Merge master into staging-next

45 files changed, 248 insertions, 106 deletions

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 889b2f7e2442..54a97f2b7a3a 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4823,6 +4823,12 @@
     githubId = 2422454;
     name = "Kai Wohlfahrt";
   };
+  kyleondy = {
+    email = "kyle@ondy.org";
+    github = "kyleondy";
+    githubId = 1640900;
+    name = "Kyle Ondy";
+  };
   kylesferrazza = {
     name = "Kyle Sferrazza";
     email = "kyle.sferrazza@gmail.com";
diff --git a/pkgs/applications/audio/littlegptracker/default.nix b/pkgs/applications/audio/littlegptracker/default.nix
index 9b1a1869c283..2fb453cf19c5 100644
--- a/pkgs/applications/audio/littlegptracker/default.nix
+++ b/pkgs/applications/audio/littlegptracker/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitHub
+, unstableGitUpdater
 , SDL
 , jack2
 , Foundation
@@ -42,6 +43,8 @@ stdenv.mkDerivation rec {
   installPhase = let extension = if stdenv.isDarwin then "app" else "deb-exe";
     in "install -Dm555 lgpt.${extension} $out/bin/lgpt";
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with stdenv.lib; {
     description = "A music tracker similar to lsdj optimised to run on portable game consoles";
     longDescription = ''
diff --git a/pkgs/applications/audio/openmpt123/default.nix b/pkgs/applications/audio/openmpt123/default.nix
index 91bf47dddd6b..4d1387bf6331 100644
--- a/pkgs/applications/audio/openmpt123/default.nix
+++ b/pkgs/applications/audio/openmpt123/default.nix
@@ -2,14 +2,14 @@
 , usePulseAudio ? config.pulseaudio or false, libpulseaudio }:
 
 let
-  version = "0.5.3";
+  version = "0.5.4";
 in stdenv.mkDerivation {
   pname = "openmpt123";
   inherit version;
 
   src = fetchurl {
     url = "https://lib.openmpt.org/files/libopenmpt/src/libopenmpt-${version}+release.autotools.tar.gz";
-    sha256 = "1f155yf5v57dwhzb7z0kh67lckr3yq4x8040dm54qgbxw582la77";
+    sha256 = "0h7gpjx1221jwsq3k91p8zhf1h77qaxyasakc88s3g57vawhckgk";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/editors/nano/default.nix b/pkgs/applications/editors/nano/default.nix
index 04bd6c7b4b8b..bd8ad4b3d20d 100644
--- a/pkgs/applications/editors/nano/default.nix
+++ b/pkgs/applications/editors/nano/default.nix
@@ -16,11 +16,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "nano";
-  version = "5.3";
+  version = "5.4";
 
   src = fetchurl {
     url = "mirror://gnu/nano/${pname}-${version}.tar.xz";
-    sha256 = "0lj3fcfzprmv9raydx8yq25lw81bs6g40rhd0fv9d6idcb7wphf5";
+    sha256 = "1sc6xl9935k9s9clkv83hapijka4qknfnj6f15c3b1i2n84396gy";
   };
 
   nativeBuildInputs = [ texinfo ] ++ optional enableNls gettext;
diff --git a/pkgs/applications/graphics/imgp/default.nix b/pkgs/applications/graphics/imgp/default.nix
index 80420202c053..1f6e20f465a2 100644
--- a/pkgs/applications/graphics/imgp/default.nix
+++ b/pkgs/applications/graphics/imgp/default.nix
@@ -2,13 +2,13 @@
 
 buildPythonApplication rec {
   pname = "imgp";
-  version = "2.7";
+  version = "2.8";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13r4fn3dd0nyidfhrr7zzpls5ifbyqdwxhyvpkqr8ahchws7wfc6";
+    sha256 = "1miabaxd5pwxn0va4drzj1d4ppxvyqsrrd4xw1j6qr52yci0lms8";
   };
 
   propagatedBuildInputs = [ pillow ];
diff --git a/pkgs/applications/graphics/meme/default.nix b/pkgs/applications/graphics/meme/default.nix
index 5f8a0bb6eed3..8cbc776132e6 100644
--- a/pkgs/applications/graphics/meme/default.nix
+++ b/pkgs/applications/graphics/meme/default.nix
@@ -1,8 +1,12 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ stdenv
+, buildGoPackage
+, unstableGitUpdater
+, fetchFromGitHub
+}:
 
 buildGoPackage rec {
-  pname = "meme-unstable";
-  version = "2017-09-10";
+  pname = "meme";
+  version = "unstable-2017-09-10";
 
   owner = "nomad-software";
   repo = "meme";
@@ -14,6 +18,8 @@ buildGoPackage rec {
     sha256 = "1gbsv1d58ck6mj89q31s5b0ppw51ab76yqgz39jgwqnkidvzdfly";
   };
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with stdenv.lib; {
     description = "A command line utility for creating image macro style memes";
     homepage = "https://github.com/nomad-software/meme";
diff --git a/pkgs/applications/networking/instant-messengers/zulip/default.nix b/pkgs/applications/networking/instant-messengers/zulip/default.nix
index dbf6cf46e92b..a177499154ee 100644
--- a/pkgs/applications/networking/instant-messengers/zulip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zulip/default.nix
@@ -5,12 +5,12 @@
 
 let
   pname = "zulip";
-  version = "5.4.3";
+  version = "5.5.0";
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "https://github.com/zulip/zulip-desktop/releases/download/v${version}/Zulip-${version}-x86_64.AppImage";
-    sha256 = "0yd4g87kcwiy1arx3y2nyb7lq1nlh4cn87762k2sd8n4s9i52c7r";
+    sha256 = "059zfcvaq8wnsz2lfd4gdb17b6nngqk3vgisy2kb29ifqf3lpzqi";
     name="${pname}-${version}.AppImage";
   };
 
@@ -32,7 +32,7 @@ in appimageTools.wrapType2 {
 
   meta = with lib; {
     description = "Desktop client for Zulip Chat";
-    homepage = "https://zulipchat.com";
+    homepage = "https://zulip.com";
     license = licenses.asl20;
     maintainers = with maintainers; [ jonafato ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/applications/science/math/gretl/default.nix b/pkgs/applications/science/math/gretl/default.nix
index e1cf5a0f08d8..7d77453cbab0 100644
--- a/pkgs/applications/science/math/gretl/default.nix
+++ b/pkgs/applications/science/math/gretl/default.nix
@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gretl";
-  version = "2020b";
+  version = "2020e";
 
   src = fetchurl {
     url = "mirror://sourceforge/gretl/${pname}-${version}.tar.xz";
-    sha256 = "0mpb8gc0mcfql8lzwknpkf1sg7mj9ikzd8r1x5xniabd9mmdhplm";
+    sha256 = "105y5hkzgyvad6wc3y7nn327bvrsch6jp03ckkn0w0hpnhiywzx7";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/version-management/git-and-tools/git-secret/default.nix b/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
index 140c2647be22..fe67aca55d14 100644
--- a/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper, git, gnupg, gawk }:
 
 let
-  version = "0.3.2";
+  version = "0.3.3";
   repo = "git-secret";
 
 in stdenv.mkDerivation {
@@ -11,7 +11,7 @@ in stdenv.mkDerivation {
     inherit repo;
     owner = "sobolevn";
     rev = "v${version}";
-    sha256 = "0n268xlsd9p5f083sqwzpvsqg99fdk876mf8gihkydakrismc45b";
+    sha256 = "0hc7yavcp8jmn6b7wngjqhy8kl7f4191sfpik8ycvqghkvvimxj4";
   };
 
   buildInputs = [ makeWrapper ];
diff --git a/pkgs/applications/virtualization/qemu/default.nix b/pkgs/applications/virtualization/qemu/default.nix
index 163a87d7072f..5d4b891ad5de 100644
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@@ -83,6 +83,12 @@ stdenv.mkDerivation rec {
     ./fix-qemu-ga.patch
     ./9p-ignore-noatime.patch
     ./CVE-2020-27617.patch
+    (fetchpatch {
+      # e1000e: infinite loop scenario in case of null packet descriptor, remove for QEMU >= 5.2.0-rc3
+      name = "CVE-2020-28916.patch";
+      url = "https://git.qemu.org/?p=qemu.git;a=patch;h=c2cb511634012344e3d0fe49a037a33b12d8a98a";
+      sha256 = "1kvm6wl4vry0npiisxsn76h8nf1iv5fmqsyjvb46203f1yyg5pis";
+    })
   ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
     ++ optionals stdenv.hostPlatform.isMusl [
     (fetchpatch {
diff --git a/pkgs/build-support/docker/default.nix b/pkgs/build-support/docker/default.nix
index db1062e1b5d8..b30ac5c77655 100644
--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -1,4 +1,5 @@
 {
+  bashInteractive,
   buildPackages,
   cacert,
   callPackage,
@@ -29,6 +30,7 @@
   writeReferencesToFile,
   writeScript,
   writeText,
+  writeTextDir,
   writePython3,
   system,  # Note: This is the cross system we're compiling for
 }:
@@ -70,7 +72,7 @@ in
 rec {
 
   examples = callPackage ./examples.nix {
-    inherit buildImage pullImage shadowSetup buildImageWithNixDb;
+    inherit buildImage buildLayeredImage fakeNss pullImage shadowSetup buildImageWithNixDb;
   };
 
   pullImage = let
@@ -684,6 +686,33 @@ rec {
     in
     result;
 
+  # Provide a /etc/passwd and /etc/group that contain root and nobody.
+  # Useful when packaging binaries that insist on using nss to look up
+  # username/groups (like nginx).
+  # /bin/sh is fine to not exist, and provided by another shim.
+  fakeNss = symlinkJoin {
+    name = "fake-nss";
+    paths = [
+      (writeTextDir "etc/passwd" ''
+        root:x:0:0:root user:/var/empty:/bin/sh
+        nobody:x:65534:65534:nobody:/var/empty:/bin/sh
+      '')
+      (writeTextDir "etc/group" ''
+        root:x:0:
+        nobody:x:65534:
+      '')
+      (runCommand "var-empty" {} ''
+        mkdir -p $out/var/empty
+      '')
+    ];
+  };
+
+  # This provides /bin/sh, pointing to bashInteractive.
+  binSh = runCommand "bin-sh" {} ''
+    mkdir -p $out/bin
+    ln -s ${bashInteractive}/bin/bash $out/bin/sh
+  '';
+
   # Build an image and populate its nix database with the provided
   # contents. The main purpose is to be able to use nix commands in
   # the container.
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index 3f30f1a2adb4..85ddeb257405 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -7,7 +7,7 @@
 #  $ nix-build '<nixpkgs>' -A dockerTools.examples.redis
 #  $ docker load < result
 
-{ pkgs, buildImage, pullImage, shadowSetup, buildImageWithNixDb, pkgsCross }:
+{ pkgs, buildImage, buildLayeredImage, fakeNss, pullImage, shadowSetup, buildImageWithNixDb, pkgsCross }:
 
 rec {
   # 1. basic example
@@ -44,7 +44,7 @@ rec {
   nginx = let
     nginxPort = "80";
     nginxConf = pkgs.writeText "nginx.conf" ''
-      user nginx nginx;
+      user nobody nobody;
       daemon off;
       error_log /dev/stdout info;
       pid /dev/null;
@@ -64,10 +64,13 @@ rec {
       <html><body><h1>Hello from NGINX</h1></body></html>
     '';
   in
-  buildImage {
+  buildLayeredImage {
     name = "nginx-container";
     tag = "latest";
-    contents = pkgs.nginx;
+    contents = [
+      fakeNss
+      pkgs.nginx
+    ];
 
     extraCommands = ''
       # nginx still tries to read this directory even if error_log
@@ -75,12 +78,6 @@ rec {
       mkdir -p var/log/nginx
       mkdir -p var/cache/nginx
     '';
-    runAsRoot = ''
-      #!${pkgs.stdenv.shell}
-      ${shadowSetup}
-      groupadd --system nginx
-      useradd --system --gid nginx nginx
-    '';
 
     config = {
       Cmd = [ "nginx" "-c" nginxConf ];
diff --git a/pkgs/development/compilers/lobster/default.nix b/pkgs/development/compilers/lobster/default.nix
index 62867f296d72..b87bec7ea2d9 100644
--- a/pkgs/development/compilers/lobster/default.nix
+++ b/pkgs/development/compilers/lobster/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitHub
+, unstableGitUpdater
 , cmake
 , callPackage
 
@@ -46,8 +47,9 @@ stdenv.mkDerivation rec {
   preConfigure = "cd dev";
   enableParallelBuilding = true;
 
-  passthru.tests = {
-    can-run-hello-world = callPackage ./test-can-run-hello-world.nix {};
+  passthru = {
+    tests.can-run-hello-world = callPackage ./test-can-run-hello-world.nix {};
+    updateScript = unstableGitUpdater { };
   };
 
   meta = with stdenv.lib; {
@@ -63,4 +65,3 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
   };
 }
-
diff --git a/pkgs/development/compilers/qbe/default.nix b/pkgs/development/compilers/qbe/default.nix
index 871707496561..436b03e499c3 100644
--- a/pkgs/development/compilers/qbe/default.nix
+++ b/pkgs/development/compilers/qbe/default.nix
@@ -25,4 +25,3 @@ stdenv.mkDerivation rec {
     platforms = platforms.all;
   };
 }
-
diff --git a/pkgs/development/libraries/libfprint/default.nix b/pkgs/development/libraries/libfprint/default.nix
index cc4e7dfefeef..469633afb10c 100644
--- a/pkgs/development/libraries/libfprint/default.nix
+++ b/pkgs/development/libraries/libfprint/default.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libfprint";
-  version = "1.90.3";
+  version = "1.90.4";
   outputs = [ "out" "devdoc" ];
 
   src = fetchFromGitLab {
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     owner = "libfprint";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1fs0qrfrqnvc6kcsg81l5p89n8jnsx9dr1pzxpb8ghwas8c9v52i";
+    sha256 = "0grhck0h29i7hm7npvby7pn7wdc446kv0r4mkpbssp46lqbjb96b";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/libimobiledevice/default.nix b/pkgs/development/libraries/libimobiledevice/default.nix
index 47408f8cb6f4..dcbb71c7c3ae 100644
--- a/pkgs/development/libraries/libimobiledevice/default.nix
+++ b/pkgs/development/libraries/libimobiledevice/default.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
       devices to the Linux Desktop.
     '';
     license = licenses.lgpl21Plus;
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ infinisil ];
   };
 }
diff --git a/pkgs/development/libraries/libirecovery/default.nix b/pkgs/development/libraries/libirecovery/default.nix
index 59f09c8d2538..5b0b60b16b35 100644
--- a/pkgs/development/libraries/libirecovery/default.nix
+++ b/pkgs/development/libraries/libirecovery/default.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
     '';
     license = licenses.lgpl21;
     # Upstream description says it works on more platforms, but packager hasn't tried that yet
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ nh2 ];
   };
 }
diff --git a/pkgs/development/libraries/libmanette/default.nix b/pkgs/development/libraries/libmanette/default.nix
index 83ee19075de5..0cb233ad271c 100644
--- a/pkgs/development/libraries/libmanette/default.nix
+++ b/pkgs/development/libraries/libmanette/default.nix
@@ -5,6 +5,9 @@
 , pkgconfig
 , vala
 , gobject-introspection
+, gtk-doc
+, docbook-xsl-nons
+, docbook_xml_dtd_43
 , glib
 , libgudev
 , libevdev
@@ -13,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libmanette";
-  version = "0.2.5";
+  version = "0.2.6";
 
-  outputs = [ "out" "dev" ];
+  outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "gAbghIDAy9T3SewVWCfRAER88jkD+tgkCnxMMhqgmis=";
+    sha256 = "1b3bcdkk5xd5asq797cch9id8692grsjxrc1ss87vv11m1ck4rb3";
   };
 
   nativeBuildInputs = [
@@ -28,6 +31,9 @@ stdenv.mkDerivation rec {
     pkgconfig
     vala
     gobject-introspection
+    gtk-doc
+    docbook-xsl-nons
+    docbook_xml_dtd_43
   ];
 
   buildInputs = [
@@ -36,6 +42,10 @@ stdenv.mkDerivation rec {
     libevdev
   ];
 
+  mesonFlags = [
+    "-Ddoc=true"
+  ];
+
   doCheck = true;
 
   passthru = {
@@ -46,7 +56,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A simple GObject game controller library";
-    homepage = "https://gitlab.gnome.org/aplazas/libmanette";
+    homepage = "https://gnome.pages.gitlab.gnome.org/libmanette/";
     license = licenses.lgpl21Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/libplist/default.nix b/pkgs/development/libraries/libplist/default.nix
index 6608ccd1abc5..a626e7a5377b 100644
--- a/pkgs/development/libraries/libplist/default.nix
+++ b/pkgs/development/libraries/libplist/default.nix
@@ -36,6 +36,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/libimobiledevice/libplist";
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ infinisil ];
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
   };
 }
diff --git a/pkgs/development/libraries/libusbmuxd/default.nix b/pkgs/development/libraries/libusbmuxd/default.nix
index f4c4dbfcf710..9d81c5d0fbeb 100644
--- a/pkgs/development/libraries/libusbmuxd/default.nix
+++ b/pkgs/development/libraries/libusbmuxd/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     description = "A client library to multiplex connections from and to iOS devices";
     homepage    = "https://github.com/libimobiledevice/libusbmuxd";
     license     = licenses.lgpl21Plus;
-    platforms   = platforms.linux;
+    platforms   = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ infinisil ];
   };
 }
diff --git a/pkgs/development/libraries/tdlib/default.nix b/pkgs/development/libraries/tdlib/default.nix
index 165506f96472..1a36a68a33bd 100644
--- a/pkgs/development/libraries/tdlib/default.nix
+++ b/pkgs/development/libraries/tdlib/default.nix
@@ -1,20 +1,16 @@
 { fetchFromGitHub, gperf, openssl, readline, zlib, cmake, stdenv }:
 
 stdenv.mkDerivation rec {
-  version = "unstable-2020-10-25";
+  version = "1.7.0";
   pname = "tdlib";
 
   src = fetchFromGitHub {
     owner = "tdlib";
     repo = "td";
 
-    # At version 1.6.0, this line was `rev = "v${version}". Version 1.6.9 (here called `unstable-2020-10-25`) uses an
-    # explicit revision because 1.6.9 is not a tdlib GitHub release, and is therefore not hosted at
-    # `https://github.com/tdlib/td/releases/tag/v1.6.9`. Please return to the `rev = "v${version}"` style on the next
-    # version bump if you can, since that will allow `nixpkgs-update` to update the package automatically.
-    rev = "32f2338bd199dd06a1b4b5f1ad14f2d4f2868f01";
+    rev = "v${version}";
 
-    sha256 = "0wv03hlgzrsc04kcwnwz6dsmkdzvhb0i1wjs08gzivwxw06pkq4n";
+    sha256 = "sha256-sZzp9k7KDnqftcSGSgXkIy0siCksGPBmRckySU/J0TU=";
   };
 
   buildInputs = [ gperf openssl readline zlib ];
diff --git a/pkgs/development/python-modules/goobook/default.nix b/pkgs/development/python-modules/goobook/default.nix
index eb6aecfecd15..a3d327275157 100644
--- a/pkgs/development/python-modules/goobook/default.nix
+++ b/pkgs/development/python-modules/goobook/default.nix
@@ -23,6 +23,10 @@ buildPythonPackage rec {
     installManPage goobook.1
   '';
 
+  doCheck = false;
+
+  pythonImportsCheck = [ "goobook" ];
+
   meta = with stdenv.lib; {
     description = "Access your Google contacts from the command line";
     longDescription = ''
diff --git a/pkgs/development/tools/ocaml/obelisk/default.nix b/pkgs/development/tools/ocaml/obelisk/default.nix
index e7528d4f7728..483e9c45df01 100644
--- a/pkgs/development/tools/ocaml/obelisk/default.nix
+++ b/pkgs/development/tools/ocaml/obelisk/default.nix
@@ -1,24 +1,20 @@
-{ stdenv, fetchFromGitHub, ocamlPackages }:
+{ lib, fetchurl, ocamlPackages }:
 
-stdenv.mkDerivation rec {
+ocamlPackages.buildDunePackage rec {
 	pname = "obelisk";
-	version = "0.4.0";
-	src = fetchFromGitHub {
-		owner = "lelio-brun";
-		repo = "obelisk";
-		rev = "v${version}";
-		sha256 = "0rw85knbwqj2rys1hh5qy8sfdqb4mb1wsriy38n7zcpbwim47vb8";
+	version = "0.5.2";
+	useDune2 = true;
+	src = fetchurl {
+		url = "https://github.com/Lelio-Brun/Obelisk/releases/download/v${version}/obelisk-v${version}.tbz";
+		sha256 = "0s86gkypyrkrp83xnay258ijri3yjwj3marsjnjf8mz58z0zd9g6";
 	};
 
-	buildInputs = with ocamlPackages; [ ocaml findlib ocamlbuild menhir ];
-
-	installFlags = [ "BINDIR=$(out)/bin" ];
+	buildInputs = with ocamlPackages; [ menhir re ];
 
 	meta = {
 		description = "A simple tool which produces pretty-printed output from a Menhir parser file (.mly)";
-		license = stdenv.lib.licenses.mit;
-		maintainers = [ stdenv.lib.maintainers.vbgl ];
-		inherit (src.meta) homepage;
-		inherit (ocamlPackages.ocaml.meta) platforms;
+		license = lib.licenses.mit;
+		maintainers = [ lib.maintainers.vbgl ];
+		homepage = "https://github.com/Lelio-Brun/Obelisk";
 	};
 }
diff --git a/pkgs/games/mindustry/default.nix b/pkgs/games/mindustry/default.nix
index d87a1cadd989..89ff37458af9 100644
--- a/pkgs/games/mindustry/default.nix
+++ b/pkgs/games/mindustry/default.nix
@@ -22,14 +22,14 @@ let
   # Note: when raising the version, ensure that all SNAPSHOT versions in
   # build.gradle are replaced by a fixed version
   # (the current one at the time of release) (see postPatch).
-  version = "120";
+  version = "120.2";
   buildVersion = makeBuildVersion version;
 
   src = fetchFromGitHub {
     owner = "Anuken";
     repo = "Mindustry";
     rev = "v${version}";
-    sha256 = "08l5c53izh5vmgahsj0qhpfiva0vs5qhh77bb770hzpadxvysyc8";
+    sha256 = "01a7qpwfr1n540fk0k65kl03biix0gmg66z7qn22mb2703laq1xc";
   };
 
   desktopItem = makeDesktopItem {
@@ -128,5 +128,8 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     maintainers = with maintainers; [ fgaz ];
     platforms = platforms.all;
+    # Hash mismatch on darwin:
+    # https://github.com/NixOS/nixpkgs/pull/105590#issuecomment-737120293
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/misc/emulators/hatari/default.nix b/pkgs/misc/emulators/hatari/default.nix
index db1a6664c542..03397bd244cb 100644
--- a/pkgs/misc/emulators/hatari/default.nix
+++ b/pkgs/misc/emulators/hatari/default.nix
@@ -1,11 +1,12 @@
 { stdenv, fetchurl, zlib, SDL, cmake }:
 
 stdenv.mkDerivation rec {
-  name = "hatari-2.2.1";
+  pname = "hatari";
+  version = "2.3.0";
 
   src = fetchurl {
-    url = "https://download.tuxfamily.org/hatari/2.2.1/${name}.tar.bz2";
-    sha256 = "0q3g23vnx58w666723v76ilh9j353md3sn48cmlq9gkll8qfzbqi";
+    url = "https://download.tuxfamily.org/hatari/${version}/${pname}-${version}.tar.bz2";
+    sha256 = "19dqadi32hgi78hyxxcm8v2vh28vyn9w5nd1xiq683wk0ccicj5z";
   };
 
   # For pthread_cancel
diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index 59f649f939ca..28ac5e6f91f5 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -445,6 +445,41 @@ in rec {
     };
   };
 
+  tmux-fzf = mkDerivation {
+    pluginName = "tmux-fzf";
+    version = "unstable-2020-11-23";
+    src = fetchFromGitHub {
+      owner = "sainnhe";
+      repo = "tmux-fzf";
+      rev = "312685b2a7747b61f1f4a96bd807819f1450479d";
+      sha256 = "1z0zmsf8asxs9wbwvkiyd81h93wb2ikl8nxxc26sdpi6l333q5s9";
+    };
+    postInstall = ''
+      find $target -type f -print0 | xargs -0 sed -i -e 's|fzf |${pkgs.fzf}/bin/fzf |g'
+      find $target -type f -print0 | xargs -0 sed -i -e 's|sed |${pkgs.gnused}/bin/sed |g'
+      find $target -type f -print0 | xargs -0 sed -i -e 's|tput |${pkgs.ncurses}/bin/tput |g'
+    '';
+     meta = {
+      homepage = "https://github.com/sainnhe/tmux-fzf";
+      description = "Use fzf to manage your tmux work environment! ";
+      longDescription =
+        ''
+        Features:
+        * Manage sessions (attach, detach*, rename, kill*).
+        * Manage windows (switch, link, move, swap, rename, kill*).
+        * Manage panes (switch, break, join*, swap, layout, kill*, resize).
+        * Multiple selection (support for actions marked by *).
+        * Search commands and append to command prompt.
+        * Search key bindings and execute.
+        * User menu.
+        * Popup window support.
+      '';
+      license = stdenv.lib.licenses.mit;
+      platforms = stdenv.lib.platforms.unix;
+      maintainers = with stdenv.lib.maintainers; [ kyleondy ];
+    };
+  };
+
   urlview = mkDerivation {
     pluginName = "urlview";
     version = "unstable-2016-01-06";
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 5a19e8d3cc93..26694d965e73 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.209";
+  version = "4.14.210";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "171b31c4rz9sn95s4s4yqchd4s46kivmvch78z0jr5zir1f4c0nb";
+    sha256 = "067xqi6sgf50p7s3n6y77cgf5bj5062s3bz3kqpp6f9wnk85267r";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 7b01bdd8c608..15a5e1972a64 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.160";
+  version = "4.19.161";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "118maapizgqgrgawnw7xmbcz26c61g5d012jzbd8l7n6z4354d0q";
+    sha256 = "0h9wskmz9wridwnicnjlcmj1112qnlvqk01bhjkxv6b8jsajjh87";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index d679969d5892..599d68636200 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.246";
+  version = "4.4.247";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "15xd1dqw53kwqvsa71nr1ymp0jp22pkl4h2yks4hqbd132zxw2wy";
+    sha256 = "1jh7vmyx55krk6y2r9v48liifs5wwkgns3gp8rs5sm4klfm36r2a";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index c5216f2c80e3..9169506536a7 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.246";
+  version = "4.9.247";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1xd9vgc4yj2vrr5r76cy3fp9a1fc3086lj5aws68wf1dsz3ndqj9";
+    sha256 = "1mngdbsq8pdzd0x9hif4715cc7wzc3ahgp1yrknnqk598q0fnfpp";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.4.nix b/pkgs/os-specific/linux/kernel/linux-5.4.nix
index 0b19291a7692..8453ec0c6cb3 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.80";
+  version = "5.4.81";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1iv4rsc9mr13xqzayzwz8mpdrdpnc425mn1izz9hylrw3xf45nj9";
+    sha256 = "09w4bpr3v9rzcvxics5wddabplwbpk1mynl45lh9csbjfpjbsw4l";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-5.9.nix b/pkgs/os-specific/linux/kernel/linux-5.9.nix
index c32ee2844f9f..e71044b0d968 100644
--- a/pkgs/os-specific/linux/kernel/linux-5.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.9.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.9.11";
+  version = "5.9.12";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0q6jlnigyjjnnxw6l724zv8acgs95s3pafabz4l9jrhhlijhmcjy";
+    sha256 = "1gfrn3sz3h4cbsf3r8f9jxja400qsmbrk8sclk4cjx1l5qcmczyr";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/servers/http/lighttpd/default.nix b/pkgs/servers/http/lighttpd/default.nix
index 01a07a9f5029..d90357044f54 100644
--- a/pkgs/servers/http/lighttpd/default.nix
+++ b/pkgs/servers/http/lighttpd/default.nix
@@ -15,11 +15,11 @@ assert enableWebDAV -> libuuid != null;
 assert enableExtendedAttrs -> attr != null;
 
 stdenv.mkDerivation rec {
-  name = "lighttpd-1.4.55";
+  name = "lighttpd-1.4.56";
 
   src = fetchurl {
     url = "https://download.lighttpd.net/lighttpd/releases-1.4.x/${name}.tar.xz";
-    sha256 = "09z947730yjh438wrqb3z1c5hr1dbb11a8sr92g3vk6mr7lm02va";
+    sha256 = "0xyzahrkmldwskwgjgj4dc3rmfmgqiwwr9y7jfhqpbp8g76q9kp4";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/nosql/cassandra/generic.nix b/pkgs/servers/nosql/cassandra/generic.nix
index 6ccd2e1c8ddf..97c7341c76d4 100644
--- a/pkgs/servers/nosql/cassandra/generic.nix
+++ b/pkgs/servers/nosql/cassandra/generic.nix
@@ -88,6 +88,6 @@ stdenv.mkDerivation rec {
     description = "A massively scalable open source NoSQL database";
     platforms = platforms.unix;
     license = licenses.asl20;
-    maintainers = with maintainers; [ cransom ];
+    maintainers = [];
   };
 }
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index a6ec8dc23d74..e27048b27235 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.20.5.3600-47c0d9038";
+  version = "1.21.0.3711-b509cc236";
   pname = "plexmediaserver";
 
   # Fetch the source
   src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "18zj4baa085gbgc0y5gx7gnwzl131xyk34m5xcipfvfb434y98cp";
+    sha256 = "0nhxxfcds3byhbz8gsd9107diy182m33xbcc8jgi78hwfadyjj7h";
   } else fetchurl {
     url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "01rq2q6avjsvnns7jsd2a9vnmd4584fwdkp833gjgrrrqkf6h45y";
+    sha256 = "0izsmcc337paakz1nqfsr78s097sxyxy3kbs43qpzpx7w5wshynb";
   };
 
   outputs = [ "out" "basedb" ];
diff --git a/pkgs/stdenv/linux/make-bootstrap-tools.nix b/pkgs/stdenv/linux/make-bootstrap-tools.nix
index 421bb8502a4c..25cde589a923 100644
--- a/pkgs/stdenv/linux/make-bootstrap-tools.nix
+++ b/pkgs/stdenv/linux/make-bootstrap-tools.nix
@@ -47,6 +47,12 @@ in with pkgs; rec {
     stdenv.mkDerivation {
       name = "stdenv-bootstrap-tools";
 
+      meta = {
+        # Increase priority to unblock nixpkgs-unstable
+        # https://github.com/NixOS/nixpkgs/pull/104679#issuecomment-732267288
+        schedulingPriority = 200;
+      };
+
       nativeBuildInputs = [ buildPackages.nukeReferences buildPackages.cpio ];
 
       buildCommand = ''
@@ -199,6 +205,12 @@ in with pkgs; rec {
   dist = stdenv.mkDerivation {
     name = "stdenv-bootstrap-tools";
 
+    meta = {
+      # Increase priority to unblock nixpkgs-unstable
+      # https://github.com/NixOS/nixpkgs/pull/104679#issuecomment-732267288
+      schedulingPriority = 200;
+    };
+
     buildCommand = ''
       mkdir -p $out/nix-support
       echo "file tarball ${build}/on-server/bootstrap-tools.tar.xz" >> $out/nix-support/hydra-build-products
diff --git a/pkgs/tools/admin/trivy/default.nix b/pkgs/tools/admin/trivy/default.nix
index df3aa7bd945e..ffe5d25bd9c1 100644
--- a/pkgs/tools/admin/trivy/default.nix
+++ b/pkgs/tools/admin/trivy/default.nix
@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0d9lb1wzvxywg88fy85bicixd8wipvbhnwfckwl3p8shh0s9sr22";
+    sha256 = "1ylk6n062n9w2c8179mj0z5acz98b30w6dkpz8gslachsz9sb5ij";
   };
 
-  vendorSha256 = "0sashi3x3hccqm27dg6hjlvpgvx42jdxpgzigzm81md58zhk509x";
+  vendorSha256 = "0kljvy61n72dg99jyc47fzhc8ihyfjk30a1a031gczk3q3z2l7kj";
 
   subPackages = [ "cmd/trivy" ];
 
@@ -32,6 +32,7 @@ buildGoModule rec {
       application dependencies (Bundler, Composer, npm, yarn, etc.).
     '';
     homepage = src.meta.homepage;
+    changelog = "${src.meta.homepage}/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ jk ];
   };
diff --git a/pkgs/tools/misc/cht.sh/default.nix b/pkgs/tools/misc/cht.sh/default.nix
index 1c38e7c3b8f5..ceef26b577d6 100644
--- a/pkgs/tools/misc/cht.sh/default.nix
+++ b/pkgs/tools/misc/cht.sh/default.nix
@@ -1,5 +1,6 @@
 { stdenv
 , fetchFromGitHub
+, unstableGitUpdater
 , makeWrapper
 , curl
 , ncurses
@@ -35,6 +36,8 @@ stdenv.mkDerivation {
       --prefix PATH : "${stdenv.lib.makeBinPath [ curl rlwrap ncurses xsel ]}"
   '';
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with stdenv.lib; {
     description = "CLI client for cheat.sh, a community driven cheat sheet";
     license = licenses.mit;
@@ -42,4 +45,3 @@ stdenv.mkDerivation {
     homepage = "https://github.com/chubin/cheat.sh";
   };
 }
-
diff --git a/pkgs/tools/misc/geekbench/default.nix b/pkgs/tools/misc/geekbench/default.nix
index b2aa0a16f921..a33ae0ed3305 100644
--- a/pkgs/tools/misc/geekbench/default.nix
+++ b/pkgs/tools/misc/geekbench/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "geekbench";
-  version = "5.3.0";
+  version = "5.3.1";
 
   src = fetchurl {
     url = "https://cdn.geekbench.com/Geekbench-${version}-Linux.tar.gz";
-    sha256 = "0g7yj2a3cddaaa0n38zjqq79w5xs3sqa9zwqn2ffr2wr6y80754i";
+    sha256 = "0hil3mvrwpwy60x9s16bf8vgvfv11sdarcbk45zjlgjzfhh8h2qr";
   };
 
   dontConfigure = true;
diff --git a/pkgs/tools/misc/idevicerestore/default.nix b/pkgs/tools/misc/idevicerestore/default.nix
index 5a6064114419..ab22e413b003 100644
--- a/pkgs/tools/misc/idevicerestore/default.nix
+++ b/pkgs/tools/misc/idevicerestore/default.nix
@@ -4,6 +4,7 @@
 , libirecovery
 , libzip
 , libusbmuxd
+, IOKit
 }:
 
 stdenv.mkDerivation rec {
@@ -31,7 +32,7 @@ stdenv.mkDerivation rec {
     # Not listing other dependencies specified in
     # https://github.com/libimobiledevice/idevicerestore/blob/8a882038b2b1e022fbd19eaf8bea51006a373c06/README#L20
     # because they are inherited `libimobiledevice`.
-  ];
+  ] ++ stdenv.lib.optionals stdenv.isDarwin [ IOKit ];
 
   meta = with stdenv.lib; {
     homepage = "https://github.com/libimobiledevice/idevicerestore";
@@ -51,8 +52,8 @@ stdenv.mkDerivation rec {
       This will download and restore a device to the latest firmware available.
     '';
     license = licenses.lgpl21Plus;
-    # configure.ac suggests it should work for darwin and mingw as well but not tried yet
-    platforms = platforms.linux;
+    # configure.ac suggests it should work for mingw as well but not tried yet
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ nh2 ];
   };
 }
diff --git a/pkgs/tools/security/bash-supergenpass/default.nix b/pkgs/tools/security/bash-supergenpass/default.nix
index f72c916acf99..53bc45acf8f7 100644
--- a/pkgs/tools/security/bash-supergenpass/default.nix
+++ b/pkgs/tools/security/bash-supergenpass/default.nix
@@ -1,8 +1,14 @@
-{ stdenv, fetchFromGitHub, makeWrapper, openssl, coreutils, gnugrep }:
+{ stdenv
+, fetchFromGitHub
+, unstableGitUpdater
+, makeWrapper
+, openssl
+, coreutils
+, gnugrep }:
 
 stdenv.mkDerivation {
-  pname = "bash-supergenpass-unstable";
-  version = "2018-04-18";
+  pname = "bash-supergenpass";
+  version = "unstable-2018-04-18";
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -18,6 +24,8 @@ stdenv.mkDerivation {
     wrapProgram "$out/bin/supergenpass" --prefix PATH : "${stdenv.lib.makeBinPath [ openssl coreutils gnugrep ]}"
   '';
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = with stdenv.lib; {
     description = "Bash shell-script implementation of SuperGenPass password generation";
     longDescription = ''
@@ -36,4 +44,3 @@ stdenv.mkDerivation {
     homepage = "https://github.com/lanzz/bash-supergenpass";
   };
 }
-
diff --git a/pkgs/tools/text/pbgopy/default.nix b/pkgs/tools/text/pbgopy/default.nix
new file mode 100644
index 000000000000..3972d3dc9bd4
--- /dev/null
+++ b/pkgs/tools/text/pbgopy/default.nix
@@ -0,0 +1,22 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "pbgopy";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "nakabonne";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "17rk15hs7kg9m1vphh1gjny7sqnk80qw61jn8qyxcmw2n55rkmfp";
+  };
+
+  vendorSha256 = "1ak3hd979395grbns9p5sw5f45plcqq6vg7j7v8n7xqc20s2l8m9";
+
+  meta = with stdenv.lib; {
+    description = "Copy and paste between devices";
+    homepage = "https://github.com/nakabonne/pbgopy";
+    license = licenses.mit;
+    maintainers = [ maintainers.ivar ];
+  };
+}
diff --git a/pkgs/tools/text/shfmt/default.nix b/pkgs/tools/text/shfmt/default.nix
index 1d1def43177c..705999639053 100644
--- a/pkgs/tools/text/shfmt/default.nix
+++ b/pkgs/tools/text/shfmt/default.nix
@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "shfmt";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "mvdan";
     repo = "sh";
     rev = "v${version}";
-    sha256 = "1ybrx82c4djp7izyqhvzk0rcf9ac7nv5g5ahxr0k0jhm752ba5z2";
+    sha256 = "1kp4ib0a64cc9qylny48ff5q9ciklzx93yhv7fgqhl1v2c7fm1jp";
   };
 
   vendorSha256 = "1ma7nvyn6ylbi8bd7x900i94pzs877kfy9xh0nf1bbify1vcpd29";
diff --git a/pkgs/tools/typesetting/pdftk/default.nix b/pkgs/tools/typesetting/pdftk/default.nix
index 9705a6d87989..25fc794b0558 100644
--- a/pkgs/tools/typesetting/pdftk/default.nix
+++ b/pkgs/tools/typesetting/pdftk/default.nix
@@ -85,11 +85,12 @@ in stdenv.mkDerivation rec {
     cp ${src}/pdftk.1 $out/share/man/man1
   '';
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Command-line tool for working with PDFs";
     homepage = "https://gitlab.com/pdftk-java/pdftk";
-    license = stdenv.lib.licenses.gpl2Plus;
-    maintainers = with stdenv.lib.maintainers; [ raskin averelld ];
-    platforms = stdenv.lib.platforms.unix;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ raskin averelld ];
+    platforms = platforms.unix;
+    broken = stdenv.isDarwin;
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a1be2f4623cc..497aa7cb0245 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2496,6 +2496,8 @@ in
 
   patool = with python3Packages; toPythonApplication patool;
 
+  pbgopy = callPackage ../tools/text/pbgopy { };
+
   pbpst = callPackage ../applications/misc/pbpst { };
 
   pbzx = callPackage ../tools/compression/pbzx { };
@@ -4752,7 +4754,9 @@ in
 
   ifuse = callPackage ../tools/filesystems/ifuse { };
   ideviceinstaller = callPackage ../tools/misc/ideviceinstaller { };
-  idevicerestore = callPackage ../tools/misc/idevicerestore { };
+  idevicerestore = callPackage ../tools/misc/idevicerestore {
+    inherit (darwin) IOKit;
+  };
 
   inherit (callPackages ../tools/filesystems/irods rec {
             stdenv = llvmPackages.libcxxStdenv;