Merge release-23.05 into staging-next-23.05

2026-10-02 21:10:08 +00:00 · 2023-08-03 00:13:55 +00:00
parent 8f769ddbd4 ad73028def
commit 71fae6920b
19 changed files with 942 additions and 925 deletions
--- a/pkgs/applications/networking/browsers/chromium/README.md
+++ b/pkgs/applications/networking/browsers/chromium/README.md
@@ -17,9 +17,9 @@
    Hydra). We use these channels for testing and to fix build errors in advance
    so that `chromium` updates are trivial and can be merged fast.
  - `google-chrome`, `google-chrome-beta`, `google-chrome-dev`: Updated via
-    Chromium's `upstream-info.json`
+    Chromium's `upstream-info.nix`
  - `ungoogled-chromium`: @squalus
-  - `chromedriver`: Updated via Chromium's `upstream-info.json` and not built
+  - `chromedriver`: Updated via Chromium's `upstream-info.nix` and not built
    from source.

 # Upstream links
@@ -35,9 +35,9 @@
 # Updating Chromium

 Simply run `./pkgs/applications/networking/browsers/chromium/update.py` to
-update `upstream-info.json`. After updates it is important to test at least
+update `upstream-info.nix`. After updates it is important to test at least
 `nixosTests.chromium` (or basic manual testing) and `google-chrome` (which
-reuses `upstream-info.json`).
+reuses `upstream-info.nix`).

 Note: Due to the script downloading many large tarballs it might be
 necessary to adjust the available tmpfs size (it defaults to 10% of the
@@ -75,7 +75,7 @@ All updates are considered security critical and should be ported to the stable
 channel ASAP. When there is a new stable release the old one should receive
 security updates for roughly one month. After that it is important to mark
 Chromium as insecure (see 69e4ae56c4b for an example; it is important that the
-tested job still succeeds and that all browsers that use `upstream-info.json`
+tested job still succeeds and that all browsers that use `upstream-info.nix`
 are marked as insecure).

 ## Major version updates
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -374,7 +374,12 @@ let
        gn = gnChromium;
      };
    };
-  };
+  }
+  # overwrite `version` with the exact same `version` from the same source,
+  # except it internally points to `upstream-info.nix` for
+  # `builtins.unsafeGetAttrPos`, which is used by ofborg to decide
+  # which maintainers need to be pinged.
+  // builtins.removeAttrs upstream-info (builtins.filter (e: e != "version") (builtins.attrNames upstream-info));

 # Remove some extraAttrs we supplied to the base attributes already.
 in stdenv.mkDerivation (base // removeAttrs extraAttrs [
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@@ -22,11 +22,11 @@ let
  llvmPackages = llvmPackages_16;
  stdenv = llvmPackages.stdenv;

-  upstream-info = (lib.importJSON ./upstream-info.json).${channel};
+  upstream-info = (import ./upstream-info.nix).${channel};

  # Helper functions for changes that depend on specific versions:
  warnObsoleteVersionConditional = min-version: result:
-    let ungoogled-version = (lib.importJSON ./upstream-info.json).ungoogled-chromium.version;
+    let ungoogled-version = (import ./upstream-info.nix).ungoogled-chromium.version;
    in lib.warnIf
         (lib.versionAtLeast ungoogled-version min-version)
         "chromium: ungoogled version ${ungoogled-version} is newer than a conditional bounded at ${min-version}. You can safely delete it."
@@ -71,10 +71,10 @@ let
      # Use the latest stable Chrome version if necessary:
      version = if chromium.upstream-info.sha256bin64 != null
        then chromium.upstream-info.version
-        else (lib.importJSON ./upstream-info.json).stable.version;
+        else (import ./upstream-info.nix).stable.version;
      sha256 = if chromium.upstream-info.sha256bin64 != null
        then chromium.upstream-info.sha256bin64
-        else (lib.importJSON ./upstream-info.json).stable.sha256bin64;
+        else (import ./upstream-info.nix).stable.sha256bin64;
    in fetchurl {
      urls = map (repo: "${repo}/${pkgName}/${pkgName}_${version}-1_amd64.deb") [
        "https://dl.google.com/linux/chrome/deb/pool/main/g"
@@ -139,8 +139,6 @@ let

  sandboxExecutableName = chromium.browser.passthru.sandboxExecutableName;

-  version = chromium.browser.version;
-
  # We want users to be able to enableWideVine without rebuilding all of
  # chromium, so we have a separate derivation here that copies chromium
  # and adds the unfree WidevineCdm.
@@ -157,7 +155,7 @@ let
 in stdenv.mkDerivation {
  pname = lib.optionalString ungoogled "ungoogled-"
    + "chromium${suffix}";
-  inherit version;
+  inherit (chromium.browser) version;

  nativeBuildInputs = [
    makeWrapper ed
@@ -236,3 +234,9 @@ in stdenv.mkDerivation {
    inherit chromeSrc sandboxExecutableName;
  };
 }
+# the following is a complicated and long-winded variant of
+# `inherit (chromium.browser) version`, with the added benefit
+# that it keeps the pointer to upstream-info.nix for
+# builtins.unsafeGetAttrPos, which is what ofborg uses to
+# decide which maintainers need to be pinged.
+// builtins.removeAttrs chromium.browser (builtins.filter (e: e != "version") (builtins.attrNames chromium.browser))
--- a/pkgs/applications/networking/browsers/chromium/update.py
+++ b/pkgs/applications/networking/browsers/chromium/update.py
@@ -1,8 +1,8 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i python -p python3 nix nix-prefetch-git
+#! nix-shell -i python -p python3 nix nixfmt nix-prefetch-git

 """This script automatically updates chromium, google-chrome, chromedriver, and ungoogled-chromium
-via upstream-info.json."""
+via upstream-info.nix."""
 # Usage: ./update.py [--commit]

 import base64
@@ -23,16 +23,23 @@ RELEASES_URL = 'https://versionhistory.googleapis.com/v1/chrome/platforms/linux/
 DEB_URL = 'https://dl.google.com/linux/chrome/deb/pool/main/g'
 BUCKET_URL = 'https://commondatastorage.googleapis.com/chromium-browser-official'

-JSON_PATH = dirname(abspath(__file__)) + '/upstream-info.json'
+PIN_PATH = dirname(abspath(__file__)) + '/upstream-info.nix'
 UNGOOGLED_FLAGS_PATH = dirname(abspath(__file__)) + '/ungoogled-flags.toml'
 COMMIT_MESSAGE_SCRIPT = dirname(abspath(__file__)) + '/get-commit-message.py'


-def load_json(path):
-    """Loads the given JSON file."""
-    with open(path, 'r') as f:
-        return json.load(f)
+def load_as_json(path):
+    """Loads the given nix file as JSON."""
+    out = subprocess.check_output(['nix-instantiate', '--eval', '--strict', '--json', path])
+    return json.loads(out)

+def save_dict_as_nix(path, input):
+    """Saves the given dict/JSON as nix file."""
+    json_string = json.dumps(input)
+    nix = subprocess.check_output(['nix-instantiate', '--eval', '--expr', '{ json }: builtins.fromJSON json', '--argstr', 'json', json_string])
+    formatted = subprocess.check_output(['nixfmt'], input=nix)
+    with open(path, 'w') as out:
+        out.write(formatted.decode())

 def nix_prefetch_url(url, algo='sha256'):
    """Prefetches the content of the given URL."""
@@ -160,7 +167,7 @@ def print_updates(channels_old, channels_new):


 channels = {}
-last_channels = load_json(JSON_PATH)
+last_channels = load_as_json(PIN_PATH)


 print(f'GET {RELEASES_URL}', file=sys.stderr)
@@ -225,9 +232,7 @@ if len(sys.argv) == 2 and sys.argv[1] == '--commit':
        version_new = sorted_channels[channel_name]['version']
        if LooseVersion(version_old) < LooseVersion(version_new):
            last_channels[channel_name] = sorted_channels[channel_name]
-            with open(JSON_PATH, 'w') as out:
-                json.dump(last_channels, out, indent=2)
-                out.write('\n')
+            save_dict_as_nix(PIN_PATH, last_channels)
            attr_name = channel_name_to_attr_name(channel_name)
            commit_message = f'{attr_name}: {version_old} -> {version_new}'
            if channel_name == 'stable':
@@ -238,7 +243,5 @@ if len(sys.argv) == 2 and sys.argv[1] == '--commit':
            subprocess.run(['git', 'add', JSON_PATH], check=True)
            subprocess.run(['git', 'commit', '--file=-'], input=commit_message.encode(), check=True)
 else:
-    with open(JSON_PATH, 'w') as out:
-        json.dump(sorted_channels, out, indent=2)
-        out.write('\n')
+    save_dict_as_nix(PIN_PATH, sorted_channels)
    print_updates(last_channels, sorted_channels)
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@@ -1,64 +0,0 @@
-{
-  "stable": {
-    "version": "115.0.5790.110",
-    "sha256": "0wgp44qnvmdqf2kk870ndm51rcvar36li2qq632ay4n8gfpbrm79",
-    "sha256bin64": "1w2jl92x78s4vxv4p1imkz7qaq51yvs0wiz2bclbjz0hjlw9akr3",
-    "deps": {
-      "gn": {
-        "version": "2023-05-19",
-        "url": "https://gn.googlesource.com/gn",
-        "rev": "e9e83d9095d3234adf68f3e2866f25daf766d5c7",
-        "sha256": "0y07c18xskq4mclqiz3a63fz8jicz2kqridnvdhqdf75lhp61f8a"
-      }
-    },
-    "chromedriver": {
-      "version": "115.0.5790.98",
-      "sha256_linux": "1797qmb213anvp9lmrkj6wmfdwkdfswmshmk1816zankw5dl883j",
-      "sha256_darwin": "1c41cb7zh13ny4xvpwy7703cnjrkmqxd3n8zpja7n6a38mi8mgsk",
-      "sha256_darwin_aarch64": "1kliszw10jnnlhzi8jrdzjq0r7vfn6ksk1spsh2rfn2hmghccv2d"
-    }
-  },
-  "beta": {
-    "version": "115.0.5790.98",
-    "sha256": "1wbasmwdqkg5jcmzpidvzjsq2n2dr73bxz85pr8a5j4grw767gpz",
-    "sha256bin64": "0xbizb3d539h1cw1kj9ahd8azmkcdfjdmqb5bpp8cr21bh2qbqp5",
-    "deps": {
-      "gn": {
-        "version": "2023-05-19",
-        "url": "https://gn.googlesource.com/gn",
-        "rev": "e9e83d9095d3234adf68f3e2866f25daf766d5c7",
-        "sha256": "0y07c18xskq4mclqiz3a63fz8jicz2kqridnvdhqdf75lhp61f8a"
-      }
-    }
-  },
-  "dev": {
-    "version": "116.0.5845.42",
-    "sha256": "1fvhh8fvm0rkb41mhsh4p3bahf4fk3gixan2x1bappm3hdcixffb",
-    "sha256bin64": "1zq4vyvm0vij03rc0zwzknm17108ka8bl1lsayp1133y2fgbl9f8",
-    "deps": {
-      "gn": {
-        "version": "2023-06-09",
-        "url": "https://gn.googlesource.com/gn",
-        "rev": "4bd1a77e67958fb7f6739bd4542641646f264e5d",
-        "sha256": "14h9jqspb86sl5lhh6q0kk2rwa9zcak63f8drp7kb3r4dx08vzsw"
-      }
-    }
-  },
-  "ungoogled-chromium": {
-    "version": "115.0.5790.110",
-    "sha256": "0wgp44qnvmdqf2kk870ndm51rcvar36li2qq632ay4n8gfpbrm79",
-    "sha256bin64": "1w2jl92x78s4vxv4p1imkz7qaq51yvs0wiz2bclbjz0hjlw9akr3",
-    "deps": {
-      "gn": {
-        "version": "2023-05-19",
-        "url": "https://gn.googlesource.com/gn",
-        "rev": "e9e83d9095d3234adf68f3e2866f25daf766d5c7",
-        "sha256": "0y07c18xskq4mclqiz3a63fz8jicz2kqridnvdhqdf75lhp61f8a"
-      },
-      "ungoogled-patches": {
-        "rev": "115.0.5790.110-1",
-        "sha256": "1jahy4jl5bnnzl6433hln0dj3b39v5zqd90n8zf7ss45wqrff91b"
-      }
-    }
-  }
-}
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.nix
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.nix
@@ -0,0 +1,65 @@
+{
+  beta = {
+    deps = {
+      gn = {
+        rev = "e9e83d9095d3234adf68f3e2866f25daf766d5c7";
+        sha256 = "0y07c18xskq4mclqiz3a63fz8jicz2kqridnvdhqdf75lhp61f8a";
+        url = "https://gn.googlesource.com/gn";
+        version = "2023-05-19";
+      };
+    };
+    sha256 = "1wbasmwdqkg5jcmzpidvzjsq2n2dr73bxz85pr8a5j4grw767gpz";
+    sha256bin64 = "0xbizb3d539h1cw1kj9ahd8azmkcdfjdmqb5bpp8cr21bh2qbqp5";
+    version = "115.0.5790.98";
+  };
+  dev = {
+    deps = {
+      gn = {
+        rev = "4bd1a77e67958fb7f6739bd4542641646f264e5d";
+        sha256 = "14h9jqspb86sl5lhh6q0kk2rwa9zcak63f8drp7kb3r4dx08vzsw";
+        url = "https://gn.googlesource.com/gn";
+        version = "2023-06-09";
+      };
+    };
+    sha256 = "1fvhh8fvm0rkb41mhsh4p3bahf4fk3gixan2x1bappm3hdcixffb";
+    sha256bin64 = "1zq4vyvm0vij03rc0zwzknm17108ka8bl1lsayp1133y2fgbl9f8";
+    version = "116.0.5845.42";
+  };
+  stable = {
+    chromedriver = {
+      sha256_darwin = "1c41cb7zh13ny4xvpwy7703cnjrkmqxd3n8zpja7n6a38mi8mgsk";
+      sha256_darwin_aarch64 =
+        "1kliszw10jnnlhzi8jrdzjq0r7vfn6ksk1spsh2rfn2hmghccv2d";
+      sha256_linux = "1797qmb213anvp9lmrkj6wmfdwkdfswmshmk1816zankw5dl883j";
+      version = "115.0.5790.98";
+    };
+    deps = {
+      gn = {
+        rev = "e9e83d9095d3234adf68f3e2866f25daf766d5c7";
+        sha256 = "0y07c18xskq4mclqiz3a63fz8jicz2kqridnvdhqdf75lhp61f8a";
+        url = "https://gn.googlesource.com/gn";
+        version = "2023-05-19";
+      };
+    };
+    sha256 = "0wgp44qnvmdqf2kk870ndm51rcvar36li2qq632ay4n8gfpbrm79";
+    sha256bin64 = "1w2jl92x78s4vxv4p1imkz7qaq51yvs0wiz2bclbjz0hjlw9akr3";
+    version = "115.0.5790.110";
+  };
+  ungoogled-chromium = {
+    deps = {
+      gn = {
+        rev = "e9e83d9095d3234adf68f3e2866f25daf766d5c7";
+        sha256 = "0y07c18xskq4mclqiz3a63fz8jicz2kqridnvdhqdf75lhp61f8a";
+        url = "https://gn.googlesource.com/gn";
+        version = "2023-05-19";
+      };
+      ungoogled-patches = {
+        rev = "115.0.5790.110-1";
+        sha256 = "1jahy4jl5bnnzl6433hln0dj3b39v5zqd90n8zf7ss45wqrff91b";
+      };
+    };
+    sha256 = "0wgp44qnvmdqf2kk870ndm51rcvar36li2qq632ay4n8gfpbrm79";
+    sha256bin64 = "1w2jl92x78s4vxv4p1imkz7qaq51yvs0wiz2bclbjz0hjlw9akr3";
+    version = "115.0.5790.110";
+  };
+}
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "16.1.2",
-  "repo_hash": "sha256-A9JkBwGym+CPpb5B7+Kwt8Ej4PGSHc3ZOgUA28hdyN8=",
-  "yarn_hash": "1cqyf06810ls94nkys0l4p86ni902q32aqjp66m7j1x6ldh248al",
+  "version": "16.1.3",
+  "repo_hash": "sha256-PI0nmwfk8uu74NJkavbbJR9/jDN9SS0Z9Axe4UmT2kk=",
+  "yarn_hash": "0wykn0vq16n8mz4jfh7dfyp9javzhqlfwmc5i1zm07gld91nirlm",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v16.1.2-ee",
+  "rev": "v16.1.3-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "16.1.2",
-    "GITLAB_PAGES_VERSION": "16.1.2",
+    "GITALY_SERVER_VERSION": "16.1.3",
+    "GITLAB_PAGES_VERSION": "16.1.3",
    "GITLAB_SHELL_VERSION": "14.23.0",
    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "4.3.5",
-    "GITLAB_WORKHORSE_VERSION": "16.1.2"
+    "GITLAB_WORKHORSE_VERSION": "16.1.3"
  }
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@@ -13,7 +13,7 @@
 }:

 let
-  version = "16.1.2";
+  version = "16.1.3";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@@ -24,7 +24,7 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      sha256 = "sha256-/yCmFbmKTp8V8CjdhoAPpAdwNEcaP/wB0oAeTLdMESo=";
+      sha256 = "sha256-g9K1dFcrUkWJInPrwg9fz/TEK35GrjqFpUS2bnemwLQ=";
    };

    vendorSha256 = "sha256-6oOFQGPwiMRQrESXsQsGzvWz9bCb0VTYIyyG/C2b3nA=";
--- a/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-pages/default.nix
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gitlab-pages";
-  version = "16.1.2";
+  version = "16.1.3";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${version}";
-    sha256 = "sha256-T33/SnV+aWUjfRKxVOQNWaPtFnounMkCXAeQCQ9w5RY=";
+    sha256 = "sha256-FSdew0HMbgEAzVoDhINDIQQs8Q63AHu8mu/dKo+wP9k=";
  };

  vendorHash = "sha256-SN4r9hcTTQUr3miv2Cm7iBryyh7yG1xx9lCvq3vQwc0=";
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "16.1.2";
+  version = "16.1.3";

  src = fetchFromGitLab {
    owner = data.owner;
--- a/pkgs/build-support/dart/build-dart-application/default.nix
+++ b/pkgs/build-support/dart/build-dart-application/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchDartDeps, writeText, dartHooks, makeWrapper, dart, nodejs }:
+{ lib, stdenv, fetchDartDeps, writeText, dartHooks, makeWrapper, dart, nodejs, darwin }:

 { pubGetScript ? "dart pub get"

@@ -54,6 +54,8 @@ stdenv.mkDerivation (args // {
    dartBuildHook
    dartInstallHook
    makeWrapper
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.sigtool
  ];

  # When stripping, it seems some ELF information is lost and the dart VM cli
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@@ -71,7 +71,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "webkitgtk";
-  version = "2.40.4";
+  version = "2.40.5";
  name = "${finalAttrs.pname}-${finalAttrs.version}+abi=${if lib.versionAtLeast gtk3.version "4.0" then "6.0" else "4.${if lib.versions.major libsoup.version == "2" then "0" else "1"}"}";

  outputs = [ "out" "dev" "devdoc" ];
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-jRYzeSl6L39RtFUSf5mDbZ/hVyKJ93tjD/PWOiywbaw=";
+    hash = "sha256-feBRomNmhiHZGmGl6xw3cdGnzskABD1K/vBsMmwWA38=";
  };

  patches = lib.optionals stdenv.isLinux [
--- a/pkgs/development/libraries/wlroots/protocols.nix
+++ b/pkgs/development/libraries/wlroots/protocols.nix
@@ -2,14 +2,14 @@

 stdenv.mkDerivation rec {
  pname = "wlr-protocols";
-  version = "unstable-2021-11-01";
+  version = "unstable-2022-09-05";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "wlroots";
    repo = "wlr-protocols";
-    rev = "d998ee6fc64ea7e066014023653d1271b7702c09";
-    sha256 = "1vw8b10d1pwsj6f4sr3imvwsy55d3435sp068sj4hdszkxc6axsr";
+    rev = "4264185db3b7e961e7f157e1cc4fd0ab75137568";
+    sha256 = "Ztc07RLg+BZPondP/r6Jo3Fw1QY/z1QsFvdEuOqQshA=";
  };

  strictDeps = true;
--- a/pkgs/development/tools/parsing/byacc/default.nix
+++ b/pkgs/development/tools/parsing/byacc/default.nix
@@ -5,14 +5,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "byacc";
-  version = "20230219";
+  version = "20230521";

  src = fetchurl {
    urls = [
      "https://invisible-mirror.net/archives/byacc/byacc-${finalAttrs.version}.tgz"
      "ftp://ftp.invisible-island.net/byacc/byacc-${finalAttrs.version}.tgz"
    ];
-    hash = "sha256-NrlyptSul1hN0YaSX7vDl9JssgYyp2wvUqx2U80IG1g=";
+    hash = "sha256-WtkVp9WDOqOKXjG9B3UFZmApw142Xf+Faf5FmOqp/vI=";
  };

  configureFlags = [
--- a/pkgs/development/tools/selenium/chromedriver/default.nix
+++ b/pkgs/development/tools/selenium/chromedriver/default.nix
@@ -6,7 +6,7 @@
 }:

 let
-  upstream-info = (lib.importJSON ../../../../applications/networking/browsers/chromium/upstream-info.json).stable.chromedriver;
+  upstream-info = (import ../../../../applications/networking/browsers/chromium/upstream-info.nix).stable.chromedriver;
  allSpecs = {
    x86_64-linux = {
      system = "linux64";
--- a/pkgs/servers/owncast/default.nix
+++ b/pkgs/servers/owncast/default.nix
@@ -2,6 +2,8 @@
 , buildGoModule
 , fetchFromGitHub
 , nixosTests
+, bash
+, which
 , ffmpeg
 , makeBinaryWrapper
 }:
@@ -25,7 +27,7 @@ in buildGoModule {

  postInstall = ''
    wrapProgram $out/bin/owncast \
-      --prefix PATH : ${lib.makeBinPath [ ffmpeg ]}
+      --prefix PATH : ${lib.makeBinPath [ bash which ffmpeg ]}
  '';

  installCheckPhase = ''
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -51,11 +51,11 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "samba";
-  version = "4.17.7";
+  version = "4.17.10";

  src = fetchurl {
    url = "mirror://samba/pub/samba/stable/${pname}-${version}.tar.gz";
-    hash = "sha256-lcnBa2VKiM+u/ZWAUt1XPi+F7N8RTk7Owxh1N6CU2Rk=";
+    hash = "sha256-ANuwqsn0z+6AD3CPTpCYlkpDp2RuYYIwcG1TLJu2w1A=";
  };

  outputs = [ "out" "dev" "man" ];