Merge master into haskell-updates

2021-10-08 00:06:49 +00:00 · 2021-10-08 00:06:49 +00:00 · 0fc3fc4b17
commit 0fc3fc4b17
parent a5ad1bc37f 42142a6a2a
224 changed files with 3886 additions and 12068 deletions
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@ -373,11 +373,11 @@ Additional file types can be supported by setting the `unpackCmd` variable (see

 ##### `srcs` / `src` {#var-stdenv-src}

-The list of source files or directories to be unpacked or copied. One of these must be set.
+The list of source files or directories to be unpacked or copied. One of these must be set. Note that if you use `srcs`, you should also set `sourceRoot` or `setSourceRoot`.

 ##### `sourceRoot` {#var-stdenv-sourceRoot}

-After running `unpackPhase`, the generic builder changes the current directory to the directory created by unpacking the sources. If there are multiple source directories, you should set `sourceRoot` to the name of the intended directory.
+After running `unpackPhase`, the generic builder changes the current directory to the directory created by unpacking the sources. If there are multiple source directories, you should set `sourceRoot` to the name of the intended directory. Set `sourceRoot = ".";` if you use `srcs` and control the unpack phase yourself.

 ##### `setSourceRoot` {#var-stdenv-setSourceRoot}

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -7377,6 +7377,12 @@
    githubId = 7610974;
    name = "Jason Miller";
  };
+  milogert = {
+    email = "milo@milogert.com";
+    github = "milogert";
+    githubId = 5378535;
+    name = "Milo Gertjejansen";
+  };
  miltador = {
    email = "miltador@yandex.ua";
    name = "Vasiliy Solovey";
@ -12245,6 +12251,12 @@
    githubId = 4113027;
    name = "Jesper Geertsen Jonsson";
  };
+  yinfeng = {
+    email = "lin.yinfeng@outlook.com";
+    github = "linyinfeng";
+    githubId = 11229748;
+    name = "Lin Yinfeng";
+  };
  ylwghst = {
    email = "ylwghst@onionmail.info";
    github = "ylwghst";
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -321,6 +321,14 @@
          <link linkend="opt-programs.pantheon-tweaks.enable">programs.pantheon-tweaks</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://github.com/DanielOgorchock/joycond">joycond</link>,
+          a service that uses <literal>hid-nintendo</literal> to provide
+          nintendo joycond pairing and better nintendo switch pro
+          controller support.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-21.11-incompatibilities">
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -99,6 +99,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [pantheon-tweaks](https://github.com/pantheon-tweaks/pantheon-tweaks), an unofficial system settings panel for Pantheon. Available as [programs.pantheon-tweaks](#opt-programs.pantheon-tweaks.enable).

+- [joycond](https://github.com/DanielOgorchock/joycond), a service that uses `hid-nintendo` to provide nintendo joycond pairing and better nintendo switch pro controller support.
+
 ## Backward Incompatibilities {#sec-release-21.11-incompatibilities}

 - The `security.wrappers` option now requires to always specify an owner, group and whether the setuid/setgid bit should be set.
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@ -21,7 +21,6 @@ import shutil
 import socket
 import subprocess
 import sys
-import telnetlib
 import tempfile
 import time
 import unicodedata
@ -89,55 +88,6 @@ CHAR_TO_KEY = {
    ")": "shift-0x0B",
 }

-global log, machines, test_script
-
-
-def eprint(*args: object, **kwargs: Any) -> None:
-    print(*args, file=sys.stderr, **kwargs)
-
-
-def make_command(args: list) -> str:
-    return " ".join(map(shlex.quote, (map(str, args))))
-
-
-def create_vlan(vlan_nr: str) -> Tuple[str, str, "subprocess.Popen[bytes]", Any]:
-    log.log("starting VDE switch for network {}".format(vlan_nr))
-    vde_socket = tempfile.mkdtemp(
-        prefix="nixos-test-vde-", suffix="-vde{}.ctl".format(vlan_nr)
-    )
-    pty_master, pty_slave = pty.openpty()
-    vde_process = subprocess.Popen(
-        ["vde_switch", "-s", vde_socket, "--dirmode", "0700"],
-        stdin=pty_slave,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
-        shell=False,
-    )
-    fd = os.fdopen(pty_master, "w")
-    fd.write("version\n")
-    # TODO: perl version checks if this can be read from
-    # an if not, dies. we could hang here forever. Fix it.
-    assert vde_process.stdout is not None
-    vde_process.stdout.readline()
-    if not os.path.exists(os.path.join(vde_socket, "ctl")):
-        raise Exception("cannot start vde_switch")
-
-    return (vlan_nr, vde_socket, vde_process, fd)
-
-
-def retry(fn: Callable, timeout: int = 900) -> None:
-    """Call the given function repeatedly, with 1 second intervals,
-    until it returns True or a timeout is reached.
-    """
-
-    for _ in range(timeout):
-        if fn(False):
-            return
-        time.sleep(1)
-
-    if not fn(True):
-        raise Exception(f"action timed out after {timeout} seconds")
-

 class Logger:
    def __init__(self) -> None:
@ -151,6 +101,10 @@ class Logger:

        self._print_serial_logs = True

+    @staticmethod
+    def _eprint(*args: object, **kwargs: Any) -> None:
+        print(*args, file=sys.stderr, **kwargs)
+
    def close(self) -> None:
        self.xml.endElement("logfile")
        self.xml.endDocument()
@ -169,15 +123,27 @@ class Logger:
        self.xml.characters(message)
        self.xml.endElement("line")

+    def info(self, *args, **kwargs) -> None:  # type: ignore
+        self.log(*args, **kwargs)
+
+    def warning(self, *args, **kwargs) -> None:  # type: ignore
+        self.log(*args, **kwargs)
+
+    def error(self, *args, **kwargs) -> None:  # type: ignore
+        self.log(*args, **kwargs)
+        sys.exit(1)
+
    def log(self, message: str, attributes: Dict[str, str] = {}) -> None:
-        eprint(self.maybe_prefix(message, attributes))
+        self._eprint(self.maybe_prefix(message, attributes))
        self.drain_log_queue()
        self.log_line(message, attributes)

    def log_serial(self, message: str, machine: str) -> None:
        self.enqueue({"msg": message, "machine": machine, "type": "serial"})
        if self._print_serial_logs:
-            eprint(Style.DIM + "{} # {}".format(machine, message) + Style.RESET_ALL)
+            self._eprint(
+                Style.DIM + "{} # {}".format(machine, message) + Style.RESET_ALL
+            )

    def enqueue(self, item: Dict[str, str]) -> None:
        self.queue.put(item)
@ -194,7 +160,7 @@ class Logger:

    @contextmanager
    def nested(self, message: str, attributes: Dict[str, str] = {}) -> Iterator[None]:
-        eprint(self.maybe_prefix(message, attributes))
+        self._eprint(self.maybe_prefix(message, attributes))

        self.xml.startElement("nest", attrs={})
        self.xml.startElement("head", attributes)
@ -211,6 +177,27 @@ class Logger:
        self.xml.endElement("nest")


+rootlog = Logger()
+
+
+def make_command(args: list) -> str:
+    return " ".join(map(shlex.quote, (map(str, args))))
+
+
+def retry(fn: Callable, timeout: int = 900) -> None:
+    """Call the given function repeatedly, with 1 second intervals,
+    until it returns True or a timeout is reached.
+    """
+
+    for _ in range(timeout):
+        if fn(False):
+            return
+        time.sleep(1)
+
+    if not fn(True):
+        raise Exception(f"action timed out after {timeout} seconds")
+
+
 def _perform_ocr_on_screenshot(
    screenshot_path: str, model_ids: Iterable[int]
 ) -> List[str]:
@ -242,113 +229,256 @@ def _perform_ocr_on_screenshot(
    return model_results


+class StartCommand:
+    """The Base Start Command knows how to append the necesary
+    runtime qemu options as determined by a particular test driver
+    run. Any such start command is expected to happily receive and
+    append additional qemu args.
+    """
+
+    _cmd: str
+
+    def cmd(
+        self,
+        monitor_socket_path: pathlib.Path,
+        shell_socket_path: pathlib.Path,
+        allow_reboot: bool = False,  # TODO: unused, legacy?
+    ) -> str:
+        display_opts = ""
+        display_available = any(x in os.environ for x in ["DISPLAY", "WAYLAND_DISPLAY"])
+        if not display_available:
+            display_opts += " -nographic"
+
+        # qemu options
+        qemu_opts = ""
+        qemu_opts += (
+            ""
+            if allow_reboot
+            else " -no-reboot"
+            " -device virtio-serial"
+            " -device virtconsole,chardev=shell"
+            " -device virtio-rng-pci"
+            " -serial stdio"
+        )
+        # TODO: qemu script already catpures this env variable, legacy?
+        qemu_opts += " " + os.environ.get("QEMU_OPTS", "")
+
+        return (
+            f"{self._cmd}"
+            f" -monitor unix:{monitor_socket_path}"
+            f" -chardev socket,id=shell,path={shell_socket_path}"
+            f"{qemu_opts}"
+            f"{display_opts}"
+        )
+
+    @staticmethod
+    def build_environment(
+        state_dir: pathlib.Path,
+        shared_dir: pathlib.Path,
+    ) -> dict:
+        # We make a copy to not update the current environment
+        env = dict(os.environ)
+        env.update(
+            {
+                "TMPDIR": str(state_dir),
+                "SHARED_DIR": str(shared_dir),
+                "USE_TMPDIR": "1",
+            }
+        )
+        return env
+
+    def run(
+        self,
+        state_dir: pathlib.Path,
+        shared_dir: pathlib.Path,
+        monitor_socket_path: pathlib.Path,
+        shell_socket_path: pathlib.Path,
+    ) -> subprocess.Popen:
+        return subprocess.Popen(
+            self.cmd(monitor_socket_path, shell_socket_path),
+            stdin=subprocess.DEVNULL,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.STDOUT,
+            shell=True,
+            cwd=state_dir,
+            env=self.build_environment(state_dir, shared_dir),
+        )
+
+
+class NixStartScript(StartCommand):
+    """A start script from nixos/modules/virtualiation/qemu-vm.nix
+    that also satisfies the requirement of the BaseStartCommand.
+    These Nix commands have the particular charactersitic that the
+    machine name can be extracted out of them via a regex match.
+    (Admittedly a _very_ implicit contract, evtl. TODO fix)
+    """
+
+    def __init__(self, script: str):
+        self._cmd = script
+
+    @property
+    def machine_name(self) -> str:
+        match = re.search("run-(.+)-vm$", self._cmd)
+        name = "machine"
+        if match:
+            name = match.group(1)
+        return name
+
+
+class LegacyStartCommand(StartCommand):
+    """Used in some places to create an ad-hoc machine instead of
+    using nix test instrumentation + module system for that purpose.
+    Legacy.
+    """
+
+    def __init__(
+        self,
+        netBackendArgs: Optional[str] = None,
+        netFrontendArgs: Optional[str] = None,
+        hda: Optional[Tuple[pathlib.Path, str]] = None,
+        cdrom: Optional[str] = None,
+        usb: Optional[str] = None,
+        bios: Optional[str] = None,
+        qemuFlags: Optional[str] = None,
+    ):
+        self._cmd = "qemu-kvm -m 384"
+
+        # networking
+        net_backend = "-netdev user,id=net0"
+        net_frontend = "-device virtio-net-pci,netdev=net0"
+        if netBackendArgs is not None:
+            net_backend += "," + netBackendArgs
+        if netFrontendArgs is not None:
+            net_frontend += "," + netFrontendArgs
+        self._cmd += f" {net_backend} {net_frontend}"
+
+        # hda
+        hda_cmd = ""
+        if hda is not None:
+            hda_path = hda[0].resolve()
+            hda_interface = hda[1]
+            if hda_interface == "scsi":
+                hda_cmd += (
+                    f" -drive id=hda,file={hda_path},werror=report,if=none"
+                    " -device scsi-hd,drive=hda"
+                )
+            else:
+                hda_cmd += f" -drive file={hda_path},if={hda_interface},werror=report"
+        self._cmd += hda_cmd
+
+        # cdrom
+        if cdrom is not None:
+            self._cmd += f" -cdrom {cdrom}"
+
+        # usb
+        usb_cmd = ""
+        if usb is not None:
+            # https://github.com/qemu/qemu/blob/master/docs/usb2.txt
+            usb_cmd += (
+                " -device usb-ehci"
+                f" -drive id=usbdisk,file={usb},if=none,readonly"
+                " -device usb-storage,drive=usbdisk "
+            )
+        self._cmd += usb_cmd
+
+        # bios
+        if bios is not None:
+            self._cmd += f" -bios {bios}"
+
+        # qemu flags
+        if qemuFlags is not None:
+            self._cmd += f" {qemuFlags}"
+
+
 class Machine:
+    """A handle to the machine with this name, that also knows how to manage
+    the machine lifecycle with the help of a start script / command."""
+
+    name: str
+    tmp_dir: pathlib.Path
+    shared_dir: pathlib.Path
+    state_dir: pathlib.Path
+    monitor_path: pathlib.Path
+    shell_path: pathlib.Path
+
+    start_command: StartCommand
+    keep_vm_state: bool
+    allow_reboot: bool
+
+    process: Optional[subprocess.Popen] = None
+    pid: Optional[int] = None
+    monitor: Optional[socket.socket] = None
+    shell: Optional[socket.socket] = None
+
+    booted: bool = False
+    connected: bool = False
+    # Store last serial console lines for use
+    # of wait_for_console_text
+    last_lines: Queue = Queue()
+
    def __repr__(self) -> str:
        return f"<Machine '{self.name}'>"

-    def __init__(self, args: Dict[str, Any]) -> None:
-        if "name" in args:
-            self.name = args["name"]
-        else:
-            self.name = "machine"
-            cmd = args.get("startCommand", None)
-            if cmd:
-                match = re.search("run-(.+)-vm$", cmd)
-                if match:
-                    self.name = match.group(1)
-        self.logger = args["log"]
-        self.script = args.get("startCommand", self.create_startcommand(args))
+    def __init__(
+        self,
+        tmp_dir: pathlib.Path,
+        start_command: StartCommand,
+        name: str = "machine",
+        keep_vm_state: bool = False,
+        allow_reboot: bool = False,
+    ) -> None:
+        self.tmp_dir = tmp_dir
+        self.keep_vm_state = keep_vm_state
+        self.allow_reboot = allow_reboot
+        self.name = name
+        self.start_command = start_command

-        tmp_dir = os.environ.get("TMPDIR", tempfile.gettempdir())
+        # set up directories
+        self.shared_dir = self.tmp_dir / "shared-xchg"
+        self.shared_dir.mkdir(mode=0o700, exist_ok=True)

-        def create_dir(name: str) -> str:
-            path = os.path.join(tmp_dir, name)
-            os.makedirs(path, mode=0o700, exist_ok=True)
-            return path
-
-        self.state_dir = os.path.join(tmp_dir, f"vm-state-{self.name}")
-        if not args.get("keepVmState", False):
+        self.state_dir = self.tmp_dir / f"vm-state-{self.name}"
+        self.monitor_path = self.state_dir / "monitor"
+        self.shell_path = self.state_dir / "shell"
+        if (not self.keep_vm_state) and self.state_dir.exists():
            self.cleanup_statedir()
-        os.makedirs(self.state_dir, mode=0o700, exist_ok=True)
-        self.shared_dir = create_dir("shared-xchg")
-
-        self.booted = False
-        self.connected = False
-        self.pid: Optional[int] = None
-        self.socket = None
-        self.monitor: Optional[socket.socket] = None
-        self.allow_reboot = args.get("allowReboot", False)
+        self.state_dir.mkdir(mode=0o700, exist_ok=True)

    @staticmethod
-    def create_startcommand(args: Dict[str, str]) -> str:
-        net_backend = "-netdev user,id=net0"
-        net_frontend = "-device virtio-net-pci,netdev=net0"
-
-        if "netBackendArgs" in args:
-            net_backend += "," + args["netBackendArgs"]
-
-        if "netFrontendArgs" in args:
-            net_frontend += "," + args["netFrontendArgs"]
-
-        start_command = (
-            args.get("qemuBinary", "qemu-kvm")
-            + " -m 384 "
-            + net_backend
-            + " "
-            + net_frontend
-            + " $QEMU_OPTS "
+    def create_startcommand(args: Dict[str, str]) -> StartCommand:
+        rootlog.warning(
+            "Using legacy create_startcommand(),"
+            "please use proper nix test vm instrumentation, instead"
+            "to generate the appropriate nixos test vm qemu startup script"
+        )
+        hda = None
+        if args.get("hda"):
+            hda_arg: str = args.get("hda", "")
+            hda_arg_path: pathlib.Path = pathlib.Path(hda_arg)
+            hda = (hda_arg_path, args.get("hdaInterface", ""))
+        return LegacyStartCommand(
+            netBackendArgs=args.get("netBackendArgs"),
+            netFrontendArgs=args.get("netFrontendArgs"),
+            hda=hda,
+            cdrom=args.get("cdrom"),
+            usb=args.get("usb"),
+            bios=args.get("bios"),
+            qemuFlags=args.get("qemuFlags"),
        )
-
-        if "hda" in args:
-            hda_path = os.path.abspath(args["hda"])
-            if args.get("hdaInterface", "") == "scsi":
-                start_command += (
-                    "-drive id=hda,file="
-                    + hda_path
-                    + ",werror=report,if=none "
-                    + "-device scsi-hd,drive=hda "
-                )
-            else:
-                start_command += (
-                    "-drive file="
-                    + hda_path
-                    + ",if="
-                    + args["hdaInterface"]
-                    + ",werror=report "
-                )
-
-        if "cdrom" in args:
-            start_command += "-cdrom " + args["cdrom"] + " "
-
-        if "usb" in args:
-            # https://github.com/qemu/qemu/blob/master/docs/usb2.txt
-            start_command += (
-                "-device usb-ehci -drive "
-                + "id=usbdisk,file="
-                + args["usb"]
-                + ",if=none,readonly "
-                + "-device usb-storage,drive=usbdisk "
-            )
-        if "bios" in args:
-            start_command += "-bios " + args["bios"] + " "
-
-        start_command += args.get("qemuFlags", "")
-
-        return start_command

    def is_up(self) -> bool:
        return self.booted and self.connected

    def log(self, msg: str) -> None:
-        self.logger.log(msg, {"machine": self.name})
+        rootlog.log(msg, {"machine": self.name})

    def log_serial(self, msg: str) -> None:
-        self.logger.log_serial(msg, self.name)
+        rootlog.log_serial(msg, self.name)

    def nested(self, msg: str, attrs: Dict[str, str] = {}) -> _GeneratorContextManager:
        my_attrs = {"machine": self.name}
        my_attrs.update(attrs)
-        return self.logger.nested(msg, my_attrs)
+        return rootlog.nested(msg, my_attrs)

    def wait_for_monitor_prompt(self) -> str:
        assert self.monitor is not None
@ -446,6 +576,7 @@ class Machine:
        self.connect()

        out_command = "( set -euo pipefail; {} ); echo '|!=EOF' $?\n".format(command)
+        assert self.shell
        self.shell.send(out_command.encode())

        output = ""
@ -466,6 +597,8 @@ class Machine:
        Should only be used during test development, not in the production test."""
        self.connect()
        self.log("Terminal is ready (there is no prompt):")
+
+        assert self.shell
        subprocess.run(
            ["socat", "READLINE", f"FD:{self.shell.fileno()}"],
            pass_fds=[self.shell.fileno()],
@ -534,6 +667,7 @@ class Machine:

        with self.nested("waiting for the VM to power off"):
            sys.stdout.flush()
+            assert self.process
            self.process.wait()

            self.pid = None
@ -611,6 +745,8 @@ class Machine:
        with self.nested("waiting for the VM to finish booting"):
            self.start()

+            assert self.shell
+
            tic = time.time()
            self.shell.recv(1024)
            # TODO: Timeout
@ -750,65 +886,35 @@ class Machine:

        self.log("starting vm")

-        def create_socket(path: str) -> socket.socket:
-            if os.path.exists(path):
-                os.unlink(path)
+        def clear(path: pathlib.Path) -> pathlib.Path:
+            if path.exists():
+                path.unlink()
+            return path
+
+        def create_socket(path: pathlib.Path) -> socket.socket:
            s = socket.socket(family=socket.AF_UNIX, type=socket.SOCK_STREAM)
-            s.bind(path)
+            s.bind(str(path))
            s.listen(1)
            return s

-        monitor_path = os.path.join(self.state_dir, "monitor")
-        self.monitor_socket = create_socket(monitor_path)
-
-        shell_path = os.path.join(self.state_dir, "shell")
-        self.shell_socket = create_socket(shell_path)
-
-        display_available = any(x in os.environ for x in ["DISPLAY", "WAYLAND_DISPLAY"])
-        qemu_options = (
-            " ".join(
-                [
-                    "" if self.allow_reboot else "-no-reboot",
-                    "-monitor unix:{}".format(monitor_path),
-                    "-chardev socket,id=shell,path={}".format(shell_path),
-                    "-device virtio-serial",
-                    "-device virtconsole,chardev=shell",
-                    "-device virtio-rng-pci",
-                    "-serial stdio" if display_available else "-nographic",
-                ]
-            )
-            + " "
-            + os.environ.get("QEMU_OPTS", "")
+        monitor_socket = create_socket(clear(self.monitor_path))
+        shell_socket = create_socket(clear(self.shell_path))
+        self.process = self.start_command.run(
+            self.state_dir,
+            self.shared_dir,
+            self.monitor_path,
+            self.shell_path,
        )
-
-        environment = dict(os.environ)
-        environment.update(
-            {
-                "TMPDIR": self.state_dir,
-                "SHARED_DIR": self.shared_dir,
-                "USE_TMPDIR": "1",
-                "QEMU_OPTS": qemu_options,
-            }
-        )
-
-        self.process = subprocess.Popen(
-            self.script,
-            stdin=subprocess.DEVNULL,
-            stdout=subprocess.PIPE,
-            stderr=subprocess.STDOUT,
-            shell=True,
-            cwd=self.state_dir,
-            env=environment,
-        )
-        self.monitor, _ = self.monitor_socket.accept()
-        self.shell, _ = self.shell_socket.accept()
+        self.monitor, _ = monitor_socket.accept()
+        self.shell, _ = shell_socket.accept()

        # Store last serial console lines for use
        # of wait_for_console_text
        self.last_lines: Queue = Queue()

        def process_serial_output() -> None:
-            assert self.process.stdout is not None
+            assert self.process
+            assert self.process.stdout
            for _line in self.process.stdout:
                # Ignore undecodable bytes that may occur in boot menus
                line = _line.decode(errors="ignore").replace("\r", "").rstrip()
@ -825,15 +931,15 @@ class Machine:
        self.log("QEMU running (pid {})".format(self.pid))

    def cleanup_statedir(self) -> None:
-        if os.path.isdir(self.state_dir):
-            shutil.rmtree(self.state_dir)
-            self.logger.log(f"deleting VM state directory {self.state_dir}")
-            self.logger.log("if you want to keep the VM state, pass --keep-vm-state")
+        shutil.rmtree(self.state_dir)
+        rootlog.log(f"deleting VM state directory {self.state_dir}")
+        rootlog.log("if you want to keep the VM state, pass --keep-vm-state")

    def shutdown(self) -> None:
        if not self.booted:
            return

+        assert self.shell
        self.shell.send("poweroff\n".encode())
        self.wait_for_shutdown()

@ -908,41 +1014,215 @@ class Machine:
        """Make the machine reachable."""
        self.send_monitor_command("set_link virtio-net-pci.1 on")

-
-def create_machine(args: Dict[str, Any]) -> Machine:
-    args["log"] = log
-    return Machine(args)
+    def release(self) -> None:
+        if self.pid is None:
+            return
+        rootlog.info(f"kill machine (pid {self.pid})")
+        assert self.process
+        assert self.shell
+        assert self.monitor
+        self.process.terminate()
+        self.shell.close()
+        self.monitor.close()


-def start_all() -> None:
-    with log.nested("starting all VMs"):
-        for machine in machines:
-            machine.start()
+class VLan:
+    """This class handles a VLAN that the run-vm scripts identify via its
+    number handles. The network's lifetime equals the object's lifetime.
+    """
+
+    nr: int
+    socket_dir: pathlib.Path
+
+    process: subprocess.Popen
+    pid: int
+    fd: io.TextIOBase
+
+    def __repr__(self) -> str:
+        return f"<Vlan Nr. {self.nr}>"
+
+    def __init__(self, nr: int, tmp_dir: pathlib.Path):
+        self.nr = nr
+        self.socket_dir = tmp_dir / f"vde{self.nr}.ctl"
+
+        # TODO: don't side-effect environment here
+        os.environ[f"QEMU_VDE_SOCKET_{self.nr}"] = str(self.socket_dir)
+
+        rootlog.info("start vlan")
+        pty_master, pty_slave = pty.openpty()
+
+        self.process = subprocess.Popen(
+            ["vde_switch", "-s", self.socket_dir, "--dirmode", "0700"],
+            stdin=pty_slave,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            shell=False,
+        )
+        self.pid = self.process.pid
+        self.fd = os.fdopen(pty_master, "w")
+        self.fd.write("version\n")
+
+        # TODO: perl version checks if this can be read from
+        # an if not, dies. we could hang here forever. Fix it.
+        assert self.process.stdout is not None
+        self.process.stdout.readline()
+        if not (self.socket_dir / "ctl").exists():
+            rootlog.error("cannot start vde_switch")
+
+        rootlog.info(f"running vlan (pid {self.pid})")
+
+    def __del__(self) -> None:
+        rootlog.info(f"kill vlan (pid {self.pid})")
+        self.fd.close()
+        self.process.terminate()


-def join_all() -> None:
-    with log.nested("waiting for all VMs to finish"):
-        for machine in machines:
-            machine.wait_for_shutdown()
+class Driver:
+    """A handle to the driver that sets up the environment
+    and runs the tests"""

+    tests: str
+    vlans: List[VLan]
+    machines: List[Machine]

-def run_tests(interactive: bool = False) -> None:
-    if interactive:
-        ptpython.repl.embed(test_symbols(), {})
-    else:
-        test_script()
+    def __init__(
+        self,
+        start_scripts: List[str],
+        vlans: List[int],
+        tests: str,
+        keep_vm_state: bool = False,
+    ):
+        self.tests = tests
+
+        tmp_dir = pathlib.Path(os.environ.get("TMPDIR", tempfile.gettempdir()))
+        tmp_dir.mkdir(mode=0o700, exist_ok=True)
+
+        with rootlog.nested("start all VLans"):
+            self.vlans = [VLan(nr, tmp_dir) for nr in vlans]
+
+        def cmd(scripts: List[str]) -> Iterator[NixStartScript]:
+            for s in scripts:
+                yield NixStartScript(s)
+
+        self.machines = [
+            Machine(
+                start_command=cmd,
+                keep_vm_state=keep_vm_state,
+                name=cmd.machine_name,
+                tmp_dir=tmp_dir,
+            )
+            for cmd in cmd(start_scripts)
+        ]
+
+        @atexit.register
+        def clean_up() -> None:
+            with rootlog.nested("clean up"):
+                for machine in self.machines:
+                    machine.release()
+
+    def subtest(self, name: str) -> Iterator[None]:
+        """Group logs under a given test name"""
+        with rootlog.nested(name):
+            try:
+                yield
+                return True
+            except:
+                rootlog.error(f'Test "{name}" failed with error:')
+                raise
+
+    def test_symbols(self) -> Dict[str, Any]:
+        @contextmanager
+        def subtest(name: str) -> Iterator[None]:
+            return self.subtest(name)
+
+        general_symbols = dict(
+            start_all=self.start_all,
+            test_script=self.test_script,
+            machines=self.machines,
+            vlans=self.vlans,
+            driver=self,
+            log=rootlog,
+            os=os,
+            create_machine=self.create_machine,
+            subtest=subtest,
+            run_tests=self.run_tests,
+            join_all=self.join_all,
+            retry=retry,
+            serial_stdout_off=self.serial_stdout_off,
+            serial_stdout_on=self.serial_stdout_on,
+            Machine=Machine,  # for typing
+        )
+        machine_symbols = {
+            m.name: self.machines[idx] for idx, m in enumerate(self.machines)
+        }
+        vlan_symbols = {
+            f"vlan{v.nr}": self.vlans[idx] for idx, v in enumerate(self.vlans)
+        }
+        print(
+            "additionally exposed symbols:\n    "
+            + ", ".join(map(lambda m: m.name, self.machines))
+            + ",\n    "
+            + ", ".join(map(lambda v: f"vlan{v.nr}", self.vlans))
+            + ",\n    "
+            + ", ".join(list(general_symbols.keys()))
+        )
+        return {**general_symbols, **machine_symbols, **vlan_symbols}
+
+    def test_script(self) -> None:
+        """Run the test script"""
+        with rootlog.nested("run the VM test script"):
+            symbols = self.test_symbols()  # call eagerly
+            exec(self.tests, symbols, None)
+
+    def run_tests(self) -> None:
+        """Run the test script (for non-interactive test runs)"""
+        self.test_script()
        # TODO: Collect coverage data
-        for machine in machines:
+        for machine in self.machines:
            if machine.is_up():
                machine.execute("sync")

+    def start_all(self) -> None:
+        """Start all machines"""
+        with rootlog.nested("start all VMs"):
+            for machine in self.machines:
+                machine.start()

-def serial_stdout_on() -> None:
-    log._print_serial_logs = True
+    def join_all(self) -> None:
+        """Wait for all machines to shut down"""
+        with rootlog.nested("wait for all VMs to finish"):
+            for machine in self.machines:
+                machine.wait_for_shutdown()

+    def create_machine(self, args: Dict[str, Any]) -> Machine:
+        rootlog.warning(
+            "Using legacy create_machine(), please instantiate the"
+            "Machine class directly, instead"
+        )
+        tmp_dir = pathlib.Path(os.environ.get("TMPDIR", tempfile.gettempdir()))
+        tmp_dir.mkdir(mode=0o700, exist_ok=True)

-def serial_stdout_off() -> None:
-    log._print_serial_logs = False
+        if args.get("startCommand"):
+            start_command: str = args.get("startCommand", "")
+            cmd = NixStartScript(start_command)
+            name = args.get("name", cmd.machine_name)
+        else:
+            cmd = Machine.create_startcommand(args)  # type: ignore
+            name = args.get("name", "machine")
+
+        return Machine(
+            tmp_dir=tmp_dir,
+            start_command=cmd,
+            name=name,
+            keep_vm_state=args.get("keep_vm_state", False),
+            allow_reboot=args.get("allow_reboot", False),
+        )
+
+    def serial_stdout_on(self) -> None:
+        rootlog._print_serial_logs = True
+
+    def serial_stdout_off(self) -> None:
+        rootlog._print_serial_logs = False


 class EnvDefault(argparse.Action):
@ -970,52 +1250,6 @@ class EnvDefault(argparse.Action):
        setattr(namespace, self.dest, values)


-@contextmanager
-def subtest(name: str) -> Iterator[None]:
-    with log.nested(name):
-        try:
-            yield
-            return True
-        except Exception as e:
-            log.log(f'Test "{name}" failed with error: "{e}"')
-            raise e
-
-    return False
-
-
-def _test_symbols() -> Dict[str, Any]:
-    general_symbols = dict(
-        start_all=start_all,
-        test_script=globals().get("test_script"),  # same
-        machines=globals().get("machines"),  # without being initialized
-        log=globals().get("log"),  # extracting those symbol keys
-        os=os,
-        create_machine=create_machine,
-        subtest=subtest,
-        run_tests=run_tests,
-        join_all=join_all,
-        retry=retry,
-        serial_stdout_off=serial_stdout_off,
-        serial_stdout_on=serial_stdout_on,
-        Machine=Machine,  # for typing
-    )
-    return general_symbols
-
-
-def test_symbols() -> Dict[str, Any]:
-
-    general_symbols = _test_symbols()
-
-    machine_symbols = {m.name: machines[idx] for idx, m in enumerate(machines)}
-    print(
-        "additionally exposed symbols:\n    "
-        + ", ".join(map(lambda m: m.name, machines))
-        + ",\n    "
-        + ", ".join(list(general_symbols.keys()))
-    )
-    return {**general_symbols, **machine_symbols}
-
-
 if __name__ == "__main__":
    arg_parser = argparse.ArgumentParser(prog="nixos-test-driver")
    arg_parser.add_argument(
@ -1055,44 +1289,18 @@ if __name__ == "__main__":
    )

    args = arg_parser.parse_args()
-    testscript = pathlib.Path(args.testscript).read_text()

-    global log, machines, test_script
+    if not args.keep_vm_state:
+        rootlog.info("Machine state will be reset. To keep it, pass --keep-vm-state")

-    log = Logger()
+    driver = Driver(
+        args.start_scripts, args.vlans, args.testscript.read_text(), args.keep_vm_state
+    )

-    vde_sockets = [create_vlan(v) for v in args.vlans]
-    for nr, vde_socket, _, _ in vde_sockets:
-        os.environ["QEMU_VDE_SOCKET_{}".format(nr)] = vde_socket
-
-    machines = [
-        create_machine({"startCommand": s, "keepVmState": args.keep_vm_state})
-        for s in args.start_scripts
-    ]
-    machine_eval = [
-        "{0} = machines[{1}]".format(m.name, idx) for idx, m in enumerate(machines)
-    ]
-    exec("\n".join(machine_eval))
-
-    @atexit.register
-    def clean_up() -> None:
-        with log.nested("cleaning up"):
-            for machine in machines:
-                if machine.pid is None:
-                    continue
-                log.log("killing {} (pid {})".format(machine.name, machine.pid))
-                machine.process.kill()
-            for _, _, process, _ in vde_sockets:
-                process.terminate()
-        log.close()
-
-    def test_script() -> None:
-        with log.nested("running the VM test script"):
-            symbols = test_symbols()  # call eagerly
-            exec(testscript, symbols, None)
-
-    interactive = args.interactive or (not bool(testscript))
-    tic = time.time()
-    run_tests(interactive)
-    toc = time.time()
-    print("test script finished in {:.2f}s".format(toc - tic))
+    if args.interactive:
+        ptpython.repl.embed(driver.test_symbols(), {})
+    else:
+        tic = time.time()
+        driver.run_tests()
+        toc = time.time()
+        rootlog.info(f"test script finished in {(toc-tic):.2f}s")
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@ -43,7 +43,8 @@ rec {
        from pydoc import importfile
        with open('driver-symbols', 'w') as fp:
          t = importfile('${testDriverScript}')
-          test_symbols = t._test_symbols()
+          d = t.Driver([],[],"")
+          test_symbols = d.test_symbols()
          fp.write(','.join(test_symbols.keys()))
        EOF
      '';
@ -188,14 +189,6 @@ rec {
          --set startScripts "''${vmStartScripts[*]}" \
          --set testScript "$out/test-script" \
          --set vlans '${toString vlans}'
-
-        ${lib.optionalString (testScript == "") ''
-          ln -s ${testDriver}/bin/nixos-test-driver $out/bin/nixos-run-vms
-          wrapProgram $out/bin/nixos-run-vms \
-            --set startScripts "''${vmStartScripts[*]}" \
-            --set testScript "${pkgs.writeText "start-all" "start_all(); join_all();"}" \
-            --set vlans '${toString vlans}'
-        ''}
      '');

  # Make a full-blown test
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@ -10,7 +10,7 @@ rec {
  # Check whenever fileSystem is needed for boot.  NOTE: Make sure
  # pathsNeededForBoot is closed under the parent relationship, i.e. if /a/b/c
  # is in the list, put /a and /a/b in as well.
-  pathsNeededForBoot = [ "/" "/nix" "/nix/store" "/var" "/var/log" "/var/lib" "/etc" ];
+  pathsNeededForBoot = [ "/" "/nix" "/nix/store" "/var" "/var/log" "/var/lib" "/var/lib/nixos" "/etc" ];
  fsNeededForBoot = fs: fs.neededForBoot || elem fs.mountPoint pathsNeededForBoot;

  # Check whenever `b` depends on `a` as a fileSystem
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@ -1,7 +1,7 @@
 {
-  x86_64-linux = "/nix/store/jhbxh1jwjc3hjhzs9y2hifdn0rmnfwaj-nix-2.3.15";
-  i686-linux = "/nix/store/9pspwnkdrgzma1l4xlv7arhwa56y16di-nix-2.3.15";
-  aarch64-linux = "/nix/store/72aqi5g7f4fhgvgafbcqwcpqjgnczj48-nix-2.3.15";
-  x86_64-darwin = "/nix/store/6p6qwp73dgfkqhynmxrzbx1lcfgfpqal-nix-2.3.15";
-  aarch64-darwin = "/nix/store/dmq2vksdhssgfl822shd0ky3x5x0klh4-nix-2.3.15";
+  x86_64-linux = "/nix/store/nzp4m3cmm7wawk031byh8jg4cdzjq212-nix-2.3.16";
+  i686-linux = "/nix/store/zsaza9pwim617ak15fsc31lv65b9w3in-nix-2.3.16";
+  aarch64-linux = "/nix/store/7f6z40gyd405yd50qkyzwilnqw106bx8-nix-2.3.16";
+  x86_64-darwin = "/nix/store/c43kyri67ia8mibs0id5ara7gqwlkybf-nix-2.3.16";
+  aarch64-darwin = "/nix/store/6jwhak3cvsgnbqs540n27g8pxnk427fr-nix-2.3.16";
 }
--- a/nixos/modules/installer/tools/nixos-build-vms/build-vms.nix
+++ b/nixos/modules/installer/tools/nixos-build-vms/build-vms.nix
@ -8,11 +8,21 @@ let
    _file = "${networkExpr}@node-${vm}";
    imports = [ module ];
  }) (import networkExpr);
+
+  pkgs = import ../../../../.. { inherit system config; };
+
+  testing = import ../../../../lib/testing-python.nix {
+    inherit system pkgs;
+  };
+
+  interactiveDriver = (testing.makeTest { inherit nodes; testScript = "start_all(); join_all();"; }).driverInteractive;
 in

-with import ../../../../lib/testing-python.nix {
-  inherit system;
-  pkgs = import ../../../../.. { inherit system config; };
-};

-(makeTest { inherit nodes; testScript = ""; }).driverInteractive
+pkgs.runCommand "nixos-build-vms" { nativeBuildInputs = [ pkgs.makeWrapper ]; } ''
+  mkdir -p $out/bin
+  ln -s ${interactiveDriver}/bin/nixos-test-driver $out/bin/nixos-test-driver
+  ln -s ${interactiveDriver}/bin/nixos-test-driver $out/bin/nixos-run-vms
+  wrapProgram $out/bin/nixos-test-driver \
+    --add-flags "--interactive"
+''
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -412,6 +412,7 @@
  ./services/hardware/illum.nix
  ./services/hardware/interception-tools.nix
  ./services/hardware/irqbalance.nix
+  ./services/hardware/joycond.nix
  ./services/hardware/lcd.nix
  ./services/hardware/lirc.nix
  ./services/hardware/nvidia-optimus.nix
@ -543,6 +544,7 @@
  ./services/misc/matrix-appservice-discord.nix
  ./services/misc/matrix-appservice-irc.nix
  ./services/misc/matrix-synapse.nix
+  ./services/misc/mautrix-facebook.nix
  ./services/misc/mautrix-telegram.nix
  ./services/misc/mbpfan.nix
  ./services/misc/mediatomb.nix
--- a/nixos/modules/services/hardware/joycond.nix
+++ b/nixos/modules/services/hardware/joycond.nix
@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.joycond;
+  kernelPackages = config.boot.kernelPackages;
+in
+
+with lib;
+
+{
+  options.services.joycond = {
+    enable = mkEnableOption "support for Nintendo Pro Controllers and Joycons";
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.joycond;
+      defaultText = "pkgs.joycond";
+      description = ''
+        The joycond package to use.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [
+      kernelPackages.hid-nintendo
+      cfg.package
+    ];
+
+    boot.extraModulePackages = [ kernelPackages.hid-nintendo ];
+    boot.kernelModules = [ "hid_nintendo" ];
+
+    services.udev.packages = [ cfg.package ];
+
+    systemd.packages = [ cfg.package ];
+
+    # Workaround for https://github.com/NixOS/nixpkgs/issues/81138
+    systemd.services.joycond.wantedBy = [ "multi-user.target" ];
+  };
+}
--- a/nixos/modules/services/misc/mautrix-facebook.nix
+++ b/nixos/modules/services/misc/mautrix-facebook.nix
@ -0,0 +1,195 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.mautrix-facebook;
+  settingsFormat = pkgs.formats.json {};
+  settingsFile = settingsFormat.generate "mautrix-facebook-config.json" cfg.settings;
+
+  puppetRegex = concatStringsSep
+    ".*"
+    (map
+      escapeRegex
+      (splitString
+        "{userid}"
+        cfg.settings.bridge.username_template));
+in {
+  options = {
+    services.mautrix-facebook = {
+      enable = mkEnableOption "Mautrix-Facebook, a Matrix-Facebook hybrid puppeting/relaybot bridge";
+
+      settings = mkOption rec {
+        apply = recursiveUpdate default;
+        type = settingsFormat.type;
+        default = {
+          homeserver = {
+            address = "http://localhost:8008";
+          };
+
+          appservice = rec {
+            address = "http://${hostname}:${toString port}";
+            hostname = "localhost";
+            port = 29319;
+
+            database = "postgresql://";
+
+            bot_username = "facebookbot";
+          };
+
+          metrics.enabled = false;
+          manhole.enabled = false;
+
+          bridge = {
+            encryption = {
+              allow = true;
+              default = true;
+            };
+            username_template = "facebook_{userid}";
+          };
+
+          logging = {
+            version = 1;
+            formatters.journal_fmt.format = "%(name)s: %(message)s";
+            handlers.journal = {
+              class = "systemd.journal.JournalHandler";
+              formatter = "journal_fmt";
+              SYSLOG_IDENTIFIER = "mautrix-facebook";
+            };
+            root = {
+              level = "INFO";
+              handlers = ["journal"];
+            };
+          };
+        };
+        example = literalExpression ''
+          {
+            homeserver = {
+              address = "http://localhost:8008";
+              domain = "mydomain.example";
+            };
+
+            bridge.permissions = {
+              "@admin:mydomain.example" = "admin";
+              "mydomain.example" = "user";
+            };
+          }
+        '';
+        description = ''
+          <filename>config.yaml</filename> configuration as a Nix attribute set.
+          Configuration options should match those described in
+          <link xlink:href="https://github.com/mautrix/facebook/blob/master/mautrix_facebook/example-config.yaml">
+          example-config.yaml</link>.
+          </para>
+
+          <para>
+          Secret tokens should be specified using <option>environmentFile</option>
+          instead of this world-readable attribute set.
+        '';
+      };
+
+      environmentFile = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = ''
+          File containing environment variables to be passed to the mautrix-telegram service.
+
+          Any config variable can be overridden by setting <literal>MAUTRIX_FACEBOOK_SOME_KEY</literal> to override the <literal>some.key</literal> variable.
+        '';
+      };
+
+      configurePostgresql = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Enable PostgreSQL and create a user and database for mautrix-facebook. The default <literal>settings</literal> reference this database, if you disable this option you must provide a database URL.
+        '';
+      };
+
+      registrationData = mkOption {
+        type = types.attrs;
+        default = {};
+        description = ''
+          Output data for appservice registration. Simply make any desired changes and serialize to JSON. Note that this data contains secrets so think twice before putting it into the nix store.
+
+          Currently <literal>as_token</literal> and <literal>hs_token</literal> need to be added as they are not known to this module.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users.mautrix-facebook = {
+      group = "mautrix-facebook";
+      isSystemUser = true;
+    };
+
+    services.postgresql = mkIf cfg.configurePostgresql {
+      ensureDatabases = ["mautrix-facebook"];
+      ensureUsers = [{
+        name = "mautrix-facebook";
+        ensurePermissions = {
+          "DATABASE \"mautrix-facebook\"" = "ALL PRIVILEGES";
+        };
+      }];
+    };
+
+    systemd.services.mautrix-facebook = rec {
+      wantedBy = [ "multi-user.target" ];
+      wants = [
+        "network-online.target"
+      ] ++ optional config.services.matrix-synapse.enable "matrix-synapse.service"
+        ++ optional cfg.configurePostgresql "postgresql.service";
+      after = wants;
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+
+        User = "mautrix-facebook";
+
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        PrivateTmp = true;
+
+        EnvironmentFile = cfg.environmentFile;
+
+        ExecStart = ''
+          ${pkgs.mautrix-facebook}/bin/mautrix-facebook --config=${settingsFile}
+        '';
+      };
+    };
+
+    services.mautrix-facebook = {
+      registrationData = {
+        id = "mautrix-facebook";
+
+        namespaces = {
+          users = [
+            {
+              exclusive = true;
+              regex = escapeRegex "@${cfg.settings.appservice.bot_username}:${cfg.settings.homeserver.domain}";
+            }
+            {
+              exclusive = true;
+              regex = "@${puppetRegex}:${escapeRegex cfg.settings.homeserver.domain}";
+            }
+          ];
+          aliases = [];
+        };
+
+        url = cfg.settings.appservice.address;
+        sender_localpart = "mautrix-facebook-sender";
+
+        rate_limited = false;
+        "de.sorunome.msc2409.push_ephemeral" = true;
+        push_ephemeral = true;
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ kevincox ];
+}
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -185,6 +185,28 @@ let
        serviceConfig.DynamicUser = mkDefault enableDynamicUser;
        serviceConfig.User = mkDefault conf.user;
        serviceConfig.Group = conf.group;
+        # Hardening
+        serviceConfig.CapabilityBoundingSet = mkDefault [ "" ];
+        serviceConfig.DeviceAllow = [ "" ];
+        serviceConfig.LockPersonality = true;
+        serviceConfig.MemoryDenyWriteExecute = true;
+        serviceConfig.NoNewPrivileges = true;
+        serviceConfig.PrivateDevices = true;
+        serviceConfig.ProtectClock = true;
+        serviceConfig.ProtectControlGroups = true;
+        serviceConfig.ProtectHome = true;
+        serviceConfig.ProtectHostname = true;
+        serviceConfig.ProtectKernelLogs = true;
+        serviceConfig.ProtectKernelModules = true;
+        serviceConfig.ProtectKernelTunables = true;
+        serviceConfig.ProtectSystem = mkDefault "strict";
+        serviceConfig.RemoveIPC = true;
+        serviceConfig.RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        serviceConfig.RestrictNamespaces = true;
+        serviceConfig.RestrictRealtime = true;
+        serviceConfig.RestrictSUIDSGID = true;
+        serviceConfig.SystemCallArchitectures = "native";
+        serviceConfig.UMask = "0077";
      } serviceOpts ]);
  };
 in
--- a/nixos/modules/services/monitoring/prometheus/exporters/bird.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/bird.nix
@ -41,6 +41,10 @@ in
          -format.new=${if cfg.newMetricFormat then "true" else "false"} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
    };
  };
 }
--- a/nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix
@ -83,6 +83,10 @@ in
          --dovecot.scopes ${concatStringsSep "," cfg.scopes} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
    };
  };
 }
--- a/nixos/modules/services/monitoring/prometheus/exporters/kea.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/kea.nix
@ -34,6 +34,10 @@ in {
          ${concatStringsSep " \\n" cfg.controlSocketPaths}
      '';
      SupplementaryGroups = [ "kea" ];
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
    };
  };
 }
--- a/nixos/modules/services/monitoring/prometheus/exporters/knot.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/knot.nix
@ -45,6 +45,10 @@ in {
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
      SupplementaryGroups = [ "knot" ];
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
    };
  };
 }
--- a/nixos/modules/services/monitoring/prometheus/exporters/modemmanager.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/modemmanager.nix
@ -28,6 +28,10 @@ in
          -rate ${cfg.refreshRate} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
    };
  };
 }
--- a/nixos/modules/services/monitoring/prometheus/exporters/postgres.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/postgres.nix
@ -79,6 +79,10 @@ in
          --web.telemetry-path ${cfg.telemetryPath} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
    };
  };
 }
--- a/nixos/modules/services/monitoring/prometheus/exporters/smokeping.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/smokeping.nix
@ -45,6 +45,7 @@ in
  serviceOpts = {
    serviceConfig = {
      AmbientCapabilities = [ "CAP_NET_RAW" ];
+      CapabilityBoundingSet = [ "CAP_NET_RAW" ];
      ExecStart = ''
        ${pkgs.prometheus-smokeping-prober}/bin/smokeping_prober \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/monitoring/prometheus/exporters/sql.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/sql.nix
@ -99,6 +99,10 @@ in
          -config.file ${configFile} \
          ${concatStringsSep " \\\n  " cfg.extraFlags}
      '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
    };
  };
 }
--- a/nixos/modules/services/monitoring/prometheus/exporters/systemd.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/systemd.nix
@ -13,6 +13,10 @@ in {
        ${pkgs.prometheus-systemd-exporter}/bin/systemd_exporter \
          --web.listen-address ${cfg.listenAddress}:${toString cfg.port}
      '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
    };
  };
 }
--- a/nixos/modules/services/monitoring/prometheus/exporters/unbound.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/unbound.nix
@ -49,6 +49,10 @@ in
          ${optionalString (cfg.controlInterface != null) "--control-interface ${cfg.controlInterface}"} \
          ${toString cfg.extraFlags}
      '';
+      RestrictAddressFamilies = [
+        # Need AF_UNIX to collect data
+        "AF_UNIX"
+      ];
    };
  }] ++ [
    (mkIf config.services.unbound.enable {
--- a/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix
@ -52,6 +52,7 @@ in {

    serviceConfig = {
      AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+      CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
      ExecStart = ''
        ${pkgs.prometheus-wireguard-exporter}/bin/prometheus_wireguard_exporter \
          -p ${toString cfg.port} \
@ -61,6 +62,10 @@ in {
          ${optionalString cfg.withRemoteIp "-r"} \
          ${optionalString (cfg.wireguardConfig != null) "-n ${escapeShellArg cfg.wireguardConfig}"}
      '';
+      RestrictAddressFamilies = [
+        # Need AF_NETLINK to collect data
+        "AF_NETLINK"
+      ];
    };
  };
 }
--- a/nixos/modules/services/web-servers/varnish/default.nix
+++ b/nixos/modules/services/web-servers/varnish/default.nix
@ -13,6 +13,8 @@ in
    services.varnish = {
      enable = mkEnableOption "Varnish Server";

+      enableConfigCheck = mkEnableOption "checking the config during build time" // { default = true; };
+
      package = mkOption {
        type = types.package;
        default = pkgs.varnish;
@ -96,11 +98,10 @@ in
    environment.systemPackages = [ cfg.package ];

    # check .vcl syntax at compile time (e.g. before nixops deployment)
-    system.extraDependencies = [
-      (pkgs.stdenv.mkDerivation {
-        name = "check-varnish-syntax";
-        buildCommand = "${cfg.package}/sbin/varnishd -C ${commandLine} 2> $out || (cat $out; exit 1)";
-      })
+    system.extraDependencies = mkIf cfg.enableConfigCheck [
+      (pkgs.runCommand "check-varnish-syntax" {} ''
+        ${cfg.package}/bin/varnishd -C ${commandLine} 2> $out || (cat $out; exit 1)
+      '')
    ];

    users.users.varnish = {
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -780,7 +780,7 @@ in
      in
      [
        "-net nic,netdev=user.0,model=virtio"
-        "-netdev user,id=user.0,${forwardingOptions}\${QEMU_NET_OPTS:+,$QEMU_NET_OPTS}"
+        "-netdev user,id=user.0,${forwardingOptions}\"$QEMU_NET_OPTS\""
      ];

    # FIXME: Consolidate this one day.
--- a/nixos/tests/udisks2.nix
+++ b/nixos/tests/udisks2.nix
@ -34,7 +34,7 @@ in

      with lzma.open(
          "${stick}"
-      ) as data, open(machine.state_dir + "/usbstick.img", "wb") as stick:
+      ) as data, open(machine.state_dir / "usbstick.img", "wb") as stick:
          stick.write(data.read())

      machine.succeed("udisksctl info -b /dev/vda >&2")
--- a/nixos/tests/usbguard.nix
+++ b/nixos/tests/usbguard.nix
@ -22,7 +22,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {

  testScript = ''
    # create a blank disk image for our fake USB stick
-    with open(machine.state_dir + "/usbstick.img", "wb") as stick:
+    with open(machine.state_dir / "usbstick.img", "wb") as stick:
        stick.write(b"\x00" * (1024 * 1024))

    # wait for machine to have started and the usbguard service to be up
--- a/pkgs/applications/audio/picard/default.nix
+++ b/pkgs/applications/audio/picard/default.nix
@ -18,13 +18,13 @@ let
 in
 pythonPackages.buildPythonApplication rec {
  pname = "picard";
-  version = "2.6.3";
+  version = "2.6.4";

  src = fetchFromGitHub {
    owner = "metabrainz";
    repo = pname;
    rev = "release-${version}";
-    sha256 = "sha256-bSqGgRXqHGjT+OYCEafsT/btVe+n91+L0kB8fnrywss=";
+    sha256 = "0lm7s9jy7z4an3xxj3gnxxf2xx045i157qaxysbdhcq5lwlmznc7";
  };

  nativeBuildInputs = [ gettext qt5.wrapQtAppsHook qt5.qtbase ]
--- a/pkgs/applications/backup/deja-dup/default.nix
+++ b/pkgs/applications/backup/deja-dup/default.nix
@ -14,7 +14,7 @@
 , libsecret
 , libhandy
 , wrapGAppsHook
-, libgpgerror
+, libgpg-error
 , json-glib
 , duplicity
 }:
@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
    gtk3
    libsecret
    libhandy
-    libgpgerror
+    libgpg-error
    json-glib
  ];

--- a/pkgs/applications/blockchains/monero-gui/default.nix
+++ b/pkgs/applications/blockchains/monero-gui/default.nix
@ -7,7 +7,7 @@
 , qtmacextras
 , monero, miniupnpc, unbound, readline
 , boost, libunwind, libsodium, pcsclite
-, randomx, zeromq, libgcrypt, libgpgerror
+, randomx, zeromq, libgcrypt, libgpg-error
 , hidapi, rapidjson, quirc
 , trezorSupport ? true, libusb1, protobuf, python3
 }:
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
    qtmultimedia qtquickcontrols qtquickcontrols2
    qtxmlpatterns
    monero miniupnpc unbound readline
-    randomx libgcrypt libgpgerror
+    randomx libgcrypt libgpg-error
    boost libunwind libsodium pcsclite
    zeromq hidapi rapidjson quirc
  ] ++ lib.optionals trezorSupport [ libusb1 protobuf python3 ]
--- a/pkgs/applications/blockchains/parity-ui/env.nix
+++ b/pkgs/applications/blockchains/parity-ui/env.nix
@ -1,11 +1,11 @@
 { stdenv, lib, zlib, glib, alsa-lib, dbus, gtk2, atk, pango, freetype, fontconfig
-, libgnome-keyring3, gdk-pixbuf, cairo, cups, expat, libgpgerror, nspr
+, libgnome-keyring3, gdk-pixbuf, cairo, cups, expat, libgpg-error, nspr
 , nss, xorg, libcap, systemd, libnotify, libsecret, gnome2 }:

 let
  packages = [
    stdenv.cc.cc zlib glib dbus gtk2 atk pango freetype libgnome-keyring3
-    fontconfig gdk-pixbuf cairo cups expat libgpgerror alsa-lib nspr nss
+    fontconfig gdk-pixbuf cairo cups expat libgpg-error alsa-lib nspr nss
    xorg.libXrender xorg.libX11 xorg.libXext xorg.libXdamage xorg.libXtst
    xorg.libXcomposite xorg.libXi xorg.libXfixes xorg.libXrandr
    xorg.libXcursor xorg.libxkbfile xorg.libXScrnSaver libcap systemd libnotify
--- a/pkgs/applications/blockchains/zcash/default.nix
+++ b/pkgs/applications/blockchains/zcash/default.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage.override { stdenv = stdenv; } rec {
  pname = "zcash";
-  version = "4.5.0";
+  version = "4.5.1";

  src = fetchFromGitHub {
    owner = "zcash";
    repo  = "zcash";
    rev = "v${version}";
-    sha256 = "0zn6ms2c4mh64cckjg88v0byy2ck116z5g4y82hh34mz3r11d9mn";
+    sha256 = "0kyk3hv1y13b3vwg9kjcrpvz9v3l8lp0ikj977nykd5ms8b1rifa";
  };

-  cargoSha256 = "16il7napj7ryxsap6icvdpvagm9mvgz2mpshny9wn56y60qaymd0";
+  cargoSha256 = "1mwprsg74xv6qlxf00w7xapnkisb1aid9hkyr8r90zcwdcy8783r";

  nativeBuildInputs = [ autoreconfHook cargo hexdump makeWrapper pkg-config ];
  buildInputs = [ boost175 libevent libsodium utf8cpp ]
--- a/pkgs/applications/editors/atom/env.nix
+++ b/pkgs/applications/editors/atom/env.nix
@ -1,5 +1,5 @@
 { stdenv, lib, zlib, glib, alsa-lib, dbus, gtk3, atk, pango, freetype, fontconfig
-, libgnome-keyring3, gdk-pixbuf, cairo, cups, expat, libgpgerror, nspr
+, libgnome-keyring3, gdk-pixbuf, cairo, cups, expat, libgpg-error, nspr
 , gconf, nss, xorg, libcap, systemd, libnotify, libsecret, libuuid, at-spi2-atk
 , at-spi2-core, libdbusmenu, libdrm, mesa
 }:
@ -7,7 +7,7 @@
 let
  packages = [
    stdenv.cc.cc zlib glib dbus gtk3 atk pango freetype libgnome-keyring3
-    fontconfig gdk-pixbuf cairo cups expat libgpgerror alsa-lib nspr gconf nss
+    fontconfig gdk-pixbuf cairo cups expat libgpg-error alsa-lib nspr gconf nss
    xorg.libXrender xorg.libX11 xorg.libXext xorg.libXdamage xorg.libXtst
    xorg.libXcomposite xorg.libXi xorg.libXfixes xorg.libXrandr
    xorg.libXcursor xorg.libxkbfile xorg.libXScrnSaver libcap systemd libnotify
--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
@ -365,6 +365,36 @@
          license = lib.licenses.free;
        };
      }) {};
+    boxy = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "boxy";
+        ename = "boxy";
+        version = "1.0.2";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/boxy-1.0.2.tar";
+          sha256 = "07m832kn4d6njfz21qfmh12gzd35d17v29pqlxfq9v03cazww4lr";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/boxy.html";
+          license = lib.licenses.free;
+        };
+      }) {};
+    boxy-headlines = callPackage ({ boxy, elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "boxy-headlines";
+        ename = "boxy-headlines";
+        version = "1.0.2";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/boxy-headlines-1.0.2.tar";
+          sha256 = "1j8j2vc318mb4i116qs9zj6cvkiy1fips09mkzj6lqr25qk5fi31";
+        };
+        packageRequires = [ boxy emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/boxy-headlines.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    brief = callPackage ({ elpaBuild, fetchurl, lib }:
      elpaBuild {
        pname = "brief";
@ -711,10 +741,10 @@
      elpaBuild {
        pname = "crdt";
        ename = "crdt";
-        version = "0.2.5";
+        version = "0.2.7";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/crdt-0.2.5.tar";
-          sha256 = "092f82kq78c9gih6xri4n3ma5ixw9c8mx12i00c174g0v041r6sp";
+          url = "https://elpa.gnu.org/packages/crdt-0.2.7.tar";
+          sha256 = "0f6v937zbxj4kci07dv0a1h4q1ak0qabkjq2j258ydxyivvqyvsw";
        };
        packageRequires = [];
        meta = {
@ -1056,10 +1086,10 @@
      elpaBuild {
        pname = "ebdb";
        ename = "ebdb";
-        version = "0.8.4";
+        version = "0.8.5";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ebdb-0.8.4.tar";
-          sha256 = "0n811af83fqpzq9513gf240gnz7qkwrjw07qs4sra4069q0pwnjr";
+          url = "https://elpa.gnu.org/packages/ebdb-0.8.5.tar";
+          sha256 = "1p2chzj5hnaiqhammvdp82ck5pi6h1rl9r782zaqxrhrqsp3vg09";
        };
        packageRequires = [ emacs seq ];
        meta = {
@ -1116,10 +1146,10 @@
      elpaBuild {
        pname = "eev";
        ename = "eev";
-        version = "20210925";
+        version = "20211006";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/eev-20210925.tar";
-          sha256 = "0kwmjspmvz9lfm6y0kls9v2l55ccni0gviv9jlzxiwynrc01rz4y";
+          url = "https://elpa.gnu.org/packages/eev-20211006.tar";
+          sha256 = "08z9q5y46fqm7r1gwiv0ir2hcybwfrvh0b7pxsrppjs1gvclyazn";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2407,10 +2437,10 @@
      elpaBuild {
        pname = "modus-themes";
        ename = "modus-themes";
-        version = "1.5.0";
+        version = "1.6.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/modus-themes-1.5.0.tar";
-          sha256 = "0y5a7g66iiai20fvc6qff3ki792bzca87zxbmxl8hpks4a6znc80";
+          url = "https://elpa.gnu.org/packages/modus-themes-1.6.0.tar";
+          sha256 = "03ahavpvd57z7cw1n46k6lq5335p1ld7kkjcylyx5fvq1rc1jw44";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2437,6 +2467,21 @@
          license = lib.licenses.free;
        };
      }) {};
+    multi-mode = callPackage ({ elpaBuild, fetchurl, lib }:
+      elpaBuild {
+        pname = "multi-mode";
+        ename = "multi-mode";
+        version = "1.14";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/multi-mode-1.14.tar";
+          sha256 = "0aslndqr0277ai0iwywbmj07vmz88vpmc0mgydcy4li8fkn8h066";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/multi-mode.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    multishell = callPackage ({ cl-lib ? null, elpaBuild, fetchurl, lib }:
      elpaBuild {
        pname = "multishell";
@ -2532,6 +2577,36 @@
          license = lib.licenses.free;
        };
      }) {};
+    nano-modeline = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "nano-modeline";
+        ename = "nano-modeline";
+        version = "0.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/nano-modeline-0.1.tar";
+          sha256 = "10hnxgjp56dqydf39mbn9zmwwvnwzi89lwnam5k3x6d6p2cnfgcx";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/nano-modeline.html";
+          license = lib.licenses.free;
+        };
+      }) {};
+    nano-theme = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "nano-theme";
+        ename = "nano-theme";
+        version = "0.2";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/nano-theme-0.2.tar";
+          sha256 = "0kcirnl1fg9kvavw8aq9l16jv4rrxv5w62i7wrsjn7np697sm0s6";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/nano-theme.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    nhexl-mode = callPackage ({ cl-lib ? null
                              , elpaBuild
                              , emacs
@ -2690,10 +2765,10 @@
      elpaBuild {
        pname = "org";
        ename = "org";
-        version = "9.4.6";
+        version = "9.5";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-9.4.6.tar";
-          sha256 = "1k49ymsi77366as2wi4kzv2f1xnbwpb47iw7iw07yxwlhmm7vskq";
+          url = "https://elpa.gnu.org/packages/org-9.5.tar";
+          sha256 = "16cflg5nms5nb8w86nvwkg49zkl0rvdhigkf4xpvbs0v7zb5y3ky";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2716,6 +2791,21 @@
          license = lib.licenses.free;
        };
      }) {};
+    org-real = callPackage ({ boxy, elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "org-real";
+        ename = "org-real";
+        version = "1.0.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/org-real-1.0.1.tar";
+          sha256 = "0rklzp32v30ndyqli3fjcsqvvpiz3klsz26b7zn2bai2ldx6016s";
+        };
+        packageRequires = [ boxy emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/org-real.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    org-translate = callPackage ({ elpaBuild, emacs, fetchurl, lib, org }:
      elpaBuild {
        pname = "org-translate";
@ -2930,10 +3020,10 @@
      elpaBuild {
        pname = "project";
        ename = "project";
-        version = "0.7.1";
+        version = "0.8.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/project-0.7.1.tar";
-          sha256 = "1ip8s924n50mmh068p42zi0ylvv79a2pi9sji1c2pqj2q19d7jr6";
+          url = "https://elpa.gnu.org/packages/project-0.8.0.tar";
+          sha256 = "05q2zr661bn2h6pdvyv3apdajfxnsx0rb0n5np8cg98a7gw4zyxd";
        };
        packageRequires = [ emacs xref ];
        meta = {
@ -3441,10 +3531,10 @@
      elpaBuild {
        pname = "setup";
        ename = "setup";
-        version = "1.0.1";
+        version = "1.1.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/setup-1.0.1.tar";
-          sha256 = "1n390hiv5a8ij584r24cpbahj2sb12wjh0l3kzhccdxnxskrzgmh";
+          url = "https://elpa.gnu.org/packages/setup-1.1.0.tar";
+          sha256 = "1xbh4fix6n47avv57gz48zf4ad1l6mfj30qr5lwvk6pz5gpnjg7i";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3752,6 +3842,21 @@
          license = lib.licenses.free;
        };
      }) {};
+    svg-lib = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "svg-lib";
+        ename = "svg-lib";
+        version = "0.2";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/svg-lib-0.2.tar";
+          sha256 = "0361w1paqrgqlv8wj5vf9ifssddrk2bwlarp2c2wzlxks3ahdf2x";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/svg-lib.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    swiper = callPackage ({ elpaBuild, emacs, fetchurl, ivy, lib }:
      elpaBuild {
        pname = "swiper";
@ -3880,10 +3985,10 @@
      elpaBuild {
        pname = "tramp";
        ename = "tramp";
-        version = "2.5.1.2";
+        version = "2.5.1.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/tramp-2.5.1.2.tar";
-          sha256 = "0p8m8prxrvrr455ahb626c1dry04m80y017h16ngr4i5ais0r85g";
+          url = "https://elpa.gnu.org/packages/tramp-2.5.1.3.tar";
+          sha256 = "1qcwdavfrbw8yyfy5rbzbcfyqavqbz13jncahkqlgwbkqvmgh7y5";
        };
        packageRequires = [ emacs ];
        meta = {
--- a/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
+++ b/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
--- a/pkgs/applications/editors/lighttable/default.nix
+++ b/pkgs/applications/editors/lighttable/default.nix
@ -1,12 +1,12 @@
 { stdenv, lib, fetchurl, zlib, glib, alsa-lib, makeDesktopItem
 , dbus, gtk2, atk, pango, freetype, fontconfig, libgnome-keyring3, gdk-pixbuf
-, cairo, cups, expat, libgpgerror, nspr, gnome2, nss, xorg, systemd, libnotify
+, cairo, cups, expat, libgpg-error, nspr, gnome2, nss, xorg, systemd, libnotify
 }:

 let
  libPath = lib.makeLibraryPath [
      stdenv.cc.cc zlib glib dbus gtk2 atk pango freetype libgnome-keyring3 nss
-      fontconfig gdk-pixbuf cairo cups expat libgpgerror alsa-lib nspr gnome2.GConf
+      fontconfig gdk-pixbuf cairo cups expat libgpg-error alsa-lib nspr gnome2.GConf
      xorg.libXrender xorg.libX11 xorg.libXext xorg.libXdamage xorg.libXtst
      xorg.libXcomposite xorg.libXi xorg.libXfixes libnotify xorg.libXrandr
      xorg.libXcursor
--- a/pkgs/applications/editors/neovim/tests.nix
+++ b/pkgs/applications/editors/neovim/tests.nix
@ -87,7 +87,7 @@ rec {
  nvim_with_plug = neovim.override {
    extraName = "-with-plug";
    configure.plug.plugins = with pkgs.vimPlugins; [
-      base16-vim
+      (base16-vim.overrideAttrs(old: { pname = old.pname + "-unique-for-tests-please-dont-use"; }))
    ];
    configure.customRC = ''
      color base16-tomorrow-night
@ -97,7 +97,7 @@ rec {

  run_nvim_with_plug = runTest nvim_with_plug ''
    export HOME=$TMPDIR
-    ${nvim_with_plug}/bin/nvim -i NONE -c 'color base16-tomorrow-night'  +quit!
+    ${nvim_with_plug}/bin/nvim -i NONE -c 'color base16-tomorrow-night'  +quit! -e
  '';


--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@ -135,7 +135,7 @@ mkDerivation rec {
    { description = "Set of integrated tools for the R language";
      homepage = "https://www.rstudio.com/";
      license = licenses.agpl3;
-      maintainers = with maintainers; [ changlinli ciil ];
+      maintainers = with maintainers; [ ciil ];
      platforms = platforms.linux;
    };
 }
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@ -10,14 +10,14 @@

 python3Packages.buildPythonPackage rec {
  pname = "hydrus";
-  version = "456";
+  version = "457";
  format = "other";

  src = fetchFromGitHub {
    owner = "hydrusnetwork";
    repo = "hydrus";
    rev = "v${version}";
-    sha256 = "sha256-r5EeHWqhJQMvImxB7IVV8MAoW8qIVYpuSN1uOYCTlHY=";
+    sha256 = "sha256-ZXBVJc+9dFzi75JYl3U3ic0MKolWMsdR3UkLe5EOzsw=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/effitask/cargo-lock.patch
+++ b/pkgs/applications/misc/effitask/cargo-lock.patch
--- a/pkgs/applications/misc/effitask/default.nix
+++ b/pkgs/applications/misc/effitask/default.nix
@ -1,32 +1,30 @@
-{ lib, stdenv
+{ lib
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
 , openssl
 , gtk3
+, stdenv
 , rust
 }:

 rustPlatform.buildRustPackage rec {
  pname = "effitask";
-  version = "1.4.0";
+  version = "1.4.1";

  src = fetchFromGitHub {
    owner = "sanpii";
    repo = pname;
    rev = version;
-    sha256 = "09bffxdp43s8b1rpmsgqr2kyz3i4jbd2yrwbxw21fj3sf3mwb9ig";
+    sha256 = "sha256-nZn+mINIqAnaCKZCiywG8/BOPx6TlSe0rKV/8gcW/B4=";
  };

-  # workaround for missing Cargo.lock file https://github.com/sanpii/effitask/issues/48
-  cargoPatches = [ ./cargo-lock.patch ];
-
-  cargoSha256 = "1a80kf95kr94l6jzxdj4i09x1342x358fqjy6119qjg3q3bj0y3p";
-
-  buildInputs = [ openssl gtk3 ];
+  cargoSha256 = "sha256-aCjZRJNsxx75ghK0N95Q9w0h5H5mW9/77j/fumDrvyM=";

  nativeBuildInputs = [ pkg-config ];

+  buildInputs = [ openssl gtk3 ];
+
  # default installPhase don't install assets
  installPhase = ''
    runHook preInstall
--- a/pkgs/applications/misc/elfx86exts/cargo-lock.patch
+++ b/pkgs/applications/misc/elfx86exts/cargo-lock.patch
--- a/pkgs/applications/misc/eureka-ideas/default.nix
+++ b/pkgs/applications/misc/eureka-ideas/default.nix
@ -0,0 +1,35 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, openssl
+, stdenv
+, Security
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "eureka-ideas";
+  version = "1.8.1";
+
+  src = fetchFromGitHub {
+    owner = "simeg";
+    repo = "eureka";
+    rev = "v${version}";
+    sha256 = "1qjf8nr7m9igy6h228gm9gnav6pi2rfarbd9bc5fchx4rqy59sp7";
+  };
+
+  cargoSha256 = "sha256-QujrFgliH8Mx1ES9KVl+O9UJP+7GDanQ7+z4QJuSOd0=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security ];
+
+  meta = with lib; {
+    description = "CLI tool to input and store your ideas without leaving the terminal";
+    homepage = "https://github.com/simeg/eureka";
+    changelog = "https://github.com/simeg/eureka/blob/v${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+    mainProgram = "eureka";
+  };
+}
--- a/pkgs/applications/misc/gpa/default.nix
+++ b/pkgs/applications/misc/gpa/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, intltool, pkg-config, gtk2, gpgme, libgpgerror, libassuan }:
+{ lib, stdenv, fetchurl, intltool, pkg-config, gtk2, gpgme, libgpg-error, libassuan }:

 stdenv.mkDerivation rec {
  name = "gpa-0.10.0";
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ intltool pkg-config ];
-  buildInputs = [ gtk2 gpgme libgpgerror libassuan ];
+  buildInputs = [ gtk2 gpgme libgpg-error libassuan ];

  meta = with lib; {
    description = "Graphical user interface for the GnuPG";
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@ -11,7 +11,7 @@
 , libXtst
 , libargon2
 , libgcrypt
-, libgpgerror
+, libgpg-error
 , libsodium
 , libyubikey
 , pkg-config
@ -99,7 +99,7 @@ stdenv.mkDerivation rec {
    libXtst
    libargon2
    libgcrypt
-    libgpgerror
+    libgpg-error
    libsodium
    libyubikey
    qrencode
--- a/pkgs/applications/misc/liberasurecode/default.nix
+++ b/pkgs/applications/misc/liberasurecode/default.nix
@ -0,0 +1,26 @@
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, zlib }:
+
+stdenv.mkDerivation rec {
+  pname = "liberasurecode";
+  version = "1.6.2";
+
+  outputs = [ "out" "dev" ];
+
+  src = fetchFromGitHub {
+    owner = "openstack";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-qV7DL/7zrwrYOaPj6iHnChGA6KHFwYKjeaMnrGrTPrQ=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  buildInputs = [ zlib ];
+
+  meta = with lib; {
+    description = "Erasure Code API library written in C with pluggable Erasure Code backends";
+    homepage = "https://github.com/openstack/liberasurecode";
+    license = licenses.bsd2;
+    maintainers = teams.openstack.members;
+  };
+}
--- a/pkgs/applications/misc/skytemple/default.nix
+++ b/pkgs/applications/misc/skytemple/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "skytemple";
-  version = "1.3.1";
+  version = "1.3.2";

  src = fetchFromGitHub {
    owner = "SkyTemple";
    repo = pname;
    rev = version;
-    sha256 = "13vvsp47frgq5c2wfllkg4lmsy5vxl53j5rw9c84d5xix5bisk1n";
+    sha256 = "1sx2rib0la3mifvh84ia3jnnq4qw9jxc13vxyidsdkp6x82nbvcg";
  };

  buildInputs = [
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -88,7 +88,7 @@ let
  fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];

  # Upstream source
-  version = "10.5.6";
+  version = "10.5.8";

  lang = "en-US";

@ -98,7 +98,7 @@ let
        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
      ];
-      sha256 = "1hxjixriah08c65nngjdp1blbji1vlnhqkphp8f96hy34hk4dpiw";
+      sha256 = "1bn31r3cayv79pjw5ndji5qzxy552cb2mcavij3nwchsmnfqp4z1";
    };

    i686-linux = fetchurl {
@ -106,7 +106,7 @@ let
        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
      ];
-      sha256 = "018kwwbbn02drvdj0bjkcyhsnbx97wnmd3lxkrx0kc9dw1s4r418";
+      sha256 = "1j3xxflwwjwxfayixj75dn6a2ka751s53f60dpkfzwpp5rfwl572";
    };
  };
 in
--- a/pkgs/applications/networking/cluster/kube3d/default.nix
+++ b/pkgs/applications/networking/cluster/kube3d/default.nix
@ -1,14 +1,14 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles, k3sVersion ? "1.21.3-k3s1" }:
+{ lib, buildGoModule, fetchFromGitHub, installShellFiles, k3sVersion ? "1.22.2-k3s2" }:

 buildGoModule rec {
  pname = "kube3d";
-  version = "4.4.8";
+  version = "5.0.0";

  src = fetchFromGitHub {
    owner = "rancher";
    repo = "k3d";
    rev = "v${version}";
-    sha256 = "sha256-PdbAkiua9AdcNDCpu4UILsmAz0nb4nLjahYomGSHqnc=";
+    sha256 = "1pkrcjr78xxw3idmyzpkbx0rp20972dl44bzwkkp06milrzsq27i";
  };

  vendorSha256 = null;
@ -18,7 +18,7 @@ buildGoModule rec {
  excludedPackages = "\\(tools\\|docgen\\)";

  ldflags =
-    let t = "github.com/rancher/k3d/v4/version"; in
+    let t = "github.com/rancher/k3d/v5/version"; in
    [ "-s" "-w" "-X ${t}.Version=v${version}" "-X ${t}.K3sVersion=v${k3sVersion}" ];

  doCheck = false;
@ -34,7 +34,7 @@ buildGoModule rec {
  installCheckPhase = ''
    runHook preInstallCheck
    $out/bin/k3d --help
-    $out/bin/k3d version | grep "k3d version v${version}"
+    $out/bin/k3d --version | grep -e "k3d version v${version}" -e "k3s version v${k3sVersion}"
    runHook postInstallCheck
  '';

--- a/pkgs/applications/networking/instant-messengers/bluejeans/update.sh
+++ b/pkgs/applications/networking/instant-messengers/bluejeans/update.sh
@ -3,10 +3,10 @@

 set -eu -o pipefail

-version="$(curl -Ls https://www.bluejeans.com/download | \
-    pup 'a[aria-label~="Linux"] attr{href}' | \
-    #output contains *.deb and *.rpm
-    grep "\.rpm" | \
+version="$(curl -Ls https://www.bluejeans.com/downloads | \
+    pup 'a[href$=".rpm"] attr{href}' | \
+    # output contains app and events
+    grep "desktop-app" | \
    awk -F'[ ._ ]' '{printf $6"."$7"."$8"."$9"\n"}')"

 update-source-version bluejeans-gui "$version"
--- a/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
+++ b/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
@ -14,7 +14,7 @@
 , libgcrypt
 , libotr
 , html-tidy
-, libgpgerror
+, libgpg-error
 , libsignal-protocol-c
 , usrsctp

@ -76,7 +76,7 @@ mkDerivation rec {
    libgcrypt
    libotr
    html-tidy
-    libgpgerror
+    libgpg-error
    libsignal-protocol-c
    usrsctp
  ] ++ lib.optionals voiceMessagesSupport [
--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@ -0,0 +1,35 @@
+{ lib, fetchurl, appimageTools }:
+
+let
+  pname = "tutanota-desktop";
+  version = "3.88.4";
+  name = "tutanota-desktop-${version}";
+  src = fetchurl {
+    url = "https://mail.tutanota.com/desktop/tutanota-desktop-linux.AppImage";
+    name = "tutanota-desktop-${version}.AppImage";
+    sha256 = "sha256-MwvH6SGZwcvxAr5olklqKTF2p2pv8+F5qwpmwN3uZkc=";
+  };
+  appimageContents = appimageTools.extractType2 { inherit name src; };
+
+in appimageTools.wrapType2 {
+  inherit name src;
+
+  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ pkgs.libsecret ];
+
+  extraInstallCommands = ''
+    mv $out/bin/${name} $out/bin/${pname}
+
+    install -m 444 -D ${appimageContents}/tutanota-desktop.desktop -t $out/share/applications
+    substituteInPlace $out/share/applications/tutanota-desktop.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+    cp -r ${appimageContents}/usr/share/icons $out/share
+  '';
+
+  meta = with lib; {
+    description = "Tutanota official desktop client";
+    homepage = "https://tutanota.com/";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ wolfangaukang ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/networking/onionshare/default.nix
+++ b/pkgs/applications/networking/onionshare/default.nix
@ -55,7 +55,7 @@ let
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ lourkeur ];
  };
-  stem' = stem.overrideAttrs (_: rec {
+  stem' = stem.overridePythonAttrs (_: rec {
    version = "1.8.1";

    src = fetchFromGitHub {
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, pcre, perl, flex, bison, gettext, libpcap, libnl, c-ares
-, gnutls, libgcrypt, libgpgerror, geoip, openssl, lua5, python3, libcap, glib
+, gnutls, libgcrypt, libgpg-error, geoip, openssl, lua5, python3, libcap, glib
 , libssh, nghttp2, zlib, cmake, makeWrapper
 , withQt ? true, qt5 ? null
 , ApplicationServices, SystemConfiguration, gmp
@ -10,7 +10,7 @@ assert withQt  -> qt5  != null;
 with lib;

 let
-  version = "3.4.8";
+  version = "3.4.9";
  variant = if withQt then "qt" else "cli";

 in stdenv.mkDerivation {
@ -20,7 +20,7 @@ in stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz";
-    sha256 = "09fpvfj4m7glisj6p4zb8wylkrjkqqw69xnwnz4ah410zs6zm9sq";
+    sha256 = "084nv4fbgpxsf6b6cfi6cinn8l3wsbn0g8lsd7p2aifjkf15wln6";
  };

  cmakeFlags = [
@ -37,7 +37,7 @@ in stdenv.mkDerivation {

  buildInputs = [
    gettext pcre perl libpcap lua5 libssh nghttp2 openssl libgcrypt
-    libgpgerror gnutls geoip c-ares python3 glib zlib
+    libgpg-error gnutls geoip c-ares python3 glib zlib
  ] ++ optionals withQt  (with qt5; [ qtbase qtmultimedia qtsvg qttools ])
    ++ optionals stdenv.isLinux  [ libcap libnl ]
    ++ optionals stdenv.isDarwin [ SystemConfiguration ApplicationServices gmp ]
--- a/pkgs/applications/terminal-emulators/foot/default.nix
+++ b/pkgs/applications/terminal-emulators/foot/default.nix
@ -27,7 +27,7 @@
 }:

 let
-  version = "1.9.0";
+  version = "1.9.2";

  # build stimuli file for PGO build and the script to generate it
  # independently of the foot's build, so we can cache the result
@ -36,8 +36,7 @@ let
  #
  # For every bump, make sure that the hash is still accurate.
  stimulusGenerator = stdenv.mkDerivation {
-    pname = "foot-generate-alt-random-writes";
-    inherit version;
+    name = "foot-generate-alt-random-writes";

    src = fetchurl {
      url = "https://codeberg.org/dnkl/foot/raw/tag/${version}/scripts/generate-alt-random-writes.py";
@ -100,7 +99,7 @@ stdenv.mkDerivation rec {
    owner = "dnkl";
    repo = pname;
    rev = version;
-    sha256 = "0mkzq5lbgl5qp5nj8sk5gyg9hrrklmbjdqzlcr2a6rlmilkxlhwm";
+    sha256 = "15h01ijx87i60bdgjjap1ymwlxggsxc6iziykh3bahj8432s1836";
  };

  depsBuildBuild = [
@ -144,16 +143,15 @@ stdenv.mkDerivation rec {

  mesonBuildType = "release";

+  # See https://codeberg.org/dnkl/foot/src/tag/1.9.2/INSTALL.md#options
  mesonFlags = [
+    # Use lto
    "-Db_lto=true"
-    # Prevent foot from installing its terminfo file into a custom location,
-    # we need to do this manually in postInstall.
-    # See https://codeberg.org/dnkl/foot/pulls/673,
-    # https://codeberg.org/dnkl/foot/src/tag/1.9.0/INSTALL.md#options
-    "-Dterminfo=disabled"
+    # “Build” and install terminfo db
+    "-Dterminfo=enabled"
    # Ensure TERM=foot is used
    "-Ddefault-terminfo=foot"
-    # Tell foot what to set TERMINFO to
+    # Tell foot to set TERMINFO and where to install the terminfo files
    "-Dcustom-terminfo-install-location=${terminfoDir}"
  ];

@ -174,13 +172,6 @@ stdenv.mkDerivation rec {

  outputs = [ "out" "terminfo" ];

-  postInstall = ''
-    # build and install foot's terminfo to the standard location
-    # instead of its custom location
-    mkdir -p "${terminfoDir}"
-    tic -o "${terminfoDir}" -x -e foot,foot-direct "$NIX_BUILD_TOP/$sourceRoot/foot.info"
-  '';
-
  passthru.tests = {
    clang-default-compilation = foot.override {
      inherit (llvmPackages) stdenv;
@ -193,6 +184,13 @@ stdenv.mkDerivation rec {
    noPgo = foot.override {
      allowPgo = false;
    };
+
+    # By changing name, this will get rebuilt everytime we change version,
+    # even if the hash stays the same. Consequently it'll fail if we introduce
+    # a hash mismatch when updating.
+    stimulus-script-is-current = stimulusGenerator.src.overrideAttrs (_: {
+      name = "generate-alt-random-writes-${version}.py";
+    });
  };

  meta = with lib; {
--- a/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/lefthook/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "lefthook";
-  version = "0.7.6";
+  version = "0.7.7";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "evilmartians";
    repo = "lefthook";
-    sha256 = "sha256-qCj6FsbzxnMISCITKFcIIYtqMiHzSNYNjlpgpE9S/Ss=";
+    sha256 = "sha256-XyuXegCTJSW4uO6fEaRKq/jZnE+JbrxZw0kcDvhpsVo=";
  };

  vendorSha256 = "sha256-Rp67FnFU27u85t02MIs7wZQoOa8oGsHVVPQ9OdIyTJg=";
--- a/pkgs/applications/video/kodi/unwrapped.nix
+++ b/pkgs/applications/video/kodi/unwrapped.nix
@ -1,6 +1,6 @@
 { stdenv, lib, fetchFromGitHub, autoconf, automake, libtool, makeWrapper
 , pkg-config, cmake, gnumake, yasm, python3Packages
-, libgcrypt, libgpgerror, libunistring
+, libgcrypt, libgpg-error, libunistring
 , boost, avahi, lame
 , gettext, pcre-cpp, yajl, fribidi, which
 , openssl, gperf, tinyxml2, taglib, libssh, swig, jre_headless
@ -122,7 +122,7 @@ in stdenv.mkDerivation {
      sqlite libmysqlclient avahi lame
      curl bzip2 zip unzip glxinfo
      libcec libcec_platform dcadec libuuid
-      libgcrypt libgpgerror libunistring
+      libgcrypt libgpg-error libunistring
      libcrossguid libplist
      bluez giflib glib harfbuzz lcms2 libpthreadstubs
      ffmpeg flatbuffers fmt fstrcmp rapidjson
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@ -2,7 +2,7 @@
 , libarchive, perl, xorg, libdvdnav, libbluray
 , zlib, a52dec, libmad, faad2, ffmpeg, alsa-lib
 , pkg-config, dbus, fribidi, freefont_ttf, libebml, libmatroska
-, libvorbis, libtheora, speex, lua5, libgcrypt, libgpgerror, libupnp
+, libvorbis, libtheora, speex, lua5, libgcrypt, libgpg-error, libupnp
 , libcaca, libpulseaudio, flac, schroedinger, libxml2, librsvg
 , mpeg2dec, systemd, gnutls, avahi, libcddb, libjack2, SDL, SDL_image
 , libmtp, unzip, taglib, libkate, libtiger, libv4l, samba, libssh2, liboggz
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
  # needing them
  buildInputs = [
    zlib a52dec libmad faad2 ffmpeg alsa-lib libdvdnav libdvdnav.libdvdread
-    libbluray dbus fribidi libvorbis libtheora speex lua5 libgcrypt libgpgerror
+    libbluray dbus fribidi libvorbis libtheora speex lua5 libgcrypt libgpg-error
    libupnp libcaca libpulseaudio flac schroedinger libxml2 librsvg mpeg2dec
    systemd gnutls avahi libcddb SDL SDL_image libmtp taglib libarchive
    libkate libtiger libv4l samba libssh2 liboggz libass libdvbpsi libva
--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@ -175,7 +175,7 @@ rec {

      harfbuzz
      e2fsprogs
-      libgpgerror
+      libgpg-error
      keyutils.lib
      libjack2
      fribidi
--- a/pkgs/build-support/fetchfirefoxaddon/default.nix
+++ b/pkgs/build-support/fetchfirefoxaddon/default.nix
@ -2,19 +2,26 @@

 {
  name
-, url
+, url ? null
 , md5 ? ""
 , sha1 ? ""
 , sha256 ? ""
 , sha512 ? ""
 , fixedExtid ? null
 , hash ? ""
+, src ? ""
 }:

-stdenv.mkDerivation rec {
-
-  inherit name;
+let
  extid = if fixedExtid == null then "nixos@${name}" else fixedExtid;
+  source = if url == null then src else fetchurl {
+    url = url;
+    inherit md5 sha1 sha256 sha512 hash;
+  };
+in
+stdenv.mkDerivation {
+  inherit name;
+
  passthru = {
    inherit extid;
  };
@ -26,16 +33,12 @@ stdenv.mkDerivation rec {

    UUID="${extid}"
    mkdir -p "$out/$UUID"
-    unzip -q ${src} -d "$out/$UUID"
+    unzip -q ${source} -d "$out/$UUID"
    NEW_MANIFEST=$(jq '. + {"applications": { "gecko": { "id": "${extid}" }}, "browser_specific_settings":{"gecko":{"id": "${extid}"}}}' "$out/$UUID/manifest.json")
    echo "$NEW_MANIFEST" > "$out/$UUID/manifest.json"
    cd "$out/$UUID"
    zip -r -q -FS "$out/$UUID.xpi" *
    rm -r "$out/$UUID"
  '';
-  src = fetchurl {
-    url = url;
-    inherit md5 sha1 sha256 sha512 hash;
-  };
  nativeBuildInputs = [ coreutils unzip zip jq  ];
 }
--- a/pkgs/build-support/fetchfirefoxaddon/tests.nix
+++ b/pkgs/build-support/fetchfirefoxaddon/tests.nix
@ -1,4 +1,4 @@
-{ invalidateFetcherByDrvHash, fetchFirefoxAddon, ... }:
+{ invalidateFetcherByDrvHash, fetchFirefoxAddon, fetchurl, ... }:

 {
  simple = invalidateFetcherByDrvHash fetchFirefoxAddon {
@ -7,4 +7,15 @@
    url = "https://addons.mozilla.org/firefox/downloads/file/3059971/image_search_options-3.0.12-fx.xpi";
    sha256 = "sha256-H73YWX/DKxvhEwKpWOo7orAQ7c/rQywpljeyxYxv0Gg=";
  };
+  overidden-source =
+    let
+      image-search-options = fetchurl {
+        url = "https://addons.mozilla.org/firefox/downloads/file/3059971/image_search_options-3.0.12-fx.xpi";
+        sha256 = "sha256-H73YWX/DKxvhEwKpWOo7orAQ7c/rQywpljeyxYxv0Gg=";
+      };
+    in
+    invalidateFetcherByDrvHash fetchFirefoxAddon {
+      name = "image-search-options";
+      src = image-search-options;
+    };
 }
--- a/pkgs/development/interpreters/angelscript/default.nix
+++ b/pkgs/development/interpreters/angelscript/default.nix
@ -1,20 +1,17 @@
-{ lib, stdenv, fetchurl, unzip, cmake }:
-let
-  s = # Generated upstream information
-  rec {
-    baseName="angelscript";
-    version = "2.35.0";
-    name="${baseName}-${version}";
-    url="http://www.angelcode.com/angelscript/sdk/files/angelscript_${version}.zip";
-    sha256 = "sha256-AQ3UXiPnNNRvWJHXDiaGB6EsuasSUD3aQvhC2dt+iFc=";
-  };
+{ lib
+, stdenv
+, fetchurl
+, unzip
+, cmake
+}:

-in
-stdenv.mkDerivation {
-  inherit (s) name version;
+stdenv.mkDerivation rec {
+  pname = "angelscript";
+  version = "2.35.1";

  src = fetchurl {
-    inherit (s) url sha256;
+    url = "https://www.angelcode.com/angelscript/sdk/files/angelscript_${version}.zip";
+    sha256 = "12x12fs2bjkbh73n2w84wnqhg6xn6mnp6g79gbkwfl6gssv9c42w";
  };

  nativeBuildInputs = [ unzip cmake ];
@ -32,7 +29,6 @@ stdenv.mkDerivation {
  '';

  meta = with lib; {
-    inherit (s) version;
    description = "Light-weight scripting library";
    license = licenses.zlib;
    maintainers = with maintainers; [ raskin ];
--- a/pkgs/development/interpreters/angelscript/default.upstream
+++ b/pkgs/development/interpreters/angelscript/default.upstream
@ -1,4 +0,0 @@
-url http://www.angelcode.com/angelscript/downloads.html
-version_link '[.]zip$'
-version '.*_([0-9.]+)[.].*' '\1'
-do_overwrite () { do_overwrite_just_version ; }
--- a/pkgs/development/interpreters/bqn/cbqn/default.nix
+++ b/pkgs/development/interpreters/bqn/cbqn/default.nix
@ -11,20 +11,21 @@ let
    name = "cbqn-bytecode-files";
    owner = "dzaima";
    repo = "CBQN";
-    rev = "94bb312d20919f942eabed3dca33c514de3c3227";
-    hash = "sha256-aFw5/F7/sYkYmxAnGeK8EwkoVrbEcjuJAD9YT+iW9Rw=";
+    rev = "4d23479cdbd5ac6eb512c376ade58077b814b2b7";
+    hash = "sha256-MTvg4lOB26bqvJTqV71p4Y4qDjTYaOE40Jk4Sle/hsY=";
  };
 in
 assert genBytecode -> ((bqn-path != null) && (mbqn-source != null));
+
 stdenv.mkDerivation rec {
  pname = "cbqn" + lib.optionalString (!genBytecode) "-standalone";
-  version = "0.0.0+unstable=2021-10-01";
+  version = "0.pre+unstable=2021-10-05";

  src = fetchFromGitHub {
    owner = "dzaima";
    repo = "CBQN";
-    rev = "3725bd58c758a749653080319766a33169551536";
-    hash = "sha256-xWp64inFZRqGGTrH6Hqbj7aA0vYPyd+FdetowTMTjPs=";
+    rev = "e23dab20daff9c0dacc2561c616174af72029a3e";
+    hash = "sha256-amVKKD9hD5A+LbqglXHLKEsYqFSSztdXs1FCoNJyCJ4=";
  };

  dontConfigure = true;
@ -34,6 +35,9 @@ stdenv.mkDerivation rec {
  '';

  preBuild = ''
+    # otherwise cbqn defaults to clang
+    makeFlagsArray+=("CC=$CC")
+
    # inform make we are providing the runtime ourselves
    touch src/gen/customRuntime
  '' + (if genBytecode then ''
@ -42,10 +46,6 @@ stdenv.mkDerivation rec {
    cp ${cbqn-bytecode-files}/src/gen/{compiler,formatter,runtime0,runtime1,src} src/gen/
  '');

-  makeFlags = [
-    "CC=${stdenv.cc.targetPrefix}cc"
-  ];
-
  installPhase = ''
     runHook preInstall

@ -63,8 +63,7 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ AndersonTorres sternenseemann synthetica ];
    platforms = platforms.all;
-    priority = if genBytecode then 0 else 10;
  };
 }
-# TODO: factor and version cbqn-bytecode-files
+# TODO: version cbqn-bytecode-files
 # TODO: test suite
--- a/pkgs/development/interpreters/bqn/dzaima-bqn/default.nix
+++ b/pkgs/development/interpreters/bqn/dzaima-bqn/default.nix
@ -8,7 +8,7 @@

 stdenv.mkDerivation rec {
  pname = "dbqn" + lib.optionalString buildNativeImage "-native";
-  version = "0.0.0+unstable=2021-10-05";
+  version = "0.pre+unstable=2021-10-05";

  src = fetchFromGitHub {
    owner = "dzaima";
--- a/pkgs/development/interpreters/bqn/mlochbaum-bqn/default.nix
+++ b/pkgs/development/interpreters/bqn/mlochbaum-bqn/default.nix
@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "bqn";
-  version = "0.0.0+unstable=2021-10-01";
+  version = "0.pre+unstable=2021-10-06";

  src = fetchFromGitHub {
    owner = "mlochbaum";
    repo = "BQN";
-    rev = "b3d68f730d48ccb5e3b3255f9010c95bf9f86e22";
-    hash = "sha256-Tkgwz7+d25svmjRsXFUQq0S/73QJU+BKSNeGqpUcBTQ=";
+    rev = "2ce2dc40702431ef3d3ffece9e2f6f8b883ac6c5";
+    hash = "sha256-bvXKOaBlddG6O0GbmtqU9prklqmOOvlbXuCUaFO+j0M=";
  };

  nativeBuildInputs = [ makeWrapper ];
@ -21,7 +21,7 @@ stdenvNoCC.mkDerivation rec {
  buildInputs = [ nodejs ];

  patches = [
-    # Creates a @libbqn@ substitution variable
+    # Creates a @libbqn@ substitution variable, to be filled in the fixupPhase
    ./001-libbqn-path.patch
  ];

--- a/pkgs/development/libraries/aqbanking/gwenhywfar.nix
+++ b/pkgs/development/libraries/aqbanking/gwenhywfar.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, gnutls, openssl, libgcrypt, libgpgerror, pkg-config, gettext
+{ lib, stdenv, fetchurl, gnutls, openssl, libgcrypt, libgpg-error, pkg-config, gettext
 , which

 # GUI support
@ -55,7 +55,7 @@ in stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkg-config gettext which ];

-  buildInputs = [ gtk2 gtk3 qt5.qtbase gnutls openssl libgcrypt libgpgerror ];
+  buildInputs = [ gtk2 gtk3 qt5.qtbase gnutls openssl libgcrypt libgpg-error ];

  dontWrapQtApps = true;

--- a/pkgs/development/libraries/gmime/2.nix
+++ b/pkgs/development/libraries/gmime/2.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, glib, zlib, gnupg, libgpgerror, gobject-introspection }:
+{ lib, stdenv, fetchurl, pkg-config, glib, zlib, gnupg, libgpg-error, gobject-introspection }:

 stdenv.mkDerivation rec {
  version = "2.6.23";
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
  outputs = [ "out" "dev" ];

  nativeBuildInputs = [ pkg-config gobject-introspection ];
-  propagatedBuildInputs = [ glib zlib libgpgerror ];
+  propagatedBuildInputs = [ glib zlib libgpg-error ];
  configureFlags = [ "--enable-introspection=yes" ];

  postPatch = ''
--- a/pkgs/development/libraries/gpgme/default.nix
+++ b/pkgs/development/libraries/gpgme/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchpatch
-, autoreconfHook, libgpgerror, gnupg, pkg-config, glib, pth, libassuan
+, autoreconfHook, libgpg-error, gnupg, pkg-config, glib, pth, libassuan
 , file, which, ncurses
 , texinfo
 , buildPackages
@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
  outputBin = "dev"; # gpgme-config; not so sure about gpgme-tool

  propagatedBuildInputs =
-    [ libgpgerror glib libassuan pth ]
+    [ libgpg-error glib libassuan pth ]
    ++ lib.optional (qtbase != null) qtbase;

  nativeBuildInputs = [ pkg-config gnupg texinfo autoreconfHook ]
@ -52,7 +52,7 @@ stdenv.mkDerivation rec {

  configureFlags = [
    "--enable-fixed-path=${gnupg}/bin"
-    "--with-libgpg-error-prefix=${libgpgerror.dev}"
+    "--with-libgpg-error-prefix=${libgpg-error.dev}"
    "--with-libassuan-prefix=${libassuan.dev}"
  ] ++ lib.optional pythonSupport "--enable-languages=python"
  # Tests will try to communicate with gpg-agent instance via a UNIX socket
--- a/pkgs/development/libraries/libaacs/default.nix
+++ b/pkgs/development/libraries/libaacs/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libgcrypt, libgpgerror, bison, flex }:
+{ lib, stdenv, fetchurl, libgcrypt, libgpg-error, bison, flex }:

 # library that allows libbluray to play AACS protected bluray disks
 # libaacs does not infringe DRM's right or copyright. See the legal page of the website for more info.
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    sha256 = "11skjqjlldmbjkyxdcz4fmcn6y4p95r1xagbcnjy4ndnzf0l723d";
  };

-  buildInputs = [ libgcrypt libgpgerror ];
+  buildInputs = [ libgcrypt libgpg-error ];

  nativeBuildInputs = [ bison flex ];

--- a/pkgs/development/libraries/libassuan/default.nix
+++ b/pkgs/development/libraries/libassuan/default.nix
@ -1,4 +1,4 @@
-{ fetchurl, lib, stdenv, gettext, npth, libgpgerror, buildPackages }:
+{ fetchurl, lib, stdenv, gettext, npth, libgpg-error, buildPackages }:

 stdenv.mkDerivation rec {
  pname = "libassuan";
@ -16,14 +16,14 @@ stdenv.mkDerivation rec {
  buildInputs = [ npth gettext ];

  configureFlags = [
-    "--with-libgpg-error-prefix=${libgpgerror.dev}"
+    "--with-libgpg-error-prefix=${libgpg-error.dev}"
  ];

  doCheck = true;

  # Make sure includes are fixed for callers who don't use libassuan-config
  postInstall = ''
-    sed -i 's,#include <gpg-error.h>,#include "${libgpgerror.dev}/include/gpg-error.h",g' $dev/include/assuan.h
+    sed -i 's,#include <gpg-error.h>,#include "${libgpg-error.dev}/include/gpg-error.h",g' $dev/include/assuan.h
  '';

  meta = with lib; {
--- a/pkgs/development/libraries/libbdplus/default.nix
+++ b/pkgs/development/libraries/libbdplus/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libgcrypt, libgpgerror, gettext }:
+{ lib, stdenv, fetchurl, libgcrypt, libgpg-error, gettext }:

 # library that allows libbluray to play BDplus protected bluray disks
 # libaacs does not infringe DRM's right or copyright. See the legal page of the website for more info.
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    sha256 = "02n87lysqn4kg2qk7d1ffrp96c44zkdlxdj0n16hbgrlrpiwlcd6";
  };

-  buildInputs = [ libgcrypt libgpgerror gettext ];
+  buildInputs = [ libgcrypt libgpg-error gettext ];

  nativeBuildInputs = [ ];

--- a/pkgs/development/libraries/libcanberra/default.nix
+++ b/pkgs/development/libraries/libcanberra/default.nix
@ -13,9 +13,11 @@ stdenv.mkDerivation rec {
    sha256 = "0wps39h8rx2b00vyvkia5j40fkak3dpipp1kzilqla0cgvk73dn2";
  };

-  nativeBuildInputs = [ pkg-config libtool ];
+  strictDeps = true;
+  nativeBuildInputs = [ pkg-config ];
  buildInputs = [
    libpulseaudio libvorbis
+    libtool # in buildInputs rather than nativeBuildInputs since libltdl is used (not libtool itself)
  ] ++ (with gst_all_1; [ gstreamer gst-plugins-base ])
    ++ lib.optional (gtkSupport == "gtk2") gtk2-x11
    ++ lib.optional (gtkSupport == "gtk3") gtk3-x11
--- a/pkgs/development/libraries/libcdada/default.nix
+++ b/pkgs/development/libraries/libcdada/default.nix
@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, autoreconfHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libcdada";
+  version = "0.3.5";
+
+  src = fetchFromGitHub {
+    owner = "msune";
+    repo = "libcdada";
+    rev = "v${version}";
+    sha256 = "0vcsf3s4fbw2w33jjc8b509kc0xb6ld58l8wfxgqwjqx5icfg1ps";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
+  configureFlags = [
+    "--without-tests"
+    "--without-examples"
+  ];
+
+  meta = with lib; {
+    description = "Library for basic data structures in C";
+    longDescription = ''
+      Basic data structures in C: list, set, map/hashtable, queue... (libstdc++ wrapper)
+    '';
+    homepage = "https://github.com/msune/libcdada";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ _0x4A6F ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/libraries/libgcrypt/1.5.nix
+++ b/pkgs/development/libraries/libgcrypt/1.5.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchpatch, fetchurl, libgpgerror, enableCapabilities ? false, libcap }:
+{ lib, stdenv, fetchpatch, fetchurl, libgpg-error, enableCapabilities ? false, libcap }:

 assert enableCapabilities -> stdenv.isLinux;

@ -19,13 +19,13 @@ stdenv.mkDerivation rec {
  ];

  buildInputs =
-    [ libgpgerror ]
+    [ libgpg-error ]
    ++ lib.optional enableCapabilities libcap;

  # Make sure libraries are correct for .pc and .la files
  # Also make sure includes are fixed for callers who don't use libgpgcrypt-config
  postInstall = ''
-    sed -i 's,#include <gpg-error.h>,#include "${libgpgerror.dev}/include/gpg-error.h",g' $out/include/gcrypt.h
+    sed -i 's,#include <gpg-error.h>,#include "${libgpg-error.dev}/include/gpg-error.h",g' $out/include/gcrypt.h
  '' + lib.optionalString enableCapabilities ''
    sed -i 's,\(-lcap\),-L${libcap.lib}/lib \1,' $out/lib/libgcrypt.la
  '';
--- a/pkgs/development/libraries/libgcrypt/default.nix
+++ b/pkgs/development/libraries/libgcrypt/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, gettext, libgpgerror, enableCapabilities ? false, libcap, buildPackages }:
+{ lib, stdenv, fetchurl, gettext, libgpg-error, enableCapabilities ? false, libcap, buildPackages }:

 assert enableCapabilities -> stdenv.isLinux;

@ -21,13 +21,13 @@ stdenv.mkDerivation rec {

  depsBuildBuild = [ buildPackages.stdenv.cc ];

-  buildInputs = [ libgpgerror ]
+  buildInputs = [ libgpg-error ]
    ++ lib.optional stdenv.isDarwin gettext
    ++ lib.optional enableCapabilities libcap;

  strictDeps = true;

-  configureFlags = [ "--with-libgpg-error-prefix=${libgpgerror.dev}" ]
+  configureFlags = [ "--with-libgpg-error-prefix=${libgpg-error.dev}" ]
      ++ lib.optional (stdenv.hostPlatform.isMusl || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)) "--disable-asm"; # for darwin see https://dev.gnupg.org/T5157

  # Necessary to generate correct assembly when compiling for aarch32 on
@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
  # Make sure libraries are correct for .pc and .la files
  # Also make sure includes are fixed for callers who don't use libgpgcrypt-config
  postFixup = ''
-    sed -i 's,#include <gpg-error.h>,#include "${libgpgerror.dev}/include/gpg-error.h",g' "$dev/include/gcrypt.h"
+    sed -i 's,#include <gpg-error.h>,#include "${libgpg-error.dev}/include/gpg-error.h",g' "$dev/include/gcrypt.h"
  '' + lib.optionalString enableCapabilities ''
    sed -i 's,\(-lcap\),-L${libcap.lib}/lib \1,' $out/lib/libgcrypt.la
  '';
--- a/pkgs/development/libraries/libgrss/default.nix
+++ b/pkgs/development/libraries/libgrss/default.nix
@ -1,4 +1,6 @@
-{ lib, stdenv, fetchurl, fetchpatch, pkg-config, vala, gobject-introspection, gtk-doc, docbook_xsl, docbook_xml_dtd_412, glib, libxml2, libsoup, gnome }:
+{ lib, stdenv, fetchurl, fetchpatch, pkg-config, vala, gobject-introspection, gtk-doc
+, docbook_xsl, docbook_xml_dtd_412, glib, libxml2, libsoup, gnome, buildPackages
+}:

 stdenv.mkDerivation rec {
  pname = "libgrss";
@ -20,10 +22,24 @@ stdenv.mkDerivation rec {
    })
  ];

-  nativeBuildInputs = [ pkg-config vala gobject-introspection gtk-doc docbook_xsl docbook_xml_dtd_412 ];
-  buildInputs = [ glib libxml2 libsoup ];
+  nativeBuildInputs = [
+    pkg-config
+    vala
+    gobject-introspection
+    gtk-doc
+    docbook_xsl
+    docbook_xml_dtd_412
+  ];
+
+  buildInputs = [
+    glib
+    libxml2
+    libsoup
+  ];

  configureFlags = [
+    "PKG_CONFIG=${buildPackages.pkg-config}/bin/${buildPackages.pkg-config.targetPrefix}pkg-config"
+  ] ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
    "--enable-gtk-doc"
  ];

--- a/pkgs/development/libraries/libksba/default.nix
+++ b/pkgs/development/libraries/libksba/default.nix
@ -1,4 +1,4 @@
-{ buildPackages, lib, stdenv, fetchurl, gettext, libgpgerror }:
+{ buildPackages, lib, stdenv, fetchurl, gettext, libgpg-error }:

 stdenv.mkDerivation rec {
  name = "libksba-1.5.1";
@ -11,10 +11,10 @@ stdenv.mkDerivation rec {
  outputs = [ "out" "dev" "info" ];

  buildInputs = [ gettext ];
-  propagatedBuildInputs = [ libgpgerror ];
+  propagatedBuildInputs = [ libgpg-error ];
  depsBuildBuild = [ buildPackages.stdenv.cc ];

-  configureFlags = [ "--with-libgpg-error-prefix=${libgpgerror.dev}" ];
+  configureFlags = [ "--with-libgpg-error-prefix=${libgpg-error.dev}" ];

  postInstall = ''
    mkdir -p $dev/bin
--- a/pkgs/development/libraries/libopenglrecorder/default.nix
+++ b/pkgs/development/libraries/libopenglrecorder/default.nix
@ -0,0 +1,46 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, pkg-config
+, libjpeg
+, libvpx
+, openh264
+, withPulse ? stdenv.hostPlatform.isLinux
+, libpulseaudio
+, libvorbis
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libopenglrecorder";
+  version = "unstable-2020-08-13";
+
+  src = fetchFromGitHub {
+    owner = "Benau";
+    repo = "libopenglrecorder";
+    rev = "c1b81ce26e62fae1aaa086b5cd337cb12361ea3d";
+    sha256 = "13s2d7qs8z4w0gb3hx03n97xmwl07d4s473m4gw90qcvmz217kiz";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    libjpeg
+    libvpx
+    openh264
+  ] ++ lib.optionals withPulse [
+    libpulseaudio
+    libvorbis
+  ];
+
+  meta = with lib; {
+    description = "Library allowing Optional async readback OpenGL frame buffer with optional audio recording";
+    homepage = "https://github.com/Benau/libopenglrecorder";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ OPNA2608 ];
+    platforms = with platforms; windows ++ linux;
+  };
+}
--- a/pkgs/development/libraries/ntbtls/default.nix
+++ b/pkgs/development/libraries/ntbtls/default.nix
@ -1,6 +1,4 @@
-{ lib, stdenv, fetchurl, gettext, libgpgerror, libgcrypt, libksba, zlib }:
-
-with lib;
+{ lib, stdenv, fetchurl, gettext, libgpg-error, libgcrypt, libksba, zlib }:

 stdenv.mkDerivation rec {
  pname = "ntbtls";
@ -13,14 +11,14 @@ stdenv.mkDerivation rec {

  outputs = [ "dev" "out" ];

-  buildInputs = [ libgcrypt libgpgerror libksba zlib ]
+  buildInputs = [ libgcrypt libgpg-error libksba zlib ]
    ++ lib.optional stdenv.isDarwin gettext;

  postInstall = ''
    moveToOutput "bin/ntbtls-config" $dev
  '';

-  meta = {
+  meta = with lib; {
    description = "A tiny TLS 1.2 only implementation";
    homepage = "https://www.gnupg.org/software/ntbtls/";
    license = licenses.gpl3Plus;
--- a/pkgs/development/libraries/utf8cpp/default.nix
+++ b/pkgs/development/libraries/utf8cpp/default.nix
@ -2,20 +2,18 @@

 stdenv.mkDerivation rec {
  pname = "utf8cpp";
-  version = "3.1.2";
+  version = "3.2.1";

  src = fetchFromGitHub {
    owner = "nemtrif";
    repo = "utfcpp";
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-l5sneFsuvPDIRni2x+aR9fmQ9bzXNnIiP9EzZ63sNtg=";
+    sha256 = "0gsbwif97i025bxgyax4fbf6v9z44zrca4s6wwd8x36ac8qzjppf";
  };

  cmakeFlags = [
-    "-DCMAKE_BUILD_TYPE=None"
    "-DCMAKE_INSTALL_LIBDIR=lib"
-    "-DINSTALL_GTEST=OFF"
  ];

  nativeBuildInputs = [ cmake ];
@ -25,7 +23,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "https://github.com/nemtrif/utfcpp";
    description = "UTF-8 with C++ in a Portable Way";
-    license = licenses.free;
+    license = licenses.boost;
    maintainers = with maintainers; [ jobojeha ];
    platforms = platforms.all;
  };
--- a/pkgs/development/ocaml-modules/curses/default.nix
+++ b/pkgs/development/ocaml-modules/curses/default.nix
@ -1,17 +1,19 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ncurses }:
+{ lib, stdenv, fetchFromGitHub, ocaml, findlib, ncurses }:

 stdenv.mkDerivation rec {
  pname = "ocaml-curses";
-  version = "1.0.4";
+  version = "1.0.8";

-  src = fetchurl {
-    url = "http://ocaml.phauna.org/distfiles/ocaml-curses-${version}.ogunden1.tar.gz";
-    sha256 = "08wq1r93lincdfzlriyc5nl2p4q7ca4h6ygzgp1nhkgd93pgk9v2";
+  src = fetchFromGitHub {
+    owner = "mbacarella";
+    repo = "curses";
+    rev = version;
+    sha256 = "0yy3wf8i7jgvzdc40bni7mvpkvclq97cgb5fw265mrjj0iqpkqpd";
  };

  propagatedBuildInputs = [ ncurses ];

-  buildInputs = [ ocaml findlib ];
+  nativeBuildInputs = [ ocaml findlib ];

  # Fix build for recent ncurses versions
  NIX_CFLAGS_COMPILE = "-DNCURSES_INTERNALS=1";
@ -26,8 +28,9 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "OCaml Bindings to curses/ncurses";
-    homepage = "https://opam.ocaml.org/packages/curses/curses.1.0.4/";
-    license = licenses.gpl2;
+    homepage = "https://github.com/mbacarella/curses";
+    license = licenses.lgpl21Plus;
+    changelog = "https://github.com/mbacarella/curses/raw/${version}/CHANGES";
    maintainers = [ maintainers.volth ];
    platforms = ocaml.meta.platforms or [];
  };
--- a/pkgs/development/python-modules/aiodiscover/default.nix
+++ b/pkgs/development/python-modules/aiodiscover/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "aiodiscover";
-  version = "1.4.2";
+  version = "1.4.4";
  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "bdraco";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-xiIN/YLIOdPuqenyxybu0iUpYEy3MyBssXswza5InU0=";
+    sha256 = "sha256-DobTx6oUr25J8bolo84V4yTT0b0jBsOIzPn93uAmDl0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "aiohomekit";
-  version = "0.6.2";
+  version = "0.6.3";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "Jc2k";
    repo = pname;
    rev = version;
-    sha256 = "16lfav83g12vzs3ssfva7chcqqb7xdx54djwfwyn9xcwfaa7cwhw";
+    sha256 = "sha256-XBinbhYUB9BuQxxmWfZUw276uNam4DgBpiCAjT7KDlg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/aiohue/default.nix
+++ b/pkgs/development/python-modules/aiohue/default.nix
@ -6,11 +6,11 @@

 buildPythonPackage rec {
  pname = "aiohue";
-  version = "2.6.1";
+  version = "2.6.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0101bw2n6vd3c0p323qqr61wwraja48xbrwcw5sn7i5sa3ygfx0k";
+    sha256 = "sha256-zpwkDKPrE5TFZQO0A1ifTQ7n+TRFpXi3jai3h5plyGM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@ -7,13 +7,13 @@

 buildPythonPackage rec {
  pname = "aioshelly";
-  version = "0.6.4";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "home-assistant-libs";
    repo = pname;
    rev = version;
-    sha256 = "sha256-QRCqkaKhPQQjNt9mw8nlTB5YKLmIZbXfrxarb3Ksr5k=";
+    sha256 = "sha256-STJ9BDVbvlIMvKMiGwkGZ9Z32NvlE+3cyYduYlwTbx4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/airthings/default.nix
+++ b/pkgs/development/python-modules/airthings/default.nix
@ -0,0 +1,39 @@
+{ lib
+, aiohttp
+, async-timeout
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "airthings";
+  version = "0.0.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchFromGitHub {
+    owner = "Danielhiversen";
+    repo = "pyAirthings";
+    rev = version;
+    sha256 = "08cbysx5p9k8hzr6sdykx91j0gx8x15b8807338dsl3qx8nhfb8j";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+    async-timeout
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "airthings" ];
+
+  meta = with lib; {
+    description = "Python module for Airthings";
+    homepage = "https://github.com/Danielhiversen/pyAirthings";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/androguard/default.nix
+++ b/pkgs/development/python-modules/androguard/default.nix
@ -21,8 +21,8 @@
 , codecov
 , coverage
 , qt5
-# This is usually used as a library, and it'd be a shame to force the gui
-# libraries to the closure if gui is not desired.
+# This is usually used as a library, and it'd be a shame to force the GUI
+# libraries to the closure if GUI is not desired.
 , withGui ? false
 # Tests take a very long time, and currently fail, but next release' tests
 # shouldn't fail
@ -30,53 +30,52 @@
 }:

 buildPythonPackage rec {
-  version = "3.3.5";
  pname = "androguard";
+  version = "3.4.0a1";

-  # No tests in pypi tarball
  src = fetchFromGitHub {
    repo = pname;
    owner = pname;
    rev = "v${version}";
-    sha256 = "0zc8m1xnkmhz2v12ddn47q0c01p3sbna2v5npfxhcp88szswlr9y";
+    sha256 = "1aparxiq11y0hbvkayp92w684nyxyyx7mi0n1x6x51g5z6c58vmy";
  };

  propagatedBuildInputs = [
-    future
-    networkx
-    pygments
-    lxml
-    colorama
-    matplotlib
    asn1crypto
    click
-    pydot
+    colorama
+    future
    ipython
+    lxml
+    matplotlib
+    networkx
+    pydot
+    pygments
  ] ++ lib.optionals withGui [
    pyqt5
    pyperclip
  ];

  checkInputs = [
-    pyqt5
-    pyperclip
-    nose
-    nose-timer
    codecov
    coverage
    mock
+    nose
+    nose-timer
+    pyperclip
+    pyqt5
    python_magic
  ];
  inherit doCheck;

-  nativeBuildInputs = lib.optionals withGui [ qt5.wrapQtAppsHook ];
+  nativeBuildInputs = lib.optionals withGui [
+    qt5.wrapQtAppsHook
+  ];

  # If it won't be verbose, you'll see nothing going on for a long time.
  checkPhase = ''
    runHook preCheck
-
    nosetests --verbosity=3
-
    runHook postCheck
  '';

@ -84,10 +83,10 @@ buildPythonPackage rec {
    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
  '';

-  meta = {
-    description = "Tool and python library to interact with Android Files";
+  meta = with lib; {
+    description = "Tool and Python library to interact with Android Files";
    homepage = "https://github.com/androguard/androguard";
-    license = lib.licenses.asl20;
-    maintainers = [ lib.maintainers.pmiddend ];
+    license = licenses.asl20;
+    maintainers = with maintainers; [ pmiddend ];
  };
 }
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@ -17,13 +17,13 @@

 buildPythonPackage rec {
  pname = "bellows";
-  version = "0.27.0";
+  version = "0.28.0";

  src = fetchFromGitHub {
    owner = "zigpy";
    repo = "bellows";
    rev = version;
-    sha256 = "sha256-lsGpCd4XgwP91JmRpV6ohXefd1Hm9C51Jk4shU6Irkw=";
+    sha256 = "sha256-j1vS6PDvvuJapECn0lKGuBkYwWsyzJaTZDRQPjMsuLk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/boto/default.nix
+++ b/pkgs/development/python-modules/boto/default.nix
@ -1,4 +1,4 @@
-{ pkgs
+{ lib
 , buildPythonPackage
 , fetchPypi
 , pythonAtLeast
@ -24,11 +24,11 @@ buildPythonPackage rec {
    ${python.interpreter} tests/test.py default
  '';

-  doCheck = (!isPy38); # hmac functionality has changed
+  doCheck = !isPy38; # hmac functionality has changed
  checkInputs = [ nose mock ];
  propagatedBuildInputs = [ requests httpretty ];

-  meta = with pkgs.lib; {
+  meta = with lib; {
    homepage = "https://github.com/boto/boto";
    license = licenses.mit;
    description = "Python interface to Amazon Web Services";
--- a/pkgs/development/python-modules/ciso8601/default.nix
+++ b/pkgs/development/python-modules/ciso8601/default.nix
@ -8,23 +8,27 @@

 buildPythonPackage rec {
  pname = "ciso8601";
-  version = "2.1.3";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "closeio";
    repo = "ciso8601";
    rev = "v${version}";
-    sha256 = "0g1aiyc1ayh0rnibyy416m5mmck38ksgdm3jsy0z3rxgmgb24951";
+    sha256 = "sha256-TqB1tQDgCkXu+QuzP6yBEH/xHxhhD/kGR2S0I8Osc5E=";
  };

  checkInputs = [
    pytz
-  ] ++ lib.optional (isPy27) unittest2;
+  ] ++ lib.optional (isPy27) [
+    unittest2
+  ];
+
+  pythonImportsCheck = [ "ciso8601" ];

  meta = with lib; {
    description = "Fast ISO8601 date time parser for Python written in C";
    homepage = "https://github.com/closeio/ciso8601";
    license = licenses.mit;
-    maintainers = [ maintainers.mic92 ];
+    maintainers = with maintainers; [ mic92 ];
  };
 }
--- a/pkgs/development/python-modules/clifford/default.nix
+++ b/pkgs/development/python-modules/clifford/default.nix
@ -1,9 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
-, fetchpatch
-, isPy27
-, future
+, pythonOlder
 , h5py
 , ipython
 , numba
@ -15,25 +13,16 @@

 buildPythonPackage rec {
  pname = "clifford";
-  version = "1.3.1";
-  disabled = isPy27;
+  version = "1.4.0";
+
+  disabled = pythonOlder "3.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "ade11b20d0631dfc9c2f18ce0149f1e61e4baf114108b27cfd68e5c1619ecc0c";
+    sha256 = "sha256-eVE8FrD0YHoRreY9CrNb8v4v4KrG83ZU0oFz+V+p+Q0=";
  };

-  patches = [
-    (fetchpatch {
-      # Compatibility with h5py 3.
-      # Will be included in the next releasse after 1.3.1
-      url = "https://github.com/pygae/clifford/pull/388/commits/955d141662c68d3d61aa50a162b39e656684c208.patch";
-      sha256 = "0pkpwnk0kfdxsbzsxqlqh8kgif17l5has0mg31g3kyp8lncj89b1";
-    })
-  ];
-
  propagatedBuildInputs = [
-    future
    h5py
    numba
    numpy
@ -55,15 +44,24 @@ buildPythonPackage rec {
    "veryslow"
    "test_algebra_initialisation"
    "test_cga"
-    "test_estimate_rotor_sequential[random_sphere]"
+    "test_grade_projection"
+    "test_multiple_grade_projection"
+    "test_inverse"
+    "test_inv_g4"
  ];

+  disabledTestPaths = [
+    # Disable failing tests
+    "test_g3c_tools.py"
+    "test_multivector_inverse.py"
+  ];
+
+  pythonImportsCheck = [ "clifford" ];
+
  meta = with lib; {
    description = "Numerical Geometric Algebra Module";
    homepage = "https://clifford.readthedocs.io";
    license = licenses.bsd3;
-    maintainers = [ maintainers.costrouc ];
-    # many TypeError's in tests
-    broken = true;
+    maintainers = with maintainers; [ costrouc ];
  };
 }
--- a/pkgs/development/python-modules/dask-jobqueue/default.nix
+++ b/pkgs/development/python-modules/dask-jobqueue/default.nix
@ -1,10 +1,11 @@
 { lib
 , buildPythonPackage
-, fetchPypi
 , dask
 , distributed
 , docrep
-, pytest
+, fetchPypi
+, pytest-asyncio
+, pytestCheckHook
 }:

 buildPythonPackage rec {
@ -16,19 +17,33 @@ buildPythonPackage rec {
    sha256 = "682d7cc0e6b319b6ab83a7a898680c12e9c77ddc77df380b40041290f55d4e79";
  };

-  checkInputs = [ pytest ];
-  propagatedBuildInputs = [ dask distributed docrep ];
+  propagatedBuildInputs = [
+    dask
+    distributed
+    docrep
+  ];

-  # do not run entire tests suite (requires slurm, sge, etc.)
-  checkPhase = ''
-    py.test dask_jobqueue/tests/test_jobqueue_core.py
-  '';
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pytestFlagsArray = [
+    # Do not run entire tests suite (requires slurm, sge, etc.)
+    "dask_jobqueue/tests/test_jobqueue_core.py"
+  ];
+
+  disabledTests = [
+    "test_import_scheduler_options_from_config"
+    "test_security"
+  ];
+
+  pythonImportsCheck = [ "dask_jobqueue" ];

  meta = with lib; {
    homepage = "https://github.com/dask/dask-jobqueue";
    description = "Deploy Dask on job schedulers like PBS, SLURM, and SGE";
    license = licenses.bsd3;
-    maintainers = [ maintainers.costrouc ];
-    broken = true;
+    maintainers = with maintainers; [ costrouc ];
  };
 }
--- a/pkgs/development/python-modules/dask/default.nix
+++ b/pkgs/development/python-modules/dask/default.nix
@ -22,7 +22,7 @@

 buildPythonPackage rec {
  pname = "dask";
-  version = "2021.09.0";
+  version = "2021.09.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -31,7 +31,7 @@ buildPythonPackage rec {
    owner = "dask";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Gb6eQ5Hebx3mBNGvgB5yvM4dPsIxJl9ka++yYC/Zf7Q=";
+    sha256 = "sha256-+UkbXbWV5R/QtVb5rWm/5SA+IoWsIfBciL3vg138jkc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/deemix/default.nix
+++ b/pkgs/development/python-modules/deemix/default.nix
@ -12,12 +12,12 @@

 buildPythonPackage rec {
  pname = "deemix";
-  version = "3.5.3";
+  version = "3.5.5";
  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "36dc6279f547cc0947daceb568e2b5ac1e274655f642c133e2700c22892163ce";
+    sha256 = "sha256-qattUKdGr9P2al5cibG0CPJNmVCJjgE+hucOtl7pAhE=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/deezer-py/default.nix
+++ b/pkgs/development/python-modules/deezer-py/default.nix
@ -7,12 +7,12 @@

 buildPythonPackage rec {
  pname = "deezer-py";
-  version = "1.2.4";
+  version = "1.2.5";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1b5664835975fda7a2519ba4b411cc5f2e4113e614ee140389b61844906d0c05";
+    sha256 = "sha256-JceyMBQFLD3fRPb9nJlGOSN7iACuJG8dmlFfOhhsYKc=";
  };

  propagatedBuildInputs = [ requests ];
--- a/pkgs/development/python-modules/deezer-python/default.nix
+++ b/pkgs/development/python-modules/deezer-python/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "deezer-python";
-  version = "2.3.1";
+  version = "2.4.0";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "browniebroke";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-0gkPwIz+nZJjxfucy71D0A5CFkhQaW32UH5t1DkuvEs=";
+    sha256 = "sha256-4Jjkhlv3wK4j2uU8dT11WYuBttlFtg+/ZBrc57UVeao=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/demjson3/default.nix
+++ b/pkgs/development/python-modules/demjson3/default.nix
@ -0,0 +1,31 @@
+{ lib
+, python
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "demjson3";
+  version = "3.0.5";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "103dc4pzwg8791q3zll1vv4gcc17d9v3jvr9zj23cpv9hpfsp6mb";
+  };
+
+  checkPhase = ''
+    ${python.interpreter} test/test_demjson3.py
+  '';
+
+  pythonImportsCheck = [ "demjson3" ];
+
+  meta = with lib; {
+    description = "Encoder/decoder and lint/validator for JSON (JavaScript Object Notation)";
+    homepage = "https://github.com/nielstron/demjson3/";
+    license = licenses.lgpl3Plus;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/distributed/default.nix
+++ b/pkgs/development/python-modules/distributed/default.nix
@ -19,13 +19,13 @@

 buildPythonPackage rec {
  pname = "distributed";
-  version = "2021.9.0";
+  version = "2021.9.1";
  disabled = pythonOlder "3.6";

  # get full repository need conftest.py to run tests
  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-IiKc0rJYODCtGC9AAOkjbww/VG7PdfrqJ32IHU9xWbo=";
+    sha256 = "sha256-9N65ap2+9bBK0DCrkF3+1xuJPXmjaL1Xh7ISaLTtX/g=";
  };

  propagatedBuildInputs = [
--- a/Show More
+++ b/Show More