Merge staging-next into staging

.version

@@ -1 +1 @@
-19.03
+19.09

doc/cross-compilation.xml

@@ -96,7 +96,7 @@
        compiler resulting from a single build can itself only produce binaries
        for a single platform. The task of specifying this single "target
        platform" is thus pushed to build time of the compiler. The root cause of
-       this that the compiler (which will be run on the host) and the standard
+       this is that the compiler (which will be run on the host) and the standard
        library/runtime (which will be run on the target) are built by a single
        build process.
       </para>

doc/functions/dockertools.xml

@@ -47,7 +47,7 @@ buildImage {
 
   contents = pkgs.redis; <co xml:id='ex-dockerTools-buildImage-6' />
   runAsRoot = '' <co xml:id='ex-dockerTools-buildImage-runAsRoot' />
-    #!${stdenv.shell}
+    #!${pkgs.runtimeShell}
     mkdir -p /data
   '';
 
@@ -544,7 +544,7 @@ buildImage {
   name = "shadow-basic";
 
   runAsRoot = ''
-    #!${stdenv.shell}
+    #!${pkgs.runtimeShell}
     ${shadowSetup}
     groupadd -r redis
     useradd -r -g redis redis

lib/systems/default.nix

@@ -24,6 +24,8 @@ rec {
       config = parse.tripleFromSystem final.parsed;
       # Just a guess, based on `system`
       platform = platforms.selectBySystem final.system;
+      # Determine whether we are compatible with the provided CPU
+      isCompatible = platform: parse.isCompatible final.parsed.cpu platform.parsed.cpu;
       # Derived meta-data
       libc =
         /**/ if final.isDarwin              then "libSystem"
@@ -99,13 +101,14 @@ rec {
         wine = (pkgs.winePackagesFor wine-name).minimal;
       in
         if final.parsed.kernel.name == pkgs.stdenv.hostPlatform.parsed.kernel.name &&
-           (final.parsed.cpu.name == pkgs.stdenv.hostPlatform.parsed.cpu.name ||
+           pkgs.stdenv.hostPlatform.isCompatible final
-            (final.isi686 && pkgs.stdenv.hostPlatform.isx86_64))
+        then "${pkgs.runtimeShell} -c"
-        then pkgs.runtimeShell
         else if final.isWindows
         then "${wine}/bin/${wine-name}"
         else if final.isLinux && pkgs.stdenv.hostPlatform.isLinux
         then "${qemu-user}/bin/qemu-${final.qemuArch}"
+        else if final.isWasm
+        then "${pkgs.v8}/bin/d8"
         else throw "Don't know how to run ${final.config} executables.";
 
     } // mapAttrs (n: v: v final.parsed) inspect.predicates

lib/systems/parse.nix

@@ -112,6 +112,66 @@ rec {
     avr      = { bits = 8; family = "avr"; };
   };
 
+  # Determine where two CPUs are compatible with each other. That is,
+  # can we run code built for system b on system a? For that to
+  # happen, then the set of all possible possible programs that system
+  # b accepts must be a subset of the set of all programs that system
+  # a accepts. This compatibility relation forms a category where each
+  # CPU is an object and each arrow from a to b represents
+  # compatibility. CPUs with multiple modes of Endianness are
+  # isomorphic while all CPUs are endomorphic because any program
+  # built for a CPU can run on that CPU.
+  isCompatible = a: b: with cpuTypes; lib.any lib.id [
+    # x86
+    (b == i386 && isCompatible a i486)
+    (b == i486 && isCompatible a i586)
+    (b == i586 && isCompatible a i686)
+    # NOTE: Not true in some cases. Like in WSL mode.
+    (b == i686 && isCompatible a x86_64)
+
+    # ARM
+    (b == arm && isCompatible a armv5tel)
+    (b == armv5tel && isCompatible a armv6m)
+    (b == armv6m && isCompatible a armv6l)
+    (b == armv6l && isCompatible a armv7a)
+    (b == armv7a && isCompatible a armv7r)
+    (b == armv7r && isCompatible a armv7m)
+    (b == armv7m && isCompatible a armv7l)
+    (b == armv7l && isCompatible a armv8a)
+    (b == armv8a && isCompatible a armv8r)
+    (b == armv8r && isCompatible a armv8m)
+    # NOTE: not always true! Some arm64 cpus don’t support arm32 mode.
+    (b == armv8m && isCompatible a aarch64)
+    (b == aarch64 && a == aarch64_be)
+    (b == aarch64_be && isCompatible a aarch64)
+
+    # PowerPC
+    (b == powerpc && isCompatible a powerpc64)
+    (b == powerpcle && isCompatible a powerpc)
+    (b == powerpc && a == powerpcle)
+    (b == powerpc64le && isCompatible a powerpc64)
+    (b == powerpc64 && a == powerpc64le)
+
+    # MIPS
+    (b == mips && isCompatible a mips64)
+    (b == mips && a == mipsel)
+    (b == mipsel && isCompatible a mips)
+    (b == mips64 && a == mips64el)
+    (b == mips64el && isCompatible a mips64)
+
+    # RISCV
+    (b == riscv32 && isCompatible a riscv64)
+
+    # SPARC
+    (b == sparc && isCompatible a sparc64)
+
+    # WASM
+    (b == wasm32 && isCompatible a wasm64)
+
+    # identity
+    (b == a)
+  ];
+
   ################################################################################
 
   types.openVendor = mkOptionType {

lib/trivial.nix

@@ -134,7 +134,7 @@ rec {
      On each release the first letter is bumped and a new animal is chosen
      starting with that new letter.
   */
-  codeName = "Koi";
+  codeName = "Loris";
 
   /* Returns the current nixpkgs version suffix as string. */
   versionSuffix =

maintainers/maintainer-list.nix

@@ -1628,6 +1628,10 @@
     email = "fpletz@fnordicwalking.de";
     github = "fpletz";
     name = "Franz Pletz";
+    keys = [{
+      longkeyid = "rsa4096/0x846FDED7792617B4";
+      fingerprint = "8A39 615D CE78 AF08 2E23  F303 846F DED7 7926 17B4";
+    }];
   };
   fps = {
     email = "mista.tapas@gmx.net";
@@ -2294,6 +2298,11 @@
   joko = {
     email = "ioannis.koutras@gmail.com";
     github = "jokogr";
+    keys = [{
+      # compare with https://keybase.io/joko
+      longkeyid = "rsa2048/0x85EAE7D9DF56C5CA";
+      fingerprint = "B154 A8F9 0610 DB45 0CA8  CF39 85EA E7D9 DF56 C5CA";
+    }];
     name = "Ioannis Koutras";
   };
   jonafato = {
@@ -4356,6 +4365,15 @@
     github = "solson";
     name = "Scott Olson";
   };
+  sondr3 = {
+    email = "nilsen.sondre@gmail.com";
+    github = "sondr3";
+    name = "Sondre Nilsen";
+    keys = [{
+      longkeyid = "ed25519/0x25676BCBFFAD76B1";
+      fingerprint = "0EC3 FA89 EFBA B421 F82E  40B0 2567 6BCB FFAD 76B1";
+    }];
+  };
   sorki = {
     email = "srk@48.io";
     github = "sorki";
@@ -5055,7 +5073,7 @@
     name = "Kranium Gikos Mendoza";
   };
   worldofpeace = {
-    email = "worldofpeace@users.noreply.github.com";
+    email = "worldofpeace@protonmail.ch";
     github = "worldofpeace";
     name = "Worldofpeace";
   };
@@ -5268,4 +5286,9 @@
     github = "shmish111";
     name = "David Smith";
   };
+  minijackson = {
+    email = "minijackson@riseup.net";
+    github = "minijackson";
+    name = "Rémi Nicole";
+  };
 }

maintainers/scripts/update-luarocks-packages

@@ -61,7 +61,7 @@ nixpkgs$ ${0} ${GENERATED_NIXFILE}
 
 These packages are manually refined in lua-overrides.nix
 */
-{ self, lua, stdenv, fetchurl, fetchgit, pkgs, ... } @ args:
+{ self, stdenv, fetchurl, fetchgit, pkgs, ... } @ args:
 self: super:
 with self;
 {

nixos/doc/manual/development/releases.xml

@@ -60,13 +60,6 @@
       Make sure a channel is created at http://nixos.org/channels/. </link>
      </para>
     </listitem>
-    <listitem>
-     <para>
-      <link xlink:href="https://github.com/NixOS/nixpkgs/settings/branches">
-      Let a GitHub nixpkgs admin lock the branch on github for you. (so
-      developers can’t force push) </link>
-     </para>
-    </listitem>
     <listitem>
      <para>
       <link xlink:href="https://github.com/NixOS/nixpkgs/compare/bdf161ed8d21...6b63c4616790">

nixos/doc/manual/release-notes/release-notes.xml

@@ -8,6 +8,7 @@
   This section lists the release notes for each stable version of NixOS and
   current unstable revision.
  </para>
+ <xi:include href="rl-1909.xml" />
  <xi:include href="rl-1903.xml" />
  <xi:include href="rl-1809.xml" />
  <xi:include href="rl-1803.xml" />

nixos/doc/manual/release-notes/rl-1903.xml

@@ -106,6 +106,23 @@
     </para>
    </listitem>
   </itemizedlist>
+
+  <itemizedlist>
+   <listitem>
+    <para>
+      <literal>./security/duosec.nix</literal>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <link xlink:href="https://duo.com/docs/duounix">PAM module for Duo
+     Security</link> has been enabled for use.  One can configure it using
+     the <option>security.duosec</option> options along with the
+     corresponding PAM option in
+     <option>security.pam.services.&lt;name?&gt;.duoSecurity.enable</option>.
+    </para>
+   </listitem>
+  </itemizedlist>
  </section>
 
  <section xmlns="http://docbook.org/ns/docbook"
@@ -563,20 +580,6 @@
       use <literal>nixos-rebuild boot; reboot</literal>.
      </para>
    </listitem>
-   <listitem>
-    <para>
-     Symlinks in <filename>/etc</filename> (except <filename>/etc/static</filename>)
-     are now relative instead of absolute. This makes possible to examine
-     NixOS container's <filename>/etc</filename> directory from host system
-     (previously it pointed to host <filename>/etc</filename> when viewed from host,
-     and to container <filename>/etc</filename> when viewed from container chroot).
-    </para>
-    <para>
-     This also makes <filename>/etc/os-release</filename> adhere to
-     <link xlink:href="https://www.freedesktop.org/software/systemd/man/os-release.html">the standard</link>
-     for NixOS containers.
-    </para>
-   </listitem>
    <listitem>
     <para>
       Flat volumes are now disabled by default in <literal>hardware.pulseaudio</literal>.

nixos/doc/manual/release-notes/rl-1909.xml

@@ -0,0 +1,58 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-19.09">
+ <title>Release 19.09 (“Loris”, 2019/09/??)</title>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-19.09-highlights">
+  <title>Highlights</title>
+
+  <para>
+   In addition to numerous new and upgraded packages, this release has the
+   following highlights:
+  </para>
+
+  <itemizedlist>
+   <listitem>
+    <para />
+   </listitem>
+  </itemizedlist>
+ </section>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-19.09-new-services">
+  <title>New Services</title>
+
+  <para>
+   The following new services were added since the last release:
+  </para>
+
+  <itemizedlist>
+   <listitem>
+    <para />
+   </listitem>
+  </itemizedlist>
+ </section>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-19.09-notable-changes">
+  <title>Other Notable Changes</title>
+
+  <itemizedlist>
+   <listitem>
+    <para />
+   </listitem>
+  </itemizedlist>
+ </section>
+</section>

nixos/modules/config/no-x-libs.nix

@@ -34,7 +34,7 @@ with lib;
       networkmanager-openvpn = super.networkmanager-openvpn.override { withGnome = false; };
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
       networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
-      pinentry = super.pinentry_ncurses;
+      pinentry = super.pinentry.override { gtk2 = null; qt = null; };
       gobject-introspection = super.gobject-introspection.override { x11Support = false; };
     }));
   };

nixos/modules/hardware/video/nvidia.nix

@@ -172,6 +172,11 @@ in
     environment.systemPackages = [ nvidia_x11.bin nvidia_x11.settings ]
       ++ lib.filter (p: p != null) [ nvidia_x11.persistenced ];
 
+    systemd.tmpfiles.rules = optional config.virtualisation.docker.enableNvidia
+        "L+ /run/nvidia-docker/bin - - - - ${nvidia_x11.bin}/origBin"
+      ++ optional (nvidia_x11.persistenced != null && config.virtualisation.docker.enableNvidia)
+        "L+ /run/nvidia-docker/extras/bin/nvidia-persistenced - - - - ${nvidia_x11.persistenced}/origBin/nvidia-persistenced";
+
     boot.extraModulePackages = [ nvidia_x11.bin ];
 
     # nvidia-uvm is required by CUDA applications.

nixos/modules/installer/tools/nixos-rebuild.sh

@@ -29,7 +29,7 @@ while [ "$#" -gt 0 ]; do
       --help)
         showSyntax
         ;;
-      switch|boot|test|build|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader)
+      switch|boot|test|build|edit|dry-build|dry-run|dry-activate|build-vm|build-vm-with-bootloader)
         if [ "$i" = dry-run ]; then i=dry-build; fi
         action="$i"
         ;;
@@ -227,6 +227,13 @@ if [ -z "$_NIXOS_REBUILD_REEXEC" -a -n "$canRun" -a -z "$fast" ]; then
     fi
 fi
 
+# Find configuration.nix and open editor instead of building.
+if [ "$action" = edit ]; then
+    NIXOS_CONFIG=${NIXOS_CONFIG:-$(nix-instantiate --find-file nixos-config)}
+    exec "${EDITOR:-nano}" "$NIXOS_CONFIG"
+    exit 1
+fi
+
 
 tmpDir=$(mktemp -t -d nixos-rebuild.XXXXXX)
 SSHOPTS="$NIX_SSHOPTS -o ControlMaster=auto -o ControlPath=$tmpDir/ssh-%n -o ControlPersist=60"

nixos/modules/programs/fish.nix

@@ -169,6 +169,59 @@ in
       end
     '';
 
+    programs.fish.interactiveShellInit = ''
+      # add completions generated by NixOS to $fish_complete_path
+      begin
+        # joins with null byte to acommodate all characters in paths, then respectively gets all paths before (exclusive) / after (inclusive) the first one including "generated_completions",
+        # splits by null byte, and then removes all empty lines produced by using 'string'
+        set -l prev (string join0 $fish_complete_path | string match --regex "^.*?(?=\x00[^\x00]*generated_completions.*)" | string split0 | string match -er ".")
+        set -l post (string join0 $fish_complete_path | string match --regex "[^\x00]*generated_completions.*" | string split0 | string match -er ".")
+        set fish_complete_path $prev "/etc/fish/generated_completions" $post
+      end
+    '';
+
+    environment.etc."fish/generated_completions".source =
+      let
+        patchedGenerator = pkgs.stdenv.mkDerivation {
+          name = "fish_patched-completion-generator";
+          srcs = [
+            "${pkgs.fish}/share/fish/tools/create_manpage_completions.py"
+            "${pkgs.fish}/share/fish/tools/deroff.py"
+          ];
+          unpackCmd = "cp $curSrc $(basename $curSrc)";
+          sourceRoot = ".";
+          patches = [ ./fish_completion-generator.patch ]; # to prevent collisions of identical completion files
+          dontBuild = true;
+          installPhase = ''
+            mkdir -p $out
+            cp * $out/
+          '';
+          preferLocalBuild = true;
+          allowSubstitutes = false;
+        };
+        generateCompletions = package: pkgs.runCommand
+          "${package.name}_fish-completions"
+          (
+            {
+              inherit package;
+              preferLocalBuild = true;
+              allowSubstitutes = false;
+            }
+            // optionalAttrs (package ? meta.priority) { meta.priority = package.meta.priority; }
+          )
+          ''
+            mkdir -p $out
+            if [ -d $package/share/man ]; then
+              find $package/share/man -type f | xargs ${pkgs.python3.interpreter} ${patchedGenerator}/create_manpage_completions.py --directory $out >/dev/null
+            fi
+          '';
+      in
+        pkgs.buildEnv {
+          name = "system_fish-completions";
+          ignoreCollisions = true;
+          paths = map generateCompletions config.environment.systemPackages;
+        };
+
     # include programs that bring their own completions
     environment.pathsToLink = []
       ++ optional cfg.vendor.config.enable "/share/fish/vendor_conf.d"

nixos/modules/programs/fish_completion-generator.patch

@@ -0,0 +1,11 @@
+--- a/create_manpage_completions.py
++++ b/create_manpage_completions.py
+@@ -776,8 +776,6 @@ def parse_manpage_at_path(manpage_path, output_directory):
+
+             built_command_output.insert(0, "# " + CMDNAME)
+
+-            # Output the magic word Autogenerated so we can tell if we can overwrite this
+-            built_command_output.insert(1, "# Autogenerated from man page " + manpage_path)
+             # built_command_output.insert(2, "# using " + parser.__class__.__name__) # XXX MISATTRIBUTES THE CULPABILE PARSER! Was really using Type2 but reporting TypeDeroffManParser
+
+             for line in built_command_output:

nixos/modules/security/duosec.nix

@@ -7,7 +7,7 @@ let
 
   boolToStr = b: if b then "yes" else "no";
 
-  configFile = ''
+  configFilePam = ''
     [duo]
     ikey=${cfg.ikey}
     skey=${cfg.skey}
@@ -16,21 +16,24 @@ let
     failmode=${cfg.failmode}
     pushinfo=${boolToStr cfg.pushinfo}
     autopush=${boolToStr cfg.autopush}
-    motd=${boolToStr cfg.motd}
     prompts=${toString cfg.prompts}
-    accept_env_factor=${boolToStr cfg.acceptEnvFactor}
     fallback_local_ip=${boolToStr cfg.fallbackLocalIP}
   '';
 
+  configFileLogin = configFilePam + ''
+    motd=${boolToStr cfg.motd}
+    accept_env_factor=${boolToStr cfg.acceptEnvFactor}
+  '';
+
   loginCfgFile = optional cfg.ssh.enable
-    { source = pkgs.writeText "login_duo.conf" configFile;
+    { source = pkgs.writeText "login_duo.conf" configFileLogin;
       mode   = "0600";
       user   = "sshd";
       target = "duo/login_duo.conf";
     };
 
   pamCfgFile = optional cfg.pam.enable
-    { source = pkgs.writeText "pam_duo.conf" configFile;
+    { source = pkgs.writeText "pam_duo.conf" configFilePam;
       mode   = "0600";
       user   = "sshd";
       target = "duo/pam_duo.conf";
@@ -180,12 +183,6 @@ in
   };
 
   config = mkIf (cfg.ssh.enable || cfg.pam.enable) {
-    assertions =
-      [ { assertion = !cfg.pam.enable;
-          message   = "PAM support is currently not implemented.";
-        }
-      ];
-
      environment.systemPackages = [ pkgs.duo-unix ];
 
      security.wrappers.login_duo.source = "${pkgs.duo-unix.out}/bin/login_duo";

nixos/modules/security/pam.nix

@@ -131,6 +131,18 @@ let
         '';
       };
 
+      duoSecurity = {
+        enable = mkOption {
+          default = false;
+          type = types.bool;
+          description = ''
+            If set, use the Duo Security pam module
+            <literal>pam_duo</literal> for authentication.  Requires
+            configuration of <option>security.duosec</option> options.
+          '';
+        };
+      };
+
       startSession = mkOption {
         default = false;
         type = types.bool;
@@ -340,7 +352,8 @@ let
             || cfg.pamMount
             || cfg.enableKwallet
             || cfg.enableGnomeKeyring
-            || cfg.googleAuthenticator.enable)) ''
+            || cfg.googleAuthenticator.enable
+            || cfg.duoSecurity.enable)) ''
               auth required pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth
               ${optionalString config.security.pam.enableEcryptfs
                 "auth optional ${pkgs.ecryptfs}/lib/security/pam_ecryptfs.so unwrap"}
@@ -350,9 +363,11 @@ let
                 ("auth optional ${pkgs.plasma5.kwallet-pam}/lib/security/pam_kwallet5.so" +
                  " kwalletd=${pkgs.libsForQt5.kwallet.bin}/bin/kwalletd5")}
               ${optionalString cfg.enableGnomeKeyring
-                ("auth optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so")}
+                "auth optional ${pkgs.gnome3.gnome-keyring}/lib/security/pam_gnome_keyring.so"}
               ${optionalString cfg.googleAuthenticator.enable
                 "auth required ${pkgs.googleAuthenticator}/lib/security/pam_google_authenticator.so no_increment_hotp"}
+              ${optionalString cfg.duoSecurity.enable
+                "auth required ${pkgs.duo-unix}/lib/security/pam_duo.so"}
             '') + ''
           ${optionalString cfg.unixAuth
               "auth sufficient pam_unix.so ${optionalString cfg.allowNullPassword "nullok"} likeauth try_first_pass"}

nixos/modules/services/monitoring/datadog-agent.nix

@@ -202,7 +202,7 @@ in {
     };
   };
   config = mkIf cfg.enable {
-    environment.systemPackages = [ datadogPkg pkgs.sysstat pkgs.procps ];
+    environment.systemPackages = [ datadogPkg pkgs.sysstat pkgs.procps pkgs.iproute ];
 
     users.extraUsers.datadog = {
       description = "Datadog Agent User";
@@ -216,7 +216,7 @@ in {
 
     systemd.services = let
       makeService = attrs: recursiveUpdate {
-        path = [ datadogPkg pkgs.python pkgs.sysstat pkgs.procps ];
+        path = [ datadogPkg pkgs.python pkgs.sysstat pkgs.procps pkgs.iproute ];
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
           User = "datadog";

nixos/modules/services/monitoring/prometheus/alertmanager.nix

@@ -106,7 +106,8 @@ in {
         type = types.str;
         default = "";
         description = ''
-          Address to listen on for the web interface and API.
+          Address to listen on for the web interface and API. Empty string will listen on all interfaces.
+          "localhost" will listen on 127.0.0.1 (but not ::1).
         '';
       };
 

nixos/modules/services/network-filesystems/openafs/client.nix

@@ -155,7 +155,7 @@ in
         };
         programs = mkOption {
           default = getBin pkgs.openafs;
-          defaultText = "config.boot.kernelPackages.openafs";
+          defaultText = "getBin pkgs.openafs";
           type = types.package;
           description = "OpenAFS programs package. MUST match the kernel module package!";
         };

nixos/modules/services/networking/gnunet.nix

@@ -146,7 +146,7 @@ in
       wantedBy = [ "multi-user.target" ];
       path = [ cfg.package pkgs.miniupnpc ];
       environment.TMPDIR = "/tmp";
-      serviceConfig.PrivateTemp = true;
+      serviceConfig.PrivateTmp = true;
       serviceConfig.ExecStart = "${cfg.package}/lib/gnunet/libexec/gnunet-service-arm -c ${configFile}";
       serviceConfig.User = "gnunet";
       serviceConfig.UMask = "0007";

nixos/modules/services/networking/ssh/sshd.nix

@@ -400,7 +400,10 @@ in
         sockets.sshd =
           { description = "SSH Socket";
             wantedBy = [ "sockets.target" ];
-            socketConfig.ListenStream = cfg.ports;
+            socketConfig.ListenStream = if cfg.listenAddresses != [] then
+              map (l: "${l.addr}:${toString (if l.port != null then l.port else 22)}") cfg.listenAddresses
+            else
+              cfg.ports;
             socketConfig.Accept = true;
           };
 

nixos/modules/services/web-apps/nextcloud.nix

@@ -45,6 +45,11 @@ in {
       default = "/var/lib/nextcloud";
       description = "Storage path of nextcloud.";
     };
+    logLevel = mkOption {
+      type = types.ints.between 0 4;
+      default = 2;
+      description = "Log level value between 0 (DEBUG) and 4 (FATAL).";
+    };
     https = mkOption {
       type = types.bool;
       default = false;
@@ -281,6 +286,7 @@ in {
               'skeletondirectory' => '${cfg.skeletonDirectory}',
               ${optionalString cfg.caching.apcu "'memcache.local' => '\\OC\\Memcache\\APCu',"}
               'log_type' => 'syslog',
+              'log_level' => '${builtins.toString cfg.logLevel}',
             ];
           '';
           occInstallCmd = let

nixos/modules/services/web-servers/nginx/default.nix

@@ -44,7 +44,7 @@ let
     }
   ''));
 
-  awkFormat = pkgs.writeText "awkFormat-nginx.awk" ''
+  awkFormat = builtins.toFile "awkFormat-nginx.awk" ''
     awk -f
     {sub(/^[ \t]+/,"");idx=0}
     /\{/{ctx++;idx=1}
@@ -52,15 +52,9 @@ let
     {id="";for(i=idx;i<ctx;i++)id=sprintf("%s%s", id, "\t");printf "%s%s\n", id, $0}
   '';
 
-  configFile = pkgs.stdenv.mkDerivation {
+  configFile = pkgs.runCommand "nginx.conf" {} (''
-    name = "nginx-config";
+    awk -f ${awkFormat} ${pre-configFile} | sed '/^\s*$/d' > $out
-    src = "";
+  '');
-    phases = [ "installPhase" ];
-    installPhase = ''
-      mkdir $out
-      awk -f ${awkFormat} ${pre-configFile} | sed '/^\s*$/d' > $out/nginx.conf
-    '';
-  };
 
   pre-configFile = pkgs.writeText "pre-nginx.conf" ''
     user ${cfg.user} ${cfg.group};
@@ -656,10 +650,10 @@ in
       preStart =
         ''
         ${cfg.preStart}
-        ${cfg.package}/bin/nginx -c ${configFile}/nginx.conf -p ${cfg.stateDir} -t
+        ${cfg.package}/bin/nginx -c ${configFile} -p ${cfg.stateDir} -t
         '';
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/nginx -c ${configFile}/nginx.conf -p ${cfg.stateDir}";
+        ExecStart = "${cfg.package}/bin/nginx -c ${configFile} -p ${cfg.stateDir}";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         Restart = "always";
         RestartSec = "10s";

nixos/modules/services/x11/desktop-managers/mate.nix

@@ -98,10 +98,13 @@ in
     ];
 
     services.gnome3.gnome-keyring.enable = true;
+    services.gnome3.gvfs.enable = true;
     services.upower.enable = config.powerManagement.enable;
 
     security.pam.services."mate-screensaver".unixAuth = true;
 
+    environment.variables.GIO_EXTRA_MODULES = [ "${pkgs.gnome3.gvfs}/lib/gio/modules" ];
+
     environment.pathsToLink = [ "/share" ];
   };
 

nixos/modules/system/etc/make-etc.sh

@@ -10,11 +10,6 @@ users_=($users)
 groups_=($groups)
 set +f
 
-# Create relative symlinks, so that the links can be followed if
-# the NixOS installation is not mounted as filesystem root.
-# Absolute symlinks violate the os-release format
-# at https://www.freedesktop.org/software/systemd/man/os-release.html
-# and break e.g. systemd-nspawn and os-prober.
 for ((i = 0; i < ${#targets_[@]}; i++)); do
     source="${sources_[$i]}"
     target="${targets_[$i]}"
@@ -24,14 +19,14 @@ for ((i = 0; i < ${#targets_[@]}; i++)); do
         # If the source name contains '*', perform globbing.
         mkdir -p $out/etc/$target
         for fn in $source; do
-            ln -s --relative "$fn" $out/etc/$target/
+            ln -s "$fn" $out/etc/$target/
         done
 
     else
         
         mkdir -p $out/etc/$(dirname $target)
         if ! [ -e $out/etc/$target ]; then
-            ln -s --relative $source $out/etc/$target
+            ln -s $source $out/etc/$target
         else
             echo "duplicate entry $target -> $source"
             if test "$(readlink $out/etc/$target)" != "$source"; then

nixos/modules/system/etc/setup-etc.pl

@@ -4,7 +4,6 @@ use File::Copy;
 use File::Path;
 use File::Basename;
 use File::Slurp;
-use File::Spec;
 
 my $etc = $ARGV[0] or die;
 my $static = "/etc/static";
@@ -18,20 +17,6 @@ sub atomicSymlink {
     return 1;
 }
 
-# Create relative symlinks, so that the links can be followed if
-# the NixOS installation is not mounted as filesystem root.
-# Absolute symlinks violate the os-release format
-# at https://www.freedesktop.org/software/systemd/man/os-release.html
-# and break e.g. systemd-nspawn and os-prober.
-sub atomicRelativeSymlink {
-    my ($source, $target) = @_;
-    my $tmp = "$target.tmp";
-    unlink $tmp;
-    my $rel = File::Spec->abs2rel($source, dirname $target);
-    symlink $rel, $tmp or return 0;
-    rename $tmp, $target or return 0;
-    return 1;
-}
 
 # Atomically update /etc/static to point at the etc files of the
 # current configuration.
@@ -118,7 +103,7 @@ sub link {
     if (-e "$_.mode") {
         my $mode = read_file("$_.mode"); chomp $mode;
         if ($mode eq "direct-symlink") {
-            atomicRelativeSymlink readlink("$static/$fn"), $target or warn;
+            atomicSymlink readlink("$static/$fn"), $target or warn;
         } else {
             my $uid = read_file("$_.uid"); chomp $uid;
             my $gid = read_file("$_.gid"); chomp $gid;
@@ -132,7 +117,7 @@ sub link {
         push @copied, $fn;
         print CLEAN "$fn\n";
     } elsif (-l "$_") {
-        atomicRelativeSymlink "$static/$fn", $target or warn;
+        atomicSymlink "$static/$fn", $target or warn;
     }
 }
 

nixos/modules/virtualisation/docker.nix

@@ -52,6 +52,15 @@ in
           '';
       };
 
+    enableNvidia =
+      mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable nvidia-docker wrapper, supporting NVIDIA GPUs inside docker containers.
+        '';
+      };
+
     liveRestore =
       mkOption {
         type = types.bool;
@@ -140,7 +149,8 @@ in
   ###### implementation
 
   config = mkIf cfg.enable (mkMerge [{
-      environment.systemPackages = [ cfg.package ];
+      environment.systemPackages = [ cfg.package ]
+        ++ optional cfg.enableNvidia pkgs.nvidia-docker;
       users.groups.docker.gid = config.ids.gids.docker;
       systemd.packages = [ cfg.package ];
 
@@ -157,6 +167,7 @@ in
                 --log-driver=${cfg.logDriver} \
                 ${optionalString (cfg.storageDriver != null) "--storage-driver=${cfg.storageDriver}"} \
                 ${optionalString cfg.liveRestore "--live-restore" } \
+                ${optionalString cfg.enableNvidia "--add-runtime nvidia=${pkgs.nvidia-docker}/bin/nvidia-container-runtime" } \
                 ${cfg.extraOptions}
             ''];
           ExecReload=[
@@ -165,7 +176,8 @@ in
           ];
         };
 
-        path = [ pkgs.kmod ] ++ (optional (cfg.storageDriver == "zfs") pkgs.zfs);
+        path = [ pkgs.kmod ] ++ optional (cfg.storageDriver == "zfs") pkgs.zfs
+          ++ optional cfg.enableNvidia pkgs.nvidia-docker;
       };
 
       systemd.sockets.docker = {
@@ -179,7 +191,6 @@ in
         };
       };
 
-
       systemd.services.docker-prune = {
         description = "Prune docker resources";
 
@@ -194,7 +205,15 @@ in
 
         startAt = optional cfg.autoPrune.enable cfg.autoPrune.dates;
       };
+
+      assertions = [
+        { assertion = cfg.enableNvidia -> config.hardware.opengl.driSupport32Bit or false;
+          message = "Option enableNvidia requires 32bit support libraries";
+        }];
     }
+    (mkIf cfg.enableNvidia {
+      environment.etc."nvidia-container-runtime/config.toml".source = "${pkgs.nvidia-docker}/etc/config.toml";
+    })
   ]);
 
   imports = [

nixos/tests/all-tests.nix

@@ -74,6 +74,7 @@ in
   ferm = handleTest ./ferm.nix {};
   firefox = handleTest ./firefox.nix {};
   firewall = handleTest ./firewall.nix {};
+  fish = handleTest ./fish.nix {};
   flannel = handleTestOn ["x86_64-linux"] ./flannel.nix {};
   flatpak = handleTest ./flatpak.nix {};
   fsck = handleTest ./fsck.nix {};

nixos/tests/fish.nix

@@ -0,0 +1,21 @@
+import ./make-test.nix ({ pkgs, ... }: {
+  name = "fish";
+
+  machine =
+    { pkgs, ... }:
+
+    {
+      programs.fish.enable = true;
+      environment.systemPackages = with pkgs; [
+        coreutils
+        procps # kill collides with coreutils' to test https://github.com/NixOS/nixpkgs/issues/56432
+      ];
+    };
+
+  testScript =
+    ''
+      $machine->waitForFile("/etc/fish/generated_completions/coreutils.fish");
+      $machine->waitForFile("/etc/fish/generated_completions/kill.fish");
+      $machine->succeed("fish -ic 'echo \$fish_complete_path' | grep -q '/share/fish/completions /etc/fish/generated_completions /root/.local/share/fish/generated_completions\$'");
+    '';
+})

nixos/tests/gitea.nix

@@ -45,7 +45,7 @@ with pkgs.lib;
       {
         services.gitea.enable = true;
         services.gitea.database.type = "postgres";
-        services.gitea.database.password = "secret";
+        services.gitea.database.passwordFile = pkgs.writeText "db-password" "secret";
       };
 
     testScript = ''

nixos/tests/ndppd.nix

@@ -37,8 +37,7 @@ import ./make-test.nix ({ pkgs, lib, ...} : {
       };
       services.ndppd = {
         enable = true;
-        interface = "eth1";
+        proxies."eth1".rules."fd42::/112" = {};
-        network = "fd42::/112";
       };
       containers.client = {
         autoStart = true;

nixos/tests/openssh.nix

@@ -34,6 +34,24 @@ in {
         ];
       };
 
+    server_localhost_only =
+      { ... }:
+
+      {
+        services.openssh = {
+          enable = true; listenAddresses = [ { addr = "127.0.0.1"; port = 22; } ];
+        };
+      };
+
+    server_localhost_only_lazy =
+      { ... }:
+
+      {
+        services.openssh = {
+          enable = true; startWhenNeeded = true; listenAddresses = [ { addr = "127.0.0.1"; port = 22; } ];
+        };
+      };
+
     client =
       { ... }: { };
 
@@ -77,5 +95,10 @@ in {
                        " server_lazy true");
 
     };
+
+    subtest "localhost-only", sub {
+      $server_localhost_only->succeed("ss -nlt | grep '127.0.0.1:22'");
+      $server_localhost_only_lazy->succeed("ss -nlt | grep '127.0.0.1:22'");
+    }
   '';
 })

nixos/tests/rspamd.nix

@@ -52,8 +52,18 @@ in
     machine = {
       services.rspamd = {
         enable = true;
-        bindSocket = [ "/run/rspamd.sock mode=0600 user=root group=root" ];
+        workers.normal.bindSockets = [{
-        bindUISocket = [ "/run/rspamd-worker.sock mode=0666 user=root group=root" ];
+          socket = "/run/rspamd.sock";
+          mode = "0600";
+          owner = "root";
+          group = "root";
+        }];
+        workers.controller.bindSockets = [{
+          socket = "/run/rspamd-worker.sock";
+          mode = "0666";
+          owner = "root";
+          group = "root";
+        }];
       };
     };
 
@@ -235,7 +245,7 @@ in
       services.rspamd = {
         enable = true;
         postfix.enable = true;
-        workers.rspamd_proxy.type = "proxy";
+        workers.rspamd_proxy.type = "rspamd_proxy";
       };
     };
     testScript = ''

pkgs/applications/altcoins/parity/beta.nix

@@ -1,6 +1,6 @@
 let
-  version     = "2.3.1";
+  version     = "2.3.2";
-  sha256      = "13y3gczqb0rb6v17j63j1zp11cnykbv9c674hrk1i6jb3y4am4lv";
+  sha256      = "1063n7lkcfkywi0a06pxkw0wkq3qyq4lr53fv584mlbnh2hj8gpm";
   cargoSha256 = "1pj5hzy7k1l9bbw1qpz80vvk89qz4qz4rnnkcvn2rkbmq382gxwy";
 in
   import ./parity.nix { inherit version sha256 cargoSha256; }

pkgs/applications/altcoins/parity/default.nix

@@ -1,6 +1,6 @@
 let
-  version     = "2.2.8";
+  version     = "2.2.9";
-  sha256      = "1l2bxra4fkbh8gnph9wnc24ddmzfdclsgcjbx8q6fflhcg6r9hf1";
+  sha256      = "0n9zk25ni4asfdqc4xh0gqp2446vxacqz7qcrmsngf8swvayvi16";
   cargoSha256 = "10lg0vzikzlj927hpn59x1dz9dvhcaqsl8nz14vj2iz42vfkcm7p";
 in
   import ./parity.nix { inherit version sha256 cargoSha256; }

pkgs/applications/audio/lollypop/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchgit, meson, ninja, pkgconfig
 , python3, gtk3, gst_all_1, libsecret, libsoup
 , appstream-glib, desktop-file-utils, totem-pl-parser
-, gobject-introspection, wrapGAppsHook }:
+, hicolor-icon-theme, gobject-introspection, wrapGAppsHook }:
 
 python3.pkgs.buildPythonApplication rec  {
   pname = "lollypop";
-  version = "0.9.921";
+  version = "0.9.923";
 
   format = "other";
   doCheck = false;
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec  {
     url = "https://gitlab.gnome.org/World/lollypop";
     rev = "refs/tags/${version}";
     fetchSubmodules = true;
-    sha256 = "0a79qnci93yicd58r6kr6yinpqz67s39h0xk5qkzlsplpbawvf3y";
+    sha256 = "0jgz36lrhigcsr9vs5sp4ngv8rir3zqicygymjv7d61d6pclkx1z";
   };
 
   nativeBuildInputs = [
@@ -36,6 +36,7 @@ python3.pkgs.buildPythonApplication rec  {
     gst-plugins-ugly
     gstreamer
     gtk3
+    hicolor-icon-theme
     libsecret
     libsoup
     totem-pl-parser

pkgs/applications/audio/qtractor/default.nix

@@ -1,21 +1,24 @@
-{ alsaLib, autoconf, automake, dssi, fetchurl, gtk2, libjack2
+{ alsaLib, autoconf, automake, dssi, fetchurl, libjack2
 , ladspaH, ladspaPlugins, liblo, libmad, libsamplerate, libsndfile
-, libtool, libvorbis, lilv, lv2, pkgconfig, qt4, rubberband, serd
+, libtool, libvorbis, lilv, lv2, pkgconfig, qttools, qtbase, rubberband, serd
 , sord, sratom, stdenv, suil }:
 
 stdenv.mkDerivation rec {
-  version = "0.6.7";
+  pname = "qtractor";
-  name = "qtractor-${version}";
+  version = "0.9.4";
 
   src = fetchurl {
-    url = "mirror://sourceforge/qtractor/${name}.tar.gz";
+    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "0h5nblfkl4s412c9f02b40nb8c8jq8ypz67z2qn3hkvhx6i9yxsg";
+    sha256 = "05xrzr48b19mghbpbzjqw5fy6pl9140bm5m929lrsi4rq5hp3xgg";
   };
 
+  nativeBuildInputs = [
+    autoconf automake libtool pkgconfig qttools
+  ];
   buildInputs =
-    [ alsaLib autoconf automake dssi gtk2 libjack2 ladspaH
+    [ alsaLib dssi libjack2 ladspaH
       ladspaPlugins liblo libmad libsamplerate libsndfile libtool
-      libvorbis lilv lv2 pkgconfig qt4 rubberband serd sord sratom
+      libvorbis lilv lv2 qtbase rubberband serd sord sratom
       suil
     ];
 

pkgs/applications/audio/spotifywm/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, spotify, xorg }:
+{ stdenv, fetchFromGitHub, spotify, xorg, runtimeShell }:
 stdenv.mkDerivation rec {
   name = "spotifywm-unstable-${version}";
   version = "2016-11-28";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ spotify ];
 
   installPhase = ''
-    echo "#!${stdenv.shell}" > spotifywm
+    echo "#!${runtimeShell}" > spotifywm
     echo "LD_PRELOAD="$out/lib/spotifywm.so" ${spotify}/bin/spotify \$*" >> spotifywm
     install -Dm644 spotifywm.so $out/lib/spotifywm.so
     install -Dm755 spotifywm $out/bin/spotifywm

pkgs/applications/editors/android-studio/default.nix

@@ -18,9 +18,9 @@ let
     sha256Hash = "0np8600qvqpw9kcmgp04i1nak1339ck1iidkzr75kigp5rgdl2bq";
   };
   latestVersion = { # canary & dev
-    version = "3.5.0.4"; # "Android Studio 3.5 Canary 5"
+    version = "3.5.0.5"; # "Android Studio 3.5 Canary 6"
-    build = "183.5320907";
+    build = "183.5326993";
-    sha256Hash = "1i56r58kcwrllx3a85dhsz9m0amb7xj9ybqfkdf1a8ipv1hdqs1g";
+    sha256Hash = "06d43qw0p6zpy6vmriiihql5vgc6c4darplc2148y616hx0whrql";
   };
 in rec {
   # Old alias (TODO @primeos: Remove after 19.03 is branched off):

pkgs/applications/editors/neovim/ruby_provider/Gemfile.lock

@@ -1,10 +1,10 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    msgpack (1.2.4)
+    msgpack (1.2.6)
     multi_json (1.13.1)
-    neovim (0.7.0)
+    neovim (0.8.0)
-      msgpack (~> 1.0)
+      msgpack (~> 1.1)
       multi_json (~> 1.0)
 
 PLATFORMS
@@ -14,4 +14,4 @@ DEPENDENCIES
   neovim
 
 BUNDLED WITH
-   1.14.6
+   1.17.2

pkgs/applications/editors/neovim/ruby_provider/gemset.nix

@@ -2,10 +2,10 @@
   msgpack = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09xy1wc4wfbd1jdrzgxwmqjzfdfxbz0cqdszq2gv6rmc3gv1c864";
+      sha256 = "0031gd2mjyba6jb7m97sqa149zjkr0vzn2s2gpb3m9nb67gqkm13";
       type = "gem";
     };
-    version = "1.2.4";
+    version = "1.2.6";
   };
   multi_json = {
     source = {
@@ -19,9 +19,9 @@
     dependencies = ["msgpack" "multi_json"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0b487dzz41im8cwzvfjqgf8kkrp6mpkvcbzhazrmqqw8gxyvfbq4";
+      sha256 = "07scrdfk7pyn5jgx5m2yajdqpbdv42833vbw568qqag6xp99j3yk";
       type = "gem";
     };
-    version = "0.7.0";
+    version = "0.8.0";
   };
 }

pkgs/applications/editors/standardnotes/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, appimage-run, fetchurl }:
+{ stdenv, appimage-run, fetchurl, runtimeShell }:
 
 let
   version = "3.0.6";
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/{bin,share}
     cp $src $out/share/standardNotes.AppImage
-    echo "#!${stdenv.shell}" > $out/bin/standardnotes
+    echo "#!${runtimeShell}" > $out/bin/standardnotes
     echo "${appimage-run}/bin/appimage-run $out/share/standardNotes.AppImage" >> $out/bin/standardnotes
     chmod +x $out/bin/standardnotes $out/share/standardNotes.AppImage
   '';

pkgs/applications/editors/sublime/3/common.nix

@@ -1,6 +1,6 @@
 {buildVersion, x32sha256, x64sha256}:
 
-{ fetchurl, stdenv, glib, xorg, cairo, gtk2, gtk3, pango, makeWrapper, wrapGAppsHook, openssl, bzip2,
+{ fetchurl, stdenv, glib, xorg, cairo, gtk2, gtk3, pango, makeWrapper, wrapGAppsHook, openssl, bzip2, runtimeShell,
   pkexecPath ? "/run/wrappers/bin/pkexec", libredirect,
   gksuSupport ? false, gksu, unzip, zip, bash}:
 
@@ -115,7 +115,7 @@ in stdenv.mkDerivation (rec {
     mkdir -p $out/bin
 
     cat > $out/bin/subl <<-EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
     exec $sublime/sublime_text "\$@"
     EOF
     chmod +x $out/bin/subl

pkgs/applications/editors/vim/configurable.nix

@@ -7,6 +7,7 @@
 , vimPlugins
 , makeWrapper
 , wrapGAppsHook
+, runtimeShell
 
 # apple frameworks
 , CoreServices, CoreData, Cocoa, Foundation, libobjc, cf-private
@@ -157,7 +158,7 @@ in stdenv.mkDerivation rec {
 
     rewrap () {
       rm -f "$out/bin/$1"
-      echo -e '#!${stdenv.shell}\n"'"$out/bin/vim"'" '"$2"' "$@"' > "$out/bin/$1"
+      echo -e '#!${runtimeShell}\n"'"$out/bin/vim"'" '"$2"' "$@"' > "$out/bin/$1"
       chmod a+x "$out/bin/$1"
     }
 

pkgs/applications/graphics/alchemy/default.nix

@@ -1,4 +1,4 @@
-{stdenv, fetchurl, jre}:
+{ stdenv, fetchurl, jre, runtimeShell }:
 
 stdenv.mkDerivation rec {
   name = "alchemy-${version}";
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin $out/share
     cp -a . $out/share/alchemy
     cat >> $out/bin/alchemy << EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
     cd $out/share/alchemy
     ${jre}/bin/java -jar Alchemy.jar "$@"
     EOF

pkgs/applications/graphics/autotrace/default.nix

@@ -1,5 +1,6 @@
-{ stdenv, fetchurl, callPackage, libpng12, imagemagick,
+{ stdenv, fetchurl, callPackage, libpng12, imagemagick
-  autoreconfHook, glib, pstoedit, pkgconfig, gettext, gd, darwin }:
+, autoreconfHook, glib, pstoedit, pkgconfig, gettext, gd, darwin
+, runtimeShell }:
 
 # TODO: Figure out why the resultant binary is somehow linked against
 # libpng16.so.16 rather than libpng12.
@@ -51,7 +52,7 @@ stdenv.mkDerivation rec {
     # pstoedit-config no longer exists, it was replaced with pkg-config
     mkdir wrappers
     cat >wrappers/pstoedit-config <<'EOF'
-    #!${stdenv.shell}
+    #!${runtimeShell}
     # replace --version with --modversion for pkg-config
     args=''${@/--version/--modversion}
     exec pkg-config pstoedit "''${args[@]}"

pkgs/applications/graphics/swingsane/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeDesktopItem, unzip, jre }:
+{ stdenv, fetchurl, makeDesktopItem, unzip, jre, runtimeShell }:
 
 stdenv.mkDerivation rec {
   name = "swingsane-${version}";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   installPhase = let
 
     execWrapper = ''
-      #!${stdenv.shell}
+      #!${runtimeShell}
       exec ${jre}/bin/java -jar $out/share/java/swingsane/swingsane-${version}.jar "$@"
     '';
 

pkgs/applications/graphics/wings/default.nix

@@ -1,4 +1,4 @@
-{ fetchurl, stdenv, erlang, cl, libGL, libGLU }:
+{ fetchurl, stdenv, erlang, cl, libGL, libGLU, runtimeShell }:
 
 stdenv.mkDerivation rec {
   name = "wings-2.2.1";
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     cp ebin/* $out/lib/${name}/ebin
     cp -R textures shaders plugins $out/lib/$name
     cat << EOF > $out/bin/wings
-    #!${stdenv.shell}
+    #!${runtimeShell}
     ${erlang}/bin/erl \
       -pa $out/lib/${name}/ebin -run wings_start start_halt "$@"
     EOF
@@ -43,4 +43,3 @@ stdenv.mkDerivation rec {
     platforms = with stdenv.lib.platforms; linux;
   };
 }
-

pkgs/applications/graphics/zgrviewer/default.nix

@@ -1,4 +1,4 @@
-{stdenv, fetchurl, jre, unzip}:
+{ stdenv, fetchurl, jre, unzip, runtimeShell }:
 stdenv.mkDerivation rec {
   version = "0.9.0";
   pname = "zgrviewer";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
 
     cp -r target/* "$out/share/java/zvtm/"
 
-    echo '#!${stdenv.shell}' > "$out/bin/zgrviewer"
+    echo '#!${runtimeShell}' > "$out/bin/zgrviewer"
     echo "${jre}/lib/openjdk/jre/bin/java -jar '$out/share/java/zvtm/zgrviewer-${version}.jar' \"\$@\"" >> "$out/bin/zgrviewer"
     chmod a+x "$out/bin/zgrviewer"
   '';

pkgs/applications/misc/avrdudess/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, unzip, mono, avrdude, gtk2, xdg_utils }:
+{ stdenv, runtimeShell, fetchurl, unzip, mono, avrdude, gtk2, xdg_utils }:
 
 stdenv.mkDerivation rec {
   name = "avrdudess-2.2.20140102";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     unzip "$src" -d "$out/avrdudess"
 
     cat >> "$out/bin/avrdudess" << __EOF__
-    #!${stdenv.shell}
+    #!${runtimeShell}
     export LD_LIBRARY_PATH="${stdenv.lib.makeLibraryPath [gtk2 mono]}"
     # We need PATH from user env for xdg-open to find its tools, which
     # typically depend on the currently running desktop environment.

pkgs/applications/misc/curabydagoma/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchurl, python, pythonPackages, unzip }:
+{ stdenv, runtimeShell, lib, fetchurl, python, pythonPackages, unzip }:
 
 # This package uses a precompiled "binary" distribution of CuraByDagoma,
 # distributed by the editor.
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
 
     mkdir $out/bin
     cat > $out/bin/curabydago <<EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
     export PYTHONPATH=$PYTHONPATH
     ${python.out}/bin/python $out/curabydago/cura.py
     EOF

pkgs/applications/misc/gammu/default.nix

@@ -8,13 +8,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "gammu-${version}";
-  version = "1.39.0";
+  version = "1.40.0";
 
   src = fetchFromGitHub {
     owner = "gammu";
     repo = "gammu";
     rev = version;
-    sha256 = "1hr053z2l5mjgip83fsxnd1rqsp5gwywzagzrgdg243apn1nz0gs";
+    sha256 = "1jjaa9r3x6i8gv3yn1ngg815s6gsxblsw4wb5ddm77kamn2qyvpf";
   };
 
   patches = [ ./bashcomp-dir.patch ./systemd.patch ];

pkgs/applications/misc/gcalcli/default.nix

@@ -5,13 +5,13 @@ with python3.pkgs;
 
 buildPythonApplication rec {
   pname = "gcalcli";
-  version = "4.0.3";
+  version = "4.0.4";
 
   src = fetchFromGitHub {
     owner  = "insanum";
     repo   = pname;
     rev    = "v${version}";
-    sha256 = "15hpm7b09p5qnha0hpp0mgdl2pgsyq2sjcqihk3fsv7arngdbr5q";
+    sha256 = "0bl4cmc24iw12zn5mlj5qn141s2k2mzdixbcb92pfng4w2s4dq66";
   };
 
   postPatch = lib.optionalString stdenv.isLinux ''

pkgs/applications/misc/glava/default.nix

@@ -1,12 +1,12 @@
 { stdenv, writeScript, fetchFromGitHub
 , libGL, libX11, libXext, python3, libXrandr, libXrender, libpulseaudio, libXcomposite
-, enableGlfw ? false, glfw }:
+, enableGlfw ? false, glfw, runtimeShell }:
 
 let
   inherit (stdenv.lib) optional makeLibraryPath;
 
   wrapperScript = writeScript "glava" ''
-    #!${stdenv.shell}
+    #!${runtimeShell}
     case "$1" in
       --copy-config)
         # The binary would symlink it, which won't work in Nix because the

pkgs/applications/misc/hello-unfree/default.nix

@@ -1,4 +1,4 @@
-{ stdenv }:
+{ stdenv, runtimeShell }:
 
 stdenv.mkDerivation rec {
   name = "example-unfree-package-${version}";
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p $out/bin
     cat > $out/bin/hello-unfree << EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
     echo "Hello, you are running an unfree system!"
     EOF
     chmod +x $out/bin/hello-unfree

pkgs/applications/misc/jbidwatcher/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, java }:
+{ stdenv, fetchurl, java, runtimeShell }:
 
 stdenv.mkDerivation rec {
   pname = "jbidwatcher";
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     mkdir -p "$out/bin"
-    echo > "$out/bin/${pname}" "#!${stdenv.shell}"
+    echo > "$out/bin/${pname}" "#!${runtimeShell}"
     echo >>"$out/bin/${pname}" "${java}/bin/java -Xmx512m -jar ${jarfile}"
     chmod +x "$out/bin/${pname}"
     install -D -m644 ${src} ${jarfile}

pkgs/applications/misc/llpp/default.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, substituteAll, makeWrapper, fetchgit, ocaml, mupdf, libX11,
-libGLU_combined, freetype, xclip }:
+libGLU_combined, freetype, xclip, inotify-tools, procps }:
 
 assert lib.versionAtLeast (lib.getVersion ocaml) "4.07";
 
@@ -34,11 +34,17 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    install -d $out/bin $out/lib
+    install -d $out/bin
     install build/llpp $out/bin
+    install misc/llpp.inotify $out/bin/llpp.inotify
+
     wrapProgram $out/bin/llpp \
-        --prefix CAML_LD_LIBRARY_PATH ":" "$out/lib" \
         --prefix PATH ":" "${xclip}/bin"
+
+    wrapProgram $out/bin/llpp.inotify \
+        --prefix PATH ":" "$out/bin" \
+        --prefix PATH ":" "${inotify-tools}/bin" \
+        --prefix PATH ":" "${procps}/bin"
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/misc/multibootusb/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, python36Packages, fetchFromGitHub, libxcb, mtools, p7zip, parted, procps, utillinux, qt5 }:
+{ stdenv, python36Packages, fetchFromGitHub, libxcb, mtools, p7zip, parted, procps, utillinux, qt5, runtimeShell }:
 python36Packages.buildPythonApplication rec {
   pname = "multibootusb";
   name = "${pname}-${version}";
@@ -40,7 +40,7 @@ python36Packages.buildPythonApplication rec {
 
     mkdir "$out/bin"
     cat > "$out/bin/${pname}" <<EOF
-      #!${stdenv.shell}
+      #!${runtimeShell}
       cd "$share"
       export PYTHONPATH="$PYTHONPATH:$share"
       export PATH="$PATH:${parted}/bin:${procps}/bin"

pkgs/applications/misc/nix-tour/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchgit, electron } :
+{ stdenv, fetchgit, electron, runtimeShell } :
 
 stdenv.mkDerivation rec {
   name = "nix-tour-${version}";
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/share
     cp -R * $out/share
     chmod 0755 $out/share/ -R
-    echo "#!${stdenv.shell}" > $out/bin/nix-tour
+    echo "#!${runtimeShell}" > $out/bin/nix-tour
     echo "cd $out/share/" >> $out/bin/nix-tour
     echo "${electron}/bin/electron $out/share/electron-main.js" >> $out/bin/nix-tour
     chmod 0755 $out/bin/nix-tour

pkgs/applications/misc/nnn/default.nix

@@ -1,23 +1,23 @@
-{ stdenv, fetchFromGitHub, pkgconfig, ncurses, conf ? null }:
+{ stdenv, fetchFromGitHub, pkgconfig, ncurses, readline, conf ? null }:
 
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "nnn-${version}";
-  version = "2.2";
+  version = "2.3";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = "nnn";
     rev = "v${version}";
-    sha256 = "01y2vkw1wakpnpzhzia3d44iir060i8vma3b3ww5wgwg7bfpzs4b";
+    sha256 = "0953l4wa4dnsq9aj50anjrww64413dxv25xx3kjwnqz2ag7zdyy7";
   };
 
   configFile = optionalString (conf!=null) (builtins.toFile "nnn.h" conf);
   preBuild = optionalString (conf!=null) "cp ${configFile} nnn.h";
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ ncurses ];
+  buildInputs = [ readline ncurses ];
 
   makeFlags = [ "DESTDIR=${placeholder "out"}" "PREFIX=" ];
 

pkgs/applications/misc/openjump/default.nix

@@ -1,4 +1,4 @@
-{stdenv, fetchurl, unzip}:
+{ stdenv, fetchurl, unzip, runtimeShell }:
 
 stdenv.mkDerivation {
   name = "openjump-1.3.1";
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
     s=$out/bin/OpenJump
     dir=$(echo $out/openjump-*)
     cat >> $s << EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
     cd $dir/bin
     exec ${stdenv.shell} openjump.sh
     EOF

pkgs/applications/misc/playonlinux/default.nix

@@ -19,6 +19,7 @@
 , pkgsi686Linux
 , which
 , curl
+, jq
 }:
 
 let
@@ -41,6 +42,7 @@ let
       xterm
       which
       curl
+      jq
     ];
 
   ld32 =

pkgs/applications/misc/terminal-notifier/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchzip }:
+{ stdenv, runtimeShell, lib, fetchzip }:
 
 stdenv.mkDerivation rec {
   name = "terminal-notifier-${version}";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     mkdir -p $out/bin
     cp -r terminal-notifier.app $out/Applications
     cat >$out/bin/terminal-notifier <<EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
     cd $out/Applications/terminal-notifier.app
     exec ./Contents/MacOS/terminal-notifier "\$@"
     EOF

pkgs/applications/misc/thinking-rock/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl }:
+{ stdenv, fetchurl, runtimeShell }:
 
 stdenv.mkDerivation {
   name = "thinkingrock-binary-2.2.1";
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     mkdir -p $out/{nix-support/tr-files,bin}
     cp -r . $out/nix-support/tr-files
     cat >> $out/bin/thinkingrock << EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
     exec $out/nix-support/tr-files/bin/tr "$@"
     EOF
     chmod +x $out/bin/thinkingrock

pkgs/applications/misc/vifm/default.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "A vi-like file manager";
     maintainers = with maintainers; [ raskin garbas ];
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     license = licenses.gpl2;
     downloadPage = "https://vifm.info/downloads.shtml";
     homepage = https://vifm.info/;

pkgs/applications/misc/vue/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, jre }:
+{ stdenv, fetchurl, jre, runtimeShell }:
 
 stdenv.mkDerivation rec {
   name = "vue-${version}";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p "$out"/{share/vue,bin}
     cp ${src} "$out/share/vue/vue.jar"
-    echo '#!${stdenv.shell}' >> "$out/bin/vue"
+    echo '#!${runtimeShell}' >> "$out/bin/vue"
     echo '${jre}/bin/java -jar "'"$out/share/vue/vue.jar"'" "$@"' >> "$out/bin/vue"
     chmod a+x "$out/bin/vue"
   '';

pkgs/applications/misc/yokadi/default.nix

@@ -1,13 +1,13 @@
 { stdenv, fetchurl, buildPythonApplication, dateutil,
-  sqlalchemy, setproctitle, icalendar, pycrypto }:
+  sqlalchemy, setproctitle, icalendar }:
 
 buildPythonApplication rec {
   pname = "yokadi";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchurl {
-    url = "https://yokadi.github.io/download/${pname}-${version}.tar.bz2";
+    url = "https://yokadi.github.io/download/${pname}-${version}.tar.gz";
-    sha256 = "af201da66fd3a8435b2ccd932082ab9ff13f5f2e3d6cd3624f1ab81c577aaf17";
+    sha256 = "681c8aa52b2e4b5255e1311e76b4b81dcb63ee7f6ca3a47178e684c06baf330f";
   };
 
   propagatedBuildInputs = [
@@ -15,7 +15,6 @@ buildPythonApplication rec {
     sqlalchemy
     setproctitle
     icalendar
-    pycrypto
   ];
 
   # Yokadi doesn't have any tests

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "0gd426a9xcgs8a9286gavziysq6fw1ilaifsna396dbdm8b571wi";
+    sha256 = "1176qg1a5d5lgy80xsywkz4gq0khfj5hgxykci00j827pryfpajh";
-    sha256bin64 = "05p20l0969rppbyn7965k78ccynng47rg7d7h7piqiwnm6ffg9yx";
+    sha256bin64 = "1dqxm82nrabdfwn20j94vs9zgif1jhkqibpx7c1ihq90nw7p17qb";
-    version = "73.0.3683.39";
+    version = "73.0.3683.46";
   };
   dev = {
-    sha256 = "1yyzhw5zv803ysdj7zf0imdw9cf0mdlw30vphcb59a93nnvhkbb7";
+    sha256 = "0ji6ps97hkwsy9525cdqd3k3k9nyh217h0gfjdkfb7phg6lf46q5";
-    sha256bin64 = "1a1dswkfc4x2rslkb899fgywv5mfrmcp1d8wxy7h034504r8gy87";
+    sha256bin64 = "0dg1qljc2gk8qkwckikq1q5wv7g00blc86nxkaqsr3i12rzy3n8g";
-    version = "74.0.3702.0";
+    version = "74.0.3710.0";
   };
   stable = {
-    sha256 = "0bcc0iksk2v30drwd5zbw7v6sfbw16jqllc12ks2nifrvh058jjp";
+    sha256 = "0ylig933xzn6c0018nxq95xhl0wkxcm95fdiy2c7s4a4h3hkr5dk";
-    sha256bin64 = "0azyhnmdg3grladpkpsv67zxqiqf5a3x9qjfj8h831kh7i7m3gy8";
+    sha256bin64 = "04rsgqrr696mq0yr0kmcyslklfnvrnkzf46d479qb2w55q7zh4s5";
-    version = "72.0.3626.109";
+    version = "72.0.3626.119";
   };
 }

pkgs/applications/networking/browsers/firefox-bin/default.nix

@@ -49,6 +49,7 @@
 , gnugrep
 , gnupg
 , ffmpeg
+, runtimeShell
 }:
 
 let
@@ -191,7 +192,7 @@ stdenv.mkDerivation {
   # update with:
   # $ nix-shell maintainers/scripts/update.nix --argstr package firefox-bin-unwrapped
   passthru.updateScript = import ./update.nix {
-    inherit stdenv name channel writeScript xidel coreutils gnused gnugrep gnupg curl;
+    inherit stdenv name channel writeScript xidel coreutils gnused gnugrep gnupg curl runtimeShell;
     baseUrl =
       if channel == "devedition"
         then "http://archive.mozilla.org/pub/devedition/releases/"

pkgs/applications/networking/browsers/firefox-bin/update.nix

@@ -8,6 +8,7 @@
 , gnugrep
 , curl
 , gnupg
+, runtimeShell
 , baseName ? "firefox"
 , basePath ? "pkgs/applications/networking/browsers/firefox-bin"
 , baseUrl
@@ -18,7 +19,7 @@ let
     channel != "release";
 
 in writeScript "update-${name}" ''
-  #!${stdenv.shell}
+  #!${runtimeShell}
   PATH=${coreutils}/bin:${gnused}/bin:${gnugrep}/bin:${xidel}/bin:${curl}/bin:${gnupg}/bin
   set -eux
   pushd ${basePath}

pkgs/applications/networking/browsers/firefox/update.nix

@@ -8,13 +8,14 @@
 , gnugrep
 , curl
 , attrPath
+, runtimeShell
 , baseUrl ? "http://archive.mozilla.org/pub/firefox/releases/"
 , versionSuffix ? ""
 , versionKey ? "version"
 }:
 
 writeScript "update-${attrPath}" ''
-  #!${stdenv.shell}
+  #!${runtimeShell}
   PATH=${lib.makeBinPath [ common-updater-scripts coreutils curl gnugrep gnused xidel ]}
 
   url=${baseUrl}

pkgs/applications/networking/browsers/qutebrowser/default.nix

@@ -21,12 +21,12 @@ let
 
 in python3Packages.buildPythonApplication rec {
   pname = "qutebrowser";
-  version = "1.5.2";
+  version = "1.6.0";
 
   # the release tarballs are different from the git checkout!
   src = fetchurl {
     url = "https://github.com/qutebrowser/qutebrowser/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "0ki19mynq91aih3kxhipnay3jmn56s7p6rilws0gq0k98li6a4my";
+    sha256 = "1pkbzhd5syn7m8q0i7zlxjdgd693z0gj0h22nkc48zjkn214w236";
   };
 
   # Needs tox

pkgs/applications/networking/cluster/kubernetes/default.nix

@@ -15,13 +15,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   name = "kubernetes-${version}";
-  version = "1.13.3";
+  version = "1.13.4";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    sha256 = "1fcp27c501ql4v7fl7rl5qyjlw1awk139rwwm0jqdpgh3sd22l2z";
+    sha256 = "1q3dc416fr9nzy64pl7rydahygnird0vpk9yflssw7v9gx84m6x9";
   };
 
   buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];

pkgs/applications/networking/feedreaders/feedreader/default.nix

@@ -1,44 +1,33 @@
-{ stdenv, fetchFromGitHub, fetchpatch, meson, ninja, pkgconfig, vala_0_40, gettext, python3
+{ stdenv, fetchFromGitHub, fetchpatch, meson, ninja, pkgconfig, vala, gettext, python3
 , appstream-glib, desktop-file-utils, glibcLocales, wrapGAppsHook
 , gtk3, libgee, libpeas, librest, webkitgtk, gsettings-desktop-schemas
-, curl, glib, gnome3, gst_all_1, json-glib, libnotify, libsecret, sqlite, gumbo
+, curl, glib, gnome3, gst_all_1, json-glib, libnotify, libsecret, sqlite, gumbo, libxml2
 }:
 
 stdenv.mkDerivation rec {
   pname = "feedreader";
-  version = "2.6.2";
+  version = "2.8.2";
 
   src = fetchFromGitHub {
     owner = "jangernert";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1x5milynfa27zyv2jkzyi7ikkszrvzki1hlzv8c2wvcmw60jqb8n";
+    sha256 = "1qm7scrz8xm68zizcfn13ll4ksdd004fahki7gbwqagsr1fg62y8";
   };
 
-  patches = [
-    # See: https://github.com/jangernert/FeedReader/pull/842
-    (fetchpatch {
-      url = "https://github.com/jangernert/FeedReader/commit/f4ce70932c4ddc91783309708402c7c42d627455.patch";
-      sha256 = "076fpjn973xg2m35lc6z4h7g5x8nb08sghg94glsqa8wh1ig2311";
-    })
-  ];
-
   nativeBuildInputs = [
-    meson ninja pkgconfig vala_0_40 gettext appstream-glib desktop-file-utils
+    meson ninja pkgconfig vala gettext appstream-glib desktop-file-utils
-    python3 glibcLocales wrapGAppsHook
+    libxml2 python3 wrapGAppsHook
   ];
 
   buildInputs = [
-    curl glib json-glib libnotify libsecret sqlite gumbo
+    curl glib json-glib libnotify libsecret sqlite gumbo gtk3
-    gtk3 libgee libpeas gnome3.libsoup librest webkitgtk gnome3.gnome-online-accounts
+    libgee libpeas gnome3.libsoup librest webkitgtk gsettings-desktop-schemas
-    gsettings-desktop-schemas
+    gnome3.gnome-online-accounts
   ] ++ (with gst_all_1; [
     gstreamer gst-plugins-base gst-plugins-good
   ]);
 
-  # vcs_tag function fails with UnicodeDecodeError
-  LC_ALL = "en_US.UTF-8";
-
   postPatch = ''
     patchShebangs meson_post_install.py
   '';
@@ -47,7 +36,7 @@ stdenv.mkDerivation rec {
     description = "A modern desktop application designed to complement existing web-based RSS accounts";
     homepage = https://jangernert.github.io/FeedReader/;
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ edwtjo ];
+    maintainers = with maintainers; [ edwtjo worldofpeace ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/networking/gns3/default.nix

@@ -1,7 +1,7 @@
 { callPackage, stdenv }:
 
 let
-  stableVersion = "2.1.12";
+  stableVersion = "2.1.14";
   previewVersion = "2.2.0a1";
   addVersion = args:
     let version = if args.stable then stableVersion else previewVersion;
@@ -9,8 +9,8 @@ let
     in args // { inherit version branch; };
   mkGui = args: callPackage (import ./gui.nix (addVersion args)) { };
   mkServer = args: callPackage (import ./server.nix (addVersion args)) { };
-  guiSrcHash = "19kk1nc8h6ljczhizkgszw6xma31p0fmh6vkygpmrfwb8975d1s6";
+  guiSrcHash = "1k4g1sd9s6nc3rsc918chnkr515qik4hfd4z5lw065bp3lshf48b";
-  serverSrcHash = "1rs3l33jf33y02xri0b7chy02cjzd8v7l20ccjw2in8mw08mpc99";
+  serverSrcHash = "0npm9p52jk04g9cmflsfph4dkj6373mfyvd3hff1caqmjalnfxg4";
 in {
   guiStable = mkGui {
     stable = true;

pkgs/applications/networking/instant-messengers/mattermost-desktop/default.nix

@@ -1,9 +1,9 @@
-{ stdenv, lib, fetchurl, gnome2, gtk2, pango, atk, cairo, gdk_pixbuf, glib,
+{ stdenv, fetchurl, gnome2, gtk3, pango, atk, cairo, gdk_pixbuf, glib,
 freetype, fontconfig, dbus, libX11, xorg, libXi, libXcursor, libXdamage,
 libXrandr, libXcomposite, libXext, libXfixes, libXrender, libXtst,
 libXScrnSaver, nss, nspr, alsaLib, cups, expat, udev }:
 let
-  rpath = lib.makeLibraryPath [
+  rpath = stdenv.lib.makeLibraryPath [
     alsaLib
     atk
     cairo
@@ -15,7 +15,7 @@ let
     gdk_pixbuf
     glib
     gnome2.GConf
-    gtk2
+    gtk3
     pango
     libX11
     libXScrnSaver
@@ -38,44 +38,51 @@ let
 in
   stdenv.mkDerivation rec {
     name = "mattermost-desktop-${version}";
-    version = "4.1.2";
+    version = "4.2.0";
 
     src =
       if stdenv.hostPlatform.system == "x86_64-linux" then
         fetchurl {
           url = "https://releases.mattermost.com/desktop/${version}/${name}-linux-x64.tar.gz";
-          sha256 = "16dn6870bs1nfl2082ym9gwvmqb3i5sli48qprap80p7riph6k9s";
+          sha256 = "0hka94gwpscjn61032c0grpjv5gjb0j8rkx6pgwci617n29xkyf6";
         }
       else if stdenv.hostPlatform.system == "i686-linux" then
         fetchurl {
           url = "https://releases.mattermost.com/desktop/${version}/${name}-linux-ia32.tar.gz";
-          sha256 = "145zb1l37fa2slfrrlprlwzcc5km3plxs374yhgix25mlg2afkqr";
+          sha256 = "1nx2sgbnr60h6kn56wv54m7cvyx27d64bfprpb94hqd5c2z21x80";
         }
       else
         throw "Mattermost-Desktop is not currently supported on ${stdenv.hostPlatform.system}";
 
-    phases = [ "unpackPhase" "installPhase" ];
+    dontBuild = true;
+    dontConfigure = true;
+    dontPatchELF = true;
+
     installPhase = ''
-      mkdir -p $out
+      mkdir -p $out/share/mattermost-desktop
-      cp -R . $out
+      cp -R . $out/share/mattermost-desktop
 
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      mkdir -p "$out/bin"
-               --set-rpath ${rpath}:$out $out/mattermost-desktop
+      ln -s $out/share/mattermost-desktop/mattermost-desktop \
+        $out/bin/mattermost-desktop
 
-      patchShebangs $out/create_desktop_file.sh
+      patchShebangs $out/share/mattermost-desktop/create_desktop_file.sh
-      $out/create_desktop_file.sh
+      $out/share/mattermost-desktop/create_desktop_file.sh
+      rm $out/share/mattermost-desktop/create_desktop_file.sh
+      mkdir -p $out/share/applications
+      mv Mattermost.desktop $out/share/applications/Mattermost.desktop
 
-      mkdir -p $out/{bin,share/applications}
+      patchelf \
-      cp Mattermost.desktop $out/share/applications/Mattermost.desktop
+        --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      ln -s $out/mattermost-desktop $out/bin/mattermost-desktop
+        --set-rpath "${rpath}:$out/share/mattermost-desktop" \
+        $out/share/mattermost-desktop/mattermost-desktop
     '';
 
-    meta = {
+    meta = with stdenv.lib; {
       description = "Mattermost Desktop client";
       homepage    = https://about.mattermost.com/;
-      license     = lib.licenses.asl20;
+      license     = licenses.asl20;
-      platforms   = [
+      platforms   = [ "x86_64-linux" "i686-linux" ];
-        "x86_64-linux" "i686-linux"
+      maintainers = [ maintainers.joko ];
-      ];
     };
   }

pkgs/applications/networking/instant-messengers/telegram/telegram-cli/default.nix

@@ -1,5 +1,6 @@
-{ stdenv, fetchgit, bash, libconfig, libevent, openssl,
+{ stdenv, fetchgit, bash, libconfig, libevent, openssl
-  readline, zlib, lua5_2, python, pkgconfig, jansson
+, readline, zlib, lua5_2, python, pkgconfig, jansson
+, runtimeShell
 }:
 
 stdenv.mkDerivation rec {
@@ -20,7 +21,7 @@ stdenv.mkDerivation rec {
     cp ./bin/telegram-cli $out/bin/telegram-wo-key
     cp ./tg-server.pub $out/
     cat > $out/bin/telegram-cli <<EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
     $out/bin/telegram-wo-key -k $out/tg-server.pub "\$@"
     EOF
     chmod +x $out/bin/telegram-cli

pkgs/applications/networking/irc/weechat/wrapper.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, runCommand, writeScriptBin, buildEnv
-, pythonPackages, perlPackages
+, pythonPackages, perlPackages, runtimeShell
 }:
 
 weechat:
@@ -60,7 +60,7 @@ let
     in "${scripts};${init}";
 
     mkWeechat = bin: (writeScriptBin bin ''
-      #!${stdenv.shell}
+      #!${runtimeShell}
       export WEECHAT_EXTRA_LIBDIR=${pluginsDir}
       ${lib.concatMapStringsSep "\n" (p: lib.optionalString (p ? extraEnv) p.extraEnv) plugins}
       exec ${weechat}/bin/${bin} "$@" --run-command ${lib.escapeShellArg init}

pkgs/applications/networking/mailreaders/msgviewer/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, unzip, jre }:
+{ stdenv, fetchurl, makeWrapper, unzip, jre, runtimeShell }:
 
 let
   version = "1.9";
@@ -20,7 +20,7 @@ in stdenv.mkDerivation rec {
     mv $dir/${uname}/* $dir
     rmdir $dir/${uname}
     cat <<_EOF > $out/bin/msgviewer
-    #!${stdenv.shell} -eu
+    #!${runtimeShell} -eu
     exec ${stdenv.lib.getBin jre}/bin/java -jar $dir/MSGViewer.jar "\$@"
     _EOF
     chmod 755 $out/bin/msgviewer

pkgs/applications/networking/mailreaders/neomutt/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchFromGitHub, gettext, makeWrapper, tcl, which, writeScript
 , ncurses, perl , cyrus_sasl, gss, gpgme, kerberos, libidn, libxml2, notmuch, openssl
-, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, mailcap
+, lmdb, libxslt, docbook_xsl, docbook_xml_dtd_42, mailcap, runtimeShell
 }:
 
 let
   muttWrapper = writeScript "mutt" ''
-    #!${stdenv.shell} -eu
+    #!${runtimeShell} -eu
 
     echo 'The neomutt project has renamed the main binary from `mutt` to `neomutt`.'
     echo ""

pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix

@@ -41,6 +41,7 @@
 , gnused
 , gnugrep
 , gnupg
+, runtimeShell
 }:
 
 # imports `version` and `sources`
@@ -159,7 +160,7 @@ stdenv.mkDerivation {
     '';
 
   passthru.updateScript = import ./../../browsers/firefox-bin/update.nix {
-    inherit name stdenv writeScript xidel coreutils gnused gnugrep curl gnupg;
+    inherit name stdenv writeScript xidel coreutils gnused gnugrep curl gnupg runtimeShell;
     baseName = "thunderbird";
     channel = "release";
     basePath = "pkgs/applications/networking/mailreaders/thunderbird-bin";

pkgs/applications/networking/mailreaders/thunderbird/default.nix

@@ -5,7 +5,7 @@
 , hunspell, libevent, libstartup_notification
 , icu, libpng, jemalloc
 , autoconf213, which, m4
-, writeScript, xidel, common-updater-scripts, coreutils, gnused, gnugrep, curl
+, writeScript, xidel, common-updater-scripts, coreutils, gnused, gnugrep, curl, runtimeShell
 , cargo, rustc, llvmPackages
 , enableGTK3 ? false, gtk3, gnome3, wrapGAppsHook, makeWrapper
 , enableCalendar ? true
@@ -193,6 +193,6 @@ in stdenv.mkDerivation rec {
   passthru.updateScript = import ./../../browsers/firefox/update.nix {
     attrPath = "thunderbird";
     baseUrl = "http://archive.mozilla.org/pub/thunderbird/releases/";
-    inherit stdenv writeScript lib common-updater-scripts xidel coreutils gnused gnugrep curl;
+    inherit stdenv writeScript lib common-updater-scripts xidel coreutils gnused gnugrep curl runtimeShell;
   };
 }

pkgs/applications/networking/protonmail-bridge/default.nix

@@ -2,7 +2,7 @@
   libsecret, libGL, libpulseaudio, glib, makeWrapper, makeDesktopItem }:
 
 let
-  version = "1.1.0-1";
+  version = "1.1.1-1";
 
   description = ''
     An application that runs on your computer in the background and seamlessly encrypts
@@ -12,9 +12,9 @@ let
   '';
 
   desktopItem = makeDesktopItem {
-    name = "Desktop-Bridge";
+    name = "protonmail-bridge";
-    exec = "Desktop-Bridge";
+    exec = "protonmail-bridge";
-    icon = "desktop-bridge";
+    icon = "protonmail-bridge";
     comment = stdenv.lib.replaceStrings ["\n"] [" "] description;
     desktopName = "ProtonMail Bridge";
     genericName = "ProtonMail Bridge for Linux";
@@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://protonmail.com/download/protonmail-bridge_${version}_amd64.deb";
-    sha256 = "0l29z208krnd3dginc203m4p5dlmnxf08vpmbm9xzlckwmswizkb";
+    sha256 = "148syyz92yqxp2fw18fhflhmdrakxz7cc30va7h0pwysz97gni2p";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -40,11 +40,11 @@ in stdenv.mkDerivation rec {
     mkdir -p $out/{bin,lib,share/applications}
     mkdir -p $out/share/{applications,icons/hicolor/scalable/apps}
 
-    cp -r usr/lib/protonmail/bridge/Desktop-Bridge{,.sh} $out/lib
+    cp -r usr/lib/protonmail/bridge/protonmail-bridge{,.sh} $out/lib
-    cp usr/share/icons/protonmail/Desktop-Bridge.svg $out/share/icons/hicolor/scalable/apps/desktop-bridge.svg
+    cp usr/share/icons/protonmail/ProtonMail_Bridge.svg $out/share/icons/hicolor/scalable/apps/protonmail-bridge.svg
     cp ${desktopItem}/share/applications/* $out/share/applications
 
-    ln -s $out/lib/Desktop-Bridge $out/bin/Desktop-Bridge
+    ln -s $out/lib/protonmail-bridge $out/bin/protonmail-bridge
   '';
 
   postFixup = let
@@ -66,9 +66,9 @@ in stdenv.mkDerivation rec {
     patchelf \
       --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
       --set-rpath "${rpath}" \
-      $out/lib/Desktop-Bridge
+      $out/lib/protonmail-bridge
 
-    wrapProgram $out/lib/Desktop-Bridge \
+    wrapProgram $out/lib/protonmail-bridge \
       --set QT_PLUGIN_PATH "${qtPath qtbase.qtPluginPrefix}" \
       --set QML_IMPORT_PATH "${qtPath qtbase.qtQmlPrefix}" \
       --set QML2_IMPORT_PATH "${qtPath qtbase.qtQmlPrefix}" \

pkgs/applications/office/mendeley/default.nix

@@ -32,6 +32,7 @@
 , autorunLinkHandler ? true
 # Update script
 , writeScript
+, runtimeShell
 }:
 
 let
@@ -130,7 +131,7 @@ stdenv.mkDerivation {
   dontStrip = true;
   dontPatchElf = true;
 
-  updateScript = import ./update.nix { inherit stdenv writeScript; };
+  updateScript = import ./update.nix { inherit stdenv writeScript runtimeShell; };
 
   meta = with stdenv.lib; {
     homepage = http://www.mendeley.com;

pkgs/applications/office/mendeley/update.nix

@@ -1,7 +1,7 @@
-{ stdenv, writeScript }:
+{ stdenv, writeScript, runtimeShell }:
 
 writeScript "update-mendeley" ''
-  #!${stdenv.shell}
+  #!${runtimeShell}
   function follow() {
     local URL=$1
     while true; do

pkgs/applications/office/moneyplex/default.nix

@@ -1,5 +1,6 @@
 { stdenv, fetchurl, patchelf, coreutils, pcsclite
-, zlib, glib, gdk_pixbuf, gtk2, cairo, pango, libX11, atk, openssl }:
+, zlib, glib, gdk_pixbuf, gtk2, cairo, pango, libX11, atk, openssl
+, runtimeShell }:
 
 let
   libPath = stdenv.lib.makeLibraryPath [
@@ -38,7 +39,7 @@ stdenv.mkDerivation rec {
     mkdir "$out/bin"
 
     cat > $out/bin/moneyplex <<EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
 
     if [ -z "\$XDG_DATA_HOME" ]; then
         MDIR=\$HOME/.local/share/moneyplex

pkgs/applications/science/electronics/alliance/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl
 , xorgproto, motif, libX11, libXt, libXpm, bison
-, flex, automake, autoconf, libtool
+, flex, automake, autoconf, libtool, runtimeShell
 }:
 
 stdenv.mkDerivation rec {
@@ -39,12 +39,12 @@ stdenv.mkDerivation rec {
   '';
 
   allianceInstaller = ''
-    #!${stdenv.shell}
+    #!${runtimeShell}
     cp -v -r -n --no-preserve=mode  $out/etc/* /etc/ > /etc/alliance-install.log
   '';
 
   allianceUnInstaller = ''
-    #!${stdenv.shell}
+    #!${runtimeShell}
     awk '{print \$3}' /etc/alliance-install.log | xargs rm
     awk '{print \$3}' /etc/alliance-install.log | xargs rmdir
     rm /etc/alliance-install.log

pkgs/applications/science/electronics/eagle/eagle7.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, makeDesktopItem, patchelf, zlib, freetype, fontconfig
 , openssl, libXrender, libXrandr, libXcursor, libX11, libXext, libXi
-, libxcb, cups, xkeyboardconfig
+, libxcb, cups, xkeyboardconfig, runtimeShell
 }:
 
 let
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
     dynlinker="$(cat $NIX_CC/nix-support/dynamic-linker)"
     mkdir -p "$out"/bin
     cat > "$out"/bin/eagle << EOF
-    #!${stdenv.shell}
+    #!${runtimeShell}
     export LD_LIBRARY_PATH="${stdenv.cc.cc.lib}/lib:${libPath}"
     export LD_PRELOAD="$out/lib/eagle_fixer.so"
     export QT_XKB_CONFIG_ROOT="${xkeyboardconfig}/share/X11/xkb"

pkgs/applications/science/logic/clprover/clprover.nix

@@ -0,0 +1,27 @@
+{ stdenv, pkgs, fetchzip }:
+
+stdenv.mkDerivation rec {
+  name = "clprover-${version}";
+  version = "1.0.3";
+
+  src = fetchzip {
+    url = "http://cgi.csc.liv.ac.uk/~ullrich/CLProver++/CLProver++-v1.0.3-18-04-2015.zip";
+    sha256 = "10kmlg4m572qwfzi6hkyb0ypb643xw8sfb55xx7866lyh37w1q3s";
+    stripRoot = false;
+  };
+
+  installPhase = ''
+    mkdir $out
+    cp -r bin $out/bin
+    mkdir -p $out/share/clprover
+    cp -r examples $out/share/clprover/examples
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Resolution-based theorem prover for Coalition Logic implemented in C++";
+    homepage = http://cgi.csc.liv.ac.uk/~ullrich/CLProver++/;
+    license = licenses.gpl3; # Note that while the website states that it is GPLv2 but the file in the zip as well as the comments in the source state it is GPLv3
+    maintainers = with maintainers; [ mgttlinger ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

pkgs/applications/science/logic/hol_light/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, ocaml, num, camlp5 }:
+{ stdenv, runtimeShell, fetchFromGitHub, ocaml, num, camlp5 }:
 
 let
   load_num =
@@ -11,7 +11,7 @@ let
 
   start_script =
     ''
-      #!${stdenv.shell}
+      #!${runtimeShell}
       cd $out/lib/hol_light
       exec ${ocaml}/bin/ocaml \
         -I \`${camlp5}/bin/camlp5 -where\` \

pkgs/applications/science/logic/leo3/binary.nix

@@ -1,4 +1,4 @@
-{stdenv, fetchurl, openjdk}:
+{stdenv, fetchurl, openjdk, runtimeShell}:
 stdenv.mkDerivation rec {
   pname = "leo3";
   version = "1.2";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p "$out"/{bin,lib/java/leo3}
     cp "${jar}" "$out/lib/java/leo3/leo3.jar"
-    echo "#!${stdenv.shell}" > "$out/bin/leo3"
+    echo "#!${runtimeShell}" > "$out/bin/leo3"
     echo "'${openjdk}/bin/java' -jar '$out/lib/java/leo3/leo3.jar' \"\$@\""  > "$out/bin/leo3"
     chmod a+x "$out/bin/leo3"
   '';

pkgs/applications/science/logic/why3/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name    = "why3-${version}";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchurl {
-    url = https://gforge.inria.fr/frs/download.php/file/37842/why3-1.1.1.tar.gz;
+    url = https://gforge.inria.fr/frs/download.php/file/37903/why3-1.2.0.tar.gz;
-    sha256 = "065ix1ill009bxg7w27s8wq47vn03vbr63hsaa79arv31d96izny";
+    sha256 = "0xz001jhi71ja8vqrjz27v63bidrzj4qvg1yqarq6p4dmpxhk348";
   };
 
   buildInputs = (with ocamlPackages; [

pkgs/applications/science/machine-learning/sc2-headless/maps.nix

@@ -12,7 +12,7 @@ in
   
   melee = fetchzip' {
     url = "http://blzdistsc2-a.akamaihd.net/MapPacks/Melee.zip";
-    sha256 = "0w050yah5rybx3m5zvpr09jv01r0xsazpyrc76338b2sd8pdxv3y";
+    sha256 = "0z44pgy10jklsvgpr0kcn4c2mz3hw7nlcmvsy6a6lzpi3dvzf33i";
     stripRoot = false;
   };
   ladder2017season1 = fetchzip' {

pkgs/applications/science/math/sage/sage-src.nix

@@ -1,6 +1,7 @@
 { stdenv
 , fetchFromGitHub
 , fetchpatch
+, runtimeShell
 }:
 
 # This file is responsible for fetching the sage source and adding necessary patches.
@@ -121,7 +122,7 @@ stdenv.mkDerivation rec {
       -e 's/sage-python23/python/g' \
       -i {} \;
 
-    echo '#!${stdenv.shell}
+    echo '#!${runtimeShell}
     python "$@"' > build/bin/sage-python23
 
     # Do not use sage-env-config (generated by ./configure).

pkgs/applications/version-management/git-and-tools/default.nix

@@ -82,6 +82,8 @@ let
 
   git-hub = callPackage ./git-hub { };
 
+  git-ignore = callPackage ./git-ignore { };
+
   git-imerge = callPackage ./git-imerge { };
 
   git-octopus = callPackage ./git-octopus { };

pkgs/applications/version-management/git-and-tools/git-ignore/default.nix

@@ -0,0 +1,31 @@
+{ stdenv, fetchFromGitHub, rustPlatform, pkgconfig, openssl, darwin }:
+
+with rustPlatform;
+
+buildRustPackage rec {
+  name = "git-ignore-${version}";
+  version = "0.2.0";
+
+  cargoSha256 = "1fqfy8lnvpn5sd3l73x2p359zq4303vsrdgw3aphvy6580yjb84d";
+
+  src = fetchFromGitHub {
+    owner = "sondr3";
+    repo = "git-ignore";
+    rev = "v${version}";
+    sha256 = "1nihh5inh46r8jg9z7d6g9gqfyhrznmkn15nmzpbnzf0653dl629";
+  };
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ openssl ]
+  ++ stdenv.lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Quickly and easily fetch .gitignore templates from gitignore.io";
+    homepage = https://github.com/sondr3/git-ignore;
+    license = licenses.gpl3Plus;
+    platforms = platforms.all;
+    maintainers = [ maintainers.sondr3 ];
+  };
+}

pkgs/applications/version-management/git-and-tools/hub/default.nix

@@ -1,8 +1,8 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, ronn, ruby, groff, Security, utillinux, git, glibcLocales }:
+{ stdenv, buildGoPackage, fetchFromGitHub, groff, Security, utillinux }:
 
 buildGoPackage rec {
   pname = "hub";
-  version = "2.9.0";
+  version = "2.10.0";
 
   goPackagePath = "github.com/github/hub";
 
@@ -13,12 +13,11 @@ buildGoPackage rec {
     owner = "github";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0yxpr606xx23l8823hjqj16cvjjrwb28c7z08ml1pkfvaf7w4n81";
+    sha256 = "1vvrc3k81jm9c664g0j9666i7ypn7n7jfyj4gxcybq3sg2d4di27";
   };
 
-  nativeBuildInputs = [ groff ronn utillinux glibcLocales ];
+  nativeBuildInputs = [ groff utillinux ];
-  buildInputs = [ ruby ] ++
+  buildInputs = stdenv.lib.optional stdenv.isDarwin Security;
-    stdenv.lib.optional stdenv.isDarwin Security;
 
   postPatch = ''
     patchShebangs .
@@ -30,7 +29,8 @@ buildGoPackage rec {
     install -D etc/hub.bash_completion.sh "$bin/share/bash-completion/completions/hub"
     install -D etc/hub.fish_completion  "$bin/share/fish/vendor_completions.d/hub.fish"
 
-    PATH=$PATH:${git}/bin LC_ALL=en_US.utf-8 make man-pages
+    LC_ALL=C.UTF8 \
+    make man-pages
     cp -vr --parents share/man/man[1-9]/*.[1-9] $bin/
   '';