Merge master into haskell-updates

2023-02-10 00:13:57 +00:00 · 2023-02-10 00:13:57 +00:00 · 3eecda0ad6
commit 3eecda0ad6
parent 40a581bcc2 46288cd92e
176 changed files with 2320 additions and 1133 deletions
--- a/doc/builders/images.xml
+++ b/doc/builders/images.xml
@ -11,4 +11,5 @@
 <xi:include href="images/snaptools.section.xml" />
 <xi:include href="images/portableservice.section.xml" />
 <xi:include href="images/makediskimage.section.xml" />
+ <xi:include href="images/binarycache.section.xml" />
 </chapter>
--- a/doc/builders/images/binarycache.section.md
+++ b/doc/builders/images/binarycache.section.md
@ -0,0 +1,49 @@
+# pkgs.mkBinaryCache {#sec-pkgs-binary-cache}
+
+`pkgs.mkBinaryCache` is a function for creating Nix flat-file binary caches. Such a cache exists as a directory on disk, and can be used as a Nix substituter by passing `--substituter file:///path/to/cache` to Nix commands.
+
+Nix packages are most commonly shared between machines using [HTTP, SSH, or S3](https://nixos.org/manual/nix/stable/package-management/sharing-packages.html), but a flat-file binary cache can still be useful in some situations. For example, you can copy it directly to another machine, or make it available on a network file system. It can also be a convenient way to make some Nix packages available inside a container via bind-mounting.
+
+Note that this function is meant for advanced use-cases. The more idiomatic way to work with flat-file binary caches is via the [nix-copy-closure](https://nixos.org/manual/nix/stable/command-ref/nix-copy-closure.html) command. You may also want to consider [dockerTools](#sec-pkgs-dockerTools) for your containerization needs.
+
+## Example
+
+The following derivation will construct a flat-file binary cache containing the closure of `hello`.
+
+```nix
+mkBinaryCache {
+  rootPaths = [hello];
+}
+```
+
+- `rootPaths` specifies a list of root derivations. The transitive closure of these derivations' outputs will be copied into the cache.
+
+Here's an example of building and using the cache.
+
+Build the cache on one machine, `host1`:
+
+```shellSession
+nix-build -E 'with import <nixpkgs> {}; mkBinaryCache { rootPaths = [hello]; }'
+```
+
+```shellSession
+/nix/store/cc0562q828rnjqjyfj23d5q162gb424g-binary-cache
+```
+
+Copy the resulting directory to the other machine, `host2`:
+
+```shellSession
+scp result host2:/tmp/hello-cache
+```
+
+Substitute the derivation using the flat-file binary cache on the other machine, `host2`:
+```shellSession
+nix-build -A hello '<nixpkgs>' \
+  --option require-sigs false \
+  --option trusted-substituters file:///tmp/hello-cache \
+  --option substituters file:///tmp/hello-cache
+```
+
+```shellSession
+/nix/store/gl5a41azbpsadfkfmbilh9yk40dh5dl0-hello-2.12.1
+```
--- a/lib/options.nix
+++ b/lib/options.nix
@ -36,6 +36,9 @@ let
  inherit (lib.types)
    mkOptionType
    ;
+  prioritySuggestion = ''
+   Use `lib.mkForce value` or `lib.mkDefault value` to change the priority on any of these definitions.
+  '';
 in
 rec {

@ -184,7 +187,7 @@ rec {
    if length defs == 1
    then (head defs).value
    else assert length defs > 1;
-      throw "The option `${showOption loc}' is defined multiple times.\n${message}\nDefinition values:${showDefs defs}";
+      throw "The option `${showOption loc}' is defined multiple times while it's expected to be unique.\n${message}\nDefinition values:${showDefs defs}\n${prioritySuggestion}";

  /* "Merge" option definitions by checking that they all have the same value. */
  mergeEqualOption = loc: defs:
@ -195,7 +198,7 @@ rec {
    else if length defs == 1 then (head defs).value
    else (foldl' (first: def:
      if def.value != first.value then
-        throw "The option `${showOption loc}' has conflicting definition values:${showDefs [ first def ]}"
+        throw "The option `${showOption loc}' has conflicting definition values:${showDefs [ first def ]}\n${prioritySuggestion}"
      else
        first) (head defs) (tail defs)).value;

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -5263,6 +5263,15 @@
    githubId = 313929;
    name = "Gabriel Ebner";
  };
+  genericnerdyusername = {
+    name = "GenericNerdyUsername";
+    email = "genericnerdyusername@proton.me";
+    github = "GenericNerdyUsername";
+    githubId = 111183546;
+    keys = [{
+      fingerprint = "58CE D4BE 6B10 149E DA80  A990 2F48 6356 A4CB 30F3";
+    }];
+  };
  genofire = {
    name = "genofire";
    email = "geno+dev@fireorbit.de";
@ -14419,6 +14428,12 @@
    githubId = 139251;
    name = "Tom Hunger";
  };
+  tehmatt = {
+    name = "tehmatt";
+    email = "nix@programsareproofs.com";
+    github = "tehmatt";
+    githubId = 3358866;
+  };
  tejasag = {
    name = "Tejas Agarwal";
    email = "tejasagarwalbly@gmail.com";
@ -16099,6 +16114,12 @@
    githubId = 2242427;
    name = "Yoann Ono";
  };
+  yajo = {
+    email = "yajo.sk8@gmail.com";
+    github = "yajo";
+    githubId = 973709;
+    name = "Jairo Llopis";
+  };
  yana = {
    email = "yana@riseup.net";
    github = "yanalunaterra";
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -510,6 +510,7 @@ in
      #seeks = 148; # removed 2020-06-21
      prosody = 149;
      i2pd = 150;
+      systemd-coredump = 151;
      systemd-network = 152;
      systemd-resolve = 153;
      systemd-timesync = 154;
--- a/nixos/modules/services/audio/ympd.nix
+++ b/nixos/modules/services/audio/ympd.nix
@ -48,8 +48,46 @@ in {

    systemd.services.ympd = {
      description = "Standalone MPD Web GUI written in C";
+
      wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${pkgs.ympd}/bin/ympd --host ${cfg.mpd.host} --port ${toString cfg.mpd.port} --webport ${toString cfg.webPort} --user nobody";
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        ExecStart = ''
+          ${pkgs.ympd}/bin/ympd \
+            --host ${cfg.mpd.host} \
+            --port ${toString cfg.mpd.port} \
+            --webport ${toString cfg.webPort}
+        '';
+
+        DynamicUser = true;
+        NoNewPrivileges = true;
+
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ProtectHome = "tmpfs";
+
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateIPC = true;
+
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+
+        SystemCallFilter = [
+          "@system-service"
+          "~@process"
+          "~@setuid"
+        ];
+      };
    };

  };
--- a/nixos/modules/services/web-servers/caddy/default.nix
+++ b/nixos/modules/services/web-servers/caddy/default.nix
@ -35,7 +35,8 @@ let

      Caddyfile-formatted = pkgs.runCommand "Caddyfile-formatted" { nativeBuildInputs = [ cfg.package ]; } ''
        mkdir -p $out
-        ${cfg.package}/bin/caddy fmt ${Caddyfile}/Caddyfile > $out/Caddyfile
+        cp --no-preserve=mode ${Caddyfile}/Caddyfile $out/Caddyfile
+        caddy fmt --overwrite $out/Caddyfile
      '';
    in
      "${if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform then Caddyfile-formatted else Caddyfile}/Caddyfile";
--- a/nixos/modules/system/boot/systemd/coredump.nix
+++ b/nixos/modules/system/boot/systemd/coredump.nix
@ -66,7 +66,9 @@ in {
        uid = config.ids.uids.systemd-coredump;
        group = "systemd-coredump";
      };
-      users.groups.systemd-coredump = {};
+      users.groups.systemd-coredump = {
+        gid = config.ids.gids.systemd-coredump;
+      };
    })

    (mkIf (!cfg.enable) {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -92,6 +92,7 @@ in {
  bcachefs = handleTestOn ["x86_64-linux" "aarch64-linux"] ./bcachefs.nix {};
  beanstalkd = handleTest ./beanstalkd.nix {};
  bees = handleTest ./bees.nix {};
+  binary-cache = handleTest ./binary-cache.nix {};
  bind = handleTest ./bind.nix {};
  bird = handleTest ./bird.nix {};
  bitcoind = handleTest ./bitcoind.nix {};
@ -520,7 +521,6 @@ in {
  peering-manager = handleTest ./web-apps/peering-manager.nix {};
  peertube = handleTestOn ["x86_64-linux"] ./web-apps/peertube.nix {};
  pgadmin4 = handleTest ./pgadmin4.nix {};
-  pgadmin4-standalone = handleTest ./pgadmin4-standalone.nix {};
  pgjwt = handleTest ./pgjwt.nix {};
  pgmanage = handleTest ./pgmanage.nix {};
  phosh = handleTest ./phosh.nix {};
--- a/nixos/tests/binary-cache.nix
+++ b/nixos/tests/binary-cache.nix
@ -0,0 +1,62 @@
+import ./make-test-python.nix ({ lib, ... }:
+
+with lib;
+
+{
+  name = "binary-cache";
+  meta.maintainers = with maintainers; [ thomasjm ];
+
+  nodes.machine =
+    { pkgs, ... }: {
+      imports = [ ../modules/installer/cd-dvd/channel.nix ];
+      environment.systemPackages = with pkgs; [python3];
+      system.extraDependencies = with pkgs; [hello.inputDerivation];
+      nix.extraOptions = ''
+        experimental-features = nix-command
+      '';
+    };
+
+  testScript = ''
+    # Build the cache, then remove it from the store
+    cachePath = machine.succeed("nix-build --no-out-link -E 'with import <nixpkgs> {}; mkBinaryCache { rootPaths = [hello]; }'").strip()
+    machine.succeed("cp -r %s/. /tmp/cache" % cachePath)
+    machine.succeed("nix-store --delete " + cachePath)
+
+    # Sanity test of cache structure
+    status, stdout = machine.execute("ls /tmp/cache")
+    cache_files = stdout.split()
+    assert ("nix-cache-info" in cache_files)
+    assert ("nar" in cache_files)
+
+    # Nix store ping should work
+    machine.succeed("nix store ping --store file:///tmp/cache")
+
+    # Cache should contain a .narinfo referring to "hello"
+    grepLogs = machine.succeed("grep -l 'StorePath: /nix/store/[[:alnum:]]*-hello-.*' /tmp/cache/*.narinfo")
+
+    # Get the store path referenced by the .narinfo
+    narInfoFile = grepLogs.strip()
+    narInfoContents = machine.succeed("cat " + narInfoFile)
+    import re
+    match = re.match(r"^StorePath: (/nix/store/[a-z0-9]*-hello-.*)$", narInfoContents, re.MULTILINE)
+    if not match: raise Exception("Couldn't find hello store path in cache")
+    storePath = match[1]
+
+    # Delete the store path
+    machine.succeed("nix-store --delete " + storePath)
+    machine.succeed("[ ! -d %s ] || exit 1" % storePath)
+
+    # Should be able to build hello using the cache
+    logs = machine.succeed("nix-build -A hello '<nixpkgs>' --option require-sigs false --option trusted-substituters file:///tmp/cache --option substituters file:///tmp/cache 2>&1")
+    logLines = logs.split("\n")
+    if not "this path will be fetched" in logLines[0]: raise Exception("Unexpected first log line")
+    def shouldBe(got, desired):
+      if got != desired: raise Exception("Expected '%s' but got '%s'" % (desired, got))
+    shouldBe(logLines[1], "  " + storePath)
+    shouldBe(logLines[2], "copying path '%s' from 'file:///tmp/cache'..." % storePath)
+    shouldBe(logLines[3], storePath)
+
+    # Store path should exist in the store now
+    machine.succeed("[ -d %s ] || exit 1" % storePath)
+  '';
+})
--- a/nixos/tests/pgadmin4-standalone.nix
+++ b/nixos/tests/pgadmin4-standalone.nix
@ -1,43 +0,0 @@
-import ./make-test-python.nix ({ pkgs, lib, ... }:
-  # This is separate from pgadmin4 since we don't want both running at once
-
-  {
-    name = "pgadmin4-standalone";
-    meta.maintainers = with lib.maintainers; [ mkg20001 ];
-
-    nodes.machine = { pkgs, ... }: {
-      environment.systemPackages = with pkgs; [
-        curl
-      ];
-
-      services.postgresql = {
-        enable = true;
-
-        authentication = ''
-          host    all             all             localhost               trust
-        '';
-
-        ensureUsers = [
-          {
-            name = "postgres";
-            ensurePermissions = {
-              "DATABASE \"postgres\"" = "ALL PRIVILEGES";
-            };
-          }
-        ];
-      };
-
-      services.pgadmin = {
-        enable = true;
-        initialEmail = "bruh@localhost.de";
-        initialPasswordFile = pkgs.writeText "pw" "bruh2012!";
-      };
-    };
-
-    testScript = ''
-      machine.wait_for_unit("postgresql")
-      machine.wait_for_unit("pgadmin")
-
-      machine.wait_until_succeeds("curl -s localhost:5050")
-    '';
-  })
--- a/nixos/tests/pgadmin4.nix
+++ b/nixos/tests/pgadmin4.nix
@ -1,56 +1,18 @@
-import ./make-test-python.nix ({ pkgs, lib, buildDeps ? [ ], pythonEnv ? [ ], ... }:
+import ./make-test-python.nix ({ pkgs, lib, ... }:

-/*
-  This test suite replaces the typical pytestCheckHook function in python
-  packages. Pgadmin4 test suite needs a running and configured postgresql
-  server. This is why this test exists.
-
-  To not repeat all the python dependencies needed, this test is called directly
-  from the pgadmin4 derivation, which also passes the currently
-  used propagatedBuildInputs and any python overrides.
-
-  Unfortunately, there doesn't seem to be an easy way to otherwise include
-  the needed packages here.
-
-  Due the the needed parameters a direct call to "nixosTests.pgadmin4" fails
-  and needs to be called as "pgadmin4.tests"
-
-  */
-
-let
-  pgadmin4SrcDir = "/pgadmin";
-  pgadmin4Dir = "/var/lib/pgadmin";
-  pgadmin4LogDir = "/var/log/pgadmin";
-
-in
 {
  name = "pgadmin4";
-  meta.maintainers = with lib.maintainers; [ gador ];
+  meta.maintainers = with lib.maintainers; [ mkg20001 gador ];

  nodes.machine = { pkgs, ... }: {
-    imports = [ ./common/x11.nix ];
-    # needed because pgadmin 6.8 will fail, if those dependencies get updated
-    nixpkgs.overlays = [
-      (self: super: {
-        pythonPackages = pythonEnv;
-      })
-    ];
+
+    imports = [ ./common/user-account.nix ];

    environment.systemPackages = with pkgs; [
-      pgadmin4
-      postgresql
-      chromedriver
-      chromium
-      # include the same packages as in pgadmin minus speaklater3
-      (python3.withPackages
-        (ps: buildDeps ++
-          [
-            # test suite package requirements
-            pythonPackages.testscenarios
-            pythonPackages.selenium
-          ])
-      )
+      curl
+      pgadmin4-desktopmode
    ];
+
    services.postgresql = {
      enable = true;
      authentication = ''
@ -65,75 +27,31 @@ in
        }
      ];
    };
+
+    services.pgadmin = {
+      port = 5051;
+      enable = true;
+      initialEmail = "bruh@localhost.de";
+      initialPasswordFile = pkgs.writeText "pw" "bruh2012!";
+    };
  };

  testScript = ''
-    machine.wait_for_unit("postgresql")
+    with subtest("Check pgadmin module"):
+      machine.wait_for_unit("postgresql")
+      machine.wait_for_unit("pgadmin")
+      machine.wait_until_succeeds("curl -s localhost:5051")
+      machine.wait_until_succeeds("curl -s localhost:5051/login | grep \"<title>pgAdmin 4</title>\" > /dev/null")

-    # pgadmin4 needs its data and log directories
-    machine.succeed(
-        "mkdir -p ${pgadmin4Dir} \
-        && mkdir -p ${pgadmin4LogDir} \
-        && mkdir -p ${pgadmin4SrcDir}"
-    )
-
-    machine.succeed(
-         "tar xvzf ${pkgs.pgadmin4.src} -C ${pgadmin4SrcDir}"
-    )
-
-    machine.wait_for_file("${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version}/README.md")
-
-    # set paths and config for tests
-    # also ensure Server Mode is set to false, which will automatically exclude some unnecessary tests.
-    # see https://github.com/pgadmin-org/pgadmin4/blob/fd1c26408bbf154fa455a49ee5c12895933833a3/web/regression/runtests.py#L217-L226
-    machine.succeed(
-        "cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version} \
-        && cp -v web/regression/test_config.json.in web/regression/test_config.json \
-        && sed -i 's|PostgreSQL 9.4|PostgreSQL|' web/regression/test_config.json \
-        && sed -i 's|/opt/PostgreSQL/9.4/bin/|${pkgs.postgresql}/bin|' web/regression/test_config.json \
-        && sed -i 's|\"headless_chrome\": false|\"headless_chrome\": true|' web/regression/test_config.json \
-        && sed -i 's|builtins.SERVER_MODE = None|builtins.SERVER_MODE = False|' web/regression/runtests.py"
-    )
-
-    # adapt chrome config to run within a sandbox without GUI
-    # see https://stackoverflow.com/questions/50642308/webdriverexception-unknown-error-devtoolsactiveport-file-doesnt-exist-while-t#50642913
-    # add chrome binary path. use spaces to satisfy python indention (tabs throw an error)
-    machine.succeed(
-         "cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version} \
-         && sed -i '\|options.add_argument(\"--disable-infobars\")|a \ \ \ \ \ \ \ \ options.binary_location = \"${pkgs.chromium}/bin/chromium\"' web/regression/runtests.py \
-         && sed -i '\|options.add_argument(\"--no-sandbox\")|a \ \ \ \ \ \ \ \ options.add_argument(\"--headless\")' web/regression/runtests.py \
-         && sed -i '\|options.add_argument(\"--disable-infobars\")|a \ \ \ \ \ \ \ \ options.add_argument(\"--disable-dev-shm-usage\")' web/regression/runtests.py \
-         && sed -i 's|(chrome_options=options)|(executable_path=\"${pkgs.chromedriver}/bin/chromedriver\", chrome_options=options)|' web/regression/runtests.py \
-         && sed -i 's|driver_local.maximize_window()||' web/regression/runtests.py"
-    )
-
-    # don't bother to test kerberos authentication
-    excluded_tests = [ "browser.tests.test_kerberos_with_mocking",
-                       ]
-
-    with subtest("run browser test"):
-        machine.succeed(
-             'cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version}/web \
-             && python regression/runtests.py \
-             --pkg browser \
-             --exclude ' + ','.join(excluded_tests)
-        )
-
-    with subtest("run resql test"):
-      machine.succeed(
-           'cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version}/web \
-           && python regression/runtests.py --pkg resql'
-      )
-
-    # fontconfig is necessary for chromium to run
-    # https://github.com/NixOS/nixpkgs/issues/136207
-    # also, the feature_tests require Server Mode = True
-    with subtest("run feature test"):
-       machine.succeed(
-           'cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version}/web \
-            && export FONTCONFIG_FILE=${pkgs.makeFontsConf { fontDirectories = [];}} \
-            && sed -i \'s|builtins.SERVER_MODE = False|builtins.SERVER_MODE = True|\' regression/runtests.py \
-            && python regression/runtests.py --pkg feature_tests'
-       )
+    # pgadmin4 module saves the configuration to /etc/pgadmin/config_system.py
+    # pgadmin4-desktopmode tries to read that as well. This normally fails with a PermissionError, as the config file
+    # is owned by the user of the pgadmin module. With the check-system-config-dir.patch this will just throw a warning
+    # but will continue and not read the file.
+    # If we run pgadmin4-desktopmode as root (something one really shouldn't do), it can read the config file and fail,
+    # because of the wrong config for desktopmode.
+    with subtest("Check pgadmin standalone desktop mode"):
+      machine.execute("sudo -u alice pgadmin4 >&2 &", timeout=60)
+      machine.wait_until_succeeds("curl -s localhost:5050")
+      machine.wait_until_succeeds("curl -s localhost:5050/browser/ | grep \"<title>pgAdmin 4</title>\" > /dev/null")
  '';
 })
--- a/pkgs/applications/audio/flac2all/default.nix
+++ b/pkgs/applications/audio/flac2all/default.nix
@ -0,0 +1,45 @@
+{ python3Packages, lib, flac, lame, opusTools, vorbis-tools, ffmpeg }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "flac2all";
+  version = "5.1";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "OBjlr7cbSx2WOIfZUNwHy5Hpb2Fmh3vmZdc70JiWsiI=";
+  };
+
+  # Not sure why this is needed, but setup.py expects this to be set
+  postPatch = ''
+    echo ${version} > ./flac2all_pkg/version
+  '';
+
+  propagatedBuildInputs = [
+    python3Packages.pyzmq
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/flac2all \
+      --set PATH ${lib.makeBinPath [
+        # Hard requirements
+        flac
+        lame
+        # Optional deps depending on encoding types
+        opusTools
+        vorbis-tools
+        ffmpeg
+      ]}
+  '';
+
+  # Has no standard tests, so we verify a few imports instead.
+  doCheck = false;
+  pythonImportsCheck = [ "flac2all_pkg.vorbis" "flac2all_pkg.mp3" ];
+
+  meta = with lib; {
+    description = "Multi process, clustered, FLAC to multi codec audio converter with tagging support";
+    homepage = "https://github.com/ZivaVatra/flac2all";
+    license = licenses.gpl3;
+    # TODO: This has only been tested on Linux, but may work on Mac too.
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/audio/pocket-casts/default.nix
+++ b/pkgs/applications/audio/pocket-casts/default.nix
@ -1,57 +1,59 @@
-{ lib, stdenv, fetchurl, dpkg, autoPatchelfHook, makeWrapper, electron
-, alsa-lib, gtk3, libXScrnSaver, libXtst, mesa, nss }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, electron
+, copyDesktopItems
+, makeDesktopItem
+, makeWrapper
+}:

 stdenv.mkDerivation rec {
  pname = "pocket-casts";
  version = "0.6.0";

-  src = fetchurl {
-    url = "https://github.com/felicianotech/pocket-casts-desktop-app/releases/download/v${version}/${pname}_${version}_amd64.deb";
-    sha256 = "sha256-nHdF9RDOkM9HwwmK/axiIPM4nmKrWp/FHNC/EI1vTTc=";
+  src = fetchFromGitHub {
+    owner = "felicianotech";
+    repo = "pocket-casts-desktop-app";
+    rev = "v${version}";
+    sha256 = "sha256-WMv2G4b7kYnWy0pz8YyI2eTdefs1mtWau+HQLiRygjE=";
  };

-  nativeBuildInputs = [
-    dpkg
-    autoPatchelfHook
-    makeWrapper
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      desktopName = "Pocket Casts";
+      genericName = "Podcasts Listener";
+      exec = "pocket-casts";
+      icon = "pocket-casts";
+      comment = meta.description;
+    })
  ];

-  buildInputs = [ alsa-lib gtk3 libXScrnSaver libXtst mesa nss ];
-
-  unpackCmd = ''
-    # If unpacking using -x option, there is a permission error
-    dpkg-deb --fsys-tarfile $src | tar -x --no-same-permissions --no-same-owner;
-  '';
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+  ];

  installPhase = ''
    runHook preInstall

-    mkdir -p $out
-    mv bin $out
-    mv lib $out
-    mv share $out
+    mkdir -p $out/bin $out/opt/pocket-casts $out/share/pixmaps

-    cp $out/lib/pocket-casts/resources/app/icon.png $out/share/pixmaps/pocket-casts.png
+    cp -r main.js tray-icon.png LICENSE $out/opt/pocket-casts
+    install -Dm644 icon.png $out/share/pixmaps/pocket-casts.png
+    install -Dm644 icon-x360.png $out/share/pixmaps/pocket-casts-x360.png
+
+    makeWrapper ${electron}/bin/electron $out/bin/pocket-casts \
+      --add-flags $out/opt/pocket-casts/main.js

    runHook postInstall
  '';

-  postFixup = ''
-    substituteInPlace $out/share/applications/pocket-casts.desktop \
-      --replace Name=pocket-casts "Name=Pocket Casts" \
-      --replace GenericName=pocket-casts "GenericName=Podcasts App" \
-      --replace Exec=pocket-casts Exec=$out/bin/pocket-casts
-    makeWrapper ${electron}/bin/electron \
-      $out/bin/pocket-casts \
-      --add-flags $out/lib/pocket-casts/resources/app/main.js
-  '';
-
  meta = with lib; {
    description = "Pocket Casts webapp, packaged for the Linux Desktop";
    homepage = "https://github.com/felicianotech/pocket-casts-desktop-app";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.mit;
    maintainers = with maintainers; [ wolfangaukang ];
-    platforms = [ "x86_64-linux" ];
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "praat";
-  version = "6.3.06";
+  version = "6.3.07";

  src = fetchFromGitHub {
    owner = "praat";
    repo = "praat";
    rev = "v${version}";
-    sha256 = "sha256-KwJ8ia1yQmmG+N44ipvGCbuoR2cL03STSTKzUwlDqms=";
+    sha256 = "sha256-hWR6mYD0vBJbX07D/HtFE9qwdbxMliHLCsNDXVYcm1Y=";
  };

  configurePhase = ''
--- a/pkgs/applications/audio/reaper/default.nix
+++ b/pkgs/applications/audio/reaper/default.nix
@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "reaper";
-  version = "6.73";
+  version = "6.75";

  src = fetchurl {
    url = url_for_platform version stdenv.hostPlatform.qemuArch;
    hash = {
-      x86_64-linux = "sha256-omQ2XdL4C78BQRuYKy90QlMko2XYHoVhd4X0C+Zyp8E=";
-      aarch64-linux = "sha256-XHohznrfFMHHgif4iFrpXb0FNddYiBb0gB7ZznlU834=";
+      x86_64-linux = "sha256-wtXClHL+SeuLxMROaZKZOwYnLo6MXC7lAiwCj80X0Ck=";
+      aarch64-linux = "sha256-xCkAbKzXH7E1Ud6iGsnzgZT/2Sy6qpRItYUHFF6ggpQ=";
    }.${stdenv.hostPlatform.system};
  };

--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@ -6,13 +6,13 @@

 buildDotnetModule rec {
  pname = "btcpayserver";
-  version = "1.7.5";
+  version = "1.7.7";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-xycNt3jzZY2a4hNv3arWLt+EfMqpFVMDHMuzOWnL7aQ=";
+    sha256 = "sha256-bflQsVaCwV5zaU5k46wFQ45dIOg3dHmYfBVQHyw+EpM=";
  };

  projectFile = "BTCPayServer/BTCPayServer.csproj";
--- a/pkgs/applications/blockchains/btcpayserver/deps.nix
+++ b/pkgs/applications/blockchains/btcpayserver/deps.nix
@ -8,15 +8,15 @@
  (fetchNuGet { pname = "AWSSDK.S3"; version = "3.3.110.10"; sha256 = "1lf1hfbx792dpa1hxgn0a0jrrvldd16hgbxx229dk2qcz5qlnc38"; })
  (fetchNuGet { pname = "BIP78.Sender"; version = "0.2.2"; sha256 = "12pm2s35c0qzc06099q2z1pxwq94rq85n74yz8fs8gwvm2ksgp4p"; })
  (fetchNuGet { pname = "BTCPayServer.Hwi"; version = "2.0.2"; sha256 = "0lh3n1qncqs4kbrmx65xs271f0d9c7irrs9qnsa9q51cbbqbljh9"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.4.18"; sha256 = "1w1h6za2mjk04njkw4hny3lx38h2m03gmvwrihj9h2rak7jf2gij"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.All"; version = "1.4.20"; sha256 = "1vnzmczd4z25vbf987p4vp6sxc09fp6mvhrvq41iwj1ks5zcprlf"; })
  (fetchNuGet { pname = "BTCPayServer.Lightning.Charge"; version = "1.3.20"; sha256 = "0nk82hkgs67mxfxkgbav8yxxd79m0xyqaan7vay00gg33pjqdjvj"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.3.24"; sha256 = "0i0lqpxx0gy9zbssjigz0vq0way88x0slyyfijsx4sasrhrbv5qs"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.CLightning"; version = "1.3.25"; sha256 = "0172czzzlgsljgmhb5wh8cb1cl12ac54qyzmd3w18wbkxmr205qk"; })
  (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.3.16"; sha256 = "1g37736b4k0ncpyy2qycbk4l85fqvgwac3k98nbdj0dvhfghp1dn"; })
  (fetchNuGet { pname = "BTCPayServer.Lightning.Common"; version = "1.3.21"; sha256 = "042xwfsxd30zgwiz0w14ynb755w5sldkplxgw1fkw68lrz66x5s4"; })
  (fetchNuGet { pname = "BTCPayServer.Lightning.Eclair"; version = "1.3.20"; sha256 = "093w82mcxxxbvx66j0sp3lsfm2bkbi3igm80iz9zdghy85845kc9"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LNBank"; version = "1.3.23"; sha256 = "036cggc386448i05s38pnhzs7qqbix6lml7j2zn84gcgk8w741gi"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LNBank"; version = "1.3.24"; sha256 = "0dah7q90x29rqhngxd9226pfn1k4bbhhfgnkpjpw64529m29cdks"; })
  (fetchNuGet { pname = "BTCPayServer.Lightning.LND"; version = "1.4.14"; sha256 = "1gzqz34lgk42kf86ldi3z0k4m9x91hlkqh6d7rq93nphl57mwqar"; })
-  (fetchNuGet { pname = "BTCPayServer.Lightning.LNDhub"; version = "1.0.16"; sha256 = "0l6pnjc6phsacwg145kwsakjpkd44jm1w53y0s166bwzpcdmljq0"; })
+  (fetchNuGet { pname = "BTCPayServer.Lightning.LNDhub"; version = "1.0.18"; sha256 = "0vnnnm9c5w8ag3a25fzmsjax028ykb7xr4fp7saq4si3bmzkjswp"; })
  (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins"; version = "1.4.4"; sha256 = "0rk0prmb0539ji5fd33cqy3yvw51i5i8m5hb43admr5z8960dd6l"; })
  (fetchNuGet { pname = "BTCPayServer.NETCore.Plugins.Mvc"; version = "1.4.4"; sha256 = "1kmmj5m7s41wc1akpqw1b1j7pp4c0vn6sqxb487980ibpj6hyisl"; })
  (fetchNuGet { pname = "CsvHelper"; version = "15.0.5"; sha256 = "01y8bhsnxghn3flz0pr11vj6wjrpmia8rpdrsp7kjfc1zmhqlgma"; })
--- a/pkgs/applications/blockchains/nbxplorer/default.nix
+++ b/pkgs/applications/blockchains/nbxplorer/default.nix
@ -6,13 +6,13 @@

 buildDotnetModule rec {
  pname = "nbxplorer";
-  version = "2.3.57";
+  version = "2.3.60";

  src = fetchFromGitHub {
    owner = "dgarage";
    repo = "NBXplorer";
    rev = "v${version}";
-    sha256 = "sha256-oLkkGdzjyvgIXi0HZiFPCShzbBR8cOgMf1h1Nf1U6Rk=";
+    sha256 = "sha256-YUZvTs77dGhG7dpxbQyGhrOMMx+8LotdMJflPflMDAE=";
  };

  projectFile = "NBXplorer/NBXplorer.csproj";
--- a/pkgs/applications/editors/texstudio/default.nix
+++ b/pkgs/applications/editors/texstudio/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "texstudio";
-  version = "4.4.1";
+  version = "4.5.1";

  src = fetchFromGitHub {
    owner = "${pname}-org";
    repo = pname;
    rev = version;
-    hash = "sha256-3w9JKX0tT5J3tJthIxJ+ZMlG8+gEeQAl9Gn+Zyjhmt4=";
+    hash = "sha256-QBPWelCqh8Ggp0IjH37QGYGu5Ya2fpsiSEkKh3Ee7PM=";
  };

  nativeBuildInputs = [ qmake wrapQtAppsHook pkg-config ];
--- a/pkgs/applications/misc/anytype/default.nix
+++ b/pkgs/applications/misc/anytype/default.nix
@ -2,13 +2,13 @@

 let
  pname = "anytype";
-  version = "0.29.1";
+  version = "0.30.0";
  name = "Anytype-${version}";
  nameExecutable = pname;
  src = fetchurl {
    url = "https://at9412003.fra1.digitaloceanspaces.com/Anytype-${version}.AppImage";
    name = "Anytype-${version}.AppImage";
-    sha256 = "sha256-NyIAOkOX9s9dN6m/5hfMhy4tSENPCDk2w/F8z+J6qqk=";
+    sha256 = "sha256-LifJc5mLbnt5wBXGM1n1uice0B6mCY80LYf3kEFJy90=";
  };
  appimageContents = appimageTools.extractType2 { inherit name src; };
 in
--- a/pkgs/applications/misc/keepass/default.nix
+++ b/pkgs/applications/misc/keepass/default.nix
@ -4,11 +4,11 @@ let
  inherit (builtins) add length readFile replaceStrings unsafeDiscardStringContext toString map;
 in buildDotnetPackage rec {
  pname = "keepass";
-  version = "2.53";
+  version = "2.53.1";

  src = fetchurl {
    url = "mirror://sourceforge/keepass/KeePass-${version}-Source.zip";
-    hash = "sha256-wpXbLH9VyjJyb+KuQ8xmbik1jq+xqAFRxsxAuLM5MI0=";
+    hash = "sha256-R7KWxlxrhl55nOaDNYwA/cJJl+kd5ZYy6eZVqyrxxnM=";
  };

  sourceRoot = ".";
--- a/pkgs/applications/misc/translate-shell/default.nix
+++ b/pkgs/applications/misc/translate-shell/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "translate-shell";
-  version = "0.9.7";
+  version = "0.9.7.1";

  src = fetchFromGitHub {
    owner = "soimort";
    repo = "translate-shell";
    rev = "v${version}";
-    sha256 = "sha256-OLbGBP+QHW51mt0sFXf6SqrIYZ0iC/X10F148NAG4A4=";
+    sha256 = "sha256-ILXE8cSrivYqMruE+xtNIInLdwdRfMX5dneY9Nn12Uk=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@ -1,38 +1,69 @@
-{ stdenv, lib, fetchFromGitHub, cmake, libuv, libmicrohttpd, openssl, hwloc
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, libuv
+, libmicrohttpd
+, openssl
+, hwloc
 , donateLevel ? 0
+, darwin
 }:

+let
+  inherit (darwin.apple_sdk_11_0.frameworks) Carbon CoreServices OpenCL;
+in
 stdenv.mkDerivation rec {
  pname = "xmrig";
-  version = "6.18.1";
+  version = "6.19.0";

  src = fetchFromGitHub {
    owner = "xmrig";
    repo = "xmrig";
    rev = "v${version}";
-    sha256 = "sha256-aTyJhPVqq3jGNVozD39RJ4n0FmAKAtPttW9ecoanEzg=";
+    hash = "sha256-pMI5SqAa9jauwWvc3JpyWQa+pQvntbTrta1p0qjBaoM=";
  };

-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ libuv libmicrohttpd openssl hwloc ];
+  patches = [
+    ./donate-level.patch
+  ];
+
+  postPatch = ''
+    substituteAllInPlace src/donate.h
+    substituteInPlace cmake/OpenSSL.cmake \
+      --replace "set(OPENSSL_USE_STATIC_LIBS TRUE)" "set(OPENSSL_USE_STATIC_LIBS FALSE)"
+  '';
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libuv
+    libmicrohttpd
+    openssl
+    hwloc
+  ] ++ lib.optionals stdenv.isDarwin [
+    Carbon
+    CoreServices
+    OpenCL
+  ];

  inherit donateLevel;

-  patches = [ ./donate-level.patch ];
-  postPatch = ''
-    substituteAllInPlace src/donate.h
-  '';
-
  installPhase = ''
+    runHook preInstall
+
    install -vD xmrig $out/bin/xmrig
+
+    runHook postInstall
  '';

  meta = with lib; {
-    broken = stdenv.isDarwin;
    description = "Monero (XMR) CPU miner";
    homepage = "https://github.com/xmrig/xmrig";
    license = licenses.gpl3Plus;
-    platforms   = [ "x86_64-linux" "x86_64-darwin" ];
+    platforms = platforms.unix;
    maintainers = with maintainers; [ kim0 ];
  };
 }
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -90,11 +90,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.47.186";
+  version = "1.48.158";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "sha256-47LkjcC+fEE+cn2m434+9fQ+N2yZSc1eF0gDO7jGfPI=";
+    sha256 = "sha256-hgV8+Mjth43KItly98lTh3Ur+h9vA9BfJxOqMGl1ndY=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -150,10 +150,10 @@ let
      libdrm wayland mesa.drivers libxkbcommon
      curl
      libepoxy
+      libffi
    ] ++ lib.optional systemdSupport systemd
      ++ lib.optionals cupsSupport [ libgcrypt cups ]
-      ++ lib.optional pulseSupport libpulseaudio
-      ++ lib.optional (chromiumVersionAtLeast "110") libffi;
+      ++ lib.optional pulseSupport libpulseaudio;

    patches = [
      # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed):
@ -293,15 +293,6 @@ let
      chrome_pgo_phase = 0;
      clang_base_path = "${llvmPackages.clang}";
      use_qt = false;
-    } // lib.optionalAttrs (!chromiumVersionAtLeast "110") {
-      # The default has changed to false. We'll build with libwayland from
-      # Nixpkgs for now but might want to eventually use the bundled libwayland
-      # as well to avoid incompatibilities (if this continues to be a problem
-      # from time to time):
-      use_system_libwayland = true;
-      # The default value is hardcoded instead of using pkg-config:
-      system_wayland_scanner_path = "${wayland.bin}/bin/wayland-scanner";
-    } // lib.optionalAttrs (chromiumVersionAtLeast "110") {
      # To fix the build as we don't provide libffi_pic.a
      # (ld.lld: error: unable to find library -l:libffi_pic.a):
      use_system_libffi = true;
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -45,19 +45,19 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "109.0.5414.120",
-    "sha256": "1yvfd0a7zfz4x00f83irrs6hy15wn85mrbbm7mk5wy4gjwg5zyrj",
+    "version": "110.0.5481.78",
+    "sha256": "1m67xfdgggaan09xsbppna209b8sm882xq587i0hsnnnzb3fdxdj",
    "sha256bin64": null,
    "deps": {
      "gn": {
-        "version": "2022-11-10",
+        "version": "2022-12-12",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "1c4151ff5c1d6fbf7fa800b8d4bb34d3abc03a41",
-        "sha256": "02621c9nqpr4pwcapy31x36l5kbyd0vdgd0wdaxj5p8hrxk67d6b"
+        "rev": "5e19d2fb166fbd4f6f32147fbb2f497091a54ad8",
+        "sha256": "1b5fwldfmkkbpp5x63n1dxv0nc965hphc8rm8ah7zg44zscm9z30"
      },
      "ungoogled-patches": {
-        "rev": "109.0.5414.120-1",
-        "sha256": "0hq48lsjl7da8rdq129mc7cd0z5ykqbaf1sbhhs1d10dzm5zs4p3"
+        "rev": "110.0.5481.78-1",
+        "sha256": "1ffb2wf1bdmzlxk4ih8qq439jzqz17f8nchvx7na52y48am1qr3c"
      }
    }
  }
--- a/pkgs/applications/networking/browsers/ladybird/default.nix
+++ b/pkgs/applications/networking/browsers/ladybird/default.nix
@ -10,28 +10,25 @@
 , nixosTests
 }:

-let serenity = fetchFromGitHub {
-  owner = "SerenityOS";
-  repo = "serenity";
-  rev = "a0f3e2c9a2b82117aa7c1a3444ad0d31baa070d5";
-  hash = "sha256-8Xde59ZfdkTD39mYSv0lfFjBHFDWTUwfozE+Q9Yq6C8=";
-};
-in
 stdenv.mkDerivation {
  pname = "ladybird";
-  version = "unstable-2022-09-29";
+  version = "unstable-2023-01-17";

-  # Remember to update `serenity` too!
  src = fetchFromGitHub {
    owner = "SerenityOS";
-    repo = "ladybird";
-    rev = "d69ad7332477de33bfd1963026e057d55c6f222d";
-    hash = "sha256-XQj2Bohk8F6dGCAManOmmDP5b/SqEeZXZbLDYPfvi2E=";
+    repo = "serenity";
+    rev = "45e85d20b64862df119f643f24e2d500c76c58f3";
+    hash = "sha256-n2mLg9wNfdMGsJuGj+ukjto9qYjGOIz4cZjgvMGQUrY=";
  };

+  sourceRoot = "source/Ladybird";
+
  postPatch = ''
    substituteInPlace CMakeLists.txt \
      --replace "MACOSX_BUNDLE TRUE" "MACOSX_BUNDLE FALSE"
+    # https://github.com/SerenityOS/serenity/issues/17062
+    substituteInPlace main.cpp \
+      --replace "./SQLServer/SQLServer" "$out/bin/SQLServer"
  '';

  nativeBuildInputs = [
@ -47,17 +44,18 @@ stdenv.mkDerivation {
  ];

  cmakeFlags = [
-    "-DSERENITY_SOURCE_DIR=${serenity}"
    # Disable network operations
    "-DENABLE_TIME_ZONE_DATABASE_DOWNLOAD=false"
    "-DENABLE_UNICODE_DATABASE_DOWNLOAD=false"
  ];

-  # error: use of undeclared identifier 'aligned_alloc'
-  NIX_CFLAGS_COMPILE = toString (lib.optionals (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinSdkVersion "11.0") [
+  NIX_CFLAGS_COMPILE = [
+    "-Wno-error"
+  ] ++ lib.optionals (stdenv.isDarwin && lib.versionOlder stdenv.targetPlatform.darwinSdkVersion "11.0") [
+    # error: use of undeclared identifier 'aligned_alloc'
    "-include mm_malloc.h"
    "-Daligned_alloc=_mm_malloc"
-  ]);
+  ];

  # https://github.com/NixOS/nixpkgs/issues/201254
  NIX_LDFLAGS = lib.optionalString (stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU) "-lgcc";
--- a/pkgs/applications/networking/cluster/arkade/default.nix
+++ b/pkgs/applications/networking/cluster/arkade/default.nix
@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "arkade";
-  version = "0.8.60";
+  version = "0.8.62";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    rev = version;
-    sha256 = "sha256-kyWUokQl5n7ko/1pdNs15WxRAAfe8KioYpkTMcLhJjU=";
+    sha256 = "sha256-lnMinIZ1n94ks7H5tlYmgaDDHyGi5YxTM9dTrckQ9y0=";
  };

  CGO_ENABLED = 0;
--- a/pkgs/applications/networking/cluster/civo/default.nix
+++ b/pkgs/applications/networking/cluster/civo/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "civo";
-  version = "1.0.47";
+  version = "1.0.48";

  src = fetchFromGitHub {
    owner  = "civo";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "sha256-iowBEtO+Ol6mFJrwLaDa88wsQB8nZEe9OFPuhbH4t1s=";
+    sha256 = "sha256-KoW+XKEFoe2QNJPu97MYYZnxbU0Wat8slJjQm/vtmew=";
  };

  vendorHash = "sha256-QzTu6/iFK+CS8UXoXSVq3OTuwk/xcHnAX4UpCU/Scpk=";
--- a/pkgs/applications/networking/cluster/glooctl/default.nix
+++ b/pkgs/applications/networking/cluster/glooctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "glooctl";
-  version = "1.13.5";
+  version = "1.13.6";

  src = fetchFromGitHub {
    owner = "solo-io";
    repo = "gloo";
    rev = "v${version}";
-    hash = "sha256-mBmjGP7O1uX+uVM4/us4RWeJcXB1lSEvZQWT/3Ygzik=";
+    hash = "sha256-CBWKKW5VIkRgl7wY63OCm/CowWHO389se3kEraqaDCI=";
  };

  subPackages = [ "projects/gloo/cli/cmd" ];
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubernetes-helm";
-  version = "3.11.0";
+  version = "3.11.1";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "sha256-Pes1p7rTO17Bef6qacsQWJkhb1CWilzmVYQe886EepU=";
+    sha256 = "sha256-TrjPpKFHMF+dPz9AqXVkYPUNWeWEeH8bA37Dpxr7b8s=";
  };
  vendorSha256 = "sha256-LRMDrBSl5EGQqQt5FUU4JJHqdwfYt5qsVpe76jUQBVI=";

--- a/pkgs/applications/networking/cluster/k3s/1_23/0001-script-download-strip-downloading-just-package-CRD.patch
+++ b/pkgs/applications/networking/cluster/k3s/1_23/0001-script-download-strip-downloading-just-package-CRD.patch
@ -1,41 +0,0 @@
-From 6f53bd36a40da4c71486e3b79f6e32d53d6eea5d Mon Sep 17 00:00:00 2001
-From: Euan Kemp <euank@euank.com>
-Date: Thu, 3 Feb 2022 23:50:40 -0800
-Subject: [PATCH 2/2] scrips/download: strip downloading, just package CRD
-
-The CRD packaging is a complicated set of commands, so let's reuse it.
---
- scripts/download | 10 ++--------
- 1 file changed, 2 insertions(+), 8 deletions(-)
-
-diff --git a/scripts/download b/scripts/download
-index 5effc0562a..82361803ee 100755
--- a/scripts/download
-+++ b/scripts/download
-@@ -24,12 +24,6 @@ rm -rf ${CONTAINERD_DIR}
- mkdir -p ${CHARTS_DIR}
- mkdir -p ${DATA_DIR}
- 
-curl --compressed -sfL https://github.com/k3s-io/k3s-root/releases/download/${VERSION_ROOT}/k3s-root-${ARCH}.tar | tar xf - --exclude=bin/socat
-
-git clone --single-branch --branch=${VERSION_RUNC} --depth=1 https://github.com/opencontainers/runc ${RUNC_DIR}
-
-git clone --single-branch --branch=${VERSION_CONTAINERD} --depth=1 https://github.com/k3s-io/containerd ${CONTAINERD_DIR}
-
- setup_tmp() {
-     TMP_DIR=$(mktemp -d --tmpdir=${CHARTS_DIR})
-     cleanup() {
-@@ -44,8 +38,8 @@ setup_tmp() {
- 
- download_and_package_traefik () {
-   echo "Downloading Traefik Helm chart from ${TRAEFIK_URL}"
-  curl -sfL ${TRAEFIK_URL} -o ${TMP_DIR}/${TRAEFIK_FILE}
-  code=$?
-+  # nixpkgs: copy in our known traefik chart instead
-+  cp $TRAEFIK_CHART_FILE ${TMP_DIR}/${TRAEFIK_FILE}
- 
-   if [ $code -ne 0 ]; then
-     echo "Error: Failed to download Traefik Helm chart!"
-- 
-2.34.1
-
--- a/pkgs/applications/networking/cluster/k3s/1_23/chart-versions.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_23/chart-versions.nix
@ -0,0 +1,10 @@
+{
+    traefik-crd  = {
+        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-20.3.1+up20.3.0.tgz";
+        sha256 = "1775vjldvqvhzdbzanxhbaqbmkih09yb91im651q8bc7z5sb9ckn";
+    };
+    traefik = {
+        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-20.3.1+up20.3.0.tgz";
+        sha256 = "1rj0f0n0vgjcbzfwzhqmsd501i2f6vw145w9plbp8gwdyzmg2nc6";
+    };
+}
--- a/pkgs/applications/networking/cluster/k3s/1_23/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_23/default.nix
@ -48,30 +48,32 @@ with lib;
 # Those pieces of software we entirely ignore upstream's handling of, and just
 # make sure they're in the path if desired.
 let
-  k3sVersion = "1.23.6+k3s1";     # k3s git tag
-  k3sCommit = "418c3fa858b69b12b9cefbcff0526f666a6236b9"; # k3s git commit at the above version
-  k3sRepoSha256 = "0fmw491dn5mpi058mr7sij51i5m4qg2grx30cnl3h2v4s0sdkx2i";
-  k3sVendorSha256 = "sha256-iHg5ySMaiSWXs98YGmxPwdZr4zdBIFma12dNEuf30Hs=";
+  k3sVersion = "1.23.16+k3s1";     # k3s git tag
+  k3sCommit = "64b0feeb36c2a26976a364a110f23ebcf971f976"; # k3s git commit at the above version
+  k3sRepoSha256 = "sha256-H6aaYa5OYAaD5hjSi8+RNXiP1zhRZCgKXQA6eU7AWBk=";
+  k3sVendorSha256 = "sha256-+xygljXp27NahsHSgoigMANBQCRwGFYwGHQEwlI9YsQ=";

-  # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
-  # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
-  traefikChartVersion = "10.19.3";
-  traefikChartSha256 = "04zg5li957svgscdmkzmzjkwljaljyav68rzxmhakkwgav6q9058";
+  # Based on the traefik charts here: https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/scripts/download#L29-L32
+  # see also https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/manifests/traefik.yaml#L8-L16
+  # At the time of writing, there are two traefik charts, and that's it
+  charts = import ./chart-versions.nix;

-  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
-  k3sRootVersion = "0.11.0";
-  k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
+  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/scripts/version.sh#L54
+  k3sRootVersion = "0.12.1";
+  k3sRootSha256 = "sha256-xCXbarWztnvW2xn3cGa84hie3OevVZeGEDWh+Uf3RBw=";

-  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
-  k3sCNIVersion = "1.0.1-k3s1";
-  k3sCNISha256 = "11ihlzzdnqf9p21y0a4ckpbxac016nm7746dcykhj26ym9zxyv92";
+  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/scripts/version.sh#L47
+  k3sCNIVersion = "1.1.1-k3s1";
+  k3sCNISha256 = "sha256-1Br7s+iMtfiPjM0EcNPuFdSlp9dVPjSG1UGuiPUfq5I=";

  # taken from go.mod, the 'github.com/containerd/containerd' line
  # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
-  containerdVersion = "1.5.11-k3s2";
-  containerdSha256 = "16132snvrg8r0vwm6c0lz0q6fx686s2ix53nm3aka9a83xs75vf2";
+  # https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/go.mod#L9
+  containerdVersion = "1.5.16-k3s2-1-22";
+  containerdSha256 = "sha256-PRrp05Jgx368Ox4hTC66lbCInWuex0OtAuCY4l8geqA=";

  # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
+  # https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/go.mod#L19
  criCtlVersion = "1.22.0-k3s1";

  baseMeta = k3s.meta;
@ -94,10 +96,9 @@ let
  ];

  # bundled into the k3s binary
-  traefikChart = fetchurl {
-    url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
-    sha256 = traefikChartSha256;
-  };
+  traefikChart = fetchurl charts.traefik;
+  traefik-crdChart = fetchurl charts.traefik-crd;
+
  # so, k3s is a complicated thing to package
  # This derivation attempts to avoid including any random binaries from the
  # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
@ -181,12 +182,13 @@ let
    postInstall = ''
      mv $out/bin/server $out/bin/k3s
      pushd $out
-      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
+      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.16%2Bk3s1/scripts/build#L123-L131
      ln -s k3s ./bin/k3s-agent
      ln -s k3s ./bin/k3s-server
      ln -s k3s ./bin/k3s-etcd-snapshot
      ln -s k3s ./bin/k3s-secrets-encrypt
      ln -s k3s ./bin/k3s-certificate
+      ln -s k3s ./bin/k3s-completion
      ln -s k3s ./bin/kubectl
      ln -s k3s ./bin/crictl
      ln -s k3s ./bin/ctr
@ -219,10 +221,6 @@ buildGoModule rec {
  src = k3sRepo;
  vendorSha256 = k3sVendorSha256;

-  patches = [
-    ./0001-script-download-strip-downloading-just-package-CRD.patch
-  ];
-
  postPatch = ''
    # Nix prefers dynamically linked binaries over static binary.

@ -290,11 +288,9 @@ buildGoModule rec {
    ln -vsf ${k3sContainerd}/bin/* ./bin/
    rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
    mkdir -p ./build/static/charts
-    # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
-    export TRAEFIK_CHART_FILE=${traefikChart}
-    # place the traefik chart using their code since it's complicated
-    # We trim the actual download, see patches
-    ./scripts/download
+
+    cp ${traefikChart} ./build/static/charts
+    cp ${traefik-crdChart} ./build/static/charts

    export ARCH=$GOARCH
    export DRONE_TAG="v${k3sVersion}"
--- a/pkgs/applications/networking/cluster/k3s/1_26/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/1_26/default.nix
@ -75,7 +75,7 @@ let
    description = "A lightweight Kubernetes distribution";
    license = licenses.asl20;
    homepage = "https://k3s.io";
-    maintainers = with maintainers; [ euank mic92 superherointj ];
+    maintainers = with maintainers; [ euank mic92 superherointj yajo ];
    platforms = platforms.linux;
  };

--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -46,11 +46,11 @@
    "vendorHash": "sha256-xIxQxgfOv+/i0gyRtpZaCm22rsK/4ajFNKQpGP5uy0Y="
  },
  "alicloud": {
-    "hash": "sha256-sG241dMkFL9YllVGuQ7KlZ8Ta3hz9v8VdyOOcjOKie0=",
+    "hash": "sha256-LFguUrrI/7gFiXwub2jTKTOI1ppLEx8M/Jka4ypgb3E=",
    "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
    "owner": "aliyun",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.197.0",
+    "rev": "v1.198.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -766,13 +766,13 @@
    "vendorHash": null
  },
  "newrelic": {
-    "hash": "sha256-lWjXsIeYpe07+kIHr8qS8SmChs0tnfzxWy/K1KNJ5oo=",
+    "hash": "sha256-OUcSegGIiXNKC5FCB9+4tnsNGiEIxBFX1UZLLwxsHwM=",
    "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
    "owner": "newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v3.13.0",
+    "rev": "v3.14.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Ptjd4A/P2pZL5wP8IGHN385jngfS56w7FN1g/EpknRw="
+    "vendorHash": "sha256-AR62fegcN9+qTuKwGbb8cEem8nsjgRQkYm3R3VNzYKA="
  },
  "nomad": {
    "hash": "sha256-oHY+jM4JQgLlE1wd+/H9H8H2g0e9ZuxI6OMlz3Izfjg=",
@ -812,11 +812,11 @@
    "vendorHash": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI="
  },
  "oci": {
-    "hash": "sha256-ecel4aXOqkPmeOzG5G/D8vmjo2HP9TG+c8H27pCYn2g=",
+    "hash": "sha256-mzAfqJcAZEFGmptjaXAtbmcrtVyufd2LLTe8TmFHtQc=",
    "homepage": "https://registry.terraform.io/providers/oracle/oci",
    "owner": "oracle",
    "repo": "terraform-provider-oci",
-    "rev": "v4.106.0",
+    "rev": "v4.107.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@ -983,13 +983,13 @@
    "vendorHash": null
  },
  "selectel": {
-    "hash": "sha256-glIvlf5lWwkdZKn4rxhR+XnBqUdu9RO+loxke07i2c0=",
+    "hash": "sha256-gZiDFcrQZsOE0R74LYwoitAjuPqPZCPLTEL3giom+c8=",
    "homepage": "https://registry.terraform.io/providers/selectel/selectel",
    "owner": "selectel",
    "repo": "terraform-provider-selectel",
-    "rev": "v3.9.0",
+    "rev": "v3.9.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-0UOC70RWcEb/YqPrrc7k+dY7jBuTZLWvUTNxuUZIyu4="
+    "vendorHash": "sha256-+Duf/wdjmw6NBhmy1KmNRJ+ZEjjwtJoXXQCw2lJzxS4="
  },
  "sentry": {
    "hash": "sha256-L/aZ4/xCVZk3C6AGglzCj5T9XnoI/uiLbRASNAHwcro=",
@ -1219,13 +1219,13 @@
    "vendorHash": null
  },
  "vsphere": {
-    "hash": "sha256-UwhIGK1zQ++IuwAKH9i+Dlu2vvXkMYL+s1P03qKSe3E=",
+    "hash": "sha256-VScIcK4bInS9yhIYkYRsU8Hhzex9iyVkPiyjnnjshkI=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/vsphere",
    "owner": "hashicorp",
    "repo": "terraform-provider-vsphere",
-    "rev": "v2.2.0",
+    "rev": "v2.3.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-160GDEQfymeCJpjYOoWP5sGQ0PJHw9kKPaefmbF5Ig4="
+    "vendorHash": "sha256-guUjkk7oW+Gvu015LUAxGqUwZF4H+4xmmOaMqKixZaI="
  },
  "vultr": {
    "hash": "sha256-DfiJgN1R7qW3c13hBabsMizY3mYamIq8AGms1q9kdVU=",
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -168,9 +168,9 @@ rec {
  mkTerraform = attrs: pluggable (generic attrs);

  terraform_1 = mkTerraform {
-    version = "1.3.7";
-    sha256 = "sha256-z49DXJ9oYObJQWHPeuKvQ6jJtAheYuy0+QmvZ74ZbTQ";
-    vendorSha256 = "sha256-fviukVGBkbxFs2fJpEp/tFMymXex7NRQdcGIIA9W88k=";
+    version = "1.3.8";
+    sha256 = "sha256-AXLk5s3qu3QZ1aXx/FwPNq3hM26skBj0wyn/x8nVMkE=";
+    vendorSha256 = "sha256-CE6jNBvM0980+R0e5brK5lMrkad+91qTt9mp2h3NZyY=";
    patches = [ ./provider-path-0_15.patch ];
    passthru = {
      inherit plugins;
--- a/pkgs/applications/networking/cluster/tfswitch/default.nix
+++ b/pkgs/applications/networking/cluster/tfswitch/default.nix
@ -1,16 +1,16 @@
 { buildGoModule, lib, fetchFromGitHub }:
 buildGoModule rec {
  pname = "tfswitch";
-  version = "0.13.1300";
+  version = "0.13.1308";

  src = fetchFromGitHub {
    owner = "warrensbox";
    repo = "terraform-switcher";
    rev = version;
-    sha256 = "sha256-btvoFllCfwQJNpRWdAB05Cu4JYmT1xynJxDbzO/6LDs=";
+    sha256 = "sha256-EyA7LwfL3vCNzd2wpyUbrUnvkM0/f7/cQp+jcAcGZsg=";
  };

-  vendorSha256 = "sha256-NX+vzI/Fa/n9ZQjpESes4fNVAmKlA1rqPwSKsL2GEUY=";
+  vendorHash = "sha256-NX+vzI/Fa/n9ZQjpESes4fNVAmKlA1rqPwSKsL2GEUY=";

  # Disable tests since it requires network access and relies on the
  # presence of release.hashicorp.com
--- a/pkgs/applications/networking/nali/default.nix
+++ b/pkgs/applications/networking/nali/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "nali";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "zu1k";
    repo = "nali";
    rev = "v${version}";
-    sha256 = "sha256-NHTS9YajVjyAjSEQxMqyyY2Hwd30pjnIthZ+1jroqTE=";
+    sha256 = "sha256-ZJnQiTcfvxHFgRNytQANs/lF4hy0S0cXOy8IuGECYi0=";
  };

-  vendorSha256 = "sha256-1sXG/xEzPVN1aRCsYqUee9aidT+ognZszOC7SR8YArw=";
+  vendorHash = "sha256-TLij88IksL0+pARKVhEhPg6qUPAXMlL2DWJk4ynahUs=";
  subPackages = [ "." ];

  meta = with lib; {
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -18,13 +18,13 @@

 buildGoModule rec {
  pname = "podman";
-  version = "4.4.0";
+  version = "4.4.1";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    rev = "v${version}";
-    sha256 = "sha256-kyeON8S7CCVdHt09wigNXDWScgyaLzC4EhOts8ViP2w=";
+    hash = "sha256-Uha5ueOGNmG2f+1I89uFQKA3pSSp1d02FGy86Fc2eWE=";
  };

  patches = [
@ -32,7 +32,7 @@ buildGoModule rec {
    ./rm-podman-mac-helper-msg.patch
  ];

-  vendorSha256 = null;
+  vendorHash = null;

  doCheck = false;

--- a/pkgs/applications/virtualization/sail-riscv/default.nix
+++ b/pkgs/applications/virtualization/sail-riscv/default.nix
@ -0,0 +1,55 @@
+{ stdenv
+, fetchFromGitHub
+, lib
+, arch
+, ocamlPackages
+, ocaml
+, zlib
+, z3
+}:
+
+
+stdenv.mkDerivation rec {
+  pname = "sail-riscv";
+  version = "0.5";
+
+  src = fetchFromGitHub {
+    owner = "riscv";
+    repo = pname;
+    rev = version;
+    hash = "sha256-7PZNNUMaCZEBf0lOCqkquewRgZPooBOjIbGF7JlLnEo=";
+  };
+
+  nativeBuildInputs = with ocamlPackages; [ ocamlbuild findlib ocaml z3 sail ];
+  buildInputs = with ocamlPackages; [ zlib linksem ];
+  strictDeps = true;
+
+  postPatch = ''
+    rm -r prover_snapshots
+  '';
+
+  makeFlags = [
+    "SAIL=sail"
+    "ARCH=${arch}"
+    "SAIL_DIR=${ocamlPackages.sail}/share/sail"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp c_emulator/riscv_sim_${arch} $out/bin
+    mkdir $out/share/
+    cp -r generated_definitions/{coq,hol4,isabelle} $out/share/
+
+    runHook postInstall
+  '';
+
+
+  meta = with lib; {
+    homepage = "https://github.com/riscv/sail-riscv";
+    description = "A formal specification of the RISC-V architecture, written in Sail";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.bsd2;
+  };
+}
--- a/pkgs/build-support/binary-cache/default.nix
+++ b/pkgs/build-support/binary-cache/default.nix
@ -0,0 +1,40 @@
+{ stdenv, buildPackages }:
+
+# This function is for creating a flat-file binary cache, i.e. the kind created by
+# nix copy --to file:///some/path and usable as a substituter (with the file:// prefix).
+
+# For example, in the Nixpkgs repo:
+# nix-build -E 'with import ./. {}; mkBinaryCache { rootPaths = [hello]; }'
+
+{ name ? "binary-cache"
+, rootPaths
+}:
+
+stdenv.mkDerivation {
+  inherit name;
+
+  __structuredAttrs = true;
+
+  exportReferencesGraph.closure = rootPaths;
+
+  preferLocalBuild = true;
+
+  PATH = "${buildPackages.coreutils}/bin:${buildPackages.jq}/bin:${buildPackages.python3}/bin:${buildPackages.nix}/bin:${buildPackages.xz}/bin";
+
+  builder = builtins.toFile "builder" ''
+    . .attrs.sh
+
+    export out=''${outputs[out]}
+
+    mkdir $out
+    mkdir $out/nar
+
+    python ${./make-binary-cache.py}
+
+    # These directories must exist, or Nix might try to create them in LocalBinaryCacheStore::init(),
+    # which fails if mounted read-only
+    mkdir $out/realisations
+    mkdir $out/debuginfo
+    mkdir $out/log
+  '';
+}
--- a/pkgs/build-support/binary-cache/make-binary-cache.py
+++ b/pkgs/build-support/binary-cache/make-binary-cache.py
@ -0,0 +1,43 @@
+
+import json
+import os
+import subprocess
+
+with open(".attrs.json", "r") as f:
+  closures = json.load(f)["closure"]
+
+os.chdir(os.environ["out"])
+
+nixPrefix = os.environ["NIX_STORE"] # Usually /nix/store
+
+with open("nix-cache-info", "w") as f:
+  f.write("StoreDir: " + nixPrefix + "\n")
+
+def dropPrefix(path):
+  return path[len(nixPrefix + "/"):]
+
+for item in closures:
+  narInfoHash = dropPrefix(item["path"]).split("-")[0]
+
+  xzFile = "nar/" + narInfoHash + ".nar.xz"
+  with open(xzFile, "w") as f:
+    subprocess.run("nix-store --dump %s | xz -c" % item["path"], stdout=f, shell=True)
+
+  fileHash = subprocess.run(["nix-hash", "--base32", "--type", "sha256", item["path"]], capture_output=True).stdout.decode().strip()
+  fileSize = os.path.getsize(xzFile)
+
+  # Rename the .nar.xz file to its own hash to match "nix copy" behavior
+  finalXzFile = "nar/" + fileHash + ".nar.xz"
+  os.rename(xzFile, finalXzFile)
+
+  with open(narInfoHash + ".narinfo", "w") as f:
+    f.writelines((x + "\n" for x in [
+      "StorePath: " + item["path"],
+      "URL: " + finalXzFile,
+      "Compression: xz",
+      "FileHash: sha256:" + fileHash,
+      "FileSize: " + str(fileSize),
+      "NarHash: " + item["narHash"],
+      "NarSize: " + str(item["narSize"]),
+      "References: " + " ".join(dropPrefix(ref) for ref in item["references"]),
+    ]))
--- a/pkgs/desktops/pantheon/apps/appcenter/default.nix
+++ b/pkgs/desktops/pantheon/apps/appcenter/default.nix
@ -25,13 +25,13 @@

 stdenv.mkDerivation rec {
  pname = "appcenter";
-  version = "7.1.0";
+  version = "7.2.0";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "sha256-ToRY27qB/cNKjKW22MTEojxxOXMBfO1LUusy/pXKJ9A=";
+    sha256 = "sha256-XWDhQ5Nu+gGj0/TQ/fALxQJ+QXzMiHm0Qh9FlGiskEA=";
  };

  patches = [
--- a/pkgs/development/compilers/circt/default.nix
+++ b/pkgs/development/compilers/circt/default.nix
@ -38,6 +38,19 @@ stdenv.mkDerivation rec {
    "-DCIRCT_LLHD_SIM_ENABLED=OFF"
  ];

+  # There are some tests depending on `clang-tools` to work. They are activated only when detected
+  # `clang-tidy` in PATH, However, we cannot simply put `clang-tools` in checkInputs to make these
+  # tests work. Because
+  #
+  # 1. The absolute paths of binaries used in tests are resolved in configure phase.
+  # 2. When stdenv = clangStdenv, the `clang-tidy` binary appears in PATH via `clang-unwrapped`,
+  #    which is always placed before `${clang-tools}/bin` in PATH. `clang-tidy` provided in
+  #    `clang-unwrapped` cause tests failing because it is not wrapped to resolve header search paths.
+  #    https://github.com/NixOS/nixpkgs/issues/214945 discusses this issue.
+  #
+  # As a temporary fix, we disabled these tests when using clang stdenv
+  LIT_FILTER_OUT = lib.optionalString stdenv.cc.isClang "CIRCT :: Target/ExportSystemC/.*\.mlir";
+
  preConfigure = ''
    substituteInPlace test/circt-reduce/test/annotation-remover.mlir --replace "/usr/bin/env" "${coreutils}/bin/env"
  '';
--- a/pkgs/development/compilers/gcc/10/default.nix
+++ b/pkgs/development/compilers/gcc/10/default.nix
@ -158,34 +158,32 @@ stdenv.mkDerivation ({
  inherit noSysDirs staticCompiler crossStageStatic
    libcCross crossMingw;

-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ texinfo which gettext ]
-    ++ (optional (perl != null) perl)
-    ++ (optional langAda gnatboot)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional buildPlatform.isDarwin gnused)
+  inherit (import ../common/dependencies.nix {
+    inherit
+      lib
+      stdenv
+      buildPackages
+      targetPackages
+      crossStageStatic
+      threadsCross
+      langAda
+      libxcrypt
+      gnatboot
+      version
+      texinfo
+      which
+      gettext
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      zip
+      perl
    ;
-
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc libxcrypt
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {} && threadsCross.package != null) threadsCross.package;
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";

--- a/pkgs/development/compilers/gcc/11/default.nix
+++ b/pkgs/development/compilers/gcc/11/default.nix
@ -164,34 +164,32 @@ stdenv.mkDerivation ({
  inherit noSysDirs staticCompiler crossStageStatic
    libcCross crossMingw;

-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ texinfo which gettext ]
-    ++ (optional (perl != null) perl)
-    ++ (optional langAda gnatboot)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional buildPlatform.isDarwin gnused)
+  inherit (import ../common/dependencies.nix {
+    inherit
+      lib
+      stdenv
+      buildPackages
+      targetPackages
+      crossStageStatic
+      threadsCross
+      langAda
+      libxcrypt
+      gnatboot
+      version
+      texinfo
+      which
+      gettext
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      zip
+      perl
    ;
-
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc libxcrypt
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {} && threadsCross.package != null) threadsCross.package;
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";

--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@ -198,35 +198,34 @@ stdenv.mkDerivation ({
  inherit noSysDirs staticCompiler crossStageStatic
    libcCross crossMingw;

-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ texinfo which gettext ]
-    ++ (optional (perl != null) perl)
-    ++ (optional langAda gnatboot)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional buildPlatform.isDarwin gnused)
+  inherit (import ../common/dependencies.nix {
+    inherit
+      lib
+      stdenv
+      buildPackages
+      targetPackages
+      crossStageStatic
+      threadsCross
+      langAda
+      langGo
+      libucontext
+      libxcrypt
+      gnatboot
+      version
+      texinfo
+      which
+      gettext
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      zip
+      perl
    ;
-
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc libxcrypt
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ++ (optional (langGo && stdenv.hostPlatform.isMusl) libucontext)
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross.package;
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";

--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@ -158,37 +158,38 @@ stdenv.mkDerivation ({
  inherit noSysDirs staticCompiler langJava crossStageStatic
    libcCross crossMingw;

-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ texinfo which gettext ]
-    ++ (optional (perl != null) perl)
-    ++ (optional javaAwtGtk pkg-config)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional buildPlatform.isDarwin gnused)
+  inherit (import ../common/dependencies.nix {
+    inherit
+      lib
+      stdenv
+      buildPackages
+      targetPackages
+      crossStageStatic
+      threadsCross
+      version
+      langJava
+      javaAwtGtk
+      texinfo
+      which
+      gettext
+      pkg-config
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      cloog
+      isl
+      zlib
+      boehmgc
+      zip
+      unzip
+      gtk2
+      libart_lgpl
+      perl
+      xlibs
    ;
-
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (cloog != null) cloog)
-    ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ++ (optionals langJava [ boehmgc zip unzip ])
-    ++ (optionals javaAwtGtk ([ gtk2 libart_lgpl ] ++ xlibs))
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross;
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

  preConfigure = import ../common/pre-configure.nix {
    inherit lib;
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@ -178,37 +178,38 @@ stdenv.mkDerivation ({
  inherit noSysDirs staticCompiler langJava crossStageStatic
    libcCross crossMingw;

-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ texinfo which gettext ]
-    ++ (optional (perl != null) perl)
-    ++ (optional javaAwtGtk pkg-config)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional buildPlatform.isDarwin gnused)
+  inherit (import ../common/dependencies.nix {
+    inherit
+      lib
+      stdenv
+      buildPackages
+      targetPackages
+      crossStageStatic
+      threadsCross
+      version
+      langJava
+      javaAwtGtk
+      texinfo
+      which
+      gettext
+      pkg-config
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      cloog
+      isl
+      zlib
+      boehmgc
+      zip
+      unzip
+      gtk2
+      libart_lgpl
+      perl
+      xlibs
    ;
-
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (cloog != null) cloog)
-    ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ++ (optionals langJava [ boehmgc zip unzip ])
-    ++ (optionals javaAwtGtk ([ gtk2 libart_lgpl ] ++ xlibs))
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross;
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

  preConfigure = import ../common/pre-configure.nix {
    inherit lib;
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@ -193,38 +193,40 @@ stdenv.mkDerivation ({
  inherit noSysDirs staticCompiler langJava crossStageStatic
    libcCross crossMingw;

-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ texinfo which gettext ]
-    ++ (optional (perl != null) perl)
-    ++ (optional javaAwtGtk pkg-config)
-    ++ (optional (with stdenv.targetPlatform; isVc4 || isRedox) flex)
-    ++ (optional langAda gnatboot)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional buildPlatform.isDarwin gnused)
+  inherit (import ../common/dependencies.nix {
+    inherit
+      lib
+      stdenv
+      buildPackages
+      targetPackages
+      crossStageStatic
+      threadsCross
+      version
+      langAda
+      gnatboot
+      flex
+      langJava
+      javaAwtGtk
+      texinfo
+      which
+      gettext
+      pkg-config
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      boehmgc
+      zip
+      unzip
+      gtk2
+      libart_lgpl
+      perl
+      xlibs
    ;
-
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ++ (optionals langJava [ boehmgc zip unzip ])
-    ++ (optionals javaAwtGtk ([ gtk2 libart_lgpl ] ++ xlibs))
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross.package;
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";

--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@ -165,33 +165,29 @@ stdenv.mkDerivation ({
  inherit noSysDirs staticCompiler crossStageStatic
    libcCross crossMingw;

-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ texinfo which gettext ]
-    ++ (optional (perl != null) perl)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional buildPlatform.isDarwin gnused)
+  inherit (import ../common/dependencies.nix {
+    inherit
+      lib
+      stdenv
+      buildPackages
+      targetPackages
+      crossStageStatic
+      threadsCross
+      version
+      texinfo
+      which
+      gettext
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      zip
+      perl
    ;
-
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross.package;
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

  NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && langFortran) "-Wno-unused-command-line-argument";
  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@ -147,33 +147,29 @@ stdenv.mkDerivation ({
  inherit noSysDirs staticCompiler crossStageStatic
    libcCross crossMingw;

-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ texinfo which gettext ]
-    ++ (optional (perl != null) perl)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional buildPlatform.isDarwin gnused)
+  inherit (import ../common/dependencies.nix {
+    inherit
+      lib
+      stdenv
+      buildPackages
+      targetPackages
+      crossStageStatic
+      threadsCross
+      version
+      texinfo
+      which
+      gettext
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      zip
+      perl
    ;
-
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross.package;
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";

--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@ -158,34 +158,31 @@ stdenv.mkDerivation ({
  inherit noSysDirs staticCompiler crossStageStatic
    libcCross crossMingw;

-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ texinfo which gettext ]
-    ++ (optional (perl != null) perl)
-    ++ (optional langAda gnatboot)
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional buildPlatform.isDarwin gnused)
+  inherit (import ../common/dependencies.nix {
+    inherit
+      lib
+      stdenv
+      buildPackages
+      targetPackages
+      crossStageStatic
+      threadsCross
+      langAda
+      gnatboot
+      version
+      texinfo
+      which
+      gettext
+      gnused
+      patchelf
+      gmp
+      mpfr
+      libmpc
+      isl
+      zlib
+      zip
+      perl
    ;
-
-  # For building runtime libs
-  depsBuildTarget =
-    (
-      if hostPlatform == buildPlatform then [
-        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-      ] else assert targetPlatform == hostPlatform; [ # build != host == target
-        stdenv.cc
-      ]
-    )
-    ++ optional targetPlatform.isLinux patchelf;
-
-  buildInputs = [
-    gmp mpfr libmpc
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != {}) threadsCross.package;
+  }) depsBuildBuild nativeBuildInputs depsBuildTarget buildInputs depsTargetTarget;

  NIX_LDFLAGS = lib.optionalString  hostPlatform.isSunOS "-lm -ldl";

--- a/pkgs/development/compilers/gcc/common/dependencies.nix
+++ b/pkgs/development/compilers/gcc/common/dependencies.nix
@ -0,0 +1,92 @@
+{ lib
+, stdenv
+, version
+, buildPackages
+, targetPackages
+, texinfo
+, which
+, gettext
+, pkg-config ? null
+, gnused
+, patchelf
+, gmp
+, mpfr
+, libmpc
+, libucontext ? null
+, libxcrypt ? null
+, cloog ? null
+, isl ? null
+, zlib ? null
+, gnatboot ? null
+, flex ? null
+, boehmgc ? null
+, zip ? null
+, unzip ? null
+, gtk2 ? null
+, libart_lgpl ? null
+, perl ? null
+, xlibs ? null
+, langJava ? false
+, javaAwtGtk ? false
+, langAda ? false
+, langGo ? false
+, crossStageStatic ? null
+, threadsCross ? null
+}:
+
+let
+  inherit (lib) optionals;
+  inherit (stdenv) buildPlatform hostPlatform targetPlatform;
+in
+
+{
+  # same for all gcc's
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [
+    texinfo
+    which
+    gettext
+  ]
+  ++ optionals (perl != null) [ perl ]
+  ++ optionals javaAwtGtk [ pkg-config ]
+  ++ optionals (with stdenv.targetPlatform; isVc4 || isRedox && flex != null) [ flex ]
+  ++ optionals langAda [ gnatboot ]
+  # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
+  # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
+  ++ optionals buildPlatform.isDarwin [ gnused ]
+  ;
+
+  # For building runtime libs
+  # same for all gcc's
+  depsBuildTarget =
+    (
+      if hostPlatform == buildPlatform then [
+        targetPackages.stdenv.cc.bintools # newly-built gcc will be used
+      ] else assert targetPlatform == hostPlatform; [
+        # build != host == target
+        stdenv.cc
+      ]
+    )
+    ++ optionals targetPlatform.isLinux [ patchelf ];
+
+  buildInputs = [
+    gmp
+    mpfr
+    libmpc
+  ]
+  ++ optionals (lib.versionAtLeast version "10") [ libxcrypt ]
+  ++ [
+    targetPackages.stdenv.cc.bintools # For linking code at run-time
+  ]
+  ++ optionals (cloog != null) [ cloog ]
+  ++ optionals (isl != null) [ isl ]
+  ++ optionals (zlib != null) [ zlib ]
+  ++ optionals langJava [ boehmgc zip unzip ]
+  ++ optionals javaAwtGtk ([ gtk2 libart_lgpl ] ++ xlibs)
+  ++ optionals (langGo && stdenv.hostPlatform.isMusl) [ libucontext ]
+  ;
+
+  # threadsCross.package after gcc6 so i assume its okay for 4.8 and 4.9 too
+  depsTargetTarget = optionals (!crossStageStatic && threadsCross != { } && threadsCross.package != null) [ threadsCross.package ];
+}
--- a/pkgs/development/compilers/kotlin/native.nix
+++ b/pkgs/development/compilers/kotlin/native.nix
@ -7,7 +7,7 @@

 stdenv.mkDerivation rec {
  pname = "kotlin-native";
-  version = "1.8.0";
+  version = "1.8.10";

  src = let
    getArch = {
@ -20,9 +20,9 @@ stdenv.mkDerivation rec {
      "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-native-${arch}-${version}.tar.gz";

    getHash = arch: {
-      "macos-aarch64" = "19dcc2ylh11vxirglda8xrrm06i2nd53ndd8b1smf2vyj0v9593m";
-      "macos-x86_64" = "0pkc4g09qwp4lcvs62qis0zxdjbr9z5mbgyi4mczxx5kqha4fxp3";
-      "linux-x86_64" = "124nvhjh9xj8nsdjf71vzsgfjdq6mc0nalk79xfvsp2wh7xd8d0n";
+      "macos-aarch64" = "119ar6wax0bkp5fmardplhsvaw1jhpfr5xgkpkkv10nmx4agbkh8";
+      "macos-x86_64" = "1nqqzx397k1ifpdymaw39iz5mzpyi7n00kpw03y5iq5avzr7rsjj";
+      "linux-x86_64" = "0hlpda33y07d8dybjn65gzdl0ws0r8vda515pr2rhfisls18lp2c";
    }.${arch};
  in
    fetchurl {
--- a/pkgs/development/compilers/picat/default.nix
+++ b/pkgs/development/compilers/picat/default.nix
@ -9,11 +9,11 @@ let
 in
 stdenv.mkDerivation {
  pname = "picat";
-  version = "3.0p4";
+  version = "3.3p3";

  src = fetchurl {
-    url    = "http://picat-lang.org/download/picat30_4_src.tar.gz";
-    sha256 = "1rwin44m7ni2h2v51sh2r8gj2k6wm6f86zgaylrria9jr57inpqj";
+    url = "http://picat-lang.org/download/picat333_src.tar.gz";
+    hash = "sha256-LMmAHCGKgon/wNbrXTUH9hiHyGVwwSDpB1236xawzXs=";
  };

  buildInputs = [ zlib ];
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -196,9 +196,9 @@ in {
      major = "3";
      minor = "12";
      patch = "0";
-      suffix = "a3";
+      suffix = "a5";
    };
-    sha256 = "sha256-G2SzB14KkkGXTlgOCbCckRehxOK+aYA5IB7x2Kc0U9E=";
+    sha256 = "sha256-1m73o0L+OjVvnO47uXrcHl+0hA9rbP994P991JX4Mjs=";
    inherit (darwin) configd;
    inherit passthruFun;
  };
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@ -50,7 +50,7 @@ in

 stdenv.mkDerivation rec {
  pname = "racket";
-  version = "8.7"; # always change at once with ./minimal.nix
+  version = "8.8"; # always change at once with ./minimal.nix

  src = (lib.makeOverridable ({ name, sha256 }:
    fetchurl {
@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
    }
  )) {
    name = "${pname}-${version}";
-    sha256 = "sha256-dqfmbUfnPrDcP8on/IGONuHUv/502iY8Xv47iAGjCgE=";
+    sha256 = "sha256-OYQi4rQjc+FOTg+W2j2Vy1dEJHuj9z6pmBX7aTwnFKs=";
  };

  FONTCONFIG_FILE = fontsConf;
--- a/pkgs/development/interpreters/racket/minimal.nix
+++ b/pkgs/development/interpreters/racket/minimal.nix
@ -6,7 +6,7 @@ racket.overrideAttrs (oldAttrs: rec {
  version = oldAttrs.version;
  src = oldAttrs.src.override {
    name = "${pname}-${version}";
-    sha256 = "sha256-Iy7ZzxfNf3Q7LM9z13XsNbWvJrJeVREprrYDi7DNwOw=";
+    sha256 = "sha256-KaYT1PzHtGYej3CZEnensGiFaR9+487XueiZf3e+hQU=";
  };

  meta = oldAttrs.meta // {
--- a/pkgs/development/interpreters/trealla/default.nix
+++ b/pkgs/development/interpreters/trealla/default.nix
@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, readline, openssl, libffi, withThread ? true, withSSL ? true, xxd }:
+{ lib, stdenv, fetchFromGitHub, readline, openssl, libffi, valgrind, withThread ? true, withSSL ? true, xxd }:

 stdenv.mkDerivation rec {
  pname = "trealla";
-  version = "2.2.6";
+  version = "2.8.4";

  src = fetchFromGitHub {
    owner = "trealla-prolog";
    repo = "trealla";
    rev = "v${version}";
-    sha256 = "sha256-DxlexijQPcNxlPjo/oIvsN//8nZ0injXFHc2t3n4yjg=";
+    sha256 = "sha256-/jB4jlYotvdU068+zj9Z+G0g75sI9dTmtgN874i0qAE=";
  };

  postPatch = ''
@ -27,6 +27,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ xxd ];
  buildInputs = [ readline openssl libffi ];
+  checkInputs = [ valgrind ];
  enableParallelBuilding = true;

  installPhase = ''
--- a/pkgs/development/libraries/draco/default.nix
+++ b/pkgs/development/libraries/draco/default.nix
@ -16,17 +16,23 @@ let
  cmakeBool = b: if b then "ON" else "OFF";
 in
 stdenv.mkDerivation rec {
-  version = "1.5.5";
+  version = "1.5.6";
  pname = "draco";

  src = fetchFromGitHub {
    owner = "google";
    repo = "draco";
    rev = version;
-    sha256 = "sha256-WYWEUfBPz/Pt7sE8snG3/LnOA3DEUm/SUVLtsH7zG5g=";
+    hash = "sha256-2YQMav0JJMbJ2bvnN/Xv90tjE/OWLbrZDO4WlaOvcfI=";
    fetchSubmodules = true;
  };

+  # ld: unknown option: --start-group
+  postPatch = ''
+    substituteInPlace cmake/draco_targets.cmake \
+      --replace "^Clang" "^AppleClang"
+  '';
+
  buildInputs = [ gtest ]
    ++ lib.optionals withTranscoder [ eigen ghc_filesystem tinygltf ];

--- a/pkgs/development/libraries/gss/default.nix
+++ b/pkgs/development/libraries/gss/default.nix
@ -1,18 +1,26 @@
-{ lib, stdenv, fetchurl
-, withShishi ? !stdenv.isDarwin, shishi
+{ lib
+, stdenv
+, fetchurl
+, withShishi ? !stdenv.isDarwin
+, shishi
 }:

 stdenv.mkDerivation rec {
  pname = "gss";
-  version = "1.0.3";
+  version = "1.0.4";

  src = fetchurl {
    url = "mirror://gnu/gss/gss-${version}.tar.gz";
-    sha256 = "1syyvh3k659xf1hdv9pilnnhbbhs6vfapayp4xgdcc8mfgf9v4gz";
+    hash = "sha256-7M6r3vTK4/znIYsuy4PrQifbpEtTthuMKy6IrgJBnHM=";
  };

  buildInputs = lib.optional withShishi shishi;

+  # ./stdint.h:89:5: error: expected value in expression
+  preConfigure = lib.optionalString stdenv.isDarwin ''
+    export GNULIBHEADERS_OVERRIDE_WINT_T=0
+  '';
+
  configureFlags = [
    "--${if withShishi then "enable" else "disable"}-kerberos5"
  ];
--- a/pkgs/development/libraries/ldb/default.nix
+++ b/pkgs/development/libraries/ldb/default.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "ldb";
-  version = "2.3.0";
+  version = "2.6.1";

  src = fetchurl {
    url = "mirror://samba/ldb/${pname}-${version}.tar.gz";
-    sha256 = "0bcjj4gv48ddg44wyxpsvrs26xry6yy9x9k16qgz0bljs2rhilx4";
+    sha256 = "sha256-RnQD9334Z4LDlluxdUQLqi7XUan+uVYBlL2MBr8XNsk=";
  };

  outputs = [ "out" "dev" ];
@ -44,6 +44,13 @@ stdenv.mkDerivation rec {
    cmocka
  ];

+  # otherwise the configure script fails with
+  # PYTHONHASHSEED=1 missing! Don't use waf directly, use ./configure and make!
+  preConfigure = ''
+    export PKGCONFIG="$PKG_CONFIG"
+    export PYTHONHASHSEED=1
+  '';
+
  wafPath = "buildtools/bin/waf";

  wafConfigureFlags = [
--- a/pkgs/development/libraries/libpgf/default.nix
+++ b/pkgs/development/libraries/libpgf/default.nix
@ -1,21 +1,29 @@
-{ lib, stdenv, fetchzip, autoreconfHook }:
+{ lib
+, stdenv
+, fetchzip
+, autoreconfHook
+, dos2unix
+}:

 stdenv.mkDerivation rec {
  pname = "libpgf";
-  version = "7.21.2";
+  version = "7.21.7";

  src = fetchzip {
    url = "mirror://sourceforge/${pname}/${pname}/${version}/${pname}.zip";
-    sha256 = "0l1j5b1d02jn27miggihlppx656i0pc70cn6x89j1rpj33zn0g9r";
+    hash = "sha256-TAWIuikijfyeTRetZWoMMdB/FeGAR7ZjNssVxUevlVg=";
  };

-  nativeBuildInputs = [ autoreconfHook ];
-
-  autoreconfPhase = ''
+  postPatch = ''
+    find . -type f | xargs dos2unix
    mv README.txt README
-    sh autogen.sh
  '';

+  nativeBuildInputs = [
+    autoreconfHook
+    dos2unix
+  ];
+
  meta = {
    homepage = "https://www.libpgf.org/";
    description = "Progressive Graphics Format";
--- a/pkgs/development/libraries/talloc/default.nix
+++ b/pkgs/development/libraries/talloc/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "talloc";
-  version = "2.3.3";
+  version = "2.3.4";

  src = fetchurl {
    url = "mirror://samba/talloc/${pname}-${version}.tar.gz";
-    sha256 = "sha256-a+lbI2i9CvHEzXqIFG62zuoY5Gw//JMwv2JitA0diqo=";
+    sha256 = "sha256-F5+eviZeZ+SrLCbK0rfeS2p3xsIS+WaQM4KGnwa+ZQU=";
  };

  nativeBuildInputs = [
@ -37,6 +37,13 @@ stdenv.mkDerivation rec {
    libxcrypt
  ];

+  # otherwise the configure script fails with
+  # PYTHONHASHSEED=1 missing! Don't use waf directly, use ./configure and make!
+  preConfigure = ''
+    export PKGCONFIG="$PKG_CONFIG"
+    export PYTHONHASHSEED=1
+  '';
+
  wafPath = "buildtools/bin/waf";

  wafConfigureFlags = [
--- a/pkgs/development/libraries/tdb/default.nix
+++ b/pkgs/development/libraries/tdb/default.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  pname = "tdb";
-  version = "1.4.6";
+  version = "1.4.7";

  src = fetchurl {
    url = "mirror://samba/tdb/${pname}-${version}.tar.gz";
-    sha256 = "sha256-1okr2L7+BKd2QqHdVuSoeTSb8c9bLAv1+4QQYZON7ws=";
+    sha256 = "sha256-pPsWje9TPzH/LAf32YRLsxMeZ5nwlOvnfQOArcmHwg4=";
  };

  nativeBuildInputs = [
@ -34,6 +34,13 @@ stdenv.mkDerivation rec {
    libxcrypt
  ];

+  # otherwise the configure script fails with
+  # PYTHONHASHSEED=1 missing! Don't use waf directly, use ./configure and make!
+  preConfigure = ''
+    export PKGCONFIG="$PKG_CONFIG"
+    export PYTHONHASHSEED=1
+  '';
+
  wafPath = "buildtools/bin/waf";

  wafConfigureFlags = [
--- a/pkgs/development/libraries/tevent/default.nix
+++ b/pkgs/development/libraries/tevent/default.nix
@ -2,6 +2,7 @@
 , fetchurl
 , python3
 , pkg-config
+, cmocka
 , readline
 , talloc
 , libxslt
@ -13,11 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "tevent";
-  version = "0.10.2";
+  version = "0.13.0";

  src = fetchurl {
    url = "mirror://samba/tevent/${pname}-${version}.tar.gz";
-    sha256 = "15k6i8ad5lpxfjsjyq9h64zlyws8d3cm0vwdnaw8z1xjwli7hhpq";
+    sha256 = "sha256-uUN6kX+lU0Q2G+tk7J4AQumcroh5iCpi3Tj2q+I3HQw=";
  };

  nativeBuildInputs = [
@ -32,10 +33,18 @@ stdenv.mkDerivation rec {

  buildInputs = [
    python3
+    cmocka
    readline # required to build python
    talloc
  ];

+  # otherwise the configure script fails with
+  # PYTHONHASHSEED=1 missing! Don't use waf directly, use ./configure and make!
+  preConfigure = ''
+    export PKGCONFIG="$PKG_CONFIG"
+    export PYTHONHASHSEED=1
+  '';
+
  wafPath = "buildtools/bin/waf";

  wafConfigureFlags = [
--- a/pkgs/development/libraries/zint/default.nix
+++ b/pkgs/development/libraries/zint/default.nix
@ -12,17 +12,15 @@

 stdenv.mkDerivation rec {
  pname = "zint";
-  version = "2.11.1";
+  version = "2.12.0";

  src = fetchFromGitHub {
    owner = "zint";
    repo = "zint";
    rev = version;
-    sha256 = "sha256-ozhXy7ftmGz1XvmF8AS1ifWJ3Q5hLSsysB8qLUP60n8=";
+    hash = "sha256-Ay6smir6zUpadmw1WpU+F7e9t7Gk3JNVtf2VVu92bDk=";
  };

-  patches = [ ./qobject.patch ];
-
  outputs = [ "out" "dev" ];

  nativeBuildInputs = [ cmake wrapQtAppsHook ];
--- a/pkgs/development/libraries/zint/qobject.patch
+++ b/pkgs/development/libraries/zint/qobject.patch
@ -1,12 +0,0 @@
-diff --git a/backend_qt/qzint.h b/backend_qt/qzint.h
-index d57ab6a..62fb0a4 100644
--- a/backend_qt/qzint.h
-+++ b/backend_qt/qzint.h
-@@ -19,6 +19,7 @@
- #ifndef QZINT_H
- #define QZINT_H
- 
-+#include <QObject>
- #include <QColor>
- #include <QPainter>
- #include "zint.h"
--- a/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
+++ b/pkgs/development/mobile/androidenv/ndk-bundle/default.nix
@ -49,7 +49,7 @@ deployAndroidPackage {
    done

    # Patch executables
-    if [ -d prebuild/linux-x86_64 ]; then
+    if [ -d prebuilt/linux-x86_64 ]; then
        autoPatchelf prebuilt/linux-x86_64
    fi

--- a/pkgs/development/ocaml-modules/lem/default.nix
+++ b/pkgs/development/ocaml-modules/lem/default.nix
@ -0,0 +1,45 @@
+{ stdenv
+, fetchFromGitHub
+, lib
+, ncurses
+, makeWrapper
+, ocamlbuild
+, findlib
+, ocaml
+, num
+, zarith
+}:
+
+lib.throwIfNot (lib.versionAtLeast ocaml.version "4.07")
+  "lem is not available for OCaml ${ocaml.version}"
+
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-lem";
+  version = "2022-12-10";
+
+  src = fetchFromGitHub {
+    owner = "rems-project";
+    repo = "lem";
+    rev = version;
+    hash = "sha256-ZQgcuIVRkJS0KtpzjbO4OPHGg6B0TadWA6XpRir30y8=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ocamlbuild findlib ocaml ];
+  propagatedBuildInputs = [ zarith num ];
+
+  installFlags = [ "INSTALL_DIR=$(out)" ];
+
+  createFindlibDestdir = true;
+
+  postInstall = ''
+    wrapProgram $out/bin/lem --set LEMLIB $out/share/lem/library
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/rems-project/lem";
+    description = "A tool for lightweight executable mathematics";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = with licenses; [ bsd3 gpl2 ];
+    platforms = ocaml.meta.platforms;
+  };
+}
--- a/pkgs/development/ocaml-modules/linksem/default.nix
+++ b/pkgs/development/ocaml-modules/linksem/default.nix
@ -0,0 +1,36 @@
+{ lib
+, fetchFromGitHub
+, stdenv
+, findlib
+, ocaml
+, lem
+}:
+
+lib.throwIfNot (lib.versionAtLeast ocaml.version "4.07")
+  "linksem is not available for OCaml ${ocaml.version}"
+
+stdenv.mkDerivation rec {
+  pname = "ocaml${ocaml.version}-linksem";
+  version = "0.8";
+
+  src = fetchFromGitHub {
+    owner = "rems-project";
+    repo = "linksem";
+    rev = version;
+    hash = "sha256-7/YfDK3TruKCckMzAPLRrwBkHRJcX1S+AzXHWRxkZPA=";
+  };
+
+  nativeBuildInputs = [ findlib ocaml ];
+
+  propagatedBuildInputs = [ lem ];
+
+  createFindlibDestdir = true;
+
+  meta = with lib; {
+    homepage = "https://github.com/rems-project/linksem";
+    description = "A formalisation of substantial parts of ELF linking and DWARF debug information";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.bsd2;
+    platforms = ocaml.meta.platforms;
+  };
+}
--- a/pkgs/development/ocaml-modules/ppx_deriving_rpc/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_deriving_rpc/default.nix
@ -3,9 +3,10 @@
 buildDunePackage rec {
  pname = "ppx_deriving_rpc";

-  inherit (rpclib) version useDune2 src;
+  inherit (rpclib) version src;

-  minimumOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";

  propagatedBuildInputs = [ ppxlib rpclib ppx_deriving ];

--- a/pkgs/development/ocaml-modules/rpclib/default.nix
+++ b/pkgs/development/ocaml-modules/rpclib/default.nix
@ -1,24 +1,25 @@
-{ lib, fetchurl, buildDunePackage, ocaml
+{ lib, fetchurl, buildDunePackage
 , alcotest
 , base64, cmdliner, rresult, xmlm, yojson
 }:

 buildDunePackage rec {
  pname = "rpclib";
-  version = "8.1.0";
+  version = "9.0.0";

-  useDune2 = true;
+  minimalOCamlVersion = "4.08";
+  duneVersion = "3";

  src = fetchurl {
-    url = "https://github.com/mirage/ocaml-rpc/releases/download/v${version}/rpclib-v${version}.tbz";
-    sha256 = "0fbajg8wq8hjhkvvfnq68br0m0pa8zf2qzadhfgi2nnr9713rada";
+    url = "https://github.com/mirage/ocaml-rpc/releases/download/${version}/rpclib-${version}.tbz";
+    hash = "sha256-ziPrdWwCjZN0vRmCMpa923wjfT8FVFLTDRz30VIW6WM=";
  };

  buildInputs = [ cmdliner yojson ];
  propagatedBuildInputs = [ base64 rresult xmlm ];
  checkInputs = [ alcotest ];

-  doCheck = lib.versionAtLeast ocaml.version "4.08";
+  doCheck = true;

  meta = with lib; {
    homepage = "https://github.com/mirage/ocaml-rpc";
--- a/pkgs/development/ocaml-modules/rpclib/lwt.nix
+++ b/pkgs/development/ocaml-modules/rpclib/lwt.nix
@ -9,7 +9,8 @@

 buildDunePackage {
  pname = "rpclib-lwt";
-  inherit (rpclib) version useDune2 src;
+  inherit (rpclib) version src;
+  duneVersion = "3";

  propagatedBuildInputs = [ lwt rpclib ];

--- a/pkgs/development/ocaml-modules/rresult/default.nix
+++ b/pkgs/development/ocaml-modules/rresult/default.nix
@ -1,5 +1,8 @@
 { stdenv, lib, fetchurl, ocaml, findlib, ocamlbuild, topkg, result }:

+lib.throwIfNot (lib.versionAtLeast ocaml.version "4.07")
+  "rresult is not available for OCaml ${ocaml.version}"
+
 stdenv.mkDerivation rec {
  pname = "ocaml${ocaml.version}-rresult";
  version = "0.7.0";
--- a/pkgs/development/ocaml-modules/sail/default.nix
+++ b/pkgs/development/ocaml-modules/sail/default.nix
@ -0,0 +1,79 @@
+{ lib
+, fetchFromGitHub
+, buildDunePackage
+, base64
+, omd
+, menhir
+, ott
+, linenoise
+, dune-site
+, pprint
+, makeWrapper
+, lem
+, z3
+, linksem
+, num
+}:
+
+buildDunePackage rec {
+  pname = "sail";
+  version = "0.15";
+
+  src = fetchFromGitHub {
+    owner = "rems-project";
+    repo = "sail";
+    rev = version;
+    hash = "sha256-eNdFOSzkniNvSCZeORRJ/IYAu+9P4HSouwmhd4BQLPk=";
+  };
+
+  duneVersion = "3";
+  minimalOCamlVersion = "4.08";
+
+  nativeBuildInputs = [
+    makeWrapper
+    ott
+    menhir
+    lem
+  ];
+
+  propagatedBuildInputs = [
+    base64
+    omd
+    dune-site
+    linenoise
+    pprint
+    linksem
+  ];
+
+  preBuild = ''
+    rm -r aarch*  # Remove code derived from non-bsd2 arm spec
+    rm -r snapshots  # Some of this might be derived from stuff in the aarch dir, it builds fine without it
+  '';
+  # `buildDunePackage` only builds the [pname] package
+  # This doesnt work in this case, as sail includes multiple packages in the same source tree
+  buildPhase = ''
+    runHook preBuild
+    dune build --release ''${enableParallelBuild:+-j $NIX_BUILD_CORES}
+    runHook postBuild
+  '';
+  checkPhase = ''
+    runHook preCheck
+    dune runtest ''${enableParallelBuild:+-j $NIX_BUILD_CORES}
+    runHook postCheck
+  '';
+  installPhase = ''
+    runHook preInstall
+    dune install --prefix $out --libdir $OCAMLFIND_DESTDIR
+    runHook postInstall
+  '';
+  postInstall = ''
+    wrapProgram $out/bin/sail --set SAIL_DIR $out/share/sail
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/rems-project/sail";
+    description = "A language for describing the instruction-set architecture (ISA) semantics of processors";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.bsd2;
+  };
+}
--- a/pkgs/development/python-modules/apache-beam/default.nix
+++ b/pkgs/development/python-modules/apache-beam/default.nix
@ -4,6 +4,7 @@
 , cython
 , dill
 , fastavro
+, fasteners
 , fetchFromGitHub
 , fetchpatch
 , freezegun
@ -11,11 +12,12 @@
 , grpcio-tools
 , hdfs
 , httplib2
+, hypothesis
 , lib
 , mock
 , mypy-protobuf
 , numpy
-, oauth2client
+, objsize
 , orjson
 , pandas
 , parameterized
@ -26,32 +28,33 @@
 , pydot
 , pyhamcrest
 , pymongo
+, pytest-xdist
 , pytestCheckHook
 , python
 , python-dateutil
-, pythonAtLeast
 , pythonRelaxDepsHook
 , pytz
 , pyyaml
+, regex
 , requests
 , requests-mock
 , scikit-learn
-, setuptools
 , sqlalchemy
 , tenacity
 , testcontainers
 , typing-extensions
+, zstandard
 }:

 buildPythonPackage rec {
  pname = "apache-beam";
-  version = "2.43.0";
+  version = "2.44.0";

  src = fetchFromGitHub {
    owner = "apache";
    repo = "beam";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-lqGXCC66eyBnHcK06k9knggX5C+2d0m6xBAI5sh0RHo=";
+    hash = "sha256-5fnZxv2ZkFlv8vGDIt/6EL41v9P1iKa1tEd1nezq+PU=";
  };

  patches = [
@ -62,24 +65,22 @@ buildPythonPackage rec {
      hash = "sha256-iUmnzrItTFM98w3mpadzrmtI3t0fucpSujAg/6qxCGk=";
      stripLen = 2;
    })
-    (fetchpatch {
-      # https://github.com/apache/beam/pull/24573
-      name = "relax-httplib2-version.patch";
-      url = "https://github.com/apache/beam/commit/4045503575ae5ccef3de8d7b868c54e37fef658b.patch";
-      hash = "sha256-YqT+sHaa1R9vLQnEQN2K0lYoCdnGoPY9qduGBpXPaek=";
-      stripLen = 2;
-    })
  ];

  pythonRelaxDeps = [
    # See https://github.com/NixOS/nixpkgs/issues/156957
    "dill"
    "numpy"
-    "pyarrow"
    "pymongo"

    # See https://github.com/NixOS/nixpkgs/issues/193613
    "protobuf"
+
+    # As of apache-beam v2.44.0, the requirement is httplib2>=0.8,<0.21.0, but
+    # the current (2023-02-08) nixpkgs's httplib2 version is 0.21.0. This can be
+    # removed once beam is upgraded since the current requirement on master is
+    # for httplib2>=0.8,<0.22.0.
+    "httplib2"
  ];

  sourceRoot = "source/sdks/python";
@ -94,14 +95,14 @@ buildPythonPackage rec {
  propagatedBuildInputs = [
    cloudpickle
    crcmod
-    cython
    dill
    fastavro
+    fasteners
    grpcio
    hdfs
    httplib2
    numpy
-    oauth2client
+    objsize
    orjson
    proto-plus
    protobuf
@ -110,9 +111,10 @@ buildPythonPackage rec {
    pymongo
    python-dateutil
    pytz
+    regex
    requests
-    setuptools
    typing-extensions
+    zstandard
  ];

  enableParallelBuilding = true;
@ -121,14 +123,16 @@ buildPythonPackage rec {
    "apache_beam"
  ];

-  nativeCheckInputs = [
+  checkInputs = [
    freezegun
+    hypothesis
    mock
    pandas
    parameterized
    psycopg2
    pyhamcrest
    pytestCheckHook
+    pytest-xdist
    pyyaml
    requests-mock
    scikit-learn
@ -160,6 +164,13 @@ buildPythonPackage rec {
    # Fails starting from dill 0.3.6 because it tries to pickle pytest globals:
    # https://github.com/uqfoundation/dill/issues/482#issuecomment-1139017499.
    "apache_beam/transforms/window_test.py"
+
+    # See https://github.com/apache/beam/issues/25390.
+    "apache_beam/coders/slow_coders_test.py"
+    "apache_beam/dataframe/pandas_doctests_test.py"
+    "apache_beam/typehints/typed_pipeline_test.py"
+    "apache_beam/coders/fast_coders_test.py"
+    "apache_beam/dataframe/schemas_test.py"
  ];

  disabledTests = [
--- a/pkgs/development/python-modules/argh/default.nix
+++ b/pkgs/development/python-modules/argh/default.nix
@ -9,22 +9,13 @@

 buildPythonPackage rec {
  pname = "argh";
-  version = "0.26.2";
+  version = "0.27.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "e9535b8c84dc9571a48999094fda7f33e63c3f1b74f3e5f3ac0105a58405bb65";
+    hash = "sha256-2wbZEIHxck40fM23iclXD+yUc351WvFZiDcpPgH8TNI=";
  };

-  patches = [
-    # https://github.com/neithere/argh/issues/148
-    (fetchpatch {
-      name = "argh-0.26.2-fix-py3.9-msgs.patch";
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/dev-python/argh/files/argh-0.26.2-fix-py3.9-msgs.patch?id=6f194f12a2e30aad7da347848f7b0187e188f983";
-      sha256 = "nBmhF2PXVeS7cBNujzip6Bb601LRHrjmhlGKFr/++Oo=";
-    })
-  ];
-
  nativeCheckInputs = [
    iocapture
    mock
@ -34,6 +25,7 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "argh" ];

  meta = with lib; {
+    changelog = "https://github.com/neithere/argh/blob/v${version}/CHANGES";
    homepage = "https://github.com/neithere/argh";
    description = "An unobtrusive argparse wrapper with natural syntax";
    license = licenses.lgpl3Plus;
--- a/pkgs/development/python-modules/b2sdk/default.nix
+++ b/pkgs/development/python-modules/b2sdk/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "b2sdk";
-  version = "1.18.0";
+  version = "1.19.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-knLyjRjUmLZtM9dJoPBeSdm7GpE0+UJhwLi/obVvPuw=";
+    hash = "sha256-aJpSt+dXjw4S33dBiMkaR6wxzwLru+jseuPKFj2R36Y=";
  };

  nativeBuildInputs = [
@ -56,6 +56,7 @@ buildPythonPackage rec {
  disabledTestPaths = [
    # requires aws s3 auth
    "test/integration/test_download.py"
+    "test/integration/test_upload.py"
  ];

  disabledTests = [
--- a/pkgs/development/python-modules/cmaes/default.nix
+++ b/pkgs/development/python-modules/cmaes/default.nix
@ -0,0 +1,37 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, hypothesis
+, numpy
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "cmaes";
+  version = "0.9.1";
+  disabled = pythonOlder "3.7";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "CyberAgentAILab";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-dd5vLT4Q0cI5ts0WgBpjPtOA81exGNjWSNHEiPggYbg=";
+  };
+
+  nativeBuildInputs = [ setuptools ];
+  propagatedBuildInputs = [ numpy ];
+
+  nativeCheckInputs = [ pytestCheckHook hypothesis ];
+
+  pythonImportsCheck = [ "cmaes" ];
+
+  meta = with lib; {
+    description = "Python library for CMA evolution strategy";
+    homepage = "https://github.com/CyberAgentAILab/cmaes";
+    license = licenses.mit;
+    maintainers = [ maintainers.bcdarwin ];
+  };
+}
--- a/pkgs/development/python-modules/dataproperty/default.nix
+++ b/pkgs/development/python-modules/dataproperty/default.nix
@ -0,0 +1,39 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, mbstrdecoder
+, typepy
+, pytestCheckHook
+, termcolor
+}:
+
+buildPythonPackage rec {
+  pname = "dataproperty";
+  version = "0.55.0";
+
+  src = fetchFromGitHub {
+    owner = "thombashi";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-ODSrKZ8M/ni9r2gkVIKWaKkdr+3AVi4INkEKJ+cmb44=";
+  };
+
+  propagatedBuildInputs = [ mbstrdecoder typepy ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+  checkInputs = [ termcolor ];
+
+  # Tests fail, even on non-nixos
+  pytestFlagsArray = [
+    "--deselect test/test_dataproperty.py::Test_DataPeroperty_len::test_normal_ascii_escape_sequence"
+    "--deselect test/test_dataproperty.py::Test_DataPeroperty_is_include_ansi_escape::test_normal"
+    "--deselect test/test_dataproperty.py::Test_DataPeroperty_repr::test_normal"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/thombashi/dataproperty";
+    description = "A library for extracting properties from data";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/python-modules/flask-babel/default.nix
+++ b/pkgs/development/python-modules/flask-babel/default.nix
@ -22,14 +22,14 @@

 buildPythonPackage rec {
  pname = "flask-babel";
-  version = "3.0.0";
+  version = "3.0.1";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "python-babel";
    repo = "flask-babel";
    rev = "refs/tags/v${version}";
-    hash = "sha256-c3QKAnyMe1THHuJ3uB2d0jMMo1SYGRAB9mBpIJSAHw0=";
+    hash = "sha256-bHsB1f7dbZW4k8JteyZOwVCgWRDZMu21XdMcjM5NYjk=";
  };

  outputs = [
--- a/pkgs/development/python-modules/gbulb/default.nix
+++ b/pkgs/development/python-modules/gbulb/default.nix
@ -10,13 +10,13 @@

 buildPythonPackage rec {
  pname = "gbulb";
-  version = "0.6.3";
+  version = "0.6.4";

  src = fetchFromGitHub {
    owner = "beeware";
    repo = "gbulb";
-    rev = "v${version}";
-    sha256 = "sha256-QNpZf1zfe6r6MtmYMWSrXPsXm5iX36oMx4GnXiTYPaQ=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-AdZSvxix0cpoFQSrslGl+hB/s6Nh0EsWMQmXZAJVJOg=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
+++ b/pkgs/development/python-modules/google-cloud-error-reporting/default.nix
@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "google-cloud-error-reporting";
-  version = "1.8.1";
+  version = "1.8.2";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-Xl+Jc05daQZPh4xggf/JYYlJ5Lx6LafqWhMcVdk/r6o=";
+    hash = "sha256-bwl1gWLux5LJMZIS/tJFMhHs1LcaDVCTgNrke6ASiBI=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/karton-asciimagic/default.nix
+++ b/pkgs/development/python-modules/karton-asciimagic/default.nix
@ -3,30 +3,39 @@
 , fetchFromGitHub
 , karton-core
 , unittestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "karton-asciimagic";
  version = "1.2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "CERT-Polska";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-sY5ik9efzLBa6Fbh17Vh4q7PlwOGYjuodU9yvp/8E3k=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-sY5ik9efzLBa6Fbh17Vh4q7PlwOGYjuodU9yvp/8E3k=";
  };

  propagatedBuildInputs = [
    karton-core
  ];

-  nativeCheckInputs = [ unittestCheckHook ];
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];

-  pythonImportsCheck = [ "karton.asciimagic" ];
+  pythonImportsCheck = [
+    "karton.asciimagic"
+  ];

  meta = with lib; {
    description = "Decoders for ascii-encoded executables for the Karton framework";
    homepage = "https://github.com/CERT-Polska/karton-asciimagic";
+    changelog = "https://github.com/CERT-Polska/karton-asciimagic/releases/tag/v${version}";
    license = with licenses; [ bsd3 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/karton-autoit-ripper/default.nix
+++ b/pkgs/development/python-modules/karton-autoit-ripper/default.nix
@ -18,8 +18,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "CERT-Polska";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-D+M3JsIN8LUWg8GVweEzySHI7KaBb6cNHHn4pXoq55M=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-D+M3JsIN8LUWg8GVweEzySHI7KaBb6cNHHn4pXoq55M=";
  };

  propagatedBuildInputs = [
@ -46,6 +46,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "AutoIt script ripper for Karton framework";
    homepage = "https://github.com/CERT-Polska/karton-autoit-ripper";
+    changelog = "https://github.com/CERT-Polska/karton-autoit-ripper/releases/tag/v${version}";
    license = with licenses; [ bsd3 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/karton-classifier/default.nix
+++ b/pkgs/development/python-modules/karton-classifier/default.nix
@ -18,7 +18,7 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "CERT-Polska";
    repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
    hash = "sha256-TRmAin0TAOIwR5EBMwTOJ9QaHO+mOx/eAjgqvyQZDj4=";
  };

@ -51,6 +51,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "File type classifier for the Karton framework";
    homepage = "https://github.com/CERT-Polska/karton-classifier";
+    changelog = "https://github.com/CERT-Polska/karton-classifier/releases/tag/v${version}";
    license = with licenses; [ bsd3 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/karton-config-extractor/default.nix
+++ b/pkgs/development/python-modules/karton-config-extractor/default.nix
@ -16,8 +16,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "CERT-Polska";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-ep69Rrm8Ek0lkgctz6vDAZ1MZ8kWKZSyIvMMAmzTngA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ep69Rrm8Ek0lkgctz6vDAZ1MZ8kWKZSyIvMMAmzTngA=";
  };

  propagatedBuildInputs = [
@ -40,6 +40,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Static configuration extractor for the Karton framework";
    homepage = "https://github.com/CERT-Polska/karton-config-extractor";
+    changelog = "https://github.com/CERT-Polska/karton-config-extractor/releases/tag/v${version}";
    license = with licenses; [ bsd3 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/karton-core/default.nix
+++ b/pkgs/development/python-modules/karton-core/default.nix
@ -3,12 +3,16 @@
 , buildPythonPackage
 , fetchFromGitHub
 , unittestCheckHook
+, pythonOlder
 , redis
 }:

 buildPythonPackage rec {
  pname = "karton-core";
  version = "5.0.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "CERT-Polska";
@ -22,7 +26,9 @@ buildPythonPackage rec {
    redis
  ];

-  nativeCheckInputs = [ unittestCheckHook ];
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];

  pythonImportsCheck = [
    "karton.core"
@ -31,6 +37,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Distributed malware processing framework";
    homepage = "https://karton-core.readthedocs.io/";
+    changelog = "https://github.com/CERT-Polska/karton/releases/tag/v${version}";
    license = licenses.bsd3;
    maintainers = with maintainers; [ chivay fab ];
  };
--- a/pkgs/development/python-modules/karton-dashboard/default.nix
+++ b/pkgs/development/python-modules/karton-dashboard/default.nix
@ -53,6 +53,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Web application that allows for Karton task and queue introspection";
    homepage = "https://github.com/CERT-Polska/karton-dashboard";
+    changelog = "https://github.com/CERT-Polska/karton-dashboard/releases/tag/v${version}";
    license = with licenses; [ bsd3 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/karton-mwdb-reporter/default.nix
+++ b/pkgs/development/python-modules/karton-mwdb-reporter/default.nix
@ -16,7 +16,7 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "CERT-Polska";
    repo = pname;
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
    hash = "sha256-QVxczXT74Xt0AtCSDm4nhIK4qtHQ6bqmVNb/CALZSE4=";
  };

@ -35,6 +35,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Karton service that uploads analyzed artifacts and metadata to MWDB Core";
    homepage = "https://github.com/CERT-Polska/karton-mwdb-reporter";
+    changelog = "https://github.com/CERT-Polska/karton-mwdb-reporter/releases/tag/v${version}";
    license = with licenses; [ bsd3 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/karton-yaramatcher/default.nix
+++ b/pkgs/development/python-modules/karton-yaramatcher/default.nix
@ -3,18 +3,22 @@
 , fetchFromGitHub
 , karton-core
 , unittestCheckHook
+, pythonOlder
 , yara-python
 }:

 buildPythonPackage rec {
  pname = "karton-yaramatcher";
  version = "1.2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "CERT-Polska";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-ulWwPXbjqQXwSRi8MFdcx7vC7P19yu66Ll8jkuTesao=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ulWwPXbjqQXwSRi8MFdcx7vC7P19yu66Ll8jkuTesao=";
  };

  propagatedBuildInputs = [
@ -22,13 +26,18 @@ buildPythonPackage rec {
    yara-python
  ];

-  nativeCheckInputs = [ unittestCheckHook ];
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];

-  pythonImportsCheck = [ "karton.yaramatcher" ];
+  pythonImportsCheck = [
+    "karton.yaramatcher"
+  ];

  meta = with lib; {
    description = "File and analysis artifacts yara matcher for the Karton framework";
    homepage = "https://github.com/CERT-Polska/karton-yaramatcher";
+    changelog = "https://github.com/CERT-Polska/karton-yaramatcher/releases/tag/v${version}";
    license = with licenses; [ bsd3 ];
    maintainers = with maintainers; [ fab ];
  };
--- a/pkgs/development/python-modules/mbstrdecoder/default.nix
+++ b/pkgs/development/python-modules/mbstrdecoder/default.nix
@ -0,0 +1,31 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, chardet
+, pytestCheckHook
+, faker
+}:
+
+buildPythonPackage rec {
+  pname = "mbstrdecoder";
+  version = "1.1.1";
+
+  src = fetchFromGitHub {
+    owner = "thombashi";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-U8F+mWKDulIRvvhswmdGnxKjM2qONQybViQ5TLZbLDY=";
+  };
+
+  propagatedBuildInputs = [ chardet ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+  checkInputs = [ faker ];
+
+  meta = with lib; {
+    homepage = "https://github.com/thombashi/mbstrdecoder";
+    description = "A library for decoding multi-byte character strings";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "nomadnet";
-  version = "0.3.2";
+  version = "0.3.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "markqvist";
    repo = "NomadNet";
    rev = "refs/tags/${version}";
-    hash = "sha256-QIme76Y7rhPCooazX+pr5ETbAmShVHZ9polJ964NLFg=";
+    hash = "sha256-7EiAvWYhYJ7S/quME6B4Iw5nw+xOnL7PMCWXLPx0O+4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pyorthanc/default.nix
+++ b/pkgs/development/python-modules/pyorthanc/default.nix
@ -0,0 +1,41 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, pytestCheckHook
+, poetry-core
+, httpx
+, pydicom
+}:
+
+buildPythonPackage rec {
+  pname = "pyorthanc";
+  version = "1.11.4";
+  disabled = pythonOlder "3.8";
+
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "gacou54";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-HbNeI6KpdIoLwRx09qQGJ/iJGKnRj0Z4/mkgoXhofGA=";
+  };
+
+  nativeBuildInputs = [ poetry-core ];
+
+  propagatedBuildInputs = [ httpx pydicom ];
+
+  doCheck = false;  # requires orthanc server (not in Nixpkgs)
+
+  pythonImportsCheck = [
+    "pyorthanc"
+  ];
+
+  meta = with lib; {
+    description = "Python library that wraps the Orthanc REST API";
+    homepage = "https://github.com/gacou54/pyorthanc";
+    license = licenses.mit;
+    maintainers = with maintainers; [ bcdarwin ];
+  };
+}
--- a/pkgs/development/python-modules/pypinyin/default.nix
+++ b/pkgs/development/python-modules/pypinyin/default.nix
@ -6,13 +6,13 @@

 buildPythonPackage rec {
  pname = "pypinyin";
-  version = "0.47.1";
+  version = "0.48.0";

  src = fetchFromGitHub {
    owner = "mozillazg";
    repo = "python-pinyin";
    rev = "refs/tags/v${version}";
-    sha256 = "sha256-c9pEO9k5tCFWLPismrXrrYEQYmxYKkciXFgpbrDEGzE=";
+    sha256 = "sha256-gt0jrDPr6FeLB5P9HCSosCHb/W1sAKSusTrCpkqO26E=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pytablewriter/default.nix
+++ b/pkgs/development/python-modules/pytablewriter/default.nix
@ -0,0 +1,57 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, lib
+, dataproperty
+, mbstrdecoder
+, pathvalidate
+, setuptools
+, tabledata
+, tcolorpy
+, typepy
+, pytestCheckHook
+, pyyaml
+, toml
+, elasticsearch
+, dominate
+}:
+
+buildPythonPackage rec {
+  pname = "pytablewriter";
+  version = "0.64.2";
+
+  src = fetchFromGitHub {
+    owner = "thombashi";
+    repo = pname;
+    rev = "v${version}";
+    hash = "sha256-+IOHnmdd9g3SoHyITJJtbJ0/SAAmwWmwX5XeqsO34EM=";
+  };
+
+  propagatedBuildInputs = [
+    dataproperty
+    mbstrdecoder
+    pathvalidate
+    tabledata
+    tcolorpy
+    typepy
+  ];
+
+  checkInputs = [ pyyaml toml elasticsearch dominate ];
+  nativeCheckInputs = [ pytestCheckHook ];
+  # Circular dependency
+  disabledTests = [
+    "test_normal_from_file"
+    "test_normal_from_text"
+    "test_normal_clear_theme"
+  ];
+  disabledTestPaths = [
+    "test/writer/binary/test_excel_writer.py"
+    "test/writer/binary/test_sqlite_writer.py"
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/thombashi/pytablewriter";
+    description = "A library to write a table in various formats";
+    maintainers = with maintainers; [ genericnerdyusername ];
+    license = licenses.mit;
+  };
+}
--- a/Show more
+++ b/Show more