Merge master into staging-next

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -40,6 +40,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [goeland](https://github.com/slurdge/goeland), an alternative to rss2email written in golang with many filters. Available as [services.goeland](#opt-services.goeland.enable).
 
+- [tts](https://github.com/coqui-ai/TTS), a battle-tested deep learning toolkit for Text-to-Speech. Mutiple servers may be configured below [services.tts.servers](#opt-services.tts.servers).
+
 - [atuin](https://github.com/ellie/atuin), a sync server for shell history. Available as [services.atuin](#opt-services.atuin.enable).
 
 - [networkd-dispatcher](https://gitlab.com/craftyguy/networkd-dispatcher), a dispatcher service for systemd-networkd connection status changes. Available as [services.networkd-dispatcher](#opt-services.networkd-dispatcher.enable).

nixos/modules/module-list.nix

@@ -314,6 +314,7 @@
   ./services/audio/snapserver.nix
   ./services/audio/spotifyd.nix
   ./services/audio/squeezelite.nix
+  ./services/audio/tts.nix
   ./services/audio/ympd.nix
   ./services/backup/automysqlbackup.nix
   ./services/backup/bacula.nix

nixos/modules/programs/flashrom.nix

@@ -22,6 +22,5 @@ in
   config = mkIf cfg.enable {
     services.udev.packages = [ cfg.package ];
     environment.systemPackages = [ cfg.package ];
-    users.groups.flashrom = { };
   };
 }

nixos/modules/services/audio/tts.nix

@@ -0,0 +1,151 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+
+let
+  cfg = config.services.tts;
+in
+
+{
+  options.services.tts = let
+    inherit (lib) literalExpression mkOption mdDoc mkEnableOption types;
+  in  {
+    servers = mkOption {
+      type = types.attrsOf (types.submodule (
+        { ... }: {
+          options = {
+            enable = mkEnableOption (mdDoc "Coqui TTS server");
+
+            port = mkOption {
+              type = types.port;
+              example = 5000;
+              description = mdDoc ''
+                Port to bind the TTS server to.
+              '';
+            };
+
+            model = mkOption {
+              type = types.nullOr types.str;
+              default = "tts_models/en/ljspeech/tacotron2-DDC";
+              example = null;
+              description = mdDoc ''
+                Name of the model to download and use for speech synthesis.
+
+                Check `tts-server --list_models` for possible values.
+
+                Set to `null` to use a custom model.
+              '';
+            };
+
+            useCuda = mkOption {
+              type = types.bool;
+              default = false;
+              example = true;
+              description = mdDoc ''
+                Whether to offload computation onto a CUDA compatible GPU.
+              '';
+            };
+
+            extraArgs = mkOption {
+              type = types.listOf types.str;
+              default = [];
+              description = mdDoc ''
+                Extra arguments to pass to the server commandline.
+              '';
+            };
+          };
+        }
+      ));
+      default = {};
+      example = literalExpression ''
+        {
+          english = {
+            port = 5300;
+            model = "tts_models/en/ljspeech/tacotron2-DDC";
+          };
+          german = {
+            port = 5301;
+            model = "tts_models/de/thorsten/tacotron2-DDC";
+          };
+          dutch = {
+            port = 5302;
+            model = "tts_models/nl/mai/tacotron2-DDC";
+          };
+        }
+      '';
+      description = mdDoc ''
+        TTS server instances.
+      '';
+    };
+  };
+
+  config = let
+    inherit (lib) mkIf mapAttrs' nameValuePair optionalString concatMapStringsSep escapeShellArgs;
+  in mkIf (cfg.servers != {}) {
+    systemd.services = mapAttrs' (server: options:
+      nameValuePair "tts-${server}" {
+        description = "Coqui TTS server instance ${server}";
+        after = [
+          "network-online.target"
+        ];
+        wantedBy = [
+          "multi-user.target"
+        ];
+        path = with pkgs; [
+          espeak-ng
+        ];
+        environment.HOME = "/var/lib/tts";
+        serviceConfig = {
+          DynamicUser = true;
+          User = "tts";
+          StateDirectory = "tts";
+          ExecStart = "${pkgs.tts}/bin/tts-server --port ${toString options.port}"
+            + optionalString (options.model != null) " --model_name ${options.model}"
+            + optionalString (options.useCuda) " --use_cuda"
+            + (concatMapStringsSep " " escapeShellArgs options.extraArgs);
+          CapabilityBoundingSet = "";
+          DeviceAllow = if options.useCuda then [
+            # https://docs.nvidia.com/dgx/pdf/dgx-os-5-user-guide.pdf
+            "/dev/nvidia1"
+            "/dev/nvidia2"
+            "/dev/nvidia3"
+            "/dev/nvidia4"
+            "/dev/nvidia-caps/nvidia-cap1"
+            "/dev/nvidia-caps/nvidia-cap2"
+            "/dev/nvidiactl"
+            "/dev/nvidia-modeset"
+            "/dev/nvidia-uvm"
+            "/dev/nvidia-uvm-tools"
+          ] else "";
+          DevicePolicy = "closed";
+          LockPersonality = true;
+          # jit via numba->llvmpipe
+          MemoryDenyWriteExecute = false;
+          PrivateDevices = true;
+          PrivateUsers = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectControlGroups = true;
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+          ];
+          UMask = "0077";
+        };
+      }) cfg.servers;
+  };
+}

nixos/modules/services/monitoring/mimir.nix

@@ -25,6 +25,13 @@ in {
         Specify a configuration file that Mimir should use.
       '';
     };
+
+    package = mkOption {
+      default = pkgs.mimir;
+      defaultText = lib.literalExpression "pkgs.mimir";
+      type = types.package;
+      description = lib.mdDoc ''Mimir package to use.'';
+    };
   };
 
   config = mkIf cfg.enable {
@@ -53,7 +60,7 @@ in {
                else cfg.configFile;
       in
       {
-        ExecStart = "${pkgs.mimir}/bin/mimir --config.file=${conf}";
+        ExecStart = "${cfg.package}/bin/mimir --config.file=${conf}";
         DynamicUser = true;
         Restart = "always";
         ProtectSystem = "full";

nixos/tests/keepassxc.nix

@@ -4,6 +4,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
   name = "keepassxc";
   meta = with pkgs.lib.maintainers; {
     maintainers = [ turion ];
+    timeout = 1800;
   };
 
   nodes.machine = { ... }:
@@ -55,9 +56,12 @@ import ./make-test-python.nix ({ pkgs, ...} :
         machine.sleep(5)
         # Regression #163482: keepassxc did not crash
         machine.succeed("ps -e | grep keepassxc")
-        machine.wait_for_text("foo.kdbx")
+        machine.wait_for_text("Open database")
         machine.send_key("ret")
-        machine.sleep(1)
+
+        # Wait for the enter password screen to appear.
+        machine.wait_for_text("/home/alice/foo.kdbx")
+
         # Click on "Browse" button to select keyfile
         machine.send_key("tab")
         machine.send_chars("/home/alice/foo.keyfile")

pkgs/applications/misc/keepassx/community.nix

@@ -3,7 +3,6 @@
 , fetchFromGitHub
 , cmake
 , qttools
-, darwin
 
 , asciidoctor
 , botan2
@@ -25,6 +24,8 @@
 , wrapQtAppsHook
 , zlib
 
+, LocalAuthentication
+
 , withKeePassBrowser ? true
 , withKeePassFDOSecrets ? true
 , withKeePassKeeShare ? true
@@ -110,7 +111,7 @@ stdenv.mkDerivation rec {
     readline
     zlib
   ]
-  ++ lib.optional (stdenv.isDarwin && withKeePassTouchID) darwin.apple_sdk.frameworks.LocalAuthentication
+  ++ lib.optional (stdenv.isDarwin && withKeePassTouchID) LocalAuthentication
   ++ lib.optional stdenv.isDarwin qtmacextras
   ++ lib.optional stdenv.isLinux libusb1
   ++ lib.optional withKeePassX11 qtx11extras;

pkgs/applications/networking/instant-messengers/nchat/default.nix

@@ -0,0 +1,44 @@
+{ lib, stdenv,  fetchFromGitHub, cmake, gperf
+, file, ncurses, openssl, readline, sqlite, zlib
+, AppKit, Cocoa, Foundation
+}:
+
+stdenv.mkDerivation rec {
+  pname = "nchat";
+  version = "3.17";
+
+  src = fetchFromGitHub {
+    owner = "d99kris";
+    repo = "nchat";
+    rev = "v${version}";
+    hash = "sha256-BtWKt8paI0gCGSzLYN8x3Yp5MUpwCb2vBGcGQG2aumY=";
+  };
+
+  postPatch = ''
+    substituteInPlace lib/tgchat/ext/td/CMakeLists.txt \
+      --replace "get_git_head_revision" "#get_git_head_revision"
+  '';
+
+  nativeBuildInputs = [ cmake gperf ];
+
+  buildInputs = [
+    file # for libmagic
+    ncurses
+    openssl
+    readline
+    sqlite
+    zlib
+  ] ++ lib.optional stdenv.isDarwin [ AppKit Cocoa Foundation ];
+
+  cmakeFlags = [
+    "-DHAS_WHATSAPP=OFF" # go module build required
+  ];
+
+  meta = with lib; {
+    description = "Terminal-based chat client with support for Telegram and WhatsApp";
+    homepage = "https://github.com/d99kris/nchat";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
+  };
+}

pkgs/development/libraries/amdvlk/default.nix

@@ -25,13 +25,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "amdvlk";
-  version = "2022.Q4.4";
+  version = "2023.Q1.2";
 
   src = fetchRepoProject {
     name = "${pname}-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
     rev = "refs/tags/v-${version}";
-    sha256 = "sha256-MKU7bfjrvH4M2kON2tr5463nYjN1xoGAknsC9YmklEc=";
+    sha256 = "sha256-QNjBLOnSfCTA+5qLqejAqJv9eIWAEVNc/VrhidGjmTc=";
   };
 
   buildInputs = [

pkgs/development/libraries/libubox/default.nix

@@ -1,8 +1,8 @@
-{ stdenv, lib, fetchgit, cmake, pkg-config, json_c, with_lua ? false, lua5_1 }:
+{ stdenv, lib, fetchgit, cmake, pkg-config, json_c, with_lua ? false, lua5_1, with_ustream_ssl ? false, ustream-ssl }:
 
 stdenv.mkDerivation {
   pname = "libubox";
-  version = "unstable-2023-01-03";
+  version = "unstable-2023-01-03${lib.optionalString with_ustream_ssl "-${ustream-ssl.ssl_implementation.pname}"}";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/libubox.git";
@@ -13,7 +13,14 @@ stdenv.mkDerivation {
   cmakeFlags = [ "-DBUILD_EXAMPLES=OFF" (if with_lua then "-DLUAPATH=${placeholder "out"}/lib/lua" else "-DBUILD_LUA=OFF") ];
 
   nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ json_c ] ++ lib.optional with_lua lua5_1;
+  buildInputs = [ json_c ] ++ lib.optional with_lua lua5_1 ++ lib.optional with_ustream_ssl ustream-ssl;
+
+  postInstall = lib.optionalString with_ustream_ssl ''
+    for fin in $(find ${ustream-ssl} -type f); do
+      fout="''${fin/"${ustream-ssl}"/"''${out}"}"
+      ln -s "$fin" "$fout"
+    done
+  '';
 
   meta = with lib; {
     description = "C utility functions for OpenWrt";

pkgs/development/libraries/thrift/default.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "thrift";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchurl {
     url = "https://archive.apache.org/dist/thrift/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-snLBeIuxZdmVIaJZmzG5f6aeWTHQmQFdka4QegsMxY8=";
+    hash = "sha256-fBk4nLeRCiDli45GkDyMGjY1MAj5/MGwP3SKzPm18+E=";
   };
 
   # Workaround to make the Python wrapper not drop this package:
@@ -74,6 +74,11 @@ stdenv.mkDerivation rec {
       url = "https://github.com/apache/thrift/commit/2ab850824f75d448f2ba14a468fb77d2594998df.diff";
       hash = "sha256-ejMKFG/cJgoPlAFzVDPI4vIIL7URqaG06/IWdQ2NkhY=";
     })
+    (fetchpatch {
+      name = "thrift-fix-tests-OpenSSL3.patch"; # https://github.com/apache/thrift/pull/2760
+      url = "https://github.com/apache/thrift/commit/eae3ac418f36c73833746bcd53e69ed8a12f0e1a.diff";
+      hash = "sha256-0jlN4fo94cfGFUKcLFQgVMI/x7uxn5OiLiFk6txVPzs=";
+    })
   ];
 
   cmakeFlags = [
@@ -90,6 +95,7 @@ stdenv.mkDerivation rec {
 
   disabledTests = [
     "PythonTestSSLSocket"
+    "PythonThriftTNonblockingServer"
   ] ++ lib.optionals stdenv.isDarwin [
     # Tests that hang up in the Darwin sandbox
     "SecurityTest"
@@ -106,7 +112,6 @@ stdenv.mkDerivation rec {
     "StressTest"
     "StressTestConcurrent"
     "StressTestNonBlocking"
-    "PythonThriftTNonblockingServer"
   ];
 
   doCheck = !static;

pkgs/development/libraries/uclient/default.nix

@@ -0,0 +1,30 @@
+{ stdenv, lib, fetchgit, cmake, pkg-config, libubox }:
+
+stdenv.mkDerivation {
+  pname = "uclient";
+  version = "unstable-2022-02-24";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/uclient.git";
+    rev = "644d3c7e13c6a64bf5cb628137ee5bd4dada4b74";
+    sha256 = "0vy4whs64699whp92d1zl7a8kh16yrfywqq0yp2y809l9z19sw22";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buidInputs = [ libubox ];
+
+  preConfigure = ''
+    sed -e 's|ubox_include_dir libubox/ustream-ssl.h|ubox_include_dir libubox/ustream-ssl.h HINTS ${libubox}/include|g' \
+        -e 's|ubox_library NAMES ubox|ubox_library NAMES ubox HINTS ${libubox}/lib|g' \
+        -i CMakeLists.txt
+  '';
+
+  meta = with lib; {
+    description = "Tiny OpenWrt fork of libnl";
+    homepage = "https://git.openwrt.org/?p=project/uclient.git;a=summary";
+    license = licenses.isc;
+    maintainers = with maintainers; [ mkg20001 ];
+    mainProgram = "uclient-fetch";
+    platforms = platforms.all;
+  };
+}

pkgs/development/libraries/ustream-ssl/default.nix

@@ -0,0 +1,37 @@
+{ stdenv, lib, fetchgit, cmake, pkg-config, libubox-nossl, ssl_implementation }:
+
+stdenv.mkDerivation {
+  pname = "ustream-ssl";
+  version = "unstable-2022-12-08-${ssl_implementation.pname}";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/ustream-ssl.git";
+    rev = "9217ab46536353c7c792951b57163063f5ec7a3b";
+    sha256 = "1ldyyb3is213iljyccx98f56rb69rfpgdcb1kjxw9a176hvpipdd";
+  };
+
+  preConfigure = ''
+    sed -r \
+        -e "s|ubox_include_dir libubox/ustream.h|ubox_include_dir libubox/ustream.h HINTS ${libubox-nossl}/include|g" \
+        -e "s|ubox_library NAMES ubox|ubox_library NAMES ubox HINTS ${libubox-nossl}/lib|g" \
+        -e "s|^  FIND_LIBRARY\((.+)\)|  FIND_LIBRARY\(\1 HINTS ${if ssl_implementation ? lib then ssl_implementation.lib else ssl_implementation.out}\)|g" \
+        -i CMakeLists.txt
+  '';
+
+  cmakeFlags = [ "-D${lib.toUpper ssl_implementation.pname}=ON" ];
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [ ssl_implementation ];
+
+  passthru = {
+    inherit ssl_implementation;
+  };
+
+  meta = with lib; {
+    description = "ustream SSL wrapper";
+    homepage = "https://git.openwrt.org/?p=project/ustream-ssl.git;a=summary";
+    license = licenses.isc;
+    maintainers = with maintainers; [ fpletz ];
+    platforms = platforms.all;
+  };
+}

pkgs/development/ocaml-modules/sha/default.nix

@@ -2,12 +2,12 @@
 
 buildDunePackage rec {
   pname = "sha";
-  version = "1.15.2";
+  version = "1.15.4";
   duneVersion = "3";
 
   src = fetchurl {
-    url = "https://github.com/djs55/ocaml-${pname}/releases/download/${version}/${pname}-${version}.tbz";
+    url = "https://github.com/djs55/ocaml-${pname}/releases/download/v${version}/${pname}-${version}.tbz";
-    hash = "sha256-P71Xs5p8QAaOtBrh7MuhQJOL6144BqTLvXlZOyGD/7c=";
+    hash = "sha256-beWxITmxmZzp30zHiloxiGwqVHydRIvyhT+LU7zx8bE=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/azure-mgmt-containerregistry/default.nix

@@ -1,27 +1,41 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
 , azure-common
 , azure-mgmt-core
 , msrest
-, msrestazure
+, typing-extensions
 }:
 
 buildPythonPackage rec {
-  version = "10.0.0";
   pname = "azure-mgmt-containerregistry";
-  disabled = isPy27;
+  version = "10.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-HjejK28Em5AeoQ20o4fucnXTlAwADF/SEpVfHn9anZk=";
+    hash = "sha256-VrX9YfYNvlA8+eNqHCp35BAeQZzQKakZs7ZZKwT8oYc=";
     extension = "zip";
   };
 
-  propagatedBuildInputs = [ azure-common azure-mgmt-core msrest msrestazure ];
+  propagatedBuildInputs = [
+    azure-common
+    azure-mgmt-core
+    msrest
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
+  ];
 
   # no tests included
   doCheck = false;
 
-  pythonImportsCheck = [ "azure.common" "azure.mgmt.containerregistry" ];
+  pythonImportsCheck = [
+    "azure.common"
+    "azure.mgmt.containerregistry"
+  ];
 
   meta = with lib; {
     description = "Microsoft Azure Container Registry Client Library for Python";

pkgs/development/python-modules/google-cloud-language/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-language";
-  version = "2.8.1";
+  version = "2.9.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-o4o9x7r7HpwzByUijDegzos35FILro0Esr2ugN2nyws=";
+    hash = "sha256-7rKNcG11cgvvwNEYiN9l8h8UR8u6DFfcI+S1QDi+t/c=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/insteon-frontend-home-assistant/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "insteon-frontend-home-assistant";
-  version = "0.3.1";
+  version = "0.3.2";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-gS2jDjgAcY4ve80yOPZcZR1v4c9EISYEoJkIezUQilU=";
+    hash = "sha256-7jRf6fp+5u6qqR5xP1R+kp6LURsBVqfct6yuCkbxBMw=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/lektor/default.nix

@@ -10,6 +10,7 @@
 , importlib-metadata
 , inifile
 , jinja2
+, markupsafe
 , marshmallow
 , marshmallow-dataclass
 , mistune
@@ -19,8 +20,10 @@
 , pytest-mock
 , pytest-pylint
 , pytestCheckHook
+, python
 , pythonOlder
 , python-slugify
+, pytz
 , requests
 , setuptools
 , typing-inspect
@@ -30,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "lektor";
-  version = "3.4.0b2";
+  version = "3.4.0b4";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
@@ -39,7 +42,7 @@ buildPythonPackage rec {
     owner = "lektor";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-5w3tT0celHgjmLlsM3sdBdYlXx57z3kMePVGSQkOP7M=";
+    hash = "sha256-O0bTmJqRymrQuHW19Y7/Kp+2XlbmDzcjl/jDACDlCSk=";
   };
 
   propagatedBuildInputs = [
@@ -51,12 +54,14 @@ buildPythonPackage rec {
     flask
     inifile
     jinja2
+    markupsafe
     marshmallow
     marshmallow-dataclass
     mistune
     pip
     pyopenssl
     python-slugify
+    pytz
     requests
     setuptools
     typing-inspect
@@ -72,9 +77,8 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  postPatch = ''
+  postInstall = ''
-    substituteInPlace setup.cfg \
+    cp -r lektor/translations "$out/${python.sitePackages}/lektor/"
-      --replace "typing.inspect < 0.8.0" "typing.inspect"
   '';
 
   pythonImportsCheck = [
@@ -89,6 +93,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A static content management system";
     homepage = "https://www.getlektor.com/";
+    changelog = "https://github.com/lektor/lektor/blob/v${version}/CHANGES.md";
     license = licenses.bsd0;
     maintainers = with maintainers; [ costrouc ];
   };

pkgs/development/tools/esbuild/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.17.8";
+  version = "0.17.10";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    hash = "sha256-UJIbx0UkpHYMgDr+1dbNoMLrY5hWs0E2Ehu3txG/80E=";
+    hash = "sha256-qe7YCOIwp+MSa5VkwImdOea1aMcpWdor/13PIgGEkkw=";
   };
 
   vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";

pkgs/development/tools/squawk/correct-Cargo.lock.patch

@@ -6,8 +6,8 @@ index d5803a8..384224d 100644
  
  [[package]]
  name = "squawk"
--version = "0.19.0"
+-version = "0.20.0"
-+version = "0.20.0"
++version = "0.21.0"
  dependencies = [
   "atty",
   "base64 0.12.3",

pkgs/development/tools/squawk/default.nix

@@ -23,16 +23,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "squawk";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "sbdchd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-v9F+HfscX4dIExIP1YvxOldZPPtmxh8lO3SREu6M+C0=";
+    hash = "sha256-ObaYGGTAGGLOAji86Q5R9fqbCGg6GP0A3iheNLgzezY=";
   };
 
-  cargoHash = "sha256-kSaQxqom8LSCOQBoIZ1iv+q2+Ih8l61L97xXv5c4a0k=";
+  cargoHash = "sha256-VOGgwBKcJK7x+PwvzvuVu9Zd1G8t9UoC/Me3G6bdtrk=";
 
   cargoPatches = [
     ./correct-Cargo.lock.patch
@@ -55,6 +55,8 @@ rustPlatform.buildRustPackage rec {
     Security
   ]);
 
+  OPENSSL_NO_VENDOR = 1;
+
   LIBPG_QUERY_PATH = libpg_query13;
 
   meta = with lib; {

pkgs/development/web/grails/default.nix

@@ -11,11 +11,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "grails";
-  version = "5.3.0";
+  version = "5.3.2";
 
   src = fetchurl {
     url = "https://github.com/grails/grails-core/releases/download/v${version}/grails-${version}.zip";
-    sha256 = "sha256-0Ow3G0QbKXQSpjLf371CYNxC3XoO5sv1SQD4MlHeOQ4=";
+    sha256 = "sha256-UdRtrQiHbBc8VoVUulDCZmAfZ1YTVdgNfeF91HomSqc=";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/os-specific/linux/libnl-tiny/default.nix

@@ -0,0 +1,28 @@
+{ stdenv, lib, fetchgit, cmake, pkg-config }:
+
+stdenv.mkDerivation {
+  pname = "libnl-tiny";
+  version = "unstable-2022-12-13";
+
+  src = fetchgit {
+    url = "https://git.openwrt.org/project/libnl-tiny.git";
+    rev = "f5d9b7e4f534a69cbd35c3f150fa6d57b9d631e4";
+    sha256 = "0c5ycsdas8rr5c33gd0mnmm515dq631fmdjn5mp2j1m0j1bk7hc0";
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+
+  preConfigure = ''
+    sed -e 's|''${prefix}/@CMAKE_INSTALL_LIBDIR@|@CMAKE_INSTALL_FULL_LIBDIR@|g' \
+        -e 's|''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@|@CMAKE_INSTALL_FULL_INCLUDEDIR@|g' \
+        -i libnl-tiny.pc.in
+  '';
+
+  meta = with lib; {
+    description = "Tiny OpenWrt fork of libnl";
+    homepage = "https://git.openwrt.org/?p=project/libnl-tiny.git;a=summary";
+    license = licenses.isc;
+    maintainers = with maintainers; [ mkg20001 ];
+    platforms = platforms.all;
+  };
+}

pkgs/servers/amqp/rabbitmq-server/default.nix

@@ -38,12 +38,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "rabbitmq-server";
-  version = "3.11.8";
+  version = "3.11.9";
 
   # when updating, consider bumping elixir version in all-packages.nix
   src = fetchurl {
     url = "https://github.com/rabbitmq/rabbitmq-server/releases/download/v${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-sD9E60xXNJQSg98XbMq6xn+nk3uQn1XnrxApAuSaF44=";
+    hash = "sha256-b/SfUyn+x33SnFo/n/zTLxG4PWz34F2qQs4B4p2/Ty4=";
   };
 
   nativeBuildInputs = [ unzip xmlto docbook_xml_dtd_45 docbook_xsl zip rsync python3 ];

pkgs/servers/http/go-camo/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-camo";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "cactus";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-TW32pzYcSMdtcO3MGxgANCLMLvq7S/Tq3KSimv90PU0=";
+    sha256 = "sha256-GRctsE+uAvyA0pcz+ym4sz3K80pUHoDipVsjFcdrT2A=";
   };
 
-  vendorHash = "sha256-AcSClJwDsM+tUbDE7sQ8LLkxCPTtLEGXsQePqQ6CwMA=";
+  vendorHash = "sha256-C66QxlMBupbHYktyzHapUrl0yk+pvWZN0BLhpjIGVzI=";
 
   ldflags = [ "-s" "-w" "-X=main.ServerVersion=${version}" ];
 

pkgs/tools/audio/tts/default.nix

@@ -5,16 +5,6 @@
 , espeak-ng
 }:
 
-# USAGE:
-# $ tts-server --list_models
-# # pick your favorite vocoder/tts model
-# $ tts-server --model_name tts_models/en/ljspeech/glow-tts --vocoder_name vocoder_models/universal/libri-tts/fullband-melgan
-#
-# If you upgrade from an old version you may have to delete old models from ~/.local/share/tts
-#
-# For now, for deployment check the systemd unit in the pull request:
-#   https://github.com/NixOS/nixpkgs/pull/103851#issue-521121136
-
 let
   python = python3.override {
     packageOverrides = self: super: {

pkgs/tools/games/minecraft/packwiz/default.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "packwiz";
-  version = "unstable-2022-10-29";
+  version = "unstable-2023-02-13";
 
   src = fetchFromGitHub {
     owner = "packwiz";
     repo = "packwiz";
-    rev = "f00dc9844ffdd6ee5c0526a79b0084429e9cb130";
+    rev = "4b336e46e277d4b252c11f43080576dc23b001d2";
-    sha256 = "sha256-YpihFWdcKfHJLEs+jHzHH7G+m/E8i5y2yp7IubObNhY=";
+    sha256 = "sha256-f6560XrnriKNq89aOxfJjN4mDdtYzMSOUlRWwItLuHk=";
   };
 
-  vendorSha256 = "sha256-09S8RFdCvtE50EICLIKCTnTjG/0XsGf+yq9SNObKmRA=";
+  vendorSha256 = "sha256-yL5pWbVqf6mEpgYsItLnv8nwSmoMP+SE0rX/s7u2vCg=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/tools/misc/flashrom/default.nix

@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace util/flashrom_udev.rules \
-      --replace "plugdev" "flashrom"
+      --replace 'GROUP="plugdev"' 'TAG+="uaccess", TAG+="udev-acl"'
   '';
 
   makeFlags = [ "PREFIX=$(out)" "libinstall" ]

pkgs/tools/misc/ntfy-sh/default.nix

@@ -10,16 +10,16 @@ let
 in
 buildGoModule rec {
   pname = "ntfy-sh";
-  version = "1.31.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "binwiederhier";
     repo = "ntfy";
     rev = "v${version}";
-    sha256 = "sha256-SQOiVHhdwOmzWVPtr1hw9oz8G/xjz5HghYcNN/u3ITo=";
+    sha256 = "sha256-r5MAffvQVya6VWzdO3NPVBAekeZQllxtpS5A06EQnI4=";
   };
 
-  vendorSha256 = "sha256-Ffmz7c/FMtXjmanZYp8vquxUu+eSTqtR5nesNdN/F0c=";
+  vendorSha256 = "sha256-QUUZX9UnLnhyYrbws9pGfN/gqbwt7CeJNYlsPsLRb6g=";
 
   doCheck = false;
 

pkgs/tools/misc/ntfy-sh/generate-dependencies.sh

@@ -6,6 +6,7 @@ $(nix-build $ROOT -A  nodePackages.node2nix --no-out-link)/bin/node2nix \
   --nodejs-14 \
   --node-env ../../../development/node-packages/node-env.nix \
   --development \
-  --lock ./package-lock-temp.json \
   --output node-packages.nix \
   --composition node-composition.nix
+# removed temporarily because of https://github.com/svanderburg/node2nix/issues/312
+# --lock ./package-lock-temp.json \

pkgs/tools/misc/ntfy-sh/package.json

@@ -15,6 +15,7 @@
     "@mui/material": "latest",
     "dexie": "^3.2.1",
     "dexie-react-hooks": "^1.1.1",
+    "humanize-duration": "^3.27.3",
     "i18next": "^21.6.14",
     "i18next-browser-languagedetector": "^6.1.4",
     "i18next-http-backend": "^1.4.0",

pkgs/tools/security/mfoc-hardnested/default.nix

@@ -0,0 +1,25 @@
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, libnfc, xz }:
+
+stdenv.mkDerivation rec {
+  pname = "mfoc-hardnested";
+  version = "unstable-2021-08-14";
+
+  src = fetchFromGitHub {
+    owner = "nfc-tools";
+    repo = pname;
+    rev = "2c25bf05a0b13827b9d06382c5d384b2e5c88238";
+    hash = "sha256-fhfevQCw0E5TorHx61Vltpmv7DAjgH73i27O7aBKxz4=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+  buildInputs = [ libnfc xz ];
+
+  meta = with lib; {
+    description = "A fork of mfoc integrating hardnested code from the proxmark";
+    license = licenses.gpl2;
+    homepage = "https://github.com/nfc-tools/mfoc-hardnested";
+    maintainers = with maintainers; [ azuwis ];
+    platforms = platforms.unix;
+    broken = (stdenv.isDarwin && stdenv.isAarch64); # Undefined symbols "_memalign" referenced
+  };
+}

pkgs/top-level/all-packages.nix

@@ -9778,6 +9778,8 @@ with pkgs;
 
   mfoc = callPackage ../tools/security/mfoc { };
 
+  mfoc-hardnested = callPackage ../tools/security/mfoc-hardnested { };
+
   microbin = callPackage ../servers/microbin { };
 
   microdnf = callPackage ../tools/package-management/microdnf { };
@@ -19386,6 +19388,14 @@ with pkgs;
 
   uci = callPackage ../development/libraries/uci { };
 
+  uclient = callPackage ../development/libraries/uclient { };
+
+  ustream-ssl = callPackage ../development/libraries/ustream-ssl { ssl_implementation = openssl; };
+
+  ustream-ssl-wolfssl = callPackage ../development/libraries/ustream-ssl { ssl_implementation = wolfssl; };
+
+  ustream-ssl-mbedtls = callPackage ../development/libraries/ustream-ssl { ssl_implementation = mbedtls_2; };
+
   uri = callPackage ../development/libraries/uri { stdenv = gcc10StdenvCompat; };
 
   cppcms = callPackage ../development/libraries/cppcms { };
@@ -21830,7 +21840,13 @@ with pkgs;
 
   libu2f-server = callPackage ../development/libraries/libu2f-server { };
 
-  libubox = callPackage ../development/libraries/libubox { };
+  libubox-nossl = callPackage ../development/libraries/libubox { };
+
+  libubox = callPackage ../development/libraries/libubox { with_ustream_ssl = true; };
+
+  libubox-wolfssl = callPackage ../development/libraries/libubox { with_ustream_ssl = true; ustream-ssl = ustream-ssl-wolfssl; };
+
+  libubox-mbedtls = callPackage ../development/libraries/libubox { with_ustream_ssl = true; ustream-ssl = ustream-ssl-mbedtls; };
 
   libudev-zero = callPackage ../development/libraries/libudev-zero { };
 
@@ -23537,9 +23553,7 @@ with pkgs;
 
   theft = callPackage ../development/libraries/theft { };
 
-  thrift = callPackage ../development/libraries/thrift {
+  thrift = callPackage ../development/libraries/thrift { };
-    openssl = openssl_1_1;
-  };
 
   thrift-0_10 = callPackage ../development/libraries/thrift/0.10.nix { };
 
@@ -26010,6 +26024,8 @@ with pkgs;
 
   libnl = callPackage ../os-specific/linux/libnl { };
 
+  libnl-tiny = callPackage ../os-specific/linux/libnl-tiny { };
+
   libtraceevent = callPackage ../os-specific/linux/libtraceevent {};
 
   libtracefs = callPackage ../os-specific/linux/libtracefs {};
@@ -29284,7 +29300,10 @@ with pkgs;
 
   keepassx = callPackage ../applications/misc/keepassx { };
   keepassx2 = callPackage ../applications/misc/keepassx/2.0.nix { };
-  keepassxc = libsForQt5.callPackage ../applications/misc/keepassx/community.nix { };
+  keepassxc = libsForQt5.callPackage ../applications/misc/keepassx/community.nix {
+    inherit (darwin.apple_sdk_11_0.frameworks) LocalAuthentication;
+    stdenv = if stdenv.isDarwin then darwin.apple_sdk_11_0.stdenv else stdenv;
+  };
 
   keepass-diff = callPackage ../applications/misc/keepass-diff { };
 
@@ -31974,6 +31993,10 @@ with pkgs;
 
   ngt = callPackage ../development/libraries/ngt { };
 
+  nchat = callPackage ../applications/networking/instant-messengers/nchat {
+    inherit (darwin.apple_sdk.frameworks) AppKit Cocoa Foundation;
+  };
+
   nheko = libsForQt5.callPackage ../applications/networking/instant-messengers/nheko {
     # https://github.com/NixOS/nixpkgs/issues/201254
     stdenv = if stdenv.isLinux && stdenv.isAarch64 && stdenv.cc.isGNU then gcc11Stdenv else stdenv;