Merge remote-tracking branch 'origin/master' into staging-next

Conflicts:
  nixos/doc/manual/release-notes/rl-2105.xml
  pkgs/tools/security/sequoia/default.nix

pkgs/tools/filesystems/blobfuse/default.nix

@@ -1,19 +1,32 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, curl, gnutls, libgcrypt, libuuid, fuse }:
-
-stdenv.mkDerivation rec {
-  pname = "blobfuse";
-  version = "1.0.2";
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, curl, gnutls, libgcrypt, libuuid, fuse, boost }:
 
+let
+  version = "1.3.7";
   src = fetchFromGitHub {
     owner  = "Azure";
     repo   = "azure-storage-fuse";
-    rev    = "v${version}";
-    sha256 = "1qh04z1fsj1l6l12sz9yl2sy9hwlrnzac54hwrr7wvsgv90n9gbp";
+    rev    = "blobfuse-${version}-Linux";
+    sha256 = "sha256-yihIuS4AG489U7eBi/p7H6S7Cg54kkQeNVCexxQZ60A=";
   };
+  cpplite = stdenv.mkDerivation rec {
+    pname = "cpplite";
+    inherit version src;
+
+    sourceRoot = "source/cpplite";
+    patches = [ ./install-adls.patch ];
+
+    cmakeFlags = [ "-DBUILD_ADLS=ON" "-DUSE_OPENSSL=OFF" ];
+
+    buildInputs = [ curl libuuid gnutls ];
+    nativeBuildInputs = [ cmake pkg-config ];
+  };
+in stdenv.mkDerivation rec {
+  pname = "blobfuse";
+  inherit version src;
 
   NIX_CFLAGS_COMPILE = "-Wno-error=catch-value";
 
-  buildInputs = [ curl gnutls libgcrypt libuuid fuse ];
+  buildInputs = [ curl gnutls libgcrypt libuuid fuse boost cpplite ];
   nativeBuildInputs = [ cmake pkg-config ];
 
   meta = with lib; {

pkgs/tools/filesystems/blobfuse/install-adls.patch

@@ -0,0 +1,14 @@
+diff --git a/adls/CMakeLists.txt b/adls/CMakeLists.txt
+index 1fb7146..22e663a 100644
+--- a/adls/CMakeLists.txt
++++ b/adls/CMakeLists.txt
+@@ -50,3 +50,9 @@ if(BUILD_TESTS)
+   string(REGEX REPLACE "([^;]+)" "${CMAKE_CURRENT_SOURCE_DIR}/\\1" AZURE_STORAGE_ADLS_TEST_SOURCES "${AZURE_STORAGE_ADLS_TEST_SOURCES}")
+   set(AZURE_STORAGE_ADLS_TEST_SOURCES ${AZURE_STORAGE_ADLS_TEST_SOURCES} PARENT_SCOPE)
+ endif()
++
++install(TARGETS azure-storage-adls
++        ARCHIVE DESTINATION lib
++        LIBRARY DESTINATION lib
++        RUNTIME DESTINATION bin)
++

pkgs/tools/misc/macchina/default.nix

@@ -3,16 +3,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "macchina";
-  version = "0.7.2";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "Macchina-CLI";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-ICiU0emo5lEs6996TwkauuBWb2+Yy6lL+/x7zQgO470=";
+    sha256 = "04ya8sa0qhj0g3h5fi5fmx0xg1glg993xad4glfm317spgkff6z7";
   };
 
-  cargoSha256 = "sha256-OfOh0YXeLT/kBuR9SOV7pHa8Z4b6+JvtVwqqwd1hCJY=";
+  cargoSha256 = "1gch2742zv0f23mq8ppmi75lmjj5m3s14wlsr72nd8hyn3ff7kbw";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optionals stdenv.isDarwin [ libiconv Foundation ];

pkgs/tools/misc/silicon/default.nix

@@ -13,6 +13,7 @@
 , AppKit
 , CoreText
 , Security
+, fira-code
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -28,7 +29,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "sha256-sUPOf9er+BOMqDJ8C6+Xjjqj6NQUV2JTzGA4yUWtDWM=";
 
-  buildInputs = [ llvmPackages.libclang expat freetype ]
+  buildInputs = [ llvmPackages.libclang expat freetype fira-code ]
     ++ lib.optionals stdenv.isLinux [ libxcb ]
     ++ lib.optionals stdenv.isDarwin [ libiconv AppKit CoreText Security ];
 

pkgs/tools/misc/xvfb-run/default.nix

@@ -23,7 +23,7 @@ stdenv.mkDerivation {
   '';
 
   meta = with lib; {
-    platforms = platforms.unix;
+    platforms = platforms.linux;
     license = licenses.gpl2;
   };
 }

pkgs/tools/networking/libreswan/default.nix

@@ -1,71 +1,114 @@
-{ lib, stdenv, fetchurl, makeWrapper,
-  pkg-config, systemd, gmp, unbound, bison, flex, pam, libevent, libcap_ng, curl, nspr,
-  bash, iproute2, iptables, procps, coreutils, gnused, gawk, nss, which, python3,
-  docs ? false, xmlto, libselinux, ldns
-  }:
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+, nixosTests
+, pkg-config
+, systemd
+, gmp
+, unbound
+, bison
+, flex
+, pam
+, libevent
+, libcap_ng
+, curl
+, nspr
+, bash
+, iproute2
+, iptables
+, procps
+, coreutils
+, gnused
+, gawk
+, nss
+, which
+, python3
+, libselinux
+, ldns
+, xmlto
+, docbook_xml_dtd_412
+, docbook_xsl
+, findXMLCatalogs
+}:
 
 let
+  # Tools needed by ipsec scripts
   binPath = lib.makeBinPath [
-    bash iproute2 iptables procps coreutils gnused gawk nss.tools which python3
+    iproute2 iptables procps
+    coreutils gnused gawk
+    nss.tools which
   ];
 in
 
-assert docs -> xmlto != null;
-assert stdenv.isLinux -> libselinux != null;
-
 stdenv.mkDerivation rec {
   pname = "libreswan";
-  version = "3.32";
+  version = "4.4";
 
   src = fetchurl {
     url = "https://download.libreswan.org/${pname}-${version}.tar.gz";
-    sha256 = "0bj3g6qwd3ir3gk6hdl9npy3k44shf56vcgjahn30qpmx3z5fsr3";
+    sha256 = "0xj974yc0y1r7235zl4jhvxqz3bpb8js2fy9ic820zq9swh0lgsz";
   };
 
   strictDeps = true;
 
-  # These flags were added to compile v3.18. Try to lift them when updating.
-  NIX_CFLAGS_COMPILE = toString [ "-Wno-error=redundant-decls" "-Wno-error=format-nonliteral"
-    # these flags were added to build with gcc7
-    "-Wno-error=implicit-fallthrough"
-    "-Wno-error=format-truncation"
-    "-Wno-error=pointer-compare"
-    "-Wno-error=stringop-truncation"
-    # The following flag allows libreswan v3.32 to work with NSS 3.22, see
-    # https://github.com/libreswan/libreswan/issues/334.
-    # This flag should not be needed for libreswan v3.33 (which is not yet released).
-    "-DNSS_PKCS11_2_0_COMPAT=1"
-  ];
-
   nativeBuildInputs = [
     bison
     flex
-    makeWrapper
     pkg-config
+    xmlto
+    docbook_xml_dtd_412
+    docbook_xsl
+    findXMLCatalogs
   ];
 
-  buildInputs = [ bash iproute2 iptables systemd coreutils gnused gawk gmp unbound pam libevent
-                  libcap_ng curl nspr nss python3 ldns ]
-                ++ lib.optional docs xmlto
-                ++ lib.optional stdenv.isLinux libselinux;
+  buildInputs = [
+    systemd coreutils
+    gnused gawk gmp unbound pam libevent
+    libcap_ng curl nspr nss ldns
+    # needed to patch shebangs
+    python3 bash
+  ] ++ lib.optional stdenv.isLinux libselinux;
+
+  patches = [
+    # Fix compilation on aarch64, remove on next update
+    (fetchpatch {
+      url = "https://github.com/libreswan/libreswan/commit/ea50d36d2886e44317ba5ba841de1d1bf91aee6c.patch";
+      sha256 = "1jp89rm9jp55zmiyimyhg7yadj0fwwxaw7i5gyclrs38w3y1aacj";
+    })
+  ];
 
   prePatch = ''
-    # Correct bash path
-    sed -i -e 's|/bin/bash|/usr/bin/env bash|' mk/config.mk
+    # Correct iproute2 path
+    sed -e 's|"/sbin/ip"|"${iproute2}/bin/ip"|' \
+        -e 's|"/sbin/iptables"|"${iptables}/bin/iptables"|' \
+        -i initsystems/systemd/ipsec.service.in \
+           programs/verify/verify.in
 
-    # Fix systemd unit directory, and prevent the makefile from trying to reload the
-    # systemd daemon or create tmpfiles
-    sed -i -e 's|UNITDIR=.*$|UNITDIR=$\{out}/etc/systemd/system/|g' \
-      -e 's|TMPFILESDIR=.*$|TMPFILESDIR=$\{out}/tmpfiles.d/|g' \
-      -e 's|systemctl|true|g' \
-      -e 's|systemd-tmpfiles|true|g' \
-      initsystems/systemd/Makefile
+    # Prevent the makefile from trying to
+    # reload the systemd daemon or create tmpfiles
+    sed -e 's|systemctl|true|g' \
+        -e 's|systemd-tmpfiles|true|g' \
+        -i initsystems/systemd/Makefile
 
     # Fix the ipsec program from crushing the PATH
-    sed -i -e 's|\(PATH=".*"\):.*$|\1:$PATH|' programs/ipsec/ipsec.in
+    sed -e 's|\(PATH=".*"\):.*$|\1:$PATH|' -i programs/ipsec/ipsec.in
 
     # Fix python script to use the correct python
-    sed -i -e 's|#!/usr/bin/python|#!/usr/bin/env python|' -e 's/^\(\W*\)installstartcheck()/\1sscmd = "ss"\n\0/' programs/verify/verify.in
+    sed -e 's/^\(\W*\)installstartcheck()/\1sscmd = "ss"\n\0/' \
+        -i programs/verify/verify.in
+
+    # Replace wget with curl to save a dependency
+    curlArgs='-s --remote-name-all --output-dir'
+    sed -e "s|wget -q -P|${curl}/bin/curl $curlArgs|g" \
+        -i programs/letsencrypt/letsencrypt.in
+
+    # Patch the Makefile:
+    # 1. correct the pam.d directory install path
+    # 2. do not create the /var/lib/ directory
+    sed -e 's|$(DESTDIR)/etc/pam.d|$(out)/etc/pam.d|' \
+        -e '/test ! -d $(NSSDIR)/,+3d' \
+        -i configs/Makefile
   '';
 
   # Set appropriate paths for build
@@ -73,10 +116,10 @@ stdenv.mkDerivation rec {
 
   makeFlags = [
     "INITSYSTEM=systemd"
-    (if docs then "all" else "base")
+    "UNITDIR=$(out)/etc/systemd/system/"
+    "TMPFILESDIR=$(out)/lib/tmpfiles.d/"
   ];
 
-  installTargets = [ (if docs then "install" else "install-base") ];
   # Hack to make install work
   installFlags = [
     "FINALVARDIR=\${out}/var"
@@ -84,18 +127,23 @@ stdenv.mkDerivation rec {
   ];
 
   postInstall = ''
-    for i in $out/bin/* $out/libexec/ipsec/*; do
-      wrapProgram "$i" --prefix PATH ':' "$out/bin:${binPath}"
-    done
+    # Install examples directory (needed for letsencrypt)
+    cp -r docs/examples $out/share/doc/libreswan/examples
   '';
 
-  enableParallelBuilding = true;
+  postFixup = ''
+    # Add a PATH to the main "ipsec" script
+    sed -e '0,/^$/{s||export PATH=${binPath}:$PATH|}' \
+        -i $out/bin/ipsec
+  '';
+
+  passthru.tests.libreswan = nixosTests.libreswan;
 
   meta = with lib; {
     homepage = "https://libreswan.org";
     description = "A free software implementation of the VPN protocol based on IPSec and the Internet Key Exchange";
     platforms = platforms.linux ++ platforms.freebsd;
-    license = licenses.gpl2;
-    maintainers = [ maintainers.afranchuk ];
+    license = with licenses; [ gpl2Plus mpl20 ] ;
+    maintainers = with maintainers; [ afranchuk rnhmjoj ];
   };
 }

pkgs/tools/networking/tinyproxy/default.nix

@@ -1,55 +1,25 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, asciidoc, libxml2,
-  libxslt, docbook_xsl }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook, perl, withDebug ? false }:
 
 stdenv.mkDerivation rec {
   pname = "tinyproxy";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
-    sha256 = "0gzapnllzyc005l3rs6iarjk1p5fc8mf9ysbck1mbzbd8xg6w35s";
+    sha256 = "13fhkmmrwzl657dq04x2wagkpjwdrzhkl141qvzr7y7sli8j0w1n";
     rev = version;
     repo = "tinyproxy";
     owner = "tinyproxy";
   };
 
-  nativeBuildInputs = [ autoreconfHook asciidoc libxml2 libxslt docbook_xsl ];
+  # perl is needed for man page generation.
+  nativeBuildInputs = [ autoreconfHook perl ];
 
-  # -z flag is not supported in darwin
-  preAutoreconf = lib.optionalString stdenv.isDarwin ''
-    substituteInPlace configure.ac --replace \
-          'LDFLAGS="-Wl,-z,defs $LDFLAGS"' \
-          'LDFLAGS="-Wl, $LDFLAGS"'
-  '';
-
-  # See: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=154624
-  postConfigure = ''
-    substituteInPlace docs/man5/Makefile --replace \
-          "-f manpage" \
-          "--xsltproc-opts=--nonet \\
-           -f manpage \\
-           -L"
-    substituteInPlace docs/man8/Makefile --replace \
-          "-f manpage" \
-          "--xsltproc-opts=--nonet \\
-           -f manpage \\
-           -L"
-  '';
-
-  configureFlags = [
-    "--disable-debug"      # Turn off debugging
-    "--enable-xtinyproxy"  # Compile in support for the XTinyproxy header, which is sent to any web server in your domain.
-    "--enable-filter"      # Allows Tinyproxy to filter out certain domains and URLs.
-    "--enable-upstream"    # Enable support for proxying connections through another proxy server.
-    "--enable-transparent" # Allow Tinyproxy to be used as a transparent proxy daemon.
-    "--enable-reverse"     # Enable reverse proxying.
-  ] ++
-  # See: https://github.com/tinyproxy/tinyproxy/issues/1
-  lib.optional stdenv.isDarwin "--disable-regexcheck";
+  configureFlags = lib.optionals withDebug [ "--enable-debug" ]; # Enable debugging support code and methods.
 
   meta = with lib; {
     homepage = "https://tinyproxy.github.io/";
     description = "A light-weight HTTP/HTTPS proxy daemon for POSIX operating systems";
-    license = licenses.gpl2;
+    license = licenses.gpl2Only;
     platforms = platforms.all;
     maintainers = [ maintainers.carlosdagos ];
   };

pkgs/tools/nix/nixos-install-tools/default.nix

@@ -0,0 +1,67 @@
+{
+  buildEnv,
+  lib,
+  man,
+  nixos,
+  # TODO: replace indirect self-reference by proper self-reference
+  #       https://github.com/NixOS/nixpkgs/pull/119942
+  nixos-install-tools,
+  runCommand,
+}:
+let
+  inherit (nixos {}) config;
+  version = config.system.nixos.version;
+in
+(buildEnv {
+  name = "nixos-install-tools-${version}";
+  paths = lib.attrValues {
+    # See nixos/modules/installer/tools/tools.nix
+    inherit (config.system.build)
+      nixos-install nixos-generate-config nixos-enter;
+
+    # Required for --help.
+    inherit (config.system.build.manual) manpages;
+  };
+
+  extraOutputsToInstall = ["man"];
+
+  meta = {
+    description = "The essential commands from the NixOS installer as a package";
+    longDescription = ''
+      With this package, you get the commands like nixos-generate-config and
+      nixos-install that you would otherwise only find on a NixOS system, such
+      as an installer image.
+
+      This way, you can install NixOS using a machine that only has Nix.
+    '';
+    license = lib.licenses.mit;
+    homepage = "https://nixos.org";
+    platforms = lib.platforms.linux;
+  };
+
+  passthru.tests = {
+    nixos-install-help = runCommand "test-nixos-install-help" {
+      nativeBuildInputs = [
+        man
+        nixos-install-tools
+      ];
+      meta.description = ''
+        Make sure that --help works. It's somewhat non-trivial because it
+        requires man.
+      '';
+    } ''
+      nixos-install --help | grep -F 'NixOS Reference Pages'
+      nixos-install --help | grep -F 'configuration.nix'
+      nixos-generate-config --help | grep -F 'NixOS Reference Pages'
+      nixos-generate-config --help | grep -F 'hardware-configuration.nix'
+
+      # FIXME: Tries to call unshare, which it must not do for --help
+      # nixos-enter --help | grep -F 'NixOS Reference Pages'
+
+      touch $out
+    '';
+  };
+}).overrideAttrs (o: {
+  inherit version;
+  pname = "nixos-install-tools";
+})

pkgs/tools/security/sequoia/default.nix

@@ -25,16 +25,16 @@ rustPlatform.buildRustPackage rec {
   pname = "sequoia";
   # Upstream has separate version numbering for the library and the CLI frontend.
   # This derivation provides the CLI frontend, and thus uses its version number.
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitLab {
     owner = "sequoia-pgp";
     repo = "sequoia";
     rev = "sq/v${version}";
-    sha256 = "0zavkf0grkqljyiywcprsiv8igidk8vc3yfj3fzqvbhm43vnnbdw";
+    sha256 = "13f582g10vba0cpbdmqkkfzgd5jgagb640jaz1w425wf5nbh6q50";
   };
 
-  cargoSha256 = "0zv6mnjbp44vp85rw4l1nqk4yb7dzqp031r8rgqq2avbnq018yhk";
+  cargoSha256 = "sha256-qIGP48uj2iQ6MVgy5anKI9QrX9vnuKh46Fmmcczda4w=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/tools/system/gdu/default.nix

@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , buildGoModule
 , fetchFromGitHub
 , installShellFiles
@@ -6,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gdu";
-  version = "4.11.1";
+  version = "4.11.2";
 
   src = fetchFromGitHub {
     owner = "dundee";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-e9TYArmNWnK8XXcniAQCegrfWAUfTKKuClgdSTQep0U=";
+    sha256 = "sha256-IrlyHYAcoRvF5CA0LMKHTb8aYSawvEcU7s+a03QYI1c=";
   };
 
   vendorSha256 = "sha256-QiO5p0x8kmIN6f0uYS0IR2MlWtRYTHeZpW6Nmupjias=";
@@ -27,21 +28,14 @@ buildGoModule rec {
   ];
 
   postPatch = ''
-    substituteInPlace cmd/app/app_test.go --replace "development" "${version}"
+    substituteInPlace cmd/gdu/app/app_test.go --replace "development" "${version}"
   '';
 
   postInstall = ''
     installManPage gdu.1
   '';
 
-  # tests fail with:
-  #  dir_test.go:76:
-  #              Error Trace:    dir_test.go:76
-  #              Error:          Not equal:
-  #                              expected: 0
-  #                              actual  : 512
-  #              Test:           TestFlags
-  doCheck = false;
+  doCheck = !(stdenv.isAarch64 || stdenv.isDarwin);
 
   meta = with lib; {
     description = "Disk usage analyzer with console interface";