Merge pull request #106321 from NixOS/staging-next

Staging next
2020-12-11 15:56:17 +01:00 · 2020-12-11 15:56:17 +01:00 · 3b85d7d54f
commit 3b85d7d54f
parent b9c76212fd 9fa8c7670d
65 changed files with 476 additions and 557 deletions
--- a/nixos/doc/manual/release-notes/rl-2103.xml
+++ b/nixos/doc/manual/release-notes/rl-2103.xml
@ -370,6 +370,18 @@
     and rebooting.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     PulseAudio was upgraded to 14.0, with changes to the handling of default sinks.
+     See its <link xlink:href="https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/14.0/">release notes</link>.
+    </para>
+
+    <para>
+     GNOME users may wish to delete their <literal>~/.config/pulse</literal> due to the changes to stream routing
+     logic. See <link xlink:href="https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/issues/832">PulseAudio bug 832</link>
+     for more information.
+    </para>
+   </listitem>
   <listitem>
    <para>
     The <package>zookeeper</package> package does not provide
--- a/pkgs/applications/office/elementary-planner/default.nix
+++ b/pkgs/applications/office/elementary-planner/default.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "elementary-planner";
-  version = "2.5.4";
+  version = "2.5.7";

  src = fetchFromGitHub {
    owner = "alainm23";
    repo = "planner";
    rev = version;
-    sha256 = "0q5zmjh0d1mapgqb2a38spss280jkkc2n835kc7grzvs9jgq1k1k";
+    sha256 = "0s2f9q7i31c2splflfnaiqviwnxbsp2zvibr70xafhbhnkmzlrsk";
  };

  nativeBuildInputs = [
--- a/pkgs/build-support/setup-hooks/auto-patchelf.sh
+++ b/pkgs/build-support/setup-hooks/auto-patchelf.sh
@ -1,9 +1,16 @@
 declare -a autoPatchelfLibs
+declare -Ag autoPatchelfFailedDeps

 gatherLibraries() {
    autoPatchelfLibs+=("$1/lib")
 }

+# wrapper around patchelf to raise proper error messages
+# containing the tried file name and command
+runPatchelf() {
+  patchelf "$@" || (echo "Command failed: patchelf $*" && exit 1)
+}
+
 addEnvHooks "$targetOffset" gatherLibraries

 isExecutable() {
@ -23,14 +30,19 @@ isExecutable() {

 # We cache dependencies so that we don't need to search through all of them on
 # every consecutive call to findDependency.
-declare -a cachedDependencies
+declare -Ag autoPatchelfCachedDepsAssoc
+declare -ag autoPatchelfCachedDeps
+

 addToDepCache() {
-    local existing
-    for existing in "${cachedDependencies[@]}"; do
-        if [ "$existing" = "$1" ]; then return; fi
-    done
-    cachedDependencies+=("$1")
+    if [[ ${autoPatchelfCachedDepsAssoc[$1]+f} ]]; then return; fi
+
+    # store deps in an assoc. array for efficient lookups
+    # otherwise findDependency would have quadratic complexity
+    autoPatchelfCachedDepsAssoc["$1"]=""
+
+    # also store deps in normal array to maintain their order
+    autoPatchelfCachedDeps+=("$1")
 }

 declare -gi depCacheInitialised=0
@ -43,9 +55,8 @@ getDepsFromSo() {

 populateCacheWithRecursiveDeps() {
    local so found foundso
-    for so in "${cachedDependencies[@]}"; do
+    for so in "${autoPatchelfCachedDeps[@]}"; do
        for found in $(getDepsFromSo "$so"); do
-            local libdir="${found%/*}"
            local base="${found##*/}"
            local soname="${base%.so*}"
            for foundso in "${found%/*}/$soname".so*; do
@ -76,7 +87,7 @@ findDependency() {
        depCacheInitialised=1
    fi

-    for dep in "${cachedDependencies[@]}"; do
+    for dep in "${autoPatchelfCachedDeps[@]}"; do
        if [ "$filename" = "${dep##*/}" ]; then
            if [ "$(getSoArch "$dep")" = "$arch" ]; then
                foundDependency="$dep"
@ -101,9 +112,10 @@ findDependency() {
 autoPatchelfFile() {
    local dep rpath="" toPatch="$1"

-    local interpreter="$(< "$NIX_CC/nix-support/dynamic-linker")"
+    local interpreter
+    interpreter="$(< "$NIX_CC/nix-support/dynamic-linker")"
    if isExecutable "$toPatch"; then
-        patchelf --set-interpreter "$interpreter" "$toPatch"
+        runPatchelf --set-interpreter "$interpreter" "$toPatch"
        if [ -n "$runtimeDependencies" ]; then
            for dep in $runtimeDependencies; do
                rpath="$rpath${rpath:+:}$dep/lib"
@ -115,9 +127,10 @@ autoPatchelfFile() {

    # We're going to find all dependencies based on ldd output, so we need to
    # clear the RPATH first.
-    patchelf --remove-rpath "$toPatch"
+    runPatchelf --remove-rpath "$toPatch"

-    local missing="$(
+    local missing
+    missing="$(
        ldd "$toPatch" 2> /dev/null | \
            sed -n -e 's/^[\t ]*\([^ ]\+\) => not found.*/\1/p'
    )"
@ -125,7 +138,6 @@ autoPatchelfFile() {
    # This ensures that we get the output of all missing dependencies instead
    # of failing at the first one, because it's more useful when working on a
    # new package where you don't yet know its dependencies.
-    local -i depNotFound=0

    for dep in $missing; do
        echo -n "  $dep -> " >&2
@ -134,18 +146,13 @@ autoPatchelfFile() {
            echo "found: $foundDependency" >&2
        else
            echo "not found!" >&2
-            depNotFound=1
+            autoPatchelfFailedDeps["$dep"]="$toPatch"
        fi
    done

-    # This makes sure the builder fails if we didn't find a dependency, because
-    # the stdenv setup script is run with set -e. The actual error is emitted
-    # earlier in the previous loop.
-    [ $depNotFound -eq 0 -o -n "$autoPatchelfIgnoreMissingDeps" ]
-
    if [ -n "$rpath" ]; then
        echo "setting RPATH to: $rpath" >&2
-        patchelf --set-rpath "$rpath" "$toPatch"
+        runPatchelf --set-rpath "$rpath" "$toPatch"
    fi
 }

@ -168,10 +175,10 @@ addAutoPatchelfSearchPath() {
        esac
    done

-    cachedDependencies+=(
-        $(find "$@" "${findOpts[@]}" \! -type d \
-               \( -name '*.so' -o -name '*.so.*' \))
-    )
+    for file in \
+      $(find "$@" "${findOpts[@]}" \! -type d \
+          \( -name '*.so' -o -name '*.so.*' \))
+    do addToDepCache "$file"; done
 }

 autoPatchelf() {
@ -197,14 +204,9 @@ autoPatchelf() {
    echo "automatically fixing dependencies for ELF files" >&2

    # Add all shared objects of the current output path to the start of
-    # cachedDependencies so that it's choosen first in findDependency.
+    # autoPatchelfCachedDeps so that it's chosen first in findDependency.
    addAutoPatchelfSearchPath ${norecurse:+--no-recurse} -- "$@"

-    # Here we actually have a subshell, which also means that
-    # $cachedDependencies is final at this point, so whenever we want to run
-    # findDependency outside of this, the dependency cache needs to be rebuilt
-    # from scratch, so keep this in mind if you want to run findDependency
-    # outside of this function.
    while IFS= read -r -d $'\0' file; do
      isELF "$file" || continue
      segmentHeaders="$(LANG=C $READELF -l "$file")"
@ -215,8 +217,24 @@ autoPatchelf() {
          # Skip if the executable is statically linked.
          [ -n "$(echo "$segmentHeaders" | grep "^ *INTERP\\>")" ] || continue
      fi
+      # Jump file if patchelf is unable to parse it
+      # Some programs contain binary blobs for testing,
+      # which are identified as ELF but fail to be parsed by patchelf
+      patchelf "$file" || continue
      autoPatchelfFile "$file"
    done < <(find "$@" ${norecurse:+-maxdepth 1} -type f -print0)
+
+    # fail if any dependencies were not found and
+    # autoPatchelfIgnoreMissingDeps is not set
+    local depsMissing=0
+    for failedDep in "${!autoPatchelfFailedDeps[@]}"; do
+      echo "autoPatchelfHook could not satisfy dependency $failedDep wanted by ${autoPatchelfFailedDeps[$failedDep]}"
+      depsMissing=1
+    done
+    if [[ $depsMissing == 1 && -z "$autoPatchelfIgnoreMissingDeps" ]]; then
+      echo "Add the missing dependencies to the build inputs or set autoPatchelfIgnoreMissingDeps=true"
+      exit 1
+    fi
 }

 # XXX: This should ultimately use fixupOutputHooks but we currently don't have
--- a/pkgs/build-support/setup-hooks/compress-man-pages.sh
+++ b/pkgs/build-support/setup-hooks/compress-man-pages.sh
@ -21,6 +21,7 @@ compressManPages() {

    # Point symlinks to compressed manpages.
    find "$dir"/share/man/ -type l -a '!' -regex '.*\.\(bz2\|gz\)$' -print0 \
+        | sort -z \
        | while IFS= read -r -d $'\0' f
    do
        local target
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@ -51,7 +51,7 @@ stripDirs() {

    if [ -n "${dirs}" ]; then
        header "stripping (with command $cmd and flags $stripFlags) in$dirs"
-        find $dirs -type f -print0 | xargs -0 ${xargsFlags:--r} $cmd $commonStripFlags $stripFlags 2>/dev/null || true
+        find $dirs -type f -exec $cmd $commonStripFlags $stripFlags '{}' \; #
        stopNest
    fi
 }
--- a/pkgs/data/misc/cacert/default.nix
+++ b/pkgs/data/misc/cacert/default.nix
@ -1,6 +1,10 @@
 { stdenv, fetchurl, nss, python3
 , blacklist ? []
-, includeEmail ? false
+
+# Used for tests only
+, runCommand
+, cacert
+, openssl
 }:

 with stdenv.lib;
@ -37,11 +41,6 @@ stdenv.mkDerivation {
    EOF

    cat ${certdata2pem} > certdata2pem.py
-    patch -p1 < ${./fix-unicode-ca-names.patch}
-    ${optionalString includeEmail ''
-      # Disable CAs used for mail signing
-      substituteInPlace certdata2pem.py --replace \[\'CKA_TRUST_EMAIL_PROTECTION\'\] '''
-    ''}
  '';

  buildPhase = ''
@ -66,12 +65,59 @@ stdenv.mkDerivation {
  setupHook = ./setup-hook.sh;

  passthru.updateScript = ./update.sh;
+  passthru.tests = {
+    # Test that building this derivation with a blacklist works, and that UTF-8 is supported.
+    blacklist-utf8 = let
+      blacklistCAToFingerprint = {
+        # "blacklist" uses the CA name from the NSS bundle, but we check for presence using the SHA256 fingerprint.
+        "CFCA EV ROOT" = "5C:C3:D7:8E:4E:1D:5E:45:54:7A:04:E6:87:3E:64:F9:0C:F9:53:6D:1C:CC:2E:F8:00:F3:55:C4:C5:FD:70:FD";
+        "NetLock Arany (Class Gold) Főtanúsítvány" = "6C:61:DA:C3:A2:DE:F0:31:50:6B:E0:36:D2:A6:FE:40:19:94:FB:D1:3D:F9:C8:D4:66:59:92:74:C4:46:EC:98";
+      };
+      mapBlacklist = f: concatStringsSep "\n" (mapAttrsToList f blacklistCAToFingerprint);
+    in runCommand "verify-the-cacert-filter-output" {
+      cacert = cacert.unbundled;
+      cacertWithExcludes = (cacert.override {
+        blacklist = builtins.attrNames blacklistCAToFingerprint;
+      }).unbundled;
+
+      nativeBuildInputs = [ openssl ];
+    } ''
+      isPresent() {
+        # isPresent <unbundled-dir> <ca name> <ca sha256 fingerprint>
+        for f in $1/etc/ssl/certs/*.crt; do
+          fingerprint="$(openssl x509 -in "$f" -noout -fingerprint -sha256 | cut -f2 -d=)"
+          if [[ "x$fingerprint" == "x$3" ]]; then
+            return 0
+          fi
+        done
+        return 1
+      }
+
+      # Ensure that each certificate is in the main "cacert".
+      ${mapBlacklist (caName: caFingerprint: ''
+        isPresent "$cacert" "${caName}" "${caFingerprint}" || ({
+          echo "CA fingerprint ${caFingerprint} (${caName}) is missing from the CA bundle. Consider picking a different CA for the blacklist test." >&2
+          exit 1
+        })
+      '')}
+
+      # Ensure that each certificate is NOT in the "cacertWithExcludes".
+      ${mapBlacklist (caName: caFingerprint: ''
+        isPresent "$cacertWithExcludes" "${caName}" "${caFingerprint}" && ({
+          echo "CA fingerprint ${caFingerprint} (${caName}) is present in the cacertWithExcludes bundle." >&2
+          exit 1
+        })
+      '')}
+
+      touch $out
+    '';
+  };

  meta = {
    homepage = "https://curl.haxx.se/docs/caextract.html";
    description = "A bundle of X.509 certificates of public Certificate Authorities (CA)";
    platforms = platforms.all;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ andir fpletz lukegb ];
    license = licenses.mpl20;
  };
 }
--- a/pkgs/data/misc/cacert/fix-unicode-ca-names.patch
+++ b/pkgs/data/misc/cacert/fix-unicode-ca-names.patch
@ -1,20 +0,0 @@
--- a/certdata2pem.py	2017-08-01 23:10:00.000000000 +0300
-+++ b/certdata2pem.py	2017-08-01 23:08:21.131297636 +0300
-@@ -88,7 +88,7 @@
- \# Read blacklist.
- blacklist = []
- if os.path.exists('blacklist.txt'):
-    for line in open('blacklist.txt', 'r'):
-+    for line in io.open('blacklist.txt', 'r', encoding='utf-8'):
-         line = line.strip()
-         if line.startswith('#') or len(line) == 0:
-             continue
-@@ -101,7 +101,7 @@
-     if obj['CKA_CLASS'] != 'CKO_NSS_TRUST':
-         continue
-     if obj['CKA_LABEL'] in blacklist:
-        print("Certificate %s blacklisted, ignoring." % obj['CKA_LABEL'])
-+        print("Certificate %s blacklisted, ignoring." % unicode(obj['CKA_LABEL']).encode('utf-8'))
-     elif obj['CKA_TRUST_SERVER_AUTH'] == 'CKT_NSS_TRUSTED_DELEGATOR':
-         trust[obj['CKA_LABEL']] = True
-     elif obj['CKA_TRUST_EMAIL_PROTECTION'] == 'CKT_NSS_TRUSTED_DELEGATOR':
--- a/pkgs/development/interpreters/guile/setup-hook-2.0.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.0.sh
@ -8,6 +8,16 @@ addGuileLibPath () {
        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
    fi
+
+    if test -d "$1/lib/guile/2.0/ccache"
+    then
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/ccache"
+    fi
+
+    if test -d "$1/lib/guile/2.0/site-ccache"
+    then
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.0/site-ccache"
+    fi
 }

 addEnvHooks "$hostOffset" addGuileLibPath
--- a/pkgs/development/interpreters/guile/setup-hook-2.2.sh
+++ b/pkgs/development/interpreters/guile/setup-hook-2.2.sh
@ -8,6 +8,16 @@ addGuileLibPath () {
        export GUILE_LOAD_PATH="${GUILE_LOAD_PATH-}${GUILE_LOAD_PATH:+:}$1/share/guile/site"
        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/share/guile/site"
    fi
+
+    if test -d "$1/lib/guile/2.2/ccache"
+    then
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/ccache"
+    fi
+
+    if test -d "$1/lib/guile/2.2/site-ccache"
+    then
+        export GUILE_LOAD_COMPILED_PATH="${GUILE_LOAD_COMPILED_PATH-}${GUILE_LOAD_COMPILED_PATH:+:}$1/lib/guile/2.2/site-ccache"
+    fi
 }

 addEnvHooks "$hostOffset" addGuileLibPath
--- a/pkgs/development/libraries/glibc/2.32-10.patch.gz
+++ b/pkgs/development/libraries/glibc/2.32-10.patch.gz
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@ -42,7 +42,7 @@

 let
  version = "2.32";
-  patchSuffix = "";
+  patchSuffix = "-10";
  sha256 = "0di848ibffrnwq7g2dvgqrnn4xqhj3h96csn69q4da51ymafl9qn";
 in

@ -59,6 +59,15 @@ stdenv.mkDerivation ({

  patches =
    [
+      /* No tarballs for stable upstream branch, only https://sourceware.org/git/?p=glibc.git
+         and using git or something would complicate bootstrapping.
+         Fortunately it's not too big with 2.32-10.
+          $ git checkout release/2.32/master; git describe
+          glibc-2.32-10-g0b9460d22e
+          $ git show --reverse glibc-2.32.. | gzip -n -9 --rsyncable - > 2.32-10.patch.gz
+       */
+      ./2.32-10.patch.gz
+
      /* Allow NixOS and Nix to handle the locale-archive. */
      ./nix-locale-archive.patch

--- a/pkgs/development/libraries/hwloc/default.nix
+++ b/pkgs/development/libraries/hwloc/default.nix
@ -7,7 +7,7 @@ assert x11Support -> libX11 != null && cairo != null;
 with stdenv.lib;

 let
-  version = "2.3.0";
+  version = "2.4.0";
  versmm = versions.major version + "." + versions.minor version;
  name = "hwloc-${version}";

@ -16,7 +16,7 @@ in stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.open-mpi.org/software/hwloc/v${versmm}/downloads/${name}.tar.bz2";
-    sha256 = "0r4a07ag1fv48ql2g64px0wrjpxlvkh6c7mhnkv9xxkkg04zc1xn";
+    sha256 = "1s9q70mrr4igbjw4m26din81i68f4wbfpv6wdc4i2aalvd51n7rb";
  };

  configureFlags = [
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@ -12,13 +12,13 @@ assert xarSupport -> libxml2 != null;

 stdenv.mkDerivation rec {
  pname = "libarchive";
-  version = "3.4.3";
+  version = "3.5.0";

  src = fetchFromGitHub {
    owner = "libarchive";
    repo = "libarchive";
    rev = "v${version}";
-    sha256 = "1y0v03p6zyv6plr2p0pid1qfgmk8hd427spj8xa93mcdmq5yc3s0";
+    sha256 = "0dj01ayyac3q5a62rqxyskr4fjiq6iappd85zn3rx64xny5fl07d";
  };

  outputs = [ "out" "lib" "dev" ];
@ -57,6 +57,7 @@ stdenv.mkDerivation rec {
      compressed with gzip, bzip2, lzma, xz, ...
    '';
    homepage = "http://libarchive.org";
+    changelog = "https://github.com/libarchive/libarchive/releases/tag/v${version}";
    license = stdenv.lib.licenses.bsd3;
    platforms = with stdenv.lib.platforms; all;
    maintainers = with stdenv.lib.maintainers; [ jcumming ];
--- a/pkgs/development/libraries/libgphoto2/default.nix
+++ b/pkgs/development/libraries/libgphoto2/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "libgphoto2";
-  version = "2.5.23";
+  version = "2.5.26";

  src = fetchFromGitHub {
    owner = "gphoto";
    repo = "libgphoto2";
    rev = "libgphoto2-${builtins.replaceStrings [ "." ] [ "_" ] version}-release";
-    sha256 = "1sc2ycx11khf0qzp1cqxxx1qymv6bjfbkx3vvbwz6wnbyvsigxz2";
+    sha256 = "0lnlxflj04ng9a0hm2nb2067kqs4kp9kx1z4gg395cgbfd7lx6j6";
  };

  patches = [];
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@ -27,14 +27,14 @@ in
 with stdenv.lib;
 stdenv.mkDerivation rec {
  pname = "libinput";
-  version = "1.16.3";
+  version = "1.16.4";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = pname;
    repo = pname;
    rev = version;
-    sha256 = "0dj2m92kh3xpnjmzp416c73hpw6ban0f6yj39chwxckdgyliak6z";
+    sha256 = "1c81429kh9av9fanxmnjw5rvsjbzcyi7d0dx0gkyq5yysmpmrppi";
  };

  outputs = [ "bin" "out" "dev" ];
--- a/pkgs/development/libraries/libksba/default.nix
+++ b/pkgs/development/libraries/libksba/default.nix
@ -1,11 +1,11 @@
 { buildPackages, stdenv, fetchurl, gettext, libgpgerror }:

 stdenv.mkDerivation rec {
-  name = "libksba-1.4.0";
+  name = "libksba-1.5.0";

  src = fetchurl {
    url = "mirror://gnupg/libksba/${name}.tar.bz2";
-    sha256 = "1dj1razn35srkgadx3i30yr0q037cr0dn54m6a54vxgh3zlsirmz";
+    sha256 = "1fm0mf3wq9fmyi1rmc1vk2fafn6liiw2mgxml3g7ybbb44lz2jmf";
  };

  outputs = [ "out" "dev" "info" ];
--- a/pkgs/development/libraries/libunwind/default.nix
+++ b/pkgs/development/libraries/libunwind/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, autoreconfHook, xz }:
+{ stdenv, lib, fetchurl, autoreconfHook, xz, coreutils }:

 stdenv.mkDerivation rec {
  pname = "libunwind";
@ -17,7 +17,11 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ autoreconfHook ];

-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "devman" ];
+
+  # Without latex2man, no man pages are installed despite being
+  # prebuilt in the source tarball.
+  configureFlags = "LATEX2MAN=${coreutils}/bin/true";

  propagatedBuildInputs = [ xz ];

--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  name = "libva-${lib.optionalString minimal "minimal-"}${version}";
-  version = "2.9.1"; # Also update the hash for libva-utils!
+  version = "2.10.0";

  src = fetchFromGitHub {
    owner  = "intel";
    repo   = "libva";
    rev    = version;
-    sha256 = "1c9rwrz30q2p47spzb9gsakwci9c5mw6i309z7p7hr2d8233ay4x";
+    sha256 = "1xyxnxmq04s3s6135v6av1rl5z809j9vxvg7af9wvyh3dgsxrlds";
  };

  outputs = [ "dev" "out" ];
--- a/pkgs/development/libraries/libva/utils.nix
+++ b/pkgs/development/libraries/libva/utils.nix
@ -4,7 +4,7 @@

 stdenv.mkDerivation rec {
  pname = "libva-utils";
-  inherit (libva) version;
+  version = "2.9.1";

  src = fetchFromGitHub {
    owner  = "intel";
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -31,7 +31,7 @@ with stdenv.lib;
 let
  # Release calendar: https://www.mesa3d.org/release-calendar.html
  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "20.2.3";
+  version = "20.2.4";
  branch  = versions.major version;
 in

@ -46,7 +46,7 @@ stdenv.mkDerivation {
      "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
      "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
    ];
-    sha256 = "0axqrqg1fas91fx30qjwhcp4yasdvk919hjds4lga7ak247286xf";
+    sha256 = "14m09bk7akj0k02lg8fhvvzbdsashlbdsgl2cw7wbqfj2mhdqwh5";
  };

  prePatch = "patchShebangs .";
--- a/pkgs/development/libraries/pcre2/default.nix
+++ b/pkgs/development/libraries/pcre2/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "pcre2";
-  version = "10.35";
+  version = "10.36";
  src = fetchurl {
    url = "https://ftp.pcre.org/pub/pcre/${pname}-${version}.tar.bz2";
-    sha256 = "04s6kmk9qdd4rjz477h547j4bx7hfz0yalpvrm381rqc5ghaijww";
+    sha256 = "0p3699msps07p40g9426lvxa3b41rg7k2fn7qxl2jm0kh4kkkvx9";
  };

  configureFlags = [
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@ -10,12 +10,12 @@ in

 stdenv.mkDerivation rec {
  pname = "sqlite";
-  version = "3.33.0";
+  version = "3.34.0";

  # NB! Make sure to update ./tools.nix src (in the same directory).
  src = fetchurl {
    url = "https://sqlite.org/2020/sqlite-autoconf-${archiveVersion version}.tar.gz";
-    sha256 = "05dvdfaxd552gj5p7k0i72sfam7lykaw1g2pfn52jnppqx42qshh";
+    sha256 = "1vlsvlp5nvhd5pdjpmdczfsv7mml2gsalykl6x3palbxwgxbfvdz";
  };

  outputs = [ "bin" "dev" "out" ];
--- a/pkgs/development/libraries/sqlite/tools.nix
+++ b/pkgs/development/libraries/sqlite/tools.nix
@ -4,11 +4,11 @@ let
  archiveVersion = import ./archive-version.nix stdenv.lib;
  mkTool = { pname, makeTarget, description, homepage }: stdenv.mkDerivation rec {
    inherit pname;
-    version = "3.33.0";
+    version = "3.34.0";

    src = assert version == sqlite.version; fetchurl {
      url = "https://sqlite.org/2020/sqlite-src-${archiveVersion version}.zip";
-      sha256 = "1f09srlrmcab1sf8j2d89s2kvknlbxk7mbsiwpndw9mall27dgwh";
+      sha256 = "0giklai05shqalj1wwadi9hg5dx6vff8nrblqh9xxljnrq701hm5";
    };

    nativeBuildInputs = [ unzip ];
--- a/pkgs/development/libraries/tracker/default.nix
+++ b/pkgs/development/libraries/tracker/default.nix
@ -1,5 +1,6 @@
 { stdenv
 , fetchurl
+, fetchpatch
 , gettext
 , meson
 , ninja
@ -43,6 +44,13 @@ stdenv.mkDerivation rec {
      src = ./fix-paths.patch;
      inherit asciidoc;
    })
+
+    # Fix consistency error with sqlite 3.34
+    # https://gitlab.gnome.org/GNOME/tracker/merge_requests/353
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/tracker/commit/040e22d005985a19a0dc435a7631f91700804ce4.patch";
+      sha256 = "5OZj17XY8ZnXfMMim25HvGfFKUlsVlVHOUjZKfBKHcs=";
+    })
  ];

  nativeBuildInputs = [
--- a/pkgs/development/ocaml-modules/eliom/default.nix
+++ b/pkgs/development/ocaml-modules/eliom/default.nix
@ -14,11 +14,11 @@ else
 stdenv.mkDerivation rec
 {
  pname = "eliom";
-  version = "6.12.1";
+  version = "6.12.4";

  src = fetchzip {
    url = "https://github.com/ocsigen/eliom/archive/${version}.tar.gz";
-    sha256 = "04c1sz113015gyhj3w7flw7l4bv0v50q6n04kk8dybcravzy2xgx";
+    sha256 = "00m6v2k4mg8705dy41934lznl6gj91i6dk7p1nkaccm51nna25kz";
  };

  buildInputs = [ ocaml which findlib js_of_ocaml-ocamlbuild js_of_ocaml-ppx_deriving_json opaline
--- a/pkgs/development/python-modules/pyopenssl/default.nix
+++ b/pkgs/development/python-modules/pyopenssl/default.nix
@ -65,11 +65,11 @@ in

 buildPythonPackage rec {
  pname = "pyOpenSSL";
-  version = "19.1.0";
+  version = "20.0.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "9a24494b2602aaf402be5c9e30a0b82d4a5c67528fe8fb475e3f3bc00dd69507";
+    sha256 = "1i8ab5zn9i9iq2ksizp3rd42v157kacddzz88kviqw3kpp68xw4j";
  };

  outputs = [ "out" "dev" ];
@ -81,27 +81,6 @@ buildPythonPackage rec {
    runHook postCheck
  '';

-  patches = [
-    # 4 patches for 2020 bug
-    # https://github.com/pyca/pyopenssl/pull/828
-    (fetchpatch {
-      url = "https://github.com/pyca/pyopenssl/commit/0d2fd1a24b30077ead6960bd63b4a9893a57c101.patch";
-      sha256 = "1c27g53qrwxddyx04sxf8yvj7xgbaabla7mc1cgbfd426rncbqf3";
-    })
-    (fetchpatch {
-      url = "https://github.com/pyca/pyopenssl/commit/d08a742573c3205348a4eec9a65abaf6c16110c4.patch";
-      sha256 = "18xn8s1wpycz575ivrbsbs0qd2q48z8pdzsjzh8i60xba3f8yj2f";
-    })
-    (fetchpatch {
-      url = "https://github.com/pyca/pyopenssl/commit/60b9e10e6da7ccafaf722def630285f54510ed12.patch";
-      sha256 = "0aw8qvy8m0bhgp39lmbcrpprpg4bhpssm327hyrk476wwgajk01j";
-    })
-    (fetchpatch {
-      url = "https://github.com/pyca/pyopenssl/commit/7a37cc23fcbe43abe785cd4badd14bdc7acfb175.patch";
-      sha256 = "1c7zb568rs71rsl16p6dq7aixwlkgzfnba4vzmfvbmy3zsnaslq2";
-    })
-  ];
-
  # Seems to fail unpredictably on Darwin. See https://hydra.nixos.org/build/49877419/nixlog/1
  # for one example, but I've also seen ContextTests.test_set_verify_callback_exception fail.
  doCheck = !stdenv.isDarwin;
--- a/pkgs/development/python-modules/setuptools/default.nix
+++ b/pkgs/development/python-modules/setuptools/default.nix
@ -38,7 +38,7 @@ let
      # Here we untar the sdist and retar it in order to control the timestamps
      # of all the files included
      tar -xzf dist/${pname}-${version}.post0.tar.gz -C dist/
-      tar -czf dist/${name} -C dist/ --mtime="@$SOURCE_DATE_EPOCH"  ${pname}-${version}.post0
+      tar -czf dist/${name} -C dist/ --mtime="@$SOURCE_DATE_EPOCH" --sort=name ${pname}-${version}.post0
    '';

    installPhase = ''
--- a/pkgs/os-specific/linux/fuse/default.nix
+++ b/pkgs/os-specific/linux/fuse/default.nix
@ -11,7 +11,7 @@ in {
  };

  fuse_3 = mkFuse {
-    version = "3.10.0";
-    sha256Hash = "05ipzmlk6xci9v4sf0pap542b37aszghlchswl6s76fg6h3w4yms";
+    version = "3.10.1";
+    sha256Hash = "0bb22mac8m0z6qp0s6g4r0x4aj6gc19pfyqr6sdy4hkpwxicgmaf";
  };
 }
--- a/pkgs/os-specific/linux/libcap-ng/default.nix
+++ b/pkgs/os-specific/linux/libcap-ng/default.nix
@ -6,11 +6,11 @@ stdenv.mkDerivation rec {
  pname = "libcap-ng";
  # When updating make sure to test that the version with
  # all of the python bindings still works
-  version = "0.7.11";
+  version = "0.8";

  src = fetchurl {
    url = "${meta.homepage}/${pname}-${version}.tar.gz";
-    sha256 = "1s8akhnnazk0b5c6z5i3x54rjb26p8pz2wdl1m21ml3231qmr0c5";
+    sha256 = "08cy59iassiwbmfxa5v0kb374r80290vv32f5q1mnip11av26kgi";
  };

  nativeBuildInputs = [ swig ];
--- a/pkgs/os-specific/linux/libcap/default.nix
+++ b/pkgs/os-specific/linux/libcap/default.nix
@ -1,4 +1,5 @@
-{ stdenv, buildPackages, fetchurl, attr, perl, pam }:
+{ stdenv, lib, buildPackages, fetchurl, attr, perl, pam
+, static ? stdenv.targetPlatform.isStatic }:

 stdenv.mkDerivation rec {
  pname = "libcap";
@ -9,7 +10,10 @@ stdenv.mkDerivation rec {
    sha256 = "1qf80lifygbnxwvqjf8jz5j24n6fqqx4ixnkbf76xs2vrmcq664j";
  };

-  outputs = [ "out" "dev" "lib" "man" "doc" "pam" ];
+  patches = lib.optional static ./no-shared-lib.patch;
+
+  outputs = [ "out" "dev" "lib" "man" "doc" ]
+    ++ lib.optional (pam != null) "pam";

  depsBuildBuild = [ buildPackages.stdenv.cc ];
  nativeBuildInputs = [ perl ];
@ -20,7 +24,7 @@ stdenv.mkDerivation rec {

  makeFlags = [
    "lib=lib"
-    "PAM_CAP=yes"
+    "PAM_CAP=${if pam == null then "no" else "yes"}"
    "BUILD_CC=$(CC_FOR_BUILD)"
    "CC:=$(CC)"
  ];
@ -44,7 +48,7 @@ stdenv.mkDerivation rec {
  installFlags = [ "RAISE_SETFCAP=no" ];

  postInstall = ''
-    rm "$lib"/lib/*.a
+    ${lib.optionalString (!static) ''rm "$lib"/lib/*.a''}
    mkdir -p "$doc/share/doc/${pname}-${version}"
    cp License "$doc/share/doc/${pname}-${version}/"
  '' + stdenv.lib.optionalString (pam != null) ''
--- a/pkgs/os-specific/linux/libcap/no-shared-lib.patch
+++ b/pkgs/os-specific/linux/libcap/no-shared-lib.patch
@ -0,0 +1,22 @@
+diff --git a/libcap/Makefile b/libcap/Makefile
+index de6a28d..7e4d8ac 100644
+--- a/libcap/Makefile
+++ b/libcap/Makefile
+@@ -22,7 +22,7 @@ MAJLIBNAME=$(LIBNAME).$(VERSION)
+ MINLIBNAME=$(MAJLIBNAME).$(MINOR)
+ GPERF_OUTPUT = _caps_output.gperf
+ 
+-all: $(MINLIBNAME) $(STACAPLIBNAME) pcs $(STAPSXLIBNAME)
+all: $(STACAPLIBNAME) pcs $(STAPSXLIBNAME)
+ 
+ pcs: libcap.pc libpsx.pc
+ 
+@@ -93,7 +93,7 @@ cap_test: cap_test.c libcap.h
+ test: cap_test
+ 	./cap_test
+ 
+-install: install-static install-shared
+install: install-static
+ 
+ install-static: install-static-cap install-static-psx
+ 
--- a/pkgs/os-specific/linux/procps-ng/default.nix
+++ b/pkgs/os-specific/linux/procps-ng/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ncurses, pkgconfig
+{ lib, stdenv, fetchurl, fetchpatch, ncurses, pkgconfig

 # `ps` with systemd support is able to properly report different
 # attributes like unit name, so we want to have it on linux.
@ -22,6 +22,14 @@ stdenv.mkDerivation rec {
    sha256 = "1br0g93ysqhlv13i1k4lfbimsgxnpy5rgs4lxfc9rkzdbpbaqplj";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://gitlab.com/procps-ng/procps/-/commit/bb96fc42956c9ed926a1b958ab715f8b4a663dec.diff";
+      sha256 = "0fzsb6ns3fvrszyzsz28qvbmcn135ilr4nwh2z1a0vlpl2fw961z";
+      name = "sysconf-argmax-sanity.patch";
+    })
+  ];
+
  buildInputs = [ ncurses ]
    ++ lib.optional withSystemd systemd;
  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
+++ b/pkgs/os-specific/linux/systemd/0001-Start-device-units-for-uninitialised-encrypted-devic.patch
@ -1,4 +1,4 @@
-From 46c8ccfeb61253cd3dff5f34013670c7e3366ef5 Mon Sep 17 00:00:00 2001
+From dd2ec741aaa7c587eb7719bbf4b305fe28168b77 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Tue, 8 Jan 2013 15:46:30 +0100
 Subject: [PATCH 01/18] Start device units for uninitialised encrypted devices
@ -13,7 +13,7 @@ unit.  (However, this ignores the fsck unit, so it's not perfect...)
 1 file changed, 4 deletions(-)

 diff --git a/rules.d/99-systemd.rules.in b/rules.d/99-systemd.rules.in
-index 1c60eec587..b2486da130 100644
+index d2f595d18e..941a7c1ba3 100644
 --- a/rules.d/99-systemd.rules.in
 +++ b/rules.d/99-systemd.rules.in
@@ -17,10 +17,6 @@ SUBSYSTEM=="ubi", TAG+="systemd"
@ -28,5 +28,5 @@ index 1c60eec587..b2486da130 100644
 SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}!="crypto_LUKS", SYMLINK+="gpt-auto-root"
 SUBSYSTEM=="block", ENV{ID_PART_GPT_AUTO_ROOT}=="1", ENV{ID_FS_TYPE}=="crypto_LUKS", SYMLINK+="gpt-auto-root-luks"
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
+++ b/pkgs/os-specific/linux/systemd/0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@ -1,4 +1,4 @@
-From 139c420de62e078182eaf48b541c4b912d445fd9 Mon Sep 17 00:00:00 2001
+From ab3dab997695db5346f8efbf8566ac96612f0c6e Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Fri, 12 Apr 2013 13:16:57 +0200
 Subject: [PATCH 02/18] Don't try to unmount /nix or /nix/store
@ -12,7 +12,7 @@ https://github.com/NixOS/nixos/issues/126
 2 files changed, 4 insertions(+)

 diff --git a/src/shared/fstab-util.c b/src/shared/fstab-util.c
-index 806dda8475..0220741c91 100644
+index 292b97cd69..791b8e6b7e 100644
 --- a/src/shared/fstab-util.c
 +++ b/src/shared/fstab-util.c
@@ -40,6 +40,8 @@ bool fstab_is_extrinsic(const char *mount, const char *opts) {
@ -25,10 +25,10 @@ index 806dda8475..0220741c91 100644
                         "/etc"))
                 return true;
 diff --git a/src/shutdown/umount.c b/src/shutdown/umount.c
-index 8a5e80eeaa..fab35ed6f3 100644
+index 3a72a13e1a..541320dc9d 100644
 --- a/src/shutdown/umount.c
 +++ b/src/shutdown/umount.c
-@@ -414,6 +414,8 @@ static int delete_dm(dev_t devnum) {
+@@ -500,6 +500,8 @@ static int delete_md(MountPoint *m) {
 
 static bool nonunmountable_path(const char *path) {
         return path_equal(path, "/")
@ -38,5 +38,5 @@ index 8a5e80eeaa..fab35ed6f3 100644
                 || path_equal(path, "/usr")
 #endif
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
+++ b/pkgs/os-specific/linux/systemd/0003-Fix-NixOS-containers.patch
@ -1,4 +1,4 @@
-From a889dbe796cd72425f38dec3d2aaab44a914ac60 Mon Sep 17 00:00:00 2001
+From 3581f8f30270e6340c671a640fe551e954715f8e Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Wed, 16 Apr 2014 10:59:28 +0200
 Subject: [PATCH 03/18] Fix NixOS containers
@ -10,10 +10,10 @@ container, so checking early whether it exists will fail.
 1 file changed, 2 insertions(+)

 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 43712565c2..07f294c78a 100644
+index 0842731c18..f790853104 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -5122,6 +5122,7 @@ static int run(int argc, char *argv[]) {
+@@ -5319,6 +5319,7 @@ static int run(int argc, char *argv[]) {
                                 goto finish;
                         }
                 } else {
@ -21,7 +21,7 @@ index 43712565c2..07f294c78a 100644
                         const char *p, *q;
 
                         if (arg_pivot_root_new)
-@@ -5136,6 +5137,7 @@ static int run(int argc, char *argv[]) {
+@@ -5333,6 +5334,7 @@ static int run(int argc, char *argv[]) {
                                 r = -EINVAL;
                                 goto finish;
                         }
@ -30,5 +30,5 @@ index 43712565c2..07f294c78a 100644
 
         } else {
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
+++ b/pkgs/os-specific/linux/systemd/0004-Look-for-fsck-in-the-right-place.patch
@ -1,4 +1,4 @@
-From 5098b1aad07356e04fcd12f2c77ea4fd17460411 Mon Sep 17 00:00:00 2001
+From 12b63d8c1d2ca85d9bb7ea07e8eb5e623e1b58e9 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Thu, 1 May 2014 14:10:10 +0200
 Subject: [PATCH 04/18] Look for fsck in the right place
@ -8,10 +8,10 @@ Subject: [PATCH 04/18] Look for fsck in the right place
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/src/fsck/fsck.c b/src/fsck/fsck.c
-index 80f7107b9d..74e48a385f 100644
+index 04752fe9dc..ad0ccf91c0 100644
 --- a/src/fsck/fsck.c
 +++ b/src/fsck/fsck.c
-@@ -370,7 +370,7 @@ static int run(int argc, char *argv[]) {
+@@ -369,7 +369,7 @@ static int run(int argc, char *argv[]) {
                 } else
                         dash_c[0] = 0;
 
@ -21,5 +21,5 @@ index 80f7107b9d..74e48a385f 100644
                 cmdline[i++] = "-T";
 
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
+++ b/pkgs/os-specific/linux/systemd/0005-Add-some-NixOS-specific-unit-directories.patch
@ -1,4 +1,4 @@
-From b46f1b20e990f01af4bdf3dd6fef45f5b4a5993e Mon Sep 17 00:00:00 2001
+From 6ede8baac88aba769030f5bc5f5b2070098c7428 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Fri, 19 Dec 2014 14:46:17 +0100
 Subject: [PATCH 05/18] Add some NixOS-specific unit directories
@ -15,7 +15,7 @@ Also, remove /usr and /lib as these don't exist on NixOS.
 2 files changed, 8 insertions(+), 17 deletions(-)

 diff --git a/src/basic/path-lookup.c b/src/basic/path-lookup.c
-index 52968dee34..bba2eb09b8 100644
+index 96b82170d0..b9fbed5c61 100644
 --- a/src/basic/path-lookup.c
 +++ b/src/basic/path-lookup.c
@@ -94,17 +94,14 @@ int xdg_user_data_dir(char **ret, const char *suffix) {
@ -102,7 +102,7 @@ index 52968dee34..bba2eb09b8 100644
 
                 if (!add)
 diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
-index 8424837824..b1c541bc52 100644
+index f2c045511d..ccb382e421 100644
 --- a/src/core/systemd.pc.in
 +++ b/src/core/systemd.pc.in
@@ -38,10 +38,11 @@ systemdsystemconfdir=${systemd_system_conf_dir}
@ -120,5 +120,5 @@ index 8424837824..b1c541bc52 100644
 
 systemd_system_generator_dir=${root_prefix}/lib/systemd/system-generators
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
+++ b/pkgs/os-specific/linux/systemd/0006-Get-rid-of-a-useless-message-in-user-sessions.patch
@ -1,4 +1,4 @@
-From 4c9f9d192182f1051dba1c547e182e7c8f549b0f Mon Sep 17 00:00:00 2001
+From 3aeb3a10c4a7ad387b004bf41efbd171913bcca9 Mon Sep 17 00:00:00 2001
 From: Eelco Dolstra <eelco.dolstra@logicblox.com>
 Date: Mon, 11 May 2015 15:39:38 +0200
 Subject: [PATCH 06/18] Get rid of a useless message in user sessions
@ -13,10 +13,10 @@ in containers.
 1 file changed, 2 insertions(+), 1 deletion(-)

 diff --git a/src/core/unit.c b/src/core/unit.c
-index 1bda568560..5b44970763 100644
+index 45a417a090..8af3cb08d6 100644
 --- a/src/core/unit.c
 +++ b/src/core/unit.c
-@@ -2150,7 +2150,8 @@ static void unit_check_binds_to(Unit *u) {
+@@ -2163,7 +2163,8 @@ static void unit_check_binds_to(Unit *u) {
         }
 
         assert(other);
@ -27,5 +27,5 @@ index 1bda568560..5b44970763 100644
         /* A unit we need to run is gone. Sniff. Let's stop this. */
         r = manager_add_job(u->manager, JOB_STOP, u, JOB_FAIL, NULL, &error, NULL);
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
+++ b/pkgs/os-specific/linux/systemd/0007-hostnamed-localed-timedated-disable-methods-that-cha.patch
@ -1,4 +1,4 @@
-From 539f3af04963a6826d2b2d0ba2095af99a7a6294 Mon Sep 17 00:00:00 2001
+From a1454e8edb7a1a87093808dc7db540232147df3d Mon Sep 17 00:00:00 2001
 From: Gabriel Ebner <gebner@gebner.org>
 Date: Sun, 6 Dec 2015 14:26:36 +0100
 Subject: [PATCH 07/18] hostnamed, localed, timedated: disable methods that
@ -11,10 +11,10 @@ Subject: [PATCH 07/18] hostnamed, localed, timedated: disable methods that
 3 files changed, 25 insertions(+)

 diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
-index 7f6607a527..b5a9388916 100644
+index a1794bdab1..77134731e1 100644
 --- a/src/hostname/hostnamed.c
 +++ b/src/hostname/hostnamed.c
-@@ -626,6 +626,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
+@@ -643,6 +643,9 @@ static int method_set_static_hostname(sd_bus_message *m, void *userdata, sd_bus_
         if (r < 0)
                 return r;
 
@ -24,7 +24,7 @@ index 7f6607a527..b5a9388916 100644
         name = empty_to_null(name);
 
         context_read_etc_hostname(c);
-@@ -685,6 +688,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
+@@ -702,6 +705,9 @@ static int set_machine_info(Context *c, sd_bus_message *m, int prop, sd_bus_mess
         if (r < 0)
                 return r;
 
@ -35,7 +35,7 @@ index 7f6607a527..b5a9388916 100644
 
         context_read_machine_info(c);
 diff --git a/src/locale/localed.c b/src/locale/localed.c
-index 715ce5cac7..014f7dcf6c 100644
+index 736dacdee9..53e0ee935e 100644
 --- a/src/locale/localed.c
 +++ b/src/locale/localed.c
@@ -317,6 +317,9 @@ static int method_set_locale(sd_bus_message *m, void *userdata, sd_bus_error *er
@ -69,7 +69,7 @@ index 715ce5cac7..014f7dcf6c 100644
         model = empty_to_null(model);
         variant = empty_to_null(variant);
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index c467b85477..3e78b2f575 100644
+index 8bfcfd5cdc..a0ee03f134 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
@@ -646,6 +646,10 @@ static int method_set_timezone(sd_bus_message *m, void *userdata, sd_bus_error *
@ -93,7 +93,7 @@ index c467b85477..3e78b2f575 100644
         if (lrtc == c->local_rtc)
                 return sd_bus_reply_method_return(m, NULL);
 
-@@ -917,6 +924,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
+@@ -905,6 +912,9 @@ static int method_set_ntp(sd_bus_message *m, void *userdata, sd_bus_error *error
         if (r < 0)
                 return r;
 
@ -104,5 +104,5 @@ index c467b85477..3e78b2f575 100644
         if (r < 0)
                 return r;
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0008-Fix-hwdb-paths.patch
@ -1,4 +1,4 @@
-From 5c2a1a6d33f7cdbcb8ddcc70b91ba4c7f3c383b3 Mon Sep 17 00:00:00 2001
+From 27680c555713e36d16198fc5f60b0f85e0777d30 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 7 Jul 2016 02:47:13 +0300
 Subject: [PATCH 08/18] Fix hwdb paths
@ -9,7 +9,7 @@ Patch by vcunat.
 1 file changed, 1 insertion(+), 6 deletions(-)

 diff --git a/src/libsystemd/sd-hwdb/sd-hwdb.c b/src/libsystemd/sd-hwdb/sd-hwdb.c
-index b3febdbb31..eba00a5bc7 100644
+index cb3c77ce96..7b8c80071f 100644
 --- a/src/libsystemd/sd-hwdb/sd-hwdb.c
 +++ b/src/libsystemd/sd-hwdb/sd-hwdb.c
@@ -297,13 +297,8 @@ static int trie_search_f(sd_hwdb *hwdb, const char *search) {
@ -28,5 +28,5 @@ index b3febdbb31..eba00a5bc7 100644
 _public_ int sd_hwdb_new(sd_hwdb **ret) {
         _cleanup_(sd_hwdb_unrefp) sd_hwdb *hwdb = NULL;
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
+++ b/pkgs/os-specific/linux/systemd/0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
@ -1,4 +1,4 @@
-From a8ccba372d865429b578e72fd104a693b96101b3 Mon Sep 17 00:00:00 2001
+From b423ce2560bd380abd80796a890454d95cd8926c Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Tue, 11 Oct 2016 13:12:08 +0300
 Subject: [PATCH 09/18] Change /usr/share/zoneinfo to /etc/zoneinfo
@ -13,7 +13,7 @@ NixOS uses this path.
 5 files changed, 12 insertions(+), 12 deletions(-)

 diff --git a/man/localtime.xml b/man/localtime.xml
-index 0f1652ee2e..71c4f95c2e 100644
+index 73c1b8e5a3..4ab4276283 100644
 --- a/man/localtime.xml
 +++ b/man/localtime.xml
@@ -20,7 +20,7 @@
@ -35,10 +35,10 @@ index 0f1652ee2e..71c4f95c2e 100644
     <literal>Etc/UTC</literal>. The resulting link should lead to the
     corresponding binary
 diff --git a/src/basic/time-util.c b/src/basic/time-util.c
-index 15cc1b8851..d0abde5933 100644
+index 5318d6378d..04069dc27b 100644
 --- a/src/basic/time-util.c
 +++ b/src/basic/time-util.c
-@@ -1259,7 +1259,7 @@ int get_timezones(char ***ret) {
+@@ -1277,7 +1277,7 @@ int get_timezones(char ***ret) {
         n_allocated = 2;
         n_zones = 1;
 
@ -47,7 +47,7 @@ index 15cc1b8851..d0abde5933 100644
         if (f) {
                 for (;;) {
                         _cleanup_free_ char *line = NULL;
-@@ -1354,7 +1354,7 @@ bool timezone_is_valid(const char *name, int log_level) {
+@@ -1372,7 +1372,7 @@ bool timezone_is_valid(const char *name, int log_level) {
         if (p - name >= PATH_MAX)
                 return false;
 
@ -56,7 +56,7 @@ index 15cc1b8851..d0abde5933 100644
 
         fd = open(t, O_RDONLY|O_CLOEXEC);
         if (fd < 0) {
-@@ -1452,7 +1452,7 @@ int get_timezone(char **ret) {
+@@ -1470,7 +1470,7 @@ int get_timezone(char **ret) {
         if (r < 0)
                 return r; /* returns EINVAL if not a symlink */
 
@ -66,10 +66,10 @@ index 15cc1b8851..d0abde5933 100644
                 return -EINVAL;
 
 diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
-index c9fc8dd5cd..44fc04dc88 100644
+index 742b43f9fc..f2cb121816 100644
 --- a/src/firstboot/firstboot.c
 +++ b/src/firstboot/firstboot.c
-@@ -460,7 +460,7 @@ static int process_timezone(void) {
+@@ -459,7 +459,7 @@ static int process_timezone(void) {
         if (isempty(arg_timezone))
                 return 0;
 
@ -79,10 +79,10 @@ index c9fc8dd5cd..44fc04dc88 100644
         (void) mkdir_parents(etc_localtime, 0755);
         if (symlink(e, etc_localtime) < 0)
 diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
-index 07f294c78a..cf86d1f494 100644
+index f790853104..74b51f4d28 100644
 --- a/src/nspawn/nspawn.c
 +++ b/src/nspawn/nspawn.c
-@@ -1699,8 +1699,8 @@ static int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t u
+@@ -1810,8 +1810,8 @@ static int userns_mkdir(const char *root, const char *path, mode_t mode, uid_t u
 static const char *timezone_from_path(const char *path) {
         return PATH_STARTSWITH_SET(
                         path,
@ -94,7 +94,7 @@ index 07f294c78a..cf86d1f494 100644
 
 static bool etc_writable(void) {
 diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
-index 3e78b2f575..de5477a08f 100644
+index a0ee03f134..9ecacad25e 100644
 --- a/src/timedate/timedated.c
 +++ b/src/timedate/timedated.c
@@ -269,7 +269,7 @@ static int context_read_data(Context *c) {
@ -128,5 +128,5 @@ index 3e78b2f575..de5477a08f 100644
                         return -ENOMEM;
 
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
+++ b/pkgs/os-specific/linux/systemd/0010-localectl-use-etc-X11-xkb-for-list-x11.patch
@ -1,4 +1,4 @@
-From 84a2d35d4e75295edf7e190a94dfaf65db4973b6 Mon Sep 17 00:00:00 2001
+From aff592e0bf9a911e7f44ce07b66517c38456b627 Mon Sep 17 00:00:00 2001
 From: Imuli <i@imu.li>
 Date: Wed, 19 Oct 2016 08:46:47 -0400
 Subject: [PATCH 10/18] localectl: use /etc/X11/xkb for list-x11-*
@ -10,7 +10,7 @@ NixOS has an option to link the xkb data files to /etc/X11, but not to
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/src/locale/localectl.c b/src/locale/localectl.c
-index e0664de826..c521f33a2a 100644
+index 7d2e887660..91c5139eed 100644
 --- a/src/locale/localectl.c
 +++ b/src/locale/localectl.c
@@ -277,7 +277,7 @@ static int list_x11_keymaps(int argc, char **argv, void *userdata) {
@ -23,5 +23,5 @@ index e0664de826..c521f33a2a 100644
                 return log_error_errno(errno, "Failed to open keyboard mapping list. %m");
 
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
+++ b/pkgs/os-specific/linux/systemd/0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
@ -1,4 +1,4 @@
-From 81ee9b5cd46f78de139c39e2a18f39e658c60169 Mon Sep 17 00:00:00 2001
+From d410a7a6d1bb0fe730c3ef690676232bfaa49f85 Mon Sep 17 00:00:00 2001
 From: Franz Pletz <fpletz@fnordicwalking.de>
 Date: Sun, 11 Feb 2018 04:37:44 +0100
 Subject: [PATCH 11/18] build: don't create statedir and don't touch prefixdir
@ -8,10 +8,10 @@ Subject: [PATCH 11/18] build: don't create statedir and don't touch prefixdir
 1 file changed, 3 deletions(-)

 diff --git a/meson.build b/meson.build
-index ba9e7afe53..2ef9d4d770 100644
+index f406d595e6..f05f579816 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -3371,9 +3371,6 @@ install_data('LICENSE.GPL2',
+@@ -3517,9 +3517,6 @@ install_data('LICENSE.GPL2',
              'src/libsystemd/sd-bus/GVARIANT-SERIALIZATION',
              install_dir : docdir)
 
@ -22,5 +22,5 @@ index ba9e7afe53..2ef9d4d770 100644
 
 check_help = find_program('tools/check-help.sh')
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0012-Install-default-configuration-into-out-share-factory.patch
+++ b/pkgs/os-specific/linux/systemd/0012-Install-default-configuration-into-out-share-factory.patch
@ -1,326 +0,0 @@
-From 7dbe84b7c43669dccd90db8ac33c38a70e6b6914 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
-Date: Mon, 26 Feb 2018 14:25:57 +0000
-Subject: [PATCH 12/18] Install default configuration into $out/share/factory
-
-By default systemd should read all its configuration from /etc. Therefor
-we rely on -Dsysconfdir=/etc in meson as default value. Unfortunately
-this would also lead to installation of systemd's own configuration
-files to `/etc` whereas we are limited to /nix/store. To counter that
-this commit introduces two new configuration variables `factoryconfdir`
-and `factorypkgconfdir` to install systemd's own configuration into nix
-store again, while having executables looking up files in /etc.
---
- hwdb.d/meson.build             |  2 +-
- meson.build                    | 11 +++++++----
- network/meson.build            |  2 +-
- src/core/meson.build           | 10 +++++-----
- src/coredump/meson.build       |  2 +-
- src/home/meson.build           |  2 +-
- src/journal-remote/meson.build |  4 ++--
- src/journal/meson.build        |  2 +-
- src/kernel-install/meson.build |  2 +-
- src/login/meson.build          |  2 +-
- src/network/meson.build        |  2 +-
- src/pstore/meson.build         |  2 +-
- src/resolve/meson.build        |  2 +-
- src/timesync/meson.build       |  2 +-
- src/udev/meson.build           |  4 ++--
- sysctl.d/meson.build           |  2 +-
- tmpfiles.d/meson.build         |  2 +-
- units/meson.build              |  2 +-
- 18 files changed, 30 insertions(+), 27 deletions(-)
-
-diff --git a/hwdb.d/meson.build b/hwdb.d/meson.build
-index 5c77387a26..6404bc01ba 100644
--- a/hwdb.d/meson.build
-+++ b/hwdb.d/meson.build
-@@ -43,7 +43,7 @@ if conf.get('ENABLE_HWDB') == 1
-                      install_dir : udevhwdbdir)
- 
-         meson.add_install_script('sh', '-c',
-                                 mkdir_p.format(join_paths(sysconfdir, 'udev/hwdb.d')))
-+                                 mkdir_p.format(join_paths(factoryconfdir, 'udev/hwdb.d')))
- 
-         meson.add_install_script('sh', '-c',
-                                  'test -n "$DESTDIR" || @0@/systemd-hwdb update'
-diff --git a/meson.build b/meson.build
-index 2ef9d4d770..ae7acbd769 100644
--- a/meson.build
-+++ b/meson.build
-@@ -163,6 +163,9 @@ udevhwdbdir = join_paths(udevlibexecdir, 'hwdb.d')
- catalogdir = join_paths(prefixdir, 'lib/systemd/catalog')
- kernelinstalldir = join_paths(prefixdir, 'lib/kernel/install.d')
- factorydir = join_paths(datadir, 'factory')
-+factoryconfdir = join_paths(datadir, 'factory/etc')
-+factorypkgconfdir = join_paths(datadir, 'factory/etc/systemd')
-+factoryxinitrcdir = join_paths(datadir, 'factory/etc/X11/xinit/xinitrc.d')
- bootlibdir = join_paths(prefixdir, 'lib/systemd/boot/efi')
- testsdir = join_paths(prefixdir, 'lib/systemd/tests')
- systemdstatedir = join_paths(localstatedir, 'lib/systemd')
-@@ -2653,7 +2656,7 @@ if conf.get('ENABLE_BINFMT') == 1
-         meson.add_install_script('sh', '-c',
-                                  mkdir_p.format(binfmtdir))
-         meson.add_install_script('sh', '-c',
-                                 mkdir_p.format(join_paths(sysconfdir, 'binfmt.d')))
-+                                 mkdir_p.format(join_paths(factoryconfdir, 'binfmt.d')))
- endif
- 
- if conf.get('ENABLE_REPART') == 1
-@@ -2769,7 +2772,7 @@ executable(
-         install_dir : rootlibexecdir)
- 
- install_data('src/sleep/sleep.conf',
-             install_dir : pkgsysconfdir)
-+             install_dir : factorypkgconfdir)
- 
- public_programs += executable(
-         'systemd-sysctl',
-@@ -3103,7 +3106,7 @@ if conf.get('HAVE_KMOD') == 1
-         meson.add_install_script('sh', '-c',
-                                  mkdir_p.format(modulesloaddir))
-         meson.add_install_script('sh', '-c',
-                                 mkdir_p.format(join_paths(sysconfdir, 'modules-load.d')))
-+                                 mkdir_p.format(join_paths(factoryconfdir, 'modules-load.d')))
- endif
- 
- public_programs += executable(
-@@ -3354,7 +3357,7 @@ install_subdir('factory/etc',
-                install_dir : factorydir)
- 
- install_data('xorg/50-systemd-user.sh',
-             install_dir : xinitrcdir)
-+             install_dir : factoryxinitrcdir)
- install_data('modprobe.d/systemd.conf',
-              install_dir : modprobedir)
- install_data('LICENSE.GPL2',
-diff --git a/network/meson.build b/network/meson.build
-index 99a650eac3..8105a4e48d 100644
--- a/network/meson.build
-+++ b/network/meson.build
-@@ -11,7 +11,7 @@ if conf.get('ENABLE_NETWORKD') == 1
-                      install_dir : networkdir)
- 
-         meson.add_install_script('sh', '-c',
-                                 mkdir_p.format(join_paths(sysconfdir, 'systemd/network')))
-+                                 mkdir_p.format(join_paths(factoryconfdir, 'systemd/network')))
- endif
- 
- install_data('99-default.link',
-diff --git a/src/core/meson.build b/src/core/meson.build
-index fa95108523..60ee0e31c1 100644
--- a/src/core/meson.build
-+++ b/src/core/meson.build
-@@ -183,8 +183,8 @@ libcore = static_library(
- systemd_sources = files('main.c')
- 
- in_files = [['macros.systemd',   rpmmacrosdir],
-            ['system.conf',      pkgsysconfdir],
-            ['user.conf',        pkgsysconfdir],
-+            ['system.conf',      factorypkgconfdir],
-+            ['user.conf',        factorypkgconfdir],
-             ['systemd.pc',       pkgconfigdatadir],
-             ['triggers.systemd', '']]
- 
-@@ -216,6 +216,6 @@ meson.add_install_script('sh', '-c', mkdir_p.format(systemsleepdir))
- meson.add_install_script('sh', '-c', mkdir_p.format(systemgeneratordir))
- meson.add_install_script('sh', '-c', mkdir_p.format(usergeneratordir))
- 
-meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(pkgsysconfdir, 'system')))
-meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(pkgsysconfdir, 'user')))
-meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(sysconfdir, 'xdg/systemd')))
-+meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(factorypkgconfdir, 'system')))
-+meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(factorypkgconfdir, 'user')))
-+meson.add_install_script('sh', '-c', mkdir_p.format(join_paths(factorypkgconfdir, 'xdg/systemd')))
-diff --git a/src/coredump/meson.build b/src/coredump/meson.build
-index 7fa5942697..34c865dfa0 100644
--- a/src/coredump/meson.build
-+++ b/src/coredump/meson.build
-@@ -15,7 +15,7 @@ coredumpctl_sources = files('coredumpctl.c')
- 
- if conf.get('ENABLE_COREDUMP') == 1
-         install_data('coredump.conf',
-                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- endif
- 
- tests += [
-diff --git a/src/home/meson.build b/src/home/meson.build
-index 797f3a3c6d..232904ab42 100644
--- a/src/home/meson.build
-+++ b/src/home/meson.build
-@@ -98,5 +98,5 @@ if conf.get('ENABLE_HOMED') == 1
-                      install_dir : polkitpolicydir)
-
-         install_data('homed.conf',
-                     install_dir : pkgsysconfdir)
-+                     install_dir : factoryconfdir)
- endif
-diff --git a/src/journal-remote/meson.build b/src/journal-remote/meson.build
-index 87b8ba6495..daff8ec967 100644
--- a/src/journal-remote/meson.build
-+++ b/src/journal-remote/meson.build
-@@ -49,7 +49,7 @@ if conf.get('ENABLE_REMOTE') ==1 and conf.get('HAVE_LIBCURL') == 1
-                 output : 'journal-upload.conf',
-                 configuration : substs)
-         install_data(journal_upload_conf,
-                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- endif
- 
- if conf.get('ENABLE_REMOTE') == 1 and conf.get('HAVE_MICROHTTPD') == 1
-@@ -58,7 +58,7 @@ if conf.get('ENABLE_REMOTE') == 1 and conf.get('HAVE_MICROHTTPD') == 1
-                 output : 'journal-remote.conf',
-                 configuration : substs)
-         install_data(journal_remote_conf,
-                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- 
-         install_data('browse.html',
-                      install_dir : join_paths(pkgdatadir, 'gatewayd'))
-diff --git a/src/journal/meson.build b/src/journal/meson.build
-index 5796f77cac..75d975c260 100644
--- a/src/journal/meson.build
-+++ b/src/journal/meson.build
-@@ -109,7 +109,7 @@ if conf.get('HAVE_QRENCODE') == 1
- endif
- 
- install_data('journald.conf',
-             install_dir : pkgsysconfdir)
-+             install_dir : factorypkgconfdir)
- 
- if get_option('create-log-dirs')
-         meson.add_install_script(
-diff --git a/src/kernel-install/meson.build b/src/kernel-install/meson.build
-index 9ae342dfba..65df666337 100644
--- a/src/kernel-install/meson.build
-+++ b/src/kernel-install/meson.build
-@@ -14,5 +14,5 @@ if want_kernel_install
- 		install_dir : kernelinstalldir)
- 
- 	meson.add_install_script('sh', '-c',
-				mkdir_p.format(join_paths(sysconfdir, 'kernel/install.d')))
-+				mkdir_p.format(join_paths(factoryconfdir, 'kernel/install.d')))
- endif
-diff --git a/src/login/meson.build b/src/login/meson.build
-index 0a7d3d5440..ff90149c1c 100644
--- a/src/login/meson.build
-+++ b/src/login/meson.build
-@@ -75,7 +75,7 @@ if conf.get('ENABLE_LOGIND') == 1
-                 output : 'logind.conf',
-                 configuration : substs)
-         install_data(logind_conf,
-                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- 
-         install_data('org.freedesktop.login1.conf',
-                      install_dir : dbuspolicydir)
-diff --git a/src/network/meson.build b/src/network/meson.build
-index b3a88d9910..be56d1e9d7 100644
--- a/src/network/meson.build
-+++ b/src/network/meson.build
-@@ -229,7 +229,7 @@ if conf.get('ENABLE_NETWORKD') == 1
-         endif
- 
-         install_data('networkd.conf',
-                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- 
-         fuzzers += [
-     [['src/network/fuzz-netdev-parser.c',
-diff --git a/src/pstore/meson.build b/src/pstore/meson.build
-index adbac24b54..e9dc88dfa2 100644
--- a/src/pstore/meson.build
-+++ b/src/pstore/meson.build
-@@ -6,5 +6,5 @@ systemd_pstore_sources = files('''
- 
- if conf.get('ENABLE_PSTORE') == 1
-         install_data('pstore.conf',
-                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- endif
-diff --git a/src/resolve/meson.build b/src/resolve/meson.build
-index 92b67b6333..ac5b9a0b0a 100644
--- a/src/resolve/meson.build
-+++ b/src/resolve/meson.build
-@@ -168,7 +168,7 @@ if conf.get('ENABLE_RESOLVE') == 1
-                 output : 'resolved.conf',
-                 configuration : substs)
-         install_data(resolved_conf,
-                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
- 
-         install_data('resolv.conf',
-                      install_dir : rootlibexecdir)
-diff --git a/src/timesync/meson.build b/src/timesync/meson.build
-index e5c118c8db..19235df9ca 100644
--- a/src/timesync/meson.build
-+++ b/src/timesync/meson.build
-@@ -27,7 +27,7 @@ if conf.get('ENABLE_TIMESYNCD') == 1
-                 output : 'timesyncd.conf',
-                 configuration : substs)
-         install_data(timesyncd_conf,
-                     install_dir : pkgsysconfdir)
-+                     install_dir : factorypkgconfdir)
-         install_data('org.freedesktop.timesync1.conf',
-                      install_dir : dbuspolicydir)
-         install_data('org.freedesktop.timesync1.service',
-diff --git a/src/udev/meson.build b/src/udev/meson.build
-index aa23b07090..ad004d803a 100644
--- a/src/udev/meson.build
-+++ b/src/udev/meson.build
-@@ -186,7 +186,7 @@ foreach prog : [['ata_id/ata_id.c'],
- endforeach
- 
- install_data('udev.conf',
-             install_dir : join_paths(sysconfdir, 'udev'))
-+             install_dir : join_paths(factoryconfdir, 'udev'))
- 
- configure_file(
-         input : 'udev.pc.in',
-@@ -195,7 +195,7 @@ configure_file(
-         install_dir : pkgconfigdatadir == 'no' ? '' : pkgconfigdatadir)
- 
- meson.add_install_script('sh', '-c',
-                         mkdir_p.format(join_paths(sysconfdir, 'udev/rules.d')))
-+                         mkdir_p.format(join_paths(factoryconfdir, 'udev/rules.d')))
- 
- fuzzers += [
-         [['src/udev/net/fuzz-link-parser.c',
-diff --git a/sysctl.d/meson.build b/sysctl.d/meson.build
-index 3f072e3db7..bd9f843eba 100644
--- a/sysctl.d/meson.build
-+++ b/sysctl.d/meson.build
-@@ -27,4 +27,4 @@ foreach file : in_files
- endforeach
- 
- meson.add_install_script('sh', '-c',
-                         mkdir_p.format(join_paths(sysconfdir, 'sysctl.d')))
-+                         mkdir_p.format(join_paths(factoryconfdir, 'sysctl.d')))
-diff --git a/tmpfiles.d/meson.build b/tmpfiles.d/meson.build
-index 0a9582d8b9..3c56ca7d83 100644
--- a/tmpfiles.d/meson.build
-+++ b/tmpfiles.d/meson.build
-@@ -58,5 +58,5 @@ endforeach
- if enable_tmpfiles
-         meson.add_install_script(
-                 'sh', '-c',
-                mkdir_p.format(join_paths(sysconfdir, 'tmpfiles.d')))
-+                mkdir_p.format(join_paths(factoryconfdir, 'tmpfiles.d')))
- endif
-diff --git a/units/meson.build b/units/meson.build
-index 275daad3f4..491abd8eef 100644
--- a/units/meson.build
-+++ b/units/meson.build
-@@ -324,7 +324,7 @@ install_data('user-.slice.d/10-defaults.conf',
- 
- meson.add_install_script(meson_make_symlink,
-                          join_paths(pkgsysconfdir, 'user'),
-                         join_paths(sysconfdir, 'xdg/systemd/user'))
-+                         join_paths(factorypkgconfdir, 'xdg/systemd/user'))
- meson.add_install_script(meson_make_symlink,
-                          join_paths(dbussystemservicedir, 'org.freedesktop.systemd1.service'),
-                          join_paths(dbussessionservicedir, 'org.freedesktop.systemd1.service'))
-- 
-2.28.0
-
--- a/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch
+++ b/pkgs/os-specific/linux/systemd/0012-inherit-systemd-environment-when-calling-generators.patch
@ -1,7 +1,7 @@
-From 4cbc82570aa8671d260c37df58688cc07106e4b6 Mon Sep 17 00:00:00 2001
+From a569dc0bdb43edb79e338c897f06de2dfa81cfc7 Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <andreas@rammhold.de>
 Date: Fri, 2 Nov 2018 21:15:42 +0100
-Subject: [PATCH 13/18] inherit systemd environment when calling generators.
+Subject: [PATCH 12/18] inherit systemd environment when calling generators.

 Systemd generators need access to the environment configured in
 stage-2-init.sh since it schedules fsck and mkfs executions based on
@ -16,10 +16,10 @@ executables that are being called from managers.
 1 file changed, 8 insertions(+), 3 deletions(-)

 diff --git a/src/core/manager.c b/src/core/manager.c
-index 6b7908fc6c..dff265c76f 100644
+index 1f1450b97c..26b9e41d78 100644
 --- a/src/core/manager.c
 +++ b/src/core/manager.c
-@@ -4098,9 +4098,14 @@ static int manager_run_generators(Manager *m) {
+@@ -4111,9 +4111,14 @@ static int manager_run_generators(Manager *m) {
         argv[4] = NULL;
 
         RUN_WITH_UMASK(0022)
@ -38,5 +38,5 @@ index 6b7908fc6c..dff265c76f 100644
 
 finish:
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch
+++ b/pkgs/os-specific/linux/systemd/0013-add-rootprefix-to-lookup-dir-paths.patch
@ -1,7 +1,7 @@
-From 1f39dba787e07d0a6944416ec172ee5d7cc86acd Mon Sep 17 00:00:00 2001
+From d36d688e32b8f2368499af091c67a7825fadf5ad Mon Sep 17 00:00:00 2001
 From: Andreas Rammhold <andreas@rammhold.de>
 Date: Thu, 9 May 2019 11:15:22 +0200
-Subject: [PATCH 14/18] add rootprefix to lookup dir paths
+Subject: [PATCH 13/18] add rootprefix to lookup dir paths

 systemd does not longer use the UDEVLIBEXEC directory as root for
 discovery default udev rules. By adding `$out/lib` to the lookup paths
@ -12,7 +12,7 @@ files that I might have missed.
 1 file changed, 4 insertions(+), 2 deletions(-)

 diff --git a/src/basic/def.h b/src/basic/def.h
-index 970654a1ad..bb261040f8 100644
+index 2e60abb4f1..732ec51d36 100644
 --- a/src/basic/def.h
 +++ b/src/basic/def.h
@@ -39,13 +39,15 @@
@ -34,5 +34,5 @@ index 970654a1ad..bb261040f8 100644
 #define CONF_PATHS(n)                           \
         CONF_PATHS_USR(n)                       \
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+++ b/pkgs/os-specific/linux/systemd/0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
@ -1,7 +1,7 @@
-From f7c462d37063b0077345395f54377c39d1ef0590 Mon Sep 17 00:00:00 2001
+From c02b7eb62e46145ec5b544ebd9338c29b9b8f32c Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 25 Jul 2019 20:45:55 +0300
-Subject: [PATCH 15/18] systemd-shutdown: execute scripts in
+Subject: [PATCH 14/18] systemd-shutdown: execute scripts in
 /etc/systemd/system-shutdown

 This is needed for NixOS to use such scripts as systemd directory is immutable.
@ -10,7 +10,7 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/src/shutdown/shutdown.c b/src/shutdown/shutdown.c
-index 06c9710c6e..dadcc3117d 100644
+index 0d07865542..26d974ef73 100644
 --- a/src/shutdown/shutdown.c
 +++ b/src/shutdown/shutdown.c
@@ -312,7 +312,7 @@ int main(int argc, char *argv[]) {
@ -23,5 +23,5 @@ index 06c9710c6e..dadcc3117d 100644
         /* The log target defaults to console, but the original systemd process will pass its log target in through a
          * command line argument, which will override this default. Also, ensure we'll never log to the journal or
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+++ b/pkgs/os-specific/linux/systemd/0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
@ -1,7 +1,7 @@
-From ff7cfe2d112eb166cd1937c3cc8c25491e508313 Mon Sep 17 00:00:00 2001
+From f01b73709d68d4581ad561fbb20c59f895132a99 Mon Sep 17 00:00:00 2001
 From: Nikolay Amiantov <ab@fmap.me>
 Date: Thu, 25 Jul 2019 20:46:58 +0300
-Subject: [PATCH 16/18] systemd-sleep: execute scripts in
+Subject: [PATCH 15/18] systemd-sleep: execute scripts in
 /etc/systemd/system-sleep

 This is needed for NixOS to use such scripts as systemd directory is immutable.
@ -10,10 +10,10 @@ This is needed for NixOS to use such scripts as systemd directory is immutable.
 1 file changed, 1 insertion(+)

 diff --git a/src/sleep/sleep.c b/src/sleep/sleep.c
-index 600e9c23c0..66ef1a99e1 100644
+index 39ab554290..880ac7ccb0 100644
 --- a/src/sleep/sleep.c
 +++ b/src/sleep/sleep.c
-@@ -182,6 +182,7 @@ static int execute(char **modes, char **states) {
+@@ -178,6 +178,7 @@ static int execute(char **modes, char **states) {
         };
         static const char* const dirs[] = {
                 SYSTEM_SLEEP_PATH,
@ -22,5 +22,5 @@ index 600e9c23c0..66ef1a99e1 100644
         };
 
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
+++ b/pkgs/os-specific/linux/systemd/0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
@ -1,7 +1,7 @@
-From 600ac2dd3fc15c5717fcdf8f37899fdabf97268c Mon Sep 17 00:00:00 2001
+From 3db343c08a09a0009da049f37e3f981519eac62f Mon Sep 17 00:00:00 2001
 From: Florian Klink <flokli@flokli.de>
 Date: Sat, 7 Mar 2020 22:40:27 +0100
-Subject: [PATCH 17/18] kmod-static-nodes.service: Update ConditionFileNotEmpty
+Subject: [PATCH 16/18] kmod-static-nodes.service: Update ConditionFileNotEmpty

 On NixOS, kernel modules of the currently booted systems are located at
 /run/booted-system/kernel-modules/lib/modules/%v/, not /lib/modules/%v/.
@ -10,7 +10,7 @@ On NixOS, kernel modules of the currently booted systems are located at
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/units/kmod-static-nodes.service.in b/units/kmod-static-nodes.service.in
-index 0971edf9ec..87105a87b9 100644
+index f4170d6a99..9a6a591bea 100644
 --- a/units/kmod-static-nodes.service.in
 +++ b/units/kmod-static-nodes.service.in
@@ -12,7 +12,7 @@ Description=Create list of static device nodes for the current kernel
@ -23,5 +23,5 @@ index 0971edf9ec..87105a87b9 100644
 [Service]
 Type=oneshot
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@ -1,7 +1,7 @@
-From 42419ff4dc7a36607189f8d3765aa836d5c5eaf9 Mon Sep 17 00:00:00 2001
+From 6f0e9a60dcd2160bcab01366bd521630f6f5dc76 Mon Sep 17 00:00:00 2001
 From: Florian Klink <flokli@flokli.de>
 Date: Sun, 8 Mar 2020 01:05:54 +0100
-Subject: [PATCH 18/18] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
+Subject: [PATCH 17/18] path-util.h: add placeholder for DEFAULT_PATH_NORMAL

 This will be the $PATH used to lookup ExecStart= etc. options, which
 systemd itself uses extensively.
@ -10,7 +10,7 @@ systemd itself uses extensively.
 1 file changed, 3 insertions(+), 3 deletions(-)

 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 30031fca8e..d97145539a 100644
+index d613709f0b..5cced4c115 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
@@ -24,11 +24,11 @@
@ -29,5 +29,5 @@ index 30031fca8e..d97145539a 100644
 #if HAVE_SPLIT_USR
 #  define DEFAULT_PATH DEFAULT_PATH_SPLIT_USR
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch
+++ b/pkgs/os-specific/linux/systemd/0018-logind-seat-debus-show-CanMultiSession-again.patch
@ -1,7 +1,7 @@
-From 3999d8949ddaf9296928f603661abcea13576d83 Mon Sep 17 00:00:00 2001
+From 120b53a3279ba098ee8e5a346b39cb2b7ef4a106 Mon Sep 17 00:00:00 2001
 From: Thomas Tuegel <ttuegel@mailbox.org>
 Date: Mon, 26 Oct 2020 21:21:38 +0100
-Subject: [PATCH 19/19] logind-seat-debus: show CanMultiSession again
+Subject: [PATCH 18/18] logind-seat-debus: show CanMultiSession again

 Fixes the "switch user" function in Plasma < 5.20.
 ---
@ -9,10 +9,10 @@ Fixes the "switch user" function in Plasma < 5.20.
 1 file changed, 1 insertion(+), 1 deletion(-)

 diff --git a/src/login/logind-seat-dbus.c b/src/login/logind-seat-dbus.c
-index a91765205c..742aeb1064 100644
+index a60ed2d3c2..69b6271075 100644
 --- a/src/login/logind-seat-dbus.c
 +++ b/src/login/logind-seat-dbus.c
-@@ -451,7 +451,7 @@ static const sd_bus_vtable seat_vtable[] = {
+@@ -450,7 +450,7 @@ static const sd_bus_vtable seat_vtable[] = {
 
         SD_BUS_PROPERTY("Id", "s", NULL, offsetof(Seat, id), SD_BUS_VTABLE_PROPERTY_CONST),
         SD_BUS_PROPERTY("ActiveSession", "(so)", property_get_active_session, 0, SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
@ -22,5 +22,5 @@ index a91765205c..742aeb1064 100644
         SD_BUS_PROPERTY("CanGraphical", "b", property_get_can_graphical, 0, SD_BUS_VTABLE_PROPERTY_EMITS_CHANGE),
         SD_BUS_PROPERTY("Sessions", "a(so)", property_get_sessions, 0, 0),
 -- 
-2.28.0
+2.29.2

--- a/pkgs/os-specific/linux/systemd/0019-Revert-pkg-config-prefix-is-not-really-configurable-.patch
+++ b/pkgs/os-specific/linux/systemd/0019-Revert-pkg-config-prefix-is-not-really-configurable-.patch
@ -0,0 +1,72 @@
+From cd5b1075499b8498d9c700a317ad11a3199c447a Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
+Date: Sun, 6 Dec 2020 08:34:19 +0100
+Subject: [PATCH 19/19] Revert "pkg-config: prefix is not really configurable,
+ don't pretend it was"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This reverts commit 6e65df89c348242dbd10036abc7dd5e8181cf733.
+
+Signed-off-by: Jörg Thalheim <joerg@thalheim.io>
+---
+ src/core/systemd.pc.in | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/core/systemd.pc.in b/src/core/systemd.pc.in
+index ccb382e421..8a35e53a4a 100644
+--- a/src/core/systemd.pc.in
+++ b/src/core/systemd.pc.in
+@@ -11,7 +11,7 @@
+ # considered deprecated (though there is no plan to remove them). New names
+ # shall have underscores.
+ 
+-prefix=/usr
+prefix=@prefix@
+ root_prefix=@rootprefix_noslash@
+ rootprefix=${root_prefix}
+ sysconf_dir=@sysconfdir@
+@@ -26,10 +26,10 @@ systemdsystemunitdir=${systemd_system_unit_dir}
+ systemd_system_preset_dir=${rootprefix}/lib/systemd/system-preset
+ systemdsystempresetdir=${systemd_system_preset_dir}
+ 
+-systemd_user_unit_dir=/usr/lib/systemd/user
+systemd_user_unit_dir=${prefix}/lib/systemd/user
+ systemduserunitdir=${systemd_user_unit_dir}
+ 
+-systemd_user_preset_dir=/usr/lib/systemd/user-preset
+systemd_user_preset_dir=${prefix}/lib/systemd/user-preset
+ systemduserpresetdir=${systemd_user_preset_dir}
+ 
+ systemd_system_conf_dir=${sysconfdir}/systemd/system
+@@ -48,7 +48,7 @@ systemduserunitpath=${systemd_user_unit_path}
+ systemd_system_generator_dir=${root_prefix}/lib/systemd/system-generators
+ systemdsystemgeneratordir=${systemd_system_generator_dir}
+ 
+-systemd_user_generator_dir=/usr/lib/systemd/user-generators
+systemd_user_generator_dir=${prefix}/lib/systemd/user-generators
+ systemdusergeneratordir=${systemd_user_generator_dir}
+ 
+ systemd_system_generator_path=/run/systemd/system-generators:/etc/systemd/system-generators:/usr/local/lib/systemd/system-generators:${systemd_system_generator_dir}
+@@ -63,7 +63,7 @@ systemdsleepdir=${systemd_sleep_dir}
+ systemd_shutdown_dir=${root_prefix}/lib/systemd/system-shutdown
+ systemdshutdowndir=${systemd_shutdown_dir}
+ 
+-tmpfiles_dir=/usr/lib/tmpfiles.d
+tmpfiles_dir=${prefix}/lib/tmpfiles.d
+ tmpfilesdir=${tmpfiles_dir}
+ 
+ sysusers_dir=${rootprefix}/lib/sysusers.d
+@@ -78,7 +78,7 @@ binfmtdir=${binfmt_dir}
+ modules_load_dir=${rootprefix}/lib/modules-load.d
+ modulesloaddir=${modules_load_dir}
+ 
+-catalog_dir=/usr/lib/systemd/catalog
+catalog_dir=${prefix}/lib/systemd/catalog
+ catalogdir=${catalog_dir}
+ 
+ system_uid_max=@SYSTEM_UID_MAX@
+-- 
+2.29.2
+
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , buildPackages
 , ninja
 , meson
@ -71,6 +72,7 @@
 , withMachined ? true
 , withNetworkd ? true
 , withNss ? true
+, withOomd ? false
 , withPCRE2 ? true
 , withPolkit ? true
 , withPortabled ? false
@ -80,8 +82,8 @@
 , withTimedated ? true
 , withTimesyncd ? true
 , withUserDb ? true
-, p11-kit
 , libfido2
+, p11-kit

  # name argument
 , pname ? "systemd"
@ -109,7 +111,7 @@ assert withCryptsetup ->
 let
  wantCurl = withRemote || withImportd;

-  version = "246.6";
+  version = "247";
 in
 stdenv.mkDerivation {
  inherit version pname;
@ -118,14 +120,15 @@ stdenv.mkDerivation {
  # This has proven to be less error-prone than the previous systemd fork.
  src = fetchFromGitHub {
    owner = "systemd";
-    repo = "systemd-stable";
+    repo = "systemd";
    rev = "v${version}";
-    sha256 = "1yhj2jlighqqpw1xk9q52f3pncjn47ipi224k35d6syb94q2b988";
+    sha256 = "1nwsr6p65zy5jpabvjbszq5g556l1npaf2xsik4p4pvjjwnn1nx6";
  };

  # If these need to be regenerated, `git am path/to/00*.patch` them into a
  # systemd worktree, rebase to the more recent systemd version, and export the
  # patches again via `git format-patch v${version}`.
+  # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all patches
  patches = [
    ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
    ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
@ -138,14 +141,14 @@ stdenv.mkDerivation {
    ./0009-Change-usr-share-zoneinfo-to-etc-zoneinfo.patch
    ./0010-localectl-use-etc-X11-xkb-for-list-x11.patch
    ./0011-build-don-t-create-statedir-and-don-t-touch-prefixdi.patch
-    ./0012-Install-default-configuration-into-out-share-factory.patch
-    ./0013-inherit-systemd-environment-when-calling-generators.patch
-    ./0014-add-rootprefix-to-lookup-dir-paths.patch
-    ./0015-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
-    ./0016-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
-    ./0017-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
-    ./0018-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
-    ./0019-logind-seat-debus-show-CanMultiSession-again.patch
+    ./0012-inherit-systemd-environment-when-calling-generators.patch
+    ./0013-add-rootprefix-to-lookup-dir-paths.patch
+    ./0014-systemd-shutdown-execute-scripts-in-etc-systemd-syst.patch
+    ./0015-systemd-sleep-execute-scripts-in-etc-systemd-system-.patch
+    ./0016-kmod-static-nodes.service-Update-ConditionFileNotEmp.patch
+    ./0017-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+    ./0018-logind-seat-debus-show-CanMultiSession-again.patch
+    ./0019-Revert-pkg-config-prefix-is-not-really-configurable-.patch
  ];

  postPatch = ''
@ -239,6 +242,7 @@ stdenv.mkDerivation {
    "-Dhostnamed=${lib.boolToString withHostnamed}"
    "-Dmachined=${lib.boolToString withMachined}"
    "-Dnetworkd=${lib.boolToString withNetworkd}"
+    "-Doomd=${lib.boolToString withOomd}"
    "-Dpolkit=${lib.boolToString withPolkit}"
    "-Dcryptsetup=${lib.boolToString withCryptsetup}"
    "-Dportabled=${lib.boolToString withPortabled}"
@ -259,6 +263,7 @@ stdenv.mkDerivation {
    "-Dldconfig=false"
    "-Dsmack=true"
    "-Db_pie=true"
+    "-Dinstall-sysconfdir=false"
    /*
    As of now, systemd doesn't allow runtime configuration of these values. So
    the settings in /etc/login.defs have no effect on it. Many people think this
@ -338,7 +343,7 @@ stdenv.mkDerivation {
        --replace /bin/plymouth /run/current-system/sw/bin/plymouth # To avoid dependency
    done

-    for dir in tools src/resolve test src/test; do
+    for dir in tools src/resolve test src/test src/shared; do
      patchShebangs $dir
    done

--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@ -31,11 +31,11 @@

 stdenv.mkDerivation rec {
  name = "${if libOnly then "lib" else ""}pulseaudio-${version}";
-  version = "13.0";
+  version = "14.0";

  src = fetchurl {
    url = "http://freedesktop.org/software/pulseaudio/releases/pulseaudio-${version}.tar.xz";
-    sha256 = "0mw0ybrqj7hvf8lqs5gjzip464hfnixw453lr0mqzlng3b5266wn";
+    sha256 = "0qf20rgg0ysrnvg3359j56ndls07qmfn5rsy9r85bc42jdfpfd58";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@ -2744,11 +2744,11 @@ lib.makeScope newScope (self: with self; {
  }) {};

  xrandr = callPackage ({ stdenv, pkgconfig, fetchurl, libX11, xorgproto, libXrandr, libXrender }: stdenv.mkDerivation {
-    name = "xrandr-1.5.0";
+    name = "xrandr-1.5.1";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/app/xrandr-1.5.0.tar.bz2";
-      sha256 = "1kaih7rmzxr1vp5a5zzjhm5x7dn9mckya088sqqw026pskhx9ky1";
+      url = "mirror://xorg/individual/app/xrandr-1.5.1.tar.xz";
+      sha256 = "0ql75s1n3dm2m3g1ilb9l6hqh15r0v709bgghpwazy3jknpnvivv";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@ -61,7 +61,7 @@ mirror://xorg/individual/app/xmodmap-1.0.10.tar.bz2
 mirror://xorg/individual/app/xmore-1.0.3.tar.bz2
 mirror://xorg/individual/app/xpr-1.0.5.tar.bz2
 mirror://xorg/individual/app/xprop-1.2.5.tar.bz2
-mirror://xorg/individual/app/xrandr-1.5.0.tar.bz2
+mirror://xorg/individual/app/xrandr-1.5.1.tar.xz
 mirror://xorg/individual/app/xrdb-1.2.0.tar.bz2
 mirror://xorg/individual/app/xrefresh-1.0.6.tar.bz2
 mirror://xorg/individual/app/xset-1.2.4.tar.bz2
--- a/pkgs/tools/filesystems/e2fsprogs/default.nix
+++ b/pkgs/tools/filesystems/e2fsprogs/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "e2fsprogs";
-  version = "1.45.5";
+  version = "1.45.6";

  src = fetchurl {
    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1n8ffss5044j9382rlvmhyr1f6kmnfjfbv6q4jbbh8gfdwpjmrwi";
+    sha256 = "sha256-X2SsUKK2C45nxbOCuxN97Dk0QBcQPK/8OmFVRCTy1pM=";
  };

  outputs = [ "bin" "dev" "out" "man" "info" ];
--- a/pkgs/tools/graphics/gnuplot/default.nix
+++ b/pkgs/tools/graphics/gnuplot/default.nix
@ -20,11 +20,11 @@ let
 in
 (if withQt then mkDerivation else stdenv.mkDerivation) rec {
  pname = "gnuplot";
-  version = "5.4.0";
+  version = "5.4.1";

  src = fetchurl {
    url = "mirror://sourceforge/gnuplot/${pname}-${version}.tar.gz";
-    sha256 = "0iwwliq5a6qcawbpxk4d7l17fpkq9xxcz05kwblx37rr7bq84h7b";
+    sha256 = "03jrqs5lvxmbbz2c4g17dn2hrxqwd3hfadk9q8wbkbkyas2h8sbb";
  };

  nativeBuildInputs = [ makeWrapper pkgconfig texinfo ] ++ lib.optional withQt qttools;
--- a/pkgs/tools/networking/unbound/default.nix
+++ b/pkgs/tools/networking/unbound/default.nix
@ -22,11 +22,11 @@

 stdenv.mkDerivation rec {
  pname = "unbound";
-  version = "1.12.0";
+  version = "1.13.0";

  src = fetchurl {
    url = "https://unbound.net/downloads/${pname}-${version}.tar.gz";
-    sha256 = "0daqxzvknvcz7sgag3wcrxhp4a39ik93lsrfpwcl9whjg2lm74jv";
+    sha256 = "18dj7migq6379hps59793457l81s3z7dll3y0fj6qcmhjlx08m59";
  };

  outputs = [ "out" "lib" "man" ]; # "dev" would only split ~20 kB
--- a/pkgs/tools/typesetting/asciidoctor/Gemfile
+++ b/pkgs/tools/typesetting/asciidoctor/Gemfile
@ -4,6 +4,7 @@ gem 'asciidoctor-diagram'
 gem 'asciidoctor-pdf'
 gem 'asciidoctor-epub3'
 gem 'asciidoctor-mathematical'
+gem 'asciidoctor-revealjs'
 gem 'coderay'
 gem 'pygments.rb'
 gem 'rouge'
--- a/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
+++ b/pkgs/tools/typesetting/asciidoctor/Gemfile.lock
@ -28,6 +28,11 @@ GEM
      safe_yaml (~> 1.0.0)
      thread_safe (~> 0.3.0)
      treetop (~> 1.5.0)
+    asciidoctor-revealjs (4.0.1)
+      asciidoctor (>= 2.0.0, < 3.0.0)
+      concurrent-ruby (~> 1.0)
+      thread_safe (~> 0.3.5)
+    asciimath (2.0.1)
    coderay (1.1.2)
    concurrent-ruby (1.1.5)
    css_parser (1.7.0)
@ -40,6 +45,9 @@ GEM
      concurrent-ruby (~> 1.0)
    mathematical (1.6.12)
      ruby-enum (~> 0.4)
+    mime-types (3.3.1)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2020.1104)
    mini_portile2 (2.4.0)
    multi_json (1.13.1)
    nokogiri (1.10.3)
@ -88,6 +96,7 @@ DEPENDENCIES
  asciidoctor-epub3
  asciidoctor-mathematical
  asciidoctor-pdf
+  asciidoctor-revealjs
  coderay
  pygments.rb
  rouge
--- a/pkgs/tools/typesetting/asciidoctor/default.nix
+++ b/pkgs/tools/typesetting/asciidoctor/default.nix
@ -13,6 +13,7 @@ let
      "asciidoctor"
      "asciidoctor-pdf"
      "asciidoctor-epub3"
+      "asciidoctor-revealjs"
    ];

    buildInputs = [ makeWrapper ];
--- a/pkgs/tools/typesetting/asciidoctor/gemset.nix
+++ b/pkgs/tools/typesetting/asciidoctor/gemset.nix
@ -84,6 +84,27 @@
    };
    version = "1.5.0.alpha.18";
  };
+  asciidoctor-revealjs = {
+    dependencies = ["asciidoctor" "concurrent-ruby" "thread_safe"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "084aq9frv4irzgd9ab3xad9i0ml9lb58w0wvg76gnwwr51plbpp4";
+      type = "gem";
+    };
+    version = "4.0.1";
+  };
+  asciimath = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1aapydwwkydbwgz07n7ma3a5jy9n3v0shy6q6j8mi4wr3crhx45a";
+      type = "gem";
+    };
+    version = "2.0.1";
+  };
  coderay = {
    groups = ["default"];
    platforms = [];
@ -158,6 +179,27 @@
    };
    version = "1.6.12";
  };
+  mime-types = {
+    dependencies = ["mime-types-data"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1zj12l9qk62anvk9bjvandpa6vy4xslil15wl6wlivyf51z773vh";
+      type = "gem";
+    };
+    version = "3.3.1";
+  };
+  mime-types-data = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0ipjyfwn9nlvpcl8knq3jk4g5f12cflwdbaiqxcq1s7vwfwfxcag";
+      type = "gem";
+    };
+    version = "3.2020.1104";
+  };
  mini_portile2 = {
    groups = ["default"];
    platforms = [];
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -19186,6 +19186,7 @@ in
    withMachined = false;
    withNetworkd = false;
    withNss = false;
+    withOomd = false;
    withPCRE2 = false;
    withPolkit = false;
    withRemote = false;
--- a/pkgs/top-level/static.nix
+++ b/pkgs/top-level/static.nix
@ -319,4 +319,6 @@ in {
      configureFlags = attrs.configureFlags ++ [ "--disable-shared" ];
    });
  });
+
+  libcap = super.libcap.override { pam = null; };
 }