diff --git a/doc/languages-frameworks/haskell.section.md b/doc/languages-frameworks/haskell.section.md
index 7677c366191..74b7a9f961e 100644
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@@ -935,7 +935,7 @@ The implementation can be found in the
 [integer-gmp](http://hackage.haskell.org/package/integer-gmp) package.
 
 A potential problem with this is that GMP is licensed under the
-[GNU Lesser General Public License (LGPL)](http://www.gnu.org/copyleft/lesser.html),
+[GNU Lesser General Public License (LGPL)](https://www.gnu.org/copyleft/lesser.html),
 a kind of "copyleft" license. According to the terms of the LGPL, paragraph 5,
 you may distribute a program that is designed to be compiled and dynamically
 linked with the library under the terms of your choice (i.e., commercially) but
diff --git a/doc/meta.xml b/doc/meta.xml
index 3abfe016d70..774ed2db750 100644
--- a/doc/meta.xml
+++ b/doc/meta.xml
@@ -14,7 +14,7 @@ meta = with stdenv.lib; {
     GNU Hello is a program that prints "Hello, world!" when you run it.
     It is fully customizable.
   '';
-  homepage = http://www.gnu.org/software/hello/manual/;
+  homepage = https://www.gnu.org/software/hello/manual/;
   license = licenses.gpl3Plus;
   maintainers = [ maintainers.eelco ];
   platforms = platforms.all;
@@ -35,7 +35,7 @@ $ nix-env -qa hello --json
     "hello": {
         "meta": {
             "description": "A program that produces a familiar, friendly greeting",
-            "homepage": "http://www.gnu.org/software/hello/manual/",
+            "homepage": "https://www.gnu.org/software/hello/manual/",
             "license": {
                 "fullName": "GNU General Public License version 3 or later",
                 "shortName": "GPLv3+",
@@ -135,7 +135,7 @@ hello-2.3  A program that produces a familiar, friendly greeting
     <listitem>
      <para>
       The package’s homepage. Example:
-      <literal>http://www.gnu.org/software/hello/manual/</literal>
+      <literal>https://www.gnu.org/software/hello/manual/</literal>
      </para>
     </listitem>
    </varlistentry>
@@ -146,7 +146,7 @@ hello-2.3  A program that produces a familiar, friendly greeting
     <listitem>
      <para>
       The page where a link to the current version can be found. Example:
-      <literal>http://ftp.gnu.org/gnu/hello/</literal>
+      <literal>https://ftp.gnu.org/gnu/hello/</literal>
      </para>
     </listitem>
    </varlistentry>
diff --git a/doc/stdenv.xml b/doc/stdenv.xml
index 4c19b2867b5..26190debc29 100644
--- a/doc/stdenv.xml
+++ b/doc/stdenv.xml
@@ -671,6 +671,43 @@ passthru = {
      </para>
     </listitem>
    </varlistentry>
+   <varlistentry>
+    <term>
+     <varname>passthru.updateScript</varname>
+    </term>
+    <listitem>
+     <para>
+      A script to be run by <filename>maintainers/scripts/update.nix</filename> when
+      the package is matched. It needs to be an executable file, either on the file
+      system:
+<programlisting>
+passthru.updateScript = ./update.sh;
+</programlisting>
+      or inside the expression itself:
+<programlisting>
+passthru.updateScript = writeScript "update-zoom-us" ''
+  #!/usr/bin/env nix-shell
+  #!nix-shell -i bash -p curl pcre common-updater-scripts
+
+  set -eu -o pipefail
+
+  version="$(curl -sI https://zoom.us/client/latest/zoom_x86_64.tar.xz | grep -Fi 'Location:' | pcregrep -o1 '/(([0-9]\.?)+)/')"
+  update-source-version zoom-us "$version"
+'';
+</programlisting>
+      The attribute can also contain a list, a script followed by arguments to be passed to it:
+<programlisting>
+passthru.updateScript = [ ../../update.sh pname "--requested-release=unstable" ];
+</programlisting>
+      Note that the update scripts will be run in parallel by default; you should avoid running <command>git commit</command> or any other commands that cannot handle that.
+     </para>
+
+     <para>
+      For information about how to run the updates, execute
+      <cmdsynopsis><command>nix-shell</command> <arg>maintainers/scripts/update.nix</arg></cmdsynopsis>.
+     </para>
+    </listitem>
+   </varlistentry>
   </variablelist>
  </section>
  <section xml:id="sec-stdenv-phases">
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index c799b9ec449..608db00a968 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -110,6 +110,10 @@ rec {
     config = "arm-none-eabi";
     libc = "newlib";
   };
+  armhf-embedded = {
+    config = "arm-none-eabihf";
+    libc = "newlib";
+  };
 
   aarch64-embedded = {
     config = "aarch64-none-elf";
diff --git a/lib/systems/parse.nix b/lib/systems/parse.nix
index 73b065689d0..7db09fc550e 100644
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@@ -209,8 +209,15 @@ rec {
   abis = setTypes types.openAbi {
     cygnus       = {};
     msvc         = {};
-    eabi         = {};
-    elf         = {};
+
+    # Note: eabi is specific to ARM and PowerPC.
+    # On PowerPC, this corresponds to PPCEABI.
+    # On ARM, this corresponds to ARMEABI.
+    eabi         = { float = "soft"; };
+    eabihf       = { float = "hard"; };
+
+    # Other architectures should use ELF in embedded situations.
+    elf          = {};
 
     androideabi  = {};
     android      = {
@@ -272,10 +279,8 @@ rec {
     "2" = # We only do 2-part hacks for things Nix already supports
       if elemAt l 1 == "cygwin"
         then { cpu = elemAt l 0;                      kernel = "windows";  abi = "cygnus";   }
-      else if (elemAt l 1 == "eabi")
-        then { cpu = elemAt l 0; vendor = "none"; kernel = "none"; abi = elemAt l 1; }
-      else if (elemAt l 1 == "elf")
-        then { cpu = elemAt l 0; vendor = "none"; kernel = "none"; abi = elemAt l 1; }
+      else if (elemAt l 1) == "elf"
+      then { cpu = elemAt l 0; vendor = "unknown";    kernel = "none";     abi = elemAt l 1; }
       else   { cpu = elemAt l 0;                      kernel = elemAt l 1;                   };
     "3" = # Awkwards hacks, beware!
       if elemAt l 1 == "apple"
@@ -286,10 +291,8 @@ rec {
         then { cpu = elemAt l 0; vendor = elemAt l 1; kernel = "windows";  abi = "gnu"; }
       else if hasPrefix "netbsd" (elemAt l 2)
         then { cpu = elemAt l 0; vendor = elemAt l 1;    kernel = elemAt l 2;                }
-      else if (elemAt l 2 == "eabi")
-        then { cpu = elemAt l 0; vendor = elemAt l 1; kernel = "none"; abi = elemAt l 2; }
-      else if (elemAt l 2 == "elf")
-        then { cpu = elemAt l 0; vendor = elemAt l 1; kernel = "none"; abi = elemAt l 2; }
+      else if (elem (elemAt l 2) ["eabi" "eabihf" "elf"])
+        then { cpu = elemAt l 0; vendor = "unknown"; kernel = elemAt l 1; abi = elemAt l 2; }
       else throw "Target specification with 3 components is ambiguous";
     "4" =    { cpu = elemAt l 0; vendor = elemAt l 1; kernel = elemAt l 2; abi = elemAt l 3; };
   }.${toString (length l)}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 87c144f0d42..5d77f75c65c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2052,6 +2052,11 @@
     github = "jluttine";
     name = "Jaakko Luttinen";
   };
+  jmagnusj = {
+    email = "jmagnusj@gmail.com";
+    github = "magnusjonsson";
+    name = "Johan Magnus Jonsson";
+  };
   jmettes = {
     email = "jonathan@jmettes.com";
     github = "jmettes";
@@ -3856,6 +3861,11 @@
     github = "sboosali";
     name = "Sam Boosalis";
   };
+  scalavision = {
+    email = "scalavision@gmail.com";
+    github = "scalavision";
+    name = "Tom Sorlie";
+  };
   schmitthenner = {
     email = "development@schmitthenner.eu";
     github = "fkz";
diff --git a/maintainers/scripts/update.nix b/maintainers/scripts/update.nix
index 8d1e47c6bc9..120cd5552f4 100755
--- a/maintainers/scripts/update.nix
+++ b/maintainers/scripts/update.nix
@@ -1,6 +1,8 @@
 { package ? null
 , maintainer ? null
 , path ? null
+, max-workers ? null
+, keep-going ? null
 }:
 
 # TODO: add assert statements
@@ -105,26 +107,23 @@ let
         % nix-shell maintainers/scripts/update.nix --argstr path gnome3
 
     to run update script for all package under an attribute path.
+
+    You can also add
+
+        --argstr max-workers 8
+
+    to increase the number of jobs in parallel, or
+
+        --argstr keep-going true
+
+    to continue running when a single update fails.
   '';
 
-  runUpdateScript = package: ''
-    echo -ne " - ${package.name}: UPDATING ..."\\r
-    ${package.updateScript} &> ${(builtins.parseDrvName package.name).name}.log
-    CODE=$?
-    if [ "$CODE" != "0" ]; then
-      echo " - ${package.name}: ERROR       "
-      echo ""
-      echo "--- SHOWING ERROR LOG FOR ${package.name} ----------------------"
-      echo ""
-      cat ${(builtins.parseDrvName package.name).name}.log
-      echo ""
-      echo "--- SHOWING ERROR LOG FOR ${package.name} ----------------------"
-      exit $CODE
-    else
-      rm ${(builtins.parseDrvName package.name).name}.log
-    fi
-    echo " - ${package.name}: DONE.       "
-  '';
+  packageData = package: {
+    name = package.name;
+    pname = (builtins.parseDrvName package.name).name;
+    updateScript = pkgs.lib.toList package.updateScript;
+  };
 
 in pkgs.stdenv.mkDerivation {
   name = "nixpkgs-update-script";
@@ -139,21 +138,7 @@ in pkgs.stdenv.mkDerivation {
     exit 1
   '';
   shellHook = ''
-    echo ""
-    echo "Going to be running update for following packages:"
-    echo "${builtins.concatStringsSep "\n" (map (x: " - ${x.name}") packages)}"
-    echo ""
-    read -n1 -r -p "Press space to continue..." confirm
-    if [ "$confirm" = "" ]; then
-      echo ""
-      echo "Running update for:"
-      ${builtins.concatStringsSep "\n" (map runUpdateScript packages)}
-      echo ""
-      echo "Packages updated!"
-      exit 0
-    else
-      echo "Aborting!"
-      exit 1
-    fi
+    unset shellHook # do not contaminate nested shells
+    exec ${pkgs.python3.interpreter} ${./update.py} ${pkgs.writeText "packages.json" (builtins.toJSON (map packageData packages))}${pkgs.lib.optionalString (max-workers != null) " --max-workers=${max-workers}"}${pkgs.lib.optionalString (keep-going == "true") " --keep-going"}
   '';
 }
diff --git a/maintainers/scripts/update.py b/maintainers/scripts/update.py
new file mode 100644
index 00000000000..eb7d0ef2647
--- /dev/null
+++ b/maintainers/scripts/update.py
@@ -0,0 +1,79 @@
+import argparse
+import concurrent.futures
+import json
+import os
+import subprocess
+import sys
+
+updates = {}
+
+def eprint(*args, **kwargs):
+    print(*args, file=sys.stderr, **kwargs)
+
+def run_update_script(package):
+    eprint(f" - {package['name']}: UPDATING ...")
+
+    subprocess.run(package['updateScript'], stdout=subprocess.PIPE, stderr=subprocess.STDOUT, check=True)
+
+
+def main(max_workers, keep_going, packages):
+    with open(sys.argv[1]) as f:
+        packages = json.load(f)
+
+    eprint()
+    eprint('Going to be running update for following packages:')
+    for package in packages:
+        eprint(f" - {package['name']}")
+    eprint()
+
+    confirm = input('Press Enter key to continue...')
+    if confirm == '':
+        eprint()
+        eprint('Running update for:')
+
+        with concurrent.futures.ProcessPoolExecutor(max_workers=max_workers) as executor:
+            for package in packages:
+                updates[executor.submit(run_update_script, package)] = package
+
+            for future in concurrent.futures.as_completed(updates):
+                package = updates[future]
+
+                try:
+                    future.result()
+                    eprint(f" - {package['name']}: DONE.")
+                except subprocess.CalledProcessError as e:
+                    eprint(f" - {package['name']}: ERROR")
+                    eprint()
+                    eprint(f"--- SHOWING ERROR LOG FOR {package['name']} ----------------------")
+                    eprint()
+                    eprint(e.stdout.decode('utf-8'))
+                    with open(f"{package['pname']}.log", 'wb') as f:
+                        f.write(e.stdout)
+                    eprint()
+                    eprint(f"--- SHOWING ERROR LOG FOR {package['name']} ----------------------")
+
+                    if not keep_going:
+                        sys.exit(1)
+
+        eprint()
+        eprint('Packages updated!')
+        sys.exit()
+    else:
+        eprint('Aborting!')
+        sys.exit(130)
+
+parser = argparse.ArgumentParser(description='Update packages')
+parser.add_argument('--max-workers', '-j', dest='max_workers', type=int, help='Number of updates to run concurrently', nargs='?', default=4)
+parser.add_argument('--keep-going', '-k', dest='keep_going', action='store_true', help='Do not stop after first failure')
+parser.add_argument('packages', help='JSON file containing the list of package names and their update scripts')
+
+if __name__ == '__main__':
+    args = parser.parse_args()
+
+    try:
+        main(args.max_workers, args.keep_going, args.packages)
+    except (KeyboardInterrupt, SystemExit) as e:
+        for update in updates:
+            update.cancel()
+
+        sys.exit(e.code if isinstance(e, SystemExit) else 130)
diff --git a/nixos/doc/manual/configuration/adding-custom-packages.xml b/nixos/doc/manual/configuration/adding-custom-packages.xml
index 028a9427534..cdcfa10b820 100644
--- a/nixos/doc/manual/configuration/adding-custom-packages.xml
+++ b/nixos/doc/manual/configuration/adding-custom-packages.xml
@@ -31,7 +31,7 @@ $ cd nixpkgs
  <para>
   The second possibility is to add the package outside of the Nixpkgs tree. For
   instance, here is how you specify a build of the
-  <link xlink:href="http://www.gnu.org/software/hello/">GNU Hello</link>
+  <link xlink:href="https://www.gnu.org/software/hello/">GNU Hello</link>
   package directly in <filename>configuration.nix</filename>:
 <programlisting>
 <xref linkend="opt-environment.systemPackages"/> =
diff --git a/nixos/doc/manual/release-notes/rl-1903.xml b/nixos/doc/manual/release-notes/rl-1903.xml
index 376a5355f7c..65cc166c9a0 100644
--- a/nixos/doc/manual/release-notes/rl-1903.xml
+++ b/nixos/doc/manual/release-notes/rl-1903.xml
@@ -39,7 +39,9 @@
 
   <itemizedlist>
    <listitem>
-    <para />
+    <para>
+     <literal>./programs/nm-applet.nix</literal>
+    </para>
    </listitem>
   </itemizedlist>
  </section>
diff --git a/nixos/modules/installer/cd-dvd/iso-image.nix b/nixos/modules/installer/cd-dvd/iso-image.nix
index 96fdb997b2c..aa8003fef2c 100644
--- a/nixos/modules/installer/cd-dvd/iso-image.nix
+++ b/nixos/modules/installer/cd-dvd/iso-image.nix
@@ -339,7 +339,9 @@ let
       echo "Image size: $image_size"
       truncate --size=$image_size "$out"
       ${pkgs.libfaketime}/bin/faketime "2000-01-01 00:00:00" ${pkgs.dosfstools}/sbin/mkfs.vfat -i 12345678 -n EFIBOOT "$out"
-      mcopy -bpsvm -i "$out" ./* ::
+      mcopy -psvm -i "$out" ./* ::
+      # Verify the FAT partition.
+      ${pkgs.dosfstools}/sbin/fsck.vfat -vn "$out"
     ''; # */
 
   targetArch = if pkgs.stdenv.isi686 then
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index c368cd91186..d9ba2efa0c8 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -337,6 +337,7 @@
       alerta = 310;
       minetest = 311;
       rss2email = 312;
+      cockroachdb = 313;
 
       # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!
 
@@ -634,6 +635,7 @@
       alerta = 310;
       minetest = 311;
       rss2email = 312;
+      cockroachdb = 313;
 
       # When adding a gid, make sure it doesn't match an existing
       # uid. Users and groups with the same name should have equal
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e476efb79a3..e3e097dca26 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -106,6 +106,7 @@
   ./programs/mininet.nix
   ./programs/mtr.nix
   ./programs/nano.nix
+  ./programs/nm-applet.nix
   ./programs/npm.nix
   ./programs/oblogout.nix
   ./programs/plotinus.nix
@@ -212,6 +213,7 @@
   ./services/databases/aerospike.nix
   ./services/databases/cassandra.nix
   ./services/databases/clickhouse.nix
+  ./services/databases/cockroachdb.nix
   ./services/databases/couchdb.nix
   ./services/databases/firebird.nix
   ./services/databases/foundationdb.nix
@@ -339,6 +341,7 @@
   ./services/misc/apache-kafka.nix
   ./services/misc/autofs.nix
   ./services/misc/autorandr.nix
+  ./services/misc/bees.nix
   ./services/misc/bepasty.nix
   ./services/misc/canto-daemon.nix
   ./services/misc/calibre-server.nix
diff --git a/nixos/modules/programs/nm-applet.nix b/nixos/modules/programs/nm-applet.nix
new file mode 100644
index 00000000000..e42219e9638
--- /dev/null
+++ b/nixos/modules/programs/nm-applet.nix
@@ -0,0 +1,14 @@
+{ config, lib, pkgs, ... }:
+
+{
+  options.programs.nm-applet.enable = lib.mkEnableOption "nm-applet";
+
+  config = lib.mkIf config.programs.nm-applet.enable {
+    systemd.user.services.nm-applet = {
+      description = "Network manager applet";
+      wantedBy = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
+      serviceConfig.ExecStart = "${pkgs.networkmanagerapplet}/bin/nm-applet";
+    };
+  };
+}
diff --git a/nixos/modules/programs/sway-beta.nix b/nixos/modules/programs/sway-beta.nix
index 8447f94ca25..7fc5979a38a 100644
--- a/nixos/modules/programs/sway-beta.nix
+++ b/nixos/modules/programs/sway-beta.nix
@@ -7,8 +7,19 @@ let
   swayPackage = cfg.package;
 
   swayWrapped = pkgs.writeShellScriptBin "sway" ''
-    ${cfg.extraSessionCommands}
-    exec ${pkgs.dbus.dbus-launch} --exit-with-session ${swayPackage}/bin/sway "$@"
+    set -o errexit
+
+    if [ ! "$_SWAY_WRAPPER_ALREADY_EXECUTED" ]; then
+      export _SWAY_WRAPPER_ALREADY_EXECUTED=1
+      ${cfg.extraSessionCommands}
+    fi
+
+    if [ "$DBUS_SESSION_BUS_ADDRESS" ]; then
+      export DBUS_SESSION_BUS_ADDRESS
+      exec ${swayPackage}/bin/sway "$@"
+    else
+      exec ${pkgs.dbus}/bin/dbus-run-session ${swayPackage}/bin/sway "$@"
+    fi
   '';
   swayJoined = pkgs.symlinkJoin {
     name = "sway-joined";
diff --git a/nixos/modules/services/databases/cockroachdb.nix b/nixos/modules/services/databases/cockroachdb.nix
new file mode 100644
index 00000000000..8de1e78633d
--- /dev/null
+++ b/nixos/modules/services/databases/cockroachdb.nix
@@ -0,0 +1,222 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.cockroachdb;
+  crdb = cfg.package;
+
+  escape    = builtins.replaceStrings ["%"] ["%%"];
+  ifNotNull = v: s: optionalString (!isNull v) s;
+
+  startupCommand = lib.concatStringsSep " "
+    [ # Basic startup
+      "${crdb}/bin/cockroach start"
+      "--logtostderr"
+      "--store=${cfg.dataDir}"
+      (ifNotNull cfg.locality "--locality='${cfg.locality}'")
+
+      # WebUI settings
+      "--http-addr='${cfg.http.address}:${toString cfg.http.port}'"
+
+      # Cluster listen address
+      "--listen-addr='${cfg.listen.address}:${toString cfg.listen.port}'"
+
+      # Cluster configuration
+      (ifNotNull cfg.join "--join=${cfg.join}")
+
+      # Cache and memory settings. Must be escaped.
+      "--cache='${escape cfg.cache}'"
+      "--max-sql-memory='${escape cfg.maxSqlMemory}'"
+
+      # Certificate/security settings.
+      (if cfg.insecure then "--insecure" else "--certs-dir=${cfg.certsDir}")
+    ];
+
+    addressOption = descr: defaultPort: {
+      address = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = "Address to bind to for ${descr}";
+      };
+
+      port = mkOption {
+        type = types.int;
+        default = defaultPort;
+        description = "Port to bind to for ${descr}";
+      };
+    };
+in
+
+{
+  options = {
+    services.cockroachdb = {
+      enable = mkEnableOption "CockroachDB Server";
+
+      listen = addressOption "intra-cluster communication" 26257;
+
+      http = addressOption "http-based Admin UI" 8080;
+
+      locality = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = ''
+          An ordered, comma-separated list of key-value pairs that describe the
+          topography of the machine. Topography might include country,
+          datacenter or rack designations. Data is automatically replicated to
+          maximize diversities of each tier. The order of tiers is used to
+          determine the priority of the diversity, so the more inclusive
+          localities like country should come before less inclusive localities
+          like datacenter.  The tiers and order must be the same on all nodes.
+          Including more tiers is better than including fewer. For example:
+
+              country=us,region=us-west,datacenter=us-west-1b,rack=12
+              country=ca,region=ca-east,datacenter=ca-east-2,rack=4
+
+              planet=earth,province=manitoba,colo=secondary,power=3
+        '';
+      };
+
+      join = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = "The addresses for connecting the node to a cluster.";
+      };
+
+      dataDir = mkOption {
+        type = types.path;
+        default = "/var/lib/cockroachdb";
+        description = "Location where CockroachDB stores its table files";
+      };
+
+      insecure = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Run in insecure mode.";
+      };
+
+      certsDir = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = "The path to the certificate directory.";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "cockroachdb";
+        description = "User account under which CockroachDB runs";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "cockroachdb";
+        description = "User account under which CockroachDB runs";
+      };
+
+      openPorts = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Open firewall ports for cluster communication by default";
+      };
+
+      cache = mkOption {
+        type = types.str;
+        default = "25%";
+        description = ''
+          The total size for caches.
+
+          This can be a percentage, expressed with a fraction sign or as a
+          decimal-point number, or any bytes-based unit. For example, "25%",
+          "0.25" both represent 25% of the available system memory. The values
+          "1000000000" and "1GB" both represent 1 gigabyte of memory.
+        '';
+      };
+
+      maxSqlMemory = mkOption {
+        type = types.str;
+        default = "25%";
+        description = ''
+          The maximum in-memory storage capacity available to store temporary
+          data for SQL queries.
+
+          This can be a percentage, expressed with a fraction sign or as a
+          decimal-point number, or any bytes-based unit. For example, "25%",
+          "0.25" both represent 25% of the available system memory. The values
+          "1000000000" and "1GB" both represent 1 gigabyte of memory.
+        '';
+      };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.cockroachdb;
+        defaultText = "pkgs.cockroachdb";
+        description = ''
+          The CockroachDB derivation to use for running the service.
+          
+          This would primarily be useful to enable Enterprise Edition features
+          in your own custom CockroachDB build (Nixpkgs CockroachDB binaries
+          only contain open source features and open source code).
+        '';
+      };
+    };
+  };
+
+  config = mkIf config.services.cockroachdb.enable {
+    assertions = [
+      { assertion = !cfg.insecure -> !(isNull cfg.certsDir);
+        message = "CockroachDB must have a set of SSL certificates (.certsDir), or run in Insecure Mode (.insecure = true)";
+      }
+    ];
+
+    environment.systemPackages = [ crdb ];
+
+    users.users = optionalAttrs (cfg.user == "cockroachdb") (singleton
+      { name        = "cockroachdb";
+        description = "CockroachDB Server User";
+        uid         = config.ids.uids.cockroachdb;
+        group       = cfg.group;
+      });
+
+    users.groups = optionalAttrs (cfg.group == "cockroachdb") (singleton
+      { name = "cockroachdb";
+        gid  = config.ids.gids.cockroachdb;
+      });
+
+    networking.firewall.allowedTCPPorts = lib.optionals cfg.openPorts
+      [ cfg.http.port cfg.listen.port ];
+
+    systemd.services.cockroachdb =
+      { description   = "CockroachDB Server";
+        documentation = [ "man:cockroach(1)" "https://www.cockroachlabs.com" ];
+
+        after    = [ "network.target" "time-sync.target" ];
+        requires = [ "time-sync.target" ];
+        wantedBy = [ "multi-user.target" ];
+
+        unitConfig.RequiresMountsFor = "${cfg.dataDir}";
+
+        preStart = ''
+          if ! test -e ${cfg.dataDir}; then
+            mkdir -m 0700 -p ${cfg.dataDir}
+            chown -R ${cfg.user} ${cfg.dataDir}
+          fi
+        '';
+
+        serviceConfig =
+          { ExecStart = startupCommand;
+            Type = "notify";
+            User = cfg.user;
+            PermissionsStartOnly = true;
+
+            Restart = "always";
+            TimeoutStopSec="60";
+            RestartSec="10";
+            StandardOutput="syslog";
+            StandardError="syslog";
+            SyslogIdentifier="cockroach";
+          };
+      };
+  };
+
+  meta.maintainers = with lib.maintainers; [ thoughtpolice ];
+}
diff --git a/nixos/modules/services/editors/emacs.xml b/nixos/modules/services/editors/emacs.xml
index 6cf20cf4aa7..1ac53c818a7 100644
--- a/nixos/modules/services/editors/emacs.xml
+++ b/nixos/modules/services/editors/emacs.xml
@@ -11,7 +11,7 @@
       Rodney Lorrimar @rvl
   -->
  <para>
-  <link xlink:href="http://www.gnu.org/software/emacs/">Emacs</link> is an
+  <link xlink:href="https://www.gnu.org/software/emacs/">Emacs</link> is an
   extensible, customizable, self-documenting real-time display editor — and
   more. At its core is an interpreter for Emacs Lisp, a dialect of the Lisp
   programming language with extensions to support text editing.
diff --git a/nixos/modules/services/misc/bees.nix b/nixos/modules/services/misc/bees.nix
new file mode 100644
index 00000000000..b0ed2d5c286
--- /dev/null
+++ b/nixos/modules/services/misc/bees.nix
@@ -0,0 +1,123 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.beesd;
+
+  logLevels = { emerg = 0; alert = 1; crit = 2; err = 3; warning = 4; notice = 5; info = 6; debug = 7; };
+
+  fsOptions = with types; {
+    options.spec = mkOption {
+      type = str;
+      description = ''
+        Description of how to identify the filesystem to be duplicated by this
+        instance of bees. Note that deduplication crosses subvolumes; one must
+        not configure multiple instances for subvolumes of the same filesystem
+        (or block devices which are part of the same filesystem), but only for
+        completely independent btrfs filesystems.
+        </para>
+        <para>
+        This must be in a format usable by findmnt; that could be a key=value
+        pair, or a bare path to a mount point.
+      '';
+      example = "LABEL=MyBulkDataDrive";
+    };
+    options.hashTableSizeMB = mkOption {
+      type = types.addCheck types.int (n: mod n 16 == 0);
+      default = 1024; # 1GB; default from upstream beesd script
+      description = ''
+        Hash table size in MB; must be a multiple of 16.
+        </para>
+        <para>
+        A larger ratio of index size to storage size means smaller blocks of
+        duplicate content are recognized.
+        </para>
+        <para>
+        If you have 1TB of data, a 4GB hash table (which is to say, a value of
+        4096) will permit 4KB extents (the smallest possible size) to be
+        recognized, whereas a value of 1024 -- creating a 1GB hash table --
+        will recognize only aligned duplicate blocks of 16KB.
+      '';
+    };
+    options.verbosity = mkOption {
+      type = types.enum (attrNames logLevels ++ attrValues logLevels);
+      apply = v: if isString v then logLevels.${v} else v;
+      default = "info";
+      description = "Log verbosity (syslog keyword/level).";
+    };
+    options.workDir = mkOption {
+      type = str;
+      default = ".beeshome";
+      description = ''
+        Name (relative to the root of the filesystem) of the subvolume where
+        the hash table will be stored.
+      '';
+    };
+    options.extraOptions = mkOption {
+      type = listOf str;
+      default = [];
+      description = ''
+        Extra command-line options passed to the daemon. See upstream bees documentation.
+      '';
+      example = literalExample ''
+        [ "--thread-count" "4" ]
+      '';
+    };
+  };
+
+in {
+
+  options.services.beesd = {
+    filesystems = mkOption {
+      type = with types; attrsOf (submodule fsOptions);
+      description = "BTRFS filesystems to run block-level deduplication on.";
+      default = { };
+      example = literalExample ''
+        {
+          root = {
+            spec = "LABEL=root";
+            hashTableSizeMB = 2048;
+            verbosity = "crit";
+            extraOptions = [ "--loadavg-target" "5.0" ];
+          };
+        }
+      '';
+    };
+  };
+  config = {
+    systemd.services = mapAttrs' (name: fs: nameValuePair "beesd@${name}" {
+      description = "Block-level BTRFS deduplication for %i";
+      after = [ "sysinit.target" ];
+
+      serviceConfig = let
+        configOpts = [
+          fs.spec
+          "verbosity=${toString fs.verbosity}"
+          "idxSizeMB=${toString fs.hashTableSizeMB}"
+          "workDir=${fs.workDir}"
+        ];
+        configOptsStr = escapeShellArgs configOpts;
+      in {
+        # Values from https://github.com/Zygo/bees/blob/v0.6.1/scripts/beesd%40.service.in
+        ExecStart = "${pkgs.bees}/bin/bees-service-wrapper run ${configOptsStr} -- --no-timestamps ${escapeShellArgs fs.extraOptions}";
+        ExecStopPost = "${pkgs.bees}/bin/bees-service-wrapper cleanup ${configOptsStr}";
+        CPUAccounting = true;
+        CPUWeight = 12;
+        IOSchedulingClass = "idle";
+        IOSchedulingPriority = 7;
+        IOWeight = 10;
+        KillMode = "control-group";
+        KillSignal = "SIGTERM";
+        MemoryAccounting = true;
+        Nice = 19;
+        Restart = "on-abnormal";
+        StartupCPUWeight = 25;
+        StartupIOWeight = 25;
+        SyslogIdentifier = "bees"; # would otherwise be "bees-service-wrapper"
+      };
+      wantedBy = ["multi-user.target"];
+    }) cfg.filesystems;
+  };
+}
diff --git a/nixos/modules/services/networking/chrony.nix b/nixos/modules/services/networking/chrony.nix
index 9b8005e706a..77f70257700 100644
--- a/nixos/modules/services/networking/chrony.nix
+++ b/nixos/modules/services/networking/chrony.nix
@@ -12,7 +12,7 @@ let
     ${concatMapStringsSep "\n" (server: "server " + server) cfg.servers}
 
     ${optionalString
-      cfg.initstepslew.enabled
+      (cfg.initstepslew.enabled && (cfg.servers != []))
       "initstepslew ${toString cfg.initstepslew.threshold} ${concatStringsSep " " cfg.initstepslew.servers}"
     }
 
@@ -113,6 +113,7 @@ in
           chown chrony:chrony ${stateDir} ${keyFile}
         '';
 
+        unitConfig.ConditionCapability = "CAP_SYS_TIME";
         serviceConfig =
           { Type = "forking";
             ExecStart = "${pkgs.chrony}/bin/chronyd ${chronyFlags}";
@@ -121,8 +122,8 @@ in
             ProtectSystem = "full";
             PrivateTmp = "yes";
 
-            ConditionCapability = "CAP_SYS_TIME";
           };
+
       };
   };
 }
diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix
index efdbca5d52e..c217ccaa405 100644
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@@ -71,7 +71,7 @@ let
           # anything ever again ("couldn't resolve ..., giving up on
           # it"), so we silently lose time synchronisation. This also
           # applies to openntpd.
-          ${config.systemd.package}/bin/systemctl try-reload-or-restart ntpd.service openntpd.service || true
+          ${config.systemd.package}/bin/systemctl try-reload-or-restart ntpd.service openntpd.service chronyd.service || true
       fi
 
       ${cfg.runHook}
diff --git a/nixos/modules/services/search/kibana.nix b/nixos/modules/services/search/kibana.nix
index ca36bba58c0..3539b3ddb4f 100644
--- a/nixos/modules/services/search/kibana.nix
+++ b/nixos/modules/services/search/kibana.nix
@@ -149,7 +149,10 @@ in {
       after = [ "network.target" "elasticsearch.service" ];
       environment = { BABEL_CACHE_PATH = "${cfg.dataDir}/.babelcache.json"; };
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/kibana --config ${cfgFile}";
+        ExecStart =
+          "${cfg.package}/bin/kibana" +
+          " --config ${cfgFile}" +
+          " --path.data ${cfg.dataDir}";
         User = "kibana";
         WorkingDirectory = cfg.dataDir;
       };
diff --git a/nixos/tests/bees.nix b/nixos/tests/bees.nix
new file mode 100644
index 00000000000..6f68c2f834f
--- /dev/null
+++ b/nixos/tests/bees.nix
@@ -0,0 +1,55 @@
+import ./make-test.nix ({ lib, ... }:
+{
+  name = "bees";
+
+  machine = { config, pkgs, ... }: {
+    boot.initrd.postDeviceCommands = ''
+      ${pkgs.btrfs-progs}/bin/mkfs.btrfs -f -L aux1 /dev/vdb
+      ${pkgs.btrfs-progs}/bin/mkfs.btrfs -f -L aux2 /dev/vdc
+    '';
+    virtualisation.emptyDiskImages = [ 4096 4096 ];
+    fileSystems = lib.mkVMOverride {
+      "/aux1" = { # filesystem configured to be deduplicated
+        device = "/dev/disk/by-label/aux1";
+        fsType = "btrfs";
+      };
+      "/aux2" = { # filesystem not configured to be deduplicated
+        device = "/dev/disk/by-label/aux2";
+        fsType = "btrfs";
+      };
+    };
+    services.beesd.filesystems = {
+      aux1 = {
+        spec = "LABEL=aux1";
+        hashTableSizeMB = 16;
+        verbosity = "debug";
+      };
+    };
+  };
+
+  testScript =
+  let
+    withRetry = content: maxTests: sleepTime: ''
+      max_tests=${lib.escapeShellArg maxTests}; sleep_time=${lib.escapeShellArg sleepTime}; for ((i=0; i<max_tests; i++)); do ${content} && exit 0; sleep "$sleep_time"; done; exit 1;
+    '';
+    someContentIsShared = loc: ''[[ $(btrfs fi du -s --raw ${lib.escapeShellArg loc}/dedup-me-{1,2} | awk 'BEGIN { count=0; } NR>1 && $3 == 0 { count++ } END { print count }') -eq 0 ]]'';
+  in ''
+    # shut down the instance started by systemd at boot, so we can test our test procedure
+    $machine->succeed("systemctl stop beesd\@aux1.service");
+
+    $machine->succeed("dd if=/dev/urandom of=/aux1/dedup-me-1 bs=1M count=8");
+    $machine->succeed("cp --reflink=never /aux1/dedup-me-1 /aux1/dedup-me-2");
+    $machine->succeed("cp --reflink=never /aux1/* /aux2/");
+    $machine->succeed("sync");
+    $machine->fail(q(${someContentIsShared "/aux1"}));
+    $machine->fail(q(${someContentIsShared "/aux2"}));
+    $machine->succeed("systemctl start beesd\@aux1.service");
+
+    # assert that "Set Shared" column is nonzero
+    $machine->succeed(q(${withRetry (someContentIsShared "/aux1") 20 2}));
+    $machine->fail(q(${someContentIsShared "/aux2"}));
+
+    # assert that 16MB hash table size requested was honored
+    $machine->succeed(q([[ $(stat -c %s /aux1/.beeshome/beeshash.dat) = $(( 16 * 1024 * 1024)) ]]))
+  '';
+})
diff --git a/nixos/tests/cockroachdb.nix b/nixos/tests/cockroachdb.nix
new file mode 100644
index 00000000000..56c624d8cf2
--- /dev/null
+++ b/nixos/tests/cockroachdb.nix
@@ -0,0 +1,126 @@
+# This performs a full 'end-to-end' test of a multi-node CockroachDB cluster
+# using the built-in 'cockroach workload' command, to simulate a semi-realistic
+# test load. It generally takes anywhere from 3-5 minutes to run and 1-2GB of
+# RAM (though each of 3 workers gets 1GB allocated)
+#
+# CockroachDB requires synchronized system clocks within a small error window
+# (~500ms by default) on each node in order to maintain a multi-node cluster.
+# Cluster joins that are outside this window will fail, and nodes that skew
+# outside the window after joining will promptly get kicked out.
+#
+# To accomodate this, we use QEMU/virtio infrastructure and load the 'ptp_kvm'
+# driver inside a guest. This driver allows the host machine to pass its clock
+# through to the guest as a hardware clock that appears as a Precision Time
+# Protocol (PTP) Clock device, generally /dev/ptp0. PTP devices can be measured
+# and used as hardware reference clocks (similar to an on-board GPS clock) by
+# NTP software. In our case, we use Chrony to synchronize to the reference
+# clock.
+#
+# This test is currently NOT enabled as a continuously-checked NixOS test.
+# Ideally, this test would be run by Hydra and Borg on all relevant changes,
+# except:
+#
+#   - Not every build machine is compatible with the ptp_kvm driver.
+#     Virtualized EC2 instances, for example, do not support loading the ptp_kvm
+#     driver into guests. However, bare metal builders (e.g. Packet) do seem to
+#     work just fine. In practice, this means x86_64-linux builds would fail
+#     randomly, depending on which build machine got the job. (This is probably
+#     worth some investigation; I imagine it's based on ptp_kvm's usage of paravirt
+#     support which may not be available in 'nested' environments.)
+#
+#   - ptp_kvm is not supported on aarch64, otherwise it seems likely Cockroach
+#     could be tested there, as well. This seems to be due to the usage of
+#     the TSC in ptp_kvm, which isn't supported (easily) on AArch64. (And:
+#     testing stuff, not just making sure it builds, is important to ensure
+#     aarch64 support remains viable.)
+#
+# For future developers who are reading this message, are daring and would want
+# to fix this, some options are:
+#
+#   - Just test a single node cluster instead (boring and less thorough).
+#   - Move all CI to bare metal packet builders, and we can at least do x86_64-linux.
+#   - Get virtualized clocking working in aarch64, somehow.
+#   - Add a 4th node that acts as an NTP service and uses no PTP clocks for
+#     references, at the client level. This bloats the node and memory
+#     requirements, but would probably allow both aarch64/x86_64 to work.
+#
+
+let
+
+  # Creates a node. If 'joinNode' parameter, a string containing an IP address,
+  # is non-null, then the CockroachDB server will attempt to join/connect to
+  # the cluster node specified at that address.
+  makeNode = locality: myAddr: joinNode:
+    { nodes, pkgs, lib, config, ... }:
+
+    {
+      # Bank/TPC-C benchmarks take some memory to complete
+      virtualisation.memorySize = 1024;
+
+      # Install the KVM PTP "Virtualized Clock" driver. This allows a /dev/ptp0
+      # device to appear as a reference clock, synchronized to the host clock.
+      # Because CockroachDB *requires* a time-synchronization mechanism for
+      # the system time in a cluster scenario, this is necessary to work.
+      boot.kernelModules = [ "ptp_kvm" ];
+
+      # Enable and configure Chrony, using the given virtualized clock passed
+      # through by KVM.
+      services.chrony.enable = true;
+      services.chrony.servers = lib.mkForce [ ];
+      services.chrony.extraConfig = ''
+        refclock PHC /dev/ptp0 poll 2 prefer require refid KVM
+        makestep 0.1 3
+      '';
+
+      # Enable CockroachDB. In order to ensure that Chrony has performed its
+      # first synchronization at boot-time (which may take ~10 seconds) before
+      # starting CockroachDB, we block the ExecStartPre directive using the
+      # 'waitsync' command. This ensures Cockroach doesn't have its system time
+      # leap forward out of nowhere during startup/execution.
+      #
+      # Note that the default threshold for NTP-based skew in CockroachDB is
+      # ~500ms by default, so making sure it's started *after* accurate time
+      # synchronization is extremely important.
+      services.cockroachdb.enable = true;
+      services.cockroachdb.insecure = true;
+      services.cockroachdb.openPorts = true;
+      services.cockroachdb.locality = locality;
+      services.cockroachdb.listen.address = myAddr;
+      services.cockroachdb.join = lib.mkIf (joinNode != null) joinNode;
+
+      # Hold startup until Chrony has performed its first measurement (which
+      # will probably result in a full timeskip, thanks to makestep)
+      systemd.services.cockroachdb.preStart = ''
+        ${pkgs.chrony}/bin/chronyc waitsync
+      '';
+    };
+
+in import ./make-test.nix ({ pkgs, ...} : {
+  name = "cockroachdb";
+  meta.maintainers = with pkgs.stdenv.lib.maintainers;
+    [ thoughtpolice ];
+
+  nodes = rec {
+    node1 = makeNode "country=us,region=east,dc=1"  "192.168.1.1" null;
+    node2 = makeNode "country=us,region=west,dc=2b" "192.168.1.2" "192.168.1.1";
+    node3 = makeNode "country=eu,region=west,dc=2"  "192.168.1.3" "192.168.1.1";
+  };
+
+  # NOTE: All the nodes must start in order and you must NOT use startAll, because
+  # there's otherwise no way to guarantee that node1 will start before the others try
+  # to join it.
+  testScript = ''
+    $node1->start;
+    $node1->waitForUnit("cockroachdb");
+
+    $node2->start;
+    $node2->waitForUnit("cockroachdb");
+
+    $node3->start;
+    $node3->waitForUnit("cockroachdb");
+
+    $node1->mustSucceed("cockroach sql --host=192.168.1.1 --insecure -e 'SHOW ALL CLUSTER SETTINGS' 2>&1");
+    $node1->mustSucceed("cockroach workload init bank 'postgresql://root\@192.168.1.1:26257?sslmode=disable'");
+    $node1->mustSucceed("cockroach workload run bank --duration=1m 'postgresql://root\@192.168.1.1:26257?sslmode=disable'");
+  '';
+})
diff --git a/pkgs/applications/audio/faust/faust1.nix b/pkgs/applications/audio/faust/faust1.nix
index bf5bb781585..6e47d921d34 100644
--- a/pkgs/applications/audio/faust/faust1.nix
+++ b/pkgs/applications/audio/faust/faust1.nix
@@ -18,7 +18,7 @@ let
 
   meta = with stdenv.lib; {
     homepage = http://faust.grame.fr/;
-    downloadPage = http://sourceforge.net/projects/faudiostream/files/;
+    downloadPage = https://sourceforge.net/projects/faudiostream/files/;
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ magnetophon pmahoney ];
diff --git a/pkgs/applications/audio/faust/faust2.nix b/pkgs/applications/audio/faust/faust2.nix
index cfb37e5761a..383d2deb10b 100644
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@@ -27,7 +27,7 @@ let
 
   meta = with stdenv.lib; {
     homepage = http://faust.grame.fr/;
-    downloadPage = http://sourceforge.net/projects/faudiostream/files/;
+    downloadPage = https://sourceforge.net/projects/faudiostream/files/;
     license = licenses.gpl2;
     platforms = platforms.linux;
     maintainers = with maintainers; [ magnetophon pmahoney ];
diff --git a/pkgs/applications/audio/lash/default.nix b/pkgs/applications/audio/lash/default.nix
index da61eee3b64..9d295073597 100644
--- a/pkgs/applications/audio/lash/default.nix
+++ b/pkgs/applications/audio/lash/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation  rec {
     longDescription = ''
       Session management system for GNU/Linux audio applications.
     '';
-    homepage = http://www.nongnu.org/lash;
+    homepage = https://www.nongnu.org/lash;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.goibhniu ];
diff --git a/pkgs/applications/audio/lingot/default.nix b/pkgs/applications/audio/lingot/default.nix
index 389db3d548d..d2ec92e0654 100644
--- a/pkgs/applications/audio/lingot/default.nix
+++ b/pkgs/applications/audio/lingot/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Not a Guitar-Only tuner";
-    homepage = http://www.nongnu.org/lingot/;
+    homepage = https://www.nongnu.org/lingot/;
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = with stdenv.lib.platforms; linux;
     maintainers = with stdenv.lib.maintainers; [viric];
diff --git a/pkgs/applications/audio/mi2ly/default.nix b/pkgs/applications/audio/mi2ly/default.nix
index 4dfc7b13046..58c1690a9bb 100644
--- a/pkgs/applications/audio/mi2ly/default.nix
+++ b/pkgs/applications/audio/mi2ly/default.nix
@@ -6,7 +6,7 @@ let
     version="0.12";
     name="${baseName}-${version}";
     hash="1b14zcwlvnxhjxr3ymyzg0mg4sbijkinzpxm641s859jxcgylmll";
-    url="http://download.savannah.gnu.org/releases/mi2ly/mi2ly.0.12.tar.bz2";
+    url="https://download.savannah.gnu.org/releases/mi2ly/mi2ly.0.12.tar.bz2";
     sha256="1b14zcwlvnxhjxr3ymyzg0mg4sbijkinzpxm641s859jxcgylmll";
   };
   buildInputs = [
diff --git a/pkgs/applications/audio/mi2ly/default.upstream b/pkgs/applications/audio/mi2ly/default.upstream
index 131f0e3a71d..0b2607989aa 100644
--- a/pkgs/applications/audio/mi2ly/default.upstream
+++ b/pkgs/applications/audio/mi2ly/default.upstream
@@ -1,3 +1,3 @@
-url http://download.savannah.gnu.org/releases/mi2ly/
+url https://download.savannah.gnu.org/releases/mi2ly/
 ensure_choice
 version '.*/mi2ly[.]([0-9.]+)[.]tar.*' '\1'
diff --git a/pkgs/applications/audio/mimms/default.nix b/pkgs/applications/audio/mimms/default.nix
index b9b840682d7..2d301a8b6a9 100644
--- a/pkgs/applications/audio/mimms/default.nix
+++ b/pkgs/applications/audio/mimms/default.nix
@@ -5,7 +5,7 @@ pythonPackages.buildPythonApplication rec {
   version = "3.2";
 
   src = fetchurl {
-    url = "http://download.savannah.gnu.org/releases/mimms/mimms-${version}.tar.bz2";
+    url = "https://download.savannah.gnu.org/releases/mimms/mimms-${version}.tar.bz2";
     sha256 = "0zmcd670mpq85cs3nvdq3i805ba0d1alqahfy1m9cpf7kxrivfml";
   };
 
diff --git a/pkgs/applications/audio/normalize/default.nix b/pkgs/applications/audio/normalize/default.nix
index a727160ff29..85c902d3839 100644
--- a/pkgs/applications/audio/normalize/default.nix
+++ b/pkgs/applications/audio/normalize/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ libmad ];
 
   meta = with stdenv.lib; {
-    homepage = http://normalize.nongnu.org/;
+    homepage = https://www.nongnu.org/normalize/;
     description = "Audio file normalizer";
     license = licenses.gpl2;
     platforms = platforms.unix;
diff --git a/pkgs/applications/audio/sonata/default.nix b/pkgs/applications/audio/sonata/default.nix
index 3aaaae85639..012270905cc 100644
--- a/pkgs/applications/audio/sonata/default.nix
+++ b/pkgs/applications/audio/sonata/default.nix
@@ -61,7 +61,7 @@ in buildPythonApplication rec {
        - Commandline control
        - Available in 24 languages
     '';
-    homepage = http://www.nongnu.org/sonata/;
+    homepage = https://www.nongnu.org/sonata/;
     license = stdenv.lib.licenses.gpl3;
     platforms = stdenv.lib.platforms.linux;
     maintainers = [ stdenv.lib.maintainers.rvl ];
diff --git a/pkgs/applications/audio/whipper/default.nix b/pkgs/applications/audio/whipper/default.nix
index fa5845c260b..8b93175ce35 100644
--- a/pkgs/applications/audio/whipper/default.nix
+++ b/pkgs/applications/audio/whipper/default.nix
@@ -3,17 +3,17 @@
 
 python2.pkgs.buildPythonApplication rec {
   name = "whipper-${version}";
-  version = "0.7.0";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "whipper-team";
     repo = "whipper";
     rev = "v${version}";
-    sha256 = "04m8s0s9dcnly9l6id8vv99n9kbjrjid79bss52ay9yvwng0frmj";
+    sha256 = "17cn11c6c62pfhhp6vcslxpanb0czh2xbxq1g6wd7bpmgw38yd8v";
   };
 
   pythonPath = with python2.pkgs; [
-    pygobject2 musicbrainzngs urllib3 chardet
+    pygobject3 musicbrainzngs urllib3 chardet
     pycdio setuptools mutagen CDDB
     requests
   ];
@@ -25,11 +25,14 @@ python2.pkgs.buildPythonApplication rec {
   patches = [
     (substituteAll {
       src = ./paths.patch;
-      inherit cdrdao cdparanoia utillinux flac sox;
-      accurateripChecksum = accuraterip-checksum;
+      inherit cdparanoia;
     })
   ];
 
+  makeWrapperArgs = [
+    "--prefix" "PATH" ":" "${stdenv.lib.makeBinPath [ accuraterip-checksum cdrdao utillinux flac sox ]}"
+  ];
+
   # some tests require internet access
   # https://github.com/JoeLametta/whipper/issues/291
   doCheck = false;
diff --git a/pkgs/applications/audio/whipper/paths.patch b/pkgs/applications/audio/whipper/paths.patch
index 9fe9f7a57c5..14b5384330d 100644
--- a/pkgs/applications/audio/whipper/paths.patch
+++ b/pkgs/applications/audio/whipper/paths.patch
@@ -1,16 +1,3 @@
---- a/whipper/program/arc.py
-+++ b/whipper/program/arc.py
-@@ -3,8 +3,8 @@
- import logging
- logger = logging.getLogger(__name__)
- 
--ARB = 'accuraterip-checksum'
--FLAC = 'flac'
-+ARB = '@accurateripChecksum@/bin/accuraterip-checksum'
-+FLAC = '@flac@/bin/flac'
- 
- 
- def _execute(cmd, **redirects):
 --- a/whipper/program/cdparanoia.py
 +++ b/whipper/program/cdparanoia.py
 @@ -280,10 +280,10 @@
@@ -43,63 +30,3 @@
 +        self.command = ['@cdparanoia@/bin/cdparanoia', '-A']
          if device:
              self.command += ['-d', device]
- 
---- a/whipper/program/cdrdao.py
-+++ b/whipper/program/cdrdao.py
-@@ -9,7 +9,7 @@
- import logging
- logger = logging.getLogger(__name__)
- 
--CDRDAO = 'cdrdao'
-+CDRDAO = '@cdrdao@/bin/cdrdao'
- 
- 
- def read_toc(device, fast_toc=False):
---- a/whipper/program/sox.py
-+++ b/whipper/program/sox.py
-@@ -4,7 +4,7 @@
- import logging
- logger = logging.getLogger(__name__)
- 
--SOX = 'sox'
-+SOX = '@sox@/bin/sox'
- 
- 
- def peak_level(track_path):
---- a/whipper/program/soxi.py
-+++ b/whipper/program/soxi.py
-@@ -6,7 +6,7 @@
- import logging
- logger = logging.getLogger(__name__)
- 
--SOXI = 'soxi'
-+SOXI = '@sox@/bin/soxi'
- 
- 
- class AudioLengthTask(ctask.PopenTask):
---- a/whipper/program/utils.py
-+++ b/whipper/program/utils.py
-@@ -9,7 +9,7 @@
-     Eject the given device.
-     """
-     logger.debug("ejecting device %s", device)
--    os.system('eject %s' % device)
-+    os.system('@utillinux@/bin/eject %s' % device)
- 
- 
- def load_device(device):
-@@ -17,7 +17,7 @@
-     Load the given device.
-     """
-     logger.debug("loading (eject -t) device %s", device)
--    os.system('eject -t %s' % device)
-+    os.system('@utillinux@/bin/eject -t %s' % device)
- 
- 
- def unmount_device(device):
-@@ -32,4 +32,4 @@
-     proc = open('/proc/mounts').read()
-     if device in proc:
-         print 'Device %s is mounted, unmounting' % device
--        os.system('umount %s' % device)
-+        os.system('@utillinux@/bin/umount %s' % device)
diff --git a/pkgs/applications/editors/ed/default.nix b/pkgs/applications/editors/ed/default.nix
index 536b319cab0..afbd6d908c3 100644
--- a/pkgs/applications/editors/ed/default.nix
+++ b/pkgs/applications/editors/ed/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (rec {
 
     license = stdenv.lib.licenses.gpl3Plus;
 
-    homepage = http://www.gnu.org/software/ed/;
+    homepage = https://www.gnu.org/software/ed/;
 
     maintainers = [ ];
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/applications/editors/emacs-modes/bbdb/3.nix b/pkgs/applications/editors/emacs-modes/bbdb/3.nix
index 44116fbac0c..d20ab53bf7e 100644
--- a/pkgs/applications/editors/emacs-modes/bbdb/3.nix
+++ b/pkgs/applications/editors/emacs-modes/bbdb/3.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "bbdb-3.1.2";
 
   src = fetchurl {
-    url = "http://download.savannah.gnu.org/releases/bbdb/${name}.tar.gz";
+    url = "https://download.savannah.gnu.org/releases/bbdb/${name}.tar.gz";
     sha256 = "1gs16bbpiiy01w9pyg12868r57kx1v3hnw04gmqsmpc40l1hyy05";
   };
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = http://savannah.nongnu.org/projects/bbdb/;
+    homepage = https://savannah.nongnu.org/projects/bbdb/;
     description = "The Insidious Big Brother Database (BBDB), a contact management utility for Emacs, version 3";
     license = "GPL";
   };
diff --git a/pkgs/applications/editors/emacs-modes/color-theme/default.nix b/pkgs/applications/editors/emacs-modes/color-theme/default.nix
index a3d76a307c7..407b9e58f0b 100644
--- a/pkgs/applications/editors/emacs-modes/color-theme/default.nix
+++ b/pkgs/applications/editors/emacs-modes/color-theme/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Emacs-lisp mode for skinning your Emacs";
-    homepage = http://www.nongnu.org/color-theme;
+    homepage = https://www.nongnu.org/color-theme;
     license = stdenv.lib.licenses.gpl2Plus;
 
     platforms = stdenv.lib.platforms.all;
diff --git a/pkgs/applications/editors/emacs-modes/emms/default.nix b/pkgs/applications/editors/emacs-modes/emms/default.nix
index c873a7c0ca8..f966989b5a3 100644
--- a/pkgs/applications/editors/emacs-modes/emms/default.nix
+++ b/pkgs/applications/editors/emacs-modes/emms/default.nix
@@ -8,7 +8,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     # These guys don't use ftp.gnu.org...
-    url = "http://www.gnu.org/software/emms/download/${name}.tar.gz";
+    url = "https://www.gnu.org/software/emms/download/${name}.tar.gz";
     sha256 = "151mfx97x15lfpd1qc2sqbvhwhvg46axgh15qyqmdy42vh906xav";
   };
 
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
       support, with no effort from your side.
     '';
 
-    homepage = http://www.gnu.org/software/emms/;
+    homepage = https://www.gnu.org/software/emms/;
 
     license = stdenv.lib.licenses.gpl3Plus;
 
diff --git a/pkgs/applications/editors/emacs-modes/font-lock-plus/default.nix b/pkgs/applications/editors/emacs-modes/font-lock-plus/default.nix
index b4ee54f3bd3..fdb28f44719 100644
--- a/pkgs/applications/editors/emacs-modes/font-lock-plus/default.nix
+++ b/pkgs/applications/editors/emacs-modes/font-lock-plus/default.nix
@@ -1,7 +1,7 @@
-{ fetchurl, lib, melpaBuild }:
+{ fetchurl, lib, melpaBuild, writeText }:
 
 melpaBuild {
-  pname = "font-lock-plus";
+  pname = "font-lock+";
   version = "20180101.25";
 
   src = fetchurl {
@@ -10,11 +10,7 @@ melpaBuild {
     name = "font-lock+.el";
   };
 
-  recipe = fetchurl {
-    url = "https://raw.githubusercontent.com/milkypostman/melpa/a5d15f875b0080b12ce45cf696c581f6bbf061ba/recipes/font-lock+";
-    sha256 = "1wn99cb53ykds87lg9mrlfpalrmjj177nwskrnp9wglyqs65lk4g";
-    name = "font-lock-plus";
-  };
+  recipe = writeText "recipe" "(font-lock+ :fetcher github :repo \"\")";
 
   meta = {
     homepage = "https://melpa.org/#/font-lock+";
diff --git a/pkgs/applications/editors/emacs-modes/let-alist/default.nix b/pkgs/applications/editors/emacs-modes/let-alist/default.nix
index 05ddfbf6c16..f6fee846f92 100644
--- a/pkgs/applications/editors/emacs-modes/let-alist/default.nix
+++ b/pkgs/applications/editors/emacs-modes/let-alist/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "let-alist-1.0.3";
 
   src = fetchurl {
-    url = "http://elpa.gnu.org/packages/let-alist-1.0.3.el";
+    url = "https://elpa.gnu.org/packages/let-alist-1.0.3.el";
     sha256 = "12n1cmjc7hzyy0jmsdxqz1hqzg4ri4nvvi0p9mw1d6v44xzfm0mx";
   };
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = http://elpa.gnu.org/packages/let-alist.html;
+    homepage = https://elpa.gnu.org/packages/let-alist.html;
     description = "Easily let-bind values of an assoc-list by their names";
     license = stdenv.lib.licenses.gpl3Plus;
   };
diff --git a/pkgs/applications/editors/emacs/25.nix b/pkgs/applications/editors/emacs/25.nix
index 6576cd54472..d9f0b211f15 100644
--- a/pkgs/applications/editors/emacs/25.nix
+++ b/pkgs/applications/editors/emacs/25.nix
@@ -114,7 +114,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "The extensible, customizable GNU text editor";
-    homepage    = http://www.gnu.org/software/emacs/;
+    homepage    = https://www.gnu.org/software/emacs/;
     license     = licenses.gpl3Plus;
     maintainers = with maintainers; [ chaoflow lovek323 peti the-kenny jwiegley ];
     platforms   = platforms.all;
diff --git a/pkgs/applications/editors/emacs/default.nix b/pkgs/applications/editors/emacs/default.nix
index e95d2b61535..948d8cb9867 100644
--- a/pkgs/applications/editors/emacs/default.nix
+++ b/pkgs/applications/editors/emacs/default.nix
@@ -119,7 +119,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "The extensible, customizable GNU text editor";
-    homepage    = http://www.gnu.org/software/emacs/;
+    homepage    = https://www.gnu.org/software/emacs/;
     license     = licenses.gpl3Plus;
     maintainers = with maintainers; [ chaoflow lovek323 peti the-kenny jwiegley ];
     platforms   = platforms.all;
diff --git a/pkgs/applications/editors/emacs/macport.nix b/pkgs/applications/editors/emacs/macport.nix
index 7070ce59738..3b32eef4e03 100644
--- a/pkgs/applications/editors/emacs/macport.nix
+++ b/pkgs/applications/editors/emacs/macport.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "The extensible, customizable text editor";
-    homepage    = http://www.gnu.org/software/emacs/;
+    homepage    = https://www.gnu.org/software/emacs/;
     license     = licenses.gpl3Plus;
     maintainers = with maintainers; [ jwiegley matthewbauer ];
     platforms   = platforms.darwin;
diff --git a/pkgs/applications/editors/leafpad/default.nix b/pkgs/applications/editors/leafpad/default.nix
index dd3fb542da7..c3b46cf61df 100644
--- a/pkgs/applications/editors/leafpad/default.nix
+++ b/pkgs/applications/editors/leafpad/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   version = "0.8.18.1";
   name = "leafpad-${version}";
   src = fetchurl {
-    url = "http://download.savannah.gnu.org/releases/leafpad/${name}.tar.gz";
+    url = "https://download.savannah.gnu.org/releases/leafpad/${name}.tar.gz";
     sha256 = "0b0az2wvqgvam7w0ns1j8xp2llslm1rx6h7zcsy06a7j0yp257cm";
   };
 
diff --git a/pkgs/applications/editors/moe/default.nix b/pkgs/applications/editors/moe/default.nix
index 764877a11cb..64843b2f070 100644
--- a/pkgs/applications/editors/moe/default.nix
+++ b/pkgs/applications/editors/moe/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
       completion, directory browser, duplicate removal from prompt histories,
       delimiter matching, text conversion from/to UTF-8, romanization, etc.
     '';
-    homepage = http://www.gnu.org/software/moe/;
+    homepage = https://www.gnu.org/software/moe/;
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ AndersonTorres ];
     platforms = platforms.unix;
diff --git a/pkgs/applications/editors/textadept/default.nix b/pkgs/applications/editors/textadept/default.nix
index 818183b9852..f17f5a9a26a 100644
--- a/pkgs/applications/editors/textadept/default.nix
+++ b/pkgs/applications/editors/textadept/default.nix
@@ -64,7 +64,7 @@ let
   gtdialog_url   = "http://foicica.com/gtdialog/download/" + gtdialog_zip;
   lspawn_url     = "http://foicica.com/lspawn/download/" + lspawn_zip;
 
-  scintilla_url  = "http://prdownloads.sourceforge.net/scintilla/" + scintilla_tgz;
+  scintilla_url  = "mirror://sourceforge/scintilla/" + scintilla_tgz;
   lua_url        = "http://www.lua.org/ftp/" + lua_tgz;
   lpeg_url       = "http://www.inf.puc-rio.br/~roberto/lpeg/" + lpeg_tgz;
   lfs_url        = "https://github.com/keplerproject/luafilesystem/archive/" + lfs_zip;
diff --git a/pkgs/applications/editors/zile/default.nix b/pkgs/applications/editors/zile/default.nix
index 7213b22c949..ae3871bb87a 100644
--- a/pkgs/applications/editors/zile/default.nix
+++ b/pkgs/applications/editors/zile/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
       compiles to about 130Kb.
     '';
 
-    homepage = http://www.gnu.org/software/zile/;
+    homepage = https://www.gnu.org/software/zile/;
 
     license = licenses.gpl3Plus;
 
diff --git a/pkgs/applications/graphics/pqiv/default.nix b/pkgs/applications/graphics/pqiv/default.nix
index e4f565b3b05..ec4ce69d5e8 100644
--- a/pkgs/applications/graphics/pqiv/default.nix
+++ b/pkgs/applications/graphics/pqiv/default.nix
@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation (rec {
   name = "pqiv-${version}";
-  version = "2.10.4";
+  version = "2.11";
 
   src = fetchFromGitHub {
     owner = "phillipberndt";
     repo = "pqiv";
     rev = version;
-    sha256 = "04fawc3sd625y1bbgfgwmak56pq28sm58dwn5db4h183iy3awdl9";
+    sha256 = "06cwm28b7j1skwp21s5snmj1pqh3xh6y2i5v4w3pz0b8k3053h9i";
   };
 
   nativeBuildInputs = [ pkgconfig ];
diff --git a/pkgs/applications/misc/aminal/default.nix b/pkgs/applications/misc/aminal/default.nix
index ebf78be7a08..77f758394e5 100644
--- a/pkgs/applications/misc/aminal/default.nix
+++ b/pkgs/applications/misc/aminal/default.nix
@@ -12,7 +12,7 @@
 
 buildGoPackage rec {
   name = "aminal-${version}";
-  version = "0.7.4";
+  version = "0.7.8";
 
   goPackagePath = "github.com/liamg/aminal";
 
@@ -36,7 +36,7 @@ buildGoPackage rec {
     owner = "liamg";
     repo = "aminal";
     rev = "v${version}";
-    sha256 = "0wnzxjlv98pi3gy4hp3d19pwpa4kf1h5rqy03s9bcqdbpb1v1b7v";
+    sha256 = "02gamvvs56w4zwqdvalbsgb2gbh0398gl7qk36pgyqkcgj3bcwv8";
   };
 
   preBuild = ''
diff --git a/pkgs/applications/misc/devilspie2/default.nix b/pkgs/applications/misc/devilspie2/default.nix
index 1ea45c3574a..4fb9ca5fa71 100644
--- a/pkgs/applications/misc/devilspie2/default.nix
+++ b/pkgs/applications/misc/devilspie2/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "0.43";
 
   src = fetchurl {
-    url = "http://download.savannah.gnu.org/releases/devilspie2/devilspie2_${version}-src.tar.gz";
+    url = "https://download.savannah.gnu.org/releases/devilspie2/devilspie2_${version}-src.tar.gz";
     sha256 = "0a7qjl2qd4099kkkbwa1y2fk48s21jlr409lf9mij7mlc9yc3zzc";
   };
 
diff --git a/pkgs/applications/misc/eaglemode/default.nix b/pkgs/applications/misc/eaglemode/default.nix
index b08ce5baa5b..0404ef8ce22 100644
--- a/pkgs/applications/misc/eaglemode/default.nix
+++ b/pkgs/applications/misc/eaglemode/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   # trick on NIX_LDFLAGS and dontPatchELF to make it find them.
   # I use 'yes y' to skip a build error linking with xineLib,
   # because xine stopped exporting "_x_vo_new_port"
-  #  http://sourceforge.net/projects/eaglemode/forums/forum/808824/topic/5115261
+  #  https://sourceforge.net/projects/eaglemode/forums/forum/808824/topic/5115261
   buildPhase = ''
     export NIX_LDFLAGS="$NIX_LDFLAGS -lXxf86vm -lXext"
     perl make.pl build
diff --git a/pkgs/applications/misc/gksu/default.nix b/pkgs/applications/misc/gksu/default.nix
index 712c2081f10..4af776674e6 100644
--- a/pkgs/applications/misc/gksu/default.nix
+++ b/pkgs/applications/misc/gksu/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
       programs that need to ask a user's password to run another program
       as another user.
     '';
-    homepage = http://www.nongnu.org/gksu/;
+    homepage = https://www.nongnu.org/gksu/;
     license = stdenv.lib.licenses.gpl2;
     maintainers = [ stdenv.lib.maintainers.romildo ];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/applications/misc/gtk2fontsel/default.nix b/pkgs/applications/misc/gtk2fontsel/default.nix
index 347d76860ef..cf409b4c185 100644
--- a/pkgs/applications/misc/gtk2fontsel/default.nix
+++ b/pkgs/applications/misc/gtk2fontsel/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
       Trivial, but useful nonetheless.
     '';
     homepage = http://gtk2fontsel.sourceforge.net/;
-    downloadPage = http://sourceforge.net/projects/gtk2fontsel/;
+    downloadPage = https://sourceforge.net/projects/gtk2fontsel/;
     license = licenses.gpl2;
     maintainers = [ maintainers.prikhi ];
     platforms = platforms.linux;
diff --git a/pkgs/applications/misc/gv/default.nix b/pkgs/applications/misc/gv/default.nix
index 036cb104b48..f94f8f5dd70 100644
--- a/pkgs/applications/misc/gv/default.nix
+++ b/pkgs/applications/misc/gv/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
   doCheck = true;
 
   meta = {
-    homepage = http://www.gnu.org/software/gv/;
+    homepage = https://www.gnu.org/software/gv/;
     description = "PostScript/PDF document viewer";
 
     longDescription = ''
diff --git a/pkgs/applications/misc/hello/default.nix b/pkgs/applications/misc/hello/default.nix
index 7998d30f253..c0a39d2d91d 100644
--- a/pkgs/applications/misc/hello/default.nix
+++ b/pkgs/applications/misc/hello/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
       GNU Hello is a program that prints "Hello, world!" when you run it.
       It is fully customizable.
     '';
-    homepage = http://www.gnu.org/software/hello/manual/;
+    homepage = https://www.gnu.org/software/hello/manual/;
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.eelco ];
     platforms = platforms.all;
diff --git a/pkgs/applications/misc/rofi/default.nix b/pkgs/applications/misc/rofi/default.nix
index 2d22d87c49a..63b047976b3 100644
--- a/pkgs/applications/misc/rofi/default.nix
+++ b/pkgs/applications/misc/rofi/default.nix
@@ -37,6 +37,6 @@ stdenv.mkDerivation rec {
     homepage = https://davedavenport.github.io/rofi;
     license = licenses.mit;
     maintainers = with maintainers; [ mbakke garbas ma27 ];
-    platforms = with platforms; unix;
+    platforms = with platforms; linux;
   };
 }
diff --git a/pkgs/applications/misc/xlog/default.nix b/pkgs/applications/misc/xlog/default.nix
index 3ba7062b7bb..c0b0ef63369 100644
--- a/pkgs/applications/misc/xlog/default.nix
+++ b/pkgs/applications/misc/xlog/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   version = "2.0.15";
   
   src = fetchurl {
-    url = "http://download.savannah.gnu.org/releases/xlog/${name}.tar.gz";
+    url = "https://download.savannah.gnu.org/releases/xlog/${name}.tar.gz";
     sha256 = "0an883wqw3zwpw8nqinm9cb17hp2xw9vf603k4l2345p61jqdw2j";
   };
 
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
          location in latitude and longitude and distance and heading in kilometers or miles,
          both for short and long path. 
       '';
-    homepage = http://www.nongnu.org/xlog;
+    homepage = https://www.nongnu.org/xlog;
     maintainers = [ maintainers.mafo ];
     license = licenses.gpl3;
     platforms = platforms.unix;
diff --git a/pkgs/applications/networking/browsers/firefox-bin/default.nix b/pkgs/applications/networking/browsers/firefox-bin/default.nix
index c81c7934985..2d9692c0528 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@@ -191,7 +191,7 @@ stdenv.mkDerivation {
   # update with:
   # $ nix-shell maintainers/scripts/update.nix --argstr package firefox-bin-unwrapped
   passthru.updateScript = import ./update.nix {
-    inherit name channel writeScript xidel coreutils gnused gnugrep gnupg curl;
+    inherit stdenv name channel writeScript xidel coreutils gnused gnugrep gnupg curl;
     baseUrl =
       if channel == "devedition"
         then "http://archive.mozilla.org/pub/devedition/releases/"
diff --git a/pkgs/applications/networking/browsers/firefox-bin/update.nix b/pkgs/applications/networking/browsers/firefox-bin/update.nix
index df928f88c38..ee022e329f9 100644
--- a/pkgs/applications/networking/browsers/firefox-bin/update.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/update.nix
@@ -1,4 +1,5 @@
-{ name
+{ stdenv
+, name
 , channel
 , writeScript
 , xidel
@@ -17,6 +18,7 @@ let
     channel != "release";
 
 in writeScript "update-${name}" ''
+  #!${stdenv.shell}
   PATH=${coreutils}/bin:${gnused}/bin:${gnugrep}/bin:${xidel}/bin:${curl}/bin:${gnupg}/bin
   set -eux
   pushd ${basePath}
diff --git a/pkgs/applications/networking/browsers/firefox/update.nix b/pkgs/applications/networking/browsers/firefox/update.nix
index a831d823118..07ae2c040e6 100644
--- a/pkgs/applications/networking/browsers/firefox/update.nix
+++ b/pkgs/applications/networking/browsers/firefox/update.nix
@@ -1,4 +1,5 @@
 { writeScript
+, stdenv
 , lib
 , xidel
 , common-updater-scripts
@@ -13,6 +14,7 @@
 }:
 
 writeScript "update-${attrPath}" ''
+  #!${stdenv.shell}
   PATH=${lib.makeBinPath [ common-updater-scripts coreutils curl gnugrep gnused xidel ]}
 
   url=${baseUrl}
diff --git a/pkgs/applications/networking/esniper/default.nix b/pkgs/applications/networking/esniper/default.nix
index ca4d8f2f49f..87e0584c931 100644
--- a/pkgs/applications/networking/esniper/default.nix
+++ b/pkgs/applications/networking/esniper/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ openssl curl ];
 
   # Add support for CURL_CA_BUNDLE variable.
-  # Fix <http://sourceforge.net/p/esniper/bugs/648/>.
+  # Fix <https://sourceforge.net/p/esniper/bugs/648/>.
   patches = [ ./find-ca-bundle.patch ];
 
   postInstall = ''
diff --git a/pkgs/applications/networking/instant-messengers/freetalk/default.nix b/pkgs/applications/networking/instant-messengers/freetalk/default.nix
index 5146f3a0e39..2c27853c944 100644
--- a/pkgs/applications/networking/instant-messengers/freetalk/default.nix
+++ b/pkgs/applications/networking/instant-messengers/freetalk/default.nix
@@ -31,6 +31,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus ;
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;
-    downloadPage = "http://www.gnu.org/software/freetalk/";
+    downloadPage = "https://www.gnu.org/software/freetalk/";
   };
 }
diff --git a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
index 2c6c74974cf..7cd3ad47c00 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
@@ -1,585 +1,585 @@
 {
-  version = "60.3.1";
+  version = "60.3.2";
   sources = [
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/ar/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/ar/thunderbird-60.3.2.tar.bz2";
       locale = "ar";
       arch = "linux-x86_64";
-      sha512 = "57b092a02666d2ca2d2b13b04bc00114b7e14b8b23b82f0af53f0d53485a8db117eea3408affcebff6431133bf337f07ecc111cdd8c5f50b4a93594ad07c0a29";
+      sha512 = "c051155472deab805e0e689d45ab82a952aecd19f91b2373cdfab3925a6b9fdebcd9a147c06e6ff491e1d1374cb03e2091220187801ab7f07f9d787c4fc4c269";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/ast/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/ast/thunderbird-60.3.2.tar.bz2";
       locale = "ast";
       arch = "linux-x86_64";
-      sha512 = "a0635e9006beec03cc5a6fb298cfc1f4bfce342bb537f1834d02f452e82285ac5853ea520c1275140ea812c742fcf19d5f6e662b7eba58bcf7e80d796236ca39";
+      sha512 = "099d5a43e4e037f33f9ae4f89c1958d9e7016cc5f5673eed74d3c37bde6590fc2e47bb832784561bcf9c4ed53decbde51372a83019e3c72bf09745b95aeaf74a";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/be/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/be/thunderbird-60.3.2.tar.bz2";
       locale = "be";
       arch = "linux-x86_64";
-      sha512 = "f2860e9508278895198d87b54ac2984d961221fa0bac20dba505d01d762ea7041127323c67cd2288d2372f37d82e0870c6a832ff4113fe914927a377e22ced99";
+      sha512 = "7e55877c3f75d9907e5cca8f7f423edc79d1bb072f96acf227fffe37375528dd5c40bf8b3d39151ac79ff510ad3e50f1940ea4df32a6cbb32a0afb085640aaba";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/bg/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/bg/thunderbird-60.3.2.tar.bz2";
       locale = "bg";
       arch = "linux-x86_64";
-      sha512 = "1d0070daf743b1c9e2b0a3471ff4f8bfd992279a422bb58daf6b7f96a6238adf654bfdf74d8414e758af2f033703a73cb0e1f71c0c72e0b7e61e62b6180ea185";
+      sha512 = "6230c26a960e962db8a0c4f8302df3ae471aa6b663bd7819da1b3ccd1b2f6db1fa207936502f7b8cf2eb47032efca7e6d0e1275223007758588df290ba9a9ac8";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/br/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/br/thunderbird-60.3.2.tar.bz2";
       locale = "br";
       arch = "linux-x86_64";
-      sha512 = "f2bb792417855409c993a2d2e9ae627b800ef3dfc7a78fd82f3af400c2c4c964757662659a32b039e20e0330b7f16b502d011a104798c2dcc47235a8c561b9a3";
+      sha512 = "8005b6b605d8a863a4b2b312a0126ffcd09a25072d11731eaab9f096f5e0b22e4fc8142d86d39505c48b6f73f96cf2d6ac4c2158d148338cbfa8c587b238063a";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/ca/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/ca/thunderbird-60.3.2.tar.bz2";
       locale = "ca";
       arch = "linux-x86_64";
-      sha512 = "e5ae4dbe02b38042ed64f399ea531203fd04d6358b70ddb2c67d29ccea45019a4226ea1719692ea48120c30af240d4d5470e4f64f09239dbfff2607569ad9bb7";
+      sha512 = "98be5d8e71110d4de311e15c448b71cceec37fce5b50b689ecdad0322c093a7e7d96caab9919a83b48af784bf4da7269274125cd5d351870dcb775c0453237ce";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/cs/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/cs/thunderbird-60.3.2.tar.bz2";
       locale = "cs";
       arch = "linux-x86_64";
-      sha512 = "b0f1440db8a329103f873a57988bc6fa66e36336752b7c215a952079f77182d91c6fdacc7815f74c18a4fe7c8a648e7aaf58cbb2fdabfda5b76daac81a602559";
+      sha512 = "35863fc6513dec41b256150a7a9c3bb9e45cc72ae869da422b8550986148c8de0de14d985a5bba50af030263c0480a709d2a9755aac73b7e60e40939db7f9f31";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/cy/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/cy/thunderbird-60.3.2.tar.bz2";
       locale = "cy";
       arch = "linux-x86_64";
-      sha512 = "191f2113ffce94d1ebff5619aa84caea262f424217bf17882189f40f772704aa07ce4ac232292742493d1b1be564558907a418c0104be656ec1441bcaee7ebe0";
+      sha512 = "3e3813449095eea1c7715d98d9198c63001b46b1aae463c6cfa1622b3808659d8a71d3cbac4264fa0fdb6264c1de738a2c79503b0629e062e949616ba0208f7c";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/da/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/da/thunderbird-60.3.2.tar.bz2";
       locale = "da";
       arch = "linux-x86_64";
-      sha512 = "54611a769b3f06860a3d61519b992dc5e4605b13d8d7069031155a23b590230c003dde720dbaf161f6dee87d96df057f01d55e195ec34bb4fb55f1423b166ee2";
+      sha512 = "dc51279ead50553ef8e8345635925b45dd8be63fdd99e3aa1499d2cc2996d084931c00b7b942935d00914c78f56b8bef13a7545d6bbf47a51a16ab26a30132cf";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/de/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/de/thunderbird-60.3.2.tar.bz2";
       locale = "de";
       arch = "linux-x86_64";
-      sha512 = "d1ea83e5402e68a93800491e091daf7bd9951be2de8e3c4e786061c57fe850cdd12bba4a35a24e4df44432a2124dc3b8c5732271a9a1c71f7fe2deebbfe94d88";
+      sha512 = "117a1c2a930c8c5a3c5a96dd6e28e7e167fb6cbe06f607211aeb1af427b47bc3b75d0431ea38ddf3812f5899d690f9c7a6dc8341c124249836bd0ab0da3147c1";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/dsb/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/dsb/thunderbird-60.3.2.tar.bz2";
       locale = "dsb";
       arch = "linux-x86_64";
-      sha512 = "5f1d459902e2ed9eb6cfa10a0ea05068bda0eb3146e5bb9b20ca2c93d85521ff465d596e9348421dda839ebd0e55c480e277ae66ba10236533f9aba7c3c317cb";
+      sha512 = "a717e0d4e57b354c4eb331f01de97267d0616fdf9a47dc8e51acadc4966ee21323a97c59b902e2b315079174acfb896c658cb07ee62f6f04959116961837d92f";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/el/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/el/thunderbird-60.3.2.tar.bz2";
       locale = "el";
       arch = "linux-x86_64";
-      sha512 = "5f1702a2b78373f0cb408363621bbfaa377f1ca38eb17bc6dfbac582115a795c2d22220725378f67b49f8f7554a37a5af5f0a18f7584e54c7f62128fba3dec33";
+      sha512 = "4e4d0df91c563cf21c83617529751cfe26ddd6d0c3952fffd5ef03d40d622da9dc84e1dc861239cbfb345d87a99e2fbe0afe4fd7975bb589201bef8d70da092e";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/en-GB/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/en-GB/thunderbird-60.3.2.tar.bz2";
       locale = "en-GB";
       arch = "linux-x86_64";
-      sha512 = "754d330a04178aa68c15c6212a04dcd5547af820f82b55d7d36910b5c85fc3d28310fe24864dcf7e4ab21838589350a752dc220c9409307ea6059d3e9adc02f3";
+      sha512 = "6a7c42efe472950daa603462de76b57bfcf97810e4c4a2fa38f07aeff8a6729939ddd35b7348deab357c723c6a20b71d25da3e2fa05502ebac1d74fb9c6498c0";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/en-US/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/en-US/thunderbird-60.3.2.tar.bz2";
       locale = "en-US";
       arch = "linux-x86_64";
-      sha512 = "3f8dd135299243996182ab9b8f38e5f7d6d486468b1afbeb52d481d8ad943cb9fec899cd56002ecb5f55f7b22e3184c4a5d114f55734b8e39debbe4ac4060b68";
+      sha512 = "6c549e9cb1a4de1f73b26332c933cb96da841f75afc54511e3d6ed459b3f1439e7febe72337e8b24d825a8fa82b1b1520248c8551bfd8446812abedd3df516b6";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/es-AR/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/es-AR/thunderbird-60.3.2.tar.bz2";
       locale = "es-AR";
       arch = "linux-x86_64";
-      sha512 = "cbe6bbd993f84e583b3d399ac45626384969d6823ef21da84034f3bb3b26b1f86e4ba65a1bee73438ca75d8aeb9f61a75f1b8747b23f1ed5059796d7ec14adac";
+      sha512 = "4465e400726d550d06fd36e8baf3c96445123f2b8c78c1d5c701d9175038878d52e304adb1cd5a6fee3be274605448916a8512b9fbda452852aaf63c8aeca242";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/es-ES/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/es-ES/thunderbird-60.3.2.tar.bz2";
       locale = "es-ES";
       arch = "linux-x86_64";
-      sha512 = "3c7c4b4cd9cfc2d867ed895adbcef4e1af487b5fe6bad6c5931ce055f2fa656de9b51d1008cfa9a342f7b8360ee6d39529d4e81dc773721157bd42841cde2d95";
+      sha512 = "4629ac510525f6af9f287bad685f696f130607eaab020bfec8bb46c2b816b7b8a3df1d0cf45e98446e13b8d219add30b751935ba5d08d5fd426da9346f9292de";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/et/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/et/thunderbird-60.3.2.tar.bz2";
       locale = "et";
       arch = "linux-x86_64";
-      sha512 = "ba2b2a7970a87d41c85aa5fea1cebed55755356fed7a82a08b0945e6311b410df25511e4886e6c066f43b31774fbd35fc65c10b155bab2aac5eb1918cdec8e3c";
+      sha512 = "fbb8b9e90ab0e3160e8b48ad788ec31ebc2c82b2839f64deb2d28c2377debb666bd94a7b081748f11d9eaa10af026693a25d9ac121754d8e2c333330984f97cb";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/eu/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/eu/thunderbird-60.3.2.tar.bz2";
       locale = "eu";
       arch = "linux-x86_64";
-      sha512 = "3398a2c1a2fed97b8e17822d7b6048af686b67f91d2b096f1e0d58dc5d29c2eac60aed39b62b80788634c3996adb0bcb93cb07e5bfe7eb2d2a88e58e1cdfe8fb";
+      sha512 = "8c2e3da06c2ce5768e23d2a0e29e186d31be925c9fd2e7479978ee8a190113d753c80ca059126b1d28bc828f732c517ba6f28647402be5284948fbe7939ea98a";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/fi/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/fi/thunderbird-60.3.2.tar.bz2";
       locale = "fi";
       arch = "linux-x86_64";
-      sha512 = "e7be730f994829e55a51754b569b8148cfc871fbf6dc28962f3d23400ed68105d813ead1612974f5f27148a57bfe099e4fd63ed4111eb877485314111fc046ea";
+      sha512 = "05c7516c48e1574055ef56575e7c7f0315bf307dddee786758b5c49fc8acb41462fad1064fb1255d4b8c2f714da7ebd6070d4d5248c6078bfc587457b51b0f2e";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/fr/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/fr/thunderbird-60.3.2.tar.bz2";
       locale = "fr";
       arch = "linux-x86_64";
-      sha512 = "710a1da3b50dd50d01f29685c6bbb6a39849a5d0daf1c98c2722c5f823b501b9679f53ed72a0335143582e10d01605d57e474936278063254f01f41cc211d92d";
+      sha512 = "5a11368521eeff68cacf8ed353b12d9d17f134871739e0c1d25a6103e4c8b917b19179978940075905e5dbac51cc13ff8bdae6185222ceb6eaa5fdd3dfab16ef";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/fy-NL/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/fy-NL/thunderbird-60.3.2.tar.bz2";
       locale = "fy-NL";
       arch = "linux-x86_64";
-      sha512 = "dd08b6a9e99b2f639139bd8b2f83406229dc8470a66381bd625a15f17093f7996777d35c05bf8cfae930c1379e547236197f73620750a99c27cc2adf0b7688c4";
+      sha512 = "003561a27b2ff7b484fe0ddf37fc539055ca8e302f0daea64c1932c0a9e2fb3a66809cef707ec3feb2dfbea5e57cb1d8aa957d4584a33f0465d252398dcad512";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/ga-IE/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/ga-IE/thunderbird-60.3.2.tar.bz2";
       locale = "ga-IE";
       arch = "linux-x86_64";
-      sha512 = "ef38f8713a7e792d7ccc62e360954c29675ce208e51c06dc3679869487059e5d768f803e751fd008c369a2e438f5c54d95f4b48d042deeb88b0c6e7c84bab213";
+      sha512 = "17db64205a0d56a90c61ab63326986054a3b162bacc01a5ae5cbfc5c6015b47a64886663418b10f1da779556b5730411bae6515e903af96c1d2f0bc51399067d";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/gd/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/gd/thunderbird-60.3.2.tar.bz2";
       locale = "gd";
       arch = "linux-x86_64";
-      sha512 = "9ea6406dbdca47e031af25139707707b9bc56957180ac73682b55c324980c6df0dc8b0ec4618cb175dfd489d7941f8f61f71551c9d221383698eaa6b300826e0";
+      sha512 = "9c09193e9a24b7a34a5e247cb9bac9b1913a4bd7549a396a4c723c83de716b3e7d055588c926d6bb08e7b6a223515764b8ba51f6d013229f40da848a401f3b01";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/gl/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/gl/thunderbird-60.3.2.tar.bz2";
       locale = "gl";
       arch = "linux-x86_64";
-      sha512 = "6ed22b1fe889a1b8109c180c90e35acabe3ce904a0d57824fdfc83f703814635123aa2fcc2f8a6edf50a33111698537ee284911a7eb3ce7f1dc8ec77819ee61f";
+      sha512 = "a303ff6bd6fe3659ef2d09aa58cd911b7b8148ea5c925b82ca7a68f3b16534e13149e03f6fb15c5f93242d6e61d4e1448a1ff27b146de9adf586f01d8d32dfbc";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/he/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/he/thunderbird-60.3.2.tar.bz2";
       locale = "he";
       arch = "linux-x86_64";
-      sha512 = "08c9923c10248b3b6e0c33b75dde8de66377404c979924c29ce602798ddec564fdb3e978a1345d9f2f734768301a262f8ce309bf002f7c7cf9434087e2439266";
+      sha512 = "ea72e43f7b1de708de898dd8351cf4837f97c1a28a71648cbfb76986bb2a87cdb747437e8b9358577685c38c9f5ec80e9982442521065a8c0e412e19cfdccdb9";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/hr/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/hr/thunderbird-60.3.2.tar.bz2";
       locale = "hr";
       arch = "linux-x86_64";
-      sha512 = "95cb5f4d35174dffbf341d2d8986ae0b5248ca7e447aebb13d27915ac7968dc1454ee8fdad201b0de7fa6b9af0cd632c951a2aa9d43fc5f6aa6f7f205ec42cb4";
+      sha512 = "a48ac47c5c04fcdc532e983559fbd2967539250d242f84f2599883c068c67e9c72d73b6355f7f6756d80ed9a54bff5a36929928398acd080e04675b552bcffec";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/hsb/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/hsb/thunderbird-60.3.2.tar.bz2";
       locale = "hsb";
       arch = "linux-x86_64";
-      sha512 = "903be2c67851f112092a09110b7abde2d05d1964e8c573962709b902a5335be3eda0f2c687e6cad67d42339e58559d633768d5b203ad482c1de6f31ba3b13a94";
+      sha512 = "cef96f079261d53092d2fb7e8f93f72caebb3aaff910264188e8b3532de1ec4fa0f43ed45a60f80bc9ba5eac69cd17f2a415b70700d7bfd6ed8c873f2fadfdd8";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/hu/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/hu/thunderbird-60.3.2.tar.bz2";
       locale = "hu";
       arch = "linux-x86_64";
-      sha512 = "83a65776921962cc84f6c932e471d8a1532aeaae6edf95a9d8f68e301ad4383d0cfdb35469a51393c45628e89142c63af3886d1bfb31cb37eef188a07f96f352";
+      sha512 = "45245ae609216cb307e07b33ebc531c900e51634a6eba57bffcdbb4e0d72dd7466e399d0f5fff42a06973c3f2fde61d5e59a608985a513786819dde443cd2e3d";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/hy-AM/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/hy-AM/thunderbird-60.3.2.tar.bz2";
       locale = "hy-AM";
       arch = "linux-x86_64";
-      sha512 = "42469e3b613321906f2573706a523af032e93abea2e579b1e768d75898a504c4ab5280d7f9ec1a2e25257ca4fd877d53092fd85813d59c6dc4e5eca058aad6b4";
+      sha512 = "d9b56f551997ba6d2413ce6847ab6af4bcf9d633bef2fea7a0fa8e8bf37fd87ce497134a7f58c31d647f781d07977be58449485c13212eff2996e3ebd34a3be7";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/id/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/id/thunderbird-60.3.2.tar.bz2";
       locale = "id";
       arch = "linux-x86_64";
-      sha512 = "008e9b2949f55a400209440e6eefc6144b71f76589ce18c022e2fdfb203d75f97a93ec3f06a9810a72e0b5b0566d2403b16baee25a46dbaf77eaf36a1ad0bbf2";
+      sha512 = "8d09a5e23191f454b628c3bbd1b95045b201dce34ce5ee78e35d4e03ab3e2f686a1be2683332d1fde5bccbffec1e878c851bbebe019b8e62634f64eae344e2df";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/is/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/is/thunderbird-60.3.2.tar.bz2";
       locale = "is";
       arch = "linux-x86_64";
-      sha512 = "130432feebe93be2c2d87febbf3a45be16c118a980d3fbb20a8d0fa42ea1898e70f60d758ce407df461ef6984a2e55d67594e50edcc4b9445468bb1ef5421889";
+      sha512 = "bd38c11eeecc90df111917e8d6d4c68882c24b40b1c7171f366c795dcaf4709fcd47aa1d81d76c7db549b054b3705330ce389bd8445dd48350c8cd3a22bdd9e0";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/it/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/it/thunderbird-60.3.2.tar.bz2";
       locale = "it";
       arch = "linux-x86_64";
-      sha512 = "1887f49727e3116bfecba4b084fe550b1b9b82f90b620ada9baa81825ab200489dbedab2f465cb52a0e22eb130069bc639eb54ab48b6e708c264bbc5bc076fbb";
+      sha512 = "ad3fef3fc1414a98e7c24abd31b0fa0796e326c141ec5896b29feac7c3955c807ebdf01e7d099f37b31e32f3267cf8052ee8d4f324ef974ccbce38f13ae432d1";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/ja/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/ja/thunderbird-60.3.2.tar.bz2";
       locale = "ja";
       arch = "linux-x86_64";
-      sha512 = "c60a6e44368387f424c9881702dcb4f3dcfe439bcef92a5e6791c7619f3fb71a36a83e6ec2142cfa556e36b0582070f1aee9973261afc1fdae55a6d5f5b808d9";
+      sha512 = "880df6180766953da20c8917da020750431b5463879aa1803a6a4b9437a650f918a69e75804c267c1cfcc959a18edae1936f5059fa165cb9a5721937b3aa68af";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/kab/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/kab/thunderbird-60.3.2.tar.bz2";
       locale = "kab";
       arch = "linux-x86_64";
-      sha512 = "1db688c67904b1f930133c5e711390d2fa1498e48db450f3ca41e6b039fd7cce4b68298ecfe5a47c20eda9ae0464ab9fe8d0907b28a59bb3fd95a7d895c02665";
+      sha512 = "285a5054b19e155905f0a29478b4cbb3694499d798ec009dcf4c3cf5d44510c5468d6119fcfd5d2e4ca4e4d1abd83ddc1d9fbdfc68499534e42040e2b8a27463";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/kk/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/kk/thunderbird-60.3.2.tar.bz2";
       locale = "kk";
       arch = "linux-x86_64";
-      sha512 = "e24f8f451e39bf945e51dc9afc4f40f3e5239616cb838e977ab74151f64dc07c246dcded50976a721261a01d9de0d55b802077de18f7682bbd892c2282f7969d";
+      sha512 = "fe77320d7228c623bab6eed15466bb31b64955dd885728728000e03ebd368c666b825bfce8a5ae9b9f17e74a519d74ae26c636e8451fa3df91a7b5b5e2ff3d05";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/ko/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/ko/thunderbird-60.3.2.tar.bz2";
       locale = "ko";
       arch = "linux-x86_64";
-      sha512 = "52296e8ba959fd82b29b8cd7eb57812955d2078fc7b8aeccab80b8a4d917a6459072a2a317feee41bf649c1806797767a85fcf81af656eb51dee70352b57ec17";
+      sha512 = "f3cbb3fe94d44f4c4334041ff53983829c783ba1cb23bdf73d07a35f3b59dbff8c4a584f159441b142e1ceae3e768e4b20316a870033603db8987bf4f1b04d53";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/lt/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/lt/thunderbird-60.3.2.tar.bz2";
       locale = "lt";
       arch = "linux-x86_64";
-      sha512 = "b5a1a8ce67d441e0d919e808a9f7b0e9dedbcdd7af105a372f071430ad1426847087b53ab2b7bb455d161216287e2c0a7e2639d80a0161f7a92a8e87337deb8d";
+      sha512 = "977aeda9dfaa83b1abf844d40199382f5ab8be2466064b4258fe46b6821b333db027c2f45355c6655a7173ca369e5329b269bb456ab964ec38e3e5a878cb8054";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/ms/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/ms/thunderbird-60.3.2.tar.bz2";
       locale = "ms";
       arch = "linux-x86_64";
-      sha512 = "8ebbee14a1c2b540baac19f6b154e74e3c39a3178b1ea32b55f35edaf2cf41f4e6096be3075b54c37f8b01e7e424dbc2f9d6b3fd04afd366ed854684e276f302";
+      sha512 = "f5e4ec77934a66ee22d8d8bc2d0c238d020a0843da562ac6ad344818ab0ed32497ca00eaf96c252392d3923151ecbe9f7a0c90d3dee7e558bbe75da278547549";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/nb-NO/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/nb-NO/thunderbird-60.3.2.tar.bz2";
       locale = "nb-NO";
       arch = "linux-x86_64";
-      sha512 = "8e9ae2aa4572e247ecf9d1715d0733bdf7123dc1fab7804a2dfb4f27aac589aecfa86824597e1efa218dfec4807730a697e36a813008b0b208c9181ae20592dc";
+      sha512 = "4d3723af7503ef508ea269f44185eefb33894a989461a22a742cfd369d0a2d93d6c3bce61711ce2a5de868b3d7f7c612a8a596718609068950b32d1bca7f1c55";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/nl/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/nl/thunderbird-60.3.2.tar.bz2";
       locale = "nl";
       arch = "linux-x86_64";
-      sha512 = "a910555ed33fe721de624b591fa0a4aa769e8c8e3d78253eca907e0ad2f4ebe541e2b72ca3434d79aee9a59dde219c5b24d5b406f0dbafa0b1a8f080cd3f6e9d";
+      sha512 = "0a95e88ecaa1b3af514bdfcaab648f3cba9b280e5eb4c9efb371309cdaf0dd1215cd74d2d3af203e0547c1bab4b2480c4a3e9f81e2d1c301322497aa990af281";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/nn-NO/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/nn-NO/thunderbird-60.3.2.tar.bz2";
       locale = "nn-NO";
       arch = "linux-x86_64";
-      sha512 = "9fb084d5ddaf22cd282b3ba001b39d926ef49a03c9ceb5624cf11bc637af5dbe3ad90d0282f6b90f794010f69104e5bb126ff5c8aafd7cbed82cae0834563e20";
+      sha512 = "d4c112319b8df0e377cdca82b33f55b0e949d3b2f2cdc3bfc5b5eb0c0a0e98470452b231e8c82f2cf303f1e75b512c5097f5988bf10efc57cb2362f7711dfae2";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/pl/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/pl/thunderbird-60.3.2.tar.bz2";
       locale = "pl";
       arch = "linux-x86_64";
-      sha512 = "c5c4590b177775b559acd89d3aa2c4555fa4c8c564ed426cad567b68e2508560d6a8bf55c9b3665819be3ce9b42ef94b795082f18e27559d6f1087a51c26bd5d";
+      sha512 = "94829eaf23916a0ff5273b38594a9a10ba9b178c0103deffcef0eb2015e4a2c51dba341644252b86430f18f4a2e526307f45ae5515f6d47832b74438dc798ea9";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/pt-BR/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/pt-BR/thunderbird-60.3.2.tar.bz2";
       locale = "pt-BR";
       arch = "linux-x86_64";
-      sha512 = "4d66d1774fea6fcf2c81bebb5035b4544ae6795077c8d12cfddd05257149a56ae91b280a28488483ddaa444533b253297f7e6d9c2314111db8013e0f8f0c234a";
+      sha512 = "55148505771d65796766e6ce0b46ae9787dffda5a3176f249092f9f446fa5cb9d7dffbca0774865bfe000e79cb8b9e7704e4f095117172b3a2b8fc661b4e21d7";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/pt-PT/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/pt-PT/thunderbird-60.3.2.tar.bz2";
       locale = "pt-PT";
       arch = "linux-x86_64";
-      sha512 = "1e24124c69e5c8b0293ea79c499329b0075fa795d87e8ebc78f322859bfb6e76f977daaaf1cb187bcff5239767fd55dd5e53884a785cc60bbf4c1180543c8c5b";
+      sha512 = "9d7c6f004afec887f06e7b08c344727dd8310390511f454e18a93ef618830bb68df5ef60129659a31c33ef6b57d3c0e7693ccb5d4c9452eed1ef1404c6f83956";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/rm/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/rm/thunderbird-60.3.2.tar.bz2";
       locale = "rm";
       arch = "linux-x86_64";
-      sha512 = "f2f6174e337010075ab78b88f9de1fb10d213fe1329ac185a64bde7c2efd9f5ad6a0151a42e0745694bb1f426246fba34cea5627316e17fa41bdc292ad692fc1";
+      sha512 = "f7dc1d5981d98f38c13c840e71b542dd3aad096d8dea8add79ebf756129a0a83316eb42b9018d47ab694c190384658cfb243dc96d4522a84a7f35ce82e79fa00";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/ro/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/ro/thunderbird-60.3.2.tar.bz2";
       locale = "ro";
       arch = "linux-x86_64";
-      sha512 = "25daf13a075591ef46295b44c0977c8e159612862953e7c22a053a3958b765b8a5693e8aef691590031285605101024142a42922faafdf9c0c998554e154dd74";
+      sha512 = "97f7f674e4a858ee9c03bf1661071c6d0990b5018de9f69ac46a98c82db53c67d2589d91ec9db2c1f6361a700d47779f6f4015214d8010da490fd69fbe065764";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/ru/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/ru/thunderbird-60.3.2.tar.bz2";
       locale = "ru";
       arch = "linux-x86_64";
-      sha512 = "a187abec0708338f7a0f593a2054fc20f4f018d1e2ceead6778c616450a2cb3fd2f959f4c7e6018ecefd07a984828efa2da3f91b34104dd62fbf5a5a97310082";
+      sha512 = "de481909f670659bbb3c227aa97780ceb54683b5ce47135e480fb95f89663b2fd9ce176d7507913f31417f66fbe8d4f8af08481bbfbac6468f7ebdc5b0bdcfa8";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/si/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/si/thunderbird-60.3.2.tar.bz2";
       locale = "si";
       arch = "linux-x86_64";
-      sha512 = "076c69137e6d4067f553efde45d1676b386277c904f452ee1880a52ead9cc40a1bceab33a895886c32a203dc8aa6d2735b5f81b21b969ccccfd2d5e75a2db289";
+      sha512 = "07ebf67fa8673dc7bfcf5563591e4ef5c4736e3844b31a4e6662098d15dc05a437e3d5eab544cd09c010628a20f15ead8185e149560e0526dc1379f0a9202f56";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/sk/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/sk/thunderbird-60.3.2.tar.bz2";
       locale = "sk";
       arch = "linux-x86_64";
-      sha512 = "669bf299926fb9f4b0201c9fbbb593eebe127ff64d9c3cd12f79aa56b2e9d8a9b68c34e8ee42b9cc1287972c1a3d28c080945c1f17f4fbf672bc90c1f86425e1";
+      sha512 = "deb6291ba941743956603f6a91c0a19a2c56960bc91869ca7201f7a3eccfc630300987ce5b7bba51856bc16cbad2e34cd7ee645a22d692c12e8b4f66553c6a1a";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/sl/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/sl/thunderbird-60.3.2.tar.bz2";
       locale = "sl";
       arch = "linux-x86_64";
-      sha512 = "0d22ef11e347caa3e03b4a83c19dc1a230be3ed2e561ce84284b752abc7d64720e2d68d2fbdec19da73cdc13c5e90983179197e512f7db4f52c341539b8c1329";
+      sha512 = "b07617d113b7c3ac75cd4b3f8fbd098bbbf5cc2b8f06317da410ce534a93013671519c9e0698809add4c14fe131b6273dafdbdb8a8ed56922a68978cd20a094f";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/sq/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/sq/thunderbird-60.3.2.tar.bz2";
       locale = "sq";
       arch = "linux-x86_64";
-      sha512 = "ac5e98dc1660efc255bc07a545e47f2141a8468e8bb911ad1b42143e5e048a82d5771f32718983ab80695b357b3b2d08897cf98f791f466edfa57d75579920c0";
+      sha512 = "b22bdf2bf3b8cb3c1a5e63360652ac34bcc63499a02a8a5af7e2c6987b310d5d4a18495b17c2f7ce9f509be08b8b5ea1beefc241958d75c4c6be26bc5a02532d";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/sr/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/sr/thunderbird-60.3.2.tar.bz2";
       locale = "sr";
       arch = "linux-x86_64";
-      sha512 = "2215af6e62448949dbb89cc66a52c9f83eabf1074ad8cff437953123d53ad403537b5655509bcdbbdf239da32e5b9d689b02cd625e225ce74a0c22f07318ba1f";
+      sha512 = "5d5139a8f9405b4ced928bb9241c0a4b3502421c8329b2da4d582022c2f57b7c599b48428ceb6601799448ad40d52270429891b7a637f9a913b47ef15a3d296c";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/sv-SE/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/sv-SE/thunderbird-60.3.2.tar.bz2";
       locale = "sv-SE";
       arch = "linux-x86_64";
-      sha512 = "c72db6a8ed31e7348df9a0fc3931c5b1520f7bc03ea47e92eab343acd58c3fb4574beb91fc932733bc52e670451a04a88262e6e29ad7c0dacbcb37da522537b6";
+      sha512 = "2b8d2962846a7a0ef0c8f77cfb51e26da417de7a808bccc97ae3087dde1f4f0d38f770a3e14c26f5081af6c57dbd175ef81ff82992430bcc5fdfba2c2948c9ba";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/tr/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/tr/thunderbird-60.3.2.tar.bz2";
       locale = "tr";
       arch = "linux-x86_64";
-      sha512 = "249d2320607100ec397556619872b701dea16142ee3ca0599fd17d66e5581d4753326a0aa9e2fff4b38c9a91ab8e923abeb0115cd8ad9e82cc871116d670cd4e";
+      sha512 = "e37b98fca81ceb022d95e6b23260a22ae0dde8f48753c6dcab96a3aadc8a68c852c2c6e105ee7da8733402561435357b0d70524aac419604a13964894a88671c";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/uk/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/uk/thunderbird-60.3.2.tar.bz2";
       locale = "uk";
       arch = "linux-x86_64";
-      sha512 = "439d7018c6a6cb3544ec26fdf6bb93d6be2a7a4a6a19d6d5de40e7bcaf0281e42af6fbad23d4640959fae84ea4bf487c19fe07bb50334cd593a20c7c5db999e9";
+      sha512 = "9d1f38ed783b36f4312ce701dc8da3bf9facbff9874b08bf5730995a2fec3a060cd55aa395919b03ae12fd9f941e5f2fd329e5d836e1f722bfea97387e07be92";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/vi/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/vi/thunderbird-60.3.2.tar.bz2";
       locale = "vi";
       arch = "linux-x86_64";
-      sha512 = "0f7e6cc139cba5223fb75b0fff6b60e26d2783e6a78f22f3d8d1ec518f950856ecdef9b2aa31346aadbadcc08ee9b9a251e2fbdc5bc9655395fa2015530de050";
+      sha512 = "e70d087dcdfc0e5f6791b1c5e1483ffe6891b64792823b400d79fd9ed8bba10e5c21cb14a11cc2e020d8c91ef5f82455793595dc7143956d0d1a99f673125253";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/zh-CN/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/zh-CN/thunderbird-60.3.2.tar.bz2";
       locale = "zh-CN";
       arch = "linux-x86_64";
-      sha512 = "3280a8085855b25b88e485581d3f275873c4c01f1ea9608d98b01553a0dacfa7226d405d055028b2a45daf6316004b12ccd8637deeffb30724540df1ee480773";
+      sha512 = "28c4d992ce79d3f62984a1a0c009a742709c4d5dc1be3e9e05da6b4e232e269b04f548b67b1e0af85c51f7f4470cb3bb9a79d5bb2ab5c55f27806bbd27f5611d";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-x86_64/zh-TW/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-x86_64/zh-TW/thunderbird-60.3.2.tar.bz2";
       locale = "zh-TW";
       arch = "linux-x86_64";
-      sha512 = "194cd71fd722d2f8f47ada2fcb02c018cace495d6d72c7eacfff38c6e5f30b7749dad41f2e28af8e935703c4033fcd5f7264ff828240008bb17a86e6894fedd8";
+      sha512 = "444524e9be27bc5a37d06cf7f9496d75ae524a27c97577066cf6bfcb2923369cf11a949d8712433345f04fd2ed7423c45497a51a50c058b7910216d9f0986350";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/ar/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/ar/thunderbird-60.3.2.tar.bz2";
       locale = "ar";
       arch = "linux-i686";
-      sha512 = "56a8a07096fb29db87dc2633aff725612ff8255991674c590dfff51970778bb6b118a2f025097bb139086cfb949d0f53b1a6b1e9670c4b3cb0fc9ecfe35f6065";
+      sha512 = "5e147d4087d5b3f92f3f62e4f889bf1a38851f038ecaf9957bdc9ba8a7c52905ef74788a6879285836bf780177ea785b0ff65074eead4a1ba2442ad2466ef82b";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/ast/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/ast/thunderbird-60.3.2.tar.bz2";
       locale = "ast";
       arch = "linux-i686";
-      sha512 = "9475397f31e227e6a83b9572b82d7067fc633fde9a271fa68be5922f860346abb2bc879b14f489b54c3e518cd2d917b5e5ea2a03da3ab554607356cb7236f4b9";
+      sha512 = "29066ad291416e4cb1e778effb807b3427d74285ca5edc4ae84c27e39e4b033eaa665ca22ebd603b7d1f7347e6d21874c1be6b00df56e6a4c93aa60fdf613b07";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/be/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/be/thunderbird-60.3.2.tar.bz2";
       locale = "be";
       arch = "linux-i686";
-      sha512 = "488cf4396202882d4499b0bf6a3c5fe636fd162c767c5344ccb033ad57c90f544fb1e4daf348f08863c990eed0a07bb543c8b9f648786535a3db2887e77a6823";
+      sha512 = "535a84a7943a1da9117829e9cc9aa0f1fef1e3eda0ee61d356a4f2e10dbf2a61da899fef2d0b858674a4e54f574bb0aa5db628b5dab52fccf2a0eca06b9695cf";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/bg/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/bg/thunderbird-60.3.2.tar.bz2";
       locale = "bg";
       arch = "linux-i686";
-      sha512 = "62bd4387ede66078250b1a462ddd487c97addd044b8c04858de922b60b88823880869f7eee0cf618b51ef1de956007d4fc9a6ce05ffae209284104cec4557bb1";
+      sha512 = "83c925fc5164146c24447835229cd1abe4d9eb89adababa68057d90906ee6b1fa51549311dfae934eb1faf36f5d10118a1d4cb7338019dd41a6d563fcfafafa7";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/br/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/br/thunderbird-60.3.2.tar.bz2";
       locale = "br";
       arch = "linux-i686";
-      sha512 = "39fd9e5b42000c9b1e37f7a0bdf03681a3372166cf90750495f7e2a0e10f45465b3eb7d68454022634ffa8dd7a280d0ba98fee9367fa6058223fb87c06349e75";
+      sha512 = "b9c0e4cd14a3c745f506c303e2cad6357890f7b9dda91de43d4bddf5bf45c0247120f6c824189721512536e3cfed4b3a1d32a1767b2cac64f20349f158c10acc";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/ca/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/ca/thunderbird-60.3.2.tar.bz2";
       locale = "ca";
       arch = "linux-i686";
-      sha512 = "9cde54a64916448a776de3c197851576c5d9e395bc90da1f18abc0f5f1bb27d267bfcda33cde51fb06c80277caf35a7b9f1fad6853f8d053d95abb8ed2e95f5f";
+      sha512 = "5d45160609b49ef060d7d6a92c5ca24b4dd6f02397103cd66a76796ac72c2ce8f9be6445b09489d8aa96ef0156ec31a734e7091d0134176593a488905370d81a";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/cs/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/cs/thunderbird-60.3.2.tar.bz2";
       locale = "cs";
       arch = "linux-i686";
-      sha512 = "1b5b8633a6502e731e9d187b0c3977db8338c3aac9d4b07c12468b143a11488c5c4b46b898f3ced8637b16abeacde0c0482b74d0c67c04bb4e1e40bce66d8151";
+      sha512 = "659431aa61b6221543bb7e59b7b5361ac2011ffad65ece1046df3869b54c1cd39fda0998108f9c72f1dc4f5151496962b73e31ba1d3a2bf9bd6bd3186f7ed0a9";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/cy/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/cy/thunderbird-60.3.2.tar.bz2";
       locale = "cy";
       arch = "linux-i686";
-      sha512 = "a4636852813f271fe7ded7665d386d34120f664e5e2c18bd923efb4f3ff4cc273fa6ce952b243a2e25840f96baa4ac28979201d6f9a99ce8ce2bd18be41f1f82";
+      sha512 = "4a488557f0f64d4d4a4aa33ab385754f89bd1d1f2d7d39b64e75ef8a6a2d2f55bacfe9fcdad7901e44f9f2c69acb76d595ae379dbd3dee07bdf299a4dfa08a3a";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/da/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/da/thunderbird-60.3.2.tar.bz2";
       locale = "da";
       arch = "linux-i686";
-      sha512 = "fb4b302ac628b6b84ee8c537ec533200421c0fa4ce5af2efbc92e1f62e23761f5a64e11ed004ebbada8c0f31a4576d8a006571470896470547622aefb27af4dd";
+      sha512 = "39b46247bc1f83c1f2d3470421411cc931beef1087089110aaffa4b604c102048771069c833db85a3c3b070b9586e45a6eeeaeb5b3fe9ee1e77daf5e6e7aaf0e";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/de/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/de/thunderbird-60.3.2.tar.bz2";
       locale = "de";
       arch = "linux-i686";
-      sha512 = "76a213f0ee3fc1611d88d82639bdd3a90fb0cae0ef9c938087da3cc14c2802c6ab2bb5c73eb27e370fa45dcf25c075c27c86fc1b8f38b32aeaf76b796269293e";
+      sha512 = "fd29518af52080217b38733f5babac66e7dfb17742b67be2ad962c541ac31e27bb162303474acb3c320a4a33c1e589c4f826b66b16df2296647e499051b540d4";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/dsb/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/dsb/thunderbird-60.3.2.tar.bz2";
       locale = "dsb";
       arch = "linux-i686";
-      sha512 = "34e0fdc2179d4edd61044eb43f9fb4653e3a34e424ca68e549f430dd2398c6e8890b1ab5dc1aa08a1f93ce5e73774eb465e75ac13c6ec56ffe25de5e41b308bd";
+      sha512 = "4f0c47c2757a5ef641f1618a7276a9a171cd681c517db130886a1569c7e00542be05fab2062fce21b5c3f8df60e3c521b25292f7bfe1c437b7c1a779c9165510";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/el/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/el/thunderbird-60.3.2.tar.bz2";
       locale = "el";
       arch = "linux-i686";
-      sha512 = "c09cb6653d9bace2767c25fd7a2d8a0100c36a5f029e2950872a13cd2f2cdc56f4e4c5a53af36d1667cd23a0ed405e529d470b0405a0f615c4a1e78e08cc6c90";
+      sha512 = "fb6f80d1a7a8e465fc49e38d986bdcbfd962b3c99c45629ac188e58ff3cc63cc97da4529fb67566705ed3c4e682598e0089e826d015b0dddcf60d359faece400";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/en-GB/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/en-GB/thunderbird-60.3.2.tar.bz2";
       locale = "en-GB";
       arch = "linux-i686";
-      sha512 = "df3b0c6e90fb683d7b67db078c4052be3066072032a99e9b1ec2bd1bc9f5f7a95952788c754efbfce9c5ca89a43d6b59953a3c5283eaef134457b79f7fa0c538";
+      sha512 = "7e2301e76e4be208256bcec9237c39b30cf49075c46d27a243005c39289e1ae26a1ee41a294c8d5389279b21749fda4f490c2fd1b3ee4b8bd9f1170f2efffcec";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/en-US/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/en-US/thunderbird-60.3.2.tar.bz2";
       locale = "en-US";
       arch = "linux-i686";
-      sha512 = "18794d71c1d904caa1959feeaeceee38c86bca0faa84438ac1e1355879ae832fd509d2124a6d9ecbac7242eef334793357caed871713a139511ae77107168933";
+      sha512 = "0132ce8050a45246919e5fe538b84eb158cbf40401d487ffb7bf72d04a2bc3371d7606523dc6776dc3b6dd4c1930d56f6b47197385cf580d7b51c926c69eae99";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/es-AR/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/es-AR/thunderbird-60.3.2.tar.bz2";
       locale = "es-AR";
       arch = "linux-i686";
-      sha512 = "69825a80a98ecaed860c5f31c63928f215736fd9eefeadd7be1d88659c17afa58d7975f0ceec26040a21ca048da7b06154a44798069092c0a4e2e6816e847aba";
+      sha512 = "bccb7704f8bd0f09054e48c54bd4ebeb4718667aaf46c55a7cca3e351181e09760fdcbca4e1e1948746b74f2c7ae46cf0d565f4a9c00430225e6f2c2849ea459";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/es-ES/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/es-ES/thunderbird-60.3.2.tar.bz2";
       locale = "es-ES";
       arch = "linux-i686";
-      sha512 = "673b4d55bf3691cf972a1f1369486cd205d7c6e8bc91cd826050fa28dd6c313f872aca399191305320289962f93495ea6316ae2f2b29313d8b61c175ae0640cb";
+      sha512 = "81359edf957802660c0f92f8894a9087acb2ee6b08906de1fbf4be2145911c30b6de27b11b66ee8b7ad8cafeb09e00f336649537829f82cb7f204c834b1e585f";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/et/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/et/thunderbird-60.3.2.tar.bz2";
       locale = "et";
       arch = "linux-i686";
-      sha512 = "1dd9ac5e292fdec230189de90fe5ca923351b98a95d72d302bbc2c838e48cda46bc2e8e4ac2f08d2356b7a596dc2210fb9f24c15319fbb519b29dab78e29f2c1";
+      sha512 = "4039a1680551f03a17225cb8b2cb9e0fbf554ce3956e89700655cf010483c61e7b29070aba4a0fb7395b93838f9fab6542fb006b9c14f0a013b6eb587329d7c8";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/eu/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/eu/thunderbird-60.3.2.tar.bz2";
       locale = "eu";
       arch = "linux-i686";
-      sha512 = "acfa8190d55223752cd3c65fa87bff86b7f1f38d86365bba23190c4f16519feb8acc37e1a47497e69279a312e57d39a5830ba8d9c4391a1503024f125ab72b18";
+      sha512 = "d7a5c40069541615ff8479a8eb48d5a199d9bf9f834661af833b65d68fce93d8b433fd45e0175bf29c8322a402136f8b4b174b7c85329659bfaaaa3430bab574";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/fi/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/fi/thunderbird-60.3.2.tar.bz2";
       locale = "fi";
       arch = "linux-i686";
-      sha512 = "8a95970bd4fb56ff80324a743f02e9dfa21df698f761096ee5d425663e87590ca8d38ab62ccc97298f4d935f4713ded1e0acf01afbcea1d378ed2c065cee637d";
+      sha512 = "10c1d2e0a3d3d0dd2bc6166e4dd3ffc273f97e7b7a03d5148a8475411357eba8733ef33380cb79d813b65fe128e2bc07ac2eef30139e3d6c69af77003cee8950";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/fr/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/fr/thunderbird-60.3.2.tar.bz2";
       locale = "fr";
       arch = "linux-i686";
-      sha512 = "51111b8da2823523bdce77d9807535e09b54f1ca7e1621f3447c9e4bf44522a176263a843875a3f55602b7b53d60ae00fd5a59f22fb3119a792064ebb9ace209";
+      sha512 = "31b8463352704d1ac6640a07bd0131f683f4baa2faed799f91de956a083f184539186f0a1bd061c0e1793cc97f22a32b275c5e60994cce93f441181f2120ceaf";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/fy-NL/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/fy-NL/thunderbird-60.3.2.tar.bz2";
       locale = "fy-NL";
       arch = "linux-i686";
-      sha512 = "144cf86e32fdad0f4eed95b461de9dc0713c3bc70ccd77c1db94ea53762bffe7a5254f3f898228347e7b1d26df0055dc04b0192d3b1a3653a8109ff8f4f712c1";
+      sha512 = "80831dcef438c2737d38df2822223632030d62efd84361925f06caa7a108cc966848184403d8422a8a1c43fd1df52a77dc4b561dd2733de73d2c8aa0e0d5978e";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/ga-IE/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/ga-IE/thunderbird-60.3.2.tar.bz2";
       locale = "ga-IE";
       arch = "linux-i686";
-      sha512 = "7f411ee0f9b518dcf122eff2eb0b70fc1c7a71d2ccddb73482a17c9508f084ff0df6aa6d9a1555c576b0fbd32c9d65e106b8f98c7d603907c7a7189de034bbca";
+      sha512 = "7ceb9363d331fe9a0c3ed4b052cce765e2ef735b8a869ba3a08e83ed5195d073c1f4d9ca4578140b195cf25e3ae8771da8e061efb3e14bf5e9d875362babb713";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/gd/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/gd/thunderbird-60.3.2.tar.bz2";
       locale = "gd";
       arch = "linux-i686";
-      sha512 = "116e72b7f9759576077d3d11b9913b78dc6356e98995f0ee1ce152d04da9d0d5db6d32218a8e3a9403ee64405c95413fda8f86c6fef85336f799324179896fb2";
+      sha512 = "292a67e214ab6392e7c6eb80a576fa130b9c22620c8c2ae5ae5eecddecb823526f39a0f16d7df3c4cb80b35325b907708083fd45efb845d40ab89bc3cf5d0374";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/gl/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/gl/thunderbird-60.3.2.tar.bz2";
       locale = "gl";
       arch = "linux-i686";
-      sha512 = "1d06ad862128b2ecb38b885c868c153b78a2246cdc635a066634f8b1a9e08fcff83d30806f9906b8f2a5a929e702be51ebec7fec54f7b80d4544f20cd2ab84b6";
+      sha512 = "df9f2a24a70facdaaa8c1b3831994fa2f5f14df92cc85dfdafa4fd4a28e7f331ae220ae08a4938755738f01e5f6fa1bbd62a558780a5444afe07e201d6c34f5c";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/he/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/he/thunderbird-60.3.2.tar.bz2";
       locale = "he";
       arch = "linux-i686";
-      sha512 = "6858b78aa38171194ee1821f7266924301859921591d84ab057a52ffaced7665adaaeb1ba536f9f0a7b8cd79ccc253631ff1a3d205c43c2c08d161e520ce7a60";
+      sha512 = "f1f527e5ec325fe9df177b172061dbfd205c307ea275f732b31ab460801dc49a18cd41625caca0c118f62d2642e4494e961b85b3058e2909445203d7b69ce6c1";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/hr/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/hr/thunderbird-60.3.2.tar.bz2";
       locale = "hr";
       arch = "linux-i686";
-      sha512 = "eb3f16f0000ea85e420c8bc60abe7b509ba0d125b8f95fdfc67d4c0fcf87b6c0db86a0297e8ee2e7fcb419951fcb0ba42a7e59005742145ae6067be5e85f6e93";
+      sha512 = "dd5b62e71c708db2dfbaa59bf860b4dcff951607277605193ff084943f4ba7be9f458310a2a3c047d4e29b7ba432bfce1ee2dcb5217c460d90816b17c2232824";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/hsb/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/hsb/thunderbird-60.3.2.tar.bz2";
       locale = "hsb";
       arch = "linux-i686";
-      sha512 = "55ee75a0158ef072c1698cefa5b6725da36e9286c6da004ceb58f2aec109609f7ca9937d8825b92ae2731ef156e562249093fd551064388bc73905fc9ad2545f";
+      sha512 = "30374f1750facbd5d96e9b38aa2f237a7424e278df6e8ceaa622d119866b10859b594622438c8299d92bdb6baee2ddd7e45498e6fbdb13a0b0d8bf2304454501";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/hu/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/hu/thunderbird-60.3.2.tar.bz2";
       locale = "hu";
       arch = "linux-i686";
-      sha512 = "6b9fee4d7747af8b6d39654fcbd0c14e7762a1ab4fb7e7e133598fded0295020b39009e028ffb3d8db502811bd5ca9889abf5004cb01ff995bf9c13b871e11bc";
+      sha512 = "7a1a955704d4fe5220f039a6fca68f87995f654a59f51df832970607809db76f1cf480df90893ffa88fe87c5cabfa0733ff307393e22c78318c379db963cb26e";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/hy-AM/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/hy-AM/thunderbird-60.3.2.tar.bz2";
       locale = "hy-AM";
       arch = "linux-i686";
-      sha512 = "e0aa3adb175fd1562e6292526f6512d5f6a9e6584d521aae3c97cc0143946a49e41e1914e9ba6d87f29409ab8b17f84cac9bd4a815e29f7c9ece1729d302881c";
+      sha512 = "8393a86a9217a4c387cc92b4c61ea552c7115549dba0ee02afac065757fcae4f79b67ef8fdd1559b942f674f6804bba7804d54696ffa71338de42bca7f12cf83";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/id/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/id/thunderbird-60.3.2.tar.bz2";
       locale = "id";
       arch = "linux-i686";
-      sha512 = "7839db4bb937e699688d1e2fd387cbfb25a0402529b183f09897535341324f4d92e774c3bf517ba3a51c86f74854508b5bd6a5560bc153bf3720ea8191c119ca";
+      sha512 = "fafd7a26288b951d179657f99c72581e4bb5299e8db775b7a086f3481f700dde031137e2cc7370e308c943a0a874c5985c6b9e36c7af1b60c4553779a4653d85";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/is/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/is/thunderbird-60.3.2.tar.bz2";
       locale = "is";
       arch = "linux-i686";
-      sha512 = "29b069bcad1cc668f65a3749a1d87b6582ad32400905bf446f8ccb86cf42100d7034bdb4c0d22a66b8f5ccf95659a5ee4c058f7c5a5ee2222dd0a93cd6236a9d";
+      sha512 = "3aa276ee0ee8f2613ec7ef1543ba5938658fdd5c1ea24b42d39c5fff4f016325daaa701f89c65a32f04c85fd066f3bef75dd0d5d28ffdeb29618fc16435f046d";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/it/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/it/thunderbird-60.3.2.tar.bz2";
       locale = "it";
       arch = "linux-i686";
-      sha512 = "fdc47d3462cc3db49a8208423c19b0d74b65eeefaad2eca873eb194cc8c9691adfba7e87bbbc7c4a472423eff91ff8e21d78fafef18a4e841e922c72eb53d78b";
+      sha512 = "696b5bd5c93fa5a174b04f2501e46c6334cbbdba43073015962e7ae17cbf577f0e64d016b7f892513a3a07b6867e8419cb16fc82b915d09695d5a84f3d904bad";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/ja/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/ja/thunderbird-60.3.2.tar.bz2";
       locale = "ja";
       arch = "linux-i686";
-      sha512 = "068a15c6913a556c1c9d0deeb96c75087f68e62c0dd2eef3445c4460e08c314d457f799e82f96dfe00fabf9ce4cf7a7c379d08e7a7ebb2969c39ae87082bdef4";
+      sha512 = "588e5c6dfbb40cf355d62f000b5561c6a2a4e0b5c43c7dd2136fab11ee4763cd9cbea89e958f3959aae0570c694aa067d77ed7cca818147cf51a28efb304ab72";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/kab/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/kab/thunderbird-60.3.2.tar.bz2";
       locale = "kab";
       arch = "linux-i686";
-      sha512 = "d11ef24a47ff39eab178ad448ea2d1457978b31dbe5ab0da2b87011d351d92ba54245891a1c6be3ed7424ea9f5743093e1cd6eeaadfe016405ad53252b7d5590";
+      sha512 = "aa58f8a4309ca122d8517042c9a8c8a92b90087001ae4552de6b660bae082565ae1d80aacd3e506f8582a145132a482fb8c22eab033d7afd4a3959653d00f1d4";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/kk/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/kk/thunderbird-60.3.2.tar.bz2";
       locale = "kk";
       arch = "linux-i686";
-      sha512 = "e4bb916f3e04136b470d46b04d7d2ba4c3d9d703dc8fda44e7611ec51af06af4bf73ab30f4d4b578560a27a34adb6950534d0554573a21210bf825f2aec4ea73";
+      sha512 = "6081c78fe6febdc6c1c0ef2d102755760c9b137d117c0ad5b8adbf1a50769c3198a703abbb5a826ddd723cb128d535d2f075359e7300d763d8e0a769e3bd5897";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/ko/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/ko/thunderbird-60.3.2.tar.bz2";
       locale = "ko";
       arch = "linux-i686";
-      sha512 = "9453426d6bb088af4bc4e0e2eea7dd163d434fbb7a29993b82faea9e79a11aca95214aefbac6278a44b90356eaca050ba081dccbb0e57bf5eadfddb992251ee4";
+      sha512 = "980b2fe49c2f705296ff9036e6714f2039a81ca8c591dd8a0567ba2171196f188be647a3aab1bab25fd48c7f3a02b75307f0a35edb36c534785d51c207fd7203";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/lt/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/lt/thunderbird-60.3.2.tar.bz2";
       locale = "lt";
       arch = "linux-i686";
-      sha512 = "a0a3580444318c1bae14d8123cb215c37c32ef4e7f0db87e118054c34d7c3fb9b4d3659241379a23360680ddef6bbaec9fd3a514790efd6cd5f43d58de2fab30";
+      sha512 = "e3b37725dcc8f97f36c7e57450b911ba4547b2f34720f27cd89b7f2be92bcc0ee20f1e3426e623a53125013b447ea90df138da53c68de535620f548c955915f0";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/ms/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/ms/thunderbird-60.3.2.tar.bz2";
       locale = "ms";
       arch = "linux-i686";
-      sha512 = "8295bef9738e4808fe0e72fdc27f772f493ef8ec0ba1ee66923a51e45088152bf61ef0dc1539af7de6e6c637dae1b9ea70ea89912e621a27083550f7abb47c70";
+      sha512 = "a27ab9c7c524f7dbeb6dde32f36c4cd0f3fe20026e90793bf6fb6396f9a7816aee99c48574224c72be8aba5922dd3d7a21b6c05cbbf8caf1e7b956af50018f2e";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/nb-NO/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/nb-NO/thunderbird-60.3.2.tar.bz2";
       locale = "nb-NO";
       arch = "linux-i686";
-      sha512 = "3311340af28fe81452c27c704420a9e30ca9c1ff1dc3b7ce2a49210e83149c0fdea1014f546109704f14cd467963624f8634568df7764085a88e078a58cf8af4";
+      sha512 = "45135f0d62b03919b754b2b95329dd4a60ad7a2ad1ed4fdff5f174df5d1391111c9f3acd1a0b4ee71b340327b06180619fe84740b43fa8d6fa5d70ea6bcba0da";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/nl/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/nl/thunderbird-60.3.2.tar.bz2";
       locale = "nl";
       arch = "linux-i686";
-      sha512 = "7b6ebfa8c12da1e73769f74ea15fbd339e0886783bf4a51fb1c612d7d7372cddd0abdfe654760880c4bdbee6930349b6290c3d52d886915445110449cdef8d6f";
+      sha512 = "be4fd59d184fd161aa2afa1d2a13a11e54adad4329991b588d373a206b5f2e41bd03d51c1270d6bfc6c84a83c520cd3859eea8f5dbe71b0d2fbfe4bdac2a862e";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/nn-NO/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/nn-NO/thunderbird-60.3.2.tar.bz2";
       locale = "nn-NO";
       arch = "linux-i686";
-      sha512 = "d89fabc6c2bf7b64eeca36b4b0b20e64e8e317764c24c9b4cf9430c54635e81ddf66879a3bd1748c295d3b52c523b63d4871823d98e86e1be68c953e0639fe6e";
+      sha512 = "896c6bfef19af9dc5cf48829869d47a7fcc2daeb9ce2f0a86a959fd6d656b6d721b024830f03230b9bf35a300b21dcb603d5e7aacb36666c33ff80bf5babf1a0";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/pl/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/pl/thunderbird-60.3.2.tar.bz2";
       locale = "pl";
       arch = "linux-i686";
-      sha512 = "5ee0bf77ccbf7f57fd4b4c7cc71befa785590d68c67141e135ef5f399e73a7e3cf2b5256f9420963c63b27a680168308772b313fea8a29c6aa322b8eaa46f059";
+      sha512 = "fb5f412f4bee2af9fed61f310306b883e78b4d64934643cfa0418b69a54e29f746b427e97f58aa94031bf1428d959e3c7e7605dc98c3658163f34217e87ed051";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/pt-BR/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/pt-BR/thunderbird-60.3.2.tar.bz2";
       locale = "pt-BR";
       arch = "linux-i686";
-      sha512 = "2243bfd560aff648ffe73cc9e7c6218bf6a1dc81e9970a097742a37aef6becdb93e5226d7340d7b69ee7a7a74785f7c06d93d0da726869ad339a715c265dbd5e";
+      sha512 = "d1cfa631a3491f1015b8182ef5beb8046cebb0d2a0f541a31dfaac88b2f54586c8a6ad15a23ad17aac0c1ff9ec3b5a214002f0aa46dea37698093ca9f71ad288";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/pt-PT/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/pt-PT/thunderbird-60.3.2.tar.bz2";
       locale = "pt-PT";
       arch = "linux-i686";
-      sha512 = "06a4caf81f561fd943050bfbb36b2f9190790f407aaecd8f20a3dcaca82bd037edd70622ace1dcf41fa4be1109ad9e80fd40332e45034895dc3fec148fd334aa";
+      sha512 = "5d63808463b829f6bffea85d0c07119ba8d33f09f39fd7494f84d12dcf205286df6e87ff1dbbeac8a6961403060f0f23b148c2ebe0329e47ec8dbab3b94267c6";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/rm/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/rm/thunderbird-60.3.2.tar.bz2";
       locale = "rm";
       arch = "linux-i686";
-      sha512 = "4664931159370d114a50f075d7fd0cec7fa0bb3e91b96d7778b206ed5e748bbe71a9f30ec1a3a7a41849b524b409e024346c5c5344d18b5eb94aa939b86f59e2";
+      sha512 = "b8c0b360b47ab9d43fa2ec3fa0fde1cacc8cc7d2f47e43eda2b4f973991d2df247520d0a10972777ce78d87887e0ace82844aec5955d122cef3119328367c862";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/ro/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/ro/thunderbird-60.3.2.tar.bz2";
       locale = "ro";
       arch = "linux-i686";
-      sha512 = "f0b19356c5917e16edeb8f120b0765f948010198a1bb8fa45e4bf7965553677f01920cf34b816d0dc3ba9190a11b6fb72ee33f0239e2e5974c60bd2929924a7b";
+      sha512 = "3a696c7bcf2ee63ca797579d5a196659cc00ebba9ccbd7f41450aa5f8352260cd7cece56b43722ff09dafeafa2e11e76bd51f6863a7badd15f550ef1e38c6ce5";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/ru/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/ru/thunderbird-60.3.2.tar.bz2";
       locale = "ru";
       arch = "linux-i686";
-      sha512 = "b79517c780485098ae0aa91d275e8f314b8914a1a84400646963e0a23bd9179fe9dd3b63b80e45cc102296364bed639ab45841932d0bf93142e38850764125e7";
+      sha512 = "897df974fdda8f9c68091a15ddaaf36261b4d68183c3f09442fff486c2a86249e24744187cf85cfcd3217f54340a7c51f14ecc618373101ecd264ae767a387e2";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/si/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/si/thunderbird-60.3.2.tar.bz2";
       locale = "si";
       arch = "linux-i686";
-      sha512 = "d7a4a804c0122a902d513e6bbde37fb75b35a6a49300992aa81f6590becff6315d757c095f35505dce48b1e4d6b4963f7484f636c0d87d5ecf0cdfc1b9f44464";
+      sha512 = "35b16423c41886f28a9aab9e9b5ebcc811ac03424a89b9e6f7ca494f8cc43a1c51668854d9c479fde8f977306290cf0b5bd2eb4c0c60fc98fc6522333624890e";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/sk/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/sk/thunderbird-60.3.2.tar.bz2";
       locale = "sk";
       arch = "linux-i686";
-      sha512 = "f50653801aff3f8596cfcdaf53755b5557e69aa237a76bd5598bc349839616a18b2a7703ce79094b6719d7e544f66a114b5d61ac9ef65f20c4f10a2e7b2cbe45";
+      sha512 = "5e4855121d4d36dc639a85986d5ccef62c7eff28008d7d2c5150becd75ebe6f95a5ae54a280e35e50c5f2cbc27665a709e1fdc55860d17b893b2fc2e48d0e56b";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/sl/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/sl/thunderbird-60.3.2.tar.bz2";
       locale = "sl";
       arch = "linux-i686";
-      sha512 = "d98731420605736ec5ba1df75a38b8a44ebe2a29c307fb7e63f51db0b2f8d2fab0bde2c8e4d9778bba82545f04f42a80bff1659cf49f3a1db5ad5418cfe9c34f";
+      sha512 = "93ca3fb5eec8edeb050d8c293446f44c975f5b206de5ceac7cf9a7feb3699c90c1e85848fb22108ec757960d6a686d68ffba61644b20d1e0c8ffd0a126dadd17";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/sq/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/sq/thunderbird-60.3.2.tar.bz2";
       locale = "sq";
       arch = "linux-i686";
-      sha512 = "8973e874151efb48343dec2c192e98015740d160dff902d1c07f6f1a5e770344ed07260bb4986892615f31b5c06f56a59406def6d7af20cab04edcba2e5b6003";
+      sha512 = "891a6a103eb05b84af59c76cee7742d5ad04aa51beb955a7023852879e2853b5ac2b79af2dd45f87cefbcd176ab7d6bda9773f9af8e624435ac228d0c04ce298";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/sr/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/sr/thunderbird-60.3.2.tar.bz2";
       locale = "sr";
       arch = "linux-i686";
-      sha512 = "354706cac183b91067d55d49b16f525aef6c5abbedb729d321e615d8e29c05976ec8e33c905600584bf2e64ba8fb27472fe14a9390e2188fb2b236df0cf7d39e";
+      sha512 = "14d84a42a89b84d2aeca1e4b4f2b2ecb30dd5e940ccb77a7b6337df88d0c73e4cfdaae0c6fdc055e6cbe213ad4652361c3b5f37680e09506da354bcc492cc155";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/sv-SE/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/sv-SE/thunderbird-60.3.2.tar.bz2";
       locale = "sv-SE";
       arch = "linux-i686";
-      sha512 = "8714ecbaf368d5c405224163bc1f0047b498770167dc6ffd53cc1bb0828228cd48933a5ff7e5116634e1c50218d08d27fa667942878a19fa2f0a4398ab0fa458";
+      sha512 = "4a51fbca27bb37b556fd3aaaca45ba0f18129089da8d69d796ea6c13fcf8e65138db7d3f87d355777ce325c7f0e7b7b643d7a0c6067f71ca63e1c37c052d34ca";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/tr/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/tr/thunderbird-60.3.2.tar.bz2";
       locale = "tr";
       arch = "linux-i686";
-      sha512 = "e8e62fdc8704f91754be9a97f288d113577039bbca1ed69c01e577cc8813e4302f9cd1842f38a91cb8d9899a7a9317b59e931e65f492e619b6b6c2a736117366";
+      sha512 = "332deb7803f935e67bc3d3e8ff55255f5ac8a6a7f128fef924c78aeb8b4023f0f562b9957dbdf84ba25c4b65a55028a8b341a0764ec4aced8fb127b05c083029";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/uk/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/uk/thunderbird-60.3.2.tar.bz2";
       locale = "uk";
       arch = "linux-i686";
-      sha512 = "d948efc3e6bd4c9392fed77f52e77998f5b1a202945a6e4bd3b3bcc8332925c6d8de5d48c9737401e94ac701ee7d9e334819fd3718b600914650ee57bef5a5bc";
+      sha512 = "0c96360839e9e72848b1574c389cd29d71e3225cfaca7292c83f9835c4c9d59cb324b390acb00666861f7a060eedc233ac84dc475536e9b206af75e9fa4edf49";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/vi/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/vi/thunderbird-60.3.2.tar.bz2";
       locale = "vi";
       arch = "linux-i686";
-      sha512 = "929f5c94418de4df462356e0321088482e1e7ece9fe1838123c12f7649c2762e53d20de75bb77f77bc54add23985653ba77b63502b19912b6bc82f2b0ef1dfa0";
+      sha512 = "b0421b6a3ee1dd95d3282c69d618eadf8f1fb69f72d61bec63fa82544d387780b2f80b2531c48c853fcfb4e9a50d14a79b145d3fe3f9ca0919582876385d63af";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/zh-CN/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/zh-CN/thunderbird-60.3.2.tar.bz2";
       locale = "zh-CN";
       arch = "linux-i686";
-      sha512 = "b746273c7ad7651521d6072f211351c3b585d25ebd48027be3b93a3ce0e09abdaae2a63e97eca013dba046dbadf97f5d4a38fd08bf4a9304c7622881367af73a";
+      sha512 = "22197ee9de592ea02894cf3cffda12267a4999b3fba31a6f90c621aec502834753f09834ed80901f156a385f7af6c1ff4a3d6558a47b2e489f153d1d727d0bd6";
     }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.1/linux-i686/zh-TW/thunderbird-60.3.1.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/60.3.2/linux-i686/zh-TW/thunderbird-60.3.2.tar.bz2";
       locale = "zh-TW";
       arch = "linux-i686";
-      sha512 = "9251b5688967e87f521bc283b0000194eb98c2ce157aa8befe624146d5dcbf4e7237944d3ae8c0045a0667172fd68616e179fb3ecf6e0f848f7e15a6a2b21f00";
+      sha512 = "8e7e3d7063ef9b5e56f000cfada185ad31951b3ccf7dd9f84455fde7490e3cafef934f0b3501b70d7746464aa5b41180f6f9eeecc7b580d07823bf2ec97d11e8";
     }
     ];
 }
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/default.nix b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
index 155916c81bf..a372a92e948 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@@ -24,11 +24,11 @@ let
   gcc = if stdenv.cc.isGNU then stdenv.cc.cc else stdenv.cc.cc.gcc;
 in stdenv.mkDerivation rec {
   name = "thunderbird-${version}";
-  version = "60.3.1";
+  version = "60.3.2";
 
   src = fetchurl {
     url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
-    sha512 = "266m4kwxiwh1zi60z4gcs54k4w903aximafngmmqaa5nkxnsxh6sp62j1mazdh52g40pzdy9sqb8zkcjsm7dp937kpcl2lvw778lanm";
+    sha512 = "27hdv1c0jgwk6lkkdfy1rx7r29s2girikbbrriwr9v1gvmf7j3vgdldk7wqijjcp185dbp714wh3n5kp1p9f3sa8mf7z6321xby0mf7";
   };
 
   # from firefox, but without sound libraries
@@ -202,6 +202,6 @@ in stdenv.mkDerivation rec {
   passthru.updateScript = import ./../../browsers/firefox/update.nix {
     attrPath = "thunderbird";
     baseUrl = "http://archive.mozilla.org/pub/thunderbird/releases/";
-    inherit writeScript lib common-updater-scripts xidel coreutils gnused gnugrep curl;
+    inherit stdenv writeScript lib common-updater-scripts xidel coreutils gnused gnugrep curl;
   };
 }
diff --git a/pkgs/applications/networking/p2p/qbittorrent/default.nix b/pkgs/applications/networking/p2p/qbittorrent/default.nix
index 673ece2cb72..532efa68f9a 100644
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@@ -10,13 +10,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "qbittorrent-${version}";
-  version = "4.1.3";
+  version = "4.1.4";
 
   src = fetchFromGitHub {
     owner = "qbittorrent";
     repo = "qbittorrent";
     rev = "release-${version}";
-    sha256 = "1hpcn1x4z3vdjscw035d18vqhfs7c6yv002akgmbgdf9jl3vfrsl";
+    sha256 = "1hclyahgzj775h1fnv2rck9cw3r2yp2r6p1q263mj890n32gf3hp";
   };
 
   # NOTE: 2018-05-31: CMake is working but it is not officially supported
diff --git a/pkgs/applications/office/mendeley/default.nix b/pkgs/applications/office/mendeley/default.nix
index 5b6271db83b..aa9317d2ffd 100644
--- a/pkgs/applications/office/mendeley/default.nix
+++ b/pkgs/applications/office/mendeley/default.nix
@@ -131,7 +131,7 @@ stdenv.mkDerivation {
   dontStrip = true;
   dontPatchElf = true;
 
-  updateScript = import ./update.nix { inherit writeScript; };
+  updateScript = import ./update.nix { inherit stdenv writeScript; };
 
   meta = with stdenv.lib; {
     homepage = http://www.mendeley.com;
diff --git a/pkgs/applications/office/mendeley/update.nix b/pkgs/applications/office/mendeley/update.nix
index cb9ee02702d..147c95b8e7b 100644
--- a/pkgs/applications/office/mendeley/update.nix
+++ b/pkgs/applications/office/mendeley/update.nix
@@ -1,6 +1,7 @@
-{ writeScript }:
+{ stdenv, writeScript }:
 
 writeScript "update-mendeley" ''
+  #!${stdenv.shell}
   function follow() {
     local URL=$1
     while true; do
diff --git a/pkgs/applications/science/electronics/archimedes/default.nix b/pkgs/applications/science/electronics/archimedes/default.nix
index a6a5f68755a..016760bde02 100644
--- a/pkgs/applications/science/electronics/archimedes/default.nix
+++ b/pkgs/applications/science/electronics/archimedes/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "GNU package for semiconductor device simulations";
-    homepage = http://www.gnu.org/software/archimedes;
+    homepage = https://www.gnu.org/software/archimedes;
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = with stdenv.lib.platforms; linux;
   };
diff --git a/pkgs/applications/science/math/maxima/default.nix b/pkgs/applications/science/math/maxima/default.nix
index 892b9d9520e..9f6e281849d 100644
--- a/pkgs/applications/science/math/maxima/default.nix
+++ b/pkgs/applications/science/math/maxima/default.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation ({
 
   # Failures in the regression test suite won't abort the build process. We run
   # the suite only so that potential errors show up in the build log. See also:
-  # http://sourceforge.net/tracker/?func=detail&aid=3365831&group_id=4933&atid=104933.
+  # https://sourceforge.net/tracker/?func=detail&aid=3365831&group_id=4933&atid=104933.
   doCheck = true;
 
   enableParallelBuilding = true;
diff --git a/pkgs/applications/science/math/pspp/default.nix b/pkgs/applications/science/math/pspp/default.nix
index 1afbc2b72e5..c53e87caa9a 100644
--- a/pkgs/applications/science/math/pspp/default.nix
+++ b/pkgs/applications/science/math/pspp/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = http://www.gnu.org/software/pspp/;
+    homepage = https://www.gnu.org/software/pspp/;
     description = "A free replacement for SPSS, a program for statistical analysis of sampled data";
     license = stdenv.lib.licenses.gpl3Plus;
 
diff --git a/pkgs/applications/science/math/sage/env-locations.nix b/pkgs/applications/science/math/sage/env-locations.nix
index 9d94e9ca5e3..9ec8d5cd83e 100644
--- a/pkgs/applications/science/math/sage/env-locations.nix
+++ b/pkgs/applications/science/math/sage/env-locations.nix
@@ -39,7 +39,7 @@ writeTextFile rec {
     export ECLDIR='${ecl}/lib/ecl-${ecl.version}/'
     export COMBINATORIAL_DESIGN_DATA_DIR="${combinatorial_designs}/share/combinatorial_designs"
     export CREMONA_MINI_DATA_DIR="${elliptic_curves}/share/cremona"
-    export JMOL_DIR="${jmol}"
+    export JMOL_DIR="${jmol}/share/jmol" # point to the directory that contains JmolData.jar
     export JSMOL_DIR="${jmol}/share/jsmol"
     export MATHJAX_DIR="${mathjax}/lib/node_modules/mathjax"
     export THREEJS_DIR="${three}/lib/node_modules/three"
diff --git a/pkgs/applications/science/math/sage/sage-env.nix b/pkgs/applications/science/math/sage/sage-env.nix
index 725ca043867..c071f894550 100644
--- a/pkgs/applications/science/math/sage/sage-env.nix
+++ b/pkgs/applications/science/math/sage/sage-env.nix
@@ -44,6 +44,7 @@
 , zlib
 , gsl
 , ntl
+, jdk
 }:
 
 # This generates a `sage-env` shell file that will be sourced by sage on startup.
@@ -91,6 +92,7 @@ let
     lcalc
     rubiks
     flintqs
+    jdk # only needed for `jmol` which may be replaced in the future
   ]
   ));
 in
diff --git a/pkgs/applications/science/math/sage/sagenb.nix b/pkgs/applications/science/math/sage/sagenb.nix
index 5adfde4388a..bbd403177f3 100644
--- a/pkgs/applications/science/math/sage/sagenb.nix
+++ b/pkgs/applications/science/math/sage/sagenb.nix
@@ -55,6 +55,7 @@ buildPythonPackage rec {
 
   # let sagenb use mathjax
   postInstall = ''
-    ln -s ${mathjax}/lib/node_modules/mathjax "$out/${python.sitePackages}/mathjax"
+    mkdir -p "$out/${python.sitePackages}/sagenb/data"
+    ln -s ${mathjax}/lib/node_modules/mathjax "$out/${python.sitePackages}/sagenb/data/mathjax"
   '';
 }
diff --git a/pkgs/applications/science/math/scilab-bin/default.nix b/pkgs/applications/science/math/scilab-bin/default.nix
index 54b262fe505..c3a74d14bc0 100644
--- a/pkgs/applications/science/math/scilab-bin/default.nix
+++ b/pkgs/applications/science/math/scilab-bin/default.nix
@@ -61,9 +61,40 @@ stdenv.mkDerivation rec {
   installPhase = ''
     mkdir -p "$out/opt/scilab-${ver}"
     cp -r . "$out/opt/scilab-${ver}/"
+
+    # Create bin/ dir
     mkdir "$out/bin"
-    ln -s "$out/opt/scilab-${ver}/bin/scilab" "$out/bin/scilab-${ver}"
-    ln -s "scilab-${ver}" "$out/bin/scilab-${majorVer}"
+
+    # Creating executable symlinks
+    ln -s "$out/opt/scilab-${ver}/bin/scilab" "$out/bin/scilab"
+    ln -s "$out/opt/scilab-${ver}/bin/scilab-cli" "$out/bin/scilab-cli"
+    ln -s "$out/opt/scilab-${ver}/bin/scilab-adv-cli" "$out/bin/scilab-adv-cli"
+
+    # Creating desktop config dir
+    mkdir -p "$out/share/applications"
+
+    # Moving desktop config files
+    mv $out/opt/scilab-${ver}/share/applications/*.desktop $out/share/applications
+
+    # Fixing Exec paths and launching each app with a terminal
+    sed -i -e "s|Exec=|Exec=$out/opt/scilab-${ver}/bin/|g" \
+           -e "s|Terminal=.*$|Terminal=true|g" $out/share/applications/*.desktop
+
+    # Moving icons to the appropriate locations
+    for path in $out/opt/scilab-${ver}/share/icons/hicolor/*/*/*
+    do
+      newpath=$(echo $path | sed 's|/opt/scilab-${ver}||g')
+      filename=$(echo $path | sed 's|.*/||g')
+      dir=$(echo $newpath | sed "s|$filename||g")
+      mkdir -p $dir
+      mv $path $newpath
+    done
+
+    # Removing emptied folders
+    rm -rf $out/opt/scilab-${ver}/share/{applications,icons}
+
+    # Moving other share/ folders
+    mv $out/opt/scilab-${ver}/share/{appdata,locale,mime} $out/share
   '';
 
   meta = {
diff --git a/pkgs/applications/science/misc/motu-client/default.nix b/pkgs/applications/science/misc/motu-client/default.nix
index 0994bb1ca38..d4367ef7e2d 100644
--- a/pkgs/applications/science/misc/motu-client/default.nix
+++ b/pkgs/applications/science/misc/motu-client/default.nix
@@ -12,10 +12,10 @@ python27Packages.buildPythonApplication rec {
     homepage = https://github.com/quiet-oceans/motuclient-setuptools;
     description = "CLI to query oceanographic data to Motu servers";
     longDescription = ''
-      Access data from (motu)[http://sourceforge.net/projects/cls-motu/] servers.
+      Access data from (motu)[https://sourceforge.net/projects/cls-motu/] servers.
       This is a refactored fork of the original release in order to simplify integration,
       deployment and packaging. Upstream code can be found at
-      http://sourceforge.net/projects/cls-motu/ .
+      https://sourceforge.net/projects/cls-motu/ .
     '';
     license = licenses.lgpl3Plus;
     maintainers = [ maintainers.lsix ];
diff --git a/pkgs/applications/version-management/arch/default.nix b/pkgs/applications/version-management/arch/default.nix
index 3dd8b9f860d..bc62004065b 100644
--- a/pkgs/applications/version-management/arch/default.nix
+++ b/pkgs/applications/version-management/arch/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "GNU Arch (aka. `tla'), a distributed revision control system";
-    homepage = http://www.gnu.org/software/gnu-arch/;
+    homepage = https://www.gnu.org/software/gnu-arch/;
     license = "GPL";
   };
 }
diff --git a/pkgs/applications/version-management/git-and-tools/git-secrets/default.nix b/pkgs/applications/version-management/git-and-tools/git-secrets/default.nix
index a2f0c8ae414..fb85bb7da46 100644
--- a/pkgs/applications/version-management/git-and-tools/git-secrets/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-secrets/default.nix
@@ -1,40 +1,32 @@
-{ stdenv, lib, fetchFromGitHub, makeWrapper, git }:
+{ stdenv, fetchFromGitHub, makeWrapper, git, coreutils }:
 
-let
+stdenv.mkDerivation rec {
+  name = "git-secrets-${version}";
   version = "1.2.1";
-  repo = "git-secrets";
-
-in stdenv.mkDerivation {
-  name = "${repo}-${version}";
 
   src = fetchFromGitHub {
-    inherit repo;
     owner = "awslabs";
+    repo = "git-secrets";
     rev = "${version}";
     sha256 = "14jsm4ks3k5d9iq3jr23829izw040pqpmv7dz8fhmvx6qz8fybzg";
   };
 
-  buildInputs = [ makeWrapper git];
+  nativeBuildInputs = [ makeWrapper ];
+
+  dontBuild = true;
 
-  # buildPhase = ''
-  #  make man # TODO: need rst2man.py
-  # '';
-  
   installPhase = ''
-    install -D git-secrets $out/bin/git-secrets
+    install -m755 -Dt $out/bin git-secrets
+    install -m444 -Dt $out/share/man/man1 git-secrets.1
 
     wrapProgram $out/bin/git-secrets \
-      --prefix PATH : "${lib.makeBinPath [ git ]}"
-
-    # TODO: see above note on rst2man.py
-    # mkdir $out/share
-    # cp -r man $out/share
+      --prefix PATH : "${stdenv.lib.makeBinPath [ git coreutils ]}"
   '';
 
-  meta = {
-    description = "Prevents you from committing passwords and other sensitive information to a git repository";
+  meta = with stdenv.lib; {
+    description = "Prevents you from committing secrets and credentials into git repositories";
     homepage = https://github.com/awslabs/git-secrets;
-    license = stdenv.lib.licenses.asl20;
-    platforms = stdenv.lib.platforms.all;
+    license = licenses.asl20;
+    platforms = platforms.all;
   };
 }
diff --git a/pkgs/applications/version-management/rcs/default.nix b/pkgs/applications/version-management/rcs/default.nix
index 5acced4ac07..df1739aea57 100644
--- a/pkgs/applications/version-management/rcs/default.nix
+++ b/pkgs/applications/version-management/rcs/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   NIX_CFLAGS_COMPILE = [ "-std=c99" ];
 
   meta = {
-    homepage = http://www.gnu.org/software/rcs/;
+    homepage = https://www.gnu.org/software/rcs/;
     description = "Revision control system";
     longDescription =
       '' The GNU Revision Control System (RCS) manages multiple revisions of
diff --git a/pkgs/applications/window-managers/dwm/dwm-status.nix b/pkgs/applications/window-managers/dwm/dwm-status.nix
index 16a67030736..f88ef63bc2e 100644
--- a/pkgs/applications/window-managers/dwm/dwm-status.nix
+++ b/pkgs/applications/window-managers/dwm/dwm-status.nix
@@ -1,15 +1,21 @@
 { stdenv, lib, rustPlatform, fetchFromGitHub, dbus, gdk_pixbuf, libnotify, makeWrapper, pkgconfig, xorg
-, enableAlsaUtils ? true, alsaUtils }:
+, enableAlsaUtils ? true, alsaUtils, bash, coreutils }:
+
+let
+  binPath = stdenv.lib.makeBinPath [
+    alsaUtils bash coreutils
+  ];
+in
 
 rustPlatform.buildRustPackage rec {
   name = "dwm-status-${version}";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "Gerschtli";
     repo = "dwm-status";
     rev = version;
-    sha256 = "1v9ksv8hdxhpm7vs71p9s1y3gnahczza0w4wyrk2fsc6x2kwlh6x";
+    sha256 = "054lwgqpx3kbrnlsqbnd8fxsawvw3nl702pf56c7dcm4sfws15nl";
   };
 
   nativeBuildInputs = [ makeWrapper pkgconfig ];
@@ -19,7 +25,7 @@ rustPlatform.buildRustPackage rec {
 
   postInstall = lib.optionalString enableAlsaUtils ''
     wrapProgram $out/bin/dwm-status \
-      --prefix "PATH" : "${alsaUtils}/bin"
+      --prefix "PATH" : "${binPath}"
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/applications/window-managers/ratpoison/default.nix b/pkgs/applications/window-managers/ratpoison/default.nix
index fded0ee24a5..a69d3164a13 100644
--- a/pkgs/applications/window-managers/ratpoison/default.nix
+++ b/pkgs/applications/window-managers/ratpoison/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://www.nongnu.org/ratpoison/;
+    homepage = https://www.nongnu.org/ratpoison/;
     description = "Simple mouse-free tiling window manager";
     license = licenses.gpl2Plus;
 
diff --git a/pkgs/applications/window-managers/tabbed/default.nix b/pkgs/applications/window-managers/tabbed/default.nix
index 3bb79f6a77d..a9c0f993d77 100644
--- a/pkgs/applications/window-managers/tabbed/default.nix
+++ b/pkgs/applications/window-managers/tabbed/default.nix
@@ -3,12 +3,12 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  name = "tabbed-20160425";
+  name = "tabbed-20180310";
 
   src = fetchgit {
     url = https://git.suckless.org/tabbed;
-    rev = "bc236142fa72d2f9d6b5c790d3f3a9a9168a7164";
-    sha256 = "1fiv57g3jnlhnb6zrzl3n6lnpn2s9s0sd7bcv7r1nb3grwy7icri";
+    rev = "b5f9ec647aae2d9a1d3bd586eb7523a4e0a329a3";
+    sha256 = "0frj2yjaf0mfjwgyfappksfir52mx2xxd3cdg5533m5d88vbmxss";
   };
 
   inherit patches;
diff --git a/pkgs/data/documentation/std-man-pages/default.nix b/pkgs/data/documentation/std-man-pages/default.nix
index 04683ceddb3..34597135500 100644
--- a/pkgs/data/documentation/std-man-pages/default.nix
+++ b/pkgs/data/documentation/std-man-pages/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "C++ STD manual pages";
-    homepage = http://gcc.gnu.org/;
+    homepage = https://gcc.gnu.org/;
     license = "GPL/LGPL";
     platforms = stdenv.lib.platforms.unix;
   };
diff --git a/pkgs/data/fonts/freefont-ttf/default.nix b/pkgs/data/fonts/freefont-ttf/default.nix
index 87b3abe2911..39118716f6f 100644
--- a/pkgs/data/fonts/freefont-ttf/default.nix
+++ b/pkgs/data/fonts/freefont-ttf/default.nix
@@ -19,7 +19,7 @@ fetchzip rec {
       (PostScript Type0, TrueType, OpenType...) fonts covering the ISO
       10646/Unicode UCS (Universal Character Set).
     '';
-    homepage = http://www.gnu.org/software/freefont/;
+    homepage = https://www.gnu.org/software/freefont/;
     license = stdenv.lib.licenses.gpl3Plus;
     platforms = stdenv.lib.platforms.all;
     maintainers = [];
diff --git a/pkgs/data/machine-learning/mnist/default.nix b/pkgs/data/machine-learning/mnist/default.nix
new file mode 100644
index 00000000000..26b06b4e652
--- /dev/null
+++ b/pkgs/data/machine-learning/mnist/default.nix
@@ -0,0 +1,45 @@
+{ stdenvNoCC, fetchurl }:
+let
+  srcs = {
+    train-images = fetchurl {
+      url = "http://yann.lecun.com/exdb/mnist/train-images-idx3-ubyte.gz";
+      sha256 = "029na81z5a1c9l1a8472dgshami6f2iixs3m2ji6ym6cffzwl3s4";
+    };
+    train-labels = fetchurl {
+      url = "http://yann.lecun.com/exdb/mnist/train-labels-idx1-ubyte.gz";
+      sha256 = "0p152200wwx0w65sqb65grb3v8ncjp230aykmvbbx2sm19556lim";
+    };
+    test-images = fetchurl {
+      url = "http://yann.lecun.com/exdb/mnist/t10k-images-idx3-ubyte.gz";
+      sha256 = "1rn4vfigaxn2ms24bf4jwzzflgp3hvz0gksvb8j7j70w19xjqhld";
+    };
+    test-labels = fetchurl {
+      url = "http://yann.lecun.com/exdb/mnist/t10k-labels-idx1-ubyte.gz";
+      sha256 = "1imf0i194ndjxzxdx87zlgn728xx3p1qhq1ssbmnvv005vwn1bpp";
+    };
+  };
+in
+  stdenvNoCC.mkDerivation rec {
+    name = "mnist-${version}";
+    version = "2018-11-16";
+    installPhase = ''
+      mkdir -p $out
+      ln -s "${srcs.train-images}" "$out/${srcs.train-images.name}"
+      ln -s "${srcs.train-labels}" "$out/${srcs.train-labels.name}"
+      ln -s "${srcs.test-images}" "$out/${srcs.test-images.name}"
+      ln -s "${srcs.test-labels}" "$out/${srcs.test-labels.name}"
+    '';
+    phases = [ "installPhase" ];
+    meta = with stdenvNoCC.lib; {
+      description = "A large database of handwritten digits";
+      longDescription = ''
+        The MNIST database (Modified National Institute of Standards and
+        Technology database) is a large database of handwritten digits that is
+        commonly used for training various image processing systems.
+      '';
+      homepage = http://yann.lecun.com/exdb/mnist/index.html;
+      license = licenses.cc-by-sa-30;
+      platforms = platforms.all;
+      maintainers = with maintainers; [ cmcdragonkai ];
+    };
+  }
diff --git a/pkgs/data/misc/miscfiles/default.nix b/pkgs/data/misc/miscfiles/default.nix
index 30fede80251..4e1d1e02a2f 100644
--- a/pkgs/data/misc/miscfiles/default.nix
+++ b/pkgs/data/misc/miscfiles/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/miscfiles/;
+    homepage = https://www.gnu.org/software/miscfiles/;
     license = licenses.gpl2Plus;
     description = "Collection of files not of crucial importance for sysadmins";
     maintainers = with maintainers; [ pSub ];
diff --git a/pkgs/desktops/deepin/update.nix b/pkgs/desktops/deepin/update.nix
index 761ead015c6..22a6acb8ce3 100644
--- a/pkgs/desktops/deepin/update.nix
+++ b/pkgs/desktops/deepin/update.nix
@@ -1,4 +1,4 @@
-{ lib, writeScript, coreutils, curl, gnugrep, gnused, jq, common-updater-scripts, nix }:
+{ stdenv, lib, writeScript, coreutils, curl, gnugrep, gnused, jq, common-updater-scripts, nix }:
 { name, ignored-versions ? "^2014\\.|^v[0-9]+" }:
 
 let
@@ -9,6 +9,7 @@ let
 in
 
 writeScript "update-${packageName}" ''
+  #!${stdenv.shell}
   set -o errexit
   set -x
 
diff --git a/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix b/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
index 1547c364b51..ac9a87299ab 100644
--- a/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
+++ b/pkgs/desktops/gnome-2/desktop/mail-notification/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Tray status icon, which notifies us when new email arrives";
-    homepage = http://www.nongnu.org/mailnotify/;
+    homepage = https://www.nongnu.org/mailnotify/;
     license = with licenses; [ gpl3 ];
     platforms = platforms.unix;
     maintainers = [ maintainers.eleanor ];
diff --git a/pkgs/desktops/gnome-3/update.nix b/pkgs/desktops/gnome-3/update.nix
index b7a6ce16d11..2ee72d46993 100644
--- a/pkgs/desktops/gnome-3/update.nix
+++ b/pkgs/desktops/gnome-3/update.nix
@@ -1,11 +1,16 @@
-{ lib, writeScript, python3, common-updater-scripts, coreutils, gnugrep, gnused }:
+{ stdenv, lib, writeScript, python3, common-updater-scripts, coreutils, gnugrep, gnused }:
 { packageName, attrPath ? packageName, versionPolicy ? "odd-unstable" }:
 
 let
   python = python3.withPackages (p: [ p.requests ]);
-in writeScript "update-${packageName}" ''
-  set -o errexit
-  PATH=${lib.makeBinPath [ common-updater-scripts coreutils gnugrep gnused python ]}
-  latest_tag=$(python "${./find-latest-version.py}" "${packageName}" "${versionPolicy}" "stable")
-  update-source-version "${attrPath}" "$latest_tag"
-''
+  updateScript = writeScript "gnome-update-script" ''
+    #!${stdenv.shell}
+    set -o errexit
+    package_name="$1"
+    attr_path="$2"
+    version_policy="$3"
+    PATH=${lib.makeBinPath [ common-updater-scripts coreutils gnugrep gnused python ]}
+    latest_tag=$(python "${./find-latest-version.py}" "$package_name" "$version_policy" "stable")
+    update-source-version "$attr_path" "$latest_tag"
+  '';
+in [ updateScript packageName attrPath versionPolicy ]
diff --git a/pkgs/development/compilers/fpc/default.upstream b/pkgs/development/compilers/fpc/default.upstream
index 7c11fb4761e..9f16c1b645c 100644
--- a/pkgs/development/compilers/fpc/default.upstream
+++ b/pkgs/development/compilers/fpc/default.upstream
@@ -1,4 +1,4 @@
-url http://sourceforge.net/projects/freepascal/files/Source/
+url https://sourceforge.net/projects/freepascal/files/Source/
 SF_version_dir
 version_link 'fpcbuild-[0-9.]+[.]tar[.]gz/download$'
 SF_redirect
diff --git a/pkgs/development/compilers/gcc/4.8/default.nix b/pkgs/development/compilers/gcc/4.8/default.nix
index a7a8011b2e6..9cfe03d6655 100644
--- a/pkgs/development/compilers/gcc/4.8/default.nix
+++ b/pkgs/development/compilers/gcc/4.8/default.nix
@@ -335,7 +335,7 @@ stdenv.mkDerivation ({
     then "install-strip"
     else "install";
 
-  # http://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
 
   # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
@@ -397,7 +397,7 @@ stdenv.mkDerivation ({
   inherit (stdenv) is64bit;
 
   meta = {
-    homepage = http://gcc.gnu.org/;
+    homepage = https://gcc.gnu.org/;
     license = stdenv.lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
     description = "GNU Compiler Collection, version ${version}"
       + (if stripped then "" else " (with debugging info)");
diff --git a/pkgs/development/compilers/gcc/4.9/default.nix b/pkgs/development/compilers/gcc/4.9/default.nix
index a3ba03f517a..9b23fe78599 100644
--- a/pkgs/development/compilers/gcc/4.9/default.nix
+++ b/pkgs/development/compilers/gcc/4.9/default.nix
@@ -348,7 +348,7 @@ stdenv.mkDerivation ({
     then "install-strip"
     else "install";
 
-  # http://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
 
   # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
@@ -409,7 +409,7 @@ stdenv.mkDerivation ({
   inherit (stdenv) is64bit;
 
   meta = {
-    homepage = http://gcc.gnu.org/;
+    homepage = https://gcc.gnu.org/;
     license = stdenv.lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
     description = "GNU Compiler Collection, version ${version}"
       + (if stripped then "" else " (with debugging info)");
diff --git a/pkgs/development/compilers/gcc/5/default.nix b/pkgs/development/compilers/gcc/5/default.nix
index 95e3d7b8492..5db2ac3d413 100644
--- a/pkgs/development/compilers/gcc/5/default.nix
+++ b/pkgs/development/compilers/gcc/5/default.nix
@@ -353,7 +353,7 @@ stdenv.mkDerivation ({
     then "install-strip"
     else "install";
 
-  # http://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
 
   # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
@@ -414,7 +414,7 @@ stdenv.mkDerivation ({
   inherit (stdenv) is64bit;
 
   meta = {
-    homepage = http://gcc.gnu.org/;
+    homepage = https://gcc.gnu.org/;
     license = stdenv.lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
     description = "GNU Compiler Collection, version ${version}"
       + (if stripped then "" else " (with debugging info)");
diff --git a/pkgs/development/compilers/gcc/6/default.nix b/pkgs/development/compilers/gcc/6/default.nix
index ff48e485a9a..99c79a99dce 100644
--- a/pkgs/development/compilers/gcc/6/default.nix
+++ b/pkgs/development/compilers/gcc/6/default.nix
@@ -355,7 +355,7 @@ stdenv.mkDerivation ({
     then "install-strip"
     else "install";
 
-  # http://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
 
   # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
@@ -416,7 +416,7 @@ stdenv.mkDerivation ({
   inherit (stdenv) is64bit;
 
   meta = {
-    homepage = http://gcc.gnu.org/;
+    homepage = https://gcc.gnu.org/;
     license = stdenv.lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
     description = "GNU Compiler Collection, version ${version}"
       + (if stripped then "" else " (with debugging info)");
diff --git a/pkgs/development/compilers/gcc/7/default.nix b/pkgs/development/compilers/gcc/7/default.nix
index 9235908f14c..d790246717d 100644
--- a/pkgs/development/compilers/gcc/7/default.nix
+++ b/pkgs/development/compilers/gcc/7/default.nix
@@ -319,7 +319,7 @@ stdenv.mkDerivation ({
     then "install-strip"
     else "install";
 
-  # http://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
 
   # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
@@ -367,7 +367,7 @@ stdenv.mkDerivation ({
   inherit (stdenv) is64bit;
 
   meta = {
-    homepage = http://gcc.gnu.org/;
+    homepage = https://gcc.gnu.org/;
     license = stdenv.lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
     description = "GNU Compiler Collection, version ${version}"
       + (if stripped then "" else " (with debugging info)");
diff --git a/pkgs/development/compilers/gcc/8/default.nix b/pkgs/development/compilers/gcc/8/default.nix
index 363694dcf4e..80d57c9d538 100644
--- a/pkgs/development/compilers/gcc/8/default.nix
+++ b/pkgs/development/compilers/gcc/8/default.nix
@@ -304,7 +304,7 @@ stdenv.mkDerivation ({
     then "install-strip"
     else "install";
 
-  # http://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
 
   # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
@@ -345,7 +345,7 @@ stdenv.mkDerivation ({
   inherit (stdenv) is64bit;
 
   meta = {
-    homepage = http://gcc.gnu.org/;
+    homepage = https://gcc.gnu.org/;
     license = stdenv.lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
     description = "GNU Compiler Collection, version ${version}"
       + (if stripped then "" else " (with debugging info)");
diff --git a/pkgs/development/compilers/gcc/snapshot/default.nix b/pkgs/development/compilers/gcc/snapshot/default.nix
index 586fb2b44e1..a07f6f1feb2 100644
--- a/pkgs/development/compilers/gcc/snapshot/default.nix
+++ b/pkgs/development/compilers/gcc/snapshot/default.nix
@@ -269,7 +269,7 @@ stdenv.mkDerivation ({
     then "install-strip"
     else "install";
 
-  # http://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
+  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
   ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
 
   # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
@@ -317,7 +317,7 @@ stdenv.mkDerivation ({
   inherit (stdenv) is64bit;
 
   meta = {
-    homepage = http://gcc.gnu.org/;
+    homepage = https://gcc.gnu.org/;
     license = stdenv.lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
     description = "GNU Compiler Collection, version ${version}"
       + (if stripped then "" else " (with debugging info)");
diff --git a/pkgs/development/compilers/gcl/2.6.13-pre.nix b/pkgs/development/compilers/gcl/2.6.13-pre.nix
index 71a6eaa8db8..1e8bdbd4e68 100644
--- a/pkgs/development/compilers/gcl/2.6.13-pre.nix
+++ b/pkgs/development/compilers/gcl/2.6.13-pre.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchgit {
     sha256 = "0vpxb6z5g9fjavrgx8gz8fsjvskfz64f63qibh5s00fvvndlwi88";
-    url = "http://git.savannah.gnu.org/r/gcl.git";
+    url = "https://git.savannah.gnu.org/r/gcl.git";
     rev = "refs/tags/Version_2_6_13pre50";
   };
 
diff --git a/pkgs/development/compilers/ghc/8.4.4.nix b/pkgs/development/compilers/ghc/8.4.4.nix
index c84ea1d84d5..1ea18149d1e 100644
--- a/pkgs/development/compilers/ghc/8.4.4.nix
+++ b/pkgs/development/compilers/ghc/8.4.4.nix
@@ -109,7 +109,11 @@ stdenv.mkDerivation (rec {
       name = "D4388.diff";
       sha256 = "0w6sdcvnqjlnlzpvnzw20b80v150ijjyjvs9548ildc1928j0w7s";
     })
-    ++ stdenv.lib.optional stdenv.isDarwin ./backport-dylib-command-size-limit.patch;
+    ++ stdenv.lib.optional stdenv.isDarwin ./backport-dylib-command-size-limit.patch
+    ++ stdenv.lib.optional (targetPlatform.isAarch32 || targetPlatform.isAarch64) (fetchpatch {
+      url = "https://git.haskell.org/ghc.git/patch/d8495549ba9d194815c2d0eaee6797fc7c00756a";
+      sha256 = "1czx12qcl088vjn7mqxvyja4b2ia2n09c28br8c777fd0xk069pm";
+    });
 
   postPatch = "patchShebangs .";
 
diff --git a/pkgs/development/compilers/gprolog/default.nix b/pkgs/development/compilers/gprolog/default.nix
index b12b055342c..a0cc27b37e2 100644
--- a/pkgs/development/compilers/gprolog/default.nix
+++ b/pkgs/development/compilers/gprolog/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = {
-    homepage = http://www.gnu.org/software/gprolog/;
+    homepage = https://www.gnu.org/software/gprolog/;
     description = "GNU Prolog, a free Prolog compiler with constraint solving over finite domains";
     license = stdenv.lib.licenses.lgpl3Plus;
 
diff --git a/pkgs/development/compilers/manticore/default.nix b/pkgs/development/compilers/manticore/default.nix
index 2c8fe186612..efbf8561b7f 100644
--- a/pkgs/development/compilers/manticore/default.nix
+++ b/pkgs/development/compilers/manticore/default.nix
@@ -1,15 +1,15 @@
 { stdenv, fetchFromGitHub, coreutils, autoreconfHook, smlnj }:
 
 let
-  rev= "f8e08c89dd98b7b8dba318d245dcd4abd3328ae2";
+  rev= "47273c463fc3c5d0a0ae655cf75a4700bdb020b4";
 in stdenv.mkDerivation rec {
   name = "manticore-${version}";
-  version = "2017.08.22";
+  version = "2018.09.29";
  
   src = fetchFromGitHub {
     owner = "ManticoreProject";
     repo = "manticore";
-    sha256 = "06icq0qdzwyzbsyms53blxpb9i26n2vn7ci8p9xvvnq687hxhr73";
+    sha256 = "1prrgp7ldkdnrdbj224qqkirw8bj72460ix97c96fy264j9c97cn";
     inherit rev;
   };
 
diff --git a/pkgs/development/compilers/mit-scheme/default.nix b/pkgs/development/compilers/mit-scheme/default.nix
index f254e91e5c6..ef7ad9b3266 100644
--- a/pkgs/development/compilers/mit-scheme/default.nix
+++ b/pkgs/development/compilers/mit-scheme/default.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation {
          development cycle.
       '';
 
-    homepage = http://www.gnu.org/software/mit-scheme/;
+    homepage = https://www.gnu.org/software/mit-scheme/;
 
     license = licenses.gpl2Plus;
 
diff --git a/pkgs/development/compilers/smlnj/bootstrap.nix b/pkgs/development/compilers/smlnj/bootstrap.nix
index fad5c7d73fe..2fe1f1f3f5a 100644
--- a/pkgs/development/compilers/smlnj/bootstrap.nix
+++ b/pkgs/development/compilers/smlnj/bootstrap.nix
@@ -3,11 +3,11 @@
 stdenv.mkDerivation rec {
   name = "smlnj-bootstrap-${version}";
 
-  version = "110.80";
+  version = "110.84";
 
   src = fetchurl {
     url = "http://smlnj.cs.uchicago.edu/dist/working/${version}/smlnj-x86-${version}.pkg";
-    sha256 = "1709xpgmxa6v73h77y7vn9wf5vlfdk75p61w28nzgfdsdc8f8l65";
+    sha256 = "17fpnlxcfwx2ysg6y9c5wwx6s3jca981nb0pawfcg6xg9wcapyfz";
   };
 
   buildInputs = [ cpio rsync makeWrapper ];
@@ -40,4 +40,4 @@ stdenv.mkDerivation rec {
     platforms   = stdenv.lib.platforms.darwin;
     maintainers = [ stdenv.lib.maintainers.jwiegley ];
   };
-}
\ No newline at end of file
+}
diff --git a/pkgs/development/compilers/smlnj/default.nix b/pkgs/development/compilers/smlnj/default.nix
index 9b4816bb282..a2a03328b6d 100644
--- a/pkgs/development/compilers/smlnj/default.nix
+++ b/pkgs/development/compilers/smlnj/default.nix
@@ -1,31 +1,32 @@
 { stdenv, fetchurl, darwin }:
 let
-  version = "110.79";
+  version = "110.84";
   baseurl = "http://smlnj.cs.uchicago.edu/dist/working/${version}";
 
   sources = map fetchurl [
-    { url = "${baseurl}/config.tgz";              sha256 = "1siahy5sxz20bdy88s7zjj6gn55np1h54dalmg0nwzqq1rc048xb"; }
-    { url = "${baseurl}/cm.tgz";                  sha256 = "174g71hvk1wfdmrg1mbx3p5j04ywnbbjapnnr9sgjd99pqqqsmdz"; }
-    { url = "${baseurl}/compiler.tgz";            sha256 = "001wi97ghj3mym4bk73gzzzrh7584hd79jn08cnq1wssdcfpn4mw"; }
-    { url = "${baseurl}/runtime.tgz";             sha256 = "0lavdzg25nbdzdyyf6wm304k0gsbb5bng2nlcx8gcfl743vl13r0"; }
-    { url = "${baseurl}/system.tgz";              sha256 = "00j34m5n8m30p51kajd0sxamy7gpwxaxrlgw5agxh0wi83vqfaki"; }
-    { url = "${baseurl}/MLRISC.tgz";              sha256 = "19q3gp7yfby4n8z6jn9m9q8g0a9kvb13arj8f2j0x9jnh3y2is78"; }
-    { url = "${baseurl}/smlnj-lib.tgz";           sha256 = "0frkc23zh9h1c2lvkidh92lsp56liyb3hyv17503nchmkxrlsi09"; }
-    { url = "${baseurl}/old-basis.tgz";           sha256 = "1ka7w4nvkmaf86dkdzgbwiw8kay6gxhcyx4q17m33wdzsjbq56lh"; }
-    { url = "${baseurl}/ckit.tgz";                sha256 = "1z8xf5pqwayqd8j6xhfhqs4axkb4dx7vdqi2a7gq3zbx2fd3s7pw"; }
-    { url = "${baseurl}/nlffi.tgz";               sha256 = "1544m7ildyd0d60wfy2hl700jnslpxqb7brgh8p0bmkvhhvvc96v"; }
-    { url = "${baseurl}/cml.tgz";                 sha256 = "11blq65zlsbh6iwq502jww1z4iyk9pf2iv3d437cgnpb3sn9mx72"; }
-    { url = "${baseurl}/eXene.tgz";               sha256 = "14yl8a5xwms1m9bvfwfiz6rhg49225l52lqqq9sbxbf57615n9yg"; }
-    { url = "${baseurl}/ml-lpt.tgz";              sha256 = "118s7v2f73ym91ymvnmswjxm2pw5n4q1d4hvbs1cmm43dv28pw7m"; }
-    { url = "${baseurl}/ml-lex.tgz";              sha256 = "0lf5ir12v8j6n11mblrl00jgm583ak077vgbabc1dfmz47rd566b"; }
-    { url = "${baseurl}/ml-yacc.tgz";             sha256 = "0dmifbbq1wxkxf479jv61nsy79sr78ad9fq6561rvgi4h12lzh7k"; }
-    { url = "${baseurl}/ml-burg.tgz";             sha256 = "1b5z18azik1kpaafi1vjgaf181yv32h88zm3z5fqxs96pwb86h1d"; }
-    { url = "${baseurl}/pgraph.tgz";              sha256 = "15g06hl7zn98qas3b6r6lrl75g9d1galqxdyai7d5z9q5lq71j2v"; }
-    { url = "${baseurl}/trace-debug-profile.tgz"; sha256 = "0jwilcv2ycfpcy3cgs8ndaj16yqm8m2q63sipcigfycacpyqfsiw"; }
-    { url = "${baseurl}/heap2asm.tgz";            sha256 = "0wylsw1dkls9l86j226ilfb50mfk4h4zz4r9zdj104a1mqvvbgfk"; }
-    { url = "${baseurl}/smlnj-c.tgz";             sha256 = "1xr89r1nhzg53hk0v0fk1livphwpgmzh1dgjqxl4w8dx9qhk9yf0"; }
-    { url = "${baseurl}/doc.tgz";                 sha256 = "1fz4l3019n1rkrww98w59cdhlrz9jg635hmdq59xryc0j78y4ga1"; }
-    { url = "${baseurl}/boot.x86-unix.tgz";       sha256 = "0nka4dhklhilrsw4byr5vixiap28zp67ai0vjkwhqh03amkcr8zq"; }
+    { url = "${baseurl}/config.tgz";              sha256 = "0cpqrvixqwf64fa94wzwf59p0lnnmwxgkwm3qwhf28l2fv5d640q"; }
+    { url = "${baseurl}/cm.tgz";                  sha256 = "0qq6kdi8xqi3w1rsmi4rgjdbjr9m4crizb1ma5xg51x8h42ccmbh"; }
+    { url = "${baseurl}/compiler.tgz";            sha256 = "11zfdwr7a10ylzvap2j0c1py11zi500hfnmhd5lvy9spwzray8vd"; }
+    { url = "${baseurl}/runtime.tgz";             sha256 = "0v2dv0hh0gxnzzxz8vzqn5avxh7mynaj4g9kkbv4gcnxxaylpksz"; }
+    { url = "${baseurl}/system.tgz";              sha256 = "0612a6qls202l6wbckcd6dklh7nb75fk4c4qmbs9h2h0j3kisszl"; }
+    { url = "${baseurl}/MLRISC.tgz";              sha256 = "0wnhvy677p2f7pxlk8mmk3gi605nawy1zzn2cf4619wg04v54g6s"; }
+    { url = "${baseurl}/smlnj-lib.tgz";           sha256 = "1pg9y0lcp18fc91y45yb2lysnrzml00xdhcilkc1cx17am394mik"; }
+    { url = "${baseurl}/old-basis.tgz";           sha256 = "14zdkzfri4a7mj7zck2c43aqkg0y7kppp2nkbihg069g4ifgw5fg"; }
+    { url = "${baseurl}/ckit.tgz";                sha256 = "0dlccmnchs38www0a3ibrjxipf8xi03d7pgriynjqdyjjgik89by"; }
+    { url = "${baseurl}/nlffi.tgz";               sha256 = "0c9z2fq8d7ln4flzc5pkfym9rkjhjymjm60v1avh1c337lmai5lb"; }
+    { url = "${baseurl}/cml.tgz";                 sha256 = "16jn5fn8khxnjj0kwjzavx2ms3kv16zy35wamh8k51nv8v3i0qam"; }
+    { url = "${baseurl}/eXene.tgz";               sha256 = "1701l155aiprzxh5p5whb9qbg368cqq0bzdwkwsxgrrllfhwdq9z"; }
+    { url = "${baseurl}/ml-lpt.tgz";              sha256 = "19dk9yqq6f5ayqlf7p95aakc4swj6x1j8m0ka2slzzb9g93f2q1g"; }
+    { url = "${baseurl}/ml-lex.tgz";              sha256 = "0w20w17rd67n6zgxzwq89k9ywc78l3ydxcax0pniwzv6m5d08znc"; }
+    { url = "${baseurl}/ml-yacc.tgz";             sha256 = "1fdxhy4f2dgs19p20vg7yysi9gxp6hc1ggs97k4zq448y2ssxsyg"; }
+    { url = "${baseurl}/ml-burg.tgz";             sha256 = "066r0zy5rc60y8kzh2c06hy1b217lh6qffvxlwz8w1w86yqkgsk2"; }
+    { url = "${baseurl}/pgraph.tgz";              sha256 = "1jy1g9xiv14jj9svb5wgbdm520qbdhamfmxlf31xnh552gg18bxa"; }
+    { url = "${baseurl}/trace-debug-profile.tgz"; sha256 = "0nkawi2mdmsw24a1pkwp2brixrvxyqgxzsylp7w7ak35p20l5igc"; }
+    { url = "${baseurl}/heap2asm.tgz";            sha256 = "159y8c8xnim7p4pyynjirqhwi73lkrq0fksk8wnpcdh5clmwacrx"; }
+    { url = "${baseurl}/smlnj-c.tgz";             sha256 = "1sgfdnvkqa6wmwg027wg8lvg7zxq36p83bkymy8qkjdlxhxm2nhl"; }
+    { url = "${baseurl}/doc.tgz";                 sha256 = "083h5h937gkhfq3xk982vmng903c83d98yh5fps53f62wib99mhf"; }
+    { url = "${baseurl}/boot.x86-unix.tgz";       sha256 = "10nf79jzmv64ag8c11fxd9ggw21a9kdn9shqkiz1kni3lq63p7m2"; }
+    { url = "${baseurl}/asdl.tgz";                sha256 = "13jvdgv63h4s8p9q563hyisbz464y88y2flvwyxvi1n11lh15rwb"; }
   ];
 in stdenv.mkDerivation {
   name = "smlnj-${version}";
diff --git a/pkgs/development/coq-modules/math-classes/default.nix b/pkgs/development/coq-modules/math-classes/default.nix
index 1831cd0c571..364366ced49 100644
--- a/pkgs/development/coq-modules/math-classes/default.nix
+++ b/pkgs/development/coq-modules/math-classes/default.nix
@@ -3,13 +3,13 @@
 stdenv.mkDerivation rec {
 
   name = "coq${coq.coq-version}-math-classes-${version}";
-  version = "1.0.7";
+  version = "8.8.1";
 
   src = fetchFromGitHub {
-    owner = "math-classes";
+    owner = "coq-community";
     repo = "math-classes";
     rev = version;
-    sha256 = "0wgnczacvkb2pc3vjbni9bwjijfyd5jcdnyyjg8185hkf9zzabgi";
+    sha256 = "05vlrrwnlfhd7l3xwn4zwpnkwvziw84zpd9775c6ffb83z48ri1r";
   };
 
   buildInputs = [ coq bignums ];
diff --git a/pkgs/development/guile-modules/guile-gnome/default.nix b/pkgs/development/guile-modules/guile-gnome/default.nix
index 12648cab7dc..26fffac0a13 100644
--- a/pkgs/development/guile-modules/guile-gnome/default.nix
+++ b/pkgs/development/guile-modules/guile-gnome/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
       guile-gnome a comprehensive environment for developing modern
       applications.
     '';
-    homepage = "http://www.gnu.org/software/guile-gnome/";
+    homepage = "https://www.gnu.org/software/guile-gnome/";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ vyp ];
     platforms = platforms.linux;
diff --git a/pkgs/development/guile-modules/guile-lib/default.nix b/pkgs/development/guile-modules/guile-lib/default.nix
index 35eb4667bd6..c3aa8400791 100644
--- a/pkgs/development/guile-modules/guile-lib/default.nix
+++ b/pkgs/development/guile-modules/guile-lib/default.nix
@@ -37,7 +37,7 @@ in stdenv.mkDerivation {
       modules into a coherent library.  Think "a down-scaled, limited-scope CPAN
       for Guile".
     '';
-    homepage = "http://www.nongnu.org/guile-lib/";
+    homepage = "https://www.nongnu.org/guile-lib/";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ vyp ];
     platforms = platforms.gnu ++ platforms.linux;
diff --git a/pkgs/development/guile-modules/guile-opengl/default.nix b/pkgs/development/guile-modules/guile-opengl/default.nix
index f854c71c240..e1e04ecfe69 100644
--- a/pkgs/development/guile-modules/guile-opengl/default.nix
+++ b/pkgs/development/guile-modules/guile-opengl/default.nix
@@ -15,7 +15,7 @@ in stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "Guile bindings for the OpenGL graphics API";
-    homepage = "http://gnu.org/s/guile-opengl";
+    homepage = "https://www.gnu.org/software/guile-opengl/";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ vyp ];
     platforms = platforms.linux;
diff --git a/pkgs/development/guile-modules/guile-sdl/default.nix b/pkgs/development/guile-modules/guile-sdl/default.nix
index 5f887c3a7be..a606b3ecf28 100644
--- a/pkgs/development/guile-modules/guile-sdl/default.nix
+++ b/pkgs/development/guile-modules/guile-sdl/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Guile bindings for SDL";
-    homepage = "http://gnu.org/s/guile-sdl";
+    homepage = "https://www.gnu.org/software/guile-sdl/";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ vyp ];
     platforms = platforms.linux;
diff --git a/pkgs/development/interpreters/gnu-apl/default.nix b/pkgs/development/interpreters/gnu-apl/default.nix
index 599126d2eff..f60e5d28614 100644
--- a/pkgs/development/interpreters/gnu-apl/default.nix
+++ b/pkgs/development/interpreters/gnu-apl/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Free interpreter for the APL programming language";
-    homepage    = http://www.gnu.org/software/apl/;
+    homepage    = https://www.gnu.org/software/apl/;
     license     = licenses.gpl3Plus;
     maintainers = [ maintainers.kovirobi ];
     platforms   = with platforms; linux ++ darwin;
diff --git a/pkgs/development/interpreters/guile/1.8.nix b/pkgs/development/interpreters/guile/1.8.nix
index 13a0d45dbe4..fd270dedefc 100644
--- a/pkgs/development/interpreters/guile/1.8.nix
+++ b/pkgs/development/interpreters/guile/1.8.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
   # One test fails.
   # ERROR: file: "libtest-asmobs", message: "file not found"
   # This is fixed here:
-  # <http://git.savannah.gnu.org/cgit/guile.git/commit/?h=branch_release-1-8&id=a0aa1e5b69d6ef0311aeea8e4b9a94eae18a1aaf>.
+  # <https://git.savannah.gnu.org/cgit/guile.git/commit/?h=branch_release-1-8&id=a0aa1e5b69d6ef0311aeea8e4b9a94eae18a1aaf>.
   doCheck = false;
   doInstallCheck = doCheck;
 
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Embeddable Scheme implementation";
-    homepage    = http://www.gnu.org/software/guile/;
+    homepage    = https://www.gnu.org/software/guile/;
     license     = stdenv.lib.licenses.lgpl2Plus;
     maintainers = [ stdenv.lib.maintainers.ludo ];
     platforms   = stdenv.lib.platforms.unix;
diff --git a/pkgs/development/interpreters/guile/2.0.nix b/pkgs/development/interpreters/guile/2.0.nix
index ea34fd61f3b..b65dfb1d4a1 100644
--- a/pkgs/development/interpreters/guile/2.0.nix
+++ b/pkgs/development/interpreters/guile/2.0.nix
@@ -41,7 +41,7 @@
   patches = [ ./disable-gc-sensitive-tests.patch ./eai_system.patch ./clang.patch
     (fetchpatch {
       # Fixes stability issues with 00-repl-server.test
-      url = "http://git.savannah.gnu.org/cgit/guile.git/patch/?id=2fbde7f02adb8c6585e9baf6e293ee49cd23d4c4";
+      url = "https://git.savannah.gnu.org/cgit/guile.git/patch/?id=2fbde7f02adb8c6585e9baf6e293ee49cd23d4c4";
       sha256 = "0p6c1lmw1iniq03z7x5m65kg3lq543kgvdb4nrxsaxjqf3zhl77v";
     })
     ./riscv.patch
@@ -94,7 +94,7 @@
 
   meta = {
     description = "Embeddable Scheme implementation";
-    homepage    = http://www.gnu.org/software/guile/;
+    homepage    = https://www.gnu.org/software/guile/;
     license     = stdenv.lib.licenses.lgpl3Plus;
     maintainers = with stdenv.lib.maintainers; [ ludo lovek323 ];
     platforms   = stdenv.lib.platforms.all;
@@ -114,7 +114,7 @@
 //
 
 (stdenv.lib.optionalAttrs (!stdenv.isLinux) {
-  # Work around <http://bugs.gnu.org/14201>.
+  # Work around <https://bugs.gnu.org/14201>.
   SHELL = "/bin/sh";
   CONFIG_SHELL = "/bin/sh";
 })
diff --git a/pkgs/development/interpreters/guile/default.nix b/pkgs/development/interpreters/guile/default.nix
index aacc5dc49a1..1943b10bdca 100644
--- a/pkgs/development/interpreters/guile/default.nix
+++ b/pkgs/development/interpreters/guile/default.nix
@@ -90,7 +90,7 @@
 
   meta = {
     description = "Embeddable Scheme implementation";
-    homepage    = http://www.gnu.org/software/guile/;
+    homepage    = https://www.gnu.org/software/guile/;
     license     = stdenv.lib.licenses.lgpl3Plus;
     maintainers = with stdenv.lib.maintainers; [ ludo lovek323 vrthra ];
     platforms   = stdenv.lib.platforms.all;
diff --git a/pkgs/development/interpreters/lush/default.upstream b/pkgs/development/interpreters/lush/default.upstream
index 4a94595f772..8a8b08fcd68 100644
--- a/pkgs/development/interpreters/lush/default.upstream
+++ b/pkgs/development/interpreters/lush/default.upstream
@@ -1,4 +1,4 @@
-url http://sourceforge.net/projects/lush/files/lush2/
+url https://sourceforge.net/projects/lush/files/lush2/
 version_link '[.]tar[.]gz/download$'
 SF_redirect
 minimize_overwrite
diff --git a/pkgs/development/interpreters/regina/default.upstream b/pkgs/development/interpreters/regina/default.upstream
index 7b3c6905a1c..481d9848f83 100644
--- a/pkgs/development/interpreters/regina/default.upstream
+++ b/pkgs/development/interpreters/regina/default.upstream
@@ -1,4 +1,4 @@
-url http://sourceforge.net/projects/regina-rexx/files/regina-rexx/
+url https://sourceforge.net/projects/regina-rexx/files/regina-rexx/
 SF_version_dir
 SF_version_tarball
 SF_redirect
diff --git a/pkgs/development/libraries/acl/default.nix b/pkgs/development/libraries/acl/default.nix
index f9bb982a784..f9559d94174 100644
--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   installTargets = [ "install" "install-lib" "install-dev" ];
 
   meta = with stdenv.lib; {
-    homepage = "http://savannah.nongnu.org/projects/acl";
+    homepage = "https://savannah.nongnu.org/projects/acl";
     description = "Library and tools for manipulating access control lists";
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
diff --git a/pkgs/development/libraries/attr/default.nix b/pkgs/development/libraries/attr/default.nix
index 944f33b7a3f..f859894cd47 100644
--- a/pkgs/development/libraries/attr/default.nix
+++ b/pkgs/development/libraries/attr/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = "http://savannah.nongnu.org/projects/attr/";
+    homepage = "https://savannah.nongnu.org/projects/attr/";
     description = "Library and tools for manipulating extended attributes";
     platforms = platforms.linux;
     license = licenses.gpl2Plus;
diff --git a/pkgs/development/libraries/ccrtp/1.8.nix b/pkgs/development/libraries/ccrtp/1.8.nix
index bd83a5c79d5..db2d177b710 100644
--- a/pkgs/development/libraries/ccrtp/1.8.nix
+++ b/pkgs/development/libraries/ccrtp/1.8.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "GNU ccRTP is an implementation of RTP, the real-time transport protocol from the IETF";
-    homepage = http://www.gnu.org/software/ccrtp/;
+    homepage = https://www.gnu.org/software/ccrtp/;
     license = stdenv.lib.licenses.gpl2;
     maintainers = [ stdenv.lib.maintainers.marcweber ];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/development/libraries/ccrtp/default.nix b/pkgs/development/libraries/ccrtp/default.nix
index 5df7c2279c5..cd9d031788a 100644
--- a/pkgs/development/libraries/ccrtp/default.nix
+++ b/pkgs/development/libraries/ccrtp/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "An implementation of the IETF real-time transport protocol (RTP)";
-    homepage = http://www.gnu.org/software/ccrtp/;
+    homepage = https://www.gnu.org/software/ccrtp/;
     license = stdenv.lib.licenses.gpl2;
     maintainers = with stdenv.lib.maintainers; [ marcweber ];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/development/libraries/commoncpp2/default.nix b/pkgs/development/libraries/commoncpp2/default.nix
index f578cd2f87d..0c5ab758583 100644
--- a/pkgs/development/libraries/commoncpp2/default.nix
+++ b/pkgs/development/libraries/commoncpp2/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
          to build native threading applications for Microsoft Windows.
       '';
 
-    homepage = http://www.gnu.org/software/commoncpp/;
+    homepage = https://www.gnu.org/software/commoncpp/;
     license = stdenv.lib.licenses.gpl2Plus;
     maintainers = [ stdenv.lib.maintainers.marcweber ];
     platforms = with stdenv.lib.platforms; linux;
diff --git a/pkgs/development/libraries/gcc/libstdc++/5.nix b/pkgs/development/libraries/gcc/libstdc++/5.nix
index f8397052b77..4762d1fb119 100644
--- a/pkgs/development/libraries/gcc/libstdc++/5.nix
+++ b/pkgs/development/libraries/gcc/libstdc++/5.nix
@@ -108,7 +108,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://gcc.gnu.org/;
+    homepage = https://gcc.gnu.org/;
     license = licenses.lgpl3Plus;
     description = "GNU Compiler Collection, version ${version} -- C++ standard library";
     platforms = platforms.linux;
diff --git a/pkgs/development/libraries/gdbm/default.nix b/pkgs/development/libraries/gdbm/default.nix
index ca4c0bc744b..9b1fc2b4ac5 100644
--- a/pkgs/development/libraries/gdbm/default.nix
+++ b/pkgs/development/libraries/gdbm/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
          package also provides traditional dbm and ndbm interfaces.
       '';
 
-    homepage = http://www.gnu.org/software/gdbm/;
+    homepage = https://www.gnu.org/software/gdbm/;
     license = licenses.gpl3Plus;
     platforms = platforms.all;
     maintainers = [ maintainers.vrthra ];
diff --git a/pkgs/development/libraries/geoclue/default.nix b/pkgs/development/libraries/geoclue/default.nix
index c405002b6d6..173aac0c52e 100644
--- a/pkgs/development/libraries/geoclue/default.nix
+++ b/pkgs/development/libraries/geoclue/default.nix
@@ -1,5 +1,5 @@
-{ fetchurl, stdenv, fetchpatch, intltool, pkgconfig, gtk-doc, docbook_xsl, docbook_xml_dtd_412, glib, json-glib, libsoup, libnotify, gdk_pixbuf
-, modemmanager, avahi, glib-networking, wrapGAppsHook, gobject-introspection
+{ stdenv, fetchFromGitLab, intltool, meson, ninja, pkgconfig, gtk-doc, docbook_xsl, docbook_xml_dtd_412, glib, json-glib, libsoup, libnotify, gdk_pixbuf
+, modemmanager, avahi, glib-networking, python3, wrapGAppsHook, gobjectIntrospection, vala
 , withDemoAgent ? false
 }:
 
@@ -7,17 +7,20 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "geoclue-${version}";
-  version = "2.4.12";
+  version = "2.5.1";
 
-  src = fetchurl {
-    url = "https://www.freedesktop.org/software/geoclue/releases/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1jnad1f3rf8h05sz1lc172jnqdhqdpz76ff6m7i5ss3s0znf5l05";
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "geoclue";
+    repo = "geoclue";
+    rev = version;
+    sha256 = "0vww6irijw5ss7vawkdi5z5wdpcgw4iqljn5vs3vbd4y3d0lzrbs";
   };
 
   outputs = [ "out" "dev" "devdoc" ];
 
   nativeBuildInputs = [
-    pkgconfig intltool wrapGAppsHook gobject-introspection
+    pkgconfig intltool meson ninja wrapGAppsHook python3 vala gobjectIntrospection
     # devdoc
     gtk-doc docbook_xsl docbook_xml_dtd_412
   ];
@@ -30,26 +33,20 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [ glib glib-networking ];
 
-  # Whitelist elementary's agent
-  patches = [
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/geoclue/geoclue/commit/2b0491e408be1ebcdbe8751bb2637c1acb78f71e.patch";
-      sha256 = "0pac94y55iksk340dlx3gkhb9lrci90mxqqy5fnh1zbjw9bqxfn4";
-    })
+  mesonFlags = [
+    "-Dsystemd-system-unit-dir=${placeholder "out"}/etc/systemd/system"
+    "-Ddemo-agent=${if withDemoAgent then "true" else "false"}"
+  ] ++ optionals stdenv.isDarwin [
+    "-D3g-source=false"
+    "-Dcdma-source=false"
+    "-Dmodem-gps-source=false"
+    "-Dnmea-source=false"
   ];
 
-  configureFlags = [
-    "--with-systemdsystemunitdir=$(out)/etc/systemd/system"
-    "--enable-introspection"
-    "--enable-gtk-doc"
-    "--enable-demo-agent=${if withDemoAgent then "yes" else "no"}"
-  ] ++ optionals stdenv.isDarwin [
-    "--disable-silent-rules"
-    "--disable-3g-source"
-    "--disable-cdma-source"
-    "--disable-modem-gps-source"
-    "--disable-nmea-source"
-  ];
+  postPatch = ''
+    chmod +x demo/install-file.py
+    patchShebangs demo/install-file.py
+  '';
 
   meta = with stdenv.lib; {
     description = "Geolocation framework and some data providers";
diff --git a/pkgs/development/libraries/gettext/default.nix b/pkgs/development/libraries/gettext/default.nix
index 1b2f6bbc222..8ed898813ae 100644
--- a/pkgs/development/libraries/gettext/default.nix
+++ b/pkgs/development/libraries/gettext/default.nix
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
       GNU packages produce multi-lingual messages.
     '';
 
-    homepage = http://www.gnu.org/software/gettext/;
+    homepage = https://www.gnu.org/software/gettext/;
 
     maintainers = with maintainers; [ zimbatm vrthra ];
     license = licenses.gpl2Plus;
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 042f5ca90ba..50d8c6e268c 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -187,7 +187,7 @@ stdenv.mkDerivation ({
   doCheck = false; # fails
 
   meta = {
-    homepage = http://www.gnu.org/software/libc/;
+    homepage = https://www.gnu.org/software/libc/;
     description = "The GNU C Library";
 
     longDescription =
diff --git a/pkgs/development/libraries/glpk/default.nix b/pkgs/development/libraries/glpk/default.nix
index 481ae32bdc6..1d35c0696d2 100644
--- a/pkgs/development/libraries/glpk/default.nix
+++ b/pkgs/development/libraries/glpk/default.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
          programming language and organized in the form of a library.
       '';
 
-    homepage = http://www.gnu.org/software/glpk/;
+    homepage = https://www.gnu.org/software/glpk/;
     license = stdenv.lib.licenses.gpl3Plus;
 
     maintainers = with stdenv.lib.maintainers; [ bjg timokau ];
diff --git a/pkgs/development/libraries/gnu-config/default.nix b/pkgs/development/libraries/gnu-config/default.nix
index a14d7486e96..3f0fcafa447 100644
--- a/pkgs/development/libraries/gnu-config/default.nix
+++ b/pkgs/development/libraries/gnu-config/default.nix
@@ -5,11 +5,11 @@ let
 
   # Don't use fetchgit as this is needed during Aarch64 bootstrapping
   configGuess = fetchurl {
-    url = "http://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
+    url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.guess?id=${rev}";
     sha256 = "1bb8z1wzjs81p9qrvji4bc2a8zyxjinz90k8xq7sxxdp6zrmq1sv";
   };
   configSub = fetchurl {
-    url = "http://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
+    url = "https://git.savannah.gnu.org/cgit/config.git/plain/config.sub?id=${rev}";
     sha256 = "00dn5i2cp4iqap5vr368r5ifrgcjfq5pr97i4dkkdbha1han5hsc";
   };
 in
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Attempt to guess a canonical system name";
-    homepage = http://savannah.gnu.org/projects/config;
+    homepage = https://savannah.gnu.org/projects/config;
     license = licenses.gpl3;
     # In addition to GPLv3:
     #   As a special exception to the GNU General Public License, if you
diff --git a/pkgs/development/libraries/gnutls-kdh/generic.nix b/pkgs/development/libraries/gnutls-kdh/generic.nix
index a81cd91fdc7..d1d3c8575b0 100644
--- a/pkgs/development/libraries/gnutls-kdh/generic.nix
+++ b/pkgs/development/libraries/gnutls-kdh/generic.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation {
     [ "--enable-guile" "--with-guile-site-dir=\${out}/share/guile/site" ];
 
   # Build of the Guile bindings is not parallel-safe.  See
-  # <http://git.savannah.gnu.org/cgit/gnutls.git/commit/?id=330995a920037b6030ec0282b51dde3f8b493cad>
+  # <https://github.com/arpa2/gnutls-kdh/commit/330995a920037b6030ec0282b51dde3f8b493cad>
   # for the actual fix.  Also an apparent race in the generation of
   # systemkey-args.h.
   enableParallelBuilding = false;
diff --git a/pkgs/development/libraries/gnutls/generic.nix b/pkgs/development/libraries/gnutls/generic.nix
index 081d896a6e0..05243824142 100644
--- a/pkgs/development/libraries/gnutls/generic.nix
+++ b/pkgs/development/libraries/gnutls/generic.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation {
        tampering, or message forgery."
     '';
 
-    homepage = http://www.gnu.org/software/gnutls/;
+    homepage = https://www.gnu.org/software/gnutls/;
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ eelco wkennington fpletz ];
     platforms = platforms.all;
diff --git a/pkgs/development/libraries/gsasl/default.nix b/pkgs/development/libraries/gsasl/default.nix
index a1df933149f..899aa116b2c 100644
--- a/pkgs/development/libraries/gsasl/default.nix
+++ b/pkgs/development/libraries/gsasl/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
          (e.g. IMAP, SMTP, etc.) to authenticate peers. 
        '';
 
-    homepage = http://www.gnu.org/software/gsasl/;
+    homepage = https://www.gnu.org/software/gsasl/;
     license = stdenv.lib.licenses.gpl3Plus;
 
     maintainers = with stdenv.lib.maintainers; [ shlevy ];
diff --git a/pkgs/development/libraries/gsignond/default.nix b/pkgs/development/libraries/gsignond/default.nix
index 21838680dc4..a81e72bf66f 100644
--- a/pkgs/development/libraries/gsignond/default.nix
+++ b/pkgs/development/libraries/gsignond/default.nix
@@ -6,16 +6,15 @@
 let
 unwrapped = stdenv.mkDerivation rec {
   pname = "gsignond";
-  version = "unstable-2018-10-04";
-
+  version = "1.2.0";
 
   outputs = [ "out" "dev" "devdoc" ];
 
   src = fetchFromGitLab {
     owner = "accounts-sso";
     repo = pname;
-    rev = "39022c86ddb5062a10fb0503ad9d81a8e532d527";
-    sha256 = "1gw8vbj3j6wxqy759z97arm8lnqhmraw9s2frv3ar6crnfhlidff";
+    rev = version;
+    sha256 = "17cpil3lpijgyj2z5c41vhb7fpk17038k5ggyw9p6049jrlf423m";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/gsignond/plugins/lastfm.nix b/pkgs/development/libraries/gsignond/plugins/lastfm.nix
index a65ab767baa..7c15e10620a 100644
--- a/pkgs/development/libraries/gsignond/plugins/lastfm.nix
+++ b/pkgs/development/libraries/gsignond/plugins/lastfm.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   PKG_CONFIG_GSIGNOND_GPLUGINSDIR = "${placeholder "out"}/lib/gsignond/gplugins";
 
   meta = with stdenv.lib; {
-    description = "Plugin for the Accounts-SSO gSignOn daemon handles the Last.FM credentials.";
+    description = "Plugin for the Accounts-SSO gSignOn daemon that handles Last.FM credentials";
     homepage = https://gitlab.com/accounts-sso/gsignond-plugin-lastfm;
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ worldofpeace ];
diff --git a/pkgs/development/libraries/gsignond/plugins/mail.nix b/pkgs/development/libraries/gsignond/plugins/mail.nix
index e8b8091bc24..c4d23bd834c 100644
--- a/pkgs/development/libraries/gsignond/plugins/mail.nix
+++ b/pkgs/development/libraries/gsignond/plugins/mail.nix
@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitLab, pkgconfig, meson, ninja, vala, glib, gsignond, gobject-introspection }:
 
 stdenv.mkDerivation rec {
-  name = "gsignond-plugin-mail-${version}";
-  version = "2018-10-04";
+  pname = "gsignond-plugin-mail";
+  version = "0.3.0";
 
   src = fetchFromGitLab {
     owner = "accounts-sso";
     repo = "gsignond-plugin-mail";
-    rev = "fbc6f34b246fec4ad2b37c696f8de7fdb9bde346";
-    sha256 = "1wvwz7qiwvj8iixprip3qd8lplzfnwcjfrbg2vd8xfsvid2zbviw";
+    rev = version;
+    sha256 = "0x8jcl0ra9kacm80f1im5wpxp9r9wxayjwnk6dkv7fhjbl2p4nh0";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   PKG_CONFIG_GSIGNOND_GPLUGINSDIR = "${placeholder "out"}/lib/gsignond/gplugins";
 
   meta = with stdenv.lib; {
-    description = "Plugin for the Accounts-SSO gSignOn daemon that handles the E-Mail credentials.";
+    description = "Plugin for the Accounts-SSO gSignOn daemon that handles E-Mail credentials";
     homepage = https://gitlab.com/accounts-sso/gsignond-plugin-mail;
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ worldofpeace ];
diff --git a/pkgs/development/libraries/gsignond/plugins/oauth.nix b/pkgs/development/libraries/gsignond/plugins/oauth.nix
index 0da6745bb4e..6182ea283cb 100644
--- a/pkgs/development/libraries/gsignond/plugins/oauth.nix
+++ b/pkgs/development/libraries/gsignond/plugins/oauth.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   PKG_CONFIG_GSIGNOND_GPLUGINSDIR = "${placeholder "out"}/lib/gsignond/gplugins";
 
   meta = with stdenv.lib; {
-    description = "Plugin for the Accounts-SSO gSignOn daemon that handles the OAuth 1.0 and 2.0 authentication protocols.";
+    description = "Plugin for the Accounts-SSO gSignOn daemon that handles the OAuth 1.0 and 2.0 authentication protocols";
     homepage = https://gitlab.com/accounts-sso/gsignond-plugin-oa;
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ worldofpeace ];
diff --git a/pkgs/development/libraries/gsignond/plugins/sasl.nix b/pkgs/development/libraries/gsignond/plugins/sasl.nix
index b09bc0e60ab..d1fa37939a7 100644
--- a/pkgs/development/libraries/gsignond/plugins/sasl.nix
+++ b/pkgs/development/libraries/gsignond/plugins/sasl.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   PKG_CONFIG_GSIGNOND_GPLUGINSDIR = "${placeholder "out"}/lib/gsignond/gplugins";
 
   meta = with stdenv.lib; {
-    description = "Plugin for the Accounts-SSO gSignOn daemon that handles the SASL authentication protocol.";
+    description = "Plugin for the Accounts-SSO gSignOn daemon that handles the SASL authentication protocol";
     homepage = https://gitlab.com/accounts-sso/gsignond-plugin-sasl;
     license = licenses.lgpl21Plus;
     maintainers = with maintainers; [ worldofpeace ];
diff --git a/pkgs/development/libraries/gsignond/wrapper.nix b/pkgs/development/libraries/gsignond/wrapper.nix
index a5df6bbeafb..04463aac379 100644
--- a/pkgs/development/libraries/gsignond/wrapper.nix
+++ b/pkgs/development/libraries/gsignond/wrapper.nix
@@ -20,4 +20,6 @@ symlinkJoin {
     substitute ${gsignond}/share/dbus-1/services/com.google.code.AccountsSSO.SingleSignOn.service $out/share/dbus-1/services/com.google.code.AccountsSSO.SingleSignOn.service \
       --replace ${gsignond} $out
   '';
+
+  inherit (gsignond) meta;
 }
diff --git a/pkgs/development/libraries/gsl/default.nix b/pkgs/development/libraries/gsl/default.nix
index 8a419d67865..9fd3f8a7a99 100644
--- a/pkgs/development/libraries/gsl/default.nix
+++ b/pkgs/development/libraries/gsl/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     # ToDo: there might be more impurities than FMA support check
-    ./disable-fma.patch # http://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html
+    ./disable-fma.patch # https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html
   ];
 
   # https://lists.gnu.org/archive/html/bug-gsl/2015-11/msg00012.html
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "The GNU Scientific Library, a large numerical library";
-    homepage = http://www.gnu.org/software/gsl/;
+    homepage = https://www.gnu.org/software/gsl/;
     license = stdenv.lib.licenses.gpl3Plus;
 
     longDescription = ''
diff --git a/pkgs/development/libraries/gsl/gsl-1_16.nix b/pkgs/development/libraries/gsl/gsl-1_16.nix
index ede2b51c559..f569d9c3ea1 100644
--- a/pkgs/development/libraries/gsl/gsl-1_16.nix
+++ b/pkgs/development/libraries/gsl/gsl-1_16.nix
@@ -10,10 +10,10 @@ stdenv.mkDerivation rec {
 
   patches = [
     # ToDo: there might be more impurities than FMA support check
-    ./disable-fma.patch # http://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html
+    ./disable-fma.patch # https://lists.gnu.org/archive/html/bug-gsl/2011-11/msg00019.html
     (fetchpatch {
       name = "bug-39055.patch";
-      url = "http://git.savannah.gnu.org/cgit/gsl.git/patch/?id=9cc12d";
+      url = "https://git.savannah.gnu.org/cgit/gsl.git/patch/?id=9cc12d";
       sha256 = "1bmrmihi28cly9g9pq54kkix2jy59y7cd7h5fw4v1c7h5rc2qvs8";
     })
   ];
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "The GNU Scientific Library, a large numerical library";
-    homepage = http://www.gnu.org/software/gsl/;
+    homepage = https://www.gnu.org/software/gsl/;
     license = stdenv.lib.licenses.gpl3Plus;
 
     longDescription = ''
diff --git a/pkgs/development/libraries/gss/default.nix b/pkgs/development/libraries/gss/default.nix
index 0cc6a07e083..9f3bb3c7ead 100644
--- a/pkgs/development/libraries/gss/default.nix
+++ b/pkgs/development/libraries/gss/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/gss/;
+    homepage = https://www.gnu.org/software/gss/;
     description = "Generic Security Service";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ bjg wkennington ];
diff --git a/pkgs/development/libraries/hyperscan/default.nix b/pkgs/development/libraries/hyperscan/default.nix
new file mode 100644
index 00000000000..35966442da2
--- /dev/null
+++ b/pkgs/development/libraries/hyperscan/default.nix
@@ -0,0 +1,69 @@
+{ lib, stdenv, fetchFromGitHub, cmake, ragel, python27
+, boost
+}:
+
+# NOTICE: pkgconfig, pcap and pcre intentionally omitted from build inputs
+#         pcap used only in examples, pkgconfig used only to check for pcre
+#         which is fixed 8.41 version requirement (nixpkgs have 8.42+, and
+#         I not see any reason (for now) to backport 8.41.
+
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "hyperscan";
+  version = "5.0.0";
+
+  src = fetchFromGitHub {
+    owner = "intel";
+    repo = "hyperscan";
+    sha256 = "017dxg0n3gn9i4j27rcvpnp4rkqgycqni6x5d15dqpidl7zg7059";
+    rev = "v${version}";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  buildInputs = [ boost ];
+  nativeBuildInputs = [ cmake ragel python27 ];
+
+  cmakeFlags = [
+    "-DFAT_RUNTIME=ON"
+    "-DBUILD_AVX512=ON"
+    "-DBUILD_STATIC_AND_SHARED=ON"
+  ];
+
+  prePatch = ''
+    sed -i '/examples/d' CMakeLists.txt
+  '';
+
+  postInstall = ''
+    mkdir -p $dev/lib
+    mv $out/lib/*.a $dev/lib/
+    ln -sf $out/lib/libhs.so $dev/lib/
+    ln -sf $out/lib/libhs_runtime.so $dev/lib/
+  '';
+
+  postFixup = ''
+    sed -i "s,$out/include,$dev/include," $dev/lib/pkgconfig/libhs.pc
+    sed -i "s,$out/lib,$dev/lib," $dev/lib/pkgconfig/libhs.pc
+  '';
+
+  meta = {
+    description = "High-performance multiple regex matching library";
+    longDescription = ''
+      Hyperscan is a high-performance multiple regex matching library.
+      It follows the regular expression syntax of the commonly-used
+      libpcre library, but is a standalone library with its own C API.
+
+      Hyperscan uses hybrid automata techniques to allow simultaneous
+      matching of large numbers (up to tens of thousands) of regular
+      expressions and for the matching of regular expressions across 
+      streams of data.
+
+      Hyperscan is typically used in a DPI library stack.
+    '';
+
+    homepage = https://www.hyperscan.io/;
+    maintainers = with lib.maintainers; [ avnik ];
+    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    license = lib.licenses.bsd3;
+  };
+}
diff --git a/pkgs/development/libraries/judy/default.nix b/pkgs/development/libraries/judy/default.nix
index 1e687ff722b..01ba605b506 100644
--- a/pkgs/development/libraries/judy/default.nix
+++ b/pkgs/development/libraries/judy/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
   };
 
   # gcc 4.8 optimisations break judy.
-  # http://sourceforge.net/p/judy/mailman/message/31995144/
+  # https://sourceforge.net/p/judy/mailman/message/31995144/
   preConfigure = stdenv.lib.optionalString stdenv.cc.isGNU ''
     configureFlagsArray+=("CFLAGS=-fno-strict-aliasing -fno-aggressive-loop-optimizations")
   '';
diff --git a/pkgs/development/libraries/libbfd/default.nix b/pkgs/development/libraries/libbfd/default.nix
index c02e2108f23..57c3e123377 100644
--- a/pkgs/development/libraries/libbfd/default.nix
+++ b/pkgs/development/libraries/libbfd/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
       It is associated with GNU Binutils, and elsewhere often distributed with
       it.
     '';
-    homepage = http://www.gnu.org/software/binutils/;
+    homepage = https://www.gnu.org/software/binutils/;
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ericson2314 ];
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/libcdio/default.nix b/pkgs/development/libraries/libcdio/default.nix
index 9dc3c1d11ba..5c50d093243 100644
--- a/pkgs/development/libraries/libcdio/default.nix
+++ b/pkgs/development/libraries/libcdio/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
       ISO-9660 filesystems (libiso9660), as well as utility
       programs such as an audio CD player and an extractor.
     '';
-    homepage = http://www.gnu.org/software/libcdio/;
+    homepage = https://www.gnu.org/software/libcdio/;
     license = licenses.gpl2Plus;
     platforms = platforms.linux ++ platforms.darwin;
   };
diff --git a/pkgs/development/libraries/libchop/default.nix b/pkgs/development/libraries/libchop/default.nix
index f524c940255..c802bd68ab0 100644
--- a/pkgs/development/libraries/libchop/default.nix
+++ b/pkgs/development/libraries/libchop/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   patches = [ ./gets-undeclared.patch ./size_t.patch ];
 
   nativeBuildInputs = [ pkgconfig gperf ];
-  
+
   buildInputs =
     [ zlib bzip2 lzo
       libgcrypt
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
          line.  It is written in C and has Guile (Scheme) bindings.
       '';
 
-    homepage = http://nongnu.org/libchop/;
+    homepage = https://www.nongnu.org/libchop/;
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ];
     platforms = platforms.gnu ++ platforms.linux;
diff --git a/pkgs/development/libraries/libe-book/default.upstream b/pkgs/development/libraries/libe-book/default.upstream
index 30a6d390787..a06a9af99bb 100644
--- a/pkgs/development/libraries/libe-book/default.upstream
+++ b/pkgs/development/libraries/libe-book/default.upstream
@@ -1,4 +1,4 @@
-url http://sourceforge.net/projects/libebook/files/
+url https://sourceforge.net/projects/libebook/files/
 SF_version_dir libe-book-
 version_link '[.]tar.xz/download$'
 SF_redirect
diff --git a/pkgs/development/libraries/libgksu/default.nix b/pkgs/development/libraries/libgksu/default.nix
index 0af0a1227f3..9bec00b9f52 100644
--- a/pkgs/development/libraries/libgksu/default.nix
+++ b/pkgs/development/libraries/libgksu/default.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
       user.  It provides X authentication facilities for running
       programs in an X session.
     '';
-    homepage = http://www.nongnu.org/gksu/;
+    homepage = https://www.nongnu.org/gksu/;
     license = stdenv.lib.licenses.lgpl2;
     maintainers = [ stdenv.lib.maintainers.romildo ];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/development/libraries/libiberty/default.nix b/pkgs/development/libraries/libiberty/default.nix
index bcc85abbd3e..ab1858c51a6 100644
--- a/pkgs/development/libraries/libiberty/default.nix
+++ b/pkgs/development/libraries/libiberty/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://gcc.gnu.org/;
+    homepage = https://gcc.gnu.org/;
     license = licenses.lgpl2;
     description = "Collection of subroutines used by various GNU programs";
     maintainers = with maintainers; [ abbradar ericson2314 ];
diff --git a/pkgs/development/libraries/libiconv/default.nix b/pkgs/development/libraries/libiconv/default.nix
index d9773a1be4d..92b6ec43d40 100644
--- a/pkgs/development/libraries/libiconv/default.nix
+++ b/pkgs/development/libraries/libiconv/default.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
       applications.
     '';
 
-    homepage = http://www.gnu.org/software/libiconv/;
+    homepage = https://www.gnu.org/software/libiconv/;
     license = lib.licenses.lgpl2Plus;
 
     maintainers = [ ];
diff --git a/pkgs/development/libraries/libidn/default.nix b/pkgs/development/libraries/libidn/default.nix
index 66ae352525f..8291499daf3 100644
--- a/pkgs/development/libraries/libidn/default.nix
+++ b/pkgs/development/libraries/libidn/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   doCheck = false; # fails
 
   meta = {
-    homepage = http://www.gnu.org/software/libidn/;
+    homepage = https://www.gnu.org/software/libidn/;
     description = "Library for internationalized domain names";
 
     longDescription = ''
diff --git a/pkgs/development/libraries/libmicrohttpd/default.nix b/pkgs/development/libraries/libmicrohttpd/default.nix
index 4462fca7b64..b284f321895 100644
--- a/pkgs/development/libraries/libmicrohttpd/default.nix
+++ b/pkgs/development/libraries/libmicrohttpd/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
     license = licenses.lgpl2Plus;
 
-    homepage = http://www.gnu.org/software/libmicrohttpd/;
+    homepage = https://www.gnu.org/software/libmicrohttpd/;
 
     maintainers = with maintainers; [ eelco vrthra fpletz ];
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/libmwaw/default.upstream b/pkgs/development/libraries/libmwaw/default.upstream
index 0db6d23a52f..bcfb53770e1 100644
--- a/pkgs/development/libraries/libmwaw/default.upstream
+++ b/pkgs/development/libraries/libmwaw/default.upstream
@@ -1,4 +1,4 @@
-url http://sourceforge.net/projects/libmwaw/files/libmwaw/
+url https://sourceforge.net/projects/libmwaw/files/libmwaw/
 SF_version_dir libmwaw-
 version_link '[.]tar.xz/download$'
 SF_redirect
diff --git a/pkgs/development/libraries/libnih/default.nix b/pkgs/development/libraries/libnih/default.nix
index 22eb8ed64dd..a4b0b26a345 100644
--- a/pkgs/development/libraries/libnih/default.nix
+++ b/pkgs/development/libraries/libnih/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
   name = "libnih-${version}";
 
   src = fetchurl {
-    url = "http://code.launchpad.net/libnih/1.0/${version}/+download/libnih-${version}.tar.gz";
+    url = "https://code.launchpad.net/libnih/1.0/${version}/+download/libnih-${version}.tar.gz";
     sha256 = "01glc6y7z1g726zwpvp2zm79pyb37ki729jkh45akh35fpgp4xc9";
   };
 
diff --git a/pkgs/development/libraries/libodfgen/default.upstream b/pkgs/development/libraries/libodfgen/default.upstream
index 44f66561bd8..bd78e974e42 100644
--- a/pkgs/development/libraries/libodfgen/default.upstream
+++ b/pkgs/development/libraries/libodfgen/default.upstream
@@ -1,4 +1,4 @@
-url http://sourceforge.net/projects/libwpd/files/libodfgen/
+url https://sourceforge.net/projects/libwpd/files/libodfgen/
 SF_version_dir libodfgen-
 version_link '[.]tar.xz/download$'
 SF_redirect
diff --git a/pkgs/development/libraries/libopcodes/default.nix b/pkgs/development/libraries/libopcodes/default.nix
index 2c59fa03ea0..a1db11d9a8e 100644
--- a/pkgs/development/libraries/libopcodes/default.nix
+++ b/pkgs/development/libraries/libopcodes/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A library from binutils for manipulating machine code";
-    homepage = http://www.gnu.org/software/binutils/;
+    homepage = https://www.gnu.org/software/binutils/;
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ericson2314 ];
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/librevenge/default.upstream b/pkgs/development/libraries/librevenge/default.upstream
index 48b678a392a..78e47f83433 100644
--- a/pkgs/development/libraries/librevenge/default.upstream
+++ b/pkgs/development/libraries/librevenge/default.upstream
@@ -1,4 +1,4 @@
-url http://sourceforge.net/projects/libwpd/files/librevenge/
+url https://sourceforge.net/projects/libwpd/files/librevenge/
 SF_version_dir librevenge-
 version_link '[.]tar.xz/download$'
 SF_redirect
diff --git a/pkgs/development/libraries/libsignon-glib/default.nix b/pkgs/development/libraries/libsignon-glib/default.nix
index 0e6bdb80cdd..c7f49a6f6dc 100644
--- a/pkgs/development/libraries/libsignon-glib/default.nix
+++ b/pkgs/development/libraries/libsignon-glib/default.nix
@@ -2,15 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libsignon-glib";
-  version = "unstable-2018-10-24";
+  version = "2.1";
 
   outputs = [ "out" "dev" "devdoc" "py" ];
 
   src = fetchgit {
     url = "https://gitlab.com/accounts-sso/${pname}";
-    rev = "3639a2e90447e4640a03a44972560afe8f61aa48";
+    rev = "refs/tags/${version}";
+    sha256 = "0gnx9gqsh0hcfm1lk7w60g64mkn1iicga5f5xcy1j9a9byacsfd0";
     fetchSubmodules = true;
-    sha256 = "1cq19zbsx4c57dc5gp3shp8lzcr1hw2ynylpn1nkvfyyrx80m60w";
   };
 
   nativeBuildInputs = [
@@ -43,9 +43,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    description = ''
-      A library for managing single signon credentials which can be used from GLib applications
-    '';
+    description = "A library for managing single signon credentials which can be used from GLib applications";
     homepage = https://gitlab.com/accounts-sso/libsignon-glib;
     license = licenses.lgpl21;
     maintainers = with maintainers; [ worldofpeace ];
diff --git a/pkgs/development/libraries/libsigsegv/default.nix b/pkgs/development/libraries/libsigsegv/default.nix
index 306c73a9b55..b50a7c371a7 100644
--- a/pkgs/development/libraries/libsigsegv/default.nix
+++ b/pkgs/development/libraries/libsigsegv/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   doCheck = true; # not cross;
 
   meta = {
-    homepage = http://www.gnu.org/software/libsigsegv/;
+    homepage = https://www.gnu.org/software/libsigsegv/;
     description = "Library to handle page faults in user mode";
 
     longDescription = ''
diff --git a/pkgs/development/libraries/libtasn1/default.nix b/pkgs/development/libraries/libtasn1/default.nix
index 5762291568c..341e2cd1c77 100644
--- a/pkgs/development/libraries/libtasn1/default.nix
+++ b/pkgs/development/libraries/libtasn1/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/libtasn1/;
+    homepage = https://www.gnu.org/software/libtasn1/;
     description = "An ASN.1 library";
     longDescription = ''
       Libtasn1 is the ASN.1 library used by GnuTLS, GNU Shishi and some
diff --git a/pkgs/development/libraries/libunistring/default.nix b/pkgs/development/libraries/libunistring/default.nix
index 312a5c11810..e066c072367 100644
--- a/pkgs/development/libraries/libunistring/default.nix
+++ b/pkgs/development/libraries/libunistring/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = false;
 
   meta = {
-    homepage = http://www.gnu.org/software/libunistring/;
+    homepage = https://www.gnu.org/software/libunistring/;
 
     description = "Unicode string library";
 
diff --git a/pkgs/development/libraries/libunwind/default.nix b/pkgs/development/libraries/libunwind/default.nix
index 6a32ccf5c1b..2453484cb9c 100644
--- a/pkgs/development/libraries/libunwind/default.nix
+++ b/pkgs/development/libraries/libunwind/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
   doCheck = false; # fails
 
   meta = with stdenv.lib; {
-    homepage = http://www.nongnu.org/libunwind;
+    homepage = https://www.nongnu.org/libunwind;
     description = "A portable and efficient API to determine the call-chain of a program";
     maintainers = with maintainers; [ orivej ];
     platforms = platforms.linux;
diff --git a/pkgs/development/libraries/libxmi/default.nix b/pkgs/development/libraries/libxmi/default.nix
index 81c5b5e2891..aff5f8ac445 100644
--- a/pkgs/development/libraries/libxmi/default.nix
+++ b/pkgs/development/libraries/libxmi/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Library for rasterizing 2-D vector graphics";
-    homepage = http://www.gnu.org/software/libxmi/;
+    homepage = https://www.gnu.org/software/libxmi/;
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.gnu ++ stdenv.lib.platforms.linux;  # arbitrary choice
     maintainers = [ ];
diff --git a/pkgs/development/libraries/lightning/default.nix b/pkgs/development/libraries/lightning/default.nix
index 2ad14efa322..3f963c7ca19 100644
--- a/pkgs/development/libraries/lightning/default.nix
+++ b/pkgs/development/libraries/lightning/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = {
-    homepage = http://www.gnu.org/software/lightning/;
+    homepage = https://www.gnu.org/software/lightning/;
     description = "Run-time code generation library";
     longDescription = ''
       GNU lightning is a library that generates assembly language code
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 77de18de2b0..7db78af340c 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -159,7 +159,7 @@ stdenv.mkDerivation rec {
       ported to OS/2 Warp!
     '';
 
-    homepage = http://www.gnu.org/software/ncurses/;
+    homepage = https://www.gnu.org/software/ncurses/;
 
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
diff --git a/pkgs/development/libraries/opencascade/default.nix b/pkgs/development/libraries/opencascade/default.nix
index 4a12217443c..05d78488957 100644
--- a/pkgs/development/libraries/opencascade/default.nix
+++ b/pkgs/development/libraries/opencascade/default.nix
@@ -2,10 +2,10 @@
 ftgl, freetype}:
 
 stdenv.mkDerivation rec {
-  name = "opencascade-oce-0.17.2";
+  name = "opencascade-oce-0.18.3";
   src = fetchurl {
-    url = https://github.com/tpaviot/oce/archive/OCE-0.17.2.tar.gz;
-    sha256 = "0vpmnb0k5y2f7lpmwx9pg9yfq24zjvnsak5alzacncfm1hv9b6cd";
+    url = https://github.com/tpaviot/oce/archive/OCE-0.18.3.tar.gz;
+    sha256 = "0v4ny0qhr5hiialb2ss25bllfnd6j4g7mfxnqfmr1xsjpykxcly5";
   };
 
   buildInputs = [ libGLU_combined tcl tk file libXmu libtool qt4 ftgl freetype cmake ];
diff --git a/pkgs/development/libraries/opencv/3.x.nix b/pkgs/development/libraries/opencv/3.x.nix
index 64aa11e1763..f948cbb062f 100644
--- a/pkgs/development/libraries/opencv/3.x.nix
+++ b/pkgs/development/libraries/opencv/3.x.nix
@@ -1,5 +1,5 @@
 { lib, stdenv
-, fetchurl, fetchFromGitHub
+, fetchurl, fetchFromGitHub, fetchpatch
 , cmake, pkgconfig, unzip, zlib, pcre, hdf5
 , glog, boost, google-gflags, protobuf
 , config
@@ -31,29 +31,31 @@
 , enableDC1394    ? false, libdc1394
 , enableDocs      ? false, doxygen, graphviz-nox
 
-, AVFoundation, Cocoa, QTKit, VideoDecodeAcceleration, bzip2
+, cf-private, AVFoundation, Cocoa, QTKit, VideoDecodeAcceleration, bzip2
 }:
 
 let
-  version = "3.4.3";
+  version = "3.4.4";
 
   src = fetchFromGitHub {
     owner  = "opencv";
     repo   = "opencv";
     rev    = version;
-    sha256 = "138q3wiv4g4xvqzsp93xaqayv7kz7bl2vrgppp8jm8w6m25cd4i2";
+    sha256 = "1xzbv0922r2zq4fgpkc1ldyq3kxp4c6x6dizydbspka18jrrxqlr";
   };
 
   contribSrc = fetchFromGitHub {
     owner  = "opencv";
     repo   = "opencv_contrib";
     rev    = version;
-    sha256 = "1f334glf39nk42mpqq6j732h3ql2mpz89jd4mcl678s8n73nfjh2";
+    sha256 = "0ylsljkmgfj5vam05cv0z3qwkqwjwz5fs5f5yif3pwvb99lxlbib";
   };
 
   # Contrib must be built in order to enable Tesseract support:
   buildContrib = enableContrib || enableTesseract;
 
+  useSystemProtobuf = ! stdenv.isDarwin;
+
   # See opencv/3rdparty/ippicv/ippicv.cmake
   ippicv = {
     src = fetchFromGitHub {
@@ -145,6 +147,13 @@ stdenv.mkDerivation rec {
     cp --no-preserve=mode -r "${contribSrc}/modules" "$NIX_BUILD_TOP/opencv_contrib"
   '';
 
+  patches =
+    # https://github.com/opencv/opencv/pull/13254
+    lib.optional enablePython (fetchpatch {
+      url = https://github.com/opencv/opencv/commit/ad35b79e3f98b4ce30481e0299cca550ed77aef0.patch;
+      sha256 = "0rkvg6wm5fyncszfpd83wa4lvsb8srvk21r1jcld758i4f334sws";
+    });
+
   # This prevents cmake from using libraries in impure paths (which
   # causes build failure on non NixOS)
   # Also, work around https://github.com/NixOS/nixpkgs/issues/26304 with
@@ -171,7 +180,8 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs =
-       [ zlib pcre hdf5 glog boost google-gflags protobuf ]
+       [ zlib pcre hdf5 glog boost google-gflags ]
+    ++ lib.optional useSystemProtobuf protobuf
     ++ lib.optional enablePython pythonPackages.python
     ++ lib.optional enableGtk2 gtk2
     ++ lib.optional enableGtk3 gtk3
@@ -197,7 +207,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals enableTesseract [ tesseract leptonica ]
     ++ lib.optional enableTbb tbb
     ++ lib.optional enableCuda cudatoolkit
-    ++ lib.optionals stdenv.isDarwin [ AVFoundation Cocoa QTKit VideoDecodeAcceleration bzip2 ]
+    ++ lib.optionals stdenv.isDarwin [ cf-private AVFoundation Cocoa QTKit VideoDecodeAcceleration bzip2 ]
     ++ lib.optionals enableDocs [ doxygen graphviz-nox ];
 
   propagatedBuildInputs = lib.optional enablePython pythonPackages.numpy;
@@ -211,8 +221,8 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DWITH_OPENMP=ON"
-    "-DBUILD_PROTOBUF=OFF"
-    "-DPROTOBUF_UPDATE_FILES=ON"
+    "-DBUILD_PROTOBUF=${printEnabled (!useSystemProtobuf)}"
+    "-DPROTOBUF_UPDATE_FILES=${printEnabled useSystemProtobuf}"
     "-DOPENCV_ENABLE_NONFREE=${printEnabled enableUnfree}"
     "-DBUILD_TESTS=OFF"
     "-DBUILD_PERF_TESTS=OFF"
@@ -234,6 +244,8 @@ stdenv.mkDerivation rec {
   ] ++ lib.optionals stdenv.isDarwin [
     "-DWITH_OPENCL=OFF"
     "-DWITH_LAPACK=OFF"
+  ] ++ lib.optionals enablePython [
+    "-DOPENCV_SKIP_PYTHON_LOADER=ON"
   ];
 
   enableParallelBuilding = true;
@@ -254,7 +266,8 @@ stdenv.mkDerivation rec {
   # ${exec_prefix}. This causes linker errors in downstream packages so we strip
   # of $out after the ${exec_prefix} prefix:
   postInstall = ''
-    sed -i "s|\''${exec_prefix}/$out|\''${exec_prefix}|" "$out/lib/pkgconfig/opencv.pc"
+    sed -i "s|{exec_prefix}/$out|{exec_prefix}|" \
+      "$out/lib/pkgconfig/opencv.pc"
   '';
 
   hardeningDisable = [ "bindnow" "relro" ];
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
new file mode 100644
index 00000000000..407070506ab
--- /dev/null
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -0,0 +1,307 @@
+{ lib, stdenv
+, fetchurl, fetchFromGitHub, fetchpatch
+, cmake, pkgconfig, unzip, zlib, pcre, hdf5
+, glog, boost, google-gflags, protobuf
+, config
+
+, enableJPEG      ? true, libjpeg
+, enablePNG       ? true, libpng
+, enableTIFF      ? true, libtiff
+, enableWebP      ? true, libwebp
+, enableEXR ? (!stdenv.isDarwin), openexr, ilmbase
+, enableJPEG2K    ? true, jasper
+, enableEigen     ? true, eigen
+, enableOpenblas  ? true, openblas
+, enableContrib   ? true
+
+, enableCuda      ? (config.cudaSupport or false), cudatoolkit
+
+, enableUnfree    ? false
+, enableIpp       ? false
+, enablePython    ? false, pythonPackages
+, enableGtk2      ? false, gtk2
+, enableGtk3      ? false, gtk3
+, enableVtk       ? false, vtk
+, enableFfmpeg    ? false, ffmpeg
+, enableGStreamer ? false, gst_all_1
+, enableTesseract ? false, tesseract, leptonica
+, enableTbb       ? false, tbb
+, enableOvis      ? false, ogre
+, enableGPhoto2   ? false, libgphoto2
+, enableDC1394    ? false, libdc1394
+, enableDocs      ? false, doxygen, graphviz-nox
+
+, cf-private, AVFoundation, Cocoa, QTKit, VideoDecodeAcceleration, bzip2
+}:
+
+let
+  version = "4.0.0";
+
+  src = fetchFromGitHub {
+    owner  = "opencv";
+    repo   = "opencv";
+    rev    = version;
+    sha256 = "1r2hszm4044dfx65wv69rcs419jjd7bqllhnpcwk3n28f5ahln50";
+  };
+
+  contribSrc = fetchFromGitHub {
+    owner  = "opencv";
+    repo   = "opencv_contrib";
+    rev    = version;
+    sha256 = "1g4pzw7hv1v9jp1nrqjxqwpi1byl3mxkj6w6ibq6ydsn0138p66z";
+  };
+
+  # Contrib must be built in order to enable Tesseract support:
+  buildContrib = enableContrib || enableTesseract || enableOvis;
+
+  # See opencv/3rdparty/ippicv/ippicv.cmake
+  ippicv = {
+    src = fetchFromGitHub {
+      owner  = "opencv";
+      repo   = "opencv_3rdparty";
+      rev    = "32e315a5b106a7b89dbed51c28f8120a48b368b4";
+      sha256 = "19w9f0r16072s59diqxsr5q6nmwyz9gnxjs49nglzhd66p3ddbkp";
+    } + "/ippicv";
+    files = let name = platform : "ippicv_2019_${platform}_general_20180723.tgz"; in
+      if stdenv.hostPlatform.system == "x86_64-linux" then
+      { ${name "lnx_intel64"} = "c0bd78adb4156bbf552c1dfe90599607"; }
+      else if stdenv.hostPlatform.system == "i686-linux" then
+      { ${name "lnx_ia32"}    = "4f38432c30bfd6423164b7a24bbc98a0"; }
+      else if stdenv.hostPlatform.system == "x86_64-darwin" then
+      { ${name "mac_intel64"} = "fe6b2bb75ae0e3f19ad3ae1a31dfa4a2"; }
+      else
+      throw "ICV is not available for this platform (or not yet supported by this package)";
+    dst = ".cache/ippicv";
+  };
+
+  # See opencv_contrib/modules/xfeatures2d/cmake/download_vgg.cmake
+  vgg = {
+    src = fetchFromGitHub {
+      owner  = "opencv";
+      repo   = "opencv_3rdparty";
+      rev    = "fccf7cd6a4b12079f73bbfb21745f9babcd4eb1d";
+      sha256 = "0r9fam8dplyqqsd3qgpnnfgf9l7lj44di19rxwbm8mxiw0rlcdvy";
+    };
+    files = {
+      "vgg_generated_48.i"  = "e8d0dcd54d1bcfdc29203d011a797179";
+      "vgg_generated_64.i"  = "7126a5d9a8884ebca5aea5d63d677225";
+      "vgg_generated_80.i"  = "7cd47228edec52b6d82f46511af325c5";
+      "vgg_generated_120.i" = "151805e03568c9f490a5e3a872777b75";
+    };
+    dst = ".cache/xfeatures2d/vgg";
+  };
+
+  # See opencv_contrib/modules/xfeatures2d/cmake/download_boostdesc.cmake
+  boostdesc = {
+    src = fetchFromGitHub {
+      owner  = "opencv";
+      repo   = "opencv_3rdparty";
+      rev    = "34e4206aef44d50e6bbcd0ab06354b52e7466d26";
+      sha256 = "13yig1xhvgghvxspxmdidss5lqiikpjr0ddm83jsi0k85j92sn62";
+    };
+    files = {
+      "boostdesc_bgm.i"          = "0ea90e7a8f3f7876d450e4149c97c74f";
+      "boostdesc_bgm_bi.i"       = "232c966b13651bd0e46a1497b0852191";
+      "boostdesc_bgm_hd.i"       = "324426a24fa56ad9c5b8e3e0b3e5303e";
+      "boostdesc_binboost_064.i" = "202e1b3e9fec871b04da31f7f016679f";
+      "boostdesc_binboost_128.i" = "98ea99d399965c03d555cef3ea502a0b";
+      "boostdesc_binboost_256.i" = "e6dcfa9f647779eb1ce446a8d759b6ea";
+      "boostdesc_lbgm.i"         = "0ae0675534aa318d9668f2a179c2a052";
+    };
+    dst = ".cache/xfeatures2d/boostdesc";
+  };
+
+  # See opencv_contrib/modules/face/CMakeLists.txt
+  face = {
+    src = fetchFromGitHub {
+      owner  = "opencv";
+      repo   = "opencv_3rdparty";
+      rev    = "8afa57abc8229d611c4937165d20e2a2d9fc5a12";
+      sha256 = "061lsvqdidq9xa2hwrcvwi9ixflr2c2lfpc8drr159g68zi8bp4v";
+    };
+    files = {
+      "face_landmark_model.dat" = "7505c44ca4eb54b4ab1e4777cb96ac05";
+    };
+    dst = ".cache/data";
+  };
+
+  # See opencv/modules/gapi/cmake/DownloadADE.cmake
+  ade = rec {
+    src = fetchurl {
+      url = "https://github.com/opencv/ade/archive/${name}";
+      sha256 = "1r85vdkvcka7bcxk69pd0ai4hld4iakpj4xl0xbinx3p9pv5a4l8";
+    };
+    name = "v0.1.1d.zip";
+    md5 = "37479d90e3a5d47f132f512b22cbe206";
+    dst = ".cache/ade";
+  };
+
+  # See opencv/cmake/OpenCVDownload.cmake
+  installExtraFiles = extra : with lib; ''
+    mkdir -p "${extra.dst}"
+  '' + concatStrings (flip mapAttrsToList extra.files (name : md5 : ''
+    ln -s "${extra.src}/${name}" "${extra.dst}/${md5}-${name}"
+  ''));
+  installExtraFile = extra: ''
+    mkdir -p "${extra.dst}"
+    ln -s "${extra.src}" "${extra.dst}/${extra.md5}-${extra.name}"
+  '';
+
+  opencvFlag = name: enabled: "-DWITH_${name}=${printEnabled enabled}";
+
+  printEnabled = enabled : if enabled then "ON" else "OFF";
+in
+
+stdenv.mkDerivation rec {
+  name = "opencv-${version}";
+  inherit version src;
+
+  postUnpack = lib.optionalString buildContrib ''
+    cp --no-preserve=mode -r "${contribSrc}/modules" "$NIX_BUILD_TOP/source/opencv_contrib"
+  '';
+
+  patches =
+    # Fixes issue: https://github.com/opencv/opencv_contrib/issues/1923
+    # PR: https://github.com/opencv/opencv_contrib/pull/1913
+    lib.optional buildContrib (fetchpatch {
+      url = https://github.com/opencv/opencv_contrib/commit/e068b62a1432d4d5688693a9e20bf175dfaa9a3e.patch;
+      sha256 = "102mq1qgmla40hhj8mda70inhakdazm9agyah98kq9931scvf0c9";
+      stripLen = 2;
+      extraPrefix = "opencv_contrib/";
+    }) ++
+    # https://github.com/opencv/opencv/pull/13254
+    lib.optional enablePython (fetchpatch {
+      url = https://github.com/opencv/opencv/commit/ad35b79e3f98b4ce30481e0299cca550ed77aef0.patch;
+      sha256 = "0rkvg6wm5fyncszfpd83wa4lvsb8srvk21r1jcld758i4f334sws";
+    });
+
+  # This prevents cmake from using libraries in impure paths (which
+  # causes build failure on non NixOS)
+  # Also, work around https://github.com/NixOS/nixpkgs/issues/26304 with
+  # what appears to be some stray headers in dnn/misc/tensorflow
+  # in contrib when generating the Python bindings:
+  postPatch = ''
+    sed -i '/Add these standard paths to the search paths for FIND_LIBRARY/,/^\s*$/{d}' CMakeLists.txt
+    sed -i -e 's|if len(decls) == 0:|if len(decls) == 0 or "opencv2/" not in hdr:|' ./modules/python/src2/gen2.py
+  '';
+
+  preConfigure =
+    installExtraFile ade +
+    lib.optionalString enableIpp (installExtraFiles ippicv) + (
+    lib.optionalString buildContrib ''
+      cmakeFlagsArray+=("-DOPENCV_EXTRA_MODULES_PATH=$NIX_BUILD_TOP/source/opencv_contrib")
+
+      ${installExtraFiles vgg}
+      ${installExtraFiles boostdesc}
+      ${installExtraFiles face}
+    '');
+
+  postConfigure = ''
+    [ -e modules/core/version_string.inc ]
+    echo '"(build info elided)"' > modules/core/version_string.inc
+  '';
+
+  buildInputs =
+       [ zlib pcre hdf5 glog boost google-gflags protobuf ]
+    ++ lib.optional enablePython pythonPackages.python
+    ++ lib.optional enableGtk2 gtk2
+    ++ lib.optional enableGtk3 gtk3
+    ++ lib.optional enableVtk vtk
+    ++ lib.optional enableJPEG libjpeg
+    ++ lib.optional enablePNG libpng
+    ++ lib.optional enableTIFF libtiff
+    ++ lib.optional enableWebP libwebp
+    ++ lib.optionals enableEXR [ openexr ilmbase ]
+    ++ lib.optional enableJPEG2K jasper
+    ++ lib.optional enableFfmpeg ffmpeg
+    ++ lib.optionals (enableFfmpeg && stdenv.isDarwin)
+                     [ VideoDecodeAcceleration bzip2 ]
+    ++ lib.optionals enableGStreamer (with gst_all_1; [ gstreamer gst-plugins-base ])
+    ++ lib.optional enableOvis ogre
+    ++ lib.optional enableGPhoto2 libgphoto2
+    ++ lib.optional enableDC1394 libdc1394
+    ++ lib.optional enableEigen eigen
+    ++ lib.optional enableOpenblas openblas
+    # There is seemingly no compile-time flag for Tesseract.  It's
+    # simply enabled automatically if contrib is built, and it detects
+    # tesseract & leptonica.
+    ++ lib.optionals enableTesseract [ tesseract leptonica ]
+    ++ lib.optional enableTbb tbb
+    ++ lib.optional enableCuda cudatoolkit
+    ++ lib.optionals stdenv.isDarwin [ cf-private AVFoundation Cocoa QTKit VideoDecodeAcceleration bzip2 ]
+    ++ lib.optionals enableDocs [ doxygen graphviz-nox ];
+
+  propagatedBuildInputs = lib.optional enablePython pythonPackages.numpy;
+
+  nativeBuildInputs = [ cmake pkgconfig unzip ];
+
+  NIX_CFLAGS_COMPILE = lib.optional enableEXR "-I${ilmbase.dev}/include/OpenEXR";
+
+  # Configure can't find the library without this.
+  OpenBLAS_HOME = lib.optionalString enableOpenblas openblas;
+
+  cmakeFlags = [
+    "-DOPENCV_GENERATE_PKGCONFIG=ON"
+    "-DWITH_OPENMP=ON"
+    "-DBUILD_PROTOBUF=OFF"
+    "-DPROTOBUF_UPDATE_FILES=ON"
+    "-DOPENCV_ENABLE_NONFREE=${printEnabled enableUnfree}"
+    "-DBUILD_TESTS=OFF"
+    "-DBUILD_PERF_TESTS=OFF"
+    "-DBUILD_DOCS=${printEnabled enableDocs}"
+    (opencvFlag "IPP" enableIpp)
+    (opencvFlag "TIFF" enableTIFF)
+    (opencvFlag "JASPER" enableJPEG2K)
+    (opencvFlag "WEBP" enableWebP)
+    (opencvFlag "JPEG" enableJPEG)
+    (opencvFlag "PNG" enablePNG)
+    (opencvFlag "OPENEXR" enableEXR)
+    (opencvFlag "CUDA" enableCuda)
+    (opencvFlag "CUBLAS" enableCuda)
+    (opencvFlag "TBB" enableTbb)
+  ] ++ lib.optionals enableCuda [
+    "-DCUDA_FAST_MATH=ON"
+    "-DCUDA_HOST_COMPILER=${cudatoolkit.cc}/bin/cc"
+    "-DCUDA_NVCC_FLAGS=--expt-relaxed-constexpr"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "-DWITH_OPENCL=OFF"
+    "-DWITH_LAPACK=OFF"
+  ] ++ lib.optionals enablePython [
+    "-DOPENCV_SKIP_PYTHON_LOADER=ON"
+  ];
+
+  enableParallelBuilding = true;
+
+  postBuild = lib.optionalString enableDocs ''
+    make doxygen
+  '';
+
+  # By default $out/lib/pkgconfig/opencv4.pc looks something like this:
+  #
+  #   prefix=/nix/store/g0wnfyjjh4rikkvp22cpkh41naa43i4i-opencv-4.0.0
+  #   exec_prefix=${prefix}
+  #   libdir=${exec_prefix}//nix/store/g0wnfyjjh4rikkvp22cpkh41naa43i4i-opencv-4.0.0/lib
+  #   includedir_old=${prefix}//nix/store/g0wnfyjjh4rikkvp22cpkh41naa43i4i-opencv-4.0.0/include/opencv4/opencv
+  #   includedir_new=${prefix}//nix/store/g0wnfyjjh4rikkvp22cpkh41naa43i4i-opencv-4.0.0/include/opencv4
+  #   ...
+  #   Libs: -L${exec_prefix}//nix/store/g0wnfyjjh4rikkvp22cpkh41naa43i4i-opencv-4.0.0/lib ...
+  # Note that ${exec_prefix} is set to $out but that $out is also appended to
+  # ${exec_prefix}. This causes linker errors in downstream packages so we strip
+  # of $out after the ${exec_prefix} and ${prefix} prefixes:
+  postInstall = ''
+    sed -i "s|{exec_prefix}/$out|{exec_prefix}|;s|{prefix}/$out|{prefix}|" \
+      "$out/lib/pkgconfig/opencv4.pc"
+  '';
+
+  hardeningDisable = [ "bindnow" "relro" ];
+
+  passthru = lib.optionalAttrs enablePython { pythonPath = []; };
+
+  meta = with stdenv.lib; {
+    description = "Open Computer Vision Library with more than 500 algorithms";
+    homepage = https://opencv.org/;
+    license = with licenses; if enableUnfree then unfree else bsd3;
+    maintainers = with maintainers; [mdaiter basvandijk];
+    platforms = with platforms; linux ++ darwin;
+  };
+}
diff --git a/pkgs/development/libraries/osip/default.nix b/pkgs/development/libraries/osip/default.nix
index 814158276ce..6ee934c60c3 100644
--- a/pkgs/development/libraries/osip/default.nix
+++ b/pkgs/development/libraries/osip/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     license = stdenv.lib.licenses.lgpl21Plus;
-    homepage = http://www.gnu.org/software/osip/;
+    homepage = https://www.gnu.org/software/osip/;
     description = "The GNU oSIP library, an implementation of the Session Initiation Protocol (SIP)";
     maintainers = with stdenv.lib.maintainers; [ raskin ];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/development/libraries/png++/default.nix b/pkgs/development/libraries/png++/default.nix
index ef4b3ea7e01..54a563c518f 100644
--- a/pkgs/development/libraries/png++/default.nix
+++ b/pkgs/development/libraries/png++/default.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    homepage = http://www.nongnu.org/pngpp/;
+    homepage = https://www.nongnu.org/pngpp/;
     description = "C++ wrapper for libpng library";
     license = licenses.bsd3;
     platforms = platforms.unix;
diff --git a/pkgs/development/libraries/pth/default.nix b/pkgs/development/libraries/pth/default.nix
index 90dc647233d..7a0eba2d67a 100644
--- a/pkgs/development/libraries/pth/default.nix
+++ b/pkgs/development/libraries/pth/default.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "The GNU Portable Threads library";
-    homepage = http://www.gnu.org/software/pth;
+    homepage = https://www.gnu.org/software/pth;
     license = licenses.lgpl21Plus;
     platforms = platforms.all;
   };
diff --git a/pkgs/development/libraries/qt-5/5.6/default.nix b/pkgs/development/libraries/qt-5/5.6/default.nix
index 8732b106134..e815cc8f70f 100644
--- a/pkgs/development/libraries/qt-5/5.6/default.nix
+++ b/pkgs/development/libraries/qt-5/5.6/default.nix
@@ -46,7 +46,7 @@ let
   srcs = import ./srcs.nix { inherit fetchurl; inherit mirror; };
 
   patches = {
-    qtbase = [ ./qtbase.patch ];
+    qtbase = [ ./qtbase.patch ./qtbase-fixguicmake.patch ];
     qtdeclarative = [ ./qtdeclarative.patch ];
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
diff --git a/pkgs/development/libraries/qt-5/5.6/qtbase-fixguicmake.patch b/pkgs/development/libraries/qt-5/5.6/qtbase-fixguicmake.patch
new file mode 100644
index 00000000000..8b46d432812
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.6/qtbase-fixguicmake.patch
@@ -0,0 +1,30 @@
+diff --git a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+index 0bbc871..3673634 100644
+--- a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
++++ b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+@@ -286,7 +286,7 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+     macro(_populate_$${CMAKE_MODULE_NAME}_plugin_properties Plugin Configuration PLUGIN_LOCATION)
+         set_property(TARGET Qt5::${Plugin} APPEND PROPERTY IMPORTED_CONFIGURATIONS ${Configuration})
+ 
+-        set(imported_location \"$${CMAKE_PLUGIN_DIR}${PLUGIN_LOCATION}\")
++        set(imported_location \"${PLUGIN_LOCATION}\")
+         _qt5_$${CMAKE_MODULE_NAME}_check_file_exists(${imported_location})
+         set_target_properties(Qt5::${Plugin} PROPERTIES
+             \"IMPORTED_LOCATION_${Configuration}\" ${imported_location}
+diff --git a/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in b/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in
+index 5baf0fd..3583745 100644
+--- a/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in
++++ b/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in
+@@ -2,10 +2,10 @@
+ add_library(Qt5::$$CMAKE_PLUGIN_NAME MODULE IMPORTED)
+ 
+ !!IF !isEmpty(CMAKE_RELEASE_TYPE)
+-_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME RELEASE \"$${CMAKE_PLUGIN_LOCATION_RELEASE}\")
++_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME RELEASE \"$${CMAKE_PLUGIN_DIR}$${CMAKE_PLUGIN_LOCATION_RELEASE}\")
+ !!ENDIF
+ !!IF !isEmpty(CMAKE_DEBUG_TYPE)
+-_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME DEBUG \"$${CMAKE_PLUGIN_LOCATION_DEBUG}\")
++_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME DEBUG \"$${CMAKE_PLUGIN_DIR}$${CMAKE_PLUGIN_LOCATION_DEBUG}\")
+ !!ENDIF
+ 
+ list(APPEND Qt5$${CMAKE_MODULE_NAME}_PLUGINS Qt5::$$CMAKE_PLUGIN_NAME)
diff --git a/pkgs/development/libraries/qt-5/5.9/default.nix b/pkgs/development/libraries/qt-5/5.9/default.nix
index fbf0001220b..6fcb7a0dc5e 100644
--- a/pkgs/development/libraries/qt-5/5.9/default.nix
+++ b/pkgs/development/libraries/qt-5/5.9/default.nix
@@ -38,7 +38,7 @@ let
   srcs = import ./srcs.nix { inherit fetchurl; inherit mirror; };
 
   patches = {
-    qtbase = [ ./qtbase.patch ] ++ optional stdenv.isDarwin ./qtbase-darwin.patch;
+    qtbase = [ ./qtbase.patch ./qtbase-fixguicmake.patch ] ++ optional stdenv.isDarwin ./qtbase-darwin.patch;
     qtdeclarative = [ ./qtdeclarative.patch ];
     qtscript = [ ./qtscript.patch ];
     qtserialport = [ ./qtserialport.patch ];
diff --git a/pkgs/development/libraries/qt-5/5.9/qtbase-fixguicmake.patch b/pkgs/development/libraries/qt-5/5.9/qtbase-fixguicmake.patch
new file mode 100644
index 00000000000..8b46d432812
--- /dev/null
+++ b/pkgs/development/libraries/qt-5/5.9/qtbase-fixguicmake.patch
@@ -0,0 +1,30 @@
+diff --git a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+index 0bbc871..3673634 100644
+--- a/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
++++ b/mkspecs/features/data/cmake/Qt5BasicConfig.cmake.in
+@@ -286,7 +286,7 @@ if (NOT TARGET Qt5::$${CMAKE_MODULE_NAME})
+     macro(_populate_$${CMAKE_MODULE_NAME}_plugin_properties Plugin Configuration PLUGIN_LOCATION)
+         set_property(TARGET Qt5::${Plugin} APPEND PROPERTY IMPORTED_CONFIGURATIONS ${Configuration})
+ 
+-        set(imported_location \"$${CMAKE_PLUGIN_DIR}${PLUGIN_LOCATION}\")
++        set(imported_location \"${PLUGIN_LOCATION}\")
+         _qt5_$${CMAKE_MODULE_NAME}_check_file_exists(${imported_location})
+         set_target_properties(Qt5::${Plugin} PROPERTIES
+             \"IMPORTED_LOCATION_${Configuration}\" ${imported_location}
+diff --git a/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in b/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in
+index 5baf0fd..3583745 100644
+--- a/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in
++++ b/mkspecs/features/data/cmake/Qt5PluginTarget.cmake.in
+@@ -2,10 +2,10 @@
+ add_library(Qt5::$$CMAKE_PLUGIN_NAME MODULE IMPORTED)
+ 
+ !!IF !isEmpty(CMAKE_RELEASE_TYPE)
+-_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME RELEASE \"$${CMAKE_PLUGIN_LOCATION_RELEASE}\")
++_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME RELEASE \"$${CMAKE_PLUGIN_DIR}$${CMAKE_PLUGIN_LOCATION_RELEASE}\")
+ !!ENDIF
+ !!IF !isEmpty(CMAKE_DEBUG_TYPE)
+-_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME DEBUG \"$${CMAKE_PLUGIN_LOCATION_DEBUG}\")
++_populate_$${CMAKE_MODULE_NAME}_plugin_properties($$CMAKE_PLUGIN_NAME DEBUG \"$${CMAKE_PLUGIN_DIR}$${CMAKE_PLUGIN_LOCATION_DEBUG}\")
+ !!ENDIF
+ 
+ list(APPEND Qt5$${CMAKE_MODULE_NAME}_PLUGINS Qt5::$$CMAKE_PLUGIN_NAME)
diff --git a/pkgs/development/libraries/readline/6.2.nix b/pkgs/development/libraries/readline/6.2.nix
index e97b31896c1..54aa42439d9 100644
--- a/pkgs/development/libraries/readline/6.2.nix
+++ b/pkgs/development/libraries/readline/6.2.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation (rec {
       desire its capabilities.
     '';
 
-    homepage = http://savannah.gnu.org/projects/readline/;
+    homepage = https://savannah.gnu.org/projects/readline/;
 
     license = stdenv.lib.licenses.gpl3Plus;
 
diff --git a/pkgs/development/libraries/readline/6.3.nix b/pkgs/development/libraries/readline/6.3.nix
index cfa70f423db..cbe6c083cb4 100644
--- a/pkgs/development/libraries/readline/6.3.nix
+++ b/pkgs/development/libraries/readline/6.3.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
       desire its capabilities.
     '';
 
-    homepage = http://savannah.gnu.org/projects/readline/;
+    homepage = https://savannah.gnu.org/projects/readline/;
 
     license = licenses.gpl3Plus;
 
diff --git a/pkgs/development/libraries/readline/7.0.nix b/pkgs/development/libraries/readline/7.0.nix
index 9c0c3d31b4b..e96b4f1ebe2 100644
--- a/pkgs/development/libraries/readline/7.0.nix
+++ b/pkgs/development/libraries/readline/7.0.nix
@@ -54,7 +54,7 @@ stdenv.mkDerivation rec {
       desire its capabilities.
     '';
 
-    homepage = http://savannah.gnu.org/projects/readline/;
+    homepage = https://savannah.gnu.org/projects/readline/;
 
     license = licenses.gpl3Plus;
 
diff --git a/pkgs/development/libraries/safefile/default.nix b/pkgs/development/libraries/safefile/default.nix
index 159bad4c68e..d09e45a2d1e 100644
--- a/pkgs/development/libraries/safefile/default.nix
+++ b/pkgs/development/libraries/safefile/default.nix
@@ -13,6 +13,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = ''
+      #!${stdenv.shell}
       cd ${toString ./.}
       ${toString path}/pkgs/build-support/upstream-updater/update-walker.sh default.nix
     '';
diff --git a/pkgs/development/libraries/science/math/or-tools/default.nix b/pkgs/development/libraries/science/math/or-tools/default.nix
index 5294c779a32..415e57e5d3c 100644
--- a/pkgs/development/libraries/science/math/or-tools/default.nix
+++ b/pkgs/development/libraries/science/math/or-tools/default.nix
@@ -1,15 +1,15 @@
 { stdenv, fetchFromGitHub, cmake, google-gflags, which
-, lsb-release, glog, protobuf, cbc, zlib }:
+, lsb-release, glog, protobuf, cbc, zlib, python3 }:
 
 stdenv.mkDerivation rec {
   name = "or-tools-${version}";
-  version = "v6.9.1";
+  version = "v6.10";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "or-tools";
     rev = version;
-    sha256 = "099j1mc7vvry0a2fiz9zvk6divivglzphv48wbw0c6nd5w8hb27c";
+    sha256 = "11k3671rpv968dsglc6bgarr9yi8ijaaqm2wq3m0rn4wy8fj7za2";
   };
 
   # The original build system uses cmake which does things like pull
@@ -25,32 +25,23 @@ stdenv.mkDerivation rec {
     EOF
   '';
 
-  buildPhase = ''
-    make cc
-  '';
+  makeFlags = [ "prefix=${placeholder "out"}" ];
+  buildFlags = [ "cc" ];
 
-  installPhase = ''
-    make install_cc prefix=$out
-  '';
+  checkTarget = "test_cc";
+  doCheck = true;
 
-  patches = [
-    # In "expected" way of compilation, the glog package is compiled
-    # with gflags support which then makes gflags header transitively
-    # included through glog. However in nixpkgs we don't compile glog
-    # with gflags so we have to include it ourselves. Upstream should
-    # always include gflags to support both ways I think.
-    #
-    # Upstream ticket: https://github.com/google/or-tools/issues/902
-    ./gflags-include.patch
-  ];
+  installTargets = [ "install_cc" ];
 
   nativeBuildInputs = [
-    cmake lsb-release which zlib
+    cmake lsb-release which zlib python3
   ];
   propagatedBuildInputs = [
     google-gflags glog protobuf cbc
   ];
 
+  enableParallelBuilding = true;
+
   meta = with stdenv.lib; {
     homepage = https://github.com/google/or-tools;
     license = licenses.asl20;
diff --git a/pkgs/development/libraries/tinyxml/2.6.2.nix b/pkgs/development/libraries/tinyxml/2.6.2.nix
index 2ec9c57e241..d61076e569b 100644
--- a/pkgs/development/libraries/tinyxml/2.6.2.nix
+++ b/pkgs/development/libraries/tinyxml/2.6.2.nix
@@ -15,7 +15,7 @@ in stdenv.mkDerivation {
     # add pkgconfig file
     ./2.6.2-add-pkgconfig.patch
 
-    # http://sourceforge.net/tracker/index.php?func=detail&aid=3031828&group_id=13559&atid=313559
+    # https://sourceforge.net/tracker/index.php?func=detail&aid=3031828&group_id=13559&atid=313559
     ./2.6.2-entity.patch
 
     # Use CC, CXX, and LD from environment
diff --git a/pkgs/development/libraries/tsocks/default.nix b/pkgs/development/libraries/tsocks/default.nix
index 149b2260792..bcc91d058f0 100644
--- a/pkgs/development/libraries/tsocks/default.nix
+++ b/pkgs/development/libraries/tsocks/default.nix
@@ -31,5 +31,6 @@ stdenv.mkDerivation rec {
     license = stdenv.lib.licenses.gpl2;
     maintainers = with maintainers; [ edwtjo phreedom ];
     platforms = platforms.unix;
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/development/libraries/ucommon/default.nix b/pkgs/development/libraries/ucommon/default.nix
index 416cf53ab49..53e10b468ba 100644
--- a/pkgs/development/libraries/ucommon/default.nix
+++ b/pkgs/development/libraries/ucommon/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "C++ library to facilitate using C++ design patterns";
-    homepage = http://www.gnu.org/software/commoncpp/;
+    homepage = https://www.gnu.org/software/commoncpp/;
     license = stdenv.lib.licenses.lgpl3Plus;
 
     maintainers = with stdenv.lib.maintainers; [ ];
diff --git a/pkgs/development/libraries/vcdimager/default.nix b/pkgs/development/libraries/vcdimager/default.nix
index ddecf4a96a7..480b8f7bcd7 100644
--- a/pkgs/development/libraries/vcdimager/default.nix
+++ b/pkgs/development/libraries/vcdimager/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   propagatedBuildInputs = [ libcdio ];
 
   meta = with lib; {
-    homepage = http://www.gnu.org/software/vcdimager/;
+    homepage = https://www.gnu.org/software/vcdimager/;
     description = "Full-featured mastering suite for authoring, disassembling and analyzing Video CDs and Super Video CDs";
     platforms = platforms.unix;
     license = licenses.gpl2;
diff --git a/pkgs/development/misc/avr/libc/default.nix b/pkgs/development/misc/avr/libc/default.nix
index ab9a696afb0..4527a8700f6 100644
--- a/pkgs/development/misc/avr/libc/default.nix
+++ b/pkgs/development/misc/avr/libc/default.nix
@@ -7,7 +7,7 @@ stdenv.mkDerivation {
   name = "avr-libc-${version}";
 
   src = fetchurl {
-    url = http://download.savannah.gnu.org/releases/avr-libc/avr-libc-2.0.0.tar.bz2;
+    url = https://download.savannah.gnu.org/releases/avr-libc/avr-libc-2.0.0.tar.bz2;
     sha256 = "15svr2fx8j6prql2il2fc0ppwlv50rpmyckaxx38d3gxxv97zpdj";
   };
 
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
 
   meta = with stdenv.lib; {
     description = "a C runtime library for AVR microcontrollers";
-    homepage = http://savannah.nongnu.org/projects/avr-libc/;
+    homepage = https://savannah.nongnu.org/projects/avr-libc/;
     license = licenses.bsd3;
     platforms = [ "avr-none" ];
     maintainers = with maintainers; [ mguentner ];
diff --git a/pkgs/development/misc/qmk_firmware/default.nix b/pkgs/development/misc/qmk_firmware/default.nix
index 0a7b4fd9d9a..0ec8664dac9 100644
--- a/pkgs/development/misc/qmk_firmware/default.nix
+++ b/pkgs/development/misc/qmk_firmware/default.nix
@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub
 , avrgcc, avrbinutils
-, gcc-arm-embedded, binutils-arm-embedded
+, gcc-arm-embedded, gcc-armhf-embedded
 , teensy-loader-cli, dfu-programmer, dfu-util }:
 
 let version = "0.6.144";
@@ -14,12 +14,23 @@ in stdenv.mkDerivation {
     sha256 = "0m71f9w32ksqjkrwhqwhr74q5v3pr38bihjyb9ks0k5id0inhrjn";
     fetchSubmodules = true;
   };
+  postPatch = ''
+    substituteInPlace tmk_core/arm_atsam.mk \
+      --replace arm-none-eabi arm-none-eabihf
+    rm keyboards/handwired/frenchdev/rules.mk keyboards/dk60/rules.mk
+  '';
   buildFlags = "all:default";
+  doCheck = true;
+  checkTarget = "test:all";
+  installPhase = ''
+    mkdir $out
+  '';
   NIX_CFLAGS_COMPILE = "-Wno-error";
   nativeBuildInputs = [
     avrgcc
     avrbinutils
     gcc-arm-embedded
+    gcc-armhf-embedded
     teensy-loader-cli
     dfu-programmer
     dfu-util
diff --git a/pkgs/development/ocaml-modules/bisect_ppx-ocamlbuild/default.nix b/pkgs/development/ocaml-modules/bisect_ppx-ocamlbuild/default.nix
new file mode 100644
index 00000000000..fd3e7d58ae3
--- /dev/null
+++ b/pkgs/development/ocaml-modules/bisect_ppx-ocamlbuild/default.nix
@@ -0,0 +1,7 @@
+{ buildDunePackage, bisect_ppx, ocamlbuild }:
+
+buildDunePackage rec {
+  inherit (bisect_ppx) version src meta;
+  pname = "bisect_ppx-ocamlbuild";
+  propagatedBuildInputs = [ ocamlbuild ];
+}
diff --git a/pkgs/development/ocaml-modules/bisect_ppx/default.nix b/pkgs/development/ocaml-modules/bisect_ppx/default.nix
new file mode 100644
index 00000000000..9999cd06fca
--- /dev/null
+++ b/pkgs/development/ocaml-modules/bisect_ppx/default.nix
@@ -0,0 +1,24 @@
+{ stdenv, fetchFromGitHub, buildDunePackage, ocaml-migrate-parsetree, ppx_tools_versioned }:
+
+buildDunePackage rec {
+  pname = "bisect_ppx";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "aantron";
+    repo = "bisect_ppx";
+    rev = version;
+    sha256 = "1plhm4pvrhpapz5zaks194ji1fgzmp13y942g10pbn9m7kgkqg4h";
+  };
+
+  buildInputs = [
+    ocaml-migrate-parsetree
+    ppx_tools_versioned
+  ];
+
+  meta = {
+    description = "Code coverage for OCaml";
+    license = stdenv.lib.licenses.mpl20;
+    homepage = https://github.com/aantron/bisect_ppx;
+  };
+}
diff --git a/pkgs/development/ocaml-modules/opti/default.nix b/pkgs/development/ocaml-modules/opti/default.nix
new file mode 100644
index 00000000000..7b084e61688
--- /dev/null
+++ b/pkgs/development/ocaml-modules/opti/default.nix
@@ -0,0 +1,18 @@
+{ stdenv, fetchurl, buildDunePackage }:
+
+buildDunePackage rec {
+  pname = "opti";
+  version = "1.0.3";
+
+  src = fetchurl {
+    url = "https://github.com/magnusjonsson/opti/releases/download/${version}/opti-${version}.tbz";
+    sha256 = "ed9ba56dc06e9d2b1bf097964cc65ea37db787d4f239c13d0dd74693f5b50a1e";
+  };
+
+  meta = with stdenv.lib; {
+    description = "DSL to generate fast incremental C code from declarative specifications";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.jmagnusj ];
+    homepage = https://github.com/magnusjonsson/opti;
+  };
+}
diff --git a/pkgs/development/python-modules/docutils/default.nix b/pkgs/development/python-modules/docutils/default.nix
index c2aced4e45e..f427f95ffaa 100644
--- a/pkgs/development/python-modules/docutils/default.nix
+++ b/pkgs/development/python-modules/docutils/default.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , fetchurl
 , buildPythonPackage
 , isPy3k
@@ -14,9 +15,13 @@ buildPythonPackage rec {
     sha256 = "0x22fs3pdmr42kvz6c654756wja305qv6cx1zbhwlagvxgr4xrji";
   };
 
-  checkPhase = ''
-    LANG="en_US.UTF-8" ${python.interpreter} ${if isPy3k then "test3/alltests.py" else "test/alltests.py"}
-  '';
+  # Only Darwin needs LANG, but we could set it in general.
+  # It's done here conditionally to prevent mass-rebuilds.
+  checkPhase = lib.optionalString (isPy3k && stdenv.isDarwin) ''LANG="en_US.UTF-8" '' + (if isPy3k then ''
+    ${python.interpreter} test3/alltests.py
+  '' else ''
+    ${python.interpreter} test/alltests.py
+  '');
 
   # Create symlinks lacking a ".py" suffix, many programs depend on these names
   postFixup = ''
diff --git a/pkgs/development/python-modules/effect/default.nix b/pkgs/development/python-modules/effect/default.nix
index 3a026103a15..8e4ad446746 100644
--- a/pkgs/development/python-modules/effect/default.nix
+++ b/pkgs/development/python-modules/effect/default.nix
@@ -8,12 +8,12 @@
 , testtools
 }:
 buildPythonPackage rec {
-  version = "0.11.0";
+  version = "0.12.0";
   pname = "effect";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1q75w4magkqd8ggabhhzzxmxakpdnn0vdg7ygj89zdc9yl7561q6";
+    sha256 = "0s8zsncq4l0ar2b4dijf8yzrk13x2swr1w2nb30s1p5jd6r24czl";
   };
   checkInputs = [
     pytest
@@ -24,10 +24,8 @@ buildPythonPackage rec {
     attrs
   ];
   checkPhase = ''
-    pytest .
+    pytest
   '';
-  # Tests fails on python3.7 https://github.com/python-effect/effect/issues/78
-  doCheck = !isPy37;
   meta = with lib; {
     description = "Pure effects for Python";
     homepage = https://github.com/python-effect/effect;
diff --git a/pkgs/development/python-modules/mmpython/default.nix b/pkgs/development/python-modules/mmpython/default.nix
index c35b2e35cfb..0a41b6e3c87 100644
--- a/pkgs/development/python-modules/mmpython/default.nix
+++ b/pkgs/development/python-modules/mmpython/default.nix
@@ -10,7 +10,7 @@ buildPythonPackage rec {
   pname = "mmpython";
 
   src = fetchurl {
-    url = http://sourceforge.net/projects/mmpython/files/latest/download;
+    url = https://sourceforge.net/projects/mmpython/files/latest/download;
     sha256 = "1b7qfad3shgakj37gcj1b9h78j1hxlz6wp9k7h76pb4sq4bfyihy";
     name = "${pname}-${version}.tar.gz";
   };
diff --git a/pkgs/development/python-modules/ntfy/default.nix b/pkgs/development/python-modules/ntfy/default.nix
deleted file mode 100644
index efbd1eec35a..00000000000
--- a/pkgs/development/python-modules/ntfy/default.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{ stdenv
-, buildPythonPackage
-, fetchFromGitHub
-, appdirs
-, ruamel_yaml
-, requests
-, emoji
-, sleekxmpp
-, mock
-, psutil
-, python
-# , dbus-python
-}:
-
-buildPythonPackage rec {
-  version = "2.6.0";
-  pname = "ntfy";
-
-  src = fetchFromGitHub {
-    owner = "dschep";
-    repo = "ntfy";
-    rev = "v${version}";
-    sha256 = "0hnwrybbk0gw0c6kw2zpx0x1rh3jb9qyrprcphzkv0jlhzdfkrp1";
-  };
-
-  propagatedBuildInputs = [ requests ruamel_yaml appdirs mock sleekxmpp emoji psutil ];
-
-  checkPhase = ''
-    HOME=$(mktemp -d) ${python.interpreter} setup.py test
-  '';
-
-  meta = with stdenv.lib; {
-    description = "A utility for sending notifications, on demand and when commands finish";
-    homepage = http://ntfy.rtfd.org/;
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ kamilchm ];
-  };
-
-}
diff --git a/pkgs/development/python-modules/pycdio/default.nix b/pkgs/development/python-modules/pycdio/default.nix
index 4c7dc52e79b..6d670006014 100644
--- a/pkgs/development/python-modules/pycdio/default.nix
+++ b/pkgs/development/python-modules/pycdio/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/libcdio/;
+    homepage = https://www.gnu.org/software/libcdio/;
     description = "Wrapper around libcdio (CD Input and Control library)";
     maintainers = with maintainers; [ rycee ];
     license = licenses.gpl3Plus;
diff --git a/pkgs/development/python-modules/ruamel_yaml/default.nix b/pkgs/development/python-modules/ruamel_yaml/default.nix
index 59674d82c90..619b2fb5eb3 100644
--- a/pkgs/development/python-modules/ruamel_yaml/default.nix
+++ b/pkgs/development/python-modules/ruamel_yaml/default.nix
@@ -9,11 +9,11 @@
 
 buildPythonPackage rec {
   pname = "ruamel.yaml";
-  version = "0.15.35";
+  version = "0.15.80";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0xggyfaj6vprggahf7cq8kp9j79rb7hn8ndk3bxj2sxvwhhliiwd";
+    sha256 = "1rhlshff9csjwn64x11b9a7gbxccs1vd7rdiqwlhifjxax8k682g";
   };
 
   # Tests cannot load the module to test
diff --git a/pkgs/development/python-modules/sybil/default.nix b/pkgs/development/python-modules/sybil/default.nix
index c78016d7296..8b1677a7b84 100644
--- a/pkgs/development/python-modules/sybil/default.nix
+++ b/pkgs/development/python-modules/sybil/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, buildPythonApplication, fetchPypi
+{ stdenv, buildPythonApplication, fetchPypi, fetchpatch
 , pytest, nose }:
 
 buildPythonApplication rec {
@@ -10,6 +10,13 @@ buildPythonApplication rec {
     sha256 = "41d2f1dba8fd1d8ead5e9b1220b590fab8b0d1ca01d43da08555b1fb08d4d8e8";
   };
 
+  patches = [
+    (fetchpatch {
+      url = https://github.com/cjw296/sybil/commit/6461d8156cfb68bd073ec613a5a516916e97e549.patch;
+      sha256 = "0aqny0i7l6g6d7vr025b90zz8wzszqdbmi05mp67dxw5xqjqvxj2";
+    })
+  ];
+
   checkInputs = [ pytest nose ];
 
   checkPhase = ''
diff --git a/pkgs/development/ruby-modules/solargraph/Gemfile.lock b/pkgs/development/ruby-modules/solargraph/Gemfile.lock
index 5c1db601988..a936dd25d92 100644
--- a/pkgs/development/ruby-modules/solargraph/Gemfile.lock
+++ b/pkgs/development/ruby-modules/solargraph/Gemfile.lock
@@ -2,7 +2,6 @@ GEM
   remote: https://rubygems.org/
   specs:
     ast (2.4.0)
-    coderay (1.1.2)
     eventmachine (1.2.7)
     htmlentities (4.3.4)
     jaro_winkler (1.5.1)
@@ -11,34 +10,33 @@ GEM
     nokogiri (1.8.5)
       mini_portile2 (~> 2.3.0)
     parallel (1.12.1)
-    parser (2.5.1.2)
+    parser (2.5.3.0)
       ast (~> 2.4.0)
     powerpack (0.1.2)
     rainbow (3.0.0)
     reverse_markdown (1.1.0)
       nokogiri
-    rubocop (0.59.2)
+    rubocop (0.60.0)
       jaro_winkler (~> 1.5.1)
       parallel (~> 1.10)
       parser (>= 2.5, != 2.5.1.1)
       powerpack (~> 0.1)
       rainbow (>= 2.2.2, < 4.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (~> 1.0, >= 1.0.1)
+      unicode-display_width (~> 1.4.0)
     ruby-progressbar (1.10.0)
-    solargraph (0.28.2)
-      coderay (~> 1.1)
+    solargraph (0.29.1)
       eventmachine (~> 1.2, >= 1.2.5)
       htmlentities (~> 4.3, >= 4.3.4)
       kramdown (~> 1.16)
-      parser (~> 2.4)
+      parser (~> 2.3)
       reverse_markdown (~> 1.0, >= 1.0.5)
       rubocop (~> 0.52)
       thor (~> 0.19, >= 0.19.4)
       tilt (~> 2.0)
       yard (~> 0.9)
-    thor (0.20.0)
-    tilt (2.0.8)
+    thor (0.20.3)
+    tilt (2.0.9)
     unicode-display_width (1.4.0)
     yard (0.9.16)
 
@@ -49,4 +47,4 @@ DEPENDENCIES
   solargraph!
 
 BUNDLED WITH
-   1.16.3
+   1.17.1
diff --git a/pkgs/development/ruby-modules/solargraph/default.nix b/pkgs/development/ruby-modules/solargraph/default.nix
index 39520fdb0ba..2f60dacd358 100644
--- a/pkgs/development/ruby-modules/solargraph/default.nix
+++ b/pkgs/development/ruby-modules/solargraph/default.nix
@@ -7,9 +7,9 @@ bundlerApp rec {
 
   meta = with lib; {
     description = "IDE tools for the Ruby language";
-    homepage    = http://www.github.com/castwide/solargraph;
-    license     = licenses.mit;
+    homepage = http://www.github.com/castwide/solargraph;
+    license = licenses.mit;
     maintainers = with maintainers; [ worldofpeace ];
-    platforms   = platforms.unix;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/development/ruby-modules/solargraph/gemset.nix b/pkgs/development/ruby-modules/solargraph/gemset.nix
index 2f46db60984..bfb5496444a 100644
--- a/pkgs/development/ruby-modules/solargraph/gemset.nix
+++ b/pkgs/development/ruby-modules/solargraph/gemset.nix
@@ -7,14 +7,6 @@
     };
     version = "2.4.0";
   };
-  coderay = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "15vav4bhcc2x3jmi3izb11l4d9f3xv8hp2fszb7iqmpsccv1pz4y";
-      type = "gem";
-    };
-    version = "1.1.2";
-  };
   eventmachine = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -76,10 +68,10 @@
     dependencies = ["ast"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zp89zg7iypncszxsjp8kiccrpbdf728jl449g6cnfkz990fyb5k";
+      sha256 = "1zjk0w1kjj3xk8ymy1430aa4gg0k8ckphfj88br6il4pm83f0n1f";
       type = "gem";
     };
-    version = "2.5.1.2";
+    version = "2.5.3.0";
   };
   powerpack = {
     source = {
@@ -110,10 +102,10 @@
     dependencies = ["jaro_winkler" "parallel" "parser" "powerpack" "rainbow" "ruby-progressbar" "unicode-display_width"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0110r4yqi6nn97bp2myah76plv6a7daxnm9k04k64n1y4zpqm256";
+      sha256 = "1ivk049z3mp12nc6v1wn35bsq1g7nz1i2r4xwzqf0v25hm2v7n1i";
       type = "gem";
     };
-    version = "0.59.2";
+    version = "0.60.0";
   };
   ruby-progressbar = {
     source = {
@@ -124,29 +116,29 @@
     version = "1.10.0";
   };
   solargraph = {
-    dependencies = ["coderay" "eventmachine" "htmlentities" "kramdown" "parser" "reverse_markdown" "rubocop" "thor" "tilt" "yard"];
+    dependencies = ["eventmachine" "htmlentities" "kramdown" "parser" "reverse_markdown" "rubocop" "thor" "tilt" "yard"];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0xvxifq5871fh2c34hjvsqn38nw4s63d599vbs5mlrrvdl3c5s01";
+      sha256 = "12sy1rdz2fk3aba43701qp1250xm8w26rlizypd6h5rnmmqm5q54";
       type = "gem";
     };
-    version = "0.28.2";
+    version = "0.29.1";
   };
   thor = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0nmqpyj642sk4g16nkbq6pj856adpv91lp4krwhqkh2iw63aszdl";
+      sha256 = "1yhrnp9x8qcy5vc7g438amd5j9sw83ih7c30dr6g6slgw9zj3g29";
       type = "gem";
     };
-    version = "0.20.0";
+    version = "0.20.3";
   };
   tilt = {
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0020mrgdf11q23hm1ddd6fv691l51vi10af00f137ilcdb2ycfra";
+      sha256 = "0ca4k0clwf0rkvy7726x4nxpjxkpv67w043i39saxgldxd97zmwz";
       type = "gem";
     };
-    version = "2.0.8";
+    version = "2.0.9";
   };
   unicode-display_width = {
     source = {
diff --git a/pkgs/development/tools/analysis/radare2/default.nix b/pkgs/development/tools/analysis/radare2/default.nix
index 88d68e2fd19..aa8741989f4 100644
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@@ -90,17 +90,17 @@ in {
   #<generated>
   # DO NOT EDIT! Automatically generated by ./update.py
   radare2 = generic {
-    version_commit = "20222";
-    gittap = "3.1.0";
-    gittip = "c033496ebc7034e52a84be9cdb2d2dfad6a4cfac";
-    rev = "3.1.0";
-    version = "3.1.0";
-    sha256 = "0ggqda8433n7p4yivn7l0807i5wwf0vww2p8v90ri66nasbzvl16";
+    version_commit = "20285";
+    gittap = "3.1.1";
+    gittip = "b143e1b1b5622ef2f41a90f4c0f7ed4c477caf40";
+    rev = "3.1.1";
+    version = "3.1.1";
+    sha256 = "09kn25ijqhk3x9f3k6mw1g0wvwym8ys6qz53ybx3qizy4fzln0hw";
     cs_tip = "f01c267f889e932b069a559ce0c604c1ae986c0a";
     cs_sha256 = "15ifnql2gi2f9g8j60hc4hbxbvi2qn1r110ry32qmlz55svxh67y";
   };
   r2-for-cutter = generic {
-    version_commit = "20222";
+    version_commit = "20285";
     gittap = "2.9.0-310-gcb62c376b";
     gittip = "cb62c376bef6c7427019a7c28910c33c364436dd";
     rev = "cb62c376bef6c7427019a7c28910c33c364436dd";
diff --git a/pkgs/development/tools/build-managers/gnumake/4.2/default.nix b/pkgs/development/tools/build-managers/gnumake/4.2/default.nix
index 95466d843d6..98804f0ebe8 100644
--- a/pkgs/development/tools/build-managers/gnumake/4.2/default.nix
+++ b/pkgs/development/tools/build-managers/gnumake/4.2/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
   outputs = [ "out" "man" "info" ];
 
   meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/make/;
+    homepage = https://www.gnu.org/software/make/;
     description = "A tool to control the generation of non-source files from sources";
     license = licenses.gpl3Plus;
 
diff --git a/pkgs/development/tools/build-managers/gup/default.nix b/pkgs/development/tools/build-managers/gup/default.nix
index f6d5b7b9b59..7fd80148831 100644
--- a/pkgs/development/tools/build-managers/gup/default.nix
+++ b/pkgs/development/tools/build-managers/gup/default.nix
@@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
     cp -r python/bin $out/bin
   '';
   passthru.updateScript = ''
+    #!${stdenv.shell}
     set -e
     echo
     cd ${toString ./.}
diff --git a/pkgs/development/tools/build-managers/mill/default.nix b/pkgs/development/tools/build-managers/mill/default.nix
new file mode 100644
index 00000000000..b909b3953fa
--- /dev/null
+++ b/pkgs/development/tools/build-managers/mill/default.nix
@@ -0,0 +1,40 @@
+{ stdenv, fetchurl, jre, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  name = "mill-${version}";
+  version = "0.3.5";
+
+  src = fetchurl {
+    url = "https://github.com/lihaoyi/mill/releases/download/${version}/${version}";
+    sha256 = "19ka81f6vjr85gd8cadn0fv0i0qcdspx2skslfksklxdxs2gasf8";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  unpackPhase = "true";
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm555 "$src" "$out/bin/.mill-wrapped"
+    # can't use wrapProgram because it sets --argv0
+    makeWrapper "$out/bin/.mill-wrapped" "$out/bin/mill" --prefix PATH : ${stdenv.lib.makeBinPath [ jre ]}
+    runHook postInstall
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://www.lihaoyi.com/mill;
+    license = licenses.mit;
+    description = "A build tool for Scala, Java and more";
+    longDescription = ''
+      Mill is a build tool borrowing ideas from modern tools like Bazel, to let you build
+      your projects in a way that's simple, fast, and predictable. Mill has built in
+      support for the Scala programming language, and can serve as a replacement for
+      SBT, but can also be extended to support any other language or platform via
+      modules (written in Java or Scala) or through an external subprocesses.
+    '';
+    maintainers = with maintainers; [ scalavision ];
+    platforms = stdenv.lib.platforms.all;
+  };
+}
diff --git a/pkgs/development/tools/build-managers/sbt/default.nix b/pkgs/development/tools/build-managers/sbt/default.nix
index dce19a1d839..d6eed35e30a 100644
--- a/pkgs/development/tools/build-managers/sbt/default.nix
+++ b/pkgs/development/tools/build-managers/sbt/default.nix
@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   name = "sbt-${version}";
-  version = "1.2.6";
+  version = "1.2.7";
 
   src = fetchurl {
     urls = [
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
       "https://github.com/sbt/sbt/releases/download/v${version}/sbt-${version}.tgz"
       "https://cocl.us/sbt-${version}.tgz"
     ];
-    sha256 = "1nv8r3j2vhp38qbb123n86wfhb6mvwz7vgrrsjp344zg211psncn";
+    sha256 = "10g7a1j2knbqmnbpvfhy1rqdg2pflmasz879ax59pv3mvgccn996";
   };
 
   patchPhase = ''
diff --git a/pkgs/development/tools/gnulib/default.nix b/pkgs/development/tools/gnulib/default.nix
index f7aad74cf9b..18af16d3652 100644
--- a/pkgs/development/tools/gnulib/default.nix
+++ b/pkgs/development/tools/gnulib/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation {
   name = "gnulib-20180226";
 
   src = fetchgit {
-    url = "http://git.savannah.gnu.org/r/gnulib.git";
+    url = "https://git.savannah.gnu.org/r/gnulib.git";
     rev = "0bec5d56c6938c2f28417bb5fd1c4b05ea2e7d28";
     sha256 = "0sifr3bkmhyr5s6ljgfyr0fw6w49ajf11rlp1r797f3r3r6j9w4k";
   };
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    homepage = http://www.gnu.org/software/gnulib/;
+    homepage = https://www.gnu.org/software/gnulib/;
     description = "Central location for code to be shared among GNU packages";
     license = stdenv.lib.licenses.gpl3Plus;
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/development/tools/guile/g-wrap/default.nix b/pkgs/development/tools/guile/g-wrap/default.nix
index 80c9ce3d432..78f2e967123 100644
--- a/pkgs/development/tools/guile/g-wrap/default.nix
+++ b/pkgs/development/tools/guile/g-wrap/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
       inter-language calls.  It currently only supports generating Guile
       wrappers for C functions.
     '';
-    homepage = "http://www.nongnu.org/g-wrap/";
+    homepage = "https://www.nongnu.org/g-wrap/";
     license = licenses.lgpl2Plus;
     maintainers = with maintainers; [ vyp ];
     platforms = platforms.linux;
diff --git a/pkgs/development/tools/java/fastjar/default.nix b/pkgs/development/tools/java/fastjar/default.nix
index f9e1d9a0842..403bfeabfd0 100644
--- a/pkgs/development/tools/java/fastjar/default.nix
+++ b/pkgs/development/tools/java/fastjar/default.nix
@@ -5,7 +5,7 @@ let version = "0.98"; in
     name = "fastjar-${version}";
 
     src = fetchurl {
-      url = "http://download.savannah.gnu.org/releases/fastjar/fastjar-${version}.tar.gz";
+      url = "https://download.savannah.gnu.org/releases/fastjar/fastjar-${version}.tar.gz";
       sha256 = "0iginbz2m15hcsa3x4y7v3mhk54gr1r7m3ghx0pg4n46vv2snmpi";
     };
 
@@ -22,7 +22,7 @@ let version = "0.98"; in
         the stock `jar' program running without a JIT.
       '';
 
-      homepage = http://savannah.nongnu.org/projects/fastjar/;
+      homepage = https://savannah.nongnu.org/projects/fastjar/;
 
       license = stdenv.lib.licenses.gpl2Plus;
       platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/development/tools/jq/default.nix b/pkgs/development/tools/jq/default.nix
index b7b2b5066b9..307968a6844 100644
--- a/pkgs/development/tools/jq/default.nix
+++ b/pkgs/development/tools/jq/default.nix
@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url="https://github.com/stedolan/jq/releases/download/jq-${version}/jq-${version}.tar.gz";
-    sha256="1a76f46a652i2g333kfvrl6mp2w7whf6h1yly519izg4y967h9cn";
+    sha256="0wmapfskhzfwranf6515nzmm84r7kwljgfs7dg6bjgxakbicis2x";
   };
 
   outputs = [ "bin" "doc" "man" "dev" "lib" "out" ];
diff --git a/pkgs/development/tools/misc/autoconf-archive/default.nix b/pkgs/development/tools/misc/autoconf-archive/default.nix
index cb64a4c876b..d051e1d5759 100644
--- a/pkgs/development/tools/misc/autoconf-archive/default.nix
+++ b/pkgs/development/tools/misc/autoconf-archive/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Archive of autoconf m4 macros";
-    homepage = http://www.gnu.org/software/autoconf-archive/;
+    homepage = https://www.gnu.org/software/autoconf-archive/;
     license = licenses.gpl3;
     platforms = platforms.unix;
   };
diff --git a/pkgs/development/tools/misc/autoconf/2.13.nix b/pkgs/development/tools/misc/autoconf/2.13.nix
index d4748337626..9e777e53cf6 100644
--- a/pkgs/development/tools/misc/autoconf/2.13.nix
+++ b/pkgs/development/tools/misc/autoconf/2.13.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
   postInstall = ''ln -s autoconf "$out"/bin/autoconf-2.13'';
 
   meta = {
-    homepage = http://www.gnu.org/software/autoconf/;
+    homepage = https://www.gnu.org/software/autoconf/;
     description = "Part of the GNU Build System";
     branch = "2.13";
 
diff --git a/pkgs/development/tools/misc/autoconf/2.64.nix b/pkgs/development/tools/misc/autoconf/2.64.nix
index 31df050d5f8..98b55e31f60 100644
--- a/pkgs/development/tools/misc/autoconf/2.64.nix
+++ b/pkgs/development/tools/misc/autoconf/2.64.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   doInstallCheck = false; # fails
 
   meta = {
-    homepage = http://www.gnu.org/software/autoconf/;
+    homepage = https://www.gnu.org/software/autoconf/;
     description = "Part of the GNU Build System";
 
     longDescription = ''
diff --git a/pkgs/development/tools/misc/autoconf/default.nix b/pkgs/development/tools/misc/autoconf/default.nix
index e9ea0ea1ea4..304b4fddf0d 100644
--- a/pkgs/development/tools/misc/autoconf/default.nix
+++ b/pkgs/development/tools/misc/autoconf/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
   doInstallCheck = false; # fails
 
   meta = {
-    homepage = http://www.gnu.org/software/autoconf/;
+    homepage = https://www.gnu.org/software/autoconf/;
     description = "Part of the GNU Build System";
 
     longDescription = ''
diff --git a/pkgs/development/tools/misc/autogen/default.nix b/pkgs/development/tools/misc/autogen/default.nix
index 265d425bbcf..ff5ce659d2e 100644
--- a/pkgs/development/tools/misc/autogen/default.nix
+++ b/pkgs/development/tools/misc/autogen/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     description = "Automated text and program generation tool";
     license = with licenses; [ gpl3Plus lgpl3Plus ];
-    homepage = http://www.gnu.org/software/autogen/;
+    homepage = https://www.gnu.org/software/autogen/;
     platforms = platforms.all;
     maintainers = [ ];
   };
diff --git a/pkgs/development/tools/misc/automake/automake-1.11.x.nix b/pkgs/development/tools/misc/automake/automake-1.11.x.nix
index 8f437af0ada..a5aa44abcde 100644
--- a/pkgs/development/tools/misc/automake/automake-1.11.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.11.x.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
 
   # TODO: Remove the `aclocal' wrapper when $ACLOCAL_PATH support is
   # available upstream; see
-  # <http://debbugs.gnu.org/cgi/bugreport.cgi?bug=9026>.
+  # <https://debbugs.gnu.org/cgi/bugreport.cgi?bug=9026>.
   builder = ./builder.sh;
 
   setupHook = ./setup-hook.sh;
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     branch = "1.11";
-    homepage = http://www.gnu.org/software/automake/;
+    homepage = https://www.gnu.org/software/automake/;
     description = "GNU standard-compliant makefile generator";
 
     longDescription = ''
diff --git a/pkgs/development/tools/misc/automake/automake-1.16.x.nix b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
index 478fc14d680..1e432a6e149 100644
--- a/pkgs/development/tools/misc/automake/automake-1.16.x.nix
+++ b/pkgs/development/tools/misc/automake/automake-1.16.x.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     branch = "1.15";
-    homepage = http://www.gnu.org/software/automake/;
+    homepage = https://www.gnu.org/software/automake/;
     description = "GNU standard-compliant makefile generator";
     license = stdenv.lib.licenses.gpl2Plus;
 
diff --git a/pkgs/development/tools/misc/avrdude/default.nix b/pkgs/development/tools/misc/avrdude/default.nix
index 4475e58207e..39f98ae0028 100644
--- a/pkgs/development/tools/misc/avrdude/default.nix
+++ b/pkgs/development/tools/misc/avrdude/default.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
       download/upload/manipulate the ROM and EEPROM contents of AVR
       microcontrollers using the in-system programming technique (ISP).
     '';
-    homepage = http://www.nongnu.org/avrdude/;
+    homepage = https://www.nongnu.org/avrdude/;
     license = licenses.gpl2Plus;
     platforms = with platforms; linux ++ darwin;
     maintainers = [ maintainers.bjornfor ];
diff --git a/pkgs/development/tools/misc/binutils/default.nix b/pkgs/development/tools/misc/binutils/default.nix
index 1c30983dfee..7d045115b59 100644
--- a/pkgs/development/tools/misc/binutils/default.nix
+++ b/pkgs/development/tools/misc/binutils/default.nix
@@ -150,7 +150,7 @@ stdenv.mkDerivation rec {
       They also include the BFD (Binary File Descriptor) library,
       `gprof', `nm', `strip', etc.
     '';
-    homepage = http://www.gnu.org/software/binutils/;
+    homepage = https://www.gnu.org/software/binutils/;
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ericson2314 ];
     platforms = platforms.unix;
diff --git a/pkgs/development/tools/misc/cflow/default.nix b/pkgs/development/tools/misc/cflow/default.nix
index 16098bda3ee..b2dbf65bcb0 100644
--- a/pkgs/development/tools/misc/cflow/default.nix
+++ b/pkgs/development/tools/misc/cflow/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
 
     license = licenses.gpl3Plus;
 
-    homepage = http://www.gnu.org/software/cflow/;
+    homepage = https://www.gnu.org/software/cflow/;
 
     maintainers = [ maintainers.vrthra ];
 
diff --git a/pkgs/development/tools/misc/complexity/default.nix b/pkgs/development/tools/misc/complexity/default.nix
index 41bfa520e62..d95c67fea6d 100644
--- a/pkgs/development/tools/misc/complexity/default.nix
+++ b/pkgs/development/tools/misc/complexity/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
     license = stdenv.lib.licenses.gpl3Plus;
 
-    homepage = http://www.gnu.org/software/complexity/;
+    homepage = https://www.gnu.org/software/complexity/;
 
     platforms = stdenv.lib.platforms.gnu ++ stdenv.lib.platforms.linux;
     maintainers = [ ];
diff --git a/pkgs/development/tools/misc/cppi/default.nix b/pkgs/development/tools/misc/cppi/default.nix
index 148c08d9c86..e4d123dece1 100644
--- a/pkgs/development/tools/misc/cppi/default.nix
+++ b/pkgs/development/tools/misc/cppi/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = {
-    homepage = http://savannah.gnu.org/projects/cppi/;
+    homepage = https://savannah.gnu.org/projects/cppi/;
 
     description = "A C preprocessor directive indenter";
 
diff --git a/pkgs/development/tools/misc/ddd/default.nix b/pkgs/development/tools/misc/ddd/default.nix
index 7238bcdeb6b..c51a5f50474 100644
--- a/pkgs/development/tools/misc/ddd/default.nix
+++ b/pkgs/development/tools/misc/ddd/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   patches = [ ./gcc44.patch ];
 
   meta = {
-    homepage = http://www.gnu.org/software/ddd;
+    homepage = https://www.gnu.org/software/ddd;
     description = "Graphical front-end for command-line debuggers";
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/development/tools/misc/dejagnu/default.nix b/pkgs/development/tools/misc/dejagnu/default.nix
index d9fab774b76..26eaf707b2b 100644
--- a/pkgs/development/tools/misc/dejagnu/default.nix
+++ b/pkgs/development/tools/misc/dejagnu/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   # details.
 
   # The test-suite needs to have a non-empty stdin:
-  #   http://lists.gnu.org/archive/html/bug-dejagnu/2003-06/msg00002.html
+  #   https://lists.gnu.org/archive/html/bug-dejagnu/2003-06/msg00002.html
   checkPhase = ''
     # Provide `runtest' with a log name, otherwise it tries to run
     # `whoami', which fails when in a chroot.
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
       Tool command language.
     '';
 
-    homepage = http://www.gnu.org/software/dejagnu/;
+    homepage = https://www.gnu.org/software/dejagnu/;
     license = licenses.gpl2Plus;
 
     platforms = platforms.unix;
diff --git a/pkgs/development/tools/misc/gdb/default.nix b/pkgs/development/tools/misc/gdb/default.nix
index 864ee05cf83..29942bb2fc4 100644
--- a/pkgs/development/tools/misc/gdb/default.nix
+++ b/pkgs/development/tools/misc/gdb/default.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
       program was doing at the moment it crashed.
     '';
 
-    homepage = http://www.gnu.org/software/gdb/;
+    homepage = https://www.gnu.org/software/gdb/;
 
     license = stdenv.lib.licenses.gpl3Plus;
 
diff --git a/pkgs/development/tools/misc/gengetopt/default.nix b/pkgs/development/tools/misc/gengetopt/default.nix
index 304f16942ea..b6758cb0bc2 100644
--- a/pkgs/development/tools/misc/gengetopt/default.nix
+++ b/pkgs/development/tools/misc/gengetopt/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
          fills a struct
       '';
 
-    homepage = http://www.gnu.org/software/gengetopt/;
+    homepage = https://www.gnu.org/software/gengetopt/;
 
     license = stdenv.lib.licenses.gpl3Plus;
 
diff --git a/pkgs/development/tools/misc/global/default.nix b/pkgs/development/tools/misc/global/default.nix
index f0f21f8f4d5..cc6dde53bb9 100644
--- a/pkgs/development/tools/misc/global/default.nix
+++ b/pkgs/development/tools/misc/global/default.nix
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
       independence of any editor.  It runs on a UNIX (POSIX) compatible
       operating system like GNU and BSD.
     '';
-    homepage = http://www.gnu.org/software/global/;
+    homepage = https://www.gnu.org/software/global/;
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ pSub peterhoeg ];
     platforms = platforms.unix;
diff --git a/pkgs/development/tools/misc/gnum4/default.nix b/pkgs/development/tools/misc/gnum4/default.nix
index 12a5b8f2adc..f477d42fcf1 100644
--- a/pkgs/development/tools/misc/gnum4/default.nix
+++ b/pkgs/development/tools/misc/gnum4/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   patches = [ ./s_isdir.patch ] ++ stdenv.lib.optional stdenv.hostPlatform.isDarwin stdenv.secure-format-patch;
 
   meta = {
-    homepage = http://www.gnu.org/software/m4/;
+    homepage = https://www.gnu.org/software/m4/;
     description = "GNU M4, a macro processor";
 
     longDescription = ''
diff --git a/pkgs/development/tools/misc/gperf/3.0.x.nix b/pkgs/development/tools/misc/gperf/3.0.x.nix
index bfada264d50..e203f931b43 100644
--- a/pkgs/development/tools/misc/gperf/3.0.x.nix
+++ b/pkgs/development/tools/misc/gperf/3.0.x.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
     license = stdenv.lib.licenses.gpl3Plus;
 
-    homepage = http://www.gnu.org/software/gperf/;
+    homepage = https://www.gnu.org/software/gperf/;
     platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/misc/gperf/default.nix b/pkgs/development/tools/misc/gperf/default.nix
index b88a107bdbc..cd0854d2beb 100644
--- a/pkgs/development/tools/misc/gperf/default.nix
+++ b/pkgs/development/tools/misc/gperf/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
 
     license = stdenv.lib.licenses.gpl3Plus;
 
-    homepage = http://www.gnu.org/software/gperf/;
+    homepage = https://www.gnu.org/software/gperf/;
     platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/development/tools/misc/help2man/default.nix b/pkgs/development/tools/misc/help2man/default.nix
index 44ec787a1a5..ca48af64196 100644
--- a/pkgs/development/tools/misc/help2man/default.nix
+++ b/pkgs/development/tools/misc/help2man/default.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
          ‘--version’ output of other commands.
       '';
 
-    homepage = http://www.gnu.org/software/help2man/;
+    homepage = https://www.gnu.org/software/help2man/;
 
     license = licenses.gpl3Plus;
     platforms = platforms.all;
diff --git a/pkgs/development/tools/misc/kibana/default.nix b/pkgs/development/tools/misc/kibana/default.nix
index 72321f560c7..9d5e94e7d76 100644
--- a/pkgs/development/tools/misc/kibana/default.nix
+++ b/pkgs/development/tools/misc/kibana/default.nix
@@ -18,12 +18,12 @@ let
   shas =
     if enableUnfree
     then {
-      "x86_64-linux"  = "1kk97ggpzmblhqm6cfd2sv5940f58h323xcyg6rba1njj7lzanv0";
-      "x86_64-darwin" = "1xvwffk8d8br92h0laf4b1m76kvki6cj0pbgcvirfcj1r70vk6c3";
+      "x86_64-linux"  = "0lip4bj3jazv83gydw99dnp03cb0fd1p4z3lvpjbisgmqffbbg5v";
+      "x86_64-darwin" = "0hjdnqagcwbjhpcfyr6w0zmy4sjnx4fyp79czb0vp7dig5arnwm3";
     }
     else {
-      "x86_64-linux"  = "0m81ki1v61gpwb3s6zf84azqrirlm9pdfx65g3xmvdp3d3wii5ly";
-      "x86_64-darwin" = "0zh9p6vsq1d0gh6ks7z6bh8sbhn6rm4jshjcfp3c9k7n2qa8vv9b";
+      "x86_64-linux"  = "1jybn4q7pz61iijzl85d948szlacfcbldn2nhhsb6063xwvf30sa";
+      "x86_64-darwin" = "1bl1h6hgp9l5cjq6pzj2x855wjaka8hbs0fn2c03lbzsc991dppr";
     };
 
   # For the correct phantomjs version see:
@@ -47,6 +47,13 @@ in stdenv.mkDerivation rec {
     sha256 = shas."${stdenv.hostPlatform.system}" or (throw "Unknown architecture");
   };
 
+  patches = [
+    # Kibana specifies it specifically needs nodejs 8.11.4 but nodejs in nixpkgs is at 8.12.0.
+    # The <nixpkgs/nixos/tests/elk.nix> test succeeds with this newer version so lets just
+    # disable the version check.
+    ./disable-nodejs-version-check.patch
+  ];
+
   buildInputs = [ makeWrapper ];
 
   installPhase = ''
diff --git a/pkgs/development/tools/misc/kibana/disable-nodejs-version-check.patch b/pkgs/development/tools/misc/kibana/disable-nodejs-version-check.patch
new file mode 100644
index 00000000000..12a81566a72
--- /dev/null
+++ b/pkgs/development/tools/misc/kibana/disable-nodejs-version-check.patch
@@ -0,0 +1,19 @@
+diff -Naur a/src/setup_node_env/node_version_validator.js b/src/setup_node_env/node_version_validator.js
+--- a/src/setup_node_env/node_version_validator.js	2018-11-16 03:28:42.000000000 +0100
++++ b/src/setup_node_env/node_version_validator.js	2018-12-01 12:19:48.238337176 +0100
+@@ -26,7 +26,7 @@
+ var currentVersion = process && process.version || null;
+ var rawRequiredVersion = pkg && pkg.engines && pkg.engines.node || null;
+ var requiredVersion = rawRequiredVersion ? 'v' + rawRequiredVersion : rawRequiredVersion;
+-var isVersionValid = !!currentVersion && !!requiredVersion && currentVersion === requiredVersion;
++var isVersionValid = !!currentVersion && !!requiredVersion;
+ 
+ // Validates current the NodeJS version compatibility when Kibana starts.
+ if (!isVersionValid) {
+@@ -35,4 +35,4 @@
+   // Actions to apply when validation fails: error report + exit.
+   console.error(errorMessage);
+   process.exit(1);
+-}
+\ No newline at end of file
++}
diff --git a/pkgs/development/tools/misc/libtool/default.nix b/pkgs/development/tools/misc/libtool/default.nix
index 23cc2c87a51..f56a59c4270 100644
--- a/pkgs/development/tools/misc/libtool/default.nix
+++ b/pkgs/development/tools/misc/libtool/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
       documentation for details.
     '';
 
-    homepage = http://www.gnu.org/software/libtool/;
+    homepage = https://www.gnu.org/software/libtool/;
 
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/development/tools/misc/libtool/libtool2.nix b/pkgs/development/tools/misc/libtool/libtool2.nix
index bd7f62a7bcd..0fb3dfed744 100644
--- a/pkgs/development/tools/misc/libtool/libtool2.nix
+++ b/pkgs/development/tools/misc/libtool/libtool2.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
       documentation for details.
     '';
 
-    homepage = http://www.gnu.org/software/libtool/;
+    homepage = https://www.gnu.org/software/libtool/;
 
     license = stdenv.lib.licenses.gpl2Plus;
 
diff --git a/pkgs/development/tools/misc/texi2html/default.nix b/pkgs/development/tools/misc/texi2html/default.nix
index 28eb95fd08b..b094f05e951 100644
--- a/pkgs/development/tools/misc/texi2html/default.nix
+++ b/pkgs/development/tools/misc/texi2html/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   meta = { 
     description = "Perl script which converts Texinfo source files to HTML output";
-    homepage = http://www.nongnu.org/texi2html/;
+    homepage = https://www.nongnu.org/texi2html/;
     license = stdenv.lib.licenses.gpl2;
     maintainers = [stdenv.lib.maintainers.marcweber];
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/development/tools/misc/texinfo/common.nix b/pkgs/development/tools/misc/texinfo/common.nix
index 391179e2eb3..613fd2673d5 100644
--- a/pkgs/development/tools/misc/texinfo/common.nix
+++ b/pkgs/development/tools/misc/texinfo/common.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     && !stdenv.isSunOS; # flaky
 
   meta = {
-    homepage = http://www.gnu.org/software/texinfo/;
+    homepage = https://www.gnu.org/software/texinfo/;
     description = "The GNU documentation system";
     license = licenses.gpl3Plus;
     platforms = platforms.all;
diff --git a/pkgs/development/tools/misc/uisp/default.nix b/pkgs/development/tools/misc/uisp/default.nix
index 6e2498bde64..1727f772006 100644
--- a/pkgs/development/tools/misc/uisp/default.nix
+++ b/pkgs/development/tools/misc/uisp/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Tool for AVR microcontrollers which can interface to many hardware in-system programmers";
     license = stdenv.lib.licenses.gpl2;
-    homepage = http://savannah.nongnu.org/projects/uisp;
+    homepage = https://savannah.nongnu.org/projects/uisp;
     platforms = stdenv.lib.platforms.linux;
   };
 }
diff --git a/pkgs/development/tools/parsing/bison/2.x.nix b/pkgs/development/tools/parsing/bison/2.x.nix
index 019c154a6b7..e9aa33d2f60 100644
--- a/pkgs/development/tools/parsing/bison/2.x.nix
+++ b/pkgs/development/tools/parsing/bison/2.x.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   # M4 = "${m4}/bin/m4";
 
   meta = {
-    homepage = http://www.gnu.org/software/bison/;
+    homepage = https://www.gnu.org/software/bison/;
     description = "Yacc-compatible parser generator";
     license = stdenv.lib.licenses.gpl3Plus;
 
diff --git a/pkgs/development/tools/parsing/bison/3.x.nix b/pkgs/development/tools/parsing/bison/3.x.nix
index 2aca4af1dea..42c443a46a8 100644
--- a/pkgs/development/tools/parsing/bison/3.x.nix
+++ b/pkgs/development/tools/parsing/bison/3.x.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   doInstallCheck = false; # fails
 
   meta = {
-    homepage = http://www.gnu.org/software/bison/;
+    homepage = https://www.gnu.org/software/bison/;
     description = "Yacc-compatible parser generator";
     license = stdenv.lib.licenses.gpl3Plus;
 
diff --git a/pkgs/development/tools/pyre/default.nix b/pkgs/development/tools/pyre/default.nix
index 02772f9f791..87066284bfe 100644
--- a/pkgs/development/tools/pyre/default.nix
+++ b/pkgs/development/tools/pyre/default.nix
@@ -3,12 +3,12 @@
 let
   # Manually set version - the setup script requires
   # hg and git + keeping the .git directory around.
-  pyre-version = "0.0.17";  # also change typeshed revision below with $pyre-src/.typeshed-version
+  pyre-version = "0.0.18";  # also change typeshed revision below with $pyre-src/.typeshed-version
   pyre-src = fetchFromGitHub {
     owner = "facebook";
     repo = "pyre-check";
     rev = "v${pyre-version}";
-    sha256 = "0y86a3g5xbgh0byksyx5jw7yq7w840x85dhz9inz6mkg5j06mcis";
+    sha256 = "1sy1lk9j3hq20dabfkr9s4r7prrcndrs345a5iqz6yzvakr4r74d";
   };
   versionFile = writeScript "version.ml" ''
     cat > "./version.ml" <<EOF
@@ -21,6 +21,7 @@ let
     let log_version_banner () =
       Log.info "Running as pid: %d" (Pid.to_int (Unix.getpid ()));
       Log.info "Version: %s" (version ());
+      Log.info "Build info: %s" (build_info ())
     EOF
   '';
  pyre-bin = stdenv.mkDerivation {
@@ -28,8 +29,6 @@ let
 
   src = pyre-src;
 
-  nativeBuildInputs = [ makeWrapper ];
-
   buildInputs = with ocamlPackages; [
     ocaml
     findlib
@@ -45,32 +44,29 @@ let
     # python36Packages.python36Full # TODO
   ];
 
-  buildPhase = ''
+  preBuild = ''
     # build requires HOME to be set
-    export HOME=.
+    export HOME=$TMPDIR
 
     # "external" because https://github.com/facebook/pyre-check/pull/8/files
     sed "s/%VERSION%/external/" dune.in > dune
 
-    cp ${versionFile} ./scripts/generate-version-number.sh
+    ln -sf ${versionFile} ./scripts/generate-version-number.sh
 
     mkdir $(pwd)/build
     export OCAMLFIND_DESTDIR=$(pwd)/build
     export OCAMLPATH=$OCAMLPATH:$(pwd)/build
-
-    make release
   '';
 
-  checkPhase = ''
-    make test
-    # ./scripts/run-python-tests.sh # TODO: once typeshed and python bits are added
-  '';
+  buildFlags = [ "release" ];
+
+  doCheck = true;
+  # ./scripts/run-python-tests.sh # TODO: once typeshed and python bits are added
 
   # Note that we're not installing the typeshed yet.
   # Improvement for a future version.
   installPhase = ''
-    mkdir -p $out/bin
-    cp ./_build/default/main.exe $out/bin/pyre.bin
+    install -D ./_build/default/main.exe $out/bin/pyre.bin
   '';
 
   meta = with stdenv.lib; {
diff --git a/pkgs/development/tools/quilt/default.nix b/pkgs/development/tools/quilt/default.nix
index fe6aeb3fa6e..7986fb2b134 100644
--- a/pkgs/development/tools/quilt/default.nix
+++ b/pkgs/development/tools/quilt/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = http://savannah.nongnu.org/projects/quilt;
+    homepage = https://savannah.nongnu.org/projects/quilt;
     description = "Easily manage large numbers of patches";
 
     longDescription = ''
diff --git a/pkgs/development/tools/rust/rustup/default.nix b/pkgs/development/tools/rust/rustup/default.nix
index fd6dbc7aeaa..7647478b7f4 100644
--- a/pkgs/development/tools/rust/rustup/default.nix
+++ b/pkgs/development/tools/rust/rustup/default.nix
@@ -4,16 +4,16 @@
 
 rustPlatform.buildRustPackage rec {
   name = "rustup-${version}";
-  version = "1.13.0";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
-    owner = "rust-lang-nursery";
+    owner = "rust-lang";
     repo = "rustup.rs";
     rev = version;
-    sha256 = "1h0786jx64nc9q8x6fv7a5sf1xijxhn02m2pq5v2grl9ks0vxidn";
+    sha256 = "12d8z53vixrrbhvadw8fgifik0xi3hyfj1s75my8lcqwmij91gkn";
   };
 
-  cargoSha256 = "09lbm2k189sri3vwcwzv7j07ah39c8ajbpkg0kzvjsjwr7ypli8a";
+  cargoSha256 = "0syp53s285ixshp6yswly0mwkcl0y2ddj5hc110irqsrvwgss32r";
 
   nativeBuildInputs = [ pkgconfig ];
 
diff --git a/pkgs/development/tools/sunxi-tools/default.nix b/pkgs/development/tools/sunxi-tools/default.nix
index 0bddd0d3e17..b3026cdf84d 100644
--- a/pkgs/development/tools/sunxi-tools/default.nix
+++ b/pkgs/development/tools/sunxi-tools/default.nix
@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, pkgconfig, libusb, zlib }:
 
 stdenv.mkDerivation {
-  name = "sunxi-tools-20171130";
+  name = "sunxi-tools-20181113";
 
   src = fetchFromGitHub {
     owner = "linux-sunxi";
     repo = "sunxi-tools";
-    rev = "5c1971040c6c44caefb98e371bfca9e18d511da9";
-    sha256 = "0qzm515i3dfn82a6sf7372080zb02d365z52bh0b1q711r4dvjgp";
+    rev = "6d598a0ed714201380e78130213500be6512942b";
+    sha256 = "1yhl6jfl2cws596ymkyhm8h9qkcvp67v8hlh081lsaqv1i8j9yig";
   };
 
   nativeBuildInputs = [ pkgconfig ];
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
   installTargets = [ "install-tools" "install-misc" ];
 
   meta = with stdenv.lib; {
-    description = "Tools for Allwinner A10 devices";
+    description = "Tools for Allwinner SoC devices";
     homepage = http://linux-sunxi.org/;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index ea764ef22e6..a9c08e1c5b7 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -101,7 +101,7 @@ in
     '';
 
     passthru.updateScript = import ./update.nix {
-      inherit writeScript coreutils gnugrep jq curl common-updater-scripts gnupg nix;
+      inherit stdenv writeScript coreutils gnugrep jq curl common-updater-scripts gnupg nix;
       inherit (stdenv) lib;
       majorVersion = with stdenv.lib; elemAt (splitString "." version) 0;
     };
diff --git a/pkgs/development/web/nodejs/update.nix b/pkgs/development/web/nodejs/update.nix
index 9ff11982b65..bf6951dc688 100644
--- a/pkgs/development/web/nodejs/update.nix
+++ b/pkgs/development/web/nodejs/update.nix
@@ -1,4 +1,5 @@
-{ lib
+{ stdenv
+, lib
 , writeScript
 , coreutils
 , curl
@@ -11,6 +12,7 @@
 }:
 
 writeScript "update-nodejs" ''
+  #!${stdenv.shell}
   PATH=${lib.makeBinPath [ common-updater-scripts coreutils curl gnugrep jq gnupg nix ]}
 
   HOME=`mktemp -d`
diff --git a/pkgs/games/ball-and-paddle/default.nix b/pkgs/games/ball-and-paddle/default.nix
index 1391ca70223..a8b5f9fea4d 100644
--- a/pkgs/games/ball-and-paddle/default.nix
+++ b/pkgs/games/ball-and-paddle/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
 
     license = stdenv.lib.licenses.gpl3Plus;
 
-    homepage = http://www.gnu.org/software/ballandpaddle/;
+    homepage = https://www.gnu.org/software/ballandpaddle/;
 
     maintainers = [ ];
 
diff --git a/pkgs/games/crack-attack/default.nix b/pkgs/games/crack-attack/default.nix
index 838bdfc9e49..bb06bec411b 100644
--- a/pkgs/games/crack-attack/default.nix
+++ b/pkgs/games/crack-attack/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "A fast-paced puzzle game inspired by the classic Super NES title Tetris Attack!";
-    homepage = http://www.nongnu.org/crack-attack/;
+    homepage = https://www.nongnu.org/crack-attack/;
     license = stdenv.lib.licenses.gpl2;
     platforms = stdenv.lib.platforms.linux;
     maintainers = [ stdenv.lib.maintainers.piotr ];
diff --git a/pkgs/games/cuyo/default.nix b/pkgs/games/cuyo/default.nix
index 69c7adfd284..19d857a8e78 100644
--- a/pkgs/games/cuyo/default.nix
+++ b/pkgs/games/cuyo/default.nix
@@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
   version = "2.1.0";
   
   src = fetchurl {
-     url = http://download.savannah.gnu.org/releases/cuyo/cuyo-2.1.0.tar.gz;
+     url = https://download.savannah.gnu.org/releases/cuyo/cuyo-2.1.0.tar.gz;
      sha256 = "17yqv924x7yvwix7yz9jdhgyar8lzdhqvmpvv0any8rdkajhj23c";
      };
 
diff --git a/pkgs/games/gltron/default.nix b/pkgs/games/gltron/default.nix
index 610fba5057d..bd3ae0b2e12 100644
--- a/pkgs/games/gltron/default.nix
+++ b/pkgs/games/gltron/default.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
   patches = [ ./gentoo-prototypes.patch ];
 
   postPatch = ''
-     # Fix http://sourceforge.net/p/gltron/bugs/15
+     # Fix https://sourceforge.net/p/gltron/bugs/15
      sed -i /__USE_MISC/d lua/src/lib/liolib.c
   '';
 
diff --git a/pkgs/games/gnuchess/default.upstream b/pkgs/games/gnuchess/default.upstream
index e1d1d5f2eeb..f19dca51add 100644
--- a/pkgs/games/gnuchess/default.upstream
+++ b/pkgs/games/gnuchess/default.upstream
@@ -1 +1 @@
-url http://ftp.gnu.org/gnu/chess/
+url https://ftp.gnu.org/gnu/chess/
diff --git a/pkgs/games/gnugo/default.nix b/pkgs/games/gnugo/default.nix
index 133a00b67bb..2952edaa78d 100644
--- a/pkgs/games/gnugo/default.nix
+++ b/pkgs/games/gnugo/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "GNU Go - A computer go player";
-    homepage = http://www.gnu.org/software/gnugo/;
+    homepage = https://www.gnu.org/software/gnugo/;
     license = stdenv.lib.licenses.gpl3;
     platforms = stdenv.lib.platforms.unix;
   };
diff --git a/pkgs/games/gtypist/default.nix b/pkgs/games/gtypist/default.nix
index 0f19537c62f..b29b045a421 100644
--- a/pkgs/games/gtypist/default.nix
+++ b/pkgs/games/gtypist/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/gtypist;
+    homepage = https://www.gnu.org/software/gtypist;
     description = "Universal typing tutor";
     license = licenses.gpl3Plus;
     platforms = platforms.linux ++ platforms.darwin;
diff --git a/pkgs/games/liquidwar/5.nix b/pkgs/games/liquidwar/5.nix
index dfb2934cf77..d748c96da24 100644
--- a/pkgs/games/liquidwar/5.nix
+++ b/pkgs/games/liquidwar/5.nix
@@ -3,7 +3,7 @@ stdenv.mkDerivation rec {
   version = "5.6.4";
   name = "liquidwar5-${version}";
   src = fetchurl {
-    url = "http://download.savannah.gnu.org/releases/liquidwar/liquidwar-${version}.tar.gz";
+    url = "https://download.savannah.gnu.org/releases/liquidwar/liquidwar-${version}.tar.gz";
     sha256 = "18wkbfzp07yckg05b5gjy67rw06z9lxp0hzg0zwj7rz8i12jxi9j";
   };
 
diff --git a/pkgs/games/liquidwar/default.nix b/pkgs/games/liquidwar/default.nix
index 1ff1f96b5a2..9a6ff4e0ae8 100644
--- a/pkgs/games/liquidwar/default.nix
+++ b/pkgs/games/liquidwar/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Quick tactics game";
-    homepage = http://www.gnu.org/software/liquidwar6/;
+    homepage = https://www.gnu.org/software/liquidwar6/;
     maintainers = [ maintainers.raskin ];
     license = licenses.gpl3Plus;
     platforms = platforms.linux;
diff --git a/pkgs/games/minecraft/default.nix b/pkgs/games/minecraft/default.nix
index 76edc512b0e..32830d6f3d0 100644
--- a/pkgs/games/minecraft/default.nix
+++ b/pkgs/games/minecraft/default.nix
@@ -1,5 +1,5 @@
 { stdenv, fetchurl, makeDesktopItem, makeWrapper
-, jdk, jre, libpulseaudio
+, jdk, jre, libpulseaudio, libXxf86vm
 }:
 
 let
@@ -13,6 +13,11 @@ let
     categories = "Game;";
   };
 
+  libPath = stdenv.lib.makeLibraryPath [
+    libpulseaudio
+    libXxf86vm # Needed only for versions <1.13
+  ];
+
 in stdenv.mkDerivation {
   name = "minecraft-2015-07-24";
 
@@ -30,7 +35,7 @@ in stdenv.mkDerivation {
 
     makeWrapper ${jre}/bin/java $out/bin/minecraft \
       --add-flags "-jar $out/share/minecraft/minecraft.jar" \
-      --suffix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ libpulseaudio ]}
+      --suffix LD_LIBRARY_PATH : ${libPath}
 
     cp $src $out/share/minecraft/minecraft.jar
     cp -r ${desktopItem}/share/applications $out/share
diff --git a/pkgs/games/quantumminigolf/default.upstream b/pkgs/games/quantumminigolf/default.upstream
index 813c3643a3c..a994bb1a6cb 100644
--- a/pkgs/games/quantumminigolf/default.upstream
+++ b/pkgs/games/quantumminigolf/default.upstream
@@ -1,4 +1,4 @@
-url http://sourceforge.net/projects/quantumminigolf/files/quantumminigolf/
+url https://sourceforge.net/projects/quantumminigolf/files/quantumminigolf/
 SF_version_dir
 version_link '[.]tar[.][^.]+/download$'
 SF_redirect
diff --git a/pkgs/games/soi/default.nix b/pkgs/games/soi/default.nix
index 8d102e98433..7f9f49f363a 100644
--- a/pkgs/games/soi/default.nix
+++ b/pkgs/games/soi/default.nix
@@ -23,6 +23,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux;
     license = licenses.free;
-    downloadPage = http://sourceforge.net/projects/soi/files/;
+    downloadPage = https://sourceforge.net/projects/soi/files/;
   };
 }
diff --git a/pkgs/games/tinyfugue/default.nix b/pkgs/games/tinyfugue/default.nix
index dcae182ed17..f230a70c088 100644
--- a/pkgs/games/tinyfugue/default.nix
+++ b/pkgs/games/tinyfugue/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
       with any type of text MUD.
     '';
     license = licenses.gpl2;
-    platforms = ncurses.meta.platforms;
+    platforms = platforms.linux;
     maintainers = [ maintainers.KibaFox ];
   };
 }
diff --git a/pkgs/games/xboard/default.nix b/pkgs/games/xboard/default.nix
index 442aad46fea..c2c0dc764df 100644
--- a/pkgs/games/xboard/default.nix
+++ b/pkgs/games/xboard/default.nix
@@ -9,12 +9,12 @@ let
     version="4.9.1";
     name="${baseName}-${version}";
     hash="1mkh36xnnacnz9r00b5f9ld9309k32jv6mcavklbdnca8bl56bib";
-    url="http://ftp.gnu.org/gnu/xboard/xboard-4.9.1.tar.gz";
+    url="https://ftp.gnu.org/gnu/xboard/xboard-4.9.1.tar.gz";
     sha256="1mkh36xnnacnz9r00b5f9ld9309k32jv6mcavklbdnca8bl56bib";
   };
   buildInputs = [
-    libX11 xproto libXt libXaw libSM libICE libXmu 
-    libXext gnuchess texinfo libXpm pkgconfig librsvg 
+    libX11 xproto libXt libXaw libSM libICE libXmu
+    libXext gnuchess texinfo libXpm pkgconfig librsvg
     cairo pango gtk2
   ];
 in
@@ -27,6 +27,7 @@ stdenv.mkDerivation {
   meta = {
     inherit (s) version;
     description = ''GUI for chess engines'';
+    homepage = https://www.gnu.org/software/xboard/;
     maintainers = [stdenv.lib.maintainers.raskin];
     platforms = stdenv.lib.platforms.unix;
     license = stdenv.lib.licenses.gpl3Plus;
diff --git a/pkgs/games/xboard/default.upstream b/pkgs/games/xboard/default.upstream
index 1e649bba505..2e5af5d0872 100644
--- a/pkgs/games/xboard/default.upstream
+++ b/pkgs/games/xboard/default.upstream
@@ -1 +1 @@
-url http://ftp.gnu.org/gnu/xboard/
+url https://ftp.gnu.org/gnu/xboard/
diff --git a/pkgs/misc/logging/beats/6.x.nix b/pkgs/misc/logging/beats/6.x.nix
index 59d7379e06c..ce8bf44bfc0 100644
--- a/pkgs/misc/logging/beats/6.x.nix
+++ b/pkgs/misc/logging/beats/6.x.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, elk6Version, buildGoPackage, libpcap }:
+{ stdenv, fetchFromGitHub, elk6Version, buildGoPackage, libpcap, systemd }:
 
 let beat = package : extraArgs : buildGoPackage (rec {
       name = "${package}-${version}";
@@ -8,7 +8,7 @@ let beat = package : extraArgs : buildGoPackage (rec {
         owner = "elastic";
         repo = "beats";
         rev = "v${version}";
-        sha256 = "0ymg6y6v0mdhs1rs11fn33xdp3r6v85563z0f4p7s22j1kd3nd6r";
+        sha256 = "1qnrq9bhk7csgcxycb8c7975lq0p7cxw29i6sji777zv4hn7442m";
       };
 
       goPackagePath = "github.com/elastic/beats";
@@ -39,4 +39,11 @@ in {
       PostgreSQL, Redis or Thrift and correlate the messages into transactions.
     '';
   };
+  journalbeat6  = beat "journalbeat" {
+    meta.description = ''
+      Journalbeat is an open source data collector to read and forward
+      journal entries from Linuxes with systemd.
+    '';
+    buildInputs = [ systemd.dev ];
+  };
 }
diff --git a/pkgs/misc/vscode-extensions/default.nix b/pkgs/misc/vscode-extensions/default.nix
index dd1bb0ad124..59938b76fe0 100644
--- a/pkgs/misc/vscode-extensions/default.nix
+++ b/pkgs/misc/vscode-extensions/default.nix
@@ -26,4 +26,6 @@ rec {
   ms-vscode.cpptools = callPackage ./cpptools {};
 
   ms-python.python = callPackage ./python {};
+
+  WakaTime.vscode-wakatime = callPackage ./wakatime {};
 }
diff --git a/pkgs/misc/vscode-extensions/vscode-utils.nix b/pkgs/misc/vscode-extensions/vscode-utils.nix
index d7ec669204c..82d39dbfec6 100644
--- a/pkgs/misc/vscode-extensions/vscode-utils.nix
+++ b/pkgs/misc/vscode-extensions/vscode-utils.nix
@@ -65,10 +65,10 @@ let
     "sha256"
   ];
 
-  mktplcExtRefToExtDrv = ext: 
-    buildVscodeMarketplaceExtension ((removeAttrs ext mktplcRefAttrList) // { 
-      mktplcRef = ext; 
-    }); 
+  mktplcExtRefToExtDrv = ext:
+    buildVscodeMarketplaceExtension ((removeAttrs ext mktplcRefAttrList) // {
+      mktplcRef = ext;
+    });
 
   extensionFromVscodeMarketplace = mktplcExtRefToExtDrv;
   extensionsFromVscodeMarketplace = mktplcExtRefList:
@@ -77,7 +77,7 @@ let
 in
 
 {
-  inherit fetchVsixFromVscodeMarketplace buildVscodeExtension 
+  inherit fetchVsixFromVscodeMarketplace buildVscodeExtension
           buildVscodeMarketplaceExtension extensionFromVscodeMarketplace
           extensionsFromVscodeMarketplace;
-}
\ No newline at end of file
+}
diff --git a/pkgs/misc/vscode-extensions/wakatime/default.nix b/pkgs/misc/vscode-extensions/wakatime/default.nix
new file mode 100644
index 00000000000..fe7943dbefb
--- /dev/null
+++ b/pkgs/misc/vscode-extensions/wakatime/default.nix
@@ -0,0 +1,30 @@
+{ stdenv, wakatime, vscode-utils }:
+
+let
+  inherit (vscode-utils) buildVscodeMarketplaceExtension;
+in
+  buildVscodeMarketplaceExtension {
+    mktplcRef = {
+      name = "vscode-wakatime";
+      publisher = "WakaTime";
+      version = "1.2.3";
+      sha256 = "1n7bxkwgpip11k6d7zc3ifp9zb6p7f27f4x4g584wisrnfnqj1bp";
+    };
+
+    postPatch = ''
+      mkdir -p out/wakatime-master
+
+      cp -rt out/wakatime-master --no-preserve=all ${wakatime}/lib/python*/site-packages/wakatime
+    '';
+
+    meta = with stdenv.lib; {
+      description = ''
+        Visual Studio Code plugin for automatic time tracking and metrics generated
+        from your programming activity
+      '';
+      license = licenses.bsd3;
+      maintainers = with maintainers; [
+        eadwu
+      ];
+    };
+  }
diff --git a/pkgs/os-specific/linux/apparmor/default.nix b/pkgs/os-specific/linux/apparmor/default.nix
index e632be905fd..851520a93be 100644
--- a/pkgs/os-specific/linux/apparmor/default.nix
+++ b/pkgs/os-specific/linux/apparmor/default.nix
@@ -37,11 +37,6 @@ let
   '';
 
   patches = stdenv.lib.optionals stdenv.hostPlatform.isMusl [
-    (fetchpatch {
-      url = "https://git.alpinelinux.org/cgit/aports/plain/testing/apparmor/0002-Provide-missing-secure_getenv-and-scandirat-function.patch?id=74b8427cc21f04e32030d047ae92caa618105b53";
-      name = "0002-Provide-missing-secure_getenv-and-scandirat-function.patch";
-      sha256 = "0pj1bzifghxwxlc39j8hyy17dkjr9fk64kkj94ayymyprz4i4nac";
-    })
     (fetchpatch {
       url = "https://git.alpinelinux.org/cgit/aports/plain/testing/apparmor/0003-Added-missing-typedef-definitions-on-parser.patch?id=74b8427cc21f04e32030d047ae92caa618105b53";
       name = "0003-Added-missing-typedef-definitions-on-parser.patch";
diff --git a/pkgs/os-specific/linux/conspy/default.upstream b/pkgs/os-specific/linux/conspy/default.upstream
index 3eeacf34694..3f9ff3e4a82 100644
--- a/pkgs/os-specific/linux/conspy/default.upstream
+++ b/pkgs/os-specific/linux/conspy/default.upstream
@@ -1,4 +1,4 @@
-url http://sourceforge.net/projects/conspy/files/
+url https://sourceforge.net/projects/conspy/files/
 version_link 'conspy-[-0-9.]+/$'
 version_link '[-0-9.]+[.]tar[.][a-z0-9]+/download$'
 SF_redirect
diff --git a/pkgs/os-specific/linux/dmidecode/default.nix b/pkgs/os-specific/linux/dmidecode/default.nix
index 49163cc8b79..a4ec902f762 100644
--- a/pkgs/os-specific/linux/dmidecode/default.nix
+++ b/pkgs/os-specific/linux/dmidecode/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   makeFlags = "prefix=$(out)";
 
   meta = with stdenv.lib; {
-    homepage = http://www.nongnu.org/dmidecode/;
+    homepage = https://www.nongnu.org/dmidecode/;
     description = "A tool that reads information about your system's hardware from the BIOS according to the SMBIOS/DMI standard";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
diff --git a/pkgs/os-specific/linux/kernel/linux-4.14.nix b/pkgs/os-specific/linux/kernel/linux-4.14.nix
index 6254ed7fac0..008c23ee9af 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.84";
+  version = "4.14.85";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0653fg6p0wg81i4mj8n4lghn8h8jx3pkbyp6sm22p2b1rwpgj893";
+    sha256 = "1kpgdwf8rcw913dfgj9c6wcvc4z54m756s2fplczm86v2gs186g4";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.18.nix b/pkgs/os-specific/linux/kernel/linux-4.18.nix
deleted file mode 100644
index fa9338fd800..00000000000
--- a/pkgs/os-specific/linux/kernel/linux-4.18.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{ stdenv, buildPackages, fetchurl, perl, buildLinux, modDirVersionArg ? null, ... } @ args:
-
-with stdenv.lib;
-
-buildLinux (args // rec {
-  version = "4.18.20";
-
-  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
-  modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
-
-  # branchVersion needs to be x.y
-  extraMeta.branch = concatStrings (intersperse "." (take 2 (splitString "." version)));
-
-  src = fetchurl {
-    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0lzn2w8zagqk3sp6jsp155xggm1c277xjh8m0nvddvdp1yg33b38";
-  };
-} // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.19.nix b/pkgs/os-specific/linux/kernel/linux-4.19.nix
index 54b03fc88be..ccdb95b1411 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.5";
+  version = "4.19.6";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStrings (intersperse "." (take 3 (splitString "." "${version}.0"))) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0xggarlff54l9zxm5qr14nzd514xxg8i1akyxzlb0znfkk19x0wc";
+    sha256 = "1hq9iyx2k6ff6yxsgkd4xvk5al3jw5nxk49zq72w04b2nsz62kk4";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.4.nix b/pkgs/os-specific/linux/kernel/linux-4.4.nix
index 01bcc6f2525..a32424565d3 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.4.165";
+  version = "4.4.166";
   extraMeta.branch = "4.4";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "19zmigb1avq63n0cbvsqaw9ygddwx13mrvl80p92abw7ns26b2va";
+    sha256 = "0nj1wvsf1c843hp9ww68gpwsjdviax67dpffafsq78ask7yyy45z";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-4.9.nix b/pkgs/os-specific/linux/kernel/linux-4.9.nix
index 2fc57a104ea..01328250186 100644
--- a/pkgs/os-specific/linux/kernel/linux-4.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.9.nix
@@ -1,11 +1,11 @@
 { stdenv, buildPackages, fetchurl, perl, buildLinux, ... } @ args:
 
 buildLinux (args // rec {
-  version = "4.9.141";
+  version = "4.9.142";
   extraMeta.branch = "4.9";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "09mc5sxzzxmks20vslimaaaw0aamjcc3lvpyjydmr78s25q5zfsp";
+    sha256 = "01n4v0gpf8xyz8hzc70mhjha7kanz9pv248ypsmab7zpzgd7wjil";
   };
 } // (args.argsOverride or {}))
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 31cad258921..c240bdc364d 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/tags/";
-    rev = "15295";
-    sha256 = "03kqbjy7w9zg6ry86h9sxa33z0rblznhba109lwmjwy0wx7yk1cs";
+    rev = "15715";
+    sha256 = "1mz1xv860ddxz7dfp4l6q25hlsh532aapvylq703jskgbzsfinxh";
   }
 , ...
 }:
diff --git a/pkgs/os-specific/linux/kmod/darwin.patch b/pkgs/os-specific/linux/kmod/darwin.patch
new file mode 100644
index 00000000000..69dbf479f9f
--- /dev/null
+++ b/pkgs/os-specific/linux/kmod/darwin.patch
@@ -0,0 +1,123 @@
+diff --git a/Makefile.am b/Makefile.am
+index 194e111..0a095b5 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -80,8 +80,7 @@ EXTRA_DIST += libkmod/README \
+ 	libkmod/COPYING testsuite/COPYING tools/COPYING COPYING
+ 
+ libkmod_libkmod_la_LDFLAGS = $(AM_LDFLAGS) \
+-	-version-info $(LIBKMOD_CURRENT):$(LIBKMOD_REVISION):$(LIBKMOD_AGE) \
+-	-Wl,--version-script=$(top_srcdir)/libkmod/libkmod.sym
++	-version-info $(LIBKMOD_CURRENT):$(LIBKMOD_REVISION):$(LIBKMOD_AGE)
+ libkmod_libkmod_la_DEPENDENCIES = \
+ 	shared/libshared.la \
+ 	${top_srcdir}/libkmod/libkmod.sym
+@@ -91,8 +90,7 @@ libkmod_libkmod_la_LIBADD = \
+ 
+ noinst_LTLIBRARIES += libkmod/libkmod-internal.la
+ libkmod_libkmod_internal_la_SOURCES = $(libkmod_libkmod_la_SOURCES)
+-libkmod_libkmod_internal_la_LDFLAGS = $(AM_LDFLAGS) \
+-	-Wl,--version-script=$(top_srcdir)/libkmod/libkmod.sym
++libkmod_libkmod_internal_la_LDFLAGS = $(AM_LDFLAGS)
+ libkmod_libkmod_internal_la_DEPENDENCIES  = $(libkmod_libkmod_la_DEPENDENCIES)
+ libkmod_libkmod_internal_la_LIBADD = $(libkmod_libkmod_la_LIBADD)
+ 
+diff --git a/libkmod/libkmod-module.c b/libkmod/libkmod-module.c
+index 889f264..6f0a285 100644
+--- a/libkmod/libkmod-module.c
++++ b/libkmod/libkmod-module.c
+@@ -787,7 +787,11 @@ KMOD_EXPORT int kmod_module_remove_module(struct kmod_module *mod,
+ 	flags &= KMOD_REMOVE_FORCE;
+ 	flags |= KMOD_REMOVE_NOWAIT;
+ 
++#if defined(__linux__)
+ 	err = delete_module(mod->name, flags);
++#else
++	err = -1;
++#endif
+ 	if (err != 0) {
+ 		err = -errno;
+ 		ERR(mod->ctx, "could not remove '%s': %m\n", mod->name);
+@@ -879,7 +883,11 @@ KMOD_EXPORT int kmod_module_insert_module(struct kmod_module *mod,
+ 	}
+ 	size = kmod_file_get_size(mod->file);
+ 
++#if defined(__linux__)
+ 	err = init_module(mem, size, args);
++#else
++	err = -1;
++#endif
+ init_finished:
+ 	if (err < 0) {
+ 		err = -errno;
+diff --git a/libkmod/libkmod-signature.c b/libkmod/libkmod-signature.c
+index 429ffbd..17a3b9c 100644
+--- a/libkmod/libkmod-signature.c
++++ b/libkmod/libkmod-signature.c
+@@ -17,7 +17,10 @@
+  * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+  */
+ 
++#if defined(__linux__)
+ #include <endian.h>
++#endif
++
+ #include <inttypes.h>
+ #include <stdio.h>
+ #include <stdlib.h>
+diff --git a/shared/macro.h b/shared/macro.h
+index 4fc5405..b5a2702 100644
+--- a/shared/macro.h
++++ b/shared/macro.h
+@@ -71,3 +71,7 @@
+ #endif
+ 
+ #define UNIQ __COUNTER__
++
++ #if !defined(__linux__)
++#define program_invocation_short_name getprogname()
++#endif
+diff --git a/shared/missing.h b/shared/missing.h
+index 4c0d136..ad8ec0f 100644
+--- a/shared/missing.h
++++ b/shared/missing.h
+@@ -45,6 +45,9 @@ static inline int finit_module(int fd, const char *uargs, int flags)
+ #endif
+ 
+ #if !HAVE_DECL_BE32TOH
++
++#if defined(__linux__)
++
+ #include <endian.h>
+ #include <byteswap.h>
+ #if __BYTE_ORDER == __LITTLE_ENDIAN
+@@ -52,4 +55,16 @@ static inline int finit_module(int fd, const char *uargs, int flags)
+ #else
+ #define be32toh(x) (x)
+ #endif
++
++#elif defined(__APPLE__)
++
++#include <libkern/OSByteOrder.h>
++#define be32toh(x) OSSwapBigToHostInt32(x)
++
++#else
++
++#error No be32toh known for platform
++
++#endif
++
+ #endif
+diff --git a/shared/util.c b/shared/util.c
+index fd2028d..ecb0141 100644
+--- a/shared/util.c
++++ b/shared/util.c
+@@ -367,7 +367,7 @@ char *path_make_absolute_cwd(const char *p)
+ 	if (path_is_absolute(p))
+ 		return strdup(p);
+ 
+-	cwd = get_current_dir_name();
++	cwd = getcwd(NULL, 0);
+ 	if (!cwd)
+ 		return NULL;
+ 
diff --git a/pkgs/os-specific/linux/kmod/default.nix b/pkgs/os-specific/linux/kmod/default.nix
index 43d69ac9574..8a09d7fea09 100644
--- a/pkgs/os-specific/linux/kmod/default.nix
+++ b/pkgs/os-specific/linux/kmod/default.nix
@@ -1,4 +1,5 @@
-{ stdenv, buildPackages, lib, fetchurl, autoreconfHook, pkgconfig, libxslt, xz }:
+{ stdenv, buildPackages, lib, fetchurl, autoreconfHook, pkgconfig
+, libxslt, xz, elf-header }:
 
 let
   systems = [ "/run/current-system/kernel-modules" "/run/booted-system/kernel-modules" "" ];
@@ -14,7 +15,7 @@ in stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ autoreconfHook pkgconfig libxslt ];
-  buildInputs = [ xz ];
+  buildInputs = [ xz ] ++ lib.optional stdenv.isDarwin elf-header;
 
   configureFlags = [
     "--sysconfdir=/etc"
@@ -22,7 +23,8 @@ in stdenv.mkDerivation rec {
     "--with-modulesdirs=${modulesDirs}"
   ];
 
-  patches = [ ./module-dir.patch ];
+  patches = [ ./module-dir.patch ]
+    ++ lib.optional stdenv.isDarwin ./darwin.patch;
 
   postInstall = ''
     for prog in rmmod insmod lsmod modinfo modprobe depmod; do
@@ -37,6 +39,6 @@ in stdenv.mkDerivation rec {
     homepage = https://www.kernel.org/pub/linux/utils/kernel/kmod/;
     description = "Tools for loading and managing Linux kernel modules";
     license = licenses.lgpl21;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }
diff --git a/pkgs/os-specific/linux/lm-sensors/default.nix b/pkgs/os-specific/linux/lm-sensors/default.nix
index 04ce60c87b0..0536ba064a3 100644
--- a/pkgs/os-specific/linux/lm-sensors/default.nix
+++ b/pkgs/os-specific/linux/lm-sensors/default.nix
@@ -1,28 +1,22 @@
-{ sensord ? false,
-  stdenv, fetchurl, bison, flex, which, perl,
-  rrdtool ? null
+{ stdenv, fetchzip, bison, flex, which, perl
+, sensord ? false, rrdtool ? null
 }:
 
 assert sensord -> rrdtool != null;
 
 stdenv.mkDerivation rec {
   name = "lm-sensors-${version}";
-  version = "3.4.0"; # don't forget to tweak fedoraproject mirror URL hash
+  version = "3.5.0";
 
-  src = fetchurl {
-    urls = [
-      # "http://dl.lm-sensors.org/lm-sensors/releases/lm_sensors-${version}.tar.bz2" # dead
-      # https://github.com/lm-sensors/lm-sensors/releases/... # only generated tarballs
-      "https://src.fedoraproject.org/repo/pkgs/lm_sensors/lm_sensors-${version}.tar.bz2/c03675ae9d43d60322110c679416901a/lm_sensors-${version}.tar.bz2"
-    ];
-    sha256 = "07q6811l4pp0f7pxr8bk3s97ippb84mx5qdg7v92s9hs10b90mz0";
+  src = fetchzip {
+    url = "https://github.com/lm-sensors/lm-sensors/archive/V${stdenv.lib.replaceStrings ["."] ["-"] version}.tar.gz";
+    sha256 = "1mdrnb9r01z1xfdm6dpkywvf9yy9a4yzb59paih9sijwmigv19fj";
   };
 
-  buildInputs = [ bison flex which perl ]
+  nativeBuildInputs = [ bison flex which ];
+  buildInputs = [ perl ]
    ++ stdenv.lib.optional sensord rrdtool;
 
-  patches = [ ./musl-fix-includes.patch ];
-
   preBuild = ''
     makeFlagsArray=(PREFIX=$out ETCDIR=$out/etc
     ${stdenv.lib.optionalString sensord "PROG_EXTRA=sensord"})
@@ -31,7 +25,7 @@ stdenv.mkDerivation rec {
   meta = with stdenv.lib; {
     homepage = https://hwmon.wiki.kernel.org/lm_sensors;
     description = "Tools for reading hardware sensors";
-    license = with licenses; [ gpl2 lgpl21 ];
+    license = with licenses; [ gpl2Plus lgpl21Plus ];
     platforms = platforms.linux;
   };
 }
diff --git a/pkgs/os-specific/linux/lm-sensors/musl-fix-includes.patch b/pkgs/os-specific/linux/lm-sensors/musl-fix-includes.patch
deleted file mode 100644
index 501f2dd762c..00000000000
--- a/pkgs/os-specific/linux/lm-sensors/musl-fix-includes.patch
+++ /dev/null
@@ -1,62 +0,0 @@
---- lm_sensors-3.3.4.orig/prog/dump/isadump.c
-+++ lm_sensors-3.3.4/prog/dump/isadump.c
-@@ -36,13 +36,7 @@
- #include "util.h"
- #include "superio.h"
- 
--
--/* To keep glibc2 happy */
--#if defined(__GLIBC__) && __GLIBC__ == 2 && __GLIBC_MINOR__ >= 0
- #include <sys/io.h>
--#else
--#include <asm/io.h>
--#endif
- 
- #ifdef __powerpc__
- unsigned long isa_io_base = 0; /* XXX for now */
---- lm_sensors-3.3.4.orig/prog/dump/isaset.c
-+++ lm_sensors-3.3.4/prog/dump/isaset.c
-@@ -32,13 +32,7 @@
- #include <string.h>
- #include "util.h"
- 
--
--/* To keep glibc2 happy */
--#if defined(__GLIBC__) && __GLIBC__ == 2 && __GLIBC_MINOR__ >= 0
- #include <sys/io.h>
--#else
--#include <asm/io.h>
--#endif
- 
- #ifdef __powerpc__
- unsigned long isa_io_base = 0; /* XXX for now */
---- lm_sensors-3.3.4.orig/prog/dump/superio.c
-+++ lm_sensors-3.3.4/prog/dump/superio.c
-@@ -20,12 +20,7 @@
- */
- 
- #include <stdlib.h>
--
--#if defined(__GLIBC__) && __GLIBC__ == 2 && __GLIBC_MINOR__ >= 0
- #include <sys/io.h>
--#else
--#include <asm/io.h>
--#endif
- 
- #include "superio.h"
- 
---- lm_sensors-3.3.4.orig/prog/dump/util.c
-+++ lm_sensors-3.3.4/prog/dump/util.c
-@@ -11,12 +11,7 @@
- #include <stdio.h>
- #include "util.h"
- 
--/* To keep glibc2 happy */
--#if defined(__GLIBC__) && __GLIBC__ == 2 && __GLIBC_MINOR__ >= 0
- #include <sys/io.h>
--#else
--#include <asm/io.h>
--#endif
- 
- /* Return 1 if we should continue, 0 if we should abort */
- int user_ack(int def)
diff --git a/pkgs/os-specific/linux/nvidia-x11/default.nix b/pkgs/os-specific/linux/nvidia-x11/default.nix
index 49f1500f206..016d03a61f8 100644
--- a/pkgs/os-specific/linux/nvidia-x11/default.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/default.nix
@@ -75,5 +75,6 @@ rec {
         '';
     in applyPatches [ "fix-typos" ];
     patches = maybePatch_drm_legacy;
+    broken = stdenv.lib.versionAtLeast kernel.version "4.18";
   };
 }
diff --git a/pkgs/os-specific/linux/nvidia-x11/generic.nix b/pkgs/os-specific/linux/nvidia-x11/generic.nix
index a40a6434493..be378d66caf 100644
--- a/pkgs/os-specific/linux/nvidia-x11/generic.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/generic.nix
@@ -10,6 +10,7 @@
 
 , prePatch ? ""
 , patches ? []
+, broken ? false
 }:
 
 { stdenv, callPackage, pkgsi686Linux, fetchurl
@@ -91,6 +92,7 @@ let
       platforms = [ "i686-linux" "x86_64-linux" ];
       maintainers = [ maintainers.vcunat ];
       priority = 4; # resolves collision with xorg-server's "lib/xorg/modules/extensions/libglx.so"
+      inherit broken;
     };
   };
 
diff --git a/pkgs/os-specific/linux/sysvinit/default.nix b/pkgs/os-specific/linux/sysvinit/default.nix
index 2e8cf0125e5..7f84e1cc9b4 100644
--- a/pkgs/os-specific/linux/sysvinit/default.nix
+++ b/pkgs/os-specific/linux/sysvinit/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
     '';
 
   meta = {
-    homepage = http://www.nongnu.org/sysvinit/;
+    homepage = https://www.nongnu.org/sysvinit/;
     description = "Utilities related to booting and shutdown";
     platforms = stdenv.lib.platforms.linux;
     license = stdenv.lib.licenses.gpl2Plus;
diff --git a/pkgs/os-specific/linux/tp_smapi/default.nix b/pkgs/os-specific/linux/tp_smapi/default.nix
index 25eeb889cc2..89c6639748d 100644
--- a/pkgs/os-specific/linux/tp_smapi/default.nix
+++ b/pkgs/os-specific/linux/tp_smapi/default.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   passthru.updateScript = import ./update.nix {
-    inherit lib writeScript coreutils gnugrep jq curl common-updater-scripts;
+    inherit stdenv lib writeScript coreutils gnugrep jq curl common-updater-scripts;
   };
 
   meta = {
diff --git a/pkgs/os-specific/linux/tp_smapi/update.nix b/pkgs/os-specific/linux/tp_smapi/update.nix
index 94eb44b744c..1b6dfd90b1e 100644
--- a/pkgs/os-specific/linux/tp_smapi/update.nix
+++ b/pkgs/os-specific/linux/tp_smapi/update.nix
@@ -1,6 +1,7 @@
-{ lib, writeScript, coreutils, curl, gnugrep, jq, common-updater-scripts }:
+{ stdenv, lib, writeScript, coreutils, curl, gnugrep, jq, common-updater-scripts }:
 
 writeScript "update-tp_smapi" ''
+#!${stdenv.shell}
 PATH=${lib.makeBinPath [ common-updater-scripts coreutils curl gnugrep jq ]}
 
 tags=`curl -s https://api.github.com/repos/evgeni/tp_smapi/tags`
diff --git a/pkgs/os-specific/linux/usbutils/default.nix b/pkgs/os-specific/linux/usbutils/default.nix
index 8d53756d510..d58c5a7e67c 100644
--- a/pkgs/os-specific/linux/usbutils/default.nix
+++ b/pkgs/os-specific/linux/usbutils/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libusb1, hwdata }:
+{ stdenv, fetchurl, substituteAll, autoreconfHook, pkgconfig, libusb1, hwdata }:
 
 stdenv.mkDerivation rec {
   name = "usbutils-010";
@@ -8,14 +8,15 @@ stdenv.mkDerivation rec {
     sha256 = "06aag4jfgsfjxk563xsp9ik9nadihmasrr37a1gb0vwqni5kdiv1";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ libusb1 ];
+  patches = [
+    (substituteAll {
+      src = ./fix-paths.patch;
+      inherit hwdata;
+    })
+  ];
 
-  postInstall =
-    ''
-      substituteInPlace $out/bin/lsusb.py \
-        --replace /usr/share/usb.ids ${hwdata}/share/hwdata/usb.ids
-    '';
+  nativeBuildInputs = [ autoreconfHook pkgconfig ];
+  buildInputs = [ libusb1 ];
 
   meta = with stdenv.lib; {
     homepage = http://www.linux-usb.org/;
diff --git a/pkgs/os-specific/linux/usbutils/fix-paths.patch b/pkgs/os-specific/linux/usbutils/fix-paths.patch
new file mode 100644
index 00000000000..d75c68505ef
--- /dev/null
+++ b/pkgs/os-specific/linux/usbutils/fix-paths.patch
@@ -0,0 +1,16 @@
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -51,11 +51,11 @@
+ 	usbreset.c
+ 
+ lsusb.py: $(srcdir)/lsusb.py.in
+-	sed 's|VERSION|$(VERSION)|g;s|@usbids@|$(datadir)/usb.ids|g' $< >$@
++	sed 's|VERSION|$(VERSION)|g;s|@usbids@|@hwdata@/share/hwdata/usb.ids|g' $< >$@
+ 	chmod 755 $@
+ 
+ lsusb.8: $(srcdir)/lsusb.8.in
+-	sed 's|VERSION|$(VERSION)|g;s|@usbids@|$(datadir)/usb.ids|g' $< >$@
++	sed 's|VERSION|$(VERSION)|g;s|@usbids@|@hwdata@/share/hwdata/usb.ids|g' $< >$@
+ 
+ usb-devices.1: $(srcdir)/usb-devices.1.in
+ 	sed 's|VERSION|$(VERSION)|g' $< >$@
diff --git a/pkgs/servers/dico/default.nix b/pkgs/servers/dico/default.nix
index 0e4c392c7a3..d64f5915881 100644
--- a/pkgs/servers/dico/default.nix
+++ b/pkgs/servers/dico/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Flexible dictionary server and client implementing RFC 2229";
-    homepage    = http://www.gnu.org/software/dico/;
+    homepage    = https://www.gnu.org/software/dico/;
     license     = licenses.gpl3Plus;
     maintainers = with maintainers; [ lovek323 ];
     platforms   = platforms.linux;
diff --git a/pkgs/servers/dict/dictd-db.nix b/pkgs/servers/dict/dictd-db.nix
index 70cd362c5ea..065218a5b95 100644
--- a/pkgs/servers/dict/dictd-db.nix
+++ b/pkgs/servers/dict/dictd-db.nix
@@ -29,15 +29,15 @@ let
    };
 in rec {
   deu2eng = makeDictdDBFreedict (fetchurl {
-    url = http://prdownloads.sourceforge.net/freedict/deu-eng.tar.gz;
+    url = mirror://sourceforge/freedict/deu-eng.tar.gz;
     sha256 = "0dqrhv04g4f5s84nbgisgcfwk5x0rpincif0yfhfh4sc1bsvzsrb";
   }) "deu-eng" "de_DE";
   eng2deu = makeDictdDBFreedict (fetchurl {
-    url = http://prdownloads.sourceforge.net/freedict/eng-deu.tar.gz;
+    url = mirror://sourceforge/freedict/eng-deu.tar.gz;
     sha256 = "01x12p72sa3071iff3jhzga8588440f07zr56r3x98bspvdlz73r";
   }) "eng-deu" "en_EN";
   nld2eng = makeDictdDBFreedict (fetchurl {
-    url = http://prdownloads.sourceforge.net/freedict/nld-eng.tar.gz;
+    url = mirror://sourceforge/freedict/nld-eng.tar.gz;
     sha256 = "1vhw81pphb64fzsjvpzsnnyr34ka2fxizfwilnxyjcmpn9360h07";
   }) "nld-eng" "nl_NL";
   eng2nld =  makeDictdDBFreedict (fetchurl {
diff --git a/pkgs/servers/http/myserver/default.nix b/pkgs/servers/http/myserver/default.nix
index b4ed3324491..b18e1ea162f 100644
--- a/pkgs/servers/http/myserver/default.nix
+++ b/pkgs/servers/http/myserver/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
       built-in features.  Share your files in minutes!
     '';
 
-    homepage = http://www.gnu.org/software/myserver/;
+    homepage = https://www.gnu.org/software/myserver/;
 
     license = lib.licenses.gpl3Plus;
 
diff --git a/pkgs/servers/mail/mailman/default.nix b/pkgs/servers/mail/mailman/default.nix
index 87e0d219c9c..91445afa97d 100644
--- a/pkgs/servers/mail/mailman/default.nix
+++ b/pkgs/servers/mail/mailman/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   makeFlags = [ "DIRSETGID=:" ];
 
   meta = {
-    homepage = http://www.gnu.org/software/mailman/;
+    homepage = https://www.gnu.org/software/mailman/;
     description = "Free software for managing electronic mail discussion and e-newsletter lists";
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/servers/mail/postfix/default.nix b/pkgs/servers/mail/postfix/default.nix
index 796d5696ebf..e2a78477bb6 100644
--- a/pkgs/servers/mail/postfix/default.nix
+++ b/pkgs/servers/mail/postfix/default.nix
@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, makeWrapper, gnused, db, openssl, cyrus_sasl, libnsl
-, coreutils, findutils, gnugrep, gawk, icu, pcre
+, coreutils, findutils, gnugrep, gawk, icu, pcre, m4
 , withLDAP ? true, openldap
 , withPgSQL ? false, postgresql
 , withMySQL ? false, mysql
@@ -25,14 +25,14 @@ in stdenv.mkDerivation rec {
 
   name = "postfix-${version}";
 
-  version = "3.3.1";
+  version = "3.3.2";
 
   src = fetchurl {
     url = "ftp://ftp.cs.uu.nl/mirror/postfix/postfix-release/official/${name}.tar.gz";
-    sha256 = "0fvymsklp32njsv0ngc1f45j01kcy61r5in99g5palibwkd19xal";
+    sha256 = "0nxkszdgs6fs86j6w1lf3vhxvjh1hw2jmrii5icqx9a9xqgg74rw";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper m4 ];
   buildInputs = [ db openssl cyrus_sasl icu libnsl pcre ]
                 ++ lib.optional withPgSQL postgresql
                 ++ lib.optional withMySQL mysql.connector-c
diff --git a/pkgs/servers/mail/rspamd/default.nix b/pkgs/servers/mail/rspamd/default.nix
index b9dd07adde9..c5dfc4a90fd 100644
--- a/pkgs/servers/mail/rspamd/default.nix
+++ b/pkgs/servers/mail/rspamd/default.nix
@@ -1,22 +1,34 @@
-{ stdenv, fetchFromGitHub, cmake, perl
-, file, glib, gmime, libevent, luajit, openssl, pcre, pkgconfig, sqlite, ragel, icu, libfann }:
+{ stdenv, lib, fetchFromGitHub, cmake, perl
+, file, glib, libevent, luajit, openssl, pcre, pkgconfig, sqlite, ragel, icu
+, hyperscan, libfann, gd, jemalloc, openblas
+, withFann ? true
+, withGd ? false
+, withBlas ? true
+, withHyperscan ? stdenv.isx86_64
+}:
+
+assert withHyperscan -> stdenv.isx86_64;
 
 let libmagic = file;  # libmagic provided by file package ATM
 in
 
 stdenv.mkDerivation rec {
   name = "rspamd-${version}";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
-    owner = "vstakhov";
+    owner = "rspamd";
     repo = "rspamd";
     rev = version;
-    sha256 = "1cgnychv8yz7a6mjg3b12nzs4gl0xqg9agl7m6faihnh7gqx4xld";
+    sha256 = "0al4d8h3ssxcx191d4crywz7dsp61lklc9m5z36a90a8w97v76bv";
   };
 
   nativeBuildInputs = [ cmake pkgconfig perl ];
-  buildInputs = [ glib gmime libevent libmagic luajit openssl pcre sqlite ragel icu libfann ];
+  buildInputs = [ glib libevent libmagic luajit openssl pcre sqlite ragel icu jemalloc ]
+    ++ lib.optional withFann libfann
+    ++ lib.optional withGd gd
+    ++ lib.optional withHyperscan hyperscan
+    ++ lib.optional withBlas openblas;
 
   cmakeFlags = [
     "-DDEBIAN_BUILD=ON"
@@ -24,10 +36,13 @@ stdenv.mkDerivation rec {
     "-DDBDIR=/var/lib/rspamd"
     "-DLOGDIR=/var/log/rspamd"
     "-DLOCAL_CONFDIR=/etc/rspamd"
-  ];
+    "-DENABLE_JEMALLOC=ON"
+  ] ++ lib.optional withFann "-DENABLE_FANN=ON"
+    ++ lib.optional withHyperscan "-DENABLE_HYPERSCAN=ON"
+    ++ lib.optional withGd "-DENABLE_GD=ON";
 
   meta = with stdenv.lib; {
-    homepage = https://github.com/vstakhov/rspamd;
+    homepage = https://rspamd.com;
     license = licenses.asl20;
     description = "Advanced spam filtering system";
     maintainers = with maintainers; [ avnik fpletz ];
diff --git a/pkgs/servers/mpd/default.nix b/pkgs/servers/mpd/default.nix
index 500f612eb02..740fd4739ab 100644
--- a/pkgs/servers/mpd/default.nix
+++ b/pkgs/servers/mpd/default.nix
@@ -36,7 +36,7 @@ let
   opt = stdenv.lib.optional;
   mkFlag = c: f: if c then "--enable-${f}" else "--disable-${f}";
   major = "0.20";
-  minor = "21";
+  minor = "23";
 
 in stdenv.mkDerivation rec {
   name = "mpd-${version}";
@@ -46,7 +46,7 @@ in stdenv.mkDerivation rec {
     owner  = "MusicPlayerDaemon";
     repo   = "MPD";
     rev    = "v${version}";
-    sha256 = "0qchvycwiai5gwkvvf44nc1jw16yhpcjmlppqlrlvicgzsanhmy3";
+    sha256 = "1z1pdgiddimnmck0ardrpxkvgk1wn9zxri5wfv5ppasbb7kfm350";
   };
 
   patches = [ ./x86.patch ];
diff --git a/pkgs/servers/p910nd/default.nix b/pkgs/servers/p910nd/default.nix
index bcf1255ff4a..1f58c309aa5 100644
--- a/pkgs/servers/p910nd/default.nix
+++ b/pkgs/servers/p910nd/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
       this protocol and the syntax is lp=remotehost%9100 in /etc/printcap.
     '';
     homepage = http://p910nd.sourceforge.net/;
-    downloadPage = http://sourceforge.net/projects/p910nd/;
+    downloadPage = https://sourceforge.net/projects/p910nd/;
     license = licenses.gpl2;
     platforms = platforms.linux;
   };
diff --git a/pkgs/servers/pies/default.nix b/pkgs/servers/pies/default.nix
index 73af60e55c4..a113d583cb1 100644
--- a/pkgs/servers/pies/default.nix
+++ b/pkgs/servers/pies/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
 
     license = stdenv.lib.licenses.gpl3Plus;
 
-    homepage = http://www.gnu.org/software/pies/;
+    homepage = https://www.gnu.org/software/pies/;
 
     platforms = stdenv.lib.platforms.gnu ++ stdenv.lib.platforms.linux;
     maintainers = [ ];
diff --git a/pkgs/servers/quagga/default.nix b/pkgs/servers/quagga/default.nix
index c6f150938ac..1d8f0c36cae 100644
--- a/pkgs/servers/quagga/default.nix
+++ b/pkgs/servers/quagga/default.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
       It is more than a routed replacement, it can be used as a Route Server and
       a Route Reflector.
     '';
-    homepage = http://www.nongnu.org/quagga/;
+    homepage = https://www.nongnu.org/quagga/;
     license = licenses.gpl2;
     platforms = platforms.unix;
     maintainers = with maintainers; [ tavyc ];
diff --git a/pkgs/servers/search/elasticsearch/default.nix b/pkgs/servers/search/elasticsearch/default.nix
index 5a43a30257e..d22395e0133 100644
--- a/pkgs/servers/search/elasticsearch/default.nix
+++ b/pkgs/servers/search/elasticsearch/default.nix
@@ -19,14 +19,20 @@ stdenv.mkDerivation (rec {
     url = "https://artifacts.elastic.co/downloads/elasticsearch/${name}.tar.gz";
     sha256 =
       if enableUnfree
-      then "0960ak602pm95p2mha9cb1mrwdky8pfw3y89r2v4zpr5n730hmnh"
-      else "1i4i1ai75bf8k0zd1qf8x0bavrm8rcw13xdim443zza09w95ypk4";
+      then "096i8xiy7mfwlslym9mkjb2f5vqdcqhk65583526rcybqxc2zkqp"
+      else "0j3q02c4rw8272w07hm64sk5ssmj4gj8s3qigsbrq5pgf8b03fvs";
   };
 
   patches = [ ./es-home-6.x.patch ];
 
   postPatch = ''
-    sed -i "s|ES_CLASSPATH=\"\$ES_HOME/lib/\*\"|ES_CLASSPATH=\"$out/lib/*\"|" ./bin/elasticsearch-env
+    substituteInPlace bin/elasticsearch-env --replace \
+      "ES_CLASSPATH=\"\$ES_HOME/lib/\*\"" \
+      "ES_CLASSPATH=\"$out/lib/*\""
+
+    substituteInPlace bin/elasticsearch-cli --replace \
+      "ES_CLASSPATH=\"\$ES_CLASSPATH:\$ES_HOME/\$additional_classpath_directory/\*\"" \
+      "ES_CLASSPATH=\"\$ES_CLASSPATH:$out/\$additional_classpath_directory/\*\""
   '';
 
   buildInputs = [ makeWrapper jre_headless utillinux ]
@@ -58,7 +64,7 @@ stdenv.mkDerivation (rec {
   nativeBuildInputs = [ autoPatchelfHook ];
   runtimeDependencies = [ zlib ];
   postFixup = ''
-    for exe in $(find $out/modules/x-pack/x-pack-ml/platform/linux-x86_64/bin -executable -type f); do
+    for exe in $(find $out/modules/x-pack-ml/platform/linux-x86_64/bin -executable -type f); do
       echo "patching $exe..."
       patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$exe"
     done
diff --git a/pkgs/servers/search/elasticsearch/plugins.nix b/pkgs/servers/search/elasticsearch/plugins.nix
index 330a81a422c..4451b010446 100644
--- a/pkgs/servers/search/elasticsearch/plugins.nix
+++ b/pkgs/servers/search/elasticsearch/plugins.nix
@@ -27,7 +27,7 @@ in {
     version = "${elk6Version}";
     src = fetchurl {
       url = "https://github.com/vhyza/elasticsearch-analysis-lemmagen/releases/download/v${version}/${name}-plugin.zip";
-      sha256 = "1m4z05wixjrq4nlbdjyhvprkrwxjym8aba18scmzfn25fhbjgvkz";
+      sha256 = "0299ldqwjn1gn44yyjiqjrxvs6mlclhzl1dbn6xlgg1a2lkaal4v";
     };
     meta = with stdenv.lib; {
       homepage = https://github.com/vhyza/elasticsearch-analysis-lemmagen;
@@ -42,7 +42,7 @@ in {
     version = "${elk6Version}";
     src = pkgs.fetchurl {
       url = "https://artifacts.elastic.co/downloads/elasticsearch-plugins/discovery-ec2/discovery-ec2-${elk6Version}.zip";
-      sha256 = "1i7ksy69132sr84h51lamgq967yz3a3dw0b54nckxpqwad9pcpj0";
+      sha256 = "1mg9knbc4r21kaiqnmkd8nzf2i23w5zxqnxyz484q0l2jf4hlkq1";
     };
     meta = with stdenv.lib; {
       homepage = https://github.com/elastic/elasticsearch/tree/master/plugins/discovery-ec2;
@@ -54,10 +54,10 @@ in {
   search_guard = esPlugin rec {
     name = "elastic-search-guard-${version}";
     pluginName = "search-guard";
-    version = "${elk6Version}-22.3";
+    version = "${elk6Version}-23.2";
     src = fetchurl rec {
       url = "mirror://maven/com/floragunn/search-guard-6/${version}/search-guard-6-${version}.zip";
-      sha256 = "1r71h4h9bmxak1mq5gpm19xq5ji1gry1kp3sjmm8azy4ykdqdncx";
+      sha256 = "05310wyxzhylxr0dfgzr10pb0pak30ry8r97g49n6iqj8dw3csnb";
     };
     meta = with stdenv.lib; {
       homepage = https://github.com/floragunncom/search-guard;
diff --git a/pkgs/servers/shishi/default.nix b/pkgs/servers/shishi/default.nix
index b066ff18bfd..6c4e515d422 100644
--- a/pkgs/servers/shishi/default.nix
+++ b/pkgs/servers/shishi/default.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage    = http://www.gnu.org/software/shishi/;
+    homepage    = https://www.gnu.org/software/shishi/;
     description = "An implementation of the Kerberos 5 network security system";
     license     = licenses.gpl3Plus;
     maintainers = with maintainers; [ bjg lovek323 wkennington ];
diff --git a/pkgs/servers/sip/sipwitch/default.nix b/pkgs/servers/sip/sipwitch/default.nix
index 9a6f2b0b5e1..1252153b79a 100644
--- a/pkgs/servers/sip/sipwitch/default.nix
+++ b/pkgs/servers/sip/sipwitch/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Secure peer-to-peer VoIP server that uses the SIP protocol";
-    homepage = http://www.gnu.org/software/sipwitch/;
+    homepage = https://www.gnu.org/software/sipwitch/;
     license = stdenv.lib.licenses.gpl3Plus;
     maintainers = with stdenv.lib.maintainers; [ ];
     platforms = with stdenv.lib.platforms; linux;
diff --git a/pkgs/servers/trezord/default.nix b/pkgs/servers/trezord/default.nix
index 86fe1d7b008..98079c37f1f 100644
--- a/pkgs/servers/trezord/default.nix
+++ b/pkgs/servers/trezord/default.nix
@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   name = "trezord-go-${version}";
-  version = "2.0.24";
+  version = "2.0.25";
 
   # Fixes Cgo related build failures (see https://github.com/NixOS/nixpkgs/issues/25959 )
   hardeningDisable = [ "fortify" ];
@@ -13,7 +13,7 @@ buildGoPackage rec {
     owner  = "trezor";
     repo   = "trezord-go";
     rev    = "v${version}";
-    sha256 = "1fl2d57qqrrwl995w4b2d57rvl2cxxy6afjmcp648hhb3dnmp7c3";
+    sha256 = "151szgfbikijpwqrvqj43kw38kbbgx2g1khlbj6l4925qba7fycd";
   };
 
   meta = with stdenv.lib; {
diff --git a/pkgs/shells/bash/4.4.nix b/pkgs/shells/bash/4.4.nix
index 6f970e1b7ad..e5e33c76d20 100644
--- a/pkgs/shells/bash/4.4.nix
+++ b/pkgs/shells/bash/4.4.nix
@@ -106,7 +106,7 @@ stdenv.mkDerivation rec {
     '';
 
   meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/bash/;
+    homepage = https://www.gnu.org/software/bash/;
     description =
       "GNU Bourne-Again Shell, the de facto standard shell on Linux" +
         (if interactive then " (for interactive use)" else "");
diff --git a/pkgs/shells/rush/default.nix b/pkgs/shells/rush/default.nix
index 9a5f7a753d3..3bfafdc46a0 100644
--- a/pkgs/shells/rush/default.nix
+++ b/pkgs/shells/rush/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
          sftp-server or scp, that lack this ability.
       '';
 
-    homepage = http://www.gnu.org/software/rush/;
+    homepage = https://www.gnu.org/software/rush/;
     license = stdenv.lib.licenses.gpl3Plus;
 
     maintainers = [ stdenv.lib.maintainers.bjg ];
diff --git a/pkgs/shells/zsh/antibody/default.nix b/pkgs/shells/zsh/antibody/default.nix
index 92a6628dcda..29e79c0e503 100644
--- a/pkgs/shells/zsh/antibody/default.nix
+++ b/pkgs/shells/zsh/antibody/default.nix
@@ -2,24 +2,23 @@
 
 buildGoPackage rec {
   name = "antibody-${version}";
-  version = "4.0.0";
-  rev = "v${version}";
+  version = "4.0.2";
 
   goPackagePath = "github.com/getantibody/antibody";
 
   src = fetchFromGitHub {
-    inherit rev;
     owner  = "getantibody";
     repo   = "antibody";
-    sha256 = "0iq3dfwwh39hmk8qmhrfgkn8pcabxf67c03s7vh18n7w9aay4jfz";
+    rev = "v${version}";
+    sha256 = "1lq0bd2l928bgwqiq3fa5ippjhnsfgwdqn6nd3hfis8bijrwc5jv";
   };
 
   goDeps = ./deps.nix;
 
   meta = with lib; {
     description = "The fastest shell plugin manager";
-    homepage    = https://github.com/getantibody/antibody;
-    license     = licenses.mit;
+    homepage = https://github.com/getantibody/antibody;
+    license = licenses.mit;
     maintainers = with maintainers; [ worldofpeace ];
   };
 }
diff --git a/pkgs/shells/zsh/antibody/deps.nix b/pkgs/shells/zsh/antibody/deps.nix
index b824358fbba..bdd53a9d142 100644
--- a/pkgs/shells/zsh/antibody/deps.nix
+++ b/pkgs/shells/zsh/antibody/deps.nix
@@ -1,110 +1,73 @@
-[
-  {
-    goPackagePath  = "github.com/alecthomas/kingpin";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/kingpin";
-      rev =  "a39589180ebd6bbf43076e514b55f20a95d43086";
-      sha256 = "0b00bfiwl76qflnmnk3cnlaii6wxgzzdnby99cxdych4f8qmzlv3";
-    };
-  }
-  {
-    goPackagePath  = "github.com/alecthomas/template";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/template";
-      rev =  "a0175ee3bccc567396460bf5acd36800cb10c49c";
-      sha256 = "0qjgvvh26vk1cyfq9fadyhfgdj36f1iapbmr5xp6zqipldz8ffxj";
-    };
-  }
-  {
-    goPackagePath  = "github.com/alecthomas/units";
-    fetch = {
-      type = "git";
-      url = "https://github.com/alecthomas/units";
-      rev =  "2efee857e7cfd4f3d0138cc3cbb1b4966962b93a";
-      sha256 = "1j65b91qb9sbrml9cpabfrcf07wmgzzghrl7809hjjhrmbzri5bl";
-    };
-  }
-  {
-    goPackagePath  = "github.com/caarlos0/gohome";
-    fetch = {
-      type = "git";
-      url = "https://github.com/caarlos0/gohome";
-      rev =  "c08fdebe2a8b9b92637a423c66ac5d4a8f4e91e8";
-      sha256 = "1wpg7dpi44kic4y20bk6fjwpanm65h1hj4762dsp41kbdfzc8322";
-    };
-  }
-  {
-    goPackagePath  = "github.com/davecgh/go-spew";
-    fetch = {
-      type = "git";
-      url = "https://github.com/davecgh/go-spew";
-      rev =  "346938d642f2ec3594ed81d874461961cd0faa76";
-      sha256 = "0d4jfmak5p6lb7n2r6yvf5p1zcw0l8j74kn55ghvr7zr7b7axm6c";
-    };
-  }
-  {
-    goPackagePath  = "github.com/getantibody/folder";
-    fetch = {
-      type = "git";
-      url = "https://github.com/getantibody/folder";
-      rev =  "479aa91767d47bc27599e6ebc7fd07945dd38132";
-      sha256 = "0mzc2x7897f17kj2v807d8cqzgclq9bsz2xqz81j1k85g53l513j";
-    };
-  }
-  {
-    goPackagePath  = "github.com/pmezard/go-difflib";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pmezard/go-difflib";
-      rev =  "792786c7400a136282c1664665ae0a8db921c6c2";
-      sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
-    };
-  }
-  {
-    goPackagePath  = "github.com/stretchr/testify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/stretchr/testify";
-      rev =  "12b6f73e6084dad08a7c6e575284b177ecafbc71";
-      sha256 = "01f80s0q64pw5drfgqwwk1wfwwkvd2lhbs56lhhkff4ni83k73fd";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/crypto";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/crypto";
-      rev =  "1a580b3eff7814fc9b40602fd35256c63b50f491";
-      sha256 = "11adgxc6fzcb3dxr5v2g4nk6ggrz04qnx633hzgmzfh2wv3blgv7";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/net";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/net";
-      rev =  "2491c5de3490fced2f6cff376127c667efeed857";
-      sha256 = "1wmijnrxi9p2rv8g6clqkzdihn5ncv29j0s4s1bz9ksncdr36ll3";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sync";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sync";
-      rev =  "1d60e4601c6fd243af51cc01ddf169918a5407ca";
-      sha256 = "046jlanz2lkxq1r57x9bl6s4cvfqaic6p2xybsj8mq1120jv4rs6";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev =  "7c87d13f8e835d2fb3a70a2912c811ed0c1d241b";
-      sha256 = "03fhkng37rczqwfgah5hd7d373jps3hcfx79dmky2fh62yvpcyn3";
-    };
-  }
-]
+[{
+  goPackagePath = "github.com/getantibody/folder";
+  fetch = {
+    type = "git";
+    url = "https://github.com/getantibody/folder";
+    rev = "479aa91767d47bc27599e6ebc7fd07945dd38132";
+    sha256 = "0mzc2x7897f17kj2v807d8cqzgclq9bsz2xqz81j1k85g53l513j";
+  };
+}{
+  goPackagePath = "github.com/alecthomas/units";
+  fetch = {
+    type = "git";
+    url = "https://github.com/alecthomas/units";
+    rev = "2efee857e7cfd4f3d0138cc3cbb1b4966962b93a";
+    sha256 = "1j65b91qb9sbrml9cpabfrcf07wmgzzghrl7809hjjhrmbzri5bl";
+  };
+}{
+  goPackagePath = "github.com/alecthomas/template";
+  fetch = {
+    type = "git";
+    url = "https://github.com/alecthomas/template";
+    rev = "a0175ee3bccc567396460bf5acd36800cb10c49c";
+    sha256 = "0qjgvvh26vk1cyfq9fadyhfgdj36f1iapbmr5xp6zqipldz8ffxj";
+  };
+}{
+  goPackagePath = "github.com/caarlos0/gohome";
+  fetch = {
+    type = "git";
+    url = "https://github.com/caarlos0/gohome";
+    rev = "75f08ebc60b144c5c3178115baedce176fdcfe99";
+    sha256 = "04950r9lzhgkksgqbnlfx0m3n7zqfif3l8fixwb7f271a880i4gz";
+  };
+}{
+  goPackagePath = "github.com/alecthomas/kingpin";
+  fetch = {
+    type = "git";
+    url = "https://github.com/alecthomas/kingpin";
+    rev = "a39589180ebd6bbf43076e514b55f20a95d43086";
+    sha256 = "0b00bfiwl76qflnmnk3cnlaii6wxgzzdnby99cxdych4f8qmzlv3";
+  };
+}{
+  goPackagePath = "golang.org/x/sync";
+  fetch = {
+    type = "git";
+    url = "https://go.googlesource.com/sync";
+    rev = "1d60e4601c6fd243af51cc01ddf169918a5407ca";
+    sha256 = "046jlanz2lkxq1r57x9bl6s4cvfqaic6p2xybsj8mq1120jv4rs6";
+  };
+}{
+  goPackagePath = "golang.org/x/crypto";
+  fetch = {
+    type = "git";
+    url = "https://go.googlesource.com/crypto";
+    rev = "1a580b3eff7814fc9b40602fd35256c63b50f491";
+    sha256 = "11adgxc6fzcb3dxr5v2g4nk6ggrz04qnx633hzgmzfh2wv3blgv7";
+  };
+}{
+  goPackagePath = "golang.org/x/sys";
+  fetch = {
+    type = "git";
+    url = "https://go.googlesource.com/sys";
+    rev = "7c87d13f8e835d2fb3a70a2912c811ed0c1d241b";
+    sha256 = "03fhkng37rczqwfgah5hd7d373jps3hcfx79dmky2fh62yvpcyn3";
+  };
+}{
+  goPackagePath = "golang.org/x/net";
+  fetch = {
+    type = "git";
+    url = "https://go.googlesource.com/net";
+    rev = "2491c5de3490fced2f6cff376127c667efeed857";
+    sha256 = "1wmijnrxi9p2rv8g6clqkzdihn5ncv29j0s4s1bz9ksncdr36ll3";
+  };
+}]
diff --git a/pkgs/tools/X11/autocutsel/default.nix b/pkgs/tools/X11/autocutsel/default.nix
index ae7daa1db10..c9bf7141804 100644
--- a/pkgs/tools/X11/autocutsel/default.nix
+++ b/pkgs/tools/X11/autocutsel/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     inherit version;
-    homepage = http://www.nongnu.org/autocutsel/;
+    homepage = https://www.nongnu.org/autocutsel/;
     description = "Tracks changes in the server's cutbuffer and CLIPBOARD selection";
     license = stdenv.lib.licenses.gpl2Plus;
     platforms = with stdenv.lib.platforms; all;
diff --git a/pkgs/tools/X11/xbindkeys/default.nix b/pkgs/tools/X11/xbindkeys/default.nix
index e633ba4f794..4e4e49bd946 100644
--- a/pkgs/tools/X11/xbindkeys/default.nix
+++ b/pkgs/tools/X11/xbindkeys/default.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   buildInputs = [ libX11 guile ];
 
   meta = {
-    homepage = http://www.nongnu.org/xbindkeys/xbindkeys.html;
+    homepage = https://www.nongnu.org/xbindkeys/xbindkeys.html;
     description = "Launch shell commands with your keyboard or your mouse under X Window";
     license = stdenv.lib.licenses.gpl2Plus;
     maintainers = with stdenv.lib.maintainers; [viric];
diff --git a/pkgs/tools/X11/xnee/default.nix b/pkgs/tools/X11/xnee/default.nix
index b31a512e84a..c7fd376a8ed 100644
--- a/pkgs/tools/X11/xnee/default.nix
+++ b/pkgs/tools/X11/xnee/default.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
 
     license = stdenv.lib.licenses.gpl3Plus;
 
-    homepage = http://www.gnu.org/software/xnee/;
+    homepage = https://www.gnu.org/software/xnee/;
 
     maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
     platforms = stdenv.lib.platforms.gnu ++ stdenv.lib.platforms.linux;  # arbitrary choice
diff --git a/pkgs/tools/admin/aws-google-auth/default.nix b/pkgs/tools/admin/aws-google-auth/default.nix
new file mode 100644
index 00000000000..5d4ba0bfbc8
--- /dev/null
+++ b/pkgs/tools/admin/aws-google-auth/default.nix
@@ -0,0 +1,62 @@
+{ lib
+, buildPythonApplication
+, fetchFromGitHub
+, beautifulsoup4
+, boto3
+, configparser
+, keyring
+, keyrings-alt
+, lxml
+, pillow
+, requests
+, six
+, tabulate
+, tzlocal
+, nose
+, mock
+, withU2F ? false, python-u2flib-host
+}:
+
+buildPythonApplication rec {
+  pname = "aws-google-auth";
+  version = "0.0.29";
+
+  # Pypi doesn't ship the tests, so we fetch directly from GitHub
+  # https://github.com/cevoaustralia/aws-google-auth/issues/120
+  src = fetchFromGitHub {
+    owner = "cevoaustralia";
+    repo = "aws-google-auth";
+    rev = version;
+    sha256 = "06dalrwjy1sbc5wvj5ip4h999izlb0j5g6b6f3l5znnsm0vfvfia";
+  };
+
+  propagatedBuildInputs = [ 
+    beautifulsoup4
+    boto3
+    configparser
+    keyring
+    keyrings-alt
+    lxml
+    pillow
+    requests
+    six
+    tabulate
+    tzlocal
+  ] ++ lib.optional withU2F python-u2flib-host;
+  
+  checkInputs = [ 
+    mock
+    nose 
+  ];
+
+  preCheck = ''
+    export HOME=$TMPDIR
+  '';
+
+  meta = with lib; {
+    description = "Acquire AWS STS (temporary) credentials via Google Apps SAML Single Sign On";
+    homepage = https://github.com/cevoaustralia/aws-google-auth;
+    maintainers = [ maintainers.marsam ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/tools/archivers/atool/default.nix b/pkgs/tools/archivers/atool/default.nix
index c5a2a7ffee0..e305a1739f7 100644
--- a/pkgs/tools/archivers/atool/default.nix
+++ b/pkgs/tools/archivers/atool/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   configureScript = "${bash}/bin/bash configure";
 
   meta = {
-    homepage = http://www.nongnu.org/atool;
+    homepage = https://www.nongnu.org/atool;
     description = "Archive command line helper";
     platforms = stdenv.lib.platforms.unix;
     license = stdenv.lib.licenses.gpl3;
diff --git a/pkgs/tools/archivers/cpio/default.nix b/pkgs/tools/archivers/cpio/default.nix
index c38dc7bbfbe..44943109ee1 100644
--- a/pkgs/tools/archivers/cpio/default.nix
+++ b/pkgs/tools/archivers/cpio/default.nix
@@ -32,7 +32,7 @@ in stdenv.mkDerivation {
   enableParallelBuilding = true;
 
   meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/cpio/;
+    homepage = https://www.gnu.org/software/cpio/;
     description = "A program to create or extract from cpio archives";
     license = licenses.gpl3;
     platforms = platforms.all;
diff --git a/pkgs/tools/archivers/gnutar/default.nix b/pkgs/tools/archivers/gnutar/default.nix
index 0cde7206984..5633a9fa152 100644
--- a/pkgs/tools/archivers/gnutar/default.nix
+++ b/pkgs/tools/archivers/gnutar/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   doInstallCheck = false; # fails
 
   meta = {
-    homepage = http://www.gnu.org/software/tar/;
+    homepage = https://www.gnu.org/software/tar/;
     description = "GNU implementation of the `tar' archiver";
 
     longDescription = ''
diff --git a/pkgs/tools/archivers/sharutils/default.nix b/pkgs/tools/archivers/sharutils/default.nix
index 292c0be20e5..a03c9610e35 100644
--- a/pkgs/tools/archivers/sharutils/default.nix
+++ b/pkgs/tools/archivers/sharutils/default.nix
@@ -60,7 +60,7 @@ stdenv.mkDerivation rec {
          by a copy of the shell. unshar may also process files containing
          concatenated shell archives.
       '';
-    homepage = http://www.gnu.org/software/sharutils/;
+    homepage = https://www.gnu.org/software/sharutils/;
     license = licenses.gpl3Plus;
     maintainers = [ maintainers.ndowens ];
     platforms = platforms.all;
diff --git a/pkgs/tools/backup/duplicity/default.nix b/pkgs/tools/backup/duplicity/default.nix
index cbe02a0593e..b5accb3b82b 100644
--- a/pkgs/tools/backup/duplicity/default.nix
+++ b/pkgs/tools/backup/duplicity/default.nix
@@ -5,7 +5,7 @@ python2Packages.buildPythonApplication rec {
   version = "0.7.18.2";
 
   src = fetchurl {
-    url = "http://code.launchpad.net/duplicity/${stdenv.lib.versions.majorMinor version}-series/${version}/+download/${name}.tar.gz";
+    url = "https://code.launchpad.net/duplicity/${stdenv.lib.versions.majorMinor version}-series/${version}/+download/${name}.tar.gz";
     sha256 = "0j37dgyji36hvb5dbzlmh5rj83jwhni02yq16g6rd3hj8f7qhdn2";
   };
 
@@ -35,7 +35,7 @@ python2Packages.buildPythonApplication rec {
 
   meta = with stdenv.lib; {
     description = "Encrypted bandwidth-efficient backup using the rsync algorithm";
-    homepage = http://www.nongnu.org/duplicity;
+    homepage = https://www.nongnu.org/duplicity;
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ peti ];
     platforms = platforms.unix;
diff --git a/pkgs/tools/backup/duply/default.nix b/pkgs/tools/backup/duply/default.nix
index f11a387e5fe..2ce6f7e92e7 100644
--- a/pkgs/tools/backup/duply/default.nix
+++ b/pkgs/tools/backup/duply/default.nix
@@ -28,11 +28,11 @@ stdenv.mkDerivation rec {
     description = "Shell front end for the duplicity backup tool";
     longDescription = ''
       Duply is a shell front end for the duplicity backup tool
-      http://duplicity.nongnu.org/. It greatly simplifies it's usage by
+      https://www.nongnu.org/duplicity. It greatly simplifies its usage by
       implementing backup job profiles, batch commands and more. Who says
       secure backups on non-trusted spaces are no child's play?
     '';
-    homepage = http://duply.net/;
+    homepage = https://duply.net/;
     license = licenses.gpl2;
     maintainers = [ maintainers.bjornfor ];
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/tools/backup/store-backup/default.nix b/pkgs/tools/backup/store-backup/default.nix
index 80ff97f097d..4f8c234b752 100644
--- a/pkgs/tools/backup/store-backup/default.nix
+++ b/pkgs/tools/backup/store-backup/default.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ perl makeWrapper ];
 
   src = fetchurl {
-    url = "http://download.savannah.gnu.org/releases/storebackup/storeBackup-${version}.tar.bz2";
+    url = "https://download.savannah.gnu.org/releases/storebackup/storeBackup-${version}.tar.bz2";
     sha256 = "0y4gzssc93x6y93mjsxm5b5cdh68d7ffa43jf6np7s7c99xxxz78";
   };
 
@@ -103,7 +103,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "A backup suite that stores files on other disks";
-    homepage = http://savannah.nongnu.org/projects/storebackup;
+    homepage = https://savannah.nongnu.org/projects/storebackup;
     license = stdenv.lib.licenses.gpl3Plus;
     maintainers = [stdenv.lib.maintainers.marcweber];
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/tools/cd-dvd/xorriso/default.nix b/pkgs/tools/cd-dvd/xorriso/default.nix
index f396cbad955..1469a68bf0e 100644
--- a/pkgs/tools/cd-dvd/xorriso/default.nix
+++ b/pkgs/tools/cd-dvd/xorriso/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
     license = licenses.gpl3Plus;
 
-    homepage = http://www.gnu.org/software/xorriso/;
+    homepage = https://www.gnu.org/software/xorriso/;
 
     maintainers = [ maintainers.vrthra ];
     platforms = platforms.unix;
diff --git a/pkgs/tools/compression/lzip/default.nix b/pkgs/tools/compression/lzip/default.nix
index 49677e98813..6b1d123a066 100644
--- a/pkgs/tools/compression/lzip/default.nix
+++ b/pkgs/tools/compression/lzip/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = {
-    homepage = http://www.nongnu.org/lzip/lzip.html;
+    homepage = https://www.nongnu.org/lzip/lzip.html;
     description = "A lossless data compressor based on the LZMA algorithm";
     license = stdenv.lib.licenses.gpl3Plus;
     platforms = stdenv.lib.platforms.all;
diff --git a/pkgs/tools/filesystems/bees/bees-service-wrapper b/pkgs/tools/filesystems/bees/bees-service-wrapper
new file mode 100755
index 00000000000..8ef46afc18f
--- /dev/null
+++ b/pkgs/tools/filesystems/bees/bees-service-wrapper
@@ -0,0 +1,223 @@
+#!@bash@/bin/bash
+PATH=@bash@/bin:@coreutils@/bin:@utillinux@/bin:@btrfsProgs@/bin:$PATH
+beesd_bin=@bees@/lib/bees/bees
+# PLEASE KEEP NIX-ISMS ABOVE THIS LINE TO EASE UPSTREAM MERGE
+#!/usr/bin/env bash
+
+shopt -s extglob
+
+# Upstream wrapper requires UUID to be used for configuration.
+
+# However, when declaratively describing a host, we may not know its UUID, and
+# shouldn't need to persist something that will differ between hosts built from
+# the same configuration template.
+
+# Thus, for using bees from NixOS, we have our own wrapper, which supports not
+# just UUID but any specification permitted by findmnt
+
+[[ $bees_debug ]] && { PS4=':${BASH_SOURCE##*/}:$LINENO+'; set -x; }
+
+usage() {
+  cat >&2 <<EOF
+Usage: ${BASH_SOURCE##*/} run|cleanup config-name|fsSpec [idxSizeMB=...] [verbosity=...] [workDir=...] [-- daemon-options...]
+
+  fsSpec should be in a format recognized by findmnt. Alternately,
+  "config-name" may refer to a file that exists in ${bees_config_dir:-/etc/bees}
+  with a .conf extension; if that file does not specify UUID, findmnt will be
+  used in addition.
+
+  Note that while config files may presently use shell arithmetic, use of this
+  functionality is not encouraged going forward: Setting ''idxSizeMB=4096'' is
+  preferred over ''DB_SIZE=$((1024*1024*1024*4))'' or ''DB_SIZE=$(( AL16M * 256 ))'',
+  although both of these are presently supported.
+
+  If fsSpec contains a /, it assumed to be a mount point to be looked up by
+  findmnt, not a config file name.
+
+  daemon-options are passed directly through to the daemon on startup, as
+  documented at https://github.com/Zygo/bees/blob/master/docs/options.md.
+EOF
+  exit 1
+}
+
+die() { echo "$*" >&2; exit 1; }
+
+allConfigNames=( blockdev fsSpec home idxSize idxSizeMB mntDir runDir status verbosity workDir )
+
+# Alternate names for configuration values; "bees_" will always be prepended
+declare -A altConfigNames=(
+  # from original bees wrapper
+  [BEESHOME]=home
+  [BEESSTATUS]=status
+  [MNT_DIR]=mntDir
+  [UUID]=uuid
+  [WORK_DIR]=runDir
+  [DB_SIZE]=idxSize
+)
+
+# legacy bees config files can be arbitrary shell scripts, so we need to actually evaluate them
+sandboxedConfigFileEval() {
+  bash_exe=$(type -P bash) || exit
+  PATH=/var/empty ENV='' BASH_ENV='' AL128K="$((128*1024))" AL16M="$((16*1024*1024))" "$bash_exe" -r ${bees_debug+-x} \
+    -c 'eval "$(</dev/stdin)" >&2; for var; do [[ ${!var} ]] && printf "%q=%s\\0" "$var" "${!var}"; done' \
+    "${!altConfigNames[@]}" "${allConfigNames[@]}" \
+    <"$1"
+}
+
+readConfigFileIfExists() {
+  local line
+  [[ -s $1 ]] || return 1
+  while IFS= read -r -d '' line; do
+    line=${line%%+([[:space:]])"#"*}
+    [[ $line ]] || continue
+    [[ $line = *=* ]] || {
+      printf 'WARNING: Config file line not recognized: %q\n' "$line" >&2
+      continue
+    }
+    set_option "$line"
+  done < <(sandboxedConfigFileEval "$1")
+}
+
+set_option() {
+  local k v
+  k="${1%%=*}" v="${1#*=}"
+  [[ ${altConfigNames[$k]} ]] && k=${altConfigNames[$k]}
+  printf -v "bees_$k" %s "$v"
+}
+
+uuid_re='^[[:xdigit:]]{8}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{4}-[[:xdigit:]]{12}$'
+
+# Shared code for setting configuration used by other operations.
+#
+# Reads from global associative array "opts" containing options passed in as
+# key=value pairs on the command line, looks for config-file overrides, and
+# sets individual global variables.
+_setup() {
+  declare fstype
+  bees_fsSpec=$1; shift
+
+  # Look for file-based configuration, additional to honoring configuration on the command line
+  bees_config_dir="${bees_config_dir:-/etc/bees}"
+  if [[ $bees_fsSpec =~ $uuid_re ]]; then
+    bees_uuid=$bees_fsSpec
+    # If our spec looks like a bare UUID, and no config file exists in the new
+    # format, fall back to legacy config file search mechanism (grep; ewww).
+    if ! readConfigFileIfExists "$bees_config_dir/UUID=$bees_fsSpec.conf"; then
+      # Legacy approach to finding a config file: Grep for a *.conf file
+      # containing the UUID within its text. Permitting spaces around the "="
+      # appears to be a bug, but is retained for compatibility with the
+      # original upstream script.
+      allConfFiles=( "$bees_config_dir"/*.conf )
+      if (( ${#allConfFiles[@]} )); then
+        # in read or readarray with -d '', the NUL terminating the empty string is used as delimiter character.
+        readarray -d '' -t matchingConfFiles < <(grep -E -l -Z "^[^#]*UUID[[:space:]]*=[[:space:]]*" "${allConfFiles[@]}")
+      else
+        matchingConfFiles=( )
+      fi
+      if (( ${#matchingConfFiles[@]} == 1 )); then
+        # Exactly one configuration file exists in our target directory with a reference to the UUID given.
+        bees_config_file=${matchingConfFiles[0]}
+        readConfigFileIfExists "$bees_config_file"
+        echo "NOTE: Please consider renaming $bees_config_file to $bees_config_dir/UUID=$bees_fsSpec" >&2
+        echo "      ...and passing UUID=$bees_fsSpec on startup." >&2
+      elif (( ${#matchingConfFiles[@]} > 1 )); then
+        # The legacy wrapper would silently use the first file and ignore
+        # others, but... no.
+        echo "ERROR: Passed a bare UUID, but multiple configuration files match it:" >&2
+        printf ' - %q\n' "${matchingConfFiles[@]}" >&2
+        die "Unable to continue."
+      fi
+    fi
+  else
+    # For a non-UUID fsSpec that is not a path, look only for a config file
+    # exactly matching its text.
+    #
+    # (Passing a mount point as a fsSpec is only supported with the new
+    # wrapper; all key=value pairs can be passed on the command line in this
+    # mode, so config file support is not needed).
+    [[ $bees_fsSpec = */* ]] || readConfigFileIfExists "$bees_config_dir/$bees_fsSpec.conf"
+  fi
+
+  [[ $bees_uuid ]] || {
+    # if bees_uuid is not in our .conf file, look it up with findmnt
+    read -r bees_uuid fstype < <(findmnt -n -o uuid,fstype "$bees_fsSpec") && [[ $fstype ]] || exit
+    [[ $fstype = btrfs ]] || die "Device type is $fstype, not btrfs"
+  }
+
+  [[ $bees_uuid = */* ]] || readConfigFileIfExists "$bees_config_dir/UUID=$bees_uuid.conf"
+
+  # Honor any values read from config files above; otherwise, set defaults.
+  bees_workDir="${bees_workDir:-.beeshome}"
+  bees_runDir="${bees_runDir:-/run/bees}"
+  bees_mntDir="${bees_mntDir:-$bees_runDir/mnt/$bees_uuid}"
+  bees_home="${bees_home:-$bees_mntDir/$bees_workDir}"
+  bees_status="${bees_status:-${bees_runDir}/$bees_uuid.status}"
+  bees_verbosity="${bees_verbosity:-6}"
+  bees_idxSizeMB="${bees_idxSizeMB:-1024}"
+  bees_idxSize=${bees_idxSize:-"$(( bees_idxSizeMB * 1024 * 1024 ))"}
+  bees_blockdev=${bees_blockdev:-"/dev/disk/by-uuid/$bees_uuid"}
+
+  [[ -b $bees_blockdev ]] || die "Block device $bees_blockdev missing"
+  (( bees_idxSize % (16 * 1024 * 1024) == 0 )) || die "DB size must be divisible by 16MB"
+}
+
+do_run() {
+  local db old_db_size
+
+  _setup "$1"; shift
+  mkdir -p -- "$bees_mntDir" || exit
+
+  # subvol id 5 is reserved for the root subvolume of a btrfs filesystem.
+  mountpoint -q "$bees_mntDir" || mount -osubvolid=5 -- "$bees_blockdev" "$bees_mntDir" || exit
+  if [[ -d $bees_home ]]; then
+    btrfs subvolume show "$bees_home" >/dev/null 2>&1 || die "$bees_home exists but is not a subvolume"
+  else
+    btrfs subvolume create "$bees_home" || exit
+    sync # workaround for Zygo/bees#93
+  fi
+  db=$bees_home/beeshash.dat
+  touch -- "$db"
+
+  old_db_size=$(stat -c %s -- "$db")
+  new_db_size=$bees_idxSize
+
+  if (( old_db_size != new_db_size )); then
+    rm -f -- "$bees_home"/beescrawl."$bees_uuid".dat
+    truncate -s "$new_db_size" -- "$db" || exit
+  fi
+  chmod 700 -- "$bees_home"
+
+  # BEESSTATUS and BEESHOME are the only variables handled by the legacy
+  # wrapper for which getenv() is called in C code.
+  BEESSTATUS=$bees_status BEESHOME=$bees_home exec "${beesd_bin:-/lib/bees/bees}" \
+    --verbose "$bees_verbosity" \
+    "$@" "$bees_mntDir" || exit
+}
+
+do_cleanup() {
+  _setup "$1"; shift
+  mountpoint -q "$bees_mntDir" && umount -l -- "$bees_mntDir" || exit
+}
+
+(( $# >= 2 )) || usage
+declare -f "do_$1" >/dev/null 2>&1 || usage
+mode=$1; shift # must be a do_* function; currently "run" or "cleanup"
+
+declare -a args=( "$1" ); shift  # pass first argument (config-name|fsSpec) through literally
+
+# parse other arguments as key=value pairs, or pass them through literally if they do not match that form.
+# similarly, any option after "--" will be passed through literally.
+while (( $# )); do
+  if [[ $1 = *=* ]]; then
+    set_option "$1"
+  elif [[ $1 = -- ]]; then
+    shift
+    args+=( "$@" )
+    break
+  else
+    args+=( "$1" )
+  fi
+  shift
+done
+
+"do_$mode" "${args[@]}"
diff --git a/pkgs/tools/filesystems/bees/default.nix b/pkgs/tools/filesystems/bees/default.nix
new file mode 100644
index 00000000000..c43962cb075
--- /dev/null
+++ b/pkgs/tools/filesystems/bees/default.nix
@@ -0,0 +1,69 @@
+{ stdenv, runCommand, makeWrapper, fetchFromGitHub, bash, btrfs-progs, coreutils, pythonPackages, utillinux }:
+
+let
+
+  version = "0.6.1";
+  sha256 = "0h7idclmhyp14mq6786x7f2237vqpn70gyi88ik4g70xl84yfgyh";
+
+  bees = stdenv.mkDerivation rec {
+    name = "bees-${version}";
+    inherit version;
+
+    src = fetchFromGitHub {
+      owner = "Zygo";
+      repo = "bees";
+      rev = "v${version}";
+      inherit sha256;
+    };
+
+    buildInputs = [
+      btrfs-progs               # for btrfs/ioctl.h
+      utillinux                 # for uuid.h
+    ];
+
+    nativeBuildInputs = [
+      pythonPackages.markdown   # documentation build
+    ];
+
+    preBuild = ''
+      git() { if [[ $1 = describe ]]; then echo ${version}; else command git "$@"; fi; }
+      export -f git
+    '';
+
+    postBuild = ''
+      unset -f git
+    '';
+
+    buildFlags = [
+      "ETC_PREFIX=/var/run/bees/configs"
+    ];
+
+    makeFlags = [
+      "SHELL=bash"
+      "PREFIX=$(out)"
+      "ETC_PREFIX=$(out)/etc"
+      "BEES_VERSION=${version}"
+      "SYSTEMD_SYSTEM_UNIT_DIR=$(out)/etc/systemd/system"
+    ];
+
+    meta = with stdenv.lib; {
+      homepage = "https://github.com/Zygo/bees";
+      description = "Block-oriented BTRFS deduplication service";
+      license = licenses.gpl3;
+      platforms = platforms.linux;
+      maintainers = with maintainers; [ chaduffy ];
+      longDescription = "Best-Effort Extent-Same: bees finds not just identical files, but also identical extents within files that differ";
+    };
+  };
+
+in
+
+runCommand "bees-service-${version}" {
+  inherit bash bees coreutils utillinux;
+  btrfsProgs = btrfs-progs; # needs to be a valid shell variable name
+} ''
+  mkdir -p -- "$out/bin"
+  substituteAll ${./bees-service-wrapper} "$out"/bin/bees-service-wrapper
+  chmod +x "$out"/bin/bees-service-wrapper
+  ln -s ${bees}/bin/beesd "$out"/bin/beesd
+''
diff --git a/pkgs/tools/filesystems/davfs2/default.nix b/pkgs/tools/filesystems/davfs2/default.nix
index 37ee611f054..2b6d0f6e669 100644
--- a/pkgs/tools/filesystems/davfs2/default.nix
+++ b/pkgs/tools/filesystems/davfs2/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   makeFlags = ["sbindir=$(out)/sbin" "ssbindir=$(out)/sbin"];
 
   meta = {
-    homepage = http://savannah.nongnu.org/projects/davfs2;
+    homepage = https://savannah.nongnu.org/projects/davfs2;
     description = "Mount WebDAV shares like a typical filesystem";
     license = stdenv.lib.licenses.gpl3Plus;
 
diff --git a/pkgs/tools/filesystems/nixpart/0.4/parted.nix b/pkgs/tools/filesystems/nixpart/0.4/parted.nix
index f7071e45232..046fe81e64a 100644
--- a/pkgs/tools/filesystems/nixpart/0.4/parted.nix
+++ b/pkgs/tools/filesystems/nixpart/0.4/parted.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
       which also serves as a sample implementation and script backend.
     '';
 
-    homepage = http://www.gnu.org/software/parted/;
+    homepage = https://www.gnu.org/software/parted/;
     license = stdenv.lib.licenses.gpl3Plus;
 
     maintainers = [
diff --git a/pkgs/tools/graphics/asymptote/default.upstream b/pkgs/tools/graphics/asymptote/default.upstream
index 3739390fd1d..e86d81ba443 100644
--- a/pkgs/tools/graphics/asymptote/default.upstream
+++ b/pkgs/tools/graphics/asymptote/default.upstream
@@ -1,4 +1,4 @@
-url http://sourceforge.net/projects/asymptote/files/
+url https://sourceforge.net/projects/asymptote/files/
 SF_version_dir
 version_link 'src[.]tgz/download$'
 SF_redirect
diff --git a/pkgs/tools/graphics/barcode/default.nix b/pkgs/tools/graphics/barcode/default.nix
index 4fa9fff97d3..de09c2b2780 100644
--- a/pkgs/tools/graphics/barcode/default.nix
+++ b/pkgs/tools/graphics/barcode/default.nix
@@ -15,9 +15,9 @@ stdenv.mkDerivation rec {
     description = "GNU barcode generator";
     maintainers = with maintainers; [ raskin ];
     platforms = platforms.linux; # Maybe other non-darwin Unix
-    downloadPage = "http://ftp.gnu.org/gnu/barcode/";
+    downloadPage = "https://ftp.gnu.org/gnu/barcode/";
     updateWalker = true;
-    homepage = http://ftp.gnu.org/gnu/barcode/;
+    homepage = https://www.gnu.org/software/barcode/;
     license = licenses.gpl3;
   };
 }
diff --git a/pkgs/tools/graphics/dmtx-utils/default.upstream b/pkgs/tools/graphics/dmtx-utils/default.upstream
index 8768681642e..2bb7fe31bf7 100644
--- a/pkgs/tools/graphics/dmtx-utils/default.upstream
+++ b/pkgs/tools/graphics/dmtx-utils/default.upstream
@@ -1,4 +1,4 @@
-url http://sourceforge.net/projects/libdmtx/files/libdmtx/
+url https://sourceforge.net/projects/libdmtx/files/libdmtx/
 SF_version_dir
 version_link 'dmtx-utils-.*[.]tar[.][a-z0-9]+/download$'
 SF_redirect
diff --git a/pkgs/tools/graphics/fim/default.nix b/pkgs/tools/graphics/fim/default.nix
index 066c181f53c..7303f27fe11 100644
--- a/pkgs/tools/graphics/fim/default.nix
+++ b/pkgs/tools/graphics/fim/default.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
       to be a highly customizable and scriptable for users who are comfortable
       with software like the VIM text editor or the Mutt mail user agent.
     '';
-    homepage = http://www.nongnu.org/fbi-improved/;
+    homepage = https://www.nongnu.org/fbi-improved/;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [ primeos ];
diff --git a/pkgs/tools/graphics/icoutils/default.nix b/pkgs/tools/graphics/icoutils/default.nix
index 3ab2232e26c..b16dbe21985 100644
--- a/pkgs/tools/graphics/icoutils/default.nix
+++ b/pkgs/tools/graphics/icoutils/default.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = http://www.nongnu.org/icoutils/;
+    homepage = https://www.nongnu.org/icoutils/;
     description = "Set of programs to deal with Microsoft Windows(R) icon and cursor files";
     license = stdenv.lib.licenses.gpl3Plus;
     platforms = with stdenv.lib.platforms; linux ++ darwin;
diff --git a/pkgs/tools/graphics/oxipng/default.nix b/pkgs/tools/graphics/oxipng/default.nix
index c5737554b77..10b4dd4a031 100644
--- a/pkgs/tools/graphics/oxipng/default.nix
+++ b/pkgs/tools/graphics/oxipng/default.nix
@@ -1,17 +1,17 @@
 { stdenv, fetchFromGitHub, rustPlatform }:
 
 rustPlatform.buildRustPackage rec {
-  version = "2.1.6";
+  version = "2.1.8";
   name = "oxipng-${version}";
 
   src = fetchFromGitHub {
     owner = "shssoichiro";
     repo = "oxipng";
     rev = "v${version}";
-    sha256 = "0n3v2dxybfkf07hb4p2hbhhkwx907b85wzj8wa4whwil89igyrdm";
+    sha256 = "18ld65vm58s6x918g6bhfkrg7lw2lca8daidv88ff14wm5khjvik";
   };
 
-  cargoSha256 = "1ycacwhwbn27i81jpp55m1446b9a50knlqv0kzkjcv8yf27213y9";
+  cargoSha256 = "034i8hgi0zgv085bimlja1hl3nd096rqpi167pw6rda5aj18c625";
 
   meta = with stdenv.lib; {
     homepage = https://github.com/shssoichiro/oxipng;
diff --git a/pkgs/tools/graphics/plotutils/default.nix b/pkgs/tools/graphics/plotutils/default.nix
index 0d1890bb670..61e21b1a33d 100644
--- a/pkgs/tools/graphics/plotutils/default.nix
+++ b/pkgs/tools/graphics/plotutils/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
          graphics.
       '';
 
-    homepage = http://www.gnu.org/software/plotutils/;
+    homepage = https://www.gnu.org/software/plotutils/;
 
     license = stdenv.lib.licenses.gpl2Plus;
     maintainers = [ stdenv.lib.maintainers.marcweber ];
diff --git a/pkgs/tools/graphics/scanbd/default.nix b/pkgs/tools/graphics/scanbd/default.nix
index 402628f0fc8..5dbbd20cd82 100644
--- a/pkgs/tools/graphics/scanbd/default.nix
+++ b/pkgs/tools/graphics/scanbd/default.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
       scanbuttond project. 
     '';
     homepage = http://scanbd.sourceforge.net/;
-    downloadPage = http://sourceforge.net/projects/scanbd/;
+    downloadPage = https://sourceforge.net/projects/scanbd/;
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
   };
diff --git a/pkgs/tools/inputmethods/m17n-db/default.nix b/pkgs/tools/inputmethods/m17n-db/default.nix
index dd8e96f8a6f..8732d1a816d 100644
--- a/pkgs/tools/inputmethods/m17n-db/default.nix
+++ b/pkgs/tools/inputmethods/m17n-db/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "m17n-db-1.8.0";
 
   src = fetchurl {
-    url = "http://download.savannah.gnu.org/releases/m17n/${name}.tar.gz";
+    url = "https://download.savannah.gnu.org/releases/m17n/${name}.tar.gz";
     sha256 = "0vfw7z9i2s9np6nmx1d4dlsywm044rkaqarn7akffmb6bf1j6zv5";
   };
 
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   ;
 
   meta = {
-    homepage = http://www.nongnu.org/m17n/;
+    homepage = https://www.nongnu.org/m17n/;
     description = "Multilingual text processing library (database)";
     license = stdenv.lib.licenses.lgpl21Plus;
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/tools/inputmethods/m17n-lib/default.nix b/pkgs/tools/inputmethods/m17n-lib/default.nix
index 12b669c8777..baf57ed9049 100644
--- a/pkgs/tools/inputmethods/m17n-lib/default.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/default.nix
@@ -3,14 +3,14 @@ stdenv.mkDerivation rec {
   name = "m17n-lib-1.8.0";
 
   src = fetchurl {
-    url = "http://download.savannah.gnu.org/releases/m17n/${name}.tar.gz";
+    url = "https://download.savannah.gnu.org/releases/m17n/${name}.tar.gz";
     sha256 = "0jp61y09xqj10mclpip48qlfhniw8gwy8b28cbzxy8hq8pkwmfkq";
   };
 
   buildInputs = [ m17n_db ];
 
   meta = {
-    homepage = http://www.nongnu.org/m17n/;
+    homepage = https://www.nongnu.org/m17n/;
     description = "Multilingual text processing library (runtime)";
     license = stdenv.lib.licenses.lgpl21Plus;
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/tools/inputmethods/m17n-lib/otf.nix b/pkgs/tools/inputmethods/m17n-lib/otf.nix
index 95eea764187..a69f46e9678 100644
--- a/pkgs/tools/inputmethods/m17n-lib/otf.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/otf.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "libotf-0.9.16";
 
   src = fetchurl {
-    url = "http://download.savannah.gnu.org/releases/m17n/${name}.tar.gz";
+    url = "https://download.savannah.gnu.org/releases/m17n/${name}.tar.gz";
     sha256 = "0sq6g3xaxw388akws6qrllp3kp2sxgk2dv4j79k6mm52rnihrnv8";
   };
 
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     '';
 
   meta = {
-    homepage = http://www.nongnu.org/m17n/;
+    homepage = https://www.nongnu.org/m17n/;
     description = "Multilingual text processing library (libotf)";
     license = stdenv.lib.licenses.lgpl21Plus;
     platforms = stdenv.lib.platforms.linux;
diff --git a/pkgs/tools/misc/bc/default.nix b/pkgs/tools/misc/bc/default.nix
index 922d34e2d36..111ab254acc 100644
--- a/pkgs/tools/misc/bc/default.nix
+++ b/pkgs/tools/misc/bc/default.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "GNU software calculator";
-    homepage = http://www.gnu.org/software/bc/;
+    homepage = https://www.gnu.org/software/bc/;
     license = stdenv.lib.licenses.gpl3;
     platforms = stdenv.lib.platforms.all;
   };
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index c465907fde8..0ddfad65a7a 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = http://www.gnu.org/software/coreutils/;
+    homepage = https://www.gnu.org/software/coreutils/;
     description = "The basic file, shell and text manipulation utilities of the GNU operating system";
 
     longDescription = ''
diff --git a/pkgs/tools/misc/datamash/default.nix b/pkgs/tools/misc/datamash/default.nix
index 064fd00cc27..d8591647ad3 100644
--- a/pkgs/tools/misc/datamash/default.nix
+++ b/pkgs/tools/misc/datamash/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A command-line program which performs basic numeric,textual and statistical operations on input textual data files";
-    homepage = http://www.gnu.org/software/datamash/;
+    homepage = https://www.gnu.org/software/datamash/;
     license = licenses.gpl3Plus;
     platforms = platforms.all;
     maintainers = with maintainers; [ pSub vrthra ];
diff --git a/pkgs/tools/misc/fileschanged/default.nix b/pkgs/tools/misc/fileschanged/default.nix
index f761c1ec4c5..6818bb708bb 100644
--- a/pkgs/tools/misc/fileschanged/default.nix
+++ b/pkgs/tools/misc/fileschanged/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = {
-    homepage = http://www.nongnu.org/fileschanged/;
+    homepage = https://www.nongnu.org/fileschanged/;
     description = "A command-line utility that reports when files have been altered";
     license = stdenv.lib.licenses.gpl3Plus;
 
diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix
index d19117d4dcd..9db66480cb1 100644
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   meta = {
-    homepage = http://www.gnu.org/software/findutils/;
+    homepage = https://www.gnu.org/software/findutils/;
     description = "GNU Find Utilities, the basic directory searching utilities of the GNU operating system";
 
     longDescription = ''
diff --git a/pkgs/tools/misc/grub/2.0x.nix b/pkgs/tools/misc/grub/2.0x.nix
index 481a07ef491..71d4abd9ca4 100644
--- a/pkgs/tools/misc/grub/2.0x.nix
+++ b/pkgs/tools/misc/grub/2.0x.nix
@@ -121,7 +121,7 @@ stdenv.mkDerivation rec {
          operating system (e.g., GNU).
       '';
 
-    homepage = http://www.gnu.org/software/grub/;
+    homepage = https://www.gnu.org/software/grub/;
 
     license = licenses.gpl3Plus;
 
diff --git a/pkgs/tools/misc/grub/trusted.nix b/pkgs/tools/misc/grub/trusted.nix
index 0e867d7cffd..d4d79c6e59f 100644
--- a/pkgs/tools/misc/grub/trusted.nix
+++ b/pkgs/tools/misc/grub/trusted.nix
@@ -21,7 +21,7 @@ let
 
   po_src = fetchurl {
     name = "grub-2.02-beta2.tar.gz";
-    url = "http://alpha.gnu.org/gnu/grub/grub-2.02~beta2.tar.gz";
+    url = "https://alpha.gnu.org/gnu/grub/grub-2.02~beta2.tar.gz";
     sha256 = "1lr9h3xcx0wwrnkxdnkfjwy08j7g7mdlmmbdip2db4zfgi69h0rm";
 
   };
diff --git a/pkgs/tools/misc/idutils/default.nix b/pkgs/tools/misc/idutils/default.nix
index 99f19889201..959be2a4eb1 100644
--- a/pkgs/tools/misc/idutils/default.nix
+++ b/pkgs/tools/misc/idutils/default.nix
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
       contents of certain character strings.
     '';
 
-    homepage = http://www.gnu.org/software/idutils/;
+    homepage = https://www.gnu.org/software/idutils/;
     license = stdenv.lib.licenses.gpl3Plus;
 
     maintainers = [ ];
diff --git a/pkgs/tools/misc/logstash/default.nix b/pkgs/tools/misc/logstash/default.nix
index 4f15ba90d39..9f3c441ffcd 100644
--- a/pkgs/tools/misc/logstash/default.nix
+++ b/pkgs/tools/misc/logstash/default.nix
@@ -16,8 +16,8 @@ stdenv.mkDerivation rec {
     url = "https://artifacts.elastic.co/downloads/logstash/${name}.tar.gz";
     sha256 =
       if enableUnfree
-      then "0yx9hpiav4d5z1b52x2h5i0iknqs9lmxy8vmz0wkb23mjiz8njdr"
-      else "1ir8pbq706mxr56k5cgc9ajn2jp603zrqj66dimx6xxf2nfamw0w";
+      then "01mkb9fr63m3ilp4cbbjccid5m8yc7iqhnli12ynfabsf7302fdz"
+      else "0r60183yyywabinsv9pkd8sx0wq68h740xi3172fypjfdcqs0g9c";
   };
 
   dontBuild         = true;
diff --git a/pkgs/tools/misc/ntfy/default.nix b/pkgs/tools/misc/ntfy/default.nix
new file mode 100644
index 00000000000..26517361ae2
--- /dev/null
+++ b/pkgs/tools/misc/ntfy/default.nix
@@ -0,0 +1,37 @@
+{ stdenv, pythonPackages, fetchFromGitHub }:
+
+pythonPackages.buildPythonApplication rec {
+  pname = "ntfy";
+  version = "2.7.0";
+
+  src = fetchFromGitHub {
+    owner = "dschep";
+    repo = "ntfy";
+    rev = "v${version}";
+    sha256 = "09f02cn4i1l2aksb3azwfb70axqhn7d0d0vl2r6640hqr74nc1cv";
+  };
+
+  checkInputs = with pythonPackages; [
+    mock
+  ];
+
+  propagatedBuildInputs = with pythonPackages; [
+    requests ruamel_yaml appdirs
+    sleekxmpp dns
+    emoji
+    psutil
+    matrix-client
+    dbus-python
+  ];
+
+  checkPhase = ''
+    HOME=$(mktemp -d) ${pythonPackages.python.interpreter} setup.py test
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A utility for sending notifications, on demand and when commands finish";
+    homepage = http://ntfy.rtfd.org/;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ jfrankenau kamilchm ];
+  };
+}
diff --git a/pkgs/tools/misc/parallel/default.nix b/pkgs/tools/misc/parallel/default.nix
index dfaca9cd88e..fec81b580f3 100644
--- a/pkgs/tools/misc/parallel/default.nix
+++ b/pkgs/tools/misc/parallel/default.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
          it possible to use output from GNU Parallel as input for other
          programs.
       '';
-    homepage = http://www.gnu.org/software/parallel/;
+    homepage = https://www.gnu.org/software/parallel/;
     license = licenses.gpl3Plus;
     platforms = platforms.all;
     maintainers = with maintainers; [ pSub vrthra ];
diff --git a/pkgs/tools/misc/parted/default.nix b/pkgs/tools/misc/parted/default.nix
index 709246269f8..4934252bed9 100644
--- a/pkgs/tools/misc/parted/default.nix
+++ b/pkgs/tools/misc/parted/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
       which also serves as a sample implementation and script backend.
     '';
 
-    homepage = http://www.gnu.org/software/parted/;
+    homepage = https://www.gnu.org/software/parted/;
     license = stdenv.lib.licenses.gpl3Plus;
 
     maintainers = [
diff --git a/pkgs/tools/misc/recutils/default.nix b/pkgs/tools/misc/recutils/default.nix
index 3dd3baed099..df53235d0ef 100644
--- a/pkgs/tools/misc/recutils/default.nix
+++ b/pkgs/tools/misc/recutils/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
          number of named fields.
       '';
 
-    homepage = http://www.gnu.org/software/recutils/;
+    homepage = https://www.gnu.org/software/recutils/;
 
     license = stdenv.lib.licenses.gpl3Plus;
 
diff --git a/pkgs/tools/misc/renameutils/default.nix b/pkgs/tools/misc/renameutils/default.nix
index 8b6fec8d021..b5e5d64dda6 100644
--- a/pkgs/tools/misc/renameutils/default.nix
+++ b/pkgs/tools/misc/renameutils/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   nativeBuildInputs = [ readline ];
 
   meta = {
-    homepage = http://www.nongnu.org/renameutils/;
+    homepage = https://www.nongnu.org/renameutils/;
     description = "A set of programs to make renaming of files faster";
     platforms = stdenv.lib.platforms.unix;
     license = stdenv.lib.licenses.gpl2Plus;
diff --git a/pkgs/tools/misc/screen/default.nix b/pkgs/tools/misc/screen/default.nix
index fd641ea613d..c7a630b837a 100644
--- a/pkgs/tools/misc/screen/default.nix
+++ b/pkgs/tools/misc/screen/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/screen/;
+    homepage = https://www.gnu.org/software/screen/;
     description = "A window manager that multiplexes a physical terminal";
     license = licenses.gpl2Plus;
 
diff --git a/pkgs/tools/misc/stow/default.nix b/pkgs/tools/misc/stow/default.nix
index 0468d2d8a63..18a6df657f5 100644
--- a/pkgs/tools/misc/stow/default.nix
+++ b/pkgs/tools/misc/stow/default.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation {
     '';
 
     license = stdenv.lib.licenses.gpl3Plus;
-    homepage = http://www.gnu.org/software/stow/;
+    homepage = https://www.gnu.org/software/stow/;
 
     maintainers = with stdenv.lib.maintainers; [ the-kenny jgeerds ];
     platforms = stdenv.lib.platforms.all;
diff --git a/pkgs/tools/misc/systrayhelper/default.nix b/pkgs/tools/misc/systrayhelper/default.nix
index e812d6799fe..73e144d93aa 100644
--- a/pkgs/tools/misc/systrayhelper/default.nix
+++ b/pkgs/tools/misc/systrayhelper/default.nix
@@ -2,16 +2,16 @@
 
 buildGoPackage rec {
   name = "systrayhelper-${version}";
-  version = "0.0.3";
-  rev = "0953942245566bf358ba937af840947100380e15";
+  version = "0.0.4";
+  rev = "ded1f2ed4d30f6ca2c89a13db0bd3046c6d6d0f9";
 
   goPackagePath = "github.com/ssbc/systrayhelper";
 
   src = fetchFromGitHub {
-    inherit rev;
+    rev = "v${version}";
     owner = "ssbc";
     repo = "systrayhelper";
-    sha256 = "12xmzcw94in4m1hl4hbfdsbvkkaqrljgb67b95m1qwkkjak3q9g6";
+    sha256 = "1iq643brha5q6w2v1hz5l3d1z0pqzqr43gpwih4cnx3m5br0wg2k";
   };
 
   goDeps = ./deps.nix;
diff --git a/pkgs/tools/misc/systrayhelper/deps.nix b/pkgs/tools/misc/systrayhelper/deps.nix
index 67ec6662d98..93c984337e6 100644
--- a/pkgs/tools/misc/systrayhelper/deps.nix
+++ b/pkgs/tools/misc/systrayhelper/deps.nix
@@ -59,8 +59,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/getlantern/systray";
-      rev =  "3fd1443dac5c8297999189fe28d5836b2b075b66";
-      sha256 = "1sb11n27zy8xmq0lvrpqikb53425jvwl5617cp201va6iwk1hgnh";
+      rev =  "e31397f8c6928d98a8a9a7e80087aebcf0090beb";
+      sha256 = "0ahb6qjd2c43nbbg0ssm76ilbzs9dq43a89f7fj6c029nympjmqn";
     };
   }
   {
@@ -86,8 +86,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/pkg/errors";
-      rev =  "c059e472caf75dbe73903f6521a20abac245b17f";
-      sha256 = "07xg8ym776j2w0k8445ii82lx8yz358cp1z96r739y13i1anqdzi";
+      rev =  "645ef00459ed84a119197bfb8d8205042c6df63d";
+      sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
     };
   }
   {
@@ -95,8 +95,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/sys";
-      rev =  "d0be0721c37eeb5299f245a996a483160fc36940";
-      sha256 = "081wyvfnlf842dqg03raxfz6lldlxpmyh1prix9lmrrm65arxb12";
+      rev =  "8e24a49d80f82323e1c4db1b5da3e0f31171a151";
+      sha256 = "0zsdnyb8dy98jw6f9yn6g5gdhaqwk39hqridr0mh4dhwvwvlj724";
     };
   }
-]
+]
\ No newline at end of file
diff --git a/pkgs/tools/misc/time/default.nix b/pkgs/tools/misc/time/default.nix
index 892afb4ee1c..8f297542a3c 100644
--- a/pkgs/tools/misc/time/default.nix
+++ b/pkgs/tools/misc/time/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     '';
 
     license = stdenv.lib.licenses.gpl3Plus;
-    homepage = http://www.gnu.org/software/time/;
+    homepage = https://www.gnu.org/software/time/;
     platforms = stdenv.lib.platforms.unix;
   };
 }
diff --git a/pkgs/tools/misc/uucp/default.nix b/pkgs/tools/misc/uucp/default.nix
index acb42a7a8d2..0fae40a5c96 100644
--- a/pkgs/tools/misc/uucp/default.nix
+++ b/pkgs/tools/misc/uucp/default.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
          just found one of the finest UUCP implementations available.
       '';
 
-    homepage = http://www.gnu.org/software/uucp/uucp.html;
+    homepage = https://www.gnu.org/software/uucp/uucp.html;
 
     license = stdenv.lib.licenses.gpl2Plus;
 
diff --git a/pkgs/tools/misc/vdirsyncer/default.nix b/pkgs/tools/misc/vdirsyncer/default.nix
index c273ef87968..49583ee2890 100644
--- a/pkgs/tools/misc/vdirsyncer/default.nix
+++ b/pkgs/tools/misc/vdirsyncer/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, python3Packages, glibcLocales, rustPlatform, pkgconfig, openssl }:
+{ stdenv, python3Packages, fetchpatch, glibcLocales, rustPlatform, pkgconfig, openssl, Security }:
 
 # Packaging documentation at:
 # https://github.com/untitaker/vdirsyncer/blob/master/docs/packaging.rst
@@ -16,7 +16,7 @@ let
     inherit src;
     sourceRoot = name + "/rust";
     cargoSha256 = "08xq9q5fx37azzkqqgwcnds1yd8687gh26dsl3ivql5h13fa2w3q";
-    buildInputs = [ pkgconfig openssl ];
+    buildInputs = [ pkgconfig openssl ] ++ stdenv.lib.optional stdenv.isDarwin Security;
   };
 in pythonPackages.buildPythonApplication rec {
   inherit version pname src native;
@@ -35,6 +35,21 @@ in pythonPackages.buildPythonApplication rec {
 
   checkInputs = with pythonPackages; [ hypothesis pytest pytest-localserver pytest-subtesthack ] ++ [ glibcLocales ];
 
+  patches = [
+    (fetchpatch {
+      url = https://github.com/pimutils/vdirsyncer/commit/80a42e4c6c18ca4db737bc6700c50a3866832bbb.patch;
+      sha256 = "1vrhn0ma3y08w6f5abhl3r5rq30g60h1bp3wmyszw909hyvyzp5l";
+    })
+    (fetchpatch {
+      url = https://github.com/pimutils/vdirsyncer/commit/22ad88a6b18b0979c5d1f1d610c1d2f8f87f4b89.patch;
+      sha256 = "0dbzj6jlxhdidnm3i21a758z83sdiwzhpd45pbkhycfhgmqmhjpl";
+    })
+    (fetchpatch {
+      url = https://github.com/pimutils/vdirsyncer/commit/29417235321c249c65904bc7948b066ef5683aee.patch;
+      sha256 = "0zvr0y88gm3vprjcdzs4m151laa9qhkyi61rvrfdjmf42fwhbm80";
+    })
+  ];
+
   postPatch = ''
     sed -i 's/spec.add_external_build(cmd=cmd/spec.add_external_build(cmd="true"/g' setup.py
   '';
diff --git a/pkgs/tools/misc/yubikey-manager/default.nix b/pkgs/tools/misc/yubikey-manager/default.nix
index 140e322c862..e80eee2db3a 100644
--- a/pkgs/tools/misc/yubikey-manager/default.nix
+++ b/pkgs/tools/misc/yubikey-manager/default.nix
@@ -2,11 +2,11 @@
   yubikey-personalization, libu2f-host, libusb1 }:
 
 pythonPackages.buildPythonPackage rec {
-  name = "yubikey-manager-1.0.0";
+  name = "yubikey-manager-1.0.1";
 
   srcs = fetchurl {
     url = "https://developers.yubico.com/yubikey-manager/Releases/${name}.tar.gz";
-    sha256 = "1qdb2b3mv4wafghnmv3sxw4fh7cjc06hnkdimfnwmqcjafzvbawd";
+    sha256 = "0i7w1f89hqlw7g800fjhbb6yvq9wjmj5d7w7p6v8bkyvk645v48z";
   };
 
   propagatedBuildInputs =
@@ -26,12 +26,13 @@ pythonPackages.buildPythonPackage rec {
     ];
 
   makeWrapperArgs = [
-    "--prefix LD_LIBRARY_PATH : ${libu2f-host}/lib:${libusb1}/lib:${yubikey-personalization}/lib"
+    "--prefix" "LD_LIBRARY_PATH" ":"
+    (lib.makeLibraryPath [ libu2f-host libusb1 yubikey-personalization ])
   ];
 
   postInstall = ''
-    mkdir -p $out/etc/bash_completion.d
-    _YKMAN_COMPLETE=source $out/bin/ykman > $out/etc/bash_completion.d/ykman.sh ||true
+    mkdir -p $out/share/bash-completion/completions
+    _YKMAN_COMPLETE=source $out/bin/ykman > $out/share/bash-completion/completions/ykman || :
   '';
 
   # See https://github.com/NixOS/nixpkgs/issues/29169
@@ -40,6 +41,7 @@ pythonPackages.buildPythonPackage rec {
   meta = with lib; {
     homepage = https://developers.yubico.com/yubikey-manager;
     description = "Command line tool for configuring any YubiKey over all USB transports.";
+
     license = licenses.bsd2;
     platforms = platforms.unix;
     maintainers = with maintainers; [ benley ];
diff --git a/pkgs/tools/networking/dropbear/default.nix b/pkgs/tools/networking/dropbear/default.nix
index be2e43a8947..32d55d2009a 100644
--- a/pkgs/tools/networking/dropbear/default.nix
+++ b/pkgs/tools/networking/dropbear/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
 
   CFLAGS = "-DSFTPSERVER_PATH=\\\"${sftpPath}\\\"";
 
-  # http://www.gnu.org/software/make/manual/html_node/Libraries_002fSearch.html
+  # https://www.gnu.org/software/make/manual/html_node/Libraries_002fSearch.html
   preConfigure = ''
     makeFlags=VPATH=`cat $NIX_CC/nix-support/orig-libc`/lib
   '';
diff --git a/pkgs/tools/networking/flvstreamer/default.nix b/pkgs/tools/networking/flvstreamer/default.nix
index 02d3bebcd30..b5e61bee4df 100644
--- a/pkgs/tools/networking/flvstreamer/default.nix
+++ b/pkgs/tools/networking/flvstreamer/default.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
     license = stdenv.lib.licenses.gpl2Plus;
 
-    homepage = http://savannah.nongnu.org/projects/flvstreamer;
+    homepage = https://savannah.nongnu.org/projects/flvstreamer;
 
     maintainers = [ stdenv.lib.maintainers.thammers ];
     platforms = with stdenv.lib.platforms; linux ++ darwin;
diff --git a/pkgs/tools/networking/gandi-cli/default.nix b/pkgs/tools/networking/gandi-cli/default.nix
index be488e788b4..99db0ab2507 100644
--- a/pkgs/tools/networking/gandi-cli/default.nix
+++ b/pkgs/tools/networking/gandi-cli/default.nix
@@ -1,17 +1,16 @@
-{ stdenv, pythonPackages, fetchFromGitHub }:
+{ stdenv, python3Packages, fetchFromGitHub }:
 
-with pythonPackages;
+with python3Packages;
 
-buildPythonPackage rec {
-  namePrefix = "";
-  name = "gandi-cli-${version}";
-  version = "0.19";
+buildPythonApplication rec {
+  pname = "gandi-cli";
+  version = "1.3";
 
   src = fetchFromGitHub {
-    sha256 = "0xbf97p75zl6sjxqcgmaa4p5rax2h6ixn8srwdr4rsx2zz9dpwgp";
-    rev = version;
-    repo = "gandi.cli";
     owner = "Gandi";
+    repo = "gandi.cli";
+    rev = version;
+    sha256 = "07i1y88j5awsw7qadk7gnmax8mi7vgh1nflnc8j54z53fjyamlcs";
   };
 
   propagatedBuildInputs = [ click ipy pyyaml requests ];
@@ -22,6 +21,6 @@ buildPythonPackage rec {
     description = "Command-line interface to the public Gandi.net API";
     homepage = http://cli.gandi.net/;
     license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ ckampka ];
   };
 }
-
diff --git a/pkgs/tools/networking/inetutils/default.nix b/pkgs/tools/networking/inetutils/default.nix
index c050758a8ee..1d2bfdc9118 100644
--- a/pkgs/tools/networking/inetutils/default.nix
+++ b/pkgs/tools/networking/inetutils/default.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
          traceroute, uucpd, and whois.
       '';
 
-    homepage = http://www.gnu.org/software/inetutils/;
+    homepage = https://www.gnu.org/software/inetutils/;
     license = licenses.gpl3Plus;
 
     maintainers = with maintainers; [ matthewbauer ];
diff --git a/pkgs/tools/networking/jwhois/default.nix b/pkgs/tools/networking/jwhois/default.nix
index be8e9e210d1..e9f43da981c 100644
--- a/pkgs/tools/networking/jwhois/default.nix
+++ b/pkgs/tools/networking/jwhois/default.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "A client for the WHOIS protocol allowing you to query the owner of a domain name";
-    homepage = http://www.gnu.org/software/jwhois/;
+    homepage = https://www.gnu.org/software/jwhois/;
     license = stdenv.lib.licenses.gpl3;
     platforms = stdenv.lib.platforms.unix;
   };
diff --git a/pkgs/tools/networking/mailutils/default.nix b/pkgs/tools/networking/mailutils/default.nix
index f4e14d98248..d6c67005295 100644
--- a/pkgs/tools/networking/mailutils/default.nix
+++ b/pkgs/tools/networking/mailutils/default.nix
@@ -118,7 +118,7 @@ stdenv.mkDerivation rec {
 
     maintainers = with maintainers; [ orivej vrthra ];
 
-    homepage = http://www.gnu.org/software/mailutils/;
+    homepage = https://www.gnu.org/software/mailutils/;
 
     # Some of the dependencies fail to build on {cyg,dar}win.
     platforms = platforms.gnu ++ platforms.linux;
diff --git a/pkgs/tools/networking/network-manager/applet.nix b/pkgs/tools/networking/network-manager/applet.nix
index 406cf0a04ea..9f1b5008507 100644
--- a/pkgs/tools/networking/network-manager/applet.nix
+++ b/pkgs/tools/networking/network-manager/applet.nix
@@ -28,7 +28,7 @@ in stdenv.mkDerivation rec {
     gnome3.gtk networkmanager libnotify libsecret gsettings-desktop-schemas
     polkit isocodes mobile-broadband-provider-info libgudev
     modemmanager jansson glib-networking
-    libappindicator-gtk3
+    libappindicator-gtk3 gnome3.defaultIconTheme
   ] ++ stdenv.lib.optionals withGnome [ gnome3.gcr ]; # advanced certificate chooser
 
   nativeBuildInputs = [ meson ninja intltool pkgconfig wrapGAppsHook gobject-introspection python3 gtk-doc docbook_xsl docbook_xml_dtd_43 libxml2 ];
diff --git a/pkgs/tools/networking/wget/default.nix b/pkgs/tools/networking/wget/default.nix
index 93f02f32cee..077e440d27a 100644
--- a/pkgs/tools/networking/wget/default.nix
+++ b/pkgs/tools/networking/wget/default.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
 
     license = licenses.gpl3Plus;
 
-    homepage = http://www.gnu.org/software/wget/;
+    homepage = https://www.gnu.org/software/wget/;
 
     maintainers = with maintainers; [ fpletz ];
     platforms = platforms.all;
diff --git a/pkgs/tools/package-management/nix-pin/default.nix b/pkgs/tools/package-management/nix-pin/default.nix
index f5d62b250e2..063c173a401 100644
--- a/pkgs/tools/package-management/nix-pin/default.nix
+++ b/pkgs/tools/package-management/nix-pin/default.nix
@@ -26,6 +26,7 @@ let self = stdenv.mkDerivation rec {
         let impl = import "${self}/share/nix/api.nix" { inherit pkgs pinConfig; }; in
         { inherit (impl) augmentedPkgs pins callPackage; };
       updateScript = ''
+        #!${stdenv.shell}
         set -e
         echo
         cd ${toString ./.}
diff --git a/pkgs/tools/package-management/nix-update-source/default.nix b/pkgs/tools/package-management/nix-update-source/default.nix
index e7eb497b4b9..7584496f258 100644
--- a/pkgs/tools/package-management/nix-update-source/default.nix
+++ b/pkgs/tools/package-management/nix-update-source/default.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, fetchFromGitHub, python3Packages, nix-prefetch-scripts }:
+{ stdenv, lib, pkgs, fetchFromGitHub, python3Packages, nix-prefetch-scripts }:
 python3Packages.buildPythonApplication rec {
   version = "0.6.3";
   name = "nix-update-source-${version}";
@@ -28,6 +28,7 @@ python3Packages.buildPythonApplication rec {
         overrideSrc = drv: lib.overrideDerivation drv (orig: { inherit src; });
       };
     updateScript = ''
+      #!${stdenv.shell}
       set -e
       echo
       cd ${toString ./.}
diff --git a/pkgs/tools/security/gnu-pw-mgr/default.nix b/pkgs/tools/security/gnu-pw-mgr/default.nix
index d58585c4069..2139b7c84af 100644
--- a/pkgs/tools/security/gnu-pw-mgr/default.nix
+++ b/pkgs/tools/security/gnu-pw-mgr/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "gnu-pw-mgr-${version}";
   version = "2.4.2";
   src = fetchurl {
-    url = "http://ftp.gnu.org/gnu/gnu-pw-mgr/${name}.tar.xz";
+    url = "https://ftp.gnu.org/gnu/gnu-pw-mgr/${name}.tar.xz";
     sha256 = "1yvdzc5w37qrjrkby5699ygj9bhkvgi3zk9k9jcjry1j6b7wdl17";
   };
 
diff --git a/pkgs/tools/security/monkeysphere/default.nix b/pkgs/tools/security/monkeysphere/default.nix
index 0cf59dc555c..b1c36871fe6 100644
--- a/pkgs/tools/security/monkeysphere/default.nix
+++ b/pkgs/tools/security/monkeysphere/default.nix
@@ -31,8 +31,10 @@ stdenv.mkDerivation rec {
     DESTDIR=$(out)
   '';
 
-  # Not all checks pass yet (NixOS specific problems) and the tests "drain"
-  # entropy (apparently GnuPG still uses /dev/random).
+  # The tests "drain" entropy (GnuPG still uses /dev/random) and they don't run
+  # inside of the sandbox, because nixbld isn't allowed to login via SSH
+  # (/etc/passwd: "nixbld:x:1000:100:Nix build user:/build:/noshell",
+  # sshd: "User nixbld not allowed because shell /noshell does not exist").
   doCheck = false;
   preCheck = ''
     patchShebangs tests/
diff --git a/pkgs/tools/security/oath-toolkit/default.nix b/pkgs/tools/security/oath-toolkit/default.nix
index 9bd3f372672..03233917e2a 100644
--- a/pkgs/tools/security/oath-toolkit/default.nix
+++ b/pkgs/tools/security/oath-toolkit/default.nix
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Components for building one-time password authentication systems";
-    homepage = http://www.nongnu.org/oath-toolkit/;
+    homepage = https://www.nongnu.org/oath-toolkit/;
     platforms = with platforms; linux ++ darwin;
   };
 }
diff --git a/pkgs/tools/system/acct/default.nix b/pkgs/tools/system/acct/default.nix
index ca8fbdcf031..669c91adf10 100644
--- a/pkgs/tools/system/acct/default.nix
+++ b/pkgs/tools/system/acct/default.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
     license = licenses.gpl3Plus;
 
-    homepage = http://www.gnu.org/software/acct/;
+    homepage = https://www.gnu.org/software/acct/;
 
     maintainers = with maintainers; [ pSub ];
     platforms = platforms.linux;
diff --git a/pkgs/tools/system/ddrescue/default.nix b/pkgs/tools/system/ddrescue/default.nix
index 6c852efe96e..22348ea6ebc 100644
--- a/pkgs/tools/system/ddrescue/default.nix
+++ b/pkgs/tools/system/ddrescue/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
          second and successive copies.
       '';
 
-    homepage = http://www.gnu.org/software/ddrescue/ddrescue.html;
+    homepage = https://www.gnu.org/software/ddrescue/ddrescue.html;
 
     license = licenses.gpl3Plus;
 
diff --git a/pkgs/tools/system/fdisk/default.nix b/pkgs/tools/system/fdisk/default.nix
index 9a4ac260ecc..0aea3ced3b5 100644
--- a/pkgs/tools/system/fdisk/default.nix
+++ b/pkgs/tools/system/fdisk/default.nix
@@ -1,7 +1,7 @@
 { fetchurl, stdenv, parted, libuuid, gettext, guile }:
 
 stdenv.mkDerivation rec {
-  name = "gnufdisk-2.0.0a"; # .0a1 seems broken, see http://lists.gnu.org/archive/html/bug-fdisk/2012-09/msg00000.html
+  name = "gnufdisk-2.0.0a"; # .0a1 seems broken, see https://lists.gnu.org/archive/html/bug-fdisk/2012-09/msg00000.html
 
   src = fetchurl {
     url = "mirror://gnu/fdisk/${name}.tar.gz";
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
     license = stdenv.lib.licenses.gpl3Plus;
 
-    homepage = http://www.gnu.org/software/fdisk/;
+    homepage = https://www.gnu.org/software/fdisk/;
 
     platforms = stdenv.lib.platforms.linux;
   };
diff --git a/pkgs/tools/system/freeipmi/default.nix b/pkgs/tools/system/freeipmi/default.nix
index 9c7a5b36c5b..5fd4136e3c2 100644
--- a/pkgs/tools/system/freeipmi/default.nix
+++ b/pkgs/tools/system/freeipmi/default.nix
@@ -30,8 +30,8 @@ stdenv.mkDerivation rec {
          info.
       '';
 
-    homepage = http://www.gnu.org/software/freeipmi/;
-    downloadPage = "http://www.gnu.org/software/freeipmi/download.html";
+    homepage = https://www.gnu.org/software/freeipmi/;
+    downloadPage = "https://www.gnu.org/software/freeipmi/download.html";
 
     license = stdenv.lib.licenses.gpl3Plus;
 
diff --git a/pkgs/tools/system/mcron/default.nix b/pkgs/tools/system/mcron/default.nix
index dbc679eb8ad..1831041063b 100644
--- a/pkgs/tools/system/mcron/default.nix
+++ b/pkgs/tools/system/mcron/default.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
       when jobs should be run.  Mcron was written by Dale Mellor.
     '';
 
-    homepage = http://www.gnu.org/software/mcron/;
+    homepage = https://www.gnu.org/software/mcron/;
 
     license = stdenv.lib.licenses.gpl3Plus;
     platforms = stdenv.lib.platforms.unix;
diff --git a/pkgs/tools/system/s-tui/default.nix b/pkgs/tools/system/s-tui/default.nix
index 35a26eb7dae..5d4ed355ba9 100644
--- a/pkgs/tools/system/s-tui/default.nix
+++ b/pkgs/tools/system/s-tui/default.nix
@@ -3,11 +3,11 @@
 pythonPackages.buildPythonPackage rec {
   name = "${pname}-${version}";
   pname = "s-tui";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = pythonPackages.fetchPypi {
     inherit pname version;
-    sha256 = "18bn0bpnrljx11gj95m2x5hlsnb8jkivlm6b1xx035ldgj1svgzh";
+    sha256 = "00lsh2v4i8rwfyjyxx5lijd6rnk9smcfffhzg5sv94ijpcnh216m";
   };
 
   propagatedBuildInputs = with pythonPackages; [
diff --git a/pkgs/tools/system/which/default.nix b/pkgs/tools/system/which/default.nix
index 870e1b3a398..be2892e52e8 100644
--- a/pkgs/tools/system/which/default.nix
+++ b/pkgs/tools/system/which/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = http://ftp.gnu.org/gnu/which/;
+    homepage = https://www.gnu.org/software/which/;
     platforms = platforms.all;
     license = licenses.gpl3;
   };
diff --git a/pkgs/tools/text/diffutils/default.nix b/pkgs/tools/text/diffutils/default.nix
index fff81fbc860..68b2e512101 100644
--- a/pkgs/tools/text/diffutils/default.nix
+++ b/pkgs/tools/text/diffutils/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
     ++ stdenv.lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "gl_cv_func_getopt_gnu=yes";
 
   meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/diffutils/diffutils.html;
+    homepage = https://www.gnu.org/software/diffutils/diffutils.html;
     description = "Commands for showing the differences between files (diff, cmp, etc.)";
     license = licenses.gpl3;
     platforms = platforms.unix;
diff --git a/pkgs/tools/text/enscript/default.nix b/pkgs/tools/text/enscript/default.nix
index 37121e68f66..24ac649026a 100644
--- a/pkgs/tools/text/enscript/default.nix
+++ b/pkgs/tools/text/enscript/default.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
     license = stdenv.lib.licenses.gpl3Plus;
 
-    homepage = http://www.gnu.org/software/enscript/;
+    homepage = https://www.gnu.org/software/enscript/;
 
     maintainers = [ ];
     platforms = stdenv.lib.platforms.all;
diff --git a/pkgs/tools/text/gawk/default.nix b/pkgs/tools/text/gawk/default.nix
index 33ce5a0fdb8..f0947004b4b 100644
--- a/pkgs/tools/text/gawk/default.nix
+++ b/pkgs/tools/text/gawk/default.nix
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   };
 
   meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/gawk/;
+    homepage = https://www.gnu.org/software/gawk/;
     description = "GNU implementation of the Awk programming language";
 
     longDescription = ''
diff --git a/pkgs/tools/text/gnugrep/default.nix b/pkgs/tools/text/gnugrep/default.nix
index 089f3094b54..0b6f36bea72 100644
--- a/pkgs/tools/text/gnugrep/default.nix
+++ b/pkgs/tools/text/gnugrep/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation {
     '';
 
   meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/grep/;
+    homepage = https://www.gnu.org/software/grep/;
     description = "GNU implementation of the Unix grep command";
 
     longDescription = ''
diff --git a/pkgs/tools/text/gnupatch/default.nix b/pkgs/tools/text/gnupatch/default.nix
index 238dba3a9f1..edea95d7d69 100644
--- a/pkgs/tools/text/gnupatch/default.nix
+++ b/pkgs/tools/text/gnupatch/default.nix
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
          more original files, producing patched versions.
       '';
 
-    homepage = http://savannah.gnu.org/projects/patch;
+    homepage = https://savannah.gnu.org/projects/patch;
 
     license = stdenv.lib.licenses.gpl3Plus;
 
diff --git a/pkgs/tools/text/gnused/422.nix b/pkgs/tools/text/gnused/422.nix
index 16d4f20fe8e..3a9856c3dd3 100644
--- a/pkgs/tools/text/gnused/422.nix
+++ b/pkgs/tools/text/gnused/422.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation {
   outputs = [ "out" "info" ];
 
   meta = {
-    homepage = http://www.gnu.org/software/sed/;
+    homepage = https://www.gnu.org/software/sed/;
     description = "GNU sed, a batch stream editor";
 
     longDescription = ''
diff --git a/pkgs/tools/text/gnused/default.nix b/pkgs/tools/text/gnused/default.nix
index 4bdddb8c50b..4fa1a44f4ae 100644
--- a/pkgs/tools/text/gnused/default.nix
+++ b/pkgs/tools/text/gnused/default.nix
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   PERL = if stdenv.hostPlatform == stdenv.buildPlatform then null else "missing";
 
   meta = {
-    homepage = http://www.gnu.org/software/sed/;
+    homepage = https://www.gnu.org/software/sed/;
     description = "GNU sed, a batch stream editor";
 
     longDescription = ''
diff --git a/pkgs/tools/text/groff/default.nix b/pkgs/tools/text/groff/default.nix
index ab0f8893bfd..88d487da9b9 100644
--- a/pkgs/tools/text/groff/default.nix
+++ b/pkgs/tools/text/groff/default.nix
@@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    homepage = http://www.gnu.org/software/groff/;
+    homepage = https://www.gnu.org/software/groff/;
     description = "GNU Troff, a typesetting package that reads plain text and produces formatted output";
     license = licenses.gpl3Plus;
     platforms = platforms.all;
diff --git a/pkgs/tools/text/numdiff/default.nix b/pkgs/tools/text/numdiff/default.nix
index 4741fecb90c..1320f824fdf 100644
--- a/pkgs/tools/text/numdiff/default.nix
+++ b/pkgs/tools/text/numdiff/default.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
       line by line and field by field, ignoring small numeric differences
       or/and different numeric formats
     '';
-    homepage = http://www.nongnu.org/numdiff/;
+    homepage = https://www.nongnu.org/numdiff/;
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ ndowens ];
     platforms = platforms.gnu ++ platforms.linux;
diff --git a/pkgs/tools/text/poedit/default.nix b/pkgs/tools/text/poedit/default.nix
index 5ed59ff12c3..53d8cf8a8a2 100644
--- a/pkgs/tools/text/poedit/default.nix
+++ b/pkgs/tools/text/poedit/default.nix
@@ -4,7 +4,7 @@ stdenv.mkDerivation rec {
   name = "poedit-1.5.7";
 
   src = fetchurl {
-    url = "http://prdownloads.sourceforge.net/poedit/${name}.tar.gz";
+    url = "mirror://sourceforge/poedit/${name}.tar.gz";
     sha256 = "0y0gbkb1jvp61qhh8sh7ar8849mwirizc42pk57zpxy84an5qlr4";
   };
 
diff --git a/pkgs/tools/text/recode/default.nix b/pkgs/tools/text/recode/default.nix
index f097ed5c0fa..9edbaff9929 100644
--- a/pkgs/tools/text/recode/default.nix
+++ b/pkgs/tools/text/recode/default.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = http://www.gnu.org/software/recode/;
+    homepage = https://www.gnu.org/software/recode/;
     description = "Converts files between various character sets and usages";
     platforms = stdenv.lib.platforms.unix;
     license = stdenv.lib.licenses.gpl2Plus;
diff --git a/pkgs/tools/text/source-highlight/default.nix b/pkgs/tools/text/source-highlight/default.nix
index dc297afc9ad..d1858d6508d 100644
--- a/pkgs/tools/text/source-highlight/default.nix
+++ b/pkgs/tools/text/source-highlight/default.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Source code renderer with syntax highlighting";
-    homepage = http://www.gnu.org/software/src-highlite/;
+    homepage = https://www.gnu.org/software/src-highlite/;
     license = stdenv.lib.licenses.gpl3Plus;
     platforms = with stdenv.lib.platforms; linux ++ darwin;
     longDescription =
diff --git a/pkgs/tools/text/wdiff/default.nix b/pkgs/tools/text/wdiff/default.nix
index df2ef215069..001ed1addaa 100644
--- a/pkgs/tools/text/wdiff/default.nix
+++ b/pkgs/tools/text/wdiff/default.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   checkInputs = [ which ];
 
   meta = {
-    homepage = http://www.gnu.org/software/wdiff/;
+    homepage = https://www.gnu.org/software/wdiff/;
     description = "Comparing files on a word by word basis";
     license = stdenv.lib.licenses.gpl3Plus;
     maintainers = [ stdenv.lib.maintainers.eelco ];
diff --git a/pkgs/tools/typesetting/lout/default.nix b/pkgs/tools/typesetting/lout/default.nix
index 09aed52265b..85c0bacf315 100644
--- a/pkgs/tools/typesetting/lout/default.nix
+++ b/pkgs/tools/typesetting/lout/default.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
       "mirror://savannah/lout/${name}.tar.gz"      # new!
       "mirror://sourceforge/lout/${name}.tar.gz"   # to be phased out
       # XXX: We could add the CTAN mirrors
-      # (see http://www.ctan.org/tex-archive/support/lout/).
+      # (see https://www.ctan.org/tex-archive/support/lout/).
     ];
     sha256 = "1gb8vb1wl7ikn269dd1c7ihqhkyrwk19jwx5kd0rdvbk6g7g25ix";
   };
@@ -40,9 +40,9 @@ stdenv.mkDerivation rec {
       went back to the beginning.
     '';
 
-    # Author's page: http://www.cs.usyd.edu.au/~jeff/
-    # Wiki: http://lout.wiki.sourceforge.net/
-    homepage = http://savannah.nongnu.org/projects/lout/;
+    # Author's page: http://jeffreykingston.id.au/lout/
+    # Wiki: https://sourceforge.net/p/lout/wiki/
+    homepage = https://savannah.nongnu.org/projects/lout/;
 
     license = stdenv.lib.licenses.gpl3Plus;
 
diff --git a/pkgs/tools/typesetting/tex/auctex/default.nix b/pkgs/tools/typesetting/tex/auctex/default.nix
index b8682260976..5444914f7a4 100644
--- a/pkgs/tools/typesetting/tex/auctex/default.nix
+++ b/pkgs/tools/typesetting/tex/auctex/default.nix
@@ -30,7 +30,7 @@ let auctex = stdenv.mkDerivation ( rec {
 
   meta = {
     description = "Extensible package for writing and formatting TeX files in GNU Emacs and XEmacs";
-    homepage = http://www.gnu.org/software/auctex;
+    homepage = https://www.gnu.org/software/auctex;
     platforms = stdenv.lib.platforms.unix;
     license = stdenv.lib.licenses.gpl3;
   };
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b24d22bb017..59d4f69004a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -294,8 +294,8 @@ with pkgs;
     ... # For hash agility
   }@args: fetchzip ({
     inherit name;
-    url = "http://git.savannah.gnu.org/cgit/${repo}.git/snapshot/${repo}-${rev}.tar.gz";
-    meta.homepage = "http://git.savannah.gnu.org/cgit/${repo}.git/";
+    url = "https://git.savannah.gnu.org/cgit/${repo}.git/snapshot/${repo}-${rev}.tar.gz";
+    meta.homepage = "https://git.savannah.gnu.org/cgit/${repo}.git/";
   } // removeAttrs args [ "repo" "rev" ]) // { inherit rev; };
 
   # gitlab example
@@ -611,6 +611,8 @@ with pkgs;
 
   aws-env = callPackage ../tools/admin/aws-env { };
 
+  aws-google-auth = pythonPackages.callPackage ../tools/admin/aws-google-auth { };
+
   aws-okta = callPackage ../tools/security/aws-okta { };
 
   aws-rotate-key = callPackage ../tools/admin/aws-rotate-key { };
@@ -919,7 +921,8 @@ with pkgs;
     filebeat6
     heartbeat6
     metricbeat6
-    packetbeat6;
+    packetbeat6
+    journalbeat6;
 
   filebeat = filebeat6;
   heartbeat = heartbeat6;
@@ -2453,7 +2456,7 @@ with pkgs;
 
   # The latest version used by elasticsearch, logstash, kibana and the the beats from elastic.
   elk5Version = "5.6.9";
-  elk6Version = "6.3.2";
+  elk6Version = "6.5.1";
 
   elasticsearch5 = callPackage ../servers/search/elasticsearch/5.x.nix { };
   elasticsearch6 = callPackage ../servers/search/elasticsearch { };
@@ -4487,7 +4490,7 @@ with pkgs;
   # ntfsprogs are merged into ntfs-3g
   ntfsprogs = pkgs.ntfs3g;
 
-  ntfy = pythonPackages.ntfy;
+  ntfy = callPackage ../tools/misc/ntfy {};
 
   ntopng = callPackage ../tools/networking/ntopng { };
 
@@ -8920,6 +8923,8 @@ with pkgs;
   scons = sconsPackages.scons_3_0_1;
   scons_2_5_1 = sconsPackages.scons_2_5_1;
 
+  mill = callPackage ../development/tools/build-managers/mill { };
+
   sbt = callPackage ../development/tools/build-managers/sbt { };
   sbt-with-scala-native = callPackage ../development/tools/build-managers/sbt/scala-native.nix { };
   simpleBuildTool = sbt;
@@ -10194,6 +10199,8 @@ with pkgs;
 
   hyena = callPackage ../development/libraries/hyena { mono = mono4; };
 
+  hyperscan = callPackage ../development/libraries/hyperscan { };
+
   icu58 = callPackage (import ../development/libraries/icu/58.nix fetchurl) ({
     nativeBuildRoot = buildPackages.icu58.override { buildRootOnly = true; };
   } //
@@ -11684,6 +11691,7 @@ with pkgs;
 
   opencv3 = callPackage ../development/libraries/opencv/3.x.nix {
     enableCuda = config.cudaSupport or false;
+    inherit (darwin) cf-private;
     inherit (darwin.apple_sdk.frameworks) AVFoundation Cocoa QTKit VideoDecodeAcceleration;
   };
 
@@ -11691,6 +11699,12 @@ with pkgs;
     enableCuda = false;
   };
 
+  opencv4 = callPackage ../development/libraries/opencv/4.x.nix {
+    enableCuda = config.cudaSupport or false;
+    inherit (darwin) cf-private;
+    inherit (darwin.apple_sdk.frameworks) AVFoundation Cocoa QTKit VideoDecodeAcceleration;
+  };
+
   openexr = callPackage ../development/libraries/openexr { };
 
   openexrid-unstable = callPackage ../development/libraries/openexrid-unstable { };
@@ -14372,16 +14386,6 @@ with pkgs;
       ];
   };
 
-  linux_4_18 = callPackage ../os-specific/linux/kernel/linux-4.18.nix {
-    kernelPatches =
-      [ kernelPatches.bridge_stp_helper
-        # See pkgs/os-specific/linux/kernel/cpu-cgroup-v2-patches/README.md
-        # when adding a new linux version
-        # kernelPatches.cpu-cgroup-v2."4.11"
-        kernelPatches.modinst_arg_list_too_long
-      ];
-  };
-
   linux_4_19 = callPackage ../os-specific/linux/kernel/linux-4.19.nix {
     kernelPatches =
       [ kernelPatches.bridge_stp_helper
@@ -14577,7 +14581,6 @@ with pkgs;
   linuxPackages_4_4 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_4);
   linuxPackages_4_9 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_9);
   linuxPackages_4_14 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_14);
-  linuxPackages_4_18 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_18);
   linuxPackages_4_19 = recurseIntoAttrs (linuxPackagesFor pkgs.linux_4_19);
   # Don't forget to update linuxPackages_latest!
 
@@ -15429,6 +15432,8 @@ with pkgs;
 
   medio = callPackage ../data/fonts/medio { };
 
+  mnist = callPackage ../data/machine-learning/mnist { };
+
   mobile-broadband-provider-info = callPackage ../data/misc/mobile-broadband-provider-info { };
 
   monoid = callPackage ../data/fonts/monoid { };
@@ -19494,7 +19499,9 @@ with pkgs;
 
   vcv-rack = callPackage ../applications/audio/vcv-rack { };
 
-  vdirsyncer = callPackage ../tools/misc/vdirsyncer { };
+  vdirsyncer = callPackage ../tools/misc/vdirsyncer {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   vdpauinfo = callPackage ../tools/X11/vdpauinfo { };
 
@@ -21925,6 +21932,8 @@ with pkgs;
 
   beep = callPackage ../misc/beep { };
 
+  bees = callPackage ../tools/filesystems/bees { };
+
   blackbird = callPackage ../misc/themes/blackbird { };
 
   bootil = callPackage ../development/libraries/bootil { };
@@ -23014,7 +23023,7 @@ with pkgs;
     avrgcc = pkgsCross.avr.buildPackages.gcc;
     avrbinutils = pkgsCross.avr.buildPackages.binutils;
     gcc-arm-embedded = pkgsCross.arm-embedded.buildPackages.gcc;
-    binutils-arm-embedded = pkgsCross.arm-embedded.buildPackages.binutils;
+    gcc-armhf-embedded = pkgsCross.armhf-embedded.buildPackages.gcc;
   };
 
   newlib = callPackage ../development/misc/newlib { };
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index d1e0ab011be..188ab06b969 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -88,7 +88,9 @@ in rec {
   coqPackages_8_7 = mkCoqPackages coq_8_7;
   coqPackages_8_8 = mkCoqPackages coq_8_8;
   coqPackages_8_9 = mkCoqPackages coq_8_9;
-  coqPackages = coqPackages_8_8;
+  coqPackages = recurseIntoAttrs (lib.mapDerivationAttrset lib.dontDistribute
+    coqPackages_8_8
+  );
   coq = coqPackages.coq;
 
 }
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index cf06b52c5ba..197051f3c2e 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -131,6 +131,9 @@ let
 
     bin_prot_p4 = callPackage ../development/ocaml-modules/bin_prot { };
 
+    bisect_ppx = callPackage ../development/ocaml-modules/bisect_ppx { };
+    bisect_ppx-ocamlbuild = callPackage ../development/ocaml-modules/bisect_ppx-ocamlbuild { };
+
     ocaml_cairo = callPackage ../development/ocaml-modules/ocaml-cairo { };
 
     cairo2 = callPackage ../development/ocaml-modules/cairo2 { };
@@ -552,6 +555,8 @@ let
 
     opam-file-format = callPackage ../development/ocaml-modules/opam-file-format { };
 
+    opti = callPackage ../development/ocaml-modules/opti { };
+
     otfm = callPackage ../development/ocaml-modules/otfm { };
 
     otr = callPackage ../development/ocaml-modules/otr { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a93bae80a82..ef1d1d40ad6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1327,6 +1327,11 @@ in {
     pythonPackages = self;
   });
 
+  opencv4 = toPythonModule (pkgs.opencv4.override {
+    enablePython = true;
+    pythonPackages = self;
+  });
+
   openidc-client = callPackage ../development/python-modules/openidc-client {};
 
   idna = callPackage ../development/python-modules/idna { };
@@ -3126,8 +3131,6 @@ in {
 
   emoji = callPackage ../development/python-modules/emoji { };
 
-  ntfy = callPackage ../development/python-modules/ntfy { };
-
   ntplib = callPackage ../development/python-modules/ntplib { };
 
   numba = callPackage ../development/python-modules/numba { };