Merge master into haskell-updates

2024-11-17 23:36:17 +01:00 · 2022-05-14 00:16:31 +00:00 · 2022-05-14 00:16:31 +00:00 · c560c27d5f
commit c560c27d5f
parent 2d056a8d99 ed014c27f4
270 changed files with 5445 additions and 2122 deletions
--- a/doc/languages-frameworks/coq.section.md
+++ b/doc/languages-frameworks/coq.section.md
@ -29,19 +29,14 @@ The recommended way of defining a derivation for a Coq library, is to use the `c
 * `releaseRev` (optional, defaults to `(v: v)`), provides a default mapping from release names to revision hashes/branch names/tags,
 * `displayVersion` (optional), provides a way to alter the computation of `name` from `pname`, by explaining how to display version numbers,
 * `namePrefix` (optional, defaults to `[ "coq" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
-* `nativeBuildInputs` (optional), is a list of executables that are required to build the current derivation, in addition to the default ones (namely `which`, `dune` and `ocaml` depending on whether `useDune2`, `useDune2ifVersion` and `mlPlugin` are set).
-* `extraNativeBuildInputs` (optional, deprecated), an additional list of derivation to add to `nativeBuildInputs`,
-* `overrideNativeBuildInputs` (optional) replaces the default list of derivation to which `nativeBuildInputs` and `extraNativeBuildInputs` adds extra elements,
-* `buildInputs` (optional), is a list of libraries and dependencies that are required to build and run the current derivation, in addition to the default one `[ coq ]`,
-* `extraBuildInputs` (optional, deprecated), an additional list of derivation to add to `buildInputs`,
-* `overrideBuildInputs` (optional) replaces the default list of derivation to which `buildInputs` and `extraBuildInputs` adds extras elements,
-* `propagatedBuildInputs` (optional) is passed as is to `mkDerivation`, we recommend to use this for Coq libraries and Coq plugin dependencies, as this makes sure the paths of the compiled libraries and plugins will always be added to the build environements of subsequent derivation, which is necessary for Coq packages to work correctly,
-* `mlPlugin` (optional, defaults to `false`). Some extensions (plugins) might require OCaml and sometimes other OCaml packages. Standard dependencies can be added by setting the current option to `true`. For a finer grain control, the `coq.ocamlPackages` attribute can be used in `nativeBuildInputs`, `buildInputs`, and `propagatedBuildInputs` to depend on the same package set Coq was built against.
-* `useDune2ifVersion` (optional, default to `(x: false)` uses Dune2 to build the package if the provided predicate evaluates to true on the version, e.g. `useDune2ifVersion = versions.isGe "1.1"`  will use dune if the version of the package is greater or equal to `"1.1"`,
+* `extraNativeBuildInputs` (optional), by default `nativeBuildInputs` just contains `coq`, this allows to add more native build inputs, `nativeBuildInputs` are executables and `buildInputs` are libraries and dependencies,
+* `extraBuildInputs` (optional), this allows to add more build inputs,
+* `mlPlugin` (optional, defaults to `false`). Some extensions (plugins) might require OCaml and sometimes other OCaml packages. Standard dependencies can be added by setting the current option to `true`. For a finer grain control, the `coq.ocamlPackages` attribute can be used in `extraBuildInputs` to depend on the same package set Coq was built against.
+* `useDune2ifVersion` (optional, default to `(x: false)` uses Dune2 to build the package if the provided predicate evaluates to true on the version, e.g. `useDune2if = versions.isGe "1.1"`  will use dune if the version of the package is greater or equal to `"1.1"`,
 * `useDune2` (optional, defaults to `false`) uses Dune2 to build the package if set to true, the presence of this attribute overrides the behavior of the previous one.
 * `opam-name` (optional, defaults to concatenating with a dash separator the components of `namePrefix` and `pname`), name of the Dune package to build.
 * `enableParallelBuilding` (optional, defaults to `true`), since it is activated by default, we provide a way to disable it.
-* `extraInstallFlags` (optional), allows to extend `installFlags` which initializes the variables `DESTDIR` and `COQMF_COQLIB` so as to install in the proper subdirectory. Indeed Coq libraries should be installed in `$(out)/lib/coq/${coq.coq-version}/user-contrib/`. Such directories are automatically added to the `$COQPATH` environment variable by the hook defined in the Coq derivation.
+* `extraInstallFlags` (optional), allows to extend `installFlags` which initializes the variable `COQMF_COQLIB` so as to install in the proper subdirectory. Indeed Coq libraries should be installed in `$(out)/lib/coq/${coq.coq-version}/user-contrib/`. Such directories are automatically added to the `$COQPATH` environment variable by the hook defined in the Coq derivation.
 * `setCOQBIN` (optional, defaults to `true`), by default, the environment variable `$COQBIN` is set to the current Coq's binary, but one can disable this behavior by setting it to `false`,
 * `useMelquiondRemake` (optional, default to `null`) is an attribute set, which, if given, overloads the `preConfigurePhases`, `configureFlags`, `buildPhase`, and `installPhase` attributes of the derivation for a specific use in libraries using `remake` as set up by Guillaume Melquiond for `flocq`, `gappalib`, `interval`, and `coquelicot` (see the corresponding derivation for concrete examples of use of this option). For backward compatibility, the attribute `useMelquiondRemake.logpath` must be set to the logical root of the library (otherwise, one can pass `useMelquiondRemake = {}` to activate this without backward compatibility).
 * `dropAttrs`, `keepAttrs`, `dropDerivationAttrs` are all optional and allow to tune which attribute is added or removed from the final call to `mkDerivation`.
--- a/maintainers/scripts/haskell/hydra-report.hs
+++ b/maintainers/scripts/haskell/hydra-report.hs
@ -1,6 +1,6 @@
 #! /usr/bin/env nix-shell
 #! nix-shell -p "haskellPackages.ghcWithPackages (p: [p.aeson p.req])"
-#! nix-shell -p hydra-unstable
+#! nix-shell -p hydra_unstable
 #! nix-shell -i runhaskell

 {-
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -331,6 +331,14 @@
          <link linkend="opt-services.tetrd.enable">services.tetrd</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://upterm.dev">uptermd</link>, an
+          open-source solution for sharing terminal sessions instantly
+          over the public internet via secure tunnels. Available at
+          <link linkend="opt-services.uptermd.enable">services.uptermd</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <link xlink:href="https://github.com/mbrubeck/agate">agate</link>,
@ -1879,6 +1887,37 @@
          during the time when the timer was inactive.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          Mastodon now uses <literal>services.redis.servers</literal> to
+          start a new redis server, instead of using a global redis
+          server. This improves compatibility with other services that
+          use redis.
+        </para>
+        <para>
+          Note that this will recreate the redis database, although
+          according to the
+          <link xlink:href="https://docs.joinmastodon.org/admin/backups/">Mastodon
+          docs</link>, this is almost harmless:
+        </para>
+        <blockquote>
+          <para>
+            Losing the Redis database is almost harmless: The only
+            irrecoverable data will be the contents of the Sidekiq
+            queues and scheduled retries of previously failed jobs. The
+            home and list feeds are stored in Redis, but can be
+            regenerated with tootctl.
+          </para>
+        </blockquote>
+        <para>
+          If you do want to save the redis database, you can use the
+          following commands:
+        </para>
+        <programlisting language="bash">
+redis-cli save
+cp /var/lib/redis/dump.rdb &quot;/var/lib/redis-mastodon/dump.rdb&quot;
+</programlisting>
+      </listitem>
      <listitem>
        <para>
          If you are using Wayland you can choose to use the Ozone
@ -2413,6 +2452,14 @@
          desktop environments as needed.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>mercury</literal> was updated to 22.01.1, which has
+          some breaking changes
+          (<link xlink:href="https://dl.mercurylang.org/release/release-notes-22.01.html">Mercury
+          22.01 news</link>).
+        </para>
+      </listitem>
      <listitem>
        <para>
          xfsprogs was update to version 5.15, which enables inobtcount
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -101,6 +101,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [tetrd](https://tetrd.app), share your internet connection from your device to your PC and vice versa through a USB cable. Available at [services.tetrd](#opt-services.tetrd.enable).

+- [uptermd](https://upterm.dev), an open-source solution for sharing terminal sessions instantly over the public internet via secure tunnels. Available at [services.uptermd](#opt-services.uptermd.enable).
+
 - [agate](https://github.com/mbrubeck/agate), a very simple server for the Gemini hypertext protocol. Available as [services.agate](options.html#opt-services.agate.enable).

 - [ArchiSteamFarm](https://github.com/JustArchiNET/ArchiSteamFarm), a C# application with primary purpose of idling Steam cards from multiple accounts simultaneously. Available as [services.archisteamfarm](options.html#opt-services.archisteamfarm.enable).
@ -699,6 +701,20 @@ In addition to numerous new and upgraded packages, this release has the followin
  By default auto-upgrade will now run immediately if it would have been triggered at least
  once during the time when the timer was inactive.

+- Mastodon now uses `services.redis.servers` to start a new redis server, instead of using a global redis server. 
+  This improves compatibility with other services that use redis.
+  
+  Note that this will recreate the redis database, although according to the [Mastodon docs](https://docs.joinmastodon.org/admin/backups/), 
+  this is almost harmless:
+  > Losing the Redis database is almost harmless: The only irrecoverable data will be the contents of the Sidekiq queues and scheduled retries of previously failed jobs. 
+  >  The home and list feeds are stored in Redis, but can be regenerated with tootctl.
+  
+  If you do want to save the redis database, you can use the following commands:
+  ```bash
+  redis-cli save
+  cp /var/lib/redis/dump.rdb "/var/lib/redis-mastodon/dump.rdb"
+  ```
+
 - If you are using Wayland you can choose to use the Ozone Wayland support
  in Chrome and several Electron apps by setting the environment variable
  `NIXOS_OZONE_WL=1` (for example via
@ -860,6 +876,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The polkit service, available at `security.polkit.enable`, is now disabled by default. It will automatically be enabled through services and desktop environments as needed.

+- `mercury` was updated to 22.01.1, which has some breaking changes ([Mercury 22.01 news](https://dl.mercurylang.org/release/release-notes-22.01.html)).
+
 - xfsprogs was update to version 5.15, which enables inobtcount and bigtime by default on filesystem creation. Support for these features was added in kernel 5.10 and deemed stable in kernel 5.15.
  If you want to be able to mount XFS filesystems created with this release of xfsprogs on kernel releases older than 5.10, you need to format them with `mkfs.xfs -m bigtime=0 -m inobtcount=0`.

--- a/nixos/modules/hardware/all-firmware.nix
+++ b/nixos/modules/hardware/all-firmware.nix
@ -83,7 +83,6 @@ in {
        broadcom-bt-firmware
        b43Firmware_5_1_138
        b43Firmware_6_30_163_46
-        b43FirmwareCutter
        xow_dongle-firmware
      ] ++ optionals pkgs.stdenv.hostPlatform.isx86 [
        facetimehd-calibration
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@ -369,10 +369,10 @@ let
    ${lib.optionalString (refindBinary != null) ''
    # GRUB apparently cannot do "chainloader" operations on "CD".
    if [ "\$root" != "cd0" ]; then
-      # Force root to be the FAT partition
-      # Otherwise it breaks rEFInd's boot
-      search --set=root --no-floppy --fs-uuid 1234-5678
      menuentry 'rEFInd' --class refind {
+        # Force root to be the FAT partition
+        # Otherwise it breaks rEFInd's boot
+        search --set=root --no-floppy --fs-uuid 1234-5678
        chainloader (\$root)/EFI/boot/${refindBinary}
      }
    fi
@ -400,10 +400,8 @@ let
    #   dates (cp -p, touch, mcopy -m, faketime for label), IDs (mkfs.vfat -i)
    ''
      mkdir ./contents && cd ./contents
-      cp -rp "${efiDir}"/EFI .
-      mkdir ./boot
-      cp -p "${config.boot.kernelPackages.kernel}/${config.system.boot.loader.kernelFile}" \
-        "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}" ./boot/
+      mkdir -p ./EFI/boot
+      cp -rp "${efiDir}"/EFI/boot/{grub.cfg,*.efi} ./EFI/boot

      # Rewrite dates for everything in the FS
      find . -exec touch --date=2000-01-01 {} +
@ -421,11 +419,11 @@ let
      faketime "2000-01-01 00:00:00" mkfs.vfat -i 12345678 -n EFIBOOT "$out"

      # Force a fixed order in mcopy for better determinism, and avoid file globbing
-      for d in $(find EFI boot -type d | sort); do
+      for d in $(find EFI -type d | sort); do
        faketime "2000-01-01 00:00:00" mmd -i "$out" "::/$d"
      done

-      for f in $(find EFI boot -type f | sort); do
+      for f in $(find EFI -type f | sort); do
        mcopy -pvm -i "$out" "$f" "::/$f"
      done

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -937,6 +937,7 @@
  ./services/networking/unifi.nix
  ./services/video/unifi-video.nix
  ./services/video/rtsp-simple-server.nix
+  ./services/networking/uptermd.nix
  ./services/networking/v2ray.nix
  ./services/networking/vsftpd.nix
  ./services/networking/wasabibackend.nix
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@ -99,8 +99,8 @@ in

      package = mkOption {
        type = types.package;
-        default = pkgs.hydra-unstable;
-        defaultText = literalExpression "pkgs.hydra-unstable";
+        default = pkgs.hydra_unstable;
+        defaultText = literalExpression "pkgs.hydra_unstable";
        description = "The Hydra package.";
      };

--- a/nixos/modules/services/hardware/udev.nix
+++ b/nixos/modules/services/hardware/udev.nix
@ -171,6 +171,11 @@ let
      mv etc/udev/hwdb.bin $out
    '';

+  compressFirmware = if config.boot.kernelPackages.kernelAtLeast "5.3" then
+    pkgs.compressFirmwareXz
+  else
+    id;
+
  # Udev has a 512-character limit for ENV{PATH}, so create a symlink
  # tree to work around this.
  udevPath = pkgs.buildEnv {
@ -267,7 +272,7 @@ in
      '';
      apply = list: pkgs.buildEnv {
        name = "firmware";
-        paths = list;
+        paths = map compressFirmware list;
        pathsToLink = [ "/lib/firmware" ];
        ignoreCollisions = true;
      };
--- a/nixos/modules/services/networking/uptermd.nix
+++ b/nixos/modules/services/networking/uptermd.nix
@ -0,0 +1,106 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.uptermd;
+in
+{
+  options = {
+    services.uptermd = {
+      enable = mkEnableOption "uptermd";
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open the firewall for the port in <option>services.uptermd.port</option>.
+        '';
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 2222;
+        description = ''
+          Port the server will listen on.
+        '';
+      };
+
+      listenAddress = mkOption {
+        type = types.str;
+        default = "[::]";
+        example = "127.0.0.1";
+        description = ''
+          Address the server will listen on.
+        '';
+      };
+
+      hostKey = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/run/keys/upterm_host_ed25519_key";
+        description = ''
+          Path to SSH host key. If not defined, an ed25519 keypair is generated automatically.
+        '';
+      };
+
+      extraFlags = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        example = [ "--debug" ];
+        description = ''
+          Extra flags passed to the uptermd command.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+
+    systemd.services.uptermd = {
+      description = "Upterm Daemon";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      path = [ pkgs.openssh ];
+
+      preStart = mkIf (cfg.hostKey == null) ''
+        if ! [ -f ssh_host_ed25519_key ]; then
+          ssh-keygen \
+            -t ed25519 \
+            -f ssh_host_ed25519_key \
+            -N ""
+        fi
+      '';
+
+      serviceConfig = {
+        StateDirectory = "uptermd";
+        WorkingDirectory = "/var/lib/uptermd";
+        ExecStart = "${pkgs.upterm}/bin/uptermd --ssh-addr ${cfg.listenAddress}:${toString cfg.port} --private-key ${if cfg.hostKey == null then "ssh_host_ed25519_key" else cfg.hostKey} ${concatStringsSep " " cfg.extraFlags}";
+
+        # Hardening
+        AmbientCapabilities = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+        CapabilityBoundingSet = mkIf (cfg.port < 1024) [ "CAP_NET_BIND_SERVICE" ];
+        PrivateUsers = cfg.port >= 1024;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "@system-service";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/web-apps/atlassian/confluence.nix
+++ b/nixos/modules/services/web-apps/atlassian/confluence.nix
@ -189,6 +189,8 @@ in
        User = cfg.user;
        Group = cfg.group;
        PrivateTmp = true;
+        Restart = "on-failure";
+        RestartSec = "10";
        ExecStart = "${pkg}/bin/start-confluence.sh -fg";
        ExecStop = "${pkg}/bin/stop-confluence.sh";
      };
--- a/nixos/modules/services/web-apps/atlassian/crowd.nix
+++ b/nixos/modules/services/web-apps/atlassian/crowd.nix
@ -157,6 +157,8 @@ in
        User = cfg.user;
        Group = cfg.group;
        PrivateTmp = true;
+        Restart = "on-failure";
+        RestartSec = "10";
        ExecStart = "${pkg}/start_crowd.sh -fg";
      };
    };
--- a/nixos/modules/services/web-apps/atlassian/jira.nix
+++ b/nixos/modules/services/web-apps/atlassian/jira.nix
@ -197,6 +197,8 @@ in
        User = cfg.user;
        Group = cfg.group;
        PrivateTmp = true;
+        Restart = "on-failure";
+        RestartSec = "10";
        ExecStart = "${pkg}/bin/start-jira.sh -fg";
        ExecStop = "${pkg}/bin/stop-jira.sh";
      };
--- a/nixos/modules/services/web-apps/hedgedoc.nix
+++ b/nixos/modules/services/web-apps/hedgedoc.nix
@ -1023,6 +1023,7 @@ in
      '';
      serviceConfig = {
        WorkingDirectory = cfg.workDir;
+        StateDirectory = [ cfg.workDir cfg.configuration.uploadsPath ];
        ExecStart = "${cfg.package}/bin/hedgedoc";
        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
        Environment = [
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@ -294,7 +294,7 @@ in {
        port = lib.mkOption {
          description = "Redis port.";
          type = lib.types.port;
-          default = 6379;
+          default = 31637;
        };
      };

@ -605,8 +605,10 @@ in {
      enable = true;
      hostname = lib.mkDefault "${cfg.localDomain}";
    };
-    services.redis = lib.mkIf (cfg.redis.createLocally && cfg.redis.host == "127.0.0.1") {
+    services.redis.servers.mastodon = lib.mkIf (cfg.redis.createLocally && cfg.redis.host == "127.0.0.1") {
      enable = true;
+      port = cfg.redis.port;
+      bind = "127.0.0.1";
    };
    services.postgresql = lib.mkIf databaseActuallyCreateLocally {
      enable = true;
--- a/nixos/modules/system/boot/kernel.nix
+++ b/nixos/modules/system/boot/kernel.nix
@ -273,9 +273,6 @@ in

        boot.kernelModules = [ "loop" "atkbd" ];

-        # The Linux kernel >= 2.6.27 provides firmware.
-        hardware.firmware = [ kernel ];
-
        # Create /etc/modules-load.d/nixos.conf, which is read by
        # systemd-modules-load.service to load required kernel modules.
        environment.etc =
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -575,6 +575,7 @@ in
  unifi = handleTest ./unifi.nix {};
  unit-php = handleTest ./web-servers/unit-php.nix {};
  upnp = handleTest ./upnp.nix {};
+  uptermd = handleTest ./uptermd.nix {};
  usbguard = handleTest ./usbguard.nix {};
  user-activation-scripts = handleTest ./user-activation-scripts.nix {};
  uwsgi = handleTest ./uwsgi.nix {};
--- a/nixos/tests/hydra/default.nix
+++ b/nixos/tests/hydra/default.nix
@ -11,7 +11,7 @@ let
  inherit (import ./common.nix { inherit system; }) baseConfig;

  hydraPkgs = {
-    inherit (pkgs) hydra-unstable;
+    inherit (pkgs) hydra_unstable;
  };

  makeHydraTest = with pkgs.lib; name: package: makeTest {
--- a/nixos/tests/uptermd.nix
+++ b/nixos/tests/uptermd.nix
@ -0,0 +1,62 @@
+import ./make-test-python.nix ({ pkgs, ...}:
+
+let
+  client = {pkgs, ...}:{
+    environment.systemPackages = [ pkgs.upterm ];
+  };
+in
+{
+  name = "uptermd";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ fleaz ];
+  };
+
+  nodes = {
+    server = {config, ...}: {
+      services.uptermd = {
+        enable = true;
+        openFirewall = true;
+        port = 1337;
+      };
+    };
+    client1 = client;
+    client2 = client;
+  };
+
+
+  testScript = ''
+    start_all()
+
+    server.wait_for_unit("uptermd.service")
+    server.wait_for_unit("network-online.target")
+
+    # Add SSH hostkeys from the server to both clients
+    # uptermd needs an '@cert-authority entry so we need to modify the known_hosts file
+    client1.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
+    client1.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
+    client2.execute("sleep 3; mkdir -p ~/.ssh && ssh -o StrictHostKeyChecking=no -p 1337 server ls")
+    client2.execute("echo @cert-authority $(cat ~/.ssh/known_hosts) > ~/.ssh/known_hosts")
+
+    client1.wait_for_unit("multi-user.target")
+    client1.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+    client1.wait_until_tty_matches(1, "login: ")
+    client1.send_chars("root\n")
+    client1.wait_until_succeeds("pgrep -u root bash")
+
+    client1.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
+    client1.send_chars("TERM=xterm upterm host --server ssh://server:1337 --force-command hostname -- bash > /tmp/session-details\n")
+    client1.wait_for_file("/tmp/session-details")
+    client1.send_key("q")
+
+    # uptermd can't connect if we don't have a keypair
+    client2.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
+
+    # Grep the ssh connect command from the output of 'upterm host'
+    ssh_command = client1.succeed("grep 'SSH Session' /tmp/session-details | cut -d':' -f2-").strip()
+
+    # Connect with client2. Because we used '--force-command hostname' we should get "client1" as the output
+    output = client2.succeed(ssh_command)
+
+    assert output.strip() == "client1"
+  '';
+})
--- a/pkgs/applications/audio/adlplug/default.nix
+++ b/pkgs/applications/audio/adlplug/default.nix
@ -13,11 +13,22 @@
 , libXinerama
 , libXext
 , libXcursor
-, libobjc
+, Foundation
 , Cocoa
+, Carbon
 , CoreServices
+, ApplicationServices
+, CoreAudio
+, CoreMIDI
+, AudioToolbox
+, Accelerate
+, CoreImage
+, IOKit
+, AudioUnit
+, QuartzCore
 , WebKit
 , DiscRecording
+, CoreAudioKit

  # Enabling JACK requires a JACK server at runtime, no fallback mechanism
 , withJack ? false, jack
@ -35,25 +46,16 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "${lib.strings.toLower type}plug";
-  version = "1.0.2";
+  version = "unstable-2021-12-17";

  src = fetchFromGitHub {
    owner = "jpcima";
    repo = "ADLplug";
-    rev = "v${version}";
+    rev = "a488abedf1783c61cb4f0caa689f1b01bf9aa17d";
    fetchSubmodules = true;
-    sha256 = "0mqx4bzri8s880v7jwd24nb93m5i3aklqld0b3h0hjnz0lh2qz0f";
+    sha256 = "1a5zw0rglqgc5wq1n0s5bxx7y59dsg6qy02236fakl34bvbk60yz";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/jpcima/ADLplug/83636c55bec1b86cabf634b9a6d56d07f00ecc61/resources/patch/juce-gcc9.patch";
-      sha256 = "15hkdb76n9lgjsrpczj27ld9b4804bzrgw89g95cj4sc8wwkplyy";
-      extraPrefix = "thirdparty/JUCE/";
-      stripLen = 1;
-    })
-  ];
-
  cmakeFlags = [
    "-DADLplug_CHIP=${chip}"
    "-DADLplug_USE_SYSTEM_FMT=ON"
@ -61,9 +63,24 @@ stdenv.mkDerivation rec {
  ];

  NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin (toString [
+    # "fp.h" file not found
    "-isystem ${CoreServices}/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/CarbonCore.framework/Versions/A/Headers"
  ]);

+  NIX_LDFLAGS = toString (lib.optionals stdenv.hostPlatform.isDarwin [
+    # Framework that JUCE needs which don't get linked properly
+    "-framework CoreAudioKit"
+    "-framework QuartzCore"
+    "-framework AudioToolbox"
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    # JUCE dlopen's these at runtime
+    "-lX11"
+    "-lXext"
+    "-lXcursor"
+    "-lXinerama"
+    "-lXrandr"
+  ]);
+
  nativeBuildInputs = [
    cmake
    pkg-config
@ -81,17 +98,32 @@ stdenv.mkDerivation rec {
    libXext
    libXcursor
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    libobjc
+    Foundation
    Cocoa
+    Carbon
    CoreServices
+    ApplicationServices
+    CoreAudio
+    CoreMIDI
+    AudioToolbox
+    Accelerate
+    CoreImage
+    IOKit
+    AudioUnit
+    QuartzCore
    WebKit
    DiscRecording
+    CoreAudioKit
  ] ++ lib.optional withJack jack;

  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mkdir $out/Applications
+    mkdir -p $out/{Applications,Library/Audio/Plug-Ins/{VST,Components}}
+
    mv $out/bin/${mainProgram}.app $out/Applications/
    ln -s $out/{Applications/${mainProgram}.app/Contents/MacOS,bin}/${mainProgram}
+
+    mv vst2/${mainProgram}.vst $out/Library/Audio/Plug-Ins/VST/
+    mv au/${mainProgram}.component $out/Library/Audio/Plug-Ins/Components/
  '';

  meta = with lib; {
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@ -84,6 +84,7 @@ let
    gettext
    glew
    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-bad
    gst_all_1.gstreamer
    gvfs
    libechonest
--- a/pkgs/applications/audio/noisetorch/default.nix
+++ b/pkgs/applications/audio/noisetorch/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "NoiseTorch";
-  version = "0.11.4";
+  version = "0.11.5";

  src = fetchFromGitHub {
    owner = "lawl";
    repo = "NoiseTorch";
    rev = version;
-    sha256 = "sha256-3+Yk7dqD7eyvd1I5CMmrg085ZtFxD2EnGqL5ttwx8eM=";
+    sha256 = "sha256-j/6XB3vA5LvTuCxmeB0HONqEDzYg210AWW/h3nCGOD8=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/backup/vorta/default.nix
+++ b/pkgs/applications/backup/vorta/default.nix
@ -8,13 +8,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "vorta";
-  version = "0.8.3";
+  version = "0.8.4";

  src = fetchFromGitHub {
    owner = "borgbase";
    repo = "vorta";
-    rev = "v${version}";
-    sha256 = "06sb24pimq9ckdkp9hzp4r9d3i21kxacsx5b7x9q99qcwf7h6372";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-eS/+7s9KgGCEhA6NgIzPlGM1daP+Ir2d1mmqse4YbIE=";
  };

  nativeBuildInputs = [ wrapQtAppsHook ];
--- a/pkgs/applications/blockchains/dashpay/default.nix
+++ b/pkgs/applications/blockchains/dashpay/default.nix
@ -1,44 +0,0 @@
-{ fetchFromGitHub, lib, stdenv, pkg-config, autoreconfHook
-, openssl, db48, boost, zlib, miniupnpc
-, qrencode, glib, protobuf, yasm, libevent
-, util-linux
-, enable_Upnp ? false
-, disable_Wallet ? false
-, disable_Daemon ? false }:
-
-with lib;
-stdenv.mkDerivation rec {
-  pname = "dashpay";
-  version = "0.12.2.3";
-
-  src = fetchFromGitHub {
-    owner = "dashpay";
-    repo= "dash";
-    rev = "v${version}";
-    sha256 = "sha256-DMoiUX8Q0HcBHA6ZIN58uPsTnHjEJMi8eGG2DW8z17Q=";
-  };
-
-  nativeBuildInputs = [ pkg-config autoreconfHook ];
-  buildInputs = [ glib openssl db48 yasm boost zlib libevent
-                  miniupnpc protobuf qrencode util-linux ];
-
-
-  configureFlags = [ "--with-boost-libdir=${boost.out}/lib --with-gui=no" ]
-                    ++ optional enable_Upnp "--enable-upnp-default"
-                    ++ optional disable_Wallet "--disable-wallet"
-                    ++ optional disable_Daemon "--disable-daemon"
-                    ;
-
-  meta = {
-    description = "A decentralized key/value registration and transfer system";
-    longDescription = ''
-      Dash (DASH) is an open sourced, privacy-centric digital currency
-      with instant transactions.  It allows you to keep your finances
-      private as you make transactions without waits, similar to cash.
-    '';
-    homepage = "https://www.dash.org";
-    maintainers = with maintainers; [ ];
-    platforms = platforms.unix;
-    license = licenses.mit;
-  };
-}
--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix
@ -384,10 +384,10 @@
      elpaBuild {
        pname = "boxy";
        ename = "boxy";
-        version = "1.0.5";
+        version = "1.1.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/boxy-1.0.5.tar";
-          sha256 = "0g608nhg160p9gflw52h3247x35r0g6bl89yq35jbsc7fnw6m5ry";
+          url = "https://elpa.gnu.org/packages/boxy-1.1.0.tar";
+          sha256 = "17z0amn1klbzvq0z5g20a5gjq5agrrhnkp8amqlqzj7p0p31nbns";
        };
        packageRequires = [ emacs ];
        meta = {
@ -399,10 +399,10 @@
      elpaBuild {
        pname = "boxy-headings";
        ename = "boxy-headings";
-        version = "2.1.2";
+        version = "2.1.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/boxy-headings-2.1.2.tar";
-          sha256 = "0jyfp41jw33kmi7832x5x0mgh5niqvb7dfc7q00kay5q9ixg83dq";
+          url = "https://elpa.gnu.org/packages/boxy-headings-2.1.3.tar";
+          sha256 = "09k5x123db19v2k49y8acyk5y3r0fxw0xz61qqqidrgrx8fs3mg9";
        };
        packageRequires = [ boxy emacs org ];
        meta = {
@ -1384,10 +1384,10 @@
      elpaBuild {
        pname = "eldoc";
        ename = "eldoc";
-        version = "1.11.1";
+        version = "1.12.0";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/eldoc-1.11.1.tar";
-          sha256 = "065clc07nrgp56cgynqhq3fmnwd64ccg2jxzikzb0f2zkn10vc90";
+          url = "https://elpa.gnu.org/packages/eldoc-1.12.0.tar";
+          sha256 = "1npggpisqnfkc3gx7dr3pjnif7gf571z7s9g7n6vnb213353qskk";
        };
        packageRequires = [ emacs ];
        meta = {
@ -1499,10 +1499,10 @@
      elpaBuild {
        pname = "engrave-faces";
        ename = "engrave-faces";
-        version = "0.3.0";
+        version = "0.3.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/engrave-faces-0.3.0.tar";
-          sha256 = "0l59fci16m6li52bqwbqglsi9gavgsfkxlxm9y1ny3ma0w1rnp9d";
+          url = "https://elpa.gnu.org/packages/engrave-faces-0.3.1.tar";
+          sha256 = "1q4sjl2rvcfwcirm32nmi53258ln71yhh1dgszlxwknm38a14v3i";
        };
        packageRequires = [ emacs ];
        meta = {
@ -1714,10 +1714,10 @@
      elpaBuild {
        pname = "fontaine";
        ename = "fontaine";
-        version = "0.1.1";
+        version = "0.2.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/fontaine-0.1.1.tar";
-          sha256 = "1jyb6s2sqr9fmy6f4i9vijaswb8f9vn2br98d4w2afzhmf4d0bdc";
+          url = "https://elpa.gnu.org/packages/fontaine-0.2.1.tar";
+          sha256 = "11g03gaiypqf0xi7s3xyjnbi2w154lkd7j0ybmn8scs6pbzdyl95";
        };
        packageRequires = [ emacs ];
        meta = {
@ -2931,10 +2931,10 @@
      elpaBuild {
        pname = "nano-modeline";
        ename = "nano-modeline";
-        version = "0.6";
+        version = "0.7";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/nano-modeline-0.6.tar";
-          sha256 = "1cxycfx4ic2hzfvp3d2z0a5xjg97p49yla3a1qxw1dldcjg9lfg0";
+          url = "https://elpa.gnu.org/packages/nano-modeline-0.7.tar";
+          sha256 = "1fsjzbdawkn4vmk6zs6az1b42mx5ka7a618fgx5zdncr79wl0vjw";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3175,10 +3175,10 @@
      elpaBuild {
        pname = "org-real";
        ename = "org-real";
-        version = "1.0.4";
+        version = "1.0.5";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-real-1.0.4.tar";
-          sha256 = "0bn9vyx74lki2nggzir02mcrww94dnqpbkryjr7a4i6am0ylf705";
+          url = "https://elpa.gnu.org/packages/org-real-1.0.5.tar";
+          sha256 = "0g70bzhr094fah86cyvd9ci8q28qi9c44g33i4lw7clklgdx7mxl";
        };
        packageRequires = [ boxy emacs org ];
        meta = {
@ -3426,6 +3426,21 @@
          license = lib.licenses.free;
        };
      }) {};
+    plz = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "plz";
+        ename = "plz";
+        version = "0.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/plz-0.1.tar";
+          sha256 = "083qz6kfg4q8xy3vsfwlk2g9vbg8iym2axmyhh54naivrc096ghc";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/plz.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    poker = callPackage ({ elpaBuild, fetchurl, lib }:
      elpaBuild {
        pname = "poker";
@ -4553,10 +4568,10 @@
      elpaBuild {
        pname = "tomelr";
        ename = "tomelr";
-        version = "0.3.0";
+        version = "0.4.3";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/tomelr-0.3.0.tar";
-          sha256 = "0jnnyvbmhqn8wkg3y13iy19nck6dphay8jdy2nimp28a1jvs7z6g";
+          url = "https://elpa.gnu.org/packages/tomelr-0.4.3.tar";
+          sha256 = "03dj7mhqyfdpxr32nyvfgkqr6wr55cd7yk9a0izjs4468zx8vl0d";
        };
        packageRequires = [ emacs map seq ];
        meta = {
--- a/pkgs/applications/editors/emacs/elisp-packages/elpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/elpa-packages.nix
@ -104,6 +104,21 @@ self: let
          maintainers = [ lib.maintainers.sternenseemann ];
        };
      });
+
+      plz = super.plz.overrideAttrs (
+        old: {
+          dontUnpack = false;
+          postPatch = old.postPatch or "" + ''
+            substituteInPlace ./plz.el \
+              --replace 'plz-curl-program "curl"' 'plz-curl-program "${pkgs.curl}/bin/curl"'
+          '';
+          preInstall = ''
+            tar -cf "$pname-$version.tar" --transform "s,^,$pname-$version/," * .[!.]*
+            src="$pname-$version.tar"
+          '';
+        }
+      );
+
    };

    elpaPackages = super // overrides;
--- a/pkgs/applications/editors/emacs/elisp-packages/header-file-mode/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/header-file-mode/default.nix
@ -5,13 +5,13 @@

 trivialBuild {
  pname = "header-file-mode";
-  version = "unstable-2022-04-19";
+  version = "unstable-2022-05-13";

  src = fetchFromGitHub {
-    owner = "0x4b";
+    owner = "aidalgol";
    repo = "header-file-mode";
-    rev = "fdf1930730e1b0c3f82490099a1325805491eff5";
-    sha256 = "sha256-FJgRI6RLQk9osh7d+YRfrV5CoGCDx2cZvsjAWlm969c=";
+    rev = "bcfd19a2c70030ebf5fa68e87aca4b3db8fad13e";
+    sha256 = "sha256-XMXOU+vWJ/0e0ny4Dz3DxWpdEfSNXGzm03sBke32Dwc=";
  };

  postUnpack = ''
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix
@ -194,8 +194,6 @@

  control-lock = callPackage ./control-lock { };

-  plz = callPackage ./plz { };
-
  pod-mode = callPackage ./pod-mode { };

  power-mode = callPackage ./power-mode { };
--- a/pkgs/applications/editors/emacs/elisp-packages/plz/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/plz/default.nix
@ -1,31 +0,0 @@
-{ trivialBuild, lib, fetchFromGitHub, curl }:
-
-trivialBuild {
-  pname = "plz";
-  version = "0.pre+date=2021-08-22";
-
-  src = fetchFromGitHub {
-    owner = "alphapapa";
-    repo = "plz.el";
-    rev = "7e456638a651bab3a814e3ea81742dd917509cbb";
-    hash = "sha256-8kn9ax1AVF6f9iCTqvVeJZihs03pYAhLjUDooG/ubxY=";
-  };
-
-  postPatch = ''
-    substituteInPlace ./plz.el \
-      --replace 'plz-curl-program "curl"' 'plz-curl-program "${curl}/bin/curl"'
-  '';
-
-  meta = {
-    description = "An HTTP library for Emacs";
-    longDescription = ''
-      plz is an HTTP library for Emacs. It uses curl as a backend, which avoids
-      some of the issues with using Emacs’s built-in url library. It supports
-      both synchronous and asynchronous requests. Its API is intended to be
-      simple, natural, and expressive. Its code is intended to be simple and
-      well-organized. Every feature is tested against httpbin.org.
-    '';
-    license = lib.licenses.gpl3Only;
-    platforms = lib.platforms.all;
-  };
-}
--- a/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
+++ b/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
--- a/pkgs/applications/editors/pinegrow/default.nix
+++ b/pkgs/applications/editors/pinegrow/default.nix
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
  version = "6.5";

  src = fetchurl {
-    url = "https://github.com/Pinegrow/PinegrowReleases/releases/download/pg${version}/PinegrowLinux64.${version}.zip";
+    url = "https://download.pinegrow.com/PinegrowLinux64.${version}.zip";
    sha256 = "1l7cf5jgidpykaf68mzf92kywl1vxwl3fg43ibgr2rg4cnl1g82b";
  };

--- a/pkgs/applications/editors/vim/plugins/build-vim-plugin.nix
+++ b/pkgs/applications/editors/vim/plugins/build-vim-plugin.nix
@ -3,14 +3,10 @@
 , vim
 , vimCommandCheckHook
 , vimGenDocHook
+, neovimRequireCheckHook
 }:

 rec {
-  addRtp = path: attrs: derivation:
-    derivation // { rtp = "${derivation}"; } // {
-      overrideAttrs = f: buildVimPlugin (attrs // f attrs);
-    };
-
  buildVimPlugin = attrs@{
    name ? "${attrs.pname}-${attrs.version}",
    namePrefix ? "vimplugin-",
@ -24,7 +20,7 @@ rec {
    addonInfo ? null,
    ...
  }:
-    addRtp "${rtpPath}/${path}" attrs (stdenv.mkDerivation (attrs // {
+    let drv = stdenv.mkDerivation (attrs // {
      name = namePrefix + name;

      # dont move the doc folder since vim expects it
@ -44,7 +40,10 @@ rec {

        runHook postInstall
      '';
-    }));
+    });
+    in  drv.overrideAttrs(oa: {
+      rtp = "${drv}";
+    });

  buildVimPluginFrom2Nix = attrs: buildVimPlugin ({
    # vim plugins may override this
--- a/pkgs/applications/editors/vim/plugins/neovim-require-check-hook.sh
+++ b/pkgs/applications/editors/vim/plugins/neovim-require-check-hook.sh
@ -0,0 +1,21 @@
+# Setup hook for checking whether Python imports succeed
+echo "Sourcing neovim-require-check-hook.sh"
+
+neovimRequireCheckHook () {
+    echo "Executing neovimRequireCheckHook"
+
+    if [ -n "$nvimRequireCheck" ]; then
+        echo "Check whether the following module can be imported: $nvimRequireCheck"
+
+		# editorconfig-checker-disable
+        export HOME="$TMPDIR"
+        @nvimBinary@ -es --headless -n -u NONE -i NONE --clean -V1 \
+            --cmd "set rtp+=$out" \
+            --cmd "lua require('$nvimRequireCheck')"
+    fi
+}
+
+echo "Using neovimRequireCheckHook"
+preDistPhases+=" neovimRequireCheckHook"
+
+
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -327,6 +327,9 @@ self: super: {
      sed -Ei lua/plenary/curl.lua \
          -e 's@(command\s*=\s*")curl(")@\1${curl}/bin/curl\2@'
    '';
+
+    doInstallCheck = true;
+    nvimRequireCheck = "plenary";
  });

  gruvbox-nvim = super.gruvbox-nvim.overrideAttrs (old: {
--- a/pkgs/applications/editors/vim/plugins/vim-utils.nix
+++ b/pkgs/applications/editors/vim/plugins/vim-utils.nix
@ -531,14 +531,26 @@ rec {
      };
    } ./vim-command-check-hook.sh) {};

+  neovimRequireCheckHook = callPackage ({ neovim-unwrapped }:
+    makeSetupHook {
+      name = "neovim-require-check-hook";
+      deps = [ neovim-unwrapped ];
+      substitutions = {
+        nvimBinary = "${neovim-unwrapped}/bin/nvim";
+        inherit rtpPath;
+      };
+    } ./neovim-require-check-hook.sh) {};
+
  inherit (import ./build-vim-plugin.nix {
-    inherit lib stdenv rtpPath vim vimGenDocHook vimCommandCheckHook;
+    inherit lib stdenv rtpPath vim vimGenDocHook vimCommandCheckHook neovimRequireCheckHook;
  }) buildVimPlugin buildVimPluginFrom2Nix;


  # TODO placeholder to ease working on automatic plugin detection
  # this should be a luarocks "flat" install with appropriate vim hooks
-  buildNeovimPluginFrom2Nix = buildVimPluginFrom2Nix;
+  buildNeovimPluginFrom2Nix = attrs: let drv = (buildVimPluginFrom2Nix attrs); in drv.overrideAttrs(oa: {
+    nativeBuildInputs = oa.nativeBuildInputs ++ [ neovimRequireCheckHook ];
+  });

  # used to figure out which python dependencies etc. neovim needs
  requiredPlugins = {
--- a/pkgs/applications/editors/vscode/extensions/rust-analyzer/build-deps/package.json
+++ b/pkgs/applications/editors/vscode/extensions/rust-analyzer/build-deps/package.json
@ -1,19 +1,19 @@
 {
  "name": "rust-analyzer",
-  "version": "0.2.975",
+  "version": "0.2.1048",
  "dependencies": {
-    "vscode-languageclient": "8.0.0-next.8",
+    "vscode-languageclient": "8.0.0-next.14",
    "d3": "^7.3.0",
-    "d3-graphviz": "^4.0.0",
+    "d3-graphviz": "^4.1.0",
    "@types/node": "~14.17.5",
-    "@types/vscode": "~1.63.0",
-    "@typescript-eslint/eslint-plugin": "^5.10.0",
-    "@typescript-eslint/parser": "^5.10.0",
-    "@vscode/test-electron": "^2.1.1",
-    "eslint": "^8.7.0",
+    "@types/vscode": "~1.66.0",
+    "@typescript-eslint/eslint-plugin": "^5.16.0",
+    "@typescript-eslint/parser": "^5.16.0",
+    "@vscode/test-electron": "^2.1.3",
+    "eslint": "^8.11.0",
    "tslib": "^2.3.0",
-    "typescript": "^4.5.5",
+    "typescript": "^4.6.3",
    "typescript-formatter": "^7.2.2",
-    "vsce": "^2.6.7"
+    "vsce": "^2.7.0"
  }
 }
--- a/pkgs/applications/editors/vscode/extensions/rust-analyzer/update.sh
+++ b/pkgs/applications/editors/vscode/extensions/rust-analyzer/update.sh
@ -5,7 +5,7 @@ set -euo pipefail
 cd "$(dirname "$0")"
 nixpkgs=../../../../../../
 node_packages="$nixpkgs/pkgs/development/node-packages"
-owner=rust-analyzer
+owner=rust-lang
 repo=rust-analyzer
 ver=$(
    curl -s "https://api.github.com/repos/$owner/$repo/releases" |
@ -22,7 +22,7 @@ if [[ "$(nix-instantiate --eval --strict -E "(builtins.compareVersions \"$req_vs
    exit 1
 fi

-extension_ver=$(curl "https://github.com/rust-analyzer/rust-analyzer/releases/download/$ver/rust-analyzer-linux-x64.vsix" -L |
+extension_ver=$(curl "https://github.com/$owner/$repo/releases/download/$ver/rust-analyzer-linux-x64.vsix" -L |
    bsdtar -xf - --to-stdout extension/package.json | # Use bsdtar to extract vsix(zip).
    jq --raw-output '.version')
 echo "Extension version: $extension_ver"
--- a/pkgs/applications/emulators/yuzu/compatibility-list.json
+++ b/pkgs/applications/emulators/yuzu/compatibility-list.json
--- a/pkgs/applications/emulators/yuzu/default.nix
+++ b/pkgs/applications/emulators/yuzu/default.nix
@ -1,22 +1,27 @@
 { branch ? "mainline"
 , libsForQt5
 , fetchFromGitHub
+, fetchurl
 }:

 let
-  # Fetched from https://api.yuzu-emu.org/gamedb, last updated 2022-03-23.
+  # Fetched from https://api.yuzu-emu.org/gamedb, last updated 2022-05-12
  # Please make sure to update this when updating yuzu!
-  compat-list = ./compatibility-list.json;
+  compat-list = fetchurl {
+    name = "yuzu-compat-list";
+    url = "https://web.archive.org/web/20220512184801/https://api.yuzu-emu.org/gamedb";
+    sha256 = "sha256-anOmO7NscHDsQxT03+YbJEyBkXjhcSVGgKpDwt//GHw=";
+  };
 in {
  mainline = libsForQt5.callPackage ./generic.nix rec {
    pname = "yuzu-mainline";
-    version = "992";
+    version = "1014";

    src = fetchFromGitHub {
      owner = "yuzu-emu";
      repo = "yuzu-mainline";
      rev = "mainline-0-${version}";
-      sha256 = "1x3fwwdw86jvygbzy9k99j6avfsd867ywm2x25izw10jznpsaixs";
+      sha256 = "1x3d1fjssadv4kybc6mk153jlvncsfgm5aipkq5n5i8sr7mmr3nw";
      fetchSubmodules = true;
    };

@ -25,13 +30,13 @@ in {

  early-access = libsForQt5.callPackage ./generic.nix rec {
    pname = "yuzu-ea";
-    version = "2690";
+    version = "2725";

    src = fetchFromGitHub {
      owner = "pineappleEA";
      repo = "pineapple-src";
      rev = "EA-${version}";
-      sha256 = "0zm06clbdh9cccq9932q9v976q7sjknynkdvvp04h1wcskmrxi3c";
+      sha256 = "1nmcl9y9chr7cdvnra5zs1v42d3i801hmsjdlz3fmp15n04bcjmp";
      fetchSubmodules = true;
    };

--- a/pkgs/applications/emulators/yuzu/generic.nix
+++ b/pkgs/applications/emulators/yuzu/generic.nix
@ -45,6 +45,12 @@
 stdenv.mkDerivation rec {
  inherit pname version src;

+  # Replace icons licensed under CC BY-ND 3.0 with free ones to allow
+  # for binary redistribution: https://github.com/yuzu-emu/yuzu/pull/8104
+  # The patch hosted on GitHub has the binary information stripped, so
+  # it has been regenerated with "git format-patch --text --full-index --binary"
+  patches = [ ./yuzu-free-icons.patch ];
+
  nativeBuildInputs = [
    cmake
    doxygen
@ -145,10 +151,11 @@ stdenv.mkDerivation rec {
    platforms = [ "x86_64-linux" ];
    license = with licenses; [
      gpl3Plus
-      # Icons
-      cc-by-nd-30 cc0
+      # Icons. Note that this would be cc0 and cc-by-nd-30 without the "yuzu-free-icons" patch
+      asl20 mit cc0
    ];
    maintainers = with maintainers; [
+      ashley
      ivar
      joshuafern
      sbruder
--- a/pkgs/applications/emulators/yuzu/update.sh
+++ b/pkgs/applications/emulators/yuzu/update.sh
@ -23,21 +23,6 @@ getLocalHash() {
    popd >/dev/null
 }

-updateCompatList() {
-    NEW_COMPAT_LIST="$(curl -s "https://api.yuzu-emu.org/gamedb")"
-
-    if [[ "$(cat ./compatibility-list.json)" = "${NEW_COMPAT_LIST}" ]]; then
-        echo "Compatibility list is already up to date!"
-    else
-        local TODAY="$(date +"%Y-%m-%d")"
-
-        echo "Compatibility list: updated to $TODAY"
-        echo "${NEW_COMPAT_LIST}" > ./compatibility-list.json
-
-        sed -i -e "s/last updated .*/last updated $TODAY./" ./default.nix
-    fi
-}
-
 updateMainline() {
    OLD_MAINLINE_VERSION="$(getLocalVersion "yuzu-mainline")"
    OLD_MAINLINE_HASH="$(getLocalHash "yuzu-mainline")"
@ -90,13 +75,10 @@ updateEarlyAccess() {

 if [[ "$BRANCH" = "mainline" ]]; then
    updateMainline
-    updateCompatList
 elif [[ "$BRANCH" = "early-access" ]]; then
    updateEarlyAccess
-    updateCompatList
 else
    KEEP_GOING=1
    updateMainline
    updateEarlyAccess
-    updateCompatList
 fi
--- a/pkgs/applications/emulators/yuzu/yuzu-free-icons.patch
+++ b/pkgs/applications/emulators/yuzu/yuzu-free-icons.patch
--- a/pkgs/applications/misc/fspy/default.nix
+++ b/pkgs/applications/misc/fspy/default.nix
@ -12,7 +12,7 @@ in appimageTools.wrapType2 {
  inherit pname version src;

  extraInstallCommands = ''
-    mv $out/bin/${pname}-v${version} $out/bin/${pname}
+    mv $out/bin/${pname}-${version} $out/bin/${pname}
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/rofimoji/default.nix
+++ b/pkgs/applications/misc/rofimoji/default.nix
@ -15,13 +15,14 @@

 buildPythonApplication rec {
  pname = "rofimoji";
-  version = "5.1.0";
+  version = "5.4.0";
+  format = "pyproject";

  src = fetchFromGitHub {
    owner = "fdw";
    repo = "rofimoji";
    rev = version;
-    sha256 = "sha256-bLV0hYDjVH11euvNHUHZFcCVywuceRljkCqyX4aANVs=";
+    sha256 = "sha256-D45XGnKWHUsE0DQThITBcgpghelsfGkSEIdg9jvOJlw=";
  };

  # `rofi` and the `waylandSupport` and `x11Support` dependencies
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -19,9 +19,9 @@
    }
  },
  "beta": {
-    "version": "102.0.5005.40",
-    "sha256": "1max5ndvl59j2hlv9k88dmadr4q05q1clzlc6zba0gcbvqx5q9jb",
-    "sha256bin64": "1byqx9w0hqwk3vizdas3dylbm69108bnq4xlm0mp1p1gh37h1642",
+    "version": "102.0.5005.49",
+    "sha256": "16r9mrsagy8lspr4pcrzfpw0vw0ym9m7n41a9yipjhm2arlhw5b2",
+    "sha256bin64": "0lyk6rd9c1gyvxsmq1bl7asr7carzyaan306ddvwxsy5rfh53jxa",
    "deps": {
      "gn": {
        "version": "2022-04-14",
@ -32,15 +32,15 @@
    }
  },
  "dev": {
-    "version": "103.0.5042.0",
-    "sha256": "0wm8m1mff8gb0x7whif16gvmhibgc8ndygnawkwq3g4fvninb65h",
-    "sha256bin64": "0vzmpi36a86kgxhdxvbqbn7i1wf2annar1mi15gra1cjpz3lf9kh",
+    "version": "103.0.5056.0",
+    "sha256": "1mvi7yc38cxn39wqm8ybrn862gaw293rb6lwcszc6rmzwd9jmd29",
+    "sha256bin64": "06371adaz8llzfjykc72vjvpy3xrgvqzz9kdrr82jdx1pjdbv29d",
    "deps": {
      "gn": {
-        "version": "2022-05-02",
+        "version": "2022-05-09",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "53ef169800760fdc09f0773bf380fe99eaeab339",
-        "sha256": "08i7qc4qvf8gb3vryajvww75wk653fybf1bb2k40r8i07znhy78r"
+        "rev": "bf4e17dc67b2a2007475415e3f9e1d1cf32f6e35",
+        "sha256": "0d2lb4alsx32zsdw3jxpxbzal350mim237p2y984h4r6fd1ddzyi"
      }
    }
  },
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -23,6 +23,7 @@
 # build time
 , autoconf
 , cargo
+, dump_syms
 , makeWrapper
 , nodejs
 , perl
@ -168,6 +169,11 @@ buildStdenv.mkDerivation ({

  inherit src unpackPhase meta;

+  outputs = [
+    "out"
+    "symbols"
+  ];
+
  # Add another configure-build-profiling run before the final configure phase if we build with pgo
  preConfigurePhases = lib.optionals pgoSupport [
    "configurePhase"
@ -196,6 +202,7 @@ buildStdenv.mkDerivation ({
  nativeBuildInputs = [
    autoconf
    cargo
+    dump_syms
    llvmPackages.llvm # llvm-objdump
    makeWrapper
    nodejs
@ -231,13 +238,17 @@ buildStdenv.mkDerivation ({
    # Set consistent remoting name to ensure wmclass matches with desktop file
    export MOZ_APP_REMOTINGNAME="${binaryName}"

-    # Use our own python
-    export MACH_USE_SYSTEM_PYTHON=1
-
    # AS=as in the environment causes build failure
    # https://bugzilla.mozilla.org/show_bug.cgi?id=1497286
    unset AS

+  '' + lib.optionalString (lib.versionAtLeast version "100.0") ''
+    # Use our own python
+    export MACH_BUILD_PYTHON_NATIVE_PACKAGE_SOURCE=system
+  '' + lib.optionalString (lib.versionOlder version "100.0") ''
+    # Use our own python
+    export MACH_USE_SYSTEM_PYTHON=1
+
  '' + lib.optionalString (lib.versionAtLeast version "95.0") ''
    # RBox WASM Sandboxing
    export WASM_CC=${pkgsCross.wasi32.stdenv.cc}/bin/${pkgsCross.wasi32.stdenv.cc.targetPrefix}cc
@ -408,7 +419,13 @@ buildStdenv.mkDerivation ({
  # tests were disabled in configureFlags
  doCheck = false;

+  # Generate build symbols once after the final build
+  # https://firefox-source-docs.mozilla.org/crash-reporting/uploading_symbol.html
  preInstall = ''
+    ./mach buildsymbols
+    mkdir -p $symbols/
+    cp mozobj/dist/*.crashreporter-symbols.zip $symbols/
+
    cd mozobj
  '';

--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@ -1,8 +1,8 @@
 {
-  "packageVersion": "100.0-2",
+  "packageVersion": "100.0-3",
  "source": {
-    "rev": "100.0-2",
-    "sha256": "0pr7fb91zw5qlnfvaavzksd3c2xzgn1344mmfnz9yx2g42vcyi7d"
+    "rev": "100.0-3",
+    "sha256": "1n99amk6ngxa7wipc402gffqjv4qmgbaahpz3xydfarxw8gk37pl"
  },
  "firefox": {
    "version": "100.0",
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@ -1,11 +1,11 @@
 { lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 let
  # look for GO_LDFLAGS getting set in the Makefile
-  version = "1.0.4";
-  sha256 = "sha256-kO48MRQDQGDUvFfsxAt+CAHn2EGU44NMpSKDWnNwAdk=";
-  vendorSha256 = "sha256-QcD5MKQO51ZZ/NvVIiAmDsN6wLI2N8YkhA387KB77W8=";
-  pkgsVersion = "v1.0.0-10-gbf81bd2";
-  extrasVersion = "v1.0.0-2-gc5d3ab0";
+  version = "1.0.5";
+  sha256 = "sha256-xgzIbhgV1AAUa0tooYtzUMqK4Co3PvWQ0YbZuf0JgFE=";
+  vendorSha256 = "sha256-Gp30qCGV+EaJ1lvfleZHRWVL6rdSj0mvpumWsqr9IT0=";
+  pkgsVersion = "v1.0.0-17-g7567bf4";
+  extrasVersion = "v1.0.0-3-g6327c36";
 in
 buildGoModule rec {
  pname = "talosctl";
--- a/pkgs/applications/networking/compactor/default.nix
+++ b/pkgs/applications/networking/compactor/default.nix
@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub
 , asciidoctor, autoreconfHook, pkg-config
-, boost, libctemplate, libmaxminddb, libpcap, libtins, openssl, protobuf, xz, zlib
+, boost, libctemplate, libmaxminddb, libpcap, libtins, openssl, protobuf, xz, zlib, catch2
 , cbor-diag, cddl, diffutils, file, mktemp, netcat, tcpdump, wireshark-cli
 }:

@ -35,6 +35,7 @@ stdenv.mkDerivation rec {

  postPatch = ''
    patchShebangs test-scripts/
+    cp ${catch2}/include/catch2/catch.hpp tests/catch.hpp
  '';

  preConfigure = ''
--- a/pkgs/applications/networking/netperf/default.nix
+++ b/pkgs/applications/networking/netperf/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation {
  pname = "netperf";
-  version = "20180613";
+  version = "20210121";

  src = fetchFromGitHub {
    owner = "HewlettPackard";
    repo = "netperf";
-    rev = "bcb868bde7f0203bbab69609f65d4088ba7398db";
-    sha256 = "1wbbgdvhadd3qs3afv6i777argdpcyxkwz4yv6aqp223n8ki6dm8";
+    rev = "3bc455b23f901dae377ca0a558e1e32aa56b31c4";
+    sha256 = "s4G1ZN+6LERdEMDkc+12ZQgTi6K+ppUYUCGn4faCS9c=";
  };

  buildInputs = lib.optional (with stdenv.hostPlatform; isx86 && isLinux) libsmbios;
@ -22,7 +22,7 @@ stdenv.mkDerivation {
  meta = {
    description = "Benchmark to measure the performance of many different types of networking";
    homepage = "http://www.netperf.org/netperf/";
-    license = "Hewlett-Packard BSD-like license";
+    license = lib.licenses.mit;

    platforms = lib.platforms.unix;
    maintainers = [ lib.maintainers.mmlb ];
--- a/pkgs/applications/networking/p2p/mldonkey/default.nix
+++ b/pkgs/applications/networking/p2p/mldonkey/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, ocamlPackages, zlib }:
+{ lib, stdenv, fetchurl, fetchpatch, ocamlPackages, zlib }:

 stdenv.mkDerivation rec {
  pname = "mldonkey";
@ -9,6 +9,14 @@ stdenv.mkDerivation rec {
    sha256 = "b926e7aa3de4b4525af73c88f1724d576b4add56ef070f025941dd51cb24a794";
  };

+  patches = [
+    # Fixes C++17 compat
+    (fetchpatch {
+      url = "https://github.com/ygrek/mldonkey/pull/66/commits/20ff84c185396f3d759cf4ef46b9f0bd33a51060.patch";
+      hash = "sha256-MCqx0jVfOaLkZhhv0b1cTdO6BK2/f6TxTWmx+NZjXME=";
+    })
+  ];
+
  preConfigure = ''
    substituteInPlace Makefile --replace '+camlp4' \
      '${ocamlPackages.camlp4}/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/camlp4'
--- a/pkgs/applications/networking/twtxt/default.nix
+++ b/pkgs/applications/networking/twtxt/default.nix
@ -23,6 +23,11 @@ buildPythonApplication rec {

  checkInputs = [ pytestCheckHook tox ];

+  disabledTests = [
+     # Disable test using relative date and time
+     "test_tweet_relative_datetime"
+  ];
+
  meta = with lib; {
    description = "Decentralised, minimalist microblogging service for hackers";
    homepage = "https://github.com/buckket/twtxt";
--- a/pkgs/applications/radio/rtl_433/default.nix
+++ b/pkgs/applications/radio/rtl_433/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, fetchpatch
 , libusb1, rtl-sdr, soapysdr-with-plugins
 }:

@ -13,6 +13,12 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-KoDKyI7KDdGSe79ZTuL9ObKnOJsqTN4wrMq+/cvQ/Xk=";
  };

+  patches = [( fetchpatch {
+    name = "CVE-2022-27419";
+    url = "https://github.com/merbanan/rtl_433/commit/37455483889bd1c641bdaafc493d1cc236b74904.patch";
+    sha256 = "172jndh8x5nlcbx2jp5y8fgfxsawwfz95037pcjp170gf93ijy88";
+  })];
+
  nativeBuildInputs = [ pkg-config cmake ];

  buildInputs = [ libusb1 rtl-sdr soapysdr-with-plugins ];
@ -23,7 +29,7 @@ stdenv.mkDerivation rec {
    description = "Decode traffic from devices that broadcast on 433.9 MHz, 868 MHz, 315 MHz, 345 MHz and 915 MHz";
    homepage = "https://github.com/merbanan/rtl_433";
    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ earldouglas ];
+    maintainers = with maintainers; [ earldouglas markuskowa ];
    platforms = platforms.all;
  };

--- a/pkgs/applications/science/biology/bayescan/default.nix
+++ b/pkgs/applications/science/biology/bayescan/default.nix
@ -29,6 +29,8 @@ stdenv.mkDerivation rec {
    cp -r ../*pdf ../input_examples ../"R functions" $out/share/doc/bayescan
  '';

+  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+
  meta = with lib; {
    description = "Detecting natural selection from population-based genetic data";
    homepage = "http://cmpg.unibe.ch/software/BayeScan";
--- a/pkgs/applications/science/chemistry/chemtool/default.nix
+++ b/pkgs/applications/science/chemistry/chemtool/default.nix
@ -24,6 +24,12 @@ stdenv.mkDerivation rec {
    fig2dev
  ];

+  # Workaround build on -fno-common toolchains like upstream gcc-10.
+  # Otherwise built fails as:
+  #   ld: inout.o:/build/chemtool-1.6.14/ct1.h:279: multiple definition of
+  #     `outtype'; draw.o:/build/chemtool-1.6.14/ct1.h:279: first defined here
+  NIX_CFLAGS_COMPILE = "-fcommon";
+
  preFixup = ''
    gappsWrapperArgs+=(--prefix PATH : "${lib.makeBinPath [ fig2dev ]}")
  '';
--- a/pkgs/applications/science/chemistry/openmolcas/MKL-MPICH.patch
+++ b/pkgs/applications/science/chemistry/openmolcas/MKL-MPICH.patch
@ -0,0 +1,24 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 276ae4e..5e56176 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -1304,9 +1304,9 @@ if (LINALG STREQUAL "MKL")
+       endif ()
+     else ()
+       if (ADDRMODE EQUAL 64)
+-        set (libpath "${MKLROOT}/lib/intel64")
+        set (libpath "${MKLROOT}/lib")
+       elseif (ADDRMODE EQUAL 32)
+-        set (libpath "${MKLROOT}/lib/ia32")
+        set (libpath "${MKLROOT}/lib")
+       endif ()
+     endif ()
+     set (MKL_LIBRARY_PATH ${libpath} CACHE PATH "location of MKL libraries." FORCE)
+@@ -1380,7 +1380,7 @@ if (LINALG STREQUAL "MKL")
+     find_library (LIBMKL_BLACS NAMES "mkl_blacs_intelmpi_ilp64"
+                   PATHS ${MKL_LIBRARY_PATH} NO_DEFAULT_PATH)
+   elseif (MPI_IMPLEMENTATION STREQUAL "mpich")
+-    find_library (LIBMKL_BLACS NAMES "mkl_blacs_ilp64"
+    find_library (LIBMKL_BLACS NAMES "mkl_blacs_intelmpi_ilp64"
+                   PATHS ${MKL_LIBRARY_PATH} NO_DEFAULT_PATH)
+   endif ()
--- a/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/pkgs/applications/science/chemistry/openmolcas/default.nix
@ -1,30 +1,35 @@
 { lib, stdenv, fetchFromGitLab, cmake, gfortran, perl
-, openblas, hdf5-cpp, python3, texlive
-, armadillo, mpi, globalarrays, openssh
-, makeWrapper
+, blas-ilp64, hdf5-cpp, python3, texlive
+, armadillo, libxc, makeWrapper
+# Note that the CASPT2 module is broken with MPI
+# See https://gitlab.com/Molcas/OpenMolcas/-/issues/169
+, enableMpi ? false
+, mpi, globalarrays
 } :

-let
-  version = "21.10";
-  # The tag keeps moving, fix a hash instead
-  gitLabRev = "117305462bac932106e8e3a0347238b768bcb058";
+assert blas-ilp64.isILP64;
+assert lib.elem blas-ilp64.passthru.implementation [ "openblas" "mkl" ];

-  python = python3.withPackages (ps : with ps; [ six pyparsing ]);
+let
+  python = python3.withPackages (ps : with ps; [ six pyparsing numpy h5py ]);

 in stdenv.mkDerivation {
  pname = "openmolcas";
-  inherit version;
+  version = "22.02";

  src = fetchFromGitLab {
    owner = "Molcas";
    repo = "OpenMolcas";
-    rev = gitLabRev;
-    sha256 = "sha256-GMi2dsNBog+TmpmP6fhQcp6Z5Bh2LelV//MqLnvRP5c=";
+    # The tag keeps moving, fix a hash instead
+    rev = "f8df69cf87b241a15ebc82d72a8f9a031a385dd4"; # 2022-02-10
+    sha256 = "0p2xj8kgqdk5kb1jv5k77acbiqkbl2sh971jnz9p00cmbh556r6a";
  };

  patches = [
    # Required to handle openblas multiple outputs
    ./openblasPath.patch
+    # Required for MKL builds
+    ./MKL-MPICH.patch
  ];

  nativeBuildInputs = [
@ -36,27 +41,35 @@ in stdenv.mkDerivation {
  ];

  buildInputs = [
-    openblas
+    blas-ilp64.passthru.provider
    hdf5-cpp
    python
    armadillo
+    libxc
+  ] ++ lib.optionals enableMpi [
    mpi
    globalarrays
-    openssh
  ];

+  passthru = lib.optionalAttrs enableMpi { inherit mpi; };
+
  cmakeFlags = [
    "-DOPENMP=ON"
-    "-DGA=ON"
-    "-DMPI=ON"
    "-DLINALG=OpenBLAS"
    "-DTOOLS=ON"
    "-DHDF5=ON"
    "-DFDE=ON"
-    "-DOPENBLASROOT=${openblas.dev}"
+    "-DEXTERNAL_LIBXC=${libxc}"
+  ] ++ lib.optionals (blas-ilp64.passthru.implementation == "openblas") [
+    "-DOPENBLASROOT=${blas-ilp64.passthru.provider.dev}" "-DLINALG=OpenBLAS"
+  ] ++ lib.optionals (blas-ilp64.passthru.implementation == "mkl") [
+    "-DMKLROOT=${blas-ilp64.passthru.provider}" "-DLINALG=MKL"
+  ] ++ lib.optionals enableMpi [
+    "-DGA=ON"
+    "-DMPI=ON"
  ];

-  preConfigure = ''
+  preConfigure = lib.optionalString enableMpi ''
    export GAROOT=${globalarrays};
  '';

@ -68,6 +81,8 @@ in stdenv.mkDerivation {

  postInstall = ''
    mv $out/pymolcas $out/bin
+    find $out/Tools -type f -exec mv \{} $out/bin \;
+    rm -r $out/Tools
  '';

  postFixup = ''
@ -84,6 +99,7 @@ in stdenv.mkDerivation {
    maintainers = [ maintainers.markuskowa ];
    license = licenses.lgpl21Only;
    platforms = [ "x86_64-linux" ];
+    mainProgram = "pymolcas";
  };
 }

--- a/pkgs/applications/science/logic/aspino/default.nix
+++ b/pkgs/applications/science/logic/aspino/default.nix
@ -9,13 +9,13 @@ in

 stdenv.mkDerivation {
  pname = "aspino";
-  version = "unstable-2017-03-09";
+  version = "unstable-2018-03-24";

  src = fetchFromGitHub {
    owner = "alviano";
    repo = "aspino";
-    rev = "e31c3b4e5791a454e6602439cb26bd98d23c4e78";
-    sha256 = "0annsjs2prqmv1lbs0lxr7yclfzh47xg9zyiq6mdxcc02rxsi14f";
+    rev = "4d7483e328bdf9a00ef1eb7f2868e7b0f2a82d56";
+    hash = "sha256-R1TpBDGdq+NQQzmzqk0wYaz2Hns3qru0AkAyFPQasPA=";
  };

  buildInputs = [ zlib boost ];
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -70,10 +70,9 @@ let
      { case = range "8.7" "8.10";  out = ocamlPackages_4_09; }
      { case = range "8.5" "8.6";   out = ocamlPackages_4_05; }
    ] ocamlPackages_4_12;
-  ocamlNativeBuildInputs = [ ocamlPackages.ocaml ]
+  ocamlNativeBuildInputs = [ ocamlPackages.ocaml ocamlPackages.findlib ]
    ++ optional (coqAtLeast "8.14") ocamlPackages.dune_2;
-  ocamlPropagatedNativeBuildInputs = [ ocamlPackages.findlib ];
-  ocamlPropagatedBuildInputs = [ ]
+  ocamlBuildInputs = []
    ++ optional (!coqAtLeast "8.10") ocamlPackages.camlp5
    ++ optional (!coqAtLeast "8.13") ocamlPackages.num
    ++ optional (coqAtLeast "8.13") ocamlPackages.zarith;
@ -83,8 +82,7 @@ self = stdenv.mkDerivation {

  passthru = {
    inherit coq-version;
-    inherit ocamlPackages ocamlNativeNuildInputs;
-    inherit ocamlPropagatedBuildInputs ocamlPropagatedNativeBuildInputs;
+    inherit ocamlPackages ocamlBuildInputs ocamlNativeBuildInputs;
    # For compatibility
    inherit (ocamlPackages) ocaml camlp5 findlib num ;
    emacsBufferSetup = pkgs: ''
@ -138,16 +136,13 @@ self = stdenv.mkDerivation {
    ++ optional buildIde copyDesktopItems
    ++ optional (buildIde && coqAtLeast "8.10") wrapGAppsHook
    ++ optional (!coqAtLeast "8.6") gnumake42;
-  buildInputs = [ ncurses ]
+  buildInputs = [ ncurses ] ++ ocamlBuildInputs
    ++ optionals buildIde
      (if coqAtLeast "8.10"
       then [ ocamlPackages.lablgtk3-sourceview3 glib gnome.adwaita-icon-theme ]
       else [ ocamlPackages.lablgtk ])
  ;

-  propagatedNativeBuildInputs = ocamlPropagatedNativeBuildInputs;
-  propagatedBuildInputs = ocamlPropagatedBuildInputs;
-
  postPatch = ''
    UNAME=$(type -tp uname)
    RM=$(type -tp rm)
--- a/pkgs/applications/science/math/mathematica/10.nix
+++ b/pkgs/applications/science/math/mathematica/10.nix
@ -1,19 +1,30 @@
-{ lib, stdenv
-, coreutils
+{ lib
 , patchelf
 , requireFile
+, stdenv
+# arguments from default.nix
+, lang
+, meta
+, name
+, src
+, version
+# dependencies
 , alsa-lib
+, coreutils
+, cudaPackages
 , fontconfig
 , freetype
 , gcc
 , glib
+, libuuid
+, libxml2
 , ncurses
 , opencv2
 , openssl
 , unixODBC
 , xorg
-, libxml2
-, libuuid
+# options
+, cudaSupport
 }:

 let
@ -24,20 +35,10 @@ let
      throw "Mathematica requires i686-linux or x86_64 linux";
 in
 stdenv.mkDerivation rec {
-  version = "10.0.2";
+  inherit meta src version;

  pname = "mathematica";

-  src = requireFile rec {
-    name = "Mathematica_${version}_LINUX.sh";
-    message = ''
-      This nix expression requires that ${name} is
-      already part of the store. Find the file on your Mathematica CD
-      and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
-    '';
-    sha256 = "1d2yaiaikzcacjamlw64g3xkk81m3pb4vz4an12cv8nb7kb20x9l";
-  };
-
  buildInputs = [
    coreutils
    patchelf
@ -127,10 +128,4 @@ stdenv.mkDerivation rec {

  # we did this in prefixup already
  dontPatchELF = true;
-
-  meta = {
-    description = "Wolfram Mathematica computational software system";
-    homepage = "http://www.wolfram.com/mathematica/";
-    license = lib.licenses.unfree;
-  };
 }
--- a/pkgs/applications/science/math/mathematica/11.nix
+++ b/pkgs/applications/science/math/mathematica/11.nix
@ -1,14 +1,26 @@
-{ lib, stdenv
-, coreutils
+{ lib
 , patchelf
 , requireFile
-, callPackage
+, stdenv
+# arguments from default.nix
+, lang
+, meta
+, name
+, src
+, version
+# dependencies
 , alsa-lib
+, coreutils
+, cudaPackages
 , dbus
 , fontconfig
 , freetype
 , gcc
 , glib
+, libGL
+, libGLU
+, libuuid
+, libxml2
 , ncurses
 , opencv2
 , openssl
@ -16,23 +28,12 @@
 , xkeyboard_config
 , xorg
 , zlib
-, libxml2
-, libuuid
-, lang ? "en"
-, libGL
-, libGLU
+# options
+, cudaSupport
 }:

-let
-  l10n =
-    import ./l10ns.nix {
-      lib = lib;
-      inherit requireFile lang;
-      majorVersion = "11";
-    };
-in
 stdenv.mkDerivation rec {
-  inherit (l10n) version name src;
+  inherit meta name src version;

  buildInputs = [
    coreutils
@ -141,10 +142,4 @@ stdenv.mkDerivation rec {

  # we did this in prefixup already
  dontPatchELF = true;
-
-  meta = {
-    description = "Wolfram Mathematica computational software system";
-    homepage = "http://www.wolfram.com/mathematica/";
-    license = lib.licenses.unfree;
-  };
 }
--- a/pkgs/applications/science/math/mathematica/9.nix
+++ b/pkgs/applications/science/math/mathematica/9.nix
@ -1,9 +1,17 @@
 { lib
-, stdenv
-, coreutils
 , patchelf
 , requireFile
+, stdenv
+# arguments from default.nix
+, lang
+, meta
+, name
+, src
+, version
+# dependencies
 , alsa-lib
+, coreutils
+, cudaPackages
 , fontconfig
 , freetype
 , gcc
@ -13,6 +21,8 @@
 , openssl
 , unixODBC
 , xorg
+# options
+, cudaSupport
 }:

 let
@ -23,18 +33,8 @@ let
      throw "Mathematica requires i686-linux or x86_64 linux";
 in
 stdenv.mkDerivation rec {
+  inherit meta src version;
  pname = "mathematica";
-  version = "9.0.0";
-
-  src = requireFile {
-    name = "Mathematica_${version}_LINUX.sh";
-    message = ''
-      This nix expression requires that Mathematica_9.0.0_LINUX.sh is
-      already part of the store. Find the file on your Mathematica CD
-      and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
-    '';
-    sha256 = "106zfaplhwcfdl9rdgs25x83xra9zcny94gb22wncbfxvrsk3a4q";
-  };

  buildInputs = [
    coreutils
@ -114,10 +114,4 @@ stdenv.mkDerivation rec {

  # we did this in prefixup already
  dontPatchELF = true;
-
-  meta = {
-    description = "Wolfram Mathematica computational software system";
-    homepage = "http://www.wolfram.com/mathematica/";
-    license = lib.licenses.unfree;
-  };
 }
--- a/pkgs/applications/science/math/mathematica/default.nix
+++ b/pkgs/applications/science/math/mathematica/default.nix
@ -1,173 +1,48 @@
-{ lib
-, stdenv
-, autoPatchelfHook
-, buildEnv
-, makeWrapper
-, requireFile
-, alsa-lib
-, cups
-, dbus
-, flite
-, fontconfig
-, freetype
-, gcc-unwrapped
-, glib
-, gmpxx
-, keyutils
-, libGL
-, libGLU
-, libpcap
-, libtins
-, libuuid
-, libxkbcommon
-, libxml2
-, llvmPackages_12
-, matio
-, mpfr
-, ncurses
-, opencv4
-, openjdk11
-, openssl
-, pciutils
-, tre
-, unixODBC
-, xkeyboard_config
-, xorg
-, zlib
+{ callPackage
+, config
+, lib
+, cudaPackages
+, cudaSupport ? config.cudaSupport or false
 , lang ? "en"
+, version ? null
 }:

-let
-  l10n = import ./l10ns.nix {
-    inherit lib requireFile lang;
-  };
-in stdenv.mkDerivation {
-  inherit (l10n) version name src;
+let versions = callPackage ./versions.nix { };

-  nativeBuildInputs = [
-    autoPatchelfHook
-    makeWrapper
-  ];
+    matching-versions =
+      lib.sort (v1: v2: lib.versionAtLeast v1.version v2.version) (lib.filter
+        (v: v.lang == lang
+            && (if version == null then true else isMatching v.version version))
+        versions);

-  buildInputs = [
-    alsa-lib
-    cups.lib
-    dbus
-    flite
-    fontconfig
-    freetype
-    glib
-    gmpxx
-    keyutils.lib
-    libGL
-    libGLU
-    libpcap
-    libtins
-    libuuid
-    libxkbcommon
-    libxml2
-    llvmPackages_12.libllvm.lib
-    matio
-    mpfr
-    ncurses
-    opencv4
-    openjdk11
-    openssl
-    pciutils
-    tre
-    unixODBC
-    xkeyboard_config
-  ] ++ (with xorg; [
-    libICE
-    libSM
-    libX11
-    libXScrnSaver
-    libXcomposite
-    libXcursor
-    libXdamage
-    libXext
-    libXfixes
-    libXi
-    libXinerama
-    libXmu
-    libXrandr
-    libXrender
-    libXtst
-    libxcb
-  ]);
+    found-version =
+      if matching-versions == []
+      then throw ("No registered Mathematica version found to match"
+                  + " version=${version} and language=${lang}")
+      else lib.head matching-versions;

-  wrapProgramFlags = [
-    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ gcc-unwrapped.lib zlib ]}"
-    "--prefix PATH : ${lib.makeBinPath [ stdenv.cc ]}"
-    # Fix libQt errors - #96490
-    "--set USE_WOLFRAM_LD_LIBRARY_PATH 1"
-    # Fix xkeyboard config path for Qt
-    "--set QT_XKB_CONFIG_ROOT ${xkeyboard_config}/share/X11/xkb"
-  ];
+    specific-drv = ./. + "/(lib.versions.major found-version.version).nix";

-  unpackPhase = ''
-    runHook preUnpack
+    real-drv = if lib.pathExists specific-drv
+               then specific-drv
+               else ./generic.nix;

-    # Find offset from file
-    offset=$(${stdenv.shell} -c "$(grep -axm1 -e 'offset=.*' $src); echo \$offset" $src)
-    tail -c +$(($offset + 1)) $src | tar -xf -
+    isMatching = v1: v2:
+      let as      = lib.splitVersion v1;
+          bs      = lib.splitVersion v2;
+          n       = lib.min (lib.length as) (lib.length bs);
+          sublist = l: lib.sublist 0 n l;
+      in lib.compareLists lib.compare (sublist as) (sublist bs) == 0;

-    runHook postUnpack
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    cd "$TMPDIR/Unix/Installer"
-
-    mkdir -p "$out/lib/udev/rules.d"
-
-    # Patch MathInstaller's shebangs and udev rules dir
-    patchShebangs MathInstaller
-    substituteInPlace MathInstaller \
-      --replace /etc/udev/rules.d $out/lib/udev/rules.d
-
-    # Remove PATH restriction, root and avahi daemon checks, and hostname call
-    sed -i '
-      s/^PATH=/# &/
-      s/isRoot="false"/# &/
-      s/^checkAvahiDaemon$/# &/
-      s/`hostname`/""/
-    ' MathInstaller
-
-    # NOTE: some files placed under HOME may be useful
-    XDG_DATA_HOME="$out/share" HOME="$TMPDIR/home" vernierLink=y \
-      ./MathInstaller -execdir="$out/bin" -targetdir="$out/libexec/Mathematica" -auto -verbose -createdir=y
-
-    # Check if MathInstaller produced any errors
-    errLog="$out/libexec/Mathematica/InstallErrors"
-    if [ -f "$errLog" ]; then
-      echo "Installation errors:"
-      cat "$errLog"
-      return 1
-    fi
-
-    runHook postInstall
-  '';
-
-  preFixup = ''
-    for bin in $out/libexec/Mathematica/Executables/*; do
-      wrapProgram "$bin" ''${wrapProgramFlags[@]}
-    done
-  '';
-
-  dontConfigure = true;
-  dontBuild = true;
-
-  # This is primarily an IO bound build; there's little benefit to building remotely
-  preferLocalBuild = true;
-
-  # All binaries are already stripped
-  dontStrip = true;
-
-  # NOTE: Some deps are still not found; ignore for now
-  autoPatchelfIgnoreMissingDeps = true;
+in

+callPackage real-drv {
+  inherit cudaSupport cudaPackages;
+  inherit (found-version) version lang src;
+  name = ("mathematica"
+          + lib.optionalString cudaSupport "-cuda"
+          + "-${found-version.version}"
+          + lib.optionalString (lang != "en") "-${lang}");
  meta = with lib; {
    description = "Wolfram Mathematica computational software system";
    homepage = "http://www.wolfram.com/mathematica/";
--- a/pkgs/applications/science/math/mathematica/generic.nix
+++ b/pkgs/applications/science/math/mathematica/generic.nix
@ -0,0 +1,192 @@
+{ addOpenGLRunpath
+, autoPatchelfHook
+, lib
+, makeWrapper
+, requireFile
+, runCommand
+, stdenv
+, symlinkJoin
+# arguments from default.nix
+, lang
+, meta
+, name
+, src
+, version
+# dependencies
+, alsa-lib
+, cudaPackages
+, cups
+, dbus
+, flite
+, fontconfig
+, freetype
+, gcc-unwrapped
+, glib
+, gmpxx
+, keyutils
+, libGL
+, libGLU
+, libpcap
+, libtins
+, libuuid
+, libxkbcommon
+, libxml2
+, llvmPackages_12
+, matio
+, mpfr
+, ncurses
+, opencv4
+, openjdk11
+, openssl
+, pciutils
+, tre
+, unixODBC
+, xkeyboard_config
+, xorg
+, zlib
+# options
+, cudaSupport
+}:
+
+let cudaEnv = symlinkJoin {
+      name = "mathematica-cuda-env";
+      paths = with cudaPackages; [
+        cuda_cudart cuda_nvcc libcublas libcufft libcurand libcusparse
+      ];
+      postBuild = ''
+        ln -s ${addOpenGLRunpath.driverLink}/lib/libcuda.so $out/lib
+        ln -s lib $out/lib64
+      '';
+    };
+
+in stdenv.mkDerivation {
+  inherit meta name src version;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    makeWrapper
+  ] ++ lib.optional cudaSupport addOpenGLRunpath;
+
+  buildInputs = [
+    alsa-lib
+    cups.lib
+    dbus
+    flite
+    fontconfig
+    freetype
+    glib
+    gmpxx
+    keyutils.lib
+    libGL
+    libGLU
+    libpcap
+    libtins
+    libuuid
+    libxkbcommon
+    libxml2
+    llvmPackages_12.libllvm.lib
+    matio
+    mpfr
+    ncurses
+    opencv4
+    openjdk11
+    openssl
+    pciutils
+    tre
+    unixODBC
+    xkeyboard_config
+  ] ++ (with xorg; [
+    libICE
+    libSM
+    libX11
+    libXScrnSaver
+    libXcomposite
+    libXcursor
+    libXdamage
+    libXext
+    libXfixes
+    libXi
+    libXinerama
+    libXmu
+    libXrandr
+    libXrender
+    libXtst
+    libxcb
+  ]) ++ lib.optional cudaSupport cudaEnv;
+
+  wrapProgramFlags = [
+    "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ gcc-unwrapped.lib zlib ]}"
+    "--prefix PATH : ${lib.makeBinPath [ stdenv.cc ]}"
+    # Fix libQt errors - #96490
+    "--set USE_WOLFRAM_LD_LIBRARY_PATH 1"
+    # Fix xkeyboard config path for Qt
+    "--set QT_XKB_CONFIG_ROOT ${xkeyboard_config}/share/X11/xkb"
+  ] ++ lib.optionals cudaSupport [
+    "--set CUDA_PATH ${cudaEnv}"
+    "--set NVIDIA_DRIVER_LIBRARY_PATH ${addOpenGLRunpath.driverLink}/lib/libnvidia-tls.so"
+    "--set CUDA_LIBRARY_PATH ${addOpenGLRunpath.driverLink}/lib/libcuda.so"
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    # Find offset from file
+    offset=$(${stdenv.shell} -c "$(grep -axm1 -e 'offset=.*' $src); echo \$offset" $src)
+    tail -c +$(($offset + 1)) $src | tar -xf -
+
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cd "$TMPDIR/Unix/Installer"
+
+    mkdir -p "$out/lib/udev/rules.d"
+
+    # Patch MathInstaller's shebangs and udev rules dir
+    patchShebangs MathInstaller
+    substituteInPlace MathInstaller \
+      --replace /etc/udev/rules.d $out/lib/udev/rules.d
+
+    # Remove PATH restriction, root and avahi daemon checks, and hostname call
+    sed -i '
+      s/^PATH=/# &/
+      s/isRoot="false"/# &/
+      s/^checkAvahiDaemon$/# &/
+      s/`hostname`/""/
+    ' MathInstaller
+
+    # NOTE: some files placed under HOME may be useful
+    XDG_DATA_HOME="$out/share" HOME="$TMPDIR/home" vernierLink=y \
+      ./MathInstaller -execdir="$out/bin" -targetdir="$out/libexec/Mathematica" -auto -verbose -createdir=y
+
+    # Check if MathInstaller produced any errors
+    errLog="$out/libexec/Mathematica/InstallErrors"
+    if [ -f "$errLog" ]; then
+      echo "Installation errors:"
+      cat "$errLog"
+      return 1
+    fi
+
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    for bin in $out/libexec/Mathematica/Executables/*; do
+      wrapProgram "$bin" ''${wrapProgramFlags[@]}
+    done
+  '';
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  # This is primarily an IO bound build; there's little benefit to building remotely
+  preferLocalBuild = true;
+
+  # All binaries are already stripped
+  dontStrip = true;
+
+  # NOTE: Some deps are still not found; ignore for now
+  autoPatchelfIgnoreMissingDeps = true;
+}
--- a/pkgs/applications/science/math/mathematica/l10ns.nix
+++ b/pkgs/applications/science/math/mathematica/l10ns.nix
@ -1,106 +0,0 @@
-{ lib
-, requireFile
-, lang
-, majorVersion ? null
-}:
-
-let allVersions = with lib; flip map
-  # N.B. Versions in this list should be ordered from newest to oldest.
-  [
-    {
-      version = "13.0.1";
-      lang = "en";
-      language = "English";
-      sha256 = "3672a920c1b4af1afd480733f6d67665baf8258757dfe59a6ed6d7440cf26dba";
-      installer = "Mathematica_13.0.1_BNDL_LINUX.sh";
-    }
-    {
-      version = "13.0.0";
-      lang = "en";
-      language = "English";
-      sha256 = "15bbad39a5995031325d1d178f63b00e71706d3ec9001eba6d1681fbc991d3e1";
-      installer = "Mathematica_13.0.0_BNDL_LINUX.sh";
-    }
-    {
-      version = "12.3.1";
-      lang = "en";
-      language = "English";
-      sha256 = "51b9cab12fd91b009ea7ad4968a2c8a59e94dc55d2e6cc1d712acd5ba2c4d509";
-      installer = "Mathematica_12.3.1_LINUX.sh";
-    }
-    {
-      version = "12.3.0";
-      lang = "en";
-      language = "English";
-      sha256 = "045df045f6e796ded59f64eb2e0f1949ac88dcba1d5b6e05fb53ea0a4aed7215";
-      installer = "Mathematica_12.3.0_LINUX.sh";
-    }
-    {
-      version = "12.2.0";
-      lang = "en";
-      language = "English";
-      sha256 = "3b6676a203c6adb7e9c418a5484b037974287b5be09c64e7dfea74ddc0e400d7";
-      installer = "Mathematica_12.2.0_LINUX.sh";
-    }
-    {
-      version = "12.1.1";
-      lang = "en";
-      language = "English";
-      sha256 = "02mk8gmv8idnakva1nc7r7mx8ld02lk7jgsj1zbn962aps3bhixd";
-      installer = "Mathematica_12.1.1_LINUX.sh";
-    }
-    {
-      version = "12.1.0";
-      lang = "en";
-      language = "English";
-      sha256 = "15m9l20jvkxh5w6mbp81ys7mx2lx5j8acw5gz0il89lklclgb8z7";
-      installer = "Mathematica_12.1.0_LINUX.sh";
-    }
-    {
-      version = "12.0.0";
-      lang = "en";
-      language = "English";
-      sha256 = "b9fb71e1afcc1d72c200196ffa434512d208fa2920e207878433f504e58ae9d7";
-      installer = "Mathematica_12.0.0_LINUX.sh";
-    }
-    {
-      version = "11.3.0";
-      lang = "en";
-      language = "English";
-      sha256 = "0fcfe208c1eac8448e7be3af0bdb84370b17bd9c5d066c013928c8ee95aed10e";
-      installer = "Mathematica_11.3.0_LINUX.sh";
-    }
-    {
-      version = "11.2.0";
-      lang = "ja";
-      language = "Japanese";
-      sha256 = "916392edd32bed8622238df435dd8e86426bb043038a3336f30df10d819b49b1";
-      installer = "Mathematica_11.2.0_ja_LINUX.sh";
-    }
-  ]
-  ({ version, lang, language, sha256, installer }: {
-    inherit version lang;
-    name = "mathematica-${version}" + optionalString (lang != "en") "-${lang}";
-    src = requireFile {
-      name = installer;
-      message = ''
-        This nix expression requires that ${installer} is
-        already part of the store. Find the file on your Mathematica CD
-        and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
-      '';
-      inherit sha256;
-    };
-  });
-minVersion =
-  with lib;
-  if majorVersion == null
-  then elemAt (builtins.splitVersion (elemAt allVersions 0).version) 0
-  else majorVersion;
-maxVersion = toString (1 + builtins.fromJSON minVersion);
-in
-with lib;
-findFirst (l: (l.lang == lang
-               && l.version >= minVersion
-               && l.version < maxVersion))
-          (throw "Version ${minVersion} in language ${lang} not supported")
-          allVersions
--- a/pkgs/applications/science/math/mathematica/versions.nix
+++ b/pkgs/applications/science/math/mathematica/versions.nix
@ -0,0 +1,103 @@
+{ lib, requireFile }:
+
+let versions = [
+  {
+    version = "13.0.1";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-NnKpIMG0rxr9SAcz9tZ2Zbr4JYdX3+WabtbXRAzybbo=";
+    installer = "Mathematica_13.0.1_BNDL_LINUX.sh";
+  }
+  {
+    version = "13.0.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-FbutOaWZUDEyXR0Xj2OwDnFwbT7JAB66bRaB+8mR0+E=";
+    installer = "Mathematica_13.0.0_BNDL_LINUX.sh";
+  }
+  {
+    version = "12.3.1";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-UbnKsS/ZGwCep61JaKLIpZ6U3FXS5swdcSrNW6LE1Qk=";
+    installer = "Mathematica_12.3.1_LINUX.sh";
+  }
+  {
+    version = "12.3.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-BF3wRfbnlt7Vn2TrLg8ZSayI3LodW24F+1PqCkrtchU=";
+    installer = "Mathematica_12.3.0_LINUX.sh";
+  }
+  {
+    version = "12.2.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-O2Z2ogPGrbfpxBilSEsDeXQoe1vgnGTn3+p03cDkANc=";
+    installer = "Mathematica_12.2.0_LINUX.sh";
+  }
+  {
+    version = "12.1.1";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-rUe4hr5KmGTXD1I/eSYVoFHU68mH2aD2VLZFtOtDswo=";
+    installer = "Mathematica_12.1.1_LINUX.sh";
+  }
+  {
+    version = "12.1.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-56P1KKOTJkQj+K9wppAsnYpej/YB3VUNL7DPLYGgqZY=";
+    installer = "Mathematica_12.1.0_LINUX.sh";
+  }
+  {
+    version = "12.0.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-uftx4a/MHXLCABlv+kNFEtII+ikg4geHhDP1BOWK6dc=";
+    installer = "Mathematica_12.0.0_LINUX.sh";
+  }
+  {
+    version = "11.3.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-D8/iCMHqyESOe+OvC9uENwsXvZxdBmwBOSjI7pWu0Q4=";
+    installer = "Mathematica_11.3.0_LINUX.sh";
+  }
+  {
+    version = "11.2.0";
+    lang = "ja";
+    language = "Japanese";
+    sha256 = "sha256-kWOS7dMr7YYiI430Nd2OhkJrsEMDijM28w3xDYGbSbE=";
+    installer = "Mathematica_11.2.0_ja_LINUX.sh";
+  }
+  {
+    version = "9.0.0";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-mKgxdd7dLWa5EOuR5C37SeU+UC9Cv5YTbY5xSK9y34A=";
+    installer = "Mathematica_9.0.0_LINUX.sh";
+  }
+  {
+    version = "10.0.2";
+    lang = "en";
+    language = "English";
+    sha256 = "sha256-NHUg1jzLos1EsIr8TdYdNaA5+3jEcFqVZIr9GVVUXrQ=";
+    installer = "Mathematica_10.0.2_LINUX.sh";
+  }
+];
+
+in
+
+lib.flip map versions ({ version, lang, language, sha256, installer }: {
+  inherit version lang;
+  src = requireFile {
+    name = installer;
+    message = ''
+      This nix expression requires that ${installer} is
+      already part of the store. Find the file on your Mathematica CD
+      and add it to the nix store with nix-store --add-fixed sha256 <FILE>.
+    '';
+    inherit sha256;
+  };
+})
--- a/pkgs/applications/version-management/git-and-tools/delta/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/delta/default.nix
@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "delta";
-  version = "0.12.1";
+  version = "0.13.0";

  src = fetchFromGitHub {
    owner = "dandavison";
    repo = pname;
    rev = version;
-    sha256 = "sha256-khW+Ri+MZytMZcd2tRXhc/D6kOOhk+LP6MsS+GijjQM=";
+    sha256 = "sha256-5h4epV3RORZiynW1fkFLImqPunC3PZ/YzLiSrzescww=";
  };

-  cargoSha256 = "sha256-SD1y+l86wqlJUUaG4ae4PXXSMS+4CPth3F4pLYbXMVc=";
+  cargoSha256 = "sha256-4dPTcrT8Gx3WfT0sauqnCSmcGE9LrgIqgHrY5l503ZA=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/video/ogmtools/default.nix
+++ b/pkgs/applications/video/ogmtools/default.nix
@ -11,6 +11,8 @@ stdenv.mkDerivation rec {

  buildInputs = [ libogg libvorbis libdvdread ];

+  NIX_CFLAGS_COMPILE = [ "-std=c++14" ];
+
  meta = {
    description = "Tools for modifying and inspecting OGG media streams";
    longDescription = ''
--- a/pkgs/build-support/coq/default.nix
+++ b/pkgs/build-support/coq/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, coqPackages, coq, which, fetchzip }@args:
+{ lib, stdenv, coqPackages, coq, fetchzip }@args:
 let lib = import ./extra-lib.nix {inherit (args) lib;}; in
 with builtins; with lib;
 let
@ -15,12 +15,8 @@ in
  releaseRev ? (v: v),
  displayVersion ? {},
  release ? {},
-  buildInputs ? [],
-  nativeBuildInputs ? [],
  extraBuildInputs ? [],
  extraNativeBuildInputs ? [],
-  overrideBuildInputs ? [],
-  overrideNativeBuildInputs ? [],
  namePrefix ? [ "coq" ],
  enableParallelBuilding ? true,
  extraInstallFlags ? [],
@ -39,11 +35,7 @@ let
  args-to-remove = foldl (flip remove) ([
    "version" "fetcher" "repo" "owner" "domain" "releaseRev"
    "displayVersion" "defaultVersion" "useMelquiondRemake"
-    "release"
-    "buildInputs" "nativeBuildInputs"
-    "extraBuildInputs" "extraNativeBuildInputs"
-    "overrideBuildInputs" "overrideNativeBuildInputs"
-    "namePrefix"
+    "release" "extraBuildInputs" "extraNativeBuildInputs" "extraPropagatedBuildInputs" "namePrefix"
    "meta" "useDune2ifVersion" "useDune2" "opam-name"
    "extraInstallFlags" "setCOQBIN" "mlPlugin"
    "dropAttrs" "dropDerivationAttrs" "keepAttrs" ] ++ dropAttrs) keepAttrs;
@ -65,16 +57,9 @@ let
    ] "") + optionalString (v == null) "-broken";
  append-version = p: n: p + display-pkg n "" coqPackages.${n}.version + "-";
  prefix-name = foldl append-version "" namePrefix;
+  var-coqlib-install =
+    (optionalString (versions.isGe "8.7" coq.coq-version || coq.coq-version == "dev") "COQMF_") + "COQLIB";
  useDune2 = args.useDune2 or (useDune2ifVersion fetched.version);
-  coqlib-flags = switch coq.coq-version [
-    { case = v: versions.isLe "8.6" v && v != "dev" ;
-      out = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ]; }
-  ] [ "COQLIBINSTALL=$(out)/lib/coq/${coq.coq-version}/user-contrib"
-      "COQPLUGININSTALL=$(OCAMLFIND_DESTDIR)" ];
-  docdir-flags = switch coq.coq-version [
-    { case = v: versions.isLe "8.6" v && v != "dev";
-      out = [ "DOCDIR=$(out)/share/coq/${coq.coq-version}/" ]; }
-  ] [ "COQDOCINSTALL=$(out)/share/coq/${coq.coq-version}/user-contrib" ];
 in

 stdenv.mkDerivation (removeAttrs ({
@ -83,12 +68,12 @@ stdenv.mkDerivation (removeAttrs ({

  inherit (fetched) version src;

-  nativeBuildInputs = args.overrideNativeBuildInputs
-    or ([ which ] ++ optional useDune2 coq.ocamlPackages.dune_2
-        ++ optional (useDune2 || mlPlugin) coq.ocaml
-        ++ (args.nativeBuildInputs or []) ++ extraNativeBuildInputs);
-  buildInputs = args.overrideBuildInputs
-    or ([ coq ] ++ (args.buildInputs or []) ++ extraBuildInputs);
+  nativeBuildInputs = [ coq ]
+    ++ optionals useDune2 [coq.ocaml coq.ocamlPackages.dune_2]
+    ++ optionals mlPlugin coq.ocamlNativeBuildInputs
+    ++ extraNativeBuildInputs;
+  buildInputs = optionals mlPlugin coq.ocamlBuildInputs
+    ++ extraBuildInputs;
  inherit enableParallelBuilding;

  meta = ({ platforms = coq.meta.platforms; } //
@ -103,7 +88,9 @@ stdenv.mkDerivation (removeAttrs ({
 // (optionalAttrs setCOQBIN { COQBIN = "${coq}/bin/"; })
 // (optionalAttrs (!args?installPhase && !args?useMelquiondRemake) {
  installFlags =
-    [ "DESTDIR=$(out)" ] ++ coqlib-flags ++ docdir-flags ++
+    [ "${var-coqlib-install}=$(out)/lib/coq/${coq.coq-version}/" ] ++
+    optional (match ".*doc$" (args.installTargets or "") != null)
+      "DOCDIR=$(out)/share/coq/${coq.coq-version}/" ++
    extraInstallFlags;
 })
 // (optionalAttrs useDune2 {
--- a/pkgs/build-support/kernel/compress-firmware-xz.nix
+++ b/pkgs/build-support/kernel/compress-firmware-xz.nix
@ -0,0 +1,16 @@
+{ runCommand }:
+
+firmware:
+
+runCommand "${firmware.name}-xz" {} ''
+  mkdir -p $out/lib
+  (cd ${firmware} && find lib/firmware -type d -print0) |
+      (cd $out && xargs -0 mkdir -v --)
+  (cd ${firmware} && find lib/firmware -type f -print0) |
+      (cd $out && xargs -0tP "$NIX_BUILD_CORES" -n1 \
+          sh -c 'xz -9c -T1 -C crc32 --lzma2=dict=2MiB "${firmware}/$1" > "$1.xz"' --)
+  (cd ${firmware} && find lib/firmware -type l) | while read link; do
+      target="$(readlink "${firmware}/$link")"
+      ln -vs -- "''${target/^${firmware}/$out}.xz" "$out/$link.xz"
+  done
+''
--- a/pkgs/build-support/kernel/modules-closure.sh
+++ b/pkgs/build-support/kernel/modules-closure.sh
@ -81,8 +81,12 @@ for module in $(cat closure); do
    for i in $(modinfo -b $kernel --set-version "$version" -F firmware $module | grep -v '^name:'); do
        mkdir -p "$out/lib/firmware/$(dirname "$i")"
        echo "firmware for $module: $i"
-        cp "$firmware/lib/firmware/$i" "$out/lib/firmware/$i" 2>/dev/null \
-            || echo "WARNING: missing firmware $i for module $module"
+        for name in "$i" "$i.xz" ""; do
+            [ -z "$name" ] && echo "WARNING: missing firmware $i for module $module"
+            if cp "$firmware/lib/firmware/$name" "$out/lib/firmware/$name" 2>/dev/null; then
+                break
+            fi
+        done
    done
 done

--- a/pkgs/data/fonts/ibm-plex/default.nix
+++ b/pkgs/data/fonts/ibm-plex/default.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:

 let
-  version = "6.0.0";
+  version = "6.0.1";

 in fetchzip {
  name = "ibm-plex-${version}";
@ -13,7 +13,7 @@ in fetchzip {
    unzip -j $downloadedFile "OpenType/*/*.otf" -x "OpenType/IBM-Plex-Sans-JP/unhinted/*" -d $out/share/fonts/opentype
  '';

-  sha256 = "0zv9kw4hmchf374pl0iajzybmx5wklsplg56j115m46i4spij6mr";
+  sha256 = "sha256-HxO0L5Q6WJQBqtg64cczzuRcSYi4jEqbOzEWxDmqFp8=";

  meta = with lib; {
    description = "IBM Plex Typeface";
--- a/pkgs/data/fonts/public-sans/default.nix
+++ b/pkgs/data/fonts/public-sans/default.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:

 let
-  version = "2.000";
+  version = "2.001";
 in fetchzip {
  name = "public-sans-${version}";

@ -13,11 +13,12 @@ in fetchzip {
    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
  '';

-  sha256 = "0r34h9mim5c3h48cpq2m2ixkdqhv3i594pip10pavkmskldpbha5";
+  sha256 = "sha256-Ba7D4J72GZQsGn0KINRib9BmHsAnoEsAwAOC+M3CkMU=";

  meta = with lib; {
    description = "A strong, neutral, principles-driven, open source typeface for text or display";
    homepage = "https://public-sans.digital.gov/";
+    changelog = "https://github.com/uswds/public-sans/raw/v${version}/FONTLOG.txt";
    license = licenses.ofl;
    maintainers = with maintainers; [ dtzWill ];
    platforms = platforms.all;
--- a/pkgs/data/fonts/work-sans/default.nix
+++ b/pkgs/data/fonts/work-sans/default.nix
@ -1,23 +1,19 @@
-{ lib, fetchFromGitHub }:
+{ lib, fetchzip }:

 let
-  version = "1.6";
-in fetchFromGitHub {
+  version = "2.010";
+in
+fetchzip {
  name = "work-sans-${version}";

-  owner = "weiweihuanghuang";
-  repo = "Work-Sans";
-  rev = "v${version}";
+  url = "https://github.com/weiweihuanghuang/Work-Sans/archive/refs/tags/v${version}.zip";

  postFetch = ''
-    tar xf $downloadedFile --strip=1
-    install -m444 -Dt $out/share/fonts/opentype/ fonts/desktop/*.otf
-    install -m444 -Dt $out/share/fonts/truetype/ fonts/webfonts/ttf/*.ttf
-    install -m444 -Dt $out/share/fonts/woff/     fonts/webfonts/woff/*.woff
-    install -m444 -Dt $out/share/fonts/woff2/    fonts/webfonts/woff2/*.woff2
+    mkdir -p $out/share/fonts
+    unzip -j $downloadedFile "*/fonts/*.ttf" -d $out/share/fonts/opentype
  '';

-  sha256 = "01kjidk6zv80rqxapcdwhd9wxzrjfc6lj4gkf6dwa4sskw5x3b8a";
+  sha256 = "sha256-S4O5EoKY4w/p+MHeHRCmPyQRAOUfEwNiETxMgNcsrws=";

  meta = with lib; {
    description = "A grotesque sans";
--- a/pkgs/data/themes/flat-remix-gnome/default.nix
+++ b/pkgs/data/themes/flat-remix-gnome/default.nix
@ -7,25 +7,25 @@
 let
  # make install will use dconf to find desktop background file uri.
  # consider adding an args to allow specify pictures manually.
-  # https://github.com/daniruiz/flat-remix-gnome/blob/20220422/Makefile#L38
+  # https://github.com/daniruiz/flat-remix-gnome/blob/20220510/Makefile#L38
  fake-dconf = writeScriptBin "dconf" "echo -n";
 in
 stdenv.mkDerivation rec {
  pname = "flat-remix-gnome";
-  version = "20220422";
+  version = "20220510";

  src = fetchFromGitHub {
    owner = "daniruiz";
    repo = pname;
    rev = version;
-    hash = "sha256-W/BNn10SggtBacelNljPh42jVMBfykJFRWBCaj/ar7U=";
+    hash = "sha256-sqHX3APeblZai6NBgY+bnRnkzn6CGXwppiQ4pb8HTTw=";
  };

  nativeBuildInputs = [ glib fake-dconf ];
  makeFlags = [ "PREFIX=$(out)" ];
  preInstall = ''
    # make install will back up this file, it will fail if the file doesn't exist.
-    # https://github.com/daniruiz/flat-remix-gnome/blob/20220422/Makefile#L56
+    # https://github.com/daniruiz/flat-remix-gnome/blob/20220510/Makefile#L56
    mkdir -p $out/share/gnome-shell/
    touch $out/share/gnome-shell/gnome-shell-theme.gresource
  '';
--- a/pkgs/development/compilers/crystal/build-package.nix
+++ b/pkgs/development/compilers/crystal/build-package.nix
@ -72,16 +72,17 @@ stdenv.mkDerivation (mkDerivationArgs // {

  PREFIX = placeholder "out";

-  buildInputs = args.buildInputs or [ ] ++ [ crystal ]
-    ++ lib.optional (format != "crystal") shards;
+  strictDeps = true;
+  buildInputs = args.buildInputs or [ ] ++ [ crystal ];

  nativeBuildInputs = args.nativeBuildInputs or [ ] ++ [
+    crystal
    git
    installShellFiles
    removeReferencesTo
    pkg-config
    which
-  ];
+  ] ++ lib.optional (format != "crystal") shards;

  buildPhase = args.buildPhase or (lib.concatStringsSep "\n" ([
    "runHook preBuild"
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@ -145,9 +145,10 @@ let
        export CRYSTAL_CACHE_DIR=$TMP
      '';

-      buildInputs = commonBuildInputs extraBuildInputs;

+      strictDeps = true;
      nativeBuildInputs = [ binary makeWrapper which pkg-config llvmPackages.llvm ];
+      buildInputs = commonBuildInputs extraBuildInputs;

      makeFlags = [
        "CRYSTAL_CONFIG_VERSION=${version}"
--- a/pkgs/development/compilers/mercury/default.nix
+++ b/pkgs/development/compilers/mercury/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "mercury";
-  version = "20.06.1";
+  version = "22.01.1";

  src = fetchurl {
    url    = "https://dl.mercurylang.org/release/mercury-srcdist-${version}.tar.gz";
-    sha256 = "ef093ae81424c4f3fe696eff9aefb5fb66899e11bb17ae0326adfb70d09c1c1f";
+    sha256 = "sha256-Cg0ixQtpmus6Q3fuc45OLheKCCTiTW3z1XJzxQ1OL6c=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/compilers/vyper/default.nix
+++ b/pkgs/development/compilers/vyper/default.nix
@ -2,7 +2,6 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, pythonAtLeast
 , pythonRelaxDepsHook
 , writeText
 , asttokens
@ -13,6 +12,7 @@
 , sphinx_rtd_theme
 , pytest-runner
 , setuptools-scm
+, git
 }:

 let
@ -27,17 +27,21 @@ let
 in
 buildPythonPackage rec {
  pname = "vyper";
-  version = "0.3.1";
+  version = "0.3.3";
  format = "setuptools";

-  disabled = pythonOlder "3.7" || pythonAtLeast "3.10";
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-fXug5v3zstz19uexMWokHBVsfcl2ZCdIOIXKeLVyh/Q=";
+    sha256 = "sha256-BAnNj27B1HAb9VVDA69bFGbQjeOpl0g5EB2juajqBAw=";
  };

  nativeBuildInputs = [
+    # Git is used in setup.py to compute version information during building
+    # ever since https://github.com/vyperlang/vyper/pull/2816
+    git
+
    pythonRelaxDepsHook
    pytest-runner
    setuptools-scm
--- a/pkgs/development/coq-modules/CoLoR/default.nix
+++ b/pkgs/development/coq-modules/CoLoR/default.nix
@ -20,7 +20,7 @@ with lib; mkCoqDerivation {
  release."1.4.0".rev    = "168c6b86c7d3f87ee51791f795a8828b1521589a";
  release."1.4.0".sha256 = "1d2whsgs3kcg5wgampd6yaqagcpmzhgb6a0hp6qn4lbimck5dfmm";

-  propagatedBuildInputs = [ bignums ];
+  extraBuildInputs = [ bignums ];
  enableParallelBuilding = false;

  meta = {
--- a/pkgs/development/coq-modules/HoTT/default.nix
+++ b/pkgs/development/coq-modules/HoTT/default.nix
@ -8,7 +8,7 @@ with lib; mkCoqDerivation {
  release."20170921".rev    = "e3557740a699167e6adb1a65855509d55a392fa1";
  release."20170921".sha256 = "0zwfp8g62b50vmmbb2kmskj3v6w7qx1pbf43yw0hr7asdz2zbx5v";

-  nativeBuildInputs = [ autoconf automake ];
+  extraBuildInputs = [ autoconf automake ];

  preConfigure = ''
    patchShebangs ./autogen.sh
--- a/pkgs/development/coq-modules/QuickChick/default.nix
+++ b/pkgs/development/coq-modules/QuickChick/default.nix
@ -36,7 +36,8 @@ let recent = lib.versions.isGe "8.7" coq.coq-version; in
    "substituteInPlace Makefile --replace quickChickTool.byte quickChickTool.native";

  mlPlugin = true;
-  nativeBuildInputs = lib.optional recent coq.ocamlPackages.ocamlbuild;
+  extraNativeBuildInputs = lib.optional recent coq.ocamlPackages.ocamlbuild;
+  extraBuildInputs = lib.optional recent coq.ocamlPackages.num;
  propagatedBuildInputs = [ ssreflect ]
    ++ lib.optionals recent [ coq-ext-lib simple-io ];
  extraInstallFlags = [ "-f Makefile.coq" ];
--- a/pkgs/development/coq-modules/VST/default.nix
+++ b/pkgs/development/coq-modules/VST/default.nix
@ -31,7 +31,7 @@ mkCoqDerivation {
  release."2.9".sha256 = "sha256:1adwzbl1pprrrwrm7cm493098fizxanxpv7nyfbvwdhgbhcnv6qf";
  release."2.8".sha256 = "sha256-cyK88uzorRfjapNQ6XgQEmlbWnDsiyLve5po1VG52q0=";
  releaseRev = v: "v${v}";
-  buildInputs = [ ITree ];
+  extraBuildInputs = [ ITree ];
  propagatedBuildInputs = [ compcert ];

  preConfigure = ''
--- a/pkgs/development/coq-modules/bignums/default.nix
+++ b/pkgs/development/coq-modules/bignums/default.nix
@ -5,7 +5,7 @@ with lib; mkCoqDerivation {
  owner = "coq";
  displayVersion = { bignums = ""; };
  inherit version;
-  defaultVersion = if versions.isGe "8.6" coq.coq-version
+  defaultVersion = if versions.isGe "8.5" coq.coq-version
    then "${coq.coq-version}.0" else null;

  release."8.15.0".sha256 = "093klwlhclgyrba1iv18dyz1qp5f0lwiaa7y0qwvgmai8rll5fns";
--- a/pkgs/development/coq-modules/compcert/default.nix
+++ b/pkgs/development/coq-modules/compcert/default.nix
@ -1,5 +1,5 @@
 { lib, fetchzip, mkCoqDerivation, coq, flocq, compcert
-, fetchpatch, makeWrapper, coq2html
+, ocamlPackages, fetchpatch, makeWrapper, coq2html
 , stdenv, tools ? stdenv.cc
 , version ? null
 }:
@ -15,9 +15,9 @@ let compcert = mkCoqDerivation rec {
  releaseRev = v: "v${v}";

  defaultVersion =  with versions; switch coq.version [
-      { case = range "8.13" "8.15"; out = "3.10"; }
-      { case = isEq "8.12"       ; out = "3.9"; }
      { case = range "8.8" "8.11"; out = "3.8"; }
+      { case = isEq "8.12"       ; out = "3.9"; }
+      { case = range "8.12" "8.15"; out = "3.10"; }
    ] null;

  release = {
@ -26,9 +26,8 @@ let compcert = mkCoqDerivation rec {
    "3.10".sha256 = "sha256:19rmx8r8v46101ij5myfrz60arqjy7q3ra3fb8mxqqi3c8c4l4j6";
  };

-  mlPlugin = true;
  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = with coq.ocamlPackages; [ menhir menhirLib ] ++ [ coq2html ];
+  buildInputs = with ocamlPackages; [ ocaml findlib menhir menhirLib ] ++ [ coq coq2html ];
  propagatedBuildInputs = [ flocq ];

  enableParallelBuilding = true;
@ -49,13 +48,9 @@ let compcert = mkCoqDerivation rec {
  '';

  installTargets = "documentation install";
-  installFlags = []; # trust ./configure
-  preInstall = ''
-    mkdir -p $out/share/man
-    mkdir -p $man/share
-  '';
  postInstall = ''
    # move man into place
+    mkdir -p $man/share
    mv $out/share/man/ $man/share/

    # move docs into place
--- a/pkgs/development/coq-modules/coq-bits/default.nix
+++ b/pkgs/development/coq-modules/coq-bits/default.nix
@ -1,18 +1,34 @@
-{ lib, mkCoqDerivation, coq, mathcomp-algebra, version ? null }:
+{ lib, mkCoqDerivation, coq, mathcomp, version ? null }:

 with lib; mkCoqDerivation {
  pname = "coq-bits";
  repo = "bits";
  inherit version;
-  defaultVersion = with versions; switch coq.coq-version [
-    { case = isGe "8.10"; out = "1.1.0"; }
-    { case = isGe "8.7";  out = "1.0.0"; }
-  ] null;
+  defaultVersion =
+    if versions.isGe "8.10" coq.version
+    then "1.1.0"
+    else if versions.isGe "8.7" coq.version
+    then "1.0.0"
+    else null;

-  release."1.1.0".sha256 = "sha256-TCw1kSXeW0ysIdLeNr+EGmpGumEE9i8tinEMp57UXaE=";
-  release."1.0.0".sha256 = "0nv5mdgrd075dpd8bc7h0xc5i95v0pkm0bfyq5rj6ii1s54dwcjl";
+  release = {
+    "1.0.0" = {
+      rev = "1.0.0";
+      sha256 = "0nv5mdgrd075dpd8bc7h0xc5i95v0pkm0bfyq5rj6ii1s54dwcjl";
+    };
+    "1.1.0" = {
+      rev = "1.1.0";
+      sha256 = "sha256-TCw1kSXeW0ysIdLeNr+EGmpGumEE9i8tinEMp57UXaE=";
+    };
+  };

-  propagatedBuildInputs = [ mathcomp-algebra ];
+  extraBuildInputs = [ mathcomp.ssreflect mathcomp.fingroup ];
+  propagatedBuildInputs = [ mathcomp.algebra ];
+
+  installPhase = ''
+    make -f Makefile CoqMakefile
+    make -f CoqMakefile COQLIB=$out/lib/coq/${coq.coq-version}/ install
+  '';

  meta = {
    description = "A formalization of bitset operations in Coq";
--- a/pkgs/development/coq-modules/coq-elpi/default.nix
+++ b/pkgs/development/coq-modules/coq-elpi/default.nix
@ -7,7 +7,7 @@ with builtins; with lib; let
    { case = "8.13"; out = { version = "1.13.7"; };}
    { case = "8.14"; out = { version = "1.13.7"; };}
    { case = "8.15"; out = { version = "1.14.1"; };}
-  ] { version = "1.14.1"; } );
+  ] {});
 in mkCoqDerivation {
  pname = "elpi";
  repo  = "coq-elpi";
@ -48,8 +48,8 @@ in mkCoqDerivation {
  release."1.6.0".sha256      = "0kf99i43mlf750fr7fric764mm495a53mg5kahnbp6zcjcxxrm0b";
  releaseRev = v: "v${v}";

+  extraNativeBuildInputs = [ which elpi ];
  mlPlugin = true;
-  propagatedBuildInputs = [ elpi ];

  meta = {
    description = "Coq plugin embedding ELPI.";
--- a/pkgs/development/coq-modules/coqeal/default.nix
+++ b/pkgs/development/coq-modules/coqeal/default.nix
@ -1,6 +1,6 @@
 { coq, mkCoqDerivation, mathcomp, bignums, paramcoq, multinomials,
  mathcomp-real-closed,
-  lib, version ? null }:
+  lib, which, version ? null }:

 with lib;

@ -22,6 +22,7 @@ with lib;
  release."1.0.4".sha256 = "1g5m26lr2lwxh6ld2gykailhay4d0ayql4bfh0aiwqpmmczmxipk";
  release."1.0.3".sha256 = "0hc63ny7phzbihy8l7wxjvn3haxx8jfnhi91iw8hkq8n29i23v24";

+  extraBuildInputs = [ which ];
  propagatedBuildInputs = [ mathcomp.algebra bignums paramcoq multinomials ];

  meta = {
--- a/pkgs/development/coq-modules/coqhammer/default.nix
+++ b/pkgs/development/coq-modules/coqhammer/default.nix
@ -28,10 +28,8 @@ with lib; mkCoqDerivation {
  release."1.3-coq8.12".sha256   = "1q1y3cwhd98pkm98g71fsdjz85bfwgcz2xn7s7wwmiraifv5l6z8";
  release."1.3-coq8.11".sha256   = "08zf8qfna7b9p2myfaz4g7bas3a1q1156x78n5isqivlnqfrjc1b";
  release."1.3-coq8.10".sha256   = "1fj8497ir4m79hyrmmmmrag01001wrby0h24wv6525vz0w5py3cd";
-  release."1.1.1-coq8.9" = { sha256 = "1knjmz4hr8vlp103j8n4fyb2lfxysnm512gh3m2kp85n6as6fvb9";
-                             rev    = "f8b4d81a213aa1f25afbe53c7c9ca1b15e3d42bc"; };
-  release."1.1-coq8.8" =   { sha256 = "0ms086wp4jmrzyglb8wymchzyflflk01nsfsk4r6qv8rrx81nx9h";
-                             rev    = "c3cb54b4d5f33fab372d33c7189861368a08fa22"; };
+  release."1.1.1-coq8.9".sha256  = "1knjmz4hr8vlp103j8n4fyb2lfxysnm512gh3m2kp85n6as6fvb9";
+  release."1.1-coq8.8".sha256    = "0ms086wp4jmrzyglb8wymchzyflflk01nsfsk4r6qv8rrx81nx9h";

  release."1.3.1-coq8.13".version  = "1.3.1";
  release."1.3.1-coq8.12".version  = "1.3.1";
--- a/pkgs/development/coq-modules/coqprime/default.nix
+++ b/pkgs/development/coq-modules/coqprime/default.nix
@ -20,6 +20,7 @@ with lib; mkCoqDerivation {
  release."8.7.2".sha256 = "15zlcrx06qqxjy3nhh22wzy0rb4npc8l4nx2bbsfsvrisbq1qb7k";
  releaseRev = v: "v${v}";

+  extraBuildInputs = [ which ];
  propagatedBuildInputs = [ bignums ];

  meta = with lib; {
--- a/pkgs/development/coq-modules/coqtail-math/default.nix
+++ b/pkgs/development/coq-modules/coqtail-math/default.nix
@ -14,7 +14,9 @@ mkCoqDerivation {
  release."8.14".sha256 = "sha256:1k8f8idjnx0mf4z479vcx55iz42rjxrbplbznv80m2famxakq03c";
  release."20201124".rev    = "5c22c3d7dcd8cf4c47cf84a281780f5915488e9e";
  release."20201124".sha256 = "sha256-wd+Lh7dpAD4zfpyKuztDmSFEZo5ZiFrR8ti2jUCVvoQ=";
-  mlPlugin = true;
+
+  extraNativeBuildInputs = with coq.ocamlPackages; [ ocaml findlib ];
+
  meta = {
    license = licenses.lgpl3Only;
    maintainers = [ maintainers.siraben ];
--- a/pkgs/development/coq-modules/coquelicot/default.nix
+++ b/pkgs/development/coq-modules/coquelicot/default.nix
@ -1,4 +1,4 @@
-{ lib, mkCoqDerivation, autoconf,
+{ lib, mkCoqDerivation, which, autoconf,
  coq, ssreflect, version ? null }:

 with lib; mkCoqDerivation {
@ -16,7 +16,7 @@ with lib; mkCoqDerivation {
  release."3.0.2".sha256 = "1rqfbbskgz7b1bcpva8wh3v3456sq2364y804f94sc8y5sij23nl";
  releaseRev = v: "coquelicot-${v}";

-  nativeBuildInputs = [ autoconf ];
+  extraNativeBuildInputs = [ which autoconf ];
  propagatedBuildInputs = [ ssreflect ];
  useMelquiondRemake.logpath = "Coquelicot";

--- a/pkgs/development/coq-modules/dpdgraph/default.nix
+++ b/pkgs/development/coq-modules/dpdgraph/default.nix
@ -39,9 +39,9 @@ mkCoqDerivation {
  release."0.6".sha256   = "0qvar8gfbrcs9fmvkph5asqz4l5fi63caykx3bsn8zf0xllkwv0n";
  releaseRev = v: "v${v}";

-  nativeBuildInputs = [ autoreconfHook ];
+  extraNativeBuildInputs = [ autoreconfHook ];
  mlPlugin = true;
-  buildInputs = [ coq.ocamlPackages.ocamlgraph ];
+  extraBuildInputs = [ coq.ocamlPackages.ocamlgraph ];

  # dpd_compute.ml uses deprecated Pervasives.compare
  # Versions prior to 0.6.5 do not have the WARN_ERR build flag
--- a/pkgs/development/coq-modules/fiat/HEAD.nix
+++ b/pkgs/development/coq-modules/fiat/HEAD.nix
@ -8,10 +8,10 @@ with lib; mkCoqDerivation rec {
  inherit version;
  defaultVersion = if coq.coq-version == "8.5" then "2016-10-24" else null;
  release."2016-10-24".rev    = "7feb6c64be9ebcc05924ec58fe1463e73ec8206a";
-  release."2016-10-24".sha256 = "16y57vibq3f5i5avgj80f4i3aw46wdwzx36k5d3pf3qk17qrlrdi";
+  release."2016-10-24".sha256 = "0griqc675yylf9rvadlfsabz41qy5f5idya30p5rv6ysiakxya64";

  mlPlugin = true;
-  buildInputs = [ python27 ];
+  extraBuildInputs = [ python27 ];

  prePatch = "patchShebangs etc/coq-scripts";

--- a/pkgs/development/coq-modules/flocq/default.nix
+++ b/pkgs/development/coq-modules/flocq/default.nix
@ -1,4 +1,4 @@
-{ lib, bash, autoconf, automake,
+{ lib, which, autoconf, automake,
  mkCoqDerivation, coq, version ? null }:

 with lib; mkCoqDerivation {
@ -16,7 +16,7 @@ with lib; mkCoqDerivation {
  release."2.6.1".sha256 = "0q5a038ww5dn72yvwn5298d3ridkcngb1dik8hdyr3xh7gr5qibj";
  releaseRev = v: "flocq-${v}";

-  nativeBuildInputs = [ bash autoconf ];
+  nativeBuildInputs = [ which autoconf ];
  mlPlugin = true;
  useMelquiondRemake.logpath = "Flocq";

--- a/pkgs/development/coq-modules/gappalib/default.nix
+++ b/pkgs/development/coq-modules/gappalib/default.nix
@ -13,7 +13,7 @@ with lib; mkCoqDerivation {
  release."1.4.4".sha256 = "114q2hgw64j6kqa9mg3qcp1nlf0ia46z2xadq81fnkxqm856ml7l";
  releaseRev = v: "gappalib-coq-${v}";

-  nativeBuildInputs = [ autoconf ];
+  extraNativeBuildInputs = [ which autoconf ];
  mlPlugin = true;
  propagatedBuildInputs = [ flocq ];
  useMelquiondRemake.logpath = "Gappa";
--- a/pkgs/development/coq-modules/heq/default.nix
+++ b/pkgs/development/coq-modules/heq/default.nix
@ -1,26 +1,22 @@
 {lib, fetchzip, mkCoqDerivation, coq, version ? null }:

-let fetcher = {rev, repo, owner, sha256, domain, ...}:
-  fetchzip {
-    url = "https://${domain}/${owner}/${repo}/download/${repo}-${rev}.zip";
-    inherit sha256;
-   }; in
 with lib; mkCoqDerivation {
  pname = "heq";
  repo = "Heq";
-  owner = "gil.hur";
-  domain = "sf.snu.ac.kr";
+  owner = "gil";
+  domain = "mpi-sws.org";
  inherit version fetcher;
  defaultVersion = if versions.isLt "8.8" coq.coq-version then "0.92" else null;
  release."0.92".sha256 = "0cf8y6728n81wwlbpq3vi7l2dbzi7759klypld4gpsjjp1y1fj74";

  mlPlugin = true;
+  propagatedBuildInputs = [ coq ];
+
+  extraInstallFlags = [ "COQLIB=$out/lib/coq/${coq.coq-version}" ];
  preBuild = "cd src";

-  extraInstallFlags = [ "COQLIB=$(out)/lib/coq/${coq.coq-version}/" ];
-
  meta = {
-    homepage = "https://ropas.snu.ac.kr/~gil.hur/Heq/";
+    homepage = "https://www.mpi-sws.org/~gil/Heq/";
    description = "Heq : a Coq library for Heterogeneous Equality";
    maintainers = with maintainers; [ jwiegley ];
  };
--- a/pkgs/development/coq-modules/hierarchy-builder/default.nix
+++ b/pkgs/development/coq-modules/hierarchy-builder/default.nix
@ -1,4 +1,4 @@
-{ lib, mkCoqDerivation, coq, coq-elpi, version ? null }:
+{ lib, mkCoqDerivation, which, coq, coq-elpi, version ? null }:

 with lib; let hb = mkCoqDerivation {
  pname = "hierarchy-builder";
@ -17,10 +17,13 @@ with lib; let hb = mkCoqDerivation {
  release."0.10.0".sha256 = "1a3vry9nzavrlrdlq3cys3f8kpq3bz447q8c4c7lh2qal61wb32h";
  releaseRev = v: "v${v}";

+  extraNativeBuildInputs = [ which ];
+
  propagatedBuildInputs = [ coq-elpi ];

  mlPlugin = true;

+  installFlags = [ "DESTDIR=$(out)" "COQMF_COQLIB=lib/coq/${coq.coq-version}" ];
  extraInstallFlags = [ "VFILES=structures.v" ];

  meta = {
--- a/pkgs/development/coq-modules/interval/default.nix
+++ b/pkgs/development/coq-modules/interval/default.nix
@ -1,5 +1,4 @@
-{ lib, mkCoqDerivation, autoconf, coq, coquelicot, flocq,
-  mathcomp-ssreflect, mathcomp-fingroup, bignums ? null, gnuplot_qt, version ? null }:
+{ lib, mkCoqDerivation, which, autoconf, coq, coquelicot, flocq, mathcomp-ssreflect, mathcomp-fingroup, bignums ? null, gnuplot_qt, version ? null }:

 mkCoqDerivation rec {
  pname = "interval";
@ -21,9 +20,8 @@ mkCoqDerivation rec {
  release."3.3.0".sha256 = "0lz2hgggzn4cvklvm8rpaxvwaryf37i8mzqajqgdxdbd8f12acsz";
  releaseRev = v: "interval-${v}";

-  nativeBuildInputs = [ autoconf ];
-  propagatedBuildInputs = lib.optional (lib.versions.isGe "8.6" coq.coq-version) bignums
-    ++ [ coquelicot flocq mathcomp-ssreflect mathcomp-fingroup ]
+  extraNativeBuildInputs = [ which autoconf ];
+  propagatedBuildInputs = [ bignums coquelicot flocq mathcomp-ssreflect mathcomp-fingroup ]
    ++ lib.optionals (lib.versions.isGe "4.2.0" defaultVersion) [ gnuplot_qt ];
  useMelquiondRemake.logpath = "Interval";
  mlPlugin = true;
--- a/pkgs/development/coq-modules/itauto/default.nix
+++ b/pkgs/development/coq-modules/itauto/default.nix
@ -17,7 +17,7 @@ mkCoqDerivation rec {
  ] null;

  mlPlugin = true;
-  nativeBuildInputs = (with coq.ocamlPackages; [ ocamlbuild ]);
+  extraNativeBuildInputs = (with coq.ocamlPackages; [ ocamlbuild ]);
  enableParallelBuilding = false;

  meta = {
--- a/Show more
+++ b/Show more