NixOS · vcunat · Jul 27, 2022 · Jul 16, 2022 · Jul 16, 2022 · Jul 16, 2022
diff --git a/doc/languages-frameworks/maven.section.md b/doc/languages-frameworks/maven.section.md
@@ -233,7 +233,8 @@ in stdenv.mkDerivation rec {
 
   src = builtins.fetchTarball
     "https://github.com/fzakaria/nixos-maven-example/archive/main.tar.gz";
-  buildInputs = [ maven makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ maven ];
 
   buildPhase = ''
     echo "Using repository ${repository}"
@@ -310,7 +311,8 @@ in stdenv.mkDerivation rec {
 
   src = builtins.fetchTarball
     "https://github.com/fzakaria/nixos-maven-example/archive/main.tar.gz";
-  buildInputs = [ maven makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ maven ];
 
   buildPhase = ''
     echo "Using repository ${repository}"

diff --git a/doc/languages-frameworks/ruby.section.md b/doc/languages-frameworks/ruby.section.md
@@ -274,7 +274,7 @@ bundlerApp {
   gemdir = ./.;
   exes = [ "r10k" ];
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   postBuild = ''
     wrapProgram $out/bin/r10k --prefix PATH : ${lib.makeBinPath [ git gnutar gzip ]}

diff --git a/doc/stdenv/cross-compilation.chapter.md b/doc/stdenv/cross-compilation.chapter.md
@@ -155,14 +155,14 @@ doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
 
 #### Package using Meson needs to run binaries for the host platform during build. {#cross-meson-runs-host-code}
 
-Add `mesonEmulatorHook` cross conditionally to `nativeBuildInputs`.
+Add `mesonEmulatorHook` to `nativeBuildInputs` conditionally on if the target binaries can be executed.
 
 e.g.
 
 ```
 nativeBuildInputs = [
   meson
-] ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+] ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
   mesonEmulatorHook
 ];
 ```

diff --git a/nixos/modules/virtualisation/waydroid.nix b/nixos/modules/virtualisation/waydroid.nix
@@ -34,7 +34,7 @@ in
     system.requiredKernelConfig = with config.lib.kernelConfig; [
       (isEnabled "ANDROID_BINDER_IPC")
       (isEnabled "ANDROID_BINDERFS")
-      (isEnabled "ASHMEM")
+      (isEnabled "ASHMEM") # FIXME Needs memfd support instead on Linux 5.18 and waydroid 1.2.1
     ];
 
     /* NOTE: we always enable this flag even if CONFIG_PSI_DEFAULT_DISABLED is not on

diff --git a/pkgs/applications/audio/fluidsynth/default.nix b/pkgs/applications/audio/fluidsynth/default.nix
@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fluidsynth";
-  version = "2.2.5";
+  version = "2.2.7";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     rev = "v${version}";
-    sha256 = "sha256-aR8TLxl6OziP+DMSNro0DB/UtvzXDeDYQ3o/iy70XD4=";
+    sha256 = "sha256-4uo+Ldrp66dmemulKqofX2pz8tE73/5zGtmnY5BHjs8=";
   };
 
   nativeBuildInputs = [ buildPackages.stdenv.cc pkg-config cmake ];

diff --git a/pkgs/applications/editors/vim/common.nix b/pkgs/applications/editors/vim/common.nix
@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.0001";
+  version = "9.0.0057";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "sha256-WnMm3q5Stn3s33rxQt76goURSa1Rq+jMVWYiS+uJTX0=";
+    sha256 = "sha256-KEEuWRxattBrOAC0dWnWGRVqyOIEMe34ivMvSeuxKyA";
   };
 
   enableParallelBuilding = true;

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1715,9 +1715,7 @@ let
         };
       };
 
-      ms-python.python = callPackage ./python {
-        extractNuGet = callPackage ./python/extract-nuget.nix { };
-      };
+      ms-python.python = callPackage ./python { };
 
       msjsdiag.debugger-for-chrome = buildVscodeMarketplaceExtension {
         mktplcRef = {

diff --git a/pkgs/applications/editors/vscode/extensions/python/default.nix b/pkgs/applications/editors/vscode/extensions/python/default.nix
@@ -1,134 +1,44 @@
-{ lib, stdenv, fetchurl, fetchpatch, vscode-utils, extractNuGet
-, icu, curl, openssl, liburcu, lttng-ust, autoPatchelfHook
-, python3, musl
-, pythonUseFixed ? false       # When `true`, the python default setting will be fixed to specified.
-                               # Use version from `PATH` for default setting otherwise.
-                               # Defaults to `false` as we expect it to be project specific most of the time.
-, ctagsUseFixed ? true, ctags  # When `true`, the ctags default setting will be fixed to specified.
-                               # Use version from `PATH` for default setting otherwise.
-                               # Defaults to `true` as usually not defined on a per projet basis.
+{ lib
+, vscode-utils
+, icu
+, python3
+  # When `true`, the python default setting will be fixed to specified.
+  # Use version from `PATH` for default setting otherwise.
+  # Defaults to `false` as we expect it to be project specific most of the time.
+, pythonUseFixed ? false
 }:
 
-assert ctagsUseFixed -> null != ctags;
-
-let
-  liburcu-0-12 = liburcu.overrideAttrs (oldAttrs: rec {
-    version = "0.12.2";
-    src = fetchurl {
-      url = "https://lttng.org/files/urcu/userspace-rcu-${version}.tar.bz2";
-      sha256 = "0yx69kbx9zd6ayjzvwvglilhdnirq4f1x1sdv33jy8bc9wgc3vsf";
-    };
-  });
-
-  lttng-ust-2-10 = (lttng-ust.override {
-    liburcu = liburcu-0-12;
-  }).overrideAttrs (oldAttrs: rec {
-    version = "2.10.5";
-    src = fetchurl {
-      url = "https://lttng.org/files/lttng-ust/lttng-ust-${version}.tar.bz2";
-      sha256 = "0ddwk0nl28bkv2xb78gz16a2bvlpfbjmzwfbgwf5p1cq46dyvy86";
-    };
-    patches = (oldAttrs.patches or []) ++ [
-      # Pull upstream fix for -fno-common toolchain. Without it build fails on
-      # upstream gcc-10 as:
-      #   ld: libustsnprintf.a(libustsnprintf_la-core.o):snprintf/core.c:23: multiple definition of
-      #     `ust_loglevel'; ustctl.o:liblttng-ust-ctl/ustctl.c:80: first defined here
-      (fetchpatch {
-        name = "fno-common.patch";
-        url = "https://github.com/lttng/lttng-ust/commit/21a934df4c683e73e0a66a9afca33573fcf9d789.patch";
-        sha256 = "122lw9rdmr80gmz7814235ibqs47c6pzvg0ryh01805x0cymx74z";
-      })
-    ];
-  });
-
-  pythonDefaultsTo = if pythonUseFixed then "${python3}/bin/python" else "python";
-  ctagsDefaultsTo = if ctagsUseFixed then "${ctags}/bin/ctags" else "ctags";
-
-  # The arch tag comes from 'PlatformName' defined here:
-  # https://github.com/Microsoft/vscode-python/blob/master/src/client/activation/types.ts
-  arch =
-    if stdenv.isLinux && stdenv.isx86_64 then "linux-x64"
-    else if stdenv.isDarwin then "osx-x64"
-    else throw "Only x86_64 Linux and Darwin are supported.";
-
-  languageServerSha256 = {
-    linux-x64 = "1pmj5pb4xylx4gdx4zgmisn0si59qx51n2m1bh7clv29q6biw05n";
-    osx-x64 = "0ishiy1z9dghj4ryh95vy8rw0v7q4birdga2zdb4a8am31wmp94b";
-  }.${arch};
-
-  # version is languageServerVersion in the package.json
-  languageServer = extractNuGet rec {
-    name = "Python-Language-Server";
-    version = "0.5.30";
-
-    src = fetchurl {
-      url = "https://pvsc.azureedge.net/python-language-server-stable/${name}-${arch}.${version}.nupkg";
-      sha256 = languageServerSha256;
-    };
-  };
-in vscode-utils.buildVscodeMarketplaceExtension rec {
+vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "python";
     publisher = "ms-python";
-    version = "2022.0.1814523869";
-  };
-
-  vsix = fetchurl {
-    name = "${mktplcRef.publisher}-${mktplcRef.name}.zip";
-    url = "https://github.com/microsoft/vscode-python/releases/download/${mktplcRef.version}/ms-python-release.vsix";
-    sha256 = "sha256-JDaimcOUDo9GuFA3mhbbGLwqZE9ejk8pWYc+9PrRhVk=";
+    version = "2022.11.11881005";
+    sha256 = "sha256-8NH/aWIAwSpVRi3cvBCpvO8MVzIoRaXxADmWp6DuUb8=";
   };
 
-  buildInputs = [
-    icu
-    curl
-    openssl
-  ] ++ lib.optionals stdenv.isLinux [
-    lttng-ust-2-10
-    musl
-  ];
+  buildInputs = [ icu ];
 
-  nativeBuildInputs = [
-    python3.pkgs.wrapPython
-  ] ++ lib.optionals stdenv.isLinux [
-    autoPatchelfHook
-  ];
+  nativeBuildInputs = [ python3.pkgs.wrapPython ];
 
-  pythonPath = with python3.pkgs; [
-    setuptools
+  propagatedBuildInputs = with python3.pkgs; [
+    debugpy
+    isort
+    jedi-language-server
   ];
 
   postPatch = ''
+    # remove bundled python deps and use libs from nixpkgs
+    rm -r pythonFiles/lib
+    mkdir -p pythonFiles/lib/python/
+    ln -s ${python3.pkgs.debugpy}/lib/*/site-packages/debugpy pythonFiles/lib/python/
+    buildPythonPath "$propagatedBuildInputs"
+    for i in pythonFiles/*.py; do
+      patchPythonScript "$i"
+    done
+  '' + lib.optionalString pythonUseFixed ''
     # Patch `packages.json` so that nix's *python* is used as default value for `python.pythonPath`.
     substituteInPlace "./package.json" \
-      --replace "\"default\": \"python\"" "\"default\": \"${pythonDefaultsTo}\""
-
-    # Patch `packages.json` so that nix's *ctags* is used as default value for `python.workspaceSymbols.ctagsPath`.
-    substituteInPlace "./package.json" \
-      --replace "\"default\": \"ctags\"" "\"default\": \"${ctagsDefaultsTo}\""
-
-    # Similar cleanup to what's done in the `debugpy` python package.
-    # This prevent our autopatchelf logic to bark on unsupported binaries (`attach_x86.so`
-    # was problematic) but also should make our derivation less heavy.
-    (
-      cd pythonFiles/lib/python/debugpy/_vendored/pydevd/pydevd_attach_to_process
-      declare kept_aside="${{
-        "x86_64-linux" = "attach_linux_amd64.so";
-        "aarch64-darwin" = "attach_x86_64.dylib";
-        "x86_64-darwin" = "attach_x86_64.dylib";
-      }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}")}"
-      mv "$kept_aside" "$kept_aside.hidden"
-      rm *.so *.dylib *.dll *.exe *.pdb
-      mv "$kept_aside.hidden" "$kept_aside"
-    )
-  '';
-
-  postInstall = ''
-    mkdir -p "$out/$installPrefix/languageServer.${languageServer.version}"
-    cp -R --no-preserve=ownership ${languageServer}/* "$out/$installPrefix/languageServer.${languageServer.version}"
-    chmod -R +wx "$out/$installPrefix/languageServer.${languageServer.version}"
-
-    patchPythonScript "$out/$installPrefix/pythonFiles/lib/python/isort/main.py"
+      --replace "\"default\": \"python\"" "\"default\": \"${python3.interpreter}\""
   '';
 
   meta = with lib; {

diff --git a/pkgs/applications/editors/vscode/extensions/python/extract-nuget.nix b/pkgs/applications/editors/vscode/extensions/python/extract-nuget.nix
diff --git a/pkgs/applications/graphics/feh/default.nix b/pkgs/applications/graphics/feh/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, makeWrapper
-, xorg, imlib2, libjpeg, libpng, fetchpatch
+, xorg, imlib2, libjpeg, libpng
 , curl, libexif, jpegexiforient, perl
 , enableAutoreload ? !stdenv.hostPlatform.isDarwin }:
 
@@ -14,13 +14,11 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-rgNC4M1TJ5EPeWmVHVzgaxTGLY7CYQf7uOsOn5bkwKE=";
   };
 
-  patches = [
-    # fix test failure when magic=0 is set
-    (fetchpatch {
-      url = "https://github.com/derf/feh/commit/3c1076b31e2e4e3429a5c3d334d555e549fb72d2.patch";
-      sha256 = "sha256-F9N+N/BAeclyPHQYlO9ZV1U8S1VWfHl/8dMKUqA7DF8=";
-    })
-  ];
+  postPatch = ''
+    substituteInPlace test/feh.t \
+      --replace "WARNING:" "WARNING: While loading" \
+      --replace "Does not look like an image \(magic bytes missing\)" "Unknown error \(15\)"
+  '';
 
   outputs = [ "out" "man" "doc" ];
 

diff --git a/pkgs/applications/misc/khal/default.nix b/pkgs/applications/misc/khal/default.nix
@@ -27,11 +27,6 @@ with python3.pkgs; buildPythonApplication rec {
     freezegun
   ];
   nativeBuildInputs = [ setuptools-scm sphinx sphinxcontrib_newsfeed installShellFiles ];
-  checkInputs = [
-    glibcLocales
-    pytestCheckHook
-  ];
-  LC_ALL = "en_US.UTF-8";
 
   postInstall = ''
     # shell completions
@@ -51,6 +46,18 @@ with python3.pkgs; buildPythonApplication rec {
 
   doCheck = !stdenv.isAarch64;
 
+  checkInputs = [
+    glibcLocales
+    pytestCheckHook
+  ];
+
+  LC_ALL = "en_US.UTF-8";
+
+  disabledTests = [
+    # timing based
+    "test_etag"
+  ];
+
   meta = with lib; {
     broken = stdenv.isDarwin;
     homepage = "http://lostpackets.de/khal/";

diff --git a/pkgs/applications/networking/powerdns-admin/default.nix b/pkgs/applications/networking/powerdns-admin/default.nix
@@ -29,7 +29,7 @@ let
   };
 
   pythonDeps = with python.pkgs; [
-    flask flask_assets flask_login flask_sqlalchemy flask_migrate flask-seasurf flask_mail flask-session flask-sslify
+    flask flask_assets flask_login flask-sqlalchemy flask_migrate flask-seasurf flask_mail flask-session flask-sslify
     mysqlclient psycopg2 sqlalchemy
     cffi configobj cryptography bcrypt requests ldap pyotp qrcode dnspython
     gunicorn python3-saml pytz cssmin rjsmin authlib bravado-core

diff --git a/pkgs/applications/version-management/git-and-tools/git/default.nix b/pkgs/applications/version-management/git-and-tools/git/default.nix
@@ -26,7 +26,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
 
 let
-  version = "2.37.0";
+  version = "2.37.1";
   svn = subversionClient.override { perlBindings = perlSupport; };
   gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
 in
@@ -39,7 +39,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "sha256-n3+hcRvQDE7D3eL+REB9wT8S5HcrXjxypY20wHSVQR8=";
+    sha256 = "sha256-yBYsa4uPHF23BqsBtO4p4xBhGCE13CfEhgIkquwbNQA=";
   };
 
   outputs = [ "out" ] ++ lib.optional withManual "doc";

diff --git a/pkgs/applications/version-management/rabbitvcs/default.nix b/pkgs/applications/version-management/rabbitvcs/default.nix
@@ -9,7 +9,7 @@ python3Packages.buildPythonApplication rec {
     owner = "rabbitvcs";
     repo = "rabbitvcs";
     rev = "v${version}";
-    sha256 = "01cr16zf3gzsci1hhfli79m34fcx5m1pvswl16rkxxn212yc9fhy";
+    hash = "sha256-gVrdf8vQWAGORZqlTS/axs4U7aZlS8OAgPM3iKgqAtM=";
   };
 
   buildInputs = [ gtk3 ];

diff --git a/pkgs/applications/video/mpv/wrapper.nix b/pkgs/applications/video/mpv/wrapper.nix
@@ -64,7 +64,7 @@ let
       # TODO: don't link all mpv outputs and convert package to mpv-unwrapped?
       paths = [ mpv.all ];
 
-      buildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeWrapper ];
 
       passthru.unwrapped = mpv;
 

diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
@@ -121,6 +121,11 @@ stdenv.mkDerivation rec {
       url = "https://gitlab.com/qemu/qemu/-/commit/f5643914a9e8f79c606a76e6a9d7ea82a3fc3e65.patch";
       sha256 = "sha256-8i13wU135h+YxoXFtkXweBN3hMslpWoNoeQ7Ydmn3V4=";
     })
+    (fetchpatch {
+      name = "CVE-2022-35414.patch";
+      url = "https://gitlab.com/qemu-project/qemu/-/commit/418ade7849ce7641c0f7333718caf5091a02fd4c.patch";
+      sha256 = "sha256-zQHDXedIXZBnabv4+3TA4z5mY1+KZiPmqUbhaSkGLgA=";
+    })
   ]
   ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch;
 

diff --git a/pkgs/build-support/rust/hooks/maturin-build-hook.sh b/pkgs/build-support/rust/hooks/maturin-build-hook.sh
@@ -15,7 +15,8 @@ maturinBuildHook() {
       "CC_@rustTargetPlatform@=@ccForHost@" \
       "CXX_@rustTargetPlatform@=@cxxForHost@" \
       maturin build \
-        --cargo-extra-args="-j $NIX_BUILD_CORES --frozen" \
+        --jobs=$NIX_BUILD_CORES \
+        --frozen \
         --target @rustTargetPlatformSpec@ \
         --manylinux off \
         --strip \