Merge remote-tracking branch 'upstream/master' into openssl-1.1

2019-08-23 02:00:31 +02:00 · 2019-08-23 02:00:31 +02:00 · c7e75df21f
parent 0f4256a2f8 1e2497720f
commit c7e75df21f
126 changed files with 3903 additions and 707 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -40,6 +40,12 @@
  See `./scripts/check-maintainer-github-handles.sh` for an example on how to work with this data.
  */
 {
+  "00-matt" = {
+    name = "Matt Smith";
+    email = "matt@offtopica.uk";
+    github = "00-matt";
+    githubId = 48835712;
+  };
  "0x4A6F" = {
    email = "0x4A6F@shackspace.de";
    name = "Joachim Ernst";
@ -2743,6 +2749,11 @@
    githubId = 26877687;
    name = "Yurii Izorkin";
  };
+  jasoncarr = {
+    email = "jcarr250@gmail.com";
+    github = "jasoncarr0";
+    name = "Jason Carr";
+  };
  j-keck = {
    email = "jhyphenkeck@gmail.com";
    github = "j-keck";
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@ -1,4 +1,5 @@
 # nix name, luarocks name, server, version,luaversion,maintainers
+alt-getopt,,,,,arobyn
 ansicolors,,,,,
 argparse,,,,,
 basexx,,,,,
@ -56,6 +57,7 @@ luv,,,,,
 markdown,,,,,
 mediator_lua,,,,,
 mpack,,,,,
+moonscript,,,,,arobyn
 nvim-client,,,,,
 penlight,,,,,
 rapidjson,,,,,
--- a/nixos/modules/config/fonts/fontconfig-penultimate.nix
+++ b/nixos/modules/config/fonts/fontconfig-penultimate.nix
@ -52,85 +52,11 @@ let
      </fontconfig>
    '';

+  # local configuration file
  localConf = pkgs.writeText "fc-local.conf" cfg.localConf;

-  # The configuration to be included in /etc/font/
-  penultimateConf = pkgs.runCommand "font-penultimate-conf" {
-    preferLocalBuild = true;
-    } ''
-    support_folder=$out/etc/fonts/conf.d
-    latest_folder=$out/etc/fonts/${latestVersion}/conf.d
-
-    mkdir -p $support_folder
-    mkdir -p $latest_folder
-
-    ln -s ${supportFontsConf} $support_folder/../fonts.conf
-    ln -s ${latestPkg.out}/etc/fonts/fonts.conf \
-          $latest_folder/../fonts.conf
-
-    # fontconfig-penultimate various configuration files
-    ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
-          $support_folder
-    ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
-          $latest_folder
-
-    ln -s ${cacheConfSupport} $support_folder/00-nixos-cache.conf
-    ln -s ${cacheConfLatest}  $latest_folder/00-nixos-cache.conf
-
-    rm $support_folder/10-antialias.conf $latest_folder/10-antialias.conf
-    ln -s ${antialiasConf} $support_folder/10-antialias.conf
-    ln -s ${antialiasConf} $latest_folder/10-antialias.conf
-
-    rm $support_folder/10-hinting.conf $latest_folder/10-hinting.conf
-    ln -s ${hintingConf} $support_folder/10-hinting.conf
-    ln -s ${hintingConf} $latest_folder/10-hinting.conf
-
-    ${optionalString cfg.useEmbeddedBitmaps ''
-    rm $support_folder/10-no-embedded-bitmaps.conf
-    rm $latest_folder/10-no-embedded-bitmaps.conf
-    ''}
-
-    rm $support_folder/10-subpixel.conf $latest_folder/10-subpixel.conf
-    ln -s ${subpixelConf} $support_folder/10-subpixel.conf
-    ln -s ${subpixelConf} $latest_folder/10-subpixel.conf
-
-    ${optionalString (cfg.dpi != 0) ''
-    ln -s ${dpiConf} $support_folder/11-dpi.conf
-    ln -s ${dpiConf} $latest_folder/11-dpi.conf
-    ''}
-
-    ${optionalString (!cfg.includeUserConf) ''
-    rm $support_folder/50-user.conf
-    rm $latest_folder/50-user.conf
-    ''}
-
-    # 51-local.conf
-    rm $latest_folder/51-local.conf
-    substitute \
-      ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/51-local.conf \
-      $latest_folder/51-local.conf \
-      --replace local.conf /etc/fonts/${latestVersion}/local.conf
-
-    # local.conf (indirect priority 51)
-    ${optionalString (cfg.localConf != "") ''
-    ln -s ${localConf}        $out/etc/fonts/local.conf
-    ln -s ${localConf}        $out/etc/fonts/${latestVersion}/local.conf
-    ''}
-
-    ln -s ${defaultFontsConf} $support_folder/52-default-fonts.conf
-    ln -s ${defaultFontsConf} $latest_folder/52-default-fonts.conf
-
-    ${optionalString cfg.allowBitmaps ''
-    rm $support_folder/53-no-bitmaps.conf
-    rm $latest_folder/53-no-bitmaps.conf
-    ''}
-
-    ${optionalString (!cfg.allowType1) ''
-    ln -s ${rejectType1} $support_folder/53-no-type1.conf
-    ln -s ${rejectType1} $latest_folder/53-no-type1.conf
-    ''}
-  '';
-
+  # rendering settings configuration files
+  # priority 10
  hintingConf = pkgs.writeText "fc-10-hinting.conf" ''
    <?xml version='1.0'?>
    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
@ -199,6 +125,8 @@ let
    </fontconfig>
  '';

+  # default fonts configuration file
+  # priority 52
  defaultFontsConf =
    let genDefault = fonts: name:
      optionalString (fonts != []) ''
@ -228,7 +156,9 @@ let
    </fontconfig>
  '';

-  rejectType1 = pkgs.writeText "fc-53-no-type1.conf" ''
+  # reject Type 1 fonts
+  # priority 53
+  rejectType1 = pkgs.writeText "fc-53-nixos-reject-type1.conf" ''
    <?xml version="1.0"?>
    <!DOCTYPE fontconfig SYSTEM "fonts.dtd">
    <fontconfig>
@ -245,6 +175,88 @@ let
    </fontconfig>
  '';

+  # The configuration to be included in /etc/font/
+  penultimateConf = pkgs.runCommand "fontconfig-penultimate-conf" {
+    preferLocalBuild = true;
+  } ''
+    support_folder=$out/etc/fonts/conf.d
+    latest_folder=$out/etc/fonts/${latestVersion}/conf.d
+
+    mkdir -p $support_folder
+    mkdir -p $latest_folder
+
+    # fonts.conf
+    ln -s ${supportFontsConf} $support_folder/../fonts.conf
+    ln -s ${latestPkg.out}/etc/fonts/fonts.conf \
+          $latest_folder/../fonts.conf
+
+    # fontconfig-penultimate various configuration files
+    ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
+          $support_folder
+    ln -s ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/*.conf \
+          $latest_folder
+
+    ln -s ${cacheConfSupport} $support_folder/00-nixos-cache.conf
+    ln -s ${cacheConfLatest}  $latest_folder/00-nixos-cache.conf
+
+    rm $support_folder/10-antialias.conf $latest_folder/10-antialias.conf
+    ln -s ${antialiasConf} $support_folder/10-antialias.conf
+    ln -s ${antialiasConf} $latest_folder/10-antialias.conf
+
+    rm $support_folder/10-hinting.conf $latest_folder/10-hinting.conf
+    ln -s ${hintingConf} $support_folder/10-hinting.conf
+    ln -s ${hintingConf} $latest_folder/10-hinting.conf
+
+    ${optionalString cfg.useEmbeddedBitmaps ''
+    rm $support_folder/10-no-embedded-bitmaps.conf
+    rm $latest_folder/10-no-embedded-bitmaps.conf
+    ''}
+
+    rm $support_folder/10-subpixel.conf $latest_folder/10-subpixel.conf
+    ln -s ${subpixelConf} $support_folder/10-subpixel.conf
+    ln -s ${subpixelConf} $latest_folder/10-subpixel.conf
+
+    ${optionalString (cfg.dpi != 0) ''
+    ln -s ${dpiConf} $support_folder/11-dpi.conf
+    ln -s ${dpiConf} $latest_folder/11-dpi.conf
+    ''}
+
+    # 50-user.conf
+    ${optionalString (!cfg.includeUserConf) ''
+    rm $support_folder/50-user.conf
+    rm $latest_folder/50-user.conf
+    ''}
+
+    # 51-local.conf
+    rm $latest_folder/51-local.conf
+    substitute \
+      ${pkgs.fontconfig-penultimate}/etc/fonts/conf.d/51-local.conf \
+      $latest_folder/51-local.conf \
+      --replace local.conf /etc/fonts/${latestVersion}/local.conf
+
+    # local.conf (indirect priority 51)
+    ${optionalString (cfg.localConf != "") ''
+    ln -s ${localConf}        $support_folder/../local.conf
+    ln -s ${localConf}        $latest_folder/../local.conf
+    ''}
+
+    # 52-nixos-default-fonts.conf
+    ln -s ${defaultFontsConf} $support_folder/52-nixos-default-fonts.conf
+    ln -s ${defaultFontsConf} $latest_folder/52-nixos-default-fonts.conf
+
+    # 53-no-bitmaps.conf
+    ${optionalString cfg.allowBitmaps ''
+    rm $support_folder/53-no-bitmaps.conf
+    rm $latest_folder/53-no-bitmaps.conf
+    ''}
+
+    ${optionalString (!cfg.allowType1) ''
+    # 53-nixos-reject-type1.conf
+    ln -s ${rejectType1} $support_folder/53-nixos-reject-type1.conf
+    ln -s ${rejectType1} $latest_folder/53-nixos-reject-type1.conf
+    ''}
+  '';
+
 in
 {

--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@ -14,250 +14,252 @@ Low number means high priority.

 */

-{ config, lib, pkgs, ... }:
+{ config, pkgs, lib, ... }:

 with lib;

-let cfg = config.fonts.fontconfig;
+let
+  cfg = config.fonts.fontconfig;

-    fcBool = x: "<bool>" + (boolToString x) + "</bool>";
+  fcBool = x: "<bool>" + (boolToString x) + "</bool>";

-    # back-supported fontconfig version and package
-    # version is used for font cache generation
-    supportVersion = "210";
-    supportPkg     = pkgs."fontconfig_${supportVersion}";
+  # back-supported fontconfig version and package
+  # version is used for font cache generation
+  supportVersion = "210";
+  supportPkg     = pkgs."fontconfig_${supportVersion}";

-    # latest fontconfig version and package
-    # version is used for configuration folder name, /etc/fonts/VERSION/
-    # note: format differs from supportVersion and can not be used with makeCacheConf
-    latestVersion  = pkgs.fontconfig.configVersion;
-    latestPkg      = pkgs.fontconfig;
+  # latest fontconfig version and package
+  # version is used for configuration folder name, /etc/fonts/VERSION/
+  # note: format differs from supportVersion and can not be used with makeCacheConf
+  latestVersion  = pkgs.fontconfig.configVersion;
+  latestPkg      = pkgs.fontconfig;

-    # supported version fonts.conf
-    supportFontsConf = pkgs.makeFontsConf { fontconfig = supportPkg; fontDirectories = config.fonts.fonts; };
+  # supported version fonts.conf
+  supportFontsConf = pkgs.makeFontsConf { fontconfig = supportPkg; fontDirectories = config.fonts.fonts; };

-    # configuration file to read fontconfig cache
-    # version dependent
-    # priority 0
-    cacheConfSupport = makeCacheConf { version = supportVersion; };
-    cacheConfLatest  = makeCacheConf {};
+  # configuration file to read fontconfig cache
+  # version dependent
+  # priority 0
+  cacheConfSupport = makeCacheConf { version = supportVersion; };
+  cacheConfLatest  = makeCacheConf {};

-    # generate the font cache setting file for a fontconfig version
-    # use latest when no version is passed
-    makeCacheConf = { version ? null }:
-      let
-        fcPackage = if version == null
-                    then "fontconfig"
-                    else "fontconfig_${version}";
-        makeCache = fontconfig: pkgs.makeFontsCache { inherit fontconfig; fontDirectories = config.fonts.fonts; };
-        cache     = makeCache pkgs."${fcPackage}";
-        cache32   = makeCache pkgs.pkgsi686Linux."${fcPackage}";
-      in
-      pkgs.writeText "fc-00-nixos-cache.conf" ''
-        <?xml version='1.0'?>
-        <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
-        <fontconfig>
-          <!-- Font directories -->
-          ${concatStringsSep "\n" (map (font: "<dir>${font}</dir>") config.fonts.fonts)}
-          <!-- Pre-generated font caches -->
-          <cachedir>${cache}</cachedir>
-          ${optionalString (pkgs.stdenv.isx86_64 && cfg.cache32Bit) ''
-            <cachedir>${cache32}</cachedir>
-          ''}
-        </fontconfig>
-      '';
-
-    # rendering settings configuration file
-    # priority 10
-    renderConf = pkgs.writeText "fc-10-nixos-rendering.conf" ''
+  # generate the font cache setting file for a fontconfig version
+  # use latest when no version is passed
+  makeCacheConf = { version ? null }:
+    let
+      fcPackage = if version == null
+                  then "fontconfig"
+                  else "fontconfig_${version}";
+      makeCache = fontconfig: pkgs.makeFontsCache { inherit fontconfig; fontDirectories = config.fonts.fonts; };
+      cache     = makeCache pkgs."${fcPackage}";
+      cache32   = makeCache pkgs.pkgsi686Linux."${fcPackage}";
+    in
+    pkgs.writeText "fc-00-nixos-cache.conf" ''
      <?xml version='1.0'?>
      <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
      <fontconfig>
-
-        <!-- Default rendering settings -->
-        <match target="pattern">
-          <edit mode="append" name="hinting">
-            ${fcBool cfg.hinting.enable}
-          </edit>
-          <edit mode="append" name="autohint">
-            ${fcBool cfg.hinting.autohint}
-          </edit>
-          <edit mode="append" name="hintstyle">
-            <const>hintslight</const>
-          </edit>
-          <edit mode="append" name="antialias">
-            ${fcBool cfg.antialias}
-          </edit>
-          <edit mode="append" name="rgba">
-            <const>${cfg.subpixel.rgba}</const>
-          </edit>
-          <edit mode="append" name="lcdfilter">
-            <const>lcd${cfg.subpixel.lcdfilter}</const>
-          </edit>
-        </match>
-
-        ${optionalString (cfg.dpi != 0) ''
-        <match target="pattern">
-          <edit name="dpi" mode="assign">
-            <double>${toString cfg.dpi}</double>
-          </edit>
-        </match>
+        <!-- Font directories -->
+        ${concatStringsSep "\n" (map (font: "<dir>${font}</dir>") config.fonts.fonts)}
+        <!-- Pre-generated font caches -->
+        <cachedir>${cache}</cachedir>
+        ${optionalString (pkgs.stdenv.isx86_64 && cfg.cache32Bit) ''
+          <cachedir>${cache32}</cachedir>
        ''}
-
      </fontconfig>
    '';

-    # local configuration file
-    # priority 51
-    localConf = pkgs.writeText "fc-local.conf" cfg.localConf;
+  # rendering settings configuration file
+  # priority 10
+  renderConf = pkgs.writeText "fc-10-nixos-rendering.conf" ''
+    <?xml version='1.0'?>
+    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+    <fontconfig>

-    # default fonts configuration file
-    # priority 52
-    defaultFontsConf =
-      let genDefault = fonts: name:
-        optionalString (fonts != []) ''
-          <alias>
-            <family>${name}</family>
-            <prefer>
-            ${concatStringsSep ""
-            (map (font: ''
-              <family>${font}</family>
-            '') fonts)}
-            </prefer>
-          </alias>
-        '';
-      in
-      pkgs.writeText "fc-52-nixos-default-fonts.conf" ''
-      <?xml version='1.0'?>
-      <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
-      <fontconfig>
-
-        <!-- Default fonts -->
-        ${genDefault cfg.defaultFonts.sansSerif "sans-serif"}
-
-        ${genDefault cfg.defaultFonts.serif     "serif"}
-
-        ${genDefault cfg.defaultFonts.monospace "monospace"}
-
-      </fontconfig>
-    '';
-
-    # bitmap font options
-    # priority 53
-    rejectBitmaps = pkgs.writeText "fc-53-nixos-bitmaps.conf" ''
-      <?xml version="1.0"?>
-      <!DOCTYPE fontconfig SYSTEM "fonts.dtd">
-      <fontconfig>
-
-      ${optionalString (!cfg.allowBitmaps) ''
-      <!-- Reject bitmap fonts -->
-      <selectfont>
-        <rejectfont>
-          <pattern>
-            <patelt name="scalable"><bool>false</bool></patelt>
-          </pattern>
-        </rejectfont>
-      </selectfont>
-      ''}
-
-      <!-- Use embedded bitmaps in fonts like Calibri? -->
-      <match target="font">
-        <edit name="embeddedbitmap" mode="assign">
-          ${fcBool cfg.useEmbeddedBitmaps}
+      <!-- Default rendering settings -->
+      <match target="pattern">
+        <edit mode="append" name="hinting">
+          ${fcBool cfg.hinting.enable}
+        </edit>
+        <edit mode="append" name="autohint">
+          ${fcBool cfg.hinting.autohint}
+        </edit>
+        <edit mode="append" name="hintstyle">
+          <const>hintslight</const>
+        </edit>
+        <edit mode="append" name="antialias">
+          ${fcBool cfg.antialias}
+        </edit>
+        <edit mode="append" name="rgba">
+          <const>${cfg.subpixel.rgba}</const>
+        </edit>
+        <edit mode="append" name="lcdfilter">
+          <const>lcd${cfg.subpixel.lcdfilter}</const>
        </edit>
      </match>

-      </fontconfig>
-    '';
-
-    # reject Type 1 fonts
-    # priority 53
-    rejectType1 = pkgs.writeText "fc-53-nixos-reject-type1.conf" ''
-      <?xml version="1.0"?>
-      <!DOCTYPE fontconfig SYSTEM "fonts.dtd">
-      <fontconfig>
-
-      <!-- Reject Type 1 fonts -->
-      <selectfont>
-        <rejectfont>
-          <pattern>
-            <patelt name="fontformat"><string>Type 1</string></patelt>
-          </pattern>
-        </rejectfont>
-      </selectfont>
-
-      </fontconfig>
-    '';
-
-    # fontconfig configuration package
-    confPkg = pkgs.runCommand "fontconfig-conf" { preferLocalBuild = true; } ''
-      support_folder=$out/etc/fonts
-      latest_folder=$out/etc/fonts/${latestVersion}
-
-      mkdir -p $support_folder/conf.d
-      mkdir -p $latest_folder/conf.d
-
-      # fonts.conf
-      ln -s ${supportFontsConf} $support_folder/fonts.conf
-      ln -s ${latestPkg.out}/etc/fonts/fonts.conf \
-            $latest_folder/fonts.conf
-
-      # fontconfig default config files
-      ln -s ${supportPkg.out}/etc/fonts/conf.d/*.conf \
-            $support_folder/conf.d/
-      ln -s ${latestPkg.out}/etc/fonts/conf.d/*.conf \
-            $latest_folder/conf.d/
-
-      # update latest 51-local.conf path to look at the latest local.conf
-      rm    $latest_folder/conf.d/51-local.conf
-
-      substitute ${latestPkg.out}/etc/fonts/conf.d/51-local.conf \
-                 $latest_folder/conf.d/51-local.conf \
-                 --replace local.conf /etc/fonts/${latestVersion}/local.conf
-
-      # 00-nixos-cache.conf
-      ln -s ${cacheConfSupport} \
-            $support_folder/conf.d/00-nixos-cache.conf
-      ln -s ${cacheConfLatest}  $latest_folder/conf.d/00-nixos-cache.conf
-
-      # 10-nixos-rendering.conf
-      ln -s ${renderConf}       $support_folder/conf.d/10-nixos-rendering.conf
-      ln -s ${renderConf}       $latest_folder/conf.d/10-nixos-rendering.conf
-
-      # 50-user.conf
-      ${optionalString (! cfg.includeUserConf) ''
-      rm    $support_folder/conf.d/50-user.conf
-      rm    $latest_folder/conf.d/50-user.conf
+      ${optionalString (cfg.dpi != 0) ''
+      <match target="pattern">
+        <edit name="dpi" mode="assign">
+          <double>${toString cfg.dpi}</double>
+        </edit>
+      </match>
      ''}

-      # local.conf (indirect priority 51)
-      ${optionalString (cfg.localConf != "") ''
-      ln -s ${localConf}        $support_folder/local.conf
-      ln -s ${localConf}        $latest_folder/local.conf
-      ''}
+    </fontconfig>
+  '';

-      # 52-nixos-default-fonts.conf
-      ln -s ${defaultFontsConf} $support_folder/conf.d/52-nixos-default-fonts.conf
-      ln -s ${defaultFontsConf} $latest_folder/conf.d/52-nixos-default-fonts.conf
+  # local configuration file
+  localConf = pkgs.writeText "fc-local.conf" cfg.localConf;

-      # 53-nixos-bitmaps.conf
-      ln -s ${rejectBitmaps} $support_folder/conf.d/53-nixos-bitmaps.conf
-      ln -s ${rejectBitmaps} $latest_folder/conf.d/53-nixos-bitmaps.conf
+  # default fonts configuration file
+  # priority 52
+  defaultFontsConf =
+    let genDefault = fonts: name:
+      optionalString (fonts != []) ''
+        <alias>
+          <family>${name}</family>
+          <prefer>
+          ${concatStringsSep ""
+          (map (font: ''
+            <family>${font}</family>
+          '') fonts)}
+          </prefer>
+        </alias>
+      '';
+    in
+    pkgs.writeText "fc-52-nixos-default-fonts.conf" ''
+    <?xml version='1.0'?>
+    <!DOCTYPE fontconfig SYSTEM 'fonts.dtd'>
+    <fontconfig>

-      ${optionalString (! cfg.allowType1) ''
-      # 53-nixos-reject-type1.conf
-      ln -s ${rejectType1} $support_folder/conf.d/53-nixos-reject-type1.conf
-      ln -s ${rejectType1} $latest_folder/conf.d/53-nixos-reject-type1.conf
-      ''}
-    '';
+      <!-- Default fonts -->
+      ${genDefault cfg.defaultFonts.sansSerif "sans-serif"}

-    # Package with configuration files
-    # this merge all the packages in the fonts.fontconfig.confPackages list
-    fontconfigEtc = pkgs.buildEnv {
-      name  = "fontconfig-etc";
-      paths = cfg.confPackages;
-      ignoreCollisions = true;
-    };
+      ${genDefault cfg.defaultFonts.serif     "serif"}
+
+      ${genDefault cfg.defaultFonts.monospace "monospace"}
+
+    </fontconfig>
+  '';
+
+  # bitmap font options
+  # priority 53
+  rejectBitmaps = pkgs.writeText "fc-53-no-bitmaps.conf" ''
+    <?xml version="1.0"?>
+    <!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+    <fontconfig>
+
+    ${optionalString (!cfg.allowBitmaps) ''
+    <!-- Reject bitmap fonts -->
+    <selectfont>
+      <rejectfont>
+        <pattern>
+          <patelt name="scalable"><bool>false</bool></patelt>
+        </pattern>
+      </rejectfont>
+    </selectfont>
+    ''}
+
+    <!-- Use embedded bitmaps in fonts like Calibri? -->
+    <match target="font">
+      <edit name="embeddedbitmap" mode="assign">
+        ${fcBool cfg.useEmbeddedBitmaps}
+      </edit>
+    </match>
+
+    </fontconfig>
+  '';
+
+  # reject Type 1 fonts
+  # priority 53
+  rejectType1 = pkgs.writeText "fc-53-nixos-reject-type1.conf" ''
+    <?xml version="1.0"?>
+    <!DOCTYPE fontconfig SYSTEM "fonts.dtd">
+    <fontconfig>
+
+    <!-- Reject Type 1 fonts -->
+    <selectfont>
+      <rejectfont>
+        <pattern>
+          <patelt name="fontformat"><string>Type 1</string></patelt>
+        </pattern>
+      </rejectfont>
+    </selectfont>
+
+    </fontconfig>
+  '';
+
+  # fontconfig configuration package
+  confPkg = pkgs.runCommand "fontconfig-conf" {
+    preferLocalBuild = true;
+  } ''
+    support_folder=$out/etc/fonts/conf.d
+    latest_folder=$out/etc/fonts/${latestVersion}/conf.d
+
+    mkdir -p $support_folder
+    mkdir -p $latest_folder
+
+    # fonts.conf
+    ln -s ${supportFontsConf} $support_folder/../fonts.conf
+    ln -s ${latestPkg.out}/etc/fonts/fonts.conf \
+          $latest_folder/../fonts.conf
+
+    # fontconfig default config files
+    ln -s ${supportPkg.out}/etc/fonts/conf.d/*.conf \
+          $support_folder/
+    ln -s ${latestPkg.out}/etc/fonts/conf.d/*.conf \
+          $latest_folder/
+
+    # update latest 51-local.conf path to look at the latest local.conf
+    rm    $latest_folder/51-local.conf
+
+    substitute ${latestPkg.out}/etc/fonts/conf.d/51-local.conf \
+               $latest_folder/51-local.conf \
+               --replace local.conf /etc/fonts/${latestVersion}/local.conf
+
+    # 00-nixos-cache.conf
+    ln -s ${cacheConfSupport} \
+          $support_folder/00-nixos-cache.conf
+    ln -s ${cacheConfLatest}  $latest_folder/00-nixos-cache.conf
+
+    # 10-nixos-rendering.conf
+    ln -s ${renderConf}       $support_folder/10-nixos-rendering.conf
+    ln -s ${renderConf}       $latest_folder/10-nixos-rendering.conf
+
+    # 50-user.conf
+    ${optionalString (!cfg.includeUserConf) ''
+    rm $support_folder/50-user.conf
+    rm $latest_folder/50-user.conf
+    ''}
+
+    # local.conf (indirect priority 51)
+    ${optionalString (cfg.localConf != "") ''
+    ln -s ${localConf}        $support_folder/../local.conf
+    ln -s ${localConf}        $latest_folder/../local.conf
+    ''}
+
+    # 52-nixos-default-fonts.conf
+    ln -s ${defaultFontsConf} $support_folder/52-nixos-default-fonts.conf
+    ln -s ${defaultFontsConf} $latest_folder/52-nixos-default-fonts.conf
+
+    # 53-no-bitmaps.conf
+    ln -s ${rejectBitmaps} $support_folder/53-no-bitmaps.conf
+    ln -s ${rejectBitmaps} $latest_folder/53-no-bitmaps.conf
+
+    ${optionalString (!cfg.allowType1) ''
+    # 53-nixos-reject-type1.conf
+    ln -s ${rejectType1} $support_folder/53-nixos-reject-type1.conf
+    ln -s ${rejectType1} $latest_folder/53-nixos-reject-type1.conf
+    ''}
+  '';
+
+  # Package with configuration files
+  # this merge all the packages in the fonts.fontconfig.confPackages list
+  fontconfigEtc = pkgs.buildEnv {
+    name  = "fontconfig-etc";
+    paths = cfg.confPackages;
+    ignoreCollisions = true;
+  };
 in
 {

--- a/nixos/modules/config/vte.nix
+++ b/nixos/modules/config/vte.nix
@ -0,0 +1,52 @@
+# VTE
+
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+
+  vteInitSnippet = ''
+    # Show current working directory in VTE terminals window title.
+    # Supports both bash and zsh, requires interactive shell.
+    . ${pkgs.vte}/etc/profile.d/vte.sh
+  '';
+
+in
+
+{
+
+  options = {
+
+    programs.bash.vteIntegration = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Whether to enable Bash integration for VTE terminals.
+        This allows it to preserve the current directory of the shell
+        across terminals.
+      '';
+    };
+
+    programs.zsh.vteIntegration = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Whether to enable Zsh integration for VTE terminals.
+        This allows it to preserve the current directory of the shell
+        across terminals.
+      '';
+    };
+
+  };
+
+  config = mkMerge [
+    (mkIf config.programs.bash.vteIntegration {
+      programs.bash.interactiveShellInit = vteInitSnippet;
+    })
+
+    (mkIf config.programs.zsh.vteIntegration {
+      programs.zsh.interactiveShellInit = vteInitSnippet;
+    })
+  ];
+}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -38,6 +38,7 @@
  ./config/unix-odbc-drivers.nix
  ./config/users-groups.nix
  ./config/vpnc.nix
+  ./config/vte.nix
  ./config/zram.nix
  ./hardware/acpilight.nix
  ./hardware/all-firmware.nix
@ -116,6 +117,7 @@
  ./programs/fuse.nix
  ./programs/gnome-disks.nix
  ./programs/gnome-documents.nix
+  ./programs/gnome-terminal.nix
  ./programs/gpaste.nix
  ./programs/gnupg.nix
  ./programs/gphoto2.nix
@ -297,7 +299,6 @@
  ./services/desktops/gnome3/gnome-remote-desktop.nix
  ./services/desktops/gnome3/gnome-online-miners.nix
  ./services/desktops/gnome3/gnome-settings-daemon.nix
-  ./services/desktops/gnome3/gnome-terminal-server.nix
  ./services/desktops/gnome3/gnome-user-share.nix
  ./services/desktops/gnome3/rygel.nix
  ./services/desktops/gnome3/seahorse.nix
--- a/nixos/modules/programs/gnome-terminal.nix
+++ b/nixos/modules/programs/gnome-terminal.nix
@ -0,0 +1,36 @@
+# GNOME Terminal.
+
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+
+  cfg = config.programs.gnome-terminal;
+
+in
+
+{
+
+  # Added 2019-08-19
+  imports = [
+    (mkRenamedOptionModule
+      [ "services" "gnome3" "gnome-terminal-server" "enable" ]
+      [ "programs" "gnome-terminal" "enable" ])
+  ];
+
+  options = {
+
+    programs.gnome-terminal.enable = mkEnableOption "GNOME Terminal";
+
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.gnome3.gnome-terminal ];
+    services.dbus.packages = [ pkgs.gnome3.gnome-terminal ];
+    systemd.packages = [ pkgs.gnome3.gnome-terminal ];
+
+    programs.bash.vteIntegration = true;
+    programs.zsh.vteIntegration = true;
+  };
+}
--- a/nixos/modules/services/desktops/gnome3/gnome-terminal-server.nix
+++ b/nixos/modules/services/desktops/gnome3/gnome-terminal-server.nix
@ -1,41 +0,0 @@
-# GNOME Documents daemon.
-
-{ config, pkgs, lib, ... }:
-
-with lib;
-
-{
-
-  ###### interface
-
-  options = {
-
-    services.gnome3.gnome-terminal-server = {
-
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Whether to enable GNOME Terminal server service,
-          needed for gnome-terminal.
-        '';
-      };
-
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = mkIf config.services.gnome3.gnome-terminal-server.enable {
-
-    environment.systemPackages = [ pkgs.gnome3.gnome-terminal ];
-
-    services.dbus.packages = [ pkgs.gnome3.gnome-terminal ];
-
-    systemd.packages = [ pkgs.gnome3.gnome-terminal ];
-
-  };
-
-}
--- a/nixos/modules/services/hardware/trezord.nix
+++ b/nixos/modules/services/hardware/trezord.nix
@ -22,6 +22,22 @@ in {
          Enable Trezor bridge daemon, for use with Trezor hardware bitcoin wallets.
        '';
      };
+
+      emulator.enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable Trezor emulator support.
+          '';
+       };
+
+      emulator.port = mkOption {
+        type = types.port;
+        default = 21324;
+        description = ''
+          Listening port for the Trezor emulator.
+          '';
+      };
    };
  };
  
@ -50,7 +66,7 @@ in {
      path = [];
      serviceConfig = {
        Type = "simple";
-        ExecStart = "${pkgs.trezord}/bin/trezord-go";
+        ExecStart = "${pkgs.trezord}/bin/trezord-go ${optionalString cfg.emulator.enable "-e ${builtins.toString cfg.emulator.port}"}";
        User = "trezord";
      };
    };
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -162,6 +162,10 @@ let
    ${cfg.appendConfig}
  '';

+  configPath = if cfg.enableReload
+    then "/etc/nginx/nginx.conf"
+    else configFile;
+
  vhosts = concatStringsSep "\n" (mapAttrsToList (vhostName: vhost:
    let
        onlySSL = vhost.onlySSL || vhost.enableSSL;
@ -431,6 +435,16 @@ in
        ";
      };

+      enableReload = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Reload nginx when configuration file changes (instead of restart).
+          The configuration file is exposed at <filename>/etc/nginx/nginx.conf</filename>.
+          See also <literal>systemd.services.*.restartIfChanged</literal>.
+        '';
+      };
+
      stateDir = mkOption {
        default = "/var/spool/nginx";
        description = "
@ -638,10 +652,10 @@ in
      preStart =
        ''
        ${cfg.preStart}
-        ${cfg.package}/bin/nginx -c ${configFile} -p ${cfg.stateDir} -t
+        ${cfg.package}/bin/nginx -c ${configPath} -p ${cfg.stateDir} -t
        '';
      serviceConfig = {
-        ExecStart = "${cfg.package}/bin/nginx -c ${configFile} -p ${cfg.stateDir}";
+        ExecStart = "${cfg.package}/bin/nginx -c ${configPath} -p ${cfg.stateDir}";
        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
        Restart = "always";
        RestartSec = "10s";
@ -649,6 +663,21 @@ in
      };
    };

+    environment.etc."nginx/nginx.conf" = mkIf cfg.enableReload {
+      source = configFile;
+    };
+
+    systemd.services.nginx-config-reload = mkIf cfg.enableReload {
+      wantedBy = [ "nginx.service" ];
+      restartTriggers = [ configFile ];
+      script = ''
+        if ${pkgs.systemd}/bin/systemctl -q is-active nginx.service ; then
+          ${pkgs.systemd}/bin/systemctl reload nginx.service
+        fi
+      '';
+      serviceConfig.RemainAfterExit = true;
+    };
+
    security.acme.certs = filterAttrs (n: v: v != {}) (
      let
        vhostsConfigs = mapAttrsToList (vhostName: vhostConfig: vhostConfig) virtualHosts;
--- a/nixos/modules/services/x11/desktop-managers/gnome3.nix
+++ b/nixos/modules/services/x11/desktop-managers/gnome3.nix
@ -136,7 +136,6 @@ in {
    services.gnome3.gnome-online-accounts.enable = mkDefault true;
    services.gnome3.gnome-remote-desktop.enable = mkDefault true;
    services.gnome3.gnome-settings-daemon.enable = true;
-    services.gnome3.gnome-terminal-server.enable = mkDefault true;
    services.gnome3.gnome-user-share.enable = mkDefault true;
    services.gvfs.enable = true;
    services.gnome3.rygel.enable = mkDefault true;
@ -166,6 +165,7 @@ in {
    programs.file-roller.enable = mkDefault true;
    programs.gnome-disks.enable = mkDefault true;
    programs.gnome-documents.enable = mkDefault true;
+    programs.gnome-terminal.enable = mkDefault true;

    # If gnome3 is installed, build vim for gtk3 too.
    nixpkgs.config.vim.gui = "gtk3";
--- a/nixos/modules/services/x11/desktop-managers/mate.nix
+++ b/nixos/modules/services/x11/desktop-managers/mate.nix
@ -94,6 +94,10 @@ in
      ];

    programs.dconf.enable = true;
+    # Shell integration for VTE terminals
+    programs.bash.vteIntegration = mkDefault true;
+    programs.zsh.vteIntegration = mkDefault true;
+
    services.gnome3.at-spi2-core.enable = true;
    services.gnome3.gnome-keyring.enable = true;
    services.gnome3.gnome-settings-daemon.enable = true;
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -146,6 +146,10 @@ in
    programs.evince.enable = mkDefault true;
    programs.file-roller.enable = mkDefault true;

+    # Shell integration for VTE terminals
+    programs.bash.vteIntegration = mkDefault true;
+    programs.zsh.vteIntegration = mkDefault true;
+
    # Harmonize Qt5 applications under Pantheon
    qt5.enable = true;
    qt5.platformTheme = "gnome";
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -55,6 +55,27 @@ let
    (assertMacAddress "MACAddress")
  ];

+  # NOTE The PrivateKey directive is missing on purpose here, please
+  # do not add it to this list. The nix store is world-readable let's
+  # refrain ourselves from providing a footgun.
+  checkWireGuard = checkUnitConfig "WireGuard" [
+    (assertOnlyFields [
+      "PrivateKeyFile" "ListenPort" "FwMark"
+    ])
+    (assertRange "FwMark" 1 4294967295)
+  ];
+
+  # NOTE The PresharedKey directive is missing on purpose here, please
+  # do not add it to this list. The nix store is world-readable,let's
+  # refrain ourselves from providing a footgun.
+  checkWireGuardPeer = checkUnitConfig "WireGuardPeer" [
+    (assertOnlyFields [
+      "PublicKey" "PresharedKeyFile" "AllowedIPs"
+      "Endpoint" "PersistentKeepalive"
+    ])
+    (assertRange "PersistentKeepalive" 1 65535)
+  ];
+
  checkVlan = checkUnitConfig "VLAN" [
    (assertOnlyFields ["Id" "GVRP" "MVRP" "LooseBinding" "ReorderHeader"])
    (assertRange "Id" 0 4094)
@ -320,6 +341,46 @@ let
      '';
    };

+    wireguardConfig = mkOption {
+      default = {};
+      example = {
+        PrivateKeyFile = "/etc/wireguard/secret.key";
+        ListenPort = 51820;
+        FwMark = 42;
+      };
+      type = types.addCheck (types.attrsOf unitOption) checkWireGuard;
+      description = ''
+        Each attribute in this set specifies an option in the
+        <literal>[WireGuard]</literal> section of the unit. See
+        <citerefentry><refentrytitle>systemd.netdev</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for details.
+        Use <literal>PrivateKeyFile</literal> instead of
+        <literal>PrivateKey</literal>: the nix store is
+        world-readable.
+      '';
+    };
+
+    wireguardPeers = mkOption {
+      default = [];
+      example = [ { wireguardPeerConfig={
+        Endpoint = "192.168.1.1:51820";
+        PublicKey = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
+        PresharedKeyFile = "/etc/wireguard/psk.key";
+        AllowedIPs = [ "10.0.0.1/32" ];
+        PersistentKeepalive = 15;
+      };}];
+      type = with types; listOf (submodule wireguardPeerOptions);
+      description = ''
+        Each item in this array specifies an option in the
+        <literal>[WireGuardPeer]</literal> section of the unit. See
+        <citerefentry><refentrytitle>systemd.netdev</refentrytitle>
+        <manvolnum>5</manvolnum></citerefentry> for details.
+        Use <literal>PresharedKeyFile</literal> instead of
+        <literal>PresharedKey</literal>: the nix store is
+        world-readable.
+      '';
+    };
+
    vlanConfig = mkOption {
      default = {};
      example = { Id = "4"; };
@ -450,6 +511,23 @@ let
    };
  };

+  wireguardPeerOptions = {
+    options = {
+      wireguardPeerConfig = mkOption {
+        default = {};
+        example = { };
+        type = types.addCheck (types.attrsOf unitOption) checkWireGuardPeer;
+        description = ''
+          Each attribute in this set specifies an option in the
+          <literal>[WireGuardPeer]</literal> section of the unit.  See
+          <citerefentry><refentrytitle>systemd.network</refentrytitle>
+          <manvolnum>5</manvolnum></citerefentry> for details.
+        '';
+      };
+    };
+  };
+
+
  networkOptions = commonNetworkOptions // {

    networkConfig = mkOption {
@ -732,6 +810,16 @@ let
            ${attrsToSection def.bondConfig}

          ''}
+          ${optionalString (def.wireguardConfig != { }) ''
+            [WireGuard]
+            ${attrsToSection def.wireguardConfig}
+
+          ''}
+          ${flip concatMapStrings def.wireguardPeers (x: ''
+            [WireGuardPeer]
+            ${attrsToSection x.wireguardPeerConfig}
+
+          '')}
          ${def.extraConfig}
        '';
    };
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@ -70,7 +70,7 @@ let
  startScript = cfg:
    ''
      mkdir -p -m 0755 "$root/etc" "$root/var/lib"
-      mkdir -p -m 0700 "$root/var/lib/private" "$root/root"
+      mkdir -p -m 0700 "$root/var/lib/private" "$root/root" /run/containers
      if ! [ -e "$root/etc/os-release" ]; then
        touch "$root/etc/os-release"
      fi
@ -248,7 +248,7 @@ let

    Type = "notify";

-    RuntimeDirectory = [ "containers" ] ++ lib.optional cfg.ephemeral "containers/%i";
+    RuntimeDirectory = lib.optional cfg.ephemeral "containers/%i";

    # Note that on reboot, systemd-nspawn returns 133, so this
    # unit will be restarted. On poweroff, it returns 0, so the
@ -683,8 +683,15 @@ in
    unit = {
      description = "Container '%i'";

+      unitConfig.RequiresMountsFor = "/var/lib/containers/%i";
+
      path = [ pkgs.iproute ];

+      environment = {
+        root = "/var/lib/containers/%i";
+        INSTANCE = "%i";
+      };
+
      preStart = preStartScript dummyConfig;

      script = startScript dummyConfig;
@ -722,14 +729,13 @@ in
            }
          else {});
        in
-          unit // {
+          recursiveUpdate unit {
            preStart = preStartScript containerConfig;
            script = startScript containerConfig;
            postStart = postStartScript containerConfig;
            serviceConfig = serviceDirectives containerConfig;
            unitConfig.RequiresMountsFor = lib.optional (!containerConfig.ephemeral) "/var/lib/containers/%i";
            environment.root = if containerConfig.ephemeral then "/run/containers/%i" else "/var/lib/containers/%i";
-            environment.INSTANCE = "%i";
          } // (
          if containerConfig.autoStart then
            {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -254,6 +254,7 @@ in
  systemd = handleTest ./systemd.nix {};
  systemd-confinement = handleTest ./systemd-confinement.nix {};
  systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
+  systemd-networkd-wireguard = handleTest ./systemd-networkd-wireguard.nix {};
  pdns-recursor = handleTest ./pdns-recursor.nix {};
  taskserver = handleTest ./taskserver.nix {};
  telegraf = handleTest ./telegraf.nix {};
@ -261,6 +262,7 @@ in
  tinydns = handleTest ./tinydns.nix {};
  tor = handleTest ./tor.nix {};
  transmission = handleTest ./transmission.nix {};
+  trezord = handleTest ./trezord.nix {};
  udisks2 = handleTest ./udisks2.nix {};
  upnp = handleTest ./upnp.nix {};
  uwsgi = handleTest ./uwsgi.nix {};
--- a/nixos/tests/nginx.nix
+++ b/nixos/tests/nginx.nix
@ -3,15 +3,15 @@
 #      generated virtual hosts config.
 #   2. whether the ETag header is properly generated whenever we're serving
 #      files in Nix store paths
-
+#   3. nginx doesn't restart on configuration changes (only reloads)
 import ./make-test.nix ({ pkgs, ... }: {
  name = "nginx";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ mbbx6spp ];
  };

-  nodes = let
-    commonConfig = { pkgs, ... }: {
+  nodes = {
+    webserver = { pkgs, lib, ... }: {
      services.nginx.enable = true;
      services.nginx.commonHttpConfig = ''
        log_format ceeformat '@cee: {"status":"$status",'
@ -32,30 +32,42 @@ import ./make-test.nix ({ pkgs, ... }: {
          location /favicon.ico { allow all; access_log off; log_not_found off; }
        '';
      };
+
      services.nginx.virtualHosts.localhost = {
        root = pkgs.runCommand "testdir" {} ''
          mkdir "$out"
          echo hello world > "$out/index.html"
        '';
      };
-    };
-  in {
-    webserver = commonConfig;

-    newwebserver = { pkgs, lib, ... }: {
-      imports = [ commonConfig ];
-      services.nginx.virtualHosts.localhost = {
-        root = lib.mkForce (pkgs.runCommand "testdir2" {} ''
-          mkdir "$out"
-          echo hello world > "$out/index.html"
-        '');
-      };
+      services.nginx.enableReload = true;
+
+      nesting.clone = [
+        {
+          services.nginx.virtualHosts.localhost = {
+            root = lib.mkForce (pkgs.runCommand "testdir2" {} ''
+              mkdir "$out"
+              echo content changed > "$out/index.html"
+            '');
+          };
+        }
+
+        {
+          services.nginx.virtualHosts."1.my.test".listen = [ { addr = "127.0.0.1"; port = 8080; }];
+        }
+
+        {
+          services.nginx.package = pkgs.nginxUnstable;
+        }
+      ];
    };
+
  };

  testScript = { nodes, ... }: let
-    newServerSystem = nodes.newwebserver.config.system.build.toplevel;
-    switch = "${newServerSystem}/bin/switch-to-configuration test";
+    etagSystem = "${nodes.webserver.config.system.build.toplevel}/fine-tune/child-1";
+    justReloadSystem = "${nodes.webserver.config.system.build.toplevel}/fine-tune/child-2";
+    reloadRestartSystem = "${nodes.webserver.config.system.build.toplevel}/fine-tune/child-3";
  in ''
    my $url = 'http://localhost/index.html';

@ -77,9 +89,23 @@ import ./make-test.nix ({ pkgs, ... }: {

    subtest "check ETag if serving Nix store paths", sub {
      my $oldEtag = checkEtag;
-      $webserver->succeed('${switch}');
+      $webserver->succeed("${etagSystem}/bin/switch-to-configuration test >&2");
+      $webserver->sleep(1); # race condition
      my $newEtag = checkEtag;
      die "Old ETag $oldEtag is the same as $newEtag" if $oldEtag eq $newEtag;
    };
+
+    subtest "config is reloaded on nixos-rebuild switch", sub {
+      $webserver->succeed("${justReloadSystem}/bin/switch-to-configuration test >&2");
+      $webserver->waitForOpenPort("8080");
+      $webserver->fail("journalctl -u nginx | grep -q -i stopped");
+      $webserver->succeed("journalctl -u nginx | grep -q -i reloaded");
+    };
+
+    subtest "restart when nginx package changes", sub {
+      $webserver->succeed("${reloadRestartSystem}/bin/switch-to-configuration test >&2");
+      $webserver->waitForUnit("nginx");
+      $webserver->succeed("journalctl -u nginx | grep -q -i stopped");
+    };
  '';
 })
--- a/nixos/tests/systemd-networkd-wireguard.nix
+++ b/nixos/tests/systemd-networkd-wireguard.nix
@ -0,0 +1,80 @@
+let generateNodeConf = { lib, pkgs, config, privkpath, pubk, peerId, nodeId, ...}: {
+      imports = [ common/user-account.nix ];
+      systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
+      networking.useNetworkd = true;
+      networking.firewall.enable = false;
+      virtualisation.vlans = [ 1 ];
+      environment.systemPackages = with pkgs; [ wireguard-tools ];
+      boot.extraModulePackages = [ config.boot.kernelPackages.wireguard ];
+      systemd.network = {
+        enable = true;
+        netdevs = {
+          "90-wg0" = {
+            netdevConfig = { Kind = "wireguard"; Name = "wg0"; };
+            wireguardConfig = {
+              PrivateKeyFile = privkpath ;
+              ListenPort = 51820;
+              FwMark = 42;
+            };
+            wireguardPeers = [ {wireguardPeerConfig={
+              Endpoint = "192.168.1.${peerId}:51820";
+              PublicKey = pubk;
+              PresharedKeyFile = pkgs.writeText "psk.key" "yTL3sCOL33Wzi6yCnf9uZQl/Z8laSE+zwpqOHC4HhFU=";
+              AllowedIPs = [ "10.0.0.${peerId}/32" ];
+              PersistentKeepalive = 15;
+            };}];
+          };
+        };
+        networks = {
+          "99-nope" = {
+            matchConfig.Name = "eth*";
+            linkConfig.Unmanaged = true;
+          };
+          "90-wg0" = {
+            matchConfig = { Name = "wg0"; };
+            address = [ "10.0.0.${nodeId}/32" ];
+            routes = [
+              { routeConfig = { Gateway = "10.0.0.${nodeId}"; Destination = "10.0.0.0/24"; }; }
+            ];
+          };
+          "90-eth1" = {
+            matchConfig = { Name = "eth1"; };
+            address = [ "192.168.1.${nodeId}/24" ];
+          };
+        };
+      };
+    };
+in import ./make-test.nix ({pkgs, ... }: {
+  name = "networkd-wireguard";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ ninjatrappeur ];
+  };
+  nodes = {
+    node1 = { pkgs, ... }@attrs:
+    let localConf = {
+        privkpath = pkgs.writeText "priv.key" "GDiXWlMQKb379XthwX0haAbK6hTdjblllpjGX0heP00=";
+        pubk = "iRxpqj42nnY0Qz8MAQbSm7bXxXP5hkPqWYIULmvW+EE=";
+        nodeId = "1";
+        peerId = "2";
+    };
+    in generateNodeConf (attrs // localConf);
+
+    node2 = { pkgs, ... }@attrs:
+    let localConf = {
+        privkpath = pkgs.writeText "priv.key" "eHxSI2jwX/P4AOI0r8YppPw0+4NZnjOxfbS5mt06K2k=";
+        pubk = "27s0OvaBBdHoJYkH9osZpjpgSOVNw+RaKfboT/Sfq0g=";
+        nodeId = "2";
+        peerId = "1";
+    };
+    in generateNodeConf (attrs // localConf);
+  };
+testScript = ''
+    startAll;
+    $node1->waitForUnit('systemd-networkd-wait-online.service');
+    $node2->waitForUnit('systemd-networkd-wait-online.service');
+    $node1->succeed('ping -c 5 10.0.0.2');
+    $node2->succeed('ping -c 5 10.0.0.1');
+    # Is the fwmark set?
+    $node2->succeed('wg | grep -q 42');
+'';
+})
--- a/nixos/tests/trezord.nix
+++ b/nixos/tests/trezord.nix
@ -0,0 +1,20 @@
+import ./make-test.nix ({ pkgs, ... }: {
+  name = "trezord";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ mmahut ];
+  };
+
+  nodes = {
+    machine = { ... }: {
+      services.trezord.enable = true;
+      services.trezord.emulator.enable = true;
+    };
+  };
+
+  testScript = ''
+    startAll;
+    $machine->waitForUnit("trezord.service");
+    $machine->waitForOpenPort(21325);
+    $machine->waitUntilSucceeds("curl -L http://localhost:21325/status/ | grep Version");
+  '';
+})
--- a/pkgs/applications/editors/kdevelop5/kdev-php.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-php.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "kdev-php";
-  version = "5.4.0";
+  version = "5.4.1";

  src = fetchurl {
    url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "1lfl8y1nmai7kp7jil8cykalw2ib0f3n47jvnz7302qsrs3lvhf2";
+    sha256 = "07j06k2f5rbwgknwcbj70wwn831a54is4kiwlpfd4la2c05slmy5";
  };

  nativeBuildInputs = [ cmake extra-cmake-modules ];
--- a/pkgs/applications/editors/kdevelop5/kdev-python.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-python.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "kdev-python";
-  version = "5.4.0";
+  version = "5.4.1";

  src = fetchurl {
    url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "1bsls5gf8jcb5zmswz82x8whfqadpgcapfc8sxvpjv5yhnjknk8c";
+    sha256 = "1dazd77bkjs11h318q4ia6ijk0d0s04v0zm8lwqlgcj271sqrfqb";
  };

  cmakeFlags = [
--- a/pkgs/applications/editors/kdevelop5/kdevelop.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevelop.nix
@ -9,11 +9,11 @@

 mkDerivation rec {
  pname = "kdevelop";
-  version = "5.4.0";
+  version = "5.4.1";

  src = fetchurl {
    url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "0zi59xlw6facak1jfzlyviwmpjn98dmircmjyqiv3ac5xr30f0ll";
+    sha256 = "12iqgmhaxm9q085h50dzkswcmsp02jzm4jjgrhkx4jlzmf4w4jb8";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "gpxsee";
-  version = "7.11";
+  version = "7.12";

  src = fetchFromGitHub {
    owner = "tumic0";
    repo = "GPXSee";
    rev = version;
-    sha256 = "1b4ky7m990h3rmam9lb1w6vns1mxd8ri6is3a8qgdl8kd6xcl5d7";
+    sha256 = "0c3axs3mm6xzabwbvy9vgq1sryjpi4h91nwzy9iyv9zjxz7phgzc";
  };

  nativeBuildInputs = [ qmake ];
--- a/pkgs/applications/misc/keepassx/community.nix
+++ b/pkgs/applications/misc/keepassx/community.nix
@ -32,13 +32,13 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  name = "keepassxc-${version}";
-  version = "2.4.1";
+  version = "2.4.3";

  src = fetchFromGitHub {
    owner = "keepassxreboot";
    repo = "keepassxc";
    rev = "${version}";
-    sha256 = "1cbfsfdvb4qw6yb0zl6mymdbphnb7lxbfrc5a8cjmn9w8b09kv6m";
+    sha256 = "1r63bl0cam04rps1bjr107qvwsmay4254nv00gwhh9n45s6cslac";
  };

  NIX_CFLAGS_COMPILE = stdenv.lib.optionalString stdenv.cc.isClang [
--- a/pkgs/applications/misc/keepassx/darwin.patch
+++ b/pkgs/applications/misc/keepassx/darwin.patch
@ -1,8 +1,8 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 658548f7..f8f10bdb 100644
+index 74b1a7ff..0a713a32 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -288,6 +288,7 @@ if(MINGW)
+@@ -307,6 +307,7 @@ if(MINGW)
     set(PLUGIN_INSTALL_DIR ".")
     set(DATA_INSTALL_DIR "share")
 elseif(APPLE AND WITH_APP_BUNDLE)
@ -10,24 +10,24 @@ index 658548f7..f8f10bdb 100644
     set(CMAKE_INSTALL_MANDIR "${PROGNAME}.app/Contents/Resources/man")
     set(CLI_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS")
     set(PROXY_INSTALL_DIR "${PROGNAME}.app/Contents/MacOS")
-@@ -350,12 +351,6 @@ set(CMAKE_AUTORCC ON)
+@@ -369,12 +370,6 @@ set(CMAKE_AUTORCC ON)
 
 if(APPLE)
     set(CMAKE_MACOSX_RPATH TRUE)
 -    find_program(MACDEPLOYQT_EXE macdeployqt HINTS ${Qt5_PREFIX}/bin ENV PATH)
 -    if(NOT MACDEPLOYQT_EXE)
-        message(FATAL_ERROR "macdeployqt is required to build in macOS")
+-        message(FATAL_ERROR "macdeployqt is required to build on macOS")
 -    else()
 -        message(STATUS "Using macdeployqt: ${MACDEPLOYQT_EXE}")
 -    endif()
- endif()
- 
- # Debian sets the the build type to None for package builds.
+ elseif(MINGW)
+     find_program(WINDEPLOYQT_EXE windeployqt HINTS ${Qt5_PREFIX}/bin ENV PATH)
+     if(NOT WINDEPLOYQT_EXE)
 diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index 110dc606..f9b58818 100644
+index f142f368..0742512d 100644
 --- a/src/CMakeLists.txt
 +++ b/src/CMakeLists.txt
-@@ -343,11 +343,6 @@ if(APPLE AND WITH_APP_BUNDLE)
+@@ -351,11 +351,6 @@ if(APPLE AND WITH_APP_BUNDLE)
     set(CPACK_PACKAGE_FILE_NAME "${PROGNAME}-${KEEPASSXC_VERSION}")
     include(CPack)
 
@ -40,10 +40,10 @@ index 110dc606..f9b58818 100644
 
 install(TARGETS ${PROGNAME}
 diff --git a/src/autotype/mac/CMakeLists.txt b/src/autotype/mac/CMakeLists.txt
-index f1c5387f..abf70b48 100644
+index 7427450a..a0a58d71 100644
 --- a/src/autotype/mac/CMakeLists.txt
 +++ b/src/autotype/mac/CMakeLists.txt
-@@ -12,7 +12,6 @@ if(WITH_APP_BUNDLE)
+@@ -8,7 +8,6 @@ if(WITH_APP_BUNDLE)
     add_custom_command(TARGET keepassx-autotype-cocoa
             POST_BUILD
             COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_CURRENT_BINARY_DIR}/libkeepassx-autotype-cocoa.so ${PLUGIN_INSTALL_DIR}
--- a/pkgs/applications/misc/st/xst.nix
+++ b/pkgs/applications/misc/st/xst.nix
@ -3,7 +3,7 @@
 with stdenv.lib;

 let
-  version = "0.7.1";
+  version = "0.7.2";
  name = "xst-${version}";
 in stdenv.mkDerivation {
  inherit name;
@ -12,7 +12,7 @@ in stdenv.mkDerivation {
    owner = "gnotclub";
    repo = "xst";
    rev = "v${version}";
-    sha256 = "1fh4y2w0icaij99kihl3w8j5d5b38d72afp17c81pi57f43ss6pc";
+    sha256 = "1fplgy30gyrwkjsw3z947327r98i13zd1whwkplpj9fzckhb9vs9";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@ -9,13 +9,13 @@
 }:
  stdenv.mkDerivation rec {
    pname = "waybar";
-    version = "0.7.1";
+    version = "0.7.2";

    src = fetchFromGitHub {
      owner = "Alexays";
      repo = "Waybar";
      rev = version;
-      sha256 = "0jj6sjsphyvdl4xy5wl64cl4p5y1vzr721cgapbd89g4y0cslsfy";
+      sha256 = "15biyr422s5f2csw395fz9cikir9wffdwqq8y0i6ayzpymzsqbzs";
    };

    nativeBuildInputs = [
--- a/pkgs/applications/misc/worker/default.nix
+++ b/pkgs/applications/misc/worker/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  name = "worker-${version}";
-  version = "4.0.0";
+  version = "4.0.1";

  src = fetchurl {
    url = "http://www.boomerangsworld.de/cms/worker/downloads/${name}.tar.gz";
-    sha256 = "0cs1sq7zpp787r1irhqk5pmxa26rjz55mbgda4823z9zkzwfxy19";
+    sha256 = "1mwkyak68bsxgff399xmr7bb3hxl0r976b90zi7jrzznwlvxx7vh";
  };

  buildInputs = [ libX11 ];
--- a/pkgs/applications/misc/xmind/default.nix
+++ b/pkgs/applications/misc/xmind/default.nix
@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
    desktopName = "XMind";
    comment = meta.description;
    categories = "Office;";
-    mimeType = "application/xmind;xscheme-handler/xmind";
+    mimeType = "application/xmind;x-scheme-handler/xmind";
  };

  installPhase = let
--- a/pkgs/applications/networking/cluster/docker-machine/kvm2.nix
+++ b/pkgs/applications/networking/cluster/docker-machine/kvm2.nix
@ -1,6 +1,6 @@
-{ stdenv, buildGoPackage, libvirt, pkgconfig, minikube }:
+{ stdenv, buildGoModule, libvirt, pkgconfig, minikube }:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "docker-machine-kvm2";
  name = "${pname}-${version}";
  version = minikube.version;
@ -10,6 +10,8 @@ buildGoPackage rec {

  src = minikube.src;

+  modSha256 = minikube.go-modules.outputHash;
+
  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ libvirt ];

@ -18,7 +20,7 @@ buildGoPackage rec {
  '';

  postInstall = ''
-    mv $bin/bin/kvm $bin/bin/docker-machine-driver-kvm2
+    mv $out/bin/kvm $out/bin/docker-machine-driver-kvm2
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/cluster/kubeless/default.nix
+++ b/pkgs/applications/networking/cluster/kubeless/default.nix
@ -0,0 +1,28 @@
+{ stdenv, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "kubeless";
+  version = "1.0.4";
+
+  src = fetchFromGitHub {
+    owner = "kubeless";
+    repo = "kubeless";
+    rev = "v${version}";
+    sha256 = "1f5w6kn9rsaxx9nf6kzyjkzm3s9ycy1c8h78hb61v4x915xd3040";
+  };
+  modSha256 = "1pw4pwb8z2kq474jjipjdivlrin5zvw8d2if4317b0w0wyp6isgd";
+
+  subPackages = [ "cmd/kubeless" ];
+
+  buildFlagsArray = ''
+    -ldflags=-X github.com/kubeless/kubeless/pkg/version.Version=${version}
+  '';
+
+  meta = with stdenv.lib; {
+    homepage = "https://kubeless.io";
+    description = "The Kubernetes Native Serverless Framework";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ "00-matt" ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@ -49,6 +49,7 @@ in buildGoModule rec {
  '';

  postInstall = ''
+    wrapProgram $out/bin/${pname} --prefix PATH : $out/bin:${stdenv.lib.makeBinPath binPath}
    mkdir -p $out/share/bash-completion/completions/
    MINIKUBE_WANTUPDATENOTIFICATION=false MINIKUBE_WANTKUBECTLDOWNLOADMSG=false HOME=$PWD $out/bin/minikube completion bash > $out/share/bash-completion/completions/minikube
    mkdir -p $out/share/zsh/site-functions/
--- a/pkgs/applications/networking/instant-messengers/freetalk/default.nix
+++ b/pkgs/applications/networking/instant-messengers/freetalk/default.nix
@ -1,9 +1,7 @@
 { stdenv, fetchFromGitHub
 , guile, pkgconfig, glib, loudmouth, gmp, libidn, readline, libtool
 , libunwind, ncurses, curl, jansson, texinfo
-, automake, autoconf
-}:
-
+, automake, autoconf }:
 stdenv.mkDerivation rec {
  name = "freetalk-${version}";
  version = "4.1";
@ -19,11 +17,10 @@ stdenv.mkDerivation rec {
    ./autogen.sh
  '';

- nativeBuildInputs = [ pkgconfig ];
- buildInputs = [
+  nativeBuildInputs = [ pkgconfig texinfo autoconf automake ];
+  buildInputs = [
    guile glib loudmouth gmp libidn readline libtool
-    libunwind ncurses curl jansson texinfo
-    autoconf automake
+    libunwind ncurses curl jansson
  ];

  meta = with stdenv.lib; {
--- a/pkgs/applications/networking/instant-messengers/rambox/pro.nix
+++ b/pkgs/applications/networking/instant-messengers/rambox/pro.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "rambox-pro";
-  version = "1.1.4";
+  version = "1.1.6";

  dontBuild = true;
  dontStrip = true;
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/ramboxapp/download/releases/download/v${version}/RamboxPro-${version}-linux-x64.tar.gz";
-    sha256 = "0vwh3km3h46bgynd10s8ijl3aj5sskzncdj14h3k7h4sibd8r71a";
+    sha256 = "1jdamjdl649315ms5g1c7m7gpy04rv7xpy6bsvink242adaq2pjz";
  };

  installPhase = ''
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop-package.json
@ -2,7 +2,7 @@
  "name": "riot-web",
  "productName": "Riot",
  "main": "src/electron-main.js",
-  "version": "1.3.0",
+  "version": "1.3.3",
  "description": "A feature-rich client for Matrix.org",
  "author": "New Vector Ltd.",
  "dependencies": {
--- a/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-desktop.nix
@ -1,4 +1,4 @@
-{ pkgs, stdenv, fetchFromGitHub, makeWrapper, makeDesktopItem, electron, riot-web }:
+{ pkgs, stdenv, fetchFromGitHub, makeWrapper, makeDesktopItem, electron_5, riot-web }:

 # Note for maintainers:
 # Versions of `riot-web` and `riot-desktop` should be kept in sync.
@ -7,12 +7,12 @@ with (import ./yarn2nix.nix { inherit pkgs; });

 let
  executableName = "riot-desktop";
-  version = "1.3.0";
+  version = "1.3.3";
  riot-web-src = fetchFromGitHub {
    owner = "vector-im";
    repo = "riot-web";
    rev = "v${version}";
-    sha256 = "00142b0zcnwfdgvb84k2a0amyb67j3mm0d8p191aqk3bxv1xpxk1";
+    sha256 = "1nzzxcz4r9932cha80q1bzn1425m67fsl89pn7n7ybrv6y0jnxpc";
  };

 in mkYarnPackage rec {
@ -49,7 +49,7 @@ in mkYarnPackage rec {
    ln -s "${desktopItem}/share/applications" "$out/share/applications"

    # executable wrapper
-    makeWrapper '${electron}/bin/electron' "$out/bin/${executableName}" \
+    makeWrapper '${electron_5}/bin/electron' "$out/bin/${executableName}" \
      --add-flags "$out/share/riot/electron"
  '';

@ -82,7 +82,6 @@ in mkYarnPackage rec {
    homepage = https://about.riot.im/;
    license = licenses.asl20;
    maintainers = with maintainers; [ pacien worldofpeace ];
-    inherit (electron.meta) platforms;
+    inherit (electron_5.meta) platforms;
  };
 }
-
--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  name= "riot-web-${version}";
-  version = "1.3.0";
+  version = "1.3.3";

  src = fetchurl {
    url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "1rppxcc4m00bf73ghgli967wwrri2jdj865623pn8nk4kny4wxyq";
+    sha256 = "1n5h7q3h0akw09p4z7nwprxsa8jnmwbvwn2npq7zz62ccasb4fv9";
  };

  installPhase = let
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -1,18 +1,19 @@
 { stdenv, fetchurl, dpkg
 , alsaLib, atk, cairo, cups, curl, dbus, expat, fontconfig, freetype, gdk-pixbuf, glib, glibc, gnome2, gnome3
 , gtk3, libnotify, libpulseaudio, libsecret, libv4l, nspr, nss, pango, systemd, wrapGAppsHook, xorg
-, at-spi2-atk }:
+, at-spi2-atk, libuuid, at-spi2-core }:

 let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.50.0.38";
+  version = "8.51.0.72";

  rpath = stdenv.lib.makeLibraryPath [
    alsaLib
    atk
    at-spi2-atk
+    at-spi2-core
    cairo
    cups
    curl
@ -23,6 +24,7 @@ let
    glib
    glibc
    libsecret
+    libuuid

    gnome2.GConf
    gdk-pixbuf
@ -58,7 +60,7 @@ let
    if stdenv.hostPlatform.system == "x86_64-linux" then
      fetchurl {
        url = "https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb";
-        sha256 = "1g0aacp4qgzp3018w1s685yr3ssqlw0z2x6ifrj01k4ig82jfkn6";
+        sha256 = "1rv3jxirlfy0gvphw8cxmwmghbak5m5wj0y3bgamcvma48mzdfk3";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch-bower/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "notmuch-bower-${version}";
-  version = "0.10";
+  version = "0.11";

  src = fetchFromGitHub {
    owner = "wangp";
    repo = "bower";
    rev = version;
-    sha256 = "0jpaxlfxz7mj76z3cyj8sq053p0mkp46kaw05nimzwaq5yx923fv";
+    sha256 = "0vhac8yjnhb1gz60jfzg27spyn96c1rr849gc6vjym5xamw7zp0v";
  };

  nativeBuildInputs = [ gawk mercury pandoc ];
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@ -34,11 +34,11 @@

 stdenv.mkDerivation rec {
  name    = "zotero-${version}";
-  version = "5.0.71";
+  version = "5.0.73";

  src = fetchurl {
    url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "070b1ak870jv8h702a9g930p01jsmly93c44igw48ylbgqjyhlwq";
+    sha256 = "0m2i3l0gy22h6c7rk39cd17vyksyz5l5py2fn9pza8lcbypkwf3l";
  };

  buildInputs= [ wrapGAppsHook gsettings-desktop-schemas gtk3 gnome3.adwaita-icon-theme gnome3.dconf ];
--- a/pkgs/applications/science/misc/tulip/default.nix
+++ b/pkgs/applications/science/misc/tulip/default.nix
@ -1,13 +1,13 @@
 { fetchurl, stdenv, libxml2, freetype, libGLU_combined, glew, qt4
 , cmake, makeWrapper, libjpeg, python }:

-let version = "5.1.0"; in
+let version = "5.2.1"; in
 stdenv.mkDerivation rec {
  name = "tulip-${version}";

  src = fetchurl {
    url = "mirror://sourceforge/auber/${name}_src.tar.gz";
-    sha256 = "1i70y8b39gkpxfalr9844pa3l4bnnyw5y7ngxdqibil96k2b9q9h";
+    sha256 = "0bqmqy6sri87a8xv5xf7ffaq5zin4hiaa13g0l64b84i7yckfwky";
  };

  buildInputs = [ libxml2 freetype glew libGLU_combined qt4 libjpeg python ];
--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@ -8,13 +8,13 @@ with stdenv.lib;

 buildGoPackage rec {
  pname = "gitea";
-  version = "1.9.1";
+  version = "1.9.2";

  src = fetchFromGitHub {
    owner = "go-gitea";
    repo = "gitea";
    rev = "v${version}";
-    sha256 = "0sk877rp6zhch1b9c7zbmk8pnlyqjp4nws2gzq24qvw5f4chlprw";
+    sha256 = "1i7h6scycwzil87fcx1a19w5pl0986g5ax7y030w0wgmrq3zj53a";
    # Required to generate the same checksum on MacOS due to unicode encoding differences
    # More information: https://github.com/NixOS/nixpkgs/pull/48128
    extraPostFetch = ''
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -13,11 +13,11 @@ let
 in
 stdenv.mkDerivation rec {
  name = "gitkraken-${version}";
-  version = "6.1.3";
+  version = "6.1.4";

  src = fetchurl {
    url = "https://release.axocdn.com/linux/GitKraken-v${version}.deb";
-    sha256 = "1ciw9b5qjx2fm1v2n6v41b52qb5smfvgdb7pi5y99gkhx8w5ghqk";
+    sha256 = "10m6pwdwdxj6x64bc7mrvlvwkgqrd5prh9xx7xhvbz55q6gx4vdr";
  };

  libPath = makeLibraryPath [
--- a/pkgs/applications/video/celluloid/default.nix
+++ b/pkgs/applications/video/celluloid/default.nix
@ -0,0 +1,64 @@
+{ stdenv
+, fetchFromGitHub
+, meson
+, ninja
+, python3
+, gettext
+, pkgconfig
+, desktop-file-utils
+, wrapGAppsHook
+, appstream-glib
+, epoxy
+, glib
+, gtk3
+, mpv
+}:
+
+stdenv.mkDerivation rec {
+  pname = "celluloid";
+  version = "0.17";
+
+  src = fetchFromGitHub {
+    owner = "celluloid-player";
+    repo = "celluloid";
+    rev = "v${version}";
+    sha256 = "0pnxjv6n2q6igxdr8wzbahcj7vccw4nfjdk8fjdnaivf2lyrpv2d";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    python3
+    appstream-glib
+    gettext
+    pkgconfig
+    desktop-file-utils
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    epoxy
+    glib
+    gtk3
+    mpv
+  ];
+
+  postPatch = ''
+    patchShebangs meson-post-install.py src/generate-authors.py
+    sed -i '/gtk-update-icon-cache/s/^/#/' meson-post-install.py
+  '';
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    description = "Simple GTK+ frontend for the mpv video player";
+    longDescription = ''
+      GNOME MPV interacts with mpv via the client API exported by libmpv,
+      allowing access to mpv's powerful playback capabilities through an
+      easy-to-use user interface.
+    '';
+    homepage = "https://github.com/celluloid-player/celluloid";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/video/gnome-mpv/default.nix
+++ b/pkgs/applications/video/gnome-mpv/default.nix
@ -1,48 +0,0 @@
-{ stdenv, fetchFromGitHub, fetchpatch, meson, ninja, python3
-, gettext, pkgconfig, desktop-file-utils, wrapGAppsHook
-, appstream-glib, epoxy, glib, gtk3, mpv
-}:
-
-stdenv.mkDerivation rec {
-  pname = "gnome-mpv";
-  version = "0.16";
-
-  src = fetchFromGitHub {
-    owner = "celluloid-player";
-    repo = "celluloid";
-    rev = "v${version}";
-    sha256 = "1fj5mr1dwd07jpnigk7z85xdm6yaf7spbvf60aj3mz12m05b1b2w";
-  };
-
-  nativeBuildInputs = [ meson ninja python3 appstream-glib gettext pkgconfig desktop-file-utils wrapGAppsHook ];
-  buildInputs = [ epoxy glib gtk3 mpv ];
-
-  patches = [
-    # fix appstream validation in sandbox
-    # https://github.com/celluloid-player/celluloid/pull/437
-    (fetchpatch {
-      url = https://github.com/celluloid-player/celluloid/commit/5a0b2e892bb715278d309c859a7e521d64433d85.patch;
-      sha256 = "0naci8lr6128yilal39h46yvq9x3la7g7fhvr5xlwyh30iqrbm3i";
-    })
-  ];
-
-  postPatch = ''
-    patchShebangs meson_post_install.py
-    patchShebangs src/generate_authors.py
-    sed -i '/gtk-update-icon-cache/s/^/#/' meson_post_install.py
-  '';
-
-  doCheck = true;
-
-  meta = with stdenv.lib; {
-    description = "Simple GTK+ frontend for the mpv video player";
-    longDescription = ''
-      GNOME MPV interacts with mpv via the client API exported by libmpv,
-      allowing access to mpv's powerful playback capabilities through an
-      easy-to-use user interface.
-    '';
-    homepage = "https://github.com/celluloid-player/celluloid";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/video/shotcut/default.nix
+++ b/pkgs/applications/video/shotcut/default.nix
@ -7,13 +7,13 @@ assert stdenv.lib.versionAtLeast mlt.version "6.8.0";

 mkDerivation rec {
  name = "shotcut-${version}";
-  version = "19.07.15";
+  version = "19.08.16";

  src = fetchFromGitHub {
    owner = "mltframework";
    repo = "shotcut";
    rev = "v${version}";
-    sha256 = "0drl0x8x45kysalzx1pbg0gkvlxaykg9zka1fdkrl4iqfs4s7vv2";
+    sha256 = "0alnnfgimfs8fjddkcfx4pzyijwz5dgnqic5qazaza6f4kf60801";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/video/vlc/default.nix
+++ b/pkgs/applications/video/vlc/default.nix
@ -25,11 +25,11 @@ assert (withQt5 -> qtbase != null && qtsvg != null && qtx11extras != null && wra

 stdenv.mkDerivation rec {
  name = "vlc-${version}";
-  version = "3.0.7.1";
+  version = "3.0.8";

  src = fetchurl {
    url = "http://get.videolan.org/vlc/${version}/${name}.tar.xz";
-    sha256 = "1xb4c8n0hkwijzfdlbwadhxnx9z8rlhmrdq4c7q74rq9f51q0m86";
+    sha256 = "e0149ef4a20a19b9ecd87309c2d27787ee3f47dfd47c6639644bc1f6fd95bdf6";
  };

  # VLC uses a *ton* of libraries for various pieces of functionality, many of
--- a/pkgs/applications/virtualization/xen/4.8.nix
+++ b/pkgs/applications/virtualization/xen/4.8.nix
@ -43,6 +43,11 @@ let
    sha256 = "0gaz93kb33qc0jx6iphvny0yrd17i8zhcl3a9ky5ylc2idz0wiwa";
  };

+  # Ported from
+  #"https://xenbits.xen.org/gitweb/?p=qemu-xen.git;a=patch;h=e014dbe74e0484188164c61ff6843f8a04a8cb9d";
+  #"https://xenbits.xen.org/gitweb/?p=qemu-xen.git;a=patch;h=0e3b891fefacc0e49f3c8ffa3a753b69eb7214d2";
+  qemuGlusterfs6Fix = ./qemu-gluster-6-compat.diff;
+
  qemuDeps = [
    udev pciutils xorg.libX11 SDL pixman acl glusterfs spice-protocol usbredir
    alsaLib
@ -50,11 +55,11 @@ let
 in

 callPackage (import ./generic.nix (rec {
-  version = "4.8.3";
+  version = "4.8.5";

  src = fetchurl {
    url = "https://downloads.xenproject.org/release/xen/${version}/xen-${version}.tar.gz";
-    sha256 = "0vhkpyy5x7kc36hnav95fn194ngsmc3m2xcc78vccs00gdf6m8q9";
+    sha256 = "04xcf01jad1lpqnmjblzhnjzp0bss9fjd9awgcycjx679arbaxqz";
  };

  # Sources needed to build tools and firmwares.
@ -67,6 +72,7 @@ callPackage (import ./generic.nix (rec {
      };
      patches = [
        qemuMemfdBuildFix
+        qemuGlusterfs6Fix
      ];
      buildInputs = qemuDeps;
      meta.description = "Xen's fork of upstream Qemu";
@ -155,13 +161,8 @@ callPackage (import ./generic.nix (rec {
    ++ optional (withInternalOVMF) "--enable-ovmf";

  patches = with xsa; flatten [
-    # XSA_231 to XSA-251 are fixed in 4.8.3 (verified with git log)
-    XSA_252_49
    # 253: 4.8 not affected
    # 254: no patch supplied by xen project (Meltdown/Spectre)
-    XSA_255_49_1
-    XSA_255_49_2
-    XSA_256_48
    xenlockprofpatch
    xenpmdpatch
  ];
@ -176,10 +177,8 @@ callPackage (import ./generic.nix (rec {
      -i tools/libxl/libxl_device.c
  '';

-  passthru = {
-    qemu-system-i386 = if withInternalQemu
+  passthru.qemu-system-i386 = if withInternalQemu
      then "lib/xen/bin/qemu-system-i386"
      else throw "this xen has no qemu builtin";
-  };

 })) ({ ocamlPackages = ocaml-ng.ocamlPackages_4_05; } // args)
--- a/pkgs/applications/virtualization/xen/generic.nix
+++ b/pkgs/applications/virtualization/xen/generic.nix
@ -121,8 +121,8 @@ stdenv.mkDerivation (rec {

  patches = [ ./0000-fix-ipxe-src.patch
              ./0000-fix-install-python.patch
-              ./acpica-utils-20180427.patch]
-         ++ (config.patches or []);
+            ] ++ optional (versionOlder version "4.8.5") ./acpica-utils-20180427.patch
+            ++ (config.patches or []);

  postPatch = ''
    ### Hacks
--- a/pkgs/applications/virtualization/xen/qemu-gluster-6-compat.diff
+++ b/pkgs/applications/virtualization/xen/qemu-gluster-6-compat.diff
@ -0,0 +1,95 @@
+diff --git a/block/gluster.c b/block/gluster.c
+index 01b479fbb9..29552e1186 100644
+--- a/block/gluster.c
+++ b/block/gluster.c
+@@ -15,6 +15,10 @@
+ #include "qemu/uri.h"
+ #include "qemu/error-report.h"
+ 
+#ifdef CONFIG_GLUSTERFS_FTRUNCATE_HAS_STAT
+# define glfs_ftruncate(fd, offset) glfs_ftruncate(fd, offset, NULL, NULL)
+#endif
+
+ #define GLUSTER_OPT_FILENAME        "filename"
+ #define GLUSTER_OPT_VOLUME          "volume"
+ #define GLUSTER_OPT_PATH            "path"
+@@ -613,7 +617,11 @@ static void qemu_gluster_complete_aio(void *opaque)
+ /*
+  * AIO callback routine called from GlusterFS thread.
+  */
+-static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret, void *arg)
+static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret,
+#ifdef CONFIG_GLUSTERFS_IOCB_HAS_STAT
+                                 struct glfs_stat *pre, struct glfs_stat *post,
+#endif
+                                 void *arg)
+ {
+     GlusterAIOCB *acb = (GlusterAIOCB *)arg;
+ 
+diff --git a/configure b/configure
+index 4b808f9d17..89fb27fd0d 100755
+--- a/configure
+++ b/configure
+@@ -301,6 +301,8 @@ glusterfs=""
+ glusterfs_xlator_opt="no"
+ glusterfs_discard="no"
+ glusterfs_zerofill="no"
+glusterfs_ftruncate_has_stat="no"
+glusterfs_iocb_has_stat="no"
+ archipelago="no"
+ gtk=""
+ gtkabi=""
+@@ -3444,6 +3446,38 @@ if test "$glusterfs" != "no" ; then
+     if $pkg_config --atleast-version=6 glusterfs-api; then
+       glusterfs_zerofill="yes"
+     fi
+    cat > $TMPC << EOF
+#include <glusterfs/api/glfs.h>
+
+int
+main(void)
+{
+	/* new glfs_ftruncate() passes two additional args */
+	return glfs_ftruncate(NULL, 0, NULL, NULL);
+}
+EOF
+    if compile_prog "$glusterfs_cflags" "$glusterfs_libs" ; then
+      glusterfs_ftruncate_has_stat="yes"
+    fi
+    cat > $TMPC << EOF
+#include <glusterfs/api/glfs.h>
+
+/* new glfs_io_cbk() passes two additional glfs_stat structs */
+static void
+glusterfs_iocb(glfs_fd_t *fd, ssize_t ret, struct glfs_stat *prestat, struct glfs_stat *poststat, void *data)
+{}
+
+int
+main(void)
+{
+	glfs_io_cbk iocb = &glusterfs_iocb;
+	iocb(NULL, 0 , NULL, NULL, NULL);
+	return 0;
+}
+EOF
+    if compile_prog "$glusterfs_cflags" "$glusterfs_libs" ; then
+      glusterfs_iocb_has_stat="yes"
+    fi
+   else
+     if test "$glusterfs" = "yes" ; then
+       feature_not_found "GlusterFS backend support" \
+@@ -5415,6 +5449,14 @@ if test "$archipelago" = "yes" ; then
+   echo "ARCHIPELAGO_LIBS=$archipelago_libs" >> $config_host_mak
+ fi
+ 
+if test "$glusterfs_ftruncate_has_stat" = "yes" ; then
+  echo "CONFIG_GLUSTERFS_FTRUNCATE_HAS_STAT=y" >> $config_host_mak
+fi
+
+if test "$glusterfs_iocb_has_stat" = "yes" ; then
+  echo "CONFIG_GLUSTERFS_IOCB_HAS_STAT=y" >> $config_host_mak
+fi
+
+ if test "$libssh2" = "yes" ; then
+   echo "CONFIG_LIBSSH2=m" >> $config_host_mak
+   echo "LIBSSH2_CFLAGS=$libssh2_cflags" >> $config_host_mak
--- a/pkgs/applications/window-managers/sxhkd/default.nix
+++ b/pkgs/applications/window-managers/sxhkd/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  name = "sxhkd-${version}";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "baskerville";
    repo = "sxhkd";
    rev = version;
-    sha256 = "1cz4vkm7fqd51ly9qjkf5q76kdqdzfhaajgvrs4anz5dyzrdpw68";
+    sha256 = "0j7bl2l06r0arrjzpz7al9j6cwzc730knbsijp7ixzz96pq7xa2h";
  };

  buildInputs = [ asciidoc libxcb xcbutil xcbutilkeysyms xcbutilwm ];
--- a/pkgs/development/compilers/mosml/default.nix
+++ b/pkgs/development/compilers/mosml/default.nix
@ -6,7 +6,7 @@ stdenv.mkDerivation rec {

  buildInputs = [ gmp perl ];

-  makeFlags = "PREFIX=$(out)";
+  makeFlags = [ "PREFIX=$(out)" ] ++ stdenv.lib.optionals stdenv.isDarwin [ "CC=cc" ];

  src = fetchurl {
    url = "https://github.com/kfl/mosml/archive/ver-${version}.tar.gz";
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    '';
    homepage = https://mosml.org/;
    license = licenses.gpl2;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    maintainers = with maintainers; [ vaibhavsagar ];
  };
 }
--- a/pkgs/development/compilers/rust/default.nix
+++ b/pkgs/development/compilers/rust/default.nix
@ -66,6 +66,7 @@
        inherit CoreFoundation Security;
      };
      clippy = self.callPackage ./clippy.nix { inherit Security; };
+      rls = self.callPackage ./rls { inherit CoreFoundation Security; };
    });
  };
 }
--- a/pkgs/development/compilers/rust/rls/default.nix
+++ b/pkgs/development/compilers/rust/rls/default.nix
@ -4,17 +4,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "rls";
-  # with rust 1.x you can only build rls version 1.x.y
-  version = "1.36.0";
+  inherit (rustPlatform.rust.rustc) src version;

-  src = fetchFromGitHub {
-    owner = "rust-lang";
-    repo = pname;
-    rev = version;
-    sha256 = "1mclv0admxv48pndyqghxc4nf1amhbd700cgrzjshf9jrnffxmrn";
-  };
+  # changes hash of vendor directory otherwise
+  dontUpdateAutotoolsGnuConfigScripts = true;

-  cargoSha256 = "1yli9540510xmzqnzfi3p6rh23bjqsviflqw95a0fawf2rnj8sin";
+  cargoVendorDir = "vendor";
+  preBuild = ''
+    pushd src/tools/rls
+    # client tests are flaky
+    rm tests/client.rs
+  '';

  # a nightly compiler is required unless we use this cheat code.
  RUSTC_BOOTSTRAP=1;
@ -27,10 +27,8 @@ rustPlatform.buildRustPackage rec {
    ++ (stdenv.lib.optionals stdenv.isDarwin [ CoreFoundation Security ]);

  doCheck = true;
-  preCheck = ''
-    # client tests are flaky
-    rm tests/client.rs
-  '';
+
+  preInstall = "popd";

  doInstallCheck = true;
  installCheckPhase = ''
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@ -17,7 +17,7 @@ let
  , withSystemd ? config.php.systemd or stdenv.isLinux
  , imapSupport ? config.php.imap or (!stdenv.isDarwin)
  , ldapSupport ? config.php.ldap or true
-  , mhashSupport ? config.php.mhash or true
+  , mhashSupport ? config.php.mhash or false
  , mysqlndSupport ? config.php.mysqlnd or true
  , mysqliSupport ? config.php.mysqli or true
  , pdo_mysqlSupport ? config.php.pdo_mysql or true
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@ -21,6 +21,12 @@
 , sha256
 , passthruFun
 , bash
+, stripConfig ? false
+, stripIdlelib ? false
+, stripTests ? false
+, stripTkinter ? false
+, rebuildBytecode ? true
+, stripBytecode ? false
 }:

 assert x11Support -> tcl != null
@ -134,6 +140,7 @@ in with passthru; stdenv.mkDerivation {
    "--without-ensurepip"
    "--with-system-expat"
    "--with-system-ffi"
+  ] ++ optionals (openssl != null) [
    "--with-openssl=${openssl.dev}"
  ] ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
    "ac_cv_buggy_getaddrinfo=no"
@ -221,8 +228,20 @@ in with passthru; stdenv.mkDerivation {
    find $out/lib/python*/config-* -type f -print -exec nuke-refs -e $out '{}' +
    find $out/lib -name '_sysconfigdata*.py*' -print -exec nuke-refs -e $out '{}' +

+    '' + optionalString stripConfig ''
+    rm -R $out/bin/python*-config $out/lib/python*/config-*
+    '' + optionalString stripIdlelib ''
+    # Strip IDLE (and turtledemo, which uses it)
+    rm -R $out/bin/idle* $out/lib/python*/{idlelib,turtledemo}
+    '' + optionalString stripTkinter ''
+    rm -R $out/lib/python*/tkinter
+    '' + optionalString stripTests ''
+    # Strip tests
+    rm -R $out/lib/python*/test $out/lib/python*/**/test{,s}
+    '' + ''
    # Include a sitecustomize.py file
    cp ${../sitecustomize.py} $out/${sitePackages}/sitecustomize.py
+    '' + optionalString rebuildBytecode ''

    # Determinism: rebuild all bytecode
    # We exclude lib2to3 because that's Python 2 code which fails
@ -232,6 +251,8 @@ in with passthru; stdenv.mkDerivation {
    find $out -name "*.py" | ${pythonForBuildInterpreter}     -m compileall -q -f -x "lib2to3" -i -
    find $out -name "*.py" | ${pythonForBuildInterpreter} -O  -m compileall -q -f -x "lib2to3" -i -
    find $out -name "*.py" | ${pythonForBuildInterpreter} -OO -m compileall -q -f -x "lib2to3" -i -
+    '' + optionalString stripBytecode ''
+    find $out -type d -name __pycache__ -print0 | xargs -0 -I {} rm -rf "{}"
  '';

  preFixup = stdenv.lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
@ -241,9 +262,9 @@ in with passthru; stdenv.mkDerivation {

  # Enforce that we don't have references to the OpenSSL -dev package, which we
  # explicitly specify in our configure flags above.
-  disallowedReferences = [
-    openssl.dev
-  ] ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
+  disallowedReferences =
+    stdenv.lib.optionals (openssl != null) [ openssl.dev ]
+    ++ stdenv.lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
    # Ensure we don't have references to build-time packages.
    # These typically end up in shebangs.
    pythonForBuild buildPackages.bash
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -111,6 +111,38 @@ in {
    inherit passthruFun;
  };

+  # Minimal versions of Python (built without optional dependencies)
+  python3Minimal = (callPackage ./cpython {
+    self = python3Minimal;
+    sourceVersion = {
+      major = "3";
+      minor = "7";
+      patch = "4";
+      suffix = "";
+    };
+    sha256 = "0gxiv5617zd7dnqm5k9r4q2188lk327nf9jznwq9j6b8p0s92ygv";
+    inherit (darwin) CF configd;
+    inherit passthruFun;
+
+    # strip down that python version as much as possible
+    openssl = null;
+    readline = null;
+    ncurses = null;
+    gdbm = null;
+    sqlite = null;
+    stripConfig = true;
+    stripIdlelib = true;
+    stripTests = true;
+    stripTkinter = true;
+    rebuildBytecode = false;
+    stripBytecode = true;
+  }).overrideAttrs(old: {
+    pname = "python3-minimal";
+    meta = old.meta // {
+      maintainers = [];
+    };
+  });
+
  pypy27 = callPackage ./pypy {
    self = pypy27;
    sourceVersion = {
--- a/pkgs/development/libraries/graphene/0001-meson-add-options-for-tests-installation-dirs.patch
+++ b/pkgs/development/libraries/graphene/0001-meson-add-options-for-tests-installation-dirs.patch
@ -1,34 +1,31 @@
-From c550bf4a41e9f86351b0a65ea3d6c9ab616e27c0 Mon Sep 17 00:00:00 2001
+From 2bf6614a6d7516e194e39eb691c05b486860153c Mon Sep 17 00:00:00 2001
 From: worldofpeace <worldofpeace@protonmail.ch>
 Date: Thu, 16 May 2019 21:15:15 -0400
 Subject: [PATCH] meson: add options for tests installation dirs

 ---
- meson_options.txt     |  6 ++++++
- src/tests/meson.build | 19 ++++++++++++++-----
+ meson_options.txt |  6 ++++++
+ tests/meson.build | 19 ++++++++++++++-----
 2 files changed, 20 insertions(+), 5 deletions(-)

 diff --git a/meson_options.txt b/meson_options.txt
-index c938805..c1e9e95 100644
+index 578bdae..6f5fa23 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -19,6 +19,12 @@ option('arm_neon', type: 'boolean',
- option('tests', type: 'boolean',
+@@ -22,3 +22,9 @@ option('tests', type: 'boolean',
+ option('installed_tests', type: 'boolean',
        value: true,
-        description: 'Build the test suite (requires GObject)')
+        description: 'Install tests')
 +option('installed_test_datadir', type: 'string',
 +       value: '',
 +       description: 'Installation directory for data files in tests')
 +option('installed_test_bindir', type: 'string',
 +       value: '',
 +       description: 'Installation directory for binary files in tests')
- option('benchmarks', type: 'boolean',
-        value: true,
-        description: 'Build the benchmarks suite (requires GObject)')
-diff --git a/src/tests/meson.build b/src/tests/meson.build
-index 62129c6..0186400 100644
--- a/src/tests/meson.build
-+++ b/src/tests/meson.build
+diff --git a/tests/meson.build b/tests/meson.build
+index 1f9bd0e..0253ac3 100644
+--- a/tests/meson.build
+++ b/tests/meson.build
@@ -22,8 +22,17 @@ unit_tests = [
 python = python3.find_python()
 gen_installed_test = join_paths(meson.current_source_dir(), 'gen-installed-test.py')
@ -47,33 +44,33 @@ index 62129c6..0186400 100644
 +    test_bindir = join_paths(get_option('prefix'), get_option('libexecdir'), test_suffix)
 +endif
 
- foreach unit: unit_tests
-   wrapper = '@0@.test'.format(unit)
-@@ -32,13 +41,13 @@ foreach unit: unit_tests
-                        command: [
-                          python,
-                          gen_installed_test,
-                         '--testdir=@0@'.format(installed_test_bindir),
-+                         '--testdir=@0@'.format(test_bindir),
-                          '--testname=@0@'.format(unit),
-                          '--outdir=@OUTDIR@',
-                          '--outfile=@0@'.format(wrapper),
-                        ],
-                        install: true,
-                       install_dir: installed_test_datadir)
-+                       install_dir: test_datadir)
+ # Make tests conditional on having mutest-1 installed system-wide, or
+ # available as a subproject
+@@ -42,13 +51,13 @@ if mutest_dep.found()
+       command: [
+         python,
+         gen_installed_test,
+-        '--testdir=@0@'.format(installed_test_bindir),
+        '--testdir=@0@'.format(test_bindir),
+         '--testname=@0@'.format(unit),
+         '--outdir=@OUTDIR@',
+         '--outfile=@0@'.format(wrapper),
+       ],
+       install: get_option('installed_tests'),
+-      install_dir: installed_test_datadir,
+      install_dir: test_datadir,
+     )
 
-   exe = executable(unit, unit + '.c',
-                    dependencies: graphene_dep,
-@@ -50,7 +59,7 @@ foreach unit: unit_tests
-                      '-DGLIB_DISABLE_DEPRECATION_WARNINGS',
-                    ],
-                    install: true,
-                   install_dir: installed_test_bindir)
-+                   install_dir: test_bindir)
- 
-   test(unit, exe, args: [ '--tap', '-k' ])
- endforeach
+     test(unit,
+@@ -57,7 +66,7 @@ if mutest_dep.found()
+         include_directories: graphene_inc,
+         c_args: common_cflags,
+         install: get_option('installed_tests'),
+-        install_dir: installed_test_bindir,
+        install_dir: test_bindir,
+       ),
+       env: ['MUTEST_OUTPUT=tap'],
+       protocol: 'tap',
 -- 
-2.21.0
+2.22.0

--- a/pkgs/development/libraries/graphene/default.nix
+++ b/pkgs/development/libraries/graphene/default.nix
@ -4,6 +4,7 @@
 , meson
 , ninja
 , python3
+, mutest
 , glib
 , gtk-doc
 , docbook_xsl
@ -13,7 +14,7 @@

 stdenv.mkDerivation rec {
  pname = "graphene";
-  version = "1.8.6";
+  version = "1.9.6";

  outputs = [ "out" "devdoc" "installedTests" ];

@ -21,7 +22,7 @@ stdenv.mkDerivation rec {
    owner = "ebassi";
    repo = pname;
    rev = version;
-    sha256 = "1hdbdzcz86jrvsq5h954ph9q62m8jr2a5s5acklxhdkfqn5bkbv8";
+    sha256 = "0hb7s6g00l7zlf4hlfda55krn0pls9ajz0hcqrh8m656zr18ddwa";
  };

  patches = [
@ -41,17 +42,21 @@ stdenv.mkDerivation rec {
    meson
    ninja
    pkgconfig
+    gobject-introspection
    python3
  ];

  buildInputs = [
+    glib
    gobject-introspection
  ];

  checkInputs = [
-    glib
+    mutest
  ];

+  doCheck = true;
+
  meta = with stdenv.lib; {
    description = "A thin layer of graphic data types";
    homepage = "https://ebassi.github.com/graphene";
--- a/pkgs/development/libraries/gthree/default.nix
+++ b/pkgs/development/libraries/gthree/default.nix
@ -0,0 +1,72 @@
+{ stdenv
+, fetchFromGitHub
+, fetchpatch
+, ninja
+, meson
+, pkgconfig
+, gobject-introspection
+, gtk-doc
+, docbook_xsl
+, docbook_xml_dtd_43
+, glib
+, gtk3
+, graphene
+, epoxy
+, json-glib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gthree";
+  version = "unstable-2019-08-21";
+
+  outputs = [ "out" "dev" "devdoc" ];
+
+  src = fetchFromGitHub {
+    owner = "alexlarsson";
+    repo = "gthree";
+    rev = "dac46b0f35e29319c004c7e17b5f345ef4c04cb8";
+    sha256 = "16ixis2g04000zffm44s7ir64vn3byz9a793g2s76aasqybl86i2";
+  };
+
+  patches = [
+    # correctly declare json-glib in .pc file
+    # https://github.com/alexlarsson/gthree/pull/61
+    (fetchpatch {
+      url = https://github.com/alexlarsson/gthree/commit/784b1f20e0b6eb15f113a51f74c2cba871249861.patch;
+      sha256 = "07vxafaxris5a98w751aw04nlw0l45np1lba08xd16wdzmkadz0x";
+    })
+  ];
+
+  nativeBuildInputs = [
+    ninja
+    meson
+    pkgconfig
+    gtk-doc
+    docbook_xsl
+    docbook_xml_dtd_43
+    gobject-introspection
+  ];
+
+  buildInputs = [
+    epoxy
+  ];
+
+  propagatedBuildInputs = [
+    glib
+    gtk3
+    graphene
+    json-glib
+  ];
+
+  mesonFlags = [
+    "-Dgtk_doc=${if stdenv.isDarwin then "false" else "true"}"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "GObject/GTK port of three.js";
+    homepage = https://github.com/alexlarsson/gthree;
+    license = licenses.mit;
+    maintainers = with maintainers; [ jtojnar ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/libraries/libosmium/default.nix
+++ b/pkgs/development/libraries/libosmium/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "libosmium-${version}";
-  version = "2.15.1";
+  version = "2.15.2";

  src = fetchFromGitHub {
    owner = "osmcode";
    repo = "libosmium";
    rev = "v${version}";
-    sha256 = "1v1m068lcjngxnwirpi0vqjhqnxn9gqvafjp3sy14vzmgl2sw2kr";
+    sha256 = "1fh8wl4grs1c0g9whx90kd4jva3k9b6zbb1cl3isay489gwndgss";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/libressl/default.nix
+++ b/pkgs/development/libraries/libressl/default.nix
@ -13,7 +13,15 @@ let

    nativeBuildInputs = [ cmake ];

-    cmakeFlags = [ "-DENABLE_NC=ON" "-DBUILD_SHARED_LIBS=ON" ];
+    cmakeFlags = [
+      "-DENABLE_NC=ON"
+      "-DBUILD_SHARED_LIBS=ON"
+      # Ensure that the output libraries do not require an executable stack.
+      # Without this define, assembly files in libcrypto do not include a
+      # .note.GNU-stack section, and if that section is missing from any object,
+      # the linker will make the stack executable.
+      "-DCMAKE_C_FLAGS=-DHAVE_GNU_STACK"
+    ];

    # The autoconf build is broken as of 2.9.1, resulting in the following error:
    # libressl-2.9.1/tls/.libs/libtls.a', needed by 'handshake_table'.
--- a/pkgs/development/libraries/libvisio/default.nix
+++ b/pkgs/development/libraries/libvisio/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  name = "libvisio-${version}";
-  version = "0.1.6";
+  version = "0.1.7";

  outputs = [ "out" "bin" "dev" "doc" ];

  src = fetchurl {
    url = "https://dev-www.libreoffice.org/src/libvisio/${name}.tar.xz";
-    sha256 = "1yahpfl13qk6178irv8jn5ppxdn7isafqisyqsdw0lqxcz9h447y";
+    sha256 = "0k7adcbbf27l7n453cca1m6s9yj6qvb5j6bsg2db09ybf3w8vbwg";
  };

  nativeBuildInputs = [ pkgconfig cppunit doxygen ];
--- a/pkgs/development/libraries/mutest/default.nix
+++ b/pkgs/development/libraries/mutest/default.nix
@ -0,0 +1,34 @@
+{ stdenv
+, fetchFromGitHub
+, meson
+, ninja
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mutest";
+  version = "unstable-2019-10-12";
+
+  outputs = [ "out" "dev" ];
+
+  src = fetchFromGitHub {
+    owner = "ebassi";
+    repo = "mutest";
+    rev = "822b5ddf07f957135ba39889d81e513d525b9b8e";
+    sha256 = "0a5fjdq9p0q5bibqngbbpd9lga0gzrv8yj5wgdfb8ylxzg0jph2p";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
+  doCheck = true;
+
+  meta = with stdenv.lib; {
+    homepage = https://ebassi.github.io/mutest/mutest.md.html;
+    description = "A BDD testing framework for C, inspired by Mocha";
+    license = licenses.mit;
+    maintainers = with maintainers; [ jtojnar worldofpeace ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/libraries/science/math/sympow/default.nix
+++ b/pkgs/development/libraries/science/math/sympow/default.nix
@ -9,7 +9,7 @@
 }:

 stdenv.mkDerivation rec {
-  version = "2.023.4";
+  version = "2.023.5";
  name = "sympow-${version}";

  src = fetchFromGitLab {
@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
    owner = "forks";
    repo = "sympow";
    rev = "v${version}";
-    sha256 = "0j2qdw9csbr081h8arhlx1z7ibgi5am4ndmvyc8y4hccfa8n4w1y";
+    sha256 = "1c5a2pizgqsf3pjkf7rfj20022ym4ixhrddp8ivs2nbzxwz6qvv9";
  };

  postUnpack = ''
--- a/pkgs/development/libraries/wcslib/default.nix
+++ b/pkgs/development/libraries/wcslib/default.nix
@ -1,14 +1,14 @@
 { fetchurl,  stdenv, flex }:

 stdenv.mkDerivation rec {
-  version = "6.3";
+  version = "6.4";
  name = "wcslib-${version}";

  buildInputs = [ flex ];

  src = fetchurl {
    url = "ftp://ftp.atnf.csiro.au/pub/software/wcslib/${name}.tar.bz2";
-    sha256 ="1si272bms58yv1zmymx9ypx1ycka8bfqy8wk03rvl6nmciyz0dsc";
+    sha256 ="003h23m6d5wcs29v2vbnl63f3z35k5x70lpsqlz5c9bp1bvizh8k";
  };

  prePatch = ''
--- a/pkgs/development/libraries/wxSVG/default.nix
+++ b/pkgs/development/libraries/wxSVG/default.nix
@ -7,11 +7,11 @@ stdenv.mkDerivation rec {

  name = "wxSVG-${version}";
  srcName = "wxsvg-${version}";
-  version = "1.5.19";
+  version = "1.5.20";

  src = fetchurl {
    url = "mirror://sourceforge/project/wxsvg/wxsvg/${version}/${srcName}.tar.bz2";
-    sha256 = "17hgaqxf2y44j1d9z11p107sk7n7m1f9nkaz7z6450pan4zphy1z";
+    sha256 = "17j5j61l5mv7x0ncsm1kv3k5mmjqyxfpddjn7j84wdgrj62xldhm";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/development/libraries/xxHash/default.nix
+++ b/pkgs/development/libraries/xxHash/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  name = "xxHash-${version}";
-  version = "0.7.0";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "Cyan4973";
    repo = "xxHash";
    rev = "v${version}";
-    sha256 = "19iyr7x0s7in9kp9wrj4iimdx58nv6jndz9x5ndnl07gd90y7jxb";
+    sha256 = "0hh1ypwk86m3b0x4433k95f94b48kvl7s79dml0f3g0cv8jdvkgw";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@ -10,6 +10,26 @@ self: super:
 with self;
 {

+alt-getopt = buildLuarocksPackage {
+  pname = "alt-getopt";
+  version = "0.8.0-1";
+
+  src = fetchurl {
+    url    = https://luarocks.org/alt-getopt-0.8.0-1.src.rock;
+    sha256 = "1mi97dqb97sf47vb6wrk12yf1yxcaz0asr9gbgwyngr5n1adh5i3";
+  };
+  disabled = (luaOlder "5.1") || (luaAtLeast "5.4");
+  propagatedBuildInputs = [ lua ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/cheusov/lua-alt-getopt";
+    description = "Process application arguments the same way as getopt_long";
+    maintainers = with maintainers; [ arobyn ];
+    license = {
+      fullName = "MIT/X11";
+    };
+  };
+};
 ansicolors = buildLuarocksPackage {
  pname = "ansicolors";
  version = "1.0.2-3";
@ -1190,6 +1210,26 @@ mpack = buildLuarocksPackage {
    };
  };
 };
+moonscript = buildLuarocksPackage {
+  pname = "moonscript";
+  version = "0.5.0-1";
+
+  src = fetchurl {
+    url    = https://raw.githubusercontent.com/rocks-moonscript-org/moonrocks-mirror/master/moonscript-0.5.0-1.src.rock;
+    sha256 = "09vv3ayzg94bjnzv5fw50r683ma0x3lb7sym297145zig9aqb9q9";
+  };
+  disabled = (luaOlder "5.1");
+  propagatedBuildInputs = [ lua lpeg alt-getopt luafilesystem ];
+
+  meta = with stdenv.lib; {
+    homepage = "http://moonscript.org";
+    description = "A programmer friendly language that compiles to Lua";
+    maintainers = with maintainers; [ arobyn ];
+    license = {
+      fullName = "MIT";
+    };
+  };
+};
 nvim-client = buildLuarocksPackage {
  pname = "nvim-client";
  version = "0.2.0-1";
--- a/pkgs/development/misc/google-clasp/README.md
+++ b/pkgs/development/misc/google-clasp/README.md
@ -0,0 +1,6 @@
+## How to update
+
+1. bump version of `@google/clasp` in [node-packages.json](./node-packages.json)
+2. run [generate.sh](./generate.sh)
+3. set the same version in [default.nix](./default.nix)
+4. build and test it
--- a/pkgs/development/misc/google-clasp/default.nix
+++ b/pkgs/development/misc/google-clasp/default.nix
@ -0,0 +1,19 @@
+{ stdenv, pkgs }:
+let
+  version = "2.2.1";
+in
+(import ./google-clasp.nix {
+  inherit pkgs;
+  inherit (stdenv.hostPlatform) system;
+})."@google/clasp-${version}".override rec {
+  preRebuild = ''
+    patch -p1 <<<"${builtins.readFile ./dotf.patch}"
+  '';
+  meta = {
+    description = "Command Line tool for Google Apps Script Projects";
+    homepage = https://developers.google.com/apps-script/guides/clasp;
+    license = stdenv.lib.licenses.asl20;
+    maintainers = [ stdenv.lib.maintainers.michojel ];
+    priority = 100;
+  };
+}
--- a/pkgs/development/misc/google-clasp/dotf.patch
+++ b/pkgs/development/misc/google-clasp/dotf.patch
@ -0,0 +1,13 @@
+Index: nodejs/tmp/xcindf87mmqyp0x5blima5q2m9fw3dx3-node__at_google_slash_clasp-2.2.1/lib/node_modules/@google/clasp/src/dotfile.js
+===================================================================
+--- clasp.orig/src/dotfile.js
+++ clasp/src/dotfile.js
+@@ -94,7 +94,7 @@ exports.DOTFILE = {
+         return dotf(projectPath ? path_1.default.dirname(projectPath) : exports.DOT.PROJECT.DIR, exports.DOT.PROJECT.NAME);
+     },
+     // Stores {ClaspCredentials}
+-    RC: dotf(exports.DOT.RC.DIR, exports.DOT.RC.NAME),
+    RC: dotf.default(exports.DOT.RC.DIR, exports.DOT.RC.NAME),
+     // Stores {ClaspCredentials}
+     RC_LOCAL: function () {
+         var localPath = find_up_1.default.sync(exports.DOT.PROJECT.PATH);
--- a/pkgs/development/misc/google-clasp/generate.sh
+++ b/pkgs/development/misc/google-clasp/generate.sh
@ -0,0 +1,9 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p nodePackages.node2nix
+
+set -eu -o pipefail
+
+exec node2nix --nodejs-10 \
+    -i node-packages.json -o node-packages.nix \
+    -c google-clasp.nix \
+     --no-copy-node-env -e ../../../development/node-packages/node-env.nix
--- a/pkgs/development/misc/google-clasp/google-clasp.nix
+++ b/pkgs/development/misc/google-clasp/google-clasp.nix
@ -0,0 +1,17 @@
+# This file has been generated by node2nix 1.6.0. Do not edit!
+
+{pkgs ? import <nixpkgs> {
+    inherit system;
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-10_x"}:
+
+let
+  nodeEnv = import ../../node-packages/node-env.nix {
+    inherit (pkgs) stdenv python2 utillinux runCommand writeTextFile;
+    inherit nodejs;
+    libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null;
+  };
+in
+import ./node-packages.nix {
+  inherit (pkgs) fetchurl fetchgit;
+  inherit nodeEnv;
+}
--- a/pkgs/development/misc/google-clasp/node-packages.json
+++ b/pkgs/development/misc/google-clasp/node-packages.json
@ -0,0 +1,3 @@
+[
+  {"@google/clasp": "2.2.1"}
+]
--- a/pkgs/development/misc/google-clasp/node-packages.nix
+++ b/pkgs/development/misc/google-clasp/node-packages.nix
--- a/pkgs/development/ocaml-modules/cohttp/default.nix
+++ b/pkgs/development/ocaml-modules/cohttp/default.nix
@ -1,22 +1,22 @@
 { lib, fetchFromGitHub, buildDunePackage
 , ppx_fields_conv, ppx_sexp_conv
-, base64, fieldslib, jsonm, re, stringext, uri
+, base64, fieldslib, jsonm, re, stringext, uri-sexp
 }:

 buildDunePackage rec {
  pname = "cohttp";
-	version = "2.0.0";
+	version = "2.1.3";

 	src = fetchFromGitHub {
 		owner = "mirage";
 		repo = "ocaml-cohttp";
 		rev = "v${version}";
-		sha256 = "0nz9y7l5s9a2rq5sb1m5705h99wvf4dk3fhcgragwhy5nwwzcya8";
+		sha256 = "16k4ldmz6ljryhr139adlma130frb5wh13qswkrwc5gxx6d2wh8d";
 	};

 	buildInputs = [ jsonm ppx_fields_conv ppx_sexp_conv ];

-	propagatedBuildInputs = [ base64 fieldslib re stringext uri ];
+	propagatedBuildInputs = [ base64 fieldslib re stringext uri-sexp ];

 	meta = {
 		description = "HTTP(S) library for Lwt, Async and Mirage";
--- a/pkgs/development/ocaml-modules/uri/default.nix
+++ b/pkgs/development/ocaml-modules/uri/default.nix
@ -1,5 +1,5 @@
-{ lib, fetchurl, buildDunePackage, ppx_sexp_conv, ounit
-, re, sexplib0, stringext
+{ lib, fetchurl, buildDunePackage, ounit
+, re, stringext
 }:

 buildDunePackage rec {
@ -12,7 +12,7 @@ buildDunePackage rec {
  };

  buildInputs = [ ounit ];
-  propagatedBuildInputs = [ ppx_sexp_conv re sexplib0 stringext ];
+  propagatedBuildInputs = [ re stringext ];
  doCheck = true;

  meta = {
--- a/pkgs/development/ocaml-modules/uri/sexp.nix
+++ b/pkgs/development/ocaml-modules/uri/sexp.nix
@ -0,0 +1,13 @@
+{ lib, ocaml, buildDunePackage, uri, ounit, ppx_sexp_conv, sexplib0 }:
+
+if !lib.versionAtLeast ocaml.version "4.04"
+then throw "uri-sexp is not available for OCaml ${ocaml.version}"
+else
+
+buildDunePackage {
+  pname = "uri-sexp";
+  inherit (uri) version src doCheck meta;
+
+  buildInputs = [ ounit ];
+  propagatedBuildInputs = [ ppx_sexp_conv sexplib0 uri ];
+}
--- a/pkgs/development/python-modules/crc16/default.nix
+++ b/pkgs/development/python-modules/crc16/default.nix
@ -0,0 +1,18 @@
+{ stdenv, buildPythonPackage, fetchPypi }:
+
+buildPythonPackage rec {
+  pname = "crc16";
+  version = "0.1.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "15nkx0pa4lskwin84flpk8fsw3jqg6wic6v3s83syjqg76h6my61";
+  };
+
+  meta = with stdenv.lib; {
+    homepage = "https://code.google.com/archive/p/pycrc16/";
+    description = "Python library for calculating CRC16";
+    license = licenses.lgpl3;
+    maintainers = with maintainers; [ abbradar ];
+  };
+}
--- a/pkgs/development/python-modules/foxdot/default.nix
+++ b/pkgs/development/python-modules/foxdot/default.nix
@ -0,0 +1,23 @@
+{ stdenv, buildPythonPackage, fetchPypi, tkinter, supercollider }:
+
+buildPythonPackage rec {
+  pname = "FoxDot";
+  version = "0.8.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "147n2c9rwmrby8rr6xfxlh7mfm12lqk2a7v1gxlzhq1i2jj1j5h4";
+  };
+
+  propagatedBuildInputs = [ tkinter supercollider ];
+
+  # Requires a running SuperCollider instance
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Live coding music with SuperCollider";
+    homepage = https://foxdot.org/;
+    license = licenses.cc-by-sa-40;
+    maintainers = with maintainers; [ mrmebelman ];
+  };
+}
--- a/pkgs/development/python-modules/geojson/default.nix
+++ b/pkgs/development/python-modules/geojson/default.nix
@ -2,13 +2,13 @@

 buildPythonPackage rec {
  pname = "geojson";
-  version = "2.4.1";
+  version = "2.5.0";

  format = "wheel";

  src = fetchPypi {
    inherit pname version format;
-    sha256 = "12k4g993qqgrhq2mgy5k8rhm5a2s2hbn769rs5fwbc5lwv4bbgxj";
+    sha256 = "1filqm050ixy53kdv81bd4n80vjvfapnmzizy7jg8a6pilv17gfc";
  };

  LC_ALL = "en_US.UTF-8";
--- a/pkgs/development/python-modules/nltk/default.nix
+++ b/pkgs/development/python-modules/nltk/default.nix
@ -1,13 +1,13 @@
 { fetchPypi, buildPythonPackage, lib, six, singledispatch, isPy3k }:

 buildPythonPackage rec {
-  version = "3.4.4";
+  version = "3.4.5";
  pname = "nltk";

  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    sha256 = "1dbwwhsbsp31bvvksq7kyrfs6s27lp8wgwqs4qf6hajkz2jj0k3n";
+    sha256 = "153x2clrnigs74jdgnn3qmljdjj4gprmvpdvh49i18ls4m8mbm5y";
  };

  propagatedBuildInputs = [ six ] ++ lib.optional (!isPy3k) singledispatch;
--- a/pkgs/development/python-modules/wsproto/0.14.nix
+++ b/pkgs/development/python-modules/wsproto/0.14.nix
@ -0,0 +1,25 @@
+{ lib, buildPythonPackage, fetchPypi, h11, enum34, pytest }:
+
+buildPythonPackage rec {
+  pname = "wsproto";
+  version = "0.14.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "051s127qb5dladxa14n9nqajwq7xki1dz1was5r5v9df5a0jq8pd";
+  };
+
+  propagatedBuildInputs = [ h11 enum34 ];
+
+  checkInputs = [ pytest ];
+
+  checkPhase = ''
+    py.test
+  '';
+
+  meta = with lib; {
+    description = "Pure Python, pure state-machine WebSocket implementation";
+    homepage = https://github.com/python-hyper/wsproto/;
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/python-modules/wsproto/default.nix
+++ b/pkgs/development/python-modules/wsproto/default.nix
@ -1,15 +1,20 @@
-{ lib, buildPythonPackage, fetchPypi, h11, enum34, pytest }:
+{ lib, buildPythonPackage, fetchPypi, pythonOlder, isPy36
+, dataclasses
+, h11
+, pytest
+}:

 buildPythonPackage rec {
  pname = "wsproto";
-  version = "0.14.1";
+  version = "0.15.0";
+  disabled = pythonOlder "3.6"; # python versions <3.6

  src = fetchPypi {
    inherit pname version;
-    sha256 = "051s127qb5dladxa14n9nqajwq7xki1dz1was5r5v9df5a0jq8pd";
+    sha256 = "17gsxlli4w8am1wwwl3k90hpdfa213ax40ycbbvb7hjx1v1rhiv1";
  };

-  propagatedBuildInputs = [ h11 enum34 ];
+  propagatedBuildInputs = [ h11 ] ++ lib.optional isPy36 dataclasses;

  checkInputs = [ pytest ];

--- a/pkgs/development/python-modules/xdis/default.nix
+++ b/pkgs/development/python-modules/xdis/default.nix
@ -1,18 +1,18 @@
-{ stdenv
-, buildPythonPackage
-, fetchPypi
+{ lib, buildPythonPackage, fetchFromGitHub
+, click
 , pytest
 , six
-, click
 }:

 buildPythonPackage rec {
  pname = "xdis";
-  version = "4.0.1";
+  version = "4.0.3";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1ifakxxawyxw4w4p58m4xdc0c955miqyaq3dfbl386ipw0f50kyz";
+  src = fetchFromGitHub {
+    owner = "rocky";
+    repo = "python-xdis";
+    rev = version;
+    sha256 = "1h4j8hincf49zyd0rvn4bh0ypj8836y8vz3d496ycb9gjzkr6044";
  };

  checkInputs = [ pytest ];
@ -22,7 +22,7 @@ buildPythonPackage rec {
    make check
  '';

-  meta = with stdenv.lib; {
+  meta = with lib; {
    description = "Python cross-version byte-code disassembler and marshal routines";
    homepage = https://github.com/rocky/python-xdis/;
    license = licenses.gpl2;
--- a/pkgs/development/tools/aws-sam-cli/default.nix
+++ b/pkgs/development/tools/aws-sam-cli/default.nix
@ -56,7 +56,7 @@ buildPythonApplication rec {
  ];

  postPatch = ''
-    substituteInPlace requirements/base.txt --replace "requests==2.20.1" "requests==2.21.0"
+    substituteInPlace requirements/base.txt --replace "requests==2.20.1" "requests==2.22.0"
    substituteInPlace requirements/base.txt --replace "six~=1.11.0" "six~=1.12.0"
    substituteInPlace requirements/base.txt --replace "PyYAML~=3.12" "PyYAML~=5.1"
  '';
--- a/pkgs/development/tools/cbor-diag/Gemfile.lock
+++ b/pkgs/development/tools/cbor-diag/Gemfile.lock
@ -1,10 +1,12 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    cbor-diag (0.5.2)
+    cbor-diag (0.5.6)
      json
+      neatjson
      treetop (~> 1)
-    json (2.1.0)
+    json (2.2.0)
+    neatjson (0.9)
    polyglot (0.3.5)
    treetop (1.6.10)
      polyglot (~> 0.3)
@ -16,4 +18,4 @@ DEPENDENCIES
  cbor-diag

 BUNDLED WITH
-   1.14.6
+   1.17.2
--- a/pkgs/development/tools/cbor-diag/gemset.nix
+++ b/pkgs/development/tools/cbor-diag/gemset.nix
@ -1,22 +1,38 @@
 {
  cbor-diag = {
-    dependencies = ["json" "treetop"];
+    dependencies = ["json" "neatjson" "treetop"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1g4pxf1ag4pyb351m06l08ig1smnf8w27ynqfxkgmwak5mh1z7w1";
+      sha256 = "0pd0k4malg1l7w3ck5glh9w0hrsvknk8rp32vrir74yww1g6yplv";
      type = "gem";
    };
-    version = "0.5.2";
+    version = "0.5.6";
  };
  json = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "01v6jjpvh3gnq6sgllpfqahlgxzj50ailwhj9b3cd20hi2dx0vxp";
+      sha256 = "0sx97bm9by389rbzv8r1f43h06xcz8vwi3h5jv074gvparql7lcx";
      type = "gem";
    };
-    version = "2.1.0";
+    version = "2.2.0";
+  };
+  neatjson = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fa2v7b6433j0iqh5iq9r71v7a5xabgjvqwsbl21vcsac7vf3ncw";
+      type = "gem";
+    };
+    version = "0.9";
  };
  polyglot = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
      sha256 = "1bqnxwyip623d8pr29rg6m8r0hdg08fpr2yb74f46rn1wgsnxmjr";
@ -26,6 +42,8 @@
  };
  treetop = {
    dependencies = ["polyglot"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
      sha256 = "0g31pijhnv7z960sd09lckmw9h8rs3wmc8g4ihmppszxqm99zpv7";
--- a/pkgs/development/tools/cddl/Gemfile.lock
+++ b/pkgs/development/tools/cddl/Gemfile.lock
@ -2,19 +2,21 @@ GEM
  remote: https://rubygems.org/
  specs:
    abnc (0.1.0)
-    cbor-diag (0.5.2)
+    cbor-diag (0.5.6)
      json
+      neatjson
      treetop (~> 1)
-    cddl (0.8.5)
+    cddl (0.8.9)
      abnc
      cbor-diag
      colorize
      json
      regexp-examples
    colorize (0.8.1)
-    json (2.1.0)
+    json (2.2.0)
+    neatjson (0.9)
    polyglot (0.3.5)
-    regexp-examples (1.4.2)
+    regexp-examples (1.5.0)
    treetop (1.6.10)
      polyglot (~> 0.3)

@ -25,4 +27,4 @@ DEPENDENCIES
  cddl

 BUNDLED WITH
-   1.14.6
+   1.17.2
--- a/pkgs/development/tools/cddl/gemset.nix
+++ b/pkgs/development/tools/cddl/gemset.nix
@ -1,5 +1,7 @@
 {
  abnc = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
      sha256 = "13nvzrk72nj130fs8bq8q3cfm48939rdzh7l31ncj5c4969hrbig";
@ -8,24 +10,30 @@
    version = "0.1.0";
  };
  cbor-diag = {
-    dependencies = ["json" "treetop"];
+    dependencies = ["json" "neatjson" "treetop"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1g4pxf1ag4pyb351m06l08ig1smnf8w27ynqfxkgmwak5mh1z7w1";
+      sha256 = "0pd0k4malg1l7w3ck5glh9w0hrsvknk8rp32vrir74yww1g6yplv";
      type = "gem";
    };
-    version = "0.5.2";
+    version = "0.5.6";
  };
  cddl = {
    dependencies = ["abnc" "cbor-diag" "colorize" "json" "regexp-examples"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1pg91wrby0qgrdnf089ddy5yy2jalxd3bb9dljj16cpwv4gjx047";
+      sha256 = "16rmcrsxwx33pj25g1si0dhjdl2brfhy2vlpfwdb6qqkaikmzhpz";
      type = "gem";
    };
-    version = "0.8.5";
+    version = "0.8.9";
  };
  colorize = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
      sha256 = "133rqj85n400qk6g3dhf2bmfws34mak1wqihvh3bgy9jhajw580b";
@ -34,14 +42,28 @@
    version = "0.8.1";
  };
  json = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "01v6jjpvh3gnq6sgllpfqahlgxzj50ailwhj9b3cd20hi2dx0vxp";
+      sha256 = "0sx97bm9by389rbzv8r1f43h06xcz8vwi3h5jv074gvparql7lcx";
      type = "gem";
    };
-    version = "2.1.0";
+    version = "2.2.0";
+  };
+  neatjson = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0fa2v7b6433j0iqh5iq9r71v7a5xabgjvqwsbl21vcsac7vf3ncw";
+      type = "gem";
+    };
+    version = "0.9";
  };
  polyglot = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
      sha256 = "1bqnxwyip623d8pr29rg6m8r0hdg08fpr2yb74f46rn1wgsnxmjr";
@ -50,15 +72,19 @@
    version = "0.3.5";
  };
  regexp-examples = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "104f0j0h2x5ijly7kyaj7zz0md65r2c03cpbi5cngm0hs2sr1qkz";
+      sha256 = "08s5d327i9dw5yjwv9vfss3qb7lwasjyc75wvh7vrdi5v4vm1y2k";
      type = "gem";
    };
-    version = "1.4.2";
+    version = "1.5.0";
  };
  treetop = {
    dependencies = ["polyglot"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
      sha256 = "0g31pijhnv7z960sd09lckmw9h8rs3wmc8g4ihmppszxqm99zpv7";
--- a/pkgs/development/tools/misc/wishbone-tool/default.nix
+++ b/pkgs/development/tools/misc/wishbone-tool/default.nix
@ -0,0 +1,25 @@
+{ lib, fetchFromGitHub, rustPlatform, libusb }:
+let
+  version = "0.2.8";
+  src = fetchFromGitHub {
+    owner = "xobs";
+    repo = "wishbone-utils";
+    rev = "v${version}";
+    sha256 = "0v6s5yl0y6bd2snf12x6c77rwvqkg6ybi1sm4wr7qdgbwq563nxp";
+  };
+in
+rustPlatform.buildRustPackage {
+  pname = "wishbone-tool";
+  inherit version;
+  src = "${src}/wishbone-tool";
+  cargoSha256 = "0pj8kf6s1c666p4kc6q1hlvaqm0lm9aqnsx5r034g1y8sxnnyri2";
+  buildInputs = [ libusb ];
+
+  meta = with lib; {
+    description = "Manipulate a Wishbone device over some sort of bridge";
+    homepage = "https://github.com/xobs/wishbone-utils#wishbone-tool";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ edef ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/tools/osslsigncode/default.nix
+++ b/pkgs/development/tools/osslsigncode/default.nix
@ -0,0 +1,31 @@
+{ stdenv
+, fetchFromGitHub
+, autoreconfHook
+, libgsf
+, pkgconfig
+, openssl_1_1
+, curl
+}:
+
+stdenv.mkDerivation rec {
+  pname = "osslsigncode";
+  version = "unstable-2019-07-25";
+
+  src = fetchFromGitHub {
+    owner = "mtrojnar";
+    repo = pname;
+    rev = "18810b7e0bb1d8e0d25b6c2565a065cf66bce5d7";
+    sha256 = "02jnbr3xdsb5dpll3k65080ryrfr7agawmjavwxd0v40w0an5yq8";
+  };
+
+  nativeBuildInputs = [ autoreconfHook libgsf pkgconfig openssl_1_1 curl ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/mtrojnar/osslsigncode";
+    description = "OpenSSL based Authenticode signing for PE/MSI/Java CAB files";
+    license = licenses.gpl3Plus;
+    maintainers = [ maintainers.mmahut ];
+    platforms = platforms.all;
+  };
+}
+
--- a/pkgs/development/tools/rust/cargo-expand/default.nix
+++ b/pkgs/development/tools/rust/cargo-expand/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-expand";
-  version = "0.4.13";
+  version = "0.4.14";

  src = fetchFromGitHub {
    owner = "dtolnay";
    repo = pname;
    rev = version;
-    sha256 = "0s3xd9dr0n64j0m38gd4cafrdr5vnpl557ks4wr0jszyhldnlfkz";
+    sha256 = "0i59m34lav3cmrazaxfraj3jk5mdi5fgaq8p7l4s8qr1fpmmw9vy";
  };

-  cargoSha256 = "13zz3n1p75267h3qrmvpmd8agnkbk8vfbr8s38wcyysck81pr4px";
+  cargoSha256 = "1sjbcgscgvjq4qpcljrsj1dyxbr10jl6wpp27xh3bv8c2rv4bzz8";

  buildInputs = [ llvmPackages.libclang ]
    ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
--- a/pkgs/development/tools/rust/cargo-make/default.nix
+++ b/pkgs/development/tools/rust/cargo-make/default.nix
@ -2,7 +2,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-make";
-  version = "0.22.0";
+  version = "0.22.1";

  src =
    let
@ -10,11 +10,11 @@ rustPlatform.buildRustPackage rec {
        owner = "sagiegurari";
        repo = pname;
        rev = version;
-        sha256 = "13nl370immbhjarc0vfzrsflml3alh2f2zrh4znbks4yc3yp790z";
+        sha256 = "1wsams41zl56mkb8671n5fqkkchs68jd9nvfzry8axxiv7n175gc";
      };
      cargo-lock = fetchurl {
-        url = "https://gist.githubusercontent.com/xrelkd/e4c9c7738b21f284d97cb7b1d181317d/raw/d31cfb3598d0a2886abd4d2ed43a02d493c8de8c/cargo-make-Cargo.lock";
-        sha256 = "08fzl98d277n9xn3hrg9jahkqwdjfi5saajsppwzdbb3l7xw4jh2";
+        url = "https://gist.githubusercontent.com/xrelkd/e4c9c7738b21f284d97cb7b1d181317d/raw/850e9830f4ab4bc65da6eb5cd8b0911970a7739f/cargo-make-Cargo.lock";
+        sha256 = "0knmzplxmh8vksmpg56l2p1a10hpqbr9hmbk3hv0aj63125rhhqy";
      };
    in
    runCommand "cargo-make-src" {} ''
@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {

  buildInputs = stdenv.lib.optionals stdenv.isDarwin [ Security ];

-  cargoSha256 = "0gj4a15slxnp31mlfgh57h3cwv0lnw5gdmkrmmj79migi96i5i6y";
+  cargoSha256 = "18j0nflf997z4nwdxifxp1ji1rbwqbg6zm2256j21am4ak45krsy";

  # Some tests fail because they need network access.
  # However, Travis ensures a proper build.
--- a/pkgs/development/web/cypress/default.nix
+++ b/pkgs/development/web/cypress/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec{
  pname = "cypress";
-  version = "3.4.0";
+  version = "3.4.1";

  src = fetchzip {
    url = "https://cdn.cypress.io/desktop/${version}/linux-x64/cypress.zip";
-    sha256 = "1j59az9j37a61ryvh975bc7bj43qi3dq0871fyambh1j2mby00qn";
+    sha256 = "1gyl5c86gr5sv6z5rkg0afdxqrmsxmyrimm1p5q6jlrlyzki1bfs";
  };

  # don't remove runtime deps
--- a/pkgs/games/gnome-hexgl/default.nix
+++ b/pkgs/games/gnome-hexgl/default.nix
@ -0,0 +1,43 @@
+{ stdenv
+, fetchFromGitHub
+, ninja
+, meson
+, pkgconfig
+, gthree
+, gsound
+, epoxy
+, gtk3
+}:
+
+stdenv.mkDerivation rec {
+  pname = "gnome-hexgl";
+  version = "unstable-2019-08-21";
+
+  src = fetchFromGitHub {
+    owner = "alexlarsson";
+    repo = "gnome-hexgl";
+    rev = "c6edde1250b830c7c8ee738905cb39abef67d4a6";
+    sha256 = "17j236damqij8n4a37psvkfxbbc18yw03s3hs0qxgfhl4671wf6z";
+  };
+
+  nativeBuildInputs = [
+    ninja
+    meson
+    pkgconfig
+  ];
+
+  buildInputs = [
+    gthree
+    gsound
+    epoxy
+    gtk3
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Gthree port of HexGL";
+    homepage = https://github.com/alexlarsson/gnome-hexgl;
+    license = licenses.mit;
+    maintainers = with maintainers; [ jtojnar ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/games/warsow/default.nix
+++ b/pkgs/games/warsow/default.nix
@ -5,7 +5,7 @@ stdenv.mkDerivation rec {
  version = "2.1.2";

  src = fetchurl {
-    url = "http://sebastian.network/warsow/${name}.tar.gz";
+    url = "http://slice.sh/warsow/${name}.tar.gz";
    sha256 = "07y2airw5qg3s1bf1c63a6snjj22riz0mqhk62jmfm9nrarhavrc";
  };

--- a/pkgs/games/warsow/engine.nix
+++ b/pkgs/games/warsow/engine.nix
@ -13,7 +13,7 @@ in stdenv.mkDerivation (libs // rec {
  version = "2.1.0";

  src = fetchurl {
-    url = "http://sebastian.network/warsow/warsow_21_sdk.tar.gz";
+    url = "http://slice.sh/warsow/warsow_21_sdk.tar.gz";
    sha256 = "0fj5k7qpf6far8i1xhqxlpfjch10zj26xpilhp95aq2yiz08pj4r";
  };

@ -48,5 +48,6 @@ in stdenv.mkDerivation (libs // rec {
    license = licenses.gpl2;
    maintainers = with maintainers; [ astsmtl abbradar ];
    platforms = platforms.linux;
+    broken = stdenv.isAarch64;
  };
 })
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@ -29,6 +29,6 @@ stdenv.mkDerivation rec {
    platforms = platforms.linux;
    license = with licenses; [ lgpl21 gpl2 ];
    homepage = https://www.displaylink.com/;
-    broken = versionOlder kernel.version "4.9" || versionAtLeast kernel.version "4.18" || stdenv.isAarch64;
+    broken = versionOlder kernel.version "4.9" || versionAtLeast kernel.version "5.3" || stdenv.isAarch64;
  };
 }
--- a/Show More
+++ b/Show More