Merge master into staging-next

26 files changed, 362 insertions, 140 deletions

diff --git a/doc/languages-frameworks/r.section.md b/doc/languages-frameworks/r.section.md
index 56e3da64df2a7..ad0fb10987c98 100644
--- a/doc/languages-frameworks/r.section.md
+++ b/doc/languages-frameworks/r.section.md
@@ -96,6 +96,11 @@ re-enter the shell.
 
 ## Updating the package set {#updating-the-package-set}
 
+There is a script and associated environment for regenerating the package
+sets and synchronising the rPackages tree to the current CRAN and matching
+BIOC release. These scripts are found in the `pkgs/development/r-modules`
+directory and executed as follows:
+
 ```bash
 nix-shell generate-shell.nix
 
@@ -112,12 +117,11 @@ Rscript generate-r-packages.R bioc-experiment > bioc-experiment-packages.nix.new
 mv bioc-experiment-packages.nix.new bioc-experiment-packages.nix
 ```
 
-`generate-r-packages.R <repo>` reads  `<repo>-packages.nix`, therefor the renaming.
-
-## Testing if the Nix-expression could be evaluated {#testing-if-the-nix-expression-could-be-evaluated}
-
-```bash
-nix-build test-evaluation.nix --dry-run
-```
+`generate-r-packages.R <repo>` reads  `<repo>-packages.nix`, therefore
+the renaming.
 
-If this exits fine, the expression is ok. If not, you have to edit `default.nix`
+Some packages require overrides to specify external dependencies or other
+patches and special requirements. These overrides are specified in the
+`pkgs/development/r-modules/default.nix` file. As the `*-packages.nix`
+contents are automatically generated it should not be edited and broken
+builds should be addressed using overrides.
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 2b8edb9c51f8d..da18fae4ca7d0 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -544,7 +544,7 @@ in
         type = types.lines;
         default = "";
         description = "
-          Entries for the virtual alias map, cf. man-page virtual(8).
+          Entries for the virtual alias map, cf. man-page virtual(5).
         ";
       };
 
diff --git a/pkgs/development/interpreters/erlang/generic-builder.nix b/pkgs/development/interpreters/erlang/generic-builder.nix
index 3d5c692930b65..f4f7d64835457 100644
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@@ -84,9 +84,13 @@ let
 
 in
 stdenv.mkDerivation ({
-  name = "${baseName}-${version}"
-    + optionalString javacSupport "-javac"
-    + optionalString odbcSupport "-odbc";
+  # name is used instead of pname to
+  # - not have to pass pnames as argument
+  # - have a separate pname for erlang (main module)
+  name = "${baseName}"
+    + optionalString javacSupport "_javac"
+    + optionalString odbcSupport "_odbc"
+    + "-${version}";
 
   inherit src version;
 
diff --git a/pkgs/development/misc/resholve/README.md b/pkgs/development/misc/resholve/README.md
index 024465f306cd2..0b4bcb371ade1 100644
--- a/pkgs/development/misc/resholve/README.md
+++ b/pkgs/development/misc/resholve/README.md
@@ -2,7 +2,8 @@
 
 resholve converts bare executable references in shell scripts to absolute
 paths. This will hopefully make its way into the Nixpkgs manual soon, but
-until then I'll outline how to use the `resholvePackage` function.
+until then I'll outline how to use the `resholvePackage`, `resholveScript`,
+and `resholveScriptBin` functions.
 
 > Fair warning: resholve does *not* aspire to resolving all valid Shell
 > scripts. It depends on the OSH/Oil parser, which aims to support most (but
@@ -21,7 +22,10 @@ Each "solution" (k=v pair) in this attrset describes one resholve invocation.
 > - Packages with scripts that require conflicting directives can use multiple
 >   solutions to resolve the scripts separately, but produce a single package.
 
-## Basic Example
+The `resholveScript` and `resholveScriptBin` functions support a _single_
+`solution` attrset. This is basically the same as any single solution in `resholvePackage`, except that it doesn't need a `scripts` attr (it is automatically added).
+
+## Basic `resholvePackage` Example
 
 Here's a simple example from one of my own projects, with annotations:
 <!--
@@ -68,6 +72,28 @@ resholvePackage rec {
 }
 ```
 
+## Basic `resholveScript` and `resholveScriptBin` examples
+
+Both of these functions have the same basic API. This example is a little
+trivial for now. If you have a real usage that you find helpful, please PR it.
+
+```nix
+resholvedScript = resholveScript "name" {
+    inputs = [ file ];
+    interpreter = "${bash}/bin/bash";
+  } ''
+    echo "Hello"
+    file .
+  '';
+resholvedScriptBin = resholveScriptBin "name" {
+    inputs = [ file ];
+    interpreter = "${bash}/bin/bash";
+  } ''
+    echo "Hello"
+    file .
+  '';
+```
+
 ## Options
 
 `resholvePackage` maps Nix types/idioms into the flags and environment variables
@@ -79,7 +105,7 @@ that the `resholve` CLI expects. Here's an overview:
 | inputs        | list    | packages to resolve executables from                  |
 | interpreter   | string  | 'none' or abspath for shebang                         |
 | prologue      | file    | text to insert before the first code-line             |
-| epilogue      | file    | text to isnert after the last code-line               |
+| epilogue      | file    | text to insert after the last code-line               |
 | flags         | list    | strings to pass as flags                              |
 | fake          | attrset | [directives](#controlling-resolution-with-directives) |
 | fix           | attrset | [directives](#controlling-resolution-with-directives) |
@@ -135,31 +161,31 @@ from the manpage, and the Nix equivalents:
 ```nix
 # --fake 'f:setUp;tearDown builtin:setopt source:/etc/bashrc'
 fake = {
-  # fake accepts the initial of valid identifier types as a CLI convienience.
+  # fake accepts the initial of valid identifier types as a CLI convenience.
   # Use full names in the Nix API.
   function = [ "setUp" "tearDown" ];
   builtin = [ "setopt" ];
   source = [ "/etc/bashrc" ];
 };
 
-# --fix 'aliases xargs:ls $GIT:gix'
+# --fix 'aliases $GIT:gix /bin/bash'
 fix = {
   # all single-word directives use `true` as value
   aliases = true;
-  xargs = [ "ls" ];
   "$GIT" = [ "gix" ];
+  "/bin/bash";
 };
 
-# --keep 'which:git;ls .:$HOME $LS:exa /etc/bashrc ~/.bashrc'
+# --keep 'source:$HOME /etc/bashrc ~/.bashrc'
 keep = {
-  which = [ "git" "ls" ];
-  "." = [ "$HOME" ];
-  "$LS" = [ "exa" ];
+  source = [ "$HOME" ];
   "/etc/bashrc" = true;
   "~/.bashrc" = true;
 };
 ```
 
+> **Note:** For now, at least, you'll need to reference the manpage to completely understand these examples.
+
 ## Controlling nested resolution with lore
 
 Initially, resolution of commands in the arguments to command-executing
@@ -177,6 +203,11 @@ some of the more common commands.
 - "wrapper" lore maps shell exec wrappers to the programs they exec so
   that resholve can substitute an executable's verdict for its wrapper's.
 
+> **Caution:** At least when it comes to common utilities, it's best to treat
+> overrides as a stopgap until they can be properly handled in resholve and/or
+> binlore. Please report things you have to override and, if possible, help
+> get them sorted.
+
 There will be more mechanisms for controlling this process in the future
 (and your reports/experiences will play a role in shaping them...) For now,
 the main lever is the ability to substitute your own lore. This is how you'd
diff --git a/pkgs/development/misc/resholve/default.nix b/pkgs/development/misc/resholve/default.nix
index dae7fdc384c1e..714c4ecabe082 100644
--- a/pkgs/development/misc/resholve/default.nix
+++ b/pkgs/development/misc/resholve/default.nix
@@ -1,5 +1,5 @@
 { callPackage
-, ...
+, writeTextFile
 }:
 
 let
@@ -8,11 +8,46 @@ let
 in
 rec {
   resholve = callPackage ./resholve.nix {
-    inherit (source) rSrc;
-    inherit (source) version;
+    inherit (source) rSrc version;
     inherit (deps.oil) oildev;
   };
-  resholvePackage = callPackage ./resholve-package.nix {
+  resholve-utils = callPackage ./resholve-utils.nix {
     inherit resholve;
   };
+  resholvePackage = callPackage ./resholve-package.nix {
+    inherit resholve resholve-utils;
+  };
+  resholveScript = name: partialSolution: text:
+    writeTextFile {
+      inherit name text;
+      executable = true;
+      checkPhase = ''
+        (
+          PS4=$'\x1f'"\033[33m[resholve context]\033[0m "
+          set -x
+          ${resholve-utils.makeInvocation name (partialSolution // {
+            scripts = [ "${placeholder "out"}" ];
+          })}
+        )
+        ${partialSolution.interpreter} -n $out
+      '';
+    };
+  resholveScriptBin = name: partialSolution: text:
+    writeTextFile rec {
+      inherit name text;
+      executable = true;
+      destination = "/bin/${name}";
+      checkPhase = ''
+        (
+          cd "$out"
+          PS4=$'\x1f'"\033[33m[resholve context]\033[0m "
+          set -x
+          : changing directory to $PWD
+          ${resholve-utils.makeInvocation name (partialSolution // {
+            scripts = [ "bin/${name}" ];
+          })}
+        )
+        ${partialSolution.interpreter} -n $out/bin/${name}
+      '';
+    };
 }
diff --git a/pkgs/development/misc/resholve/oildev.nix b/pkgs/development/misc/resholve/oildev.nix
index b15047b53ff9c..635aca9aa57a2 100644
--- a/pkgs/development/misc/resholve/oildev.nix
+++ b/pkgs/development/misc/resholve/oildev.nix
@@ -46,6 +46,11 @@ rec {
     nativeBuildInputs = [ git ];
   };
 
+  /*
+    Upstream isn't interested in packaging this as a library
+    (or accepting all of the patches we need to do so).
+    This creates one without disturbing upstream too much.
+  */
   oildev = python27Packages.buildPythonPackage rec {
     pname = "oildev-unstable";
     version = "2021-07-14";
@@ -61,22 +66,21 @@ rec {
         It's not critical to drop most of these; the primary target is
         the vendored fork of Python-2.7.13, which is ~ 55M and over 3200
         files, dozens of which get interpreter script patches in fixup.
+
+        Note: -f is necessary to keep it from being a pain to update
+        hash on rev updates. Command will fail w/o and not print hash.
       */
       extraPostFetch = ''
         rm -rf Python-2.7.13 benchmarks metrics py-yajl rfc gold web testdata services demo devtools cpp
       '';
     };
 
-    # TODO: not sure why I'm having to set this for nix-build...
-    #       can anyone tell if I'm doing something wrong?
-    SOURCE_DATE_EPOCH = 315532800;
-
     # patch to support a python package, pass tests on macOS, etc.
     patchSrc = fetchFromGitHub {
       owner = "abathur";
       repo = "nix-py-dev-oil";
-      rev = "v0.8.12";
-      hash = "sha256-/EvwxL201lGsioL0lIhzM8VTghe6FuVbc3PBJgY8c8E=";
+      rev = "v0.8.12.1";
+      hash = "sha256-7JVnosdcvmVFN3h6SIeeqcJFcyFkai//fFuzi7ThNMY=";
     };
     patches = [
       "${patchSrc}/0001-add_setup_py.patch"
@@ -102,7 +106,12 @@ rec {
       patchShebangs asdl build core doctools frontend native oil_lang
     '';
 
-    # TODO: this may be obsolete?
+    /*
+    We did convince oil to upstream an env for specifying
+    this to support a shell.nix. Would need a patch if they
+    later drop this support. See:
+    https://github.com/oilshell/oil/blob/46900310c7e4a07a6223eb6c08e4f26460aad285/doctools/cmark.py#L30-L34
+    */
     _NIX_SHELL_LIBCMARK = "${cmark}/lib/libcmark${stdenv.hostPlatform.extensions.sharedLibrary}";
 
     # See earlier note on glibcLocales TODO: verify needed?
diff --git a/pkgs/development/misc/resholve/resholve-package.nix b/pkgs/development/misc/resholve/resholve-package.nix
index 78ee6603b9d48..89852efb8bac8 100644
--- a/pkgs/development/misc/resholve/resholve-package.nix
+++ b/pkgs/development/misc/resholve/resholve-package.nix
@@ -1,4 +1,4 @@
-{ stdenv, lib, resholve, binlore }:
+{ stdenv, lib, resholve, resholve-utils }:
 
 { pname
 , src
@@ -9,81 +9,11 @@
 }@attrs:
 let
   inherit stdenv;
-  /* These functions break up the work of partially validating the
-    'solutions' attrset and massaging it into env/cli args.
-
-    Note: some of the left-most args do not *have* to be passed as
-    deep as they are, but I've done so to provide more error context
-  */
-
-  # for brevity / line length
-  spaces = l: builtins.concatStringsSep " " l;
-  semicolons = l: builtins.concatStringsSep ";" l;
-
-  /* Throw a fit with dotted attr path context */
-  nope = path: msg:
-    throw "${builtins.concatStringsSep "." path}: ${msg}";
-
-  /* Special-case directive value representations by type */
-  makeDirective = solution: env: name: val:
-    if builtins.isInt val then builtins.toString val
-    else if builtins.isString val then name
-    else if true == val then name
-    else if false == val then "" # omit!
-    else if null == val then "" # omit!
-    else if builtins.isList val then "${name}:${semicolons val}"
-    else nope [ solution env name ] "unexpected type: ${builtins.typeOf val}";
-
-  /* Build fake/fix/keep directives from Nix types */
-  makeDirectives = solution: env: val:
-    lib.mapAttrsToList (makeDirective solution env) val;
-
-  /* Special-case value representation by type/name */
-  makeEnvVal = solution: env: val:
-    if env == "inputs" then lib.makeBinPath val
-    else if builtins.isString val then val
-    else if builtins.isList val then spaces val
-    else if builtins.isAttrs val then spaces (makeDirectives solution env val)
-    else nope [ solution env ] "unexpected type: ${builtins.typeOf val}";
-
-  /* Shell-format each env value */
-  shellEnv = solution: env: value:
-    lib.escapeShellArg (makeEnvVal solution env value);
-
-  /* Build a single ENV=val pair */
-  makeEnv = solution: env: value:
-    "RESHOLVE_${lib.toUpper env}=${shellEnv solution env value}";
-
-  /* Discard attrs claimed by makeArgs */
-  removeCliArgs = value:
-    removeAttrs value [ "scripts" "flags" ];
-
-  /* Verify required arguments are present */
-  validateSolution = { scripts, inputs, interpreter, ... }: true;
-
-  /* Pull out specific solution keys to build ENV=val pairs */
-  makeEnvs = solution: value:
-    spaces (lib.mapAttrsToList (makeEnv solution) (removeCliArgs value));
-
-  /* Pull out specific solution keys to build CLI argstring */
-  makeArgs = { flags ? [ ], scripts, ... }:
-    spaces (flags ++ scripts);
-
-  /* Build a single resholve invocation */
-  makeInvocation = solution: value:
-    if validateSolution value then
-    # we pass resholve a directory
-      "RESHOLVE_LORE=${binlore.collect { drvs = value.inputs; } } ${makeEnvs solution value} resholve --overwrite ${makeArgs value}"
-    else throw "invalid solution"; # shouldn't trigger for now
-
-  /* Build resholve invocation for each solution. */
-  makeCommands = solutions:
-    lib.mapAttrsToList makeInvocation solutions;
 
   self = (stdenv.mkDerivation ((removeAttrs attrs [ "solutions" ])
     // {
     inherit pname version src;
-    buildInputs = [ resholve ];
+    buildInputs = (lib.optionals (builtins.hasAttr "buildInputs" attrs) attrs.buildInputs) ++ [ resholve ];
 
     # enable below for verbose debug info if needed
     # supports default python.logging levels
@@ -99,7 +29,7 @@ let
         PS4=$'\x1f'"\033[33m[resholve context]\033[0m "
         set -x
         : changing directory to $PWD
-        ${builtins.concatStringsSep "\n" (makeCommands solutions)}
+        ${builtins.concatStringsSep "\n" (resholve-utils.makeCommands solutions)}
       )
     '';
   }));
diff --git a/pkgs/development/misc/resholve/resholve-utils.nix b/pkgs/development/misc/resholve/resholve-utils.nix
new file mode 100644
index 0000000000000..2d3c55b875631
--- /dev/null
+++ b/pkgs/development/misc/resholve/resholve-utils.nix
@@ -0,0 +1,74 @@
+{ lib, resholve, binlore }:
+
+rec {
+  /* These functions break up the work of partially validating the
+    'solutions' attrset and massaging it into env/cli args.
+
+    Note: some of the left-most args do not *have* to be passed as
+    deep as they are, but I've done so to provide more error context
+  */
+
+  # for brevity / line length
+  spaces = l: builtins.concatStringsSep " " l;
+  semicolons = l: builtins.concatStringsSep ";" l;
+
+  /* Throw a fit with dotted attr path context */
+  nope = path: msg:
+    throw "${builtins.concatStringsSep "." path}: ${msg}";
+
+  /* Special-case directive value representations by type */
+  makeDirective = solution: env: name: val:
+    if builtins.isInt val then builtins.toString val
+    else if builtins.isString val then name
+    else if true == val then name
+    else if false == val then "" # omit!
+    else if null == val then "" # omit!
+    else if builtins.isList val then "${name}:${semicolons val}"
+    else nope [ solution env name ] "unexpected type: ${builtins.typeOf val}";
+
+  /* Build fake/fix/keep directives from Nix types */
+  makeDirectives = solution: env: val:
+    lib.mapAttrsToList (makeDirective solution env) val;
+
+  /* Special-case value representation by type/name */
+  makeEnvVal = solution: env: val:
+    if env == "inputs" then lib.makeBinPath val
+    else if builtins.isString val then val
+    else if builtins.isList val then spaces val
+    else if builtins.isAttrs val then spaces (makeDirectives solution env val)
+    else nope [ solution env ] "unexpected type: ${builtins.typeOf val}";
+
+  /* Shell-format each env value */
+  shellEnv = solution: env: value:
+    lib.escapeShellArg (makeEnvVal solution env value);
+
+  /* Build a single ENV=val pair */
+  makeEnv = solution: env: value:
+    "RESHOLVE_${lib.toUpper env}=${shellEnv solution env value}";
+
+  /* Discard attrs claimed by makeArgs */
+  removeCliArgs = value:
+    removeAttrs value [ "scripts" "flags" ];
+
+  /* Verify required arguments are present */
+  validateSolution = { scripts, inputs, interpreter, ... }: true;
+
+  /* Pull out specific solution keys to build ENV=val pairs */
+  makeEnvs = solution: value:
+    spaces (lib.mapAttrsToList (makeEnv solution) (removeCliArgs value));
+
+  /* Pull out specific solution keys to build CLI argstring */
+  makeArgs = { flags ? [ ], scripts, ... }:
+    spaces (flags ++ scripts);
+
+  /* Build a single resholve invocation */
+  makeInvocation = solution: value:
+    if validateSolution value then
+    # we pass resholve a directory
+      "RESHOLVE_LORE=${binlore.collect { drvs = value.inputs; } } ${makeEnvs solution value} ${resholve}/bin/resholve --overwrite ${makeArgs value}"
+    else throw "invalid solution"; # shouldn't trigger for now
+
+  /* Build resholve invocation for each solution. */
+  makeCommands = solutions:
+    lib.mapAttrsToList makeInvocation solutions;
+}
diff --git a/pkgs/development/misc/resholve/source.nix b/pkgs/development/misc/resholve/source.nix
index 32ffeb98fd7e2..5633e90f4bb0f 100644
--- a/pkgs/development/misc/resholve/source.nix
+++ b/pkgs/development/misc/resholve/source.nix
@@ -3,7 +3,7 @@
 }:
 
 rec {
-  version = "0.6.0";
+  version = "0.6.6";
   rSrc =
     # local build -> `make ci`; `make clean` to restore
     # return to remote source
@@ -14,6 +14,6 @@ rec {
         owner = "abathur";
         repo = "resholve";
         rev = "v${version}";
-        hash = "sha256-GfhhU9f5kiYcuYTPKWXCIkAGsz7GhAUGjAmIZ8Ww5X4=";
+        hash = "sha256-bupf3c9tNPAEMzFEDcvg483bSiwZFuB3ZqveG89dgkE=";
       };
 }
diff --git a/pkgs/development/misc/resholve/test.nix b/pkgs/development/misc/resholve/test.nix
index f263c019d8137..ca8a51c705d62 100644
--- a/pkgs/development/misc/resholve/test.nix
+++ b/pkgs/development/misc/resholve/test.nix
@@ -23,7 +23,7 @@
 
 let
   inherit (callPackage ./default.nix { })
-    resholve resholvePackage;
+    resholve resholvePackage resholveScript resholveScriptBin;
 
   # ourCoreutils = coreutils.override { singleBinary = false; };
 
@@ -224,4 +224,20 @@ rec {
       fi
     '';
   };
+
+  # Caution: ci.nix asserts the equality of both of these w/ diff
+  resholvedScript = resholveScript "resholved-script" {
+    inputs = [ file ];
+    interpreter = "${bash}/bin/bash";
+  } ''
+    echo "Hello"
+    file .
+  '';
+  resholvedScriptBin = resholveScriptBin "resholved-script-bin" {
+    inputs = [ file ];
+    interpreter = "${bash}/bin/bash";
+  } ''
+    echo "Hello"
+    file .
+  '';
 }
diff --git a/pkgs/development/python-modules/fe25519/default.nix b/pkgs/development/python-modules/fe25519/default.nix
index 89890b8e8cf28..193d7aa60decd 100644
--- a/pkgs/development/python-modules/fe25519/default.nix
+++ b/pkgs/development/python-modules/fe25519/default.nix
@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "fe25519";
-  version = "0.3.0";
+  version = "1.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8819659f19b51713199a75fda5107c93fbb6e2cb4afef3164ce7932b5eb276b9";
+    sha256 = "sha256-947DIkmg56mAegEgLKq8iqETWf2SCvtmeDZi5cxVSJA=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/ge25519/default.nix b/pkgs/development/python-modules/ge25519/default.nix
index 0e8d3722fbecf..1a00108a8f8fb 100644
--- a/pkgs/development/python-modules/ge25519/default.nix
+++ b/pkgs/development/python-modules/ge25519/default.nix
@@ -11,11 +11,11 @@
 
 buildPythonPackage rec {
   pname = "ge25519";
-  version = "0.2.0";
+  version = "1.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1wgv0vqg8iv9y5d7if14gmcgslwd5zzgk322w9jaxdfbndldddik";
+    sha256 = "sha256-f7xvZ92zRO3GLSdfgEyhkWVwAFT2TvKHy6+iF+k43bI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/lupupy/default.nix b/pkgs/development/python-modules/lupupy/default.nix
new file mode 100644
index 0000000000000..a1248d331426c
--- /dev/null
+++ b/pkgs/development/python-modules/lupupy/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, colorlog
+, demjson
+, fetchPypi
+, pythonOlder
+, requests
+}:
+
+buildPythonPackage rec {
+  pname = "lupupy";
+  version = "0.0.21";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "0cpamb1fp84psiqm7xr156zi4f2fv2wijbjjyk6w87z8fl2aw8xc";
+  };
+
+  propagatedBuildInputs = [
+    colorlog
+    demjson
+    requests
+  ];
+
+  # Project has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "lupupy" ];
+
+  meta = with lib; {
+    description = "Python module to control Lupusec alarm control panels";
+    homepage = "https://github.com/majuss/lupupy";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/r-modules/generate-r-packages.R b/pkgs/development/r-modules/generate-r-packages.R
index f656fdca0922d..8c97c651e4c4b 100755
--- a/pkgs/development/r-modules/generate-r-packages.R
+++ b/pkgs/development/r-modules/generate-r-packages.R
@@ -82,6 +82,17 @@ pkgs$sha256 <- parApply(cl, pkgs, 1, function(p) nixPrefetch(p[1], p[2]))
 nix <- apply(pkgs, 1, function(p) formatPackage(p[1], p[2], p[18], p[4], p[5], p[6]))
 write("done", stderr())
 
+# Mark deleted packages as broken
+setkey(readFormatted, V2)
+markBroken <- function(name) {
+  str <- paste0(readFormatted[name], collapse='"')
+  if(sum(grep("broken = true;", str)))
+    return(str)
+  write(paste("marked", name, "as broken"), stderr())
+  gsub("};$", "broken = true; };", str)
+}
+broken <- lapply(setdiff(readFormatted[[2]], pkgs[[1]]), markBroken)
+
 cat("# This file is generated from generate-r-packages.R. DO NOT EDIT.\n")
 cat("# Execute the following command to update the file.\n")
 cat("#\n")
@@ -95,6 +106,7 @@ if (mirrorType == "cran") { cat("{ snapshot = \"", paste(snapshotDate), "\"; }",
 cat(";\n")
 cat("in with self; {\n")
 cat(paste(nix, collapse="\n"), "\n", sep="")
+cat(paste(broken, collapse="\n"), "\n", sep="")
 cat("}\n")
 
 stopCluster(cl)
diff --git a/pkgs/development/tools/sigrok-cli/default.nix b/pkgs/development/tools/sigrok-cli/default.nix
index 7935d10effcb9..b1ba0402a3e79 100644
--- a/pkgs/development/tools/sigrok-cli/default.nix
+++ b/pkgs/development/tools/sigrok-cli/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sigrok-cli";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchurl {
     url = "https://sigrok.org/download/source/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "15vpn1psriadcbl6v9swwgws7dva85ld03yv6g1mgm27kx11697m";
+    sha256 = "sha256-cdBEPzaJe/Vlcy3sIGgw2+oPJ4m2YBzxBTayhtEUCrg=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/misc/vim-plugins/generated.nix b/pkgs/misc/vim-plugins/generated.nix
index dbc5419abe525..852ccb68309fe 100644
--- a/pkgs/misc/vim-plugins/generated.nix
+++ b/pkgs/misc/vim-plugins/generated.nix
@@ -1289,18 +1289,6 @@ final: prev:
     meta.homepage = "https://github.com/deoplete-plugins/deoplete-dictionary/";
   };
 
-  deoplete-emoji = buildVimPluginFrom2Nix {
-    pname = "deoplete-emoji";
-    version = "2019-01-20";
-    src = fetchFromGitHub {
-      owner = "fszymanski";
-      repo = "deoplete-emoji";
-      rev = "1dfa2da6ae3ee146ddfbfdba48cf45f0c1d57d7d";
-      sha256 = "0drqbdmy8igq6rv7s2qlxsp391pydcynlr9gkaadzrg7pk4nlgsb";
-    };
-    meta.homepage = "https://github.com/fszymanski/deoplete-emoji/";
-  };
-
   deoplete-fish = buildVimPluginFrom2Nix {
     pname = "deoplete-fish";
     version = "2020-04-04";
diff --git a/pkgs/misc/vim-plugins/vim-plugin-names b/pkgs/misc/vim-plugins/vim-plugin-names
index b433b04c7cba7..234b2a2355c27 100644
--- a/pkgs/misc/vim-plugins/vim-plugin-names
+++ b/pkgs/misc/vim-plugins/vim-plugin-names
@@ -173,7 +173,6 @@ frigoeu/psc-ide-vim
 fruit-in/brainfuck-vim
 fruit-in/vim-nong-theme
 fsharp/vim-fsharp
-fszymanski/deoplete-emoji
 garbas/vim-snipmate
 gcmt/taboo.vim
 gcmt/wildfire.vim
diff --git a/pkgs/os-specific/linux/sydbox/default.nix b/pkgs/os-specific/linux/sydbox/default.nix
new file mode 100644
index 0000000000000..bdaf77147f2ee
--- /dev/null
+++ b/pkgs/os-specific/linux/sydbox/default.nix
@@ -0,0 +1,77 @@
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, autoreconfHook
+, python3
+, perl
+, libxslt
+, docbook_xsl
+, docbook_xml_dtd_42
+, libseccomp
+, installTests ? true, gnumake, which
+, debugBuild ? false, libunwind
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sydbox-1";
+  version = "2.2.0";
+
+  outputs = [ "out" "dev" "man" "doc" ]
+    ++ lib.optional installTests "installedTests";
+
+  src = fetchurl {
+    url = "https://git.exherbo.org/${pname}.git/snapshot/${pname}-${version}.tar.xz";
+    sha256 = "0664myrrzbvsw73q5b7cqwgv4hl9a7vkm642s1r96gaxm16jk0z7";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    autoreconfHook
+    python3
+    perl
+    libxslt.bin
+    docbook_xsl
+    docbook_xml_dtd_42
+  ];
+
+  buildInputs = [
+    libseccomp
+  ] ++ lib.optional debugBuild libunwind
+    ++ lib.optionals installTests [
+      gnumake
+      python3
+      perl
+      which
+    ];
+
+  enableParallelBuilding = true;
+
+  configureFlags = [ ]
+    ++ lib.optionals installTests [ "--enable-installed-tests"
+      "--libexecdir=${placeholder "installedTests"}/libexec" ]
+    ++ lib.optional debugBuild "--enable-debug";
+
+  makeFlags = [ "SYD_INCLUDEDIR=${stdenv.cc.libc.dev}/include" ];
+
+  doCheck = true;
+  checkPhase = ''
+    # Many of the regular test cases in t/ do not work inside the build sandbox
+    make -C syd check
+  '';
+
+  postInstall = if installTests then ''
+    moveToOutput bin/syd-test $installedTests
+  '' else ''
+    # Tests are installed despite --disable-installed-tests
+    rm -r $out/bin/syd-test $out/libexec
+  '';
+
+  meta = with lib; {
+    homepage = "https://sydbox.exherbo.org/";
+    description = "seccomp-based application sandbox";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mvs ];
+  };
+}
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 6204a43b2c536..39a5ed3e2bea2 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -478,7 +478,7 @@
     "lovelace" = ps: with ps; [ ];
     "luci" = ps: with ps; [ openwrt-luci-rpc ];
     "luftdaten" = ps: with ps; [ luftdaten ];
-    "lupusec" = ps: with ps; [ ]; # missing inputs: lupupy
+    "lupusec" = ps: with ps; [ lupupy ];
     "lutron" = ps: with ps; [ pylutron ];
     "lutron_caseta" = ps: with ps; [ aiolip pylutron-caseta ];
     "lw12wifi" = ps: with ps; [ ]; # missing inputs: lw12
diff --git a/pkgs/servers/teleport/default.nix b/pkgs/servers/teleport/default.nix
index 42296b03260c4..5acbc8e806922 100644
--- a/pkgs/servers/teleport/default.nix
+++ b/pkgs/servers/teleport/default.nix
@@ -10,14 +10,14 @@ let
 in
 buildGoModule rec {
   pname = "teleport";
-  version = "7.1.2";
+  version = "7.1.3";
 
   # This repo has a private submodule "e" which fetchgit cannot handle without failing.
   src = fetchFromGitHub {
     owner = "gravitational";
     repo = "teleport";
     rev = "v${version}";
-    sha256 = "sha256-1/Dmh7jTlGg3CqNZDFNIT8/OvgzkHG2m6Qs0ya4IM18=";
+    sha256 = "sha256-upzEfImMuYU/6F5HSR3Jah3QiMXEt0XMpNAPzEYV1Nk=";
   };
 
   vendorSha256 = null;
diff --git a/pkgs/servers/web-apps/vikunja/api.nix b/pkgs/servers/web-apps/vikunja/api.nix
index fc1aa09e4f699..2917c0e240089 100644
--- a/pkgs/servers/web-apps/vikunja/api.nix
+++ b/pkgs/servers/web-apps/vikunja/api.nix
@@ -2,14 +2,14 @@
 
 buildGoModule rec {
   pname = "vikunja-api";
-  version = "0.18.0";
+  version = "0.18.1";
 
   src = fetchFromGitea {
     domain = "kolaente.dev";
     owner = "vikunja";
     repo = "api";
     rev = "v${version}";
-    sha256 = "sha256-43y9+y5VVgbCexHPsYZ9/Up84OoPSrThHWiKR0P1h3s=";
+    sha256 = "sha256-ngdtK8e4mLpbuY9OP1aHk99qPX/cKwnyhb/3ImTwF6M=";
   };
 
   nativeBuildInputs =
@@ -24,7 +24,7 @@ buildGoModule rec {
         '';
       in [ fakeGit mage ];
 
-  vendorSha256 = "sha256-1tXnlOlVH61Y4jN07XBfTgZhAsU2HeudiEVAtlP+Cpk=";
+  vendorSha256 = "sha256-0MP04KpWX17Fa1WhLwF4yzIsDqGAeTUXxv81B+BTNe4=";
 
   # checks need to be disabled because of needed internet for some checks
   doCheck = false;
diff --git a/pkgs/servers/web-apps/vikunja/frontend.nix b/pkgs/servers/web-apps/vikunja/frontend.nix
index 6cca64e19ae9f..3c708287ca34d 100644
--- a/pkgs/servers/web-apps/vikunja/frontend.nix
+++ b/pkgs/servers/web-apps/vikunja/frontend.nix
@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "vikunja-frontend";
-  version = "0.18.0";
+  version = "0.18.1";
   src = fetchurl {
     url = "https://dl.vikunja.io/frontend/${pname}-${version}.zip";
-    sha256 = "sha256-LV7+HfXeNcVHuoo+n6fuAQoIb/m0lOs6JYYMNLM/jTA=";
+    sha256 = "sha256-u4XA6Jqn+p2J0sB2KabwZY/lFwZakZEvUUh/enrhtN4=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/tools/inputmethods/fcitx5/default.nix b/pkgs/tools/inputmethods/fcitx5/default.nix
index ee801fdb24a1e..85b6525774373 100644
--- a/pkgs/tools/inputmethods/fcitx5/default.nix
+++ b/pkgs/tools/inputmethods/fcitx5/default.nix
@@ -41,13 +41,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "fcitx5";
-  version = "5.0.8";
+  version = "5.0.9";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    sha256 = "0czj2awvgk9apdh9rj3vcb04g8x2wp1d4sshvch31nwpqs10hssr";
+    sha256 = "161xgm2fs51v8l46raz6xxkjmshpgaaax64lz8208m7fcd32ll3a";
   };
 
   prePatch = ''
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-rime.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-rime.nix
index cd362e94ef57d..86e5b6ca51af5 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-rime.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-rime.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-rime";
-  version = "5.0.6";
+  version = "5.0.7";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    sha256 = "1r36c1pl63vka9mxa8f5x0kijapjgxzz5b4db8h87ri9kcxk7i2g";
+    sha256 = "1djakg17rxc38smja4y76i0p4gwdj3lgwym8kybkaspk7lxr62zy";
   };
 
   cmakeFlags = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4e0814a482178..9cb8e612c15c7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3418,6 +3418,8 @@ with pkgs;
 
   swego = callPackage ../servers/swego { };
 
+  sydbox = callPackage ../os-specific/linux/sydbox { };
+
   syscall_limiter = callPackage ../os-specific/linux/syscall_limiter {};
 
   syslogng = callPackage ../tools/system/syslog-ng { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0f5dc551e472e..686dd8c0f3638 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4384,6 +4384,8 @@ in {
 
   lupa = callPackage ../development/python-modules/lupa { };
 
+  lupupy = callPackage ../development/python-modules/lupupy { };
+
   lxml = callPackage ../development/python-modules/lxml {
     inherit (pkgs) libxml2 libxslt zlib;
   };