Merge master into staging-next

.github/workflows/editorconfig.yml

@@ -11,7 +11,7 @@ jobs:
       with:
         fetch-depth: 0
     - uses: technote-space/get-diff-action@v2.0.3
-    - name: fetch editorconfig-checker
+    - name: Fetch editorconfig-checker
       env:
         VERSION: "2.1.0"
         OS: "linux"

.github/workflows/wait-ofborg.yml

@@ -7,8 +7,9 @@ jobs:
     steps:
     - name: Wait for ofborg CI
       run: |
+        # Wait for ofborg ...
         # eval sometimes takes a bit longer on staging.
-        if [[ "$BASE_BRANCH" == "refs/heads/staging" ]]; then
+        if [[ "$BASE_BRANCH" == "staging" ]]; then
           COUNTDOWN=$((COUNTDOWN*2))
         fi
         # ..in future a better fix would be to make ofborg mark CI as pending right away.
@@ -30,7 +31,7 @@ jobs:
       if: github.repository_owner == 'NixOS'
       env:
         BASE_BRANCH: ${{ github.base_ref }}
-        COUNTDOWN: 360 # wait for ~30min...
+        COUNTDOWN: 540 # wait for ~45min...
         GITHUB_TOKEN: ${{ github.token }}
         COMMIT: ${{ github.event.pull_request.head.sha }}
         OFBORG_APP_ID: 20500

nixos/doc/manual/release-notes/rl-2009.xml

@@ -721,6 +721,37 @@ services.postgresql.dataDir = "/var/db/postgresql";
      was removed, as udev gained native support to handle FIDO security tokens.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The <literal>services.transmission</literal> module
+     was enhanced with the new options:
+     <xref linkend="opt-services.transmission.credentialsFile"/>,
+     <xref linkend="opt-services.transmission.openFirewall"/>,
+     and <xref linkend="opt-services.transmission.performanceNetParameters"/>.
+    </para>
+    <para>
+     <literal>transmission-daemon</literal> is now started with additional systemd sandbox/hardening options for better security.
+     Please <link xlink:href="https://github.com/NixOS/nixpkgs/issues">report</link>
+     any use case where this is not working well.
+     In particular, the <literal>RootDirectory</literal> option newly set
+     forbids uploading or downloading a torrent outside of the default directory
+     configured at <link linkend="opt-services.transmission.settings">settings.download-dir</link>.
+     If you really need Transmission to access other directories,
+     you must include those directories into the <literal>BindPaths</literal> of the service:
+<programlisting>
+systemd.services.transmission.serviceConfig.BindPaths = [ "/path/to/alternative/download-dir" ];
+</programlisting>
+    </para>
+    <para>
+     Also, connection to the RPC (Remote Procedure Call) of <literal>transmission-daemon</literal>
+     is now only available on the local network interface by default.
+     Use:
+<programlisting>
+services.transmission.settings.rpc-bind-address = "0.0.0.0";
+</programlisting>
+     to get the previous behavior of listening on all network interfaces.
+    </para>
+   </listitem>
    <listitem>
     <para>
      With this release <literal>systemd-networkd</literal> (when enabled through <xref linkend="opt-networking.useNetworkd"/>)

nixos/modules/services/databases/postgresql.nix

@@ -333,7 +333,7 @@ in
             # Wait for PostgreSQL to be ready to accept connections.
             ExecStartPost =
               let
-                setupScript = pkgs.writeScript "postgresql-setup" ''
+                setupScript = pkgs.writeScript "postgresql-setup" (''
                   #!${pkgs.runtimeShell} -e
 
                   PSQL="${pkgs.utillinux}/bin/runuser -u ${cfg.superUser} -- psql --port=${toString cfg.port}"
@@ -360,7 +360,7 @@ in
                       $PSQL -tAc 'GRANT ${permission} ON ${database} TO "${user.name}"'
                     '') user.ensurePermissions)}
                   '') cfg.ensureUsers}
-                '';
+                '');
               in
                 "+${setupScript}";
           }

nixos/modules/services/misc/gitlab.nix

@@ -618,26 +618,38 @@ in {
       enable = true;
       ensureUsers = singleton { name = cfg.databaseUsername; };
     };
+
     # The postgresql module doesn't currently support concepts like
     # objects owners and extensions; for now we tack on what's needed
     # here.
-    systemd.services.postgresql.postStart = mkAfter (optionalString databaseActuallyCreateLocally ''
+    systemd.services.gitlab-postgresql = let pgsql = config.services.postgresql; in mkIf databaseActuallyCreateLocally {
-      set -eu
+      after = [ "postgresql.service" ];
+      wantedBy = [ "multi-user.target" ];
+      path = [ pgsql.package ];
+      script = ''
+        set -eu
 
-      $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
+        PSQL="${pkgs.utillinux}/bin/runuser -u ${pgsql.superUser} -- psql --port=${toString pgsql.port}"
-      current_owner=$($PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.databaseName}'")
+
-      if [[ "$current_owner" != "${cfg.databaseUsername}" ]]; then
+        $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
-          $PSQL -tAc 'ALTER DATABASE "${cfg.databaseName}" OWNER TO "${cfg.databaseUsername}"'
+        current_owner=$($PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.databaseName}'")
-          if [[ -e "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}" ]]; then
+        if [[ "$current_owner" != "${cfg.databaseUsername}" ]]; then
-              echo "Reassigning ownership of database ${cfg.databaseName} to user ${cfg.databaseUsername} failed on last boot. Failing..."
+            $PSQL -tAc 'ALTER DATABASE "${cfg.databaseName}" OWNER TO "${cfg.databaseUsername}"'
-              exit 1
+            if [[ -e "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}" ]]; then
-          fi
+                echo "Reassigning ownership of database ${cfg.databaseName} to user ${cfg.databaseUsername} failed on last boot. Failing..."
-          touch "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
+                exit 1
-          $PSQL "${cfg.databaseName}" -tAc "REASSIGN OWNED BY \"$current_owner\" TO \"${cfg.databaseUsername}\""
+            fi
-          rm "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
+            touch "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
-      fi
+            $PSQL "${cfg.databaseName}" -tAc "REASSIGN OWNED BY \"$current_owner\" TO \"${cfg.databaseUsername}\""
-      $PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
+            rm "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
-    '');
+        fi
+        $PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
+      '';
+
+      serviceConfig = {
+        Type = "oneshot";
+      };
+    };
 
     # Use postfix to send out mails.
     services.postfix.enable = mkDefault true;
@@ -767,7 +779,7 @@ in {
     };
 
     systemd.services.gitlab = {
-      after = [ "gitlab-workhorse.service" "gitaly.service" "network.target" "postgresql.service" "redis.service" ];
+      after = [ "gitlab-workhorse.service" "gitaly.service" "network.target" "gitlab-postgresql.service" "redis.service" ];
       requires = [ "gitlab-sidekiq.service" ];
       wantedBy = [ "multi-user.target" ];
       environment = gitlabEnv;

nixos/modules/services/torrent/transmission.nix

@@ -1,52 +1,51 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, options, ... }:
 
 with lib;
 
 let
   cfg = config.services.transmission;
+  inherit (config.environment) etc;
   apparmor = config.security.apparmor.enable;
-
+  rootDir = "/run/transmission";
-  homeDir = cfg.home;
+  homeDir = "/var/lib/transmission";
-  downloadDirPermissions = cfg.downloadDirPermissions;
+  settingsDir = ".config/transmission-daemon";
-  downloadDir = "${homeDir}/Downloads";
+  downloadsDir = "Downloads";
-  incompleteDir = "${homeDir}/.incomplete";
+  incompleteDir = ".incomplete";
-
+  # TODO: switch to configGen.json once RFC0042 is implemented
-  settingsDir = "${homeDir}/config";
+  settingsFile = pkgs.writeText "settings.json" (builtins.toJSON cfg.settings);
-  settingsFile = pkgs.writeText "settings.json" (builtins.toJSON fullSettings);
-
-  # for users in group "transmission" to have access to torrents
-  fullSettings = { umask = 2; download-dir = downloadDir; incomplete-dir = incompleteDir; } // cfg.settings;
-
-  preStart = pkgs.writeScript "transmission-pre-start" ''
-    #!${pkgs.runtimeShell}
-    set -ex
-    cp -f ${settingsFile} ${settingsDir}/settings.json
-  '';
 in
 {
   options = {
     services.transmission = {
-      enable = mkOption {
+      enable = mkEnableOption ''the headless Transmission BitTorrent daemon.
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether or not to enable the headless Transmission BitTorrent daemon.
 
-          Transmission daemon can be controlled via the RPC interface using
+        Transmission daemon can be controlled via the RPC interface using
-          transmission-remote or the WebUI (http://localhost:9091/ by default).
+        transmission-remote, the WebUI (http://127.0.0.1:9091/ by default),
+        or other clients like stig or tremc.
 
-          Torrents are downloaded to ${downloadDir} by default and are
+        Torrents are downloaded to ${homeDir}/${downloadsDir} by default and are
-          accessible to users in the "transmission" group.
+        accessible to users in the "transmission" group'';
-        '';
-      };
 
-      settings = mkOption {
+      settings = mkOption rec {
+        # TODO: switch to types.config.json as prescribed by RFC0042 once it's implemented
         type = types.attrs;
+        apply = recursiveUpdate default;
         default =
           {
-            download-dir = downloadDir;
+            download-dir = "${cfg.home}/${downloadsDir}";
-            incomplete-dir = incompleteDir;
+            incomplete-dir = "${cfg.home}/${incompleteDir}";
             incomplete-dir-enabled = true;
+            message-level = 1;
+            peer-port = 51413;
+            peer-port-random-high = 65535;
+            peer-port-random-low = 49152;
+            peer-port-random-on-start = false;
+            rpc-bind-address = "127.0.0.1";
+            rpc-port = 9091;
+            script-torrent-done-enabled = false;
+            script-torrent-done-filename = "";
+            umask = 2; # 0o002 in decimal as expected by Transmission
+            utp-enabled = true;
           };
         example =
           {
@@ -56,11 +55,12 @@ in
             rpc-whitelist = "127.0.0.1,192.168.*.*";
           };
         description = ''
-          Attribute set whos fields overwrites fields in settings.json (each
+          Attribute set whose fields overwrites fields in
-          time the service starts). String values must be quoted, integer and
+          <literal>.config/transmission-daemon/settings.json</literal>
+          (each time the service starts). String values must be quoted, integer and
           boolean values must not.
 
-          See https://github.com/transmission/transmission/wiki/Editing-Configuration-Files
+          See <link xlink:href="https://github.com/transmission/transmission/wiki/Editing-Configuration-Files">Transmission's Wiki</link>
           for documentation.
         '';
       };
@@ -70,22 +70,32 @@ in
         default = "770";
         example = "775";
         description = ''
-          The permissions to set for download-dir and incomplete-dir.
+          The permissions set by <literal>systemd.activationScripts.transmission-daemon</literal>
-          They will be applied on every service start.
+          on the directories <link linkend="opt-services.transmission.settings">settings.download-dir</link>
+          and <link linkend="opt-services.transmission.settings">settings.incomplete-dir</link>.
+          Note that you may also want to change
+          <link linkend="opt-services.transmission.settings">settings.umask</link>.
         '';
       };
 
       port = mkOption {
-        type = types.int;
+        type = types.port;
-        default = 9091;
+        description = ''
-        description = "TCP port number to run the RPC/web interface.";
+          TCP port number to run the RPC/web interface.
+
+          If instead you want to change the peer port,
+          use <link linkend="opt-services.transmission.settings">settings.peer-port</link>
+          or <link linkend="opt-services.transmission.settings">settings.peer-port-random-on-start</link>.
+        '';
       };
 
       home = mkOption {
         type = types.path;
-        default = "/var/lib/transmission";
+        default = homeDir;
         description = ''
-          The directory where transmission will create files.
+          The directory where Transmission will create <literal>${settingsDir}</literal>.
+          as well as <literal>${downloadsDir}/</literal> unless <link linkend="opt-services.transmission.settings">settings.download-dir</link> is changed,
+          and <literal>${incompleteDir}/</literal> unless <link linkend="opt-services.transmission.settings">settings.incomplete-dir</link> is changed.
         '';
       };
 
@@ -100,32 +110,174 @@ in
         default = "transmission";
         description = "Group account under which Transmission runs.";
       };
+
+      credentialsFile = mkOption {
+        type = types.path;
+        description = ''
+          Path to a JSON file to be merged with the settings.
+          Useful to merge a file which is better kept out of the Nix store
+          because it contains sensible data like <link linkend="opt-services.transmission.settings">settings.rpc-password</link>.
+        '';
+        default = "/dev/null";
+        example = "/var/lib/secrets/transmission/settings.json";
+      };
+
+      openFirewall = mkEnableOption "opening of the peer port(s) in the firewall";
+
+      performanceNetParameters = mkEnableOption ''tweaking of kernel parameters
+        to open many more connections at the same time.
+
+        Note that you may also want to increase
+        <link linkend="opt-services.transmission.settings">settings.peer-limit-global</link>.
+        And be aware that these settings are quite aggressive
+        and might not suite your regular desktop use.
+        For instance, SSH sessions may time out more easily'';
     };
   };
 
   config = mkIf cfg.enable {
-    systemd.tmpfiles.rules = [
+    # Note that using systemd.tmpfiles would not work here
-      "d '${homeDir}' 0770 '${cfg.user}' '${cfg.group}' - -"
+    # because it would fail when creating a directory
-      "d '${settingsDir}' 0700 '${cfg.user}' '${cfg.group}' - -"
+    # with a different owner than its parent directory, by saying:
-      "d '${fullSettings.download-dir}' '${downloadDirPermissions}' '${cfg.user}' '${cfg.group}' - -"
+    # Detected unsafe path transition /home/foo → /home/foo/Downloads during canonicalization of /home/foo/Downloads
-      "d '${fullSettings.incomplete-dir}' '${downloadDirPermissions}' '${cfg.user}' '${cfg.group}' - -"
+    # when /home/foo is not owned by cfg.user.
+    # Note also that using an ExecStartPre= wouldn't work either
+    # because BindPaths= needs these directories before.
+    system.activationScripts.transmission-daemon = ''
+      install -d -m 700 '${cfg.home}/${settingsDir}'
+      chown -R '${cfg.user}:${cfg.group}' ${cfg.home}/${settingsDir}
+      install -d -m '${cfg.downloadDirPermissions}' -o '${cfg.user}' -g '${cfg.group}' '${cfg.settings.download-dir}'
+      '' + optionalString cfg.settings.incomplete-dir-enabled ''
+      install -d -m '${cfg.downloadDirPermissions}' -o '${cfg.user}' -g '${cfg.group}' '${cfg.settings.incomplete-dir}'
+      '';
+
+    assertions = [
+      { assertion = builtins.match "^/.*" cfg.home != null;
+        message = "`services.transmission.home' must be an absolute path.";
+      }
+      { assertion = types.path.check cfg.settings.download-dir;
+        message = "`services.transmission.settings.download-dir' must be an absolute path.";
+      }
+      { assertion = types.path.check cfg.settings.incomplete-dir;
+        message = "`services.transmission.settings.incomplete-dir' must be an absolute path.";
+      }
+      { assertion = cfg.settings.script-torrent-done-filename == "" || types.path.check cfg.settings.script-torrent-done-filename;
+        message = "`services.transmission.settings.script-torrent-done-filename' must be an absolute path.";
+      }
+      { assertion = types.port.check cfg.settings.rpc-port;
+        message = "${toString cfg.settings.rpc-port} is not a valid port number for `services.transmission.settings.rpc-port`.";
+      }
+      # In case both port and settings.rpc-port are explicitely defined: they must be the same.
+      { assertion = !options.services.transmission.port.isDefined || cfg.port == cfg.settings.rpc-port;
+        message = "`services.transmission.port' is not equal to `services.transmission.settings.rpc-port'";
+      }
     ];
 
+    services.transmission.settings =
+      optionalAttrs options.services.transmission.port.isDefined { rpc-port = cfg.port; };
+
     systemd.services.transmission = {
       description = "Transmission BitTorrent Service";
       after = [ "network.target" ] ++ optional apparmor "apparmor.service";
-      requires = mkIf apparmor [ "apparmor.service" ];
+      requires = optional apparmor "apparmor.service";
       wantedBy = [ "multi-user.target" ];
+      environment.CURL_CA_BUNDLE = etc."ssl/certs/ca-certificates.crt".source;
 
-      # 1) Only the "transmission" user and group have access to torrents.
+      serviceConfig = {
-      # 2) Optionally update/force specific fields into the configuration file.
+        # Use "+" because credentialsFile may not be accessible to User= or Group=.
-      serviceConfig.ExecStartPre = preStart;
+        ExecStartPre = [("+" + pkgs.writeShellScript "transmission-prestart" ''
-      serviceConfig.ExecStart = "${pkgs.transmission}/bin/transmission-daemon -f --port ${toString config.services.transmission.port} --config-dir ${settingsDir}";
+          set -eu${lib.optionalString (cfg.settings.message-level >= 3) "x"}
-      serviceConfig.ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          ${pkgs.jq}/bin/jq --slurp add ${settingsFile} '${cfg.credentialsFile}' |
-      serviceConfig.User = cfg.user;
+          install -D -m 600 -o '${cfg.user}' -g '${cfg.group}' /dev/stdin \
-      serviceConfig.Group = cfg.group;
+           '${cfg.home}/${settingsDir}/settings.json'
-      # NOTE: transmission has an internal umask that also must be set (in settings.json)
+        '')];
-      serviceConfig.UMask = "0002";
+        ExecStart="${pkgs.transmission}/bin/transmission-daemon -f";
+        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+        User = cfg.user;
+        Group = cfg.group;
+        # Create rootDir in the host's mount namespace.
+        RuntimeDirectory = [(baseNameOf rootDir)];
+        RuntimeDirectoryMode = "755";
+        # Avoid mounting rootDir in the own rootDir of ExecStart='s mount namespace.
+        InaccessiblePaths = ["-+${rootDir}"];
+        # This is for BindPaths= and BindReadOnlyPaths=
+        # to allow traversal of directories they create in RootDirectory=.
+        UMask = "0066";
+        # Using RootDirectory= makes it possible
+        # to use the same paths download-dir/incomplete-dir
+        # (which appear in user's interfaces) without requiring cfg.user
+        # to have access to their parent directories,
+        # by using BindPaths=/BindReadOnlyPaths=.
+        # Note that TemporaryFileSystem= could have been used instead
+        # but not without adding some BindPaths=/BindReadOnlyPaths=
+        # that would only be needed for ExecStartPre=,
+        # because RootDirectoryStartOnly=true would not help.
+        RootDirectory = rootDir;
+        RootDirectoryStartOnly = true;
+        MountAPIVFS = true;
+        BindPaths =
+          [ "${cfg.home}/${settingsDir}"
+            cfg.settings.download-dir
+          ] ++
+          optional cfg.settings.incomplete-dir-enabled
+            cfg.settings.incomplete-dir;
+        BindReadOnlyPaths = [
+          # No confinement done of /nix/store here like in systemd-confinement.nix,
+          # an AppArmor profile is provided to get a confinement based upon paths and rights.
+          builtins.storeDir
+          "-/etc/hosts"
+          "-/etc/ld-nix.so.preload"
+          "-/etc/localtime"
+          ] ++
+          optional (cfg.settings.script-torrent-done-enabled &&
+                    cfg.settings.script-torrent-done-filename != "")
+            cfg.settings.script-torrent-done-filename;
+        # The following options are only for optimizing:
+        # systemd-analyze security transmission
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        # ProtectClock= adds DeviceAllow=char-rtc r
+        DeviceAllow = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateNetwork = mkDefault false;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        # ProtectHome=true would not allow BindPaths= to work accross /home,
+        # and ProtectHome=tmpfs would break statfs(),
+        # preventing transmission-daemon to report the available free space.
+        # However, RootDirectory= is used, so this is not a security concern
+        # since there would be nothing in /home but any BindPaths= wanted by the user.
+        ProtectHome = "read-only";
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        # AF_UNIX may become usable one day:
+        # https://github.com/transmission/transmission/issues/441
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallFilter = [
+          "@system-service"
+          # Groups in @system-service which do not contain a syscall
+          # listed by perf stat -e 'syscalls:sys_enter_*' transmission-daemon -f
+          # in tests, and seem likely not necessary for transmission-daemon.
+          "~@aio" "~@chown" "~@keyring" "~@memlock" "~@resources" "~@setuid" "~@timer"
+          # In the @privileged group, but reached when querying infos through RPC (eg. with stig).
+          "quotactl"
+        ];
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+      };
     };
 
     # It's useful to have transmission in path, e.g. for remote control
@@ -133,70 +285,153 @@ in
 
     users.users = optionalAttrs (cfg.user == "transmission") ({
       transmission = {
-        name = "transmission";
         group = cfg.group;
         uid = config.ids.uids.transmission;
         description = "Transmission BitTorrent user";
-        home = homeDir;
+        home = cfg.home;
-        createHome = true;
       };
     });
 
     users.groups = optionalAttrs (cfg.group == "transmission") ({
       transmission = {
-        name = "transmission";
         gid = config.ids.gids.transmission;
       };
     });
 
-    # AppArmor profile
+    networking.firewall = mkIf cfg.openFirewall (
+      if cfg.settings.peer-port-random-on-start
+      then
+        { allowedTCPPortRanges =
+            [ { from = cfg.settings.peer-port-random-low;
+                to   = cfg.settings.peer-port-random-high;
+              }
+            ];
+          allowedUDPPortRanges =
+            [ { from = cfg.settings.peer-port-random-low;
+                to   = cfg.settings.peer-port-random-high;
+              }
+            ];
+        }
+      else
+        { allowedTCPPorts = [ cfg.settings.peer-port ];
+          allowedUDPPorts = [ cfg.settings.peer-port ];
+        }
+    );
+
+    boot.kernel.sysctl = mkMerge [
+      # Transmission uses a single UDP socket in order to implement multiple uTP sockets,
+      # and thus expects large kernel buffers for the UDP socket,
+      # https://trac.transmissionbt.com/browser/trunk/libtransmission/tr-udp.c?rev=11956.
+      # at least up to the values hardcoded here:
+      (mkIf cfg.settings.utp-enabled {
+        "net.core.rmem_max" = mkDefault "4194304"; # 4MB
+        "net.core.wmem_max" = mkDefault "1048576"; # 1MB
+      })
+      (mkIf cfg.performanceNetParameters {
+        # Increase the number of available source (local) TCP and UDP ports to 49151.
+        # Usual default is 32768 60999, ie. 28231 ports.
+        # Find out your current usage with: ss -s
+        "net.ipv4.ip_local_port_range" = "16384 65535";
+        # Timeout faster generic TCP states.
+        # Usual default is 600.
+        # Find out your current usage with: watch -n 1 netstat -nptuo
+        "net.netfilter.nf_conntrack_generic_timeout" = 60;
+        # Timeout faster established but inactive connections.
+        # Usual default is 432000.
+        "net.netfilter.nf_conntrack_tcp_timeout_established" = 600;
+        # Clear immediately TCP states after timeout.
+        # Usual default is 120.
+        "net.netfilter.nf_conntrack_tcp_timeout_time_wait" = 1;
+        # Increase the number of trackable connections.
+        # Usual default is 262144.
+        # Find out your current usage with: conntrack -C
+        "net.netfilter.nf_conntrack_max" = 1048576;
+      })
+    ];
+
     security.apparmor.profiles = mkIf apparmor [
       (pkgs.writeText "apparmor-transmission-daemon" ''
-        #include <tunables/global>
+        include <tunables/global>
 
         ${pkgs.transmission}/bin/transmission-daemon {
-          #include <abstractions/base>
+          include <abstractions/base>
-          #include <abstractions/nameservice>
+          include <abstractions/nameservice>
 
-          ${getLib pkgs.glibc}/lib/*.so                    mr,
+          # NOTE: https://github.com/NixOS/nixpkgs/pull/93457
-          ${getLib pkgs.libevent}/lib/libevent*.so*        mr,
+          # will remove the need for these by fixing <abstractions/base>
-          ${getLib pkgs.curl}/lib/libcurl*.so*             mr,
+          r ${etc."hosts".source},
-          ${getLib pkgs.openssl}/lib/libssl*.so*           mr,
+          r /etc/ld-nix.so.preload,
-          ${getLib pkgs.openssl}/lib/libcrypto*.so*        mr,
+          ${lib.optionalString (builtins.hasAttr "ld-nix.so.preload" etc) ''
-          ${getLib pkgs.zlib}/lib/libz*.so*                mr,
+            r ${etc."ld-nix.so.preload".source},
-          ${getLib pkgs.libssh2}/lib/libssh2*.so*          mr,
+            ${concatMapStrings (p: optionalString (p != "") ("mr ${p},\n"))
-          ${getLib pkgs.systemd}/lib/libsystemd*.so*       mr,
+              (splitString "\n" config.environment.etc."ld-nix.so.preload".text)}
-          ${getLib pkgs.xz}/lib/liblzma*.so*               mr,
-          ${getLib pkgs.libgcrypt}/lib/libgcrypt*.so*      mr,
-          ${getLib pkgs.libgpgerror}/lib/libgpg-error*.so* mr,
-          ${getLib pkgs.nghttp2}/lib/libnghttp2*.so*       mr,
-          ${getLib pkgs.c-ares}/lib/libcares*.so*          mr,
-          ${getLib pkgs.libcap}/lib/libcap*.so*            mr,
-          ${getLib pkgs.attr}/lib/libattr*.so*             mr,
-          ${getLib pkgs.lz4}/lib/liblz4*.so*               mr,
-          ${getLib pkgs.libkrb5}/lib/lib*.so*              mr,
-          ${getLib pkgs.keyutils}/lib/libkeyutils*.so*     mr,
-          ${getLib pkgs.utillinuxMinimal.out}/lib/libblkid.so.* mr,
-          ${getLib pkgs.utillinuxMinimal.out}/lib/libmount.so.* mr,
-          ${getLib pkgs.utillinuxMinimal.out}/lib/libuuid.so.* mr,
-          ${getLib pkgs.gcc.cc.lib}/lib/libstdc++.so.* mr,
-          ${getLib pkgs.gcc.cc.lib}/lib/libgcc_s.so.* mr,
-
-          @{PROC}/sys/kernel/random/uuid   r,
-          @{PROC}/sys/vm/overcommit_memory r,
-
-          ${pkgs.openssl.out}/etc/**                     r,
-          ${pkgs.transmission}/share/transmission/** r,
-
-          owner ${settingsDir}/** rw,
-
-          ${fullSettings.download-dir}/** rw,
-          ${optionalString fullSettings.incomplete-dir-enabled ''
-            ${fullSettings.incomplete-dir}/** rw,
           ''}
+          r ${etc."ssl/certs/ca-certificates.crt".source},
+          r ${pkgs.tzdata}/share/zoneinfo/**,
+          r ${pkgs.stdenv.cc.libc}/share/i18n/**,
+          r ${pkgs.stdenv.cc.libc}/share/locale/**,
+
+          mr ${getLib pkgs.stdenv.cc.cc}/lib/*.so*,
+          mr ${getLib pkgs.stdenv.cc.libc}/lib/*.so*,
+          mr ${getLib pkgs.attr}/lib/libattr*.so*,
+          mr ${getLib pkgs.c-ares}/lib/libcares*.so*,
+          mr ${getLib pkgs.curl}/lib/libcurl*.so*,
+          mr ${getLib pkgs.keyutils}/lib/libkeyutils*.so*,
+          mr ${getLib pkgs.libcap}/lib/libcap*.so*,
+          mr ${getLib pkgs.libevent}/lib/libevent*.so*,
+          mr ${getLib pkgs.libgcrypt}/lib/libgcrypt*.so*,
+          mr ${getLib pkgs.libgpgerror}/lib/libgpg-error*.so*,
+          mr ${getLib pkgs.libkrb5}/lib/lib*.so*,
+          mr ${getLib pkgs.libssh2}/lib/libssh2*.so*,
+          mr ${getLib pkgs.lz4}/lib/liblz4*.so*,
+          mr ${getLib pkgs.nghttp2}/lib/libnghttp2*.so*,
+          mr ${getLib pkgs.openssl}/lib/libcrypto*.so*,
+          mr ${getLib pkgs.openssl}/lib/libssl*.so*,
+          mr ${getLib pkgs.systemd}/lib/libsystemd*.so*,
+          mr ${getLib pkgs.utillinuxMinimal.out}/lib/libblkid.so*,
+          mr ${getLib pkgs.utillinuxMinimal.out}/lib/libmount.so*,
+          mr ${getLib pkgs.utillinuxMinimal.out}/lib/libuuid.so*,
+          mr ${getLib pkgs.xz}/lib/liblzma*.so*,
+          mr ${getLib pkgs.zlib}/lib/libz*.so*,
+
+          r @{PROC}/sys/kernel/random/uuid,
+          r @{PROC}/sys/vm/overcommit_memory,
+          # @{pid} is not a kernel variable yet but a regexp
+          #r @{PROC}/@{pid}/environ,
+          r @{PROC}/@{pid}/mounts,
+          rwk /tmp/tr_session_id_*,
+
+          r ${pkgs.openssl.out}/etc/**,
+          r ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE},
+          r ${pkgs.transmission}/share/transmission/**,
+
+          owner rw ${cfg.home}/${settingsDir}/**,
+          rw ${cfg.settings.download-dir}/**,
+          ${optionalString cfg.settings.incomplete-dir-enabled ''
+            rw ${cfg.settings.incomplete-dir}/**,
+          ''}
+          profile dirs {
+            rw ${cfg.settings.download-dir}/**,
+            ${optionalString cfg.settings.incomplete-dir-enabled ''
+              rw ${cfg.settings.incomplete-dir}/**,
+            ''}
+          }
+
+          ${optionalString (cfg.settings.script-torrent-done-enabled &&
+                            cfg.settings.script-torrent-done-filename != "") ''
+            # Stack transmission_directories profile on top of
+            # any existing profile for script-torrent-done-filename
+            # FIXME: to be tested as I'm not sure it works well with NoNewPrivileges=
+            # https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking#seccomp-and-no_new_privs
+            px ${cfg.settings.script-torrent-done-filename} -> &@{dirs},
+          ''}
+
+          # FIXME: enable customizing using https://github.com/NixOS/nixpkgs/pull/93457
+          # include <local/transmission-daemon>
         }
       '')
     ];
   };
 
+  meta.maintainers = with lib.maintainers; [ julm ];
 }

nixos/modules/services/web-apps/nextcloud.nix

@@ -45,6 +45,12 @@ let
   inherit (config.system) stateVersion;
 
 in {
+
+  imports = [
+    ( mkRemovedOptionModule [ "services" "nextcloud" "nginx" "enable" ]
+      "The nextcloud module dropped support for other webservers than nginx.")
+  ];
+
   options.services.nextcloud = {
     enable = mkEnableOption "nextcloud";
     hostName = mkOption {
@@ -91,16 +97,6 @@ in {
       '';
     };
 
-    nginx.enable = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Whether to enable nginx virtual host management.
-        Further nginx configuration can be done by adapting <literal>services.nginx.virtualHosts.&lt;name&gt;</literal>.
-        See <xref linkend="opt-services.nginx.virtualHosts"/> for further information.
-      '';
-    };
-
     webfinger = mkOption {
       type = types.bool;
       default = false;
@@ -468,10 +464,18 @@ in {
           script = ''
             chmod og+x ${cfg.home}
             ln -sf ${cfg.package}/apps ${cfg.home}/
-            mkdir -p ${cfg.home}/config ${cfg.home}/data ${cfg.home}/store-apps
-            ln -sf ${overrideConfig} ${cfg.home}/config/override.config.php
 
-            chown -R nextcloud:nginx ${cfg.home}/config ${cfg.home}/data ${cfg.home}/store-apps
+            # create nextcloud directories.
+            # if the directories exist already with wrong permissions, we fix that
+            for dir in ${cfg.home}/config ${cfg.home}/data ${cfg.home}/store-apps; do
+              if [ ! -e $dir ]; then
+                install -o nextcloud -g nextcloud -d $dir
+              elif [ $(stat -c "%G" $dir) != "nextcloud" ]; then
+                chgrp -R nextcloud $dir
+              fi
+            done
+
+            ln -sf ${overrideConfig} ${cfg.home}/config/override.config.php
 
             # Do not install if already installed
             if [[ ! -e ${cfg.home}/config/config.php ]]; then
@@ -484,6 +488,7 @@ in {
             ${occSetTrustedDomainsCmd}
           '';
           serviceConfig.Type = "oneshot";
+          serviceConfig.User = "nextcloud";
         };
         nextcloud-cron = {
           environment.NEXTCLOUD_CONFIG_DIR = "${cfg.home}/config";
@@ -502,7 +507,7 @@ in {
       services.phpfpm = {
         pools.nextcloud = {
           user = "nextcloud";
-          group = "nginx";
+          group = "nextcloud";
           phpOptions = phpOptionsStr;
           phpPackage = phpPackage;
           phpEnv = {
@@ -510,99 +515,82 @@ in {
             PATH = "/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin";
           };
           settings = mapAttrs (name: mkDefault) {
-            "listen.owner" = "nginx";
+            "listen.owner" = config.services.nginx.user;
-            "listen.group" = "nginx";
+            "listen.group" = config.services.nginx.group;
           } // cfg.poolSettings;
           extraConfig = cfg.poolConfig;
         };
       };
 
-      users.extraUsers.nextcloud = {
+      users.users.nextcloud = {
         home = "${cfg.home}";
-        group = "nginx";
+        group = "nextcloud";
         createHome = true;
       };
+      users.groups.nextcloud.members = [ "nextcloud" config.services.nginx.user ];
 
       environment.systemPackages = [ occ ];
-    }
 
-    (mkIf cfg.nginx.enable {
+      services.nginx = mkDefault {
-      services.nginx = {
         enable = true;
-        virtualHosts = {
+        virtualHosts.${cfg.hostName} = {
-          ${cfg.hostName} = {
+          root = cfg.package;
-            root = cfg.package;
+          locations = {
-            locations = {
+            "= /robots.txt" = {
-              "= /robots.txt" = {
+              priority = 100;
-                priority = 100;
+              extraConfig = ''
-                extraConfig = ''
+                allow all;
-                  allow all;
+                log_not_found off;
-                  log_not_found off;
-                  access_log off;
-                '';
-              };
-              "/" = {
-                priority = 200;
-                extraConfig = "rewrite ^ /index.php;";
-              };
-              "~ ^/store-apps" = {
-                priority = 201;
-                extraConfig = "root ${cfg.home};";
-              };
-              "= /.well-known/carddav" = {
-                priority = 210;
-                extraConfig = "return 301 $scheme://$host/remote.php/dav;";
-              };
-              "= /.well-known/caldav" = {
-                priority = 210;
-                extraConfig = "return 301 $scheme://$host/remote.php/dav;";
-              };
-              "~ ^\\/(?:build|tests|config|lib|3rdparty|templates|data)\\/" = {
-                priority = 300;
-                extraConfig = "deny all;";
-              };
-              "~ ^\\/(?:\\.|autotest|occ|issue|indie|db_|console)" = {
-                priority = 300;
-                extraConfig = "deny all;";
-              };
-              "~ ^\\/(?:index|remote|public|cron|core/ajax\\/update|status|ocs\\/v[12]|updater\\/.+|ocs-provider\\/.+|ocm-provider\\/.+)\\.php(?:$|\\/)" = {
-                priority = 500;
-                extraConfig = ''
-                  include ${config.services.nginx.package}/conf/fastcgi.conf;
-                  fastcgi_split_path_info ^(.+\.php)(\\/.*)$;
-                  try_files $fastcgi_script_name =404;
-                  fastcgi_param PATH_INFO $fastcgi_path_info;
-                  fastcgi_param HTTPS ${if cfg.https then "on" else "off"};
-                  fastcgi_param modHeadersAvailable true;
-                  fastcgi_param front_controller_active true;
-                  fastcgi_pass unix:${fpm.socket};
-                  fastcgi_intercept_errors on;
-                  fastcgi_request_buffering off;
-                  fastcgi_read_timeout 120s;
-                '';
-              };
-              "~ ^\\/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = ''
-                try_files $uri/ =404;
-                index index.php;
-              '';
-              "~ \\.(?:css|js|woff2?|svg|gif)$".extraConfig = ''
-                try_files $uri /index.php$request_uri;
-                add_header Cache-Control "public, max-age=15778463";
-                add_header X-Content-Type-Options nosniff;
-                add_header X-XSS-Protection "1; mode=block";
-                add_header X-Robots-Tag none;
-                add_header X-Download-Options noopen;
-                add_header X-Permitted-Cross-Domain-Policies none;
-                add_header X-Frame-Options sameorigin;
-                add_header Referrer-Policy no-referrer;
-                access_log off;
-              '';
-              "~ \\.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$".extraConfig = ''
-                try_files $uri /index.php$request_uri;
                 access_log off;
               '';
             };
-            extraConfig = ''
+            "/" = {
+              priority = 200;
+              extraConfig = "rewrite ^ /index.php;";
+            };
+            "~ ^/store-apps" = {
+              priority = 201;
+              extraConfig = "root ${cfg.home};";
+            };
+            "= /.well-known/carddav" = {
+              priority = 210;
+              extraConfig = "return 301 $scheme://$host/remote.php/dav;";
+            };
+            "= /.well-known/caldav" = {
+              priority = 210;
+              extraConfig = "return 301 $scheme://$host/remote.php/dav;";
+            };
+            "~ ^\\/(?:build|tests|config|lib|3rdparty|templates|data)\\/" = {
+              priority = 300;
+              extraConfig = "deny all;";
+            };
+            "~ ^\\/(?:\\.|autotest|occ|issue|indie|db_|console)" = {
+              priority = 300;
+              extraConfig = "deny all;";
+            };
+            "~ ^\\/(?:index|remote|public|cron|core/ajax\\/update|status|ocs\\/v[12]|updater\\/.+|ocs-provider\\/.+|ocm-provider\\/.+)\\.php(?:$|\\/)" = {
+              priority = 500;
+              extraConfig = ''
+                include ${config.services.nginx.package}/conf/fastcgi.conf;
+                fastcgi_split_path_info ^(.+\.php)(\\/.*)$;
+                try_files $fastcgi_script_name =404;
+                fastcgi_param PATH_INFO $fastcgi_path_info;
+                fastcgi_param HTTPS ${if cfg.https then "on" else "off"};
+                fastcgi_param modHeadersAvailable true;
+                fastcgi_param front_controller_active true;
+                fastcgi_pass unix:${fpm.socket};
+                fastcgi_intercept_errors on;
+                fastcgi_request_buffering off;
+                fastcgi_read_timeout 120s;
+              '';
+            };
+            "~ ^\\/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = ''
+              try_files $uri/ =404;
+              index index.php;
+            '';
+            "~ \\.(?:css|js|woff2?|svg|gif)$".extraConfig = ''
+              try_files $uri /index.php$request_uri;
+              add_header Cache-Control "public, max-age=15778463";
               add_header X-Content-Type-Options nosniff;
               add_header X-XSS-Protection "1; mode=block";
               add_header X-Robots-Tag none;
@@ -610,28 +598,42 @@ in {
               add_header X-Permitted-Cross-Domain-Policies none;
               add_header X-Frame-Options sameorigin;
               add_header Referrer-Policy no-referrer;
-              add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+              access_log off;
-              error_page 403 /core/templates/403.php;
+            '';
-              error_page 404 /core/templates/404.php;
+            "~ \\.(?:png|html|ttf|ico|jpg|jpeg|bcmap|mp4|webm)$".extraConfig = ''
-              client_max_body_size ${cfg.maxUploadSize};
+              try_files $uri /index.php$request_uri;
-              fastcgi_buffers 64 4K;
+              access_log off;
-              fastcgi_hide_header X-Powered-By;
-              gzip on;
-              gzip_vary on;
-              gzip_comp_level 4;
-              gzip_min_length 256;
-              gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
-              gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
-
-              ${optionalString cfg.webfinger ''
-                rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-                rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
-              ''}
             '';
           };
+          extraConfig = ''
+            add_header X-Content-Type-Options nosniff;
+            add_header X-XSS-Protection "1; mode=block";
+            add_header X-Robots-Tag none;
+            add_header X-Download-Options noopen;
+            add_header X-Permitted-Cross-Domain-Policies none;
+            add_header X-Frame-Options sameorigin;
+            add_header Referrer-Policy no-referrer;
+            add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+            error_page 403 /core/templates/403.php;
+            error_page 404 /core/templates/404.php;
+            client_max_body_size ${cfg.maxUploadSize};
+            fastcgi_buffers 64 4K;
+            fastcgi_hide_header X-Powered-By;
+            gzip on;
+            gzip_vary on;
+            gzip_comp_level 4;
+            gzip_min_length 256;
+            gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+            gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+
+            ${optionalString cfg.webfinger ''
+              rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
+              rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
+            ''}
+          '';
         };
       };
-    })
+    }
   ]);
 
   meta.doc = ./nextcloud.xml;

nixos/modules/services/web-apps/nextcloud.xml

@@ -29,7 +29,6 @@
   services.nextcloud = {
     <link linkend="opt-services.nextcloud.enable">enable</link> = true;
     <link linkend="opt-services.nextcloud.hostName">hostName</link> = "nextcloud.tld";
-    <link linkend="opt-services.nextcloud.nginx.enable">nginx.enable</link> = true;
     config = {
       <link linkend="opt-services.nextcloud.config.dbtype">dbtype</link> = "pgsql";
       <link linkend="opt-services.nextcloud.config.dbuser">dbuser</link> = "nextcloud";
@@ -61,9 +60,8 @@
   </para>
 
   <para>
-   The options <literal>hostName</literal> and <literal>nginx.enable</literal>
+   The <literal>hostName</literal> option is used internally to configure an HTTP
-   are used internally to configure an HTTP server using
+   server using <literal><link xlink:href="https://php-fpm.org/">PHP-FPM</link></literal>
-   <literal><link xlink:href="https://php-fpm.org/">PHP-FPM</link></literal>
    and <literal>nginx</literal>. The <literal>config</literal> attribute set is
    used by the imperative installer and all values are written to an additional file
    to ensure that changes can be applied by changing the module's options.

nixos/modules/tasks/auto-upgrade.nix

@@ -2,9 +2,9 @@
 
 with lib;
 
-let cfg = config.system.autoUpgrade; in
+let cfg = config.system.autoUpgrade;
 
-{
+in {
 
   options = {
 
@@ -21,6 +21,16 @@ let cfg = config.system.autoUpgrade; in
         '';
       };
 
+      flake = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "github:kloenk/nix";
+        description = ''
+          The Flake URI of the NixOS configuration to build.
+          Disables the option <option>system.autoUpgrade.channel</option>.
+        '';
+      };
+
       channel = mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -35,10 +45,20 @@ let cfg = config.system.autoUpgrade; in
 
       flags = mkOption {
         type = types.listOf types.str;
-        default = [];
+        default = [ ];
-        example = [ "-I" "stuff=/home/alice/nixos-stuff" "--option" "extra-binary-caches" "http://my-cache.example.org/" ];
+        example = [
+          "-I"
+          "stuff=/home/alice/nixos-stuff"
+          "--option"
+          "extra-binary-caches"
+          "http://my-cache.example.org/"
+        ];
         description = ''
           Any additional flags passed to <command>nixos-rebuild</command>.
+
+          If you are using flakes and use a local repo you can add
+          <command>[ "--update-input" "nixpkgs" "--commit-lock-file" ]</command>
+          to update nixpkgs.
         '';
       };
 
@@ -82,11 +102,23 @@ let cfg = config.system.autoUpgrade; in
 
   config = lib.mkIf cfg.enable {
 
-    system.autoUpgrade.flags =
+    assertions = [{
-      [ "--no-build-output" ]
+      assertion = !((cfg.channel != null) && (cfg.flake != null));
-      ++ (if cfg.channel == null
+      message = ''
-          then [ "--upgrade" ]
+        The options 'system.autoUpgrade.channels' and 'system.autoUpgrade.flake' cannot both be set.
-          else [ "-I" "nixpkgs=${cfg.channel}/nixexprs.tar.xz" ]);
+      '';
+    }];
+
+    system.autoUpgrade.flags = [ "--no-build-output" ]
+      ++ (if cfg.flake == null then
+        (if cfg.channel == null then
+          [ "--upgrade" ]
+        else [
+          "-I"
+          "nixpkgs=${cfg.channel}/nixexprs.tar.xz"
+        ])
+      else
+        [ "--flake ${cfg.flake}" ]);
 
     systemd.services.nixos-upgrade = {
       description = "NixOS Upgrade";
@@ -96,33 +128,41 @@ let cfg = config.system.autoUpgrade; in
 
       serviceConfig.Type = "oneshot";
 
-      environment = config.nix.envVars //
+      environment = config.nix.envVars // {
-        { inherit (config.environment.sessionVariables) NIX_PATH;
+        inherit (config.environment.sessionVariables) NIX_PATH;
-          HOME = "/root";
+        HOME = "/root";
-        } // config.networking.proxy.envVars;
+      } // config.networking.proxy.envVars;
 
-      path = with pkgs; [ coreutils gnutar xz.bin gzip gitMinimal config.nix.package.out ];
+      path = with pkgs; [
+        coreutils
+        gnutar
+        xz.bin
+        gzip
+        gitMinimal
+        config.nix.package.out
+      ];
 
       script = let
-          nixos-rebuild = "${config.system.build.nixos-rebuild}/bin/nixos-rebuild";
+        nixos-rebuild =
-        in
+          "${config.system.build.nixos-rebuild}/bin/nixos-rebuild";
-        if cfg.allowReboot then ''
+      in if cfg.allowReboot then ''
-            ${nixos-rebuild} boot ${toString cfg.flags}
+        ${nixos-rebuild} boot ${toString cfg.flags}
-            booted="$(readlink /run/booted-system/{initrd,kernel,kernel-modules})"
+        booted="$(readlink /run/booted-system/{initrd,kernel,kernel-modules})"
-            built="$(readlink /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
+        built="$(readlink /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
-            if [ "$booted" = "$built" ]; then
+        if [ "$booted" = "$built" ]; then
-              ${nixos-rebuild} switch ${toString cfg.flags}
+          ${nixos-rebuild} switch ${toString cfg.flags}
-            else
+        else
-              /run/current-system/sw/bin/shutdown -r +1
+          /run/current-system/sw/bin/shutdown -r +1
-            fi
+        fi
-          '' else ''
+      '' else ''
-            ${nixos-rebuild} switch ${toString cfg.flags}
+        ${nixos-rebuild} switch ${toString cfg.flags}
-        '';
+      '';
 
       startAt = cfg.dates;
     };
 
-    systemd.timers.nixos-upgrade.timerConfig.RandomizedDelaySec = cfg.randomizedDelaySec;
+    systemd.timers.nixos-upgrade.timerConfig.RandomizedDelaySec =
+      cfg.randomizedDelaySec;
 
   };
 

nixos/modules/virtualisation/railcar.nix

@@ -46,7 +46,7 @@ let
         description = ''
           Mount options of the filesystem to be used.
 
-          Support optoions are listed in the mount(8) man page. Note that 
+          Support options are listed in the mount(8) man page. Note that
           both filesystem-independent and filesystem-specific options
           are listed.
         '';

nixos/tests/bittorrent.nix

@@ -19,6 +19,7 @@ let
   externalClient2Address = "80.100.100.2";
   externalTrackerAddress = "80.100.100.3";
 
+  download-dir = "/var/lib/transmission/Downloads";
   transmissionConfig = { ... }: {
     environment.systemPackages = [ pkgs.transmission ];
     services.transmission = {
@@ -26,6 +27,7 @@ let
       settings = {
         dht-enabled = false;
         message-level = 3;
+        inherit download-dir;
       };
     };
   };
@@ -117,12 +119,12 @@ in
       router.wait_for_unit("miniupnpd")
 
       # Create the torrent.
-      tracker.succeed("mkdir /tmp/data")
+      tracker.succeed("mkdir ${download-dir}/data")
       tracker.succeed(
-          "cp ${file} /tmp/data/test.tar.bz2"
+          "cp ${file} ${download-dir}/data/test.tar.bz2"
       )
       tracker.succeed(
-          "transmission-create /tmp/data/test.tar.bz2 --private --tracker http://${externalTrackerAddress}:6969/announce --outfile /tmp/test.torrent"
+          "transmission-create ${download-dir}/data/test.tar.bz2 --private --tracker http://${externalTrackerAddress}:6969/announce --outfile /tmp/test.torrent"
       )
       tracker.succeed("chmod 644 /tmp/test.torrent")
 
@@ -133,18 +135,16 @@ in
 
       # Start the initial seeder.
       tracker.succeed(
-          "transmission-remote --add /tmp/test.torrent --no-portmap --no-dht --download-dir /tmp/data"
+          "transmission-remote --add /tmp/test.torrent --no-portmap --no-dht --download-dir ${download-dir}/data"
       )
 
       # Now we should be able to download from the client behind the NAT.
       tracker.wait_for_unit("httpd")
       client1.wait_for_unit("network-online.target")
+      client1.succeed("transmission-remote --add http://${externalTrackerAddress}/test.torrent >&2 &")
+      client1.wait_for_file("${download-dir}/test.tar.bz2")
       client1.succeed(
-          "transmission-remote --add http://${externalTrackerAddress}/test.torrent --download-dir /tmp >&2 &"
+          "cmp ${download-dir}/test.tar.bz2 ${file}"
-      )
-      client1.wait_for_file("/tmp/test.tar.bz2")
-      client1.succeed(
-          "cmp /tmp/test.tar.bz2 ${file}"
       )
 
       # Bring down the initial seeder.
@@ -154,11 +154,11 @@ in
       # the first client created a NAT hole in the router.
       client2.wait_for_unit("network-online.target")
       client2.succeed(
-          "transmission-remote --add http://${externalTrackerAddress}/test.torrent --no-portmap --no-dht --download-dir /tmp >&2 &"
+          "transmission-remote --add http://${externalTrackerAddress}/test.torrent --no-portmap --no-dht >&2 &"
       )
-      client2.wait_for_file("/tmp/test.tar.bz2")
+      client2.wait_for_file("${download-dir}/test.tar.bz2")
       client2.succeed(
-          "cmp /tmp/test.tar.bz2 ${file}"
+          "cmp ${download-dir}/test.tar.bz2 ${file}"
       )
     '';
 })

nixos/tests/nextcloud/basic.nix

@@ -33,7 +33,6 @@ in {
 
       services.nextcloud = {
         enable = true;
-        nginx.enable = true;
         hostName = "nextcloud";
         config = {
           # Don't inherit adminuser since "root" is supposed to be the default

nixos/tests/nextcloud/with-mysql-and-memcached.nix

@@ -17,7 +17,6 @@ in {
       services.nextcloud = {
         enable = true;
         hostName = "nextcloud";
-        nginx.enable = true;
         https = true;
         caching = {
           apcu = true;

nixos/tests/nextcloud/with-postgresql-and-redis.nix

@@ -17,7 +17,6 @@ in {
       services.nextcloud = {
         enable = true;
         hostName = "nextcloud";
-        nginx.enable = true;
         caching = {
           apcu = false;
           redis = true;

pkgs/applications/audio/a2jmidid/default.nix

@@ -9,7 +9,7 @@ in stdenv.mkDerivation {
   version = "8";
 
   src = fetchurl {
-    url = "https://repo.or.cz/a2jmidid.git/snapshot/7383d268c4bfe85df9f10df6351677659211d1ca.tar.gz";
+    url = "https://github.com/linuxaudio/a2jmidid/archive/7383d268c4bfe85df9f10df6351677659211d1ca.tar.gz";
     sha256 = "06dgf5655znbvrd7fhrv8msv6zw8vk0hjqglcqkh90960mnnmwz7";
   };
 
@@ -18,13 +18,17 @@ in stdenv.mkDerivation {
 
   patches = [
     (fetchpatch {
-      url = "https://repo.or.cz/a2jmidid.git/patch/24e3b8e543256ae8fdfb4b75eb9fd775f07c46e2";
+      url = "https://github.com/linuxaudio/a2jmidid/commit/24e3b8e543256ae8fdfb4b75eb9fd775f07c46e2.diff";
       sha256 = "1nxrvnhxlgqc9wbxnp1gnpw4wjyzxvymwcg1gh2nqzmssgfykfkc";
     })
     (fetchpatch {
-      url = "https://repo.or.cz/a2jmidid.git/patch/7f82da7eb2f540a94db23331be98d42a58ddc269";
+      url = "https://github.com/linuxaudio/a2jmidid/commit/7f82da7eb2f540a94db23331be98d42a58ddc269.diff";
       sha256 = "1nab9zf0agbcj5pvhl90pz0cx1d204d4janqflc5ymjhy8jyrsdv";
     })
+    (fetchpatch {
+      url = "https://github.com/linuxaudio/a2jmidid/commit/c07775d021a71cb91bf64ce1391cf525415cb060.diff";
+      sha256 = "172v9hri03qdqi8a3zsg227k5qxldd8v5bj4jk7fyk5jf50fcxga";
+    })
   ];
 
   postInstall = ''
@@ -35,6 +39,6 @@ in stdenv.mkDerivation {
     description = "Daemon for exposing legacy ALSA sequencer applications in JACK MIDI system";
     license = licenses.gpl2;
     maintainers = [ maintainers.goibhniu ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
+    platforms = [ "i686-linux" "x86_64-linux" "aarch64-linux" ];
   };
 }

pkgs/applications/audio/adlplug/default.nix

@@ -1,18 +1,18 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, libjack2, alsaLib
 , freetype, libX11, libXrandr, libXinerama, libXext, libXcursor
-, fetchpatch
+, fetchpatch, fmt
 , adlplugChip ? "-DADLplug_CHIP=OPL3"
 , pname ? "ADLplug" }:
 
 stdenv.mkDerivation rec {
   inherit pname;
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "jpcima";
     repo = "ADLplug";
     rev = "v${version}";
-    sha256 = "0n9srdlgl1j528ap5xmllrqs1w6ibc5yf9sphvl1q9kjnizxrs2c";
+    sha256 = "0mqx4bzri8s880v7jwd24nb93m5i3aklqld0b3h0hjnz0lh2qz0f";
     fetchSubmodules = true;
   };
 
@@ -25,13 +25,13 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  cmakeFlags = [ adlplugChip ];
+  cmakeFlags = [ adlplugChip "-DADLplug_USE_SYSTEM_FMT=ON" ];
 
   buildInputs = [
     libjack2 alsaLib freetype libX11 libXrandr libXinerama libXext
     libXcursor
   ];
-  nativeBuildInputs = [ cmake pkgconfig ];
+  nativeBuildInputs = [ cmake pkgconfig fmt ];
 
   meta = with stdenv.lib; {
     description = "OPL3 and OPN2 FM Chip Synthesizer";

pkgs/applications/audio/giada/default.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "giada";
-  version = "0.16.3";
+  version = "0.16.3.1";
 
   src = fetchFromGitHub {
     owner = "monocasual";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1sysv5d0wq6ib47bqsn3wdzkqzjpzjrgzg15bkllbm67hiz9abhh";
+    sha256 = "0z1jrkggdn630i3j59j30apaa9s242y1wiawqp4g1n9dkg3r9a1j";
   };
 
   configureFlags = [

pkgs/applications/audio/musikcube/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "musikcube";
-  version = "0.92.1";
+  version = "0.93.1";
 
   src = fetchFromGitHub {
     owner = "clangen";
     repo = pname;
     rev = version;
-    sha256 = "0l4ncxqxvp5m014j7vlglhzxhhrxl0c2m71xn0i0a27hn4nc72mr";
+    sha256 = "05qsxyr7x8l0vlmn4yjg4gglxvcw9raf6vfzvblsl2ngsdsrnizy";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/yasr/default.nix

@@ -11,10 +11,10 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    ./10_fix_openpty_forkpty_declarations
+    ./10_fix_openpty_forkpty_declarations.patch
-    ./20_maxpathlen
+    ./20_maxpathlen.patch
-    ./30_conf
+    ./30_conf.patch
-    ./40_dectalk_extended_chars
+    ./40_dectalk_extended_chars.patch
   ]; # taken from the debian yasr package
 
   meta = {

pkgs/applications/blockchains/bitcoin-abc.nix

@@ -7,13 +7,13 @@ with stdenv.lib;
 mkDerivation rec {
 
   name = "bitcoin" + (toString (optional (!withGui) "d")) + "-abc-" + version;
-  version = "0.21.10";
+  version = "0.21.12";
 
   src = fetchFromGitHub {
     owner = "bitcoin-ABC";
     repo = "bitcoin-abc";
     rev = "v${version}";
-    sha256 = "1m210g6db8f09m66v75ia1fdd1dlvs1srgk2jhd3wqbvnmjqa77f";
+    sha256 = "1mad3aqfwrxi06135nf8hv13d67nilmxpx4dw5vjcy1zi3lljj1j";
   };
 
   patches = [ ./fix-bitcoin-qt-build.patch ];

pkgs/applications/editors/jetbrains/default.nix

@@ -224,7 +224,8 @@ let
         interpreter=$(echo ${stdenv.glibc.out}/lib/ld-linux*.so.2)
         patchelf --set-interpreter "$interpreter" lib/ReSharperHost/linux-x64/mono/bin/mono-sgen
         rm -rf lib/ReSharperHost/linux-x64/dotnet
-        ln -s ${dotnet-sdk_3} lib/ReSharperHost/linux-x64/dotnet
+        mkdir -p lib/ReSharperHost/linux-x64/dotnet/
+        ln -s ${dotnet-sdk_3}/bin/dotnet lib/ReSharperHost/linux-x64/dotnet/dotnet
       '');
     });
 

pkgs/applications/editors/okteta/default.nix

@@ -4,11 +4,11 @@
 
 mkDerivation rec {
   pname = "okteta";
-  version = "0.26.3";
+  version = "0.26.4";
 
   src = fetchurl {
     url = "mirror://kde/stable/okteta/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "1454844s76skk18gpcf56y9pkmffs7p4z09ggmy37ifzf7yk1p19";
+    sha256 = "00qgzm5mqx0j8f0fznhnw76l9pjyw3lxirvy8ssq59nqqjbb08pg";
   };
 
   nativeBuildInputs = [ qtscript extra-cmake-modules kdoctools ];

pkgs/applications/kde/marble.nix

@@ -1,6 +1,6 @@
 { mkDerivation, lib
 , extra-cmake-modules, kdoctools
-, qtscript, qtsvg, qtquickcontrols, qtwebkit
+, qtscript, qtsvg, qtquickcontrols, qtwebengine
 , krunner, shared-mime-info, kparts, knewstuff
 , gpsd, perl
 }:
@@ -11,7 +11,7 @@ mkDerivation {
   outputs = [ "out" "dev" ];
   nativeBuildInputs = [ extra-cmake-modules kdoctools perl ];
   propagatedBuildInputs = [
-    qtscript qtsvg qtquickcontrols qtwebkit shared-mime-info krunner kparts
+    qtscript qtsvg qtquickcontrols qtwebengine shared-mime-info krunner kparts
     knewstuff gpsd
   ];
   preConfigure = ''

pkgs/applications/misc/ArchiSteamFarm/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ArchiSteamFarm";
-  version = "4.2.3.3";
+  version = "4.2.3.6";
 
   src = fetchurl {
     url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-generic.zip";
-    sha256 = "0v69rrs5fr1n5llfx42xkiish52al7kb36fjy3ng0j9qfp3g8pj7";
+    sha256 = "1a8baxrb8czndxxi16md1nyl2snfx215yvrygdpcblgngkp2z2y9";
   };
 
   nativeBuildInputs = [ unzip makeWrapper jq ];
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
       --run "[ -d config ] || cp --no-preserve=mode -r $dist/config ." \
       --run "[ -d logs ] || cp --no-preserve=mode -r $dist/logs ." \
       --run "[ -d plugins ] || cp --no-preserve=mode -r $dist/plugins ." \
-      --run "[ -d www ] || ln -sf $dist/www ."
+      --run "ln -sf $dist/www ."
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/misc/calibre/default.nix

@@ -30,11 +30,11 @@ let
 in
 mkDerivation rec {
   pname = "calibre";
-  version = "4.19.0";
+  version = "4.22.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1kpj65spwr9m88vshsljpdrw5jy7bbpqgqcrvqb17abh7fnnrb4x";
+    sha256 = "0d0wmd3ijk8px1d662igal4lfmpyzynfzs6ms1bb9nf42mq2pxai";
   };
 
   patches = [

pkgs/applications/misc/redshift/default.nix

@@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub, autoconf, automake, gettext, intltool
+{ stdenv, fetchFromGitHub, fetchFromGitLab
+, autoconf, automake, gettext, intltool
 , libtool, pkgconfig, wrapGAppsHook, wrapPython, gobject-introspection
 , gtk3, python, pygobject3, pyxdg
 
@@ -18,11 +19,16 @@ let
     stdenv.mkDerivation rec {
       inherit pname version src meta;
 
-      patches = [
+      patches = stdenv.lib.optionals (pname != "gammastep") [
         # https://github.com/jonls/redshift/pull/575
         ./575.patch
       ];
 
+      postPatch = stdenv.lib.optionalString (pname == "gammastep") ''
+        substituteInPlace configure.ac \
+          --replace "[gammastep], [2.0]" "[gammastep], [${version}]"
+      '';
+
       nativeBuildInputs = [
         autoconf
         automake
@@ -62,10 +68,15 @@ let
 
       # the geoclue agent may inspect these paths and expect them to be
       # valid without having the correct $PATH set
-      postInstall = ''
+      postInstall = if (pname == "gammastep") then ''
+        substituteInPlace $out/share/applications/gammastep.desktop \
+          --replace 'Exec=gammastep' "Exec=$out/bin/gammastep"
+        substituteInPlace $out/share/applications/gammastep-indicator.desktop \
+          --replace 'Exec=gammastep-indicator' "Exec=$out/bin/gammastep-indicator"
+      '' else ''
         substituteInPlace $out/share/applications/redshift.desktop \
           --replace 'Exec=redshift' "Exec=$out/bin/redshift"
-        substituteInPlace $out/share/applications/redshift.desktop \
+        substituteInPlace $out/share/applications/redshift-gtk.desktop \
           --replace 'Exec=redshift-gtk' "Exec=$out/bin/redshift-gtk"
       '';
 
@@ -118,4 +129,24 @@ rec {
       homepage = "https://github.com/minus7/redshift";
     };
   };
+
+  gammastep = mkRedshift rec {
+    pname = "gammastep";
+    version = "2.0.1";
+
+    src = fetchFromGitLab {
+      owner = "chinstrap";
+      repo = pname;
+      rev = "v${version}";
+      sha256 = "1ky4h892sg2mfbwwq5xv0vnjflsl2x3nsy5q456r1kyk1gwkj0rg";
+    };
+
+    meta = redshift.meta // {
+      name = "${pname}-${version}";
+      longDescription = "Gammastep"
+        + stdenv.lib.removePrefix "Redshift" redshift.meta.longDescription;
+      homepage = "https://gitlab.com/chinstrap/gammastep";
+      maintainers = [ stdenv.lib.maintainers.primeos ] ++ redshift.meta.maintainers;
+    };
+  };
 }

pkgs/applications/misc/waybar/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, meson, pkgconfig, ninja, wrapGAppsHook
-, wayland, wlroots, gtkmm3, libinput, libsigcxx, jsoncpp, fmt, scdoc, spdlog, gtk-layer-shell
+, wayland, wlroots, gtkmm3, libsigcxx, jsoncpp, fmt, scdoc, spdlog, gtk-layer-shell
 , howard-hinnant-date, cmake
 , traySupport  ? true,  libdbusmenu-gtk3
 , pulseSupport ? false, libpulseaudio
@@ -11,13 +11,13 @@
 }:
   stdenv.mkDerivation rec {
     pname = "waybar";
-    version = "0.9.2";
+    version = "0.9.3";
 
     src = fetchFromGitHub {
       owner = "Alexays";
       repo = "Waybar";
       rev = version;
-      sha256 = "1gfxyjzwfqznyrpyr3322z3w844i1lh77kly4hcpy9y5gsfmlafy";
+      sha256 = "0ks719khhg2zwpyiwa2079i6962qcxpapm28hmr4ckpsp2n659ck";
     };
 
     nativeBuildInputs = [
@@ -32,7 +32,7 @@
     strictDeps = false;
 
     buildInputs = with stdenv.lib;
-      [ wayland wlroots gtkmm3 libinput libsigcxx jsoncpp fmt spdlog gtk-layer-shell howard-hinnant-date ]
+      [ wayland wlroots gtkmm3 libsigcxx jsoncpp fmt spdlog gtk-layer-shell howard-hinnant-date ]
       ++ optional  traySupport  libdbusmenu-gtk3
       ++ optional  pulseSupport libpulseaudio
       ++ optional  nlSupport    libnl

pkgs/applications/networking/cluster/argo/default.nix

@@ -19,13 +19,13 @@ let
 in
 buildGoModule rec {
   pname = "argo";
-  version = "2.9.4";
+  version = "2.9.5";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo";
     rev = "v${version}";
-    sha256 = "156102xqwmsq3g9jammfib0ri22a0nzk96zrv5774gidjvy2xb55";
+    sha256 = "1x44mgvnbn47a33xnhnh9bxxvj1vsr32lvh9bq6w5hpmxb7qbq4f";
   };
 
   vendorSha256 = "1vqmzz76lcwwnw89n4lyg4jjf7wbdgn9sdzwsgrjwkj8ax7d48cv";

pkgs/applications/networking/cluster/minikube/default.nix

@@ -11,15 +11,15 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.12.1";
+  version = "1.12.2";
 
-  vendorSha256 = "0v2lnzdv5nmg4jf10hqyvrsyz5yg7brm4p3gil7n88w6n100phfn";
+  vendorSha256 = "0smjj2sq09k1ai79lk74gi056hfls7qy8x08wkq2g24fxi06cr94";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "0ya6mp081vs48c0nh4nys9z04kz79mjfpm4gs0hlmh2kpa5kmc9h";
+    sha256 = "1x28s6d2nibm76qd3kjsa7wkyhqvnwdy9rfwk9xf45hzrx9700sm";
   };
 
   nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -7,30 +7,30 @@ in {
     pname = "discord";
     binaryName = "Discord";
     desktopName = "Discord";
-    version = "0.0.10";
+    version = "0.0.11";
     src = fetchurl {
       url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-      sha256 = "0kx92i8naqr3algmyy3wyzbh8146z7gigxwf1nbpg1gl16wlplaq";
+      sha256 = "1saqwigi1gjgy4q8rgnwyni57aaszi0w9vqssgyvfgzff8fpcx54";
     };
   };
   ptb = callPackage ./base.nix rec {
     pname = "discord-ptb";
     binaryName = "DiscordPTB";
     desktopName = "Discord PTB";
-    version = "0.0.20";
+    version = "0.0.21";
     src = fetchurl {
       url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-      sha256 = "0wn2qdv0a4n59xl451y7fcq11klp2g63qwx40qkshllvnf5lzzsx";
+      sha256 = "1i164wpi07d45w19i7l5hs47crc29k3plg4y9kc97x75rhh4xym1";
     };
   };
   canary = callPackage ./base.nix rec {
     pname = "discord-canary";
     binaryName = "DiscordCanary";
     desktopName = "Discord Canary";
-    version = "0.0.105";
+    version = "0.0.106";
     src = fetchurl {
       url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-      sha256 = "1jc2zr8q33ras5mkifg19kcxpb84vsqx01rj66w62hsjw1nsbidg";
+      sha256 = "1bqlf7iixdy6c7lhbva4lizvhd6w0xqn69izxcy26wk35xcqgfh8";
     };
   };
 }.${branch}

pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix

@@ -7,7 +7,7 @@ let
 
   # Please keep the version x.y.0.z and do not update to x.y.76.z because the
   # source of the latter disappears much faster.
-  version = "8.62.0.85";
+  version = "8.63.0.76";
 
   rpath = stdenv.lib.makeLibraryPath [
     alsaLib
@@ -65,7 +65,7 @@ let
           "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
           "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
         ];
-        sha256 = "0qlm2hbshxgycczv227bbj2fbiw3b76rp24mh8amhq4xbscazl38";
+        sha256 = "0gmrk1giabr53imiwdflf6ykwpcj2q5zn3bynvrncnhivsbvaavy";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";

pkgs/applications/networking/instant-messengers/wire-desktop/default.nix

@@ -20,13 +20,13 @@ let
   pname = "wire-desktop";
 
   version = {
-    x86_64-darwin = "3.18.3728";
+    x86_64-darwin = "3.19.3799";
-    x86_64-linux = "3.18.2925";
+    x86_64-linux = "3.19.2928";
   }.${system} or throwSystem;
 
   sha256 = {
-    x86_64-darwin = "0xi3k95yw59xsfavncc1giwxlwjz26z34qm3i604ksjjalvpzy5l";
+    x86_64-darwin = "1sv8n4g1pd4nwpwsg0m61zhrfjlh7sj29rnh46xjw1qg332g6cw9";
-    x86_64-linux = "01g39hncj1w0zyfrzv4mgv8npwvx0g0lw99azyai99877b30bm8j";
+    x86_64-linux = "038h1j59qfj5ckaxk823qpfflxay47v0jrqc0hmrdmnd2y59dpx7";
   }.${system} or throwSystem;
 
   meta = with stdenv.lib; {

pkgs/applications/science/chemistry/octopus/default.nix

@@ -6,13 +6,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);
 
 stdenv.mkDerivation rec {
   pname = "octopus";
-  version = "9.2";
+  version = "10.0";
 
   src = fetchFromGitLab {
     owner = "octopus-code";
     repo = "octopus";
     rev = version;
-    sha256 = "083z51sjv70asr04rv53wb9gf4396nblq1zl22qw7jdr28hji4is";
+    sha256 = "1c6q20y0x9aacwa7vp6gj3yvfzain7hnk6skxmvg3wazp02l91kn";
   };
 
   nativeBuildInputs = [ perl procps autoreconfHook ];

pkgs/applications/science/electronics/fritzing/default.nix

@@ -1,8 +1,8 @@
-{ stdenv, fetchpatch, fetchFromGitHub, qmake, pkgconfig
+{ mkDerivation, stdenv, fetchpatch, fetchFromGitHub, qmake, pkgconfig
 , qtbase, qtsvg, qtserialport, boost, libgit2
 }:
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
   pname = "fritzing";
   version = "0.9.3b";
 

pkgs/applications/science/electronics/hyp2mat/default.nix

@@ -0,0 +1,53 @@
+{ stdenv
+, fetchFromGitHub
+, bison
+, flex
+, gengetopt
+, help2man
+, groff
+, libharu
+, autoreconfHook
+, pkgconfig
+, libpng
+, zlib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "hyp2mat";
+  version = "0.0.17";
+
+  src = fetchFromGitHub {
+    owner = "koendv";
+    repo = "hyp2mat";
+    rev = "v${version}";
+    sha256 = "04bd2vrn8y1izir7pwl34a60cg2v05baqcrmpfdx5fvf33bbflaj";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkgconfig
+  ];
+
+  buildInputs = [
+    libharu
+    libpng
+    zlib
+    bison
+    flex
+    gengetopt
+    help2man
+    groff
+  ];
+
+  configureFlags = [ "--enable-library" ];
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "Import Hyperlynx Boardsim files to openEMS, an open source 3D full-wave electromagnetic field solver";
+    homepage = https://github.com/koendv/hyp2mat;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ matthuszagh ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/version-management/git-and-tools/ghq/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ghq";
-  version = "1.1.2";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "x-motemen";
     repo = "ghq";
     rev = "v${version}";
-    sha256 = "1qzrycmd26f4q36z3rblfxp7jngqgmspb9385vpfwv9laiw3sqrg";
+    sha256 = "098fik155viylq07az7crzbgswcvhpx0hr68xpvyx0rpri792jbq";
   };
 
-  vendorSha256 = "0x347ljj9q3zi0zf8x13dhvsydv9vg4qc5l1kc2y56v0w8hlb4p7";
+  vendorSha256 = "0gll132g111vn1hdmdjpkha9rbyppz0qj1ld89gwlk2mqd57jxkd";
 
   buildFlagsArray = ''
     -ldflags=

pkgs/applications/video/obs-studio/wlrobs.nix

@@ -13,12 +13,12 @@ assert dmabufSupport -> libdrm != null && libGL != null;
 
 stdenv.mkDerivation {
   pname = "obs-wlrobs";
-  version = "20200111";
+  version = "20200622";
 
   src = fetchhg {
     url = "https://hg.sr.ht/~scoopta/wlrobs";
-    rev = "8345bf985e390896d89e35e2feae1fa37722f4be";
+    rev = "1d3acaaf64049da3da9721aa8b9b47582fe0081b";
-    sha256 = "0j01wkhwhhla4qx8mwyrq2qj9cfhxksxaq2k8rskmy2qbdkvvdpb";
+    sha256 = "0qrcf8024r4ynfjw0zx8vn59ygx9q5rb196s6nyxmy3gkv2lfxlq";
   };
 
   buildInputs = [ libX11 libGL libdrm meson ninja pkgconfig wayland obs-studio ];

pkgs/desktops/enlightenment/default.nix

@@ -1,14 +1,14 @@
 { callPackage, pkgs }:
 {
   #### CORE EFL
-  efl = callPackage ./efl.nix { };
+  efl = callPackage ./efl { };
 
   #### WINDOW MANAGER
-  enlightenment = callPackage ./enlightenment.nix { };
+  enlightenment = callPackage ./enlightenment { };
 
   #### APPLICATIONS
-  econnman = callPackage ./econnman.nix { };
+  econnman = callPackage ./econnman { };
-  terminology = callPackage ./terminology.nix { };
+  terminology = callPackage ./terminology { };
-  rage = callPackage ./rage.nix { };
+  rage = callPackage ./rage { };
-  ephoto = callPackage ./ephoto.nix { };
+  ephoto = callPackage ./ephoto { };
 }

pkgs/development/compilers/ghc/8.10.1.nix

@@ -24,7 +24,7 @@
   enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform
 
   # aarch64 outputs otherwise exceed 2GB limit
-, enableProfiliedLibs ? !stdenv.targetPlatform.isAarch64
+, enableProfiledLibs ? !stdenv.targetPlatform.isAarch64
 
 , # Whether to build dynamic libs for the standard library (on the target
   # platform). Static libs are always built.
@@ -68,7 +68,7 @@ let
     HADDOCK_DOCS = NO
     BUILD_SPHINX_HTML = NO
     BUILD_SPHINX_PDF = NO
-  '' + stdenv.lib.optionalString (!enableProfiliedLibs) ''
+  '' + stdenv.lib.optionalString (!enableProfiledLibs) ''
     GhcLibWays = "v dyn"
   '' + stdenv.lib.optionalString enableRelocatedStaticLibs ''
     GhcLibHcOpts += -fPIC

pkgs/development/compilers/ghc/8.8.3.nix

@@ -23,6 +23,9 @@
 , # If enabled, use -fPIC when compiling static libs.
   enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform
 
+  # aarch64 outputs otherwise exceed 2GB limit
+, enableProfiledLibs ? !stdenv.targetPlatform.isAarch64
+
 , # Whether to build dynamic libs for the standard library (on the target
   # platform). Static libs are always built.
   enableShared ? !stdenv.targetPlatform.isWindows && !stdenv.targetPlatform.useiOSPrebuilt
@@ -30,9 +33,6 @@
 , # Whether to build terminfo.
   enableTerminfo ? !stdenv.targetPlatform.isWindows
 
-  # aarch64 outputs otherwise exceed 2GB limit
-, enableProfiliedLibs ? !stdenv.targetPlatform.isAarch64
-
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
   ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
@@ -68,7 +68,7 @@ let
     HADDOCK_DOCS = NO
     BUILD_SPHINX_HTML = NO
     BUILD_SPHINX_PDF = NO
-  '' + stdenv.lib.optionalString (!enableProfiliedLibs) ''
+  '' + stdenv.lib.optionalString (!enableProfiledLibs) ''
     GhcLibWays = "v dyn"
   '' + stdenv.lib.optionalString enableRelocatedStaticLibs ''
     GhcLibHcOpts += -fPIC

pkgs/development/compilers/ghc/8.8.4.nix

@@ -24,7 +24,7 @@
   enableRelocatedStaticLibs ? stdenv.targetPlatform != stdenv.hostPlatform
 
   # aarch64 outputs otherwise exceed 2GB limit
-, enableProfiliedLibs ? !stdenv.targetPlatform.isAarch64
+, enableProfiledLibs ? !stdenv.targetPlatform.isAarch64
 
 , # Whether to build dynamic libs for the standard library (on the target
   # platform). Static libs are always built.
@@ -68,7 +68,7 @@ let
     HADDOCK_DOCS = NO
     BUILD_SPHINX_HTML = NO
     BUILD_SPHINX_PDF = NO
-  '' + stdenv.lib.optionalString (!enableProfiliedLibs) ''
+  '' + stdenv.lib.optionalString (!enableProfiledLibs) ''
     GhcLibWays = "v dyn"
   '' + stdenv.lib.optionalString enableRelocatedStaticLibs ''
     GhcLibHcOpts += -fPIC

pkgs/development/compilers/ghc/head.nix

@@ -20,9 +20,9 @@
   # build-time dependency too.
   buildLlvmPackages, llvmPackages
 
-, # If enabled, GHC will be built with the GPL-free but slower integer-simple
+, # If enabled, GHC will be built with the GPL-free but slightly slower native
-  # library instead of the faster but GPLed integer-gmp library.
+  # bignum backend instead of the faster but GPLed gmp backend.
-  enableIntegerSimple ? !(stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) gmp.meta.platforms)
+  enableNativeBignum ? !(stdenv.lib.any (stdenv.lib.meta.platformMatch stdenv.hostPlatform) gmp.meta.platforms)
 , gmp
 
 , # If enabled, use -fPIC when compiling static libs.
@@ -35,7 +35,7 @@
 , # Whether to build terminfo.
   enableTerminfo ? !stdenv.targetPlatform.isWindows
 
-, version ? "8.11.20200505"
+, version ? "8.11.20200731"
 , # What flavour to build. An empty string indicates no
   # specific flavour and falls back to ghc default values.
   ghcFlavour ? stdenv.lib.optionalString (stdenv.targetPlatform != stdenv.hostPlatform)
@@ -46,7 +46,7 @@
   disableLargeAddressSpace ? stdenv.targetPlatform.isDarwin && stdenv.targetPlatform.isAarch64
 }:
 
-assert !enableIntegerSimple -> gmp != null;
+assert !enableNativeBignum -> gmp != null;
 
 let
   inherit (stdenv) buildPlatform hostPlatform targetPlatform;
@@ -64,7 +64,7 @@ let
     include mk/flavours/\$(BuildFlavour).mk
     endif
     DYNAMIC_GHC_PROGRAMS = ${if enableShared then "YES" else "NO"}
-    INTEGER_LIBRARY = ${if enableIntegerSimple then "integer-simple" else "integer-gmp"}
+    BIGNUM_BACKEND = ${if enableNativeBignum then "native" else "gmp"}
   '' + stdenv.lib.optionalString (targetPlatform != hostPlatform) ''
     Stage1Only = ${if targetPlatform.system == hostPlatform.system then "NO" else "YES"}
     CrossCompilePrefix = ${targetPrefix}
@@ -81,7 +81,7 @@ let
   # Splicer will pull out correct variations
   libDeps = platform: stdenv.lib.optional enableTerminfo ncurses
     ++ [libffi]
-    ++ stdenv.lib.optional (!enableIntegerSimple) gmp
+    ++ stdenv.lib.optional (!enableNativeBignum) gmp
     ++ stdenv.lib.optional (platform.libc != "glibc" && !targetPlatform.isWindows) libiconv
     ++ stdenv.lib.optional enableDwarf elfutils;
 
@@ -103,8 +103,8 @@ stdenv.mkDerivation (rec {
 
   src = fetchgit {
     url = "https://gitlab.haskell.org/ghc/ghc.git/";
-    rev = "40c71c2cf38b4e134d81b7184a4d5e02949ae70c";
+    rev = "380638a33691ba43fdcd2e18bca636750e5f66f1";
-    sha256 = "04h9rcyzm9w3an1z00hjs062dp7dl19b8pkyxjsypr7a2i9dmvkb";
+    sha256 = "029cgiyhddvwnx5zx31i0vgj13zsvzb8fna99zr6ifscz6x7rid1";
   };
 
   enableParallelBuilding = true;
@@ -173,7 +173,7 @@ stdenv.mkDerivation (rec {
     "--with-system-libffi"
     "--with-ffi-includes=${targetPackages.libffi.dev}/include"
     "--with-ffi-libraries=${targetPackages.libffi.out}/lib"
-  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && !enableIntegerSimple) [
+  ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && !enableNativeBignum) [
     "--with-gmp-includes=${targetPackages.gmp.dev}/include"
     "--with-gmp-libraries=${targetPackages.gmp.out}/lib"
   ] ++ stdenv.lib.optionals (targetPlatform == hostPlatform && hostPlatform.libc != "glibc" && !targetPlatform.isWindows) [

pkgs/development/compilers/go/1.13.nix

@@ -30,11 +30,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.13.14";
+  version = "1.13.15";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "01mbqzn1hj8idbyn2f9gghvirfnw348dcf7pjs3ymschfblk6wqr";
+    sha256 = "0pfgixca3a0svblzivkia11q79l8bzai6yg64m1piy3c0iqk3d2z";
   };
 
   # perl is used for testing go vet

pkgs/development/compilers/nim/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nim";
-  version = "1.2.4";
+  version = "1.2.6";
 
   src = fetchurl {
     url = "https://nim-lang.org/download/${pname}-${version}.tar.xz";
-    sha256 = "0dnn60slvp3ynlx3zhv3cjkanv8zglljxws0db8g0rdyz8r8zwgf";
+    sha256 = "0zk5qzxayqjw7kq6p92j4008g9bbyilyymhdc5xq9sln5rqym26z";
   };
 
   enableParallelBuilding = true;

pkgs/development/compilers/openjdk/8.nix

@@ -19,8 +19,8 @@ let
     aarch64-linux = "aarch64";
   }.${stdenv.system} or (throw "Unsupported platform");
 
-  update = "242";
+  update = "265";
-  build = "b08";
+  build = if stdenv.isAarch64 then "b01" else "ga";
   baseurl = if stdenv.isAarch64 then "https://hg.openjdk.java.net/aarch64-port/jdk8u-shenandoah"
             else "https://hg.openjdk.java.net/jdk8u/jdk8u";
   repover = lib.optionalString stdenv.isAarch64 "aarch64-shenandoah-"
@@ -29,50 +29,50 @@ let
   jdk8 = fetchurl {
              name = "jdk8-${repover}.tar.gz";
              url = "${baseurl}/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0qpmr267qcxhmw398zbl1axd161yxn4k4hfz1jlxlmdvg70p7h90"
+             sha256 = if stdenv.isAarch64 then "1a2adw51af064rzlngsdlhs9gl47h3lv6dzvr8swqgl2n93nlbxa"
-                      else "1crs4hmzmgm6fkwfq0d3xz9lph0nd33fngrqv2rz1mkkqcrjx18z";
+                      else "02j1nbf3rxl581fqzc6i3ri6wwxx1dhkmj5klkh5xlp8dkhclr30";
           };
   langtools = fetchurl {
              name = "langtools-${repover}.tar.gz";
              url = "${baseurl}/langtools/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "1rhhi4kgmxvnyl3ic5p008p1n7zyji5nw99blm1lr5fw7ry7df24"
+             sha256 = if stdenv.isAarch64 then "0hfrbz7421s2barfrfp0fvmh45iksw2zx1z4ykjg3giv8zbmswfm"
-                      else "1aaxd1rl7dlk4kxdivvqvripsbn0d5vny0jvjksycsm97vrfiry4";
+                      else "1r2adp7sn3y45rb5h059qygz18bgmkqr2g2jc9mpzskl5vwsqiw4";
           };
   hotspot = fetchurl {
              name = "hotspot-${repover}.tar.gz";
              url = "${baseurl}/hotspot/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0lphrhjqlavd6qlkh7h4sd2bqf5gd0cchkcnvy87703fbd7gy5ii"
+             sha256 = if stdenv.isAarch64 then "0g5h74snfl2dj2xwlvb5hgfbqmnbhxax68axadz11mq7r2bhd0lk"
-                      else "18i4if16zikgda9k5bgqyx0p2104db23zlnclq512178z0p9yycb";
+                      else "10xj8qr499r6nla74bjh4dmq7pkj63iircijk1wyv9xz5v777pcc";
           };
   corba = fetchurl {
              name = "corba-${repover}.tar.gz";
              url = "${baseurl}/corba/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "18h0v566v420d00na6x4jrs41v4aa39byk15fi8k6dcn0dmirhvg"
+             sha256 = if stdenv.isAarch64 then "0wfqrpr5m4gnavgsl6zcy2l3c7sgn3yl7yhp2crh9icp44ld2cj9"
-                      else "1298k8p2dsj7xc4h2ayk5nl4ssrcgncn06ysyqrmnwrb8gj8s1w4";
+                      else "0lk4jimrafgphffsj5yyyhl6pib0y5xxqcr09bgr2w8sjkp4s04s";
           };
   jdk = fetchurl {
              name = "jdk-${repover}.tar.gz";
              url = "${baseurl}/jdk/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0xxy7rkj8ah263nnzkd4mg9dai5qix3l9cyilm47dig5hv7g8aq0"
+             sha256 = if stdenv.isAarch64 then "0ss49bv2dzb9vkabpv1ag04wli5722p0a8gqkzqmzw4nj67snfqw"
-                      else "0vqlbks3cy3cnmnrnhbjkqinvp8bcy2h96xvx81cvlza4s2hszvz";
+                      else "0anbp4vq8bzhqsqxlgjd0dx0irf57x4i5ddbpljl36vy2pi9xsm7";
           };
   jaxws = fetchurl {
              name = "jaxws-${repover}.tar.gz";
              url = "${baseurl}/jaxws/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0ajqm2l9g5w5ag5s4vl4ldpbm99pqa6d342hrzvv7psqn3zf6ar5"
+             sha256 = if stdenv.isAarch64 then "1nwn6mz38app6pk5f1x3vya1x9qfckyl7z6bi62k6mj2c72ikfh5"
-                      else "1wg9fbiz09arj0llavnzrmbhw8nx0dw8dcjkrzxw78rj1cadflzc";
+                      else "113d5nx2mp30m6xy2m2wh0nixk45q8abimlszkiq09w1w1ckzpba";
           };
   jaxp = fetchurl {
              name = "jaxp-${repover}.tar.gz";
              url = "${baseurl}/jaxp/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "03zjh6xvza05abxz9d9j2w9xndw9n07f8lrn6dymj7f4imals831"
+             sha256 = if stdenv.isAarch64 then "1rhgbwvp7xls7r3f5jm69dw7x521vamchv917dwiz1byvm2bwn7s"
-                      else "1i5xrk8r8pcgnc68zrgp3hd1a1nzcm99swpmdnlb424qlg5nnrcf";
+                      else "0nvqidjssmamcrchq15cg3lfv5v3cnrw05a4h20xmhlpgb9im0vj";
           };
   nashorn = fetchurl {
              name = "nashorn-${repover}.tar.gz";
              url = "${baseurl}/nashorn/archive/${repover}.tar.gz";
-             sha256 = if stdenv.isAarch64 then "0n809w264ndxksva9c81x0m1fsyg8c627w571f72xxxl9c1bnrmp"
+             sha256 = if stdenv.isAarch64 then "14gp8q6jw1hq2wlmcalfwn1kgmnq5w9svqnbjww20f25phxkicij"
-                      else "0qlxaz7sriy709vcyzz48s2v4p5h4d31my33whip018c4j5gkfqq";
+                      else "0fm9ldps7ayk7r3wjqiyxp1s6hvi242kl7f92ydkmlxqyfajx60a";
           };
   openjdk8 = stdenv.mkDerivation {
     pname = "openjdk" + lib.optionalString headless "-headless";

pkgs/development/haskell-modules/configuration-common.nix

@@ -1336,7 +1336,7 @@ self: super: {
         })).override {
           # we are faster than stack here
           hie-bios = dontCheck self.hie-bios_0_6_1;
-          lsp-test = dontCheck self.lsp-test_0_11_0_3;
+          lsp-test = dontCheck self.lsp-test_0_11_0_4;
         });
 
   haskell-language-server = (overrideCabal super.haskell-language-server
@@ -1356,7 +1356,7 @@ self: super: {
       ghcide = self.hls-ghcide;
       # we are faster than stack here
       hie-bios = dontCheck self.hie-bios_0_6_1;
-      lsp-test = dontCheck self.lsp-test_0_11_0_3;
+      lsp-test = dontCheck self.lsp-test_0_11_0_4;
     };
 
   # https://github.com/kowainik/policeman/issues/57

pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix

@@ -67,9 +67,9 @@ self: super: {
   unliftio-core = doJailbreak super.unliftio-core;
 
   # Use the latest version to fix the build.
-  dhall = self.dhall_1_33_1;
+  dhall = self.dhall_1_34_0;
   lens = self.lens_4_19_2;
-  optics-core = self.optics-core_0_3;
+  optics-core = self.optics-core_0_3_0_1;
   repline = self.repline_0_4_0_0;
   singletons = self.singletons_2_7;
   th-desugar = self.th-desugar_1_11;

pkgs/development/haskell-modules/configuration-ghc-head.nix

@@ -26,6 +26,7 @@ self: super: {
   filepath = null;
   ghc-boot = null;
   ghc-boot-th = null;
+  ghc-bignum = null;
   ghc-compact = null;
   ghc-heap = null;
   ghci = null;

pkgs/development/haskell-modules/configuration-hackage2nix.yaml

@@ -72,7 +72,7 @@ default-package-overrides:
   # gi-gdkx11-4.x requires gtk-4.x, which is still under development and
   # not yet available in Nixpkgs
   - gi-gdkx11 < 4
-  # LTS Haskell 16.7
+  # LTS Haskell 16.8
   - abstract-deque ==0.3
   - abstract-par ==0.3.3
   - AC-Angle ==1.0
@@ -323,7 +323,7 @@ default-package-overrides:
   - bins ==0.1.2.0
   - bitarray ==0.0.1.1
   - bits ==0.5.2
-  - bitset-word8 ==0.1.1.1
+  - bitset-word8 ==0.1.1.2
   - bits-extra ==0.0.2.0
   - bitvec ==1.0.3.0
   - blake2 ==0.3.0
@@ -439,9 +439,9 @@ default-package-overrides:
   - cipher-des ==0.0.6
   - cipher-rc4 ==0.1.4
   - circle-packing ==0.1.0.6
-  - clash-ghc ==1.2.3
+  - clash-ghc ==1.2.4
-  - clash-lib ==1.2.3
+  - clash-lib ==1.2.4
-  - clash-prelude ==1.2.3
+  - clash-prelude ==1.2.4
   - classy-prelude ==1.5.0
   - classy-prelude-conduit ==1.5.0
   - classy-prelude-yesod ==1.5.0
@@ -518,9 +518,9 @@ default-package-overrides:
   - control-monad-omega ==0.3.2
   - convertible ==1.1.1.0
   - cookie ==0.4.5
-  - core-data ==0.2.1.5
+  - core-data ==0.2.1.7
-  - core-program ==0.2.4.2
+  - core-program ==0.2.4.4
-  - core-text ==0.2.3.3
+  - core-text ==0.2.3.5
   - countable ==1.0
   - cpio-conduit ==0.7.0
   - cpphs ==1.20.9.1
@@ -787,7 +787,7 @@ default-package-overrides:
   - file-path-th ==0.1.0.0
   - filepattern ==0.1.2
   - fileplow ==0.1.0.0
-  - filtrable ==0.1.3.0
+  - filtrable ==0.1.4.0
   - fin ==0.1.1
   - FindBin ==0.0.5
   - fingertree ==0.1.4.2
@@ -976,6 +976,7 @@ default-package-overrides:
   - hadoop-streaming ==0.2.0.3
   - hakyll ==4.13.4.0
   - half ==0.3
+  - hall-symbols ==0.1.0.6
   - hamtsolo ==1.0.3
   - HandsomeSoup ==0.4.2
   - hapistrano ==0.4.1.0
@@ -1046,7 +1047,7 @@ default-package-overrides:
   - hint ==0.9.0.3
   - hjsmin ==0.2.0.4
   - hkd-default ==1.1.0.0
-  - hkgr ==0.2.6
+  - hkgr ==0.2.6.1
   - hlibcpuid ==0.2.0
   - hlibgit2 ==0.18.0.16
   - hmatrix ==0.20.0.0
@@ -1144,7 +1145,7 @@ default-package-overrides:
   - http-link-header ==1.0.3.1
   - http-media ==0.8.0.0
   - http-reverse-proxy ==0.6.0
-  - http-streams ==0.8.7.1
+  - http-streams ==0.8.7.2
   - http-types ==0.12.3
   - human-readable-duration ==0.2.1.4
   - HUnit ==1.6.0.0
@@ -1511,7 +1512,7 @@ default-package-overrides:
   - MusicBrainz ==0.4.1
   - mustache ==2.3.1
   - mutable-containers ==0.3.4
-  - mwc-probability ==2.3.0
+  - mwc-probability ==2.3.1
   - mwc-random ==0.14.0.0
   - mx-state-codes ==1.0.0.0
   - mysql ==0.1.7
@@ -1732,11 +1733,11 @@ default-package-overrides:
   - pretty-class ==1.0.1.1
   - pretty-hex ==1.1
   - prettyprinter ==1.6.2
-  - prettyprinter-ansi-terminal ==1.1.1.2
+  - prettyprinter-ansi-terminal ==1.1.2
   - prettyprinter-compat-annotated-wl-pprint ==1
   - prettyprinter-compat-ansi-wl-pprint ==1.0.1
   - prettyprinter-compat-wl-pprint ==1.0.0.1
-  - prettyprinter-convert-ansi-wl-pprint ==1.1
+  - prettyprinter-convert-ansi-wl-pprint ==1.1.1
   - pretty-relative-time ==0.2.0.0
   - pretty-show ==1.10
   - pretty-simple ==3.2.3.0
@@ -1825,7 +1826,7 @@ default-package-overrides:
   - rawstring-qm ==0.2.3.0
   - raw-strings-qq ==1.1
   - rcu ==0.2.4
-  - rdf ==0.1.0.3
+  - rdf ==0.1.0.4
   - rdtsc ==1.3.0.1
   - re2 ==0.3
   - readable ==0.3.1
@@ -1914,7 +1915,7 @@ default-package-overrides:
   - salve ==1.0.10
   - sample-frame ==0.0.3
   - sample-frame-np ==0.0.4.1
-  - sampling ==0.3.4
+  - sampling ==0.3.5
   - say ==0.1.0.1
   - sbp ==2.6.3
   - scalpel ==0.6.2
@@ -2137,6 +2138,7 @@ default-package-overrides:
   - syb ==0.7.1
   - symbol ==0.2.4
   - symengine ==0.1.2.0
+  - symmetry-operations-symbols ==0.0.1.4
   - sysinfo ==0.1.1
   - system-argv0 ==0.1.1
   - systemd ==2.3.0
@@ -2231,10 +2233,10 @@ default-package-overrides:
   - th-nowq ==0.1.0.5
   - th-orphans ==0.13.10
   - th-printf ==0.7
-  - thread-hierarchy ==0.3.0.1
+  - thread-hierarchy ==0.3.0.2
   - thread-local-storage ==0.2
   - threads ==0.5.1.6
-  - thread-supervisor ==0.1.0.0
+  - thread-supervisor ==0.1.0.1
   - threepenny-gui ==0.9.0.0
   - th-reify-compat ==0.0.1.5
   - th-reify-many ==0.1.9
@@ -2426,9 +2428,9 @@ default-package-overrides:
   - wave ==0.2.0
   - wcwidth ==0.0.2
   - webdriver ==0.9.0.1
-  - webex-teams-api ==0.2.0.0
+  - webex-teams-api ==0.2.0.1
-  - webex-teams-conduit ==0.2.0.0
+  - webex-teams-conduit ==0.2.0.1
-  - webex-teams-pipes ==0.2.0.0
+  - webex-teams-pipes ==0.2.0.1
   - webrtc-vad ==0.1.0.3
   - websockets ==0.12.7.1
   - websockets-snap ==0.10.3.1
@@ -3745,6 +3747,7 @@ broken-packages:
   - chart-histogram
   - Chart-simple
   - chart-svg
+  - chart-svg-various
   - chart-unit
   - chatter
   - chatty-text
@@ -7615,6 +7618,7 @@ broken-packages:
   - mDNSResponder-client
   - mdp
   - mealstrom
+  - mealy
   - MeanShift
   - Measure
   - mecab
@@ -8661,6 +8665,8 @@ broken-packages:
   - postgresql-simple-sop
   - postgresql-simple-typed
   - postgresql-syntax
+  - postgresql-tx-query
+  - postgresql-tx-squeal
   - postgresql-typed
   - postgresql-typed-lifted
   - postgrest-ws
@@ -9334,6 +9340,7 @@ broken-packages:
   - SCalendar
   - scalendar
   - scalp-webhooks
+  - scalpel-search
   - scan-vector-machine
   - scc
   - scenegraph
@@ -10164,6 +10171,7 @@ broken-packages:
   - taskell
   - TaskMonad
   - tasty-auto
+  - tasty-bdd
   - tasty-fail-fast
   - tasty-groundhog-converters
   - tasty-hedgehog-coverage

pkgs/development/libraries/audio/libmysofa/default.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ zlib ];
 
-  cmakeFlags = [ "-DBUILD_TESTS=OFF" ];
+  cmakeFlags = [ "-DBUILD_TESTS=OFF" "-DCODE_COVERAGE=OFF" ];
 
   meta = with stdenv.lib; {
     description = "Reader for AES SOFA files to get better HRTFs";

pkgs/development/libraries/ayatana-ido/default.nix

@@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub
+, pkgconfig, autoreconfHook
+, gtk3, gobject-introspection, gtk-doc, vala
+}:
+
+stdenv.mkDerivation rec {
+  pname = "ayatana-ido";
+  version = "0.4.90";
+
+  src = fetchFromGitHub {
+    owner = "AyatanaIndicators";
+    repo = pname;
+    rev = version;
+    sha256 = "02vqjryni96zzrpkq5d7kvgw7nf252d2fm2xq8fklvvb2vz3fa0w";
+  };
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook gtk-doc vala ];
+
+  buildInputs = [ gtk3 gobject-introspection ];
+
+  meta = with stdenv.lib; {
+    description = "Ayatana Display Indicator Objects";
+    homepage = "https://github.com/AyatanaIndicators/ayatana-ido";
+    changelog = "https://github.com/AyatanaIndicators/ayatana-ido/blob/${version}/ChangeLog";
+    license = [ licenses.gpl3 licenses.lgpl21 ];
+    maintainers = [ maintainers.nickhu ];
+    platforms = platforms.x86_64;
+  };
+}

pkgs/development/libraries/faudio/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "faudio";
-  version = "20.07";
+  version = "20.08";
 
   src = fetchFromGitHub {
     owner = "FNA-XNA";
     repo = "FAudio";
     rev = version;
-    sha256 = "14fi0jwax9qzn2k89qazdkhxvklk5zcwhbi6pxi1l5i9zk4ly2h7";
+    sha256 = "1fs0h5wl0ndix61mz7h59c15kpqikrk7nn1rc7m2a44jiw8mzdnx";
   };
 
 	nativeBuildInputs = [cmake];

pkgs/development/libraries/gl2ps/default.nix

@@ -1,17 +1,27 @@
-{ stdenv, fetchurl, cmake
+{ stdenv
-, zlib, libGL, libGLU, libpng, freeglut }:
+, fetchurl
+, cmake
+, zlib
+, libGL
+, libGLU
+, libpng
+, freeglut
+}:
 
 stdenv.mkDerivation rec {
-  version = "1.4.2";
   pname = "gl2ps";
+  version = "1.4.2";
 
   src = fetchurl {
     url = "http://geuz.org/gl2ps/src/${pname}-${version}.tgz";
     sha256 = "1sgzv547h7hrskb9qd0x5yp45kmhvibjwj2mfswv95lg070h074d";
   };
 
-  buildInputs = [
+  nativeBuildInputs = [
     cmake
+  ];
+
+  buildInputs = [
     zlib
     libGL
     libGLU

pkgs/development/libraries/grpc/default.nix

@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, fetchpatch, cmake, zlib, c-ares, pkgconfig, openssl, protobuf, gflags, abseil-cpp }:
 
 stdenv.mkDerivation rec {
-  version = "1.29.0"; # N.B: if you change this, change pythonPackages.grpcio-tools to a matching version too
+  version = "1.31.0"; # N.B: if you change this, change pythonPackages.grpcio-tools to a matching version too
   pname = "grpc";
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc";
     rev = "v${version}";
-    sha256 = "1n604grkf2amzrmwcz6am0rpbp3yfb062lpgmhv943hj8wk7xw27";
+    sha256 = "1h7gmhkjijfkpqhz8vswhkz2gkphs638g10dlkayic8xg9xdl4gj";
     fetchSubmodules = true;
   };
   patches = [

pkgs/development/libraries/kmsxx/default.nix

@@ -3,14 +3,14 @@
 
 stdenv.mkDerivation {
   pname = "kmsxx";
-  version = "2020-02-14";
+  version = "2020-08-04";
 
   src = fetchFromGitHub {
     owner = "tomba";
     repo = "kmsxx";
     fetchSubmodules = true;
-    rev = "7c5e645112a899ad018219365c3898b0e896353f";
+    rev = "38bee3092f2d477f1baebfcae464f888d3d04bbe";
-    sha256 = "1hj4gk4gwlvpjprjbrmrbrzqjhdgszsndrb1i4f9z7mjvdv8gij2";
+    sha256 = "0xz4m9bk0naawxwpx5cy1j3cm6c8c9m5y551csk88y88x1g0z0xh";
   };
 
   enableParallelBuilding = true;

pkgs/development/libraries/ldb/default.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ldb";
-  version = "2.1.4";
+  version = "2.2.0";
 
   src = fetchurl {
     url = "mirror://samba/ldb/${pname}-${version}.tar.gz";
-    sha256 = "0kmzs2s7fvar9ksaxyiqlh8q8mbwc7bxrq9w1y91zlyb23p142wy";
+    sha256 = "0pxxb3sn9lignkf80kndd84shxqk9m2qwimz62gzb6khd4bvajqk";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/libayatana-appindicator/default.nix

@@ -0,0 +1,49 @@
+{ stdenv, fetchFromGitHub, lib
+, pkgconfig, autoreconfHook , gtk-doc
+, gtkVersion ? "3"
+, gtk2, libayatana-indicator-gtk2, libdbusmenu-gtk2
+, gtk3, libayatana-indicator-gtk3, libdbusmenu-gtk3
+, dbus-glib, python2, python2Packages
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libayatana-appindicator-gtk${gtkVersion}";
+  version = "0.5.4";
+
+  src = fetchFromGitHub {
+    owner = "AyatanaIndicators";
+    repo = "libayatana-appindicator";
+    rev = version;
+    sha256 = "0bqjqb7gabdk7mifk8azi630qw39z978f973fx2ylgdgr4a66j1v";
+  };
+
+  patchPhase = ''
+    substituteInPlace configure.ac \
+      --replace "codegendir pygtk-2.0" "codegendir pygobject-2.0"
+  '';
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook gtk-doc ];
+
+  buildInputs = [ dbus-glib python2 python2Packages.pygtk ]
+    ++ lib.lists.optional (gtkVersion == "2") libayatana-indicator-gtk2
+    ++ lib.lists.optional (gtkVersion == "3") libayatana-indicator-gtk3;
+
+  propagatedBuildInputs =
+    lib.lists.optionals (gtkVersion == "2") [ gtk2 libdbusmenu-gtk2 ]
+    ++ lib.lists.optionals (gtkVersion == "3") [ gtk3 libdbusmenu-gtk3 ];
+
+  preAutoreconf = ''
+    gtkdocize
+  '';
+
+  configureFlags = [ "--with-gtk=${gtkVersion}" ];
+
+  meta = with stdenv.lib; {
+    description = "Ayatana Application Indicators Shared Library";
+    homepage = "https://github.com/AyatanaIndicators/libayatana-appindicator";
+    changelog = "https://github.com/AyatanaIndicators/libayatana-appindicator/blob/${version}/ChangeLog";
+    license = [ licenses.gpl3 licenses.lgpl21 ];
+    maintainers = [ maintainers.nickhu ];
+    platforms = platforms.x86_64;
+  };
+}

pkgs/development/libraries/libayatana-indicator/default.nix

@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, lib
+, pkgconfig, autoreconfHook
+, gtkVersion ? "3"
+, gtk2
+, gtk3
+, ayatana-ido
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libayatana-indicator-gtk${gtkVersion}";
+  version = "0.6.3";
+
+  src = fetchFromGitHub {
+    owner = "AyatanaIndicators";
+    repo = "libayatana-indicator";
+    rev = version;
+    sha256 = "1q9wmaw6pckwyrv0s7wkqzm1yrk031pbz4xbr8cwn75ixqyfcb28";
+  };
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+
+  buildInputs = [ ayatana-ido ]
+    ++ lib.lists.optionals (gtkVersion == "2") [ gtk2 ]
+    ++ lib.lists.optionals (gtkVersion == "3") [ gtk3 ];
+
+  configureFlags = [ "--with-gtk=${gtkVersion}" ];
+
+  meta = with stdenv.lib; {
+    description = "Ayatana Indicators Shared Library";
+    homepage = "https://github.com/AyatanaIndicators/libayatana-indicator";
+    changelog = "https://github.com/AyatanaIndicators/libayatana-indicator/blob/${version}/ChangeLog";
+    license = licenses.gpl3;
+    maintainers = [ maintainers.nickhu ];
+    platforms = platforms.x86_64;
+  };
+}

pkgs/development/libraries/libxml2/default.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, fetchpatch
-, zlib, xz, python, gettext, ncurses, findXMLCatalogs
+, zlib, xz, libintl, python, gettext, ncurses, findXMLCatalogs
 , pythonSupport ? stdenv.buildPlatform == stdenv.hostPlatform
 , icuSupport ? false, icu ? null
 , enableShared ? stdenv.hostPlatform.libc != "msvcrt"
@@ -46,6 +46,8 @@ stdenv.mkDerivation rec {
   buildInputs = lib.optional pythonSupport python
     ++ lib.optional (pythonSupport && python?isPy2 && python.isPy2) gettext
     ++ lib.optional (pythonSupport && python?isPy3 && python.isPy3) ncurses
+    ++ lib.optional (stdenv.isDarwin &&
+                     pythonSupport && python?isPy2 && python.isPy2) libintl
     # Libxml2 has an optional dependency on liblzma.  However, on impure
     # platforms, it may end up using that from /usr/lib, and thus lack a
     # RUNPATH for that, leading to undefined references for its users.

pkgs/development/libraries/oneDNN/default.nix

@@ -5,13 +5,13 @@
 # https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
 stdenv.mkDerivation rec {
   pname = "oneDNN";
-  version = "1.5.1";
+  version = "1.6";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "oneDNN";
     rev = "v${version}";
-    sha256 = "1l66gkidldjpznp8pb01wdgrmm0rmrbndv8lzidz8fp9hf473zgl";
+    sha256 = "0w2rgr3zgk7a3cql12dpddyhz2isyqqaks4vm8p45y426pd5m64b";
   };
 
   outputs = [ "out" "dev" "doc" ];

pkgs/development/libraries/openmpi/default.nix

@@ -13,7 +13,6 @@
 
 # Enable libfabric support (necessary for Omnipath networks) on x86_64 linux
 , fabricSupport ? stdenv.isLinux && stdenv.isx86_64
-
 }:
 
 assert !cudaSupport || cudatoolkit != null;
@@ -59,6 +58,7 @@ in stdenv.mkDerivation rec {
       "--with-libnl=${libnl.dev}"
       "--with-pmix=${pmix}"
       "--with-pmix-libdir=${pmix}/lib"
+      "--enable-mpi-cxx"
     ] ++ lib.optional enableSGE "--with-sge"
     ++ lib.optional enablePrefix "--enable-mpirun-prefix-by-default"
     # TODO: add UCX support, which is recommended to use with cuda for the most robust OpenMPI build

pkgs/development/libraries/rocclr/default.nix

@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake rocm-cmake ];
 
-  buildInputs = [ clang rocm-comgr rocm-runtime rocm-thunk clang ];
+  buildInputs = [ clang rocm-comgr rocm-runtime rocm-thunk ];
 
   propagatedBuildInputs = [ libelf libglvnd libX11 ];
 
@@ -34,7 +34,8 @@ stdenv.mkDerivation rec {
       --replace 'set(ROCCLR_EXPORTS_FILE "''${CMAKE_CURRENT_BINARY_DIR}/amdrocclr_staticTargets.cmake")' \
         'set(ROCCLR_EXPORTS_FILE "''${CMAKE_INSTALL_LIBDIR}/cmake/amdrocclr_staticTargets.cmake")' \
       --replace 'set (CMAKE_LIBRARY_OUTPUT_DIRECTORY ''${CMAKE_CURRENT_BINARY_DIR}/lib)' \
-        'set (CMAKE_LIBRARY_OUTPUT_DIRECTORY ''${CMAKE_INSTALL_LIBDIR})'
+        'set (CMAKE_LIBRARY_OUTPUT_DIRECTORY ''${CMAKE_INSTALL_LIBDIR})' \
+      --replace 'find_library( OpenCL REQUIRED' 'find_library( OpenCL'
     substituteInPlace device/comgrctx.cpp \
       --replace "libamd_comgr.so" "${rocm-comgr}/lib/libamd_comgr.so"
   '';

pkgs/development/ocaml-modules/gmetadom/default.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "0skmlv0pnqvg99wzzzi1h4zhwzd82xg7xpkj1kwpfy7bzinjh7ig";
   };
 
-  patches = [ ./gcc-4.3.dpatch ];
+  patches = [ ./gcc-4.3.patch ];
 
   dontDisableStatic = true;
 

pkgs/development/python-modules/azure-mgmt-monitor/default.nix

@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-monitor";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "0r3l55mhd00zx8sw13d7i9l7r214946s1y3wxcswxad7q5660zfm";
+    sha256 = "c6e1fe83dd2ddffa7f6d90c7aa63b3128042396a3893c14dc4816ad28cb15016";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/binwalk/default.nix

@@ -9,6 +9,8 @@
 , gnutar
 , p7zip
 , cabextract
+, cramfsprogs
+, cramfsswap
 , lzma
 , nose
 , pycrypto
@@ -29,7 +31,7 @@ buildPythonPackage {
     sha256 = "1bxgj569fzwv6jhcbl864nmlsi9x1k1r20aywjxc8b9b1zgqrlvc";
   };
 
-  propagatedBuildInputs = [ zlib xz ncompress gzip bzip2 gnutar p7zip cabextract lzma pycrypto ]
+  propagatedBuildInputs = [ zlib xz ncompress gzip bzip2 gnutar p7zip cabextract cramfsswap cramfsprogs lzma pycrypto ]
   ++ stdenv.lib.optional visualizationSupport pyqtgraph;
 
   # setup.py only installs version.py during install, not test

pkgs/development/python-modules/braintree/default.nix

@@ -6,11 +6,11 @@
 
 buildPythonPackage rec {
   pname = "braintree";
-  version = "4.2.0";
+  version = "4.3.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0aw5n1hqrg5pb5xmcr1b8y9i7v8zj23q9k2p4b6bwnq2c2fqi8wr";
+    sha256 = "d2b5ead45dbfe98b6099d387c7f12b7d2994ae0efb60679e6bb0929a06027e16";
   };
 
   propagatedBuildInputs = [ requests ];

pkgs/development/python-modules/cfgv/default.nix

@@ -2,12 +2,12 @@
 
 buildPythonPackage rec {
   pname = "cfgv";
-  version = "3.1.0";
+  version = "3.2.0";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "c8e8f552ffcc6194f4e18dd4f68d9aef0c0d58ae7e7be8c82bee3c5e9edfa513";
+    sha256 = "cf22deb93d4bcf92f345a5c3cd39d3d41d6340adc60c78bbbd6588c384fda6a1";
   };
 
   propagatedBuildInputs = [ six ];

pkgs/development/python-modules/cli-helpers/default.nix

@@ -10,11 +10,11 @@
 
 buildPythonPackage rec {
   pname = "cli_helpers";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "18f7d8c5a22d85fc685d56a9f301d8b9f7f0d7d4e9033a27563b066c2ab41833";
+    sha256 = "dd6f164310f7d86fa3da1f82043a9c784e44a02ad49be932a80624261e56979b";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/cot/default.nix

@@ -0,0 +1,56 @@
+{ stdenv, buildPythonPackage, fetchPypi, pythonOlder, isPy3k
+, argcomplete, colorlog, pyvmomi, requests, verboselogs
+, psutil, pyopenssl, setuptools
+, mock, pytest, pytest-mock, pytestCheckHook, qemu
+}:
+
+buildPythonPackage rec {
+  pname = "cot";
+  version = "2.2.1";
+
+  disabled = !isPy3k;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "f4b3553415f90daac656f89d3e82e79b3d751793239bb173a683b4cc0ceb2635";
+  };
+
+  propagatedBuildInputs = [ colorlog pyvmomi requests verboselogs pyopenssl setuptools ]
+  ++ stdenv.lib.optional (pythonOlder "3.3") psutil;
+
+  checkInputs = [ mock pytestCheckHook pytest-mock qemu ];
+
+  # Many tests require network access and/or ovftool (https://code.vmware.com/web/tool/ovf)
+  # try enabling these tests with ovftool once/if it is added to nixpkgs
+  disabledTests = [
+    "HelperGenericTest"
+    "TestCOTAddDisk"
+    "TestCOTAddFile"
+    "TestCOTEditHardware"
+    "TestCOTEditProduct"
+    "TestCOTEditProperties"
+    "TestCOTInjectConfig"
+    "TestISO"
+    "TestOVFAPI"
+    "TestQCOW2"
+    "TestRAW"
+    "TestVMDKConversion"
+  ];
+
+
+  # argparse is part of the standardlib
+  prePatch = ''
+    substituteInPlace setup.py --replace "'argparse'," ""
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Common OVF Tool";
+    longDescription = ''
+      COT (the Common OVF Tool) is a tool for editing Open Virtualization Format (.ovf, .ova) virtual appliances,
+      with a focus on virtualized network appliances such as the Cisco CSR 1000V and Cisco IOS XRv platforms.
+    '';
+    homepage = "https://github.com/glennmatthews/cot";
+    license = licenses.mit;
+    maintainers = with maintainers; [ evanjs ];
+  };
+}

pkgs/development/python-modules/grpcio-tools/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.29.0";
+  version = "1.31.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0f681c1ebd5472b804baa391b16dc59d92b065903999566f4776bfbd010bcec9";
+    sha256 = "3b08cbd3f4d5b60e3bff8f859e6e03db739967a684268164abc940415e23ca51";
   };
 
   enableParallelBuilding = true;

pkgs/development/python-modules/itemloaders/default.nix

@@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, isPy27
+, w3lib
+, parsel
+, jmespath
+, itemadapter
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "itemloaders";
+  version = "1.0.1";
+
+  disabled = isPy27;
+
+  # Tests not included in PyPI tarball
+  src = fetchFromGitHub {
+    owner = "scrapy";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0frs0s876ddha844vhnhhiggyk3qbhhngrwkvgg3c0mrnn282f6k";
+  };
+
+  propagatedBuildInputs = [ w3lib parsel jmespath itemadapter ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    description = "Base library for scrapy's ItemLoader";
+    homepage = "https://github.com/scrapy/itemloaders";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.marsam ];
+  };
+}

pkgs/development/python-modules/scrapy/default.nix

@@ -24,10 +24,11 @@
 , pytest-twisted
 , botocore
 , itemadapter
+, itemloaders
 }:
 
 buildPythonPackage rec {
-  version = "2.2.1";
+  version = "2.3.0";
   pname = "Scrapy";
 
   disabled = isPy27;
@@ -57,22 +58,24 @@ buildPythonPackage rec {
     zope_interface
     protego
     itemadapter
+    itemloaders
   ];
 
   LC_ALL = "en_US.UTF-8";
 
   # Disable doctest plugin—enabled in the shipped pytest.ini—because it causes pytest to hang
   # Ignore proxy tests because requires mitmproxy
+  # Ignore utils_display tests because it requires pygments
   # Ignore test_retry_dns_error because tries to resolve an invalid dns and weirdly fails with "Reactor was unclean"
   # Ignore xml encoding test on darwin because lxml can't find encodings https://bugs.launchpad.net/lxml/+bug/707396
   checkPhase = ''
     substituteInPlace pytest.ini --replace "--doctest-modules" ""
-    pytest --ignore=tests/test_linkextractors_deprecated.py --ignore=tests/test_proxy_connect.py --deselect tests/test_crawl.py::CrawlTestCase::test_retry_dns_error ${lib.optionalString stdenv.isDarwin "--deselect tests/test_utils_iterators.py::LxmlXmliterTestCase::test_xmliter_encoding"}
+    pytest --ignore=tests/test_linkextractors_deprecated.py --ignore=tests/test_proxy_connect.py --ignore=tests/test_utils_display.py --deselect tests/test_crawl.py::CrawlTestCase::test_retry_dns_error ${lib.optionalString stdenv.isDarwin "--deselect tests/test_utils_iterators.py::LxmlXmliterTestCase::test_xmliter_encoding"}
   '';
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "6a09beb5190bfdee2d72cf261822eae5d92fe8a86ac9ee1f55fc44b4864ca583";
+    sha256 = "b4d08cdacb615563c291d053ef1ba2dc08d9d4b6d81578684eaa1cf7b832f90c";
   };
 
   postInstall = ''

pkgs/development/python-modules/vega/default.nix

@@ -1,5 +1,5 @@
 { stdenv, buildPythonPackage , fetchPypi, pythonOlder
-, pytest, jupyter_core, pandas, ipywidgets }:
+, pytest, jupyter_core, pandas, ipywidgets, jupyter, altair }:
 
 buildPythonPackage rec {
   pname = "vega";
@@ -12,7 +12,11 @@ buildPythonPackage rec {
   };
 
   buildInputs = [ pytest ];
-  propagatedBuildInputs = [ jupyter_core pandas ipywidgets ];
+  propagatedBuildInputs = [ jupyter jupyter_core pandas ipywidgets ];
+
+  # currently, recommonmark is broken on python3
+  doCheck = false;
+  checkInputs = [ altair ];
 
   meta = with stdenv.lib; {
     description = "An IPython/Jupyter widget for Vega and Vega-Lite";

pkgs/development/python-modules/wxPython/4.0.nix

@@ -1,29 +1,18 @@
 { lib
 , stdenv
-, openglSupport ? true
-, libX11
-, pyopengl
 , buildPythonPackage
 , fetchPypi
 , pkgconfig
-, libjpeg
-, libtiff
-, SDL
-, gst-plugins-base
-, libnotify
-, freeglut
-, xorg
 , which
 , cairo
-, requests
 , pango
-, pathlib2
 , python
 , doxygen
 , ncurses
-, libpng
-, gstreamer
 , wxGTK
+, numpy
+, pillow
+, six
 }:
 
 buildPythonPackage rec {
@@ -38,16 +27,7 @@ buildPythonPackage rec {
   doCheck = false;
 
   nativeBuildInputs = [ pkgconfig which doxygen wxGTK ];
-
+  buildInputs = [ ncurses wxGTK.gtk ];
-  buildInputs = [ libjpeg libtiff SDL
-      gst-plugins-base libnotify freeglut xorg.libSM ncurses
-      requests libpng gstreamer libX11
-      pathlib2
-      (wxGTK.gtk)
-  ]
-    ++ lib.optional openglSupport pyopengl;
-
-  hardeningDisable = [ "format" ];
 
   DOXYGEN = "${doxygen}/bin/doxygen";
 
@@ -68,10 +48,9 @@ buildPythonPackage rec {
 
   installPhase = ''
     ${python.interpreter} setup.py install --skip-build --prefix=$out
-    wrapPythonPrograms
   '';
 
-  passthru = { inherit wxGTK openglSupport; };
+  passthru = { inherit wxGTK; };
 
 
   meta = {

pkgs/development/tools/continuous-integration/gitlab-runner/default.nix

@@ -1,16 +1,16 @@
 { lib, buildGoPackage, fetchFromGitLab, fetchurl }:
 
 let
-  version = "13.2.0";
+  version = "13.2.2";
   # Gitlab runner embeds some docker images these are prebuilt for arm and x86_64
   docker_x86_64 = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-x86_64.tar.xz";
-    sha256 = "0cvcil96gww68abdj5ni7w69ss5ncz3ixh00k1a9nlqggf0ifaav";
+    sha256 = "1m45jipn0lmlc4ynmm7g4nd1ryr5bzz1wvr8spd6gxvq5577i4pk";
   };
 
   docker_arm = fetchurl {
     url = "https://gitlab-runner-downloads.s3.amazonaws.com/v${version}/helper-images/prebuilt-arm.tar.xz";
-    sha256 = "1j2z1wk4qs089mvx7y14al28pzhhnzs17n1ijpahsln2jn7b2s5m";
+    sha256 = "10nx0gjhbl4gz2n3yl8m7w60pmgdywgzins6y2pa7wvj5dkm04ax";
   };
 in
 buildGoPackage rec {
@@ -30,7 +30,7 @@ buildGoPackage rec {
     owner = "gitlab-org";
     repo = "gitlab-runner";
     rev = "v${version}";
-    sha256 = "0bgrh1yckc879qq155dvdqsr7673g1r1hbwf489ngabj8f8l3l23";
+    sha256 = "1jii9rm11kcdh7hg9rif27b7rlj2cip6q9viknvs3ha1rf9fw96q";
   };
 
   patches = [ ./fix-shell-path.patch ];

pkgs/development/tools/database/dbmate/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "dbmate";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "amacneil";
     repo = "dbmate";
     rev = "v${version}";
-    sha256 = "0v00k658b4ca9bpn2yiiy3gq5gr6hms8mlk31wf8svwsjyzjibzr";
+    sha256 = "0s7ymw1r1k1s8kwyg6nxpgak6kh9z3649a0axdfpjnm62v283shd";
   };
 
   vendorSha256 = "00vp925vf9clk5bkw5fvj34id4v548rlssizh52z9psvdizj8q5p";

pkgs/development/tools/gopls/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gopls";
-  version = "0.4.3";
+  version = "0.4.4";
 
   src = fetchgit {
     rev = "gopls/v${version}";
     url = "https://go.googlesource.com/tools";
-    sha256 = "1r670c7p63l0fhx671r3mb1jgvvfv1382079fv59z07j5j5hizbc";
+    sha256 = "1h4ica6rwrdp5wg4ybpzvyvszj4m5l6w9hpvd9r2qcd9qdnqlykf";
   };
 
   modRoot = "gopls";
-  vendorSha256 = "1xdvkdkvk7a32jspzjcgxkfdn78d2zm53wxmc9c4sqysxsgy6lbw";
+  vendorSha256 = "175051d858lsdir2hj5qcimp6hakbi9grpws1ssvk3r2jna27x1z";
 
   meta = with stdenv.lib; {
     description = "Official language server for the Go language";

pkgs/development/tools/kustomize/default.nix

@@ -2,8 +2,8 @@
 
 buildGoModule rec {
   pname = "kustomize";
-  version = "3.8.0";
+  version = "3.8.1";
-  # rev is the 3.8.0 commit, mainly for kustomize version command output
+  # rev is the 3.8.1 commit, mainly for kustomize version command output
   rev = "6a50372dd5686df22750b0c729adaf369fbf193c";
 
   buildFlagsArray = let t = "sigs.k8s.io/kustomize/api/provenance"; in
@@ -17,14 +17,14 @@ buildGoModule rec {
     owner = "kubernetes-sigs";
     repo = pname;
     rev = "kustomize/v${version}";
-    sha256 = "1v86gqn16xh28gi2fa6jgbbk0clrcng3sbr1az42iy4mm4nmsriy";
+    sha256 = "07zdp6xv8viwnaz1qacwhg82dlzcrgb8dls6yz9qk4qcnsk6badx";
   };
 
   # avoid finding test and development commands
   sourceRoot = "source/kustomize";
 
   deleteVendor = true;
-  vendorSha256 = "03z40gi9nrj120cd57pa3fmi8grldyxa65a1lkvlc2r3z9g29vdw";
+  vendorSha256 = "01ff3w4hwp4ynqhg8cplv0i2ixs811d2x2j6xbh1lslyyh3z3wc5";
 
   meta = with lib; {
     description = "Customization of kubernetes YAML configurations";

pkgs/development/tools/misc/arcanist/default.nix

@@ -1,53 +1,54 @@
-{ stdenv, fetchFromGitHub, php, flex, makeWrapper }:
+{ stdenv, fetchFromGitHub, php, flex }:
+
+# Make a custom wrapper. If `wrapProgram` is used, arcanist thinks .arc-wrapped is being
+# invoked and complains about it being an unknown toolset. We could use `makeWrapper`, but
+# then we’d need to still craft a script that does the `php libexec/arcanist/bin/...` dance
+# anyway... So just do everything at once.
+let makeArcWrapper = toolset: ''
+    cat << WRAPPER > $out/bin/${toolset}
+    #!$shell -e
+    export PATH='${php}/bin/'\''${PATH:+':'}\$PATH
+    exec ${php}/bin/php $out/libexec/arcanist/bin/${toolset} "\$@"
+    WRAPPER
+    chmod +x $out/bin/${toolset}
+'';
 
-let
-  libphutil = fetchFromGitHub {
-    owner = "phacility";
-    repo = "libphutil";
-    rev = "cc2a3dbf590389400da55563cb6993f321ec6d73";
-    sha256 = "1k7sr3racwz845i7r5kdwvgqrz8gldz07pxj3yw77s58rqbix3ad";
-  };
-  arcanist = fetchFromGitHub {
-    owner = "phacility";
-    repo = "arcanist";
-    rev = "21a1828ea06cf031e93082db8664d73efc88290a";
-    sha256 = "05rq9l9z7446ks270viay57r5ibx702b5bnlf4ck529zc4abympx";
-  };
 in
+
 stdenv.mkDerivation {
   pname = "arcanist";
-  version = "20200127";
+  version = "20200711";
 
-  src = [ arcanist libphutil ];
+  src = fetchFromGitHub {
-  buildInputs = [ php makeWrapper flex ];
+    owner = "phacility";
-
+    repo = "arcanist";
-  unpackPhase = ''
+    rev = "2565cc7b4d1dbce6bc7a5b3c4e72ae94be4712fe";
-    cp -aR ${libphutil} libphutil
+    sha256 = "0jiv4aj4m5750dqw9r8hizjkwiyxk4cg4grkr63sllsa2dpiibxw";
-    cp -aR ${arcanist} arcanist
+  };
-    chmod +w -R libphutil arcanist
+  buildInputs = [ php flex ];
-  '';
 
   postPatch = stdenv.lib.optionalString stdenv.isAarch64 ''
-    substituteInPlace libphutil/support/xhpast/Makefile \
+    substituteInPlace support/xhpast/Makefile \
       --replace "-minline-all-stringops" ""
   '';
 
   buildPhase = ''
-    (
+    make xhpast -C support/xhpast
-      cd libphutil/support/xhpast
-      make clean all install
-    )
   '';
+
   installPhase = ''
     mkdir -p $out/bin $out/libexec
-    cp -R libphutil $out/libexec/libphutil
+    make install -C support/xhpast
-    cp -R arcanist  $out/libexec/arcanist
+    cp -R $src $out/libexec/arcanist
-    ${if stdenv.isDarwin then ''
+
-        echo "#! $shell -e" > $out/bin/arc
+    ${makeArcWrapper "arc"}
-        echo "exec ${php}/bin/php $out/libexec/arcanist/scripts/arcanist.php "'"$@"' >> $out/bin/arc
+    ${makeArcWrapper "phage"}
-        chmod +x $out/bin/arc''
+  '';
-      else ''
+
-        ln -s $out/libexec/arcanist/scripts/arcanist.php $out/bin/arc''}
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/arc help diff -- > /dev/null
+    $out/bin/phage help alias -- > /dev/null
   '';
 
   meta = {

pkgs/development/tools/misc/cproto/default.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   };
 
   # patch made by Joe Khoobyar copied from gentoo bugs
-  patches = ./cproto_patch;
+  patches = [ ./cproto.patch ];
 
   nativeBuildInputs = [ flex bison ];
 

pkgs/development/tools/misc/pahole/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pahole";
-  version = "1.16";
+  version = "1.17";
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/devel/pahole/pahole.git";
     rev = "v${version}";
-    sha256 = "1gfc9v4dgs811v1zjk0d9hsgmizllw2hibc83ykmakzysimaxsy3";
+    sha256 = "13dxsmhpf9n2wqggf4gd6f12rm0vhv0q96jd50gkvaxzzvgpzzbc";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/tools/misc/strace/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "strace";
-  version = "5.7";
+  version = "5.8";
 
   src = fetchurl {
     url = "https://strace.io/files/${version}/${pname}-${version}.tar.xz";
-    sha256 = "1n6cfz3i2krkyvxpdp3kmxhf7sy5xp0danzaiirbk5fdkfgvb15j";
+    sha256 = "1abs3svkg9985f4jrxx34sj1dcpsf95vv1a0g01c777zgygncjnz";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];