Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -18120,6 +18120,12 @@
     githubId = 16415673;
     name = "Van Tuan Vo";
   };
+  vuimuich = {
+    email = "vuimuich@quantentunnel.de";
+    github = "VuiMuich";
+    githubId = 4779365;
+    name = "Johannes Mayrhofer";
+  };
   vyorkin = {
     email = "vasiliy.yorkin@gmail.com";
     github = "vyorkin";

nixos/doc/manual/development/unit-handling.section.md

@@ -25,8 +25,11 @@ checks:
     since changes in their values are applied by systemd when systemd is
     reloaded.
 
-  - `.mount` units are **reload**ed. These mostly come from the `/etc/fstab`
-    parser.
+  - `.mount` units are **reload**ed if only their `Options` changed. If anything
+    else changed (like `What`), they are **restart**ed unless they are the mount
+    unit for `/` or `/nix` in which case they are reloaded to prevent the system
+    from crashing. Note that this is the case for `.mount` units and not for
+    mounts from `/etc/fstab`. These are explained in [](#sec-switching-systems).
 
   - `.socket` units are currently ignored. This is to be fixed at a later
     point.

nixos/doc/manual/release-notes/rl-2311.section.md

@@ -50,6 +50,9 @@
 
 - [eris-server](https://codeberg.org/eris/eris-go). [ERIS](https://eris.codeberg.page/) is an encoding for immutable storage and this server provides block exchange as well as content decoding over HTTP and through a FUSE file-system. Available as [services.eris-server](#opt-services.eris-server.enable).
 
+- [Honk](https://humungus.tedunangst.com/r/honk), a complete ActivityPub server with minimal setup and support costs.
+  Available as [services.honk](#opt-services.honk.enable).
+
 ## Backward Incompatibilities {#sec-release-23.11-incompatibilities}
 
 - The `boot.loader.raspberryPi` options have been marked deprecated, with intent for removal for NixOS 24.11. They had a limited use-case, and do not work like people expect. They required either very old installs ([before mid-2019](https://github.com/NixOS/nixpkgs/pull/62462)) or customized builds out of scope of the standard and generic AArch64 support. That option set never supported the Raspberry Pi 4 family of devices.

nixos/modules/module-list.nix

@@ -1227,6 +1227,7 @@
   ./services/web-apps/healthchecks.nix
   ./services/web-apps/hedgedoc.nix
   ./services/web-apps/hledger-web.nix
+  ./services/web-apps/honk.nix
   ./services/web-apps/icingaweb2/icingaweb2.nix
   ./services/web-apps/icingaweb2/module-monitoring.nix
   ./services/web-apps/invidious.nix

nixos/modules/services/web-apps/honk.md

@@ -0,0 +1,23 @@
+# Honk {#module-services-honk}
+
+With Honk on NixOS you can quickly configure a complete ActivityPub server with
+minimal setup and support costs.
+
+## Basic usage {#module-services-honk-basic-usage}
+
+A minimal configuration looks like this:
+
+```nix
+{
+  services.honk = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 8080;
+    username = "username";
+    passwordFile = "/etc/honk/password.txt";
+    servername = "honk.example.com";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 8080 ];
+}
+```

nixos/modules/services/web-apps/honk.nix

@@ -0,0 +1,153 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+let
+  cfg = config.services.honk;
+
+  honk-initdb-script = cfg: pkgs.writeShellApplication {
+    name = "honk-initdb-script";
+
+    runtimeInputs = with pkgs; [ coreutils ];
+
+    text = ''
+      PW=$(cat "$CREDENTIALS_DIRECTORY/honk_passwordFile")
+
+      echo -e "${cfg.username}\n''$PW\n${cfg.host}:${toString cfg.port}\n${cfg.servername}" | ${lib.getExe cfg.package} -datadir "$STATE_DIRECTORY" init
+    '';
+  };
+in
+{
+  options = {
+    services.honk = {
+      enable = lib.mkEnableOption (lib.mdDoc "the Honk server");
+      package = lib.mkPackageOptionMD pkgs "honk" { };
+
+      host = lib.mkOption {
+        default = "127.0.0.1";
+        description = lib.mdDoc ''
+          The host name or IP address the server should listen to.
+        '';
+        type = lib.types.str;
+      };
+
+      port = lib.mkOption {
+        default = 8080;
+        description = lib.mdDoc ''
+          The port the server should listen to.
+        '';
+        type = lib.types.port;
+      };
+
+      username = lib.mkOption {
+        description = lib.mdDoc ''
+          The admin account username.
+        '';
+        type = lib.types.str;
+      };
+
+      passwordFile = lib.mkOption {
+        description = lib.mdDoc ''
+          Password for admin account.
+          NOTE: Should be string not a store path, to prevent the password from being world readable
+        '';
+        type = lib.types.path;
+      };
+
+      servername = lib.mkOption {
+        description = lib.mdDoc ''
+          The server name.
+        '';
+        type = lib.types.str;
+      };
+
+      extraJS = lib.mkOption {
+        default = null;
+        description = lib.mdDoc ''
+          An extra JavaScript file to be loaded by the client.
+        '';
+        type = lib.types.nullOr lib.types.path;
+      };
+
+      extraCSS = lib.mkOption {
+        default = null;
+        description = lib.mdDoc ''
+          An extra CSS file to be loaded by the client.
+        '';
+        type = lib.types.nullOr lib.types.path;
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.username or "" != "";
+        message = ''
+          You have to define a username for Honk (`services.honk.username`).
+        '';
+      }
+      {
+        assertion = cfg.servername or "" != "";
+        message = ''
+          You have to define a servername for Honk (`services.honk.servername`).
+        '';
+      }
+    ];
+
+    systemd.services.honk-initdb = {
+      description = "Honk server database setup";
+      requiredBy = [ "honk.service" ];
+      before = [ "honk.service" ];
+
+      serviceConfig = {
+        LoadCredential = [
+          "honk_passwordFile:${cfg.passwordFile}"
+        ];
+        Type = "oneshot";
+        StateDirectory = "honk";
+        DynamicUser = true;
+        RemainAfterExit = true;
+        ExecStart = lib.getExe (honk-initdb-script cfg);
+        PrivateTmp = true;
+      };
+
+      unitConfig = {
+        ConditionPathExists = [
+          # Skip this service if the database already exists
+          "!$STATE_DIRECTORY/honk.db"
+        ];
+      };
+    };
+
+    systemd.services.honk = {
+      description = "Honk server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      bindsTo = [ "honk-initdb.service" ];
+      preStart = ''
+        mkdir -p $STATE_DIRECTORY/views
+        ${lib.optionalString (cfg.extraJS != null) "ln -fs ${cfg.extraJS} $STATE_DIRECTORY/views/local.js"}
+        ${lib.optionalString (cfg.extraCSS != null) "ln -fs ${cfg.extraCSS} $STATE_DIRECTORY/views/local.css"}
+        ${lib.getExe cfg.package} -datadir $STATE_DIRECTORY -viewdir ${cfg.package}/share/honk backup $STATE_DIRECTORY/backup
+        ${lib.getExe cfg.package} -datadir $STATE_DIRECTORY -viewdir ${cfg.package}/share/honk upgrade
+        ${lib.getExe cfg.package} -datadir $STATE_DIRECTORY -viewdir ${cfg.package}/share/honk cleanup
+      '';
+      serviceConfig = {
+        ExecStart = ''
+          ${lib.getExe cfg.package} -datadir $STATE_DIRECTORY -viewdir ${cfg.package}/share/honk
+        '';
+        StateDirectory = "honk";
+        DynamicUser = true;
+        PrivateTmp = "yes";
+        Restart = "on-failure";
+      };
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ drupol ];
+    doc = ./honk.md;
+  };
+}

nixos/modules/system/activation/switch-to-configuration.pl

@@ -313,7 +313,8 @@ sub unrecord_unit {
 # needs to be restarted or reloaded. If the units differ, the service
 # is restarted unless the only difference is `X-Reload-Triggers` in the
 # `Unit` section. If this is the only modification, the unit is reloaded
-# instead of restarted.
+# instead of restarted. If the only difference is `Options` in the
+# `[Mount]` section, the unit is reloaded rather than restarted.
 # Returns:
 # - 0 if the units are equal
 # - 1 if the units are different and a restart action is required
@@ -390,6 +391,11 @@ sub compare_units { ## no critic(Subroutines::ProhibitExcessComplexity)
                         next;
                     }
                 }
+                # If this is a mount unit, check if it was only `Options`
+                if ($section_name eq "Mount" and $ini_key eq "Options") {
+                    $ret = 2;
+                    next;
+                }
                 return 1;
             }
         }
@@ -440,10 +446,18 @@ sub handle_modified_unit { ## no critic(Subroutines::ProhibitManyArgs, Subroutin
         # properties (resource limits and inotify watches)
         # seem to get applied on daemon-reload.
     } elsif ($unit =~ /\.mount$/msx) {
-        # Reload the changed mount unit to force a remount.
-        # FIXME: only reload when Options= changed, restart otherwise
-        $units_to_reload->{$unit} = 1;
-        record_unit($reload_list_file, $unit);
+        # Just restart the unit. We wouldn't have gotten into this subroutine
+        # if only `Options` was changed, in which case the unit would be reloaded.
+        # The only exception is / and /nix because it's very unlikely we can safely
+        # unmount them so we reload them instead. This means that we may not get
+        # all changes into the running system but it's better than crashing it.
+        if ($unit eq "-.mount" or $unit eq "nix.mount") {
+            $units_to_reload->{$unit} = 1;
+            record_unit($reload_list_file, $unit);
+        } else {
+            $units_to_restart->{$unit} = 1;
+            record_unit($restart_list_file, $unit);
+        }
     } elsif ($unit =~ /\.socket$/msx) {
         # FIXME: do something?
         # Attempt to fix this: https://github.com/NixOS/nixpkgs/pull/141192

nixos/tests/all-tests.nix

@@ -345,6 +345,7 @@ in {
   hedgedoc = handleTest ./hedgedoc.nix {};
   herbstluftwm = handleTest ./herbstluftwm.nix {};
   homepage-dashboard = handleTest ./homepage-dashboard.nix {};
+  honk = runTest ./honk.nix;
   installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
   invidious = handleTest ./invidious.nix {};
   oci-containers = handleTestOn ["aarch64-linux" "x86_64-linux"] ./oci-containers.nix {};

nixos/tests/honk.nix

@@ -0,0 +1,32 @@
+{ lib, ... }:
+
+{
+  name = "honk-server";
+
+  nodes = {
+    machine = { pkgs, ... }: {
+      services.honk = {
+        enable = true;
+        host = "0.0.0.0";
+        port = 8080;
+        username = "username";
+        passwordFile = "${pkgs.writeText "honk-password" "secure"}";
+        servername = "servername";
+      };
+    };
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("honk.service")
+    machine.wait_for_open_port(8080)
+
+    machine.stop_job("honk")
+    machine.wait_for_closed_port(8080)
+
+    machine.start_job("honk")
+    machine.wait_for_open_port(8080)
+  '';
+
+  meta.maintainers = [ lib.maintainers.drupol ];
+}

nixos/tests/switch-test.nix

@@ -450,7 +450,7 @@ in {
           ];
         };
 
-        mountModified.configuration = {
+        mountOptionsModified.configuration = {
           systemd.mounts = [
             {
               description = "Testmount";
@@ -463,6 +463,19 @@ in {
           ];
         };
 
+        mountModified.configuration = {
+          systemd.mounts = [
+            {
+              description = "Testmount";
+              what = "ramfs";
+              type = "ramfs";
+              where = "/testmount";
+              options = "size=10M";
+              wantedBy = [ "local-fs.target" ];
+            }
+          ];
+        };
+
         timer.configuration = {
           systemd.timers.test-timer = {
             wantedBy = [ "timers.target" ];
@@ -1137,7 +1150,8 @@ in {
         switch_to_specialisation("${machine}", "mount")
         out = machine.succeed("mount | grep 'on /testmount'")
         assert_contains(out, "size=1024k")
-        out = switch_to_specialisation("${machine}", "mountModified")
+        # Changing options reloads the unit
+        out = switch_to_specialisation("${machine}", "mountOptionsModified")
         assert_lacks(out, "stopping the following units:")
         assert_lacks(out, "NOT restarting the following changed units:")
         assert_contains(out, "reloading the following units: testmount.mount\n")
@@ -1147,6 +1161,17 @@ in {
         # It changed
         out = machine.succeed("mount | grep 'on /testmount'")
         assert_contains(out, "size=10240k")
+        # Changing anything but `Options=` restarts the unit
+        out = switch_to_specialisation("${machine}", "mountModified")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_lacks(out, "reloading the following units:")
+        assert_contains(out, "\nrestarting the following units: testmount.mount\n")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
+        # It changed
+        out = machine.succeed("mount | grep 'on /testmount'")
+        assert_contains(out, "ramfs")
 
     with subtest("timers"):
         switch_to_specialisation("${machine}", "timer")

pkgs/applications/graphics/pdfcpu/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pdfcpu";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "pdfcpu";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-4crBl0aQFsSB1D3iuAVcwcet8KSUB3/tUi1kD1VmpAI=";
+    sha256 = "sha256-dEAlOKjNXL7zqlll6lqGmbopjdplDR3ewMMNu9TMsmw=";
   };
 
-  vendorHash = "sha256-qFupm0ymDw9neAu6Xl3fQ/mMWn9f40Vdf7uOLOBkcaE=";
+  vendorHash = "sha256-WZsm2wiKedMP0miwnzhnSrF7Qw+jqd8dnpcehlsdMCA=";
 
   # No tests
   doCheck = false;

pkgs/applications/networking/cluster/talosctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "talosctl";
-  version = "1.4.7";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     rev = "v${version}";
-    hash = "sha256-K5YuT8OTxkkv5k6bW6kFDB3NMmXM1yFGBxId0snShe4=";
+    hash = "sha256-cCH20c0QO3Y1XUcI2RLD611L3GVgxwLRvBeT/+NIlHo=";
   };
 
-  vendorHash = "sha256-RJhsGjpSHbRXhOr2OkjY7x/Tgw+o7eJ9Ebd+NpW5KFs=";
+  vendorHash = "sha256-h7llw2CPrQmcLwMZX1B9XjgF0E3ygc3tCSEsjpRuAYk=";
 
   ldflags = [ "-s" "-w" ];
 

pkgs/desktops/pantheon/apps/switchboard-plugs/applications/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "switchboard-plug-applications";
-  version = "7.0.0";
+  version = "7.0.1";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "sha256-M9JMrxhMiDC/qrrnPaBm6Kf3CAkxrhGWwJF8jVm2G5c=";
+    sha256 = "sha256-r2JKiTewsLQSZPriC0w72CFevRQXytrFcO2VfA9BKHA=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/pantheon/desktop/wingpanel-indicators/power/default.nix

@@ -6,7 +6,6 @@
 , gnome-power-manager
 , pkg-config
 , meson
-, python3
 , ninja
 , vala
 , gtk3
@@ -21,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wingpanel-indicator-power";
-  version = "6.2.0";
+  version = "6.2.1";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = pname;
     rev = version;
-    sha256 = "sha256-TxrskbwitsilTidWifSWg9IP6BzH1y/OOrFohlENJmM=";
+    sha256 = "sha256-EEY32O7GeXBHSjZQ3XGogT1sUzIKGX+CzcGx8buGLq4=";
   };
 
   patches = [
@@ -41,7 +40,6 @@ stdenv.mkDerivation rec {
     meson
     ninja
     pkg-config
-    python3
     vala
   ];
 
@@ -56,11 +54,6 @@ stdenv.mkDerivation rec {
     wingpanel
   ];
 
-  postPatch = ''
-    chmod +x meson/post_install.py
-    patchShebangs meson/post_install.py
-  '';
-
   passthru = {
     updateScript = nix-update-script { };
   };

pkgs/development/python-modules/aiounifi/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "aiounifi";
-  version = "52";
+  version = "55";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "Kane610";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-mghAUZrRBKHM+mIeUGnbJqWD+NhZyikdGsIhf1uohiM=";
+    hash = "sha256-JvuP1Rhq01Y9KbfAJpawUQNWfxvlf9LY82RvXok4tgw=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/azure-identity/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "azure-identity";
-  version = "1.13.0";
+  version = "1.14.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    hash = "sha256-yTHCcwH/qGsHtNz1dOKdpz4966mrXR/k9EW7ajEX4mA=";
+    hash = "sha256-ckQXmfjFyJv+IQJpZeJmZyp8XQUMLGURnviZ3VNi4rE=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/oldest-supported-numpy/default.nix

@@ -25,10 +25,11 @@ buildPythonPackage rec {
       --replace 'numpy==' 'numpy>='
   '';
 
-  nativeBuildInputs = [
+  propagatedBuildInputs = [
     numpy
   ];
 
+  # package has no tests
   doCheck = false;
 
   meta = with lib; {

pkgs/development/python-modules/osc/default.nix

@@ -4,13 +4,13 @@
 
 buildPythonPackage rec {
   pname = "osc";
-  version = "1.0.0b1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "osc";
     rev = version;
-    sha256 = "cMltsR4Nxe0plHU5cP2Lj/qqlIqRbCXi6FXP8qx7908=";
+    sha256 = "sha256-gHcPqo3AuSrVprYUGLenC0kw9hKNmjabZ1m6YVMsNPs=";
   };
 
   buildInputs = [ bashInteractive ]; # needed for bash-completion helper
@@ -18,8 +18,8 @@ buildPythonPackage rec {
   propagatedBuildInputs = [ urllib3 cryptography ];
 
   postInstall = ''
-    install -D -m444 osc.fish $out/etc/fish/completions/osc.fish
-    install -D -m555 dist/osc.complete $out/share/bash-completion/helpers/osc-helper
+    install -D -m444 contrib/osc.fish $out/etc/fish/completions/osc.fish
+    install -D -m555 contrib/osc.complete $out/share/bash-completion/helpers/osc-helper
     mkdir -p $out/share/bash-completion/completions
     cat >>$out/share/bash-completion/completions/osc <<EOF
     test -z "\$BASH_VERSION" && return

pkgs/development/python-modules/python-engineio/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "python-engineio";
-  version = "4.5.1";
+  version = "4.6.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "miguelgrinberg";
     repo = "python-engineio";
     rev = "refs/tags/v${version}";
-    hash = "sha256-XTr5potc3t9TxHEqMydRsAzslmLnrzsGqDaM8qdKfp8=";
+    hash = "sha256-za2JY5Gu9MEqi3W1zxcuwYiJ5XLc43ig6Hdx/4JwDbY=";
   };
 
   nativeCheckInputs = [

pkgs/development/python-modules/pywbem/default.nix

@@ -67,6 +67,6 @@ buildPythonPackage rec {
     homepage = "https://pywbem.github.io";
     changelog = "https://github.com/pywbem/pywbem/blob/${version}/docs/changes.rst";
     license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ peterhoeg ];
+    maintainers = with maintainers; [ ];
   };
 }

pkgs/development/python-modules/textual/default.nix

@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "textual";
-  version = "0.33.0";
+  version = "0.35.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "Textualize";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-IhqUUsS1kCG/AwnbcLAhmQYLBSqf1ff0pD2xH4Tgdho=";
+    hash = "sha256-WOYS1bovS6OGmFnJaxvEpqM3jRSzQg1M0vQGv1yfcnw=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/unstructured-api-tools/default.nix

@@ -28,7 +28,7 @@
 , pytest-mock
 }:
 let
-  version = "0.10.10";
+  version = "0.10.11";
 in
 buildPythonPackage {
   pname = "unstructured-api-tools";
@@ -40,8 +40,8 @@ buildPythonPackage {
   src = fetchFromGitHub {
     owner = "Unstructured-IO";
     repo = "unstructured-api-tools";
-    rev = version;
-    hash = "sha256-CJ5bsII24hw03JN4+8VywYRYCsnMlYHjmaIIn0zttIs=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-t1fK40ayR2bxc1iMIwvn/OHuyVlR98Gq+NpIhOmaP+4=";
   };
 
   propagatedBuildInputs = [

pkgs/development/tools/build-managers/apache-maven/build-package.nix

@@ -26,16 +26,24 @@ let
     ];
 
     buildPhase = ''
+      runHook preBuild
+
       mvn package -Dmaven.repo.local=$out/.m2 ${mvnParameters}
+
+      runHook postBuild
     '';
 
     # keep only *.{pom,jar,sha1,nbm} and delete all ephemeral files with lastModified timestamps inside
     installPhase = ''
+      runHook preInstall
+
       find $out -type f \( \
         -name \*.lastUpdated \
         -o -name resolver-status.properties \
         -o -name _remote.repositories \) \
         -delete
+
+      runHook postInstall
     '';
 
     # don't do any fixup

pkgs/development/tools/global-platform-pro/default.nix

@@ -1,29 +1,50 @@
-{ lib, fetchFromGitHub, jdk8, maven, makeWrapper, jre8_headless, pcsclite }:
+{ lib, stdenv, fetchFromGitHub, jdk8, maven, makeWrapper, jre8_headless, pcsclite, proot, zlib }:
 
 let
   mavenJdk8 = maven.override {
     jdk = jdk8;
   };
+
+  defineMvnWrapper = ''
+    mvn()
+    {
+        # One of the deps that are downloaded and run needs zlib.
+        export LD_LIBRARY_PATH="${lib.makeLibraryPath [zlib]}"
+        # Give access to ELF interpreter under FHS path, to be able to run
+        # prebuilt binaries.
+        "${lib.getExe proot}" -b "${stdenv.cc.libc}/lib:/lib64" mvn "$@"
+    }
+  '';
 in
 mavenJdk8.buildMavenPackage rec {
   pname = "global-platform-pro";
-  version = "18.09.14";
-  GPPRO_VERSION = "18.09.14-0-gb439b52"; # git describe --tags --always --long --dirty
+  version = "20.01.23";
+  GPPRO_VERSION = "v20.01.23-0-g5ad373b"; # git describe --tags --always --long --dirty
 
   src = fetchFromGitHub {
     owner = "martinpaljak";
     repo = "GlobalPlatformPro";
-    rev = version;
-    sha256 = "1vws6cbgm3mrwc2xz9j1y262vw21x3hjc9m7rqc4hn3m7gjpwsvg";
+    rev = "v${version}";
+    sha256 = "sha256-z38I61JR4oiAkImkbwcvXoK5QsdoR986dDrOzhHsCeY=";
   };
 
-  mvnHash = "sha256-xFcEZpJ0+ApJTDTuA63LgvUwLrxATVKoj5Mh3WZyfq8=";
+  mvnHash = "sha256-+297ttqBT4Q4NyNIvTYTtiDrB1dfmuu9iWmAxxBZiW8=";
 
   nativeBuildInputs = [ jdk8 makeWrapper ];
 
+  # Fix build error due to missing .git directory:
+  #  Failed to execute goal pl.project13.maven:git-commit-id-plugin:4.0.0:revision (retrieve-git-info) on project gppro: .git directory is not found! Please specify a valid [dotGitDirectory] in your pom.xml -> [Help 1]
+  mvnParameters = "-Dmaven.gitcommitid.skip=true";
+
+  mvnFetchExtraArgs = {
+    preConfigure = defineMvnWrapper;
+  };
+
+  preConfigure = defineMvnWrapper;
+
   installPhase = ''
     mkdir -p "$out/lib/java" "$out/share/java"
-    cp target/gp.jar "$out/share/java"
+    cp tool/target/gp.jar "$out/share/java"
     makeWrapper "${jre8_headless}/bin/java" "$out/bin/gp" \
       --add-flags "-jar '$out/share/java/gp.jar'" \
       --prefix LD_LIBRARY_PATH : "${pcsclite.out}/lib"

pkgs/development/tools/misc/premake/5.nix

@@ -14,12 +14,17 @@ stdenv.mkDerivation rec {
   buildInputs = [ libuuid ] ++ lib.optionals stdenv.isDarwin [ Foundation readline ];
 
   patches = [ ./no-curl-ca.patch ];
-  patchPhase = ''
+  postPatch = ''
     substituteInPlace contrib/curl/premake5.lua \
       --replace "ca = nil" "ca = '${cacert}/etc/ssl/certs/ca-bundle.crt'"
   '' + lib.optionalString stdenv.isDarwin ''
     substituteInPlace premake5.lua \
       --replace -mmacosx-version-min=10.4 -mmacosx-version-min=10.5
+  '' + lib.optionalString stdenv.hostPlatform.isStatic ''
+    substituteInPlace \
+      binmodules/example/premake5.lua \
+      binmodules/luasocket/premake5.lua \
+      --replace SharedLib StaticLib
   '';
 
   buildPhase =

pkgs/development/tools/skopeo/default.nix

@@ -18,13 +18,13 @@
 
 buildGoModule rec {
   pname = "skopeo";
-  version = "1.13.2";
+  version = "1.13.3";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "containers";
     repo = "skopeo";
-    hash = "sha256-X6DHRE3HIHNWVJYrQyXP3fZYK5Va0nNtpFCV1QzbBoE=";
+    hash = "sha256-FTPBeq/WbrYDEmS1fR8rzDBHBsjdyMHcm+tCxXtYUPg=";
   };
 
   outputs = [ "out" "man" ];
@@ -36,7 +36,7 @@ buildGoModule rec {
   nativeBuildInputs = [ pkg-config go-md2man installShellFiles makeWrapper ];
 
   buildInputs = [ gpgme ]
-  ++ lib.optionals stdenv.isLinux [ lvm2 btrfs-progs ];
+    ++ lib.optionals stdenv.isLinux [ lvm2 btrfs-progs ];
 
   buildPhase = ''
     runHook preBuild

pkgs/development/tools/spirv-tools/default.nix

@@ -11,6 +11,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-K7cv0mMNrXYOlJsxAPwz3rVX5FnsnBNvaU33k9hYnQc=";
   };
 
+  # The cmake options are sufficient for turning on static building, but not
+  # for disabling shared building, just trim the shared lib from the CMake
+  # description
+  patches = lib.optional stdenv.hostPlatform.isStatic ./no-shared-libs.patch;
+
   nativeBuildInputs = [ cmake python3 ];
 
   cmakeFlags = [
@@ -39,7 +44,7 @@ stdenv.mkDerivation rec {
     description = "The SPIR-V Tools project provides an API and commands for processing SPIR-V modules";
     homepage = "https://github.com/KhronosGroup/SPIRV-Tools";
     license = licenses.asl20;
-    platforms = platforms.unix;
+    platforms = with platforms; unix ++ windows;
     maintainers = [ maintainers.ralith ];
   };
 }

pkgs/development/tools/spirv-tools/no-shared-libs.patch

@@ -0,0 +1,30 @@
+diff --git a/source/CMakeLists.txt b/source/CMakeLists.txt
+index acfa0c12..bf3eb686 100644
+--- a/source/CMakeLists.txt
++++ b/source/CMakeLists.txt
+@@ -378,16 +378,6 @@ function(spirv_tools_default_target_options target)
+   add_dependencies(${target} spirv-tools-build-version core_tables enum_string_mapping extinst_tables)
+ endfunction()
+ 
+-# Always build ${SPIRV_TOOLS}-shared. This is expected distro packages, and
+-# unlike the other SPIRV_TOOLS target, defaults to hidden symbol visibility.
+-add_library(${SPIRV_TOOLS}-shared SHARED ${SPIRV_SOURCES})
+-spirv_tools_default_target_options(${SPIRV_TOOLS}-shared)
+-set_target_properties(${SPIRV_TOOLS}-shared PROPERTIES CXX_VISIBILITY_PRESET hidden)
+-target_compile_definitions(${SPIRV_TOOLS}-shared
+-  PRIVATE SPIRV_TOOLS_IMPLEMENTATION
+-  PUBLIC SPIRV_TOOLS_SHAREDLIB
+-)
+-
+ if(SPIRV_TOOLS_BUILD_STATIC)
+   add_library(${SPIRV_TOOLS}-static STATIC ${SPIRV_SOURCES})
+   spirv_tools_default_target_options(${SPIRV_TOOLS}-static)
+@@ -402,7 +392,7 @@ if(SPIRV_TOOLS_BUILD_STATIC)
+     add_library(${SPIRV_TOOLS} ALIAS ${SPIRV_TOOLS}-static)
+   endif()
+ 
+-  set(SPIRV_TOOLS_TARGETS ${SPIRV_TOOLS}-static ${SPIRV_TOOLS}-shared)
++  set(SPIRV_TOOLS_TARGETS ${SPIRV_TOOLS}-static)
+ else()
+   add_library(${SPIRV_TOOLS} ${SPIRV_TOOLS_LIBRARY_TYPE} ${SPIRV_SOURCES})
+   spirv_tools_default_target_options(${SPIRV_TOOLS})

pkgs/games/openarena/Makefile.local

@@ -0,0 +1,12 @@
+BUILD_CLIENT=1
+BUILD_RENDERER_OPENGL2=1
+BUILD_SERVER=1
+USE_CURL_DLOPEN=0
+USE_FREETYPE=1
+USE_INTERNAL_SPEEX=0
+USE_INTERNAL_JPEG=0
+USE_INTERNAL_OGG=0
+USE_INTERNAL_OPUS=0
+USE_INTERNAL_ZLIB=0
+USE_OPENAL_DLOPEN=0
+USE_RENDERER_DLOPEN=0

pkgs/games/openarena/default.nix

@@ -10,6 +10,7 @@
 , which
 , freetype
 , libglvnd
+, libjpeg
 , libogg
 , libvorbis
 , libxmp
@@ -25,25 +26,18 @@ let
     url = "https://download.tuxfamily.org/openarena/rel/088/openarena-0.8.8.zip";
     hash = "sha256-Rup1n14k9sKcyVFYzFqPYV+BEBCnUNwpnFsnyGrhl20=";
   };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "openarena";
+  version = "unstable-2023-03-02";
 
-  openarena-source = fetchFromGitHub {
+  src = fetchFromGitHub {
     name = "openarena-source";
     owner = "OpenArena";
     repo = "engine";
     rev = "075cb860a4d2bc43e75e5f506eba7da877708aba";
     hash = "sha256-ofQKQyS3ti5TSN+zqwPFYuJiB9kvdER6zTWn8yrOpQU=";
   };
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "openarena";
-  version = "unstable-2023-03-02";
-
-  srcs = [
-    openarena-source
-    openarena-maps
-  ];
-
-  sourceRoot = "openarena-source";
 
   patches = [
     # Fix Makefile `copyFiles` target
@@ -65,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     freetype
     libglvnd
+    libjpeg
     libogg
     libvorbis
     libxmp
@@ -75,13 +70,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  makeFlags = [
-    "USE_INTERNAL_LIBS=0"
-    "USE_FREETYPE=1"
-    "USE_OPENAL_DLOPEN=0"
-    "USE_CURL_DLOPEN=0"
-    "ARCH=${stdenv.hostPlatform.linuxArch}"
-  ];
+  preConfigure = ''
+    cp ${./Makefile.local} ./Makefile.local
+  '';
 
   installTargets = [ "copyfiles" ];
   installFlags = [ "COPYDIR=$(out)/share/openarena" ];

pkgs/servers/honk/default.nix

@@ -3,6 +3,7 @@
 , fetchurl
 , sqlite
 , installShellFiles
+, nixosTests
 }:
 
 buildGoModule rec {
@@ -49,6 +50,10 @@ buildGoModule rec {
     mv views $out/share/${pname}
   '';
 
+  passthru.tests = {
+    inherit (nixosTests) honk;
+  };
+
   meta = {
     changelog = "https://humungus.tedunangst.com/r/honk/v/v${version}/f/docs/changelog.txt";
     description = "An ActivityPub server with minimal setup and support costs.";

pkgs/servers/mail/listmonk/default.nix

@@ -12,8 +12,9 @@ buildGoModule rec {
   };
 
   patches = [
+    # Ensure that listmonk supports Go 1.20
     (fetchpatch {
-      url = "https://github.com/knadh/listmonk/pull/1479.patch";
+      url = "https://github.com/knadh/listmonk/commit/25513b81044803b104ada63c0be57a913960484e.patch";
       hash = "sha256-SYACM8r+NgeSWn9VJV4+wkm+6s/MhNGwn5zyc2tw7FU=";
     })
   ];

pkgs/servers/monitoring/grafana-agent/default.nix

@@ -1,11 +1,15 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
+, fetchYarnDeps
+, fixup_yarn_lock
 , grafana-agent
 , nixosTests
+, nodejs
 , stdenv
 , systemd
 , testers
+, yarn
 }:
 
 buildGoModule rec {
@@ -22,6 +26,11 @@ buildGoModule rec {
   vendorHash = "sha256-vzrp20Mg6AA0h3+5+qbKRa7nhx/hgiIHG6RNXLATpHE=";
   proxyVendor = true; # darwin/linux hash mismatch
 
+  frontendYarnOfflineCache = fetchYarnDeps {
+    yarnLock = src + "/web/ui/yarn.lock";
+    hash = "sha256-xJEPubIDjlZQL70UGha1MHbeek6KFPaxZGb5IRgMlTA=";
+  };
+
   ldflags = let
     prefix = "github.com/grafana/agent/pkg/build";
   in [
@@ -34,7 +43,10 @@ buildGoModule rec {
     "-X ${prefix}.BuildDate=1980-01-01T00:00:00Z"
   ];
 
+  nativeBuildInputs = [ fixup_yarn_lock nodejs yarn ];
+
   tags = [
+    "builtinassets"
     "nonetwork"
     "nodocker"
     "promtail_journal_enabled"
@@ -43,8 +55,21 @@ buildGoModule rec {
   subPackages = [
     "cmd/grafana-agent"
     "cmd/grafana-agentctl"
+    "web/ui"
   ];
 
+  preBuild = ''
+    export HOME="$TMPDIR"
+
+    pushd web/ui
+    fixup_yarn_lock yarn.lock
+    yarn config --offline set yarn-offline-mirror $frontendYarnOfflineCache
+    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+    patchShebangs node_modules
+    yarn --offline run build
+    popd
+  '';
+
   # uses go-systemd, which uses libsystemd headers
   # https://github.com/coreos/go-systemd/issues/351
   env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isLinux [ "-I${lib.getDev systemd}/include" ]);

pkgs/shells/fish/plugins/fzf-fish.nix

@@ -5,13 +5,13 @@ let
 in
 buildFishPlugin rec {
   pname = "fzf.fish";
-  version = "9.9";
+  version = "10.0";
 
   src = fetchFromGitHub {
     owner = "PatrickF1";
     repo = "fzf.fish";
     rev = "v${version}";
-    sha256 = "sha256-Aqr6+DcOS3U1R8o9Mlbxszo5/Dy9viU4KbmRGXo95R8=";
+    hash = "sha256-CqRSkwNqI/vdxPKrShBykh+eHQq9QIiItD6jWdZ/DSM=";
   };
 
   nativeCheckInputs = [ fzf fd unixtools.script procps ];
@@ -38,6 +38,7 @@ buildFishPlugin rec {
   meta = with lib; {
     description = "Augment your fish command line with fzf key bindings";
     homepage = "https://github.com/PatrickF1/fzf.fish";
+    changelog = "https://github.com/PatrickF1/fzf.fish/releases/tag/${src.rev}";
     license = licenses.mit;
     maintainers = with maintainers; [ pacien natsukium ];
   };

pkgs/tools/misc/citron/default.nix

@@ -0,0 +1,35 @@
+{ lib
+, rustPlatform
+, fetchCrate
+, dbus
+, installShellFiles
+, pkg-config
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "citron";
+  version = "0.15.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-6wJ4UfiwpV9zFuBR8SYj6eBiRqQitFs7wRe5R51Z3SA=";
+  };
+
+  cargoHash = "sha256-xTmhgE4iHydhZBMrHWqQUcS9KDlZAzW2CmPGpJr40Fw=";
+
+  buildInputs = [ dbus ];
+
+  nativeBuildInputs = [ installShellFiles pkg-config ];
+
+  postInstall = ''
+    installManPage doc/citron.1
+  '';
+
+  meta = {
+    homepage = "https://git.sr.ht/~grtcdr/citron";
+    description = "System data via on-demand notifications";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ vuimuich ];
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/tools/misc/clac/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "clac";
-  version = "0.3.3";
+  version = "0.3.3-unstable-2021-09-06";
 
   src = fetchFromGitHub {
     owner = "soveran";
     repo = "clac";
-    rev = version;
-    sha256 = "rsag8MWl/udwXC0Gj864fAuQ6ts1gzrN2N/zelazqjE=";
+    rev = "beae8c4bc89912f4cd66bb875585fa471692cd54";
+    sha256 = "XaULDkFF9OZW7Hbh60wbGgvCJ6L+3gZNGQ9uQv3G0zU=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];

pkgs/tools/package-management/nixpkgs-review/default.nix

@@ -16,14 +16,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "nixpkgs-review";
-  version = "2.10.0";
+  version = "2.10.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "nixpkgs-review";
     rev = version;
-    hash = "sha256-uMcTwRmELk/vFI7vU4+UUvBDhlF+gVgohIXE0Sm1/d8=";
+    hash = "sha256-zZM0Ozl6uoYfzvHhQRluS4/5NNRuumQgc4MV993LNyY=";
   };
 
   nativeBuildInputs = [

pkgs/tools/security/jwx/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "jwx";
-  version = "2.0.11";
+  version = "2.0.12";
 
   src = fetchFromGitHub {
     owner = "lestrrat-go";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-8ZzDVCJERf9T9Tlth+9imVJPZIAwffR03S/8UflKjZc=";
+    hash = "sha256-2Lx9pu5KQut9eXIQYDjFW/pMDzR0eSKMFtSGOPQAkN4=";
   };
 
-  vendorHash = "sha256-RyAQh1uXw3bEZ6vuh8+mEf8T4l3ZIFAaFJ6dGMoANys=";
+  vendorHash = "sha256-o3EHPIXGLz/io0d8jhl9cxzctP3CeOjEDMQl1SY9lXg=";
 
   sourceRoot = "${src.name}/cmd/jwx";
 

pkgs/tools/security/web-eid-app/default.nix

@@ -10,13 +10,13 @@
 
 mkDerivation rec {
   pname = "web-eid-app";
-  version = "2.3.1";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "web-eid";
     repo = "web-eid-app";
     rev = "v${version}";
-    sha256 = "sha256-X6/vfCDEGXFn05DUSyy7koGVxUAPJ0lv8dnTaoansKk=";
+    sha256 = "sha256-xWwguxs/121BFF1zhb/HxS9b1vTwQRemhPKOfHEXVZQ=";
     fetchSubmodules = true;
   };
 

pkgs/tools/virtualization/google-guest-oslogin/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "google-guest-oslogin";
-  version = "20230808.00";
+  version = "20230821.01";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "guest-oslogin";
     rev = version;
-    sha256 = "sha256-6CHMnoPrfXFAgTyIoGPsMos9CaW6W0zcbpIG1j7DRqk=";
+    sha256 = "sha256-1/iXn4jN44eZCLRYCDSsEz7WDnTsAwxxB62jvIRjvoU=";
   };
 
   postPatch = ''

pkgs/top-level/all-packages.nix

@@ -378,6 +378,8 @@ with pkgs;
 
   circumflex = callPackage ../applications/networking/circumflex { };
 
+  citron = callPackage ../tools/misc/citron { };
+
   cxx-rs = callPackage ../development/libraries/cxx-rs { };
 
   elfcat = callPackage ../tools/misc/elfcat { };