Merge staging-next into staging

lib/sources.nix

@@ -138,12 +138,13 @@ rec {
              in if m == null
                 then throw ("File contains no gitdir reference: " + path)
                 else
-                  let gitDir     = absolutePath (dirOf path) (lib.head m);
-                      commonDir' = if pathIsRegularFile "${gitDir}/commondir"
-                                   then lib.fileContents "${gitDir}/commondir"
-                                   else gitDir;
-                      commonDir  = absolutePath gitDir commonDir';
-                      refFile    = lib.removePrefix "${commonDir}/" "${gitDir}/${file}";
+                  let gitDir      = absolutePath (dirOf path) (lib.head m);
+                      commonDir'' = if pathIsRegularFile "${gitDir}/commondir"
+                                    then lib.fileContents "${gitDir}/commondir"
+                                    else gitDir;
+                      commonDir'  = lib.removeSuffix "/" commonDir'';
+                      commonDir   = absolutePath gitDir commonDir';
+                      refFile     = lib.removePrefix "${commonDir}/" "${gitDir}/${file}";
                   in readCommitFromFile refFile commonDir
 
            else if pathIsRegularFile fileName

nixos/modules/module-list.nix

@@ -924,6 +924,7 @@
   ./services/web-apps/selfoss.nix
   ./services/web-apps/shiori.nix
   ./services/web-apps/virtlyst.nix
+  ./services/web-apps/wiki-js.nix
   ./services/web-apps/whitebophir.nix
   ./services/web-apps/wordpress.nix
   ./services/web-apps/youtrack.nix

nixos/modules/services/web-apps/wiki-js.nix

@@ -0,0 +1,139 @@
+{ lib, pkgs, config, ... }:
+
+with lib;
+
+let
+  cfg = config.services.wiki-js;
+
+  format = pkgs.formats.json { };
+
+  configFile = format.generate "wiki-js.yml" cfg.settings;
+in {
+  options.services.wiki-js = {
+    enable = mkEnableOption "wiki-js";
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/root/wiki-js.env";
+      description = ''
+        Environment fiel to inject e.g. secrets into the configuration.
+      '';
+    };
+
+    stateDirectoryName = mkOption {
+      default = "wiki-js";
+      type = types.str;
+      description = ''
+        Name of the directory in <filename>/var/lib</filename>.
+      '';
+    };
+
+    settings = mkOption {
+      default = {};
+      type = types.submodule {
+        freeformType = format.type;
+        options = {
+          port = mkOption {
+            type = types.port;
+            default = 3000;
+            description = ''
+              TCP port the process should listen to.
+            '';
+          };
+
+          bindIP = mkOption {
+            default = "0.0.0.0";
+            type = types.str;
+            description = ''
+              IPs the service should listen to.
+            '';
+          };
+
+          db = {
+            type = mkOption {
+              default = "postgres";
+              type = types.enum [ "postgres" "mysql" "mariadb" "mssql" ];
+              description = ''
+                Database driver to use for persistence. Please note that <literal>sqlite</literal>
+                is currently not supported as the build process for it is currently not implemented
+                in <package>pkgs.wiki-js</package> and it's not recommended by upstream for
+                production use.
+              '';
+            };
+            host = mkOption {
+              type = types.str;
+              example = "/run/postgresql";
+              description = ''
+                Hostname or socket-path to connect to.
+              '';
+            };
+            db = mkOption {
+              default = "wiki";
+              type = types.str;
+              description = ''
+                Name of the database to use.
+              '';
+            };
+          };
+
+          logLevel = mkOption {
+            default = "info";
+            type = types.enum [ "error" "warn" "info" "verbose" "debug" "silly" ];
+            description = ''
+              Define how much detail is supposed to be logged at runtime.
+            '';
+          };
+
+          offline = mkEnableOption "offline mode" // {
+            description = ''
+              Disable latest file updates and enable
+              <link xlink:href="https://docs.requarks.io/install/sideload">sideloading</link>.
+            '';
+          };
+        };
+      };
+      description = ''
+        Settings to configure <package>wiki-js</package>. This directly
+        corresponds to <link xlink:href="https://docs.requarks.io/install/config">the upstream
+        configuration options</link>.
+
+        Secrets can be injected via the environment by
+        <itemizedlist>
+          <listitem><para>specifying <xref linkend="opt-services.wiki-js.environmentFile" />
+          to contain secrets</para></listitem>
+          <listitem><para>and setting sensitive values to <literal>$(ENVIRONMENT_VAR)</literal>
+          with this value defined in the environment-file.</para></listitem>
+        </itemizedlist>
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.wiki-js.settings.dataPath = "/var/lib/${cfg.stateDirectoryName}";
+    systemd.services.wiki-js = {
+      description = "A modern and powerful wiki app built on Node.js";
+      documentation = [ "https://docs.requarks.io/" ];
+      wantedBy = [ "multi-user.target" ];
+
+      path = with pkgs; [ coreutils ];
+      preStart = ''
+        ln -sf ${configFile} /var/lib/${cfg.stateDirectoryName}/config.yml
+        ln -sf ${pkgs.wiki-js}/server /var/lib/${cfg.stateDirectoryName}
+        ln -sf ${pkgs.wiki-js}/assets /var/lib/${cfg.stateDirectoryName}
+        ln -sf ${pkgs.wiki-js}/package.json /var/lib/${cfg.stateDirectoryName}/package.json
+      '';
+
+      serviceConfig = {
+        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        StateDirectory = cfg.stateDirectoryName;
+        WorkingDirectory = "/var/lib/${cfg.stateDirectoryName}";
+        DynamicUser = true;
+        PrivateTmp = true;
+        ExecStart = "${pkgs.nodejs}/bin/node ${pkgs.wiki-js}/server";
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ ma27 ];
+}

nixos/tests/all-tests.nix

@@ -426,6 +426,7 @@ in
   virtualbox = handleTestOn ["x86_64-linux"] ./virtualbox.nix {};
   vscodium = handleTest ./vscodium.nix {};
   wasabibackend = handleTest ./wasabibackend.nix {};
+  wiki-js = handleTest ./wiki-js.nix {};
   wireguard = handleTest ./wireguard {};
   wordpress = handleTest ./wordpress.nix {};
   xandikos = handleTest ./xandikos.nix {};

nixos/tests/wiki-js.nix

@@ -0,0 +1,152 @@
+import ./make-test-python.nix ({ pkgs, lib, ...} : {
+  name = "wiki-js";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ma27 ];
+  };
+
+  machine = { pkgs, ... }: {
+    virtualisation.memorySize = 2048;
+    services.wiki-js = {
+      enable = true;
+      settings.db.host = "/run/postgresql";
+      settings.db.user = "wiki-js";
+      settings.logLevel = "debug";
+    };
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = [ "wiki" ];
+      ensureUsers = [
+        { name = "wiki-js";
+          ensurePermissions."DATABASE wiki" = "ALL PRIVILEGES";
+        }
+      ];
+    };
+    systemd.services.wiki-js = {
+      requires = [ "postgresql.service" ];
+      after = [ "postgresql.service" ];
+    };
+    environment.systemPackages = with pkgs; [ jq ];
+  };
+
+  testScript = let
+    payloads.finalize = pkgs.writeText "finalize.json" (builtins.toJSON {
+      adminEmail = "webmaster@example.com";
+      adminPassword = "notapassword";
+      adminPasswordConfirm = "notapassword";
+      siteUrl = "http://localhost:3000";
+      telemetry = false;
+    });
+    payloads.login = pkgs.writeText "login.json" (builtins.toJSON [{
+      operationName = null;
+      extensions = {};
+      query = ''
+        mutation ($username: String!, $password: String!, $strategy: String!) {
+          authentication {
+            login(username: $username, password: $password, strategy: $strategy) {
+              responseResult {
+                succeeded
+                errorCode
+                slug
+                message
+                __typename
+              }
+              jwt
+              mustChangePwd
+              mustProvideTFA
+              mustSetupTFA
+              continuationToken
+              redirect
+              tfaQRImage
+              __typename
+            }
+            __typename
+          }
+        }
+      '';
+      variables = {
+        password = "notapassword";
+        strategy = "local";
+        username = "webmaster@example.com";
+      };
+    }]);
+    payloads.content = pkgs.writeText "content.json" (builtins.toJSON [{
+      extensions = {};
+      operationName = null;
+      query = ''
+        mutation ($content: String!, $description: String!, $editor: String!, $isPrivate: Boolean!, $isPublished: Boolean!, $locale: String!, $path: String!, $publishEndDate: Date, $publishStartDate: Date, $scriptCss: String, $scriptJs: String, $tags: [String]!, $title: String!) {
+          pages {
+            create(content: $content, description: $description, editor: $editor, isPrivate: $isPrivate, isPublished: $isPublished, locale: $locale, path: $path, publishEndDate: $publishEndDate, publishStartDate: $publishStartDate, scriptCss: $scriptCss, scriptJs: $scriptJs, tags: $tags, title: $title) {
+              responseResult {
+                succeeded
+                errorCode
+                slug
+                message
+                __typename
+              }
+              page {
+                id
+                updatedAt
+                __typename
+              }
+              __typename
+            }
+            __typename
+          }
+        }
+      '';
+      variables = {
+        content = "# Header\n\nHello world!";
+        description = "";
+        editor = "markdown";
+        isPrivate = false;
+        isPublished = true;
+        locale = "en";
+        path = "home";
+        publishEndDate = "";
+        publishStartDate = "";
+        scriptCss = "";
+        scriptJs = "";
+        tags = [];
+        title = "Hello world";
+      };
+    }]);
+  in ''
+    machine.start()
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_open_port(3000)
+
+    machine.succeed("curl -sSf localhost:3000")
+
+    with subtest("Setup"):
+        result = machine.succeed(
+            "set -o pipefail; curl -sSf localhost:3000/finalize -X POST -d "
+            + "@${payloads.finalize} -H 'Content-Type: application/json' "
+            + "| jq .ok | xargs echo"
+        )
+        assert result.strip() == "true", f"Expected true, got {result}"
+
+        # During the setup the service gets restarted, so we use this
+        # to check if the setup is done.
+        machine.wait_until_fails("curl -sSf localhost:3000")
+        machine.wait_until_succeeds("curl -sSf localhost:3000")
+
+    with subtest("Base functionality"):
+        auth = machine.succeed(
+            "set -o pipefail; curl -sSf localhost:3000/graphql -X POST "
+            + "-d @${payloads.login} -H 'Content-Type: application/json' "
+            + "| jq '.[0].data.authentication.login.jwt' | xargs echo"
+        ).strip()
+
+        assert auth
+
+        create = machine.succeed(
+            "set -o pipefail; curl -sSf localhost:3000/graphql -X POST "
+            + "-d @${payloads.content} -H 'Content-Type: application/json' "
+            + f"-H 'Authorization: Bearer {auth}' "
+            + "| jq '.[0].data.pages.create.responseResult.succeeded'|xargs echo"
+        )
+        assert create.strip() == "true", f"Expected true, got {create}"
+
+    machine.shutdown()
+  '';
+})

pkgs/applications/editors/zile/default.nix

@@ -1,20 +1,39 @@
-{ fetchurl, lib, stdenv, glib, libgee, pkg-config, ncurses, boehmgc, perl, help2man, vala }:
+{ lib
+, stdenv
+, fetchurl
+, boehmgc
+, glib
+, help2man
+, libgee
+, ncurses
+, perl
+, pkg-config
+, vala
+}:
 
 stdenv.mkDerivation rec {
-  name = "zile-2.6.0.90";
+  pname = "zile";
+  version = "2.6.1";
 
   src = fetchurl {
-    url = "mirror://gnu/zile/${name}.tar.gz";
-    sha256 = "1bhdwnasmqhy0hi3fqmpzr8xkw5zlqjpmf1cj42h4cg3fnamp6r3";
+    url = "mirror://gnu/zile/${pname}-${version}.tar.gz";
+    hash = "sha256-v7rN33aOORc6J0Z5JP5AmZCj6XvjYyoCl5hl+7mvAnc=";
   };
 
-  buildInputs = [ glib libgee ncurses boehmgc vala ];
-  nativeBuildInputs = [ perl pkg-config ]
-    # `help2man' wants to run Zile, which won't work when the
-    # newly-produced binary can't be run at build-time.
-    ++ lib.optional
-         (stdenv.hostPlatform == stdenv.buildPlatform)
-         help2man;
+  buildInputs = [
+    boehmgc
+    glib
+    libgee
+    ncurses
+  ];
+  nativeBuildInputs = [
+    perl
+    pkg-config
+    vala
+  ]
+  # `help2man' wants to run Zile, which won't work when the
+  # newly-produced binary can't be run at build-time.
+  ++ lib.optional (stdenv.hostPlatform == stdenv.buildPlatform) help2man;
 
   # Tests can't be run because most of them rely on the ability to
   # fiddle with the terminal.
@@ -24,33 +43,38 @@ stdenv.mkDerivation rec {
   gl_cv_func_fstatat_zero_flag="yes";
 
   meta = with lib; {
-    description = "Lightweight Emacs clone";
-
-    longDescription = ''
-      GNU Zile, which is a lightweight Emacs clone.  Zile is short
-      for Zile Is Lossy Emacs.  Zile has been written to be as
-      similar as possible to Emacs; every Emacs user should feel at
-      home.
-
-      Zile has all of Emacs's basic editing features: it is 8-bit
-      clean (though it currently lacks Unicode support), and the
-      number of editing buffers and windows is only limited by
-      available memory and screen space respectively.  Registers,
-      minibuffer completion and auto fill are available.  Function
-      and variable names are identical with Emacs's (except those
-      containing the word "emacs", which instead contain the word
-      "zile"!).
-
-      However, all of this is packed into a program which typically
-      compiles to about 130Kb.
-    '';
-
     homepage = "https://www.gnu.org/software/zile/";
+    description = "Zile Implements Lua Editors";
+    longDescription = ''
+      GNU Zile is a text editor development kit, so that you can (relatively)
+      quickly develop your own ideal text editor without reinventing the wheel
+      for many of the common algorithms and data-structures needed to do so.
 
+      It comes with an example implementation of a lightweight Emacs clone,
+      called Zemacs. Every Emacs user should feel at home with Zemacs. Zemacs is
+      aimed at small footprint systems and quick editing sessions (it starts up
+      and shuts down instantly).
+
+      More editors implemented over the Zile frameworks are forthcoming as the
+      data-structures and interfaces improve: Zz an emacs inspired editor using
+      Lua as an extension language; Zee a minimalist non-modal editor; Zi a
+      lightweight vi clone; and more...
+
+      Zile is a collection of algorithms and data-structures that currently
+      support all basic Emacs-like editing features: it is 8-bit clean (though
+      Unicode support is not ready yet), and the number of editing buffers and
+      windows is only limited by available memoryand screen space
+      respectively. Registers, minibuffer completion and auto fill are
+      available.
+
+      Zemacs implements a subset of Emacs with identical function and variable
+      names, continuing the spirit of the earlier Zile editor implemented in C.
+      GNU Zile, which is a lightweight Emacs clone.  Zile is short for Zile Is
+      Lossy Emacs.  Zile has been written to be as similar as possible to Emacs;
+      every Emacs user should feel at home.
+    '';
     license = licenses.gpl3Plus;
-
-    maintainers = with maintainers; [ pSub ];
-
+    maintainers = with maintainers; [ pSub AndersonTorres ];
     platforms = platforms.unix;
   };
 }

pkgs/applications/graphics/monado/default.nix

@@ -1,6 +1,6 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitLab
-, fetchpatch
 , writeText
 , cmake
 , doxygen
@@ -44,24 +44,16 @@
 
 stdenv.mkDerivation rec {
   pname = "monado";
-  version = "0.4.1";
+  version = "21.0.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "114aif79dqyn2qg07mkv6lzmqn15k6fdcii818rdf5g4bp7zzzgm";
+    sha256 = "07zxs96i3prjqww1f68496cl2xxqaidx32lpfyy0pn5am4c297zc";
   };
 
-  patches = [
-    # fix libsurvive autodetection, drop with the next version update
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/monado/monado/-/commit/345e9eab56e2de9e8b07cf72c2a67cf2ebd01e62.patch";
-      sha256 = "17c110an6sxc8rn7dfz30rfkbayg64w68licicwc8cqabi6cgrm3";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     doxygen

pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix

@@ -88,19 +88,19 @@ let
   fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];
 
   # Upstream source
-  version = "10.0.13";
+  version = "10.0.14";
 
   lang = "en-US";
 
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
-      sha256 = "sha256-KxJKS/ymbkAg8LjMFz3BDSupPk5cNB1pFz9fFyRTndk=";
+      sha256 = "1qgwzfdvix5gkqwapb4mki79mlfjzdlw68cq6q1qks0v138x528w";
     };
 
     i686-linux = fetchurl {
       url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
-      sha256 = "sha256-4glc2qP6AdHtWc8zW+varG30rlAXpeFyKjqDPsmiVfI=";
+      sha256 = "1f13jsk8k8b725h4wr40kfnln8fq7lfl4r992xj4rf98gcydws56";
     };
   };
 in

pkgs/applications/networking/instant-messengers/deltachat-electron/default.nix

@@ -2,12 +2,12 @@
 
 let
   pname = "deltachat-electron";
-  version = "1.15.3";
+  version = "1.15.5";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://download.delta.chat/desktop/v${version}/DeltaChat-${version}.AppImage";
-    sha256 = "sha256-cYb0uruuWpNr1jF5WZ48quBZRIVXiHr99mLPLKMOX5M=";
+    sha256 = "sha256-BTGwgC0zSr1tq/X4v/fS/12E7/mGVYQ0m+Bt6o7VL4o=";
   };
 
   appimageContents = appimageTools.extract { inherit name src; };

pkgs/applications/version-management/gitkraken/default.nix

@@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "gitkraken";
-  version = "7.5.2";
+  version = "7.5.3";
 
   src = fetchzip {
     url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-    sha256 = "0qd83licmw3p7cl04dki510nsn3kxk31s18g2xlixl8zqs3h08lp";
+    sha256 = "0vxvfq0dh6l1plqbq67gfydr8bh5w3q6d5y3bn3rdia10wa1dac6";
   };
 
   dontBuild = true;

pkgs/desktops/gnome-3/extensions/appindicator/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-appindicator";
-  version = "35";
+  version = "36";
 
   src = fetchFromGitHub {
     owner = "Ubuntu";
     repo = "gnome-shell-extension-appindicator";
     rev = "v${version}";
-    sha256 = "sha256-xVoXVVEULZZnoYEXl1x96Tjs8hOvs9/sOAUVMj9kKCo=";
+    sha256 = "1nx1lgrrp3w5z5hymb91frjdvdkk7x677my5v4jjd330ihqa02dq";
   };
 
   # This package has a Makefile, but it's used for building a zip for

pkgs/development/compilers/llvm/6/default.nix

@@ -36,6 +36,7 @@ let
 
     llvm-manpages = lowPrio (tools.llvm.override {
       enableManpages = true;
+      enableSharedLibraries = false;
       python3 = pkgs.python3;  # don't use python-boot
     });
 

pkgs/development/libraries/coordgenlibs/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "coordgenlibs";
-  version = "1.4.2";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "schrodinger";
     repo = pname;
     rev = "v${version}";
-    sha256 = "18s3y9v6x246hapxy0cy4srnll4qqzqfx003j551l5f27b2ng8fn";
+    sha256 = "sha256-lfA0y/tT64C/7NjBff4HEzIfhZ3piFBkQjX5xVbFXFc=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/python-modules/Pygments/2_5.nix

@@ -1,6 +1,7 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , docutils
 }:
 
@@ -13,6 +14,15 @@ buildPythonPackage rec {
     sha256 = "98c8aa5a9f778fcd1026a17361ddaf7330d1b7c62ae97c3bb0ae73e0b9b6b0fe";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2021-27291.patch";
+      url = "https://github.com/pygments/pygments/commit/2e7e8c4a7b318f4032493773732754e418279a14.patch";
+      sha256 = "0ap7jgkmvkkzijabsgnfrwl376cjsxa4jmzvqysrkwpjq3q4rxpa";
+      excludes = ["CHANGES"];
+    })
+  ];
+
   propagatedBuildInputs = [ docutils ];
 
   # Circular dependency with sphinx

pkgs/development/python-modules/dulwich/default.nix

@@ -13,12 +13,12 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.20.20";
+  version = "0.20.21";
   pname = "dulwich";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-QmlZuXBfrcxsgg5a3zKR1xpIq6CvzPdBFCLjMI8RX4c=";
+    sha256 = "sha256-rHZMmpuA+mGv40BNUnDFBgqlf38IexGpU5XTt287cf0=";
   };
 
   LC_ALL = "en_US.UTF-8";

pkgs/development/python-modules/hwi/default.nix

@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "hwi";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "bitcoin-core";
     repo = "HWI";
     rev = version;
-    sha256 = "0m8maxhjpfxnkry2l0x8143m1gmds8mbwyd9flnkfipxz0r0xwbr";
+    sha256 = "148m0vgwm6l8drcx6j3fjs2zpdzvslk4w2nkb8nm0g8qdlm6gjlw";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/micawber/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "micawber";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "ac2d737d8ff27ed01ea3825ed8806970e8137d7b342cef37b39b6dd17e6eb3a4";
+    sha256 = "05ef4c89e307e3031dd1d85a3a557cd7f9f900f7dbbbcb33dde454940ca38460";
   };
 
   propagatedBuildInputs = [ beautifulsoup4 ];

pkgs/development/tools/golangci-lint/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "golangci-lint";
-  version = "1.38.0";
+  version = "1.39.0";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    sha256 = "sha256-hJGyK+hrP6CuSkODNsN8d2IhteKe/fXTF9GxbF7TQOk=";
+    sha256 = "0c9yka27k4v1waijk7mn7k31l5a373sclykypflchy7xnlrsa18v";
   };
 
-  vendorSha256 = "sha256-zTWipGoWFndBSH8V+QxWmGv+8RoFa+OGT4BhAq/yIbE=";
+  vendorSha256 = "1685iv1lsal462c8xqvs76x9dwvbwazrak902j0p12s0fyb66lpl";
 
   doCheck = false;
 

pkgs/development/tools/tabnine/default.nix

@@ -1,20 +1,23 @@
 { stdenv, lib, fetchurl, unzip }:
 
 let
-  version = "3.2.63";
+  version = "3.3.101";
   src =
     if stdenv.hostPlatform.system == "x86_64-darwin" then
-      fetchurl {
-        url = "https://update.tabnine.com/bundles/${version}/x86_64-apple-darwin/TabNine.zip";
-        sha256 = "0y0wb3jdr2qk4k21c11w8c9a5fl0h2rm1wm7m8hqdywy4lz9ppgy";
-      }
+      fetchurl
+        {
+          url = "https://update.tabnine.com/bundles/${version}/x86_64-apple-darwin/TabNine.zip";
+          sha256 = "KrFDQSs7hMCioeqPKTNODe3RKnwNV8XafdYDUaxou/Y=";
+        }
     else if stdenv.hostPlatform.system == "x86_64-linux" then
-      fetchurl {
-        url = "https://update.tabnine.com/bundles/${version}/x86_64-unknown-linux-musl/TabNine.zip";
-        sha256 = "0zzk2w5azk5f0svjxlj2774x01xdflb767xxvbglj4223dgyx2x5";
-      }
+      fetchurl
+        {
+          url = "https://update.tabnine.com/bundles/${version}/x86_64-unknown-linux-musl/TabNine.zip";
+          sha256 = "vbeuZf/phOj83xTha+AzpKIvvrjwMar7q2teAmr5ESQ=";
+        }
     else throw "Not supported on ${stdenv.hostPlatform.system}";
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation rec {
   pname = "tabnine";
 
   inherit version src;

pkgs/games/20kly/default.nix

@@ -1,16 +1,19 @@
 { lib
-, fetchurl
-, python2 }:
+, fetchFromGitHub
+, python3Packages
+}:
 
-python2.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "20kly";
-  version = "1.4";
-  format = "other";
-  disabled = !(python2.isPy2 or false);
+  version = "1.5.0";
 
-  src = fetchurl {
-    url = "http://jwhitham.org.uk/20kly/lightyears-${version}.tar.bz2";
-    sha256 = "13h73cmfjqkipffimfc4iv0hf89if490ng6vd6xf3wcalpgaim5d";
+  format = "other";
+
+  src = fetchFromGitHub {
+    owner = "20kly";
+    repo = "20kly";
+    rev = "v${version}";
+    sha256 = "1zxsxg49a02k7zidx3kgk2maa0vv0n1f9wrl5vch07sq3ghvpphx";
   };
 
   patchPhase = ''
@@ -20,21 +23,24 @@ python2.pkgs.buildPythonApplication rec {
         "LIGHTYEARS_DIR = \"$out/share\""
   '';
 
-  propagatedBuildInputs = with python2.pkgs; [ pygame ];
+  propagatedBuildInputs = with python3Packages; [
+    pygame
+  ];
 
-  buildPhase = "python -O -m compileall .";
+  buildPhase = ''
+    python -O -m compileall .
+  '';
 
   installPhase = ''
     mkdir -p "$out/share"
-    cp -r audio code data lightyears "$out/share"
+    cp -r data lib20k lightyears "$out/share"
     install -Dm755 lightyears "$out/bin/lightyears"
   '';
 
   meta = with lib; {
     description = "A steampunk-themed strategy game where you have to manage a steam supply network";
     homepage = "http://jwhitham.org.uk/20kly/";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     maintainers = with maintainers; [ fgaz ];
   };
 }
-

pkgs/misc/emulators/wine/default.nix

@@ -44,7 +44,7 @@
   sdlSupport ? false,
   faudioSupport ? false,
   vkd3dSupport ? false,
-  mingwSupport ? false,
+  mingwSupport ? wineRelease != "stable",
 }:
 
 let wine-build = build: release:

pkgs/misc/emulators/wine/sources.nix

@@ -44,9 +44,9 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the SHA256 for staging as well.
-    version = "6.3";
+    version = "6.4";
     url = "https://dl.winehq.org/wine/source/6.x/wine-${version}.tar.xz";
-    sha256 = "sha256-aCp3wf0S9WNHyiCA2F/hfe8bZV0yQdlFgvh1kdnQzDs=";
+    sha256 = "sha256-Gy0rRT2Q1sLXEk5H+urlDlxUwl9pvuHQZTGEMmECTI8=";
     inherit (stable) mono gecko32 gecko64;
 
     patches = [
@@ -58,7 +58,7 @@ in rec {
   staging = fetchFromGitHub rec {
     # https://github.com/wine-staging/wine-staging/releases
     inherit (unstable) version;
-    sha256 = "sha256-Fok0jdGBQtH84PL6LVnuCR7ZVSUIHECqPUI/2lLXs44=";
+    sha256 = "sha256-gTt75rRoP/HTeD5k/8bW3jjnn8M5atmP9RFqmBQaAfk=";
     owner = "wine-staging";
     repo = "wine-staging";
     rev = "v${version}";

pkgs/misc/vscode-extensions/terraform/default.nix

@@ -3,13 +3,13 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "terraform";
     publisher = "hashicorp";
-    version = "2.8.3";
+    version = "2.9.1";
   };
 
   vsix = fetchurl {
     name = "${mktplcRef.publisher}-${mktplcRef.name}.zip";
     url = "https://github.com/hashicorp/vscode-terraform/releases/download/v${mktplcRef.version}/terraform-${mktplcRef.version}.vsix";
-    sha256 = "1cng82q9079qmn5q71h9knh9qzhqrl3phaamkqfjy1jallgi43b1";
+    sha256 = "1i4pzxw57hf2g7x62hfsb588b1lz3zjjh8ny96qqrif2bj2h887z";
   };
 
   patches = [ ./fix-terraform-ls.patch ];

pkgs/misc/vscode-extensions/terraform/fix-terraform-ls.patch

@@ -1,25 +1,38 @@
 diff --git a/out/extension.js b/out/extension.js
-index 4a2c6a9..158fe28 100644
+index e44cef2..fba0899 100644
 --- a/out/extension.js
 +++ b/out/extension.js
-@@ -215,19 +215,7 @@ function pathToBinary() {
-         if (!_pathToBinaryPromise) {
-             let command = vscodeUtils_1.config('terraform').get('languageServer.pathToBinary');
-             if (!command) { // Skip install/upgrade if user has set custom binary path
--                const installDir = `${extensionPath}/lsp`;
--                const installer = new languageServerInstaller_1.LanguageServerInstaller(reporter);
+@@ -141,24 +141,6 @@ function updateLanguageServer() {
+     return __awaiter(this, void 0, void 0, function* () {
+         const delay = 1000 * 60 * 24;
+         setTimeout(updateLanguageServer, delay); // check for new updates every 24hrs
+-        // skip install if a language server binary path is set
+-        if (!vscodeUtils_1.config('terraform').get('languageServer.pathToBinary')) {
+-            const installer = new languageServerInstaller_1.LanguageServerInstaller(installPath, reporter);
+-            const install = yield installer.needsInstall();
+-            if (install) {
+-                yield stopClients();
 -                try {
--                    yield installer.install(installDir);
+-                    yield installer.install();
 -                }
 -                catch (err) {
 -                    reporter.sendTelemetryException(err);
 -                    throw err;
 -                }
 -                finally {
--                    yield installer.cleanupZips(installDir);
+-                    yield installer.cleanupZips();
 -                }
--                command = `${installDir}/terraform-ls`;
-+                command = 'TERRAFORM-LS-PATH';
+-            }
+-        }
+         return startClients(); // on repeat runs with no install, this will be a no-op
+     });
+ }
+@@ -256,7 +238,7 @@ function pathToBinary() {
+                 reporter.sendTelemetryEvent('usePathToBinary');
              }
              else {
-                 reporter.sendTelemetryEvent('usePathToBinary');
+-                command = path.join(installPath, 'terraform-ls');
++                command = 'TERRAFORM-LS-PATH';
+             }
+             _pathToBinaryPromise = Promise.resolve(command);
+         }

pkgs/servers/fishnet/assets.nix

@@ -9,13 +9,13 @@
 # again so that a selection of them can be embedded into the fishnet binary.
 stdenv.mkDerivation rec {
   pname = "fishnet-assets";
-  version = "unstable-2020-01-30";
+  version = "unstable-2020-03-27";
 
   src = fetchFromGitHub {
     owner = "niklasf";
     repo = pname;
-    rev = "acd36ab6ccee67a652b6d84aedc4c2828abac5c6";
-    sha256 = "0mh4gh6qij70clp64m4jw6q7dafr7gwjqpvpaf9vc6h10g1rhzrx";
+    rev = "a1fe3ec6074ad9dc43e6d46e0d42fab5d7cce12c";
+    sha256 = "1548wj2bs89b5w42z3c98hpnbln5w8p1909wyl7a63d8vkvnyn5l";
   };
 
   relAssetsPath = "share/${pname}";

pkgs/servers/fishnet/default.nix

@@ -12,22 +12,24 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "fishnet";
-  version = "2.2.5";
+  version = "2.2.6";
 
   src = fetchFromGitHub {
     owner = "niklasf";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0gif9wagm9bzq7j3biasqvzp9lfvmxqr5wagqqybmhbn8ipj20a8";
+    sha256 = "0dmc58wzv758b82pjpfzcfi0hr14hqcr61cd9v5xlgk5w78cisjq";
   };
 
-  cargoSha256 = "0hqyh0nzfrm7m34kqixrlbc7w8d0k7v6psw8jg6zpwpfcmhqq15j";
+  cargoSha256 = "08v969b0kvsg4dq3xsb159pr52a0vqr34g48j8nvq13979yq6d8p";
 
   preBuild = ''
     rmdir ./assets
     ln -snf ${assets}/${assets.relAssetsPath} ./assets
   '';
 
+  passthru.assets = assets;
+
   meta = with lib; {
     description = "Distributed Stockfish analysis for lichess.org";
     homepage = "https://github.com/niklasf/fishnet";

pkgs/servers/mail/spamassassin/default.nix

@@ -2,11 +2,11 @@
 
 perlPackages.buildPerlPackage rec {
   pname = "SpamAssassin";
-  version = "3.4.4";
+  version = "3.4.5";
 
   src = fetchurl {
     url = "mirror://apache/spamassassin/source/Mail-${pname}-${version}.tar.bz2";
-    sha256 = "0ga5mi2nv2v91kakk9xakkg71rnxnddlzv76ca13vfyd4jgcfasf";
+    sha256 = "0qsl18p2swdbq4zizvs9ahl2bkilpcyzq817lk16jj5g4rqzivb7";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/servers/web-apps/wiki-js/default.nix

@@ -0,0 +1,32 @@
+{ stdenv, fetchurl, lib, nixosTests }:
+
+stdenv.mkDerivation rec {
+  pname = "wiki-js";
+  version = "2.5.197";
+
+  src = fetchurl {
+    url = "https://github.com/Requarks/wiki/releases/download/${version}/${pname}.tar.gz";
+    sha256 = "sha256-0xM9BtQvSt5WkbKBri+KxB+Ghc4wgY8/TUgI6PCFmm0=";
+  };
+
+  sourceRoot = ".";
+
+  dontBuild = true;
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp -r . $out
+
+    runHook postInstall
+  '';
+
+  passthru.tests = { inherit (nixosTests) wiki-js; };
+
+  meta = with lib; {
+    homepage = "https://js.wiki/";
+    description = "A modern and powerful wiki app built on Node.js";
+    license = licenses.agpl3Only;
+    maintainers = with maintainers; [ ma27 ];
+  };
+}

pkgs/shells/oil/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "oil";
-  version = "0.8.7";
+  version = "0.8.8";
 
   src = fetchurl {
     url = "https://www.oilshell.org/download/oil-${version}.tar.xz";
-    sha256 = "sha256-KcXu1u/MvvbCLb5a7D09NvfJPaeo0c8Z/Czuk7XR23M=";
+    sha256 = "sha256-J9aNuw72qufoVY6VnbdpCtpcI6GAI7ON10XGEJuqieI=";
   };
 
   postPatch = ''

pkgs/tools/misc/chezmoi/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "chezmoi";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     rev = "v${version}";
-    sha256 = "sha256-kOxA9FtVfS1lFSsV5E1+eGQF7D9C7TzhzLGw2r7LlOY=";
+    sha256 = "sha256-jvit6Z0SwxjDmpEqojmPUJ3TVmVmW3RC+3tfvG1ev4Q=";
   };
 
   vendorSha256 = "sha256-V05cCKQeqw6BEjLIYDeHeDePkA7rs7kjqPCys5eLefA=";

pkgs/tools/misc/miniserve/default.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "miniserve";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "svenstaro";
     repo = "miniserve";
     rev = "v${version}";
-    sha256 = "sha256-hTNwEspM1qlQkC6lD7N947tvS7O7RCIUYACvj4KYsAY=";
+    sha256 = "sha256-1LyDwQWC8cb3Sq8lZ9eDpZMcu5/yh0BJFuOWQ3iTtpY=";
   };
 
-  cargoSha256 = "sha256-7G+h+g00T/aJ1cQ1SChxy8dq3CWWdHlx5DAH77xM9Oc=";
+  cargoSha256 = "sha256-11aP0/p9wC9o1KuM+CLAuHhZxuYff6nvJPj0/yjb1+E=";
 
   nativeBuildInputs = [ pkg-config zlib ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];

pkgs/tools/networking/croc/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "croc";
-  version = "8.6.11";
+  version = "8.6.12";
 
   src = fetchFromGitHub {
     owner = "schollz";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-+ej6Q2XczWVcu7lMRjt+Sj2FZxlfFSepE6crCFgPuoc=";
+    sha256 = "sha256-Oad0JpeeCpIHfH9e1pTKtrnvZ+eFx3dR5GP6g6piFS0=";
   };
 
-  vendorSha256 = "sha256-50ESG3GL9BcTaGp1Q5rc1XklF3H7WKcyM1yq7SZa2QE=";
+  vendorSha256 = "sha256-LYMZFaCNlJg+9Hoh2VbY6tMHv6oT7r+JHBcQYpOceRQ=";
 
   doCheck = false;
 

pkgs/tools/security/cosign/default.nix

@@ -0,0 +1,25 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "cosign";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "sigstore";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0rgq29vi0h378j0bqs53gjgp246rqxfpk6rwskzrmawgry0zr8pk";
+  };
+
+  vendorSha256 = "0pcp3wdvwq06ajdfbgadyq0ipfj65n276hj88p5v6wqfn821ahd6";
+
+  subPackages = [ "cmd/cosign" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/sigstore/cosign";
+    changelog = "https://github.com/sigstore/cosign/releases/tag/v${version}";
+    description = "Container Signing CLI with support for ephemeral keys and Sigstore signing";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ lesuisse ];
+  };
+}

pkgs/tools/security/grype/default.nix

@@ -1,7 +1,7 @@
-{ buildGoModule
+{ lib
+, buildGoModule
 , docker
 , fetchFromGitHub
-, lib
 }:
 
 buildGoModule rec {
@@ -19,7 +19,11 @@ buildGoModule rec {
 
   propagatedBuildInputs = [ docker ];
 
-  # tests require a running Docker instance
+  preBuild = ''
+    buildFlagsArray+=("-ldflags" "-s -w -X github.com/anchore/grype/internal/version.version=${version}")
+  '';
+
+  # Tests require a running Docker instance
   doCheck = false;
 
   meta = with lib; {

pkgs/top-level/all-packages.nix

@@ -1237,6 +1237,8 @@ in
 
   corsmisc = callPackage ../tools/security/corsmisc { };
 
+  cosign = callPackage ../tools/security/cosign { };
+
   cozy = callPackage ../applications/audio/cozy-audiobooks { };
 
   cpuid = callPackage ../os-specific/linux/cpuid { };
@@ -30078,6 +30080,8 @@ in
     pythonPackages = python3Packages;
   };
 
+  wiki-js = callPackage ../servers/web-apps/wiki-js { };
+
   winePackagesFor = wineBuild: lib.makeExtensible (self: with self; {
     callPackage = newScope self;