nixos/release-notes: move non-highlights to other mentions

(cherry picked from commit 9a3e869997)

doc/contributing/coding-conventions.chapter.md

@@ -526,6 +526,16 @@ If you do need to do create this sort of patch file, one way to do so is with gi
     $ git diff > nixpkgs/pkgs/the/package/0001-changes.patch
     ```
 
+If a patch is available online but does not cleanly apply, it can be modified in some fixed ways by using additional optional arguments for `fetchpatch`:
+
+- `stripLen`: Remove the first `stripLen` components of pathnames in the patch.
+- `extraPrefix`: Prefix pathnames by this string.
+- `excludes`: Exclude files matching this pattern.
+- `includes`: Include only files matching this pattern.
+- `revert`: Revert the patch.
+
+Note that because the checksum is computed after applying these effects, using or modifying these arguments will have no effect unless the `sha256` argument is changed as well.
+
 ## Package tests {#sec-package-tests}
 
 Tests are important to ensure quality and make reviews and automatic updates easy.

flake.nix

@@ -18,6 +18,7 @@
         "aarch64-linux"
         "armv6l-linux"
         "armv7l-linux"
+        "aarch64-darwin"
       ];
 
       forAllSystems = f: lib.genAttrs systems (system: f system);

lib/systems/default.nix

@@ -41,6 +41,19 @@ rec {
         else if final.isNetBSD              then "nblibc"
         # TODO(@Ericson2314) think more about other operating systems
         else                                     "native/impure";
+      # Choose what linker we wish to use by default. Someday we might also
+      # choose the C compiler, runtime library, C++ standard library, etc. in
+      # this way, nice and orthogonally, and deprecate `useLLVM`. But due to
+      # the monolithic GCC build we cannot actually make those choices
+      # independently, so we are just doing `linker` and keeping `useLLVM` for
+      # now.
+      linker =
+        /**/ if final.useLLVM or false      then "lld"
+        else if final.isDarwin              then "cctools"
+        # "bfd" and "gold" both come from GNU binutils. The existance of Gold
+        # is why we use the more obscure "bfd" and not "binutils" for this
+        # choice.
+        else                                     "bfd";
       extensions = {
         sharedLibrary =
           /**/ if final.isDarwin  then ".dylib"
@@ -118,7 +131,7 @@ rec {
         else null;
       # The canonical name for this attribute is darwinSdkVersion, but some
       # platforms define the old name "sdkVer".
-      darwinSdkVersion = final.sdkVer or "10.12";
+      darwinSdkVersion = final.sdkVer or (if final.isAarch64 then "11.0" else "10.12");
       darwinMinVersion = final.darwinSdkVersion;
       darwinMinVersionVariable =
         if final.isMacOS then "MACOSX_DEPLOYMENT_TARGET"

lib/systems/doubles.nix

@@ -96,5 +96,5 @@ in {
 
   embedded      = filterDoubles predicates.isNone;
 
-  mesaPlatforms = ["i686-linux" "x86_64-linux" "x86_64-darwin" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "armv7a-linux" "aarch64-linux" "powerpc64-linux" "powerpc64le-linux"];
+  mesaPlatforms = ["i686-linux" "x86_64-linux" "x86_64-darwin" "armv5tel-linux" "armv6l-linux" "armv7l-linux" "armv7a-linux" "aarch64-linux" "powerpc64-linux" "powerpc64le-linux" "aarch64-darwin"];
 }

lib/systems/examples.nix

@@ -70,6 +70,15 @@ rec {
     useAndroidPrebuilt = true;
   };
 
+  aarch64-android = {
+    config = "aarch64-unknown-linux-android";
+    sdkVer = "30";
+    ndkVer = "21";
+    libc = "bionic";
+    useAndroidPrebuilt = false;
+    useLLVM = true;
+  };
+
   scaleway-c1 = armv7l-hf-multiplatform // platforms.scaleway-c1;
 
   pogoplug4 = {
@@ -231,6 +240,12 @@ rec {
     useiOSPrebuilt = true;
   };
 
+  aarch64-darwin = {
+    config = "aarch64-apple-darwin";
+    xcodePlatform = "MacOSX";
+    platform = {};
+  };
+
   #
   # Windows
   #

lib/systems/platforms.nix

@@ -375,6 +375,13 @@ rec {
     };
   };
 
+  apple-m1 = {
+    gcc = {
+      arch = "armv8.3-a+crypto+sha2+aes+crc+fp16+lse+simd+ras+rdm+rcpc";
+      cpu = "apple-a13";
+    };
+  };
+
   ##
   ## MIPS
   ##
@@ -495,7 +502,10 @@ rec {
         else if lib.versionOlder version "6" then sheevaplug
         else if lib.versionOlder version "7" then raspberrypi
         else armv7l-hf-multiplatform
-    else if platform.isAarch64 then aarch64-multiplatform
+
+    else if platform.isAarch64 then
+      if platform.isDarwin then apple-m1
+      else aarch64-multiplatform
 
     else if platform.isRiscV then riscv-multiplatform
 

nixos/doc/manual/installation/installing.xml

@@ -46,6 +46,12 @@
    to increase the font size.
   </para>
 
+  <para>
+    To install over a serial port connect with <literal>115200n8</literal>
+    (e.g. <command>picocom -b 115200 /dev/ttyUSB0</command>). When the
+    bootloader lists boot entries, select the serial console boot entry.
+  </para>
+
   <section xml:id="sec-installation-booting-networking">
    <title>Networking in the installer</title>
 

nixos/doc/manual/installation/upgrading.xml

@@ -14,7 +14,7 @@
     <para>
      <emphasis>Stable channels</emphasis>, such as
      <literal
-    xlink:href="https://nixos.org/channels/nixos-20.09">nixos-20.09</literal>.
+    xlink:href="https://nixos.org/channels/nixos-21.05">nixos-21.05</literal>.
      These only get conservative bug fixes and package upgrades. For instance,
      a channel update may cause the Linux kernel on your system to be upgraded
      from 4.19.34 to 4.19.38 (a minor bug fix), but not from
@@ -38,7 +38,7 @@
     <para>
      <emphasis>Small channels</emphasis>, such as
      <literal
-    xlink:href="https://nixos.org/channels/nixos-20.09-small">nixos-20.09-small</literal>
+    xlink:href="https://nixos.org/channels/nixos-21.05-small">nixos-21.05-small</literal>
      or
      <literal
     xlink:href="https://nixos.org/channels/nixos-unstable-small">nixos-unstable-small</literal>.
@@ -63,8 +63,8 @@
  <para>
   When you first install NixOS, you’re automatically subscribed to the NixOS
   channel that corresponds to your installation source. For instance, if you
-  installed from a 20.09 ISO, you will be subscribed to the
-  <literal>nixos-20.09</literal> channel. To see which NixOS channel you’re
+  installed from a 21.05 ISO, you will be subscribed to the
+  <literal>nixos-21.05</literal> channel. To see which NixOS channel you’re
   subscribed to, run the following as root:
 <screen>
 <prompt># </prompt>nix-channel --list | grep nixos
@@ -75,13 +75,13 @@ nixos https://nixos.org/channels/nixos-unstable
 <prompt># </prompt>nix-channel --add https://nixos.org/channels/<replaceable>channel-name</replaceable> nixos
 </screen>
   (Be sure to include the <literal>nixos</literal> parameter at the end.) For
-  instance, to use the NixOS 20.09 stable channel:
+  instance, to use the NixOS 21.05 stable channel:
 <screen>
-<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-20.09 nixos
+<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-21.05 nixos
 </screen>
   If you have a server, you may want to use the “small” channel instead:
 <screen>
-<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-20.09-small nixos
+<prompt># </prompt>nix-channel --add https://nixos.org/channels/nixos-21.05-small nixos
 </screen>
   And if you want to live on the bleeding edge:
 <screen>
@@ -132,7 +132,7 @@ nixos https://nixos.org/channels/nixos-unstable
    kernel, initrd or kernel modules.
    You can also specify a channel explicitly, e.g.
 <programlisting>
-<xref linkend="opt-system.autoUpgrade.channel"/> = https://nixos.org/channels/nixos-20.09;
+<xref linkend="opt-system.autoUpgrade.channel"/> = https://nixos.org/channels/nixos-21.05;
 </programlisting>
   </para>
  </section>

nixos/doc/manual/release-notes/rl-2105.xml

@@ -3,8 +3,11 @@
          xmlns:xi="http://www.w3.org/2001/XInclude"
          version="5.0"
          xml:id="sec-release-21.05">
- <title>Release 21.05 (“Okapi”, 2021.05/??)</title>
+ <title>Release 21.05 (“Okapi”, 2021.05/31)</title>
 
+ <para>
+  Support is planned until the end of December 2021, handing over to 21.11.
+ </para>
  <section xmlns="http://docbook.org/ns/docbook"
          xmlns:xlink="http://www.w3.org/1999/xlink"
          xmlns:xi="http://www.w3.org/2001/XInclude"
@@ -18,101 +21,81 @@
   </para>
 
   <itemizedlist>
+
    <listitem>
     <para>
-     Support is planned until the end of December 2021, handing over to 21.11.
+     Core version changes:
     </para>
-   </listitem>
-   <listitem>
-    <para>The default Linux kernel was updated to the 5.10 LTS series, coming from the 5.4 LTS series.</para>
-   </listitem>
-   <listitem>
-    <para>GNOME desktop environment was upgraded to 40, see the release notes for <link xlink:href="https://help.gnome.org/misc/release-notes/40.0/">40.0</link> and <link xlink:href="https://help.gnome.org/misc/release-notes/3.38/">3.38</link>. The <code>gnome3</code> attribute set has been renamed to <code>gnome</code> and so have been the NixOS options.</para>
+    <itemizedlist>
+     <listitem>
+      <para>
+       gcc: 9.3.0 -> 10.3.0
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+       glibc: 2.30 -> 2.32
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+        default linux: 5.4 -> 5.10, all supported kernels available
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+        mesa: 20.1.7 -> 21.0.1
+      </para>
+     </listitem>
+    </itemizedlist>
    </listitem>
    <listitem>
     <para>
-     <link xlink:href="https://www.gnuradio.org/">GNURadio</link> 3.8 was
-     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/82263">finally</link>
-     packaged, along with a rewrite to the Nix expressions, allowing users to
-     override the features upstream supports selecting to compile or not to.
-     Additionally, the attribute <code>gnuradio</code> and <code>gnuradio3_7</code>
-     now point to an externally wrapped by default derivations, that allow you to
-     also add `extraPythonPackages` to the Python interpreter used by GNURadio.
-     Missing environmental variables needed for operational GUI were also added
-     (<link xlink:href="https://github.com/NixOS/nixpkgs/issues/75478">#75478</link>).
+     Desktop Environments:
     </para>
+    <itemizedlist>
+     <listitem>
+      <para>
+        Gnome: 3.36 -> 3.40, see its <link xlink:href="https://help.gnome.org/misc/release-notes/3.40/">release notes</link>
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+        Plasma5: 5.18.5 -> 5.21.3
+      </para>
+     </listitem>
+     <listitem>
+      <para>
+        kdeApplications: 20.08.1 -> 20.12.3
+      </para>
+     </listitem>
+      <listitem>
+       <para>
+         cinnamon: 4.6 -> 4.8.1
+      </para>
+     </listitem>
+    </itemizedlist>
    </listitem>
+
    <listitem>
     <para>
-     <link xlink:href="https://www.gnuradio.org/">GNURadio</link> has a
-     <code>pkgs</code> attribute set, and there's a <code>gnuradio.callPackage</code>
-     function that extends <code>pkgs</code> with a <code>mkDerivation</code>, and a
-     <code>mkDerivationWith</code>, like Qt5. Now all <code>gnuradio.pkgs</code> are
-     defined with <code>gnuradio.callPackage</code> and some packages that depend
-     on gnuradio are defined with this as well.
+     Programming Languages and Frameworks:
     </para>
+    <itemizedlist>
+
+     <listitem>
+      <para>
+       Python optimizations were disabled again. Builds with optimizations enabled
+       are not reproducible. Optimizations can now be enabled with an option.
+      </para>
+     </listitem>
+
+    </itemizedlist>
    </listitem>
    <listitem>
-    <para>
-     <link xlink:href="https://www.privoxy.org/">Privoxy</link> has been updated
-     to version 3.0.32 (See <link xlink:href="https://lists.privoxy.org/pipermail/privoxy-announce/2021-February/000007.html">announcement</link>).
-     Compared to the previous release, Privoxy has gained support for HTTPS
-     inspection (still experimental), Brotli decompression, several new filters
-     and lots of bug fixes, including security ones. In addition, the package
-     is now built with compression and external filters support, which were
-     previously disabled.
-    </para>
-    <para>
-     Regarding the NixOS module, new options for HTTPS inspection have been added
-     and <option>services.privoxy.extraConfig</option> has been replaced by the new
-     <xref linkend="opt-services.privoxy.settings"/>
-     (See <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">RFC 0042</link>
-     for the motivation).
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     Python optimizations were disabled again. Builds with optimizations enabled
-     are not reproducible. Optimizations can now be enabled with an option.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <link xlink:href="https://kodi.tv/">Kodi</link> has been updated to version 19.1 "Matrix". See
-     the <link xlink:href="https://kodi.tv/article/kodi-190-matrix-release">announcement</link> for
-     further details.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     The <option>services.packagekit.backend</option> option has been removed as
-     it only supported a single setting which would always be the default.
-     Instead new <link
-     xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">RFC
-     0042</link> compliant <xref linkend="opt-services.packagekit.settings"/>
-     and <xref linkend="opt-services.packagekit.vendorSettings"/> options have
-     been introduced.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-      <link xlink:href="https://nginx.org">Nginx</link> has been updated to stable version 1.20.0.
-      Now nginx uses the zlib-ng library by default.
-    </para>
-   </listitem>
-   <listitem>
-    <para>
-     <link xlink:href="https://libreswan.org/">Libreswan</link> has been updated
-     to version 4.4. The package now includes example configurations and manual
-     pages by default. The NixOS module has been changed to use the upstream
-     systemd units and write the configuration in the <literal>/etc/ipsec.d/
-     </literal> directory. In addition, two new options have been added to
-     specify connection policies
-     (<xref linkend="opt-services.libreswan.policies"/>)
-     and disable send/receive redirects
-     (<xref linkend="opt-services.libreswan.disableRedirects"/>).
-    </para>
+    <para>The <package>linux_latest</package> kernel was updated to the 5.12 series. It currently is not officially supported for use with the zfs filesystem. If you use zfs, you should use a different kernel version (either the LTS kernel, or track a specific one). </para>
    </listitem>
+
   </itemizedlist>
  </section>
 
@@ -128,6 +111,20 @@
   </para>
 
   <itemizedlist>
+   <listitem>
+    <para>
+     <link xlink:href="https://www.gnuradio.org/">GNURadio</link> 3.8 was
+     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/82263">finally</link>
+     packaged, along with a rewrite to the Nix expressions, allowing users to
+     override the features upstream supports selecting to compile or not to.
+     Additionally, the attribute <code>gnuradio</code> and <code>gnuradio3_7</code>
+     now point to an externally wrapped by default derivations, that allow you to
+     also add `extraPythonPackages` to the Python interpreter used by GNURadio.
+     Missing environmental variables needed for operational GUI were also added
+     (<link xlink:href="https://github.com/NixOS/nixpkgs/issues/75478">#75478</link>).
+    </para>
+   </listitem>
+
    <listitem>
      <para>
        <link xlink:href="https://www.keycloak.org/">Keycloak</link>,
@@ -180,6 +177,10 @@
   </para>
 
   <itemizedlist>
+   <listitem>
+    <para>GNOME desktop environment was upgraded to 40, see the release notes for <link xlink:href="https://help.gnome.org/misc/release-notes/40.0/">40.0</link> and <link xlink:href="https://help.gnome.org/misc/release-notes/3.38/">3.38</link>. The <code>gnome3</code> attribute set has been renamed to <code>gnome</code> and so have been the NixOS options.</para>
+   </listitem>
+
    <listitem>
     <para>
      If you are using <option>services.udev.extraRules</option> to assign
@@ -293,6 +294,24 @@
       <literal>/var/lib/powerdns</literal> to <literal>/run/pdns</literal>.
     </para>
    </listitem>
+   <listitem>
+     <para>
+       The <literal>mediatomb</literal> service is
+       now using by default the new and maintained fork
+       <literal>gerbera</literal> package instead of the unmaintained
+       <literal>mediatomb</literal> package. If you want to keep the old
+       behavior, you must declare it with:
+       <programlisting>
+       services.mediatomb.package = pkgs.mediatomb;
+       </programlisting>
+       One new option <literal>openFirewall</literal> has been introduced which
+       defaults to false. If you relied on the service declaration to add the
+       firewall rules itself before, you should now declare it with:
+       <programlisting>
+       services.mediatomb.openFirewall = true;
+       </programlisting>
+     </para>
+   </listitem>
    <listitem>
      <para>
        xfsprogs was update from 4.19 to 5.11. It now enables reflink support by default on filesystem creation.
@@ -415,7 +434,7 @@
     </para>
     <programlisting>
       TMPDIR=$(mktemp -d)
-      slaptest -f /path/to/slapd.conf $TMPDIR
+      slaptest -f /path/to/slapd.conf -F $TMPDIR
       slapcat -F $TMPDIR -n0 -H 'ldap:///???(!(objectClass=olcSchemaConfig))'
     </programlisting>
     <para>
@@ -560,7 +579,7 @@ http://some.json-exporter.host:7979/probe?target=https://example.com/some/json/e
        <programlisting>
 self: super:
 {
- mpi = super.mpich;
+  mpi = super.mpich;
 }
        </programlisting>
      </para>
@@ -764,6 +783,16 @@ environment.systemPackages = [
      the deprecated <option>services.radicale.config</option> is used.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     In the <option>security.acme</option> module, use of <literal>--reuse-key</literal>
+     parameter  for Lego has been removed. It was introduced for HKPK, but this security
+     feature is now deprecated. It is a better security practice to rotate key pairs
+     instead of always keeping the same. If you need to keep this parameter, you can add
+     it back using <literal>extraLegoRenewFlags</literal> as an option for the
+     appropriate certificate.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -783,6 +812,85 @@ environment.systemPackages = [
      for details.
     </para>
    </listitem>
+
+   <listitem>
+    <para>
+     <link xlink:href="https://www.gnuradio.org/">GNURadio</link> has a
+     <code>pkgs</code> attribute set, and there's a <code>gnuradio.callPackage</code>
+     function that extends <code>pkgs</code> with a <code>mkDerivation</code>, and a
+     <code>mkDerivationWith</code>, like Qt5. Now all <code>gnuradio.pkgs</code> are
+     defined with <code>gnuradio.callPackage</code> and some packages that depend
+     on gnuradio are defined with this as well.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <link xlink:href="https://www.privoxy.org/">Privoxy</link> has been updated
+     to version 3.0.32 (See <link xlink:href="https://lists.privoxy.org/pipermail/privoxy-announce/2021-February/000007.html">announcement</link>).
+     Compared to the previous release, Privoxy has gained support for HTTPS
+     inspection (still experimental), Brotli decompression, several new filters
+     and lots of bug fixes, including security ones. In addition, the package
+     is now built with compression and external filters support, which were
+     previously disabled.
+    </para>
+    <para>
+     Regarding the NixOS module, new options for HTTPS inspection have been added
+     and <option>services.privoxy.extraConfig</option> has been replaced by the new
+     <xref linkend="opt-services.privoxy.settings"/>
+     (See <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">RFC 0042</link>
+     for the motivation).
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <link xlink:href="https://kodi.tv/">Kodi</link> has been updated to version 19.1 "Matrix". See
+     the <link xlink:href="https://kodi.tv/article/kodi-190-matrix-release">announcement</link> for
+     further details.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <option>services.packagekit.backend</option> option has been removed as
+     it only supported a single setting which would always be the default.
+     Instead new <link
+     xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">RFC
+     0042</link> compliant <xref linkend="opt-services.packagekit.settings"/>
+     and <xref linkend="opt-services.packagekit.vendorSettings"/> options have
+     been introduced.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+      <link xlink:href="https://nginx.org">Nginx</link> has been updated to stable version 1.20.0.
+      Now nginx uses the zlib-ng library by default.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     KDE Gear (formerly KDE Applications) is upgraded to 21.04, see its
+     <link xlink:href="https://kde.org/announcements/gear/21.04/">release
+     notes</link> for details.
+    </para>
+    <para>
+     The <code>kdeApplications</code> package set is now <code>kdeGear</code>,
+     in keeping with the new name. The old name remains for compatibility, but
+     it is deprecated.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <link xlink:href="https://libreswan.org/">Libreswan</link> has been updated
+     to version 4.4. The package now includes example configurations and manual
+     pages by default. The NixOS module has been changed to use the upstream
+     systemd units and write the configuration in the <literal>/etc/ipsec.d/
+     </literal> directory. In addition, two new options have been added to
+     specify connection policies
+     (<xref linkend="opt-services.libreswan.policies"/>)
+     and disable send/receive redirects
+     (<xref linkend="opt-services.libreswan.disableRedirects"/>).
+    </para>
+   </listitem>
+
    <listitem>
     <para>
      The Mailman NixOS module (<literal>services.mailman</literal>) has a new
@@ -823,6 +931,29 @@ environment.systemPackages = [
      All services should use <xref linkend="opt-systemd.services._name_.startLimitIntervalSec" /> or <literal>StartLimitIntervalSec</literal> in <xref linkend="opt-systemd.services._name_.unitConfig" /> instead.
     </para>
    </listitem>
+   <listitem>
+     <para>
+       The <literal>mediatomb</literal> service
+       declares new options. It also adapts existing options so the
+       configuration generation is now lazy. The existing option
+       <literal>customCfg</literal> (defaults to false), when enabled, stops
+       the service configuration generation completely. It then expects the
+       users to provide their own correct configuration at the right location
+       (whereas the configuration was generated and not used at all before).
+       The new option <literal>transcodingOption</literal> (defaults to no)
+       allows a generated configuration. It makes the mediatomb service pulls
+       the necessary runtime dependencies in the nix store (whereas it was
+       generated with hardcoded values before). The new option
+       <literal>mediaDirectories</literal> allows the users to declare autoscan
+       media directories from their nixos configuration:
+       <programlisting>
+       services.mediatomb.mediaDirectories = [
+         { path = "/var/lib/mediatomb/pictures"; recursive = false; hidden-files = false; }
+         { path = "/var/lib/mediatomb/audio"; recursive = true; hidden-files = false; }
+       ];
+       </programlisting>
+     </para>
+   </listitem>
    <listitem>
     <para>
      The Unbound DNS resolver service (<literal>services.unbound</literal>) has been refactored to allow reloading, control sockets and to fix startup ordering issues.
@@ -921,7 +1052,8 @@ environment.systemPackages = [
      PulseAudio was upgraded to 14.0, with changes to the handling of default sinks.
      See its <link xlink:href="https://www.freedesktop.org/wiki/Software/PulseAudio/Notes/14.0/">release notes</link>.
     </para>
-
+   </listitem>
+   <listitem>
     <para>
      GNOME users may wish to delete their <literal>~/.config/pulse</literal> due to the changes to stream routing
      logic. See <link xlink:href="https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/issues/832">PulseAudio bug 832</link>

nixos/modules/module-list.nix

@@ -472,7 +472,6 @@
   ./services/misc/cgminer.nix
   ./services/misc/confd.nix
   ./services/misc/couchpotato.nix
-  ./services/misc/dendrite.nix
   ./services/misc/devmon.nix
   ./services/misc/dictd.nix
   ./services/misc/duckling.nix

nixos/modules/security/acme.nix

@@ -152,7 +152,7 @@ let
     );
     renewOpts = escapeShellArgs (
       commonOpts
-      ++ [ "renew" "--reuse-key" ]
+      ++ [ "renew" ]
       ++ optionals data.ocspMustStaple [ "--must-staple" ]
       ++ data.extraLegoRenewFlags
     );

nixos/modules/services/misc/dendrite.nix

@@ -1,181 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.dendrite;
-  settingsFormat = pkgs.formats.yaml { };
-  configurationYaml = settingsFormat.generate "dendrite.yaml" cfg.settings;
-  workingDir = "/var/lib/dendrite";
-in
-{
-  options.services.dendrite = {
-    enable = lib.mkEnableOption "matrix.org dendrite";
-    httpPort = lib.mkOption {
-      type = lib.types.nullOr lib.types.port;
-      default = 8008;
-      description = ''
-        The port to listen for HTTP requests on.
-      '';
-    };
-    httpsPort = lib.mkOption {
-      type = lib.types.nullOr lib.types.port;
-      default = null;
-      description = ''
-        The port to listen for HTTPS requests on.
-      '';
-    };
-    tlsCert = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      example = "/var/lib/dendrite/server.cert";
-      default = null;
-      description = ''
-        The path to the TLS certificate.
-
-        <programlisting>
-          nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
-        </programlisting>
-      '';
-    };
-    tlsKey = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      example = "/var/lib/dendrite/server.key";
-      default = null;
-      description = ''
-        The path to the TLS key.
-
-        <programlisting>
-          nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
-        </programlisting>
-      '';
-    };
-    environmentFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      example = "/var/lib/dendrite/registration_secret";
-      default = null;
-      description = ''
-        Environment file as defined in <citerefentry>
-        <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
-        </citerefentry>.
-        Secrets may be passed to the service without adding them to the world-readable
-        Nix store, by specifying placeholder variables as the option value in Nix and
-        setting these variables accordingly in the environment file. Currently only used
-        for the registration secret to allow secure registration when
-        client_api.registration_disabled is true.
-
-        <programlisting>
-          # snippet of dendrite-related config
-          services.dendrite.settings.client_api.registration_shared_secret = "$REGISTRATION_SHARED_SECRET";
-        </programlisting>
-
-        <programlisting>
-          # content of the environment file
-          REGISTRATION_SHARED_SECRET=verysecretpassword
-        </programlisting>
-
-        Note that this file needs to be available on the host on which
-        <literal>dendrite</literal> is running.
-      '';
-    };
-    settings = lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = settingsFormat.type;
-        options.global = {
-          server_name = lib.mkOption {
-            type = lib.types.str;
-            example = "example.com";
-            description = ''
-              The domain name of the server, with optional explicit port.
-              This is used by remote servers to connect to this server.
-              This is also the last part of your UserID.
-            '';
-          };
-          private_key = lib.mkOption {
-            type = lib.types.path;
-            example = "${workingDir}/matrix_key.pem";
-            description = ''
-              The path to the signing private key file, used to sign
-              requests and events.
-
-              <programlisting>
-                nix-shell -p dendrite --command "generate-keys --private-key matrix_key.pem"
-              </programlisting>
-            '';
-          };
-          trusted_third_party_id_servers = lib.mkOption {
-            type = lib.types.listOf lib.types.str;
-            example = [ "matrix.org" ];
-            default = [ "matrix.org" "vector.im" ];
-            description = ''
-              Lists of domains that the server will trust as identity
-              servers to verify third party identifiers such as phone
-              numbers and email addresses
-            '';
-          };
-        };
-        options.client_api = {
-          registration_disabled = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = ''
-              Whether to disable user registration to the server
-              without the shared secret.
-            '';
-          };
-        };
-      };
-      default = { };
-      description = ''
-        Configuration for dendrite, see:
-        <link xlink:href="https://github.com/matrix-org/dendrite/blob/master/dendrite-config.yaml"/>
-        for available options with which to populate settings.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [{
-      assertion = cfg.httpsPort != null -> (cfg.tlsCert != null && cfg.tlsKey != null);
-      message = ''
-        If Dendrite is configured to use https, tlsCert and tlsKey must be provided.
-
-        nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
-      '';
-    }];
-
-    systemd.services.dendrite = {
-      description = "Dendrite Matrix homeserver";
-      after = [
-        "network.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "simple";
-        DynamicUser = true;
-        StateDirectory = "dendrite";
-        WorkingDirectory = workingDir;
-        RuntimeDirectory = "dendrite";
-        RuntimeDirectoryMode = "0700";
-        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
-        ExecStartPre =
-          if (cfg.environmentFile != null) then ''
-            ${pkgs.envsubst}/bin/envsubst \
-              -i ${configurationYaml} \
-              -o /run/dendrite/dendrite.yaml
-          '' else ''
-            ${pkgs.coreutils}/bin/cp ${configurationYaml} /run/dendrite/dendrite.yaml
-          '';
-        ExecStart = lib.strings.concatStringsSep " " ([
-          "${pkgs.dendrite}/bin/dendrite-monolith-server"
-          "--config /run/dendrite/dendrite.yaml"
-        ] ++ lib.optionals (cfg.httpPort != null) [
-          "--http-bind-address :${builtins.toString cfg.httpPort}"
-        ] ++ lib.optionals (cfg.httpsPort != null) [
-          "--https-bind-address :${builtins.toString cfg.httpsPort}"
-          "--tls-cert ${cfg.tlsCert}"
-          "--tls-key ${cfg.tlsKey}"
-        ]);
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-        Restart = "on-failure";
-      };
-    };
-  };
-  meta.maintainers = lib.teams.matrix.members;
-}

nixos/modules/services/misc/nix-daemon.nix

@@ -12,8 +12,6 @@ let
 
   isNix23 = versionAtLeast nixVersion "2.3pre";
 
-  isNix24 = versionAtLeast nixVersion "2.4pre";
-
   makeNixBuildUser = nr: {
     name  = "nixbld${toString nr}";
     value = {
@@ -43,11 +41,7 @@ let
         max-jobs = ${toString (cfg.maxJobs)}
         cores = ${toString (cfg.buildCores)}
         sandbox = ${if (builtins.isBool cfg.useSandbox) then boolToString cfg.useSandbox else cfg.useSandbox}
-        ${if isNix24 then ''
-          sandbox-paths = ${toString cfg.sandboxPaths}
-        '' else ''
-          extra-sandbox-paths = ${toString cfg.sandboxPaths}
-        ''}
+        extra-sandbox-paths = ${toString cfg.sandboxPaths}
         substituters = ${toString cfg.binaryCaches}
         trusted-substituters = ${toString cfg.trustedBinaryCaches}
         trusted-public-keys = ${toString cfg.binaryCachePublicKeys}

nixos/modules/services/networking/kresd.nix

@@ -115,6 +115,8 @@ in {
   config = mkIf cfg.enable {
     environment.etc."knot-resolver/kresd.conf".source = configFile; # not required
 
+    networking.resolvconf.useLocalResolver = mkDefault true;
+
     users.users.knot-resolver =
       { isSystemUser = true;
         group = "knot-resolver";

nixos/modules/services/networking/wireguard.nix

@@ -219,17 +219,6 @@ let
 
   };
 
-  generatePathUnit = name: values:
-    assert (values.privateKey == null);
-    assert (values.privateKeyFile != null);
-    nameValuePair "wireguard-${name}"
-      {
-        description = "WireGuard Tunnel - ${name} - Private Key";
-        requiredBy = [ "wireguard-${name}.service" ];
-        before = [ "wireguard-${name}.service" ];
-        pathConfig.PathExists = values.privateKeyFile;
-      };
-
   generateKeyServiceUnit = name: values:
     assert values.generatePrivateKeyFile;
     nameValuePair "wireguard-${name}-key"
@@ -448,9 +437,6 @@ in
       // (mapAttrs' generateKeyServiceUnit
       (filterAttrs (name: value: value.generatePrivateKeyFile) cfg.interfaces));
 
-    systemd.paths = mapAttrs' generatePathUnit
-      (filterAttrs (name: value: value.privateKeyFile != null) cfg.interfaces);
-
   });
 
 }

nixos/modules/services/security/bitwarden_rs/default.nix

@@ -121,7 +121,6 @@ in {
         EnvironmentFile = [ configFile ] ++ optional (cfg.environmentFile != null) cfg.environmentFile;
         ExecStart = "${bitwarden_rs}/bin/bitwarden_rs";
         LimitNOFILE = "1048576";
-        LimitNPROC = "64";
         PrivateTmp = "true";
         PrivateDevices = "true";
         ProtectHome = "true";

nixos/modules/services/web-apps/discourse.nix

@@ -5,11 +5,16 @@ let
 
   cfg = config.services.discourse;
 
+  # Keep in sync with https://github.com/discourse/discourse_docker/blob/master/image/base/Dockerfile#L5
+  upstreamPostgresqlVersion = lib.getVersion pkgs.postgresql_13;
+
   postgresqlPackage = if config.services.postgresql.enable then
                         config.services.postgresql.package
                       else
                         pkgs.postgresql;
 
+  postgresqlVersion = lib.getVersion postgresqlPackage;
+
   # We only want to create a database if we're actually going to connect to it.
   databaseActuallyCreateLocally = cfg.database.createLocally && cfg.database.host == null;
 
@@ -263,6 +268,17 @@ in
             Discourse database user.
           '';
         };
+
+        ignorePostgresqlVersion = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = ''
+            Whether to allow other versions of PostgreSQL than the
+            recommended one. Only effective when
+            <option>services.discourse.database.createLocally</option>
+            is enabled.
+          '';
+        };
       };
 
       redis = {
@@ -398,6 +414,14 @@ in
               How OpenSSL checks the certificate, see http://api.rubyonrails.org/classes/ActionMailer/Base.html
             '';
           };
+
+          forceTLS = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Force implicit TLS as per RFC 8314 3.3.
+            '';
+          };
         };
 
         incoming = {
@@ -497,6 +521,12 @@ in
         assertion = cfg.hostname != "";
         message = "Could not automatically determine hostname, set service.discourse.hostname manually.";
       }
+      {
+        assertion = cfg.database.ignorePostgresqlVersion || (databaseActuallyCreateLocally -> upstreamPostgresqlVersion == postgresqlVersion);
+        message = "The PostgreSQL version recommended for use with Discourse is ${upstreamPostgresqlVersion}, you're using ${postgresqlVersion}. "
+                  + "Either update your PostgreSQL package to the correct version or set services.discourse.database.ignorePostgresqlVersion. "
+                  + "See https://nixos.org/manual/nixos/stable/index.html#module-postgresql for details on how to upgrade PostgreSQL.";
+      }
     ];
 
 
@@ -530,6 +560,7 @@ in
       smtp_authentication = cfg.mail.outgoing.authentication;
       smtp_enable_start_tls = cfg.mail.outgoing.enableStartTLSAuto;
       smtp_openssl_verify_mode = cfg.mail.outgoing.opensslVerifyMode;
+      smtp_force_tls = cfg.mail.outgoing.forceTLS;
 
       load_mini_profiler = true;
       mini_profiler_snapshots_period = 0;
@@ -542,8 +573,8 @@ in
 
       redis_host = cfg.redis.host;
       redis_port = 6379;
-      redis_slave_host = null;
-      redis_slave_port = 6379;
+      redis_replica_host = null;
+      redis_replica_port = 6379;
       redis_db = cfg.redis.dbNumber;
       redis_password = cfg.redis.passwordFile;
       redis_skip_client_commands = false;
@@ -552,8 +583,8 @@ in
       message_bus_redis_enabled = false;
       message_bus_redis_host = "localhost";
       message_bus_redis_port = 6379;
-      message_bus_redis_slave_host = null;
-      message_bus_redis_slave_port = 6379;
+      message_bus_redis_replica_host = null;
+      message_bus_redis_replica_port = 6379;
       message_bus_redis_db = 0;
       message_bus_redis_password = null;
       message_bus_redis_skip_client_commands = false;
@@ -606,6 +637,7 @@ in
       allowed_theme_repos = null;
       enable_email_sync_demon = false;
       max_digests_enqueued_per_30_mins_per_site = 10000;
+      cluster_name = null;
     };
 
     services.redis.enable = lib.mkDefault (cfg.redis.host == "localhost");
@@ -667,6 +699,7 @@ in
       environment = cfg.package.runtimeEnv // {
         UNICORN_TIMEOUT = builtins.toString cfg.unicornTimeout;
         UNICORN_SIDEKIQS = builtins.toString cfg.sidekiqProcesses;
+        MALLOC_ARENA_MAX = "2";
       };
 
       preStart =

nixos/modules/services/web-apps/wordpress.nix

@@ -61,8 +61,10 @@ let
     ?>
   '';
 
-  secretsVars = [ "AUTH_KEY" "SECURE_AUTH_KEY" "LOOGGED_IN_KEY" "NONCE_KEY" "AUTH_SALT" "SECURE_AUTH_SALT" "LOGGED_IN_SALT" "NONCE_SALT" ];
+  secretsVars = [ "AUTH_KEY" "SECURE_AUTH_KEY" "LOGGED_IN_KEY" "NONCE_KEY" "AUTH_SALT" "SECURE_AUTH_SALT" "LOGGED_IN_SALT" "NONCE_SALT" ];
   secretsScript = hostStateDir: ''
+    # The match in this line is not a typo, see https://github.com/NixOS/nixpkgs/pull/124839
+    grep -q "LOOGGED_IN_KEY" "${hostStateDir}/secret-keys.php" && rm "${hostStateDir}/secret-keys.php"
     if ! test -e "${hostStateDir}/secret-keys.php"; then
       umask 0177
       echo "<?php" >> "${hostStateDir}/secret-keys.php"

nixos/modules/services/x11/desktop-managers/plasma5.nix

@@ -8,7 +8,7 @@ let
   cfg = xcfg.desktopManager.plasma5;
 
   libsForQt5 = pkgs.plasma5Packages;
-  inherit (libsForQt5) kdeApplications kdeFrameworks plasma5;
+  inherit (libsForQt5) kdeGear kdeFrameworks plasma5;
   inherit (pkgs) writeText;
 
   pulseaudio = config.hardware.pulseaudio;
@@ -213,7 +213,7 @@ in
 
       environment.systemPackages =
         with libsForQt5;
-        with plasma5; with kdeApplications; with kdeFrameworks;
+        with plasma5; with kdeGear; with kdeFrameworks;
         [
           frameworkintegration
           kactivities

nixos/modules/tasks/filesystems.nix

@@ -321,6 +321,7 @@ in
             RemainAfterExit = true;
           };
           unitConfig = {
+            ConditionPathIsMountPoint = "!/sys/fs/pstore";
             ConditionVirtualization = "!container";
             DefaultDependencies = false; # needed to prevent a cycle
           };

nixos/modules/virtualisation/libvirtd.nix

@@ -159,7 +159,7 @@ in {
       etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n" (e:
         "allow ${e}") cfg.allowedBridges;
       systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemuPackage ];
-      etc.ethertypes.source = "${pkgs.iptables}/etc/ethertypes";
+      etc.ethertypes.source = "${pkgs.ebtables}/etc/ethertypes";
     };
 
     boot.kernelModules = [ "tun" ];

nixos/tests/all-tests.nix

@@ -53,7 +53,7 @@ in
   caddy = handleTest ./caddy.nix {};
   cadvisor = handleTestOn ["x86_64-linux"] ./cadvisor.nix {};
   cage = handleTestOn ["x86_64-linux"] ./cage.nix {};
-  cagebreak = handleTest ./cagebreak.nix {};
+  cagebreak = handleTestOn ["x86_64-linux"] ./cagebreak.nix {};
   calibre-web = handleTest ./calibre-web.nix {};
   cassandra_2_1 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_2_1; };
   cassandra_2_2 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_2_2; };
@@ -93,7 +93,6 @@ in
   custom-ca = handleTest ./custom-ca.nix {};
   croc = handleTest ./croc.nix {};
   deluge = handleTest ./deluge.nix {};
-  dendrite = handleTest ./dendrite.nix {};
   dhparams = handleTest ./dhparams.nix {};
   discourse = handleTest ./discourse.nix {};
   dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
@@ -395,7 +394,7 @@ in
   sssd-ldap = handleTestOn ["x86_64-linux"] ./sssd-ldap.nix {};
   strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
   sudo = handleTest ./sudo.nix {};
-  sway = handleTest ./sway.nix {};
+  sway = handleTestOn ["x86_64-linux"] ./sway.nix {};
   switchTest = handleTest ./switch-test.nix {};
   sympa = handleTest ./sympa.nix {};
   syncthing = handleTest ./syncthing.nix {};

nixos/tests/dendrite.nix

@@ -1,99 +0,0 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-    let
-      homeserverUrl = "http://homeserver:8008";
-
-      private_key = pkgs.runCommand "matrix_key.pem" {
-        buildInputs = [ pkgs.dendrite ];
-      } "generate-keys --private-key $out";
-    in
-      {
-        name = "dendrite";
-        meta = with pkgs.lib; {
-          maintainers = teams.matrix.members;
-        };
-
-        nodes = {
-          homeserver = { pkgs, ... }: {
-            services.dendrite = {
-              enable = true;
-              settings = {
-                global.server_name = "test-dendrite-server.com";
-                global.private_key = private_key;
-                client_api.registration_disabled = false;
-              };
-            };
-
-            networking.firewall.allowedTCPPorts = [ 8008 ];
-          };
-
-          client = { pkgs, ... }: {
-            environment.systemPackages = [
-              (
-                pkgs.writers.writePython3Bin "do_test"
-                  { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
-                  import asyncio
-
-                  from nio import AsyncClient
-
-
-                  async def main() -> None:
-                      # Connect to dendrite
-                      client = AsyncClient("http://homeserver:8008", "alice")
-
-                      # Register as user alice
-                      response = await client.register("alice", "my-secret-password")
-
-                      # Log in as user alice
-                      response = await client.login("my-secret-password")
-
-                      # Create a new room
-                      response = await client.room_create(federate=False)
-                      room_id = response.room_id
-
-                      # Join the room
-                      response = await client.join(room_id)
-
-                      # Send a message to the room
-                      response = await client.room_send(
-                          room_id=room_id,
-                          message_type="m.room.message",
-                          content={
-                              "msgtype": "m.text",
-                              "body": "Hello world!"
-                          }
-                      )
-
-                      # Sync responses
-                      response = await client.sync(timeout=30000)
-
-                      # Check the message was received by dendrite
-                      last_message = response.rooms.join[room_id].timeline.events[-1].body
-                      assert last_message == "Hello world!"
-
-                      # Leave the room
-                      response = await client.room_leave(room_id)
-
-                      # Close the client
-                      await client.close()
-
-                  asyncio.get_event_loop().run_until_complete(main())
-                ''
-              )
-            ];
-          };
-        };
-
-        testScript = ''
-          start_all()
-
-          with subtest("start the homeserver"):
-              homeserver.wait_for_unit("dendrite.service")
-              homeserver.wait_for_open_port(8008)
-
-          with subtest("ensure messages can be exchanged"):
-              client.succeed("do_test")
-        '';
-
-      }
-)

nixos/tests/discourse.nix

@@ -51,6 +51,8 @@ import ./make-test-python.nix (
 
         environment.systemPackages = [ pkgs.jq ];
 
+        services.postgresql.package = pkgs.postgresql_13;
+
         services.discourse = {
           enable = true;
           inherit admin;

pkgs/applications/audio/bjumblr/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "BJumblr";
-  version = "1.4.2";
+  version = "1.6.6";
 
   src = fetchFromGitHub {
     owner = "sjaehn";
     repo = pname;
     rev = version;
-    sha256 = "0kl6hrxmqrdf0195bfnzsa2h1073fgiqrfhg2276fm1954sm994v";
+    sha256 = "1nbxi54023vck3qgmr385cjzinmdnvz62ywb6bcksmc3shl080mg";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/audio/flac/default.nix

@@ -1,13 +1,22 @@
-{ lib, stdenv, fetchurl, libogg }:
+{ lib, stdenv, fetchurl, fetchpatch, libogg }:
 
 stdenv.mkDerivation rec {
-  name = "flac-1.3.3";
+  pname = "flac";
+  version = "1.3.3";
 
   src = fetchurl {
-    url = "http://downloads.xiph.org/releases/flac/${name}.tar.xz";
+    url = "http://downloads.xiph.org/releases/flac/${pname}-${version}.tar.xz";
     sha256 = "0j0p9sf56a2fm2hkjnf7x3py5ir49jyavg4q5zdyd7bcf6yq4gi1";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2020-0499.patch";
+      url = "https://github.com/xiph/flac/commit/2e7931c27eb15e387da440a37f12437e35b22dd4.patch";
+      sha256 = "160qzq9ms5addz7sx06pnyjjkqrffr54r4wd8735vy4x008z71ah";
+    })
+  ];
+
   buildInputs = [ libogg ];
 
   #doCheck = true; # takes lots of time

pkgs/applications/audio/goattracker/default.nix

@@ -27,16 +27,16 @@ let
 in stdenv.mkDerivation rec {
   inherit pname;
   version = if isStereo
-    then "2.76"  # stereo
-    else "2.75"; # normal
+    then "2.77"  # stereo
+    else "2.76"; # normal
 
   src = fetchurl {
     url = "mirror://sourceforge/goattracker2/GoatTracker_${version}${optionalString isStereo "_Stereo"}.zip";
     sha256 = if isStereo
-      then "12cz3780x5k047jqdv69n6rjgbfiwv67z850kfl4i37lxja432l7"  # stereo
-      else "1km97nl7qvk6qc5l5j69wncbm76hf86j47sgzgr968423g0bxxlk"; # normal
+      then "1hiig2d152sv9kazwz33i56x1c54h5sh21ipkqnp6qlnwj8x1ksy"  # stereo
+      else "0d7a3han4jw4bwiba3j87racswaajgl3pj4sb5lawdqdxicv3dn1"; # normal
   };
-  sourceRoot = (if isStereo then "gt2stereo/trunk" else "goattrk2") + "/src";
+  sourceRoot = "src";
 
   nativeBuildInputs = [ copyDesktopItems unzip imagemagick ];
   buildInputs = [ SDL ];

pkgs/applications/audio/gradio/default.nix

@@ -55,7 +55,6 @@ in stdenv.mkDerivation {
     gsettings-desktop-schemas
   ] ++ gst_plugins;
 
-  enableParallelBuilding = true;
   postInstall = ''
     glib-compile-schemas "$out"/share/glib-2.0/schemas
   '';

pkgs/applications/audio/gxplugins-lv2/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "GxPlugins.lv2";
-  version = "0.8";
+  version = "0.9";
 
   src = fetchFromGitHub {
     owner = "brummer10";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11iv7bwvvspm74pisqvcpsxpg9xi6b08hq4i8q67mri4mvy9hmal";
+    sha256 = "02fksl8wr443ygwgcd1c2zab8kp67a6ps12k71ysqx7szv4zq877";
     fetchSubmodules = true;
   };
 
@@ -29,6 +29,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/brummer10/GxPlugins.lv2";
     description = "A set of extra lv2 plugins from the guitarix project";
     maintainers = [ maintainers.magnetophon ];
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
   };
 }

pkgs/applications/audio/mmtc/default.nix

@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "0ag87hgdg6fvk80fgznba0xjlcajks5w5s6y8lvwhz9irn2kq2rz";
   };
 
-  cargoSha256 = "06xqh0mqbik00qyg8mn1ddbn15v3pdwvh1agghg22xgx53kmnxb3";
+  cargoSha256 = "0lkx0zj9xc0rlrq91l4wydzp430hxlrqyq7ii8wq2fcan8ln22lv";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/audio/muso/default.nix

@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
     cp share/* $out/share/muso/
   '';
 
-  cargoSha256 = "06jgk54r3f8gq6iylv5rgsawss3hc5kmvk02y4gl8iwfnw4xrvmg";
+  cargoSha256 = "1hgdzyz005244f2mh97js9ga0a6s2hcd6iydz07f1hmhsh1j2bwy";
 
   meta = with lib; {
     description = "An automatic music sorter (based on ID3 tags)";

pkgs/applications/audio/netease-music-tui/default.nix

@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ alsaLib openssl ];
 
-  cargoSha256 = "0f06wc7h2zjipifvxsskxvihjf6mykrjrm7yk0zf98ra079bc9g9";
+  cargoSha256 = "1pca0sz4rz8qls6k2vhf70ixhnvgk81c4hbx81q3pv106g5k205f";
 
   meta = with lib; {
     homepage = "https://github.com/betta-cyber/netease-music-tui";

pkgs/applications/audio/parlatype/default.nix

@@ -48,7 +48,6 @@ stdenv.mkDerivation rec {
   '';
 
   doCheck = false;
-  enableParallelBuilding = true;
 
   buildPhase = ''
     export GST_PLUGIN_SYSTEM_PATH_1_0="$out/lib/gstreamer-1.0/:$GST_PLUGIN_SYSTEM_PATH_1_0"

pkgs/applications/audio/schismtracker/default.nix

@@ -13,7 +13,8 @@ stdenv.mkDerivation rec {
     sha256 = "1n6cgjiw3vkv7a1h1nki5syyjxjb6icknr9s049w2jrag10bxssn";
   };
 
-  configureFlags = [ "--enable-dependency-tracking" ];
+  configureFlags = [ "--enable-dependency-tracking" ]
+    ++ lib.optional stdenv.isDarwin "--disable-sdltest";
 
   nativeBuildInputs = [ autoreconfHook python ];
 

pkgs/applications/audio/spotify-tui/default.nix

@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "082y5m2vglzx9kdc2088zynz0njcnljnb0y170igmlsxq9wkrgg2";
   };
 
-  cargoSha256 = "100c7x603qyhav3p24clwfal4ngh0258x9lqsi84kcj4wq2f3i8f";
+  cargoSha256 = "1khn6fx13qlfpqwnw7ysgan5h4nrg2qnzn2p74vn7jic3mqc3sax";
 
   nativeBuildInputs = [ installShellFiles ] ++ lib.optionals stdenv.isLinux [ pkg-config python3 ];
   buildInputs = [ ]

pkgs/applications/audio/spotifyd/default.nix

@@ -18,7 +18,7 @@ rustPackages.rustPlatform.buildRustPackage rec {
     sha256 = "1a578h13iv8gqmskzlncfr42jlg5gp0zfcizv4wbd48y9hl8fh2l";
   };
 
-  cargoSha256 = "1sm5yfgjx5xfnqqh1v8ycwzxw4kl6dq5gcvsdnc4h1cj3pdhbpcc";
+  cargoSha256 = "07dxfc0csrnfl01p9vdrqvca9f574svlf37dk3dz8p6q08ki0n1z";
 
   cargoBuildFlags = [
     "--no-default-features"

pkgs/applications/audio/whipper/default.nix

@@ -1,7 +1,17 @@
-{ lib, fetchFromGitHub, python3, cdparanoia, cdrdao, flac
-, sox, accuraterip-checksum, libsndfile, util-linux, substituteAll }:
+{ lib
+, python3
+, fetchFromGitHub
+, libcdio-paranoia
+, cdrdao
+, libsndfile
+, flac
+, sox
+, util-linux
+}:
 
-python3.pkgs.buildPythonApplication rec {
+let
+  bins = [ libcdio-paranoia cdrdao flac sox util-linux ];
+in python3.pkgs.buildPythonApplication rec {
   pname = "whipper";
   version = "0.10.0";
 
@@ -12,44 +22,43 @@ python3.pkgs.buildPythonApplication rec {
     sha256 = "00cq03cy5dyghmibsdsq5sdqv3bzkzhshsng74bpnb5lasxp3ia5";
   };
 
-  pythonPath = with python3.pkgs; [
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools_scm
+    docutils
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
     musicbrainzngs
     mutagen
     pycdio
     pygobject3
-    requests
     ruamel_yaml
-    setuptools
-    setuptools_scm
+    discid
+    pillow
   ];
 
   buildInputs = [ libsndfile ];
 
   checkInputs = with python3.pkgs; [
     twisted
-  ];
-
-  patches = [
-    (substituteAll {
-      src = ./paths.patch;
-      inherit cdparanoia;
-    })
-  ];
+  ] ++ bins;
 
   makeWrapperArgs = [
-    "--prefix" "PATH" ":" (lib.makeBinPath [ accuraterip-checksum cdrdao util-linux flac sox ])
+    "--prefix" "PATH" ":" (lib.makeBinPath bins)
   ];
 
   preBuild = ''
     export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
   '';
 
-  # some tests require internet access
-  # https://github.com/JoeLametta/whipper/issues/291
-  doCheck = false;
-
-  preCheck = ''
-    HOME=$TMPDIR
+  checkPhase = ''
+    runHook preCheck
+    # disable tests that require internet access
+    # https://github.com/JoeLametta/whipper/issues/291
+    substituteInPlace whipper/test/test_common_accurip.py \
+      --replace "test_AccurateRipResponse" "dont_test_AccurateRipResponse"
+    HOME=$TMPDIR ${python3.interpreter} -m unittest discover
+    runHook postCheck
   '';
 
   meta = with lib; {

pkgs/applications/audio/whipper/paths.patch

@@ -1,32 +0,0 @@
---- a/whipper/program/cdparanoia.py
-+++ b/whipper/program/cdparanoia.py
-@@ -280,10 +280,10 @@
- 
-         bufsize = 1024
-         if self._overread:
--            argv = ["cd-paranoia", "--stderr-progress",
-+            argv = ["@cdparanoia@/bin/cdparanoia", "--stderr-progress",
-                     "--sample-offset=%d" % self._offset, "--force-overread", ]
-         else:
--            argv = ["cd-paranoia", "--stderr-progress",
-+            argv = ["@cdparanoia@/bin/cdparanoia", "--stderr-progress",
-                     "--sample-offset=%d" % self._offset, ]
-         if self._device:
-             argv.extend(["--force-cdrom-device", self._device, ])
-@@ -560,7 +560,7 @@
- 
- def getCdParanoiaVersion():
-     getter = common.VersionGetter('cd-paranoia',
--                                  ["cd-paranoia", "-V"],
-+                                  ["@cdparanoia@/bin/cdparanoia", "-V"],
-                                   _VERSION_RE,
-                                   "%(version)s %(release)s")
- 
-@@ -585,7 +585,7 @@
-     def __init__(self, device=None):
-         # cdparanoia -A *always* writes cdparanoia.log
-         self.cwd = tempfile.mkdtemp(suffix='.whipper.cache')
--        self.command = ['cd-paranoia', '-A']
-+        self.command = ['@cdparanoia@/bin/cdparanoia', '-A']
-         if device:
-             self.command += ['-d', device]

pkgs/applications/backup/pika-backup/default.nix

@@ -19,20 +19,20 @@
 
 stdenv.mkDerivation rec {
   pname = "pika-backup";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "pika-backup";
     rev = "v${version}";
-    sha256 = "0cr3axfp15nzwmsqyz6j781qhr2gsn9p69m0jfzy89pl83d6vcz0";
+    sha256 = "sha256-dKVyvB4s1MZHri0dFJDBUXQKsi2KgP30ZhsJ486M+og=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    sha256 = "1z0cbrkhxyzwf7vjjsvdppb7zhflpkw4m5cy90a2315nbll3hpbp";
+    sha256 = "1vsh8vqgmfady82d7wfxkknmrp7mq7nizpif2zwg3kqbl964mp3y";
   };
 
   patches = [

pkgs/applications/blockchains/stellar-core-dirty-version.patch

@@ -1,15 +0,0 @@
-Subject: Prevent "-dirty" from being erroneously added to the version
-
-diff --git a/src/Makefile.am b/src/Makefile.am
-index d36d1a3..00048fc 100644
---- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -28,7 +28,7 @@ always:
- # Always rebuild because .git/HEAD is a symbolic ref one can't depend on
- StellarCoreVersion.h: always
- 	@vers=$$(cd "$(srcdir)" \
--		&& git describe --always --dirty --tags 2>/dev/null \
-+		&& git describe --always --tags 2>/dev/null \
- 		|| echo "$(PACKAGE) $(VERSION)"); \
- 	    echo "#define STELLAR_CORE_VERSION \"$$vers\"" > $@~
- 	@if cmp -s $@~ $@; then rm -f $@~; else \

pkgs/applications/blockchains/stellar-core.nix

@@ -1,31 +1,30 @@
-{ lib, stdenv, fetchgit, autoconf, libtool, automake, pkg-config, git
-, bison, flex, postgresql }:
+{ lib, stdenv, fetchFromGitHub, autoconf, libtool, automake, pkg-config, git
+, bison, flex, postgresql, ripgrep }:
 
-let
+stdenv.mkDerivation rec {
   pname = "stellar-core";
-  version = "0.5.1";
+  version = "17.0.0";
 
-in stdenv.mkDerivation {
-  name = "${pname}-${version}";
-
-  src = fetchgit {
-    url = "https://github.com/stellar/stellar-core.git";
-    rev = "refs/tags/v${version}";
-    sha256 = "0ldw3qr0sajgam38z2w2iym0214ial6iahbzx3b965cw92n8n88z";
+  src = fetchFromGitHub {
+    owner = "stellar";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1ngl8yjqb8xzhdwzlxzzxf14q2hgwy2ysb17sn5380rrn0jswin1";
     fetchSubmodules = true;
-    leaveDotGit = true;
   };
 
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ autoconf automake libtool git ];
+  nativeBuildInputs = [ automake autoconf git libtool pkg-config ripgrep ];
 
   propagatedBuildInputs = [ bison flex postgresql ];
 
-  patches = [ ./stellar-core-dirty-version.patch ];
-
   preConfigure = ''
+    # Due to https://github.com/NixOS/nixpkgs/issues/8567 we cannot rely on
+    # having the .git directory present, so directly provide the version
+    substituteInPlace src/Makefile.am --replace '$$vers' '${pname} ${version}';
+
     # Everything needs to be staged in git because the build uses
     # `git ls-files` to search for source files to compile.
+    git init
     git add .
 
     ./autogen.sh

pkgs/applications/editors/amp/default.nix

@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "0l1vpcfq6jrq2dkrmsa4ghwdpp7c54f46gz3n7nk0i41b12hnigw";
   };
 
-  cargoSha256 = "09v991rl2w4c4jh7ga7q1lk6wyl2vr71j5cpniij8mcvszrz78qf";
+  cargoSha256 = "19r3xvysragmf02zk2l5s2hjg92gxdygsh52y7za81x443lvjyvq";
 
   nativeBuildInputs = [ cmake pkg-config python3 ];
   buildInputs = [ openssl xorg.libxcb libgit2 ] ++ lib.optionals stdenv.isDarwin

pkgs/applications/editors/hexdino/default.nix

@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage {
     sha256 = "11mz07735gxqfamjcjjmxya6swlvr1p77sgd377zjcmd6z54gwyf";
   };
 
-  cargoSha256 = "06ghcd4j751mdkzwb88nqwk8la4zdb137y0iqrkpykkfx0as43x3";
+  cargoSha256 = "1hpndmpk1zlfvb4r95m13yvnsbjkwgw4pb9ala2d5yzfp38225nm";
 
   buildInputs = [ ncurses ];
 

pkgs/applications/editors/kibi/default.nix

@@ -7,7 +7,7 @@ rustPlatform.buildRustPackage rec {
   pname = "kibi";
   version = "0.2.2";
 
-  cargoSha256 = "sha256-8iEUOLFwHBLS0HQL/oLnv6lcV3V9Hm4jMqXkqPvIF9E=";
+  cargoSha256 = "sha256-ebUCkcUACganeq5U0XU4VIGClKDZGhUw6K3WBgTUUUw=";
 
   src = fetchFromGitHub {
     owner = "ilai-deutel";

pkgs/applications/editors/neovim/gnvim/default.nix

@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1cc3yk04v9icdjr5cn58mqc3ba1wqmlzhf9ly7biy9m8yk30w9y0";
   };
 
-  cargoSha256 = "1fyn8nsabzrfl9ykf2gk2p8if0yjp6k0ybrmp0pw67pbwaxpb9ym";
+  cargoSha256 = "0z6hhahxdc6d7nzqvc8jlxn1frsc39va8z5pmwfmmq5z61ahk90z";
 
   buildInputs = [ gtk webkitgtk ];
 

pkgs/applications/editors/neovim/neovide/default.nix

@@ -66,7 +66,7 @@ rustPlatform.buildRustPackage rec {
 
   SKIA_OFFLINE_NINJA_COMMAND = "${ninja}/bin/ninja";
   SKIA_OFFLINE_GN_COMMAND = "${gn}/bin/gn";
-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 
   # test needs a valid fontconfig file
   FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };

pkgs/applications/editors/ox/default.nix

@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "18iffnmvax6mbnhypf7yma98y5q2zlsyp9q18f92fdwz426r33p0";
   };
 
-  cargoSha256 = "0v0a1dl9rq5qyy9xwnb59w62qr9db3y3zlmnp60wafvj70zi9zxs";
+  cargoSha256 = "0m5vglm58myf50vbb7m6gd3srk3n93afg70lz63i2kciqkkwsnjl";
 
   meta = with lib; {
     description = "An independent Rust text editor that runs in your terminal";

pkgs/applications/gis/whitebox-tools/default.nix

@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 
-  cargoSha256 = "09rz8f1xyc64qjbj6pgw8jxr2a7chghmdc6sfkbv7hdvx6vg4wvk";
+  cargoSha256 = "0rdg9k44si37iyqlcl1rw7ilajcvqy93gbfpd7n4cr1hg9ypm0m3";
 
   meta = with lib; {
     description = "An advanced geospatial data analysis platform";

pkgs/applications/graphics/ImageMagick/6.x.nix

@@ -9,7 +9,7 @@ let
     if stdenv.hostPlatform.system == "i686-linux" then "i686"
     else if stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin" then "x86-64"
     else if stdenv.hostPlatform.system == "armv7l-linux" then "armv7l"
-    else if stdenv.hostPlatform.system == "aarch64-linux" then "aarch64"
+    else if stdenv.hostPlatform.system == "aarch64-linux"  || stdenv.hostPlatform.system == "aarch64-darwin" then "aarch64"
     else if stdenv.hostPlatform.system == "powerpc64le-linux" then "ppc64le"
     else throw "ImageMagick is not supported on this platform.";
 in

pkgs/applications/graphics/ImageMagick/7.0.nix

@@ -11,20 +11,20 @@ let
     if stdenv.hostPlatform.system == "i686-linux" then "i686"
     else if stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin" then "x86-64"
     else if stdenv.hostPlatform.system == "armv7l-linux" then "armv7l"
-    else if stdenv.hostPlatform.system == "aarch64-linux" then "aarch64"
+    else if stdenv.hostPlatform.system == "aarch64-linux"  || stdenv.hostPlatform.system == "aarch64-darwin" then "aarch64"
     else if stdenv.hostPlatform.system == "powerpc64le-linux" then "ppc64le"
     else throw "ImageMagick is not supported on this platform.";
 in
 
 stdenv.mkDerivation rec {
   pname = "imagemagick";
-  version = "7.0.11-9";
+  version = "7.0.11-13";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     rev = version;
-    sha256 = "sha256-eL9zFrgkLb3pS8/UlQB5+p50UG8j3Q7TNDwcO/3BuXo=";
+    sha256 = "sha256-6dYc636m1OeRqIPv5NFz/K8OUvl6sgEQKjfvTngR2Ms=";
   };
 
   outputs = [ "out" "dev" "doc" ]; # bin/ isn't really big

pkgs/applications/graphics/rx/default.nix

@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1pln65pqy39ijrld11d06klwzfhhzmrgdaxijpx9q7w9z66zmqb8";
   };
 
-  cargoSha256 = "143a5x61s7ywk0ljqd10jkfvs6lrhlibkm2a9lw41wq13mgzb78j";
+  cargoSha256 = "1mb9wx5h729pc9y1b0d0yiapyk0mlbvdmvwq993fcpkziwjvnl44";
 
   nativeBuildInputs = [ cmake pkg-config makeWrapper ];
 

pkgs/applications/kde/akonadi-import-wizard.nix

@@ -2,7 +2,8 @@
   mkDerivation, lib, kdepimTeam,
   extra-cmake-modules, kdoctools,
   akonadi, karchive, kcontacts, kcrash, kidentitymanagement, kio,
-  kmailtransport, kwallet, mailcommon, mailimporter, messagelib
+  kmailtransport, kwallet, mailcommon, mailimporter, messagelib,
+  qtkeychain, libsecret
 }:
 
 mkDerivation {
@@ -15,6 +16,7 @@ mkDerivation {
   buildInputs = [
     akonadi karchive kcontacts kcrash kidentitymanagement kio
     kmailtransport kwallet mailcommon mailimporter messagelib
+    qtkeychain libsecret
   ];
   outputs = [ "out" "dev" ];
 }

pkgs/applications/kde/akonadi/0001-akonadi-paths.patch

@@ -1,6 +1,6 @@
-From f4d718502ecd8242500078a7783e27caba72871e Mon Sep 17 00:00:00 2001
+From ca8ff6e6d527ee968300cce5e8cd148f6a4d256b Mon Sep 17 00:00:00 2001
 From: Thomas Tuegel <ttuegel@mailbox.org>
-Date: Sun, 31 Jan 2021 11:00:03 -0600
+Date: Sun, 25 Apr 2021 08:00:10 -0500
 Subject: [PATCH 1/3] akonadi paths
 
 ---
@@ -11,32 +11,32 @@ Subject: [PATCH 1/3] akonadi paths
  4 files changed, 11 insertions(+), 40 deletions(-)
 
 diff --git a/src/akonadicontrol/agentmanager.cpp b/src/akonadicontrol/agentmanager.cpp
-index 31e0cf2..6436e87 100644
+index 44ceec5..eb5fa50 100644
 --- a/src/akonadicontrol/agentmanager.cpp
 +++ b/src/akonadicontrol/agentmanager.cpp
-@@ -48,7 +48,7 @@ public:
-                 []() {
-                     QCoreApplication::instance()->exit(255);
-                 });
+@@ -47,7 +47,7 @@ public:
+         connect(this, &Akonadi::ProcessControl::unableToStart, this, []() {
+             QCoreApplication::instance()->exit(255);
+         });
 -        start(QStringLiteral("akonadiserver"), args, RestartOnCrash);
-+        start(QLatin1String(NIX_OUT "/bin/akonadiserver"), args, RestartOnCrash);
++        start(QStringLiteral(NIX_OUT "/bin/akonadiserver"), args, RestartOnCrash);
      }
- 
+
      ~StorageProcessControl() override
-@@ -70,7 +70,7 @@ public:
-                 []() {
-                     qCCritical(AKONADICONTROL_LOG) << "Failed to start AgentServer!";
-                 });
+@@ -69,7 +69,7 @@ public:
+         connect(this, &Akonadi::ProcessControl::unableToStart, this, []() {
+             qCCritical(AKONADICONTROL_LOG) << "Failed to start AgentServer!";
+         });
 -        start(QStringLiteral("akonadi_agent_server"), args, RestartOnCrash);
-+        start(QLatin1String(NIX_OUT "/bin/akonadi_agent_server"), args, RestartOnCrash);
++        start(QStringLiteral(NIX_OUT "/bin/akonadi_agent_server"), args, RestartOnCrash);
      }
- 
+
      ~AgentServerProcessControl() override
 diff --git a/src/akonadicontrol/agentprocessinstance.cpp b/src/akonadicontrol/agentprocessinstance.cpp
-index c98946c..aa307ca 100644
+index 8e92e08..f98dfd8 100644
 --- a/src/akonadicontrol/agentprocessinstance.cpp
 +++ b/src/akonadicontrol/agentprocessinstance.cpp
-@@ -49,7 +49,7 @@ bool AgentProcessInstance::start(const AgentType &agentInfo)
+@@ -47,7 +47,7 @@ bool AgentProcessInstance::start(const AgentType &agentInfo)
      } else {
          Q_ASSERT(agentInfo.launchMethod == AgentType::Launcher);
          const QStringList arguments = QStringList() << executable << identifier();
@@ -46,20 +46,20 @@ index c98946c..aa307ca 100644
      }
      return true;
 diff --git a/src/server/storage/dbconfigmysql.cpp b/src/server/storage/dbconfigmysql.cpp
-index d595a3a..99324f6 100644
+index 1a437ac..3550f9d 100644
 --- a/src/server/storage/dbconfigmysql.cpp
 +++ b/src/server/storage/dbconfigmysql.cpp
-@@ -69,7 +69,6 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
+@@ -72,7 +72,6 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
      // determine default settings depending on the driver
      QString defaultHostName;
      QString defaultOptions;
 -    QString defaultServerPath;
      QString defaultCleanShutdownCommand;
- 
+
  #ifndef Q_OS_WIN
-@@ -78,16 +77,7 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
+@@ -80,16 +79,7 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
  #endif
- 
+
      const bool defaultInternalServer = true;
 -#ifdef MYSQLD_EXECUTABLE
 -    if (QFile::exists(QStringLiteral(MYSQLD_EXECUTABLE))) {
@@ -75,20 +75,20 @@ index d595a3a..99324f6 100644
      if (!mysqladminPath.isEmpty()) {
  #ifndef Q_OS_WIN
          defaultCleanShutdownCommand = QStringLiteral("%1 --defaults-file=%2/mysql.conf --socket=%3/%4 shutdown")
-@@ -97,10 +87,10 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
+@@ -99,10 +89,10 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
  #endif
      }
- 
+
 -    mMysqlInstallDbPath = findExecutable(QStringLiteral("mysql_install_db"));
 +    mMysqlInstallDbPath = QLatin1String(NIXPKGS_MYSQL_MYSQL_INSTALL_DB);
      qCDebug(AKONADISERVER_LOG) << "Found mysql_install_db: " << mMysqlInstallDbPath;
- 
+
 -    mMysqlCheckPath = findExecutable(QStringLiteral("mysqlcheck"));
 +    mMysqlCheckPath = QLatin1String(NIXPKGS_MYSQL_MYSQLCHECK);
      qCDebug(AKONADISERVER_LOG) << "Found mysqlcheck: " << mMysqlCheckPath;
- 
+
      mInternalServer = settings.value(QStringLiteral("QMYSQL/StartServer"), defaultInternalServer).toBool();
-@@ -117,7 +107,7 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
+@@ -119,7 +109,7 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
      mUserName = settings.value(QStringLiteral("User")).toString();
      mPassword = settings.value(QStringLiteral("Password")).toString();
      mConnectionOptions = settings.value(QStringLiteral("Options"), defaultOptions).toString();
@@ -96,18 +96,18 @@ index d595a3a..99324f6 100644
 +    mMysqldPath = QLatin1String(NIXPKGS_MYSQL_MYSQLD);
      mCleanServerShutdownCommand = settings.value(QStringLiteral("CleanServerShutdownCommand"), defaultCleanShutdownCommand).toString();
      settings.endGroup();
- 
-@@ -127,9 +117,6 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
+
+@@ -129,9 +119,6 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
          // intentionally not namespaced as we are the only one in this db instance when using internal mode
          mDatabaseName = QStringLiteral("akonadi");
      }
 -    if (mInternalServer && (mMysqldPath.isEmpty() || !QFile::exists(mMysqldPath))) {
 -        mMysqldPath = defaultServerPath;
 -    }
- 
+
      qCDebug(AKONADISERVER_LOG) << "Using mysqld:" << mMysqldPath;
- 
-@@ -139,9 +126,6 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
+
+@@ -141,9 +128,6 @@ bool DbConfigMysql::init(QSettings &settings, bool storeSettings)
          settings.setValue(QStringLiteral("Name"), mDatabaseName);
          settings.setValue(QStringLiteral("Host"), mHostName);
          settings.setValue(QStringLiteral("Options"), mConnectionOptions);
@@ -117,20 +117,20 @@ index d595a3a..99324f6 100644
          settings.setValue(QStringLiteral("StartServer"), mInternalServer);
          settings.endGroup();
          settings.sync();
-@@ -214,7 +198,7 @@ bool DbConfigMysql::startInternalServer()
+@@ -215,7 +199,7 @@ bool DbConfigMysql::startInternalServer()
  #endif
- 
+
      // generate config file
 -    const QString globalConfig = StandardDirs::locateResourceFile("config", QStringLiteral("mysql-global.conf"));
 +    const QString globalConfig = QLatin1String(NIX_OUT "/etc/xdg/akonadi/mysql-global.conf");
-     const QString localConfig  = StandardDirs::locateResourceFile("config", QStringLiteral("mysql-local.conf"));
+     const QString localConfig = StandardDirs::locateResourceFile("config", QStringLiteral("mysql-local.conf"));
      const QString actualConfig = StandardDirs::saveDir("data") + QLatin1String("/mysql.conf");
      if (globalConfig.isEmpty()) {
 diff --git a/src/server/storage/dbconfigpostgresql.cpp b/src/server/storage/dbconfigpostgresql.cpp
-index dd273fc..05288d9 100644
+index 4df61da..e3469c4 100644
 --- a/src/server/storage/dbconfigpostgresql.cpp
 +++ b/src/server/storage/dbconfigpostgresql.cpp
-@@ -127,9 +127,7 @@ bool DbConfigPostgresql::init(QSettings &settings, bool storeSettings)
+@@ -125,9 +125,7 @@ bool DbConfigPostgresql::init(QSettings &settings, bool storeSettings)
      // determine default settings depending on the driver
      QString defaultHostName;
      QString defaultOptions;
@@ -138,10 +138,10 @@ index dd273fc..05288d9 100644
      QString defaultInitDbPath;
 -    QString defaultPgUpgradePath;
      QString defaultPgData;
- 
+
  #ifndef Q_WS_WIN // We assume that PostgreSQL is running as service on Windows
-@@ -140,12 +138,8 @@ bool DbConfigPostgresql::init(QSettings &settings, bool storeSettings)
- 
+@@ -138,12 +136,8 @@ bool DbConfigPostgresql::init(QSettings &settings, bool storeSettings)
+
      mInternalServer = settings.value(QStringLiteral("QPSQL/StartServer"), defaultInternalServer).toBool();
      if (mInternalServer) {
 -        const auto paths = postgresSearchPaths(QStringLiteral("/usr/lib/postgresql"));
@@ -153,8 +153,8 @@ index dd273fc..05288d9 100644
 -        defaultPgUpgradePath = QStandardPaths::findExecutable(QStringLiteral("pg_upgrade"), paths);
          defaultPgData = StandardDirs::saveDir("data", QStringLiteral("db_data"));
      }
- 
-@@ -164,20 +158,14 @@ bool DbConfigPostgresql::init(QSettings &settings, bool storeSettings)
+
+@@ -162,20 +156,14 @@ bool DbConfigPostgresql::init(QSettings &settings, bool storeSettings)
      mUserName = settings.value(QStringLiteral("User")).toString();
      mPassword = settings.value(QStringLiteral("Password")).toString();
      mConnectionOptions = settings.value(QStringLiteral("Options"), defaultOptions).toString();
@@ -177,7 +177,7 @@ index dd273fc..05288d9 100644
      qCDebug(AKONADISERVER_LOG) << "Found pg_upgrade:" << mPgUpgradePath;
      mPgData = settings.value(QStringLiteral("PgData"), defaultPgData).toString();
      if (mPgData.isEmpty()) {
-@@ -194,7 +182,6 @@ bool DbConfigPostgresql::init(QSettings &settings, bool storeSettings)
+@@ -192,7 +180,6 @@ bool DbConfigPostgresql::init(QSettings &settings, bool storeSettings)
              settings.setValue(QStringLiteral("Port"), mHostPort);
          }
          settings.setValue(QStringLiteral("Options"), mConnectionOptions);
@@ -185,6 +185,6 @@ index dd273fc..05288d9 100644
          settings.setValue(QStringLiteral("InitDbPath"), mInitDbPath);
          settings.setValue(QStringLiteral("StartServer"), mInternalServer);
          settings.endGroup();
--- 
-2.29.2
+--
+2.31.1
 

pkgs/applications/kde/akonadi/0002-akonadi-timestamps.patch

@@ -1,6 +1,6 @@
-From badd4be311afd37a99126c60490f1ae5daced6c4 Mon Sep 17 00:00:00 2001
+From f6c446cf6fab2edbd2606b4c6100903e9437362a Mon Sep 17 00:00:00 2001
 From: Thomas Tuegel <ttuegel@mailbox.org>
-Date: Sun, 31 Jan 2021 11:00:15 -0600
+Date: Sun, 25 Apr 2021 08:01:02 -0500
 Subject: [PATCH 2/3] akonadi timestamps
 
 ---
@@ -8,19 +8,19 @@ Subject: [PATCH 2/3] akonadi timestamps
  1 file changed, 1 insertion(+), 2 deletions(-)
 
 diff --git a/src/server/storage/dbconfigmysql.cpp b/src/server/storage/dbconfigmysql.cpp
-index 99324f6..3c170a8 100644
+index 3550f9d..e9e8887 100644
 --- a/src/server/storage/dbconfigmysql.cpp
 +++ b/src/server/storage/dbconfigmysql.cpp
-@@ -240,8 +240,7 @@ bool DbConfigMysql::startInternalServer()
+@@ -241,8 +241,7 @@ bool DbConfigMysql::startInternalServer()
      bool confUpdate = false;
      QFile actualFile(actualConfig);
      // update conf only if either global (or local) is newer than actual
--    if ((QFileInfo(globalConfig).lastModified() > QFileInfo(actualFile).lastModified()) ||
--            (QFileInfo(localConfig).lastModified()  > QFileInfo(actualFile).lastModified())) {
+-    if ((QFileInfo(globalConfig).lastModified() > QFileInfo(actualFile).lastModified())
+-        || (QFileInfo(localConfig).lastModified() > QFileInfo(actualFile).lastModified())) {
 +    if (true) {
          QFile globalFile(globalConfig);
          QFile localFile(localConfig);
          if (globalFile.open(QFile::ReadOnly) && actualFile.open(QFile::WriteOnly)) {
 -- 
-2.29.2
+2.31.1
 

pkgs/applications/kde/akonadi/0003-akonadi-revert-make-relocatable.patch

@@ -1,6 +1,6 @@
-From 82bfa975af60757374ffad787e56a981d6df0f98 Mon Sep 17 00:00:00 2001
+From 4b90a0bd4411a66bbe6ecf85ce89a60a58bee969 Mon Sep 17 00:00:00 2001
 From: Thomas Tuegel <ttuegel@mailbox.org>
-Date: Sun, 31 Jan 2021 11:01:24 -0600
+Date: Sun, 25 Apr 2021 08:01:21 -0500
 Subject: [PATCH 3/3] akonadi revert make relocatable
 
 ---
@@ -9,10 +9,10 @@ Subject: [PATCH 3/3] akonadi revert make relocatable
  2 files changed, 3 insertions(+), 6 deletions(-)
 
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 4bb5fec..35720b4 100644
+index 4e8cc81..63161b7 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -343,9 +343,6 @@ configure_package_config_file(
+@@ -368,9 +368,6 @@ configure_package_config_file(
      "${CMAKE_CURRENT_SOURCE_DIR}/KF5AkonadiConfig.cmake.in"
      "${CMAKE_CURRENT_BINARY_DIR}/KF5AkonadiConfig.cmake"
      INSTALL_DESTINATION ${CMAKECONFIG_INSTALL_DIR}
@@ -41,5 +41,5 @@ index bcf7320..1574319 100644
  # set the directories
  if(NOT AKONADI_INSTALL_DIR)
 -- 
-2.29.2
+2.31.1
 

pkgs/applications/kde/akonadi/default.nix

@@ -1,5 +1,5 @@
 {
-  mkDerivation, lib, kdepimTeam,
+  mkDerivation, lib, kdepimTeam, substituteAll,
   extra-cmake-modules, shared-mime-info, qtbase, accounts-qt,
   boost, kaccounts-integration, kcompletion, kconfigwidgets, kcrash, kdbusaddons,
   kdesignerplugin, ki18n, kiconthemes, kio, kitemmodels, kwindowsystem, mariadb, qttools,
@@ -33,8 +33,7 @@ mkDerivation {
     ''-DNIXPKGS_POSTGRES_PG_CTL=\"\"''
     ''-DNIXPKGS_POSTGRES_PG_UPGRADE=\"\"''
     ''-DNIXPKGS_POSTGRES_INITDB=\"\"''
+    ''-DNIX_OUT=\"${placeholder "out"}\"''
+    ''-I${lib.getDev kio}/include/KF5''  # Fixes: kio_version.h: No such file or directory
   ];
-  preConfigure = ''
-    NIX_CFLAGS_COMPILE+=" -DNIX_OUT=\"$out\""
-  '';
 }

pkgs/applications/kde/baloo-widgets.nix

@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules, kdoctools,
-  baloo, kconfig, kdelibs4support, kfilemetadata, ki18n, kio, kservice
+  baloo, kconfig, kfilemetadata, ki18n, kio, kservice
 }:
 
 mkDerivation {
@@ -12,7 +12,7 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   propagatedBuildInputs = [
-    baloo kconfig kdelibs4support kfilemetadata ki18n kio kservice
+    baloo kconfig kfilemetadata ki18n kio kservice
   ];
   outputs = [ "out" "dev" ];
 }

pkgs/applications/kde/default.nix

@@ -30,6 +30,9 @@ still shows most of the available features is in `./gwenview.nix`.
 }:
 
 let
+  minQtVersion = "5.15";
+  broken = lib.versionOlder libsForQt5.qtbase.version minQtVersion;
+
   mirror = "mirror://kde";
   srcs = import ./srcs.nix { inherit fetchurl mirror; };
 
@@ -45,10 +48,13 @@ let
 
         outputs = args.outputs or [ "out" ];
 
-        meta = {
-          platforms = lib.platforms.linux;
-          homepage = "http://www.kde.org";
-        } // (args.meta or {});
+        meta =
+          let meta = args.meta or {}; in
+          meta // {
+            homepage = meta.homepage or "http://www.kde.org";
+            platforms = meta.platforms or lib.platforms.linux;
+            broken = meta.broken or broken;
+          };
       });
 
   packages = self: with self;

pkgs/applications/kde/dolphin-plugins.nix

@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules, kdoctools,
-  dolphin, kdelibs4support, ki18n, kio, kxmlgui
+  dolphin, ki18n, kio, kxmlgui
 }:
 
 mkDerivation {
@@ -12,7 +12,7 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   propagatedBuildInputs = [
-    dolphin kdelibs4support ki18n kio kxmlgui
+    dolphin ki18n kio kxmlgui
   ];
   outputs = [ "out" "dev" ];
 }

pkgs/applications/kde/dolphin.nix

@@ -2,7 +2,7 @@
   mkDerivation, lib,
   extra-cmake-modules, kdoctools,
   baloo, baloo-widgets, kactivities, kbookmarks, kcmutils,
-  kcompletion, kconfig, kcoreaddons, kdelibs4support, kdbusaddons,
+  kcompletion, kconfig, kcoreaddons, kdbusaddons,
   kfilemetadata, ki18n, kiconthemes, kinit, kio, knewstuff, knotifications,
   kparts, ktexteditor, kwindowsystem, phonon, solid,
   wayland, qtbase, qtwayland
@@ -19,7 +19,7 @@ mkDerivation {
   propagatedUserEnvPkgs = [ baloo ];
   propagatedBuildInputs = [
     baloo baloo-widgets kactivities kbookmarks kcmutils kcompletion kconfig
-    kcoreaddons kdelibs4support kdbusaddons kfilemetadata ki18n kiconthemes
+    kcoreaddons kdbusaddons kfilemetadata ki18n kiconthemes
     kinit kio knewstuff knotifications kparts ktexteditor kwindowsystem
     phonon solid
     wayland qtwayland

pkgs/applications/kde/dragon.nix

@@ -2,7 +2,7 @@
   mkDerivation, lib,
   extra-cmake-modules, kdoctools,
   baloo, baloo-widgets, kactivities, kbookmarks, kcmutils,
-  kcompletion, kconfig, kcoreaddons, kdelibs4support, kdbusaddons,
+  kcompletion, kconfig, kcoreaddons, kdbusaddons,
   kfilemetadata, ki18n, kiconthemes, kinit, kio, knewstuff, knotifications,
   kparts, ktexteditor, kwindowsystem, phonon, solid, phonon-backend-gstreamer
 }:
@@ -17,7 +17,7 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   propagatedBuildInputs = [
     baloo baloo-widgets kactivities kbookmarks kcmutils kcompletion kconfig
-    kcoreaddons kdelibs4support kdbusaddons kfilemetadata ki18n kiconthemes
+    kcoreaddons kdbusaddons kfilemetadata ki18n kiconthemes
     kinit kio knewstuff knotifications kparts ktexteditor kwindowsystem
     phonon solid phonon-backend-gstreamer
   ];

pkgs/applications/kde/fetch.sh

@@ -1 +1 @@
-WGET_ARGS=( http://download.kde.org/stable/release-service/20.12.3/src -A '*.tar.xz' )
+WGET_ARGS=( http://download.kde.org/stable/release-service/21.04.0/src -A '*.tar.xz' )

pkgs/applications/kde/gwenview.nix

@@ -2,7 +2,7 @@
   mkDerivation, lib,
   extra-cmake-modules, kdoctools,
   exiv2, lcms2,
-  baloo, kactivities, kdelibs4support, kio, kipi-plugins, libkdcraw, libkipi,
+  baloo, kactivities, kio, kipi-plugins, kitemmodels, kparts, libkdcraw, libkipi,
   phonon, qtimageformats, qtsvg, qtx11extras, kinit
 }:
 
@@ -14,7 +14,8 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    baloo exiv2 kactivities kdelibs4support kio libkdcraw lcms2 libkipi phonon
+    baloo kactivities kio kitemmodels kparts libkdcraw libkipi phonon
+    exiv2 lcms2
     qtimageformats qtsvg qtx11extras
   ];
   propagatedUserEnvPkgs = [ kipi-plugins libkipi (lib.getBin kinit) ];

pkgs/applications/kde/kalarm.nix

@@ -4,7 +4,7 @@
 
   kauth, kcodecs, kcompletion, kconfig, kconfigwidgets, kdbusaddons, kdoctools,
   kguiaddons, ki18n, kiconthemes, kidletime, kjobwidgets, kcmutils,
-  kdelibs4support, kio, knotifications, knotifyconfig, kservice, kwidgetsaddons,
+  kio, knotifications, knotifyconfig, kservice, kwidgetsaddons,
   kwindowsystem, kxmlgui, phonon,
 
   kimap, akonadi, akonadi-contacts, akonadi-mime, kalarmcal, kcalendarcore, kcalutils,
@@ -25,7 +25,7 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     kauth kcodecs kcompletion kconfig kconfigwidgets kdbusaddons kdoctools
-    kguiaddons ki18n kiconthemes kidletime kjobwidgets kcmutils kdelibs4support
+    kguiaddons ki18n kiconthemes kidletime kjobwidgets kcmutils
     kio knotifications knotifyconfig kservice kwidgetsaddons kwindowsystem
     kxmlgui phonon
 

pkgs/applications/kde/kalarmcal.nix

@@ -1,7 +1,7 @@
 {
   mkDerivation, lib, kdepimTeam,
   extra-cmake-modules, kdoctools,
-  akonadi, kcalendarcore, kdelibs4support, kholidays, kidentitymanagement,
+  akonadi, kcalendarcore, kholidays, kidentitymanagement,
   kpimtextedit, kcalutils
 }:
 
@@ -13,7 +13,7 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   propagatedBuildInputs = [
-    akonadi kcalendarcore kdelibs4support kholidays kidentitymanagement kpimtextedit kcalutils
+    akonadi kcalendarcore kholidays kidentitymanagement kpimtextedit kcalutils
   ];
   outputs = [ "out" "dev" ];
 }

pkgs/applications/kde/kcachegrind.nix

@@ -1,8 +1,8 @@
 {
   mkDerivation, lib,
   extra-cmake-modules, kdoctools,
-  karchive, ki18n, kio, perl, python3, php, qttools
-  , kdbusaddons
+  karchive, ki18n, kio, perl, python3, php, qttools,
+  kdbusaddons
 }:
 
 mkDerivation {

pkgs/applications/kde/kcalutils.nix

@@ -1,7 +1,7 @@
 {
   mkDerivation, lib, kdepimTeam,
   extra-cmake-modules, kdoctools,
-  grantlee, kcalendarcore, kconfig, kontactinterface, kcoreaddons, kdelibs4support,
+  grantlee, kcalendarcore, kconfig, kontactinterface, kcoreaddons,
   kidentitymanagement, kpimtextedit,
 }:
 
@@ -13,7 +13,7 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    grantlee kcalendarcore kconfig kontactinterface kcoreaddons kdelibs4support
+    grantlee kcalendarcore kconfig kontactinterface kcoreaddons
     kidentitymanagement kpimtextedit
   ];
   outputs = [ "out" "dev" ];

pkgs/applications/kde/kdeconnect-kde.nix

@@ -21,6 +21,7 @@
 , qca-qt5
 , qtgraphicaleffects
 , qtmultimedia
+, qtquickcontrols2
 , qtx11extras
 , breeze-icons
 , sshfs
@@ -47,6 +48,7 @@ mkDerivation {
     qca-qt5
     qtgraphicaleffects
     qtmultimedia
+    qtquickcontrols2
     qtx11extras
     # otherwise buttons are blank on non-kde
     breeze-icons

pkgs/applications/kde/kdenlive/default.nix

@@ -26,6 +26,7 @@
 , phonon-backend-gstreamer
 , qtdeclarative
 , qtmultimedia
+, qtnetworkauth
 , qtquickcontrols2
 , qtscript
 , rttr
@@ -61,6 +62,7 @@ mkDerivation {
     phonon-backend-gstreamer
     qtdeclarative
     qtmultimedia
+    qtnetworkauth
     qtquickcontrols2
     qtscript
     shared-mime-info

pkgs/applications/kde/kdepim-runtime/default.nix

@@ -3,9 +3,10 @@
   extra-cmake-modules, kdoctools,
   shared-mime-info,
   akonadi, akonadi-calendar, akonadi-contacts, akonadi-mime, akonadi-notes,
-  kalarmcal, kcalutils, kcontacts, kdav, kdelibs4support, kidentitymanagement,
+  kalarmcal, kcalutils, kcontacts, kdav, kidentitymanagement,
   kimap, kldap, kmailtransport, kmbox, kmime, knotifications, knotifyconfig,
-  pimcommon, qtwebengine, libkgapi, qca-qt5, qtnetworkauth, qtspeech, qtxmlpatterns,
+  pimcommon, libkgapi, libsecret,
+  qca-qt5, qtkeychain, qtnetworkauth, qtspeech, qtwebengine, qtxmlpatterns,
 }:
 
 mkDerivation {
@@ -17,8 +18,9 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules kdoctools shared-mime-info ];
   buildInputs = [
     akonadi akonadi-calendar akonadi-contacts akonadi-mime akonadi-notes
-    kalarmcal kcalutils kcontacts kdav kdelibs4support kidentitymanagement kimap
+    kalarmcal kcalutils kcontacts kdav kidentitymanagement kimap
     kldap kmailtransport kmbox kmime knotifications knotifyconfig qtwebengine
-    pimcommon libkgapi qca-qt5 qtnetworkauth qtspeech qtxmlpatterns
+    pimcommon libkgapi libsecret
+    qca-qt5 qtkeychain qtnetworkauth qtspeech qtxmlpatterns
   ];
 }

pkgs/applications/kde/khelpcenter.nix

@@ -1,7 +1,7 @@
 {
   mkDerivation,
   extra-cmake-modules, kdoctools,
-  grantlee, kcmutils, kconfig, kcoreaddons, kdbusaddons, kdelibs4support, ki18n,
+  grantlee, kcmutils, kconfig, kcoreaddons, kdbusaddons, ki18n,
   kinit, khtml, kservice, xapian
 }:
 
@@ -9,7 +9,7 @@ mkDerivation {
   pname = "khelpcenter";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    grantlee kcmutils kconfig kcoreaddons kdbusaddons kdelibs4support khtml
+    grantlee kcmutils kconfig kcoreaddons kdbusaddons khtml
     ki18n kinit kservice xapian
   ];
 }

pkgs/applications/kde/kio-extras.nix

@@ -2,7 +2,7 @@
   mkDerivation, lib, extra-cmake-modules, kdoctools, shared-mime-info,
   exiv2, kactivities, karchive, kbookmarks, kconfig, kconfigwidgets,
   kcoreaddons, kdbusaddons, kdsoap, kguiaddons, kdnssd, kiconthemes, ki18n, kio,
-  khtml, kdelibs4support, kpty, syntax-highlighting, libmtp, libssh, openexr,
+  khtml, kpty, syntax-highlighting, libmtp, libssh, openexr,
   ilmbase, openslp, phonon, qtsvg, samba, solid, gperf
 }:
 
@@ -16,7 +16,7 @@ mkDerivation {
   buildInputs = [
     exiv2 kactivities karchive kbookmarks kconfig kconfigwidgets kcoreaddons
     kdbusaddons kdsoap kguiaddons kdnssd kiconthemes ki18n kio khtml
-    kdelibs4support kpty syntax-highlighting libmtp libssh openexr openslp
+    kpty syntax-highlighting libmtp libssh openexr openslp
     phonon qtsvg samba solid gperf
   ];
   CXXFLAGS = [ "-I${ilmbase.dev}/include/OpenEXR" ];

pkgs/applications/kde/kldap.nix

@@ -1,7 +1,7 @@
 {
   mkDerivation, lib, kdepimTeam,
   extra-cmake-modules, kdoctools,
-  cyrus_sasl, ki18n, kio, kmbox, openldap
+  cyrus_sasl, ki18n, kio, kmbox, libsecret, openldap, qtkeychain
 }:
 
 mkDerivation {
@@ -11,7 +11,7 @@ mkDerivation {
     maintainers = kdepimTeam;
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [ ki18n kio kmbox ];
+  buildInputs = [ ki18n kio kmbox libsecret qtkeychain ];
   propagatedBuildInputs = [ cyrus_sasl openldap ];
   outputs = [ "out" "dev" ];
 }

pkgs/applications/kde/kmail.nix

@@ -2,12 +2,13 @@
   mkDerivation, lib, kdepimTeam,
   extra-cmake-modules, kdoctools,
   akonadi-search, kbookmarks, kcalutils, kcmutils, kcompletion, kconfig,
-  kconfigwidgets, kcoreaddons, kdelibs4support, libkdepim,
+  kconfigwidgets, kcoreaddons, libkdepim,
   kdepim-runtime, kguiaddons, ki18n, kiconthemes, kinit, kio, kldap,
   kmail-account-wizard, kmailtransport, knotifications, knotifyconfig,
   kontactinterface, kparts, kpty, kservice, ktextwidgets, ktnef, kwallet,
   kwidgetsaddons, kwindowsystem, kxmlgui, libgravatar, libksieve, mailcommon,
-  messagelib, pim-sieve-editor, qtscript, qtwebengine, akonadi, kdepim-addons
+  messagelib, pim-sieve-editor, qtscript, qtwebengine, akonadi, kdepim-addons,
+  qtkeychain, libsecret
 }:
 
 mkDerivation {
@@ -19,12 +20,12 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     akonadi-search kbookmarks kcalutils kcmutils kcompletion kconfig
-    kconfigwidgets kcoreaddons kdelibs4support kguiaddons ki18n
+    kconfigwidgets kcoreaddons kguiaddons ki18n
     kiconthemes kinit kio kldap kmail-account-wizard kmailtransport libkdepim
     knotifications knotifyconfig kontactinterface kparts kpty kservice
     ktextwidgets ktnef kwidgetsaddons kwindowsystem kxmlgui libgravatar
     libksieve mailcommon messagelib pim-sieve-editor qtscript qtwebengine
-    kdepim-addons
+    kdepim-addons qtkeychain libsecret
   ];
   propagatedUserEnvPkgs = [ kdepim-runtime kwallet akonadi ];
 }

pkgs/applications/kde/kmailtransport.nix

@@ -3,7 +3,7 @@
   extra-cmake-modules, kdoctools,
   akonadi, akonadi-mime, cyrus_sasl, kcmutils,
   ki18n, kio, kmime, kwallet, ksmtp, libkgapi,
-  kcalendarcore, kcontacts
+  kcalendarcore, kcontacts, qtkeychain, libsecret
 }:
 
 mkDerivation {
@@ -13,7 +13,10 @@ mkDerivation {
     maintainers = kdepimTeam;
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [ akonadi kcmutils ki18n kio ksmtp libkgapi kcalendarcore kcontacts ];
+  buildInputs = [
+    akonadi kcmutils ki18n kio ksmtp libkgapi kcalendarcore kcontacts
+    qtkeychain libsecret
+  ];
   propagatedBuildInputs = [ akonadi-mime cyrus_sasl kmime kwallet ];
   outputs = [ "out" "dev" ];
 }

pkgs/applications/kde/kmix.nix

@@ -1,7 +1,7 @@
 {
   mkDerivation, lib,
   extra-cmake-modules, kdoctools,
-  kglobalaccel, kxmlgui, kcoreaddons, kdelibs4support,
+  kglobalaccel, kxmlgui, kcoreaddons,
   plasma-framework, libpulseaudio, alsaLib, libcanberra_kde
 }:
 
@@ -13,7 +13,7 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    alsaLib kglobalaccel kxmlgui kcoreaddons kdelibs4support
+    alsaLib kglobalaccel kxmlgui kcoreaddons
     libcanberra_kde libpulseaudio plasma-framework
   ];
   cmakeFlags = [ "-DKMIX_KF5_BUILD=1" ];

pkgs/applications/kde/knotes.nix

@@ -5,7 +5,6 @@
   kdbusaddons, kdnssd, kglobalaccel, kiconthemes, kitemmodels,
   kitemviews, kcmutils, knewstuff, knotifications, knotifyconfig,
   kparts, ktextwidgets, kwidgetsaddons, kwindowsystem,
-  kdelibs4support,
   grantlee, grantleetheme, qtx11extras,
   akonadi, akonadi-notes, akonadi-search, kcalutils,
   kontactinterface, libkdepim, kmime, pimcommon, kpimtextedit,
@@ -19,7 +18,7 @@ mkDerivation {
     kcompletion kconfig kconfigwidgets kcoreaddons kcrash
     kdbusaddons kdnssd kglobalaccel kiconthemes kitemmodels kitemviews
     kcmutils knewstuff knotifications knotifyconfig kparts ktextwidgets
-    kwidgetsaddons kwindowsystem kdelibs4support
+    kwidgetsaddons kwindowsystem
     grantlee grantleetheme qtx11extras
     akonadi akonadi-notes kcalutils kontactinterface
     libkdepim kmime pimcommon kpimtextedit

pkgs/applications/kde/kolourpaint.nix

@@ -2,14 +2,20 @@
 , mkDerivation
 , extra-cmake-modules
 , kdoctools
-, kdelibs4support
+, kguiaddons
+, kio
+, ktextwidgets
+, kwidgetsaddons
+, kxmlgui
 , libkexiv2
 }:
 
 mkDerivation {
   pname = "kolourpaint";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [ kdelibs4support libkexiv2 ];
+  buildInputs = [
+    kguiaddons kio ktextwidgets kwidgetsaddons kxmlgui libkexiv2
+  ];
   meta = {
     maintainers = [ lib.maintainers.fridh ];
     license = with lib.licenses; [ gpl2 ];

pkgs/applications/kde/konqueror.nix

@@ -1,16 +1,16 @@
 { lib
 , mkDerivation
 , extra-cmake-modules, kdoctools
-, kdelibs4support, kcmutils, khtml, kdesu
-, qtbase, qtwebkit, qtwebengine, qtx11extras, qtscript, qtwayland
+, kinit, kcmutils, khtml, kdesu
+, qtbase, qtwebengine, qtx11extras, qtscript, qtwayland
 }:
 
 mkDerivation {
   pname = "konqueror";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    kdelibs4support kcmutils khtml kdesu
-    qtwebkit qtwebengine qtx11extras qtscript qtwayland
+    kcmutils khtml kinit kdesu
+    qtwebengine qtx11extras qtscript qtwayland
   ];
 
   # InitialPreference values are too high and any text/html ends up

pkgs/applications/kde/konquest.nix

@@ -2,7 +2,13 @@
 , mkDerivation
 , extra-cmake-modules
 , kdoctools
-, kdelibs4support
+, kconfig
+, kcoreaddons
+, kcrash
+, kdbusaddons
+, kguiaddons
+, kxmlgui
+, kwidgetsaddons
 , libkdegames
 , qtquickcontrols
 }:
@@ -10,7 +16,11 @@
 mkDerivation {
   pname = "konquest";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [ kdelibs4support libkdegames qtquickcontrols ];
+  buildInputs = [
+    kconfig kcoreaddons kcrash kdbusaddons kguiaddons kxmlgui kwidgetsaddons
+    libkdegames
+    qtquickcontrols
+  ];
   meta = {
     license = with lib.licenses; [ gpl2 ];
     maintainers = with lib.maintainers; [ lheckemann ];

pkgs/applications/kde/konsole.nix

@@ -2,7 +2,7 @@
   mkDerivation, lib,
   extra-cmake-modules, kdoctools,
   kbookmarks, kcompletion, kconfig, kconfigwidgets, kcoreaddons, kguiaddons,
-  ki18n, kiconthemes, kinit, kdelibs4support, kio, knotifications,
+  ki18n, kiconthemes, kinit, kio, knotifications,
   knotifyconfig, kparts, kpty, kservice, ktextwidgets, kwidgetsaddons,
   kwindowsystem, kxmlgui, qtscript, knewstuff
 }:
@@ -15,7 +15,7 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    kbookmarks kcompletion kconfig kconfigwidgets kcoreaddons kdelibs4support
+    kbookmarks kcompletion kconfig kconfigwidgets kcoreaddons
     kguiaddons ki18n kiconthemes kinit kio knotifications knotifyconfig kparts kpty
     kservice ktextwidgets kwidgetsaddons kwindowsystem kxmlgui qtscript knewstuff
   ];

pkgs/applications/kde/kontactinterface.nix

@@ -12,6 +12,7 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    kiconthemes kparts kwindowsystem kxmlgui
+    kiconthemes kwindowsystem kxmlgui
   ];
+  propagatedBuildInputs = [ kparts ];
 }

pkgs/applications/kde/korganizer.nix

@@ -7,7 +7,7 @@
   akonadi-calendar, akonadi-contacts, akonadi-notes, akonadi-search,
   calendarsupport, eventviews, incidenceeditor, kcalutils,
   kholidays, kidentitymanagement, kldap, kmailtransport, kontactinterface,
-  kpimtextedit, pimcommon,
+  kparts, kpimtextedit, pimcommon,
 }:
 
 mkDerivation {
@@ -24,6 +24,6 @@ mkDerivation {
     akonadi-calendar akonadi-contacts akonadi-notes akonadi-search
     calendarsupport eventviews incidenceeditor kcalutils
     kholidays kidentitymanagement kldap kmailtransport kontactinterface
-    kpimtextedit pimcommon
+    kparts kpimtextedit pimcommon
   ];
 }

pkgs/applications/kde/krfb.nix

@@ -1,7 +1,10 @@
 {
   mkDerivation, lib,
   extra-cmake-modules, kdoctools,
-  kdelibs4support, kdnssd, libvncserver, libXtst, libXdamage, qtx11extras
+  kconfig, kcoreaddons, kcrash, kdbusaddons, kdnssd, knotifications, kwallet,
+  kwidgetsaddons, kwindowsystem, kxmlgui,
+  libvncserver, libXtst, libXdamage,
+  qtx11extras
 }:
 
 mkDerivation {
@@ -11,6 +14,11 @@ mkDerivation {
     maintainers = with lib.maintainers; [ jerith666 ];
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
-  buildInputs = [ libvncserver libXtst libXdamage qtx11extras ];
-  propagatedBuildInputs = [ kdelibs4support kdnssd ];
+  buildInputs = [
+    libvncserver libXtst libXdamage
+    kconfig kcoreaddons kcrash kdbusaddons knotifications kwallet kwidgetsaddons
+    kwindowsystem kxmlgui
+    qtx11extras
+  ];
+  propagatedBuildInputs = [ kdnssd ];
 }

pkgs/applications/kde/ktnef.nix

@@ -1,7 +1,7 @@
 {
   mkDerivation, lib, kdepimTeam,
   extra-cmake-modules, kdoctools,
-  kcalendarcore, kcalutils, kcontacts, kdelibs4support
+  kcalendarcore, kcalutils, kcontacts
 }:
 
 mkDerivation {
@@ -12,7 +12,7 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   propagatedBuildInputs = [
-    kcalendarcore kcalutils kcontacts kdelibs4support
+    kcalendarcore kcalutils kcontacts
   ];
   outputs = [ "out" "dev" ];
 }

pkgs/applications/kde/kwalletmanager.nix

@@ -7,7 +7,6 @@
 , kconfigwidgets
 , kcoreaddons
 , kdbusaddons
-, kdelibs4support
 , kwallet
 , kxmlgui
 }:
@@ -20,7 +19,7 @@ mkDerivation {
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    kauth kcmutils kconfigwidgets kcoreaddons kdbusaddons kdelibs4support
+    kauth kcmutils kconfigwidgets kcoreaddons kdbusaddons
     kwallet kxmlgui
   ];
 }

pkgs/applications/kde/libkdegames.nix

@@ -2,7 +2,6 @@
 , mkDerivation
 , extra-cmake-modules
 , kdoctools
-, kdelibs4support
 , qtdeclarative
 , kdeclarative
 , kdnssd
@@ -16,7 +15,7 @@ mkDerivation {
   pname = "libkdegames";
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
-    kdelibs4support qtdeclarative kdeclarative kdnssd knewstuff openal libsndfile
+    qtdeclarative kdeclarative kdnssd knewstuff openal libsndfile
     qtquickcontrols
   ];
   meta = {

pkgs/applications/kde/pim-sieve-editor.nix

@@ -2,7 +2,7 @@
   mkDerivation, lib, kdepimTeam,
   extra-cmake-modules, kdoctools,
   kdbusaddons, kcrash, kbookmarks, kiconthemes, kio, kpimtextedit,
-  kmailtransport, pimcommon, libksieve
+  kmailtransport, libksieve, pimcommon, qtkeychain, libsecret
 }:
 
 mkDerivation {
@@ -14,6 +14,6 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [
     kdbusaddons kcrash kbookmarks kiconthemes kio kpimtextedit kmailtransport
-    pimcommon libksieve
+    libksieve pimcommon qtkeychain libsecret
   ];
 }

pkgs/applications/misc/break-time/default.nix

@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "18p9gfp0inbnjsc7af38fghyklr7qnl2kkr25isfy9d5m8cpxqc6";
   };
 
-  cargoSha256 = "0brmgrxhspcpcarm4lvnl95dw2n96r20w736giv18xcg7d5jmgca";
+  cargoSha256 = "01y1p40vz30h2jkh37zipqvmfybgpq6wdcdglkab85jivmd1lslx";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/misc/clipcat/default.nix

@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "0rxl3ksjinw07q3p2vjqg80k3c6wx2q7pzpf2344zyfb4gkqzx1c";
   };
 
-  cargoSha256 = "1ffgvhkdj8wkhlgi0cj0njdm9ycxq2qda4b5qn8bmaygzr2zkwpd";
+  cargoSha256 = "1n4il3l59m2a6ca54vfaivzg25abf8s4w5kpd5q51p13624iz0kb";
 
   LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 

pkgs/applications/misc/effitask/default.nix

@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
   # workaround for missing Cargo.lock file https://github.com/sanpii/effitask/issues/48
   cargoPatches = [ ./cargo-lock.patch ];
 
-  cargoSha256 = "0dvmp23kny6rlv6c0mfyy3cmz1bi5wcm1mxps4z67lym5kxfd362";
+  cargoSha256 = "1a80kf95kr94l6jzxdj4i09x1342x358fqjy6119qjg3q3bj0y3p";
 
   buildInputs = [ openssl gtk3 ];
 

pkgs/applications/misc/elfx86exts/default.nix

@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "1j9ca2lyxjsrf0rsfv83xi53vj6jz5nb76xibh367brcsc26mvd6";
   };
 
-  cargoSha256 = "1dfhx40jr5llqa554wifd920mqdbm8s5fns98m6vcqdjxzan4nr2";
+  cargoSha256 = "0n3b9vdk5n32jmd7ks50d55z4dfahjincd2s1d8m9z17ip2qw2c4";
 
   meta = with lib; {
     description = "Decode x86 binaries and print out which instruction set extensions they use.";

pkgs/applications/misc/fitnesstrax/default.nix

@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
     gtk3
   ];
 
-  cargoSha256 = "1xgyyxd2kz21xan0pk7rbxiym90s7m2qrzg2ddilcszva60bxdd9";
+  cargoSha256 = "0dlnlb3hqyh98y916wvdb4rd20az73brs8hqna2lgr7kv1pd77j7";
 
   postInstall = ''
     mkdir -p $out/share/glib-2.0/schemas

pkgs/applications/misc/flavours/default.nix

@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ ]
     ++ lib.optionals stdenv.isDarwin [ libiconv ];
 
-  cargoSha256 = "sha256-cAXiAPhHdxdd8pFQ0Gq7eHO2p/Dam53gDbE583UYY/k=";
+  cargoSha256 = "sha256-I8ZH35L2CVLy6ypmdOPd8VEG/sQeGaHyT1HWNdwyZVo=";
 
   meta = with lib; {
     description = "An easy to use base16 scheme manager/builder that integrates with any workflow";

pkgs/applications/misc/girara/default.nix

@@ -12,9 +12,10 @@ stdenv.mkDerivation rec {
     sha256 = "1n3i960b458172mc3pkq7m9dn5qxry6fms3c3k06v27cjp5whsyf";
   };
 
-  nativeBuildInputs = [ meson ninja pkg-config gettext check dbus xvfb-run ];
+  nativeBuildInputs = [ meson ninja pkg-config gettext check dbus ];
   buildInputs = [ libintl libiconv json_c ];
   propagatedBuildInputs = [ glib gtk ];
+  checkInputs = [ xvfb-run ];
 
   doCheck = !stdenv.isDarwin;
 

pkgs/applications/misc/imag/default.nix

@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
 
   LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
 
-  cargoSha256 = "0n8cw70qh8g4hfwfaxwwxbrrx5hm2z037z8kdhvdpqkxljl9189x";
+  cargoSha256 = "1vnrc72g2271i2p847z30kplxmdpi60n3dzpw0s7dahg33g14ai6";
 
   checkPhase = ''
     export HOME=$TMPDIR

pkgs/applications/misc/kondo/default.nix

@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "0kl2zn6ir3w75ny25ksgxl93vlyb13gzx2795zyimqqnsrdpbbrf";
   };
 
-  cargoSha256 = "1ax81a2828z3yla1psg5xi8ild65m6zcsvx48ncz902mpzqlj92b";
+  cargoSha256 = "0sddsm0jys1bsj2bsr39lcyx8k2hzw17nlsv6aql0v82x8qbsiv4";
 
   meta = with lib; {
     description = "Save disk space by cleaning unneeded files from software projects";

pkgs/applications/misc/lscolors/default.nix

@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage rec {
     ./cargo.lock.patch
   ];
 
-  cargoSha256 = "02k23idwy0sb4lnjrwnyah3qp22zj161ilbc13p75k0hdijfaxl5";
+  cargoSha256 = "0kfm1pq22dhiw138bf7jvf7amlkal90n1hc9fq44wr4chr9b2fmx";
 
   meta = with lib; {
     description = "Rust library and tool to colorize paths using LS_COLORS";

pkgs/applications/misc/pastel/default.nix

@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "00xxrssa3gbr5w2jsqlf632jlzc0lc2rpybnbv618ndy5lxidnw0";
   };
 
-  cargoSha256 = "1ji64h0f8f2sq12cx33kymypzar9swhaj903gclf3jdwgna77326";
+  cargoSha256 = "0kkhj58q1lgsyj7hpy3sxg1jva9q51m0i7j60zfzhnjnirwcd0h8";
 
   buildInputs = lib.optional stdenv.isDarwin Security;