Merge master into staging-next

.github/FUNDING.yml

@@ -1,3 +0,0 @@
-# These are supported funding model platforms
-
-open_collective: nixos

doc/package-specific-user-notes.xml

@@ -409,11 +409,19 @@ overrides = self: super: rec {
  </section>
 
  <section xml:id="sec-citrix">
-  <title>Citrix Receiver</title>
+  <title>Citrix Receiver &amp; Citrix Workspace App</title>
 
   <para>
-   The <link xlink:href="https://www.citrix.com/products/receiver/">Citrix
+   <note>
-   Receiver</link> is a remote desktop viewer which provides access to
+    <para>
+     Please note that the <literal>citrix_receiver</literal> package has been deprecated since its
+     development was <link xlink:href="https://docs.citrix.com/en-us/citrix-workspace-app.html">discontinued by upstream</link>
+     and will be replaced by <link xlink:href="https://www.citrix.com/products/workspace-app/">the citrix workspace app</link>.
+    </para>
+   </note>
+   <link xlink:href="https://www.citrix.com/products/receiver/">Citrix Receiver</link> and
+   <link xlink:href="https://www.citrix.com/products/workspace-app/">Citrix Workspace App</link>
+   are a remote desktop viewers which provide access to
    <link xlink:href="https://www.citrix.com/products/xenapp-xendesktop/">XenDesktop</link>
    installations.
   </para>
@@ -423,30 +431,35 @@ overrides = self: super: rec {
 
    <para>
     The tarball archive needs to be downloaded manually as the license
-    agreements of the vendor need to be accepted first. This is available at
+    agreements of the vendor for
-    the
+    <link xlink:href="https://www.citrix.com/downloads/citrix-receiver/">Citrix Receiver</link>
-    <link xlink:href="https://www.citrix.com/downloads/citrix-receiver/">download
+    or <link xlink:href="https://www.citrix.de/downloads/workspace-app/linux/workspace-app-for-linux-latest.html">Citrix Workspace</link>
-    page at citrix.com</link>. Then run <literal>nix-prefetch-url
+    need to be accepted first.
-    file://$PWD/linuxx64-$version.tar.gz</literal>. With the archive available
+    Then run <command>nix-prefetch-url file://$PWD/linuxx64-$version.tar.gz</command>.
+    With the archive available
     in the store the package can be built and installed with Nix.
    </para>
 
-   <para>
+   <warning>
-    <emphasis>Note: it's recommended to install <literal>Citrix
+    <title>Caution with <command>nix-shell</command> installs</title>
-    Receiver</literal> using <literal>nix-env -i</literal> or globally to
+    <para>
-    ensure that the <literal>.desktop</literal> files are installed properly
+     It's recommended to install <literal>Citrix Receiver</literal>
-    into <literal>$XDG_CONFIG_DIRS</literal>. Otherwise it won't be possible to
+     and/or <literal>Citrix Workspace</literal> using
-    open <literal>.ica</literal> files automatically from the browser to start
+     <literal>nix-env -i</literal> or globally to
-    a Citrix connection.</emphasis>
+     ensure that the <literal>.desktop</literal> files are installed properly
-   </para>
+     into <literal>$XDG_CONFIG_DIRS</literal>. Otherwise it won't be possible to
+     open <literal>.ica</literal> files automatically from the browser to start
+     a Citrix connection.
+    </para>
+   </warning>
   </section>
 
   <section xml:id="sec-citrix-custom-certs">
    <title>Custom certificates</title>
 
    <para>
-    The <literal>Citrix Receiver</literal> in <literal>nixpkgs</literal> trusts
+    The <literal>Citrix Receiver</literal> and <literal>Citrix Workspace App</literal>
-    several certificates
+    in <literal>nixpkgs</literal> trust several certificates
     <link xlink:href="https://curl.haxx.se/docs/caextract.html">from the
     Mozilla database</link> by default. However several companies using Citrix
     might require their own corporate certificate. On distros with imperative
@@ -459,7 +472,7 @@ overrides = self: super: rec {
 <programlisting>
 <![CDATA[with import <nixpkgs> { config.allowUnfree = true; };
 let extraCerts = [ ./custom-cert-1.pem ./custom-cert-2.pem /* ... */ ]; in
-citrix_receiver.override {
+citrix_workspace.override { # the same applies for `citrix_receiver` if used.
   inherit extraCerts;
 }]]>
 </programlisting>

maintainers/maintainer-list.nix

@@ -333,6 +333,11 @@
     github = "andersk";
     name = "Anders Kaseorg";
   };
+  anderslundstedt = {
+    email = "git@anderslundstedt.se";
+    github = "anderslundstedt";
+    name = "Anders Lundstedt";
+  };
   AndersonTorres = {
     email = "torres.anderson.85@protonmail.com";
     github = "AndersonTorres";
@@ -1148,6 +1153,19 @@
     github = "cwoac";
     name = "Oliver Matthews";
   };
+  cypherpunk2140 = {
+    email = "stefan.mihaila@pm.me";
+    github = "cypherpunk2140";
+    name = "Ștefan D. Mihăilă";
+    keys = [
+      { longkeyid = "rsa4096/6E68A39BF16A3ECB";
+        fingerprint = "CBC9 C7CC 51F0 4A61 3901 C723 6E68 A39B F16A 3ECB";
+      }
+      { longkeyid = "rsa4096/6220AD7846220A52";
+        fingerprint = "7EAB 1447 5BBA 7DDE 7092 7276 6220 AD78 4622 0A52";
+      }
+    ];
+  };
   dalance = {
     email = "dalance@gmail.com";
     github = "dalance";
@@ -2119,6 +2137,11 @@
     github = "henrytill";
     name = "Henry Till";
   };
+  herberteuler = {
+    email = "herberteuler@gmail.com";
+    github = "herberteuler";
+    name = "Guanpeng Xu";
+  };
   hhm = {
     email = "heehooman+nixpkgs@gmail.com";
     github = "hhm0";
@@ -2285,6 +2308,11 @@
     github = "j-keck";
     name = "Jürgen Keck";
   };
+  j03 = {
+    email = "github@johannesloetzsch.de";
+    github = "johannesloetzsch";
+    name = "Johannes Lötzsch";
+  };
   jagajaga = {
     email = "ars.seroka@gmail.com";
     github = "jagajaga";
@@ -2573,6 +2601,11 @@
     github = "jraygauthier";
     name = "Raymond Gauthier";
   };
+  jtobin = {
+    email = "jared@jtobin.io";
+    github = "jtobin";
+    name = "Jared Tobin";
+  };
   jtojnar = {
     email = "jtojnar@gmail.com";
     github = "jtojnar";
@@ -2941,6 +2974,15 @@
     github = "listx";
     name = "Linus Arver";
   };
+  livnev = {
+    email = "lev@liv.nev.org.uk";
+    github = "livnev";
+    name = "Lev Livnev";
+    keys = [{
+      longkeyid = "rsa2048/0x68FF81E6A7850F49";
+      fingerprint = "74F5 E5CC 19D3 B5CB 608F  6124 68FF 81E6 A785 0F49";
+    }];
+  };
   luis = {
       email = "luis.nixos@gmail.com";
       github = "Luis-Hebendanz";

nixos/doc/manual/release-notes/rl-1909.xml

@@ -149,9 +149,20 @@
    </listitem>
    <listitem>
     <para>
-     Several of the apache subservices have been replaced with full NixOS
+     The httpd service no longer attempts to start the postgresql service. If you have come to depend
-     modules including LimeSurvey, WordPress, and Zabbix.
+     on this behaviour then you can preserve the behavior with the following configuration:
-     These modules can be enabled using the <option>services.limesurvey.enable</option>,
+     <literal>systemd.services.httpd.after = [ "postgresql.service" ];</literal>
+    </para>
+    <para>
+     The option <option>services.httpd.extraSubservices</option> has been
+     marked as deprecated. You may still use this feature, but it will be
+     removed in a future release of NixOS. You are encouraged to convert any
+     httpd subservices you may have written to a full NixOS module.
+    </para>
+    <para>
+     Most of the httpd subservices packaged with NixOS have been replaced with
+     full NixOS modules including LimeSurvey, WordPress, and Zabbix. These
+     modules can be enabled using the <option>services.limesurvey.enable</option>,
      <option>services.wordpress.enable</option>, and <option>services.zabbixWeb.enable</option> options.
     </para>
    </listitem>
@@ -195,6 +206,13 @@
      <xref linkend="opt-programs.zsh.loginShellInit" /> and <xref linkend="opt-programs.zsh.promptInit" /> may break if it relies on those options being set.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      The <literal>prometheus-nginx-exporter</literal> package now uses the offical exporter provided by NGINX Inc.
+      Its metrics are differently structured and are incompatible to the old ones. For information about the metrics,
+      have a look at the <link xlink:href="https://github.com/nginxinc/nginx-prometheus-exporter">official repo</link>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 
@@ -347,6 +365,15 @@
      The <literal>tomcat-connector</literal> <literal>httpd.extraSubservice</literal> has been removed from nixpkgs.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     It's now possible to change configuration in
+     <link linkend="opt-services.nextcloud.enable">services.nextcloud</link> after the initial deploy
+     since all config parameters are persisted in an additional config file generated by the module.
+     Previously core configuration like database parameters were set using their imperative
+     installer after creating <literal>/var/lib/nextcloud</literal>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>

nixos/modules/config/no-x-libs.nix

@@ -34,7 +34,7 @@ with lib;
       networkmanager-openvpn = super.networkmanager-openvpn.override { withGnome = false; };
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
       networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
-      pinentry = super.pinentry.override { gtk2 = null; gcr = null; qt = null; };
+      pinentry = super.pinentry.override { gtk2 = null; gcr = null; qt4 = null; qt5 = null; };
       gobject-introspection = super.gobject-introspection.override { x11Support = false; };
     }));
   };

nixos/modules/module-list.nix

@@ -198,6 +198,7 @@
   ./services/audio/slimserver.nix
   ./services/audio/snapserver.nix
   ./services/audio/squeezelite.nix
+  ./services/audio/spotifyd.nix
   ./services/audio/ympd.nix
   ./services/backup/automysqlbackup.nix
   ./services/backup/bacula.nix
@@ -422,6 +423,7 @@
   ./services/misc/gollum.nix
   ./services/misc/gpsd.nix
   ./services/misc/headphones.nix
+  ./services/misc/greenclip.nix
   ./services/misc/home-assistant.nix
   ./services/misc/ihaskell.nix
   ./services/misc/irkerd.nix
@@ -691,6 +693,7 @@
   ./services/networking/tcpcrypt.nix
   ./services/networking/teamspeak3.nix
   ./services/networking/tedicross.nix
+  ./services/networking/thelounge.nix
   ./services/networking/tinc.nix
   ./services/networking/tinydns.nix
   ./services/networking/tftpd.nix

nixos/modules/services/audio/spotifyd.nix

@@ -0,0 +1,42 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.spotifyd;
+  spotifydConf = pkgs.writeText "spotifyd.conf" cfg.config;
+in
+{
+  options = {
+    services.spotifyd = {
+      enable = mkEnableOption "spotifyd, a Spotify playing daemon";
+
+      config = mkOption {
+        default = "";
+        type = types.lines;
+        description = ''
+          Configuration for Spotifyd. For syntax and directives, see
+          https://github.com/Spotifyd/spotifyd#Configuration.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.spotifyd = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" "sound.target" ];
+      description = "spotifyd, a Spotify playing daemon";
+      serviceConfig = {
+        ExecStart = "${pkgs.spotifyd}/bin/spotifyd --no-daemon --cache_path /var/cache/spotifyd --config ${spotifydConf}";
+        Restart = "always";
+        RestartSec = 12;
+        DynamicUser = true;
+        CacheDirectory = "spotifyd";
+        SupplementaryGroups = ["audio"];
+      };
+    };
+  };
+
+  meta.maintainers = [ maintainers.anderslundstedt ];
+}

nixos/modules/services/databases/postgresql.xml

@@ -52,7 +52,7 @@ Type "help" for help.
 
   <para>
    By default, PostgreSQL stores its databases in
-   <filename>/var/db/postgresql</filename>. You can override this using
+   <filename>/var/lib/postgresql/$psqlSchema</filename>. You can override this using
    <xref linkend="opt-services.postgresql.dataDir"/>, e.g.
 <programlisting>
 <xref linkend="opt-services.postgresql.dataDir"/> = "/data/postgresql";

nixos/modules/services/misc/gitlab.nix

@@ -585,6 +585,7 @@ in {
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       path = with pkgs; [
+        exiftool
         gitAndTools.git
         gnutar
         gzip

nixos/modules/services/misc/greenclip.nix

@@ -0,0 +1,31 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.greenclip;
+in {
+
+  options.services.greenclip = {
+    enable = mkEnableOption "Greenclip daemon";
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.haskellPackages.greenclip;
+      defaultText = "pkgs.haskellPackages.greenclip";
+      description = "greenclip derivation to use.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.user.services.greenclip = {
+      enable      = true;
+      description = "greenclip daemon";
+      wantedBy = [ "graphical-session.target" ];
+      after    = [ "graphical-session.target" ];
+      serviceConfig.ExecStart = "${cfg.package}/bin/greenclip daemon";
+    };
+
+    environment.systemPackages = [ cfg.package ];
+  };
+}

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -1,8 +1,10 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, options, ... }:
-
-with lib;
 
 let
+  inherit (lib) concatStrings foldl foldl' genAttrs literalExample maintainers
+                mapAttrsToList mkDefault mkEnableOption mkIf mkMerge mkOption
+                optional types;
+
   cfg = config.services.prometheus.exporters;
 
   # each attribute in `exporterOpts` is expected to have specified:
@@ -17,25 +19,28 @@ let
   #  Note that `extraOpts` is optional, but a script for the exporter's
   #  systemd service must be provided by specifying either
   #  `serviceOpts.script` or `serviceOpts.serviceConfig.ExecStart`
-  exporterOpts = {
+
-    blackbox  = import ./exporters/blackbox.nix  { inherit config lib pkgs; };
+  exporterOpts = genAttrs [
-    collectd  = import ./exporters/collectd.nix  { inherit config lib pkgs; };
+    "bind"
-    dnsmasq   = import ./exporters/dnsmasq.nix   { inherit config lib pkgs; };
+    "blackbox"
-    dovecot   = import ./exporters/dovecot.nix   { inherit config lib pkgs; };
+    "collectd"
-    fritzbox  = import ./exporters/fritzbox.nix  { inherit config lib pkgs; };
+    "dnsmasq"
-    json      = import ./exporters/json.nix      { inherit config lib pkgs; };
+    "dovecot"
-    minio     = import ./exporters/minio.nix     { inherit config lib pkgs; };
+    "fritzbox"
-    nginx     = import ./exporters/nginx.nix     { inherit config lib pkgs; };
+    "json"
-    node      = import ./exporters/node.nix      { inherit config lib pkgs; };
+    "minio"
-    postfix   = import ./exporters/postfix.nix   { inherit config lib pkgs; };
+    "nginx"
-    snmp      = import ./exporters/snmp.nix      { inherit config lib pkgs; };
+    "node"
-    surfboard = import ./exporters/surfboard.nix { inherit config lib pkgs; };
+    "postfix"
-    tor       = import ./exporters/tor.nix       { inherit config lib pkgs; };
+    "snmp"
-    unifi     = import ./exporters/unifi.nix     { inherit config lib pkgs; };
+    "surfboard"
-    varnish   = import ./exporters/varnish.nix   { inherit config lib pkgs; };
+    "tor"
-    bind      = import ./exporters/bind.nix      { inherit config lib pkgs; };
+    "unifi"
-    wireguard = import ./exporters/wireguard.nix { inherit config lib pkgs; };
+    "varnish"
-  };
+    "wireguard"
+  ] (name:
+    import (./. + "/exporters/${name}.nix") { inherit config lib pkgs options; }
+  );
 
   mkExporterOpts = ({ name, port }: {
     enable = mkEnableOption "the prometheus ${name} exporter";
@@ -97,9 +102,10 @@ let
     };
   });
 
-  mkSubModule = { name, port, extraOpts, ... }: {
+  mkSubModule = { name, port, extraOpts, imports }: {
     ${name} = mkOption {
       type = types.submodule {
+        inherit imports;
         options = (mkExporterOpts {
           inherit name port;
         } // extraOpts);
@@ -112,13 +118,15 @@ let
   mkSubModules = (foldl' (a: b: a//b) {}
     (mapAttrsToList (name: opts: mkSubModule {
       inherit name;
-      inherit (opts) port serviceOpts;
+      inherit (opts) port;
       extraOpts = opts.extraOpts or {};
+      imports = opts.imports or [];
     }) exporterOpts)
   );
 
   mkExporterConf = { name, conf, serviceOpts }:
     mkIf conf.enable {
+      warnings = conf.warnings or [];
       networking.firewall.extraCommands = mkIf conf.openFirewall (concatStrings [
         "ip46tables -A nixos-fw ${conf.firewallFilter} "
         "-m comment --comment ${name}-exporter -j nixos-fw-accept"

nixos/modules/services/monitoring/prometheus/exporters.xml

@@ -17,7 +17,7 @@
    exporter</link>, it provides hardware and OS metrics from the host it's
    running on. The exporter could be configured as follows:
 <programlisting>
-  services.promtheus.exporters.node = {
+  services.prometheus.exporters.node = {
     enable = true;
     enabledCollectors = [
       "logind"
@@ -113,7 +113,7 @@
      specific options and configuration:
 <programlisting>
 # nixpgs/nixos/modules/services/prometheus/exporters/postfix.nix
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 
@@ -184,4 +184,42 @@ in
    </listitem>
   </itemizedlist>
  </section>
+ <section xml:id="module-services-prometheus-exporters-update-exporter-module">
+  <title>Updating an exporter module</title>
+   <para>
+     Should an exporter option change at some point, it is possible to add
+     information about the change to the exporter definition similar to
+     <literal>nixpkgs/nixos/modules/rename.nix</literal>:
+<programlisting>
+{ config, lib, pkgs, options }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.exporters.nginx;
+in
+{
+  port = 9113;
+  extraOpts = {
+    # additional module options
+    # ...
+  };
+  serviceOpts = {
+    # service configuration
+    # ...
+  };
+  imports = [
+    # 'services.prometheus.exporters.nginx.telemetryEndpoint' -> 'services.prometheus.exporters.nginx.telemetryPath'
+    (mkRenamedOptionModule [ "telemetryEndpoint" ] [ "telemetryPath" ])
+
+    # removed option 'services.prometheus.exporters.nginx.insecure'
+    (mkRemovedOptionModule [ "insecure" ] ''
+      This option was replaced by 'prometheus.exporters.nginx.sslVerify' which defaults to true.
+    '')
+    ({ options.warnings = options.warnings; })
+  ];
+}
+</programlisting>
+    </para>
+  </section>
 </chapter>

nixos/modules/services/monitoring/prometheus/exporters/bind.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/blackbox.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/collectd.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/dnsmasq.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/dovecot.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/fritzbox.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/json.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/minio.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/nginx.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 
@@ -16,32 +16,40 @@ in
         Can be enabled with services.nginx.statusPage = true.
       '';
     };
-    telemetryEndpoint = mkOption {
+    telemetryPath = mkOption {
       type = types.str;
       default = "/metrics";
       description = ''
         Path under which to expose metrics.
       '';
     };
-    insecure = mkOption {
+    sslVerify = mkOption {
       type = types.bool;
       default = true;
       description = ''
-        Ignore server certificate if using https.
+        Whether to perform certificate verification for https.
       '';
     };
+
   };
   serviceOpts = {
     serviceConfig = {
       DynamicUser = true;
       ExecStart = ''
-        ${pkgs.prometheus-nginx-exporter}/bin/nginx_exporter \
+        ${pkgs.prometheus-nginx-exporter}/bin/nginx-prometheus-exporter \
-          --nginx.scrape_uri '${cfg.scrapeUri}' \
+          --nginx.scrape-uri '${cfg.scrapeUri}' \
-          --telemetry.address ${cfg.listenAddress}:${toString cfg.port} \
+          --nginx.ssl-verify ${toString cfg.sslVerify} \
-          --telemetry.endpoint ${cfg.telemetryEndpoint} \
+          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
-          --insecure ${toString cfg.insecure} \
+          --web.telemetry-path ${cfg.telemetryPath} \
           ${concatStringsSep " \\\n  " cfg.extraFlags}
       '';
     };
   };
+  imports = [
+    (mkRenamedOptionModule [ "telemetryEndpoint" ] [ "telemetryPath" ])
+    (mkRemovedOptionModule [ "insecure" ] ''
+      This option was replaced by 'prometheus.exporters.nginx.sslVerify'.
+    '')
+    ({ options.warnings = options.warnings; })
+  ];
 }

nixos/modules/services/monitoring/prometheus/exporters/node.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/postfix.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/snmp.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/surfboard.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/tor.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/unifi.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/monitoring/prometheus/exporters/varnish.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 
@@ -68,7 +68,6 @@ in
   serviceOpts = {
     path = [ pkgs.varnish ];
     serviceConfig = {
-      DynamicUser = true;
       RestartSec = mkDefault 1;
       ExecStart = ''
         ${pkgs.prometheus-varnish-exporter}/bin/prometheus_varnish_exporter \

nixos/modules/services/monitoring/prometheus/exporters/wireguard.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs }:
+{ config, lib, pkgs, options }:
 
 with lib;
 

nixos/modules/services/networking/bind.nix

@@ -33,7 +33,7 @@ let
       ${cfg.extraConfig}
 
       ${ concatMapStrings
-          ({ name, file, master ? true, slaves ? [], masters ? [] }:
+          ({ name, file, master ? true, slaves ? [], masters ? [], extraConfig ? "" }:
             ''
               zone "${name}" {
                 type ${if master then "master" else "slave"};
@@ -52,6 +52,7 @@ let
                    ''
                 }
                 allow-query { any; };
+                ${extraConfig}
               };
             '')
           cfg.zones }
@@ -131,6 +132,7 @@ in
           file = "/var/dns/example.com";
           masters = ["192.168.0.1"];
           slaves = [];
+          extraConfig = "";
         }];
       };
 

nixos/modules/services/networking/syncthing.nix

@@ -291,7 +291,7 @@ in {
 
       group = mkOption {
         type = types.str;
-        default = "nogroup";
+        default = defaultUser;
         description = ''
           Syncthing will be run under this group (group will not be created if it doesn't exist.
           This can be your user name).
@@ -403,18 +403,12 @@ in {
           Group = cfg.group;
           ExecStartPre = mkIf (cfg.declarative.cert != null || cfg.declarative.key != null)
             "+${pkgs.writers.writeBash "syncthing-copy-keys" ''
-              mkdir -p ${cfg.configDir}
+              install -dm700 -o ${cfg.user} -g ${cfg.group} ${cfg.configDir}
-              chown ${cfg.user}:${cfg.group} ${cfg.configDir}
-              chmod 700 ${cfg.configDir}
               ${optionalString (cfg.declarative.cert != null) ''
-                cp ${toString cfg.declarative.cert} ${cfg.configDir}/cert.pem
+                install -Dm400 -o ${cfg.user} -g ${cfg.group} ${toString cfg.declarative.cert} ${cfg.configDir}/cert.pem
-                chown ${cfg.user}:${cfg.group} ${cfg.configDir}/cert.pem
-                chmod 400 ${cfg.configDir}/cert.pem
               ''}
               ${optionalString (cfg.declarative.key != null) ''
-                cp ${toString cfg.declarative.key} ${cfg.configDir}/key.pem
+                install -Dm400 -o ${cfg.user} -g ${cfg.group} ${toString cfg.declarative.key} ${cfg.configDir}/key.pem
-                chown ${cfg.user}:${cfg.group} ${cfg.configDir}/key.pem
-                chmod 400 ${cfg.configDir}/key.pem
               ''}
             ''}"
           ;

nixos/modules/services/networking/thelounge.nix

@@ -0,0 +1,75 @@
+{ pkgs, lib, config, ... }:
+
+with lib;
+
+let
+  cfg = config.services.thelounge;
+  dataDir = "/var/lib/thelounge";
+  configJsData = "module.exports = " + builtins.toJSON (
+    { private = cfg.private; port = cfg.port; } // cfg.extraConfig
+  );
+in {
+  options.services.thelounge = {
+    enable = mkEnableOption "The Lounge web IRC client";
+
+    private = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Make your The Lounge instance private. You will need to configure user
+        accounts by using the (<command>thelounge</command>) command or by adding
+        entries in <filename>${dataDir}/users</filename>. You might need to restart
+        The Lounge after making changes to the state directory.
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 9000;
+      description = "TCP port to listen on for http connections.";
+    };
+
+    extraConfig = mkOption {
+      default = {};
+      type = types.attrs;
+      example = literalExample ''{
+        reverseProxy = true;
+        defaults = {
+          name = "Your Network";
+          host = "localhost";
+          port = 6697;
+        };
+      }'';
+      description = ''
+        The Lounge's <filename>config.js</filename> contents as attribute set (will be
+        converted to JSON to generate the configuration file).
+
+        The options defined here will be merged to the default configuration file.
+        Note: In case of duplicate configuration, options from <option>extraConfig</option> have priority.
+
+        Documentation: <link xlink:href="https://thelounge.chat/docs/server/configuration" />
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users.thelounge = {
+      description = "thelounge service user";
+      group = "thelounge";
+    };
+    users.groups.thelounge = {};
+    systemd.services.thelounge = {
+      description = "The Lounge web IRC client";
+      wantedBy = [ "multi-user.target" ];
+      environment = { THELOUNGE_HOME = dataDir; };
+      preStart = "ln -sf ${pkgs.writeText "config.js" configJsData} ${dataDir}/config.js";
+      serviceConfig = {
+        User = "thelounge";
+        StateDirectory = baseNameOf dataDir;
+        ExecStart = "${pkgs.thelounge}/bin/thelounge start";
+      };
+    };
+
+    environment.systemPackages = [ pkgs.thelounge ];
+  };
+}

nixos/modules/services/system/nscd.conf

@@ -7,46 +7,28 @@
 # is not aware of the path in which the nss modules live.  As a workaround, we
 # have `enable-cache yes` with an explicit ttl of 0
 server-user             nscd
-threads                 1
-paranoia                no
-debug-level             0
 
 enable-cache            passwd          yes
 positive-time-to-live   passwd          0
 negative-time-to-live   passwd          0
-suggested-size          passwd          211
-check-files             passwd          yes
-persistent              passwd          no
 shared                  passwd          yes
 
 enable-cache            group           yes
 positive-time-to-live   group           0
 negative-time-to-live   group           0
-suggested-size          group           211
-check-files             group           yes
-persistent              group           no
 shared                  group           yes
 
 enable-cache            netgroup        yes
 positive-time-to-live   netgroup        0
 negative-time-to-live   netgroup        0
-suggested-size          netgroup        211
-check-files             netgroup        yes
-persistent              netgroup        no
 shared                  netgroup        yes
 
 enable-cache            hosts           yes
 positive-time-to-live   hosts           600
 negative-time-to-live   hosts           0
-suggested-size          hosts           211
-check-files             hosts           yes
-persistent              hosts           no
 shared                  hosts           yes
 
 enable-cache            services        yes
 positive-time-to-live   services        0
 negative-time-to-live   services        0
-suggested-size          services        211
-check-files             services        yes
-persistent              services        no
 shared                  services        yes

nixos/modules/services/system/nscd.nix

@@ -39,11 +39,6 @@ in
   config = mkIf cfg.enable {
     environment.etc."nscd.conf".text = cfg.config;
 
-    users.users.nscd =
-      { isSystemUser = true;
-        description = "Name service cache daemon user";
-      };
-
     systemd.services.nscd =
       { description = "Name Service Cache Daemon";
 
@@ -51,22 +46,23 @@ in
 
         environment = { LD_LIBRARY_PATH = nssModulesPath; };
 
-        preStart =
-          ''
-            mkdir -m 0755 -p /run/nscd
-            rm -f /run/nscd/nscd.pid
-            mkdir -m 0755 -p /var/db/nscd
-          '';
-
         restartTriggers = [
           config.environment.etc.hosts.source
           config.environment.etc."nsswitch.conf".source
           config.environment.etc."nscd.conf".source
         ];
 
+        # We use DynamicUser because in default configurations nscd doesn't
+        # create any files that need to survive restarts. However, in some
+        # configurations, nscd needs to be started as root; it will drop
+        # privileges after all the NSS modules have read their configuration
+        # files. So prefix the ExecStart command with "!" to prevent systemd
+        # from dropping privileges early. See ExecStart in systemd.service(5).
         serviceConfig =
-          { ExecStart = "@${pkgs.glibc.bin}/sbin/nscd nscd";
+          { ExecStart = "!@${pkgs.glibc.bin}/sbin/nscd nscd";
             Type = "forking";
+            DynamicUser = true;
+            RuntimeDirectory = "nscd";
             PIDFile = "/run/nscd/nscd.pid";
             Restart = "always";
             ExecReload =
@@ -75,15 +71,6 @@ in
                 "${pkgs.glibc.bin}/sbin/nscd --invalidate hosts"
               ];
           };
-
-        # Urgggggh... Nscd forks before opening its socket and writing
-        # its pid. So wait until it's ready.
-        postStart =
-          ''
-            while ! ${pkgs.glibc.bin}/sbin/nscd -g > /dev/null; do
-              sleep 0.2
-            done
-          '';
       };
 
   };

nixos/modules/services/web-apps/nextcloud.nix

@@ -297,8 +297,23 @@ in {
 
       systemd.services = {
         "nextcloud-setup" = let
+          c = cfg.config;
+          writePhpArrary = a: "[${concatMapStringsSep "," (val: ''"${toString val}"'') a}]";
           overrideConfig = pkgs.writeText "nextcloud-config.php" ''
             <?php
+            ${optionalString (c.dbpassFile != null) ''
+              function nix_read_pwd() {
+                $file = "${c.dbpassFile}";
+                if (!file_exists($file)) {
+                  throw new \RuntimeException(sprintf(
+                    "Cannot start Nextcloud, dbpass file %s set by NixOS doesn't exist!",
+                    $file
+                  ));
+                }
+
+                return trim(file_get_contents($file));
+              }
+            ''}
             $CONFIG = [
               'apps_paths' => [
                 [ 'path' => '${cfg.home}/apps', 'url' => '/apps', 'writable' => false ],
@@ -309,19 +324,27 @@ in {
               ${optionalString cfg.caching.apcu "'memcache.local' => '\\OC\\Memcache\\APCu',"}
               'log_type' => 'syslog',
               'log_level' => '${builtins.toString cfg.logLevel}',
-              ${optionalString (cfg.config.overwriteProtocol != null) "'overwriteprotocol' => '${cfg.config.overwriteProtocol}',"}
+              ${optionalString (c.overwriteProtocol != null) "'overwriteprotocol' => '${c.overwriteProtocol}',"}
+              ${optionalString (c.dbname != null) "'dbname' => '${c.dbname}',"}
+              ${optionalString (c.dbhost != null) "'dbhost' => '${c.dbhost}',"}
+              ${optionalString (c.dbport != null) "'dbport' => '${toString c.dbport}',"}
+              ${optionalString (c.dbuser != null) "'dbuser' => '${c.dbuser}',"}
+              ${optionalString (c.dbtableprefix != null) "'dbtableprefix' => '${toString c.dbtableprefix}',"}
+              ${optionalString (c.dbpass != null) "'dbpassword' => '${c.dbpass}',"}
+              ${optionalString (c.dbpassFile != null) "'dbpassword' => nix_read_pwd(),"}
+              'dbtype' => '${c.dbtype}',
+              'trusted_domains' => ${writePhpArrary ([ cfg.hostName ] ++ c.extraTrustedDomains)},
             ];
           '';
           occInstallCmd = let
-            c = cfg.config;
-            adminpass = if c.adminpassFile != null
-              then ''"$(<"${toString c.adminpassFile}")"''
-              else ''"${toString c.adminpass}"'';
             dbpass = if c.dbpassFile != null
               then ''"$(<"${toString c.dbpassFile}")"''
               else if c.dbpass != null
               then ''"${toString c.dbpass}"''
               else null;
+            adminpass = if c.adminpassFile != null
+              then ''"$(<"${toString c.adminpassFile}")"''
+              else ''"${toString c.adminpass}"'';
             installFlags = concatStringsSep " \\\n    "
               (mapAttrsToList (k: v: "${k} ${toString v}") {
               "--database" = ''"${c.dbtype}"'';

nixos/modules/services/web-apps/nextcloud.xml

@@ -42,10 +42,12 @@
 
   services.postgresql = {
     <link linkend="opt-services.postgresql.enable">enable</link> = true;
-    <link linkend="opt-services.postgresql.initialScript">initialScript</link> = pkgs.writeText "psql-init" ''
+    <link linkend="opt-services.postgresql.ensureDatabases">ensureDatabases</link> = [ "nextcloud" ];
-      CREATE ROLE nextcloud WITH LOGIN;
+    <link linkend="opt-services.postgresql.ensureUsers">ensureUsers</link> = [
-      CREATE DATABASE nextcloud WITH OWNER nextcloud;
+     { name = "nextcloud";
-    '';
+       ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
+     }
+    ];
   };
 
   # ensure that postgres is running *before* running the setup
@@ -63,17 +65,22 @@
    are used internally to configure an HTTP server using
    <literal><link xlink:href="https://php-fpm.org/">PHP-FPM</link></literal>
    and <literal>nginx</literal>. The <literal>config</literal> attribute set is
-   used for the <literal>config.php</literal> which is used for the
+   used by the imperative installer and all values are written to an additional file
-   application's configuration. <emphasis>Beware: this isn't entirely pure
+   to ensure that changes can be applied by changing the module's options.
-   since the config is modified by the application's runtime!</emphasis>
   </para>
 
   <para>
-   In case the application serves multiple hosts (those are checked with
+   In case the application serves multiple domains (those are checked with
    <literal><link xlink:href="http://php.net/manual/en/reserved.variables.server.php">$_SERVER['HTTP_HOST']</link></literal>)
-   those can be added using
+   it's needed to add them to
    <literal><link linkend="opt-services.nextcloud.config.extraTrustedDomains">services.nextcloud.config.extraTrustedDomains</link></literal>.
   </para>
+
+  <para>
+   Auto updates for Nextcloud apps can be enabled using
+   <literal><link linkend="opt-services.nextcloud.autoUpdateApps.enable">services.nextcloud.autoUpdateApps</link></literal>.
+</para>
+
  </section>
  <section xml:id="module-services-nextcloud-pitfalls-during-upgrade">
   <title>Pitfalls</title>
@@ -87,35 +94,24 @@
   </para>
 
   <para>
-   Right now changes to the <literal>services.nextcloud.config</literal>
+   All configuration parameters are also stored in
-   attribute set won't take effect after the first install (except
+   <literal>/var/lib/nextcloud/config/override.config.php</literal> which is generated by
-   <literal><link linkend="opt-services.nextcloud.config.extraTrustedDomains">services.nextcloud.config.extraTrustedDomains</link></literal>)
+   the module and linked from the store to ensure that all values from <literal>config.php</literal>
-   since the actual configuration file is generated by the NextCloud installer
+   can be modified by the module.
-   which also sets up critical parts such as the database structure.
+   However <literal>config.php</literal> manages the application's state and shouldn't be touched
+   manually because of that.
   </para>
 
-  <para>
+  <warning>
-   <emphasis>Warning: don't delete <literal>config.php</literal>! This file
+   <para>Don't delete <literal>config.php</literal>! This file
    tracks the application's state and a deletion can cause unwanted
-   side-effects!</emphasis>
+   side-effects!</para>
-  </para>
+  </warning>
 
-  <para>
+  <warning>
-   <emphasis>Warning: don't rerun <literal>nextcloud-occ
+   <para>Don't rerun <literal>nextcloud-occ
    maintenance:install</literal>! This command tries to install the application
-   and can cause unwanted side-effects!</emphasis>
+   and can cause unwanted side-effects!</para>
-  </para>
+  </warning>
-
-  <para>
-   The issues are known and reported in
-   <link xlink:href="https://github.com/NixOS/nixpkgs/issues/49783">#49783</link>,
-   for now it's unfortunately necessary to manually work around these issues.
-  </para>
-
-  <para>
-   Right now app installation and configuration is done imperatively in the nextcloud web ui or via the <literal>nextcloud-occ</literal> command line utility.
-   You can activate auto updates for your apps via
-   <literal><link linkend="opt-services.nextcloud.autoUpdateApps.enable">services.nextcloud.autoUpdateApps</link></literal>.
-  </para>
  </section>
 </chapter>

nixos/modules/services/web-servers/apache-httpd/default.nix

@@ -21,10 +21,9 @@ let
     else [{ip = "*"; port = 80;}];
 
   getListen = cfg:
-    let list = (lib.optional (cfg.port != 0) {ip = "*"; port = cfg.port;}) ++ cfg.listen;
+    if cfg.listen == []
-    in if list == []
+      then defaultListen cfg
-        then defaultListen cfg
+      else cfg.listen;
-        else list;
 
   listenToString = l: "${l.ip}:${toString l.port}";
 
@@ -638,7 +637,7 @@ in
                      message = "SSL is enabled for httpd, but sslServerCert and/or sslServerKey haven't been specified."; }
                  ];
 
-    warnings = map (cfg: ''apache-httpd's port option is deprecated. Use listen = [{/*ip = "*"; */ port = ${toString cfg.port};}]; instead'' ) (lib.filter (cfg: cfg.port != 0) allHosts);
+    warnings = map (cfg: "apache-httpd's extraSubservices option is deprecated. Most existing subservices have been ported to the NixOS module system. Please update your configuration accordingly.") (lib.filter (cfg: cfg.extraSubservices != []) allHosts);
 
     users.users = optionalAttrs (mainCfg.user == "wwwrun") (singleton
       { name = "wwwrun";
@@ -672,7 +671,7 @@ in
 
         wantedBy = [ "multi-user.target" ];
         wants = [ "keys.target" ];
-        after = [ "network.target" "fs.target" "postgresql.service" "keys.target" ];
+        after = [ "network.target" "fs.target" "keys.target" ];
 
         path =
           [ httpd pkgs.coreutils pkgs.gnugrep ]

nixos/modules/services/web-servers/apache-httpd/per-server-options.nix

@@ -24,14 +24,6 @@ with lib;
     '';
   };
 
-  port = mkOption {
-    type = types.int;
-    default = 0;
-    description = ''
-      Port for the server. Option will be removed, use <option>listen</option> instead.
-  '';
-  };
-
   listen = mkOption {
      type = types.listOf (types.submodule (
           {

nixos/modules/services/x11/compton.nix

@@ -7,57 +7,35 @@ let
 
   cfg = config.services.compton;
 
-  literalAttrs = v:
+  pairOf = x: with types; addCheck (listOf x) (y: length y == 2);
-    if isString v then toString v
-    else if isAttrs v then "{\n"
-      + concatStringsSep "\n" (mapAttrsToList
-        (name: value: "${literalAttrs name} = ${literalAttrs value};")
-        v)
-      + "\n}"
-    else generators.toPretty {} v;
 
   floatBetween = a: b: with lib; with types;
     addCheck str (x: versionAtLeast x a && versionOlder x b);
 
-  pairOf = x: with types; addCheck (listOf x) (y: length y == 2);
+  toConf = attrs: concatStringsSep "\n"
+    (mapAttrsToList
+      (k: v: let
+        sep = if isAttrs v then ":" else "=";
+        # Basically a tinkered lib.generators.mkKeyValueDefault
+        mkValueString = v:
+          if isBool v        then boolToString v
+          else if isInt v    then toString v
+          else if isFloat v  then toString v
+          else if isString v then ''"${escape [ ''"'' ] v}"''
+          else if isList v   then "[ "
+            + concatMapStringsSep " , " mkValueString v
+            + " ]"
+          else if isAttrs v  then "{ "
+            + concatStringsSep " "
+              (mapAttrsToList
+                (key: value: "${toString key}=${mkValueString value};")
+                v)
+            + " }"
+          else abort "compton.mkValueString: unexpected type (v = ${v})";
+      in "${escape [ sep ] k}${sep}${mkValueString v};")
+      attrs);
 
-  opacityRules = optionalString (length cfg.opacityRules != 0)
+  configFile = pkgs.writeText "compton.conf" (toConf cfg.settings);
-    (concatMapStringsSep ",\n" (rule: ''"${rule}"'') cfg.opacityRules);
-
-  configFile = pkgs.writeText "compton.conf"
-    (optionalString cfg.fade ''
-      # fading
-      fading = true;
-      fade-delta    = ${toString cfg.fadeDelta};
-      fade-in-step  = ${elemAt cfg.fadeSteps 0};
-      fade-out-step = ${elemAt cfg.fadeSteps 1};
-      fade-exclude  = ${toJSON cfg.fadeExclude};
-    '' + optionalString cfg.shadow ''
-
-      # shadows
-      shadow = true;
-      shadow-offset-x = ${toString (elemAt cfg.shadowOffsets 0)};
-      shadow-offset-y = ${toString (elemAt cfg.shadowOffsets 1)};
-      shadow-opacity  = ${cfg.shadowOpacity};
-      shadow-exclude  = ${toJSON cfg.shadowExclude};
-    '' + ''
-
-      # opacity
-      active-opacity   = ${cfg.activeOpacity};
-      inactive-opacity = ${cfg.inactiveOpacity};
-
-      wintypes:
-      ${literalAttrs cfg.wintypes};
-
-      opacity-rule = [
-        ${opacityRules}
-      ];
-
-      # other options
-      backend = ${toJSON cfg.backend};
-      vsync = ${boolToString cfg.vSync};
-      refresh-rate = ${toString cfg.refreshRate};
-    '' + cfg.extraOptions);
 
 in {
 
@@ -236,23 +214,13 @@ in {
       '';
     };
 
-    package = mkOption {
+    settings = let
-      type = types.package;
+      configTypes = with types; either bool (either int (either float str));
-      default = pkgs.compton;
+      # types.loaOf converts lists to sets
-      defaultText = "pkgs.compton";
+      loaOf = t: with types; either (listOf t) (attrsOf t);
-      example = literalExample "pkgs.compton";
+    in mkOption {
-      description = ''
+      type = loaOf (types.either configTypes (loaOf (types.either configTypes (loaOf configTypes))));
-        Compton derivation to use.
+      default = {};
-      '';
-    };
-
-    extraOptions = mkOption {
-      type = types.lines;
-      default = "";
-      example = ''
-        unredir-if-possible = true;
-        dbe = true;
-      '';
       description = ''
         Additional Compton configuration.
       '';
@@ -260,6 +228,42 @@ in {
   };
 
   config = mkIf cfg.enable {
+    services.compton.settings = let
+      # Hard conversion to float, literally lib.toInt but toFloat
+      toFloat = str: let
+        may_be_float = builtins.fromJSON str;
+      in if builtins.isFloat may_be_float
+        then may_be_float
+        else throw "Could not convert ${str} to float.";
+    in {
+      # fading
+      fading           = mkDefault cfg.fade;
+      fade-delta       = mkDefault cfg.fadeDelta;
+      fade-in-step     = mkDefault (toFloat (elemAt cfg.fadeSteps 0));
+      fade-out-step    = mkDefault (toFloat (elemAt cfg.fadeSteps 1));
+      fade-exclude     = mkDefault cfg.fadeExclude;
+
+      # shadows
+      shadow           = mkDefault cfg.shadow;
+      shadow-offset-x  = mkDefault (elemAt cfg.shadowOffsets 0);
+      shadow-offset-y  = mkDefault (elemAt cfg.shadowOffsets 1);
+      shadow-opacity   = mkDefault (toFloat cfg.shadowOpacity);
+      shadow-exclude   = mkDefault cfg.shadowExclude;
+
+      # opacity
+      active-opacity   = mkDefault (toFloat cfg.activeOpacity);
+      inactive-opacity = mkDefault (toFloat cfg.inactiveOpacity);
+
+      wintypes         = mkDefault cfg.wintypes;
+
+      opacity-rule     = mkDefault cfg.opacityRules;
+
+      # other options
+      backend          = mkDefault cfg.backend;
+      vsync            = mkDefault cfg.vSync;
+      refresh-rate     = mkDefault cfg.refreshRate;
+    };
+
     systemd.user.services.compton = {
       description = "Compton composite manager";
       wantedBy = [ "graphical-session.target" ];
@@ -271,13 +275,13 @@ in {
       };
 
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/compton --config ${configFile}";
+        ExecStart = "${pkgs.compton}/bin/compton --config ${configFile}";
         RestartSec = 3;
         Restart = "always";
       };
     };
 
-    environment.systemPackages = [ cfg.package ];
+    environment.systemPackages = [ pkgs.compton ];
   };
 
 }

nixos/modules/services/x11/desktop-managers/pantheon.nix

@@ -145,8 +145,6 @@ in
       isSystem = true;
     };
 
-    xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
-
     networking.networkmanager.enable = mkDefault true;
     networking.networkmanager.basePackages =
       { inherit (pkgs) networkmanager modemmanager wpa_supplicant;

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

@@ -22,7 +22,9 @@ let
 
     editor = if cfg.editor then "True" else "False";
 
-    inherit (cfg) consoleMode configurationLimit;
+    configurationLimit = if cfg.configurationLimit == null then 0 else cfg.configurationLimit;
+
+    inherit (cfg) consoleMode;
 
     inherit (efi) efiSysMountPoint canTouchEfiVariables;
 
@@ -58,12 +60,15 @@ in {
     };
 
     configurationLimit = mkOption {
-      default = 100;
+      default = null;
       example = 120;
-      type = types.int;
+      type = types.nullOr types.int;
       description = ''
-        Maximum of configurations in boot menu. Otherwise boot partition could
+        Maximum number of latest generations in the boot menu. 
-        run out of disk space.
+        Useful to prevent boot partition running out of disk space.
+
+        <literal>null</literal> means no limit i.e. all generations 
+        that were not garbage collected yet.
       '';
     };
 

nixos/tests/nextcloud/with-postgresql-and-redis.nix

@@ -27,10 +27,7 @@ in {
           dbtype = "pgsql";
           dbname = "nextcloud";
           dbuser = "nextcloud";
-          dbhost = "localhost";
+          dbhost = "/run/postgresql";
-          dbpassFile = toString (pkgs.writeText "db-pass-file" ''
-            hunter2
-          '');
           inherit adminuser;
           adminpassFile = toString (pkgs.writeText "admin-pass-file" ''
             ${adminpass}
@@ -84,10 +81,12 @@ in {
 
       services.postgresql = {
         enable = true;
-        initialScript = pkgs.writeText "psql-init" ''
+        ensureDatabases = [ "nextcloud" ];
-          create role nextcloud with login password 'hunter2';
+        ensureUsers = [
-          create database nextcloud with owner nextcloud;
+          { name = "nextcloud";
-        '';
+            ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
+          }
+        ];
       };
     };
   };

nixos/tests/prometheus-exporters.nix

@@ -3,10 +3,11 @@
 , pkgs ? import ../.. { inherit system config; }
 }:
 
-with pkgs.lib;
-with import ../lib/testing.nix { inherit system pkgs; };
-
 let
+  inherit (import ../lib/testing.nix { inherit system pkgs; }) makeTest;
+  inherit (pkgs.lib) concatStringsSep maintainers mapAttrs mkMerge
+                     removeSuffix replaceChars singleton splitString;
+
   escape' = str: replaceChars [''"'' "$" "\n"] [''\\\"'' "\\$" ""] str;
 
 /*
@@ -73,7 +74,7 @@ let
       exporterTest = ''
         waitForUnit("prometheus-bind-exporter.service");
         waitForOpenPort(9119);
-        succeed("curl -sSf http://localhost:9119/metrics" | grep -q 'bind_query_recursions_total 0');
+        succeed("curl -sSf http://localhost:9119/metrics | grep -q 'bind_query_recursions_total 0'");
       '';
     };
 
@@ -311,6 +312,7 @@ let
       };
       exporterTest = ''
         waitForUnit("prometheus-varnish-exporter.service");
+        waitForOpenPort(6081);
         waitForOpenPort(9131);
         succeed("curl -sSf http://localhost:9131/metrics | grep -q 'varnish_up 1'");
       '';

pkgs/applications/altcoins/default.nix

@@ -65,6 +65,8 @@ rec {
   };
   litecoind = litecoin.override { withGui = false; };
 
+  lnd = callPackage ./lnd.nix { };
+
   masari = callPackage ./masari.nix { boost = boost165; };
 
   memorycoin  = callPackage ./memorycoin.nix { boost = boost165; withGui = true; };

pkgs/applications/altcoins/go-ethereum.nix

@@ -2,7 +2,7 @@
 
 buildGoPackage rec {
   pname = "go-ethereum";
-  version = "1.9.0";
+  version = "1.9.1";
 
   goPackagePath = "github.com/ethereum/go-ethereum";
 
@@ -17,7 +17,7 @@ buildGoPackage rec {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "03gkrvps1syvyjna7769n4j3mlpxcgdj461gzds2l90k02ajvh7x";
+    sha256 = "05vnjdjwahdp2j7c6g81jchpdhxmdpbr20mjzpszylp9824v4cba";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/altcoins/lnd.nix

@@ -0,0 +1,22 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+
+buildGoModule rec {
+  pname = "lnd";
+  version = "0.7.0-beta";
+
+  src = fetchFromGitHub {
+    owner = "lightningnetwork";
+    repo = "lnd";
+    rev = "v${version}";
+    sha256 = "0d6m1vfy33rg6d7qmkpydiypav1girxsnxan9njyjz0vhinmq0sx";
+  };
+
+  modSha256 = "0akxi7xhyz7xx0vc003abidva02sp940cc2gfjg4fmzkc95cajc9";
+
+  meta = with lib; {
+    description = "Lightning Network Daemon";
+    homepage = "https://github.com/lightningnetwork/lnd";
+    license = lib.licenses.mit;
+    maintainers = with maintainers; [ cypherpunk2140 ];
+  };
+}

pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix

@@ -0,0 +1,16 @@
+{ fetchurl, bitwig-studio1,
+  pulseaudio }:
+
+bitwig-studio1.overrideAttrs (oldAttrs: rec {
+  name = "bitwig-studio-${version}";
+  version = "3.0";
+
+  src = fetchurl {
+    url = "https://downloads.bitwig.com/stable/${version}/bitwig-studio-${version}.deb";
+    sha256 = "0p7wi1srfzalb0rl94vqppfbnxdfwqzgg5blkdwkf4sx977aihpv";
+  };
+
+  runtimeDependencies = [
+    pulseaudio
+  ];
+})

pkgs/applications/audio/drumkv1/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "drumkv1-${version}";
-  version = "0.9.8";
+  version = "0.9.9";
 
   src = fetchurl {
     url = "mirror://sourceforge/drumkv1/${name}.tar.gz";
-    sha256 = "010p8nwnmqgj5mw324psig3hxi1g2gylxrigd6sj6sgcpy3kdm23";
+    sha256 = "02sa29fdjgwcf7izly685gxvga3bxyyqvskvfiisgm2xg3h9r983";
   };
 
   buildInputs = [ libjack2 alsaLib libsndfile liblo lv2 qt5.qtbase qt5.qttools ];

pkgs/applications/audio/helio-workstation/default.nix

@@ -0,0 +1,46 @@
+{ stdenv, fetchFromGitHub
+, alsaLib, freetype, xorg, curl, libGL, libjack2, gnome3
+, pkgconfig, makeWrapper
+}:
+
+stdenv.mkDerivation rec {
+  pname = "helio-workstation";
+  version = "2.2";
+
+  src = fetchFromGitHub {
+    owner = "helio-fm";
+    repo = pname;
+    rev = version;
+    fetchSubmodules = true;
+    sha256 = "16iwj4mjs1nm8dlk70q97svp3vkcgs7hdj9hfda9h67acn4a8vvk";
+  };
+
+  buildInputs = [
+    alsaLib freetype xorg.libX11 xorg.libXext xorg.libXinerama xorg.libXrandr
+    xorg.libXcursor xorg.libXcomposite curl libGL libjack2 gnome3.zenity
+  ];
+
+  nativeBuildInputs = [ pkgconfig makeWrapper ];
+
+  preBuild = "cd Projects/LinuxMakefile";
+  buildFlags = [ "CONFIG=Release64" ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    install -Dm755 build/Helio $out/bin
+    wrapProgram $out/bin/Helio --prefix PATH ":" ${gnome3.zenity}/bin
+
+    mkdir -p $out/share
+    cp -r ../Deployment/Linux/Debian/x64/usr/share/* $out/share
+    substituteInPlace $out/share/applications/Helio.desktop \
+      --replace "/usr/bin/helio" "$out/bin/Helio"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "One music sequencer for all major platforms, both desktop and mobile";
+    homepage = https://helio.fm/;
+    license = licenses.gpl3;
+    maintainers = [ maintainers.suhr ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

pkgs/applications/audio/klystrack/default.nix

@@ -0,0 +1,52 @@
+{ stdenv, fetchFromGitHub, fetchpatch
+, SDL2, SDL2_image
+, pkgconfig
+}:
+
+stdenv.mkDerivation rec {
+  pname = "klystrack";
+  version = "1.7.6";
+
+  src = fetchFromGitHub {
+    owner = "kometbomb";
+    repo = pname;
+    rev = version;
+    fetchSubmodules = true;
+    sha256 = "1h99sm2ddaq483hhk2s3z4bjbgn0d2h7qna7l7qq98wvhqix8iyz";
+  };
+
+  buildInputs = [
+    SDL2 SDL2_image
+  ];
+  nativeBuildInputs = [ pkgconfig ];
+
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/kometbomb/klystrack/commit/bb537595d02140176831c4a1b8e9121978b32d22.patch";
+      sha256 = "06gl9q0jwg039kpxb13lg9x0k59s11968qn4lybgkadvzmhxkgmi";
+    })
+  ];
+
+  buildFlags = [ "PREFIX=${placeholder "out"}" "CFG=release" ];
+
+  installPhase = ''
+    install -Dm755 bin.release/klystrack $out/bin/klystrack
+
+    mkdir -p $out/lib/klystrack
+    cp -R res $out/lib/klystrack
+    cp -R key $out/lib/klystrack
+
+    install -DT icon/256x256.png $out/share/icons/hicolor/256x256/apps/klystrack.png
+    mkdir -p $out/share/applications
+    substitute linux/klystrack.desktop $out/share/applications/klystrack.desktop \
+      --replace "klystrack %f" "$out/bin/klystrack %f"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A chiptune tracker";
+    homepage = "https://kometbomb.github.io/klystrack";
+    license = licenses.mit;
+    maintainers = with maintainers; [ suhr ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/audio/reaper/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   name = "reaper-${version}";
-  version = "5.979";
+  version = "5.980";
 
   src = fetchurl {
     url = "https://www.reaper.fm/files/${stdenv.lib.versions.major version}.x/reaper${builtins.replaceStrings ["."] [""] version}_linux_x86_64.tar.xz";
-    sha256 = "0v9i7wgl68clwlw5k6rwligk3b3bl6c8xxabklglbxnx5i6iw5ia";
+    sha256 = "0ij5cx43gf05q0d57p4slsp7wkq2cdb3ymh2n5iqgqjl9rf26h1q";
   };
 
   nativeBuildInputs = [ autoPatchelfHook makeWrapper ];

pkgs/applications/audio/snd/default.nix

@@ -4,11 +4,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "snd-19.4";
+  name = "snd-19.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/snd/${name}.tar.gz";
-    sha256 = "1g96r1js9rfxxczpaa1ggrz7i1zsj4px4fyz64kbqawzsn9xapg9";
+    sha256 = "0sk6iyykwi2mm3f1g4r0iqbsrwk3zmyagp6jjqkh8njbq42cjr1y";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/audio/spotifyd/default.nix

@@ -0,0 +1,40 @@
+{ stdenv, fetchFromGitHub, rustPlatform, pkgconfig, openssl
+, withALSA ? true, alsaLib ? null
+, withPulseAudio ? false, libpulseaudio ? null
+, withPortAudio ? false, portaudio ? null
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "spotifyd";
+  version = "0.2.11";
+
+  src = fetchFromGitHub {
+    owner = "Spotifyd";
+    repo = "spotifyd";
+    rev = "${version}";
+    sha256 = "1iybk9xrrvhrcl2xl5r2xhyn1ydhrgwnnb8ldhsw5c16b32z03q1";
+  };
+
+  cargoSha256 = "0879p1h32259schmy8j3xnwpw3sw80f8mrj8s6b5aihi3yyzz521";
+
+  cargoBuildFlags = [
+    "--no-default-features"
+    "--features"
+    "${stdenv.lib.optionalString withALSA "alsa_backend,"}${stdenv.lib.optionalString withPulseAudio "pulseaudio_backend,"}${stdenv.lib.optionalString withPortAudio "portaudio_backend,"}"
+  ];
+
+  nativeBuildInputs = [ pkgconfig ];
+
+  buildInputs = [ openssl ]
+    ++ stdenv.lib.optional withALSA alsaLib
+    ++ stdenv.lib.optional withPulseAudio libpulseaudio
+    ++ stdenv.lib.optional withPortAudio portaudio;
+
+  meta = with stdenv.lib; {
+    description = "An open source Spotify client running as a UNIX daemon";
+    homepage = "https://github.com/Spotifyd/spotifyd";
+    license = with licenses; [ gpl3 ];
+    maintainers = [ maintainers.anderslundstedt ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/audio/tree-from-tags/Gemfile

@@ -0,0 +1,3 @@
+source "https://rubygems.org"
+
+gem "taglib-ruby"

pkgs/applications/audio/tree-from-tags/Gemfile.lock

@@ -0,0 +1,13 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    taglib-ruby (0.7.1)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  taglib-ruby
+
+BUNDLED WITH
+   1.16.3

pkgs/applications/audio/tree-from-tags/default.nix

@@ -0,0 +1,37 @@
+{ stdenv, bundlerEnv, ruby, fetchFromGitHub }:
+let
+  version = "1.1";
+  gems = bundlerEnv {
+    name = "tree-from-tags-${version}-gems";
+    inherit ruby;
+    gemdir  = ./.;
+  };
+in stdenv.mkDerivation {
+  name = "tree-from-tags-${version}";
+  src = fetchFromGitHub {
+    owner  = "dbrock";
+    repo   = "bongo";
+    rev    = version;
+    sha256 = "1nszph9mn98flyhn1jq3y6mdh6jymjkvj5ng36ql016dj92apvhv";
+  };
+  buildInputs = [ gems ruby ];
+  installPhase = ''
+    mkdir -p $out/{bin,share}
+    cp tree-from-tags.rb $out/share/
+    bin=$out/bin/tree-from-tags
+# we are using bundle exec to start in the bundled environment
+    cat > $bin <<EOF
+#!/bin/sh -e
+exec ${gems}/bin/bundle exec ${ruby}/bin/ruby "$out"/share/tree-from-tags.rb "\$@"
+EOF
+    chmod +x $bin
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Create file hierarchies from media tags";
+    homepage = https://www.emacswiki.org/emacs/Bongo;
+    platforms = ruby.meta.platforms;
+    maintainers = [ maintainers.livnev maintainers.dbrock ];
+    license = licenses.gpl2Plus;
+  };
+}

pkgs/applications/audio/tree-from-tags/gemset.nix

@@ -0,0 +1,10 @@
+{
+  taglib-ruby = {
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0r8g7zdncc6243d000jn0grc1n70rn9mx16vggy3q7c4wgsa37xi";
+      type = "gem";
+    };
+    version = "0.7.1";
+  };
+}

pkgs/applications/editors/emacs-modes/melpa-packages.nix

@@ -59,6 +59,10 @@ self:
         inherit (self.melpaPackages) easy-kill;
       };
 
+      editorconfig = super.editorconfig.overrideAttrs (attrs: {
+        propagatedUserEnvPkgs = [ external.editorconfig-core-c ];
+      });
+
       egg = super.egg.overrideAttrs (attrs: {
         # searches for Git at build time
         nativeBuildInputs =

pkgs/applications/graphics/drawio/default.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "10.8.0";
+  version = "10.9.5";
 
   src = fetchurl {
     url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/draw.io-x86_64-${version}.rpm";
-    sha256 = "0c5wymzhbp72x0yhvw7vb4akkdvj97npl9kglk79vqjbzfn5di9k";
+    sha256 = "13687d5bfxj7wlbh5j13pvxvs69whlg820wllk3pb1xb3syynlpn";
   };
 
   nativeBuildInputs = [

pkgs/applications/graphics/feh/default.nix

@@ -6,11 +6,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   name = "feh-${version}";
-  version = "3.2";
+  version = "3.2.1";
 
   src = fetchurl {
     url = "https://feh.finalrewind.org/${name}.tar.bz2";
-    sha256 = "004vapxpl001yanqvw3cq37fmkdr527jyz0s5nybz1mnl4926660";
+    sha256 = "070axq8jpibcabmjfv4fmjmpk3k349vzvh4qhsi4n62bkcwl35wg";
   };
 
   outputs = [ "out" "man" "doc" ];

pkgs/applications/graphics/pdfcpu/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "pdfcpu";
-  version = "0.1.25";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "hhrutter";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0vmmc7nnvpvsf92yi69rvqif1irkpya2shqyz49sa3s42jh1446b";
+    sha256 = "0cg17nph3qv1ca86j3wcd33vqs6clkzi6y2nrajmk7dq5vbzr6nn";
   };
 
   modSha256 = "0cz4gs88s9z2yv1gc9ap92vv2j93ab6kr25zjgl2r7z6clbl5fzp";

pkgs/applications/misc/barrier/default.nix

@@ -1,26 +1,19 @@
-{ stdenv, fetchpatch, fetchurl, cmake, curl, xorg, avahi, qt5,
+{ stdenv, fetchFromGitHub, cmake, curl, xorg, avahi, qtbase, mkDerivation,
   avahiWithLibdnssdCompat ? avahi.override { withLibdnssdCompat = true; }
 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
-  name = "barrier-${version}";
+  pname = "barrier";
-  version = "2.1.1";
+  version = "2.3.0";
-  src = fetchurl {
+
-    url = "https://github.com/debauchee/barrier/archive/v${version}.tar.gz";
+  src = fetchFromGitHub {
-    sha256 = "0x17as5ikfx2r5hawr368a9risvcavyc8zv5g724s709nr6m0pbp";
+    owner = "debauchee";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1fy7xjwqyisapf8wv50gwpbgbv5b4ldf7766w453h5iw10d18kh0";
   };
 
-  buildInputs = [ cmake curl xorg.libX11 xorg.libXext xorg.libXtst avahiWithLibdnssdCompat ];
+  buildInputs = [ cmake curl xorg.libX11 xorg.libXext xorg.libXtst avahiWithLibdnssdCompat qtbase ];
-  propagatedBuildInputs = with qt5; [ qtbase ];
-
-  patches = [
-    # Fix compilation on Qt 5.11
-    # Patch should be removed on next version bump from 2.1.1!
-    (fetchpatch {
-      url = "https://github.com/debauchee/barrier/commit/a956cad0da23f544b874888c6c3540dc7f8f22cf.patch";
-      sha256 = "0x5045bdks1f9casp0v7svx9ml1gxhkhw5sqc7xk36h184m24a21";
-    })
-  ];
 
   postFixup = ''
     substituteInPlace "$out/share/applications/barrier.desktop" --replace "Exec=barrier" "Exec=$out/bin/barrier"

pkgs/applications/misc/brewtarget/default.nix

@@ -0,0 +1,38 @@
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, bash
+, cmake
+, qtbase
+, qttools
+, qtmultimedia
+, qtwebkit
+, qtsvg
+}:
+
+mkDerivation rec {
+  pname = "brewtarget";
+  version = "2.3.1";
+
+  src = fetchFromGitHub {
+    owner = "Brewtarget";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "14xmm6f8xmvypagx4qdw8q9llzmyi9zzfhnzh4kbbflhjbcr7isz";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ qtbase qttools qtmultimedia qtwebkit qtsvg ];
+
+  preConfigure = ''
+    chmod +x configure
+    substituteInPlace configure --replace /bin/bash "${bash}/bin/bash"
+  '';
+
+  meta = with lib; {
+    description = "Open source beer recipe creation tool";
+    homepage = "http://www.brewtarget.org/";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.mmahut ];
+  };
+}

pkgs/applications/misc/kjv/default.nix

@@ -0,0 +1,43 @@
+{ stdenv, fetchFromGitHub, fetchpatch }:
+
+let
+
+patch-base = https://github.com/LukeSmithxyz/kjv/commit/;
+
+add-apocrypha = fetchpatch {
+  url = patch-base + "b92b7622285d10464f9274f11e740bef90705bbc.patch";
+  sha256 = "0n4sj8p9m10fcair4msc129jxkkx5whqzhjbr5k4lfgp6nb1zk8k";
+};
+
+add-install-target = fetchpatch {
+  url = patch-base + "f4ad73539eb73f1890f4b791d8d38dd95900a4a4.patch";
+  sha256 = "1yzj72i5fkzn2i4wl09q6jx7nwn2h4jwm49fc23nxfwchzar9m1q";
+};
+
+in
+
+stdenv.mkDerivation rec {
+  pname = "kjv";
+  version = "unstable-2018-12-25";
+
+  src = fetchFromGitHub {
+    owner = "bontibon";
+    repo = pname;
+    rev = "fda81a610e4be0e7c5cf242de655868762dda1d4";
+    sha256 = "1favfcjvd3pzz1ywwv3pbbxdg7v37s8vplgsz8ag016xqf5ykqqf";
+  };
+
+  patches = [ add-apocrypha add-install-target ];
+
+  makeFlags = [
+    "PREFIX=${placeholder ''out''}"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "The Bible, King James Version";
+    homepage = "https://github.com/bontibon/kjv";
+    license = licenses.publicDomain;
+    maintainers = [ maintainers.jtobin ];
+  };
+}
+

pkgs/applications/misc/rescuetime/default.nix

@@ -5,15 +5,15 @@ let
     if stdenv.hostPlatform.system == "i686-linux" then fetchurl {
       name = "rescuetime-installer.deb";
       url = "https://www.rescuetime.com/installers/rescuetime_current_i386.deb";
-      sha256 = "136ci4q0ns0qzikndlkbab947m47zv2nmnn8mda2374ip43kn6ri";
+      sha256 = "03bky9vja7fijz45n44b6gawd6q8yd30nx6nya9lqdlxd1bkqmji";
     } else fetchurl {
       name = "rescuetime-installer.deb";
       url = "https://www.rescuetime.com/installers/rescuetime_current_amd64.deb";
-      sha256 = "1cw10lr7hrsr9xvq3wv1wkyk7jqsgfnnlkq4km9kxr39f51hv6na";
+      sha256 = "03bky9vja7fijz45n44b6gawd6q8yd30nx6nya9lqdlxd1bkqmji";
     };
 in stdenv.mkDerivation {
   # https://www.rescuetime.com/updates/linux_release_notes.html
-  name = "rescuetime-2.14.2.1";
+  name = "rescuetime-2.14.3.1";
   inherit src;
   buildInputs = [ dpkg makeWrapper ];
   # avoid https://github.com/NixOS/patchelf/issues/99

pkgs/applications/misc/st/xst.nix

@@ -9,7 +9,7 @@ in stdenv.mkDerivation {
   inherit name;
 
   src = fetchFromGitHub {
-    owner = "neeasade";
+    owner = "gnotclub";
     repo = "xst";
     rev = "v${version}";
     sha256 = "1fh4y2w0icaij99kihl3w8j5d5b38d72afp17c81pi57f43ss6pc";

pkgs/applications/misc/xygrib/default.nix

@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, cmake, bzip2, qtbase, qttools, libnova, proj, libpng, openjpeg } :
+
+stdenv.mkDerivation rec {
+  version = "1.2.6.1";
+  pname = "xygrib";
+
+  src = fetchFromGitHub {
+    owner = "opengribs";
+    repo = "XyGrib";
+    rev = "v${version}";
+    sha256 = "0xzsm8pr0zjk3f8j880fg5n82jyxn8xf1330qmmq1fqv7rsrg9ia";
+  };
+
+  nativeBuildInputs = [ cmake qttools ];
+  buildInputs = [ bzip2 qtbase libnova proj openjpeg libpng ];
+  cmakeFlags = [ "-DOPENJPEG_INCLUDE_DIR=${openjpeg.dev}/include/openjpeg-2.3" ];
+
+  postInstall = ''
+    mkdir $out/bin
+    ln -s $out/XyGrib/XyGrib $out/bin/XyGrib
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://opengribs.org";
+    description = "Weather Forecast Visualization";
+    longDescription = ''XyGrib is a leading opensource weather visualization package.
+                        It interacts with OpenGribs's Grib server providing a choice
+                        of global and large area atmospheric and wave models.'';
+    license = licenses.gpl3;
+    platforms = platforms.all;
+    maintainers = [ maintainers.j03 ];
+  };
+}

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -17,10 +17,10 @@ rec {
 
   firefox = common rec {
     pname = "firefox";
-    ffversion = "68.0";
+    ffversion = "68.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "0pg8ww2ldlvdlri0zrzv20x69x00gxshr4afq62pnz7rgrnppkdd0pw5snflisgvpxq1syxcrg5750wz1k4bfjwnyq47jk9h3fzddpw";
+      sha512 = "20rqfa5sdaagryk00iywnbap0bmhq1c74pfbxi3pq1cs52qs5nhjqn3xm6910zwcn5nw08i9qd5jkg5blvqrjzw780nh8qbrwsm3d4n";
     };
 
     patches = [
@@ -99,10 +99,10 @@ rec {
 
   firefox-esr-68 = common rec {
     pname = "firefox-esr";
-    ffversion = "68.0esr";
+    ffversion = "68.0.1esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "29iqxxwkz2zgk2ppgq05w0bhs8c0938gina5s8brmwn6zn15nv379pa82a9djpzjryl6c5ff0hk0z7gx6n3xvf7w7ky9010h9il0kbg";
+      sha512 = "27ncapq18rdlrf0kp5r09spcqazi0g8nbzbfxijs9pi3cvlkayagi3fbbzzq5jkn0n3j580vadc6v1v3zibvdwb5s3c6bz559a7nra2";
     };
 
     patches = [

pkgs/applications/networking/cluster/sonobuoy/default.nix

@@ -0,0 +1,43 @@
+{ lib, buildGoPackage, fetchFromGitHub }:
+
+# SHA of ${version} for the tool's help output
+let rev = "7ad367535a6710802085d41e0dbb53df359b9882";
+in
+buildGoPackage rec {
+  pname = "sonobuoy";
+  version = "0.15.0";
+
+  goPackagePath = "github.com/heptio/sonobuoy";
+
+  buildFlagsArray =
+    let t = "${goPackagePath}";
+    in ''
+      -ldflags=
+        -s -X ${t}/pkg/buildinfo.Version=${version}
+           -X ${t}/pkg/buildinfo.GitSHA=${rev}
+           -X ${t}/pkg/buildDate=unknown
+    '';
+
+  src = fetchFromGitHub {
+    sha256 = "0dkmhmr7calk8mkdxfpy3yjzk10ja4gz1jq8pgk3v8rh04f4h1x5";
+    rev = "v${version}";
+    repo = "sonobuoy";
+    owner = "heptio";
+  };
+
+  meta = with lib; {
+    description = ''
+      Diagnostic tool that makes it easier to understand the
+      state of a Kubernetes cluster.
+    '';
+    longDescription = ''
+      Sonobuoy is a diagnostic tool that makes it easier to understand the state of
+      a Kubernetes cluster by running a set of Kubernetes conformance tests in an
+      accessible and non-destructive manner.
+    '';
+
+    homepage = "https://github.com/heptio/sonobuoy";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ carlosdagos ];
+  };
+}

pkgs/applications/networking/cluster/tilt/default.nix

@@ -1,25 +1,24 @@
 { stdenv, buildGoPackage, fetchFromGitHub }:
 
 buildGoPackage rec {
-  pname   = "tilt";
+  pname = "tilt";
-  name    = "${pname}-${version}";
   /* Do not use "dev" as a version. If you do, Tilt will consider itself
      running in development environment and try to serve assets from the
      source tree, which is not there once build completes.  */
-  version = "0.8.8";
+  version = "0.9.4";
-  rev = "344dc1dc61ffe2c29606b105cea0df79fb5897f5";
 
   src = fetchFromGitHub {
     owner  = "windmilleng";
-    repo   = "tilt";
+    repo   = pname;
-    rev    = "${rev}";
+    rev    = "v${version}";
-    sha256 = "13yda6m2d92mmc9w4k8ngdxmpqcqf86bkrvcpmpaby848ls1yx8g";
+    sha256 = "1n1hys9mwqr4jiwl2z5bi2lgbw4rp800hsavih87xzrda1gzvmad";
   };
 
   goPackagePath = "github.com/windmilleng/tilt";
+
   subPackages = [ "cmd/tilt" ];
 
-  buildFlagsArray = ("-ldflags=-X main.version=${version} -X main.date=2019-06-03");
+  buildFlagsArray = ("-ldflags=-X main.version=${version} -X main.date=2019-07-23");
 
   meta = with stdenv.lib; {
     description = "Local development tool to manage your developer instance when your team deploys to Kubernetes in production";

pkgs/applications/networking/instant-messengers/franz/default.nix

@@ -3,12 +3,12 @@
 , gnome2, dbus, nss, nspr, alsaLib, cups, expat, udev, libnotify, xdg_utils }:
 
 let
-  version = "5.1.0";
+  version = "5.2.0";
 in stdenv.mkDerivation rec {
   name = "franz-${version}";
   src = fetchurl {
     url = "https://github.com/meetfranz/franz/releases/download/v${version}/franz_${version}_amd64.deb";
-    sha256 = "a474d2e9c6fb99abfc4c7e9290a0e52eef62233fa25c962afdde75fe151277d0";
+    sha256 = "1wlfd1ja38vbjy8y5pg95cpvf5ixkkq53m7v3c24q473jax4ynvg";
   };
 
   # don't remove runtime deps

pkgs/applications/networking/instant-messengers/slack/default.nix

@@ -1,12 +1,12 @@
 { theme ? null, stdenv, fetchurl, dpkg, makeWrapper , alsaLib, atk, cairo,
 cups, curl, dbus, expat, fontconfig, freetype, glib , gnome2, gtk3, gdk_pixbuf,
 libappindicator-gtk3, libnotify, libxcb, nspr, nss, pango , systemd, xorg,
-at-spi2-atk, libuuid
+at-spi2-atk, libuuid, nodePackages
 }:
 
 let
 
-  version = "3.4.2";
+  version = "4.0.0";
 
   rpath = stdenv.lib.makeLibraryPath [
     alsaLib
@@ -51,7 +51,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://downloads.slack-edge.com/linux_releases/slack-desktop-${version}-amd64.deb";
-        sha256 = "0qbj41ymckz8w1p2pazyxg7pimgn9gmpvxz4ygcm0nyivfmw2crq";
+        sha256 = "911a4c05fb4f85181df13f013e82440b0d171862c9cb137dc19b6381d47bd57e";
       }
     else
       throw "Slack is not supported on ${stdenv.hostPlatform.system}";
@@ -66,7 +66,7 @@ in stdenv.mkDerivation {
     gtk3  # needed for GSETTINGS_SCHEMAS_PATH
   ];
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper nodePackages.asar ];
 
   dontUnpack = true;
   buildCommand = ''
@@ -93,18 +93,20 @@ in stdenv.mkDerivation {
       --replace /usr/bin/ $out/bin/ \
       --replace /usr/share/ $out/share/
   '' + stdenv.lib.optionalString (theme != null) ''
-    cat <<EOF >> $out/lib/slack/resources/app.asar.unpacked/src/static/ssb-interop.js
+    asar extract $out/lib/slack/resources/app.asar $out/lib/slack/resources/app.asar.unpacked
+    cat <<EOF >> $out/lib/slack/resources/app.asar.unpacked/dist/ssb-interop.bundle.js
+
     var fs = require('fs');
     document.addEventListener('DOMContentLoaded', function() {
-    let tt__customCss = ".menu ul li a:not(.inline_menu_link) {color: #fff !important;}"
       fs.readFile('${theme}/theme.css', 'utf8', function(err, css) {
-            \$("<style></style>").appendTo('head').html(css + tt__customCss);
+        let s = document.createElement('style');
-            \$("<style></style>").appendTo('head').html('#reply_container.upload_in_threads .inline_message_input_container {background: padding-box #545454}');
+        s.type = 'text/css';
-            \$("<style></style>").appendTo('head').html('.p-channel_sidebar {background: #363636 !important}');
+        s.innerHTML = css;
-            \$("<style></style>").appendTo('head').html('#client_body:not(.onboarding):not(.feature_global_nav_layout):before {background: inherit;}');
+        document.head.appendChild(s);
       });
     });
     EOF
+    asar pack $out/lib/slack/resources/app.asar.unpacked $out/lib/slack/resources/app.asar
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/networking/instant-messengers/teamspeak/server.nix

@@ -1,13 +1,10 @@
-{ stdenv, fetchurl, makeWrapper, autoPatchelfHook }:
+{ stdenv, fetchurl, autoPatchelfHook }:
 
 let
-  version = "3.8.0";
   arch = if stdenv.is64bit then "amd64" else "x86";
-  libDir = if stdenv.is64bit then "lib64" else "lib";
+in stdenv.mkDerivation rec {
-in
+  pname = "teamspeak-server";
-
+  version = "3.8.0";
-stdenv.mkDerivation {
-  name = "teamspeak-server-${version}";
 
   src = fetchurl {
     urls = [
@@ -19,10 +16,10 @@ stdenv.mkDerivation {
       else "0p5rqwdsvbria5dzjjm5mj8vfy0zpfs669wpbwxd4g3n4vh03kyw";
   };
 
-  nativeBuildInputs = [ makeWrapper autoPatchelfHook ];
-
   buildInputs = [ stdenv.cc.cc ];
 
+  nativeBuildInputs = [ autoPatchelfHook ];
+
   installPhase = ''
     # Install files.
     mkdir -p $out/lib/teamspeak

pkgs/applications/networking/protonmail-bridge/default.nix

@@ -1,8 +1,8 @@
-{ stdenv, fetchurl, lib, qtbase, qtmultimedia, qtsvg, qtdeclarative, qttools, full
+{ stdenv, fetchurl, lib, qtbase, qtmultimedia, qtsvg, qtdeclarative, qttools, qtgraphicaleffects, qtquickcontrols2, full
-, libsecret, libGL, libpulseaudio, glib, wrapQtAppsHook, makeDesktopItem }:
+, libsecret, libGL, libpulseaudio, glib, wrapQtAppsHook, makeDesktopItem, mkDerivation }:
 
 let
-  version = "1.1.5-1";
+  version = "1.1.6-1";
 
   description = ''
     An application that runs on your computer in the background and seamlessly encrypts
@@ -20,16 +20,15 @@ let
     genericName = "ProtonMail Bridge for Linux";
     categories = "Utility;Security;Network;Email";
   };
-in stdenv.mkDerivation rec {
+
+in mkDerivation rec {
   name = "protonmail-bridge-${version}";
 
   src = fetchurl {
     url = "https://protonmail.com/download/protonmail-bridge_${version}_amd64.deb";
-    sha256 = "1y5mphrs60zd6km9z64vskk70q9zzw4g6js7qvgl572wv81w2l75";
+    sha256 = "108dql9q5znsqjkrs41pc6psjbg5bz09rdmjl036xxbvsdvq4a8r";
   };
 
-  nativeBuildInputs = [ wrapQtAppsHook ];
-
   sourceRoot = ".";
 
   unpackCmd = ''
@@ -51,6 +50,8 @@ in stdenv.mkDerivation rec {
     rpath = lib.makeLibraryPath [
       stdenv.cc.cc.lib
       qtbase
+      qtquickcontrols2
+      qtgraphicaleffects
       qtmultimedia
       qtsvg
       qtdeclarative
@@ -67,6 +68,8 @@ in stdenv.mkDerivation rec {
       $out/lib/protonmail-bridge
   '';
 
+  buildInputs = [ qtbase qtquickcontrols2 qtmultimedia qtgraphicaleffects qtdeclarative ];
+
   meta = with stdenv.lib; {
     homepage = "https://www.protonmail.com/bridge";
     license = licenses.mit;

pkgs/applications/networking/remote/citrix-workspace/default.nix

@@ -22,22 +22,11 @@
 , fontconfig
 , gtk_engines
 , alsaLib
-, libidn
 , zlib
-, version ? "19.3.0"
+, version ? "19.6.0"
 }:
 
 let
-  # In 56e1bdc7f9c (libidn: 1.34 -> 1.35), libidn.so.11 became libidn.so.12.
-  # Citrix looks for the former so we build version 1.34 to please the binary
-  libidn_134 = libidn.overrideDerivation (_: rec {
-    name = "libidn-1.34";
-    src = fetchurl {
-      url = "mirror://gnu/libidn/${name}.tar.gz";
-      sha256 = "0g3fzypp0xjcgr90c5cyj57apx1cmy0c6y9lvw2qdcigbyby469p";
-    };
-  });
-
   versionInfo = let
     supportedVersions = {
       "19.3.0" = {
@@ -48,13 +37,27 @@ let
         x86hash   = "1hxgj5lk5ghbpssbqjd404qr84gls967vwrh8ww5hg3pn86kyf8w";
         x64suffix = "5";
         x86suffix = "5";
+        homepage  = https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-linux/workspace-app-for-linux-1903.html;
+      };
+
+      "19.6.0" = {
+        major     = "19";
+        minor     = "6";
+        patch     = "0";
+        x64hash   = "0szqlfmigzgf0309i6ikxkizxaf4ri7qmhys75m0zi3bpwx6hzhs";
+        x86hash   = "16v3kgavrh62z6vxcbw6mn7h0bfishpl7m92k7g1p2882r1f8vaf";
+        x64suffix = "60";
+        x86suffix = "60";
         homepage  = https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html;
       };
     };
 
     # Copied this file largely from the citrix-receiver package
     # Leaving this here even though there are no deprecations yet
-    # for ease of future maintenance
+    # for ease of future maintenance.
+    #
+    # The lifespans of Citrix products can be found here:
+    # https://www.citrix.com/support/product-lifecycle/milestones/receiver.html
     deprecatedVersions = let
       versions = [ ];
     in
@@ -117,7 +120,6 @@ let
         xorg.libXinerama
         xorg.libXfixes
         libpng12
-        libidn_134
         zlib
         gtk_engines
         freetype
@@ -208,6 +210,7 @@ let
         inherit homepage;
         description = "Citrix Workspace";
         platforms   = platforms.linux;
+        maintainers = with maintainers; [ ma27 ];
       };
     };
 

pkgs/applications/networking/remote/teamviewer/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   name = "teamviewer-${version}";
-  version = "14.3.4730";
+  version = "14.4.2669";
 
   src = fetchurl {
     url = "https://dl.tvcdn.de/download/linux/version_14x/teamviewer_${version}_amd64.deb";
-    sha256 = "1k3vrkgkdh5wvws7xajgjvsqnmig64gnmf75sy7qq6lrpgp5l3nf";
+    sha256 = "0vk782xpp8plbaz8cfggp0jrw7n8d5p9lv605pzmgxyq5h8z72za";
   };
 
   unpackPhase = ''

pkgs/applications/office/qownnotes/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qownnotes";
-  version = "19.6.1";
+  version = "19.7.3";
 
   src = fetchurl {
     url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
     # Can grab official version like so:
     # $ curl https://download.tuxfamily.org/qownnotes/src/qownnotes-19.1.8.tar.xz.sha256
-    sha256 = "0m56klcs1bq5xhbn2kmlzv8nalscxw6wimrmqjmharif97cyddc6";
+    sha256 = "1d4an3yzr77c6pz5cv1vbsrl2v5r62qdckk3l5y5dcv7jikb1l8l";
   };
 
   nativeBuildInputs = [ qmake qttools ];

pkgs/applications/radio/gnss-sdr/default.nix

@@ -5,7 +5,7 @@
 , glog
 , gmock
 , openssl
-, google-gflags
+, gflags
 , gnuradio
 , orc
 , pkgconfig
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     glog
     gmock
     openssl.dev
-    google-gflags
+    gflags
     gnuradio
     orc
     pkgconfig
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
   enableParallelBuilding = true;
 
   cmakeFlags = [
-    "-DGFlags_ROOT_DIR=${google-gflags}/lib"
+    "-DGFlags_ROOT_DIR=${gflags}/lib"
     "-DGLOG_INCLUDE_DIR=${glog}/include"
     "-DENABLE_UNIT_TESTING=OFF"
 

pkgs/applications/science/biology/est-sfs/default.nix

@@ -0,0 +1,28 @@
+{ stdenv, fetchurl, gsl }:
+
+stdenv.mkDerivation rec {
+  pname = "est-sfs";
+  version = "2.03";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/est-usfs/${pname}-release-${version}.tar.gz";
+    sha256 = "1hvamrgagz0xi89w8qafyd9mjrdpyika8zm22drddnjkp4sdj65n";
+  };
+
+  buildInputs = [ gsl ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/doc/${pname}
+    cp est-sfs $out/bin
+    cp est-sfs-documentation.pdf $out/share/doc/${pname}
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = https://sourceforge.net/projects/est-usfs;
+    description = "Estimate the unfolded site frequency spectrum and ancestral states";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.bzizou ];
+    platforms = platforms.all;
+  };
+}

pkgs/applications/science/logic/cryptoverif/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "cryptoverif-${version}";
-  version = "2.01";
+  version = "2.01pl1";
 
   src = fetchurl {
     url    = "http://prosecco.gforge.inria.fr/personal/bblanche/cryptoverif/cryptoverif${version}.tar.gz";
-    sha256 = "122pryci8rsdzv9qszw11g3izh78r2lvd1raahv2j7qmvgi76nab";
+    sha256 = "1bkmrv3wsy8mwhrxd3z3br9zgv37c2w6443rm4s9jl0aphcgnbiw";
   };
 
   buildInputs = [ ocaml ];

pkgs/applications/science/math/caffe/default.nix

@@ -3,7 +3,7 @@
 , fetchurl
 , cmake
 , boost
-, google-gflags
+, gflags
 , glog
 , hdf5-cpp
 , opencv3
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
       ++ ["-DUSE_LEVELDB=${toggle leveldbSupport}"]
       ++ ["-DUSE_LMDB=${toggle lmdbSupport}"];
 
-  buildInputs = [ boost google-gflags glog protobuf hdf5-cpp opencv3 openblas ]
+  buildInputs = [ boost gflags glog protobuf hdf5-cpp opencv3 openblas ]
                 ++ lib.optional cudaSupport cudatoolkit
                 ++ lib.optional cudnnSupport cudnn
                 ++ lib.optional lmdbSupport lmdb

pkgs/applications/science/math/mathematica/11.nix

@@ -0,0 +1,150 @@
+{ stdenv
+, coreutils
+, patchelf
+, requireFile
+, callPackage
+, alsaLib
+, dbus
+, fontconfig
+, freetype
+, gcc
+, glib
+, ncurses
+, opencv
+, openssl
+, unixODBC
+, xkeyboard_config
+, xorg
+, zlib
+, libxml2
+, libuuid
+, lang ? "en"
+, libGL
+, libGLU
+}:
+
+let
+  l10n =
+    import ./l10ns.nix {
+      lib = stdenv.lib;
+      inherit requireFile lang;
+      majorVersion = "11";
+    };
+in
+stdenv.mkDerivation rec {
+  inherit (l10n) version name src;
+
+  buildInputs = [
+    coreutils
+    patchelf
+    alsaLib
+    coreutils
+    dbus
+    fontconfig
+    freetype
+    gcc.cc
+    gcc.libc
+    glib
+    ncurses
+    opencv
+    openssl
+    unixODBC
+    xkeyboard_config
+    libxml2
+    libuuid
+    zlib
+    libGL
+    libGLU
+  ] ++ (with xorg; [
+    libX11
+    libXext
+    libXtst
+    libXi
+    libXmu
+    libXrender
+    libxcb
+    libXcursor
+    libXfixes
+    libXrandr
+    libICE
+    libSM
+  ]);
+
+  ldpath = stdenv.lib.makeLibraryPath buildInputs
+    + stdenv.lib.optionalString (stdenv.hostPlatform.system == "x86_64-linux")
+      (":" + stdenv.lib.makeSearchPathOutput "lib" "lib64" buildInputs);
+
+  phases = "unpackPhase installPhase fixupPhase";
+
+  unpackPhase = ''
+    echo "=== Extracting makeself archive ==="
+    # find offset from file
+    offset=$(${stdenv.shell} -c "$(grep -axm1 -e 'offset=.*' $src); echo \$offset" $src)
+    dd if="$src" ibs=$offset skip=1 | tar -xf -
+    cd Unix
+  '';
+
+  installPhase = ''
+    cd Installer
+    # don't restrict PATH, that has already been done
+    sed -i -e 's/^PATH=/# PATH=/' MathInstaller
+    sed -i -e 's/\/bin\/bash/\/bin\/sh/' MathInstaller
+
+    echo "=== Running MathInstaller ==="
+    ./MathInstaller -auto -createdir=y -execdir=$out/bin -targetdir=$out/libexec/Mathematica -silent
+
+    # Fix library paths
+    cd $out/libexec/Mathematica/Executables
+    for path in mathematica MathKernel Mathematica WolframKernel wolfram math; do
+      sed -i -e 's#export LD_LIBRARY_PATH$#export LD_LIBRARY_PATH=${zlib}/lib:\''${LD_LIBRARY_PATH}#' $path
+    done
+
+    # Fix xkeyboard config path for Qt
+    for path in mathematica Mathematica; do
+      line=$(grep -n QT_PLUGIN_PATH $path | sed 's/:.*//')
+      sed -i -e "$line iexport QT_XKB_CONFIG_ROOT=\"${xkeyboard_config}/share/X11/xkb\"" $path
+    done
+  '';
+
+  preFixup = ''
+    echo "=== PatchElfing away ==="
+    # This code should be a bit forgiving of errors, unfortunately
+    set +e
+    find $out/libexec/Mathematica/SystemFiles -type f -perm -0100 | while read f; do
+      type=$(readelf -h "$f" 2>/dev/null | grep 'Type:' | sed -e 's/ *Type: *\([A-Z]*\) (.*/\1/')
+      if [ -z "$type" ]; then
+        :
+      elif [ "$type" == "EXEC" ]; then
+        echo "patching $f executable <<"
+        patchelf --shrink-rpath "$f"
+        patchelf \
+	  --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+          --set-rpath "$(patchelf --print-rpath "$f"):${ldpath}" \
+          "$f" \
+          && patchelf --shrink-rpath "$f" \
+          || echo unable to patch ... ignoring 1>&2
+      elif [ "$type" == "DYN" ]; then
+        echo "patching $f library <<"
+        patchelf \
+          --set-rpath "$(patchelf --print-rpath "$f"):${ldpath}" \
+          "$f" \
+          && patchelf --shrink-rpath "$f" \
+          || echo unable to patch ... ignoring 1>&2
+      else
+        echo "not patching $f <<: unknown elf type"
+      fi
+    done
+  '';
+
+  # all binaries are already stripped
+  dontStrip = true;
+
+  # we did this in prefixup already
+  dontPatchELF = true;
+
+  meta = {
+    description = "Wolfram Mathematica computational software system";
+    homepage = http://www.wolfram.com/mathematica/;
+    license = stdenv.lib.licenses.unfree;
+  };
+}

pkgs/applications/science/math/mathematica/default.nix

@@ -1,6 +1,7 @@
 { stdenv
 , coreutils
 , patchelf
+, requireFile
 , callPackage
 , alsaLib
 , dbus
@@ -24,10 +25,10 @@
 
 let
   l10n =
-    with stdenv.lib;
+    import ./l10ns.nix {
-    with callPackage ./l10ns.nix {};
+      lib = stdenv.lib;
-    flip (findFirst (l: l.lang == lang)) l10ns
+      inherit requireFile lang;
-      (throw "Language '${lang}' not supported");
+    };
 in
 stdenv.mkDerivation rec {
   inherit (l10n) version name src;
@@ -72,8 +73,6 @@ stdenv.mkDerivation rec {
     + stdenv.lib.optionalString (stdenv.hostPlatform.system == "x86_64-linux")
       (":" + stdenv.lib.makeSearchPathOutput "lib" "lib64" buildInputs);
 
-  phases = "unpackPhase installPhase fixupPhase";
-
   unpackPhase = ''
     echo "=== Extracting makeself archive ==="
     # find offset from file
@@ -99,8 +98,7 @@ stdenv.mkDerivation rec {
 
     # Fix xkeyboard config path for Qt
     for path in mathematica Mathematica; do
-      line=$(grep -n QT_PLUGIN_PATH $path | sed 's/:.*//')
+      sed -i -e "2iexport QT_XKB_CONFIG_ROOT=\"${xkeyboard_config}/share/X11/xkb\"\n" $path
-      sed -i -e "$line iexport QT_XKB_CONFIG_ROOT=\"${xkeyboard_config}/share/X11/xkb\"" $path
     done
   '';
 
@@ -134,15 +132,19 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  dontBuild = true;
+
   # all binaries are already stripped
   dontStrip = true;
 
   # we did this in prefixup already
   dontPatchELF = true;
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "Wolfram Mathematica computational software system";
     homepage = http://www.wolfram.com/mathematica/;
-    license = stdenv.lib.licenses.unfree;
+    license = licenses.unfree;
+    maintainers = with maintainers; [ herberteuler ];
+    platforms = [ "x86_64-linux" ];
   };
 }

pkgs/applications/science/math/mathematica/l10ns.nix

@@ -1,9 +1,18 @@
-{ lib, requireFile }:
+{ lib
+, requireFile
+, lang
+, majorVersion ? null
+}:
 
-with lib;
+let allVersions = with lib; flip map
-{
+  # N.B. Versions in this list should be ordered from newest to oldest.
-  l10ns = flip map
   [
+    {
+      version = "12.0.0";
+      lang = "en";
+      language = "English";
+      sha256 = "b9fb71e1afcc1d72c200196ffa434512d208fa2920e207878433f504e58ae9d7";
+    }
     {
       version = "11.3.0";
       lang = "en";
@@ -30,4 +39,16 @@ with lib;
       inherit sha256;
     };
   });
-}
+minVersion =
+  with lib;
+  if majorVersion == null
+  then elemAt (builtins.splitVersion (elemAt allVersions 0).version) 0
+  else majorVersion;
+maxVersion = toString (1 + builtins.fromJSON minVersion);
+in
+with lib;
+findFirst (l: (l.lang == lang
+               && l.version >= minVersion
+               && l.version < maxVersion))
+          (throw "Version ${minVersion} in language ${lang} not supported")
+          allVersions

pkgs/applications/science/math/scilab-bin/default.nix

@@ -3,7 +3,7 @@
 let
   name = "scilab-bin-${ver}";
 
-  ver = "6.0.1";
+  ver = "6.0.2";
 
   badArch = throw "${name} requires i686-linux or x86_64-linux";
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
       if stdenv.hostPlatform.system == "i686-linux" then
         "0fgjc2ak3b2qi6yin3fy50qwk2bcj0zbz1h4lyyic9n1n1qcliib"
       else if stdenv.hostPlatform.system == "x86_64-linux" then
-        "1scswlznc14vyzg0gqa1q9gcpwx05kz1sbn563463mzkdp7nd35d"
+        "05clcdgry90drirl3swbxn5q36fmgknnhs6h5pr7mmrzfr6r818w"
       else
         badArch;
   };

pkgs/applications/science/misc/openmvs/default.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, pkgconfig, cmake
 , eigen, opencv, ceres-solver, cgal, boost, vcg
-, gmp, mpfr, glog, google-gflags, libjpeg_turbo }:
+, gmp, mpfr, glog, gflags, libjpeg_turbo }:
 
 stdenv.mkDerivation rec {
   name = "openmvs-unstable-2018-05-26";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "12dgkwwfdp24581y3i41gsd1k9hq0aw917q0ja5s0if4qbmc8pni";
   };
 
-  buildInputs = [ eigen opencv ceres-solver cgal boost vcg gmp mpfr glog google-gflags libjpeg_turbo ];
+  buildInputs = [ eigen opencv ceres-solver cgal boost vcg gmp mpfr glog gflags libjpeg_turbo ];
 
   nativeBuildInputs = [ cmake pkgconfig ];
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
       "-DCERES_DIR=${ceres-solver}/lib/cmake/Ceres/"
     )
   '';
-  
+
   postFixup = ''
     rp=$(patchelf --print-rpath $out/bin/DensifyPointCloud)
     patchelf --set-rpath $rp:$out/lib/OpenMVS $out/bin/DensifyPointCloud
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
     rp=$(patchelf --print-rpath $out/bin/TextureMesh)
     patchelf --set-rpath $rp:$out/lib/OpenMVS $out/bin/TextureMesh
   '';
-  
+
   cmakeDir = "./";
 
   dontUseCmakeBuildDir = true;

pkgs/applications/virtualization/virt-manager/default.nix

@@ -15,12 +15,12 @@ let
 in
 python3Packages.buildPythonApplication rec {
   name = "virt-manager-${version}";
-  version = "2.2.0";
+  version = "2.2.1";
   namePrefix = "";
 
   src = fetchurl {
     url = "http://virt-manager.org/download/sources/virt-manager/${name}.tar.gz";
-    sha256 = "0186c2fjqm3wdr3wik4fcyl5l3gv5j6sxn18d0vclw83w4yrhjz9";
+    sha256 = "06ws0agxlip6p6n3n43knsnjyd91gqhh2dadgc33wl9lx1k8vn6g";
   };
 
   nativeBuildInputs = [

pkgs/applications/virtualization/x11docker/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchFromGitHub, makeWrapper, nx-libs, xorg }:
 stdenv.mkDerivation rec {
   name = "x11docker-${version}";
-  version = "5.4.4";
+  version = "6.0.0";
   src = fetchFromGitHub {
     owner = "mviereck";
     repo = "x11docker";
     rev = "v${version}";
-    sha256 = "1p45dyd1zfjxlawsy190q71hwl083f90ryaslslhxsadsi9m64dq";
+    sha256 = "1sfdxlh50hv8j3dj5bphihqdyf8s7ixm6ckrmvqgr2y3gak1y840";
   };
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ nx-libs xorg.xhost xorg.xinit ];

pkgs/applications/window-managers/compton/default.nix

@@ -1,11 +1,11 @@
-{ stdenv, lib, fetchFromGitHub, pkgconfig, asciidoc, docbook_xml_dtd_45
+{ stdenv, lib, fetchFromGitHub, pkgconfig, uthash, asciidoc, docbook_xml_dtd_45
 , docbook_xsl, libxslt, libxml2, makeWrapper, meson, ninja
 , xorgproto, libxcb ,xcbutilrenderutil, xcbutilimage, pixman, libev
 , dbus, libconfig, libdrm, libGL, pcre, libX11
 , libXinerama, libXext, xwininfo, libxdg_basedir }:
 stdenv.mkDerivation rec {
   pname = "compton";
-  version = "6.2";
+  version = "7";
 
   COMPTON_VERSION = "v${version}";
 
@@ -13,12 +13,14 @@ stdenv.mkDerivation rec {
     owner  = "yshui";
     repo   = "compton";
     rev    = COMPTON_VERSION;
-    sha256 = "03fi9q8zw2qrwpkmy1bnavgfh91ci9in5fdi17g4s5s0n2l7yil7";
+    sha256 = "0f23dv2p1snlpzc91v38q6896ncz4zqzmh2d97yf66j78g21awas";
+    fetchSubmodules = true;
   };
 
   nativeBuildInputs = [
     meson ninja
     pkgconfig
+    uthash
     asciidoc
     docbook_xml_dtd_45
     docbook_xsl
@@ -41,7 +43,7 @@ stdenv.mkDerivation rec {
   ];
 
   preBuild = ''
-    git() { echo "v${version}"; }
+    git() { echo "$COMPTON_VERSION"; }
     export -f git
   '';
 

pkgs/build-support/build-bazel-package/default.nix

@@ -1,4 +1,8 @@
-{ stdenv, bazel, cacert }:
+{ stdenv
+, bazel
+, cacert
+, lib
+}:
 
 args@{ name, bazelFlags ? [], bazelTarget, buildAttrs, fetchAttrs, ... }:
 
@@ -109,6 +113,31 @@ in stdenv.mkDerivation (fBuildAttrs // {
   buildPhase = fBuildAttrs.buildPhase or ''
     runHook preBuild
 
+    '' + lib.optionalString stdenv.isDarwin ''
+    # Bazel sandboxes the execution of the tools it invokes, so even though we are
+    # calling the correct nix wrappers, the values of the environment variables
+    # the wrappers are expecting will not be set. So instead of relying on the
+    # wrappers picking them up, pass them in explicitly via `--copt`, `--linkopt`
+    # and related flags.
+    #
+    copts=()
+    host_copts=()
+    for flag in $NIX_CFLAGS_COMPILE; do
+      copts+=( "--copt=$flag" )
+      host_copts+=( "--host_copt=$flag" )
+    done
+    for flag in $NIX_CXXSTDLIB_COMPILE; do
+      copts+=( "--copt=$flag" )
+      host_copts+=( "--host_copt=$flag" )
+    done
+    linkopts=()
+    host_linkopts=()
+    for flag in $NIX_LD_FLAGS; do
+      linkopts+=( "--linkopt=$flag" )
+      host_linkopts+=( "--host_linkopt=$flag" )
+    done
+    '' + ''
+
     BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
     USER=homeless-shelter \
     bazel \
@@ -116,6 +145,12 @@ in stdenv.mkDerivation (fBuildAttrs // {
       --output_user_root="$bazelUserRoot" \
       build \
       -j $NIX_BUILD_CORES \
+      '' + lib.optionalString stdenv.isDarwin ''
+      "''${copts[@]}" \
+      "''${host_copts[@]}" \
+      "''${linkopts[@]}" \
+      "''${host_linkopts[@]}" \
+      '' + ''
       $bazelFlags \
       $bazelTarget
 

pkgs/data/fonts/google-fonts/default.nix

@@ -2,19 +2,15 @@
 
 stdenv.mkDerivation rec {
   name = "google-fonts-${version}";
-  version = "2018-07-13";
+  version = "2019-07-14";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "fonts";
-    rev = "3ca591dae7372a26e254ec6d22e7b453813b9530";
+    rev = "f113126dc4b9b1473d9354a86129c9d7b837aa1a";
-    sha256 = "01ak3dzw2kihwa0dy27x8vvpiscd66mnkf61vj1xn29m4g48y0lr";
+    sha256 = "0safw5prpa63mqcyfw3gr3a535w4c9hg5ayw5pkppiwil7n3pyxs";
   };
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = "1pzm26794nwdbsvjnczpfchxiqa1n1zhp517g6g39wfm1nfszz83";
-
   phases = [ "unpackPhase" "patchPhase" "installPhase" ];
 
   patchPhase = ''
@@ -29,6 +25,13 @@ stdenv.mkDerivation rec {
       ofl/siamreap \
       ofl/terminaldosislight
 
+    # See comment above, the structure of these is a bit odd
+    # We keep the ofl/<font>/static/ variants
+    rm -rv ofl/comfortaa/*.ttf \
+      ofl/mavenpro/*.ttf \
+      ofl/muli/*.ttf \
+      ofl/oswald/*.ttf
+
     if find . -name "*.ttf" | sed 's|.*/||' | sort | uniq -c | sort -n | grep -v '^.*1 '; then
       echo "error: duplicate font names"
       exit 1

pkgs/desktops/gnome-3/apps/evolution/default.nix

@@ -42,11 +42,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.32.3";
+  version = "3.32.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0ghwi4mmx6l28dkjx7ayiqcrvmfakqfiyvdg6946v5dcimgsclxn";
+    sha256 = "00hmmg4hfns8rq9rcilmy0gi1xkksld27lfbd9zmw2xw37wjmbqh";
   };
 
   nativeBuildInputs = [

pkgs/desktops/gnome-3/apps/ghex/default.nix

@@ -1,30 +1,86 @@
-{ stdenv, fetchurl, pkgconfig, gnome3, intltool, itstool, libxml2, gtk3,
+{ stdenv
-  wrapGAppsHook }:
+, fetchurl
+, fetchpatch
+, pkgconfig
+, meson
+, ninja
+, python3
+, gnome3
+, hicolor-icon-theme
+, desktop-file-utils
+, appstream-glib
+, gettext
+, itstool
+, libxml2
+, gtk3
+, glib
+, atk
+, wrapGAppsHook
+}:
 
 stdenv.mkDerivation rec {
-  name = "ghex-${version}";
+  pname = "ghex";
-  version = "3.18.3";
+  version = "3.18.4";
+
+  outputs = [ "out" "dev" ];
 
   src = fetchurl {
-    url = "mirror://gnome/sources/ghex/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
+    url = "mirror://gnome/sources/ghex/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "c67450f86f9c09c20768f1af36c11a66faf460ea00fbba628a9089a6804808d3";
+    sha256 = "1h1pjrr9wynclfykizqd78dbi785wjz6b63p31k87kjvzy8w3nf2";
   };
 
-  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
+  nativeBuildInputs = [
+    desktop-file-utils
+    gettext
+    hicolor-icon-theme # for setup-hook
+    itstool
+    meson
+    ninja
+    pkgconfig
+    python3
+    wrapGAppsHook
+  ];
 
-  buildInputs = [ gtk3 intltool itstool libxml2 ];
+  buildInputs = [
+    gtk3
+    atk
+    glib
+  ];
+
+  checkInputs = [
+    appstream-glib
+    desktop-file-utils
+  ];
+
+  patches = [
+    # Fixes for darwin. Drop in next release.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/ghex/commit/b0af26666cd990d99076c242b2abb3efc6e98671.patch";
+      sha256 = "1zwdkgr2nqrn9q3ydyvrrpn5x55cdi747fhbq6mh6blp9cbrk9b5";
+    })
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/ghex/commit/cc8ef9e67b23604c402460010dc0b5dccb85391b.patch";
+      sha256 = "0j2165rfhlbrlzhmcnirqd5m89ljpz0n3nz20sxbwlc8h42zv36s";
+    })
+  ];
+
+  postPatch = ''
+     chmod +x meson_post_install.py
+     patchShebangs meson_post_install.py
+  '';
 
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = "ghex";
-      attrPath = "gnome3.ghex";
+      attrPath = "gnome3.${pname}";
     };
   };
 
   meta = with stdenv.lib; {
     homepage = https://wiki.gnome.org/Apps/Ghex;
     description = "Hex editor for GNOME desktop environment";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
+    license = licenses.gpl2Plus;
     maintainers = gnome3.maintainers;
   };
 }

pkgs/desktops/gnome-3/apps/gnome-notes/default.nix

@@ -5,13 +5,13 @@
 , gnome3, libxml2, gsettings-desktop-schemas }:
 
 let
-  version = "3.32.1";
+  version = "3.32.2";
 in stdenv.mkDerivation rec {
   name = "gnome-notes-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/bijiben/${stdenv.lib.versions.majorMinor version}/bijiben-${version}.tar.xz";
-    sha256 = "02b7afg3ps0hxp5dkb4kv6315ydc2r6bxgk1kamwp581lc7ghd67";
+    sha256 = "0chm2fks7cpx3mycxzddpj6v9by203c3m1y6zns5ra43bspwafy2";
   };
 
   doCheck = true;

pkgs/desktops/gnome-3/core/evolution-data-server/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   name = "evolution-data-server-${version}";
-  version = "3.32.3";
+  version = "3.32.4";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1sx2ywvvwbmphrlqq62srd235ihsj8864d9g8kcbcxwrvn2z70b4";
+    sha256 = "0zsc9xwy6ixk3x0dx69ax5isrdw8qxjdxg2i5fr95s40nss7rxl3";
   };
 
   patches = [

pkgs/desktops/gnome-3/core/gnome-user-docs/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   name = "gnome-user-docs-${version}";
-  version = "3.32.2";
+  version = "3.32.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-user-docs/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1ny7cwkyskrykzsrabjnlc9jsdl4kdk73smwxas6ddmca02hpm7c";
+    sha256 = "0dvsl0ldg8rf7yq0r4dv1pn41s7gjgcqp7agkbflkbmhrl6vbhig";
   };
 
   passthru = {

pkgs/desktops/gnome-3/core/grilo-plugins/default.nix

@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation rec {
   pname = "grilo-plugins";
-  version = "0.3.8";
+  version = "0.3.9";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0nync07gah3jkpb5ph5d3gwbygmabnih2m3hfz7lkvjl2l5pgpac";
+    sha256 = "1hv84b56qjic8vz8iz46ikhrxx31l29ilbr8dm5qcghbd8ikw8j1";
   };
 
   nativeBuildInputs = [

pkgs/desktops/gnome-3/core/grilo/default.nix

@@ -1,10 +1,10 @@
 { stdenv, fetchurl, meson, ninja, pkgconfig, gettext, vala, glib, liboauth, gtk3
-, gtk-doc, docbook_xsl, docbook_xml_dtd_43
+, gtk-doc, docbook_xsl, docbook_xml_dtd_43, fetchpatch
 , libxml2, gnome3, gobject-introspection, libsoup, totem-pl-parser }:
 
 let
   pname = "grilo";
-  version = "0.3.7"; # if you change minor, also change ./setup-hook.sh
+  version = "0.3.9"; # if you change minor, also change ./setup-hook.sh
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
@@ -13,23 +13,32 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1dz965l743r4bhj78wij9k1mb6635gnkb1lnk9j7gw9dd5qsyfza";
+    sha256 = "1wnabc69730jsv8dljj5ik8g7p581nw60mw1mkgamkzjcb6821bk";
   };
 
-  patches = [
-    # Fix meson build: https://gitlab.gnome.org/GNOME/grilo/merge_requests/34
-    (fetchurl {
-      url = "https://gitlab.gnome.org/GNOME/grilo/commit/166612aeff09e5fc2fec1f62185c84cbdcf8f889.diff";
-      sha256 = "07zamy927iaa7knrwq5yxz7ypl1i02pymkcdrg5l55alhdvb81pw";
-    })
-  ];
-
   setupHook = ./setup-hook.sh;
 
   mesonFlags = [
     "-Dgtk_doc=true"
   ];
 
+  patches = [
+    # https://gitlab.gnome.org/GNOME/grilo/merge_requests/45
+    # commits are from a separate branch so they shouldn't 404
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/worldofpeace/grilo/commit/f6993c2a8a6c1a6246372569f9f7a9179955c95e.patch";
+      sha256 = "1x4s0ahs60dqyphgv2dy3x2sjnxv5ydd55kdlcjsys5870ijwbi8";
+    })
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/worldofpeace/grilo/commit/61bca28b141162a33eb2fb575ef1daf0f21c7741.patch";
+      sha256 = "1147xbmaq61myfwxz0pagdv056krfmh1s78qjbiy5k7k203qrjz0";
+    })
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/worldofpeace/grilo/commit/363b198a062eeb8aaa5489ea9720e69d428e885c.patch";
+      sha256 = "01w1bfzdbnxy5l37b2z7a9h2mrxziqkzdw02dybjphy85nb0hz5w";
+    })
+  ];
+
   nativeBuildInputs = [
     meson ninja pkgconfig gettext gobject-introspection vala
     gtk-doc docbook_xsl docbook_xml_dtd_43

pkgs/desktops/gnome-3/misc/nautilus-python/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nautilus-python";
-  version = "1.2.2";
+  version = "1.2.3";
 
   outputs = [ "out" "dev" "doc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "04pib6fan6cq8x0fhf5gll2f5d2dh5pxrhj79qhi5l1yc7ys7kch";
+    sha256 = "161050sx3sdxqcpjkjcpf6wl4kx0jydihga7mcvrj9c2f8ly0g07";
   };
 
   nativeBuildInputs = [