Merge staging-next into staging

lib/options.nix

@@ -36,6 +36,9 @@ let
   inherit (lib.types)
     mkOptionType
     ;
+  prioritySuggestion = ''
+   Use `lib.mkForce value` or `lib.mkDefault value` to change the priority on any of these definitions.
+  '';
 in
 rec {
 
@@ -184,7 +187,7 @@ rec {
     if length defs == 1
     then (head defs).value
     else assert length defs > 1;
-      throw "The option `${showOption loc}' is defined multiple times.\n${message}\nDefinition values:${showDefs defs}";
+      throw "The option `${showOption loc}' is defined multiple times while it's expected to be unique.\n${message}\nDefinition values:${showDefs defs}\n${prioritySuggestion}";
 
   /* "Merge" option definitions by checking that they all have the same value. */
   mergeEqualOption = loc: defs:
@@ -195,7 +198,7 @@ rec {
     else if length defs == 1 then (head defs).value
     else (foldl' (first: def:
       if def.value != first.value then
-        throw "The option `${showOption loc}' has conflicting definition values:${showDefs [ first def ]}"
+        throw "The option `${showOption loc}' has conflicting definition values:${showDefs [ first def ]}\n${prioritySuggestion}"
       else
         first) (head defs) (tail defs)).value;
 

maintainers/maintainer-list.nix

@@ -14428,6 +14428,12 @@
     githubId = 139251;
     name = "Tom Hunger";
   };
+  tehmatt = {
+    name = "tehmatt";
+    email = "[email protected]";
+    github = "tehmatt";
+    githubId = 3358866;
+  };
   tejasag = {
     name = "Tejas Agarwal";
     email = "[email protected]";

nixos/modules/services/audio/ympd.nix

@@ -48,8 +48,46 @@ in {
 
     systemd.services.ympd = {
       description = "Standalone MPD Web GUI written in C";
+
       wantedBy = [ "multi-user.target" ];
-      serviceConfig.ExecStart = "${pkgs.ympd}/bin/ympd --host ${cfg.mpd.host} --port ${toString cfg.mpd.port} --webport ${toString cfg.webPort} --user nobody";
+      after = [ "network-online.target" ];
+
+      serviceConfig = {
+        ExecStart = ''
+          ${pkgs.ympd}/bin/ympd \
+            --host ${cfg.mpd.host} \
+            --port ${toString cfg.mpd.port} \
+            --webport ${toString cfg.webPort}
+        '';
+
+        DynamicUser = true;
+        NoNewPrivileges = true;
+
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ProtectHome = "tmpfs";
+
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateIPC = true;
+
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+
+        SystemCallFilter = [
+          "@system-service"
+          "~@process"
+          "~@setuid"
+        ];
+      };
     };
 
   };

pkgs/applications/audio/flac2all/default.nix

@@ -0,0 +1,45 @@
+{ python3Packages, lib, flac, lame, opusTools, vorbis-tools, ffmpeg }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "flac2all";
+  version = "5.1";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "OBjlr7cbSx2WOIfZUNwHy5Hpb2Fmh3vmZdc70JiWsiI=";
+  };
+
+  # Not sure why this is needed, but setup.py expects this to be set
+  postPatch = ''
+    echo ${version} > ./flac2all_pkg/version
+  '';
+
+  propagatedBuildInputs = [
+    python3Packages.pyzmq
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/flac2all \
+      --set PATH ${lib.makeBinPath [
+        # Hard requirements
+        flac
+        lame
+        # Optional deps depending on encoding types
+        opusTools
+        vorbis-tools
+        ffmpeg
+      ]}
+  '';
+
+  # Has no standard tests, so we verify a few imports instead.
+  doCheck = false;
+  pythonImportsCheck = [ "flac2all_pkg.vorbis" "flac2all_pkg.mp3" ];
+
+  meta = with lib; {
+    description = "Multi process, clustered, FLAC to multi codec audio converter with tagging support";
+    homepage = "https://github.com/ZivaVatra/flac2all";
+    license = licenses.gpl3;
+    # TODO: This has only been tested on Linux, but may work on Mac too.
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/misc/keepass/default.nix

@@ -4,11 +4,11 @@ let
   inherit (builtins) add length readFile replaceStrings unsafeDiscardStringContext toString map;
 in buildDotnetPackage rec {
   pname = "keepass";
-  version = "2.53";
+  version = "2.53.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/keepass/KeePass-${version}-Source.zip";
-    hash = "sha256-wpXbLH9VyjJyb+KuQ8xmbik1jq+xqAFRxsxAuLM5MI0=";
+    hash = "sha256-R7KWxlxrhl55nOaDNYwA/cJJl+kd5ZYy6eZVqyrxxnM=";
   };
 
   sourceRoot = ".";

pkgs/applications/networking/browsers/chromium/common.nix

@@ -150,10 +150,10 @@ let
       libdrm wayland mesa.drivers libxkbcommon
       curl
       libepoxy
+      libffi
     ] ++ lib.optional systemdSupport systemd
       ++ lib.optionals cupsSupport [ libgcrypt cups ]
-      ++ lib.optional pulseSupport libpulseaudio
-      ++ lib.optional (chromiumVersionAtLeast "110") libffi;
+      ++ lib.optional pulseSupport libpulseaudio;
 
     patches = [
       # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed):
@@ -293,15 +293,6 @@ let
       chrome_pgo_phase = 0;
       clang_base_path = "${llvmPackages.clang}";
       use_qt = false;
-    } // lib.optionalAttrs (!chromiumVersionAtLeast "110") {
-      # The default has changed to false. We'll build with libwayland from
-      # Nixpkgs for now but might want to eventually use the bundled libwayland
-      # as well to avoid incompatibilities (if this continues to be a problem
-      # from time to time):
-      use_system_libwayland = true;
-      # The default value is hardcoded instead of using pkg-config:
-      system_wayland_scanner_path = "${wayland.bin}/bin/wayland-scanner";
-    } // lib.optionalAttrs (chromiumVersionAtLeast "110") {
       # To fix the build as we don't provide libffi_pic.a
       # (ld.lld: error: unable to find library -l:libffi_pic.a):
       use_system_libffi = true;

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -45,19 +45,19 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "109.0.5414.120",
-    "sha256": "1yvfd0a7zfz4x00f83irrs6hy15wn85mrbbm7mk5wy4gjwg5zyrj",
+    "version": "110.0.5481.78",
+    "sha256": "1m67xfdgggaan09xsbppna209b8sm882xq587i0hsnnnzb3fdxdj",
     "sha256bin64": null,
     "deps": {
       "gn": {
-        "version": "2022-11-10",
+        "version": "2022-12-12",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "1c4151ff5c1d6fbf7fa800b8d4bb34d3abc03a41",
-        "sha256": "02621c9nqpr4pwcapy31x36l5kbyd0vdgd0wdaxj5p8hrxk67d6b"
+        "rev": "5e19d2fb166fbd4f6f32147fbb2f497091a54ad8",
+        "sha256": "1b5fwldfmkkbpp5x63n1dxv0nc965hphc8rm8ah7zg44zscm9z30"
       },
       "ungoogled-patches": {
-        "rev": "109.0.5414.120-1",
-        "sha256": "0hq48lsjl7da8rdq129mc7cd0z5ykqbaf1sbhhs1d10dzm5zs4p3"
+        "rev": "110.0.5481.78-1",
+        "sha256": "1ffb2wf1bdmzlxk4ih8qq439jzqz17f8nchvx7na52y48am1qr3c"
       }
     }
   }

pkgs/applications/networking/cluster/terraform/default.nix

@@ -168,9 +168,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.3.7";
-    sha256 = "sha256-z49DXJ9oYObJQWHPeuKvQ6jJtAheYuy0+QmvZ74ZbTQ";
-    vendorSha256 = "sha256-fviukVGBkbxFs2fJpEp/tFMymXex7NRQdcGIIA9W88k=";
+    version = "1.3.8";
+    sha256 = "sha256-AXLk5s3qu3QZ1aXx/FwPNq3hM26skBj0wyn/x8nVMkE=";
+    vendorSha256 = "sha256-CE6jNBvM0980+R0e5brK5lMrkad+91qTt9mp2h3NZyY=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;

pkgs/development/compilers/picat/default.nix

@@ -9,11 +9,11 @@ let
 in
 stdenv.mkDerivation {
   pname = "picat";
-  version = "3.0p4";
+  version = "3.3p3";
 
   src = fetchurl {
-    url    = "http://picat-lang.org/download/picat30_4_src.tar.gz";
-    sha256 = "1rwin44m7ni2h2v51sh2r8gj2k6wm6f86zgaylrria9jr57inpqj";
+    url = "http://picat-lang.org/download/picat333_src.tar.gz";
+    hash = "sha256-LMmAHCGKgon/wNbrXTUH9hiHyGVwwSDpB1236xawzXs=";
   };
 
   buildInputs = [ zlib ];

pkgs/development/interpreters/trealla/default.nix

@@ -1,14 +1,14 @@
-{ lib, stdenv, fetchFromGitHub, readline, openssl, libffi, withThread ? true, withSSL ? true, xxd }:
+{ lib, stdenv, fetchFromGitHub, readline, openssl, libffi, valgrind, withThread ? true, withSSL ? true, xxd }:
 
 stdenv.mkDerivation rec {
   pname = "trealla";
-  version = "2.2.6";
+  version = "2.8.4";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${version}";
-    sha256 = "sha256-DxlexijQPcNxlPjo/oIvsN//8nZ0injXFHc2t3n4yjg=";
+    sha256 = "sha256-/jB4jlYotvdU068+zj9Z+G0g75sI9dTmtgN874i0qAE=";
   };
 
   postPatch = ''
@@ -27,6 +27,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ xxd ];
   buildInputs = [ readline openssl libffi ];
+  checkInputs = [ valgrind ];
   enableParallelBuilding = true;
 
   installPhase = ''

pkgs/development/libraries/libpgf/default.nix

@@ -1,21 +1,29 @@
-{ lib, stdenv, fetchzip, autoreconfHook }:
+{ lib
+, stdenv
+, fetchzip
+, autoreconfHook
+, dos2unix
+}:
 
 stdenv.mkDerivation rec {
   pname = "libpgf";
-  version = "7.21.2";
+  version = "7.21.7";
 
   src = fetchzip {
     url = "mirror://sourceforge/${pname}/${pname}/${version}/${pname}.zip";
-    sha256 = "0l1j5b1d02jn27miggihlppx656i0pc70cn6x89j1rpj33zn0g9r";
+    hash = "sha256-TAWIuikijfyeTRetZWoMMdB/FeGAR7ZjNssVxUevlVg=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
-
-  autoreconfPhase = ''
+  postPatch = ''
+    find . -type f | xargs dos2unix
     mv README.txt README
-    sh autogen.sh
   '';
 
+  nativeBuildInputs = [
+    autoreconfHook
+    dos2unix
+  ];
+
   meta = {
     homepage = "https://www.libpgf.org/";
     description = "Progressive Graphics Format";

pkgs/games/simutrans/default.nix

@@ -163,7 +163,7 @@ let
 
       homepage = "http://www.simutrans.com/";
       license = with licenses; [ artistic1 gpl1Plus ];
-      maintainers = with maintainers; [ phile314 ];
+      maintainers = with maintainers; [ ];
       platforms = with platforms; linux; # TODO: ++ darwin;
     };
   };

pkgs/os-specific/linux/kernel-headers/default.nix

@@ -1,11 +1,8 @@
 { stdenvNoCC, lib, buildPackages, fetchurl, perl, elf-header
-, bison ? null, flex ? null, python ? null, rsync ? null
+, bison, flex, rsync
 , writeTextFile
 }:
 
-assert stdenvNoCC.hostPlatform.isAndroid ->
-  (flex != null && bison != null && python != null && rsync != null);
-
 let
 
   # As part of building a hostPlatform=mips kernel, Linux creates and runs a
@@ -50,7 +47,7 @@ let
     nativeBuildInputs = [
       perl elf-header
     ] ++ lib.optionals stdenvNoCC.hostPlatform.isAndroid [
-      flex bison python rsync
+      bison flex rsync
     ] ++ lib.optionals (stdenvNoCC.buildPlatform.isDarwin &&
                         stdenvNoCC.hostPlatform.isMips) [
       darwin-endian-h

pkgs/servers/filtron/default.nix

@@ -1,22 +1,32 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub, fetchpatch }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "filtron";
   version = "0.2.0";
 
-  goPackagePath = "github.com/asciimoo/filtron";
-
   src = fetchFromGitHub {
     owner = "asciimoo";
     repo = "filtron";
     rev = "v${version}";
-    sha256 = "18d3h0i2sfqbc0bjx26jm2n9f37zwp8z9z4wd17sw7nvkfa72a26";
+    hash = "sha256-RihxlJvbHq5PaJz89NHl/wyXrKjSiC4XYAs7LSKAo6E=";
   };
 
-  goDeps = ./deps.nix;
+  vendorHash = "sha256-1DRR16WiBGvhOpq12L5njJJRRCIA7ajs1Py9j/3cWPE=";
+
+  patches = [
+    # Update golang version in go.mod
+    (fetchpatch {
+      url = "https://github.com/asciimoo/filtron/commit/365a0131074b3b12aaa65194bfb542182a63413c.patch";
+      hash = "sha256-QGR6YetEzA/b6tC4uD94LBkWv0+9PG7RD72Tpkn2gQU=";
+    })
+    # Add missing go.sum file
+    (fetchpatch {
+      url = "https://github.com/asciimoo/filtron/commit/077769282b4e392e96a194c8ae71ff9f693560ea.patch";
+      hash = "sha256-BhHbXDKiRjSzC6NKhKUiH6rjt/EgJcEprHMMJ1x/wiQ=";
+    })
+  ];
 
-  # The upstream test checks are obsolete/unmaintained.
-  doCheck = false;
+  ldflags = [ "-s" "-w" ];
 
   meta = with lib; {
     description = "Reverse HTTP proxy to filter requests by different rules.";