
+  };
+}
--- a/pkgs/tools/admin/rset/paths.patch
+++ b/pkgs/tools/admin/rset/paths.patch
@ -0,0 +1,131 @@
+diff --git a/execute.c b/execute.c
+index be06068..3468fa7 100644
+--- a/execute.c
+++ b/execute.c
+@@ -242,7 +242,7 @@ verify_ssh_agent() {
+ 	char *output;
+ 	char *argv[32];
+ 
+-	append(argv, 0, "ssh-add", "-l", NULL);
+	append(argv, 0, "@ssh-add@", "-l", NULL);
+ 	output = cmd_pipe_stdout(argv, &error_code, &output_size);
+ 	free(output);
+ 
+@@ -282,7 +282,7 @@ start_connection(char *socket_path, Label *route_label, int http_port, const cha
+ 	}
+ 
+ 	argc = 0;
+-	argc = append(argv, argc, "ssh", "-fN", "-R", port_forwarding, "-S",
+	argc = append(argv, argc, "@ssh@", "-fN", "-R", port_forwarding, "-S",
+ 		socket_path, "-M", NULL);
+ 	if (ssh_config)
+ 		(void) append(argv, argc, "-F", ssh_config, host_name, NULL);
+@@ -292,12 +292,12 @@ start_connection(char *socket_path, Label *route_label, int http_port, const cha
+ 		return -1;
+ 
+ 	snprintf(tmp_path, sizeof(tmp_path), "mkdir " REMOTE_TMP_PATH, http_port);
+-	append(argv, 0, "ssh", "-S", socket_path, host_name, tmp_path, NULL);
+	append(argv, 0, "@ssh@", "-S", socket_path, host_name, tmp_path, NULL);
+ 	if (run(argv) != 0)
+ 		return -1;
+ 
+-	snprintf(cmd, PATH_MAX, "tar -cf - %s -C " REPLICATED_DIRECTORY " ./ | "
+-	   "exec ssh -q -S %s %s tar -xf - -C " REMOTE_TMP_PATH,
+	snprintf(cmd, PATH_MAX, "@tar@ -cf - %s -C " REPLICATED_DIRECTORY " ./ | "
+	   "exec @ssh@ -q -S %s %s tar -xf - -C " REMOTE_TMP_PATH,
+ 	    array_to_str(route_label->export_paths), socket_path, host_name,
+ 	    http_port);
+ 	if (system(cmd) != 0) {
+@@ -326,7 +326,7 @@ ssh_command_pipe(char *host_name, char *socket_path, Label *host_label, int http
+ 
+ 	/* construct ssh command */
+ 	argc = 0;
+-	argc = append(argv, argc, "ssh", "-T", "-S", socket_path, NULL);
+	argc = append(argv, argc, "@ssh@", "-T", "-S", socket_path, NULL);
+ 
+ 	(void) append(argv, argc, host_name, cmd, NULL);
+ 	return cmd_pipe_stdin(argv, host_label->content, host_label->content_size);
+@@ -344,7 +344,7 @@ ssh_command_tty(char *host_name, char *socket_path, Label *host_label, int http_
+ 	    http_port);
+ 	/* construct ssh command */
+ 	argc = 0;
+-	argc = append(argv, argc, "ssh", "-T", "-S", socket_path, NULL);
+	argc = append(argv, argc, "@ssh@", "-T", "-S", socket_path, NULL);
+ 	(void) append(argv, argc, host_name, cmd, NULL);
+ 	cmd_pipe_stdin(argv, host_label->content, host_label->content_size);
+ 
+@@ -360,7 +360,7 @@ ssh_command_tty(char *host_name, char *socket_path, Label *host_label, int http_
+ 
+ 	/* construct ssh command */
+ 	argc = 0;
+-	argc = append(argv, argc, "ssh", "-t", "-S", socket_path, NULL);
+	argc = append(argv, argc, "@ssh@", "-t", "-S", socket_path, NULL);
+ 
+ 	(void) append(argv, argc, host_name, cmd, NULL);
+ 	return run(argv);
+@@ -375,11 +375,11 @@ end_connection(char *socket_path, char *host_name, int http_port) {
+ 		return;
+ 
+ 	snprintf(tmp_path, sizeof(tmp_path), REMOTE_TMP_PATH, http_port);
+-	append(argv, 0, "ssh", "-S", socket_path, host_name, "rm", "-rf", tmp_path , NULL);
+	append(argv, 0, "@ssh@", "-S", socket_path, host_name, "rm", "-rf", tmp_path , NULL);
+ 	if (run(argv) != 0)
+ 		warn("remote tmp dir");
+ 
+-	append(argv, 0, "ssh", "-q", "-S", socket_path, "-O", "exit", host_name, NULL);
+	append(argv, 0, "@ssh@", "-q", "-S", socket_path, "-O", "exit", host_name, NULL);
+ 	if (run(argv) != 0)
+ 		warn("exec ssh -O exit");
+ }
+diff --git a/rset.c b/rset.c
+index 383fc82..9c20f65 100644
+--- a/rset.c
+++ b/rset.c
+@@ -128,10 +128,8 @@ int main(int argc, char *argv[])
+ 		hostnames[i] = argv[optind+i];
+ 	hostnames[i] = NULL;
+ 
+-	if ((rinstall_bin = findprog("rinstall")) == 0)
+-		not_found("rinstall");
+-	if ((rsub_bin = findprog("rsub")) == 0)
+-		not_found("rsub");
+  rinstall_bin = "@rinstall@";
+  rsub_bin = "@rsub@";
+ 
+ 	/* all operations must be relative to the routes file */
+ 	if (realpath(xdirname(routes_file), routes_realpath) == NULL)
+@@ -159,10 +157,9 @@ int main(int argc, char *argv[])
+ 
+ 	/* Convert http server command line into a vector */
+ 	inputstring = malloc(PATH_MAX);
+-	snprintf(inputstring, PATH_MAX, "miniquark -p %d -d " PUBLIC_DIRECTORY, http_port);
+	snprintf(inputstring, PATH_MAX, "@miniquark@ -p %d -d " PUBLIC_DIRECTORY, http_port);
+ 	str_to_array(http_srv_argv, inputstring, sizeof(http_srv_argv));
+-	if ((httpd_bin = findprog(http_srv_argv[0])) == 0)
+-		not_found(http_srv_argv[0]);
+	httpd_bin = "@miniquark@";
+ 
+ 	/* start the web server */
+ 	pipe(stdout_pipe);
+@@ -397,7 +394,7 @@ handle_exit(int sig) {
+ 		printf("caught signal %d, terminating connection to '%s'\n", sig,
+ 			hostname);
+ 		/* clean up socket and SSH connection; leaving staging dir */
+-		execlp("ssh", "ssh", "-S", socket_path, "-O", "exit", hostname, NULL);
+		execlp("@ssh@", "@ssh@", "-S", socket_path, "-O", "exit", hostname, NULL);
+ 		err(1, "ssh -O exit");
+ 	}
+ }
+diff --git a/rutils.c b/rutils.c
+index 1e182d8..9aef76d 100644
+--- a/rutils.c
+++ b/rutils.c
+@@ -77,7 +77,7 @@ install_if_new(const char *src, const char *dst) {
+ 
+ 	pid = fork();
+ 	if (pid == 0) {
+-		if (execl("/usr/bin/install", "/usr/bin/install", src, dst, NULL) != -1)
+		if (execl("@install@", "@install@", src, dst, NULL) != -1)
+ 			err(1, "%s", dst);
+ 	}
+ 	waitpid(pid, &status, 0);
--- a/pkgs/tools/misc/librespeed-cli/default.nix
+++ b/pkgs/tools/misc/librespeed-cli/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "librespeed-cli";
-  version = "1.0.7";
+  version = "1.0.8";

  src = fetchFromGitHub {
    owner = "librespeed";
    repo = "speedtest-cli";
    rev = "v${version}";
-    sha256 = "03bhxx33fy1cgp83anm51fm8v079v0az0d0p785dz98jg14vzibl";
+    sha256 = "sha256-cbLuAOAGWmYj6xR2AjpwvRXrP3SXfHhjUp5MVLqC0WE=";
  };

-  vendorSha256 = "1kccxmmzbkzbrxypcrz0j1zz51c0q1d5hh25lcpfbkm3498mj02c";
+  vendorSha256 = "sha256-psZyyySpY06J+ji+9uHUtX7Ks1hzZC3zINszYP75NfQ=";

  # Tests have additonal requirements
  doCheck = false;
--- a/pkgs/tools/networking/babeld/default.nix
+++ b/pkgs/tools/networking/babeld/default.nix
@ -1,33 +1,25 @@
-{ lib, stdenv, fetchurl, fetchpatch, nixosTests }:
+{ lib, stdenv, fetchurl, nixosTests }:

 stdenv.mkDerivation rec {
  pname = "babeld";
-  version = "1.9.2";
+  version = "1.10";

  src = fetchurl {
-    url = "http://www.pps.univ-paris-diderot.fr/~jch/software/files/${pname}-${version}.tar.gz";
-    sha256 = "01vzhrspnm4sy9ggaz9n3bfl5hy3qlynr218j3mdcddzm3h00kqm";
+    url = "https://www.irif.fr/~jch/software/files/${pname}-${version}.tar.gz";
+    sha256 = "1sld5bbig2pkcr4zrdpvfzifc6a3lc8i8kdzk5ryjh166844mxd5";
  };

-  patches = [
-    (fetchpatch {
-      # Skip kernel_setup_interface when `skip-kernel-setup` is enabled.
-      url = "https://github.com/jech/babeld/commit/f9698a5616842467ad08a5f9ed3d6fcfa2dd2898.patch";
-      sha256 = "00kj2jxsfq0pjk5wrkslyvkww57makxlwa4fd82g7g9hrgahpqwr";
-    })
-  ];
-
  preBuild = ''
    makeFlags="PREFIX=$out ETCDIR=$out/etc"
  '';

  passthru.tests.babeld = nixosTests.babeld;

-  meta = {
-    homepage = "http://www.pps.univ-paris-diderot.fr/~jch/software/babel/";
+  meta = with lib; {
+    homepage = "http://www.irif.fr/~jch/software/babel/";
    description = "Loop-avoiding distance-vector routing protocol";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ fpletz ];
-    platforms = with lib.platforms; linux;
+    license = licenses.mit;
+    maintainers = with maintainers; [ fpletz hexa ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/tools/security/rage/default.nix
+++ b/pkgs/tools/security/rage/default.nix
@ -1,24 +1,25 @@
 { lib, stdenv, rustPlatform, fetchFromGitHub, installShellFiles
-, Foundation, Security }:
+, Foundation, Security, libiconv }:

 rustPlatform.buildRustPackage rec {
  pname = "rage";
-  version = "0.5.1";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "str4d";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-oYCARqG5YwKO0b73aEMLr/xzXl6xBEMCvE1HMCtMq20=";
+    sha256 = "1vag448zpjyplcjpf1ir81l8ip3yxm9vkrxffqr78zslb4k6hw2w";
  };

-  cargoSha256 = "sha256-vadXIdqfmol4thHIwpkQCn7HsXdxo0l+6CBm3QIJmeA=";
+  cargoSha256 = "06jfhq9vnkq5g5bw1zl2sxsih63yajcyk9zaizhzkdsbhydr4955";

  nativeBuildInputs = [ installShellFiles ];

  buildInputs = lib.optionals stdenv.isDarwin [
    Foundation
    Security
+    libiconv
  ];

  # cargo test has an x86-only dependency
@ -37,7 +38,7 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "A simple, secure and modern encryption tool with small explicit keys, no config options, and UNIX-style composability";
    homepage = "https://github.com/str4d/rage";
-    changelog = "https://github.com/str4d/rage/releases/tag/v${version}";
+    changelog = "https://github.com/str4d/rage/raw/v${version}/rage/CHANGELOG.md";
    license = with licenses; [ asl20 mit ]; # either at your option
    maintainers = with maintainers; [ marsam ryantm ];
  };
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -251,6 +251,8 @@ in

  eclipse-mat = callPackage ../development/tools/eclipse-mat { };

+  frugal = callPackage ../development/tools/frugal { };
+
  glade = callPackage ../development/tools/glade { };

  hobbes = callPackage ../development/tools/hobbes { };
@ -1228,6 +1230,10 @@ in

  btrfs-heatmap = callPackage ../tools/filesystems/btrfs-heatmap { };

+  bucklespring = bucklespring-x11;
+  bucklespring-libinput = callPackage ../applications/audio/bucklespring { };
+  bucklespring-x11 = callPackage ../applications/audio/bucklespring { legacy = true; };
+
  buildbot = with python3Packages; toPythonApplication buildbot;
  buildbot-ui = with python3Packages; toPythonApplication buildbot-ui;
  buildbot-full = with python3Packages; toPythonApplication buildbot-full;
@ -6175,6 +6181,8 @@ in

  multitail = callPackage ../tools/misc/multitail { };

+  mx-puppet-discord = callPackage ../servers/mx-puppet-discord { };
+
  mxt-app = callPackage ../misc/mxt-app { };

  naabu = callPackage ../tools/security/naabu { };
@ -8096,6 +8104,8 @@ in

  rrdtool = callPackage ../tools/misc/rrdtool { };

+  rset = callPackage ../tools/admin/rset { };
+
  rshijack = callPackage ../tools/networking/rshijack { };

  rsibreak = libsForQt5.callPackage ../applications/misc/rsibreak { };
@ -14048,6 +14058,8 @@ in

  cimg = callPackage  ../development/libraries/cimg { };

+  cjose = callPackage ../development/libraries/cjose { };
+
  scmccid = callPackage ../development/libraries/scmccid { };

  ccrtp = callPackage ../development/libraries/ccrtp { };
@ -19420,6 +19432,8 @@ in

  thanos = callPackage ../servers/monitoring/thanos { };

+  trafficserver = callPackage ../servers/http/trafficserver { };
+
  inherit (callPackages ../servers/http/tomcat { })
    tomcat7
    tomcat8
@ -23584,7 +23598,7 @@ in

  googleearth = callPackage ../applications/misc/googleearth { };

-  googleearth-pro = callPackage ../applications/misc/googleearth-pro { };
+  googleearth-pro = libsForQt5.callPackage ../applications/misc/googleearth-pro { };

  google-chrome = callPackage ../applications/networking/browsers/google-chrome { gconf = gnome2.GConf; };

--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@ -122,9 +122,7 @@ in rec {
  coqPackages_8_11 = mkCoqPackages coq_8_11;
  coqPackages_8_12 = mkCoqPackages coq_8_12;
  coqPackages_8_13 = mkCoqPackages coq_8_13;
-  coqPackages = recurseIntoAttrs (lib.mapDerivationAttrset lib.dontDistribute
-    coqPackages_8_11
-  );
+  coqPackages = recurseIntoAttrs coqPackages_8_11;
  coq = coqPackages.coq;

 }
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -10673,6 +10673,16 @@ let
      sha256 = "0skm22b3gg1bfk0amklrprpva41m6mkrhqp0gi7z1nmcf9ypjh61";
    };

+    patches = [
+      # Unfortunately, not every release is uploaded to CPAN so security fixes
+      # would need to be cherry-picked from releases
+      (fetchpatch {
+        name = "CVE-2021-22204.patch";
+        url = "https://salsa.debian.org/perl-team/modules/packages/libimage-exiftool-perl/-/raw/0347501fda93cb8366d6451aedcf258b34fb4a2b/debian/patches/CVE-2021-22204.patch";
+        sha256 = "1fxw32zcssillnv764wsd05lyswn8bbrc90q5cy9aknx0ncgsrxj";
+      })
+    ];
+
    nativeBuildInputs = lib.optional stdenv.isDarwin shortenPerlShebang;
    postInstall = lib.optionalString stdenv.isDarwin ''
      shortenPerlShebang $out/bin/exiftool
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -615,6 +615,8 @@ in {

  autograd = callPackage ../development/python-modules/autograd { };

+  autoit-ripper = callPackage ../development/python-modules/autoit-ripper { };
+
  autologging = callPackage ../development/python-modules/autologging { };

  automat = callPackage ../development/python-modules/automat { };
@ -3565,6 +3567,8 @@ in {

  karton-asciimagic = callPackage ../development/python-modules/karton-asciimagic { };

+  karton-autoit-ripper = callPackage ../development/python-modules/karton-autoit-ripper { };
+
  karton-classifier = callPackage ../development/python-modules/karton-classifier { };

  karton-config-extractor = callPackage ../development/python-modules/karton-config-extractor { };
@ -5077,7 +5081,7 @@ in {
  poolsense = callPackage ../development/python-modules/poolsense { };

  poppler-qt5 = callPackage ../development/python-modules/poppler-qt5 {
-    inherit (pkgs.qt5) qtbase;
+    inherit (pkgs.qt5) qtbase qmake;
    inherit (pkgs.libsForQt5) poppler;
  };