Merge branch 'nixos-unstable' of https://github.com/NixOS/nixpkgs

Conflicts:
	nixpkgs/nixos/modules/config/console.nix
	nixpkgs/nixos/modules/services/mail/mailman.nix
	nixpkgs/nixos/modules/services/mail/public-inbox.nix
	nixpkgs/nixos/modules/services/mail/rss2email.nix
	nixpkgs/nixos/modules/services/networking/ssh/sshd.nix
	nixpkgs/pkgs/applications/networking/instant-messengers/dino/default.nix
	nixpkgs/pkgs/applications/networking/irc/weechat/default.nix
	nixpkgs/pkgs/applications/window-managers/sway/default.nix
	nixpkgs/pkgs/build-support/go/module.nix
	nixpkgs/pkgs/build-support/rust/build-rust-package/default.nix
	nixpkgs/pkgs/development/interpreters/python/default.nix
	nixpkgs/pkgs/development/node-packages/overrides.nix
	nixpkgs/pkgs/development/tools/b4/default.nix
	nixpkgs/pkgs/servers/dict/dictd-db.nix
	nixpkgs/pkgs/servers/mail/public-inbox/default.nix
	nixpkgs/pkgs/tools/security/pinentry/default.nix
	nixpkgs/pkgs/tools/text/unoconv/default.nix
	nixpkgs/pkgs/top-level/all-packages.nix

36 files changed, 400 insertions, 117 deletions

diff --git a/nixpkgs/pkgs/servers/mail/archiveopteryx/default.nix b/nixpkgs/pkgs/servers/mail/archiveopteryx/default.nix
index 2bcd87c3b84d..99e482323a46 100644
--- a/nixpkgs/pkgs/servers/mail/archiveopteryx/default.nix
+++ b/nixpkgs/pkgs/servers/mail/archiveopteryx/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   '';
 
   # fix build on gcc7+ and gcc11+
-  NIX_CFLAGS_COMPILE = [
+  env.NIX_CFLAGS_COMPILE = toString ([
     "-std=c++11" # c++17+ has errors
     "-Wno-error=builtin-declaration-mismatch"
     "-Wno-error=deprecated-copy"
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     "-Wno-error=nonnull"
   ] ++ lib.optionals (stdenv.cc.isGNU && lib.versionAtLeast stdenv.cc.version "11") [
     "-Wno-error=mismatched-new-delete"
-  ];
+  ]);
 
   buildPhase = ''jam "-j$NIX_BUILD_CORES" '';
   installPhase = ''
diff --git a/nixpkgs/pkgs/servers/mail/dkimproxy/default.nix b/nixpkgs/pkgs/servers/mail/dkimproxy/default.nix
index c5ad8414cdd9..128a9ae8ff11 100644
--- a/nixpkgs/pkgs/servers/mail/dkimproxy/default.nix
+++ b/nixpkgs/pkgs/servers/mail/dkimproxy/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "SMTP-proxy that signs and/or verifies emails";
-    homepage = "http://dkimproxy.sourceforge.net/";
+    homepage = "https://dkimproxy.sourceforge.net/";
     license = licenses.gpl2Plus;
     maintainers = [ maintainers.ekleog ];
     platforms = platforms.all;
diff --git a/nixpkgs/pkgs/servers/mail/dovecot/default.nix b/nixpkgs/pkgs/servers/mail/dovecot/default.nix
index 81d858d41b4c..47b6e8571915 100644
--- a/nixpkgs/pkgs/servers/mail/dovecot/default.nix
+++ b/nixpkgs/pkgs/servers/mail/dovecot/default.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation rec {
   pname = "dovecot";
-  version = "2.3.19.1";
+  version = "2.3.20";
 
   nativeBuildInputs = [ perl pkg-config ];
   buildInputs =
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dovecot.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.gz";
-    hash = "sha256-21q82H1zCWWeprRbLLbunF+XSGsrcZpd0Fp1nh9qXFE=";
+    hash = "sha256-yqgy65aBSKvfNe6dD1NLd5+nMsDOSpE9mrjDRpshhVI=";
   };
 
   enableParallelBuilding = true;
@@ -41,6 +41,9 @@ stdenv.mkDerivation rec {
     sed -i -s -E 's!\bcat\b!${coreutils}/bin/cat!g' src/lib-smtp/test-bin/*.sh
 
     patchShebangs src/config/settings-get.pl
+
+    # DES-encrypted passwords are not supported by NixPkgs anymore
+    sed '/test_password_scheme("CRYPT"/d' -i src/auth/test-libpassword.c
   '' + lib.optionalString stdenv.isLinux ''
     export systemdsystemunitdir=$out/etc/systemd/system
   '';
@@ -58,10 +61,10 @@ stdenv.mkDerivation rec {
     # so we can symlink plugins from several packages there.
     # The symlinking needs to be done in NixOS.
     ./2.3.x-module_dir.patch
-    # fix CVE-2022-30550
+    # fix openssl 3.0 compatibility
     (fetchpatch {
-      url = "https://github.com/dovecot/core/compare/7bad6a24%5E..a1022072.patch";
-      hash = "sha256-aSyRcQreyA9j8QwkODHqPpRuS3vzouVatEWCqhh+r+8=";
+      url = "https://salsa.debian.org/debian/dovecot/-/raw/debian/1%252.3.19.1+dfsg1-2/debian/patches/Support-openssl-3.0.patch";
+      hash = "sha256-PbBB1jIY3jIC8Js1NY93zkV0gISGUq7Nc67Ul5tN7sw=";
     })
   ];
 
diff --git a/nixpkgs/pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix b/nixpkgs/pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix
index c3f11bc14b28..35826e61de15 100644
--- a/nixpkgs/pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix
+++ b/nixpkgs/pkgs/servers/mail/dovecot/plugins/pigeonhole/default.nix
@@ -3,11 +3,11 @@ let
   dovecotMajorMinor = lib.versions.majorMinor dovecot.version;
 in stdenv.mkDerivation rec {
   pname = "dovecot-pigeonhole";
-  version = "0.5.19";
+  version = "0.5.20";
 
   src = fetchurl {
     url = "https://pigeonhole.dovecot.org/releases/${dovecotMajorMinor}/dovecot-${dovecotMajorMinor}-pigeonhole-${version}.tar.gz";
-    hash = "sha256:033kkhby9k9yrmgvlfmyzp8fccsw5bhq1dyvxj94sg3grkpj7f8h";
+    hash = "sha256-rjK9SHDqLBMorgm6IG6ewSEoBG1q/KUvu8nvf3VhfJg=";
   };
 
   buildInputs = [ dovecot openssl ];
diff --git a/nixpkgs/pkgs/servers/mail/dspam/default.nix b/nixpkgs/pkgs/servers/mail/dspam/default.nix
index e2388e6a9491..f32316428a69 100644
--- a/nixpkgs/pkgs/servers/mail/dspam/default.nix
+++ b/nixpkgs/pkgs/servers/mail/dspam/default.nix
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchurl, makeWrapper
 , gawk, gnused, gnugrep, coreutils, which
 , perlPackages
-, withMySQL ? false, zlib, mysql57
+, withMySQL ? false, zlib, mariadb-connector-c
 , withPgSQL ? false, postgresql
 , withSQLite ? false, sqlite
 , withDB ? false, db
@@ -25,13 +25,21 @@ in stdenv.mkDerivation rec {
     url = "mirror://sourceforge/dspam/dspam/${pname}-${version}/${pname}-${version}.tar.gz";
     sha256 = "1acklnxn1wvc7abn31l3qdj8q6k13s51k5gv86vka7q20jb5cxmf";
   };
+  patches = [
+    # https://gist.github.com/WhiteAnthrax/613136c76882e0ead3cb3bdad6b3d551
+    ./mariadb.patch
+  ];
 
   buildInputs = [ perlPackages.perl ]
-                ++ lib.optionals withMySQL [ zlib mysql57.connector-c ]
+                ++ lib.optionals withMySQL [ zlib mariadb-connector-c.out ]
                 ++ lib.optional withPgSQL postgresql
                 ++ lib.optional withSQLite sqlite
                 ++ lib.optional withDB db;
   nativeBuildInputs = [ makeWrapper ];
+  # patch out libmysql >= 5 check, since mariadb-connector is at 3.x
+  postPatch = ''
+    sed -i 's/atoi(m) >= 5/1/g' configure m4/mysql_drv.m4
+  '';
 
   configureFlags = [
     "--with-storage-driver=${drivers}"
@@ -50,14 +58,17 @@ in stdenv.mkDerivation rec {
     "--enable-preferences-extension"
     "--enable-long-usernames"
     "--enable-external-lookup"
-  ] ++ lib.optional withMySQL "--with-mysql-includes=${mysql57.connector-c}/include/mysql"
+  ] ++ lib.optionals withMySQL [
+    "--with-mysql-includes=${mariadb-connector-c.dev}/include/mysql"
+    "--with-mysql-libraries=${mariadb-connector-c.out}/lib/mysql"
+  ]
     ++ lib.optional withPgSQL "--with-pgsql-libraries=${postgresql.lib}/lib";
 
   # Workaround build failure on -fno-common toolchains like upstream
   # gcc-10. Otherwise build fails as:
   #   ld: .libs/hash_drv.o:/build/dspam-3.10.2/src/util.h:96: multiple definition of `verified_user';
   #     .libs/libdspam.o:/build/dspam-3.10.2/src/util.h:96: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   # Lots of things are hardwired to paths like sysconfdir. That's why we install with both "prefix" and "DESTDIR"
   # and fix directory structure manually after that.
@@ -106,7 +117,7 @@ in stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "http://dspam.sourceforge.net/";
+    homepage = "https://dspam.sourceforge.net/";
     description = "Community Driven Antispam Filter";
     license = licenses.agpl3Plus;
     platforms = platforms.linux;
diff --git a/nixpkgs/pkgs/servers/mail/dspam/mariadb.patch b/nixpkgs/pkgs/servers/mail/dspam/mariadb.patch
new file mode 100644
index 000000000000..5f3d8277d943
--- /dev/null
+++ b/nixpkgs/pkgs/servers/mail/dspam/mariadb.patch
@@ -0,0 +1,42 @@
+diff -ur dspam-3.10.2.orig/configure dspam-3.10.2/configure
+--- dspam-3.10.2.orig/configure	2012-04-24 02:53:49.000000000 +0900
++++ dspam-3.10.2/configure	2019-05-24 01:59:06.557890494 +0900
+@@ -13280,7 +13280,7 @@
+     #include <mysql.h>
+     #include <mysqld_error.h>
+     #include <errmsg.h>
+-    #if defined(PROTOCOL_VERSION) && defined(ER_LOCK_DEADLOCK) && defined(ER_LOCK_WAIT_TIMEOUT) && defined(ER_LOCK_OR_ACTIVE_TRANSACTION) && defined(CR_ERROR_FIRST)
++    #if defined(PROTOCOL_VERSION) && defined(ER_LOCK_DEADLOCK) && defined(ER_LOCK_WAIT_TIMEOUT) && defined(ER_LOCK_OR_ACTIVE_TRANSACTION) && defined(CR_MIN_ERROR)
+     /* Success */
+     #else
+     #error Unsupported version of MySQL
+@@ -13293,7 +13293,7 @@
+ 
+                 { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+ $as_echo "$as_me: error: in \`$ac_pwd':" >&2;}
+-as_fn_error $? "Unsupported version of MySQL (no PROTOCOL_VERSION or ER_LOCK_DEADLOCK or ER_LOCK_WAIT_TIMEOUT or ER_LOCK_OR_ACTIVE_TRANSACTION or CR_ERROR_FIRST defined)
++as_fn_error $? "Unsupported version of MySQL (no PROTOCOL_VERSION or ER_LOCK_DEADLOCK or ER_LOCK_WAIT_TIMEOUT or ER_LOCK_OR_ACTIVE_TRANSACTION or CR_MIN_ERROR defined)
+ See \`config.log' for more details" "$LINENO" 5; }
+                 mysql_headers_success=no
+ 
+diff -ur dspam-3.10.2.orig/m4/mysql_drv.m4 dspam-3.10.2/m4/mysql_drv.m4
+--- dspam-3.10.2.orig/m4/mysql_drv.m4	2011-08-17 07:38:30.000000000 +0900
++++ dspam-3.10.2/m4/mysql_drv.m4	2019-05-24 02:00:08.301217506 +0900
+@@ -80,7 +80,7 @@
+     #include <mysql.h>
+     #include <mysqld_error.h>
+     #include <errmsg.h>
+-    #if defined(PROTOCOL_VERSION) && defined(ER_LOCK_DEADLOCK) && defined(ER_LOCK_WAIT_TIMEOUT) && defined(ER_LOCK_OR_ACTIVE_TRANSACTION) && defined(CR_ERROR_FIRST)
++    #if defined(PROTOCOL_VERSION) && defined(ER_LOCK_DEADLOCK) && defined(ER_LOCK_WAIT_TIMEOUT) && defined(ER_LOCK_OR_ACTIVE_TRANSACTION) && defined(CR_MIN_ERROR)
+     /* Success */
+     #else
+     #error Unsupported version of MySQL 
+@@ -88,7 +88,7 @@
+             ]])],
+             [],
+             [
+-                AC_MSG_FAILURE([Unsupported version of MySQL (no PROTOCOL_VERSION or ER_LOCK_DEADLOCK or ER_LOCK_WAIT_TIMEOUT or ER_LOCK_OR_ACTIVE_TRANSACTION or CR_ERROR_FIRST defined)])
++                AC_MSG_FAILURE([Unsupported version of MySQL (no PROTOCOL_VERSION or ER_LOCK_DEADLOCK or ER_LOCK_WAIT_TIMEOUT or ER_LOCK_OR_ACTIVE_TRANSACTION or CR_MIN_ERROR defined)])
+                 mysql_headers_success=no
+             ])
+ fi
diff --git a/nixpkgs/pkgs/servers/mail/exim/default.nix b/nixpkgs/pkgs/servers/mail/exim/default.nix
index 30b8309d6bc3..1a911668a540 100644
--- a/nixpkgs/pkgs/servers/mail/exim/default.nix
+++ b/nixpkgs/pkgs/servers/mail/exim/default.nix
@@ -17,6 +17,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-KZpWknsus0d9qv08W9oCvGflxOWJinrq8nQIdSeM8aM=";
   };
 
+  enableParallelBuilding = true;
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ coreutils db openssl perl pcre2 ]
     ++ lib.optional enableLDAP openldap
@@ -27,7 +29,9 @@ stdenv.mkDerivation rec {
     ++ lib.optional enableDMARC opendmarc
     ++ lib.optional enableRedis hiredis;
 
-  preBuild = ''
+  configurePhase = ''
+    runHook preConfigure
+
     sed '
       s:^\(BIN_DIRECTORY\)=.*:\1='"$out"'/bin:
       s:^\(CONFIGURE_FILE\)=.*:\1=/etc/exim.conf:
@@ -60,8 +64,8 @@ stdenv.mkDerivation rec {
       ${lib.optionalString enableMySQL ''
         s:^# \(LOOKUP_MYSQL=yes\)$:\1:
         s:^# \(LOOKUP_MYSQL_PC=libmysqlclient\)$:\1:
-        s:^\(LOOKUP_LIBS\)=\(.*\):\1=\2 -lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -ldl -lm -lpthread -lz:
-        s:^# \(LOOKUP_LIBS\)=.*:\1=-lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -ldl -lm -lpthread -lz:
+        s:^\(LOOKUP_LIBS\)=\(.*\):\1=\2 -lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -lm -lpthread -lz:
+        s:^# \(LOOKUP_LIBS\)=.*:\1=-lmysqlclient -L${libmysqlclient}/lib/mysql -lssl -lm -lpthread -lz:
         s:^# \(LOOKUP_INCLUDE\)=.*:\1=-I${libmysqlclient.dev}/include/mysql/:
       ''}
       ${lib.optionalString enableAuthDovecot ''
@@ -90,9 +94,13 @@ stdenv.mkDerivation rec {
       #/^\s*#.*/d
       #/^\s*$/d
     ' < src/EDITME > Local/Makefile
+
+    runHook postConfigure
   '';
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/bin $out/share/man/man8
     cp doc/exim.8 $out/share/man/man8
 
@@ -106,6 +114,8 @@ stdenv.mkDerivation rec {
       for i in mailq newaliases rmail rsmtp runq sendmail; do
         ln -s exim $i
       done )
+
+    runHook postInstall
   '';
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/servers/mail/listmonk/default.nix b/nixpkgs/pkgs/servers/mail/listmonk/default.nix
index 487ef068c22f..97ec1924c2a8 100644
--- a/nixpkgs/pkgs/servers/mail/listmonk/default.nix
+++ b/nixpkgs/pkgs/servers/mail/listmonk/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, callPackage, stuffbin }:
+{ lib, buildGoModule, fetchFromGitHub, callPackage, stuffbin, nixosTests }:
 
 buildGoModule rec {
   pname = "listmonk";
@@ -43,6 +43,7 @@ buildGoModule rec {
 
   passthru = {
     frontend = callPackage ./frontend.nix { inherit meta; };
+    tests = { inherit (nixosTests) listmonk; };
   };
 
   meta = with lib; {
diff --git a/nixpkgs/pkgs/servers/mail/listmonk/frontend.nix b/nixpkgs/pkgs/servers/mail/listmonk/frontend.nix
index f1b8bf5c07e1..81e5afa8fd96 100644
--- a/nixpkgs/pkgs/servers/mail/listmonk/frontend.nix
+++ b/nixpkgs/pkgs/servers/mail/listmonk/frontend.nix
@@ -18,11 +18,18 @@ yarn2nix-moretea.mkYarnPackage rec {
   yarnLock = ./yarn.lock;
   yarnNix = ./yarn.nix;
 
+  # For Node.js v17+, this is necessary.
+  NODE_OPTIONS = "--openssl-legacy-provider";
+
   installPhase = ''
+    runHook preInstall
+
     cd deps/listmonk-frontend/frontend
     npm run build
 
     mv dist $out
+
+    runHook postInstall
   '';
 
   doDist = false;
diff --git a/nixpkgs/pkgs/servers/mail/listmonk/stuffbin.nix b/nixpkgs/pkgs/servers/mail/listmonk/stuffbin.nix
index 92c9785e2731..442307fad65b 100644
--- a/nixpkgs/pkgs/servers/mail/listmonk/stuffbin.nix
+++ b/nixpkgs/pkgs/servers/mail/listmonk/stuffbin.nix
@@ -4,7 +4,7 @@ buildGoModule rec {
   pname = "stuffbin";
   version = "1.1.0";
 
-  vendorSha256 = "sha256-pQpattmS9VmO3ZIQUFn66az8GSmB4IvYhTTCFn6SUmo=";
+  vendorSha256 = null;
 
   src = fetchFromGitHub {
     owner = "knadh";
diff --git a/nixpkgs/pkgs/servers/mail/mailman/default.nix b/nixpkgs/pkgs/servers/mail/mailman/default.nix
index 77dbef745c8d..5571a5bef7f3 100644
--- a/nixpkgs/pkgs/servers/mail/mailman/default.nix
+++ b/nixpkgs/pkgs/servers/mail/mailman/default.nix
@@ -26,9 +26,9 @@ let
         mailmanEnv = self.python3.withPackages
           (ps: [ mailman ps.psycopg2 ]
             ++ lib.optional withHyperkitty mailman-hyperkitty
-            ++ lib.optionals withLDAP [ ps.ldap ps.django-auth-ldap ]);
+            ++ lib.optionals withLDAP [ ps.python-ldap ps.django-auth-ldap ]);
         webEnv = self.python3.withPackages
-          (ps: [ web ps.psycopg2 ] ++ lib.optionals withLDAP [ ps.ldap ps.django-auth-ldap ]);
+          (ps: [ web ps.psycopg2 ] ++ lib.optionals withLDAP [ ps.python-ldap ps.django-auth-ldap ]);
       };
   });
 
diff --git a/nixpkgs/pkgs/servers/mail/mailman/hyperkitty.nix b/nixpkgs/pkgs/servers/mail/mailman/hyperkitty.nix
index 7f221617878c..f0cac80bb5fd 100644
--- a/nixpkgs/pkgs/servers/mail/mailman/hyperkitty.nix
+++ b/nixpkgs/pkgs/servers/mail/mailman/hyperkitty.nix
@@ -1,5 +1,6 @@
 { lib
 , python3
+, fetchPypi
 , fetchpatch
 }:
 
@@ -61,12 +62,12 @@ buildPythonPackage rec {
   # listed as dependencies in setup.py.  To use these, they should be
   # dependencies of the Django Python environment, but not of
   # HyperKitty so they're not included for people who don't need them.
-  checkInputs = [
+  nativeCheckInputs = [
     beautifulsoup4
     elasticsearch
     mock
     whoosh
-  ];
+  ] ++ beautifulsoup4.optional-dependencies.lxml;
 
   checkPhase = ''
     cd $NIX_BUILD_TOP/$sourceRoot
diff --git a/nixpkgs/pkgs/servers/mail/mailman/mailman-hyperkitty.nix b/nixpkgs/pkgs/servers/mail/mailman/mailman-hyperkitty.nix
index 39f9b5ec37a8..4bb9cdda1a46 100644
--- a/nixpkgs/pkgs/servers/mail/mailman/mailman-hyperkitty.nix
+++ b/nixpkgs/pkgs/servers/mail/mailman/mailman-hyperkitty.nix
@@ -1,19 +1,20 @@
 { lib
 , python3
+, fetchPypi
 , mailman
 }:
 
 with python3.pkgs;
 buildPythonPackage rec {
   pname = "mailman-hyperkitty";
-  version = "1.2.0";
+  version = "1.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-EQBx1KX3z/Wv3QAHOi+s/ihLOjpiupIQBYyE6IPbJto=";
+    sha256 = "sha256-+Nad+8bMtYKJbUCpppRXqhB1zdbvvFXTTHlwJLQLzDg=";
   };
 
   propagatedBuildInputs = [
@@ -22,7 +23,7 @@ buildPythonPackage rec {
     zope_interface
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     mock
     nose2
   ];
diff --git a/nixpkgs/pkgs/servers/mail/mailman/package.nix b/nixpkgs/pkgs/servers/mail/mailman/package.nix
index b316d69f85b9..e900c2b872df 100644
--- a/nixpkgs/pkgs/servers/mail/mailman/package.nix
+++ b/nixpkgs/pkgs/servers/mail/mailman/package.nix
@@ -1,16 +1,23 @@
-{ lib, fetchpatch, python3, postfix, lynx
+{ lib
+, fetchpatch
+, python3
+, fetchPypi
+, docutils
+, sphinx
+, postfix
+, lynx
 }:
 
 with python3.pkgs;
 
 buildPythonPackage rec {
   pname = "mailman";
-  version = "3.3.5";
+  version = "3.3.8";
   disabled = pythonOlder "3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "12mgxs1ndhdjjkydx48b95na9k9h0disfqgrr6wxx7vda6dqvcwz";
+    hash = "sha256-g6wH7lXqK0yJ8AxO1HFxMvBicBJ9NGWlPePFyxl9Qc4=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
@@ -33,6 +40,11 @@ buildPythonPackage rec {
     zope_configuration
   ];
 
+  checkInputs = [
+    docutils
+    sphinx
+  ];
+
   patches = [
     # https://gitlab.com/mailman/mailman/-/merge_requests/594
     (fetchpatch {
@@ -70,9 +82,6 @@ buildPythonPackage rec {
   # 'runner' scripts.
   dontWrapPythonPrograms = true;
 
-  # requires flufl.testing, which the upstream has archived
-  doCheck = false;
-
   meta = {
     homepage = "https://www.gnu.org/software/mailman/";
     description = "Free software for managing electronic mail discussion and newsletter lists";
diff --git a/nixpkgs/pkgs/servers/mail/mailman/postorius.nix b/nixpkgs/pkgs/servers/mail/mailman/postorius.nix
index bd4425e5efa7..fefffffc87c8 100644
--- a/nixpkgs/pkgs/servers/mail/mailman/postorius.nix
+++ b/nixpkgs/pkgs/servers/mail/mailman/postorius.nix
@@ -1,4 +1,4 @@
-{ lib, python3 }:
+{ lib, python3, fetchPypi }:
 
 with python3.pkgs;
 
@@ -14,7 +14,7 @@ buildPythonPackage rec {
   };
 
   propagatedBuildInputs = [ django-mailman3 readme_renderer ];
-  checkInputs = [ beautifulsoup4 vcrpy mock ];
+  nativeCheckInputs = [ beautifulsoup4 vcrpy mock ];
 
   # Tries to connect to database.
   doCheck = false;
diff --git a/nixpkgs/pkgs/servers/mail/mailman/python.nix b/nixpkgs/pkgs/servers/mail/mailman/python.nix
index 359f974f598c..288e48d814e4 100644
--- a/nixpkgs/pkgs/servers/mail/mailman/python.nix
+++ b/nixpkgs/pkgs/servers/mail/mailman/python.nix
@@ -1,30 +1,19 @@
-{ python3 }:
+{ python3, fetchPypi }:
 
 python3.override {
   packageOverrides = self: super: {
     # does not find tests
-    alembic = super.alembic.overridePythonAttrs (oldAttrs:  {
-      doCheck = false;
-    });
-    # Needed by mailman, see https://gitlab.com/mailman/mailman/-/issues/964
-    sqlalchemy = super.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
-      version = "1.3.24";
-      src = super.fetchPypi {
-        inherit version;
-        inherit (oldAttrs) pname;
-        sha256 = "06bmxzssc66cblk1hamskyv5q3xf1nh1py3vi6dka4lkpxy7gfzb";
-      };
-      # does not find tests
+    alembic = super.alembic.overridePythonAttrs (oldAttrs: {
       doCheck = false;
     });
     # Fixes `AssertionError: database connection isn't set to UTC`
-    psycopg2 = super.psycopg2.overridePythonAttrs (a: (rec {
+    psycopg2 = super.psycopg2.overridePythonAttrs (a: rec {
       version = "2.8.6";
-      src = super.fetchPypi {
+      src = fetchPypi {
         inherit version;
         inherit (a) pname;
         sha256 = "fb23f6c71107c37fd667cb4ea363ddeb936b348bbd6449278eb92c189699f543";
       };
-    }));
+    });
   };
 }
diff --git a/nixpkgs/pkgs/servers/mail/mailman/web.nix b/nixpkgs/pkgs/servers/mail/mailman/web.nix
index 64489bc3e412..bb50586e8d56 100644
--- a/nixpkgs/pkgs/servers/mail/mailman/web.nix
+++ b/nixpkgs/pkgs/servers/mail/mailman/web.nix
@@ -1,4 +1,4 @@
-{ lib, python3
+{ lib, python3, fetchPypi
 , sassc, hyperkitty, postorius
 }:
 
diff --git a/nixpkgs/pkgs/servers/mail/mlmmj/default.nix b/nixpkgs/pkgs/servers/mail/mlmmj/default.nix
index aba0664b8f4f..2795ba1af358 100644
--- a/nixpkgs/pkgs/servers/mail/mlmmj/default.nix
+++ b/nixpkgs/pkgs/servers/mail/mlmmj/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   # gcc-10. Otherwise build fails as:
   #   ld: getlistdelim.o:/build/mlmmj-1.3.0/src/../include/mlmmj.h:84: multiple definition of
   #     `subtype_strs'; mlmmj-send.o:/build/mlmmj-1.3.0/src/../include/mlmmj.h:84: first defined here
-  NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon";
 
   postInstall = ''
     # grab all documentation files
diff --git a/nixpkgs/pkgs/servers/mail/opensmtpd/default.nix b/nixpkgs/pkgs/servers/mail/opensmtpd/default.nix
index 5f36b139781b..3bac9e0c6ef6 100644
--- a/nixpkgs/pkgs/servers/mail/opensmtpd/default.nix
+++ b/nixpkgs/pkgs/servers/mail/opensmtpd/default.nix
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, autoconf, automake, libtool, bison
-, libasr, libevent, zlib, libressl, db, pam, nixosTests
+, libasr, libevent, zlib, libressl, db, pam, libxcrypt, nixosTests
 }:
 
 stdenv.mkDerivation rec {
@@ -7,7 +7,7 @@ stdenv.mkDerivation rec {
   version = "6.8.0p2";
 
   nativeBuildInputs = [ autoconf automake libtool bison ];
-  buildInputs = [ libasr libevent zlib libressl db pam ];
+  buildInputs = [ libasr libevent zlib libressl db pam libxcrypt ];
 
   src = fetchurl {
     url = "https://www.opensmtpd.org/archives/${pname}-${version}.tar.gz";
diff --git a/nixpkgs/pkgs/servers/mail/opensmtpd/extras.nix b/nixpkgs/pkgs/servers/mail/opensmtpd/extras.nix
index 5759e57d3b49..f179bf96368f 100644
--- a/nixpkgs/pkgs/servers/mail/opensmtpd/extras.nix
+++ b/nixpkgs/pkgs/servers/mail/opensmtpd/extras.nix
@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
     "--with-table-redis"
   ];
 
-  NIX_CFLAGS_COMPILE = lib.optionalString enableRedis
+  env.NIX_CFLAGS_COMPILE = lib.optionalString enableRedis
       "-I${hiredis}/include/hiredis -lhiredis"
     + lib.optionalString enableMysql
       " -L${libmysqlclient}/lib/mysql";
diff --git a/nixpkgs/pkgs/servers/mail/opensmtpd/filter-dkimsign/default.nix b/nixpkgs/pkgs/servers/mail/opensmtpd/filter-dkimsign/default.nix
new file mode 100644
index 000000000000..844eb8dc3d88
--- /dev/null
+++ b/nixpkgs/pkgs/servers/mail/opensmtpd/filter-dkimsign/default.nix
@@ -0,0 +1,36 @@
+{ lib
+, stdenv
+, fetchurl
+, libopensmtpd
+, openssl
+, mandoc
+}:
+stdenv.mkDerivation rec {
+  pname = "opensmtpd-filter-dkimsign";
+  version = "0.6";
+
+  src = fetchurl {
+    url = "https://imperialat.at/releases/filter-dkimsign-${version}.tar.gz";
+    hash = "sha256-O18NtAuSNg82uKnUx+R4h3e1IBSElTrFWBBkr2AYNsM=";
+  };
+
+  patches = [ ./no-chown-while-installing.patch ];
+
+  buildInputs = [ libopensmtpd openssl ];
+
+  nativeBuildInputs = [ mandoc ];
+
+  makeFlags = [
+    "-f Makefile.gnu"
+    "HAVE_ED25519=1"
+    "DESTDIR=$(out)"
+    "LOCALBASE="
+  ];
+
+  meta = with lib; {
+    description = "OpenSMTPD filter for DKIM signing";
+    homepage = "http://imperialat.at/dev/filter-dkimsign/";
+    license = licenses.isc;
+    maintainers = with maintainers; [ malte-v ];
+  };
+}
diff --git a/nixpkgs/pkgs/servers/mail/opensmtpd/filter-dkimsign/no-chown-while-installing.patch b/nixpkgs/pkgs/servers/mail/opensmtpd/filter-dkimsign/no-chown-while-installing.patch
new file mode 100644
index 000000000000..8ed5fc153a36
--- /dev/null
+++ b/nixpkgs/pkgs/servers/mail/opensmtpd/filter-dkimsign/no-chown-while-installing.patch
@@ -0,0 +1,24 @@
+diff --git a/Makefile.gnu b/Makefile.gnu
+index 1f97bd2..807b692 100644
+--- a/Makefile.gnu
++++ b/Makefile.gnu
+@@ -46,11 +46,7 @@ NEED_PLEDGE?=		1
+ 
+ MANFORMAT?=		mangz
+ 
+-BINOWN?=	root
+-BINGRP?=	root
+ BINPERM?=	755
+-MANOWN?=	root
+-MANGRP?=	root
+ MANPERM?=	644
+ 
+ ifeq (${MANFORMAT}, mangz)
+@@ -115,5 +111,5 @@ clean:
+ 
+ .PHONY: install
+ install: ${PROG}
+-	${INSTALL} -D -o ${BINOWN} -g ${BINGRP} -m ${BINPERM} ${PROG} ${DESTDIR}${BINDIR}/${PROG}
+-	${INSTALL} -D -o ${MANOWN} -g ${MANGRP} -m ${MANPERM} ${TARGET_MAN} ${DESTDIR}${MANDIR}/${TARGET_MAN}
++	${INSTALL} -D -m ${BINPERM} ${PROG} ${DESTDIR}${BINDIR}/${PROG}
++	${INSTALL} -D -m ${MANPERM} ${TARGET_MAN} ${DESTDIR}${MANDIR}/${TARGET_MAN}
diff --git a/nixpkgs/pkgs/servers/mail/opensmtpd/libopensmtpd/default.nix b/nixpkgs/pkgs/servers/mail/opensmtpd/libopensmtpd/default.nix
new file mode 100644
index 000000000000..e9abdf0864f2
--- /dev/null
+++ b/nixpkgs/pkgs/servers/mail/opensmtpd/libopensmtpd/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchurl
+, libevent
+, mandoc
+}:
+stdenv.mkDerivation rec {
+  pname = "libopensmtpd";
+  version = "0.7";
+
+  src = fetchurl {
+    url = "https://imperialat.at/releases/libopensmtpd-${version}.tar.gz";
+    hash = "sha256-zdbV4RpwY/kmXaQ6QjCcZGVUuLaLA5gsqEctvisIphM=";
+  };
+
+  patches = [ ./no-chown-while-installing.patch ];
+
+  buildInputs = [ libevent ];
+
+  nativeBuildInputs = [ mandoc ];
+
+  makeFlags = [
+    "-f Makefile.gnu"
+    "DESTDIR=$(out)"
+    "LOCALBASE="
+  ];
+
+  meta = with lib; {
+    description = "Library for creating OpenSMTPD filters";
+    homepage = "http://imperialat.at/dev/libopensmtpd/";
+    license = licenses.isc;
+    maintainers = with maintainers; [ malte-v ];
+  };
+}
diff --git a/nixpkgs/pkgs/servers/mail/opensmtpd/libopensmtpd/no-chown-while-installing.patch b/nixpkgs/pkgs/servers/mail/opensmtpd/libopensmtpd/no-chown-while-installing.patch
new file mode 100644
index 000000000000..52d8b3e2d01f
--- /dev/null
+++ b/nixpkgs/pkgs/servers/mail/opensmtpd/libopensmtpd/no-chown-while-installing.patch
@@ -0,0 +1,38 @@
+diff --git a/Makefile.gnu b/Makefile.gnu
+index b4bcaef..981721c 100644
+--- a/Makefile.gnu
++++ b/Makefile.gnu
+@@ -27,7 +27,7 @@ SYMBOL_LIST=	${CURDIR}/Symbols.list
+ includes:
+ 	@cd ${CURDIR}; for i in ${HDRS}; do \
+ 	    j="cmp -s $$i ${DESTDIR}${LOCALBASE}/include/$$i || \
+-	    ${INSTALL} -D -o ${BINOWN} -g ${BINGRP} -m 444 $$i\
++	    ${INSTALL} -D -m 444 $$i\
+ 		${DESTDIR}${LOCALBASE}/include/$$i"; \
+ 	    echo $$j; \
+ 	    eval "$$j"; \
+@@ -52,11 +52,7 @@ MANFORMAT?=		mangz
+ INSTALL?=	install
+ LINK?=		ln
+ 
+-BINOWN?=	root
+-BINGRP?=	root
+ LIBPERM?=	755
+-MANOWN?=	root
+-MANGRP?=	root
+ MANPERM?=	644
+ 
+ include ${CURDIR}/shlib_version
+@@ -138,10 +134,10 @@ all: ${TARGET_LIB} ${TARGET_MAN}
+ 
+ .PHONY: install
+ install: includes ${TARGET_LIB} ${TARGET_MAN}
+-	${INSTALL} -D -o ${BINOWN} -g ${BINGRP} -m ${LIBPERM} ${TARGET_LIB} ${DESTDIR}${LIBDIR}/${TARGET_LIB}
++	${INSTALL} -D -m ${LIBPERM} ${TARGET_LIB} ${DESTDIR}${LIBDIR}/${TARGET_LIB}
+ 	${LINK} -s ${TARGET_LIB} ${DESTDIR}${LIBDIR}/${SONAME_LIB}
+ 	${LINK} -s ${TARGET_LIB} ${DESTDIR}${LIBDIR}/${BASE_LIB}
+-	${INSTALL} -D -o ${MANOWN} -g ${MANGRP} -m ${MANPERM} ${TARGET_MAN} ${DESTDIR}${MANDIR}/${TARGET_MAN}
++	${INSTALL} -D -m ${MANPERM} ${TARGET_MAN} ${DESTDIR}${MANDIR}/${TARGET_MAN}
+ 
+ CLEANFILES+=	*.o ${TARGET_LIB}
+ 
diff --git a/nixpkgs/pkgs/servers/mail/petidomo/default.nix b/nixpkgs/pkgs/servers/mail/petidomo/default.nix
index 447e643c5c93..64d9ef99bdd3 100644
--- a/nixpkgs/pkgs/servers/mail/petidomo/default.nix
+++ b/nixpkgs/pkgs/servers/mail/petidomo/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = {
-    homepage = "http://petidomo.sourceforge.net/";
+    homepage = "https://petidomo.sourceforge.net/";
     description = "A simple and easy to administer mailing list server";
     license = lib.licenses.gpl3Plus;
 
diff --git a/nixpkgs/pkgs/servers/mail/popa3d/default.nix b/nixpkgs/pkgs/servers/mail/popa3d/default.nix
index 9678bfe3fa28..d36d26b5d520 100644
--- a/nixpkgs/pkgs/servers/mail/popa3d/default.nix
+++ b/nixpkgs/pkgs/servers/mail/popa3d/default.nix
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl,  openssl }:
+{ lib, stdenv, fetchurl,  openssl, libxcrypt }:
 
 stdenv.mkDerivation rec {
   pname = "popa3d";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
     sha256 = "1g48cd74sqhl496wmljhq44iyfpghaz363a1ip8nyhpjz7d57f03";
   };
 
-  buildInputs = [ openssl ];
+  buildInputs = [ openssl libxcrypt ];
 
   patches = [
     ./fix-mail-spool-path.patch
diff --git a/nixpkgs/pkgs/servers/mail/postfix/default.nix b/nixpkgs/pkgs/servers/mail/postfix/default.nix
index 65e0041a01eb..e801dcbe7ba4 100644
--- a/nixpkgs/pkgs/servers/mail/postfix/default.nix
+++ b/nixpkgs/pkgs/servers/mail/postfix/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, makeWrapper, gnused, db, openssl, cyrus_sasl, libnsl
-, coreutils, findutils, gnugrep, gawk, icu, pcre, m4
+, coreutils, findutils, gnugrep, gawk, icu, pcre2, m4
 , fetchpatch
 , buildPackages, nixosTests
 , withLDAP ? true, openldap
@@ -25,15 +25,15 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "postfix";
-  version = "3.6.6";
+  version = "3.8.1";
 
   src = fetchurl {
     url = "http://cdn.postfix.johnriley.me/mirrors/postfix-release/official/${pname}-${version}.tar.gz";
-    hash = "sha256-CYpxT0EEaO/ibiGR3I8xy6RQfVv0iPVvnrVUXjaG8NY=";
+    hash = "sha256-VOG//e0wMoKKcN4iwqGpTRwJf8RRPg/b/P2/O/9rcJI=";
   };
 
   nativeBuildInputs = [ makeWrapper m4 ];
-  buildInputs = [ db openssl cyrus_sasl icu libnsl pcre ]
+  buildInputs = [ db openssl cyrus_sasl icu libnsl pcre2 ]
     ++ lib.optional withPgSQL postgresql
     ++ lib.optional withMySQL libmysqlclient
     ++ lib.optional withSQLite sqlite
@@ -101,7 +101,11 @@ in stdenv.mkDerivation rec {
       --prefix PATH ":" ${lib.makeBinPath [ coreutils findutils gnugrep gawk gnused ]}
   '';
 
-  passthru.tests = { inherit (nixosTests) postfix postfix-raise-smtpd-tls-security-level; };
+  passthru = {
+    tests = { inherit (nixosTests) postfix postfix-raise-smtpd-tls-security-level; };
+
+    updateScript = ./update.sh;
+  };
 
   meta = with lib; {
     homepage = "http://www.postfix.org/";
diff --git a/nixpkgs/pkgs/servers/mail/postfix/pfixtools.nix b/nixpkgs/pkgs/servers/mail/postfix/pfixtools.nix
index df04ade5b452..d57aaa4ef29d 100644
--- a/nixpkgs/pkgs/servers/mail/postfix/pfixtools.nix
+++ b/nixpkgs/pkgs/servers/mail/postfix/pfixtools.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
                       --replace /bin/bash ${bash}/bin/bash;
   '';
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=nonnull-compare -Wno-error=format-truncation";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=nonnull-compare -Wno-error=format-truncation";
 
   makeFlags = [ "DESTDIR=$(out)" "prefix=" ];
 
diff --git a/nixpkgs/pkgs/servers/mail/postfix/update.sh b/nixpkgs/pkgs/servers/mail/postfix/update.sh
new file mode 100755
index 000000000000..eacb548bc002
--- /dev/null
+++ b/nixpkgs/pkgs/servers/mail/postfix/update.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl pcre common-updater-scripts
+
+set -eu -o pipefail
+
+# Expect the text in format of '<a href="official/postfix-3.7.4.tar.gz">Source code</a> |'
+# Stable release goes first.
+new_version="$(curl -s http://cdn.postfix.johnriley.me/mirrors/postfix-release/index.html |
+    pcregrep -o1 '"official/postfix-([0-9.]+)[.]tar[.]gz">' | head -n1)"
+update-source-version postfix "$new_version"
diff --git a/nixpkgs/pkgs/servers/mail/postsrsd/default.nix b/nixpkgs/pkgs/servers/mail/postsrsd/default.nix
index 67dbea9c470d..99e3dbfdc435 100644
--- a/nixpkgs/pkgs/servers/mail/postsrsd/default.nix
+++ b/nixpkgs/pkgs/servers/mail/postsrsd/default.nix
@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "postsrsd";
-  version = "1.11";
+  version = "1.12";
 
   src = fetchFromGitHub {
     owner = "roehling";
     repo = "postsrsd";
     rev = version;
-    sha256 = "sha256-M1VtH+AToLh9J4zwIznInfFJzqmKElTvqAgI+qqL+Lw=";
+    sha256 = "sha256-aSI9TR1wSyMA0SKkbavk+IugRfW4ZEgpzrNiXn0F5ak=";
   };
 
   cmakeFlags = [ "-DGENERATE_SRS_SECRET=OFF" "-DINIT_FLAVOR=systemd" ];
diff --git a/nixpkgs/pkgs/servers/mail/public-inbox/default.nix b/nixpkgs/pkgs/servers/mail/public-inbox/default.nix
index 5216c0923930..302473b975a9 100644
--- a/nixpkgs/pkgs/servers/mail/public-inbox/default.nix
+++ b/nixpkgs/pkgs/servers/mail/public-inbox/default.nix
@@ -6,6 +6,7 @@
 , gnumake
 , highlight
 , libgit2
+, libxcrypt
 , man
 , openssl
 , pkg-config
@@ -17,30 +18,33 @@
 , EmailAddressXS
 , EmailMIME
 , IOSocketSSL
+# FIXME: to be packaged
+#, IOSocketSocks
 , IPCRun
 , Inline
 , InlineC
 , LinuxInotify2
 , MailIMAPClient
+# FIXME: to be packaged
+#, NetNetrc
+# FIXME: to be packaged
+#, NetNNTP
 , ParseRecDescent
 , Plack
 , PlackMiddlewareReverseProxy
+, PlackTestExternalServer
 , SearchXapian
+, TestSimple13
 , TimeDate
 , URI
+, XMLTreePP
 }:
 
 let
 
   skippedTests = [
-    # These tests would fail, and produce "Operation not permitted"
-    # errors from git, because they use git init --shared.  This tries
-    # to set the setgid bit, which isn't permitted inside build
-    # sandboxes.
-    #
-    # These tests were indentified with
-    #     grep -r shared t/
-    "convert-compact" "search" "v2writable" "www_listing"
+    # fatal: Could not make /tmp/pi-search-9188-DGZM/a.git/branches/ writable by group
+    "search"
     # perl5.32.0-public-inbox> t/eml.t ...................... 1/? Cannot parse parameter '=?ISO-8859-1?Q?=20charset=3D=1BOF?=' at t/eml.t line 270.
     # perl5.32.0-public-inbox> #   Failed test 'got wide character by assuming utf-8'
     # perl5.32.0-public-inbox> #   at t/eml.t line 272.
@@ -67,6 +71,8 @@ let
     #   expected: anything else
     # waiting for child to reap grandchild...
     "spawn"
+    # Failed to connect to 127.0.0.1
+    "v2mirror"
   ];
 
   testConditions = with lib;
@@ -76,11 +82,11 @@ in
 
 buildPerlPackage rec {
   pname = "public-inbox";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchurl {
     url = "https://public-inbox.org/public-inbox.git/snapshot/public-inbox-${version}.tar.gz";
-    sha256 = "sha256-laJOOCk5NecIGWesv4D30cLGfijQHVkeo55eNqNKzew=";
+    sha256 = "sha256-ENnT2YK7rpODII9TqiEYSCp5mpWOnxskeSuAf8Ilqro=";
   };
 
   outputs = [ "out" "devdoc" "sa_config" ];
@@ -101,9 +107,13 @@ buildPerlPackage rec {
     EmailAddressXS
     highlight
     IOSocketSSL
+    #IOSocketSocks
     IPCRun
     Inline
     InlineC
+    MailIMAPClient
+    #NetNetrc
+    #NetNNTP
     ParseRecDescent
     Plack
     PlackMiddlewareReverseProxy
@@ -115,15 +125,17 @@ buildPerlPackage rec {
   ];
 
   doCheck = !stdenv.isDarwin;
-  checkInputs = [
-    MailIMAPClient
-    EmailMIME
+  nativeCheckInputs = [
     curl
     git
     openssl
     pkg-config
     sqlite
     xapian
+    EmailMIME
+    PlackTestExternalServer
+    TestSimple13
+    XMLTreePP
   ] ++ lib.optionals stdenv.isLinux [
     LinuxInotify2
   ];
@@ -137,13 +149,15 @@ buildPerlPackage rec {
   installTargets = [ "install" ];
   postInstall = ''
     for prog in $out/bin/*; do
-        wrapProgram $prog --prefix PATH : ${lib.makeBinPath [
-          git
-          /* for InlineC */
-          gnumake
-          stdenv.cc.cc
-          xapian
-        ]}
+        wrapProgram $prog \
+            --set NIX_CFLAGS_COMPILE_${stdenv.cc.suffixSalt} -I${lib.getDev libxcrypt}/include \
+            --prefix PATH : ${lib.makeBinPath [
+              git
+              xapian
+              /* for InlineC */
+              gnumake
+              stdenv.cc
+            ]}
     done
 
     mv sa_config $sa_config
diff --git a/nixpkgs/pkgs/servers/mail/pypolicyd-spf/default.nix b/nixpkgs/pkgs/servers/mail/pypolicyd-spf/default.nix
deleted file mode 100644
index cbc63ff535a1..000000000000
--- a/nixpkgs/pkgs/servers/mail/pypolicyd-spf/default.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-{ lib, buildPythonApplication, fetchurl, pyspf }:
-
-buildPythonApplication rec {
-  pname = "pypolicyd-spf";
-  majorVersion = "2.0";
-  version = "${majorVersion}.2";
-
-  src = fetchurl {
-    url = "https://launchpad.net/pypolicyd-spf/${majorVersion}/${version}/+download/${pname}-${version}.tar.gz";
-    sha256 = "1nm8y1jjgx6mxrbcxrbdnmkf8vglwp0wiw6jipzh641wb24gi76z";
-  };
-
-  propagatedBuildInputs = [ pyspf ];
-
-  preBuild = ''
-    substituteInPlace setup.py --replace "'/etc'" "'$out/etc'"
-  '';
-
-  meta = with lib; {
-    homepage = "https://launchpad.net/pypolicyd-spf/";
-    description = "Postfix policy engine for Sender Policy Framework (SPF) checking";
-    maintainers = with maintainers; [ abbradar ];
-    license = licenses.asl20;
-    platforms = platforms.all;
-  };
-}
diff --git a/nixpkgs/pkgs/servers/mail/rspamd/default.nix b/nixpkgs/pkgs/servers/mail/rspamd/default.nix
index 05d71c9bad32..971865331a1d 100644
--- a/nixpkgs/pkgs/servers/mail/rspamd/default.nix
+++ b/nixpkgs/pkgs/servers/mail/rspamd/default.nix
@@ -11,13 +11,13 @@ assert withHyperscan -> stdenv.isx86_64;
 
 stdenv.mkDerivation rec {
   pname = "rspamd";
-  version = "3.2";
+  version = "3.5";
 
   src = fetchFromGitHub {
     owner = "rspamd";
     repo = "rspamd";
     rev = version;
-    sha256 = "122d5m1nfxxz93bhsk8lm4dazvdknzphb0a1188m7bsa4iynbfv2";
+    hash = "sha256-3+ve5cPt4As6Hfvxw77waJgl2Imi9LpredFkYzTchbQ=";
   };
 
   hardeningEnable = [ "pie" ];
diff --git a/nixpkgs/pkgs/servers/mail/spf-engine/default.nix b/nixpkgs/pkgs/servers/mail/spf-engine/default.nix
new file mode 100644
index 000000000000..c90522edf041
--- /dev/null
+++ b/nixpkgs/pkgs/servers/mail/spf-engine/default.nix
@@ -0,0 +1,27 @@
+{ lib, buildPythonApplication, fetchurl, pyspf, dnspython, authres, pymilter }:
+
+buildPythonApplication rec {
+  pname = "spf-engine";
+  version = "3.0.4";
+  format = "flit";
+
+  src = fetchurl {
+    url = "https://launchpad.net/${pname}/${lib.versions.majorMinor version}/${version}/+download/${pname}-${version}.tar.gz";
+    sha256 = "sha256-Gcw7enNIb/TrZEYa0Z04ezHUmfMmc1J+aEH6FlXbhTo=";
+  };
+
+  propagatedBuildInputs = [ pyspf dnspython authres pymilter ];
+
+  pythonImportsCheck = [
+    "spf_engine"
+    "spf_engine.milter_spf"
+    "spf_engine.policyd_spf"
+  ];
+
+  meta = with lib; {
+    homepage = "https://launchpad.net/spf-engine/";
+    description = "Postfix policy engine for Sender Policy Framework (SPF) checking";
+    maintainers = with maintainers; [ abbradar ];
+    license = licenses.asl20;
+  };
+}
diff --git a/nixpkgs/pkgs/servers/mail/sympa/default.nix b/nixpkgs/pkgs/servers/mail/sympa/default.nix
index 196cd07ceff8..7e409934fad0 100644
--- a/nixpkgs/pkgs/servers/mail/sympa/default.nix
+++ b/nixpkgs/pkgs/servers/mail/sympa/default.nix
@@ -61,13 +61,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "sympa";
-  version = "6.2.68";
+  version = "6.2.70";
 
   src = fetchFromGitHub {
     owner = "sympa-community";
     repo = pname;
     rev = version;
-    sha256 = "sha256-biTF2We9/ZBFBNpltyJonAe5tpXz+eNam+Bu6esJPiY=";
+    sha256 = "sha256-/gaJ17IwB6ZC7OT9gxA5uUhTAHXeqsEh/x4AzAARups=";
   };
 
   configureFlags = [
diff --git a/nixpkgs/pkgs/servers/mail/vsmtp/default.nix b/nixpkgs/pkgs/servers/mail/vsmtp/default.nix
new file mode 100644
index 000000000000..a6fc770cf5e0
--- /dev/null
+++ b/nixpkgs/pkgs/servers/mail/vsmtp/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, installShellFiles
+, testers
+, vsmtp
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "vsmtp";
+  version = "2.2.1";
+
+  src = fetchFromGitHub {
+    owner = "viridIT";
+    repo = "vsmtp";
+    rev = "v${version}";
+    hash = "sha256-dRw5Q6bejaAJCnoR9j2wBU+L+p1pk1Tnxtm0WcRyOaY=";
+  };
+
+  cargoHash = "sha256-RYHn9kZZApgXWTExAHl9ZnCsuvqnnb67unmvd4Pnwz0=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  buildFeatures = [
+    "telemetry"
+    "journald"
+    "syslog"
+  ];
+
+  # tests do not run well in the nix sandbox
+  doCheck = false;
+
+  postInstall = ''
+    installManPage tools/install/man/*.1
+  '';
+
+  passthru = {
+    tests.version = testers.testVersion { package = vsmtp; version = "v${version}"; };
+  };
+
+  meta = with lib; {
+    description = "A next-gen mail transfer agent (MTA) written in Rust";
+    homepage = "https://viridit.com";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ nickcao ];
+  };
+}