Merge master into staging-next

nixos/lib/test-driver/test-driver.py

@@ -16,6 +16,8 @@ import tempfile
 import time
 import unicodedata
 from typing import Tuple, Any, Callable, Dict, Iterator, Optional, List
+import shlex
+import pathlib
 
 CHAR_TO_KEY = {
     "A": "shift-a",
@@ -91,6 +93,10 @@ def eprint(*args: object, **kwargs: Any) -> None:
     print(*args, file=sys.stderr, **kwargs)
 
 
+def make_command(args: list) -> str:
+    return " ".join(map(shlex.quote, (map(str, args))))
+
+
 def create_vlan(vlan_nr: str) -> Tuple[str, str, "subprocess.Popen[bytes]", Any]:
     global log
     log.log("starting VDE switch for network {}".format(vlan_nr))
@@ -215,7 +221,7 @@ class Machine:
             return path
 
         self.state_dir = create_dir("vm-state-{}".format(self.name))
-        self.shared_dir = create_dir("xchg-shared")
+        self.shared_dir = create_dir("{}/xchg".format(self.state_dir))
 
         self.booted = False
         self.connected = False
@@ -524,6 +530,33 @@ class Machine:
             if ret.returncode != 0:
                 raise Exception("Cannot convert screenshot")
 
+    def copy_from_vm(self, source: str, target_dir: str = "") -> None:
+        """Copy a file from the VM (specified by an in-VM source path) to a path
+        relative to `$out`. The file is copied via the `shared_dir` shared among
+        all the VMs (using a temporary directory).
+        """
+        # Compute the source, target, and intermediate shared file names
+        out_dir = pathlib.Path(os.environ.get("out", os.getcwd()))
+        vm_src = pathlib.Path(source)
+        with tempfile.TemporaryDirectory(dir=self.shared_dir) as shared_td:
+            shared_temp = pathlib.Path(shared_td)
+            vm_shared_temp = pathlib.Path("/tmp/xchg") / shared_temp.name
+            vm_intermediate = vm_shared_temp / vm_src.name
+            intermediate = shared_temp / vm_src.name
+            # Copy the file to the shared directory inside VM
+            self.succeed(make_command(["mkdir", "-p", vm_shared_temp]))
+            self.succeed(make_command(["cp", "-r", vm_src, vm_intermediate]))
+            self.succeed("sync")
+            abs_target = out_dir / target_dir / vm_src.name
+            abs_target.parent.mkdir(exist_ok=True, parents=True)
+            # Copy the file from the shared directory outside VM
+            if intermediate.is_dir():
+                shutil.copytree(intermediate, abs_target)
+            else:
+                shutil.copy(intermediate, abs_target)
+        # Make sure the cleanup is synced into VM
+        self.succeed("sync")
+
     def dump_tty_contents(self, tty: str) -> None:
         """Debugging: Dump the contents of the TTY<n>
         """

nixos/modules/config/no-x-libs.nix

@@ -35,7 +35,6 @@ with lib;
       networkmanager-vpnc = super.networkmanager-vpnc.override { withGnome = false; };
       networkmanager-iodine = super.networkmanager-iodine.override { withGnome = false; };
       gobject-introspection = super.gobject-introspection.override { x11Support = false; };
-      polkit = super.polkit.override { withGnome = false; };
     }));
   };
 }

nixos/modules/services/misc/gitea.nix

@@ -394,6 +394,28 @@ in
         WorkingDirectory = cfg.stateDir;
         ExecStart = "${gitea.bin}/bin/gitea web";
         Restart = "always";
+
+        # Filesystem
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        ReadWritePaths = cfg.stateDir;
+        # Caps
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        # Misc.
+        LockPersonality = true;
+        RestrictRealtime = true;
+        PrivateMounts = true;
+        PrivateUsers = true;
+        MemoryDenyWriteExecute = true;
+        SystemCallFilter = "~@chown @clock @cpu-emulation @debug @keyring @memlock @module @mount @obsolete @privileged @raw-io @reboot @resources @setuid @swap";
+        SystemCallArchitectures = "native";
+        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
       };
 
       environment = {

nixos/tests/ferm.nix

@@ -1,5 +1,5 @@
 
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
   name = "ferm";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ mic92 ];
@@ -53,24 +53,22 @@ import ./make-test.nix ({ pkgs, ...} : {
 
   testScript =
     ''
-      startAll;
+      start_all()
 
-      $client->waitForUnit("network-online.target");
+      client.wait_for_unit("network-online.target")
-      $server->waitForUnit("ferm.service");
+      server.wait_for_unit("ferm.service")
-      $server->waitForUnit("nginx.service");
+      server.wait_for_unit("nginx.service")
-      $server->waitUntilSucceeds("ss -ntl | grep -q 80");
+      server.wait_until_succeeds("ss -ntl | grep -q 80")
 
-      subtest "port 80 is allowed", sub {
+      with subtest("port 80 is allowed"):
-          $client->succeed("curl --fail -g http://192.168.1.1:80/status");
+          client.succeed("curl --fail -g http://192.168.1.1:80/status")
-          $client->succeed("curl --fail -g http://[fd00::1]:80/status");
+          client.succeed("curl --fail -g http://[fd00::1]:80/status")
-      };
 
-      subtest "port 8080 is not allowed", sub {
+      with subtest("port 8080 is not allowed"):
-          $server->succeed("curl --fail -g http://192.168.1.1:8080/status");
+          server.succeed("curl --fail -g http://192.168.1.1:8080/status")
-          $server->succeed("curl --fail -g http://[fd00::1]:8080/status");
+          server.succeed("curl --fail -g http://[fd00::1]:8080/status")
 
-          $client->fail("curl --fail -g http://192.168.1.1:8080/status");
+          client.fail("curl --fail -g http://192.168.1.1:8080/status")
-          $client->fail("curl --fail -g http://[fd00::1]:8080/status");
+          client.fail("curl --fail -g http://[fd00::1]:8080/status")
-      };
     '';
 })

nixos/tests/nat.nix

@@ -3,7 +3,7 @@
 # client on the inside network, a server on the outside network, and a
 # router connected to both that performs Network Address Translation
 # for the client.
-import ./make-test.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false, ... }:
+import ./make-test-python.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false, ... }:
   let
     unit = if withFirewall then "firewall" else "nat";
 
@@ -69,49 +69,52 @@ import ./make-test.nix ({ pkgs, lib, withFirewall, withConntrackHelpers ? false,
         routerDummyNoNatClosure = nodes.routerDummyNoNat.config.system.build.toplevel;
         routerClosure = nodes.router.config.system.build.toplevel;
       in ''
-        $client->start;
+        client.start()
-        $router->start;
+        router.start()
-        $server->start;
+        server.start()
 
         # The router should have access to the server.
-        $server->waitForUnit("network.target");
+        server.wait_for_unit("network.target")
-        $server->waitForUnit("httpd");
+        server.wait_for_unit("httpd")
-        $router->waitForUnit("network.target");
+        router.wait_for_unit("network.target")
-        $router->succeed("curl --fail http://server/ >&2");
+        router.succeed("curl --fail http://server/ >&2")
 
         # The client should be also able to connect via the NAT router.
-        $router->waitForUnit("${unit}");
+        router.wait_for_unit("${unit}")
-        $client->waitForUnit("network.target");
+        client.wait_for_unit("network.target")
-        $client->succeed("curl --fail http://server/ >&2");
+        client.succeed("curl --fail http://server/ >&2")
-        $client->succeed("ping -c 1 server >&2");
+        client.succeed("ping -c 1 server >&2")
 
         # Test whether passive FTP works.
-        $server->waitForUnit("vsftpd");
+        server.wait_for_unit("vsftpd")
-        $server->succeed("echo Hello World > /home/ftp/foo.txt");
+        server.succeed("echo Hello World > /home/ftp/foo.txt")
-        $client->succeed("curl -v ftp://server/foo.txt >&2");
+        client.succeed("curl -v ftp://server/foo.txt >&2")
 
         # Test whether active FTP works.
-        $client->${if withConntrackHelpers then "succeed" else "fail"}(
+        client.${if withConntrackHelpers then "succeed" else "fail"}("curl -v -P - ftp://server/foo.txt >&2")
-          "curl -v -P - ftp://server/foo.txt >&2");
 
         # Test ICMP.
-        $client->succeed("ping -c 1 router >&2");
+        client.succeed("ping -c 1 router >&2")
-        $router->succeed("ping -c 1 client >&2");
+        router.succeed("ping -c 1 client >&2")
 
         # If we turn off NAT, the client shouldn't be able to reach the server.
-        $router->succeed("${routerDummyNoNatClosure}/bin/switch-to-configuration test 2>&1");
+        router.succeed(
-        $client->fail("curl --fail --connect-timeout 5 http://server/ >&2");
+            "${routerDummyNoNatClosure}/bin/switch-to-configuration test 2>&1"
-        $client->fail("ping -c 1 server >&2");
+        )
+        client.fail("curl --fail --connect-timeout 5 http://server/ >&2")
+        client.fail("ping -c 1 server >&2")
 
         # And make sure that reloading the NAT job works.
-        $router->succeed("${routerClosure}/bin/switch-to-configuration test 2>&1");
+        router.succeed(
+            "${routerClosure}/bin/switch-to-configuration test 2>&1"
+        )
         # FIXME: this should not be necessary, but nat.service is not started because
         #        network.target is not triggered
         #        (https://github.com/NixOS/nixpkgs/issues/16230#issuecomment-226408359)
         ${lib.optionalString (!withFirewall) ''
-          $router->succeed("systemctl start nat.service");
+          router.succeed("systemctl start nat.service")
         ''}
-        $client->succeed("curl --fail http://server/ >&2");
+        client.succeed("curl --fail http://server/ >&2")
-        $client->succeed("ping -c 1 server >&2");
+        client.succeed("ping -c 1 server >&2")
       '';
   })

nixos/tests/predictable-interface-names.nix

@@ -4,7 +4,7 @@
 }:
 
 let
-  inherit (import ../lib/testing.nix { inherit system pkgs; }) makeTest;
+  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;
 in pkgs.lib.listToAttrs (pkgs.lib.crossLists (predictable: withNetworkd: {
   name = pkgs.lib.optionalString (!predictable) "un" + "predictable"
        + pkgs.lib.optionalString withNetworkd "Networkd";
@@ -20,8 +20,8 @@ in pkgs.lib.listToAttrs (pkgs.lib.crossLists (predictable: withNetworkd: {
     };
 
     testScript = ''
-      print $machine->succeed("ip link");
+      print(machine.succeed("ip link"))
-      $machine->${if predictable then "fail" else "succeed"}("ip link show eth0 ");
+      machine.${if predictable then "fail" else "succeed"}("ip link show eth0")
     '';
   };
 }) [[true false] [true false]])

pkgs/applications/audio/mda-lv2/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mda-lv2";
-  version = "1.2.2";
+  version = "1.2.4";
 
   src = fetchurl {
     url = "https://download.drobilla.net/${pname}-${version}.tar.bz2";
-    sha256 = "0hh40c5d2m0k5gb3vw031l6lqn59dg804an3mkmhkc7qv4gc6xm4";
+    sha256 = "1a3cv6w5xby9yn11j695rbh3c4ih7rxfxmkca9s1324ljphh06m8";
   };
 
   nativeBuildInputs = [ pkgconfig wafHook ];

pkgs/applications/audio/qtractor/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qtractor";
-  version = "0.9.10";
+  version = "0.9.11";
 
   src = fetchurl {
     url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "00fj762qdna4bm8hshdhkwfa48s01bi5sk4f030rfk77mivl09jk";
+    sha256 = "02cpjlf3j4sm74hz88r1frnlycs52rs11mzplr2q8plji3ic5w50";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/strawberry/default.nix

@@ -35,13 +35,13 @@
 
 mkDerivation rec {
   pname = "strawberry";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    sha256 = "113z2qdcg0fm6ff2k36nl5zbbj5wsidl94ca1sfnsv9bq9lkvck5";
+    sha256 = "14bw4hmysrbl4havz03s3wl8bv76380wddf5zzrjvfjjpwn333r6";
   };
 
   buildInputs = [

pkgs/applications/audio/yoshimi/default.nix

@@ -6,11 +6,11 @@ assert stdenv ? glibc;
 
 stdenv.mkDerivation  rec {
   pname = "yoshimi";
-  version = "1.6.0.2";
+  version = "1.6.0.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/yoshimi/${pname}-${version}.tar.bz2";
-    sha256 = "0q2cw168r53r50zghkdqcxba2cybn44axbdkwacvkm7ag2z0j2l8";
+    sha256 = "1z2mnmm299ng6jcwa61dzr1ilwa5fjgsggxl2wa5smji6b4npmx7";
   };
 
   buildInputs = [

pkgs/applications/display-managers/lightdm/gtk-greeter.nix

@@ -20,7 +20,7 @@
 
 let
   ver_branch = "2.0";
-  version = "2.0.6";
+  version = "2.0.7";
 in
 stdenv.mkDerivation rec {
   pname = "lightdm-gtk-greeter";
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "${meta.homepage}/${ver_branch}/${version}/+download/${pname}-${version}.tar.gz";
-    sha256 = "1pis5qyg95pg31dvnfqq34bzgj00hg4vs547r8h60lxjk81z8p15";
+    sha256 = "1g7wc3d3vqfa7mrdhx1w9ywydgjbffla6rbrxq9k3sc62br97qms";
   };
 
   nativeBuildInputs = [ pkgconfig intltool wrapGAppsHook ];

pkgs/applications/editors/neovim/neovim-remote.nix

@@ -4,14 +4,14 @@ with stdenv.lib;
 
 pythonPackages.buildPythonApplication rec {
   pname = "neovim-remote";
-  version = "2.2.2";
+  version = "2.2.3";
   disabled = !pythonPackages.isPy3k;
 
   src = fetchFromGitHub {
     owner = "mhinz";
     repo = "neovim-remote";
     rev = "v${version}";
-    sha256 = "129yjpwn6480rd5na866h4mcr6rf60rqv651hks5fn3ws112n751";
+    sha256 = "0g7gs5gigk3krydxdpmscgfr1fms0a6rc6am2y4c5szkgbd1d0ph";
   };
 
   propagatedBuildInputs = with pythonPackages; [ pynvim psutil ];

pkgs/applications/graphics/fig2dev/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, ghostscript, libpng } :
 
 let
-  version = "3.2.7a";
+  version = "3.2.7b";
 
 in stdenv.mkDerivation {
   pname = "fig2dev";
@@ -9,7 +9,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://sourceforge/mcj/fig2dev-${version}.tar.xz";
-    sha256 = "0a7vkfl38fvkhg3na5gr9c4fskas9wbs84y9djg85nzwbshik8mx";
+    sha256 = "1ck8gnqgg13xkxq4hrdy706i4xdgrlckx6bi6wxm1g514121pp27";
   };
 
   buildInputs = [ libpng ];

pkgs/applications/misc/kanboard/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kanboard";
-  version = "1.2.11";
+  version = "1.2.12";
 
   src = fetchFromGitHub {
     owner = "kanboard";
     repo = "kanboard";
     rev = "v${version}";
-    sha256 = "0if5nh4m4y3xlvlv86jph7ix5nvpgc1zjkp4cq5iig6z0041bw98";
+    sha256 = "1m1drgbyk1m6mf69xqlz9gqcj650n9m4y2fdj7d2yv20q8r31489";
   };
 
   dontBuild = true;

pkgs/applications/misc/minder/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "minder";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "phase1geo";
     repo = pname;
     rev = version;
-    sha256 = "0lhmv3z2jifv4cksxa27jigdfj9n81myjsxg38xp28fx5x3h8bzc";
+    sha256 = "1z3if8bbiigb3m5py641y0j8d9z0s6kbb325waxbqs240pcxipml";
   };
 
   nativeBuildInputs = [ pkgconfig meson ninja python3 wrapGAppsHook vala shared-mime-info ];

pkgs/applications/misc/opencpn/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "opencpn-unstable";
-  version = "2019-05-15";
+  version = "2019-11-21";
 
   src = fetchFromGitHub {
     owner = "OpenCPN";
     repo = "OpenCPN";
-    rev = "83a3c4b5ff011d4eb070f009e0a46d194b177047";
+    rev = "e73dc935545b2bbcf193cc61d987a0178c52d7a7";
-    sha256 = "00s1mxnkf1gg41hrz0zp8ypkp98py0m1c22im2zd09k6lcddxw5p";
+    sha256 = "0yiqahkzwcbzgabc5xgxmwlngapkfiaqyva3mwz29xj0c5lg2bdk";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/misc/taskell/default.nix

@@ -1,8 +1,8 @@
 { lib, haskellPackages, fetchFromGitHub }:
 
 let
-  version = "1.6.1";
+  version = "1.7.3";
-  sha256  = "047gvpq52pif9sfb4qcfdiwz50x3wlnjvsnnjzypm1qlwyl2rbz1";
+  sha256  = "1439fh79ilc6jvz894cfzhk7gy5r2sv4v79bvqmmqbzbqk9qsbvx";
 
 in (haskellPackages.mkDerivation {
   pname = "taskell";

pkgs/applications/misc/xmrig/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig";
-  version = "5.0.1";
+  version = "5.1.0";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig";
     rev = "v${version}";
-    sha256 = "0w6vbrp44l25jhv3kx1m0841rkv7im30581gds0qb7lhyqm0hnbg";
+    sha256 = "1lkw7xrj20ppfmv7abki9i60yjks9i7nr8ni9p6n7rilfbp4603k";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/misc/xmrig/proxy.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig-proxy";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig-proxy";
     rev = "v${version}";
-    sha256 = "0h0yxzpar952ix94j10qyf31c20g45w0nxr02vfybjip48dvlf76";
+    sha256 = "0lp11p4lf03l9x2kcpq1j19z7c1zrdvjmcfh2xyvlbw8pqx0hxkv";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/networking/mailreaders/mutt/default.nix

@@ -27,11 +27,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "1.12.2";
+  version = "1.13.0";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "10k8352s0z7yan6d4z2am80qd3bsaky4h89g72wl4xr3x067ahmw";
+    sha256 = "1dzmypmcyqsxcb0qwz1b2v3nhvd83jcqlnn3acvgaiag10hxq3d0";
   };
 
   patches = optional smimeSupport (fetchpatch {

pkgs/applications/networking/newsreaders/pan/default.nix

@@ -7,7 +7,7 @@
 
 assert spellChecking -> gtkspell3 != null;
 
-let version = "0.145"; in
+let version = "0.146"; in
 
 stdenv.mkDerivation {
   pname = "pan";
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "http://pan.rebelbase.com/download/releases/${version}/source/pan-${version}.tar.bz2";
-    sha256 = "1b4wamv33hprghcjk903bpvnd233yxyrm18qnh13alc8h1553nk8";
+    sha256 = "17agd27sn4a7nahvkpg0w39kv74njgdrrygs74bbvpaj8rk2hb55";
   };
 
   nativeBuildInputs = [ pkgconfig gettext intltool itstool libxml2 makeWrapper ];

pkgs/applications/office/libreoffice/default.nix

@@ -13,7 +13,7 @@
 , librevenge, libe-book, libmwaw, glm, glew, gst_all_1
 , gdb, commonsLogging, librdf_rasqal, wrapGAppsHook
 , gnome3, glib, ncurses, epoxy, gpgme
-, langs ? [ "ca" "cs" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "ru" "sl" "zh-CN" ]
+, langs ? [ "ca" "cs" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ru" "sl" "zh-CN" ]
 , withHelp ? true
 , kdeIntegration ? false
 }:

pkgs/applications/office/libreoffice/still.nix

@@ -13,7 +13,7 @@
 , librevenge, libe-book, libmwaw, glm, glew, gst_all_1
 , gdb, commonsLogging, librdf_rasqal, wrapGAppsHook
 , gnome3, glib, ncurses, epoxy, gpgme
-, langs ? [ "ca" "cs" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "ru" "sl" "zh-CN" ]
+, langs ? [ "ca" "cs" "de" "en-GB" "en-US" "eo" "es" "fr" "hu" "it" "ja" "nl" "pl" "pt" "pt-BR" "ru" "sl" "zh-CN" ]
 , withHelp ? true
 , kdeIntegration ? false
 }:

pkgs/applications/science/biology/paml/default.nix

@@ -1,11 +1,11 @@
 {stdenv, fetchurl}:
 
 stdenv.mkDerivation rec {
-  version = "4.9i";
+  version = "4.9j";
   pname = "paml";
   src = fetchurl {
     url = "http://abacus.gene.ucl.ac.uk/software/paml${version}.tgz";
-    sha256 = "1k5lcyls6c33ppp5fxl8ply2fy7i2k0gcqaifsl7gnc81d8ay4dw";
+    sha256 = "0qflf3i27x6jwks3c6q560m1q8r043ja96syah145113iz5wdalp";
   };
 
   preBuild = ''
@@ -29,6 +29,5 @@ stdenv.mkDerivation rec {
     longDescription = ''PAML is a package of programs for phylogenetic analyses of DNA or protein sequences using maximum likelihood. It is maintained and distributed for academic use free of charge by Ziheng Yang. ANSI C source codes are distributed for UNIX/Linux/Mac OSX, and executables are provided for MS Windows. PAML is not good for tree making. It may be used to estimate parameters and test hypotheses to study the evolutionary process, when you have reconstructed trees using other programs such as PAUP*, PHYLIP, MOLPHY, PhyML, RaxML, etc.'';
     license     = "non-commercial";
     homepage    = http://abacus.gene.ucl.ac.uk/software/paml.html;
-    broken = true;
   };
 }

pkgs/applications/window-managers/icewm/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "icewm";
-  version = "1.6.0";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner  = "bbidulock";
     repo   = "icewm";
     rev    = version;
-    sha256 = "1l8hjmb19d7ds7z21cx207h86wkjcmmmamcnalgkwh4alvbawc2p";
+    sha256 = "0h3w718x28fd4sz36ka9wpgcb98scna6qpycxzls4cjji3rjgm0l";
   };
 
   nativeBuildInputs = [ cmake pkgconfig perl asciidoc ];

pkgs/development/compilers/go-jsonnet/default.nix

@@ -1,33 +1,24 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib, buildGoModule, fetchFromGitHub }:
 
-buildGoPackage rec {
+buildGoModule rec {
   pname = "go-jsonnet";
-  version = "0.13.0";
+  version = "0.14.0";
-
-  goPackagePath = "github.com/google/go-jsonnet";
-
-  # regenerate deps.nix using following steps:
-  #
-  # go get -u github.com/google/go-jsonnet
-  # cd $GOPATH/src/github.com/google/go-jsonnet
-  # git checkout <version>
-  # dep init
-  # dep2nix
-  goDeps = ./deps.nix;
 
   src = fetchFromGitHub {
-    rev = "v${version}";
     owner = "google";
     repo = "go-jsonnet";
-    sha256 = "0x95sqhrw4pscxq0q8781wix0w881k9my5kn5nf6k0fg1d6qlgiy";
+    rev = "v${version}";
-    fetchSubmodules = true;
+    sha256 = "1q0mpydh8h0zrml605q9r259y8584kbwcr9g4sqcb1n13b4d1sgp";
   };
 
-  meta = {
+  modSha256 = "1b6hz5a66hhlzpcv1badxr1b4nmk4lw0507d5jks7lqzvvwd0sxq";
+
+  subPackages = [ "cmd/jsonnet" ];
+
+  meta = with lib; {
     description = "An implementation of Jsonnet in pure Go";
-    maintainers = with lib.maintainers; [ nshalman ];
+    homepage = "https://github.com/google/go-jsonnet";
-    license = lib.licenses.asl20;
+    license = licenses.asl20;
-    homepage = https://github.com/google/go-jsonnet;
+    maintainers = with maintainers; [ nshalman ];
-    platforms = lib.platforms.unix;
   };
 }

pkgs/development/compilers/go-jsonnet/deps.nix

@@ -1,48 +0,0 @@
-# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
-[
-  {
-    goPackagePath  = "github.com/fatih/color";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fatih/color";
-      rev =  "5b77d2a35fb0ede96d138fc9a99f5c9b6aef11b4";
-      sha256 = "0v8msvg38r8d1iiq2i5r4xyfx0invhc941kjrsg5gzwvagv55inv";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mattn/go-colorable";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-colorable";
-      rev =  "167de6bfdfba052fa6b2d3664c8f5272e23c9072";
-      sha256 = "1nwjmsppsjicr7anq8na6md7b1z84l9ppnlr045hhxjvbkqwalvx";
-    };
-  }
-  {
-    goPackagePath  = "github.com/mattn/go-isatty";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-isatty";
-      rev =  "1311e847b0cb909da63b5fecfb5370aa66236465";
-      sha256 = "0rqfh1rj6f5wm8p2ky7inm8g10152p7w6n2cli17kf9gad797i8h";
-    };
-  }
-  {
-    goPackagePath  = "github.com/sergi/go-diff";
-    fetch = {
-      type = "git";
-      url = "https://github.com/sergi/go-diff";
-      rev =  "1744e2970ca51c86172c8190fadad617561ed6e7";
-      sha256 = "0swiazj8wphs2zmk1qgq75xza6m19snif94h2m6fi8dqkwqdl7c7";
-    };
-  }
-  {
-    goPackagePath  = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev =  "4c4f7f33c9ed00de01c4c741d2177abfcfe19307";
-      sha256 = "191001bxqyc3xfs46nnqmm7jdk0r73vk7a4zqngfl7zwjv9smwsq";
-    };
-  }
-]

pkgs/development/libraries/libfprint/default.nix

@@ -1,41 +1,27 @@
-{ thinkpad ? false
+{ stdenv
-, stdenv
-, fetchFromGitHub
 , fetchurl
 , pkgconfig
 , meson
 , ninja
-, libusb
+, gusb
 , pixman
 , glib
 , nss
-, gtk3
+, gobject-introspection
 , coreutils
 , gtk-doc
 , docbook_xsl
 , docbook_xml_dtd_43
-, openssl ? null
 }:
 
-assert thinkpad -> openssl != null;
-
 stdenv.mkDerivation rec {
-  pname = "libfprint" + stdenv.lib.optionalString thinkpad "-thinkpad";
+  pname = "libfprint";
-  version = "1.0";
+  version = "1.90";
 
-  src = {
+  src = fetchurl {
-    libfprint-thinkpad =
+    url = "https://gitlab.freedesktop.org/libfprint/libfprint/uploads/1bba17b5daa130aa548bc7ea96dc58c4/libfprint-1.90.0.tar.xz";
-      fetchFromGitHub {
+    sha256 = "930f530df369ff874d7971f0b7c7bdb7c81597e91af4668694b98fe30b4b3371";
-        owner = "3v1n0";
+  };
-        repo = "libfprint";
-        rev = "2e2e3821717e9042e93a995bdbd3d00f2df0be9c";
-        sha256 = "1vps1wrp7hskf13f7jrv0dwry2fcid76x2w463wplngp63cj7b3b";
-      };
-    libfprint = fetchurl {
-      url = "https://gitlab.freedesktop.org/libfprint/libfprint/uploads/aff93e9921d1cff53d7c070944952ff9/libfprint-${version}.tar.xz";
-      sha256 = "0v84pd12v016m8iimhq39fgzamlarqccsr7d98cvrrwrzrgcixrd";
-    };
-  }.${pname};
 
   nativeBuildInputs = [
     pkgconfig
@@ -44,17 +30,15 @@ stdenv.mkDerivation rec {
     gtk-doc
     docbook_xsl
     docbook_xml_dtd_43
+    gobject-introspection
   ];
 
   buildInputs = [
-    libusb
+    gusb
     pixman
     glib
     nss
-    gtk3
+  ];
-  ]
-  ++ stdenv.lib.optional thinkpad openssl
-  ;
 
   mesonFlags = [
     "-Dudev_rules_dir=${placeholder "out"}/lib/udev/rules.d"

pkgs/development/libraries/libsolv/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, cmake, ninja, zlib, expat, rpm, db }:
 
 stdenv.mkDerivation rec {
-  version  = "0.7.7";
+  version  = "0.7.9";
   pname = "libsolv";
 
   src = fetchFromGitHub {
     owner  = "openSUSE";
     repo   = "libsolv";
     rev    = version;
-    sha256 = "0f6r5j5d4fbzx9ihbbwrqylayw90qac8kapkhmfcvsh7f8whr623";
+    sha256 = "1ijb4nywc3hx142194d85x7db0j5g2n0i750665fal30qrw2x43y";
   };
 
   cmakeFlags = [
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A free package dependency solver";
+    homepage    = "https://github.com/openSUSE/libsolv";
     license     = licenses.bsd3;
     platforms   = platforms.linux;
     maintainers = with maintainers; [ copumpkin ];

pkgs/development/libraries/libxl/default.nix

@@ -2,14 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "libxl";
-  version = "3.8.5";
+  version = "3.8.7";
 
   src = fetchurl {
     url = "http://www.libxl.com/download/${pname}-lin-${version}.tar.gz";
-    sha256 = "15n8gxyznk1nm2kgp86hd36rnivjsby9ccl12lyabv6q3fab6fsx";
+    sha256 = "0mfi2mlsgqjw9ki3c5bsb6nr2aqym7s1priw70f69r12azzxfqw3";
   };
 
-  phases = [ "unpackPhase" "installPhase" "fixupPhase" ];
+  dontConfigure = true;
+  dontBuild = true;
 
   installPhase = ''
     mkdir $out
@@ -18,7 +19,8 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with stdenv.lib; {
-    description = "A lbrary for parsing excel files";
+    description = "A library for parsing Excel files";
+    homepage    = "http://www.libxl.com/";
     license     = licenses.unfree;
     platforms   = platforms.linux;
     maintainers = with maintainers; [  ];

pkgs/development/libraries/polkit/default.nix

@@ -2,7 +2,7 @@
 , intltool, spidermonkey_60 , gobject-introspection, libxslt, docbook_xsl, dbus
 , docbook_xml_dtd_412, gtk-doc, coreutils
 , useSystemd ? (stdenv.isLinux && !stdenv.hostPlatform.isMusl), systemd, elogind
-, withGnome ? true
+, withIntrospection ? true
 # A few tests currently fail on musl (polkitunixusertest, polkitunixgrouptest, polkitidentitytest segfault).
 # Not yet investigated; it may be due to the "Make netgroup support optional"
 # patch not updating the tests correctly yet, or doing something wrong,
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     [ expat pam spidermonkey_60 ]
     # On Linux, fall back to elogind when systemd support is off.
     ++ stdenv.lib.optional stdenv.isLinux (if useSystemd then systemd else elogind)
-    ++ stdenv.lib.optional withGnome gobject-introspection;
+    ++ stdenv.lib.optional withIntrospection gobject-introspection;
 
   propagatedBuildInputs = [
     glib # in .pc Requires
@@ -86,7 +86,7 @@ stdenv.mkDerivation rec {
     "--with-systemdsystemunitdir=${placeholder "out"}/etc/systemd/system"
     "--with-polkitd-user=polkituser" #TODO? <nixos> config.ids.uids.polkituser
     "--with-os-type=NixOS" # not recognized but prevents impurities on non-NixOS
-    (if withGnome then "--enable-introspection" else "--disable-introspection")
+    (if withIntrospection then "--enable-introspection" else "--disable-introspection")
   ] ++ stdenv.lib.optional (!doCheck) "--disable-test";
 
   makeFlags = [

pkgs/development/python-modules/aiorpcx/default.nix

@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "aiorpcx";
-  version = "0.18.3";
+  version = "0.18.4";
 
   src = fetchPypi {
     inherit version;
     pname = "aiorpcX";
-    sha256 = "0k545hc7wl6sh1svydzbv6x7sx5pig2pqkl3yxs9riwmvzawx9xp";
+    sha256 = "0jpvrkan6w8bpq017m8si7r9hb1pyw3ip4vr1fl2pmi8ngzc1jdy";
   };
 
   propagatedBuildInputs = [ attrs ];

pkgs/development/python-modules/apsw/default.nix

@@ -3,7 +3,7 @@
 
 buildPythonPackage rec {
   pname = "apsw";
-  version = "3.29.0-r1";
+  version = "3.30.1-r1";
 
   disabled = isPyPy;
 
@@ -11,19 +11,11 @@ buildPythonPackage rec {
     owner = "rogerbinns";
     repo = "apsw";
     rev = version;
-    sha256 = "1p3sgmk9qwd0a634lirva44qgpyq0a74r9d70wxb6hsa52yjj9xb";
+    sha256 = "1zp38gj44bmzfxxpvgd7nixkp8vs2fpl839ag8vrh9z70dax22f0";
   };
 
   buildInputs = [ sqlite ];
 
-  patches = [
-    # Fixes a test failure with sqlite 3.30, see https://github.com/rogerbinns/apsw/issues/275
-    (fetchpatch {
-      url = "https://github.com/rogerbinns/apsw/commit/13df0b57bff59542978abf7c0a440c9274e3aac3.diff";
-      sha256 = "1wi1mfis2mr21389wdnvq44phg0bpm5vpwmxhvrj211vwfm0q7dv";
-    })
-  ];
-
   meta = with stdenv.lib; {
     description = "A Python wrapper for the SQLite embedded relational database engine";
     homepage = https://github.com/rogerbinns/apsw;

pkgs/development/python-modules/buildbot/default.nix

@@ -25,11 +25,11 @@ let
 
   package = buildPythonPackage rec {
     pname = "buildbot";
-    version = "2.5.0";
+    version = "2.5.1";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "06dza7kggybz8nf3i1skkadwrq9s0nkpqjfahifysaag3j3b5rp4";
+      sha256 = "13ddpcbndb22zlg9gjsf2pbgad45g1w5cg4a3z83085fkgnib7sr";
     };
 
     propagatedBuildInputs = [
@@ -74,13 +74,6 @@ let
       # This patch disables the test that tries to read /etc/os-release which
       # is not accessible in sandboxed builds.
       ./skip_test_linux_distro.patch
-      # Work around https://github.com/glyph/automat/issues/117
-      (fetchpatch {
-        url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/buildbot-automat-117.diff?h=packages/buildbot&id=7904292340f98578adfe783a09e9eb4c5b1d4632";
-        name = "buildbot-automat-117.diff";
-        stripLen = 1;
-        sha256 = "0rng6f8nvghkihajz9m925rdp9q3c395bj4wc7r2s1minv613hba";
-      })
     ];
 
     postPatch = ''

pkgs/development/python-modules/buildbot/pkg.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "buildbot-pkg";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "1my9a791y6hsazzqs3f3svl6zw28x3qwj0a0vxffybqdij650nvw";
+    sha256 = "1g87pddsyas1r0f6z29047cwnz7ds4925f6n9g7b0pkj3k73ci06";
   };
 
   postPatch = ''

pkgs/development/python-modules/buildbot/plugins.nix

@@ -7,7 +7,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0awy96pb9s9g0nrmlrvqf5zi878z6mvj653inf9sm89x601a6lp1";
+      sha256 = "00k5dbcwzqlyk4lcp5qh1q8xbrxmg9gzqs7vl2r6f3wxi4ydb5nw";
     };
 
     # Remove unneccessary circular dependency on buildbot
@@ -36,7 +36,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0bp7bbq6rq1kdg3pf8plcpc4amam0pks5dlmyqj6bn29skfa5h1j";
+      sha256 = "0ai334y779jwqabrn2yjma41pw0a9k1qy7v68qbjd22n4my227ma";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -58,7 +58,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "1mxxkqzh4a6574n2lk2ndi77d9g93hjpkwsqizj911n6ibsn4qw3";
+      sha256 = "1j450hwvg729mivzijbrx8ngalx56qvrx8mwwgy8arfwpnyfkr9l";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -80,7 +80,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "1fkrd5crbgqgp8mr8qgfy559f59ys6hrspddzk3fwg5hrsckkjwr";
+      sha256 = "19w8is5s7d7l60mlchh1zd9nidpkswi8fivfa36b97plibn0jgw1";
     };
 
     buildInputs = [ buildbot-pkg ];
@@ -102,7 +102,7 @@
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "0cvbizcc92df08xcs8w6ah51yfilxz7sx9g8bbdrvw6m586ziczb";
+      sha256 = "1zl7y08rkw7bya6cli44msvcdgirsyfg3kxpf2z82vwgc6bwi785";
     };
 
     buildInputs = [ buildbot-pkg ];

pkgs/development/python-modules/buildbot/worker.nix

@@ -3,11 +3,11 @@
 
 buildPythonPackage (rec {
   pname = "buildbot-worker";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "05c8q6ykharry4lv47imh6agq55fxar8a9ldwx46clb480qwyc43";
+    sha256 = "1kpj85x8xflrccvy840v9bl3q1j63rk9kahj1qirbai1fxwvzbik";
   };
 
   propagatedBuildInputs = [ twisted future ];

pkgs/development/python-modules/matrix-nio/default.nix

@@ -1,6 +1,6 @@
 { lib, buildPythonPackage, fetchFromGitHub, git,
   attrs, future, peewee, h11, h2, atomicwrites, pycryptodome, sphinx, Logbook, jsonschema,
-  python-olm, unpaddedbase64, aiohttp }:
+  python-olm, unpaddedbase64, aiohttp, cachetools }:
 
 buildPythonPackage rec {
   pname = "nio";
@@ -36,6 +36,7 @@ buildPythonPackage rec {
     python-olm
     unpaddedbase64
     aiohttp
+    cachetools
   ];
 
   doCheck = false;

pkgs/development/python-modules/owslib/default.nix

@@ -1,11 +1,11 @@
 { lib, buildPythonPackage, fetchPypi, dateutil, requests, pytz, pyproj , pytest } :
 buildPythonPackage rec {
   pname = "OWSLib";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "018p2ypmpbbcgl0hp92s0vig1wirh41lj0wy62aafn5050pmqr7m";
+    sha256 = "0rdhymayyc6w1izlv1bf2wgx2dfxbp4k1vll5s1364isw60rjj8x";
   };
 
   buildInputs = [ pytest ];

pkgs/development/python-modules/pykde4/default.nix

@@ -1,46 +0,0 @@
-{ pyqt4, openssl_1_0_2
-, stdenv, callPackage, fetchurl, cmake, automoc4, sip }:
-
-let
-  kdelibs = callPackage ./kdelibs.nix {
-    openssl = openssl_1_0_2;
-  };
-  sip4_19_3 = sip.overrideAttrs (oldAttrs: rec {
-    src = fetchurl {
-      url = "mirror://sourceforge/pyqt/sip/sip-4.19.3/sip-4.19.3.tar.gz";
-      sha256 = "0x2bghbprwl3az1ni3p87i0bq8r99694la93kg65vi0cz12gh3bl";
-    };
-  });
-  pyqt4_fixed = pyqt4.overrideAttrs (oldAttrs: {
-    propagatedBuildInputs = [ sip4_19_3 ];
-  });
-in stdenv.mkDerivation rec {
-  version = "4.14.3";
-  pname = "pykde4";
-
-  src = fetchurl {
-    url = "mirror://kde/stable/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "1z40gnkyjlv6ds3cmpzvv99394rhmydr6rxx7qj33m83xnsxgfbz";
-  };
-
-  patches = [ ./dlfcn.patch ];
-
-  buildInputs = [
-    kdelibs
-  ];
-
-  nativeBuildInputs = [ cmake automoc4 ];
-
-  propagatedBuildInputs = [ pyqt4_fixed ];
-
-  enableParallelBuilding = true;
-
-  meta = with stdenv.lib; {
-    platforms = platforms.linux;
-    hydraPlatforms = platforms.none;
-    description = "Python bindings for KDE";
-    license = with licenses; [ gpl2 lgpl2 ];
-    homepage = https://api.kde.org/pykde-4.3-api/;
-    maintainers = with maintainers; [ gnidorah ];
-  };
-}

pkgs/development/python-modules/pykde4/dlfcn.patch

@@ -1,13 +0,0 @@
---- __init__.py.orig	2017-11-02 09:06:48.998054459 +0300
-+++ ./__init__.py	2017-11-02 09:24:28.089072752 +0300
-@@ -1,4 +1,8 @@
--import sys,DLFCN
-+import sys
-+try:
-+    import DLFCN
-+except ImportError:
-+    import os as DLFCN
- # This is needed to ensure that dynamic_cast and RTTI works inside kdelibs.
- sys.setdlopenflags(DLFCN.RTLD_NOW|DLFCN.RTLD_GLOBAL)
-      
-\ No newline at end of file

pkgs/development/python-modules/pykde4/kdelibs.nix

@@ -1,48 +0,0 @@
-{
-  stdenv, fetchurl, fetchpatch,
-  automoc4, cmake_2_8, libxslt, perl, pkgconfig, shared-mime-info,
-  attica, docbook_xml_dtd_42, docbook_xsl, giflib,
-  libdbusmenu_qt, libjpeg, phonon, qt4, openssl
-}:
-
-stdenv.mkDerivation rec {
-  version = "4.14.38";
-  pname = "kdelibs";
-  src = fetchurl {
-    url = "mirror://kde/stable/applications/17.08.3/src/${pname}-${version}.tar.xz";
-    sha256 = "1zn3yb09sd22bm54is0rn98amj0398zybl550dp406419sil7z9p";
-  };
-  patches = [
-    # https://phabricator.kde.org/D22989
-    (fetchpatch {
-      url = "https://cgit.kde.org/kdelibs.git/patch/?id=2c3762feddf7e66cf6b64d9058f625a715694a00";
-      sha256 = "1wbzywh8lcc66n6y3pxs18h7cwkq6g216faz27san33jpl8ra1i9";
-      name = "CVE-2019-14744.patch";
-    })
-  ];
-
-  enableParallelBuilding = true;
-
-  nativeBuildInputs = [
-    automoc4 cmake_2_8 libxslt perl pkgconfig shared-mime-info
-  ];
-  buildInputs = [
-    attica giflib libdbusmenu_qt libjpeg openssl
-  ];
-  propagatedBuildInputs = [ qt4 phonon ];
-
-  cmakeFlags = [
-    "-DDOCBOOKXML_CURRENTDTD_DIR=${docbook_xml_dtd_42}/xml/dtd/docbook"
-    "-DDOCBOOKXSL_DIR=${docbook_xsl}/xml/xsl/docbook"
-    "-DKJS_FORCE_DISABLE_PCRE=true"
-    "-DWITH_SOLID_UDISKS2=OFF"
-  ];
-
-  meta = with stdenv.lib; {
-    platforms = platforms.linux;
-    hydraPlatforms = platforms.none;
-    homepage = http://www.kde.org;
-    license = with licenses; [ gpl2 fdl12 lgpl21 ];
-    maintainers = with maintainers; [ gnidorah ];
-  };
-}

pkgs/development/tools/ammonite/default.nix

@@ -22,6 +22,7 @@ stdenv.mkDerivation rec {
     sed -i '0,/java/{s|java|${jre}/bin/java|}' $out/bin/amm
   '' + optionalString (disableRemoteLogging) ''
     sed -i '0,/ammonite.Main/{s|ammonite.Main|ammonite.Main --no-remote-logging|}' $out/bin/amm
+    sed -i '1i #!/bin/sh' $out/bin/amm
   '';
 
   meta = {

pkgs/development/tools/clang-tools/wrapper

@@ -6,7 +6,7 @@ buildcpath() {
     case $1 in
         -isystem)
             shift
-            path=$path${path':'}$1
+            path=$path${path:+':'}$1
     esac
     shift
   done

pkgs/development/tools/kubectx/default.nix

@@ -4,13 +4,13 @@ with lib;
 
 stdenv.mkDerivation rec {
   pname = "kubectx";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "ahmetb";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11snp3li2w4ds2r7fc6mldlgj24mga40v0knlralaiz296bd6zcs";
+    sha256 = "0mv40jh94by99i5wkf3p52wk4l68hvly1k5gnn7zsy9avc8fjd0p";
   };
 
   buildInputs = [ makeWrapper ];

pkgs/games/pioneer/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pioneer";
-  version = "20191009";
+  version = "20191117";
 
   src = fetchFromGitHub{
     owner = "pioneerspacesim";
     repo = "pioneer";
     rev = version;
-    sha256 = "1ll6pv1931z29kz1zvhnc6mgvjxz30q25lvb00qrsvh236nvll7n";
+    sha256 = "0ka5w1sfp56bs3njiwyr6ffy34qvqbzcvmra9cqwyvi7famn8b49";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];

pkgs/games/zandronum/default.nix

@@ -9,13 +9,14 @@ let
   sqlite = callPackage ./sqlite.nix { };
   clientLibPath = lib.makeLibraryPath [ fluidsynth ];
 
-in stdenv.mkDerivation {
+in stdenv.mkDerivation rec {
-  name = "zandronum${suffix}-3.0";
+  pname = "zandronum${suffix}";
+  version = "3.0.1";
 
   src = fetchhg {
     url = "https://bitbucket.org/Torr_Samaho/zandronum-stable";
-    rev = "dd3c3b57023f";
+    rev = "ZA_${version}";
-    sha256 = "1f8pd8d2zjwdp6v9anp9yrkdbfhd2mp7svmnna0jiqgxjw6wkyls";
+    sha256 = "16v5b6wfrmabs3ky6isbfhlrqdjrr1pvfxlxwk0im02kcpxxw9qw";
   };
 
   # zandronum tries to download sqlite now when running cmake, don't let it

pkgs/os-specific/linux/intel-compute-runtime/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "intel-compute-runtime";
-  version = "19.34.13959";
+  version = "19.44.14658";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     rev = version;
-    sha256 = "1m54w5p5pilrkmlmqgvgrsm3d5dqfdr4jai5siq5ccsqj4gnv1wz";
+    sha256 = "1pl7yhmgzf7r2b8jyxzmwdc7772gd24izy2z2g4n5s205s125k7x";
   };
 
   # Build script tries to write the ICD to /etc

pkgs/os-specific/linux/ipset/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, pkgconfig, libmnl }:
 
 stdenv.mkDerivation rec {
-  name = "ipset-7.3";
+  name = "ipset-7.4";
 
   src = fetchurl {
     url = "http://ipset.netfilter.org/${name}.tar.bz2";
-    sha256 = "0nm3vagr1pb5hr1028qrwx6v6s8bxf1m4qjx72vak42y032wfi26";
+    sha256 = "110q996yrf74ckpkc5f4pn8j5bqq98f27fsak3ibgr3zwmv435sa";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/os-specific/linux/kernel/linux-4.14.nix

@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.156";
+  version = "4.14.157";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1h47fxfbq0d5ry7j3jxz45v5c4103qncgm2vydpz6zdx1kmrz27q";
+    sha256 = "0cvpagbjwpj63lpybfq1rnwdnxcjw49z0b5prah39krf0nd7dylh";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-4.19.nix

@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.86";
+  version = "4.19.87";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "1xmzcxsiydym574y7k313qd8s4c3mdahpb3nx3cingfl36ivnb5z";
+    sha256 = "07fsds2k0hxqgny86winzl46d79g6mb9s28bp7nwlvwf67l22wm5";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/perf.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, kernel, elfutils, python, perl, newt, slang, asciidoc, xmlto, makeWrapper
+{ lib, stdenv, kernel, elfutils, python2, python3, perl, newt, slang, asciidoc, xmlto, makeWrapper
 , docbook_xsl, docbook_xml_dtd_45, libxslt, flex, bison, pkgconfig, libunwind, binutils
 , libiberty, audit, libbfd, libopcodes, openssl, systemtap, numactl
 , zlib, withGtk ? false, gtk2 ? null
@@ -36,12 +36,13 @@ stdenv.mkDerivation {
   # perf refers both to newt and slang
   nativeBuildInputs = [
     asciidoc xmlto docbook_xsl docbook_xml_dtd_45 libxslt
-    flex bison libiberty audit makeWrapper pkgconfig python perl
+    flex bison libiberty audit makeWrapper pkgconfig
   ];
   buildInputs = [
     elfutils newt slang libunwind libbfd zlib openssl systemtap.stapBuild numactl
-    libopcodes
+    libopcodes python3 perl
-  ] ++ stdenv.lib.optional withGtk gtk2;
+  ] ++ stdenv.lib.optional withGtk gtk2
+    ++ (if (versionAtLeast kernel.version "4.19") then [ python3 ] else [ python2 ]);
 
   # Note: we don't add elfutils to buildInputs, since it provides a
   # bad `ld' and other stuff.

pkgs/os-specific/linux/mcelog/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mcelog";
-  version = "165";
+  version = "166";
 
   src = fetchFromGitHub {
     owner  = "andikleen";
     repo   = "mcelog";
     rev    = "v${version}";
-    sha256 = "1g242qz3jj7amgar497bbd8krljspwy89g1r32wz3fdpkn9m1w8s";
+    sha256 = "0q76lf5yrjq7b96ynj5dbf9ll94ymiab1b9106xpb4vbiwz0ia7w";
   };
 
   postPatch = ''

pkgs/os-specific/linux/nvidia-x11/default.nix

@@ -20,25 +20,25 @@ if ((!lib.versionOlder args.version "391")
 in
 rec {
   # Policy: use the highest stable version as the default (on our master).
-  stable = if stdenv.hostPlatform.system == "x86_64-linux" then stable_43x else legacy_390;
+  stable = if stdenv.hostPlatform.system == "x86_64-linux"
+    then generic {
+      version = "440.36";
+      sha256_64bit = "0nbdldwizb802w4x0rqnyb1p7iqz5nqiahqr534n5ihz21a6422h";
+      settingsSha256 = "07hnl3bq76vsl655ipfx9v4zxjq0nc5hp43dk49nny4pi6ly06p1";
+      persistencedSha256 = "08zm1i5sax16xfhkivkmady0yy5argmxv846x21q98ry1ic6cp6w";
+    }
+    else legacy_390;
 
   # No active beta right now
   beta = stable;
 
-  stable_43x = generic {
-    version = "435.21";
-    sha256_64bit = "0v3pq677ab01qdmwl5dawk8hn39qlwj05p8s9qzh9irmrlnc1izs";
-    settingsSha256 = "1p13cz79kncwx5067a3d7dbz6a1ibp611zynp1qdxpa65hwp2pxa";
-    persistencedSha256 = "0br8znxhz2ryzdj0j4jhqzvdgw9h899q8yz0p9429xz4wxkavgdr";
-  };
-
   # Last one supporting x86
   legacy_390 = generic {
-    version = "390.129";
+    version = "390.132";
-    sha256_32bit = "0dkgkp0zx40hf1fsq5xnvbschp7r3c1x1pnpdxna24pi4s62cm2q";
+    sha256_32bit = "0xgjywzkmmm6a5gby67l2kx0gn7bcxksv4wam0sqym6l1s7v5bai";
-    sha256_64bit = "0h0jcckqpd63vaj95lvdgj2sbbn9y1ri1xx7r2snxfx0plhwz46n";
+    sha256_64bit = "0qgzsajrc3xkf2jjkwip3la0f2ixp45f76nmz5cphvzrb7k2slxn";
-    settingsSha256 = "1w5nkxs7a40mq0qf97nhfazdqhfn1bvr54v50s8p0ggixb6vdm3l";
+    settingsSha256 = "07nylqzhldq1gr40q7x5424p2aml3qqnvl2zvnpzc65x2way34v6";
-    persistencedSha256 = "02v76202qcnh8hvg4y9wmk9swdlv7z39ppfd1c850nlv158vn5nf";
+    persistencedSha256 = "0vab5rj9b1n9yl9674q7i88w1i5p8nhvrwsayn7i1vh4wp3m840r";
   };
 
   legacy_340 = generic {

pkgs/os-specific/linux/psmisc/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "psmisc";
-  version = "23.2";
+  version = "23.3";
 
   src = fetchFromGitLab {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "0d90wmibxpkl0d7sdibvvkwpyxyg6m6ksh5gwrjh15vf1swvd5i1";
+    sha256 = "1132xvrldv0dar2mf221mv5kvajq0v6yrq8k3nl0wslnh5baa0r0";
   };
 
   nativeBuildInputs = [ autoconf automake gettext ];

pkgs/servers/dns/nsd/default.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nsd";
-  version = "4.2.2";
+  version = "4.2.3";
 
   src = fetchurl {
     url = "https://www.nlnetlabs.nl/downloads/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1ys608jyp5scc957q4brm094c97sxlwymina7d2nvzi51aa37cw3";
+    sha256 = "1664wpglrwqk627xma10f9qa652vzmf90gsjd8pribyj74xrczc1";
   };
 
   prePatch = ''

pkgs/servers/mail/postfix/default.nix

@@ -26,11 +26,11 @@ in stdenv.mkDerivation rec {
 
   pname = "postfix";
 
-  version = "3.4.7";
+  version = "3.4.8";
 
   src = fetchurl {
     url = "ftp://ftp.cs.uu.nl/mirror/postfix/postfix-release/official/${pname}-${version}.tar.gz";
-    sha256 = "0rzr0n1gljhmxidsslbr9505xcv0hm8jahkp4dm87a1v3l956cpy";
+    sha256 = "0hw9kbr05qdzvfqhxi4dp4n3s9xvdh0gr0la08a4bip06ybl4pcd";
   };
 
   nativeBuildInputs = [ makeWrapper m4 ];

pkgs/servers/misc/subsonic/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "subsonic";
-  version = "6.1.5";
+  version = "6.1.6";
 
   src = fetchurl {
     url = "mirror://sourceforge/subsonic/subsonic-${version}-standalone.tar.gz";
-    sha256 = "1xz3flxd5hxcvvg1izzxpv5rxwb5zprk92vsgvmcniy7j7r66936";
+    sha256 = "180qdk8mnc147az8v9rmc1kgf8b13mmq88l195gjdwiqpflqzdyz";
   };
 
   inherit jre;

pkgs/servers/squid/default.nix

@@ -3,11 +3,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "squid-4.8";
+  name = "squid-4.9";
 
   src = fetchurl {
     url = "http://www.squid-cache.org/Versions/v4/${name}.tar.xz";
-    sha256 = "0432m0ix046rkja7r7qpydgsm2kf1w393xym15nx6h9kv4jb7kbq";
+    sha256 = "188znkbpr315yxbpvpvbpb5sbsn15zmg8l207a55dc43cs687c8w";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/servers/web-apps/moodle/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, writeText }:
 
 let
-  version = "3.7.3";
+  version = "3.8";
   stableVersion = builtins.substring 0 2 (builtins.replaceStrings ["."] [""] version);
 in
 
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.moodle.org/stable${stableVersion}/${pname}-${version}.tgz";
-    sha256 = "1n82n77lw83a5wjfjbvc74h2ny2z0zkdprxk7sai88rg6rix33ak";
+    sha256 = "00ssx0drgp1fy062x6alp0x8di7hjn4xc87v8skpy3aznchfxyk9";
   };
 
   phpConfig = writeText "config.php" ''

pkgs/shells/nushell/default.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nushell";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "012fhy7ni4kyxypn25ssj6py1zxwk41bj4xb1ni4zaw47fqsj1nw";
+    sha256 = "0fdi5c9l8ij2vqcxwi9203mh1qj3lcqsl4kl2rkshqj45hn4ab2a";
   };
 
-  cargoSha256 = "17r6g80qcy1mb195fl5iwcr83d35q2hs71camhwjbdh8yrs9l1la";
+  cargoSha256 = "11cr88jmy34lzjka7agzfvm13hvg66ksa735rzcdx7lcxha538f3";
 
   nativeBuildInputs = [ pkg-config ]
     ++ stdenv.lib.optionals (withAllFeatures && stdenv.isLinux) [ python3 ];

pkgs/tools/filesystems/grive2/default.nix

@@ -1,14 +1,14 @@
 { stdenv, fetchFromGitHub, pkgconfig, yajl, cmake, libgcrypt, curl, expat, boost, libiberty }:
 
 stdenv.mkDerivation rec {
-  version = "0.5.0";
+  version = "0.5.1";
   pname = "grive2";
 
   src = fetchFromGitHub {
     owner = "vitalif";
     repo = "grive2";
     rev =  "v${version}";
-    sha256 = "0gyic9228j25l5x8qj9xxxp2cgbw6y4skxqx0xrq6qilhv4lj23c";
+    sha256 = "1kv34ys8qarjsxpb1kd8dp7b3b4ycyiwjzd6mg97d3jk7405g6nm";
   };
 
   nativeBuildInputs = [ cmake pkgconfig ];

pkgs/tools/networking/haproxy/default.nix

@@ -11,11 +11,11 @@ assert usePcre -> pcre != null;
 
 stdenv.mkDerivation rec {
   pname = "haproxy";
-  version = "2.0.8";
+  version = "2.0.10";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${stdenv.lib.versions.majorMinor version}/src/${pname}-${version}.tar.gz";
-    sha256 = "02i87hr1dfhrk6nvvcig4m9bpww7hyl6qcxcl20rfvxd2n2iwzn3";
+    sha256 = "1sm42q9l159pdmjs5dg544z10dn6x073caljkqh0p4syshysnf0x";
   };
 
   buildInputs = [ openssl zlib ]

pkgs/tools/networking/nebula/default.nix

@@ -0,0 +1,43 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "nebula";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "slackhq";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0j7fna352z8kzx6n0hck7rp122c0v44j9syz0v30vq47xq2pwj5c";
+  };
+
+  modSha256 = "130h0gc5z0w5inpc99y6mismwg3nyzk3bqdq5v9yclkxlhkbcp6d";
+
+  subPackages = [ "cmd/nebula" "cmd/nebula-cert" ];
+
+  buildFlagsArray = [ "-ldflags='-X main.Build=${version}'" ];
+
+  meta = with lib; {
+    description = "A scalable overlay networking tool with a focus on performance, simplicity and security";
+    longDescription = ''
+      Nebula is a scalable overlay networking tool with a focus on performance,
+      simplicity and security. It lets you seamlessly connect computers
+      anywhere in the world. Nebula is portable, and runs on Linux, OSX, and
+      Windows. (Also: keep this quiet, but we have an early prototype running
+      on iOS). It can be used to connect a small number of computers, but is
+      also able to connect tens of thousands of computers.
+
+      Nebula incorporates a number of existing concepts like encryption,
+      security groups, certificates, and tunneling, and each of those
+      individual pieces existed before Nebula in various forms. What makes
+      Nebula different to existing offerings is that it brings all of these
+      ideas together, resulting in a sum that is greater than its individual
+      parts.
+    '';
+    homepage = "https://github.com/slackhq/nebula";
+    license = licenses.mit;
+    maintainers = with maintainers; [ filalex77 ];
+    platforms = platforms.all;
+  };
+
+}

pkgs/tools/networking/openapi-generator-cli/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, jre, makeWrapper }:
 
 stdenv.mkDerivation rec {
-  version = "4.2.0";
+  version = "4.2.1";
   pname = "openapi-generator-cli";
 
   jarfilename = "${pname}-${version}.jar";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://central.maven.org/maven2/org/openapitools/${pname}/${version}/${jarfilename}";
-    sha256 = "00c5y06b8lm6lhnnvl42yndwdgn42bwwfc7p1q7zcsga275b6jpb";
+    sha256 = "1inkiqbr183ksmkvpawagv1gqgc323wa1d6sdrd33pb9lk6wahdl";
   };
 
   phases = [ "installPhase" ];

pkgs/tools/security/fprintd/default.nix

@@ -1,11 +1,9 @@
-{ thinkpad ? false
+{ stdenv
-, stdenv
 , fetchurl
 , fetchpatch
 , pkgconfig
 , intltool
-, libfprint-thinkpad ? null
+, libfprint
-, libfprint ? null
 , glib
 , dbus-glib
 , polkit
@@ -17,7 +15,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  pname = "fprintd" + stdenv.lib.optionalString thinkpad "-thinkpad";
+  pname = "fprintd";
   version = "0.9.0";
 
   src = fetchurl {
@@ -46,10 +44,8 @@ stdenv.mkDerivation rec {
     nss
     pam
     systemd
-  ]
+    libfprint
-  ++ stdenv.lib.optional thinkpad libfprint-thinkpad
+  ];
-  ++ stdenv.lib.optional (!thinkpad) libfprint
-  ;
 
   configureFlags = [
     # is hardcoded to /var/lib/fprint, this is for the StateDirectory install target

pkgs/top-level/aliases.nix

@@ -115,6 +115,7 @@ mapAliases ({
   '';
   font-droid = throw "font-droid has been deprecated by noto-fonts"; # 2019-04-12
   foomatic_filters = foomatic-filters;  # 2016-08
+  fprintd-thinkpad = throw "removed from repository 2019-12-01: Install it manually with an override.";
   fuse_exfat = exfat;                   # 2015-09-11
   fuseki = apache-jena-fuseki; # added 2018-04-25
   fusesmb = throw "fusesmb is abandoned by upstream"; # added 2019-10-15
@@ -193,6 +194,7 @@ mapAliases ({
   liberation_ttf_v1_from_source = liberation_ttf_v1; # added 2018-12-12
   liberation_ttf_v2_from_source = liberation_ttf_v2; # added 2018-12-12
   liberationsansnarrow = liberation-sans-narrow; # added 2018-12-12
+  libfprint-thinkpad = throw "removed from repository 2019-12-01: Install it manually with an override.";
   libgnome_keyring = libgnome-keyring; # added 2018-02-25
   libgnome_keyring3 = libgnome-keyring3; # added 2018-02-25
   libgumbo = gumbo; # added 2018-01-21

pkgs/top-level/all-packages.nix

@@ -3303,9 +3303,6 @@ in
   fprot = callPackage ../tools/security/fprot { };
 
   fprintd = callPackage ../tools/security/fprintd { };
-  fprintd-thinkpad = fprintd.override {
-    thinkpad = true;
-  };
 
   franz = callPackage ../applications/networking/instant-messengers/franz { };
 
@@ -5075,6 +5072,8 @@ in
 
   ndppd = callPackage ../applications/networking/ndppd { };
 
+  nebula = callPackage ../tools/networking/nebula { };
+
   nemiver = callPackage ../development/tools/nemiver { };
 
   neofetch = callPackage ../tools/misc/neofetch { };
@@ -12220,9 +12219,6 @@ in
   };
 
   libfprint = callPackage ../development/libraries/libfprint { };
-  libfprint-thinkpad = libfprint.override {
-    thinkpad = true;
-  };
 
   libfpx = callPackage ../development/libraries/libfpx { };
 

pkgs/top-level/python-packages.nix

@@ -1049,11 +1049,6 @@ in {
 
   pyjwkest = callPackage ../development/python-modules/pyjwkest { };
 
-  pykde4 = callPackage ../development/python-modules/pykde4 {
-    inherit (self) pyqt4;
-    callPackage = pkgs.callPackage;
-  };
-
   pykdtree = callPackage ../development/python-modules/pykdtree {
     inherit (pkgs.llvmPackages) openmp;
   };