Merge master into staging-next

doc/languages-frameworks/python.section.md

@@ -1061,11 +1061,9 @@ in pkgs.mkShell rec {
     pythonPackages.numpy
     pythonPackages.requests
 
-    # the following packages are related to the dependencies of your python
+    # In this particular example, in order to compile any binary extensions they may
-    # project.
+    # require, the python modules listed in the hypothetical requirements.txt need
-    # In this particular example the python modules listed in the
+    # the following packages to be installed locally:
-    # requirements.txt require the following packages to be installed locally
-    # in order to compile any binary extensions they may require.
     taglib
     openssl
     git
@@ -1075,7 +1073,8 @@ in pkgs.mkShell rec {
     zlib
   ];
 
-  # Now we can execute any commands within the virtual environment
+  # Now we can execute any commands within the virtual environment.
+  # This is optional and can be left out to run pip manually.
   postShellHook = ''
     pip install -r requirements.txt
   '';
@@ -1091,12 +1090,14 @@ with import <nixpkgs> { };
 
 let
   venvDir = "./.venv";
+  pythonPackages = python3Packages;
 in pkgs.mkShell rec {
   name = "impurePythonEnv";
   buildInputs = [
-    python3Packages.python
+    pythonPackages.python
-    python3Packages.virtualenv
+    # Needed when using python 2.7
-    ...
+    # pythonPackages.virtualenv
+    # ...
   ];
 
   # This is very close to how venvShellHook is implemented, but
@@ -1108,14 +1109,18 @@ in pkgs.mkShell rec {
       echo "Skipping venv creation, '${venvDir}' already exists"
     else
       echo "Creating new venv environment in path: '${venvDir}'"
+      # Note that the module venv was only introduced in python 3, so for 2.7
+      # this needs to be replaced with a call to virtualenv
       ${pythonPackages.python.interpreter} -m venv "${venvDir}"
     fi
 
     # Under some circumstances it might be necessary to add your virtual
     # environment to PYTHONPATH, which you can do here too;
-    # PYTHONPATH=$PWD/${venvDir}/${python.sitePackages}/:$PYTHONPATH
+    # PYTHONPATH=$PWD/${venvDir}/${pythonPackages.python.sitePackages}/:$PYTHONPATH
 
     source "${venvDir}/bin/activate"
+
+    # As in the previous example, this is optional.
     pip install -r requirements.txt
   '';
 }

maintainers/maintainer-list.nix

@@ -3878,6 +3878,12 @@
     githubId = 17659803;
     name = "Matthias Axel Kröll";
   };
+  kristian-brucaj = {
+    email = "kbrucaj@gmail.com";
+    github = "kristian-brucaj";
+    githubID = "8893110";
+    name = "Kristian Brucaj";
+  };
   kristoff3r = {
     email = "k.soeholm@gmail.com";
     github = "kristoff3r";

nixos/doc/manual/release-notes/rl-2003.xml

@@ -577,6 +577,27 @@ auth required pam_succeed_if.so uid >= 1000 quiet
      as they aren't provided by upstream anymore.
     </para>
    </listitem>
+   <listitem>
+    <para>
+     The <option>services.dnscrypt-proxy</option> module has been removed
+     as it used the deprecated version of dnscrypt-proxy. We've added
+     <xref linkend="opt-services.dnscrypt-proxy2.enable"/> to use the supported version.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <literal>qesteidutil</literal> has been deprecated in favor of <literal>qdigidoc</literal>.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     <package>sqldeveloper_18</package> has been removed as it's not maintained anymore,
+     <package>sqldeveloper</package> has been updated to version <literal>19.4</literal>.
+     Please note that this means that this means that the <package>oraclejdk</package> is now
+     required. For further information please read the
+     <link xlink:href="https://www.oracle.com/technetwork/developer-tools/sql-developer/downloads/sqldev-relnotes-194-5908846.html">release notes</link>.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 

nixos/modules/config/ldap.nix

@@ -28,8 +28,6 @@ let
   };
 
   nslcdConfig = writeText "nslcd.conf" ''
-    uid nslcd
-    gid nslcd
     uri ${cfg.server}
     base ${cfg.base}
     timelimit ${toString cfg.timeLimit}
@@ -282,6 +280,7 @@ in
           Group = "nslcd";
           RuntimeDirectory = [ "nslcd" ];
           PIDFile = "/run/nslcd/nslcd.pid";
+          AmbientCapabilities = "CAP_SYS_RESOURCE";
         };
       };
 

nixos/modules/config/resolvconf.nix

@@ -38,6 +38,7 @@ in
     (mkRenamedOptionModule [ "networking" "dnsExtensionMechanism" ] [ "networking" "resolvconf" "dnsExtensionMechanism" ])
     (mkRenamedOptionModule [ "networking" "extraResolvconfConf" ] [ "networking" "resolvconf" "extraConfig" ])
     (mkRenamedOptionModule [ "networking" "resolvconfOptions" ] [ "networking" "resolvconf" "extraOptions" ])
+    (mkRemovedOptionModule [ "networking" "resolvconf" "useHostResolvConf" ] "This option was never used for anything anyways")
   ];
 
   options = {
@@ -53,15 +54,6 @@ in
         '';
       };
 
-      useHostResolvConf = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          In containers, whether to use the
-          <filename>resolv.conf</filename> supplied by the host.
-        '';
-      };
-
       dnsSingleRequest = lib.mkOption {
         type = types.bool;
         default = false;

nixos/modules/hardware/openrazer.nix

@@ -49,7 +49,7 @@ in
 {
   options = {
     hardware.openrazer = {
-      enable = mkEnableOption "OpenRazer drivers and userspace daemon.";
+      enable = mkEnableOption "OpenRazer drivers and userspace daemon";
 
       verboseLogging = mkOption {
         type = types.bool;

nixos/modules/module-list.nix

@@ -529,6 +529,7 @@
   ./services/monitoring/prometheus/alertmanager.nix
   ./services/monitoring/prometheus/exporters.nix
   ./services/monitoring/prometheus/pushgateway.nix
+  ./services/monitoring/prometheus/xmpp-alerts.nix
   ./services/monitoring/riemann.nix
   ./services/monitoring/riemann-dash.nix
   ./services/monitoring/riemann-tools.nix
@@ -590,7 +591,7 @@
   ./services/networking/dhcpd.nix
   ./services/networking/dnscache.nix
   ./services/networking/dnschain.nix
-  ./services/networking/dnscrypt-proxy.nix
+  ./services/networking/dnscrypt-proxy2.nix
   ./services/networking/dnscrypt-wrapper.nix
   ./services/networking/dnsdist.nix
   ./services/networking/dnsmasq.nix

nixos/modules/programs/bash/bash.nix

@@ -32,6 +32,10 @@ let
     fi
   '';
 
+  lsColors = optionalString cfg.enableLsColors ''
+    eval "$(${pkgs.coreutils}/bin/dircolors -b)"
+  '';
+
   bashAliases = concatStringsSep "\n" (
     mapAttrsFlatten (k: v: "alias ${k}=${escapeShellArg v}")
       (filterAttrs (k: v: v != null) cfg.shellAliases)
@@ -127,6 +131,14 @@ in
         type = types.bool;
       };
 
+      enableLsColors = mkOption {
+        default = true;
+        description = ''
+          Enable extra colors in directory listings.
+        '';
+        type = types.bool;
+      };
+
     };
 
   };
@@ -156,6 +168,7 @@ in
 
         ${cfg.promptInit}
         ${bashCompletion}
+        ${lsColors}
         ${bashAliases}
 
         ${cfge.interactiveShellInit}

nixos/modules/rename.nix

@@ -41,6 +41,7 @@ with lib;
       LightDM. Please use the services.xserver.displayManager.lightdm.autoLogin options
       instead, or any other display manager in NixOS as they all support auto-login.
     '')
+    (mkRemovedOptionModule [ "services" "dnscrypt-proxy" ] "Use services.dnscrypt-proxy2 instead")
 
     # Do NOT add any option renames here, see top of the file
   ];

nixos/modules/services/hardware/irqbalance.nix

@@ -13,18 +13,12 @@ in
 
   config = mkIf cfg.enable {
 
-    systemd.services = {
-      irqbalance = {
-        description = "irqbalance daemon";
-        path = [ pkgs.irqbalance ];
-        serviceConfig =
-          { ExecStart = "${pkgs.irqbalance}/bin/irqbalance --foreground"; };
-        wantedBy = [ "multi-user.target" ];
-      };
-    };
-
     environment.systemPackages = [ pkgs.irqbalance ];
 
+    systemd.services.irqbalance.wantedBy = ["multi-user.target"];
+
+    systemd.packages = [ pkgs.irqbalance ];
+
   };
 
 }

nixos/modules/services/monitoring/prometheus/xmpp-alerts.nix

@@ -0,0 +1,47 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.prometheus.xmpp-alerts;
+
+  configFile = pkgs.writeText "prometheus-xmpp-alerts.yml" (builtins.toJSON cfg.configuration);
+
+in
+
+{
+  options.services.prometheus.xmpp-alerts = {
+
+    enable = mkEnableOption "XMPP Web hook service for Alertmanager";
+
+    configuration = mkOption {
+      type = types.attrs;
+      description = "Configuration as attribute set which will be converted to YAML";
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.prometheus-xmpp-alerts = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      serviceConfig = {
+        ExecStart = "${pkgs.prometheus-xmpp-alerts}/bin/prometheus-xmpp-alerts --config ${configFile}";
+        Restart = "on-failure";
+        DynamicUser = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHome = true;
+        ProtectSystem = "strict";
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        NoNewPrivileges = true;
+        SystemCallArchitectures = "native";
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        SystemCallFilter = [ "@system-service" ];
+      };
+    };
+  };
+}

nixos/modules/services/networking/dhcpcd.nix

@@ -190,6 +190,8 @@ in
         before = [ "network-online.target" ];
         after = [ "systemd-udev-settle.service" ];
 
+        restartTriggers = [ exitHook ];
+
         # Stopping dhcpcd during a reconfiguration is undesirable
         # because it brings down the network interfaces configured by
         # dhcpcd.  So do a "systemctl restart" instead.

nixos/modules/services/networking/dnscrypt-proxy.nix

@@ -1,328 +0,0 @@
-{ config, lib, pkgs, ... }:
-with lib;
-
-let
-  cfg = config.services.dnscrypt-proxy;
-
-  stateDirectory = "/var/lib/dnscrypt-proxy";
-
-  # The minisign public key used to sign the upstream resolver list.
-  # This is somewhat more flexible than preloading the key as an
-  # embedded string.
-  upstreamResolverListPubKey = pkgs.fetchurl {
-    url = https://raw.githubusercontent.com/dyne/dnscrypt-proxy/master/minisign.pub;
-    sha256 = "18lnp8qr6ghfc2sd46nn1rhcpr324fqlvgsp4zaigw396cd7vnnh";
-  };
-
-  # Internal flag indicating whether the upstream resolver list is used.
-  useUpstreamResolverList = cfg.customResolver == null;
-
-  # The final local address.
-  localAddress = "${cfg.localAddress}:${toString cfg.localPort}";
-
-  # The final resolvers list path.
-  resolverList = "${stateDirectory}/dnscrypt-resolvers.csv";
-
-  # Build daemon command line
-
-  resolverArgs =
-    if (cfg.customResolver == null)
-      then
-        [ "-L ${resolverList}"
-          "-R ${cfg.resolverName}"
-        ]
-      else with cfg.customResolver;
-        [ "-N ${name}"
-          "-k ${key}"
-          "-r ${address}:${toString port}"
-        ];
-
-  daemonArgs =
-       [ "-a ${localAddress}" ]
-    ++ resolverArgs
-    ++ cfg.extraArgs;
-in
-
-{
-  meta = {
-    maintainers = with maintainers; [ joachifm ];
-    doc = ./dnscrypt-proxy.xml;
-  };
-
-  options = {
-    # Before adding another option, consider whether it could
-    # equally well be passed via extraArgs.
-
-    services.dnscrypt-proxy = {
-      enable = mkOption {
-        default = false;
-        type = types.bool;
-        description = "Whether to enable the DNSCrypt client proxy";
-      };
-
-      localAddress = mkOption {
-        default = "127.0.0.1";
-        type = types.str;
-        description = ''
-          Listen for DNS queries to relay on this address. The only reason to
-          change this from its default value is to proxy queries on behalf
-          of other machines (typically on the local network).
-        '';
-      };
-
-      localPort = mkOption {
-        default = 53;
-        type = types.int;
-        description = ''
-          Listen for DNS queries to relay on this port. The default value
-          assumes that the DNSCrypt proxy should relay DNS queries directly.
-          When running as a forwarder for another DNS client, set this option
-          to a different value; otherwise leave the default.
-        '';
-      };
-
-      resolverName = mkOption {
-        default = "random";
-        example = "dnscrypt.eu-nl";
-        type = types.nullOr types.str;
-        description = ''
-          The name of the DNSCrypt resolver to use, taken from
-          <filename>${resolverList}</filename>.  The default is to
-          pick a random non-logging resolver that supports DNSSEC.
-        '';
-      };
-
-      customResolver = mkOption {
-        default = null;
-        description = ''
-          Use an unlisted resolver (e.g., a private DNSCrypt provider). For
-          advanced users only. If specified, this option takes precedence.
-        '';
-        type = types.nullOr (types.submodule ({ ... }: { options = {
-          address = mkOption {
-            type = types.str;
-            description = "IP address";
-            example = "208.67.220.220";
-          };
-
-          port = mkOption {
-            type = types.int;
-            description = "Port";
-            default = 443;
-          };
-
-          name = mkOption {
-            type = types.str;
-            description = "Fully qualified domain name";
-            example = "2.dnscrypt-cert.example.com";
-          };
-
-          key = mkOption {
-            type = types.str;
-            description = "Public key";
-            example = "B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79";
-          };
-        }; }));
-      };
-
-      extraArgs = mkOption {
-        default = [];
-        type = types.listOf types.str;
-        description = ''
-          Additional command-line arguments passed verbatim to the daemon.
-          See <citerefentry><refentrytitle>dnscrypt-proxy</refentrytitle>
-          <manvolnum>8</manvolnum></citerefentry> for details.
-        '';
-        example = [ "-X libdcplugin_example_cache.so,--min-ttl=60" ];
-      };
-    };
-  };
-
-  config = mkIf cfg.enable (mkMerge [{
-    assertions = [
-      { assertion = (cfg.customResolver != null) || (cfg.resolverName != null);
-        message   = "please configure upstream DNSCrypt resolver";
-      }
-    ];
-
-    # make man 8 dnscrypt-proxy work
-    environment.systemPackages = [ pkgs.dnscrypt-proxy ];
-
-    users.users.dnscrypt-proxy = {
-      description = "dnscrypt-proxy daemon user";
-      isSystemUser = true;
-      group = "dnscrypt-proxy";
-    };
-    users.groups.dnscrypt-proxy = {};
-
-    systemd.sockets.dnscrypt-proxy = {
-      description = "dnscrypt-proxy listening socket";
-      documentation = [ "man:dnscrypt-proxy(8)" ];
-
-      wantedBy = [ "sockets.target" ];
-
-      socketConfig = {
-        ListenStream = localAddress;
-        ListenDatagram = localAddress;
-      };
-    };
-
-    systemd.services.dnscrypt-proxy = {
-      description = "dnscrypt-proxy daemon";
-      documentation = [ "man:dnscrypt-proxy(8)" ];
-
-      before = [ "nss-lookup.target" ];
-      after = [ "network.target" ];
-      requires = [ "dnscrypt-proxy.socket "];
-
-      serviceConfig = {
-        NonBlocking = "true";
-        ExecStart = "${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy ${toString daemonArgs}";
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-
-        User = "dnscrypt-proxy";
-
-        PrivateTmp = true;
-        PrivateDevices = true;
-        ProtectHome = true;
-      };
-    };
-    }
-
-    (mkIf config.security.apparmor.enable {
-    systemd.services.dnscrypt-proxy.after = [ "apparmor.service" ];
-
-    security.apparmor.profiles = singleton (pkgs.writeText "apparmor-dnscrypt-proxy" ''
-      ${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy {
-        /dev/null rw,
-        /dev/random r,
-        /dev/urandom r,
-
-        /etc/passwd r,
-        /etc/group r,
-        ${config.environment.etc."nsswitch.conf".source} r,
-
-        ${getLib pkgs.glibc}/lib/*.so mr,
-        ${pkgs.tzdata}/share/zoneinfo/** r,
-
-        network inet stream,
-        network inet6 stream,
-        network inet dgram,
-        network inet6 dgram,
-
-        ${getLib pkgs.dnscrypt-proxy}/lib/dnscrypt-proxy/libdcplugin*.so mr,
-
-        ${getLib pkgs.gcc.cc}/lib/libssp.so.* mr,
-        ${getLib pkgs.libsodium}/lib/libsodium.so.* mr,
-        ${getLib pkgs.systemd}/lib/libsystemd.so.* mr,
-        ${getLib pkgs.utillinuxMinimal.out}/lib/libmount.so.* mr,
-        ${getLib pkgs.utillinuxMinimal.out}/lib/libblkid.so.* mr,
-        ${getLib pkgs.utillinuxMinimal.out}/lib/libuuid.so.* mr,
-        ${getLib pkgs.xz}/lib/liblzma.so.* mr,
-        ${getLib pkgs.libgcrypt}/lib/libgcrypt.so.* mr,
-        ${getLib pkgs.libgpgerror}/lib/libgpg-error.so.* mr,
-        ${getLib pkgs.libcap}/lib/libcap.so.* mr,
-        ${getLib pkgs.lz4}/lib/liblz4.so.* mr,
-        ${getLib pkgs.attr}/lib/libattr.so.* mr, # */
-
-        ${resolverList} r,
-
-        /run/systemd/notify rw,
-      }
-    '');
-    })
-
-    (mkIf useUpstreamResolverList {
-    systemd.services.init-dnscrypt-proxy-statedir = {
-      description = "Initialize dnscrypt-proxy state directory";
-
-      wantedBy = [ "dnscrypt-proxy.service" ];
-      before = [ "dnscrypt-proxy.service" ];
-
-      script = ''
-        mkdir -pv ${stateDirectory}
-        chown -c dnscrypt-proxy:dnscrypt-proxy ${stateDirectory}
-        cp -uv \
-          ${pkgs.dnscrypt-proxy}/share/dnscrypt-proxy/dnscrypt-resolvers.csv \
-          ${stateDirectory}
-      '';
-
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-      };
-    };
-
-    systemd.services.update-dnscrypt-resolvers = {
-      description = "Update list of DNSCrypt resolvers";
-
-      requires = [ "init-dnscrypt-proxy-statedir.service" ];
-      after = [ "init-dnscrypt-proxy-statedir.service" ];
-
-      path = with pkgs; [ curl diffutils dnscrypt-proxy minisign ];
-      script = ''
-        cd ${stateDirectory}
-        domain=raw.githubusercontent.com
-        get="curl -fSs --resolve $domain:443:$(hostip -r 8.8.8.8 $domain | head -1)"
-        $get -o dnscrypt-resolvers.csv.tmp \
-          https://$domain/dyne/dnscrypt-proxy/master/dnscrypt-resolvers.csv
-        $get -o dnscrypt-resolvers.csv.minisig.tmp \
-          https://$domain/dyne/dnscrypt-proxy/master/dnscrypt-resolvers.csv.minisig
-        mv dnscrypt-resolvers.csv.minisig{.tmp,}
-        if ! minisign -q -V -p ${upstreamResolverListPubKey} \
-          -m dnscrypt-resolvers.csv.tmp -x dnscrypt-resolvers.csv.minisig ; then
-          echo "failed to verify resolver list!" >&2
-          exit 1
-        fi
-        [[ -f dnscrypt-resolvers.csv ]] && mv dnscrypt-resolvers.csv{,.old}
-        mv dnscrypt-resolvers.csv{.tmp,}
-        if cmp dnscrypt-resolvers.csv{,.old} ; then
-          echo "no change"
-        else
-          echo "resolver list updated"
-        fi
-      '';
-
-      serviceConfig = {
-        PrivateTmp = true;
-        PrivateDevices = true;
-        ProtectHome = true;
-        ProtectSystem = "strict";
-        ReadWritePaths = "${dirOf stateDirectory} ${stateDirectory}";
-        SystemCallFilter = "~@mount";
-      };
-    };
-
-    systemd.timers.update-dnscrypt-resolvers = {
-      wantedBy = [ "timers.target" ];
-      timerConfig = {
-        OnBootSec = "5min";
-        OnUnitActiveSec = "6h";
-      };
-    };
-    })
-    ]);
-
-  imports = [
-    (mkRenamedOptionModule [ "services" "dnscrypt-proxy" "port" ] [ "services" "dnscrypt-proxy" "localPort" ])
-
-    (mkChangedOptionModule
-      [ "services" "dnscrypt-proxy" "tcpOnly" ]
-      [ "services" "dnscrypt-proxy" "extraArgs" ]
-      (config:
-        let val = getAttrFromPath [ "services" "dnscrypt-proxy" "tcpOnly" ] config; in
-        optional val "-T"))
-
-    (mkChangedOptionModule
-      [ "services" "dnscrypt-proxy" "ephemeralKeys" ]
-      [ "services" "dnscrypt-proxy" "extraArgs" ]
-      (config:
-        let val = getAttrFromPath [ "services" "dnscrypt-proxy" "ephemeralKeys" ] config; in
-        optional val "-E"))
-
-    (mkRemovedOptionModule [ "services" "dnscrypt-proxy" "resolverList" ] ''
-      The current resolver listing from upstream is always used
-      unless a custom resolver is specified.
-    '')
-  ];
-}

nixos/modules/services/networking/dnscrypt-proxy.xml

@@ -1,66 +0,0 @@
-<chapter xmlns="http://docbook.org/ns/docbook"
-         xmlns:xlink="http://www.w3.org/1999/xlink"
-         xmlns:xi="http://www.w3.org/2001/XInclude"
-         version="5.0"
-         xml:id="sec-dnscrypt-proxy">
- <title>DNSCrypt client proxy</title>
- <para>
-  The DNSCrypt client proxy relays DNS queries to a DNSCrypt enabled upstream
-  resolver. The traffic between the client and the upstream resolver is
-  encrypted and authenticated, mitigating the risk of MITM attacks, DNS
-  poisoning attacks, and third-party snooping (assuming the upstream is
-  trustworthy).
- </para>
- <sect1 xml:id="sec-dnscrypt-proxy-configuration">
-  <title>Basic configuration</title>
-
-  <para>
-   To enable the client proxy, set
-<programlisting>
-<xref linkend="opt-services.dnscrypt-proxy.enable"/> = true;
-</programlisting>
-  </para>
-
-  <para>
-   Enabling the client proxy does not alter the system nameserver; to relay
-   local queries, prepend <literal>127.0.0.1</literal> to
-   <option>networking.nameservers</option>.
-  </para>
- </sect1>
- <sect1 xml:id="sec-dnscrypt-proxy-forwarder">
-  <title>As a forwarder for another DNS client</title>
-
-  <para>
-   To run the DNSCrypt proxy client as a forwarder for another DNS client,
-   change the default proxy listening port to a non-standard value and point
-   the other client to it:
-<programlisting>
-<xref linkend="opt-services.dnscrypt-proxy.localPort"/> = 43;
-</programlisting>
-  </para>
-
-  <sect2 xml:id="sec-dnscrypt-proxy-forwarder-dsnmasq">
-   <title>dnsmasq</title>
-   <para>
-<programlisting>
-{
-  <xref linkend="opt-services.dnsmasq.enable"/> = true;
-  <xref linkend="opt-services.dnsmasq.servers"/> = [ "127.0.0.1#43" ];
-}
-</programlisting>
-   </para>
-  </sect2>
-
-  <sect2 xml:id="sec-dnscrypt-proxy-forwarder-unbound">
-   <title>unbound</title>
-   <para>
-<programlisting>
-{
-  <xref linkend="opt-services.unbound.enable"/> = true;
-  <xref linkend="opt-services.unbound.forwardAddresses"/> = [ "127.0.0.1@43" ];
-}
-</programlisting>
-   </para>
-  </sect2>
- </sect1>
-</chapter>

nixos/modules/services/networking/dnscrypt-proxy2.nix

@@ -0,0 +1,61 @@
+{ config, lib, pkgs, ... }: with lib;
+
+let
+  cfg = config.services.dnscrypt-proxy2;
+in
+
+{
+  options.services.dnscrypt-proxy2 = {
+    enable = mkEnableOption "dnscrypt-proxy2";
+
+    settings = mkOption {
+      description = ''
+        Attrset that is converted and passed as TOML config file.
+        For available params, see: <link xlink:href="https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml"/>
+      '';
+      example = literalExample ''
+        {
+          sources.public-resolvers = {
+            urls = [ "https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md" ];
+            cache_file = "public-resolvers.md";
+            minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
+            refresh_delay = 72;
+          };
+        }
+      '';
+      type = types.attrs;
+      default = {};
+    };
+
+    configFile = mkOption {
+      description = ''
+        Path to TOML config file. See: <link xlink:href="https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml"/>
+        If this option is set, it will override any configuration done in options.services.dnscrypt-proxy2.settings.
+      '';
+      example = "/etc/dnscrypt-proxy/dnscrypt-proxy.toml";
+      type = types.path;
+      default = pkgs.runCommand "dnscrypt-proxy.toml" {
+        json = builtins.toJSON cfg.settings;
+        passAsFile = [ "json" ];
+      } ''
+        ${pkgs.remarshal}/bin/json2toml < $jsonPath > $out
+      '';
+      defaultText = literalExample "TOML file generated from services.dnscrypt-proxy2.settings";
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    networking.nameservers = lib.mkDefault [ "127.0.0.1" ];
+
+    systemd.services.dnscrypt-proxy2 = {
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        DynamicUser = true;
+        ExecStart = "${pkgs.dnscrypt-proxy2}/bin/dnscrypt-proxy -config ${cfg.configFile}";
+      };
+    };
+  };
+}

nixos/modules/system/boot/loader/grub/grub.nix

@@ -630,7 +630,7 @@ in
 
       boot.loader.grub.extraPrepareConfig =
         concatStrings (mapAttrsToList (n: v: ''
-          ${pkgs.coreutils}/bin/cp -pf "${v}" "/boot/${n}"
+          ${pkgs.coreutils}/bin/cp -pf "${v}" "@bootPath@/${n}"
         '') config.boot.loader.grub.extraFiles);
 
       assertions = [

nixos/modules/system/boot/loader/grub/install-grub.pl

@@ -475,6 +475,9 @@ if ($grubVersion == 2) {
     }
 }
 
+# extraPrepareConfig could refer to @bootPath@, which we have to substitute
+$extraPrepareConfig =~ s/\@bootPath\@/$bootPath/g;
+
 # Run extraPrepareConfig in sh
 if ($extraPrepareConfig ne "") {
   system((get("shell"), "-c", $extraPrepareConfig));

nixos/modules/system/boot/systemd.nix

@@ -697,6 +697,16 @@ in
       '';
     };
 
+    systemd.sleep.extraConfig = mkOption {
+      default = "";
+      type = types.lines;
+      example = "HibernateDelaySec=1h";
+      description = ''
+        Extra config options for systemd sleep state logic.
+        See sleep.conf.d(5) man page for available options.
+      '';
+    };
+
     systemd.user.extraConfig = mkOption {
       default = "";
       type = types.lines;
@@ -863,6 +873,7 @@ in
 
       "systemd/sleep.conf".text = ''
         [Sleep]
+        ${config.systemd.sleep.extraConfig}
       '';
 
       # install provided sysctl snippets

nixos/tests/all-tests.nix

@@ -65,7 +65,7 @@ in
   couchdb = handleTest ./couchdb.nix {};
   deluge = handleTest ./deluge.nix {};
   dhparams = handleTest ./dhparams.nix {};
-  dnscrypt-proxy = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy.nix {};
+  dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
   docker = handleTestOn ["x86_64-linux"] ./docker.nix {};
   docker-containers = handleTestOn ["x86_64-linux"] ./docker-containers.nix {};
   docker-edge = handleTestOn ["x86_64-linux"] ./docker-edge.nix {};
@@ -213,8 +213,7 @@ in
   openldap = handleTest ./openldap.nix {};
   opensmtpd = handleTest ./opensmtpd.nix {};
   openssh = handleTest ./openssh.nix {};
-  # openstack-image-userdata doesn't work in a sandbox as the simulated openstack instance needs network access
+  openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
-  #openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
   openstack-image-metadata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).metadata or {};
   orangefs = handleTest ./orangefs.nix {};
   os-prober = handleTestOn ["x86_64-linux"] ./os-prober.nix {};

nixos/tests/dnscrypt-proxy2.nix

@@ -1,5 +1,5 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
-  name = "dnscrypt-proxy";
+  name = "dnscrypt-proxy2";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ joachifm ];
   };
@@ -13,9 +13,16 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     {
       security.apparmor.enable = true;
 
-      services.dnscrypt-proxy.enable = true;
+      services.dnscrypt-proxy2.enable = true;
-      services.dnscrypt-proxy.localPort = localProxyPort;
+      services.dnscrypt-proxy2.settings = {
-      services.dnscrypt-proxy.extraArgs = [ "-X libdcplugin_example.so" ];
+        listen_addresses = [ "127.0.0.1:${toString localProxyPort}" ];
+        sources.public-resolvers = {
+          urls = [ "https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md" ];
+          cache_file = "public-resolvers.md";
+          minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3";
+          refresh_delay = 72;
+        };
+      };
 
       services.dnsmasq.enable = true;
       services.dnsmasq.servers = [ "127.0.0.1#${toString localProxyPort}" ];
@@ -24,12 +31,6 @@ import ./make-test-python.nix ({ pkgs, ... }: {
 
   testScript = ''
     client.wait_for_unit("dnsmasq")
-
+    client.wait_for_unit("dnscrypt-proxy2")
-    # The daemon is socket activated; sending a single ping should activate it.
-    client.fail("systemctl is-active dnscrypt-proxy")
-    client.execute(
-        "${pkgs.iputils}/bin/ping -c1 example.com"
-    )
-    client.wait_until_succeeds("systemctl is-active dnscrypt-proxy")
   '';
 })

nixos/tests/misc.nix

@@ -1,6 +1,6 @@
 # Miscellaneous small tests that don't warrant their own VM run.
 
-import ./make-test.nix ({ pkgs, ...} : rec {
+import ./make-test-python.nix ({ pkgs, ...} : rec {
   name = "misc";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = [ eelco ];
@@ -34,109 +34,97 @@ import ./make-test.nix ({ pkgs, ...} : rec {
 
   testScript =
     ''
-      subtest "nix-db", sub {
+      import json
-          my $json = $machine->succeed("nix path-info --json ${foo}");
-          $json =~ /"narHash":"sha256:0afw0d9j1hvwiz066z93jiddc33nxg6i6qyp26vnqyglpyfivlq5"/ or die "narHash not set";
-          $json =~ /"narSize":128/ or die "narSize not set";
-      };
 
-      subtest "nixos-version", sub {
-          $machine->succeed("[ `nixos-version | wc -w` = 2 ]");
-      };
 
-      subtest "nixos-rebuild", sub {
+      def get_path_info(path):
-          $machine->succeed("nixos-rebuild --help | grep 'NixOS module' ");
+          result = machine.succeed(f"nix path-info --json {path}")
-      };
+          parsed = json.loads(result)
+          return parsed
 
-      # Sanity check for uid/gid assignment.
-      subtest "users-groups", sub {
-          $machine->succeed("[ `id -u messagebus` = 4 ]");
-          $machine->succeed("[ `id -g messagebus` = 4 ]");
-          $machine->succeed("[ `getent group users` = 'users:x:100:' ]");
-      };
 
-      # Regression test for GMP aborts on QEMU.
+      with subtest("nix-db"):
-      subtest "gmp", sub {
+          info = get_path_info("${foo}")
-          $machine->succeed("expr 1 + 2");
-      };
 
-      # Test that the swap file got created.
+          if (
-      subtest "swapfile", sub {
+              info[0]["narHash"]
-          $machine->waitForUnit("root-swapfile.swap");
+              != "sha256:0afw0d9j1hvwiz066z93jiddc33nxg6i6qyp26vnqyglpyfivlq5"
-          $machine->succeed("ls -l /root/swapfile | grep 134217728");
+          ):
-      };
+              raise Exception("narHash not set")
 
-      # Test whether kernel.poweroff_cmd is set.
+          if info[0]["narSize"] != 128:
-      subtest "poweroff_cmd", sub {
+              raise Exception("narSize not set")
-          $machine->succeed("[ -x \"\$(cat /proc/sys/kernel/poweroff_cmd)\" ]")
-      };
 
-      # Test whether the blkio controller is properly enabled.
+      with subtest("nixos-version"):
-      subtest "blkio-cgroup", sub {
+          machine.succeed("[ `nixos-version | wc -w` = 2 ]")
-          $machine->succeed("[ -n \"\$(cat /sys/fs/cgroup/blkio/blkio.sectors)\" ]")
-      };
 
-      # Test whether we have a reboot record in wtmp.
+      with subtest("nixos-rebuild"):
-      subtest "reboot-wtmp", sub {
+          assert "NixOS module" in machine.succeed("nixos-rebuild --help")
-          $machine->shutdown;
-          $machine->waitForUnit('multi-user.target');
-          $machine->succeed("last | grep reboot >&2");
-      };
 
-      # Test whether we can override environment variables.
+      with subtest("Sanity check for uid/gid assignment"):
-      subtest "override-env-var", sub {
+          assert "4" == machine.succeed("id -u messagebus").strip()
-          $machine->succeed('[ "$EDITOR" = emacs ]');
+          assert "4" == machine.succeed("id -g messagebus").strip()
-      };
+          assert "users:x:100:" == machine.succeed("getent group users").strip()
 
-      # Test whether hostname (and by extension nss_myhostname) works.
+      with subtest("Regression test for GMP aborts on QEMU."):
-      subtest "hostname", sub {
+          machine.succeed("expr 1 + 2")
-          $machine->succeed('[ "`hostname`" = machine ]');
-          #$machine->succeed('[ "`hostname -s`" = machine ]');
-      };
 
-      # Test whether systemd-udevd automatically loads modules for our hardware.
+      with subtest("the swap file got created"):
-      $machine->succeed("systemctl start systemd-udev-settle.service");
+          machine.wait_for_unit("root-swapfile.swap")
-      subtest "udev-auto-load", sub {
+          machine.succeed("ls -l /root/swapfile | grep 134217728")
-          $machine->waitForUnit('systemd-udev-settle.service');
-          $machine->succeed('lsmod | grep mousedev');
-      };
 
-      # Test whether systemd-tmpfiles-clean works.
+      with subtest("whether kernel.poweroff_cmd is set"):
-      subtest "tmpfiles", sub {
+          machine.succeed('[ -x "$(cat /proc/sys/kernel/poweroff_cmd)" ]')
-          $machine->succeed('touch /tmp/foo');
-          $machine->succeed('systemctl start systemd-tmpfiles-clean');
-          $machine->succeed('[ -e /tmp/foo ]');
-          $machine->succeed('date -s "@$(($(date +%s) + 1000000))"'); # move into the future
-          $machine->succeed('systemctl start systemd-tmpfiles-clean');
-          $machine->fail('[ -e /tmp/foo ]');
-      };
 
-      # Test whether automounting works.
+      with subtest("whether the blkio controller is properly enabled"):
-      subtest "automount", sub {
+          machine.succeed("[ -e /sys/fs/cgroup/blkio/blkio.reset_stats ]")
-          $machine->fail("grep '/tmp2 tmpfs' /proc/mounts");
-          $machine->succeed("touch /tmp2/x");
-          $machine->succeed("grep '/tmp2 tmpfs' /proc/mounts");
-      };
 
-      subtest "shell-vars", sub {
+      with subtest("whether we have a reboot record in wtmp"):
-          $machine->succeed('[ -n "$NIX_PATH" ]');
+          machine.shutdown
-      };
+          machine.wait_for_unit("multi-user.target")
+          machine.succeed("last | grep reboot >&2")
 
-      subtest "nix-db", sub {
+      with subtest("whether we can override environment variables"):
-          $machine->succeed("nix-store -qR /run/current-system | grep nixos-");
+          machine.succeed('[ "$EDITOR" = emacs ]')
-      };
 
-      # Test sysctl
+      with subtest("whether hostname (and by extension nss_myhostname) works"):
-      subtest "sysctl", sub {
+          assert "machine" == machine.succeed("hostname").strip()
-          $machine->waitForUnit("systemd-sysctl.service");
+          assert "machine" == machine.succeed("hostname -s").strip()
-          $machine->succeed('[ `sysctl -ne vm.swappiness` = 1 ]');
-          $machine->execute('sysctl vm.swappiness=60');
-          $machine->succeed('[ `sysctl -ne vm.swappiness` = 60 ]');
-      };
 
-      # Test boot parameters
+      with subtest("whether systemd-udevd automatically loads modules for our hardware"):
-      subtest "bootparam", sub {
+          machine.succeed("systemctl start systemd-udev-settle.service")
-          $machine->succeed('grep -Fq vsyscall=emulate /proc/cmdline');
+          machine.wait_for_unit("systemd-udev-settle.service")
-      };
+          assert "mousedev" in machine.succeed("lsmod")
+
+      with subtest("whether systemd-tmpfiles-clean works"):
+          machine.succeed(
+              "touch /tmp/foo", "systemctl start systemd-tmpfiles-clean", "[ -e /tmp/foo ]"
+          )
+          # move into the future
+          machine.succeed(
+              'date -s "@$(($(date +%s) + 1000000))"',
+              "systemctl start systemd-tmpfiles-clean",
+          )
+          machine.fail("[ -e /tmp/foo ]")
+
+      with subtest("whether automounting works"):
+          machine.fail("grep '/tmp2 tmpfs' /proc/mounts")
+          machine.succeed("touch /tmp2/x")
+          machine.succeed("grep '/tmp2 tmpfs' /proc/mounts")
+
+      with subtest("shell-vars"):
+          machine.succeed('[ -n "$NIX_PATH" ]')
+
+      with subtest("nix-db"):
+          machine.succeed("nix-store -qR /run/current-system | grep nixos-")
+
+      with subtest("Test sysctl"):
+          machine.wait_for_unit("systemd-sysctl.service")
+          assert "1" == machine.succeed("sysctl -ne vm.swappiness").strip()
+          machine.execute("sysctl vm.swappiness=60")
+          assert "60" == machine.succeed("sysctl -ne vm.swappiness").strip()
+
+      with subtest("Test boot parameters"):
+          assert "vsyscall=emulate" in machine.succeed("cat /proc/cmdline")
     '';
 })

nixos/tests/openstack-image.nix

@@ -16,6 +16,12 @@ let
         ../maintainers/scripts/openstack/openstack-image.nix
         ../modules/testing/test-instrumentation.nix
         ../modules/profiles/qemu-guest.nix
+        {
+          # Needed by nixos-rebuild due to lack of network access.
+          system.extraDependencies = with pkgs; [
+            stdenv
+          ];
+        }
       ];
     }).config.system.build.openstackImage + "/nixos.qcow2";
 

pkgs/applications/editors/kdevelop5/kdev-php.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kdev-php";
-  version = "5.4.6";
+  version = "5.5.0";
 
   src = fetchurl {
     url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "0p532r0ld6j6fpwqyf9m5m0d27y37chgbvcjp1x6g5jjvm7m77xk";
+    sha256 = "1hd3ckayrwszda517zfvhihrfmzq4m3kcsrz4sqkbvib0giwsfkp";
   };
 
   nativeBuildInputs = [ cmake extra-cmake-modules ];

pkgs/applications/editors/kdevelop5/kdev-python.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "kdev-python";
-  version = "5.4.6";
+  version = "5.5.0";
 
   src = fetchurl {
     url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "1xzk0zgbc4nnz8gjbhw5h6kwznzxsqrg19ggyb8ijpmgg0ncxk8l";
+    sha256 = "0kna6vkxc6lrfzb3gzn11qvw8jpa86gi1k996hdk83gn0lhmkvx5";
   };
 
   cmakeFlags = [

pkgs/applications/editors/kdevelop5/kdevelop.nix

@@ -10,11 +10,11 @@
 
 mkDerivation rec {
   pname = "kdevelop";
-  version = "5.4.6";
+  version = "5.5.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "01jmrmwbc1hrvq7jdfcc7mxl03q2l6kz57yca2j26xwyvfcfv5sz";
+    sha256 = "0438721v24pim5q0q54ivsws9a679fm7ymrm1nn9g1fv06qsm4d8";
   };
 
   nativeBuildInputs = [

pkgs/applications/graphics/xournalpp/default.nix

@@ -1,5 +1,4 @@
 { stdenv
-, lib
 , fetchFromGitHub
 
 , cmake
@@ -23,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xournalpp";
-  version = "1.0.16";
+  version = "1.0.17";
 
   src = fetchFromGitHub {
     owner = "xournalpp";
     repo = pname;
     rev = version;
-    sha256 = "1bdmxxkcqpjvkckizmrz2839b4yspw4xv69bqkrrgkcyvxsr804w";
+    sha256 = "0xw2mcgnm4sa9hrhfgp669lfypw97drxjmz5w8i5whaprpvmkxzw";
   };
 
   nativeBuildInputs = [ cmake gettext pkgconfig wrapGAppsHook ];
@@ -45,7 +44,9 @@ stdenv.mkDerivation rec {
       portaudio
       zlib
     ]
-    ++ lib.optional withLua lua;
+    ++ stdenv.lib.optional withLua lua;
+
+  buildFlags = "translations";
 
   hardeningDisable = [ "format" ];
 
@@ -53,9 +54,9 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Xournal++ is a handwriting Notetaking software with PDF annotation support";
-    homepage    = https://github.com/xournalpp/xournalpp;
+    homepage    = "https://github.com/xournalpp/xournalpp";
     license     = licenses.gpl2;
-    maintainers = with maintainers; [ andrew-d ];
+    maintainers = with maintainers; [ andrew-d sikmir ];
     platforms   = platforms.linux;
   };
 }

pkgs/applications/misc/dbeaver/default.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "dbeaver-ce";
-  version = "6.3.3";
+  version = "6.3.4";
 
   desktopItem = makeDesktopItem {
     name = "dbeaver";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "08rf7igfzh5g40bapsj0f424jxfx62y97syr3fxmqv3ik7iav9k4";
+    sha256 = "1b4ac7vsfz3c9vk7yv33pcfflcxl5fcnbzfdva1yfq63v28g38gk";
   };
 
   installPhase = ''

pkgs/applications/misc/heimer/default.nix

@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "heimer";
-  version = "1.13.1";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "juzzlin";
     repo = pname;
     rev = version;
-    sha256 = "1s6s5rlzr917hq7370pmikbdvd6y468cyxw614ah65d4v105qfv7";
+    sha256 = "1qh8nr6yvxiy8pxl5pkhzlfr7hanxxc8hd8h00gsdxa0vgmqz11q";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/misc/hugo/default.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.63.2";
+  version = "0.64.0";
 
   goPackagePath = "github.com/gohugoio/hugo";
 
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1fylsx2isvims0xwcj831b1zcwsmd3igrnxjad44rhl2k3anq8vm";
+    sha256 = "10zbi2414c9grqhi9vcj3sczjh7hf20dihvcsirj551fmiqxrvpy";
   };
 
-  modSha256 = "0h95r3m6ca60dn1bllnw127nbfnkdjld94c3nyrzlwdczl2iaiyf";
+  modSha256 = "18wfsp3ypfxj5qljmb19kzyc5byf413nkabz5mfvq8srjhcq1ifl";
 
   buildFlags = [ "-tags" "extended" ];
 
@@ -23,6 +23,6 @@ buildGoModule rec {
     description = "A fast and modern static website engine.";
     homepage = "https://gohugo.io";
     license = licenses.asl20;
-    maintainers = with maintainers; [ schneefux filalex77 ];
+    maintainers = with maintainers; [ schneefux filalex77 Frostman ];
   };
 }

pkgs/applications/misc/joplin-desktop/default.nix

@@ -2,7 +2,7 @@
 
 let
   pname = "joplin-desktop";
-  version = "1.0.177";
+  version = "1.0.179";
   desktopItem = makeDesktopItem {
      name = "Joplin";
      exec = "joplin-desktop";
@@ -13,7 +13,7 @@ in appimageTools.wrapType2 rec {
   name = "${pname}-${version}";
   src = fetchurl {
     url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}.AppImage";
-    sha256 = "023q3yxqsv0vd76bvfhyhh0pnfia01rflfpyv0i6w6xnb5hm2jp7";
+    sha256 = "0v7d5wzwiznl755pl6jfg33g6jxr1cbm9j13jpbmfi497hj8w82k";
   };
 
 

pkgs/applications/misc/josm/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "josm";
-  version = "15628";
+  version = "15806";
 
   src = fetchurl {
     url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-    sha256 = "19yn311h9x1434832i0awpv2n9vhbhkk1j1mi9zggy9f256f80c6";
+    sha256 = "03a1hw566z6jd232hjkxjxqs1ggd0ir12ndkz9swxkif6aqbrnvs";
   };
 
   buildInputs = [ jdk11 makeWrapper ];

pkgs/applications/misc/jotta-cli/default.nix

@@ -5,11 +5,10 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "jotta-cli";
-  version = "0.6.18626";
+  version = "0.6.21799";
-  src =
+  src = fetchzip {
-    fetchzip {
       url = "https://repo.jotta.us/archives/linux/${arch}/jotta-cli-${version}_linux_${arch}.tar.gz";
-      sha256 = "0v9bw0f2mcvmzp7v8gs6q4p1q54rflqnbjv5sw7h1kyfwznmflzj";
+      sha256 = "19axrcfmycmdfgphkfwl9qgwd9xj8g37gmwi4ynb45w7nhfid5vm";
       stripRoot = false;
     };
 

pkgs/applications/misc/lyx/default.nix

@@ -1,14 +1,14 @@
-{ fetchurl, lib, mkDerivation, pkgconfig, python, file, bc, fetchpatch
+{ fetchurl, lib, mkDerivation, pkgconfig, python, file, bc
 , qtbase, qtsvg, hunspell, makeWrapper #, mythes, boost
 }:
 
 mkDerivation rec {
-  version = "2.3.0";
+  version = "2.3.4";
   pname = "lyx";
 
   src = fetchurl {
     url = "ftp://ftp.lyx.org/pub/lyx/stable/2.3.x/${pname}-${version}.tar.xz";
-    sha256 = "0axri2h8xkna4mkfchfyyysbjl7s486vx80p5hzj9zgsvdm5a3ri";
+    sha256 = "0qgvc19flnf6ny3ffyj8civwaxrnwcdlw2v708hg49cbmg6f8igh";
   };
 
   # LaTeX is used from $PATH, as people often want to have it with extra pkgs
@@ -34,13 +34,6 @@ mkDerivation rec {
     " --prefix PATH : ${python}/bin"
   ];
 
-  patches = [
-    (fetchpatch {
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/app-office/lyx/files/lyx-2.3.0-qt-5.11.patch?id=07e82fd1fc07bf055c78b81eaa128f8f837da80d";
-      sha256 = "1bnx0il2iv36lnrnyb370wyvww0rd8bphcy6z8d7zmvd3pwhyfql";
-    })
-  ];
-
   meta = with lib; {
     description = "WYSIWYM frontend for LaTeX, DocBook";
     homepage = http://www.lyx.org;

pkgs/applications/misc/pueue/default.nix

@@ -0,0 +1,28 @@
+{ lib, rustPlatform, fetchFromGitHub, installShellFiles }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "pueue";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "Nukesor";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "03aj4vw8kvwqk1i1a4kah5b574ahs930ij7xmqsvdy7f8c2g6pbq";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  cargoSha256 = "1y33n0dmrssv35l0apfq1mchyh92cfbzjarh0m8zb2nxwhvk7paw";
+
+  postInstall = ''
+    installShellCompletion utils/completions/pueue.{bash,fish} --zsh utils/completions/_pueue
+  '';
+
+  meta = with lib; {
+    description = "A daemon for managing long running shell commands";
+    homepage = "https://github.com/Nukesor/pueue";
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+  };
+}

pkgs/applications/misc/xca/default.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "xca";
-  version = "2.1.2";
+  version = "2.2.1";
 
   src = fetchFromGitHub {
     owner  = "chris2511";
     repo   = "xca";
     rev    = "RELEASE.${version}";
-    sha256 = "0slfqmz0b01lwmrv4h78hmrsdrhcyc7sjzsxcw05ylgmhvdq3dw9";
+    sha256 = "0na2816lkfkkvssh9kmf5vwy6x8kd4x7h138jzy61wrvs69vhnbi";
   };
 
   postPatch = ''

pkgs/applications/networking/browsers/otter/default.nix

@@ -1,27 +0,0 @@
-{ stdenv, cmake, fetchFromGitHub
-, qtbase, qtmultimedia, qtwebengine, qtxmlpatterns
-, version ? "1.0.01"
-, sourceSha ? "1jw8bj3lcqngr0mqwvz1gf47qjxbwiyda7x4sm96a6ckga7pcwyb"
-}:
-stdenv.mkDerivation {
-  pname = "otter-browser";
-  inherit version;
-
-  src = fetchFromGitHub {
-    owner = "OtterBrowser";
-    repo = "otter-browser";
-    rev = "v${version}";
-    sha256 = sourceSha;
-  };
-
-  nativeBuildInputs = [ cmake ];
-
-  buildInputs = [ qtbase qtmultimedia qtwebengine qtxmlpatterns ];
-
-  meta = with stdenv.lib; {
-    homepage = https://otter-browser.org;
-    license = licenses.gpl3Plus;
-    description = "Browser aiming to recreate the best aspects of the classic Opera (12.x) UI using Qt5";
-    maintainers = with maintainers; [ lheckemann ];
-  };
-}

pkgs/applications/networking/browsers/qutebrowser/default.nix

@@ -21,12 +21,12 @@ let
 
 in mkDerivationWith python3Packages.buildPythonApplication rec {
   pname = "qutebrowser";
-  version = "1.9.0";
+  version = "1.10.0";
 
   # the release tarballs are different from the git checkout!
   src = fetchurl {
     url = "https://github.com/qutebrowser/qutebrowser/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "1y0yq1qfr6g1s7kf3w2crd0b025dv2dfknhlz3v0001ns3rgwj17";
+    sha256 = "1prvd3cysmcjfybn0dmr3ih0bl6lm5ml9i7wd09fn8hb7047mkby";
   };
 
   # Needs tox

pkgs/applications/networking/browsers/qutebrowser/fix-restart.patch

@@ -1,8 +1,8 @@
-diff --git a/qutebrowser/app.py b/qutebrowser/app.py
+diff --git a/quitter.py b/quitterb.py
-index a47b5d2f4..f23ee23ef 100644
+index a42b9d0..f544ccb 100644
---- a/qutebrowser/app.py
+--- a/qutebrowser/misc/quitter.py
-+++ b/qutebrowser/app.py
++++ b/qutebrowser/misc/quitter.py
-@@ -573,13 +573,8 @@ class Quitter(QObject):
+@@ -112,13 +112,7 @@ class Quitter(QObject):
          Return:
              The commandline as a list of strings.
          """
@@ -14,7 +14,6 @@ index a47b5d2f4..f23ee23ef 100644
 -        else:
 -            args = [sys.executable, '-m', 'qutebrowser']
 +        args = ['@qutebrowser@']
-+        cwd = None
  
          # Add all open pages so they get reopened.
          page_args = []  # type: typing.MutableSequence[str]

pkgs/applications/networking/flexget/default.nix

@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "FlexGet";
-  version = "3.1.13";
+  version = "3.1.18";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "51215f71ed2d2666313c7965a2b22b5463b4a51f319d64db61f6a4fd221e124e";
+    sha256 = "34be4ac61dbb5699cfbc9db8bf4f4be15a63164d9006d8ac7c488278d00baa62";
   };
 
   postPatch = ''

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -23,7 +23,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.30.0"; # Please backport all updates to the stable channel.
+  version = "1.30.1"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "1gbvna40sc83s7mwip5281yn4bs0k19fj061y0xzwkvh0yk06x3i";
+    sha256 = "08l51f1fq9jlnqb4j38lxdfwfbqfzb85zrim57wlgcj8azp2ash6";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/irc/weechat/scripts/wee-slack/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wee-slack";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     repo = "wee-slack";
     owner = "wee-slack";
     rev = "v${version}";
-    sha256 = "0544j6vqbvb2xshq7ma2a3apx2vvpgfg3jh5prg265wnh4991nsw";
+    sha256 = "0h425ln5vv76zv41dccapyfbl8qmmflbpwmrd26knqyj8k24zfpr";
   };
 
   patches = [

pkgs/applications/networking/mailreaders/aerc/default.nix

@@ -3,15 +3,19 @@
 , python3, perl, w3m, dante
 }:
 
-buildGoModule rec {
+let
+  rev = "ea0df7bee433fedae5716906ea56141f92b9ce53";
+in buildGoModule rec {
   pname = "aerc";
-  version = "0.3.0";
+  version = "unstable-2020-02-01";
 
   src = fetchurl {
-    url = "https://git.sr.ht/~sircmpwn/aerc/archive/${version}.tar.gz";
+    url = "https://git.sr.ht/~sircmpwn/aerc/archive/${rev}.tar.gz";
-    sha256 = "188jln8hmgiqn5il5m54bns0wk4grj09di8y6mmid58ibw6spma4";
+    sha256 = "1bx2fypw053v3bzalfgyi6a0s5fvv040z8jy4i63s7p53m8gmzs9";
   };
 
+  modSha256 = "127xrah6xxrvc224g5dxn432sagrssx8v7phzapcsdajsnmagq6x";
+
   nativeBuildInputs = [
     go
     scdoc
@@ -51,8 +55,6 @@ buildGoModule rec {
       ${stdenv.lib.makeBinPath [ w3m dante ]}
   '';
 
-  modSha256 = "0pxbv4zfhii0g41cy0ycfpkkxw6nnd4ibavic6zqw30j476jnm2x";
-
   meta = with stdenv.lib; {
     description = "aerc is an email client for your terminal";
     homepage = https://aerc-mail.org/;

pkgs/applications/networking/remote/teamviewer/default.nix

@@ -6,11 +6,11 @@
 
 mkDerivation rec {
   pname = "teamviewer";
-  version = "15.0.8397";
+  version = "15.1.3937";
 
   src = fetchurl {
     url = "https://dl.tvcdn.de/download/linux/version_15x/teamviewer_${version}_amd64.deb";
-    sha256 = "0bidlwlpzqpba9c0zfasm08vp308hgfnq4pslj1b04v64mlci66s";
+    sha256 = "0v7733g795b15l2fya26sq710p0mg3wqhkahrg4w84y69p9zz2pf";
   };
 
   unpackPhase = ''

pkgs/applications/networking/station/default.nix

@@ -3,7 +3,6 @@
 let
   pname = "station";
   version = "1.52.2";
-in appimageTools.wrapType2 rec {
   name = "${pname}-${version}";
 
   src = fetchurl {
@@ -11,6 +10,12 @@ in appimageTools.wrapType2 rec {
     sha256 = "0lhiwvnf94is9klvzrqv2wri53gj8nms9lg2678bs4y58pvjxwid";
   };
 
+  appimageContents = appimageTools.extractType2 {
+    inherit name src;
+  };
+in appimageTools.wrapType2 rec {
+  inherit name src;
+
   profile = ''
     export LC_ALL=C.UTF-8
     export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
@@ -18,7 +23,14 @@ in appimageTools.wrapType2 rec {
 
   multiPkgs = null;
   extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
-  extraInstallCommands = "mv $out/bin/{${name},${pname}}";
+  extraInstallCommands = ''
+    mv $out/bin/{${name},${pname}}
+    install -m 444 -D ${appimageContents}/browserx.desktop $out/share/applications/browserx.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/browserx.png \
+      $out/share/icons/hicolor/512x512/apps/browserx.png
+    substituteInPlace $out/share/applications/browserx.desktop \
+      --replace 'Exec=AppRun' 'Exec=${pname}'
+  '';
 
   meta = with lib; {
     description = "A single place for all of your web applications";

pkgs/applications/networking/syncthing/default.nix

@@ -3,19 +3,19 @@
 let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
-      version = "1.3.3";
+      version = "1.3.4";
       name = "${stname}-${version}";
 
       src = fetchFromGitHub {
         owner  = "syncthing";
         repo   = "syncthing";
         rev    = "v${version}";
-        sha256 = "0bcp8kbj8xsnly2dfafnfvj6vl27mbgvj84pjk0wxdjfnr2my9ic";
+        sha256 = "076k06p2vqqz2r5bgvqkjipnhznbfbalp3pa2gjm2j9hy7nldr9f";
       };
 
       goPackagePath = "github.com/syncthing/syncthing";
 
-      modSha256 = "0kv24bi3w3pvjyjng7ly67brq8wkc1xnhsyha1h7v3jbmj5fgb12";
+      modSha256 = "10fgfjip5xr8lim2z0dh7399xpcnhxis9s9yd36fk934h1k1hwzd";
 
       patches = [
         ./add-stcli-target.patch

pkgs/applications/office/elementary-planner/default.nix

@@ -0,0 +1,71 @@
+{ stdenv, fetchFromGitHub, fetchpatch
+, meson, ninja, pkgconfig, desktop-file-utils
+, python3, vala, wrapGAppsHook
+, evolution-data-server
+, libical
+, libgee
+, json-glib
+, glib
+, sqlite
+, libsoup
+, gtk3
+, pantheon /* granite, icons, maintainers */
+, webkitgtk
+}:
+
+stdenv.mkDerivation rec {
+  pname = "elementary-planner";
+  version = "2.1.1";
+
+  src = fetchFromGitHub {
+    owner = "alainm23";
+    repo = "planner";
+    rev = version;
+    sha256 = "0swj94pqf00wwzsgjap8z19k33gg1wj2b78ba1aj9h791j8lmaim";
+  };
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    meson
+    ninja
+    pkgconfig
+    python3
+    vala
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    evolution-data-server
+    libical
+    libgee
+    json-glib
+    glib
+    sqlite
+    libsoup
+    gtk3
+    pantheon.granite
+    webkitgtk
+    pantheon.elementary-icon-theme
+  ];
+
+  # Fix version string, remove in next update!
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/alainm23/planner/pull/194/commits/3d0a2197087b13fe90fa6f85f817ba56798d632c.patch";
+      sha256 = "077q5jddi8jaw2ypc6szbd1c50i4x3b21jvmvi3w7g5zhjwpkmf5";
+    })
+  ];
+
+  postPatch = ''
+    chmod +x build-aux/meson/post_install.py
+    patchShebangs build-aux/meson/post_install.py
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Task and project manager designed to elementary OS";
+    homepage = "https://planner-todo.web.app";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ dtzWill ] ++ pantheon.maintainers;
+  };
+}
+

pkgs/applications/office/ktimetracker/default.nix

@@ -0,0 +1,32 @@
+{ mkDerivation, lib, fetchurl, cmake, pkgconfig, extra-cmake-modules,
+kconfig, kconfigwidgets, kdbusaddons, kdoctools, ki18n, kidletime,
+kjobwidgets, kio, knotifications, kwindowsystem, kxmlgui, ktextwidgets,
+kcalendarcore
+}:
+
+mkDerivation rec {
+  pname = "ktimetracker";
+  version = "5.0.1";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.xz";
+    sha256 = "0jp63fby052rapjjaz413b1wjz4qsgpxh82y2d75jzimch0n5s02";
+  };
+
+  nativeBuildInputs = [
+    cmake pkgconfig extra-cmake-modules
+  ];
+
+  buildInputs = [
+		kconfig kconfigwidgets kdbusaddons kdoctools ki18n kidletime kjobwidgets
+kio knotifications kwindowsystem kxmlgui ktextwidgets
+    kcalendarcore
+  ];
+
+  meta = with lib; {
+    description = "Todo management and time tracking application";
+    license = licenses.gpl2;
+    homepage = "https://userbase.kde.org/KTimeTracker";
+    maintainers = with maintainers; [ dtzWill ];
+  };
+}

pkgs/applications/office/zanshin/default.nix

@@ -1,21 +1,19 @@
 {
   mkDerivation, lib,
-  fetchFromGitHub,
+  fetchurl,
   extra-cmake-modules,
   qtbase, boost,
   akonadi-calendar, akonadi-notes, akonadi-search, kidentitymanagement, kontactinterface, kldap,
-  krunner, kwallet
+  krunner, kwallet, kcalendarcore
 }:
 
-mkDerivation {
+mkDerivation rec {
   pname = "zanshin";
-  version = "2019-07-28";
+  version = "0.5.71";
 
-  src = fetchFromGitHub {
+  src = fetchurl {
-    owner = "KDE";
+    url = "mirror://kde/stable/${pname}/${pname}-${version}.tar.xz";
-    repo = "zanshin";
+    sha256 = "0b316ddcd46sawva84x5d8nsp19v66gbm83djrra7fv3k8nkv4xh";
-    rev = "a8c223e745ed7e6aa3dd3cb0786a625a5c54e378";
-    sha256 = "0jglwh30x7qrl41n3dhawn4c25dmrzscpvcajhgb6fwcl4w8cgfm";
   };
 
   nativeBuildInputs = [
@@ -25,7 +23,7 @@ mkDerivation {
   buildInputs = [
     qtbase boost
     akonadi-calendar akonadi-notes akonadi-search kidentitymanagement kontactinterface kldap
-    krunner kwallet
+    krunner kwallet kcalendarcore
   ];
 
   meta = with lib; {

pkgs/applications/radio/fldigi/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, hamlib, fltk13, libjpeg, libpng, portaudio, libsndfile,
+{ stdenv, fetchurl, hamlib, fltk14, libjpeg, libpng, portaudio, libsndfile,
   libsamplerate, libpulseaudio, libXinerama, gettext, pkgconfig, alsaLib }:
 
 stdenv.mkDerivation rec {
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "0wki9d19q8rkjxcd3dz3k0a395gmbnji4fxlhw6dpcyqpfw88fcs";
   };
 
-  buildInputs = [ libXinerama gettext hamlib fltk13 libjpeg libpng portaudio
+  buildInputs = [ libXinerama gettext hamlib fltk14 libjpeg libpng portaudio
                   libsndfile libsamplerate libpulseaudio pkgconfig alsaLib ];
 
   meta = {

pkgs/applications/science/misc/simgrid/default.nix

@@ -18,14 +18,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "simgrid";
-  version = "3.24";
+  version = "3.25";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "1r9zgfx5npjw4mk0ywxx07jyi1m1b1i06j0m60n3dsrz75492x6m";
+    sha256 = "019fgryfwpcrkv1f3271v7qxk0mfw2w990vgnk1cqhmr9i1f17gs";
   };
 
   nativeBuildInputs = [ cmake perl python3 boost valgrind ]

pkgs/applications/version-management/git-and-tools/default.nix

@@ -28,6 +28,8 @@ let
 
   diff-so-fancy = callPackage ./diff-so-fancy { };
 
+  gh = callPackage ./gh { };
+
   ghq = callPackage ./ghq { };
 
   git = appendToName "minimal" gitBase;
@@ -103,7 +105,9 @@ let
 
   git-imerge = callPackage ./git-imerge { };
 
-  git-interactive-rebase-tool = callPackage ./git-interactive-rebase-tool {};
+  git-interactive-rebase-tool = callPackage ./git-interactive-rebase-tool {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
 
   git-machete = python3Packages.callPackage ./git-machete { };
 

pkgs/applications/version-management/git-and-tools/gh/default.nix

@@ -0,0 +1,36 @@
+{ lib, fetchFromGitHub, buildGoModule, installShellFiles }:
+
+buildGoModule rec {
+  pname = "gh";
+  version = "0.5.3";
+
+  src = fetchFromGitHub {
+    owner = "cli";
+    repo = "cli";
+    rev = "v${version}";
+    sha256 = "033y9bwdaj8735nmj22k8lrgkgimji7hyly9i4jyp11iaa7cgd7a";
+  };
+
+  modSha256 = "0ina3m2ixkkz2fws6ifwy34pmp6kn5s3j7w40alz6vmybn2smy1h";
+
+  buildFlagsArray = [
+    "-ldflags=-X github.com/cli/cli/command.Version=${version}"
+  ];
+
+  subPackages = [ "cmd/gh" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+  postInstall = ''
+    for shell in bash fish zsh; do
+      $out/bin/gh completion -s $shell > gh.$shell
+      installShellCompletion gh.$shell
+    done
+  '';
+
+  meta = with lib; {
+    description = "GitHub CLI tool";
+    homepage = "https://github.com/cli/cli";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zowoq ];
+  };
+}

pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/01-terminaltests.patch

@@ -1,169 +0,0 @@
---- a/src/display/utils.rs
-+++ b/src/display/utils.rs
-@@ -53,166 +53,3 @@
- 		_ => ColorMode::TwoTone,
- 	}
- }
--
--#[cfg(all(windows, test))]
--mod tests {
--	use crate::display::color_mode::ColorMode;
--	use crate::display::utils::detect_color_mode;
--
--	#[test]
--	fn detect_color_mode_windows() {
--		assert_eq!(detect_color_mode(2), ColorMode::ThreeBit);
--	}
--}
--
--#[cfg(all(unix, test))]
--mod tests {
--	use crate::display::color_mode::ColorMode;
--	use crate::display::utils::detect_color_mode;
--	use std::env::{remove_var, set_var};
--
--	fn clear_env() {
--		remove_var("COLORTERM");
--		remove_var("VTE_VERSION");
--		remove_var("TERM_PROGRAM");
--		remove_var("TERM");
--	}
--
--	#[test]
--	fn detect_color_mode_no_env_2_colors() {
--		clear_env();
--		assert_eq!(detect_color_mode(2), ColorMode::TwoTone);
--	}
--
--	#[test]
--	fn detect_color_mode_no_env_8_colors() {
--		clear_env();
--		assert_eq!(detect_color_mode(8), ColorMode::ThreeBit);
--	}
--
--	#[test]
--	fn detect_color_mode_no_env_less_8_colors() {
--		clear_env();
--		assert_eq!(detect_color_mode(7), ColorMode::TwoTone);
--	}
--
--	#[test]
--	fn detect_color_mode_no_env_16_colors() {
--		clear_env();
--		assert_eq!(detect_color_mode(16), ColorMode::FourBit);
--	}
--
--	#[test]
--	fn detect_color_mode_no_env_less_16_colors() {
--		clear_env();
--		assert_eq!(detect_color_mode(15), ColorMode::ThreeBit);
--	}
--
--	#[test]
--	fn detect_color_mode_no_env_256_colors() {
--		clear_env();
--		assert_eq!(detect_color_mode(256), ColorMode::EightBit);
--	}
--
--	#[test]
--	fn detect_color_mode_no_env_less_256_colors() {
--		clear_env();
--		assert_eq!(detect_color_mode(255), ColorMode::FourBit);
--	}
--
--	#[test]
--	fn detect_color_mode_no_env_more_256_colors() {
--		clear_env();
--		assert_eq!(detect_color_mode(257), ColorMode::EightBit);
--	}
--
--	#[test]
--	fn detect_color_mode_term_env_no_256() {
--		clear_env();
--		set_var("TERM", "XTERM");
--		assert_eq!(detect_color_mode(0), ColorMode::TwoTone);
--	}
--
--	#[test]
--	fn detect_color_mode_term_env_with_256() {
--		clear_env();
--		set_var("TERM", "XTERM-256");
--		assert_eq!(detect_color_mode(0), ColorMode::EightBit);
--	}
--
--	#[test]
--	fn detect_color_mode_term_program_env_apple_terminal() {
--		clear_env();
--		set_var("TERM_PROGRAM", "Apple_Terminal");
--		assert_eq!(detect_color_mode(0), ColorMode::EightBit);
--	}
--
--	#[test]
--	fn detect_color_mode_term_program_env_iterm() {
--		clear_env();
--		set_var("TERM_PROGRAM", "iTerm.app");
--		assert_eq!(detect_color_mode(0), ColorMode::EightBit);
--	}
--
--	#[test]
--	fn detect_color_mode_term_program_env_other() {
--		clear_env();
--		set_var("TERM_PROGRAM", "other");
--		assert_eq!(detect_color_mode(0), ColorMode::TwoTone);
--	}
--
--	#[test]
--	fn detect_color_mode_vte_version_0_36_00() {
--		clear_env();
--		set_var("VTE_VERSION", "3600");
--		assert_eq!(detect_color_mode(0), ColorMode::TrueColor);
--	}
--
--	#[test]
--	fn detect_color_mode_vte_version_greater_0_36_00() {
--		clear_env();
--		set_var("VTE_VERSION", "3601");
--		assert_eq!(detect_color_mode(0), ColorMode::TrueColor);
--	}
--
--	#[test]
--	fn detect_color_mode_vte_version_less_0_36_00() {
--		clear_env();
--		set_var("VTE_VERSION", "1");
--		assert_eq!(detect_color_mode(0), ColorMode::EightBit);
--	}
--
--	#[test]
--	fn detect_color_mode_vte_version_0() {
--		clear_env();
--		set_var("VTE_VERSION", "0");
--		assert_eq!(detect_color_mode(0), ColorMode::TwoTone);
--	}
--	#[test]
--	fn detect_color_mode_vte_version_invalid() {
--		clear_env();
--		set_var("VTE_VERSION", "invalid");
--		assert_eq!(detect_color_mode(0), ColorMode::TwoTone);
--	}
--
--	#[test]
--	fn detect_color_mode_colorterm_env_is_truecolor() {
--		clear_env();
--		set_var("COLORTERM", "truecolor");
--		assert_eq!(detect_color_mode(0), ColorMode::TrueColor);
--	}
--
--	#[test]
--	fn detect_color_mode_colorterm_env_is_24bit() {
--		clear_env();
--		set_var("COLORTERM", "24bit");
--		assert_eq!(detect_color_mode(0), ColorMode::TrueColor);
--	}
--
--	#[test]
--	fn detect_color_mode_colorterm_env_is_other() {
--		clear_env();
--		set_var("COLORTERM", "other");
--		assert_eq!(detect_color_mode(0), ColorMode::TwoTone);
--	}
--}

pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/default.nix

@@ -1,4 +1,4 @@
-{ lib, ncurses5, fetchFromGitHub, rustPlatform }:
+{ stdenv, ncurses5, fetchFromGitHub, rustPlatform, libiconv, Security }:
 
 rustPlatform.buildRustPackage rec {
   pname = "git-interactive-rebase-tool";
@@ -11,13 +11,13 @@ rustPlatform.buildRustPackage rec {
     sha256 = "10z3di2qypgsmg2z7xfs9nlrf9vng5i7l8dvqadv1l4lb9zz7i8q";
   };
 
-  patches = [ ./01-terminaltests.patch ];
-
   cargoSha256 = "002kr52vlpv1rhnxki29xflpmgk6bszrw0dsxcc34kyal0593ajk";
 
-  buildInputs = [ ncurses5 ];
+  buildInputs = [ ncurses5 ] ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv Security ];
 
-  meta = with lib; {
+  checkFlagsArray = [ "--test-threads=1" ];
+
+  meta = with stdenv.lib; {
     homepage = "https://github.com/MitMaro/git-interactive-rebase-tool";
     description = "Native cross platform full feature terminal based sequence editor for git interactive rebase";
     changelog = "https://github.com/MitMaro/git-interactive-rebase-tool/releases/tag/${version}";

pkgs/applications/version-management/git-and-tools/git-workspace/default.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-workspace";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "orf";
     repo = pname;
     rev = "v${version}";
-    sha256 = "01qxm00c5wqpy1clrvjr44v7cg4nqawaf5a6qnvvgswvis4kakzr";
+    sha256 = "0pl5z0gx2ypkrgq7vj1cxj5iwj06vcd06x3b3nh0g7w7q7nl8pr4";
   };
 
-  cargoSha256 = "16rkmk888alfvq8nsggi26vck1c7ya0fa5j7gv219g5py4gw2n34";
+  cargoSha256 = "0jbsz7r9n3jcgb9sd6pdjwzjf1b35qpfqw8ba8fjjmzfvs9qn6ld";
 
   verifyCargoDeps = true;
 

pkgs/applications/version-management/git-and-tools/gitstatus/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation {
   pname = "gitstatus";
-  version = "unstable-2019-12-18";
+  version = "unstable-2020-01-28";
 
   src = fetchFromGitHub {
     owner = "romkatv";
     repo = "gitstatus";
-    rev = "8ae9c17a60158dcf91f56d9167493e3988a5e921";
+    rev = "edb99aa7b86d10ad0a1cfe25135b57c8031d82ad";
-    sha256 = "1czjwsgbmxd1d656srs3n6wj6bmqr8p3aw5gw61q4wdxw3mni2a6";
+    sha256 = "1nys74qswwc7hn9cv0j7syvbpnw0f15chc9pi11him4d6lsflrfd";
   };
 
   buildInputs = [ (callPackage ./romkatv_libgit2.nix {}) ];
@@ -25,6 +25,6 @@ stdenv.mkDerivation {
     homepage = https://github.com/romkatv/gitstatus;
     license = [ licenses.gpl3 ];
 
-    maintainers = [ maintainers.mmlb ];
+    maintainers = with maintainers; [ mmlb hexa ];
   };
 }

pkgs/applications/version-management/git-repo/default.nix

@@ -1,20 +1,20 @@
 { stdenv, fetchFromGitHub, makeWrapper
-, python, git, gnupg, less, cacert
+, python3, git, gnupg, less, cacert
 }:
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "1.13.8";
+  version = "1.13.9.1";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    sha256 = "1wmzgijmssgwkkw8g4zgmc4x64xkvz6nq1b3szcvawgv1ndwnb2j";
+    sha256 = "0yns7n8gpac33cbkm85slslcnfdb55ax9c0vpvmmfbgcgkvqlknb";
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ python ];
+  buildInputs = [ python3 ];
 
   patchPhase = ''
     substituteInPlace repo --replace \

pkgs/applications/version-management/pijul/default.nix

@@ -20,6 +20,15 @@ in rustPlatform.buildRustPackage rec {
     sha256 = "1rm787kkh3ya8ix0rjvj7sbrg9armm0rnpkga6gjmsbg5bx20y4q";
   };
 
+  postPatch = ''
+    pushd ../${pname}-${version}-vendor/thrussh/
+    patch -p1 < ${./thrussh-build-fix.patch}
+    substituteInPlace .cargo-checksum.json --replace \
+      9696ed2422a483cd8de48ac241178a0441be6636909c76174c536b8b1cba9d45 \
+      a199f2bba520d56e11607b77be4dde0cfae576c90badb9fbd39af4784e8120d1
+    popd
+  '';
+
   nativeBuildInputs = [ pkgconfig clang ];
 
   postInstall = ''

pkgs/applications/version-management/pijul/thrussh-build-fix.patch

@@ -0,0 +1,12 @@
+--- a/src/client/connection.rs	2020-02-04 12:48:43.845299096 +0100
++++ b/src/client/connection.rs	2020-02-04 12:50:00.140329310 +0100
+@@ -546,8 +546,8 @@
+                 &[msg::NEWKEYS],
+                 &mut session.0.write_buffer,
+             );
+-            session.0.kex = Some(Kex::NewKeys(newkeys));
+             newkeys.sent = true;
++            session.0.kex = Some(Kex::NewKeys(newkeys));
+         }
+         Ok(())
+     }

pkgs/applications/video/mpv/default.nix

@@ -1,5 +1,5 @@
 { config, stdenv, fetchurl, fetchFromGitHub, makeWrapper
-, addOpenGLRunpath, docutils, perl, pkgconfig, python3, which
+, addOpenGLRunpath, docutils, perl, pkgconfig, python3, wafHook, which
 , ffmpeg_4, freefont_ttf, freetype, libass, libpthreadstubs, mujs
 , nv-codec-headers, lua, libuchardet, libiconv ? null, darwin
 
@@ -93,14 +93,6 @@ assert youtubeSupport     -> available youtube-dl;
 assert zimgSupport        -> available zimg;
 
 let
-  # Purity: Waf is normally downloaded by bootstrap.py, but
-  # for purity reasons this behavior should be avoided.
-  wafVersion = "2.0.9";
-  waf = fetchurl {
-    urls = [ "https://waf.io/waf-${wafVersion}"
-             "http://www.freehackers.org/~tnagy/release/waf-${wafVersion}" ];
-    sha256 = "0j7sbn3w6bgslvwwh5v9527w3gi2sd08kskrgxamx693y0b0i3ia";
-  };
   luaEnv = lua.withPackages (ps: with ps; [ luasocket ]);
 
 in stdenv.mkDerivation rec {
@@ -121,7 +113,7 @@ in stdenv.mkDerivation rec {
   NIX_LDFLAGS = optionalString x11Support "-lX11 -lXext "
               + optionalString stdenv.isDarwin "-framework CoreFoundation";
 
-  configureFlags = [
+  wafConfigureFlags = [
     "--enable-libmpv-shared"
     "--enable-manpage-build"
     "--disable-libmpv-static"
@@ -140,12 +132,8 @@ in stdenv.mkDerivation rec {
     (enableFeature stdenv.isLinux  "dvbin")
   ];
 
-  configurePhase = ''
-    python3 ${waf} configure --prefix=$out $configureFlags
-  '';
-
   nativeBuildInputs = [
-    addOpenGLRunpath docutils makeWrapper perl pkgconfig python3 which
+    addOpenGLRunpath docutils makeWrapper perl pkgconfig python3 wafHook which
   ];
 
   buildInputs = [
@@ -189,9 +177,7 @@ in stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  buildPhase = ''
+  postBuild = optionalString stdenv.isDarwin ''
-    python3 ${waf} build
-  '' + optionalString stdenv.isDarwin ''
     python3 TOOLS/osxbundle.py -s build/mpv
   '';
 
@@ -204,9 +190,7 @@ in stdenv.mkDerivation rec {
       --prefix PYTHONPATH : "${vapoursynth}/lib/${python3.libPrefix}/site-packages:$PYTHONPATH"
   '';
 
-  installPhase = ''
+  postInstall = ''
-    python3 ${waf} install
-
     # Use a standard font
     mkdir -p $out/share/mpv
     ln -s ${freefont_ttf}/share/fonts/truetype/FreeSans.ttf $out/share/mpv/subfont.ttf

pkgs/applications/virtualization/crun/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "0.11";
+  version = "0.12";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    sha256 = "0mn64hrgx4a7mhqjxn127i8yivhn1grp93wws1da1ffj4ap6ay76";
+    sha256 = "0sxpdv3afh8hn39jdg06vwkyp7i6dsyf1gg8719vwiwmcbhzj8mx";
     fetchSubmodules = true;
   };
 

pkgs/applications/virtualization/firecracker/default.nix

@@ -1,27 +1,27 @@
 { fetchurl, stdenv }:
 
 let
-  version = "0.19.0";
+  version = "0.20.0";
 
   suffix = {
-    x86_64-linux  = "";
+    x86_64-linux  = "x86_64";
-    aarch64-linux = "-aarch64";
+    aarch64-linux = "aarch64";
   }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
   baseurl = "https://github.com/firecracker-microvm/firecracker/releases/download";
   fetchbin = name: sha256: fetchurl {
-    url    = "${baseurl}/v${version}/${name}-v${version}${suffix}";
+    url    = "${baseurl}/v${version}/${name}-v${version}-${suffix}";
     sha256 = sha256."${stdenv.hostPlatform.system}";
   };
 
   firecracker-bin = fetchbin "firecracker" {
-    x86_64-linux  = "0yjhw77xc2nc96p36jhf0va95gf6hwi9n270g4iiwakycdy048mx";
+    x86_64-linux  = "073pp4q5dnyr126k8k7qdkqclqx18hj12app4gj2is0413gia8z9";
-    aarch64-linux = "165yca7pcwpqw3x6dihcjz1xcwjh37sdi9qrrjk9zasxx7xcniym";
+    aarch64-linux = "1w5f522imq5dnjrdidnrq7jlwcdrsiz32shv9bh66dhy336sd8qw";
   };
 
   jailer-bin = fetchbin "jailer" {
-    x86_64-linux  = "1q792b4bl1q3ach8nc8l0fbcil44knv3wa542xrskndzdz28lhsp";
+    x86_64-linux  = "0falk6y9y0pimgav1yg6ydn6wsslz0my01qd9by8ipk3f3776531";
-    aarch64-linux = "1cnwlpy5bswjprk7fcjgf6lxidhp7z00qx691nkwhzjkby80j490";
+    aarch64-linux = "1j4x4p4zz1ydvpzbbmxszyqv28qbl4v3hiwdj2f67f1jn1cv9l7z";
   };
 
 in

pkgs/applications/window-managers/i3/status-rust.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "i3status-rust";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "greshake";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1banaiqj4gdsg886kb7l1fxhmf33vxnwwha46397s7gwfxkvxz4n";
+    sha256 = "047ivrp70kwsm4792ing8dvgh161cmayzy9ij6ww61fbkb4slr1i";
   };
 
-  cargoSha256 = "1cbx2jll0bj547dvwzjprzidndbqn1c4c6hmbfgjgdkxmmrpb0r1";
+  cargoSha256 = "16rgg0fy50n0z0kal52iaxiqwhw4qpjvzyqwaldm29fq9c0105d1";
 
   nativeBuildInputs = [ pkgconfig ];
 
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
     description = "Very resource-friendly and feature-rich replacement for i3status";
     homepage = https://github.com/greshake/i3status-rust;
     license = licenses.gpl3;
-    maintainers = with maintainers; [ backuitist globin ];
+    maintainers = with maintainers; [ backuitist globin ma27 ];
     platforms = platforms.linux;
   };
 }

pkgs/build-support/build-bazel-package/default.nix

@@ -23,6 +23,8 @@ args@{
 #
 # [1]: https://github.com/bazelbuild/rules_cc
 , removeRulesCC ? true
+, removeLocalConfigCc ? true
+, removeLocal ? true
 , ...
 }:
 
@@ -86,7 +88,8 @@ in stdenv.mkDerivation (fBuildAttrs // {
       rm -rf $bazelOut/external/{bazel_tools,\@bazel_tools.marker}
       ${if removeRulesCC then "rm -rf $bazelOut/external/{rules_cc,\\@rules_cc.marker}" else ""}
       rm -rf $bazelOut/external/{embedded_jdk,\@embedded_jdk.marker}
-      rm -rf $bazelOut/external/{local_*,\@local_*.marker}
+      ${if removeLocalConfigCc then "rm -rf $bazelOut/external/{local_config_cc,\@local_config_cc.marker}" else ""}
+      ${if removeLocal then "rm -rf $bazelOut/external/{local_*,\@local_*.marker}" else ""}
 
       # Clear markers
       find $bazelOut/external -name '@*\.marker' -exec sh -c 'echo > {}' \;
@@ -145,7 +148,6 @@ in stdenv.mkDerivation (fBuildAttrs // {
   buildPhase = fBuildAttrs.buildPhase or ''
     runHook preBuild
 
-    '' + lib.optionalString stdenv.isDarwin ''
     # Bazel sandboxes the execution of the tools it invokes, so even though we are
     # calling the correct nix wrappers, the values of the environment variables
     # the wrappers are expecting will not be set. So instead of relying on the
@@ -168,7 +170,6 @@ in stdenv.mkDerivation (fBuildAttrs // {
       linkopts+=( "--linkopt=$flag" )
       host_linkopts+=( "--host_linkopt=$flag" )
     done
-    '' + ''
 
     BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
     USER=homeless-shelter \
@@ -177,12 +178,10 @@ in stdenv.mkDerivation (fBuildAttrs // {
       --output_user_root="$bazelUserRoot" \
       build \
       -j $NIX_BUILD_CORES \
-      '' + lib.optionalString stdenv.isDarwin ''
       "''${copts[@]}" \
       "''${host_copts[@]}" \
       "''${linkopts[@]}" \
       "''${host_linkopts[@]}" \
-      '' + ''
       $bazelFlags \
       $bazelBuildFlags \
       $bazelTarget

pkgs/build-support/singularity-tools/default.nix

@@ -59,7 +59,8 @@ rec {
             mkdir disk
             mkfs -t ext3 -b 4096 /dev/${vmTools.hd}
             mount /dev/${vmTools.hd} disk
-            cd disk
+            mkdir -p disk/img
+            cd disk/img
             mkdir proc sys dev
 
             # Run root script
@@ -84,8 +85,10 @@ rec {
               done
             done
 
-            # Create runScript
+            # Create runScript and link shell
-            ln -s ${runScriptFile} singularity
+            ln -s ${runtimeShell} bin/sh
+            mkdir -p .singularity.d
+            ln -s ${runScriptFile} .singularity.d/runscript
 
             # Fill out .singularity.d
             mkdir -p .singularity.d/env
@@ -94,7 +97,7 @@ rec {
             cd ..
             mkdir -p /var/singularity/mnt/{container,final,overlay,session,source}
             echo "root:x:0:0:System administrator:/root:/bin/sh" > /etc/passwd
-            singularity build $out ./disk
+            TMPDIR=$(pwd -P) singularity build $out ./img
           '');
 
     in result;

pkgs/common-updater/scripts.nix

@@ -1,4 +1,4 @@
-{ stdenv, makeWrapper, coreutils, gawk, gnused, gnugrep, diffutils, nix }:
+{ stdenv, makeWrapper, coreutils, gnused, gnugrep, diffutils, nix }:
 
 stdenv.mkDerivation {
   name = "common-updater-scripts";
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     cp ${./scripts}/* $out/bin
 
     for f in $out/bin/*; do
-      wrapProgram $f --prefix PATH : ${stdenv.lib.makeBinPath [ coreutils gawk gnused gnugrep nix diffutils ]}
+      wrapProgram $f --prefix PATH : ${stdenv.lib.makeBinPath [ coreutils gnused gnugrep nix diffutils ]}
     done
   '';
 }

pkgs/common-updater/scripts/update-source-version

@@ -11,6 +11,7 @@ die() {
 usage() {
     echo "Usage: $scriptName <attr> <version> [<new-source-hash>] [<new-source-url>]"
     echo "                              [--version-key=<version-key>] [--system=<system>] [--file=<file-to-update>]"
+    echo "                              [--ignore-same-hash]"
 }
 
 args=()
@@ -25,7 +26,7 @@ for arg in "$@"; do
         ;;
         --file=*)
             nixFile="${arg#*=}"
-            if [ ! -f "$nixFile" ]; then
+            if [[ ! -f "$nixFile" ]]; then
                 die "Could not find provided file $nixFile"
             fi
         ;;
@@ -37,7 +38,7 @@ for arg in "$@"; do
             exit 0
         ;;
         --*)
-            echo "$scriptName: Unknown argument: " $arg
+            echo "$scriptName: Unknown argument: $arg"
             usage
             exit 1
         ;;
@@ -52,25 +53,25 @@ newVersion=${args[1]}
 newHash=${args[2]}
 newUrl=${args[3]}
 
-if [ "${#args[*]}" -lt 2 ]; then
+if (( "${#args[*]}" < 2 )); then
     echo "$scriptName: Too few arguments"
     usage
     exit 1
 fi
 
-if [ "${#args[*]}" -gt 4 ]; then
+if (( "${#args[*]}" > 4 )); then
     echo "$scriptName: Too many arguments"
     usage
     exit 1
 fi
 
-if [ -z "$versionKey" ]; then
+if [[ -z "$versionKey" ]]; then
     versionKey=version
 fi
 
-if [ -z "$nixFile" ]; then
+if [[ -z "$nixFile" ]]; then
     nixFile=$(nix-instantiate $systemArg --eval --strict -A "$attr.meta.position" | sed -re 's/^"(.*):[0-9]+"$/\1/')
-    if [ ! -f "$nixFile" ]; then
+    if [[ ! -f "$nixFile" ]]; then
         die "Couldn't evaluate '$attr.meta.position' to locate the .nix file!"
     fi
 fi
@@ -78,28 +79,28 @@ fi
 oldHashAlgo=$(nix-instantiate $systemArg --eval --strict -A "$attr.src.drvAttrs.outputHashAlgo" | tr -d '"')
 oldHash=$(nix-instantiate $systemArg --eval --strict -A "$attr.src.drvAttrs.outputHash" | tr -d '"')
 
-if [ -z "$oldHashAlgo" -o -z "$oldHash" ]; then
+if [[ -z "$oldHashAlgo" || -z "$oldHash" ]]; then
     die "Couldn't evaluate old source hash from '$attr.src'!"
 fi
 
-if [ $(grep -c "$oldHash" "$nixFile") != 1 ]; then
+if [[ $(grep --count "$oldHash" "$nixFile") != 1 ]]; then
     die "Couldn't locate old source hash '$oldHash' (or it appeared more than once) in '$nixFile'!"
 fi
 
 oldUrl=$(nix-instantiate $systemArg --eval -E "with import ./. {}; builtins.elemAt ($attr.src.drvAttrs.urls or [ $attr.src.url ]) 0" | tr -d '"')
 
-if [ -z "$oldUrl" ]; then
+if [[ -z "$oldUrl" ]]; then
     die "Couldn't evaluate source url from '$attr.src'!"
 fi
 
 drvName=$(nix-instantiate $systemArg --eval -E "with import ./. {}; lib.getName $attr" | tr -d '"')
 oldVersion=$(nix-instantiate $systemArg --eval -E "with import ./. {}; $attr.${versionKey} or (lib.getVersion $attr)" | tr -d '"')
 
-if [ -z "$drvName" -o -z "$oldVersion" ]; then
+if [[ -z "$drvName" || -z "$oldVersion" ]]; then
     die "Couldn't evaluate name and version from '$attr.name'!"
 fi
 
-if [ "$oldVersion" = "$newVersion" ]; then
+if [[ "$oldVersion" = "$newVersion" ]]; then
     echo "$scriptName: New version same as old version, nothing to do." >&2
     exit 0
 fi
@@ -108,14 +109,41 @@ fi
 oldVersionEscaped=$(echo "$oldVersion" | sed -re 's|[.+]|\\&|g')
 oldUrlEscaped=$(echo "$oldUrl" | sed -re 's|[${}.+]|\\&|g')
 
-if [ $(grep -c -E "^\s*(let\b)?\s*$versionKey\s*=\s*\"$oldVersionEscaped\"" "$nixFile") = 1 ]; then
+if [[ $(grep --count --extended-regexp "^\s*(let\b)?\s*$versionKey\s*=\s*\"$oldVersionEscaped\"" "$nixFile") = 1 ]]; then
     pattern="/\b$versionKey\b\s*=/ s|\"$oldVersionEscaped\"|\"$newVersion\"|"
-elif [ $(grep -c -E "^\s*(let\b)?\s*name\s*=\s*\"[^\"]+-$oldVersionEscaped\"" "$nixFile") = 1 ]; then
+elif [[ $(grep --count --extended-regexp "^\s*(let\b)?\s*name\s*=\s*\"[^\"]+-$oldVersionEscaped\"" "$nixFile") = 1 ]]; then
     pattern="/\bname\b\s*=/ s|-$oldVersionEscaped\"|-$newVersion\"|"
 else
     die "Couldn't figure out where out where to patch in new version in '$attr'!"
 fi
 
+if [[ "$oldHash" =~ ^(sha256|sha512)[:-] ]]; then
+    # Handle the possible SRI-style hash attribute (in the form ${type}${separator}${hash})
+    # True SRI uses dash as a separator and only supports base64, whereas Nix’s SRI-style format uses a colon and supports all the same encodings like regular hashes (16/32/64).
+    # To keep this program reasonably simple, we will upgrade Nix’s format to SRI.
+    oldHashAlgo="${BASH_REMATCH[1]}"
+    sri=true
+elif [[ "$oldHashAlgo" = "null" ]]; then
+    # Some fetcher functions support SRI-style `hash` attribute in addition to legacy type-specific attributes. When `hash` is used `outputHashAlgo` is null so let’s complain when SRI-style hash value was not detected.
+    die "Unable to figure out hashing scheme from '$oldHash' in '$attr'!"
+fi
+
+case "$oldHashAlgo" in
+    # Lengths of hex-encoded hashes
+    sha256) hashLength=64 ;;
+    sha512) hashLength=128 ;;
+    *) die "Unhandled hash algorithm '$oldHashAlgo' in '$attr'!" ;;
+esac
+
+# Make a temporary all-zeroes hash of $hashLength characters
+tempHash=$(printf '%0*d' "$hashLength" 0)
+
+if [[ -n "$sri" ]]; then
+    # SRI hashes only support base64
+    # SRI hashes need to declare the hash type as part of the hash
+    tempHash="$(nix to-sri --type "$oldHashAlgo" "$tempHash")"
+fi
+
 # Replace new version
 sed -i.bak "$nixFile" -re "$pattern"
 if cmp -s "$nixFile" "$nixFile.bak"; then
@@ -123,7 +151,7 @@ if cmp -s "$nixFile" "$nixFile.bak"; then
 fi
 
 # Replace new URL
-if [ -n "$newUrl" ]; then
+if [[ -n "$newUrl" ]]; then
     sed -i "$nixFile" -re "s|\"$oldUrlEscaped\"|\"$newUrl\"|"
 
     if cmp -s "$nixFile" "$nixFile.bak"; then
@@ -131,33 +159,29 @@ if [ -n "$newUrl" ]; then
     fi
 fi
 
-case "$oldHashAlgo" in
-    sha256) hashLength=64 ;;
-    sha512) hashLength=128 ;;
-    *) die "Unhandled hash algorithm '$oldHashAlgo' in '$attr'!" ;;
-esac
-
-# Make a temporary all-zeroes hash of $hashLength characters
-tempHash=$(printf '%0*d' "$hashLength" 0)
-
 sed -i "$nixFile" -re "s|\"$oldHash\"|\"$tempHash\"|"
 if cmp -s "$nixFile" "$nixFile.bak"; then
     die "Failed to replace source hash of '$attr' to a temporary hash!"
 fi
 
 # If new hash not given on the command line, recalculate it ourselves.
-if [ -z "$newHash" ]; then
+if [[ -z "$newHash" ]]; then
     nix-build $systemArg --no-out-link -A "$attr.src" 2>"$attr.fetchlog" >/dev/null || true
     # FIXME: use nix-build --hash here once https://github.com/NixOS/nix/issues/1172 is fixed
-    newHash=$(egrep -v "killing process|dependencies couldn't be built|wanted: " "$attr.fetchlog" | tail -n2 | sed "s~output path .* has .* hash ‘\(.*\)’ when .* was expected\|fixed-output derivation produced path '.*' with .* hash '\(.*\)' instead of the expected hash '.*'\|  got:    .*:\(.*\)~\1\2\3~" | head -n1)
+    newHash=$(grep --extended-regexp --invert-match "killing process|dependencies couldn't be built|wanted: " "$attr.fetchlog" | tail -n2 | sed "s~output path .* has .* hash ‘\(.*\)’ when .* was expected\|fixed-output derivation produced path '.*' with .* hash '\(.*\)' instead of the expected hash '.*'\|  got:    .*:\(.*\)~\1\2\3~" | head -n1)
 fi
 
-if [ -z "$newHash" ]; then
+if [[ -n "$sri" ]]; then
+    # nix-build preserves the hashing scheme so we can just convert the result to SRI using the old type
+    newHash="$(nix to-sri --type "$oldHashAlgo" "$newHash")"
+fi
+
+if [[ -z "$newHash" ]]; then
     cat "$attr.fetchlog" >&2
     die "Couldn't figure out new hash of '$attr.src'!"
 fi
 
-if [ -z "${ignoreSameHash}" ] && [ "$oldVersion" != "$newVersion" ] && [ "$oldHash" = "$newHash" ]; then
+if [[ -z "${ignoreSameHash}" && "$oldVersion" != "$newVersion" && "$oldHash" = "$newHash" ]]; then
     mv "$nixFile.bak" "$nixFile"
     die "Both the old and new source hashes of '$attr.src' were equivalent. Please fix the package's source URL to be dependent on '\${version}'!"
 fi

pkgs/data/fonts/nerdfonts/default.nix

@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, which, withFont ? "" }:
 
 stdenv.mkDerivation rec {
-  version = "2.0.0";
+  version = "2.1.0";
   pname = "nerdfonts";
   src = fetchFromGitHub {
     owner = "ryanoasis";
     repo = "nerd-fonts";
     rev = version;
-    sha256 = "09i467hyskvzj2wn5sj6shvc9pb0a0rx5iknjkkkbg1ng3bla7nm";
+    sha256 = "1la79y16k9rwcl2zsxk73c0kgdms2ma43kpjfqnq5jlbfdj0niwg";
   };
   dontPatchShebangs = true;
   buildInputs = [ which ];

pkgs/data/fonts/tt2020/default.nix

@@ -0,0 +1,27 @@
+{ lib, fetchFromGitHub }:
+
+let
+  pname = "TT2020";
+  version = "2020-01-05";
+in
+fetchFromGitHub {
+  name = "${pname}-${version}";
+  owner = "ctrlcctrlv";
+  repo = pname;
+  rev = "2b418fab5f99f72a18b3b2e7e2745ac4e03aa612";
+  sha256 = "1z0nizvs0gp0xl7pn6xcjvsysxhnfm7aqfamplkyvya3fxvhncds";
+
+  postFetch = ''
+    tar xf $downloadedFile --strip=1
+    install -Dm644 -t $out/share/fonts/truetype dist/*.ttf
+    install -Dm644 -t $out/share/fonts/woff2 dist/*.woff2
+  '';
+
+  meta = with lib; {
+    description = "An advanced, open source, hyperrealistic, multilingual typewriter font for a new decade";
+    homepage = "https://ctrlcctrlv.github.io/TT2020";
+    license = licenses.ofl;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.all;
+  };
+}

pkgs/data/themes/jade1/default.nix

@@ -2,25 +2,25 @@
 
 stdenv.mkDerivation rec {
   pname = "theme-jade1";
-  version = "1.5";
+  version = "1.6";
 
   src = fetchFromGitHub {
     owner = "madmaxms";
     repo = "theme-jade-1";
     rev = "v${version}";
-    sha256 = "1m3150iyk8421mkwj4x2pv29wjzqdcnvvnp3bsg11k5kszsm27a8";
+    sha256 = "1lnajrsikw6dljf6dvgmj8aqwywmgdp34h3xsc0xiyq07arhp606";
   };
 
   propagatedUserEnvPkgs = [ gtk-engine-murrine ];
 
   installPhase = ''
     mkdir -p $out/share/themes
-    cp -a Jade-1 $out/share/themes
+    cp -a Jade* $out/share/themes
   '';
 
   meta = with stdenv.lib; {
     description = "Fork of the original Linux Mint theme with dark menus, more intensive green and some other modifications";
-    homepage = https://github.com/madmaxms/theme-jade-1;
+    homepage = "https://github.com/madmaxms/theme-jade-1";
     license = with licenses; [ gpl3 ];
     platforms = platforms.linux;
     maintainers = [ maintainers.romildo ];

pkgs/desktops/gnustep/base/default.nix

@@ -3,7 +3,7 @@
 , cups
 , fetchurl
 , gmp, gnutls
-, libffi, libbfd
+, libffi, binutils-unwrapped
 , libjpeg, libtiff, libpng, giflib, libungif
 , libxml2, libxslt, libiconv
 , libobjc, libgcrypt
@@ -25,7 +25,7 @@ gsmakeDerivation {
     aspell audiofile
     cups
     gmp gnutls
-    libffi libbfd
+    libffi binutils-unwrapped
     libjpeg libtiff libpng giflib libungif
     libxml2 libxslt libiconv
     libobjc libgcrypt
@@ -35,10 +35,6 @@ gsmakeDerivation {
   ];
   patches = [ ./fixup-paths.patch ];
 
-  # Bump to gcc9 has give missing xmemdup symbols. Need libiberty here
-  # to resolve it, unclear why. See #76927 for more info
-  NIX_LDFLAGS = "-liberty";
-
   meta = {
     description = "An implementation of AppKit and Foundation libraries of OPENSTEP and Cocoa";
   };

pkgs/development/compilers/go/1.12.nix

@@ -30,11 +30,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.12.15";
+  version = "1.12.16";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "1hw4xjywcl883dnvfbb92w85sy8n231fdri4aynj8xajgr0p9fla";
+    sha256 = "1y0x10fsvgpc1x24b9q9y6kv9b0kwf7879am3p0gym2abgc5wvnf";
   };
 
   # perl is used for testing go vet

pkgs/development/compilers/go/1.13.nix

@@ -30,11 +30,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.13.6";
+  version = "1.13.7";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "03220q6n4wlpmz6zz3mw48kl3pjxia6pxdvf03wbqh6w9favxrda";
+    sha256 = "1x21kfpzfkvmqd42pan6nl862m7jjl4niqxxpcgm46awbz645bg4";
   };
 
   # perl is used for testing go vet

pkgs/development/compilers/ocaml/4.10.nix

@@ -1,6 +1,6 @@
 import ./generic.nix {
   major_version = "4";
   minor_version = "10";
-  patch_version = "0+beta1";
+  patch_version = "0+beta2";
-  sha256 = "18jrgww98v1famb2x5jhbsnm4ngph2rvq0z4cxpqxfn06yb53jyf";
+  sha256 = "106y4jarwib6xxy0vhd7766mxhnlr1zq05jchisklyrgjly0g3ry";
 }

pkgs/development/compilers/ocaml/ber-metaocaml.nix

@@ -50,10 +50,10 @@ stdenv.mkDerivation rec {
 
   buildPhase = ''
     make world
-    make -i install
 
     make bootstrap
     make opt.opt
+    make -i install
     make installopt
     mkdir -p $out/include
     ln -sv $out/lib/ocaml/caml $out/include/caml

pkgs/development/compilers/oraclejdk/jdk-linux-base.nix

@@ -16,7 +16,6 @@
 , pluginSupport ? true
 , installjce ? false
 , config
-, licenseAccepted ? config.oraclejdk.accept_license or false
 , glib
 , libxml2
 , libav_0_8
@@ -36,13 +35,6 @@
 
 assert swingSupport -> xorg != null;
 
-if !licenseAccepted then throw ''
-    You must accept the Oracle Binary Code License Agreement for Java SE at
-    https://www.oracle.com/technetwork/java/javase/terms/license/index.html
-    by setting nixpkgs config option 'oraclejdk.accept_license = true;'
-  ''
-else assert licenseAccepted;
-
 let
 
   /**

pkgs/development/compilers/sbcl/2.0.0.nix

@@ -0,0 +1,112 @@
+{ stdenv, fetchurl, writeText, sbclBootstrap
+, sbclBootstrapHost ? "${sbclBootstrap}/bin/sbcl --disable-debugger --no-userinit --no-sysinit"
+, threadSupport ? (stdenv.isi686 || stdenv.isx86_64 || "aarch64-linux" == stdenv.hostPlatform.system)
+  # Meant for sbcl used for creating binaries portable to non-NixOS via save-lisp-and-die.
+  # Note that the created binaries still need `patchelf --set-interpreter ...`
+  # to get rid of ${glibc} dependency.
+, purgeNixReferences ? false
+, texinfo
+}:
+
+stdenv.mkDerivation rec {
+  pname = "sbcl";
+  version = "2.0.0";
+
+  src = fetchurl {
+    url    = "mirror://sourceforge/project/sbcl/sbcl/${version}/${pname}-${version}-source.tar.bz2";
+    sha256 = "1krgd69cirp4ili2pfsh1a0mfvq722jbknlvmf17qhsxh1b94dlh";
+  };
+
+  buildInputs = [texinfo];
+
+  patchPhase = ''
+    echo '"${version}.nixos"' > version.lisp-expr
+    echo "
+    (lambda (features)
+      (flet ((enable (x)
+               (pushnew x features))
+             (disable (x)
+               (setf features (remove x features))))
+    ''
+    + (if threadSupport then "(enable :sb-thread)" else "(disable :sb-thread)")
+    + stdenv.lib.optionalString stdenv.isAarch32 "(enable :arm)"
+    + ''
+      )) " > customize-target-features.lisp
+
+    pwd
+
+    # SBCL checks whether files are up-to-date in many places..
+    # Unfortunately, same timestamp is not good enough
+    sed -e 's@> x y@>= x y@' -i contrib/sb-aclrepl/repl.lisp
+    #sed -e '/(date)/i((= date 2208988801) 2208988800)' -i contrib/asdf/asdf.lisp
+    sed -i src/cold/slam.lisp -e \
+      '/file-write-date input/a)'
+    sed -i src/cold/slam.lisp -e \
+      '/file-write-date output/i(or (and (= 2208988801 (file-write-date output)) (= 2208988801 (file-write-date input)))'
+    sed -i src/code/target-load.lisp -e \
+      '/date defaulted-fasl/a)'
+    sed -i src/code/target-load.lisp -e \
+      '/date defaulted-source/i(or (and (= 2208988801 (file-write-date defaulted-source-truename)) (= 2208988801 (file-write-date defaulted-fasl-truename)))'
+
+    # Fix the tests
+    sed -e '5,$d' -i contrib/sb-bsd-sockets/tests.lisp
+    sed -e '5,$d' -i contrib/sb-simple-streams/*test*.lisp
+
+    # Use whatever `cc` the stdenv provides
+    substituteInPlace src/runtime/Config.x86-64-darwin --replace gcc cc
+
+    substituteInPlace src/runtime/Config.x86-64-darwin \
+      --replace mmacosx-version-min=10.4 mmacosx-version-min=10.5
+  ''
+  + (if purgeNixReferences
+    then
+      # This is the default location to look for the core; by default in $out/lib/sbcl
+      ''
+        sed 's@^\(#define SBCL_HOME\) .*$@\1 "/no-such-path"@' \
+          -i src/runtime/runtime.c
+      ''
+    else
+      # Fix software version retrieval
+      ''
+        sed -e "s@/bin/uname@$(command -v uname)@g" -i src/code/*-os.lisp \
+          src/code/run-program.lisp
+      ''
+    );
+
+
+  preBuild = ''
+    export INSTALL_ROOT=$out
+    mkdir -p test-home
+    export HOME=$PWD/test-home
+  '';
+
+  buildPhase = ''
+    sh make.sh --prefix=$out --xc-host="${sbclBootstrapHost}"
+    (cd doc/manual ; make info)
+  '';
+
+  installPhase = ''
+    INSTALL_ROOT=$out sh install.sh
+  ''
+  + stdenv.lib.optionalString (!purgeNixReferences) ''
+    cp -r src $out/lib/sbcl
+    cp -r contrib $out/lib/sbcl
+    cat >$out/lib/sbcl/sbclrc <<EOF
+     (setf (logical-pathname-translations "SYS")
+       '(("SYS:SRC;**;*.*.*" #P"$out/lib/sbcl/src/**/*.*")
+         ("SYS:CONTRIB;**;*.*.*" #P"$out/lib/sbcl/contrib/**/*.*")))
+    EOF
+  '';
+
+  setupHook = stdenv.lib.optional purgeNixReferences (writeText "setupHook.sh" ''
+    addEnvHooks "$targetOffset" _setSbclHome
+    _setSbclHome() {
+      export SBCL_HOME='@out@/lib/sbcl/'
+    }
+  '');
+
+  meta = sbclBootstrap.meta // {
+    inherit version;
+    updateWalker = true;
+  };
+}

pkgs/development/compilers/urweb/default.nix

@@ -23,6 +23,7 @@ stdenv.mkDerivation rec {
     export PGHEADER="${postgresql}/include/libpq-fe.h";
     export MSHEADER="${libmysqlclient}/include/mysql/mysql.h";
     export SQHEADER="${sqlite.dev}/include/sqlite3.h";
+    export ICU_INCLUDES="-I${icu.dev}/include";
 
     export CC="${gcc}/bin/gcc";
     export CCARGS="-I$out/include \

pkgs/development/libraries/editline/default.nix

@@ -1,15 +1,23 @@
-{ stdenv, fetchFromGitHub, autoreconfHook }:
+{ stdenv, fetchFromGitHub, autoreconfHook, fetchpatch }:
 
 stdenv.mkDerivation rec {
   pname = "editline";
-  version = "1.16.1";
+  version = "1.17.0";
   src = fetchFromGitHub {
     owner = "troglobit";
     repo = "editline";
     rev = version;
-    sha256 = "192valxbvkxh47dszrnahv7xiccarjw9y84g4zaw5y0lxfc54dir";
+    sha256 = "0vjm42y6zjmi6hdcng0l7wkksw7s50agbmk5dxsc3292q8mvq8v6";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-for-multiline-as-one-line.patch";
+      url = "https://github.com/troglobit/editline/commit/ceee039cfc819c8e09eebbfca192091b0cf8df75.patch";
+      sha256 = "149fmfva05ghzwkd0bq1sahdbkys3qyyky28ssqb5jq7q9hw3ddm";
+    })
+  ];
+
   nativeBuildInputs = [ autoreconfHook ];
 
   outputs = [ "out" "dev" "man" "doc" ];

pkgs/development/libraries/libcint/default.nix

@@ -0,0 +1,45 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, cmake
+, openblas
+  # Check Inputs
+, python2
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libcint";
+  version = "3.0.19";
+
+  src = fetchFromGitHub {
+    owner = "sunqm";
+    repo = "libcint";
+    rev = "v${version}";
+    sha256 = "0x613f2hiqi2vbhp20fcl7rhxb07f2714lplzd0vkvv07phagip9";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ openblas ];
+  cmakeFlags = [
+    "-DENABLE_TEST=1"
+    "-DQUICK_TEST=1"
+    "-DCMAKE_INSTALL_PREFIX=" # ends up double-adding /nix/store/... prefix, this avoids issue
+  ];
+
+  doCheck = true;
+  # Test syntax (like print statements) is written in python2. Fixed when #33 merged: https://github.com/sunqm/libcint/pull/33
+  checkInputs = [ python2.pkgs.numpy ];
+
+  meta = with lib; {
+    description = "General GTO integrals for quantum chemistry";
+    longDescription = ''
+      libcint is an open source library for analytical Gaussian integrals.
+      It provides C/Fortran API to evaluate one-electron / two-electron
+      integrals for Cartesian / real-spheric / spinor Gaussian type functions.
+    '';
+    homepage = "http://wiki.sunqm.net/libcint";
+    downloadPage = "https://github.com/sunqm/libcint";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ drewrisinger ];
+  };
+}

pkgs/development/libraries/physics/geant4/datasets.nix

@@ -35,78 +35,78 @@ in
   builtins.listToAttrs (map (a: { inherit (a) name; value = mkDataset a; }) [
     {
       name = "G4NDL";
-      version = "4.5";
+      version = "4.6";
-      sha256 = "cba928a520a788f2bc8229c7ef57f83d0934bb0c6a18c31ef05ef4865edcdf8e";
+      sha256 = "022l2jjhi57frfdv9nk6s6q23gmr9zkix06fmni8gf0gmvr7qa4x";
       envvar = "NEUTRONHP";
     }
 
     {
       name = "G4EMLOW";
-      version = "7.7";
+      version = "7.9";
-      sha256 = "16dec6adda6477a97424d749688d73e9bd7d0b84d0137a67cf341f1960984663";
+      sha256 = "1zrsvk2ahlwss6mgjrma6d2ii49vlzcd5r3ccw94c7m9rnk9mgsa";
       envvar = "LE";
     }
 
     {
       name = "G4PhotonEvaporation";
-      version = "5.3";
+      version = "5.5";
-      sha256 = "d47ababc8cbe548065ef644e9bd88266869e75e2f9e577ebc36bc55bf7a92ec8";
+      sha256 = "1mvnbs7yvkii41blks6bkqr8qhxgnj3xxvv1i3vdg2y14shxv5ar";
       envvar = "LEVELGAMMA";
     }
 
     {
       name = "G4RadioactiveDecay";
-      version = "5.3";
+      version = "5.4";
-      sha256 = "5c8992ac57ae56e66b064d3f5cdfe7c2fee76567520ad34a625bfb187119f8c1";
+      sha256 = "0qaark6mqzxr3lqawv6ai8z5211qihlp5x2hn86vzx8kgpd7j1r4";
       envvar = "RADIOACTIVE";
     }
 
     {
       name = "G4SAIDDATA";
       version = "2.0";
-      sha256 = "1d26a8e79baa71e44d5759b9f55a67e8b7ede31751316a9e9037d80090c72e91";
+      sha256 = "149fqy801n1pj2g6lcai2ziyvdz8cxdgbfarax6y8wdakgksh9hx";
       envvar = "SAIDXS";
     }
 
     {
       name = "G4PARTICLEXS";
-      version = "1.1";
+      version = "2.1";
-      sha256 = "100a11c9ed961152acfadcc9b583a9f649dda4e48ab314fcd4f333412ade9d62";
+      sha256 = "0h8ba8jk197npbd9lzq2qlfiklbjgqwk45m1cc6piy5vf8ri0k89";
       envvar = "PARTICLEXS";
     }
 
     {
       name = "G4ABLA";
       version = "3.1";
-      sha256 = "7698b052b58bf1b9886beacdbd6af607adc1e099fc730ab6b21cf7f090c027ed";
+      sha256 = "1v97q28g1xqwnav0lwzwk7hc3b87yrmbvkgadf4bkwcbnm9b163n";
       envvar = "ABLA";
     }
 
     {
       name = "G4INCL";
       version = "1.0";
-      sha256 = "716161821ae9f3d0565fbf3c2cf34f4e02e3e519eb419a82236eef22c2c4367d";
+      sha256 = "0z9nqk125vvf4f19lhgb37jy60jf9zrjqg5zbxbd1wz93a162qbi";
       envvar = "INCL";
     }
 
     {
       name = "G4PII";
       version = "1.3";
-      sha256 = "6225ad902675f4381c98c6ba25fc5a06ce87549aa979634d3d03491d6616e926";
+      sha256 = "09p92rk1sj837m6n6yd9k9a8gkh6bby2bfn6k0f3ix3m4s8as9b2";
       envvar = "PII";
     }
 
     {
       name = "G4ENSDFSTATE";
       version = "2.2";
-      sha256 = "dd7e27ef62070734a4a709601f5b3bada6641b111eb7069344e4f99a01d6e0a6";
+      sha256 = "19p0sq0rmyg48j9hddqy24dn99md7ddiyq09lyj381q7cbpjfznx";
       envvar = "ENSDFSTATE";
     }
 
     {
       name = "G4RealSurface";
-      version = "2.1";
+      version = "2.1.1";
-      sha256 = "2a287adbda1c0292571edeae2082a65b7f7bd6cf2bf088432d1d6f889426dcf3";
+      sha256 = "0l3gs0nlp10cjlwiln3f72zfch0av2g1r8m2ny9afgvwgbwiyj4h";
       envvar = "REALSURFACE";
     }
   ])

pkgs/development/libraries/physics/geant4/default.nix

@@ -8,7 +8,7 @@
 , enableRaytracerX11   ? false
 
 # Standard build environment with cmake.
-, stdenv, fetchurl, cmake
+, stdenv, fetchurl, fetchpatch, cmake
 
 # Optional system packages, otherwise internal GEANT4 packages are used.
 , clhep ? null # not packaged currently
@@ -36,14 +36,23 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "10.5.1";
+  version = "10.6.0";
   pname = "geant4";
 
   src = fetchurl{
-    url = "http://cern.ch/geant4-data/releases/geant4.10.05.p01.tar.gz";
+    url = "https://geant4-data.web.cern.ch/geant4-data/releases/geant4.10.06.tar.gz";
-    sha256 = "f4a292220500fad17e0167ce3153e96e3410ecbe96284e572dc707f63523bdff";
+    sha256 = "169ikv2sssfbqml7bs146dj035xifxm9b12r4rzmgpvswfhca90l";
   };
 
+  # This patch fixes crash when set -u is enabled
+  patches = [
+    (fetchpatch {
+      name = "bash-variable-fix.patch";
+      url = "https://bugzilla-geant4.kek.jp/attachment.cgi?id=606&action=diff&collapsed=&headers=1&format=raw";
+      sha256 = "1bg9wg174fbqbjsjm1gz9584a7rq9p1szxr2fq9yfvqaf78289k6";
+    })
+  ];
+
   cmakeFlags = [
     "-DGEANT4_INSTALL_DATA=OFF"
     "-DGEANT4_USE_GDML=${if enableGDML then "ON" else "OFF"}"
@@ -64,11 +73,14 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
   nativeBuildInputs =  [ cmake ];
-  buildInputs = [ clhep expat zlib libGLU libGL xlibsWrapper libXmu ]
+
+  buildInputs = [ libGLU xlibsWrapper libXmu ]
+    ++ stdenv.lib.optionals enableInventor [ libXpm coin3d soxt motif ];
+
+  propagatedBuildInputs = [ clhep expat zlib libGL ]
     ++ stdenv.lib.optionals enableGDML [ xercesc ]
     ++ stdenv.lib.optionals enableXM [ motif ]
-    ++ stdenv.lib.optionals enableQT [ qtbase ]
+    ++ stdenv.lib.optionals enableQT [ qtbase ];
-    ++ stdenv.lib.optionals enableInventor [ libXpm coin3d soxt motif ];
 
   postFixup = ''
     # Don't try to export invalid environment variables.

pkgs/development/libraries/physics/geant4/g4py/default.nix

@@ -18,13 +18,15 @@ stdenv.mkDerivation {
   inherit (geant4_nomt) version src;
   pname = "g4py";
 
-  sourceRoot = "geant4.10.05.p01/environments/g4py";
-
   nativeBuildInputs = [ cmake ];
   buildInputs = [ geant4_nomt xercesc boost_python python ];
 
   GEANT4_INSTALL = geant4_nomt;
 
+  postPatch = ''
+    cd environments/g4py
+  '';
+
   preConfigure = ''
     # Fix for boost 1.67+
     substituteInPlace CMakeLists.txt \

pkgs/development/libraries/poppler/default.nix

@@ -12,7 +12,7 @@ let
 in
 stdenv.mkDerivation rec {
   name = "poppler-${suffix}-${version}";
-  version = "0.84.0"; # beware: updates often break cups-filters build
+  version = "0.84.0"; # beware: updates often break cups-filters build, check texlive too!
 
   src = fetchurl {
     url = "${meta.homepage}/poppler-${version}.tar.xz";

pkgs/development/libraries/protobuf/3.11.nix

@@ -1,6 +1,6 @@
 { callPackage, ... }:
 
 callPackage ./generic-v3.nix {
-  version = "3.11.1";
+  version = "3.11.3";
-  sha256 = "1mq8dp94mlp72ri27bgvc2i370r8kfig87wfai7vxjdnh3vng0y1";
+  sha256 = "0cn6h6fg5h64q5h3ncfwr3m7yszf5n9gpvgpv7s1csndp0ffzmin";
 }

pkgs/development/lisp-modules/quicklisp-to-nix-overrides.nix

@@ -211,4 +211,11 @@ $out/lib/common-lisp/query-fs"
       '';
     };
   };
+  cl-store = x: {
+    overrides = y: (x.overrides y) // {
+      postPatch = ''
+        sed -i -e 's/:initform "Unknown" /:initform #:|Unknown| /' backends.lisp
+      '';
+    };
+  };
 }

pkgs/development/ocaml-modules/lwt/4.x.nix

@@ -7,11 +7,11 @@ let inherit (lib) optional versionAtLeast; in
 
 buildDunePackage rec {
   pname = "lwt";
-  version = "4.4.0";
+  version = "4.5.0";
 
   src = fetchzip {
     url = "https://github.com/ocsigen/${pname}/archive/${version}.tar.gz";
-    sha256 = "1l97zdcql7y13fhaq0m9n9xvxf712jg0w70r72fvv6j49xm4nlhi";
+    sha256 = "0l836z5zr38969bi77aga7ismj4wb01i3ffxf5v59jsgd3g44r2w";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/development/ocaml-modules/mlgmpidl/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   name = "ocaml${ocaml.version}-mlgmpidl-${version}";
-  version = "1.2.11";
+  version = "1.2.12";
   src = fetchFromGitHub {
     owner = "nberth";
     repo = "mlgmpidl";
     rev = version;
-    sha256 = "1rycl84sdvgb5avdsya9iz8brx92y2zcb6cn4w1j0164j6q2ril9";
+    sha256 = "17xqiclaqs4hmnb92p9z6z9a1xfr31vcn8nlnj8ykk57by31vfza";
   };
 
   buildInputs = [ perl gmp mpfr ocaml findlib camlidl ];
@@ -21,9 +21,9 @@ stdenv.mkDerivation rec {
   postConfigure = ''
     sed -i Makefile \
       -e 's|^	/bin/rm |	rm |'
+    mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/stublibs
   '';
 
-  createFindlibDestdir = true;
 
   meta = {
     description = "OCaml interface to the GMP library";

pkgs/development/ocaml-modules/parmap/default.nix

@@ -0,0 +1,20 @@
+{ lib, buildDunePackage, fetchzip }:
+
+buildDunePackage rec {
+  pname = "parmap";
+  version = "1.1";
+
+  src = fetchzip {
+    url = "https://github.com/rdicosmo/${pname}/releases/download/${version}/${pname}-${version}.tbz";
+    sha256 = "13ahqaga1palf0s0dll512cl7k43sllmwvw6r03y70kfmky1j114";
+  };
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Library for multicore parallel programming";
+    homepage = "https://rdicosmo.github.io/parmap";
+    maintainers = [ maintainers.bcdarwin ];
+    license = licenses.lgpl2;
+  };
+}

pkgs/development/python-modules/azure-core/default.nix

@@ -11,14 +11,14 @@
 }:
 
 buildPythonPackage rec {
-  version = "1.1.1";
+  version = "1.2.1";
   pname = "azure-core";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
     extension = "zip";
-    sha256 = "00jm43gw89n446zdm18qziwd85lsx1gandxpmw62dc1bdnsfakxl";
+    sha256 = "1fff6g5lszn97qz1h4l1n255r9538yybb329ilb2rwdfq3q9kkg2";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/azure-mgmt-deploymentmanager/default.nix

@@ -5,13 +5,13 @@
 }:
 
 buildPythonPackage rec {
-  version = "0.1.0";
+  version = "0.2.0";
   pname = "azure-mgmt-deploymentmanager";
   disabled = isPy27;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0gvh17bhfcpvr6w0nd06v482m8lqxchlk256w68agi2qnqw6v2ir";
+    sha256 = "0c6pyr36n9snx879vas5r6l25db6nlp2z96xn759mz4kg4i45qs6";
     extension = "zip";
   };
 

pkgs/development/python-modules/deepdiff/default.nix

@@ -0,0 +1,44 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, mock
+, jsonpickle
+, ordered-set
+, numpy
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "deepdiff";
+  version = "4.0.9";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "5e2343398e90538edaa59c0c99207e996a3a834fdc878c666376f632a760c35a";
+  };
+
+  # # Extra packages (may not be necessary)
+  checkInputs = [
+    mock
+    numpy
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # skipped tests require murmur module
+    "test_prep_str_murmur3_64bit"
+    "test_prep_str_murmur3_128bit"
+  ];
+
+  propagatedBuildInputs = [
+    jsonpickle
+    ordered-set
+  ];
+
+  meta = with lib; {
+    description = "Deep Difference and Search of any Python object/data";
+    homepage = "https://github.com/seperman/deepdiff";
+    license = licenses.mit;
+    maintainers = [ maintainers.mic92 ];
+  };
+}

pkgs/development/python-modules/django_classytags/default.nix

@@ -2,25 +2,26 @@
 , buildPythonPackage
 , fetchPypi
 , django
+, six
 }:
 
 buildPythonPackage rec {
   pname = "django-classy-tags";
-  version = "0.9.0";
+  version = "1.0.0";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0axzsigvmb17ha5mnr3xf6c851kwinjpkxksxwprwjakh1m59d1q";
+    sha256 = "1cayqddvxd5prhybqi77lif2z4j7mmfmxgc61pq9i82q5gy2asmd";
   };
 
-  propagatedBuildInputs = [ django ];
+  propagatedBuildInputs = [ django six ];
 
   # pypi version doesn't include runtest.py, needed to run tests
   doCheck = false;
 
   meta = with stdenv.lib; {
     description = "Class based template tags for Django";
-    homepage = https://github.com/ojii/django-classy-tags;
+    homepage = "https://github.com/divio/django-classy-tags";
     license = licenses.bsd3;
   };
 

pkgs/development/python-modules/django_compressor/default.nix

@@ -2,11 +2,11 @@
   rcssmin, rjsmin, django_appconf }:
 buildPythonPackage rec {
     pname = "django_compressor";
-    version = "2.3";
+    version = "2.4";
 
     src = fetchPypi {
       inherit pname version;
-      sha256 = "1pbygd00l0k5p1r959131khij1km1a1grfxg0r59ar2wyx3n7j27";
+      sha256 = "0kx7bclfa0sxlsz6ka70zr9ra00lks0hmv1kc99wbanx6xhirvfj";
     };
     postPatch = ''
       substituteInPlace setup.py --replace 'rcssmin == 1.0.6' 'rcssmin' \

pkgs/development/python-modules/foxdot/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "FoxDot";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "8b6d810f5389692c45d236dec89cecc4ff32ad053e4c878c91363acfa4508639";
+    sha256 = "1k32fjlmzhhh6hvda71xqis13c3bdn7y3f5z9qqd1q410nfpzf59";
   };
 
   propagatedBuildInputs = [ tkinter supercollider ];

pkgs/development/python-modules/hbmqtt/default.nix

@@ -3,13 +3,13 @@
 
 buildPythonPackage rec {
   pname = "hbmqtt";
-  version = "0.9.5";
+  version = "0.9.6";
 
   disabled = !isPy3k;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "9886b1c8321d16e971376dc609b902e0c84118846642b5e09f08a4ca876a7f2a";
+    sha256 = "1n9c8yj11npiq9qxivwmfhib1qkjpcyw42a7q0w641bdrz3x6r37";
   };
 
   propagatedBuildInputs = [ transitions websockets passlib docopt pyyaml ];

pkgs/development/python-modules/odfpy/default.nix

@@ -7,11 +7,11 @@
 
 buildPythonPackage rec {
   pname = "odfpy";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "596021f0519623ca8717331951c95e3b8d7b21e86edc7efe8cb650a0d0f59a2b";
+    sha256 = "1v1qqk9p12qla85yscq2g413l3qasn6yr4ncyc934465b5p6lxnv";
   };
 
   propagatedBuildInputs = [ defusedxml ];

pkgs/development/python-modules/openrazer/common.nix

@@ -1,17 +1,17 @@
 { stdenv
 , fetchFromGitHub
 }: rec {
-  version = "2.6.0";
+  version = "2.7.0";
   src = fetchFromGitHub {
     owner = "openrazer";
     repo = "openrazer";
     rev = "v${version}";
-    sha256 = "1s5irs3avrlp891mxan3z8p55ias9rq26rqp2qrlcc6i4vl29di0";
+    sha256 = "013r9q4xg2xjmyxybx07zsl2b5lm9vw843anx22ygpvxz1qgz9hp";
   };
   meta = with stdenv.lib; {
     homepage = https://openrazer.github.io/;
     license = licenses.gpl2;
-    maintainers = with maintainers; [ roelvandijk ];
+    maintainers = with maintainers; [ roelvandijk evanjs ];
     platforms = platforms.linux;
   };
 }

pkgs/development/python-modules/pandas/default.nix

@@ -87,6 +87,8 @@ in buildPythonPackage rec {
     # ordering logic has changed
     "numpy_ufuncs_other"
     "order_without_freq"
+    # tries to import from pandas.tests post install
+    "util_in_top_level"
   ] ++ optionals isDarwin [
     "test_locale"
     "test_clipboard"

pkgs/development/python-modules/rpy2/default.nix

@@ -24,13 +24,13 @@
 }:
 
 buildPythonPackage rec {
-    version = "3.2.4";
+    version = "3.2.5";
     pname = "rpy2";
 
     disabled = isPyPy;
     src = fetchPypi {
       inherit version pname;
-      sha256 = "3daf1a4b28c4e354ef989093f03b066908bf6e5082a6f4af72cc3fd928a28dc6";
+      sha256 = "0pnk363klic4smb3jnkm4lnh984c2cpqzawrg2j52hgy8k1bgyrk";
     };
 
     buildInputs = [