Merge master into staging-next

lib/modules.nix

@@ -613,7 +613,6 @@ rec {
         if tp.name == "option set" || tp.name == "submodule" then
           throw "The option ${showOption loc} uses submodules without a wrapping type, in ${showFiles opt.declarations}."
         else if optionSetIn "attrsOf" then types.attrsOf (types.submodule options)
-        else if optionSetIn "loaOf"   then types.loaOf   (types.submodule options)
         else if optionSetIn "listOf"  then types.listOf  (types.submodule options)
         else if optionSetIn "nullOr"  then types.nullOr  (types.submodule options)
         else tp;

lib/types.nix

@@ -252,8 +252,8 @@ rec {
       merge = mergeEqualOption;
     };
 
-    # drop this in the future:
+    # TODO: drop this in the future:
-    list = builtins.trace "`types.list` is deprecated; use `types.listOf` instead" types.listOf;
+    list = builtins.trace "`types.list` has been removed; please use `types.listOf` instead" types.listOf;
 
     listOf = elemType: mkOptionType rec {
       name = "listOf";
@@ -326,110 +326,15 @@ rec {
       functor = (defaultFunctor name) // { wrapped = elemType; };
     };
 
-    # List or attribute set of ...
+    # TODO: drop this in the future:
-    loaOf = elemType:
+    loaOf =
-      let
+      let msg =
-        convertAllLists = loc: defs:
+        ''
-          let
+          `types.loaOf` has been removed and mixing lists with attribute values
-            padWidth = stringLength (toString (length defs));
+          is no longer possible; please use `types.attrsOf` instead.
-            unnamedPrefix = i: "unnamed-" + fixedWidthNumber padWidth i + ".";
+          See https://github.com/NixOS/nixpkgs/issues/1800 for the motivation.
-          in
-            imap1 (i: convertIfList loc (unnamedPrefix i)) defs;
-        convertIfList = loc: unnamedPrefix: def:
-          if isList def.value then
-            let
-              padWidth = stringLength (toString (length def.value));
-              unnamed = i: unnamedPrefix + fixedWidthNumber padWidth i;
-              anyString = placeholder "name";
-              nameAttrs = [
-                { path = [ "environment" "etc" ];
-                  name = "target";
-                }
-                { path = [ "containers" anyString "bindMounts" ];
-                  name = "mountPoint";
-                }
-                { path = [ "programs" "ssh" "knownHosts" ];
-                  # hostNames is actually a list so we would need to handle it only when singleton
-                  name = "hostNames";
-                }
-                { path = [ "fileSystems" ];
-                  name = "mountPoint";
-                }
-                { path = [ "boot" "specialFileSystems" ];
-                  name = "mountPoint";
-                }
-                { path = [ "services" "znapzend" "zetup" ];
-                  name = "dataset";
-                }
-                { path = [ "services" "znapzend" "zetup" anyString "destinations" ];
-                  name = "label";
-                }
-                { path = [ "services" "geoclue2" "appConfig" ];
-                  name = "desktopID";
-                }
-              ];
-              matched = let
-                equals = a: b: b == anyString || a == b;
-                fallback = { name = "name"; };
-              in findFirst ({ path, ... }: all (v: v == true) (zipListsWith equals loc path)) fallback nameAttrs;
-              nameAttr = matched.name;
-              nameValueOld = value:
-                if isList value then
-                  if length value > 0 then
-                    "[ " + concatMapStringsSep " " escapeNixString value + " ]"
-                  else
-                    "[ ]"
-                else
-                  escapeNixString value;
-              nameValueNew = value: unnamed:
-                if isList value then
-                  if length value > 0 then
-                    head value
-                  else
-                    unnamed
-                else
-                  value;
-              res =
-                { inherit (def) file;
-                  value = listToAttrs (
-                    imap1 (elemIdx: elem:
-                      { name  = nameValueNew (elem.${nameAttr} or (unnamed elemIdx)) (unnamed elemIdx);
-                        value = elem;
-                      }) def.value);
-                };
-              option = concatStringsSep "." loc;
-              sample = take 3 def.value;
-              more = lib.optionalString (length def.value > 3) "... ";
-              list = concatMapStrings (x: ''{ ${nameAttr} = ${nameValueOld (x.${nameAttr} or "unnamed")}; ...} '') sample;
-              set = concatMapStrings (x: ''${nameValueNew (x.${nameAttr} or "unnamed") "unnamed"} = {...}; '') sample;
-              msg = ''
-                In file ${def.file}
-                a list is being assigned to the option config.${option}.
-                This will soon be an error as type loaOf is deprecated.
-                See https://github.com/NixOS/nixpkgs/pull/63103 for more information.
-                Do
-                  ${option} =
-                    { ${set}${more}}
-                instead of
-                  ${option} =
-                    [ ${list}${more}]
         '';
-            in
+      in builtins.trace msg types.attrsOf;
-              lib.warn msg res
-          else
-            def;
-        attrOnly = attrsOf elemType;
-      in mkOptionType rec {
-        name = "loaOf";
-        description = "list or attribute set of ${elemType.description}s";
-        check = x: isList x || isAttrs x;
-        merge = loc: defs: attrOnly.merge loc (convertAllLists loc defs);
-        emptyValue = { value = {}; };
-        getSubOptions = prefix: elemType.getSubOptions (prefix ++ ["<name?>"]);
-        getSubModules = elemType.getSubModules;
-        substSubModules = m: loaOf (elemType.substSubModules m);
-        functor = (defaultFunctor name) // { wrapped = elemType; };
-      };
 
     # Value of given type but with no merging (i.e. `uniq list`s are not concatenated).
     uniq = elemType: mkOptionType rec {

maintainers/maintainer-list.nix

@@ -7181,6 +7181,16 @@
     githubId = 3621083;
     name = "Roosembert (Roosemberth) Palacios";
   };
+  rople380 = {
+    name = "rople380";
+    email = "55679162+rople380@users.noreply.github.com";
+    github = "rople380";
+    githubId = 55679162;
+    keys = [{
+      longkeyid = "rsa2048/0x8526B7574A536236";
+      fingerprint = "1401 1B63 393D 16C1 AA9C  C521 8526 B757 4A53 6236";
+    }];
+  };
   royneary = {
     email = "christian@ulrich.earth";
     github = "royneary";

nixos/doc/manual/administration/boot-problems.xml

@@ -58,9 +58,9 @@
       Like <literal>boot.debug1</literal> or
       <literal>boot.debug1devices</literal>, but runs stage1 until all
       filesystems that are mounted during initrd are mounted (see
-      <option><link linkend="opt-fileSystems._name__.neededForBoot">neededForBoot</link></option>
+      <option><link linkend="opt-fileSystems._name_.neededForBoot">neededForBoot</link></option>
       ). As a motivating example, this could be useful if you've forgotten to set
-      <option><link linkend="opt-fileSystems._name__.neededForBoot">neededForBoot</link></option>
+      <option><link linkend="opt-fileSystems._name_.neededForBoot">neededForBoot</link></option>
       on a file system.
      </para>
     </listitem>

nixos/doc/manual/administration/imperative-containers.xml

@@ -27,7 +27,7 @@
 <screen>
 # nixos-container create foo --config '
   <xref linkend="opt-services.openssh.enable"/> = true;
-  <link linkend="opt-users.users._name__.openssh.authorizedKeys.keys">users.users.root.openssh.authorizedKeys.keys</link> = ["ssh-dss AAAAB3N…"];
+  <link linkend="opt-users.users._name_.openssh.authorizedKeys.keys">users.users.root.openssh.authorizedKeys.keys</link> = ["ssh-dss AAAAB3N…"];
 '
 </screen>
   By default the next free address in the <literal>10.233.0.0/16</literal> subnet will be chosen

nixos/doc/manual/configuration/file-systems.xml

@@ -23,12 +23,12 @@
   <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd-fstab-generator.html">systemd-fstab-generator</link>.
   The filesystem will be mounted automatically unless
   <literal>"noauto"</literal> is present in <link
-  linkend="opt-fileSystems._name__.options">options</link>.
+  linkend="opt-fileSystems._name_.options">options</link>.
   <literal>"noauto"</literal> filesystems can be mounted explicitly using
   <command>systemctl</command> e.g. <command>systemctl start
   data.mount</command>.
   Mount points are created automatically if they don’t already exist. For
-  <option><link linkend="opt-fileSystems._name__.device">device</link></option>,
+  <option><link linkend="opt-fileSystems._name_.device">device</link></option>,
   it’s best to use the topology-independent device aliases in
   <filename>/dev/disk/by-label</filename> and
   <filename>/dev/disk/by-uuid</filename>, as these don’t change if the
@@ -36,7 +36,7 @@
  </para>
  <para>
   You can usually omit the file system type
-  (<option><link linkend="opt-fileSystems._name__.fsType">fsType</link></option>),
+  (<option><link linkend="opt-fileSystems._name_.fsType">fsType</link></option>),
   since <command>mount</command> can usually detect the type and load the
   necessary kernel module automatically. However, if the file system is needed
   at early boot (in the initial ramdisk) and is not <literal>ext2</literal>,
@@ -49,7 +49,7 @@
    System startup will fail if any of the filesystems fails to mount, dropping
    you to the emergency shell. You can make a mount asynchronous and
    non-critical by adding
-   <literal><link linkend="opt-fileSystems._name__.options">options</link> = [
+   <literal><link linkend="opt-fileSystems._name_.options">options</link> = [
    "nofail" ];</literal>.
   </para>
  </note>

nixos/doc/manual/configuration/ipv4-config.xml

@@ -10,7 +10,7 @@
   automatically configure network interfaces. However, you can configure an
   interface manually as follows:
 <programlisting>
-<link linkend="opt-networking.interfaces._name__.ipv4.addresses">networking.interfaces.eth0.ipv4.addresses</link> = [ {
+<link linkend="opt-networking.interfaces._name_.ipv4.addresses">networking.interfaces.eth0.ipv4.addresses</link> = [ {
   address = "192.168.1.2";
   prefixLength = 24;
 } ];

nixos/doc/manual/configuration/ipv6-config.xml

@@ -26,7 +26,7 @@
   As with IPv4 networking interfaces are automatically configured via DHCPv6.
   You can configure an interface manually:
 <programlisting>
-<link linkend="opt-networking.interfaces._name__.ipv6.addresses">networking.interfaces.eth0.ipv6.addresses</link> = [ {
+<link linkend="opt-networking.interfaces._name_.ipv6.addresses">networking.interfaces.eth0.ipv6.addresses</link> = [ {
   address = "fe00:aa:bb:cc::2";
   prefixLength = 64;
 } ];

nixos/doc/manual/configuration/luks-file-systems.xml

@@ -30,7 +30,7 @@ Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: ***
   <filename>/</filename>, add the following to
   <filename>configuration.nix</filename>:
 <programlisting>
-<link linkend="opt-boot.initrd.luks.devices._name__.device">boot.initrd.luks.devices.crypted.device</link> = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d";
+<link linkend="opt-boot.initrd.luks.devices._name_.device">boot.initrd.luks.devices.crypted.device</link> = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d";
 <xref linkend="opt-fileSystems"/>."/".device = "/dev/mapper/crypted";
 </programlisting>
   Should grub be used as bootloader, and <filename>/boot</filename> is located
@@ -60,13 +60,13 @@ Added to key to device /dev/sda2, slot: 2
   To ensure that this file system is decrypted using the FIDO2 compatible key, add the following to <filename>configuration.nix</filename>:
 <programlisting>
 <link linkend="opt-boot.initrd.luks.fido2Support">boot.initrd.luks.fido2Support</link> = true;
-<link linkend="opt-boot.initrd.luks.devices._name__.fido2.credential">boot.initrd.luks.devices."/dev/sda2".fido2.credential</link> = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7";
+<link linkend="opt-boot.initrd.luks.devices._name_.fido2.credential">boot.initrd.luks.devices."/dev/sda2".fido2.credential</link> = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7";
 </programlisting>
 
   You can also use the FIDO2 passwordless setup, but for security reasons, you might want to enable it only when your device is PIN protected, such as <link xlink:href="https://trezor.io/">Trezor</link>.
 
 <programlisting>
-<link linkend="opt-boot.initrd.luks.devices._name__.fido2.passwordLess">boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess</link> = true;
+<link linkend="opt-boot.initrd.luks.devices._name_.fido2.passwordLess">boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess</link> = true;
 </programlisting>
   </para>
  </section>

nixos/doc/manual/configuration/network-manager.xml

@@ -19,7 +19,7 @@
   All users that should have permission to change network settings must belong
   to the <code>networkmanager</code> group:
 <programlisting>
-<link linkend="opt-users.users._name__.extraGroups">users.users.alice.extraGroups</link> = [ "networkmanager" ];
+<link linkend="opt-users.users._name_.extraGroups">users.users.alice.extraGroups</link> = [ "networkmanager" ];
 </programlisting>
  </para>
 

nixos/doc/manual/configuration/ssh.xml

@@ -20,7 +20,7 @@
   follows:
 <!-- FIXME: this might not work if the user is unmanaged. -->
 <programlisting>
-<link linkend="opt-users.users._name__.openssh.authorizedKeys.keys">users.users.alice.openssh.authorizedKeys.keys</link> =
+<link linkend="opt-users.users._name_.openssh.authorizedKeys.keys">users.users.alice.openssh.authorizedKeys.keys</link> =
   [ "ssh-dss AAAAB3NzaC1kc3MAAACBAPIkGWVEt4..." ];
 </programlisting>
  </para>

nixos/doc/manual/configuration/user-mgmt.xml

@@ -11,11 +11,11 @@
   that a user account named <literal>alice</literal> shall exist:
 <programlisting>
 <xref linkend="opt-users.users"/>.alice = {
-  <link linkend="opt-users.users._name__.isNormalUser">isNormalUser</link> = true;
+  <link linkend="opt-users.users._name_.isNormalUser">isNormalUser</link> = true;
-  <link linkend="opt-users.users._name__.home">home</link> = "/home/alice";
+  <link linkend="opt-users.users._name_.home">home</link> = "/home/alice";
-  <link linkend="opt-users.users._name__.description">description</link> = "Alice Foobar";
+  <link linkend="opt-users.users._name_.description">description</link> = "Alice Foobar";
-  <link linkend="opt-users.users._name__.extraGroups">extraGroups</link> = [ "wheel" "networkmanager" ];
+  <link linkend="opt-users.users._name_.extraGroups">extraGroups</link> = [ "wheel" "networkmanager" ];
-  <link linkend="opt-users.users._name__.openssh.authorizedKeys.keys">openssh.authorizedKeys.keys</link> = [ "ssh-dss AAAAB3Nza... alice@foobar" ];
+  <link linkend="opt-users.users._name_.openssh.authorizedKeys.keys">openssh.authorizedKeys.keys</link> = [ "ssh-dss AAAAB3Nza... alice@foobar" ];
 };
 </programlisting>
   Note that <literal>alice</literal> is a member of the
@@ -36,7 +36,7 @@
   account will cease to exist. Also, imperative commands for managing users and
   groups, such as useradd, are no longer available. Passwords may still be
   assigned by setting the user's
-  <link linkend="opt-users.users._name__.hashedPassword">hashedPassword</link>
+  <link linkend="opt-users.users._name_.hashedPassword">hashedPassword</link>
   option. A hashed password can be generated using <command>mkpasswd -m
   sha-512</command> after installing the <literal>mkpasswd</literal> package.
  </para>

nixos/doc/manual/development/option-types.xml

@@ -385,17 +385,6 @@
      </para>
     </listitem>
    </varlistentry>
-   <varlistentry>
-    <term>
-     <varname>types.loaOf</varname> <replaceable>t</replaceable>
-    </term>
-    <listitem>
-     <para>
-      An attribute set or a list of <replaceable>t</replaceable> type. Multiple
-      definitions are merged according to the value.
-     </para>
-    </listitem>
-   </varlistentry>
    <varlistentry>
     <term>
      <varname>types.nullOr</varname> <replaceable>t</replaceable>

nixos/doc/manual/installation/changing-config.xml

@@ -78,7 +78,7 @@
   <literal>mutableUsers = false</literal>. Another way is to temporarily add
   the following to your configuration:
 <screen>
-<link linkend="opt-users.users._name__.initialHashedPassword">users.users.your-user.initialHashedPassword</link> = "test";
+<link linkend="opt-users.users._name_.initialHashedPassword">users.users.your-user.initialHashedPassword</link> = "test";
 </screen>
   <emphasis>Important:</emphasis> delete the $hostname.qcow2 file if you have
   started the virtual machine at least once without the right users, otherwise

nixos/doc/manual/installation/installing-from-other-distro.xml

@@ -211,7 +211,7 @@ nixpkgs https://nixos.org/channels/nixpkgs-unstable</screen>
     use <literal>sudo</literal>)
    </para>
 <programlisting>
-<link linkend="opt-users.users._name__.initialHashedPassword">users.users.root.initialHashedPassword</link> = "";
+<link linkend="opt-users.users._name_.initialHashedPassword">users.users.root.initialHashedPassword</link> = "";
 </programlisting>
   </listitem>
   <listitem>

nixos/doc/manual/installation/installing.xml

@@ -550,7 +550,7 @@ Retype new UNIX password: ***</screen>
   # Note: setting fileSystems is generally not
   # necessary, since nixos-generate-config figures them out
   # automatically in hardware-configuration.nix.
-  #<link linkend="opt-fileSystems._name__.device">fileSystems."/".device</link> = "/dev/disk/by-label/nixos";
+  #<link linkend="opt-fileSystems._name_.device">fileSystems."/".device</link> = "/dev/disk/by-label/nixos";
 
   # Enable the OpenSSH server.
   services.sshd.enable = true;

nixos/doc/manual/release-notes/rl-2003.xml

@@ -796,7 +796,7 @@ users.users.me =
      or any other display manager in NixOS as they all support auto-login. If you used this module specifically
      because it permitted root auto-login you can override the lightdm-autologin pam module like:
 <programlisting>
-<link xlink:href="#opt-security.pam.services._name__.text">security.pam.services.lightdm-autologin.text</link> = lib.mkForce ''
+<link xlink:href="#opt-security.pam.services._name_.text">security.pam.services.lightdm-autologin.text</link> = lib.mkForce ''
     auth     requisite pam_nologin.so
     auth     required  pam_succeed_if.so quiet
     auth     required  pam_permit.so

nixos/doc/manual/release-notes/rl-2009.xml

@@ -767,6 +767,16 @@ CREATE ROLE postgres LOGIN SUPERUSER;
      See <link xlink:href="https://github.com/NixOS/nixpkgs/pull/82743#issuecomment-674520472">the PR that changed this</link> for more info.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     For NixOS configuration options, the type <literal>loaOf</literal>, after
+     its initial deprecation in release 20.03, has been removed. In NixOS and
+     Nixpkgs options using this type have been converted to <literal>attrsOf</literal>.
+     For more information on this change have look at these links:
+     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/1800">issue #1800</link>,
+     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/63103">PR #63103</link>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 

nixos/lib/make-options-doc/options-to-docbook.xsl

@@ -20,7 +20,7 @@
       <title>Configuration Options</title>
       <variablelist xml:id="configuration-variable-list">
         <xsl:for-each select="attrs">
-          <xsl:variable name="id" select="concat('opt-', str:replace(str:replace(str:replace(str:replace(attr[@name = 'name']/string/@value, '*', '_'), '&lt;', '_'), '>', '_'), '?', '_'))" />
+          <xsl:variable name="id" select="concat('opt-', str:replace(str:replace(str:replace(attr[@name = 'name']/string/@value, '*', '_'), '&lt;', '_'), '>', '_'))" />
           <varlistentry>
             <term xlink:href="#{$id}">
               <xsl:attribute name="xml:id"><xsl:value-of select="$id"/></xsl:attribute>

nixos/modules/config/krb5/default.nix

@@ -41,31 +41,30 @@ let
         value)
     else value;
 
-  mkIndent = depth: concatStrings (builtins.genList (_:  " ") (2 * depth));
+  indent = "  ";
 
-  mkRelation = name: value: "${name} = ${mkVal { inherit value; }}";
+  mkRelation = name: value:
+    if (isList value) then
+      concatMapStringsSep "\n" (mkRelation name) value
+    else "${name} = ${mkVal value}";
 
-  mkVal = { value, depth ? 0 }:
+  mkVal = value:
     if (value == true) then "true"
     else if (value == false) then "false"
     else if (isInt value) then (toString value)
-    else if (isList value) then
-      concatMapStringsSep " " mkVal { inherit value depth; }
     else if (isAttrs value) then
-      (concatStringsSep "\n${mkIndent (depth + 1)}"
+      let configLines = concatLists
-        ([ "{" ] ++ (mapAttrsToList
+        (map (splitString "\n")
-          (attrName: attrValue: let
+          (mapAttrsToList mkRelation value));
-            mappedAttrValue = mkVal {
+      in
-              value = attrValue;
+      (concatStringsSep "\n${indent}"
-              depth = depth + 1;
+        ([ "{" ] ++ configLines))
-            };
+      + "\n}"
-          in "${attrName} = ${mappedAttrValue}")
-        value))) + "\n${mkIndent depth}}"
     else value;
 
   mkMappedAttrsOrString = value: concatMapStringsSep "\n"
     (line: if builtins.stringLength line > 0
-      then "${mkIndent 1}${line}"
+      then "${indent}${line}"
       else line)
     (splitString "\n"
       (if isAttrs value then
@@ -114,7 +113,10 @@ in {
           {
             "ATHENA.MIT.EDU" = {
               admin_server = "athena.mit.edu";
-              kdc = "athena.mit.edu";
+              kdc = [
+                "athena01.mit.edu"
+                "athena02.mit.edu"
+              ];
             };
           };
         '';

nixos/modules/config/users-groups.nix

@@ -463,7 +463,7 @@ in {
 
     users.users = mkOption {
       default = {};
-      type = with types; loaOf (submodule userOpts);
+      type = with types; attrsOf (submodule userOpts);
       example = {
         alice = {
           uid = 1234;
@@ -487,7 +487,7 @@ in {
         { students.gid = 1001;
           hackers = { };
         };
-      type = with types; loaOf (submodule groupOpts);
+      type = with types; attrsOf (submodule groupOpts);
       description = ''
         Additional groups to be created automatically by the system.
       '';

nixos/modules/installer/cd-dvd/sd-image-raspberrypi4.nix

@@ -27,7 +27,7 @@
   };
 
   fileSystems."/boot/firmware" = {
-    # This effectively "renames" the loaOf entry set in sd-image.nix
+    # This effectively "renames" the attrsOf entry set in sd-image.nix
     mountPoint = "/boot";
     neededForBoot = true;
   };

nixos/modules/installer/tools/nixos-option/nixos-option.cc

@@ -224,7 +224,7 @@ bool optionTypeIs(Context & ctx, Value & v, const std::string & soughtType)
 
 bool isAggregateOptionType(Context & ctx, Value & v)
 {
-    return optionTypeIs(ctx, v, "attrsOf") || optionTypeIs(ctx, v, "listOf") || optionTypeIs(ctx, v, "loaOf");
+    return optionTypeIs(ctx, v, "attrsOf") || optionTypeIs(ctx, v, "listOf");
 }
 
 MakeError(OptionPathError, EvalError);

nixos/modules/module-list.nix

@@ -587,6 +587,7 @@
   ./services/networking/atftpd.nix
   ./services/networking/avahi-daemon.nix
   ./services/networking/babeld.nix
+  ./services/networking/biboumi.nix
   ./services/networking/bind.nix
   ./services/networking/bitcoind.nix
   ./services/networking/autossh.nix

nixos/modules/programs/environment.nix

@@ -33,7 +33,6 @@ in
       { PATH = [ "/bin" ];
         INFOPATH = [ "/info" "/share/info" ];
         KDEDIRS = [ "" ];
-        STRIGI_PLUGIN_PATH = [ "/lib/strigi/" ];
         QT_PLUGIN_PATH = [ "/lib/qt4/plugins" "/lib/kde4/plugins" ];
         QTWEBKIT_PLUGIN_PATH = [ "/lib/mozilla/plugins/" ];
         GTK_PATH = [ "/lib/gtk-2.0" "/lib/gtk-3.0" ];

nixos/modules/programs/gpaste.nix

@@ -30,5 +30,7 @@ with lib;
     environment.systemPackages = [ pkgs.gnome3.gpaste ];
     services.dbus.packages = [ pkgs.gnome3.gpaste ];
     systemd.packages = [ pkgs.gnome3.gpaste ];
+    # gnome-control-center crashes in Keyboard Shortcuts pane without the GSettings schemas.
+    services.xserver.desktopManager.gnome3.sessionPath = [ pkgs.gnome3.gpaste ];
   };
 }

nixos/modules/programs/ssh.nix

@@ -131,7 +131,7 @@ in
 
       knownHosts = mkOption {
         default = {};
-        type = types.loaOf (types.submodule ({ name, ... }: {
+        type = types.attrsOf (types.submodule ({ name, ... }: {
           options = {
             certAuthority = mkOption {
               type = types.bool;

nixos/modules/programs/tsm-client.nix

@@ -7,7 +7,7 @@ let
   inherit (lib.modules) mkDefault mkIf;
   inherit (lib.options) literalExample mkEnableOption mkOption;
   inherit (lib.strings) concatStringsSep optionalString toLower;
-  inherit (lib.types) addCheck attrsOf lines loaOf nullOr package path port str strMatching submodule;
+  inherit (lib.types) addCheck attrsOf lines nullOr package path port str strMatching submodule;
 
   # Checks if given list of strings contains unique
   # elements when compared without considering case.
@@ -178,7 +178,7 @@ let
       client system-options file "dsm.sys"
     '';
     servers = mkOption {
-      type = loaOf (submodule [ serverOptions ]);
+      type = attrsOf (submodule [ serverOptions ]);
       default = {};
       example.mainTsmServer = {
         server = "tsmserver.company.com";

nixos/modules/programs/zsh/oh-my-zsh.xml

@@ -73,7 +73,7 @@
 <programlisting>
 { pkgs, ... }:
 {
-  programs.zsh.ohMyZsh.customPkgs = with pkgs; [
+  programs.zsh.ohMyZsh.customPkgs = [
     pkgs.nix-zsh-completions
     # and even more...
   ];

nixos/modules/security/pam.nix

@@ -544,7 +544,7 @@ in
 
     security.pam.services = mkOption {
       default = [];
-      type = with types; loaOf (submodule pamOpts);
+      type = with types; attrsOf (submodule pamOpts);
       description =
         ''
           This option defines the PAM services.  A service typically

nixos/modules/services/backup/znapzend.nix

@@ -220,7 +220,7 @@ let
       };
 
       destinations = mkOption {
-        type = loaOf (destType config);
+        type = attrsOf (destType config);
         description = "Additional destinations.";
         default = {};
         example = literalExample ''
@@ -328,7 +328,7 @@ in
       };
 
       zetup = mkOption {
-        type = loaOf srcType;
+        type = attrsOf srcType;
         description = "Znapzend configuration.";
         default = {};
         example = literalExample ''

nixos/modules/services/desktops/geoclue2.nix

@@ -160,7 +160,7 @@ in
       };
 
       appConfig = mkOption {
-        type = types.loaOf appConfigModule;
+        type = types.attrsOf appConfigModule;
         default = {};
         example = literalExample ''
           "com.github.app" = {

nixos/modules/services/hardware/sane_extra_backends/brscan4.nix

@@ -81,7 +81,7 @@ in
         { office1 = { model = "MFC-7860DW"; ip = "192.168.1.2"; };
           office2 = { model = "MFC-7860DW"; nodename = "BRW0080927AFBCE"; };
         };
-      type = with types; loaOf (submodule netDeviceOpts);
+      type = with types; attrsOf (submodule netDeviceOpts);
       description = ''
         The list of network devices that will be registered against the brscan4
         sane backend.

nixos/modules/services/networking/biboumi.nix

@@ -0,0 +1,269 @@
+{ config, lib, pkgs, options, ... }:
+with lib;
+let
+  cfg = config.services.biboumi;
+  inherit (config.environment) etc;
+  rootDir = "/run/biboumi/mnt-root";
+  stateDir = "/var/lib/biboumi";
+  settingsFile = pkgs.writeText "biboumi.cfg" (
+    generators.toKeyValue {
+      mkKeyValue = k: v:
+        if v == null then ""
+        else generators.mkKeyValueDefault {} "=" k v;
+    } cfg.settings);
+  need_CAP_NET_BIND_SERVICE = cfg.settings.identd_port != 0 && cfg.settings.identd_port < 1024;
+in
+{
+  options = {
+    services.biboumi = {
+      enable = mkEnableOption "the Biboumi XMPP gateway to IRC";
+
+      settings = mkOption {
+        description = ''
+          See <link xlink:href="https://lab.louiz.org/louiz/biboumi/blob/8.5/doc/biboumi.1.rst">biboumi 8.5</link>
+          for documentation.
+        '';
+        default = {};
+        type = types.submodule {
+          freeformType = with types;
+            (attrsOf (nullOr (oneOf [str int bool]))) // {
+              description = "settings option";
+            };
+          options.admin = mkOption {
+            type = with types; listOf str;
+            default = [];
+            example = ["admin@example.org"];
+            apply = concatStringsSep ":";
+            description = ''
+              The bare JID of the gateway administrator. This JID will have more
+              privileges than other standard users, for example some administration
+              ad-hoc commands will only be available to that JID.
+            '';
+          };
+          options.ca_file = mkOption {
+            type = types.path;
+            default = "/etc/ssl/certs/ca-certificates.crt";
+            description = ''
+              Specifies which file should be used as the list of trusted CA
+              when negociating a TLS session.
+            '';
+          };
+          options.db_name = mkOption {
+            type = with types; either path str;
+            default = "${stateDir}/biboumi.sqlite";
+            description = ''
+              The name of the database to use.
+            '';
+            example = "postgresql://user:secret@localhost";
+          };
+          options.hostname = mkOption {
+            type = types.str;
+            example = "biboumi.example.org";
+            description = ''
+              The hostname served by the XMPP gateway.
+              This domain must be configured in the XMPP server
+              as an external component.
+            '';
+          };
+          options.identd_port = mkOption {
+            type = types.port;
+            default = 113;
+            example = 0;
+            description = ''
+              The TCP port on which to listen for identd queries.
+            '';
+          };
+          options.log_level = mkOption {
+            type = types.ints.between 0 3;
+            default = 1;
+            description = ''
+              Indicate what type of log messages to write in the logs.
+              0 is debug, 1 is info, 2 is warning, 3 is error.
+            '';
+          };
+          options.password = mkOption {
+            type = with types; nullOr str;
+            description = ''
+              The password used to authenticate the XMPP component to your XMPP server.
+              This password must be configured in the XMPP server,
+              associated with the external component on
+              <link linkend="opt-services.biboumi.settings.hostname">hostname</link>.
+
+              Set it to null and use <link linkend="opt-services.biboumi.credentialsFile">credentialsFile</link>
+              if you do not want this password to go into the Nix store.
+            '';
+          };
+          options.persistent_by_default = mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Whether all rooms will be persistent by default:
+              the value of the “persistent” option in the global configuration of each
+              user will be “true”, but the value of each individual room will still
+              default to false. This means that a user just needs to change the global
+              “persistent” configuration option to false in order to override this.
+            '';
+          };
+          options.policy_directory = mkOption {
+            type = types.path;
+            default = "${pkgs.biboumi}/etc/biboumi";
+            description = ''
+              A directory that should contain the policy files,
+              used to customize Botan’s behaviour
+              when negociating the TLS connections with the IRC servers.
+            '';
+          };
+          options.port = mkOption {
+            type = types.port;
+            default = 5347;
+            description = ''
+              The TCP port to use to connect to the local XMPP component.
+            '';
+          };
+          options.realname_customization = mkOption {
+            type = types.bool;
+            default = true;
+            description = ''
+              Whether the users will be able to use
+              the ad-hoc commands that lets them configure
+              their realname and username.
+            '';
+          };
+          options.realname_from_jid = mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Whether the realname and username of each biboumi
+              user will be extracted from their JID.
+              Otherwise they will be set to the nick
+              they used to connect to the IRC server.
+            '';
+          };
+          options.xmpp_server_ip = mkOption {
+            type = types.str;
+            default = "127.0.0.1";
+            description = ''
+              The IP address to connect to the XMPP server on.
+              The connection to the XMPP server is unencrypted,
+              so the biboumi instance and the server should
+              normally be on the same host.
+            '';
+          };
+        };
+      };
+
+      credentialsFile = mkOption {
+        type = types.path;
+        description = ''
+          Path to a configuration file to be merged with the settings.
+          Beware not to surround "=" with spaces when setting biboumi's options in this file.
+          Useful to merge a file which is better kept out of the Nix store
+          because it contains sensible data like
+          <link linkend="opt-services.biboumi.settings.password">password</link>.
+        '';
+        default = "/dev/null";
+        example = "/run/keys/biboumi.cfg";
+      };
+
+      openFirewall = mkEnableOption "opening of the identd port in the firewall";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall = mkIf (cfg.openFirewall && cfg.settings.identd_port != 0)
+      { allowedTCPPorts = [ cfg.settings.identd_port ]; };
+
+    systemd.services.biboumi = {
+      description = "Biboumi, XMPP to IRC gateway";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "notify";
+        # Biboumi supports systemd's watchdog.
+        WatchdogSec = 20;
+        Restart = "always";
+        # Use "+" because credentialsFile may not be accessible to User= or Group=.
+        ExecStartPre = [("+" + pkgs.writeShellScript "biboumi-prestart" ''
+          set -eux
+          cat ${settingsFile} '${cfg.credentialsFile}' |
+          install -m 644 /dev/stdin /run/biboumi/biboumi.cfg
+        '')];
+        ExecStart = "${pkgs.biboumi}/bin/biboumi /run/biboumi/biboumi.cfg";
+        ExecReload = "${pkgs.coreutils}/bin/kill -USR1 $MAINPID";
+        # Firewalls needing opening for output connections can still do that
+        # selectively for biboumi with:
+        # users.users.biboumi.isSystemUser = true;
+        # and, for example:
+        # networking.nftables.ruleset = ''
+        #   add rule inet filter output meta skuid biboumi tcp accept
+        # '';
+        DynamicUser = true;
+        RootDirectory = rootDir;
+        RootDirectoryStartOnly = true;
+        InaccessiblePaths = [ "-+${rootDir}" ];
+        RuntimeDirectory = [ "biboumi" (removePrefix "/run/" rootDir) ];
+        RuntimeDirectoryMode = "700";
+        StateDirectory = "biboumi";
+        StateDirectoryMode = "700";
+        MountAPIVFS = true;
+        UMask = "0066";
+        BindPaths = [
+          stateDir
+          # This is for Type="notify"
+          # See https://github.com/systemd/systemd/issues/3544
+          "/run/systemd/notify"
+          "/run/systemd/journal/socket"
+        ];
+        BindReadOnlyPaths = [
+          builtins.storeDir
+          "/etc"
+        ];
+        # The following options are only for optimizing:
+        # systemd-analyze security biboumi
+        AmbientCapabilities = [ (optionalString need_CAP_NET_BIND_SERVICE "CAP_NET_BIND_SERVICE") ];
+        CapabilityBoundingSet = [ (optionalString need_CAP_NET_BIND_SERVICE "CAP_NET_BIND_SERVICE") ];
+        # ProtectClock= adds DeviceAllow=char-rtc r
+        DeviceAllow = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateNetwork = mkDefault false;
+        PrivateTmp = true;
+        # PrivateUsers=true breaks AmbientCapabilities=CAP_NET_BIND_SERVICE
+        # See https://bugs.archlinux.org/task/65921
+        PrivateUsers = !need_CAP_NET_BIND_SERVICE;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        # AF_UNIX is for /run/systemd/notify
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallFilter = [
+          "@system-service"
+          # Groups in @system-service which do not contain a syscall
+          # listed by perf stat -e 'syscalls:sys_enter_*' biboumi biboumi.cfg
+          # in tests, and seem likely not necessary for biboumi.
+          # To run such a perf in ExecStart=, you have to:
+          # - AmbientCapabilities="CAP_SYS_ADMIN"
+          # - mount -o remount,mode=755 /sys/kernel/debug/{,tracing}
+          "~@aio" "~@chown" "~@ipc" "~@keyring" "~@resources" "~@setuid" "~@timer"
+        ];
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ julm ];
+}

nixos/modules/services/networking/hylafax/options.nix

@@ -3,7 +3,7 @@
 let
 
   inherit (lib.options) literalExample mkEnableOption mkOption;
-  inherit (lib.types) bool enum int lines loaOf nullOr path str submodule;
+  inherit (lib.types) bool enum int lines attrsOf nullOr path str submodule;
   inherit (lib.modules) mkDefault mkIf mkMerge;
 
   commonDescr = ''
@@ -248,7 +248,7 @@ in
     };
 
     modems = mkOption {
-      type = loaOf (submodule [ modemConfigOptions ]);
+      type = attrsOf (submodule [ modemConfigOptions ]);
       default = {};
       example.ttyS1 = {
         type = "cirrus";

nixos/modules/services/networking/nylon.nix

@@ -140,7 +140,7 @@ in
     services.nylon = mkOption {
       default = {};
       description = "Collection of named nylon instances";
-      type = with types; loaOf (submodule nylonOpts);
+      type = with types; attrsOf (submodule nylonOpts);
       internal = true;
     };
 

nixos/modules/services/networking/prosody.nix

@@ -655,7 +655,7 @@ in
 
         description = "Define the virtual hosts";
 
-        type = with types; loaOf (submodule vHostOpts);
+        type = with types; attrsOf (submodule vHostOpts);
 
         example = {
           myhost = {

nixos/modules/services/networking/prosody.xml

@@ -43,10 +43,10 @@ services.prosody = {
   <link linkend="opt-services.prosody.ssl.cert">ssl.cert</link> = "/var/lib/acme/example.org/fullchain.pem";
   <link linkend="opt-services.prosody.ssl.key">ssl.key</link> = "/var/lib/acme/example.org/key.pem";
   <link linkend="opt-services.prosody.virtualHosts">virtualHosts</link>."example.org" = {
-      <link linkend="opt-services.prosody.virtualHosts._name__.enabled">enabled</link> = true;
+      <link linkend="opt-services.prosody.virtualHosts._name_.enabled">enabled</link> = true;
-      <link linkend="opt-services.prosody.virtualHosts._name__.domain">domain</link> = "example.org";
+      <link linkend="opt-services.prosody.virtualHosts._name_.domain">domain</link> = "example.org";
-      <link linkend="opt-services.prosody.virtualHosts._name__.ssl.cert">ssl.cert</link> = "/var/lib/acme/example.org/fullchain.pem";
+      <link linkend="opt-services.prosody.virtualHosts._name_.ssl.cert">ssl.cert</link> = "/var/lib/acme/example.org/fullchain.pem";
-      <link linkend="opt-services.prosody.virtualHosts._name__.ssl.key">ssl.key</link> = "/var/lib/acme/example.org/key.pem";
+      <link linkend="opt-services.prosody.virtualHosts._name_.ssl.key">ssl.key</link> = "/var/lib/acme/example.org/key.pem";
   };
   <link linkend="opt-services.prosody.muc">muc</link> = [ {
       <link linkend="opt-services.prosody.muc">domain</link> = "conference.example.org";

nixos/modules/services/networking/ssh/sshd.nix

@@ -361,7 +361,7 @@ in
     };
 
     users.users = mkOption {
-      type = with types; loaOf (submodule userOptions);
+      type = with types; attrsOf (submodule userOptions);
     };
 
   };

nixos/modules/services/security/tor.nix

@@ -607,7 +607,7 @@ in
             ];
           }
         '';
-        type = types.loaOf (types.submodule ({name, ...}: {
+        type = types.attrsOf (types.submodule ({name, ...}: {
           options = {
 
              name = mkOption {

nixos/modules/system/boot/luksroot.nix

@@ -516,7 +516,7 @@ in
         <filename>/dev/mapper/<replaceable>name</replaceable></filename>.
       '';
 
-      type = with types; loaOf (submodule (
+      type = with types; attrsOf (submodule (
         { name, ... }: { options = {
 
           name = mkOption {

nixos/modules/system/boot/stage-1.nix

@@ -558,7 +558,7 @@ in
       };
 
     fileSystems = mkOption {
-      type = with lib.types; loaOf (submodule {
+      type = with lib.types; attrsOf (submodule {
         options.neededForBoot = mkOption {
           default = false;
           type = types.bool;

nixos/modules/system/etc/etc.nix

@@ -46,7 +46,7 @@ in
         Set of files that have to be linked in <filename>/etc</filename>.
       '';
 
-      type = with types; loaOf (submodule (
+      type = with types; attrsOf (submodule (
         { name, config, ... }:
         { options = {
 

nixos/modules/tasks/encrypted-devices.nix

@@ -54,7 +54,7 @@ in
 
   options = {
     fileSystems = mkOption {
-      type = with lib.types; loaOf (submodule encryptedFSOptions);
+      type = with lib.types; attrsOf (submodule encryptedFSOptions);
     };
     swapDevices = mkOption {
       type = with lib.types; listOf (submodule encryptedFSOptions);

nixos/modules/tasks/filesystems.nix

@@ -159,7 +159,7 @@ in
           "/bigdisk".label = "bigdisk";
         }
       '';
-      type = types.loaOf (types.submodule [coreFileSystemOpts fileSystemOpts]);
+      type = types.attrsOf (types.submodule [coreFileSystemOpts fileSystemOpts]);
       description = ''
         The file systems to be mounted.  It must include an entry for
         the root directory (<literal>mountPoint = "/"</literal>).  Each
@@ -193,7 +193,7 @@ in
 
     boot.specialFileSystems = mkOption {
       default = {};
-      type = types.loaOf (types.submodule coreFileSystemOpts);
+      type = types.attrsOf (types.submodule coreFileSystemOpts);
       internal = true;
       description = ''
         Special filesystems that are mounted very early during boot.

nixos/modules/tasks/network-interfaces.nix

@@ -519,7 +519,7 @@ in
         <option>networking.useDHCP</option> is true, then every
         interface not listed here will be configured using DHCP.
       '';
-      type = with types; loaOf (submodule interfaceOpts);
+      type = with types; attrsOf (submodule interfaceOpts);
     };
 
     networking.vswitches = mkOption {
@@ -544,7 +544,7 @@ in
           interfaces = mkOption {
             example = [ "eth0" "eth1" ];
             description = "The physical network interfaces connected by the vSwitch.";
-            type = with types; loaOf (submodule vswitchInterfaceOpts);
+            type = with types; attrsOf (submodule vswitchInterfaceOpts);
           };
 
           controllers = mkOption {

nixos/modules/virtualisation/containers.nix

@@ -43,6 +43,12 @@ in
         '';
       };
 
+    ociSeccompBpfHook.enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable the OCI seccomp BPF hook";
+    };
+
     containersConf = mkOption {
       default = {};
       description = "containers.conf configuration";
@@ -116,6 +122,12 @@ in
       [network]
       cni_plugin_dirs = ["${pkgs.cni-plugins}/bin/"]
 
+      ${lib.optionalString (cfg.ociSeccompBpfHook.enable == true) ''
+      [engine]
+      hooks_dir = [
+        "${config.boot.kernelPackages.oci-seccomp-bpf-hook}",
+      ]
+      ''}
     '' + cfg.containersConf.extraConfig;
 
     environment.etc."containers/registries.conf".source = toTOML "registries.conf" {

nixos/modules/virtualisation/nixos-containers.nix

@@ -627,7 +627,7 @@ in
 		    };
 
             bindMounts = mkOption {
-              type = with types; loaOf (submodule bindMountOpts);
+              type = with types; attrsOf (submodule bindMountOpts);
               default = {};
               example = literalExample ''
                 { "/home" = { hostPath = "/home/alice";

nixos/modules/virtualisation/railcar.nix

@@ -41,7 +41,7 @@ let
         description = "Source for the in-container mount";
       };
       options = mkOption {
-        type = loaOf (str);
+        type = attrsOf (str);
         default = [ "bind" ];
         description = ''
           Mount options of the filesystem to be used.
@@ -61,7 +61,7 @@ in
     containers = mkOption {
       default = {};
       description = "Declarative container configuration";
-      type = with types; loaOf (submodule ({ name, config, ... }: {
+      type = with types; attrsOf (submodule ({ name, config, ... }: {
         options = {
           cmd = mkOption {
             type = types.lines;

nixos/tests/krb5/example-config.nix

@@ -18,7 +18,10 @@ import ../make-test-python.nix ({ pkgs, ...} : {
         realms = {
           "ATHENA.MIT.EDU" = {
             admin_server = "athena.mit.edu";
-            kdc = "athena.mit.edu";
+            kdc = [
+              "athena01.mit.edu"
+              "athena02.mit.edu"
+            ];
           };
         };
         domain_realm = {
@@ -65,7 +68,8 @@ import ../make-test-python.nix ({ pkgs, ...} : {
       [realms]
         ATHENA.MIT.EDU = {
           admin_server = athena.mit.edu
-          kdc = athena.mit.edu
+          kdc = athena01.mit.edu
+          kdc = athena02.mit.edu
         }
 
       [domain_realm]

pkgs/applications/misc/dbeaver/default.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "dbeaver-ce";
-  version = "7.1.5";
+  version = "7.2.0";
 
   desktopItem = makeDesktopItem {
     name = "dbeaver";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "14pdkg9xxnldr7qwpb61hp2dgsd5h9scjn59ajqsqn4f4sgcpba0";
+    sha256 = "0zpxsdzhn5fsrlq04v5kvkrgf4dsj5zmpypj9awsd2mjcbp6yxd7";
   };
 
   installPhase = ''

pkgs/applications/misc/etesync-dav/default.nix

@@ -9,6 +9,10 @@ python3Packages.buildPythonApplication rec {
     sha256 = "1q8h89hqi4kxphn1g5nbcia0haz5k57is9rycwaabm55mj9s9fah";
   };
 
+  postPatch = ''
+    substituteInPlace setup.py --replace "Radicale==" "Radicale>="
+  '';
+
   propagatedBuildInputs = with python3Packages; [
     etesync
     flask

pkgs/applications/misc/qcad/application-dir.patch

@@ -33,3 +33,16 @@ index c6c31cbf5..c51b59ce6 100644
  }
  
  int RSettings::getSnapRange() {
+diff --git a/qcad.desktop b/qcad.desktop
+index 93c5e9720..2d0e6bf32 100644
+--- a/qcad.desktop
++++ b/qcad.desktop
+@@ -48,7 +48,7 @@ Comment[sv]=2D CAD-system
+ Comment[sl]=Sistem 2D CAD
+ Comment[uk]=2D САПР
+ Comment[tr]=2D CAD Sistemi
+-Exec=qcad %F
++Exec=qcad-bin %F
+ X-MultipleArgs=true
+ Icon=qcad_icon
+ Terminal=false

pkgs/applications/misc/qcad/default.nix

@@ -11,13 +11,13 @@
 
 mkDerivationWith stdenv.mkDerivation rec {
   pname = "qcad";
-  version = "3.24.3.10";
+  version = "3.25.0.0";
 
   src = fetchFromGitHub {
     owner = "qcad";
     repo = "qcad";
     rev = "v${version}";
-    sha256 = "0izyn4y1ffq1mgxs5dymkrqih6n6v9ifrcpyk1z2vyhbm5xx4qsa";
+    sha256 = "07qph2645m1wi9yi04ixdvx8dli03q1vimj3laqdmnpipi54lljc";
   };
 
   patches = [
@@ -25,10 +25,12 @@ mkDerivationWith stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
+    if ! [ -d src/3rdparty/qt-labs-qtscriptgenerator-${qt5.qtbase.version} ]; then
       mkdir src/3rdparty/qt-labs-qtscriptgenerator-${qt5.qtbase.version}
       cp \
-      src/3rdparty/qt-labs-qtscriptgenerator-5.12.3/qt-labs-qtscriptgenerator-5.12.3.pro \
+        src/3rdparty/qt-labs-qtscriptgenerator-5.14.0/qt-labs-qtscriptgenerator-5.14.0.pro \
         src/3rdparty/qt-labs-qtscriptgenerator-${qt5.qtbase.version}/qt-labs-qtscriptgenerator-${qt5.qtbase.version}.pro
+    fi
  '';
 
   qmakeFlags = [

pkgs/applications/misc/zettlr/default.nix

@@ -0,0 +1,38 @@
+{ appimageTools, lib, fetchurl, gtk3, gsettings-desktop-schemas}:
+
+# Based on https://gist.github.com/msteen/96cb7df66a359b827497c5269ccbbf94 and joplin-desktop nixpkgs.
+let
+  pname = "zettlr";
+  version = "1.7.5";
+  name = "${pname}-${version}";
+  src = fetchurl {
+    url = "https://github.com/Zettlr/Zettlr/releases/download/v${version}/Zettlr-${version}-x86_64.appimage";
+    sha256 = "040lx01ywdpla34d4abkmh51kchr11s17la6fk6yq77y8zb87xzi";
+  };
+  appimageContents = appimageTools.extractType2 {
+    inherit name src;
+  };
+in appimageTools.wrapType2 rec {
+  inherit name src;
+
+  profile = ''
+    export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
+  '';
+
+  multiPkgs = null; # no 32bit needed
+  extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
+  extraInstallCommands = ''
+    mv $out/bin/{${name},${pname}}
+    install -m 444 -D ${appimageContents}/zettlr.desktop $out/share/applications/zettlr.desktop
+    install -m 444 -D ${appimageContents}/zettlr.png $out/share/icons/hicolor/512x512/apps/zettlr.png
+    substituteInPlace $out/share/applications/zettlr.desktop --replace 'Exec=AppRun' 'Exec=${pname}'
+  '';
+
+  meta = with lib; {
+    description = "A markdown editor for writing academic texts and taking notes";
+    homepage = "https://www.zettlr.com";
+    platforms = [ "x86_64-linux" ];
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ tfmoraes ];
+  };
+}

pkgs/applications/networking/cluster/terraform/default.nix

@@ -132,8 +132,8 @@ in rec {
   });
 
   terraform_0_13 = pluggable (generic {
-    version = "0.13.1";
+    version = "0.13.2";
-    sha256 = "0a2sjjb79ziv42ifhplpkvqgsg8gxvr1wdgkhdj59dwahqv64pm2";
+    sha256 = "04pm57l29j3ai6dvh2343q4yhskkxqj8ayr2hdw2qqjch52p8mrw";
     patches = [ ./provider-path.patch ];
     passthru = { inherit plugins; };
   });

pkgs/applications/networking/instant-messengers/element/element-desktop-package.json

@@ -2,7 +2,7 @@
   "name": "element-desktop",
   "productName": "Element",
   "main": "src/electron-main.js",
-  "version": "1.7.4",
+  "version": "1.7.5",
   "description": "A feature-rich client for Matrix.org",
   "author": "Element",
   "repository": {

pkgs/applications/networking/instant-messengers/element/element-desktop.nix

@@ -8,12 +8,12 @@
 
 let
   executableName = "element-desktop";
-  version = "1.7.4";
+  version = "1.7.5";
   src = fetchFromGitHub {
     owner = "vector-im";
     repo = "riot-desktop";
     rev = "v${version}";
-    sha256 = "16ilkf5b8mz74x1r9fym5xjb4plxzhg3g5njj1sl4qvsbrkk6r9a";
+    sha256 = "0781yg15bzkw5bpfzbdkqix239djgsc7kjdvbilv1d1xxqz3462y";
   };
   electron = electron_9;
 

pkgs/applications/networking/instant-messengers/element/element-web.nix

@@ -12,11 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "element-web";
-  version = "1.7.4";
+  version = "1.7.5";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "0ssyd5b9yrxidivr3rcjsd8ixkmppsmmr7a8k0sv16yk7hjnvz5b";
+    sha256 = "07qc4hymdp1r2zn9gsgkpwxf6knk6xr88dc3iihlhipmlk46m58b";
   };
 
   installPhase = ''

pkgs/applications/networking/instant-messengers/pantalaimon/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonApplication rec {
   pname = "pantalaimon";
-  version = "0.6.5";
+  version = "0.7.0";
 
   disabled = pythonOlder "3.6";
 
@@ -19,7 +19,7 @@ buildPythonApplication rec {
     owner = "matrix-org";
     repo = pname;
     rev = version;
-    sha256 = "1pjrq71fkpvsc79nwhxhwjkqvqhj5wsnnwvsgslghaajdaw3n6wd";
+    sha256 = "0cx8sqajf5lh8w61yy1l6ry67rv1b45xp264zkw3s7ip80i4ylb2";
   };
 
   propagatedBuildInputs = [

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -25,7 +25,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.34.5"; # Please backport all updates to the stable channel.
+  version = "1.35.1"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "1s8nksrkfivsf9r460ifxsf8l7bnc1zix5yj39kvnx0mbync8lg1";
+    sha256 = "1nxj7h8yrp2sbxxd49q9xdh1zsqixcd01i83lr492f4322cg1yjf";
   };
 
   nativeBuildInputs = [

pkgs/applications/office/libreoffice/default.nix

@@ -61,15 +61,12 @@ in (mkDrv rec {
   # of rasqal/rasqal.h
   NIX_CFLAGS_COMPILE = [
     "-I${librdf_rasqal}/include/rasqal"
-  ] ++ lib.optional stdenv.isx86_64 "-mno-fma";
+  ] ++ lib.optionals stdenv.isx86_64 [ "-mno-fma" "-mno-avx" ]
+  # https://bugs.documentfoundation.org/show_bug.cgi?id=78174#c10
+  ++ [ "-fno-visibility-inlines-hidden" ];
 
   patches = [
     ./xdg-open-brief.patch
-    (fetchpatch {
-      url = "https://git.pld-linux.org/gitweb.cgi?p=packages/libreoffice.git;a=blob_plain;f=poppler-0.86.patch;h=76b8356d5f22ef537a83b0f9b0debab591f152fe;hb=a2737a61353e305a9ee69640fb20d4582c218008";
-      name = "poppler-0.86.patch";
-      sha256 = "0q6k4l8imgp8ailcv0qx5l83afyw44hah24fi7gjrm9xgv5sbb8j";
-    })
   ];
 
   tarballPath = "external/tarballs";

pkgs/applications/office/libreoffice/src-fresh/download.nix

@@ -28,11 +28,11 @@
     md5name = "976a12a59bc286d634a21d7be0841cc74289ea9077aa1af46be19d1a6e844c19-apr-util-1.5.4.tar.gz";
   }
   {
-    name = "boost_1_69_0.tar.bz2";
+    name = "boost_1_71_0.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/boost_1_69_0.tar.bz2";
+    url = "http://dev-www.libreoffice.org/src/boost_1_71_0.tar.xz";
-    sha256 = "8f32d4617390d1c2d16f26a27ab60d97807b35440d45891fa340fc2648b04406";
+    sha256 = "35e06a3bd7cd8f66be822c7d64e80c2b6051a181e9e897006917cb8e7988a543";
     md5 = "";
-    md5name = "8f32d4617390d1c2d16f26a27ab60d97807b35440d45891fa340fc2648b04406-boost_1_69_0.tar.bz2";
+    md5name = "35e06a3bd7cd8f66be822c7d64e80c2b6051a181e9e897006917cb8e7988a543-boost_1_71_0.tar.xz";
   }
   {
     name = "breakpad.zip";
@@ -63,11 +63,11 @@
     md5name = "5e7b29b3f113ef870d1e3ecf8adf21f923396401604bda16d44be45e66052331-cairo-1.16.0.tar.xz";
   }
   {
-    name = "libcdr-0.1.5.tar.xz";
+    name = "libcdr-0.1.6.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/libcdr-0.1.5.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/libcdr-0.1.6.tar.xz";
-    sha256 = "6ace5c499a8be34ad871e825442ce388614ae2d8675c4381756a7319429e3a48";
+    sha256 = "01cd00b04a030977e544433c2d127c997205332cd9b8e35ec0ee17110da7f861";
     md5 = "";
-    md5name = "6ace5c499a8be34ad871e825442ce388614ae2d8675c4381756a7319429e3a48-libcdr-0.1.5.tar.xz";
+    md5name = "01cd00b04a030977e544433c2d127c997205332cd9b8e35ec0ee17110da7f861-libcdr-0.1.6.tar.xz";
   }
   {
     name = "clucene-core-2.3.3.4.tar.gz";
@@ -76,6 +76,13 @@
     md5 = "48d647fbd8ef8889e5a7f422c1bfda94";
     md5name = "48d647fbd8ef8889e5a7f422c1bfda94-clucene-core-2.3.3.4.tar.gz";
   }
+  {
+    name = "dtoa-20180411.tgz";
+    url = "http://dev-www.libreoffice.org/src/dtoa-20180411.tgz";
+    sha256 = "0082d0684f7db6f62361b76c4b7faba19e0c7ce5cb8e36c4b65fea8281e711b4";
+    md5 = "";
+    md5name = "0082d0684f7db6f62361b76c4b7faba19e0c7ce5cb8e36c4b65fea8281e711b4-dtoa-20180411.tgz";
+  }
   {
     name = "libcmis-0.5.2.tar.xz";
     url = "http://dev-www.libreoffice.org/src/libcmis-0.5.2.tar.xz";
@@ -91,11 +98,11 @@
     md5name = "86c798780b9e1f5921fe4efe651a93cb420623b45aa1fdff57af8c37f116113f-CoinMP-1.7.6.tgz";
   }
   {
-    name = "cppunit-1.14.0.tar.gz";
+    name = "cppunit-1.15.1.tar.gz";
-    url = "http://dev-www.libreoffice.org/src/cppunit-1.14.0.tar.gz";
+    url = "http://dev-www.libreoffice.org/src/cppunit-1.15.1.tar.gz";
-    sha256 = "3d569869d27b48860210c758c4f313082103a5e58219a7669b52bfd29d674780";
+    sha256 = "89c5c6665337f56fd2db36bc3805a5619709d51fb136e51937072f63fcc717a7";
     md5 = "";
-    md5name = "3d569869d27b48860210c758c4f313082103a5e58219a7669b52bfd29d674780-cppunit-1.14.0.tar.gz";
+    md5name = "89c5c6665337f56fd2db36bc3805a5619709d51fb136e51937072f63fcc717a7-cppunit-1.15.1.tar.gz";
   }
   {
     name = "converttexttonumber-1-5-0.oxt";
@@ -105,11 +112,11 @@
     md5name = "1f467e5bb703f12cbbb09d5cf67ecf4a-converttexttonumber-1-5-0.oxt";
   }
   {
-    name = "curl-7.65.0.tar.xz";
+    name = "curl-7.71.0.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/curl-7.65.0.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/curl-7.71.0.tar.xz";
-    sha256 = "7766d263929404f693905b5e5222aa0f2bdf8c66ab4b8758f0c0820a42b966cd";
+    sha256 = "cdf18794393d8bead915312708a9e5d819c6e9919de14b20d5c8e7987abd9772";
     md5 = "";
-    md5name = "7766d263929404f693905b5e5222aa0f2bdf8c66ab4b8758f0c0820a42b966cd-curl-7.65.0.tar.xz";
+    md5name = "cdf18794393d8bead915312708a9e5d819c6e9919de14b20d5c8e7987abd9772-curl-7.71.0.tar.xz";
   }
   {
     name = "libe-book-0.1.3.tar.xz";
@@ -161,11 +168,11 @@
     md5name = "6994be3555e23226630c587444be19d309b25b0fcf1f87df3b4e3f88943e5860-Firebird-3.0.0.32483-0.tar.bz2";
   }
   {
-    name = "fontconfig-2.12.6.tar.bz2";
+    name = "fontconfig-2.13.91.tar.gz";
-    url = "http://dev-www.libreoffice.org/src/fontconfig-2.12.6.tar.bz2";
+    url = "http://dev-www.libreoffice.org/src/fontconfig-2.13.91.tar.gz";
-    sha256 = "cf0c30807d08f6a28ab46c61b8dbd55c97d2f292cf88f3a07d3384687f31f017";
+    sha256 = "19e5b1bc9d013a52063a44e1307629711f0bfef35b9aca16f9c793971e2eb1e5";
     md5 = "";
-    md5name = "cf0c30807d08f6a28ab46c61b8dbd55c97d2f292cf88f3a07d3384687f31f017-fontconfig-2.12.6.tar.bz2";
+    md5name = "19e5b1bc9d013a52063a44e1307629711f0bfef35b9aca16f9c793971e2eb1e5-fontconfig-2.13.91.tar.gz";
   }
   {
     name = "crosextrafonts-20130214.tar.gz";
@@ -315,11 +322,11 @@
     md5name = "db8d87ea720ea9d5edc5388fc7a0497bb11ba9fe972245e0f7f4c7e8b1e1e84d-freetype-2.9.1.tar.bz2";
   }
   {
-    name = "glm-0.9.4.6-libreoffice.zip";
+    name = "glm-0.9.9.7.zip";
-    url = "http://dev-www.libreoffice.org/src/bae83fa5dc7f081768daace6e199adc3-glm-0.9.4.6-libreoffice.zip";
+    url = "http://dev-www.libreoffice.org/src/glm-0.9.9.7.zip";
-    sha256 = "d0312c360efe04dd048b3311fe375ff36f1993b4c2e3cb58c81062990532904a";
+    sha256 = "c5e167c042afd2d7ad642ace6b643863baeb33880781983563e1ab68a30d3e95";
-    md5 = "bae83fa5dc7f081768daace6e199adc3";
+    md5 = "";
-    md5name = "bae83fa5dc7f081768daace6e199adc3-glm-0.9.4.6-libreoffice.zip";
+    md5name = "c5e167c042afd2d7ad642ace6b643863baeb33880781983563e1ab68a30d3e95-glm-0.9.9.7.zip";
   }
   {
     name = "gpgme-1.9.0.tar.bz2";
@@ -329,11 +336,11 @@
     md5name = "1b29fedb8bfad775e70eafac5b0590621683b2d9869db994568e6401f4034ceb-gpgme-1.9.0.tar.bz2";
   }
   {
-    name = "graphite2-minimal-1.3.13.tgz";
+    name = "graphite2-minimal-1.3.14.tgz";
-    url = "http://dev-www.libreoffice.org/src/graphite2-minimal-1.3.13.tgz";
+    url = "http://dev-www.libreoffice.org/src/graphite2-minimal-1.3.14.tgz";
-    sha256 = "d47d387161db7f7ebade1920aa7cbdc797e79772597d8b55e80b58d1071bcc36";
+    sha256 = "b8e892d8627c41888ff121e921455b9e2d26836978f2359173d19825da62b8fc";
     md5 = "";
-    md5name = "d47d387161db7f7ebade1920aa7cbdc797e79772597d8b55e80b58d1071bcc36-graphite2-minimal-1.3.13.tgz";
+    md5name = "b8e892d8627c41888ff121e921455b9e2d26836978f2359173d19825da62b8fc-graphite2-minimal-1.3.14.tgz";
   }
   {
     name = "harfbuzz-2.6.0.tar.xz";
@@ -364,18 +371,18 @@
     md5name = "5ade6ae2a99bc1e9e57031ca88d36dad-hyphen-2.8.8.tar.gz";
   }
   {
-    name = "icu4c-65_1-src.tgz";
+    name = "icu4c-67_1-src.tgz";
-    url = "http://dev-www.libreoffice.org/src/icu4c-65_1-src.tgz";
+    url = "http://dev-www.libreoffice.org/src/icu4c-67_1-src.tgz";
-    sha256 = "53e37466b3d6d6d01ead029e3567d873a43a5d1c668ed2278e253b683136d948";
+    sha256 = "94a80cd6f251a53bd2a997f6f1b5ac6653fe791dfab66e1eb0227740fb86d5dc";
     md5 = "";
-    md5name = "53e37466b3d6d6d01ead029e3567d873a43a5d1c668ed2278e253b683136d948-icu4c-65_1-src.tgz";
+    md5name = "94a80cd6f251a53bd2a997f6f1b5ac6653fe791dfab66e1eb0227740fb86d5dc-icu4c-67_1-src.tgz";
   }
   {
-    name = "icu4c-65_1-data.zip";
+    name = "icu4c-67_1-data.zip";
-    url = "http://dev-www.libreoffice.org/src/icu4c-65_1-data.zip";
+    url = "http://dev-www.libreoffice.org/src/icu4c-67_1-data.zip";
-    sha256 = "06359a7c4ad125ba11d3ac30617cd4b932f1214f611db96573032726574896b6";
+    sha256 = "7c16a59cc8c06128b7ecc1dc4fc056b36b17349312829b17408b9e67b05c4a7e";
     md5 = "";
-    md5name = "06359a7c4ad125ba11d3ac30617cd4b932f1214f611db96573032726574896b6-icu4c-65_1-data.zip";
+    md5name = "7c16a59cc8c06128b7ecc1dc4fc056b36b17349312829b17408b9e67b05c4a7e-icu4c-67_1-data.zip";
   }
   {
     name = "flow-engine-0.9.4.zip";
@@ -462,11 +469,11 @@
     md5name = "b24890e2bb46e12e72a79f7e965f409f4e16466d00e1dd15d93d73ee6b592523-libjpeg-turbo-1.5.3.tar.gz";
   }
   {
-    name = "language-subtag-registry-2019-09-16.tar.bz2";
+    name = "language-subtag-registry-2020-04-01.tar.bz2";
-    url = "http://dev-www.libreoffice.org/src/language-subtag-registry-2019-09-16.tar.bz2";
+    url = "http://dev-www.libreoffice.org/src/language-subtag-registry-2020-04-01.tar.bz2";
-    sha256 = "07b66bc0f2786fde55f6bbcbcb4a455a846eb8e2351c8ce3d0a219a73693736a";
+    sha256 = "fb1ee0dabfd956a445fbe9f351e86a52767808558f20f4256e67fbbb3768e9da";
     md5 = "";
-    md5name = "07b66bc0f2786fde55f6bbcbcb4a455a846eb8e2351c8ce3d0a219a73693736a-language-subtag-registry-2019-09-16.tar.bz2";
+    md5name = "fb1ee0dabfd956a445fbe9f351e86a52767808558f20f4256e67fbbb3768e9da-language-subtag-registry-2020-04-01.tar.bz2";
   }
   {
     name = "JLanguageTool-1.7.0.tar.bz2";
@@ -532,11 +539,11 @@
     md5name = "d6242790324f1432fb0a6fae71b6851f520b2c5a87675497cf8ea14c2924d52e-liblangtag-0.6.2.tar.bz2";
   }
   {
-    name = "libnumbertext-1.0.5.tar.xz";
+    name = "libnumbertext-1.0.6.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/libnumbertext-1.0.5.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/libnumbertext-1.0.6.tar.xz";
-    sha256 = "e1c9086b4cecb6b25f180316f30740dfabe6a4dbaf70dddc34276fc839e4f4f7";
+    sha256 = "739f220b34bf7cb731c09de2921771d644d37dfd276c45564401e5759f10ae57";
     md5 = "";
-    md5name = "e1c9086b4cecb6b25f180316f30740dfabe6a4dbaf70dddc34276fc839e4f4f7-libnumbertext-1.0.5.tar.xz";
+    md5name = "739f220b34bf7cb731c09de2921771d644d37dfd276c45564401e5759f10ae57-libnumbertext-1.0.6.tar.xz";
   }
   {
     name = "ltm-1.0.zip";
@@ -546,11 +553,11 @@
     md5name = "083daa92d8ee6f4af96a6143b12d7fc8fe1a547e14f862304f7281f8f7347483-ltm-1.0.zip";
   }
   {
-    name = "xmlsec1-1.2.28.tar.gz";
+    name = "xmlsec1-1.2.30.tar.gz";
-    url = "http://dev-www.libreoffice.org/src/xmlsec1-1.2.28.tar.gz";
+    url = "http://dev-www.libreoffice.org/src/xmlsec1-1.2.30.tar.gz";
-    sha256 = "13eec4811ea30e3f0e16a734d1dbf7f9d246a71d540b48d143a07b489f6222d4";
+    sha256 = "2d84360b03042178def1d9ff538acacaed2b3a27411db7b2874f1612ed71abc8";
     md5 = "";
-    md5name = "13eec4811ea30e3f0e16a734d1dbf7f9d246a71d540b48d143a07b489f6222d4-xmlsec1-1.2.28.tar.gz";
+    md5name = "2d84360b03042178def1d9ff538acacaed2b3a27411db7b2874f1612ed71abc8-xmlsec1-1.2.30.tar.gz";
   }
   {
     name = "libxml2-2.9.10.tar.gz";
@@ -581,18 +588,18 @@
     md5name = "940caef1ec7c78e0c34b0f6b94fe42d0f2022915ffc78643d28538a5cfd0f40e-lxml-4.1.1.tgz";
   }
   {
-    name = "mariadb_client-2.0.0-src.tar.gz";
+    name = "mariadb-connector-c-3.1.8-src.tar.gz";
-    url = "http://dev-www.libreoffice.org/src/a233181e03d3c307668b4c722d881661-mariadb_client-2.0.0-src.tar.gz";
+    url = "http://dev-www.libreoffice.org/src/mariadb-connector-c-3.1.8-src.tar.gz";
-    sha256 = "fd2f751dea049c1907735eb236aeace1d811d6a8218118b00bbaa9b84dc5cd60";
+    sha256 = "431434d3926f4bcce2e5c97240609983f60d7ff50df5a72083934759bb863f7b";
-    md5 = "a233181e03d3c307668b4c722d881661";
+    md5 = "";
-    md5name = "a233181e03d3c307668b4c722d881661-mariadb_client-2.0.0-src.tar.gz";
+    md5name = "431434d3926f4bcce2e5c97240609983f60d7ff50df5a72083934759bb863f7b-mariadb-connector-c-3.1.8-src.tar.gz";
   }
   {
-    name = "mdds-1.5.0.tar.bz2";
+    name = "mdds-1.6.0.tar.bz2";
-    url = "http://dev-www.libreoffice.org/src/mdds-1.5.0.tar.bz2";
+    url = "http://dev-www.libreoffice.org/src/mdds-1.6.0.tar.bz2";
-    sha256 = "144d6debd7be32726f332eac14ef9f17e2d3cf89cb3250eb31a7127e0789680d";
+    sha256 = "f1585c9cbd12f83a6d43d395ac1ab6a9d9d5d77f062c7b5f704e24ed72dae07d";
     md5 = "";
-    md5name = "144d6debd7be32726f332eac14ef9f17e2d3cf89cb3250eb31a7127e0789680d-mdds-1.5.0.tar.bz2";
+    md5name = "f1585c9cbd12f83a6d43d395ac1ab6a9d9d5d77f062c7b5f704e24ed72dae07d-mdds-1.6.0.tar.bz2";
   }
   {
     name = "mDNSResponder-878.200.35.tar.gz";
@@ -609,11 +616,11 @@
     md5name = "ef36c1a1aabb2ba3b0bedaaafe717bf4480be2ba8de6f3894be5fd3702b013ba-libmspub-0.1.4.tar.xz";
   }
   {
-    name = "libmwaw-0.3.15.tar.xz";
+    name = "libmwaw-0.3.16.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/libmwaw-0.3.15.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/libmwaw-0.3.16.tar.xz";
-    sha256 = "0440bb09f05e3419423d8dfa36ee847056ebfd837f9cbc091fdb5b057daab0b1";
+    sha256 = "0c639edba5297bde5575193bf5b5f2f469956beaff5c0206d91ce9df6bde1868";
     md5 = "";
-    md5name = "0440bb09f05e3419423d8dfa36ee847056ebfd837f9cbc091fdb5b057daab0b1-libmwaw-0.3.15.tar.xz";
+    md5name = "0c639edba5297bde5575193bf5b5f2f469956beaff5c0206d91ce9df6bde1868-libmwaw-0.3.16.tar.xz";
   }
   {
     name = "mythes-1.2.4.tar.gz";
@@ -644,11 +651,11 @@
     md5name = "2c7b21892f84a4c67546f84611eccdad6259875c971e98ddb027da66ea0ac9c2-libodfgen-0.1.6.tar.bz2";
   }
   {
-    name = "odfvalidator-1.2.0-incubating-SNAPSHOT-jar-with-dependencies-971c54fd38a968f5860014b44301872706f9e540.jar";
+    name = "odfvalidator-0.9.0-RC2-SNAPSHOT-jar-with-dependencies-2726ab578664434a545f8379a01a9faffac0ae73.jar";
-    url = "http://dev-www.libreoffice.org/src/../extern/odfvalidator-1.2.0-incubating-SNAPSHOT-jar-with-dependencies-971c54fd38a968f5860014b44301872706f9e540.jar";
+    url = "http://dev-www.libreoffice.org/src/../extern/odfvalidator-0.9.0-RC2-SNAPSHOT-jar-with-dependencies-2726ab578664434a545f8379a01a9faffac0ae73.jar";
-    sha256 = "984f2a479df79e27e7b01a5815ac53ae64e07746b882262d8a64566494515504";
+    sha256 = "d55495ab3a86544650587de2a72180ddf8bfc6376d14ddfa923992dbc86a06e0";
     md5 = "";
-    md5name = "984f2a479df79e27e7b01a5815ac53ae64e07746b882262d8a64566494515504-odfvalidator-1.2.0-incubating-SNAPSHOT-jar-with-dependencies-971c54fd38a968f5860014b44301872706f9e540.jar";
+    md5name = "d55495ab3a86544650587de2a72180ddf8bfc6376d14ddfa923992dbc86a06e0-odfvalidator-0.9.0-RC2-SNAPSHOT-jar-with-dependencies-2726ab578664434a545f8379a01a9faffac0ae73.jar";
   }
   {
     name = "officeotron-0.7.4-master.jar";
@@ -672,11 +679,11 @@
     md5name = "14cb464efe7ac6b54799b34456bd69558a749a4931ecfd9cf9f71d7881cac7bc-openssl-1.0.2t.tar.gz";
   }
   {
-    name = "liborcus-0.15.3.tar.gz";
+    name = "liborcus-0.15.4.tar.bz2";
-    url = "http://dev-www.libreoffice.org/src/liborcus-0.15.3.tar.gz";
+    url = "http://dev-www.libreoffice.org/src/liborcus-0.15.4.tar.bz2";
-    sha256 = "0dd26f3f2e611c51df9ee02d6dbf08887989eaa417b73f6877cd0d94df795fc2";
+    sha256 = "cfb2aa60825f2a78589ed030c07f46a1ee16ef8a2d1bf2279192fbc1ae5a5f61";
     md5 = "";
-    md5name = "0dd26f3f2e611c51df9ee02d6dbf08887989eaa417b73f6877cd0d94df795fc2-liborcus-0.15.3.tar.gz";
+    md5name = "cfb2aa60825f2a78589ed030c07f46a1ee16ef8a2d1bf2279192fbc1ae5a5f61-liborcus-0.15.4.tar.bz2";
   }
   {
     name = "owncloud-android-library-0.9.4-no-binary-deps.tar.gz";
@@ -693,11 +700,11 @@
     md5name = "66adacd705a7d19895e08eac46d1e851332adf2e736c566bef1164e7a442519d-libpagemaker-0.0.4.tar.xz";
   }
   {
-    name = "pdfium-3963.tar.bz2";
+    name = "pdfium-4137.tar.bz2";
-    url = "http://dev-www.libreoffice.org/src/pdfium-3963.tar.bz2";
+    url = "http://dev-www.libreoffice.org/src/pdfium-4137.tar.bz2";
-    sha256 = "80d4d6bd8faec226936fcde5521c6e92c0c645126ac3ae72dd2c160ca1749895";
+    sha256 = "9a2f9bddca935a263f06c81003483473a525ccd0f4e517bc75fceb914d4c54b6";
     md5 = "";
-    md5name = "80d4d6bd8faec226936fcde5521c6e92c0c645126ac3ae72dd2c160ca1749895-pdfium-3963.tar.bz2";
+    md5name = "9a2f9bddca935a263f06c81003483473a525ccd0f4e517bc75fceb914d4c54b6-pdfium-4137.tar.bz2";
   }
   {
     name = "pixman-0.34.0.tar.gz";
@@ -791,11 +798,18 @@
     md5name = "6988d394b62c3494635b6f0760bc3079f9a0cd380baf0f6b075af1eb9fa5e700-serf-1.2.1.tar.bz2";
   }
   {
-    name = "libstaroffice-0.0.6.tar.xz";
+    name = "skia-m84-c1baf6e1c2a5454148adb516f0f833483b5a0353.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/libstaroffice-0.0.6.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/skia-m84-c1baf6e1c2a5454148adb516f0f833483b5a0353.tar.xz";
-    sha256 = "6b00e1ed8194e6072be4441025d1b888e39365727ed5b23e0e8c92c4009d1ec4";
+    sha256 = "f88dc1a500d29c87ef5251c5a6c3ea66aa4c7daf0cf5d349ece64b36f7623be0";
     md5 = "";
-    md5name = "6b00e1ed8194e6072be4441025d1b888e39365727ed5b23e0e8c92c4009d1ec4-libstaroffice-0.0.6.tar.xz";
+    md5name = "f88dc1a500d29c87ef5251c5a6c3ea66aa4c7daf0cf5d349ece64b36f7623be0-skia-m84-c1baf6e1c2a5454148adb516f0f833483b5a0353.tar.xz";
+  }
+  {
+    name = "libstaroffice-0.0.7.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/libstaroffice-0.0.7.tar.xz";
+    sha256 = "f94fb0ad8216f97127bedef163a45886b43c62deac5e5b0f5e628e234220c8db";
+    md5 = "";
+    md5name = "f94fb0ad8216f97127bedef163a45886b43c62deac5e5b0f5e628e234220c8db-libstaroffice-0.0.7.tar.xz";
   }
   {
     name = "swingExSrc.zip";
@@ -840,11 +854,11 @@
     md5name = "99b3f7f8832385748582ab8130fbb9e5607bd5179bebf9751ac1d51a53099d1c-libwpg-0.3.3.tar.xz";
   }
   {
-    name = "libwps-0.4.10.tar.xz";
+    name = "libwps-0.4.11.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/libwps-0.4.10.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/libwps-0.4.11.tar.xz";
-    sha256 = "1421e034286a9f96d3168a1c54ea570ee7aa008ca07b89de005ad5ce49fb29ca";
+    sha256 = "a8fdaabc28654a975fa78c81873ac503ba18f0d1cdbb942f470a21d29284b4d1";
     md5 = "";
-    md5name = "1421e034286a9f96d3168a1c54ea570ee7aa008ca07b89de005ad5ce49fb29ca-libwps-0.4.10.tar.xz";
+    md5name = "a8fdaabc28654a975fa78c81873ac503ba18f0d1cdbb942f470a21d29284b4d1-libwps-0.4.11.tar.xz";
   }
   {
     name = "xsltml_2.1.2.zip";

pkgs/applications/office/libreoffice/src-fresh/primary.nix

@@ -6,10 +6,10 @@ rec {
     inherit sha256;
   };
 
-  major = "6";
+  major = "7";
-  minor = "4";
+  minor = "0";
-  patch = "3";
+  patch = "0";
-  tweak = "2";
+  tweak = "3";
 
   subdir = "${major}.${minor}.${patch}";
 
@@ -17,13 +17,13 @@ rec {
 
   src = fetchurl {
     url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "1cmbrhha7mlflnlbpla8fix07cxcgkdb7krnrgs1bylf31y5855w";
+    sha256 = "sha256-sl+vgnLGIWtyw8Y/ovVsxThdOMg2Gby4SRaiaqvZVB0=";
   };
 
   # FIXME rename
   translations = fetchSrc {
     name = "translations";
-    sha256 = "06z9hz4m3kdcljjc6y5s18001axjibj9xiyakdndkl9pmnnhn9h3";
+    sha256 = "sha256-i3yfD5cmM6D9BctjablIFRqfibjrwLAaxxPIsQdk0sY=";
   };
 
   # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
@@ -31,6 +31,6 @@ rec {
 
   help = fetchSrc {
     name = "help";
-    sha256 = "0mpgrwg8z1q38j03l6m1sdpcplyjd5nz1nqaa13vfkryj2lflw45";
+    sha256 = "sha256-hYBEEPRmh16zgGZBUN20xfTY6qL07aKMC1lC/0ij9/0=";
   };
 }

pkgs/applications/office/portfolio/default.nix

@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "PortfolioPerformance";
-  version = "0.48.0";
+  version = "0.48.1";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "12skl08isz2f1a6ksmcw7sm82xk909y636ch8jp80lglb21i0q1j";
+    sha256 = "0xhxp4iglggv6rqwsg0xjn8z46v910rj372abkaviwa3cqzf7gdb";
   };
 
   nativeBuildInputs = [

pkgs/applications/office/wpsoffice/default.nix

@@ -12,7 +12,7 @@
 , cups
 , dbus
 , expat
-, ffmpeg_3
+, ffmpeg
 , fontconfig
 , freetype
 , gdk-pixbuf
@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     cairo
     dbus.lib
     expat
-    ffmpeg_3
+    ffmpeg
     fontconfig
     freetype
     gdk-pixbuf

pkgs/applications/version-management/git-and-tools/gita/default.nix

@@ -9,11 +9,11 @@
 }:
 
 buildPythonApplication rec {
-  version = "0.10.9";
+  version = "0.10.10";
   pname = "gita";
 
   src = fetchFromGitHub {
-    sha256 = "0wilyf4nnn2jyxrfqs8krya3zvhj6x36szsp9xhb6h08g1ihzp5i";
+    sha256 = "0k7hicncbrqvhmpq1w3v1309bqij6izw31xs8xcb8is85dvi754h";
     rev = "v${version}";
     repo = "gita";
     owner = "nosarthur";
@@ -45,6 +45,7 @@ buildPythonApplication rec {
 
   postInstall = ''
     installShellCompletion --bash --name gita ${src}/.gita-completion.bash
+    installShellCompletion --zsh --name gita ${src}/.gita-completion.zsh
   '';
 
   meta = with lib; {

pkgs/applications/video/pitivi/default.nix

@@ -1,15 +1,28 @@
-{ stdenv, fetchFromGitHub, fetchurl, pkgconfig, intltool, itstool, python3, wrapGAppsHook
+{ stdenv
-, python3Packages, gst_all_1, gtk3
+, fetchFromGitHub
-, gobject-introspection, librsvg, gnome3, libnotify, gsound
+, fetchurl
-, meson, ninja, gsettings-desktop-schemas
+, fetchpatch
+, pkg-config
+, gettext
+, itstool
+, python3
+, wrapGAppsHook
+, python3Packages
+, gst_all_1
+, gtk3
+, gobject-introspection
+, librsvg
+, gnome3
+, libnotify
+, gsound
+, meson
+, ninja
+, gsettings-desktop-schemas
 }:
 
 let
-  version = "0.999";
+  # gst-transcoder was merged with gst-plugins-bad 1.18.
-
+  # TODO: switch to that once available.
-  # gst-transcoder will eventually be merged with gstreamer (according to
-  # gst-transcoder 1.8.0 release notes). For now the only user is pitivi so we
-  # don't bother exposing the package to all of nixpkgs.
   gst-transcoder = stdenv.mkDerivation rec {
     version = "1.14.1";
     pname = "gst-transcoder";
@@ -19,46 +32,121 @@ let
       rev = version;
       sha256 = "16skiz9akavssii529v9nr8zd54w43livc14khdyzv164djg9q8f";
     };
-    nativeBuildInputs = [ pkgconfig meson ninja gobject-introspection python3 ];
+    nativeBuildInputs = [
-    buildInputs = with gst_all_1; [ gstreamer gst-plugins-base ];
+      pkg-config
+      meson
+      ninja
+      gobject-introspection
+      python3
+    ];
+    buildInputs = with gst_all_1; [
+      gstreamer
+      gst-plugins-base
+    ];
   };
 
 in python3Packages.buildPythonApplication rec {
-  name = "pitivi-${version}";
+  pname = "pitivi";
-
+  version = "0.999";
-  src = fetchurl {
-    url = "mirror://gnome/sources/pitivi/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0mxp2p4gg976fp1vj3rb5rmpl5mqfzncm9vw2719irl32f1qlvyb";
-  };
 
   format = "other";
 
+  src = fetchurl {
+    url = "mirror://gnome/sources/pitivi/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0mxp2p4gg976fp1vj3rb5rmpl5mqfzncm9vw2719irl32f1qlvyb";
+  };
+
   patches = [
     # By default, the build picks up environment variables like PYTHONPATH
     # and saves them to the generated binary. This would make the build-time
     # dependencies part of the closure so we remove it.
     ./prevent-closure-contamination.patch
+
+    # Port from intltool to gettext.
+    # Needed for the following patches to apply.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/pitivi/commit/89b1053f2516c594f414c5c67c835471bce44b67.patch";
+      sha256 = "8yhArzAtZC+WjHftcSDrstBlT8j6WlGHffU9Nj+ny+c=";
+      excludes = [ "po/POTFILES.in" ];
+    })
+
+    # Complete switching to gst-transcoder in gst-plugins-bad.
+    # Otherwise there will likely be conflics.
+    # TODO: Apply this patch once we are using gst-transcoder from gst-plugins-bad.
+    # (fetchpatch {
+    #   url = "https://gitlab.gnome.org/GNOME/pitivi/commit/51ae6533ee26ffd47e453eb5f5ad8cd46f57d15e.patch";
+    #   sha256 = "zxJm+E5o+oZ3lW6wYNY/ERo2g4NmCjoY8oV+uScq8j8=";
+    # })
+
+    # Generate renderer.so on macOS instead of dylib.
+    # Needed for the following patch to apply.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/pitivi/commit/bcacadcafabf8911efb0fddc8d57329237d08cd1.patch";
+      sha256 = "2BM5acIwOgdr1L9vhtMMN4trrLuqCg/K6v6ZYtD1Fjw=";
+      postFetch = ''
+        sed -i -e "s/1.90.0.1/0.999/g" "$out"
+      '';
+    })
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/pitivi/commit/0a3cc054a2c20b59f5aaaaa307de3c9af3c0d270.patch";
+      sha256 = "6DhqRlxFWFFdLwGoFem+vPt8x7v732KMVjMF9fypMK4=";
+      postFetch = ''
+        sed "$out" -i \
+          -e "s/1.90.0.1/0.999/g" \
+          -e "s/\(-python_dep.*\)/\1\n /" \
+          -e "s/-1,9 +1,16/-1,10 +1,17/"
+      '';
+    })
+  ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gettext
+    itstool
+    python3
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gobject-introspection
+    gtk3
+    librsvg
+    gnome3.gnome-desktop
+    gsound
+    gnome3.adwaita-icon-theme
+    gsettings-desktop-schemas
+    libnotify
+    gst-transcoder
+  ] ++ (with gst_all_1; [
+    gstreamer
+    gst-editing-services
+    gst-plugins-base
+    (gst-plugins-good.override { gtkSupport = true; })
+    gst-plugins-bad
+    gst-plugins-ugly
+    gst-libav
+    gst-validate
+  ]);
+
+  pythonPath = with python3Packages; [
+    pygobject3
+    gst-python
+    pyxdg
+    numpy
+    pycairo
+    matplotlib
+    dbus-python
   ];
 
   postPatch = ''
     patchShebangs ./getenvvar.py
+
+    # fetchpatch does not support renamings
+    mv data/org.pitivi.Pitivi-mime.xml data/org.pitivi.Pitivi-mime.xml.in
   '';
 
-  nativeBuildInputs = [ meson ninja pkgconfig intltool itstool python3 wrapGAppsHook ];
-
-  buildInputs = [
-    gobject-introspection gtk3 librsvg gnome3.gnome-desktop gsound
-    gnome3.adwaita-icon-theme
-    gsettings-desktop-schemas libnotify
-    gst-transcoder
-  ] ++ (with gst_all_1; [
-    gstreamer gst-editing-services
-    gst-plugins-base (gst-plugins-good.override { gtkSupport = true; })
-    gst-plugins-bad gst-plugins-ugly gst-libav gst-validate
-  ]);
-
-  pythonPath = with python3Packages; [ pygobject3 gst-python pyxdg numpy pycairo matplotlib dbus-python ];
-
   passthru = {
     updateScript = gnome3.updateScript {
       packageName = "pitivi";

pkgs/build-support/build-bazel-package/default.nix

@@ -37,6 +37,12 @@ args@{
 # Debian-specific /usr/share/java paths, but doesn't in the configured build).
 , fetchConfigured ? false
 
+# Don’t add Bazel --copt and --linkopt from NIX_CFLAGS_COMPILE /
+# NIX_LDFLAGS. This is necessary when using a custom toolchain which
+# Bazel wants all headers / libraries to come from, like when using
+# CROSSTOOL. Weirdly, we can still get the flags through the wrapped
+# compiler.
+, dontAddBazelOpts ? false
 , ...
 }:
 
@@ -170,6 +176,8 @@ in stdenv.mkDerivation (fBuildAttrs // {
     done
   '' + fBuildAttrs.preConfigure or "";
 
+  inherit dontAddBazelOpts;
+
   buildPhase = fBuildAttrs.buildPhase or ''
     runHook preBuild
 
@@ -181,6 +189,9 @@ in stdenv.mkDerivation (fBuildAttrs // {
     #
     copts=()
     host_copts=()
+    linkopts=()
+    host_linkopts=()
+    if [ -z "''${dontAddBazelOpts:-}" ]; then
       for flag in $NIX_CFLAGS_COMPILE; do
         copts+=( "--copt=$flag" )
         host_copts+=( "--host_copt=$flag" )
@@ -189,12 +200,11 @@ in stdenv.mkDerivation (fBuildAttrs // {
         copts+=( "--copt=$flag" )
         host_copts+=( "--host_copt=$flag" )
       done
-    linkopts=()
-    host_linkopts=()
       for flag in $NIX_LDFLAGS; do
         linkopts+=( "--linkopt=-Wl,$flag" )
         host_linkopts+=( "--host_linkopt=-Wl,$flag" )
       done
+    fi
 
     BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
     USER=homeless-shelter \

pkgs/data/fonts/ibm-plex/default.nix

@@ -1,7 +1,7 @@
 { lib, fetchzip }:
 
 let
-  version = "5.1.0";
+  version = "5.1.3";
 
 in fetchzip {
   name = "ibm-plex-${version}";
@@ -13,7 +13,7 @@ in fetchzip {
     unzip -j $downloadedFile "OpenType/*/*.otf" -d $out/share/fonts/opentype
   '';
 
-  sha256 = "1lcbj6zkpnsq38s2xkx3z4d7bd43k630lmzmgdcv1w05gjij0pw5";
+  sha256 = "0w07fkhav2lqdyki7ipnkpji5ngwarlhsyliy0ip7cd29x24ys5h";
 
   meta = with lib; {
     description = "IBM Plex Typeface";

pkgs/desktops/plasma-5/powerdevil.nix

@@ -30,7 +30,7 @@ mkDerivation {
     # Reduce log message spam by setting the default log level to Warning.
     (fetchpatch {
       url = "https://invent.kde.org/plasma/powerdevil/-/commit/c7590f9065ec9547b7fabad77a548bbc0c693113.patch";
-      sha256 = "0vj70mhx6qhvbh4vn9qk9ir5w4s2m76hw2lsxmh3ibgsydz4yilz";
+      sha256 = "077whhi0jrb3bajx357k7n66hv7nchis8jix0nfc1zjvi9fm6pi2";
     })
   ];
 }

pkgs/development/compilers/go/1.14.nix

@@ -31,11 +31,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.14.7";
+  version = "1.14.8";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "1qrhdjdzi1knchk1wmlaqgkqhxkq2niw14b931rhqrk36m1r4hq6";
+    sha256 = "0sp3ss9mqcysc3h7ynwxhdjq4g0id9y6liakwy2cy27mapxi79nr";
   };
 
   # perl is used for testing go vet

pkgs/development/interpreters/j/default.nix

@@ -5,12 +5,12 @@
 stdenv.mkDerivation rec {
   pname = "j";
   version = "901";
-  jtype = "release-e";
+  jtype = "release-f";
   src = fetchFromGitHub {
     owner = "jsoftware";
     repo = "jsource";
     rev = "j${version}-${jtype}";
-    sha256 = "13ky37rrl6mc66fckrdnrw64gmvq1qlv6skzd513lab4d0wigshw";
+    sha256 = "1776021m0j1aanzwg60by83n53pw7i6afd5wplfzczwk8bywax4p";
     name = "jsource";
   };
 

pkgs/development/libraries/science/math/cudnn/generic.nix

@@ -32,19 +32,20 @@ stdenv.mkDerivation {
     mkdir -p $out
     cp -a include $out/include
     cp -a lib64 $out/lib64
-
-    ${lib.optionalString (lib.versionAtLeast version "8") ''
-      # patchelf fails on libcudnn_cnn_infer due to it being too big.
-      # I'm hoping it's not needed for most programs.
-      # (https://github.com/NixOS/patchelf/issues/222)
-      rm -f $out/lib64/libcudnn_cnn_infer*
-    ''}
   '';
 
   # Set RUNPATH so that libcuda in /run/opengl-driver(-32)/lib can be found.
   # See the explanation in addOpenGLRunpath.
   postFixup = ''
-    addOpenGLRunpath $out/lib/lib*.so
+    for lib in $out/lib/lib*.so; do
+      # patchelf fails on libcudnn_cnn_infer due to it being too big.
+      # Most programs will still get the RPATH since they link to
+      # other things.
+      # (https://github.com/NixOS/patchelf/issues/222)
+      if [ "$(basename $lib)" != libcudnn_cnn_infer.so ]; then
+        addOpenGLRunpath $lib
+      fi
+    done
   '';
 
   propagatedBuildInputs = [

pkgs/development/libraries/strigi/default.nix

@@ -1,43 +0,0 @@
-{ stdenv, fetchurl, cmake, qt4, perl, bzip2, libxml2, exiv2
-, clucene_core, fam, zlib, dbus, pkgconfig
-}:
-
-stdenv.mkDerivation rec {
-  pname = "strigi";
-  version = "0.7.8";
-
-  src = fetchurl {
-    url = "https://www.vandenoever.info/software/strigi/${pname}-${version}.tar.bz2";
-    sha256 = "12grxzqwnvbyqw7q1gnz42lypadxmq89vk2qpxczmpmc4nk63r23";
-  };
-
-  includeAllQtDirs = true;
-
-  CLUCENE_HOME = clucene_core;
-
-  buildInputs =
-    [ zlib bzip2 libxml2 qt4 exiv2 clucene_core fam dbus.out ];
-
-  nativeBuildInputs = [ cmake pkgconfig perl ];
-
-  patches = [ ./export_bufferedstream.patch ./gcc6.patch ];
-
-  enableParallelBuilding = true;
-
-  # Strigi installs some libraries in an incorrect place
-  # ($out/$out/lib instead of $out/lib), so move them to the right
-  # place.
-  postInstall =
-    ''
-      mv $out/$out/lib/* $out/lib
-      rm -rf $out/nix
-    '';
-
-  meta = {
-    homepage = "http://strigi.sourceforge.net";
-    description = "A very fast and efficient crawler to index data on your harddrive";
-    license = "LGPL";
-    maintainers = with stdenv.lib.maintainers; [ sander ];
-    inherit (qt4.meta) platforms;
-  };
-}

pkgs/development/libraries/strigi/export_bufferedstream.patch

@@ -1,12 +0,0 @@
-diff -u -r strigi-0.7.8/libstreams/include/strigi/bufferedstream.h strigi-0.7.8_new/libstreams/include/strigi/bufferedstream.h
---- strigi-0.7.8/libstreams/include/strigi/bufferedstream.h	2013-02-05 13:34:57.000000000 -0800
-+++ strigi-0.7.8_new/libstreams/include/strigi/bufferedstream.h	2013-07-14 17:01:54.000000000 -0700
-@@ -34,7 +34,7 @@
-  * BufferedStream will do the rest.
-  */
- template <class T>
--class BufferedStream : public StreamBase<T> {
-+class STRIGI_EXPORT BufferedStream : public StreamBase<T> {
- private:
-     StreamBuffer<T> buffer;
-     bool finishedWritingToBuffer;

pkgs/development/libraries/strigi/gcc6.patch

@@ -1,45 +0,0 @@
-https://sourceforge.net/p/strigi/patches/4/
-
-and a fix for
-
-/tmp/nix-build-strigi-0.7.8.drv-0/strigi-0.7.8/libstreamanalyzer/plugins/indexers/clucenengindexer/cluceneindexreader.cpp:325:37: error: no matching function for call to 'make_pair(std::__cxx11::string, std::__cxx11::string&)'
-             wchartoutf8(name), value));
-
-diff -Naur strigi-0.7.8.old/libstreamanalyzer/cmake/MacroCheckGccVisibility.cmake strigi-0.7.8/libstreamanalyzer/cmake/MacroCheckGccVisibility.cmake
---- strigi-0.7.8.old/libstreamanalyzer/cmake/MacroCheckGccVisibility.cmake	2013-02-05 16:34:52.000000000 -0500
-+++ strigi-0.7.8/libstreamanalyzer/cmake/MacroCheckGccVisibility.cmake	2016-05-14 11:39:54.586260564 -0400
-@@ -15,7 +15,7 @@
-    # get the gcc version
-    exec_program(${CMAKE_C_COMPILER} ARGS ${CMAKE_C_COMPILER_ARG1} --version OUTPUT_VARIABLE _gcc_version_info)
- 
--   string (REGEX MATCH "[345]\\.[0-9]\\.[0-9]" _gcc_version "${_gcc_version_info}")
-+   string (REGEX MATCH "[3456789]\\.[0-9]\\.[0-9]" _gcc_version "${_gcc_version_info}")
-    # gcc on mac just reports: "gcc (GCC) 3.3 20030304 ..." without the patch level, handle this here:
-    if (NOT _gcc_version)
-       string (REGEX REPLACE ".*\\(GCC\\).* ([34]\\.[0-9]) .*" "\\1.0" _gcc_version "${_gcc_version_info}")
-diff -Naur strigi-0.7.8.old/libstreams/cmake/MacroCheckGccVisibility.cmake strigi-0.7.8/libstreams/cmake/MacroCheckGccVisibility.cmake
---- strigi-0.7.8.old/libstreams/cmake/MacroCheckGccVisibility.cmake	2013-02-05 16:34:57.000000000 -0500
-+++ strigi-0.7.8/libstreams/cmake/MacroCheckGccVisibility.cmake	2016-05-14 11:40:11.340134414 -0400
-@@ -15,7 +15,7 @@
-    # get the gcc version
-    exec_program(${CMAKE_C_COMPILER} ARGS ${CMAKE_C_COMPILER_ARG1} --version OUTPUT_VARIABLE _gcc_version_info)
- 
--   string (REGEX MATCH "[345]\\.[0-9]\\.[0-9]" _gcc_version "${_gcc_version_info}")
-+   string (REGEX MATCH "[3456789]\\.[0-9]\\.[0-9]" _gcc_version "${_gcc_version_info}")
-    # gcc on mac just reports: "gcc (GCC) 3.3 20030304 ..." without the patch level, handle this here:
-    if (NOT _gcc_version)
-       string (REGEX REPLACE ".*\\(GCC\\).* ([34]\\.[0-9]) .*" "\\1.0" _gcc_version "${_gcc_version_info}")
-
-diff -ru strigi-0.7.8-orig/libstreamanalyzer/plugins/indexers/clucenengindexer/cluceneindexreader.cpp strigi-0.7.8/libstreamanalyzer/plugins/indexers/clucenengindexer/cluceneindexreader.cpp
---- strigi-0.7.8-orig/libstreamanalyzer/plugins/indexers/clucenengindexer/cluceneindexreader.cpp	2013-02-05 22:34:52.000000000 +0100
-+++ strigi-0.7.8/libstreamanalyzer/plugins/indexers/clucenengindexer/cluceneindexreader.cpp	2017-07-31 10:56:27.067902643 +0200
-@@ -321,8 +321,7 @@
-         string size = value;
-         doc.size = atoi(size.c_str());
-     } else {
--        doc.properties.insert(make_pair<const string, string>(
--            wchartoutf8(name), value));
-+        doc.properties.emplace(wchartoutf8(name), value);
-     }
- }
- Variant

pkgs/development/ocaml-modules/re/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, buildDunePackage, ounit, seq }:
+{ lib, fetchzip, buildDunePackage, ocaml, ounit, seq }:
 
 buildDunePackage rec {
   pname = "re";
@@ -11,14 +11,14 @@ buildDunePackage rec {
     sha256 = "07ycb103mr4mrkxfd63cwlsn023xvcjp0ra0k7n2gwrg0mwxmfss";
   };
 
-  buildInputs = [ ounit ];
+  buildInputs = lib.optional doCheck ounit;
   propagatedBuildInputs = [ seq ];
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.04";
 
   meta = {
     homepage = "https://github.com/ocaml/ocaml-re";
     description = "Pure OCaml regular expressions, with support for Perl and POSIX-style strings";
-    license = stdenv.lib.licenses.lgpl2;
+    license = lib.licenses.lgpl2;
-    maintainers = with stdenv.lib.maintainers; [ vbgl ];
+    maintainers = with lib.maintainers; [ vbgl ];
   };
 }

pkgs/development/python-modules/asgi-csrf/default.nix

@@ -0,0 +1,31 @@
+{ stdenv, buildPythonPackage, isPy27, fetchFromGitHub, itsdangerous, python-multipart
+, pytest, starlette, httpx, pytest-asyncio }:
+
+buildPythonPackage rec {
+  version = "0.7";
+  pname = "asgi-csrf";
+  disabled = isPy27;
+
+  # PyPI tarball doesn't include tests directory
+  src = fetchFromGitHub {
+    owner = "simonw";
+    repo = pname;
+    rev = version;
+    sha256 = "1vf4lh007790836cp3hd6wf8wsgj045dcg0w1cm335p08zz6j4k7";
+  };
+
+  propagatedBuildInputs = [ itsdangerous python-multipart ];
+
+  checkInputs = [ pytest starlette httpx pytest-asyncio ];
+  checkPhase = ''
+    pytest test_asgi_csrf.py
+  '';
+  pythonImportsCheck = [ "asgi_csrf" ];
+
+  meta = with stdenv.lib; {
+    description = "ASGI middleware for protecting against CSRF attacks";
+    license = licenses.asl20;
+    homepage = "https://github.com/simonw/asgi-csrf";
+    maintainers = [ maintainers.ris ];
+  };
+}

pkgs/development/python-modules/cirq/default.nix

@@ -48,6 +48,15 @@ buildPythonPackage rec {
     })
   ];
 
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace "freezegun~=0.3.15" "freezegun" \
+      --replace "matplotlib~=3.0" "matplotlib" \
+      --replace "networkx~=2.4" "networkx" \
+      --replace "numpy~=1.16, < 1.19" "numpy" \
+      --replace "protobuf~=3.12.0" "protobuf"
+  '';
+
   propagatedBuildInputs = [
     freezegun
     google_api_core
@@ -64,7 +73,7 @@ buildPythonPackage rec {
   ];
 
   doCheck = true;
-  # pythonImportsCheck = [ "cirq" "cirq.Ciruit" ];  # cirq's importlib hook doesn't work here
+  # pythonImportsCheck = [ "cirq" "cirq.Circuit" ];  # cirq's importlib hook doesn't work here
   dontUseSetuptoolsCheck = true;
   checkInputs = [
     pytestCheckHook
@@ -78,16 +87,10 @@ buildPythonPackage rec {
 
   pytestFlagsArray = [
     "--ignore=dev_tools"  # Only needed when developing new code, which is out-of-scope
+    "--benchmark-disable" # Don't need to run benchmarks when packaging.
   ];
   disabledTests = [
-    "test_serialize_sympy_constants"  # fails due to small error in pi (~10e-7)
+    "test_convert_to_ion_gates" # fails on some systems due to rounding error, 0.75 != 0.750...2
-    "test_convert_to_ion_gates" # fails due to rounding error, 0.75 != 0.750...2
-
-    # Newly disabled tests on cirq 0.8
-    # TODO: test & figure out why failing
-    "engine_job_test"
-    "test_health"
-    "test_run_delegation"
   ] ++ lib.optionals stdenv.isAarch64 [
     # Seem to fail due to math issues on aarch64?
     "expectation_from_wavefunction"
@@ -97,6 +100,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "A framework for creating, editing, and invoking Noisy Intermediate Scale Quantum (NISQ) circuits.";
     homepage = "https://github.com/quantumlib/cirq";
+    changelog = "https://github.com/quantumlib/Cirq/releases/tag/v${version}";
     license = licenses.asl20;
     maintainers = with maintainers; [ drewrisinger ];
   };

pkgs/development/python-modules/datasette/default.nix

@@ -2,19 +2,22 @@
 , buildPythonPackage
 , fetchFromGitHub
 , aiofiles
+, asgi-csrf
 , click
 , click-default-group
 , janus
 , jinja2
 , hupper
+, mergedeep
 , pint
 , pluggy
+, python-baseconv
+, pyyaml
 , uvicorn
 # Check Inputs
 , pytestCheckHook
 , pytestrunner
 , pytest-asyncio
-, black
 , aiohttp
 , beautifulsoup4
 , asgiref
@@ -23,26 +26,30 @@
 
 buildPythonPackage rec {
   pname = "datasette";
-  version = "0.39";
+  version = "0.46";
 
   src = fetchFromGitHub {
     owner = "simonw";
     repo = "datasette";
     rev = version;
-    sha256 = "07d46512bc9sdan9lv39sf1bwlf7vf1bfhcsm825vk7sv7g9kczd";
+    sha256 = "0g4dfq5ykifa9628cb4i7gvx98p8hvb99gzfxk3bkvq1v9p4kcqq";
   };
 
   nativeBuildInputs = [ pytestrunner ];
 
   propagatedBuildInputs = [
     aiofiles
+    asgi-csrf
     click
     click-default-group
     janus
     jinja2
     hupper
+    mergedeep
     pint
     pluggy
+    python-baseconv
+    pyyaml
     uvicorn
     setuptools
   ];
@@ -52,7 +59,6 @@ buildPythonPackage rec {
     pytest-asyncio
     aiohttp
     beautifulsoup4
-    black
     asgiref
   ];
 
@@ -60,22 +66,17 @@ buildPythonPackage rec {
     substituteInPlace setup.py \
       --replace "click~=7.1.1" "click" \
       --replace "click-default-group~=1.2.2" "click-default-group" \
-      --replace "Jinja2~=2.10.3" "Jinja2" \
       --replace "hupper~=1.9" "hupper" \
       --replace "pint~=0.9" "pint" \
-      --replace "pluggy~=0.13.0" "pint" \
+      --replace "pluggy~=0.13.0" "pluggy" \
       --replace "uvicorn~=0.11" "uvicorn" \
-      --replace "aiofiles~=0.4.0" "aiofiles" \
-      --replace "janus~=0.4.0" "janus" \
       --replace "PyYAML~=5.3" "PyYAML"
   '';
 
-  # many tests require network access
+  # test_html is very slow
   # test_black fails on darwin
   dontUseSetuptoolsCheck = true;
   pytestFlagsArray = [
-    "--ignore=tests/test_api.py"
-    "--ignore=tests/test_csv.py"
     "--ignore=tests/test_html.py"
     "--ignore=tests/test_docs.py"
     "--ignore=tests/test_black.py"
@@ -84,6 +85,7 @@ buildPythonPackage rec {
     "facet"
     "_invalid_database" # checks error message when connecting to invalid database
   ];
+  pythonImportsCheck = [ "datasette" ];
 
   meta = with lib; {
     description = "An instant JSON API for your SQLite databases";

pkgs/development/python-modules/elasticsearch/default.nix

@@ -7,11 +7,11 @@
 
 buildPythonPackage (rec {
   pname = "elasticsearch";
-  version = "7.8.1";
+  version = "7.9.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "92b534931865a186906873f75ae0b91808ff5036b0f2b9269eb5f6dc09644b55";
+    sha256 = "5e08776fbb30c6e92408c7fa8c37d939210d291475ae2f364f0497975918b6fe";
   };
 
   # Check is disabled because running them destroy the content of the local cluster!

pkgs/development/python-modules/httpcore/default.nix

@@ -0,0 +1,34 @@
+{ stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, isPy27
+, h11
+, sniffio
+}:
+
+buildPythonPackage rec {
+  pname = "httpcore";
+  version = "0.10.2";
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "encode";
+    repo = pname;
+    rev = version;
+    sha256 = "00gn8nfv814rg6fj7xv97mrra3fvx6fzjcgx9y051ihm6hxljdsi";
+  };
+
+  propagatedBuildInputs = [ h11 sniffio ];
+
+  # tests require pythonic access to mitmproxy, which isn't (yet?) packaged as
+  # a pythonPackage.
+  doCheck = false;
+  pythonImportsCheck = [ "httpcore" ];
+
+  meta = with stdenv.lib; {
+    description = "A minimal HTTP client";
+    homepage = "https://github.com/encode/httpcore";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.ris ];
+  };
+}

pkgs/development/python-modules/httpx/default.nix

@@ -2,64 +2,60 @@
 , buildPythonPackage
 , fetchFromGitHub
 , certifi
-, hstspreload
 , chardet
 , h11
 , h2
+, httpcore
 , idna
 , rfc3986
 , sniffio
 , isPy27
 , pytest
+, pytest-asyncio
+, pytest-trio
 , pytestcov
 , trustme
 , uvicorn
-, trio
 , brotli
-, urllib3
 }:
 
 buildPythonPackage rec {
   pname = "httpx";
-  version = "0.12.1";
+  version = "0.14.2";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "encode";
     repo = pname;
     rev = version;
-    sha256 = "1nrp4h1ppb5vll81fzxmks82p0hxcil9f3mja3dgya511kc703h6";
+    sha256 = "08b6k5g8car3bic90aw4ysb2zvsa5nm8qk3hk4dgamllnnxzl5br";
   };
 
   propagatedBuildInputs = [
     certifi
-    hstspreload
     chardet
     h11
     h2
+    httpcore
     idna
     rfc3986
     sniffio
-    urllib3
   ];
 
   checkInputs = [
     pytest
+    pytest-asyncio
+    pytest-trio
     pytestcov
     trustme
     uvicorn
-    trio
     brotli
   ];
 
-  postPatch = ''
-    substituteInPlace setup.py \
-          --replace "h11==0.8.*" "h11"
-  '';
-
   checkPhase = ''
-    PYTHONPATH=.:$PYTHONPATH pytest
+    PYTHONPATH=.:$PYTHONPATH pytest -k 'not (test_connect_timeout or test_elapsed_timer)'
   '';
+  pythonImportsCheck = [ "httpx" ];
 
   meta = with lib; {
     description = "The next generation HTTP client";

pkgs/development/python-modules/jupyterhub-ldapauthenticator/default.nix

@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "jupyterhub-ldapauthenticator";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "913cc67a1e8c50e7e301a16f25a4125ffd020a7c5dd22ccfb3f7707af2ee9157";
+    sha256 = "12xby5j7wmi6qsbb2fjd5qbckkcg5fmdij8qpc9n7ci8vfxq303m";
   };
 
   # No tests implemented

pkgs/development/python-modules/matrix-nio/default.nix

@@ -20,13 +20,13 @@
 
 buildPythonPackage rec {
   pname = "matrix-nio";
-  version = "0.14.1";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "poljar";
     repo = "matrix-nio";
     rev = version;
-    sha256 = "0mgb9m3298jvw3wa051zn7vp1m8qriys3ps0qn3sq54fndljgg5k";
+    sha256 = "127n4sqdcip1ld42w9wz49pxkpvi765qzvivvwl26720n11zq5cd";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/mergedeep/default.nix

@@ -0,0 +1,26 @@
+{ stdenv, buildPythonPackage, isPy27, fetchFromGitHub, pytest }:
+
+buildPythonPackage rec {
+  pname = "mergedeep";
+  version = "1.3.0";
+  disabled = isPy27;
+
+  # PyPI tarball doesn't include tests directory
+  src = fetchFromGitHub {
+    owner = "clarketm";
+    repo = "mergedeep";
+    rev = "v${version}";
+    sha256 = "1a0y26a04limiggjwqyyqpryxiylbqya74nq1bij75zhz42sa02b";
+  };
+
+  checkInputs = [ pytest ];
+  checkPhase = "pytest";
+  pythonImportsCheck = [ "mergedeep" ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/clarketm/mergedeep";
+    description = "A deep merge function for python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ris ];
+  };
+}

pkgs/development/python-modules/phonopy/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, python, fetchPypi, numpy, pyyaml, matplotlib, h5py }:
+{ stdenv, buildPythonPackage, python, fetchPypi, numpy, pyyaml, matplotlib, h5py, spglib, pytestCheckHook }:
 
 buildPythonPackage rec {
   pname = "phonopy";
@@ -9,15 +9,15 @@ buildPythonPackage rec {
     sha256 = "482c6ff29c058d091ac885e561e28ba3e516ea9e91c44a951cad11f3ae19856c";
   };
 
-  propagatedBuildInputs = [ numpy pyyaml matplotlib h5py ];
+  propagatedBuildInputs = [ numpy pyyaml matplotlib h5py spglib ];
 
-  checkPhase = ''
+  checkInputs = [ pytestCheckHook ];
-    cd test
+  # flakey due to floating point inaccuracy
-    # dynamic structure factor test ocassionally fails do to roundoff
+  disabledTests = [ "test_NaCl" ];
-    # see issue https://github.com/atztogo/phonopy/issues/79
+
-    rm spectrum/test_dynamic_structure_factor.py
+  # prevent pytest from importing local directory
-    ${python.interpreter} -m unittest discover -b
+  preCheck = ''
-    cd ../..
+    rm -r phonopy
   '';
 
   meta = with stdenv.lib; {

pkgs/development/python-modules/starlette/default.nix

@@ -21,19 +21,14 @@
 buildPythonPackage rec {
   pname = "starlette";
 
-  # This is not the latest version of Starlette, however, later
+  version = "0.13.8";
-  # versions of Starlette break FastAPI due to
-  # https://github.com/tiangolo/fastapi/issues/683. Please update when
-  # possible. FastAPI is currently Starlette's only dependent.
-
-  version = "0.13.6";
   disabled = isPy27;
 
   src = fetchFromGitHub {
     owner = "encode";
     repo = pname;
     rev = version;
-    sha256 = "08d1d4qdwhi1xxag4am5ijingdyn0mbyqajs9ql5shxnybyjv321";
+    sha256 = "11i0yd8cqwscixajl734g11vf8pghki11c81chzfh8ifmj6mf9jk";
   };
 
   propagatedBuildInputs = [
@@ -57,6 +52,7 @@ buildPythonPackage rec {
   checkPhase = ''
     pytest --ignore=tests/test_graphql.py
   '';
+  pythonImportsCheck = [ "starlette" ];
 
   meta = with lib; {
     homepage = "https://www.starlette.io/";

pkgs/development/tools/build-managers/bazel/bazel_0_26/default.nix

@@ -236,6 +236,8 @@ stdenv.mkDerivation rec {
       fetch --experimental_distdir=${distDir}
       build --copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt="/g')"
       build --host_copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt="/g')"
+      build --linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt="/g')"
+      build --host_linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt="/g')"
       build --linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt="-Wl,/g')"
       build --host_linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt="-Wl,/g')"
       build --host_javabase='@local_jdk//:jdk'
@@ -245,6 +247,8 @@ stdenv.mkDerivation rec {
       # add the same environment vars to compile.sh
       sed -e "/\$command \\\\$/a --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\" \\\\" \
           -e "/\$command \\\\$/a --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt=\"/g')\" \\\\" \
           -e "/\$command \\\\$/a --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\" \\\\" \
           -e "/\$command \\\\$/a --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\" \\\\" \
           -e "/\$command \\\\$/a --host_javabase='@local_jdk//:jdk' \\\\" \

pkgs/development/tools/build-managers/bazel/bazel_0_29/default.nix

@@ -417,6 +417,8 @@ stdenv.mkDerivation rec {
       fetch --distdir=${distDir}
       build --copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt="/g')"
       build --host_copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt="/g')"
+      build --linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt="/g')"
+      build --host_linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt="/g')"
       build --linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt="-Wl,/g')"
       build --host_linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt="-Wl,/g')"
       build --host_javabase='@local_jdk//:jdk'
@@ -426,6 +428,8 @@ stdenv.mkDerivation rec {
       # add the same environment vars to compile.sh
       sed -e "/\$command \\\\$/a --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\" \\\\" \
           -e "/\$command \\\\$/a --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt=\"/g')\" \\\\" \
           -e "/\$command \\\\$/a --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\" \\\\" \
           -e "/\$command \\\\$/a --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\" \\\\" \
           -e "/\$command \\\\$/a --host_javabase='@local_jdk//:jdk' \\\\" \

pkgs/development/tools/build-managers/bazel/bazel_1/default.nix

@@ -417,6 +417,8 @@ stdenv.mkDerivation rec {
       fetch --distdir=${distDir}
       build --copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt="/g')"
       build --host_copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt="/g')"
+      build --linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt="/g')"
+      build --host_linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt="/g')"
       build --linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt="-Wl,/g')"
       build --host_linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt="-Wl,/g')"
       build --host_javabase='@local_jdk//:jdk'
@@ -426,6 +428,8 @@ stdenv.mkDerivation rec {
       # add the same environment vars to compile.sh
       sed -e "/\$command \\\\$/a --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\" \\\\" \
           -e "/\$command \\\\$/a --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt=\"/g')\" \\\\" \
           -e "/\$command \\\\$/a --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\" \\\\" \
           -e "/\$command \\\\$/a --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\" \\\\" \
           -e "/\$command \\\\$/a --host_javabase='@local_jdk//:jdk' \\\\" \

pkgs/development/tools/build-managers/bazel/bazel_3/default.nix

@@ -429,6 +429,8 @@ stdenv.mkDerivation rec {
       fetch --distdir=${distDir}
       build --copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt="/g')"
       build --host_copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt="/g')"
+      build --linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt="/g')"
+      build --host_linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt="/g')"
       build --linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt="-Wl,/g')"
       build --host_linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt="-Wl,/g')"
       build --host_javabase='@local_jdk//:jdk'
@@ -438,6 +440,8 @@ stdenv.mkDerivation rec {
       # add the same environment vars to compile.sh
       sed -e "/\$command \\\\$/a --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\" \\\\" \
           -e "/\$command \\\\$/a --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt=\"/g')\" \\\\" \
           -e "/\$command \\\\$/a --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\" \\\\" \
           -e "/\$command \\\\$/a --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\" \\\\" \
           -e "/\$command \\\\$/a --host_javabase='@local_jdk//:jdk' \\\\" \

pkgs/development/tools/dep2nix/deps.nix

@@ -1,17 +1,14 @@
-
+# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-  # file automatically generated from Gopkg.lock with https://github.com/nixcloud/dep2nix (golang dep)
 [
-  
   {
     goPackagePath  = "github.com/Masterminds/semver";
     fetch = {
       type = "git";
-        url = "https://github.com/Masterminds/semver";
+      url = "https://github.com/carolynvs/semver.git";
       rev =  "a93e51b5a57ef416dac8bb02d11407b6f55d8929";
       sha256 = "1rd3p135r7iw0lvaa6vk7afxna87chq61a7a0wqnxd3xgpnpa9ik";
     };
   }
-    
   {
     goPackagePath  = "github.com/Masterminds/vcs";
     fetch = {
@@ -21,7 +18,6 @@
       sha256 = "02bpyzccazw9lwqchcz349al4vlxnz4m5gzwigk02zg2qpa1j53j";
     };
   }
-    
   {
     goPackagePath  = "github.com/armon/go-radix";
     fetch = {
@@ -31,7 +27,6 @@
       sha256 = "19jws9ngncpbhghzcy7biyb4r8jh14mzknyk67cvq6ln7kh1qyic";
     };
   }
-    
   {
     goPackagePath  = "github.com/boltdb/bolt";
     fetch = {
@@ -41,7 +36,6 @@
       sha256 = "0z7j06lijfi4y30ggf2znak2zf2srv2m6c68ar712wd2ys44qb3r";
     };
   }
-    
   {
     goPackagePath  = "github.com/golang/dep";
     fetch = {
@@ -51,7 +45,6 @@
       sha256 = "1knaxs1ji1b0b68393f24r8qzvahxz9x7rqwc8jsjlshvpz0hlm6";
     };
   }
-    
   {
     goPackagePath  = "github.com/golang/protobuf";
     fetch = {
@@ -61,7 +54,6 @@
       sha256 = "1pyli3dcagi7jzpiazph4fhkz7a3z4bhd25nwbb7g0iy69b8z1g4";
     };
   }
-    
   {
     goPackagePath  = "github.com/jmank88/nuts";
     fetch = {
@@ -71,7 +63,6 @@
       sha256 = "1d0xj1dj1lfalq3pg15h0c645n84lf122xx3zkm7hawq9zri6n5k";
     };
   }
-    
   {
     goPackagePath  = "github.com/nightlyone/lockfile";
     fetch = {
@@ -81,7 +72,6 @@
       sha256 = "03znnf6rzyyi4h4qj81py1xpfs3pnfm39j4bfc9qzakz5j9y1gdl";
     };
   }
-    
   {
     goPackagePath  = "github.com/pelletier/go-toml";
     fetch = {
@@ -91,7 +81,6 @@
       sha256 = "1y5m9pngxhsfzcnxh8ma5nsllx74wn0jr47p2n6i3inrjqxr12xh";
     };
   }
-    
   {
     goPackagePath  = "github.com/pkg/errors";
     fetch = {
@@ -101,7 +90,6 @@
       sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
     };
   }
-    
   {
     goPackagePath  = "github.com/sdboyer/constext";
     fetch = {
@@ -111,7 +99,6 @@
       sha256 = "0055yw73di4spa1wwpa2pyb708wmh9r3xd8dcv8pn81dba94if1w";
     };
   }
-    
   {
     goPackagePath  = "golang.org/x/net";
     fetch = {
@@ -121,7 +108,6 @@
       sha256 = "0gkw1am63agb1rgpxr2qhns9npr99mzwrxg7px88qq8h93zzd4kg";
     };
   }
-    
   {
     goPackagePath  = "golang.org/x/sync";
     fetch = {
@@ -131,7 +117,6 @@
       sha256 = "12lzldlj1cqc1babp1hkkn76fglzn5abkqvmbpr4f2j95mf9x836";
     };
   }
-    
   {
     goPackagePath  = "golang.org/x/sys";
     fetch = {
@@ -141,5 +126,4 @@
       sha256 = "1abrr2507a737hdqv4q7pw7hv6ls9pdiq9crhdi52r3gcz6hvizg";
     };
   }
-    
 ]

pkgs/development/tools/leaps/deps.nix

@@ -1,7 +1,5 @@
-
+# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-  # file automatically generated from Gopkg.lock with https://github.com/nixcloud/dep2nix (golang dep)
 [
-  
   {
     goPackagePath  = "github.com/Azure/go-autorest";
     fetch = {
@@ -11,7 +9,6 @@
       sha256 = "1j6aqbizlpiqcywdsj4dy4i76g8fbqc7d61c22ppc9knw0968h4r";
     };
   }
-    
   {
     goPackagePath  = "github.com/Jeffail/gabs";
     fetch = {
@@ -21,7 +18,6 @@
       sha256 = "1fx6fyl5x037viwlj319f3gsq749an17q5l6n2zvf3ny5wq0iqxr";
     };
   }
-    
   {
     goPackagePath  = "github.com/amir/raidman";
     fetch = {
@@ -31,7 +27,6 @@
       sha256 = "074ckbyslrwn23q4x01hn3j7c3xngagn36lbli2g51n9j3x14jxr";
     };
   }
-    
   {
     goPackagePath  = "github.com/azure/azure-sdk-for-go";
     fetch = {
@@ -41,7 +36,6 @@
       sha256 = "0zlhrh3n9mc5w7r0sdaqmpqfm2d290b50an0k1bvrr892m4cnxaq";
     };
   }
-    
   {
     goPackagePath  = "github.com/cenkalti/backoff";
     fetch = {
@@ -51,7 +45,6 @@
       sha256 = "08x77mgb9zsj047n74rx6c16jjx985lmy4s6fl58mdgxgxjv54y5";
     };
   }
-    
   {
     goPackagePath  = "github.com/dgrijalva/jwt-go";
     fetch = {
@@ -61,7 +54,6 @@
       sha256 = "0zk6l6kzsjdijfn7c4h0aywdjx5j2hjwi67vy1k6wr46hc8ks2hs";
     };
   }
-    
   {
     goPackagePath  = "github.com/elazarl/go-bindata-assetfs";
     fetch = {
@@ -71,7 +63,6 @@
       sha256 = "1swfb37g6sga3awvcmxf49ngbpvjv7ih5an9f8ixjqcfcwnb7nzp";
     };
   }
-    
   {
     goPackagePath  = "github.com/garyburd/redigo";
     fetch = {
@@ -81,7 +72,6 @@
       sha256 = "0gw18k9kg93hvdks93hckrdqppg1bav82sp2c98q6z36dkvaih24";
     };
   }
-    
   {
     goPackagePath  = "github.com/go-sql-driver/mysql";
     fetch = {
@@ -91,7 +81,6 @@
       sha256 = "1rw1m91dpm23s6nn6jc4zi6rq2mgl7zx07gyadrdn0sh7cj8c89d";
     };
   }
-    
   {
     goPackagePath  = "github.com/golang/protobuf";
     fetch = {
@@ -101,7 +90,6 @@
       sha256 = "1d3zjvhl115l23xakj0014qpjchivlg098h10v5nfirkk1i9f9sa";
     };
   }
-    
   {
     goPackagePath  = "github.com/gorilla/websocket";
     fetch = {
@@ -111,7 +99,6 @@
       sha256 = "1bhgs2542qs49p1dafybqxfs2qc072xv41w5nswyrknwyjxxs2a1";
     };
   }
-    
   {
     goPackagePath  = "github.com/kardianos/osext";
     fetch = {
@@ -121,7 +108,6 @@
       sha256 = "056dkgxrqjj5r18bnc3knlpgdz5p3yvp12y4y978hnsfhwaqvbjz";
     };
   }
-    
   {
     goPackagePath  = "github.com/lib/pq";
     fetch = {
@@ -131,7 +117,6 @@
       sha256 = "02y7c8xy33x5q4167x2drzrys41nfi7wxxp9hy4vpazfws88al9p";
     };
   }
-    
   {
     goPackagePath  = "github.com/marstr/guid";
     fetch = {
@@ -141,7 +126,6 @@
       sha256 = "1mxcigzfc1bbh5b616hm89bp06allhwcsas9v9lks235h0acgn4x";
     };
   }
-    
   {
     goPackagePath  = "github.com/satori/go.uuid";
     fetch = {
@@ -151,7 +135,6 @@
       sha256 = "1j4s5pfg2ldm35y8ls8jah4dya2grfnx2drb4jcbjsyrp4cm5yfb";
     };
   }
-    
   {
     goPackagePath  = "golang.org/x/net";
     fetch = {
@@ -161,25 +144,22 @@
       sha256 = "1hmpqkxh97ayyy0xcdvf1bwirwja4wyin3sh0fzjlh93aqmqgylf";
     };
   }
-    
   {
     goPackagePath  = "gopkg.in/alexcesaro/statsd.v2";
     fetch = {
       type = "git";
-        url = "https://gopkg.in/alexcesaro/statsd.v2";
+      url = "https://github.com/alexcesaro/statsd";
       rev =  "7fea3f0d2fab1ad973e641e51dba45443a311a90";
       sha256 = "02jdx68vicwsgabrnwgg1rvc45rinyh8ikinqgbqc56c5hkx3brj";
     };
   }
-    
   {
     goPackagePath  = "gopkg.in/yaml.v2";
     fetch = {
       type = "git";
-        url = "https://gopkg.in/yaml.v2";
+      url = "https://github.com/go-yaml/yaml";
       rev =  "d670f9405373e636a5a2765eea47fac0c9bc91a4";
       sha256 = "1w1xid51n8v1mydn2m3vgggw8qgpd5a5sr62snsc77d99fpjsrs0";
     };
   }
-    
 ]

pkgs/development/tools/ocaml/ocp-index/default.nix

@@ -1,15 +1,15 @@
-{ lib, fetchurl, buildDunePackage, ocp-build, ocp-indent, cmdliner, re }:
+{ lib, fetchzip, buildDunePackage, cppo, ocp-indent, cmdliner, re }:
 
 buildDunePackage rec {
   pname = "ocp-index";
-  version = "1.2";
+  version = "1.2.1";
 
-  src = fetchurl {
+  src = fetchzip {
-    url = "https://github.com/OCamlPro/ocp-index/releases/download/${version}/ocp-index-${version}.tbz";
+    url = "https://github.com/OCamlPro/ocp-index/archive/${version}.tar.gz";
-    sha256 = "1lchw02sakjjppmzr0rzlarwbg1lc2bl7pwcfpsiycnaz46x6gmr";
+    sha256 = "08r7mxdnxmhff37fw4hmrpjgckgi5kaiiiirwp4rmdl594z0h9c8";
   };
 
-  buildInputs = [ ocp-build cmdliner re ];
+  buildInputs = [ cppo cmdliner re ];
 
   propagatedBuildInputs = [ ocp-indent ];
 

pkgs/development/tools/rust/rustup/default.nix

@@ -1,7 +1,13 @@
 { stdenv, lib, runCommand, patchelf
-, fetchFromGitHub, rustPlatform
+, fetchFromGitHub, rustPlatform, makeWrapper
 , pkgconfig, curl, zlib, Security, CoreServices }:
 
+let
+  libPath = lib.makeLibraryPath [
+    zlib # libz.so.1
+  ];
+in
+
 rustPlatform.buildRustPackage rec {
   pname = "rustup";
   version = "1.22.1";
@@ -15,7 +21,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoSha256 = "0ghjrx7y25s6rjp06h0iyv4195x7daj57bqza01i1j4hm5nkhqhi";
 
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ makeWrapper pkgconfig ];
 
   buildInputs = [
     curl zlib
@@ -24,11 +30,6 @@ rustPlatform.buildRustPackage rec {
   cargoBuildFlags = [ "--features no-self-update" ];
 
   patches = lib.optionals stdenv.isLinux [
-    (let
-      libPath = lib.makeLibraryPath [
-        zlib # libz.so.1
-      ];
-    in
     (runCommand "0001-dynamically-patchelf-binaries.patch" { CC=stdenv.cc; patchelf = patchelf; libPath = "$ORIGIN/../lib:${libPath}"; } ''
      export dynamicLinker=$(cat $CC/nix-support/dynamic-linker)
      substitute ${./0001-dynamically-patchelf-binaries.patch} $out \
@@ -36,7 +37,6 @@ rustPlatform.buildRustPackage rec {
        --subst-var dynamicLinker \
        --subst-var libPath
     '')
-    )
   ];
 
   doCheck = !stdenv.isAarch64 && !stdenv.isDarwin;
@@ -53,6 +53,8 @@ rustPlatform.buildRustPackage rec {
     done
     popd
 
+    wrapProgram $out/bin/rustup --prefix "LD_LIBRARY_PATH" : "${libPath}"
+
     # tries to create .rustup
     export HOME=$(mktemp -d)
     mkdir -p "$out/share/"{bash-completion/completions,fish/vendor_completions.d,zsh/site-functions}

pkgs/development/tools/selenium/chromedriver/default.nix

@@ -1,17 +1,17 @@
 { stdenv, fetchurl, cairo, fontconfig, freetype, gdk-pixbuf, glib
 , glibc, gtk2, libX11, makeWrapper, nspr, nss, pango, unzip, gconf
-, libXi, libXrender, libXext
+, libxcb, libXi, libXrender, libXext
 }:
 let
   allSpecs = {
     x86_64-linux = {
       system = "linux64";
-      sha256 = "149p43zaz45malmff1274r2bwjcyjwsdickivk3pd0mvnjbfid2r";
+      sha256 = "0absr1fp2h87gpyw6jxj2f08sbhkkh3pf13145hfyzdvajj5rfjy";
     };
 
     x86_64-darwin = {
       system = "mac64";
-      sha256 = "1xpyqxpsz3r653ls67s6alv4g2vr4lxf29gyxc162ikywyrx80nr";
+      sha256 = "1p9k92fgyx0xis6r50vhcpx3iws2gaspq3dnpigglv3bj9yg8zvi";
     };
   };
 
@@ -23,12 +23,12 @@ let
     cairo fontconfig freetype
     gdk-pixbuf glib gtk2 gconf
     libX11 nspr nss pango libXrender
-    gconf libXext libXi
+    gconf libxcb libXext libXi
   ];
 in
 stdenv.mkDerivation rec {
   pname = "chromedriver";
-  version = "83.0.4103.39";
+  version = "85.0.4183.87";
 
   src = fetchurl {
     url = "https://chromedriver.storage.googleapis.com/${version}/chromedriver_${spec.system}.zip";

pkgs/os-specific/linux/numworks-udev-rules/50-numworks-calculator.rules

@@ -0,0 +1,2 @@
+SUBSYSTEM=="usb", ATTR{idVendor}=="0483", ATTR{idProduct}=="a291", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTR{idVendor}=="0483", ATTR{idProduct}=="df11", TAG+="uaccess"

pkgs/os-specific/linux/numworks-udev-rules/default.nix

@@ -0,0 +1,21 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "numworks-udev-rules";
+  version = "unstable-2020-08-31";
+
+  udevRules = ./50-numworks-calculator.rules;
+  dontUnpack = true;
+
+  installPhase = ''
+    install -Dm 644 "${udevRules}" "$out/lib/udev/rules.d/50-numworks-calculator.rules"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Udev rules for Numworks calculators";
+    homepage = "https://numworks.com";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ shamilton ];
+    platforms = platforms.linux;
+  };
+}