Merge master into haskell-updates

maintainers/maintainer-list.nix

@@ -513,12 +513,6 @@
     githubId = 38869148;
     name = "Alex Eyre";
   };
-  algorith = {
-    email = "dries_van_daele@telenet.be";
-    github = "DriesVanDaele";
-    githubId = 1141488;
-    name = "Dries Van Daele";
-  };
   alibabzo = {
     email = "alistair.bill@gmail.com";
     github = "alibabzo";
@@ -6536,6 +6530,12 @@
     githubId = 787421;
     name = "Kevin Quick";
   };
+  kradalby = {
+    name = "Kristoffer Dalby";
+    email = "kristoffer@dalby.cc";
+    github = "kradalby";
+    githubId = 98431;
+  };
   kraem = {
     email = "me@kraem.xyz";
     github = "kraem";

nixos/doc/manual/from_md/release-notes/rl-2205.section.xml

@@ -192,6 +192,15 @@
           <link xlink:href="options.html#opt-services.rstudio-server.enable">services.rstudio-server</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://github.com/juanfont/headscale">headscale</link>,
+          an Open Source implementation of the
+          <link xlink:href="https://tailscale.io">Tailscale</link>
+          Control Server. Available as
+          <link xlink:href="options.html#opt-services.headscale.enable">services.headscale</link>
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-22.05-incompatibilities">

nixos/doc/manual/release-notes/rl-2205.section.md

@@ -58,6 +58,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [rstudio-server](https://www.rstudio.com/products/rstudio/#rstudio-server), a browser-based version of the RStudio IDE for the R programming language. Available as [services.rstudio-server](options.html#opt-services.rstudio-server.enable).
 
+- [headscale](https://github.com/juanfont/headscale), an Open Source implementation of the [Tailscale](https://tailscale.io) Control Server. Available as [services.headscale](options.html#opt-services.headscale.enable)
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Backward Incompatibilities {#sec-release-22.05-incompatibilities}

nixos/lib/systemd-lib.nix

@@ -11,6 +11,9 @@ in rec {
 
   mkPathSafeName = lib.replaceChars ["@" ":" "\\" "[" "]"] ["-" "-" "-" "" ""];
 
+  # a type for options that take a unit name
+  unitNameType = types.strMatching "[a-zA-Z0-9@%:_.\\-]+[.](service|socket|device|mount|automount|swap|target|path|timer|scope|slice)";
+
   makeUnit = name: unit:
     if unit.enable then
       pkgs.runCommand "unit-${mkPathSafeName name}"

nixos/lib/systemd-unit-options.nix

@@ -45,7 +45,7 @@ in rec {
 
     requiredBy = mkOption {
       default = [];
-      type = types.listOf types.str;
+      type = types.listOf unitNameType;
       description = ''
         Units that require (i.e. depend on and need to go down with)
         this unit. The discussion under <literal>wantedBy</literal>
@@ -56,7 +56,7 @@ in rec {
 
     wantedBy = mkOption {
       default = [];
-      type = types.listOf types.str;
+      type = types.listOf unitNameType;
       description = ''
         Units that want (i.e. depend on) this unit. The standard way
         to make a unit start by default at boot is to set this option
@@ -73,7 +73,7 @@ in rec {
 
     aliases = mkOption {
       default = [];
-      type = types.listOf types.str;
+      type = types.listOf unitNameType;
       description = "Aliases of that unit.";
     };
 
@@ -110,7 +110,7 @@ in rec {
 
     requires = mkOption {
       default = [];
-      type = types.listOf types.str;
+      type = types.listOf unitNameType;
       description = ''
         Start the specified units when this unit is started, and stop
         this unit when the specified units are stopped or fail.
@@ -119,7 +119,7 @@ in rec {
 
     wants = mkOption {
       default = [];
-      type = types.listOf types.str;
+      type = types.listOf unitNameType;
       description = ''
         Start the specified units when this unit is started.
       '';
@@ -127,7 +127,7 @@ in rec {
 
     after = mkOption {
       default = [];
-      type = types.listOf types.str;
+      type = types.listOf unitNameType;
       description = ''
         If the specified units are started at the same time as
         this unit, delay this unit until they have started.
@@ -136,7 +136,7 @@ in rec {
 
     before = mkOption {
       default = [];
-      type = types.listOf types.str;
+      type = types.listOf unitNameType;
       description = ''
         If the specified units are started at the same time as
         this unit, delay them until this unit has started.
@@ -145,7 +145,7 @@ in rec {
 
     bindsTo = mkOption {
       default = [];
-      type = types.listOf types.str;
+      type = types.listOf unitNameType;
       description = ''
         Like ‘requires’, but in addition, if the specified units
         unexpectedly disappear, this unit will be stopped as well.
@@ -154,7 +154,7 @@ in rec {
 
     partOf = mkOption {
       default = [];
-      type = types.listOf types.str;
+      type = types.listOf unitNameType;
       description = ''
         If the specified units are stopped or restarted, then this
         unit is stopped or restarted as well.
@@ -163,7 +163,7 @@ in rec {
 
     conflicts = mkOption {
       default = [];
-      type = types.listOf types.str;
+      type = types.listOf unitNameType;
       description = ''
         If the specified units are started, then this unit is stopped
         and vice versa.
@@ -172,7 +172,7 @@ in rec {
 
     requisite = mkOption {
       default = [];
-      type = types.listOf types.str;
+      type = types.listOf unitNameType;
       description = ''
         Similar to requires. However if the units listed are not started,
         they will not be started and the transaction will fail.
@@ -203,7 +203,7 @@ in rec {
 
     onFailure = mkOption {
       default = [];
-      type = types.listOf types.str;
+      type = types.listOf unitNameType;
       description = ''
         A list of one or more units that are activated when
         this unit enters the "failed" state.

nixos/modules/module-list.nix

@@ -764,6 +764,7 @@
   ./services/networking/gvpe.nix
   ./services/networking/hans.nix
   ./services/networking/haproxy.nix
+  ./services/networking/headscale.nix
   ./services/networking/hostapd.nix
   ./services/networking/htpdate.nix
   ./services/networking/hylafax/default.nix

nixos/modules/services/networking/headscale.nix

@@ -0,0 +1,490 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.services.headscale;
+
+  dataDir = "/var/lib/headscale";
+  runDir = "/run/headscale";
+
+  settingsFormat = pkgs.formats.yaml { };
+  configFile = settingsFormat.generate "headscale.yaml" cfg.settings;
+in
+{
+  options = {
+    services.headscale = {
+      enable = mkEnableOption "headscale, Open Source coordination server for Tailscale";
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.headscale;
+        defaultText = literalExpression "pkgs.headscale";
+        description = ''
+          Which headscale package to use for the running server.
+        '';
+      };
+
+      user = mkOption {
+        default = "headscale";
+        type = types.str;
+        description = ''
+          User account under which headscale runs.
+          <note><para>
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the headscale service starts.
+          </para></note>
+        '';
+      };
+
+      group = mkOption {
+        default = "headscale";
+        type = types.str;
+        description = ''
+          Group under which headscale runs.
+          <note><para>
+          If left as the default value this group will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the headscale service starts.
+          </para></note>
+        '';
+      };
+
+      serverUrl = mkOption {
+        type = types.str;
+        default = "http://127.0.0.1:8080";
+        description = ''
+          The url clients will connect to.
+        '';
+        example = "https://myheadscale.example.com:443";
+      };
+
+      address = mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = ''
+          Listening address of headscale.
+        '';
+        example = "0.0.0.0";
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 8080;
+        description = ''
+          Listening port of headscale.
+        '';
+        example = 443;
+      };
+
+      privateKeyFile = mkOption {
+        type = types.path;
+        default = "${dataDir}/private.key";
+        description = ''
+          Path to private key file, generated automatically if it does not exist.
+        '';
+      };
+
+      derp = {
+        urls = mkOption {
+          type = types.listOf types.str;
+          default = [ "https://controlplane.tailscale.com/derpmap/default" ];
+          description = ''
+            List of urls containing DERP maps.
+            See <link xlink:href="https://tailscale.com/blog/how-tailscale-works/">How Tailscale works</link> for more information on DERP maps.
+          '';
+        };
+
+        paths = mkOption {
+          type = types.listOf types.path;
+          default = [ ];
+          description = ''
+            List of file paths containing DERP maps.
+            See <link xlink:href="https://tailscale.com/blog/how-tailscale-works/">How Tailscale works</link> for more information on DERP maps.
+          '';
+        };
+
+
+        autoUpdate = mkOption {
+          type = types.bool;
+          default = true;
+          description = ''
+            Whether to automatically update DERP maps on a set frequency.
+          '';
+          example = false;
+        };
+
+        updateFrequency = mkOption {
+          type = types.str;
+          default = "24h";
+          description = ''
+            Frequency to update DERP maps.
+          '';
+          example = "5m";
+        };
+
+      };
+
+      ephemeralNodeInactivityTimeout = mkOption {
+        type = types.str;
+        default = "30m";
+        description = ''
+          Time before an inactive ephemeral node is deleted.
+        '';
+        example = "5m";
+      };
+
+      database = {
+        type = mkOption {
+          type = types.enum [ "sqlite3" "postgres" ];
+          example = "postgres";
+          default = "sqlite3";
+          description = "Database engine to use.";
+        };
+
+        host = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          example = "127.0.0.1";
+          description = "Database host address.";
+        };
+
+        port = mkOption {
+          type = types.nullOr types.port;
+          default = null;
+          example = 3306;
+          description = "Database host port.";
+        };
+
+        name = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          example = "headscale";
+          description = "Database name.";
+        };
+
+        user = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          example = "headscale";
+          description = "Database user.";
+        };
+
+        passwordFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          example = "/run/keys/headscale-dbpassword";
+          description = ''
+            A file containing the password corresponding to
+            <option>database.user</option>.
+          '';
+        };
+
+        path = mkOption {
+          type = types.nullOr types.str;
+          default = "${dataDir}/db.sqlite";
+          description = "Path to the sqlite3 database file.";
+        };
+      };
+
+      logLevel = mkOption {
+        type = types.str;
+        default = "info";
+        description = ''
+          headscale log level.
+        '';
+        example = "debug";
+      };
+
+      dns = {
+        nameservers = mkOption {
+          type = types.listOf types.str;
+          default = [ "1.1.1.1" ];
+          description = ''
+            List of nameservers to pass to Tailscale clients.
+          '';
+        };
+
+        domains = mkOption {
+          type = types.listOf types.str;
+          default = [ ];
+          description = ''
+            Search domains to inject to Tailscale clients.
+          '';
+          example = [ "mydomain.internal" ];
+        };
+
+        magicDns = mkOption {
+          type = types.bool;
+          default = true;
+          description = ''
+            Whether to use [MagicDNS](https://tailscale.com/kb/1081/magicdns/).
+            Only works if there is at least a nameserver defined.
+          '';
+          example = false;
+        };
+
+        baseDomain = mkOption {
+          type = types.str;
+          default = "";
+          description = ''
+            Defines the base domain to create the hostnames for MagicDNS.
+            <option>baseDomain</option> must be a FQDNs, without the trailing dot.
+            The FQDN of the hosts will be
+            <literal>hostname.namespace.base_domain</literal> (e.g.
+            <literal>myhost.mynamespace.example.com</literal>).
+          '';
+        };
+      };
+
+      openIdConnect = {
+        issuer = mkOption {
+          type = types.str;
+          default = "";
+          description = ''
+            URL to OpenID issuer.
+          '';
+          example = "https://openid.example.com";
+        };
+
+        clientId = mkOption {
+          type = types.str;
+          default = "";
+          description = ''
+            OpenID Connect client ID.
+          '';
+        };
+
+        clientSecretFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          description = ''
+            Path to OpenID Connect client secret file.
+          '';
+        };
+
+        domainMap = mkOption {
+          type = types.attrsOf types.str;
+          default = { };
+          description = ''
+            Domain map is used to map incomming users (by their email) to
+            a namespace. The key can be a string, or regex.
+          '';
+          example = {
+            ".*" = "default-namespace";
+          };
+        };
+
+      };
+
+      tls = {
+        letsencrypt = {
+          hostname = mkOption {
+            type = types.nullOr types.str;
+            default = "";
+            description = ''
+              Domain name to request a TLS certificate for.
+            '';
+          };
+          challengeType = mkOption {
+            type = types.enum [ "TLS_ALPN-01" "HTTP-01" ];
+            default = "HTTP-01";
+            description = ''
+              Type of ACME challenge to use, currently supported types:
+              <literal>HTTP-01</literal> or <literal>TLS_ALPN-01</literal>.
+            '';
+          };
+          httpListen = mkOption {
+            type = types.nullOr types.str;
+            default = ":http";
+            description = ''
+              When HTTP-01 challenge is chosen, letsencrypt must set up a
+              verification endpoint, and it will be listening on:
+              <literal>:http = port 80</literal>.
+            '';
+          };
+        };
+
+        certFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          description = ''
+            Path to already created certificate.
+          '';
+        };
+        keyFile = mkOption {
+          type = types.nullOr types.path;
+          default = null;
+          description = ''
+            Path to key for already created certificate.
+          '';
+        };
+      };
+
+      aclPolicyFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = ''
+          Path to a file containg ACL policies.
+        '';
+      };
+
+      settings = mkOption {
+        type = settingsFormat.type;
+        default = { };
+        description = ''
+          Overrides to <filename>config.yaml</filename> as a Nix attribute set.
+          This option is ideal for overriding settings not exposed as Nix options.
+          Check the <link xlink:href="https://github.com/juanfont/headscale/blob/main/config-example.yaml">example config</link>
+          for possible options.
+        '';
+      };
+
+
+    };
+
+  };
+  config = mkIf cfg.enable {
+
+    services.headscale.settings = {
+      server_url = mkDefault cfg.serverUrl;
+      listen_addr = mkDefault "${cfg.address}:${toString cfg.port}";
+
+      private_key_path = mkDefault cfg.privateKeyFile;
+
+      derp = {
+        urls = mkDefault cfg.derp.urls;
+        paths = mkDefault cfg.derp.paths;
+        auto_update_enable = mkDefault cfg.derp.autoUpdate;
+        update_frequency = mkDefault cfg.derp.updateFrequency;
+      };
+
+      # Turn off update checks since the origin of our package
+      # is nixpkgs and not Github.
+      disable_check_updates = true;
+
+      ephemeral_node_inactivity_timeout = mkDefault cfg.ephemeralNodeInactivityTimeout;
+
+      db_type = mkDefault cfg.database.type;
+      db_path = mkDefault cfg.database.path;
+
+      log_level = mkDefault cfg.logLevel;
+
+      dns_config = {
+        nameservers = mkDefault cfg.dns.nameservers;
+        domains = mkDefault cfg.dns.domains;
+        magic_dns = mkDefault cfg.dns.magicDns;
+        base_domain = mkDefault cfg.dns.baseDomain;
+      };
+
+      unix_socket = "${runDir}/headscale.sock";
+
+      # OpenID Connect
+      oidc = {
+        issuer = mkDefault cfg.openIdConnect.issuer;
+        client_id = mkDefault cfg.openIdConnect.clientId;
+        domain_map = mkDefault cfg.openIdConnect.domainMap;
+      };
+
+      tls_letsencrypt_cache_dir = "${dataDir}/.cache";
+
+    } // optionalAttrs (cfg.database.host != null) {
+      db_host = mkDefault cfg.database.host;
+    } // optionalAttrs (cfg.database.port != null) {
+      db_port = mkDefault cfg.database.port;
+    } // optionalAttrs (cfg.database.name != null) {
+      db_name = mkDefault cfg.database.name;
+    } // optionalAttrs (cfg.database.user != null) {
+      db_user = mkDefault cfg.database.user;
+    } // optionalAttrs (cfg.tls.letsencrypt.hostname != null) {
+      tls_letsencrypt_hostname = mkDefault cfg.tls.letsencrypt.hostname;
+    } // optionalAttrs (cfg.tls.letsencrypt.challengeType != null) {
+      tls_letsencrypt_challenge_type = mkDefault cfg.tls.letsencrypt.challengeType;
+    } // optionalAttrs (cfg.tls.letsencrypt.httpListen != null) {
+      tls_letsencrypt_listen = mkDefault cfg.tls.letsencrypt.httpListen;
+    } // optionalAttrs (cfg.tls.certFile != null) {
+      tls_cert_path = mkDefault cfg.tls.certFile;
+    } // optionalAttrs (cfg.tls.keyFile != null) {
+      tls_key_path = mkDefault cfg.tls.keyFile;
+    } // optionalAttrs (cfg.aclPolicyFile != null) {
+      acl_policy_path = mkDefault cfg.aclPolicyFile;
+    };
+
+    # Setup the headscale configuration in a known path in /etc to
+    # allow both the Server and the Client use it to find the socket
+    # for communication.
+    environment.etc."headscale/config.yaml".source = configFile;
+
+    users.groups.headscale = mkIf (cfg.group == "headscale") { };
+
+    users.users.headscale = mkIf (cfg.user == "headscale") {
+      description = "headscale user";
+      home = dataDir;
+      group = cfg.group;
+      isSystemUser = true;
+    };
+
+    systemd.services.headscale = {
+      description = "headscale coordination server for Tailscale";
+      after = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ configFile ];
+
+      script = ''
+        ${optionalString (cfg.database.passwordFile != null) ''
+          export HEADSCALE_DB_PASS="$(head -n1 ${escapeShellArg cfg.database.passwordFile})"
+        ''}
+
+        export HEADSCALE_OIDC_CLIENT_SECRET="$(head -n1 ${escapeShellArg cfg.openIdConnect.clientSecretFile})"
+        exec ${cfg.package}/bin/headscale serve
+      '';
+
+      serviceConfig =
+        let
+          capabilityBoundingSet = [ "CAP_CHOWN" ] ++ optional (cfg.port < 1024) "CAP_NET_BIND_SERVICE";
+        in
+        {
+          Restart = "always";
+          Type = "simple";
+          User = cfg.user;
+          Group = cfg.group;
+
+          # Hardening options
+          RuntimeDirectory = "headscale";
+          # Allow headscale group access so users can be added and use the CLI.
+          RuntimeDirectoryMode = "0750";
+
+          StateDirectory = "headscale";
+          StateDirectoryMode = "0750";
+
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectKernelTunables = true;
+          ProtectControlGroups = true;
+          RestrictSUIDSGID = true;
+          PrivateMounts = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectHostname = true;
+          ProtectClock = true;
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+          RestrictNamespaces = true;
+          RemoveIPC = true;
+          UMask = "0077";
+
+          CapabilityBoundingSet = capabilityBoundingSet;
+          AmbientCapabilities = capabilityBoundingSet;
+          NoNewPrivileges = true;
+          LockPersonality = true;
+          RestrictRealtime = true;
+          SystemCallFilter = [ "@system-service" "~@priviledged" "@chown" ];
+          SystemCallArchitectures = "native";
+          RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
+        };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ kradalby ];
+}

pkgs/applications/misc/edgetx/default.nix

@@ -0,0 +1,47 @@
+{ lib, mkDerivation, fetchFromGitHub
+, cmake, gcc-arm-embedded, python3Packages
+, qtbase, qtmultimedia, qttranslations, SDL, gtest
+, dfu-util
+}:
+
+mkDerivation rec {
+  pname = "edgetx";
+  version = "2.6.0";
+
+  src = fetchFromGitHub {
+    owner = "EdgeTX";
+    repo = pname;
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-TffHFgr3g7v4VnNSSlLITz4cYjHM6wE0aI85W1g4IFA=";
+  };
+
+  nativeBuildInputs = [ cmake gcc-arm-embedded python3Packages.pillow ];
+
+  buildInputs = [ qtbase qtmultimedia qttranslations SDL ];
+
+  postPatch = ''
+    sed -i companion/src/burnconfigdialog.cpp \
+      -e 's|/usr/.*bin/dfu-util|${dfu-util}/bin/dfu-util|'
+  '';
+
+  cmakeFlags = [
+    "-DGTEST_ROOT=${gtest.src}/googletest"
+    "-DQT_TRANSLATIONS_DIR=${qttranslations}/translations"
+    "-DDFU_UTIL_PATH=${dfu-util}/bin/dfu-util"
+  ];
+
+  meta = with lib; {
+    description = "EdgeTX Companion transmitter support software";
+    longDescription = ''
+      EdgeTX Companion is used for many different tasks like loading EdgeTX
+      firmware to the radio, backing up model settings, editing settings and
+      running radio simulators.
+    '';
+    homepage = "https://edgetx.org/";
+    license = licenses.gpl2Only;
+    platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
+    maintainers = with maintainers; [ elitak lopsided98 wucke13 ];
+  };
+
+}

pkgs/applications/misc/etesync-dav/default.nix

@@ -1,20 +1,36 @@
-{ lib, stdenv, python3Packages, radicale3 }:
+{ lib
+, stdenv
+, python3
+, radicale3
+}:
 
-python3Packages.buildPythonApplication rec {
+let
+  python = python3.override {
+    packageOverrides = self: super: {
+      flask_wtf = super.flask_wtf.overridePythonAttrs (old: rec {
+        version = "0.15.1";
+        src = old.src.override {
+          inherit version;
+          sha256 = "ff177185f891302dc253437fe63081e7a46a4e99aca61dfe086fb23e54fff2dc";
+        };
+      });
+    };
+  };
+in python.pkgs.buildPythonApplication rec {
   pname = "etesync-dav";
-  version = "0.30.8";
+  version = "0.32.1";
 
-  src = python3Packages.fetchPypi {
+  src = python.pkgs.fetchPypi {
     inherit pname version;
-    sha256 = "sha256-HBLQsq3B6TMdcnUt8ukbk3+S0Ed44+gePkpuGZ2AyC4=";
+    sha256 = "a4e2ee83932755d29ac39c1e74005ec289880fd2d4d2164f09fe2464a294d720";
   };
 
-  propagatedBuildInputs = with python3Packages; [
+  propagatedBuildInputs = with python.pkgs; [
     etebase
     etesync
     flask
     flask_wtf
-    radicale3
+    (python.pkgs.toPythonModule (radicale3.override { python3 = python; }))
   ];
 
   doCheck = false;

pkgs/applications/misc/pdfstudio/default.nix

@@ -4,6 +4,10 @@
 , callPackage
 }:
 
+let makeurl = { pname, year, version }: "https://download.qoppa.com/${pname}/v${year}/${
+    builtins.replaceStrings [ "pdfstudio" "viewer" "." ] [ "PDFStudio" "Viewer" "_" ] "${pname}_v${version}"
+  }_linux64.deb";
+in
 {
   pdfstudio = callPackage ./common.nix rec {
     pname = program;
@@ -17,9 +21,7 @@
       libgccjit #for libstdc++.so.6 and libgomp.so.1
     ];
     src = fetchurl {
-      url = "https://download.qoppa.com/${pname}/v${year}/PDFStudio_v${
+      url = makeurl { inherit pname year version; };
-        builtins.replaceStrings [ "." ] [ "_" ] version
-        }_linux64.deb";
       sha256 = "1188ll2qz58rr2slavqxisbz4q3fdzidpasb1p33926z0ym3rk45";
     };
   };
@@ -33,9 +35,7 @@
       PDF Studio Viewer is an easy to use, full-featured PDF editing software. This is the free edition. For the standard/pro edition, see the package pdfstudio.
     '';
     src = fetchurl {
-      url = "https://download.qoppa.com/${pname}/v${year}/PDFStudioViewer_v${
+      url = makeurl { inherit pname year version; };
-          builtins.replaceStrings [ "." ] [ "_" ] version
-        }_linux64.deb";
       sha256 = "128k3fm8m8zdykx4s30g5m2zl7cgmvs4qinf1w525zh84v56agz6";
     };
   };

pkgs/applications/networking/irc/quassel/0001-common-Disable-enum-type-stream-operators-for-Qt-5.1.patch

@@ -1,37 +0,0 @@
-From ac9387271b2420a71f7d172f44354fc35adac504 Mon Sep 17 00:00:00 2001
-From: Manuel Nickschas <sputnick@quassel-irc.org>
-Date: Tue, 7 Jan 2020 18:34:54 +0100
-Subject: [PATCH] common: Disable enum type stream operators for Qt >= 5.14
-
-Starting from version 5.14, Qt provides stream operators for enum
-types, which collide with the ones we ship in types.h. Disable
-Quassel's stream operators when compiling against Qt 5.14 or later.
-
-(cherry-picked from 579e559a6322209df7cd51c34801fecff5fe734b)
----
- src/common/types.h | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/src/common/types.h b/src/common/types.h
-index 467d9fb2..c4b9f364 100644
---- a/src/common/types.h
-+++ b/src/common/types.h
-@@ -140,6 +140,7 @@ Q_DECLARE_METATYPE(QHostAddress)
- typedef QList<MsgId> MsgIdList;
- typedef QList<BufferId> BufferIdList;
- 
-+#if QT_VERSION < QT_VERSION_CHECK(5, 14, 0)
- /**
-  * Catch-all stream serialization operator for enum types.
-  *
-@@ -169,6 +170,7 @@ QDataStream &operator>>(QDataStream &in, T &value) {
-     value = static_cast<T>(v);
-     return in;
- }
-+#endif
- 
- // Exceptions
- 
--- 
-2.26.2
-

pkgs/applications/networking/irc/quassel/default.nix

@@ -5,7 +5,7 @@
 , static ? false # link statically
 
 , lib, stdenv, fetchFromGitHub, cmake, makeWrapper, dconf
-, mkDerivation, qtbase, qtscript
+, mkDerivation, qtbase, boost, zlib, qtscript
 , phonon, libdbusmenu, qca-qt5
 
 , withKDE ? true # enable KDE integration
@@ -33,27 +33,21 @@ let
 
 in (if !buildClient then stdenv.mkDerivation else mkDerivation) rec {
   pname = "quassel${tag}";
-  version = "0.13.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "quassel";
     repo = "quassel";
     rev = version;
-    sha256 = "0z8p7iv90yrrjbh31cyxhpr6hsynfmi23rlayn7p2f6ki5az7yc3";
+    sha256 = "sha256-eulhNcyCmy9ryietOhT2yVJeJH+MMZRbTUo2XuTy9qU=";
   };
 
-  patches = [
-    # fixes build with Qt 5.14
-    # source: https://github.com/quassel/quassel/pull/518/commits/8a46d983fc99204711cdff1e4c542e272fef45b9
-    ./0001-common-Disable-enum-type-stream-operators-for-Qt-5.1.patch
-  ];
-
   # Prevent ``undefined reference to `qt_version_tag''' in SSL check
   NIX_CFLAGS_COMPILE = "-DQT_NO_VERSION_TAGGING=1";
 
   nativeBuildInputs = [ cmake makeWrapper ];
-  buildInputs = [ qtbase ]
+  buildInputs = [ qtbase boost zlib ]
-    ++ lib.optionals buildCore [qtscript qca-qt5]
+    ++ lib.optionals buildCore [qtscript qca-qt5 ]
     ++ lib.optionals buildClient [libdbusmenu phonon]
     ++ lib.optionals (buildClient && withKDE) [
       extra-cmake-modules kconfigwidgets kcoreaddons

pkgs/applications/science/physics/shtns/default.nix

@@ -0,0 +1,22 @@
+{ lib, stdenv, fetchgit, fftw }:
+
+stdenv.mkDerivation rec {
+  pname = "shtns";
+  version = "3.5.1";
+
+  src = fetchgit {
+    url = "https://bitbucket.org/nschaeff/shtns";
+    rev = "v${version}";
+    sha256 = "1ajrplhv7a2dvb3cn3n638281w0bzdcydvvwbg64awbjg622mdpd";
+  };
+
+  buildInputs = [ fftw ];
+
+  meta = with lib; {
+    description = "High performance library for Spherical Harmonic Transform";
+    homepage = "https://nschaeff.bitbucket.io/shtns/";
+    license = licenses.cecill21;
+    maintainers = [ maintainers.bzizou ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/window-managers/spectrwm/default.nix

@@ -22,9 +22,9 @@ stdenv.mkDerivation {
     xcbutilwm
   ];
 
-  sourceRoot = let
+  prePatch = let
     subdir = if stdenv.isDarwin then "osx" else "linux";
-  in "source/${subdir}";
+  in "cd ${subdir}";
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 

pkgs/development/php-packages/maxminddb/default.nix

@@ -13,8 +13,11 @@ buildPecl {
     sha256 = "sha256-Dw1+pYJmZ3U2+rgSOEkx4a6HB8FebSr7YZodOjSipjI=";
   };
 
+  prePatch = ''
+    cd ext
+  '';
+
   buildInputs = [ libmaxminddb ];
-  sourceRoot = "source/ext";
 
   meta = with lib; {
     description = "C extension that is a drop-in replacement for MaxMind\\Db\\Reader";

pkgs/development/tools/confluent-cli/default.nix

@@ -0,0 +1,42 @@
+{ stdenv, autoPatchelfHook, fetchurl, lib }:
+
+stdenv.mkDerivation rec {
+  pname = "confluent-cli";
+  version = "2.4.0";
+
+  # To get the latest version:
+  # curl -L https://cnfl.io/cli | sh -s -- -l | grep -v latest | sort -V | tail -n1
+  src = fetchurl (if stdenv.hostPlatform.isDarwin then {
+      url = "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/${version}/confluent_v${version}_darwin_amd64.tar.gz";
+      sha256 = "1xkf7p9cn37k8j57cgbzxhqgnmchf86jyiza91bf6ddvm6jsm2gd";
+    } else {
+      url = "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/${version}/confluent_v${version}_linux_amd64.tar.gz";
+      sha256 = "1wvy7x56cc7imycf0d83mxcqzdvv56cc0zbp913xgghjn9dl2z7a";
+    });
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  dontStrip = stdenv.isDarwin;
+
+  installPhase = ''
+    mkdir -p $out/{bin,share/doc/confluent-cli}
+    cp confluent $out/bin/
+    cp LICENSE $out/share/doc/confluent-cli/
+    cp -r legal $out/share/doc/confluent-cli/
+  '';
+
+  meta = with lib; {
+    description = "Confluent CLI";
+    homepage = "https://docs.confluent.io/confluent-cli/current/overview.html";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ rguevara84 ];
+
+    # TODO: There's support for i686 systems but I do not have any such system
+    # to build it locally on, it's also unfree so I cannot rely on ofborg to
+    # build it. Get the list of supported system by looking at the list of
+    # files in the S3 bucket:
+    #
+    #   https://s3-us-west-2.amazonaws.com/confluent.cloud?prefix=confluent-cli/archives/1.25.0/&delimiter=/%27
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+  };
+}

pkgs/misc/emulators/wxmupen64plus/default.nix

@@ -1,32 +0,0 @@
-{ lib, stdenv, fetchurl, python2, wxGTK29, mupen64plus, SDL, libX11, libGLU, libGL
-, wafHook }:
-
-stdenv.mkDerivation rec {
-  pname = "wxmupen64plus";
-  version = "0.3";
-
-  src = fetchurl {
-    url = "https://bitbucket.org/auria/wxmupen64plus/get/${version}.tar.bz2";
-    sha256 = "1mnxi4k011dd300k35li2p6x4wccwi6im21qz8dkznnz397ps67c";
-  };
-
-  nativeBuildInputs = [ wafHook ];
-  buildInputs = [ python2 wxGTK29 SDL libX11 libGLU libGL ];
-
-  preConfigure = ''
-    tar xf ${mupen64plus.src}
-    APIDIR=$(eval echo `pwd`/mupen64plus*/source/mupen64plus-core/src/api)
-    export CXXFLAGS="-I${libX11.dev}/include/X11 -DLIBDIR=\\\"${mupen64plus}/lib/\\\""
-    export LDFLAGS="-lwx_gtk2u_adv-2.9"
-
-    wafConfigureFlagsArray+=("--mupenapi=$APIDIR" "--wxconfig=`type -P wx-config`")
-  '';
-
-  NIX_CFLAGS_COMPILE = "-fpermissive";
-
-  meta = {
-    description = "GUI for the Mupen64Plus 2.0 emulator";
-    license = lib.licenses.gpl2Plus;
-    homepage = "https://bitbucket.org/auria/wxmupen64plus/wiki/Home";
-  };
-}

pkgs/misc/vim-plugins/overrides.nix

@@ -796,7 +796,7 @@ self: super: {
             libiconv
           ];
 
-          cargoSha256 = "sha256-4VXXQjGmGGQXgfzSOvFnQS+iQjidj0FjaNKZ3VzBqw0=";
+          cargoSha256 = "sha256-y4yQ8Zv9bpfOyQrBX/TAuVYHhDsXdj0rh8nHJonxgcU=";
         };
       in
       ''

pkgs/misc/vim-plugins/vim-plugin-names

@@ -203,7 +203,6 @@ github/copilot.vim
 gleam-lang/gleam.vim
 glepnir/dashboard-nvim
 glepnir/galaxyline.nvim
-glepnir/lspsaga.nvim
 glepnir/oceanic-material
 glepnir/zephyr-nvim
 glts/vim-textobj-comment
@@ -779,6 +778,7 @@ tamago324/compe-zsh
 tamago324/lir.nvim
 tami5/compe-conjure
 tami5/lispdocs.nvim
+tami5/lspsaga.nvim
 tami5/sqlite.lua
 tbastos/vim-lua
 tbodt/deoplete-tabnine

pkgs/os-specific/linux/numatop/default.nix

@@ -1,17 +1,32 @@
-{ lib, stdenv, fetchurl, pkg-config, numactl, ncurses, check }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, autoreconfHook, pkg-config, numactl, ncurses, check }:
 
 stdenv.mkDerivation rec {
   pname = "numatop";
-  version = "2.1";
+  version = "2.2";
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://github.com/intel/${pname}/releases/download/v${version}/${pname}-v${version}.tar.xz";
+    owner = "intel";
-    sha256 = "1s7psq1xyswj0lpx10zg5lnppav2xy9safkfx3rssrs9c2fp5d76";
+    repo = "numatop";
+    rev = "v${version}";
+    sha256 = "sha256-GJvTwqgx34ZW10eIJj/xiKe3ZkAfs7GlJImz8jrnjfI=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
   buildInputs = [ numactl ncurses ];
   checkInputs = [ check ];
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/intel/numatop/pull/54.patch";
+      sha256 = "sha256-TbMLv7TT9T8wE4uJ1a/AroyPPwrwL0eX5IBLsh9GTTM=";
+      name = "fix-string-operations.patch";
+    })
+    (fetchpatch {
+      url = "https://github.com/intel/numatop/pull/64.patch";
+      sha256 = "sha256-IevbSFJRTS5iQ5apHOVXzF67f3LJaW6j7DySFmVuyiM=";
+      name = "fix-format-strings-mvwprintw.patch";
+    })
+  ];
+
   doCheck  = true;
 
   meta = with lib; {
@@ -20,8 +35,8 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     maintainers = with maintainers; [ dtzWill ];
     platforms = [
-      { kernel.name = "linux"; cpu.family = "x86"; }
+      "i686-linux" "x86_64-linux"
-      { kernel.name = "linux"; cpu.family = "power"; }
+      "powerpc64-linux" "powerpc64le-linux"
     ];
   };
 }

pkgs/servers/radicale/3.x.nix

@@ -2,13 +2,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "radicale";
-  version = "3.1.0";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "Kozea";
     repo = "Radicale";
     rev = "v${version}";
-    hash = "sha256-LtPv+3FQMGC2YP2+1cSPZVUIzrUhteJTl58+JdvGcQg=";
+    hash = "sha256-a1oapCktJPvNO+MTsB9COtxSFB/ZIZvJiuqX+s+lncY=";
   };
 
   postPatch = ''
@@ -36,6 +36,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://radicale.org/v3.html";
     description = "CalDAV and CardDAV server";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ dotlambda ];
+    maintainers = with maintainers; [ dotlambda erictapen ];
   };
 }

pkgs/tools/audio/abcmidi/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "abcMIDI";
-  version = "2022.01.13";
+  version = "2022.01.28";
 
   src = fetchzip {
     url = "https://ifdo.ca/~seymour/runabc/${pname}-${version}.zip";
-    hash = "sha256-jXXUdPAmU6JcnqWBnzc9tfjEyLSdYxZZJh4w4iSCD1w=";
+    hash = "sha256-+g5oKUfm6vRuRQfOx0QDueYMabgScL8Mfw5GJcXQztg=";
   };
 
   meta = with lib; {

pkgs/tools/security/spire/default.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "spire";
-  version = "1.1.2";
+  version = "1.2.0";
 
   outputs = [ "out" "agent" "server" ];
 
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "spiffe";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MX2kbdLj72S2WBceUW/3ps34Bcsf/VArK8RN4r13wQY=";
+    sha256 = "01ph9jzh18bnidrsbnnxm3gxh0cgfllnjvf7a5haqz51lm6a9pny";
   };
 
-  vendorSha256 = "sha256-ZRcXMNKhNY3W5fV9q/V7xsnODoG6KWHrzpWte9hx/Ms=";
+  vendorSha256 = "17d845lwlbk19lsc937c22b1l0ikimhlagknm2i7mn8s8xrs57q8";
 
   subPackages = [ "cmd/spire-agent" "cmd/spire-server" ];
 

pkgs/top-level/aliases.nix

@@ -1098,6 +1098,7 @@ mapAliases ({
   winswitch = throw "winswitch has been removed from nixpkgs."; # added 2019-12-10
   wireshark-gtk = throw "wireshark-gtk is not supported anymore. Use wireshark-qt or wireshark-cli instead."; # added 2019-11-18
   wireguard = wireguard-tools; # added 2018-05-19
+  wxmupen64plus = throw "wxmupen64plus was removed because the upstream disappeared."; # 2022-01-31
   morituri = whipper; # added 2018-09-13
   xbmc-retroarch-advanced-launchers = kodi-retroarch-advanced-launchers; # added 2021-11-19
   xp-pen-g430 = pentablet-driver; # added 2020-05-03

pkgs/top-level/all-packages.nix

@@ -15018,6 +15018,8 @@ with pkgs;
 
   ccloud-cli = callPackage ../development/tools/ccloud-cli { };
 
+  confluent-cli = callPackage ../development/tools/confluent-cli { };
+
   htmlunit-driver = callPackage ../development/tools/selenium/htmlunit-driver { };
 
   hyenae = callPackage ../tools/networking/hyenae { };
@@ -27481,6 +27483,8 @@ with pkgs;
 
   mozjpeg = callPackage ../applications/graphics/mozjpeg { };
 
+  edgetx = libsForQt5.callPackage ../applications/misc/edgetx { };
+
   easytag = callPackage ../applications/audio/easytag { };
 
   mp3gain = callPackage ../applications/audio/mp3gain { };
@@ -32304,6 +32308,8 @@ with pkgs;
 
   sherpa = callPackage ../applications/science/physics/sherpa {};
 
+  shtns = callPackage ../applications/science/physics/shtns { };
+
   xfitter = callPackage ../applications/science/physics/xfitter {};
 
   xflr5 = libsForQt5.callPackage ../applications/science/physics/xflr5 { };
@@ -34120,8 +34126,6 @@ with pkgs;
 
   wraith = callPackage ../applications/networking/irc/wraith { };
 
-  wxmupen64plus = callPackage ../misc/emulators/wxmupen64plus { };
-
   wxsqlite3 = callPackage ../development/libraries/wxsqlite3 {
     wxGTK = wxGTK30;
     inherit (darwin.apple_sdk.frameworks) Cocoa;

pkgs/top-level/perl-packages.nix

@@ -729,11 +729,20 @@ let
 
   Appcpanminus = buildPerlPackage {
     pname = "App-cpanminus";
-    version = "1.7044";
+    version = "1.7045";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/App-cpanminus-1.7044.tar.gz";
+      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/App-cpanminus-1.7045.tar.gz";
-      sha256 = "9b60767fe40752ef7a9d3f13f19060a63389a5c23acc3e9827e19b75500f81f3";
+      sha256 = "1779w07zxlgfk35s24ksr7k9azd5yl8sbb48y1aaph7y4gf4lkmc";
     };
+    # Use TLS endpoints for downloads and metadata by default
+    preConfigure = ''
+      substituteInPlace bin/cpanm \
+        --replace http://www.cpan.org https://www.cpan.org \
+        --replace http://backpan.perl.org https://backpan.perl.org \
+        --replace http://fastapi.metacpan.org https://fastapi.metacpan.org \
+        --replace http://cpanmetadb.plackperl.org https://cpanmetadb.plackperl.org
+    '';
+    propagatedBuildInputs = [ IOSocketSSL ];
     meta = {
       homepage = "https://github.com/miyagawa/cpanminus";
       description = "Get, unpack, build and install modules from CPAN";