Merge branch 'staging-next' into staging

maintainers/maintainer-list.nix

@@ -3024,6 +3024,16 @@
     githubId = 615606;
     name = "Glenn Searby";
   };
+  glittershark = {
+    name = "Griffin Smith";
+    email = "root@gws.fyi";
+    github = "glittershark";
+    githubId = 1481027;
+    keys = [{
+      longkeyid = "rsa2048/0x44EF5B5E861C09A7";
+      fingerprint = "0F11 A989 879E 8BBB FDC1  E236 44EF 5B5E 861C 09A7";
+    }];
+  };
   gloaming = {
     email = "ch9871@gmail.com";
     github = "gloaming";
@@ -3959,6 +3969,12 @@
     githubId = 4611077;
     name = "Raymond Gauthier";
   };
+  jschievink = {
+    email = "jonasschievink@gmail.com";
+    github = "jonas-schievink";
+    githubId = 1786438;
+    name = "Jonas Schievink";
+  };
   jtcoolen = {
     email = "jtcoolen@pm.me";
     name = "Julien Coolen";
@@ -5640,6 +5656,12 @@
     githubId = 5047140;
     name = "Victor Collod";
   };
+  mupdt = {
+    email = "nix@pdtpartners.com";
+    github = "mupdt";
+    githubId = 25388474;
+    name = "Matej Urbas";
+  };
   mvnetbiz = {
     email = "mvnetbiz@gmail.com";
     github = "mvnetbiz";

nixos/doc/manual/release-notes/rl-2009.xml

@@ -124,6 +124,12 @@ systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ];
      <varname>services.postfix.sslCACert</varname> was replaced by <varname>services.postfix.tlsTrustedAuthorities</varname> which now defaults to system certifcate authorities.
     </para>
    </listitem>
+   <listitem>
+    <para>
+      Subordinate GID and UID mappings are now set up automatically for all normal users.
+      This will make container tools like Podman work as non-root users out of the box.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 

nixos/modules/config/update-users-groups.pl

@@ -281,3 +281,58 @@ foreach my $u (values %usersOut) {
 }
 
 updateFile("/etc/shadow", \@shadowNew, 0600);
+
+# Rewrite /etc/subuid & /etc/subgid to include default container mappings
+
+my $subUidMapFile = "/var/lib/nixos/auto-subuid-map";
+my $subUidMap = -e $subUidMapFile ? decode_json(read_file($subUidMapFile)) : {};
+
+my (%subUidsUsed, %subUidsPrevUsed);
+
+$subUidsPrevUsed{$_} = 1 foreach values %{$subUidMap};
+
+sub allocSubUid {
+    my ($name, @rest) = @_;
+
+    # TODO: No upper bounds?
+    my ($min, $max, $up) = (100000, 100000 * 100, 1);
+    my $prevId = $subUidMap->{$name};
+    if (defined $prevId && !defined $subUidsUsed{$prevId}) {
+        $subUidsUsed{$prevId} = 1;
+        return $prevId;
+    }
+
+    my $id = allocId(\%subUidsUsed, \%subUidsPrevUsed, $min, $max, $up, sub { my ($uid) = @_; getpwuid($uid) });
+    my $offset = $id - 100000;
+    my $count = $offset * 65536;
+    my $subordinate = 100000 + $count;
+    return $subordinate;
+}
+
+my @subGids;
+my @subUids;
+foreach my $u (values %usersOut) {
+    my $name = $u->{name};
+
+    foreach my $range (@{$u->{subUidRanges}}) {
+        my $value = join(":", ($name, $range->{startUid}, $range->{count}));
+        push @subUids, $value;
+    }
+
+    foreach my $range (@{$u->{subGidRanges}}) {
+        my $value = join(":", ($name, $range->{startGid}, $range->{count}));
+        push @subGids, $value;
+    }
+
+    if($u->{isNormalUser}) {
+        my $subordinate = allocSubUid($name);
+        $subUidMap->{$name} = $subordinate;
+        my $value = join(":", ($name, $subordinate, 65536));
+        push @subUids, $value;
+        push @subGids, $value;
+    }
+}
+
+updateFile("/etc/subuid", join("\n", @subUids) . "\n");
+updateFile("/etc/subgid", join("\n", @subGids) . "\n");
+updateFile($subUidMapFile, encode_json($subUidMap) . "\n");

nixos/modules/config/users-groups.nix

@@ -375,18 +375,6 @@ let
     };
   };
 
-  mkSubuidEntry = user: concatStrings (
-    map (range: "${user.name}:${toString range.startUid}:${toString range.count}\n")
-      user.subUidRanges);
-
-  subuidFile = concatStrings (map mkSubuidEntry (attrValues cfg.users));
-
-  mkSubgidEntry = user: concatStrings (
-    map (range: "${user.name}:${toString range.startGid}:${toString range.count}\n")
-        user.subGidRanges);
-
-  subgidFile = concatStrings (map mkSubgidEntry (attrValues cfg.users));
-
   idsAreUnique = set: idAttr: !(fold (name: args@{ dup, acc }:
     let
       id = builtins.toString (builtins.getAttr idAttr (builtins.getAttr name set));
@@ -406,6 +394,7 @@ let
       { inherit (u)
           name uid group description home createHome isSystemUser
           password passwordFile hashedPassword
+          isNormalUser subUidRanges subGidRanges
           initialPassword initialHashedPassword;
         shell = utils.toShellPath u.shell;
       }) cfg.users;
@@ -430,9 +419,9 @@ in {
     (mkChangedOptionModule
       [ "security" "initialRootPassword" ]
       [ "users" "users" "root" "initialHashedPassword" ]
-      (cfg: if cfg.security.initialHashedPassword == "!"
+      (cfg: if cfg.security.initialRootPassword == "!"
             then null
-            else cfg.security.initialHashedPassword))
+            else cfg.security.initialRootPassword))
   ];
 
   ###### interface
@@ -567,16 +556,7 @@ in {
     # Install all the user shells
     environment.systemPackages = systemShells;
 
-    environment.etc = {
+    environment.etc = (mapAttrs' (name: { packages, ... }: {
-      subuid = {
-        text = subuidFile;
-        mode = "0644";
-      };
-      subgid = {
-        text = subgidFile;
-        mode = "0644";
-      };
-    } // (mapAttrs' (name: { packages, ... }: {
       name = "profiles/per-user/${name}";
       value.source = pkgs.buildEnv {
         name = "user-environment";

nixos/modules/services/audio/spotifyd.nix

@@ -16,7 +16,7 @@ in
         type = types.lines;
         description = ''
           Configuration for Spotifyd. For syntax and directives, see
-          https://github.com/Spotifyd/spotifyd#Configuration.
+          <link xlink:href="https://github.com/Spotifyd/spotifyd#Configuration"/>.
         '';
       };
     };

nixos/modules/services/backup/restic.nix

@@ -31,6 +31,59 @@ in
           '';
         };
 
+        rcloneOptions = mkOption {
+          type = with types; nullOr (attrsOf (oneOf [ str bool ]));
+          default = null;
+          description = ''
+            Options to pass to rclone to control its behavior.
+            See <link xlink:href="https://rclone.org/docs/#options"/> for
+            available options. When specifying option names, strip the
+            leading <literal>--</literal>. To set a flag such as
+            <literal>--drive-use-trash</literal>, which does not take a value,
+            set the value to the Boolean <literal>true</literal>.
+          '';
+          example = {
+            bwlimit = "10M";
+            drive-use-trash = "true";
+          };
+        };
+
+        rcloneConfig = mkOption {
+          type = with types; nullOr (attrsOf (oneOf [ str bool ]));
+          default = null;
+          description = ''
+            Configuration for the rclone remote being used for backup.
+            See the remote's specific options under rclone's docs at
+            <link xlink:href="https://rclone.org/docs/"/>. When specifying
+            option names, use the "config" name specified in the docs. 
+            For example, to set <literal>--b2-hard-delete</literal> for a B2
+            remote, use <literal>hard_delete = true</literal> in the
+            attribute set.
+            Warning: Secrets set in here will be world-readable in the Nix
+            store! Consider using the <literal>rcloneConfigFile</literal>
+            option instead to specify secret values separately. Note that
+            options set here will override those set in the config file.
+          '';
+          example = {
+            type = "b2";
+            account = "xxx";
+            key = "xxx";
+            hard_delete = true;
+          };
+        };
+
+        rcloneConfigFile = mkOption {
+          type = with types; nullOr path;
+          default = null;
+          description = ''
+            Path to the file containing rclone configuration. This file
+            must contain configuration for the remote specified in this backup
+            set and also must be readable by root. Options set in
+            <literal>rcloneConfig</literal> will override those set in this
+            file.
+          '';
+        };
+
         repository = mkOption {
           type = types.str;
           description = ''
@@ -170,11 +223,22 @@ in
             ( resticCmd + " forget --prune " + (concatStringsSep " " backup.pruneOpts) )
             ( resticCmd + " check" )
           ];
+          # Helper functions for rclone remotes
+          rcloneRemoteName = builtins.elemAt (splitString ":" backup.repository) 1;
+          rcloneAttrToOpt = v: "RCLONE_" + toUpper (builtins.replaceStrings [ "-" ] [ "_" ] v);
+          rcloneAttrToConf = v: "RCLONE_CONFIG_" + toUpper (rcloneRemoteName + "_" + v);
+          toRcloneVal = v: if lib.isBool v then lib.boolToString v else v;
         in nameValuePair "restic-backups-${name}" ({
           environment = {
             RESTIC_PASSWORD_FILE = backup.passwordFile;
             RESTIC_REPOSITORY = backup.repository;
-          };
+          } // optionalAttrs (backup.rcloneOptions != null) (mapAttrs' (name: value:
+            nameValuePair (rcloneAttrToOpt name) (toRcloneVal value)
+          ) backup.rcloneOptions) // optionalAttrs (backup.rcloneConfigFile != null) {
+            RCLONE_CONFIG = backup.rcloneConfigFile;
+          } // optionalAttrs (backup.rcloneConfig != null) (mapAttrs' (name: value:
+            nameValuePair (rcloneAttrToConf name) (toRcloneVal value)
+          ) backup.rcloneConfig);
           path = [ pkgs.openssh ];
           restartIfChanged = false;
           serviceConfig = {

nixos/modules/services/continuous-integration/buildbot/worker.nix

@@ -29,7 +29,7 @@ let
 
     with open('${cfg.workerPassFile}', 'r', encoding='utf-8') as passwd_file:
         passwd = passwd_file.read().strip('\r\n')
-    keepalive = 600
+    keepalive = ${toString cfg.keepalive}
     umask = None
     maxdelay = 300
     numcpus = None
@@ -116,6 +116,15 @@ in {
         description = "Specifies the Buildbot Worker connection string.";
       };
 
+      keepalive = mkOption {
+        default = 600;
+        type = types.int;
+        description = "
+          This is a number that indicates how frequently keepalive messages should be sent
+          from the worker to the buildmaster, expressed in seconds.
+        ";
+      };
+
       package = mkOption {
         type = types.package;
         default = pkgs.python3Packages.buildbot-worker;

nixos/modules/services/development/jupyter/default.nix

@@ -6,10 +6,7 @@ let
 
   cfg = config.services.jupyter;
 
-  # NOTE: We don't use top-level jupyter because we don't
+  package = cfg.package;
-  # want to pass in JUPYTER_PATH but use .environment instead,
-  # saving a rebuild.
-  package = pkgs.python3.pkgs.notebook;
 
   kernels = (pkgs.jupyter-kernel.create  {
     definitions = if cfg.kernels != null
@@ -37,6 +34,27 @@ in {
       '';
     };
 
+    package = mkOption {
+      type = types.package;
+      # NOTE: We don't use top-level jupyter because we don't
+      # want to pass in JUPYTER_PATH but use .environment instead,
+      # saving a rebuild.
+      default = pkgs.python3.pkgs.notebook;
+      description = ''
+        Jupyter package to use.
+      '';
+    };
+
+    command = mkOption {
+      type = types.str;
+      default = "jupyter-notebook";
+      example = "jupyter-lab";
+      description = ''
+        Which command the service runs. Note that not all jupyter packages
+        have all commands, e.g. jupyter-lab isn't present in the default package.
+       '';
+    };
+
     port = mkOption {
       type = types.int;
       default = 8888;
@@ -157,7 +175,7 @@ in {
 
         serviceConfig = {
           Restart = "always";
-          ExecStart = ''${package}/bin/jupyter-notebook \
+          ExecStart = ''${package}/bin/${cfg.command} \
             --no-browser \
             --ip=${cfg.ip} \
             --port=${toString cfg.port} --port-retries 0 \

nixos/modules/services/misc/gitolite.nix

@@ -27,7 +27,10 @@ in
         type = types.str;
         default = "/var/lib/gitolite";
         description = ''
-          Gitolite home directory (used to store all the repositories).
+          The gitolite home directory used to store all repositories. If left as the default value
+          this directory will automatically be created before the gitolite server starts, otherwise
+          the sysadmin is responsible for ensuring the directory exists with appropriate ownership
+          and permissions.
         '';
       };
 
@@ -149,14 +152,6 @@ in
     };
     users.groups.${cfg.group}.gid = config.ids.gids.gitolite;
 
-    systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' 0750 ${cfg.user} ${cfg.group} - -"
-      "d '${cfg.dataDir}'/.gitolite - ${cfg.user} ${cfg.group} - -"
-      "d '${cfg.dataDir}'/.gitolite/logs - ${cfg.user} ${cfg.group} - -"
-
-      "Z ${cfg.dataDir} 0750 ${cfg.user} ${cfg.group} - -"
-    ];
-
     systemd.services.gitolite-init = {
       description = "Gitolite initialization";
       wantedBy    = [ "multi-user.target" ];
@@ -167,13 +162,19 @@ in
         GITOLITE_RC_DEFAULT = "${rcDir}/gitolite.rc.default";
       };
 
-      serviceConfig = {
+      serviceConfig = mkMerge [
-        Type = "oneshot";
+        (mkIf (cfg.dataDir == "/var/lib/gitolite") {
-        User = cfg.user;
+          StateDirectory = "gitolite gitolite/.gitolite gitolite/.gitolite/logs";
-        Group = cfg.group;
+          StateDirectoryMode = "0750";
-        WorkingDirectory = "~";
+        })
-        RemainAfterExit = true;
+        {
-      };
+          Type = "oneshot";
+          User = cfg.user;
+          Group = cfg.group;
+          WorkingDirectory = "~";
+          RemainAfterExit = true;
+        }
+      ];
 
       path = [ pkgs.gitolite pkgs.git pkgs.perl pkgs.bash pkgs.diffutils config.programs.ssh.package ];
       script =

nixos/modules/services/networking/unifi.nix

@@ -162,6 +162,8 @@ in
       unitConfig.RequiresMountsFor = stateDir;
       # This a HACK to fix missing dependencies of dynamic libs extracted from jars
       environment.LD_LIBRARY_PATH = with pkgs.stdenv; "${cc.cc.lib}/lib";
+      # Make sure package upgrades trigger a service restart
+      restartTriggers = [ cfg.unifiPackage cfg.mongodbPackage ];
 
       serviceConfig = {
         Type = "simple";

nixos/modules/system/boot/loader/grub/install-grub.pl

@@ -652,7 +652,7 @@ my @deviceTargets = getList('devices');
 my $prevGrubState = readGrubState();
 my @prevDeviceTargets = split/,/, $prevGrubState->devices;
 my @extraGrubInstallArgs = getList('extraGrubInstallArgs');
-my @prevExtraGrubInstallArgs = $prevGrubState->extraGrubInstallArgs;
+my @prevExtraGrubInstallArgs = @{$prevGrubState->extraGrubInstallArgs};
 
 my $devicesDiffer = scalar (List::Compare->new( '-u', '-a', \@deviceTargets, \@prevDeviceTargets)->get_symmetric_difference());
 my $extraGrubInstallArgsDiffer = scalar (List::Compare->new( '-u', '-a', \@extraGrubInstallArgs, \@prevExtraGrubInstallArgs)->get_symmetric_difference());

nixos/modules/system/boot/luksroot.nix

@@ -473,8 +473,6 @@ in
         [ "aes" "aes_generic" "blowfish" "twofish"
           "serpent" "cbc" "xts" "lrw" "sha1" "sha256" "sha512"
           "af_alg" "algif_skcipher"
-
-          (if pkgs.stdenv.hostPlatform.system == "x86_64-linux" then "aes_x86_64" else "aes_i586")
         ];
       description = ''
         A list of cryptographic kernel modules needed to decrypt the root device(s).

nixos/modules/system/boot/networkd.nix

@@ -302,7 +302,7 @@ let
 
   checkDhcpV6 = checkUnitConfig "DHCPv6" [
     (assertOnlyFields [
-      "UseDns" "UseNTP" "RapidCommit" "ForceDHCPv6PDOtherInformation"
+      "UseDNS" "UseNTP" "RapidCommit" "ForceDHCPv6PDOtherInformation"
       "PrefixDelegationHint"
     ])
     (assertValueOneOf "UseDNS" boolValues)

nixos/modules/system/boot/stage-2-init.sh

@@ -169,4 +169,4 @@ exec {logOutFd}>&- {logErrFd}>&-
 echo "starting systemd..."
 PATH=/run/current-system/systemd/lib/systemd:@fsPackagesPath@ \
     LOCALE_ARCHIVE=/run/current-system/sw/lib/locale/locale-archive \
-    exec systemd
+    exec @systemdExecutable@

nixos/modules/system/boot/stage-2.nix

@@ -10,6 +10,7 @@ let
     src = ./stage-2-init.sh;
     shellDebug = "${pkgs.bashInteractive}/bin/bash";
     shell = "${pkgs.bash}/bin/bash";
+    inherit (config.boot) systemdExecutable;
     isExecutable = true;
     inherit (config.nix) readOnlyStore;
     inherit useHostResolvConf;
@@ -72,6 +73,15 @@ in
         '';
       };
 
+      systemdExecutable = mkOption {
+        default = "systemd";
+        type = types.str;
+        description = ''
+          The program to execute to start systemd. Typically
+          <literal>systemd</literal>, which will find systemd in the
+          PATH.
+        '';
+      };
     };
 
   };

nixos/modules/system/boot/systemd.nix

@@ -818,6 +818,49 @@ in
       '';
     };
 
+    systemd.watchdog.device = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/dev/watchdog";
+      description = ''
+        The path to a hardware watchdog device which will be managed by systemd.
+        If not specified, systemd will default to /dev/watchdog.
+      '';
+    };
+
+    systemd.watchdog.runtimeTime = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "30s";
+      description = ''
+        The amount of time which can elapse before a watchdog hardware device
+        will automatically reboot the system. Valid time units include "ms",
+        "s", "min", "h", "d", and "w".
+      '';
+    };
+
+    systemd.watchdog.rebootTime = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "10m";
+      description = ''
+        The amount of time which can elapse after a reboot has been triggered
+        before a watchdog hardware device will automatically reboot the system.
+        Valid time units include "ms", "s", "min", "h", "d", and "w".
+      '';
+    };
+
+    systemd.watchdog.kexecTime = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "10m";
+      description = ''
+        The amount of time which can elapse when kexec is being executed before
+        a watchdog hardware device will automatically reboot the system. This
+        option should only be enabled if reloadTime is also enabled. Valid
+        time units include "ms", "s", "min", "h", "d", and "w".
+      '';
+    };
   };
 
 
@@ -889,6 +932,19 @@ in
           DefaultIPAccounting=yes
         ''}
         DefaultLimitCORE=infinity
+        ${optionalString (config.systemd.watchdog.device != null) ''
+          WatchdogDevice=${config.systemd.watchdog.device}
+        ''}
+        ${optionalString (config.systemd.watchdog.runtimeTime != null) ''
+          RuntimeWatchdogSec=${config.systemd.watchdog.runtimeTime}
+        ''}
+        ${optionalString (config.systemd.watchdog.rebootTime != null) ''
+          RebootWatchdogSec=${config.systemd.watchdog.rebootTime}
+        ''}
+        ${optionalString (config.systemd.watchdog.kexecTime != null) ''
+          KExecWatchdogSec=${config.systemd.watchdog.kexecTime}
+        ''}
+
         ${config.systemd.extraConfig}
       '';
 

nixos/modules/virtualisation/containers.nix

@@ -23,6 +23,15 @@ in
     maintainers = [] ++ lib.teams.podman.members;
   };
 
+
+  imports = [
+    (
+      lib.mkRemovedOptionModule
+      [ "virtualisation" "containers" "users" ]
+      "All users with `isNormaUser = true` set now get appropriate subuid/subgid mappings."
+    )
+  ];
+
   options.virtualisation.containers = {
 
     enable =
@@ -99,15 +108,6 @@ in
       '';
     };
 
-    users = mkOption {
-      default = [];
-      type = types.listOf types.str;
-      description = ''
-        List of users to set up subuid/subgid mappings for.
-        This is a requirement for running rootless containers.
-      '';
-    };
-
   };
 
   config = lib.mkIf cfg.enable {
@@ -122,26 +122,6 @@ in
       registries = lib.mapAttrs (n: v: { registries = v; }) cfg.registries;
     };
 
-    users.extraUsers = builtins.listToAttrs (
-      (
-        builtins.foldl' (
-          acc: user: {
-            values = acc.values ++ [
-              {
-                name = user;
-                value = {
-                  subUidRanges = [ { startUid = acc.offset; count = 65536; } ];
-                  subGidRanges = [ { startGid = acc.offset; count = 65536; } ];
-                };
-              }
-            ];
-            offset = acc.offset + 65536;
-          }
-        )
-        { values = []; offset = 100000; } (lib.unique cfg.users)
-      ).values
-    );
-
     environment.etc."containers/policy.json".source =
       if cfg.policy != {} then pkgs.writeText "policy.json" (builtins.toJSON cfg.policy)
       else copyFile "${pkgs.skopeo.src}/default-policy.json";

nixos/tests/ceph-multi-node.nix

@@ -183,15 +183,15 @@ let
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
 
     monA.succeed(
-        "ceph osd pool create multi-node-test 128 128",
+        "ceph osd pool create multi-node-test 32 32",
         "ceph osd pool ls | grep 'multi-node-test'",
         "ceph osd pool rename multi-node-test multi-node-other-test",
         "ceph osd pool ls | grep 'multi-node-other-test'",
     )
-    monA.wait_until_succeeds("ceph -s | grep '1 pools, 128 pgs'")
+    monA.wait_until_succeeds("ceph -s | grep '2 pools, 33 pgs'")
     monA.succeed("ceph osd pool set multi-node-other-test size 2")
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-    monA.wait_until_succeeds("ceph -s | grep '128 active+clean'")
+    monA.wait_until_succeeds("ceph -s | grep '33 active+clean'")
     monA.fail(
         "ceph osd pool ls | grep 'multi-node-test'",
         "ceph osd pool delete multi-node-other-test multi-node-other-test --yes-i-really-really-mean-it",

nixos/tests/ceph-single-node.nix

@@ -143,12 +143,12 @@ let
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
 
     monA.succeed(
-        "ceph osd pool create single-node-test 128 128",
+        "ceph osd pool create single-node-test 32 32",
         "ceph osd pool ls | grep 'single-node-test'",
         "ceph osd pool rename single-node-test single-node-other-test",
         "ceph osd pool ls | grep 'single-node-other-test'",
     )
-    monA.wait_until_succeeds("ceph -s | grep '1 pools, 128 pgs'")
+    monA.wait_until_succeeds("ceph -s | grep '2 pools, 33 pgs'")
     monA.succeed(
         "ceph osd getcrushmap -o crush",
         "crushtool -d crush -o decrushed",
@@ -158,7 +158,7 @@ let
         "ceph osd pool set single-node-other-test size 2",
     )
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-    monA.wait_until_succeeds("ceph -s | grep '128 active+clean'")
+    monA.wait_until_succeeds("ceph -s | grep '33 active+clean'")
     monA.fail(
         "ceph osd pool ls | grep 'multi-node-test'",
         "ceph osd pool delete single-node-other-test single-node-other-test --yes-i-really-really-mean-it",

nixos/tests/gnome3-xorg.nix

@@ -14,6 +14,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
 
       services.xserver.displayManager = {
         gdm.enable = true;
+        gdm.debug = true;
         autoLogin = {
           enable = true;
           user = user.name;
@@ -21,6 +22,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
       };
 
       services.xserver.desktopManager.gnome3.enable = true;
+      services.xserver.desktopManager.gnome3.debug = true;
       services.xserver.displayManager.defaultSession = "gnome-xorg";
 
       virtualisation.memorySize = 1024;

nixos/tests/gnome3.nix

@@ -13,6 +13,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
 
       services.xserver.displayManager = {
         gdm.enable = true;
+        gdm.debug = true;
         autoLogin = {
           enable = true;
           user = "alice";
@@ -20,6 +21,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
       };
 
       services.xserver.desktopManager.gnome3.enable = true;
+      services.xserver.desktopManager.gnome3.debug = true;
 
       virtualisation.memorySize = 1024;
     };

nixos/tests/podman.nix

@@ -12,9 +12,6 @@ import ./make-test-python.nix (
         { pkgs, ... }:
         {
           virtualisation.podman.enable = true;
-          virtualisation.containers.users = [
-            "alice"
-          ];
 
           users.users.alice = {
             isNormalUser = true;

nixos/tests/restic.nix

@@ -4,33 +4,50 @@ import ./make-test-python.nix (
     let
       password = "some_password";
       repository = "/tmp/restic-backup";
-      passwordFile = pkgs.writeText "password" "correcthorsebatterystaple";
+      rcloneRepository = "rclone:local:/tmp/restic-rclone-backup";
+
+      passwordFile = "${pkgs.writeText "password" "correcthorsebatterystaple"}";
+      initialize = true;
+      paths = [ "/opt" ];
+      pruneOpts = [
+        "--keep-daily 2"
+        "--keep-weekly 1"
+        "--keep-monthly 1"
+        "--keep-yearly 99"
+      ];
     in
       {
         name = "restic";
 
         meta = with pkgs.stdenv.lib.maintainers; {
-          maintainers = [ bbigras ];
+          maintainers = [ bbigras i077 ];
         };
 
         nodes = {
           server =
-            { ... }:
+            { pkgs, ... }:
               {
                 services.restic.backups = {
                   remotebackup = {
-                    inherit repository;
+                    inherit repository passwordFile initialize paths pruneOpts;
-                    passwordFile = "${passwordFile}";
+                  };
-                    initialize = true;
+                  rclonebackup = {
-                    paths = [ "/opt" ];
+                    repository = rcloneRepository;
-                    pruneOpts = [
+                    rcloneConfig = {
-                      "--keep-daily 2"
+                      type = "local";
-                      "--keep-weekly 1"
+                      one_file_system = true;
-                      "--keep-monthly 1"
+                    };
-                      "--keep-yearly 99"
+
-                    ];
+                    # This gets overridden by rcloneConfig.type
+                    rcloneConfigFile = pkgs.writeText "rclone.conf" ''
+                      [local]
+                      type=ftp
+                    '';
+                    inherit passwordFile initialize paths pruneOpts;
                   };
                 };
+
+                environment.sessionVariables.RCLONE_CONFIG_LOCAL_TYPE = "local";
               };
         };
 
@@ -38,25 +55,35 @@ import ./make-test-python.nix (
           server.start()
           server.wait_for_unit("dbus.socket")
           server.fail(
-              "${pkgs.restic}/bin/restic -r ${repository} -p ${passwordFile} snapshots"
+              "${pkgs.restic}/bin/restic -r ${repository} -p ${passwordFile} snapshots",
+              "${pkgs.restic}/bin/restic -r ${rcloneRepository} -p ${passwordFile} snapshots",
           )
           server.succeed(
               "mkdir -p /opt",
               "touch /opt/some_file",
+              "mkdir -p /tmp/restic-rclone-backup",
               "timedatectl set-time '2016-12-13 13:45'",
               "systemctl start restic-backups-remotebackup.service",
+              "systemctl start restic-backups-rclonebackup.service",
               '${pkgs.restic}/bin/restic -r ${repository} -p ${passwordFile} snapshots -c | grep -e "^1 snapshot"',
+              '${pkgs.restic}/bin/restic -r ${rcloneRepository} -p ${passwordFile} snapshots -c | grep -e "^1 snapshot"',
               "timedatectl set-time '2017-12-13 13:45'",
               "systemctl start restic-backups-remotebackup.service",
+              "systemctl start restic-backups-rclonebackup.service",
               "timedatectl set-time '2018-12-13 13:45'",
               "systemctl start restic-backups-remotebackup.service",
+              "systemctl start restic-backups-rclonebackup.service",
               "timedatectl set-time '2018-12-14 13:45'",
               "systemctl start restic-backups-remotebackup.service",
+              "systemctl start restic-backups-rclonebackup.service",
               "timedatectl set-time '2018-12-15 13:45'",
               "systemctl start restic-backups-remotebackup.service",
+              "systemctl start restic-backups-rclonebackup.service",
               "timedatectl set-time '2018-12-16 13:45'",
               "systemctl start restic-backups-remotebackup.service",
+              "systemctl start restic-backups-rclonebackup.service",
               '${pkgs.restic}/bin/restic -r ${repository} -p ${passwordFile} snapshots -c | grep -e "^4 snapshot"',
+              '${pkgs.restic}/bin/restic -r ${rcloneRepository} -p ${passwordFile} snapshots -c | grep -e "^4 snapshot"',
           )
         '';
       }

nixos/tests/systemd.nix

@@ -50,6 +50,13 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         fi
       '';
     };
+
+    systemd.watchdog = {
+      device = "/dev/watchdog";
+      runtimeTime = "30s";
+      rebootTime = "10min";
+      kexecTime = "5min";
+    };
   };
 
   testScript = ''
@@ -122,5 +129,20 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         retcode, output = machine.execute("systemctl status testservice1.service")
         assert retcode in [0, 3]  # https://bugs.freedesktop.org/show_bug.cgi?id=77507
         assert "CPU:" in output
+
+    # Test systemd is configured to manage a watchdog
+    with subtest("systemd manages hardware watchdog"):
+        machine.wait_for_unit("multi-user.target")
+
+        # It seems that the device's path doesn't appear in 'systemctl show' so
+        # check it separately.
+        assert "WatchdogDevice=/dev/watchdog" in machine.succeed(
+            "cat /etc/systemd/system.conf"
+        )
+
+        output = machine.succeed("systemctl show | grep Watchdog")
+        assert "RuntimeWatchdogUSec=30s" in output
+        assert "RebootWatchdogUSec=10m" in output
+        assert "KExecWatchdogUSec=5m" in output
   '';
 })

pkgs/applications/audio/gnome-podcasts/default.nix

@@ -20,7 +20,7 @@
 }:
 
 rustPlatform.buildRustPackage rec {
-  version = "0.4.7";
+  version = "0.4.8";
   pname = "gnome-podcasts";
 
   src = fetchFromGitLab {
@@ -28,10 +28,10 @@ rustPlatform.buildRustPackage rec {
     owner = "World";
     repo = "podcasts";
     rev = version;
-    sha256 = "0vy5i77bv8c22ldhrnr4z6kx22zqnb1lg3s7y8673bqjgd7dppi0";
+    sha256 = "0y2332zjq7vf1v38wzwz98fs19vpzy9kl7y0xbdzqr303l59hjb1";
   };
 
-  cargoSha256 = "1dlbdxsf9p2jzrsclm43k95y8m3zcd41qd9ajg1ii3fpnahi58kd";
+  cargoSha256 = "1jbii9k4bkrivdk1ffr6556q1sgk9j4jbzwnn8vbxmksyl1x328q";
 
   nativeBuildInputs = [
     meson

pkgs/applications/audio/mellowplayer/default.nix

@@ -0,0 +1,70 @@
+{ cmake
+, fetchFromGitLab
+, lib
+, libnotify
+, mkDerivation
+, pkgconfig
+, qtbase
+, qtdeclarative
+, qtgraphicaleffects
+, qtquickcontrols2
+, qttools
+, qtwebengine
+}:
+
+mkDerivation rec {
+  pname = "MellowPlayer";
+  version = "3.6.4";
+
+  src = fetchFromGitLab {
+    owner = "ColinDuquesnoy";
+    repo = "MellowPlayer";
+    rev = version;
+    sha256 = "1ss7s3kal4vzhz7ld0yy2kvp1rk2w3i6fya0z3xd7nff9p31gqvw";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  buildInputs = [
+    libnotify
+    qtbase
+    qtdeclarative
+    qtgraphicaleffects
+    qtquickcontrols2
+    qttools
+    qtwebengine
+  ];
+
+  doCheck = true;
+
+  cmakeFlags = [ "-DBUILD_TESTS=ON" ];
+
+  preCheck = ''
+    # Running the tests requires a location at the home directory for logging.
+    export HOME="$NIX_BUILD_TOP/home"
+    mkdir -p "$HOME/.local/share/MellowPlayer.Tests/MellowPlayer.Tests/Logs"
+
+    # Without this, the tests fail because they cannot create the QT Window
+    export QT_QPA_PLATFORM=offscreen
+  ''
+  # TODO: The tests are failing because it can't locate QT plugins. Is there a better way to do this?
+  + (builtins.concatStringsSep "\n" (lib.lists.flatten (builtins.map
+      (pkg: [
+        (lib.optionalString (pkg ? qtPluginPrefix) ''
+          export QT_PLUGIN_PATH="${pkg}/${pkg.qtPluginPrefix}"''${QT_PLUGIN_PATH:+':'}$QT_PLUGIN_PATH
+        '')
+
+        (lib.optionalString (pkg ? qtQmlPrefix) ''
+          export QML2_IMPORT_PATH="${pkg}/${pkg.qtQmlPrefix}"''${QML2_IMPORT_PATH:+':'}$QML2_IMPORT_PATH
+        '')
+      ]) buildInputs)));
+
+  meta = with lib; {
+    inherit (qtbase.meta) platforms;
+
+    description = "Cloud music integration for your desktop.";
+    homepage = "https://gitlab.com/ColinDuquesnoy/MellowPlayer";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ kalbasit ];
+  };
+}

pkgs/applications/audio/mixxx/default.nix

@@ -19,13 +19,13 @@ let
 in
 mkDerivation rec {
   pname = "mixxx";
-  version = "2.2.3";
+  version = "2.2.4";
 
   src = fetchFromGitHub {
     owner = "mixxxdj";
     repo = "mixxx";
     rev = "release-${version}";
-    sha256 = "1h7q25fv62c5m74d4cn1m6mpanmqpbl2wqbch4qvn488jb2jw1dv";
+    sha256 = "1dj9li8av9b2kbm76jvvbdmihy1pyrw0s4xd7dd524wfhwr1llxr";
   };
 
   nativeBuildInputs = [ scons.py2 ];

pkgs/applications/blockchains/go-ethereum.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.9.15";
+  version = "1.9.16";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1c69rfnx9130b87pw9lnaxyrbzwfhqb2dxyl7qyiscq85hqs16f9";
+    sha256 = "0vycnyz6v39cfrck70h3dbn7jkkh67q0fli240ksw2cp4pqwpwcn";
   };
 
   usb = fetchFromGitHub {
@@ -18,7 +18,7 @@ buildGoModule rec {
     sha256 = "0asd5fz2rhzkjmd8wjgmla5qmqyz4jaa6qf0n2ycia16jsck6wc2";
   };
 
-  vendorSha256 = "1pjgcx6sydfipsx8s0kl7n6r3lk61klsfrkd7cg4l934k590q2n7";
+  vendorSha256 = "0w2214fllw93xbrlxayhl014aqbjsc8zz7mpik7w5b26m60hn5kr";
 
   overrideModAttrs = (_: {
       postBuild = ''

pkgs/applications/blockchains/lnd.nix

@@ -1,24 +1,38 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, lib
+, tags ? [ "autopilotrpc" "signrpc" "walletrpc" "chainrpc" "invoicesrpc" "watchtowerrpc" ]
+}:
 
 buildGoModule rec {
   pname = "lnd";
-  version = "0.10.0-beta";
+  version = "0.10.3-beta";
 
   src = fetchFromGitHub {
     owner = "lightningnetwork";
     repo = "lnd";
     rev = "v${version}";
-    sha256 = "1amciz924s2h6qhy7w34jpv1jc25p5ayfxzvjph6hhx0bccrm88w";
+    sha256 = "129vi8z2sk4hagk7axa675nba6sbj9km88zlq8a1g8di7v2k9z6a";
   };
 
-  vendorSha256 = "1iyghg11cxvbzi0gl40fvv8pl3d3k52j179w3x5m1f09r5ji223y";
+  vendorSha256 = "0a4bk2qry0isnrvl0adwikqn6imxwzlaq5j3nglb5rmwwq2cdz0r";
 
   subPackages = ["cmd/lncli" "cmd/lnd"];
 
+  preBuild = let
+    buildVars = {
+      RawTags = lib.concatStringsSep "," tags;
+      GoVersion = "$(go version | egrep -o 'go[0-9]+[.][^ ]*')";
+    };
+    buildVarsFlags = lib.concatStringsSep " " (lib.mapAttrsToList (k: v: "-X github.com/lightningnetwork/lnd/build.${k}=${v}") buildVars);
+  in
+  lib.optionalString (tags != []) ''
+    buildFlagsArray+=("-tags=${lib.concatStringsSep " " tags}")
+    buildFlagsArray+=("-ldflags=${buildVarsFlags}")
+  '';
+
   meta = with lib; {
     description = "Lightning Network Daemon";
     homepage = "https://github.com/lightningnetwork/lnd";
     license = lib.licenses.mit;
     maintainers = with maintainers; [ cypherpunk2140 ];
   };
-}
+}

pkgs/applications/blockchains/monero/default.nix

@@ -10,13 +10,13 @@ assert stdenv.isDarwin -> IOKit != null;
 
 stdenv.mkDerivation rec {
   pname = "monero";
-  version = "0.16.0.0";
+  version = "0.16.0.1";
 
   src = fetchFromGitHub {
     owner = "monero-project";
     repo = "monero";
     rev = "v${version}";
-    sha256 = "0x74h5z0nxxxip97ibc854pqmrgd8r4d6w62m424f66i8gbzfskh";
+    sha256 = "0n2cviqm8radpynx70fc0819k1xknjc58cvb4whlc49ilyvh8ky6";
     fetchSubmodules = true;
   };
 

pkgs/applications/blockchains/wownero.nix

@@ -1,26 +1,26 @@
-{ stdenv, fetchFromGitHub, cmake, boost, miniupnpc_2, openssl, unbound
+{ stdenv, fetchgit, cmake, boost, miniupnpc_2, openssl, unbound
 , readline, libsodium, rapidjson, fetchurl
 }:
 
 with stdenv.lib;
 
 let
-  randomwowVersion = "1.1.6";
+  randomwowVersion = "1.1.7";
   randomwow = fetchurl {
     url = "https://github.com/wownero/RandomWOW/archive/${randomwowVersion}.tar.gz";
-    sha256 = "1c55y2dwrayh6k1avpchs89gq1mvy5c305h92jm2k48kzhw6a792";
+    sha256 = "1xp76zf01hnhnk6rjvqjav9n9pnvxzxlzqa5rc574d1c2qczfy3q";
   };
 in
 
 stdenv.mkDerivation rec {
   pname = "wownero";
-  version = "0.8.0.0";
+  version = "0.8.0.1";
 
-  src = fetchFromGitHub {
+  src = fetchgit {
-    owner = "wownero";
+    url = "https://git.wownero.com/wownero/wownero.git";
-    repo = "wownero";
+    rev = "v${version}";
-    rev    = "v${version}";
+    sha256 = "15443xv6q1nw4627ajk6k4ghhahvh82lb4gyb8nvq753p2v838g3";
-    sha256 = "14nggivilgzaqhjd4ng3g2p884yp2hc322hpcpwjdnz2zfc3qq6c";
+    fetchSubmodules = false;
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/editors/jetbrains/default.nix

@@ -294,12 +294,12 @@ in
 
   goland = buildGoland rec {
     name = "goland-${version}";
-    version = "2020.1.3"; /* updated by script */
+    version = "2020.1.4"; /* updated by script */
     description = "Up and Coming Go IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0pqwj4gc23gf10xqciwndimb4ml7djmx8m5rh52c07m77y4aniyn"; /* updated by script */
+      sha256 = "1wgcc1faqn0y9brxikh53s6ly7zvpdmpg7m5gvp5437isbllisbl"; /* updated by script */
     };
     wmClass = "jetbrains-goland";
     update-channel = "GoLand RELEASE";
@@ -307,12 +307,12 @@ in
 
   idea-community = buildIdea rec {
     name = "idea-community-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "07gfqyp6blbf7v8p106ngpq7c5p0llcjahi205yg2jgzkhshn7ld"; /* updated by script */
+      sha256 = "1aycsy2pg8nw5il8p2r6bhim9y47g5rfga63f0p435mpjmzpll0s"; /* updated by script */
     };
     wmClass = "jetbrains-idea-ce";
     update-channel = "IntelliJ IDEA RELEASE";
@@ -320,12 +320,12 @@ in
 
   idea-ultimate = buildIdea rec {
     name = "idea-ultimate-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
     description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
-      sha256 = "13qj8n5daz0z0pjizyfsvbbr1gxp5479ar3a68ygi0vrpmbdbssd"; /* updated by script */
+      sha256 = "188wkqcv67kizq4w6v4vg9jpr3qfgbg9x5jc77s4ki4nafkbfxas"; /* updated by script */
     };
     wmClass = "jetbrains-idea";
     update-channel = "IntelliJ IDEA RELEASE";
@@ -333,12 +333,12 @@ in
 
   mps = buildMps rec {
     name = "mps-${version}";
-    version = "2019.2";
+    version = "2020.1.2"; /* updated by script */
     description = "Create your own domain-specific language";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
-      url = "https://download.jetbrains.com/mps/2019.2/MPS-${version}.tar.gz";
+      url = "https://download.jetbrains.com/mps/2020.1/MPS-${version}.tar.gz";
-      sha256 = "0rph3bibj74ddbyrn0az1npn4san4g1alci8nlq4gaqdlcz6zx22";
+      sha256 = "0ygk31l44bxcv64h6lnqxssmx5prcb5b5xdm3qxmrv7xz1qv59c1"; /* updated by script */
     };
     wmClass = "jetbrains-mps";
     update-channel = "MPS RELEASE";
@@ -346,12 +346,12 @@ in
 
   phpstorm = buildPhpStorm rec {
     name = "phpstorm-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
     description = "Professional IDE for Web and PHP developers";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "00c8vlp125j56v9g9d4rc5g4dhgvl1bhi6qrzvpaf6x77jbq4fv4"; /* updated by script */
+      sha256 = "0cw2rx68rl6mrnizpb69ahz4hrh8blry70cv4rjnkw19d4x877m8"; /* updated by script */
     };
     wmClass = "jetbrains-phpstorm";
     update-channel = "PhpStorm RELEASE";
@@ -359,12 +359,12 @@ in
 
   pycharm-community = buildPycharm rec {
     name = "pycharm-community-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
     description = "PyCharm Community Edition";
     license = stdenv.lib.licenses.asl20;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1s04b9w7sydix1sjqzmby63nwcvzs6iw28wz7441kxgryl9qg0qw"; /* updated by script */
+      sha256 = "1290k17nihiih8ipxfqax1xlx320h1vkwbcc5hc50psvpsfgiall"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm-ce";
     update-channel = "PyCharm RELEASE";
@@ -372,12 +372,12 @@ in
 
   pycharm-professional = buildPycharm rec {
     name = "pycharm-professional-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
     description = "PyCharm Professional Edition";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1ysj00qbn5ik6i5953b9mln4g456fmn3phdln9m5jmcb0126y235"; /* updated by script */
+      sha256 = "1ag8jrfs38f0q11pyil4pvddi8lv46b0jxd3mcbmidn3p1z29f9x"; /* updated by script */
     };
     wmClass = "jetbrains-pycharm";
     update-channel = "PyCharm RELEASE";
@@ -385,12 +385,12 @@ in
 
   rider = buildRider rec {
     name = "rider-${version}";
-    version = "2020.1.3"; /* updated by script */
+    version = "2020.1.4"; /* updated by script */
     description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/rider/JetBrains.Rider-${version}.tar.gz";
-      sha256 = "1zzkd3b5j3q6jqrvibxz33a4fcm7pgqfx91bqjs615v3499ncng7"; /* updated by script */
+      sha256 = "0vicgwgsbllfw6fz4l82x4vbka3agf541576ix9akyvsskwbaxj9"; /* updated by script */
     };
     wmClass = "jetbrains-rider";
     update-channel = "Rider RELEASE";
@@ -398,12 +398,12 @@ in
 
   ruby-mine = buildRubyMine rec {
     name = "ruby-mine-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
     description = "The Most Intelligent Ruby and Rails IDE";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "1ycwml7fyhjajjfy1fhggmx0mcdcjidkxll7357rv2z51r0yhc9h"; /* updated by script */
+      sha256 = "1z6z2c31aq29hzi1cifc77zz9vnw48h2jvw4w61lvgskcnzrw9vn"; /* updated by script */
     };
     wmClass = "jetbrains-rubymine";
     update-channel = "RubyMine RELEASE";
@@ -411,12 +411,12 @@ in
 
   webstorm = buildWebStorm rec {
     name = "webstorm-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
     description = "Professional IDE for Web and JavaScript development";
     license = stdenv.lib.licenses.unfree;
     src = fetchurl {
       url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "1szgiccimfk99z9x1k99lgic6ix81fdahf1k3a88rddl8hhncjwv"; /* updated by script */
+      sha256 = "19zqac77fkw1czf86s39ggnd24r9ljr80gj422ch4fdkz4qy832q"; /* updated by script */
     };
     wmClass = "jetbrains-webstorm";
     update-channel = "WebStorm RELEASE";

pkgs/applications/graphics/darktable/default.nix

@@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
     "-DUSE_KWALLET=OFF"
   ];
 
+  # Doc has high risk of collisions
+  postInstall = "rm -r $out/share/doc";
 
   # darktable changed its rpath handling in commit
   # 83c70b876af6484506901e6b381304ae0d073d3c and as a result the

pkgs/applications/graphics/gscan2pdf/default.nix

@@ -10,11 +10,11 @@ with stdenv.lib;
 
 perlPackages.buildPerlPackage rec {
   pname = "gscan2pdf";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/gscan2pdf/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0rqx41hkppil3lp1dhkxwlhv0kwp8w8fkgzlapryq1yd9pgkx6lw";
+    sha256 = "00g2vw7lz3yb4nq358x8d3r4mf3hkrq2vw1g9lli27zdp5p6jja1";
   };
 
   nativeBuildInputs = [ wrapGAppsHook ];

pkgs/applications/kde/akonadi/0001-akonadi-paths.patch

@@ -1,27 +1,42 @@
-Index: akonadi-19.08.0/src/akonadicontrol/agentmanager.cpp
+From 90969b9b36400d47b1afe761fb8468c1acb8a04a Mon Sep 17 00:00:00 2001
-===================================================================
+From: Thomas Tuegel <ttuegel@mailbox.org>
---- akonadi-19.08.0.orig/src/akonadicontrol/agentmanager.cpp
+Date: Mon, 13 Jul 2020 11:41:19 -0500
-+++ akonadi-19.08.0/src/akonadicontrol/agentmanager.cpp
+Subject: [PATCH 1/3] akonadi paths
-@@ -78,12 +78,12 @@ AgentManager::AgentManager(bool verbose,
+
-     mStorageController = new Akonadi::ProcessControl;
+---
-     mStorageController->setShutdownTimeout(15 * 1000);   // the server needs more time for shutdown if we are using an internal mysqld
+ src/akonadicontrol/agentmanager.cpp         |  4 ++--
-     connect(mStorageController, &Akonadi::ProcessControl::unableToStart, this, &AgentManager::serverFailure);
+ src/akonadicontrol/agentprocessinstance.cpp |  2 +-
--    mStorageController->start(QStringLiteral("akonadiserver"), serviceArgs, Akonadi::ProcessControl::RestartOnCrash);
+ src/server/storage/dbconfigmysql.cpp        | 26 ++++-----------------
-+    mStorageController->start(QLatin1String(NIX_OUT "/bin/akonadiserver"), serviceArgs, Akonadi::ProcessControl::RestartOnCrash);
+ src/server/storage/dbconfigpostgresql.cpp   | 19 +++------------
- 
+ 4 files changed, 11 insertions(+), 40 deletions(-)
-     if (mAgentServerEnabled) {
+
-         mAgentServer = new Akonadi::ProcessControl;
+diff --git a/src/akonadicontrol/agentmanager.cpp b/src/akonadicontrol/agentmanager.cpp
-         connect(mAgentServer, &Akonadi::ProcessControl::unableToStart, this, &AgentManager::agentServerFailure);
+index 23b4a1f..c13b658 100644
--        mAgentServer->start(QStringLiteral("akonadi_agent_server"), serviceArgs, Akonadi::ProcessControl::RestartOnCrash);
+--- a/src/akonadicontrol/agentmanager.cpp
-+        mAgentServer->start(QLatin1String(NIX_OUT "/bin/akonadi_agent_server"), serviceArgs, Akonadi::ProcessControl::RestartOnCrash);
++++ b/src/akonadicontrol/agentmanager.cpp
+@@ -61,7 +61,7 @@ public:
+                 []() {
+                     QCoreApplication::instance()->exit(255);
+                 });
+-        start(QStringLiteral("akonadiserver"), args, RestartOnCrash);
++        start(QLatin1String(NIX_OUT "/bin/akonadiserver"), args, RestartOnCrash);
      }
- }
  
-Index: akonadi-19.08.0/src/akonadicontrol/agentprocessinstance.cpp
+     ~StorageProcessControl() override
-===================================================================
+@@ -84,7 +84,7 @@ public:
---- akonadi-19.08.0.orig/src/akonadicontrol/agentprocessinstance.cpp
+                 []() {
-+++ akonadi-19.08.0/src/akonadicontrol/agentprocessinstance.cpp
+                     qCCritical(AKONADICONTROL_LOG) << "Failed to start AgentServer!";
-@@ -62,7 +62,7 @@ bool AgentProcessInstance::start(const A
+                 });
+-        start(QStringLiteral("akonadi_agent_server"), args, RestartOnCrash);
++        start(QLatin1String(NIX_OUT "/bin/akonadi_agent_server"), args, RestartOnCrash);
+     }
+ 
+     ~AgentServerProcessControl() override
+diff --git a/src/akonadicontrol/agentprocessinstance.cpp b/src/akonadicontrol/agentprocessinstance.cpp
+index 4e58f7e..e8bb532 100644
+--- a/src/akonadicontrol/agentprocessinstance.cpp
++++ b/src/akonadicontrol/agentprocessinstance.cpp
+@@ -62,7 +62,7 @@ bool AgentProcessInstance::start(const AgentType &agentInfo)
      } else {
          Q_ASSERT(agentInfo.launchMethod == AgentType::Launcher);
          const QStringList arguments = QStringList() << executable << identifier();
@@ -30,11 +45,11 @@ Index: akonadi-19.08.0/src/akonadicontrol/agentprocessinstance.cpp
          mController->start(agentLauncherExec, arguments);
      }
      return true;
-Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
+diff --git a/src/server/storage/dbconfigmysql.cpp b/src/server/storage/dbconfigmysql.cpp
-===================================================================
+index cac40f5..527649b 100644
---- akonadi-19.08.0.orig/src/server/storage/dbconfigmysql.cpp
+--- a/src/server/storage/dbconfigmysql.cpp
-+++ akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
++++ b/src/server/storage/dbconfigmysql.cpp
-@@ -83,7 +83,6 @@ bool DbConfigMysql::init(QSettings &sett
+@@ -83,7 +83,6 @@ bool DbConfigMysql::init(QSettings &settings)
      // determine default settings depending on the driver
      QString defaultHostName;
      QString defaultOptions;
@@ -42,7 +57,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
      QString defaultCleanShutdownCommand;
  
  #ifndef Q_OS_WIN
-@@ -92,16 +91,7 @@ bool DbConfigMysql::init(QSettings &sett
+@@ -92,16 +91,7 @@ bool DbConfigMysql::init(QSettings &settings)
  #endif
  
      const bool defaultInternalServer = true;
@@ -60,7 +75,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
      if (!mysqladminPath.isEmpty()) {
  #ifndef Q_OS_WIN
          defaultCleanShutdownCommand = QStringLiteral("%1 --defaults-file=%2/mysql.conf --socket=%3/%4 shutdown")
-@@ -111,10 +101,10 @@ bool DbConfigMysql::init(QSettings &sett
+@@ -111,10 +101,10 @@ bool DbConfigMysql::init(QSettings &settings)
  #endif
      }
  
@@ -73,7 +88,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
      qCDebug(AKONADISERVER_LOG) << "Found mysqlcheck: " << mMysqlCheckPath;
  
      mInternalServer = settings.value(QStringLiteral("QMYSQL/StartServer"), defaultInternalServer).toBool();
-@@ -131,7 +121,7 @@ bool DbConfigMysql::init(QSettings &sett
+@@ -131,7 +121,7 @@ bool DbConfigMysql::init(QSettings &settings)
      mUserName = settings.value(QStringLiteral("User")).toString();
      mPassword = settings.value(QStringLiteral("Password")).toString();
      mConnectionOptions = settings.value(QStringLiteral("Options"), defaultOptions).toString();
@@ -82,7 +97,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
      mCleanServerShutdownCommand = settings.value(QStringLiteral("CleanServerShutdownCommand"), defaultCleanShutdownCommand).toString();
      settings.endGroup();
  
-@@ -141,9 +131,6 @@ bool DbConfigMysql::init(QSettings &sett
+@@ -141,9 +131,6 @@ bool DbConfigMysql::init(QSettings &settings)
          // intentionally not namespaced as we are the only one in this db instance when using internal mode
          mDatabaseName = QStringLiteral("akonadi");
      }
@@ -92,7 +107,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
  
      qCDebug(AKONADISERVER_LOG) << "Using mysqld:" << mMysqldPath;
  
-@@ -152,9 +139,6 @@ bool DbConfigMysql::init(QSettings &sett
+@@ -152,9 +139,6 @@ bool DbConfigMysql::init(QSettings &settings)
      settings.setValue(QStringLiteral("Name"), mDatabaseName);
      settings.setValue(QStringLiteral("Host"), mHostName);
      settings.setValue(QStringLiteral("Options"), mConnectionOptions);
@@ -102,7 +117,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
      settings.setValue(QStringLiteral("StartServer"), mInternalServer);
      settings.endGroup();
      settings.sync();
-@@ -209,7 +193,7 @@ bool DbConfigMysql::startInternalServer(
+@@ -209,7 +193,7 @@ bool DbConfigMysql::startInternalServer()
  #endif
  
      // generate config file
@@ -111,11 +126,11 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
      const QString localConfig  = StandardDirs::locateResourceFile("config", QStringLiteral("mysql-local.conf"));
      const QString actualConfig = StandardDirs::saveDir("data") + QLatin1String("/mysql.conf");
      if (globalConfig.isEmpty()) {
-Index: akonadi-19.08.0/src/server/storage/dbconfigpostgresql.cpp
+diff --git a/src/server/storage/dbconfigpostgresql.cpp b/src/server/storage/dbconfigpostgresql.cpp
-===================================================================
+index 09cdbd5..1c8996b 100644
---- akonadi-19.08.0.orig/src/server/storage/dbconfigpostgresql.cpp
+--- a/src/server/storage/dbconfigpostgresql.cpp
-+++ akonadi-19.08.0/src/server/storage/dbconfigpostgresql.cpp
++++ b/src/server/storage/dbconfigpostgresql.cpp
-@@ -140,9 +140,7 @@ bool DbConfigPostgresql::init(QSettings
+@@ -141,9 +141,7 @@ bool DbConfigPostgresql::init(QSettings &settings)
      // determine default settings depending on the driver
      QString defaultHostName;
      QString defaultOptions;
@@ -125,7 +140,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigpostgresql.cpp
      QString defaultPgData;
  
  #ifndef Q_WS_WIN // We assume that PostgreSQL is running as service on Windows
-@@ -153,12 +151,8 @@ bool DbConfigPostgresql::init(QSettings
+@@ -154,12 +152,8 @@ bool DbConfigPostgresql::init(QSettings &settings)
  
      mInternalServer = settings.value(QStringLiteral("QPSQL/StartServer"), defaultInternalServer).toBool();
      if (mInternalServer) {
@@ -139,7 +154,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigpostgresql.cpp
          defaultPgData = StandardDirs::saveDir("data", QStringLiteral("db_data"));
      }
  
-@@ -177,20 +171,14 @@ bool DbConfigPostgresql::init(QSettings
+@@ -178,20 +172,14 @@ bool DbConfigPostgresql::init(QSettings &settings)
      mUserName = settings.value(QStringLiteral("User")).toString();
      mPassword = settings.value(QStringLiteral("Password")).toString();
      mConnectionOptions = settings.value(QStringLiteral("Options"), defaultOptions).toString();
@@ -162,7 +177,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigpostgresql.cpp
      qCDebug(AKONADISERVER_LOG) << "Found pg_upgrade:" << mPgUpgradePath;
      mPgData = settings.value(QStringLiteral("PgData"), defaultPgData).toString();
      if (mPgData.isEmpty()) {
-@@ -206,7 +194,6 @@ bool DbConfigPostgresql::init(QSettings
+@@ -207,7 +195,6 @@ bool DbConfigPostgresql::init(QSettings &settings)
          settings.setValue(QStringLiteral("Port"), mHostPort);
      }
      settings.setValue(QStringLiteral("Options"), mConnectionOptions);
@@ -170,3 +185,6 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigpostgresql.cpp
      settings.setValue(QStringLiteral("InitDbPath"), mInitDbPath);
      settings.setValue(QStringLiteral("StartServer"), mInternalServer);
      settings.endGroup();
+-- 
+2.25.4
+

pkgs/applications/kde/akonadi/0002-akonadi-timestamps.patch

@@ -0,0 +1,26 @@
+From b8c6a2a017321649db8fec553a644b8da2300514 Mon Sep 17 00:00:00 2001
+From: Thomas Tuegel <ttuegel@mailbox.org>
+Date: Mon, 13 Jul 2020 11:41:35 -0500
+Subject: [PATCH 2/3] akonadi timestamps
+
+---
+ src/server/storage/dbconfigmysql.cpp | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/server/storage/dbconfigmysql.cpp b/src/server/storage/dbconfigmysql.cpp
+index 527649b..08c3dd4 100644
+--- a/src/server/storage/dbconfigmysql.cpp
++++ b/src/server/storage/dbconfigmysql.cpp
+@@ -235,8 +235,7 @@ bool DbConfigMysql::startInternalServer()
+     bool confUpdate = false;
+     QFile actualFile(actualConfig);
+     // update conf only if either global (or local) is newer than actual
+-    if ((QFileInfo(globalConfig).lastModified() > QFileInfo(actualFile).lastModified()) ||
+-            (QFileInfo(localConfig).lastModified()  > QFileInfo(actualFile).lastModified())) {
++    if (true) {
+         QFile globalFile(globalConfig);
+         QFile localFile(localConfig);
+         if (globalFile.open(QFile::ReadOnly) && actualFile.open(QFile::WriteOnly)) {
+-- 
+2.25.4
+

pkgs/applications/kde/akonadi/0003-akonadi-revert-make-relocatable.patch

@@ -1,19 +1,18 @@
-From bc018b4bc816a3b51deb9739bedbf8a2268d0684 Mon Sep 17 00:00:00 2001
+From 7afe018382cf68b477b35f87b666424d62d19ef4 Mon Sep 17 00:00:00 2001
-From: gnidorah <gnidorah@users.noreply.github.com>
+From: Thomas Tuegel <ttuegel@mailbox.org>
-Date: Fri, 22 Dec 2017 17:36:03 +0300
+Date: Mon, 13 Jul 2020 11:41:55 -0500
-Subject: [PATCH] Revert "Make Akonadi installation properly relocatable"
+Subject: [PATCH 3/3] akonadi revert make relocatable
 
-This reverts commit b2bb55f13f2ac783f89cc414de8c39f62fa2096a.
 ---
  CMakeLists.txt            | 3 ---
  KF5AkonadiConfig.cmake.in | 6 +++---
  2 files changed, 3 insertions(+), 6 deletions(-)
 
-Index: akonadi-19.08.0/CMakeLists.txt
+diff --git a/CMakeLists.txt b/CMakeLists.txt
-===================================================================
+index d927471..83a74c0 100644
---- akonadi-19.08.0.orig/CMakeLists.txt
+--- a/CMakeLists.txt
-+++ akonadi-19.08.0/CMakeLists.txt
++++ b/CMakeLists.txt
-@@ -306,9 +306,6 @@ configure_package_config_file(
+@@ -330,9 +330,6 @@ configure_package_config_file(
      "${CMAKE_CURRENT_SOURCE_DIR}/KF5AkonadiConfig.cmake.in"
      "${CMAKE_CURRENT_BINARY_DIR}/KF5AkonadiConfig.cmake"
      INSTALL_DESTINATION ${CMAKECONFIG_INSTALL_DIR}
@@ -23,11 +22,11 @@ Index: akonadi-19.08.0/CMakeLists.txt
  )
  
  install(FILES
-Index: akonadi-19.08.0/KF5AkonadiConfig.cmake.in
+diff --git a/KF5AkonadiConfig.cmake.in b/KF5AkonadiConfig.cmake.in
-===================================================================
+index 421e1df..e3abf27 100644
---- akonadi-19.08.0.orig/KF5AkonadiConfig.cmake.in
+--- a/KF5AkonadiConfig.cmake.in
-+++ akonadi-19.08.0/KF5AkonadiConfig.cmake.in
++++ b/KF5AkonadiConfig.cmake.in
-@@ -26,8 +26,8 @@ if(BUILD_TESTING)
+@@ -24,8 +24,8 @@ if(BUILD_TESTING)
      find_dependency(Qt5Test "@QT_REQUIRED_VERSION@")
  endif()
  
@@ -38,7 +37,7 @@ Index: akonadi-19.08.0/KF5AkonadiConfig.cmake.in
  
  find_dependency(Boost "@Boost_MINIMUM_VERSION@")
  
-@@ -35,7 +35,7 @@ include(${CMAKE_CURRENT_LIST_DIR}/KF5Ako
+@@ -33,7 +33,7 @@ include(${CMAKE_CURRENT_LIST_DIR}/KF5AkonadiTargets.cmake)
  include(${CMAKE_CURRENT_LIST_DIR}/KF5AkonadiMacros.cmake)
  
  # The directory where akonadi-xml.xsd and kcfg2dbus.xsl are installed
@@ -47,3 +46,6 @@ Index: akonadi-19.08.0/KF5AkonadiConfig.cmake.in
  
  ####################################################################################
  # CMAKE_AUTOMOC
+-- 
+2.25.4
+

pkgs/applications/kde/akonadi/akonadi-timestamps.patch

@@ -1,14 +0,0 @@
-Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
-===================================================================
---- akonadi-19.08.0.orig/src/server/storage/dbconfigmysql.cpp
-+++ akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
-@@ -235,8 +235,7 @@ bool DbConfigMysql::startInternalServer(
-     bool confUpdate = false;
-     QFile actualFile(actualConfig);
-     // update conf only if either global (or local) is newer than actual
--    if ((QFileInfo(globalConfig).lastModified() > QFileInfo(actualFile).lastModified()) ||
--            (QFileInfo(localConfig).lastModified()  > QFileInfo(actualFile).lastModified())) {
-+    if (true) {
-         QFile globalFile(globalConfig);
-         QFile localFile(localConfig);
-         if (globalFile.open(QFile::ReadOnly) && actualFile.open(QFile::WriteOnly)) {

pkgs/applications/kde/akonadi/default.nix

@@ -11,7 +11,11 @@ mkDerivation {
     license = [ lib.licenses.lgpl21 ];
     maintainers = kdepimTeam;
   };
-  patches = copyPathsToStore (lib.readPathsFromFile ./. ./series);
+  patches = [
+    ./0001-akonadi-paths.patch
+    ./0002-akonadi-timestamps.patch
+    ./0003-akonadi-revert-make-relocatable.patch
+  ];
   nativeBuildInputs = [ extra-cmake-modules shared-mime-info ];
   buildInputs = [
     kcompletion kconfigwidgets kcrash kdbusaddons kdesignerplugin ki18n

pkgs/applications/kde/akonadi/series

@@ -1,3 +0,0 @@
-akonadi-paths.patch
-akonadi-timestamps.patch
-0001-Revert-Make-Akonadi-installation-properly-relocatabl.patch

pkgs/applications/kde/bovo.nix

@@ -0,0 +1,28 @@
+{ mkDerivation, lib
+, libkdegames, extra-cmake-modules
+, kdeclarative, knewstuff
+}:
+
+mkDerivation {
+  name = "bovo";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.bovo";
+    description = "Five in a row application";
+    longDescription = ''
+      Bovo is a Gomoku (from Japanese 五目並べ - lit. "five points") like game for two players,
+      where the opponents alternate in placing their respective pictogram on the game board.
+      (Also known as: Connect Five, Five in a row, X and O, Naughts and Crosses)
+    '';
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    kdeclarative
+    knewstuff
+    libkdegames
+  ];
+}

pkgs/applications/kde/default.nix

@@ -74,6 +74,7 @@ let
       akregator = callPackage ./akregator.nix {};
       ark = callPackage ./ark {};
       baloo-widgets = callPackage ./baloo-widgets.nix {};
+      bovo = callPackage ./bovo.nix {};
       calendarsupport = callPackage ./calendarsupport.nix {};
       dolphin = callPackage ./dolphin.nix {};
       dolphin-plugins = callPackage ./dolphin-plugins.nix {};
@@ -174,6 +175,7 @@ let
       messagelib = callPackage ./messagelib.nix {};
       minuet = callPackage ./minuet.nix {};
       okular = callPackage ./okular.nix {};
+      picmi = callPackage ./picmi.nix {};
       pimcommon = callPackage ./pimcommon.nix {};
       pim-data-exporter = callPackage ./pim-data-exporter.nix {};
       pim-sieve-editor = callPackage ./pim-sieve-editor.nix {};

pkgs/applications/kde/fetch.sh

@@ -1 +1 @@
-WGET_ARGS=( http://download.kde.org/stable/release-service/19.12.3/src )
+WGET_ARGS=(http://download.kde.org/stable/release-service/20.04.1/src)

pkgs/applications/kde/kdegraphics-thumbnailers.nix

@@ -9,14 +9,6 @@ mkDerivation {
     license = [ lib.licenses.lgpl21 ];
     maintainers = [ lib.maintainers.ttuegel ];
   };
-  patches = [
-    # Fix a bug with thumbnail.so processes hanging:
-    # https://bugs.kde.org/show_bug.cgi?id=404652
-    (fetchpatch {
-      url = "https://github.com/KDE/kdegraphics-thumbnailers/commit/3e2ea6e924d0e2a2cdd9bb435b06965117d6d34c.patch";
-      sha256 = "0fq85zhymmrq8vl0y6vgh87qf4c6fhcq704p4kpkaq7y0isxj4h1";
-    })
-  ];
   nativeBuildInputs = [ extra-cmake-modules ];
   buildInputs = [ karchive kio libkexiv2 libkdcraw ];
 }

pkgs/applications/kde/kdenlive.nix

@@ -25,7 +25,7 @@
 , frei0r
 , phonon-backend-gstreamer
 , qtdeclarative
-, qtquickcontrols
+, qtquickcontrols2
 , qtscript
 , qtwebkit
 , rttr
@@ -60,7 +60,7 @@ mkDerivation {
     mlt
     phonon-backend-gstreamer
     qtdeclarative
-    qtquickcontrols
+    qtquickcontrols2
     qtscript
     qtwebkit
     shared-mime-info

pkgs/applications/kde/kio-extras.nix

@@ -1,9 +1,9 @@
 {
   mkDerivation, lib, extra-cmake-modules, kdoctools, shared-mime-info,
   exiv2, kactivities, karchive, kbookmarks, kconfig, kconfigwidgets,
-  kcoreaddons, kdbusaddons, kguiaddons, kdnssd, kiconthemes, ki18n, kio, khtml,
+  kcoreaddons, kdbusaddons, kdsoap, kguiaddons, kdnssd, kiconthemes, ki18n, kio,
-  kdelibs4support, kpty, syntax-highlighting, libmtp, libssh, openexr, ilmbase,
+  khtml, kdelibs4support, kpty, syntax-highlighting, libmtp, libssh, openexr,
-  openslp, phonon, qtsvg, samba, solid, gperf
+  ilmbase, openslp, phonon, qtsvg, samba, solid, gperf
 }:
 
 mkDerivation {
@@ -15,9 +15,9 @@ mkDerivation {
   nativeBuildInputs = [ extra-cmake-modules kdoctools shared-mime-info ];
   buildInputs = [
     exiv2 kactivities karchive kbookmarks kconfig kconfigwidgets kcoreaddons
-    kdbusaddons kguiaddons kdnssd kiconthemes ki18n kio khtml kdelibs4support
+    kdbusaddons kdsoap kguiaddons kdnssd kiconthemes ki18n kio khtml
-    kpty syntax-highlighting libmtp libssh openexr openslp phonon qtsvg samba
+    kdelibs4support kpty syntax-highlighting libmtp libssh openexr openslp
-    solid gperf
+    phonon qtsvg samba solid gperf
   ];
   CXXFLAGS = [ "-I${ilmbase.dev}/include/OpenEXR" ];
 }

pkgs/applications/kde/kmail.nix

@@ -7,7 +7,7 @@
   kmail-account-wizard, kmailtransport, knotifications, knotifyconfig,
   kontactinterface, kparts, kpty, kservice, ktextwidgets, ktnef, kwallet,
   kwidgetsaddons, kwindowsystem, kxmlgui, libgravatar, libksieve, mailcommon,
-  messagelib, pim-sieve-editor, qtscript, qtwebengine, akonadi
+  messagelib, pim-sieve-editor, qtscript, qtwebengine, akonadi, kdepim-addons
 }:
 
 mkDerivation {
@@ -24,6 +24,7 @@ mkDerivation {
     knotifications knotifyconfig kontactinterface kparts kpty kservice
     ktextwidgets ktnef kwidgetsaddons kwindowsystem kxmlgui libgravatar
     libksieve mailcommon messagelib pim-sieve-editor qtscript qtwebengine
+    kdepim-addons
   ];
   propagatedUserEnvPkgs = [ kdepim-runtime kwallet akonadi ];
   patches = [ ./kmail.patch ];

pkgs/applications/kde/messagelib.nix

@@ -5,7 +5,7 @@
   grantleetheme, karchive, kcodecs, kconfig, kconfigwidgets, kcontacts,
   kdepim-apps-libs, kiconthemes, kidentitymanagement, kio, kjobwidgets, kldap,
   kmailtransport, kmbox, kmime, kwindowsystem, libgravatar, libkdepim, libkleo,
-  pimcommon, qtwebengine, qtwebkit, syntax-highlighting
+  pimcommon, qca-qt5, qtwebengine, qtwebkit, syntax-highlighting
 }:
 
 mkDerivation {
@@ -18,7 +18,7 @@ mkDerivation {
   buildInputs = [
     akonadi-notes akonadi-search gpgme grantlee grantleetheme karchive kcodecs
     kconfig kconfigwidgets kdepim-apps-libs kiconthemes kio kjobwidgets kldap
-    kmailtransport kmbox kmime kwindowsystem libgravatar libkdepim qtwebkit
+    kmailtransport kmbox kmime kwindowsystem libgravatar libkdepim qca-qt5 qtwebkit
     syntax-highlighting
   ];
   propagatedBuildInputs = [

pkgs/applications/kde/picmi.nix

@@ -0,0 +1,25 @@
+{ mkDerivation, lib
+, libkdegames, extra-cmake-modules
+, kdeclarative, knewstuff
+}:
+
+mkDerivation {
+  name = "picmi";
+  meta = with lib; {
+    description = "Nonogram game";
+    longDescription = ''The goal is to reveal the hidden pattern in the board by coloring or
+      leaving blank the cells in a grid according to numbers given at the side of the grid.
+      '';
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    kdeclarative
+    knewstuff
+    libkdegames
+  ];
+}

pkgs/applications/kde/spectacle.nix

@@ -17,8 +17,8 @@ mkDerivation {
     knewstuff kwayland
   ];
   postPatch = ''
-    substituteInPlace desktop/org.kde.spectacle.desktop \
+    substituteInPlace desktop/org.kde.spectacle.desktop.cmake \
-      --replace "Exec=qdbus" "Exec=${lib.getBin qttools}/bin/qdbus"
+      --replace "Exec=@QtBinariesDir@/qdbus" "Exec=${lib.getBin qttools}/bin/qdbus"
   '';
   propagatedUserEnvPkgs = [ kipi-plugins libkipi ];
 }

pkgs/applications/misc/birdtray/default.nix

@@ -7,6 +7,7 @@
   , qtbase
   , qttools
   , qtx11extras
+  , qttranslations
 }:
 
 mkDerivation rec {
@@ -20,11 +21,21 @@ mkDerivation rec {
     sha256 = "15l8drdmamq1dpqpj0h9ajj2r5vcs23cx421drvhfgs6bqlzd1hl";
   };
 
+  patches = [
+    # See https://github.com/NixOS/nixpkgs/issues/86054
+    ./fix-qttranslations-path.diff
+  ];
+
   nativeBuildInputs = [ cmake pkgconfig ];
   buildInputs = [
     qtbase qttools qtx11extras
   ];
 
+  postPatch = ''
+    substituteInPlace src/birdtrayapp.cpp \
+      --subst-var-by qttranslations ${qttranslations}
+  '';
+
   meta = with lib; {
     description = "Mail system tray notification icon for Thunderbird";
     homepage = "https://github.com/gyunaev/birdtray";

pkgs/applications/misc/birdtray/fix-qttranslations-path.diff

@@ -0,0 +1,13 @@
+diff --git a/src/birdtrayapp.cpp b/src/birdtrayapp.cpp
+index 847b4d3..3a3709a 100644
+--- a/src/birdtrayapp.cpp
++++ b/src/birdtrayapp.cpp
+@@ -130,7 +130,7 @@ bool BirdtrayApp::loadTranslations() {
+             [](QString path) { return path.append("/translations"); });
+     QLocale locale = QLocale::system();
+     bool success = loadTranslation(
+-            qtTranslator, locale, "qt", {QLibraryInfo::location(QLibraryInfo::TranslationsPath)});
++            qtTranslator, locale, "qt", {QLatin1String("@qttranslations@/translations")});
+     success &= loadTranslation(dynamicTranslator, locale, "dynamic", locations);
+     success &= loadTranslation(mainTranslator, locale, "main", locations);
+     return success;

pkgs/applications/misc/font-manager/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "font-manager";
-  version = "0.7.7";
+  version = "0.7.8";
 
   src = fetchFromGitHub {
     owner = "FontManager";
     repo = "master";
     rev = version;
-    sha256 = "1bzqvspplp1zj0n0869jqbc60wgbjhf0vdrn5bj8dfawxynh8s5f";
+    sha256 = "0s1l30y55l45rrqd9lygvp2gzrqw25rmjgnnja6s5rzs79gc668c";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/lyx/default.nix

@@ -3,12 +3,12 @@
 }:
 
 mkDerivation rec {
-  version = "2.3.5.1";
+  version = "2.3.5.2";
   pname = "lyx";
 
   src = fetchurl {
     url = "ftp://ftp.lyx.org/pub/lyx/stable/2.3.x/${pname}-${version}.tar.xz";
-    sha256 = "0mv32s26igm0pd8vs7d2mk1240dpr83y0a2wyh3xz6b67ph0w157";
+    sha256 = "1pwdh0ljd7lm5a83vsqmp4695irhig07wxa90jc23ng5gap589na";
   };
 
   # LaTeX is used from $PATH, as people often want to have it with extra pkgs

pkgs/applications/misc/masterpdfeditor/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "masterpdfeditor";
-  version = "5.4.38";
+  version = "5.6.09";
 
   src = fetchurl {
     url = "https://code-industry.net/public/master-pdf-editor-${version}-qt5.amd64.tar.gz";
-    sha256 = "0fidy8gd4mqvyfgmrwdiz8z53dyzihqqhgfrffj0z0idm2zi4mcq";
+    sha256 = "0v9j6fwr0xl03kr77vf4wdb06zlplmn4mr3jyzxhvs8a77scmfzb";
   };
 
   nativeBuildInputs = [ autoPatchelfHook wrapQtAppsHook ];

pkgs/applications/misc/nnn/default.nix

@@ -4,13 +4,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "nnn";
-  version = "3.2";
+  version = "3.3";
 
   src = fetchFromGitHub {
     owner = "jarun";
     repo = pname;
     rev = "v${version}";
-    sha256 = "13p3379c26l57121ymx0kw7afh51zv614p57di311d2a41jaz5cw";
+    sha256 = "1dxa5blpdf0s03znhnr23zzpsz8yzqpnwknycz42h1w9g9s9jz1v";
   };
 
   configFile = optionalString (conf != null) (builtins.toFile "nnn.h" conf);

pkgs/applications/misc/tipp10/default.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "tipp10";
-  version = "3.1.0";
+  version = "3.2.0";
 
   src = fetchFromGitLab {
-    owner = "a_a";
+    owner = "tipp10";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1mksga1zyqz1y2s524nkw86irg36zpjwz7ff87n2ygrlysczvnx1";
+    sha256 = "0fav5jlw6lw78iqrj7a65b8vd50hhyyaqyzmfrvyxirpsqhjk1v7";
   };
 
   nativeBuildInputs = [ cmake qttools ];

pkgs/applications/misc/urlscan/default.nix

@@ -2,13 +2,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "urlscan";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "firecat53";
     repo = pname;
     rev = version;
-    sha256 = "11wkwjqsq848ks6m2jqsb8h0xnz75fb60bm0c4jkxys9wzy4chg5";
+    sha256 = "16g7dzvjcfhaz52wbmcapamy55l7vfhgizqy3m8dv9gkmy8vap89";
   };
 
   propagatedBuildInputs = [ python3Packages.urwid ];

pkgs/applications/misc/wofi/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchhg, fetchpatch, pkg-config, meson, ninja, wayland, gtk3, wrapGAppsHook }:
+{ stdenv, lib, fetchhg, fetchpatch, pkg-config, meson, ninja, wayland, gtk3, wrapGAppsHook, installShellFiles }:
 
 stdenv.mkDerivation rec {
   pname = "wofi";
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     sha256 = "086j5wshawjbwdmmmldivfagc2rr7g5a2gk11l0snqqslm294xsn";
   };
 
-  nativeBuildInputs = [ pkg-config meson ninja wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config meson ninja wrapGAppsHook installShellFiles ];
   buildInputs = [ wayland gtk3 ];
 
   # Fixes icon bug on NixOS.
@@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  postInstall = ''
+    installManPage man/wofi*
+  '';
+
   meta = with lib; {
     description = "A launcher/menu program for wlroots based wayland compositors such as sway";
     homepage = "https://hg.sr.ht/~scoopta/wofi";

pkgs/applications/misc/wtf/default.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "wtf";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "wtfutil";
     repo = pname;
     rev = "v${version}";
-    sha256 = "11vy39zygk1gxb1nc1zmxlgs6fn7yq68090fwm2jar0lsxx8a83i";
+    sha256 = "07ngk83p753w9qxm8bvw6n5vk0zldn14yv08d900sxny8cg2h0rb";
    };
 
-  vendorSha256 = "0qfb352gmsmy5glrsjwc3w57di5k2kjdsyfqn4xf7p4v12yg88va";
+  vendorSha256 = "09iy148pnbdrzjj2j50lbd8s9mkv7vggrx77mj88p1gnqclz3lip";
 
   buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];
 

pkgs/applications/networking/browsers/firefox-bin/default.nix

@@ -47,6 +47,7 @@
 , gnupg
 , ffmpeg_3
 , runtimeShell
+, mesa # firefox wants gbm for drm+dmabuf
 , systemLocale ? config.i18n.defaultLocale or "en-US"
 }:
 
@@ -84,7 +85,7 @@ in
 stdenv.mkDerivation {
   inherit name;
 
-  src = fetchurl { inherit (source) url sha512; };
+  src = fetchurl { inherit (source) url sha256; };
 
   phases = [ "unpackPhase" "patchPhase" "installPhase" "fixupPhase" ];
 
@@ -106,6 +107,7 @@ stdenv.mkDerivation {
       gtk2
       gtk3
       kerberos
+      mesa
       libX11
       libXScrnSaver
       libXcomposite

pkgs/applications/networking/browsers/firefox-bin/update.nix

@@ -47,12 +47,13 @@ in writeScript "update-${name}" ''
            grep -e "${if isBeta then "b" else ""}\([[:digit:]]\|[[:digit:]][[:digit:]]\)$" | ${if isBeta then "" else "grep -v \"b\" |"} \
            tail -1`
 
-  curl --silent -o $HOME/shasums "$url$version/SHA512SUMS"
+  curl --silent -o $HOME/shasums "$url$version/SHA256SUMS"
-  curl --silent -o $HOME/shasums.asc "$url$version/SHA512SUMS.asc"
+  curl --silent -o $HOME/shasums.asc "$url$version/SHA256SUMS.asc"
   gpgv --keyring=$GNUPGHOME/pubring.kbx $HOME/shasums.asc $HOME/shasums
 
-  # this is a list of sha512 and tarballs for both arches
+  # this is a list of sha256 and tarballs for both arches
-  shasums=`cat $HOME/shasums`
+  # Upstream files contains python repr strings like b'somehash', hence the sed dance
+  shasums=`cat $HOME/shasums | sed -E s/"b'([a-f0-9]{64})'?(.*)"/'\1\2'/`
 
   cat > $tmpfile <<EOF
   {
@@ -74,7 +75,7 @@ in writeScript "update-${name}" ''
       { url = "$url$version/`echo $line | cut -d":" -f3`";
         locale = "`echo $line | cut -d":" -f3 | sed "s/$arch\///" | sed "s/\/.*//"`";
         arch = "$arch";
-        sha512 = "`echo $line | cut -d":" -f1`";
+        sha256 = "`echo $line | cut -d":" -f1`";
       }
   EOF
     done

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -54,23 +54,4 @@ rec {
       versionKey = "ffversion";
     };
   };
-} // lib.optionalAttrs (config.allowAliases or true) {
-  #### ALIASES
-  #### remove after 20.03 branchoff
-
-  firefox-esr-52 = throw ''
-    firefoxPackages.firefox-esr-52 was removed as it's an unsupported ESR with
-    open security issues. If you need it because you need to run some plugins
-    not having been ported to WebExtensions API, import it from an older
-    nixpkgs checkout still containing it.
-  '';
-  firefox-esr-60 = throw "firefoxPackages.firefox-esr-60 was removed as it's an unsupported ESR with open security issues.";
-
-  icecat = throw "firefoxPackages.icecat was removed as even its latest upstream version is based on an unsupported ESR release with open security issues.";
-  icecat-52 = throw "firefoxPackages.icecat was removed as even its latest upstream version is based on an unsupported ESR release with open security issues.";
-
-  tor-browser-7-5 = throw "firefoxPackages.tor-browser-7-5 was removed because it was out of date and inadequately maintained. Please use tor-browser-bundle-bin instead. See #77452.";
-  tor-browser-8-5 = throw "firefoxPackages.tor-browser-8-5 was removed because it was out of date and inadequately maintained. Please use tor-browser-bundle-bin instead. See #77452.";
-  tor-browser = throw "firefoxPackages.tor-browser was removed because it was out of date and inadequately maintained. Please use tor-browser-bundle-bin instead. See #77452.";
-
 }

pkgs/applications/networking/browsers/firefox/wrapper.nix

@@ -10,6 +10,7 @@
 , udev
 , kerberos
 , libva
+, mesa # firefox wants gbm for drm+dmabuf
 }:
 
 ## configurability of the wrapper itself
@@ -26,11 +27,12 @@ let
     , nameSuffix ? ""
     , icon ? browserName
     , extraNativeMessagingHosts ? []
-    , gdkWayland ? false
+    , forceWayland ? false
+    , useGlvnd ? true
     , cfg ? config.${browserName} or {}
     }:
 
-    assert gdkWayland -> (browser ? gtk3); # Can only use the wayland backend if gtk3 is being used
+    assert forceWayland -> (browser ? gtk3); # Can only use the wayland backend if gtk3 is being used
 
     let
       enableAdobeFlash = cfg.enableAdobeFlash or false;
@@ -65,10 +67,10 @@ let
           ++ lib.optional (cfg.enableFXCastBridge or false) fx_cast_bridge
           ++ extraNativeMessagingHosts
         );
-      libs =   lib.optionals stdenv.isLinux [ udev libva ]
+      libs =   lib.optionals stdenv.isLinux [ udev libva mesa ]
             ++ lib.optional ffmpegSupport ffmpeg
             ++ lib.optional gssSupport kerberos
-            ++ lib.optional gdkWayland libglvnd
+            ++ lib.optional useGlvnd libglvnd
             ++ lib.optionals (cfg.enableQuakeLive or false)
             (with xorg; [ stdenv.cc libX11 libXxf86dga libXxf86vm libXext libXt alsaLib zlib ])
             ++ lib.optional (enableAdobeFlash && (cfg.enableAdobeFlashDRM or false)) hal-flash
@@ -83,7 +85,7 @@ let
         exec = "${browserName}${nameSuffix} %U";
         inherit icon;
         comment = "";
-        desktopName = "${desktopName}${nameSuffix}${lib.optionalString gdkWayland " (Wayland)"}";
+        desktopName = "${desktopName}${nameSuffix}${lib.optionalString forceWayland " (Wayland)"}";
         genericName = "Web Browser";
         categories = "Network;WebBrowser;";
         mimeType = stdenv.lib.concatStringsSep ";" [
@@ -124,8 +126,8 @@ let
             --set SNAP_NAME "firefox" \
             --set MOZ_LEGACY_PROFILES 1 \
             --set MOZ_ALLOW_DOWNGRADE 1 \
-            ${lib.optionalString gdkWayland ''
+            ${lib.optionalString forceWayland ''
-              --set GDK_BACKEND "wayland" \
+              --set MOZ_ENABLE_WAYLAND "1" \
             ''}${lib.optionalString (browser ? gtk3)
                 ''--prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
                   --suffix XDG_DATA_DIRS : '${gnome3.adwaita-icon-theme}/share'

pkgs/applications/networking/cluster/docker-machine/hyperkit.nix

@@ -1,12 +1,12 @@
 { lib, buildGoModule, minikube }:
 
 buildGoModule rec {
-  inherit (minikube) version src nativeBuildInputs buildInputs vendorSha256 commit;
+  inherit (minikube) version src nativeBuildInputs buildInputs vendorSha256;
 
   pname = "docker-machine-hyperkit";
 
   buildPhase = ''
-    make docker-machine-driver-hyperkit COMMIT=${commit}
+    make docker-machine-driver-hyperkit COMMIT=${src.rev}
   '';
 
   installPhase = ''

pkgs/applications/networking/cluster/docker-machine/kvm2.nix

@@ -1,7 +1,7 @@
 { lib, buildGoModule, minikube }:
 
 buildGoModule rec {
-  inherit (minikube) version src nativeBuildInputs buildInputs vendorSha256 commit;
+  inherit (minikube) version src nativeBuildInputs buildInputs vendorSha256;
 
   pname = "docker-machine-kvm2";
 
@@ -10,7 +10,7 @@ buildGoModule rec {
   '';
 
   buildPhase = ''
-    make docker-machine-driver-kvm2 COMMIT=${commit}
+    make docker-machine-driver-kvm2 COMMIT=${src.rev}
   '';
 
   installPhase = ''

pkgs/applications/networking/cluster/fluxctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fluxctl";
-  version = "1.19.0";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = "flux";
     rev = version;
-    sha256 = "1w6ndp0nrpps6pkxnq38hikbnzwahi6j9gn8l0bxd0qkf7cjc5w0";
+    sha256 = "0bfib5pg2cbip6fw45slb0h3a7qpikxsfpclzr86bcnjq60pshl1";
   };
 
-  vendorSha256 = "0w5l1lkzx4frllflkbilj8qqwf54wkz7hin7q8xn1vflkv3lxcnp";
+  vendorSha256 = "0a5sv11pb2i6r0ffwaiqdhc0m7gz679yfmqw6ix9imk4ybhf4jp9";
 
   subPackages = [ "cmd/fluxctl" ];
 

pkgs/applications/networking/cluster/minikube/default.nix

@@ -11,18 +11,15 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.11.0";
+  version = "1.12.0";
 
-  # for -ldflags
+  vendorSha256 = "0wcm7kw5z7d0ch59nyx5xlv5ci7jrwnzspmsh1yb76318cx2aghi";
-  commit = "57e2f55f47effe9ce396cea42a1e0eb4f611ebbd";
-
-  vendorSha256 = "1l9dxn7yy21x4b3cg6l5a08wx2ng8qf531ilg8yf1rznwfwjajrv";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "0y761svwyrpc4ywdd4vr9hxkg6593wg4wwqzn8n86g0zcz6qg11d";
+    sha256 = "0bvdyfx5vjcgnkqd23rpbbhxf1zigpzxlqpay2sb6dpldsj0nhdk";
   };
 
   nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];
@@ -30,7 +27,7 @@ buildGoModule rec {
   buildInputs = if stdenv.isDarwin then [ vmnet ] else if stdenv.isLinux then [ libvirt ] else null;
 
   buildPhase = ''
-    make COMMIT=${commit}
+    make COMMIT=${src.rev}
   '';
 
   installPhase = ''
@@ -40,7 +37,7 @@ buildGoModule rec {
     export MINIKUBE_WANTUPDATENOTIFICATION=false
     export MINIKUBE_WANTKUBECTLDOWNLOADMSG=false
 
-    for shell in bash zsh; do
+    for shell in bash zsh fish; do
       $out/bin/minikube completion $shell > minikube.$shell
       installShellCompletion minikube.$shell
     done

pkgs/applications/networking/cluster/terraform-providers/default.nix

@@ -144,6 +144,7 @@ let
     elasticsearch = callPackage ./elasticsearch {};
     libvirt = callPackage ./libvirt {};
     lxd = callPackage ./lxd {};
+    shell = callPackage ./shell {};
     vpsadmin = callPackage ./vpsadmin {};
   };
 in

pkgs/applications/networking/cluster/terraform-providers/shell/default.nix

@@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, buildGoModule }:
+buildGoModule rec {
+  pname = "terraform-provider-shell";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "scottwinkler";
+    repo   = pname;
+    rev    = "v${version}";
+    sha256 = "0jxb30vw93ibnwz8nfqapac7p9r2famzvsf2h4nfbmhkm6mpan4l";
+  };
+
+  vendorSha256 = "1p2ja6cw3dl7mx41svri6frjpgb9pxsrl7sq0rk1d3sviw0f88sg";
+
+  subPackages = [ "." ];
+
+  # Terraform allows checking the provider versions, but this breaks
+  # if the versions are not provided via file paths.
+  postInstall = "mv $out/bin/${pname}{,_v${version}}";
+
+  meta = with stdenv.lib; {
+    inherit (src.meta) homepage;
+    description = "Terraform provider for executing shell commands and saving output to state file";
+    changelog = "https://github.com/scottwinkler/terraform-provider-shell/releases/tag/v${version}";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ mupdt ];
+  };
+}

pkgs/applications/networking/gns3/default.nix

@@ -1,7 +1,7 @@
 { callPackage }:
 
 let
-  stableVersion = "2.2.8";
+  stableVersion = "2.2.11";
   previewVersion = stableVersion;
   addVersion = args:
     let version = if args.stable then stableVersion else previewVersion;
@@ -15,18 +15,19 @@ let
           src = oldAttrs.src.override {
             inherit version sha256;
           };
-          doCheck = oldAttrs.doCheck && (attrname != "psutil");
         });
       };
     commonOverrides = [
-      (mkOverride "psutil" "5.6.6"
+      (mkOverride "psutil" "5.7.0"
-        "1rs6z8bfy6bqzw88s4i5zllrx3i18hnkv4akvmw7bifngcgjh8dd")
+        "03jykdi3dgf1cdal9bv4fq9zjvzj9l9bs99gi5ar81sdl5nc2pk8")
+      (mkOverride "jsonschema" "3.2.0"
+        "0ykr61yiiizgvm3bzipa3l73rvj49wmrybbfwhvpgk3pscl5pa68")
     ];
   };
   mkGui = args: callPackage (import ./gui.nix (addVersion args // extraArgs)) { };
   mkServer = args: callPackage (import ./server.nix (addVersion args // extraArgs)) { };
-  guiSrcHash = "1qgzad9hdbvkdalzdnlg5gnlzn2f9qlpd1aj8djmi6w1mmdkf9q7";
+  guiSrcHash = "1carwhp49l9zx2p6i3in03x6rjzn0x6ls2svwazd643rmrl4y7gn";
-  serverSrcHash = "1kg38dh0xk4yvi7hz0d5dq9k0wany0sfd185l0zxs3nz78zd23an";
+  serverSrcHash = "0acbxay1pwq62yq9q67hid44byyi6rb6smz5wa8br3vka7z31iqf";
 in {
   guiStable = mkGui {
     stable = true;

pkgs/applications/networking/gns3/gui.nix

@@ -4,8 +4,6 @@
 
 let
   defaultOverrides = commonOverrides ++ [
-    (mkOverride "jsonschema" "3.2.0"
-      "0ykr61yiiizgvm3bzipa3l73rvj49wmrybbfwhvpgk3pscl5pa68")
   ];
 
   python = python3.override {
@@ -23,7 +21,7 @@ in python.pkgs.buildPythonPackage rec {
   };
 
   propagatedBuildInputs = with python.pkgs; [
-    raven psutil jsonschema # tox for check
+    sentry-sdk psutil jsonschema # tox for check
     # Runtime dependencies
     sip (pyqt5.override { withWebSockets = true; }) distro setuptools
     pkgs.qt5Full

pkgs/applications/networking/gns3/server.nix

@@ -4,10 +4,19 @@
 
 let
   defaultOverrides = commonOverrides ++ [
-    (mkOverride "jsonschema" "3.2.0"
+    (mkOverride "aiofiles" "0.5.0"
-      "0ykr61yiiizgvm3bzipa3l73rvj49wmrybbfwhvpgk3pscl5pa68")
+      "98e6bcfd1b50f97db4980e182ddd509b7cc35909e903a8fe50d8849e02d815af")
-    (mkOverride "aiofiles" "0.4.0"
+    (self: super: {
-      "1vmvq9qja3wahv8m1adkyk00zm7j0x64pk3f2ry051ja66xa07h2")
+      py-cpuinfo = super.py-cpuinfo.overridePythonAttrs (oldAttrs: rec {
+        version = "6.0.0";
+        src = fetchFromGitHub {
+           owner = "workhorsy";
+           repo = "py-cpuinfo";
+           rev = "v${version}";
+           sha256 = "0595gjkd7gzmn9cfpgjw3ia2sl1y8mmw7ajyscibjx59m5mqcki5";
+        };
+      });
+    })
   ];
 
   python = python3.override {
@@ -31,7 +40,7 @@ in python.pkgs.buildPythonPackage {
 
   propagatedBuildInputs = with python.pkgs; [
     aiohttp-cors yarl aiohttp multidict setuptools
-    jinja2 psutil zipstream raven jsonschema distro async_generator aiofiles
+    jinja2 psutil zipstream sentry-sdk jsonschema distro async_generator aiofiles
     prompt_toolkit py-cpuinfo
   ];
 

pkgs/applications/networking/instant-messengers/riot/riot-web.nix

@@ -12,11 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "riot-web";
-  version = "1.6.7";
+  version = "1.6.8";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "14g5rbvcw6p0q50slbf0c7s39i54ggv2cjc5iv93yvfrwn3z0f8p";
+    sha256 = "09jazixxaq9fcw3qld73hpknw7pcjg3b94hhgipl3zyn6dvqk3xv";
   };
 
   installPhase = ''

pkgs/applications/networking/ipfs-migrator/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ipfs-migrator";
-  version = "1.5.1";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner = "ipfs";
     repo = "fs-repo-migrations";
     rev = "v${version}";
-    sha256 = "18pjxkxfbsbbj4hs4xyzfmmz991h31785ldx41dll6wa9zx4lsnm";
+    sha256 = "13ah5jk8n3wznvag6dda1ssgpqsdr9pdgvqm9gcsb7zzls89j9x5";
   };
 
   vendorSha256 = null;
@@ -22,4 +22,4 @@ buildGoModule rec {
     platforms = platforms.unix;
     maintainers = with maintainers; [ elitak ];
   };
-}
+}

pkgs/applications/networking/mailreaders/mutt/default.nix

@@ -27,11 +27,11 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mutt";
-  version = "1.14.5";
+  version = "1.14.6";
 
   src = fetchurl {
     url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "0p1xiqzmkqlzy5yi4l0dh0lacdq300zdj48zk0fir8j1pp512sri";
+    sha256 = "0i0q6vwhnb1grimsrpmz8maw255rh9k0laijzxkry6xqa80jm5s7";
   };
 
   patches = optional smimeSupport (fetchpatch {

pkgs/applications/networking/mumble/default.nix

@@ -128,14 +128,14 @@ let
   } source;
 
   source = rec {
-    version = "1.3.1";
+    version = "1.3.2";
 
     # Needs submodules
     src = fetchFromGitHub {
       owner = "mumble-voip";
       repo = "mumble";
       rev = version;
-      sha256 = "1xsla9g7xbq6xniwcsjik5hbjh0xahv44qh4z9hjn7p70b8vgnwc";
+      sha256 = "1ljn7h7dr9iyhvq7rdh0prl7hzn9d2hhnxv0ni6dha6f7d9qbfy6";
       fetchSubmodules = true;
     };
   };

pkgs/applications/networking/p2p/stig/default.nix

@@ -7,13 +7,13 @@ python3Packages.buildPythonApplication rec {
   pname = "stig";
   # This project has a different concept for pre release / alpha,
   # Read the project's README for details: https://github.com/rndusr/stig#stig
-  version = "0.11.0a";
+  version = "0.11.2a0";
 
   src = fetchFromGitHub {
     owner = "rndusr";
     repo = "stig";
     rev = "v${version}";
-    sha256 = "192v8f80jfly12bqzsslpxlvm72kdqm3jl40x1az5czpg4ab3lb7";
+    sha256 = "05dn6mr86ly65gdqarl16a2jk1bwiw5xa6r4kyag3s6lqsv66iw8";
   };
 
   # urwidtrees 1.0.3 is requested by the developer because 1.0.2 (which is packaged

pkgs/applications/networking/p2p/transmission/default.nix

@@ -57,6 +57,9 @@ in stdenv.mkDerivation {
   ++ lib.optionals enableQt [ qt5.wrapQtAppsHook ]
   ;
 
+  # Doc has high risk of collisions
+  postInstall = "rm -r $out/share/doc";
+
   buildInputs = [
     openssl
     curl

pkgs/applications/networking/syncthing/default.nix

@@ -3,17 +3,17 @@
 let
   common = { stname, target, postInstall ? "" }:
     buildGoModule rec {
-      version = "1.6.1";
+      version = "1.7.0";
       name = "${stname}-${version}";
 
       src = fetchFromGitHub {
         owner  = "syncthing";
         repo   = "syncthing";
         rev    = "v${version}";
-        sha256 = "1lhbx1mh2hdjjwks3s17i8y9vbl3fnapc1czaf42pp7nf8245q3j";
+        sha256 = "0jz1xfbs5ql9z7zdldyxc6wr0y5b0pf3vg8vzva5ml9aiqjcs9fg";
       };
 
-      vendorSha256 = "12g63a6jsshzqjgww792xmvybhfbkjx5aza4xnyljjsp453iky7k";
+      vendorSha256 = "1gmdv0g0gymq6khrwvplw6yfp146kg5ar8vqdp5dlp0myxfzi22b";
 
       patches = [
         ./add-stcli-target.patch

pkgs/applications/science/electronics/gtkwave/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gtkwave";
-  version = "3.3.104";
+  version = "3.3.105";
 
   src = fetchurl {
     url    = "mirror://sourceforge/gtkwave/${pname}-gtk3-${version}.tar.gz";
-    sha256 = "1qvldbnlp3wkqr5ff93f6pdvv9yzij7lxfhpqlizakz08l1xb391";
+    sha256 = "1vifgyhwqhpipnzmsivncawqjqihcm5kyg3yyygmd0lmgljy9rs4";
   };
 
   nativeBuildInputs = [ pkgconfig wrapGAppsHook ];

pkgs/applications/science/molecular-dynamics/gromacs/default.nix

@@ -9,11 +9,11 @@
 }:
 
 stdenv.mkDerivation {
-  name = "gromacs-2020.2";
+  name = "gromacs-2020.3";
 
   src = fetchurl {
-    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-2020.2.tar.gz";
+    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-2020.3.tar.gz";
-    sha256 = "1wyjgcdl30wy4hy6jvi9lkq53bqs9fgfq6fri52dhnb3c76y8rbl";
+    sha256 = "1acjrhcfzpqy2dncblhj97602jbg9gdha4q1bgji9nrj25lq6cch";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/science/robotics/qgroundcontrol/default.nix

@@ -1,4 +1,4 @@
-{ lib, mkDerivation, fetchgit, SDL2
+{ lib, mkDerivation, fetchFromGitHub, SDL2
 , qtbase, qtcharts, qtlocation, qtserialport, qtsvg, qtquickcontrols2
 , qtgraphicaleffects, qtspeech, qtx11extras, qmake, qttools
 , gst_all_1, wayland, pkgconfig
@@ -6,7 +6,7 @@
 
 mkDerivation rec {
   pname = "qgroundcontrol";
-  version = "4.0.8";
+  version = "4.0.9";
 
   qtInputs = [
     qtbase qtcharts qtlocation qtserialport qtsvg qtquickcontrols2
@@ -58,10 +58,11 @@ mkDerivation rec {
   '';
 
   # TODO: package mavlink so we can build from a normal source tarball
-  src = fetchgit {
+  src = fetchFromGitHub {
-    url = "https://github.com/mavlink/qgroundcontrol.git";
+    owner = "mavlink";
+    repo = pname;
     rev = "v${version}";
-    sha256 = "0jr9jpjqdwizsvh9zm0fdp8k2r4536m40dxrn30fbr3ba8vnzkgq";
+    sha256 = "0fwibgb9wmxk2zili5vsibi2q6pk1gna21870y5abx4scbvhgq68";
     fetchSubmodules = true;
   };
 

pkgs/applications/version-management/gerrit/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gerrit";
-  version = "3.1.5";
+  version = "3.2.2";
 
   src = fetchurl {
     url = "https://gerrit-releases.storage.googleapis.com/gerrit-${version}.war";
-    sha256 = "0gyh6a0p8gcrfnkm0sdjvzg6is9iirxjyffgza6k4v9rz6pjx8i8";
+    sha256 = "08i6rb8hawj44gg57mbhwjjmfn7mc45racl8gjsyrcyb8jm6zj1s";
   };
 
   buildCommand = ''
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
     homepage = "https://www.gerritcodereview.com/index.md";
     license = licenses.asl20;
     description = "A web based code review and repository management for the git version control system";
-    maintainers = with maintainers; [ jammerful zimbatm ];
+    maintainers = with maintainers; [ flokli jammerful zimbatm ];
     platforms = platforms.unix;
   };
 }

pkgs/applications/version-management/git-and-tools/delta/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "delta";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "dandavison";
     repo = pname;
     rev = version;
-    sha256 = "15c7rsmiinnpxh12520jz3wr0j86vgzjq1ss5pf30fa7lcgicb32";
+    sha256 = "0y3gkan5v0d6637yf5p5a9dklyv5zngw7a8pyqzj4ixys72ixg20";
   };
 
-  cargoSha256 = "0lzz32qh80s4dxr0d4pg0qagkn549lr4vbqknl2l0cmlq1bvvq6g";
+  cargoSha256 = "15sh2lsc16nf9w7sp3avy77f4vyj0rdsm6m1bn60y8gmv2r16v6i";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/version-management/gitea/default.nix

@@ -8,11 +8,11 @@ with stdenv.lib;
 
 buildGoPackage rec {
   pname = "gitea";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchurl {
     url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "0n92msf5pbgb5q6pa2p0nj9lnzs4y0qis62c5mp4hp8rc1j22wlb";
+    sha256 = "12zzb1c4cl07ccxaravkmia8vdyw5ffxrlx9v95ampvv6a0swpb9";
   };
 
   unpackPhase = ''

pkgs/applications/video/webtorrent_desktop/default.nix

@@ -1,14 +1,16 @@
 {
-  alsaLib, atk, cairo, cups, dbus, dpkg, expat, fetchurl, fontconfig, freetype,
+  alsaLib, atk, cairo, cups, dbus, dpkg, expat, fetchurl, fetchzip, fontconfig, freetype,
-  gdk-pixbuf, glib, gnome2, libX11, libXScrnSaver, libXcomposite, libXcursor,
+  gdk-pixbuf, glib, gnome3, libX11, libXScrnSaver, libXcomposite, libXcursor,
   libXdamage, libXext, libXfixes, libXi, libXrandr, libXrender, libXtst,
-  libxcb, nspr, nss, stdenv, udev
+  libxcb, nspr, nss, stdenv, udev, libuuid, pango, at-spi2-atk, at-spi2-core
 }:
 
   let
     rpath = stdenv.lib.makeLibraryPath ([
     alsaLib
     atk
+    at-spi2-core
+    at-spi2-atk
     cairo
     cups
     dbus
@@ -17,9 +19,9 @@
     freetype
     gdk-pixbuf
     glib
-    gnome2.GConf
+    gnome3.gtk
-    gnome2.gtk
+    pango
-    gnome2.pango
+    libuuid
     libX11
     libXScrnSaver
     libXcomposite
@@ -39,29 +41,33 @@
     ]);
   in stdenv.mkDerivation rec {
     pname = "webtorrent-desktop";
-    version = "0.20.0";
+    version = "0.21.0";
 
     src =
       if stdenv.hostPlatform.system == "x86_64-linux" then
-        fetchurl {
+        fetchzip {
-          url = "https://github.com/webtorrent/webtorrent-desktop/releases/download/v0.20.0/webtorrent-desktop_${version}-1_amd64.deb";
+          url = "https://github.com/webtorrent/webtorrent-desktop/releases/download/v${version}/WebTorrent-v${version}-linux.zip";
-          sha256 = "1kkrnbimiip5pn2nwpln35bbdda9gc3cgrjwphq4fqasbjf2781k";
+          sha256 = "13gd8isq2l10kibsc1bsc15dbgpnwa7nw4cwcamycgx6pfz9a852";
         }
         else
           throw "Webtorrent is not currently supported on ${stdenv.hostPlatform.system}";
+    desktopFile = fetchurl {
+      url = "https://raw.githubusercontent.com/webtorrent/webtorrent-desktop/v${version}/static/linux/share/applications/webtorrent-desktop.desktop";
+      sha256 = "1v16dqbxqds3cqg3xkzxsa5fyd8ssddvjhy9g3i3lz90n47916ca";
+    };
+    icon256File = fetchurl {
+      url = "https://raw.githubusercontent.com/webtorrent/webtorrent-desktop/v${version}/static/linux/share/icons/hicolor/256x256/apps/webtorrent-desktop.png";
+      sha256 = "1dapxvvp7cx52zhyaby4bxm4rll9xc7x3wk8k0il4g3mc7zzn3yk";
+    };
+    icon48File = fetchurl {
+      url = "https://raw.githubusercontent.com/webtorrent/webtorrent-desktop/v${version}/static/linux/share/icons/hicolor/48x48/apps/webtorrent-desktop.png";
+      sha256 = "00y96w9shbbrdbf6xcjlahqd08154kkrxmqraik7qshiwcqpw7p4";
+    };
     phases = [ "unpackPhase" "installPhase" ];
     nativeBuildInputs = [ dpkg ];
-    unpackPhase = "dpkg-deb -x $src .";
     installPhase = ''
-      mkdir -p $out
+      mkdir -p $out/share/{applications,icons/hicolor/{48x48,256x256}/apps}
-      cp -R opt $out
+      cp -R . $out/libexec
-
-      mv ./usr/share $out/share
-      mv $out/opt/webtorrent-desktop $out/libexec
-      chmod +x $out/libexec/WebTorrent
-      rmdir $out/opt
-
-      chmod -R g-w $out
 
       # Patch WebTorrent
       patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
@@ -71,9 +77,11 @@
       mkdir -p $out/bin
       ln -s $out/libexec/WebTorrent $out/bin/WebTorrent
 
-      # Fix the desktop link
+      cp $icon48File $out/share/icons/hicolor/48x48/apps/webtorrent-desktop.png
-      substituteInPlace $out/share/applications/webtorrent-desktop.desktop \
+      cp $icon256File $out/share/icons/hicolor/256x256/apps/webtorrent-desktop.png
-        --replace /opt/webtorrent-desktop $out/bin
+      ## Fix the desktop link
+      substitute $desktopFile $out/share/applications/webtorrent-desktop.desktop \
+        --replace /opt/webtorrent-desktop $out/libexec
     '';
 
     meta = with stdenv.lib; {

pkgs/data/fonts/jetbrains-mono/default.nix

@@ -1,14 +1,14 @@
 { lib, fetchzip }:
 
 let
-  version = "1.0.6";
+  version = "2.001";
 in
-fetchzip rec {
+fetchzip {
   name = "JetBrainsMono-${version}";
 
-  url = "https://github.com/JetBrains/JetBrainsMono/releases/download/v${version}/JetBrainsMono-${version}.zip";
+  url = "https://github.com/JetBrains/JetBrainsMono/releases/download/v${version}/JetBrains.Mono.${version}.zip";
 
-  sha256 = "1198k5zw91g85h6n7rg3y7wcj1nrbby9zlr6zwlmiq0nb37n0d3g";
+  sha256 = "06rh8dssq6qzgb9rri3an2ka24j47c0i8yhgq81yyg471spc39h1";
 
   postFetch = ''
     mkdir -p $out/share/fonts

pkgs/data/icons/iconpack-jade/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iconpack-jade";
-  version = "1.22";
+  version = "1.23";
 
   src = fetchFromGitHub {
     owner = "madmaxms";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1piypv8wdxnfiy6kgh7i3wi52m4fh4x874kh01qjmymssyirn17x";
+    sha256 = "1q29ikfssn1vmwws3dry4ssq6b44afd9sb7dwv3rdqg0frabpj1m";
   };
 
   nativeBuildInputs = [ gtk3 ];

pkgs/data/themes/cdetheme/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, python2Packages }:
 
 stdenv.mkDerivation rec {
-  pname = "cde-motif-theme";
+  pname = "cdetheme";
   version = "1.3";
 
   src = fetchFromGitHub {
@@ -29,5 +29,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3;
     platforms = platforms.all;
     maintainers = with maintainers; [ gnidorah ];
+    hydraPlatforms = [];
   };
 }

pkgs/data/themes/yaru/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "yaru";
-  version = "20.04.7";
+  version = "20.10.1";
 
   src = fetchFromGitHub {
     owner = "ubuntu";
     repo = "yaru";
     rev = version;
-    sha256 = "05fpr928kgyly7ac3zf6hfw9wqgc7fjn6980ih54iqc2qffcglsk";
+    sha256 = "08zws1qwvfr126fgdkqxxmpsqgfk02s31n90555bd5d66cfgdh72";
   };
 
   nativeBuildInputs = [ meson sassc pkg-config glib ninja python3 ];

pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix

@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-initial-setup";
-  version = "3.36.3";
+  version = "3.36.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "11f2yj8q844gks3jkfbi4ap448snz1wjflqbq4y2kk12r3w37afq";
+    sha256 = "17szzz2a5wpi7kwjnhimiwf8vg0bfliyk3k0adgv1pw2mcfpxp5s";
   };
 
   nativeBuildInputs = [

pkgs/desktops/gnome-3/extensions/dash-to-panel/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-dash-to-panel";
-  version = "31";
+  version = "38";
 
   src = fetchFromGitHub {
     owner = "home-sweet-gnome";
     repo = "dash-to-panel";
     rev = "v${version}";
-    sha256 = "0vh36mdncjvfp1jbinifznj5dw3ahsswwm3m9sjw5gydsbx6vh83";
+    sha256 = "1kvybb49l1vf0fvh8d0c6xkwnry8m330scamf5x40y63d4i213j1";
   };
 
   buildInputs = [

pkgs/desktops/gnome-3/games/gnome-taquin/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-taquin";
-  version = "3.36.3";
+  version = "3.36.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-taquin/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "149bv8q2a44i9msyshhh57nxwf5a43hankbndbvjqvq95yqlnhv4";
+    sha256 = "0awfssqpswsyla4gn80ifj53biwq34hcadxlknnlm7jpz0z38cp0";
   };
 
   passthru = {

pkgs/desktops/gnome-3/games/tali/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tali";
-  version = "3.36.1";
+  version = "3.36.4";
 
   src = fetchurl {
     url = "mirror://gnome/sources/tali/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1klnxk49rr1m2lr4zj1wvfl0iaxzdh2k8ngrcmfmcq39vlxnn94y";
+    sha256 = "12h6783m4634zzprlk31j0dmvgzrfjklhl0z49fdwcziw5bszr3c";
   };
 
   passthru = {

pkgs/development/arduino/platformio/chrootenv.nix

@@ -1,4 +1,4 @@
-{ lib, buildFHSUserEnv }:
+{ lib, buildFHSUserEnv, fetchFromGitHub }:
 
 let
   pio-pkgs = pkgs:
@@ -19,6 +19,14 @@ let
       platformio
     ]);
 
+  src = fetchFromGitHub {
+    owner = "platformio";
+    repo = "platformio-core";
+    rev = "v4.3.4";
+    sha256 = "0vf2j79319ypr4yrdmx84853igkb188sjfvlxgw06rlsvsm3kacq";
+  };
+
+
 in buildFHSUserEnv {
   name = "platformio";
 
@@ -34,7 +42,10 @@ in buildFHSUserEnv {
   };
 
   extraInstallCommands = ''
+    mkdir -p $out/lib/udev/rules.d
+
     ln -s $out/bin/platformio $out/bin/pio
+    ln -s ${src}/scripts/99-platformio-udev.rules $out/lib/udev/rules.d/99-platformio-udev.rules
   '';
 
   runScript = "platformio";