Merge remote-tracking branch 'origin/master' into staging-next

# Browsers

/pkgs/applications/networking/browsers/firefox @mweinelt

# Certificate Authorities

pkgs/data/misc/cacert/ @ajs124 @lukegb @mweinelt

pkgs/development/libraries/nss/ @ajs124 @lukegb @mweinelt

pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt

# Jetbrains

/pkgs/applications/editors/jetbrains @edwtjo

# Matrix

/pkgs/servers/heisenbridge                                 @piegamesde

/pkgs/servers/matrix-conduit                               @piegamesde

/pkgs/servers/matrix-synapse/matrix-appservice-irc         @piegamesde

/nixos/modules/services/misc/heisenbridge.nix              @piegamesde

/nixos/modules/services/misc/matrix-appservice-irc.nix     @piegamesde

/nixos/modules/services/misc/matrix-conduit.nix            @piegamesde

/nixos/tests/matrix-appservice-irc.nix                     @piegamesde

/nixos/tests/matrix-conduit.nix                            @piegamesde

# Dotnet

```nix

fetchurl {

  url = "http://www.example.org/hello-1.0.tar.gz";

  sha256 = "0v6r3wwnsk5pdjr188nip3pjgn1jrn5pc5ajpcfy6had6b3v4dwm";

  hash = "sha256-lTeyxzJNQeMdu1IVdovNMtgn77jRIhSybLdMbTkf2Ww=";

};

```

```nix

fetchurl {

  url = "http://www.example.org/hello-1.1.tar.gz";

  sha256 = "0v6r3wwnsk5pdjr188nip3pjgn1jrn5pc5ajpcfy6had6b3v4dwm";

  hash = "sha256-lTeyxzJNQeMdu1IVdovNMtgn77jRIhSybLdMbTkf2Ww=";

};

```

**This will reuse the old contents**.

Remember to invalidate the hash argument, in this case by setting the `sha256` attribute to an empty string.

Remember to invalidate the hash argument, in this case by setting the `hash` attribute to an empty string.

```nix

fetchurl {

  url = "http://www.example.org/hello-1.1.tar.gz";

  sha256 = "";

  hash = "";

};

```

```

error: hash mismatch in fixed-output derivation '/path/to/my.drv':

         specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

            got:    sha256-RApQUm78dswhBLC/rfU9y0u6pSAzHceIJqgmetRD24E=

            got:    sha256-lTeyxzJNQeMdu1IVdovNMtgn77jRIhSybLdMbTkf2Ww=

```

A similar problem arises while testing changes to a fetcher's implementation. If the output of the derivation already exists in the Nix store, test failures can go undetected. The [`invalidateFetcherByDrvHash`](#tester-invalidateFetcherByDrvHash) function helps prevent reusing cached derivations.

## `fetchurl` and `fetchzip` {#fetchurl}

Two basic fetchers are `fetchurl` and `fetchzip`. Both of these have two required arguments, a URL and a hash. The hash is typically `sha256`, although many more hash algorithms are supported. Nixpkgs contributors are currently recommended to use `sha256`. This hash will be used by Nix to identify your source. A typical usage of `fetchurl` is provided below.

Two basic fetchers are `fetchurl` and `fetchzip`. Both of these have two required arguments, a URL and a hash. The hash is typically `hash`, although many more hash algorithms are supported. Nixpkgs contributors are currently recommended to use `hash`. This hash will be used by Nix to identify your source. A typical usage of `fetchurl` is provided below.

```nix

{ stdenv, fetchurl }:

  name = "hello";

  src = fetchurl {

    url = "http://www.example.org/hello.tar.gz";

    sha256 = "1111111111111111111111111111111111111111111111111111";

    hash = "sha256-BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=";

  };

}

```

- `includes`: Include only files matching these patterns (applies after the above arguments).

- `revert`: Revert the patch.

Note that because the checksum is computed after applying these effects, using or modifying these arguments will have no effect unless the `sha256` argument is changed as well.

Note that because the checksum is computed after applying these effects, using or modifying these arguments will have no effect unless the `hash` argument is changed as well.

Most other fetchers return a directory rather than a single file.

## `fetchsvn` {#fetchsvn}

Used with Subversion. Expects `url` to a Subversion directory, `rev`, and `sha256`.

Used with Subversion. Expects `url` to a Subversion directory, `rev`, and `hash`.

## `fetchgit` {#fetchgit}

Used with Git. Expects `url` to a Git repo, `rev`, and `sha256`. `rev` in this case can be full the git commit id (SHA1 hash) or a tag name like `refs/tags/v1.0`.

Used with Git. Expects `url` to a Git repo, `rev`, and `hash`. `rev` in this case can be full the git commit id (SHA1 hash) or a tag name like `refs/tags/v1.0`.

Additionally, the following optional arguments can be given: `fetchSubmodules = true` makes `fetchgit` also fetch the submodules of a repository. If `deepClone` is set to true, the entire repository is cloned as opposing to just creating a shallow clone. `deepClone = true` also implies `leaveDotGit = true` which means that the `.git` directory of the clone won't be removed after checkout.

      "directory/to/be/included"

      "another/directory"

    ];

    sha256 = "0000000000000000000000000000000000000000000000000000";

    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";

  };

}

```

## `fetchfossil` {#fetchfossil}

Used with Fossil. Expects `url` to a Fossil archive, `rev`, and `sha256`.

Used with Fossil. Expects `url` to a Fossil archive, `rev`, and `hash`.

## `fetchcvs` {#fetchcvs}

Used with CVS. Expects `cvsRoot`, `tag`, and `sha256`.

Used with CVS. Expects `cvsRoot`, `tag`, and `hash`.

## `fetchhg` {#fetchhg}

Used with Mercurial. Expects `url`, `rev`, and `sha256`.

Used with Mercurial. Expects `url`, `rev`, and `hash`.

A number of fetcher functions wrap part of `fetchurl` and `fetchzip`. They are mainly convenience functions intended for commonly used destinations of source code in Nixpkgs. These wrapper fetchers are listed below.

## `fetchFromGitea` {#fetchfromgitea}

`fetchFromGitea` expects five arguments. `domain` is the gitea server name. `owner` is a string corresponding to the Gitea user or organization that controls this repository. `repo` corresponds to the name of the software repository. These are located at the top of every Gitea HTML page as `owner`/`repo`. `rev` corresponds to the Git commit hash or tag (e.g `v1.0`) that will be downloaded from Git. Finally, `sha256` corresponds to the hash of the extracted directory. Again, other hash algorithms are also available but `sha256` is currently preferred.

`fetchFromGitea` expects five arguments. `domain` is the gitea server name. `owner` is a string corresponding to the Gitea user or organization that controls this repository. `repo` corresponds to the name of the software repository. These are located at the top of every Gitea HTML page as `owner`/`repo`. `rev` corresponds to the Git commit hash or tag (e.g `v1.0`) that will be downloaded from Git. Finally, `hash` corresponds to the hash of the extracted directory. Again, other hash algorithms are also available but `hash` is currently preferred.

## `fetchFromGitHub` {#fetchfromgithub}

`fetchFromGitHub` expects four arguments. `owner` is a string corresponding to the GitHub user or organization that controls this repository. `repo` corresponds to the name of the software repository. These are located at the top of every GitHub HTML page as `owner`/`repo`. `rev` corresponds to the Git commit hash or tag (e.g `v1.0`) that will be downloaded from Git. Finally, `sha256` corresponds to the hash of the extracted directory. Again, other hash algorithms are also available, but `sha256` is currently preferred.

`fetchFromGitHub` expects four arguments. `owner` is a string corresponding to the GitHub user or organization that controls this repository. `repo` corresponds to the name of the software repository. These are located at the top of every GitHub HTML page as `owner`/`repo`. `rev` corresponds to the Git commit hash or tag (e.g `v1.0`) that will be downloaded from Git. Finally, `hash` corresponds to the hash of the extracted directory. Again, other hash algorithms are also available, but `hash` is currently preferred.

`fetchFromGitHub` uses `fetchzip` to download the source archive generated by GitHub for the specified revision. If `leaveDotGit`, `deepClone` or `fetchSubmodules` are set to `true`, `fetchFromGitHub` will use `fetchgit` instead. Refer to its section for documentation of these options.

## `fetchFromSourcehut` {#fetchfromsourcehut}

This is used with sourcehut repositories. Similar to `fetchFromGitHub` above,

it expects `owner`, `repo`, `rev` and `sha256`, but don't forget the tilde (~)

it expects `owner`, `repo`, `rev` and `hash`, but don't forget the tilde (~)

in front of the username! Expected arguments also include `vc` ("git" (default)

or "hg"), `domain` and `fetchSubmodules`.

  name = "patchwork";

  src = fetchurl {

    url = "https://github.com/ssbc/patchwork/releases/download/v3.11.4/Patchwork-3.11.4-linux-x86_64.AppImage";

    sha256 = "1blsprpkvm0ws9b96gb36f0rbf8f5jgmw4x6dsb1kswr4ysf591s";

    hash = "sha256-OqTitCeZ6xmWbqYTXp8sDrmVgTNjPZNW0hzUPW++mq4=";

  };

  extraPkgs = pkgs: with pkgs; [ ];

}

pullImage {

  imageName = "nixos/nix";

  imageDigest =

    "sha256:20d9485b25ecfd89204e843a962c1bd70e9cc6858d65d7f5fadc340246e2116b";

    "sha256:473a2b527958665554806aea24d0131bacec46d23af09fef4598eeab331850fa";

  finalImageName = "nix";

  finalImageTag = "1.11";

  sha256 = "0mqjy3zq2v6rrhizgb9nvhczl87lcfphq9601wcprdika2jz7qh8";

  finalImageTag = "2.11.1";

  sha256 = "sha256-qvhj+Hlmviz+KEBVmsyPIzTB3QlVAFzwAY1zDPIBGxc=";

  os = "linux";

  arch = "x86_64";

}

        owner = "Someone";

        repo = "AwesomeMod";

        rev = "...";

        sha256 = "...";

        hash = "...";

      };

      # Path to be installed in the unpacked source (default: ".")

      modRoot = "contents/under/this/path/will/be/installed";