Merge master into staging-next

.editorconfig

@@ -11,18 +11,26 @@ insert_final_newline = true
 trim_trailing_whitespace = true
 charset = utf-8
 
+# Ignore diffs/patches
+[*.{diff,patch}]
+end_of_line = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+
 # see https://nixos.org/nixpkgs/manual/#chap-conventions
 
-# Match nix/ruby/docbook files, set indent to spaces with width of two
+# Match nix/perl/python/ruby/shell/docbook files, set indent to spaces
-[*.{nix,rb,xml}]
+[*.{nix,pl,py,rb,sh,xml}]
 indent_style = space
+
+# Match docbook files, set indent width of one
+[*.xml]
+indent_size = 1
+
+# Match nix/ruby files, set indent width of two
+[*.{nix,rb}]
 indent_size = 2
 
-# Match shell/python/perl scripts, set indent to spaces with width of four
+# Match perl/python/shell scripts, set indent width of four
-[*.{sh,py,pl}]
+[*.{pl,py,sh}]
-indent_style = space
 indent_size = 4
-
-# Match diffs, avoid to trim trailing whitespace
-[*.{diff,patch}]
-trim_trailing_whitespace = false

maintainers/maintainer-list.nix

@@ -4168,6 +4168,12 @@
     githubId = 10544;
     name = "Giuluo Eulisse";
   };
+  kthielen = {
+    email = "kthielen@gmail.com";
+    github = "kthielen";
+    githubId = 1409287;
+    name = "Kalani Thielen";
+  };
   ktor = {
     email = "kruszewsky@gmail.com";
     github = "ktor";
@@ -5552,6 +5558,12 @@
     githubId = 4368690;
     name = "Ratko Mladic";
   };
+  nilp0inter = {
+    email = "robertomartinezp@gmail.com";
+    github = "nilp0inter";
+    githubId = 1224006;
+    name = "Roberto Abdelkader Martínez Pérez";
+  };
   ninjatrappeur = {
     email = "felix@alternativebit.fr";
     github = "ninjatrappeur";
@@ -6640,6 +6652,12 @@
     githubId = 1942810;
     name = "Christian Ulrich";
   };
+  rpearce = {
+    email = "me@robertwpearce.com";
+    github = "rpearce";
+    githubId = 592876;
+    name = "Robert W. Pearce";
+  };
   rprospero = {
     email = "rprospero+nix@gmail.com";
     github = "rprospero";
@@ -6700,6 +6718,12 @@
     githubId = 889991;
     name = "Ryan Artecona";
   };
+  ryanorendorff = {
+    email = "12442942+ryanorendorff@users.noreply.github.com";
+    github = "ryanorendorff";
+    githubId = 12442942;
+    name = "Ryan Orendorff";
+  };
   ryansydnor = {
     email = "ryan.t.sydnor@gmail.com";
     github = "ryansydnor";

nixos/doc/manual/release-notes/rl-2009.xml

@@ -26,6 +26,12 @@
    <listitem>
     <para>GNOME desktop environment was upgraded to 3.36, see its <link xlink:href="https://help.gnome.org/misc/release-notes/3.36/">release notes</link>.</para>
    </listitem>
+   <listitem>
+    <para>
+    <package>maxx</package> package removed along with <varname>services.xserver.desktopManager.maxx</varname> module.
+    Please migrate to <package>cdesktopenv</package> and <varname>services.xserver.desktopManager.cde</varname> module.
+    </para>
+   </listitem>
    <listitem>
     <para>
      We now distribute a GNOME ISO.
@@ -122,8 +128,16 @@ services.mysql.initialScript = pkgs.writeText "mariadb-init.sql" ''
   <itemizedlist>
    <listitem>
     <para>
-     The go-modules builder now uses vendorSha256 instead of modSha256 to pin
+     <literal>buildGoModule</literal> now internally creates a vendor directory
-     fetched version data. This is currently a warning, but will be removed in the next release.
+     in the source tree for downloaded modules instead of using go's <link
+     xlink:href="https://golang.org/cmd/go/#hdr-Module_proxy_protocol">module
+     proxy protocol</link>. This storage format is simpler and therefore less
+     likekly to break with future versions of go. As a result
+     <literal>buildGoModule</literal> switched from
+     <literal>modSha256</literal> to the <literal>vendorSha256</literal>
+     attribute to pin fetched version data. <literal>buildGoModule</literal>
+     still accepts <literal>modSha256</literal> with a warning, but support will
+     be removed in the next release.
     </para>
    </listitem>
    <listitem>
@@ -418,6 +432,26 @@ systemd.services.nginx.serviceConfig.ReadWritePaths = [ "/var/www" ];
      The default output of <literal>buildGoPackage</literal> is now <literal>$out</literal> instead of <literal>$bin</literal>.
    </para>
    </listitem>
+   <listitem>
+   <para>
+     Default algorithm for ZRAM swap was changed to <literal>zstd</literal>.
+   </para>
+   </listitem>
+   <listitem>
+    <para>
+     The scripted networking system now uses <literal>.link</literal> files in
+     <literal>/etc/systemd/network</literal> to configure mac address and link MTU,
+     instead of the sometimes buggy <literal>network-link-*</literal> units, which
+     have been removed.
+     Bringing the interface up has been moved to the beginning of the
+     <literal>network-addresses-*</literal> unit.
+     Note this doesn't require <command>systemd-networkd</command> - it's udev that
+     parses <literal>.link</literal> files.
+     Extra care needs to be taken in the presence of <link xlink:href="https://wiki.debian.org/NetworkInterfaceNames#THE_.22PERSISTENT_NAMES.22_SCHEME">legacy udev rules</link>
+     to rename interfaces, as MAC Address and MTU defined in these options can only match on the original link name.
+     In such cases, you most likely want to create a <literal>10-*.link</literal> file through <xref linkend="opt-systemd.network.links"/> and set both name and MAC Address / MTU there.
+    </para>
+   </listitem>
   </itemizedlist>
  </section>
 </section>

nixos/modules/config/power-management.nix

@@ -94,7 +94,7 @@ in
         after = [ "suspend.target" "hibernate.target" "hybrid-sleep.target" ];
         script =
           ''
-            ${config.systemd.package}/bin/systemctl try-restart post-resume.target
+            /run/current-system/systemd/bin/systemctl try-restart post-resume.target
             ${cfg.resumeCommands}
             ${cfg.powerUpCommands}
           '';

nixos/modules/config/resolvconf.nix

@@ -21,7 +21,7 @@ let
     '' + optionalString config.services.nscd.enable ''
       # Invalidate the nscd cache whenever resolv.conf is
       # regenerated.
-      libc_restart='${pkgs.systemd}/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
+      libc_restart='/run/current-system/systemd/bin/systemctl try-restart --no-block nscd.service 2> /dev/null'
     '' + optionalString (length resolvconfOptions > 0) ''
       # Options as described in resolv.conf(5)
       resolv_conf_options='${concatStringsSep " " resolvconfOptions}'

nixos/modules/config/zram.nix

@@ -91,7 +91,7 @@ in
       };
 
       algorithm = mkOption {
-        default = "lzo";
+        default = "zstd";
         example = "lz4";
         type = with types; either (enum [ "lzo" "lz4" "zstd" ]) str;
         description = ''

nixos/modules/module-list.nix

@@ -415,6 +415,7 @@
   ./services/misc/apache-kafka.nix
   ./services/misc/autofs.nix
   ./services/misc/autorandr.nix
+  ./services/misc/bazarr.nix
   ./services/misc/beanstalkd.nix
   ./services/misc/bees.nix
   ./services/misc/bepasty.nix
@@ -847,6 +848,7 @@
   ./services/web-apps/matomo.nix
   ./services/web-apps/moinmoin.nix
   ./services/web-apps/restya-board.nix
+  ./services/web-apps/sogo.nix
   ./services/web-apps/tt-rss.nix
   ./services/web-apps/trac.nix
   ./services/web-apps/trilium.nix

nixos/modules/programs/zsh/zsh.nix

@@ -135,6 +135,13 @@ in
         type = types.bool;
       };
 
+      enableBashCompletion = mkOption {
+        default = false;
+        description = ''
+          Enable compatibility with bash's programmable completion system.
+        '';
+        type = types.bool;
+      };
 
       enableGlobalCompInit = mkOption {
         default = cfg.enableCompletion;
@@ -239,6 +246,11 @@ in
           autoload -U compinit && compinit
         ''}
 
+        ${optionalString cfg.enableBashCompletion ''
+          # Enable compatibility with bash's completion system.
+          autoload -U bashcompinit && bashcompinit
+        ''}
+
         # Setup custom interactive shell init stuff.
         ${cfge.interactiveShellInit}
 

nixos/modules/services/hardware/udev.nix

@@ -83,6 +83,10 @@ let
       run_progs=$(grep -v '^[[:space:]]*#' $out/* | grep 'RUN+="/' |
         sed -e 's/.*RUN+="\([^ "]*\)[ "].*/\1/' | uniq)
       for i in $import_progs $run_progs; do
+        # if the path refers to /run/current-system/systemd, replace with config.systemd.package
+        if [[ $i == /run/current-system/systemd* ]]; then
+          i="${config.systemd.package}/''${i#/run/current-system/systemd/}"
+        fi
         if [[ ! -x $i ]]; then
           echo "FAIL"
           echo "$i is called in udev rules but is not executable or does not exist"

nixos/modules/services/logging/logrotate.nix

@@ -5,26 +5,85 @@ with lib;
 let
   cfg = config.services.logrotate;
 
-  configFile = pkgs.writeText "logrotate.conf"
+  pathOptions = {
-    cfg.config;
+    options = {
+      path = mkOption {
+        type = types.str;
+        description = "The path to log files to be rotated";
+      };
+      user = mkOption {
+        type = types.str;
+        description = "The user account to use for rotation";
+      };
+      group = mkOption {
+        type = types.str;
+        description = "The group to use for rotation";
+      };
+      frequency = mkOption {
+        type = types.enum [
+          "daily" "weekly" "monthly" "yearly"
+        ];
+        default = "daily";
+        description = "How often to rotate the logs";
+      };
+      keep = mkOption {
+        type = types.int;
+        default = 20;
+        description = "How many rotations to keep";
+      };
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = "Extra logrotate config options for this path";
+      };
+    };
+  };
+
+  pathConfig = options: ''
+    "${options.path}" {
+      su ${options.user} ${options.group}
+      ${options.frequency}
+      missingok
+      notifempty
+      rotate ${toString options.keep}
+      ${options.extraConfig}
+    }
+  '';
+
+  configFile = pkgs.writeText "logrotate.conf" (
+    (concatStringsSep "\n" ((map pathConfig cfg.paths) ++ [cfg.extraConfig]))
+  );
 
 in
 {
+  imports = [
+    (mkRenamedOptionModule [ "services" "logrotate" "config" ] [ "services" "logrotate" "extraConfig" ])
+  ];
+
   options = {
     services.logrotate = {
-      enable = mkOption {
+      enable = mkEnableOption "the logrotate systemd service";
-        type = lib.types.bool;
+
-        default = false;
+      paths = mkOption {
-        description = ''
+        type = types.listOf (types.submodule pathOptions);
-          Enable the logrotate cron job
+        default = [];
-        '';
+        description = "List of attribute sets with paths to rotate";
+        example = {
+          "/var/log/myapp/*.log" = {
+            user = "myuser";
+            group = "mygroup";
+            rotate = "weekly";
+            keep = 5;
+          };
+        };
       };
 
-      config = mkOption {
+      extraConfig = mkOption {
         default = "";
         type = types.lines;
         description = ''
-          The contents of the logrotate config file
+          Extra contents to add to the logrotate config file.
+          See https://linux.die.net/man/8/logrotate
         '';
       };
     };

nixos/modules/services/misc/bazarr.nix

@@ -0,0 +1,76 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.services.bazarr;
+in
+{
+  options = {
+    services.bazarr = {
+      enable = mkEnableOption "bazarr, a subtitle manager for Sonarr and Radarr";
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Open ports in the firewall for the bazarr web interface.";
+      };
+
+      listenPort = mkOption {
+        type = types.port;
+        default = 6767;
+        description = "Port on which the bazarr web interface should listen";
+      };
+
+      user = mkOption {
+        type = types.str;
+        default = "bazarr";
+        description = "User account under which bazarr runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "bazarr";
+        description = "Group under which bazarr runs.";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.bazarr = {
+      description = "bazarr";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = rec {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        StateDirectory = "bazarr";
+        SyslogIdentifier = "bazarr";
+        ExecStart = pkgs.writeShellScript "start-bazarr" ''
+          ${pkgs.bazarr}/bin/bazarr \
+            --config '/var/lib/${StateDirectory}' \
+            --port ${toString cfg.listenPort} \
+            --no-update True
+        '';
+        Restart = "on-failure";
+      };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.listenPort ];
+    };
+
+    users.users = mkIf (cfg.user == "bazarr") {
+      bazarr = {
+        group = cfg.group;
+        home = "/var/lib/${config.systemd.services.bazarr.serviceConfig.StateDirectory}";
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "bazarr") {
+      bazarr = {};
+    };
+  };
+}

nixos/modules/services/misc/docker-registry.nix

@@ -138,7 +138,7 @@ in {
 
       script = ''
         ${pkgs.docker-distribution}/bin/registry garbage-collect ${configFile}
-        ${pkgs.systemd}/bin/systemctl restart docker-registry.service
+        /run/current-system/systemd/bin/systemctl restart docker-registry.service
       '';
 
       startAt = optional cfg.enableGarbageCollect cfg.garbageCollectDates;

nixos/modules/services/misc/freeswitch.nix

@@ -78,7 +78,7 @@ in {
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ configDirectory ];
       serviceConfig = {
-        ExecStart = "${pkgs.systemd}/bin/systemctl try-reload-or-restart freeswitch.service";
+        ExecStart = "/run/current-system/systemd/bin/systemctl try-reload-or-restart freeswitch.service";
         RemainAfterExit = true;
         Type = "oneshot";
       };

nixos/modules/services/networking/dhcpcd.nix

@@ -81,7 +81,7 @@ let
           # anything ever again ("couldn't resolve ..., giving up on
           # it"), so we silently lose time synchronisation. This also
           # applies to openntpd.
-          ${config.systemd.package}/bin/systemctl try-reload-or-restart ntpd.service openntpd.service chronyd.service || true
+          /run/current-system/systemd/bin/systemctl try-reload-or-restart ntpd.service openntpd.service chronyd.service || true
       fi
 
       ${cfg.runHook}
@@ -217,7 +217,7 @@ in
     powerManagement.resumeCommands = mkIf config.systemd.services.dhcpcd.enable
       ''
         # Tell dhcpcd to rebind its interfaces if it's running.
-        ${config.systemd.package}/bin/systemctl reload dhcpcd.service
+        /run/current-system/systemd/bin/systemctl reload dhcpcd.service
       '';
 
   };

nixos/modules/services/networking/dnscrypt-proxy2.nix

@@ -55,6 +55,7 @@ in
         AmbientCapabilities = "CAP_NET_BIND_SERVICE";
         DynamicUser = true;
         ExecStart = "${pkgs.dnscrypt-proxy2}/bin/dnscrypt-proxy -config ${cfg.configFile}";
+        Restart = "always";
       };
     };
   };

nixos/modules/services/networking/nsd.nix

@@ -252,7 +252,7 @@ let
           Use imports or pkgs.lib.readFile if you don't want this data in your config file.
         '';
       };
-      
+
       dnssec = mkEnableOption "DNSSEC";
 
       dnssecPolicy = {
@@ -970,7 +970,7 @@ in
       script = signZones;
 
       postStop = ''
-        ${pkgs.systemd}/bin/systemctl kill -s SIGHUP nsd.service
+        /run/current-system/systemd/bin/systemctl kill -s SIGHUP nsd.service
       '';
     };
 

nixos/modules/services/networking/wpa_supplicant.nix

@@ -253,12 +253,12 @@ in {
     };
 
     powerManagement.resumeCommands = ''
-      ${config.systemd.package}/bin/systemctl try-restart wpa_supplicant
+      /run/current-system/systemd/bin/systemctl try-restart wpa_supplicant
     '';
 
     # Restart wpa_supplicant when a wlan device appears or disappears.
     services.udev.extraRules = ''
-      ACTION=="add|remove", SUBSYSTEM=="net", ENV{DEVTYPE}=="wlan", RUN+="${config.systemd.package}/bin/systemctl try-restart wpa_supplicant.service"
+      ACTION=="add|remove", SUBSYSTEM=="net", ENV{DEVTYPE}=="wlan", RUN+="/run/current-system/systemd/bin/systemctl try-restart wpa_supplicant.service"
     '';
   };
 

nixos/modules/services/networking/yggdrasil.nix

@@ -1,55 +1,17 @@
 { config, lib, pkgs, ... }:
 with lib;
 let
+  keysPath = "/var/lib/yggdrasil/keys.json";
+
   cfg = config.services.yggdrasil;
-  configProvided = (cfg.config != {});
+  configProvided = cfg.config != { };
-  configAsFile = (if configProvided then
+  configFileProvided = cfg.configFile != null;
-                   toString (pkgs.writeTextFile {
-                     name = "yggdrasil-conf";
-                     text = builtins.toJSON cfg.config;
-                   })
-                   else null);
-  configFileProvided = (cfg.configFile != null);
-  generateConfig = (
-    if configProvided && configFileProvided then
-      "${pkgs.jq}/bin/jq -s add ${configAsFile} ${cfg.configFile}"
-    else if configProvided then
-      "cat ${configAsFile}"
-    else if configFileProvided then
-      "cat ${cfg.configFile}"
-    else
-      "${cfg.package}/bin/yggdrasil -genconf"
-  );
 
 in {
   options = with types; {
     services.yggdrasil = {
       enable = mkEnableOption "the yggdrasil system service";
 
-      configFile = mkOption {
-        type =  nullOr str;
-        default = null;
-        example = "/run/keys/yggdrasil.conf";
-        description = ''
-          A file which contains JSON configuration for yggdrasil.
-
-          You do not have to supply a complete configuration, as
-          yggdrasil will use default values for anything which is
-          omitted.  If the encryption and signing keys are omitted,
-          yggdrasil will generate new ones each time the service is
-          started, resulting in a random IPv6 address on the yggdrasil
-          network each time.
-
-          If both this option and <option>config</option> are
-          supplied, they will be combined, with values from
-          <option>config</option> taking precedence.
-
-          You can use the command <code>nix-shell -p yggdrasil --run
-          "yggdrasil -genconf -json"</code> to generate a default
-          JSON configuration.
-        '';
-      };
-
       config = mkOption {
         type = attrs;
         default = {};
@@ -66,16 +28,21 @@ in {
           Configuration for yggdrasil, as a Nix attribute set.
 
           Warning: this is stored in the WORLD-READABLE Nix store!
-          Therefore, it is not appropriate for private keys.  If you
+          Therefore, it is not appropriate for private keys. If you
-          do not specify the keys, yggdrasil will generate a new set
+          wish to specify the keys, use <option>configFile</option>.
-          each time the service is started, creating a random IPv6
-          address on the yggdrasil network each time.
 
-          If you wish to specify the keys, use
+          If the <option>persistentKeys</option> is enabled then the
-          <option>configFile</option>.  If both
+          keys that are generated during activation will override
-          <option>configFile</option> and <option>config</option> are
+          those in <option>config</option> or
-          supplied, they will be combined, with values from
+          <option>configFile</option>.
-          <option>config</option> taking precedence.
+
+          If no keys are specified then ephemeral keys are generated
+          and the Yggdrasil interface will have a random IPv6 address
+          each time the service is started, this is the default.
+
+          If both <option>configFile</option> and <option>config</option>
+          are supplied, they will be combined, with values from
+          <option>configFile</option> taking precedence.
 
           You can use the command <code>nix-shell -p yggdrasil --run
           "yggdrasil -genconf"</code> to generate default
@@ -83,12 +50,21 @@ in {
         '';
       };
 
+      configFile = mkOption {
+        type = nullOr path;
+        default = null;
+        example = "/run/keys/yggdrasil.conf";
+        description = ''
+          A file which contains JSON configuration for yggdrasil.
+          See the <option>config</option> option for more information.
+        '';
+      };
+
       group = mkOption {
         type = types.str;
         default = "root";
         example = "wheel";
-        description =
+        description = "Group to grant acces to the Yggdrasil control socket.";
-          "Group to grant acces to the Yggdrasil control socket.";
       };
 
       openMulticastPort = mkOption {
@@ -126,37 +102,64 @@ in {
         defaultText = "pkgs.yggdrasil";
         description = "Yggdrasil package to use.";
       };
+
+      persistentKeys = mkEnableOption ''
+        If enabled then keys will be generated once and Yggdrasil
+        will retain the same IPv6 address when the service is
+        restarted. Keys are stored at ${keysPath}.
+      '';
+
     };
   };
 
-  config = mkIf cfg.enable {
+  config = mkIf cfg.enable (let binYggdrasil = cfg.package + "/bin/yggdrasil";
-    assertions = [
+  in {
-      { assertion = config.networking.enableIPv6;
+    assertions = [{
-        message = "networking.enableIPv6 must be true for yggdrasil to work";
+      assertion = config.networking.enableIPv6;
-      }
+      message = "networking.enableIPv6 must be true for yggdrasil to work";
-    ];
+    }];
+
+    system.activationScripts.yggdrasil = mkIf cfg.persistentKeys ''
+      if [ ! -e ${keysPath} ]
+      then
+        mkdir -p ${builtins.dirOf keysPath}
+        ${binYggdrasil} -genconf -json \
+          | ${pkgs.jq}/bin/jq \
+              'to_entries|map(select(.key|endswith("Key")))|from_entries' \
+          > ${keysPath}
+        chmod 600 ${keysPath}
+      fi
+    '';
 
     systemd.services.yggdrasil = {
       description = "Yggdrasil Network Service";
-      path = [ cfg.package ] ++ optional (configProvided && configFileProvided) pkgs.jq;
       bindsTo = [ "network-online.target" ];
       after = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
-      preStart = ''
+      preStart =
-        ${generateConfig} | yggdrasil -normaliseconf -useconf > /run/yggdrasil/yggdrasil.conf
+        (if configProvided || configFileProvided || cfg.persistentKeys then
-      '';
+          "echo "
+
+          + (lib.optionalString configProvided
+            "'${builtins.toJSON cfg.config}'")
+          + (lib.optionalString configFileProvided "$(cat ${cfg.configFile})")
+          + (lib.optionalString cfg.persistentKeys "$(cat ${keysPath})")
+          + " | ${pkgs.jq}/bin/jq -s add | ${binYggdrasil} -normaliseconf -useconf"
+        else
+          "${binYggdrasil} -genconf") + " > /run/yggdrasil/yggdrasil.conf";
 
       serviceConfig = {
-        ExecStart = "${cfg.package}/bin/yggdrasil -useconffile /run/yggdrasil/yggdrasil.conf";
+        ExecStart =
+          "${binYggdrasil} -useconffile /run/yggdrasil/yggdrasil.conf";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         Restart = "always";
 
         Group = cfg.group;
         RuntimeDirectory = "yggdrasil";
         RuntimeDirectoryMode = "0750";
-        BindReadOnlyPaths = mkIf configFileProvided
+        BindReadOnlyPaths = lib.optional configFileProvided cfg.configFile
-          [ "${cfg.configFile}" ];
+          ++ lib.optional cfg.persistentKeys keysPath;
 
         # TODO: as of yggdrasil 0.3.8 and systemd 243, yggdrasil fails
         # to set up the network adapter when DynamicUser is set.  See
@@ -191,6 +194,6 @@ in {
 
     # Make yggdrasilctl available on the command line.
     environment.systemPackages = [ cfg.package ];
-  };
+  });
-  meta.maintainers = with lib.maintainers; [ gazally ];
+  meta.maintainers = with lib.maintainers; [ gazally ehmry ];
 }

nixos/modules/services/torrent/transmission.nix

@@ -11,7 +11,7 @@ let
   downloadDir = "${homeDir}/Downloads";
   incompleteDir = "${homeDir}/.incomplete";
 
-  settingsDir = "${homeDir}/.config/transmission-daemon";
+  settingsDir = "${homeDir}/config";
   settingsFile = pkgs.writeText "settings.json" (builtins.toJSON fullSettings);
 
   # for users in group "transmission" to have access to torrents
@@ -20,12 +20,6 @@ let
   preStart = pkgs.writeScript "transmission-pre-start" ''
     #!${pkgs.runtimeShell}
     set -ex
-    for DIR in "${homeDir}" "${settingsDir}" "${fullSettings.download-dir}" "${fullSettings.incomplete-dir}"; do
-      mkdir -p "$DIR"
-    done
-    chmod 755 "${homeDir}"
-    chmod 700 "${settingsDir}"
-    chmod ${downloadDirPermissions} "${fullSettings.download-dir}" "${fullSettings.incomplete-dir}"
     cp -f ${settingsFile} ${settingsDir}/settings.json
   '';
 in
@@ -110,6 +104,13 @@ in
   };
 
   config = mkIf cfg.enable {
+    systemd.tmpfiles.rules = [
+      "d '${homeDir}' 0770 '${cfg.user}' '${cfg.group}' - -"
+      "d '${settingsDir}' 0700 '${cfg.user}' '${cfg.group}' - -"
+      "d '${fullSettings.download-dir}' '${downloadDirPermissions}' '${cfg.user}' '${cfg.group}' - -"
+      "d '${fullSettings.incomplete-dir}' '${downloadDirPermissions}' '${cfg.user}' '${cfg.group}' - -"
+    ];
+
     systemd.services.transmission = {
       description = "Transmission BitTorrent Service";
       after = [ "network.target" ] ++ optional apparmor "apparmor.service";

nixos/modules/services/web-apps/sogo.nix

@@ -0,0 +1,272 @@
+{ config, pkgs, lib, ... }: with lib; let
+  cfg = config.services.sogo;
+
+  preStart = pkgs.writeShellScriptBin "sogo-prestart" ''
+    touch /etc/sogo/sogo.conf
+    chown sogo:sogo /etc/sogo/sogo.conf
+    chmod 640 /etc/sogo/sogo.conf
+
+    ${if (cfg.configReplaces != {}) then ''
+      # Insert secrets
+      ${concatStringsSep "\n" (mapAttrsToList (k: v: ''export ${k}="$(cat "${v}" | tr -d '\n')"'') cfg.configReplaces)}
+
+      ${pkgs.perl}/bin/perl -p ${concatStringsSep " " (mapAttrsToList (k: v: '' -e 's/${k}/''${ENV{"${k}"}}/g;' '') cfg.configReplaces)} /etc/sogo/sogo.conf.raw > /etc/sogo/sogo.conf
+    '' else ''
+      cp /etc/sogo/sogo.conf.raw /etc/sogo/sogo.conf
+    ''}
+  '';
+
+in {
+  options.services.sogo = with types; {
+    enable = mkEnableOption "SOGo groupware";
+
+    vhostName = mkOption {
+      description = "Name of the nginx vhost";
+      type = str;
+      default = "sogo";
+    };
+
+    timezone = mkOption {
+      description = "Timezone of your SOGo instance";
+      type = str;
+      example = "America/Montreal";
+    };
+
+    language = mkOption {
+      description = "Language of SOGo";
+      type = str;
+      default = "English";
+    };
+
+    ealarmsCredFile = mkOption {
+      description = "Optional path to a credentials file for email alarms";
+      type = nullOr str;
+      default = null;
+    };
+
+    configReplaces = mkOption {
+      description = ''
+        Replacement-filepath mapping for sogo.conf.
+        Every key is replaced with the contents of the file specified as value.
+
+        In the example, every occurence of LDAP_BINDPW will be replaced with the text of the
+        specified file.
+      '';
+      type = attrsOf str;
+      default = {};
+      example = {
+        LDAP_BINDPW = "/var/lib/secrets/sogo/ldappw";
+      };
+    };
+
+    extraConfig = mkOption {
+      description = "Extra sogo.conf configuration lines";
+      type = lines;
+      default = "";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.sogo ];
+
+    environment.etc."sogo/sogo.conf.raw".text = ''
+      {
+        // Mandatory parameters
+        SOGoTimeZone = "${cfg.timezone}";
+        SOGoLanguage = "${cfg.language}";
+        // Paths
+        WOSendMail = "/run/wrappers/bin/sendmail";
+        SOGoMailSpoolPath = "/var/lib/sogo/spool";
+        SOGoZipPath = "${pkgs.zip}/bin/zip";
+        // Enable CSRF protection
+        SOGoXSRFValidationEnabled = YES;
+        // Remove dates from log (jornald does that)
+        NGLogDefaultLogEventFormatterClass = "NGLogEventFormatter";
+        // Extra config
+        ${cfg.extraConfig}
+      }
+    '';
+
+    systemd.services.sogo = {
+      description = "SOGo groupware";
+      after = [ "postgresql.service" "mysql.service" "memcached.service" "openldap.service" "dovecot2.service" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ config.environment.etc."sogo/sogo.conf.raw".source ];
+
+      environment.LDAPTLS_CACERT = "/etc/ssl/certs/ca-certificates.crt";
+
+      serviceConfig = {
+        Type = "forking";
+        ExecStartPre = "+" + preStart + "/bin/sogo-prestart";
+        ExecStart = "${pkgs.sogo}/bin/sogod -WOLogFile - -WOPidFile /run/sogo/sogo.pid";
+
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RuntimeDirectory = "sogo";
+        StateDirectory = "sogo/spool";
+
+        User = "sogo";
+        Group = "sogo";
+
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+
+        LockPersonality = true;
+        RestrictRealtime = true;
+        PrivateMounts = true;
+        PrivateUsers = true;
+        MemoryDenyWriteExecute = true;
+        SystemCallFilter = "@basic-io @file-system @network-io @system-service @timer";
+        SystemCallArchitectures = "native";
+        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
+      };
+    };
+
+    systemd.services.sogo-tmpwatch = {
+      description = "SOGo tmpwatch";
+
+      startAt = [ "hourly" ];
+      script = ''
+        SOGOSPOOL=/var/lib/sogo/spool
+
+        find "$SOGOSPOOL" -type f -user sogo -atime +23 -delete > /dev/null
+        find "$SOGOSPOOL" -mindepth 1 -type d -user sogo -empty -delete > /dev/null
+      '';
+
+      serviceConfig = {
+        Type = "oneshot";
+
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        StateDirectory = "sogo/spool";
+
+        User = "sogo";
+        Group = "sogo";
+
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+
+        LockPersonality = true;
+        RestrictRealtime = true;
+        PrivateMounts = true;
+        PrivateUsers = true;
+        PrivateNetwork = true;
+        SystemCallFilter = "@basic-io @file-system @system-service";
+        SystemCallArchitectures = "native";
+        RestrictAddressFamilies = "";
+      };
+    };
+
+    systemd.services.sogo-ealarms = {
+      description = "SOGo email alarms";
+
+      after = [ "postgresql.service" "mysqld.service" "memcached.service" "openldap.service" "dovecot2.service" "sogo.service" ];
+      restartTriggers = [ config.environment.etc."sogo/sogo.conf.raw".source ];
+
+      startAt = [ "minutely" ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.sogo}/bin/sogo-ealarms-notify${optionalString (cfg.ealarmsCredFile != null) " -p ${cfg.ealarmsCredFile}"}";
+
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        StateDirectory = "sogo/spool";
+
+        User = "sogo";
+        Group = "sogo";
+
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+
+        LockPersonality = true;
+        RestrictRealtime = true;
+        PrivateMounts = true;
+        PrivateUsers = true;
+        MemoryDenyWriteExecute = true;
+        SystemCallFilter = "@basic-io @file-system @network-io @system-service";
+        SystemCallArchitectures = "native";
+        RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
+      };
+    };
+
+    # nginx vhost
+    services.nginx.virtualHosts."${cfg.vhostName}" = {
+      locations."/".extraConfig = ''
+        rewrite ^ https://$server_name/SOGo;
+        allow all;
+      '';
+
+      # For iOS 7
+      locations."/principals/".extraConfig = ''
+        rewrite ^ https://$server_name/SOGo/dav;
+        allow all;
+      '';
+
+      locations."^~/SOGo".extraConfig = ''
+        proxy_pass http://127.0.0.1:20000;
+        proxy_redirect http://127.0.0.1:20000 default;
+
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Host $host;
+        proxy_set_header x-webobjects-server-protocol HTTP/1.0;
+        proxy_set_header x-webobjects-remote-host 127.0.0.1;
+        proxy_set_header x-webobjects-server-port $server_port;
+        proxy_set_header x-webobjects-server-name $server_name;
+        proxy_set_header x-webobjects-server-url $scheme://$host;
+        proxy_connect_timeout 90;
+        proxy_send_timeout 90;
+        proxy_read_timeout 90;
+        proxy_buffer_size 4k;
+        proxy_buffers 4 32k;
+        proxy_busy_buffers_size 64k;
+        proxy_temp_file_write_size 64k;
+        client_max_body_size 50m;
+        client_body_buffer_size 128k;
+        break;
+      '';
+
+      locations."/SOGo.woa/WebServerResources/".extraConfig = ''
+        alias ${pkgs.sogo}/lib/GNUstep/SOGo/WebServerResources/;
+        allow all;
+      '';
+
+      locations."/SOGo/WebServerResources/".extraConfig = ''
+        alias ${pkgs.sogo}/lib/GNUstep/SOGo/WebServerResources/;
+        allow all;
+      '';
+
+      locations."~ ^/SOGo/so/ControlPanel/Products/([^/]*)/Resources/(.*)$".extraConfig = ''
+        alias ${pkgs.sogo}/lib/GNUstep/SOGo/$1.SOGo/Resources/$2;
+      '';
+
+      locations."~ ^/SOGo/so/ControlPanel/Products/[^/]*UI/Resources/.*\\.(jpg|png|gif|css|js)$".extraConfig = ''
+        alias ${pkgs.sogo}/lib/GNUstep/SOGo/$1.SOGo/Resources/$2;
+      '';
+    };
+
+    # User and group
+    users.groups.sogo = {};
+    users.users.sogo = {
+      group = "sogo";
+      isSystemUser = true;
+      description = "SOGo service user";
+    };
+  };
+}

nixos/modules/services/web-apps/tt-rss.nix

@@ -631,9 +631,12 @@ let
         serviceConfig = {
           User = "${cfg.user}";
           Group = "tt_rss";
-          ExecStart = "${pkgs.php}/bin/php ${cfg.root}/update.php --daemon";
+          ExecStart = "${pkgs.php}/bin/php ${cfg.root}/update.php --daemon --quiet";
           StandardOutput = "syslog";
           StandardError = "syslog";
+          Restart = "on-failure";
+          RestartSec = "60";
+          SyslogIdentifier = "tt-rss";
         };
 
         wantedBy = [ "multi-user.target" ];

nixos/modules/services/web-servers/nginx/default.nix

@@ -756,9 +756,9 @@ in
       serviceConfig.Type = "oneshot";
       serviceConfig.TimeoutSec = 60;
       script = ''
-        if ${pkgs.systemd}/bin/systemctl -q is-active nginx.service ; then
+        if /run/current-system/systemd/bin/systemctl -q is-active nginx.service ; then
           ${execCommand} -t && \
-            ${pkgs.systemd}/bin/systemctl reload nginx.service
+            /run/current-system/systemd/bin/systemctl reload nginx.service
         fi
       '';
       serviceConfig.RemainAfterExit = true;
@@ -772,7 +772,7 @@ in
             webroot = vhostConfig.acmeRoot;
             extraDomains = genAttrs vhostConfig.serverAliases (alias: null);
             postRun = ''
-              systemctl reload nginx
+              /run/current-system/systemd/bin/systemctl reload nginx
             '';
           }; }) acmeEnabledVhosts;
       in

nixos/modules/services/x11/desktop-managers/default.nix

@@ -19,7 +19,7 @@ in
   # E.g., if Plasma 5 is enabled, it supersedes xterm.
   imports = [
     ./none.nix ./xterm.nix ./xfce.nix ./plasma5.nix ./lumina.nix
-    ./lxqt.nix ./enlightenment.nix ./gnome3.nix ./kodi.nix ./maxx.nix
+    ./lxqt.nix ./enlightenment.nix ./gnome3.nix ./kodi.nix
     ./mate.nix ./pantheon.nix ./surf-display.nix ./cde.nix
   ];
 

nixos/modules/services/x11/desktop-managers/maxx.nix

@@ -1,31 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  xcfg = config.services.xserver;
-  cfg = xcfg.desktopManager.maxx;
-in {
-  options.services.xserver.desktopManager.maxx = {
-    enable = mkEnableOption "MaXX desktop environment";
-  };
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.maxx ];
-
-    # there is hardcoded path in binaries
-    system.activationScripts.setup-maxx = ''
-      mkdir -p /opt
-      ln -sfn ${pkgs.maxx}/opt/MaXX /opt
-    '';
-
-    services.xserver.desktopManager.session = [
-    { name = "MaXX";
-      start = ''
-        exec ${pkgs.maxx}/opt/MaXX/etc/skel/Xsession.dt
-      '';
-    }];
-  };
-
-  meta.maintainers = [ maintainers.gnidorah ];
-}

nixos/modules/services/x11/display-managers/default.nix

@@ -39,7 +39,8 @@ let
 
       ${optionalString cfg.startDbusSession ''
         if test -z "$DBUS_SESSION_BUS_ADDRESS"; then
-          exec ${pkgs.dbus.dbus-launch} --exit-with-session "$0" "$@"
+          /run/current-system/systemd/bin/systemctl --user start dbus.socket
+          export `/run/current-system/systemd/bin/systemctl --user show-environment | grep '^DBUS_SESSION_BUS_ADDRESS'`
         fi
       ''}
 
@@ -59,7 +60,7 @@ let
       #
       # Also tell systemd about the dbus session bus address.
       # This is required by user units using the session bus.
-      ${config.systemd.package}/bin/systemctl --user import-environment DISPLAY XAUTHORITY DBUS_SESSION_BUS_ADDRESS
+      /run/current-system/systemd/bin/systemctl --user import-environment DISPLAY XAUTHORITY DBUS_SESSION_BUS_ADDRESS
 
       # Load X defaults. This should probably be safe on wayland too.
       ${xorg.xrdb}/bin/xrdb -merge ${xresourcesXft}
@@ -88,7 +89,7 @@ let
       fi
 
       # Start systemd user services for graphical sessions
-      ${config.systemd.package}/bin/systemctl --user start graphical-session.target
+      /run/current-system/systemd/bin/systemctl --user start graphical-session.target
 
       # Allow the user to setup a custom session type.
       if test -x ~/.xsession; then
@@ -393,7 +394,7 @@ in
 
           test -n "$waitPID" && wait "$waitPID"
 
-          ${config.systemd.package}/bin/systemctl --user stop graphical-session.target
+          /run/current-system/systemd/bin/systemctl --user stop graphical-session.target
 
           exit 0
         '';

nixos/modules/services/x11/display-managers/sddm.nix

@@ -30,8 +30,8 @@ let
 
   cfgFile = pkgs.writeText "sddm.conf" ''
     [General]
-    HaltCommand=${pkgs.systemd}/bin/systemctl poweroff
+    HaltCommand=/run/current-system/systemd/bin/systemctl poweroff
-    RebootCommand=${pkgs.systemd}/bin/systemctl reboot
+    RebootCommand=/run/current-system/systemd/bin/systemctl reboot
     ${optionalString cfg.autoNumlock ''
     Numlock=on
     ''}

nixos/modules/services/x11/xautolock.nix

@@ -66,7 +66,7 @@ in
 
         killer = mkOption {
           default = null; # default according to `man xautolock` is none
-          example = "${pkgs.systemd}/bin/systemctl suspend";
+          example = "/run/current-system/systemd/bin/systemctl suspend";
           type = types.nullOr types.str;
 
           description = ''

nixos/modules/tasks/network-interfaces-scripted.nix

@@ -54,7 +54,16 @@ let
     };
 
   normalConfig = {
-
+    systemd.network.links = let
+      createNetworkLink = i: nameValuePair "40-${i.name}" {
+        matchConfig.OriginalName = i.name;
+        linkConfig = optionalAttrs (i.macAddress != null) {
+          MACAddress = i.macAddress;
+        } // optionalAttrs (i.mtu != null) {
+          MTUBytes = toString i.mtu;
+        };
+      };
+    in listToAttrs (map createNetworkLink interfaces);
     systemd.services =
       let
 
@@ -164,7 +173,6 @@ let
           { description = "Address configuration of ${i.name}";
             wantedBy = [
               "network-setup.service"
-              "network-link-${i.name}.service"
               "network.target"
             ];
             # order before network-setup because the routes that are configured
@@ -183,6 +191,8 @@ let
                 state="/run/nixos/network/addresses/${i.name}"
                 mkdir -p $(dirname "$state")
 
+                ip link set "${i.name}" up
+
                 ${flip concatMapStrings ips (ip:
                   let
                     cidr = "${ip.address}/${toString ip.prefixLength}";
@@ -237,38 +247,6 @@ let
             '';
           };
 
-        createNetworkLink = i:
-        let
-          deviceDependency = if (config.boot.isContainer || i.name == "lo")
-            then []
-            else [ (subsystemDevice i.name) ];
-        in
-        nameValuePair "network-link-${i.name}"
-        { description = "Link configuration of ${i.name}";
-          wantedBy = [ "network-interfaces.target" ];
-          before = [ "network-interfaces.target" ];
-          bindsTo = deviceDependency;
-          after = [ "network-pre.target" ] ++ deviceDependency;
-          path = [ pkgs.iproute ];
-          serviceConfig = {
-            Type = "oneshot";
-            RemainAfterExit = true;
-          };
-          script =
-            ''
-              echo "Configuring link..."
-            '' + optionalString (i.macAddress != null) ''
-              echo "setting MAC address to ${i.macAddress}..."
-              ip link set "${i.name}" address "${i.macAddress}"
-            '' + optionalString (i.mtu != null) ''
-              echo "setting MTU to ${toString i.mtu}..."
-              ip link set "${i.name}" mtu "${toString i.mtu}"
-            '' + ''
-              echo -n "bringing up interface... "
-              ip link set "${i.name}" up && echo "done" || (echo "failed"; exit 1)
-            '';
-        };
-
         createTunDevice = i: nameValuePair "${i.name}-netdev"
           { description = "Virtual Network Interface ${i.name}";
             bindsTo = [ "dev-net-tun.device" ];
@@ -298,7 +276,7 @@ let
             bindsTo = deps ++ optional v.rstp "mstpd.service";
             partOf = [ "network-setup.service" ] ++ optional v.rstp "mstpd.service";
             after = [ "network-pre.target" ] ++ deps ++ optional v.rstp "mstpd.service"
-              ++ concatMap (i: [ "network-addresses-${i}.service" "network-link-${i}.service" ]) v.interfaces;
+              ++ map (i: "network-addresses-${i}.service") v.interfaces;
             before = [ "network-setup.service" ];
             serviceConfig.Type = "oneshot";
             serviceConfig.RemainAfterExit = true;
@@ -327,7 +305,7 @@ let
                   # if `libvirtd.service` is not running, do not use `virsh` which would try activate it via 'libvirtd.socket' and thus start it out-of-order.
                   # `libvirtd.service` will set up bridge interfaces when it will start normally.
                   #
-                  if ${pkgs.systemd}/bin/systemctl --quiet is-active 'libvirtd.service'; then
+                  if /run/current-system/systemd/bin/systemctl --quiet is-active 'libvirtd.service'; then
                     for uri in qemu:///system lxc:///; do
                       for dom in $(${pkgs.libvirt}/bin/virsh -c $uri list --name); do
                         ${pkgs.libvirt}/bin/virsh -c $uri dumpxml "$dom" | \
@@ -375,7 +353,7 @@ let
         createVswitchDevice = n: v: nameValuePair "${n}-netdev"
           (let
             deps = concatLists (map deviceDependency (attrNames (filterAttrs (_: config: config.type != "internal") v.interfaces)));
-            internalConfigs = concatMap (i: ["network-link-${i}.service" "network-addresses-${i}.service"]) (attrNames (filterAttrs (_: config: config.type == "internal") v.interfaces));
+            internalConfigs = map (i: "network-addresses-${i}.service") (attrNames (filterAttrs (_: config: config.type == "internal") v.interfaces));
             ofRules = pkgs.writeText "vswitch-${n}-openFlowRules" v.openFlowRules;
           in
           { description = "Open vSwitch Interface ${n}";
@@ -427,7 +405,7 @@ let
             bindsTo = deps;
             partOf = [ "network-setup.service" ];
             after = [ "network-pre.target" ] ++ deps
-              ++ concatMap (i: [ "network-addresses-${i}.service" "network-link-${i}.service" ]) v.interfaces;
+              ++ map (i: "network-addresses-${i}.service") v.interfaces;
             before = [ "network-setup.service" ];
             serviceConfig.Type = "oneshot";
             serviceConfig.RemainAfterExit = true;
@@ -540,7 +518,6 @@ let
           });
 
       in listToAttrs (
-           map createNetworkLink interfaces ++
            map configureAddrs interfaces ++
            map createTunDevice (filter (i: i.virtual) interfaces))
          // mapAttrs' createBridgeDevice cfg.bridges

nixos/modules/virtualisation/azure-agent.nix

@@ -48,7 +48,7 @@ let
 
   provisionedHook = pkgs.writeScript "provisioned-hook" ''
     #!${pkgs.runtimeShell}
-    ${config.systemd.package}/bin/systemctl start provisioned.target
+    /run/current-system/systemd/bin/systemctl start provisioned.target
   '';
 
 in

nixos/modules/virtualisation/hyperv-image.nix

@@ -37,6 +37,7 @@ in {
       name = cfg.vmDerivationName;
       postVM = ''
         ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o subformat=dynamic -O vhdx $diskImage $out/${cfg.vmFileName}
+        rm $diskImage
       '';
       format = "raw";
       diskSize = cfg.baseImageSize;

nixos/modules/virtualisation/vmware-image.nix

@@ -0,0 +1,90 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  boolToStr = value: if value then "on" else "off";
+  cfg = config.vmware;
+
+  subformats = [
+    "monolithicSparse"
+    "monolithicFlat"
+    "twoGbMaxExtentSparse"
+    "twoGbMaxExtentFlat"
+    "streamOptimized"
+  ];
+
+in {
+  options = {
+    vmware = {
+      baseImageSize = mkOption {
+        type = types.int;
+        default = 2048;
+        description = ''
+          The size of the VMWare base image in MiB.
+        '';
+      };
+      vmDerivationName = mkOption {
+        type = types.str;
+        default = "nixos-vmware-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}";
+        description = ''
+          The name of the derivation for the VMWare appliance.
+        '';
+      };
+      vmFileName = mkOption {
+        type = types.str;
+        default = "nixos-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.vmdk";
+        description = ''
+          The file name of the VMWare appliance.
+        '';
+      };
+      vmSubformat = mkOption {
+        type = types.enum subformats;
+        default = "monolithicSparse";
+        description = "Specifies which VMDK subformat to use.";
+      };
+      vmCompat6 = mkOption {
+        type = types.bool;
+        default = false;
+        example = true;
+        description = "Create a VMDK version 6 image (instead of version 4).";
+      };
+    };
+  };
+
+  config = {
+    system.build.vmwareImage = import ../../lib/make-disk-image.nix {
+      name = cfg.vmDerivationName;
+      postVM = ''
+        ${pkgs.vmTools.qemu}/bin/qemu-img convert -f raw -o compat6=${boolToStr cfg.vmCompat6},subformat=${cfg.vmSubformat} -O vmdk $diskImage $out/${cfg.vmFileName}
+        rm $diskImage
+      '';
+      format = "raw";
+      diskSize = cfg.baseImageSize;
+      partitionTableType = "efi";
+      inherit config lib pkgs;
+    };
+
+    fileSystems."/" = {
+      device = "/dev/disk/by-label/nixos";
+      autoResize = true;
+      fsType = "ext4";
+    };
+
+    fileSystems."/boot" = {
+      device = "/dev/disk/by-label/ESP";
+      fsType = "vfat";
+    };
+
+    boot.growPartition = true;
+
+    boot.loader.grub = {
+      version = 2;
+      device = "nodev";
+      efiSupport = true;
+      efiInstallAsRemovable = true;
+    };
+
+    virtualisation.vmware.guest.enable = true;
+  };
+}

nixos/tests/all-tests.nix

@@ -27,6 +27,7 @@ in
   atd = handleTest ./atd.nix {};
   avahi = handleTest ./avahi.nix {};
   babeld = handleTest ./babeld.nix {};
+  bazarr = handleTest ./bazarr.nix {};
   bcachefs = handleTestOn ["x86_64-linux"] ./bcachefs.nix {}; # linux-4.18.2018.10.12 is unsupported on aarch64
   beanstalkd = handleTest ./beanstalkd.nix {};
   bees = handleTest ./bees.nix {};
@@ -292,6 +293,7 @@ in
   slurm = handleTest ./slurm.nix {};
   smokeping = handleTest ./smokeping.nix {};
   snapper = handleTest ./snapper.nix {};
+  sogo = handleTest ./sogo.nix {};
   solr = handleTest ./solr.nix {};
   spacecookie = handleTest ./spacecookie.nix {};
   spike = handleTest ./spike.nix {};

nixos/tests/bazarr.nix

@@ -0,0 +1,26 @@
+import ./make-test-python.nix ({ lib, ... }:
+
+with lib;
+
+let
+  port = 42069;
+in
+{
+  name = "bazarr";
+  meta.maintainers = with maintainers; [ xwvvvvwx ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.bazarr = {
+        enable = true;
+        listenPort = port;
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_unit("bazarr.service")
+    machine.wait_for_open_port("${toString port}")
+    machine.succeed("curl --fail http://localhost:${toString port}/")
+  '';
+})

nixos/tests/home-assistant.nix

@@ -76,7 +76,7 @@ in {
         hass.succeed("test -f ${configDir}/ui-lovelace.yaml")
     with subtest("Check that Home Assistant's web interface and API can be reached"):
         hass.wait_for_open_port(8123)
-        hass.succeed("curl --fail http://localhost:8123/states")
+        hass.succeed("curl --fail http://localhost:8123/lovelace")
         assert "API running" in hass.succeed(
             "curl --fail -H 'x-ha-access: ${apiPassword}' http://localhost:8123/api/"
         )

nixos/tests/podman.nix

@@ -38,23 +38,45 @@ import ./make-test-python.nix (
       start_all()
 
 
-      with subtest("Run container as root"):
+      with subtest("Run container as root with runc"):
           podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
           podman.succeed(
-              "podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+              "podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
           )
           podman.succeed("podman ps | grep sleeping")
           podman.succeed("podman stop sleeping")
+          podman.succeed("podman rm sleeping")
 
-      with subtest("Run container rootless"):
+      with subtest("Run container as root with crun"):
+          podman.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
+          podman.succeed(
+              "podman run --runtime=crun -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+          )
+          podman.succeed("podman ps | grep sleeping")
+          podman.succeed("podman stop sleeping")
+          podman.succeed("podman rm sleeping")
+
+      with subtest("Run container rootless with runc"):
           podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
           podman.succeed(
               su_cmd(
-                  "podman run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+                  "podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
               )
           )
           podman.succeed(su_cmd("podman ps | grep sleeping"))
           podman.succeed(su_cmd("podman stop sleeping"))
+          podman.succeed(su_cmd("podman rm sleeping"))
+
+      with subtest("Run container rootless with crun"):
+          podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
+          podman.succeed(
+              su_cmd(
+                  "podman run --runtime=crun -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+              )
+          )
+          podman.succeed(su_cmd("podman ps | grep sleeping"))
+          podman.succeed(su_cmd("podman stop sleeping"))
+          podman.succeed(su_cmd("podman rm sleeping"))
     '';
   }
 )

nixos/tests/sogo.nix

@@ -0,0 +1,58 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "sogo";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ ajs124 das_j ];
+  };
+
+  nodes = {
+    sogo = { config, pkgs, ... }: {
+      services.nginx.enable = true;
+
+      services.mysql = {
+        enable = true;
+        package = pkgs.mysql;
+        ensureDatabases = [ "sogo" ];
+        ensureUsers = [{
+          name = "sogo";
+          ensurePermissions = {
+            "sogo.*" = "ALL PRIVILEGES";
+          };
+        }];
+      };
+
+      services.sogo = {
+        enable = true;
+        timezone = "Europe/Berlin";
+        extraConfig = ''
+          WOWorkersCount = 1;
+
+          SOGoUserSources = (
+            {
+              type = sql;
+              userPasswordAlgorithm = md5;
+              viewURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_users";
+              canAuthenticate = YES;
+              id = users;
+            }
+          );
+
+          SOGoProfileURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_user_profile";
+          OCSFolderInfoURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_folder_info";
+          OCSSessionsFolderURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_sessions_folder";
+          OCSEMailAlarmsFolderURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_alarms_folder";
+          OCSStoreURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_store";
+          OCSAclURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_acl";
+          OCSCacheFolderURL = "mysql://sogo@%2Frun%2Fmysqld%2Fmysqld.sock/sogo/sogo_cache_folder";
+        '';
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    sogo.wait_for_unit("multi-user.target")
+    sogo.wait_for_open_port(20000)
+    sogo.wait_for_open_port(80)
+    sogo.succeed("curl -sSfL http://sogo/SOGo")
+  '';
+})

nixos/tests/yggdrasil.nix

@@ -85,6 +85,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : {
             MulticastInterfaces = [ "eth1" ];
             LinkLocalTCPPort = 43210;
           };
+          persistentKeys = true;
         };
       };
     };

pkgs/applications/audio/audacity/default.nix

@@ -7,12 +7,12 @@
 with stdenv.lib;
 
 stdenv.mkDerivation rec {
-  version = "2.4.0";
+  version = "2.4.1";
   pname = "audacity";
 
   src = fetchzip {
     url = "https://github.com/audacity/audacity/archive/Audacity-${version}.tar.gz";
-    sha256 = "1f0lbzisqaj4pr9xxsx105a9ibym2qbngalnsb7iwmcvyrpc0l6a";
+    sha256 = "1xk0piv72d2xd3p7igr916fhcbrm76fhjr418k1rlqdzzg1hfljn";
   };
 
   preConfigure = /* we prefer system-wide libs */ ''

pkgs/applications/audio/bsequencer/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "BSEQuencer";
-  version = "1.4.0";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "sjaehn";
     repo = pname;
     rev = "${version}";
-    sha256 = "1zz1cirmx4wm4im4gjdp691f2042c8d1i8np1ns71f6kqdj9ps3k";
+    sha256 = "1fz0p0ba00b7k7a8q9mxwj01jwl8xwh9a2npn00pbbdrg9zv4fdr";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/audio/denemo/default.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "denemo";
-  version = "2.3.0";
+  version = "2.4.0";
 
   src = fetchurl {
     url = "https://ftp.gnu.org/gnu/denemo/denemo-${version}.tar.gz";
-    sha256 = "1blkcl3slbsq9jlhwcf2m9v9g38a0sjfhh9advgi2qr1gxri08by";
+    sha256 = "145kq0zfgdadykl3i6na221i4s5wzdrcqq48amzyfarnrqk2rmpd";
   };
 
   buildInputs = [

pkgs/applications/audio/ft2-clone/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ft2-clone";
-  version = "1.23";
+  version = "1.24";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${version}";
-    sha256 = "03prdifc2nz7smmzdy19flp33m927vb7j5bhdc46gak753pikw7d";
+    sha256 = "0wb7xsc2m9f4q5zsf5ai6h6c0558lkziv30b5a8ic64wp0layr6k";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/audio/goattracker/default.nix

@@ -0,0 +1,69 @@
+{ stdenv
+, fetchurl
+, unzip
+, makeDesktopItem
+, imagemagick
+, SDL
+, isStereo ? false
+}:
+
+with stdenv.lib;
+let
+  pname = "goattracker" + optionalString isStereo "-stereo";
+  desktopItem = makeDesktopItem {
+    type = "Application";
+    name = pname;
+    desktopName = "GoatTracker 2" + optionalString isStereo " Stereo";
+    genericName = "Music Tracker";
+    exec = if isStereo
+      then "gt2stereo"
+      else "goattrk2";
+    icon = "goattracker";
+    categories = "AudioVideo;AudioVideoEditing;";
+    extraEntries = "Keywords=tracker;music;";
+  };
+
+in stdenv.mkDerivation rec {
+  inherit pname;
+  version = if isStereo
+    then "2.76"  # stereo
+    else "2.75"; # normal
+
+  src = fetchurl {
+    url = "mirror://sourceforge/goattracker2/GoatTracker_${version}${optionalString isStereo "_Stereo"}.zip";
+    sha256 = if isStereo
+      then "12cz3780x5k047jqdv69n6rjgbfiwv67z850kfl4i37lxja432l7"  # stereo
+      else "1km97nl7qvk6qc5l5j69wncbm76hf86j47sgzgr968423g0bxxlk"; # normal
+  };
+  sourceRoot = (if isStereo then "gt2stereo/trunk" else "goattrk2") + "/src";
+
+  nativeBuildInputs = [ unzip imagemagick ];
+  buildInputs = [ SDL ];
+
+  # PREFIX gets treated as BINDIR.
+  makeFlags = [ "PREFIX=$(out)/bin/" ];
+
+  # The zip contains some build artifacts.
+  prePatch = "make clean";
+
+  # The destination does not get created automatically.
+  preBuild = "mkdir -p $out/bin";
+
+  # Other files get installed during the build phase.
+  installPhase = ''
+    convert goattrk2.bmp goattracker.png
+    install -Dm644 goattracker.png $out/share/icons/hicolor/32x32/apps/goattracker.png
+    ${desktopItem.buildCommand}
+  '';
+
+  meta = {
+    description = "A crossplatform music editor for creating Commodore 64 music. Uses reSID library by Dag Lem and supports alternatively HardSID & CatWeasel devices"
+      + optionalString isStereo " - Stereo version";
+    homepage = "https://cadaver.github.io/tools.html";
+    downloadPage = "https://sourceforge.net/projects/goattracker2/";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ fgaz ];
+    platforms = platforms.all;
+  };
+}
+

pkgs/applications/audio/guitarix/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, gettext, intltool, pkgconfig, python2
+{ stdenv, fetchurl, fetchpatch, faust, gettext, intltool, pkgconfig, python2
 , avahi, bluez, boost, eigen, fftw, glib, glib-networking
 , glibmm, gsettings-desktop-schemas, gtkmm2, libjack2
 , ladspaH, libav, libsndfile, lilv, lrdf, lv2, serd, sord, sratom
@@ -19,7 +19,15 @@ stdenv.mkDerivation rec {
     sha256 = "1nn80m1qagfhvv69za60f0w6ck87vmk77qmqarj7fbr8avwg63s9";
   };
 
-  nativeBuildInputs = [ gettext intltool wrapGAppsHook pkgconfig python2 wafHook ];
+  patches = [
+    (fetchpatch {
+      url = "https://git.archlinux.org/svntogit/community.git/plain/trunk/guitarix-0.39.0-fix_faust_and_lv2_plugins.patch?id=8579b4dfe85e04303ad2d9771ed699f04ea7b7cf";
+      stripLen = 1;
+      sha256 = "0pgkhi4v4vrzjnig0ggmz207q4x5iyk2n6rjj8s5lv15fia7qzp4";
+    })
+  ];
+
+  nativeBuildInputs = [ faust gettext intltool wrapGAppsHook pkgconfig python2 wafHook ];
 
   buildInputs = [
     avahi bluez boost eigen fftw glib glibmm glib-networking.out
@@ -28,11 +36,16 @@ stdenv.mkDerivation rec {
     zita-resampler curl
   ];
 
+  postPatch = ''
+    # Fix build with lv2 1.18: https://github.com/brummer10/guitarix/commit/c0334c72
+    find . -type f -exec fgrep -q LV2UI_Descriptor {} \; \
+      -exec sed -i {} -e 's/const struct _\?LV2UI_Descriptor/const LV2UI_Descriptor/' \;
+  '';
+
   wafConfigureFlags = [
     "--shared-lib"
     "--no-desktop-update"
     "--enable-nls"
-    "--no-faust" # todo: find out why --faust doesn't work
     "--install-roboto-font"
     "--includeresampler"
     "--convolver-ffmpeg"

pkgs/applications/audio/mopidy/iris.nix

@@ -2,11 +2,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "Mopidy-Iris";
-  version = "3.47.0";
+  version = "3.49.0";
 
   src = python3Packages.fetchPypi {
     inherit pname version;
-    sha256 = "1lvq5qsnn2djwkgbadzr7rr6ik2xh8yyj0p3y3hck9pl96ms7lfv";
+    sha256 = "0zddm7286iwx437gjz47m4g28s8gdcxnm2hmly9w1dzi08aa4fas";
   };
 
   propagatedBuildInputs = [

pkgs/applications/audio/pt2-clone/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pt2-clone";
-  version = "1.12";
+  version = "1.16";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${version}";
-    sha256 = "1y7kv889rm3nvaigcda4bglvwm799f3gp0zrivkvrg1lrlygs89f";
+    sha256 = "0rbjphhyca71j22lbyx53w3n2mkdw7xflks2knfaziwdkqcfcvp2";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/blockchains/clightning.nix

@@ -4,11 +4,11 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
   pname = "clightning";
-  version = "0.8.2";
+  version = "0.8.2.1";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/lightning/releases/download/v${version}/clightning-v${version}.zip";
-    sha256 = "1w5l3r3pnhnwz3x7mjgd69cw9a18fpyjwj7kmfka7cf9hdgcwp9x";
+    sha256 = "02incjr59fv75q6hlrln9h4b5gq7ipd778scbz8b8dahj7x1a6i5";
   };
 
   enableParallelBuilding = true;

pkgs/applications/blockchains/parity/default.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "parity";
-  version = "2.7.2";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "parity-ethereum";
     rev = "v${version}";
-    sha256 = "09cvqk0h9c26famh3f1nc3g74cd0zk6klys977yr1f13bgqmzx0x";
+    sha256 = "124km8c2d7877yzd885wzlcl3gky15isx0z2l1qg1q3cqdsb5mjf";
   };
 
-  cargoSha256 = "1fdymy8hvn137i5y4flyhlxwjxkd2cd6gq81i1429gk7j3h085ig";
+  cargoSha256 = "0m4pms7agfyqk6gz6fwxdl8jmcyhphhzh3x4vykbi6186y7a8ihq";
 
   LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
   nativeBuildInputs = [

pkgs/applications/editors/dit/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "dit";
-  version = "0.6";
+  version = "0.7";
 
   src = fetchurl {
     url = "https://hisham.hm/dit/releases/${version}/${pname}-${version}.tar.gz";
-    sha256 = "0ryvm54xxkg2gcgz4r8zdxrl6j2h8mgg9nfqmdmdr31qkcj8wjsq";
+    sha256 = "0cmbyzqfz2qa83cg8lpjifn34wmx34c5innw485zh4vk3c0k8wlj";
   };
 
   buildInputs = [ ncurses lua ]

pkgs/applications/graphics/cq-editor/default.nix

@@ -6,13 +6,13 @@
 
 mkDerivationWith python3Packages.buildPythonApplication rec {
   pname = "cq-editor";
-  version = "0.1RC1";
+  version = "0.1RC2";
 
   src = fetchFromGitHub {
     owner = "CadQuery";
     repo = "CQ-editor";
     rev = version;
-    sha256 = "0iwcpnj15s64k16948sakvkn1lb4mqwrhmbxk3r03bczs0z33zax";
+    sha256 = "0zima4pmn34s8b2axxwy6qd1f1r5ki34byq4x3rrd7n3g0hagxz5";
   };
 
   propagatedBuildInputs = with python3Packages; [

pkgs/applications/graphics/gnome-photos/default.nix

@@ -35,13 +35,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-photos";
-  version = "3.34.1";
+  version = "3.34.2";
 
   outputs = [ "out" "installedTests" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1ifm8hmxpf9nnxddfcpkbc5wc5f5hz43yj83nnakzqr6x1mq7gdp";
+    sha256 = "06ml5sf8xhpan410msqz085hmfc7082d368pb82yq646y9pcfn9w";
   };
 
   patches = [

pkgs/applications/misc/ArchiSteamFarm/default.nix

@@ -0,0 +1,52 @@
+{ stdenv, fetchurl, unzip, makeWrapper, autoPatchelfHook
+, zlib, lttng-ust, curl, icu, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "ArchiSteamFarm";
+  version = "4.2.0.6";
+
+  src = {
+    x86_64-linux = fetchurl {
+      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-x64.zip";
+      sha256 = "05hx6q1lkbjbqhwi9xxvm7ycnsnpl1cnqzyy2yn0q4x27im399cn";
+    };
+    armv7l-linux = fetchurl {
+      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-arm.zip";
+      sha256 = "0l8irqrpl5vbjj84k4makj2ph2z6kpny7qz51zrzbgwhrlw0w4vg";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://github.com/JustArchiNET/ArchiSteamFarm/releases/download/${version}/ASF-linux-arm64.zip";
+      sha256 = "0hg2g4i8sj3fxqfy4imz1iarby1d9f8dh59j266lbbdf2vfz2cml";
+    };
+  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
+
+  nativeBuildInputs = [ unzip makeWrapper autoPatchelfHook ];
+  buildInputs = [ stdenv.cc.cc zlib lttng-ust curl ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    dist=$out/opt/asf
+    mkdir -p $dist
+    cp -r * $dist
+    chmod +x $dist/ArchiSteamFarm
+    makeWrapper $dist/ArchiSteamFarm $out/bin/ArchiSteamFarm \
+      --prefix LD_LIBRARY_PATH : "${stdenv.lib.makeLibraryPath [ icu openssl ] }" \
+      --add-flags "--path ~/.config/asf" \
+      --run "mkdir -p ~/.config/asf" \
+      --run "cd ~/.config/asf" \
+      --run "[ -d config ] || cp --no-preserve=mode -r $dist/config ." \
+      --run "[ -d logs ] || cp --no-preserve=mode -r $dist/logs ." \
+      --run "[ -d plugins ] || cp --no-preserve=mode -r $dist/plugins ." \
+      --run "[ -d www ] || cp --no-preserve=mode -r $dist/www ." \
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Application with primary purpose of idling Steam cards from multiple accounts simultaneously";
+    homepage = "https://github.com/JustArchiNET/ArchiSteamFarm";
+    license = licenses.asl20;
+    platforms = [ "x86_64-linux" "armv7l-linux" "aarch64-linux" ];
+    maintainers = with maintainers; [ gnidorah ];
+    hydraPlatforms = [];
+  };
+}

pkgs/applications/misc/dbeaver/default.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "dbeaver-ce";
-  version = "7.0.4";
+  version = "7.0.5";
 
   desktopItem = makeDesktopItem {
     name = "dbeaver";
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "1d36d2rzsr8c048w0jyacvmgh46jamr9nzs22rmpm7xbzlnvdg4k";
+    sha256 = "082a0dszdlynpf7lrkwijwcs2x8xmbzrjr8rrwmrmkznhzj50gqf";
   };
 
   installPhase = ''

pkgs/applications/misc/fbmenugen/0001-Fix-paths.patch

@@ -0,0 +1,69 @@
+From 76c25147328d71960c70bbdd5a9396aac4a362a2 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Romildo=20Malaquias?= <malaquias@gmail.com>
+Date: Wed, 20 May 2020 14:19:07 -0300
+Subject: [PATCH] Fix paths
+
+---
+ fbmenugen | 14 ++++++--------
+ 1 file changed, 6 insertions(+), 8 deletions(-)
+
+diff --git a/fbmenugen b/fbmenugen
+index 46a18dc..0c8eb08 100755
+--- a/fbmenugen
++++ b/fbmenugen
+@@ -214,9 +214,7 @@ my %CONFIG = (
+ 
+ #<<<
+         desktop_files_paths => [
+-            '/usr/share/applications',
+-            '/usr/local/share/applications',
+-            '/usr/share/applications/kde4',
++            '/run/current-system/sw/share/applications',
+             "$home_dir/.local/share/applications",
+         ],
+ #>>>
+@@ -232,7 +230,7 @@ my %CONFIG = (
+     force_icon_size  => 0,
+     generic_fallback => 0,
+     locale_support   => 1,
+-    use_gtk3         => 0,
++    use_gtk3         => 1,
+ 
+     VERSION => $version,
+              );
+@@ -252,7 +250,7 @@ if (not -e $config_file) {
+ }
+ 
+ if (not -e $schema_file) {
+-    if (-e (my $etc_schema_file = "/etc/xdg/$pkgname/schema.pl")) {
++    if (-e (my $etc_schema_file = "@fbmenugen@/etc/xdg/$pkgname/schema.pl")) {
+         require File::Copy;
+         File::Copy::copy($etc_schema_file, $schema_file)
+           or warn "$0: can't copy file `$etc_schema_file' to `$schema_file': $!\n";
+@@ -570,7 +568,7 @@ EXIT
+         $generated_menu .= begin_category(@{$schema->{fluxbox}}) . <<"FOOTER";
+ [config] (Configure)
+ [submenu] (System Styles) {Choose a style...}
+-  [stylesdir] (/usr/share/fluxbox/styles)
++  [stylesdir] (@fluxbox@/share/fluxbox/styles)
+ [end]
+ [submenu] (User Styles) {Choose a style...}
+   [stylesdir] (~/.fluxbox/styles)
+@@ -580,12 +578,12 @@ EXIT
+   [exec] (Screenshot - JPG) {import screenshot.jpg && display -resize 50% screenshot.jpg}
+   [exec] (Screenshot - PNG) {import screenshot.png && display -resize 50% screenshot.png}
+   [exec] (Run) {fbrun}
+-  [exec] (Regen Menu) {fluxbox-generate_menu}
++  [exec] (Regen Menu) {@fluxbox@/bin/fluxbox-generate_menu}
+ [end]
+ [commanddialog] (Fluxbox Command)
+   [reconfig] (Reload config)
+   [restart] (Restart)
+-  [exec] (About) {(fluxbox -v; fluxbox -info | sed 1d) | xmessage -file - -center}
++  [exec] (About) {(@fluxbox@/bin/fluxbox -v; @fluxbox@/bin/fluxbox -info | @gnused@/bin/sed 1d) | @xmessage@/bin/xmessage -file - -center}
+   [separator]
+   [exit] (Exit)
+ [end]
+-- 
+2.26.2
+

pkgs/applications/misc/fbmenugen/default.nix

@@ -0,0 +1,75 @@
+{ stdenv
+, fetchFromGitHub
+, fluxbox
+, gnused
+, makeWrapper
+, perlPackages
+, substituteAll
+, xorg
+, wrapGAppsHook
+}:
+
+perlPackages.buildPerlPackage rec {
+  pname = "fbmenugen";
+  version = "2020-05-20";
+
+  src = fetchFromGitHub {
+    owner = "trizen";
+    repo = pname;
+    rev = "ed9a680546edbb5b05086971b6a9f42a37cb485f";
+    sha256 = "1fikdl08a0s8d6k1ls1pzmw2rcwkfbbczsjfx6lr12ngd2bz222h";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./0001-Fix-paths.patch;
+      xmessage = xorg.xmessage;
+      inherit fluxbox gnused;
+    })
+  ];
+
+  outputs = [ "out" ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    fluxbox
+    gnused
+    perlPackages.DataDump
+    perlPackages.FileDesktopEntry
+    perlPackages.Gtk3
+    perlPackages.LinuxDesktopFiles
+    perlPackages.perl
+    xorg.xmessage
+  ];
+
+  dontConfigure = true;
+
+  dontBuild = true;
+
+  postPatch = ''
+    substituteInPlace fbmenugen --subst-var-by fbmenugen $out
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -D -t $out/bin ${pname}
+    install -D -t $out/etc/xdg/${pname} schema.pl
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    wrapProgram "$out/bin/${pname}" --prefix PERL5LIB : "$PERL5LIB"
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/trizen/fbmenugen";
+    description = "Simple menu generator for the Fluxbox Window Manager";
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.romildo ];
+  };
+}

pkgs/applications/misc/fetchmail/default.nix

@@ -1,7 +1,7 @@
 { stdenv, fetchurl, openssl }:
 
 let
-  version = "6.4.4";
+  version = "6.4.5";
 in
 stdenv.mkDerivation {
   pname = "fetchmail";
@@ -9,7 +9,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "mirror://sourceforge/fetchmail/fetchmail-${version}.tar.xz";
-    sha256 = "1smbydwfjq29a2l44g6mgj0cd412fz40gbq6vq0klm7pmgd606si";
+    sha256 = "073bjh8qbvww7f5gbd6pq640qspi7dc6cjndvm0h2jcl0a90c3yk";
   };
 
   buildInputs = [ openssl ];

pkgs/applications/misc/geoipupdate/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "geoipupdate";
-  version = "4.2.2";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "maxmind";
     repo = "geoipupdate";
     rev = "v${version}";
-    sha256 = "057f9kp8g3wixjh9dm58g0qvzfcmhwbk1d573ldly4g5404r9bvf";
+    sha256 = "08h14bf4z2gx9sy34jpi2pvxv3i8g9ypl222hzdjsp2ixhl0jia9";
   };
 
   vendorSha256 = "0q4byhvs1c1xm4qjvs2vyf98vdv121qn0z51arcf7k4ayrys5xcx";

pkgs/applications/misc/hugo/default.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.70.0";
+  version = "0.71.0";
 
   buildInputs = [ libsass ];
 
@@ -10,7 +10,7 @@ buildGoModule rec {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "14g1x95jh91z9xm3xkv2psw2jn7z6bv2009miyv727df4d58nh6m";
+    sha256 = "1cjf69y8wvjq7kpncvqzmhc03pmf21nfxqpdnh64v34d14gpa1aa";
   };
 
   golibsass = fetchFromGitHub {
@@ -27,7 +27,7 @@ buildGoModule rec {
       '';
     });
 
-  vendorSha256 = "1wl9pg5wf1n5n7gq6lyz0l5ij4icjpfinl4myxwj93l2hqqyx2lf";
+  vendorSha256 = "1fz1wvw0jy3rj6pl1w6vpr0xr1v8pnpf76bwdalacqy6r85lxmkl";
 
   buildFlags = [ "-tags" "extended" ];
 

pkgs/applications/misc/img2pdf/default.nix

@@ -4,15 +4,13 @@ with python3Packages;
 
 buildPythonApplication rec {
   pname = "img2pdf";
-  version = "0.3.4";
+  version = "0.3.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0jgfk191vvxn2r6bbdknvw5v510mx9g0xrgnmcghaxkv65zjnj0b";
+    sha256 = "1yx0ljbg7phpix507wq584qvspp2jgax7flpp1148pxpc2d51mcc";
   };
 
-  doCheck = false; # needs pdfrw
-
   propagatedBuildInputs = [
     pillow
   ];

pkgs/applications/misc/jekyll/basic/Gemfile.lock

@@ -1,7 +1,7 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (6.0.3)
+    activesupport (6.0.3.1)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -66,7 +66,7 @@ GEM
       rb-inotify (~> 0.9, >= 0.9.10)
     mercenary (0.3.6)
     mini_portile2 (2.4.0)
-    minitest (5.14.0)
+    minitest (5.14.1)
     nokogiri (1.10.9)
       mini_portile2 (~> 2.4.0)
     pathutil (0.16.2)
@@ -76,7 +76,7 @@ GEM
     rb-inotify (0.10.1)
       ffi (~> 1.0)
     rexml (3.2.4)
-    rouge (3.18.0)
+    rouge (3.19.0)
     safe_yaml (1.0.5)
     sassc (2.3.0)
       ffi (~> 1.9)

pkgs/applications/misc/jekyll/basic/gemset.nix

@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0shh34xx9ygxb57s8mag8l22klvjfnk1c4jbjvchk16r6z0ps326";
+      sha256 = "1l29n9n38c9lpy5smh26r7fy7jp2bpjqlzhxgsr79cv7xpwlrbhs";
       type = "gem";
     };
-    version = "6.0.3";
+    version = "6.0.3.1";
   };
   addressable = {
     dependencies = ["public_suffix"];
@@ -280,10 +280,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g73x65hmjph8dg1h3rkzfg7ys3ffxm35hj35grw75fixmq53qyz";
+      sha256 = "09bz9nsznxgaf06cx3b5z71glgl0hdw469gqx3w7bqijgrb55p5g";
       type = "gem";
     };
-    version = "5.14.0";
+    version = "5.14.1";
   };
   nokogiri = {
     dependencies = ["mini_portile2"];
@@ -353,10 +353,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1n9h0ls2a2zq0bcsw31wxci1wdxb8s3vglfadxpcs6b04vkf6nqq";
+      sha256 = "102rc07d78k5bkl0s9nd1gw6wz0w0zcvg4g5sl7z9xxi4r793c35";
       type = "gem";
     };
-    version = "3.18.0";
+    version = "3.19.0";
   };
   safe_yaml = {
     groups = ["default"];

pkgs/applications/misc/jekyll/full/Gemfile.lock

@@ -1,7 +1,7 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (6.0.3)
+    activesupport (6.0.3.1)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -93,9 +93,9 @@ GEM
     mercenary (0.3.6)
     mime-types (3.3.1)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2020.0425)
+    mime-types-data (3.2020.0512)
     mini_portile2 (2.4.0)
-    minitest (5.14.0)
+    minitest (5.14.1)
     multipart-post (2.1.1)
     nokogiri (1.10.9)
       mini_portile2 (~> 2.4.0)
@@ -110,7 +110,7 @@ GEM
       ffi (~> 1.0)
     rdoc (6.2.1)
     rexml (3.2.4)
-    rouge (3.18.0)
+    rouge (3.19.0)
     safe_yaml (1.0.5)
     sassc (2.3.0)
       ffi (~> 1.9)

pkgs/applications/misc/jekyll/full/gemset.nix

@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0shh34xx9ygxb57s8mag8l22klvjfnk1c4jbjvchk16r6z0ps326";
+      sha256 = "1l29n9n38c9lpy5smh26r7fy7jp2bpjqlzhxgsr79cv7xpwlrbhs";
       type = "gem";
     };
-    version = "6.0.3";
+    version = "6.0.3.1";
   };
   addressable = {
     dependencies = ["public_suffix"];
@@ -478,10 +478,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1zin0q26wc5p7zb7glpwary7ms60s676vcq987yv22jgm6hnlwlh";
+      sha256 = "1z75svngyhsglx0y2f9rnil2j08f9ab54b3l95bpgz67zq2if753";
       type = "gem";
     };
-    version = "3.2020.0425";
+    version = "3.2020.0512";
   };
   mini_portile2 = {
     groups = ["default"];
@@ -498,10 +498,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0g73x65hmjph8dg1h3rkzfg7ys3ffxm35hj35grw75fixmq53qyz";
+      sha256 = "09bz9nsznxgaf06cx3b5z71glgl0hdw469gqx3w7bqijgrb55p5g";
       type = "gem";
     };
-    version = "5.14.0";
+    version = "5.14.1";
   };
   multipart-post = {
     groups = ["default"];
@@ -602,10 +602,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1n9h0ls2a2zq0bcsw31wxci1wdxb8s3vglfadxpcs6b04vkf6nqq";
+      sha256 = "102rc07d78k5bkl0s9nd1gw6wz0w0zcvg4g5sl7z9xxi4r793c35";
       type = "gem";
     };
-    version = "3.18.0";
+    version = "3.19.0";
   };
   safe_yaml = {
     groups = ["default"];

pkgs/applications/misc/jgmenu/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jgmenu";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "johanmalm";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1wcmx2yhm6n54w6nymgb8pgfjv411i3zj1vk79q9vr052y1622z0";
+    sha256 = "00q4v31x4q7nm61wda4v0gznv18bm3qs8mp04pcns60qacdv9lkk";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/keepass/default.nix

@@ -1,13 +1,13 @@
 { stdenv, lib, fetchurl, buildDotnetPackage, substituteAll, makeWrapper, makeDesktopItem,
-  unzip, icoutils, gtk2, xorg, xdotool, xsel, plugins ? [] }:
+  unzip, icoutils, gtk2, xorg, xdotool, xsel, coreutils, unixtools, glib, plugins ? [] }:
 
 with builtins; buildDotnetPackage rec {
   baseName = "keepass";
-  version = "2.40";
+  version = "2.45";
 
   src = fetchurl {
     url = "mirror://sourceforge/keepass/KeePass-${version}-Source.zip";
-    sha256 = "1gldl74wz2lvsci6rn71d6q1zmnhr52z6fjib9nsragsazq5byz9";
+    sha256 = "07wyp3k2kiprr47mc4vxb7vmh7g5kshcqw0gq3qr87gi78c9i66m";
   };
 
   sourceRoot = ".";
@@ -20,6 +20,9 @@ with builtins; buildDotnetPackage rec {
       xsel = "${xsel}/bin/xsel";
       xprop = "${xorg.xprop}/bin/xprop";
       xdotool = "${xdotool}/bin/xdotool";
+      uname = "${coreutils}/bin/uname";
+      whereis = "${unixtools.whereis}/bin/whereis";
+      gsettings = "${glib}/bin/gsettings";
     })
   ];
 

pkgs/applications/misc/keepass/fix-paths.patch

@@ -1,8 +1,23 @@
+From 830d0db80f2fce09e12c117f8338b8e4b05866ff Mon Sep 17 00:00:00 2001
+From: Pascal Winkelmann <pascal@wnklmnn.de>
+Date: Tue, 19 May 2020 10:28:31 +0200
+Subject: [PATCH] fixpaths
+
+---
+ KeePass/Native/NativeMethods.Unix.cs  |  2 +-
+ KeePass/UI/UISystemFonts.cs           |  2 +-
+ KeePass/Util/AppLocator.cs            |  2 +-
+ KeePass/Util/ClipboardUtil.Unix.cs    | 14 +++++++-------
+ KeePassLib/Native/ClipboardU.cs       |  2 +-
+ KeePassLib/Native/NativeLib.cs        |  2 +-
+ KeePassLib/Utility/MonoWorkarounds.cs |  4 ++--
+ 7 files changed, 14 insertions(+), 14 deletions(-)
+
 diff --git a/KeePass/Native/NativeMethods.Unix.cs b/KeePass/Native/NativeMethods.Unix.cs
-index 7495a1c..4ef4727 100644
+index 4c47258..79cfdb2 100644
 --- a/KeePass/Native/NativeMethods.Unix.cs
 +++ b/KeePass/Native/NativeMethods.Unix.cs
-@@ -128,7 +128,7 @@ namespace KeePass.Native
+@@ -130,7 +130,7 @@ namespace KeePass.Native
  			try
  			{
  				Application.DoEvents(); // E.g. for clipboard updates
@@ -11,10 +26,54 @@ index 7495a1c..4ef4727 100644
  				Application.DoEvents(); // E.g. for clipboard updates
  				return (strOutput ?? string.Empty);
  			}
+diff --git a/KeePass/UI/UISystemFonts.cs b/KeePass/UI/UISystemFonts.cs
+index 08d6134..2bfa4a2 100644
+--- a/KeePass/UI/UISystemFonts.cs
++++ b/KeePass/UI/UISystemFonts.cs
+@@ -188,7 +188,7 @@ namespace KeePass.UI
+ 
+ 		private static void UbuntuLoadFonts()
+ 		{
+-			string strDef = NativeLib.RunConsoleApp("gsettings",
++			string strDef = NativeLib.RunConsoleApp("@gsettings@",
+ 				"get org.gnome.desktop.interface font-name");
+ 			if(strDef == null) return;
+ 
+diff --git a/KeePass/Util/AppLocator.cs b/KeePass/Util/AppLocator.cs
+index af02803..8a32c9d 100644
+--- a/KeePass/Util/AppLocator.cs
++++ b/KeePass/Util/AppLocator.cs
+@@ -429,7 +429,7 @@ namespace KeePass.Util
+ 			if(NativeLib.GetPlatformID() == PlatformID.MacOSX)
+ 				strArgPrefix = string.Empty; // FR 3535696
+ 
+-			string str = NativeLib.RunConsoleApp("whereis", strArgPrefix + strApp);
++			string str = NativeLib.RunConsoleApp("@whereis@", strArgPrefix + strApp);
+ 			if(str == null) return null;
+ 
+ 			str = str.Trim();
 diff --git a/KeePass/Util/ClipboardUtil.Unix.cs b/KeePass/Util/ClipboardUtil.Unix.cs
-index e93a22a..3fd9a2b 100644
+index ab49ee2..7f6c50f 100644
 --- a/KeePass/Util/ClipboardUtil.Unix.cs
 +++ b/KeePass/Util/ClipboardUtil.Unix.cs
+@@ -42,7 +42,7 @@ namespace KeePass.Util
+ 			// string strGtk = GtkGetString();
+ 			// if(strGtk != null) return strGtk;
+ 
+-			return (NativeLib.RunConsoleApp("pbpaste", "-pboard general") ??
++			return (NativeLib.RunConsoleApp("@pbpaste@", "-pboard general") ??
+ 				string.Empty);
+ 		}
+ 
+@@ -50,7 +50,7 @@ namespace KeePass.Util
+ 		{
+ 			// if(GtkSetString(str)) return;
+ 
+-			NativeLib.RunConsoleApp("pbcopy", "-pboard general", str);
++			NativeLib.RunConsoleApp("@pbcopy@", "-pboard general", str);
+ 		}
+ 
+ 		private static string GetStringU()
 @@ -62,7 +62,7 @@ namespace KeePass.Util
  			//	"-out -selection clipboard");
  			// if(str != null) return str;
@@ -51,20 +110,33 @@ index e93a22a..3fd9a2b 100644
  				return;
  			}
 diff --git a/KeePassLib/Native/ClipboardU.cs b/KeePassLib/Native/ClipboardU.cs
-index ddd8f57..150eb82 100644
+index 291c51d..3c76380 100644
 --- a/KeePassLib/Native/ClipboardU.cs
 +++ b/KeePassLib/Native/ClipboardU.cs
 @@ -27,7 +27,7 @@ namespace KeePassLib.Native
  {
  	internal static class ClipboardU
  	{
--		private const string XSel = "xsel";
+-		internal const string XSel = "xsel";
-+		private const string XSel = "@xsel@";
++		internal const string XSel = "@xsel@";
  		private const string XSelV = "--version";
  		private const string XSelR = "--output --clipboard";
  		private const string XSelC = "--clear --clipboard";
+diff --git a/KeePassLib/Native/NativeLib.cs b/KeePassLib/Native/NativeLib.cs
+index 2d227a3..243f4ee 100644
+--- a/KeePassLib/Native/NativeLib.cs
++++ b/KeePassLib/Native/NativeLib.cs
+@@ -145,7 +145,7 @@ namespace KeePassLib.Native
+ 			// Mono returns PlatformID.Unix on Mac OS X, workaround this
+ 			if(m_platID.Value == PlatformID.Unix)
+ 			{
+-				if((RunConsoleApp("uname", null) ?? string.Empty).Trim().Equals(
++				if((RunConsoleApp("@uname@", null) ?? string.Empty).Trim().Equals(
+ 					"Darwin", StrUtil.CaseIgnoreCmp))
+ 					m_platID = PlatformID.MacOSX;
+ 			}
 diff --git a/KeePassLib/Utility/MonoWorkarounds.cs b/KeePassLib/Utility/MonoWorkarounds.cs
-index 0da7019..f6a1022 100644
+index e20bb3a..4fd875b 100644
 --- a/KeePassLib/Utility/MonoWorkarounds.cs
 +++ b/KeePassLib/Utility/MonoWorkarounds.cs
 @@ -41,7 +41,7 @@ namespace KeePassLib.Utility
@@ -76,7 +148,7 @@ index 0da7019..f6a1022 100644
  
  		private static Dictionary<uint, bool> g_dForceReq = new Dictionary<uint, bool>();
  		private static Thread g_thFixClip = null;
-@@ -303,7 +303,7 @@ namespace KeePassLib.Utility
+@@ -335,7 +335,7 @@ namespace KeePassLib.Utility
  				// }
  				// else { Debug.Assert(false); }
  
@@ -85,3 +157,6 @@ index 0da7019..f6a1022 100644
  					"-id " + strHandle + " WM_CLASS") ?? string.Empty);
  
  				if(strWmClass.IndexOf("\"" + PwDefs.ResClass + "\"",
+-- 
+2.25.4
+

pkgs/applications/misc/keepass/keepass-plugins.patch

@@ -1,13 +1,25 @@
+From 4cb0b18f5326a07927453897180289a4b254ac4f Mon Sep 17 00:00:00 2001
+From: Pascal Winkelmann <pascal@wnklmnn.de>
+Date: Tue, 19 May 2020 10:43:49 +0200
+Subject: [PATCH] loadplugin
+
+---
+ KeePass/Forms/MainForm.cs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
 diff --git a/KeePass/Forms/MainForm.cs b/KeePass/Forms/MainForm.cs
-index 3d5fca0..4c3f3d4 100644
+index 347eaf5..b92e1e2 100644
 --- a/KeePass/Forms/MainForm.cs
 +++ b/KeePass/Forms/MainForm.cs
-@@ -406,7 +406,$OUTPUT_LC$ @@ namespace KeePass.Forms
+@@ -440,7 +440,7 @@ namespace KeePass.Forms
- 			m_pluginManager.Initialize(m_pluginDefaultHost);
+ 				ToolStripItemCollection tsicT = m_ctxTray.Items;
+ 				ToolStripItem tsiPrevT = m_ctxTrayOptions;
  
- 			m_pluginManager.UnloadAllPlugins();
+-				m_pluginManager.LoadAllPlugins();
--			if(AppPolicy.Current.Plugins) m_pluginManager.LoadAllPlugins();
 $DO_LOADS$+
  
- 			// Delete old files *after* loading plugins (when timestamps
+ 				m_pluginManager.AddMenuItems(PluginMenuType.Main, tsicM, tsiPrevM);
- 			// of loaded plugins have been updated already)
+ 				m_pluginManager.AddMenuItems(PluginMenuType.Group, tsicGM, tsiPrevGM);
+-- 
+2.25.4
+

pkgs/applications/misc/klayout/default.nix

@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "klayout";
-  version = "0.26.4";
+  version = "0.26.5";
 
   src = fetchFromGitHub {
     owner = "KLayout";
     repo = "klayout";
     rev = "v${version}";
-    sha256 = "0hqc11vz24b6nfpfzsjwwmaq0sznwwqpzmd48q5wpdl0kz1309gj";
+    sha256 = "1zv8yazhdyxm33vdn0m5cciw7zzg45nwdg4rdcsydnrwg7d667r6";
   };
 
   postPatch = ''

pkgs/applications/misc/pdfarranger/default.nix

@@ -5,13 +5,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pdfarranger";
-  version = "1.5.1";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "jeromerobert";
     repo = pname;
     rev = version;
-    sha256 = "0n4jw0dsqw929a34ff077kz8w89vkjkqf8dy4c356zh6gf23cdxr";
+    sha256 = "0a9ap7p8iw57sn5nmhim7gp5as8gj6ir6l3p0bpmg4iqjsr4169h";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/sequeler/default.nix

@@ -11,13 +11,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "sequeler";
-  version = "0.7.9";
+  version = "0.7.91";
 
   src = fetchFromGitHub {
     owner = "Alecaddd";
     repo = pname;
     rev = "v${version}";
-    sha256 = "117gcc41rd24y5hpm3drqxfcfz52smpcr8w76xnykx8wb1ac50jf";
+    sha256 = "071vfx7bdf7hfa4784xz97vrj9x5aipgjbp30r00kg2zhg8wa2ls";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig vala gettext wrapGAppsHook python3 desktop-file-utils ];

pkgs/applications/misc/syncthingtray/default.nix

@@ -39,6 +39,12 @@ mkDerivation rec {
 
   nativeBuildInputs = [ cmake qttools ];
 
+  # No tests are available by upstream, but we test --help anyway
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/syncthingtray --help | grep ${version}
+  '';
+
   cmakeFlags = [
     # See https://github.com/Martchus/syncthingtray/issues/42
     "-DQT_PLUGIN_DIR:STRING=${placeholder "out"}/lib/qt-5"

pkgs/applications/misc/timewarrior/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "timewarrior";
-  version = "1.2.0";
+  version = "1.3.0";
 
   enableParallelBuilding = true;
 
@@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
     owner = "GothenburgBitFactory";
     repo = "timewarrior";
     rev = "v${version}";
-    sha256 = "0ci8kb7gdp1dsv6xj30nbz8lidrmn50pbriw26wv8mdhs17rfk7w";
+    sha256 = "1aijh1ad7gpa61cn7b57w24vy7fyjj0zx5k9z8d6m1ldzbw589cl";
     fetchSubmodules = true;
   };
 

pkgs/applications/misc/waybar/default.nix

@@ -7,6 +7,7 @@
 , udevSupport  ? true,  udev
 , swaySupport  ? true,  sway
 , mpdSupport   ? true,  mpd_clientlib
+, withMediaPlayer ? false, glib, gobject-introspection, python3, python38Packages, playerctl
 }:
   stdenv.mkDerivation rec {
     pname = "waybar";
@@ -21,7 +22,14 @@
 
     nativeBuildInputs = [
       meson ninja pkgconfig scdoc wrapGAppsHook cmake
+    ] ++ stdenv.lib.optional withMediaPlayer gobject-introspection;
+
+    propagatedBuildInputs = stdenv.lib.optionals withMediaPlayer [
+      glib
+      playerctl
+      python38Packages.pygobject3
     ];
+    strictDeps = false;
 
     buildInputs = with stdenv.lib;
       [ wayland wlroots gtkmm3 libinput libsigcxx jsoncpp fmt spdlog gtk-layer-shell howard-hinnant-date ]
@@ -46,6 +54,13 @@
       "-Dsystemd=disabled"
     ];
 
+    preFixup = stdenv.lib.optional withMediaPlayer ''
+      cp $src/resources/custom_modules/mediaplayer.py $out/bin/waybar-mediaplayer.py
+
+      wrapProgram $out/bin/waybar-mediaplayer.py \
+        --prefix PYTHONPATH : "$PYTHONPATH:$out/${python3.sitePackages}"
+    '';
+
     meta = with stdenv.lib; {
       description = "Highly customizable Wayland bar for Sway and Wlroots based compositors";
       license = licenses.mit;

pkgs/applications/networking/browsers/brave/default.nix

@@ -18,6 +18,7 @@
 , gtk3
 , libpulseaudio
 , libuuid
+, libdrm
 , libX11
 , libXcomposite
 , libXcursor
@@ -29,6 +30,7 @@
 , libXrender
 , libXScrnSaver
 , libXtst
+, mesa
 , nspr
 , nss
 , pango
@@ -56,6 +58,7 @@ rpath = lib.makeLibraryPath [
   glib
   gnome2.GConf
   gtk3
+  libdrm
   libpulseaudio
   libX11
   libXScrnSaver
@@ -69,6 +72,7 @@ rpath = lib.makeLibraryPath [
   libXrender
   libXtst
   libuuid
+  mesa
   nspr
   nss
   pango
@@ -82,11 +86,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.7.92";
+  version = "1.8.95";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "1f262xh88c83m6ixqxc69z8kvkl3qbjc6jnv2g8n0flw8s70hs7z";
+    sha256 = "1mlffg2v31b42gj354w5yv0yzlqc2f4f3cmdnddzkplw10jgw6f1";
   };
 
   dontConfigure = true;

pkgs/applications/networking/browsers/chromium/common.nix

@@ -154,13 +154,10 @@ let
       #
       # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
       # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
-    ] ++ optionals (useVaapi) ([ # Fixes for the VA-API build:
+    ] ++ optionals (useVaapi) [ # Improvements for the VA-API build:
       ./patches/enable-vdpau-support-for-nvidia.patch # https://aur.archlinux.org/cgit/aur.git/tree/vdpau-support.patch?h=chromium-vaapi
       ./patches/enable-video-acceleration-on-linux.patch # Can be controlled at runtime (i.e. without rebuilding Chromium)
-    ] ++ optionals (versionRange "81" "82") [
+    ];
-      (githubPatch "5b2ff215473e0526b5b24aeff4ad90d369b21c75" "0n00vh8wfpn2ay5fqsxcsx0zadnv7mihm72bcvnrfzh75nzbg902")
-      (githubPatch "98e343ab369e4262511b5fce547728e3e5eefba8" "00wwp653jk0k0yvix00vr7ymgck9dj7fxjwx4nc67ynn84dh6064")
-    ]);
 
     postPatch = ''
       # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX

pkgs/applications/networking/browsers/chromium/default.nix

@@ -22,9 +22,7 @@
 }:
 
 let
-  llvmPackages = if channel != "stable"
+  llvmPackages = llvmPackages_10;
-    then llvmPackages_10
-    else llvmPackages_9;
   stdenv = llvmPackages.stdenv;
 
   callPackage = newScope chromium;
@@ -36,8 +34,6 @@ let
 
     mkChromiumDerivation = callPackage ./common.nix ({
       inherit gnome gnomeSupport gnomeKeyringSupport proprietaryCodecs cupsSupport pulseSupport useOzone;
-      gnChromium = gn;
-    } // lib.optionalAttrs (channel != "stable") {
       # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
       gnChromium = gn.overrideAttrs (oldAttrs: {
         version = "2020-03-23";

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "0z9p4v5mkinf7hbdagh4bz6ymqjxg3df3wjpvm201ilzzngmjqz1";
+    sha256 = "1g052h8g458qx04wbkz93j7hciw12b2b3w93x2849ag69q6g4qa9";
-    sha256bin64 = "1srvlirhnynh0q2a17p8z13p7r54z0cchh1d1h07hqljnwmsf8qj";
+    sha256bin64 = "0lkjl09vnj2bd1jry3awbg4z34vjnzd88p73a6x7pyrfq079l6vb";
-    version = "83.0.4103.34";
+    version = "83.0.4103.61";
   };
   dev = {
-    sha256 = "178fc112bsbrgj2hss78y8rhnz8hl85fr33gawk9fz88zk5qz7xd";
+    sha256 = "0f7m57acv79yzq3yg2xkchqqwisdgjv8h5xngp2i2v2md9jkfkbq";
-    sha256bin64 = "06qra245l2bbgxc3k04aabkgq1qnzybnrjhrjb25vriv31ji36b1";
+    sha256bin64 = "0b0w0nwa64gf99d617idjjgrjym3qc6p9h41kn5r9j2x46lxzply";
-    version = "84.0.4128.3";
+    version = "84.0.4143.2";
   };
   stable = {
-    sha256 = "19kpzmqmld0m0nflx13w9flxfal19msnxhzl3lip1jqih65z4y7l";
+    sha256 = "1g052h8g458qx04wbkz93j7hciw12b2b3w93x2849ag69q6g4qa9";
-    sha256bin64 = "0sl4wv7npc3rhi7jgn679hi7j5ykzwpx5dahy78h87yfg4fx84wx";
+    sha256bin64 = "1wji1ak6gi2a7lynxwvgpqsaz7zma9h2b9qbb5x3gzbv2dj37fmd";
-    version = "81.0.4044.138";
+    version = "83.0.4103.61";
   };
 }

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -18,11 +18,11 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "2.11.1811.52-1";
+  version = "3.0.1874.38-1";
 
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}_amd64.deb";
-    sha256 = "0bq9ggk75xzka2nbrnc7vghq8s7jjy9nbfmyrf51kf0nni1zg1fp";
+    sha256 = "03667f8rlk8shxq6ghjg4q9hqhsaw4gwpqnjpyili49qczd5423w";
   };
 
   unpackPhase = ''

pkgs/applications/networking/cluster/cni/plugins.nix

@@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ lib, fetchFromGitHub, buildGoModule, nixosTests }:
 
 buildGoModule rec {
   pname = "cni-plugins";
@@ -36,6 +36,8 @@ buildGoModule rec {
     "plugins/meta/tuning"
   ];
 
+  passthru.tests.podman = nixosTests.podman;
+
   meta = with lib; {
     description = "Some standard networking plugins, maintained by the CNI team";
     homepage = "https://github.com/containernetworking/plugins";

pkgs/applications/networking/cluster/helm/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "helm";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "1x05xnc3czk7vpn9qnfdavdjy5agv800nh7jyqczpiw125l9jfyd";
+    sha256 = "1453qkd9s4z4r0xzmv8ym7qfg33szf6gizfkb5zxj590fcbsgnd7";
   };
   vendorSha256 = "0j25m56cwzjd9b75v7xlb26q81bsmln77k23h9n8v2f2gqwwpkrl";
 
@@ -28,4 +28,4 @@ buildGoModule rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ rlupton20 edude03 saschagrunert Frostman ];
   };
-}
+}

pkgs/applications/networking/cluster/kube3d/default.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "kube3d";
-  version = "1.6.0";
+  version = "1.7.0";
   k3sVersion = "1.17.3-k3s1";
 
   goPackagePath = "github.com/rancher/k3d";
@@ -11,7 +11,7 @@ buildGoModule rec {
     owner  = "rancher";
     repo   = "k3d";
     rev    = "v${version}";
-    sha256 = "0qjwqqynvgzainq66fpzczgynwk3hv7wzgfy5271fc6mj2k0zz5x";
+    sha256 = "0aij2l7zmg4cxbw7pwf7ddc64di25hpjvbmp1madhz9q28rwfa9w";
   };
 
   buildFlagsArray = ''

pkgs/applications/networking/cluster/kubeseal/default.nix

@@ -2,19 +2,21 @@
 
 buildGoModule rec {
   pname = "kubeseal";
-  version = "0.12.0";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "bitnami-labs";
     repo = "sealed-secrets";
     rev = "v${version}";
-    sha256 = "0z51iwdc4m0y8wyyx3mcvbzxlrgws7n5wkcd0g7nr73irnsld4lh";
+    sha256 = "1h8n2219xh0gl42kz3rkv3aj3wfwivvs9skwbbrvmrkwwrpxkgdj";
   };
 
   vendorSha256 = null;
 
   subPackages = [ "cmd/kubeseal" ];
 
+  buildFlagsArray = [ "-ldflags=-s -w -X main.VERSION=${version}" ];
+
   meta = with lib; {
     description = "A Kubernetes controller and tool for one-way encrypted Secrets";
     homepage = "https://github.com/bitnami-labs/sealed-secrets";

pkgs/applications/networking/instant-messengers/rambox/pro.nix

@@ -16,22 +16,31 @@ stdenv.mkDerivation rec {
   };
 
   installPhase = ''
-    mkdir -p $out/bin $out/opt/RamboxPro $out/share/applications
+    mkdir -p $out/{bin,resources/dist/renderer/assets/images/app,share/applications,share/icons/hicolor/256x256/apps}
-    asar e resources/app.asar $out/opt/RamboxPro/resources/app.asar.unpacked   
+
-    ln -s ${desktopItem}/share/applications/* $out/share/applications
+    asar e resources/app.asar $out/resources
+
+    substituteInPlace "$out/resources/dist/electron/main.js" \
+      --replace ",isHidden:" ",path:\"$out/bin/ramboxpro\",isHidden:"
+
+    cp $desktopItem/share/applications/* $out/share/applications
+    cp $out/resources/dist/electron/imgs/256x256.png $out/share/icons/hicolor/256x256/apps/ramboxpro.png
+    cp $out/resources/dist/electron/imgs/256x256.png $out/resources/dist/renderer/assets/images/app/icon.png
   '';
 
   postFixup = ''
     makeWrapper ${electron}/bin/electron $out/bin/ramboxpro \
-      --add-flags "$out/opt/RamboxPro/resources/app.asar.unpacked --without-update" \
+      --add-flags "$out/resources --without-update" \
       --prefix PATH : ${xdg_utils}/bin
   '';
 
   desktopItem = makeDesktopItem {
     name = "rambox-pro";
     exec = "ramboxpro";
+    icon = "ramboxpro";
     type = "Application";
     desktopName = "Rambox Pro";
+    categories = "Network;";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json

@@ -1,15 +1,111 @@
 {
-  "name": "riot-web",
+  "name": "riot-desktop",
   "productName": "Riot",
   "main": "src/electron-main.js",
-  "version": "1.6.0",
+  "version": "1.6.2",
   "description": "A feature-rich client for Matrix.org",
   "author": "New Vector Ltd.",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/vector-im/riot-desktop"
+  },
+  "license": "Apache-2.0",
+  "files": [],
+  "scripts": {
+    "mkdirs": "mkdirp packages deploys",
+    "fetch": "yarn run mkdirs && node scripts/fetch-package.js",
+    "start": "electron .",
+    "lint": "eslint src/ scripts/ hak/",
+    "build:native": "yarn run hak",
+    "build32": "electron-builder --ia32",
+    "build64": "electron-builder --x64",
+    "build": "electron-builder",
+    "docker:setup": "docker build -t riot-desktop-dockerbuild dockerbuild",
+    "docker:build:native": "scripts/in-docker.sh yarn run hak",
+    "docker:build": "scripts/in-docker.sh yarn run build",
+    "docker:install": "scripts/in-docker.sh yarn install",
+    "debrepo": "scripts/mkrepo.sh",
+    "clean": "rimraf webapp.asar dist packages deploys",
+    "hak": "node scripts/hak/index.js"
+  },
   "dependencies": {
     "auto-launch": "^5.0.1",
     "electron-store": "^2.0.0",
     "electron-window-state": "^4.1.0",
-    "minimist": "^1.2.0",
+    "minimist": "^1.2.3",
     "png-to-ico": "^1.0.2"
+  },
+  "devDependencies": {
+    "asar": "^2.0.1",
+    "electron-builder": "^22.3.2",
+    "electron-builder-squirrel-windows": "^22.3.2",
+    "electron-devtools-installer": "^2.2.4",
+    "electron-notarize": "^0.2.0",
+    "eslint": "^5.8.0",
+    "eslint-config-google": "^0.7.1",
+    "eslint-plugin-babel": "^4.1.2",
+    "find-npm-prefix": "^1.0.2",
+    "fs-extra": "^8.1.0",
+    "glob": "^7.1.6",
+    "matrix-js-sdk": "6.1.0",
+    "mkdirp": "^1.0.3",
+    "needle": "^2.3.2",
+    "node-pre-gyp": "^0.14.0",
+    "npm": "^6.13.7",
+    "rimraf": "^3.0.2",
+    "semver": "^7.1.3",
+    "tar": "^6.0.1"
+  },
+  "hakDependencies": {
+    "matrix-seshat": "^1.3.3"
+  },
+  "build": {
+    "appId": "im.riot.app",
+    "electronVersion": "8.0.3",
+    "files": [
+      "package.json",
+      {
+        "from": ".hak/hakModules",
+        "to": "node_modules"
+      },
+      "src/**"
+    ],
+    "extraResources": [
+      {
+        "from": "res/img",
+        "to": "img"
+      },
+      "webapp.asar"
+    ],
+    "linux": {
+      "target": "deb",
+      "category": "Network;InstantMessaging;Chat",
+      "maintainer": "support@riot.im",
+      "desktop": {
+        "StartupWMClass": "riot"
+      }
+    },
+    "mac": {
+      "category": "public.app-category.social-networking",
+      "darkModeSupport": true
+    },
+    "win": {
+      "target": {
+        "target": "squirrel"
+      },
+      "sign": "scripts/electron_winSign"
+    },
+    "directories": {
+      "output": "dist"
+    },
+    "afterSign": "scripts/electron_afterSign",
+    "protocols": [
+      {
+        "name": "riot",
+        "schemes": [
+          "riot"
+        ]
+      }
+    ]
   }
 }

pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix

@@ -8,20 +8,18 @@
 
 let
   executableName = "riot-desktop";
-  version = "1.6.0";
+  version = "1.6.2";
-  riot-web-src = fetchFromGitHub {
+  src = fetchFromGitHub {
     owner = "vector-im";
-    repo = "riot-web";
+    repo = "riot-desktop";
     rev = "v${version}";
-    sha256 = "16zm6l4c7vkfdlxh6gdw531k5r4v3mb0h66q41h94dvmj79dz2bj";
+    sha256 = "1anmch9z3na7rphxb0p9cnk55388z22iwfnfjhmjps1ii5wx4rls";
   };
   electron = electron_7;
 
 in mkYarnPackage rec {
   name = "riot-desktop-${version}";
-  inherit version;
+  inherit version src;
-
-  src = "${riot-web-src}/electron_app";
 
   packageJSON = ./riot-desktop-package.json;
   yarnNix = ./riot-desktop-yarndeps.nix;
@@ -32,8 +30,8 @@ in mkYarnPackage rec {
     # resources
     mkdir -p "$out/share/riot"
     ln -s '${riot-web}' "$out/share/riot/webapp"
-    cp -r './deps/riot-web' "$out/share/riot/electron"
+    cp -r './deps/riot-desktop' "$out/share/riot/electron"
-    cp -r './deps/riot-web/img' "$out/share/riot"
+    cp -r './deps/riot-desktop/res/img' "$out/share/riot"
     rm "$out/share/riot/electron/node_modules"
     cp -r './node_modules' "$out/share/riot/electron"
 
@@ -80,7 +78,7 @@ in mkYarnPackage rec {
     description = "A feature-rich client for Matrix.org";
     homepage = "https://about.riot.im/";
     license = licenses.asl20;
-    maintainers = with maintainers; [ pacien worldofpeace ];
+    maintainers = with maintainers; [ pacien worldofpeace ma27 ];
     inherit (electron.meta) platforms;
   };
 }

pkgs/applications/networking/instant-messengers/riot/riot-web.nix

@@ -12,11 +12,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "riot-web";
-  version = "1.6.0";
+  version = "1.6.2";
 
   src = fetchurl {
     url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "1mm4xk69ya1k3gz6jjhc4njx7b3rp157jmrqsxr5i382zs035ff7";
+    sha256 = "1cyjw3x9yh96cn84r95zziwxgifkmzd5kdf4l69b7mwnqcr78dp0";
   };
 
   installPhase = ''

pkgs/applications/networking/instant-messengers/riot/update-riot-desktop.sh

@@ -9,9 +9,9 @@ if [ "$#" -ne 1 ] || [[ "$1" == -* ]]; then
 	exit 1
 fi
 
-RIOT_WEB_SRC="https://raw.githubusercontent.com/vector-im/riot-web/$1"
+RIOT_WEB_SRC="https://raw.githubusercontent.com/vector-im/riot-desktop/$1"
 
-wget "$RIOT_WEB_SRC/electron_app/package.json" -O riot-desktop-package.json
+wget "$RIOT_WEB_SRC/package.json" -O riot-desktop-package.json
-wget "$RIOT_WEB_SRC/electron_app/yarn.lock" -O riot-desktop-yarndeps.lock
+wget "$RIOT_WEB_SRC/yarn.lock" -O riot-desktop-yarndeps.lock
 yarn2nix --lockfile=riot-desktop-yarndeps.lock > riot-desktop-yarndeps.nix
 rm riot-desktop-yarndeps.lock

pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix

@@ -7,7 +7,7 @@ let
 
   # Please keep the version x.y.0.z and do not update to x.y.76.z because the
   # source of the latter disappears much faster.
-  version = "8.59.0.77";
+  version = "8.60.0.76";
 
   rpath = stdenv.lib.makeLibraryPath [
     alsaLib
@@ -65,7 +65,7 @@ let
           "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
           "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
         ];
-        sha256 = "1cnlwlp84942ywji3x60zvhijavazdxfym3rfzq3ysky28b6mn6i";
+        sha256 = "1y919ki0c17vip90fln17impwky08qgprw0j1dgz239qqpwakn7a";
       }
     else
       throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";

pkgs/applications/networking/instant-messengers/teamspeak/client.nix

@@ -1,6 +1,6 @@
 { stdenv, fetchurl, makeWrapper, makeDesktopItem, zlib, glib, libpng, freetype, openssl
-, xorg, fontconfig, qtbase, qtwebengine, qtwebchannel, qtsvg, xkeyboard_config, alsaLib
+, xorg, fontconfig, qtbase, qtwebengine, qtwebchannel, qtsvg, qtwebsockets, xkeyboard_config
-, libpulseaudio ? null, libredirect, quazip, which, unzip, llvmPackages, writeShellScriptBin
+, alsaLib, libpulseaudio ? null, libredirect, quazip, which, unzip, llvmPackages, writeShellScriptBin
 }:
 
 let
@@ -13,7 +13,7 @@ let
     [ zlib glib libpng freetype xorg.libSM xorg.libICE xorg.libXrender openssl
       xorg.libXrandr xorg.libXfixes xorg.libXcursor xorg.libXinerama
       xorg.libxcb fontconfig xorg.libXext xorg.libX11 alsaLib qtbase qtwebengine qtwebchannel qtsvg
-      libpulseaudio quazip llvmPackages.libcxx llvmPackages.libcxxabi
+      qtwebsockets libpulseaudio quazip llvmPackages.libcxx llvmPackages.libcxxabi
     ];
 
   desktopItem = makeDesktopItem {
@@ -33,13 +33,13 @@ in
 stdenv.mkDerivation rec {
   pname = "teamspeak-client";
 
-  version = "3.3.2";
+  version = "3.5.3";
 
   src = fetchurl {
     url = "https://files.teamspeak-services.com/releases/client/${version}/TeamSpeak3-Client-linux_${arch}-${version}.run";
     sha256 = if stdenv.is64bit
-                then "1n916ds67dxj5bfgc5zm9nz2xh2914k85pzzspzvfyr7njcw7hpi"
+                then "0fp9v2rkxf0zgvf3wcx8nsmf93bzdc22xlqxk3r8cb0415adp76a"
-                else "0csl5xklcb4v8bzwvby5m2n38zjrnaw8dcvha7qvfbjllxr75yn2";
+                else "0ni7hijprc8xygyz41568f1m9wwhl8lk5c3q28bm9m5r6qym39l6";
   };
 
   # grab the plugin sdk for the desktop icon

pkgs/applications/networking/instant-messengers/zoom-us/default.nix

@@ -15,11 +15,11 @@ assert pulseaudioSupport -> libpulseaudio != null;
 let
   inherit (stdenv.lib) concatStringsSep makeBinPath optional;
 
-  version = "5.0.403652.0509";
+  version = "5.0.408598.0517";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "00bprrfc7mmf3yg6jddqm2qr73m2zycr8hy19dxqpzld9gbvyzik";
+      sha256 = "1irpnrxl91pc9naz0d9m252scnbfdbdi7yh19hd3arvk3fppjk7w";
     };
   };
 

pkgs/applications/networking/mullvad-vpn/default.nix

@@ -41,11 +41,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "mullvad-vpn";
-  version = "2020.3";
+  version = "2020.4";
 
   src = fetchurl {
     url = "https://www.mullvad.net/media/app/MullvadVPN-${version}_amd64.deb";
-    sha256 = "fac3896db78cc2ddac81abec8bc0aa324e66b453126ed35a501e422ce64b1362";
+    sha256 = "17xi8g2k89vi4d0j7pr33bx9zjapa2qh4pymbrqvxwli3yhq6zwr";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/remote/anydesk/default.nix

@@ -5,7 +5,7 @@
 
 let
   sha256 = {
-    x86_64-linux = "09ajpsmgrgjhw7b91id76w84kwk2d678n0b81zzpwq7sgjcm0sb0";
+    x86_64-linux = "1vpfyffg1g7f1m4mxmqghswihml9rm1cipm7krmr5wvxdmcphxnk";
     i386-linux   = "0vjxbg5hwkqkh600rr75xviwy848r1xw9mxwf6bb6l8b0isvlsgg";
   }.${stdenv.hostPlatform.system} or (throw "system ${stdenv.hostPlatform.system} not supported");
 
@@ -28,7 +28,7 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "anydesk";
-  version = "5.5.5";
+  version = "5.5.6";
 
   src = fetchurl {
     urls = [

pkgs/applications/networking/sniffers/etherape/default.nix

@@ -2,10 +2,10 @@
 popt, itstool, libxml2 }:
 
 stdenv.mkDerivation rec {
-  name = "etherape-0.9.18";
+  name = "etherape-0.9.19";
   src = fetchurl {
     url = "mirror://sourceforge/etherape/${name}.tar.gz";
-    sha256 = "0y9cfc5iv5zy82j165i9agf45n1ixka064ykdvpdhb07sr3lzhmv";
+    sha256 = "0w63vg2q6if3wvy2md66in8b6cdw9q40hny5xy6yrxky58l4kmg7";
   };
 
   nativeBuildInputs = [ itstool pkgconfig (stdenv.lib.getBin libxml2) ];

pkgs/applications/networking/sniffers/wireshark/default.nix

@@ -10,7 +10,7 @@ assert withQt  -> qt5  != null;
 with stdenv.lib;
 
 let
-  version = "3.2.3";
+  version = "3.2.4";
   variant = if withQt then "qt" else "cli";
 
 in stdenv.mkDerivation {
@@ -20,7 +20,7 @@ in stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz";
-    sha256 = "1fpsfjrap7j84sy728yhcr2gad9nq3n5gq03mwrmxnc6ijwf81zh";
+    sha256 = "1amqgn94g6h6cfnsccm2zb4c73pfv1qmzi1i6h1hnbcyhhg4czfi";
   };
 
   cmakeFlags = [

pkgs/applications/networking/termius/default.nix

@@ -0,0 +1,68 @@
+{ atomEnv
+, autoPatchelfHook
+, dpkg
+, fetchurl
+, makeDesktopItem
+, makeWrapper
+, stdenv
+, udev
+, wrapGAppsHook
+}:
+
+stdenv.mkDerivation rec {
+  pname = "termius";
+  version = "5.10.1";
+
+  src = fetchurl {
+    url = "https://deb.termius.com/pool/main/t/termius-app/termius-app_${version}_amd64.deb";
+    sha256 = "04zh0zzyp906lf6mz3xzxybn2a55rv3vvrj0m12gnrb8kjb3pk5s";
+  };
+
+  desktopItem = makeDesktopItem {
+    categories = "Network;";
+    comment = "The SSH client that works on Desktop and Mobile";
+    desktopName = "Termius";
+    exec = "termius-app";
+    genericName = "Cross-platform SSH client";
+    icon = "termius-app";
+    name = "termius-app";
+  };
+
+  dontBuild = true;
+  dontConfigure = true;
+  dontPatchELF = true;
+  dontWrapGApps = true;
+
+  nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper wrapGAppsHook ];
+
+  buildInputs = atomEnv.packages;
+
+  unpackPhase = "dpkg-deb -x $src .";
+
+  installPhase = ''
+    mkdir -p "$out/bin"
+    cp -R "opt" "$out"
+    cp -R "usr/share" "$out/share"
+    chmod -R g-w "$out"
+
+    # Desktop file
+    mkdir -p "$out/share/applications"
+    cp "${desktopItem}/share/applications/"* "$out/share/applications"
+  '';
+
+  runtimeDependencies = [ udev.lib ];
+
+  postFixup = ''
+    makeWrapper $out/opt/Termius/termius-app $out/bin/termius-app \
+      "''${gappsWrapperArgs[@]}"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A cross-platform SSH client with cloud data sync and more";
+    homepage = "https://termius.com/";
+    downloadPage = "https://termius.com/linux/";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ filalex77 ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

pkgs/applications/radio/urh/default.nix

@@ -5,13 +5,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "urh";
-  version = "2.8.7";
+  version = "2.8.8";
 
   src = fetchFromGitHub {
     owner = "jopohl";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1grak0vzlzqvg8bqaalyamwvkyzlmj9nbczqp6jcdf6w2vnbzhph";
+    sha256 = "0knymy85n9kxj364jpxjc4v9c238b00nl40rafi1ripkqx36bsfv";
   };
 
   nativeBuildInputs = [ qt5.wrapQtAppsHook ];

pkgs/applications/science/biology/picard-tools/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "picard-tools";
-  version = "2.22.4";
+  version = "2.22.7";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "0gzna5df8nk42l7mc0qbp9h73gwr1030jnw10fawjp6ql6213kdd";
+    sha256 = "09q66lhjnprkw8azavwzwv9dlhr9b4x0dbz6fym0i2wbhylqp4w6";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/science/electronics/kicad/versions.nix

@@ -3,49 +3,49 @@
 {
   "kicad" = {
     kicadVersion = {
-      version =			"5.1.5";
+      version =			"5.1.6";
       src = {
-        rev =			"52549c5d09cbfb0e807fcbcb07819bc9f7861544";
+        rev =			"c6e7f7de7df655fd59b57823499efc443009de6b";
-        sha256 =		"15h3rwisjss3fdc9bam9n2wq94slhacc3fbg14bnzf4n5agsnv5b";
+        sha256 =		"1pa3z0h0679jmgxlzc833h6q85b5paxdp69kf2h93vkaryj58622";
       };
     };
     libVersion = {
-      version =			"5.1.5";
+      version =			"5.1.6";
       libSources = {
-        i18n.rev =		"5122cbec6563fb7c8d6f960a639ac470353af91b";
+        i18n.rev =		"5ad171ce5c8d90f4740517c2adecb310d8be51bd";
-        i18n.sha256 =		"1rfpifl8vky1gba2angizlb2n7mwmsiai3r6ip6qma60wdj8sbd3";
+        i18n.sha256 =		"0qryi8xjm23ka363zfl7bbga0v5c31fr3d4nyxp3m168vkv9zhha";
-        symbols.rev =		"dd122ec170b49e032179511c9d263126f52f4020";
+        symbols.rev =		"5150eaa2a7d15cfc6bb1459c527c4ebaa66d7708";
-        symbols.sha256 =	"048b07ffsaav1ssrchw2p870lvb4rsyb5vnniy670k7q9p16qq6h";
+        symbols.sha256 =	"12w3rdy085drlikkpb27n9ni7cyg9l0pqy7hnr86cxjcw3l5wcx6";
-        templates.rev =		"94761f10d06582b33cd55ea2149d72f269f65580";
+        templates.rev =		"9213d439f757e6049b7e54f3ea08272a0d0f44a9";
-        templates.sha256 =	"0cs3bm3zb5ngw5ldn0lzw5bvqm4kvcidyrn76438alffwiz2b15g";
+        templates.sha256 =	"1hppcsrkn4dk6ggby6ckh0q65qxkywrbyxa4lwpaf7pxjyv498xg";
-        footprints.rev =	"e076f8f271f8db96d5fec45616b7554caebb7ef7";
+        footprints.rev =	"a61b4e49762fb355f654e65a1c7db1aaf7bb2332";
-        footprints.sha256 =	"1c4whgn14qhz4yqkl46w13p6rpv1k0hsc9s9h9368fxfcz9knb2j";
+        footprints.sha256 =	"1kmf91a5mmvj9izrv40mkaw1w36yjgn8daczd9rq2wlmd0rdp1zx";
-        packages3d.rev =	"8d233cdcb109aa1c3b8ba4c934ee31f6a3b6e1f4";
+        packages3d.rev =	"150ff1caf0b01dc04c84f4f966f4f88fedfa8f8c";
-        packages3d.sha256 =	"0cff2ms1bsw530kqb1fr1m2pjixyxzwa81mxgac3qpbcf8fnpvaz";
+        packages3d.sha256 =	"0b9jglf77fy0n0r8xs4yqkv6zvipyfvp0z5dnqlzp32csy5aqpi1";
       };
     };
   };
   "kicad-unstable" = {
     kicadVersion = {
-      version =			"2020-05-06";
+      version =			"2020-05-14";
       src = {
-        rev =			"c92181621e2e51dc8aae1bd9f4483bb3301ffaa5";
+        rev =			"3b8465359135e9f6dea4b0a5fcb62377753fe890";
-        sha256 =		"0s50xn5gbjy7yxnp9yiynxvxi2mkcrp6yghgdzclpm40rnfyi0v5";
+        sha256 =		"18xsg2s0pxx176rnblygq1f8xpmryw59lcjzm897gifz0sj0nhvx";
       };
     };
     libVersion = {
-      version =			"2020-05-06";
+      version =			"2020-05-14";
       libSources = {
-        i18n.rev =		"f29cab831eb823165fa2c5efab5d9c9b443e62e2";
+        i18n.rev =		"c4460d0d8e1075691d43dc928ffc332fa1282592";
-        i18n.sha256 =		"0cc0zvpml75yxphay3281f762ls08fzvv538cd5hmkr8xqlj3vbi";
+        i18n.sha256 =		"1gkrbfyfzsr5q7sahhlyhgfpfwm6b83lzf0q1v854gwxdfabvi0y";
-        symbols.rev =		"d4245ae8cf633095a0994ab01492bd56cd124112";
+        symbols.rev =		"614b5f6256fbae82c2bba399086506bbe435bd94";
-        symbols.sha256 =	"11pynjgji3skw42q5mryz98f8z418k43jy6s2k90w6jv638z3cb0";
+        symbols.sha256 =	"10ix3wdcl832r4ha5q8phpx8j97gzngb41nczdli1qkhjmiw9y8r";
         templates.rev =		"7db8d4d0ea0711f1961d117853547fb3edbc3857";
         templates.sha256 =	"1hppcsrkn4dk6ggby6ckh0q65qxkywrbyxa4lwpaf7pxjyv498xg";
-        footprints.rev =	"3bff23ee339bc48490bb39deba5d8b2f1f42733e";
+        footprints.rev =	"240804c6c89b66af808379e1fc94ea6011433cbe";
-        footprints.sha256 =	"0430r8k49ib6w1sjr8fx42szbz960yhlzg4w80jl5bwasq67nqwd";
+        footprints.sha256 =	"1jh71004lrn7bl384zfmbqqdbs28gjb6diwn6hyb587jpivdnl3g";
-        packages3d.rev =	"889a3dd550233ec51baed4a04a01d4cc64a8d747";
+        packages3d.rev =	"9b560cf94a35b692ca516d37bdaf392ce10e549d";
-        packages3d.sha256 =	"152zv4j51v8skqlvrabblpcqpbn5yf3grisjj8vnwf7kdd41chb2";
+        packages3d.sha256 =	"0b9jglf77fy0n0r8xs4yqkv6zvipyfvp0z5dnqlzp32csy5aqpi1";
       };
     };
   };