Merge master into staging-next

2019-01-19 09:23:29 +01:00 · 2019-01-19 09:23:29 +01:00 · bd538d6bb0
commit bd538d6bb0
parent 379c3899a5 aaff01ecbf
151 changed files with 3086 additions and 1983 deletions
--- a/doc/Makefile
+++ b/doc/Makefile
@ -9,8 +9,10 @@ debug:

 .PHONY: format
 format:
-	find . -iname '*.xml' -type f -print0 | xargs -0 -I{} -n1 \
-		xmlformat --config-file "$$XMLFORMAT_CONFIG" -i {}
+	find . -iname '*.xml' -type f | while read f; do \
+		echo $$f ;\
+		xmlformat --config-file "$$XMLFORMAT_CONFIG" -i $$f ;\
+	done

 .PHONY: fix-misc-xml
 fix-misc-xml:
--- a/doc/coding-conventions.xml
+++ b/doc/coding-conventions.xml
@ -814,7 +814,7 @@ args.stdenv.mkDerivation (args // {

  <para>
   There are multiple ways to fetch a package source in nixpkgs. The general
-   guideline is that you should package sources with a high degree of
+   guideline is that you should package reproducible sources with a high degree of
   availability. Right now there is only one fetcher which has mirroring
   support and that is <literal>fetchurl</literal>. Note that you should also
   prefer protocols which have a corresponding proxy environment variable.
@ -876,6 +876,123 @@ src = fetchFromGitHub {
   </itemizedlist>
  </para>
 </section>
+ <section xml:id="sec-source-hashes">
+  <title>Obtaining source hash</title>
+
+  <para>
+   Preferred source hash type is sha256. There are several ways to get it.
+  </para>
+
+  <orderedlist>
+   <listitem>
+    <para>
+     Prefetch URL (with <literal>nix-prefetch-<replaceable>XXX</replaceable>
+     <replaceable>URL</replaceable></literal>, where
+     <replaceable>XXX</replaceable> is one of <literal>url</literal>,
+     <literal>git</literal>, <literal>hg</literal>, <literal>cvs</literal>,
+     <literal>bzr</literal>, <literal>svn</literal>). Hash is printed to
+     stdout.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Prefetch by package source (with <literal>nix-prefetch-url
+     '&lt;nixpkgs&gt;' -A <replaceable>PACKAGE</replaceable>.src</literal>,
+     where <replaceable>PACKAGE</replaceable> is package attribute name). Hash
+     is printed to stdout.
+    </para>
+    <para>
+     This works well when you've upgraded existing package version and want to
+     find out new hash, but is useless if package can't be accessed by
+     attribute or package has multiple sources (<literal>.srcs</literal>,
+     architecture-dependent sources, etc).
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Upstream provided hash: use it when upstream provides
+     <literal>sha256</literal> or <literal>sha512</literal> (when upstream
+     provides <literal>md5</literal>, don't use it, compute
+     <literal>sha256</literal> instead).
+    </para>
+    <para>
+     A little nuance is that <literal>nix-prefetch-*</literal> tools produce
+     hash encoded with <literal>base32</literal>, but upstream usually provides
+     hexadecimal (<literal>base16</literal>) encoding. Fetchers understand both
+     formats. Nixpkgs does not standardize on any one format.
+    </para>
+    <para>
+     You can convert between formats with nix-hash, for example:
+<screen>
+$ nix-hash --type sha256 --to-base32 <replaceable>HASH</replaceable>
+</screen>
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Extracting hash from local source tarball can be done with
+     <literal>sha256sum</literal>. Use <literal>nix-prefetch-url
+     file:///path/to/tarball </literal> if you want base32 hash.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     Fake hash: set fake hash in package expression, perform build and extract
+     correct hash from error Nix prints.
+    </para>
+    <para>
+     For package updates it is enough to change one symbol to make hash fake.
+     For new packages, you can use <literal>lib.fakeSha256</literal>,
+     <literal>lib.fakeSha512</literal> or any other fake hash.
+    </para>
+    <para>
+     This is last resort method when reconstructing source URL is non-trivial
+     and <literal>nix-prefetch-url -A</literal> isn't applicable (for example,
+     <link xlink:href="https://github.com/NixOS/nixpkgs/blob/d2ab091dd308b99e4912b805a5eb088dd536adb9/pkgs/applications/video/kodi/default.nix#L73">
+     one of <literal>kodi</literal> dependencies</link>). The easiest way then
+     would be replace hash with a fake one and rebuild. Nix build will fail and
+     error message will contain desired hash.
+    </para>
+    <warning><para>This method has security problems. Check below for details.</para></warning>
+   </listitem>
+  </orderedlist>
+
+  <section xml:id="sec-source-hashes-security">
+   <title>Obtaining hashes securely</title>
+   <para>
+    Let's say Man-in-the-Middle (MITM) sits close to your network. Then instead of fetching
+    source you can fetch malware, and instead of source hash you get hash of malware. Here are
+    security considerations for this scenario:
+   </para>
+   <itemizedlist>
+    <listitem>
+     <para>
+      <literal>http://</literal> URLs are not secure to prefetch hash from;
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      hashes from upstream (in method 3) should be obtained via secure protocol;
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      <literal>https://</literal> URLs are secure in methods 1, 2, 3;
+     </para>
+    </listitem>
+    <listitem>
+     <para>
+      <literal>https://</literal> URLs are not secure in method 5. When obtaining hashes
+      with fake hash method, TLS checks are disabled. So
+      refetch source hash from several different networks to exclude MITM scenario.
+      Alternatively, use fake hash method to make Nix error, but instead of extracting
+      hash from error, extract <literal>https://</literal> URL and prefetch it
+      with method 1.
+     </para>
+    </listitem>
+   </itemizedlist>
+  </section>
+ </section>
 <section xml:id="sec-patches">
  <title>Patches</title>

--- a/doc/configuration.xml
+++ b/doc/configuration.xml
@ -180,7 +180,11 @@
     code:
 <programlisting>
 {
-  allowUnfreePredicate = (pkg: builtins.elem (builtins.parseDrvName pkg.name).name [ "flashplayer" "vscode" ]);
+  allowUnfreePredicate = (pkg: builtins.elem
+    (builtins.parseDrvName pkg.name).name [
+      "flashplayer"
+      "vscode"
+    ]);
 }
 </programlisting>
    </para>
@ -322,7 +326,18 @@
  packageOverrides = pkgs: with pkgs; {
    myPackages = pkgs.buildEnv {
      name = "my-packages";
-      paths = [ aspell bc coreutils gdb ffmpeg nixUnstable emscripten jq nox silver-searcher ];
+      paths = [
+        aspell
+        bc
+        coreutils
+        gdb
+        ffmpeg
+        nixUnstable
+        emscripten
+        jq
+        nox
+        silver-searcher
+      ];
    };
  };
 }
@ -343,7 +358,18 @@
  packageOverrides = pkgs: with pkgs; {
    myPackages = pkgs.buildEnv {
      name = "my-packages";
-      paths = [ aspell bc coreutils gdb ffmpeg nixUnstable emscripten jq nox silver-searcher ];
+      paths = [
+        aspell
+        bc
+        coreutils
+        gdb
+        ffmpeg
+        nixUnstable
+        emscripten
+        jq
+        nox
+        silver-searcher
+      ];
      pathsToLink = [ "/share" "/bin" ];
    };
  };
@ -378,7 +404,17 @@
  packageOverrides = pkgs: with pkgs; {
    myPackages = pkgs.buildEnv {
      name = "my-packages";
-      paths = [ aspell bc coreutils ffmpeg nixUnstable emscripten jq nox silver-searcher ];
+      paths = [
+        aspell
+        bc
+        coreutils
+        ffmpeg
+        nixUnstable
+        emscripten
+        jq
+        nox
+        silver-searcher
+      ];
      pathsToLink = [ "/share/man" "/share/doc" "/bin" ];
      extraOutputsToInstall = [ "man" "doc" ];
    };
--- a/doc/reviewing-contributions.xml
+++ b/doc/reviewing-contributions.xml
@ -605,11 +605,11 @@ policy.
 -->

  <para>
-   In a case a contributor leaves definitively the Nix community, he should
+   In a case a contributor definitively leaves the Nix community, they should
   create an issue or post on
   <link
   xlink:href="https://discourse.nixos.org">Discourse</link> with
-   references of packages and modules he maintains so the maintainership can be
+   references of packages and modules they maintain so the maintainership can be
   taken over by other contributors.
  </para>
 </section>
--- a/doc/style.css
+++ b/doc/style.css
@ -9,6 +9,7 @@
 body
 {
    font-family: "Nimbus Sans L", sans-serif;
+    font-size: 1em;
    background: white;
    margin: 2em 1em 2em 1em;
 }
@ -28,6 +29,25 @@ h2 /* chapters, appendices, subtitle */
    font-size: 180%;
 }

+div.book
+{
+    text-align: center;
+}
+
+div.book > div
+{
+    /*
+     * based on https://medium.com/@zkareemz/golden-ratio-62b3b6d4282a
+     * we do 70 characters per line to fit code listings better
+     * 70 * (font-size / 1.618)
+     * expression for emacs:
+     * (* 70 (/ 1 1.618))
+     */
+    max-width: 43.2em;
+    text-align: left;
+    margin: auto;
+}
+
 /* Extra space between chapters, appendices. */
 div.chapter > div.titlepage h2, div.appendix > div.titlepage h2
 {
@ -102,8 +122,8 @@ pre.screen, pre.programlisting
 {
    border: 1px solid #b0b0b0;
    padding: 3px 3px;
-    margin-left: 1.5em;
-    margin-right: 1.5em;
+    margin-left: 0.5em;
+    margin-right: 0.5em;

    background: #f4f4f8;
    font-family: monospace;
--- a/lib/default.nix
+++ b/lib/default.nix
@ -94,7 +94,7 @@ let
      callPackageWith callPackagesWith extendDerivation hydraJob
      makeScope;
    inherit (meta) addMetaAttrs dontDistribute setName updateName
-      appendToName mapDerivationAttrset lowPrio lowPrioSet hiPrio
+      appendToName mapDerivationAttrset setPrio lowPrio lowPrioSet hiPrio
      hiPrioSet;
    inherit (sources) pathType pathIsDirectory cleanSourceFilter
      cleanSource sourceByRegex sourceFilesBySuffices
--- a/lib/meta.nix
+++ b/lib/meta.nix
@ -41,16 +41,18 @@ rec {
    let x = builtins.parseDrvName name; in "${x.name}-${suffix}-${x.version}");


-  /* Apply a function to each derivation and only to derivations in an attrset
+  /* Apply a function to each derivation and only to derivations in an attrset.
  */
  mapDerivationAttrset = f: set: lib.mapAttrs (name: pkg: if lib.isDerivation pkg then (f pkg) else pkg) set;

+  /* Set the nix-env priority of the package.
+  */
+  setPrio = priority: addMetaAttrs { inherit priority; };

  /* Decrease the nix-env priority of the package, i.e., other
     versions/variants of the package will be preferred.
  */
-  lowPrio = drv: addMetaAttrs { priority = 10; } drv;
-
+  lowPrio = setPrio 10;

  /* Apply lowPrio to an attrset with derivations
  */
@ -60,8 +62,7 @@ rec {
  /* Increase the nix-env priority of the package, i.e., this
     version/variant of the package will be preferred.
  */
-  hiPrio = drv: addMetaAttrs { priority = -10; } drv;
-
+  hiPrio = setPrio (-10);

  /* Apply hiPrio to an attrset with derivations
  */
--- a/nixos/doc/manual/configuration/x-windows.xml
+++ b/nixos/doc/manual/configuration/x-windows.xml
@ -35,11 +35,11 @@
 </para>
 <para>
  NixOS’s default <emphasis>display manager</emphasis> (the program that
-  provides a graphical login prompt and manages the X server) is SLiM. You can
+  provides a graphical login prompt and manages the X server) is LightDM. You can
  select an alternative one by picking one of the following lines:
 <programlisting>
 <xref linkend="opt-services.xserver.displayManager.sddm.enable"/> = true;
-<xref linkend="opt-services.xserver.displayManager.lightdm.enable"/> = true;
+<xref linkend="opt-services.xserver.displayManager.slim.enable"/> = true;
 </programlisting>
 </para>
 <para>
--- a/nixos/doc/manual/installation/installing-usb.xml
+++ b/nixos/doc/manual/installation/installing-usb.xml
@ -23,7 +23,7 @@ $ diskutil list
 [..]
 $ diskutil unmountDisk diskN
 Unmount of all volumes on diskN was successful
-$ sudo dd bs=1m if=nix.iso of=/dev/rdiskN
+$ sudo dd bs=1000000 if=nix.iso of=/dev/rdiskN
 </programlisting>
    Using the 'raw' <command>rdiskN</command> device instead of
    <command>diskN</command> completes in minutes instead of hours. After
--- a/nixos/doc/manual/installation/installing-virtualbox-guest.xml
+++ b/nixos/doc/manual/installation/installing-virtualbox-guest.xml
@ -77,18 +77,22 @@
  Shared folders can be given a name and a path in the host system in the
  VirtualBox settings (Machine / Settings / Shared Folders, then click on the
  "Add" icon). Add the following to the
-  <literal>/etc/nixos/configuration.nix</literal> to auto-mount them:
+  <literal>/etc/nixos/configuration.nix</literal> to auto-mount them. If you 
+   do not add <literal>"nofail"</literal>, the system will no boot properly. 
+   The same goes for disabling <literal>rngd</literal> which is normally used 
+   to get randomness but this does not work in virtual machines.
 </para>

 <programlisting>
 { config, pkgs, ...} :
 {
+  security.rngd.enable = false; // otherwise vm will not boot
  ...

  fileSystems."/virtualboxshare" = {
    fsType = "vboxsf";
    device = "nameofthesharedfolder";
-    options = [ "rw" ];
+    options = [ "rw" "nofail" ];
  };
 }
 </programlisting>
--- a/nixos/lib/make-squashfs.nix
+++ b/nixos/lib/make-squashfs.nix
@ -3,6 +3,9 @@
 , # The root directory of the squashfs filesystem is filled with the
  # closures of the Nix store paths listed here.
  storeContents ? []
+, # Compression parameters.
+  # For zstd compression you can use "zstd -Xcompression-level 6".
+  comp ? "xz -Xdict-size 100%"
 }:

 stdenv.mkDerivation {
@ -20,6 +23,6 @@ stdenv.mkDerivation {

      # Generate the squashfs image.
      mksquashfs nix-path-registration $(cat $closureInfo/store-paths) $out \
-        -keep-as-directory -all-root -b 1048576 -comp xz -Xdict-size 100%
+        -keep-as-directory -all-root -b 1048576 -comp ${comp}
    '';
 }
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -306,7 +306,7 @@
      rslsync = 279;
      minio = 280;
      kanboard = 281;
-      pykms = 282;
+      # pykms = 282; # DynamicUser = true
      kodi = 283;
      restya-board = 284;
      mighttpd2 = 285;
@ -338,6 +338,7 @@
      minetest = 311;
      rss2email = 312;
      cockroachdb = 313;
+      zoneminder = 314;

      # When adding a uid, make sure it doesn't match an existing gid. And don't use uids above 399!

@ -604,7 +605,7 @@
      rslsync = 279;
      minio = 280;
      kanboard = 281;
-      pykms = 282;
+      # pykms = 282; # DynamicUser = true
      kodi = 283;
      restya-board = 284;
      mighttpd2 = 285;
@ -636,6 +637,7 @@
      minetest = 311;
      rss2email = 312;
      cockroachdb = 313;
+      zoneminder = 314;

      # When adding a gid, make sure it doesn't match an existing
      # uid. Users and groups with the same name should have equal
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -248,6 +248,7 @@
  ./services/desktops/gnome3/at-spi2-core.nix
  ./services/desktops/gnome3/chrome-gnome-shell.nix
  ./services/desktops/gnome3/evolution-data-server.nix
+  ./services/desktops/gnome3/file-roller.nix
  ./services/desktops/gnome3/gnome-disks.nix
  ./services/desktops/gnome3/gnome-documents.nix
  ./services/desktops/gnome3/gnome-keyring.nix
@ -432,6 +433,7 @@
  ./services/misc/uhub.nix
  ./services/misc/weechat.nix
  ./services/misc/xmr-stak.nix
+  ./services/misc/zoneminder.nix
  ./services/misc/zookeeper.nix
  ./services/monitoring/alerta.nix
  ./services/monitoring/apcupsd.nix
--- a/nixos/modules/services/desktops/gnome3/file-roller.nix
+++ b/nixos/modules/services/desktops/gnome3/file-roller.nix
@ -0,0 +1,32 @@
+# File Roller.
+
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.gnome3.file-roller = {
+
+      enable = mkEnableOption "File Roller, an archive manager for GNOME";
+
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf config.services.gnome3.file-roller.enable {
+
+    environment.systemPackages = [ pkgs.gnome3.file-roller ];
+
+    services.dbus.packages = [ pkgs.gnome3.file-roller ];
+
+  };
+
+}
--- a/nixos/modules/services/misc/pykms.nix
+++ b/nixos/modules/services/misc/pykms.nix
@ -5,20 +5,8 @@ with lib;
 let
  cfg = config.services.pykms;

-  home = "/var/lib/pykms";
-
-  services = {
-    serviceConfig = {
-      Restart = "on-failure";
-      RestartSec = "10s";
-      StartLimitInterval = "1min";
-      PrivateTmp = true;
-      ProtectSystem = "full";
-      ProtectHome = true;
-    };
-  };
-
 in {
+  meta.maintainers = with lib.maintainers; [ peterhoeg ];

  options = {
    services.pykms = rec {
@ -51,39 +39,38 @@ in {
        default = false;
        description = "Whether the listening port should be opened automatically.";
      };
+
+      memoryLimit = mkOption {
+        type = types.str;
+        default = "64M";
+        description = "How much memory to use at most.";
+      };
    };
  };

  config = mkIf cfg.enable {
    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewallPort [ cfg.port ];

-    systemd.services = {
-      pykms = services // {
-        description = "Python KMS";
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = with pkgs; {
-          User = "pykms";
-          Group = "pykms";
-          ExecStartPre = "${getBin pykms}/bin/create_pykms_db.sh ${home}/clients.db";
-          ExecStart = "${getBin pykms}/bin/server.py ${optionalString cfg.verbose "--verbose"} ${cfg.listenAddress} ${toString cfg.port}";
-          WorkingDirectory = home;
-          MemoryLimit = "64M";
-        };
-      };
-    };
-
-    users = {
-      users.pykms = {
-        name = "pykms";
-        group = "pykms";
-        home  = home;
-        createHome = true;
-        uid = config.ids.uids.pykms;
-        description = "PyKMS daemon user";
-      };
-
-      groups.pykms = {
-        gid = config.ids.gids.pykms;
+    systemd.services.pykms = let
+      home = "/var/lib/pykms";
+    in {
+      description = "Python KMS";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      # python programs with DynamicUser = true require HOME to be set
+      environment.HOME = home;
+      serviceConfig = with pkgs; {
+        DynamicUser = true;
+        StateDirectory = baseNameOf home;
+        ExecStartPre = "${getBin pykms}/bin/create_pykms_db.sh ${home}/clients.db";
+        ExecStart = lib.concatStringsSep " " ([
+          "${getBin pykms}/bin/server.py"
+          cfg.listenAddress
+          (toString cfg.port)
+        ] ++ lib.optional cfg.verbose "--verbose");
+        WorkingDirectory = home;
+        Restart = "on-failure";
+        MemoryLimit = cfg.memoryLimit;
      };
    };
  };
--- a/nixos/modules/services/misc/zoneminder.nix
+++ b/nixos/modules/services/misc/zoneminder.nix
@ -0,0 +1,362 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.zoneminder;
+  pkg = pkgs.zoneminder;
+
+  dirName = pkg.dirName;
+
+  user = "zoneminder";
+  group = {
+    nginx = config.services.nginx.group;
+    none  = user;
+  }."${cfg.webserver}";
+
+  useNginx = cfg.webserver == "nginx";
+
+  defaultDir = "/var/lib/${user}";
+  home = if useCustomDir then cfg.storageDir else defaultDir;
+
+  useCustomDir = !(builtins.isNull cfg.storageDir);
+
+  socket = "/run/phpfpm/${dirName}.sock";
+
+  zms = "/cgi-bin/zms";
+
+  dirs = dirList: [ dirName ] ++ map (e: "${dirName}/${e}") dirList;
+
+  cacheDirs = [ "swap" ];
+  libDirs   = [ "events" "exports" "images" "sounds" ];
+
+  dirStanzas = baseDir:
+    lib.concatStringsSep "\n" (map (e:
+      "ZM_DIR_${lib.toUpper e}=${baseDir}/${e}"
+      ) libDirs);
+
+  defaultsFile = pkgs.writeText "60-defaults.conf" ''
+    # 01-system-paths.conf
+    ${dirStanzas home}
+    ZM_PATH_ARP=${lib.getBin pkgs.nettools}/bin/arp
+    ZM_PATH_LOGS=/var/log/${dirName}
+    ZM_PATH_MAP=/dev/shm
+    ZM_PATH_SOCKS=/run/${dirName}
+    ZM_PATH_SWAP=/var/cache/${dirName}/swap
+    ZM_PATH_ZMS=${zms}
+
+    # 02-multiserver.conf
+    ZM_SERVER_HOST=
+
+    # Database
+    ZM_DB_TYPE=mysql
+    ZM_DB_HOST=${cfg.database.host}
+    ZM_DB_NAME=${cfg.database.name}
+    ZM_DB_USER=${cfg.database.username}
+    ZM_DB_PASS=${cfg.database.password}
+
+    # Web
+    ZM_WEB_USER=${user}
+    ZM_WEB_GROUP=${group}
+  '';
+
+  configFile = pkgs.writeText "80-nixos.conf" ''
+    # You can override defaults here
+
+    ${cfg.extraConfig}
+  '';
+
+  phpExtensions = with pkgs.phpPackages; [
+    { pkg = apcu; name = "apcu"; }
+  ];
+
+in {
+  options = {
+    services.zoneminder = with lib; {
+      enable = lib.mkEnableOption ''
+        ZoneMinder
+        </para><para>
+        If you intend to run the database locally, you should set
+        `config.services.zoneminder.database.createLocally` to true. Otherwise,
+        when set to `false` (the default), you will have to create the database
+        and database user as well as populate the database yourself.
+      '';
+
+      webserver = mkOption {
+        type = types.enum [ "nginx" "none" ];
+        default = "nginx";
+        description = ''
+          The webserver to configure for the PHP frontend.
+          </para>
+          <para>
+
+          Set it to `none` if you want to configure it yourself. PRs are welcome
+          for support for other web servers.
+        '';
+      };
+
+      hostname = mkOption {
+        type = types.str;
+        default = "localhost";
+        description = ''
+          The hostname on which to listen.
+        '';
+      };
+
+      port = mkOption {
+        type = types.int;
+        default = 8095;
+        description = ''
+          The port on which to listen.
+        '';
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Open the firewall port(s).
+        '';
+      };
+
+      database = {
+        createLocally = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Create the database and database user locally.
+          '';
+        };
+
+        host = mkOption {
+          type = types.str;
+          default = "localhost";
+          description = ''
+            Hostname hosting the database.
+          '';
+        };
+
+        name = mkOption {
+          type = types.str;
+          default = "zm";
+          description = ''
+            Name of database.
+          '';
+        };
+
+        username = mkOption {
+          type = types.str;
+          default = "zmuser";
+          description = ''
+            Username for accessing the database.
+          '';
+        };
+
+        password = mkOption {
+          type = types.str;
+          default = "zmpass";
+          description = ''
+            Username for accessing the database.
+          '';
+        };
+      };
+
+      cameras = mkOption {
+        type = types.int;
+        default = 1;
+        description = ''
+          Set this to the number of cameras you expect to support.
+        '';
+      };
+
+      storageDir = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "/storage/tank";
+        description = ''
+          ZoneMinder can generate quite a lot of data, so in case you don't want
+          to use the default ${home}, you can override the path here.
+        '';
+      };
+
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Additional configuration added verbatim to the configuration file.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    environment.etc = {
+      "zoneminder/60-defaults.conf".source = defaultsFile;
+      "zoneminder/80-nixos.conf".source    = configFile;
+    };
+
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+
+    services = {
+      fcgiwrap = lib.mkIf useNginx {
+        enable = true;
+        preforkProcesses = cfg.cameras;
+        inherit user group;
+      };
+
+      mysql = lib.mkIf cfg.database.createLocally {
+        ensureDatabases = [ cfg.database.name ];
+        ensureUsers = {
+          name = cfg.database.username;
+          ensurePermissions = [
+            { "${cfg.database.name}.*" = "ALL PRIVILEGES"; }
+          ];
+          initialDatabases = [
+            { inherit (cfg.database) name; schema = "${pkg}/share/zoneminder/db/zm_create.sql"; }
+          ];
+        };
+      };
+
+      nginx = lib.mkIf useNginx {
+        enable = true;
+        virtualHosts = {
+          "${cfg.hostname}" = {
+            default = true;
+            root = "${pkg}/share/zoneminder/www";
+            listen = [ { addr = "0.0.0.0"; inherit (cfg) port; } ];
+            extraConfig = let
+              fcgi = config.services.fcgiwrap;
+            in ''
+              index index.php;
+
+              location / {
+                try_files $uri $uri/ /index.php?$args =404;
+
+                location ~ /api/(css|img|ico) {
+                  rewrite ^/api(.+)$ /api/app/webroot/$1 break;
+                  try_files $uri $uri/ =404;
+                }
+
+                location ~ \.(gif|ico|jpg|jpeg|png)$ {
+                  access_log off;
+                  expires 30d;
+                }
+
+                location /api {
+                  rewrite ^/api(.+)$ /api/app/webroot/index.php?p=$1 last;
+                }
+
+                location /cgi-bin {
+                  gzip off;
+
+                  include ${pkgs.nginx}/conf/fastcgi_params;
+                  fastcgi_param SCRIPT_FILENAME ${pkg}/libexec/zoneminder/${zms};
+                  fastcgi_param HTTP_PROXY "";
+                  fastcgi_intercept_errors on;
+
+                  fastcgi_pass ${fcgi.socketType}:${fcgi.socketAddress};
+                }
+
+                location /cache {
+                  alias /var/cache/${dirName};
+                }
+
+                location ~ \.php$ {
+                  try_files $uri =404;
+                  fastcgi_index index.php;
+
+                  include ${pkgs.nginx}/conf/fastcgi_params;
+                  fastcgi_param SCRIPT_FILENAME $request_filename;
+                  fastcgi_param HTTP_PROXY "";
+
+                  fastcgi_pass unix:${socket};
+                }
+              }
+            '';
+          };
+        };
+      };
+
+      phpfpm = lib.mkIf useNginx {
+        phpOptions = ''
+          date.timezone = "${config.time.timeZone}"
+
+          ${lib.concatStringsSep "\n" (map (e:
+          "extension=${e.pkg}/lib/php/extensions/${e.name}.so") phpExtensions)}
+        '';
+        pools.zoneminder = {
+          listen = socket;
+          extraConfig = ''
+            user = ${user}
+            group = ${group}
+
+            listen.owner = ${user}
+            listen.group = ${group}
+            listen.mode = 0660
+
+            pm = dynamic
+            pm.start_servers = 1
+            pm.min_spare_servers = 1
+            pm.max_spare_servers = 2
+            pm.max_requests = 500
+            pm.max_children = 5
+            pm.status_path = /$pool-status
+            ping.path = /$pool-ping
+          '';
+        };
+      };
+    };
+
+    systemd.services = {
+      zoneminder = with pkgs; rec {
+        inherit (zoneminder.meta) description;
+        documentation = [ "https://zoneminder.readthedocs.org/en/latest/" ];
+        path = [
+          coreutils
+          procps
+          psmisc
+        ];
+        after = [ "mysql.service" "nginx.service" ];
+        wantedBy = [ "multi-user.target" ];
+        restartTriggers = [ defaultsFile configFile ];
+        preStart = lib.mkIf useCustomDir ''
+          install -dm775 -o ${user} -g ${group} ${cfg.storageDir}/{${lib.concatStringsSep "," libDirs}}
+        '';
+        serviceConfig = {
+          User = user;
+          Group = group;
+          SupplementaryGroups = [ "video" ];
+          ExecStart  = "${zoneminder}/bin/zmpkg.pl start";
+          ExecStop   = "${zoneminder}/bin/zmpkg.pl stop";
+          ExecReload = "${zoneminder}/bin/zmpkg.pl restart";
+          PIDFile = "/run/${dirName}/zm.pid";
+          Type = "forking";
+          Restart = "on-failure";
+          RestartSec = "10s";
+          CacheDirectory = dirs cacheDirs;
+          RuntimeDirectory = dirName;
+          ReadWriteDirectories = lib.mkIf useCustomDir [ cfg.storageDir ];
+          StateDirectory = dirs (if useCustomDir then [] else libDirs);
+          LogsDirectory = dirName;
+          PrivateTmp = true;
+          ProtectSystem = "strict";
+          ProtectKernelTunables = true;
+          SystemCallArchitectures = "native";
+          NoNewPrivileges = true;
+        };
+      };
+    };
+
+    users.groups."${user}" = {
+      gid = config.ids.gids.zoneminder;
+    };
+
+    users.users."${user}" = {
+      uid = config.ids.uids.zoneminder;
+      group = user;
+      inherit home;
+      inherit (pkgs.zoneminder.meta) description;
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ peterhoeg ];
+}
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@ -5,14 +5,6 @@ with lib;
 let
  cfg = config.services.xserver.desktopManager.gnome3;

-  # Remove packages of ys from xs, based on their names
-  removePackagesByName = xs: ys:
-    let
-      pkgName = drv: (builtins.parseDrvName drv.name).name;
-      ysNames = map pkgName ys;
-    in
-      filter (x: !(builtins.elem (pkgName x) ysNames)) xs;
-
  # Prioritize nautilus by default when opening directories
  mimeAppsList = pkgs.writeTextFile {
    name = "gnome-mimeapps";
@ -103,6 +95,7 @@ in {
    services.dleyna-server.enable = mkDefault true;
    services.gnome3.at-spi2-core.enable = true;
    services.gnome3.evolution-data-server.enable = true;
+    services.gnome3.file-roller.enable = mkDefault true;
    services.gnome3.gnome-disks.enable = mkDefault true;
    services.gnome3.gnome-documents.enable = mkDefault true;
    services.gnome3.gnome-keyring.enable = true;
@ -167,7 +160,7 @@ in {
                                                "${pkgs.gnome3.glib-networking.out}/lib/gio/modules"
                                                "${pkgs.gnome3.gvfs}/lib/gio/modules" ];
    environment.systemPackages = pkgs.gnome3.corePackages ++ cfg.sessionPath
-      ++ (removePackagesByName pkgs.gnome3.optionalPackages config.environment.gnome3.excludePackages) ++ [
+      ++ (pkgs.gnome3.removePackagesByName pkgs.gnome3.optionalPackages config.environment.gnome3.excludePackages) ++ [
      pkgs.xdg-user-dirs # Update user dirs as described in http://freedesktop.org/wiki/Software/xdg-user-dirs/
    ];

--- a/nixos/modules/services/x11/desktop-managers/lxqt.nix
+++ b/nixos/modules/services/x11/desktop-managers/lxqt.nix
@ -3,15 +3,6 @@
 with lib;

 let
-
-  # Remove packages of ys from xs, based on their names
-  removePackagesByName = xs: ys:
-    let
-      pkgName = drv: (builtins.parseDrvName drv.name).name;
-      ysNames = map pkgName ys;
-    in
-      filter (x: !(builtins.elem (pkgName x) ysNames)) xs;
-
  xcfg = config.services.xserver;
  cfg = xcfg.desktopManager.lxqt;

@ -60,7 +51,7 @@ in
    environment.systemPackages =
      pkgs.lxqt.preRequisitePackages ++
      pkgs.lxqt.corePackages ++
-      (removePackagesByName
+      (pkgs.gnome3.removePackagesByName
        pkgs.lxqt.optionalPackages
        config.environment.lxqt.excludePackages);

--- a/nixos/modules/services/x11/desktop-managers/mate.nix
+++ b/nixos/modules/services/x11/desktop-managers/mate.nix
@ -4,14 +4,6 @@ with lib;

 let

-  # Remove packages of ys from xs, based on their names
-  removePackagesByName = xs: ys:
-    let
-      pkgName = drv: (builtins.parseDrvName drv.name).name;
-      ysNames = map pkgName ys;
-    in
-      filter (x: !(builtins.elem (pkgName x) ysNames)) xs;
-
  addToXDGDirs = p: ''
    if [ -d "${p}/share/gsettings-schemas/${p.name}" ]; then
      export XDG_DATA_DIRS=$XDG_DATA_DIRS''${XDG_DATA_DIRS:+:}${p}/share/gsettings-schemas/${p.name}
@ -96,7 +88,7 @@ in

    environment.systemPackages =
      pkgs.mate.basePackages ++
-      (removePackagesByName
+      (pkgs.gnome3.removePackagesByName
        pkgs.mate.extraPackages
        config.environment.mate.excludePackages);

--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@ -158,9 +158,9 @@ in runCommand
  ''
    mkdir -p $out/{bin,share/pixmaps}

-    # TODO: Rename preview -> beta (and add -stable suffix?):
    echo -n "$startScript" > $out/bin/${pname}
    chmod +x $out/bin/${pname}
+
    ln -s ${androidStudio}/bin/studio.png $out/share/pixmaps/${drvName}.png
    ln -s ${desktopItem}/share/applications $out/share/applications
  ''
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -23,8 +23,15 @@ let
    sha256Hash = "1f7lllj85fia02hgy4ksbqh80sdcml16fv1g892jc6lwykjrdw5y";
  };
 in rec {
-  # Old alias
-  preview = beta;
+  # Old alias (TODO @primeos: Remove after 19.03 is branched off):
+  preview = throw ''
+    The attributes "android-studio-preview" and "androidStudioPackages.preview"
+    are now deprecated and will be removed soon, please use
+    "androidStudioPackages.beta" instead. This attribute corresponds to the
+    beta channel, if you want the latest release you can use
+    "androidStudioPackages.dev" or "androidStudioPackages.canary" instead
+    (currently, there is no difference between both channels).
+  '';

  # Attributes are named by their corresponding release channels

@ -35,7 +42,7 @@ in rec {

  beta = mkStudio (betaVersion // {
    channel = "beta";
-    pname = "android-studio-preview";
+    pname = "android-studio-beta";
  });

  dev = mkStudio (latestVersion // {
--- a/pkgs/applications/editors/gnome-builder/default.nix
+++ b/pkgs/applications/editors/gnome-builder/default.nix
@ -32,14 +32,14 @@
 , wrapGAppsHook
 }:
 let
-  version = "3.30.2";
+  version = "3.30.3";
  pname = "gnome-builder";
 in stdenv.mkDerivation {
  name = "${pname}-${version}";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "05yax7iv9g831xvw9xdc01qc0l7qpmh6rfd692x8cbg76hljxdrr";
+    sha256 = "11h6apjyah91djf77m8xkl5rvdz7mwpp3bjc4yzzs9lm3pag764r";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/editors/neovim/default.nix
+++ b/pkgs/applications/editors/neovim/default.nix
@ -11,13 +11,13 @@ let

  neovim = stdenv.mkDerivation rec {
    name = "neovim-unwrapped-${version}";
-    version = "0.3.3";
+    version = "0.3.4";

    src = fetchFromGitHub {
      owner = "neovim";
      repo = "neovim";
      rev = "v${version}";
-      sha256 = "0jf39br0c7kkvmc8b5n9b3lgy9cmf5sv1gghzafc8qk54bqymy2f";
+      sha256 = "07ncvgp6xfhiwc6hd7qf7zk28n3yj47p26qj1ji29vqkwnk28y3s";
    };

    enableParallelBuilding = true;
--- a/pkgs/applications/editors/neovim/neovim-remote.nix
+++ b/pkgs/applications/editors/neovim/neovim-remote.nix
@ -4,14 +4,14 @@ with stdenv.lib;

 pythonPackages.buildPythonPackage rec {
  pname = "neovim-remote";
-  version = "2.1.3";
+  version = "2.1.4";
  disabled = !pythonPackages.isPy3k;

  src = fetchFromGitHub {
    owner = "mhinz";
    repo = "neovim-remote";
    rev = "v${version}";
-    sha256 = "0nx987af29ajlpwnwfc3z8gplxv69gj53s4bzm6pwwsfbhfakdah";
+    sha256 = "1s438cbyyzgg96b6639wk1ny6d6p2ywcba41l3r027wzyl7wrn8v";
  };

  propagatedBuildInputs = with pythonPackages; [ pynvim psutil ];
--- a/pkgs/applications/misc/coursera-dl/default.nix
+++ b/pkgs/applications/misc/coursera-dl/default.nix
@ -22,6 +22,11 @@ in pythonPackages.buildPythonApplication rec {

  checkInputs = with pythonPackages; [ pytest mock ];

+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace '==' '>='
+  '';
+
  preConfigure = ''
    export LC_ALL=en_US.utf-8
  '';
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -14,11 +14,11 @@ in

 python3Packages.buildPythonApplication rec {
  name = "electrum-${version}";
-  version = "3.2.3";
+  version = "3.2.4";

  src = fetchurl {
    url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "139kzapas1l61w1in9f7c6ybricid4fzryfnvsrfhpaqh83ydn2c";
+    sha256 = "0nwipn1alk3r54zpsv2bdwsqxw4f08bxnfmygnwakfkiaifmmhxg";
  };

  propagatedBuildInputs = with python3Packages; [
--- a/pkgs/applications/misc/gnuradio/osmosdr.nix
+++ b/pkgs/applications/misc/gnuradio/osmosdr.nix
@ -1,24 +1,33 @@
-{ stdenv, fetchgit, cmake, pkgconfig, boost, gnuradio, rtl-sdr, uhd
-, makeWrapper, hackrf, airspy
+{ stdenv, fetchgit, cmake, pkgconfig, makeWrapper
+, boost
 , pythonSupport ? true, python, swig
+, airspy
+, gnuradio
+, hackrf
+, libbladeRF
+, rtl-sdr
+, soapysdr-with-plugins
+, uhd
 }:

 assert pythonSupport -> python != null && swig != null;

 stdenv.mkDerivation rec {
  name = "gnuradio-osmosdr-${version}";
-  version = "0.1.4";
+  version = "2018-08-15";

  src = fetchgit {
    url = "git://git.osmocom.org/gr-osmosdr";
-    rev = "refs/tags/v${version}";
-    sha256 = "0vyzr4fhkblf2v3d7m0ch5hws4c493jw3ydl4y6b2dfbfzchhsz8";
+    rev = "4d83c6067f059b0c5015c3f59f8117bbd361e877";
+    sha256 = "1d5nb47506qry52bg4cn02d3l4lwxwz44g2fz1ph0q93c7892j60";
  };

  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [
-    cmake boost gnuradio rtl-sdr uhd makeWrapper hackrf airspy
-  ] ++ stdenv.lib.optionals pythonSupport [ python swig ];
+    cmake makeWrapper boost
+    airspy gnuradio hackrf libbladeRF rtl-sdr uhd
+  ] ++ stdenv.lib.optionals stdenv.isLinux [ soapysdr-with-plugins ]
+    ++ stdenv.lib.optionals pythonSupport [ python swig ];

  postInstall = ''
    for prog in "$out"/bin/*; do
--- a/pkgs/applications/misc/gnuradio/rds.nix
+++ b/pkgs/applications/misc/gnuradio/rds.nix
@ -6,13 +6,13 @@ assert pythonSupport -> python != null && swig != null;

 stdenv.mkDerivation rec {
  name = "gnuradio-rds-${version}";
-  version = "1.0.0";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "bastibl";
    repo = "gr-rds";
    rev = "v${version}";
-    sha256 = "008284ya464q4h4fd0zvcn6g7bym231p8fl3kdxncz9ks4zsbsxs";
+    sha256 = "0jkzchvw0ivcxsjhi1h0mf7k13araxf5m4wi5v9xdgqxvipjzqfy";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/misc/img2pdf/default.nix
+++ b/pkgs/applications/misc/img2pdf/default.nix
@ -4,11 +4,11 @@ with python3Packages;

 buildPythonApplication rec {
  pname = "img2pdf";
-  version = "0.3.2";
+  version = "0.3.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "07wxgn5khmy94zqqv8l84q9b3yy84ddvwr2f7j4pjycrj2gg7si8";
+    sha256 = "1ksn33j9d9df04n4jx7dli70d700rafbm37gjaz6lwsswrzc2xwx";
  };

  doCheck = false; # needs pdfrw
--- a/pkgs/applications/misc/tdrop/default.nix
+++ b/pkgs/applications/misc/tdrop/default.nix
@ -0,0 +1,33 @@
+{ stdenv, lib, fetchFromGitHub, makeWrapper
+, xwininfo, xdotool, xprop }:
+
+stdenv.mkDerivation rec {
+  pname = "tdrop";
+  version = "unstable-2018-11-13";
+
+  src = fetchFromGitHub {
+    owner = "noctuid";
+    repo = "tdrop";
+    rev = "198795c0d2573a31979330d6a2ae946eb81deebf";
+    sha256 = "1fhibqgmls64mylcb6q46ipmg1q6pvaqm26vz933gqav6cqsbdzs";
+  };
+
+  dontBuild = true;
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  postInstall = ''
+    wrapProgram $out/bin/tdrop \
+      --prefix PATH : ${lib.makeBinPath [ xwininfo xdotool xprop ]}
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  meta = with stdenv.lib; {
+    description = "A Glorified WM-Independent Dropdown Creator";
+    homepage = https://github.com/noctuid/tdrop;
+    license = licenses.bsd2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ wedens ];
+  };
+}
--- a/pkgs/applications/misc/xpad/default.nix
+++ b/pkgs/applications/misc/xpad/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  name = "xpad-${version}";
-  version = "5.3.0";
+  version = "5.4.0";

  src = fetchurl {
    url = "https://launchpad.net/xpad/trunk/${version}/+download/xpad-${version}.tar.bz2";
-    sha256 = "0gv9indihr2kbv9iqdqq4mfj6l6qgzwc06jm08gmg10f262sni34";
+    sha256 = "1qpmlwn0bcw1q73ag0l0fdnlzmwawfvsy4g9y5b0vyrc58lcp5d3";
  };

  nativeBuildInputs = [ autoreconfHook pkgconfig wrapGAppsHook ];
--- a/pkgs/applications/misc/yubioath-desktop/default.nix
+++ b/pkgs/applications/misc/yubioath-desktop/default.nix
@ -1,41 +1,56 @@
-{ stdenv, fetchurl,  python27Packages, pcsclite, yubikey-personalization }:
+{ stdenv, fetchurl, fetchFromGitHub
+, qmake, qtbase, qtquickcontrols, qtsvg
+, python3, pyotherside, ncurses
+, pcsclite, yubikey-personalization
+, yubikey-manager, makeWrapper }:

-python27Packages.buildPythonApplication rec {
-    namePrefix = "";
-    name = "yubioath-desktop-${version}";
-    version = "3.1.0";
+stdenv.mkDerivation rec {
+  pname = "yubioath-desktop";
+  version = "4.3.4";

-    src = fetchurl {
-      url = "https://developers.yubico.com/yubioath-desktop/Releases/yubioath-desktop-${version}.tar.gz";
-      sha256 = "0jfvllgh88g2vwd8sg6willlnn2hq05nd9d3xmv98lhl7gyy1akw";
-    };
+  src = fetchurl {
+    url = "https://developers.yubico.com/yubioath-desktop/Releases/yubioath-desktop-${version}.tar.gz";
+    sha256 = "0hb7j71032sigs8zd5r8yr0m59sjkb24vhs2l4jarpvj8q7hv30d";
+  };

-    doCheck = false;
+  doCheck = false;

-    buildInputs = [ stdenv ];
+  buildInputs = [ stdenv qtbase qtquickcontrols pyotherside python3 ];

-    propagatedBuildInputs = [ python27Packages.pycrypto python27Packages.click python27Packages.pyscard python27Packages.pyside ];
+  nativeBuildInputs = [ qmake makeWrapper python3.pkgs.wrapPython ];

-    # Need LD_PRELOAD for libykpers as the Nix cpython disables ctypes.cdll.LoadLibrary
-    # support that the yubicommon library uses to load libykpers
-    makeWrapperArgs = ''--prefix LD_LIBRARY_PATH : "${stdenv.lib.getLib pcsclite}/lib:${yubikey-personalization}/lib" --prefix LD_PRELOAD : "${yubikey-personalization}/lib/libykpers-1.so"'';
+  postPatch = ''
+    substituteInPlace deployment.pri \
+      --replace '/usr/bin' "$out/bin"
+  '';
+
+  pythonPath = [ yubikey-manager ];
+
+  # Need LD_PRELOAD for libykpers as the Nix cpython disables ctypes.cdll.LoadLibrary
+  # support that the yubicommon library uses to load libykpers
+
+  postInstall = ''
+    buildPythonPath "$out $pythonPath"
+    wrapProgram $out/bin/yubioath-desktop \
+      --prefix PYTHONPATH : "$program_PYTHONPATH" \
+      --prefix LD_PRELOAD : "${yubikey-personalization}/lib/libykpers-1.so" \
+      --prefix LD_LIBRARY_PATH : "${stdenv.lib.getLib pcsclite}/lib:${yubikey-personalization}/lib"

-    postInstall = ''
      mkdir -p $out/share/applications
-      cp resources/yubioath.desktop $out/share/applications/yubioath.desktop
+      cp resources/yubioath-desktop.desktop \
+        $out/share/applications/yubioath-desktop.desktop
      mkdir -p $out/share/yubioath/icons
-      cp resources/yubioath*.{icns,ico,png,xpm} $out/share/yubioath/icons
-      substituteInPlace $out/share/applications/yubioath.desktop \
-        --replace 'Exec=yubioath-gui' "Exec=$out/bin/yubioath-gui" \
-        --replace 'Icon=yubioath' "Icon=$out/share/yubioath/icons"
+      cp resources/icons/*.{icns,ico,png,xpm} $out/share/yubioath/icons
+      substituteInPlace $out/share/applications/yubioath-desktop.desktop \
+        --replace 'Exec=yubioath-desktop' "Exec=$out/bin/yubioath-desktop" \
+  '';

-    '';
+  meta = with stdenv.lib; {
+    description = "Yubikey Desktop Authenticator";

-    meta = {
-      description = "Yubikey Desktop Authenticator";
+    homepage = https://www.yubico.com/support/knowledge-base/categories/articles/yubico-authenticator-download/;

-      homepage = https://www.yubico.com/support/knowledge-base/categories/articles/yubico-authenticator-download/;
-
-      license = stdenv.lib.licenses.gpl3;
-    };
+    license = stdenv.lib.licenses.gpl3;
+    maintainers = with maintainers; [ mic92 ];
+  };
 }
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -76,11 +76,11 @@ let rpath = lib.makeLibraryPath [

 in stdenv.mkDerivation rec {
    pname = "brave";
-    version = "0.58.18";
+    version = "0.58.21";

    src = fetchurl {
        url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-        sha256 = "0xybcgsxjmd8bxi4x4midzw71s23j8icpspqf5sadskhldvshzr3";
+        sha256 = "0mml8zjpm8gjw3krppr57y4p10ky975v0s4wyyx7ixr1lzk2qp11";
    };

    dontConfigure = true;
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -15,13 +15,13 @@ with lib;

 stdenv.mkDerivation rec {
  name = "kubernetes-${version}";
-  version = "1.13.1";
+  version = "1.13.2";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    rev = "v${version}";
-    sha256 = "048ckirz7v1djari6l9ddkcd9i4yafcv57wk131dv0cs2zady9va";
+    sha256 = "1j5yyzn3c481ba6bbyx6gsa41zhg3x35sdbajlnxmbnid0g21g8g";
  };

  buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];
--- a/pkgs/applications/networking/cluster/terraform-docs/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-docs/default.nix
@ -2,7 +2,7 @@
 buildGoPackage rec {
  name = "${pname}-${version}";
  pname = "terraform-docs";
-  version = "0.5.0";
+  version = "0.6.0";

  goPackagePath = "github.com/segmentio/${pname}";

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner  = "segmentio";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "12w2yr669hk5kxdb9rrzsn8hwvx8rzrc1rmn8hs9l8z1bkfhr4gg";
+    sha256 = "1p6prhjf82qnhf1zwl9h92j4ds5g383a6g9pwwnqbc3wdwy5zx7d";
  };

  preBuild = ''
--- a/pkgs/applications/networking/cluster/terraform-providers/data.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/data.nix
@ -11,8 +11,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-alicloud";
-      version = "1.25.0";
-      sha256  = "09f0vdzkifj2mk1qccacpnlqiihbhhb2sfd21rpxbqscmj6a7vj1";
+      version = "1.28.0";
+      sha256  = "1clivywiv41dbdiix5cqghncf782jvpixlh02hlj4hn2cwq2j6mn";
    };
  archive =
    {
@ -39,15 +39,22 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-aws";
-      version = "1.52.0";
-      sha256  = "037n26spp49r4b4f6cyv6d3sgqw2d80g97fqgz1j0hcwi0am56h1";
+      version = "1.56.0";
+      sha256  = "1jsvkqr3l88z2lq89rjw0nrnm8dsm57nydi45mbzjl3k0j7g028m";
+    };
+  azuread =
+    {
+      owner   = "terraform-providers";
+      repo    = "terraform-provider-azuread";
+      version = "0.1.0";
+      sha256  = "0jrsg3a9cb16jinzjhg2pfm65b1bfhdwnyhag1x3x4kffm3gm148";
    };
  azurerm =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-azurerm";
-      version = "1.20.0";
-      sha256  = "0hfq5gk4bhmw65x1rsdpwv0massgr1sczvcbyh572qlkkhvm59xd";
+      version = "1.21.0";
+      sha256  = "1xvw884nmr3h5ai2ijm2vms12cghas0jbkb52mqbqbaqci7273lc";
    };
  azurestack =
    {
@ -102,8 +109,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-cloudflare";
-      version = "1.9.0";
-      sha256  = "0z11zaii99cilqcq4lgikaanb2zc457qv19sxdh6b3v88n5n8qsf";
+      version = "1.11.0";
+      sha256  = "14v4461bxxr5zdr11v1s89m1x9kpjxa1mff9inx2vwkdz9s02w0i";
    };
  cloudscale =
    {
@ -116,8 +123,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-cloudstack";
-      version = "0.1.5";
-      sha256  = "139wq6rr6fczjz496fqkxh6cmscx5hfnv2hvhfwpkhvqipsnlxmq";
+      version = "0.2.0";
+      sha256  = "1v46da55a8a0hnw319swz3pkd62afy7hdwzybxmp48hxh1i6af74";
    };
  cobbler =
    {
@ -193,15 +200,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-fastly";
-      version = "0.4.0";
-      sha256  = "1fkn9b6ibs36cmhknb3x05g31rf73w70xwx05rh9fhybrz5dd9z9";
+      version = "0.5.0";
+      sha256  = "08mnpf5j0pwhd38yl0phy5ipdvk9hwh8q9kcbv997y8mzpn5703g";
    };
  flexibleengine =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-flexibleengine";
-      version = "1.2.1";
-      sha256  = "000v6fmmnwfibzfssk23s9qwrb8a9l0j1qd14x2dqsc7ql0kbnz8";
+      version = "1.3.1";
+      sha256  = "19jncf24hl448srk4r2vqn8sca1mx8pcql9p5nxn015q6gig510v";
    };
  github =
    {
@ -214,8 +221,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-gitlab";
-      version = "1.0.0";
-      sha256  = "1kxmzdzdb6fc64i2bzch6020zfk0ygms9gh5mm1bypsyqmj4qc6r";
+      version = "1.1.0";
+      sha256  = "07mj69w0bvvkbzgfj17z7j34dg19db1d2m4gxwzjj81qmgmvzs3x";
    };
  google =
    {
@ -224,6 +231,13 @@
      version = "1.20.0";
      sha256  = "1brkq4iz140miai6gzvzxfl28qi4j8gcc22igd7cb4qzafnlbxaj";
    };
+  google-beta =
+    {
+      owner   = "terraform-providers";
+      repo    = "terraform-provider-google-beta";
+      version = "1.20.0";
+      sha256  = "0qbzacfm1ai0lflwrq49sjy5y84n8zvaxsp6yz7ifvylqmirj1j0";
+    };
  grafana =
    {
      owner   = "terraform-providers";
@ -235,8 +249,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-hcloud";
-      version = "1.6.0";
-      sha256  = "19kax1l2l6vr8cwgy14ahhafnvlxgkw86xx2g9ajfg70d0q4zs3g";
+      version = "1.7.0";
+      sha256  = "10i043mlcp4vvlsd22zcdj2ma3372cxfklrx30kav7w3lfsqgcl6";
+    };
+  hedvig =
+    {
+      owner   = "terraform-providers";
+      repo    = "terraform-provider-hedvig";
+      version = "1.0.1";
+      sha256  = "1cbvr43qb2kxvsg17cnf91lnfv6cmj0dmc1manxrq1nicsnz6v5f";
    };
  helm =
    {
@ -249,8 +270,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-heroku";
-      version = "1.7.0";
-      sha256  = "0zk5w4xwbg631m7592gfmdbsmrr0r7vla5nd1p5frh6szg6psy6m";
+      version = "1.7.2";
+      sha256  = "0wliiks1cvxai3rca2nzy6dhc763fkrzagsl92c5xsz1zs59vy98";
    };
  http =
    {
@ -263,8 +284,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-huaweicloud";
-      version = "1.2.0";
-      sha256  = "0r05dfgpzci0lpc2ivbrj6ivib8svbks9612by3w3zakzclpv467";
+      version = "1.3.0";
+      sha256  = "1pm2zfss20spfwqidhn04hcq4nxxamjkn6xv8vxm3mgrky1ysvp5";
    };
  icinga2 =
    {
@ -291,8 +312,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-kubernetes";
-      version = "1.4.0";
-      sha256  = "14bhqrpx0z4qn51xwcklafva46ipx05q6myy7xh5wf6wpjz69j9p";
+      version = "1.5.0";
+      sha256  = "1rzydw8bg2rmwvcvjp1h2qd4izkfs96rnmff42h0av22sfxkd7ng";
    };
  librato =
    {
@ -305,8 +326,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-linode";
-      version = "1.3.0";
-      sha256  = "1683nkpq7wnc67pphablcmaifq2l1pz3gc9y5y9jbslllphy92v5";
+      version = "1.4.0";
+      sha256  = "0ak102bmi6yh7x9d3ryyvpck49vgdgwhbk958bbyhfpdr6jrvsrr";
    };
  local =
    {
@ -361,15 +382,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-nomad";
-      version = "1.2.0";
-      sha256  = "1z3knyjn5ymbk4vaja4ka9zn57cgl7vr7hqv6ybqw0q9i2ykaici";
+      version = "1.3.0";
+      sha256  = "06kq0qkrgnj7z13xrgb9shid356m55mz0hkdbm4vfz3fx863mvl3";
    };
  ns1 =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-ns1";
-      version = "1.0.0";
-      sha256  = "0zjdhz6miwlg3b68pbd99c6nw7hhyzxy736734xz8g3w89xn18f5";
+      version = "1.1.0";
+      sha256  = "1qfzm35p6kgamm1ffdvll96br025sj496nqzhsnfh3n3hsxzf0b8";
    };
  nsxt =
    {
@ -382,8 +403,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-null";
-      version = "1.0.0";
-      sha256  = "12vpa09xrq8z1pjq0bwzq3889c4fl6c5kvynwqy0z1pdx21m60ha";
+      version = "2.0.0";
+      sha256  = "1qbb4pyzqys2010g6b4yzdzgalrf6az1s24y4sa577q2bix8x45v";
    };
  nutanix =
    {
@ -396,8 +417,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-oci";
-      version = "3.10.0";
-      sha256  = "0dhz3y62dp66jkn0q4x7v2cnqw8kiq34sgyfx8mw706hg9sdqb0l";
+      version = "3.12.0";
+      sha256  = "00mwyangy7n665wlvvr6jmrlfbhnw5spy47q64rmm4pp66gg9brw";
    };
  oneandone =
    {
@ -410,22 +431,22 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-opc";
-      version = "1.3.1";
-      sha256  = "0rpkhaja6vq1y1xah136vjlp1d5v9adymq300ajssbjkqf93wzs6";
+      version = "1.3.2";
+      sha256  = "0fm53xwgpsmfkqavichxb0vq86bqqpsadlyzqz5jafw3aavx91cb";
    };
  openstack =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-openstack";
-      version = "1.12.0";
-      sha256  = "1zv5z55yiqvsh5sh26qlyw8fcc7kyw7v4p60kfnw2ds5kd0b51i1";
+      version = "1.14.0";
+      sha256  = "05vlcfnbfs4xwzfx8lihq63zya19gdgq2xh5ddwprzddm42v1i1z";
    };
  opentelekomcloud =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-opentelekomcloud";
-      version = "1.4.0";
-      sha256  = "0dv756npyhadzr08zlv28ghazaj1fdp3avcld7y6ri99hamncm95";
+      version = "1.5.2";
+      sha256  = "1zprj2k86wad9c35jgv22imld8l8f1jjgv54dj54ry56964nhkh8";
    };
  opsgenie =
    {
@ -438,8 +459,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-oraclepaas";
-      version = "1.4.0";
-      sha256  = "1hhkijxnwmm21b0w9qc3lk5vfcg0ac0sg7v4g0ffjqv68mssrz6x";
+      version = "1.4.1";
+      sha256  = "12jsqsyrkmrxpz8zashjwnvn6nkrd6ya06d58m116a0qija1a4s3";
    };
  ovh =
    {
@ -473,8 +494,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-postgresql";
-      version = "0.1.2";
-      sha256  = "08wv03j70mych4nnamivjihwvca3aksjxgjlj8yasz5292qgl05w";
+      version = "0.1.3";
+      sha256  = "1jx907wrq3b9cvx0z4731d1vkp40g358czgpgmky6k8wg70mhp17";
    };
  powerdns =
    {
@ -543,8 +564,15 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-selvpc";
-      version = "0.3.0";
-      sha256  = "1s1p0qa9x007hq26i4h0gcqpyx54jnwvg8d6ya044gm7gghhviz4";
+      version = "1.1.0";
+      sha256  = "045mp6j5hll0lym9z035swxmdjq43mdpf881qgmk8sz8j2wgvm5f";
+    };
+  skytap =
+    {
+      owner   = "terraform-providers";
+      repo    = "terraform-provider-skytap";
+      version = "0.9.0";
+      sha256  = "15p2rfaqw5iab8fkxcxigp7nxvs4gmgr2v8ysfyjz01mgwidd0rq";
    };
  softlayer =
    {
@ -557,8 +585,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-spotinst";
-      version = "1.4.0";
-      sha256  = "0kb09v18ksh2r4b5k9iv4rzq403zk1shpakk54pmq8s6i5jd085g";
+      version = "1.5.0";
+      sha256  = "15ggn37qsgzb78g0f6bj1l89zy65yqj66abs7xq5kjxsh62h9dij";
    };
  statuscake =
    {
@ -578,8 +606,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-template";
-      version = "1.0.0";
-      sha256  = "0jl6bp6gwg96sdk5j6s13vv1j9gxjpy2yva3barmzv9138i665mz";
+      version = "2.0.0";
+      sha256  = "0rn2qavvx1y0hv25iw8yd6acvrclmz17hzg2jpb161mnlh8q94r4";
    };
  tencentcloud =
    {
@ -599,8 +627,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-tfe";
-      version = "0.5.0";
-      sha256  = "1acmmsb4nj3l4d7zlzjrh97nhrkgm99wlazjrfavxwly253ck283";
+      version = "0.6.0";
+      sha256  = "1p8l034cjpj81vcvnz8mr2yyw3bz4zffmdg9pz9mp62s8rrrvwkw";
    };
  tls =
    {
@ -616,6 +644,13 @@
      version = "0.5.1";
      sha256  = "1bn5x6nmhfkrzpxhyfclls85l9qqffvzx1xsgcb3368lhwzarn2f";
    };
+  ucloud =
+    {
+      owner   = "terraform-providers";
+      repo    = "terraform-provider-ucloud";
+      version = "1.1.0";
+      sha256  = "0v4f7rvyiwmm64v6gwqdz3mn9sjq5y8mlhd7v9saq7rh56pfx3n2";
+    };
  ultradns =
    {
      owner   = "terraform-providers";
@ -641,8 +676,8 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-vsphere";
-      version = "1.9.0";
-      sha256  = "1by9klwvdw3m854jffimfnsz1lnbaixi4zcv4zzs63dc3flwy2b2";
+      version = "1.9.1";
+      sha256  = "07pxzy8fw0n0kq9mf43bz4cycbwxp8vy0jbl44sknszmzbn4pam7";
    };
  matchbox =
    {
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@ -11,10 +11,12 @@ let
      inherit (data) owner repo version sha256;
      name = "${repo}-${version}";
      goPackagePath = "github.com/${owner}/${repo}";
+      subPackages = [ "." ];
      src = fetchFromGitHub {
        inherit owner repo sha256;
        rev = "v${version}";
      };
+      

      # Terraform allow checking the provider versions, but this breaks
      # if the versions are not provided via file paths.
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.txt
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.txt
@ -7,7 +7,7 @@
 #  <organisation>/<repo>                                         - include only the named repository.

 # include all terraform-providers
-terraform-providers terraform-provider- terraform-provider-\\(azure-classic\\|scaffolding\\|google-beta\\|skytap\\)
+terraform-providers terraform-provider- terraform-provider-\\(azure-classic\\|scaffolding\\)

 # include terraform-provider-matchbox
 coreos/terraform-provider-matchbox
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -97,8 +97,8 @@ in rec {
  terraform_0_11-full = terraform_0_11.full;

  terraform_0_12 = pluggable (generic {
-    version = "0.12.0-alpha2";
-    sha256 = "1rnxgwfk10b1g3jnh9gv4lqrcszhxq8shaqslml30hafs3dkg71q";
+    version = "0.12.0-alpha4";
+    sha256 = "16cwqxxb19m91d7rx7awri1awz7d8cfnrv0rbql9rbg5qjyqxcp9";
    patches = [ ./provider-path.patch ];
    passthru = { inherit plugins; };
  });
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -56,11 +56,11 @@ let

 in stdenv.mkDerivation rec {
  name = "signal-desktop-${version}";
-  version = "1.19.0";
+  version = "1.20.0";

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "19a585mylbwrxd2m75hgp77ys1r350xkvawq2ysp0cxzr04l46z7";
+    sha256 = "1w75g7i7hf9b3yilnd6ivhd4xgp4z000x9wnrqcba2dgbr5pz7c7";
  };

  phases = [ "unpackPhase" "installPhase" ];
--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@ -1,14 +1,15 @@
 { darkMode ? false, stdenv, fetchurl, dpkg, makeWrapper
 , alsaLib, atk, cairo, cups, curl, dbus, expat, fontconfig, freetype, glib
 , gnome2, gtk3, gdk_pixbuf, libnotify, libxcb, nspr, nss, pango
-, systemd, xorg }:
+, systemd, xorg, at-spi2-atk }:

 let

-  version = "3.3.3";
+  version = "3.3.7";

  rpath = stdenv.lib.makeLibraryPath [
    alsaLib
+    at-spi2-atk
    atk
    cairo
    cups
@ -47,7 +48,7 @@ let
    if stdenv.hostPlatform.system == "x86_64-linux" then
      fetchurl {
        url = "https://downloads.slack-edge.com/linux_releases/slack-desktop-${version}-amd64.deb";
-        sha256 = "01x4anbm62y49zfkyfvxih5rk8g2qi32ppb8j2a5pwssyw4wqbfi";
+        sha256 = "1q3866iaby8rqim8h2m398wzi0isnnlsxirlq63fzz7a4g1hnc8p";
      }
    else
      throw "Slack is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/networking/instant-messengers/wavebox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/wavebox/default.nix
@ -8,7 +8,7 @@ with stdenv.lib;
 let
  bits = "x86_64";

-  version = "4.5.9";
+  version = "4.5.10";

  desktopItem = makeDesktopItem rec {
    name = "Wavebox";
@ -25,7 +25,7 @@ in stdenv.mkDerivation rec {
  name = "wavebox-${version}";
  src = fetchurl {
    url = "https://github.com/wavebox/waveboxapp/releases/download/v${version}/${tarball}";
-    sha256 = "158kj7r5p4p3xk5pwzvbd51h543panmgkr64knv418ksyqjdi16g";
+    sha256 = "0863x3gyzzbm6qs26j821b4iy596cc2h7ppdj6hq5rgr7c01ac9k";
  };

  # don't remove runtime deps
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@ -27,15 +27,15 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "mutt-${version}";
-  version = "1.11.1";
+  version = "1.11.2";

  src = fetchurl {
    url = "http://ftp.mutt.org/pub/mutt/${name}.tar.gz";
-    sha256 = "01fvn5h7l9rkwx6qz46svl4hmww108v4bmcywiw3prb26q0l2lbh";
+    sha256 = "08w7lbhj5ba2zkjcd0cxkgfiy9y82yhg731xjg9i9292kz1x8p6s";
  };

  patches = optional smimeSupport (fetchpatch {
-    url = "https://salsa.debian.org/mutt-team/mutt/raw/debian/1.11.1-2/debian/patches/misc/smime.rc.patch";
+    url = "https://salsa.debian.org/mutt-team/mutt/raw/debian/1.11.2-2/debian/patches/misc/smime.rc.patch";
    sha256 = "1rl27qqwl4nw321ll5jcvfmkmz4fkvcsh5vihjcrhzzyf6vz8wmj";
  });

--- a/pkgs/applications/networking/mpop/default.nix
+++ b/pkgs/applications/networking/mpop/default.nix
@ -3,12 +3,12 @@
 with stdenv.lib;

 stdenv.mkDerivation rec {
-  version = "1.4.1";
+  version = "1.4.2";
  name = "mpop-${version}";

  src = fetchurl {
    url = "https://marlam.de/mpop/releases/${name}.tar.xz";
-    sha256 = "1b9mj6yfa8vg5flxw1xb8xalifjg87dghbg523i6fbr7679zl9iy";
+    sha256 = "1rx5mhgqkm7swbynrhbsz32v85h0rydb4kqfgfs9jrznd9d14m2d";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchurl, buildFHSUserEnv, makeDesktopItem, runCommand, bash, wrapGAppsHook, gsettings-desktop-schemas, gtk3, gnome3 }:

 let
-version = "5.0.35.1";
+version = "5.0.60";
 meta = with stdenv.lib; {
  homepage = https://www.zotero.org;
  description = "Collect, organize, cite, and share your research sources";
@ -15,7 +15,7 @@ zoteroSrc = stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "0d2imvp84svllrnja1dl4nldp634z632g5xkm2q9v7j3dwbzw1hw";
+    sha256 = "0753xk95shhxma4dvdxrj2q6y81z8lianxg7jnab9m17fb67jy2d";
  };

  buildInputs= [ wrapGAppsHook gsettings-desktop-schemas gtk3 gnome3.adwaita-icon-theme gnome3.dconf ];
@ -32,7 +32,7 @@ zoteroSrc = stdenv.mkDerivation rec {
 fhsEnv = buildFHSUserEnv {
  name = "zotero-fhs-env";
  targetPkgs = pkgs: with pkgs; with xorg; [
-    gtk3 dbus-glib
+    gtk3 dbus-glib glib
    libXt nss
    libX11
  ];
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "picard-tools-${version}";
-  version = "2.18.21";
+  version = "2.18.23";

  src = fetchurl {
    url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "0p1na79p0kz1x1nd88100487s4f306p8k4m7dq5r4m2kdsc1dqin";
+    sha256 = "13521lcblbcb4vshcrrw6qlqlzvm88grp4vm8d0b3hwbl3rr0py4";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/science/math/gap/default.nix
+++ b/pkgs/applications/science/math/gap/default.nix
@ -5,11 +5,60 @@
 , makeWrapper
 , m4
 , gmp
-# don't remove any packages -- results in a ~1.3G size increase
-# see https://github.com/NixOS/nixpkgs/pull/38754 for a discussion
-, keepAllPackages ? true
+# one of
+# - "minimal" (~400M):
+#     Install the bare minimum of packages required by gap to start.
+#     This is likely to break a lot of stuff. Do not expect upstream support with
+#     this configuration.
+# - "standard" (~700M):
+#     Install the "standard packages" which gap autoloads by default. These
+#     packages are effectively considered a part of gap.
+# - "full" (~1.7G):
+#     Install all available packages. This takes a lot of space.
+, packageSet ? "standard"
+# Kept for backwards compatibility. Overrides packageSet to "full".
+, keepAllPackages ? false
 }:
+let
+  # packages absolutely required for gap to start
+  # `*` represents the version where applicable
+  requiredPackages = [
+    "GAPDoc-*"
+    "primgrp-*"
+    "SmallGrp-*"
+    "transgrp"
+  ];
+  # packages autoloaded by default if available
+  autoloadedPackages = [
+    "atlasrep"
+    "autpgrp-*"
+    "alnuth-*"
+    "crisp-*"
+    "ctbllib"
+    "FactInt-*"
+    "fga"
+    "irredsol-*"
+    "laguna-*"
+    "polenta-*"
+    "polycyclic-*"
+    "resclasses-*"
+    "sophus-*"
+    "tomlib-*"
+  ];
+  standardPackages = requiredPackages ++ autoloadedPackages;
+  keepAll = keepAllPackages || (packageSet == "full");
+  packagesToKeep = requiredPackages ++ lib.optionals (packageSet == "standard") autoloadedPackages;

+  # Generate bash script that removes all packages from the `pkg` subdirectory
+  # that are not on the whitelist. The whitelist consists of strings expected by
+  # `find`'s `-name`.
+  removeNonWhitelistedPkgs = whitelist: ''
+    find pkg -type d -maxdepth 1 -mindepth 1 \
+  '' + (lib.concatStringsSep "\n" (map (str: "-not -name '${str}' \\") whitelist)) + ''
+    -exec echo "Removing package {}" \; \
+    -exec rm -r '{}' \;
+  '';
+in
 stdenv.mkDerivation rec {
  pname = "gap";
  # https://www.gap-system.org/Releases/
@ -21,14 +70,8 @@ stdenv.mkDerivation rec {
  };

  # remove all non-essential packages (which take up a lot of space)
-  preConfigure = ''
+  preConfigure = lib.optionalString (!keepAll) (removeNonWhitelistedPkgs packagesToKeep) + ''
    patchShebangs .
-  '' + lib.optionalString (!keepAllPackages) ''
-    find pkg -type d -maxdepth 1 -mindepth 1 \
-       -not -name 'GAPDoc-*' \
-       -not -name 'autpgrp*' \
-       -exec echo "Removing package {}" \; \
-       -exec rm -r {} \;
  '';

  configureFlags = [ "--with-gmp=system" ];
@ -107,7 +150,16 @@ stdenv.mkDerivation rec {
    popd
  '';

-  installPhase = ''
+  installTargets = [
+    "install-libgap"
+    "install-headers"
+  ];
+
+  # full `make install` is not yet implemented, just for libgap and headers
+  postInstall = ''
+    # Install config.h, which is not currently handled by `make install-headers`
+    cp gen/config.h "$out/include/gap"
+
    mkdir -p "$out/bin" "$out/share/gap/"

    mkdir -p "$out/share/gap"
@ -129,6 +181,7 @@ stdenv.mkDerivation rec {
    [
      raskin
      chrisjefferson
+      timokau
    ];
    platforms = platforms.all;
    # keeping all packages increases the package size considerably, wchich
--- a/pkgs/applications/science/math/gmsh/default.nix
+++ b/pkgs/applications/science/math/gmsh/default.nix
@ -1,14 +1,14 @@
 { stdenv, fetchurl, cmake, openblasCompat, gfortran, gmm, fltk, libjpeg
 , zlib, libGLU_combined, libGLU, xorg }:

-let version = "4.0.7"; in
+let version = "4.1.0"; in

 stdenv.mkDerivation {
  name = "gmsh-${version}";

  src = fetchurl {
    url = "http://gmsh.info/src/gmsh-${version}-source.tgz";
-    sha256 = "c6572320d0ffdf7d2488e113861bc4bd9c38a29f7fc5b67957f6fbcb63fbdbd5";
+    sha256 = "0k53k6s4hmciakhrb3ka109vk06ckdbyms5ixizijlfh1dvh7iim";
  };

  buildInputs = [ cmake openblasCompat gmm fltk libjpeg zlib libGLU_combined
--- a/pkgs/applications/science/math/sage/env-locations.nix
+++ b/pkgs/applications/science/math/sage/env-locations.nix
@ -7,7 +7,7 @@
 , graphs
 , elliptic_curves
 , polytopes_db
-, gap-libgap-compatible
+, gap
 , ecl
 , combinatorial_designs
 , jmol
@ -35,7 +35,7 @@ writeTextFile rec {
    export GRAPHS_DATA_DIR='${graphs}/share/graphs'
    export ELLCURVE_DATA_DIR='${elliptic_curves}/share/ellcurves'
    export POLYTOPE_DATA_DIR='${polytopes_db}/share/reflexive_polytopes'
-    export GAP_ROOT_DIR='${gap-libgap-compatible}/share/gap/build-dir'
+    export GAP_ROOT_DIR='${gap}/share/gap/build-dir'
    export ECLDIR='${ecl}/lib/ecl-${ecl.version}/'
    export COMBINATORIAL_DESIGN_DATA_DIR="${combinatorial_designs}/share/combinatorial_designs"
    export CREMONA_MINI_DATA_DIR="${elliptic_curves}/share/cremona"
--- a/pkgs/applications/science/math/sage/patches/dont-test-guess-gaproot.patch
+++ b/pkgs/applications/science/math/sage/patches/dont-test-guess-gaproot.patch
@ -1,13 +0,0 @@
-diff --git a/src/sage/libs/gap/util.pyx b/src/sage/libs/gap/util.pyx
-index 5ff67107c1..1318df86fd 100644
--- a/src/sage/libs/gap/util.pyx
-+++ b/src/sage/libs/gap/util.pyx
-@@ -165,7 +165,7 @@ def _guess_gap_root():
-     EXAMPLES::
- 
-         sage: from sage.libs.gap.util import _guess_gap_root
-        sage: _guess_gap_root()
-+        sage: _guess_gap_root() # not tested (not necessary on nixos)
-         The gap-4.5.5.spkg (or later) seems to be not installed!
-         ...
-     """
--- a/pkgs/applications/science/math/sage/patches/fix-ecl-race.patch
+++ b/pkgs/applications/science/math/sage/patches/fix-ecl-race.patch
@ -0,0 +1,19 @@
+diff --git a/src/sage/doctest/forker.py b/src/sage/doctest/forker.py
+index 02e18e67e7..2ebf6eb35f 100644
+--- a/src/sage/doctest/forker.py
+++ b/src/sage/doctest/forker.py
+@@ -1075,6 +1075,14 @@ class SageDocTestRunner(doctest.DocTestRunner, object):
+             sage: set(ex2.predecessors) == set([ex0,ex1])
+             True
+         """
+
+        # Fix ECL dir race conditions by using a separate dir for each process
+        # (https://trac.sagemath.org/ticket/26968)
+        os.environ['MAXIMA_USERDIR'] = "{}/sage-maxima-{}".format(
+            tempfile.gettempdir(),
+            os.getpid()
+        )
+
+         if isinstance(globs, RecordingDict):
+             globs.start()
+         example.sequence_number = len(self.history)
--- a/pkgs/applications/science/math/sage/sage-env.nix
+++ b/pkgs/applications/science/math/sage/sage-env.nix
@ -14,8 +14,7 @@
 , python3
 , pkg-config
 , pari
-, gap-libgap-compatible
-, libgap
+, gap
 , ecl
 , maxima-ecl
 , singular
@ -70,8 +69,7 @@ let
    binutils.bintools
    pkg-config
    pari
-    gap-libgap-compatible
-    libgap
+    gap
    ecl
    maxima-ecl
    singular
@ -118,7 +116,7 @@ writeTextFile rec {

    # set dependent vars, like JUPYTER_CONFIG_DIR
    source "${sagelib.src}/src/bin/sage-env"
-    export PATH="${runtimepath}:$orig_path" # sage-env messes with PATH
+    export PATH="$RUNTIMEPATH_PREFIX:${runtimepath}:$orig_path" # sage-env messes with PATH

    export SAGE_LOGS="$TMPDIR/sage-logs"
    export SAGE_DOC="''${SAGE_DOC_OVERRIDE:-doc-placeholder}"
@ -133,7 +131,7 @@ writeTextFile rec {
    export LDFLAGS='${
      lib.concatStringsSep " " (map (pkg: "-L${pkg}/lib") [
        flint
-        libgap
+        gap
        glpk
        gmp
        mpfr
@ -153,7 +151,7 @@ writeTextFile rec {
        gmp.dev
        glpk
        flint
-        libgap
+        gap
        pynac
        mpfr.dev
      ])
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -9,14 +9,14 @@
 # all get the same sources with the same patches applied.

 stdenv.mkDerivation rec {
-  version = "8.5";
+  version = "8.6";
  name = "sage-src-${version}";

  src = fetchFromGitHub {
    owner = "sagemath";
    repo = "sage";
    rev = version;
-    sha256 = "08mb9626phsls2phdzqxsnp2df5pn5qr72m0mm4nncby26pwn19c";
+    sha256 = "1vs3pbgbqpg0qnwr018bqsdmm7crgjp310cx8zwh7za3mv1cw5j3";
  };

  # Patches needed because of particularities of nix or the way this is packaged.
@ -47,7 +47,8 @@ stdenv.mkDerivation rec {
    # https://trac.sagemath.org/ticket/26110 for an upstream discussion.
    ./patches/Only-test-py2-py3-optional-tests-when-all-of-sage-is.patch

-    ./patches/dont-test-guess-gaproot.patch
+    # Fixes a potential race condition which can lead to transient doctest failures.
+    ./patches/fix-ecl-race.patch
  ];

  # Patches needed because of package updates. We could just pin the versions of
@ -60,12 +61,13 @@ stdenv.mkDerivation rec {
    # Fetch a diff between `base` and `rev` on sage's git server.
    # Used to fetch trac tickets by setting the `base` to the last release and the
    # `rev` to the last commit of the ticket.
-    fetchSageDiff = { base, rev, ...}@args: (
+    fetchSageDiff = { base, rev, name ? "sage-diff-${base}-${rev}.patch", ...}@args: (
      fetchpatch ({
-        url = "https://git.sagemath.org/sage.git/patch?id2=${base}&id=${rev}";
+        inherit name;
+        url = "https://git.sagemath.org/sage.git/rawdiff?id2=${base}&id=${rev}";
        # We don't care about sage's own build system (which builds all its dependencies).
        # Exclude build system changes to avoid conflicts.
-        excludes = [ "build/*" ];
+        excludes = [ "/build/*" ];
      } // builtins.removeAttrs args [ "rev" "base" ])
    );
  in [
@ -82,21 +84,6 @@ stdenv.mkDerivation rec {
    # https://trac.sagemath.org/ticket/26315
    ./patches/giac-1.5.0.patch

-    # https://trac.sagemath.org/ticket/26326
-    # needs to be split because there is a merge commit in between
-    (fetchSageDiff {
-      name = "networkx-2.2-1.patch";
-      base = "8.4";
-      rev = "68f5ad068184745b38ba6716bf967c8c956c52c5";
-      sha256 = "112b5ywdqgyzgvql2jj5ss8la9i8rgnrzs8vigsfzg4shrcgh9p6";
-    })
-    (fetchSageDiff {
-      name = "networkx-2.2-2.patch";
-      base = "626485bbe5f33bf143d6dfba4de9c242f757f59b~1";
-      rev = "db10d327ade93711da735a599a67580524e6f7b4";
-      sha256 = "09v87id25fa5r9snfn4mv79syhc77jxfawj5aizmdpwdmpgxjk1f";
-    })
-
    # https://trac.sagemath.org/ticket/26442
    (fetchSageDiff {
      name = "cypari2-2.0.3.patch";
--- a/pkgs/applications/science/math/sage/sage-with-env.nix
+++ b/pkgs/applications/science/math/sage/sage-with-env.nix
@ -6,8 +6,7 @@
 , pkg-config
 , three
 , singular
-, libgap
-, gap-libgap-compatible
+, gap
 , giac
 , maxima-ecl
 , pari
@ -35,8 +34,7 @@ let
    three
    pynac
    giac
-    libgap
-    gap-libgap-compatible
+    gap
    pari
    gmp
    gfan
--- a/pkgs/applications/science/math/sage/sagelib.nix
+++ b/pkgs/applications/science/math/sage/sagelib.nix
@ -20,7 +20,7 @@
 , jinja2
 , lcalc
 , lrcalc
-, libgap
+, gap
 , linbox
 , m4ri
 , m4rie
@ -88,7 +88,7 @@ buildPythonPackage rec {
    glpk
    gsl
    lcalc
-    libgap
+    gap
    libmpc
    linbox
    lrcalc
--- a/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-secret/default.nix
@ -1,7 +1,7 @@
 { stdenv, lib, fetchFromGitHub, makeWrapper, git, gnupg, gawk }:

 let
-  version = "0.2.4";
+  version = "0.2.5";
  repo = "git-secret";

 in stdenv.mkDerivation {
@ -11,7 +11,7 @@ in stdenv.mkDerivation {
    inherit repo;
    owner = "sobolevn";
    rev = "v${version}";
-    sha256 = "0lx2rjyhy3xh6ik755lbbl40v7a7ayyqk68jj8mnv42f2vhd66xl";
+    sha256 = "1caxdx1ps662vfa79f7l1bwgwgwf974ahzii0hzaqfnkxy45i520";
  };

  buildInputs = [ makeWrapper ];
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@ -4,7 +4,7 @@

 let
  # if you bump version, update pkgs.tortoisehg too or ping maintainer
-  version = "4.8.1";
+  version = "4.8.2";
  name = "mercurial-${version}";
  inherit (python2Packages) docutils hg-git dulwich python;
 in python2Packages.buildPythonApplication {
@ -13,7 +13,7 @@ in python2Packages.buildPythonApplication {

  src = fetchurl {
    url = "https://mercurial-scm.org/release/${name}.tar.gz";
-    sha256 = "08gsn0s5802bs8ks77xqg7c8dwpbsh8df47kvb1gn14ivrf5z928";
+    sha256 = "1cpx8nf6vcqz92kx6b5c4900pcay8zb89gvy8y33prh5rywjq83c";
  };

  inherit python; # pass it so that the same version can be used in hg2git
--- a/pkgs/data/fonts/agave/default.nix
+++ b/pkgs/data/fonts/agave/default.nix
@ -0,0 +1,28 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  name = "agave-${version}";
+  version = "008";
+
+  src = fetchurl {
+    url = "https://github.com/agarick/agave/releases/download/v${version}/${name}.tar.gz";
+    sha256 = "0g50mqpffn4dq761vibaf8dwfkbcl5da1cc89qz6pq35ircipbns";
+  };
+
+  sourceRoot = ".";
+
+  dontBuild = true;
+  installPhase = ''
+    mkdir -p $out/share/fonts/truetype
+    cp *.ttf $out/share/fonts/truetype
+  '';
+
+  meta = with stdenv.lib; {
+    description = "truetype monospaced typeface designed for X environments";
+    homepage = https://b.agaric.net/page/agave;
+    license = licenses.mit;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
+
--- a/pkgs/data/fonts/ankacoder/condensed.nix
+++ b/pkgs/data/fonts/ankacoder/condensed.nix
@ -0,0 +1,24 @@
+{ stdenv, fetchzip }:
+
+let version = "1.100"; in
+fetchzip rec {
+  name = "ankacoder-condensed-${version}";
+  url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/anka-coder-fonts/AnkaCoderCondensed.${version}.zip";
+
+  postFetch = ''
+    unzip $downloadedFile
+    mkdir -p $out/share/fonts/truetype
+    cp *.ttf $out/share/fonts/truetype
+  '';
+
+  sha256 = "0i80zpr2y9368rg2i6x8jv0g7d03kdyr5h7w9yz7pjd7i9xd8439";
+
+  meta = with stdenv.lib; {
+    description = "Anka/Coder Condensed font";
+    homepage = https://code.google.com/archive/p/anka-coder-fonts;
+    license = licenses.ofl;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
+
--- a/pkgs/data/fonts/ankacoder/default.nix
+++ b/pkgs/data/fonts/ankacoder/default.nix
@ -0,0 +1,24 @@
+{ stdenv, fetchzip }:
+
+let version = "1.100"; in
+fetchzip rec {
+  name = "ankacoder-${version}";
+  url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/anka-coder-fonts/AnkaCoder.${version}.zip";
+
+  postFetch = ''
+    unzip $downloadedFile
+    mkdir -p $out/share/fonts/truetype
+    cp *.ttf $out/share/fonts/truetype
+  '';
+
+  sha256 = "1jqx9micfmiarqh9xp330gl96v3vxbwzz9cmg2vi845n9md4im85";
+
+  meta = with stdenv.lib; {
+    description = "Anka/Coder fonts";
+    homepage = https://code.google.com/archive/p/anka-coder-fonts;
+    license = licenses.ofl;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
+
--- a/pkgs/data/fonts/cherry/default.nix
+++ b/pkgs/data/fonts/cherry/default.nix
@ -0,0 +1,35 @@
+{ stdenv, fetchFromGitHub, bdftopcf }:
+
+stdenv.mkDerivation rec {
+  name = "${pname}-${version}";
+  pname = "cherry";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "turquoise-hexagon";
+    repo = pname;
+    rev = version;
+    sha256 = "1sfajzndv78v8hb156876i2rw3zw8xys6qi8zr4yi0isgsqj5yx5";
+  };
+
+  nativeBuildInputs = [ bdftopcf ];
+
+  buildPhase = ''
+    patchShebangs make.sh
+    ./make.sh
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/fonts/misc
+    cp *.pcf $out/share/fonts/misc
+  '';
+
+  meta = with stdenv.lib; {
+    description = "cherry font";
+    homepage = https://github.com/turquoise-hexagon/cherry;
+    license = licenses.mit;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
+
--- a/pkgs/data/fonts/hermit/default.nix
+++ b/pkgs/data/fonts/hermit/default.nix
@ -0,0 +1,28 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "hermit";
+  version = "2.0";
+
+  src = fetchurl {
+    url = "https://pcaro.es/d/otf-${pname}-${version}.tar.gz";
+    sha256 = "09rmy3sbf1j1hr8zidighjgqc8kp0wsra115y27vrnlf10ml6jy0";
+  };
+
+  sourceRoot = ".";
+
+  dontBuild = true;
+  installPhase = ''
+    mkdir -p $out/share/fonts/opentype
+    cp *.otf $out/share/fonts/opentype/
+  '';
+
+  meta = with stdenv.lib; {
+    description = "monospace font designed to be clear, pragmatic and very readable";
+    homepage = https://pcaro.es/p/hermit;
+    license = licenses.ofl;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
+
--- a/pkgs/data/fonts/luculent/default.nix
+++ b/pkgs/data/fonts/luculent/default.nix
@ -0,0 +1,23 @@
+{ lib, fetchzip }:
+
+let version = "2.0.0"; in
+fetchzip rec {
+  name = "luculent-${version}";
+  url =  http://www.eastfarthing.com/luculent/luculent.tar.xz;
+
+  postFetch = ''
+    tar -xJf $downloadedFile --strip-components=1
+    mkdir -p $out/share/fonts/truetype
+    cp *.ttf $out/share/fonts/truetype
+  '';
+
+  sha256 = "1m3g64galwna1xjxb1fczmfplm6c1fn3ra1ln7f0vkm0ah5m4lbv";
+
+  meta = with lib; {
+    description = "luculent font";
+    homepage = http://www.eastfarthing.com/luculent/;
+    license = licenses.ofl;
+    maintainers = with maintainers; [ dtzWill ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/data/icons/zafiro-icons/default.nix
+++ b/pkgs/data/icons/zafiro-icons/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "zafiro-icons";
-  version = "0.8.1";
+  version = "0.8.3";

  src = fetchFromGitHub {
    owner = "zayronxio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "121fpg74vra8kfvgxi3i7p09qxhck45kv270x6cv5dq1fp2hdm8k";
+    sha256 = "1hflpnliww5fkk7bsgmi8hlrbqvkijjjmbzjqnnl991nqsqxqxpl";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-documents/default.nix
@ -1,4 +1,4 @@
-{ stdenv, meson, ninja, gettext, fetchurl, evince, gjs
+{ stdenv, meson, ninja, gettext, fetchurl, fetchpatch, evince, gjs
 , pkgconfig, gtk3, glib, tracker, tracker-miners
 , itstool, libxslt, webkitgtk, libgdata
 , gnome-desktop, libzapojit, libgepub
@ -31,6 +31,14 @@ stdenv.mkDerivation rec {
    gnome-desktop libzapojit libgepub
  ];

+  patches = [
+    # fix RPATH to libgd
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/gnome-documents/commit/d18a92e0a940073ac766f609937539e4fc6cdbb7.patch";
+      sha256 = "0s3mk8vrl1gzk93yvgqbnz44i27qw1d9yvvmnck3fv23phrxkzk9";
+    })
+  ];
+
  postPatch = ''
    chmod +x meson_post_install.py # patchShebangs requires executable file
    patchShebangs meson_post_install.py
--- a/pkgs/desktops/gnome-3/apps/gnome-sound-recorder/default.nix
+++ b/pkgs/desktops/gnome-3/apps/gnome-sound-recorder/default.nix
@ -1,16 +1,22 @@
-{ stdenv, fetchurl, pkgconfig, intltool, gobject-introspection, wrapGAppsHook, gjs, glib, gtk3, gdk_pixbuf, gst_all_1, gnome3 }:
+{ stdenv, fetchurl, fetchpatch, pkgconfig, intltool, gobject-introspection, wrapGAppsHook, gjs, glib, gtk3, gdk_pixbuf, gst_all_1, gnome3 }:

-let
+stdenv.mkDerivation rec {
  pname = "gnome-sound-recorder";
-  version = "3.28.1";
-in stdenv.mkDerivation rec {
-  name = "${pname}-${version}";
+  version = "3.28.2";

  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0y0srj1hvr1waa35p6dj1r1mlgcsscc0i99jni50ijp4zb36fjqy";
+    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "1k63xr3d16qbzi88md913ndaf2mzwmhmi6hipj0123sm7nsz1p94";
  };

+  patches = [
+    # Fix crash when trying to play recordings
+    (fetchpatch {
+      url = https://gitlab.gnome.org/GNOME/gnome-sound-recorder/commit/2b311ef67909bc20d0e87f334fe37bf5c4e9f29f.patch;
+      sha256 = "0hqmk846bxma0p66cqp94zd02zc1if836ywjq3sv5dsfwnz7jv3f";
+    })
+  ];
+
  nativeBuildInputs = [ pkgconfig intltool gobject-introspection wrapGAppsHook ];
  buildInputs = [ gjs glib gtk3 gdk_pixbuf ] ++ (with gst_all_1; [ gstreamer.dev gstreamer gst-plugins-base gst-plugins-good gst-plugins-bad ]);

--- a/pkgs/desktops/gnome-3/core/eog/default.nix
+++ b/pkgs/desktops/gnome-3/core/eog/default.nix
@ -25,6 +25,15 @@ in stdenv.mkDerivation rec {
    patchShebangs meson_post_install.py
  '';

+  preFixup = ''
+    gappsWrapperArgs+=(
+      # Thumbnailers
+      --prefix XDG_DATA_DIRS : "${gdk_pixbuf}/share"
+      --prefix XDG_DATA_DIRS : "${librsvg}/share"
+      --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
+    )
+  '';
+
  passthru = {
    updateScript = gnome3.updateScript {
      packageName = pname;
--- a/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
+++ b/pkgs/desktops/gnome-3/core/evolution-data-server/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  name = "evolution-data-server-${version}";
-  version = "3.30.3";
+  version = "3.30.4";

  outputs = [ "out" "dev" ];

  src = fetchurl {
    url = "mirror://gnome/sources/evolution-data-server/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "1q1wpsc3p6b1cacwgkgqbni7rdx3skvb2fm6fyjs2wjgq6zi5753";
+    sha256 = "1j8lwl04zz59sg7k3hpkzp829z8xyd1isz8xavm9vzxfvw5w776y";
  };

  patches = [
--- a/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-settings-daemon/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  name = "gnome-settings-daemon-${version}";
-  version = "3.30.1.2";
+  version = "3.30.2";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-settings-daemon/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "079dh609rvpwfyzg4m898q8km9g7x04hg18rwwb1izj1dr7zdp2w";
+    sha256 = "0c663csa3gnsr6wm0xfll6aani45snkdj7zjwjfzcwfh8w4a3z12";
  };

  patches = [
--- a/pkgs/desktops/gnome-3/default.nix
+++ b/pkgs/desktops/gnome-3/default.nix
@ -3,6 +3,22 @@
 lib.makeScope pkgs.newScope (self: with self; {
  updateScript = callPackage ./update.nix { };

+  /* Remove packages of packagesToRemove from packages, based on their names
+
+     Type:
+       removePackagesByName :: [package] -> [package] -> [package]
+
+     Example:
+       removePackagesByName [ nautilus file-roller ] [ file-roller totem ]
+       => [ nautilus ]
+  */
+  removePackagesByName = packages: packagesToRemove:
+    let
+      pkgName = drv: (builtins.parseDrvName drv.name).name;
+      namesToRemove = map pkgName packagesToRemove;
+    in
+      lib.filter (x: !(builtins.elem (pkgName x) namesToRemove)) packages;
+
  maintainers = with pkgs.lib.maintainers; [ lethalman jtojnar hedning ];

  corePackages = with gnome3; [
--- a/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
+++ b/pkgs/desktops/plasma-5/xdg-desktop-portal-kde.nix
@ -1,13 +1,15 @@
 {
  mkDerivation,
  extra-cmake-modules, gettext, kdoctools, python,
-  kcoreaddons, knotifications, kwayland, kwidgetsaddons
+  kcoreaddons, knotifications, kwayland, kwidgetsaddons,
+  cups, pcre, pipewire
 }:

 mkDerivation {
  name = "xdg-desktop-portal-kde";
  nativeBuildInputs = [ extra-cmake-modules gettext kdoctools python ];
  buildInputs = [
+    cups pcre pipewire
    kcoreaddons knotifications kwayland kwidgetsaddons
  ];
 }
--- a/pkgs/development/compilers/fasm/bin.nix
+++ b/pkgs/development/compilers/fasm/bin.nix
@ -3,11 +3,11 @@
 stdenvNoCC.mkDerivation rec {
  name = "fasm-bin-${version}";

-  version = "1.73.05";
+  version = "1.73.06";

  src = fetchurl {
    url = "https://flatassembler.net/fasm-${version}.tgz";
-    sha256 = "0qpj6cs9rp1bg2rqxg1k8j71918rh86hplyw4n82n11ndwk23ni5";
+    sha256 = "02wqkqxpn3p0iwcagsm92qd9cdfcnbx8a09qg03b3pjppp30hmp6";
  };

  installPhase = ''
--- a/pkgs/development/coq-modules/QuickChick/default.nix
+++ b/pkgs/development/coq-modules/QuickChick/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, coq, ssreflect }:
+{ stdenv, fetchFromGitHub, coq, ssreflect, coq-ext-lib, simple-io }:

 let params =
  {
@ -19,6 +19,14 @@ let params =
      rev = "195e550a1cf0810497734356437a1720ebb6d744";
      sha256 = "0zm23y89z0h4iamy74qk9qi2pz2cj3ga6ygav0w79n0qyqwhxcq1";
    };
+    "8.8" = rec {
+      preConfigure = "substituteInPlace Makefile --replace quickChickTool.byte quickChickTool.native";
+      version = "1.0.2";
+      rev = "v${version}";
+      sha256 = "1mcbsp07ra3gdcmir36pf27ig3xv8nagyfp7w5pwqi4gj9w81ffn";
+      buildInputs = with coq.ocamlPackages; [ ocamlbuild num ];
+      propagatedBuildInputs = [ coq-ext-lib simple-io ];
+    };
  };
  param = params."${coq.coq-version}";
 in
@ -33,11 +41,16 @@ stdenv.mkDerivation rec {
    inherit (param) rev sha256;
  };

-  buildInputs = with coq.ocamlPackages; [ ocaml camlp5 findlib ];
-  propagatedBuildInputs = [ coq ssreflect ];
+  buildInputs = [ coq ]
+  ++ (with coq.ocamlPackages; [ ocaml camlp5 findlib ])
+  ++ (param.buildInputs or [])
+  ;
+  propagatedBuildInputs = [ ssreflect ] ++ (param.propagatedBuildInputs or []);

  enableParallelBuilding = false;

+  preConfigure = param.preConfigure or null;
+
  installPhase = ''
    make -f Makefile.coq COQLIB=$out/lib/coq/${coq.coq-version}/ install
  '';
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@ -39,7 +39,7 @@ core-packages:

  # Hack: The following package is a core package of GHCJS. If we don't declare
  # it, then hackage2nix will generate a Hackage database where all dependants
-  # of this library are maked as "broken".
+  # of this library are marked as "broken".
  - ghcjs-base-0

 default-package-overrides:
--- a/pkgs/development/interpreters/erlang/R21.nix
+++ b/pkgs/development/interpreters/erlang/R21.nix
@ -1,8 +1,8 @@
 { mkDerivation }:

 mkDerivation rec {
-  version = "21.2";
-  sha256 = "0v9smdp2vxkpsz65a6ypwzl12fqdfrsi7k29f5i7af0v27r308cm";
+  version = "21.2.3";
+  sha256 = "1v47c7bddbp31y6f8yzdjyvgcx9sskxql33k7cs0p5fmr05hhxws";

  prePatch = ''
    substituteInPlace configure.in --replace '`sw_vers -productVersion`' '10.10'
--- a/pkgs/development/interpreters/racket/default.nix
+++ b/pkgs/development/interpreters/racket/default.nix
@ -10,6 +10,7 @@
 , disableDocs ? false
 , CoreFoundation
 , gsettings-desktop-schemas
+, wrapGAppsHook
 }:

 let
@ -59,7 +60,9 @@ stdenv.mkDerivation rec {
    (stdenv.lib.optionalString stdenv.isDarwin "-framework CoreFoundation")
  ];

-  buildInputs = [ fontconfig libffi libtool makeWrapper sqlite gsettings-desktop-schemas gtk3 ]
+  nativeBuildInputs = [ wrapGAppsHook ];
+
+  buildInputs = [ fontconfig libffi libtool sqlite gsettings-desktop-schemas gtk3 ]
    ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv CoreFoundation ];

  preConfigure = ''
@ -69,6 +72,8 @@ stdenv.mkDerivation rec {
    done
    mkdir src/build
    cd src/build
+
+    gappsWrapperArgs+=("--prefix" "LD_LIBRARY_PATH" ":" $LD_LIBRARY_PATH)
  '';

  shared = if stdenv.isDarwin then "dylib" else "shared";
@ -80,13 +85,6 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = false;

-  postInstall = ''
-    for p in $(ls $out/bin/) ; do
-      wrapProgram $out/bin/$p \
-        --prefix LD_LIBRARY_PATH ":" "${LD_LIBRARY_PATH}" \
-        --prefix XDG_DATA_DIRS ":" "$GSETTINGS_SCHEMAS_PATH";
-    done
-  '';

  meta = with stdenv.lib; {
    description = "A programmable programming language";
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, cmake, openblasCompat, superlu, hdf5 }:

 stdenv.mkDerivation rec {
-  version = "9.200.6";
+  version = "9.200.7";
  name = "armadillo-${version}";

  src = fetchurl {
    url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "1gm8dysb29f3p96bzjgdb5r70dc6y5jq1avg18sdixz0hgnxqq14";
+    sha256 = "1y3xrchykwddlrnzgf7xjdmbkf6c4gayz92vyrqdyvnlpi07sy72";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/box2d/default.nix
+++ b/pkgs/development/libraries/box2d/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  name = "box2d-${version}";
-  version = "2.3.0";
+  version = "2.3.1";

  src = fetchurl {
    url = "https://github.com/erincatto/Box2D/archive/v${version}.tar.gz";
-    sha256 = "1dmbswh4x2n5l3c9h0k72m0z4rdpzfy1xl8m8p3rf5rwkvk3bkg2";
+    sha256 = "0llpcifl8zbjbpxdwz87drd01m3lwnv82xb4av6kca1xn4w2gmkm";
  };

  sourceRoot = "Box2D-${version}/Box2D";
--- a/pkgs/development/libraries/capstone/default.nix
+++ b/pkgs/development/libraries/capstone/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name    = "capstone-${version}";
-  version = "4.0";
+  version = "4.0.1";

  src = fetchurl {
    url    = "https://github.com/aquynh/capstone/archive/${version}.tar.gz";
-    sha256 = "0yp6y5m3v674i2pq6s804ikvz43gzgsjwq1maqhmj3b730b4dii6";
+    sha256 = "1isxw2qwy1fi3m3w7igsr5klzczxc5cxndz0a78dfss6ps6ymfvr";
  };

  configurePhase = '' patchShebangs make.sh '';
--- a/pkgs/development/libraries/gtkd/default.nix
+++ b/pkgs/development/libraries/gtkd/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  name = "gtkd-${version}";
-  version = "3.8.4";
+  version = "3.8.5";

  src = fetchzip {
    url = "https://gtkd.org/Downloads/sources/GtkD-${version}.zip";
-    sha256 = "0q2kf1jwr89i8ajjzyf3b4bbla33djvnwrvljq17y206q7qknfyz";
+    sha256 = "12n2njsaplra7x15nqwrj2hrf8a27pfjj2mck4mkzxv03qk6mqky";
    stripRoot = false;
  };

--- a/pkgs/development/libraries/liburcu/default.nix
+++ b/pkgs/development/libraries/liburcu/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, perl }:

 stdenv.mkDerivation rec {
-  version = "0.10.1";
+  version = "0.10.2";
  name = "liburcu-${version}";

  src = fetchurl {
    url = "https://lttng.org/files/urcu/userspace-rcu-${version}.tar.bz2";
-    sha256 = "01pbg67qy5hcssy2yi0ckqapzfclgdq93li2rmzw4pa3wh5j42cw";
+    sha256 = "1k31faqz9plx5dwxq8g1fnczxda1is4s1x4ph0gjrq3gmy6qixmk";
  };

  checkInputs = [ perl ];
--- a/pkgs/development/libraries/netcdf-fortran/default.nix
+++ b/pkgs/development/libraries/netcdf-fortran/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, netcdf, hdf5, curl, gfortran }:
 stdenv.mkDerivation rec {
  name = "netcdf-fortran-${version}";
-  version = "4.4.4";
+  version = "4.4.5";

  src = fetchurl {
    url = "https://github.com/Unidata/netcdf-fortran/archive/v${version}.tar.gz";
-    sha256 = "0rwybszj1jjb25cx8vfyrd77x5qsdjzwspcjz56n12br89n9ica4";
+    sha256 = "00qwg4v250yg8kxp68srrnvfbfim241fnlm071p9ila2mihk8r01";
  };

  buildInputs = [ netcdf hdf5 curl gfortran ];
--- a/pkgs/development/libraries/pyotherside/default.nix
+++ b/pkgs/development/libraries/pyotherside/default.nix
@ -0,0 +1,29 @@
+{ stdenv, fetchFromGitHub
+, python3, qmake, qtbase, qtquickcontrols, qtsvg, ncurses }:
+
+stdenv.mkDerivation rec {
+  pname = "pyotherside";
+  version = "1.5.3";
+
+  src = fetchFromGitHub {
+    owner = "thp";
+    repo = "pyotherside";
+    rev = version;
+    sha256 = "1xaw1aarj8gpgpm4z3lk8klbssadrsf3xdyzqx10zcwy16amka7k";
+  };
+
+  nativeBuildInputs = [ qmake ];
+  buildInputs = [
+    python3 qtbase qtquickcontrols qtsvg ncurses
+  ];
+
+  patches = [ ./qml-path.patch ];
+  installTargets = [ "sub-src-install_subtargets" ];
+
+  meta = with stdenv.lib; {
+    description = "Asynchronous Python 3 Bindings for Qt 5";
+    homepage = https://thp.io/2011/pyotherside/;
+    license = licenses.isc;
+    maintainers = [ maintainers.mic92 ];
+  };
+}
--- a/pkgs/development/libraries/pyotherside/qml-path.patch
+++ b/pkgs/development/libraries/pyotherside/qml-path.patch
@ -0,0 +1,12 @@
+diff -Naur --strip-trailing-cr source.org/src/src.pro source/src/src.pro
+--- source.org/src/src.pro	1970-01-01 01:00:01.000000000 +0100
+++ source/src/src.pro	2019-01-17 19:14:46.256821852 +0000
+@@ -10,7 +10,7 @@
+ CONFIG += qt plugin
+ QT += qml quick svg
+ 
+-target.path = $$[QT_INSTALL_QML]/$$PLUGIN_IMPORT_PATH
+target.path = $$NIX_OUTPUT_QML/$$PLUGIN_IMPORT_PATH
+ INSTALLS += target
+ 
+ qmldir.files += $$_PRO_FILE_PWD_/qmldir $$_PRO_FILE_PWD_/pyotherside.qmltypes
--- a/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtdeclarative.nix
@ -1,10 +1,10 @@
-{ qtModule, lib, python2, qtbase, qtsvg, qtxmlpatterns }:
+{ qtModule, lib, python2, qtbase, qtsvg }:

 with lib;

 qtModule {
  name = "qtdeclarative";
-  qtInputs = [ qtbase qtsvg qtxmlpatterns ];
+  qtInputs = [ qtbase qtsvg ];
  nativeBuildInputs = [ python2 ];
  outputs = [ "out" "dev" "bin" ];
  preConfigure = ''
--- a/pkgs/development/libraries/qt-5/modules/qtxmlpatterns.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtxmlpatterns.nix
@ -1,7 +1,7 @@
-{ qtModule, qtbase }:
+{ qtModule, qtbase, qtdeclarative }:

 qtModule {
  name = "qtxmlpatterns";
-  qtInputs = [ qtbase ];
+  qtInputs = [ qtbase qtdeclarative ];
  devTools = [ "bin/xmlpatterns" "bin/xmlpatternsvalidator" ];
 }
--- a/pkgs/development/libraries/readline/8.0.nix
+++ b/pkgs/development/libraries/readline/8.0.nix
@ -0,0 +1,66 @@
+{ fetchurl, stdenv, ncurses
+}:
+
+stdenv.mkDerivation rec {
+  name = "readline-${version}";
+  version = "8.0p${toString (builtins.length upstreamPatches)}";
+
+  src = fetchurl {
+    url = "mirror://gnu/readline/readline-${meta.branch}.tar.gz";
+    sha256 = "0qg4924hf4hg0r0wbx2chswsr08734536fh5iagkd3a7f4czafg3";
+  };
+
+  outputs = [ "out" "dev" "man" "doc" "info" ];
+
+  propagatedBuildInputs = [ncurses];
+
+  patchFlags = "-p0";
+
+  upstreamPatches =
+    (let
+       patch = nr: sha256:
+         fetchurl {
+           url = "mirror://gnu/readline/readline-${meta.branch}-patches/readline80-${nr}";
+           inherit sha256;
+         };
+     in
+       import ./readline-8.0-patches.nix patch);
+
+  patches =
+    [ ./link-against-ncurses.patch
+      ./no-arch_only-6.3.patch
+    ]
+    ++ upstreamPatches;
+
+  # Don't run the native `strip' when cross-compiling.
+  dontStrip = stdenv.hostPlatform != stdenv.buildPlatform;
+  bash_cv_func_sigsetjmp = if stdenv.isCygwin then "missing" else null;
+
+  meta = with stdenv.lib; {
+    description = "Library for interactive line editing";
+
+    longDescription = ''
+      The GNU Readline library provides a set of functions for use by
+      applications that allow users to edit command lines as they are
+      typed in.  Both Emacs and vi editing modes are available.  The
+      Readline library includes additional functions to maintain a
+      list of previously-entered command lines, to recall and perhaps
+      reedit those lines, and perform csh-like history expansion on
+      previous commands.
+
+      The history facilities are also placed into a separate library,
+      the History library, as part of the build process.  The History
+      library may be used without Readline in applications which
+      desire its capabilities.
+    '';
+
+    homepage = https://savannah.gnu.org/projects/readline/;
+
+    license = licenses.gpl3Plus;
+
+    maintainers = with maintainers; [ vanschelven dtzWill ];
+
+    platforms = platforms.unix;
+    branch = "8.0";
+  };
+}
--- a/pkgs/development/libraries/readline/readline-8.0-patches.nix
+++ b/pkgs/development/libraries/readline/readline-8.0-patches.nix
@ -0,0 +1,4 @@
+# Automatically generated by `update-patch-set.sh'; do not edit.
+
+patch: [
+]
--- a/pkgs/development/perl-modules/generic/default.nix
+++ b/pkgs/development/perl-modules/generic/default.nix
@ -28,6 +28,7 @@ stdenv.mkDerivation (
    PERL_USE_UNSAFE_INC = "1";

    meta.homepage = "https://metacpan.org/release/${(builtins.parseDrvName name).name}";
+    meta.platforms = perl.meta.platforms;
  }
  attrs
  )
--- a/pkgs/development/python-modules/aniso8601/default.nix
+++ b/pkgs/development/python-modules/aniso8601/default.nix
@ -1,9 +1,9 @@
 { stdenv, buildPythonPackage, fetchPypi
-, dateutil }:
+, dateutil, mock, isPy3k }:

 buildPythonPackage rec {
  pname = "aniso8601";
-  version = "4.0.1";
+  version = "4.1.0";

  meta = with stdenv.lib; {
    description = "Parses ISO 8601 strings.";
@ -13,8 +13,10 @@ buildPythonPackage rec {

  propagatedBuildInputs = [ dateutil ];

+  checkInputs = stdenv.lib.optional (!isPy3k) mock;
+
  src = fetchPypi {
    inherit pname version;
-    sha256 = "15cwnadw2xdczdi13k9grrgqq67hxgys4l155dqsl2zh3glhsmp7";
+    sha256 = "1x49k287ky1spv3msc9fwmc7ydyw6rlcr14nslgcmpjfn3pgzh03";
  };
 }
--- a/pkgs/development/python-modules/base58/default.nix
+++ b/pkgs/development/python-modules/base58/default.nix
@ -1,17 +1,15 @@
-{ stdenv, fetchFromGitHub, buildPythonPackage, pytest, pyhamcrest }:
+{ stdenv, fetchPypi, buildPythonPackage, pytest, pyhamcrest }:

 buildPythonPackage rec {
  pname = "base58";
-  version = "1.0.0";
+  version = "1.0.3";

-  src = fetchFromGitHub {
-    owner = "keis";
-    repo = "base58";
-    rev = "v${version}";
-    sha256 = "0f8isdpvbgw0sqn9bj7hk47y8akpvdl8sn6rkszla0xb92ywj0f6";
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "9a793c599979c497800eb414c852b80866f28daaed5494703fc129592cc83e60";
  };

-  buildInputs = [ pytest pyhamcrest ];
+  checkInputs = [ pytest pyhamcrest ];
  checkPhase = ''
    pytest
  '';
--- a/pkgs/development/python-modules/beancount/default.nix
+++ b/pkgs/development/python-modules/beancount/default.nix
@ -4,14 +4,14 @@
 , pytest, requests }:

 buildPythonPackage rec {
-  version = "2.1.3";
+  version = "2.2.0";
  pname = "beancount";

  disabled = !isPy3k;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "4b7b0d3633c82ca88d3cb3d31ad2fd2e45a42401cfa94eaa1cb938ffece34f22";
+    sha256 = "1j3fyyqnr5gq71rmkb9q3im8pqppa134zzhmmp4hk4b274g18w31";
  };

  # No tests in archive
--- a/pkgs/development/python-modules/cfgv/default.nix
+++ b/pkgs/development/python-modules/cfgv/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "cfgv";
-  version = "1.1.0";
+  version = "1.4.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1akm5xdbi5kckgnhhfj6qavjwakm44cwqzhfx2ycgh7mkym1qyfi";
+    sha256 = "01mpw8kx0f2py2jwf0fv60k01p11gs0dbar5zq42k4z38xf0bn9r";
  };

  propagatedBuildInputs = [ six ];
--- a/pkgs/development/python-modules/cmd2/default.nix
+++ b/pkgs/development/python-modules/cmd2/default.nix
@ -1,5 +1,5 @@
 { stdenv, fetchPypi, buildPythonPackage, pythonOlder, isPy3k
-, pyperclip, six, pyparsing, vim, wcwidth, colorama
+, pyperclip, six, pyparsing, vim, wcwidth, colorama, attrs
 , contextlib2 ? null, typing ? null, setuptools_scm
 , pytest, mock ? null, pytest-mock
 , which, glibcLocales
@ -36,6 +36,7 @@ buildPythonPackage rec {
    six
    pyparsing
    wcwidth
+    attrs
  ]
  ++ stdenv.lib.optionals (pythonOlder "3.5") [contextlib2 typing]
  ;
--- a/pkgs/development/python-modules/configargparse/default.nix
+++ b/pkgs/development/python-modules/configargparse/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "ConfigArgParse";
-  version = "0.13.0";
+  version = "0.14.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "e6441aa58e23d3d122055808e5e2220fd742dff6e1e51082d2a4e4ed145dd788";
+    sha256 = "149fy4zya0rsnlkvxbbq43cyr8lscb5k4pj1m6n7f1grwcmzwbif";
  };

  # no tests in tarball
--- a/pkgs/development/python-modules/irc/default.nix
+++ b/pkgs/development/python-modules/irc/default.nix
@ -1,4 +1,4 @@
-{ buildPythonPackage, fetchPypi
+{ buildPythonPackage, fetchPypi, isPy3k
 , six, jaraco_logging, jaraco_text, jaraco_stream, pytz, jaraco_itertools
 , setuptools_scm }:

@ -6,6 +6,8 @@ buildPythonPackage rec {
  pname = "irc";
  version = "17.0";

+  disabled = !isPy3k;
+
  src = fetchPypi {
    inherit pname version;
    sha256 = "f9c5fcb72dd230e1387fd4a0114a1935605e0f59ac09dec962313baed74e1365";
--- a/pkgs/development/python-modules/jaraco_classes/default.nix
+++ b/pkgs/development/python-modules/jaraco_classes/default.nix
@ -2,10 +2,10 @@

 buildPythonPackage rec {
  pname = "jaraco.classes";
-  version = "1.5";
+  version = "2.0";
  src = fetchPypi {
    inherit pname version;
-    sha256 = "002zsifikv6qwigkjlij7jhyvbwv6793m8h9ckbkx2jizmgc80fi";
+    sha256 = "1xfal9085bjh4fv57d6v9ibr5wf4llj73gp1ybdlqd2bralc9hnw";
  };
  doCheck = false;
  buildInputs = [ setuptools_scm ];
--- a/pkgs/development/python-modules/jaraco_itertools/default.nix
+++ b/pkgs/development/python-modules/jaraco_itertools/default.nix
@ -1,14 +1,26 @@
-{ buildPythonPackage, fetchPypi, setuptools_scm
-, inflect, more-itertools, six }:
+{ lib, buildPythonPackage, fetchPypi, setuptools_scm
+, inflect, more-itertools, six, pytest, pytest-flake8 }:

 buildPythonPackage rec {
  pname = "jaraco.itertools";
-  version = "3.0.0";
+  version = "4.0.0";
+
  src = fetchPypi {
    inherit pname version;
-    sha256 = "19d8557a25c08f7a7b8f1cfa456ebfd615bafa0f045f89bbda55f99661b0626d";
+    sha256 = "1d09zpi593bhr56rwm41kzffr18wif98plgy6xdy0zrbdwfarrxl";
  };
-  doCheck = false;
+
  buildInputs = [ setuptools_scm ];
  propagatedBuildInputs = [ inflect more-itertools six ];
+  checkInputs = [ pytest pytest-flake8 ];
+
+  checkPhase = ''
+    pytest
+  '';
+
+  meta = with lib; {
+    description = "Tools for working with iterables";
+    homepage = https://github.com/jaraco/jaraco.itertools;
+    license = licenses.mit;
+  };
 }
--- a/Show More
+++ b/Show More