Merge branch 'master' into staging-next

2021-09-23 18:43:00 -07:00 · 2021-09-23 18:43:00 -07:00 · 40299257cc
commit 40299257cc
parent 2a102ddcd7 188dad47ca
235 changed files with 7740 additions and 5428 deletions
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -164,6 +164,14 @@ with lib.maintainers; {
    scope = "Maintain Kodi and related packages.";
  };

+  mate = {
+    members = [
+      j03
+      romildo
+    ];
+    scope = "Maintain Mate desktop environment and related packages.";
+  };
+
  matrix = {
    members = [
      ma27
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -72,6 +72,15 @@
          <literal>gsettings set org.gnome.desktop.lockdown disable-lock-screen false</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>kubernetes-helm</literal> now defaults to 3.7.0,
+          which introduced some breaking changes to the experimental OCI
+          manifest format. See
+          <link xlink:href="https://github.com/helm/community/blob/main/hips/hip-0006.md">HIP
+          6</link> for more details.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-21.11-new-services">
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -26,6 +26,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - Pantheon desktop has been updated to version 6. Due to changes of screen locker, if locking doesn't work for you, please try `gsettings set org.gnome.desktop.lockdown disable-lock-screen false`.

+- `kubernetes-helm` now defaults to 3.7.0, which introduced some breaking changes to the experimental OCI manifest format. See [HIP 6](https://github.com/helm/community/blob/main/hips/hip-0006.md) for more details.
+
 ## New Services {#sec-release-21.11-new-services}

 - [btrbk](https://digint.ch/btrbk/index.html), a backup tool for btrfs subvolumes, taking advantage of btrfs specific capabilities to create atomic snapshots and transfer them incrementally to your backup locations. Available as [services.btrbk](options.html#opt-services.brtbk.instances).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1031,7 +1031,7 @@
  ./services/web-servers/shellinabox.nix
  ./services/web-servers/tomcat.nix
  ./services/web-servers/traefik.nix
-  ./services/web-servers/trafficserver.nix
+  ./services/web-servers/trafficserver/default.nix
  ./services/web-servers/ttyd.nix
  ./services/web-servers/uwsgi.nix
  ./services/web-servers/varnish/default.nix
--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@ -253,7 +253,7 @@ in {
    (mkIf cfg.kubelet.enable {
      virtualisation.containerd = {
        enable = mkDefault true;
-        settings = mkDefault defaultContainerdSettings;
+        settings = mapAttrsRecursive (name: mkDefault) defaultContainerdSettings;
      };
    })

--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@ -172,6 +172,15 @@ in
      };

      admin = {
+        skipCreate = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = ''
+            Do not create the admin account, instead rely on other
+            existing admin accounts.
+          '';
+        };
+
        email = lib.mkOption {
          type = lib.types.str;
          example = "admin@example.com";
@ -721,6 +730,16 @@ in
            lib.optionalString (file != null) ''
              replace-secret '${file}' '${file}' /run/discourse/config/discourse.conf
            '';
+
+          mkAdmin = ''
+            export ADMIN_EMAIL="${cfg.admin.email}"
+            export ADMIN_NAME="${cfg.admin.fullName}"
+            export ADMIN_USERNAME="${cfg.admin.username}"
+            ADMIN_PASSWORD="$(<${cfg.admin.passwordFile})"
+            export ADMIN_PASSWORD
+            discourse-rake admin:create_noninteractively
+          '';
+
        in ''
          set -o errexit -o pipefail -o nounset -o errtrace
          shopt -s inherit_errexit
@ -750,12 +769,7 @@ in
          discourse-rake db:migrate >>/var/log/discourse/db_migration.log
          chmod -R u+w /run/discourse/tmp/

-          export ADMIN_EMAIL="${cfg.admin.email}"
-          export ADMIN_NAME="${cfg.admin.fullName}"
-          export ADMIN_USERNAME="${cfg.admin.username}"
-          ADMIN_PASSWORD="$(<${cfg.admin.passwordFile})"
-          export ADMIN_PASSWORD
-          discourse-rake admin:create_noninteractively
+          ${lib.optionalString (!cfg.admin.skipCreate) mkAdmin}

          discourse-rake themes:update
          discourse-rake uploads:regenerate_missing_optimized
--- a/nixos/modules/services/web-servers/trafficserver/default.nix
+++ b/nixos/modules/services/web-servers/trafficserver/default.nix
@ -8,21 +8,9 @@ let
  group = config.users.groups.trafficserver.name;

  getManualUrl = name: "https://docs.trafficserver.apache.org/en/latest/admin-guide/files/${name}.en.html";
-  getConfPath = name: "${pkgs.trafficserver}/etc/trafficserver/${name}";

  yaml = pkgs.formats.yaml { };

-  fromYAML = f:
-    let
-      jsonFile = pkgs.runCommand "in.json"
-        {
-          nativeBuildInputs = [ pkgs.remarshal ];
-        } ''
-        yaml2json < "${f}" > "$out"
-      '';
-    in
-    builtins.fromJSON (builtins.readFile jsonFile);
-
  mkYamlConf = name: cfg:
    if cfg != null then {
      "trafficserver/${name}.yaml".source = yaml.generate "${name}.yaml" cfg;
@ -73,7 +61,7 @@ in

    ipAllow = mkOption {
      type = types.nullOr yaml.type;
-      default = fromYAML (getConfPath "ip_allow.yaml");
+      default = builtins.fromJSON (builtins.readFile ./ip_allow.json);
      defaultText = "upstream defaults";
      example = literalExample {
        ip_allow = [{
@ -94,7 +82,7 @@ in

    logging = mkOption {
      type = types.nullOr yaml.type;
-      default = fromYAML (getConfPath "logging.yaml");
+      default = builtins.fromJSON (builtins.readFile ./logging.json);
      defaultText = "upstream defaults";
      example = literalExample { };
      description = ''
--- a/nixos/modules/services/web-servers/trafficserver/ip_allow.json
+++ b/nixos/modules/services/web-servers/trafficserver/ip_allow.json
@ -0,0 +1,36 @@
+{
+  "ip_allow": [
+    {
+      "apply": "in",
+      "ip_addrs": "127.0.0.1",
+      "action": "allow",
+      "methods": "ALL"
+    },
+    {
+      "apply": "in",
+      "ip_addrs": "::1",
+      "action": "allow",
+      "methods": "ALL"
+    },
+    {
+      "apply": "in",
+      "ip_addrs": "0/0",
+      "action": "deny",
+      "methods": [
+        "PURGE",
+        "PUSH",
+        "DELETE"
+      ]
+    },
+    {
+      "apply": "in",
+      "ip_addrs": "::/0",
+      "action": "deny",
+      "methods": [
+        "PURGE",
+        "PUSH",
+        "DELETE"
+      ]
+    }
+  ]
+}
--- a/nixos/modules/services/web-servers/trafficserver/logging.json
+++ b/nixos/modules/services/web-servers/trafficserver/logging.json
@ -0,0 +1,37 @@
+{
+  "logging": {
+    "formats": [
+      {
+        "name": "welf",
+        "format": "id=firewall time=\"%<cqtd> %<cqtt>\" fw=%<phn> pri=6 proto=%<cqus> duration=%<ttmsf> sent=%<psql> rcvd=%<cqhl> src=%<chi> dst=%<shi> dstname=%<shn> user=%<caun> op=%<cqhm> arg=\"%<cqup>\" result=%<pssc> ref=\"%<{Referer}cqh>\" agent=\"%<{user-agent}cqh>\" cache=%<crc>"
+      },
+      {
+        "name": "squid_seconds_only_timestamp",
+        "format": "%<cqts> %<ttms> %<chi> %<crc>/%<pssc> %<psql> %<cqhm> %<cquc> %<caun> %<phr>/%<shn> %<psct>"
+      },
+      {
+        "name": "squid",
+        "format": "%<cqtq> %<ttms> %<chi> %<crc>/%<pssc> %<psql> %<cqhm> %<cquc> %<caun> %<phr>/%<shn> %<psct>"
+      },
+      {
+        "name": "common",
+        "format": "%<chi> - %<caun> [%<cqtn>] \"%<cqtx>\" %<pssc> %<pscl>"
+      },
+      {
+        "name": "extended",
+        "format": "%<chi> - %<caun> [%<cqtn>] \"%<cqtx>\" %<pssc> %<pscl> %<sssc> %<sscl> %<cqcl> %<pqcl> %<cqhl> %<pshl> %<pqhl> %<sshl> %<tts>"
+      },
+      {
+        "name": "extended2",
+        "format": "%<chi> - %<caun> [%<cqtn>] \"%<cqtx>\" %<pssc> %<pscl> %<sssc> %<sscl> %<cqcl> %<pqcl> %<cqhl> %<pshl> %<pqhl> %<sshl> %<tts> %<phr> %<cfsc> %<pfsc> %<crc>"
+      }
+    ],
+    "logs": [
+      {
+        "filename": "squid",
+        "format": "squid",
+        "mode": "binary"
+      }
+    ]
+  }
+}
--- a/nixos/modules/virtualisation/containerd.nix
+++ b/nixos/modules/virtualisation/containerd.nix
@ -53,8 +53,11 @@ in
    virtualisation.containerd = {
      args.config = toString containerdConfigChecked;
      settings = {
-        plugins.cri.containerd.snapshotter = lib.mkIf config.boot.zfs.enabled "zfs";
-        plugins.cri.cni.bin_dir = lib.mkDefault "${pkgs.cni-plugins}/bin";
+        plugins."io.containerd.grpc.v1.cri" = {
+         containerd.snapshotter =
+           lib.mkIf config.boot.zfs.enabled (lib.mkOptionDefault "zfs");
+         cni.bin_dir = lib.mkOptionDefault "${pkgs.cni-plugins}/bin";
+        };
      };
    };

--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "praat";
-  version = "6.1.52";
+  version = "6.1.53";

  src = fetchFromGitHub {
    owner = "praat";
    repo = "praat";
    rev = "v${version}";
-    sha256 = "sha256-O/PjR2J9IMifOtCIsvo90XeRK/G29HQYt3zrn2lVjxA=";
+    sha256 = "sha256-4GOVrKVHl/Cj0PNx+rcLESn5fbyIsnzaheMOFLlEVMU=";
  };

  configurePhase = ''
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -17,8 +17,8 @@ let
    sha256Hash = "04k7c328bl8ixi8bvp2mm33q2hmv40yc9p5dff5cghyycarwpd3f";
  };
  latestVersion = { # canary & dev
-    version = "2021.1.1.11"; # "Android Studio Bumblebee (2021.1.1) Canary 11"
-    sha256Hash = "0npvb7kr259799bs2bs2drvimmmwb0rdzswbkz8zgi5c2fwjcvvl";
+    version = "2021.1.1.12"; # "Android Studio Bumblebee (2021.1.1) Canary 12"
+    sha256Hash = "1dyn9435s0xbxwj28b0cciz6ry58pgfgba4rbny3jszxi5j3j0r1";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/misc/mediainfo-gui/default.nix
+++ b/pkgs/applications/misc/mediainfo-gui/default.nix
@ -2,11 +2,11 @@
 , desktop-file-utils, libSM, imagemagick }:

 stdenv.mkDerivation rec {
-  version = "21.03";
+  version = "21.09";
  pname = "mediainfo-gui";
  src = fetchurl {
    url = "https://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    sha256 = "07h2a1lbw5ak6c9bcn8qydchl0wpgk945rf9sfcqjyv05h5wll6y";
+    sha256 = "0mqcqm8y2whnbdi2ry7jd755gfl5ccdqhwjh67hsyr7c0ajxk3vv";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/applications/misc/mediainfo/default.nix
+++ b/pkgs/applications/misc/mediainfo/default.nix
@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, autoreconfHook, pkg-config, libzen, libmediainfo, zlib }:

 stdenv.mkDerivation rec {
-  version = "21.03";
+  version = "21.09";
  pname = "mediainfo";
  src = fetchurl {
    url = "https://mediaarea.net/download/source/mediainfo/${version}/mediainfo_${version}.tar.xz";
-    sha256 = "07h2a1lbw5ak6c9bcn8qydchl0wpgk945rf9sfcqjyv05h5wll6y";
+    sha256 = "0mqcqm8y2whnbdi2ry7jd755gfl5ccdqhwjh67hsyr7c0ajxk3vv";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/applications/misc/mkgmap/default.nix
+++ b/pkgs/applications/misc/mkgmap/default.nix
@ -14,11 +14,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mkgmap";
-  version = "4806";
+  version = "4807";

  src = fetchurl {
    url = "https://www.mkgmap.org.uk/download/mkgmap-r${version}-src.tar.gz";
-    sha256 = "kCjcjl0qXxtAS+WGpZB3o5Eq9Xg0vY0gcjFosYJbAsI=";
+    sha256 = "3DEcXopoCIcBANYrGclZH6K0JLgeYADXtPjQtobyfps=";
  };

  patches = [
--- a/pkgs/applications/misc/privacyidea/default.nix
+++ b/pkgs/applications/misc/privacyidea/default.nix
@ -14,7 +14,8 @@ let
      });
      flask_migrate = super.flask_migrate.overridePythonAttrs (oldAttrs: rec {
        version = "2.7.0";
-        src = oldAttrs.src.override {
+        src = python3.pkgs.fetchPypi {
+          pname = "Flask-Migrate";
          inherit version;
          sha256 = "ae2f05671588762dd83a21d8b18c51fe355e86783e24594995ff8d7380dffe38";
        };
--- a/pkgs/applications/misc/prusa-slicer/super-slicer.nix
+++ b/pkgs/applications/misc/prusa-slicer/super-slicer.nix
@ -1,23 +1,27 @@
 { lib, fetchFromGitHub, makeDesktopItem, prusa-slicer }:
 let
  appname = "SuperSlicer";
-  version = "2.3.56.8";
  pname = "super-slicer";
  description = "PrusaSlicer fork with more features and faster development cycle";
-  override = super: {
+
+  versions = {
+    stable = { version = "2.3.56.9"; sha256 = "sha256-vv01wGQkrasKKjpGSDeDqZbd1X5/iTfGXYN5Jwz+FKE="; };
+    staging = { version = "2.3.57.0"; sha256 = "sha256-7o0AqgQcKYc6c+Hi3x5pC/pKJZPlEsYOYk9sC21+mvM="; };
+  };
+
+  override = { version, sha256 }: super: {
    inherit version pname;

    src = fetchFromGitHub {
      owner = "supermerill";
      repo = "SuperSlicer";
-      sha256 = "sha256-em0OgrcPaV2VYM8DpvtVJjgdojStMF/ROUEtZ8iLZfo=";
+      inherit sha256;
      rev = version;
      fetchSubmodules = true;
    };

    # We don't need PS overrides anymore, and gcode-viewer is embedded in the binary.
    postInstall = null;
-    dontStrip = true;
    separateDebugInfo = true;

    # See https://github.com/supermerill/SuperSlicer/issues/432
@ -44,5 +48,10 @@ let
      maintainers = with maintainers; [ cab404 moredread ];
    };

+    passthru = allVersions;
+
  };
-in prusa-slicer.overrideAttrs override
+
+  allVersions = builtins.mapAttrs (_name: version: (prusa-slicer.overrideAttrs (override version))) versions;
+in
+allVersions.stable
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -7,10 +7,10 @@ in
 rec {
  firefox = common rec {
    pname = "firefox";
-    version = "92.0";
+    version = "92.0.1";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "1a73cc275ea1790120845f579a7d21713ea78db0867ced767f393dfc25b132292dfbb673290fccdb9dcde86684e0300d56565841985fa3f0115376c91154ba8e";
+      sha512 = "53361c231a4ac93a1808c9ccb29893d85b5e516fe939a770aac7f178abb4f43cbe3571097e5c5bf91b11fd95fc62b61f2aa215a45048357bfc9dad9eabdee9ef";
    };

    meta = {
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "helm";
-  version = "3.6.3";
-  gitCommit = "ee407bdf364942bcb8e8c665f82e15aa28009b71";
+  version = "3.7.0";
+  gitCommit = "eeac83883cb4014fe60267ec6373570374ce770b";

  src = fetchFromGitHub {
    owner = "helm";
    repo = "helm";
    rev = "v${version}";
-    sha256 = "sha256-DfMI50eQsMHRX8S5rBzF3qlSfJizlYQyofA7HPkD4EQ=";
+    sha256 = "sha256-dV6Bx6XVzPqaRBeCzEFR473xnxjff4f24jd5vETVX78=";
  };
-  vendorSha256 = "sha256-PTAyRG6PZK+vaiheUd3oiu4iBGlnFjoCrci0CYbXjBk=";
+  vendorSha256 = "sha256-Q/ycpLCIvf+PP+03ug3fKT+uIOdzDwP7709VfFVJglk=";

  doCheck = false;

--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix
@ -20,13 +20,13 @@ let
    "${electron}/bin/electron";
 in nodePackages.deltachat-desktop.override rec {
  pname = "deltachat-desktop";
-  version = "1.22.1";
+  version = "1.22.2";

  src = fetchFromGitHub {
    owner = "deltachat";
    repo = "deltachat-desktop";
    rev = "v${version}";
-    sha256 = "0wrwjblpw3f5ky697b2nhi9lisn4q5bl05086fdkx5v5j2ghz3n9";
+    sha256 = "0in6w2vl4ypgjb9gfhyh77vg05ni5p3z24lah7wvvhywcpv1jp2n";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/deltachat-desktop/package.json
+++ b/pkgs/applications/networking/instant-messengers/deltachat-desktop/package.json
@ -1,6 +1,6 @@
 {
  "name": "deltachat-desktop",
-  "version": "1.22.1",
+  "version": "1.22.2",
  "dependencies": {
    "@blueprintjs/core": "^3.22.3",
    "@mapbox/geojson-extent": "^1.0.0",
--- a/pkgs/applications/networking/instant-messengers/dino/default.nix
+++ b/pkgs/applications/networking/instant-messengers/dino/default.nix
@ -17,13 +17,13 @@

 stdenv.mkDerivation rec {
  pname = "dino";
-  version = "0.2.1";
+  version = "0.2.2";

  src = fetchFromGitHub {
    owner = "dino";
    repo = "dino";
    rev = "v${version}";
-    sha256 = "11m38syqzb1z92wmdaf45gryl6gjxwbcnk32j4p984ipqj2vdzd8";
+    sha256 = "sha256-uYP3D2uyvfRP91fq/1jKOaKgp/+How0SUwmxSrLLH4c=";
  };

  nativeBuildInputs = [
@ -81,7 +81,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Modern Jabber/XMPP Client using GTK/Vala";
    homepage = "https://github.com/dino/dino";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
    platforms = platforms.linux ++ platforms.darwin;
    maintainers = with maintainers; [ mic92 qyliss ];
  };
--- a/pkgs/applications/networking/instant-messengers/whatsapp-for-linux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/whatsapp-for-linux/default.nix
@ -8,6 +8,7 @@
 , libappindicator-gtk3
 , gst_all_1
 , pcre
+, wrapGAppsHook
 }:

 stdenv.mkDerivation rec {
@ -24,6 +25,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    cmake
    pkg-config
+    wrapGAppsHook
  ];

  buildInputs = [
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -28,11 +28,11 @@
 }:

 let
-  version = "5.7.31792.0820";
+  version = "5.8.0.16";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${version}/zoom_x86_64.pkg.tar.xz";
-      sha256 = "16p8wn67hb6p9rn684bbpwz8w5knyqw9rv2nnw6cwg949qjv43lm";
+      sha256 = "1axnh81bf3ab5gzxxqm172wpqlpfbj9a2h3cry3kyxzmrihzbwdm";
    };
  };

--- a/pkgs/applications/networking/mailreaders/meli/default.nix
+++ b/pkgs/applications/networking/mailreaders/meli/default.nix
@ -15,15 +15,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "meli";
-  version = "alpha-0.6.2";
+  version = "alpha-0.7.1";

  src = fetchgit {
    url = "https://git.meli.delivery/meli/meli.git";
    rev = version;
-    sha256 = "0ycyksrrp4llwklzx3ipac8hmpfxa1pa7dqsm82wic0f6p5d1dp6";
+    sha256 = "00iai2z5zydx9bw0ii0n6d7zwm5rrkj03b4ymic0ybwjahqzvyfq";
  };

-  cargoSha256 = "sha256:0lxwhb2c16w5z7rqzch0ij8n8hxb5xcin31w9i28mzv1xm7sg8ks";
+  cargoSha256 = "1r54a51j91iv0ziasjygzw30vqqvqibcnwnkih5xv0ijbaly61n0";

  cargoBuildFlags = lib.optional withNotmuch "--features=notmuch";

--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "rclone";
-  version = "1.56.0";
+  version = "1.56.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "03fqwsbpwb8vmgxg6knkp8f4xlvgg88n2c7inwjg8x91c7c77i0b";
+    sha256 = "sha256-2UIIJMa5Wlr4rvBRXvE9kwh798x8jVa63hVLZ51Ltp0=";
  };

-  vendorSha256 = "1gryisn63f6ss889s162ncvlsaznwgvgxdwk2pn5c5zw8dkmjdmi";
+  vendorSha256 = "sha256-sTZZZ0P8F1bsFZO3/vbj9itNN7PCBJ0Q0tq4YayOPr8=";

  subPackages = [ "." ];

--- a/pkgs/applications/science/biology/blast/default.nix
+++ b/pkgs/applications/science/biology/blast/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "blast";
-  version = "2.11.0";
+  version = "2.12.0";

  src = fetchurl {
    url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-src.tar.gz";
-    sha256 = "0m0r9vkw631ky1za1wilsfk9k9spwqh22nkrb9a57rbwmrc1i3nq";
+    sha256 = "122bf45cyj3s3zv2lw1y1rhz7g22v0va560ai30xdjl8sk4wk8zx";
  };

  sourceRoot = "ncbi-blast-${version}+-src/c++";
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -9,7 +9,7 @@
 , customOCamlPackages ? null
 , ocamlPackages_4_05, ocamlPackages_4_09, ocamlPackages_4_10, ncurses
 , buildIde ? true
-, glib, gnome, wrapGAppsHook
+, glib, gnome, wrapGAppsHook, makeDesktopItem, copyDesktopItems
 , csdp ? null
 , version, coq-version ? null,
 }@args:
@ -124,7 +124,9 @@ self = stdenv.mkDerivation {
    '';
  };

-  nativeBuildInputs = [ pkg-config ] ++ optional (!versionAtLeast "8.6") gnumake42;
+  nativeBuildInputs = [ pkg-config ]
+    ++ optional buildIde copyDesktopItems
+    ++ optional (!versionAtLeast "8.6") gnumake42;
  buildInputs = [ ncurses ] ++ ocamlBuildInputs
    ++ optionals buildIde
      (if versionAtLeast "8.10"
@ -166,12 +168,24 @@ self = stdenv.mkDerivation {

  createFindlibDestdir = true;

+  desktopItems = optional buildIde (makeDesktopItem {
+    name = "coqide";
+    exec = "coqide";
+    icon = "coq";
+    desktopName = "CoqIDE";
+    comment = "Graphical interface for the Coq proof assistant";
+    categories = "Development;Science;Math;IDE;GTK";
+  });
+
  postInstall = ''
    cp bin/votour $out/bin/
    ln -s $out/lib/coq $OCAMLFIND_DESTDIR/coq
+  '' + optionalString buildIde ''
+    mkdir -p "$out/share/pixmaps"
+    ln -s "$out/share/coq/coq.png" "$out/share/pixmaps/"
  '';

-  meta = with lib; {
+  meta = {
    description = "Coq proof assistant";
    longDescription = ''
      Coq is a formal proof management system.  It provides a formal language
--- a/pkgs/applications/science/machine-learning/shogun/default.nix
+++ b/pkgs/applications/science/machine-learning/shogun/default.nix
@ -8,6 +8,7 @@
 # extra support
 , pythonSupport ? true, pythonPackages ? null
 , opencvSupport ? false, opencv ? null
+, withSvmLight ? false
 }:

 assert pythonSupport -> pythonPackages != null;
@ -60,7 +61,7 @@ stdenv.mkDerivation rec {
      url = "https://github.com/awild82/shogun/commit/365ce4c4c700736d2eec8ba6c975327a5ac2cd9b.patch";
      sha256 = "158hqv4xzw648pmjbwrhxjp7qcppqa7kvriif87gn3zdn711c49s";
    })
-  ];
+  ] ++ lib.optional (!withSvmLight) ./svmlight-scrubber.patch;

  CCACHE_DISABLE="1";
  CCACHE_DIR=".ccache";
@ -86,12 +87,29 @@ stdenv.mkDerivation rec {
    (flag "CMAKE_VERBOSE_MAKEFILE:BOOL" doCheck)
    (flag "PythonModular" pythonSupport)
    (flag "OpenCV" opencvSupport)
+    (flag "USE_SVMLIGHT" withSvmLight)
  ];

+  postPatch = ''
+    # Fix preprocessing SVMlight code
+    sed -i \
+        -e 's@#ifdef SVMLIGHT@#ifdef USE_SVMLIGHT@' \
+        -e '/^#ifdef USE_SVMLIGHT/,/^#endif/ s@#endif@#endif //USE_SVMLIGHT@' \
+        src/shogun/kernel/string/CommUlongStringKernel.cpp
+    sed -i -e 's/#if USE_SVMLIGHT/#ifdef USE_SVMLIGHT/' src/interfaces/swig/Machine.i
+    sed -i -e 's@// USE_SVMLIGHT@//USE_SVMLIGHT@' src/interfaces/swig/Transfer.i
+    sed -i -e 's@/\* USE_SVMLIGHT \*/@//USE_SVMLIGHT@' src/interfaces/swig/Transfer_includes.i
+  '' + lib.optionalString (!withSvmLight) ''
+    # Run SVMlight scrubber
+    patchShebangs scripts/light-scrubber.sh
+    echo "removing SVMlight code"
+    ./scripts/light-scrubber.sh
+  '';
+
  meta = with lib; {
    description = "A toolbox which offers a wide range of efficient and unified machine learning methods";
    homepage = "http://shogun-toolbox.org/";
-    license = licenses.gpl3;
+    license = if withSvmLight then licenses.unfree else licenses.gpl3Plus;
    maintainers = with maintainers; [ edwtjo ];
  };
 }
--- a/pkgs/applications/science/machine-learning/shogun/svmlight-scrubber.patch
+++ b/pkgs/applications/science/machine-learning/shogun/svmlight-scrubber.patch
@ -0,0 +1,76 @@
+From: Sebastián Mancilla <smancill@smancill.dev>
+Subject: Update SVMlight scrubber script
+
+This requires previously fixing a few wrong preprocessor directives that
+are supposed to fence code using SVMlight.
+
+- The script was too eager and removing *.light files in SVMlight format
+  that are used by other tests. The code reading those files doesn't use
+  any SVMlight code so it should be fine to keep it and run the tests.
+
+- The Python test *domainadaptationsvm.py was not removed because of
+  wrong globbing.
+
+- Remove a couple of examples using SVMlight that were missed.
+
+- The script is actually modifying (and breaking) itself because the
+  grep for the USE_SVMLIGHT macro is too eager again and matches itself
+  (and the version stored in upstream's Debian package control tarball
+  is broken because of it). Just fix it by grepping for preprocessor
+  directives only.
+
+- No need to fix the Transfer_includes.i file in the script with a final
+  %} when its preprocessor directives have been fixed.
+
+- The Swig files were moved to a new directory at some point but the
+  script was not updated accordingly.
+---
+ scripts/light-scrubber.sh | 16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+diff a/scripts/light-scrubber.sh b/scripts/light-scrubber.sh
+--- a/scripts/light-scrubber.sh
+++ b/scripts/light-scrubber.sh
+@@ -26,14 +26,16 @@
+ # You should have received a copy of the GNU General Public License
+ # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ #
+-rm -rf	examples/*/*/{*light*,*_domainadaptationsvm_*}				\
+rm -rf	examples/*/*/{*light*.*,*domainadaptationsvm*}				\
+ 	examples/undocumented/matlab_and_octave/tests/*light*			\
+	examples/undocumented/python/serialization_string_kernels.py		\
+	examples/undocumented/python/mkl_binclass.py				\
+ 	src/shogun/classifier/svm/SVMLight.*					\
+ 	src/shogun/classifier/svm/SVMLightOneClass.*				\
+ 	src/shogun/regression/svr/SVRLight.*					\
+ 	doc/md/LICENSE_SVMlight*
+ 
+-for _file in `grep -rl USE_SVMLIGHT .`
+grep -rl '^#ifdef USE_SVMLIGHT' . | while read -r _file
+ do
+   sed -i.orig -e								\
+ 	'/\#ifdef USE_SVMLIGHT/,/\#endif \/\/USE_SVMLIGHT/c \\' ${_file} &&	\
+@@ -41,7 +43,7 @@ do
+   rm -rf ${_file}.orig
+ done
+ 
+-for _file in `find . -depth -name 'CMakeLists.txt'`
+find . -depth -name 'CMakeLists.txt' | while read -r _file
+ do
+   sed -i.orig -e 's!.*_sv[mr]light_.*!!g' ${_file} &&				\
+   touch -r ${_file}.orig ${_file} &&						\
+@@ -56,13 +58,7 @@ do
+   rm -rf ${_file}.orig
+ done
+ 
+-_file="src/interfaces/modular/Transfer_includes.i" &&				\
+-cp -a ${_file} ${_file}.orig &&							\
+-echo '%}' >> ${_file} &&							\
+-touch -r ${_file}.orig ${_file} &&						\
+-rm -rf ${_file}.orig
+-
+-_file="src/interfaces/modular/Machine.i" &&					\
+_file="src/interfaces/swig/Machine.i" &&					\
+ sed -i.orig -e '/.*CSVRLight.*/d' ${_file} &&					\
+ touch -r ${_file}.orig ${_file} &&						\
+ rm -rf ${_file}.orig
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@ -4,14 +4,14 @@

 stdenv.mkDerivation rec {
  pname = "xterm";
-  version = "368";
+  version = "369";

  src = fetchurl {
    urls = [
      "ftp://ftp.invisible-island.net/xterm/${pname}-${version}.tgz"
      "https://invisible-mirror.net/archives/xterm/${pname}-${version}.tgz"
    ];
-    sha256 = "L/UWmTC2tJ7wuvteEzHJTxqYwxBEK7p3mK3YIcdq5xI=";
+    sha256 = "ce1qSNBkiT0hSXQaACeBqXNJb9JNUtrdNk9jQ5p2TiY=";
  };

  strictDeps = true;
--- a/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-machete/default.nix
@ -1,26 +1,36 @@
-{ lib, buildPythonApplication, fetchPypi
-, installShellFiles, pbr
-, flake8, mock, pycodestyle, pylint, stestr, tox
+{ lib
+, buildPythonApplication
+, fetchFromGitHub
+, installShellFiles
+, git
+, stestr
 , nix-update-script
-, testVersion, git-machete
+, testVersion
+, git-machete
 }:

 buildPythonApplication rec {
  pname = "git-machete";
  version = "3.3.0";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0mq6hmb3wvj0ash27h4zyl46l3fikpf0mv3ng330lcy6v7bhy5b8";
+  src = fetchFromGitHub {
+    owner = "virtuslab";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0sx45y1d1v6y66msjc1lw9jhjppgbxqj145kivmd7lr6ccw68kav";
  };

-  nativeBuildInputs = [ installShellFiles pbr ];
+  nativeBuildInputs = [ installShellFiles ];

-  checkInputs = [ flake8 mock pycodestyle pylint stestr tox ];
+  checkInputs = [ git stestr ];
+
+  postCheck = ''
+    stestr run
+  '';

  postInstall = ''
-      installShellCompletion --bash --name git-machete completion/git-machete.completion.bash
-      installShellCompletion --zsh --name _git-machete completion/git-machete.completion.zsh
+    installShellCompletion --bash --name git-machete completion/git-machete.completion.bash
+    installShellCompletion --zsh --name _git-machete completion/git-machete.completion.zsh
  '';

  passthru = {
@ -39,7 +49,6 @@ buildPythonApplication rec {
    homepage = "https://github.com/VirtusLab/git-machete";
    description = "Git repository organizer and rebase/merge workflow automation tool";
    license = licenses.mit;
-    platforms = platforms.all;
    maintainers = with maintainers; [ blitz ];
  };
 }
--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "git-repo";
-  version = "2.16.7";
+  version = "2.16.8";

  src = fetchFromGitHub {
    owner = "android";
    repo = "tools_repo";
    rev = "v${version}";
-    sha256 = "sha256-AJD+WV8JilclcMXc4RFv2xY9QZNUJtYX1dsb1q85qZ0=";
+    sha256 = "sha256-5EIuaGc93ll9YXLlleZ2HhT0maa+xtozk0LtneYYcDM=";
  };

  # Fix 'NameError: name 'ssl' is not defined'
--- a/pkgs/data/fonts/unifont/default.nix
+++ b/pkgs/data/fonts/unifont/default.nix
@ -4,16 +4,16 @@

 stdenv.mkDerivation rec {
  pname = "unifont";
-  version = "13.0.06";
+  version = "14.0.01";

  ttf = fetchurl {
    url = "mirror://gnu/unifont/${pname}-${version}/${pname}-${version}.ttf";
-    sha256 = "0hp72lcj8q8cw490lxl5y1ygw9mcicryjwqr1mmkdz8zh4jh8g6p";
+    sha256 = "19algkm4nnixmzshc25rjgh8gfccqinallgi86wgvkcwcmn6ccn6";
  };

  pcf = fetchurl {
    url = "mirror://gnu/unifont/${pname}-${version}/${pname}-${version}.pcf.gz";
-    sha256 = "0y030km1x8mai8zrk661dqsb0yq8rpx6akl7p2sw5ijkcdsfm85f";
+    sha256 = "1aj29pswi6qwpvjwncv5w3ndwy2nzli0200i6dx6f80036z8nz9i";
  };

  nativeBuildInputs = [ libfaketime fonttosfnt mkfontscale ];
--- a/pkgs/data/fonts/unifont_upper/default.nix
+++ b/pkgs/data/fonts/unifont_upper/default.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:

 let
-  version = "13.0.06";
+  version = "14.0.01";
 in fetchzip rec {
  name = "unifont_upper-${version}";

@ -9,7 +9,7 @@ in fetchzip rec {

  postFetch = "install -Dm644 $downloadedFile $out/share/fonts/truetype/unifont_upper.ttf";

-  sha256 = "0bqw30h5b787dw8bn1dj8shz22mlxr1zmcfp68fpyll5vg02540n";
+  sha256 = "0sb3m2qg0ri7zmxhjvrq8n0jmxxjx8rrx9rpibh5f5fbfkibq4gm";

  meta = with lib; {
    description = "Unicode font for glyphs above the Unicode Basic Multilingual Plane";
--- a/pkgs/data/icons/luna-icons/default.nix
+++ b/pkgs/data/icons/luna-icons/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "luna-icons";
-  version = "1.3";
+  version = "1.4";

  src = fetchFromGitHub {
    owner = "darkomarko42";
    repo = pname;
    rev = version;
-    sha256 = "0pww8882qvlnamxzvn7jxyi0h7lffrwld7qqs1q08h73xc3p18nv";
+    sha256 = "sha256-qYFyZT1mLNHBRrX/NX2pmt9P5n8urEK/msQMctSckzE=";
  };

  nativeBuildInputs = [
--- a/pkgs/data/themes/flat-remix-gnome/default.nix
+++ b/pkgs/data/themes/flat-remix-gnome/default.nix
@ -6,20 +6,20 @@

 stdenv.mkDerivation rec {
  pname = "flat-remix-gnome";
-  version = "20210716";
+  version = "20210921";

  src = fetchFromGitHub {
    owner = "daniruiz";
    repo = pname;
    rev = version;
-    hash = "sha256-UAWi4MyqtuSzp5TEkVLYJF7+2tzH/aT60ObNOimCJ4o=";
+    hash = "sha256-HnbKqdDAre2jhZH1Osf3jigz/dQpx7k0fPsVaZz7xC8=";
  };

  nativeBuildInputs = [ glib ];
  makeFlags = [ "PREFIX=$(out)" ];
  preInstall = ''
    # make install will back up this file, it will fail if the file doesn't exist.
-    # https://github.com/daniruiz/flat-remix-gnome/blob/20210716/Makefile#L53
+    # https://github.com/daniruiz/flat-remix-gnome/blob/20210921/Makefile#L53
    mkdir -p $out/share/gnome-shell/
    touch $out/share/gnome-shell/gnome-shell-theme.gresource
  '';
--- a/pkgs/desktops/gnome/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome/core/epiphany/default.nix
@ -48,7 +48,6 @@ stdenv.mkDerivation rec {

  patches = lib.optionals withPantheon [
    # https://github.com/elementary/browser
-    # FIXME: Update the patches when https://github.com/elementary/browser/pull/41 merged
    ./dark-style.patch
    ./navigation-buttons.patch
  ];
--- a/pkgs/desktops/mate/atril/default.nix
+++ b/pkgs/desktops/mate/atril/default.nix
@ -75,6 +75,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/caja-dropbox/default.nix
+++ b/pkgs/desktops/mate/caja-dropbox/default.nix
@ -50,6 +50,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/mate-desktop/caja-dropbox";
    license = with licenses; [ gpl3Plus cc-by-nd-30 ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/caja-extensions/default.nix
+++ b/pkgs/desktops/mate/caja-extensions/default.nix
@ -40,6 +40,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/caja/default.nix
+++ b/pkgs/desktops/mate/caja/default.nix
@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = with licenses; [ gpl2Plus lgpl2Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/engrampa/default.nix
+++ b/pkgs/desktops/mate/engrampa/default.nix
@ -39,6 +39,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = with licenses; [ gpl2Plus lgpl2Plus fdl11Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/eom/default.nix
+++ b/pkgs/desktops/mate/eom/default.nix
@ -34,11 +34,11 @@ stdenv.mkDerivation rec {

  passthru.updateScript = mateUpdateScript { inherit pname version; };

-  meta = {
+  meta = with lib; {
    description = "An image viewing and cataloging program for the MATE desktop";
    homepage = "https://mate-desktop.org";
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.romildo ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.unix;
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/libmatekbd/default.nix
+++ b/pkgs/desktops/mate/libmatekbd/default.nix
@ -22,6 +22,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/mate-desktop/libmatekbd";
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/libmatemixer/default.nix
+++ b/pkgs/desktops/mate/libmatemixer/default.nix
@ -31,6 +31,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/mate-desktop/libmatemixer";
    license = licenses.lgpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/libmateweather/default.nix
+++ b/pkgs/desktops/mate/libmateweather/default.nix
@ -29,6 +29,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/mate-desktop/libmateweather";
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/marco/default.nix
+++ b/pkgs/desktops/mate/marco/default.nix
@ -40,6 +40,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/mate-desktop/marco";
    license = [ licenses.gpl2Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-applets/default.nix
+++ b/pkgs/desktops/mate/mate-applets/default.nix
@ -49,6 +49,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = with licenses; [ gpl2Plus lgpl2Plus ];
    platforms = platforms.linux;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-backgrounds/default.nix
+++ b/pkgs/desktops/mate/mate-backgrounds/default.nix
@ -22,6 +22,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = with licenses; [ gpl2Plus cc-by-sa-40 ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-calc/default.nix
+++ b/pkgs/desktops/mate/mate-calc/default.nix
@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = [ licenses.gpl2Plus ];
    platforms = platforms.linux;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-common/default.nix
+++ b/pkgs/desktops/mate/mate-common/default.nix
@ -13,11 +13,11 @@ stdenv.mkDerivation rec {

  passthru.updateScript = mateUpdateScript { inherit pname version; };

-  meta = {
+  meta = with lib; {
    description = "Common files for development of MATE packages";
    homepage = "https://mate-desktop.org";
-    license = lib.licenses.gpl3Plus;
-    platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.romildo ];
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-control-center/default.nix
+++ b/pkgs/desktops/mate/mate-control-center/default.nix
@ -57,6 +57,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/mate-desktop/mate-control-center";
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-desktop/default.nix
+++ b/pkgs/desktops/mate/mate-desktop/default.nix
@ -30,6 +30,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-icon-theme-faenza/default.nix
+++ b/pkgs/desktops/mate/mate-icon-theme-faenza/default.nix
@ -30,6 +30,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-icon-theme/default.nix
+++ b/pkgs/desktops/mate/mate-icon-theme/default.nix
@ -29,11 +29,11 @@ stdenv.mkDerivation rec {

  passthru.updateScript = mateUpdateScript { inherit pname version; };

-  meta = {
+  meta = with lib; {
    description = "Icon themes from MATE";
    homepage = "https://mate-desktop.org";
-    license = lib.licenses.lgpl3Plus;
-    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.romildo ];
+    license = licenses.lgpl3Plus;
+    platforms = platforms.linux;
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-indicator-applet/default.nix
+++ b/pkgs/desktops/mate/mate-indicator-applet/default.nix
@ -42,6 +42,6 @@ stdenv.mkDerivation rec {
    '';
    license = with licenses; [ gpl3Plus lgpl2Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-media/default.nix
+++ b/pkgs/desktops/mate/mate-media/default.nix
@ -34,6 +34,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = licenses.gpl2Plus;
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo maintainers.chpatrick ];
+    maintainers = teams.mate.members ++ (with maintainers; [ chpatrick ]);
  };
 }
--- a/pkgs/desktops/mate/mate-menus/default.nix
+++ b/pkgs/desktops/mate/mate-menus/default.nix
@ -27,6 +27,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/mate-desktop/mate-menus";
    license = with licenses; [ gpl2Plus lgpl2Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-netbook/default.nix
+++ b/pkgs/desktops/mate/mate-netbook/default.nix
@ -39,6 +39,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = with licenses; [ gpl3Only lgpl2Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-notification-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-notification-daemon/default.nix
@ -37,6 +37,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/mate-desktop/mate-notification-daemon";
    license = with licenses; [ gpl2Plus gpl3Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-panel/default.nix
+++ b/pkgs/desktops/mate/mate-panel/default.nix
@ -46,6 +46,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/mate-desktop/mate-panel";
    license = with licenses; [ gpl2Plus lgpl2Plus fdl11Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-polkit/default.nix
+++ b/pkgs/desktops/mate/mate-polkit/default.nix
@ -31,6 +31,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = [ licenses.gpl2Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-power-manager/default.nix
+++ b/pkgs/desktops/mate/mate-power-manager/default.nix
@ -41,6 +41,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = with licenses; [ gpl2Plus fdl11Plus ];
    platforms = platforms.unix;
-    maintainers = with maintainers; [ romildo chpatrick ];
+    maintainers = teams.mate.members ++ (with maintainers; [ chpatrick ]);
  };
 }
--- a/pkgs/desktops/mate/mate-screensaver/default.nix
+++ b/pkgs/desktops/mate/mate-screensaver/default.nix
@ -41,6 +41,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = with licenses; [ gpl2Plus lgpl2Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-sensors-applet/default.nix
+++ b/pkgs/desktops/mate/mate-sensors-applet/default.nix
@ -38,6 +38,6 @@ stdenv.mkDerivation rec {
    description = "MATE panel applet for hardware sensors";
    license = with licenses; [ gpl2Plus ];
    platforms = platforms.linux;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-session-manager/default.nix
+++ b/pkgs/desktops/mate/mate-session-manager/default.nix
@ -55,6 +55,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/mate-desktop/mate-session-manager";
    license = with licenses; [ gpl2Plus lgpl2Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-settings-daemon/default.nix
+++ b/pkgs/desktops/mate/mate-settings-daemon/default.nix
@ -45,6 +45,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/mate-desktop/mate-settings-daemon";
    license = with licenses; [ gpl2Plus gpl3Plus lgpl2Plus mit ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-system-monitor/default.nix
+++ b/pkgs/desktops/mate/mate-system-monitor/default.nix
@ -37,6 +37,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = [ licenses.gpl2Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-terminal/default.nix
+++ b/pkgs/desktops/mate/mate-terminal/default.nix
@ -33,6 +33,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = licenses.gpl3Plus;
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-themes/default.nix
+++ b/pkgs/desktops/mate/mate-themes/default.nix
@ -34,6 +34,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = with licenses; [ lgpl21Plus lgpl3Only gpl3Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-tweak/default.nix
+++ b/pkgs/desktops/mate/mate-tweak/default.nix
@ -86,6 +86,6 @@ python3Packages.buildPythonApplication rec {
    changelog = "https://github.com/ubuntu-mate/mate-tweak/releases/tag/${version}";
    license = [ licenses.gpl2Plus ];
    platforms = platforms.linux;
-    maintainers = with maintainers; [ luc65r ];
+    maintainers = teams.mate.members ++ (with maintainers; [ luc65r ]);
  };
 }
--- a/pkgs/desktops/mate/mate-user-guide/default.nix
+++ b/pkgs/desktops/mate/mate-user-guide/default.nix
@ -27,6 +27,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = with licenses; [ gpl2Plus fdl12 ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-user-share/default.nix
+++ b/pkgs/desktops/mate/mate-user-share/default.nix
@ -52,6 +52,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/mate-desktop/mate-user-share";
    license = with licenses; [ gpl2Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mate-utils/default.nix
+++ b/pkgs/desktops/mate/mate-utils/default.nix
@ -39,6 +39,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = with licenses; [ gpl2Plus lgpl2Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/mozo/default.nix
+++ b/pkgs/desktops/mate/mozo/default.nix
@ -27,6 +27,6 @@ python3.pkgs.buildPythonApplication rec {
    homepage = "https://github.com/mate-desktop/mozo";
    license = with licenses; [ lgpl2Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/pluma/default.nix
+++ b/pkgs/desktops/mate/pluma/default.nix
@ -38,6 +38,6 @@ stdenv.mkDerivation rec {
    homepage = "https://mate-desktop.org";
    license = with licenses; [ gpl2Plus lgpl2Plus fdl11Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/mate/python-caja/default.nix
+++ b/pkgs/desktops/mate/python-caja/default.nix
@ -33,6 +33,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/mate-desktop/python-caja";
    license = [ licenses.gpl2Plus ];
    platforms = platforms.unix;
-    maintainers = [ maintainers.romildo ];
+    maintainers = teams.mate.members;
  };
 }
--- a/pkgs/desktops/pantheon/apps/elementary-calendar/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-calendar/default.nix
@ -28,7 +28,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-calendar";
-  version = "6.0.1";
+  version = "6.0.2";

  repoName = "calendar";

@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1caxc42jrys5s4x9qai5wdpcwpkmyvnqx9z75974g7swiz1lrzq6";
+    sha256 = "16xp8gfgpyz9xpjsxm6jlk4skkknj65g0q4x0qvw9sg9f1p6a514";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/sideload/default.nix
+++ b/pkgs/desktops/pantheon/apps/sideload/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "sideload";
-  version = "6.0.1";
+  version = "6.0.2";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "0mwcaayzcm5pjcwdd61can93y66jiz4wyz9wr8j5fbns5hbk3z5m";
+    sha256 = "0abpcawmmv5mgzk2i5n9rlairmjr2v9rg9b8c9g7xa085s496bi9";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/keyboard/default.nix
@ -21,22 +21,16 @@

 stdenv.mkDerivation rec {
  pname = "switchboard-plug-keyboard";
-  version = "2.5.0";
+  version = "2.5.1";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "1nsy9fh6qj5kyg22bs1hm6kpsvarwc63q0hl0nbwymvnhfjf6swp";
+    sha256 = "1p1l7dx5v1zzz89hhhkm6n3ls7ig4cf2prh1099f1c054qiy9b0y";
  };

  patches = [
-    # Upstream code not respecting our localedir
-    # https://github.com/elementary/switchboard-plug-keyboard/pull/377
-    (fetchpatch {
-      url = "https://github.com/elementary/switchboard-plug-keyboard/commit/6d8bcadba05b4ee1115b891448b0de31bcba3749.patch";
-      sha256 = "1bppxakj71r3cfy8sw19xbyngb7r6nyirc4g6pjf02cdidhw3v8l";
-    })
    ./0001-Remove-Install-Unlisted-Engines-function.patch
    (substituteAll {
      src = ./fix-paths.patch;
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/mouse-touchpad/default.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "switchboard-plug-mouse-touchpad";
-  version = "6.0.0";
+  version = "6.1.0";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "19kiwrdpan8hr5r79y591591qjx7pm3x814xfkg9vi11ndbcrznr";
+    sha256 = "0nqgbpk1knvbj5xa078i0ka6lzqmaaa873gwj3mhjr5q2gzkw7y5";
  };

  passthru = {
@ -60,12 +60,6 @@ stdenv.mkDerivation rec {
      src = ./fix-paths.patch;
      touchegg = touchegg;
    })
-    # Upstream code not respecting our localedir
-    # https://github.com/elementary/switchboard-plug-mouse-touchpad/pull/185
-    (fetchpatch {
-      url = "https://github.com/elementary/switchboard-plug-mouse-touchpad/commit/a6f84dc08be5dc6f7535082bacfa24e2dff4ef67.patch";
-      sha256 = "0fxl894dzw1f84n36mb9y7gshs69xcb0samvs2gsa0pcdlzfp3cy";
-    })
  ];

  meta = with lib; {
--- a/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-greeter/default.nix
@ -32,7 +32,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-greeter";
-  version = "6.0.0";
+  version = "6.0.1";

  repoName = "greeter";

@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1ny1003bbpdscc4kr2d94zc5vxm30y64dpj3fpd5zz2p2g0cq2h9";
+    sha256 = "1f606ds56sp1c58q8dblfpaq9pwwkqw9i4gkwksw45m2xkwlbflq";
  };

  passthru = {
@ -89,12 +89,6 @@ stdenv.mkDerivation rec {
  ];

  patches = [
-    # Upstream code not respecting our localedir
-    # https://github.com/elementary/greeter/pull/545
-    (fetchpatch {
-      url = "https://github.com/elementary/greeter/commit/d1373a7db827bc753bfcd70d0c8f25460ea9f1de.patch";
-      sha256 = "0s8l7ycd2s307d3dh1p4vdk33dbzjzqwxs6msyb9w0ycfyxlwdvp";
-    })
    ./sysconfdir-install.patch
    # Needed until https://github.com/elementary/greeter/issues/360 is fixed
    (substituteAll {
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@ -93,6 +93,7 @@ let
      # libsanitizer requires netrom/netrom.h which is not
      # available in uclibc.
      "--disable-libsanitizer"
+    ] ++ lib.optionals (targetPlatform.libc == "uclibc") [
      # In uclibc cases, libgomp needs an additional '-ldl'
      # and as I don't know how to pass it, I disable libgomp.
      "--disable-libgomp"
--- a/pkgs/development/compilers/idris2/default.nix
+++ b/pkgs/development/compilers/idris2/default.nix
@ -13,13 +13,13 @@
 # Uses scheme to bootstrap the build of idris2
 stdenv.mkDerivation rec {
  pname = "idris2";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "idris-lang";
    repo = "Idris2";
    rev = "v${version}";
-    sha256 = "sha256-JRI5/dEy9GT8SIj3X+UcJ0SiTQ20pqevWeTNX6e+Nfw=";
+    sha256 = "sha256-6CTn8o5geWSesXO7vTrrV/2EOQ3f+nPQ2M5cem13ZSY=";
  };

  # We do not add any propagatedNativeBuildInputs because we do not want the
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "kotlin";
-  version = "1.5.30";
+  version = "1.5.31";

  src = fetchurl {
    url = "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-compiler-${version}.zip";
-    sha256 = "sha256-Je69ubsuFl5LqO+/j/lDxF1Pw52//CwcqgWejdgTZ18=";
+    sha256 = "sha256-ZhERKG8+WsBqrzqUA9hp2alqF2tisUGBS+YmpHJJ/p4=";
  };

  propagatedBuildInputs = [ jre ] ;
--- a/pkgs/development/compilers/mlkit/default.nix
+++ b/pkgs/development/compilers/mlkit/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "mlkit";
-  version = "4.5.7";
+  version = "4.5.9";

  src = fetchFromGitHub {
    owner = "melsman";
    repo = "mlkit";
    rev = "v${version}";
-    sha256 = "sha256-Wq+Os7nzRA5Pxz6Ba7DudcDQs3KA0eYVLy1nO/A16EE=";
+    sha256 = "sha256-b+iPuGB82a0r0zl49+RbalxR6OpFNXOxZgubzKE+2M4=";
  };

  nativeBuildInputs = [ autoreconfHook mlton ];
--- a/pkgs/development/libraries/eccodes/default.nix
+++ b/pkgs/development/libraries/eccodes/default.nix
@ -1,39 +1,50 @@
-{ fetchurl, lib, stdenv
-, cmake, netcdf, openjpeg, libpng, gfortran
-, enablePython ? false, pythonPackages
+{ fetchurl
+, lib
+, stdenv
+, cmake
+, netcdf
+, openjpeg
+, libpng
+, gfortran
+, perl
+, enablePython ? false
+, pythonPackages
 , enablePosixThreads ? false
-, enableOpenMPThreads ? false}:
-with lib;
+, enableOpenMPThreads ? false
+}:
+
 stdenv.mkDerivation rec {
  pname = "eccodes";
-  version = "2.12.5";
+  version = "2.23.0";

  src = fetchurl {
    url = "https://confluence.ecmwf.int/download/attachments/45757960/eccodes-${version}-Source.tar.gz";
-    sha256 = "0576fccng4nvmq5gma1nb1v00if5cwl81w4nv5zkb80q5wicn50c";
+    sha256 = "sha256-y9yFMlN+loLxqT3bA0QEFrZpBqTMJd7Dy9c5QNGUvww=";
  };

  postPatch = ''
    substituteInPlace cmake/FindOpenJPEG.cmake --replace openjpeg-2.1 ${openjpeg.incDir}
  '';

-  nativeBuildInputs = [ cmake gfortran ];
+  nativeBuildInputs = [ cmake gfortran perl ];

-  buildInputs = [ netcdf
-                  openjpeg
-                  libpng
-                ];
+  buildInputs = [
+    netcdf
+    openjpeg
+    libpng
+  ];

-  propagatedBuildInputs = optionals enablePython [
-                  pythonPackages.python
-                  pythonPackages.numpy
-                ];
+  propagatedBuildInputs = lib.optionals enablePython [
+    pythonPackages.python
+    pythonPackages.numpy
+  ];

-  cmakeFlags = [ "-DENABLE_PYTHON=${if enablePython then "ON" else "OFF"}"
-                 "-DENABLE_PNG=ON"
-                 "-DENABLE_ECCODES_THREADS=${if enablePosixThreads then "ON" else "OFF"}"
-                 "-DENABLE_ECCODES_OMP_THREADS=${if enableOpenMPThreads then "ON" else "OFF"}"
-               ];
+  cmakeFlags = [
+    "-DENABLE_PYTHON=${if enablePython then "ON" else "OFF"}"
+    "-DENABLE_PNG=ON"
+    "-DENABLE_ECCODES_THREADS=${if enablePosixThreads then "ON" else "OFF"}"
+    "-DENABLE_ECCODES_OMP_THREADS=${if enableOpenMPThreads then "ON" else "OFF"}"
+  ];

  doCheck = true;

@ -44,7 +55,7 @@ stdenv.mkDerivation rec {
    ctest -R "eccodes_t_(definitions|calendar|unit_tests|md5|uerra|grib_2nd_order_numValues|julian)" -VV
  '';

-  meta = {
+  meta = with lib; {
    homepage = "https://confluence.ecmwf.int/display/ECC/";
    license = licenses.asl20;
    maintainers = with maintainers; [ knedlsepp ];
--- a/pkgs/development/libraries/glibc/locales.nix
+++ b/pkgs/development/libraries/glibc/locales.nix
@ -34,9 +34,9 @@ callPackage ./common.nix { inherit stdenv; } {
      + lib.optionalString (!allLocales) ''
      # Check that all locales to be built are supported
      echo -n '${lib.concatMapStrings (s: s + " \\\n") locales}' \
-        | sort > locales-to-build.txt
+        | sort -u > locales-to-build.txt
      cat ../glibc-2*/localedata/SUPPORTED | grep ' \\' \
-        | sort > locales-supported.txt
+        | sort -u > locales-supported.txt
      comm -13 locales-supported.txt locales-to-build.txt \
        > locales-unsupported.txt
      if [[ $(wc -c locales-unsupported.txt) != "0 locales-unsupported.txt" ]]; then
--- a/pkgs/development/libraries/libdigidocpp/default.nix
+++ b/pkgs/development/libraries/libdigidocpp/default.nix
@ -1,26 +1,26 @@
-{ lib, stdenv, fetchurl, cmake, libdigidoc, minizip, pcsclite, opensc, openssl
+{ lib, stdenv, fetchurl, cmake, minizip, pcsclite, opensc, openssl
 , xercesc, xml-security-c, pkg-config, xsd, zlib, xalanc, xxd }:

 stdenv.mkDerivation rec {
-  version = "3.14.6";
+  version = "3.14.7";
  pname = "libdigidocpp";

  src = fetchurl {
     url = "https://github.com/open-eid/libdigidocpp/releases/download/v${version}/libdigidocpp-${version}.tar.gz";
-     sha256 = "sha256-zDMxJyL/T3cXrqgMT15yZlCozgyOt5nNreottuuiGHk=";
+     sha256 = "sha256-QdctW2+T8kPNUJv30pXZ/qfnw1Uhq6gScSjUI+bZMfY=";
  };

  nativeBuildInputs = [ cmake pkg-config xxd ];

  buildInputs = [
-    libdigidoc minizip pcsclite opensc openssl xercesc
+    minizip pcsclite opensc openssl xercesc
    xml-security-c xsd zlib xalanc
  ];

  meta = with lib; {
    description = "Library for creating DigiDoc signature files";
    homepage = "http://www.id.ee/";
-    license = licenses.lgpl2;
+    license = licenses.lgpl21Plus;
    platforms = platforms.linux;
    maintainers = [ maintainers.jagajaga ];
  };
--- a/pkgs/development/libraries/libmediainfo/default.nix
+++ b/pkgs/development/libraries/libmediainfo/default.nix
@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, autoreconfHook, pkg-config, libzen, zlib }:

 stdenv.mkDerivation rec {
-  version = "21.03";
+  version = "21.09";
  pname = "libmediainfo";
  src = fetchurl {
    url = "https://mediaarea.net/download/source/libmediainfo/${version}/libmediainfo_${version}.tar.xz";
-    sha256 = "1jm4mk539wf3crgpcddgwdixshwdzm37mkb5441lifhcz2mykdsn";
+    sha256 = "09pinxqw3z3hxrafn67clw1cb1z9aqfy6gkiavginfm0yr299gk9";
  };

  nativeBuildInputs = [ autoreconfHook pkg-config ];
--- a/pkgs/development/libraries/libopenaptx/default.nix
+++ b/pkgs/development/libraries/libopenaptx/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libopenaptx";
-  version = "0.2.0";
+  version = "0.2.1";

  src = fetchFromGitHub {
    owner = "pali";
    repo = "libopenaptx";
    rev = version;
-    sha256 = "nTpw4vWgJ765FM6Es3SzaaaZr0YDydXglb0RWLbiigI=";
+    sha256 = "sha256-4FYKxw1U+efCfzKOPSDJH8a/dG0KV+anJDgxjqzD80k=";
  };

  makeFlags = [
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Audio Processing Technology codec (aptX)";
-    license = licenses.lgpl21Plus;
+    license = licenses.gpl3Plus;
    homepage = "https://github.com/pali/libopenaptx";
    platforms = platforms.linux;
    maintainers = with maintainers; [ orivej ];
--- a/pkgs/development/libraries/tinycbor/default.nix
+++ b/pkgs/development/libraries/tinycbor/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "tinycbor";
-  version = "0.5.3";
+  version = "0.5.4";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "tinycbor";
    rev = "v${version}";
-    sha256 = "11y6liyd3fvc28d3dinii16sxgwgg2p29p41snc4h82dvvx5bb2b";
+    sha256 = "sha256-H0NTUaSOGMtbM1+EQVOsYoPP+A1FGvUM7XrbPxArR88=";
  };

  makeFlags = [ "prefix=$(out)" ];
--- a/pkgs/development/misc/resholve/README.md
+++ b/pkgs/development/misc/resholve/README.md
@ -84,6 +84,9 @@ that the `resholve` CLI expects. Here's an overview:
 | fake          | attrset | [directives](#controlling-resolution-with-directives) |
 | fix           | attrset | [directives](#controlling-resolution-with-directives) |
 | keep          | attrset | [directives](#controlling-resolution-with-directives) |
+| lore          | string  | [lore directory](#controlling-nested-resolution-with-lore)  |
+| execers       | list    | [execer lore directive](#controlling-nested-resolution-with-lore) |
+| wrappers      | list    | [wrapper lore directive](#controlling-nested-resolution-with-lore) |

 ## Controlling resolution with directives

@ -156,3 +159,52 @@ keep = {
  "~/.bashrc" = true;
 };
 ```
+
+## Controlling nested resolution with lore
+
+Initially, resolution of commands in the arguments to command-executing
+commands was limited to one level for a hard-coded list of builtins and
+external commands. resholve can now resolve these recursively.
+
+This feature combines information (_lore_) that the resholve Nix API
+obtains via binlore ([nixpkgs](../../tools/analysis/binlore), [repo](https://github.com/abathur/resholve)),
+with some rules (internal to resholve) for locating sub-executions in
+some of the more common commands.
+
+- "execer" lore identifies whether an executable can, cannot,
+  or might execute its arguments. Every "can" or "might" verdict requires
+  either built-in rules for finding the executable, or human triage.
+- "wrapper" lore maps shell exec wrappers to the programs they exec so
+  that resholve can substitute an executable's verdict for its wrapper's.
+
+There will be more mechanisms for controlling this process in the future
+(and your reports/experiences will play a role in shaping them...) For now,
+the main lever is the ability to substitute your own lore. This is how you'd
+do it piecemeal:
+
+```
+# --execer 'cannot:${openssl.bin}/bin/openssl can:${openssl.bin}/bin/c_rehash'
+execer = [
+  /*
+    This is the same verdict binlore will
+    come up with. It's a no-op just to demo
+    how to fiddle lore via the Nix API.
+  */
+  "cannot:${openssl.bin}/bin/openssl"
+  # different verdict, but not used
+  "can:${openssl.bin}/bin/c_rehash"
+];
+
+# --wrapper '${gnugrep}/bin/egrep:${gnugrep}/bin/grep'
+execer = [
+  /*
+    This is the same verdict binlore will
+    come up with. It's a no-op just to demo
+    how to fiddle lore via the Nix API.
+  */
+  "${gnugrep}/bin/egrep:${gnugrep}/bin/grep"
+];
+```
+
+The format is fairly simple to generate--you can script your own generator if
+you need to modify the lore.
--- a/pkgs/development/misc/resholve/default.nix
+++ b/pkgs/development/misc/resholve/default.nix
@ -1,9 +1,18 @@
 { callPackage
-, doCheck ? true
+, ...
 }:

+let
+  source = callPackage ./source.nix { };
+  deps = callPackage ./deps.nix { };
+in
 rec {
-  resholve = callPackage ./resholve.nix { inherit doCheck; };
-  resholvePackage =
-    callPackage ./resholve-package.nix { inherit resholve; };
+  resholve = callPackage ./resholve.nix {
+    inherit (source) rSrc;
+    inherit (source) version;
+    inherit (deps.oil) oildev;
+  };
+  resholvePackage = callPackage ./resholve-package.nix {
+    inherit resholve;
+  };
 }
--- a/pkgs/development/misc/resholve/deps.nix
+++ b/pkgs/development/misc/resholve/deps.nix
@ -1,120 +1,18 @@
-{ lib, stdenv
-, python27Packages
-, fetchFromGitHub
-, makeWrapper
-, # re2c deps
-  autoreconfHook
-, # py-yajl deps
-  git
-, # oil deps
-  readline
-, cmark
-, file
-, glibcLocales
-, oilPatches ? [ ]
+{ callPackage
+, ...
 }:

 /*
-Notes on specific dependencies:
- if/when python2.7 is removed from nixpkgs, this may need to figure
+  Notes on specific dependencies:
+  - if/when python2.7 is removed from nixpkgs, this may need to figure
  out how to build oil's vendored python2
- I'm not sure if glibcLocales is worth the addition here. It's to fix
+  - I'm not sure if glibcLocales is worth the addition here. It's to fix
  a libc test oil runs. My oil fork just disabled the libc tests, but
  I haven't quite decided if that's the right long-term call, so I
  didn't add a patch for it here yet.
 */

 rec {
-  # had to add this as well; 1.3 causes a break here; sticking
-  # to oil's official 1.0.3 dep for now.
-  re2c = stdenv.mkDerivation rec {
-    pname = "re2c";
-    version = "1.0.3";
-    sourceRoot = "${src.name}/re2c";
-    src = fetchFromGitHub {
-      owner = "skvadrik";
-      repo = "re2c";
-      rev = version;
-      sha256 = "0grx7nl9fwcn880v5ssjljhcb9c5p2a6xpwil7zxpmv0rwnr3yqi";
-    };
-    nativeBuildInputs = [ autoreconfHook ];
-    preCheck = ''
-      patchShebangs run_tests.sh
-    '';
-  };
-
-  py-yajl = python27Packages.buildPythonPackage rec {
-    pname = "oil-pyyajl-unstable";
-    version = "2019-12-05";
-    src = fetchFromGitHub {
-      owner = "oilshell";
-      repo = "py-yajl";
-      rev = "eb561e9aea6e88095d66abcc3990f2ee1f5339df";
-      sha256 = "17hcgb7r7cy8r1pwbdh8di0nvykdswlqj73c85k6z8m0filj3hbh";
-      fetchSubmodules = true;
-    };
-    # just for submodule IIRC
-    nativeBuildInputs = [ git ];
-  };
-
-  # resholve's primary dependency is this developer build of the oil shell.
-  oildev = python27Packages.buildPythonPackage rec {
-    pname = "oildev-unstable";
-    version = "2021-02-26";
-
-    src = fetchFromGitHub {
-      owner = "oilshell";
-      repo = "oil";
-      rev = "11c6bd3ca0e126862c7a1f938c8510779837affa";
-      hash = "sha256-UTQywtx+Dn1/qx5uocqgGn7oFYW4R5DbuiRNF8t/BzY=";
-
-      /*
-      It's not critical to drop most of these; the primary target is
-      the vendored fork of Python-2.7.13, which is ~ 55M and over 3200
-      files, dozens of which get interpreter script patches in fixup.
-      */
-      extraPostFetch = ''
-        rm -rf Python-2.7.13 benchmarks metrics py-yajl rfc gold web testdata services demo devtools cpp
-      '';
-    };
-
-    # TODO: not sure why I'm having to set this for nix-build...
-    #       can anyone tell if I'm doing something wrong?
-    SOURCE_DATE_EPOCH = 315532800;
-
-    # These aren't, strictly speaking, nix/nixpkgs specific, but I've
-    # had hell upstreaming them. Pulling from resholve source and
-    # passing in from resholve.nix
-    patches = oilPatches;
-
-    buildInputs = [ readline cmark py-yajl ];
-
-    nativeBuildInputs = [ re2c file makeWrapper ];
-
-    propagatedBuildInputs = with python27Packages; [ six typing ];
-
-    doCheck = true;
-
-    preBuild = ''
-      build/dev.sh all
-    '';
-
-    postPatch = ''
-      patchShebangs asdl build core doctools frontend native oil_lang
-    '';
-
-    _NIX_SHELL_LIBCMARK = "${cmark}/lib/libcmark${stdenv.hostPlatform.extensions.sharedLibrary}";
-
-    # See earlier note on glibcLocales
-    LOCALE_ARCHIVE = lib.optionalString (stdenv.buildPlatform.libc == "glibc") "${glibcLocales}/lib/locale/locale-archive";
-
-    meta = {
-      description = "A new unix shell";
-      homepage = "https://www.oilshell.org/";
-      license = with lib.licenses; [
-        psfl # Includes a portion of the python interpreter and standard library
-        asl20 # Licence for Oil itself
-      ];
-    };
-  };
+  # binlore = callPackage ./binlore.nix { };
+  oil = callPackage ./oildev.nix { };
 }
--- a/pkgs/development/misc/resholve/oildev.nix
+++ b/pkgs/development/misc/resholve/oildev.nix
@ -0,0 +1,121 @@
+{ lib
+, stdenv
+, python27Packages
+, callPackage
+, fetchFromGitHub
+, makeWrapper
+, # re2c deps
+  autoreconfHook
+, # py-yajl deps
+  git
+, # oil deps
+  readline
+, cmark
+, file
+, glibcLocales
+}:
+
+rec {
+  re2c = stdenv.mkDerivation rec {
+    pname = "re2c";
+    version = "1.0.3";
+    sourceRoot = "${src.name}/re2c";
+    src = fetchFromGitHub {
+      owner = "skvadrik";
+      repo = "re2c";
+      rev = version;
+      sha256 = "0grx7nl9fwcn880v5ssjljhcb9c5p2a6xpwil7zxpmv0rwnr3yqi";
+    };
+    nativeBuildInputs = [ autoreconfHook ];
+    preCheck = ''
+      patchShebangs run_tests.sh
+    '';
+  };
+
+  py-yajl = python27Packages.buildPythonPackage rec {
+    pname = "oil-pyyajl-unstable";
+    version = "2019-12-05";
+    src = fetchFromGitHub {
+      owner = "oilshell";
+      repo = "py-yajl";
+      rev = "eb561e9aea6e88095d66abcc3990f2ee1f5339df";
+      sha256 = "17hcgb7r7cy8r1pwbdh8di0nvykdswlqj73c85k6z8m0filj3hbh";
+      fetchSubmodules = true;
+    };
+    # just for submodule IIRC
+    nativeBuildInputs = [ git ];
+  };
+
+  oildev = python27Packages.buildPythonPackage rec {
+    pname = "oildev-unstable";
+    version = "2021-07-14";
+
+    src = fetchFromGitHub {
+      owner = "oilshell";
+      repo = "oil";
+      # rev == present HEAD of release/0.8.12
+      rev = "799c0703d1da86cb80d1f5b163edf9369ad77cf1";
+      hash = "sha256-QNSISr719ycZ1Z0quxHWzCb3IvHGj9TpogaYz20hDM4=";
+
+      /*
+        It's not critical to drop most of these; the primary target is
+        the vendored fork of Python-2.7.13, which is ~ 55M and over 3200
+        files, dozens of which get interpreter script patches in fixup.
+      */
+      extraPostFetch = ''
+        rm -rf Python-2.7.13 benchmarks metrics py-yajl rfc gold web testdata services demo devtools cpp
+      '';
+    };
+
+    # TODO: not sure why I'm having to set this for nix-build...
+    #       can anyone tell if I'm doing something wrong?
+    SOURCE_DATE_EPOCH = 315532800;
+
+    # patch to support a python package, pass tests on macOS, etc.
+    patchSrc = fetchFromGitHub {
+      owner = "abathur";
+      repo = "nix-py-dev-oil";
+      rev = "v0.8.12";
+      hash = "sha256-/EvwxL201lGsioL0lIhzM8VTghe6FuVbc3PBJgY8c8E=";
+    };
+    patches = [
+      "${patchSrc}/0001-add_setup_py.patch"
+      "${patchSrc}/0002-add_MANIFEST_in.patch"
+      "${patchSrc}/0004-disable-internal-py-yajl-for-nix-built.patch"
+      "${patchSrc}/0006-disable_failing_libc_tests.patch"
+      "${patchSrc}/0007-namespace_via_init.patch"
+    ];
+
+    buildInputs = [ readline cmark py-yajl ];
+
+    nativeBuildInputs = [ re2c file makeWrapper ];
+
+    propagatedBuildInputs = with python27Packages; [ six typing ];
+
+    doCheck = true;
+
+    preBuild = ''
+      build/dev.sh all
+    '';
+
+    postPatch = ''
+      patchShebangs asdl build core doctools frontend native oil_lang
+    '';
+
+    # TODO: this may be obsolete?
+    _NIX_SHELL_LIBCMARK = "${cmark}/lib/libcmark${stdenv.hostPlatform.extensions.sharedLibrary}";
+
+    # See earlier note on glibcLocales TODO: verify needed?
+    LOCALE_ARCHIVE = lib.optionalString (stdenv.buildPlatform.libc == "glibc") "${glibcLocales}/lib/locale/locale-archive";
+
+    # not exhaustive; just a spot-check for now
+    pythonImportsCheck = [ "oil" "oil._devbuild" ];
+
+    meta = {
+      license = with lib.licenses; [
+        psfl # Includes a portion of the python interpreter and standard library
+        asl20 # Licence for Oil itself
+      ];
+    };
+  };
+}
--- a/pkgs/development/misc/resholve/resholve-package.nix
+++ b/pkgs/development/misc/resholve/resholve-package.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, resholve }:
+{ stdenv, lib, resholve, binlore }:

 { pname
 , src
@ -10,11 +10,11 @@
 let
  inherit stdenv;
  /* These functions break up the work of partially validating the
-   * 'solutions' attrset and massaging it into env/cli args.
-   *
-   * Note: some of the left-most args do not *have* to be passed as
-   * deep as they are, but I've done so to provide more error context
-   */
+    'solutions' attrset and massaging it into env/cli args.
+
+    Note: some of the left-most args do not *have* to be passed as
+    deep as they are, but I've done so to provide more error context
+  */

  # for brevity / line length
  spaces = l: builtins.concatStringsSep " " l;
@ -72,7 +72,8 @@ let
  /* Build a single resholve invocation */
  makeInvocation = solution: value:
    if validateSolution value then
-      "${makeEnvs solution value} resholve --overwrite ${makeArgs value}"
+    # we pass resholve a directory
+      "RESHOLVE_LORE=${binlore.collect { drvs = value.inputs; } } ${makeEnvs solution value} resholve --overwrite ${makeArgs value}"
    else throw "invalid solution"; # shouldn't trigger for now

  /* Build resholve invocation for each solution. */
@ -87,10 +88,19 @@ let
    # enable below for verbose debug info if needed
    # supports default python.logging levels
    # LOGLEVEL="INFO";
+    /*
+      subshell/PS4/set -x and : command to output resholve envs
+      and invocation. Extra context makes it clearer what the
+      Nix API is doing, makes nix-shell debugging easier, etc.
+    */
    preFixup = ''
-      pushd "$out"
-      ${builtins.concatStringsSep "\n" (makeCommands solutions)}
-      popd
+      (
+        cd "$out"
+        PS4=$'\x1f'"\033[33m[resholve context]\033[0m "
+        set -x
+        : changing directory to $PWD
+        ${builtins.concatStringsSep "\n" (makeCommands solutions)}
+      )
    '';
  }));
 in
--- a/pkgs/development/misc/resholve/resholve.nix
+++ b/pkgs/development/misc/resholve/resholve.nix
@ -2,48 +2,22 @@
 , callPackage
 , python27Packages
 , installShellFiles
-, fetchFromGitHub
-, file
-, findutils
-, gettext
-, bats
-, bash
-, doCheck ? true
+, rSrc
+, version
+, oildev
+, binlore
 }:
-let
-  version = "0.5.1";
-  rSrc = fetchFromGitHub {
-    owner = "abathur";
-    repo = "resholve";
-    rev = "v${version}";
-    hash = "sha256-+9MjvO1H+A3Ol2to5tWqdpNR7osQsYcbkX9avAqyrKw=";
-  };
-  deps = callPackage ./deps.nix {
-    /*
-    resholve needs to patch Oil, but trying to avoid adding
-    them all *to* nixpkgs, since they aren't specific to
-    nix/nixpkgs.
-    */
-    oilPatches = [
-      "${rSrc}/0001-add_setup_py.patch"
-      "${rSrc}/0002-add_MANIFEST_in.patch"
-      "${rSrc}/0003-fix_codegen_shebang.patch"
-      "${rSrc}/0004-disable-internal-py-yajl-for-nix-built.patch"
-      "${rSrc}/0005_revert_libc_locale.patch"
-      "${rSrc}/0006_disable_failing_libc_tests.patch"
-      "${rSrc}/0007_restore_root_init_py.patch"
-    ];
-  };
-in
+
 python27Packages.buildPythonApplication {
  pname = "resholve";
  inherit version;
  src = rSrc;
  format = "other";
+  dontBuild = true;

  nativeBuildInputs = [ installShellFiles ];

-  propagatedBuildInputs = [ deps.oildev python27Packages.configargparse ];
+  propagatedBuildInputs = [ oildev python27Packages.configargparse ];

  patchPhase = ''
    for file in resholve; do
@ -56,23 +30,14 @@ python27Packages.buildPythonApplication {
    installManPage resholve.1
  '';

-  inherit doCheck;
-  checkInputs = [ bats ];
-  RESHOLVE_PATH = "${lib.makeBinPath [ file findutils gettext ]}";
-
-  checkPhase = ''
-    # explicit interpreter for test suite
-    export INTERP="${bash}/bin/bash" PATH="$out/bin:$PATH"
-    patchShebangs .
-    ./test.sh
-  '';
-
  # Do not propagate Python; may be obsoleted by nixos/nixpkgs#102613
  # for context on why, see abathur/resholve#20
  postFixup = ''
    rm $out/nix-support/propagated-build-inputs
  '';

+  passthru.tests = callPackage ./test.nix { inherit rSrc; inherit binlore; };
+
  meta = with lib; {
    description = "Resolve external shell-script dependencies";
    homepage = "https://github.com/abathur/resholve";
--- a/pkgs/development/misc/resholve/source.nix
+++ b/pkgs/development/misc/resholve/source.nix
@ -0,0 +1,19 @@
+{ fetchFromGitHub
+, ...
+}:
+
+rec {
+  version = "0.6.0";
+  rSrc =
+    # local build -> `make ci`; `make clean` to restore
+    # return to remote source
+    # if builtins.pathExists ./.local
+    # then ./.
+    # else
+      fetchFromGitHub {
+        owner = "abathur";
+        repo = "resholve";
+        rev = "v${version}";
+        hash = "sha256-GfhhU9f5kiYcuYTPKWXCIkAGsz7GhAUGjAmIZ8Ww5X4=";
+      };
+}
--- a/Show More
+++ b/Show More