NixOS · Jul 3, 2020 · Jul 4, 2020 · Jul 5, 2020 · Jul 5, 2020 · Jul 5, 2020
diff --git a/nixos/tests/docker-tools.nix b/nixos/tests/docker-tools.nix
@@ -178,5 +178,12 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         # This check may be loosened to allow an *empty* store rather than *no* store.
         docker.succeed("docker run --rm no-store-paths ls /")
         docker.fail("docker run --rm no-store-paths ls /nix/store")
+
+    with subtest("Ensure buildLayeredImage does not change store path contents."):
+        docker.succeed(
+            "docker load --input='${pkgs.dockerTools.examples.filesInStore}'",
+            "docker run --rm file-in-store nix-store --verify --check-contents",
+            "docker run --rm file-in-store |& grep 'some data'",
+        )
   '';
 })
diff --git a/pkgs/applications/networking/instant-messengers/bluejeans/default.nix b/pkgs/applications/networking/instant-messengers/bluejeans/default.nix
@@ -40,11 +40,11 @@
 
 stdenv.mkDerivation rec {
   pname = "bluejeans";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchurl {
     url = "https://swdl.bluejeans.com/desktop-app/linux/${version}/BlueJeans.rpm";
-    sha256 = "06lcpkga8h0zpl2wlysj6n979f0yg361frp3zr0vwzln3fiil2a7";
+    sha256 = "180hc854ngwfn6y6nsrfn74rv78cxhq6sgshrca5zqv6wq3l98g0";
   };
 
   nativeBuildInputs = [ rpmextract makeWrapper ];

diff --git a/pkgs/applications/office/libreoffice/default.nix b/pkgs/applications/office/libreoffice/default.nix
@@ -13,7 +13,7 @@
 , librevenge, libe-book, libmwaw, glm, glew, gst_all_1
 , gdb, commonsLogging, librdf_rasqal, wrapGAppsHook
 , gnome3, glib, ncurses, epoxy, gpgme
-, langs ? [ "ca" "cs" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sl" "zh-CN" ]
+, langs ? [ "ca" "cs" "da" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sl" "zh-CN" ]
 , withHelp ? true
 , kdeIntegration ? false, mkDerivation ? null, qtbase ? null, qtx11extras ? null
 , ki18n ? null, kconfig ? null, kcoreaddons ? null, kio ? null, kwindowsystem ? null

diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
@@ -335,4 +335,23 @@ rec {
     };
   };
 
+  # 19. Support files in the store on buildLayeredImage
+  # See: https://github.com/NixOS/nixpkgs/pull/91084#issuecomment-653496223
+  filesInStore = pkgs.dockerTools.buildLayeredImageWithNixDb {
+    name = "file-in-store";
+    tag = "latest";
+    contents = [
+      pkgs.coreutils
+      pkgs.nix
+      (pkgs.writeScriptBin "myscript" ''
+        #!${pkgs.runtimeShell}
+        cat ${pkgs.writeText "somefile" "some data"}
+      '')
+    ];
+    config = {
+      Cmd = [ "myscript" ];
+      # For some reason 'nix-store --verify' requires this environment variable
+      Env = [ "USER=root" ];
+    };
+  };
 }
diff --git a/pkgs/build-support/docker/stream_layered_image.py b/pkgs/build-support/docker/stream_layered_image.py
@@ -39,6 +39,7 @@
 import hashlib
 import pathlib
 import tarfile
+import itertools
 import threading
 from datetime import datetime
 from collections import namedtuple
@@ -87,16 +88,16 @@ def dir(path):
             tar.addfile(apply_filters(dir("/nix/store")))
 
         for path in paths:
-            ti = tar.gettarinfo(os.path.join("/", path))
-            tar.addfile(apply_filters(append_root(ti)))
-
-            for filename in pathlib.Path(path).rglob("*"):
+            path = pathlib.Path(path)
+            files = itertools.chain([path], path.rglob("*"))
+            for filename in sorted(files):
                 ti = append_root(tar.gettarinfo(filename))
 
                 # copy hardlinks as regular files
                 if ti.islnk():
                     ti.type = tarfile.REGTYPE
                     ti.linkname = ""
+                    ti.size = filename.stat().st_size
 
                 ti = apply_filters(ti)
                 if ti.isfile():

diff --git a/pkgs/development/ocaml-modules/mirage-crypto/default.nix b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@@ -1,14 +1,14 @@
-{ lib, fetchurl, buildDunePackage, ounit, cstruct, dune-configurator, pkg-config }:
+{ lib, fetchurl, buildDunePackage, ounit, cstruct, dune-configurator, eqaf, pkg-config }:
 
 buildDunePackage rec {
   minimumOCamlVersion = "4.08";
 
   pname = "mirage-crypto";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-crypto/releases/download/v${version}/mirage-crypto-v${version}.tbz";
-    sha256 = "1wb2923v17z179v866ragil0r601w5b3kvpnbkmkwlijp4i5grih";
+    sha256 = "13qjisijayviw1s77s74f7klkrjj470vhj4b21cpif7jj2i4ljgk";
   };
 
   useDune2 = true;
@@ -17,7 +17,7 @@ buildDunePackage rec {
   checkInputs = [ ounit ];
 
   nativeBuildInputs = [ dune-configurator pkg-config ];
-  propagatedBuildInputs = [ cstruct ];
+  propagatedBuildInputs = [ cstruct eqaf ];
 
   meta = with lib; {
     homepage = "https://github.com/mirage/mirage-crypto";

diff --git a/pkgs/development/ocaml-modules/tls/default.nix b/pkgs/development/ocaml-modules/tls/default.nix
@@ -6,12 +6,12 @@
 buildDunePackage rec {
   minimumOCamlVersion = "4.08";
 
-  version = "0.12.2";
+  version = "0.12.3";
   pname = "tls";
 
   src = fetchurl {
     url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-v${version}.tbz";
-    sha256 = "1wpgs0cd79wl4lnn1i44xjn8prha793nrbyv68zjiqpq3gmpyy3k";
+    sha256 = "1kfkxsy0nkqi0gbsqn1ssh4x0xhy0p07ijclm42806rxlqr3x405";
   };
 
   useDune2 = true;

diff --git a/pkgs/development/python-modules/asgiref/default.nix b/pkgs/development/python-modules/asgiref/default.nix
@@ -1,6 +1,6 @@
 { stdenv, buildPythonPackage, pythonOlder, fetchFromGitHub, async-timeout, pytest, pytest-asyncio }:
 buildPythonPackage rec {
-  version = "3.2.7";
+  version = "3.2.10";
   pname = "asgiref";
 
   disabled = pythonOlder "3.5";
@@ -10,7 +10,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = pname;
     rev = version;
-    sha256 = "1qf29blzhh6sljaj1adc0p8cnyxh9ar6hky9ccdfbgmrk4rw5kwc";
+    sha256 = "1sj4yy2injaskwfi5pkb542jl8s6ljijnyra81gpw0pgd3d0bgxv";
   };
 
   propagatedBuildInputs = [ async-timeout ];

diff --git a/pkgs/development/python-modules/boolean-py/default.nix b/pkgs/development/python-modules/boolean-py/default.nix
@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "boolean.py";
-  version = "3.7";
+  version = "3.8";
 
   src = fetchFromGitHub {
     owner = "bastikr";
     repo = "boolean.py";
     rev = "v${version}";
-    sha256 = "1q9ji2jq07qr6vgp9yv6y8lx6h0zyi07fqjga3yi3vpfk46h2jn1";
+    sha256 = "02jznrfrihhk69ai1vnh26s3rshl4kfc2id7li6xccavc2ws5y3b";
   };
 
   meta = with lib; {

diff --git a/pkgs/os-specific/linux/e1000e/default.nix b/pkgs/os-specific/linux/e1000e/default.nix
@@ -4,19 +4,20 @@ assert stdenv.lib.versionOlder kernel.version "4.10";
 
 stdenv.mkDerivation rec {
   name = "e1000e-${version}-${kernel.version}";
-  version = "3.3.5.3";
+  version = "3.8.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/e1000/e1000e-${version}.tar.gz";
-    sha256 = "1ajz3vdnf1y307k585w95r6jlh4ah8d74bq36gdkjl1z5hgiqi9q";
+    sha256 = "1q8dbqh14c7r15q6k6iv5k0d6xpi74i71d5r54py60gr099m2ha4";
   };
 
   hardeningDisable = [ "pic" ];
 
   configurePhase = ''
     cd src
     kernel_version=${kernel.modDirVersion}
-    sed -i -e 's|/lib/modules|${kernel.dev}/lib/modules|' Makefile
+    substituteInPlace common.mk \
+      --replace "/lib/modules" "${kernel.dev}/lib/modules"
     export makeFlags="BUILD_KERNEL=$kernel_version"
   '';
 

diff --git a/pkgs/servers/monitoring/plugins/wmiplus/default.nix b/pkgs/servers/monitoring/plugins/wmiplus/default.nix
@@ -4,15 +4,15 @@
 
 stdenv.mkDerivation rec {
   pname = "check-wmiplus";
-  version = "1.64";
+  version = "1.65";
 
   # We fetch from github.com instead of the proper upstream as nix-build errors
   # out with 406 when trying to fetch the sources
   src = fetchFromGitHub {
     owner = "speartail";
     repo = "checkwmiplus";
     rev = "v${version}";
-    sha256 = "1m36rd2wnc5dk4mm9q4ch67w19144dl112p9s6lhc1sh6h25ln6r";
+    sha256 = "1as0iyhy4flpm37mb7lvah7rnd6ax88appjm1icwhy7iq03wi8pl";
   };
 
   patches = [

diff --git a/pkgs/servers/web-apps/mediawiki/default.nix b/pkgs/servers/web-apps/mediawiki/default.nix
@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mediawiki";
-  version = "1.34.1";
+  version = "1.34.2";
 
   src = with stdenv.lib; fetchurl {
     url = "https://releases.wikimedia.org/mediawiki/${versions.majorMinor version}/${pname}-${version}.tar.gz";
-    sha256 = "0jg1ls5xy2bmvvd63lpvnkj53rfmik6sy2px14mphxba3gbcpf5c";
+    sha256 = "1mi46a14b2080x6mh61mb49xq0ky27g0lbm3gqgvkgckc1zmbp0f";
   };
 
   prePatch = ''

diff --git a/pkgs/tools/misc/fdupes/default.nix b/pkgs/tools/misc/fdupes/default.nix
@@ -1,17 +1,18 @@
-{ stdenv, fetchFromGitHub }:
+{ stdenv, fetchFromGitHub, autoreconfHook, ncurses, pcre2 }:
 
 stdenv.mkDerivation rec {
   pname = "fdupes";
-  version = "1.6.1";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "adrianlopezroche";
     repo  = "fdupes";
     rev   = "v${version}";
-    sha256 = "19b6vqblddaw8ccw4sn0qsqzbswlhrz8ia6n4m3hymvcxn8skpz9";
+    sha256 = "1c5hv7vkfxsii1qafhsynzp9zkwim47xkpk27sy64qdsjnhysdak";
   };
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  nativeBuildInputs = [ autoreconfHook ];
+  buildInputs = [ ncurses pcre2 ];
 
   meta = with stdenv.lib; {
     description = "Identifies duplicate files residing within specified directories";

diff --git a/pkgs/tools/text/kdiff3/default.nix b/pkgs/tools/text/kdiff3/default.nix
@@ -6,11 +6,11 @@
 
 mkDerivation rec {
   pname = "kdiff3";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchurl {
     url = "https://download.kde.org/stable/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "0s5vsm1avzv88b6mf2pp20c2sz0srrj52iiqpnwi3p4ihivm8wgv";
+    sha256 = "1awb62y09kbkjhz22mdkrppd6w5aihd3l0ssvpil8c9hg8syjd9g";
   };
 
   nativeBuildInputs = [ extra-cmake-modules kdoctools wrapGAppsHook ];

diff --git a/pkgs/tools/virtualization/govc/default.nix b/pkgs/tools/virtualization/govc/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "govc";
-  version = "0.23.0";
+  version = "0.23.1";
 
   goPackagePath = "github.com/vmware/govmomi";
 
@@ -12,7 +12,7 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "vmware";
     repo = "govmomi";
-    sha256 = "05nb5xd90kbazdx4l9bw72729dh5hrcaqdi9wpf5ma7bz7mw9wzi";
+    sha256 = "05f6i7v8v9g3w3cmz8c952djl652mj6qcwjx9iyl23h6knd1d9b1";
   };
 
   meta = {