Merge master into staging-next

2019-04-29 13:46:20 +02:00 · 2019-04-29 13:46:20 +02:00 · 2f936f85d8
parent ee5f4636b0 6dabc28cd0
commit 2f936f85d8
201 changed files with 6657 additions and 1860 deletions
--- a/README.md
+++ b/README.md
@ -12,12 +12,12 @@ build daemon as so-called channels. To get channel information via git, add
 ```

 For stability and maximum binary package support, it is recommended to maintain
-custom changes on top of one of the channels, e.g. `nixos-18.09` for the latest
+custom changes on top of one of the channels, e.g. `nixos-19.03` for the latest
 release and `nixos-unstable` for the latest successful build of master:

 ```
 % git remote update channels
-% git rebase channels/nixos-18.09
+% git rebase channels/nixos-19.03
 ```

 For pull requests, please rebase onto nixpkgs `master`.
@ -31,9 +31,9 @@ For pull requests, please rebase onto nixpkgs `master`.
 * [Manual (NixOS)](https://nixos.org/nixos/manual/)
 * [Community maintained wiki](https://nixos.wiki/)
 * [Continuous package builds for unstable/master](https://hydra.nixos.org/jobset/nixos/trunk-combined)
-* [Continuous package builds for 18.09 release](https://hydra.nixos.org/jobset/nixos/release-18.09)
+* [Continuous package builds for 19.03 release](https://hydra.nixos.org/jobset/nixos/release-19.03)
 * [Tests for unstable/master](https://hydra.nixos.org/job/nixos/trunk-combined/tested#tabs-constituents)
-* [Tests for 18.09 release](https://hydra.nixos.org/job/nixos/release-18.09/tested#tabs-constituents)
+* [Tests for 19.03 release](https://hydra.nixos.org/job/nixos/release-19.03/tested#tabs-constituents)

 Communication:

--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
@ -55,7 +55,7 @@ package `haskell-pandoc`, for example, installs both a library and an
 application. You can install and use Haskell executables just like any other
 program in Nixpkgs, but using Haskell libraries for development is a bit
 trickier and we'll address that subject in great detail in section [How to
-create a development environment].
+create a development environment](#how-to-create-a-development-environment).

 Attribute paths are deterministic inside of Nixpkgs, but the path necessary to
 reach Nixpkgs varies from system to system. We dodged that problem by giving
@ -127,7 +127,7 @@ Also, the attributes `haskell.compiler.ghcXYC` and

 A simple development environment consists of a Haskell compiler and one or both
 of the tools `cabal-install` and `stack`. We saw in section
-[How to install Haskell packages] how you can install those programs into your
+[How to install Haskell packages](#how-to-install-haskell-packages) how you can install those programs into your
 user profile:
 ```shell
 nix-env -f "<nixpkgs>" -iA haskellPackages.ghc haskellPackages.cabal-install
@ -162,7 +162,7 @@ nix-shell -p haskell.compiler.ghc784
 to bring GHC 7.8.4 into `$PATH`. Alternatively, you can use Stack instead of
 `nix-shell` directly to select compiler versions and other build tools
 per-project. It uses `nix-shell` under the hood when Nix support is turned on.
-See [How to build a Haskell project using Stack].
+See [How to build a Haskell project using Stack](#how-to-build-a-haskell-project-using-stack).

 If you're using `cabal-install`, re-running `cabal configure` inside the spawned
 shell switches your build to use that compiler instead. If you're working on
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -197,6 +197,11 @@
    github = "aij";
    name = "Ivan Jager";
  };
+  ajs124 = {
+    email = "nix@ajs124.de";
+    github = "ajs124";
+    name = "Andreas Schrägle";
+  };
  ajgrf = {
    email = "a@ajgrf.com";
    github = "ajgrf";
@ -578,6 +583,11 @@
    github = "bbarker";
    name = "Brandon Elam Barker";
  };
+  bbigras = {
+    email = "bigras.bruno@gmail.com";
+    github = "bbigras";
+    name = "Bruno Bigras";
+  };
  bcarrell = {
    email = "brandoncarrell@gmail.com";
    github = "bcarrell";
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -22,6 +22,8 @@ luaffi,,http://luarocks.org/dev,
 luuid,
 penlight,
 say,
+std__debug,std._debug,
+std_normalize,std.normalize,
 luv,
 luasystem,
 mediator_lua,,http://luarocks.org/manifests/teto
--- a/maintainers/scripts/update-luarocks-packages
+++ b/maintainers/scripts/update-luarocks-packages
@ -81,7 +81,7 @@ function convert_pkg () {
 		server=" --server=$3"
 	fi

-    version="${3:-}"
+    version="${4:-}"

    echo "looking at $lua_pkg_name (version $version) from server [$server]" >&2
    cmd="luarocks nix $server $lua_pkg_name $version"
--- a/nixos/doc/manual/configuration/x-windows.xml
+++ b/nixos/doc/manual/configuration/x-windows.xml
@ -67,6 +67,32 @@
 <xref linkend="opt-hardware.opengl.driSupport32Bit"/> = true;
 </programlisting>
 </para>
+ <simplesect xml:id="sec-x11-auto-login">
+  <title>Auto-login</title>
+  <para>
+  The x11 login screen can be skipped entirely, automatically logging you into
+  your window manager and desktop environment when you boot your computer.
+  </para>
+  <para>
+  This is especially helpful if you have disk encryption enabled. Since you
+  already have to provide a password to decrypt your disk, entering a second
+  password to login can be redundant.
+  </para>
+  <para>
+  To enable auto-login, you need to define your default window manager and
+  desktop environment. If you wanted no desktop environment and i3 as your your
+  window manager, you'd define:
+<programlisting>
+<xref linkend="opt-services.xserver.desktopManager.default"/> = "none";
+<xref linkend="opt-services.xserver.windowManager.default"/> = "i3";
+</programlisting>
+  And, finally, to enable auto-login for a user <literal>johndoe</literal>:
+<programlisting>
+<xref linkend="opt-services.xserver.displayManager.auto.enable"/> = true;
+<xref linkend="opt-services.xserver.displayManager.auto.user"/> = "johndoe";
+</programlisting>
+  </para>
+ </simplesect>
 <simplesect xml:id="sec-x11-graphics-cards-nvidia">
  <title>Proprietary NVIDIA drivers</title>
  <para>
--- a/nixos/doc/manual/release-notes/rl-1909.xml
+++ b/nixos/doc/manual/release-notes/rl-1909.xml
@ -83,6 +83,14 @@
      The same applies to ModemManager where modem-manager.service is now called ModemManager.service again.
    </para>
   </listitem>
+   <listitem>
+    <para>
+      The <option>services.nzbget.configFile</option> and <option>services.nzbget.openFirewall</option>
+      options were removed as they are managed internally by the nzbget. The
+      <option>services.nzbget.dataDir</option> option hadn't actually been used by
+      the module for some time and so was removed as cleanup.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -414,6 +414,7 @@
  ./services/misc/ihaskell.nix
  ./services/misc/irkerd.nix
  ./services/misc/jackett.nix
+  ./services/misc/jellyfin.nix
  ./services/misc/logkeys.nix
  ./services/misc/leaps.nix
  ./services/misc/lidarr.nix
--- a/nixos/modules/programs/browserpass.nix
+++ b/nixos/modules/programs/browserpass.nix
@ -26,16 +26,6 @@ with lib;
      # brave
      "opt/brave/native-messaging-hosts/${appId}".source = source "hosts/chromium";
      "opt/brave/policies/managed/${appId}".source = source "policies/chromium";
-    }
-    # As with the v2 backwards compatibility in the pkgs.browserpass
-    # declaration, this part can be removed once the browser extension
-    # auto-updates to v3 (planned 2019-04-13, see
-    # https://github.com/browserpass/browserpass-native/issues/31)
-    // {
-      "chromium/native-messaging-hosts/com.dannyvankooten.browserpass.json".source = "${pkgs.browserpass}/etc/chrome-host.json";
-      "chromium/policies/managed/com.dannyvankooten.browserpass.json".source = "${pkgs.browserpass}/etc/chrome-policy.json";
-      "opt/chrome/native-messaging-hosts/com.dannyvankooten.browserpass.json".source = "${pkgs.browserpass}/etc/chrome-host.json";
-      "opt/chrome/policies/managed/com.dannyvankooten.browserpass.json".source = "${pkgs.browserpass}/etc/chrome-policy.json";
    };
    nixpkgs.config.firefox.enableBrowserpass = true;
  };
--- a/nixos/modules/programs/sway.nix
+++ b/nixos/modules/programs/sway.nix
@ -78,9 +78,9 @@ in {
    environment = {
      systemPackages = [ swayJoined ] ++ cfg.extraPackages;
      etc = {
-        "sway/config".source = "${swayPackage}/etc/sway/config";
-        #"sway/security.d".source = "${swayPackage}/etc/sway/security.d/";
-        #"sway/config.d".source = "${swayPackage}/etc/sway/config.d/";
+        "sway/config".source = mkOptionDefault "${swayPackage}/etc/sway/config";
+        #"sway/security.d".source = mkOptionDefault "${swayPackage}/etc/sway/security.d/";
+        #"sway/config.d".source = mkOptionDefault "${swayPackage}/etc/sway/config.d/";
      };
    };
    security.pam.services.swaylock = {};
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -45,6 +45,9 @@ with lib;
    (mkRemovedOptionModule [ "services" "neo4j" "port" ] "Use services.neo4j.http.listenAddress instead.")
    (mkRemovedOptionModule [ "services" "neo4j" "boltPort" ] "Use services.neo4j.bolt.listenAddress instead.")
    (mkRemovedOptionModule [ "services" "neo4j" "httpsPort" ] "Use services.neo4j.https.listenAddress instead.")
+    (mkRemovedOptionModule [ "services" "misc" "nzbget" "configFile" ] "The configuration of nzbget is now managed by users through the web interface.")
+    (mkRemovedOptionModule [ "services" "misc" "nzbget" "dataDir" ] "The data directory for nzbget is now /var/lib/nzbget.")
+    (mkRemovedOptionModule [ "services" "misc" "nzbget" "openFirewall" ] "The port used by nzbget is managed through the web interface so you should adjust your firewall rules accordingly.")
    (mkRemovedOptionModule [ "services" "prometheus" "alertmanager" "user" ] "The alertmanager service is now using systemd's DynamicUser mechanism which obviates a user setting.")
    (mkRemovedOptionModule [ "services" "prometheus" "alertmanager" "group" ] "The alertmanager service is now using systemd's DynamicUser mechanism which obviates a group setting.")
    (mkRenamedOptionModule [ "services" "tor" "relay" "portSpec" ] [ "services" "tor" "relay" "port" ])
--- a/nixos/modules/services/logging/journalwatch.nix
+++ b/nixos/modules/services/logging/journalwatch.nix
@ -4,6 +4,8 @@ with lib;
 let
  cfg = config.services.journalwatch;
  user = "journalwatch";
+  # for journal access
+  group = "systemd-journal";
  dataDir = "/var/lib/${user}";

  journalwatchConfig = pkgs.writeText "config" (''
@ -31,6 +33,17 @@ let

  '') filterBlocks);

+  # can't use joinSymlinks directly, because when we point $XDG_CONFIG_HOME
+  # to the /nix/store path, we still need the subdirectory "journalwatch" inside that
+  # to match journalwatch's expectations
+  journalwatchConfigDir = pkgs.runCommand "journalwatch-config"
+    { preferLocalBuild = true; allowSubstitutes = false; }
+    ''
+      mkdir -p $out/journalwatch
+      ln -sf ${journalwatchConfig} $out/journalwatch/config
+      ln -sf ${journalwatchPatterns} $out/journalwatch/patterns
+    '';
+

 in {
  options = {
@ -199,33 +212,38 @@ in {

    users.users.${user} = {
      isSystemUser = true;
-      createHome = true;
      home = dataDir;
-      # for journal access
-      group = "systemd-journal";
+      group = group;
    };

+    systemd.tmpfiles.rules = [
+      # present since NixOS 19.09: remove old stateful symlink join directory,
+      # which has been replaced with the journalwatchConfigDir store path
+      "R ${dataDir}/config"
+    ];
+
    systemd.services.journalwatch = {
+
      environment = {
+        # journalwatch stores the last processed timpestamp here
+        # the share subdirectory is historic now that config home lives in /nix/store,
+        # but moving this in a backwards-compatible way is much more work than what's justified
+        # for cleaning that up.
        XDG_DATA_HOME = "${dataDir}/share";
-        XDG_CONFIG_HOME = "${dataDir}/config";
+        XDG_CONFIG_HOME = journalwatchConfigDir;
      };
      serviceConfig = {
        User = user;
+        Group = group;
        Type = "oneshot";
-        PermissionsStartOnly = true;
+        # requires a relative directory name to create beneath /var/lib
+        StateDirectory = user;
+        StateDirectoryMode = 0750;
        ExecStart = "${pkgs.python3Packages.journalwatch}/bin/journalwatch mail";
        # lowest CPU and IO priority, but both still in best-effort class to prevent starvation
        Nice=19;
        IOSchedulingPriority=7;
      };
-      preStart = ''
-        chown -R ${user}:systemd-journal ${dataDir}
-        chmod -R u+rwX,go-w ${dataDir}
-        mkdir -p ${dataDir}/config/journalwatch
-        ln -sf ${journalwatchConfig} ${dataDir}/config/journalwatch/config
-        ln -sf ${journalwatchPatterns} ${dataDir}/config/journalwatch/patterns
-      '';
    };

    systemd.timers.journalwatch = {
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@ -8,6 +8,7 @@ let
  pg = config.services.postgresql;
  useMysql = cfg.database.type == "mysql";
  usePostgresql = cfg.database.type == "postgres";
+  useSqlite = cfg.database.type == "sqlite3";
  configFile = pkgs.writeText "app.ini" ''
    APP_NAME = ${cfg.appName}
    RUN_USER = ${cfg.user}
@ -15,11 +16,15 @@ let

    [database]
    DB_TYPE = ${cfg.database.type}
-    HOST = ${if cfg.database.socket != null then cfg.database.socket else cfg.database.host + ":" + toString cfg.database.port}
-    NAME = ${cfg.database.name}
-    USER = ${cfg.database.user}
-    PASSWD = #dbpass#
-    PATH = ${cfg.database.path}
+    ${optionalString (usePostgresql || useMysql) ''
+      HOST = ${if cfg.database.socket != null then cfg.database.socket else cfg.database.host + ":" + toString cfg.database.port}
+      NAME = ${cfg.database.name}
+      USER = ${cfg.database.user}
+      PASSWD = #dbpass#
+    ''}
+    ${optionalString useSqlite ''
+      PATH = ${cfg.database.path}
+    ''}
    ${optionalString usePostgresql ''
      SSL_MODE = disable
    ''}
--- a/nixos/modules/services/misc/jellyfin.nix
+++ b/nixos/modules/services/misc/jellyfin.nix
@ -0,0 +1,60 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.jellyfin;
+in
+{
+  options = {
+    services.jellyfin = {
+      enable = mkEnableOption "Jellyfin Media Server";
+
+      user = mkOption {
+        type = types.str;
+        default = "jellyfin";
+        description = "User account under which Jellyfin runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "jellyfin";
+        description = "Group under which jellyfin runs.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.jellyfin = {
+      description = "Jellyfin Media Server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = rec {
+        User = cfg.user;
+        Group = cfg.group;
+        StateDirectory = "jellyfin";
+        CacheDirectory = "jellyfin";
+        ExecStart = "${pkgs.jellyfin}/bin/jellyfin --datadir '/var/lib/${StateDirectory}' --cachedir '/var/cache/${CacheDirectory}'";
+        Restart = "on-failure";
+      };
+    };
+
+    users.users = mkIf (cfg.user == "jellyfin") {
+      jellyfin.group = cfg.group;
+    };
+
+    users.groups = mkIf (cfg.group == "jellyfin") {
+      jellyfin = {};
+    };
+
+    assertions = [
+      {
+        assertion = !config.services.emby.enable;
+        message = "Emby and Jellyfin are incompatible, you cannot enable both";
+      }
+    ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ minijackson ];
+}
--- a/nixos/modules/services/misc/nzbget.nix
+++ b/nixos/modules/services/misc/nzbget.nix
@ -4,33 +4,35 @@ with lib;

 let
  cfg = config.services.nzbget;
-  dataDir = builtins.dirOf cfg.configFile;
-in {
+  pkg = pkgs.nzbget;
+  stateDir = "/var/lib/nzbget";
+  configFile = "${stateDir}/nzbget.conf";
+  configOpts = concatStringsSep " " (mapAttrsToList (name: value: "-o ${name}=${value}") nixosOpts);
+
+  nixosOpts = {
+    # allows nzbget to run as a "simple" service
+    OutputMode = "loggable";
+    # use journald for logging
+    WriteLog = "none";
+    ErrorTarget = "screen";
+    WarningTarget = "screen";
+    InfoTarget = "screen";
+    DetailTarget = "screen";
+    # required paths
+    ConfigTemplate = "${pkg}/share/nzbget/nzbget.conf";
+    WebDir = "${pkg}/share/nzbget/webui";
+    # nixos handles package updates
+    UpdateCheck = "none";
+  };
+
+in
+{
+  # interface
+
  options = {
    services.nzbget = {
      enable = mkEnableOption "NZBGet";

-      package = mkOption {
-        type = types.package;
-        default = pkgs.nzbget;
-        defaultText = "pkgs.nzbget";
-        description = "The NZBGet package to use";
-      };
-
-      dataDir = mkOption {
-        type = types.str;
-        default = "/var/lib/nzbget";
-        description = "The directory where NZBGet stores its configuration files.";
-      };
-
-      openFirewall = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Open ports in the firewall for the NZBGet web interface
-        '';
-      };
-
      user = mkOption {
        type = types.str;
        default = "nzbget";
@ -42,15 +44,11 @@ in {
        default = "nzbget";
        description = "Group under which NZBGet runs";
      };
-
-      configFile = mkOption {
-        type = types.str;
-        default = "/var/lib/nzbget/nzbget.conf";
-        description = "Path for NZBGet's config file. (If this doesn't exist, the default config template is copied here.)";
-      };
    };
  };

+  # implementation
+
  config = mkIf cfg.enable {
    systemd.services.nzbget = {
      description = "NZBGet Daemon";
@ -61,50 +59,26 @@ in {
        p7zip
      ];
      preStart = ''
-        cfgtemplate=${cfg.package}/share/nzbget/nzbget.conf
-        if [ ! -f ${cfg.configFile} ]; then
-          echo "${cfg.configFile} not found. Copying default config $cfgtemplate to ${cfg.configFile}"
-          install -m 0700 $cfgtemplate ${cfg.configFile}
-          echo "Setting temporary \$MAINDIR variable in default config required in order to allow nzbget to complete initial start"
-          echo "Remember to change this to a proper value once NZBGet startup has been completed"
-          sed -i -e 's/MainDir=.*/MainDir=\/tmp/g' ${cfg.configFile}
+        if [ ! -f ${configFile} ]; then
+          ${pkgs.coreutils}/bin/install -m 0700 ${pkg}/share/nzbget/nzbget.conf ${configFile}
        fi
      '';

-      script = ''
-        args="--daemon --configfile ${cfg.configFile}"
-        # The script in preStart (above) copies nzbget's config template to datadir on first run, containing paths that point to the nzbget derivation installed at the time.
-        # These paths break when nzbget is upgraded & the original derivation is garbage collected. If such broken paths are found in the config file, override them to point to
-        # the currently installed nzbget derivation.
-        cfgfallback () {
-          local hit=`grep -Po "(?<=^$1=).*+" "${cfg.configFile}" | sed 's/[ \t]*$//'` # Strip trailing whitespace
-          ( test $hit && test -e $hit ) || {
-            echo "In ${cfg.configFile}, valid $1 not found; falling back to $1=$2"
-            args+=" -o $1=$2"
-          }
-        }
-        cfgfallback ConfigTemplate ${cfg.package}/share/nzbget/nzbget.conf
-        cfgfallback WebDir ${cfg.package}/share/nzbget/webui
-        ${cfg.package}/bin/nzbget $args
-      '';
-
      serviceConfig = {
-        StateDirectory = dataDir;
-        StateDirectoryMode = "0700";
-        Type = "forking";
+        StateDirectory = "nzbget";
+        StateDirectoryMode = "0750";
        User = cfg.user;
        Group = cfg.group;
-        PermissionsStartOnly = "true";
+        UMask = "0002";
        Restart = "on-failure";
+        ExecStart = "${pkg}/bin/nzbget --server --configfile ${stateDir}/nzbget.conf ${configOpts}";
+        ExecStop = "${pkg}/bin/nzbget --quit";
      };
    };

-    networking.firewall = mkIf cfg.openFirewall {
-      allowedTCPPorts = [ 8989 ];
-    };
-
    users.users = mkIf (cfg.user == "nzbget") {
      nzbget = {
+        home = stateDir;
        group = cfg.group;
        uid = config.ids.uids.nzbget;
      };
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@ -177,7 +177,7 @@ let
      folder = mkOption {
        type = types.str;
        default = "";
-        description = "Add dashboards to the speciied folder";
+        description = "Add dashboards to the specified folder";
      };
      type = mkOption {
        type = types.str;
--- a/nixos/modules/services/networking/ejabberd.nix
+++ b/nixos/modules/services/networking/ejabberd.nix
@ -11,7 +11,7 @@ let
    ${cfg.ctlConfig}
  '';

-  ectl = ''${cfg.package}/bin/ejabberdctl ${if cfg.configFile == null then "" else "--config ${cfg.configFile}"} --ctl-config "${ctlcfg}" --spool "${cfg.spoolDir}" --logs "${cfg.logsDir}"'';
+  ectl = ''${cfg.package}/bin/ejabberdctl ${optionalString (cfg.configFile != null) "--config ${cfg.configFile}"} --ctl-config "${ctlcfg}" --spool "${cfg.spoolDir}" --logs "${cfg.logsDir}"'';

  dumps = lib.escapeShellArgs cfg.loadDumps;

@ -111,28 +111,17 @@ in {
      description = "ejabberd server";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
-      path = [ pkgs.findutils pkgs.coreutils pkgs.runit ] ++ lib.optional cfg.imagemagick pkgs.imagemagick;
+      path = [ pkgs.findutils pkgs.coreutils ] ++ lib.optional cfg.imagemagick pkgs.imagemagick;

      serviceConfig = {
-        ExecStart = ''${ectl} foreground'';
-        # FIXME: runit is used for `chpst` -- can we get rid of this?
-        ExecStop = ''${pkgs.runit}/bin/chpst -u "${cfg.user}:${cfg.group}" ${ectl} stop'';
-        ExecReload = ''${pkgs.runit}/bin/chpst -u "${cfg.user}:${cfg.group}" ${ectl} reload_config'';
        User = cfg.user;
        Group = cfg.group;
-        PermissionsStartOnly = true;
+        ExecStart = "${ectl} foreground";
+        ExecStop = "${ectl} stop";
+        ExecReload = "${ectl} reload_config";
      };

      preStart = ''
-        mkdir -p -m750 "${cfg.logsDir}"
-        chown "${cfg.user}:${cfg.group}" "${cfg.logsDir}"
-
-        mkdir -p -m750 "/var/lock/ejabberdctl"
-        chown "${cfg.user}:${cfg.group}" "/var/lock/ejabberdctl"
-
-        mkdir -p -m750 "${cfg.spoolDir}"
-        chown -R "${cfg.user}:${cfg.group}" "${cfg.spoolDir}"
-
        if [ -z "$(ls -A '${cfg.spoolDir}')" ]; then
          touch "${cfg.spoolDir}/.firstRun"
        fi
@ -149,13 +138,18 @@ in {
          for src in ${dumps}; do
            find "$src" -type f | while read dump; do
              echo "Loading configuration dump at $dump"
-              chpst -u "${cfg.user}:${cfg.group}" ${ectl} load "$dump"
+              ${ectl} load "$dump"
            done
          done
        fi
      '';
    };

+    systemd.tmpfiles.rules = [
+      "d '${cfg.logsDir}' 0750 ${cfg.user} ${cfg.group} -"
+      "d '${cfg.spoolDir}' 0700 ${cfg.user} ${cfg.group} -"
+    ];
+
    security.pam.services.ejabberd = {};

  };
--- a/nixos/modules/services/networking/zeronet.nix
+++ b/nixos/modules/services/networking/zeronet.nix
@ -5,13 +5,15 @@ let

  zConfFile = pkgs.writeTextFile {
    name = "zeronet.conf";
-    
+
    text = ''
      [global]
      data_dir = ${cfg.dataDir}
      log_dir = ${cfg.logDir}
    '' + lib.optionalString (cfg.port != null) ''
      ui_port = ${toString cfg.port}
+    '' + lib.optionalString (cfg.fileserverPort != null) ''
+      fileserver_port = ${toString cfg.fileserverPort}
    '' + lib.optionalString (cfg.torAlways) ''
      tor = always
    '' + cfg.extraConfig;
@ -41,6 +43,15 @@ in with lib; {
      description = "Optional zeronet web UI port.";
    };

+    fileserverPort = mkOption {
+      # Not optional: when absent zeronet tries to write one to the
+      # read-only config file and crashes
+      type = types.int;
+      default = 12261;
+      example = 12261;
+      description = "Zeronet fileserver port.";
+    };
+
    tor = mkOption {
      type = types.bool;
      default = false;
--- a/nixos/modules/services/security/sks.nix
+++ b/nixos/modules/services/security/sks.nix
@ -116,20 +116,22 @@ in {
          ${lib.optionalString (cfg.webroot != null)
            "ln -sfT \"${cfg.webroot}\" web"}
          mkdir -p dump
-          # Check that both database configs are symlinks before overwriting them
-          if [ -e KDB/DB_CONFIG ] && [ ! -L KBD/DB_CONFIG ]; then
-            echo "KDB/DB_CONFIG exists but is not a symlink." >&2
-            exit 1
-          fi
-          if [ -e PTree/DB_CONFIG ] && [ ! -L PTree/DB_CONFIG ]; then
-            echo "PTree/DB_CONFIG exists but is not a symlink." >&2
-            exit 1
-          fi
-          ln -sf ${dbConfig} KDB/DB_CONFIG
-          ln -sf ${dbConfig} PTree/DB_CONFIG
          ${sksPkg}/bin/sks build dump/*.gpg -n 10 -cache 100 || true #*/
          ${sksPkg}/bin/sks cleandb || true
          ${sksPkg}/bin/sks pbuild -cache 20 -ptree_cache 70 || true
+          # Check that both database configs are symlinks before overwriting them
+          # TODO: The initial build will be without DB_CONFIG, but this will
+          # hopefully not cause any significant problems. It might be better to
+          # create both directories manually but we have to check that this does
+          # not affect the initial build of the DB.
+          for CONFIG_FILE in KDB/DB_CONFIG PTree/DB_CONFIG; do
+            if [ -e $CONFIG_FILE ] && [ ! -L $CONFIG_FILE ]; then
+              echo "$CONFIG_FILE exists but is not a symlink." >&2
+              echo "Please remove $PWD/$CONFIG_FILE manually to continue." >&2
+              exit 1
+            fi
+            ln -sf ${dbConfig} $CONFIG_FILE
+          done
        '';
        serviceConfig = {
          WorkingDirectory = "~";
--- a/nixos/modules/services/system/earlyoom.nix
+++ b/nixos/modules/services/system/earlyoom.nix
@ -63,6 +63,17 @@ in
          Enable debugging messages.
        '';
      };
+
+      notificationsCommand = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "sudo -u example_user DISPLAY=:0 DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus notify-send";
+        description = ''
+          Command used to send notifications.
+
+          See <link xlink:href="https://github.com/rfjakob/earlyoom#notifications">README</link> for details.
+        '';
+      };
    };
  };

@ -88,7 +99,9 @@ in
          -s ${toString ecfg.freeSwapThreshold} \
          ${optionalString ecfg.useKernelOOMKiller "-k"} \
          ${optionalString ecfg.ignoreOOMScoreAdjust "-i"} \
-          ${optionalString ecfg.enableDebugInfo "-d"}
+          ${optionalString ecfg.enableDebugInfo "-d"} \
+          ${optionalString (ecfg.notificationsCommand != null)
+            "-N ${escapeShellArg ecfg.notificationsCommand}"}
        '';
      };
    };
--- a/nixos/modules/services/web-apps/documize.nix
+++ b/nixos/modules/services/web-apps/documize.nix
@ -3,65 +3,136 @@
 with lib;

 let
-
  cfg = config.services.documize;

-in
+  mkParams = optional: concatMapStrings (name: let
+    predicate = optional -> cfg.${name} != null;
+    template = " -${name} '${toString cfg.${name}}'";
+  in optionalString predicate template);

-  {
-    options.services.documize = {
-      enable = mkEnableOption "Documize Wiki";
+in {
+  options.services.documize = {
+    enable = mkEnableOption "Documize Wiki";

-      offline = mkEnableOption "Documize offline mode";
-
-      package = mkOption {
-        default = pkgs.documize-community;
-        type = types.package;
-        description = ''
-          Which package to use for documize.
-        '';
-      };
-
-      db = mkOption {
-        type = types.str;
-        example = "host=localhost port=5432 sslmode=disable user=admin password=secret dbname=documize";
-        description = ''
-          The DB connection string to use for the database.
-        '';
-      };
-
-      dbtype = mkOption {
-        type = types.enum [ "postgresql" "percona" "mariadb" "mysql" ];
-        description = ''
-          Which database to use for storage.
-        '';
-      };
-
-      port = mkOption {
-        type = types.port;
-        example = 3000;
-        description = ''
-          Which TCP port to serve.
-        '';
-      };
+    package = mkOption {
+      type = types.package;
+      default = pkgs.documize-community;
+      description = ''
+        Which package to use for documize.
+      '';
    };

-    config = mkIf cfg.enable {
-      systemd.services.documize-server = {
-        wantedBy = [ "multi-user.target" ];
+    salt = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "3edIYV6c8B28b19fh";
+      description = ''
+        The salt string used to encode JWT tokens, if not set a random value will be generated.
+      '';
+    };

-        script = ''
-          ${cfg.package}/bin/documize \
-            -db "${cfg.db}" \
-            -dbtype ${cfg.dbtype} \
-            -port ${toString cfg.port} \
-            -offline ${if cfg.offline then "1" else "0"}
-        '';
+    cert = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        The <filename>cert.pem</filename> file used for https.
+      '';
+    };

-        serviceConfig = {
-          Restart = "always";
-          DynamicUser = "yes";
-        };
+    key = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        The <filename>key.pem</filename> file used for https.
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 5001;
+      description = ''
+        The http/https port number.
+      '';
+    };
+
+    forcesslport = mkOption {
+      type = types.nullOr types.port;
+      default = null;
+      description = ''
+        Redirect given http port number to TLS.
+      '';
+    };
+
+    offline = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Set <literal>true</literal> for offline mode.
+      '';
+      apply = v: if true == v then 1 else 0;
+    };
+
+    dbtype = mkOption {
+      type = types.enum [ "mysql" "percona" "mariadb" "postgresql" "sqlserver" ];
+      default = "postgresql";
+      description = ''
+        Specify the database provider:
+        <simplelist type='inline'>
+          <member><literal>mysql</literal></member>
+          <member><literal>percona</literal></member>
+          <member><literal>mariadb</literal></member>
+          <member><literal>postgresql</literal></member>
+          <member><literal>sqlserver</literal></member>
+        </simplelist>
+      '';
+    };
+
+    db = mkOption {
+      type = types.str;
+      description = ''
+        Database specific connection string for example:
+        <itemizedlist>
+        <listitem><para>MySQL/Percona/MariaDB:
+          <literal>user:password@tcp(host:3306)/documize</literal>
+        </para></listitem>
+        <listitem><para>MySQLv8+:
+          <literal>user:password@tcp(host:3306)/documize?allowNativePasswords=true</literal>
+        </para></listitem>
+        <listitem><para>PostgreSQL:
+          <literal>host=localhost port=5432 dbname=documize user=admin password=secret sslmode=disable</literal>
+        </para></listitem>
+        <listitem><para>MSSQL:
+          <literal>sqlserver://username:password@localhost:1433?database=Documize</literal> or
+          <literal>sqlserver://sa@localhost/SQLExpress?database=Documize</literal>
+        </para></listitem>
+        </itemizedlist>
+      '';
+    };
+
+    location = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        reserved
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.documize-server = {
+      description = "Documize Wiki";
+      documentation = [ https://documize.com/ ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        ExecStart = concatStringsSep " " [
+          "${cfg.package}/bin/documize"
+          (mkParams false [ "db" "dbtype" "port" ])
+          (mkParams true [ "offline" "location" "forcesslport" "key" "cert" "salt" ])
+        ];
+        Restart = "always";
+        DynamicUser = "yes";
      };
    };
-  }
+  };
+}
--- a/nixos/modules/services/x11/window-managers/i3.nix
+++ b/nixos/modules/services/x11/window-managers/i3.nix
@ -60,12 +60,15 @@ in
        ${cfg.extraSessionCommands}

        ${cfg.package}/bin/i3 ${optionalString (cfg.configFile != null)
-          "-c \"${cfg.configFile}\""
+          "-c /etc/i3/config"
        } &
        waitPID=$!
      '';
    }];
    environment.systemPackages = [ cfg.package ] ++ cfg.extraPackages;
+    environment.etc."i3/config" = mkIf (cfg.configFile != null) {
+      source = cfg.configFile;
+    };
  };

  imports = [
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@ -166,24 +166,6 @@ while (my ($unit, $state) = each %{$activePrev}) {

    if (-e $prevUnitFile && ($state->{state} eq "active" || $state->{state} eq "activating")) {
        if (! -e $newUnitFile || abs_path($newUnitFile) eq "/dev/null") {
-            # Ignore (i.e. never stop) these units:
-            if ($unit eq "system.slice") {
-                # TODO: This can be removed a few months after 18.09 is out
-                # (i.e. after everyone switched away from 18.03).
-                # Problem: Restarting (stopping) system.slice would not only
-                # stop X11 but also most system units/services. We obviously
-                # don't want this happening to users when they switch from 18.03
-                # to 18.09 or nixos-unstable.
-                # Reason: The following change in systemd:
-                # https://github.com/systemd/systemd/commit/d8e5a9338278d6602a0c552f01f298771a384798
-                # The commit adds system.slice to the perpetual units, which
-                # means removing the unit file and adding it to the source code.
-                # This is done so that system.slice can't be stopped anymore but
-                # in our case it ironically would cause this script to stop
-                # system.slice because the unit was removed (and an older
-                # systemd version is still running).
-                next;
-            }
            my $unitInfo = parseUnit($prevUnitFile);
            $unitsToStop{$unit} = 1 if boolIsTrue($unitInfo->{'X-StopOnRemoval'} // "yes");
        }
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@ -87,6 +87,9 @@ let
    mkdir -p /crypt-ramfs
    mount -t ramfs none /crypt-ramfs

+    # Cryptsetup locking directory
+    mkdir -p /run/cryptsetup
+
    # For Yubikey salt storage
    mkdir -p /crypt-storage

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -72,6 +72,7 @@ in
  #ec2-config = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-config or {};
  ec2-nixops = (handleTestOn ["x86_64-linux"] ./ec2.nix {}).boot-ec2-nixops or {};
  ecryptfs = handleTest ./ecryptfs.nix {};
+  ejabberd = handleTest ./ejabberd.nix {};
  elk = handleTestOn ["x86_64-linux"] ./elk.nix {};
  env = handleTest ./env.nix {};
  etcd = handleTestOn ["x86_64-linux"] ./etcd.nix {};
@ -172,6 +173,7 @@ in
  nix-ssh-serve = handleTest ./nix-ssh-serve.nix {};
  novacomd = handleTestOn ["x86_64-linux"] ./novacomd.nix {};
  nsd = handleTest ./nsd.nix {};
+  nzbget = handleTest ./nzbget.nix {};
  openldap = handleTest ./openldap.nix {};
  opensmtpd = handleTest ./opensmtpd.nix {};
  openssh = handleTest ./openssh.nix {};
--- a/nixos/tests/ejabberd.nix
+++ b/nixos/tests/ejabberd.nix
@ -0,0 +1,262 @@
+import ./make-test.nix ({ pkgs, ... }: {
+  name = "ejabberd";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ ajs124 ];
+  };
+  nodes = {
+    client = { nodes, pkgs, ... }: {
+      environment.systemPackages = [
+        (pkgs.callPackage ./xmpp-sendmessage.nix { connectTo = nodes.server.config.networking.primaryIPAddress; })
+      ];
+    };
+    server = { config, pkgs, ... }: {
+      networking.extraHosts = ''
+        ${config.networking.primaryIPAddress} example.com
+      '';
+
+      services.ejabberd = {
+        enable = true;
+        configFile = "/etc/ejabberd.yml";
+      };
+
+      environment.etc."ejabberd.yml" = {
+        user = "ejabberd";
+        mode = "0600";
+        text = ''
+          loglevel: 3
+
+          hosts:
+            - "example.com"
+
+          listen:
+            -
+              port: 5222
+              module: ejabberd_c2s
+              zlib: false
+              max_stanza_size: 65536
+              shaper: c2s_shaper
+              access: c2s
+            -
+              port: 5269
+              ip: "::"
+              module: ejabberd_s2s_in
+            -
+              port: 5347
+              ip: "127.0.0.1"
+              module: ejabberd_service
+              access: local
+              shaper_rule: fast
+              ip: "127.0.0.1"
+
+          ## Disabling digest-md5 SASL authentication. digest-md5 requires plain-text
+          ## password storage (see auth_password_format option).
+          disable_sasl_mechanisms: "digest-md5"
+
+          ## Outgoing S2S options
+          ## Preferred address families (which to try first) and connect timeout
+          ## in seconds.
+          outgoing_s2s_families:
+             - ipv4
+             - ipv6
+
+          ## auth_method: Method used to authenticate the users.
+          ## The default method is the internal.
+          ## If you want to use a different method,
+          ## comment this line and enable the correct ones.
+          auth_method: internal
+
+          ## Store the plain passwords or hashed for SCRAM:
+          ## auth_password_format: plain
+          auth_password_format: scram
+
+          ###'  TRAFFIC SHAPERS
+          shaper:
+            # in B/s
+            normal: 1000000
+            fast: 50000000
+
+          ## This option specifies the maximum number of elements in the queue
+          ## of the FSM. Refer to the documentation for details.
+          max_fsm_queue: 1000
+
+          ###'   ACCESS CONTROL LISTS
+          acl:
+            ## The 'admin' ACL grants administrative privileges to XMPP accounts.
+            ## You can put here as many accounts as you want.
+            admin:
+               user:
+                 - "root": "example.com"
+
+            ## Local users: don't modify this.
+            local:
+              user_regexp: ""
+
+            ## Loopback network
+            loopback:
+              ip:
+                - "127.0.0.0/8"
+                - "::1/128"
+                - "::FFFF:127.0.0.1/128"
+
+          ###'  SHAPER RULES
+          shaper_rules:
+            ## Maximum number of simultaneous sessions allowed for a single user:
+            max_user_sessions: 10
+            ## Maximum number of offline messages that users can have:
+            max_user_offline_messages:
+              - 5000: admin
+              - 1024
+            ## For C2S connections, all users except admins use the "normal" shaper
+            c2s_shaper:
+              - none: admin
+              - normal
+            ## All S2S connections use the "fast" shaper
+            s2s_shaper: fast
+
+          ###'  ACCESS RULES
+          access_rules:
+            ## This rule allows access only for local users:
+            local:
+              - allow: local
+            ## Only non-blocked users can use c2s connections:
+            c2s:
+              - deny: blocked
+              - allow
+            ## Only admins can send announcement messages:
+            announce:
+              - allow: admin
+            ## Only admins can use the configuration interface:
+            configure:
+              - allow: admin
+            ## Only accounts of the local ejabberd server can create rooms:
+            muc_create:
+              - allow: local
+            ## Only accounts on the local ejabberd server can create Pubsub nodes:
+            pubsub_createnode:
+              - allow: local
+            ## In-band registration allows registration of any possible username.
+            ## To disable in-band registration, replace 'allow' with 'deny'.
+            register:
+              - allow
+            ## Only allow to register from localhost
+            trusted_network:
+              - allow: loopback
+
+          ## ===============
+          ## API PERMISSIONS
+          ## ===============
+          ##
+          ## This section allows you to define who and using what method
+          ## can execute commands offered by ejabberd.
+          ##
+          ## By default "console commands" section allow executing all commands
+          ## issued using ejabberdctl command, and "admin access" section allows
+          ## users in admin acl that connect from 127.0.0.1 to  execute all
+          ## commands except start and stop with any available access method
+          ## (ejabberdctl, http-api, xmlrpc depending what is enabled on server).
+          ##
+          ## If you remove "console commands" there will be one added by
+          ## default allowing executing all commands, but if you just change
+          ## permissions in it, version from config file will be used instead
+          ## of default one.
+          ##
+          api_permissions:
+            "console commands":
+              from:
+                - ejabberd_ctl
+              who: all
+              what: "*"
+
+          language: "en"
+
+          ###'  MODULES
+          ## Modules enabled in all ejabberd virtual hosts.
+          modules:
+            mod_adhoc: {}
+            mod_announce: # recommends mod_adhoc
+              access: announce
+            mod_blocking: {} # requires mod_privacy
+            mod_caps: {}
+            mod_carboncopy: {}
+            mod_client_state: {}
+            mod_configure: {} # requires mod_adhoc
+            ## mod_delegation: {} # for xep0356
+            mod_echo: {}
+            #mod_irc:
+            #  host: "irc.@HOST@"
+            #  default_encoding: "utf-8"
+            ## mod_bosh: {}
+            ## mod_http_fileserver:
+            ##   docroot: "/var/www"
+            ##   accesslog: "/var/log/ejabberd/access.log"
+            #mod_http_upload:
+            #  thumbnail: false # otherwise needs the identify command from ImageMagick installed
+            #  put_url: "https://@HOST@:5444"
+            ##   # docroot: "@HOME@/upload"
+            #mod_http_upload_quota:
+            #  max_days: 14
+            mod_last: {}
+            ## XEP-0313: Message Archive Management
+            ## You might want to setup a SQL backend for MAM because the mnesia database is
+            ## limited to 2GB which might be exceeded on large servers
+            mod_mam: {}
+            mod_muc:
+              host: "muc.@HOST@"
+              access:
+                - allow
+              access_admin:
+                - allow: admin
+              access_create: muc_create
+              access_persistent: muc_create
+            mod_muc_admin: {}
+            mod_muc_log: {}
+            mod_offline:
+              access_max_user_messages: max_user_offline_messages
+            mod_ping: {}
+            ## mod_pres_counter:
+            ##   count: 5
+            ##   interval: 60
+            mod_privacy: {}
+            mod_private: {}
+            mod_roster:
+                versioning: true
+            mod_shared_roster: {}
+            mod_stats: {}
+            mod_time: {}
+            mod_vcard:
+              search: false
+            mod_vcard_xupdate: {}
+            ## Convert all avatars posted by Android clients from WebP to JPEG
+            mod_avatar: {}
+            #  convert:
+            #    webp: jpeg
+            mod_version: {}
+            mod_stream_mgmt: {}
+            ##   The module for S2S dialback (XEP-0220). Please note that you cannot
+            ##   rely solely on dialback if you want to federate with other servers,
+            ##   because a lot of servers have dialback disabled and instead rely on
+            ##   PKIX authentication. Make sure you have proper certificates installed
+            ##   and check your accessibility at https://check.messaging.one/
+            mod_s2s_dialback: {}
+            mod_pubsub:
+              plugins:
+                - "pep"
+            mod_push: {}
+        '';
+      };
+
+      networking.firewall.enable = false;
+    };
+  };
+
+  testScript = { nodes, ... }: ''
+    $server->waitForUnit('ejabberd.service');
+    $server->succeed('su ejabberd -s $(which ejabberdctl) status|grep started') =~ /ejabberd is running/;
+    $server->succeed('su ejabberd -s $(which ejabberdctl) register azurediamond example.com hunter2');
+    $server->succeed('su ejabberd -s $(which ejabberdctl) register cthon98 example.com nothunter2');
+    $server->fail('su ejabberd -s $(which ejabberdctl) register asdf wrong.domain');
+    $client->succeed('send-message');
+    $server->succeed('su ejabberd -s $(which ejabberdctl) unregister cthon98 example.com');
+    $server->succeed('su ejabberd -s $(which ejabberdctl) unregister azurediamond example.com');
+  '';
+})
--- a/nixos/tests/jellyfin.nix
+++ b/nixos/tests/jellyfin.nix
@ -0,0 +1,16 @@
+import ./make-test.nix ({ lib, ...}:
+
+{
+  name = "jellyfin";
+  meta.maintainers = with lib.maintainers; [ minijackson ];
+
+  machine =
+    { ... }:
+    { services.jellyfin.enable = true; };
+
+  testScript = ''
+    $machine->waitForUnit('jellyfin.service');
+    $machine->waitForOpenPort('8096');
+    $machine->succeed("curl --fail http://localhost:8096/");
+  '';
+})
--- a/nixos/tests/nzbget.nix
+++ b/nixos/tests/nzbget.nix
@ -0,0 +1,26 @@
+import ./make-test.nix ({ pkgs, ...} : {
+  name = "nzbget";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ aanderse flokli ];
+  };
+
+  nodes = {
+    server = { ... }: {
+      services.nzbget.enable = true;
+
+      # hack, don't add (unfree) unrar to nzbget's path,
+      # so we can run this test in CI
+      systemd.services.nzbget.path = pkgs.stdenv.lib.mkForce [ pkgs.p7zip ];
+    };
+  };
+
+  testScript = ''
+    startAll;
+
+    $server->waitForUnit("nzbget.service");
+    $server->waitForUnit("network.target");
+    $server->waitForOpenPort(6789);
+    $server->succeed("curl -s -u nzbget:tegbzn6789 http://127.0.0.1:6789 | grep -q 'This file is part of nzbget'");
+    $server->succeed("${pkgs.nzbget}/bin/nzbget -n -o ControlIP=127.0.0.1 -o ControlPort=6789 -o ControlPassword=tegbzn6789 -V");
+  '';
+})
--- a/nixos/tests/prosody.nix
+++ b/nixos/tests/prosody.nix
@ -9,70 +9,30 @@ import ./make-test.nix {
      extraConfig = ''
        storage = "sql"
      '';
+      virtualHosts.test = {
+        domain = "example.com";
+        enabled = true;
+      };
    };
-    environment.systemPackages = let
-      sendMessage = pkgs.writeScriptBin "send-message" ''
-        #!/usr/bin/env python3
-        # Based on the sleekxmpp send_client example, look there for more details:
-        # https://github.com/fritzy/SleekXMPP/blob/develop/examples/send_client.py
-        import sleekxmpp
-
-        class SendMsgBot(sleekxmpp.ClientXMPP):
-            """
-            A basic SleekXMPP bot that will log in, send a message,
-            and then log out.
-            """
-            def __init__(self, jid, password, recipient, message):
-                sleekxmpp.ClientXMPP.__init__(self, jid, password)
-
-                self.recipient = recipient
-                self.msg = message
-
-                self.add_event_handler("session_start", self.start, threaded=True)
-
-            def start(self, event):
-                self.send_presence()
-                self.get_roster()
-
-                self.send_message(mto=self.recipient,
-                                  mbody=self.msg,
-                                  mtype='chat')
-
-                self.disconnect(wait=True)
-
-
-        if __name__ == '__main__':
-            xmpp = SendMsgBot("test1@localhost", "test1", "test2@localhost", "Hello World!")
-            xmpp.register_plugin('xep_0030') # Service Discovery
-            xmpp.register_plugin('xep_0199') # XMPP Ping
-
-            # TODO: verify certificate
-            # If you want to verify the SSL certificates offered by a server:
-            # xmpp.ca_certs = "path/to/ca/cert"
-
-            if xmpp.connect(('localhost', 5222)):
-                xmpp.process(block=True)
-            else:
-                print("Unable to connect.")
-                sys.exit(1)
-      '';
-    in [ (pkgs.python3.withPackages (ps: [ ps.sleekxmpp ])) sendMessage ];
+    environment.systemPackages = [
+      (pkgs.callPackage ./xmpp-sendmessage.nix {})
+    ];
  };

  testScript = ''
    $machine->waitForUnit('prosody.service');
    $machine->succeed('prosodyctl status') =~ /Prosody is running/;

-    # set password to 'test' (it's asked twice)
-    $machine->succeed('yes test1 | prosodyctl adduser test1@localhost');
+    # set password to 'nothunter2' (it's asked twice)
+    $machine->succeed('yes nothunter2 | prosodyctl adduser cthon98@example.com');
    # set password to 'y'
-    $machine->succeed('yes | prosodyctl adduser test2@localhost');
-    # correct password to 'test2'
-    $machine->succeed('yes test2 | prosodyctl passwd test2@localhost');
+    $machine->succeed('yes | prosodyctl adduser azurediamond@example.com');
+    # correct password to 'hunter2'
+    $machine->succeed('yes hunter2 | prosodyctl passwd azurediamond@example.com');

    $machine->succeed("send-message");

-    $machine->succeed('prosodyctl deluser test1@localhost');
-    $machine->succeed('prosodyctl deluser test2@localhost');
+    $machine->succeed('prosodyctl deluser cthon98@example.com');
+    $machine->succeed('prosodyctl deluser azurediamond@example.com');
  '';
 }
--- a/nixos/tests/xmpp-sendmessage.nix
+++ b/nixos/tests/xmpp-sendmessage.nix
@ -0,0 +1,46 @@
+{ writeScriptBin, python3, connectTo ? "localhost" }:
+writeScriptBin "send-message" ''
+  #!${(python3.withPackages (ps: [ ps.sleekxmpp ])).interpreter}
+  # Based on the sleekxmpp send_client example, look there for more details:
+  # https://github.com/fritzy/SleekXMPP/blob/develop/examples/send_client.py
+  import sleekxmpp
+
+  class SendMsgBot(sleekxmpp.ClientXMPP):
+      """
+      A basic SleekXMPP bot that will log in, send a message,
+      and then log out.
+      """
+      def __init__(self, jid, password, recipient, message):
+          sleekxmpp.ClientXMPP.__init__(self, jid, password)
+
+          self.recipient = recipient
+          self.msg = message
+
+          self.add_event_handler("session_start", self.start, threaded=True)
+
+      def start(self, event):
+          self.send_presence()
+          self.get_roster()
+
+          self.send_message(mto=self.recipient,
+                            mbody=self.msg,
+                            mtype='chat')
+
+          self.disconnect(wait=True)
+
+
+  if __name__ == '__main__':
+      xmpp = SendMsgBot("cthon98@example.com", "nothunter2", "azurediamond@example.com", "hey, if you type in your pw, it will show as stars")
+      xmpp.register_plugin('xep_0030') # Service Discovery
+      xmpp.register_plugin('xep_0199') # XMPP Ping
+
+      # TODO: verify certificate
+      # If you want to verify the SSL certificates offered by a server:
+      # xmpp.ca_certs = "path/to/ca/cert"
+
+      if xmpp.connect(('${connectTo}', 5222)):
+          xmpp.process(block=True)
+      else:
+          print("Unable to connect.")
+          sys.exit(1)
+''
--- a/pkgs/applications/accessibility/mousetweaks/default.nix
+++ b/pkgs/applications/accessibility/mousetweaks/default.nix
@ -0,0 +1,49 @@
+{ stdenv, fetchurl, pkgconfig
+, glib, gtk3, gnome3, gsettings-desktop-schemas, wrapGAppsHook
+, libX11, libXtst, libXfixes, libXcursor
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mousetweaks";
+  version = "3.32.0";
+
+  src = fetchurl {
+   url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+   sha256 = "005fhmvb45sa9mq17dpa23n1xnspiissx5rnpiy7hiqmy3g5rg8f";
+  };
+
+  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
+
+  buildInputs = [
+    glib gtk3 gsettings-desktop-schemas
+    libX11 libXtst libXfixes libXcursor
+  ];
+
+  passthru = {
+    updateScript = gnome3.updateScript {
+      packageName = pname;
+    };
+  };
+
+  meta = with stdenv.lib; {
+    description = "Provides mouse accessibility enhancements for the GNOME desktop";
+    longDescription = ''
+      Mousetweaks provides mouse accessibility enhancements for the GNOME
+      desktop. These enhancements are:
+
+      - It offers a way to perform the various clicks without using any
+      physical mouse buttons. (Hover Click)
+
+      - It allows users to perform a secondary click by keeping the primary
+      mouse button pressed for a predetermined amount of time. (Simulated
+      Secondary Click)
+
+      The features can be activated and configured through the Universal Access
+      panel of the GNOME Control Center.
+    '';
+    homepage = https://wiki.gnome.org/Projects/Mousetweaks;
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.johnazoidberg ];
+  };
+}
--- a/pkgs/applications/audio/calf/default.nix
+++ b/pkgs/applications/audio/calf/default.nix
@ -3,21 +3,14 @@

 stdenv.mkDerivation rec {
  name = "calf-${version}";
-  version = "0.90.0";
+  version = "0.90.2";

  src = fetchurl {
    url = "https://calf-studio-gear.org/files/${name}.tar.gz";
-    sha256 = "0dijv2j7vlp76l10s4v8gbav26ibaqk8s24ci74vrc398xy00cib";
+    sha256 = "0bn4j1klw2yfxz8clbmasaydifq25rdfsv0n6iisxrzcj1lx7sgh";
  };

-  patches = [
-    # Fix memory leak in limiter
-    # https://github.com/flathub/com.github.wwmm.pulseeffects/issues/12
-    (fetchpatch {
-      url = https://github.com/calf-studio-gear/calf/commit/7afdefc0d0489a6227fd10f15843d81dc82afd62.patch;
-      sha256 = "056662iw6hp4ykwk4jyrzg5yarcn17ni97yc060y5kcnzy29ddg6";
-    })
-  ];
+  enableParallelBuilding = true;

  buildInputs = [
    cairo expat fftwSinglePrec fluidsynth glib gtk2 libjack2 ladspaH
--- a/pkgs/applications/audio/dragonfly-reverb/default.nix
+++ b/pkgs/applications/audio/dragonfly-reverb/default.nix
@ -1,13 +1,14 @@
 { stdenv, fetchFromGitHub, libjack2, libGL, pkgconfig, xorg }:

 stdenv.mkDerivation rec {
-  name = "dragonfly-reverb-${src.rev}";
+  pname = "dragonfly-reverb";
+  version = "1.1.4";

  src = fetchFromGitHub {
    owner = "michaelwillis";
    repo = "dragonfly-reverb";
-    rev = "1.0.0";
-    sha256 = "05m4hd8lg0a7iiia6cbiw5qmc4p8vbkxp2qh7ywaabawiwa9r24x";
+    rev = version;
+    sha256 = "060g4ddh1z222n39wqj8jxj0zgmpjrgraw76qgyg6xkn15cn9q9y";
    fetchSubmodules = true;
  };

@ -21,15 +22,20 @@ stdenv.mkDerivation rec {
  ];

  installPhase = ''
+    mkdir -p $out/bin
    mkdir -p $out/lib/lv2/
-    cp -a bin/DragonflyReverb.lv2/ $out/lib/lv2/
+    mkdir -p $out/lib/vst/
+    cd bin
+    cp -a DragonflyReverb        $out/bin/
+    cp -a DragonflyReverb-vst.so $out/lib/vst/
+    cp -a DragonflyReverb.lv2/   $out/lib/lv2/
  '';

  meta = with stdenv.lib; {
    homepage = https://github.com/michaelwillis/dragonfly-reverb;
    description = "A hall-style reverb based on freeverb3 algorithms";
    maintainers = [ maintainers.magnetophon ];
-    license = licenses.gpl2;
+    license = licenses.gpl3;
    platforms = ["x86_64-linux"];
  };
 }
--- a/pkgs/applications/audio/soundkonverter/default.nix
+++ b/pkgs/applications/audio/soundkonverter/default.nix
@ -0,0 +1,97 @@
+# currently needs to be installed into an environment and needs a `kbuildsycoca5` run afterwards for plugin discovery
+{
+  mkDerivation, fetchFromGitHub, lib, makeWrapper,
+  cmake, extra-cmake-modules, pkgconfig,
+  libkcddb, kconfig, kconfigwidgets, ki18n, kdelibs4support, kio, solid, kwidgetsaddons, kxmlgui,
+  qtbase, phonon, 
+  taglib,
+  # optional backends
+  withCD ? true, cdparanoia,
+  withFlac ? true, flac,
+  withMidi ? true, fluidsynth, timidity,
+  withSpeex ? false, speex,
+  withVorbis ? true, vorbis-tools, vorbisgain,
+  withMp3 ? true, lame, mp3gain,
+  withAac ? true, faad2, aacgain,
+  withUnfreeAac ? false, faac,
+  withFfmpeg ? true, ffmpeg-full,
+  withMplayer ? false, mplayer,
+  withSox ? true, sox,
+  withOpus ? true, opusTools,
+  withTwolame ? false, twolame,
+  withApe ? false, mac,
+  withWavpack ? false, wavpack
+}:
+
+assert withAac -> withFfmpeg || withUnfreeAac;
+assert withUnfreeAac -> withAac;
+
+let runtimeDeps = []
+    ++ lib.optional withCD cdparanoia
+    ++ lib.optional withFlac flac
+    ++ lib.optional withSpeex speex
+    ++ lib.optional withFfmpeg ffmpeg-full
+    ++ lib.optional withMplayer mplayer
+    ++ lib.optional withSox sox
+    ++ lib.optional withOpus opusTools
+    ++ lib.optional withTwolame twolame
+    ++ lib.optional withApe mac
+    ++ lib.optional withWavpack wavpack
+    ++ lib.optional withUnfreeAac faac
+    ++ lib.optionals withMidi [ fluidsynth timidity ]
+    ++ lib.optionals withVorbis [ vorbis-tools vorbisgain ]
+    ++ lib.optionals withMp3 [ lame mp3gain ]
+    ++ lib.optionals withAac [  faad2 aacgain ];
+
+in 
+mkDerivation rec {
+  name = "soundkonverter";
+  version = "3.0.1";
+  src = fetchFromGitHub {
+    owner = "dfaust";
+    repo = "soundkonverter";
+    rev = "v" + version;
+    sha256 = "1g2khdsjmsi4zzynkq8chd11cbdhjzmi37r9jhpal0b730nq9x7l";
+  };
+  enableParallelBuilding = true;
+  nativeBuildInputs = [ cmake extra-cmake-modules pkgconfig kdelibs4support makeWrapper ];
+  propagatedBuildInputs = [ libkcddb kconfig kconfigwidgets ki18n kdelibs4support kio solid kwidgetsaddons kxmlgui qtbase phonon];
+  buildInputs = [ taglib ] ++ runtimeDeps;
+  # encoder plugins go to ${out}/lib so they're found by kbuildsycoca5
+  cmakeFlags = [ "-DCMAKE_INSTALL_PREFIX=$out" ]; 
+  sourceRoot = "source/src";
+  # add runt-time deps to PATH
+  postInstall = ''
+    wrapProgram $out/bin/soundkonverter --prefix PATH : ${lib.makeBinPath runtimeDeps }
+    '';
+  meta = {
+    license = lib.licenses.gpl2;
+    maintainers = [ lib.maintainers.schmittlauch ];
+    description = "Audio file converter, CD ripper and Replay Gain tool";
+    longDescription = ''
+      soundKonverter is a frontend to various audio converters.
+      
+      The key features are:
+      - Audio file conversion
+      - Replay Gain calculation
+      - CD ripping
+      
+      soundKonverter supports reading and writing tags and covers for many formats, so they are preserved when converting files.
+      
+      It is extendable by plugins and supports many backends including:
+      
+      - Audio file conversion
+        Backends: faac, faad, ffmpeg, flac, lame, mplayer, neroaac, timidity, fluidsynth, vorbistools, opustools, sox, twolame,
+        flake, mac, shorten, wavpack and speex
+        Formats: ogg vorbis, mp3, flac, wma, aac, ac3, opus, alac, mp2, als, amr nb, amr wb, ape, speex, m4a, mp1, musepack shorten,
+        tta, wavpack, ra, midi, mod, 3gp, rm, avi, mkv, ogv, mpeg, mov, mp4, flv, wmv and rv
+      
+      - Replay Gain calculation
+        Backends: aacgain, metaflac, mp3gain, vorbisgain, wvgain, mpcgain
+        Formats: aac, mp3, flac, ogg vorbis, wavpack, musepack
+      
+      - CD ripping
+        Backends: cdparanoia
+      '';
+  };
+}
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -250,12 +250,12 @@ in

  clion = buildClion rec {
    name = "clion-${version}";
-    version = "2019.1"; /* updated by script */
+    version = "2019.1.2"; /* updated by script */
    description  = "C/C++ IDE. New. Intelligent. Cross-platform";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "1rlqnnv6b7lg18si31zd97ixnslwp8j6imkkjq0j5n9sydsr8xzj"; /* updated by script */
+      sha256 = "0x4fmbarckw60issrwk3cd65x5xjkxwrw4xq1qgfzmxfqhzbzvz8"; /* updated by script */
    };
    wmClass = "jetbrains-clion";
    update-channel = "CLion RELEASE"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@ -263,12 +263,12 @@ in

  datagrip = buildDataGrip rec {
    name = "datagrip-${version}";
-    version = "2018.3.4"; /* updated by script */
+    version = "2019.1.1"; /* updated by script */
    description = "Your Swiss Army Knife for Databases and SQL";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "10sw41kkf2k60xjpwgc73i182y7px3dmqz2awnrl4gffdb9jgzmy"; /* updated by script */
+      sha256 = "0w6hasb8vcbxdqmb0pngwr2jg0w14prqb4v7blraa5jf1xyyiayd"; /* updated by script */
    };
    wmClass = "jetbrains-datagrip";
    update-channel = "DataGrip RELEASE";
@ -276,12 +276,12 @@ in

  goland = buildGoland rec {
    name = "goland-${version}";
-    version = "2019.1"; /* updated by script */
+    version = "2019.1.1"; /* updated by script */
    description = "Up and Coming Go IDE";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0aq3x5aixh86h1zvvwrbr2f1nnqdpfvlsadd2ckmf5s5kghvg5r9"; /* updated by script */
+      sha256 = "0b8msq0raczm657rhbyqi702zv4zs66yd6dcm7s0l54hnas5ia9r"; /* updated by script */
    };
    wmClass = "jetbrains-goland";
    update-channel = "GoLand RELEASE";
@ -289,12 +289,12 @@ in

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "2019.1"; /* updated by script */
+    version = "2019.1.1"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "0zyw88dd2v4igp080l99cyq6h0bmyri8a50fjp69ripiz9qaawx1"; /* updated by script */
+      sha256 = "0xbdn1q0a2ksb7z26n2l889m6z0lh3b45clya7rdfl4jv2gkiaaq"; /* updated by script */
    };
    wmClass = "jetbrains-idea-ce";
    update-channel = "IntelliJ IDEA RELEASE";
@ -302,12 +302,12 @@ in

  idea-ultimate = buildIdea rec {
    name = "idea-ultimate-${version}";
-    version = "2019.1"; /* updated by script */
+    version = "2019.1.1"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
-      sha256 = "0fsdf090cwwrsq3azknc9rpwwsl71cvsx4flivnqwfakb6rh4f1j"; /* updated by script */
+      sha256 = "1pglvklbj4w6pmc7ffbjwwfqh7fad54yfx87m9plqk80rmpjzxfi"; /* updated by script */
    };
    wmClass = "jetbrains-idea";
    update-channel = "IntelliJ IDEA RELEASE";
@ -315,12 +315,12 @@ in

  phpstorm = buildPhpStorm rec {
    name = "phpstorm-${version}";
-    version = "2019.1"; /* updated by script */
+    version = "2019.1.1"; /* updated by script */
    description = "Professional IDE for Web and PHP developers";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "1bv2a16wsc9j82w14qfrfjgszwkihk0jwp8bp8z9618q04c8vmgf"; /* updated by script */
+      sha256 = "100whawwj1kiq870dsmkx33qv5ygjpr9977jkbavhqjnc1zhwl1r"; /* updated by script */
    };
    wmClass = "jetbrains-phpstorm";
    update-channel = "PhpStorm RELEASE";
@ -328,12 +328,12 @@ in

  pycharm-community = buildPycharm rec {
    name = "pycharm-community-${version}";
-    version = "2019.1"; /* updated by script */
+    version = "2019.1.1"; /* updated by script */
    description = "PyCharm Community Edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "173qm2g6pjga2jlw8sa59bxw543b56r56ikqwv2wp0jq5z61v26f"; /* updated by script */
+      sha256 = "1zz579kmskvgsjv2lriglxkdlx33mmfv2liw1b9iilspga59izld"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm-ce";
    update-channel = "PyCharm RELEASE";
@ -341,12 +341,12 @@ in

  pycharm-professional = buildPycharm rec {
    name = "pycharm-professional-${version}";
-    version = "2019.1"; /* updated by script */
+    version = "2019.1.1"; /* updated by script */
    description = "PyCharm Professional Edition";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0gjphdzdxgvflkzaakf3c1wnig86lxhxyx6xk6rg40yj6f2hzi47"; /* updated by script */
+      sha256 = "0hcij77j4zb1y1vls5nvxq3lmqrbppm3ml0p9nagbjipy2rmp838"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm";
    update-channel = "PyCharm RELEASE";
@ -367,12 +367,12 @@ in

  ruby-mine = buildRubyMine rec {
    name = "ruby-mine-${version}";
-    version = "2018.3.5"; /* updated by script */
+    version = "2019.1.1"; /* updated by script */
    description = "The Most Intelligent Ruby and Rails IDE";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "1gykag8fsfqxv0d6fipn18hhpdvn4qxva2kkb0v330vp73wm2i2w"; /* updated by script */
+      sha256 = "0asg0x8xcjyydy0p1fdlhpcwfckdf9719460pv5zwc7yfd8z61yd"; /* updated by script */
    };
    wmClass = "jetbrains-rubymine";
    update-channel = "RubyMine RELEASE";
@ -380,12 +380,12 @@ in

  webstorm = buildWebStorm rec {
    name = "webstorm-${version}";
-    version = "2019.1"; /* updated by script */
+    version = "2019.1.1"; /* updated by script */
    description = "Professional IDE for Web and JavaScript development";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "0r6a9g8ydnxf805gn2wajnwkcyfn0xksbsrs8wq6j4ghipkhscxj"; /* updated by script */
+      sha256 = "05lrsjk45l4xqjyinsqlnfr36qnv1nrgg2sskgi0bfjbdrfv9xrv"; /* updated by script */
    };
    wmClass = "jetbrains-webstorm";
    update-channel = "WebStorm RELEASE";
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@ -7,19 +7,19 @@ stdenv.mkDerivation rec {
    if stdenv.hostPlatform.system == "i686-linux" then
      fetchzip {
        url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_386_v${version}.zip";
-        sha256 = "14qx69fq1a3h93h167nhwp6gxka8r34295p82kim9grijrx5zz5f";
+        sha256 = "1jwkvj6xxfgn08j6wzwcra3p1dp04vblzr2g5s1y3bj4r7gs4gax";
        stripRoot = false;
      }
    else if stdenv.hostPlatform.system == "x86_64-linux" then
      fetchzip {
        url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_amd64_v${version}.zip";
-        sha256 = "1jh1sk07k3whbr0rvc4kf221wskcdbk0zpxaj49qbwq1d89cjnpg";
+        sha256 = "1svic2b2msbwzfx3qxfglxp0jjzy3p3v78273wab942zh822ld8b";
        stripRoot = false;
      }
    else if stdenv.hostPlatform.system == "x86_64-darwin" then
      fetchzip {
        url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_darwin_amd64_v${version}.zip";
-        sha256 = "1s6gw2qwsbhj4z9nrwrxs776y45ingpfp9533qz0gc1pk7ia99js";
+        sha256 = "03bnwn06066hvp0n30260mhvkjr60dl93nj9l7p6a0ndcv7w77r8";
        stripRoot = false;
      }
    else throw "Architecture not supported";
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@ -7,7 +7,7 @@

 stdenv.mkDerivation rec {
  name = "dbeaver-ce-${version}";
-  version = "6.0.2";
+  version = "6.0.3";

  desktopItem = makeDesktopItem {
    name = "dbeaver";
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "12zqz9zi4jryvlk1rjxfl4jdj4a6n00018yyk95glfdrxda2xyib";
+    sha256 = "0pcf8p9nmbj6kf32zrjjrfyxb07x37h56zm3s5gdf1jk2hvrarvl";
  };

  installPhase = ''
--- a/pkgs/applications/misc/evopedia/default.nix
+++ b/pkgs/applications/misc/evopedia/default.nix
@ -1,30 +0,0 @@
-{ stdenv, fetchFromGitHub, bzip2, qt4, qmake4Hook, libX11 }:
-
-stdenv.mkDerivation rec {
-  name = "evopedia-${version}";
-  version = "0.4.4";
-
-  src = fetchFromGitHub {
-    owner = "evopedia";
-    repo = "evopedia_qt";
-    rev = "v${version}";
-    sha256 = "0snp5qiywj306kfaywvkl7j34fivgxcb8dids1lzmbqq5xcpqqvc";
-  };
-
-  buildInputs = [ bzip2 qt4 libX11 ];
-  nativeBuildInputs = [ qmake4Hook ];
-
-  postInstall = ''
-    # Patch the `evopedia.desktop' file.
-    substituteInPlace $out/share/applications/evopedia.desktop \
-        --replace '/usr/bin/evopedia' $out/bin/evopedia
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Offline Wikipedia Viewer";
-    homepage = http://www.evopedia.info;
-    license = licenses.gpl3Plus;
-    maintainers = [ maintainers.qknight ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/misc/font-manager/correct-post-install.patch
+++ b/pkgs/applications/misc/font-manager/correct-post-install.patch
@ -1,13 +0,0 @@
-diff --git a/meson_post_install.py b/meson_post_install.py
-index 8d00e70..c28d19e 100644
--- a/meson_post_install.py
-+++ b/meson_post_install.py
-@@ -7,7 +7,7 @@ prefix = environ['MESON_INSTALL_PREFIX']
- data_dir = path.join(prefix, 'share')
- schema_dir = path.join(data_dir, 'glib-2.0', 'schemas')
- 
-if not environ['DESTDIR']:
-+if not environ.get('DESTDIR'):
-     print('Compiling gsettings schemas...')
-     call(['glib-compile-schemas', schema_dir])
-     print('Updating desktop database...')
--- a/pkgs/applications/misc/font-manager/default.nix
+++ b/pkgs/applications/misc/font-manager/default.nix
@ -10,8 +10,8 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner = "FontManager";
    repo = "master";
-    rev = "cc057f3e93f5b1033b04decee03cdb44177e48b3";
-    sha256 = "1xg80bi2465p5r8zfmb34iga9yqs3is1k4f13hw0ligvhb58gas0";
+    rev = version;
+    sha256 = "16hma8rrkam6ngn5vbdaryn31vdixvii6920g9z928gylz9xkd3g";
  };

  nativeBuildInputs = [
@ -38,10 +38,6 @@ stdenv.mkDerivation rec {
    gnome3.adwaita-icon-theme
  ];

-  patches = [
-   ./correct-post-install.patch
-  ];
-
  mesonFlags = [
    "-Ddisable_pycompile=true"
  ];
--- a/pkgs/applications/misc/kanboard/default.nix
+++ b/pkgs/applications/misc/kanboard/default.nix
@ -1,12 +1,14 @@
-{ stdenv, fetchzip }:
+{ stdenv, fetchFromGitHub }:

 stdenv.mkDerivation rec {
  name = "kanboard-${version}";
-  version = "1.0.48";
+  version = "1.2.9";

-  src = fetchzip {
-    url = "https://github.com/kanboard/kanboard/releases/download/v${version}/${name}.zip";
-    sha256 = "0ipyijlfcnfqlz9n20wcnaf9pw404a675x404pm9h2n4ld8x6m5v";
+  src = fetchFromGitHub {
+    owner = "kanboard";
+    repo = "kanboard";
+    rev = "v${version}";
+    sha256 = "1hdr95cpxgdzrzhffs63gdl0g7122ma2zg8bkqwp42p5xphx0xan";
  };

  dontBuild = true;
--- a/pkgs/applications/misc/kdeconnect/default.nix
+++ b/pkgs/applications/misc/kdeconnect/default.nix
@ -20,12 +20,11 @@

 stdenv.mkDerivation rec {
  pname = "kdeconnect";
-  version = "1.3.3";
-  name = "${pname}-${version}";
+  version = "1.3.4";

  src = fetchurl {
-    url = "mirror://kde/stable/${pname}/${version}/src/${pname}-kde-${version}.tar.xz";
-    sha256 = "1vac0mw1myrswr61adv7lgif0c4wzw5wnsj0sqxj6msp4l4pfgsg";
+    url = "mirror://kde/stable/${pname}/${version}/${pname}-kde-${version}.tar.xz";
+    sha256 = "12ijvp86wm6k81dggypxh3c0dmwg5mczxy43ra8rgv63aavmf42h";
  };

  buildInputs = [
--- a/pkgs/applications/misc/onboard/default.nix
+++ b/pkgs/applications/misc/onboard/default.nix
@ -1,5 +1,6 @@
 { fetchurl
 , stdenv
+, substituteAll
 , aspellWithDicts
 , at-spi2-core ? null
 , atspiSupport ? true
@ -16,6 +17,7 @@
 , intltool
 , isocodes
 , libcanberra-gtk3
+, mousetweaks
 , udev
 , libxkbcommon
 , pkgconfig
@ -38,6 +40,10 @@ in python3.pkgs.buildPythonApplication rec {
  };

  patches = [
+    (substituteAll {
+      src = ./fix-paths.patch;
+      inherit mousetweaks;
+    })
    # Allow loading hunspell dictionaries installed in NixOS system path
    ./hunspell-use-xdg-datadirs.patch
  ];
@ -79,6 +85,7 @@ in python3.pkgs.buildPythonApplication rec {
    hunspell
    isocodes
    libcanberra-gtk3
+    mousetweaks
    udev
    libxkbcommon
    wrapGAppsHook
--- a/pkgs/applications/misc/onboard/fix-paths.patch
+++ b/pkgs/applications/misc/onboard/fix-paths.patch
@ -0,0 +1,11 @@
+--- a/Onboard/ClickSimulator.py
+++ b/Onboard/ClickSimulator.py
+@@ -479,7 +479,7 @@ class CSMousetweaks(ConfigObject, ClickSimulator):
+         self._daemon_running_notify_callbacks = []
+
+     def _launch_daemon(self, delay):
+-        self.launcher.launch_delayed(["mousetweaks"], delay)
+        self.launcher.launch_delayed(["@mousetweaks@/bin/mousetweaks"], delay)
+
+     def _set_connection(self, active):
+         ''' Update interface object, state and notify listeners '''
--- a/pkgs/applications/misc/zola/default.nix
+++ b/pkgs/applications/misc/zola/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "zola";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "getzola";
    repo = pname;
    rev = "v${version}";
-    sha256 = "11y5gb6lx040ax4b16fr3whkj4vmv8hlkvb50h58gs77payglf6l";
+    sha256 = "02lr1n3gf0agj8x451ndyvv16lq7rccazp4nz9zy0pzwxwrlwhra";
  };

-  cargoSha256 = "19hqkj27dbsy4pi0i8mjjlhi4351yifvc6zln6scc2nd60p251h6";
+  cargoSha256 = "003dhh41fh337k3djibpj6hyd16xprbgws3lbp7x37p4lx7qlnfy";

  nativeBuildInputs = [ cmake pkgconfig ];
  buildInputs = [ openssl ] ++ stdenv.lib.optionals stdenv.isDarwin [ CoreServices cf-private ];
--- a/pkgs/applications/networking/flent/default.nix
+++ b/pkgs/applications/networking/flent/default.nix
@ -14,6 +14,8 @@ buildPythonApplication rec {

  buildInputs = [ sphinx ];

+  checkInputs = [ procps ];
+
  propagatedBuildInputs = [
    matplotlib
    procps
--- a/pkgs/applications/networking/instant-messengers/matrique/default.nix
+++ b/pkgs/applications/networking/instant-messengers/matrique/default.nix
@ -1,55 +0,0 @@
-{ stdenv, fetchFromGitLab, fetchFromGitHub, qmake
-, qtquickcontrols2, qtmultimedia, qtgraphicaleffects
-, libqmatrixclient
-}:
-
-let
-
-  libqmatrixclient_git = libqmatrixclient.overrideDerivation (oldAttrs: {
-    name = "libqmatrixclient-git-for-matrique";
-    src = fetchFromGitHub {
-      owner = "QMatrixClient";
-      repo = "libqmatrixclient";
-      rev = "d9ff200f";
-      sha256 = "0qxkffg1499wnn8rbndq6z51sz6hiij2pkp40cvs530sl0zg0c69";
-    };
-  });
-
-  SortFilterProxyModel = fetchFromGitLab {
-    owner = "b0";
-    repo = "SortFilterProxyModel";
-    rev = "3c2c125c";
-    sha256 = "1494dvq7kiq0ymf5f9hr47pw80zv3m3dncnaw1pnzs7mhkf2s5fr";
-  };
-
-in stdenv.mkDerivation rec {
-  name = "matrique-${version}";
-  version = "250";
-
-  src = fetchFromGitLab {
-    owner = "b0";
-    repo = "matrique";
-    rev = version;
-    sha256 = "0l7ag2q3l8ixczwc43igvkkl81g5s5j032gzizmgpzb1bjpdgry7";
-  };
-
-  postPatch = ''
-    rm -r include/*
-    ln -sf ${libqmatrixclient_git.src} include/libqmatrixclient
-    ln -sf ${SortFilterProxyModel} include/SortFilterProxyModel
-  '';
-
-  nativeBuildInputs = [ qmake ];
-  buildInputs = [
-    qtquickcontrols2 qtmultimedia qtgraphicaleffects
-    libqmatrixclient_git
-  ];
-
-  meta = with stdenv.lib; {
-    inherit (src.meta) homepage;
-    description = "A glossy client for Matrix";
-    maintainers = with maintainers; [ fpletz ];
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/networking/instant-messengers/quaternion/default.nix
+++ b/pkgs/applications/networking/instant-messengers/quaternion/default.nix
@ -1,36 +1,42 @@
 { stdenv, lib, fetchFromGitHub, qtbase, qtquickcontrols, cmake
-, qttools, libqmatrixclient }:
+, qttools, qtmultimedia
+, libqmatrixclient_0_4, libqmatrixclient_0_5 }:

-stdenv.mkDerivation rec {
-  name = "quaternion-${version}";
-  version = "0.0.9.3";
+let
+  generic = version: sha256: prefix: library: stdenv.mkDerivation rec {
+    name = "quaternion-${version}";

-  src = fetchFromGitHub {
-    owner  = "QMatrixClient";
-    repo   = "Quaternion";
-    rev    = "v${version}";
-    sha256 = "1hr9zqf301rg583n9jv256vzj7y57d8qgayk7c723bfknf1s6hh3";
+    src = fetchFromGitHub {
+      owner = "QMatrixClient";
+      repo  = "Quaternion";
+      rev   = "${prefix}${version}";
+      inherit sha256;
+    };
+
+    buildInputs = [ qtbase qtmultimedia qtquickcontrols qttools library ];
+
+    nativeBuildInputs = [ cmake ];
+
+    postInstall = if stdenv.isDarwin then ''
+      mkdir -p $out/Applications
+      mv $out/bin/quaternion.app $out/Applications
+      rmdir $out/bin || :
+    '' else ''
+      substituteInPlace $out/share/applications/quaternion.desktop \
+        --replace 'Exec=quaternion' "Exec=$out/bin/quaternion"
+    '';
+
+    meta = with lib; {
+      description = "Cross-platform desktop IM client for the Matrix protocol";
+      homepage    = https://matrix.org/docs/projects/client/quaternion.html;
+      license     = licenses.gpl3;
+      maintainers = with maintainers; [ peterhoeg ];
+      inherit (qtbase.meta) platforms;
+      inherit version;
+    };
  };

-  buildInputs = [ qtbase qtquickcontrols qttools libqmatrixclient ];
-
-  nativeBuildInputs = [ cmake ];
-
-  postInstall = if stdenv.isDarwin then ''
-    mkdir -p $out/Applications
-    mv $out/bin/quaternion.app $out/Applications
-    rmdir $out/bin || :
-  '' else ''
-    substituteInPlace $out/share/applications/quaternion.desktop \
-      --replace 'Exec=quaternion' "Exec=$out/bin/quaternion"
-  '';
-
-  meta = with lib; {
-    description = "Cross-platform desktop IM client for the Matrix protocol";
-    homepage    = https://matrix.org/docs/projects/client/quaternion.html;
-    license     = licenses.gpl3;
-    maintainers = with maintainers; [ peterhoeg ];
-    inherit (qtbase.meta) platforms;
-    inherit version;
-  };
+in rec {
+  quaternion     = generic "0.0.9.3"     "1hr9zqf301rg583n9jv256vzj7y57d8qgayk7c723bfknf1s6hh3" "v" libqmatrixclient_0_4;
+  quaternion-git = generic "0.0.9.4-rc3" "1fc3ya9fr3zw1cx7565s2rswzry98avslrryvdi0qa9yn0m3sw7p" ""  libqmatrixclient_0_5;
 }
--- a/pkgs/applications/networking/ipfs/default.nix
+++ b/pkgs/applications/networking/ipfs/default.nix
@ -1,24 +1,19 @@
-{ stdenv, buildGoPackage, fetchFromGitHub, fetchgx }:
+{ stdenv, buildGoPackage, fetchFromGitHub }:

 buildGoPackage rec {
  name = "ipfs-${version}";
-  version = "0.4.19";
+  version = "0.4.20";
  rev = "v${version}";

  goPackagePath = "github.com/ipfs/go-ipfs";

-  extraSrcPaths = [
-    (fetchgx {
-      inherit name src;
-      sha256 = "0bj2kzxjssp7szp1wr9pp08bsi55jgf0k7gi4h70phlib2q673j2";
-    })
-  ];
+  goDeps = ./deps.nix;

  src = fetchFromGitHub {
    owner = "ipfs";
    repo = "go-ipfs";
    inherit rev;
-    sha256 = "061mgkawimhw3gq506h8m6kw50a2v26qysa5kc5jdqgaqx5yvqh4";
+    sha256 = "1xnjn4pcgknywfndrp2zwln3v1msaffhhfiym5mdz543rsxav0yp";
  };

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/ipfs/deps.nix
+++ b/pkgs/applications/networking/ipfs/deps.nix
--- a/pkgs/applications/office/kexi/default.nix
+++ b/pkgs/applications/office/kexi/default.nix
@ -9,12 +9,12 @@

 mkDerivation rec {
  pname = "kexi";
-  version = "3.1.0";
+  version = "3.2.0";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "mirror://kde/stable/${pname}/src/${name}.tar.xz";
-    sha256 = "1ysj44qq75wglw4d080l3gfw47695gapf29scxhb1g3py55csmbd";
+    sha256 = "1zy1q7q9rfdaws3rwf3my22ywkn6g747s3ixfcg9r80mm2g3z0bs";
  };

  nativeBuildInputs = [ extra-cmake-modules kdoctools ];
@ -29,13 +29,6 @@ mkDerivation rec {

  propagatedUserEnvPkgs = [ kproperty ];

-  patches = [
-    (fetchpatch {
-      url = "https://phabricator.kde.org/file/data/6iwzltiifyqwjnzbvyo6/PHID-FILE-li4a7j35wkdkm2qdtnp4/D11503.diff";
-      sha256 = "0yj717m4x1zb4xjy1ayhz78xkxpawxgsvjgvf5iw81jnlr8absq9";
-    })
-  ];
-
  meta = with lib; {
    description = "A open source visual database applications creator, a long-awaited competitor for programs like MS Access or Filemaker";
    longDescription = ''
--- a/pkgs/applications/office/skrooge/default.nix
+++ b/pkgs/applications/office/skrooge/default.nix
@ -7,11 +7,11 @@

 mkDerivation rec {
  name = "skrooge-${version}";
-  version = "2.18.0";
+  version = "2.19.1";

  src = fetchurl {
    url = "http://download.kde.org/stable/skrooge/${name}.tar.xz";
-    sha256 = "00zk152clnmq8rjjnrxmd7lfflf2pnzljaw73bjjsb6r6vkxywa6";
+    sha256 = "04pajy540vwff1y84ndrnscvlggiwfkr6w65g4hpa75cg7m169ya";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/office/zim/default.nix
+++ b/pkgs/applications/office/zim/default.nix
@ -9,11 +9,11 @@

 python3Packages.buildPythonApplication rec {
  name = "zim-${version}";
-  version = "0.70";
+  version = "0.71.0";

  src = fetchurl {
    url = "http://zim-wiki.org/downloads/${name}.tar.gz";
-    sha256 = "1g1xj86iph1a2k4n9yykq0gipbd5jdd7fsh9qpv4v2h5lggadjdd";
+    sha256 = "0mr3911ls5zp3z776ysrdm3sg89zg29r3ip23msydcdbl8wymw30";
  };

  buildInputs = [ gtk3 gobject-introspection wrapGAppsHook ];
--- a/pkgs/applications/radio/cubicsdr/default.nix
+++ b/pkgs/applications/radio/cubicsdr/default.nix
@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub, cmake, fftw, hamlib, libpulseaudio, libGL, libX11, liquid-dsp,
+  pkgconfig, soapysdr-with-plugins, wxGTK, enableDigitalLab ? false }:
+
+stdenv.mkDerivation rec {
+  name = "cubicsdr-${version}";
+  version = "0.2.5";
+
+  src = fetchFromGitHub {
+    owner = "cjcliffe";
+    repo = "CubicSDR";
+    rev = version;
+    sha256 = "1ihbn18bzdcdvwpa4hnb55ns38bj4b8xy53hkmra809f9qpbcjhn";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+  buildInputs = [ fftw hamlib libpulseaudio libGL libX11 liquid-dsp soapysdr-with-plugins wxGTK ];
+
+  cmakeFlags = [ "-DUSE_HAMLIB=ON" ]
+    ++ stdenv.lib.optional enableDigitalLab "-DENABLE_DIGITAL_LAB=ON";
+
+  meta = with stdenv.lib; {
+    homepage = https://cubicsdr.com;
+    description = "Software Defined Radio application";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ lasandell ];
+    platforms = platforms.linux;
+  };
+}
+
--- a/pkgs/applications/science/biology/aragorn/default.nix
+++ b/pkgs/applications/science/biology/aragorn/default.nix
@ -0,0 +1,28 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  version = "1.2.38";
+  pname = "aragorn";
+
+  src = fetchurl {
+    url = "http://mbio-serv2.mbioekol.lu.se/ARAGORN/Downloads/${pname}${version}.tgz";
+    sha256 = "09i1rg716smlbnixfm7q1ml2mfpaa2fpn3hwjg625ysmfwwy712b";
+  };
+
+  buildPhase = ''
+    gcc -O3 -ffast-math -finline-functions -o aragorn aragorn${version}.c
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin && cp aragorn $out/bin
+    mkdir -p $out/man/1 && cp aragorn.1 $out/man/1
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Detects tRNA, mtRNA, and tmRNA genes in nucleotide sequences";
+    homepage = http://mbio-serv2.mbioekol.lu.se/ARAGORN/;
+    license = licenses.gpl2;
+    maintainers = [ maintainers.bzizou ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/science/math/R/default.nix
+++ b/pkgs/applications/science/math/R/default.nix
@ -1,18 +1,18 @@
 { stdenv, fetchurl, bzip2, gfortran, libX11, libXmu, libXt, libjpeg, libpng
 , libtiff, ncurses, pango, pcre, perl, readline, tcl, texLive, tk, xz, zlib
 , less, texinfo, graphviz, icu, pkgconfig, bison, imake, which, jdk, openblas
-, curl, Cocoa, Foundation, libobjc, libcxx, tzdata
+, curl, Cocoa, Foundation, libobjc, libcxx, tzdata, fetchpatch
 , withRecommendedPackages ? true
 , enableStrictBarrier ? false
 , javaSupport ? (!stdenv.hostPlatform.isAarch32 && !stdenv.hostPlatform.isAarch64)
 }:

 stdenv.mkDerivation rec {
-  name = "R-3.5.3";
+  name = "R-3.6.0";

  src = fetchurl {
    url = "https://cran.r-project.org/src/base/R-3/${name}.tar.gz";
-    sha256 = "1337irx9y0r3jm1rcq1dcwnxsgfhnvgjs5wadcyh17vhpnvkgyib";
+    sha256 = "02bmylmzrm9sdidirmwy233lghmd2346z725ca71ari68lzarz1n";
  };

  dontUseImakeConfigure = true;
@ -25,7 +25,13 @@ stdenv.mkDerivation rec {
    ++ stdenv.lib.optionals stdenv.isDarwin [ Cocoa Foundation libobjc libcxx ]
    ++ stdenv.lib.optional javaSupport jdk;

-  patches = [ ./no-usr-local-search-paths.patch ];
+  patches = [
+    ./no-usr-local-search-paths.patch
+    (fetchpatch {
+      url = "https://github.com/wch/r-source/commit/aeb75e12863019be06fe6c762ab705bf5ed8b38c.patch";
+      sha256 = "03xv1g1yw1dbhx4paw6pn6hkawj8sny86km3748l1vnasbham82g";
+      })
+  ];

  prePatch = stdenv.lib.optionalString stdenv.isDarwin ''
    substituteInPlace configure --replace "-install_name libR.dylib" "-install_name $out/lib/R/lib/libR.dylib"
@ -108,6 +114,6 @@ stdenv.mkDerivation rec {
    platforms = platforms.all;
    hydraPlatforms = platforms.linux;

-    maintainers = [ maintainers.peti ];
+    maintainers = with maintainers; [ peti timokau ];
  };
 }
--- a/pkgs/applications/science/math/geogebra/default.nix
+++ b/pkgs/applications/science/math/geogebra/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  name = "geogebra-${version}";
-  version = "5-0-472-0";
+  version = "5-0-535-0";

  preferLocalBuild = true;

@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
      "https://download.geogebra.org/installers/5.0/GeoGebra-Linux-Portable-${version}.tar.bz2"
      "http://web.archive.org/https://download.geogebra.org/installers/5.0/GeoGebra-Linux-Portable-${version}.tar.bz2"
    ];
-    sha256 = "1f56k5r5wf2l27sgp2vjpvx7wl72gizwxs0a6hngk15nzzka87v9";
+    sha256 = "1mbjwa9isw390i0k1yh6r9wmh8zkczian0v25w2vxb2a8vv0hjk0";
  };

  srcIcon = fetchurl {
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -134,6 +134,13 @@ stdenv.mkDerivation rec {
      url = "https://git.sagemath.org/sage.git/patch?id=d3483110474591ea6cc8e3210cd884f3e0018b3e";
      sha256 = "028i6h8l8npwzx5z0ax0rcywl85gc83qw1jf93zf523msdfcsk0n";
    })
+
+    # https://trac.sagemath.org/ticket/27738
+    (fetchpatch {
+      name = "R-3.6.0.patch";
+      url = "https://git.sagemath.org/sage.git/patch/?h=8b7dbd0805d02d0e8674a272e161ceb24a637966";
+      sha256 = "1c81f13z1w62s06yvp43gz6vkp8mxcs289n6l4gj9xj10slimzff";
+    })
  ];

  patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -200,14 +200,14 @@ rec {
  # Get revisions from
  # https://github.com/docker/docker-ce/tree/v${version}/components/engine/hack/dockerfile/install/*

-  docker_18_09 = dockerGen rec {
-    version = "18.09.2";
-    rev = "62479626f213818ba5b4565105a05277308587d5"; # git commit
-    sha256 = "05kvpy1c4g661xfds6dfzb8r5q76ndblxjykfj06had18pv0xxd4";
-    runcRev = "09c8266bf2fcf9519a651b04ae54c967b9ab86ec";
-    runcSha256 = "08h45vs1f25byapqzy6x42r86m232z166v6z81gc2a3id8v0nzia";
-    containerdRev = "9754871865f7fe2f4e74d43e2fc7ccd237edcbce";
-    containerdSha256 = "065snv0s3v3z0ghadlii4w78qnhchcbx2kfdrvm8fk8gb4pkx1ya";
+  docker_18_09 = makeOverridable dockerGen {
+    version = "18.09.5";
+    rev = "e8ff056dbcfadaeca12a5f508b0cec281126c01d";
+    sha256 = "16nd9vg2286m6v47fjq2zicmfvi8vwiwn24yylxia8b9mk417kdb";
+    runcRev = "2b18fe1d885ee5083ef9f0838fee39b62d653e30";
+    runcSha256 = "0g0d9mh5fcvsjgddiyw98ph5zpz5ivlwy89m45jxwbzkxb21gy7w";
+    containerdRev = "bb71b10fd8f58240ca47fbb579b9d1028eea7c84";
+    containerdSha256 = "0npbzixf3c0jvzm159vygvkydrr8h36c9sq50yv0mdinrys2bvg0";
    tiniRev = "fec3683b971d9c3ef73f284f176672c44b448662";
    tiniSha256 = "1h20i3wwlbd8x4jr2gz68hgklh0lb0jj7y5xk1wvr8y58fip1rdn";
  };
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -47,9 +47,10 @@ stdenv.mkDerivation rec {
    sha256 = "08frr1fdjx8qcfh3fafn10kibdwbvkqqvfl7hpqbm7i9dg4f1zlq";
  };

+  nativeBuildInputs = [ python2 pkgconfig flex bison ];
  buildInputs =
-    [ python2 zlib pkgconfig glib ncurses perl pixman
-      vde2 texinfo flex bison makeWrapper lzo snappy
+    [ zlib glib ncurses perl pixman
+      vde2 texinfo makeWrapper lzo snappy
      gnutls nettle curl
    ]
    ++ optionals stdenv.isDarwin [ CoreServices Cocoa Hypervisor rez setfile ]
--- a/pkgs/applications/window-managers/awesome/default.nix
+++ b/pkgs/applications/window-managers/awesome/default.nix
@ -42,17 +42,17 @@ with luaPackages; stdenv.mkDerivation rec {
  cmakeFlags = "-DOVERRIDE_VERSION=${version}";

  GI_TYPELIB_PATH = "${pango.out}/lib/girepository-1.0";
+  # LUA_CPATH and LUA_PATH are used only for *building*, see the --search flags
+  # below for how awesome finds the libraries it needs at runtime.
  LUA_CPATH = "${lgi}/lib/lua/${lua.luaversion}/?.so";
-  LUA_PATH  = "?.lua;${lgi}/share/lua/${lua.luaversion}/?.lua;${lgi}/share/lua/${lua.luaversion}/lgi/?.lua";
+  LUA_PATH  = "${lgi}/share/lua/${lua.luaversion}/?.lua;;";

  postInstall = ''
    wrapProgram $out/bin/awesome \
      --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
      --add-flags '--search ${lgi}/lib/lua/${lua.luaversion}' \
      --add-flags '--search ${lgi}/share/lua/${lua.luaversion}' \
-      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH" \
-      --prefix LUA_PATH ';'  "${lgi}/share/lua/${lua.luaversion}/?.lua;${lgi}/share/lua/${lua.luaversion}/lgi/?.lua" \
-      --prefix LUA_CPATH ';' "${lgi}/lib/lua/${lua.luaversion}/?.so"
+      --prefix GI_TYPELIB_PATH : "$GI_TYPELIB_PATH"

    wrapProgram $out/bin/awesome-client \
      --prefix PATH : "${which}/bin"
--- a/pkgs/applications/window-managers/sway/default.nix
+++ b/pkgs/applications/window-managers/sway/default.nix
@ -26,6 +26,7 @@ stdenv.mkDerivation rec {
      sha256 = "0r583nmqvq43ib93yv6flw8pj833v32lbs0q0xld56s3rnzvvdcp";
    })
    ./sway-config-no-nix-store-references.patch
+    ./load-configuration-from-etc.patch
  ];

  nativeBuildInputs = [ pkgconfig meson ninja scdoc ];
--- a/pkgs/applications/window-managers/sway/load-configuration-from-etc.patch
+++ b/pkgs/applications/window-managers/sway/load-configuration-from-etc.patch
@ -0,0 +1,42 @@
+From 26f9c65ef037892977a824f0d7d7111066856b53 Mon Sep 17 00:00:00 2001
+From: Michael Weiss <dev.primeos@gmail.com>
+Date: Sat, 27 Apr 2019 14:26:16 +0200
+Subject: [PATCH] Load configs from /etc but fallback to /nix/store
+
+This change will load all configuration files from /etc, to make it easy
+to override them, but fallback to /nix/store/.../etc/sway/config to make
+Sway work out-of-the-box with the default configuration on non NixOS
+systems.
+---
+ meson.build   | 3 ++-
+ sway/config.c | 1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index 02b5d606..c03a9c0f 100644
+--- a/meson.build
+++ b/meson.build
+@@ -129,7 +129,8 @@ if scdoc.found()
+ 	endforeach
+ endif
+ 
+-add_project_arguments('-DSYSCONFDIR="/@0@"'.format(join_paths(prefix, sysconfdir)), language : 'c')
+add_project_arguments('-DSYSCONFDIR="/@0@"'.format(sysconfdir), language : 'c')
+add_project_arguments('-DNIX_SYSCONFDIR="/@0@"'.format(join_paths(prefix, sysconfdir)), language : 'c')
+ 
+ version = '"@0@"'.format(meson.project_version())
+ if git.found()
+diff --git a/sway/config.c b/sway/config.c
+index 4cd21bbc..dd855753 100644
+--- a/sway/config.c
+++ b/sway/config.c
+@@ -317,6 +317,7 @@ static char *get_config_path(void) {
+ 		"$XDG_CONFIG_HOME/i3/config",
+ 		SYSCONFDIR "/sway/config",
+ 		SYSCONFDIR "/i3/config",
+		NIX_SYSCONFDIR "/sway/config",
+ 	};
+ 
+ 	char *config_home = getenv("XDG_CONFIG_HOME");
+-- 
+2.19.2
--- a/pkgs/build-support/appimage/default.nix
+++ b/pkgs/build-support/appimage/default.nix
@ -49,10 +49,12 @@ rec {
  } // (removeAttrs args (builtins.attrNames (builtins.functionArgs wrapAppImage))));

  wrapType1 = args@{ name, src, extraPkgs ? pkgs: [], ... }: wrapAppImage (args // {
+    inherit name extraPkgs;
    src = extractType1 { inherit name src; };
  });

  wrapType2 = args@{ name, src, extraPkgs ? pkgs: [], ... }: wrapAppImage (args // {
+    inherit name extraPkgs;
    src = extractType2 { inherit name src; };
  });

--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -1,7 +1,7 @@
 { stdenv, fetchzip }:

 let
-  version = "2.2.0";
+  version = "2.2.1";
 in fetchzip rec {
  name = "iosevka-bin-${version}";

@ -12,7 +12,7 @@ in fetchzip rec {
    unzip -j $downloadedFile \*.ttc -d $out/share/fonts/iosevka
  '';

-  sha256 = "038jpax2kgpknqzlg4iip4213f5lbs99iixsxccxy1bg4w7liqsa";
+  sha256 = "0d5ys9k8adj9v1hpwbmjqshzpjlnyj81xwp0328vc5q8pvjcfly6";

  meta = with stdenv.lib; {
    homepage = https://be5invis.github.io/Iosevka/;
--- a/pkgs/data/fonts/nahid-fonts/default.nix
+++ b/pkgs/data/fonts/nahid-fonts/default.nix
@ -0,0 +1,26 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "nahid-fonts";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "rastikerdar";
+    repo = "nahid-font";
+    rev = "v${version}";
+    sha256 = "0n42sywi41zin9dilr8vabmcqvmx2f1a8b4yyybs6ms9zb9xdkxg";
+  };
+
+  installPhase = ''
+    mkdir -p $out/share/fonts/nahid-fonts
+    cp -v $( find . -name '*.ttf') $out/share/fonts/nahid-fonts
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://github.com/rastikerdar/nahid-font;
+    description = "A Persian (Farsi) Font - قلم (فونت) فارسی ناهید";
+    license = licenses.free;
+    platforms = platforms.all;
+    maintainers = [ maintainers.linarcx ];
+  };
+}
--- a/pkgs/desktops/enlightenment/efl.nix
+++ b/pkgs/desktops/enlightenment/efl.nix
@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  name = "efl-${version}";
-  version = "1.21.1";
+  version = "1.22.1";

  src = fetchurl {
    url = "http://download.enlightenment.org/rel/libs/efl/${name}.tar.xz";
-    sha256 = "0a5907h896pvpix7a6idc2fspzy6d78xrzf84k8y9fyvnd14nxs4";
+    sha256 = "04mfjvaxi36b7r6kn4n0nq2gj97cbldk9iqnr5pf8jnm8plyblr0";
  };

  nativeBuildInputs = [ pkgconfig gtk3 ];
@ -29,9 +29,6 @@ stdenv.mkDerivation rec {
    harfbuzz jbig2dec librsvg dbus alsaLib poppler ghostscript libraw libspectre xineLib libwebp curl libdrm
    libinput utillinux fribidi SDL2 ];

-  # as of 1.21.0 compilation will fail due to -Werror=format-security
-  hardeningDisable = [ "format" ];
-
  # ac_ct_CXX must be set to random value, because then it skips some magic which does alternative searching for g++
  configureFlags = [
    "--enable-sdl"
@ -54,6 +51,10 @@ stdenv.mkDerivation rec {

  patches = [ ./efl-elua.patch ];

+  postPatch = ''
+    patchShebangs src/lib/elementary/config_embed
+  '';
+
  # bin/edje_cc creates $HOME/.run, which would break build of reverse dependencies.
  setupHook = writeText "setupHook.sh" ''
    export HOME="$TEMPDIR"
--- a/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
@ -13,6 +13,7 @@
 , libgnomekbd
 , lcms2
 , libpulseaudio
+, mousetweaks
 , alsaLib
 , libcanberra-gtk3
 , upower
@ -48,7 +49,7 @@ stdenv.mkDerivation rec {
  patches = [
    (substituteAll {
      src = ./fix-paths.patch;
-      inherit tzdata;
+      inherit tzdata mousetweaks;
    })
  ];

--- a/pkgs/desktops/gnome-3/core/gnome-settings-daemon/fix-paths.patch
+++ b/pkgs/desktops/gnome-3/core/gnome-settings-daemon/fix-paths.patch
@ -13,3 +13,14 @@
 
 typedef struct _TzDB TzDB;
 typedef struct _TzLocation TzLocation;
+--- a/plugins/mouse/gsd-mouse-manager.c
+++ b/plugins/mouse/gsd-mouse-manager.c
+@@ -118,7 +118,7 @@ set_mousetweaks_daemon (GsdMouseManager *manager,
+         gboolean run_daemon = dwell_click_enabled || secondary_click_enabled;
+
+         if (run_daemon || manager->priv->mousetweaks_daemon_running)
+-                comm = g_strdup_printf ("mousetweaks %s",
+                comm = g_strdup_printf ("@mousetweaks@/bin/mousetweaks %s",
+                                         run_daemon ? "" : "-s");
+         else
+                 return;
--- a/pkgs/desktops/gnome-3/core/mutter/3.28.nix
+++ b/pkgs/desktops/gnome-3/core/mutter/3.28.nix
@ -1,5 +1,5 @@
 { fetchFromGitLab, stdenv, substituteAll, pkgconfig, gnome3, intltool, gobject-introspection, upower, cairo
-, glib, gtk3, pango, cogl, clutter, libstartup_notification, zenity, libcanberra-gtk3
+, glib, gtk3, pango, cogl, clutter, libstartup_notification, zenity, libcanberra-gtk3, fetchpatch
 , gsettings-desktop-schemas, gnome-desktop, wrapGAppsHook
 , libtool, makeWrapper, xkeyboard_config, libxkbfile, libxkbcommon, libXtst, libinput
 , geocode-glib, libgudev, libwacom, xwayland, autoreconfHook }:
@ -21,6 +21,33 @@ stdenv.mkDerivation rec {
      src = ./fix-paths-328.patch;
      inherit zenity;
    })
+
+    # https://bugzilla.redhat.com/show_bug.cgi?id=1700337
+    # https://gitlab.gnome.org/GNOME/mutter/merge_requests/133
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/mutter328/raw/fff28bebda02111b4c534952465ff967ba7efced/f/0070-clutter-Add-API-to-retrieve-the-physical-size-of-abs.patch";
+      sha256 = "11xg0clrqwvssy2r6hv4iya8g87z2v5f47fimd2b4hha6ki3g1is";
+    })
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/mutter328/raw/fff28bebda02111b4c534952465ff967ba7efced/f/0071-backends-Add-MetaInputMapper.patch";
+      sha256 = "1kcp42hg8sy1q21w5586gdgmi95nf36829kkfswbah61h6bkb518";
+    })
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/mutter328/raw/fff28bebda02111b4c534952465ff967ba7efced/f/0072-backends-Delegate-on-MetaInputMapper-for-unmapped-di.patch";
+      sha256 = "0zf4yxhq5s3dnzmn15mx4yb978g27ij4vmq055my9p7xgh6h9ga8";
+    })
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/mutter328/raw/fff28bebda02111b4c534952465ff967ba7efced/f/0073-backends-Add-MetaInputMapper-method-to-lookup-device.patch";
+      sha256 = "0dnb2hqx5in6x9ar6wnr1hy3bg2wdcl3wbdx4jn66c7bi7s1k5zd";
+    })
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/mutter328/raw/fff28bebda02111b4c534952465ff967ba7efced/f/0074-backends-Turn-builtin-touchscreen-on-off-together-wi.patch";
+      sha256 = "17fvs7j5ws4sz6fkch93gjlik0nm4z426w4n348gyw5llh0r76pg";
+    })
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/mutter328/raw/fff28bebda02111b4c534952465ff967ba7efced/f/0075-backends-Update-to-new-output-setting-for-tablets-to.patch";
+      sha256 = "141p3an83s042f67fw2fqmr79i5g634ndrbpd8cs47fd4wwiwpj5";
+    })
  ];

  configureFlags = [
--- a/pkgs/desktops/gnustep/libobjc2/default.nix
+++ b/pkgs/desktops/gnustep/libobjc2/default.nix
@ -1,20 +1,17 @@
 { stdenv, lib, fetchFromGitHub, cmake }:

-let
-  version = "1.8.1";
-in
-
 stdenv.mkDerivation rec {
-  name = "libobjc2-${version}";
+  pname = "libobjc2";
+  version = "1.9";

  src = fetchFromGitHub {
    owner = "gnustep";
    repo = "libobjc2";
    rev = "v${version}";
-    sha256 = "12v9pjg97h56mb114cqd22q1pdwhmxrgdw5hal74ddlrhiq1nzvi";
+    sha256 = "00pscl3ly3rv6alf9vk70kxnnxq2rfgpc1ylcv6cgjs9jxdnrqmn";
  };

-  buildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ];

  cmakeFlags = [ "-DCMAKE_INSTALL_LIBDIR=lib" ];

--- a/pkgs/desktops/mate/marco/default.nix
+++ b/pkgs/desktops/mate/marco/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "marco-${version}";
-  version = "1.22.0";
+  version = "1.22.1";

  src = fetchurl {
    url = "http://pub.mate-desktop.org/releases/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1i1pi1z9mrb6564mxcwb93jqpdppfv58c2viwmicsixis62hv5wx";
+    sha256 = "1j7pvq8ndyl2x8jmh95sj69cnf0q9qsjn7lkr3jz6hk103mga82f";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-session-manager/default.nix
+++ b/pkgs/desktops/mate/mate-session-manager/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  name = "mate-session-manager-${version}";
-  version = "1.22.0";
+  version = "1.22.1";

  src = fetchurl {
    url = "http://pub.mate-desktop.org/releases/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1kpfmgay01gm74paaxccs3lim4jfb4hsm7i85jfdypr51985pwyj";
+    sha256 = "1ix8picxgc28m5zd0ww3zvzw6rz38wvzsrbqw28hghrfg926h6ig";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/mate/mate-system-monitor/default.nix
+++ b/pkgs/desktops/mate/mate-system-monitor/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "mate-system-monitor-${version}";
-  version = "1.22.0";
+  version = "1.22.1";

  src = fetchurl {
    url = "http://pub.mate-desktop.org/releases/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0rs0n5ivmvi355fp3ymcp1jj2sz9viw31475aw7zh7s1l7dn969x";
+    sha256 = "0yh1sh5snd7ivchh6l9rbn1s7ia4j5ihhzhqkyjnhr8ln59dvcbm";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
@ -22,6 +22,7 @@
 , libxml2
 , libxslt
 , meson
+, mousetweaks
 , networkmanager
 , ninja
 , nss
@ -30,12 +31,12 @@
 , pkgconfig
 , polkit
 , python3
+, stdenv
 , substituteAll
 , systemd
 , tzdata
 , upower
 , wrapGAppsHook
-, stdenv
 }:

 stdenv.mkDerivation rec {
@ -63,7 +64,7 @@ stdenv.mkDerivation rec {
  patches = let patchPath = "${src2}/debian/patches"; in [
    (substituteAll {
      src = ./fix-paths.patch;
-      inherit tzdata;
+      inherit tzdata mousetweaks;
    })
    "${patchPath}/45_suppress-printer-may-not-be-connected-notification.patch"
    "${patchPath}/64_restore_terminal_keyboard_shortcut_schema.patch"
--- a/pkgs/desktops/pantheon/services/elementary-settings-daemon/fix-paths.patch
+++ b/pkgs/desktops/pantheon/services/elementary-settings-daemon/fix-paths.patch
@ -13,3 +13,14 @@
 
 typedef struct _TzDB TzDB;
 typedef struct _TzLocation TzLocation;
+--- a/plugins/mouse/gsd-mouse-manager.c
+++ b/plugins/mouse/gsd-mouse-manager.c
+@@ -118,7 +118,7 @@ set_mousetweaks_daemon (GsdMouseManager *manager,
+         gboolean run_daemon = dwell_click_enabled || secondary_click_enabled;
+
+         if (run_daemon || manager->priv->mousetweaks_daemon_running)
+-                comm = g_strdup_printf ("mousetweaks %s",
+                comm = g_strdup_printf ("@mousetweaks@/bin/mousetweaks %s",
+                                         run_daemon ? "" : "-s");
+         else
+                 return;
--- a/pkgs/desktops/plasma-5/default.nix
+++ b/pkgs/desktops/plasma-5/default.nix
@ -102,6 +102,7 @@ let
      breeze-qt5 = callPackage ./breeze-qt5.nix {};
      breeze-grub = callPackage ./breeze-grub.nix {};
      breeze-plymouth = callPackage ./breeze-plymouth {};
+      discover = callPackage ./discover.nix {};
      kactivitymanagerd = callPackage ./kactivitymanagerd.nix {};
      kde-cli-tools = callPackage ./kde-cli-tools.nix {};
      kde-gtk-config = callPackage ./kde-gtk-config { inherit gsettings-desktop-schemas; };
--- a/pkgs/desktops/plasma-5/discover.nix
+++ b/pkgs/desktops/plasma-5/discover.nix
@ -0,0 +1,20 @@
+{
+  mkDerivation,
+  extra-cmake-modules, gettext, kdoctools, python,
+  appstream-qt, discount, flatpak, fwupd, ostree, packagekit-qt, pcre, utillinux,
+  qtquickcontrols2,
+  karchive, kconfig, kcrash, kdbusaddons, kdeclarative, kio, kirigami2, kitemmodels,
+  knewstuff, kwindowsystem, kxmlgui, plasma-framework
+}:
+
+mkDerivation {
+  name = "discover";
+  nativeBuildInputs = [ extra-cmake-modules gettext kdoctools python ];
+  buildInputs = [
+    # discount is needed for libmarkdown
+    appstream-qt discount flatpak fwupd ostree packagekit-qt pcre utillinux
+    qtquickcontrols2
+    karchive kconfig kcrash kdbusaddons kdeclarative kio kirigami2 kitemmodels knewstuff kwindowsystem kxmlgui
+    plasma-framework
+  ];
+}
--- a/pkgs/development/compilers/adoptopenjdk-bin/sources.json
+++ b/pkgs/development/compilers/adoptopenjdk-bin/sources.json
@ -5,7 +5,7 @@
        "hotspot": {
          "aarch64": {
            "build": "7",
-            "sha256": "ac367f3261fb53508c07f7eeb767b11ab53681b7613b81b6b7030c4db00b1aa8",
+            "sha256": "894a846600ddb0df474350037a2fb43e3343dc3606809a20c65e750580d8f2b9",
            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.3%2B7/OpenJDK11U-jdk_aarch64_linux_hotspot_11.0.3_7.tar.gz",
            "version": "11.0.3"
          },
@ -33,7 +33,7 @@
        "hotspot": {
          "aarch64": {
            "build": "7",
-            "sha256": "4af5b7d6678d03f2207029a7c610d81b1f016462c1dfcd8153a227b1df973a42",
+            "sha256": "de31fab70640c6d5099de5fc8fa8b4d6b484a7352fa48a9fafbdc088ca708564",
            "url": "https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.3%2B7/OpenJDK11U-jre_aarch64_linux_hotspot_11.0.3_7.tar.gz",
            "version": "11.0.3"
          },
--- a/pkgs/development/compilers/openjdk/8.nix
+++ b/pkgs/development/compilers/openjdk/8.nix
@ -95,6 +95,9 @@ let
      ./swing-use-gtk-jdk8.patch
    ];

+    # Hotspot cares about the host(!) version otherwise
+    DISABLE_HOTSPOT_OS_VERSION_CHECK = "ok";
+
    preConfigure = ''
      chmod +x configure
      substituteInPlace configure --replace /bin/bash "${bash}/bin/bash"
--- a/pkgs/development/compilers/oraclejdk/jdk8cpu-linux.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk8cpu-linux.nix
@ -2,13 +2,13 @@
 # jce download url: http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html;
 import ./jdk-linux-base.nix {
  productVersion = "8";
-  patchVersion = "201";
-  buildVersion = "09";
-  sha256.i686-linux = "1f9n93zmkggchaxkchp4bqasvxznn96zjci34f52h7v392jkzqac";
-  sha256.x86_64-linux = "0w730v2q0iaxf2lprabwmy7129byrs0hhdbwas575p1xmk00qw6b";
-  sha256.armv7l-linux = "0y6bvq93lsf21v6ca536dpfhkk5ljsj7c6di0qzkban37bivj0si";
-  sha256.aarch64-linux = "1bybysgg9llqzllsmdszmmb73v5az2l1shxn6lxwv3wwiazpf47q";
-  releaseToken = "42970487e3af4f5aa5bca3f542482c60";
+  patchVersion = "211";
+  buildVersion = "12";
+  sha256.i686-linux = "0mdrljs0rw9s4pvaa3sn791nqgdrp8749z3qn80y7hhad74kvsnp";
+  sha256.x86_64-linux = "13b6qk4sn8jdhxa22na9d2aazm4yjh6yxrlxr189gxy3619y9dy0";
+  sha256.armv7l-linux = "1ij1x925k7lyp5f98gy8r0xfr41qhczf2rb74plwwmrccc1k00p5";
+  sha256.aarch64-linux = "041r615qj9qy34a9gxm8968qlmf060ba2as5w97v86mbik4rca05";
+  releaseToken = "478a62b7d4e34b78b671c754eaaf38ab";
  jceName = "jce_policy-8.zip";
  sha256JCE = "0n8b6b8qmwb14lllk2lk1q1ahd3za9fnjigz5xn65mpg48whl0pk";
 }
--- a/pkgs/development/compilers/oraclejdk/jdk8psu-linux.nix
+++ b/pkgs/development/compilers/oraclejdk/jdk8psu-linux.nix
@ -2,13 +2,13 @@
 # jce download url: http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html;
 import ./jdk-linux-base.nix {
  productVersion = "8";
-  patchVersion = "202";
-  buildVersion = "09";
-  sha256.i686-linux = "19np392dwdqdq39lmm10607w2h042lrm5953fnsfh1bb9jli1pgj";
-  sha256.x86_64-linux = "1q4l8pymjvsvxfwaw0rdcnhryh1la2bvg5f4d4my41ka390k4p4s";
-  sha256.armv7l-linux = "06aljl7dqmmhmp7xswgvkcgh9mam71wnqydg9yb3hkcc443cm581";
-  sha256.aarch64-linux = "12v9ndv7a2c9zqq6ai2vsgwad0lzmf4c6jxy4p9miapmhjzx5vii";
-  releaseToken = "42970487e3af4f5aa5bca3f542482c60";
+  patchVersion = "212";
+  buildVersion = "10";
+  sha256.i686-linux = "03dj9q0bi3ib731f4zl9hylkrgw417h6qlg2wi7nw71b0fqhijn1";
+  sha256.x86_64-linux = "1yzddxzfh6h14bpzis1abp52x4jjljg8a3zyqz483q6qm05caq1i";
+  sha256.armv7l-linux = "0x333alkqdx8mmiirair7g5iiwif5v9ka4j3qr0f42ilvmk8csnx";
+  sha256.aarch64-linux = "0vcbdvcsl8rm47i07s93jmrrs5laibf937d8vacjqqgh9bbhsr2c";
+  releaseToken = "59066701cf1a433da9770636fbc4c9aa";
  jceName = "jce_policy-8.zip";
  sha256JCE = "0n8b6b8qmwb14lllk2lk1q1ahd3za9fnjigz5xn65mpg48whl0pk";
 }
--- a/pkgs/development/compilers/sbcl/bootstrap.nix
+++ b/pkgs/development/compilers/sbcl/bootstrap.nix
@ -3,9 +3,9 @@
 let
  options = rec {
    x86_64-darwin = rec {
-      version = "1.1.8";
+      version = "1.2.11";
      system = "x86-64-darwin";
-      sha256 = "006pr88053wclvbjfjdypnbiw8wymbzdzi7a6kbkpdfn4zf5943j";
+      sha256 = "0lh4gpvi8hl6g6b9321g5pwh8sk3218i7h4lx7p3vd9z0cf3lz85";
    };
    x86_64-linux = rec {
      version = "1.3.16";
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@ -10,11 +10,11 @@

 stdenv.mkDerivation rec {
  name    = "sbcl-${version}";
-  version = "1.5.0";
+  version = "1.5.1";

  src = fetchurl {
    url    = "mirror://sourceforge/project/sbcl/sbcl/${version}/${name}-source.tar.bz2";
-    sha256 = "1a4c84b6qqi4w4l1zzhnhnywk73j3wb0gjgghzcw0h5syqbqzy8z";
+    sha256 = "08z62qba0kmm15k93s2rq7ipi769895g8iwigcp20qjh6amwnwph";
  };

  buildInputs = [texinfo];
--- a/pkgs/development/compilers/swi-prolog/default.nix
+++ b/pkgs/development/compilers/swi-prolog/default.nix
@ -1,22 +1,30 @@
-{ stdenv, fetchurl, jdk, gmp, readline, openssl, libjpeg, unixODBC, zlib
+{ stdenv, fetchgit, jdk, gmp, readline, openssl, libjpeg, unixODBC, zlib
 , libXinerama, libarchive, db, pcre, libedit, libossp_uuid, libXft, libXpm
 , libSM, libXt, freetype, pkgconfig, fontconfig, makeWrapper ? stdenv.isDarwin
+, git, cacert, cmake, libyaml
+, extraLibraries ? [ jdk unixODBC libXpm libSM libXt freetype fontconfig ]
+, extraPacks     ? []
 }:

 let
-  version = "7.6.4";
+  version = "8.1.4";
+  packInstall = swiplPath: pack:
+    ''${swiplPath}/bin/swipl -g "pack_install(${pack}, [package_directory(\"${swiplPath}/lib/swipl/pack\"), silent(true), interactive(false)])." -t "halt."
+    '';
 in
 stdenv.mkDerivation {
  name = "swi-prolog-${version}";

-  src = fetchurl {
-    url = "http://www.swi-prolog.org/download/stable/src/swipl-${version}.tar.gz";
-    sha256 = "14bq4sqs61maqpnmgy6687jjj0shwc27cpfsqbf056nrssmplg9d";
+  src = fetchgit {
+    url = "https://github.com/SWI-Prolog/swipl-devel";
+    rev = "V${version}";
+    sha256 = "0qxa6f5dypwczxajlf0l736adbjb17cbak3qsh5g04hpv2bxm6dh";
  };

-  buildInputs = [ jdk gmp readline openssl libjpeg unixODBC libXinerama
-    libarchive db pcre libedit libossp_uuid libXft libXpm libSM libXt
-    zlib freetype pkgconfig fontconfig ]
+  buildInputs = [ cacert git cmake gmp readline openssl
+    libarchive libyaml db pcre libedit libossp_uuid
+    zlib pkgconfig ]
+  ++ extraLibraries
  ++ stdenv.lib.optional stdenv.isDarwin makeWrapper;

  hardeningDisable = [ "format" ];
@ -27,7 +35,20 @@ stdenv.mkDerivation {
    "--enable-shared"
  ];

-  buildFlags = "world";
+  installPhase = ''
+    mkdir -p $out
+    mkdir build
+    cd build
+    ${cmake}/bin/cmake -DCMAKE_INSTALL_PREFIX=$out ..
+    cd ../
+    make
+    make install
+    make clean
+    mkdir -p $out/lib/swipl/pack
+  ''
+  + builtins.concatStringsSep "\n"
+  ( builtins.map (packInstall "$out") extraPacks
+  );

  # For macOS: still not fixed in upstream: "abort trap 6" when called
  # through symlink, so wrap binary.
--- a/pkgs/development/idris-modules/glfw.nix
+++ b/pkgs/development/idris-modules/glfw.nix
@ -10,8 +10,14 @@ build-idris-package  {

  idrisDeps = [ effects ];

+  nativeBuildInputs = [ pkgs.pkgconfig ];
  extraBuildInputs = [ pkgs.glfw ];

+  postPatch = ''
+    substituteInPlace src/MakefileGlfw \
+      --replace glfw3 "glfw3 gl"
+  '';
+
  src = fetchFromGitHub {
    owner = "eckart";
    repo = "glfw-idris";
--- a/pkgs/development/idris-modules/idris-wrapper.nix
+++ b/pkgs/development/idris-modules/idris-wrapper.nix
@ -1,4 +1,4 @@
-{ lib, symlinkJoin, makeWrapper, idris-no-deps, gcc, gmp }:
+{ stdenv, lib, symlinkJoin, makeWrapper, idris-no-deps, gmp }:

 symlinkJoin {
  inherit (idris-no-deps) name src meta;
@ -6,7 +6,9 @@ symlinkJoin {
  buildInputs = [ makeWrapper ];
  postBuild = ''
    wrapProgram $out/bin/idris \
-      --run 'export IDRIS_CC=''${IDRIS_CC:-${lib.getBin gcc}/bin/gcc}' \
-      --suffix LIBRARY_PATH : ${lib.makeLibraryPath [ gmp ]}
+      --run 'export IDRIS_CC=''${IDRIS_CC:-${stdenv.cc}/bin/cc}' \
+      --set NIX_CC_WRAPPER_${stdenv.cc.infixSalt}_TARGET_HOST 1 \
+      --prefix NIX_CFLAGS_COMPILE " " "-I${lib.getDev gmp}/include" \
+      --prefix NIX_CFLAGS_LINK " " "-L${lib.getLib gmp}/lib"
  '';
 }
--- a/pkgs/development/interpreters/lua-5/5.1.nix
+++ b/pkgs/development/interpreters/lua-5/5.1.nix
@ -1,76 +0,0 @@
-{ stdenv, fetchurl, readline
-, self
-, callPackage
-, packageOverrides ? (self: super: {})
-}:
-
-let
-  dsoPatch = fetchurl {
-    url = "https://projects.archlinux.org/svntogit/packages.git/plain/trunk/lua-arch.patch?h=packages/lua51";
-    sha256 = "11fcyb4q55p4p7kdb8yp85xlw8imy14kzamp2khvcyxss4vw8ipw";
-    name = "lua-arch.patch";
-  };
-  luaPackages = callPackage ../../lua-modules {lua=self; overrides=packageOverrides;};
-in
-stdenv.mkDerivation rec {
-  name = "lua-${version}";
-  version = "5.1.5";
-  luaversion = "5.1";
-
-  src = fetchurl {
-    url = "https://www.lua.org/ftp/${name}.tar.gz";
-    sha256 = "2640fc56a795f29d28ef15e13c34a47e223960b0240e8cb0a82d9b0738695333";
-  };
-
-  LuaPathSearchPaths    = luaPackages.getLuaPathList luaversion;
-  LuaCPathSearchPaths   = luaPackages.getLuaCPathList luaversion;
-  setupHook = luaPackages.lua-setup-hook LuaPathSearchPaths LuaCPathSearchPaths;
-
-  buildInputs = [ readline ];
-
-  patches = (if stdenv.isDarwin then [ ./5.1.darwin.patch ] else [ dsoPatch ])
-    ++ [ ./5.1.0004-Fix-stack-overflow-in-vararg-functions.patch ];
-
-  configurePhase =
-    if stdenv.isDarwin
-    then ''
-    makeFlagsArray=( INSTALL_TOP=$out INSTALL_MAN=$out/share/man/man1 PLAT=macosx CFLAGS="-DLUA_USE_LINUX -fno-common -O2" LDFLAGS="" CC="$CC" )
-    installFlagsArray=( TO_BIN="lua luac" TO_LIB="liblua.5.1.5.dylib" INSTALL_DATA='cp -d' )
-  '' else ''
-    makeFlagsArray=( INSTALL_TOP=$out INSTALL_MAN=$out/share/man/man1 PLAT=linux CFLAGS="-DLUA_USE_LINUX -O2 -fPIC" LDFLAGS="-fPIC" CC="$CC" AR="$AR q" RANLIB="$RANLIB" )
-    installFlagsArray=( TO_BIN="lua luac" TO_LIB="liblua.a liblua.so liblua.so.5.1 liblua.so.5.1.5" INSTALL_DATA='cp -d' )
-  '';
-
-  postInstall = ''
-    mkdir -p "$out/share/doc/lua" "$out/lib/pkgconfig"
-    sed <"etc/lua.pc" >"$out/lib/pkgconfig/lua.pc" -e "s|^prefix=.*|prefix=$out|"
-    mv "doc/"*.{gif,png,css,html} "$out/share/doc/lua/"
-    rmdir $out/{share,lib}/lua/5.1 $out/{share,lib}/lua
-  '';
-
-  passthru = rec {
-    buildEnv = callPackage ./wrapper.nix {
-      lua=self;
-      inherit (luaPackages) requiredLuaModules;
-    };
-    withPackages = import ./with-packages.nix { inherit buildEnv luaPackages;};
-    pkgs = luaPackages;
-    interpreter = "${self}/bin/lua";
-  };
-
-  meta = {
-    homepage = http://www.lua.org;
-    description = "Powerful, fast, lightweight, embeddable scripting language";
-    longDescription = ''
-      Lua combines simple procedural syntax with powerful data
-      description constructs based on associative arrays and extensible
-      semantics. Lua is dynamically typed, runs by interpreting bytecode
-      for a register-based virtual machine, and has automatic memory
-      management with incremental garbage collection, making it ideal
-      for configuration, scripting, and rapid prototyping.
-    '';
-    license = stdenv.lib.licenses.mit;
-    platforms = with stdenv.lib.platforms; linux ++ darwin;
-    hydraPlatforms = stdenv.lib.platforms.linux;
-  };
-}
--- a/pkgs/development/interpreters/lua-5/5.2.nix
+++ b/pkgs/development/interpreters/lua-5/5.2.nix
@ -1,95 +0,0 @@
-{ stdenv, fetchurl, readline
-# compiles compatibility layer with lua5.1
-, compat ? false
-, callPackage
-, self
-, packageOverrides ? (self: super: {})
-}:
-
-let
-  dsoPatch = fetchurl {
-    url = "https://projects.archlinux.org/svntogit/packages.git/plain/trunk/liblua.so.patch?h=packages/lua52";
-    sha256 = "1by1dy4ql61f5c6njq9ibf9kaqm3y633g2q8j54iyjr4cxvqwqz9";
-    name = "lua-arch.patch";
-  };
-  luaPackages = callPackage ../../lua-modules {lua=self; overrides=packageOverrides;};
-in
-stdenv.mkDerivation rec {
-  name = "lua-${version}";
-  luaversion = "5.2";
-  version = "${luaversion}.4";
-
-  LuaPathSearchPaths    = luaPackages.getLuaPathList luaversion;
-  LuaCPathSearchPaths   = luaPackages.getLuaCPathList luaversion;
-  setupHook = luaPackages.lua-setup-hook LuaPathSearchPaths LuaCPathSearchPaths;
-
-  src = fetchurl {
-    url = "https://www.lua.org/ftp/${name}.tar.gz";
-    sha256 = "0jwznq0l8qg9wh5grwg07b5cy3lzngvl5m2nl1ikp6vqssmf9qmr";
-  };
-
-  buildInputs = [ readline ];
-
-  patches = if stdenv.isDarwin then [ ./5.2.darwin.patch ] else [ dsoPatch ];
-
-
-  passthru = rec {
-    buildEnv = callPackage ./wrapper.nix {
-      lua = self;
-      inherit (luaPackages) requiredLuaModules;
-    };
-    withPackages = import ./with-packages.nix { inherit buildEnv luaPackages;};
-    pkgs = luaPackages;
-    interpreter = "${self}/bin/lua";
-  };
-
-  enableParallelBuilding = true;
-
-  configurePhase =
-    if stdenv.isDarwin
-    then ''
-    makeFlagsArray=( INSTALL_TOP=$out INSTALL_MAN=$out/share/man/man1 PLAT=macosx CFLAGS="-DLUA_USE_LINUX -fno-common -O2 -fPIC${if compat then " -DLUA_COMPAT_ALL" else ""}" LDFLAGS="-fPIC" V=${luaversion} R=${version}  CC="$CC" )
-    installFlagsArray=( TO_BIN="lua luac" TO_LIB="liblua.${version}.dylib" INSTALL_DATA='cp -d' )
-  '' else ''
-    makeFlagsArray=( INSTALL_TOP=$out INSTALL_MAN=$out/share/man/man1 PLAT=linux CFLAGS="-DLUA_USE_LINUX -O2 -fPIC${if compat then " -DLUA_COMPAT_ALL" else ""}" LDFLAGS="-fPIC" V=${luaversion} R=${version} CC="$CC" AR="$AR q" RANLIB="$RANLIB" )
-    installFlagsArray=( TO_BIN="lua luac" TO_LIB="liblua.a liblua.so liblua.so.${luaversion} liblua.so.${version}" INSTALL_DATA='cp -d' )
-  '';
-
-  postInstall = ''
-    mkdir -p "$out/share/doc/lua" "$out/lib/pkgconfig"
-    mv "doc/"*.{gif,png,css,html} "$out/share/doc/lua/"
-    rmdir $out/{share,lib}/lua/${luaversion} $out/{share,lib}/lua
-    mkdir -p "$out/lib/pkgconfig"
-    cat >"$out/lib/pkgconfig/lua.pc" <<EOF
-    prefix=$out
-    libdir=$out/lib
-    includedir=$out/include
-    INSTALL_BIN=$out/bin
-    INSTALL_INC=$out/include
-    INSTALL_LIB=$out/lib
-    INSTALL_MAN=$out/man/man1
-
-    Name: Lua
-    Description: An Extensible Extension Language
-    Version: ${version}
-    Requires:
-    Libs: -L$out/lib -llua -lm
-    Cflags: -I$out/include
-    EOF
-  '';
-
-  meta = {
-    homepage = http://www.lua.org;
-    description = "Powerful, fast, lightweight, embeddable scripting language";
-    longDescription = ''
-      Lua combines simple procedural syntax with powerful data
-      description constructs based on associative arrays and extensible
-      semantics. Lua is dynamically typed, runs by interpreting bytecode
-      for a register-based virtual machine, and has automatic memory
-      management with incremental garbage collection, making it ideal
-      for configuration, scripting, and rapid prototyping.
-    '';
-    license = stdenv.lib.licenses.mit;
-    platforms = stdenv.lib.platforms.unix;
-  };
-}
--- a/pkgs/development/interpreters/lua-5/build-lua-package.nix
+++ b/pkgs/development/interpreters/lua-5/build-lua-package.nix
@ -150,6 +150,9 @@ builtins.removeAttrs attrs ["disabled" "checkInputs"] // {
  installPhase = attrs.installPhase or ''
    runHook preInstall

+    # work around failing luarocks test for Write access
+    mkdir -p $out
+
    # luarocks make assumes sources are available in cwd
    # After the build is complete, it also installs the rock.
    # If no argument is given, it looks for a rockspec in the current directory
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@ -0,0 +1,65 @@
+# similar to interpreters/python/default.nix
+{ stdenv, lib, callPackage, fetchurl }:
+let
+  dsoPatch51 = fetchurl {
+    url = "https://projects.archlinux.org/svntogit/packages.git/plain/trunk/lua-arch.patch?h=packages/lua51";
+    sha256 = "11fcyb4q55p4p7kdb8yp85xlw8imy14kzamp2khvcyxss4vw8ipw";
+    name = "lua-arch.patch";
+  };
+
+  dsoPatch52 = fetchurl {
+    url = "https://projects.archlinux.org/svntogit/packages.git/plain/trunk/liblua.so.patch?h=packages/lua52";
+    sha256 = "1by1dy4ql61f5c6njq9ibf9kaqm3y633g2q8j54iyjr4cxvqwqz9";
+    name = "lua-arch.patch";
+  };
+
+in rec {
+
+  lua5_3 = callPackage ./interpreter.nix {
+    sourceVersion = { major = "5"; minor = "3"; patch = "5"; };
+    hash = "0c2eed3f960446e1a3e4b9a1ca2f3ff893b6ce41942cf54d5dd59ab4b3b058ac";
+    patches = lib.optionals stdenv.isDarwin [ ./5.2.darwin.patch ] ;
+    postConfigure = lib.optionalString (!stdenv.isDarwin) ''
+      cat ${./lua-5.3-dso.make} >> src/Makefile
+      sed -e 's/ALL_T *= */& $(LUA_SO)/' -i src/Makefile
+    '';
+
+    postBuild = stdenv.lib.optionalString (!stdenv.isDarwin) ''
+      ( cd src; make $makeFlags "''${makeFlagsArray[@]}" liblua.so )
+    '';
+  };
+
+  lua5_3_compat = lua5_3.override({
+    compat = true;
+  });
+
+
+  lua5_2 = callPackage ./interpreter.nix {
+    sourceVersion = { major = "5"; minor = "2"; patch = "4"; };
+    hash = "0jwznq0l8qg9wh5grwg07b5cy3lzngvl5m2nl1ikp6vqssmf9qmr";
+    patches = if stdenv.isDarwin then [ ./5.2.darwin.patch ] else [ dsoPatch52 ];
+  };
+
+  lua5_2_compat = lua5_2.override({
+    compat = true;
+  });
+
+
+  lua5_1 = callPackage ./interpreter.nix {
+    sourceVersion = { major = "5"; minor = "1"; patch = "5"; };
+    hash = "2640fc56a795f29d28ef15e13c34a47e223960b0240e8cb0a82d9b0738695333";
+    patches = (if stdenv.isDarwin then [ ./5.1.darwin.patch ] else [ dsoPatch51 ])
+      ++ [ ./5.1.0004-Fix-stack-overflow-in-vararg-functions.patch ];
+  };
+
+  luajit_2_0 = import ../luajit/2.0.nix {
+    self = luajit_2_0;
+    inherit callPackage lib;
+  };
+
+  luajit_2_1 = import ../luajit/2.1.nix {
+    self = luajit_2_1;
+    inherit callPackage lib;
+  };
+
+}
--- a/pkgs/development/interpreters/lua-5/interpreter.nix
+++ b/pkgs/development/interpreters/lua-5/interpreter.nix
@ -1,19 +1,24 @@
-{ stdenv, fetchurl, readline, compat ? false
+{ stdenv, fetchurl, readline
+, compat ? false
 , callPackage
-, self
 , packageOverrides ? (self: super: {})
+, sourceVersion
+, hash
+, patches ? []
+, postConfigure ? null
+, postBuild ? null
 }:
 let
-  luaPackages = callPackage ../../lua-modules {lua=self; overrides=packageOverrides;};
-in
-stdenv.mkDerivation rec {
-  name = "lua-${version}";
-  luaversion = "5.3";
-  version = "${luaversion}.5";
+luaPackages = callPackage ../../lua-modules {lua=self; overrides=packageOverrides;};
+
+self = stdenv.mkDerivation rec {
+  pname = "lua";
+  luaversion = with sourceVersion; "${major}.${minor}";
+  version = "${luaversion}.${sourceVersion.patch}";

  src = fetchurl {
-    url = "https://www.lua.org/ftp/${name}.tar.gz";
-    sha256 = "0c2eed3f960446e1a3e4b9a1ca2f3ff893b6ce41942cf54d5dd59ab4b3b058ac";
+    url = "https://www.lua.org/ftp/${pname}-${luaversion}.tar.gz";
+    sha256 = hash;
  };

  LuaPathSearchPaths    = luaPackages.getLuaPathList luaversion;
@ -22,29 +27,43 @@ stdenv.mkDerivation rec {

  buildInputs = [ readline ];

-  patches = if stdenv.isDarwin then [ ./5.2.darwin.patch ] else [];
+  inherit patches;

-  configurePhase =
-    if stdenv.isDarwin
-    then ''
-    makeFlagsArray=( INSTALL_TOP=$out INSTALL_MAN=$out/share/man/man1 PLAT=macosx CFLAGS="-DLUA_USE_LINUX -fno-common -O2 -fPIC${if compat then " -DLUA_COMPAT_ALL" else ""}" LDFLAGS="-fPIC" V=${luaversion} R=${version}  CC="$CC" )
-    installFlagsArray=( TO_BIN="lua luac" TO_LIB="liblua.${version}.dylib" INSTALL_DATA='cp -d' )
-  '' else ''
-    makeFlagsArray=( INSTALL_TOP=$out INSTALL_MAN=$out/share/man/man1 PLAT=linux CFLAGS="-DLUA_USE_LINUX -O2 -fPIC${if compat then " -DLUA_COMPAT_ALL" else ""}" LDFLAGS="-fPIC" V=${luaversion} R=${version} CC="$CC" AR="$AR q" RANLIB="$RANLIB" )
-    installFlagsArray=( TO_BIN="lua luac" TO_LIB="liblua.a liblua.so liblua.so.${luaversion} liblua.so.${version}" INSTALL_DATA='cp -d' )
-    cat ${./lua-5.3-dso.make} >> src/Makefile
-    sed -e 's/ALL_T *= */& $(LUA_SO)/' -i src/Makefile
-  '';
+  # see configurePhase for additional flags (with space)
+  makeFlags = [
+    "INSTALL_TOP=${placeholder "out"}"
+    "INSTALL_MAN=${placeholder "out"}/share/man/man1"
+    "R=${version}"
+    "LDFLAGS=-fPIC"
+    "V=${luaversion}"
+  ] ++ (if stdenv.isDarwin then [
+    "PLAT=macosx"
+  ] else [
+    "PLAT=linux"
+  ])
+  ;

-  postBuild = stdenv.lib.optionalString (! stdenv.isDarwin) ''
-    ( cd src; make liblua.so "''${makeFlagsArray[@]}" )
+  configurePhase = ''
+    runHook preConfigure
+
+    makeFlagsArray+=(CFLAGS="-DLUA_USE_LINUX -O2 -fPIC${if compat then " -DLUA_COMPAT_ALL" else ""}" )
+    makeFlagsArray+=(${stdenv.lib.optionalString stdenv.isDarwin "CC=\"$CC\""})
+
+    installFlagsArray=( TO_BIN="lua luac" INSTALL_DATA='cp -d' \
+      TO_LIB="${if stdenv.isDarwin then "liblua.${version}.dylib" else "liblua.a liblua.so liblua.so.${luaversion} liblua.so.${version}"}" )
+
+    runHook postConfigure
  '';
+  inherit postConfigure;
+
+  inherit postBuild;

  postInstall = ''
    mkdir -p "$out/share/doc/lua" "$out/lib/pkgconfig"
    mv "doc/"*.{gif,png,css,html} "$out/share/doc/lua/"
    rmdir $out/{share,lib}/lua/${luaversion} $out/{share,lib}/lua
    mkdir -p "$out/lib/pkgconfig"
+
    cat >"$out/lib/pkgconfig/lua.pc" <<EOF
    prefix=$out
    libdir=$out/lib
@ -88,4 +107,5 @@ stdenv.mkDerivation rec {
    license = stdenv.lib.licenses.mit;
    platforms = stdenv.lib.platforms.unix;
  };
-}
+};
+in self
--- a/pkgs/development/interpreters/python/cpython/docs/2.7-html.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-html.nix
@ -3,10 +3,10 @@
 { stdenv, fetchurl, lib }:

 stdenv.mkDerivation rec {
-  name = "python27-docs-html-2.7.3";
+  name = "python27-docs-html-2.7.16";
  src = fetchurl {
-    url = http://docs.python.org/ftp/python/doc/2.7.3/python-2.7.3-docs-html.tar.bz2;
-    sha256 = "1hg92n0mzl9w6j33b2h0bf2vy6fsxnpxfdc3qw760vcm0y00155j";
+    url = http://docs.python.org/ftp/python/doc/2.7.16/python-2.7.16-docs-html.tar.bz2;
+    sha256 = "1razs1grzhai65ihaiyph8kz6ncjkgp1gsn3c8v7kanf13lqim02";
  };
  installPhase = ''
    mkdir -p $out/share/doc/python27
--- a/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-a4.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-a4.nix
@ -3,10 +3,10 @@
 { stdenv, fetchurl, lib }:

 stdenv.mkDerivation rec {
-  name = "python27-docs-pdf-a4-2.7.3";
+  name = "python27-docs-pdf-a4-2.7.16";
  src = fetchurl {
-    url = http://docs.python.org/ftp/python/doc/2.7.3/python-2.7.3-docs-pdf-a4.tar.bz2;
-    sha256 = "13da88panq5b6qfhf8k4dgqgxkg4ydcac5cx69a3f35s1w90xdjr";
+    url = http://docs.python.org/ftp/python/doc/2.7.16/python-2.7.16-docs-pdf-a4.tar.bz2;
+    sha256 = "14ml1ynrlbhg43737bdsb8k5y39wsffqj4iwhylhb8n8l5dplfdq";
  };
  installPhase = ''
    mkdir -p $out/share/doc/python27
--- a/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-letter.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-letter.nix
@ -3,10 +3,10 @@
 { stdenv, fetchurl, lib }:

 stdenv.mkDerivation rec {
-  name = "python27-docs-pdf-letter-2.7.3";
+  name = "python27-docs-pdf-letter-2.7.16";
  src = fetchurl {
-    url = http://docs.python.org/ftp/python/doc/2.7.3/python-2.7.3-docs-pdf-letter.tar.bz2;
-    sha256 = "0x41phsdrpivhzkchswsliyx3a10n7gzc9irkrw6rz22j81bfydg";
+    url = http://docs.python.org/ftp/python/doc/2.7.16/python-2.7.16-docs-pdf-letter.tar.bz2;
+    sha256 = "019i8n48m71mn31v8d85kkwyqfgcgqnqh506y4a7fcgf656bajs0";
  };
  installPhase = ''
    mkdir -p $out/share/doc/python27
--- a/pkgs/development/interpreters/python/cpython/docs/2.7-text.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-text.nix
@ -3,10 +3,10 @@
 { stdenv, fetchurl, lib }:

 stdenv.mkDerivation rec {
-  name = "python27-docs-text-2.7.3";
+  name = "python27-docs-text-2.7.16";
  src = fetchurl {
-    url = http://docs.python.org/ftp/python/doc/2.7.3/python-2.7.3-docs-text.tar.bz2;
-    sha256 = "1rxlb3jhh3892y65i45nk1y2lx981fr22a5hmfkp9gvjvdykjnzp";
+    url = http://docs.python.org/ftp/python/doc/2.7.16/python-2.7.16-docs-text.tar.bz2;
+    sha256 = "1da7swlykvc013684nywycinfz3v8dqkcmv0zj8p7l5lyi5mq03r";
  };
  installPhase = ''
    mkdir -p $out/share/doc/python27
--- a/pkgs/development/interpreters/python/cpython/docs/3.7-html.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.7-html.nix
@ -0,0 +1,18 @@
+# This file was generated and will be overwritten by ./generate.sh
+
+{ stdenv, fetchurl, lib }:
+
+stdenv.mkDerivation rec {
+  name = "python37-docs-html-3.7.2";
+  src = fetchurl {
+    url = http://docs.python.org/ftp/python/doc/3.7.2/python-3.7.2-docs-html.tar.bz2;
+    sha256 = "19wbrawpdam09fmyipfy92sxwn1rl93v8jkfqsfx028qhvzf0422";
+  };
+  installPhase = ''
+    mkdir -p $out/share/doc/python37
+    cp -R ./ $out/share/doc/python37/html
+  '';
+  meta = {
+    maintainers = [ ];
+  };
+}
--- a/pkgs/development/interpreters/python/cpython/docs/3.7-pdf-a4.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.7-pdf-a4.nix
@ -0,0 +1,18 @@
+# This file was generated and will be overwritten by ./generate.sh
+
+{ stdenv, fetchurl, lib }:
+
+stdenv.mkDerivation rec {
+  name = "python37-docs-pdf-a4-3.7.2";
+  src = fetchurl {
+    url = http://docs.python.org/ftp/python/doc/3.7.2/python-3.7.2-docs-pdf-a4.tar.bz2;
+    sha256 = "0vdx762m30hjaabn6w88awcj2qpbz0b6z59zn9wmamd35k59lfba";
+  };
+  installPhase = ''
+    mkdir -p $out/share/doc/python37
+    cp -R ./ $out/share/doc/python37/pdf-a4
+  '';
+  meta = {
+    maintainers = [ ];
+  };
+}
--- a/pkgs/development/interpreters/python/cpython/docs/3.7-pdf-letter.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.7-pdf-letter.nix
@ -0,0 +1,18 @@
+# This file was generated and will be overwritten by ./generate.sh
+
+{ stdenv, fetchurl, lib }:
+
+stdenv.mkDerivation rec {
+  name = "python37-docs-pdf-letter-3.7.2";
+  src = fetchurl {
+    url = http://docs.python.org/ftp/python/doc/3.7.2/python-3.7.2-docs-pdf-letter.tar.bz2;
+    sha256 = "17g57vlyvqx0k916q84q2pcx7y8myw0fda9fvg9kh0ph930c837x";
+  };
+  installPhase = ''
+    mkdir -p $out/share/doc/python37
+    cp -R ./ $out/share/doc/python37/pdf-letter
+  '';
+  meta = {
+    maintainers = [ ];
+  };
+}
--- a/pkgs/development/interpreters/python/cpython/docs/3.7-text.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.7-text.nix
@ -0,0 +1,18 @@
+# This file was generated and will be overwritten by ./generate.sh
+
+{ stdenv, fetchurl, lib }:
+
+stdenv.mkDerivation rec {
+  name = "python37-docs-text-3.7.2";
+  src = fetchurl {
+    url = http://docs.python.org/ftp/python/doc/3.7.2/python-3.7.2-docs-text.tar.bz2;
+    sha256 = "0h50rlr8jclwfxa106b42q2vn2ynp219c4zsy5qz65n5m3b7y1g2";
+  };
+  installPhase = ''
+    mkdir -p $out/share/doc/python37
+    cp -R ./ $out/share/doc/python37/text
+  '';
+  meta = {
+    maintainers = [ ];
+  };
+}
--- a/Show More
+++ b/Show More