Merge master into staging-next

maintainers/maintainer-list.nix

@@ -3533,6 +3533,16 @@
     githubId = 28303440;
     name = "Max Hausch";
   };
+  cherrykitten = {
+    email = "contact@cherrykitten.dev";
+    github = "cherrykitten";
+    githubId = 20300586;
+    matrix = "@sammy:cherrykitten.dev";
+    name = "CherryKitten";
+    keys = [{
+      fingerprint = "264C FA1A 194C 585D F822  F673 C01A 7CBB A617 BD5F";
+    }];
+  };
   chessai = {
     email = "chessai1996@gmail.com";
     github = "chessai";
@@ -3854,6 +3864,14 @@
     githubId = 180339;
     name = "Andrew Cobb";
   };
+  coca = {
+    github = "Coca162";
+    githubId = 62479942;
+    name = "Coca";
+    keys = [{
+      fingerprint = "99CB 86FF 62BB 7DA4 8903  B16D 0328 2DF8 8179 AB19";
+    }];
+  };
   coconnor = {
     email = "coreyoconnor@gmail.com";
     github = "coreyoconnor";

nixos/modules/programs/kdeconnect.nix

@@ -21,7 +21,6 @@
       lib.mkIf cfg.enable {
         environment.systemPackages = [
           cfg.package
-          pkgs.sshfs
         ];
         networking.firewall = rec {
           allowedTCPPortRanges = [ { from = 1714; to = 1764; } ];

pkgs/applications/networking/browsers/chromium/patches/widevine-disable-auto-download-allow-bundle.patch

@@ -12,15 +12,16 @@ index 525693b6c10ab..245491e137d39 100644
      "ENABLE_MEDIA_FOUNDATION_WIDEVINE_CDM=$enable_media_foundation_widevine_cdm",
    ]
 diff --git a/third_party/widevine/cdm/widevine.gni b/third_party/widevine/cdm/widevine.gni
-index 58f073ca562ca..4b242c2618dfb 100644
+index 8b97b7a57419e..69fe548ec2845 100644
 --- a/third_party/widevine/cdm/widevine.gni
 +++ b/third_party/widevine/cdm/widevine.gni
-@@ -41,8 +41,7 @@ enable_library_widevine_cdm =
+@@ -42,9 +42,7 @@ enable_library_widevine_cdm =
- # Widevine CDM can be deployed as a component. Currently only supported on
+ # desktop platforms. Not enabled for lacros (as it is changing to use the
- # desktop platforms. The CDM can be bundled regardless whether
+ # ash updated version). The CDM can be bundled regardless whether it's a
- # it's a component. See below.
+ # component. See below.
 -enable_widevine_cdm_component =
--    enable_library_widevine_cdm && (is_win || is_mac || is_linux || is_chromeos)
+-    enable_library_widevine_cdm &&
+-    (is_win || is_mac || is_linux || is_chromeos_ash)
 +enable_widevine_cdm_component = false
  
  # Enable (Windows) Media Foundation Widevine CDM component.

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,37 +1,37 @@
 {
   stable = {
     chromedriver = {
-      hash_darwin = "sha256-00582jnlAkVkqFsylZnTWfHh5TJkz+m9W8QCXYKerfo=";
+      hash_darwin = "sha256-ahwPSPoB2h6Zq4ePbvSmYs3WNc+MpBXQYyYLf0ZS3ss=";
       hash_darwin_aarch64 =
-        "sha256-EV45I6lav93uMzgZkjypq1RazqtP1W8w8/c4dVZ5hjI=";
+        "sha256-NVqr/i4S4XP+z0+YT6CuDnmyN4GtS6ttyJDOQ05KB+0=";
-      hash_linux = "sha256-xCizRpHgcent3D/tMBK+CtXiwtTdH61fja1u8QyECCA=";
+      hash_linux = "sha256-PKuhfBw5FblCUQ60yeQC0McvYu7gPfwwIW1ysN/MwVA=";
-      version = "124.0.6367.207";
+      version = "125.0.6422.60";
     };
     deps = {
       gn = {
-        hash = "sha256-aEL1kIhgPAFqdb174dG093HoLhCJ07O1Kpqfu7r14wQ=";
+        hash = "sha256-lrVAb6La+cvuUCNI90O6M/sheOEVFTjgpfA3O/6Odp0=";
-        rev = "22581fb46c0c0c9530caa67149ee4dd8811063cf";
+        rev = "d823fd85da3fb83146f734377da454473b93a2b2";
         url = "https://gn.googlesource.com/gn";
-        version = "2024-03-14";
+        version = "2024-04-10";
       };
     };
-    hash = "sha256-IeIWk4y1dufEnhxqvZbQlFVD8dsoceysiEHqJ2G4Oz8=";
+    hash = "sha256-ewX7oRna7IYCXhAe98HS5HbS1psIEAguhZJ1ymK+dPE=";
-    version = "124.0.6367.207";
+    version = "125.0.6422.60";
   };
   ungoogled-chromium = {
     deps = {
       gn = {
-        hash = "sha256-aEL1kIhgPAFqdb174dG093HoLhCJ07O1Kpqfu7r14wQ=";
+        hash = "sha256-lrVAb6La+cvuUCNI90O6M/sheOEVFTjgpfA3O/6Odp0=";
-        rev = "22581fb46c0c0c9530caa67149ee4dd8811063cf";
+        rev = "d823fd85da3fb83146f734377da454473b93a2b2";
         url = "https://gn.googlesource.com/gn";
-        version = "2024-03-14";
+        version = "2024-04-10";
       };
       ungoogled-patches = {
-        hash = "sha256-7Z9j+meVRZYLmreCzHlJe71E9kj5YJ4rrfpQ/deNTpM=";
+        hash = "sha256-I3RQBa4LLuOdZQFKHIqePj9Ozw61dsuAOctqN1abij0=";
-        rev = "124.0.6367.207-1";
+        rev = "125.0.6422.60-1";
       };
     };
-    hash = "sha256-IeIWk4y1dufEnhxqvZbQlFVD8dsoceysiEHqJ2G4Oz8=";
+    hash = "sha256-ewX7oRna7IYCXhAe98HS5HbS1psIEAguhZJ1ymK+dPE=";
-    version = "124.0.6367.207";
+    version = "125.0.6422.60";
   };
 }

pkgs/applications/video/jellyfin-media-player/default.nix

@@ -1,6 +1,5 @@
 { lib
 , fetchFromGitHub
-, fetchzip
 , mkDerivation
 , stdenv
 , Cocoa
@@ -23,18 +22,18 @@
 , qtwebengine
 , qtx11extras
 , jellyfin-web
-, withDbus ? stdenv.isLinux, dbus
+, withDbus ? stdenv.isLinux
 }:
 
 mkDerivation rec {
   pname = "jellyfin-media-player";
-  version = "1.9.1";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-media-player";
     rev = "v${version}";
-    sha256 = "sha256-97/9UYXOsg8v7QoRqo5rh0UGhjjS85K9OvUwtlG249c=";
+    sha256 = "sha256-XeDyNSQpnTgV6u1vT69DEfbFHvBu1LNhvsQmKvUYq2o=";
   };
 
   patches = [

pkgs/applications/video/jellyfin-media-player/disable-update-notifications.patch

@@ -1,11 +1,11 @@
 diff --git a/resources/settings/settings_description.json b/resources/settings/settings_description.json
-index 20fff81..9979de5 100644
+index 3329d0d..ccd5718 100644
 --- a/resources/settings/settings_description.json
 +++ b/resources/settings/settings_description.json
-@@ -118,7 +118,7 @@
+@@ -127,7 +127,7 @@
-       },
-       {
          "value": "checkForUpdates",
+         "display_name": "Check For Updates",
+         "help": "Allows user to disable update check plugin script.",
 -        "default": true
 +        "default": false
        },

pkgs/by-name/go/goofcord/package.nix

@@ -0,0 +1,151 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  dpkg,
+  makeBinaryWrapper,
+  wrapGAppsHook3,
+  alsa-lib,
+  at-spi2-atk,
+  at-spi2-core,
+  atk,
+  cairo,
+  cups,
+  dbus,
+  expat,
+  ffmpeg,
+  fontconfig,
+  freetype,
+  gdk-pixbuf,
+  glib,
+  gtk3,
+  libappindicator-gtk3,
+  libdrm,
+  libnotify,
+  libpulseaudio,
+  libsecret,
+  libuuid,
+  libxkbcommon,
+  mesa,
+  nss,
+  pango,
+  systemd,
+  xdg-utils,
+  xorg,
+  wayland,
+  pipewire,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "goofcord";
+  version = "1.4.2";
+
+  src =
+    let
+      base = "https://github.com/Milkshiift/GoofCord/releases/download";
+    in
+    {
+      x86_64-linux = fetchurl {
+        url = "${base}/v${finalAttrs.version}/GoofCord-${finalAttrs.version}-linux-amd64.deb";
+        hash = "sha256-fUP/se3hOhs+aAoew25YhRyxnodYPrgqN68RIg1A1Kw=";
+      };
+      aarch64-linux = fetchurl {
+        url = "${base}/v${finalAttrs.version}/GoofCord-${finalAttrs.version}-linux-arm64.deb";
+        hash = "sha256-hVpXmBSIgoON683f/sRtmpHwqxcO6IrFCCRPZjsUqjw=";
+      };
+    }
+    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    dpkg
+    makeBinaryWrapper
+    wrapGAppsHook3
+  ];
+
+  dontWrapGApps = true;
+
+  buildInputs = [
+    alsa-lib
+    at-spi2-atk
+    at-spi2-core
+    atk
+    cairo
+    cups
+    dbus
+    expat
+    ffmpeg
+    fontconfig
+    freetype
+    gdk-pixbuf
+    glib
+    gtk3
+    pango
+    systemd
+    mesa # for libgbm
+    nss
+    libuuid
+    libdrm
+    libnotify
+    libsecret
+    libpulseaudio
+    libxkbcommon
+    libappindicator-gtk3
+    xorg.libX11
+    xorg.libxcb
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXScrnSaver
+    xorg.libxshmfence
+    xorg.libXtst
+    wayland
+    pipewire
+  ];
+
+  sourceRoot = ".";
+  unpackCmd = "dpkg-deb -x $src .";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/bin"
+    cp -R "opt" "$out"
+    cp -R "usr/share" "$out/share"
+    chmod -R g-w "$out"
+
+    # Wrap the startup command
+    makeBinaryWrapper $out/opt/GoofCord/goofcord $out/bin/goofcord \
+      "''${gappsWrapperArgs[@]}" \
+      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=UseOzonePlatform,WaylandWindowDecorations,WebRTCPipeWireCapturer}}" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath finalAttrs.buildInputs}" \
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
+
+    # Fix desktop link
+    substituteInPlace $out/share/applications/goofcord.desktop \
+      --replace /opt/GoofCord/ ""
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Highly configurable and privacy-focused Discord client";
+    homepage = "https://github.com/Milkshiift/GoofCord";
+    downloadPage = "https://github.com/Milkshiift/GoofCord";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.osl3;
+    maintainers = with maintainers; [ nyanbinary ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+    mainProgram = "goofcord";
+  };
+})

pkgs/by-name/gu/gungnir/package.nix

@@ -0,0 +1,29 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "gungnir";
+  version = "1.0.8";
+
+  src = fetchFromGitHub {
+    owner = "g0ldencybersec";
+    repo = "gungnir";
+    rev = "v${version}";
+    hash = "sha256-k6fxAvUBAAcTHzdeGhekYhPpnS05jHq/7EqxafQfMio=";
+  };
+
+  vendorHash = "sha256-r2aU59L0fnSdc/lpR04K/GQ1eZ7ihV+tKlyuS6sPX2o=";
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = with lib; {
+    description = "A command-line tool that continuously monitors certificate transparency (CT) logs for newly issued SSL/TLS certificates";
+    homepage = "https://github.com/g0ldencybersec/gungnir";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cherrykitten ];
+    mainProgram = "gungnir";
+  };
+}
+

pkgs/by-name/mi/miracode/package.nix

@@ -0,0 +1,32 @@
+{ stdenvNoCC, lib, fetchurl }:
+
+let
+  version = "1.0";
+in
+stdenvNoCC.mkDerivation {
+  pname = "miracode";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://github.com/IdreesInc/Miracode/releases/download/v${version}/Miracode.ttf";
+    hash = "sha256-Q+/D/TPlqOt779qYS/dF7ahEd3Mm4a4G+wdHB+Gutmo=";
+  };
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 $src $out/share/fonts/truetype/Miracode.ttf
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A sharp, readable, vector-y version of Monocraft";
+    homepage = "https://github.com/IdreesInc/Miracode";
+    license = licenses.ofl;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ coca ];
+  };
+}

pkgs/development/tools/ko/default.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "ko";
-  version = "0.15.2";
+  version = "0.15.3";
 
   src = fetchFromGitHub {
     owner = "ko-build";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-/1s335bXbBKlzKT4AevuHltLdU2qj6pJFngOrJCLtUw=";
+    hash = "sha256-H/S2TNzUIAjHDCrfQ3pkHC3yVf1k1DYkR5eBme8Cuq4=";
   };
 
-  vendorHash = null;
+  vendorHash = "sha256-RrcJJzjmihjR/E19Pqgl//+yweRsaqWZ0yPcd1AvOc0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/development/tools/ocaml/js_of_ocaml/compiler.nix

@@ -5,12 +5,12 @@
 
 buildDunePackage rec {
   pname = "js_of_ocaml-compiler";
-  version = "5.7.1";
+  version = "5.8.1";
   minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/ocsigen/js_of_ocaml/releases/download/${version}/js_of_ocaml-${version}.tbz";
-    hash = "sha256-DqSOKqiQTsVi8iX6CT/2dLVODnUU2uhie4/Y93IQOD0=";
+    hash = "sha256-DohuELJzqMSNn0U9XEuHacofPrpe6VDgsYha3JQ/SlM=";
   };
 
   nativeBuildInputs = [ menhir ];

pkgs/tools/networking/openssh/common.nix

@@ -33,6 +33,7 @@
 , withPAM ? stdenv.hostPlatform.isLinux
 , dsaKeysSupport ? false
 , linkOpenssl ? true
+, isNixos ? stdenv.hostPlatform.isLinux
 }:
 
 stdenv.mkDerivation {
@@ -77,6 +78,12 @@ stdenv.mkDerivation {
     unset LD
   '';
 
+  env = lib.optionalAttrs isNixos {
+    # openssh calls passwd to allow the user to reset an expired password, but nixos
+    # doesn't ship it at /usr/bin/passwd.
+    PATH_PASSWD_PROG = "/run/wrappers/bin/passwd";
+  };
+
   # I set --disable-strip because later we strip anyway. And it fails to strip
   # properly when cross building.
   configureFlags = [