staging-next: 21.11 iteration 1

doc/languages-frameworks/rust.section.md

@@ -186,6 +186,33 @@ added. To find the correct hash, you can first use `lib.fakeSha256` or
 `lib.fakeHash` as a stub hash. Building the package (and thus the
 vendored dependencies) will then inform you of the correct hash.
 
+### Cargo features {#cargo-features}
+
+You can disable default features using `buildNoDefaultFeatures`, and
+extra features can be added with `buildFeatures`.
+
+If you want to use different features for check phase, you can use
+`checkNoDefaultFeatures` and `checkFeatures`. They are only passed to
+`cargo test` and not `cargo build`. If left unset, they default to
+`buildNoDefaultFeatures` and `buildFeatures`.
+
+For example:
+
+```nix
+rustPlatform.buildRustPackage rec {
+  pname = "myproject";
+  version = "1.0.0";
+
+  buildNoDefaultFeatures = true;
+  buildFeatures = [ "color" "net" ];
+
+  # disable network features in tests
+  checkFeatures = [ "color" ];
+
+  # ...
+}
+```
+
 ### Cross compilation {#cross-compilation}
 
 By default, Rust packages are compiled for the host platform, just like any
@@ -261,7 +288,7 @@ rustPlatform.buildRustPackage {
 Please note that the code will be compiled twice here: once in `release` mode
 for the `buildPhase`, and again in `debug` mode for the `checkPhase`.
 
-Test flags, e.g., `--features xxx/yyy`, can be passed to `cargo test` via the
+Test flags, e.g., `--package foo`, can be passed to `cargo test` via the
 `cargoTestFlags` attribute.
 
 Another attribute, called `checkFlags`, is used to pass arguments to the test
@@ -421,18 +448,20 @@ you of the correct hash.
 * `cargoBuildHook`: use Cargo to build a crate. If the crate to be
   built is a crate in e.g. a Cargo workspace, the relative path to the
   crate to build can be set through the optional `buildAndTestSubdir`
-  environment variable. Additional Cargo build flags can be passed
-  through `cargoBuildFlags`.
+  environment variable. Features can be specified with
+  `cargoBuildNoDefaultFeatures` and `cargoBuildFeatures`. Additional
+  Cargo build flags can be passed through `cargoBuildFlags`.
 * `maturinBuildHook`: use [Maturin](https://github.com/PyO3/maturin)
   to build a Python wheel. Similar to `cargoBuildHook`, the optional
   variable `buildAndTestSubdir` can be used to build a crate in a
   Cargo workspace. Additional maturin flags can be passed through
   `maturinBuildFlags`.
 * `cargoCheckHook`: run tests using Cargo. The build type for checks
-  can be set using `cargoCheckType`. Additional flags can be passed to
-  the tests using `checkFlags` and `checkFlagsArray`. By default,
-  tests are run in parallel. This can be disabled by setting
-  `dontUseCargoParallelTests`.
+  can be set using `cargoCheckType`. Features can be specified with
+  `cargoCheckNoDefaultFeaatures` and `cargoCheckFeatures`. Additional
+  flags can be passed to the tests using `checkFlags` and
+  `checkFlagsArray`. By default, tests are run in parallel. This can
+  be disabled by setting `dontUseCargoParallelTests`.
 * `cargoInstallHook`: install binaries and static/shared libraries
   that were built using `cargoBuildHook`.
 

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

@@ -1243,6 +1243,14 @@ Superuser created successfully.
           will no longer work and must be updated.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>fluidsynth_1</literal> attribute has been
+          removed, as this legacy version is no longer needed in
+          nixpkgs. The actively maintained 2.x series is available as
+          <literal>fluidsynth</literal> unchanged.
+        </para>
+      </listitem>
       <listitem>
         <para>
           Nextcloud 20 (<literal>pkgs.nextcloud20</literal>) has been

nixos/doc/manual/release-notes/rl-2111.section.md

@@ -378,6 +378,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 - The `services.mosquitto` module has been rewritten to support multiple listeners and per-listener configuration.
   Module configurations from previous releases will no longer work and must be updated.
 
+- The `fluidsynth_1` attribute has been removed, as this legacy version is no longer needed in nixpkgs. The actively maintained 2.x series is available as `fluidsynth` unchanged.
+
 - Nextcloud 20 (`pkgs.nextcloud20`) has been dropped because it was EOLed by upstream in 2021-10.
 
 - The `virtualisation.pathsInNixDB` option was renamed

nixos/modules/security/pam.nix

@@ -197,6 +197,46 @@ let
         '';
       };
 
+      ttyAudit = {
+        enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Enable or disable TTY auditing for specified users
+          '';
+        };
+
+        enablePattern = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            For each user matching one of comma-separated
+            glob patterns, enable TTY auditing
+          '';
+        };
+
+        disablePattern = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = ''
+            For each user matching one of comma-separated
+            glob patterns, disable TTY auditing
+          '';
+        };
+
+        openOnly = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Set the TTY audit flag when opening the session,
+            but do not restore it when closing the session.
+            Using this option is necessary for some services
+            that don't fork() to run the authenticated session,
+            such as sudo.
+          '';
+        };
+      };
+
       forwardXAuth = mkOption {
         default = false;
         type = types.bool;
@@ -482,6 +522,12 @@ let
               "session ${
                 if config.boot.isContainer then "optional" else "required"
               } pam_loginuid.so"}
+          ${optionalString cfg.ttyAudit.enable
+              "session required ${pkgs.pam}/lib/security/pam_tty_audit.so
+                open_only=${toString cfg.ttyAudit.openOnly}
+                ${optionalString (cfg.ttyAudit.enablePattern != null) "enable=${cfg.ttyAudit.enablePattern}"}
+                ${optionalString (cfg.ttyAudit.disablePattern != null) "disable=${cfg.ttyAudit.disablePattern}"}
+              "}
           ${optionalString cfg.makeHomeDir
               "session required ${pkgs.pam}/lib/security/pam_mkhomedir.so silent skel=${config.security.pam.makeHomeDir.skelDirectory} umask=0022"}
           ${optionalString cfg.updateWtmp

nixos/tests/all-tests.nix

@@ -218,6 +218,7 @@ in
   kerberos = handleTest ./kerberos/default.nix {};
   kernel-generic = handleTest ./kernel-generic.nix {};
   kernel-latest-ath-user-regd = handleTest ./kernel-latest-ath-user-regd.nix {};
+  kexec = handleTest ./kexec.nix {};
   keycloak = discoverTests (import ./keycloak.nix);
   keymap = handleTest ./keymap.nix {};
   knot = handleTest ./knot.nix {};

nixos/tests/kexec.nix

@@ -4,12 +4,6 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
   name = "kexec";
   meta = with lib.maintainers; {
     maintainers = [ eelco ];
-    # Currently hangs forever; last output is:
-    #     machine # [   10.239914] dhcpcd[707]: eth0: adding default route via fe80::2
-    #     machine: waiting for the VM to finish booting
-    #     machine # Cannot find the ESP partition mount point.
-    #     machine # [   28.681197] nscd[692]: 692 checking for monitored file `/etc/netgroup': No such file or directory
-    broken = true;
   };
 
   machine = { ... }:
@@ -18,8 +12,11 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
   testScript =
     ''
       machine.wait_for_unit("multi-user.target")
+      machine.succeed('kexec --load /run/current-system/kernel --initrd /run/current-system/initrd --command-line "$(</proc/cmdline)"')
       machine.execute("systemctl kexec >&2 &", check_return=False)
       machine.connected = False
+      machine.connect()
       machine.wait_for_unit("multi-user.target")
+      machine.shutdown()
     '';
 })

pkgs/applications/audio/cdparanoia/default.nix

@@ -35,6 +35,15 @@ stdenv.mkDerivation rec {
     cp ${gnu-config}/config.guess configure.guess
   '';
 
+  # Build system reuses the same object file names for shared and static
+  # library. Occasionally fails in the middle:
+  #    gcc -O2 -fsigned-char -g -O2 -c scan_devices.c
+  #    rm  -f *.o core *~ *.out
+  #    gcc -O2 -fsigned-char -g -O2 -fpic -c scan_devices.c
+  #    gcc -fpic -shared -o libcdda_interface.so.0.10.2 ... scan_devices.o ...
+  #    scan_devices.o: file not recognized: file format not recognized
+  enableParallelBuilding = false;
+
   meta = with lib; {
     homepage = "https://xiph.org/paranoia";
     description = "A tool and library for reading digital audio from CDs";

pkgs/applications/audio/espeak-ng/default.nix

@@ -35,6 +35,12 @@ stdenv.mkDerivation rec {
     "--with-mbrola=${if mbrolaSupport then "yes" else "no"}"
   ];
 
+  # Current release lacks dependencies on local espeak-ng:
+  #  cd dictsource && ESPEAK_DATA_PATH=/build/espeak-ng LD_LIBRARY_PATH=../src: ../src/espeak-ng --compile=yue && cd ..
+  #  bash: line 1: ../src/espeak-ng: No such file or directory
+  # Should be fixed in next release: https://github.com/espeak-ng/espeak-ng/pull/1029
+  enableParallelBuilding = false;
+
   postInstall = lib.optionalString stdenv.isLinux ''
     patchelf --set-rpath "$(patchelf --print-rpath $out/bin/espeak-ng)" $out/bin/speak-ng
   '';

pkgs/applications/audio/fluidsynth/default.nix

@@ -1,33 +1,17 @@
 { stdenv, lib, fetchFromGitHub, pkg-config, cmake
 , alsa-lib, glib, libjack2, libsndfile, libpulseaudio
 , AudioUnit, CoreAudio, CoreMIDI, CoreServices
-, version ? "2"
 }:
 
-let
-  versionMap = {
-    "1" = {
-      fluidsynthVersion = "1.1.11";
-      sha256 = "0n75jq3xgq46hfmjkaaxz3gic77shs4fzajq40c8gk043i84xbdh";
-    };
-    "2" = {
-      fluidsynthVersion = "2.2.3";
-      sha256 = "0x5808d03ym23np17nl8gfbkx3c4y3d7jyyr2222wn2prswbb6x3";
-    };
-  };
-in
-
-with versionMap.${version};
-
-stdenv.mkDerivation  {
-  name = "fluidsynth-${fluidsynthVersion}";
-  version = fluidsynthVersion;
+stdenv.mkDerivation rec {
+  pname = "fluidsynth";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
-    rev = "v${fluidsynthVersion}";
-    inherit sha256;
+    rev = "v${version}";
+    sha256 = "0x5808d03ym23np17nl8gfbkx3c4y3d7jyyr2222wn2prswbb6x3";
   };
 
   nativeBuildInputs = [ pkg-config cmake ];

pkgs/applications/audio/ncspot/default.nix

@@ -5,13 +5,6 @@
 , withMPRIS ? false, dbus ? null
 }:
 
-let
-  features = [ "cursive/pancurses-backend" ]
-    ++ lib.optional withALSA "alsa_backend"
-    ++ lib.optional withPulseAudio "pulseaudio_backend"
-    ++ lib.optional withPortAudio "portaudio_backend"
-    ++ lib.optional withMPRIS "mpris";
-in
 rustPlatform.buildRustPackage rec {
   pname = "ncspot";
   version = "0.9.0";
@@ -25,8 +18,6 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "0sdbba32f56z2q7kha5fxw2f00hikbz9sf4zl4wfl2i9b13j7mj0";
 
-  cargoBuildFlags = [ "--no-default-features" "--features" "${lib.concatStringsSep "," features}" ];
-
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ ncurses openssl ]
@@ -36,6 +27,13 @@ rustPlatform.buildRustPackage rec {
     ++ lib.optional withPortAudio portaudio
     ++ lib.optional withMPRIS dbus;
 
+  buildNoDefaultFeatures = true;
+  buildFeatures = [ "cursive/pancurses-backend" ]
+    ++ lib.optional withALSA "alsa_backend"
+    ++ lib.optional withPulseAudio "pulseaudio_backend"
+    ++ lib.optional withPortAudio "portaudio_backend"
+    ++ lib.optional withMPRIS "mpris";
+
   doCheck = false;
 
   meta = with lib; {

pkgs/applications/audio/whipper/default.nix

@@ -42,7 +42,7 @@ in python3.pkgs.buildPythonApplication rec {
     mutagen
     pycdio
     pygobject3
-    ruamel_yaml
+    ruamel-yaml
     discid
     pillow
   ];

pkgs/applications/display-managers/sddm/default.nix

@@ -25,6 +25,12 @@ in mkDerivation {
       url = "https://github.com/sddm/sddm/commit/e1dedeeab6de565e043f26ac16033e613c222ef9.patch";
       sha256 = "sha256-OPyrUI3bbH+PGDBfoL4Ohb4wIvmy9TeYZhE0JxR/D58=";
     })
+    # Fix build with Qt 5.15.3
+    # See: https://github.com/sddm/sddm/pull/1325
+    (fetchpatch {
+      url = "https://github.com/sddm/sddm/commit/e93bf95c54ad8c2a1604f8d7be05339164b19308.patch";
+      sha256 = "sha256:1rh6sdvzivjcl5b05fczarvxhgpjhi7019hvf2gadnwgwdg104r4";
+    })
   ];
 
   postPatch =

pkgs/applications/editors/vim/common.nix

@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "8.2.3337";
+  version = "8.2.3451";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    sha256 = "sha256-iwSGcLeqXH0bVIXEI5OnotG88Uv8ntycisD9EcHjz/c=";
+    sha256 = "sha256-8OaEaFyOaL59j0EZkUY+kuR6si79H2dN09f8SnltxbQ=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/graphics/epick/default.nix

@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "epick";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "vv9k";
     repo = pname;
     rev = version;
-    sha256 = "0l7m45bqx62nrwi0r4pdwxcq37s7h3nnawk9nq2zpvl9wcgnx3gc";
+    sha256 = "sha256-x1C8kY9VpMg7aXgC/jRsLCeUV8uRLobgjSAQdK2/sHk=";
   };
 
-  cargoSha256 = "sha256-LERV3+zwt5oVfyueGfxM7HsOha4cuWTkPyvPQwHSZqo=";
+  cargoSha256 = "sha256-KgQOlvKRt47lg7NteqBa2DLKkDf93JTzp9EIHn3clxY=";
 
   nativeBuildInputs = lib.optional stdenv.isLinux python3;
 

pkgs/applications/graphics/menyoki/default.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "menyoki";
-  version = "1.5.3";
+  version = "1.5.5";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "050c6c60il6cy0a8d3nw4z2cyp043912a7n4n44yjpmx047w7kc7";
+    sha256 = "sha256-wEPt96z/odQ05hosN+GB5KLsCu8onR9WWamofJayhwU=";
   };
 
-  cargoSha256 = "0wwcda2w8jg3q132cvhdgfmjc0rz93fx6fai93g5w8br98aq9qzx";
+  cargoSha256 = "sha256-nwxBreouL3Z47zHSH+Y/ej7KU2/bXyMQ+Tb7R4U+yKk=";
 
   nativeBuildInputs = [ installShellFiles ]
     ++ lib.optional stdenv.isLinux pkg-config;
@@ -37,8 +37,8 @@ rustPlatform.buildRustPackage rec {
   meta = with lib; {
     description = "Screen{shot,cast} and perform ImageOps on the command line";
     homepage = "https://menyoki.cli.rs/";
+    changelog = "https://github.com/orhun/menyoki/blob/v${version}/CHANGELOG.md";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ figsoda ];
-    broken = stdenv.isDarwin;
   };
 }

pkgs/applications/misc/khard/default.nix

@@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication rec {
     atomicwrites
     configobj
     vobject
-    ruamel_yaml
+    ruamel-yaml
     ruamel_base
     unidecode
   ];

pkgs/applications/misc/robo3t/default.nix

@@ -15,7 +15,7 @@
 }:
 
 let
-  curlWithGnuTls = curl.override { gnutlsSupport = true; sslSupport = false; };
+  curlWithGnuTls = curl.override { gnutlsSupport = true; opensslSupport = false; };
 in
 
 stdenv.mkDerivation rec {