Merge master into staging-next

.github/CODEOWNERS

@@ -206,6 +206,12 @@
 /nixos/tests/cri-o.nix                       @NixOS/podman @zowoq
 /nixos/tests/podman.nix                      @NixOS/podman @zowoq
 
+# Docker tools
+/pkgs/build-support/docker                   @roberth
+/nixos/tests/docker-tools-overlay.nix        @roberth
+/nixos/tests/docker-tools.nix                @roberth
+/doc/builders/images/dockertools.xml         @roberth
+
 # Blockchains
 /pkgs/applications/blockchains  @mmahut
 

doc/languages-frameworks/java.xml

@@ -32,7 +32,7 @@ nativeBuildInputs = [ jdk ];
  </para>
 
  <para>
-  If your Java package provides a program, you need to generate a wrapper script to run it using the OpenJRE. You can use <literal>makeWrapper</literal> for this:
+  If your Java package provides a program, you need to generate a wrapper script to run it using a JRE. You can use <literal>makeWrapper</literal> for this:
 <programlisting>
 nativeBuildInputs = [ makeWrapper ];
 
@@ -43,7 +43,21 @@ installPhase =
       --add-flags "-cp $out/share/java/foo.jar org.foo.Main"
   '';
 </programlisting>
-  Note the use of <literal>jre</literal>, which is the part of the OpenJDK package that contains the Java Runtime Environment. By using <literal>${jre}/bin/java</literal> instead of <literal>${jdk}/bin/java</literal>, you prevent your package from depending on the JDK at runtime.
+Since the introduction of the Java Platform Module System in Java 9, Java distributions typically no longer ship with a general-purpose JRE: instead, they allow generating a JRE with only the modules required for your application(s). Because we can't predict what modules will be needed on a general-purpose system, the default <package>jre</package> package is the full JDK. When building a minimal system/image, you can override the <literal>modules</literal> parameter on <literal>jre_minimal</literal> to build a JRE with only the modules relevant for you:
+<programlisting>
+let
+  my_jre = pkgs.jre_minimal.override {
+    modules = [
+      # The modules used by 'something' and 'other' combined:
+      "java.base"
+      "java.logging"
+    ];
+  };
+  something = (pkgs.something.override { jre = my_jre; });
+  other = (pkgs.other.override { jre = my_jre; });
+in
+  ...
+</programlisting>
  </para>
 
  <para>

doc/languages-frameworks/rust.section.md

@@ -16,9 +16,9 @@ cargo
 into the `environment.systemPackages` or bring them into
 scope with `nix-shell -p rustc cargo`.
 
-For daily builds (beta and nightly) use either rustup from
+For other versions such as daily builds (beta and nightly),
-nixpkgs or use the [Rust nightlies
+use either `rustup` from nixpkgs (which will manage the rust installation in your home directory),
-overlay](#using-the-rust-nightlies-overlay).
+or use Mozilla's [Rust nightlies overlay](#using-the-rust-nightlies-overlay).
 
 ## Compiling Rust applications with Cargo
 
@@ -478,8 +478,15 @@ Mozilla provides an overlay for nixpkgs to bring a nightly version of Rust into
 This overlay can _also_ be used to install recent unstable or stable versions
 of Rust, if desired.
 
-To use this overlay, clone
+### Rust overlay installation
-[nixpkgs-mozilla](https://github.com/mozilla/nixpkgs-mozilla),
+
+You can use this overlay by either changing your local nixpkgs configuration,
+or by adding the overlay declaratively in a nix expression,  e.g. in `configuration.nix`.
+For more information see [#sec-overlays-install](the manual on installing overlays).
+
+#### Imperative rust overlay installation
+
+Clone [nixpkgs-mozilla](https://github.com/mozilla/nixpkgs-mozilla),
 and create a symbolic link to the file
 [rust-overlay.nix](https://github.com/mozilla/nixpkgs-mozilla/blob/master/rust-overlay.nix)
 in the `~/.config/nixpkgs/overlays` directory.
@@ -488,7 +495,34 @@ in the `~/.config/nixpkgs/overlays` directory.
     $ mkdir -p ~/.config/nixpkgs/overlays
     $ ln -s $(pwd)/nixpkgs-mozilla/rust-overlay.nix ~/.config/nixpkgs/overlays/rust-overlay.nix
 
-The latest version can be installed with the following command:
+### Declarative rust overlay installation
+
+Add the following to your `configuration.nix`, `home-configuration.nix`, `shell.nix`, or similar:
+
+```
+  nixpkgs = {
+    overlays = [
+      (import (builtins.fetchTarball https://github.com/mozilla/nixpkgs-mozilla/archive/master.tar.gz))
+      # Further overlays go here
+    ];
+  };
+```
+
+Note that this will fetch the latest overlay version when rebuilding your system.
+
+### Rust overlay usage
+
+The overlay contains attribute sets corresponding to different versions of the rust toolchain, such as:
+
+* `latest.rustChannels.stable`
+* `latest.rustChannels.nightly`
+* a function `rustChannelOf`, called as `(rustChannelOf { date = "2018-04-11"; channel = "nightly"; })`, or...
+* `(nixpkgs.rustChannelOf { rustToolchain = ./rust-toolchain; })` if you have a local `rust-toolchain` file (see https://github.com/mozilla/nixpkgs-mozilla#using-in-nix-expressions for an example)
+
+Each of these contain packages such as `rust`, which contains your usual rust development tools with the respective toolchain chosen.
+For example, you might want to add `latest.rustChannels.stable.rust` to the list of packages in your configuration.
+
+Imperatively, the latest stable version can be installed with the following command:
 
     $ nix-env -Ai nixos.latest.rustChannels.stable.rust
 

maintainers/maintainer-list.nix

@@ -4007,6 +4007,12 @@
     githubId = 2502736;
     name = "James Hillyerd";
   };
+  jiehong = {
+    email = "nixos@majiehong.com";
+    github = "Jiehong";
+    githubId = 1061229;
+    name = "Jiehong Ma";
+  };
   jirkamarsik = {
     email = "jiri.marsik89@gmail.com";
     github = "jirkamarsik";
@@ -4816,6 +4822,12 @@
     githubId = 20250323;
     name = "Lucio Delelis";
   };
+  ldenefle = {
+    email = "ldenefle@gmail.com";
+    github = "ldenefle";
+    githubId = 20558127;
+    name = "Lucas Denefle";
+  };
   ldesgoui = {
     email = "ldesgoui@gmail.com";
     github = "ldesgoui";
@@ -6439,6 +6451,12 @@
     githubId = 167209;
     name = "Masanori Ogino";
   };
+  omgbebebe = {
+    email = "omgbebebe@gmail.com";
+    github = "omgbebebe";
+    githubId = 588167;
+    name = "Sergey Bubnov";
+  };
   omnipotententity = {
     email = "omnipotententity@gmail.com";
     github = "omnipotententity";

nixos/doc/manual/administration/service-mgmt.xml

@@ -6,7 +6,7 @@
  <title>Service Management</title>
  <para>
   In NixOS, all system services are started and monitored using the systemd
-  program. Systemd is the “init” process of the system (i.e. PID 1), the
+  program. systemd is the “init” process of the system (i.e. PID 1), the
   parent of all other processes. It manages a set of so-called “units”,
   which can be things like system services (programs), but also mount points,
   swap files, devices, targets (groups of units) and more. Units can have
@@ -16,10 +16,17 @@
   dependencies of this unit cause all system services to be started, file
   systems to be mounted, swap files to be activated, and so on.
  </para>
- <para>
+ <section xml:id="sect-nixos-systemd-general">
-  The command <command>systemctl</command> is the main way to interact with
+  <title>Interacting with a running systemd</title>
-  <command>systemd</command>. Without any arguments, it shows the status of
+   <para>
-  active units:
+    The command <command>systemctl</command> is the main way to interact with
+    <command>systemd</command>. The following paragraphs demonstrate ways to
+    interact with any OS running systemd as init system. NixOS is of no
+    exception. The <link xlink:href="#sect-nixos-systemd-nixos">next section
+    </link> explains NixOS specific things worth knowing.
+   </para>
+   <para>
+    Without any arguments, <literal>systmctl</literal> the status of active units:
 <screen>
 <prompt>$ </prompt>systemctl
 -.mount          loaded active mounted   /
@@ -28,10 +35,10 @@ sshd.service     loaded active running   SSH Daemon
 graphical.target loaded active active    Graphical Interface
 <replaceable>...</replaceable>
 </screen>
- </para>
+  </para>
- <para>
+  <para>
-  You can ask for detailed status information about a unit, for instance, the
+   You can ask for detailed status information about a unit, for instance, the
-  PostgreSQL database service:
+   PostgreSQL database service:
 <screen>
 <prompt>$ </prompt>systemctl status postgresql.service
 postgresql.service - PostgreSQL Server
@@ -62,11 +69,72 @@ Jan 07 15:55:57 hagbard systemd[1]: Started PostgreSQL Server.
 <prompt># </prompt>systemctl start postgresql.service
 <prompt># </prompt>systemctl restart postgresql.service
 </screen>
-  These operations are synchronous: they wait until the service has finished
+   These operations are synchronous: they wait until the service has finished
-  starting or stopping (or has failed). Starting a unit will cause the
+   starting or stopping (or has failed). Starting a unit will cause the
-  dependencies of that unit to be started as well (if necessary).
+   dependencies of that unit to be started as well (if necessary).
- </para>
+  </para>
-<!-- - cgroups: each service and user session is a cgroup
+  <!-- TODO: document cgroups, draft:
+   each service and user session is a cgroup
 
-- cgroup resource management -->
+   - cgroup resource management -->
+ </section>
+ <section xml:id="sect-nixos-systemd-nixos">
+  <title>systemd in NixOS</title>
+  <para>
+   Packages in Nixpkgs sometimes provide systemd units with them, usually in
+   e.g <literal>#pkg-out#/lib/systemd/</literal>. Putting such a package in
+   <literal>environment.systemPackages</literal> doesn't make the service
+   available to users or the system.
+  </para>
+  <para>
+   In order to enable a systemd <emphasis>system</emphasis> service with
+   provided upstream package, use (e.g):
+<programlisting>
+<xref linkend="opt-systemd.packages"/> = [ pkgs.packagekit ];
+</programlisting>
+  </para>
+  <para>
+   Usually NixOS modules written by the community do the above, plus take care of
+   other details. If a module was written for a service you are interested in,
+   you'd probably need only to use
+   <literal>services.#name#.enable = true;</literal>. These services are defined
+   in Nixpkgs'
+   <link xlink:href="https://github.com/NixOS/nixpkgs/tree/master/nixos/modules">
+   <literal>nixos/modules/</literal> directory </link>. In case the service is
+   simple enough, the above method should work, and start the service on boot.
+  </para>
+  <para>
+   <emphasis>User</emphasis> systemd services on the other hand, should be
+   treated differently. Given a package that has a systemd unit file at
+   <literal>#pkg-out#/lib/systemd/user/</literal>, using
+   <xref linkend="opt-systemd.packages"/> will make you able to start the service via
+   <literal>systemctl --user start</literal>, but it won't start automatically on login.
+   <!-- TODO: Document why systemd.packages doesn't work for user services or fix this.
+   https://github.com/NixOS/nixpkgs/blob/2cd6594a8710a801038af2b72348658f732ce84a/nixos/modules/system/boot/systemd-lib.nix#L177-L198
+
+   This has been talked over at https://discourse.nixos.org/t/how-to-enable-upstream-systemd-user-services-declaratively/7649/5
+   -->
+   However, You can imperatively enable it by adding the package's attribute to
+   <link linkend="opt-environment.systemPackages">
+   <literal>systemd.packages</literal></link> and then do this (e.g):
+<screen>
+<prompt>$ </prompt>mkdir -p ~/.config/systemd/user/default.target.wants
+<prompt>$ </prompt>ln -s /run/current-system/sw/lib/systemd/user/syncthing.service ~/.config/systemd/user/default.target.wants/
+<prompt>$ </prompt>systemctl --user daemon-reload
+<prompt>$ </prompt>systemctl --user enable syncthing.service
+</screen>
+   If you are interested in a timer file, use <literal>timers.target.wants</literal>
+   instead of <literal>default.target.wants</literal> in the 1st and 2nd command.
+  </para>
+  <para>
+   Using <literal>systemctl --user enable syncthing.service</literal> instead of
+   the above, will work, but it'll use the absolute path of
+   <literal>syncthing.service</literal> for the symlink, and this path is in
+   <literal>/nix/store/.../lib/systemd/user/</literal>. Hence
+   <link xlink:href="#sec-nix-gc">garbage collection</link> will remove that file
+   and you will wind up with a broken symlink in your systemd configuration, which
+   in turn will not make the service / timer start on login.
+  </para>
+ </section>
 </chapter>
+

nixos/modules/services/hardware/bluetooth.nix

@@ -87,6 +87,8 @@ in {
       bluetooth = {
         wantedBy = [ "bluetooth.target" ];
         aliases  = [ "dbus-org.bluez.service" ];
+        # restarting can leave people without a mouse/keyboard
+        unitConfig.X-RestartIfChanged = false;
       };
     };
 

nixos/modules/services/networking/tailscale.nix

@@ -18,30 +18,10 @@ in {
 
   config = mkIf cfg.enable {
     environment.systemPackages = [ pkgs.tailscale ]; # for the CLI
-    systemd.services.tailscale = {
+    systemd.packages = [ pkgs.tailscale ];
-      description = "Tailscale client daemon";
+    systemd.services.tailscaled = {
-
-      after = [ "network-pre.target" ];
-      wants = [ "network-pre.target" ];
       wantedBy = [ "multi-user.target" ];
-
+      serviceConfig.Environment = "PORT=${toString cfg.port}";
-      startLimitIntervalSec = 0;
-
-      serviceConfig = {
-        ExecStart =
-          "${pkgs.tailscale}/bin/tailscaled --port ${toString cfg.port}";
-
-        RuntimeDirectory = "tailscale";
-        RuntimeDirectoryMode = 755;
-
-        StateDirectory = "tailscale";
-        StateDirectoryMode = 750;
-
-        CacheDirectory = "tailscale";
-        CacheDirectoryMode = 750;
-
-        Restart = "on-failure";
-      };
     };
   };
 }

nixos/modules/system/boot/kernel.nix

@@ -227,7 +227,7 @@ in
             "xhci_pci"
             "usbhid"
             "hid_generic" "hid_lenovo" "hid_apple" "hid_roccat"
-            "hid_logitech_hidpp" "hid_logitech_dj"
+            "hid_logitech_hidpp" "hid_logitech_dj" "hid_microsoft"
 
           ] ++ optionals (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) [
             # Misc. x86 keyboard stuff.

nixos/modules/system/boot/resolved.nix

@@ -136,7 +136,7 @@ in
       }
     ];
 
-    users.users.resolved.group = "systemd-resolve";
+    users.users.systemd-resolve.group = "systemd-resolve";
 
     # add resolve to nss hosts database if enabled and nscd enabled
     # system.nssModules is configured in nixos/modules/system/boot/systemd.nix

nixos/tests/all-tests.nix

@@ -255,6 +255,7 @@ in
   novacomd = handleTestOn ["x86_64-linux"] ./novacomd.nix {};
   nsd = handleTest ./nsd.nix {};
   nzbget = handleTest ./nzbget.nix {};
+  oh-my-zsh = handleTest ./oh-my-zsh.nix {};
   openarena = handleTest ./openarena.nix {};
   openldap = handleTest ./openldap.nix {};
   opensmtpd = handleTest ./opensmtpd.nix {};
@@ -313,6 +314,7 @@ in
   samba = handleTest ./samba.nix {};
   sanoid = handleTest ./sanoid.nix {};
   sbt = handleTest ./sbt.nix {};
+  scala = handleTest ./scala.nix {};
   sddm = handleTest ./sddm.nix {};
   service-runner = handleTest ./service-runner.nix {};
   shadowsocks = handleTest ./shadowsocks {};

nixos/tests/oh-my-zsh.nix

@@ -0,0 +1,18 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "oh-my-zsh";
+
+  machine = { pkgs, ... }:
+
+    {
+      programs.zsh = {
+        enable = true;
+        ohMyZsh.enable = true;
+      };
+    };
+
+  testScript = ''
+    start_all()
+    machine.succeed("touch ~/.zshrc")
+    machine.succeed("zsh -c 'source /etc/zshrc && echo $ZSH | grep oh-my-zsh-${pkgs.oh-my-zsh.version}'")
+  '';
+})

nixos/tests/scala.nix

@@ -0,0 +1,33 @@
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+
+with pkgs.lib;
+
+let
+  common = name: package: (import ./make-test-python.nix ({
+    inherit name;
+    meta = with pkgs.stdenv.lib.maintainers; {
+      maintainers = [ nequissimus ];
+    };
+
+    nodes = {
+      scala = { ... }: {
+        environment.systemPackages = [ package ];
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      scala.succeed("scalac -version 2>&1 | grep '^Scala compiler version ${package.version}'")
+    '';
+  }) { inherit system; });
+
+in with pkgs; {
+  scala_2_10  = common "scala_2_10"  scala_2_10;
+  scala_2_11  = common "scala_2_11"  scala_2_11;
+  scala_2_12  = common "scala_2_12"  scala_2_12;
+  scala_2_13  = common "scala_2_13"  scala_2_13;
+}

pkgs/applications/audio/ardour/default.nix

@@ -12,17 +12,14 @@
 , fftw
 , fftwSinglePrec
 , flac
-, fluidsynth
 , glibc
 , glibmm
 , graphviz
 , gtkmm2
-, hidapi
 , itstool
 , libarchive
 , libjack2
 , liblo
-, libltc
 , libogg
 , libpulseaudio
 , librdf_raptor
@@ -42,11 +39,11 @@
 , perl
 , pkg-config
 , python3
-, qm-dsp
 , readline
 , rubberband
 , serd
 , sord
+, soundtouch
 , sratom
 , suil
 , taglib
@@ -55,13 +52,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "ardour";
-  version = "6.2";
+  version = "6.3";
 
   # don't fetch releases from the GitHub mirror, they are broken
   src = fetchgit {
     url = "git://git.ardour.org/ardour/ardour.git";
     rev = version;
-    sha256 = "17jxbqavricy01x4ymq6d302djsqfnv84m7dm4fd8cpka0dqjp1y";
+    sha256 = "050p1adgyirr790a3xp878pq3axqwzcmrk3drgm9z6v753h0xhcd";
   };
 
   patches = [
@@ -91,15 +88,12 @@ stdenv.mkDerivation rec {
     fftw
     fftwSinglePrec
     flac
-    fluidsynth
     glibmm
     gtkmm2
-    hidapi
     itstool
     libarchive
     libjack2
     liblo
-    libltc
     libogg
     libpulseaudio
     librdf_raptor
@@ -118,11 +112,11 @@ stdenv.mkDerivation rec {
     pango
     perl
     python3
-    qm-dsp
     readline
     rubberband
     serd
     sord
+    soundtouch
     sratom
     suil
     taglib
@@ -136,11 +130,11 @@ stdenv.mkDerivation rec {
     "--no-phone-home"
     "--optimize"
     "--ptformat"
-    "--qm-dsp-include=${qm-dsp}/include/qm-dsp"
     "--run-tests"
     "--test"
-    "--use-external-libs"
   ];
+  # removed because it fixes https://tracker.ardour.org/view.php?id=8161 and https://tracker.ardour.org/view.php?id=8437
+  # "--use-external-libs"
 
   # Ardour's wscript requires git revision and date to be available.
   # Since they are not, let's generate the file manually.

pkgs/applications/audio/pulseaudio-ctl/default.nix

@@ -7,13 +7,13 @@ let
 
 in stdenv.mkDerivation rec {
   name = "${pname}-${version}";
-  version = "1.67";
+  version = "1.68";
 
   src = fetchFromGitHub {
     owner = "graysky2";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1mf5r7x6aiqmx9mz7gpckrqvvzxnr5gs2q1k4m42rjk6ldkpdb46";
+    sha256 = "0wrzfanwy18wyawpg8rfvfgjh3lwngqwmfpi4ww3530rfmi84cf0";
   };
 
   postPatch = ''

pkgs/applications/blockchains/polkadot/default.nix

@@ -7,18 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "0.8.25";
+  version = "0.8.26";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot";
     rev = "v${version}";
-    sha256 = "1jdklmysr25rlwgx7pz0jw66j1w60h98kqghzjhr90zhynzh39lz";
+    sha256 = "1bvma6k3gsjqh8w76k4kf52sjg8wxn1b7a409kmnmmvmd9j6z5ia";
   };
 
-  cargoSha256 = "08yfafrspkd1g1mhlfwngbknkxjkyymbcga8n2rdsk7mz0hm0vgy";
+  cargoSha256 = "0pacmmvvjgzmaxgg47qbfhqwl02jxj3i6vnmkjbj9npzqfmqf72d";
-
-  cargoPatches = [ ./substrate-wasm-builder-runner.patch ];
 
   nativeBuildInputs = [ clang ];
 

pkgs/applications/blockchains/polkadot/substrate-wasm-builder-runner.patch

@@ -1,25 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 5e7c4a14..bb67aada 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -8642,8 +8642,7 @@ dependencies = [
- [[package]]
- name = "substrate-wasm-builder-runner"
- version = "1.0.6"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "d2a965994514ab35d3893e9260245f2947fd1981cdd4fffd2c6e6d1a9ce02e6a"
-+source = "git+https://github.com/paritytech/substrate#647ad15565d7c35ecf00b73b12cccad9858780b9"
- 
- [[package]]
- name = "subtle"
-diff --git a/Cargo.toml b/Cargo.toml
-index 78047a1a..2d571f8e 100644
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -112,3 +112,6 @@ polkadot = { path = "/usr/bin/polkadot" }
- 
- [package.metadata.rpm.files]
- "../scripts/packaging/polkadot.service" = { path = "/usr/lib/systemd/system/polkadot.service", mode = "644" }
-+
-+[patch.crates-io]
-+substrate-wasm-builder-runner = { git = "https://github.com/paritytech/substrate", branch = "master" }

pkgs/applications/editors/neovim/gnvim/wrapper.nix

@@ -23,9 +23,7 @@ stdenv.mkDerivation {
     cp -r '${gnvim-unwrapped}/share/applications' "$out/share/applications"
     # Sed needs a writable directory to do inplace modifications
     chmod u+rw "$out/share/applications"
-    for file in $out/share/applications/*.desktop; do
+    sed -e "s|Exec=.\\+gnvim\\>|Exec=gnvim|" -i $out/share/applications/*.desktop
-      sed -e "s|Exec=.\\+gnvim\\>|Exec=$out/bin/gnvim|" -i "$file"
-    done
   '';
 
   preferLocalBuild = true;

pkgs/applications/editors/neovim/wrapper.nix

@@ -43,7 +43,6 @@ let
       postBuild = lib.optionalString stdenv.isLinux ''
         rm $out/share/applications/nvim.desktop
         substitute ${neovim}/share/applications/nvim.desktop $out/share/applications/nvim.desktop \
-          --replace 'TryExec=nvim' "TryExec=$out/bin/nvim" \
           --replace 'Name=Neovim' 'Name=WrappedNeovim'
       ''
       + optionalString withPython2 ''

pkgs/applications/editors/vim/macvim.nix

@@ -94,6 +94,19 @@ stdenv.mkDerivation {
   + ''
     unset LD
   ''
+  # When building with nix-daemon, we need to pass -derivedDataPath or else it tries to use
+  # a folder rooted in /var/empty and fails. Unfortunately we can't just pass -derivedDataPath
+  # by itself as this flag requires the use of -scheme or -xctestrun (not sure why), but MacVim
+  # by default just runs `xcodebuild -project src/MacVim/MacVim.xcodeproj`, relying on the default
+  # behavior to build the first target in the project. Experimentally, there seems to be a scheme
+  # called MacVim, so we'll explicitly select that. We also need to specify the configuration too
+  # as the scheme seems to have the wrong default.
+  + ''
+    configureFlagsArray+=(
+      XCODEFLAGS="-scheme MacVim -derivedDataPath $NIX_BUILD_TOP/derivedData"
+      --with-xcodecfg="Release"
+    )
+  ''
   ;
 
   # Because we're building with system clang, this means we're building against Xcode's SDK and

pkgs/applications/graphics/photoflare/default.nix

@@ -0,0 +1,31 @@
+{ mkDerivation, stdenv, graphicsmagick, fetchFromGitHub, qmake, qtbase, qttools
+}:
+
+mkDerivation rec {
+  pname = "photoflare";
+  version = "1.6.5";
+
+  src = fetchFromGitHub {
+    owner = "PhotoFlare";
+    repo = "photoflare";
+    rev = "v${version}";
+    sha256 = "0a394324h7ds567z3i3pw6kkii78n4qwdn129kgkkm996yh03q89";
+  };
+
+  nativeBuildInputs = [ qmake qttools ];
+  buildInputs = [ qtbase graphicsmagick ];
+
+  qmakeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  NIX_CFLAGS_COMPILE = "-I${graphicsmagick}/include/GraphicsMagick";
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "A cross-platform image editor with a powerful features and a very friendly graphical user interface";
+    homepage = "https://photoflare.io";
+    maintainers = [ maintainers.omgbebebe ];
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/graphics/yed/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchzip, makeWrapper, unzip, jre }:
+{ stdenv, fetchzip, makeWrapper, unzip, jre, wrapGAppsHook }:
 
 stdenv.mkDerivation rec {
   pname = "yEd";
@@ -9,16 +9,25 @@ stdenv.mkDerivation rec {
     sha256 = "0sd73s700f3gqq5zq1psrqjg6ff2gv49f8vd37v6bv65vdxqxryq";
   };
 
-  nativeBuildInputs = [ makeWrapper unzip ];
+  nativeBuildInputs = [ makeWrapper unzip wrapGAppsHook ];
+  # For wrapGAppsHook setup hook
+  buildInputs = [ jre.gtk3 ];
 
-  installPhase = ''
+  dontConfigure = true;
+  dontBuild = true;
+  dontInstall = true;
+
+  preFixup = ''
     mkdir -p $out/yed
     cp -r * $out/yed
     mkdir -p $out/bin
 
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
     makeWrapper ${jre}/bin/java $out/bin/yed \
+      ''${makeWrapperArgs[@]} \
       --add-flags "-jar $out/yed/yed.jar --"
   '';
+  dontWrapGApps = true;
 
   meta = with stdenv.lib; {
     license = licenses.unfree;

pkgs/applications/misc/charm/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "charm";
-  version = "0.8.3";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "charm";
     rev = "v${version}";
-    sha256 = "1nbix7fi6g9jadak5zyx7fdz7d6367aly6fnrs0v98zsl1kxyvx3";
+    sha256 = "0wsh83kchqakvx7kgs2s31rzsvnfr47jk6pbmqzjv1kqmnlhc3rh";
   };
 
-  vendorSha256 = "0lhml6m0j9ksn09j7z4d9pix5aszhndpyqajycwj3apvi3ic90il";
+  vendorSha256 = "1lg4bbdzgnw50v6m6p7clibwm8m82kdr1jizgbmhfmzy15d5sfll";
 
   doCheck = false;
 

pkgs/applications/misc/kupfer/default.nix

@@ -16,6 +16,8 @@ buildPythonApplication rec {
   pname = "kupfer";
   version = "319";
 
+  format = "other";
+
   src = fetchurl {
     url = "https://github.com/kupferlauncher/kupfer/releases/download/v${version}/kupfer-v${version}.tar.xz";
     sha256 = "0c9xjx13r8ckfr4az116bhxsd3pk78v04c3lz6lqhraak0rp4d92";
@@ -33,13 +35,9 @@ buildPythonApplication rec {
   # see https://github.com/NixOS/nixpkgs/issues/56943 for details
   strictDeps = false;
 
-  postInstall = let
+  postInstall = ''
-    pythonPath = (stdenv.lib.concatMapStringsSep ":"
-      (m: "${m}/lib/${python.libPrefix}/site-packages")
-      propagatedBuildInputs);
-  in ''
     gappsWrapperArgs+=(
-      "--prefix" "PYTHONPATH" : "${pythonPath}"
+      "--prefix" "PYTHONPATH" : "${makePythonPath propagatedBuildInputs}"
       "--set" "PYTHONNOUSERSITE" "1"
     )
   '';

pkgs/applications/misc/tiv/default.nix

@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, imagemagick }:
+
+stdenv.mkDerivation rec {
+  pname = "tiv";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "stefanhaustein";
+    repo = "TerminalImageViewer";
+    rev = "v${version}";
+    sha256 = "17zqbwj2imk6ygyc142mw6v4fh7h4rd5vzn5wxr9gs0g8qdc6ixn";
+  };
+
+  buildInputs = [ imagemagick ];
+
+  makeFlags = [ "prefix=$(out)" ];
+
+  preConfigure = "cd src/main/cpp";
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/stefanhaustein/TerminalImageViewer";
+    description = "Small C++ program to display images in a (modern) terminal using RGB ANSI codes and unicode block graphics characters";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ magnetophon ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

pkgs/applications/networking/Sylk/default.nix

@@ -2,7 +2,7 @@
 
 let
   pname = "Sylk";
-  version = "2.9.1";
+  version = "2.9.2";
 in
 
 appimageTools.wrapType2 rec {
@@ -10,7 +10,7 @@ appimageTools.wrapType2 rec {
 
   src = fetchurl {
     url = "http://download.ag-projects.com/Sylk/Sylk-${version}-x86_64.AppImage";
-    hash = "sha256-Y1FR1tYZTxhMFn6NL578otitmOsngMJBPK/9cpCqE/Q=";
+    hash = "sha256-pfzTeKxY2fs98mgvhzaI/uBbYYkxfnQ+6jQ+gTSeEkA=";
   };
 
   profile = ''

pkgs/applications/networking/browsers/ungoogled-chromium/browser.nix

@@ -13,7 +13,7 @@ mkChromiumDerivation (base: rec {
 
   installPhase = ''
     mkdir -p "$libExecPath"
-    cp -v "$buildPath/"*.pak "$buildPath/"*.bin "$libExecPath/"
+    cp -v "$buildPath/"*.so "$buildPath/"*.pak "$buildPath/"*.bin "$libExecPath/"
     cp -v "$buildPath/icudtl.dat" "$libExecPath/"
     cp -vLR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
     cp -v "$buildPath/chrome" "$libExecPath/$packageName"
@@ -78,17 +78,10 @@ mkChromiumDerivation (base: rec {
     '';
     homepage = "https://github.com/Eloston/ungoogled-chromium";
     maintainers = with maintainers; [ squalus ];
-    # Overview of the maintainer roles:
-    # nixos-unstable:
-    # - TODO: Need a new maintainer for x86_64 [0]
-    # - @thefloweringash: aarch64
-    # - @primeos: Provisional maintainer (x86_64)
-    # Stable channel:
-    # - TODO (need someone to test backports [0])
-    # [0]: https://github.com/NixOS/nixpkgs/issues/78450
     license = if enableWideVine then licenses.unfree else licenses.bsd3;
     platforms = platforms.linux;
     hydraPlatforms = if channel == "stable" then ["aarch64-linux" "x86_64-linux"] else [];
-    timeout = 172800; # 48 hours
+    timeout = 172800; # 48 hours (increased from the Hydra default of 10h)
+    broken = channel == "dev"; # Blocked on https://bugs.chromium.org/p/chromium/issues/detail?id=1141896
   };
 })

pkgs/applications/networking/browsers/ungoogled-chromium/common.nix

@@ -5,7 +5,7 @@
 , libevent, expat, libjpeg, snappy
 , libpng, libcap
 , xdg_utils, yasm, nasm, minizip, libwebp
-, libusb1, pciutils, nss, re2, zlib
+, libusb1, pciutils, nss, re2
 
 , python2Packages, perl, pkgconfig
 , nspr, systemd, kerberos
@@ -13,10 +13,9 @@
 , bison, gperf
 , glib, gtk3, dbus-glib
 , glibc
-, xorg
 , libXScrnSaver, libXcursor, libXtst, libGLU, libGL
 , protobuf, speechd, libXdamage, cups
-, ffmpeg_3, libxslt, libxml2, at-spi2-core
+, ffmpeg, libxslt, libxml2, at-spi2-core
 , jre8
 , pipewire_0_2
 
@@ -49,8 +48,6 @@ buildFun:
 
 with stdenv.lib;
 
-# see http://www.linuxfromscratch.org/blfs/view/cvs/xsoft/chromium.html
-
 let
   jre = jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731
 
@@ -66,7 +63,7 @@ let
   mkGnFlags =
     let
       # Serialize Nix types into GN types according to this document:
-      # https://chromium.googlesource.com/chromium/src/+/master/tools/gn/docs/language.md
+      # https://source.chromium.org/gn/gn/+/master:docs/language.md
       mkGnString = value: "\"${escape ["\"" "$" "\\"] value}\"";
       sanitize = value:
         if value == true then "true"
@@ -78,14 +75,17 @@ let
       toFlag = key: value: "${key}=${sanitize value}";
     in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs));
 
+  # https://source.chromium.org/chromium/chromium/src/+/master:build/linux/unbundle/replace_gn_files.py
   gnSystemLibraries = [
-    "flac" "libwebp" "libxslt" "opus" "snappy" "libpng"
+    "ffmpeg"
-    # "zlib" # version 77 reports unresolved dependency on //third_party/zlib:zlib_config
+    "flac"
-    # "libjpeg" # fails with multiple undefined references to chromium_jpeg_*
+    "libjpeg"
-    # "re2" # fails with linker errors
+    "libpng"
-    # "ffmpeg" # https://crbug.com/731766
+    "libwebp"
-    # "harfbuzz-ng" # in versions over 63 harfbuzz and freetype are being built together
+    "libxslt"
-                    # so we can't build with one from system and other from source
+    "opus"
+    "snappy"
+    "zlib"
   ];
 
   opusWithCustomModes = libopus.override {
@@ -97,11 +97,9 @@ let
     libevent expat libjpeg snappy
     libpng libcap
     xdg_utils minizip libwebp
-    libusb1 re2 zlib
+    libusb1 re2
-    ffmpeg_3 libxslt libxml2
+    ffmpeg libxslt libxml2
     nasm
-    # harfbuzz # in versions over 63 harfbuzz and freetype are being built together
-               # so we can't build with one from system and other from source
   ];
 
   # build paths and release info
@@ -135,10 +133,10 @@ let
     };
 
     nativeBuildInputs = [
+      llvmPackages.lldClang.bintools
       ninja which python2Packages.python perl pkgconfig
       python2Packages.ply python2Packages.jinja2 nodejs
       gnutar python2Packages.setuptools
-      (xorg.xcbproto.override { python = python2Packages.python; })
     ];
 
     buildInputs = defaultDependencies ++ [
@@ -157,34 +155,35 @@ let
       ++ optional pulseSupport libpulseaudio
       ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];
 
-    patches = optionals (versionRange "68" "86") [
+    patches = [
-      ./patches/nix_plugin_paths_68.patch
+      ./patches/no-build-timestamps.patch # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed)
-    ] ++ [
+      ./patches/widevine-79.patch # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags
-      ./patches/remove-webp-include-69.patch
-      ./patches/no-build-timestamps.patch
-      ./patches/widevine-79.patch
-      ./patches/dont-use-ANGLE-by-default.patch
-      # Unfortunately, chromium regularly breaks on major updates and
-      # then needs various patches backported in order to be compiled with GCC.
-      # Good sources for such patches and other hints:
-      # - https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/chromium/
-      # - https://git.archlinux.org/svntogit/packages.git/tree/trunk?h=packages/chromium
-      # - https://github.com/chromium/chromium/search?q=GCC&s=committer-date&type=Commits
-      #
-      # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
       # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
-    ] ++ optionals (useVaapi && versionRange "68" "86") [ # Improvements for the VA-API build:
+    ] ++ optionals (useVaapi && versionRange "86" "87") [
-      ./patches/enable-vdpau-support-for-nvidia.patch # https://aur.archlinux.org/cgit/aur.git/tree/vdpau-support.patch?h=chromium-vaapi
+      # Check for enable-accelerated-video-decode on Linux:
-      ./patches/enable-video-acceleration-on-linux.patch # Can be controlled at runtime (i.e. without rebuilding Chromium)
+      (githubPatch "54deb9811ca9bd2327def5c05ba6987b8c7a0897" "11jvxjlkzz1hm0pvfyr88j7z3zbwzplyl5idkx92l2lzv4459c8d")
     ];
 
-    postPatch = optionalString (!versionRange "0" "86") ''
+    postPatch = ''
+      # remove unused third-party
+      for lib in ${toString gnSystemLibraries}; do
+        if [ -d "third_party/$lib" ]; then
+          find "third_party/$lib" -type f \
+            \! -path "third_party/$lib/chromium/*" \
+            \! -path "third_party/$lib/google/*" \
+            \! -path "third_party/harfbuzz-ng/utils/hb_scoped.h" \
+            \! -regex '.*\.\(gn\|gni\|isolate\)' \
+            -delete
+        fi
+      done
+
       # Required for patchShebangs (unsupported interpreter directive, basename: invalid option -- '*', etc.):
-      substituteInPlace native_client/SConstruct \
+      substituteInPlace native_client/SConstruct --replace "#! -*- python -*-" ""
-        --replace "#! -*- python -*-" ""
+      if [ -e third_party/harfbuzz-ng/src/src/update-unicode-tables.make ]; then
-      substituteInPlace third_party/harfbuzz-ng/src/src/update-unicode-tables.make \
+        substituteInPlace third_party/harfbuzz-ng/src/src/update-unicode-tables.make \
-        --replace "/usr/bin/env -S make -f" "/usr/bin/make -f"
+          --replace "/usr/bin/env -S make -f" "/usr/bin/make -f"
-    '' + ''
+      fi
+
       # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
       substituteInPlace sandbox/linux/suid/client/setuid_sandbox_host.cc \
         --replace \
@@ -202,11 +201,6 @@ let
           '/usr/share/locale/' \
           '${glibc}/share/locale/'
 
-      substituteInPlace ui/gfx/x/BUILD.gn \
-        --replace \
-          '/usr/share/xcb' \
-          '${xorg.xcbproto}/share/xcb/'
-
       sed -i -e 's@"\(#!\)\?.*xdg-@"\1${xdg_utils}/bin/xdg-@' \
         chrome/browser/shell_integration_linux.cc
 
@@ -216,42 +210,20 @@ let
       sed -i -e '/libpci_loader.*Load/s!"\(libpci\.so\)!"${pciutils}/lib/\1!' \
         gpu/config/gpu_info_collector_linux.cc
 
-      sed -i -re 's/([^:])\<(isnan *\()/\1std::\2/g' \
-        chrome/browser/ui/webui/engagement/site_engagement_ui.cc
-
-      sed -i -e '/#include/ {
-        i #include <algorithm>
-        :l; n; bl
-      }' gpu/config/gpu_control_list.cc
-
       # Allow to put extensions into the system-path.
       sed -i -e 's,/usr,/run/current-system/sw,' chrome/common/chrome_paths.cc
 
       patchShebangs .
       # use our own nodejs
       mkdir -p third_party/node/linux/node-linux-x64/bin
-      ln -s $(which node) third_party/node/linux/node-linux-x64/bin/node
+      ln -s "$(command -v node)" third_party/node/linux/node-linux-x64/bin/node
+
+      # Allow building against system libraries in official builds
+      sed -i 's/OFFICIAL_BUILD/GOOGLE_CHROME_BUILD/' tools/generate_shim_headers/generate_shim_headers.py
 
-      # remove unused third-party
-      # in third_party/crashpad third_party/zlib contains just a header-adapter
-      for lib in ${toString gnSystemLibraries}; do
-        find -type f -path "*third_party/$lib/*"     \
-            \! -path "*third_party/crashpad/crashpad/third_party/zlib/*"  \
-            \! -path "*third_party/$lib/chromium/*"  \
-            \! -path "*third_party/$lib/google/*"    \
-            \! -path "*base/third_party/icu/*"       \
-            \! -path "*base/third_party/libevent/*"  \
-            \! -regex '.*\.\(gn\|gni\|isolate\|py\)' \
-            -delete
-      done
     '' + optionalString stdenv.isAarch64 ''
       substituteInPlace build/toolchain/linux/BUILD.gn \
         --replace 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
-    '' + optionalString stdenv.cc.isClang ''
-      mkdir -p third_party/llvm-build/Release+Asserts/bin
-      ln -s ${stdenv.cc}/bin/clang              third_party/llvm-build/Release+Asserts/bin/clang
-      ln -s ${stdenv.cc}/bin/clang++            third_party/llvm-build/Release+Asserts/bin/clang++
-      ln -s ${llvmPackages.llvm}/bin/llvm-ar    third_party/llvm-build/Release+Asserts/bin/llvm-ar
     '' + optionalString ungoogled ''
       ${ungoogler}/utils/prune_binaries.py . ${ungoogler}/pruning.list || echo "some errors"
       ${ungoogler}/utils/patches.py . ${ungoogler}/patches
@@ -259,9 +231,9 @@ let
     '';
 
     gnFlags = mkGnFlags ({
-      use_lld = false;
+      custom_toolchain = "//build/toolchain/linux/unbundle:default";
-      use_gold = true;
+      host_toolchain = "//build/toolchain/linux/unbundle:default";
-      gold_path = "${stdenv.cc}/bin";
+      is_official_build = true;
       is_debug = false;
 
       proprietary_codecs = false;
@@ -283,6 +255,7 @@ let
       is_clang = stdenv.cc.isClang;
       clang_use_chrome_plugins = false;
       blink_symbol_level = 0;
+      symbol_level = 0;
       fieldtrial_testing_like_official_build = true;
 
       # Google API keys, see:
@@ -336,8 +309,7 @@ let
 
       # This is to ensure expansion of $out.
       libExecPath="${libExecPath}"
-      python build/linux/unbundle/replace_gn_files.py \
+      python build/linux/unbundle/replace_gn_files.py --system-libraries ${toString gnSystemLibraries}
-        --system-libraries ${toString gnSystemLibraries}
       ${gnChromium}/bin/gn gen --args=${escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt
 
       # Fail if `gn gen` contains a WARNING.

pkgs/applications/networking/browsers/ungoogled-chromium/default.nix

@@ -1,5 +1,5 @@
 { newScope, config, stdenv, fetchurl, makeWrapper
-, llvmPackages_10, llvmPackages_11, ed, gnugrep, coreutils, xdg_utils
+, llvmPackages_11, ed, gnugrep, coreutils, xdg_utils
 , glib, gtk3, gnome3, gsettings-desktop-schemas, gn, fetchgit
 , libva ? null
 , pipewire_0_2
@@ -14,8 +14,7 @@
 , proprietaryCodecs ? true
 , enablePepperFlash ? false
 , enableWideVine ? false
-, useVaapi ? false # Deprecated, use enableVaapi instead!
+, enableVaapi ? false # Disabled by default due to unofficial support
-, enableVaapi ? false # Disabled by default due to unofficial support and issues on radeon
 , ungoogled ? true
 , useOzone ? false
 , cupsSupport ? true
@@ -24,7 +23,7 @@
 }:
 
 let
-  llvmPackages = llvmPackages_10;
+  llvmPackages = llvmPackages_11;
   stdenv = llvmPackages.stdenv;
 
   callPackage = newScope chromium;
@@ -39,16 +38,6 @@ let
               cupsSupport pulseSupport useOzone;
       inherit ungoogled;
       # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
-      gnChromium = gn.overrideAttrs (oldAttrs: {
-        version = "2020-05-19";
-        src = fetchgit {
-          url = "https://gn.googlesource.com/gn";
-          rev = "d0a6f072070988e7b038496c4e7d6c562b649732";
-          sha256 = "0197msabskgfbxvhzq73gc3wlr3n9cr4bzrhy5z5irbvy05lxk17";
-        };
-      });
-    } // lib.optionalAttrs (lib.versionAtLeast upstream-info.version "86") {
-      llvmPackages = llvmPackages_11;
       gnChromium = gn.overrideAttrs (oldAttrs: {
         version = "2020-07-20";
         src = fetchgit {
@@ -58,8 +47,8 @@ let
         };
       });
     } // lib.optionalAttrs (lib.versionAtLeast upstream-info.version "87") {
-      llvmPackages = llvmPackages_11;
       useOzone = true; # YAY: https://chromium-review.googlesource.com/c/chromium/src/+/2382834 \o/
+      useVaapi = !stdenv.isAarch64; # TODO: Might be best to not set use_vaapi anymore (default is fine)
       gnChromium = gn.overrideAttrs (oldAttrs: {
         version = "2020-08-17";
         src = fetchgit {
@@ -162,13 +151,6 @@ let
       ''
     else browser;
 
-  optionalVaapiFlags = if useVaapi # TODO: Remove after 20.09:
-    then throw ''
-      Chromium's useVaapi was replaced by enableVaapi and you don't need to pass
-      "--ignore-gpu-blacklist" anymore (also no rebuilds are required anymore).
-    '' else lib.optionalString
-      (!enableVaapi)
-      "--add-flags --disable-accelerated-video-decode --add-flags --disable-accelerated-video-encode";
 in stdenv.mkDerivation {
   name = "ungoogled-chromium${suffix}-${version}";
   inherit version;
@@ -195,7 +177,7 @@ in stdenv.mkDerivation {
 
     eval makeWrapper "${browserBinary}" "$out/bin/chromium" \
       --add-flags ${escapeShellArg (escapeShellArg commandLineArgs)} \
-      ${optionalVaapiFlags} \
+      ${lib.optionalString enableVaapi "--add-flags --enable-accelerated-video-decode"} \
       ${concatMapStringsSep " " getWrapperFlags chromium.plugins.enabled}
 
     ed -v -s "$out/bin/chromium" << EOF

pkgs/applications/networking/browsers/ungoogled-chromium/patches/dont-use-ANGLE-by-default.patch

@@ -1,26 +0,0 @@
-A field trial currently enables the passthrough command decoder, which causes
-gl_factory.cc to try kGLImplementationEGLANGLE first, which causes Chromium to fail
-to load libGLESv2.so on NixOS.  It somehow does not try kGLImplementationDesktopGL,
-and so there is no GL support at all.
-
-Revert to using the validating command decoder, which prevents gl_factory.cc
-from touching allowed_impls, allowing it to successfully use kGLImplementationDesktopGL.
-
-diff --git a/ui/gl/gl_utils.cc b/ui/gl/gl_utils.cc
-index 697cbed5fe2d..8419bdb21a2f 100644
---- a/ui/gl/gl_utils.cc
-+++ b/ui/gl/gl_utils.cc
-@@ -71,9 +71,10 @@ bool UsePassthroughCommandDecoder(const base::CommandLine* command_line) {
-   } else if (switch_value == kCmdDecoderValidatingName) {
-     return false;
-   } else {
--    // Unrecognized or missing switch, use the default.
--    return base::FeatureList::IsEnabled(
--        features::kDefaultPassthroughCommandDecoder);
-+    // Ignore the field trial that enables it; disable it until
-+    // gl_factory.cc kGLImplementationEGLANGLE issues are sorted
-+    // out on NixOS.
-+    return false;
-   }
- }
- }

pkgs/applications/networking/browsers/ungoogled-chromium/patches/enable-vdpau-support-for-nvidia.patch

@@ -1,65 +0,0 @@
---- a/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
-+++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
-@@ -641,6 +641,7 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
-   // |vpp_vaapi_wrapper_| for VaapiPicture to DownloadFromSurface() the VA's
-   // internal decoded frame.
-   if (buffer_allocation_mode_ != BufferAllocationMode::kNone &&
-+      buffer_allocation_mode_ != BufferAllocationMode::kWrapVdpau &&
-       !vpp_vaapi_wrapper_) {
-     vpp_vaapi_wrapper_ = VaapiWrapper::Create(
-         VaapiWrapper::kVideoProcess, VAProfileNone,
-@@ -665,7 +666,8 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
-     PictureBuffer buffer = buffers[i];
-     buffer.set_size(requested_pic_size_);
-     std::unique_ptr<VaapiPicture> picture = vaapi_picture_factory_->Create(
--        (buffer_allocation_mode_ == BufferAllocationMode::kNone)
-+        ((buffer_allocation_mode_ == BufferAllocationMode::kNone) ||
-+         (buffer_allocation_mode_ == BufferAllocationMode::kWrapVdpau))
-             ? vaapi_wrapper_
-             : vpp_vaapi_wrapper_,
-         make_context_current_cb_, bind_image_cb_, buffer);
-@@ -1093,6 +1095,12 @@ VaapiVideoDecodeAccelerator::GetSupportedProfiles() {
-
- VaapiVideoDecodeAccelerator::BufferAllocationMode
- VaapiVideoDecodeAccelerator::DecideBufferAllocationMode() {
-+  // NVIDIA blobs use VDPAU
-+  if (VaapiWrapper::GetImplementationType() == VAImplementation::kNVIDIAVDPAU) {
-+    LOG(INFO) << "VA-API driver on VDPAU backend";
-+    return BufferAllocationMode::kWrapVdpau;
-+  }
-+
-   // TODO(crbug.com/912295): Enable a better BufferAllocationMode for IMPORT
-   // |output_mode_| as well.
-   if (output_mode_ == VideoDecodeAccelerator::Config::OutputMode::IMPORT)
---- a/media/gpu/vaapi/vaapi_video_decode_accelerator.h
-+++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.h
-@@ -204,6 +204,7 @@ class MEDIA_GPU_EXPORT VaapiVideoDecodeAccelerator
-     // Using |client_|s provided PictureBuffers and as many internally
-     // allocated.
-     kNormal,
-+    kWrapVdpau,
-   };
-
-   // Decides the concrete buffer allocation mode, depending on the hardware
---- a/media/gpu/vaapi/vaapi_wrapper.cc
-+++ b/media/gpu/vaapi/vaapi_wrapper.cc
-@@ -131,6 +131,9 @@ media::VAImplementation VendorStringToImplementationType(
-   } else if (base::StartsWith(va_vendor_string, "Intel iHD driver",
-                               base::CompareCase::SENSITIVE)) {
-     return media::VAImplementation::kIntelIHD;
-+  } else if (base::StartsWith(va_vendor_string, "Splitted-Desktop Systems VDPAU",
-+                              base::CompareCase::SENSITIVE)) {
-+    return media::VAImplementation::kNVIDIAVDPAU;
-   }
-   return media::VAImplementation::kOther;
- }
---- a/media/gpu/vaapi/vaapi_wrapper.h
-+++ b/media/gpu/vaapi/vaapi_wrapper.h
-@@ -79,6 +79,7 @@ enum class VAImplementation {
-   kIntelIHD,
-   kOther,
-   kInvalid,
-+  kNVIDIAVDPAU,
- };
-
- // This class handles VA-API calls and ensures proper locking of VA-API calls

pkgs/applications/networking/browsers/ungoogled-chromium/patches/enable-video-acceleration-on-linux.patch

@@ -1,48 +0,0 @@
-From b2144fd28e09cd52e7a88a62a9d9b54cf9922f9f Mon Sep 17 00:00:00 2001
-From: Michael Weiss <dev.primeos@gmail.com>
-Date: Tue, 14 Apr 2020 14:16:10 +0200
-Subject: [PATCH] Enable accelerated video decode on Linux
-
-This will enable accelerated video decode on Linux by default (i.e.
-without "--ignore-gpu-blacklist"), but on NixOS we'll provide
-"--disable-accelerated-video-decode" and
-"--disable-accelerated-video-encode" by default to avoid regressions
-(e.g. VA-API doesn't work properly for some radeon drivers).
-
-Video acceleration can then be enabled via:
-chromium.override { enableVaapi = true; }
-without rebuilding Chromium.
----
- gpu/config/software_rendering_list.json | 16 ----------------
- 1 file changed, 16 deletions(-)
-
-diff --git a/gpu/config/software_rendering_list.json b/gpu/config/software_rendering_list.json
-index 22712bdbf38f..a06dd19a50e4 100644
---- a/gpu/config/software_rendering_list.json
-+++ b/gpu/config/software_rendering_list.json
-@@ -336,22 +336,6 @@
-       ]
-     },
-     {
--      "id": 48,
--      "description": "Accelerated video decode is unavailable on Linux",
--      "cr_bugs": [137247, 1032907],
--      "os": {
--        "type": "linux"
--      },
--      "exceptions": [
--        {
--          "machine_model_name": ["Chromecast"]
--        }
--      ],
--      "features": [
--        "accelerated_video_decode"
--      ]
--    },
--    {
-       "id": 50,
-       "description": "Disable VMware software renderer on older Mesa",
-       "cr_bugs": [145531, 332596, 571899, 629434],
--- 
-2.11.0
-

pkgs/applications/networking/browsers/ungoogled-chromium/patches/nix_plugin_paths_68.patch

@@ -1,61 +0,0 @@
-diff --git a/chrome/common/chrome_paths.cc b/chrome/common/chrome_paths.cc
-index f4e119d..d9775bd 100644
---- a/chrome/common/chrome_paths.cc
-+++ b/chrome/common/chrome_paths.cc
-@@ -68,21 +68,14 @@ static base::LazyInstance<base::FilePath>
-     g_invalid_specified_user_data_dir = LAZY_INSTANCE_INITIALIZER;
- 
- // Gets the path for internal plugins.
--bool GetInternalPluginsDirectory(base::FilePath* result) {
--#if defined(OS_MACOSX)
--  // If called from Chrome, get internal plugins from a subdirectory of the
--  // framework.
--  if (base::mac::AmIBundled()) {
--    *result = chrome::GetFrameworkBundlePath();
--    DCHECK(!result->empty());
--    *result = result->Append("Internet Plug-Ins");
--    return true;
--  }
--  // In tests, just look in the module directory (below).
--#endif
--
--  // The rest of the world expects plugins in the module directory.
--  return base::PathService::Get(base::DIR_MODULE, result);
-+bool GetInternalPluginsDirectory(base::FilePath* result,
-+                                 const std::string& ident) {
-+  std::string full_env = std::string("NIX_CHROMIUM_PLUGIN_PATH_") + ident;
-+  const char* value = getenv(full_env.c_str());
-+  if (value == NULL)
-+      return base::PathService::Get(base::DIR_MODULE, result);
-+  else
-+      *result = base::FilePath(value);
- }
- 
- // Gets the path for bundled implementations of components. Note that these
-@@ -272,7 +265,7 @@ bool PathProvider(int key, base::FilePath* result) {
-       create_dir = true;
-       break;
-     case chrome::DIR_INTERNAL_PLUGINS:
--      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "ALL"))
-         return false;
-       break;
-     case chrome::DIR_COMPONENTS:
-@@ -280,7 +273,7 @@ bool PathProvider(int key, base::FilePath* result) {
-         return false;
-       break;
-     case chrome::DIR_PEPPER_FLASH_PLUGIN:
--      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "PEPPERFLASH"))
-         return false;
-       cur = cur.Append(kPepperFlashBaseDirectory);
-       break;
-@@ -358,7 +351,7 @@ bool PathProvider(int key, base::FilePath* result) {
-         cur = cur.DirName();
-       }
- #else
--      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "PNACL"))
-         return false;
- #endif
-       cur = cur.Append(FILE_PATH_LITERAL("pnacl"));

pkgs/applications/networking/browsers/ungoogled-chromium/patches/remove-webp-include-69.patch

@@ -1,11 +0,0 @@
---- a/third_party/blink/renderer/platform/image-encoders/image_encoder.cc
-+++ b/third_party/blink/renderer/platform/image-encoders/image_encoder.cc
-@@ -13,7 +13,7 @@
-
- #include "jpeglib.h"  // for JPEG_MAX_DIMENSION
-
--#include "third_party/libwebp/src/webp/encode.h"  // for WEBP_MAX_DIMENSION
-+#define WEBP_MAX_DIMENSION 16383
-
- namespace blink {
-

pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled-src.nix

@@ -1,6 +1,6 @@
 {
-  "85.0.4183.102" = {
+  "86.0.4240.111" = {
-    rev = "85.0.4183.102-1";
+    rev = "86.0.4240.111-1";
-    sha256 = "1mdx4a5zcs3an9yx1jxx4amq8p9rcj0hv76r8y7nz6cpsfgd9n3y";
+    sha256 = "0fkk0lxbvik8q8d5njxmwiam64qz5g74hlb56w24nh5mh1jm59a8";
   };
 }

pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.json

@@ -1,17 +1,17 @@
 {
   "stable": {
-    "version": "85.0.4183.102",
+    "version": "86.0.4240.111",
-    "sha256": "032yh1mfwins7a62zw8kwwq8xw1n52a0a93lqz7qlyjaf9sd8s4a",
+    "sha256": "05y7lwr89awkhvgmwkx3br9j4ap2aypg2wsc0nz8mi7kxc1dnyzj",
-    "sha256bin64": "1i8xaxxnmg80vsia8hxnq58qi9k5nnbrl80d6d23g9lb7dbc9cpm"
+    "sha256bin64": "10aqiiydw4i3jxnw8xxdgkgcqbfqc67n1fbrg40y54kg0v5dz8l6"
   },
   "beta": {
-    "version": "86.0.4240.30",
+    "version": "87.0.4280.27",
-    "sha256": "1isj0zngb72k1hhn3h0s8mccg1cdmppz1mjmg19f2h306farzmzl",
+    "sha256": "0w0asxj7jlsw69cssfia8km4q9cx1c2mliks2rmhf4jk0hsghasm",
-    "sha256bin64": "10d8im2adqqnkd6265gngv6xlm5qsz6r13z6cbbchsss0ssr8fxa"
+    "sha256bin64": "1lsx4mhy8nachfb8c9f3mrx5nqw2bi046dqirb4lnv7y80jjjs1k"
   },
   "dev": {
-    "version": "87.0.4252.0",
+    "version": "88.0.4298.4",
-    "sha256": "1lxlsdni63zh79hxvpwgmnfn67kgfzhz3yg9bkxghqchqykkz92y",
+    "sha256": "0ka11gmpkyrmifajaxm66c16hrj3xakdvhjqg04slyp2sv0nlhrl",
-    "sha256bin64": "130hf7b35wcxpw05ddbqq89x10c0kays1vb9qg6xhq3zx2mk6ijw"
+    "sha256bin64": "0768y31jqbl1znp7yp6mvl5j12xl1nwjkh2l8zdga81q0wz52hh6"
   }
 }

pkgs/applications/networking/cluster/starboard/default.nix

@@ -2,16 +2,18 @@
 
 buildGoModule rec {
   pname = "starboard";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = pname;
     rev = "v${version}";
-    sha256 = "12vfxnny3giirdf1xhacy24dvy5zm7iil6h019s0l63876vingnc";
+    sha256 = "00d3cnd3n6laa6rphw5w9xk8slpp4a603vzhixzg01sghq26gy22";
   };
 
-  vendorSha256 = "0hj7h58j0v98plrqfldq59d084j76aiy82mfm8zi0vcqg6gxf4pb";
+  vendorSha256 = "0y816r75rp1a4rp7j0a8wzrfi2mdf4ji1vz2vaj5s7x9ik6rc13r";
+
+  subPackages = [ "cmd/starboard" ];
 
   doCheck = false;
 

pkgs/applications/networking/instant-messengers/slack/default.nix

@@ -39,9 +39,16 @@ let
   throwSystem = throw "Unsupported system: ${system}";
 
   pname = "slack";
+
+  x86_64-darwin-version = "4.10.3";
+  x86_64-darwin-sha256 = "0r77l57vr603xamich4h4gbdd5vdcj0sjs6yjpymfx9s0f98v8bb";
+
+  x86_64-linux-version = "4.10.3";
+  x86_64-linux-sha256 = "1gnjj2iyk8cwjajg8h9qpmzx10j4qjxjzciq8csg45qfzwkr3drf";
+
   version = {
-    x86_64-darwin = "4.10.3";
+    x86_64-darwin = x86_64-darwin-version;
-    x86_64-linux = "4.10.3";
+    x86_64-linux = x86_64-linux-version;
   }.${system} or throwSystem;
 
   src = let
@@ -49,11 +56,11 @@ let
   in {
     x86_64-darwin = fetchurl {
       url = "${base}/releases/macos/${version}/prod/x64/Slack-${version}-macOS.dmg";
-      sha256 = "0r77l57vr603xamich4h4gbdd5vdcj0sjs6yjpymfx9s0f98v8bb";
+      sha256 = x86_64-darwin-sha256;
     };
     x86_64-linux = fetchurl {
       url = "${base}/linux_releases/slack-desktop-${version}-amd64.deb";
-      sha256 = "1gnjj2iyk8cwjajg8h9qpmzx10j4qjxjzciq8csg45qfzwkr3drf";
+      sha256 = x86_64-linux-sha256;
     };
   }.${system} or throwSystem;
 
@@ -68,6 +75,8 @@ let
   linux = stdenv.mkDerivation rec {
     inherit pname version src meta;
 
+    passthru.updateScript = ./update.sh;
+
     rpath = stdenv.lib.makeLibraryPath [
       alsaLib
       at-spi2-atk
@@ -152,6 +161,8 @@ let
   darwin = stdenv.mkDerivation {
     inherit pname version src meta;
 
+    passthru.updateScript = ./update.sh;
+
     nativeBuildInputs = [ undmg ];
 
     sourceRoot = "Slack.app";

pkgs/applications/networking/instant-messengers/slack/update.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p curl gnused
+
+set -eou pipefail
+
+latest_linux_version=$(curl --silent https://slack.com/downloads/linux | sed -n 's/.*Version \([0-9\.]\+\).*/\1/p')
+latest_mac_version=$(curl --silent https://slack.com/downloads/mac | sed -n 's/.*Version \([0-9\.]\+\).*/\1/p')
+
+# Double check that the latest mac and linux versions are in sync.
+if [[ "$latest_linux_version" != "$latest_mac_version" ]]; then
+  echo "the latest linux ($latest_linux_version) and mac ($latest_mac_version) versions are not the same"
+  exit 1
+fi
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+slack_nix="$nixpkgs/pkgs/applications/networking/instant-messengers/slack/default.nix"
+nixpkgs_linux_version=$(cat "$slack_nix" | sed -n 's/.*x86_64-linux-version = \"\([0-9\.]\+\)\";.*/\1/p')
+nixpkgs_mac_version=$(cat "$slack_nix" | sed -n 's/.*x86_64-darwin-version = \"\([0-9\.]\+\)\";.*/\1/p')
+
+if [[ "$nixpkgs_linux_version" == "$latest_linux_version" && "$nixpkgs_mac_version" == "$latest_mac_version" ]]; then
+  echo "nixpkgs versions are all up to date!"
+  exit 0
+fi
+
+linux_url="https://downloads.slack-edge.com/linux_releases/slack-desktop-${latest_linux_version}-amd64.deb"
+mac_url="https://downloads.slack-edge.com/releases/macos/${latest_mac_version}/prod/x64/Slack-${latest_mac_version}-macOS.dmg"
+linux_sha256=$(nix-prefetch-url ${linux_url})
+mac_sha256=$(nix-prefetch-url ${mac_url})
+
+sed -i "s/x86_64-linux-version = \".*\"/x86_64-linux-version = \"${latest_linux_version}\"/" "$slack_nix"
+sed -i "s/x86_64-darwin-version = \".*\"/x86_64-darwin-version = \"${latest_mac_version}\"/" "$slack_nix"
+sed -i "s/x86_64-linux-sha256 = \".*\"/x86_64-linux-sha256 = \"${linux_sha256}\"/" "$slack_nix"
+sed -i "s/x86_64-darwin-sha256 = \".*\"/x86_64-darwin-sha256 = \"${mac_sha256}\"/" "$slack_nix"
+
+if ! nix-build -A slack "$nixpkgs"; then
+  echo "The updated slack failed to build."
+  exit 1
+fi
+
+echo "Successfully updated"
+echo "slack: $nixpkgs_linux_version -> $latest_linux_version"

pkgs/applications/networking/instant-messengers/teams/default.nix

@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     mv share $out/share
 
     substituteInPlace $out/share/applications/teams.desktop \
-      --replace /usr/bin/ $out/bin/
+      --replace /usr/bin/ ""
 
     ln -s $out/opt/teams/teams $out/bin/
 

pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix

@@ -22,12 +22,12 @@ let
 
 in mkDerivation rec {
   pname = "telegram-desktop";
-  version = "2.4.6";
+  version = "2.4.7";
 
   # Telegram-Desktop with submodules
   src = fetchurl {
     url = "https://github.com/telegramdesktop/tdesktop/releases/download/v${version}/tdesktop-${version}-full.tar.gz";
-    sha256 = "190k9ik678br5k892gj26bx4rbj5rn5ks4qgf2nrlgww0z59fvrc";
+    sha256 = "1j2v29952l0am357pqvvgzm2zghmwhlr833kgp85hssxpr9xy4vv";
   };
 
   postPatch = ''

pkgs/applications/networking/mailreaders/bubblemail/default.nix

@@ -0,0 +1,76 @@
+{ lib
+, fetchFromGitLab
+, gettext
+, gtk3
+, python3Packages
+, gdk-pixbuf
+, libnotify
+, gst_all_1
+, libsecret
+, wrapGAppsHook
+, gsettings-desktop-schemas
+, gnome-online-accounts
+, glib
+, gobject-introspection
+, folks
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "bubblemail";
+  version = "1.3";
+
+  src = fetchFromGitLab {
+    domain = "framagit.org";
+    owner = "razer";
+    repo = "bubblemail";
+    rev = "v${version}";
+    sha256 = "FEIdEoZBlM28F5kSMoln7KACwetb8hp+qix1P+DIE8k=";
+  };
+
+  buildInputs = [
+    gtk3
+    gdk-pixbuf
+    glib
+    libnotify
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+    libsecret
+    gnome-online-accounts
+    folks
+  ];
+
+  nativeBuildInputs = [
+    gettext
+    wrapGAppsHook
+    python3Packages.pillow
+    # For setup-hook
+    gobject-introspection
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    gsettings-desktop-schemas
+    pygobject3
+    dbus-python
+    pyxdg
+  ];
+
+  # See https://nixos.org/nixpkgs/manual/#ssec-gnome-common-issues-double-wrapped
+  dontWrapGApps = true;
+
+  # https://github.com/NixOS/nixpkgs/issues/56943
+  strictDeps = false;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  meta = with lib; {
+    description = "An extensible mail notification service.";
+    homepage = "http://bubblemail.free.fr/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ doronbehar ];
+  };
+}

pkgs/applications/networking/nextdns/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "nextdns";
-  version = "1.8.3";
+  version = "1.8.8";
 
   src = fetchFromGitHub {
     owner = "nextdns";
     repo = "nextdns";
     rev = "v${version}";
-    sha256 = "1bl6ky258hnai4v7d0gskn6nf5sdsc3xlwl959iwzqhpp0j3q9xg";
+    sha256 = "17grlia9vxjly7hnwdgw8xfrynibj9h839kxs3wbdgp86b4lf5xf";
   };
 
   vendorSha256 = "09whpzsn16znyrknfm5zlhla253r69j6d751czza4c83m4r36swj";

pkgs/applications/networking/syncplay/default.nix

@@ -2,7 +2,7 @@
 
 buildPythonApplication rec {
   pname = "syncplay";
-  version = "1.6.5";
+  version = "1.6.6";
 
   format = "other";
 
@@ -10,7 +10,7 @@ buildPythonApplication rec {
     owner = "Syncplay";
     repo = "syncplay";
     rev = "v${version}";
-    sha256 = "107dgsrjv95ww6gj77q89dirl604b2ljlpjg79gffm9c4gkmjj2m";
+    sha256 = "1wkxdp7dv5y1100awy949higvs5035ylfyl83qrp4lnimy3imw09";
   };
 
   propagatedBuildInputs = [ pyside2 shiboken2 twisted certifi ] ++ twisted.extras.tls;

pkgs/applications/office/todoman/default.nix

@@ -1,4 +1,9 @@
-{ stdenv, python3, glibcLocales, installShellFiles, jq }:
+{ stdenv
+, python3
+, glibcLocales
+, installShellFiles
+, jq
+}:
 
 let
   inherit (python3.pkgs) buildPythonApplication fetchPypi;
@@ -12,22 +17,36 @@ buildPythonApplication rec {
     sha256 = "1aq7f63bhs9dnwzp15nfr07f2ki6s3lnqfap3b09rhchn6lfznwb";
   };
 
-    LOCALE_ARCHIVE = stdenv.lib.optionalString stdenv.isLinux
+  nativeBuildInputs = [
-      "${glibcLocales}/lib/locale/locale-archive";
+    installShellFiles
-    LANG = "en_US.UTF-8";
+  ];
-    LC_TYPE = "en_US.UTF-8";
+  propagatedBuildInputs = with python3.pkgs; [
+    atomicwrites
+    click
+    click-log
+    click-repl
+    configobj
+    humanize
+    icalendar
+    parsedatetime
+    python-dateutil
+    pyxdg
+    tabulate
+    urwid
+  ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  checkInputs = with python3.pkgs; [
-  buildInputs = [ glibcLocales ];
+    flake8
-  propagatedBuildInputs = with python3.pkgs;
+    flake8-import-order
-    [ atomicwrites click click-log click-repl configobj humanize icalendar parsedatetime
+    freezegun
-      python-dateutil pyxdg tabulate urwid ];
+    hypothesis
+    pytest
+    pytestrunner
+    pytestcov
+    glibcLocales
+  ];
 
-  checkInputs = with python3.pkgs;
+  LC_ALL = "en_US.UTF-8";
-    [ flake8 flake8-import-order freezegun hypothesis pytest pytestrunner pytestcov ];
-
-  makeWrapperArgs = [ "--set LOCALE_ARCHIVE ${glibcLocales}/lib/locale/locale-archive"
-                      "--set CHARSET en_us.UTF-8" ];
 
   postInstall = ''
     installShellCompletion --bash contrib/completion/bash/_todo

pkgs/applications/radio/limesuite/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "limesuite";
-  version = "20.07.2";
+  version = "20.10.0";
 
   src = fetchFromGitHub {
     owner = "myriadrf";
     repo = "LimeSuite";
     rev = "v${version}";
-    sha256 = "0v0w0f5ff1gwpfy13x1q1jsx9xfg4s3ccg05ikpnkzj4yg6sjps1";
+    sha256 = "04wzfhzqmxjsa6bgcr4zd518fln9rbwnbabf48kha84d70vzkdlx";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/version-management/git-and-tools/default.nix

@@ -74,6 +74,8 @@ let
   # support for bugzilla
   git-bz = callPackage ./git-bz { };
 
+  git-chglog = callPackage ./git-chglog { };
+
   git-cinnabar = callPackage ./git-cinnabar { };
 
   git-codeowners = callPackage ./git-codeowners { };

pkgs/applications/version-management/git-and-tools/git-chglog/default.nix

@@ -0,0 +1,22 @@
+{ lib, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  pname = "git-chglog";
+  version = "0.9.1";
+
+  goPackagePath = "github.com/git-chglog/git-chglog";
+
+  src = fetchFromGitHub {
+    owner = "git-chglog";
+    repo = "git-chglog";
+    rev = version;
+    sha256 = "08x7w1jlvxxvwnz6pvkjmfd3nqayd8n15r9jbqi2amrp31z0gq0p";
+  };
+
+  meta = with lib; {
+    description = "CHANGELOG generator implemented in Go (Golang)";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ldenefle ];
+  };
+}
+

pkgs/applications/version-management/git-lfs/default.nix

@@ -2,13 +2,13 @@
 
 buildGoPackage rec {
   pname = "git-lfs";
-  version = "2.12.0";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "git-lfs";
     repo = "git-lfs";
-    sha256 = "0pyvlcy6jxh0vzpsmywlbzwwdyj3jkcclnqb6sg786mmwrnqzj88";
+    sha256 = "1x8s1w8yqhj5nm20knr2gkb59rwzx220nf099lgd62cajzsdpjx5";
   };
 
   goPackagePath = "github.com/git-lfs/git-lfs";

pkgs/applications/video/k9copy/default.nix

@@ -1,63 +0,0 @@
-{ stdenv, fetchurl
-, cmake
-, dvdauthor, xineLib, libmpeg2, libav, libdvdread, libdvdnav, dvdplusrwtools
-, phonon, qtx11extras
-, extra-cmake-modules, kio, kiconthemes, ki18n, kdesu, kdoctools, solid
-}:
-
-stdenv.mkDerivation rec {
-  version = "3.0.3";
-  pname = "k9copy";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/k9copy-reloaded/${pname}-${version}.tar.gz";
-    sha256 = "0dp06rwihks50c57bbv04d6bj2qc88isl91971r4lii2xp0qn7sg";
-  };
-
-  patches = [
-    ./gcc6.patch
-  ];
-
-  cmakeFlags = [
-    "-DQT5_BUILD=ON"
-    "-DCMAKE_MINIMUM_REQUIRED_VERSION=3.0"
-  ];
-
-  # Hack to disable documentation
-  preConfigure = ''
-   substituteInPlace ./CMakeLists.txt \
-     --replace "add_subdirectory(doc)" ""
-  '';
-
-  buildInputs = [
-    cmake
-    dvdauthor
-    xineLib
-    libmpeg2
-    libav
-    libdvdread
-    libdvdnav
-    dvdplusrwtools
-    #automoc4
-    phonon
-    extra-cmake-modules
-    kio
-    solid
-    qtx11extras
-    kiconthemes
-    ki18n
-    kdesu
-  ];
-  nativeBuildInputs = [ kdoctools ];
-
-  meta = {
-    description = "DVD backup and DVD authoring program";
-    homepage = "http://k9copy-reloaded.sourceforge.net/";
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = with stdenv.lib.maintainers; [ flosse ];
-    platforms = stdenv.lib.platforms.unix;
-    # TODO: The software is deprecated and the build is broken, see:
-    # https://github.com/NixOS/nixpkgs/pull/63260#issuecomment-503506487
-    broken = true;
-  };
-}

pkgs/applications/video/k9copy/gcc6.patch

@@ -1,26 +0,0 @@
-diff --git c/src/backup/k9dvdbackup.cpp i/src/backup/k9dvdbackup.cpp
-index f5e4859..82fa392 100755
---- c/src/backup/k9dvdbackup.cpp
-+++ i/src/backup/k9dvdbackup.cpp
-@@ -907,7 +907,7 @@ k9Vobu * k9DVDBackup::remapOffset(uint32_t _sector,uint32_t *_offset,int _dir) {
- 
- 
-         if ((vobu1 !=NULL) && (vobu2!=NULL)) {
--            *_offset = abs(vobu1->newSector - vobu2->newSector)  | maskOffset1 ;
-+            *_offset = (vobu1->newSector - vobu2->newSector)  | maskOffset1 ;
-             *_offset |= maskOffset2;
-             return vobu2;
-         }
-diff --git c/src/backup/k9execcopy.cpp i/src/backup/k9execcopy.cpp
-index d59222c..35de923 100644
---- c/src/backup/k9execcopy.cpp
-+++ i/src/backup/k9execcopy.cpp
-@@ -306,7 +306,7 @@ void k9ExecCopy::createMkv(k9DVDTitle *_title,const QString &_filename,QMultiMap
- 
- #if QT_VERSION >= 0x050000
-     m_progressDialog=new QProgressDialog(k9Dialogs::getMainWidget() );
--    m_progressDialog->setCancelButton(false);
-+    m_progressDialog->setCancelButton(0);
- 
- #else
-     m_progressDialog=new KProgressDialog(k9Dialogs::getMainWidget() );

pkgs/applications/virtualization/singularity/default.nix

@@ -18,11 +18,11 @@ with lib;
 
 buildGoPackage rec {
   pname = "singularity";
-  version = "3.6.3";
+  version = "3.6.4";
 
   src = fetchurl {
     url = "https://github.com/hpcng/singularity/releases/download/v${version}/singularity-${version}.tar.gz";
-    sha256 = "1zd29s8lggv4x5xracgzywayg1skl9qc2bqh1zdxh1wrg9sqbadi";
+    sha256 = "17z7v7pjq1ibl64ir4h183sp58v2x7iv6dn6imnnhkdvss0kl8vi";
   };
 
   goPackagePath = "github.com/sylabs/singularity";

pkgs/data/fonts/ttf-tw-moe/default.nix

@@ -0,0 +1,27 @@
+{ stdenv, fetchzip }:
+
+fetchzip {
+  name = "ttf-tw-moe";
+
+  url = "https://github.com/Jiehong/TW-fonts/archive/b30ae75e9dc299afd61e31cfd43f7a0a157dfb1f.zip";
+
+  postFetch = ''
+    mkdir -p $out/share/fonts
+    unzip -j $downloadedFile TW-fonts-b30ae75e9dc299afd61e31cfd43f7a0a157dfb1f/\*.ttf -d $out/share/fonts/truetype
+  '';
+
+  sha256 = "0khgxih9z6pqf7pdp21xjp24wb9ygsrdcmzpjb7vr9x8n78i1fbs";
+
+  meta = with stdenv.lib; {
+    homepage = "http://www.moe.gov.tw/";
+    description = "Set of KAI and SONG fonts from the Ministry of Education of Taiwan";
+    longDescription = ''
+      Installs 2 TTF fonts: MOESongUN and TW-MOE-Std-Kai.
+      Both are provided by the Ministry of Education of Taiwan; each character's shape
+      closely follows the official recommendation, and can be used as for teaching purposes.
+    '';
+    license = licenses.cc-by-nd-30;
+    maintainers = [ maintainers.jiehong ];
+    platforms = platforms.all;
+  };
+}

pkgs/development/compilers/go/1.14.nix

@@ -36,11 +36,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.14.10";
+  version = "1.14.11";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0rfnjl582cm5klv8c2qyyvn26807zn89m5mk282gkc7awfkrjxmk";
+    sha256 = "05hgnyda5bpm29gnx1956syq54jmpk4k9cf976vypw8ckg9g6w8q";
   };
 
   # perl is used for testing go vet

pkgs/development/compilers/go/1.15.nix

@@ -36,11 +36,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "go";
-  version = "1.15.3";
+  version = "1.15.4";
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "1228nv4vyzbqv768dl0bimsic47x9yyqld61qbgqqk75f0jn0sl9";
+    sha256 = "0rr3gp99bmdzg381x5fdwa15brllihn57175l0c82sqqljlscg86";
   };
 
   # perl is used for testing go vet

pkgs/development/compilers/openjdk/default.nix

@@ -31,6 +31,10 @@ let
       gtk3 gnome_vfs GConf glib
     ];
 
+    passthru = {
+      inherit gtk3;
+    };
+
     patches = [
       ./fix-java-home-jdk10.patch
       ./read-truststore-from-env-jdk10.patch

pkgs/development/compilers/openjdk/jre.nix

@@ -0,0 +1,19 @@
+{ jdk
+, runCommand
+, patchelf
+, lib
+, modules ? [ "java.base" ]
+}:
+
+let
+  jre = runCommand "${jdk.name}-jre" {
+    nativeBuildInputs = [ patchelf ];
+    buildInputs = [ jdk ];
+    passthru = {
+      home = "${jre}";
+    };
+  }   ''
+      jlink --module-path ${jdk}/lib/openjdk/jmods --add-modules ${lib.concatStringsSep "," modules} --output $out
+      patchelf --shrink-rpath $out/bin/* $out/lib/jexec $out/lib/jspawnhelper $out/lib/*.so $out/lib/*/*.so
+  '';
+in jre

pkgs/development/compilers/scala/2.10.nix

@@ -1,43 +0,0 @@
-{ stdenv, fetchurl, makeWrapper, jre, gnugrep, coreutils }:
-
-stdenv.mkDerivation rec {
-  name = "scala-2.10.7";
-
-  src = fetchurl {
-    url = "https://www.scala-lang.org/files/archive/${name}.tgz";
-    sha256 = "04gi55lzgrhsb78qw8jmnccqim92rw6898knw0a7gfzn2sci30wj";
-  };
-
-  propagatedBuildInputs = [ jre ] ;
-  buildInputs = [ makeWrapper ] ;
-
-  installPhase = ''
-    mkdir -p $out
-    rm bin/*.bat
-    mv * $out
-
-    for p in $(ls $out/bin/) ; do
-      wrapProgram $out/bin/$p \
-        --prefix PATH ":" ${coreutils}/bin \
-        --prefix PATH ":" ${gnugrep}/bin \
-        --prefix PATH ":" ${jre}/bin \
-        --set JAVA_HOME ${jre}
-    done
-  '';
-
-  meta = {
-    description = "A general purpose programming language";
-    longDescription = ''
-      Scala is a general purpose programming language designed to express
-      common programming patterns in a concise, elegant, and type-safe way.
-      It smoothly integrates features of object-oriented and functional
-      languages, enabling Java and other programmers to be more productive.
-      Code sizes are typically reduced by a factor of two to three when
-      compared to an equivalent Java application.
-    '';
-    homepage = "https://www.scala-lang.org/";
-    license = stdenv.lib.licenses.bsd3;
-    platforms = stdenv.lib.platforms.all;
-    branch = "2.10";
-  };
-}

pkgs/development/compilers/scala/2.11.nix

@@ -1,48 +0,0 @@
-{ stdenv, fetchurl, makeWrapper, jre, gnugrep, coreutils }:
-
-stdenv.mkDerivation rec {
-  name = "scala-2.11.12";
-
-  src = fetchurl {
-    url = "https://www.scala-lang.org/files/archive/${name}.tgz";
-    sha256 = "1a4nc4qp9dm4rps47j92hlmxxqskv67qbdmjqc5zd94wd4rps7di";
-  };
-
-  propagatedBuildInputs = [ jre ] ;
-  buildInputs = [ makeWrapper ] ;
-
-  installPhase = ''
-    mkdir -p $out
-    rm "bin/"*.bat
-    mv * $out
-
-    # put docs in correct subdirectory
-    mkdir -p $out/share/doc
-    mv $out/doc $out/share/doc/${name}
-    mv $out/man $out/share/man
-
-    for p in $(ls $out/bin/) ; do
-      wrapProgram $out/bin/$p \
-        --prefix PATH ":" ${coreutils}/bin \
-        --prefix PATH ":" ${gnugrep}/bin \
-        --prefix PATH ":" ${jre}/bin \
-        --set JAVA_HOME ${jre}
-    done
-  '';
-
-  meta = {
-    description = "General purpose programming language";
-    longDescription = ''
-      Scala is a general purpose programming language designed to express
-      common programming patterns in a concise, elegant, and type-safe way.
-      It smoothly integrates features of object-oriented and functional
-      languages, enabling Java and other programmers to be more productive.
-      Code sizes are typically reduced by a factor of two to three when
-      compared to an equivalent Java application.
-    '';
-    homepage = "https://www.scala-lang.org/";
-    license = stdenv.lib.licenses.bsd3;
-    platforms = stdenv.lib.platforms.all;
-    branch = "2.11";
-  };
-}

pkgs/development/compilers/scala/2.12.nix

@@ -1,47 +0,0 @@
-{ stdenv, fetchurl, makeWrapper, jre, gnugrep, coreutils }:
-
-stdenv.mkDerivation rec {
-  name = "scala-2.12.12";
-
-  src = fetchurl {
-    url = "https://www.scala-lang.org/files/archive/${name}.tgz";
-    sha256 = "0avyaa7y8w7494339krcpqhc2p8y5pjk4pz7mqmzdzwy7hgws81m";
-  };
-
-  propagatedBuildInputs = [ jre ] ;
-  buildInputs = [ makeWrapper ] ;
-
-  installPhase = ''
-    mkdir -p $out
-    rm "bin/"*.bat
-    mv * $out
-
-    # put docs in correct subdirectory
-    mkdir -p $out/share/doc
-    mv $out/doc $out/share/doc/scala
-    mv $out/{LICENSE,NOTICE} $out/share/doc/scala
-
-    for p in $(ls $out/bin/) ; do
-      wrapProgram $out/bin/$p \
-        --prefix PATH ":" ${coreutils}/bin \
-        --prefix PATH ":" ${gnugrep}/bin \
-        --prefix PATH ":" ${jre}/bin \
-        --set JAVA_HOME ${jre}
-    done
-  '';
-
-  meta = {
-    description = "General purpose programming language";
-    longDescription = ''
-      Scala is a general purpose programming language designed to express
-      common programming patterns in a concise, elegant, and type-safe way.
-      It smoothly integrates features of object-oriented and functional
-      languages, enabling Java and other programmers to be more productive.
-      Code sizes are typically reduced by a factor of two to three when
-      compared to an equivalent Java application.
-    '';
-    homepage = "https://www.scala-lang.org/";
-    license = stdenv.lib.licenses.bsd3;
-    platforms = stdenv.lib.platforms.all;
-  };
-}

pkgs/development/compilers/scala/2.13.nix

@@ -1,47 +0,0 @@
-{ stdenv, fetchurl, makeWrapper, jre, gnugrep, coreutils }:
-
-stdenv.mkDerivation rec {
-  name = "scala-2.13.3";
-
-  src = fetchurl {
-    url = "https://www.scala-lang.org/files/archive/${name}.tgz";
-    sha256 = "0zv9w9f6g2cfydsvp8mqcfgv2v3487xp4ca1qndg6v7jrhdp7wy9";
-  };
-
-  propagatedBuildInputs = [ jre ] ;
-  buildInputs = [ makeWrapper ] ;
-
-  installPhase = ''
-    mkdir -p $out
-    rm "bin/"*.bat
-    mv * $out
-
-    # put docs in correct subdirectory
-    mkdir -p $out/share/doc
-    mv $out/doc $out/share/doc/scala
-    mv $out/{LICENSE,NOTICE} $out/share/doc/scala
-
-    for p in $(ls $out/bin/) ; do
-      wrapProgram $out/bin/$p \
-        --prefix PATH ":" ${coreutils}/bin \
-        --prefix PATH ":" ${gnugrep}/bin \
-        --prefix PATH ":" ${jre}/bin \
-        --set JAVA_HOME ${jre}
-    done
-  '';
-
-  meta = {
-    description = "General purpose programming language";
-    longDescription = ''
-      Scala is a general purpose programming language designed to express
-      common programming patterns in a concise, elegant, and type-safe way.
-      It smoothly integrates features of object-oriented and functional
-      languages, enabling Java and other programmers to be more productive.
-      Code sizes are typically reduced by a factor of two to three when
-      compared to an equivalent Java application.
-    '';
-    homepage = "https://www.scala-lang.org/";
-    license = stdenv.lib.licenses.bsd3;
-    platforms = stdenv.lib.platforms.all;
-  };
-}

pkgs/development/compilers/scala/2.x.nix

@@ -0,0 +1,117 @@
+{ stdenv, lib, fetchurl, makeWrapper, jre, gnugrep, coreutils, nixosTests
+, writeScript, common-updater-scripts, git, gnused, nix, nixfmt }:
+
+with lib;
+
+let
+  repo = "git@github.com:scala/scala.git";
+
+  common = { version, sha256, test, pname }:
+    stdenv.mkDerivation rec {
+      inherit version;
+
+      name = "scala-${version}";
+
+      src = fetchurl {
+        inherit sha256;
+        url = "https://www.scala-lang.org/files/archive/scala-${version}.tgz";
+      };
+
+      propagatedBuildInputs = [ jre ];
+      buildInputs = [ makeWrapper ];
+
+      installPhase = ''
+        mkdir -p $out
+        rm bin/*.bat
+        mv * $out
+
+        # put docs in correct subdirectory
+        mkdir -p $out/share/doc
+        mv $out/doc $out/share/doc/${name}
+        mv $out/man $out/share/man
+
+        for p in $(ls $out/bin/) ; do
+          wrapProgram $out/bin/$p \
+            --prefix PATH ":" ${coreutils}/bin \
+            --prefix PATH ":" ${gnugrep}/bin \
+            --prefix PATH ":" ${jre}/bin \
+            --set JAVA_HOME ${jre}
+        done
+      '';
+
+      passthru = {
+        tests = [ test ];
+
+        updateScript = writeScript "update.sh" ''
+          #!${stdenv.shell}
+          set -o errexit
+          PATH=${
+            stdenv.lib.makeBinPath [
+              common-updater-scripts
+              coreutils
+              git
+              gnused
+              nix
+              nixfmt
+            ]
+          }
+          versionSelect='v${versions.major version}.${versions.minor version}.*'
+          oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion ${pname}" | tr -d '"')"
+          latestTag="$(git -c 'versionsort.suffix=-' ls-remote --exit-code --refs --sort='version:refname' --tags ${repo} "$versionSelect" | tail --lines=1 | cut --delimiter='/' --fields=3 | sed 's|^v||g')"
+          if [ "$oldVersion" != "$latestTag" ]; then
+            nixpkgs="$(git rev-parse --show-toplevel)"
+            default_nix="$nixpkgs/pkgs/development/compilers/scala/2.x.nix"
+            update-source-version ${pname} "$latestTag" --version-key=version --print-changes
+            nixfmt "$default_nix"
+          else
+            echo "${pname} is already up-to-date"
+          fi
+        '';
+      };
+
+      meta = {
+        description = "A general purpose programming language";
+        longDescription = ''
+          Scala is a general purpose programming language designed to express
+          common programming patterns in a concise, elegant, and type-safe way.
+          It smoothly integrates features of object-oriented and functional
+          languages, enabling Java and other programmers to be more productive.
+          Code sizes are typically reduced by a factor of two to three when
+          compared to an equivalent Java application.
+        '';
+        homepage = "https://www.scala-lang.org/";
+        license = licenses.bsd3;
+        platforms = platforms.all;
+        branch = versions.majorMinor version;
+        maintainers = [ maintainers.nequissimus ];
+      };
+    };
+in {
+  scala_2_10 = common {
+    version = "2.10.7";
+    sha256 = "koMRmRb2u3cU4HaihAzPItWIGbNVIo7RWRrm92kp8RE=";
+    test = { inherit (nixosTests) scala_2_10; };
+    pname = "scala_2_10";
+  };
+
+  scala_2_11 = common {
+    version = "2.11.12";
+    sha256 = "sR19M2mcpPYLw7K2hY/ZU+PeK4UiyUP0zaS2dDFhlqg=";
+    test = { inherit (nixosTests) scala_2_11; };
+    pname = "scala_2_11";
+  };
+
+  scala_2_12 = common {
+    version = "2.12.12";
+    sha256 = "NSDNHzye//YrrudfMuUtHl3BIL4szzQGSeRw5I9Sfis=";
+    test = { inherit (nixosTests) scala_2_12; };
+    pname = "scala_2_12";
+  };
+
+  scala_2_13 = common {
+    version = "2.13.3";
+    sha256 = "yfNzG8zybPOaxUExcvtBZGyxn2O4ort1846JZ1ziaX8=";
+    test = { inherit (nixosTests) scala_2_13; };
+    pname = "scala_2_13";
+  };
+}

pkgs/development/compilers/solc/default.nix

@@ -1,32 +1,37 @@
-{ stdenv, fetchzip, boost, cmake, ncurses, python3, coreutils
+{ gccStdenv, fetchzip, boost, cmake, ncurses, python3, coreutils
 , z3Support ? true, z3 ? null, cvc4Support ? true, cvc4 ? null
 , cln ? null, gmp ? null
 }:
 
+# compiling source/libsmtutil/CVC4Interface.cpp breaks on clang on Darwin,
+# general commandline tests fail at abiencoderv2_no_warning/ on clang on NixOS
+let stdenv = gccStdenv; in
+
 assert z3Support -> z3 != null && stdenv.lib.versionAtLeast z3.version "4.6.0";
 assert cvc4Support -> cvc4 != null && cln != null && gmp != null;
 
 let
-  jsoncppURL = "https://github.com/open-source-parsers/jsoncpp/archive/1.9.2.tar.gz";
+  jsoncppVersion = "1.9.4";
+  jsoncppUrl = "https://github.com/open-source-parsers/jsoncpp/archive/${jsoncppVersion}.tar.gz";
   jsoncpp = fetchzip {
-    url = jsoncppURL;
+    url = jsoncppUrl;
-    sha256 = "037d1b1qdmn3rksmn1j71j26bv4hkjv7sn7da261k853xb5899sg";
+    sha256 = "0qnx5y6c90fphl9mj9d20j2dfgy6s5yr5l0xnzid0vh71zrp6jwv";
   };
 in
 stdenv.mkDerivation rec {
 
   pname = "solc";
-  version = "0.6.8";
+  version = "0.7.4";
 
   # upstream suggests avoid using archive generated by github
   src = fetchzip {
     url = "https://github.com/ethereum/solidity/releases/download/v${version}/solidity_${version}.tar.gz";
-    sha256 = "1nxds6c10hjqjjk893qw2yljws57li0xigbf3ih85y8y6d587ph0";
+    sha256 = "02261l54jdbvxk612z7zsyvmchy1rx4lf27b3f616sd7r56krpkg";
   };
 
   postPatch = ''
     substituteInPlace cmake/jsoncpp.cmake \
-      --replace "${jsoncppURL}" ${jsoncpp}
+      --replace "${jsoncppUrl}" ${jsoncpp}
   '';
 
   cmakeFlags = [

pkgs/development/compilers/spasm-ng/default.nix

@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, gcc, gmp, openssl, zlib }:
+
+stdenv.mkDerivation rec {
+  pname = "spasm-ng";
+
+  version = "unstable-2020-08-03";
+
+  src = fetchFromGitHub {
+    owner = "alberthdev";
+    repo = "spasm-ng";
+    rev = "221898beff2442f459b80ab89c8e1035db97868e";
+    sha256 = "0xspxmp2fir604b4xsk4hi1gjv61rnq2ypppr7cj981jlhicmvjj";
+  };
+
+  nativeBuildInputs = [ gcc ];
+
+  buildInputs = [ gmp openssl zlib ];
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    install -Dm755 spasm -t $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    homepage    = "https://github.com/alberthdev/spasm-ng";
+    description = "Z80 assembler with extra features to support development for TI calculators";
+    license     = licenses.gpl2Plus;
+    maintainers = with maintainers; [ siraben ];
+    platforms   = platforms.unix;
+  };
+}

pkgs/development/go-modules/generic/default.nix

@@ -136,10 +136,10 @@ let
       export GOSUMDB=off
       export GOPROXY=off
       cd "$modRoot"
-      if [ -n "${go-modules}" ]; then
+    '' + lib.optionalString (go-modules != "") ''
-          rm -rf vendor
+      rm -rf vendor
-          ln -s ${go-modules} vendor
+      cp -r --reflink=auto ${go-modules} vendor
-      fi
+    '' + ''
 
       runHook postConfigure
     '';

pkgs/development/interpreters/clojure/babashka.nix

@@ -1,25 +1,25 @@
-{ stdenv, fetchurl, graalvm8-ce, glibcLocales }:
+{ stdenv, fetchurl, graalvm11-ce, glibcLocales }:
 
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "babashka";
-  version = "0.0.97";
+  version = "0.2.3";
 
   reflectionJson = fetchurl {
     name = "reflection.json";
     url = "https://github.com/borkdude/${pname}/releases/download/v${version}/${pname}-${version}-reflection.json";
-    sha256 = "1gd9ih9l02n1j9qkbxb36d3cb5sddwvxiw8kkicgc4xig77lsa7z";
+    sha256 = "0lbdh3v3g3j00bn99bjhjj3gk1q9ks2alpvl9bxc00xpyw86f7z8";
   };
 
   src = fetchurl {
     url = "https://github.com/borkdude/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "08py6bawfrhg90fbcnv2mq4c91g5wa1q2q6zdjy2i1b9q4x1654r";
+    sha256 = "0vh6k3dkzyk346jjzg6n4mdi65iybrmhb3js9lm73yc3ay2c5dyi";
   };
 
   dontUnpack = true;
 
   LC_ALL = "en_US.UTF-8";
-  nativeBuildInputs = [ graalvm8-ce glibcLocales ];
+  nativeBuildInputs = [ graalvm11-ce glibcLocales ];
 
   buildPhase = ''
     native-image \
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://github.com/borkdude/babashka";
     license = licenses.epl10;
-    platforms = graalvm8-ce.meta.platforms;
+    platforms = graalvm11-ce.meta.platforms;
     maintainers = with maintainers; [ bandresen bhougland DerGuteMoritz jlesquembre ];
   };
 }

pkgs/development/interpreters/php/default.nix

@@ -273,16 +273,16 @@ let
         };
 
   php73base = callPackage generic (_args // {
-    version = "7.3.23";
+    version = "7.3.24";
-    sha256 = "0k600imsxm3r3qdv20ryqhvfmnkmjhvm2hcnqr180l058snncrpx";
+    sha256 = "1655rj4w63n5fkvdj3kz9f5jfyjgvzw8a6j8zkzgic1p42xszdsm";
 
     # https://bugs.php.net/bug.php?id=76826
     extraPatches = lib.optional stdenv.isDarwin ./php73-darwin-isfinite.patch;
   });
 
   php74base = callPackage generic (_args // {
-    version = "7.4.11";
+    version = "7.4.12";
-    sha256 = "1idq2sk3x6msy8l2g42jv3y87h1fgb1aybxw7wpjkliv4iaz422l";
+    sha256 = "0rwrl7xgfq2bbgmy34klgfsqa7v935074ibanmic9pwy4g676vvf";
   });
 
   defaultPhpExtensions = { all, ... }: with all; ([

pkgs/development/interpreters/spidermonkey/78.nix

@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "spidermonkey";
-  version = "78.1.0";
+  version = "78.4.0";
 
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}esr/source/firefox-${version}esr.source.tar.xz";
-    sha256 = "18k47dl9hbnpqw69csxjar5dhwa7r8k7j9kvcfgmwb1iv6ba601n";
+    sha256 = "1z3hj45bnd12z3g6ajv9qrgclca7fymi1sxj9l9nh9q6y6xz0g4f";
   };
 
   outputs = [ "out" "dev" ];
@@ -52,18 +52,6 @@ stdenv.mkDerivation rec {
     zlib
   ];
 
-  patches = [
-    # https://mail.gnome.org/archives/distributor-list/2020-August/msg00000.html
-    (fetchpatch {
-      url = "https://github.com/ptomato/mozjs/commit/b2974f8a6558d2dc4517b49ee313a9900a853285.patch";
-      sha256 = "1bl5mbx7gmad6fmpc427263i1ychi2linpg69kxlr2w91r5m6ji3";
-    })
-    (fetchpatch {
-      url = "https://github.com/ptomato/mozjs/commit/e5a2eb99f653ae03c67e536df1d55d265a0a1605.patch";
-      sha256 = "0xhy63nw2byibmjc41yh6dwpg282nylganrs5aprn9pbqbcpsvif";
-    })
-  ];
-
   preConfigure = ''
     export CXXFLAGS="-fpermissive"
     export LIBXUL_DIST=$out
@@ -101,9 +89,9 @@ stdenv.mkDerivation rec {
 
   # Remove unnecessary static lib
   preFixup = ''
-    moveToOutput bin/js60-config "$dev"
+    moveToOutput bin/js78-config "$dev"
     rm $out/lib/libjs_static.ajs
-    ln -s $out/bin/js60 $out/bin/js
+    ln -s $out/bin/js78 $out/bin/js
   '';
 
   enableParallelBuilding = true;
@@ -112,7 +100,7 @@ stdenv.mkDerivation rec {
     description = "Mozilla's JavaScript engine written in C/C++";
     homepage = "https://developer.mozilla.org/en/SpiderMonkey";
     license = licenses.gpl2; # TODO: MPL/GPL/LGPL tri-license.
-    maintainers = [ maintainers.abbradar ];
+    maintainers = with maintainers; [ abbradar lostnet ];
     platforms = platforms.linux;
   };
 }

pkgs/development/libraries/amdvlk/default.nix

@@ -21,13 +21,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "amdvlk";
-  version = "2020.Q4.2";
+  version = "2020.Q4.3";
 
   src = fetchRepoProject {
     name = "${pname}-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
     rev = "refs/tags/v-${version}";
-    sha256 = "qqP95+K8G9Z3Da1pUT9EGAUi83IM50qI9eZxpp7Vlqg=";
+    sha256 = "O1+w2R9Fvoc+1vegiCkBA9pE/yi/p0aK82fY4jML/2c=";
   };
 
   buildInputs = [

pkgs/development/libraries/libvirt/5.9.0.nix

@@ -36,12 +36,12 @@ in stdenv.mkDerivation rec {
   nativeBuildInputs = [ makeWrapper pkgconfig rpcsvc-proto ];
   buildInputs = [
     libxml2 gnutls perl python2 readline gettext libtasn1 libgcrypt yajl
-    libxslt xhtml1 perlPackages.XMLXPath curl libpcap glib libtirpc
+    libxslt xhtml1 perlPackages.XMLXPath curl libpcap glib
   ] ++ optionals (!buildFromTarball) [
     libtool autoconf automake
   ] ++ optionals stdenv.isLinux [
     libpciaccess lvm2 utillinux systemd libnl numad zfs
-    libapparmor libcap_ng numactl attr parted
+    libapparmor libcap_ng numactl attr parted libtirpc
   ] ++ optionals (enableXen && stdenv.isLinux && stdenv.isx86_64) [
     xen
   ] ++ optionals enableIscsi [

pkgs/development/libraries/pipewire/default.nix

@@ -40,7 +40,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "pipewire";
-  version = "0.3.13";
+  version = "0.3.15";
 
   outputs = [
     "out"
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     owner = "pipewire";
     repo = "pipewire";
     rev = version;
-    sha256 = "19j5kmb7iaivkq2agfzncfm2qms41ckqi0ddxvhpc91ihwprdc5w";
+    sha256 = "1lmsn13pbr0cigb5ri9nd3102ffbaf8nsz5c8aawf6lsz7mhkx9x";
   };
 
   patches = [
@@ -65,13 +65,6 @@ stdenv.mkDerivation rec {
     ./alsa-profiles-use-libdir.patch
     # Move installed tests into their own output.
     ./installed-tests-path.patch
-
-    # TODO Remove this on next update
-    # Fixes rpath referencecs.
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/pipewire/pipewire/commit/2e3556fa128b778be62a7ffad5fbe78393035825.diff";
-      sha256 = "039yysb8j1aiqml54rxnaqfmzqz1b6m8sv5w3vz52grvav3kyr1l";
-    })
   ];
 
   nativeBuildInputs = [

pkgs/development/libraries/qrupdate/default.nix

@@ -3,25 +3,35 @@
 , gfortran
 , blas
 , lapack
+, which
 }:
-stdenv.mkDerivation {
+
-  name = "qrupdate-1.1.2";
+stdenv.mkDerivation rec {
+  pname = "qrupdate";
+  version = "1.1.2";
   src = fetchurl {
-    url = "mirror://sourceforge/qrupdate/qrupdate-1.1.2.tar.gz";
+    url = "mirror://sourceforge/qrupdate/${pname}-${version}.tar.gz";
     sha256 = "024f601685phcm1pg8lhif3lpy5j9j0k6n0r46743g4fvh8wg8g2";
   };
 
-  configurePhase =
+  preBuild =
-    ''
+    # Check that blas and lapack are compatible
-      export PREFIX=$out
+    assert (blas.isILP64 == lapack.isILP64);
-      sed -i -e 's,^BLAS=.*,BLAS=-L${blas}/lib -lblas,' \
+  # We don't have structuredAttrs yet implemented, and we need to use space
-          -e 's,^LAPACK=.*,LAPACK=-L${lapack}/lib -llapack,' \
+  # seprated values in makeFlags, so only this works.
-          Makeconf
+  ''
-    ''
+    makeFlagsArray+=(
-    + stdenv.lib.optionalString blas.isILP64
+      "LAPACK=-L${lapack}/lib -llapack"
-    ''
+      "BLAS=-L${blas}/lib -lblas"
-      sed -i Makeconf -e '/^FFLAGS=.*/ s/$/-fdefault-integer-8/'
+      "PREFIX=${placeholder "out"}"
-    '';
+      ${stdenv.lib.optionalString blas.isILP64
+      # Use their FFLAGS along with `-fdefault-integer-8`. If another
+      # application intends to use arpack, it should add this to it's FFLAGS as
+      # well. Otherwise (e.g): https://savannah.gnu.org/bugs/?50339
+      "FFLAGS=-fimplicit-none -O3 -funroll-loops -fdefault-integer-8"
+      }
+    )
+  '';
 
   doCheck = true;
 
@@ -31,12 +41,15 @@ stdenv.mkDerivation {
 
   installTargets = stdenv.lib.optionals stdenv.isDarwin [ "install-staticlib" "install-shlib" ];
 
-  buildInputs = [ gfortran blas lapack ];
+  buildInputs = [ gfortran ];
+
+  nativeBuildInputs = [ which ];
 
   meta = with stdenv.lib; {
     description = "Library for fast updating of qr and cholesky decompositions";
     homepage = "https://sourceforge.net/projects/qrupdate/";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ doronbehar ];
     platforms = platforms.unix;
   };
 }

pkgs/development/libraries/science/math/petsc/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "petsc";
-  version = "3.13.4";
+  version = "3.14.0";
 
   src = fetchurl {
     url = "http://ftp.mcs.anl.gov/pub/petsc/release-snapshots/petsc-${version}.tar.gz";
-    sha256 = "1n2paqw5c0ja392s1qhp7q2ypwav8s5drxxz2w5m2cn31vbspy1c";
+    sha256 = "1hq3igm90bnl44vyjdbkpqmqk7496pakcswzc2vq57l8d27nhdxz";
   };
 
   nativeBuildInputs = [ blas gfortran gfortran.cc.lib lapack python ];

pkgs/development/libraries/waffle/default.nix

@@ -0,0 +1,54 @@
+{ stdenv
+, fetchFromGitLab
+, lib
+, cmake
+, libGL
+, libglvnd
+, makeWrapper
+, pkg-config
+, wayland
+, libxcb
+, libX11
+}:
+
+stdenv.mkDerivation rec {
+  pname = "waffle";
+  version = "1.6.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "mesa";
+    repo = "waffle";
+    rev = "v${version}";
+    sha256 = "0s8gislmhccfa04zsj1yqk97lscbbnmxirr2zm4q3p8ybmpfhpqr";
+  };
+
+  buildInputs = [
+    libGL
+    libglvnd
+    libX11
+    libxcb
+    wayland
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+    pkg-config
+  ];
+
+  cmakeFlags = [ "-Dplatforms=x11,wayland" ];
+
+  postInstall = ''
+    wrapProgram $out/bin/wflinfo \
+      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ libGL libglvnd ]}
+  '';
+
+  meta = with lib; {
+    description = "A cross-platform C library that allows one to defer selection of an OpenGL API and window system until runtime";
+    homepage = "http://www.waffle-gl.org/";
+    license = licenses.bsd2;
+    platforms = platforms.mesaPlatforms;
+    maintainers = with maintainers; [ Flakebi ];
+  };
+}

pkgs/development/ocaml-modules/apron/default.nix

@@ -13,8 +13,21 @@ stdenv.mkDerivation rec {
   buildInputs = [ perl gmp mpfr ppl ocaml findlib camlidl ];
   propagatedBuildInputs = [ mlgmpidl ];
 
-  prefixKey = "-prefix ";
+  outputs = [ "out" "bin" "dev" ];
-  preBuild = "mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/stublibs";
+
+  configurePhase = ''
+    runHook preConfigure
+    ./configure -prefix $out
+    mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/stublibs
+    runHook postConfigure
+  '';
+
+  postInstall = ''
+    mkdir -p $dev/lib
+    mv $out/lib/ocaml $dev/lib/
+    mkdir -p $bin
+    mv $out/bin $bin/
+  '';
 
   meta = {
     license = stdenv.lib.licenses.lgpl21;

pkgs/development/ocaml-modules/mirage-console/default.nix

@@ -0,0 +1,24 @@
+{ lib, fetchurl, buildDunePackage
+, lwt, mirage-device, mirage-flow
+}:
+
+buildDunePackage rec {
+  pname = "mirage-console";
+  version = "3.0.2";
+
+  useDune2 = true;
+
+  src = fetchurl {
+    url = "https://github.com/mirage/mirage-console/releases/download/v${version}/mirage-console-v${version}.tbz";
+    sha256 = "1fygk7pvlmwx6vd0h4cv9935xxhi64k2dgym41wf6qfkxgpp31lm";
+  };
+
+  propagatedBuildInputs = [ lwt mirage-device mirage-flow ];
+
+  meta = {
+    description = "Implementations of Mirage console devices";
+    homepage = "https://github.com/mirage/mirage-console";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}

pkgs/development/ocaml-modules/mirage-logs/default.nix

@@ -0,0 +1,28 @@
+{ lib, fetchurl, buildDunePackage
+, logs, lwt, mirage-clock, mirage-profile, ptime
+, alcotest
+}:
+
+buildDunePackage rec {
+  pname = "mirage-logs";
+  version = "1.2.0";
+
+  useDune2 = true;
+
+  src = fetchurl {
+    url = "https://github.com/mirage/mirage-logs/releases/download/v${version}/mirage-logs-v${version}.tbz";
+    sha256 = "0h0amzjxy067jljscib7fvw5q8k0adqa8m86affha9hq5jsh07a1";
+  };
+
+  propagatedBuildInputs = [ logs lwt mirage-clock mirage-profile ptime ];
+
+  doCheck = true;
+  checkInputs = [ alcotest ];
+
+  meta = {
+    description = "A reporter for the Logs library that writes log messages to stderr, using a Mirage `CLOCK` to add timestamps";
+    homepage = "https://github.com/mirage/mirage-logs";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}

pkgs/development/ocaml-modules/owl-base/default.nix

@@ -1,23 +1,19 @@
-{ stdenv, buildDunePackage, fetchFromGitHub, stdlib-shims }:
+{ lib, buildDunePackage, fetchurl }:
 
 buildDunePackage rec {
   pname = "owl-base";
-  version = "0.9.0";
+  version = "0.10.0";
 
   useDune2 = true;
 
-  src = fetchFromGitHub {
+  src = fetchurl {
-    owner = "owlbarn";
+    url = "https://github.com/owlbarn/owl/releases/download/${version}/owl-${version}.tbz";
-    repo = "owl";
+    sha256 = "148ny2cdzga1l36kcibvlz5xlyi5zvkywifxaqn8lf79n1swmlzf";
-    rev  = version;
-    sha256 = "0xxchsymmdbwszs6barqq8x4vqz5hbap64yxq82c2la9sdxgk0vv";
   };
 
-  propagatedBuildInputs = [ stdlib-shims ];
-
   minimumOCamlVersion = "4.10";
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Numerical computing library for Ocaml";
     homepage = "https://ocaml.xyz";
     changelog = "https://github.com/owlbarn/owl/releases";

pkgs/development/python-modules/crytic-compile/default.nix

@@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder, pysha3 }:
+
+buildPythonPackage rec {
+  pname = "crytic-compile";
+  version = "0.1.9";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "crytic";
+    repo = "crytic-compile";
+    rev = version;
+    sha256 = "01mis7bqsh0l5vjl6jwibzy99djza35fxmywy56q8k4jbxwmdcna";
+  };
+
+  propagatedBuildInputs = [ pysha3 ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Abstraction layer for smart contract build systems";
+    homepage = "https://github.com/crytic/crytic-compile";
+    license = licenses.agpl3;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}

pkgs/development/python-modules/pyzmq/default.nix

@@ -1,6 +1,6 @@
 { buildPythonPackage
 , fetchPypi
-, pytest
+, pytestCheckHook
 , tornado
 , zeromq
 , py
@@ -16,23 +16,30 @@ buildPythonPackage rec {
     sha256 = "296540a065c8c21b26d63e3cea2d1d57902373b16e4256afe46422691903a438";
   };
 
-  checkInputs = [  pytest tornado ];
+  checkInputs = [
+    pytestCheckHook
+    tornado
+  ];
   buildInputs = [ zeromq ];
   propagatedBuildInputs = [ py ];
 
-  # test_socket.py seems to be hanging
+  # failing tests
-  # others fail
+  disabledTests = [
-  # for test_monitor: https://github.com/zeromq/pyzmq/issues/1272
+    "test_socket" # hangs
-  checkPhase = ''
+    "test_current"
-    py.test $out/${python.sitePackages}/zmq/ -k "not test_socket \
+    "test_instance"
-      and not test_current \
+    "test_callable_check"
-      and not test_instance \
+    "test_on_recv_basic"
-      and not test_callable_check \
+    "test_on_recv_wake"
-      and not test_on_recv_basic \
+    "test_monitor" # https://github.com/zeromq/pyzmq/issues/1272
-      and not test_on_recv_wake \
+    "test_cython"
-      and not test_monitor \
+    "test_asyncio" # hangs
-      and not test_cython"
+    "test_mockable" # fails
-  '';
+  ];
+
+  pytestFlagsArray = [
+    "$out/${python.sitePackages}/zmq/tests/" # Folder with tests
+  ];
 
   # Some of the tests use localhost networking.
   __darwinAllowLocalNetworking = true;

pkgs/development/python-modules/slither-analyzer/default.nix

@@ -1,7 +1,5 @@
 { lib, buildPythonPackage, fetchPypi, makeWrapper, pythonOlder
-, prettytable
+, crytic-compile, prettytable, setuptools, solc
-, setuptools
-, solc
 }:
 
 buildPythonPackage rec {
@@ -19,7 +17,7 @@ buildPythonPackage rec {
   };
 
   nativeBuildInputs = [ makeWrapper ];
-  propagatedBuildInputs = [ prettytable setuptools ];
+  propagatedBuildInputs = [ crytic-compile prettytable setuptools ];
 
   postFixup = ''
     wrapProgram $out/bin/slither \

pkgs/development/tools/rufo/Gemfile

@@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+
+gem 'rufo'

pkgs/development/tools/rufo/Gemfile.lock

@@ -0,0 +1,13 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    rufo (0.12.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  rufo
+
+BUNDLED WITH
+   2.1.4

pkgs/development/tools/rufo/default.nix

@@ -0,0 +1,16 @@
+{ bundlerApp, bundlerUpdateScript, lib }:
+
+bundlerApp {
+  pname = "rufo";
+  gemdir = ./.;
+  exes = [ "rufo" ];
+
+  passthru.updateScript = bundlerUpdateScript "rufo";
+
+  meta = with lib; {
+    description = "Ruby formatter";
+    homepage = "https://github.com/ruby-formatter/rufo";
+    license = licenses.mit;
+    maintainers = with maintainers; [ andersk ];
+  };
+}

pkgs/development/tools/rufo/gemset.nix

@@ -0,0 +1,12 @@
+{
+  rufo = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nwasskcm0nrf7f52019x4fvxa5zckj4fcvf4cdl0qflrcwb1l9f";
+      type = "gem";
+    };
+    version = "0.12.0";
+  };
+}

pkgs/games/osu-lazer/default.nix

@@ -13,13 +13,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "osu-lazer";
-  version = "2020.925.0";
+  version = "2020.1017.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     rev = version;
-    sha256 = "0838i3pdc1c44jm7mp86kvw5164w8f3faci73bzkq84g20ixwj2g";
+    sha256 = "0sz3l8cxi9vlryjd7cb86dh3gcanim2pvhag3cg5sslqzrrinp2v";
   };
 
   patches = [ ./bypass-tamper-detection.patch ];

pkgs/games/osu-lazer/deps.nix

@@ -586,8 +586,8 @@
   })
   (fetchNuGet {
     name = "ppy.osu.Framework";
-    version = "2020.925.0";
+    version = "2020.1009.0";
-    sha256 = "1244fxm7x4rqi43kp6l98bsbjc2yvv7dmpbajdr9fapqm37fdbdj";
+    sha256 = "0mqx9wjp639k56f0cjlrk67mq7c4h4vlglvss93dnvbb20ljn54r";
   })
   (fetchNuGet {
     name = "ppy.osu.Framework.NativeLibs";
@@ -596,8 +596,8 @@
   })
   (fetchNuGet {
     name = "ppy.osu.Game.Resources";
-    version = "2020.904.0";
+    version = "2020.1016.0";
-    sha256 = "0n0alpyxpf65mmnqidh044sh4nibsfj0m5n8hfmpjwq11wnpmbih";
+    sha256 = "1zsqmmlxbb2ncrlvha33cz0inbd6ijbcvxn0y0cysfkg7zb9iisy";
   })
   (fetchNuGet {
     name = "ppy.osuTK.NS20";

pkgs/os-specific/linux/kernel/hardened/patches.json

@@ -1,27 +1,27 @@
 {
     "4.14": {
-        "name": "linux-hardened-4.14.202.a.patch",
+        "name": "linux-hardened-4.14.204.a.patch",
-        "sha256": "0ns5yq087m7i7ciq2b4skxclnlym0zm5v0vjqvzi9r375fd0gm9s",
+        "sha256": "1vwja9mqycw3322p8a896l9mkxvzym6r9q17zfgwpqi3kvr9k74h",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.202.a/linux-hardened-4.14.202.a.patch"
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.204.a/linux-hardened-4.14.204.a.patch"
     },
     "4.19": {
-        "name": "linux-hardened-4.19.152.a.patch",
+        "name": "linux-hardened-4.19.155.a.patch",
-        "sha256": "0zc36yklzjb3sqd61m12c1988mazkrv242wbk7cn0a2b5sw7a373",
+        "sha256": "0jrvd9yws7cym08j28r7wv3i83zlk5z0vl0l1mibak04h43mibgf",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.152.a/linux-hardened-4.19.152.a.patch"
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.155.a/linux-hardened-4.19.155.a.patch"
     },
     "5.4": {
-        "name": "linux-hardened-5.4.72.a.patch",
+        "name": "linux-hardened-5.4.75.a.patch",
-        "sha256": "1w4sfkx4qj9vx47z06bkf4biaiz58z2qp536g7dss26zdbx1im26",
+        "sha256": "169m2a3wm5lsyzp7cp8nvxarhgcnan41ap7k5r7jx7x1frx2vzxm",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.72.a/linux-hardened-5.4.72.a.patch"
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.75.a/linux-hardened-5.4.75.a.patch"
     },
     "5.8": {
-        "name": "linux-hardened-5.8.16.a.patch",
+        "name": "linux-hardened-5.8.18.a.patch",
-        "sha256": "0b7bfzknz2am9pfypazqzky9bcd6659sakcdx2a7p1i3bj6zxnn1",
+        "sha256": "1r2n74nbyi3dp5zql9sk504xkpil6ylbyd99zqqva4nd3qg17c99",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.8.16.a/linux-hardened-5.8.16.a.patch"
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.8.18.a/linux-hardened-5.8.18.a.patch"
     },
     "5.9": {
-        "name": "linux-hardened-5.9.1.a.patch",
+        "name": "linux-hardened-5.9.6.a.patch",
-        "sha256": "07897dgkldm2dxsriapjlg9b118sd32qmd1z8xja01xcgd3r6vp7",
+        "sha256": "1h25jkbp0yz2jfmbnwrldd1rcpag8mbf8dv6kc79j7qg1agafxkn",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.9.1.a/linux-hardened-5.9.1.a.patch"
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.9.6.a/linux-hardened-5.9.6.a.patch"
     }
 }

pkgs/os-specific/linux/kernel/linux-4.14.nix

@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.14.203";
+  version = "4.14.204";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0c9r1s83mrn9lzgrr4wzvk4d72q70sbgf7lql6z9ivkf12v3p5mc";
+    sha256 = "1ncacsy2g80zigfx8nmr1f7v50s1y9ys1xy9jgizrnvmxjcji0wy";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-4.19.nix

@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "4.19.154";
+  version = "4.19.155";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0ik6anz6ly0dl0lp8m5mighlvzkifnk2kljwajxa56vbhj691339";
+    sha256 = "1lj81aadyskmxs3j4s923nhnk69dfj2kiwm0nxabbcjw83sliinb";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-5.4.nix

@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.4.74";
+  version = "5.4.75";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1drs2pngr5w3rmpydljirmibp30qb4hdrhqsi92knshlw6nz817c";
+    sha256 = "0w0lpiy56zqdm2vpx9ckxakna334n88pnqbv52zyfcslxgb6yinj";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/kernel/linux-5.9.nix

@@ -3,7 +3,7 @@
 with stdenv.lib;
 
 buildLinux (args // rec {
-  version = "5.9.3";
+  version = "5.9.6";
 
   # modDirVersion needs to be x.y.z, will automatically add .0 if needed
   modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@@ -13,6 +13,6 @@ buildLinux (args // rec {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0wwa6557i9l4vyswz26ixz8c2ykxnzqrsc9pwkr76nyjx7gjibni";
+    sha256 = "0w2kcng09nzk09dwkx4azdfgnwzbd2mz8lyl4j69bwx837z85hbc";
   };
 } // (args.argsOverride or {}))

pkgs/os-specific/linux/pam_mount/default.nix

@@ -1,37 +1,48 @@
-{ stdenv, fetchurl, autoconf, automake, pkgconfig, libtool, pam, libHX, libxml2, pcre, perl, openssl, cryptsetup, utillinux }:
+{ stdenv, fetchurl, autoreconfHook, pkgconfig, libtool, pam, libHX, libxml2, pcre, perl, openssl, cryptsetup, utillinux }:
 
 stdenv.mkDerivation rec {
-  name = "pam_mount-2.16";
+  pname = "pam_mount";
+  version = "2.16";
 
   src = fetchurl {
-    url = "mirror://sourceforge/pam-mount/pam_mount/2.16/${name}.tar.xz";
+    url = "mirror://sourceforge/pam-mount/pam_mount/${version}/${pname}-${version}.tar.xz";
     sha256 = "1rvi4irb7ylsbhvx1cr6islm2xxw1a4b19q6z4a9864ndkm0f0mf";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  patches = [
-  buildInputs = [ autoconf automake libtool pam libHX utillinux libxml2 pcre perl openssl cryptsetup ];
+    ./insert_utillinux_path_hooks.patch
+    ./support_luks2.patch
+  ];
 
-  patches = [ ./insert_utillinux_path_hooks.patch ];
+  postPatch = ''
+    substituteInPlace src/mtcrypt.c \
+      --replace @@NIX_UTILLINUX@@ ${utillinux}/bin
+  '';
 
-  preConfigure = ''
+  nativeBuildInputs = [ autoreconfHook libtool pkgconfig ];
-    substituteInPlace src/mtcrypt.c --replace @@NIX_UTILLINUX@@ ${utillinux}/bin
-    sh autogen.sh --prefix=$out
-    '';
 
-  makeFlags = [ "DESTDIR=$(out)" ];
+  buildInputs = [ pam libHX utillinux libxml2 pcre perl openssl cryptsetup ];
+
+  enableParallelBuilding = true;
+
+  configureFlags = [
+    "--prefix=${placeholder "out"}"
+    "--localstatedir=${placeholder "out"}/var"
+    "--sbindir=${placeholder "out"}/bin"
+    "--sysconfdir=${placeholder "out"}/etc"
+    "--with-slibdir=${placeholder "out"}/lib"
+    "--with-ssbindir=${placeholder "out"}/bin"
+  ];
 
-  # Probably a hack, but using DESTDIR and PREFIX makes everything work!
   postInstall = ''
-    mkdir -p $out
+    rm -r $out/var
-    cp -r $out/$out/* $out
+  '';
-    rm -r $out/nix
-    '';
 
   meta = with stdenv.lib; {
-    homepage = "http://pam-mount.sourceforge.net/";
     description = "PAM module to mount volumes for a user session";
-    maintainers = [ maintainers.tstrobel ];
+    homepage = "https://pam-mount.sourceforge.net/";
     license = with licenses; [ gpl2 gpl3 lgpl21 lgpl3 ];
+    maintainers = with maintainers; [ tstrobel ];
     platforms = platforms.linux;
   };
 }

pkgs/os-specific/linux/pam_mount/support_luks2.patch

@@ -0,0 +1,47 @@
+commit d4434c05e7c0cf05d87089404cfa2deedc60811a
+Author: Ingo Franzki <ifranzki@linux.ibm.com>
+Date:   Mon Oct 29 16:47:40 2018 +0100
+
+    crypto: Add support for LUKS2
+    
+    Cryptsetup version 2.0 added support for LUKS2.
+    This patch adds support for mounting LUKS2 volumes with
+    pam_mount.
+    
+    Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
+
+diff --git a/src/crypto-dmc.c b/src/crypto-dmc.c
+index d0ab6ca..abd0358 100644
+--- a/src/crypto-dmc.c
++++ b/src/crypto-dmc.c
+@@ -21,6 +21,12 @@
+ #include "libcryptmount.h"
+ #include "pam_mount.h"
+ 
++#ifndef CRYPT_LUKS
++	#define CRYPT_LUKS	NULL /* Passing NULL to crypt_load will
++					default to LUKS(1) on older
++					libcryptsetup versions. */
++#endif
++
+ /**
+  * dmc_is_luks - check if @path points to a LUKS volume (cf. normal dm-crypt)
+  * @path:	path to the crypto container
+@@ -48,7 +54,7 @@ EXPORT_SYMBOL int ehd_is_luks(const char *path, bool blkdev)
+ 
+ 	ret = crypt_init(&cd, device);
+ 	if (ret == 0) {
+-		ret = crypt_load(cd, CRYPT_LUKS1, NULL);
++		ret = crypt_load(cd, CRYPT_LUKS, NULL);
+ 		if (ret == -EINVAL)
+ 			ret = false;
+ 		else if (ret == 0)
+@@ -106,7 +112,7 @@ static bool dmc_run(const struct ehd_mount_request *req,
+ #endif
+ 	}
+ 
+-	ret = crypt_load(cd, CRYPT_LUKS1, NULL);
++	ret = crypt_load(cd, CRYPT_LUKS, NULL);
+ 	if (ret == 0) {
+ 		ret = crypt_activate_by_passphrase(cd, mt->crypto_name,
+ 		      CRYPT_ANY_SLOT, req->key_data, req->key_size, flags);

pkgs/os-specific/linux/r8168/default.nix

@@ -6,7 +6,7 @@ let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wi
 in stdenv.mkDerivation rec {
   name = "r8168-${kernel.version}-${version}";
   # on update please verify that the source matches the realtek version
-  version = "8.047.04";
+  version = "8.048.03";
 
   # This is a mirror. The original website[1] doesn't allow non-interactive
   # downloads, instead emailing you a download link.
@@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
     owner = "mtorromeo";
     repo = "r8168";
     rev = version;
-    sha256 = "1rni8jimwdhyx75603mdcylrdxgfwfpyprf1lf5x5cli2i4bbijg";
+    sha256 = "1l8llpcnapcaafxp7wlyny2ywh7k6q5zygwwjl9h0l6p04cghss4";
   };
 
   hardeningDisable = [ "pic" ];
@@ -29,8 +29,8 @@ in stdenv.mkDerivation rec {
   # based on the ArchLinux pkgbuild: https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/r8168
   preBuild = ''
     makeFlagsArray+=("-C${kernel.dev}/lib/modules/${kernel.modDirVersion}/build")
-    makeFlagsArray+=("SUBDIRS=$PWD/src")
+    makeFlagsArray+=("M=$PWD/src")
-    makeFlagsArray+=("EXTRA_CFLAGS=-DCONFIG_R8168_NAPI -DCONFIG_R8168_VLAN")
+    makeFlagsArray+=("EXTRA_CFLAGS=-DCONFIG_R8168_NAPI -DCONFIG_R8168_VLAN -DCONFIG_ASPM -DENABLE_S5WOL -DENABLE_EEE")
     makeFlagsArray+=("modules")
   '';
 

pkgs/os-specific/linux/zfs/default.nix

@@ -202,9 +202,9 @@ in {
     # incompatibleKernelVersion = "4.19";
 
     # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2.0.0-rc4";
+    version = "2.0.0-rc5";
 
-    sha256 = "12ydycmmzqm70p6hgmmg7q93j8n1xlkk3j56vvqh1zmazr3sr6r0";
+    sha256 = "0vnldx95c36yy18v1hfr8r4cmmh3hw4n6pwz30drkwgywakjwnsd";
     isUnstable = true;
   };
 }

pkgs/servers/keycloak/default.nix

@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname   = "keycloak";
-  version = "11.0.2";
+  version = "11.0.3";
 
   src = fetchzip {
     url    = "https://downloads.jboss.org/keycloak/${version}/keycloak-${version}.zip";
-    sha256 = "0ayg6cl6mff64qs36djnfs3is4x0pzhk7zwb27cbln77q3icc0j0";
+    sha256 = "15fw49rhnjky108hh71dkdlafd0ajr1n13vhivqcw6c18zvyan35";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/servers/monitoring/prometheus/default.nix

@@ -1,13 +1,13 @@
 { lib, go, buildGoPackage, fetchFromGitHub, mkYarnPackage, nixosTests }:
 
 let
-  version = "2.20.1";
+  version = "2.22.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "prometheus";
     repo = "prometheus";
-    sha256 = "0svhx08pbz55nhn6g9pn79zbhyvr394k5w3ny1mq3wp382h62r5j";
+    sha256 = "0wilx675b0a8ww7bj36hzcaip0zqzndkzan04rjsjigz5bw6kba0";
   };
 
   webui = mkYarnPackage {

pkgs/servers/monitoring/prometheus/webui-package.json

@@ -8,33 +8,33 @@
     "@fortawesome/react-fontawesome": "^0.1.4",
     "@reach/router": "^1.2.1",
     "@testing-library/react-hooks": "^3.1.1",
-    "@types/jest": "^24.0.20",
+    "@types/jest": "^26.0.10",
-    "@types/jquery": "^3.3.29",
+    "@types/jquery": "^3.5.1",
     "@types/node": "^12.11.1",
     "@types/reach__router": "^1.2.6",
     "@types/react": "^16.8.2",
     "@types/react-copy-to-clipboard": "^4.3.0",
     "@types/react-dom": "^16.8.0",
-    "@types/react-resize-detector": "^4.0.2",
+    "@types/react-resize-detector": "^4.2.0",
     "@types/sanitize-html": "^1.20.2",
     "bootstrap": "^4.2.1",
     "css.escape": "^1.5.1",
-    "downshift": "^3.2.2",
+    "downshift": "^3.4.8",
     "enzyme-to-json": "^3.4.3",
     "fuzzy": "^0.1.3",
     "i": "^0.3.6",
-    "jest-fetch-mock": "^2.1.2",
+    "jest-fetch-mock": "^3.0.3",
-    "jquery": "^3.5",
+    "jquery": "^3.5.1",
     "jquery.flot.tooltip": "^0.9.0",
-    "jsdom": "^15.2.0",
+    "jsdom": "^16.4.0",
     "moment": "^2.24.0",
     "moment-timezone": "^0.5.23",
     "popper.js": "^1.14.3",
     "react": "^16.7.0",
     "react-copy-to-clipboard": "^5.0.1",
     "react-dom": "^16.7.0",
-    "react-resize-detector": "^4.2.1",
+    "react-resize-detector": "^5.0.7",
-    "react-scripts": "3.4.0",
+    "react-scripts": "3.4.3",
     "react-test-renderer": "^16.9.0",
     "reactstrap": "^8.0.1",
     "sanitize-html": "^1.20.1",
@@ -68,7 +68,7 @@
     "@types/flot": "0.0.31",
     "@types/moment-timezone": "^0.5.10",
     "@types/reactstrap": "^8.0.5",
-    "@types/sinon": "^7.5.0",
+    "@types/sinon": "^9.0.4",
     "@typescript-eslint/eslint-plugin": "2.x",
     "@typescript-eslint/parser": "2.x",
     "enzyme": "^3.10.0",
@@ -76,15 +76,15 @@
     "eslint": "6.x",
     "eslint-config-prettier": "^6.4.0",
     "eslint-config-react-app": "^5.0.2",
-    "eslint-plugin-flowtype": "3.x",
+    "eslint-plugin-flowtype": "4.x",
     "eslint-plugin-import": "2.x",
     "eslint-plugin-jsx-a11y": "6.x",
     "eslint-plugin-prettier": "^3.1.1",
     "eslint-plugin-react": "7.x",
-    "eslint-plugin-react-hooks": "1.x",
+    "eslint-plugin-react-hooks": "2.x",
-    "jest-fetch-mock": "^2.1.2",
+    "jest-fetch-mock": "^3.0.3",
     "prettier": "^1.18.2",
-    "sinon": "^7.5.0"
+    "sinon": "^9.0.3"
   },
   "proxy": "http://localhost:9090",
   "jest": {

pkgs/servers/tailscale/default.nix

@@ -33,6 +33,8 @@ buildGoModule rec {
     wrapProgram $out/bin/tailscaled --prefix PATH : ${
       lib.makeBinPath [ iproute iptables ]
     }
+    sed -i -e "s#/usr/sbin#$out/bin#" -e "/^EnvironmentFile/d" ./cmd/tailscaled/tailscaled.service
+    install -D -m0444 -t $out/lib/systemd/system ./cmd/tailscaled/tailscaled.service
   '';
 
   meta = with lib; {