Merge master into haskell-updates

2023-02-06 00:13:13 +00:00 · 2023-02-06 00:13:13 +00:00 · 3f3dc60c6e
commit 3f3dc60c6e
parent 328d6f8499 8255262d78
215 changed files with 2550 additions and 1316 deletions
--- a/doc/builders/fetchers.chapter.md
+++ b/doc/builders/fetchers.chapter.md
@ -163,3 +163,30 @@ or "hg"), `domain` and `fetchSubmodules`.
 If `fetchSubmodules` is `true`, `fetchFromSourcehut` uses `fetchgit`
 or `fetchhg` with `fetchSubmodules` or `fetchSubrepos` set to `true`,
 respectively. Otherwise, the fetcher uses `fetchzip`.
+
+## `requireFile` {#requirefile}
+
+`requireFile` allows requesting files that cannot be fetched automatically, but whose content is known.
+This is a useful last-resort workaround for license restrictions that prohibit redistribution, or for downloads that are only accessible after authenticating interactively in a browser.
+If the requested file is present in the Nix store, the resulting derivation will not be built, because its expected output is already available.
+Otherwise, the builder will run, but fail with a message explaining to the user how to provide the file. The following code, for example:
+
+```
+requireFile {
+  name = "jdk-${version}_linux-x64_bin.tar.gz";
+  url = "https://www.oracle.com/java/technologies/javase-jdk11-downloads.html";
+  sha256 = "94bd34f85ee38d3ef59e5289ec7450b9443b924c55625661fffe66b03f2c8de2";
+}
+```
+results in this error message:
+```
+***
+Unfortunately, we cannot download file jdk-11.0.10_linux-x64_bin.tar.gz automatically.
+Please go to https://www.oracle.com/java/technologies/javase-jdk11-downloads.html to download it yourself, and add it to the Nix store
+using either
+  nix-store --add-fixed sha256 jdk-11.0.10_linux-x64_bin.tar.gz
+or
+  nix-prefetch-url --type sha256 file:///path/to/jdk-11.0.10_linux-x64_bin.tar.gz
+
+***
+```
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -693,6 +693,15 @@
      fingerprint = "7FDB 17B3 C29B 5BA6 E5A9  8BB2 9FAA 63E0 9750 6D9D";
    }];
  };
+  Alper-Celik = {
+    email = "dev.alpercelik@gmail.com";
+    name = "Alper Çelik";
+    github = "Alper-Celik";
+    githubId = 110625473;
+    keys = [{
+      fingerprint = "6B69 19DD CEE0 FAF3 5C9F  2984 FA90 C0AB 738A B873";
+    }];
+  };
  almac = {
    email = "alma.cemerlic@gmail.com";
    github = "a1mac";
@ -8930,8 +8939,8 @@
    githubId = 2914269;
    name = "Malo Bourgon";
  };
-  malvo = {
-    email = "malte@malvo.org";
+  malte-v = {
+    email = "nixpkgs@mal.tc";
    github = "malte-v";
    githubId = 34393802;
    name = "Malte Voos";
--- a/nixos/doc/manual/manpages/README.md
+++ b/nixos/doc/manual/manpages/README.md
@ -4,6 +4,8 @@ This is the collection of NixOS manpages, excluding `configuration.nix(5)`.

 Man pages are written in [`mdoc(7)` format](https://mandoc.bsd.lv/man/mdoc.7.html) and should be portable between mandoc and groff for rendering (though minor differences may occur, mandoc and groff seem to have slightly different spacing rules.)

+For previewing edited files, you can just run `man -l path/to/file.8` and you will see it rendered.
+
 Being written in `mdoc` these manpages use semantic markup. This file provides a guideline on where to apply which of the semantic elements of `mdoc`.

 ### Command lines and arguments
--- a/nixos/modules/programs/sway.nix
+++ b/nixos/modules/programs/sway.nix
@ -26,7 +26,7 @@ let
    };
  };

-  swayPackage = pkgs.sway.override {
+  defaultSwayPackage = pkgs.sway.override {
    extraSessionCommands = cfg.extraSessionCommands;
    extraOptions = cfg.extraOptions;
    withBaseWrapper = cfg.wrapperFeatures.base;
@ -42,6 +42,19 @@ in {
      <https://github.com/swaywm/sway/wiki> and
      "man 5 sway" for more information'');

+    package = mkOption {
+      type = with types; nullOr package;
+      default = defaultSwayPackage;
+      defaultText = literalExpression "pkgs.sway";
+      description = lib.mdDoc ''
+        Sway package to use. Will override the options
+        'wrapperFeatures', 'extraSessionCommands', and 'extraOptions'.
+        Set to <code>null</code> to not add any Sway package to your
+        path. This should be done if you want to use the Home Manager Sway
+        module to install Sway.
+      '';
+    };
+
    wrapperFeatures = mkOption {
      type = wrapperOptions;
      default = { };
@ -121,16 +134,17 @@ in {
      }
    ];
    environment = {
-      systemPackages = [ swayPackage ] ++ cfg.extraPackages;
+      systemPackages = optional (cfg.package != null) cfg.package ++ cfg.extraPackages;
      # Needed for the default wallpaper:
-      pathsToLink = [ "/share/backgrounds/sway" ];
+      pathsToLink = optionals (cfg.package != null) [ "/share/backgrounds/sway" ];
      etc = {
-        "sway/config".source = mkOptionDefault "${swayPackage}/etc/sway/config";
        "sway/config.d/nixos.conf".source = pkgs.writeText "nixos.conf" ''
          # Import the most important environment variables into the D-Bus and systemd
          # user environments (e.g. required for screen sharing and Pinentry prompts):
          exec dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY SWAYSOCK XDG_CURRENT_DESKTOP
        '';
+      } // optionalAttrs (cfg.package != null) {
+        "sway/config".source = mkOptionDefault "${cfg.package}/etc/sway/config";
      };
    };
    security.polkit.enable = true;
@ -139,7 +153,7 @@ in {
    fonts.enableDefaultFonts = mkDefault true;
    programs.dconf.enable = mkDefault true;
    # To make a Sway session available if a display manager like SDDM is enabled:
-    services.xserver.displayManager.sessionPackages = [ swayPackage ];
+    services.xserver.displayManager.sessionPackages = optionals (cfg.package != null) [ cfg.package ];
    programs.xwayland.enable = mkDefault true;
    # For screen sharing (this option only has an effect with xdg.portal.enable):
    xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-wlr ];
--- a/nixos/modules/services/networking/firefox-syncserver.nix
+++ b/nixos/modules/services/networking/firefox-syncserver.nix
@ -304,6 +304,10 @@ in
        forceSSL = cfg.singleNode.enableTLS;
        locations."/" = {
          proxyPass = "http://127.0.0.1:${toString cfg.settings.port}";
+          # We need to pass the Host header that matches the original Host header. Otherwise,
+          # Hawk authentication will fail (because it assumes that the client and server see
+          # the same value of the Host header).
+          recommendedProxySettings = true;
        };
      };
    };
--- a/nixos/modules/services/networking/soju.nix
+++ b/nixos/modules/services/networking/soju.nix
@ -120,5 +120,5 @@ in
    };
  };

-  meta.maintainers = with maintainers; [ malvo ];
+  meta.maintainers = with maintainers; [ malte-v ];
 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -414,7 +414,9 @@ in {
  mtp = handleTest ./mtp.nix {};
  multipass = handleTest ./multipass.nix {};
  mumble = handleTest ./mumble.nix {};
-  musescore = handleTest ./musescore.nix {};
+  # Fails on aarch64-linux at the PDF creation step - need to debug this on an
+  # aarch64 machine..
+  musescore = handleTestOn ["x86_64-linux"] ./musescore.nix {};
  munin = handleTest ./munin.nix {};
  mutableUsers = handleTest ./mutable-users.nix {};
  mxisd = handleTest ./mxisd.nix {};
--- a/nixos/tests/musescore.nix
+++ b/nixos/tests/musescore.nix
@ -2,13 +2,12 @@ import ./make-test-python.nix ({ pkgs, ...} :

 let
  # Make sure we don't have to go through the startup tutorial
-  customMuseScoreConfig = pkgs.writeText "MuseScore3.ini" ''
+  customMuseScoreConfig = pkgs.writeText "MuseScore4.ini" ''
    [application]
-    startup\firstStart=false
+    hasCompletedFirstLaunchSetup=true

-    [ui]
-    application\startup\showTours=false
-    application\startup\showStartCenter=false
+    [project]
+    preferredScoreCreationMode=1
    '';
 in
 {
@ -40,51 +39,68 @@ in
    # Inject custom settings
    machine.succeed("mkdir -p /root/.config/MuseScore/")
    machine.succeed(
-        "cp ${customMuseScoreConfig} /root/.config/MuseScore/MuseScore3.ini"
+        "cp ${customMuseScoreConfig} /root/.config/MuseScore/MuseScore4.ini"
    )

    # Start MuseScore window
    machine.execute("DISPLAY=:0.0 mscore >&2 &")

    # Wait until MuseScore has launched
-    machine.wait_for_window("MuseScore")
+    machine.wait_for_window("MuseScore 4")

    # Wait until the window has completely initialised
-    machine.wait_for_text("MuseScore")
-
-    # Start entering notes
-    machine.send_key("n")
-    # Type the beginning of https://de.wikipedia.org/wiki/Alle_meine_Entchen
-    machine.send_chars("cdef6gg5aaaa7g")
-    # Make sure the VM catches up with all the keys
-    machine.sleep(1)
+    machine.wait_for_text("MuseScore 4")

    machine.screenshot("MuseScore0")

+    # Create a new score
+    machine.send_key("ctrl-n")
+
+    # Wait until the creation wizard appears
+    machine.wait_for_window("New score")
+
+    machine.screenshot("MuseScore1")
+
+    machine.send_key("tab")
+    machine.send_key("tab")
+    machine.send_key("tab")
+    machine.send_key("tab")
+    machine.send_key("right")
+    machine.send_key("right")
+    machine.send_key("ret")
+
+    machine.sleep(1)
+
+    # Type the beginning of https://de.wikipedia.org/wiki/Alle_meine_Entchen
+    machine.send_chars("cdef6gg5aaaa7g")
+    machine.sleep(1)
+
+    machine.screenshot("MuseScore2")
+
    # Go to the export dialogue and create a PDF
    machine.send_key("alt-f")
    machine.sleep(1)
    machine.send_key("e")

    # Wait until the export dialogue appears.
-    machine.wait_for_window("Export")
-    machine.screenshot("MuseScore1")
-    machine.send_key("shift-tab")
-    machine.sleep(1)
-    machine.send_key("shift-tab")
-    machine.sleep(1)
-    machine.send_key("ret")
-    machine.sleep(1)
-    machine.send_key("ret")
-
-    machine.screenshot("MuseScore2")
-
-    # Wait until PDF is exported
-    machine.wait_for_file("/root/Documents/MuseScore3/Scores/Untitled.pdf")
-
-    # Check that it contains the title of the score
-    machine.succeed("pdfgrep Title /root/Documents/MuseScore3/Scores/Untitled.pdf")
+    machine.wait_for_text("Export")

    machine.screenshot("MuseScore3")
+
+    machine.send_key("shift-tab")
+    machine.sleep(1)
+    machine.send_key("ret")
+    machine.sleep(1)
+    machine.send_key("ret")
+
+    machine.screenshot("MuseScore4")
+
+    # Wait until PDF is exported
+    machine.wait_for_file('"/root/Documents/MuseScore4/Scores/Untitled score.pdf"')
+
+    # Check that it contains the title of the score
+    machine.succeed('pdfgrep "Untitled score" "/root/Documents/MuseScore4/Scores/Untitled score.pdf"')
+
+    machine.screenshot("MuseScore5")
  '';
 })
--- a/nixos/tests/nextcloud/default.nix
+++ b/nixos/tests/nextcloud/default.nix
@ -26,4 +26,4 @@ foldl
    };
  })
 { }
-  [ 24 25 26 ]
+  [ 24 25 ]
--- a/nixos/tests/vscodium.nix
+++ b/nixos/tests/vscodium.nix
@ -33,13 +33,6 @@ let
      };
      enableOCR = true;

-      # testScriptWithTypes:55: error: Item "function" of
-      # "Union[Callable[[Callable[..., Any]], ContextManager[Any]], ContextManager[Any]]"
-      # has no attribute "__enter__"
-      #     with codium_running:
-      #          ^
-      skipTypeCheck = true;
-
      testScript = ''
        @polling_condition
        def codium_running():
@ -50,10 +43,10 @@ let

        machine.wait_for_unit('graphical.target')

-        codium_running.wait()
-        with codium_running:
+        codium_running.wait() # type: ignore[union-attr]
+        with codium_running: # type: ignore[union-attr]
            # Wait until vscodium is visible. "File" is in the menu bar.
-            machine.wait_for_text('Get Started')
+            machine.wait_for_text('Welcome')
            machine.screenshot('start_screen')

            test_string = 'testfile'
--- a/pkgs/applications/audio/musescore/darwin.nix
+++ b/pkgs/applications/audio/musescore/darwin.nix
@ -1,8 +1,9 @@
 { stdenv, lib, fetchurl, undmg }:

 let
-  versionComponents = [ "3" "6" "2" "548020600" ];
+  versionComponents = [ "4" "0" "1" ];
  appName = "MuseScore ${builtins.head versionComponents}";
+  ref = "230121751";
 in

 stdenv.mkDerivation rec {
@ -13,8 +14,8 @@ stdenv.mkDerivation rec {
  sourceRoot = "${appName}.app";

  src = fetchurl {
-    url = "https://github.com/musescore/MuseScore/releases/download/v${lib.concatStringsSep "." (lib.take 3 versionComponents)}/MuseScore-${version}.dmg";
-    sha256 = "sha256-lHckfhTTrDzaGwlbnZ5w0O1gMPbRmrmgATIGMY517l0=";
+    url =  "https://github.com/musescore/MuseScore/releases/download/v${version}/MuseScore-${version}.${ref}.dmg";
+    hash = "sha256-tkIEV+tCS0SYh2TlC70/zEBUEOSg//EaSKDGA7kH/vo=";
  };

  buildInputs = [ undmg ];
--- a/pkgs/applications/audio/musescore/default.nix
+++ b/pkgs/applications/audio/musescore/default.nix
@ -1,28 +1,35 @@
-{ mkDerivation, lib, fetchFromGitHub, cmake, pkg-config
+{ mkDerivation, lib, fetchFromGitHub, fetchpatch, cmake, pkg-config, ninja
 , alsa-lib, freetype, libjack2, lame, libogg, libpulseaudio, libsndfile, libvorbis
-, portaudio, portmidi, qtbase, qtdeclarative, qtgraphicaleffects
+, portaudio, portmidi, qtbase, qtdeclarative, qtgraphicaleffects, flac
 , qtquickcontrols2, qtscript, qtsvg, qttools
-, qtwebengine, qtxmlpatterns
+, qtwebengine, qtxmlpatterns, qtnetworkauth, qtx11extras
 , nixosTests
 }:

 mkDerivation rec {
  pname = "musescore";
-  version = "3.6.2";
+  version = "4.0.1";

  src = fetchFromGitHub {
    owner = "musescore";
    repo = "MuseScore";
    rev = "v${version}";
-    sha256 = "sha256-GBGAD/qdOhoNfDzI+O0EiKgeb86GFJxpci35T6tZ+2s=";
+    sha256 = "sha256-Xhjjm/pYcjfZE632eP2jujqUAmzdYNa81EPrvS5UKnQ=";
  };
-
  patches = [
-    ./remove_qtwebengine_install_hack.patch
+    # See https://github.com/musescore/MuseScore/issues/15571
+    (fetchpatch {
+      url = "https://github.com/musescore/MuseScore/commit/365be5dfb7296ebee4677cb74b67c1721bc2cf7b.patch";
+      hash = "sha256-tJ2M21i3geO9OsjUQKNatSXTkJ5U9qMT4RLNdJnyoKw=";
+    })
  ];

  cmakeFlags = [
    "-DMUSESCORE_BUILD_CONFIG=release"
+    # Disable the _usage_ of the `/bin/crashpad_handler` utility. See:
+    # https://github.com/musescore/MuseScore/pull/15577
+    "-DBUILD_CRASHPAD_CLIENT=OFF"
+    # Use our freetype
    "-DUSE_SYSTEM_FREETYPE=ON"
  ];

@ -34,13 +41,13 @@ mkDerivation rec {
    "--set-default QT_QPA_PLATFORM xcb"
  ];

-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [ cmake pkg-config ninja ];

  buildInputs = [
    alsa-lib libjack2 freetype lame libogg libpulseaudio libsndfile libvorbis
-    portaudio portmidi # tesseract
+    portaudio portmidi flac # tesseract
    qtbase qtdeclarative qtgraphicaleffects qtquickcontrols2
-    qtscript qtsvg qttools qtwebengine qtxmlpatterns
+    qtscript qtsvg qttools qtwebengine qtxmlpatterns qtnetworkauth qtx11extras
  ];

  passthru.tests = nixosTests.musescore;
@ -48,8 +55,11 @@ mkDerivation rec {
  meta = with lib; {
    description = "Music notation and composition software";
    homepage = "https://musescore.org/";
-    license = licenses.gpl2;
+    license = licenses.gpl3Only;
    maintainers = with maintainers; [ vandenoever turion doronbehar ];
+    # Darwin requires CoreMIDI from SDK 11.3, we use the upstream built .dmg
+    # file in ./darwin.nix in the meantime.
    platforms = platforms.linux;
+    mainProgram = "mscore";
  };
 }
--- a/pkgs/applications/audio/musescore/remove_qtwebengine_install_hack.patch
+++ b/pkgs/applications/audio/musescore/remove_qtwebengine_install_hack.patch
@ -1,19 +0,0 @@
--- a/main/CMakeLists.txt
-+++ b/main/CMakeLists.txt
-@@ -220,16 +219,0 @@ else (MINGW)
-      ## install qwebengine core
-      if (NOT APPLE AND USE_WEBENGINE)
-         install(PROGRAMS
-            ${QT_INSTALL_LIBEXECS}/QtWebEngineProcess
-            DESTINATION bin
-            )
-         install(DIRECTORY
-            ${QT_INSTALL_DATA}/resources
-            DESTINATION lib/qt5
-            )
-         install(DIRECTORY
-            ${QT_INSTALL_TRANSLATIONS}/qtwebengine_locales
-            DESTINATION lib/qt5/translations
-            )
-      endif(NOT APPLE AND USE_WEBENGINE)
-
--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "praat";
-  version = "6.3.05";
+  version = "6.3.06";

  src = fetchFromGitHub {
    owner = "praat";
    repo = "praat";
    rev = "v${version}";
-    sha256 = "sha256-0e225cmP0CSYjRYNEXi4Oqq9o8XR2N7bNS1X5x+mQKw=";
+    sha256 = "sha256-KwJ8ia1yQmmG+N44ipvGCbuoR2cL03STSTKzUwlDqms=";
  };

  configurePhase = ''
--- a/pkgs/applications/blockchains/stellar-core/default.nix
+++ b/pkgs/applications/blockchains/stellar-core/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "stellar-core";
-  version = "19.6.0";
+  version = "19.7.0";

  src = fetchFromGitHub {
    owner = "stellar";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-lDefmPZM8ow6t5CpNBxef+9BoT773p5UgeMhgF+em2w=";
+    sha256 = "sha256-VfaP4EIVsu5JTAV7AX0Ymo44/TD8eUB61CViwf6Hfqw=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@ -135,6 +135,9 @@ let

      # this fixes bundled ripgrep
      chmod +x resources/app/node_modules/@vscode/ripgrep/bin/rg
+
+      # see https://github.com/gentoo/gentoo/commit/4da5959
+      chmod +x resources/app/node_modules/node-pty/build/Release/spawn-helper
    '';

    inherit meta;
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -15,11 +15,11 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "0mm6xa0kizgg2f6cql6jk8h83pn89h6q7rrs1kypvj3j0x6ysqsg";
-    x86_64-darwin = "1g9syvinj2mx292wrnrdn2znqhg17mrjqij0z1ilag5bi4xmzhcj";
-    aarch64-linux = "0xbq6fla0lxan08jgmsva91cbcv8rhzd7mqixrm1lsqh4h0wpssz";
-    aarch64-darwin = "1b4a56j256rib1997g9wwiak206axkppl124qg021vyab42x8rim";
-    armv7l-linux = "0gb96hi854kyh8694j9mbgl78f4y68czkwmjxhzb054l5b4adjla";
+    x86_64-linux = "1qayw19mb7f0gcgcvl57gpacrqsyx2jvc6s63vzbx8jmf5qnk71a";
+    x86_64-darwin = "02z9026kp66lx6pll46xx790jj7c7wh2ca7xim373x90k8hm4kwz";
+    aarch64-linux = "1izqhzvv46p05k1z2yg380ddwmar4w2pbrd0dyvkdysvp166y931";
+    aarch64-darwin = "1zcr653ssck4nc3vf04l6bilnjdsiqscw62g1wzbyk6s50133cx8";
+    armv7l-linux = "0n914rcfn2m9zsbnkd82cmw88qbpssv6jk3g8ig3wqlircbgrw0h";
  }.${system} or throwSystem;

  sourceRoot = if stdenv.isDarwin then "" else ".";
@ -29,7 +29,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.74.3.23010";
+    version = "1.75.0.23033";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@ -30,6 +30,7 @@
 , Foundation
 , testers
 , imagemagick
+, python3
 }:

 assert libXtSupport -> libX11Support;
@ -122,8 +123,10 @@ stdenv.mkDerivation rec {
    done
  '';

-  passthru.tests.version =
-    testers.testVersion { package = imagemagick; };
+  passthru.tests = {
+    version = testers.testVersion { package = imagemagick; };
+    inherit (python3.pkgs) img2pdf;
+  };

  meta = with lib; {
    homepage = "http://www.imagemagick.org/";
--- a/pkgs/applications/kde/kalendar.nix
+++ b/pkgs/applications/kde/kalendar.nix
@ -97,7 +97,7 @@ mkDerivation rec {
    description = "A calendar application using Akonadi to sync with external services (Nextcloud, GMail, ...)";
    homepage = "https://apps.kde.org/kalendar/";
    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ chuangzhu ];
+    maintainers = with maintainers; [ Thra11 ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/iptsd/default.nix
+++ b/pkgs/applications/misc/iptsd/default.nix
@ -1,37 +1,67 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, systemd, inih }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, meson
+, ninja
+, pkg-config
+, cli11
+, hidrd
+, inih
+, microsoft_gsl
+, spdlog
+, systemd
+}:

 stdenv.mkDerivation rec {
  pname = "iptsd";
-  version = "0.5.1";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "linux-surface";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-du5TC3I5+hWifjdnaeTj2QPJ6/oTXZqaOrZJkef/USU=";
+    hash = "sha256-fd/WZXRvJb6XCATNmPj2xi1UseoZqBT9IN21iwxHGLs=";
  };

-  nativeBuildInputs = [ meson ninja pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    meson
+    ninja
+    pkg-config
+  ];

-  buildInputs = [ systemd inih ];
+  dontUseCmakeConfigure = true;
+
+  buildInputs = [
+    cli11
+    hidrd
+    inih
+    microsoft_gsl
+    spdlog
+    systemd
+  ];

  # Original installs udev rules and service config into global paths
  postPatch = ''
-    substituteInPlace meson.build \
+    substituteInPlace etc/meson.build \
      --replace "install_dir: unitdir" "install_dir: datadir" \
      --replace "install_dir: rulesdir" "install_dir: datadir" \
  '';
+
  mesonFlags = [
    "-Dservice_manager=systemd"
    "-Dsample_config=false"
-    "-Ddebug_tool=false"
+    "-Ddebug_tools="
+    "-Db_lto=false"  # plugin needed to handle lto object -> undefined reference to ...
  ];

  meta = with lib; {
+    changelog = "https://github.com/linux-surface/iptsd/releases/tag/${src.rev}";
    description = "Userspace daemon for Intel Precise Touch & Stylus";
    homepage = "https://github.com/linux-surface/iptsd";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ tomberek ];
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ tomberek dotlambda ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/kanboard/default.nix
+++ b/pkgs/applications/misc/kanboard/default.nix
@ -1,27 +0,0 @@
-{ lib, stdenv, fetchFromGitHub }:
-
-stdenv.mkDerivation rec {
-  pname = "kanboard";
-  version = "1.2.26";
-
-  src = fetchFromGitHub {
-    owner = "kanboard";
-    repo = "kanboard";
-    rev = "v${version}";
-    sha256 = "sha256-/Unxl9Vh9pEWjO89sSviGGPFzUwxdb1mbOfpTFTyRL0=";
-  };
-
-  dontBuild = true;
-
-  installPhase = ''
-    mkdir -p $out/share/kanboard
-    cp -rv . $out/share/kanboard
-  '';
-
-  meta = with lib; {
-    description = "Kanban project management software";
-    homepage = "https://kanboard.org";
-    license = licenses.mit;
-    maintainers = with maintainers; [ lheckemann ];
-  };
-}
--- a/pkgs/applications/misc/keepass/default.nix
+++ b/pkgs/applications/misc/keepass/default.nix
@ -4,11 +4,11 @@ let
  inherit (builtins) add length readFile replaceStrings unsafeDiscardStringContext toString map;
 in buildDotnetPackage rec {
  pname = "keepass";
-  version = "2.52";
+  version = "2.53";

  src = fetchurl {
    url = "mirror://sourceforge/keepass/KeePass-${version}-Source.zip";
-    sha256 = "sha256-6dGCfysen26VGHIHETuNGkqHbPyeWRIEopqJa6AMzXA=";
+    hash = "sha256-wpXbLH9VyjJyb+KuQ8xmbik1jq+xqAFRxsxAuLM5MI0=";
  };

  sourceRoot = ".";
--- a/pkgs/applications/misc/klayout/default.nix
+++ b/pkgs/applications/misc/klayout/default.nix
@ -5,13 +5,13 @@

 mkDerivation rec {
  pname = "klayout";
-  version = "0.28.3";
+  version = "0.28.4";

  src = fetchFromGitHub {
    owner = "KLayout";
    repo = "klayout";
    rev = "v${version}";
-    hash = "sha256-keC+QLV/iEEGFDdy/Vt2pCr55qbqQzcx3HokdDi+xSU=";
+    hash = "sha256-6RIzgC/PA2DqO24vKu+d/+GttufUbIH+k9GZe09M0vM=";
  };

  postPatch = ''
--- a/pkgs/applications/misc/pgmodeler/default.nix
+++ b/pkgs/applications/misc/pgmodeler/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    owner = "pgmodeler";
    repo = "pgmodeler";
    rev = "v${version}";
-    sha256 = "sha256-Lim9iQYdmulwZEIayoBGoAmQ7rysTEEof5iXy3kfKXs=";
+    sha256 = "sha256-aDmaKf3iLBFD28n2u/QOf/GkgE64Birn0x3Kj5Qx2sg=";
  };

  nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook ];
--- a/pkgs/applications/misc/process-compose/default.nix
+++ b/pkgs/applications/misc/process-compose/default.nix
@ -8,13 +8,13 @@ let config-module = "github.com/f1bonacc1/process-compose/src/config";
 in
 buildGoModule rec {
  pname = "process-compose";
-  version = "0.40.0";
+  version = "0.40.1";

  src = fetchFromGitHub {
    owner = "F1bonacc1";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-8gyALVW+ort76r/zevWAhZlJ/fg5DBmwUNvjZ21wWKY=";
+    hash = "sha256-riYrvg83mNdj4W8o/2cdZO+zie/WB+HVWXORJ4Uo/CE=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
--- a/pkgs/applications/misc/tabula/default.nix
+++ b/pkgs/applications/misc/tabula/default.nix
@ -36,5 +36,6 @@ stdenv.mkDerivation rec {
    license = licenses.mit;
    maintainers = [ maintainers.dpaetzel ];
    platforms = platforms.all;
+    broken = true; # on 2022-11-23 this package builds, but produces an executable that fails immediately
  };
 }
--- a/pkgs/applications/misc/thedesk/default.nix
+++ b/pkgs/applications/misc/thedesk/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "thedesk";
-  version = "24.0.7";
+  version = "24.0.8";

  src = fetchurl {
    url = "https://github.com/cutls/TheDesk/releases/download/v${version}/${pname}_${version}_amd64.deb";
-    sha256 = "sha256-EG5TMhYvECXahIbB25gP40iNQpStcrgaJW3ld9x02/E=";
+    sha256 = "sha256-nxwSJ/rQJYMNrtTWSmqcrJQwMK8zRwIG4jccVyb7OsQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/tvbrowser/default.nix
+++ b/pkgs/applications/misc/tvbrowser/default.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
  version = "4.2.7";

  src = fetchzip {
-    url = "mirror://sourceforge/${pname}/TV-Browser%20Releases%20%28Java%20${minimalJavaVersion}%20and%20higher%29/${version}/${pname}_${version}_src.tar.gz";
+    url = "mirror://sourceforge/${pname}/TV-Browser%20Releases%20%28Java%20${minimalJavaVersion}%20and%20higher%29/${version}/${pname}_${version}_src.zip";
    hash = "sha256-dmNfI6T0MU7UtMH+C/2hiAeDwZlFCB4JofQViZezoqI=";
  };

--- a/pkgs/applications/misc/variety/default.nix
+++ b/pkgs/applications/misc/variety/default.nix
@ -21,13 +21,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "variety";
-  version = "0.8.9";
+  version = "0.8.10";

  src = fetchFromGitHub {
    owner = "varietywalls";
    repo = "variety";
    rev = "refs/tags/${version}";
-    hash = "sha256-Tm8RXn2S/NDUD3JWeCHKqSFkxZPJdNMojPGnU4WEpr0=";
+    hash = "sha256-Uln0uoaEZgV9FN3HEBTeFOD7d6RkAQLgQZw7bcgu26A=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/xmrig/proxy.nix
+++ b/pkgs/applications/misc/xmrig/proxy.nix
@ -1,27 +1,54 @@
-{ stdenv, lib, fetchFromGitHub, cmake, libuv, libmicrohttpd, openssl
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, libuv
+, libmicrohttpd
+, openssl
+, darwin
 }:

+let
+  inherit (darwin.apple_sdk_11_0.frameworks) CoreServices IOKit;
+in
 stdenv.mkDerivation rec {
  pname = "xmrig-proxy";
-  version = "6.18.0";
+  version = "6.19.0";

  src = fetchFromGitHub {
    owner = "xmrig";
    repo = "xmrig-proxy";
    rev = "v${version}";
-    sha256 = "sha256-3Tp0wTL3uHs0N4CdlNusvpuam653b6qUZu9/KBT4HOM=";
+    hash = "sha256-0vmRwe7PQVifm6HxgpPno9mIFcBZFtxqNdDK4V637ds=";
  };

-  nativeBuildInputs = [ cmake ];
-  buildInputs = [ libuv libmicrohttpd openssl ];
-
  postPatch = ''
-    # Link dynamically against libuuid instead of statically
-    substituteInPlace CMakeLists.txt --replace uuid.a uuid
+    # Link dynamically against libraries instead of statically
+    substituteInPlace CMakeLists.txt \
+      --replace uuid.a uuid
+    substituteInPlace cmake/OpenSSL.cmake \
+      --replace "set(OPENSSL_USE_STATIC_LIBS TRUE)" "set(OPENSSL_USE_STATIC_LIBS FALSE)"
  '';

+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libuv
+    libmicrohttpd
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    CoreServices
+    IOKit
+  ];
+
  installPhase = ''
+    runHook preInstall
+
    install -vD xmrig-proxy $out/bin/xmrig-proxy
+
+    runHook postInstall
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/yewtube/default.nix
+++ b/pkgs/applications/misc/yewtube/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "yewtube";
-  version = "2.9.0";
+  version = "2.9.2";

  src = fetchFromGitHub {
    owner = "iamtalhaasghar";
    repo = "yewtube";
-    rev = "v${version}";
-    hash = "sha256-8GL2ZvRHtnnLZ07nQk3irJUj+XLL+pyUUA+JJPICPRA=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-5+0OaoUan9IFEqtMvpvtkfpd7IbFJhG52oROER5TY20=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/cluster/civo/default.nix
+++ b/pkgs/applications/networking/cluster/civo/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "civo";
-  version = "1.0.45";
+  version = "1.0.47";

  src = fetchFromGitHub {
    owner  = "civo";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "sha256-wYZC4eEvxvHgtb0l+kpP2msQgt8InJu59lgS5cwGxRI=";
+    sha256 = "sha256-iowBEtO+Ol6mFJrwLaDa88wsQB8nZEe9OFPuhbH4t1s=";
  };

-  vendorHash = "sha256-42ZTPl4kI+dgr78s9WvLFchQU9uvkMkkio53REjvpbw=";
+  vendorHash = "sha256-QzTu6/iFK+CS8UXoXSVq3OTuwk/xcHnAX4UpCU/Scpk=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/k9s/default.nix
+++ b/pkgs/applications/networking/cluster/k9s/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "k9s";
-  version = "0.27.0";
+  version = "0.27.2";

  src = fetchFromGitHub {
    owner  = "derailed";
    repo   = "k9s";
    rev    = "v${version}";
-    sha256 = "sha256-optEMGB6izGlpcq2AJOY4lTt8igYBilE0Bg8KxE8AsU=";
+    sha256 = "sha256-9wdc3Wiqry8+q/60Y7mPzH0k4dp1nKIGinxfkYBaHJY=";
  };

  ldflags = [
@ -20,7 +20,7 @@ buildGoModule rec {

  tags = [ "netgo" ];

-  vendorHash = "sha256-57JrBmund2hwcgqWkLos/h1EOgZQb9HfKUf1BX0MYGQ=";
+  vendorHash = "sha256-8H7siVl6gXifQOBOLtyCeDbYflhKjaIRmP0KOTWVJk0=";

  # TODO investigate why some config tests are failing
  doCheck = !(stdenv.isDarwin && stdenv.isAarch64);
--- a/pkgs/applications/networking/cluster/stern/default.nix
+++ b/pkgs/applications/networking/cluster/stern/default.nix
@ -4,16 +4,16 @@ let isCrossBuild = stdenv.hostPlatform != stdenv.buildPlatform;
 in
 buildGoModule rec {
  pname = "stern";
-  version = "1.22.0";
+  version = "1.23.0";

  src = fetchFromGitHub {
    owner = "stern";
    repo = "stern";
    rev = "v${version}";
-    sha256 = "sha256-xO4I4fNf14ltiSnFnAhM8VYBw4JKB0RSQziSshZOFBo=";
+    sha256 = "sha256-tqp2H8aWPBgje1zIK673cbr+DShhTQL9VQ0dEL/he7s=";
  };

-  vendorSha256 = "sha256-tNx1BvZBblyLavFslhqj9DCyfcgbl6HxlZ7zceK1a0w=";
+  vendorHash = "sha256-ud07lWHwQfAHgVenUApwrfxmTjJKVm+pOExdR9pZFxA=";

  subPackages = [ "." ];

--- a/pkgs/applications/networking/ids/zeek/avoid-broken-tests.patch
+++ b/pkgs/applications/networking/ids/zeek/avoid-broken-tests.patch
@ -0,0 +1,16 @@
+diff --git a/auxil/spicy/spicy/hilti/toolchain/CMakeLists.txt b/auxil/spicy/spicy/hilti/toolchain/CMakeLists.txt
+index bafbabf1..0579f20a 100644
+--- a/auxil/spicy/spicy/hilti/toolchain/CMakeLists.txt
+++ b/auxil/spicy/spicy/hilti/toolchain/CMakeLists.txt
+@@ -188,11 +188,3 @@ install_headers(include hilti)
+ install_headers(${PROJECT_BINARY_DIR}/include/hilti hilti)
+ install(CODE "file(REMOVE \"\$ENV\{DESTDIR\}${CMAKE_INSTALL_FULL_INCLUDEDIR}/hilti/hilti\")"
+ )# Get rid of symlink.
+-
+-##### Tests
+-
+-add_executable(hilti-toolchain-tests tests/main.cc tests/id-base.cc tests/visitor.cc tests/util.cc)
+-hilti_link_executable_in_tree(hilti-toolchain-tests PRIVATE)
+-target_link_libraries(hilti-toolchain-tests PRIVATE doctest)
+-target_compile_options(hilti-toolchain-tests PRIVATE "-Wall")
+-add_test(NAME hilti-toolchain-tests COMMAND ${PROJECT_BINARY_DIR}/bin/hilti-toolchain-tests)
--- a/pkgs/applications/networking/ids/zeek/broker/0001-Fix-include-path-in-exported-CMake-targets.patch
+++ b/pkgs/applications/networking/ids/zeek/broker/0001-Fix-include-path-in-exported-CMake-targets.patch
@ -0,0 +1,75 @@
+From 889ee4dd9e778511e2fb850e6467f55a331cded9 Mon Sep 17 00:00:00 2001
+From: Tobias Mayer <tobim@fastmail.fm>
+Date: Sun, 13 Nov 2022 19:06:00 +0100
+Subject: [PATCH] Fix include path in exported CMake targets
+
+---
+ CMakeLists.txt | 23 ++++++++++++++---------
+ 1 file changed, 14 insertions(+), 9 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index e22b77aa..77a15314 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -209,7 +209,6 @@ if (CAF_ROOT)
+   else()
+     find_package(CAF REQUIRED COMPONENTS openssl test io core net)
+   endif()
+-  list(APPEND LINK_LIBS CAF::core CAF::io CAF::net)
+   set(BROKER_USE_EXTERNAL_CAF ON)
+ else ()
+   message(STATUS "Using bundled CAF")
+@@ -243,22 +242,18 @@ endif ()
+ 
+ # Make sure there are no old header versions on disk.
+ install(
+-  CODE "MESSAGE(STATUS \"Removing: ${CMAKE_INSTALL_PREFIX}/include/broker\")"
+-  CODE "file(REMOVE_RECURSE \"${CMAKE_INSTALL_PREFIX}/include/broker\")")
+  CODE "MESSAGE(STATUS \"Removing: ${CMAKE_FULL_INSTALL_INCLUDEDIR}/broker\")"
+  CODE "file(REMOVE_RECURSE \"${CMAKE_FULL_INSTALL_INCLUDEDIR}/broker\")")
+ 
+ # Install all headers except the files from broker/internal.
+ install(DIRECTORY include/broker
+-        DESTINATION include
+        DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}"
+         FILES_MATCHING PATTERN "*.hh"
+                        PATTERN "include/broker/internal" EXCLUDE)
+ 
+-include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}/include)
+-
+-include_directories(${CMAKE_CURRENT_BINARY_DIR}/include)
+-
+ configure_file(${CMAKE_CURRENT_SOURCE_DIR}/src/config.hh.in
+                ${CMAKE_CURRENT_BINARY_DIR}/include/broker/config.hh)
+-install(FILES ${CMAKE_CURRENT_BINARY_DIR}/include/broker/config.hh DESTINATION include/broker)
+install(FILES ${CMAKE_CURRENT_BINARY_DIR}/include/broker/config.hh DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/broker")
+ 
+ if (NOT BROKER_EXTERNAL_SQLITE_TARGET)
+   include_directories(BEFORE ${CMAKE_CURRENT_SOURCE_DIR}/3rdparty)
+@@ -360,6 +355,11 @@ if (ENABLE_SHARED)
+                         OUTPUT_NAME broker)
+   target_link_libraries(broker PUBLIC ${LINK_LIBS})
+   target_link_libraries(broker PRIVATE CAF::core CAF::io CAF::net)
+  target_include_directories(
+    broker PUBLIC
+      $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>
+      $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
+      $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
+   install(TARGETS broker
+           EXPORT BrokerTargets
+           DESTINATION ${CMAKE_INSTALL_LIBDIR})
+@@ -373,6 +373,11 @@ if (ENABLE_STATIC)
+   endif()
+   target_link_libraries(broker_static PUBLIC ${LINK_LIBS})
+   target_link_libraries(broker_static PRIVATE CAF::core CAF::io CAF::net)
+  target_include_directories(
+    broker_static PUBLIC
+      $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/include>
+      $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
+      $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>)
+   install(TARGETS broker_static
+           EXPORT BrokerTargets
+           DESTINATION ${CMAKE_INSTALL_LIBDIR})
+-- 
+2.38.1
+
--- a/pkgs/applications/networking/ids/zeek/broker/default.nix
+++ b/pkgs/applications/networking/ids/zeek/broker/default.nix
@ -0,0 +1,88 @@
+{ stdenv
+, lib
+, callPackage
+, fetchFromGitHub
+, cmake
+, pkg-config
+, python3
+, caf
+, openssl
+}:
+let
+  inherit (stdenv.hostPlatform) isStatic;
+
+  src-cmake = fetchFromGitHub {
+    owner = "zeek";
+    repo = "cmake";
+    rev = "0b7a543554622600bc0a42b57a22f291a4fbd86c";
+    hash = "sha256-kaBOBTpfR3XyuF4PW5NQKca/UhXXxJJcXVsErFU1VYY=";
+  };
+  src-3rdparty = fetchFromGitHub {
+    owner = "zeek";
+    repo = "zeek-3rdparty";
+    rev = "eb87829547270eab13c223e6de58b25bc9a0282e";
+    hash = "sha256-AVaKcRjF5ZiSR8aPSLBzSTeWVwGWW/aSyQJcN0Yhza0=";
+  };
+  caf' = caf.overrideAttrs (old: {
+    version = "unstable-2022-11-17-zeek";
+    src = fetchFromGitHub {
+      owner = "zeek";
+      repo = "actor-framework";
+      rev = "dbb68b4573736d7aeb69268cc73aa766c998b3dd";
+      hash = "sha256-RV2mKF3B47h/hDgK/D1UJN/ll2G5rcPkHaLVY1/C/Pg=";
+    };
+    checkPhase = ''
+      runHook preCheck
+      libcaf_core/caf-core-test
+      libcaf_io/caf-io-test
+      libcaf_openssl/caf-openssl-test
+      libcaf_net/caf-net-test --not-suites='net.*'
+      runHook postCheck
+    '';
+  });
+in
+stdenv.mkDerivation rec {
+  pname = "zeek-broker";
+  version = "2.4.2";
+  outputs = [ "out" "py" ];
+
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "zeek";
+    repo = "broker";
+    rev = "v${version}";
+    hash = "sha256-y07fJEVPDGPv5VThE45SwM342VS6LnEtMvazZHadM/k=";
+  };
+  postUnpack = ''
+    rmdir $sourceRoot/cmake $sourceRoot/3rdparty
+    ln -s ${src-cmake} ''${sourceRoot}/cmake
+    ln -s ${src-3rdparty} ''${sourceRoot}/3rdparty
+
+    # Refuses to build the bindings unless this file is present, but never
+    # actually uses it.
+    touch $sourceRoot/bindings/python/3rdparty/pybind11/CMakeLists.txt
+  '';
+
+  patches = [
+    ./0001-Fix-include-path-in-exported-CMake-targets.patch
+  ];
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ openssl python3.pkgs.pybind11 ];
+  propagatedBuildInputs = [ caf' ];
+
+  cmakeFlags = [
+    "-DCAF_ROOT=${caf'}"
+    "-DENABLE_STATIC_ONLY:BOOL=${if isStatic then "ON" else "OFF"}"
+    "-DPY_MOD_INSTALL_DIR=${placeholder "py"}/${python3.sitePackages}/"
+  ];
+
+  meta = with lib; {
+    description = "Zeek's Messaging Library";
+    homepage = "https://github.com/zeek/broker";
+    license = licenses.bsd3;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ tobim ];
+  };
+}
--- a/pkgs/applications/networking/ids/zeek/debug-runtime-undef-fortify-source.patch
+++ b/pkgs/applications/networking/ids/zeek/debug-runtime-undef-fortify-source.patch
@ -0,0 +1,26 @@
+diff --git a/auxil/spicy/spicy/hilti/runtime/CMakeLists.txt b/auxil/spicy/spicy/hilti/runtime/CMakeLists.txt
+index f154901c..76563717 100644
+--- a/auxil/spicy/spicy/hilti/runtime/CMakeLists.txt
+++ b/auxil/spicy/spicy/hilti/runtime/CMakeLists.txt
+@@ -69,7 +69,7 @@ target_compile_definitions(hilti-rt-objects PRIVATE "HILTI_RT_BUILD_TYPE_RELEASE
+ # Build hilti-rt-debug with debug flags.
+ string(REPLACE " " ";" cxx_flags_debug ${CMAKE_CXX_FLAGS_DEBUG})
+ target_compile_options(hilti-rt-debug-objects PRIVATE ${cxx_flags_debug})
+-target_compile_options(hilti-rt-debug-objects PRIVATE "-UNDEBUG;-O0;-Wall")
+target_compile_options(hilti-rt-debug-objects PRIVATE "-UNDEBUG;-O0;-Wall;-U_FORTIFY_SOURCE")
+ target_compile_definitions(hilti-rt-debug-objects PRIVATE "HILTI_RT_BUILD_TYPE_DEBUG")
+ 
+ add_library(hilti-rt-tests-library-dummy1 SHARED src/tests/library-dummy.cc)
+diff --git a/auxil/spicy/spicy/spicy/runtime/CMakeLists.txt b/auxil/spicy/spicy/spicy/runtime/CMakeLists.txt
+index 20e7d291..9712341f 100644
+--- a/auxil/spicy/spicy/spicy/runtime/CMakeLists.txt
+++ b/auxil/spicy/spicy/spicy/runtime/CMakeLists.txt
+@@ -48,7 +48,7 @@ target_link_libraries(spicy-rt-objects PUBLIC hilti-rt-objects)
+ # Build spicy-rt-debug with debug flags.
+ string(REPLACE " " ";" cxx_flags_debug ${CMAKE_CXX_FLAGS_DEBUG})
+ target_compile_options(spicy-rt-debug-objects PRIVATE ${cxx_flags_debug})
+-target_compile_options(spicy-rt-debug-objects PRIVATE "-UNDEBUG;-O0;-Wall")
+target_compile_options(spicy-rt-debug-objects PRIVATE "-UNDEBUG;-O0;-Wall;-U_FORTIFY_SOURCE")
+ target_compile_definitions(spicy-rt-debug-objects PRIVATE "HILTI_RT_BUILD_TYPE_DEBUG")
+ target_link_libraries(spicy-rt-debug-objects PUBLIC hilti-rt-debug-objects)
+ 
--- a/pkgs/applications/networking/ids/zeek/default.nix
+++ b/pkgs/applications/networking/ids/zeek/default.nix
@ -1,10 +1,13 @@
 { lib
 , stdenv
+, callPackage
 , fetchurl
 , cmake
 , flex
 , bison
+, spicy-parser-generator
 , openssl
+, libkqueue
 , libpcap
 , zlib
 , file
@ -16,46 +19,69 @@
 , gettext
 , coreutils
 , ncurses
-, caf
 }:

+let
+  broker = callPackage ./broker { };
+in
 stdenv.mkDerivation rec {
  pname = "zeek";
-  version = "4.2.2";
+  version = "5.1.2";

  src = fetchurl {
    url = "https://download.zeek.org/zeek-${version}.tar.gz";
-    sha256 = "sha256-9Q3X24uAmnSnLUAklK+gC0Mu8eh81ZE2h/7uIVc8cAw=";
+    sha256 = "sha256-1DvXUcTbLBm9UjJXuk8DjGEj+lED+s9D+SNnSqA3bwU=";
  };

+  strictDeps = true;
+
+  patches = [
+    ./avoid-broken-tests.patch
+    ./debug-runtime-undef-fortify-source.patch
+    ./fix-installation.patch
+  ];
+
  nativeBuildInputs = [
    bison
    cmake
    file
    flex
+    python3
  ];

  buildInputs = [
+    broker
+    spicy-parser-generator
    curl
    gperftools
+    libkqueue
    libmaxminddb
    libpcap
    ncurses
    openssl
-    python3
    swig
    zlib
  ] ++ lib.optionals stdenv.isDarwin [
    gettext
  ];

-  outputs = [ "out" "lib" "py" ];
+  postPatch = ''
+    patchShebangs ./auxil/spicy/spicy/scripts
+
+    substituteInPlace auxil/spicy/CMakeLists.txt --replace "hilti-toolchain-tests" ""
+    substituteInPlace auxil/spicy/spicy/hilti/CMakeLists.txt --replace "hilti-toolchain-tests" ""
+  '';

  cmakeFlags = [
-    "-DCAF_ROOT=${caf}"
-    "-DZEEK_PYTHON_DIR=${placeholder "py"}/lib/${python3.libPrefix}/site-packages"
+    "-DBroker_ROOT=${broker}"
+    "-DSPICY_ROOT_DIR=${spicy-parser-generator}"
+    "-DLIBKQUEUE_ROOT_DIR=${libkqueue}"
    "-DENABLE_PERFTOOLS=true"
    "-DINSTALL_AUX_TOOLS=true"
+    "-DZEEK_ETC_INSTALL_DIR=/etc/zeek"
+    "-DZEEK_LOG_DIR=/var/log/zeek"
+    "-DZEEK_STATE_DIR=/var/lib/zeek"
+    "-DZEEK_SPOOL_DIR=/var/spool/zeek"
  ];

  postInstall = ''
@ -70,6 +96,10 @@ stdenv.mkDerivation rec {
    done
  '';

+  passthru = {
+    inherit broker;
+  };
+
  meta = with lib; {
    description = "Network analysis framework much different from a typical IDS";
    homepage = "https://www.zeek.org";
--- a/pkgs/applications/networking/ids/zeek/fix-installation.patch
+++ b/pkgs/applications/networking/ids/zeek/fix-installation.patch
@ -0,0 +1,28 @@
+From f8c42a712db42cfd00fca75be2ce63c3aad2aad1 Mon Sep 17 00:00:00 2001
+From: Tobias Mayer <tobim@fastmail.fm>
+Date: Sun, 13 Nov 2022 21:48:36 +0100
+Subject: [PATCH] Fix installation
+
+---
+ CMakeLists.txt | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 846b65efd..d8b0be169 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -81,11 +81,6 @@ if ( NOT ZEEK_LOG_DIR )
+     set(ZEEK_LOG_DIR ${ZEEK_ROOT_DIR}/logs)
+ endif ()
+ 
+-install(DIRECTORY DESTINATION ${ZEEK_ETC_INSTALL_DIR})
+-install(DIRECTORY DESTINATION ${ZEEK_STATE_DIR})
+-install(DIRECTORY DESTINATION ${ZEEK_SPOOL_DIR})
+-install(DIRECTORY DESTINATION ${ZEEK_LOG_DIR})
+-
+ configure_file(zeek-path-dev.in ${CMAKE_CURRENT_BINARY_DIR}/zeek-path-dev)
+ execute_process(COMMAND "${CMAKE_COMMAND}" -E create_symlink
+                 "${CMAKE_CURRENT_BINARY_DIR}/zeek-wrapper.in"
+-- 
+2.37.3
+
--- a/pkgs/applications/networking/instant-messengers/armcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/armcord/default.nix
@ -33,6 +33,8 @@
 , systemd
 , xdg-utils
 , xorg
+, wayland
+, pipewire
 }:

 stdenv.mkDerivation rec {
@ -97,6 +99,8 @@ stdenv.mkDerivation rec {
    xorg.libXScrnSaver
    xorg.libxshmfence
    xorg.libXtst
+    wayland
+    pipewire
  ];

  sourceRoot = ".";
@ -114,9 +118,9 @@ stdenv.mkDerivation rec {
    makeWrapper $out/opt/ArmCord/armcord $out/bin/armcord \
      "''${gappsWrapperArgs[@]}" \
      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}/" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=UseOzonePlatform --enable-features=WebRTCPipeWireCapturer }}" \
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath buildInputs}" \
-      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
-      "''${gappsWrapperArgs[@]}"
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}

    # Fix desktop link
    substituteInPlace $out/share/applications/armcord.desktop \
--- a/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "signalbackup-tools";
-  version = "20230128-1";
+  version = "20230203";

  src = fetchFromGitHub {
    owner = "bepaald";
    repo = pname;
    rev = version;
-    sha256 = "sha256-wYhftShCL9XozK0c7OLijqzveDvEvv9stpw+6CQND/Y=";
+    sha256 = "sha256-xXIdXv2U5VpRSuJ9Kl6HMDBZGpXRYGPZFBBk9QYODtU=";
  };

  postPatch = ''
--- a/pkgs/applications/networking/irc/senpai/default.nix
+++ b/pkgs/applications/networking/irc/senpai/default.nix
@ -32,6 +32,6 @@ buildGoModule rec {
    description = "Your everyday IRC student";
    homepage = "https://ellidri.org/senpai";
    license = licenses.isc;
-    maintainers = with maintainers; [ malvo ];
+    maintainers = with maintainers; [ malte-v ];
  };
 }
--- a/pkgs/applications/networking/mailreaders/mblaze/default.nix
+++ b/pkgs/applications/networking/mailreaders/mblaze/default.nix
@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
  version = "1.2";

  nativeBuildInputs = [ installShellFiles makeWrapper ];
-  buildInputs = [ ruby ] ++ lib.optionals stdenv.isDarwin [ libiconv ];
+  buildInputs = [ libiconv ruby ];

  src = fetchFromGitHub {
    owner = "leahneukirchen";
--- a/pkgs/applications/networking/seaweedfs/default.nix
+++ b/pkgs/applications/networking/seaweedfs/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "seaweedfs";
-  version = "3.40";
+  version = "3.41";

  src = fetchFromGitHub {
    owner = "seaweedfs";
    repo = "seaweedfs";
    rev = version;
-    hash = "sha256-eU1RnLjPSAdtv+EqVnIpOLsDfBjx4WHFnHHkGZfr130=";
+    hash = "sha256-sNeuIcRJ249F9m7NBi5Vh4HMhWwDpNHAZsit1auVI5U=";
  };

-  vendorHash = "sha256-tKq5QEd7f4q7q2EDNjNrlatQ7+lXF9ya9L0iTP/AXSo=";
+  vendorHash = "sha256-ZtHgZ0Mur102H2EvifsK3HYUQaI1dFMh/6eiJO09HBc=";

  subPackages = [ "weed" ];

--- a/pkgs/applications/networking/soju/default.nix
+++ b/pkgs/applications/networking/soju/default.nix
@ -60,6 +60,6 @@ buildGoModule rec {
    homepage = "https://soju.im";
    changelog = "https://git.sr.ht/~emersion/soju/refs/${src.rev}";
    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ azahi malvo ];
+    maintainers = with maintainers; [ azahi malte-v ];
  };
 }
--- a/pkgs/applications/networking/warp/default.nix
+++ b/pkgs/applications/networking/warp/default.nix
@ -17,14 +17,14 @@

 stdenv.mkDerivation rec {
  pname = "warp";
-  version = "0.3.2";
+  version = "0.4";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-oKkZC9fi5xPnLTI00MnG2gMjzMZHMNFI77ztbR4KQo4=";
+    hash = "sha256-c8X0kedfM8DPTEQAbh8cXIfEvxG2cdUD3twVHs0/k7U";
  };

  postPatch = ''
@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-sbyAyjxpol2SBxoLUsiPGfkP2diBPgJW0vEDHYWgmLU=";
+    hash = "sha256-TS/Q6T3bPjkk1bfINTR6bcPy8fnbAxbKJUrx2pYsPWY=";
  };

  nativeBuildInputs = [
@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
    description = "Fast and secure file transfer";
    homepage = "https://apps.gnome.org/app/app.drey.Warp";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ dotlambda ];
+    maintainers = with lib.maintainers; [ dotlambda foo-dogsquared ];
    platforms = lib.platforms.linux;
  };
 }
--- a/pkgs/applications/office/paper-note/default.nix
+++ b/pkgs/applications/office/paper-note/default.nix
@ -49,13 +49,10 @@ stdenv.mkDerivation rec {
      --replace "1.2.0" "${libadwaita.version}"
  '';

-  postInstall = ''
-    ln -s $out/bin/io.posidon.Paper $out/bin/paper
-  '';
-
  meta = with lib; {
-    description = "Take notes in Markdown";
-    homepage = "https://posidon.io/paper/";
+    description = "A pretty note-taking app for GNOME";
+    homepage = "https://gitlab.com/posidon_software/paper";
+    mainProgram = "io.posidon.Paper";
    license = licenses.gpl3;
    platforms = platforms.unix;
    maintainers = with maintainers; [ j0lol ];
--- a/pkgs/applications/office/treesheets/default.nix
+++ b/pkgs/applications/office/treesheets/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "treesheets";
-  version = "unstable-2023-01-23";
+  version = "unstable-2023-01-31";

  src = fetchFromGitHub {
    owner = "aardappel";
    repo = "treesheets";
-    rev = "f676cba7f9749825744ec705ee58b9fbea47db51";
-    sha256 = "Zx1fGicCuX+HJm2QFSYQhcd9Ibg3qj5h9NPlSNNVLag=";
+    rev = "44206849d03c8983e41d2aeca70a06e04365d88d";
+    sha256 = "bUyM0zWVO7HWBiWi0mhkDlVxgqMHoFiR78XpiG8q/V4=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/radio/gridtracker/default.nix
+++ b/pkgs/applications/radio/gridtracker/default.nix
@ -1,18 +1,19 @@
 { lib
 , stdenv
 , fetchFromGitLab
+, nix-update-script
 , nwjs
 }:

 stdenv.mkDerivation rec {
  pname = "gridtracker";
-  version = "1.23.0110";
+  version = "1.23.0206";

  src = fetchFromGitLab {
    owner = "gridtracker.org";
    repo = "gridtracker";
    rev = "v${version}";
-    sha256 = "sha256-yQWdBNt7maYTzroB+P1hsGIeivkP+soR3/b847HLYZY=";
+    sha256 = "sha256-XWjKJga9aQrMb0ZfA4ElsPU1CfMwFtwYSK1vjgtlKes=";
  };

  postPatch = ''
@ -27,6 +28,8 @@ stdenv.mkDerivation rec {

  makeFlags = [ "DESTDIR=$(out)" "NO_DIST_INSTALL=1" ];

+  passthru.updateScript = nix-update-script { };
+
  meta = with lib; {
    description = "An amateur radio companion to WSJT-X or JTDX";
    longDescription = ''
--- a/pkgs/applications/science/astronomy/kstars/default.nix
+++ b/pkgs/applications/science/astronomy/kstars/default.nix
@ -14,11 +14,11 @@

 mkDerivation rec {
  pname = "kstars";
-  version = "3.6.1";
+  version = "3.6.3";

  src = fetchurl {
    url = "mirror://kde/stable/kstars/kstars-${version}.tar.xz";
-    sha256 = "sha256-WWbtfqvGd13+a41z8/MjlchllpuhLX08nu15OlYUeuI=";
+    sha256 = "sha256-sve9q4iM/Y8+K64Ceby/KGx5Un5G0o5cCnIxJkXTgug=";
  };

  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
--- a/pkgs/applications/science/biology/igv/default.nix
+++ b/pkgs/applications/science/biology/igv/default.nix
@ -2,10 +2,10 @@

 stdenv.mkDerivation rec {
  pname = "igv";
-  version = "2.15.5";
+  version = "2.16.0";
  src = fetchzip {
    url = "https://data.broadinstitute.org/igv/projects/downloads/${lib.versions.majorMinor version}/IGV_${version}.zip";
-    sha256 = "sha256-AKKMtR0hU2O84mRJxxsXNCYHeW8d6t3XJpzOKKaxAWw=";
+    sha256 = "sha256-pfFUtPgHzTWMm3sh4un8SwSYF8HM30HbAQznxlu4Irw=";
  };

  installPhase = ''
--- a/pkgs/applications/science/electronics/digital/default.nix
+++ b/pkgs/applications/science/electronics/digital/default.nix
@ -4,8 +4,8 @@

 let
  pkgDescription = "A digital logic designer and circuit simulator.";
-  version = "0.29";
-  buildDate = "2022-02-11T18:10:34+01:00"; # v0.29 commit date
+  version = "0.30";
+  buildDate = "2023-02-03T08:00:56+01:00"; # v0.30 commit date

  desktopItem = makeDesktopItem {
    type = "Application";
@ -24,7 +24,8 @@ let
  # inspect the .git folder to find the version number we are building, we then
  # provide that version number manually as a property.
  # (see https://github.com/hneemann/Digital/issues/289#issuecomment-513721481)
-  mvnOptions = "-Pno-git-rev -Dgit.commit.id.describe=${version} -Dproject.build.outputTimestamp=${buildDate}";
+  # Also use the commit date as a build and output timestamp.
+  mvnOptions = "-Pno-git-rev -Dgit.commit.id.describe=${version} -Dproject.build.outputTimestamp=${buildDate} -DbuildTimestamp=${buildDate}";
 in
 stdenv.mkDerivation rec {
  pname = "digital";
@ -33,20 +34,16 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "hneemann";
    repo = "Digital";
-    rev = "287dd939d6f2d4d02c0d883c6178c3425c28d39c";
-    sha256 = "o5gaExUTTbk6WgQVw7/IeXhpNkj1BLkwD752snQqjIg=";
+    rev = "932791eb6486d04f2ea938d83bcdb71b56d3a3f6";
+    sha256 = "cDykYlcFvDLFBy9UnX07iCR2LCq28SNU+h9vRT/AoJM=";
  };

-  # Use fixed dates in the pom.xml and upgrade the jar and assembly plugins to
-  # a version where they support reproducible builds
-  patches = [ ./pom.xml.patch ];
-
  # Fetching maven dependencies from "central" needs the network at build phase,
  # we do that in this extra derivation that explicitely specifies its
  # outputHash to ensure determinism.
  mavenDeps = stdenv.mkDerivation {
    name = "${pname}-${version}-maven-deps";
-    inherit src nativeBuildInputs version patches postPatch;
+    inherit src nativeBuildInputs version;
    dontFixup = true;
    buildPhase = ''
      mvn package ${mvnOptions} -Dmaven.repo.local=$out
@ -62,15 +59,11 @@ stdenv.mkDerivation rec {
    '';
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
-    outputHash = "X5ppGUVwNQrMnjzD4Kin1Xmt4O3x+qr7jK4jr6E8tCI=";
+    outputHash = "1Cgw+5V2E/RENMRMm368+2yvY7y6v9gTlo+LRgrCXcE=";
  };

  nativeBuildInputs = [ copyDesktopItems maven makeWrapper ];

-  postPatch = ''
-    substituteInPlace pom.xml --subst-var-by buildDate "${buildDate}"
-  '';
-
  buildPhase = ''
    mvn package --offline ${mvnOptions} -Dmaven.repo.local=${mavenDeps}
  '';
--- a/pkgs/applications/science/electronics/digital/pom.xml.patch
+++ b/pkgs/applications/science/electronics/digital/pom.xml.patch
@ -1,30 +0,0 @@
-diff --git a/pom.xml b/pom.xml
-index d5f8330b4..58ed18b63 100644
--- a/pom.xml
-+++ b/pom.xml
-@@ -129,7 +130,7 @@
-             <plugin>
-                 <groupId>org.apache.maven.plugins</groupId>
-                 <artifactId>maven-jar-plugin</artifactId>
-                <version>2.5</version>
-+                <version>3.2.0</version>
-                 <configuration>
-                     <archive>
-                         <manifest>
-@@ -188,6 +189,7 @@
-             <plugin>
-                 <groupId>org.apache.maven.plugins</groupId>
-                 <artifactId>maven-assembly-plugin</artifactId>
-+                <version>3.2.0</version>
-                 <configuration>
-                     <finalName>Digital</finalName>
-                     <appendAssemblyId>false</appendAssemblyId>
-@@ -202,7 +204,7 @@
-                         </manifest>
-                         <manifestEntries>
-                             <Build-SCM-Revision>${git.commit.id.describe}</Build-SCM-Revision>
-                            <Build-Time>${maven.build.timestamp}</Build-Time>
-+                            <Build-Time>@buildDate@</Build-Time>
-                             <SplashScreen-Image>icons/splash.png</SplashScreen-Image>
-                         </manifestEntries>
-                     </archive>
--- a/pkgs/applications/science/math/pari/default.nix
+++ b/pkgs/applications/science/math/pari/default.nix
@ -14,7 +14,7 @@ assert withThread -> libpthreadstubs != null;

 stdenv.mkDerivation rec {
  pname = "pari";
-  version = "2.15.1";
+  version = "2.15.2";

  src = fetchurl {
    urls = [
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
      # old versions are at the url below
      "https://pari.math.u-bordeaux.fr/pub/pari/OLD/${lib.versions.majorMinor version}/${pname}-${version}.tar.gz"
    ];
-    hash = "sha256-RUGdt3xmhb7mfkLg7LeOGe9WK+eq/GN8ikGXDy6Qnj0=";
+    hash = "sha256-sEYoER7iKHZRmksc2vsy/rqjTq+iT56B9Y+NBX++4N0=";
  };

  buildInputs = [
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@ -97,8 +97,7 @@ buildPythonApplication rec {
  hardeningDisable = lib.optional stdenv.cc.isClang "strictoverflow";

  CGO_ENABLED = 0;
-  GO_FLAGS = "-trimpath";
-  disallowedReferences = [ go ];
+  GOFLAGS = "-trimpath";

  configurePhase = let
    goModules = (buildGoModule {
--- a/pkgs/applications/version-management/tig/default.nix
+++ b/pkgs/applications/version-management/tig/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "tig";
-  version = "2.5.7";
+  version = "2.5.8";

  src = fetchFromGitHub {
    owner = "jonas";
    repo = pname;
    rev = "${pname}-${version}";
-    sha256 = "sha256-D5NQaxkGhwyBoScI7fZxnSHC0ABmsUeRf8pZCKooV3w=";
+    sha256 = "sha256-VuuqR5fj0YvqIfVPH7N3rpAfIbcTwOx9W3H60saCToQ=";
  };

  nativeBuildInputs = [ makeWrapper autoreconfHook asciidoc xmlto docbook_xsl docbook_xml_dtd_45 findXMLCatalogs pkg-config ];
--- a/pkgs/applications/video/makemkv/default.nix
+++ b/pkgs/applications/video/makemkv/default.nix
@ -14,21 +14,21 @@
 }:

 let
-  version = "1.17.2";
+  version = "1.17.3";
  # Using two URLs as the first one will break as soon as a new version is released
  src_bin = fetchurl {
    urls = [
      "http://www.makemkv.com/download/makemkv-bin-${version}.tar.gz"
      "http://www.makemkv.com/download/old/makemkv-bin-${version}.tar.gz"
    ];
-    sha256 = "sha256-gACMzJ7oZCk/INSeJaV7GnF9hy/6F9d0QDLp5jPiF4k=";
+    sha256 = "1cd633bfb381faa4f22ab57f6b75053c1b18997c223ed7988896c8c15cd1bee0";
  };
  src_oss = fetchurl {
    urls = [
      "http://www.makemkv.com/download/makemkv-oss-${version}.tar.gz"
      "http://www.makemkv.com/download/old/makemkv-oss-${version}.tar.gz"
    ];
-    sha256 = "sha256-qD+Kuz8j3vDch4PlNQYqdbffL3YSKRqKg6IfkLk/LaQ=";
+    sha256 = "16be3ee29c1dd3d5292f793e9f5efbcd30a59bf035de79586e9afbfa98a6a4cb";
  };

 in mkDerivation {
--- a/pkgs/build-support/fetchmavenartifact/default.nix
+++ b/pkgs/build-support/fetchmavenartifact/default.nix
@ -43,13 +43,15 @@ let
      (lib.replaceStrings ["."] ["_"] artifactId) "-"
      version
    ];
+  suffix = if isNull classifier then "" else "-${classifier}";
+  filename = "${artifactId}-${version}${suffix}.jar";
  mkJarUrl = repoUrl:
    lib.concatStringsSep "/" [
      (lib.removeSuffix "/" repoUrl)
      (lib.replaceStrings ["."] ["/"] groupId)
      artifactId
      version
-      "${artifactId}-${version}${lib.optionalString (!isNull classifier) "-${classifier}"}.jar"
+      filename
    ];
  urls_ =
    if url != "" then [url]
@ -68,7 +70,7 @@ in
    # packages packages that mention this derivation in their buildInputs.
    installPhase = ''
      mkdir -p $out/share/java
-      ln -s ${jar} $out/share/java/${artifactId}-${version}.jar
+      ln -s ${jar} $out/share/java/${filename}
    '';
    # We also add a `jar` attribute that can be used to easily obtain the path
    # to the downloaded jar file.
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@ -509,8 +509,8 @@ rec {
      ''
        mkdir -p $out
        for i in $(cat $pathsPath); do
-          ${lndir}/bin/lndir -silent $i $out
-        done
+          ${lndir}/bin/lndir $i $out
+        done 2>&1 | sed 's/^/symlinkJoin: warning: keeping existing file: /'
        ${postBuild}
      '';

--- a/pkgs/data/fonts/blackout/default.nix
+++ b/pkgs/data/fonts/blackout/default.nix
@ -0,0 +1,36 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "blackout";
+  version = "2014-07-29";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "4864cfc1749590e9f78549c6e57116fe98480c0f";
+    hash = "sha256-UmJVmtuPQYW/w+mdnJw9Ql4R1xf/07l+/Ky1wX9WKqw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A bad-ass, unholy-mother-shut-your-mouth stencil sans-serif";
+    longDescription = ''
+      Eats holes for breakfast lunch and dinner. Inspired by filling in
+      sans-serif newspaper headlines. Continually updated with coffee and
+      music. Makes your work louder than the next person’s.
+
+      Comes in three styles: Midnight (solid), 2AM (reversed), & Sunrise
+      (stroked).
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/blackout";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/chunk/default.nix
+++ b/pkgs/data/fonts/chunk/default.nix
@ -0,0 +1,38 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "chunk";
+  version = "2021-03-03";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "12a243f3fb7c7a68844901023f7d95d6eaf14104";
+    hash = "sha256-NMkRvrUgy9yzOT3a1rN6Ch/p8Cr902CwL4G0w7jVm1E=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "An ultra-bold, ultra-awesome slab serif typeface";
+    longDescription = ''
+      Chunk is an ultra-bold slab serif typeface that is reminiscent of old
+      American Western woodcuts, broadsides, and newspaper headlines. Used
+      mainly for display, the fat block lettering is unreserved yet refined for
+      contemporary use.
+
+      In 2014, a new textured style was created by Tyler Finck called Chunk
+      Five Print. It contains the same glyphs as the original.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/chunk";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/fanwood/default.nix
+++ b/pkgs/data/fonts/fanwood/default.nix
@ -0,0 +1,32 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "fanwood";
+  version = "2011-05-11";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "cbaaed9704e7d37d3dcdbdf0b472e9efd0e39432";
+    hash = "sha256-OroFhhb4RxPHkx+/8PtFnxs1GQVXMPiYTd+2vnRbIjg=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A serif based on the work of a famous Czech-American type designer of yesteryear";
+    longDescription = ''
+      Based on work of a famous Czech-American type designer of yesteryear. The
+      package includes roman and italic.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/fanwood";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/goudy-bookletter-1911/default.nix
+++ b/pkgs/data/fonts/goudy-bookletter-1911/default.nix
@ -0,0 +1,28 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "goudy-bookletter-1911";
+  version = "2011-05-11";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "85ff5b834b4f63feb36fd2053949c19660580e48";
+    hash = "sha256-11axs1+SRQj+1lYTq2LYf1I65WrrvB/UnAgZkHPP1N8=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A public domain font based on Frederic Goudy’s Kennerley Oldstyle";
+    homepage = "https://www.theleagueofmoveabletype.com/goudy-bookletter-1911";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/junction/default.nix
+++ b/pkgs/data/fonts/junction/default.nix
@ -0,0 +1,34 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "junction";
+  version = "2014-05-29";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "fb73260e86dd301b383cf6cc9ca8e726ef806535";
+    hash = "sha256-Zqh23HPWGed+JkADYjYdsVNRxqJDvC9xhnqAqWZ3Eu8=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Junction is a a humanist sans-serif font";
+    longDescription = ''
+      Junction is a a humanist sans-serif, and the first open-source type
+      project started by The League of Moveable Type. It has been updated
+      (2014) to include additional weights (light/bold) and expanded
+      international support.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/junction";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/knewave/default.nix
+++ b/pkgs/data/fonts/knewave/default.nix
@ -0,0 +1,32 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "knewave";
+  version = "2012-07-30";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "f335d5ff1f12e4acf97d4208e1c37b4d386e57fb";
+    hash = "sha256-SaJU2GlxU7V3iJNQzFKg1YugaPsiJuSZpC8NCqtWyz0=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = " A bold, painted face for the rocker within";
+    longDescription = ''
+      Knewave is bold, painted face. Get it? Git it.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/knewave";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/league-gothic/default.nix
+++ b/pkgs/data/fonts/league-gothic/default.nix
@ -0,0 +1,39 @@
+{ lib, fetchzip, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "league-gothic";
+  version = "1.601";
+
+  src = fetchzip {
+    url = "https://github.com/theleagueof/league-gothic/releases/download/${self.version}/LeagueGothic-${self.version}.tar.xz";
+    hash = "sha256-emkXKyQw4R0Zgg02oJsvBkqV0jmczP0tF0K2IKqJHMA=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/static/TTF/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/static/OTF/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A revival of an old classic, Alternate Gothic #1";
+    longDescription = ''
+      League Gothic is a revival of an old classic, and one of our favorite
+      typefaces, Alternate Gothic #1. It was originally designed by Morris
+      Fuller Benton for the American Type Founders Company in 1903. The company
+      went bankrupt in 1993, and since the original typeface was created before
+      1923, the typeface is in the public domain.
+
+      We decided to make our own version, and contribute it to the Open Source
+      Type Movement. Thanks to a commission from the fine & patient folks over
+      at WND.com, it’s been revised & updated with contributions from Micah
+      Rich, Tyler Finck, and Dannci, who contributed extra glyphs.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/league-gothic";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/league-of-moveable-type/default.nix
+++ b/pkgs/data/fonts/league-of-moveable-type/default.nix
@ -1,35 +1,46 @@
-{lib, stdenv, fetchurl, unzip, raleway}:
+{ lib
+, symlinkJoin
+, the-neue-black
+, blackout
+, chunk
+, fanwood
+, goudy-bookletter-1911
+, junction-font
+, knewave
+, league-gothic
+, league-script-number-one
+, league-spartan
+, linden-hill
+, orbitron
+, ostrich-sans
+, prociono
+, raleway
+, sniglet
+, sorts-mill-goudy
+}:

-let
+symlinkJoin {
+  name = "league-of-moveable-type";

-  # TO UPDATE:
-  # ./update.sh > ./fonts.nix
-  # we use the extended version of raleway (same license).
-  fonts = [raleway]
-    ++ map fetchurl (builtins.filter (f: f.name != "raleway.zip") (import ./fonts.nix));
-
-in
-stdenv.mkDerivation rec {
-
-  baseName = "league-of-moveable-type";
-  version = "2016-10-15";
-  name="${baseName}-${version}";
-
-  srcs = fonts;
-
-  nativeBuildInputs = [ unzip ];
-  sourceRoot = ".";
-
-  installPhase = ''
-    mkdir -p $out/share/fonts/opentype
-    cp */*.otf $out/share/fonts/opentype
-    # for Raleway, where the fonts are already in /share/…
-    cp */share/fonts/opentype/*.otf $out/share/fonts/opentype
-  '';
-
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "1gy959qhhdwm1phbrkab9isi0dmxcy0yizzncb0k49w88mc13vd0";
+  paths = [
+    the-neue-black
+    blackout
+    chunk
+    fanwood
+    goudy-bookletter-1911
+    junction-font
+    knewave
+    league-gothic
+    league-script-number-one
+    league-spartan
+    linden-hill
+    orbitron
+    ostrich-sans
+    prociono
+    raleway
+    sniglet
+    sorts-mill-goudy
+  ];

  meta = {
    description = "Font Collection by The League of Moveable Type";
@ -46,6 +57,6 @@ stdenv.mkDerivation rec {
    license = lib.licenses.ofl;

    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ bergey Profpatsch ];
+    maintainers = with lib.maintainers; [ bergey minijackson Profpatsch ];
  };
 }
--- a/pkgs/data/fonts/league-of-moveable-type/fonts.nix
+++ b/pkgs/data/fonts/league-of-moveable-type/fonts.nix
@ -1,82 +0,0 @@
-[
-  {
-    url = "https://www.theleagueofmoveabletype.com/league-spartan/download";
-    sha256 = "1z9pff8xm58njs7whaxb3sq4vbdkxv7llwgm9nqhwshmgr52jrm1";
-    name = "league-spartan.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/junction/download";
-    sha256 = "1qbhfha012ma26n43lm1fh06i7z47wk50r8qsp09bpxc5yr4ypi7";
-    name = "junction.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/ostrich-sans/download";
-    sha256 = "11ydhbgcfhmydcnim64vb035cha14krxxrbf62426dm6bvxkphp3";
-    name = "ostrich-sans.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/league-gothic/download";
-    sha256 = "0nbwsbwhs375kbis3lpk98dw05mnh455vghjg1cq0j2fsj1zb99b";
-    name = "league-gothic.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/blackout/download";
-    sha256 = "1r7dihnjvy4fgvaj5m4llc9dm4cpdl1l79mhg3as16qvjgazms3p";
-    name = "blackout.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/knewave/download";
-    sha256 = "065yiakhm6h6jkmigj4pqm2qi6saph0pwb7g8s9gwkskhkk5iy57";
-    name = "knewave.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/fanwood/download";
-    sha256 = "1023da7hik8ci8s7rcy6lh4h9p6igx1kz9y1a2cv6sizbp819w8g";
-    name = "fanwood.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/linden-hill/download";
-    sha256 = "0rm92rz9kki91l5wcn149mdpwq1mfql4dv6d159hv534qmg3z3ks";
-    name = "linden-hill.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/league-script-number-one/download";
-    sha256 = "056hb02a5vydrq5q0gwzanp2zkrrv1spm8sfc5wzhyfzgwd1vc76";
-    name = "league-script-number-one.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/raleway/download";
-    sha256 = "0f6anym0adq0ankqbdqx4lyzbysx824zqdj1x60gafyisjx48y87";
-    name = "raleway.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/prociono/download";
-    sha256 = "11hamjry5lx3cykzpjq7kwlp6h9cjqy470fmn9f2pi954b46xkdy";
-    name = "prociono.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/orbitron/download";
-    sha256 = "156w4j324d350pvjmzdg2w8inhhdfzrvb86rhlavgd9sxx2fykk4";
-    name = "orbitron.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/goudy-bookletter-1911/download";
-    sha256 = "01qganq5n7rgqw546lf45kj8j7ymfjr00i2bwp3qw7ibifg9pn4n";
-    name = "goudy-bookletter-1911.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/sorts-mill-goudy/download";
-    sha256 = "11aywj5lzapk04k2yzi1g96acbbm48x902ka0v9cfwwqpn6js9ra";
-    name = "sorts-mill-goudy.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/chunk/download";
-    sha256 = "15mbqwz90y1n4vlj2xkc8vd56va6la5qnxhiipvcmkrng5y3931j";
-    name = "chunk.zip";
-  }
-  {
-    url = "https://www.theleagueofmoveabletype.com/sniglet/download";
-    sha256 = "1lhpnjm52gyhy9s2kwbsg1rd9iyrqli5q9ngp141igx4p1bgbqkc";
-    name = "sniglet.zip";
-  }
-]
--- a/pkgs/data/fonts/league-of-moveable-type/update.sh
+++ b/pkgs/data/fonts/league-of-moveable-type/update.sh
@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-
-SITE=https://www.theleagueofmoveabletype.com
-
-# since there is no nice way to get all the fonts,
-# this fetches the homepage and extracts their names from the html …
-fonts=$(curl "$SITE" 2>/dev/null | \
-            sed -ne 's/<img.*cloudfront.*images\/\(.*\)-[[:digit:]-]\..*$/\1/p')
-
-# build an ad-hoc nixexpr list with the files & hashes
-echo "["
-for f in $fonts; do
-    url="$SITE/$f/download"
-    hash=$(nix-prefetch-url --type sha256 "$url" 2>/dev/null)
-    cat <<EOF
-  {
-    url = "$url";
-    sha256 = "$hash";
-    name = "$f.zip";
-  }
-EOF
-done
-echo "]"
-
-
--- a/pkgs/data/fonts/league-script-number-one/default.nix
+++ b/pkgs/data/fonts/league-script-number-one/default.nix
@ -0,0 +1,35 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "league-script-number-one";
+  version = "2011-05-25";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "225add0b37cf8268759ba4572e02630d9fb54ecf";
+    hash = "sha256-Z3Zrp0Os3On0tESVical1Qh6wY1H2Hc0OPTlkbtsrCI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A modern, coquettish script font";
+    longDescription = ''
+      This ain’t no Lucinda. League Script #1 is a modern, coquettish script
+      font that sits somewhere between your high school girlfriend’s love notes
+      and handwritten letters from the ’20s. Designed exclusively for the
+      League of Moveable Type, it includes ligatures and will act as the
+      framework for future script designs.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/league-script";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/league-spartan/default.nix
+++ b/pkgs/data/fonts/league-spartan/default.nix
@ -0,0 +1,40 @@
+{ lib, fetchzip, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "league-spartan";
+  version = "2.220";
+
+  src = fetchzip {
+    url = "https://github.com/theleagueof/league-spartan/releases/download/${self.version}/LeagueSpartan-${self.version}.tar.xz";
+    hash = "sha256-dkvWRYli8vk+E0DkZ2NWCJKfSfdo4jEcGo0puQpFVVc=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/static/TTF/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/static/OTF/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A fantastic new revival of ATF's classic Spartan, a geometric sans-serif that has no problem kicking its enemies in the chest.";
+    longDescription = ''
+      A new classic, this is a bold, modern, geometric sans-serif that has no
+      problem kicking its enemies in the chest.
+
+      Taking a strong influence from ATF's classic Spartan family, we're
+      starting our own family out with a single strong weight. We've put a few
+      unique touches into a beautiful, historical typeface, and made sure to
+      include an extensive characterset – currently totaling over 300 glyphs.
+
+      Over time, the open-source license will allow us expand League Spartan
+      into a full family, with multiple weights and styles, and we're starting
+      by releasing our first Bold style for this exciting, modern classic now.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/league-spartan";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/linden-hill/default.nix
+++ b/pkgs/data/fonts/linden-hill/default.nix
@ -0,0 +1,32 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "linden-hill";
+  version = "2011-05-25";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "a3f7ae6c4cac1b7e5ce5269e1fcc6a2fbb9e31ee";
+    hash = "sha256-EjXcLjzVQeOJgLxGua8t0oMc+APOsONGGpG6VJVCgFw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A digital version of Frederic Goudy’s Deepdene";
+    longDescription = ''
+      Linden Hill is a digital version of Frederic Goudy’s Deepdene. The
+      package includes roman and italic.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/linden-hill";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/orbitron/default.nix
+++ b/pkgs/data/fonts/orbitron/default.nix
@ -1,21 +1,21 @@
 { lib, stdenvNoCC, fetchFromGitHub }:

-stdenvNoCC.mkDerivation {
+stdenvNoCC.mkDerivation (self: {
  pname = "orbitron";
-  version = "20110526";
+  version = "2011-05-25";

  src = fetchFromGitHub {
    owner = "theleagueof";
-    repo = "orbitron";
-    rev = "13e6a52";
+    repo = self.pname;
+    rev = "13e6a5222aa6818d81c9acd27edd701a2d744152";
    hash = "sha256-zjNPVrDUxcQbrsg1/8fFa6Wenu1yuG/XDfKA7NVZ0rA=";
  };

  installPhase = ''
    runHook preInstall

-    install -m444 -Dt $out/share/fonts/opentype/orbitron *.otf
-    install -m444 -Dt $out/share/fonts/ttf/orbitron      *.ttf
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf

    runHook postInstall
  '';
@ -43,6 +43,6 @@ stdenvNoCC.mkDerivation {
    '';
    license = licenses.ofl;
    platforms = platforms.all;
-    maintainers = [ maintainers.leenaars ];
+    maintainers = with lib.maintainers; [ leenaars minijackson ];
  };
-}
+})
--- a/pkgs/data/fonts/ostrich-sans/default.nix
+++ b/pkgs/data/fonts/ostrich-sans/default.nix
@ -0,0 +1,32 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "ostrich-sans";
+  version = "2014-04-18";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "a949d40d0576d12ba26e2a45e19c91fd0228c964";
+    hash = "sha256-vvTNtl+fO2zWooH1EvCmO/dPYYgCkj8Ckg5xfg1gtnw=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A gorgeous modern sans-serif with a very long neck";
+    longDescription = ''
+      A gorgeous modern sans-serif with a very long neck. With a whole slew of
+      styles & weights.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/ostrich-sans";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/prociono/default.nix
+++ b/pkgs/data/fonts/prociono/default.nix
@ -0,0 +1,34 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "prociono";
+  version = "2011-05-25";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "f9d9680de6d6f0c13939f23c9dd14cd7853cf844";
+    hash = "sha256-gC5E0Z0O2cnthoBEu+UOQLsr3/a/3/JPIx3WCPsXXtk=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A roman serif with blackletter elements";
+    longDescription = ''
+      "Prociono" (pro-tsee-O-no) is an Esperanto word meaning either the star
+      Procyon or the animal species known as the raccoon. It is a roman serif
+      with blackletter elements.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/prociono";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/raleway/default.nix
+++ b/pkgs/data/fonts/raleway/default.nix
@ -1,44 +1,40 @@
-{ lib, stdenvNoCC, fetchFromGitHub }:
+{ lib, fetchzip, stdenvNoCC }:

-stdenvNoCC.mkDerivation {
+stdenvNoCC.mkDerivation (self: {
  pname = "raleway";
-  version = "2016-08-30";
+  version = "4.101";

-  src = fetchFromGitHub {
-    owner = "impallari";
-    repo = "Raleway";
-    rev = "fa27f47b087fc093c6ae11cfdeb3999ac602929a";
-    hash = "sha256-mcIpE+iqG6M43I5TT95oV+5kNgphunmyxC+Jaj0JysQ=";
+  src = fetchzip {
+    url = "https://github.com/theleagueof/raleway/releases/download/${self.version}/Raleway-${self.version}.tar.xz";
+    hash = "sha256-itNHIMoRjiaqYAJoDNetkCquv47VAfel8MAzwsd//Ww=";
  };

  installPhase = ''
    runHook preInstall

-    find . -name "*-Original.otf" -exec install -Dt $out/share/fonts/opentype {} \;
+    install -D -m444 -t $out/share/fonts/truetype $src/static/TTF/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/static/OTF/*.otf

    runHook postInstall
  '';

  meta = {
    description = "Raleway is an elegant sans-serif typeface family";
-
    longDescription = ''
      Initially designed by Matt McInerney as a single thin weight, it was
      expanded into a 9 weight family by Pablo Impallari and Rodrigo Fuenzalida
-      in 2012 and iKerned by Igino Marini. In 2013 the Italics where added.
+      in 2012 and iKerned by Igino Marini. In 2013 the Italics where added, and
+      most recently — a variable version.

-      It is a display face and the download features both old style and lining
-      numerals, standard and discretionary ligatures, a pretty complete set of
-      diacritics, as well as a stylistic alternate inspired by more geometric
-      sans-serif typefaces than its neo-grotesque inspired default character
-      set.
+      It features both old style and lining numerals, standard and
+      discretionary ligatures, a pretty complete set of diacritics, as well as
+      a stylistic alternate inspired by more geometric sans-serif typefaces
+      than its neo-grotesque inspired default character set.

      It also has a sister display family, Raleway Dots.
    '';
-
-    homepage = "https://github.com/impallari/Raleway";
+    homepage = "https://www.theleagueofmoveabletype.com/raleway";
    license = lib.licenses.ofl;
-
-    maintainers = with lib.maintainers; [ Profpatsch ];
+    maintainers = with lib.maintainers; [ minijackson Profpatsch ];
  };
-}
+})
--- a/pkgs/data/fonts/sniglet/default.nix
+++ b/pkgs/data/fonts/sniglet/default.nix
@ -0,0 +1,33 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "sniglet";
+  version = "2011-05-25";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "5c6b0860bdd0d8c4f16222e4de3918c384db17c4";
+    hash = "sha256-fLT2hZT9o1Ka30EB/6oWwmalhVJ+swXLRFG99yRWd2c=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A fun rounded display face that’s great for headlines";
+    longDescription = ''
+      A rounded display face that’s great for headlines. It comes with a full
+      character set, so you can type in Icelandic or even French!
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/sniglet";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/sorts-mill-goudy/default.nix
+++ b/pkgs/data/fonts/sorts-mill-goudy/default.nix
@ -0,0 +1,36 @@
+{ lib, fetchFromGitHub, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "sorts-mill-goudy";
+  version = "2011-05-25";
+
+  src = fetchFromGitHub {
+    owner = "theleagueof";
+    repo = self.pname;
+    rev = "06072890c7b05f274215a24f17449655ccb2c8af";
+    hash = "sha256-NEfLBJatUmdUL5gJEimJHZfOd1OtI7pxTN97eWMODyM=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "A ‘revival’ of Goudy Oldstyle and Italic";
+    longDescription = ''
+      A 'revival' of Goudy Oldstyle and Italic, with features including small
+      capitals (in the roman only), oldstyle and lining figures, superscripts
+      and subscripts, fractions, ligatures, class-based kerning, case-sensitive
+      forms, and capital spacing. There is support for many languages using
+      latin scripts.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/sorts-mill-goudy";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/the-neue-black/default.nix
+++ b/pkgs/data/fonts/the-neue-black/default.nix
@ -0,0 +1,33 @@
+{ lib, fetchzip, stdenvNoCC }:
+
+stdenvNoCC.mkDerivation (self: {
+  pname = "the-neue-black";
+  version = "1.007";
+
+  src = fetchzip {
+    url = "https://github.com/theleagueof/the-neue-black/releases/download/${self.version}/TheNeueBlack-${self.version}.tar.xz";
+    hash = "sha256-AsB6w1000xdl+pOPDXqqzQhru1T/VD0hIJ4gFec7mU4=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m444 -t $out/share/fonts/truetype $src/static/TTF/*.ttf
+    install -D -m444 -t $out/share/fonts/opentype $src/static/OTF/*.otf
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Tré Seals’ first open-source font, a typeface based on the Chicago Freedom Movement";
+    longDescription = ''
+      The open-source release of The Neue Black is in partnership with designer
+      Tré Seals of Vocal Type Co. The Neue Black is a display sans serif with a
+      robust character set that has over 25 ligatures and various inktrap
+      alternates.
+    '';
+    homepage = "https://www.theleagueofmoveabletype.com/the-neue-black";
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+})
--- a/pkgs/data/fonts/vazir-fonts/default.nix
+++ b/pkgs/data/fonts/vazir-fonts/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "vazir-fonts";
-  version = "32.0.0";
+  version = "33.003";

  src = fetchFromGitHub {
    owner = "rastikerdar";
    repo = "vazir-font";
    rev = "v${version}";
-    hash = "sha256-lkjlSW3Sfr1bJ9/IOsZl9yOVh9mYKhoV5XcLkqcQ71g=";
+    hash = "sha256-C1UtfrRFzz0uv/hj8e7huXe4sNd5h7ozVhirWEAyXGg=";
  };

  dontBuild = true;
--- a/pkgs/data/misc/poppler-data/default.nix
+++ b/pkgs/data/misc/poppler-data/default.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "poppler-data";
-  version = "0.4.11";
+  version = "0.4.12";

  src = fetchurl {
    url = "https://poppler.freedesktop.org/${pname}-${version}.tar.gz";
-    sha256 = "LOwFzRuwOvmKiwah4i9ubhplseLzgWyzBpuwh0gl8Iw=";
+    sha256 = "yDW2QKQM41fhuDZmqr2V7f+iTd3dSbja/2OtuFHNq3Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/pantheon/apps/elementary-files/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , pkg-config
 , meson
@ -29,7 +28,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-files";
-  version = "6.2.1";
+  version = "6.2.2";

  outputs = [ "out" "dev" ];

@ -37,18 +36,9 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = "files";
    rev = version;
-    sha256 = "sha256-pJFeMG2aGaMkS00fSoRlMR2YSg5YzwqwaQT8G7Gk5S4=";
+    sha256 = "sha256-YV7fcRaLaDwa0m6zbdhayCAqeON5nqEdQ1IUtDKu5AY=";
  };

-  patches = [
-    # Ensure special user directory icon used for bookmark
-    # https://github.com/elementary/files/pull/2106
-    (fetchpatch {
-      url = "https://github.com/elementary/files/commit/00b1c2a975aeab378ed6eb1d90c8988f82596add.patch";
-      sha256 = "sha256-F/Vk7dg57uBBMO4WOJ/7kKbRNMZuWZ3QfrBfEIBozbw=";
-    })
-  ];
-
  nativeBuildInputs = [
    desktop-file-utils
    meson
--- a/pkgs/development/libraries/bullet/default.nix
+++ b/pkgs/development/libraries/bullet/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "bullet";
-  version = "3.24";
+  version = "3.25";

  src = fetchFromGitHub {
    owner = "bulletphysics";
    repo = "bullet3";
    rev = version;
-    sha256 = "sha256-1zQZI1MdW0Ipg5XJeiFZQi/6cI0t6Ckralc5DE3auow=";
+    sha256 = "sha256-AGP05GoxLjHqlnW63/KkZe+TjO3IKcgBi+Qb/osQuCM=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/coordgenlibs/default.nix
+++ b/pkgs/development/libraries/coordgenlibs/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "coordgenlibs";
-  version = "3.0.1";
+  version = "3.0.2";

  src = fetchFromGitHub {
    owner = "schrodinger";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-u8UmJ4bu00t7qxiNZ3nL7cd+8AIC0LoICj5FNPboCTQ=";
+    sha256 = "sha256-casFPNbPv9mkKpzfBENW7INClypuCO1L7clLGBXvSvI=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/exempi/default.nix
+++ b/pkgs/development/libraries/exempi/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "exempi";
-  version = "2.6.2";
+  version = "2.6.3";

  src = fetchurl {
    url = "https://libopenraw.freedesktop.org/download/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-TRfUyT3yqV2j4xcsRbelvzF90x2v0cejQBaXKMcInR0=";
+    sha256 = "sha256-sHSdsYqeeM93FzeVSoOM3NsdVBWIi6wbqcr4y6d8ZWw=";
  };

  configureFlags = [
--- a/pkgs/development/libraries/libcdio-paranoia/default.nix
+++ b/pkgs/development/libraries/libcdio-paranoia/default.nix
@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3;
    maintainers = [ ];
    mainProgram = "cd-paranoia";
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/libks/default.nix
+++ b/pkgs/development/libraries/libks/default.nix
@ -6,17 +6,18 @@
 , pkg-config
 , libuuid
 , openssl
+, libossp_uuid
 }:

 stdenv.mkDerivation rec {
  pname = "libks";
-  version = "1.8.0";
+  version = "1.8.2";

  src = fetchFromGitHub {
    owner = "signalwire";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Bfp8+jqXu1utlaYuPewm+t3zHxaTWEw+cGZu1nFzkDk=";
+    sha256 = "sha256-TJ3q97K3m3zYGB1D5lLVyrh61L3vtnP5I64lP/DYzW4=";
  };

  patches = [
@ -33,16 +34,15 @@ stdenv.mkDerivation rec {
    pkg-config
  ];

-  buildInputs = [
-    libuuid
-    openssl
-  ];
+  buildInputs = [ openssl ]
+    ++ lib.optional stdenv.isLinux libuuid
+    ++ lib.optional stdenv.isDarwin libossp_uuid;

  meta = with lib; {
    description = "Foundational support for signalwire C products";
    homepage = "https://github.com/signalwire/libks";
    maintainers = with lib.maintainers; [ misuzu ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    license = licenses.mit;
  };
 }
--- a/pkgs/development/libraries/libvmaf/default.nix
+++ b/pkgs/development/libraries/libvmaf/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, meson, ninja, nasm }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, meson, ninja, nasm }:

 stdenv.mkDerivation rec {
  pname = "libvmaf";
@ -13,6 +13,15 @@ stdenv.mkDerivation rec {

  sourceRoot = "source/libvmaf";

+  patches = [
+    # Backport fix for non-Linux, non-Darwin platforms.
+    (fetchpatch {
+      url = "https://github.com/Netflix/vmaf/commit/f47640f9ffee9494571bd7c9622e353660c93fc4.patch";
+      stripLen = 1;
+      sha256 = "rsTKuqp8VJG5DBDpixPke3LrdfjKzUO945i+iL0n7CY=";
+    })
+  ];
+
  nativeBuildInputs = [ meson ninja nasm ];

  mesonFlags = [ "-Denable_avx512=true" ];
--- a/pkgs/development/libraries/maeparser/default.nix
+++ b/pkgs/development/libraries/maeparser/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "maeparser";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "schrodinger";
    repo = "maeparser";
    rev = "v${version}";
-    sha256 = "sha256-9KxCR/spIZzePjmZe8qihIi1hEhPvxg/9dAlYmHxZPs=";
+    sha256 = "sha256-+eCTOU0rqFQC87wcxgINGLsULfbIr/wKxQTkRR59JVc=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/magic-enum/default.nix
+++ b/pkgs/development/libraries/magic-enum/default.nix
@ -0,0 +1,26 @@
+{ fetchFromGitHub
+, lib
+, stdenv
+, cmake
+}:
+stdenv.mkDerivation rec{
+  pname = "magic-enum";
+  version = "0.8.2";
+  src = fetchFromGitHub {
+    owner = "Neargye";
+    repo = "magic_enum";
+    rev = "v${version}";
+    sha256 = "sha256-k4zCEQxO0N/o1hDYxw5p9u0BMwP/5oIoe/4yw7oqEo0=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  doCheck = true;
+
+  meta = with lib;{
+    description = "Static reflection for enums (to string, from string, iteration) for modern C++";
+    homepage = "https://github.com/Neargye/magic_enum";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Alper-Celik ];
+  };
+}
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "ngtcp2";
-  version = "0.12.1";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "ngtcp2";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-nUUbGNxr2pGiEoYbArHppNE29rki9SM/3MZWMS9HmqY=";
+    sha256 = "sha256-rKEF5R1GubgFiblmdTqh26PxTRxIqXUJHxj0Qwd3N00=";
  };

  outputs = [ "out" "dev" "doc" ];
--- a/pkgs/development/libraries/openvino/cmake.patch
+++ b/pkgs/development/libraries/openvino/cmake.patch
@ -0,0 +1,31 @@
+diff --git a/cmake/developer_package/linux_name.cmake b/cmake/developer_package/linux_name.cmake
+index 3e8c775770..2d5e00fb8b 100644
+--- a/cmake/developer_package/linux_name.cmake
+++ b/cmake/developer_package/linux_name.cmake
+@@ -6,25 +6,7 @@ include(target_flags)
+ 
+ if(LINUX)
+     function(get_linux_name res_var)
+-        if(EXISTS "/etc/lsb-release")
+-            # linux version detection using cat /etc/lsb-release
+-            file(READ "/etc/lsb-release" release_data)
+-            set(name_regex "DISTRIB_ID=([^ \n]*)\n")
+-            set(version_regex "DISTRIB_RELEASE=([0-9]+(\\.[0-9]+)?)")
+-        else()
+-            execute_process(COMMAND find -L /etc/ -maxdepth 1 -type f -name *-release -exec cat {} \;
+-                            OUTPUT_VARIABLE release_data
+-                            RESULT_VARIABLE result)
+-            string(REPLACE "Red Hat" "CentOS" release_data "${release_data}")
+-            set(name_regex "NAME=\"([^ \"\n]*).*\"\n")
+-            set(version_regex "VERSION=\"([0-9]+(\\.[0-9]+)?)[^\n]*\"")
+-        endif()
+-
+-        string(REGEX MATCH ${name_regex} name ${release_data})
+-        set(os_name ${CMAKE_MATCH_1})
+-
+-        string(REGEX MATCH ${version_regex} version ${release_data})
+-        set(os_name "${os_name} ${CMAKE_MATCH_1}")
+        set(os_name "NixOS @version@")
+ 
+         if(os_name)
+             set(${res_var} ${os_name} PARENT_SCOPE)
--- a/pkgs/development/libraries/openvino/default.nix
+++ b/pkgs/development/libraries/openvino/default.nix
@ -1,115 +1,167 @@
 { lib
-, addOpenGLRunpath
-, autoPatchelfHook
 , stdenv
 , fetchFromGitHub
 , fetchpatch
+, fetchurl
+, substituteAll
+
+# build
+, addOpenGLRunpath
+, autoPatchelfHook
 , cmake
 , git
-, protobuf
-, tbb
-, opencv
-, unzip
-, shellcheck
-, srcOnly
+, libarchive
+, pkg-config
 , python
-, enablePython ? false
+, shellcheck
+
+# runtime
+, libusb1
+, libxml2
+, opencv
+, protobuf
+, pugixml
+, tbb
 }:

 let
-
-  onnx_src = srcOnly {
-    name = "onnx-patched";
-    src = fetchFromGitHub {
-      owner = "onnx";
-      repo = "onnx";
-      rev = "v1.8.1";
-      sha256 = "+1zNnZ4lAyVYRptfk0PV7koIX9FqcfD1Ah33qj/G2rA=";
-    };
-    patches = [
-      # Fix build with protobuf 3.18+
-      # Remove with onnx 1.9 release
-      (fetchpatch {
-        url = "https://github.com/onnx/onnx/commit/d3bc82770474761571f950347560d62a35d519d7.patch";
-        sha256 = "0vdsrklkzhdjaj8wdsl4icn93q3961g8dx35zvff0nhpr08wjb7y";
-      })
-    ];
+  # See FIRMWARE_PACKAGE_VERSION in src/plugins/intel_myriad/myriad_dependencies.cmake
+  myriad_firmware_version = "20221129_35";
+  myriad_usb_firmware = fetchurl {
+    url = "https://storage.openvinotoolkit.org/dependencies/myriad/firmware_usb-ma2x8x_${myriad_firmware_version}.zip";
+    hash = "sha256-HKNWbSlMjSafOgrS9WmenbsmeaJKRVssw0NhIwPYZ70=";
+  };
+  myriad_pcie_firmware = fetchurl {
+    url = "https://storage.openvinotoolkit.org/dependencies/myriad/firmware_pcie-ma2x8x_${myriad_firmware_version}.zip";
+    hash = "sha256-VmfrAoKQ++ySIgAxWQul+Hd0p7Y4sTF44Nz4RHpO6Mo=";
  };

+  # See GNA_VERSION in cmake/dependencies.cmake
+  gna_version = "03.00.00.1910";
+  gna = fetchurl {
+    url = "https://storage.openvinotoolkit.org/dependencies/gna/gna_${gna_version}.zip";
+    hash = "sha256-iU3bwK40WfBFE7hTsMq8MokN1Oo3IooCK2oyEBvbt/g=";
+  };
+
+  tbbbind_version = "2_5";
+  tbbbind = fetchurl {
+    url = "https://download.01.org/opencv/master/openvinotoolkit/thirdparty/linux/tbbbind_${tbbbind_version}_static_lin_v2.tgz";
+    hash = "sha256-hl54lMWEAiM8rw0bKIBW4OarK/fJ0AydxgVhxIS8kPQ=";
+  };
 in
+
 stdenv.mkDerivation rec {
  pname = "openvino";
-  version = "2021.2";
+  version = "2022.3.0";

  src = fetchFromGitHub {
    owner = "openvinotoolkit";
    repo = "openvino";
-    rev = version;
-    sha256 = "pv4WTfY1U5GbA9Yj07UOLQifvVH3oDfWptxxYW5IwVQ=";
+    rev = "refs/tags/${version}";
    fetchSubmodules = true;
+    hash = "sha256-Ie58zTNatiYZZQJ8kJh/+HlSetQjhAtf2Us83z1jGv4=";
  };

+  outputs = [
+    "out"
+    "python"
+  ];
+
+  nativeBuildInputs = [
+    addOpenGLRunpath
+    autoPatchelfHook
+    cmake
+    git
+    libarchive
+    pkg-config
+    (python.withPackages (ps: with ps; [
+      cython
+      pybind11
+      setuptools
+    ]))
+    shellcheck
+  ];
+
+  patches = [
+    (substituteAll {
+      src = ./cmake.patch;
+      inherit (lib) version;
+    })
+  ];
+
+  postPatch = ''
+    mkdir -p temp/vpu/firmware/{pcie,usb}-ma2x8x
+    pushd temp/vpu/firmware
+    bsdtar -xf ${myriad_pcie_firmware} -C pcie-ma2x8x
+    echo "${myriad_pcie_firmware.url}" > pcie-ma2x8x/ie_dependency.info
+    bsdtar -xf ${myriad_usb_firmware} -C usb-ma2x8x
+    echo "${myriad_usb_firmware.url}" > usb-ma2x8x/ie_dependency.info
+    popd
+
+    mkdir -p temp/gna_${gna_version}
+    pushd temp/
+    bsdtar -xf ${gna}
+    autoPatchelf gna_${gna_version}
+    echo "${gna.url}" > gna_${gna_version}/ie_dependency.info
+    popd
+
+    mkdir -p temp/tbbbind_${tbbbind_version}
+    pushd temp/tbbbind_${tbbbind_version}
+    bsdtar -xf ${tbbbind}
+    echo "${tbbbind.url}" > ie_dependency.info
+    popd
+  '';
+
  dontUseCmakeBuildDir = true;

  cmakeFlags = [
-    "-DNGRAPH_USE_SYSTEM_PROTOBUF:BOOL=ON"
-    "-DFETCHCONTENT_FULLY_DISCONNECTED:BOOL=ON"
-    "-DFETCHCONTENT_SOURCE_DIR_EXT_ONNX:STRING=${onnx_src}"
-    "-DENABLE_VPU:BOOL=OFF"
-    "-DTBB_DIR:STRING=${tbb}"
+    "-DCMAKE_PREFIX_PATH:PATH=${placeholder "out"}"
+    "-DCMAKE_MODULE_PATH:PATH=${placeholder "out"}/lib/cmake"
+    "-DENABLE_LTO:BOOL=ON"
+    # protobuf
+    "-DENABLE_SYSTEM_PROTOBUF:BOOL=OFF"
+    "-DProtobuf_LIBRARIES=${protobuf}/lib/libprotobuf${stdenv.hostPlatform.extensions.sharedLibrary}"
+    # tbb
+    "-DENABLE_SYSTEM_TBB:BOOL=ON"
+    # opencv
    "-DENABLE_OPENCV:BOOL=ON"
-    "-DOPENCV:STRING=${opencv}"
-    "-DENABLE_GNA:BOOL=OFF"
-    "-DENABLE_SPEECH_DEMO:BOOL=OFF"
-    "-DBUILD_TESTING:BOOL=OFF"
-    "-DENABLE_CLDNN_TESTS:BOOL=OFF"
-    "-DNGRAPH_INTERPRETER_ENABLE:BOOL=ON"
-    "-DNGRAPH_TEST_UTIL_ENABLE:BOOL=OFF"
-    "-DNGRAPH_UNIT_TEST_ENABLE:BOOL=OFF"
-    "-DENABLE_SAMPLES:BOOL=OFF"
-    "-DENABLE_CPPLINT:BOOL=OFF"
-  ] ++ lib.optionals enablePython [
+    "-DOpenCV_DIR=${opencv}/lib/cmake/opencv4/"
+    # pugixml
+    "-DENABLE_SYSTEM_PUGIXML:BOOL=ON"
+    # onednn
+    "-DENABLE_ONEDNN_FOR_GPU:BOOL=OFF"
+    # intel gna
+    "-DENABLE_INTEL_GNA:BOOL=ON"
+    # python
    "-DENABLE_PYTHON:BOOL=ON"
+    # tests
+    "-DENABLE_CPPLINT:BOOL=OFF"
+    "-DBUILD_TESTING:BOOL=OFF"
+    "-DENABLE_SAMPLES:BOOL=OFF"
  ];

-  preConfigure = ''
-    # To make install openvino inside /lib instead of /python
-    substituteInPlace inference-engine/ie_bridges/python/CMakeLists.txt \
-      --replace 'DESTINATION python/''${PYTHON_VERSION}/openvino' 'DESTINATION lib/''${PYTHON_VERSION}/site-packages/openvino' \
-      --replace 'DESTINATION python/''${PYTHON_VERSION}' 'DESTINATION lib/''${PYTHON_VERSION}/site-packages/openvino'
-    substituteInPlace inference-engine/ie_bridges/python/src/openvino/inference_engine/CMakeLists.txt \
-      --replace 'python/''${PYTHON_VERSION}/openvino/inference_engine' 'lib/''${PYTHON_VERSION}/site-packages/openvino/inference_engine'
-
-    # Used to download OpenCV based on Linux Distro and make it use system OpenCV
-    substituteInPlace inference-engine/cmake/dependencies.cmake \
-        --replace 'include(linux_name)' ' ' \
-        --replace 'if (ENABLE_OPENCV)' 'if (ENABLE_OPENCV AND NOT DEFINED OPENCV)'
-
-    cmakeDir=$PWD
-    mkdir ../build
-    cd ../build
-  '';
-
-  autoPatchelfIgnoreMissingDeps = [ "libngraph_backend.so" ];
-
-  nativeBuildInputs = [
-    cmake
-    autoPatchelfHook
-    addOpenGLRunpath
-    unzip
+  autoPatchelfIgnoreMissingDeps = [
+    "libngraph_backend.so"
  ];

  buildInputs = [
-    git
-    protobuf
+    libusb1
+    libxml2
    opencv
-    python
+    protobuf
+    pugixml
    tbb
-    shellcheck
-  ] ++ lib.optionals enablePython (with python.pkgs; [
-    cython
-    pybind11
-  ]);
+  ];
+
+  enableParallelBuilding = true;
+
+  postInstall = ''
+    pushd $out/python/python${lib.versions.majorMinor python.version}
+    mkdir -p $python
+    mv ./* $python/
+    popd
+    rm -r $out/python
+  '';

  postFixup = ''
    # Link to OpenCL
@ -130,8 +182,7 @@ stdenv.mkDerivation rec {
    homepage = "https://docs.openvinotoolkit.org/";
    license = with licenses; [ asl20 ];
    platforms = platforms.all;
-    broken = (stdenv.isLinux && stdenv.isx86_64) # at 2022-09-23
-             || stdenv.isDarwin; # Cannot find macos sdk
+    broken = stdenv.isDarwin; # Cannot find macos sdk
    maintainers = with maintainers; [ tfmoraes ];
  };
 }
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: rec {
  pname = "poppler-${suffix}";
-  version = "22.11.0"; # beware: updates often break cups-filters build, check texlive and scribus too!
+  version = "23.02.0"; # beware: updates often break cups-filters build, check texlive and scribus too!

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "https://poppler.freedesktop.org/poppler-${version}.tar.xz";
-    hash = "sha256-CTuphE7XdChVFzYcFeIaMbpN8nikmSY9RAPMp08tqCg=";
+    hash = "sha256-MxXdonD+KzXPH0HSdZSMOWUvqGO5DeB2b2spPZpVj8k=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/qxmpp/default.nix
+++ b/pkgs/development/libraries/qxmpp/default.nix
@ -9,13 +9,13 @@

 mkDerivation rec {
  pname = "qxmpp";
-  version = "1.4.0";
+  version = "1.5.1";

  src = fetchFromGitHub {
    owner = "qxmpp-project";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1knpq1jkwk0lxdwczbmzf7qrjvlxba9yr40nbq9s5nqkcx6q1c3i";
+    sha256 = "sha256-6iI+s+iSKK8TeocvyOxou7cF9ZXlWr5prUbPhoHOoSM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/science/chemistry/openmm/default.nix
+++ b/pkgs/development/libraries/science/chemistry/openmm/default.nix
@ -18,13 +18,13 @@

 stdenv.mkDerivation rec {
  pname = "openmm";
-  version = "7.7.0";
+  version = "8.0.0";

  src = fetchFromGitHub {
    owner = "openmm";
    repo = pname;
    rev = version;
-    hash = "sha256-2PYUGTMVQ5qVDeeABrwR45U3JIgo2xMXKlD6da7y3Dw=";
+    hash = "sha256-89ngeZHdjyL/OoGuQ+F5eaXE1/od0EEfIgw9eKdLtL8=";
  };

  # "This test is stochastic and may occassionally fail". It does.
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@ -68,7 +68,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "webkitgtk";
-  version = "2.38.3";
+  version = "2.38.4";
  name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${if lib.versionAtLeast gtk3.version "4.0" then "5.0" else "4.${if lib.versions.major libsoup.version == "2" then "0" else "1"}"}";

  outputs = [ "out" "dev" "devdoc" ];
@ -79,7 +79,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-QfAB0e1EjGk2s5Sp8g5GQO6/g6fwgmLfKFBPdBBgSlo=";
+    hash = "sha256-T0fqKaLU1fFe7z3J4tbG8Gfo3oY6P2RFXhzPlpPMHTY=";
  };

  patches = lib.optionals stdenv.isLinux [
--- a/pkgs/development/ocaml-modules/ounit2/default.nix
+++ b/pkgs/development/ocaml-modules/ounit2/default.nix
@ -1,22 +1,22 @@
 { lib, ocaml, buildDunePackage, fetchurl, seq, stdlib-shims, ncurses }:

 buildDunePackage rec {
-  minimumOCamlVersion = "4.04";
+  minimalOCamlVersion = "4.04";

  pname = "ounit2";
  version = "2.2.6";

-  useDune2 = lib.versionAtLeast ocaml.version "4.08";
+  duneVersion = if lib.versionAtLeast ocaml.version "4.08" then "2" else "1";

  src = fetchurl {
    url = "https://github.com/gildor478/ounit/releases/download/v${version}/ounit-${version}.tbz";
-    sha256 = "sha256-BpD7Hg6QoY7tXDVms8wYJdmLDox9UbtrhGyVxFphWRM=";
+    hash = "sha256-BpD7Hg6QoY7tXDVms8wYJdmLDox9UbtrhGyVxFphWRM=";
  };

  propagatedBuildInputs = [ seq stdlib-shims ];

  doCheck = true;
-  nativeCheckInputs = lib.optional (lib.versionOlder ocaml.version "4.07") ncurses;
+  checkInputs = lib.optional (lib.versionOlder ocaml.version "4.07") ncurses;

  meta = with lib; {
    homepage = "https://github.com/gildor478/ounit";
--- a/pkgs/development/python-modules/aiofile/default.nix
+++ b/pkgs/development/python-modules/aiofile/default.nix
@ -1,9 +1,9 @@
 { lib
 , aiomisc
-, asynctest
 , caio
 , buildPythonPackage
 , fetchFromGitHub
+, fetchpatch
 , pytestCheckHook
 , pythonOlder
 }:
@ -22,13 +22,20 @@ buildPythonPackage rec {
    hash = "sha256-PIImQZ1ymazsOg8qmlO91tNYHwXqK/d8AuKPsWYvh0w=";
  };

+  patches = [
+    (fetchpatch {
+      name = "remove-asynctest.patch";
+      url = "https://github.com/mosquito/aiofile/commit/9253ca42022f17f630ccfb6811f67876910f8b13.patch";
+      hash = "sha256-yMRfqEbdxApFypEj27v1zTgF/4kuLf5aS/+clo3mfZo=";
+    })
+  ];
+
  propagatedBuildInputs = [
    caio
  ];

  nativeCheckInputs = [
    aiomisc
-    asynctest
    pytestCheckHook
  ];

--- a/Show More
+++ b/Show More