Merge remote-tracking branch 'origin/master' into haskell-updates

nixos/modules/module-list.nix

@@ -135,6 +135,7 @@
   ./programs/droidcam.nix
   ./programs/environment.nix
   ./programs/evince.nix
+  ./programs/extra-container.nix
   ./programs/feedbackd.nix
   ./programs/file-roller.nix
   ./programs/firejail.nix

nixos/modules/programs/extra-container.nix

@@ -0,0 +1,17 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+let
+  cfg = config.programs.extra-container;
+in {
+  options = {
+    programs.extra-container.enable = mkEnableOption ''
+      extra-container, a tool for running declarative NixOS containers
+      without host system rebuilds
+    '';
+  };
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.extra-container ];
+    boot.extraSystemdUnitPaths = [ "/etc/systemd-mutable/system" ];
+  };
+}

nixos/modules/services/web-apps/nextcloud.nix

@@ -399,13 +399,39 @@ in {
             The package can be upgraded by explicitly declaring the service-option
             `services.nextcloud.package`.
           '';
+
+        # FIXME(@Ma27) remove as soon as nextcloud properly supports
+        # mariadb >=10.6.
+        isUnsupportedMariadb =
+          # All currently supported Nextcloud versions are affected.
+          (versionOlder cfg.package.version "23")
+          # This module uses mysql
+          && (cfg.config.dbtype == "mysql")
+          # MySQL is managed via NixOS
+          && config.services.mysql.enable
+          # We're using MariaDB
+          && (getName config.services.mysql.package) == "mariadb-server"
+          # MariaDB is at least 10.6 and thus not supported
+          && (versionAtLeast (getVersion config.services.mysql.package) "10.6");
+
       in (optional (cfg.poolConfig != null) ''
           Using config.services.nextcloud.poolConfig is deprecated and will become unsupported in a future release.
           Please migrate your configuration to config.services.nextcloud.poolSettings.
         '')
         ++ (optional (versionOlder cfg.package.version "20") (upgradeWarning 19 "21.05"))
         ++ (optional (versionOlder cfg.package.version "21") (upgradeWarning 20 "21.05"))
-        ++ (optional (versionOlder cfg.package.version "22") (upgradeWarning 21 "21.11"));
+        ++ (optional (versionOlder cfg.package.version "22") (upgradeWarning 21 "21.11"))
+        ++ (optional isUnsupportedMariadb ''
+            You seem to be using MariaDB at an unsupported version (i.e. at least 10.6)!
+            Please note that this isn't supported officially by Nextcloud. You can either
+
+            * Switch to `pkgs.mysql`
+            * Downgrade MariaDB to at least 10.5
+            * Work around Nextcloud's problems by specifying `innodb_read_only_compressed=0`
+
+            For further context, please read
+            https://help.nextcloud.com/t/update-to-next-cloud-21-0-2-has-get-an-error/117028/15
+          '');
 
       services.nextcloud.package = with pkgs;
         mkDefault (

nixos/tests/nextcloud/with-mysql-and-memcached.nix

@@ -39,6 +39,13 @@ in {
         enable = true;
         bind = "127.0.0.1";
         package = pkgs.mariadb;
+
+        # FIXME(@Ma27) Nextcloud isn't compatible with mariadb 10.6,
+        # this is a workaround.
+        # See https://help.nextcloud.com/t/update-to-next-cloud-21-0-2-has-get-an-error/117028/22
+        extraOptions = ''
+          innodb_read_only_compressed=0
+        '';
         initialScript = pkgs.writeText "mysql-init" ''
           CREATE USER 'nextcloud'@'localhost' IDENTIFIED BY 'hunter2';
           CREATE DATABASE IF NOT EXISTS nextcloud;

pkgs/applications/misc/pdfsam-basic/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pdfsam-basic";
-  version = "4.2.3";
+  version = "4.2.6";
 
   src = fetchurl {
     url = "https://github.com/torakiki/pdfsam/releases/download/v${version}/pdfsam_${version}-1_amd64.deb";
-    sha256 = "sha256-WmJ+atndIXm5Z6RvRVSvf2de1Gda+cs5kSw4iotPVfU=";
+    sha256 = "sha256-H8vFbQHFTO7blTJyfaEuyVUIljhfFautIrXV73zmBeI=";
   };
 
   unpackPhase = ''

pkgs/applications/version-management/gerrit/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gerrit";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchurl {
     url = "https://gerrit-releases.storage.googleapis.com/gerrit-${version}.war";
-    sha256 = "sha256-GNUpSK9cczGISyvo05KrLzeO+zRm5dEYOmX2Oy7TjzE=";
+    sha256 = "sha256-pHomYKYpV60SIKLoST5y9i3FprMV1VGy+5GjhpRhBUo=";
   };
 
   buildCommand = ''

pkgs/build-support/fetchgit/default.nix

@@ -21,6 +21,11 @@ in
   postFetch ? ""
 , preferLocalBuild ? true
 , fetchLFS ? false
+, # Shell code to build a netrc file for BASIC auth
+  netrcPhase ? null
+, # Impure env vars (https://nixos.org/nix/manual/#sec-advanced-attributes)
+  # needed for netrcPhase
+  netrcImpureEnvVars ? []
 }:
 
 /* NOTE:
@@ -64,10 +69,17 @@ stdenvNoCC.mkDerivation {
 
   inherit url rev leaveDotGit fetchLFS fetchSubmodules deepClone branchName postFetch;
 
+  postHook = if netrcPhase == null then null else ''
+    ${netrcPhase}
+    # required that git uses the netrc file
+    mv {,.}netrc
+    export HOME=$PWD
+  '';
+
   GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
-  impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+  impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ netrcImpureEnvVars ++ [
-    "GIT_PROXY_COMMAND" "SOCKS_SERVER"
+    "GIT_PROXY_COMMAND" "NIX_GIT_SSL_CAINFO" "SOCKS_SERVER"
   ];
 
   inherit preferLocalBuild;

pkgs/build-support/fetchgit/nix-prefetch-git

@@ -17,6 +17,10 @@ branchName=$NIX_PREFETCH_GIT_BRANCH_NAME
 out=${out:-}
 http_proxy=${http_proxy:-}
 
+# allow overwritting cacert's ca-bundle.crt with a custom one
+# this can be done by setting NIX_GIT_SSL_CAINFO and NIX_SSL_CERT_FILE enviroment variables for the nix-daemon
+GIT_SSL_CAINFO=${NIX_GIT_SSL_CAINFO:-$GIT_SSL_CAINFO}
+
 # populated by clone_user_rev()
 fullRev=
 humanReadableRev=

pkgs/build-support/fetchgithub/default.nix

@@ -2,7 +2,7 @@
 
 { owner, repo, rev, name ? "source"
 , fetchSubmodules ? false, leaveDotGit ? null
-, deepClone ? false, private ? false
+, deepClone ? false, private ? false, forceFetchGit ? false
 , githubBase ? "github.com", varPrefix ? null
 , ... # For hash agility
 }@args:
@@ -10,7 +10,7 @@ let
   baseUrl = "https://${githubBase}/${owner}/${repo}";
   passthruAttrs = removeAttrs args [ "owner" "repo" "rev" "fetchSubmodules" "private" "githubBase" "varPrefix" ];
   varBase = "NIX${if varPrefix == null then "" else "_${varPrefix}"}_GITHUB_PRIVATE_";
-  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone;
+  useFetchGit = fetchSubmodules || (leaveDotGit == true) || deepClone || forceFetchGit;
   # We prefer fetchzip in cases we don't need submodules as the hash
   # is more stable in that case.
   fetcher = if useFetchGit then fetchgit else fetchzip;
@@ -32,10 +32,8 @@ let
     then {
       inherit rev deepClone fetchSubmodules; url = "${baseUrl}.git";
     } // lib.optionalAttrs (leaveDotGit != null) { inherit leaveDotGit; }
-    else ({ url = "${baseUrl}/archive/${rev}.tar.gz"; } // privateAttrs)
+    else { url = "${baseUrl}/archive/${rev}.tar.gz"; }
-  ) // passthruAttrs // { inherit name; };
+  ) // privateAttrs // passthruAttrs // { inherit name; };
 in
 
-assert private -> !useFetchGit;
-
 fetcher fetcherArgs // { meta.homepage = baseUrl; inherit rev; }

pkgs/build-support/vm/default.nix

@@ -8,14 +8,17 @@
       ++ pkgs.lib.optional (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) "rtc_cmos"
 }:
 
-with pkgs;
+let
-
+  inherit (pkgs) bash bashInteractive busybox cpio coreutils e2fsprogs fetchurl kmod rpm
+    stdenv util-linux
+    buildPackages writeScript writeText runCommand;
+in
 rec {
   qemu-common = import ../../../nixos/lib/qemu-common.nix { inherit lib pkgs; };
 
   qemu = buildPackages.qemu_kvm;
 
-  modulesClosure = makeModulesClosure {
+  modulesClosure = pkgs.makeModulesClosure {
     inherit kernel rootModules;
     firmware = kernel;
   };
@@ -137,7 +140,7 @@ rec {
   '';
 
 
-  initrd = makeInitrd {
+  initrd = pkgs.makeInitrd {
     contents = [
       { object = stage1Init;
         symlink = "/init";
@@ -152,7 +155,7 @@ rec {
 
     # Set the system time from the hardware clock.  Works around an
     # apparent KVM > 1.5.2 bug.
-    ${pkgs.util-linux}/bin/hwclock -s
+    ${util-linux}/bin/hwclock -s
 
     export NIX_STORE=${storeDir}
     export NIX_BUILD_TOP=/tmp
@@ -324,7 +327,7 @@ rec {
 
 
   extractFs = {file, fs ? null} :
-    with pkgs; runInLinuxVM (
+    runInLinuxVM (
     stdenv.mkDerivation {
       name = "extract-file";
       buildInputs = [ util-linux ];
@@ -349,10 +352,10 @@ rec {
 
 
   extractMTDfs = {file, fs ? null} :
-    with pkgs; runInLinuxVM (
+    runInLinuxVM (
     stdenv.mkDerivation {
       name = "extract-file-mtd";
-      buildInputs = [ util-linux mtdutils ];
+      buildInputs = [ pkgs.util-linux pkgs.mtdutils ];
       buildCommand = ''
         ln -s ${kernel}/lib /lib
         ${kmod}/bin/modprobe mtd
@@ -503,7 +506,7 @@ rec {
      tarball must contain an RPM specfile. */
 
   buildRPM = attrs: runInLinuxImage (stdenv.mkDerivation ({
-    prePhases = [ prepareImagePhase sysInfoPhase ];
+    prePhases = [ pkgs.prepareImagePhase pkgs.sysInfoPhase ];
     dontUnpack = true;
     dontConfigure = true;
 
@@ -584,7 +587,7 @@ rec {
       buildCommand = ''
         ${createRootFS}
 
-        PATH=$PATH:${lib.makeBinPath [ dpkg dpkg glibc xz ]}
+        PATH=$PATH:${lib.makeBinPath [ pkgs.dpkg pkgs.glibc pkgs.xz ]}
 
         # Unpack the .debs.  We do this to prevent pre-install scripts
         # (which have lots of circular dependencies) from barfing.

pkgs/development/interpreters/php/7.4.nix

@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "7.4.23";
+    version = "7.4.24";
-    sha256 = "d1e094fe6e4f832e0a64be9c69464ba5d593fb216f914efa8bbb084e0a7a5727";
+    sha256 = "0cigvwp469kmc27r28liq5dwdz5icp61vqqr3w24jhw6i2vk43pm";
   });
 
 in

pkgs/development/interpreters/php/8.0.nix

@@ -2,8 +2,8 @@
 
 let
   base = callPackage ./generic.nix (_args // {
-    version = "8.0.10";
+    version = "8.0.11";
-    sha256 = "sha256-yUVHJxQQkAhFsITsK8s0Zq82PuypLLJL1hHcvcJvFYc=";
+    sha256 = "0fj0yk0h0fvr9ckszp496wdyvf8kdfsvydw95qg0q0g4hm18gvbh";
   });
 
 in

pkgs/development/python-modules/mautrix/default.nix

@@ -4,11 +4,11 @@
 
 buildPythonPackage rec {
   pname = "mautrix";
-  version = "0.10.6";
+  version = "0.10.8";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "2738370469f8ce27efc37aa6e17319a4149246c9a0da822c8d81d948f0c7e1a7";
+    sha256 = "sha256-25zLhlGMwDja5wGmkqYuYtSUqOdD/gzUKGi79f1Tsjs=";
   };
 
   propagatedBuildInputs = [
@@ -32,6 +32,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/tulir/mautrix-python";
     description = "A Python 3 asyncio Matrix framework.";
     license = licenses.mpl20;
-    maintainers = with maintainers; [ nyanloutre ma27 ];
+    maintainers = with maintainers; [ nyanloutre ma27 sumnerevans ];
   };
 }

pkgs/development/python-modules/puremagic/default.nix

@@ -1,20 +1,17 @@
-{ lib, buildPythonPackage, fetchPypi
+{ lib
+, buildPythonPackage
+, fetchPypi
 }:
 
 buildPythonPackage rec {
   pname = "puremagic";
-  version = "1.10";
+  version = "1.11";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "025ih5q1qa40x88j7ngsdr5sf0dp400kwlfzz60i7v6fh0ms1zkg";
+    sha256 = "09d762b9d83c65a83617ee57a3532eb10663f394c1caf81390516c5b1cc0fc6b";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace '"argparse"' ""
-  '';
-
   # test data not included on pypi
   doCheck = false;
 

pkgs/development/python-modules/sqlmap/default.nix

@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "sqlmap";
-  version = "1.5.9";
+  version = "1.5.10";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1714780f8835854c6f949f854fca936c3064b9a7e0da96989bb637a6ba5c119b";
+    sha256 = "925b9b18d2880f7c74ebf53694b4cd8b9e04ca2cc27d57c265acda5f27b0dc89";
   };
 
   postPatch = ''

pkgs/development/python-modules/vispy/default.nix

@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "vispy";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6e482e68487f5384205d349f288580d6287fd690df4cdc3ad4c573afc39990f1";
+    sha256 = "41a6836aa78462370fe15efaade94cbe3344586412f8d7f12689c49c299ff41b";
   };
 
   patches = [

pkgs/development/tools/trunk/default.nix

@@ -3,13 +3,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "trunk";
-  version = "0.13.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "thedodd";
     repo = "trunk";
     rev = "v${version}";
-    sha256 = "sha256-pFF3x4vfouqO49q+MVyvYS40cH8cVn4yB61o14K6ABY=";
+    sha256 = "sha256-69MQDIF79pSuaOgZEIqb/ESPQzL7MUiQaJaxPccGxo8=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage rec {
   # requires network
   checkFlags = [ "--skip=tools::tests::download_and_install_binaries" ];
 
-  cargoSha256 = "sha256-Faj0xZkGTs5z5vMfr2BwN1/xm5vopewI9ZWkOhyPq9c=";
+  cargoSha256 = "sha256-3WTxCMNpBmiNbZMHp5BrqTXa1vmE/ZZ/8XbdcfxBfYg=";
 
   meta = with lib; {
     homepage = "https://github.com/thedodd/trunk";

pkgs/servers/gotify/package.json

@@ -5,12 +5,12 @@
   "homepage": ".",
   "proxy": "http://localhost:80",
   "dependencies": {
-    "@material-ui/core": "^4.11.0",
+    "@material-ui/core": "^4.11.4",
     "@material-ui/icons": "^4.9.1",
-    "axios": "^0.20.0",
+    "axios": "^0.21.1",
-    "codemirror": "^5.57.0",
+    "codemirror": "^5.61.1",
-    "detect-browser": "^5.1.1",
+    "detect-browser": "^5.2.0",
-    "js-base64": "^3.4.5",
+    "js-base64": "^3.6.1",
     "mobx": "^5.15.6",
     "mobx-react": "^6.3.0",
     "mobx-utils": "^5.6.1",
@@ -20,36 +20,37 @@
     "react-codemirror2": "^7.2.1",
     "react-dom": "^16.4.2",
     "react-infinite": "^0.13.0",
-    "react-markdown": "^4.0.6",
+    "react-markdown": "^6.0.2",
     "react-router": "^5.2.0",
     "react-router-dom": "^5.2.0",
-    "react-timeago": "^4.1.9",
+    "react-timeago": "^6.2.1",
+    "remark-gfm": "^1.0.0",
     "remove-markdown": "^0.3.0",
-    "typeface-roboto": "0.0.75"
+    "typeface-roboto": "1.1.13"
   },
   "scripts": {
     "start": "react-scripts start",
     "build": "react-scripts build",
     "test": "react-scripts test --env=node",
     "eject": "react-scripts eject",
-    "lint": "eslint \"src/*.{ts,tsx}\"",
+    "lint": "eslint \"src/**/*.{ts,tsx}\"",
     "format": "prettier \"src/**/*.{ts,tsx}\" --write",
     "testformat": "prettier \"src/**/*.{ts,tsx}\" --list-different"
   },
   "devDependencies": {
-    "@types/codemirror": "0.0.98",
+    "@types/codemirror": "5.60.0",
     "@types/detect-browser": "^4.0.0",
     "@types/get-port": "^4.0.0",
-    "@types/jest": "^26.0.13",
+    "@types/jest": "^26.0.23",
-    "@types/js-base64": "^3.0.0",
+    "@types/js-base64": "^3.3.1",
-    "@types/node": "^14.10.1",
+    "@types/node": "^15.12.2",
     "@types/notifyjs": "^3.0.2",
-    "@types/puppeteer": "^3.0.2",
+    "@types/puppeteer": "^5.4.3",
     "@types/react": "^16.9.49",
     "@types/react-dom": "^16.9.8",
     "@types/react-infinite": "0.0.35",
-    "@types/react-router-dom": "^5.1.5",
+    "@types/react-router-dom": "^5.1.7",
-    "@types/remove-markdown": "^0.1.1",
+    "@types/remove-markdown": "^0.3.0",
     "@types/rimraf": "^3.0.0",
     "@typescript-eslint/eslint-plugin": "^4.1.0",
     "@typescript-eslint/parser": "^4.1.0",
@@ -60,13 +61,13 @@
     "eslint-plugin-react": "^7.20.6",
     "eslint-plugin-unicorn": "^21.0.0",
     "get-port": "^5.1.1",
-    "prettier": "^2.1.1",
+    "prettier": "^2.3.1",
-    "puppeteer": "^5.3.0",
+    "puppeteer": "^10.0.0",
-    "react-scripts": "^3.4.3",
+    "react-scripts": "^4.0.3",
     "rimraf": "^3.0.2",
     "tree-kill": "^1.2.0",
     "typescript": "4.0.2",
-    "wait-on": "^5.2.0"
+    "wait-on": "^5.3.0"
   },
   "eslintConfig": {
     "extends": "react-app"

pkgs/servers/gotify/source-sha.nix

@@ -1 +1 @@
-"1rb7gmkinp3nwdng3xw2nrim10iw374rwhzlviqgmz87djgajh3l"
+"0qqp05258s2ybzbxfklhya8zw9ha9crkxzwls2kfdhndlrdpgznl"

pkgs/servers/gotify/ui.nix

@@ -1,5 +1,5 @@
 { yarn2nix-moretea
-, fetchFromGitHub
+, fetchFromGitHub, applyPatches
 }:
 
 yarn2nix-moretea.mkYarnPackage rec {
@@ -10,16 +10,52 @@ yarn2nix-moretea.mkYarnPackage rec {
 
   version = import ./version.nix;
 
-  src_all = fetchFromGitHub {
+  src_all = applyPatches {
-    owner = "gotify";
+    src = fetchFromGitHub {
-    repo = "server";
+      owner = "gotify";
-    rev = "v${version}";
+      repo = "server";
-    sha256 = import ./source-sha.nix;
+      rev = "v${version}";
+      sha256 = import ./source-sha.nix;
+    };
+    postPatch = ''
+      substituteInPlace ui/yarn.lock \
+        --replace \
+          "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001237.tgz" \
+          "https___registry.npmjs.org_caniuse_lite___caniuse_lite_1.0.30001237.tgz"
+    '';
   };
   src = "${src_all}/ui";
 
   buildPhase = ''
+    export HOME=$(mktemp -d)
+    export WRITABLE_NODE_MODULES="$(pwd)/tmp"
+    mkdir -p "$WRITABLE_NODE_MODULES"
+
+    # react-scripts requires a writable node_modules/.cache, so we have to copy the symlink's contents back
+    # into `node_modules/`.
+    # See https://github.com/facebook/create-react-app/issues/11263
+    cd deps/gotify-ui
+    node_modules="$(readlink node_modules)"
+    rm node_modules
+    mkdir -p "$WRITABLE_NODE_MODULES"/.cache
+    cp -r $node_modules/* "$WRITABLE_NODE_MODULES"
+
+    # In `node_modules/.bin` are relative symlinks that would be broken after copying them over,
+    # so we take care of them here.
+    mkdir -p "$WRITABLE_NODE_MODULES"/.bin
+    for x in "$node_modules"/.bin/*; do
+      ln -sfv "$node_modules"/.bin/"$(readlink "$x")" "$WRITABLE_NODE_MODULES"/.bin/"$(basename "$x")"
+    done
+
+    ln -sfv "$WRITABLE_NODE_MODULES" node_modules
+    cd ../..
+
     yarn build
+
+    cd deps/gotify-ui
+    rm -rf node_modules
+    ln -sf $node_modules node_modules
+    cd ../..
   '';
 
 }

pkgs/servers/gotify/vendor-sha.nix

@@ -1 +1 @@
-"15y5migjf68fwv21ihkcj3r7mm4cgjbghvwvb9l7mhysnc8kdk8j"
+"sha256-ktmJ8rIBYL6/gwYG109sLqo16M0Xgre3wLBTuOTz3CY="

pkgs/servers/gotify/version.nix

@@ -1 +1 @@
-"2.0.21"
+"2.1.0"

pkgs/servers/nextcloud/default.nix

@@ -44,18 +44,18 @@ in {
   '';
 
   nextcloud20 = generic {
-    version = "20.0.12";
+    version = "20.0.13";
-    sha256 = "sha256-gIIPuWVcWv/5nuXMWticcPBKMjJVsCmvs83tj8fdbgY=";
+    sha256 = "15mi51aayi3m8brxc0w51mbxp4h3hjv14gr5mm7ch2930x655gg9";
   };
 
   nextcloud21 = generic {
-    version = "21.0.4";
+    version = "21.0.5";
-    sha256 = "sha256-Sg0w/r+6UxGLqZCgwtLBZ2e3eqZ2r8k30gGNaGXF/jo=";
+    sha256 = "1q46h480kn97k7h3xm7r5gsa8l3f0kfiicapi46sh0p39pbjbyhv";
   };
 
   nextcloud22 = generic {
-    version = "22.1.1";
+    version = "22.2.0";
-    sha256 = "sha256-5VtuuXf7U5CB4zp9jxluOEMOszfMdr8DeaZjpJf73ls=";
+    sha256 = "07ryvynws65k42n6ca20nni1vqr90fsrd2dpx2bvh09mwhyblg97";
   };
   # tip: get she sha with:
   # curl 'https://download.nextcloud.com/server/releases/nextcloud-${version}.tar.bz2.sha256'

pkgs/tools/misc/diffoscope/default.nix

@@ -9,11 +9,11 @@
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python3Packages.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "185";
+  version = "186";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    sha256 = "sha256-Spw7/+vQ1jd3rMZ792du04di0zleRNp8LUEki1374O8=";
+    sha256 = "sha256-lOVKhpzDkm7NM9Ti0AAQ3CRpdQ3DTJElQWx7eXP7E3o=";
   };
 
   outputs = [ "out" "man" ];

pkgs/tools/misc/natls/default.nix

@@ -0,0 +1,25 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "natls";
+  version = "2.1.14";
+
+  src = fetchFromGitHub {
+    owner = "willdoescode";
+    repo = "nat";
+    rev = "v${version}";
+    sha256 = "sha256-4x92r6V9AvEO88gFofPTUt+mS7ZhmptDn/8O4pizSRg=";
+  };
+
+  cargoSha256 = "sha256-Am4HmfmhskKxcp1iWod5z3caHwsdo31qCaVi0UxTXAg=";
+
+  meta = with lib; {
+    description = "the 'ls' replacement you never knew you needed";
+    homepage = "https://github.com/willdoescode/nat";
+    license = licenses.mit;
+    maintainers = with maintainers; [ msfjarvis ];
+  };
+}

pkgs/tools/networking/kea/default.nix

@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kea";
-  version = "1.9.11";
+  version = "2.0.0"; # only even minor versions are stable
 
   src = fetchurl {
     url = "https://ftp.isc.org/isc/${pname}/${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-fSyJYsAshtEviybA67UzGCWK2iHJYJy5tJIZxxzTfyU=";
+    sha256 = "sha256-BYVODDhxtFLtrOGOzMarYYlA4CSfvnwjKjbQauWb9B0=";
   };
 
   patches = [ ./dont-create-var.patch ];

pkgs/tools/virtualization/extra-container/default.nix

@@ -0,0 +1,37 @@
+{ stdenv, lib, nixos-container, openssh, glibcLocales, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "extra-container";
+  version = "0.8";
+
+  src = fetchFromGitHub {
+    owner = "erikarvstedt";
+    repo = pname;
+    rev = version;
+    hash = "sha256-/AetqDPkz32JMdjbSdzZCBVmGbvzjeAb8Wv82iTgHFE=";
+  };
+
+  buildCommand = ''
+    install -D $src/extra-container $out/bin/extra-container
+    patchShebangs $out/bin
+    share=$out/share/extra-container
+    install $src/eval-config.nix -Dt $share
+
+    # Use existing PATH for systemctl and machinectl
+    scriptPath="export PATH=${lib.makeBinPath [ nixos-container openssh ]}:\$PATH"
+
+    sed -i \
+      -e "s|evalConfig=.*|evalConfig=$share/eval-config.nix|" \
+      -e "s|LOCALE_ARCHIVE=.*|LOCALE_ARCHIVE=${glibcLocales}/lib/locale/locale-archive|" \
+      -e "2i$scriptPath" \
+      $out/bin/extra-container
+  '';
+
+  meta = with lib; {
+    description = "Run declarative containers without full system rebuilds";
+    homepage = https://github.com/erikarvstedt/extra-container;
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.earvstedt ];
+  };
+}

pkgs/top-level/all-packages.nix

@@ -1040,6 +1040,8 @@ with pkgs;
 
   mrxvt = callPackage ../applications/terminal-emulators/mrxvt { };
 
+  natls = callPackage ../tools/misc/natls { };
+
   nimmm = callPackage ../applications/terminal-emulators/nimmm { };
 
   pikchr = callPackage ../tools/graphics/pikchr { };
@@ -31941,6 +31943,8 @@ with pkgs;
 
   nixos-rebuild = callPackage ../os-specific/linux/nixos-rebuild { };
 
+  extra-container = callPackage ../tools/virtualization/extra-container { };
+
   norwester-font = callPackage ../data/fonts/norwester  {};
 
   nut = callPackage ../applications/misc/nut { };