Merge master into staging-next

maintainers/maintainer-list.nix

@@ -1905,6 +1905,12 @@
     email = "burkett.andrew@gmail.com";
     name = "Andrew Burkett";
   };
+  drewrisinger = {
+    email = "drisinger+nixpkgs@gmail.com";
+    github = "drewrisinger";
+    gitHubId = 10198051;
+    name = "Drew Risinger";
+  };
   dsferruzza = {
     email = "david.sferruzza@gmail.com";
     github = "dsferruzza";
@@ -3028,6 +3034,12 @@
     githubId = 4401220;
     name = "Michael Eden";
   };
+  ilya-fedin = {
+    email = "fedin-ilja2010@ya.ru";
+    github = "ilya-fedin";
+    githubId = 17829319;
+    name = "Ilya Fedin";
+  };
   ilya-kolpakov = {
     email = "ilya.kolpakov@gmail.com";
     github = "ilya-kolpakov";
@@ -7992,4 +8004,10 @@
     githubId = 56247270;
     name = "Foxit";
   };
+  masaeedu = {
+    email = "masaeedu@gmail.com";
+    github = "masaeedu";
+    githubId = 3674056;
+    name = "Asad Saeeduddin";
+  };
 }

nixos/doc/manual/configuration/network-manager.xml

@@ -28,17 +28,21 @@
   <command>nmtui</command> (curses-based terminal user interface). See their
   manual pages for details on their usage. Some desktop environments (GNOME,
   KDE) have their own configuration tools for NetworkManager. On XFCE, there is
-  no configuration tool for NetworkManager by default: by adding
+  no configuration tool for NetworkManager by default: by enabling <xref linkend="opt-programs.nm-applet.enable"/>, the
-  <code>networkmanagerapplet</code> to the list of system packages, the
+  graphical applet will be installed and will launch automatically when the graphical session is started.
-  graphical applet will be installed and will launch automatically when XFCE is
-  starting (and will show in the status tray).
  </para>
 
  <note>
   <para>
    <code>networking.networkmanager</code> and <code>networking.wireless</code>
-   (WPA Supplicant) cannot be enabled at the same time: you can still connect
+   (WPA Supplicant) can be used together if desired. To do this you need to instruct
-   to the wireless networks using NetworkManager.
+   NetworkManager to ignore those interfaces like:
+<programlisting>
+<xref linkend="opt-networking.networkmanager.unmanaged"/> = [
+   "*" "except:type:wwan" "except:type:gsm"
+];
+</programlisting>
+   Refer to the option description for the exact syntax and references to external documentation.
   </para>
  </note>
 </section>

nixos/doc/manual/configuration/xfce.xml

@@ -28,25 +28,14 @@
  <para>
   Some Xfce programs are not installed automatically. To install them manually
   (system wide), put them into your
-  <xref linkend="opt-environment.systemPackages"/>.
+  <xref linkend="opt-environment.systemPackages"/> from <literal>pkgs.xfce</literal>.
  </para>
- <simplesect xml:id="sec-xfce-thunar-volumes">
+ <simplesect xml:id="sec-xfce-thunar-plugins">
-  <title>Thunar Volume Support</title>
+  <title>Thunar Plugins</title>
   <para>
-   To enable <emphasis>Thunar</emphasis> volume support, put
+    If you'd like to add extra plugins to Thunar, add them to
-<programlisting>
+    <xref linkend="opt-services.xserver.desktopManager.xfce.thunarPlugins"/>.
-<xref linkend="opt-services.xserver.desktopManager.xfce.enable"/> = true;
+    You shouldn't just add them to <xref linkend="opt-environment.systemPackages"/>.
-</programlisting>
-   into your <emphasis>configuration.nix</emphasis>.
-  </para>
- </simplesect>
- <simplesect xml:id="sec-xfce-polkit">
-  <title>Polkit Authentication Agent</title>
-  <para>
-   There is no authentication agent automatically installed alongside Xfce. To
-   allow mounting of local (non-removable) filesystems, you will need to
-   install one. Installing <emphasis>polkit_gnome</emphasis>, a rebuild, logout
-   and login did the trick.
   </para>
  </simplesect>
  <simplesect xml:id="sec-xfce-troubleshooting">

nixos/doc/manual/man-nixos-option.xml

@@ -14,12 +14,16 @@
  <refsynopsisdiv>
   <cmdsynopsis>
    <command>nixos-option</command>
+
    <arg>
-    <option>-I</option> <replaceable>path</replaceable>
+    <group choice='req'>
+     <arg choice='plain'><option>-r</option></arg>
+     <arg choice='plain'><option>--recursive</option></arg>
+    </group>
    </arg>
 
    <arg>
-    <option>--all</option>
+    <option>-I</option> <replaceable>path</replaceable>
    </arg>
 
    <arg>
@@ -45,6 +49,15 @@
    This command accepts the following options:
   </para>
   <variablelist>
+   <varlistentry>
+    <term><option>-r</option></term>
+    <term><option>--recursive</option></term>
+    <listitem>
+     <para>
+      Print all the values at or below the specified path recursively.
+     </para>
+    </listitem>
+   </varlistentry>
    <varlistentry>
     <term>
      <option>-I</option> <replaceable>path</replaceable>
@@ -56,16 +69,6 @@
      </para>
     </listitem>
    </varlistentry>
-   <varlistentry>
-    <term>
-     <option>--all</option>
-    </term>
-    <listitem>
-     <para>
-      Print the values of all options.
-     </para>
-    </listitem>
-   </varlistentry>
   </variablelist>
  </refsection>
  <refsection>

nixos/doc/manual/release-notes/rl-2003.xml

@@ -23,6 +23,13 @@
      Support is planned until the end of October 2020, handing over to 20.09.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     Linux kernel is updated to branch 5.4 by default (from 4.19).
+     Users of Intel GPUs may prefer to explicitly set branch to 4.19 to avoid some regressions.
+     <programlisting>boot.kernelPackages = pkgs.linuxPackages_4_19;</programlisting>
+    </para>
+   </listitem>
    <listitem>
     <para>
      Postgresql for NixOS service now defaults to v11.
@@ -52,7 +59,7 @@
    <listitem>
     <para>
       <command>nixos-option</command> has been rewritten in C++, speeding it up, improving correctness,
-      and adding a <option>--all</option> option which prints all options and their values.
+      and adding a <option>-r</option> option which prints all options and their values recursively.
     </para>
    </listitem>
    <listitem>
@@ -96,6 +103,13 @@ services.xserver.displayManager.defaultSession = "xfce+icewm";
     via <option>services.upower</option>.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     To use Geary you should enable <xref linkend="opt-programs.geary.enable"/> instead of
+     just adding it to <xref linkend="opt-environment.systemPackages"/>.
+     It was created so Geary could function properly outside of GNOME.
+    </para>
+   </listitem>
   </itemizedlist>
 
  </section>
@@ -536,6 +550,33 @@ auth required pam_succeed_if.so uid >= 1000 quiet
        </listitem>
      </itemizedlist>
    </listitem>
+   <listitem>
+    <para>The LLVM versions 3.5, 3.9 and 4 (including the corresponding CLang versions) have been dropped.</para>
+   </listitem>
+   <listitem>
+    <para>
+     The <option>networking.interfaces.*.preferTempAddress</option> option has
+     been replaced by <option>networking.interfaces.*.tempAddress</option>.
+     The new option allows better control of the IPv6 temporary addresses,
+     including completely disabling them for interfaces where they are not
+     needed.
+    </para>
+   </listitem>
+   <listitem>
+     <para>
+       Rspamd was updated to version 2.2. Read
+       <link xlink:href="https://rspamd.com/doc/migration.html#migration-to-rspamd-20">
+       the upstream migration notes</link> carefully. Please be especially
+       aware that some modules were removed and the default Bayes backend is
+       now Redis.
+     </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <literal>*psu</literal> versions of <package>oraclejdk8</package> have been removed
+     as they aren't provided by upstream anymore.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 

nixos/lib/qemu-flags.nix

@@ -17,9 +17,9 @@ in
         else throw "Unknown QEMU serial device for system '${pkgs.stdenv.hostPlatform.system}'";
 
   qemuBinary = qemuPkg: {
-    x86_64-linux = "${qemuPkg}/bin/qemu-kvm -cpu kvm64";
+    x86_64-linux = "${qemuPkg}/bin/qemu-kvm -cpu host";
     armv7l-linux = "${qemuPkg}/bin/qemu-system-arm -enable-kvm -machine virt -cpu host";
     aarch64-linux = "${qemuPkg}/bin/qemu-system-aarch64 -enable-kvm -machine virt,gic-version=host -cpu host";
-    x86_64-darwin = "${qemuPkg}/bin/qemu-kvm -cpu kvm64";
+    x86_64-darwin = "${qemuPkg}/bin/qemu-kvm -cpu host";
   }.${pkgs.stdenv.hostPlatform.system} or "${qemuPkg}/bin/qemu-kvm";
 }

nixos/modules/installer/tools/nixos-option/nixos-option.cc

@@ -131,12 +131,12 @@ bool isOption(Context & ctx, const Value & v)
     if (v.type != tAttrs) {
         return false;
     }
-    const auto & atualType = v.attrs->find(ctx.underscoreType);
+    const auto & actualType = v.attrs->find(ctx.underscoreType);
-    if (atualType == v.attrs->end()) {
+    if (actualType == v.attrs->end()) {
         return false;
     }
     try {
-        Value evaluatedType = evaluateValue(ctx, *atualType->value);
+        Value evaluatedType = evaluateValue(ctx, *actualType->value);
         if (evaluatedType.type != tString) {
             return false;
         }
@@ -197,9 +197,107 @@ void recurse(const std::function<bool(const std::string & path, std::variant<Val
     }
 }
 
-// Calls f on all the option names
+bool optionTypeIs(Context & ctx, Value & v, const std::string & soughtType)
-void mapOptions(const std::function<void(const std::string & path)> & f, Context & ctx, Value root)
 {
+    try {
+        const auto & typeLookup = v.attrs->find(ctx.state.sType);
+        if (typeLookup == v.attrs->end()) {
+            return false;
+        }
+        Value type = evaluateValue(ctx, *typeLookup->value);
+        if (type.type != tAttrs) {
+            return false;
+        }
+        const auto & nameLookup = type.attrs->find(ctx.state.sName);
+        if (nameLookup == type.attrs->end()) {
+            return false;
+        }
+        Value name = evaluateValue(ctx, *nameLookup->value);
+        if (name.type != tString) {
+            return false;
+        }
+        return name.string.s == soughtType;
+    } catch (Error &) {
+        return false;
+    }
+}
+
+bool isAggregateOptionType(Context & ctx, Value & v)
+{
+    return optionTypeIs(ctx, v, "attrsOf") || optionTypeIs(ctx, v, "listOf") || optionTypeIs(ctx, v, "loaOf");
+}
+
+MakeError(OptionPathError, EvalError);
+
+Value getSubOptions(Context & ctx, Value & option)
+{
+    Value getSubOptions = evaluateValue(ctx, *findAlongAttrPath(ctx.state, "type.getSubOptions", ctx.autoArgs, option));
+    if (getSubOptions.type != tLambda) {
+        throw OptionPathError("Option's type.getSubOptions isn't a function");
+    }
+    Value emptyString{};
+    nix::mkString(emptyString, "");
+    Value v;
+    ctx.state.callFunction(getSubOptions, emptyString, v, nix::Pos{});
+    return v;
+}
+
+// Carefully walk an option path, looking for sub-options when a path walks past
+// an option value.
+struct FindAlongOptionPathRet
+{
+    Value option;
+    std::string path;
+};
+FindAlongOptionPathRet findAlongOptionPath(Context & ctx, const std::string & path)
+{
+    Strings tokens = parseAttrPath(path);
+    Value v = ctx.optionsRoot;
+    std::string processedPath;
+    for (auto i = tokens.begin(); i != tokens.end(); i++) {
+        const auto & attr = *i;
+        try {
+            bool lastAttribute = std::next(i) == tokens.end();
+            v = evaluateValue(ctx, v);
+            if (attr.empty()) {
+                throw OptionPathError("empty attribute name");
+            }
+            if (isOption(ctx, v) && optionTypeIs(ctx, v, "submodule")) {
+                v = getSubOptions(ctx, v);
+            }
+            if (isOption(ctx, v) && isAggregateOptionType(ctx, v)) {
+                auto subOptions = getSubOptions(ctx, v);
+                if (lastAttribute && subOptions.attrs->empty()) {
+                    break;
+                }
+                v = subOptions;
+                // Note that we've consumed attr, but didn't actually use it.  This is the path component that's looked
+                // up in the list or attribute set that doesn't name an option -- the "root" in "users.users.root.name".
+            } else if (v.type != tAttrs) {
+                throw OptionPathError("Value is %s while a set was expected", showType(v));
+            } else {
+                const auto & next = v.attrs->find(ctx.state.symbols.create(attr));
+                if (next == v.attrs->end()) {
+                    throw OptionPathError("Attribute not found", attr, path);
+                }
+                v = *next->value;
+            }
+            processedPath = appendPath(processedPath, attr);
+        } catch (OptionPathError & e) {
+            throw OptionPathError("At '%s' in path '%s': %s", attr, path, e.msg());
+        }
+    }
+    return {v, processedPath};
+}
+
+// Calls f on all the option names at or below the option described by `path`.
+// Note that "the option described by `path`" is not trivial -- if path describes a value inside an aggregate
+// option (such as users.users.root), the *option* described by that path is one path component shorter
+// (eg: users.users), which results in f being called on sibling-paths (eg: users.users.nixbld1).  If f
+// doesn't want these, it must do its own filtering.
+void mapOptions(const std::function<void(const std::string & path)> & f, Context & ctx, const std::string & path)
+{
+    auto root = findAlongOptionPath(ctx, path);
     recurse(
         [f, &ctx](const std::string & path, std::variant<Value, std::exception_ptr> v) {
             bool isOpt = std::holds_alternative<std::exception_ptr>(v) || isOption(ctx, std::get<Value>(v));
@@ -208,7 +306,7 @@ void mapOptions(const std::function<void(const std::string & path)> & f, Context
             }
             return !isOpt;
         },
-        ctx, root, "");
+        ctx, root.option, root.path);
 }
 
 // Calls f on all the config values inside one option.
@@ -294,11 +392,13 @@ void printAttrs(Context & ctx, Out & out, Value & v, const std::string & path)
     Out attrsOut(out, "{", "}", v.attrs->size());
     for (const auto & a : v.attrs->lexicographicOrder()) {
         std::string name = a->name;
+        if (!forbiddenRecursionName(name)) {
             attrsOut << name << " = ";
             printValue(ctx, attrsOut, *a->value, appendPath(path, name));
             attrsOut << ";" << Out::sep;
         }
     }
+}
 
 void multiLineStringEscape(Out & out, const std::string & s)
 {
@@ -380,17 +480,26 @@ void printConfigValue(Context & ctx, Out & out, const std::string & path, std::v
     out << ";\n";
 }
 
-void printAll(Context & ctx, Out & out)
+// Replace with std::starts_with when C++20 is available
+bool starts_with(const std::string & s, const std::string & prefix)
+{
+    return s.size() >= prefix.size() &&
+           std::equal(s.begin(), std::next(s.begin(), prefix.size()), prefix.begin(), prefix.end());
+}
+
+void printRecursive(Context & ctx, Out & out, const std::string & path)
 {
     mapOptions(
-        [&ctx, &out](const std::string & optionPath) {
+        [&ctx, &out, &path](const std::string & optionPath) {
             mapConfigValuesInOption(
-                [&ctx, &out](const std::string & configPath, std::variant<Value, std::exception_ptr> v) {
+                [&ctx, &out, &path](const std::string & configPath, std::variant<Value, std::exception_ptr> v) {
+                    if (starts_with(configPath, path)) {
                         printConfigValue(ctx, out, configPath, v);
+                    }
                 },
                 optionPath, ctx);
         },
-        ctx, ctx.optionsRoot);
+        ctx, path);
 }
 
 void printAttr(Context & ctx, Out & out, const std::string & path, Value & root)
@@ -450,95 +559,17 @@ void printListing(Out & out, Value & v)
     }
 }
 
-bool optionTypeIs(Context & ctx, Value & v, const std::string & soughtType)
-{
-    try {
-        const auto & typeLookup = v.attrs->find(ctx.state.sType);
-        if (typeLookup == v.attrs->end()) {
-            return false;
-        }
-        Value type = evaluateValue(ctx, *typeLookup->value);
-        if (type.type != tAttrs) {
-            return false;
-        }
-        const auto & nameLookup = type.attrs->find(ctx.state.sName);
-        if (nameLookup == type.attrs->end()) {
-            return false;
-        }
-        Value name = evaluateValue(ctx, *nameLookup->value);
-        if (name.type != tString) {
-            return false;
-        }
-        return name.string.s == soughtType;
-    } catch (Error &) {
-        return false;
-    }
-}
-
-bool isAggregateOptionType(Context & ctx, Value & v)
-{
-    return optionTypeIs(ctx, v, "attrsOf") || optionTypeIs(ctx, v, "listOf") || optionTypeIs(ctx, v, "loaOf");
-}
-
-MakeError(OptionPathError, EvalError);
-
-Value getSubOptions(Context & ctx, Value & option)
-{
-    Value getSubOptions = evaluateValue(ctx, *findAlongAttrPath(ctx.state, "type.getSubOptions", ctx.autoArgs, option));
-    if (getSubOptions.type != tLambda) {
-        throw OptionPathError("Option's type.getSubOptions isn't a function");
-    }
-    Value emptyString{};
-    nix::mkString(emptyString, "");
-    Value v;
-    ctx.state.callFunction(getSubOptions, emptyString, v, nix::Pos{});
-    return v;
-}
-
-// Carefully walk an option path, looking for sub-options when a path walks past
-// an option value.
-Value findAlongOptionPath(Context & ctx, const std::string & path)
-{
-    Strings tokens = parseAttrPath(path);
-    Value v = ctx.optionsRoot;
-    for (auto i = tokens.begin(); i != tokens.end(); i++) {
-        const auto & attr = *i;
-        try {
-            bool lastAttribute = std::next(i) == tokens.end();
-            v = evaluateValue(ctx, v);
-            if (attr.empty()) {
-                throw OptionPathError("empty attribute name");
-            }
-            if (isOption(ctx, v) && optionTypeIs(ctx, v, "submodule")) {
-                v = getSubOptions(ctx, v);
-            }
-            if (isOption(ctx, v) && isAggregateOptionType(ctx, v) && !lastAttribute) {
-                v = getSubOptions(ctx, v);
-                // Note that we've consumed attr, but didn't actually use it.  This is the path component that's looked
-                // up in the list or attribute set that doesn't name an option -- the "root" in "users.users.root.name".
-            } else if (v.type != tAttrs) {
-                throw OptionPathError("Value is %s while a set was expected", showType(v));
-            } else {
-                const auto & next = v.attrs->find(ctx.state.symbols.create(attr));
-                if (next == v.attrs->end()) {
-                    throw OptionPathError("Attribute not found", attr, path);
-                }
-                v = *next->value;
-            }
-        } catch (OptionPathError & e) {
-            throw OptionPathError("At '%s' in path '%s': %s", attr, path, e.msg());
-        }
-    }
-    return v;
-}
-
 void printOne(Context & ctx, Out & out, const std::string & path)
 {
     try {
-        Value option = findAlongOptionPath(ctx, path);
+        auto result = findAlongOptionPath(ctx, path);
+        Value & option = result.option;
         option = evaluateValue(ctx, option);
+        if (path != result.path) {
+            out << "Note: showing " << result.path << " instead of " << path << "\n";
+        }
         if (isOption(ctx, option)) {
-            printOption(ctx, out, path, option);
+            printOption(ctx, out, result.path, option);
         } else {
             printListing(out, option);
         }
@@ -552,7 +583,7 @@ void printOne(Context & ctx, Out & out, const std::string & path)
 
 int main(int argc, char ** argv)
 {
-    bool all = false;
+    bool recursive = false;
     std::string path = ".";
     std::string optionsExpr = "(import <nixpkgs/nixos> {}).options";
     std::string configExpr = "(import <nixpkgs/nixos> {}).config";
@@ -568,8 +599,8 @@ int main(int argc, char ** argv)
             nix::showManPage("nixos-option");
         } else if (*arg == "--version") {
             nix::printVersion("nixos-option");
-        } else if (*arg == "--all") {
+        } else if (*arg == "-r" || *arg == "--recursive") {
-            all = true;
+            recursive = true;
         } else if (*arg == "--path") {
             path = nix::getArg(*arg, arg, end);
         } else if (*arg == "--options_expr") {
@@ -598,18 +629,12 @@ int main(int argc, char ** argv)
     Context ctx{*state, *myArgs.getAutoArgs(*state), optionsRoot, configRoot};
     Out out(std::cout);
 
-    if (all) {
+    auto print = recursive ? printRecursive : printOne;
-        if (!args.empty()) {
-            throw UsageError("--all cannot be used with arguments");
-        }
-        printAll(ctx, out);
-    } else {
     if (args.empty()) {
-            printOne(ctx, out, "");
+        print(ctx, out, "");
     }
     for (const auto & arg : args) {
-            printOne(ctx, out, arg);
+        print(ctx, out, arg);
-        }
     }
 
     ctx.state.printStats();

nixos/modules/installer/tools/nixos-rebuild.sh

@@ -91,9 +91,7 @@ while [ "$#" -gt 0 ]; do
         shift 1
         ;;
       --use-remote-sudo)
-        # note the trailing space
         maybeSudo=(sudo --)
-        shift 1
         ;;
       *)
         echo "$0: unknown option \`$i'"

nixos/modules/misc/locate.nix

@@ -131,13 +131,6 @@ in {
             ++ optional (isFindutils && cfg.pruneNames != []) "findutils locate does not support pruning by directory component"
             ++ optional (isFindutils && cfg.pruneBindMounts) "findutils locate does not support skipping bind mounts";
 
-    # directory creation needs to be separated from main service
-    # because ReadWritePaths fails when the directory doesn't already exist
-    systemd.tmpfiles.rules =
-      let dir = dirOf cfg.output; in
-      mkIf (dir != "/var/cache")
-        [ "d ${dir} 0755 root root -" ];
-
     systemd.services.update-locatedb =
       { description = "Update Locate Database";
         path = mkIf (!isMLocate) [ pkgs.su ];

nixos/modules/security/duosec.nix

@@ -12,7 +12,7 @@ let
     ikey=${cfg.ikey}
     skey=${cfg.skey}
     host=${cfg.host}
-    ${optionalString (cfg.group != "") ("group="+cfg.group)}
+    ${optionalString (cfg.groups != "") ("groups="+cfg.groups)}
     failmode=${cfg.failmode}
     pushinfo=${boolToStr cfg.pushinfo}
     autopush=${boolToStr cfg.autopush}
@@ -42,6 +42,10 @@ let
   };
 in
 {
+  imports = [
+    (mkRenamedOptionModule [ "security" "duosec" "group" ] [ "security" "duosec" "groups" ])
+  ];
+
   options = {
     security.duosec = {
       ssh.enable = mkOption {
@@ -71,10 +75,16 @@ in
         description = "Duo API hostname.";
       };
 
-      group = mkOption {
+      groups = mkOption {
         type = types.str;
         default = "";
-        description = "Use Duo authentication for users only in this group.";
+        example = "users,!wheel,!*admin guests";
+        description = ''
+          If specified, Duo authentication is required only for users
+          whose primary group or supplementary group list matches one
+          of the space-separated pattern lists. Refer to
+          <link xlink:href="https://duo.com/docs/duounix"/> for details.
+        '';
       };
 
       failmode = mkOption {

nixos/modules/services/development/jupyter/default.nix

@@ -118,15 +118,15 @@ in {
           in {
             displayName = "Python 3 for machine learning";
             argv = [
-              "$ {env.interpreter}"
+              "''${env.interpreter}"
               "-m"
               "ipykernel_launcher"
               "-f"
               "{connection_file}"
             ];
             language = "python";
-            logo32 = "$ {env.sitePackages}/ipykernel/resources/logo-32x32.png";
+            logo32 = "''${env.sitePackages}/ipykernel/resources/logo-32x32.png";
-            logo64 = "$ {env.sitePackages}/ipykernel/resources/logo-64x64.png";
+            logo64 = "''${env.sitePackages}/ipykernel/resources/logo-64x64.png";
           };
         }
       '';

nixos/modules/services/monitoring/nagios.nix

@@ -154,7 +154,7 @@ in
       };
 
       virtualHost = mkOption {
-        type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+        type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
         example = literalExample ''
           { hostName = "example.org";
             adminAddr = "webmaster@example.org";

nixos/modules/services/networking/nsd.nix

@@ -244,7 +244,7 @@ let
       };
 
       data = mkOption {
-        type = types.str;
+        type = types.lines;
         default = "";
         example = "";
         description = ''
@@ -484,7 +484,7 @@ in
     };
 
     extraConfig = mkOption {
-      type = types.str;
+      type = types.lines;
       default = "";
       description = ''
         Extra nsd config.

nixos/modules/services/security/fail2ban.nix

@@ -6,15 +6,32 @@ let
 
   cfg = config.services.fail2ban;
 
-  fail2banConf = pkgs.writeText "fail2ban.conf" cfg.daemonConfig;
+  fail2banConf = pkgs.writeText "fail2ban.local" cfg.daemonConfig;
 
-  jailConf = pkgs.writeText "jail.conf"
+  jailConf = pkgs.writeText "jail.local" ''
-    (concatStringsSep "\n" (attrValues (flip mapAttrs cfg.jails (name: def:
+    [INCLUDES]
+
+    before = paths-nixos.conf
+
+    ${concatStringsSep "\n" (attrValues (flip mapAttrs cfg.jails (name: def:
       optionalString (def != "")
         ''
           [${name}]
           ${def}
-        ''))));
+        '')))}
+  '';
+
+  pathsConf = pkgs.writeText "paths-nixos.conf" ''
+    # NixOS
+
+    [INCLUDES]
+
+    before = paths-common.conf
+
+    after  = paths-overrides.local
+
+    [DEFAULT]
+  '';
 
 in
 
@@ -31,18 +48,132 @@ in
         description = "Whether to enable the fail2ban service.";
       };
 
+      package = mkOption {
+        default = pkgs.fail2ban;
+        type = types.package;
+        example = "pkgs.fail2ban_0_11";
+        description = "The fail2ban package to use for running the fail2ban service.";
+      };
+
+      packageFirewall = mkOption {
+        default = pkgs.iptables;
+        type = types.package;
+        example = "pkgs.nftables";
+        description = "The firewall package used by fail2ban service.";
+      };
+
+      banaction = mkOption {
+        default = "iptables-multiport";
+        type = types.str;
+        example = "nftables-multiport";
+        description = ''
+          Default banning action (e.g. iptables, iptables-new, iptables-multiport,
+          shorewall, etc) It is used to define action_* variables. Can be overridden
+          globally or per section within jail.local file
+        '';
+      };
+
+      banaction-allports = mkOption {
+        default = "iptables-allport";
+        type = types.str;
+        example = "nftables-allport";
+        description = ''
+          Default banning action (e.g. iptables, iptables-new, iptables-multiport,
+          shorewall, etc) It is used to define action_* variables. Can be overridden
+          globally or per section within jail.local file
+        '';
+      };
+
+      bantime-increment.enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Allows to use database for searching of previously banned ip's to increase
+          a default ban time using special formula, default it is banTime * 1, 2, 4, 8, 16, 32...
+        '';
+      };
+
+      bantime-increment.rndtime = mkOption {
+        default = "4m";
+        type = types.str;
+        example = "8m";
+        description = ''
+          "bantime-increment.rndtime" is the max number of seconds using for mixing with random time
+          to prevent "clever" botnets calculate exact time IP can be unbanned again
+        '';
+      };
+
+      bantime-increment.maxtime = mkOption {
+        default = "10h";
+        type = types.str;
+        example = "48h";
+        description = ''
+          "bantime-increment.maxtime" is the max number of seconds using the ban time can reach (don't grows further)
+        '';
+      };
+
+      bantime-increment.factor = mkOption {
+        default = "1";
+        type = types.str;
+        example = "4";
+        description = ''
+          "bantime-increment.factor" is a coefficient to calculate exponent growing of the formula or common multiplier,
+          default value of factor is 1 and with default value of formula, the ban time grows by 1, 2, 4, 8, 16 ...
+        '';
+      };
+
+      bantime-increment.formula = mkOption {
+        default = "ban.Time * (1<<(ban.Count if ban.Count<20 else 20)) * banFactor";
+        type = types.str;
+        example = "ban.Time * math.exp(float(ban.Count+1)*banFactor)/math.exp(1*banFactor)";
+        description = ''
+          "bantime-increment.formula" used by default to calculate next value of ban time, default value bellow,
+          the same ban time growing will be reached by multipliers 1, 2, 4, 8, 16, 32...
+        '';
+      };
+
+      bantime-increment.multipliers = mkOption {
+        default = "1 2 4 8 16 32 64";
+        type = types.str;
+        example = "2 4 16 128";
+        description = ''
+          "bantime-increment.multipliers" used to calculate next value of ban time instead of formula, coresponding
+          previously ban count and given "bantime.factor" (for multipliers default is 1);
+          following example grows ban time by 1, 2, 4, 8, 16 ... and if last ban count greater as multipliers count,
+          always used last multiplier (64 in example), for factor '1' and original ban time 600 - 10.6 hours
+        '';
+      };
+
+      bantime-increment.overalljails = mkOption {
+        default = false;
+        type = types.bool;
+        example = true;
+        description = ''
+          "bantime-increment.overalljails"  (if true) specifies the search of IP in the database will be executed
+          cross over all jails, if false (dafault), only current jail of the ban IP will be searched
+        '';
+      };
+
+      ignoreIP = mkOption {
+        default = [ ];
+        type = types.listOf types.str;
+        example = [ "192.168.0.0/16" "2001:DB8::42" ];
+        description = ''
+          "ignoreIP" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban will not ban a host which
+          matches an address in this list. Several addresses can be defined using space (and/or comma) separator.
+        '';
+      };
+
       daemonConfig = mkOption {
-        default =
+        default = ''
-          ''
           [Definition]
-            loglevel  = INFO
           logtarget = SYSLOG
           socket    = /run/fail2ban/fail2ban.sock
           pidfile   = /run/fail2ban/fail2ban.pid
+          dbfile    = /var/lib/fail2ban/fail2ban.sqlite3
         '';
         type = types.lines;
-        description =
+        description = ''
-          ''
           The contents of Fail2ban's main configuration file.  It's
           generally not necessary to change it.
        '';
@@ -65,8 +196,7 @@ in
           }
         '';
         type = types.attrsOf types.lines;
-        description =
+        description = ''
-          ''
           The configuration of each Fail2ban “jail”.  A jail
           consists of an action (such as blocking a port using
           <command>iptables</command>) that is triggered when a
@@ -82,71 +212,91 @@ in
 
   };
 
-
   ###### implementation
 
   config = mkIf cfg.enable {
 
-    environment.systemPackages = [ pkgs.fail2ban ];
+    environment.systemPackages = [ cfg.package ];
 
-    environment.etc."fail2ban/fail2ban.conf".source = fail2banConf;
+    environment.etc = {
-    environment.etc."fail2ban/jail.conf".source = jailConf;
+      "fail2ban/fail2ban.local".source = fail2banConf;
-    environment.etc."fail2ban/action.d".source = "${pkgs.fail2ban}/etc/fail2ban/action.d/*.conf";
+      "fail2ban/jail.local".source = jailConf;
-    environment.etc."fail2ban/filter.d".source = "${pkgs.fail2ban}/etc/fail2ban/filter.d/*.conf";
+      "fail2ban/fail2ban.conf".source = "${cfg.package}/etc/fail2ban/fail2ban.conf";
+      "fail2ban/jail.conf".source = "${cfg.package}/etc/fail2ban/jail.conf";
+      "fail2ban/paths-common.conf".source = "${cfg.package}/etc/fail2ban/paths-common.conf";
+      "fail2ban/paths-nixos.conf".source = pathsConf;
+      "fail2ban/action.d".source = "${cfg.package}/etc/fail2ban/action.d/*.conf";
+      "fail2ban/filter.d".source = "${cfg.package}/etc/fail2ban/filter.d/*.conf";
+    };
 
-    systemd.services.fail2ban =
+    systemd.services.fail2ban = {
-      { description = "Fail2ban Intrusion Prevention System";
+      description = "Fail2ban Intrusion Prevention System";
 
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
       partOf = optional config.networking.firewall.enable "firewall.service";
 
-        restartTriggers = [ fail2banConf jailConf ];
+      restartTriggers = [ fail2banConf jailConf pathsConf ];
-        path = [ pkgs.fail2ban pkgs.iptables pkgs.iproute ];
+      reloadIfChanged = true;
 
-        preStart =
+      path = [ cfg.package cfg.packageFirewall pkgs.iproute ];
-          ''
-            mkdir -p /var/lib/fail2ban
-          '';
 
       unitConfig.Documentation = "man:fail2ban(1)";
 
-        serviceConfig =
+      serviceConfig = {
-          { Type = "forking";
+        ExecStart = "${cfg.package}/bin/fail2ban-server -xf start";
-            ExecStart = "${pkgs.fail2ban}/bin/fail2ban-client -x start";
+        ExecStop = "${cfg.package}/bin/fail2ban-server stop";
-            ExecStop = "${pkgs.fail2ban}/bin/fail2ban-client stop";
+        ExecReload = "${cfg.package}/bin/fail2ban-server reload";
-            ExecReload = "${pkgs.fail2ban}/bin/fail2ban-client reload";
+        Type = "simple";
+        Restart = "on-failure";
         PIDFile = "/run/fail2ban/fail2ban.pid";
-            Restart = "always";
+        # Capabilities
-
+        CapabilityBoundingSet = [ "CAP_AUDIT_READ" "CAP_DAC_READ_SEARCH" "CAP_NET_ADMIN" "CAP_NET_RAW" ];
-            ReadOnlyDirectories = "/";
+        # Security
-            ReadWriteDirectories = "/run/fail2ban /var/tmp /var/lib";
+        NoNewPrivileges = true;
-            PrivateTmp = "true";
+        # Directory
         RuntimeDirectory = "fail2ban";
-            CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW";
+        RuntimeDirectoryMode = "0750";
+        StateDirectory = "fail2ban";
+        StateDirectoryMode = "0750";
+        LogsDirectory = "fail2ban";
+        LogsDirectoryMode = "0750";
+        # Sandboxing
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHostname = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
       };
     };
 
     # Add some reasonable default jails.  The special "DEFAULT" jail
     # sets default values for all other jails.
-    services.fail2ban.jails.DEFAULT =
+    services.fail2ban.jails.DEFAULT = ''
-      ''
+      ${optionalString cfg.bantime-increment.enable ''
-        ignoreip = 127.0.0.1/8
+        # Bantime incremental
-        bantime  = 600
+        bantime.increment    = ${if cfg.bantime-increment.enable then "true" else "false"}
-        findtime = 600
+        bantime.maxtime      = ${cfg.bantime-increment.maxtime}
+        bantime.factor       = ${cfg.bantime-increment.factor}
+        bantime.formula      = ${cfg.bantime-increment.formula}
+        bantime.multipliers  = ${cfg.bantime-increment.multipliers}
+        bantime.overalljails = ${if cfg.bantime-increment.overalljails then "true" else "false"}
+      ''}
+      # Miscellaneous options
+      ignoreip    = 127.0.0.1/8 ${optionalString config.networking.enableIPv6 "::1"} ${concatStringsSep " " cfg.ignoreIP}
       maxretry    = 3
       backend     = systemd
-        enabled  = true
+      # Actions
+      banaction   = ${cfg.banaction}
+      banaction_allports = ${cfg.banaction-allports}
     '';
-
     # Block SSH if there are too many failing connection attempts.
-    services.fail2ban.jails.ssh-iptables =
+    services.fail2ban.jails.sshd = mkDefault ''
-      ''
+      enabled = true
-        filter   = sshd
+      port    = ${concatMapStringsSep "," (p: toString p) config.services.openssh.ports}
-        action   = iptables-multiport[name=SSH, port="${concatMapStringsSep "," (p: toString p) config.services.openssh.ports}", protocol=tcp]
-        maxretry = 5
     '';
-
   };
-
 }

nixos/modules/services/web-apps/limesurvey.nix

@@ -100,7 +100,7 @@ in
     };
 
     virtualHost = mkOption {
-      type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+      type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
       example = literalExample ''
         {
           hostName = "survey.example.org";

nixos/modules/services/web-apps/mediawiki.nix

@@ -290,7 +290,7 @@ in
       };
 
       virtualHost = mkOption {
-        type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+        type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
         example = literalExample ''
           {
             hostName = "mediawiki.example.org";

nixos/modules/services/web-apps/moodle.nix

@@ -140,7 +140,7 @@ in
     };
 
     virtualHost = mkOption {
-      type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+      type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
       example = literalExample ''
         {
           hostName = "moodle.example.org";

nixos/modules/services/web-apps/wordpress.nix

@@ -209,7 +209,7 @@ let
         };
 
         virtualHost = mkOption {
-          type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+          type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
           example = literalExample ''
             {
               adminAddr = "webmaster@example.org";

nixos/modules/services/web-apps/zabbix.nix

@@ -113,7 +113,7 @@ in
       };
 
       virtualHost = mkOption {
-        type = types.submodule (import ../web-servers/apache-httpd/per-server-options.nix);
+        type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
         example = literalExample ''
           {
             hostName = "zabbix.example.org";

nixos/modules/services/web-servers/apache-httpd/default.nix

@@ -4,21 +4,21 @@ with lib;
 
 let
 
-  mainCfg = config.services.httpd;
+  cfg = config.services.httpd;
 
   runtimeDir = "/run/httpd";
 
-  httpd = mainCfg.package.out;
+  pkg = cfg.package.out;
 
-  httpdConf = mainCfg.configFile;
+  httpdConf = cfg.configFile;
 
-  php = mainCfg.phpPackage.override { apacheHttpd = httpd.dev; /* otherwise it only gets .out */ };
+  php = cfg.phpPackage.override { apacheHttpd = pkg.dev; /* otherwise it only gets .out */ };
 
   phpMajorVersion = lib.versions.major (lib.getVersion php);
 
-  mod_perl = pkgs.apacheHttpdPackages.mod_perl.override { apacheHttpd = httpd; };
+  mod_perl = pkgs.apacheHttpdPackages.mod_perl.override { apacheHttpd = pkg; };
 
-  vhosts = attrValues mainCfg.virtualHosts;
+  vhosts = attrValues cfg.virtualHosts;
 
   mkListenInfo = hostOpts:
     if hostOpts.listen != [] then hostOpts.listen
@@ -41,23 +41,18 @@ let
       "mime" "autoindex" "negotiation" "dir"
       "alias" "rewrite"
       "unixd" "slotmem_shm" "socache_shmcb"
-      "mpm_${mainCfg.multiProcessingModule}"
+      "mpm_${cfg.multiProcessingModule}"
     ]
-    ++ (if mainCfg.multiProcessingModule == "prefork" then [ "cgi" ] else [ "cgid" ])
+    ++ (if cfg.multiProcessingModule == "prefork" then [ "cgi" ] else [ "cgid" ])
     ++ optional enableSSL "ssl"
     ++ optional enableUserDir "userdir"
-    ++ optional mainCfg.enableMellon { name = "auth_mellon"; path = "${pkgs.apacheHttpdPackages.mod_auth_mellon}/modules/mod_auth_mellon.so"; }
+    ++ optional cfg.enableMellon { name = "auth_mellon"; path = "${pkgs.apacheHttpdPackages.mod_auth_mellon}/modules/mod_auth_mellon.so"; }
-    ++ optional mainCfg.enablePHP { name = "php${phpMajorVersion}"; path = "${php}/modules/libphp${phpMajorVersion}.so"; }
+    ++ optional cfg.enablePHP { name = "php${phpMajorVersion}"; path = "${php}/modules/libphp${phpMajorVersion}.so"; }
-    ++ optional mainCfg.enablePerl { name = "perl"; path = "${mod_perl}/modules/mod_perl.so"; }
+    ++ optional cfg.enablePerl { name = "perl"; path = "${mod_perl}/modules/mod_perl.so"; }
-    ++ mainCfg.extraModules;
+    ++ cfg.extraModules;
 
-
+  loggingConf = (if cfg.logFormat != "none" then ''
-  allDenied = "Require all denied";
+    ErrorLog ${cfg.logDir}/error.log
-  allGranted = "Require all granted";
-
-
-  loggingConf = (if mainCfg.logFormat != "none" then ''
-    ErrorLog ${mainCfg.logDir}/error.log
 
     LogLevel notice
 
@@ -66,7 +61,7 @@ let
     LogFormat "%{Referer}i -> %U" referer
     LogFormat "%{User-agent}i" agent
 
-    CustomLog ${mainCfg.logDir}/access.log ${mainCfg.logFormat}
+    CustomLog ${cfg.logDir}/access.log ${cfg.logFormat}
   '' else ''
     ErrorLog /dev/null
   '');
@@ -88,6 +83,7 @@ let
 
 
   sslConf = ''
+    <IfModule mod_ssl.c>
         SSLSessionCache shmcb:${runtimeDir}/ssl_scache(512000)
 
         Mutex posixsem
@@ -95,27 +91,28 @@ let
         SSLRandomSeed startup builtin
         SSLRandomSeed connect builtin
 
-    SSLProtocol ${mainCfg.sslProtocols}
+        SSLProtocol ${cfg.sslProtocols}
-    SSLCipherSuite ${mainCfg.sslCiphers}
+        SSLCipherSuite ${cfg.sslCiphers}
         SSLHonorCipherOrder on
+    </IfModule>
   '';
 
 
   mimeConf = ''
-    TypesConfig ${httpd}/conf/mime.types
+    TypesConfig ${pkg}/conf/mime.types
 
     AddType application/x-x509-ca-cert .crt
     AddType application/x-pkcs7-crl    .crl
     AddType application/x-httpd-php    .php .phtml
 
     <IfModule mod_mime_magic.c>
-        MIMEMagicFile ${httpd}/conf/magic
+        MIMEMagicFile ${pkg}/conf/magic
     </IfModule>
   '';
 
   mkVHostConf = hostOpts:
     let
-      adminAddr = if hostOpts.adminAddr != null then hostOpts.adminAddr else mainCfg.adminAddr;
+      adminAddr = if hostOpts.adminAddr != null then hostOpts.adminAddr else cfg.adminAddr;
       listen = filter (listen: !listen.ssl) (mkListenInfo hostOpts);
       listenSSL = filter (listen: listen.ssl) (mkListenInfo hostOpts);
 
@@ -203,9 +200,9 @@ let
       '') (sortProperties (mapAttrsToList (k: v: v // { location = k; }) locations)));
     in
       ''
-        ${optionalString mainCfg.logPerVirtualHost ''
+        ${optionalString cfg.logPerVirtualHost ''
-          ErrorLog ${mainCfg.logDir}/error-${hostOpts.hostName}.log
+          ErrorLog ${cfg.logDir}/error-${hostOpts.hostName}.log
-          CustomLog ${mainCfg.logDir}/access-${hostOpts.hostName}.log ${hostOpts.logFormat}
+          CustomLog ${cfg.logDir}/access-${hostOpts.hostName}.log ${hostOpts.logFormat}
         ''}
 
         ${optionalString (hostOpts.robotsEntries != "") ''
@@ -217,7 +214,7 @@ let
         <Directory "${documentRoot}">
             Options Indexes FollowSymLinks
             AllowOverride None
-            ${allGranted}
+            Require all granted
         </Directory>
 
         ${optionalString hostOpts.enableUserDir ''
@@ -244,7 +241,7 @@ let
                 Alias ${elem.urlPath} ${elem.dir}/
                 <Directory ${elem.dir}>
                     Options +Indexes
-                    ${allGranted}
+                    Require all granted
                     AllowOverride All
                 </Directory>
               '';
@@ -259,20 +256,20 @@ let
 
   confFile = pkgs.writeText "httpd.conf" ''
 
-    ServerRoot ${httpd}
+    ServerRoot ${pkg}
     ServerName ${config.networking.hostName}
     DefaultRuntimeDir ${runtimeDir}/runtime
 
     PidFile ${runtimeDir}/httpd.pid
 
-    ${optionalString (mainCfg.multiProcessingModule != "prefork") ''
+    ${optionalString (cfg.multiProcessingModule != "prefork") ''
       # mod_cgid requires this.
       ScriptSock ${runtimeDir}/cgisock
     ''}
 
     <IfModule prefork.c>
-        MaxClients           ${toString mainCfg.maxClients}
+        MaxClients           ${toString cfg.maxClients}
-        MaxRequestsPerChild  ${toString mainCfg.maxRequestsPerChild}
+        MaxRequestsPerChild  ${toString cfg.maxRequestsPerChild}
     </IfModule>
 
     ${let
@@ -281,12 +278,12 @@ let
       in concatStringsSep "\n" uniqueListen
     }
 
-    User ${mainCfg.user}
+    User ${cfg.user}
-    Group ${mainCfg.group}
+    Group ${cfg.group}
 
     ${let
         mkModule = module:
-          if isString module then { name = module; path = "${httpd}/modules/mod_${module}.so"; }
+          if isString module then { name = module; path = "${pkg}/modules/mod_${module}.so"; }
           else if isAttrs module then { inherit (module) name path; }
           else throw "Expecting either a string or attribute set including a name and path.";
       in
@@ -296,37 +293,37 @@ let
     AddHandler type-map var
 
     <Files ~ "^\.ht">
-        ${allDenied}
+        Require all denied
     </Files>
 
     ${mimeConf}
     ${loggingConf}
     ${browserHacks}
 
-    Include ${httpd}/conf/extra/httpd-default.conf
+    Include ${pkg}/conf/extra/httpd-default.conf
-    Include ${httpd}/conf/extra/httpd-autoindex.conf
+    Include ${pkg}/conf/extra/httpd-autoindex.conf
-    Include ${httpd}/conf/extra/httpd-multilang-errordoc.conf
+    Include ${pkg}/conf/extra/httpd-multilang-errordoc.conf
-    Include ${httpd}/conf/extra/httpd-languages.conf
+    Include ${pkg}/conf/extra/httpd-languages.conf
 
     TraceEnable off
 
-    ${if enableSSL then sslConf else ""}
+    ${sslConf}
 
     # Fascist default - deny access to everything.
     <Directory />
         Options FollowSymLinks
         AllowOverride None
-        ${allDenied}
+        Require all denied
     </Directory>
 
     # But do allow access to files in the store so that we don't have
     # to generate <Directory> clauses for every generated file that we
     # want to serve.
     <Directory /nix/store>
-        ${allGranted}
+        Require all granted
     </Directory>
 
-    ${mainCfg.extraConfig}
+    ${cfg.extraConfig}
 
     ${concatMapStringsSep "\n" mkVHostConf vhosts}
   '';
@@ -334,7 +331,7 @@ let
   # Generate the PHP configuration file.  Should probably be factored
   # out into a separate module.
   phpIni = pkgs.runCommand "php.ini"
-    { options = mainCfg.phpOptions;
+    { options = cfg.phpOptions;
       preferLocalBuild = true;
     }
     ''
@@ -367,17 +364,13 @@ in
     (mkRemovedOptionModule [ "services" "httpd" "sslServerKey" ] "Please define a virtual host using `services.httpd.virtualHosts`.")
   ];
 
-  ###### interface
+  # interface
 
   options = {
 
     services.httpd = {
 
-      enable = mkOption {
+      enable = mkEnableOption "the Apache HTTP Server";
-        type = types.bool;
-        default = false;
-        description = "Whether to enable the Apache HTTP Server.";
-      };
 
       package = mkOption {
         type = types.package;
@@ -404,7 +397,7 @@ in
         default = "";
         description = ''
           Configuration lines appended to the generated Apache
-          configuration file. Note that this mechanism may not work
+          configuration file. Note that this mechanism will not work
           when <option>configFile</option> is overridden.
         '';
       };
@@ -458,8 +451,7 @@ in
         type = types.str;
         default = "wwwrun";
         description = ''
-          User account under which httpd runs.  The account is created
+          User account under which httpd runs.
-          automatically if it doesn't exist.
         '';
       };
 
@@ -467,8 +459,7 @@ in
         type = types.str;
         default = "wwwrun";
         description = ''
-          Group under which httpd runs.  The account is created
+          Group under which httpd runs.
-          automatically if it doesn't exist.
         '';
       };
 
@@ -481,10 +472,10 @@ in
       };
 
       virtualHosts = mkOption {
-        type = with types; attrsOf (submodule (import ./per-server-options.nix));
+        type = with types; attrsOf (submodule (import ./vhost-options.nix));
         default = {
           localhost = {
-            documentRoot = "${httpd}/htdocs";
+            documentRoot = "${pkg}/htdocs";
           };
         };
         example = literalExample ''
@@ -540,12 +531,13 @@ in
           ''
             date.timezone = "CET"
           '';
-        description =
+        description = ''
-          "Options appended to the PHP configuration file <filename>php.ini</filename>.";
+          Options appended to the PHP configuration file <filename>php.ini</filename>.
+        '';
       };
 
       multiProcessingModule = mkOption {
-        type = types.str;
+        type = types.enum [ "event" "prefork" "worker" ];
         default = "prefork";
         example = "worker";
         description =
@@ -572,8 +564,9 @@ in
         type = types.int;
         default = 0;
         example = 500;
-        description =
+        description = ''
-          "Maximum number of httpd requests answered per httpd child (prefork), 0 means unlimited";
+          Maximum number of httpd requests answered per httpd child (prefork), 0 means unlimited.
+        '';
       };
 
       sslCiphers = mkOption {
@@ -592,10 +585,9 @@ in
 
   };
 
+  # implementation
 
-  ###### implementation
+  config = mkIf cfg.enable {
-
-  config = mkIf config.services.httpd.enable {
 
     assertions = [
       {
@@ -626,30 +618,30 @@ in
     warnings =
       mapAttrsToList (name: hostOpts: ''
         Using config.services.httpd.virtualHosts."${name}".servedFiles is deprecated and will become unsupported in a future release. Your configuration will continue to work as is but please migrate your configuration to config.services.httpd.virtualHosts."${name}".locations before the 20.09 release of NixOS.
-      '') (filterAttrs (name: hostOpts: hostOpts.servedFiles != []) mainCfg.virtualHosts);
+      '') (filterAttrs (name: hostOpts: hostOpts.servedFiles != []) cfg.virtualHosts);
 
-    users.users = optionalAttrs (mainCfg.user == "wwwrun") {
+    users.users = optionalAttrs (cfg.user == "wwwrun") {
       wwwrun = {
-        group = mainCfg.group;
+        group = cfg.group;
         description = "Apache httpd user";
         uid = config.ids.uids.wwwrun;
       };
     };
 
-    users.groups = optionalAttrs (mainCfg.group == "wwwrun") {
+    users.groups = optionalAttrs (cfg.group == "wwwrun") {
       wwwrun.gid = config.ids.gids.wwwrun;
     };
 
     security.acme.certs = mapAttrs (name: hostOpts: {
-      user = mainCfg.user;
+      user = cfg.user;
-      group = mkDefault mainCfg.group;
+      group = mkDefault cfg.group;
-      email = if hostOpts.adminAddr != null then hostOpts.adminAddr else mainCfg.adminAddr;
+      email = if hostOpts.adminAddr != null then hostOpts.adminAddr else cfg.adminAddr;
       webroot = hostOpts.acmeRoot;
       extraDomains = genAttrs hostOpts.serverAliases (alias: null);
       postRun = "systemctl reload httpd.service";
-    }) (filterAttrs (name: hostOpts: hostOpts.enableACME) mainCfg.virtualHosts);
+    }) (filterAttrs (name: hostOpts: hostOpts.enableACME) cfg.virtualHosts);
 
-    environment.systemPackages = [httpd];
+    environment.systemPackages = [ pkg ];
 
     # required for "apachectl configtest"
     environment.etc."httpd/httpd.conf".source = httpdConf;
@@ -689,6 +681,15 @@ in
       "access_compat"
     ];
 
+    systemd.tmpfiles.rules =
+      let
+        svc = config.systemd.services.httpd.serviceConfig;
+      in
+        [
+          "d '${cfg.logDir}' 0700 ${svc.User} ${svc.Group}"
+          "Z '${cfg.logDir}' - ${svc.User} ${svc.Group}"
+        ];
+
     systemd.services.httpd =
       let
         vhostsACME = filter (hostOpts: hostOpts.enableACME) vhosts;
@@ -700,35 +701,36 @@ in
         after = [ "network.target" "fs.target" ] ++ map (hostOpts: "acme-selfsigned-${hostOpts.hostName}.service") vhostsACME;
 
         path =
-          [ httpd pkgs.coreutils pkgs.gnugrep ]
+          [ pkg pkgs.coreutils pkgs.gnugrep ]
-          ++ optional mainCfg.enablePHP pkgs.system-sendmail; # Needed for PHP's mail() function.
+          ++ optional cfg.enablePHP pkgs.system-sendmail; # Needed for PHP's mail() function.
 
         environment =
-          optionalAttrs mainCfg.enablePHP { PHPRC = phpIni; }
+          optionalAttrs cfg.enablePHP { PHPRC = phpIni; }
-          // optionalAttrs mainCfg.enableMellon { LD_LIBRARY_PATH  = "${pkgs.xmlsec}/lib"; };
+          // optionalAttrs cfg.enableMellon { LD_LIBRARY_PATH  = "${pkgs.xmlsec}/lib"; };
 
         preStart =
           ''
-            mkdir -m 0700 -p ${mainCfg.logDir}
-
             # Get rid of old semaphores.  These tend to accumulate across
             # server restarts, eventually preventing it from restarting
             # successfully.
-            for i in $(${pkgs.utillinux}/bin/ipcs -s | grep ' ${mainCfg.user} ' | cut -f2 -d ' '); do
+            for i in $(${pkgs.utillinux}/bin/ipcs -s | grep ' ${cfg.user} ' | cut -f2 -d ' '); do
                 ${pkgs.utillinux}/bin/ipcrm -s $i
             done
           '';
 
-        serviceConfig.ExecStart = "@${httpd}/bin/httpd httpd -f ${httpdConf}";
+        serviceConfig = {
-        serviceConfig.ExecStop = "${httpd}/bin/httpd -f ${httpdConf} -k graceful-stop";
+          ExecStart = "@${pkg}/bin/httpd httpd -f ${httpdConf}";
-        serviceConfig.ExecReload = "${httpd}/bin/httpd -f ${httpdConf} -k graceful";
+          ExecStop = "${pkg}/bin/httpd -f ${httpdConf} -k graceful-stop";
-        serviceConfig.Group = mainCfg.group;
+          ExecReload = "${pkg}/bin/httpd -f ${httpdConf} -k graceful";
-        serviceConfig.Type = "forking";
+          User = "root";
-        serviceConfig.PIDFile = "${runtimeDir}/httpd.pid";
+          Group = cfg.group;
-        serviceConfig.Restart = "always";
+          Type = "forking";
-        serviceConfig.RestartSec = "5s";
+          PIDFile = "${runtimeDir}/httpd.pid";
-        serviceConfig.RuntimeDirectory = "httpd httpd/runtime";
+          Restart = "always";
-        serviceConfig.RuntimeDirectoryMode = "0750";
+          RestartSec = "5s";
+          RuntimeDirectory = "httpd httpd/runtime";
+          RuntimeDirectoryMode = "0750";
+        };
       };
 
   };

nixos/modules/system/activation/activation-script.nix

@@ -162,16 +162,6 @@ in
         <literal>/usr/bin/env</literal>.
       '';
     };
-
-    environment.ld-linux = mkOption {
-      default = false;
-      type = types.bool;
-      visible = false;
-      description = ''
-        Install symlink to ld-linux(8) system-wide to allow running unmodified ELF binaries.
-        It might be useful to run games or executables distributed inside jar files.
-      '';
-    };
   };
 
 
@@ -205,30 +195,9 @@ in
       ''
       else ''
         rm -f /usr/bin/env
-        rmdir -p /usr/bin || true
+        rmdir --ignore-fail-on-non-empty /usr/bin /usr
       '';
 
-    system.activationScripts.ld-linux =
-      concatStrings (
-        mapAttrsToList
-          (target: source:
-            if config.environment.ld-linux then ''
-              mkdir -m 0755 -p $(dirname ${target})
-              ln -sfn ${escapeShellArg source} ${target}.tmp
-              mv -f ${target}.tmp ${target} # atomically replace
-            '' else ''
-              rm -f ${target}
-              rmdir $(dirname ${target}) || true
-            '')
-          {
-            "i686-linux"   ."/lib/ld-linux.so.2"          = "${pkgs.glibc.out}/lib/ld-linux.so.2";
-            "x86_64-linux" ."/lib/ld-linux.so.2"          = "${pkgs.pkgsi686Linux.glibc.out}/lib/ld-linux.so.2";
-            "x86_64-linux" ."/lib64/ld-linux-x86-64.so.2" = "${pkgs.glibc.out}/lib64/ld-linux-x86-64.so.2";
-            "aarch64-linux"."/lib/ld-linux-aarch64.so.1"  = "${pkgs.glibc.out}/lib/ld-linux-aarch64.so.1";
-            "armv7l-linux" ."/lib/ld-linux-armhf.so.3"    = "${pkgs.glibc.out}/lib/ld-linux-armhf.so.3";
-          }.${pkgs.stdenv.system} or {}
-      );
-
     system.activationScripts.specialfs =
       ''
         specialMount() {

nixos/modules/system/boot/networkd.nix

@@ -55,6 +55,11 @@ let
     (assertMacAddress "MACAddress")
   ];
 
+  checkVRF = checkUnitConfig "VRF" [
+    (assertOnlyFields [ "Table" ])
+    (assertMinimum "Table" 0)
+  ];
+
   # NOTE The PrivateKey directive is missing on purpose here, please
   # do not add it to this list. The nix store is world-readable let's
   # refrain ourselves from providing a footgun.
@@ -349,6 +354,21 @@ let
       '';
     };
 
+    vrfConfig = mkOption {
+      default = {};
+      example = { Table = 2342; };
+      type = types.addCheck (types.attrsOf unitOption) checkVRF;
+      description = ''
+        Each attribute in this set specifies an option in the
+        <literal>[VRF]</literal> section of the unit. See
+        <citerefentry><refentrytitle>systemd.netdev</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for details.
+        A detailed explanation about how VRFs work can be found in the
+        <link xlink:href="https://www.kernel.org/doc/Documentation/networking/vrf.txt">kernel
+        docs</link>.
+      '';
+    };
+
     wireguardConfig = mkOption {
       default = {};
       example = {
@@ -844,6 +864,11 @@ let
             [Xfrm]
             ${attrsToSection def.xfrmConfig}
 
+          ''}
+          ${optionalString (def.vrfConfig != { }) ''
+            [VRF]
+            ${attrsToSection def.vrfConfig}
+
           ''}
           ${optionalString (def.wireguardConfig != { }) ''
             [WireGuard]
@@ -947,9 +972,10 @@ in
     systemd.network.units = mkOption {
       description = "Definition of networkd units.";
       default = {};
+      internal = true;
       type = with types; attrsOf (submodule (
         { name, config, ... }:
-        { options = concreteUnitOptions;
+        { options = mapAttrs (_: x: x // { internal = true; }) concreteUnitOptions;
           config = {
             unit = mkDefault (makeUnit name config);
           };

nixos/modules/tasks/network-interfaces.nix

@@ -143,13 +143,34 @@ let
         description = "Name of the interface.";
       };
 
-      preferTempAddress = mkOption {
+      tempAddress = mkOption {
-        type = types.bool;
+        type = types.enum [ "default" "enabled" "disabled" ];
-        default = cfg.enableIPv6;
+        default = if cfg.enableIPv6 then "default" else "disabled";
-        defaultText = literalExample "config.networking.enableIPv6";
+        defaultText = literalExample ''if cfg.enableIPv6 then "default" else "disabled"'';
         description = ''
-          When using SLAAC prefer a temporary (IPv6) address over the EUI-64
+          When IPv6 is enabled with SLAAC, this option controls the use of
-          address for originating connections. This is used to reduce tracking.
+          temporary address (aka privacy extensions). This is used to reduce tracking.
+          The three possible values are:
+
+          <itemizedlist>
+           <listitem>
+            <para>
+             <literal>"default"</literal> to generate temporary addresses and use
+             them by default;
+            </para>
+           </listitem>
+           <listitem>
+            <para>
+             <literal>"enabled"</literal> to generate temporary addresses but keep
+             using the standard EUI-64 ones by default;
+            </para>
+           </listitem>
+           <listitem>
+            <para>
+             <literal>"disabled"</literal> to completely disable temporary addresses.
+            </para>
+           </listitem>
+          </itemizedlist>
         '';
       };
 
@@ -287,6 +308,11 @@ let
       let
         defined = x: x != "_mkMergedOptionModule";
       in [
+        (mkChangedOptionModule [ "preferTempAddress" ] [ "tempAddress" ]
+         (config:
+          let bool = getAttrFromPath [ "preferTempAddress" ] config;
+          in if bool then "default" else "enabled"
+        ))
         (mkRenamedOptionModule [ "ip4" ] [ "ipv4" "addresses"])
         (mkRenamedOptionModule [ "ip6" ] [ "ipv6" "addresses"])
         (mkRemovedOptionModule [ "subnetMask" ] ''
@@ -945,7 +971,7 @@ in
           The networking.interfaces."${i.name}" must not have any defined ips when it is a slave.
         '';
       })) ++ (forEach interfaces (i: {
-        assertion = i.preferTempAddress -> cfg.enableIPv6;
+        assertion = i.tempAddress != "disabled" -> cfg.enableIPv6;
         message = ''
           Temporary addresses are only needed when IPv6 is enabled.
         '';
@@ -973,8 +999,11 @@ in
       "net.ipv6.conf.all.forwarding" = mkDefault (any (i: i.proxyARP) interfaces);
     } // listToAttrs (flip concatMap (filter (i: i.proxyARP) interfaces)
         (i: forEach [ "4" "6" ] (v: nameValuePair "net.ipv${v}.conf.${replaceChars ["."] ["/"] i.name}.proxy_arp" true)))
-      // listToAttrs (forEach (filter (i: i.preferTempAddress) interfaces)
+      // listToAttrs (forEach interfaces
-        (i: nameValuePair "net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr" 2));
+        (i: let
+          opt = i.tempAddress;
+          val = { disabled = 0; enabled = 1; default = 2; }.${opt};
+         in nameValuePair "net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr" val));
 
     # Capabilities won't work unless we have at-least a 4.3 Linux
     # kernel because we need the ambient capability
@@ -1103,10 +1132,18 @@ in
       (pkgs.writeTextFile rec {
         name = "ipv6-privacy-extensions.rules";
         destination = "/etc/udev/rules.d/99-${name}";
-        text = concatMapStrings (i: ''
+        text = concatMapStrings (i:
-          # enable IPv6 privacy addresses but prefer EUI-64 addresses for ${i.name}
+          let
-          ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr=1"
+            opt = i.tempAddress;
-        '') (filter (i: !i.preferTempAddress) interfaces);
+            val = if opt == "disabled" then 0 else 1;
+            msg = if opt == "disabled"
+                  then "completely disable IPv6 privacy addresses"
+                  else "enable IPv6 privacy addresses but prefer EUI-64 addresses";
+          in
+          ''
+            # override to ${msg} for ${i.name}
+            ACTION=="add", SUBSYSTEM=="net", RUN+="${pkgs.procps}/bin/sysctl net.ipv6.conf.${replaceChars ["."] ["/"] i.name}.use_tempaddr=${toString val}"
+          '') (filter (i: i.tempAddress != "default") interfaces);
       })
     ] ++ lib.optional (cfg.wlanInterfaces != {})
       (pkgs.writeTextFile {

nixos/tests/all-tests.nix

@@ -32,7 +32,6 @@ in
   bees = handleTest ./bees.nix {};
   bind = handleTest ./bind.nix {};
   bittorrent = handleTest ./bittorrent.nix {};
-  #blivet = handleTest ./blivet.nix {};   # broken since 2017-07024
   buildkite-agent = handleTest ./buildkite-agent.nix {};
   boot = handleTestOn ["x86_64-linux"] ./boot.nix {}; # syslinux is unsupported on aarch64
   boot-stage1 = handleTest ./boot-stage1.nix {};
@@ -276,6 +275,7 @@ in
   systemd-analyze = handleTest ./systemd-analyze.nix {};
   systemd-confinement = handleTest ./systemd-confinement.nix {};
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
+  systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix {};
   systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {};
   systemd-nspawn = handleTest ./systemd-nspawn.nix {};
   pdns-recursor = handleTest ./pdns-recursor.nix {};

nixos/tests/blivet.nix

@@ -1,87 +0,0 @@
-import ./make-test.nix ({ pkgs, ... }: with pkgs.python2Packages; rec {
-  name = "blivet";
-  meta = with pkgs.stdenv.lib.maintainers; {
-    maintainers = [ aszlig ];
-  };
-
-  machine = {
-    environment.systemPackages = [ pkgs.python blivet mock ];
-    boot.supportedFilesystems = [ "btrfs" "jfs" "reiserfs" "xfs" ];
-    virtualisation.memorySize = 768;
-  };
-
-  debugBlivet       = false;
-  debugProgramCalls = false;
-
-  pythonTestRunner = pkgs.writeText "run-blivet-tests.py" ''
-    import sys
-    import logging
-
-    from unittest import TestLoader
-    from unittest.runner import TextTestRunner
-
-    ${pkgs.lib.optionalString debugProgramCalls ''
-      blivet_program_log = logging.getLogger("program")
-      blivet_program_log.setLevel(logging.DEBUG)
-      blivet_program_log.addHandler(logging.StreamHandler(sys.stderr))
-    ''}
-
-    ${pkgs.lib.optionalString debugBlivet ''
-      blivet_log = logging.getLogger("blivet")
-      blivet_log.setLevel(logging.DEBUG)
-      blivet_log.addHandler(logging.StreamHandler(sys.stderr))
-    ''}
-
-    runner = TextTestRunner(verbosity=2, failfast=False, buffer=False)
-    result = runner.run(TestLoader().discover('tests/', pattern='*_test.py'))
-    sys.exit(not result.wasSuccessful())
-  '';
-
-  blivetTest = pkgs.writeScript "blivet-test.sh" ''
-    #!${pkgs.stdenv.shell} -e
-
-    # Use the hosts temporary directory, because we have a tmpfs within the VM
-    # and we don't want to increase the memory size of the VM for no reason.
-    mkdir -p /tmp/xchg/bigtmp
-    TMPDIR=/tmp/xchg/bigtmp
-    export TMPDIR
-
-    cp -Rd "${blivet.src}/tests" .
-
-    # Skip SELinux tests
-    rm -f tests/formats_test/selinux_test.py
-
-    # Race conditions in growing/shrinking during resync
-    rm -f tests/devicelibs_test/mdraid_*
-
-    # Deactivate small BTRFS device test, because it fails with newer btrfsprogs
-    sed -i -e '/^class *BTRFSAsRootTestCase3(/,/^[^ ]/ {
-      /^class *BTRFSAsRootTestCase3(/d
-      /^$/d
-      /^ /d
-    }' tests/devicelibs_test/btrfs_test.py
-
-    # How on earth can these tests ever work even upstream? O_o
-    sed -i -e '/def testDiskChunk[12]/,/^ *[^ ]/{n; s/^ */&return # /}' \
-      tests/partitioning_test.py
-
-    # fix hardcoded temporary directory
-    sed -i \
-      -e '1i import tempfile' \
-      -e 's|_STORE_FILE_PATH = .*|_STORE_FILE_PATH = tempfile.gettempdir()|' \
-      -e 's|DEFAULT_STORE_SIZE = .*|DEFAULT_STORE_SIZE = 409600|' \
-      tests/loopbackedtestcase.py
-
-    PYTHONPATH=".:$(< "${pkgs.stdenv.mkDerivation {
-      name = "blivet-pythonpath";
-      buildInputs = [ blivet mock ];
-      buildCommand = "echo \"$PYTHONPATH\" > \"$out\"";
-    }}")" python "${pythonTestRunner}"
-  '';
-
-  testScript = ''
-    $machine->waitForUnit("multi-user.target");
-    $machine->succeed("${blivetTest}");
-    $machine->execute("rm -rf /tmp/xchg/bigtmp");
-  '';
-})

nixos/tests/buildbot.nix

@@ -1,12 +1,11 @@
+# Test ensures buildbot master comes up correctly and workers can connect
+
 { system ? builtins.currentSystem,
   config ? {},
   pkgs ? import ../.. { inherit system config; }
 }:
 
-with import ../lib/testing.nix { inherit system pkgs; };
+import ./make-test-python.nix {
-
-# Test ensures buildbot master comes up correctly and workers can connect
-makeTest {
   name = "buildbot";
 
   nodes = {
@@ -39,75 +38,76 @@ makeTest {
       services.openssh.enable = true;
       networking.firewall.allowedTCPPorts = [ 22 9418 ];
       environment.systemPackages = with pkgs; [ git ];
+      systemd.services.git-daemon = {
+        description   = "Git daemon for the test";
+        wantedBy      = [ "multi-user.target" ];
+        after         = [ "network.target" ];
+
+        serviceConfig.Restart = "always";
+        path = with pkgs; [ coreutils git openssh ];
+        environment = { HOME = "/root"; };
+        preStart = ''
+          git config --global user.name 'Nobody Fakeuser'
+          git config --global user.email 'nobody\@fakerepo.com'
+          rm -rvf /srv/repos/fakerepo.git /tmp/fakerepo
+          mkdir -pv /srv/repos/fakerepo ~/.ssh
+          ssh-keyscan -H gitrepo > ~/.ssh/known_hosts
+          cat ~/.ssh/known_hosts
+
+          mkdir -p /src/repos/fakerepo
+          cd /srv/repos/fakerepo
+          rm -rf *
+          git init
+          echo -e '#!/bin/sh\necho fakerepo' > fakerepo.sh
+          cat fakerepo.sh
+          touch .git/git-daemon-export-ok
+          git add fakerepo.sh .git/git-daemon-export-ok
+          git commit -m fakerepo
+        '';
+        script = ''
+          git daemon --verbose --export-all --base-path=/srv/repos --reuseaddr
+        '';
+      };
     };
   };
 
   testScript = ''
-    #Start up and populate fake repo
+    gitrepo.wait_for_unit("git-daemon.service")
-    $gitrepo->waitForUnit("multi-user.target");
+    gitrepo.wait_for_unit("multi-user.target")
-    print($gitrepo->execute(" \
-      git config --global user.name 'Nobody Fakeuser' && \
-      git config --global user.email 'nobody\@fakerepo.com' && \
-      rm -rvf /srv/repos/fakerepo.git /tmp/fakerepo && \
-      mkdir -pv /srv/repos/fakerepo ~/.ssh && \
-      ssh-keyscan -H gitrepo > ~/.ssh/known_hosts && \
-      cat ~/.ssh/known_hosts && \
-      cd /srv/repos/fakerepo && \
-      git init && \
-      echo -e '#!/bin/sh\necho fakerepo' > fakerepo.sh && \
-      cat fakerepo.sh && \
-      touch .git/git-daemon-export-ok && \
-      git add fakerepo.sh .git/git-daemon-export-ok && \
-      git commit -m fakerepo && \
-      git daemon --verbose --export-all --base-path=/srv/repos --reuseaddr & \
-    "));
 
-    # Test gitrepo
+    with subtest("Repo is accessible via git daemon"):
-    $bbmaster->waitForUnit("network-online.target");
+        bbmaster.wait_for_unit("network-online.target")
-    #$bbmaster->execute("nc -z gitrepo 9418");
+        bbmaster.succeed("rm -rfv /tmp/fakerepo")
-    print($bbmaster->execute(" \
+        bbmaster.succeed("git clone git://gitrepo/fakerepo /tmp/fakerepo")
-      rm -rfv /tmp/fakerepo && \
-      git clone git://gitrepo/fakerepo /tmp/fakerepo && \
-      pwd && \
-      ls -la && \
-      ls -la /tmp/fakerepo \
-    "));
 
-    # Test start master and connect worker
+    with subtest("Master service and worker successfully connect"):
-    $bbmaster->waitForUnit("buildbot-master.service");
+        bbmaster.wait_for_unit("buildbot-master.service")
-    $bbmaster->waitUntilSucceeds("curl -s --head http://bbmaster:8010") =~ /200 OK/;
+        bbmaster.wait_until_succeeds("curl --fail -s --head http://bbmaster:8010")
-    $bbworker->waitForUnit("network-online.target");
+        bbworker.wait_for_unit("network-online.target")
-    $bbworker->execute("nc -z bbmaster 8010");
+        bbworker.succeed("nc -z bbmaster 8010")
-    $bbworker->execute("nc -z bbmaster 9989");
+        bbworker.succeed("nc -z bbmaster 9989")
-    $bbworker->waitForUnit("buildbot-worker.service");
+        bbworker.wait_for_unit("buildbot-worker.service")
-    print($bbworker->execute("ls -la /home/bbworker/worker"));
 
+    with subtest("Stop buildbot worker"):
+        bbmaster.succeed("systemctl -l --no-pager status buildbot-master")
+        bbmaster.succeed("systemctl stop buildbot-master")
+        bbworker.fail("nc -z bbmaster 8010")
+        bbworker.fail("nc -z bbmaster 9989")
+        bbworker.succeed("systemctl -l --no-pager status buildbot-worker")
+        bbworker.succeed("systemctl stop buildbot-worker")
 
-    # Test stop buildbot master and worker
+    with subtest("Buildbot daemon mode works"):
-    print($bbmaster->execute(" \
+        bbmaster.succeed(
-      systemctl -l --no-pager status buildbot-master && \
+            "buildbot create-master /tmp",
-      systemctl stop buildbot-master \
+            "mv -fv /tmp/master.cfg.sample /tmp/master.cfg",
-    "));
+            "sed -i 's/8010/8011/' /tmp/master.cfg",
-    $bbworker->fail("nc -z bbmaster 8010");
+            "buildbot start /tmp",
-    $bbworker->fail("nc -z bbmaster 9989");
+            "nc -z bbmaster 8011",
-    print($bbworker->execute(" \
+        )
-      systemctl -l --no-pager status buildbot-worker && \
+        bbworker.wait_until_succeeds("curl --fail -s --head http://bbmaster:8011")
-      systemctl stop buildbot-worker && \
+        bbmaster.wait_until_succeeds("buildbot stop /tmp")
-      ls -la /home/bbworker/worker \
+        bbworker.fail("nc -z bbmaster 8011")
-    "));
-
-
-    # Test buildbot daemon mode
-    $bbmaster->execute("buildbot create-master /tmp");
-    $bbmaster->execute("mv -fv /tmp/master.cfg.sample /tmp/master.cfg");
-    $bbmaster->execute("sed -i 's/8010/8011/' /tmp/master.cfg");
-    $bbmaster->execute("buildbot start /tmp");
-    $bbworker->execute("nc -z bbmaster 8011");
-    $bbworker->waitUntilSucceeds("curl -s --head http://bbmaster:8011") =~ /200 OK/;
-    $bbmaster->execute("buildbot stop /tmp");
-    $bbworker->fail("nc -z bbmaster 8011");
-
   '';
 
   meta.maintainers = with pkgs.stdenv.lib.maintainers; [ nand0p ];
-}
+} {}

nixos/tests/graphite.nix

@@ -1,6 +1,11 @@
-import ./make-test.nix ({ pkgs, ... } :
+import ./make-test-python.nix ({ pkgs, ... } :
 {
   name = "graphite";
+  meta = {
+    # Fails on dependency `python-2.7-Twisted`'s test suite
+    # complaining `ImportError: No module named zope.interface`.
+    broken = true;
+  };
   nodes = {
     one =
       { ... }: {
@@ -22,20 +27,20 @@ import ./make-test.nix ({ pkgs, ... } :
   };
 
   testScript = ''
-    startAll;
+    start_all()
-    $one->waitForUnit("default.target");
+    one.wait_for_unit("default.target")
-    $one->waitForUnit("graphiteWeb.service");
+    one.wait_for_unit("graphiteWeb.service")
-    $one->waitForUnit("graphiteApi.service");
+    one.wait_for_unit("graphiteApi.service")
-    $one->waitForUnit("graphitePager.service");
+    one.wait_for_unit("graphitePager.service")
-    $one->waitForUnit("graphite-beacon.service");
+    one.wait_for_unit("graphite-beacon.service")
-    $one->waitForUnit("carbonCache.service");
+    one.wait_for_unit("carbonCache.service")
-    $one->waitForUnit("seyren.service");
+    one.wait_for_unit("seyren.service")
     # The services above are of type "simple". systemd considers them active immediately
     # even if they're still in preStart (which takes quite long for graphiteWeb).
     # Wait for ports to open so we're sure the services are up and listening.
-    $one->waitForOpenPort(8080);
+    one.wait_for_open_port(8080)
-    $one->waitForOpenPort(2003);
+    one.wait_for_open_port(2003)
-    $one->succeed("echo \"foo 1 `date +%s`\" | nc -N localhost 2003");
+    one.succeed('echo "foo 1 `date +%s`" | nc -N localhost 2003')
-    $one->waitUntilSucceeds("curl 'http://localhost:8080/metrics/find/?query=foo&format=treejson' --silent | grep foo >&2");
+    one.wait_until_succeeds("curl 'http://localhost:8080/metrics/find/?query=foo&format=treejson' --silent | grep foo >&2")
   '';
 })

nixos/tests/ihatemoney.nix

@@ -1,13 +1,5 @@
-{ system ? builtins.currentSystem
-, config ? {}
-, pkgs ? import ../.. { inherit system config; }
-}:
-
 let
-  inherit (import ../lib/testing.nix { inherit system pkgs; }) makeTest;
+  f = backend: import ./make-test-python.nix ({ pkgs, ... }: {
-in
-map (
-  backend: makeTest {
     name = "ihatemoney-${backend}";
     machine = { lib, ... }: {
       services.ihatemoney = {
@@ -30,23 +22,34 @@ map (
       };
     };
     testScript = ''
-      $machine->waitForOpenPort(8000);
+      machine.wait_for_open_port(8000)
-      $machine->waitForUnit("uwsgi.service");
+      machine.wait_for_unit("uwsgi.service")
-      my $return = $machine->succeed("curl -X POST http://localhost:8000/api/projects -d 'name=yay&id=yay&password=yay&contact_email=yay\@example.com'");
+
-      die "wrong project id $return" unless "\"yay\"\n" eq $return;
+      assert '"yay"' in machine.succeed(
-      my $timestamp = $machine->succeed("stat --printf %Y /var/lib/ihatemoney/secret_key");
+          "curl -X POST http://localhost:8000/api/projects -d 'name=yay&id=yay&password=yay&contact_email=yay\@example.com'"
-      my $owner = $machine->succeed("stat --printf %U:%G /var/lib/ihatemoney/secret_key");
+      )
-      die "wrong ownership for the secret key: $owner, is uwsgi running as the right user ?" unless $owner eq "ihatemoney:ihatemoney";
+      owner, timestamp = machine.succeed(
-      $machine->shutdown();
+          "stat --printf %U:%G___%Y /var/lib/ihatemoney/secret_key"
-      $machine->start();
+      ).split("___")
-      $machine->waitForOpenPort(8000);
+      assert "ihatemoney:ihatemoney" == owner
-      $machine->waitForUnit("uwsgi.service");
+
-      # check that the database is really persistent
+      with subtest("Restart machine and service"):
-      print $machine->succeed("curl --basic -u yay:yay http://localhost:8000/api/projects/yay");
+          machine.shutdown()
-      # check that the secret key is really persistent
+          machine.start()
-      my $timestamp2 = $machine->succeed("stat --printf %Y /var/lib/ihatemoney/secret_key");
+          machine.wait_for_open_port(8000)
-      die unless $timestamp eq $timestamp2;
+          machine.wait_for_unit("uwsgi.service")
-      $machine->succeed("curl http://localhost:8000 | grep ihatemoney");
+
+      with subtest("check that the database is really persistent"):
+          machine.succeed("curl --basic -u yay:yay http://localhost:8000/api/projects/yay")
+
+      with subtest("check that the secret key is really persistent"):
+          timestamp2 = machine.succeed("stat --printf %Y /var/lib/ihatemoney/secret_key")
+          assert timestamp == timestamp2
+
+      assert "ihatemoney" in machine.succeed("curl http://localhost:8000")
     '';
+  });
+in {
+  ihatemoney-sqlite = f "sqlite";
+  ihatemoney-postgresql = f "postgresql";
 }
-) [ "sqlite" "postgresql" ]

nixos/tests/installer.nix

@@ -74,7 +74,7 @@ let
       # FIXME don't duplicate the -enable-kvm etc. flags here yet again!
       qemuFlags =
         (if system == "x86_64-linux" then "-m 768 " else "-m 512 ") +
-        (optionalString (system == "x86_64-linux") "-cpu kvm64 ") +
+        (optionalString (system == "x86_64-linux") "-cpu host ") +
         (optionalString (system == "aarch64-linux") "-enable-kvm -machine virt,gic-version=host -cpu host ");
 
       hdFlags = ''hda => "vm-state-machine/machine.qcow2", hdaInterface => "${iface}", ''

nixos/tests/keymap.nix

@@ -3,14 +3,13 @@
   pkgs ? import ../.. { inherit system config; }
 }:
 
-with import ../lib/testing.nix { inherit system pkgs; };
+with import ../lib/testing-python.nix { inherit system pkgs; };
 
 let
   readyFile  = "/tmp/readerReady";
   resultFile = "/tmp/readerResult";
 
   testReader = pkgs.writeScript "test-input-reader" ''
-    #!${pkgs.stdenv.shell}
     rm -f ${resultFile} ${resultFile}.tmp
     logger "testReader: START: Waiting for $1 characters, expecting '$2'."
     touch ${readyFile}
@@ -27,56 +26,75 @@ let
   '';
 
 
-  mkKeyboardTest = layout: { extraConfig ? {}, tests }: with pkgs.lib; let
+  mkKeyboardTest = layout: { extraConfig ? {}, tests }: with pkgs.lib; makeTest {
-    combinedTests = foldAttrs (acc: val: acc ++ val) [] (builtins.attrValues tests);
-    perlStr = val: "'${escape ["'" "\\"] val}'";
-    lq = length combinedTests.qwerty;
-    le = length combinedTests.expect;
-    msg = "length mismatch between qwerty (${toString lq}) and expect (${toString le}) lists!";
-    send   = concatMapStringsSep ", " perlStr combinedTests.qwerty;
-    expect = if (lq == le) then concatStrings combinedTests.expect else throw msg;
-
-  in makeTest {
     name = "keymap-${layout}";
 
+    machine.console.keyMap = mkOverride 900 layout;
     machine.services.xserver.desktopManager.xterm.enable = false;
-    machine.i18n.consoleKeyMap = mkOverride 900 layout;
     machine.services.xserver.layout = mkOverride 900 layout;
     machine.imports = [ ./common/x11.nix extraConfig ];
 
     testScript = ''
+      import json
+      import shlex
 
-      sub mkTest ($$) {
-        my ($desc, $cmd) = @_;
 
-        subtest $desc, sub {
+      def run_test_case(cmd, xorg_keymap, test_case_name, inputs, expected):
-          # prepare and start testReader
+          with subtest(test_case_name):
-          $machine->execute("rm -f ${readyFile} ${resultFile}");
+              assert len(inputs) == len(expected)
-          $machine->succeed("$cmd ${testReader} ${toString le} ".q(${escapeShellArg expect} & ));
+              machine.execute("rm -f ${readyFile} ${resultFile}")
 
-          if ($desc eq "Xorg keymap") {
+              # set up process that expects all the keys to be entered
+              machine.succeed(
+                  "{} {} {} {} &".format(
+                      cmd,
+                      "${testReader}",
+                      len(inputs),
+                      shlex.quote("".join(expected)),
+                  )
+              )
+
+              if xorg_keymap:
                   # make sure the xterm window is open and has focus
-            $machine->waitForWindow(qr/testterm/);
+                  machine.wait_for_window("testterm")
-            $machine->waitUntilSucceeds("${pkgs.xdotool}/bin/xdotool search --sync --onlyvisible --class testterm windowfocus --sync");
+                  machine.wait_until_succeeds(
-          }
+                      "${pkgs.xdotool}/bin/xdotool search --sync --onlyvisible "
+                      "--class testterm windowfocus --sync"
+                  )
 
               # wait for reader to be ready
-          $machine->waitForFile("${readyFile}");
+              machine.wait_for_file("${readyFile}")
-          $machine->sleep(1);
+              machine.sleep(1)
 
               # send all keys
-          foreach ((${send})) { $machine->sendKeys($_); };
+              for key in inputs:
+                  machine.send_key(key)
 
               # wait for result and check
-          $machine->waitForFile("${resultFile}");
+              machine.wait_for_file("${resultFile}")
-          $machine->succeed("grep -q 'PASS:' ${resultFile}");
+              machine.succeed("grep -q 'PASS:' ${resultFile}")
-        };
-      };
 
-      $machine->waitForX;
 
-      mkTest "VT keymap", "openvt -sw --";
+      with open("${pkgs.writeText "tests.json" (builtins.toJSON tests)}") as json_file:
-      mkTest "Xorg keymap", "DISPLAY=:0 xterm -title testterm -class testterm -fullscreen -e";
+          tests = json.load(json_file)
+
+      keymap_environments = {
+          "VT Keymap": "openvt -sw --",
+          "Xorg Keymap": "DISPLAY=:0 xterm -title testterm -class testterm -fullscreen -e",
+      }
+
+      machine.wait_for_x()
+
+      for keymap_env_name, command in keymap_environments.items():
+          with subtest(keymap_env_name):
+              for test_case_name, test_data in tests.items():
+                  run_test_case(
+                      command,
+                      False,
+                      test_case_name,
+                      test_data["qwerty"],
+                      test_data["expect"],
+                  )
     '';
   };
 
@@ -89,7 +107,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
       altgr.expect = [ "~"       "#"       "{"       "["       "|"       ];
     };
 
-    extraConfig.i18n.consoleKeyMap = "azerty/fr";
+    extraConfig.console.keyMap = "azerty/fr";
     extraConfig.services.xserver.layout = "fr";
   };
 
@@ -99,7 +117,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
       homerow.expect = [ "a" "r" "s" "t" "n" "e" "i" "o"         ];
     };
 
-    extraConfig.i18n.consoleKeyMap = "colemak/colemak";
+    extraConfig.console.keyMap = "colemak/colemak";
     extraConfig.services.xserver.layout = "us";
     extraConfig.services.xserver.xkbVariant = "colemak";
   };
@@ -151,7 +169,7 @@ in pkgs.lib.mapAttrs mkKeyboardTest {
       altgr.expect = [ "@" "|"    "{" "[" "]" "}" ];
     };
 
-    extraConfig.i18n.consoleKeyMap = "de";
+    extraConfig.console.keyMap = "de";
     extraConfig.services.xserver.layout = "de";
   };
 }

nixos/tests/networking-proxy.nix

@@ -10,7 +10,7 @@ let default-config = {
 
         virtualisation.memorySize = 128;
       };
-in import ./make-test.nix ({ pkgs, ...} : {
+in import ./make-test-python.nix ({ pkgs, ...} : {
   name = "networking-proxy";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [  ];
@@ -66,46 +66,70 @@ in import ./make-test.nix ({ pkgs, ...} : {
 
   testScript =
     ''
-      startAll;
+      from typing import Dict, Optional
 
-      # no proxy at all
-      print $machine->execute("env | grep -i proxy");
-      print $machine->execute("su - alice -c 'env | grep -i proxy'");
-      $machine->mustFail("env | grep -i proxy");
-      $machine->mustFail("su - alice -c 'env | grep -i proxy'");
 
-      # Use a default proxy option
+      def get_machine_env(machine: Machine, user: Optional[str] = None) -> Dict[str, str]:
-      print $machine2->execute("env | grep -i proxy");
+          """
-      print $machine2->execute("su - alice -c 'env | grep -i proxy'");
+          Gets the environment from a given machine, and returns it as a
-      $machine2->mustSucceed("env | grep -i proxy");
+          dictionary in the form:
-      $machine2->mustSucceed("su - alice -c 'env | grep -i proxy'");
+              {"lowercase_var_name": "value"}
 
-      # explicitly set each proxy option
+          Duplicate environment variables with the same name
-      print $machine3->execute("env | grep -i proxy");
+          (e.g. "foo" and "FOO") are handled in an undefined manner.
-      print $machine3->execute("su - alice -c 'env | grep -i proxy'");
+          """
-      $machine3->mustSucceed("env | grep -i http_proxy | grep 123");
+          if user is not None:
-      $machine3->mustSucceed("env | grep -i https_proxy | grep 456");
+              env = machine.succeed("su - {} -c 'env -0'".format(user))
-      $machine3->mustSucceed("env | grep -i rsync_proxy | grep 789");
+          else:
-      $machine3->mustSucceed("env | grep -i ftp_proxy | grep 101112");
+              env = machine.succeed("env -0")
-      $machine3->mustSucceed("env | grep -i no_proxy | grep 131415");
+          ret = {}
-      $machine3->mustSucceed("su - alice -c 'env | grep -i http_proxy | grep 123'");
+          for line in env.split("\0"):
-      $machine3->mustSucceed("su - alice -c 'env | grep -i https_proxy | grep 456'");
+              if "=" not in line:
-      $machine3->mustSucceed("su - alice -c 'env | grep -i rsync_proxy | grep 789'");
+                  continue
-      $machine3->mustSucceed("su - alice -c 'env | grep -i ftp_proxy | grep 101112'");
-      $machine3->mustSucceed("su - alice -c 'env | grep -i no_proxy | grep 131415'");
 
-      # set default proxy option + some other specifics
+              key, val = line.split("=", 1)
-      print $machine4->execute("env | grep -i proxy");
+              ret[key.lower()] = val
-      print $machine4->execute("su - alice -c 'env | grep -i proxy'");
+          return ret
-      $machine4->mustSucceed("env | grep -i http_proxy | grep 000");
+
-      $machine4->mustSucceed("env | grep -i https_proxy | grep 000");
+
-      $machine4->mustSucceed("env | grep -i rsync_proxy | grep 123");
+      start_all()
-      $machine4->mustSucceed("env | grep -i ftp_proxy | grep 000");
+
-      $machine4->mustSucceed("env | grep -i no_proxy | grep 131415");
+      with subtest("no proxy"):
-      $machine4->mustSucceed("su - alice -c 'env | grep -i http_proxy | grep 000'");
+          assert "proxy" not in machine.succeed("env").lower()
-      $machine4->mustSucceed("su - alice -c 'env | grep -i https_proxy | grep 000'");
+          assert "proxy" not in machine.succeed("su - alice -c env").lower()
-      $machine4->mustSucceed("su - alice -c 'env | grep -i rsync_proxy | grep 123'");
+
-      $machine4->mustSucceed("su - alice -c 'env | grep -i ftp_proxy | grep 000'");
+      with subtest("default proxy"):
-      $machine4->mustSucceed("su - alice -c 'env | grep -i no_proxy | grep 131415'");
+          assert "proxy" in machine2.succeed("env").lower()
+          assert "proxy" in machine2.succeed("su - alice -c env").lower()
+
+      with subtest("explicitly-set proxy"):
+          env = get_machine_env(machine3)
+          assert "123" in env["http_proxy"]
+          assert "456" in env["https_proxy"]
+          assert "789" in env["rsync_proxy"]
+          assert "101112" in env["ftp_proxy"]
+          assert "131415" in env["no_proxy"]
+
+          env = get_machine_env(machine3, "alice")
+          assert "123" in env["http_proxy"]
+          assert "456" in env["https_proxy"]
+          assert "789" in env["rsync_proxy"]
+          assert "101112" in env["ftp_proxy"]
+          assert "131415" in env["no_proxy"]
+
+      with subtest("default proxy + some other specifics"):
+          env = get_machine_env(machine4)
+          assert "000" in env["http_proxy"]
+          assert "000" in env["https_proxy"]
+          assert "123" in env["rsync_proxy"]
+          assert "000" in env["ftp_proxy"]
+          assert "131415" in env["no_proxy"]
+
+          env = get_machine_env(machine4, "alice")
+          assert "000" in env["http_proxy"]
+          assert "000" in env["https_proxy"]
+          assert "123" in env["rsync_proxy"]
+          assert "000" in env["ftp_proxy"]
+          assert "131415" in env["no_proxy"]
     '';
 })

nixos/tests/networking.nix

@@ -533,7 +533,7 @@ let
           useNetworkd = networkd;
           useDHCP = false;
           interfaces.eth1 = {
-            preferTempAddress = true;
+            tempAddress = "default";
             ipv4.addresses = mkOverride 0 [ ];
             ipv6.addresses = mkOverride 0 [ ];
             useDHCP = true;
@@ -546,7 +546,7 @@ let
           useNetworkd = networkd;
           useDHCP = false;
           interfaces.eth1 = {
-            preferTempAddress = false;
+            tempAddress = "enabled";
             ipv4.addresses = mkOverride 0 [ ];
             ipv6.addresses = mkOverride 0 [ ];
             useDHCP = true;

nixos/tests/riak.nix

@@ -1,21 +1,18 @@
-import ./make-test.nix {
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
   name = "riak";
+  meta = with lib.maintainers; {
+    maintainers = [ filalex77 ];
+  };
 
-  nodes = {
+  machine = {
-    master =
-      { pkgs, ... }:
-
-      {
     services.riak.enable = true;
     services.riak.package = pkgs.riak;
   };
-  };
 
   testScript = ''
-    startAll;
+    machine.start()
 
-    $master->waitForUnit("riak");
+    machine.wait_for_unit("riak")
-    $master->sleep(20); # Hopefully this is long enough!!
+    machine.wait_until_succeeds("riak ping 2>&1")
-    $master->succeed("riak ping 2>&1");
   '';
-}
+})

nixos/tests/systemd-networkd-vrf.nix

@@ -0,0 +1,221 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: let
+  inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+in {
+  name = "systemd-networkd-vrf";
+  meta.maintainers = with lib.maintainers; [ ma27 ];
+
+  nodes = {
+    client = { pkgs, ... }: {
+      virtualisation.vlans = [ 1 2 ];
+
+      networking = {
+        useDHCP = false;
+        useNetworkd = true;
+        firewall.checkReversePath = "loose";
+      };
+
+      systemd.network = {
+        enable = true;
+
+        netdevs."10-vrf1" = {
+          netdevConfig = {
+            Kind = "vrf";
+            Name = "vrf1";
+            MTUBytes = "1300";
+          };
+          vrfConfig.Table = 23;
+        };
+        netdevs."10-vrf2" = {
+          netdevConfig = {
+            Kind = "vrf";
+            Name = "vrf2";
+            MTUBytes = "1300";
+          };
+          vrfConfig.Table = 42;
+        };
+
+        networks."10-vrf1" = {
+          matchConfig.Name = "vrf1";
+          networkConfig.IPForward = "yes";
+          routes = [
+            { routeConfig = { Destination = "192.168.1.2"; Metric = "100"; }; }
+          ];
+        };
+        networks."10-vrf2" = {
+          matchConfig.Name = "vrf2";
+          networkConfig.IPForward = "yes";
+          routes = [
+            { routeConfig = { Destination = "192.168.2.3"; Metric = "100"; }; }
+          ];
+        };
+
+        networks."10-eth1" = {
+          matchConfig.Name = "eth1";
+          linkConfig.RequiredForOnline = "no";
+          networkConfig = {
+            VRF = "vrf1";
+            Address = "192.168.1.1";
+            IPForward = "yes";
+          };
+        };
+        networks."10-eth2" = {
+          matchConfig.Name = "eth2";
+          linkConfig.RequiredForOnline = "no";
+          networkConfig = {
+            VRF = "vrf2";
+            Address = "192.168.2.1";
+            IPForward = "yes";
+          };
+        };
+      };
+    };
+
+    node1 = { pkgs, ... }: {
+      virtualisation.vlans = [ 1 ];
+      networking = {
+        useDHCP = false;
+        useNetworkd = true;
+      };
+
+      services.openssh.enable = true;
+      users.users.root.openssh.authorizedKeys.keys = [ snakeOilPublicKey ];
+
+      systemd.network = {
+        enable = true;
+
+        networks."10-eth1" = {
+          matchConfig.Name = "eth1";
+          linkConfig.RequiredForOnline = "no";
+          networkConfig = {
+            Address = "192.168.1.2";
+            IPForward = "yes";
+          };
+        };
+      };
+    };
+
+    node2 = { pkgs, ... }: {
+      virtualisation.vlans = [ 2 ];
+      networking = {
+        useDHCP = false;
+        useNetworkd = true;
+      };
+
+      systemd.network = {
+        enable = true;
+
+        networks."10-eth2" = {
+          matchConfig.Name = "eth2";
+          linkConfig.RequiredForOnline = "no";
+          networkConfig = {
+            Address = "192.168.2.3";
+            IPForward = "yes";
+          };
+        };
+      };
+    };
+
+    node3 = { pkgs, ... }: {
+      virtualisation.vlans = [ 2 ];
+      networking = {
+        useDHCP = false;
+        useNetworkd = true;
+      };
+
+      systemd.network = {
+        enable = true;
+
+        networks."10-eth2" = {
+          matchConfig.Name = "eth2";
+          linkConfig.RequiredForOnline = "no";
+          networkConfig = {
+            Address = "192.168.2.4";
+            IPForward = "yes";
+          };
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    def compare_tables(expected, actual):
+        assert (
+            expected == actual
+        ), """
+        Routing tables don't match!
+        Expected:
+          {}
+        Actual:
+          {}
+        """.format(
+            expected, actual
+        )
+
+
+    start_all()
+
+    client.wait_for_unit("network.target")
+    node1.wait_for_unit("network.target")
+    node2.wait_for_unit("network.target")
+    node3.wait_for_unit("network.target")
+
+    client_ipv4_table = """
+    192.168.1.2 dev vrf1 proto static metric 100 
+    192.168.2.3 dev vrf2 proto static metric 100
+    """.strip()
+    vrf1_table = """
+    broadcast 192.168.1.0 dev eth1 proto kernel scope link src 192.168.1.1 
+    192.168.1.0/24 dev eth1 proto kernel scope link src 192.168.1.1 
+    local 192.168.1.1 dev eth1 proto kernel scope host src 192.168.1.1 
+    broadcast 192.168.1.255 dev eth1 proto kernel scope link src 192.168.1.1
+    """.strip()
+    vrf2_table = """
+    broadcast 192.168.2.0 dev eth2 proto kernel scope link src 192.168.2.1 
+    192.168.2.0/24 dev eth2 proto kernel scope link src 192.168.2.1 
+    local 192.168.2.1 dev eth2 proto kernel scope host src 192.168.2.1 
+    broadcast 192.168.2.255 dev eth2 proto kernel scope link src 192.168.2.1
+    """.strip()
+
+    # Check that networkd properly configures the main routing table
+    # and the routing tables for the VRF.
+    with subtest("check vrf routing tables"):
+        compare_tables(
+            client_ipv4_table, client.succeed("ip -4 route list | head -n2").strip()
+        )
+        compare_tables(
+            vrf1_table, client.succeed("ip -4 route list table 23 | head -n4").strip()
+        )
+        compare_tables(
+            vrf2_table, client.succeed("ip -4 route list table 42 | head -n4").strip()
+        )
+
+    # Ensure that other nodes are reachable via ICMP through the VRF.
+    with subtest("icmp through vrf works"):
+        client.succeed("ping -c5 192.168.1.2")
+        client.succeed("ping -c5 192.168.2.3")
+
+    # Test whether SSH through a VRF IP is possible.
+    # (Note: this seems to be an issue on Linux 5.x, so I decided to add this to
+    # ensure that we catch this when updating the default kernel).
+    with subtest("tcp traffic through vrf works"):
+        node1.wait_for_open_port(22)
+        client.succeed(
+            "cat ${snakeOilPrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.1.2 true"
+        )
+
+    # Only configured routes through the VRF from the main routing table should
+    # work. Additional IPs are only reachable when binding to the vrf interface.
+    with subtest("only routes from main routing table work by default"):
+        client.fail("ping -c5 192.168.2.4")
+        client.succeed("ping -I vrf2 -c5 192.168.2.4")
+
+    client.shutdown()
+    node1.shutdown()
+    node2.shutdown()
+    node3.shutdown()
+  '';
+})

pkgs/applications/audio/quodlibet/default.nix

@@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [ wrapGAppsHook gettext ];
 
-  checkInputs = with python3.pkgs; [ pytest pytest_xdist pyflakes pycodestyle polib xvfb_run dbus.daemon glibcLocales ];
+  checkInputs = [ gdk-pixbuf ] ++ (with python3.pkgs; [ pytest pytest_xdist polib xvfb_run dbus.daemon glibcLocales ]);
 
   buildInputs = [ gnome3.adwaita-icon-theme libsoup glib glib-networking gtk3 webkitgtk gdk-pixbuf keybinder3 gtksourceview libmodplug libappindicator-gtk3 kakasi gobject-introspection ]
     ++ (if xineBackend then [ xineLib ] else with gst_all_1;
@@ -33,13 +33,23 @@ python3.pkgs.buildPythonApplication rec {
 
   LC_ALL = "en_US.UTF-8";
 
+  pytestFlags = stdenv.lib.optionals (xineBackend || !withGstPlugins) [
+    "--ignore=tests/plugin/test_replaygain.py"
+  ] ++ [
+    # upstream does actually not enforce source code linting
+    "--ignore=tests/quality"
+    # build failure on Arch Linux
+    # https://github.com/NixOS/nixpkgs/pull/77796#issuecomment-575841355
+    "--ignore=tests/test_operon.py"
+  ];
+
   checkPhase = ''
     runHook preCheck
-    env XDG_DATA_DIRS="$out/share:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS" \
+    env XDG_DATA_DIRS="$out/share:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_ICON_DIRS:$XDG_DATA_DIRS" \
       HOME=$(mktemp -d) \
       xvfb-run -s '-screen 0 800x600x24' dbus-run-session \
         --config-file=${dbus.daemon}/share/dbus-1/session.conf \
-        py.test${stdenv.lib.optionalString (xineBackend || !withGstPlugins) " --ignore=tests/plugin/test_replaygain.py"}
+        py.test $pytestFlags
     runHook postCheck
   '';
 
@@ -65,6 +75,5 @@ python3.pkgs.buildPythonApplication rec {
 
     maintainers = with maintainers; [ coroa sauyon ];
     homepage = https://quodlibet.readthedocs.io/en/latest/;
-    broken = true;
   };
 }

pkgs/applications/audio/rhythmbox/default.nix

@@ -17,13 +17,13 @@
 }:
 let
   pname = "rhythmbox";
-  version = "3.4.3";
+  version = "3.4.4";
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1yx3n7p9vmv23jsv98fxwq95n78awdxqm8idhyhxx2d6vk4w1hgx";
+    sha256 = "142xcvw4l19jyr5i72nbnrihs953pvrrzcbijjn9dxmxszbv03pf";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/spotify-tui/default.nix

@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-tui";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "Rigellute";
     repo = "spotify-tui";
     rev = "v${version}";
-    sha256 = "18ja0a7s6lhz6y8fmpmabv95zkcfazj0qc0dsd9dblfzzjhvmw39";
+    sha256 = "0gp7xb63icraqg7f0j91q474acph3ligzak2k8qqr9cqbgg509f4";
   };
 
   cargoSha256 = "1364z9jz3mnba3pii5h7imqlwlvbp146pcd5q8w61lsmdr2iyha2";
@@ -21,6 +21,7 @@ rustPlatform.buildRustPackage rec {
   meta = with stdenv.lib; {
     description = "Spotify for the terminal written in Rust";
     homepage = https://github.com/Rigellute/spotify-tui;
+    changelog = "https://github.com/Rigellute/spotify-tui/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ jwijenbergh ];
     platforms = platforms.all;

pkgs/applications/audio/squeezelite/default.nix

@@ -1,6 +1,9 @@
-{ stdenv, fetchFromGitHub, alsaLib, faad2, flac, libmad, libvorbis, mpg123 }:
+{ stdenv, fetchFromGitHub, alsaLib, faad2, flac, libmad, libvorbis, makeWrapper, mpg123 }:
 
-stdenv.mkDerivation {
+let
+  runtimeDeps  = [ faad2 flac libmad libvorbis mpg123 ];
+  rpath = stdenv.lib.makeLibraryPath runtimeDeps;
+in stdenv.mkDerivation {
   name = "squeezelite-git-2018-08-14";
 
   src = fetchFromGitHub {
@@ -10,7 +13,8 @@ stdenv.mkDerivation {
     sha256 = "0di3d5qy8fhawijq6bxy524fgffvzl08dprrws0fs2j1a70fs0fh";
   };
 
-  buildInputs = [ alsaLib faad2 flac libmad libvorbis mpg123 ];
+  buildInputs = [ alsaLib ] ++ runtimeDeps;
+  nativeBuildInputs = [ makeWrapper ];
 
   enableParallelBuilding = true;
 
@@ -20,6 +24,7 @@ stdenv.mkDerivation {
     install -Dm755 -t $out/bin                   squeezelite
     install -Dm644 -t $out/share/doc/squeezelite *.txt *.md
 
+    wrapProgram $out/bin/squeezelite --set LD_LIBRARY_PATH $RPATH
     runHook postInstall
   '';
 
@@ -29,4 +34,5 @@ stdenv.mkDerivation {
     license = licenses.gpl3;
     platforms = platforms.linux;
   };
+  RPATH = rpath;
 }

pkgs/applications/audio/sunvox/default.nix

@@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "SunVox";
-  version = "1.9.4c";
+  version = "1.9.5";
 
   src = fetchurl {
     url = "http://www.warmplace.ru/soft/sunvox/sunvox-${version}.zip";
-    sha256 = "19c1a4e28459e31e1a19986f219d4caa4eb2cb5bc9f6aa994abdbb2ebf6ac4ac";
+    sha256 = "011cyagbqqkvnrxxq196zsvcyn3gksjfsaas02xl8ncjwfj084di";
   };
 
   buildInputs = [ unzip ];

pkgs/applications/editors/netbeans/default.nix

@@ -3,7 +3,7 @@
 }:
 
 let
-  version = "11.1";
+  version = "11.2";
   desktopItem = makeDesktopItem {
     name = "netbeans";
     exec = "netbeans";
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
   inherit version;
   src = fetchurl {
     url = "mirror://apache/netbeans/netbeans/${version}/netbeans-${version}-bin.zip";
-    sha512 = "bb061b9258d524b7b53b3b5ee9aa95111f7a391a5e2c5c0bc949164166af9a03d0cebbde2b47a8853fb765307b4c93ce8389a9c87bef26c92c08cdf446314e4d";
+    sha512 = "d589481808832c4f0391ee1ecb8e18202cebeee8bd844cb4bdbf6125113b41f9138a34c4c2ef1fdf228294ef8c24b242ffec9ba5fdc4f1d288db4a3f19ba1509";
   };
 
   buildCommand = ''

pkgs/applications/graphics/fondo/default.nix

@@ -1,6 +1,5 @@
 { stdenv
 , fetchFromGitHub
-, fetchpatch
 , pantheon
 , vala
 , pkgconfig
@@ -15,26 +14,28 @@
 , glib-networking
 , libsoup
 , libunity
+, desktop-file-utils
 , wrapGAppsHook
 }:
 
 stdenv.mkDerivation rec {
   pname = "fondo";
-  version = "1.3.2";
+  version = "1.3.8";
 
   src = fetchFromGitHub {
     owner = "calo001";
     repo = pname;
     rev = version;
-    sha256 = "0w7qai261l9m7ckzxc2gj3ywa55wm6p5br1xdk7607ql44lfpgba";
+    sha256 = "126diirhmm2igxdpgfv1l20wnz5q8hadgq53d0j83ka72mfd3qg6";
   };
 
   nativeBuildInputs = [
+    desktop-file-utils
     meson
     ninja
-    vala
     pkgconfig
     python3
+    vala
     wrapGAppsHook
   ];
 
@@ -50,14 +51,6 @@ stdenv.mkDerivation rec {
     pantheon.granite
   ];
 
-  patches = [
-    # Fix hardcoded FHS gsettings path
-    (fetchpatch {
-      url = "https://github.com/calo001/fondo/commit/98afdd834201321a3242f0b53bfba4b2ffa04a4c.patch";
-      sha256 = "0vvgbgjja6vyrk6in3sgv8jbl4bwxkm6fhllgjzq7r65gkj4jg79";
-    })
-  ];
-
   postPatch = ''
     chmod +x meson/post_install.py
     patchShebangs meson/post_install.py

pkgs/applications/misc/blugon/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "blugon";
-  version = "1.11.4";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "jumper149";
     repo = pname;
     rev = version;
-    sha256 = "0x320w2h5nlcgha4345i8ns15akb4kmrdgkh710s4r1n1by4x11r";
+    sha256 = "0vdhq8v011awhpkccbcmigj9c46widyzh0m5knafapanai3kv7ii";
   };
 
   buildInputs = [ python3 libX11 libXrandr ];

pkgs/applications/misc/cointop/default.nix

@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "cointop";
-  version = "1.4.1";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "miguelmota";
     repo = pname;
     rev = version;
-    sha256 = "067jsn66xs30d5yz9z8cvpxbvh8a95kllkb2wk134c43bfxy2m34";
+    sha256 = "12yi1lmyd5y4cgcjclkczf93jj7wd6k8aqnhq21dd1mx65l77swv";
   };
 
   goPackagePath = "github.com/miguelmota/cointop";

pkgs/applications/misc/gpxlab/default.nix

@@ -1,4 +1,4 @@
-{ mkDerivation, lib, fetchFromGitHub, qmake, qttools, qttranslations }:
+{ stdenv, mkDerivation, lib, fetchFromGitHub, qmake, qttools, qttranslations }:
 
 mkDerivation rec {
   pname = "gpxlab";
@@ -18,6 +18,12 @@ mkDerivation rec {
     lrelease GPXLab/locale/*.ts
   '';
 
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    mkdir -p $out/Applications
+    mv GPXLab/GPXLab.app $out/Applications
+    wrapQtApp $out/Applications/GPXLab.app/Contents/MacOS/GPXLab
+  '';
+
   enableParallelBuilding = true;
 
   meta = with lib; {
@@ -29,6 +35,6 @@ mkDerivation rec {
     '';
     license = licenses.gpl3;
     maintainers = with maintainers; [ sikmir ];
-    platforms = platforms.linux;
+    platforms = with platforms; linux ++ darwin;
   };
 }

pkgs/applications/misc/hivemind/default.nix

@@ -1,10 +1,14 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ stdenv, buildGoPackage, fetchFromGitHub, runtimeShell }:
 
 buildGoPackage rec {
   pname = "hivemind";
   version = "1.0.6";
   goPackagePath = "github.com/DarthSim/hivemind";
 
+  postPatch = ''
+    substituteInPlace process.go --replace \"/bin/sh\" \"${runtimeShell}\"
+  '';
+
   src = fetchFromGitHub {
     owner = "DarthSim";
     repo = "hivemind";

pkgs/applications/misc/lutris/chrootenv.nix

@@ -69,7 +69,7 @@ in buildFHSUserEnv {
     flac
 
     # rpcs3 // TODO: "error while loading shared libraries: libz.so.1..."
-    llvm_4
+    llvm
 
     # ScummVM
     nasm sndio

pkgs/applications/misc/mkgmap/default.nix

@@ -17,12 +17,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "mkgmap";
-  version = "4289";
+  version = "4432";
 
   src = fetchsvn {
     url = "https://svn.mkgmap.org.uk/mkgmap/mkgmap/trunk";
     rev = version;
-    sha256 = "1sm1pw71q7z0jrxm8bcgm6xjl2mcidyibcf0a3m8fv2andidxrb4";
+    sha256 = "1z1ppf9v1b9clnx20v15xkmdrfw6q4h7i15drzxsdh2wl6bafzvx";
   };
 
   # This patch removes from the build process

pkgs/applications/misc/orca/default.nix

@@ -35,13 +35,13 @@
 
 buildPythonApplication rec {
   pname = "orca";
-  version = "3.34.1";
+  version = "3.34.2";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1q38n7hyshkiszmn361skxjynxr31lcms7a1iny6d0zlpmh1vnk4";
+    sha256 = "0aaagz8mxvfigrsdbmg22q44vf5yhkbw4rh4cnizysbfvijk4dan";
   };
 
   patches = [

pkgs/applications/misc/pdfpc/default.nix

@@ -1,5 +1,5 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, vala, gtk3, libgee, fetchpatch
-, poppler, libpthreadstubs, gstreamer, gst-plugins-base, librsvg, pcre, gobject-introspection, wrapGAppsHook }:
+, poppler, libpthreadstubs, gstreamer, gst-plugins-base, gst-plugins-good, gst-libav, librsvg, pcre, gobject-introspection, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   name = "${product}-${version}";
@@ -19,8 +19,15 @@ stdenv.mkDerivation rec {
     gobject-introspection
     wrapGAppsHook
   ];
-  buildInputs = [ gstreamer gst-plugins-base gtk3 libgee poppler
+
-    libpthreadstubs librsvg pcre ];
+  buildInputs = [
+    gtk3 libgee poppler
+    libpthreadstubs librsvg pcre
+    gstreamer
+    gst-plugins-base
+    (gst-plugins-good.override { gtkSupport = true; })
+    gst-libav
+  ];
 
   cmakeFlags = stdenv.lib.optional stdenv.isDarwin "-DMOVIES=OFF";
 

pkgs/applications/misc/simplenote/default.nix

@@ -16,10 +16,10 @@ let
 
   pname = "simplenote";
 
-  version = "1.12.0";
+  version = "1.14.0";
 
   sha256 = {
-    x86_64-linux = "0y9b4haaj7qxr92wnwacziljqrkf4vlyqq3rvis8ribq6zr5b24w";
+    x86_64-linux = "1l61xf1i80fd8ymmnrb3plqn70jsxd8wyg0n6f69bz3k8s5g8cxi";
   }.${system} or throwSystem;
 
   meta = with stdenv.lib; {

pkgs/applications/misc/tzupdate/default.nix

@@ -1,22 +1,22 @@
-{ stdenv, python }:
+{ stdenv, python3 }:
 
 let
-  inherit (python.pkgs) buildPythonApplication fetchPypi requests;
+  inherit (python3.pkgs) buildPythonApplication fetchPypi requests;
 in
 buildPythonApplication rec {
   pname = "tzupdate";
-  version = "1.5.0";
+  version = "2.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "13np40h64bgkcj10qw6f4nb51p47bb20fd6pzxq8xbr645a4d34m";
+    sha256 = "12jvyza9pfhazkzq94nizacknnp32lf7kalrjmpz1z2bqqxhx0fm";
   };
 
   propagatedBuildInputs = [ requests ];
 
   meta = with stdenv.lib; {
-    description = "Update timezone information based on geoip.";
+    description = "Update timezone information based on geoip";
-    homepage = https://github.com/cdown/tzupdate;
+    homepage = "https://github.com/cdown/tzupdate";
     maintainers = [ maintainers.michaelpj ];
     license = licenses.unlicense;
   };

pkgs/applications/misc/wego/default.nix

@@ -2,15 +2,15 @@
 
 buildGoPackage rec {
   pname = "wego";
-  version = "unstable-2017-04-03";
+  version = "unstable-2019-02-11";
-  rev = "415efdfab5d5ee68300bf261a0c6f630c6c2584c";
+  rev = "994e4f141759a1070d7b0c8fbe5fad2cc7ee7d45";
 
   goPackagePath = "github.com/schachmat/wego";
 
   src = fetchgit {
     inherit rev;
     url = "https://github.com/schachmat/wego";
-    sha256 = "0w8sypwg0s2mvhk9cdibqr8bz5ipiiacs60a39sdswrpc4z486hg";
+    sha256 = "1affzwi5rbp4zkirhmby8bvlhsafw7a4rs27caqwyj8g3jhczmhy";
   };
 
   goDeps = ./deps.nix;

pkgs/applications/misc/wego/deps.nix

@@ -1,11 +1,21 @@
+# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
 [
+  {
+    goPackagePath = "github.com/mattn/go-colorable";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-colorable";
+      rev = "98ec13f34aabf44cc914c65a1cfb7b9bc815aef1";
+      sha256 = "1yxcz08kminqr1221zxpibnbzfcgs3fafin0z9zqb3gqvf74jywz";
+    };
+  }
   {
     goPackagePath = "github.com/mattn/go-isatty";
     fetch = {
       type = "git";
       url = "https://github.com/mattn/go-isatty";
-      rev = "v0.0.4";
+      rev = "31745d66dd679ac0ac4f8d3ecff168fce6170c6a";
-      sha256 = "0zs92j2cqaw9j8qx1sdxpv3ap0rgbs0vrvi72m40mg8aa36gd39w";
+      sha256 = "0h671sv7hfprja495kavazkalkx7xzaqksjh13brcnwq67ijrali";
     };
   }
   {
@@ -13,17 +23,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/mattn/go-runewidth";
-      rev = "v0.0.4";
+      rev = "18c3d09a134a52720932bbaa92c798a0ab111004";
-      sha256 = "00b3ssm7wiqln3k54z2wcnxr3k3c7m1ybyhb9h8ixzbzspld0qzs";
+      sha256 = "1snr8mk63vz2h44knq26dm81p83887v7kb09iywqmx0nqzngih66";
-    };
-  }
-  {
-    goPackagePath = "github.com/mattn/go-colorable";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mattn/go-colorable";
-      rev = "v0.0.9";
-      sha256 = "1nwjmsppsjicr7anq8na6md7b1z84l9ppnlr045hhxjvbkqwalvx";
     };
   }
   {
@@ -35,4 +36,13 @@
       sha256 = "1gw0kddy7jh3467imsqni86cf9yq7k6vpfc0ywkbwj0zsjsdgd49";
     };
   }
+  {
+    goPackagePath = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev = "b016eb3dc98ea7f69ed55e8216b87187067ae621";
+      sha256 = "1k0qr26046d228gi6ngkfxp4m1rjgxk4jj75h0kh1cpyp91n5rja";
+    };
+  }
 ]

pkgs/applications/misc/worker/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "worker";
-  version = "4.1.0";
+  version = "4.2.0";
 
   src = fetchurl {
     url = "http://www.boomerangsworld.de/cms/worker/downloads/${pname}-${version}.tar.gz";
-    sha256 = "19v4g34sk4fkagk0s60rbixyrrgg22qy1xwffm8b5ffq36r7yfch";
+    sha256 = "17b845x09q0cfk12hd3f7y08diqrflrr2aj2nwf4szy4f52jk5gz";
   };
 
   buildInputs = [ libX11 ];

pkgs/applications/networking/browsers/ephemeral/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ephemeral";
-  version = "6.1.1";
+  version = "6.2.0";
 
   src = fetchFromGitHub {
     owner = "cassidyjames";
     repo = "ephemeral";
     rev = version;
-    sha256 = "1i77chbjjg8zda5bnn1wj4h00a88awfls5b3i3dqwgsi356hv4wb";
+    sha256 = "1y0n1p14kg24qnybi201181q7j6vm20ka4xwmgggjll9v6qflvaz";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/cluster/helm/default.nix

@@ -2,19 +2,18 @@
 
 buildGoModule rec {
   pname = "helm";
-  version = "3.0.1";
+  version = "3.0.3";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "0l5rmmrb6b57w1szwp6g7ad3xv0pgvc394mzjr4bi3bzcjsn7wny";
+    sha256 = "1gdrm3zz7524c8v3g128drfzdyalxlipbzxmwhalm7px4p5z4n0j";
   };
-  modSha256 = "0xjzzwmq3i77anb7w2qfnz7vc0gxq02lylj0xs6dzwl543winshm";
+  modSha256 = "1kmm6yb03g9lsz380rvf32j4icp3rcq7ixxcgsxfgpwqvq08zkn6";
 
-  goPackagePath = "k8s.io/helm";
   subPackages = [ "cmd/helm" ];
-  buildFlagsArray = [ "-ldflags=-w -s -X helm.sh/helm/v3/internal/version.gitCommit=v${version}" ];
+  buildFlagsArray = [ "-ldflags=-w -s -X helm.sh/helm/v3/internal/version.version=v${version}" ];
 
   nativeBuildInputs = [ installShellFiles ];
   postInstall = ''
@@ -27,6 +26,6 @@ buildGoModule rec {
     homepage = https://github.com/kubernetes/helm;
     description = "A package manager for kubernetes";
     license = licenses.asl20;
-    maintainers = with maintainers; [ rlupton20 edude03 saschagrunert ];
+    maintainers = with maintainers; [ rlupton20 edude03 saschagrunert Frostman ];
   };
 }

pkgs/applications/networking/cluster/k9s/default.nix

@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "k9s";
-  version = "0.9.3";
+  version = "0.13.6";
   # rev is the release commit, mainly for version command output
-  rev = "1a9a83b34cdd0c9b4e793ed6b4b5c16ea1a949a0";
+  rev = "8fedc42304ce33df314664eb0c4ac73be59065af";
 
   src = fetchFromGitHub {
     owner  = "derailed";
     repo   = "k9s";
-    rev    = version;
+    rev    = "v${version}";
-    sha256 = "0k27mfccz563r18zlbaxll305vrmrx19ym6znsikvqxlmhy86g36";
+    sha256 = "1gffbj6pgys6k3i8ikcy3yr2r9cwg0xki55yz5yg6z4a8h0jc8a6";
   };
 
   buildFlagsArray = ''
@@ -20,7 +20,7 @@ buildGoModule rec {
       -X github.com/derailed/k9s/cmd.commit=${rev}
   '';
 
-  modSha256 = "09rwbl8zd06ax5hidm5l1schwqvsr5ndlqh09w1rq9fqjijy649y";
+  modSha256 = "04k1wfhyignxy84pvq09fxvvk7pxdswbrzxvxc50dz8n8y7wcnjf";
 
   meta = with stdenv.lib; {
     description = "Kubernetes CLI To Manage Your Clusters In Style.";

pkgs/applications/networking/cluster/kompose/default.nix

@@ -1,8 +1,8 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ stdenv, buildGoPackage, fetchFromGitHub, installShellFiles }:
 
 buildGoPackage rec {
   pname = "kompose";
-  version = "1.18.0";
+  version = "1.20.0";
 
   goPackagePath = "github.com/kubernetes/kompose";
 
@@ -10,9 +10,16 @@ buildGoPackage rec {
     rev = "v${version}";
     owner = "kubernetes";
     repo = "kompose";
-    sha256 = "1hb4bs710n9fghphhfakwg42wjscf136dcr05zwwfg7iyqx2cipc";
+    sha256 = "1zgxm3zcxapav4jxh1r597rmxmlxcgns1l8w632ch7d90x5ihvll";
   };
 
+  nativeBuildInputs = [ installShellFiles ];
+  postInstall = ''
+    $bin/bin/kompose completion bash > kompose.bash
+    $bin/bin/kompose completion zsh > kompose.zsh
+    installShellCompletion kompose.{bash,zsh}
+  '';
+
   meta = with stdenv.lib; {
     description = "A tool to help users who are familiar with docker-compose move to Kubernetes";
     homepage = https://github.com/kubernetes/kompose;

pkgs/applications/networking/cluster/kubeseal/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubeseal";
-  version = "0.9.6";
+  version = "0.9.7";
 
   src = fetchFromGitHub {
     owner = "bitnami-labs";
     repo = "sealed-secrets";
     rev = "v${version}";
-    sha256 = "09ds5qn13l6l8kl2i01hgy6pqr30z1rm447ax32lf79zp8hca3r3";
+    sha256 = "01skvf8jsianyk9xq7lhcnpn3anhi4lma9bn66ngv279av147h9c";
   };
 
   modSha256 = "04dmjyz3vi2l0dfpyy42lkp2fv1vlfkvblrxh1dvb37phrkd5lbd";

pkgs/applications/networking/dat/default.nix

@@ -1,92 +0,0 @@
-{ stdenv
-, fetchurl
-, unzip
-}:
-
-stdenv.mkDerivation rec {
-  pname = "dat";
-  version = "13.13.1";
-
-  suffix = {
-    x86_64-darwin = "macos-x64";
-    x86_64-linux  = "linux-x64";
-  }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  src = fetchurl {
-    url = "https://github.com/datproject/dat/releases/download/v${version}/${pname}-${version}-${suffix}.zip";
-    sha256 = {
-      x86_64-darwin = "1qj38zn33hhr2v39jw14k2af091bafh5yvhs91h5dnjb2r8yxnaq";
-      x86_64-linux  = "0vgn57kf3j1pbfxlhj4sl1sm2gfd2gcvhk4wz5yf5mzq1vj9ivpv";
-    }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  };
-
-  buildInputs = [ unzip ];
-
-  dontConfigure = true;
-  dontBuild = true;
-  dontStrip = true;
-  dontPatchELF = true;
-
-  installPhase = ''
-    mkdir -p $out/bin
-    mv dat $out/bin
-  '';
-
-  # dat is a node program packaged using zeit/pkg.
-  # thus, it contains hardcoded offsets.
-  # patchelf shifts these locations when it expands headers.
-
-  # this could probably be generalised into allowing any program packaged
-  # with zeit/pkg to be run on nixos.
-
-  preFixup = let
-    libPath = stdenv.lib.makeLibraryPath [stdenv.cc.cc];
-  in stdenv.lib.optionalString (!stdenv.isDarwin) ''
-    orig_size=$(stat --printf=%s $out/bin/dat)
-
-    patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $out/bin/dat
-    patchelf --set-rpath ${libPath} $out/bin/dat
-    chmod +x $out/bin/dat
-
-    new_size=$(stat --printf=%s $out/bin/dat)
-
-    ###### zeit-pkg fixing starts here.
-    # we're replacing plaintext js code that looks like
-    # PAYLOAD_POSITION = '1234                  ' | 0
-    # [...]
-    # PRELUDE_POSITION = '1234                  ' | 0
-    # ^-----20-chars-----^^------22-chars------^
-    # ^-- grep points here
-    #
-    # var_* are as described above
-    # shift_by seems to be safe so long as all patchelf adjustments occur
-    # before any locations pointed to by hardcoded offsets
-
-    var_skip=20
-    var_select=22
-    shift_by=$(expr $new_size - $orig_size)
-
-    function fix_offset {
-      # $1 = name of variable to adjust
-      location=$(grep -obUam1 "$1" $out/bin/dat | cut -d: -f1)
-      location=$(expr $location + $var_skip)
-
-      value=$(dd if=$out/bin/dat iflag=count_bytes,skip_bytes skip=$location \
-                 bs=1 count=$var_select status=none)
-      value=$(expr $shift_by + $value)
-
-      echo -n $value | dd of=$out/bin/dat bs=1 seek=$location conv=notrunc
-    }
-
-    fix_offset PAYLOAD_POSITION
-    fix_offset PRELUDE_POSITION
-  '';
-
-  meta = with stdenv.lib; {
-    description = "Peer-to-peer sharing and live synchronization of files";
-    homepage = "https://dat.foundation/";
-    license = licenses.bsd3;
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
-    maintainers = with maintainers; [ prusnak ];
-  };
-}

pkgs/applications/networking/instant-messengers/riot/riot-web.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "riot-web";
-  version = "1.5.6";
+  version = "1.5.8";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "063ynbil038y201skyldj2ysr0hwgwq981w1iw104xd17x31zmn0";
+    sha256 = "112zjlmxy2s8qcd227laf1lfvbbwwcipn51xb779hy2dci48kpkx";
   };
 
   installPhase = let

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix

@@ -0,0 +1,54 @@
+{ mkDerivation, lib, fetchFromGitHub, pkg-config, python3, cmake, ninja
+, qtbase, qtimageformats, enchant, xdg_utils, ffmpeg, openalSoft, lzma
+, lz4, xxHash, zlib, minizip, openssl, libtgvoip, range-v3
+}:
+
+with lib;
+
+mkDerivation rec {
+  pname = "kotatogram-desktop";
+  version = "1.1.5";
+
+  src = fetchFromGitHub {
+    owner = "kotatogram";
+    repo = "kotatogram-desktop";
+    rev = "k${version}";
+    sha256 = "1j5wn3k1mr2c39szmyzm0pf720jmbllcaj40p2ydx0p3lir1s760";
+    fetchSubmodules = true;
+  };
+
+  postPatch = ''
+    substituteInPlace Telegram/lib_spellcheck/spellcheck/platform/linux/linux_enchant.cpp \
+      --replace '"libenchant-2.so.2"' '"${enchant}/lib/libenchant-2.so.2"'
+  '';
+
+  nativeBuildInputs = [ pkg-config python3 cmake ninja ];
+
+  buildInputs = [
+    qtbase qtimageformats ffmpeg openalSoft lzma lz4 xxHash
+    zlib minizip openssl enchant libtgvoip range-v3
+  ];
+
+  qtWrapperArgs = [
+    "--prefix PATH : ${xdg_utils}/bin"
+  ];
+
+  cmakeFlags = [
+    "-DTDESKTOP_API_TEST=ON"
+    "-DTDESKTOP_DISABLE_GTK_INTEGRATION=ON"
+    "-DDESKTOP_APP_USE_PACKAGED_RLOTTIE=OFF"
+  ];
+
+  meta = {
+    description = "Kotatogram – experimental Telegram Desktop fork";
+    longDescription = ''
+      Unofficial desktop client for the Telegram messenger, based on Telegram Desktop.
+
+      It contains some useful (or purely cosmetic) features, but they could be unstable. A detailed list is available here: https://kotatogram.github.io/changes
+    '';
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    homepage = https://kotatogram.github.io;
+    maintainers = with maintainers; [ ilya-fedin ];
+  };
+}

pkgs/applications/networking/vnstat/default.nix

@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "vnstat";
-  version = "2.4";
+  version = "2.6";
 
   src = fetchurl {
-    sha256 = "1amb8l97y6acp9j1xs2da3mdk6hykg6drzsps9im8vfmmfcmk5d0";
+    sha256 = "1xvzkxkq1sq33r2s4f1967f4gnca4xw411sbapdkx541f856w9w9";
     url = "https://humdi.net/${pname}/${pname}-${version}.tar.gz";
   };
 

pkgs/applications/office/aesop/default.nix

@@ -3,24 +3,15 @@
 
 stdenv.mkDerivation rec {
   pname = "aesop";
-  version = "1.1.3";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "lainsce";
     repo = pname;
     rev = version;
-    sha256 = "1hnwhxaz0zx4fswrxjzyv5s77v5fimn87yid9sd1qgfv2g1ck0jc";
+    sha256 = "1aa1kp1rndi2dj1d9sf8zhssn5dw183yx1fm2xccdy9zjf9wi4jk";
   };
 
-  patches = [
-    # Fix build
-    # https://github.com/lainsce/aesop/pull/33
-    (fetchpatch {
-      url = "https://github.com/lainsce/aesop/commit/850ec86bbfef5168e537a5af7e0d73d96db56330.patch";
-      sha256 = "14b251wp11rypqw4fafwjbsqy92mxzr8mmaxlv7n4whvwxrzqirh";
-    })
-  ];
-
   nativeBuildInputs = [
     desktop-file-utils
     meson

pkgs/applications/office/agenda/default.nix

@@ -0,0 +1,54 @@
+{ stdenv
+, fetchFromGitHub
+, pantheon
+, cmake
+, pkg-config
+, vala
+, gettext
+, glib
+, gtk3
+, libgee
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "agenda";
+  version = "1.0.12";
+
+  src = fetchFromGitHub {
+    owner = "dahenson";
+    repo = pname;
+    rev = version;
+    sha256 = "128c9p2jkc90imlq25xg5alqlam8q4i3gd5p1kcggf7s4amv8l8w";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    gettext
+    vala
+    pkg-config
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    glib
+    gtk3
+    libgee
+    pantheon.granite
+  ];
+
+  passthru = {
+    updateScript = pantheon.updateScript {
+      attrPath = pname;
+    };
+  };
+
+  meta = with stdenv.lib; {
+    description = "A simple, fast, no-nonsense to-do (task) list designed for elementary OS";
+    homepage = https://github.com/dahenson/agenda;
+    maintainers = with maintainers; [ kjuvi ] ++ pantheon.maintainers;
+    platforms = platforms.linux;
+    license = licenses.gpl3;
+  };
+}
+

pkgs/applications/office/tryton/default.nix

@@ -20,13 +20,13 @@ with stdenv.lib;
 
 python3Packages.buildPythonApplication rec {
   pname = "tryton";
-  version = "5.4.1";
+  version = "5.4.2";
 
   disabled = !python3Packages.isPy3k;
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "0lk47qv944yc2b1ifhinp07af839r408w83rj8zzy8b43cwkpsxd";
+    sha256 = "1rca19krvmycdhmi1vb4ixwq0cagmrkhbqry4f19b725nlp8cv0q";
   };
 
   nativeBuildInputs = [

pkgs/applications/office/zim/default.nix

@@ -9,11 +9,11 @@
 
 python3Packages.buildPythonApplication rec {
   name = "zim-${version}";
-  version = "0.72.0";
+  version = "0.72.1";
 
   src = fetchurl {
     url = "https://zim-wiki.org/downloads/${name}.tar.gz";
-    sha256 = "1n3gmg7g86s8iwcx0i7rvvfdfs1fzmc9awr9qzjd2rckw4bkxad1";
+    sha256 = "0a9h97rmp7if74p3i028cllzf9p9468psbqwcvm9009ga253dr1l";
   };
 
   buildInputs = [ gtk3 gobject-introspection wrapGAppsHook gnome3.adwaita-icon-theme ];

pkgs/applications/office/zotero/default.nix

@@ -35,11 +35,11 @@
 
 stdenv.mkDerivation rec {
   pname = "zotero";
-  version = "5.0.80";
+  version = "5.0.82";
 
   src = fetchurl {
     url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "0a5xjliml6rwxvi450l42iw6m9mk3aahnp90sr22jyijz9qii2al";
+    sha256 = "02a9dlsdd7dh56dwvsjskr899bqi8ijcvzc71xcjwaik6rp8xw88";
   };
 
   buildInputs= [ wrapGAppsHook gsettings-desktop-schemas gtk3 gnome3.adwaita-icon-theme dconf ];

pkgs/applications/radio/gqrx/default.nix

@@ -9,13 +9,13 @@ assert pulseaudioSupport -> libpulseaudio != null;
 
 mkDerivation rec {
   pname = "gqrx";
-  version = "2.11.5";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     owner = "csete";
     repo = "gqrx";
     rev = "v${version}";
-    sha256 = "0q9i0dhd6blagxzk84pzqjq8n4ym3jc1mkkhygg8yncr4vq2saaf";
+    sha256 = "00alf3q6y313xpx6p7v43vqsphd2x4am4q362lw21bcy9wc4jidw";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/radio/limesuite/default.nix

@@ -4,7 +4,7 @@
 } :
 
 let
-  version = "19.04.0";
+  version = "20.01.0";
 
 in stdenv.mkDerivation {
   pname = "limesuite";
@@ -14,7 +14,7 @@ in stdenv.mkDerivation {
     owner = "myriadrf";
     repo = "LimeSuite";
     rev = "v${version}";
-    sha256 = "1lrjrli0ny25qwg8bw1bvbdb18hf7ffqj4ziibkgzscv3w5v0s45";
+    sha256 = "01z4idcby2lm34bbnpbp400ski7p61jjiir6sy6dalnvsl52m7vx";
   };
 
   enableParallelBuilding = true;

pkgs/applications/science/chemistry/jmol/default.nix

@@ -17,14 +17,14 @@ let
   };
 in
 stdenv.mkDerivation rec {
-  version = "14.30.1";
+  version = "14.30.2";
   pname = "jmol";
 
   src = let
     baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
   in fetchurl {
     url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "0qnxsw6pjjkn6yigrfh85fz58ibqdmbv1jhf6i5q68wm5pr1ff3d";
+    sha256 = "0f9sxhxyqrd1vvmq566v1zpzzlci37pm9j7alzak766x5dg5yyz1";
   };
 
   patchPhase = ''

pkgs/applications/science/geometry/tetgen/default.nix

@@ -1,13 +1,13 @@
 {stdenv, fetchurl}: 
 
-let version = "1.5.0"; in
+let version = "1.5.1"; in
 stdenv.mkDerivation {
   pname = "tetgen";
   inherit version;
 
   src = fetchurl {
     url = "http://wias-berlin.de/software/tetgen/1.5/src/tetgen${version}.tar.gz";
-    sha256 = "1www3x2r6r7pck43ismlwy82x0j6xj2qiwvfs2pn687gsmhlh4ad";
+    sha256 = "0l5q066crs4cjj7qr0r2gnz8ajkgighngwglr1201h77lcs48sp4";
   };
 
   installPhase = ''

pkgs/applications/science/logic/abc/default.nix

@@ -1,16 +1,20 @@
 { fetchFromGitHub, stdenv, readline, cmake }:
 
-stdenv.mkDerivation {
+let
+  rev = "71f2b40320127561175ad60f6f2428f3438e5243";
+in stdenv.mkDerivation {
   pname = "abc-verifier";
-  version = "2018-07-08";
+  version = "2020-01-11";
 
   src = fetchFromGitHub {
+    inherit rev;
     owner = "berkeley-abc";
     repo = "abc";
-    rev    = "24407e13db4b8ca16c3996049b2d33ec3722de39";
+    sha256 = "15sn146ajxql7l1h8rsag5lhn4spwvgjhwzqawfr78snzadw8by3";
-    sha256 = "1rckji7nk81n6v1yajz7daqwipxacv7zlafknvmbiwji30j47sq5";
   };
 
+  passthru.rev = rev;
+
   nativeBuildInputs = [ cmake ];
   buildInputs = [ readline ];
 

pkgs/applications/science/logic/coq/default.nix

@@ -7,7 +7,7 @@
 
 { stdenv, fetchFromGitHub, writeText, pkgconfig
 , ocamlPackages, ncurses
-, buildIde ? true
+, buildIde ? !(stdenv.isDarwin && stdenv.lib.versionAtLeast version "8.10")
 , glib, gnome3, wrapGAppsHook
 , darwin
 , csdp ? null
@@ -32,7 +32,7 @@ let
    "8.10.0" = "138jw94wp4mg5dgjc2asn8ng09ayz1mxdznq342n0m469j803gzg";
    "8.10.1" = "072v2zkjzf7gj48137wpr3c9j0hg9pdhlr5l8jrgrwynld8fp7i4";
    "8.10.2" = "0znxmpy71bfw0p6x47i82jf5k7v41zbz9bdpn901ysn3ir8l3wrz";
-   "8.11+beta1" = "06dlxj6v7gd51dh6ir121z7lgqdagkq717xxxrc8bdqhz7d2z7qj";
+   "8.11.0" = "1rfdic6mp7acx2zfwz7ziqk12g95bl9nyj68z4n20a5bcjv2pxpn";
   }.${version};
   coq-version = stdenv.lib.versions.majorMinor version;
   versionAtLeast = stdenv.lib.versionAtLeast coq-version;

pkgs/applications/science/logic/saw-tools/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gmp4, ncurses, zlib, clang_35 }:
+{ stdenv, fetchurl, gmp4, ncurses, zlib, clang }:
 
 let
   libPath = stdenv.lib.makeLibraryPath
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
     ln -s ${stdenv.cc.libc}/lib/libpthread.so.0 $out/lib/libpthread.so.0
 
     # Add a clang symlink for easy building with a suitable compiler.
-    ln -s ${clang_35}/bin/clang $out/bin/saw-clang
+    ln -s ${clang}/bin/clang $out/bin/saw-clang
   '';
 
   fixupPhase = ''

pkgs/applications/science/misc/snakemake/default.nix

@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "snakemake";
-  version = "5.8.1";
+  version = "5.9.1";
 
   propagatedBuildInputs = with python3Packages; [
     appdirs
@@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1r1qi14klmxmmw7vcivp45jrjka5rcwlcfggj5npnfb378fx3hb0";
+    sha256 = "0s3y5pz9vqxpj5bx8y7ymh3zmsiyrk7sp8zwqwpva3mli7ky81pz";
   };
 
   doCheck = false; # Tests depend on Google Cloud credentials at ${HOME}/gcloud-service-key.json

pkgs/applications/version-management/git-and-tools/default.nix

@@ -103,6 +103,8 @@ let
 
   git-imerge = callPackage ./git-imerge { };
 
+  git-interactive-rebase-tool = callPackage ./git-interactive-rebase-tool {};
+
   git-machete = python3Packages.callPackage ./git-machete { };
 
   git-octopus = callPackage ./git-octopus { };

pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/01-terminaltests.patch

@@ -0,0 +1,169 @@
+--- a/src/display/utils.rs
++++ b/src/display/utils.rs
+@@ -53,166 +53,3 @@
+ 		_ => ColorMode::TwoTone,
+ 	}
+ }
+-
+-#[cfg(all(windows, test))]
+-mod tests {
+-	use crate::display::color_mode::ColorMode;
+-	use crate::display::utils::detect_color_mode;
+-
+-	#[test]
+-	fn detect_color_mode_windows() {
+-		assert_eq!(detect_color_mode(2), ColorMode::ThreeBit);
+-	}
+-}
+-
+-#[cfg(all(unix, test))]
+-mod tests {
+-	use crate::display::color_mode::ColorMode;
+-	use crate::display::utils::detect_color_mode;
+-	use std::env::{remove_var, set_var};
+-
+-	fn clear_env() {
+-		remove_var("COLORTERM");
+-		remove_var("VTE_VERSION");
+-		remove_var("TERM_PROGRAM");
+-		remove_var("TERM");
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_no_env_2_colors() {
+-		clear_env();
+-		assert_eq!(detect_color_mode(2), ColorMode::TwoTone);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_no_env_8_colors() {
+-		clear_env();
+-		assert_eq!(detect_color_mode(8), ColorMode::ThreeBit);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_no_env_less_8_colors() {
+-		clear_env();
+-		assert_eq!(detect_color_mode(7), ColorMode::TwoTone);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_no_env_16_colors() {
+-		clear_env();
+-		assert_eq!(detect_color_mode(16), ColorMode::FourBit);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_no_env_less_16_colors() {
+-		clear_env();
+-		assert_eq!(detect_color_mode(15), ColorMode::ThreeBit);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_no_env_256_colors() {
+-		clear_env();
+-		assert_eq!(detect_color_mode(256), ColorMode::EightBit);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_no_env_less_256_colors() {
+-		clear_env();
+-		assert_eq!(detect_color_mode(255), ColorMode::FourBit);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_no_env_more_256_colors() {
+-		clear_env();
+-		assert_eq!(detect_color_mode(257), ColorMode::EightBit);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_term_env_no_256() {
+-		clear_env();
+-		set_var("TERM", "XTERM");
+-		assert_eq!(detect_color_mode(0), ColorMode::TwoTone);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_term_env_with_256() {
+-		clear_env();
+-		set_var("TERM", "XTERM-256");
+-		assert_eq!(detect_color_mode(0), ColorMode::EightBit);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_term_program_env_apple_terminal() {
+-		clear_env();
+-		set_var("TERM_PROGRAM", "Apple_Terminal");
+-		assert_eq!(detect_color_mode(0), ColorMode::EightBit);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_term_program_env_iterm() {
+-		clear_env();
+-		set_var("TERM_PROGRAM", "iTerm.app");
+-		assert_eq!(detect_color_mode(0), ColorMode::EightBit);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_term_program_env_other() {
+-		clear_env();
+-		set_var("TERM_PROGRAM", "other");
+-		assert_eq!(detect_color_mode(0), ColorMode::TwoTone);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_vte_version_0_36_00() {
+-		clear_env();
+-		set_var("VTE_VERSION", "3600");
+-		assert_eq!(detect_color_mode(0), ColorMode::TrueColor);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_vte_version_greater_0_36_00() {
+-		clear_env();
+-		set_var("VTE_VERSION", "3601");
+-		assert_eq!(detect_color_mode(0), ColorMode::TrueColor);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_vte_version_less_0_36_00() {
+-		clear_env();
+-		set_var("VTE_VERSION", "1");
+-		assert_eq!(detect_color_mode(0), ColorMode::EightBit);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_vte_version_0() {
+-		clear_env();
+-		set_var("VTE_VERSION", "0");
+-		assert_eq!(detect_color_mode(0), ColorMode::TwoTone);
+-	}
+-	#[test]
+-	fn detect_color_mode_vte_version_invalid() {
+-		clear_env();
+-		set_var("VTE_VERSION", "invalid");
+-		assert_eq!(detect_color_mode(0), ColorMode::TwoTone);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_colorterm_env_is_truecolor() {
+-		clear_env();
+-		set_var("COLORTERM", "truecolor");
+-		assert_eq!(detect_color_mode(0), ColorMode::TrueColor);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_colorterm_env_is_24bit() {
+-		clear_env();
+-		set_var("COLORTERM", "24bit");
+-		assert_eq!(detect_color_mode(0), ColorMode::TrueColor);
+-	}
+-
+-	#[test]
+-	fn detect_color_mode_colorterm_env_is_other() {
+-		clear_env();
+-		set_var("COLORTERM", "other");
+-		assert_eq!(detect_color_mode(0), ColorMode::TwoTone);
+-	}
+-}

pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/default.nix

@@ -0,0 +1,27 @@
+{ lib, ncurses5, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "git-interactive-rebase-tool";
+  version = "1.2.1";
+
+  src = fetchFromGitHub {
+    owner = "MitMaro";
+    repo = pname;
+    rev = version;
+    sha256 = "10z3di2qypgsmg2z7xfs9nlrf9vng5i7l8dvqadv1l4lb9zz7i8q";
+  };
+
+  patches = [ ./01-terminaltests.patch ];
+
+  cargoSha256 = "002kr52vlpv1rhnxki29xflpmgk6bszrw0dsxcc34kyal0593ajk";
+
+  buildInputs = [ ncurses5 ];
+
+  meta = with lib; {
+    homepage = "https://github.com/MitMaro/git-interactive-rebase-tool";
+    description = "Native cross platform full feature terminal based sequence editor for git interactive rebase";
+    changelog = "https://github.com/MitMaro/git-interactive-rebase-tool/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ masaeedu ];
+  };
+}

pkgs/applications/version-management/gitlab/data.json

@@ -1,13 +1,13 @@
 {
-  "version": "12.6.4",
+  "version": "12.7.5",
-  "repo_hash": "0jsww785bxvjdrp1wsz6zkvx9zr69j24bway6nfyjkz8a7vbl9ls",
+  "repo_hash": "0jlhaakpg6bycajbhm3100gs2ka9f6iv529dvj3y1k6gysd2dpvs",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v12.6.4-ee",
+  "rev": "v12.7.5-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "1.77.1",
+    "GITALY_SERVER_VERSION": "1.83.0",
     "GITLAB_PAGES_VERSION": "1.12.0",
-    "GITLAB_SHELL_VERSION": "10.3.0",
+    "GITLAB_SHELL_VERSION": "11.0.0",
-    "GITLAB_WORKHORSE_VERSION": "8.18.0"
+    "GITLAB_WORKHORSE_VERSION": "8.20.0"
   }
 }

pkgs/applications/version-management/gitlab/gitaly/Gemfile

@@ -34,7 +34,7 @@ group :development, :test do
 
   # gitlab-shell spec gems
   gem 'listen', '~> 0.5.0'
-  gem 'simplecov', '~> 0.9.0', require: false
+  gem 'simplecov', '~> 0.17.1', require: false
   gem 'vcr', '~> 4.0.0'
   gem 'webmock', '~> 3.4.0'
 end

pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock

@@ -36,9 +36,9 @@ GEM
     concurrent-ruby (1.1.5)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
-    crass (1.0.4)
+    crass (1.0.5)
     diff-lcs (1.3)
-    docile (1.1.5)
+    docile (1.3.2)
     equalizer (0.0.11)
     erubi (1.8.0)
     escape_utils (1.2.1)
@@ -99,7 +99,7 @@ GEM
     licensee (8.9.2)
       rugged (~> 0.24)
     listen (0.5.3)
-    loofah (2.3.1)
+    loofah (2.4.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     memoizable (0.4.2)
@@ -112,9 +112,8 @@ GEM
     mini_portile2 (2.4.0)
     minitest (5.11.3)
     msgpack (1.3.1)
-    multi_json (1.13.1)
     multipart-post (2.0.0)
-    nokogiri (1.10.5)
+    nokogiri (1.10.7)
       mini_portile2 (~> 2.4.0)
     nokogumbo (1.5.0)
       nokogiri
@@ -184,11 +183,11 @@ GEM
       nokogumbo (~> 1.4)
     sentry-raven (2.9.0)
       faraday (>= 0.7.6, < 1.0)
-    simplecov (0.9.2)
+    simplecov (0.17.1)
-      docile (~> 1.1.0)
+      docile (~> 1.1)
-      multi_json (~> 1.0)
+      json (>= 1.8, < 3)
-      simplecov-html (~> 0.9.0)
+      simplecov-html (~> 0.10.0)
-    simplecov-html (0.9.0)
+    simplecov-html (0.10.2)
     stringex (2.8.5)
     thread_safe (0.3.6)
     thrift (0.11.0.0)
@@ -235,7 +234,7 @@ DEPENDENCIES
   rubocop (~> 0.69)
   rugged (~> 0.28)
   sentry-raven (~> 2.9.0)
-  simplecov (~> 0.9.0)
+  simplecov (~> 0.17.1)
   timecop
   vcr (~> 4.0.0)
   webmock (~> 3.4.0)

pkgs/applications/version-management/gitlab/gitaly/default.nix

@@ -17,14 +17,14 @@ let
       };
   };
 in buildGoPackage rec {
-  version = "1.77.1";
+  version = "1.83.0";
   pname = "gitaly";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "08xc9lxlvga36yq1wdvb1h4zk70c36qspyd7azhkw84kzwfrif1c";
+    sha256 = "1vwa38mhnxyncrrvp45d8s6fg94xaq8c71d7qh9ip77db0ak45kh";
   };
 
   # Fix a check which assumes that hook files are writeable by their

pkgs/applications/version-management/gitlab/gitaly/deps.nix

@@ -72,6 +72,24 @@
       sha256 = "1j65b91qb9sbrml9cpabfrcf07wmgzzghrl7809hjjhrmbzri5bl";
     };
   }
+  {
+    goPackagePath = "github.com/armon/consul-api";
+    fetch = {
+      type = "git";
+      url = "https://github.com/armon/consul-api";
+      rev = "eb2c6b5be1b6";
+      sha256 = "1j6fdr1sg36qy4n4xjl7brq739fpm5npq98cmvklzjc9qrx98nk9";
+    };
+  }
+  {
+    goPackagePath = "github.com/armon/go-radix";
+    fetch = {
+      type = "git";
+      url = "https://github.com/armon/go-radix";
+      rev = "7fddfc383310";
+      sha256 = "0y8chspn14n9xpsfb9gxnnf819rfpriaz64v81p7873a42kkhxb4";
+    };
+  }
   {
     goPackagePath = "github.com/aymerick/raymond";
     fetch = {
@@ -90,6 +108,15 @@
       sha256 = "17n4yygjxa6p499dj3yaqzfww2g7528165cl13haj97hlx94dgl7";
     };
   }
+  {
+    goPackagePath = "github.com/bgentry/speakeasy";
+    fetch = {
+      type = "git";
+      url = "https://github.com/bgentry/speakeasy";
+      rev = "v0.1.0";
+      sha256 = "02dfrj0wyphd3db9zn2mixqxwiz1ivnyc5xc7gkz58l5l27nzp8s";
+    };
+  }
   {
     goPackagePath = "github.com/certifi/gocertifi";
     fetch = {
@@ -144,6 +171,42 @@
       sha256 = "1jqakr3z9l60qhcgrdzsb6rlk8ikcamisw0g2ndmrf27s0ibfcaj";
     };
   }
+  {
+    goPackagePath = "github.com/coreos/etcd";
+    fetch = {
+      type = "git";
+      url = "https://github.com/coreos/etcd";
+      rev = "v3.3.10";
+      sha256 = "1x2ii1hj8jraba8rbxz6dmc03y3sjxdnzipdvg6fywnlq1f3l3wl";
+    };
+  }
+  {
+    goPackagePath = "github.com/coreos/go-etcd";
+    fetch = {
+      type = "git";
+      url = "https://github.com/coreos/go-etcd";
+      rev = "v2.0.0";
+      sha256 = "1xb34hzaa1lkbq5vkzy9vcz6gqwj7hp6cdbvyack2bf28dwn33jj";
+    };
+  }
+  {
+    goPackagePath = "github.com/coreos/go-semver";
+    fetch = {
+      type = "git";
+      url = "https://github.com/coreos/go-semver";
+      rev = "v0.2.0";
+      sha256 = "1gghi5bnqj50hfxhqc1cxmynqmh2yk9ii7ab9gsm75y5cp94ymk0";
+    };
+  }
+  {
+    goPackagePath = "github.com/cpuguy83/go-md2man";
+    fetch = {
+      type = "git";
+      url = "https://github.com/cpuguy83/go-md2man";
+      rev = "v1.0.10";
+      sha256 = "1bqkf2bvy1dns9zd24k81mh2p1zxsx2nhq5cj8dz2vgkv1xkh60i";
+    };
+  }
   {
     goPackagePath = "github.com/davecgh/go-spew";
     fetch = {
@@ -153,6 +216,15 @@
       sha256 = "0hka6hmyvp701adzag2g26cxdj47g21x6jz4sc6jjz1mn59d474y";
     };
   }
+  {
+    goPackagePath = "github.com/denisenkom/go-mssqldb";
+    fetch = {
+      type = "git";
+      url = "https://github.com/denisenkom/go-mssqldb";
+      rev = "cfbb681360f0";
+      sha256 = "0mr4y9vppiyl7mvad74k3zk4sc1jdkmc0lcd6lhm70iziw2xpncs";
+    };
+  }
   {
     goPackagePath = "github.com/dgrijalva/jwt-go";
     fetch = {
@@ -171,6 +243,15 @@
       sha256 = "152w97yckwncgw7lwjvgd8d00wy6y0nxzlvx72kl7nqqxs9vhxd9";
     };
   }
+  {
+    goPackagePath = "github.com/fatih/color";
+    fetch = {
+      type = "git";
+      url = "https://github.com/fatih/color";
+      rev = "v1.7.0";
+      sha256 = "0v8msvg38r8d1iiq2i5r4xyfx0invhc941kjrsg5gzwvagv55inv";
+    };
+  }
   {
     goPackagePath = "github.com/fatih/structs";
     fetch = {
@@ -288,6 +369,15 @@
       sha256 = "01ip3mwbnm5isq120ww73yrvbcn6n5944prhhbyf2ggyf6g46ylh";
     };
   }
+  {
+    goPackagePath = "github.com/go-sql-driver/mysql";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-sql-driver/mysql";
+      rev = "v1.4.1";
+      sha256 = "1fvsvwc1v2i0gqn01mynvi1shp5xm0xaym6xng09fcbqb56lbjx1";
+    };
+  }
   {
     goPackagePath = "github.com/go-stack/stack";
     fetch = {
@@ -297,6 +387,42 @@
       sha256 = "0wk25751ryyvxclyp8jdk5c3ar0cmfr8lrjb66qbg4808x66b96v";
     };
   }
+  {
+    goPackagePath = "github.com/gobuffalo/envy";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gobuffalo/envy";
+      rev = "v1.7.1";
+      sha256 = "1s1f05cgpkhgcs2qfh04ixxm1ggk8ms3fpwsxhb0mx7nfrcm106d";
+    };
+  }
+  {
+    goPackagePath = "github.com/gobuffalo/logger";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gobuffalo/logger";
+      rev = "v1.0.1";
+      sha256 = "1w6rkz0xwq3xj3giwzjkfnai69a0cgg09zx01z7s8r5z450cish3";
+    };
+  }
+  {
+    goPackagePath = "github.com/gobuffalo/packd";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gobuffalo/packd";
+      rev = "v0.3.0";
+      sha256 = "02sg33jkp219g0z3yf2fn9xm2zds1qxzdznx5mh8vffh4njjg1x8";
+    };
+  }
+  {
+    goPackagePath = "github.com/gobuffalo/packr";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gobuffalo/packr";
+      rev = "v2.7.1";
+      sha256 = "0m5kl2fq8gf1v4vllgag2xl8fd382sdgqrcdb8f5alsnrdn08kb9";
+    };
+  }
   {
     goPackagePath = "github.com/gogo/protobuf";
     fetch = {
@@ -306,6 +432,15 @@
       sha256 = "1525pq7r6h3s8dncvq8gxi893p2nq8dxpzvq0nfl5b4p6mq0v1c2";
     };
   }
+  {
+    goPackagePath = "github.com/golang-sql/civil";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang-sql/civil";
+      rev = "cb61b32ac6fe";
+      sha256 = "0yadfbvi0w06lg3sxw0daji02jxd3vv2in26yfmwpl4vd4vm9zay";
+    };
+  }
   {
     goPackagePath = "github.com/golang/glog";
     fetch = {
@@ -405,6 +540,33 @@
       sha256 = "1lzk54h7np32b3acidg1ggbn8ppbnns0m71gcg9d1qkkdh8zrijl";
     };
   }
+  {
+    goPackagePath = "github.com/hashicorp/errwrap";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/errwrap";
+      rev = "v1.0.0";
+      sha256 = "0slfb6w3b61xz04r32bi0a1bygc82rjzhqkxj2si2074wynqnr1c";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/go-multierror";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/go-multierror";
+      rev = "v1.0.0";
+      sha256 = "00nyn8llqzbfm8aflr9kwsvpzi4kv8v45c141v88xskxp5xf6z49";
+    };
+  }
+  {
+    goPackagePath = "github.com/hashicorp/hcl";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/hcl";
+      rev = "v1.0.0";
+      sha256 = "0q6ml0qqs0yil76mpn4mdx4lp94id8vbv575qm60jzl1ijcl5i66";
+    };
+  }
   {
     goPackagePath = "github.com/hpcloud/tail";
     fetch = {
@@ -423,6 +585,15 @@
       sha256 = "180h3pf2p0pch6hmqf45wk7wd87md83d3p122f8ll43x5nja5mph";
     };
   }
+  {
+    goPackagePath = "github.com/inconshreveable/mousetrap";
+    fetch = {
+      type = "git";
+      url = "https://github.com/inconshreveable/mousetrap";
+      rev = "v1.0.0";
+      sha256 = "1mn0kg48xkd74brf48qf5hzp0bc6g8cf5a77w895rl3qnlpfw152";
+    };
+  }
   {
     goPackagePath = "github.com/iris-contrib/blackfriday";
     fetch = {
@@ -459,6 +630,15 @@
       sha256 = "126c50c6r5l2gdn60jirpb54pqwswxag3wgrv6wcn998h9w9gv8c";
     };
   }
+  {
+    goPackagePath = "github.com/joho/godotenv";
+    fetch = {
+      type = "git";
+      url = "https://github.com/joho/godotenv";
+      rev = "v1.3.0";
+      sha256 = "0ri8if0pc3x6jg4c3i8wr58xyfpxkwmcjk3rp8gb398a1aa3gpjm";
+    };
+  }
   {
     goPackagePath = "github.com/json-iterator/go";
     fetch = {
@@ -675,6 +855,15 @@
       sha256 = "10n5r66g44s6rnz5kf86s4a3p1g55kc1kxqhnk7bx7mlayndgpmb";
     };
   }
+  {
+    goPackagePath = "github.com/magiconair/properties";
+    fetch = {
+      type = "git";
+      url = "https://github.com/magiconair/properties";
+      rev = "v1.8.0";
+      sha256 = "1a10362wv8a8qwb818wygn2z48lgzch940hvpv81hv8gc747ajxn";
+    };
+  }
   {
     goPackagePath = "github.com/mattn/go-colorable";
     fetch = {
@@ -693,6 +882,24 @@
       sha256 = "0i3km37lajahh1y2392g4hpgvq05arcgiiv93yhzxxyv0fpqj72m";
     };
   }
+  {
+    goPackagePath = "github.com/mattn/go-runewidth";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-runewidth";
+      rev = "v0.0.4";
+      sha256 = "00b3ssm7wiqln3k54z2wcnxr3k3c7m1ybyhb9h8ixzbzspld0qzs";
+    };
+  }
+  {
+    goPackagePath = "github.com/mattn/go-sqlite3";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mattn/go-sqlite3";
+      rev = "v1.12.0";
+      sha256 = "0di8zy6202sbs0p9kx8lpii77ir5jwjhg6z0796y3nfvw87wk9iv";
+    };
+  }
   {
     goPackagePath = "github.com/mattn/goveralls";
     fetch = {
@@ -720,6 +927,33 @@
       sha256 = "0j0aylsxqjcj49w7ph8cmpaqjlpvg7mb5mrcrd9bg71dlb9z9ir2";
     };
   }
+  {
+    goPackagePath = "github.com/mitchellh/cli";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/cli";
+      rev = "v1.0.0";
+      sha256 = "1i9kmr7rcf10d2hji8h4247hmc0nbairv7a0q51393aw2h1bnwg2";
+    };
+  }
+  {
+    goPackagePath = "github.com/mitchellh/go-homedir";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/go-homedir";
+      rev = "v1.1.0";
+      sha256 = "0ydzkipf28hwj2bfxqmwlww47khyk6d152xax4bnyh60f4lq3nx1";
+    };
+  }
+  {
+    goPackagePath = "github.com/mitchellh/mapstructure";
+    fetch = {
+      type = "git";
+      url = "https://github.com/mitchellh/mapstructure";
+      rev = "v1.1.2";
+      sha256 = "03bpv28jz9zhn4947saqwi328ydj7f6g6pf1m2d4m5zdh5jlfkrr";
+    };
+  }
   {
     goPackagePath = "github.com/modern-go/concurrent";
     fetch = {
@@ -756,6 +990,15 @@
       sha256 = "0nbrnpk7bkmqg9mzwsxlm0y8m7s9qd9phr1q30qlx2qmdmz7c1mf";
     };
   }
+  {
+    goPackagePath = "github.com/olekukonko/tablewriter";
+    fetch = {
+      type = "git";
+      url = "https://github.com/olekukonko/tablewriter";
+      rev = "v0.0.2";
+      sha256 = "1f4mwdh501p8105nfxayprlj5ld14fwzyyy2wbc04xk3wrm1wzlf";
+    };
+  }
   {
     goPackagePath = "github.com/onsi/ginkgo";
     fetch = {
@@ -783,6 +1026,15 @@
       sha256 = "0i0ghg94dg8lk05mw5n23983wq04yjvkjmdkc9z5y1f3508938h9";
     };
   }
+  {
+    goPackagePath = "github.com/pelletier/go-toml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pelletier/go-toml";
+      rev = "v1.2.0";
+      sha256 = "1fjzpcjng60mc3a4b2ql5a00d5gah84wj740dabv9kq67mpg8fxy";
+    };
+  }
   {
     goPackagePath = "github.com/philhofer/fwd";
     fetch = {
@@ -819,6 +1071,15 @@
       sha256 = "0c1cn55m4rypmscgf0rrb88pn58j3ysvc2d0432dp3c6fqg6cnzw";
     };
   }
+  {
+    goPackagePath = "github.com/posener/complete";
+    fetch = {
+      type = "git";
+      url = "https://github.com/posener/complete";
+      rev = "v1.1.1";
+      sha256 = "1nbdiybjizbaxbf5q0xwbq0cjqw4bl6jggvsjzrpif0w86fcjda2";
+    };
+  }
   {
     goPackagePath = "github.com/prometheus/client_golang";
     fetch = {
@@ -855,6 +1116,33 @@
       sha256 = "18c4m795fwng8f8qa395f3crvamlbk5y5afk8b5rzyisnmjq774y";
     };
   }
+  {
+    goPackagePath = "github.com/rogpeppe/go-internal";
+    fetch = {
+      type = "git";
+      url = "https://github.com/rogpeppe/go-internal";
+      rev = "v1.4.0";
+      sha256 = "17wisy8bapx5ki0gpissm8dvv7x0lmdnrl1fka75g05kpbyv6g2n";
+    };
+  }
+  {
+    goPackagePath = "github.com/rubenv/sql-migrate";
+    fetch = {
+      type = "git";
+      url = "https://github.com/rubenv/sql-migrate";
+      rev = "06338513c237";
+      sha256 = "0z7y7vsnzjswx51g9hlawnzmwnb8c7rks6ljzf6m1xbimhi4n3kz";
+    };
+  }
+  {
+    goPackagePath = "github.com/russross/blackfriday";
+    fetch = {
+      type = "git";
+      url = "https://github.com/russross/blackfriday";
+      rev = "v1.5.2";
+      sha256 = "0jzbfzcywqcrnym4gxlz6nphmm1grg6wsl4f0r9x384rn83wkj7c";
+    };
+  }
   {
     goPackagePath = "github.com/ryanuber/columnize";
     fetch = {
@@ -896,8 +1184,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/sirupsen/logrus";
-      rev = "v1.3.0";
+      rev = "v1.4.2";
-      sha256 = "0ib7k8cwxn53dyxd3af1g81z018n77n6q64pm4miznirf7c2c9gk";
+      sha256 = "087k2lxrr9p9dh68yw71d05h5g9p5v26zbwd6j7lghinjfaw334x";
     };
   }
   {
@@ -918,6 +1206,60 @@
       sha256 = "07zjxwszayal88z1j2bwnqrsa32vg8l4nivks5yfr9j8xfsw7n6m";
     };
   }
+  {
+    goPackagePath = "github.com/spf13/afero";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/afero";
+      rev = "v1.1.2";
+      sha256 = "0miv4faf5ihjfifb1zv6aia6f6ik7h1s4954kcb8n6ixzhx9ck6k";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/cast";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/cast";
+      rev = "v1.3.0";
+      sha256 = "0xq1ffqj8y8h7dcnm0m9lfrh0ga7pssnn2c1dnr09chqbpn4bdc5";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/cobra";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/cobra";
+      rev = "v0.0.5";
+      sha256 = "0z4x8js65mhwg1gf6sa865pdxfgn45c3av9xlcc1l3xjvcnx32v2";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/jwalterweatherman";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/jwalterweatherman";
+      rev = "v1.0.0";
+      sha256 = "093fmmvavv84pv4q84hav7ph3fmrq87bvspjj899q0qsx37yvdr8";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/pflag";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/pflag";
+      rev = "v1.0.3";
+      sha256 = "1cj3cjm7d3zk0mf1xdybh0jywkbbw7a6yr3y22x9sis31scprswd";
+    };
+  }
+  {
+    goPackagePath = "github.com/spf13/viper";
+    fetch = {
+      type = "git";
+      url = "https://github.com/spf13/viper";
+      rev = "v1.3.2";
+      sha256 = "1829hvf805kda65l59r17wvid7y0vr390s23zfhf4w7vdb4wp3zh";
+    };
+  }
   {
     goPackagePath = "github.com/stretchr/objx";
     fetch = {
@@ -1053,6 +1395,15 @@
       sha256 = "10gn5y4l72zknj21mff29d9vnk4pz7jnw39xnlsb373lsiih91xg";
     };
   }
+  {
+    goPackagePath = "github.com/xordataexchange/crypt";
+    fetch = {
+      type = "git";
+      url = "https://github.com/xordataexchange/crypt";
+      rev = "b2862e3d0a77";
+      sha256 = "04q3856anpzl4gdfgmg7pbp9cx231nkz3ymq2xp27rnmmwhfxr8y";
+    };
+  }
   {
     goPackagePath = "github.com/yalp/jsonpath";
     fetch = {
@@ -1089,6 +1440,15 @@
       sha256 = "18vbc7jagnjw1wpvhqjffl0np7bzzqdd9jpdcisvj5h85lbyn5gk";
     };
   }
+  {
+    goPackagePath = "github.com/ziutek/mymysql";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ziutek/mymysql";
+      rev = "v1.5.4";
+      sha256 = "172s7sv5bgc40x81k18hypf9c4n8hn9v5w5zwyr4mi5prbavqcci";
+    };
+  }
   {
     goPackagePath = "gitlab.com/gitlab-org/labkit";
     fetch = {
@@ -1130,8 +1490,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/net";
-      rev = "d28f0bde5980";
+      rev = "3b0461eec859";
-      sha256 = "18xj31h70m7xxb7gc86n9i21w6d7djbjz67zfaljm4jqskz6hxkf";
+      sha256 = "0l00c8l0a8xnv6qdpwfzxxsr58jggacgzdrwiprrfx2xqm37b6d5";
     };
   }
   {
@@ -1148,8 +1508,8 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/sync";
-      rev = "112230192c58";
+      rev = "cd5d95a43a6e";
-      sha256 = "05i2k43j2d0llq768hg5pf3hb2yhfzp9la1w5wp0rsnnzblr0lfn";
+      sha256 = "1nqkyz2y1qvqcma52ijh02s8aiqmkfb95j08f6zcjhbga3ds6hds";
     };
   }
   {
@@ -1175,8 +1535,17 @@
     fetch = {
       type = "git";
       url = "https://go.googlesource.com/tools";
-      rev = "2c0ae7006135";
+      rev = "72853e10c5a3";
-      sha256 = "1lsi2ssxajclj3bciz2a41v1vjv768ja3v6wnbyhxy8xphwkp4fk";
+      sha256 = "06v42k857lcivcar3fq8yjc782hny0m5yf20sb7ij5jva0gab026";
+    };
+  }
+  {
+    goPackagePath = "golang.org/x/xerrors";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/xerrors";
+      rev = "a985d3407aa7";
+      sha256 = "00wzr5w8aadipgc3rkk8f11i41znskfj9ix5nhhaxyg7isrslgcj";
     };
   }
   {
@@ -1184,8 +1553,8 @@
     fetch = {
       type = "git";
       url = "https://github.com/golang/appengine";
-      rev = "v1.1.0";
+      rev = "v1.6.5";
-      sha256 = "1pz202zszg8f35dk5pfhwgcdi3r6dx1l4yk6x6ly7nb4j45zi96x";
+      sha256 = "05hbq4cs7bqw0zl17bx8rzdkszid3nyl92100scg3jjrg70dhm7w";
     };
   }
   {
@@ -1233,6 +1602,15 @@
       sha256 = "0v3bim0j375z81zrpr5qv42knqs0y2qv2vkjiqi5axvb78slki1a";
     };
   }
+  {
+    goPackagePath = "gopkg.in/errgo.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/errgo.v2";
+      rev = "v2.1.0";
+      sha256 = "065mbihiy7q67wnql0bzl9y1kkvck5ivra68254zbih52jxwrgr2";
+    };
+  }
   {
     goPackagePath = "gopkg.in/fsnotify.v1";
     fetch = {
@@ -1260,6 +1638,15 @@
       sha256 = "1m2i48ph5a3kw9nlw2srx8i04v7chicds2hlzlrfm15045crga55";
     };
   }
+  {
+    goPackagePath = "gopkg.in/gorp.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/gorp.v1";
+      rev = "v1.7.2";
+      sha256 = "0zwkq4cv71vp7cmpfcs54908g1amr0cdxv1b8h1icf64jjawb1lb";
+    };
+  }
   {
     goPackagePath = "gopkg.in/mgo.v2";
     fetch = {
@@ -1283,8 +1670,8 @@
     fetch = {
       type = "git";
       url = "https://gopkg.in/yaml.v2";
-      rev = "v2.2.2";
+      rev = "v2.2.5";
-      sha256 = "01wj12jzsdqlnidpyjssmj0r4yavlqy7dwrg7adqd8dicjc4ncsa";
+      sha256 = "08smz8dfyxp02ha74my9iszqa5qzgl3ksi28ilyp8lqipssiq6fg";
     };
   }
   {

pkgs/applications/version-management/gitlab/gitaly/gemset.nix

@@ -133,12 +133,14 @@
     version = "0.4.3";
   };
   crass = {
+    groups = ["default"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0bpxzy6gjw9ggjynlxschbfsgmx8lv3zw1azkjvnb8b9i895dqfi";
+      sha256 = "030sc98kjrb36rh7g21qsbdfxrj6knsjkx0mn3b7gig8zknwhp2f";
       type = "gem";
     };
-    version = "1.0.4";
+    version = "1.0.5";
   };
   diff-lcs = {
     source = {
@@ -149,12 +151,14 @@
     version = "1.3";
   };
   docile = {
+    groups = ["default" "development" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0m8j31whq7bm5ljgmsrlfkiqvacrw6iz9wq10r3gwrv5785y8gjx";
+      sha256 = "0qrwiyagxzl8zlx3dafb0ay8l14ib7imb2rsmx70i5cp420v8gif";
       type = "gem";
     };
-    version = "1.1.5";
+    version = "1.3.2";
   };
   equalizer = {
     source = {
@@ -418,10 +422,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0npqav026zd7r4qdidq9x5nxcp2dzg71bnp421xxx7sngbxf2xbd";
+      sha256 = "1g7ps9m3s14cajhxrfgbzahv9i3gy47s4hqrv3mpybpj5cyr0srn";
       type = "gem";
     };
-    version = "2.3.1";
+    version = "2.4.0";
   };
   memoizable = {
     dependencies = ["thread_safe"];
@@ -495,14 +499,6 @@
     };
     version = "1.3.1";
   };
-  multi_json = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1rl0qy4inf1mp8mybfk56dfga0mvx97zwpmq5xmiwl5r770171nv";
-      type = "gem";
-    };
-    version = "1.13.1";
-  };
   multipart-post = {
     source = {
       remotes = ["https://rubygems.org"];
@@ -517,10 +513,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "185g3dwba73jqxjr94bd2zk6fil6n9hmcfnfyzh3p1w47vm296r7";
+      sha256 = "0r0qpgf80h764k176yr63gqbs2z0xbsp8vlvs2a79d5r9vs83kln";
       type = "gem";
     };
-    version = "1.10.5";
+    version = "1.10.7";
   };
   nokogumbo = {
     dependencies = ["nokogiri"];
@@ -827,21 +823,25 @@
     version = "2.9.0";
   };
   simplecov = {
-    dependencies = ["docile" "multi_json" "simplecov-html"];
+    dependencies = ["docile" "json" "simplecov-html"];
+    groups = ["development" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1a3wy9zlmfwl3f47cibnxyxrgfz16y6fmy0dj1vyidzyys4mvy12";
+      sha256 = "1135k46nik05sdab30yxb8264lqiz01c8v000g16cl9pjc4mxrdw";
       type = "gem";
     };
-    version = "0.9.2";
+    version = "0.17.1";
   };
   simplecov-html = {
+    groups = ["default" "development" "test"];
+    platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0jv9pmpaxihrcsgcf6mgl3qg7rhf9scl5l2k67d768w9cz63xgvc";
+      sha256 = "1lihraa4rgxk8wbfl77fy9sf0ypk31iivly8vl3w04srd7i0clzn";
       type = "gem";
     };
-    version = "0.9.0";
+    version = "0.10.2";
   };
   stringex = {
     groups = ["default"];

pkgs/applications/version-management/gitlab/gitlab-shell/default.nix

@@ -2,12 +2,12 @@
 
 buildGoPackage rec {
   pname = "gitlab-shell-go";
-  version = "10.3.0";
+  version = "11.0.0";
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${version}";
-    sha256 = "0kxbw2n5kabh0876xqn1dcjbxyrp82ms566rw065nqrb32g8c2hk";
+    sha256 = "1ca4yil8gp1cm7w939irp1x2y907z2mkdqiap8ik8mqp8svv1m44";
   };
 
   buildInputs = [ ruby ];

pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix

@@ -3,13 +3,13 @@
 buildGoPackage rec {
   pname = "gitlab-workhorse";
 
-  version = "8.18.0";
+  version = "8.20.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-workhorse";
     rev = "v${version}";
-    sha256 = "0qsbz8gv9r9wfvxsh9mpspgs2gyyidxdz5n9n7ibfy7z129mx4ak";
+    sha256 = "0a64qrbyxvpqgf5ksczn3kisbhyx6fcw58g5nlag4jnjj6w5i0wr";
   };
 
   goPackagePath = "gitlab.com/gitlab-org/gitlab-workhorse";

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile

@@ -19,7 +19,7 @@ gem 'default_value_for', '~> 3.3.0'
 gem 'pg', '~> 1.1'
 
 gem 'rugged', '~> 0.28'
-gem 'grape-path-helpers', '~> 1.1'
+gem 'grape-path-helpers', '~> 1.2'
 
 gem 'faraday', '~> 0.12'
 gem 'marginalia', '~> 1.8.0'
@@ -65,7 +65,7 @@ gem 'u2f', '~> 0.2.1'
 
 # GitLab Pages
 gem 'validates_hostname', '~> 1.0.6'
-gem 'rubyzip', '~> 1.3.0', require: 'zip'
+gem 'rubyzip', '~> 2.0.0', require: 'zip'
 # GitLab Pages letsencrypt support
 gem 'acme-client', '~> 2.0.2'
 
@@ -129,26 +129,26 @@ gem 'unf', '~> 0.1.4'
 gem 'seed-fu', '~> 2.3.7'
 
 # Search
-gem 'elasticsearch-model', '~> 0.1.9'
+gem 'elasticsearch-model', '~> 6.1'
-gem 'elasticsearch-rails', '~> 0.1.9', require: 'elasticsearch/rails/instrumentation'
+gem 'elasticsearch-rails', '~> 6.1', require: 'elasticsearch/rails/instrumentation'
-gem 'elasticsearch-api',   '5.0.3'
+gem 'elasticsearch-api',   '~> 6.8'
 gem 'aws-sdk'
 gem 'faraday_middleware-aws-signers-v4'
 
 # Markdown and HTML processing
 gem 'html-pipeline', '~> 2.12'
-gem 'deckar01-task_list', '2.2.1'
+gem 'deckar01-task_list', '2.3.1'
 gem 'gitlab-markup', '~> 1.7.0'
 gem 'github-markup', '~> 1.7.0', require: 'github/markup'
 gem 'commonmarker', '~> 0.20'
 gem 'RedCloth', '~> 4.3.2'
-gem 'rdoc', '~> 6.0'
+gem 'rdoc', '~> 6.1.2'
 gem 'org-ruby', '~> 0.9.12'
 gem 'creole', '~> 0.5.0'
 gem 'wikicloth', '0.8.1'
 gem 'asciidoctor', '~> 2.0.10'
 gem 'asciidoctor-include-ext', '~> 0.3.1', require: false
-gem 'asciidoctor-plantuml', '0.0.9'
+gem 'asciidoctor-plantuml', '0.0.10'
 gem 'rouge', '~> 3.11.0'
 gem 'truncato', '~> 0.7.11'
 gem 'bootstrap_form', '~> 4.2.0'
@@ -249,7 +249,7 @@ gem 'asana', '~> 0.9'
 gem 'ruby-fogbugz', '~> 0.2.1'
 
 # Kubernetes integration
-gem 'kubeclient', '~> 4.4.0'
+gem 'kubeclient', '~> 4.6.0'
 
 # Sanitize user input
 gem 'sanitize', '~> 4.6'
@@ -283,7 +283,7 @@ gem 'rack-proxy', '~> 0.6.0'
 gem 'sassc-rails', '~> 2.1.0'
 gem 'uglifier', '~> 2.7.2'
 
-gem 'addressable', '~> 2.5.2'
+gem 'addressable', '~> 2.7'
 gem 'font-awesome-rails', '~> 4.7'
 gem 'gemojione', '~> 3.3'
 gem 'gon', '~> 6.2'
@@ -301,7 +301,7 @@ gem 'sentry-raven', '~> 2.9'
 gem 'premailer-rails', '~> 1.10.3'
 
 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '~> 0.5'
+gem 'gitlab-labkit', '0.8.0'
 
 # I18n
 gem 'ruby_parser', '~> 3.8', require: false
@@ -366,11 +366,11 @@ group :development, :test do
   gem 'spring', '~> 2.0.0'
   gem 'spring-commands-rspec', '~> 1.0.4'
 
-  gem 'gitlab-styles', '~> 2.7', require: false
+  gem 'gitlab-styles', '~> 3.1.0', require: false
   # Pin these dependencies, otherwise a new rule could break the CI pipelines
-  gem 'rubocop', '~> 0.69.0'
+  gem 'rubocop', '~> 0.74.0'
-  gem 'rubocop-performance', '~> 1.1.0'
+  gem 'rubocop-performance', '~> 1.4.1'
-  gem 'rubocop-rspec', '~> 1.22.1'
+  gem 'rubocop-rspec', '~> 1.37.0'
 
   gem 'scss_lint', '~> 0.56.0', require: false
   gem 'haml_lint', '~> 0.34.0', require: false
@@ -386,6 +386,10 @@ group :development, :test do
   gem 'simple_po_parser', '~> 1.1.2', require: false
 
   gem 'timecop', '~> 0.8.0'
+
+  gem 'png_quantizator', '~> 0.2.1', require: false
+
+  gem 'parallel', '~> 1.19', require: false
 end
 
 # Gems required in omnibus-gitlab pipeline
@@ -415,7 +419,7 @@ group :test do
   gem 'guard-rspec'
 end
 
-gem 'octokit', '~> 4.9'
+gem 'octokit', '~> 4.15'
 
 gem 'mail_room', '~> 0.10.0'
 
@@ -452,13 +456,13 @@ group :ed25519 do
 end
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 1.73.0'
+gem 'gitaly', '~> 1.81.0'
 
 gem 'grpc', '~> 1.24.0'
 
 gem 'google-protobuf', '~> 3.8.0'
 
-gem 'toml-rb', '~> 1.0.0', require: false
+gem 'toml-rb', '~> 1.0.0'
 
 # Feature toggles
 gem 'flipper', '~> 0.17.1'
@@ -477,3 +481,8 @@ gem 'gitlab-net-dns', '~> 0.9.1'
 gem 'countries', '~> 3.0'
 
 gem 'retriable', '~> 3.1.2'
+
+gem 'liquid', '~> 4.0'
+
+# LRU cache
+gem 'lru_redux'

pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock

@@ -55,8 +55,8 @@ GEM
     adamantium (0.2.0)
       ice_nine (~> 0.11.0)
       memoizable (~> 0.4.0)
-    addressable (2.5.2)
+    addressable (2.7.0)
-      public_suffix (>= 2.0.2, < 4.0)
+      public_suffix (>= 2.0.2, < 5.0)
     aes_key_wrap (1.0.1)
     akismet (3.0.0)
     apollo_upload_server (2.0.0.beta.3)
@@ -71,7 +71,7 @@ GEM
     asciidoctor (2.0.10)
     asciidoctor-include-ext (0.3.1)
       asciidoctor (>= 1.5.6, < 3.0.0)
-    asciidoctor-plantuml (0.0.9)
+    asciidoctor-plantuml (0.0.10)
       asciidoctor (>= 1.5.6, < 3.0.0)
     ast (2.4.0)
     atlassian-jwt (0.2.0)
@@ -117,7 +117,7 @@ GEM
       activemodel (>= 5.0)
     brakeman (4.2.1)
     browser (2.5.3)
-    builder (3.2.3)
+    builder (3.2.4)
     bullet (6.0.2)
       activesupport (>= 3.0.0)
       uniform_notifier (~> 1.11)
@@ -192,7 +192,7 @@ GEM
     database_cleaner (1.7.0)
     debug_inspector (0.0.3)
     debugger-ruby_core_source (1.3.8)
-    deckar01-task_list (2.2.1)
+    deckar01-task_list (2.3.1)
       html-pipeline
     declarative (0.0.10)
     declarative-option (0.1.0)
@@ -235,17 +235,17 @@ GEM
       doorkeeper (~> 4.3)
       json-jwt (~> 1.6)
     ed25519 (1.2.4)
-    elasticsearch (5.0.3)
+    elasticsearch (6.8.0)
-      elasticsearch-api (= 5.0.3)
+      elasticsearch-api (= 6.8.0)
-      elasticsearch-transport (= 5.0.3)
+      elasticsearch-transport (= 6.8.0)
-    elasticsearch-api (5.0.3)
+    elasticsearch-api (6.8.0)
       multi_json
-    elasticsearch-model (0.1.9)
+    elasticsearch-model (6.1.0)
       activesupport (> 3)
-      elasticsearch (> 0.4)
+      elasticsearch (> 1)
       hashie
-    elasticsearch-rails (0.1.9)
+    elasticsearch-rails (6.1.0)
-    elasticsearch-transport (5.0.3)
+    elasticsearch-transport (6.8.0)
       faraday
       multi_json
     email_reply_trimmer (0.1.6)
@@ -260,7 +260,7 @@ GEM
     et-orbi (1.2.1)
       tzinfo
     eventmachine (1.2.7)
-    excon (0.62.0)
+    excon (0.71.1)
     execjs (2.6.0)
     expression_parser (0.9.0)
     extended-markdown-filter (0.6.0)
@@ -270,7 +270,7 @@ GEM
     factory_bot_rails (5.1.0)
       factory_bot (~> 5.1.0)
       railties (>= 4.2.0)
-    faraday (0.12.2)
+    faraday (0.15.4)
       multipart-post (>= 1.2, < 3)
     faraday-http-cache (2.0.0)
       faraday (~> 0.8)
@@ -286,6 +286,9 @@ GEM
     fast_gettext (1.6.0)
     ffaker (2.10.0)
     ffi (1.11.3)
+    ffi-compiler (1.0.1)
+      ffi (>= 1.0.0)
+      rake
     flipper (0.17.1)
     flipper-active_record (0.17.1)
       activerecord (>= 4.2, < 7)
@@ -357,12 +360,12 @@ GEM
       po_to_json (>= 1.0.0)
       rails (>= 3.2.0)
     git (1.5.0)
-    gitaly (1.73.0)
+    gitaly (1.81.0)
       grpc (~> 1.0)
     github-markup (1.7.0)
     gitlab-chronic (0.10.5)
       numerizer (~> 0.2)
-    gitlab-labkit (0.7.0)
+    gitlab-labkit (0.8.0)
       actionpack (>= 5.0.0, < 6.1.0)
       activesupport (>= 5.0.0, < 6.1.0)
       grpc (~> 1.19)
@@ -379,11 +382,12 @@ GEM
       gitlab-puma (>= 2.7, < 5)
     gitlab-sidekiq-fetcher (0.5.2)
       sidekiq (~> 5)
-    gitlab-styles (2.8.0)
+    gitlab-styles (3.1.0)
-      rubocop (~> 0.69.0)
+      rubocop (~> 0.74.0)
       rubocop-gitlab-security (~> 0.1.0)
-      rubocop-performance (~> 1.1.0)
+      rubocop-performance (~> 1.4.1)
-      rubocop-rspec (~> 1.19)
+      rubocop-rails (~> 2.0)
+      rubocop-rspec (~> 1.36)
     gitlab_chronic_duration (0.10.6.2)
       numerizer (~> 0.2)
     gitlab_omniauth-ldap (2.1.1)
@@ -426,7 +430,7 @@ GEM
     grape-entity (0.7.1)
       activesupport (>= 4.0)
       multi_json (>= 1.3.2)
-    grape-path-helpers (1.1.0)
+    grape-path-helpers (1.2.0)
       activesupport
       grape (~> 1.0)
       rake (~> 12)
@@ -477,7 +481,7 @@ GEM
       tilt
     hangouts-chat (0.0.5)
     hashdiff (0.3.8)
-    hashie (3.5.7)
+    hashie (3.6.0)
     hashie-forbidden_attributes (0.1.1)
       hashie (>= 3.0)
     health_check (2.6.0)
@@ -492,20 +496,21 @@ GEM
     html2text (0.2.0)
       nokogiri (~> 1.6)
     htmlentities (4.3.4)
-    http (3.3.0)
+    http (4.2.0)
       addressable (~> 2.3)
       http-cookie (~> 1.0)
       http-form_data (~> 2.0)
-      http_parser.rb (~> 0.6.0)
+      http-parser (~> 1.2.0)
     http-cookie (1.0.3)
       domain_name (~> 0.5)
     http-form_data (2.1.1)
-    http_parser.rb (0.6.0)
+    http-parser (1.2.1)
+      ffi-compiler (>= 1.0, < 2.0)
     httparty (0.16.4)
       mime-types (~> 3.0)
       multi_xml (>= 0.5.2)
     httpclient (2.8.3)
-    i18n (1.7.0)
+    i18n (1.7.1)
       concurrent-ruby (~> 1.0)
     i18n_data (0.8.0)
     icalendar (2.4.1)
@@ -519,7 +524,7 @@ GEM
     jaeger-client (0.10.0)
       opentracing (~> 0.3)
       thrift
-    jaro_winkler (1.5.3)
+    jaro_winkler (1.5.4)
     jira-ruby (1.7.1)
       activesupport
       atlassian-jwt
@@ -556,8 +561,8 @@ GEM
     kramdown (2.1.0)
     kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)
-    kubeclient (4.4.0)
+    kubeclient (4.6.0)
-      http (~> 3.0)
+      http (>= 3.0, < 5.0)
       recursive-open-struct (~> 1.0, >= 1.0.4)
       rest-client (~> 2.0)
     launchy (2.4.3)
@@ -577,6 +582,7 @@ GEM
       xml-simple
     licensee (8.9.2)
       rugged (~> 0.24)
+    liquid (4.0.3)
     listen (3.1.5)
       rb-fsevent (~> 0.9, >= 0.9.4)
       rb-inotify (~> 0.9, >= 0.9.7)
@@ -587,9 +593,10 @@ GEM
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
-    loofah (2.3.1)
+    loofah (2.4.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
+    lru_redux (1.1.0)
     lumberjack (1.0.13)
     mail (2.7.1)
       mini_mime (>= 0.1.1)
@@ -613,9 +620,9 @@ GEM
     mini_portile2 (2.4.0)
     minitest (5.11.3)
     msgpack (1.3.1)
-    multi_json (1.13.1)
+    multi_json (1.14.1)
     multi_xml (0.6.0)
-    multipart-post (2.0.0)
+    multipart-post (2.1.1)
     murmurhash3 (0.1.6)
     mustermann (1.0.3)
     mustermann-grape (1.0.0)
@@ -623,13 +630,13 @@ GEM
     nakayoshi_fork (0.0.4)
     nap (1.1.0)
     nenv (0.3.0)
-    net-ldap (0.16.0)
+    net-ldap (0.16.2)
     net-ntp (2.1.3)
     net-ssh (5.2.0)
     netrc (0.11.0)
     nio4r (2.5.2)
     no_proxy_fix (0.1.2)
-    nokogiri (1.10.5)
+    nokogiri (1.10.7)
       mini_portile2 (~> 2.4.0)
     nokogumbo (1.5.0)
       nokogiri
@@ -644,7 +651,8 @@ GEM
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 3)
-    octokit (4.9.0)
+    octokit (4.15.0)
+      faraday (>= 0.9)
       sawyer (~> 0.8.0, >= 0.5.3)
     omniauth (1.9.0)
       hashie (>= 3.4.6, < 3.7.0)
@@ -725,13 +733,14 @@ GEM
       rubypants (~> 0.2)
     orm_adapter (0.5.0)
     os (1.0.0)
-    parallel (1.17.0)
+    parallel (1.19.1)
-    parser (2.6.3.0)
+    parser (2.6.5.0)
       ast (~> 2.4.0)
     parslet (1.8.2)
     peek (1.1.0)
       railties (>= 4.0.0)
     pg (1.1.4)
+    png_quantizator (0.2.1)
     po_to_json (1.0.1)
       json (>= 1.6.0)
     premailer (1.11.1)
@@ -755,7 +764,7 @@ GEM
       pry (~> 0.10)
     pry-rails (0.3.6)
       pry (>= 0.10.4)
-    public_suffix (3.1.1)
+    public_suffix (4.0.3)
     pyu-ruby-sasl (0.0.3.3)
     raabro (1.1.6)
     rack (2.0.7)
@@ -763,7 +772,8 @@ GEM
       rack (>= 0.4)
     rack-attack (6.2.0)
       rack (>= 1.0, < 3)
-    rack-cors (1.0.2)
+    rack-cors (1.0.6)
+      rack (>= 1.6.0)
     rack-oauth2 (1.9.3)
       activesupport
       attr_required
@@ -820,7 +830,7 @@ GEM
       ffi (>= 1.0.6)
       msgpack (>= 0.4.3)
       optimist (>= 3.0.0)
-    rdoc (6.0.4)
+    rdoc (6.1.2)
     re2 (1.1.1)
     recaptcha (4.13.1)
       json
@@ -903,7 +913,7 @@ GEM
       pg
       rails
       sqlite3
-    rubocop (0.69.0)
+    rubocop (0.74.0)
       jaro_winkler (~> 1.5.1)
       parallel (~> 1.10)
       parser (>= 2.6)
@@ -912,10 +922,13 @@ GEM
       unicode-display_width (>= 1.4.0, < 1.7)
     rubocop-gitlab-security (0.1.1)
       rubocop (>= 0.51)
-    rubocop-performance (1.1.0)
+    rubocop-performance (1.4.1)
-      rubocop (>= 0.67.0)
+      rubocop (>= 0.71.0)
-    rubocop-rspec (1.22.2)
+    rubocop-rails (2.4.0)
-      rubocop (>= 0.52.1)
+      rack (>= 1.1)
+      rubocop (>= 0.72.0)
+    rubocop-rspec (1.37.0)
+      rubocop (>= 0.68.1)
     ruby-enum (0.7.2)
       i18n
     ruby-fogbugz (0.2.1)
@@ -929,7 +942,7 @@ GEM
       sexp_processor (~> 4.9)
     rubyntlm (0.6.2)
     rubypants (0.2.0)
-    rubyzip (1.3.0)
+    rubyzip (2.0.0)
     rugged (0.28.4.1)
     safe_yaml (1.0.4)
     sanitize (4.6.6)
@@ -950,9 +963,9 @@ GEM
       sprockets (> 3.0)
       sprockets-rails
       tilt
-    sawyer (0.8.1)
+    sawyer (0.8.2)
-      addressable (>= 2.3.5, < 2.6)
+      addressable (>= 2.3.5)
-      faraday (~> 0.8, < 1.0)
+      faraday (> 0.8, < 2.0)
     scss_lint (0.56.0)
       rake (>= 0.9, < 13)
       sass (~> 3.5.3)
@@ -1042,7 +1055,7 @@ GEM
     truncato (0.7.11)
       htmlentities (~> 4.3.1)
       nokogiri (>= 1.7.0, <= 2.0)
-    tzinfo (1.2.5)
+    tzinfo (1.2.6)
       thread_safe (~> 0.1)
     u2f (0.2.1)
     uber (0.1.0)
@@ -1119,13 +1132,13 @@ DEPENDENCIES
   acme-client (~> 2.0.2)
   activerecord-explain-analyze (~> 0.1)
   acts-as-taggable-on (~> 6.0)
-  addressable (~> 2.5.2)
+  addressable (~> 2.7)
   akismet (~> 3.0)
   apollo_upload_server (~> 2.0.0.beta3)
   asana (~> 0.9)
   asciidoctor (~> 2.0.10)
   asciidoctor-include-ext (~> 0.3.1)
-  asciidoctor-plantuml (= 0.0.9)
+  asciidoctor-plantuml (= 0.0.10)
   atlassian-jwt (~> 0.2.0)
   attr_encrypted (~> 3.1.0)
   awesome_print
@@ -1155,7 +1168,7 @@ DEPENDENCIES
   creole (~> 0.5.0)
   danger (~> 6.0)
   database_cleaner (~> 1.7.0)
-  deckar01-task_list (= 2.2.1)
+  deckar01-task_list (= 2.3.1)
   default_value_for (~> 3.3.0)
   derailed_benchmarks
   device_detector
@@ -1167,9 +1180,9 @@ DEPENDENCIES
   doorkeeper (~> 4.3)
   doorkeeper-openid_connect (~> 1.5)
   ed25519 (~> 1.2)
-  elasticsearch-api (= 5.0.3)
+  elasticsearch-api (~> 6.8)
-  elasticsearch-model (~> 0.1.9)
+  elasticsearch-model (~> 6.1)
-  elasticsearch-rails (~> 0.1.9)
+  elasticsearch-rails (~> 6.1)
   email_reply_trimmer (~> 0.1)
   email_spec (~> 2.2.0)
   escape_utils (~> 1.1)
@@ -1196,17 +1209,17 @@ DEPENDENCIES
   gettext (~> 3.2.2)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 1.73.0)
+  gitaly (~> 1.81.0)
   github-markup (~> 1.7.0)
   gitlab-chronic (~> 0.10.5)
-  gitlab-labkit (~> 0.5)
+  gitlab-labkit (= 0.8.0)
   gitlab-license (~> 1.0)
   gitlab-markup (~> 1.7.0)
   gitlab-net-dns (~> 0.9.1)
   gitlab-puma (~> 4.3.1.gitlab.2)
   gitlab-puma_worker_killer (~> 0.1.1.gitlab.1)
   gitlab-sidekiq-fetcher (= 0.5.2)
-  gitlab-styles (~> 2.7)
+  gitlab-styles (~> 3.1.0)
   gitlab_chronic_duration (~> 0.10.6.2)
   gitlab_omniauth-ldap (~> 2.1.1)
   gon (~> 6.2)
@@ -1215,7 +1228,7 @@ DEPENDENCIES
   gpgme (~> 2.0.19)
   grape (~> 1.1.0)
   grape-entity (~> 0.7.1)
-  grape-path-helpers (~> 1.1)
+  grape-path-helpers (~> 1.2)
   grape_logging (~> 1.7)
   graphiql-rails (~> 1.4.10)
   graphql (~> 1.9.11)
@@ -1241,12 +1254,14 @@ DEPENDENCIES
   jwt (~> 2.1.0)
   kaminari (~> 1.0)
   knapsack (~> 1.17)
-  kubeclient (~> 4.4.0)
+  kubeclient (~> 4.6.0)
   letter_opener_web (~> 1.3.4)
   license_finder (~> 5.4)
   licensee (~> 8.9)
+  liquid (~> 4.0)
   lograge (~> 0.5)
   loofah (~> 2.2)
+  lru_redux
   mail_room (~> 0.10.0)
   marginalia (~> 1.8.0)
   memory_profiler (~> 0.9)
@@ -1260,7 +1275,7 @@ DEPENDENCIES
   net-ssh (~> 5.2)
   nokogiri (~> 1.10.5)
   oauth2 (~> 1.4)
-  octokit (~> 4.9)
+  octokit (~> 4.15)
   omniauth (~> 1.8)
   omniauth-auth0 (~> 2.0.0)
   omniauth-authentiq (~> 0.3.3)
@@ -1280,8 +1295,10 @@ DEPENDENCIES
   omniauth_crowd (~> 2.2.0)
   omniauth_openid_connect (~> 0.3.3)
   org-ruby (~> 0.9.12)
+  parallel (~> 1.19)
   peek (~> 1.1)
   pg (~> 1.1)
+  png_quantizator (~> 0.2.1)
   premailer-rails (~> 1.10.3)
   prometheus-client-mmap (~> 0.10.0)
   pry-byebug (~> 3.5.1)
@@ -1299,7 +1316,7 @@ DEPENDENCIES
   raindrops (~> 0.18)
   rblineprof (~> 0.3.6)
   rbtrace (~> 0.4)
-  rdoc (~> 6.0)
+  rdoc (~> 6.1.2)
   re2 (~> 1.1.1)
   recaptcha (~> 4.11)
   redis (~> 4.0)
@@ -1316,14 +1333,14 @@ DEPENDENCIES
   rspec-set (~> 0.1.3)
   rspec_junit_formatter
   rspec_profiling (~> 0.0.5)
-  rubocop (~> 0.69.0)
+  rubocop (~> 0.74.0)
-  rubocop-performance (~> 1.1.0)
+  rubocop-performance (~> 1.4.1)
-  rubocop-rspec (~> 1.22.1)
+  rubocop-rspec (~> 1.37.0)
   ruby-fogbugz (~> 0.2.1)
   ruby-prof (~> 1.0.0)
   ruby-progressbar
   ruby_parser (~> 3.8)
-  rubyzip (~> 1.3.0)
+  rubyzip (~> 2.0.0)
   rugged (~> 0.28)
   sanitize (~> 4.6)
   sassc-rails (~> 2.1.0)

pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix

@@ -168,10 +168,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0viqszpkggqi8hq87pqp0xykhvz60g99nwmkwsb0v45kc2liwxvk";
+      sha256 = "1fvchp2rhp2rmigx7qglf69xvjqvzq7x0g49naliw29r2bz656sy";
       type = "gem";
     };
-    version = "2.5.2";
+    version = "2.7.0";
   };
   aes_key_wrap = {
     groups = ["default"];
@@ -252,10 +252,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lzxj16w7s3w0wnlpg8lfs9v2xxk3x3c1skynqm1sms7rjhnhlnb";
+      sha256 = "1bnrz4ywaq7vaw66fy3kkbwf07fvyqwngm3vb83s9h5zvr4n593b";
       type = "gem";
     };
-    version = "0.0.9";
+    version = "0.0.10";
   };
   ast = {
     groups = ["default" "development" "test"];
@@ -534,10 +534,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0qibi5s67lpdv1wgcj66wcymcr04q6j4mzws6a479n0mlrmh5wr1";
+      sha256 = "045wzckxpwcqzrjr353cxnyaxgf0qg22jh00dcx7z38cys5g1jlr";
       type = "gem";
     };
-    version = "3.2.3";
+    version = "3.2.4";
   };
   bullet = {
     dependencies = ["activesupport" "uniform_notifier"];
@@ -901,10 +901,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09k7rlxsl7pd5kn3wyswgqi0hhbmlj40b66l4mf8v9mqf3c7v0yk";
+      sha256 = "18bwkvxjr7khxj95xrg1vj7va522vbm2li9wsiiw01cg5b10hni0";
       type = "gem";
     };
-    version = "2.2.1";
+    version = "2.3.1";
   };
   declarative = {
     groups = ["default"];
@@ -1091,10 +1091,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0fik4nrxyi28zy1xwi4rygn0pf1sm1gskcrvbsnmqfrsdd6l4ga4";
+      sha256 = "1jp7amblk18dag3w0yrzdzkhkbfap2d6xpbyv9314parxw98mgq0";
       type = "gem";
     };
-    version = "5.0.3";
+    version = "6.8.0";
   };
   elasticsearch-api = {
     dependencies = ["multi_json"];
@@ -1102,10 +1102,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0aal128hq59l5kscl2ag2cv24g1sp5ysdb4jxkqmj0b1l9rv16mw";
+      sha256 = "0kq6ljssd5nd2fjaznbnyf4bhkk5q17ava5rq3bjfvjh1wyzagca";
       type = "gem";
     };
-    version = "5.0.3";
+    version = "6.8.0";
   };
   elasticsearch-model = {
     dependencies = ["activesupport" "elasticsearch" "hashie"];
@@ -1113,20 +1113,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "10kbsdxd192g8x60fhaxs4gqpgwag68d53flcw8rwvdm0i8smyzf";
+      sha256 = "0ifm8vh8nr9r1wnpnfa6kjm7v54jwsgvpg060r08haydqcv5lbsy";
       type = "gem";
     };
-    version = "0.1.9";
+    version = "6.1.0";
   };
   elasticsearch-rails = {
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "081hm2dc3l6kky027wm3s8k6lmiygg0hnrggnidchbl94nlalw2z";
+      sha256 = "0zxqj7pgb0b32qda84jlg6kay4b9qbpjlfk2b0m23hxnkbbmf1bd";
       type = "gem";
     };
-    version = "0.1.9";
+    version = "6.1.0";
   };
   elasticsearch-transport = {
     dependencies = ["faraday" "multi_json"];
@@ -1134,10 +1134,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1a7fak70ajdqw1ahd2gmgijka52pjjfr3chaakkxa5fk3rwwna26";
+      sha256 = "0c1scz8l4z84x7g3iwf9kmvrpgjjq0gaxaswviiy9zg3csn720mc";
       type = "gem";
     };
-    version = "5.0.3";
+    version = "6.8.0";
   };
   email_reply_trimmer = {
     groups = ["default"];
@@ -1226,10 +1226,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15l9w0938c19nxmrp09n75qpmm64k12xj69h47yvxzcxcpbgnkb2";
+      sha256 = "0nn8wk7j22ly4lzdp5pnm7qsrjxbgspiyxkw70g1qf9bn6pslmxr";
       type = "gem";
     };
-    version = "0.62.0";
+    version = "0.71.1";
   };
   execjs = {
     groups = ["default"];
@@ -1290,10 +1290,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "157c4cmb5g1b3ny6k9qf9z57rfijl54fcq3hnqqf6g31g1m096b2";
+      sha256 = "0s72m05jvzc1pd6cw1i289chas399q0a14xrwg4rvkdwy7bgzrh0";
       type = "gem";
     };
-    version = "0.12.2";
+    version = "0.15.4";
   };
   faraday-http-cache = {
     dependencies = ["faraday"];
@@ -1379,6 +1379,17 @@
     };
     version = "1.11.3";
   };
+  ffi-compiler = {
+    dependencies = ["ffi" "rake"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0c2caqm9wqnbidcb8dj4wd3s902z15qmgxplwyfyqbwa0ydki7q1";
+      type = "gem";
+    };
+    version = "1.0.1";
+  };
   flipper = {
     groups = ["default"];
     platforms = [];
@@ -1644,10 +1655,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1bls6aywjkvq1jw324criphzbzl710rx1nab4y22bvyi98qvdi38";
+      sha256 = "048s8p93srl3fvaj4l38qhrqzndzgiv32dvrr3s5k65pcxm0vb5i";
       type = "gem";
     };
-    version = "1.73.0";
+    version = "1.81.0";
   };
   github-markup = {
     groups = ["default"];
@@ -1676,10 +1687,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0r2zkxkj2l78c6qgr6k9lgcp7w6x7r703259rbsbrg7cfnjm43b7";
+      sha256 = "1q3qd8jriafyblivqd5fzb95x9mzm8hgizg5401m3m5i957957z9";
       type = "gem";
     };
-    version = "0.7.0";
+    version = "0.8.0";
   };
   gitlab-license = {
     groups = ["default"];
@@ -1745,15 +1756,15 @@
     version = "0.5.2";
   };
   gitlab-styles = {
-    dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-performance" "rubocop-rspec"];
+    dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-performance" "rubocop-rails" "rubocop-rspec"];
     groups = ["development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0kxn5j4gk2bidxfi3lnx8sl58kwh0fp89p75pbwwz3cd88d4vgsq";
+      sha256 = "07qh80nxwxgk76bhwrxw0a0jjcfvyxzmcd773k6axwklp5wvas7x";
       type = "gem";
     };
-    version = "2.8.0";
+    version = "3.1.0";
   };
   gitlab_chronic_duration = {
     dependencies = ["numerizer"];
@@ -1881,10 +1892,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16l6lrv4h4ls0lrpj35pc00431q2rx6r9n47337qyvprxs3v0a01";
+      sha256 = "170aw6yvr8l5srlfjz1yqpxr7klr8jypr4i0gj41gn6v4iamyl79";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.2.0";
   };
   grape_logging = {
     dependencies = ["grape"];
@@ -2041,10 +2052,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1hh5lybf8hm7d7xs4xm8hxvm8xqrs2flc8fnwkrclaj746izw6xb";
+      sha256 = "13bdzfp25c8k51ayzxqkbzag3wj5gc1jd8h7d985nsq6pn57g5xh";
       type = "gem";
     };
-    version = "3.5.7";
+    version = "3.6.0";
   };
   hashie-forbidden_attributes = {
     dependencies = ["hashie"];
@@ -2122,15 +2133,15 @@
     version = "4.3.4";
   };
   http = {
-    dependencies = ["addressable" "http-cookie" "http-form_data" "http_parser.rb"];
+    dependencies = ["addressable" "http-cookie" "http-form_data" "http-parser"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1jlm5prw437wqpfxcigh88lfap3m7g8mnmj5as7qw6dzqnvrxwmc";
+      sha256 = "1gsn0jmri7cavw1pv3pbynq6nldsff0r5dr6pa0mxz0rkpjsgjwl";
       type = "gem";
     };
-    version = "3.3.0";
+    version = "4.2.0";
   };
   http-cookie = {
     dependencies = ["domain_name"];
@@ -2153,15 +2164,16 @@
     };
     version = "2.1.1";
   };
-  "http_parser.rb" = {
+  http-parser = {
+    dependencies = ["ffi-compiler"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "15nidriy0v5yqfjsgsra51wmknxci2n2grliz78sf9pga3n0l7gi";
+      sha256 = "10wz818i7dq5zkcll0yf7pbjz1zqvs7mgh3xg3x6www2f2ccwxqj";
       type = "gem";
     };
-    version = "0.6.0";
+    version = "1.2.1";
   };
   httparty = {
     dependencies = ["mime-types" "multi_xml"];
@@ -2190,10 +2202,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hmypvx9iyc0b4hski7aic2xzm09cg1c7q1qlpnk3k8s5acxzyhl";
+      sha256 = "11ss256hnild52qg5kxisidf1fn0n6gm8hq65y9fnqnq0wq7daw9";
       type = "gem";
     };
-    version = "1.7.0";
+    version = "1.7.1";
   };
   i18n_data = {
     groups = ["default"];
@@ -2273,10 +2285,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1930v0chc1q4fr7hn0y1j34mw0v032a8kh0by4d4sbz8ksy056kf";
+      sha256 = "1y8l6k34svmdyqxya3iahpwbpvmn3fswhwsvrz0nk1wyb8yfihsh";
       type = "gem";
     };
-    version = "1.5.3";
+    version = "1.5.4";
   };
   jira-ruby = {
     dependencies = ["activesupport" "atlassian-jwt" "multipart-post" "oauth"];
@@ -2443,10 +2455,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0gj6z90p3nm43bafbp97b78zi764gy88590g2y4lm8zcgk8k586r";
+      sha256 = "1djf4zll2alrwv7wg4wk9v504wbri717wqaq773i1azg7cbisbw6";
       type = "gem";
     };
-    version = "4.4.0";
+    version = "4.6.0";
   };
   launchy = {
     dependencies = ["addressable"];
@@ -2503,6 +2515,16 @@
     };
     version = "8.9.2";
   };
+  liquid = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0zhg5ha8zy8zw9qr3fl4wgk4r5940n4128xm2pn4shpbzdbsj5by";
+      type = "gem";
+    };
+    version = "4.0.3";
+  };
   listen = {
     dependencies = ["rb-fsevent" "rb-inotify" "ruby_dep"];
     groups = ["default" "test"];
@@ -2541,10 +2563,20 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0npqav026zd7r4qdidq9x5nxcp2dzg71bnp421xxx7sngbxf2xbd";
+      sha256 = "1g7ps9m3s14cajhxrfgbzahv9i3gy47s4hqrv3mpybpj5cyr0srn";
       type = "gem";
     };
-    version = "2.3.1";
+    version = "2.4.0";
+  };
+  lru_redux = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1yxghzg7476sivz8yyr9nkak2dlbls0b89vc2kg52k0nmg6d0wgf";
+      type = "gem";
+    };
+    version = "1.1.0";
   };
   lumberjack = {
     groups = ["default" "test"];
@@ -2730,10 +2762,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1rl0qy4inf1mp8mybfk56dfga0mvx97zwpmq5xmiwl5r770171nv";
+      sha256 = "0xy54mjf7xg41l8qrg1bqri75agdqmxap9z466fjismc1rn2jwfr";
       type = "gem";
     };
-    version = "1.13.1";
+    version = "1.14.1";
   };
   multi_xml = {
     groups = ["default"];
@@ -2750,10 +2782,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09k0b3cybqilk1gwrwwain95rdypixb2q9w65gd44gfzsd84xi1x";
+      sha256 = "1zgw9zlwh2a6i1yvhhc4a84ry1hv824d6g2iw2chs3k5aylpmpfj";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "2.1.1";
   };
   murmurhash3 = {
     groups = ["default"];
@@ -2821,10 +2853,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fh4l8zfsrvghanpnjxk944k7yl093qpw4759xs6f1v9kb73ihfq";
+      sha256 = "1vzfhivjfr9q65hkln7xig3qcba6fw9y4kb4384fpm7d7ww0b7xg";
       type = "gem";
     };
-    version = "0.16.0";
+    version = "0.16.2";
   };
   net-ntp = {
     groups = ["default"];
@@ -2882,10 +2914,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "185g3dwba73jqxjr94bd2zk6fil6n9hmcfnfyzh3p1w47vm296r7";
+      sha256 = "0r0qpgf80h764k176yr63gqbs2z0xbsp8vlvs2a79d5r9vs83kln";
       type = "gem";
     };
-    version = "1.10.5";
+    version = "1.10.7";
   };
   nokogumbo = {
     dependencies = ["nokogiri"];
@@ -2941,15 +2973,15 @@
     version = "1.4.1";
   };
   octokit = {
-    dependencies = ["sawyer"];
+    dependencies = ["faraday" "sawyer"];
     groups = ["default" "development"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ssn5iyax07a22mvmj0y45bfy8ali129bl1qmasp6bcg03bvk298";
+      sha256 = "0yg6dhd028j74sm8hpw9w7bwfwlkml9wiis7nq20ivfsbcz4g8ac";
       type = "gem";
     };
-    version = "4.9.0";
+    version = "4.15.0";
   };
   omniauth = {
     dependencies = ["hashie" "rack"];
@@ -3255,14 +3287,14 @@
     version = "1.0.0";
   };
   parallel = {
-    groups = ["default" "development" "test"];
+    groups = ["development" "test"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1x1gzgjrdlkm1aw0hfpyphsxcx90qgs3y4gmp9km3dvf4hc4qm8r";
+      sha256 = "12jijkap4akzdv11lm08dglsc8jmc87xcgq6947i1s3qb69f4zn2";
       type = "gem";
     };
-    version = "1.17.0";
+    version = "1.19.1";
   };
   parser = {
     dependencies = ["ast"];
@@ -3270,10 +3302,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1pnks149x0fzgqiw53qlmvcd8bi746cxdw03sjljby5s97p1fskn";
+      sha256 = "09davv4ld6caqlczw64vhwf8hr41apys3cj8v2h96yxs4qg1m2iw";
       type = "gem";
     };
-    version = "2.6.3.0";
+    version = "2.6.5.0";
   };
   parslet = {
     groups = ["default" "development" "test"];
@@ -3306,6 +3338,16 @@
     };
     version = "1.1.4";
   };
+  png_quantizator = {
+    groups = ["development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0sqhydp5g9ly1kgfiya1fc6srmhf6avrb74j09z3lp0jck8d88v0";
+      type = "gem";
+    };
+    version = "0.2.1";
+  };
   po_to_json = {
     dependencies = ["json"];
     groups = ["default"];
@@ -3416,10 +3458,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g9ds2ffzljl6jjmkjffwxc1z6lh5nkqqmhhkxjk71q5ggv0rkpm";
+      sha256 = "1c6kq6s13idl2036b5lch8r7390f8w82cal8hcp4ml76fm2vdac7";
       type = "gem";
     };
-    version = "3.1.1";
+    version = "4.0.3";
   };
   pyu-ruby-sasl = {
     groups = ["default"];
@@ -3474,14 +3516,15 @@
     version = "6.2.0";
   };
   rack-cors = {
+    dependencies = ["rack"];
     groups = ["default"];
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1j27vy1bmhbqcyzhxg8d07qassmax769xjalfwcwz6qfiq8cf013";
+      sha256 = "07dppmm1ah1gs31sb5byrkkady9vqzwjmpd92c8425nc6yzwknik";
       type = "gem";
     };
-    version = "1.0.2";
+    version = "1.0.6";
   };
   rack-oauth2 = {
     dependencies = ["activesupport" "attr_required" "httpclient" "json-jwt" "rack"];
@@ -3685,10 +3728,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0anv42cqcdc6g4n386mrva7mgav5i0c2ry3yzvzzc6z6hymkmcr7";
+      sha256 = "0zh39dpsqlhhi4aba1sbrk504d88p38djk8cansjq0fwndq7w4zb";
       type = "gem";
     };
-    version = "6.0.4";
+    version = "6.1.2";
   };
   re2 = {
     groups = ["default"];
@@ -4057,10 +4100,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1cmw8ajaiidvrzjcsljh47f4l3lmcazqrzljgalj3szkr8ibkk5i";
+      sha256 = "0wpyass9qb2wvq8zsc7wdzix5xy2ldiv66wnx8mwwprz2dcvzayk";
       type = "gem";
     };
-    version = "0.69.0";
+    version = "0.74.0";
   };
   rubocop-gitlab-security = {
     dependencies = ["rubocop"];
@@ -4079,10 +4122,21 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0azzgj62w24wa4hza1qn7i9b9crxdh907kydlzcvhismx41h3lzk";
+      sha256 = "1ssizdnyai2hxdp6nd4b9hqyrc4gwhjlznhrdliz8wj4p8cvas44";
       type = "gem";
     };
-    version = "1.1.0";
+    version = "1.4.1";
+  };
+  rubocop-rails = {
+    dependencies = ["rack" "rubocop"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0vvrwcxzbqiqdjxakxmjg4c3dcrlpb00i1d3i0s1gdk0ch79byag";
+      type = "gem";
+    };
+    version = "2.4.0";
   };
   rubocop-rspec = {
     dependencies = ["rubocop"];
@@ -4090,10 +4144,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0vk51h9swvgshan8vp8yjz03qv9vn5vs29i9iddhjwcwgzsganla";
+      sha256 = "1dypzxzrm8lh1gip9pn93p1nwamzkqsljy6mcv2ngw9zqsial233";
       type = "gem";
     };
-    version = "1.22.2";
+    version = "1.37.0";
   };
   ruby-enum = {
     dependencies = ["i18n"];
@@ -4194,10 +4248,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1qxc2zxwwipm6kviiar4gfhcakpx1jdcs89v6lvzivn5hq1xk78l";
+      sha256 = "1gz0ri0pa2xr7b6bf66yjc2wfvk51f4gi6yk7bklwl1nr65zc4gz";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "2.0.0";
   };
   rugged = {
     groups = ["default"];
@@ -4280,10 +4334,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0sv1463r7bqzvx4drqdmd36m7rrv6sf1v3c6vswpnq3k6vdw2dvd";
+      sha256 = "0yrdchs3psh583rjapkv33mljdivggqn99wkydkjdckcjn43j3cz";
       type = "gem";
     };
-    version = "0.8.1";
+    version = "0.8.2";
   };
   scss_lint = {
     dependencies = ["rake" "sass"];
@@ -4754,10 +4808,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1fjx9j327xpkkdlxwmkl3a8wqj7i4l4jwlrv3z13mg95z9wl253z";
+      sha256 = "04f18jdv6z3zn3va50rqq35nj3izjpb72fnf21ixm7vanq6nc4fp";
       type = "gem";
     };
-    version = "1.2.5";
+    version = "1.2.6";
   };
   u2f = {
     groups = ["default"];

pkgs/applications/version-management/gitlab/yarnPkgs.nix

@@ -666,19 +666,19 @@
       };
     }
     {
-      name = "_gitlab_svgs___svgs_1.88.0.tgz";
+      name = "_gitlab_svgs___svgs_1.89.0.tgz";
       path = fetchurl {
-        name = "_gitlab_svgs___svgs_1.88.0.tgz";
+        name = "_gitlab_svgs___svgs_1.89.0.tgz";
-        url  = "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-1.88.0.tgz";
+        url  = "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-1.89.0.tgz";
-        sha1 = "0a9b72e9591264fcac592ebf9944665c70f48de2";
+        sha1 = "5bdaff1b0af1cc07ed34e89c21c34c7c6a3e1caa";
       };
     }
     {
-      name = "_gitlab_ui___ui_8.8.0.tgz";
+      name = "_gitlab_ui___ui_8.17.0.tgz";
       path = fetchurl {
-        name = "_gitlab_ui___ui_8.8.0.tgz";
+        name = "_gitlab_ui___ui_8.17.0.tgz";
-        url  = "https://registry.yarnpkg.com/@gitlab/ui/-/ui-8.8.0.tgz";
+        url  = "https://registry.yarnpkg.com/@gitlab/ui/-/ui-8.17.0.tgz";
-        sha1 = "c22b4dece89d224c525b3510970f3c61321a6765";
+        sha1 = "674baa9b5c05fa6ecb23b233c5b308ff82ba5660";
       };
     }
     {
@@ -850,11 +850,11 @@
       };
     }
     {
-      name = "_sourcegraph_code_host_integration___code_host_integration_0.0.14.tgz";
+      name = "_sourcegraph_code_host_integration___code_host_integration_0.0.18.tgz";
       path = fetchurl {
-        name = "_sourcegraph_code_host_integration___code_host_integration_0.0.14.tgz";
+        name = "_sourcegraph_code_host_integration___code_host_integration_0.0.18.tgz";
-        url  = "https://registry.yarnpkg.com/@sourcegraph/code-host-integration/-/code-host-integration-0.0.14.tgz";
+        url  = "https://registry.yarnpkg.com/@sourcegraph/code-host-integration/-/code-host-integration-0.0.18.tgz";
-        sha1 = "e12b08371dc37bf4a468450b008c6e167705e1a8";
+        sha1 = "814467cdbc94bbfee5768193acf89fdf404ca949";
       };
     }
     {
@@ -961,14 +961,6 @@
         sha1 = "9ae2106efc443d7c1e26570aa8247828c9c80f11";
       };
     }
-    {
-      name = "_types_semver___semver_5.5.0.tgz";
-      path = fetchurl {
-        name = "_types_semver___semver_5.5.0.tgz";
-        url  = "https://registry.yarnpkg.com/@types/semver/-/semver-5.5.0.tgz";
-        sha1 = "146c2a29ee7d3bae4bf2fcb274636e264c813c45";
-      };
-    }
     {
       name = "_types_stack_utils___stack_utils_1.0.1.tgz";
       path = fetchurl {
@@ -1058,11 +1050,11 @@
       };
     }
     {
-      name = "_vue_test_utils___test_utils_1.0.0_beta.25.tgz";
+      name = "_vue_test_utils___test_utils_1.0.0_beta.30.tgz";
       path = fetchurl {
-        name = "_vue_test_utils___test_utils_1.0.0_beta.25.tgz";
+        name = "_vue_test_utils___test_utils_1.0.0_beta.30.tgz";
-        url  = "https://registry.yarnpkg.com/@vue/test-utils/-/test-utils-1.0.0-beta.25.tgz";
+        url  = "https://registry.yarnpkg.com/@vue/test-utils/-/test-utils-1.0.0-beta.30.tgz";
-        sha1 = "4703076de3076bac42cdd242cd53e6fb8752ed8c";
+        sha1 = "d5f26d1e2411fdb7fa7fdedb61b4b4ea4194c49d";
       };
     }
     {
@@ -2929,6 +2921,14 @@
         sha1 = "904bdf194cd3122fc675c77fc4ac3d4ff0fd1a34";
       };
     }
+    {
+      name = "condense_newlines___condense_newlines_0.2.1.tgz";
+      path = fetchurl {
+        name = "condense_newlines___condense_newlines_0.2.1.tgz";
+        url  = "https://registry.yarnpkg.com/condense-newlines/-/condense-newlines-0.2.1.tgz";
+        sha1 = "3de985553139475d32502c83b02f60684d24c55f";
+      };
+    }
     {
       name = "config_chain___config_chain_1.1.12.tgz";
       path = fetchurl {
@@ -3634,27 +3634,27 @@
       };
     }
     {
-      name = "d3___d3_5.12.0.tgz";
+      name = "d3___d3_5.15.0.tgz";
       path = fetchurl {
-        name = "d3___d3_5.12.0.tgz";
+        name = "d3___d3_5.15.0.tgz";
-        url  = "https://registry.yarnpkg.com/d3/-/d3-5.12.0.tgz";
+        url  = "https://registry.yarnpkg.com/d3/-/d3-5.15.0.tgz";
-        sha1 = "0ddeac879c28c882317cd439b495290acd59ab61";
+        sha1 = "ffd44958e6a3cb8a59a84429c45429b8bca5677a";
       };
     }
     {
-      name = "https___codeload.github.com_dagrejs_dagre_d3_tar.gz_e1a00e5cb518f5d2304a35647e024f31d178e55b";
+      name = "dagre_d3___dagre_d3_0.6.4.tgz";
       path = fetchurl {
-        name = "https___codeload.github.com_dagrejs_dagre_d3_tar.gz_e1a00e5cb518f5d2304a35647e024f31d178e55b";
+        name = "dagre_d3___dagre_d3_0.6.4.tgz";
-        url  = "https://codeload.github.com/dagrejs/dagre-d3/tar.gz/e1a00e5cb518f5d2304a35647e024f31d178e55b";
+        url  = "https://registry.yarnpkg.com/dagre-d3/-/dagre-d3-0.6.4.tgz";
-        sha1 = "7400df3f5fe80538fde43d0201e1570e1d689004";
+        sha1 = "0728d5ce7f177ca2337df141ceb60fbe6eeb7b29";
       };
     }
     {
-      name = "dagre___dagre_0.8.4.tgz";
+      name = "dagre___dagre_0.8.5.tgz";
       path = fetchurl {
-        name = "dagre___dagre_0.8.4.tgz";
+        name = "dagre___dagre_0.8.5.tgz";
-        url  = "https://registry.yarnpkg.com/dagre/-/dagre-0.8.4.tgz";
+        url  = "https://registry.yarnpkg.com/dagre/-/dagre-0.8.5.tgz";
-        sha1 = "26b9fb8f7bdc60c6110a0458c375261836786061";
+        sha1 = "ba30b0055dac12b6c1fcc247817442777d06afee";
       };
     }
     {
@@ -3754,11 +3754,11 @@
       };
     }
     {
-      name = "deckar01_task_list___deckar01_task_list_2.2.1.tgz";
+      name = "deckar01_task_list___deckar01_task_list_2.3.1.tgz";
       path = fetchurl {
-        name = "deckar01_task_list___deckar01_task_list_2.2.1.tgz";
+        name = "deckar01_task_list___deckar01_task_list_2.3.1.tgz";
-        url  = "https://registry.yarnpkg.com/deckar01-task_list/-/deckar01-task_list-2.2.1.tgz";
+        url  = "https://registry.yarnpkg.com/deckar01-task_list/-/deckar01-task_list-2.3.1.tgz";
-        sha1 = "e1e8a16c4fd6e153e51fd9258fdbee067ebcd86b";
+        sha1 = "f3ffd5319d7b9e27c596dc8d823b13f617ed7db7";
       };
     }
     {
@@ -4049,6 +4049,14 @@
         sha1 = "dad8cb7be38e04ee3f56842e6cf81af46c1249ba";
       };
     }
+    {
+      name = "dom_event_types___dom_event_types_1.0.0.tgz";
+      path = fetchurl {
+        name = "dom_event_types___dom_event_types_1.0.0.tgz";
+        url  = "https://registry.yarnpkg.com/dom-event-types/-/dom-event-types-1.0.0.tgz";
+        sha1 = "5830a0a29e1bf837fe50a70cd80a597232813cae";
+      };
+    }
     {
       name = "dom_serialize___dom_serialize_2.2.1.tgz";
       path = fetchurl {
@@ -4178,11 +4186,11 @@
       };
     }
     {
-      name = "editorconfig___editorconfig_0.15.2.tgz";
+      name = "editorconfig___editorconfig_0.15.3.tgz";
       path = fetchurl {
-        name = "editorconfig___editorconfig_0.15.2.tgz";
+        name = "editorconfig___editorconfig_0.15.3.tgz";
-        url  = "https://registry.yarnpkg.com/editorconfig/-/editorconfig-0.15.2.tgz";
+        url  = "https://registry.yarnpkg.com/editorconfig/-/editorconfig-0.15.3.tgz";
-        sha1 = "047be983abb9ab3c2eefe5199cb2b7c5689f0702";
+        sha1 = "bef84c4e75fb8dcb0ce5cee8efd51c15999befc5";
       };
     }
     {
@@ -5514,11 +5522,11 @@
       };
     }
     {
-      name = "graphlib___graphlib_2.1.7.tgz";
+      name = "graphlib___graphlib_2.1.8.tgz";
       path = fetchurl {
-        name = "graphlib___graphlib_2.1.7.tgz";
+        name = "graphlib___graphlib_2.1.8.tgz";
-        url  = "https://registry.yarnpkg.com/graphlib/-/graphlib-2.1.7.tgz";
+        url  = "https://registry.yarnpkg.com/graphlib/-/graphlib-2.1.8.tgz";
-        sha1 = "b6a69f9f44bd9de3963ce6804a2fc9e73d86aecc";
+        sha1 = "5761d414737870084c92ec7b5dbcb0592c9d35da";
       };
     }
     {
@@ -5945,6 +5953,14 @@
         sha1 = "9db1dbd0faf8de6fbe0f5dd5e56bb606280de69b";
       };
     }
+    {
+      name = "immer___immer_5.2.1.tgz";
+      path = fetchurl {
+        name = "immer___immer_5.2.1.tgz";
+        url  = "https://registry.yarnpkg.com/immer/-/immer-5.2.1.tgz";
+        sha1 = "7d4f74c242178e87151d595f48db1b5c51580485";
+      };
+    }
     {
       name = "import_fresh___import_fresh_2.0.0.tgz";
       path = fetchurl {
@@ -6601,6 +6617,14 @@
         sha1 = "ede53b4c6f6fb3874533751ec9280d01928d03ed";
       };
     }
+    {
+      name = "is_whitespace___is_whitespace_0.3.0.tgz";
+      path = fetchurl {
+        name = "is_whitespace___is_whitespace_0.3.0.tgz";
+        url  = "https://registry.yarnpkg.com/is-whitespace/-/is-whitespace-0.3.0.tgz";
+        sha1 = "1639ecb1be036aec69a54cbb401cfbed7114ab7f";
+      };
+    }
     {
       name = "is_windows___is_windows_1.0.2.tgz";
       path = fetchurl {
@@ -7082,11 +7106,11 @@
       };
     }
     {
-      name = "js_beautify___js_beautify_1.8.9.tgz";
+      name = "js_beautify___js_beautify_1.10.2.tgz";
       path = fetchurl {
-        name = "js_beautify___js_beautify_1.8.9.tgz";
+        name = "js_beautify___js_beautify_1.10.2.tgz";
-        url  = "https://registry.yarnpkg.com/js-beautify/-/js-beautify-1.8.9.tgz";
+        url  = "https://registry.yarnpkg.com/js-beautify/-/js-beautify-1.10.2.tgz";
-        sha1 = "08e3c05ead3ecfbd4f512c3895b1cda76c87d523";
+        sha1 = "88c9099cd6559402b124cfab18754936f8a7b178";
       };
     }
     {
@@ -8042,11 +8066,11 @@
       };
     }
     {
-      name = "mermaid___mermaid_8.4.2.tgz";
+      name = "mermaid___mermaid_8.4.5.tgz";
       path = fetchurl {
-        name = "mermaid___mermaid_8.4.2.tgz";
+        name = "mermaid___mermaid_8.4.5.tgz";
-        url  = "https://registry.yarnpkg.com/mermaid/-/mermaid-8.4.2.tgz";
+        url  = "https://registry.yarnpkg.com/mermaid/-/mermaid-8.4.5.tgz";
-        sha1 = "91d3d8e9541e72eed7a78d0e882db11564fab3bb";
+        sha1 = "48d5722cbc72be2ad01002795835d7ca1b48e000";
       };
     }
     {
@@ -8258,11 +8282,11 @@
       };
     }
     {
-      name = "monaco_editor___monaco_editor_0.15.6.tgz";
+      name = "monaco_editor___monaco_editor_0.18.1.tgz";
       path = fetchurl {
-        name = "monaco_editor___monaco_editor_0.15.6.tgz";
+        name = "monaco_editor___monaco_editor_0.18.1.tgz";
-        url  = "https://registry.yarnpkg.com/monaco-editor/-/monaco-editor-0.15.6.tgz";
+        url  = "https://registry.yarnpkg.com/monaco-editor/-/monaco-editor-0.18.1.tgz";
-        sha1 = "d63b3b06f86f803464f003b252627c3eb4a09483";
+        sha1 = "ced7c305a23109875feeaf395a504b91f6358cfc";
       };
     }
     {
@@ -9346,11 +9370,11 @@
       };
     }
     {
-      name = "portal_vue___portal_vue_2.1.5.tgz";
+      name = "portal_vue___portal_vue_2.1.7.tgz";
       path = fetchurl {
-        name = "portal_vue___portal_vue_2.1.5.tgz";
+        name = "portal_vue___portal_vue_2.1.7.tgz";
-        url  = "https://registry.yarnpkg.com/portal-vue/-/portal-vue-2.1.5.tgz";
+        url  = "https://registry.yarnpkg.com/portal-vue/-/portal-vue-2.1.7.tgz";
-        sha1 = "ecd0997cb32958205151cb72f40fd4f38d175e5c";
+        sha1 = "ea08069b25b640ca08a5b86f67c612f15f4e4ad4";
       };
     }
     {
@@ -9585,6 +9609,14 @@
         sha1 = "8dae7044f58db7cb8be245383b565a963e3c27f2";
       };
     }
+    {
+      name = "pretty___pretty_2.0.0.tgz";
+      path = fetchurl {
+        name = "pretty___pretty_2.0.0.tgz";
+        url  = "https://registry.yarnpkg.com/pretty/-/pretty-2.0.0.tgz";
+        sha1 = "adbc7960b7bbfe289a557dc5f737619a220d06a5";
+      };
+    }
     {
       name = "prismjs___prismjs_1.6.0.tgz";
       path = fetchurl {
@@ -10721,6 +10753,14 @@
         sha1 = "d6e0dfb2a3832a8c94468e6eb1db97e55a192a65";
       };
     }
+    {
+      name = "serialize_javascript___serialize_javascript_2.1.2.tgz";
+      path = fetchurl {
+        name = "serialize_javascript___serialize_javascript_2.1.2.tgz";
+        url  = "https://registry.yarnpkg.com/serialize-javascript/-/serialize-javascript-2.1.2.tgz";
+        sha1 = "ecec53b0e0317bdc95ef76ab7074b7384785fa61";
+      };
+    }
     {
       name = "serve_index___serve_index_1.9.1.tgz";
       path = fetchurl {
@@ -10746,19 +10786,11 @@
       };
     }
     {
-      name = "set_value___set_value_0.4.3.tgz";
+      name = "set_value___set_value_2.0.1.tgz";
       path = fetchurl {
-        name = "set_value___set_value_0.4.3.tgz";
+        name = "set_value___set_value_2.0.1.tgz";
-        url  = "https://registry.yarnpkg.com/set-value/-/set-value-0.4.3.tgz";
+        url  = "https://registry.yarnpkg.com/set-value/-/set-value-2.0.1.tgz";
-        sha1 = "7db08f9d3d22dc7f78e53af3c3bf4666ecdfccf1";
+        sha1 = "a18d40530e6f07de4228c7defe4227af8cad005b";
-      };
-    }
-    {
-      name = "set_value___set_value_2.0.0.tgz";
-      path = fetchurl {
-        name = "set_value___set_value_2.0.0.tgz";
-        url  = "https://registry.yarnpkg.com/set-value/-/set-value-2.0.0.tgz";
-        sha1 = "71ae4a88f0feefbbf52d1ea604f3fb315ebb6274";
       };
     }
     {
@@ -11586,11 +11618,11 @@
       };
     }
     {
-      name = "terser_webpack_plugin___terser_webpack_plugin_1.4.1.tgz";
+      name = "terser_webpack_plugin___terser_webpack_plugin_1.4.3.tgz";
       path = fetchurl {
-        name = "terser_webpack_plugin___terser_webpack_plugin_1.4.1.tgz";
+        name = "terser_webpack_plugin___terser_webpack_plugin_1.4.3.tgz";
-        url  = "https://registry.yarnpkg.com/terser-webpack-plugin/-/terser-webpack-plugin-1.4.1.tgz";
+        url  = "https://registry.yarnpkg.com/terser-webpack-plugin/-/terser-webpack-plugin-1.4.3.tgz";
-        sha1 = "61b18e40eaee5be97e771cdbb10ed1280888c2b4";
+        sha1 = "5ecaf2dbdc5fb99745fd06791f46fc9ddb1c9a7c";
       };
     }
     {
@@ -12154,11 +12186,11 @@
       };
     }
     {
-      name = "union_value___union_value_1.0.0.tgz";
+      name = "union_value___union_value_1.0.1.tgz";
       path = fetchurl {
-        name = "union_value___union_value_1.0.0.tgz";
+        name = "union_value___union_value_1.0.1.tgz";
-        url  = "https://registry.yarnpkg.com/union-value/-/union-value-1.0.0.tgz";
+        url  = "https://registry.yarnpkg.com/union-value/-/union-value-1.0.1.tgz";
-        sha1 = "5c71c34cb5bad5dcebe3ea0cd08207ba5aa1aea4";
+        sha1 = "0b6fe7b835aecda61c6ea4d4f02c14221e109847";
       };
     }
     {
@@ -12594,11 +12626,11 @@
       };
     }
     {
-      name = "vue_virtual_scroll_list___vue_virtual_scroll_list_1.3.1.tgz";
+      name = "vue_virtual_scroll_list___vue_virtual_scroll_list_1.4.4.tgz";
       path = fetchurl {
-        name = "vue_virtual_scroll_list___vue_virtual_scroll_list_1.3.1.tgz";
+        name = "vue_virtual_scroll_list___vue_virtual_scroll_list_1.4.4.tgz";
-        url  = "https://registry.yarnpkg.com/vue-virtual-scroll-list/-/vue-virtual-scroll-list-1.3.1.tgz";
+        url  = "https://registry.yarnpkg.com/vue-virtual-scroll-list/-/vue-virtual-scroll-list-1.4.4.tgz";
-        sha1 = "efcb83d3a3dcc69cd886fa4de1130a65493e8f76";
+        sha1 = "5fca7a13f785899bbfb70471ec4fe222437d8495";
       };
     }
     {
@@ -12730,11 +12762,11 @@
       };
     }
     {
-      name = "webpack___webpack_4.40.2.tgz";
+      name = "webpack___webpack_4.41.5.tgz";
       path = fetchurl {
-        name = "webpack___webpack_4.40.2.tgz";
+        name = "webpack___webpack_4.41.5.tgz";
-        url  = "https://registry.yarnpkg.com/webpack/-/webpack-4.40.2.tgz";
+        url  = "https://registry.yarnpkg.com/webpack/-/webpack-4.41.5.tgz";
-        sha1 = "d21433d250f900bf0facbabe8f50d585b2dc30a7";
+        sha1 = "3210f1886bce5310e62bb97204d18c263341b77c";
       };
     }
     {

pkgs/applications/version-management/mercurial/default.nix

@@ -8,11 +8,11 @@ let
 
 in python3Packages.buildPythonApplication rec {
   pname = "mercurial";
-  version = "5.2.1";
+  version = "5.2.2";
 
   src = fetchurl {
     url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-    sha256 = "1pxkd37b0a1mi2zakk1hi122lgz1ffy2fxdnbs8acwlqpw55bc8q";
+    sha256 = "0fy00q0k4f0q64jjlnb7cl6m0sglivq9jgdddsp5sywc913zzigz";
   };
 
   format = "other";

pkgs/build-support/docker/default.nix

@@ -593,6 +593,8 @@ rec {
           if tag == null
           then lib.head (lib.splitString "-" (lib.last (lib.splitString "/" result)))
           else lib.toLower tag;
+        # Docker can't be made to run darwin binaries
+        meta.badPlatforms = lib.platforms.darwin;
       } ''
         ${if (tag == null) then ''
           outName="$(basename "$out")"
@@ -723,6 +725,8 @@ rec {
         layerClosure = writeReferencesToFile layer;
         passthru.buildArgs = args;
         passthru.layer = layer;
+        # Docker can't be made to run darwin binaries
+        meta.badPlatforms = lib.platforms.darwin;
       } ''
         ${lib.optionalString (tag == null) ''
           outName="$(basename "$out")"

pkgs/data/themes/canta/default.nix

@@ -0,0 +1,33 @@
+{ stdenv, fetchFromGitHub, gdk-pixbuf, librsvg, gtk-engine-murrine }:
+
+stdenv.mkDerivation rec {
+  pname = "canta-theme";
+  version = "2020-01-31";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = pname;
+    rev = version;
+    sha256 = "070lhbhh3n7nd6rkwm52v1x4v8spyb932w6qmgs2r19g0whyn55w";
+  };
+
+  buildInputs = [ gdk-pixbuf librsvg ];
+
+  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
+
+  installPhase = ''
+    patchShebangs .
+    mkdir -p $out/share/themes
+    name= ./install.sh -d $out/share/themes
+    install -D -t $out/share/backgrounds wallpaper/canta-wallpaper.svg
+    rm $out/share/themes/*/{AUTHORS,COPYING}
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Flat Design theme for GTK based desktop environments";
+    homepage = "https://github.com/vinceliuice/Canta-theme";
+    license = licenses.gpl2;
+    platforms = platforms.unix;
+    maintainers = [ maintainers.romildo ];
+  };
+}

pkgs/data/themes/yaru/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "yaru";
-  version = "19.10.4";
+  version = "19.10.5";
 
   src = fetchFromGitHub {
     owner = "ubuntu";
     repo = "yaru";
     rev = version;
-    sha256 = "1dj6awlz13787783ds9mdid75rd4vvgpg52h6x19pxdga3k17s9b";
+    sha256 = "0d53flfkb01kycchdhv72ga0qh8947bxvm5njfrrbk6rqfg0zc1v";
   };
 
   nativeBuildInputs = [ meson sassc pkg-config glib ninja python3 ];

pkgs/desktops/gnome-3/apps/evolution/default.nix

@@ -43,11 +43,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.34.2";
+  version = "3.34.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "164vy8h432pjglafn8y2ms4gsvk3kbgc63h5qp0mk5dv4smsp29c";
+    sha256 = "1s4y29iszvd3zppgxx2qc2jr1lg7ipl3072jnn8g2l3bghcvq7xq";
   };
 
   nativeBuildInputs = [

pkgs/desktops/plasma-5/kwin/scripts/krohnkite.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "krohnkite";
-  version = "0.5";
+  version = "0.6";
 
   src = fetchFromGitHub {
     owner = "esjeon";
     repo = "krohnkite";
     rev = "v${version}";
-    sha256 = "0i0xr5aj565dzr72zjg7wmyca2gwg9izhnri63pab5y5gp5zjqn2";
+    sha256 = "0gib39vvnpdynyfqfrkzri67dhr4lf3zpk3njw4zzkz97c8k6psq";
   };
 
   buildInputs = [

pkgs/desktops/xfce/applications/catfish/default.nix

@@ -5,11 +5,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "catfish";
-  version = "1.4.12";
+  version = "1.4.13";
 
   src = fetchurl {
     url = "https://archive.xfce.org/src/apps/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.bz2";
-    sha256 = "0jhk4x97vip6h7rsw8hbwzfjmz55w6dpcj9v96m54xr15gh31yy3";
+    sha256 = "0fg89946z6n8njxn4mv29jksw8yavg8vypsljn9031pjwl3fmh2q";
   };
 
   nativeBuildInputs = [
@@ -51,7 +51,7 @@ python3Packages.buildPythonApplication rec {
   doCheck = false;
 
   meta = with stdenv.lib; {
-    homepage = https://docs.xfce.org/apps/catfish/start;
+    homepage = "https://docs.xfce.org/apps/catfish/start";
     description = "Handy file search tool";
     longDescription = ''
       Catfish is a handy file searching tool. The interface is

pkgs/development/compilers/dale/default.nix

@@ -3,12 +3,12 @@
 , cmake
 , pkgconfig
 , libffi
-, llvm_35
+, llvm_6
 , doCheck ? false
 , perl
 }:
 
-let version = "20170519";
+let version = "20181024";
 
 in stdenv.mkDerivation {
   pname = "dale";
@@ -17,16 +17,14 @@ in stdenv.mkDerivation {
   src = fetchFromGitHub {
     owner = "tomhrr";
     repo = "dale";
-    rev = "39e16d8e89fa070de65a673d4462e783d530f95a";
+    rev = "f5db8b486f4e7c423fc25941a8315f1209bc0e54";
-    sha256 = "0dc5cjahv7lzlp92hidlh83rwgrpgb6xz2pnba2pm5xrv2pnsskl";
+    sha256 = "0v4ajrzrqvf279kd7wsd9flrpsav57lzxlwwimk9vnfwh7xpzf9v";
   };
 
   nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ cmake libffi llvm_35 ]
+  buildInputs = [ cmake libffi llvm_6 ]
              ++ stdenv.lib.optional doCheck perl;
 
-  patches = [ ./link-llvm.patch ];
-
   inherit doCheck;
 
   checkTarget = "tests";