Merge staging-next-23.05 into staging-23.05

pkgs/applications/editors/pulsar/001-patch-wrapper.patch

@@ -1,27 +1,11 @@
 --- a/resources/pulsar.sh	2023-03-16 04:11:14.000000000 +0100
 +++ b/resources/pulsar.sh	2023-03-24 14:37:13.468813964 +0100
-@@ -123,22 +123,9 @@
+@@ -123,7 +123,7 @@
  elif [ $OS == 'Linux' ]; then
    SCRIPT=$(readlink -f "$0")
  
 -  PULSAR_PATH="/opt/Pulsar/pulsar"
 +  # PULSAR_PATH is set-up via `wrapProgram` in the postFixup phase
-
--  #Will allow user to get context menu on cinnamon desktop enviroment
--  #Add a check to make sure that DESKTOP_SESSION is set before attempting to grep it
--  #expr substr is expecting 3 arguments string, index, length
--  #If grep doesnt find anything is provides an empty string which causes the expr: syntax error: missing argument after '8' error - see pulsar-edit/pulsar#174
--  #Im also not quite sure why they used grep instead of simply [ "${DESKTOP_SESSION}" == "cinnamon" ]
--  if [ -n "${DESKTOP_SESSION}" ] && [ "$(expr substr $(printenv | grep 'DESKTOP_SESSION=') 17 8)" == "cinnamon" ]; then
--    #This local path is almost assuredly wrong as it shouldnt exist in a standard install
--    ACTION_PATH="resources/linux/desktopenviroment/cinnamon/pulsar.nemo_action"
--
--    #Validate the file exists before attempting to copy it
--    if [ -f "${ACTION_PATH}" ]; then
--        cp "${$ACTION_PATH}" "/usr/share/nemo/actions/pulsar.nemo_action"
--    fi
--  fi
-+  # We remove the nemo integration. It is handled by the postFixup phase
  
    #Set tmpdir only if tmpdir is unset
    : ${TMPDIR:=/tmp}

pkgs/applications/editors/pulsar/default.nix

@@ -23,13 +23,13 @@
 
 let
   pname = "pulsar";
-  version = "1.104.0";
+  version = "1.106.0";
 
   sourcesPath = {
     x86_64-linux.tarname = "Linux.${pname}-${version}.tar.gz";
-    x86_64-linux.hash = "sha256-HEMUQVNPb6qWIXX25N79HwHo7j11MyFiBRsq9otdAL8=";
+    x86_64-linux.hash = "sha256-Wd0z6kHd6qZgrgZBxZQjwVC1dDqYtJ94L7aAnbuJoO8=";
     aarch64-linux.tarname = "ARM.Linux.${pname}-${version}-arm64.tar.gz";
-    aarch64-linux.hash = "sha256-f+s54XtLLdhTFY9caKTKngJF6zLai0F7ur9v37bwuNE=";
+    aarch64-linux.hash = "sha256-Xadjqw8PRrq0ksif6te0gxn8xeYTCYnJcsrezfl2SYs=";
   }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   additionalLibs = lib.makeLibraryPath [
@@ -119,7 +119,7 @@ stdenv.mkDerivation rec {
     # But asar complains because the node_gyp unpacked dependency uses a prebuilt Python3 itself
 
     rm $opt/resources/app.asar.unpacked/node_modules/tree-sitter-bash/build/node_gyp_bins/python3
-    ln -s ${python3}/bin/python3 $opt/resources/app.asar.unpacked/node_modules/tree-sitter-bash/build/node_gyp_bins/python3
+    ln -s ${python3.interpreter} $opt/resources/app.asar.unpacked/node_modules/tree-sitter-bash/build/node_gyp_bins/python3
   '' + ''
     # Patch the bundled node executables
     find $opt -name "*.node" -exec patchelf --set-rpath "${newLibpath}:$opt" {} \;

pkgs/applications/editors/pulsar/update.mjs

@@ -13,6 +13,17 @@ const constants = {
     targetFile: new URL("default.nix", import.meta.url).pathname,
 };
 
+async function utf16ToUtf8(blob) {
+    // Sometime, upstream saves the SHA256SUMS.txt file in UTF-16, which absolutely breaks node's string handling
+    // So we need to convert this blob to UTF-8
+
+    // We need to skip the first 2 bytes, which are the BOM
+    const arrayBuffer = await blob.slice(2).arrayBuffer();
+    const buffer = Buffer.from(arrayBuffer);
+    const utf8String = buffer.toString('utf16le');
+    return utf8String;
+}
+
 async function getLatestVersion() {
     const requestResult = await fetch(constants.githubUrl);
     if (!requestResult.ok) {
@@ -37,6 +48,7 @@ async function getSha256Sum(hashFileContent, targetFile) {
 
     let sha256 = hashFileContent.
         split('\n').
+        map(line => line.replace("\r", "")). // Side-effect of the UTF-16 conversion, if the file was created from Windows
         filter((line) => line.endsWith(targetFile))[0].
         split(' ')[0];
 
@@ -47,14 +59,21 @@ async function getSha256Sums(newVersion) {
     // Upstream provides a file with the hashes of the files, but it's not in the SRI format, and it refers to the compressed tarball
     // So let's just use nix-prefetch-url to get the hashes of the decompressed tarball, and `nix hash to-sri` to convert them to SRI format
     const hashFileUrl = constants.sha256FileURL(newVersion);
-    const hashFileContent = await fetch(hashFileUrl).then((response) => response.text());
+    const hashFileContent = await fetch(hashFileUrl).then((response) => response.blob());
+    const headerbuffer = await hashFileContent.slice(0, 2).arrayBuffer()
+    const header = Buffer.from(headerbuffer).toString('hex');
+
+    // We must detect if it's UTF-16 or UTF-8. If it's UTF-16, we must convert it to UTF-8, otherwise just use it as-is
+    const hashFileContentString = header == 'fffe' ?
+        await utf16ToUtf8(hashFileContent) :
+        await hashFileContent.text();
 
     let x86_64;
     let aarch64;
     console.log("Getting new hashes");
     let promises = [
-        getSha256Sum(hashFileContent, constants.x86_64FileName(newVersion)).then((hash) => { x86_64 = hash; }),
-        getSha256Sum(hashFileContent, constants.aarch64FileName(newVersion)).then((hash) => { aarch64 = hash; }),
+        getSha256Sum(hashFileContentString, constants.x86_64FileName(newVersion)).then((hash) => { x86_64 = hash; }),
+        getSha256Sum(hashFileContentString, constants.aarch64FileName(newVersion)).then((hash) => { aarch64 = hash; }),
     ];
     await Promise.all(promises);
     return { x86_64, aarch64 };

pkgs/applications/emulators/retroarch/retroarch-joypad-autoconfig.nix

@@ -0,0 +1,28 @@
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "retroarch-joypad-autoconfig";
+  version = "1.15.0";
+
+  src = fetchFromGitHub {
+    owner = "libretro";
+    repo = "retroarch-joypad-autoconfig";
+    rev = "v${version}";
+    hash = "sha256-/F2Y08uDA/pIIeLiLfOQfGVjX2pkuOqPourlx2RbZ28=";
+  };
+
+  makeFlags = [
+    "PREFIX=$(out)"
+  ];
+
+  meta = with lib; {
+    description = "Joypad autoconfig files";
+    homepage = "https://www.libretro.com/";
+    license = licenses.mit;
+    maintainers = with maintainers; teams.libretro.members ++ [ ];
+    platforms = platforms.all;
+  };
+}

pkgs/applications/emulators/retroarch/wrapper.nix

@@ -3,16 +3,28 @@
 , makeWrapper
 , retroarch
 , symlinkJoin
+, runCommand
 , cores ? [ ]
+, settings ? { }
 }:
 
 let
+  settingsPath = runCommand "declarative-retroarch.cfg"
+    {
+      value = lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "${n} = \"${v}\"") settings);
+      passAsFile = [ "value" ];
+    }
+    ''
+      cp "$valuePath" "$out"
+    '';
+
   # All cores should be located in the same path after symlinkJoin,
   # but let's be safe here
   coresPath = lib.lists.unique (map (c: c.libretroCore) cores);
-  wrapperArgs = lib.strings.escapeShellArgs
-    (lib.lists.flatten
-      (map (p: [ "--add-flags" "-L ${placeholder "out" + p}" ]) coresPath));
+  wrapperArgs = lib.strings.escapeShellArgs (
+    (lib.lists.flatten (map (p: [ "--add-flags" "-L ${placeholder "out" + p}" ]) coresPath))
+    ++ [ "--add-flags" "--appendconfig=${settingsPath}" ]
+  );
 in
 symlinkJoin {
   name = "retroarch-with-cores-${lib.getVersion retroarch}";

pkgs/applications/networking/browsers/palemoon/bin.nix

@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation rec {
   pname = "palemoon-bin";
-  version = "32.2.1";
+  version = "32.3.1";
 
   src = fetchzip {
     urls = [
@@ -27,9 +27,9 @@ stdenv.mkDerivation rec {
       "https://rm-us.palemoon.org/release/palemoon-${version}.linux-x86_64-gtk${if withGTK3 then "3" else "2"}.tar.xz"
     ];
     hash = if withGTK3 then
-      "sha256-brF9ACAG+JM7bk/JarB208f8ihI/1d90l+6e1pHmC20="
+      "sha256-1JYaxxkqgg/gLdZ+uGDB5BI0NKjHO4huk0b/M9QFuII="
     else
-      "sha256-205rhW89Jlk4ICraqndTbJ6/88+ZqhtDOIvhFTiEUz0=";
+      "sha256-p/Lid6Uv3XTEg+43Gke5VLILhzENHoBP6XjGVHy7wCY=";
   };
 
   preferLocalBuild = true;

pkgs/development/interpreters/elixir/1.15.nix

@@ -1,7 +1,7 @@
 { mkDerivation }:
 mkDerivation {
-  version = "1.15.0";
-  sha256 = "sha256-o5MfA0UG8vpnPCH1EYspzcN62yKZQcz5uVUY47hOL9w=";
+  version = "1.15.4";
+  sha256 = "sha256-0DrfKQPyFX+zurCIZ6RVj9vm1lHSkJSfhiUaRpa3FFo=";
   # https://hexdocs.pm/elixir/1.15.0/compatibility-and-deprecations.html#compatibility-between-elixir-and-erlang-otp
   minimumOTPVersion = "24";
   escriptPath = "lib/elixir/scripts/generate_app.escript";

pkgs/os-specific/linux/kernel/hardened/patches.json

@@ -52,31 +52,31 @@
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.1.38-hardened1.patch",
-            "sha256": "0sv8i26xwgw3a36yga79n36a5xbrs3ajn8wdkqn40ydbzp24i0qc",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.38-hardened1/linux-hardened-6.1.38-hardened1.patch"
+            "name": "linux-hardened-6.1.39-hardened1.patch",
+            "sha256": "0j4sgcs6m2mq9dn1v525bymhdhha3x8ivrpfrhqm553q4vdnmbg7",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.1.39-hardened1/linux-hardened-6.1.39-hardened1.patch"
         },
-        "sha256": "0hrdh1w9z8bgy4cxqsxfkwa01yincfw1mq1bbwm36zczc0dzk97r",
-        "version": "6.1.38"
+        "sha256": "1f45j3ch1ljbacjlg8q45iva9lvwys938rdg0s516mznzlifxpac",
+        "version": "6.1.39"
     },
     "6.3": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.3.12-hardened1.patch",
-            "sha256": "12dqdn2prr0mczwcy48907wpp235n87pl22gwyfilsxcj94x2wrx",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.3.12-hardened1/linux-hardened-6.3.12-hardened1.patch"
+            "name": "linux-hardened-6.3.13-hardened1.patch",
+            "sha256": "1iy95awbkrdk5529w9s07axb21l2snab4kifbzjghhz9vwzx22rp",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.3.13-hardened1/linux-hardened-6.3.13-hardened1.patch"
         },
-        "sha256": "1mvcirkhqnf03cci3jiq077fs9b42a3xdk3zjkpyim3x43ydwzyb",
-        "version": "6.3.12"
+        "sha256": "1ywijjhf19bciip75ppzjjh7bkadd449jr64yg2j5049w9h0aipa",
+        "version": "6.3.13"
     },
     "6.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-6.4.3-hardened1.patch",
-            "sha256": "1xwy9088f8qy7algv1gad90gd6sv03diz16jvfnk2yb01k4f87wv",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.3-hardened1/linux-hardened-6.4.3-hardened1.patch"
+            "name": "linux-hardened-6.4.4-hardened1.patch",
+            "sha256": "0yy02hn190wvl24z1j9kjmnyxrlp6s9fhkyvqgcm8i56d7d69zhb",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/6.4.4-hardened1/linux-hardened-6.4.4-hardened1.patch"
         },
-        "sha256": "18c8ikghvlr6h9jajy11dldck4h57wl301j14rxg7xhd6qlysd3i",
-        "version": "6.4.3"
+        "sha256": "0apzfnn04w6jda9yw5cbgj8784frvqrryb1iw5ad390lwwmlmg4w",
+        "version": "6.4.4"
     }
 }

pkgs/os-specific/linux/kernel/linux-6.1.nix

@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.1.38";
+  version = "6.1.39";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "0hrdh1w9z8bgy4cxqsxfkwa01yincfw1mq1bbwm36zczc0dzk97r";
+    sha256 = "1f45j3ch1ljbacjlg8q45iva9lvwys938rdg0s516mznzlifxpac";
   };
 } // (args.argsOverride or { }))

pkgs/os-specific/linux/kernel/linux-6.3.nix

@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.3.12";
+  version = "6.3.13";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "1mvcirkhqnf03cci3jiq077fs9b42a3xdk3zjkpyim3x43ydwzyb";
+    sha256 = "1ywijjhf19bciip75ppzjjh7bkadd449jr64yg2j5049w9h0aipa";
   };
 } // (args.argsOverride or { }))

pkgs/os-specific/linux/kernel/linux-6.4.nix

@@ -3,7 +3,7 @@
 with lib;
 
 buildLinux (args // rec {
-  version = "6.4.3";
+  version = "6.4.4";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = versions.pad 3 version;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${version}.tar.xz";
-    sha256 = "18c8ikghvlr6h9jajy11dldck4h57wl301j14rxg7xhd6qlysd3i";
+    sha256 = "0apzfnn04w6jda9yw5cbgj8784frvqrryb1iw5ad390lwwmlmg4w";
   };
 } // (args.argsOverride or { }))

pkgs/tools/security/age-plugin-tpm/default.nix

@@ -0,0 +1,41 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, swtpm
+}:
+
+buildGoModule rec {
+  pname = "age-plugin-tpm";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Foxboron";
+    repo = "age-plugin-tpm";
+    rev = "v${version}";
+    hash = "sha256-Gp7n2/+vgQbsm/En6PQ1to/W6lvFam4Wh3LHdCZnafc=";
+  };
+
+  vendorHash = "sha256-oZni/n2J0N3ZxNhf+RlUWyWeOFwL4+6KUIk6DQF8YpA=";
+
+  postConfigure = ''
+    substituteInPlace vendor/github.com/foxboron/swtpm_test/swtpm.go \
+      --replace "/usr/share/swtpm/swtpm-create-user-config-files" "${swtpm}/share/swtpm/swtpm-create-user-config-files"
+  '';
+
+  nativeCheckInputs = [
+    swtpm
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = with lib; {
+    description = "TPM 2.0 plugin for age (This software is experimental, use it at your own risk)";
+    homepage = "https://github.com/Foxboron/age-plugin-tpm";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ kranzes ];
+  };
+}

pkgs/top-level/all-packages.nix

@@ -2491,19 +2491,24 @@ with pkgs;
       (builtins.attrValues libretro);
   };
 
-  wrapRetroArch = { retroarch }:
+  wrapRetroArch = { retroarch, settings ? {} }:
     callPackage ../applications/emulators/retroarch/wrapper.nix
-      { inherit retroarch; };
+      { inherit retroarch settings; };
 
   retroarch = wrapRetroArch {
     retroarch = retroarchBare.override {
       withAssets = true;
       withCoreInfo = true;
     };
+    settings = {
+      joypad_autoconfig_dir = "${retroarch-joypad-autoconfig}/share/libretro/autoconfig";
+    };
   };
 
   retroarch-assets = callPackage ../applications/emulators/retroarch/retroarch-assets.nix { };
 
+  retroarch-joypad-autoconfig = callPackage ../applications/emulators/retroarch/retroarch-joypad-autoconfig.nix { };
+
   libretro = recurseIntoAttrs
     (callPackage ../applications/emulators/retroarch/cores.nix {
       retroarch = retroarchBare;
@@ -6477,6 +6482,8 @@ with pkgs;
 
   agebox = callPackage ../tools/security/agebox { };
 
+  age-plugin-tpm = callPackage ../tools/security/age-plugin-tpm { };
+
   age-plugin-yubikey = darwin.apple_sdk_11_0.callPackage ../tools/security/age-plugin-yubikey {
     inherit (darwin.apple_sdk_11_0.frameworks) Foundation PCSC IOKit;
   };