Added ubuntu-font-family

…-group

dont hardcode apache group name when setting permissions for state dir

Make urxvt work on OS X.

Semi-automatic update generated by https://github.com/ryantm/nixpkgs-update tools.

This update was made based on information from https://repology.org/metapackage/clingo/versions.

Version release notes (from GitHub):
# Packages

- The easiest way to obtain Python enabled clingo packages is using [Anaconda][ana]. Packages are available in the [Potassco channel][pch]. First [install either Anaconda or Miniconda][ins] and then run: `conda install -c potassco clingo`.
- Packages for clingo are available in the Linux distributions [Debian][deb], [Ubuntu][ubu], and [Arch Linux (AUR)][aur].
- For Mac OS X, clingo packages are available in [homebrew][hbr] and [macports][mac].

# Changes

* change C API to use numeric instead of symbolic literals
  * affects assumptions and assigning/releasing externals (breaks backward compatibility)
  * added overloads to C++, python and lua API to support both numeric and symbolic version (preserves backward compatibility for most code)
* the python, C and C++ APIs now allow for customizing clingo by implementing a custom main function but reusing the rest of the application including the standard output
* add API function to detect conflicting programs
* add message logger to python and lua interface
* add support for primes in the beginning of identifiers and variable names
* add per solver registration of watches during propagator initialization
* add a directive to selectivel suppress undefined atom warnings
* add support for user defined statistics
* add _to_c functions for python API to be able to call C functions from python
* only create ground representations for requested program parts when grounding (NixOS#71)
* improve program observer (NixOS#19)
* support for binary, octal, and hexadecimal numbers (NixOS#65)
* the backend has to be opened/closed now
* release python's GIL while grounding (NixOS#82)
* TruthValue.{True,False} becomes TruthValue.{\_True,\_False} in python API
* improve API and it's documentation

[deb]: https://www.debian.org/
[ubu]: https://www.ubuntu.com/
[aur]: https://aur.archlinux.org/
[hbr]: https://brew.sh/
[mac]: https://www.macports.org/
[ana]: https://conda.io
[pch]: https://anaconda.org/potassco/clingo
[ins]: https://conda.io/docs/user-guide/install/index.html

These checks were done:

- built on NixOS
- /nix/store/484fg7w1fr5xh2avc4g7811mxq3v3p9x-clingo-5.3.0/bin/lpconvert passed the binary check.
- /nix/store/484fg7w1fr5xh2avc4g7811mxq3v3p9x-clingo-5.3.0/bin/clasp passed the binary check.
- /nix/store/484fg7w1fr5xh2avc4g7811mxq3v3p9x-clingo-5.3.0/bin/reify passed the binary check.
- /nix/store/484fg7w1fr5xh2avc4g7811mxq3v3p9x-clingo-5.3.0/bin/gringo passed the binary check.
- /nix/store/484fg7w1fr5xh2avc4g7811mxq3v3p9x-clingo-5.3.0/bin/clingo passed the binary check.
- 5 of 5 passed binary check by having a zero exit code.
- 0 of 5 passed binary check by having the new version present in output.
- found 5.3.0 with grep in /nix/store/484fg7w1fr5xh2avc4g7811mxq3v3p9x-clingo-5.3.0
- directory tree listing: https://gist.github.com/bba2eaf1d132fbdd88a2710a6030c419
- du listing: https://gist.github.com/230340bfa02557290a60cfc6d2e7e977

Apple MacBook Pro 10,1 + misc fixes

Nitpick README.md

fluent-bit 3.2.7, 3.2.8 and 3.2.9 are segfaulting when
used in combination with the systemd input. Lets
revert to 3.2.6 for now.

Upstream bug: fluent/fluent-bit#10139

Note that fluent-bit-3.2.7 fixes two high CVEs which we are now
reintroducing. However they are only exploitable if you are
using the OpenTelemetry input or the Prometheus Remote Write input.

OpenTelemetry input: [CVE-2024-50609](https://nvd.nist.gov/vuln/detail/CVE-2024-50609)
Prometheus Remote Write input: [CVE-2024-50608](https://nvd.nist.gov/vuln/detail/CVE-2024-50608)

The problem is as follows:

3.2.7 started vendoring a copy of `libzstd` in tree and statically
linking against it. Also, the fluent-bit binary exports the symbols
of static libraries it links against.

This is a problem because `libzstd` gets `dlopen()`ed by `libsystemd`
when enumerating the journal (as journal logs are zstd compressed). and `libzstd` in Nixpkgs is built
with `-DZSTD_LEGACY_SUPPORT=0` which causes `struct ZSTD_DCtx` to be 16
bytes smaller than without this flag https://github.com/facebook/zstd/blob/dev/lib/decompress/zstd_decompress_internal.h#L183-L187

`libsystemd` calls [`sym_ZSTD_createDCtx()`](https://github.com/systemd/systemd/blob/1e79a2923364b65fc9f347884dd5b9b2087f6e32/src/basic/compress.c#L480)
which calls the function pointer returned by `dlsym()` which is calling into
the `libzstd` that comes with `nixpkgs` and thus allocates a struct that is 16 bytes smaller.

Later then `sym_ZSTD_freeDCtx()` is called. However because fluent-bit
has `zstd` in its global symbol table, any functions that `sym_ZSTD_freeDCtx()`
calls will be calls to the functions in the vendored fluent-bit version of the library
which expects the larger struct. This then causes enough heap corruption to cause
a segfault.

E.g. the subsequent calls to `ZSTD_clearDict(dctx)` and `ZSTD_customFree(dctx->inBuff)`
in https://github.com/facebook/zstd/blob/dev/lib/decompress/zstd_decompress.c#L324
will be working on a struct that is 16 bytes smaller than the one that was allocated
by `libsystemd` and will cause a segfault at some point and thus are probably modifying
pieces of memory that they shouldn't

	(gdb) bt
	#0  0x00007f10e7e9916c in __pthread_kill_implementation () from /nix/store/rmy663w9p7xb202rcln4jjzmvivznmz8-glibc-2.40-66/lib/libc.so.6
	#1  0x00007f10e7e40e86 in raise () from /nix/store/rmy663w9p7xb202rcln4jjzmvivznmz8-glibc-2.40-66/lib/libc.so.6
	#2  0x00007f10e7e2893a in abort () from /nix/store/rmy663w9p7xb202rcln4jjzmvivznmz8-glibc-2.40-66/lib/libc.so.6
	#3  0x000000000046a938 in flb_signal_handler ()
	#4  <signal handler called>
	#5  0x00007f10e7ea42b7 in unlink_chunk.isra () from /nix/store/rmy663w9p7xb202rcln4jjzmvivznmz8-glibc-2.40-66/lib/libc.so.6
	#6  0x00007f10e7ea45cd in _int_free_create_chunk () from /nix/store/rmy663w9p7xb202rcln4jjzmvivznmz8-glibc-2.40-66/lib/libc.so.6
	#7  0x00007f10e7ea5a1c in _int_free_merge_chunk () from /nix/store/rmy663w9p7xb202rcln4jjzmvivznmz8-glibc-2.40-66/lib/libc.so.6
	#8  0x00007f10e7ea5dc9 in _int_free () from /nix/store/rmy663w9p7xb202rcln4jjzmvivznmz8-glibc-2.40-66/lib/libc.so.6
	#9  0x00007f10e7ea8613 in free () from /nix/store/rmy663w9p7xb202rcln4jjzmvivznmz8-glibc-2.40-66/lib/libc.so.6
	#10 0x00007f10e80ad3b5 in ZSTD_freeDCtx () from /nix/store/wy0slah6yvchgra8nhp6vgrqa6ay72cq-zstd-1.5.6/lib/libzstd.so.1
	#11 0x00007f10e8c90f6b in decompress_blob_zstd () from /nix/store/b2cfj7yk3wfg1jdwjzim7306hvsc5gnl-systemd-257.3/lib/libsystemd.so.0
	#12 0x00007f10e8bf0efe in journal_file_data_payload () from /nix/store/b2cfj7yk3wfg1jdwjzim7306hvsc5gnl-systemd-257.3/lib/libsystemd.so.0
	#13 0x00007f10e8c00f74 in sd_journal_enumerate_data () from /nix/store/b2cfj7yk3wfg1jdwjzim7306hvsc5gnl-systemd-257.3/lib/libsystemd.so.0
	#14 0x00000000004eae2f in in_systemd_collect ()
	#15 0x00000000004eb5a0 in in_systemd_collect_archive ()
	#16 0x000000000047aa18 in flb_input_collector_fd ()
	#17 0x0000000000495223 in flb_engine_start ()
	#18 0x000000000046f304 in flb_lib_worker ()
	#19 0x00007f10e7e972e3 in start_thread () from /nix/store/rmy663w9p7xb202rcln4jjzmvivznmz8-glibc-2.40-66/lib/libc.so.6
	#20 0x00007f10e7f1b2fc in __clone3 () from /nix/store/rmy663w9p7xb202rcln4jjzmvivznmz8-glibc-2.40-66/lib/libc.so.6

Reverts 7310ab3
Reverts 4fbc6cf

Use the default efi mount point `/boot`