Merge branch 'staging' into glibc230

.github/CODEOWNERS

@@ -164,7 +164,7 @@
 /pkgs/top-level/emacs-packages.nix     @adisbladis
 
 # VimPlugins
-/pkgs/misc/vim-plugins         @jonringer
+/pkgs/misc/vim-plugins         @jonringer @softinio
 
 # VsCode Extensions
 /pkgs/misc/vscode-extensions   @jonringer

maintainers/maintainer-list.nix

@@ -2550,6 +2550,12 @@
     githubId = 1943632;
     name = "fro_ozen";
   };
+  Frostman = {
+    email = "me@slukjanov.name";
+    github = "Frostman";
+    githubId = 134872;
+    name = "Sergei Lukianov";
+  };
   frontsideair = {
     email = "photonia@gmail.com";
     github = "frontsideair";
@@ -7980,4 +7986,10 @@
     githubId = 8686360;
     name = "Illia Shestakov";
   };
+  foxit64 = {
+    email = "o4nsxy05@gmail.com";
+    github = "foxit64";
+    githubId = 56247270;
+    name = "Foxit";
+  };
 }

nixos/doc/manual/configuration/x-windows.xml

@@ -85,11 +85,14 @@
 <programlisting>
 <xref linkend="opt-services.xserver.displayManager.defaultSession"/> = "none+i3";
 </programlisting>
-  And, finally, to enable auto-login for a user <literal>johndoe</literal>:
+  Every display manager in NixOS supports auto-login, here is an example
+  using lightdm for a user <literal>alice</literal>:
 <programlisting>
-<xref linkend="opt-services.xserver.displayManager.auto.enable"/> = true;
+<xref linkend="opt-services.xserver.displayManager.lightdm.enable"/> = true;
-<xref linkend="opt-services.xserver.displayManager.auto.user"/> = "johndoe";
+<xref linkend="opt-services.xserver.displayManager.lightdm.autoLogin.enable"/> = true;
+<xref linkend="opt-services.xserver.displayManager.lightdm.autoLogin.user"/> = "alice";
 </programlisting>
+  The options are named identically for all other display managers.
   </para>
  </simplesect>
  <simplesect xml:id="sec-x11-graphics-cards-nvidia">

nixos/doc/manual/release-notes/rl-2003.xml

@@ -126,7 +126,7 @@ services.xserver.displayManager.defaultSession = "xfce+icewm";
    <listitem>
     <para>
      The <literal>dynamicHosts</literal> option has been removed from the
-     <link linkend="opt-networking.networkmanager.enable">networkd</link>
+     <link linkend="opt-networking.networkmanager.enable">NetworkManager</link>
      module. Allowing (multiple) regular users to override host entries
      affecting the whole system opens up a huge attack vector.
      There seem to be very rare cases where this might be useful.
@@ -445,6 +445,97 @@ users.users.me =
       </listitem>
     </itemizedlist>
    </listitem>
+   <listitem>
+    <para>
+     The <literal>citrix_workspace_19_3_0</literal> package has been removed as
+     it will be EOLed within the lifespan of 20.03. For further information,
+     please refer to the <link xlink:href="https://www.citrix.com/de-de/support/product-lifecycle/milestones/receiver.html">support and maintenance information</link> from upstream.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <literal>gcc5</literal> and <literal>gfortran5</literal> packages have been removed.
+    </para>
+   </listitem>
+   <listitem>
+    <para>
+     The <option>services.xserver.displayManager.auto</option> module has been removed.
+     It was only intended for use in internal NixOS tests, and gave the false impression
+     of it being a special display manager when it's actually LightDM.
+     Please use the <xref linkend="opt-services.xserver.displayManager.lightdm.autoLogin"/> options instead,
+     or any other display manager in NixOS as they all support auto-login. If you used this module specifically
+     because it permitted root auto-login you can override the lightdm-autologin pam module like:
+<programlisting>
+<link xlink:href="#opt-security.pam.services._name__.text">security.pam.services.lightdm-autologin.text</link> = lib.mkForce ''
+    auth     requisite pam_nologin.so
+    auth     required  pam_succeed_if.so quiet
+    auth     required  pam_permit.so
+
+    account  include   lightdm
+
+    password include   lightdm
+
+    session  include   lightdm
+'';
+</programlisting>
+     The difference is the:
+<programlisting>
+auth required pam_succeed_if.so quiet
+</programlisting>
+     line, where default it's:
+<programlisting>
+auth required pam_succeed_if.so uid >= 1000 quiet
+</programlisting>
+     not permitting users with uid's below 1000 (like root).
+     All other display managers in NixOS are configured like this.
+    </para>
+   </listitem>
+   <listitem>
+     <para>
+       There have been lots of improvements to the Mailman module.  As
+       a result,
+     </para>
+     <itemizedlist>
+       <listitem>
+         <para>
+           The <option>services.mailman.hyperkittyBaseUrl</option>
+           option has been renamed to <xref
+           linkend="opt-services.mailman.hyperkitty.baseUrl"/>.
+         </para>
+       </listitem>
+       <listitem>
+         <para>
+           The <option>services.mailman.hyperkittyApiKey</option>
+           option has been removed.  This is because having an option
+           for the Hyperkitty API key meant that the API key would be
+           stored in the world-readable Nix store, which was a
+           security vulnerability.  A new Hyperkitty API key will be
+           generated the first time the new Hyperkitty service is run,
+           and it will then be persisted outside of the Nix store.  To
+           continue using Hyperkitty, you must set <xref
+           linkend="opt-services.mailman.hyperkitty.enable"/> to
+           <literal>true</literal>.
+         </para>
+       </listitem>
+       <listitem>
+         <para>
+           Additionally, some Postfix configuration must now be set
+           manually instead of automatically by the Mailman module:
+<programlisting>
+<xref linkend="opt-services.postfix.relayDomains"/> = [ "hash:/var/lib/mailman/data/postfix_domains" ];
+<xref linkend="opt-services.postfix.config"/>.transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
+<xref linkend="opt-services.postfix.config"/>.local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
+</programlisting>
+           This is because some users may want to include other values
+           in these lists as well, and this was not possible if they
+           were set automatically by the Mailman module.  It would not
+           have been possible to just concatenate values from multiple
+           modules each setting the values they needed, because the
+           order of elements in the list is significant.
+         </para>
+       </listitem>
+     </itemizedlist>
+   </listitem>
   </itemizedlist>
  </section>
 

nixos/modules/module-list.nix

@@ -117,6 +117,7 @@
   ./programs/fish.nix
   ./programs/freetds.nix
   ./programs/fuse.nix
+  ./programs/geary.nix
   ./programs/gnome-disks.nix
   ./programs/gnome-documents.nix
   ./programs/gnome-terminal.nix
@@ -280,6 +281,7 @@
   ./services/databases/riak.nix
   ./services/databases/riak-cs.nix
   ./services/databases/stanchion.nix
+  ./services/databases/victoriametrics.nix
   ./services/databases/virtuoso.nix
   ./services/desktops/accountsservice.nix
   ./services/desktops/bamf.nix
@@ -426,6 +428,7 @@
   ./services/misc/exhibitor.nix
   ./services/misc/felix.nix
   ./services/misc/folding-at-home.nix
+  ./services/misc/freeswitch.nix
   ./services/misc/fstrim.nix
   ./services/misc/gammu-smsd.nix
   ./services/misc/geoip-updater.nix
@@ -864,7 +867,6 @@
   ./services/x11/unclutter.nix
   ./services/x11/unclutter-xfixes.nix
   ./services/x11/desktop-managers/default.nix
-  ./services/x11/display-managers/auto.nix
   ./services/x11/display-managers/default.nix
   ./services/x11/display-managers/gdm.nix
   ./services/x11/display-managers/lightdm.nix

nixos/modules/programs/geary.nix

@@ -0,0 +1,20 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.programs.geary;
+
+in {
+  options = {
+    programs.geary.enable = mkEnableOption "Geary, a Mail client for GNOME 3";
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.gnome3.geary ];
+    programs.dconf.enable = true;
+    services.gnome3.gnome-keyring.enable = true;
+    services.gnome3.gnome-online-accounts.enable = true;
+  };
+}
+

nixos/modules/rename.nix

@@ -34,6 +34,13 @@ with lib;
       as the underlying package isn't being maintained. Working alternatives are
       libinput and synaptics.
     '')
+    (mkRemovedOptionModule [ "services" "xserver" "displayManager" "auto" ] ''
+      The services.xserver.displayManager.auto module has been removed
+      because it was only intended for use in internal NixOS tests, and gave the
+      false impression of it being a special display manager when it's actually
+      LightDM. Please use the services.xserver.displayManager.lightdm.autoLogin options
+      instead, or any other display manager in NixOS as they all support auto-login.
+    '')
 
     # Do NOT add any option renames here, see top of the file
   ];

nixos/modules/services/databases/victoriametrics.nix

@@ -0,0 +1,70 @@
+{ config, pkgs, lib, ... }:
+let cfg = config.services.victoriametrics; in
+{
+  options.services.victoriametrics = with lib; {
+    enable = mkEnableOption "victoriametrics";
+    package = mkOption {
+      type = types.package;
+      default = pkgs.victoriametrics;
+      defaultText = "pkgs.victoriametrics";
+      description = ''
+        The VictoriaMetrics distribution to use.
+      '';
+    };
+    listenAddress = mkOption {
+      default = ":8428";
+      type = types.str;
+      description = ''
+        The listen address for the http interface.
+      '';
+    };
+    retentionPeriod = mkOption {
+      type = types.int;
+      default = 1;
+      description = ''
+        Retention period in months.
+      '';
+    };
+    extraOptions = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = ''
+        Extra options to pass to VictoriaMetrics. See the README: <link
+        xlink:href="https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/README.md" />
+        or <command>victoriametrics -help</command> for more
+        information.
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    systemd.services.victoriametrics = {
+      description = "VictoriaMetrics time series database";
+      after = [ "network.target" ];
+      serviceConfig = {
+        Restart = "on-failure";
+        RestartSec = 1;
+        StartLimitBurst = 5;
+        StateDirectory = "victoriametrics";
+        DynamicUser = true;
+        ExecStart = ''
+          ${cfg.package}/bin/victoria-metrics \
+              -storageDataPath=/var/lib/victoriametrics \
+              -httpListenAddr ${cfg.listenAddress}
+              -retentionPeriod ${toString cfg.retentionPeriod}
+              ${lib.escapeShellArgs cfg.extraOptions}
+        '';
+      };
+      wantedBy = [ "multi-user.target" ];
+
+      postStart =
+        let
+          bindAddr = (lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
+        in
+        lib.mkBefore ''
+          until ${lib.getBin pkgs.curl}/bin/curl -s -o /dev/null http://${bindAddr}/ping; do
+            sleep 1;
+          done
+        '';
+    };
+  };
+}

nixos/modules/services/mail/mailman.nix

@@ -6,37 +6,18 @@ let
 
   cfg = config.services.mailman;
 
-  mailmanPyEnv = pkgs.python3.withPackages (ps: with ps; [mailman mailman-hyperkitty]);
+  # This deliberately doesn't use recursiveUpdate so users can
+  # override the defaults.
+  settings = {
+    DEFAULT_FROM_EMAIL = cfg.siteOwner;
+    SERVER_EMAIL = cfg.siteOwner;
+    ALLOWED_HOSTS = [ "localhost" "127.0.0.1" ] ++ cfg.webHosts;
+    COMPRESS_OFFLINE = true;
+    STATIC_ROOT = "/var/lib/mailman-web/static";
+    MEDIA_ROOT = "/var/lib/mailman-web/media";
+  } // cfg.webSettings;
 
-  mailmanExe = with pkgs; stdenv.mkDerivation {
+  settingsJSON = pkgs.writeText "settings.json" (builtins.toJSON settings);
-    name = "mailman-" + python3Packages.mailman.version;
-    buildInputs = [makeWrapper];
-    unpackPhase = ":";
-    installPhase = ''
-      mkdir -p $out/bin
-      makeWrapper ${mailmanPyEnv}/bin/mailman $out/bin/mailman \
-        --set MAILMAN_CONFIG_FILE /etc/mailman.cfg
-   '';
-  };
-
-  mailmanWeb = pkgs.python3Packages.mailman-web.override {
-    serverEMail = cfg.siteOwner;
-    archiverKey = cfg.hyperkittyApiKey;
-    allowedHosts = cfg.webHosts;
-  };
-
-  mailmanWebPyEnv = pkgs.python3.withPackages (x: with x; [mailman-web]);
-
-  mailmanWebExe = with pkgs; stdenv.mkDerivation {
-    inherit (mailmanWeb) name;
-    buildInputs = [makeWrapper];
-    unpackPhase = ":";
-    installPhase = ''
-      mkdir -p $out/bin
-      makeWrapper ${mailmanWebPyEnv}/bin/django-admin $out/bin/mailman-web \
-        --set DJANGO_SETTINGS_MODULE settings
-    '';
-  };
 
   mailmanCfg = ''
     [mailman]
@@ -53,30 +34,42 @@ let
     etc_dir: /etc
     ext_dir: $etc_dir/mailman.d
     pid_file: /run/mailman/master.pid
-  '' + optionalString (cfg.hyperkittyApiKey != null) ''
+  '' + optionalString cfg.hyperkitty.enable ''
+
     [archiver.hyperkitty]
     class: mailman_hyperkitty.Archiver
     enable: yes
-    configuration: ${pkgs.writeText "mailman-hyperkitty.cfg" mailmanHyperkittyCfg}
+    configuration: /var/lib/mailman/mailman-hyperkitty.cfg
   '';
 
-  mailmanHyperkittyCfg = ''
+  mailmanHyperkittyCfg = pkgs.writeText "mailman-hyperkitty.cfg" ''
     [general]
     # This is your HyperKitty installation, preferably on the localhost. This
     # address will be used by Mailman to forward incoming emails to HyperKitty
     # for archiving. It does not need to be publicly available, in fact it's
     # better if it is not.
-    base_url: ${cfg.hyperkittyBaseUrl}
+    base_url: ${cfg.hyperkitty.baseUrl}
 
     # Shared API key, must be the identical to the value in HyperKitty's
     # settings.
-    api_key: ${cfg.hyperkittyApiKey}
+    api_key: @API_KEY@
   '';
 
 in {
 
   ###### interface
 
+  imports = [
+    (mkRenamedOptionModule [ "services" "mailman" "hyperkittyBaseUrl" ]
+      [ "services" "mailman" "hyperkitty" "baseUrl" ])
+
+    (mkRemovedOptionModule [ "services" "mailman" "hyperkittyApiKey" ] ''
+      The Hyperkitty API key is now generated on first run, and not
+      stored in the world-readable Nix store.  To continue using
+      Hyperkitty, you must set services.mailman.hyperkitty.enable = true.
+    '')
+  ];
+
   options = {
 
     services.mailman = {
@@ -87,9 +80,17 @@ in {
         description = "Enable Mailman on this host. Requires an active Postfix installation.";
       };
 
+      package = mkOption {
+        type = types.package;
+        default = pkgs.mailman;
+        defaultText = "pkgs.mailman";
+        example = "pkgs.mailman.override { archivers = []; }";
+        description = "Mailman package to use";
+      };
+
       siteOwner = mkOption {
         type = types.str;
-        default = "postmaster@example.org";
+        example = "postmaster@example.org";
         description = ''
           Certain messages that must be delivered to a human, but which can't
           be delivered to a list owner (e.g. a bounce from a list owner), will
@@ -99,12 +100,13 @@ in {
 
       webRoot = mkOption {
         type = types.path;
-        default = "${mailmanWeb}/${pkgs.python3.sitePackages}";
+        default = "${pkgs.mailman-web}/${pkgs.python3.sitePackages}";
-        defaultText = "pkgs.python3Packages.mailman-web";
+        defaultText = "\${pkgs.mailman-web}/\${pkgs.python3.sitePackages}";
         description = ''
           The web root for the Hyperkity + Postorius apps provided by Mailman.
           This variable can be set, of course, but it mainly exists so that site
-          admins can refer to it in their own hand-written httpd configuration files.
+          admins can refer to it in their own hand-written web server
+          configuration files.
         '';
       };
 
@@ -120,26 +122,35 @@ in {
         '';
       };
 
-      hyperkittyBaseUrl = mkOption {
+      webUser = mkOption {
         type = types.str;
-        default = "http://localhost/hyperkitty/";
+        default = config.services.httpd.user;
         description = ''
-          Where can Mailman connect to Hyperkitty's internal API, preferably on
+          User to run mailman-web as
-          localhost?
         '';
       };
 
-      hyperkittyApiKey = mkOption {
+      webSettings = mkOption {
-        type = types.nullOr types.str;
+        type = types.attrs;
-        default = null;
+        default = {};
         description = ''
-          The shared secret used to authenticate Mailman's internal
+          Overrides for the default mailman-web Django settings.
-          communication with Hyperkitty. Must be set to enable support for the
-          Hyperkitty archiver. Note that this secret is going to be visible to
-          all local users in the Nix store.
         '';
       };
 
+      hyperkitty = {
+        enable = mkEnableOption "the Hyperkitty archiver for Mailman";
+
+        baseUrl = mkOption {
+          type = types.str;
+          default = "http://localhost/hyperkitty/";
+          description = ''
+            Where can Mailman connect to Hyperkitty's internal API, preferably on
+            localhost?
+          '';
+        };
+      };
+
     };
   };
 
@@ -147,25 +158,58 @@ in {
 
   config = mkIf cfg.enable {
 
-    assertions = [
+    assertions = let
-      { assertion = cfg.enable -> config.services.postfix.enable;
+      inherit (config.services) postfix;
+
+      requirePostfixHash = optionPath: dataFile:
+        with lib;
+        let
+          expected = "hash:/var/lib/mailman/data/${dataFile}";
+          value = attrByPath optionPath [] postfix;
+        in
+          { assertion = postfix.enable -> isList value && elem expected value;
+            message = ''
+              services.postfix.${concatStringsSep "." optionPath} must contain
+              "${expected}".
+              See <https://mailman.readthedocs.io/en/latest/src/mailman/docs/mta.html>.
+            '';
+          };
+    in [
+      { assertion = postfix.enable;
         message = "Mailman requires Postfix";
       }
+      (requirePostfixHash [ "relayDomains" ] "postfix_domains")
+      (requirePostfixHash [ "config" "transport_maps" ] "postfix_lmtp")
+      (requirePostfixHash [ "config" "local_recipient_maps" ] "postfix_lmtp")
     ];
 
     users.users.mailman = { description = "GNU Mailman"; isSystemUser = true; };
 
-    environment = {
+    environment.etc."mailman.cfg".text = mailmanCfg;
-      systemPackages = [ mailmanExe mailmanWebExe pkgs.sassc ];
+
-      etc."mailman.cfg".text = mailmanCfg;
+    environment.etc."mailman3/settings.py".text = ''
-    };
+      import os
+
+      # Required by mailman_web.settings, but will be overridden when
+      # settings_local.json is loaded.
+      os.environ["SECRET_KEY"] = ""
+
+      from mailman_web.settings import *
+
+      import json
+
+      with open('${settingsJSON}') as f:
+          globals().update(json.load(f))
+
+      with open('/var/lib/mailman-web/settings_local.json') as f:
+          globals().update(json.load(f))
+    '';
+
+    environment.systemPackages = [ cfg.package ] ++ (with pkgs; [ mailman-web ]);
 
     services.postfix = {
-      relayDomains = [ "hash:/var/lib/mailman/data/postfix_domains" ];
       recipientDelimiter = "+";         # bake recipient addresses in mail envelopes via VERP
       config = {
-        transport_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
-        local_recipient_maps = [ "hash:/var/lib/mailman/data/postfix_lmtp" ];
         owner_request_special = "no";   # Mailman handles -owner addresses on its own
       };
     };
@@ -173,34 +217,71 @@ in {
     systemd.services.mailman = {
       description = "GNU Mailman Master Process";
       after = [ "network.target" ];
+      restartTriggers = [ config.environment.etc."mailman.cfg".source ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
-        ExecStart = "${mailmanExe}/bin/mailman start";
+        ExecStart = "${cfg.package}/bin/mailman start";
-        ExecStop = "${mailmanExe}/bin/mailman stop";
+        ExecStop = "${cfg.package}/bin/mailman stop";
         User = "mailman";
         Type = "forking";
-        StateDirectory = "mailman";
-        StateDirectoryMode = "0700";
         RuntimeDirectory = "mailman";
         PIDFile = "/run/mailman/master.pid";
       };
     };
 
-    systemd.services.mailman-web = {
+    systemd.services.mailman-settings = {
-      description = "Init Postorius DB";
+      description = "Generate settings files (including secrets) for Mailman";
-      before = [ "httpd.service" ];
+      before = [ "mailman.service" "mailman-web.service" "hyperkitty.service" "httpd.service" "uwsgi.service" ];
-      requiredBy = [ "httpd.service" ];
+      requiredBy = [ "mailman.service" "mailman-web.service" "hyperkitty.service" "httpd.service" "uwsgi.service" ];
+      path = with pkgs; [ jq ];
       script = ''
-        ${mailmanWebExe}/bin/mailman-web migrate
+        mailmanDir=/var/lib/mailman
-        rm -rf static
+        mailmanWebDir=/var/lib/mailman-web
-        ${mailmanWebExe}/bin/mailman-web collectstatic
+
-        ${mailmanWebExe}/bin/mailman-web compress
+        mailmanCfg=$mailmanDir/mailman-hyperkitty.cfg
+        mailmanWebCfg=$mailmanWebDir/settings_local.json
+
+        install -m 0700 -o mailman -g nogroup -d $mailmanDir
+        install -m 0700 -o ${cfg.webUser} -g nogroup -d $mailmanWebDir
+
+        if [ ! -e $mailmanWebCfg ]; then
+            hyperkittyApiKey=$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 64)
+            secretKey=$(tr -dc A-Za-z0-9 < /dev/urandom | head -c 64)
+
+            mailmanWebCfgTmp=$(mktemp)
+            jq -n '.MAILMAN_ARCHIVER_KEY=$archiver_key | .SECRET_KEY=$secret_key' \
+                --arg archiver_key "$hyperkittyApiKey" \
+                --arg secret_key "$secretKey" \
+                >"$mailmanWebCfgTmp"
+            chown ${cfg.webUser} "$mailmanWebCfgTmp"
+            mv -n "$mailmanWebCfgTmp" $mailmanWebCfg
+        fi
+
+        hyperkittyApiKey="$(jq -r .MAILMAN_ARCHIVER_KEY $mailmanWebCfg)"
+        mailmanCfgTmp=$(mktemp)
+        sed "s/@API_KEY@/$hyperkittyApiKey/g" ${mailmanHyperkittyCfg} >"$mailmanCfgTmp"
+        chown mailman "$mailmanCfgTmp"
+        mv "$mailmanCfgTmp" $mailmanCfg
       '';
       serviceConfig = {
-        User = config.services.httpd.user;
         Type = "oneshot";
-        StateDirectory = "mailman-web";
+      };
-        StateDirectoryMode = "0700";
+    };
+
+    systemd.services.mailman-web = {
+      description = "Init Postorius DB";
+      before = [ "httpd.service" "uwsgi.service" ];
+      requiredBy = [ "httpd.service" "uwsgi.service" ];
+      restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
+      script = ''
+        ${pkgs.mailman-web}/bin/mailman-web migrate
+        rm -rf static
+        ${pkgs.mailman-web}/bin/mailman-web collectstatic
+        ${pkgs.mailman-web}/bin/mailman-web compress
+      '';
+      serviceConfig = {
+        User = cfg.webUser;
+        Type = "oneshot";
         WorkingDirectory = "/var/lib/mailman-web";
       };
     };
@@ -208,86 +289,94 @@ in {
     systemd.services.mailman-daily = {
       description = "Trigger daily Mailman events";
       startAt = "daily";
+      restartTriggers = [ config.environment.etc."mailman.cfg".source ];
       serviceConfig = {
-        ExecStart = "${mailmanExe}/bin/mailman digests --send";
+        ExecStart = "${cfg.package}/bin/mailman digests --send";
         User = "mailman";
       };
     };
 
     systemd.services.hyperkitty = {
-      enable = cfg.hyperkittyApiKey != null;
+      inherit (cfg.hyperkitty) enable;
       description = "GNU Hyperkitty QCluster Process";
       after = [ "network.target" ];
+      restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
       wantedBy = [ "mailman.service" "multi-user.target" ];
       serviceConfig = {
-        ExecStart = "${mailmanWebExe}/bin/mailman-web qcluster";
+        ExecStart = "${pkgs.mailman-web}/bin/mailman-web qcluster";
-        User = config.services.httpd.user;
+        User = cfg.webUser;
         WorkingDirectory = "/var/lib/mailman-web";
       };
     };
 
     systemd.services.hyperkitty-minutely = {
-      enable = cfg.hyperkittyApiKey != null;
+      inherit (cfg.hyperkitty) enable;
       description = "Trigger minutely Hyperkitty events";
       startAt = "minutely";
+      restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
       serviceConfig = {
-        ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs minutely";
+        ExecStart = "${pkgs.mailman-web}/bin/mailman-web runjobs minutely";
-        User = config.services.httpd.user;
+        User = cfg.webUser;
         WorkingDirectory = "/var/lib/mailman-web";
       };
     };
 
     systemd.services.hyperkitty-quarter-hourly = {
-      enable = cfg.hyperkittyApiKey != null;
+      inherit (cfg.hyperkitty) enable;
       description = "Trigger quarter-hourly Hyperkitty events";
       startAt = "*:00/15";
+      restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
       serviceConfig = {
-        ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs quarter_hourly";
+        ExecStart = "${pkgs.mailman-web}/bin/mailman-web runjobs quarter_hourly";
-        User = config.services.httpd.user;
+        User = cfg.webUser;
         WorkingDirectory = "/var/lib/mailman-web";
       };
     };
 
     systemd.services.hyperkitty-hourly = {
-      enable = cfg.hyperkittyApiKey != null;
+      inherit (cfg.hyperkitty) enable;
       description = "Trigger hourly Hyperkitty events";
       startAt = "hourly";
+      restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
       serviceConfig = {
-        ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs hourly";
+        ExecStart = "${pkgs.mailman-web}/bin/mailman-web runjobs hourly";
-        User = config.services.httpd.user;
+        User = cfg.webUser;
         WorkingDirectory = "/var/lib/mailman-web";
       };
     };
 
     systemd.services.hyperkitty-daily = {
-      enable = cfg.hyperkittyApiKey != null;
+      inherit (cfg.hyperkitty) enable;
       description = "Trigger daily Hyperkitty events";
       startAt = "daily";
+      restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
       serviceConfig = {
-        ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs daily";
+        ExecStart = "${pkgs.mailman-web}/bin/mailman-web runjobs daily";
-        User = config.services.httpd.user;
+        User = cfg.webUser;
         WorkingDirectory = "/var/lib/mailman-web";
       };
     };
 
     systemd.services.hyperkitty-weekly = {
-      enable = cfg.hyperkittyApiKey != null;
+      inherit (cfg.hyperkitty) enable;
       description = "Trigger weekly Hyperkitty events";
       startAt = "weekly";
+      restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
       serviceConfig = {
-        ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs weekly";
+        ExecStart = "${pkgs.mailman-web}/bin/mailman-web runjobs weekly";
-        User = config.services.httpd.user;
+        User = cfg.webUser;
         WorkingDirectory = "/var/lib/mailman-web";
       };
     };
 
     systemd.services.hyperkitty-yearly = {
-      enable = cfg.hyperkittyApiKey != null;
+      inherit (cfg.hyperkitty) enable;
       description = "Trigger yearly Hyperkitty events";
       startAt = "yearly";
+      restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
       serviceConfig = {
-        ExecStart = "${mailmanWebExe}/bin/mailman-web runjobs yearly";
+        ExecStart = "${pkgs.mailman-web}/bin/mailman-web runjobs yearly";
-        User = config.services.httpd.user;
+        User = cfg.webUser;
         WorkingDirectory = "/var/lib/mailman-web";
       };
     };

nixos/modules/services/mail/spamassassin.nix

@@ -6,15 +6,6 @@ let
   cfg = config.services.spamassassin;
   spamassassin-local-cf = pkgs.writeText "local.cf" cfg.config;
 
-  spamdEnv = pkgs.buildEnv {
-    name = "spamd-env";
-    paths = [];
-    postBuild = ''
-      ln -sf ${spamassassin-init-pre} $out/init.pre
-      ln -sf ${spamassassin-local-cf} $out/local.cf
-    '';
-  };
-
 in
 
 {
@@ -120,13 +111,11 @@ in
   };
 
   config = mkIf cfg.enable {
+    environment.etc."mail/spamassassin/init.pre".source = cfg.initPreConf;
+    environment.etc."mail/spamassassin/local.cf".source = spamassassin-local-cf;
 
     # Allow users to run 'spamc'.
-
+    environment.systemPackages = [ pkgs.spamassassin ];
-    environment = {
-      etc.spamassassin.source = spamdEnv;
-      systemPackages = [ pkgs.spamassassin ];
-    };
 
     users.users.spamd = {
       description = "Spam Assassin Daemon";
@@ -141,7 +130,7 @@ in
     systemd.services.sa-update = {
       script = ''
         set +e
-        ${pkgs.su}/bin/su -s "${pkgs.bash}/bin/bash" -c "${pkgs.spamassassin}/bin/sa-update --gpghomedir=/var/lib/spamassassin/sa-update-keys/ --siteconfigpath=${spamdEnv}/" spamd
+        ${pkgs.su}/bin/su -s "${pkgs.bash}/bin/bash" -c "${pkgs.spamassassin}/bin/sa-update --gpghomedir=/var/lib/spamassassin/sa-update-keys/" spamd
 
         v=$?
         set -e
@@ -172,7 +161,7 @@ in
       after = [ "network.target" ];
 
       serviceConfig = {
-        ExecStart = "${pkgs.spamassassin}/bin/spamd ${optionalString cfg.debug "-D"} --username=spamd --groupname=spamd --siteconfigpath=${spamdEnv} --virtual-config-dir=/var/lib/spamassassin/user-%u --allow-tell --pidfile=/run/spamd.pid";
+        ExecStart = "${pkgs.spamassassin}/bin/spamd ${optionalString cfg.debug "-D"} --username=spamd --groupname=spamd --virtual-config-dir=/var/lib/spamassassin/user-%u --allow-tell --pidfile=/run/spamd.pid";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
       };
 
@@ -183,7 +172,7 @@ in
         mkdir -p /var/lib/spamassassin
         chown spamd:spamd /var/lib/spamassassin -R
         set +e
-        ${pkgs.su}/bin/su -s "${pkgs.bash}/bin/bash" -c "${pkgs.spamassassin}/bin/sa-update --gpghomedir=/var/lib/spamassassin/sa-update-keys/ --siteconfigpath=${spamdEnv}/" spamd
+        ${pkgs.su}/bin/su -s "${pkgs.bash}/bin/bash" -c "${pkgs.spamassassin}/bin/sa-update --gpghomedir=/var/lib/spamassassin/sa-update-keys/" spamd
         v=$?
         set -e
         if [ $v -gt 1 ]; then

nixos/modules/services/misc/freeswitch.nix

@@ -0,0 +1,103 @@
+{ config, lib, pkgs, ...}:
+with lib;
+let
+  cfg = config.services.freeswitch;
+  pkg = cfg.package;
+  configDirectory = pkgs.runCommand "freeswitch-config-d" { } ''
+    mkdir -p $out
+    cp -rT ${cfg.configTemplate} $out
+    chmod -R +w $out
+    ${concatStringsSep "\n" (mapAttrsToList (fileName: filePath: ''
+      mkdir -p $out/$(dirname ${fileName})
+      cp ${filePath} $out/${fileName}
+    '') cfg.configDir)}
+  '';
+  configPath = if cfg.enableReload
+    then "/etc/freeswitch"
+    else configDirectory;
+in {
+  options = {
+    services.freeswitch = {
+      enable = mkEnableOption "FreeSWITCH";
+      enableReload = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Issue the <literal>reloadxml</literal> command to FreeSWITCH when configuration directory changes (instead of restart).
+          See <link xlink:href="https://freeswitch.org/confluence/display/FREESWITCH/Reloading">FreeSWITCH documentation</link> for more info.
+          The configuration directory is exposed at <filename>/etc/freeswitch</filename>.
+          See also <literal>systemd.services.*.restartIfChanged</literal>.
+        '';
+      };
+      configTemplate = mkOption {
+        type = types.path;
+        default = "${config.services.freeswitch.package}/share/freeswitch/conf/vanilla";
+        defaultText = literalExample "\${config.services.freeswitch.package}/share/freeswitch/conf/vanilla";
+        example = literalExample "\${config.services.freeswitch.package}/share/freeswitch/conf/minimal";
+        description = ''
+          Configuration template to use.
+          See available templates in <link xlink:href="https://github.com/signalwire/freeswitch/tree/master/conf">FreeSWITCH repository</link>.
+          You can also set your own configuration directory.
+        '';
+      };
+      configDir = mkOption {
+        type = with types; attrsOf path;
+        default = { };
+        example = literalExample ''
+          {
+            "freeswitch.xml" = ./freeswitch.xml;
+            "dialplan/default.xml" = pkgs.writeText "dialplan-default.xml" '''
+              [xml lines]
+            ''';
+          }
+        '';
+        description = ''
+          Override file in FreeSWITCH config template directory.
+          Each top-level attribute denotes a file path in the configuration directory, its value is the file path.
+          See <link xlink:href="https://freeswitch.org/confluence/display/FREESWITCH/Default+Configuration">FreeSWITCH documentation</link> for more info.
+          Also check available templates in <link xlink:href="https://github.com/signalwire/freeswitch/tree/master/conf">FreeSWITCH repository</link>.
+        '';
+      };
+      package = mkOption {
+        type = types.package;
+        default = pkgs.freeswitch;
+        defaultText = literalExample "pkgs.freeswitch";
+        example = literalExample "pkgs.freeswitch";
+        description = ''
+          FreeSWITCH package.
+        '';
+      };
+    };
+  };
+  config = mkIf cfg.enable {
+    environment.etc.freeswitch = mkIf cfg.enableReload {
+      source = configDirectory;
+    };
+    systemd.services.freeswitch-config-reload = mkIf cfg.enableReload {
+      before = [ "freeswitch.service" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ configDirectory ];
+      serviceConfig = {
+        ExecStart = "${pkgs.systemd}/bin/systemctl try-reload-or-restart freeswitch.service";
+        RemainAfterExit = true;
+        Type = "oneshot";
+      };
+    };
+    systemd.services.freeswitch = {
+      description = "Free and open-source application server for real-time communication";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        DynamicUser = true;
+        StateDirectory = "freeswitch";
+        ExecStart = "${pkg}/bin/freeswitch -nf \\
+          -mod ${pkg}/lib/freeswitch/mod \\
+          -conf ${configPath} \\
+          -base /var/lib/freeswitch";
+        ExecReload = "${pkg}/bin/fs_cli -x reloadxml";
+        Restart = "always";
+        RestartSec = "5s";
+      };
+    };
+  };
+}

nixos/modules/services/misc/home-assistant.nix

@@ -251,6 +251,7 @@ in {
       home = cfg.configDir;
       createHome = true;
       group = "hass";
+      extraGroups = [ "dialout" ];
       uid = config.ids.uids.hass;
     };
 

nixos/modules/services/network-filesystems/kbfs.nix

@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }:
 with lib;
 let
+  inherit (config.security) wrapperDir;
   cfg = config.services.kbfs;
 
 in {
@@ -17,6 +18,16 @@ in {
         description = "Whether to mount the Keybase filesystem.";
       };
 
+      enableRedirector = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to enable the Keybase root redirector service, allowing
+          any user to access KBFS files via <literal>/keybase</literal>,
+          which will show different contents depending on the requester.
+        '';
+      };
+
       mountPoint = mkOption {
         type = types.str;
         default = "%h/keybase";
@@ -41,26 +52,67 @@ in {
 
   ###### implementation
 
-  config = mkIf cfg.enable {
+  config = mkIf cfg.enable (mkMerge [
+    {
+      # Upstream: https://github.com/keybase/client/blob/master/packaging/linux/systemd/kbfs.service
+      systemd.user.services.kbfs = {
+        description = "Keybase File System";
 
-    systemd.user.services.kbfs = {
+        # Note that the "Requires" directive will cause a unit to be restarted whenever its dependency is restarted.
-      description = "Keybase File System";
+        # Do not issue a hard dependency on keybase, because kbfs can reconnect to a restarted service.
-      requires = [ "keybase.service" ];
+        # Do not issue a hard dependency on keybase-redirector, because it's ok if it fails (e.g., if it is disabled).
-      after = [ "keybase.service" ];
+        wants = [ "keybase.service" ] ++ optional cfg.enableRedirector "keybase-redirector.service";
-      path = [ "/run/wrappers" ];
+        path = [ "/run/wrappers" ];
-      unitConfig.ConditionUser = "!@system";
+        unitConfig.ConditionUser = "!@system";
-      serviceConfig = {
+
-        ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p ${cfg.mountPoint}";
+        serviceConfig = {
-        ExecStart = "${pkgs.kbfs}/bin/kbfsfuse ${toString cfg.extraFlags} ${cfg.mountPoint}";
+          Type = "notify";
-        ExecStopPost = "/run/wrappers/bin/fusermount -u ${cfg.mountPoint}";
+          # Keybase notifies from a forked process
-        Restart = "on-failure";
+          EnvironmentFile = [
-        PrivateTmp = true;
+            "-%E/keybase/keybase.autogen.env"
+            "-%E/keybase/keybase.env"
+          ];
+          ExecStartPre = [
+            "${pkgs.coreutils}/bin/mkdir -p \"${cfg.mountPoint}\""
+            "-${wrapperDir}/fusermount -uz \"${cfg.mountPoint}\""
+          ];
+          ExecStart = "${pkgs.kbfs}/bin/kbfsfuse ${toString cfg.extraFlags} \"${cfg.mountPoint}\"";
+          ExecStop = "${wrapperDir}/fusermount -uz \"${cfg.mountPoint}\"";
+          Restart = "on-failure";
+          PrivateTmp = true;
+        };
+        wantedBy = [ "default.target" ];
       };
-      wantedBy = [ "default.target" ];
-    };
 
-    services.keybase.enable = true;
+      services.keybase.enable = true;
 
-    environment.systemPackages = [ pkgs.kbfs ];
+      environment.systemPackages = [ pkgs.kbfs ];
-  };
+    }
+
+    (mkIf cfg.enableRedirector {
+      security.wrappers."keybase-redirector".source = "${pkgs.kbfs}/bin/redirector";
+
+      systemd.tmpfiles.rules = [ "d /keybase 0755 root root 0" ];
+
+      # Upstream: https://github.com/keybase/client/blob/master/packaging/linux/systemd/keybase-redirector.service
+      systemd.user.services.keybase-redirector = {
+        description = "Keybase Root Redirector for KBFS";
+        wants = [ "keybase.service" ];
+        unitConfig.ConditionUser = "!@system";
+
+        serviceConfig = {
+          EnvironmentFile = [
+            "-%E/keybase/keybase.autogen.env"
+            "-%E/keybase/keybase.env"
+          ];
+          # Note: The /keybase mount point is not currently configurable upstream.
+          ExecStart = "${wrapperDir}/keybase-redirector /keybase";
+          Restart = "on-failure";
+          PrivateTmp = true;
+        };
+
+        wantedBy = [ "default.target" ];
+      };
+    })
+  ]);
 }

nixos/modules/services/networking/dhcpcd.nix

@@ -59,6 +59,16 @@ let
       # Use the list of allowed interfaces if specified
       ${optionalString (allowInterfaces != null) "allowinterfaces ${toString allowInterfaces}"}
 
+      # Immediately fork to background if specified, otherwise wait for IP address to be assigned
+      ${{
+        background = "background";
+        any = "waitip";
+        ipv4 = "waitip 4";
+        ipv6 = "waitip 6";
+        both = "waitip 4\nwaitip 6";
+        if-carrier-up = "";
+      }.${cfg.wait}}
+
       ${cfg.extraConfig}
     '';
 
@@ -146,6 +156,21 @@ in
       '';
     };
 
+    networking.dhcpcd.wait = mkOption {
+      type = types.enum [ "background" "any" "ipv4" "ipv6" "both" "if-carrier-up" ];
+      default = "any";
+      description = ''
+        This option specifies when the dhcpcd service will fork to background.
+        If set to "background", dhcpcd will fork to background immediately.
+        If set to "ipv4" or "ipv6", dhcpcd will wait for the corresponding IP
+        address to be assigned. If set to "any", dhcpcd will wait for any type
+        (IPv4 or IPv6) to be assigned. If set to "both", dhcpcd will wait for
+        both an IPv4 and an IPv6 address before forking.
+        The option "if-carrier-up" is equivalent to "any" if either ethernet
+        is plugged nor WiFi is powered, and to "background" otherwise.
+      '';
+    };
+
   };
 
 
@@ -177,7 +202,7 @@ in
         serviceConfig =
           { Type = "forking";
             PIDFile = "/run/dhcpcd.pid";
-            ExecStart = "@${dhcpcd}/sbin/dhcpcd dhcpcd -w --quiet ${optionalString cfg.persistent "--persistent"} --config ${dhcpcdConf}";
+            ExecStart = "@${dhcpcd}/sbin/dhcpcd dhcpcd --quiet ${optionalString cfg.persistent "--persistent"} --config ${dhcpcdConf}";
             ExecReload = "${dhcpcd}/sbin/dhcpcd --rebind";
             Restart = "always";
           };

nixos/modules/services/networking/keybase.nix

@@ -24,13 +24,18 @@ in {
 
   config = mkIf cfg.enable {
 
+    # Upstream: https://github.com/keybase/client/blob/master/packaging/linux/systemd/keybase.service
     systemd.user.services.keybase = {
       description = "Keybase service";
       unitConfig.ConditionUser = "!@system";
+      environment.KEYBASE_SERVICE_TYPE = "systemd";
       serviceConfig = {
-        ExecStart = ''
+        Type = "notify";
-          ${pkgs.keybase}/bin/keybase service --auto-forked
+        EnvironmentFile = [
-        '';
+          "-%E/keybase/keybase.autogen.env"
+          "-%E/keybase/keybase.env"
+        ];
+        ExecStart = "${pkgs.keybase}/bin/keybase service";
         Restart = "on-failure";
         PrivateTmp = true;
       };

nixos/modules/services/networking/unifi.nix

@@ -147,8 +147,10 @@ in
       }) mountPoints;
 
     systemd.tmpfiles.rules = [
-      "e '${stateDir}' 0700 unifi - - -"
+      "d '${stateDir}' 0700 unifi - - -"
       "d '${stateDir}/data' 0700 unifi - - -"
+      "d '${stateDir}/webapps' 0700 unifi - - -"
+      "L+ '${stateDir}/webapps/ROOT' - - - - ${cfg.unifiPackage}/webapps/ROOT"
     ];
 
     systemd.services.unifi = {
@@ -161,17 +163,6 @@ in
       # This a HACK to fix missing dependencies of dynamic libs extracted from jars
       environment.LD_LIBRARY_PATH = with pkgs.stdenv; "${cc.cc.lib}/lib";
 
-      preStart = ''
-        # Create the volatile webapps
-        rm -rf "${stateDir}/webapps"
-        mkdir -p "${stateDir}/webapps"
-        ln -s "${cfg.unifiPackage}/webapps/ROOT" "${stateDir}/webapps/ROOT"
-      '';
-
-      postStop = ''
-        rm -rf "${stateDir}/webapps"
-      '';
-
       serviceConfig = {
         Type = "simple";
         ExecStart = "${(removeSuffix "\n" cmd)} start";

nixos/modules/services/security/bitwarden_rs/default.nix

@@ -18,15 +18,33 @@ let
         else key + toUpper x) "" parts;
     in if builtins.match "[A-Z0-9_]+" name != null then name else partsToEnvVar parts;
 
-  configFile = pkgs.writeText "bitwarden_rs.env" (concatMapStrings (s: s + "\n") (
+  # Due to the different naming schemes allowed for config keys,
-    (concatLists (mapAttrsToList (name: value:
+  # we can only check for values consistently after converting them to their corresponding environment variable name.
-      if value != null then [ "${nameToEnvVar name}=${if isBool value then boolToString value else toString value}" ] else []
+  configEnv =
-    ) cfg.config))));
+    let
+      configEnv = listToAttrs (concatLists (mapAttrsToList (name: value:
+        if value != null then [ (nameValuePair (nameToEnvVar name) (if isBool value then boolToString value else toString value)) ] else []
+      ) cfg.config));
+    in { DATA_FOLDER = "/var/lib/bitwarden_rs"; } // optionalAttrs (!(configEnv ? WEB_VAULT_ENABLED) || configEnv.WEB_VAULT_ENABLED == "true") {
+      WEB_VAULT_FOLDER = "${pkgs.bitwarden_rs-vault}/share/bitwarden_rs/vault";
+    } // configEnv;
+
+  configFile = pkgs.writeText "bitwarden_rs.env" (concatStrings (mapAttrsToList (name: value: "${name}=${value}\n") configEnv));
+
+  bitwarden_rs = pkgs.bitwarden_rs.override { inherit (cfg) dbBackend; };
 
 in {
   options.services.bitwarden_rs = with types; {
     enable = mkEnableOption "bitwarden_rs";
 
+    dbBackend = mkOption {
+      type = enum [ "sqlite" "mysql" "postgresql" ];
+      default = "sqlite";
+      description = ''
+        Which database backend bitwarden_rs will be using.
+      '';
+    };
+
     backupDir = mkOption {
       type = nullOr str;
       default = null;
@@ -56,23 +74,20 @@ in {
         even though foo2 would have been converted to FOO_2.
         This allows working around any potential future conflicting naming conventions.
 
-        Based on the attributes passed to this config option a environment file will be generated
+        Based on the attributes passed to this config option an environment file will be generated
         that is passed to bitwarden_rs's systemd service.
 
         The available configuration options can be found in
-        <link xlink:href="https://github.com/dani-garcia/bitwarden_rs/blob/1.8.0/.env.template">the environment template file</link>.
+        <link xlink:href="https://github.com/dani-garcia/bitwarden_rs/blob/${bitwarden_rs.version}/.env.template">the environment template file</link>.
       '';
-      apply = config: optionalAttrs config.webVaultEnabled {
-        webVaultFolder = "${pkgs.bitwarden_rs-vault}/share/bitwarden_rs/vault";
-      } // config;
     };
   };
 
   config = mkIf cfg.enable {
-    services.bitwarden_rs.config = {
+    assertions = [ {
-      dataFolder = "/var/lib/bitwarden_rs";
+      assertion = cfg.backupDir != null -> cfg.dbBackend == "sqlite";
-      webVaultEnabled = mkDefault true;
+      message = "Backups for database backends other than sqlite will need customization";
-    };
+    } ];
 
     users.users.bitwarden_rs = {
       inherit group;
@@ -87,7 +102,7 @@ in {
         User = user;
         Group = group;
         EnvironmentFile = configFile;
-        ExecStart = "${pkgs.bitwarden_rs}/bin/bitwarden_rs";
+        ExecStart = "${bitwarden_rs}/bin/bitwarden_rs";
         LimitNOFILE = "1048576";
         LimitNPROC = "64";
         PrivateTmp = "true";
@@ -109,6 +124,7 @@ in {
       path = with pkgs; [ sqlite ];
       serviceConfig = {
         SyslogIdentifier = "backup-bitwarden_rs";
+        Type = "oneshot";
         User = mkDefault user;
         Group = mkDefault group;
         ExecStart = "${pkgs.bash}/bin/bash ${./backup.sh}";

nixos/modules/services/web-servers/apache-httpd/default.nix

@@ -179,6 +179,28 @@ let
         then hostOpts.documentRoot
         else pkgs.runCommand "empty" { preferLocalBuild = true; } "mkdir -p $out"
       ;
+
+      mkLocations = locations: concatStringsSep "\n" (map (config: ''
+        <Location ${config.location}>
+          ${optionalString (config.proxyPass != null) ''
+            <IfModule mod_proxy.c>
+                ProxyPass ${config.proxyPass}
+                ProxyPassReverse ${config.proxyPass}
+            </IfModule>
+          ''}
+          ${optionalString (config.index != null) ''
+            <IfModule mod_dir.c>
+                DirectoryIndex ${config.index}
+            </IfModule>
+          ''}
+          ${optionalString (config.alias != null) ''
+            <IfModule mod_alias.c>
+                Alias "${config.alias}"
+            </IfModule>
+          ''}
+          ${config.extraConfig}
+        </Location>
+      '') (sortProperties (mapAttrsToList (k: v: v // { location = k; }) locations)));
     in
       ''
         ${optionalString mainCfg.logPerVirtualHost ''
@@ -217,12 +239,6 @@ let
           RedirectPermanent / ${hostOpts.globalRedirect}
         ''}
 
-        ${
-          let makeFileConf = elem: ''
-                Alias ${elem.urlPath} ${elem.file}
-              '';
-          in concatMapStrings makeFileConf hostOpts.servedFiles
-        }
         ${
           let makeDirConf = elem: ''
                 Alias ${elem.urlPath} ${elem.dir}/
@@ -235,6 +251,7 @@ let
           in concatMapStrings makeDirConf hostOpts.servedDirs
         }
 
+        ${mkLocations hostOpts.locations}
         ${hostOpts.extraConfig}
       ''
   ;
@@ -606,6 +623,11 @@ in
       }
     ];
 
+    warnings =
+      mapAttrsToList (name: hostOpts: ''
+        Using config.services.httpd.virtualHosts."${name}".servedFiles is deprecated and will become unsupported in a future release. Your configuration will continue to work as is but please migrate your configuration to config.services.httpd.virtualHosts."${name}".locations before the 20.09 release of NixOS.
+      '') (filterAttrs (name: hostOpts: hostOpts.servedFiles != []) mainCfg.virtualHosts);
+
     users.users = optionalAttrs (mainCfg.user == "wwwrun") {
       wwwrun = {
         group = mainCfg.group;

nixos/modules/services/web-servers/apache-httpd/location-options.nix

@@ -0,0 +1,54 @@
+{ config, lib, name, ... }:
+let
+  inherit (lib) mkOption types;
+in
+{
+  options = {
+
+    proxyPass = mkOption {
+      type = with types; nullOr str;
+      default = null;
+      example = "http://www.example.org/";
+      description = ''
+        Sets up a simple reverse proxy as described by <link xlink:href="https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#simple" />.
+      '';
+    };
+
+    index = mkOption {
+      type = with types; nullOr str;
+      default = null;
+      example = "index.php index.html";
+      description = ''
+        Adds DirectoryIndex directive. See <link xlink:href="https://httpd.apache.org/docs/2.4/mod/mod_dir.html#directoryindex" />.
+      '';
+    };
+
+    alias = mkOption {
+      type = with types; nullOr path;
+      default = null;
+      example = "/your/alias/directory";
+      description = ''
+        Alias directory for requests. See <link xlink:href="https://httpd.apache.org/docs/2.4/mod/mod_alias.html#alias" />.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        These lines go to the end of the location verbatim.
+      '';
+    };
+
+    priority = mkOption {
+      type = types.int;
+      default = 1000;
+      description = ''
+        Order of this location block in relation to the others in the vhost.
+        The semantics are the same as with `lib.mkOrder`. Smaller values have
+        a greater priority.
+      '';
+    };
+
+  };
+}

nixos/modules/services/web-servers/apache-httpd/per-server-options.nix

@@ -1,6 +1,6 @@
 { config, lib, name, ... }:
 let
-  inherit (lib) mkOption types;
+  inherit (lib) literalExample mkOption nameValuePair types;
 in
 {
   options = {
@@ -175,6 +175,12 @@ in
       ];
       description = ''
         This option provides a simple way to serve individual, static files.
+
+        <note><para>
+          This option has been deprecated and will be removed in a future
+          version of NixOS. You can achieve the same result by making use of
+          the <literal>locations.&lt;name&gt;.alias</literal> option.
+        </para></note>
       '';
     };
 
@@ -231,5 +237,30 @@ in
       '';
     };
 
+    locations = mkOption {
+      type = with types; attrsOf (submodule (import ./location-options.nix));
+      default = {};
+      example = literalExample ''
+        {
+          "/" = {
+            proxyPass = "http://localhost:3000";
+          };
+          "/foo/bar.png" = {
+            alias = "/home/eelco/some-file.png";
+          };
+        };
+      '';
+      description = ''
+        Declarative location config. See <link
+        xlink:href="https://httpd.apache.org/docs/2.4/mod/core.html#location"/> for details.
+      '';
+    };
+
+  };
+
+  config = {
+
+    locations = builtins.listToAttrs (map (elem: nameValuePair elem.urlPath { alias = elem.file; }) config.servedFiles);
+
   };
 }

nixos/modules/services/x11/desktop-managers/default.nix

@@ -68,21 +68,15 @@ in
           scripts before forwarding the value to the
           <varname>displayManager</varname>.
         '';
-        apply = list: {
+        apply = map (d: d // {
-          list = map (d: d // {
+          manage = "desktop";
-            manage = "desktop";
+          start = d.start
-            start = d.start
+          + optionalString (needBGCond d) ''
-            + optionalString (needBGCond d) ''
+            if [ -e $HOME/.background-image ]; then
-              if [ -e $HOME/.background-image ]; then
+              ${pkgs.feh}/bin/feh --bg-${cfg.wallpaper.mode} ${optionalString cfg.wallpaper.combineScreens "--no-xinerama"} $HOME/.background-image
-                ${pkgs.feh}/bin/feh --bg-${cfg.wallpaper.mode} ${optionalString cfg.wallpaper.combineScreens "--no-xinerama"} $HOME/.background-image
+            fi
-              else
+          '';
-                # Use a solid black background as fallback
+        });
-                ${pkgs.xorg.xsetroot}/bin/xsetroot -solid black
-              fi
-            '';
-          }) list;
-          needBGPackages = [] != filter needBGCond list;
-        };
       };
 
       default = mkOption {
@@ -100,5 +94,5 @@ in
 
   };
 
-  config.services.xserver.displayManager.session = cfg.session.list;
+  config.services.xserver.displayManager.session = cfg.session;
 }

nixos/modules/services/x11/desktop-managers/gnome3.nix

@@ -334,7 +334,6 @@ in
         cheese
         eog
         epiphany
-        geary
         gedit
         gnome-calculator
         gnome-calendar
@@ -361,6 +360,7 @@ in
       # Enable default programs
       programs.evince.enable = mkDefault true;
       programs.file-roller.enable = mkDefault true;
+      programs.geary.enable = mkDefault true;
       programs.gnome-disks.enable = mkDefault true;
       programs.gnome-terminal.enable = mkDefault true;
       programs.seahorse.enable = mkDefault true;

nixos/modules/services/x11/xserver.nix

@@ -556,8 +556,7 @@ in
 
     services.xserver.displayManager.lightdm.enable =
       let dmconf = cfg.displayManager;
-          default = !( dmconf.auto.enable
+          default = !(dmconf.gdm.enable
-                    || dmconf.gdm.enable
                     || dmconf.sddm.enable
                     || dmconf.xpra.enable );
       in mkIf (default) true;

nixos/modules/virtualisation/docker-containers.nix

@@ -10,11 +10,24 @@ let
       options = {
 
         image = mkOption {
-          type = types.str;
+          type = with types; str;
           description = "Docker image to run.";
           example = "library/hello-world";
         };
 
+        imageFile = mkOption {
+          type = with types; nullOr package;
+          default = null;
+          description = ''
+            Path to an image file to load instead of pulling from a registry.
+            If defined, do not pull from registry.
+
+            You still need to set the <literal>image</literal> attribute, as it
+            will be used as the image name for docker to start a container.
+          '';
+          example = literalExample "pkgs.dockerTools.buildDockerImage {...};";
+        };
+
         cmd = mkOption {
           type =  with types; listOf str;
           default = [];
@@ -153,6 +166,24 @@ let
           example = "/var/lib/hello_world";
         };
 
+        dependsOn = mkOption {
+          type = with types; listOf str;
+          default = [];
+          description = ''
+            Define which other containers this one depends on. They will be added to both After and Requires for the unit.
+
+            Use the same name as the attribute under <literal>services.docker-containers</literal>.
+          '';
+          example = literalExample ''
+            services.docker-containers = {
+              node1 = {};
+              node2 = {
+                dependsOn = [ "node1" ];
+              }
+            }
+          '';
+        };
+
         extraDockerOptions = mkOption {
           type = with types; listOf str;
           default = [];
@@ -164,15 +195,18 @@ let
       };
     };
 
-  mkService = name: container: {
+  mkService = name: container: let
+    mkAfter = map (x: "docker-${x}.service") container.dependsOn;
+  in rec {
     wantedBy = [ "multi-user.target" ];
-    after = [ "docker.service" "docker.socket" ];
+    after = [ "docker.service" "docker.socket" ] ++ mkAfter;
-    requires = [ "docker.service" "docker.socket" ];
+    requires = after;
+
     serviceConfig = {
       ExecStart = concatStringsSep " \\\n  " ([
         "${pkgs.docker}/bin/docker run"
         "--rm"
-        "--name=%n"
+        "--name=${name}"
         "--log-driver=${container.log-driver}"
       ] ++ optional (container.entrypoint != null)
         "--entrypoint=${escapeShellArg container.entrypoint}"
@@ -185,9 +219,14 @@ let
         ++ [container.image]
         ++ map escapeShellArg container.cmd
       );
-      ExecStartPre = "-${pkgs.docker}/bin/docker rm -f %n";
+
-      ExecStop = ''${pkgs.bash}/bin/sh -c "[ $SERVICE_RESULT = success ] || ${pkgs.docker}/bin/docker stop %n"'';
+      ExecStartPre = ["-${pkgs.docker}/bin/docker rm -f ${name}"
-      ExecStopPost = "-${pkgs.docker}/bin/docker rm -f %n";
+                      "-${pkgs.docker}/bin/docker image prune -f"] ++
+        (optional (container.imageFile != null)
+                ["${pkgs.docker}/bin/docker load -i ${container.imageFile}"]);
+
+      ExecStop = ''${pkgs.bash}/bin/sh -c "[ $SERVICE_RESULT = success ] || ${pkgs.docker}/bin/docker stop ${name}"'';
+      ExecStopPost = "-${pkgs.docker}/bin/docker rm -f ${name}";
 
       ### There is no generalized way of supporting `reload` for docker
       ### containers. Some containers may respond well to SIGHUP sent to their

nixos/modules/virtualisation/lxd.nix

@@ -7,6 +7,7 @@ with lib;
 let
 
   cfg = config.virtualisation.lxd;
+  zfsCfg = config.boot.zfs;
 
 in
 
@@ -26,11 +27,40 @@ in
           <command>lxc</command> command line tool, among others.
         '';
       };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.lxd;
+        defaultText = "pkgs.lxd";
+        description = ''
+          The LXD package to use.
+        '';
+      };
+
+      lxcPackage = mkOption {
+        type = types.package;
+        default = pkgs.lxc;
+        defaultText = "pkgs.lxc";
+        description = ''
+          The LXC package to use with LXD (required for AppArmor profiles).
+        '';
+      };
+
+      zfsPackage = mkOption {
+        type = types.package;
+        default = with pkgs; if zfsCfg.enableUnstable then zfsUnstable else zfs;
+        defaultText = "pkgs.zfs";
+        description = ''
+          The ZFS package to use with LXD.
+        '';
+      };
+
       zfsSupport = mkOption {
         type = types.bool;
         default = false;
         description = ''
-          enables lxd to use zfs as a storage for containers.
+          Enables lxd to use zfs as a storage for containers.
+
           This option is enabled by default if a zfs pool is configured
           with nixos.
         '';
@@ -54,15 +84,15 @@ in
 
   config = mkIf cfg.enable {
 
-    environment.systemPackages = [ pkgs.lxd ];
+    environment.systemPackages = [ cfg.package ];
 
     security.apparmor = {
       enable = true;
       profiles = [
-        "${pkgs.lxc}/etc/apparmor.d/usr.bin.lxc-start"
+        "${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start"
-        "${pkgs.lxc}/etc/apparmor.d/lxc-containers"
+        "${cfg.lxcPackage}/etc/apparmor.d/lxc-containers"
       ];
-      packages = [ pkgs.lxc ];
+      packages = [ cfg.lxcPackage ];
     };
 
     systemd.services.lxd = {
@@ -71,14 +101,14 @@ in
       wantedBy = [ "multi-user.target" ];
       after = [ "systemd-udev-settle.service" ];
 
-      path = lib.optional cfg.zfsSupport pkgs.zfs;
+      path = lib.optional cfg.zfsSupport cfg.zfsPackage;
 
       preStart = ''
         mkdir -m 0755 -p /var/lib/lxc/rootfs
       '';
 
       serviceConfig = {
-        ExecStart = "@${pkgs.lxd.bin}/bin/lxd lxd --group lxd";
+        ExecStart = "@${cfg.package.bin}/bin/lxd lxd --group lxd";
         Type = "simple";
         KillMode = "process"; # when stopping, leave the containers alone
         LimitMEMLOCK = "infinity";

nixos/tests/all-tests.nix

@@ -94,6 +94,7 @@ in
   flannel = handleTestOn ["x86_64-linux"] ./flannel.nix {};
   fluentd = handleTest ./fluentd.nix {};
   fontconfig-default-fonts = handleTest ./fontconfig-default-fonts.nix {};
+  freeswitch = handleTest ./freeswitch.nix {};
   fsck = handleTest ./fsck.nix {};
   gotify-server = handleTest ./gotify-server.nix {};
   gitea = handleTest ./gitea.nix {};
@@ -293,6 +294,7 @@ in
   upnp = handleTest ./upnp.nix {};
   uwsgi = handleTest ./uwsgi.nix {};
   vault = handleTest ./vault.nix {};
+  victoriametrics = handleTest ./victoriametrics.nix {};
   virtualbox = handleTestOn ["x86_64-linux"] ./virtualbox.nix {};
   wireguard = handleTest ./wireguard {};
   wireguard-generated = handleTest ./wireguard/generated.nix {};

nixos/tests/chromium.nix

@@ -23,7 +23,7 @@ mapAttrs (channel: chromiumPkg: makeTest rec {
 
   machine.imports = [ ./common/user-account.nix ./common/x11.nix ];
   machine.virtualisation.memorySize = 2047;
-  machine.services.xserver.displayManager.auto.user = "alice";
+  machine.test-support.displayManager.auto.user = "alice";
   machine.environment.systemPackages = [ chromiumPkg ];
 
   startupHTML = pkgs.writeText "chromium-startup.html" ''

nixos/tests/common/auto.nix

@@ -5,7 +5,7 @@ with lib;
 let
 
   dmcfg = config.services.xserver.displayManager;
-  cfg = dmcfg.auto;
+  cfg = config.test-support.displayManager.auto;
 
 in
 
@@ -15,7 +15,7 @@ in
 
   options = {
 
-    services.xserver.displayManager.auto = {
+    test-support.displayManager.auto = {
 
       enable = mkOption {
         default = false;

nixos/tests/common/x11.nix

@@ -1,9 +1,14 @@
 { lib, ... }:
 
-{ services.xserver.enable = true;
+{
+  imports = [
+    ./auto.nix
+  ];
+
+  services.xserver.enable = true;
 
   # Automatically log in.
-  services.xserver.displayManager.auto.enable = true;
+  test-support.displayManager.auto.enable = true;
 
   # Use IceWM as the window manager.
   # Don't use a desktop manager.

nixos/tests/docker-containers.nix

@@ -1,9 +1,11 @@
 # Test Docker containers as systemd units
 
-import ./make-test.nix ({ pkgs, lib, ... }: {
+import ./make-test.nix ({ pkgs, lib, ... }:
+
+{
   name = "docker-containers";
   meta = {
-    maintainers = with lib.maintainers; [ benley ];
+    maintainers = with lib.maintainers; [ benley mkaito ];
   };
 
   nodes = {
@@ -11,10 +13,9 @@ import ./make-test.nix ({ pkgs, lib, ... }: {
       {
         virtualisation.docker.enable = true;
 
-        virtualisation.dockerPreloader.images = [ pkgs.dockerTools.examples.nginx ];
-
         docker-containers.nginx = {
           image = "nginx-container";
+          imageFile = pkgs.dockerTools.examples.nginx;
           ports = ["8181:80"];
         };
       };

nixos/tests/docker-tools.nix

@@ -80,5 +80,8 @@ import ./make-test.nix ({ pkgs, ... }: {
       # This is to be sure the order of layers of the parent image is preserved
       $docker->succeed("docker run --rm  ${pkgs.dockerTools.examples.layersOrder.imageName} cat /tmp/layer2 | grep -q layer2");
       $docker->succeed("docker run --rm  ${pkgs.dockerTools.examples.layersOrder.imageName} cat /tmp/layer3 | grep -q layer3");
+
+      # Ensure image with only 2 layers can be loaded
+      $docker->succeed("docker load --input='${pkgs.dockerTools.examples.two-layered-image}'");
     '';
 })

nixos/tests/freeswitch.nix

@@ -0,0 +1,29 @@
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "freeswitch";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ misuzu ];
+  };
+  nodes = {
+    node0 = { config, lib, ... }: {
+      networking.useDHCP = false;
+      networking.interfaces.eth1 = {
+        ipv4.addresses = [
+          {
+            address = "192.168.0.1";
+            prefixLength = 24;
+          }
+        ];
+      };
+      services.freeswitch = {
+        enable = true;
+        enableReload = true;
+        configTemplate = "${config.services.freeswitch.package}/share/freeswitch/conf/minimal";
+      };
+    };
+  };
+  testScript = ''
+    node0.wait_for_unit("freeswitch.service")
+    # Wait for SIP port to be open
+    node0.wait_for_open_port("5060")
+  '';
+})

nixos/tests/gnome3.nix

@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
   name = "gnome3";
   meta = with pkgs.stdenv.lib.maintainers; {
     maintainers = pkgs.gnome3.maintainers;
@@ -24,41 +24,53 @@ import ./make-test.nix ({ pkgs, ...} : {
       virtualisation.memorySize = 1024;
     };
 
-  testScript = let
+  testScript = { nodes, ... }: let
     # Keep line widths somewhat managable
-    bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus";
+    user = nodes.machine.config.users.users.alice;
+    uid = toString user.uid;
+    bus = "DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/${uid}/bus";
     gdbus = "${bus} gdbus";
+    su = command: "su - ${user.name} -c '${command}'";
+
     # Call javascript in gnome shell, returns a tuple (success, output), where
     # `success` is true if the dbus call was successful and output is what the
     # javascript evaluates to.
     eval = "call --session -d org.gnome.Shell -o /org/gnome/Shell -m org.gnome.Shell.Eval";
+
     # False when startup is done
-    startingUp = "${gdbus} ${eval} Main.layoutManager._startingUp";
+    startingUp = su "${gdbus} ${eval} Main.layoutManager._startingUp";
+
+    # Start gnome-terminal
+    gnomeTerminalCommand = su "${bus} gnome-terminal";
+
     # Hopefully gnome-terminal's wm class
-    wmClass = "${gdbus} ${eval} global.display.focus_window.wm_class";
+    wmClass = su "${gdbus} ${eval} global.display.focus_window.wm_class";
   in ''
-      # wait for gdm to start
+      with subtest("Login to GNOME with GDM"):
-      $machine->waitForUnit("display-manager.service");
+          # wait for gdm to start
+          machine.wait_for_unit("display-manager.service")
+          # wait for the wayland server
+          machine.wait_for_file("/run/user/${uid}/wayland-0")
+          # wait for alice to be logged in
+          machine.wait_for_unit("default.target", "${user.name}")
+          # check that logging in has given the user ownership of devices
+          assert "alice" in machine.succeed("getfacl -p /dev/snd/timer")
 
-      # wait for alice to be logged in
+      with subtest("Wait for GNOME Shell"):
-      $machine->waitForUnit("default.target","alice");
+          # correct output should be (true, 'false')
+          machine.wait_until_succeeds(
+              "${startingUp} | grep -q 'true,..false'"
+          )
 
-      # Check that logging in has given the user ownership of devices.
+      with subtest("Open Gnome Terminal"):
-      $machine->succeed("getfacl -p /dev/snd/timer | grep -q alice");
+          machine.succeed(
-
+              "${gnomeTerminalCommand}"
-      # Wait for the wayland server
+          )
-      $machine->waitForFile("/run/user/1000/wayland-0");
+          # correct output should be (true, '"gnome-terminal-server"')
-
+          machine.wait_until_succeeds(
-      # Wait for gnome shell, correct output should be "(true, 'false')"
+              "${wmClass} | grep -q 'gnome-terminal-server'"
-      $machine->waitUntilSucceeds("su - alice -c '${startingUp} | grep -q true,..false'");
+          )
-
+          machine.sleep(20)
-      # open a terminal
+          machine.screenshot("screen")
-      $machine->succeed("su - alice -c '${bus} gnome-terminal'");
-      # and check it's there
-      $machine->waitUntilSucceeds("su - alice -c '${wmClass} | grep -q gnome-terminal-server'");
-
-      # wait to get a nice screenshot
-      $machine->sleep(20);
-      $machine->screenshot("screen");
     '';
 })

nixos/tests/i3wm.nix

@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
 
   machine = { lib, ... }: {
     imports = [ ./common/x11.nix ./common/user-account.nix ];
-    services.xserver.displayManager.auto.user = "alice";
+    test-support.displayManager.auto.user = "alice";
     services.xserver.displayManager.defaultSession = lib.mkForce "none+i3";
     services.xserver.windowManager.i3.enable = true;
   };

nixos/tests/signal-desktop.nix

@@ -15,7 +15,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
     ];
 
     services.xserver.enable = true;
-    services.xserver.displayManager.auto.user = "alice";
+    test-support.displayManager.auto.user = "alice";
     environment.systemPackages = [ pkgs.signal-desktop ];
   };
 

nixos/tests/systemd.nix

@@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }: {
   name = "systemd";
 
   machine = { lib, ... }: {
@@ -19,7 +19,7 @@ import ./make-test.nix ({ pkgs, ... }: {
     systemd.extraConfig = "DefaultEnvironment=\"XXX_SYSTEM=foo\"";
     systemd.user.extraConfig = "DefaultEnvironment=\"XXX_USER=bar\"";
     services.journald.extraConfig = "Storage=volatile";
-    services.xserver.displayManager.auto.user = "alice";
+    test-support.displayManager.auto.user = "alice";
 
     systemd.shutdown.test = pkgs.writeScript "test.shutdown" ''
       #!${pkgs.stdenv.shell}
@@ -53,50 +53,69 @@ import ./make-test.nix ({ pkgs, ... }: {
   };
 
   testScript = ''
-    $machine->waitForX;
+    import re
+    import subprocess
+
+    machine.wait_for_x()
     # wait for user services
-    $machine->waitForUnit("default.target","alice");
+    machine.wait_for_unit("default.target", "alice")
 
     # Regression test for https://github.com/NixOS/nixpkgs/issues/35415
-    subtest "configuration files are recognized by systemd", sub {
+    with subtest("configuration files are recognized by systemd"):
-      $machine->succeed('test -e /system_conf_read');
+        machine.succeed("test -e /system_conf_read")
-      $machine->succeed('test -e /home/alice/user_conf_read');
+        machine.succeed("test -e /home/alice/user_conf_read")
-      $machine->succeed('test -z $(ls -1 /var/log/journal)');
+        machine.succeed("test -z $(ls -1 /var/log/journal)")
-    };
 
     # Regression test for https://github.com/NixOS/nixpkgs/issues/50273
-    subtest "DynamicUser actually allocates a user", sub {
+    with subtest("DynamicUser actually allocates a user"):
-        $machine->succeed('systemd-run --pty --property=Type=oneshot --property=DynamicUser=yes --property=User=iamatest whoami | grep iamatest');
+        assert "iamatest" in machine.succeed(
-    };
+            "systemd-run --pty --property=Type=oneshot --property=DynamicUser=yes --property=User=iamatest whoami"
+        )
 
     # Regression test for https://github.com/NixOS/nixpkgs/issues/35268
-    subtest "file system with x-initrd.mount is not unmounted", sub {
+    with subtest("file system with x-initrd.mount is not unmounted"):
-      $machine->succeed('mountpoint -q /test-x-initrd-mount');
+        machine.succeed("mountpoint -q /test-x-initrd-mount")
-      $machine->shutdown;
+        machine.shutdown()
-      system('qemu-img', 'convert', '-O', 'raw',
-             'vm-state-machine/empty2.qcow2', 'x-initrd-mount.raw');
-      my $extinfo = `${pkgs.e2fsprogs}/bin/dumpe2fs x-initrd-mount.raw`;
-      die "File system was not cleanly unmounted: $extinfo"
-        unless $extinfo =~ /^Filesystem state: *clean$/m;
-    };
 
-    subtest "systemd-shutdown works", sub {
+        subprocess.check_call(
-      $machine->shutdown;
+            [
-      $machine->waitForUnit('multi-user.target');
+                "qemu-img",
-      $machine->succeed('test -e /tmp/shared/shutdown-test');
+                "convert",
-    };
+                "-O",
+                "raw",
+                "vm-state-machine/empty0.qcow2",
+                "x-initrd-mount.raw",
+            ]
+        )
+        extinfo = subprocess.check_output(
+            [
+                "${pkgs.e2fsprogs}/bin/dumpe2fs",
+                "x-initrd-mount.raw",
+            ]
+        ).decode("utf-8")
+        assert (
+            re.search(r"^Filesystem state: *clean$", extinfo, re.MULTILINE) is not None
+        ), ("File system was not cleanly unmounted: " + extinfo)
 
-   # Test settings from /etc/sysctl.d/50-default.conf are applied
+    with subtest("systemd-shutdown works"):
-   subtest "systemd sysctl settings are applied", sub {
+        machine.shutdown()
-     $machine->waitForUnit('multi-user.target');
+        machine.wait_for_unit("multi-user.target")
-     $machine->succeed('sysctl net.core.default_qdisc | grep -q "fq_codel"');
+        machine.succeed("test -e /tmp/shared/shutdown-test")
-   };
 
-   # Test cgroup accounting is enabled
+    # Test settings from /etc/sysctl.d/50-default.conf are applied
-   subtest "systemd cgroup accounting is enabled", sub {
+    with subtest("systemd sysctl settings are applied"):
-     $machine->waitForUnit('multi-user.target');
+        machine.wait_for_unit("multi-user.target")
-     $machine->succeed('systemctl show testservice1.service -p IOAccounting | grep -q "yes"');
+        assert "fq_codel" in machine.succeed("sysctl net.core.default_qdisc")
-     $machine->succeed('systemctl status testservice1.service | grep -q "CPU:"');
+
-   };
+    # Test cgroup accounting is enabled
+    with subtest("systemd cgroup accounting is enabled"):
+        machine.wait_for_unit("multi-user.target")
+        assert "yes" in machine.succeed(
+            "systemctl show testservice1.service -p IOAccounting"
+        )
+
+        retcode, output = machine.execute("systemctl status testservice1.service")
+        assert retcode in [0, 3]  # https://bugs.freedesktop.org/show_bug.cgi?id=77507
+        assert "CPU:" in output
   '';
 })

nixos/tests/victoriametrics.nix

@@ -0,0 +1,31 @@
+# This test runs influxdb and checks if influxdb is up and running
+
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "victoriametrics";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ yorickvp ];
+  };
+
+  nodes = {
+    one = { ... }: {
+      services.victoriametrics.enable = true;
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    one.wait_for_unit("victoriametrics.service")
+
+    # write some points and run simple query
+    out = one.succeed(
+        "curl -d 'measurement,tag1=value1,tag2=value2 field1=123,field2=1.23' -X POST 'http://localhost:8428/write'"
+    )
+    cmd = """curl -s -G 'http://localhost:8428/api/v1/export' -d 'match={__name__!=""}'"""
+    # data takes a while to appear
+    one.wait_until_succeeds(f"[[ $({cmd} | wc -l) -ne 0 ]]")
+    out = one.succeed(cmd)
+    assert '"values":[123]' in out
+    assert '"values":[1.23]' in out
+  '';
+})

nixos/tests/virtualbox.nix

@@ -356,7 +356,7 @@ let
       virtualisation.qemu.options =
         if useKvmNestedVirt then ["-cpu" "kvm64,vmx=on"] else [];
       virtualisation.virtualbox.host.enable = true;
-      services.xserver.displayManager.auto.user = "alice";
+      test-support.displayManager.auto.user = "alice";
       users.users.alice.extraGroups = let
         inherit (config.virtualisation.virtualbox.host) enableHardening;
       in lib.mkIf enableHardening (lib.singleton "vboxusers");

nixos/tests/xautolock.nix

@@ -9,7 +9,7 @@ with lib;
   nodes.machine = {
     imports = [ ./common/x11.nix ./common/user-account.nix ];
 
-    services.xserver.displayManager.auto.user = "bob";
+    test-support.displayManager.auto.user = "bob";
     services.xserver.xautolock.enable = true;
     services.xserver.xautolock.time = 1;
   };

nixos/tests/xfce.nix

@@ -4,12 +4,20 @@ import ./make-test-python.nix ({ pkgs, ...} : {
   machine =
     { pkgs, ... }:
 
-    { imports = [ ./common/user-account.nix ];
+    {
+      imports = [
+        ./common/user-account.nix
+      ];
 
       services.xserver.enable = true;
 
-      services.xserver.displayManager.auto.enable = true;
+      services.xserver.displayManager.lightdm = {
-      services.xserver.displayManager.auto.user = "alice";
+        enable = true;
+        autoLogin = {
+          enable = true;
+          user = "alice";
+        };
+      };
 
       services.xserver.desktopManager.xfce.enable = true;
 

nixos/tests/xmonad.nix

@@ -6,7 +6,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
 
   machine = { pkgs, ... }: {
     imports = [ ./common/x11.nix ./common/user-account.nix ];
-    services.xserver.displayManager.auto.user = "alice";
+    test-support.displayManager.auto.user = "alice";
     services.xserver.displayManager.defaultSession = "none+xmonad";
     services.xserver.windowManager.xmonad = {
       enable = true;

nixos/tests/xrdp.nix

@@ -14,7 +14,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
 
     client = { pkgs, ... }: {
       imports = [ ./common/x11.nix ./common/user-account.nix ];
-      services.xserver.displayManager.auto.user = "alice";
+      test-support.displayManager.auto.user = "alice";
       environment.systemPackages = [ pkgs.freerdp ];
       services.xrdp.enable = true;
       services.xrdp.defaultWindowManager = "${pkgs.icewm}/bin/icewm";

nixos/tests/xss-lock.nix

@@ -10,12 +10,12 @@ with lib;
     simple = {
       imports = [ ./common/x11.nix ./common/user-account.nix ];
       programs.xss-lock.enable = true;
-      services.xserver.displayManager.auto.user = "alice";
+      test-support.displayManager.auto.user = "alice";
     };
 
     custom_lockcmd = { pkgs, ... }: {
       imports = [ ./common/x11.nix ./common/user-account.nix ];
-      services.xserver.displayManager.auto.user = "alice";
+      test-support.displayManager.auto.user = "alice";
 
       programs.xss-lock = {
         enable = true;

nixos/tests/yabar.nix

@@ -11,7 +11,7 @@ with lib;
   machine = {
     imports = [ ./common/x11.nix ./common/user-account.nix ];
 
-    services.xserver.displayManager.auto.user = "bob";
+    test-support.displayManager.auto.user = "bob";
 
     programs.yabar.enable = true;
     programs.yabar.bars = {

pkgs/applications/audio/gnaural/default.nix

@@ -1,19 +0,0 @@
-{ stdenv, fetchurl, pkgconfig, gtk2, libsndfile, portaudio }:
-
-stdenv.mkDerivation rec {
-  name = "gnaural-1.0.20110606";
-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ gtk2 libsndfile portaudio ];
-  src = fetchurl {
-    url = "mirror://sourceforge/gnaural/Gnaural/${name}.tar.gz";
-    sha256 = "0p9rasz1jmxf16vnpj17g3vzdjygcyz3l6nmbq6wr402l61f1vy5";
-  };
-  meta = with stdenv.lib;
-    { description = "Auditory binaural-beat generator";
-      homepage = http://gnaural.sourceforge.net/;
-      license = licenses.gpl2;
-      maintainers = [ maintainers.ehmry ];
-      platforms = platforms.linux;
-      broken = true;
-    };
-}

pkgs/applications/audio/gpodder/default.nix

@@ -5,14 +5,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gpodder";
-  version = "3.10.11";
+  version = "3.10.12";
   format = "other";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    sha256 = "15f5z3cnch9lpzbz73l4wjykv9n74y8djz5db53la2ql4ihaxfz9";
+    sha256 = "0q95am079gg01dkivr972mm2k87y8z296a9yf7amzsf9hxfycdra";
   };
 
   patches = [

pkgs/applications/audio/muse/default.nix

@@ -1,7 +1,9 @@
 { stdenv
 , fetchFromGitHub
 , libjack2
-, qt5
+, wrapQtAppsHook
+, qtsvg
+, qttools
 , cmake
 , libsndfile
 , libsamplerate
@@ -13,7 +15,6 @@
 , dssi
 , liblo
 , pkgconfig
-, gitAndTools
 }:
 
 stdenv.mkDerivation {
@@ -45,14 +46,14 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     pkgconfig
-    gitAndTools.gitFull
+    wrapQtAppsHook
+    qttools
+    cmake
   ];
 
   buildInputs = [
     libjack2
-    qt5.qtsvg
+    qtsvg
-    qt5.qttools
-    cmake
     libsndfile
     libsamplerate
     ladspaH
@@ -65,15 +66,4 @@ stdenv.mkDerivation {
   ];
 
   sourceRoot = "source/muse3";
-
-  buildPhase = ''
-    cd ..
-    bash compile_muse.sh
-  '';
-
-  installPhase = ''
-    mkdir $out
-    cd build
-    make install
-  '';
 }

pkgs/applications/audio/ncmpc/default.nix

@@ -10,13 +10,13 @@ assert pcreSupport -> pcre != null;
 
 stdenv.mkDerivation rec {
   pname = "ncmpc";
-  version = "0.36";
+  version = "0.37";
 
   src = fetchFromGitHub {
     owner  = "MusicPlayerDaemon";
     repo   = "ncmpc";
     rev    = "v${version}";
-    sha256 = "1ssmk1p43gjhcqi86sh6b7csqpwwpf3hs32cmnylv6pmbcwbs69h";
+    sha256 = "1b0vd0h49kjg4nxjfjrcg8gzplz93ryr6xyfha2pvhlrzdd2d1lj";
   };
 
   buildInputs = [ glib ncurses mpd_clientlib boost ]

pkgs/applications/audio/x42-plugins/default.nix

@@ -3,12 +3,12 @@
 , libGLU, lv2, gtk2, cairo, pango, fftwFloat, zita-convolver }:
 
 stdenv.mkDerivation rec {
-  version = "20191215";
+  version = "20200114";
   pname = "x42-plugins";
 
   src = fetchurl {
     url = "https://gareus.org/misc/x42-plugins/${pname}-${version}.tar.xz";
-    sha256 = "1mwfvhsvc0qgjyiwd8pmmam1mav43lmv39fljhmj9yri558v5g1c";
+    sha256 = "02f8wnsl9wg7pgf4sshr0hdjfjkwln870ffgjmb01nqk37v7hiyn";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/blockchains/bitcoin-gold.nix

@@ -0,0 +1,70 @@
+{ stdenv
+, fetchFromGitHub
+, openssl
+, boost
+, libevent
+, autoreconfHook
+, db4
+, pkgconfig
+, protobuf
+, hexdump
+, zeromq
+, libsodium
+, withGui
+, qtbase ? null
+, qttools ? null
+, wrapQtAppsHook ? null
+}:
+
+with stdenv.lib;
+
+stdenv.mkDerivation rec {
+  
+  pname = "bitcoin" + toString (optional (!withGui) "d") + "-gold";
+  version = "0.15.2";
+
+  src = fetchFromGitHub {
+    owner = "BTCGPU";
+    repo = "BTCGPU";
+    rev = "v${version}";
+    sha256 = "0grd1cd8d2nsrxl27la85kcan09z73fn70ncr9km4iccaj5pg12h";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkgconfig
+    hexdump
+  ] ++ optionals withGui [
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    openssl
+    boost
+    libevent
+    db4
+    zeromq
+    libsodium
+  ] ++ optionals withGui [
+    qtbase
+    qttools
+    protobuf
+  ];
+
+  enableParallelBuilding = true;
+
+  configureFlags = [
+      "--with-boost-libdir=${boost.out}/lib"
+  ] ++ optionals withGui [
+      "--with-gui=qt5"
+      "--with-qt-bindir=${qtbase.dev}/bin:${qttools.dev}/bin"
+  ];
+
+  meta = {
+    description = "BTG is a cryptocurrency with Bitcoin fundamentals, mined on common GPUs instead of specialty ASICs";
+    homepage = "https://bitcoingold.org/";
+    license = licenses.mit;
+    maintainers = [ maintainers.mmahut ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/blockchains/go-ethereum.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.9.9";
+  version = "1.9.10";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "00fhqn0b9grqz8iigzbijg7b1va58vccjb15fpy6yfr301z3ib1q";
+    sha256 = "0pm8gfr4g7rbax6vzxv6lklpx83mxghah7fyvpk3jqvm1mq299ln";
   };
 
-  modSha256 = "1rn1x3qc23wfcx9c61sw1sc6iqwvv2b9pv006lk1az4zbwh09dbm";
+  modSha256 = "0zar9nvx2nk6kyijp8df3y2rzxvg0mccj6b3skhzf8y9c27hvrsg";
 
   subPackages = [
     "cmd/abigen"

pkgs/applications/blockchains/litecoin.nix

@@ -1,14 +1,16 @@
-{ stdenv, fetchFromGitHub
+{ stdenv, mkDerivation, fetchFromGitHub
 , pkgconfig, autoreconfHook
 , openssl, db48, boost, zlib, miniupnpc
-, glib, protobuf, utillinux, qt4, qrencode
+, glib, protobuf, utillinux, qrencode
 , AppKit
 , withGui ? true, libevent
+, qtbase, qttools
+, zeromq
 }:
 
 with stdenv.lib;
 
-stdenv.mkDerivation rec {
+mkDerivation rec {
 
   name = "litecoin" + (toString (optional (!withGui) "d")) + "-" + version;
   version = "0.17.1";
@@ -21,13 +23,15 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkgconfig autoreconfHook ];
-  buildInputs = [ openssl db48 boost zlib
+  buildInputs = [ openssl db48 boost zlib zeromq
                   miniupnpc glib protobuf utillinux libevent ]
                   ++ optionals stdenv.isDarwin [ AppKit ]
-                  ++ optionals withGui [ qt4 qrencode ];
+                  ++ optionals withGui [ qtbase qttools qrencode ];
 
   configureFlags = [ "--with-boost-libdir=${boost.out}/lib" ]
-                     ++ optionals withGui [ "--with-gui=qt4" ];
+                   ++ optionals withGui [
+                      "--with-gui=qt5"
+                      "--with-qt-bindir=${qtbase.dev}/bin:${qttools.dev}/bin" ];
 
   enableParallelBuilding = true;
 

pkgs/applications/editors/android-studio/default.nix

@@ -13,9 +13,9 @@ let
     sha256Hash = "1nsm4d3vdx90szqd78a8mjq65xc9m5ipd35cqrlx3c3ny900sqxg";
   };
   betaVersion = {
-    version = "3.6.0.18"; # "Android Studio 3.6 RC 1"
+    version = "3.6.0.19"; # "Android Studio 3.6 RC 2"
-    build = "192.6071332";
+    build = "192.6165589";
-    sha256Hash = "0xpcihr5xxr9l1kv6aflywshs8fww3s7di0g98mz475whhxwzf3q";
+    sha256Hash = "1d47nfhzb0apfzin4bg5bck4jjid3jipm5s4n36r7fh20lpx93z5";
   };
   latestVersion = { # canary & dev
     version = "4.0.0.9"; # "Android Studio 4.0 Canary 9"

pkgs/applications/editors/hexdino/default.nix

@@ -1,6 +1,7 @@
 { stdenv, fetchFromGitHub, rustPlatform, ncurses }:
-rustPlatform.buildRustPackage rec {
+
-  name = "hexdino-${version}";
+rustPlatform.buildRustPackage {
+  pname = "hexdino";
   version = "0.1.0";
 
   src = fetchFromGitHub {

pkgs/applications/editors/uberwriter/default.nix

@@ -2,7 +2,7 @@
 , wrapGAppsHook, pkgconfig, desktop-file-utils
 , appstream-glib, pythonPackages, glib, gobject-introspection
 , gtk3, webkitgtk, glib-networking, gnome3, gspell, texlive
-, haskellPackages}:
+, shared-mime-info, haskellPackages}:
 
 let
   pythonEnv = pythonPackages.python.withPackages(p: with p;
@@ -11,13 +11,13 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "uberwriter";
-  version = "unstable-2019-11-29";
+  version = "unstable-2020-01-24";
 
   src = fetchFromGitHub {
     owner  = pname;
     repo   = pname;
-    rev    = "7606a55389f8516d9fed7927fa50ff8822ee9e38";
+    rev    = "0647b413407eb8789a25c353602c4ac979dc342a";
-    sha256 = "0ky001vs9nfvqf05h4q7fl0n8vsgim59z22i66a8sw6bqipv62sg";
+    sha256 = "19z52fpbf0p7dzx7q0r5pk3nn0c8z69g1hv6db0cqp61cqv5z95q";
   };
 
   nativeBuildInputs = [ meson ninja cmake pkgconfig desktop-file-utils
@@ -41,6 +41,7 @@ in stdenv.mkDerivation rec {
       --prefix PYTHONPATH : "$out/lib/python${pythonEnv.pythonVersion}/site-packages/"
       --prefix PATH : "${texliveDist}/bin"
       --prefix PATH : "${haskellPackages.pandoc-citeproc}/bin"
+      --prefix XDG_DATA_DIRS : "${shared-mime-info}/share"
     )
   '';
 

pkgs/applications/graphics/paraview/default.nix

@@ -55,11 +55,11 @@ mkDerivation rec {
   # so we need to put the correct sitePackages (with numpy) back on the path
   postInstall = ''
     wrapProgram $out/bin/paraview \
-      --set PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
+      --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
     wrapProgram $out/bin/pvbatch \
-      --set PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
+      --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
     wrapProgram $out/bin/pvpython \
-      --set PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
+      --prefix PYTHONPATH "${python.pkgs.numpy}/${python.sitePackages}"
   '';
 
   meta = {

pkgs/applications/misc/gpxsee/default.nix

@@ -1,14 +1,14 @@
-{ mkDerivation, lib, fetchFromGitHub, qmake, qttools }:
+{ stdenv, mkDerivation, lib, fetchFromGitHub, qmake, qttools }:
 
 mkDerivation rec {
   pname = "gpxsee";
-  version = "7.19";
+  version = "7.20";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "0mfmj0g6q6p2i6bd64ik1hq2l1ddqxnc6i9m30dnfl4v1zyvlc38";
+    sha256 = "08scvhhdadzz9iydhpkn2k618bgw26z09y6nydi3hi8fc3xfnb8d";
   };
 
   nativeBuildInputs = [ qmake ];
@@ -18,6 +18,12 @@ mkDerivation rec {
     lrelease lang/*.ts
   '';
 
+  postInstall = lib.optionalString stdenv.isDarwin ''
+    mkdir -p $out/Applications
+    mv GPXSee.app $out/Applications
+    wrapQtApp $out/Applications/GPXSee.app/Contents/MacOS/GPXSee
+  '';
+
   enableParallelBuilding = true;
 
   meta = with lib; {
@@ -29,6 +35,6 @@ mkDerivation rec {
     '';
     license = licenses.gpl3;
     maintainers = with maintainers; [ womfoo sikmir ];
-    platforms = platforms.linux;
+    platforms = with platforms; linux ++ darwin;
   };
 }

pkgs/applications/misc/hugo/default.nix

@@ -2,7 +2,7 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.62.2";
+  version = "0.63.2";
 
   goPackagePath = "github.com/gohugoio/hugo";
 
@@ -10,10 +10,10 @@ buildGoModule rec {
     owner = "gohugoio";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1rdfx5gv0q64ivyg0ilb96p5nksip9cj75fmvw0bjky9w6i07yd9";
+    sha256 = "1fylsx2isvims0xwcj831b1zcwsmd3igrnxjad44rhl2k3anq8vm";
   };
 
-  modSha256 = "0dwv5qnglv00jj7vlps76zlfpkzsplf93401j2l03xfvmvadifrs";
+  modSha256 = "0h95r3m6ca60dn1bllnw127nbfnkdjld94c3nyrzlwdczl2iaiyf";
 
   buildFlags = [ "-tags" "extended" ];
 

pkgs/applications/networking/browsers/chromium/browser.nix

@@ -60,8 +60,22 @@ mkChromiumDerivation (base: rec {
 
   meta = {
     description = "An open source web browser from Google";
-    homepage = http://www.chromium.org/;
+    longDescription = ''
-    maintainers = with maintainers; [ bendlas thefloweringash ];
+      Chromium is an open source web browser from Google that aims to build a
+      safer, faster, and more stable way for all Internet users to experience
+      the web. It has a minimalist user interface and provides the vast majority
+      of source code for Google Chrome (which has some additional features).
+    '';
+    homepage = https://www.chromium.org/;
+    maintainers = with maintainers; [ bendlas thefloweringash primeos ];
+    # Overview of the maintainer roles:
+    # nixos-unstable:
+    # - TODO: Need a new maintainer for x86_64 [0]
+    # - @thefloweringash: aarch64
+    # - @primeos: Provisional maintainer (x86_64)
+    # Stable channel:
+    # - TODO (need someone to test backports [0])
+    # [0]: https://github.com/NixOS/nixpkgs/issues/78450
     license = if enableWideVine then licenses.unfree else licenses.bsd3;
     platforms = platforms.linux;
     hydraPlatforms = if channel == "stable" then ["aarch64-linux" "x86_64-linux"] else [];

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,18 +1,18 @@
 # This file is autogenerated from update.sh in the same directory.
 {
   beta = {
-    sha256 = "1fbs6llrhm9jkzmk3v3a84d9is6g96kysy91hvpb0bw8f7anl969";
+    sha256 = "07h3znqb1r8hgcxzm5f04xkj2r66s1rhixqyyxi4hadf7qjx02n7";
-    sha256bin64 = "026gb4ypgidywvs4a031d0alv6fdphmlfybvgir4a73z8q263s26";
+    sha256bin64 = "0r7706gxdqws8dm5859869p5h8gas6f65qz674rk18l8dbg40fzw";
-    version = "80.0.3987.16";
+    version = "80.0.3987.66";
   };
   dev = {
-    sha256 = "1bczkk2q4fk1vgx34d9qgzqz7gsf89h6gd16apwcy6063lmrsizz";
+    sha256 = "1sm1ndq4y2d4fs4y9d5k4dcs6q2pqilv7b0ffx2nlazdrr73la3n";
-    sha256bin64 = "1ywi3x7rc4vwsg20lci37bw97873j3vvbxxv7m2nlh4nqcs5655q";
+    sha256bin64 = "0kr49hvk0c6pmxpm94fscxvdd6whxz1x7ic27xk86csjpjz6s5dg";
-    version = "81.0.4000.3";
+    version = "81.0.4033.2";
   };
   stable = {
-    sha256 = "1wafhpnaqwmmks4rs6x9m2b4jz4m4h27jch6gy71rk4hsy5hx5jd";
+    sha256 = "183vz3lf1588cr9s5vlnj65qvbmz36s8cg8k7dvr64cxmcqk86an";
-    sha256bin64 = "1dl43a94xd7vkx8mnp3ccgq18y624fffcfnfjhxgfc02c0c6an9l";
+    sha256bin64 = "1550fs4n3lgvb80hij2yq13zkw0bjih210ylpd74n1mw9yw4ygk1";
-    version = "79.0.3945.117";
+    version = "79.0.3945.130";
   };
 }

pkgs/applications/networking/cluster/kops/default.nix

@@ -67,7 +67,7 @@ in rec {
   };
 
   kops_1_15 = mkKops {
-    version = "1.15.0";
+    version = "1.15.1";
-    sha256 = "0sjas8pn0njl767b1y15g7cci2q3kxkxwmgr0wvs7vi3n1s1sf9d";
+    sha256 = "0iq2bqq6zv6sk2psar33c3smnz79rk5v623qx4kr5h47wnqvrfvj";
   };
 }

pkgs/applications/networking/instant-messengers/dino/default.nix

@@ -2,7 +2,8 @@
 , vala, cmake, ninja, wrapGAppsHook, pkgconfig, gettext
 , gobject-introspection, gnome3, glib, gdk-pixbuf, gtk3, glib-networking
 , xorg, libXdmcp, libxkbcommon
-, libnotify, libsoup, libgee
+, libnotify, libsoup, libgee, utillinux, libselinux, libsepol, libpsl, brotli
+, librsvg, libsignal-protocol-c
 , libgcrypt
 , epoxy
 , at-spi2-core
@@ -14,15 +15,15 @@
 , icu
  }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
-  name = "dino-unstable-2019-10-28";
+  pname = "dino";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "dino";
     repo = "dino";
-    rev = "388cc56674487e7b9e339637369fc55f0e271daf";
+    rev = "v${version}";
-    sha256 = "1v8rnjbzi8qhwb1fv787byxk8ygfs16z2j64h0s6sd3asr4n0kz1";
+    sha256 = "1k5cgj5n8s40i71wqdh6m1q0njl45ichfdbbywx9rga5hljz1c54";
-    fetchSubmodules = true;
   };
 
   nativeBuildInputs = [
@@ -51,21 +52,27 @@ stdenv.mkDerivation {
     pcre
     xorg.libxcb
     xorg.libpthreadstubs
+    xorg.libXtst
     libXdmcp
     libxkbcommon
     epoxy
     at-spi2-core
     dbus
     icu
+    utillinux
+    libselinux
+    libsepol
+    libpsl
+    brotli
+    libsignal-protocol-c
+    librsvg
   ];
 
-  enableParallelBuilding = true;
-
   meta = with stdenv.lib; {
     description = "Modern Jabber/XMPP Client using GTK/Vala";
     homepage = https://github.com/dino/dino;
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = [ maintainers.mic92 ];
+    maintainers = with maintainers; [ mic92 qyliss ];
   };
 }

pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix

@@ -18,12 +18,12 @@ with lib;
 
 mkDerivation rec {
   pname = "telegram-desktop";
-  version = "1.9.8";
+  version = "1.9.9";
 
   # Telegram-Desktop with submodules
   src = fetchurl {
     url = "https://github.com/telegramdesktop/tdesktop/releases/download/v${version}/tdesktop-${version}-full.tar.gz";
-    sha256 = "1rq3180l4ly0n0jj08cxy9l2d07scwp9hasmliva2xspyv7i9ksd";
+    sha256 = "08bxlqiapj9yqj9ywni33n5k7n3ckgfhv200snjqyqy9waqph1i6";
   };
 
   postPatch = ''
@@ -31,6 +31,8 @@ mkDerivation rec {
       --replace '"appindicator3"' '"${libappindicator-gtk3}/lib/libappindicator3.so"'
     substituteInPlace Telegram/lib_spellcheck/spellcheck/platform/linux/linux_enchant.cpp \
       --replace '"libenchant-2.so.2"' '"${enchant2}/lib/libenchant-2.so.2"'
+    substituteInPlace Telegram/CMakeLists.txt \
+      --replace '"''${TDESKTOP_LAUNCHER_BASENAME}.appdata.xml"' '"''${TDESKTOP_LAUNCHER_BASENAME}.metainfo.xml"'
   '';
 
   # We want to run wrapProgram manually (with additional parameters)
@@ -79,19 +81,6 @@ mkDerivation rec {
   # Both of these packages are included in this PR (kotatogram-desktop):
   # https://github.com/NixOS/nixpkgs/pull/75210
 
-  installPhase = ''
-    install -Dm755 bin/telegram-desktop $out/bin/telegram-desktop
-
-    mkdir -p $out/share/{kservices5,applications,metainfo}
-    sed "s,/usr/bin,$out/bin,g" "../lib/xdg/tg.protocol" > "$out/share/kservices5/tg.protocol"
-    install -m444 "../lib/xdg/telegramdesktop.desktop" "$out/share/applications/telegram-desktop.desktop"
-    install -m644 "../lib/xdg/telegramdesktop.appdata.xml" "$out/share/metainfo/telegramdesktop.metainfo.xml"
-
-    for icon_size in 16 32 48 64 128 256 512; do
-      install -Dm644 "../Telegram/Resources/art/icon''${icon_size}.png" "$out/share/icons/hicolor/''${icon_size}x''${icon_size}/apps/telegram.png"
-    done
-  '';
-
   postFixup = ''
     # This is necessary to run Telegram in a pure environment.
     # We also use gappsWrapperArgs from wrapGAppsHook.

pkgs/applications/networking/irc/hexchat/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "hexchat";
-  version = "2.14.2";
+  version = "2.14.3";
 
   src = fetchFromGitHub {
     owner = "hexchat";
     repo = "hexchat";
     rev = "v${version}";
-    sha256 = "1kz81xfis0bw2cfd6ndw32jdzdl5azk9ixqj4a3lginmlj6fs45a";
+    sha256 = "08kvp0dcn3bvmlqcfp9312075bwkqkpa8m7zybr88pfp210gfl85";
   };
 
   nativeBuildInputs = [ meson ninja pkgconfig ];
@@ -24,14 +24,6 @@ stdenv.mkDerivation rec {
     isocodes
   ];
 
-  patches = [
-    #https://github.com/hexchat/hexchat/issues/2237
-    (fetchpatch {
-      url = "https://src.fedoraproject.org/rpms/hexchat/raw/8a08a0c8a8da503b18f2fbb15194c5f3728a689a/f/0001-Python-plugin-Call-EndInterpreter-when-deinit-ing-th.patch";
-      sha256 = "1199dj3wvjqj6h5vlm7lzhaax84j9ki6an8y8fs4rww27iq0lk8g";
-    })
-  ];
-
   #hexchat and hexchat-text loads enchant spell checking library at run time and so it needs to have route to the path
   postPatch = ''
     sed -i "s,libenchant-2.so.2,${enchant2}/lib/libenchant-2.so.2,g" src/fe-gtk/sexy-spell-entry.c

pkgs/applications/networking/newsreaders/quiterss/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "quiterss";
-  version = "0.19.2";
+  version = "0.19.3";
 
   src = fetchFromGitHub {
     owner = "QuiteRSS";
     repo = "quiterss";
     rev = version;
-    sha256 = "1dmfag5hmy4jac20nizwgd92w8h2hdl2ch57hvw5hmjyfckn9rpj";
+    sha256 = "06m5mhzxvv8q2adaqcrar3sx2c1hc89h2i0qfjxmirfc5z67hdw2";
   };
 
   nativeBuildInputs = [ qmake pkgconfig wrapQtAppsHook ];

pkgs/applications/networking/remote/citrix-workspace/default.nix

@@ -30,17 +30,6 @@
 let
   versionInfo = let
     supportedVersions = {
-      "19.3.0" = {
-        major     = "19";
-        minor     = "3";
-        patch     = "0";
-        x64hash   = "0mhpp29ca3dw9hx72i0qawdq35wcc7qzgxwzlx4aicwnm1gbil5c";
-        x86hash   = "1hxgj5lk5ghbpssbqjd404qr84gls967vwrh8ww5hg3pn86kyf8w";
-        x64suffix = "5";
-        x86suffix = "5";
-        homepage  = https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-linux/workspace-app-for-linux-1903.html;
-      };
-
       "19.6.0" = {
         major     = "19";
         minor     = "6";
@@ -60,7 +49,7 @@ let
         x86hash   = "0afcqirb4q349r3izy88vqkszg6y2wg14iwypk6nrmvwgvcl6jdn";
         x64suffix = "20";
         x86suffix = "20";
-        homepage  = https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-linux/workspace-app-for-linux-latest1.html;
+        homepage  = https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-linux/workspace-app-for-linux-1908.html;
       };
 
       "19.10.0" = {
@@ -93,7 +82,7 @@ let
     # The lifespans of Citrix products can be found here:
     # https://www.citrix.com/support/product-lifecycle/milestones/receiver.html
     deprecatedVersions = let
-      versions = [ ];
+      versions = [ "19.3.0" ];
     in
       lib.listToAttrs
         (lib.forEach versions

pkgs/applications/science/biology/seaview/default.nix

@@ -1,12 +1,12 @@
 { stdenv, fetchurl, coreutils, fltk, libjpeg }:
 
 stdenv.mkDerivation rec {
-  version = "4.7";
+  version = "5.0";
   pname = "seaview";
 
   src = fetchurl {
     url = "ftp://pbil.univ-lyon1.fr/pub/mol_phylogeny/seaview/archive/seaview_${version}.tar.gz";
-    sha256 = "0fhyq7dcn0izhwcfin9ajsr7kmmsqm9f1np1rmhzg4digfwqb29n";
+    sha256 = "0gzjqf5mm91pa1drwxvz229bv6l995npdggngszh6z6j4pfh8j7c";
   };
 
   buildInputs = [ fltk libjpeg ];

pkgs/applications/science/electronics/verilator/default.nix

@@ -2,20 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "verilator";
-  version = "4.024";
+  version = "4.026";
 
   src = fetchurl {
     url    = "https://www.veripool.org/ftp/${pname}-${version}.tgz";
-    sha256 = "0nmjazdv36ksjp8ys48c1grlzkd6yx3zhcd9y165d4sjm3m1pffs";
+    sha256 = "1b4zxwgd780yxql11r2333qhl7ki5jxh9jxlyhv9xqml9aq8myva";
   };
 
   enableParallelBuilding = true;
   buildInputs = [ perl flex bison ];
 
-  postInstall = ''
-    sed -i -e '3a\#!/usr/bin/env perl' -e '1,3d' $out/bin/{verilator,verilator_coverage,verilator_profcfunc}
-  '';
-
   meta = {
     description = "Fast and robust (System)Verilog simulator/compiler";
     homepage    = "https://www.veripool.org/wiki/verilator";

pkgs/applications/science/logic/ott/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ott";
-  version = "0.29";
+  version = "0.30";
 
   src = fetchFromGitHub {
     owner = "ott-lang";
     repo = "ott";
     rev = version;
-    sha256 = "0saznk2mjbhp3j57imy2p2j0938026bw5m5gqbj59vcvk1rwwl22";
+    sha256 = "16bxfnm30z94x36vr8vs6zd6fj55vnb7aypjl6hf7clk42040brc";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/science/physics/sherpa/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sherpa";
-  version = "2.2.6";
+  version = "2.2.8";
 
   src = fetchurl {
     url = "https://www.hepforge.org/archive/sherpa/SHERPA-MC-${version}.tar.gz";
-    sha256 = "1cagkkz1pjl0pdf85w1qkwhx0afi3kxm1vnmfavq1zqhss7fc57i";
+    sha256 = "1al1imdrknvbcy8k113xysc14lln4msbv281bf0kx7p73wz59mv3";
   };
 
   buildInputs = [ gfortran sqlite lhapdf rivet ];

pkgs/applications/version-management/git-and-tools/default.nix

@@ -135,6 +135,10 @@ let
 
   git-test = callPackage ./git-test { };
 
+  git-workspace = callPackage ./git-workspace {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
   git2cl = callPackage ./git2cl { };
 
   gitFastExport = callPackage ./fast-export { };

pkgs/applications/version-management/git-and-tools/git-workspace/default.nix

@@ -0,0 +1,31 @@
+{ stdenv
+, fetchFromGitHub
+, rustPlatform
+, Security
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "git-workspace";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "orf";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "01qxm00c5wqpy1clrvjr44v7cg4nqawaf5a6qnvvgswvis4kakzr";
+  };
+
+  cargoSha256 = "16rkmk888alfvq8nsggi26vck1c7ya0fa5j7gv219g5py4gw2n34";
+
+  verifyCargoDeps = true;
+
+  buildInputs = with stdenv; lib.optional isDarwin Security;
+
+  meta = with stdenv.lib; {
+    description = "Sync personal and work git repositories from multiple providers";
+    homepage = "https://github.com/orf/git-workspace";
+    license = with licenses; [ mit ];
+    platforms = platforms.all;
+    maintainers = with maintainers; [ misuzu ];
+  };
+}

pkgs/applications/video/mediathekview/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, makeWrapper, jre }:
 
 stdenv.mkDerivation rec {
-  version = "13.5.0";
+  version = "13.5.1";
   pname = "mediathekview";
   src = fetchurl {
     url = "https://download.mediathekview.de/stabil/MediathekView-${version}-linux.tar.gz";
-    sha256 = "0n05w2d6sh03rjms7m9b5nj84cl16gkrc9nsn53kvldglmqmmrac";
+    sha256 = "0fixr6drim0wmh4q44zikcla4mrnm44nm95d5naqsgx6idalddrc";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/video/mkvtoolnix/default.nix

@@ -13,13 +13,13 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "mkvtoolnix";
-  version = "42.0.0";
+  version = "43.0.0";
 
   src = fetchFromGitLab {
     owner  = "mbunkus";
     repo   = "mkvtoolnix";
     rev    = "release-${version}";
-    sha256 = "0bjb1cx1sj61yhpraqryhxma4wiz0yl3asnbsv9hvq730v07hg0b";
+    sha256 = "0ra9kgvhh5yhbr0hsia1va5lw45zr4kdwcdjhas5ljjyj75mlyxc";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/streamlink/default.nix

@@ -1,14 +1,14 @@
 { stdenv, pythonPackages, fetchFromGitHub, rtmpdump, ffmpeg }:
 
 pythonPackages.buildPythonApplication rec {
-  version = "1.3.0";
+  version = "1.3.1";
   pname = "streamlink";
 
   src = fetchFromGitHub {
     owner = "streamlink";
     repo = "streamlink";
     rev = version;
-    sha256 = "0f4qwwa5pxd4igvxq1qadqpphazlbs3c3cr29ybks2x5wajrvwah";
+    sha256 = "0scc0mzvy56b1l6iyvrzb28l8vzrxpfkn4lcwr8nnyjb7ams2xms";
   };
 
   checkInputs = with pythonPackages; [ pytest mock requests-mock freezegun ];

pkgs/applications/virtualization/xen/4.5.nix

@@ -1,261 +0,0 @@
-{ stdenv, callPackage, fetchurl, fetchpatch, fetchgit
-, ocaml-ng
-, withInternalQemu ? true
-, withInternalTraditionalQemu ? true
-, withInternalSeabios ? true
-, withSeabios ? !withInternalSeabios, seabios ? null
-, withInternalOVMF ? false # FIXME: tricky to build
-, withOVMF ? false, OVMF
-, withLibHVM ? true
-
-# qemu
-, udev, pciutils, xorg, SDL, pixman, acl, glusterfs, spice-protocol, usbredir
-, alsaLib
-, ... } @ args:
-
-assert withInternalSeabios -> !withSeabios;
-assert withInternalOVMF -> !withOVMF;
-
-with stdenv.lib;
-
-# Patching XEN? Check the XSAs at
-# https://xenbits.xen.org/xsa/
-# and try applying all the ones we don't have yet.
-
-let
-  xsaPatch = { name , sha256 }: (fetchpatch {
-    url = "https://xenbits.xen.org/xsa/xsa${name}.patch";
-    inherit sha256;
-  });
-
-  qemuDeps = [
-    udev pciutils xorg.libX11 SDL pixman acl glusterfs spice-protocol usbredir
-    alsaLib
-  ];
-
-  xsa = import ./xsa-patches.nix { inherit fetchpatch; };
-in
-
-callPackage (import ./generic.nix (rec {
-  version = "4.5.5";
-
-  meta = {
-    knownVulnerabilities = [ "Security support ended in January 2018" ];
-  };
-
-  src = fetchurl {
-    url = "https://downloads.xenproject.org/release/xen/${version}/xen-${version}.tar.gz";
-    sha256 = "1y74ms4yc3znf8jc3fgyq94va2y0pf7jh8m9pfqnpgklywqnw8g2";
-  };
-
-  # Sources needed to build tools and firmwares.
-  xenfiles = optionalAttrs withInternalQemu {
-    qemu-xen = {
-      src = fetchgit {
-        url = https://xenbits.xen.org/git-http/qemu-xen.git;
-        rev = "refs/tags/qemu-xen-${version}";
-        sha256 = "014s755slmsc7xzy7qhk9i3kbjr2grxb5yznjp71dl6xxfvnday2";
-      };
-      buildInputs = qemuDeps;
-      patches = [
-        (xsaPatch {
-          name = "197-4.5-qemuu";
-          sha256 = "09gp980qdlfpfmxy0nk7ncyaa024jnrpzx9gpq2kah21xygy5myx";
-        })
-        (xsaPatch {
-          name = "208-qemuu-4.7";
-          sha256 = "0z9b1whr8rp2riwq7wndzcnd7vw1ckwx0vbk098k2pcflrzppgrb";
-        })
-        (xsaPatch {
-          name = "209-qemuu/0001-display-cirrus-ignore-source-pitch-value-as-needed-i";
-          sha256 = "1xvxzsrsq05fj6szjlpbgg4ia3cw54dn5g7xzq1n1dymbhv606m0";
-        })
-        (xsaPatch {
-          name = "209-qemuu/0002-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput";
-          sha256 = "0avxqs9922qjfsxxlk7bh10432a526j2yyykhags8dk1bzxkpxwv";
-        })
-        (xsaPatch {
-          name = "211-qemuu-4.6";
-          sha256 = "1g090xs8ca8676vyi78b99z5yjdliw6mxkr521b8kimhf8crx4yg";
-        })
-        (xsaPatch {
-          name = "216-qemuu-4.5";
-          sha256 = "0nh5akbal93czia1gh1pzvwq7gc4zwiyr1hbyk1m6wwdmqv6ph61";
-        })
-      ];
-      meta.description = "Xen's fork of upstream Qemu";
-    };
-  } // optionalAttrs withInternalTraditionalQemu {
-    qemu-xen-traditional = {
-      src = fetchgit {
-        url = https://xenbits.xen.org/git-http/qemu-xen-traditional.git;
-        rev = "refs/tags/xen-${version}";
-        sha256 = "0n0ycxlf1wgdjkdl8l2w1i0zzssk55dfv67x8i6b2ima01r0k93r";
-      };
-      buildInputs = qemuDeps;
-      patches = [
-        (xsaPatch {
-          name = "197-4.5-qemut";
-          sha256 = "17l7npw00gyhqzzaqamwm9cawfvzm90zh6jjyy95dmqbh7smvy79";
-        })
-        (xsaPatch {
-          name = "199-trad";
-          sha256 = "0dfw6ciycw9a9s97sbnilnzhipnzmdm9f7xcfngdjfic8cqdcv42";
-        })
-        (xsaPatch {
-          name = "208-qemut";
-          sha256 = "0960vhchixp60j9h2lawgbgzf6mpcdk440kblk25a37bd6172l54";
-        })
-        (xsaPatch {
-          name = "209-qemut";
-          sha256 = "1hq8ghfzw6c47pb5vf9ngxwgs8slhbbw6cq7gk0nam44rwvz743r";
-        })
-        (xsaPatch {
-          name = "211-qemut-4.5";
-          sha256 = "1z3phabvqmxv4b5923fx63hwdg4v1fnl15zbl88873ybqn0hp50f";
-        })
-      ];
-      postPatch = ''
-        substituteInPlace xen-hooks.mak \
-          --replace /usr/include/pci ${pciutils}/include/pci
-      '';
-      meta.description = "Xen's fork of upstream Qemu that uses old device model";
-    };
-  } // optionalAttrs withInternalSeabios {
-    "firmware/seabios-dir-remote" = {
-      src = fetchgit {
-        url = https://xenbits.xen.org/git-http/seabios.git;
-        rev = "e51488c5f8800a52ac5c8da7a31b85cca5cc95d2";
-        #rev = "rel-1.7.5";
-        sha256 = "0jk54ybhmw97pzyhpm6jr2x99f702kbn0ipxv5qxcbynflgdazyb";
-      };
-      patches = [ ./0000-qemu-seabios-enable-ATA_DMA.patch ];
-      meta.description = "Xen's fork of Seabios";
-    };
-  } // optionalAttrs withInternalOVMF {
-    "firmware/ovmf-dir-remote" = {
-      src = fetchgit {
-        url = https://xenbits.xen.org/git-http/ovmf.git;
-        rev = "cb9a7ebabcd6b8a49dc0854b2f9592d732b5afbd";
-        sha256 = "07zmdj90zjrzip74fvd4ss8n8njk6cim85s58mc6snxmqqv7gmcq";
-      };
-      meta.description = "Xen's fork of OVMF";
-    };
-  } // {
-    # TODO: patch Xen to make this optional?
-    "firmware/etherboot/ipxe.git" = {
-      src = fetchgit {
-        url = https://git.ipxe.org/ipxe.git;
-        rev = "9a93db3f0947484e30e753bbd61a10b17336e20e";
-        sha256 = "1ga3h1b34q0cl9azj7j9nswn7mfcs3cgfjdihrm5zkp2xw2hpvr6";
-      };
-      meta.description = "Xen's fork of iPXE";
-    };
-  } // optionalAttrs withLibHVM {
-    xen-libhvm-dir-remote = {
-      src = fetchgit {
-        name = "xen-libhvm";
-        url = https://github.com/ts468/xen-libhvm;
-        rev = "442dcc4f6f4e374a51e4613532468bd6b48bdf63";
-        sha256 = "9ba97c39a00a54c154785716aa06691d312c99be498ebbc00dc3769968178ba8";
-      };
-      buildPhase = ''
-        make
-        cd biospt
-        cc -Wall -g -D_LINUX -Wstrict-prototypes biospt.c -o biospt -I../libhvm -L../libhvm -lxenhvm
-      '';
-      installPhase = ''
-        make install
-        cp biospt/biospt $out/bin/
-      '';
-      meta = {
-        description = ''
-          Helper library for reading ACPI and SMBIOS firmware values
-          from the host system for use with the HVM guest firmware
-          pass-through feature in Xen'';
-        license = licenses.bsd2;
-      };
-    };
-  };
-
-  configureFlags = []
-    ++ optional (!withInternalQemu) "--with-system-qemu" # use qemu from PATH
-    ++ optional (withInternalTraditionalQemu) "--enable-qemu-traditional"
-    ++ optional (!withInternalTraditionalQemu) "--disable-qemu-traditional"
-
-    ++ optional (withSeabios) "--with-system-seabios=${seabios}"
-    ++ optional (!withInternalSeabios && !withSeabios) "--disable-seabios"
-
-    ++ optional (withOVMF) "--with-system-ovmf=${OVMF.fd}/FV/OVMF.fd"
-    ++ optional (withInternalOVMF) "--enable-ovmf";
-
-  patches = with xsa; flatten [
-    ./0001-libxl-Spice-image-compression-setting-support-for-up.patch
-    ./0002-libxl-Spice-streaming-video-setting-support-for-upst.patch
-    ./0003-Add-qxl-vga-interface-support-for-upstream-qem.patch
-    XSA_190
-    XSA_191
-    XSA_192
-    XSA_193
-    XSA_195
-    XSA_196
-    XSA_198
-    XSA_200
-    XSA_202_45
-    XSA_204_45
-    XSA_206_45
-    XSA_207
-    XSA_212
-    XSA_213_45
-    XSA_214
-    XSA_215
-    XSA_217_45
-    XSA_218_45
-    XSA_219_45
-    XSA_220_45
-    XSA_221
-    XSA_222_45
-    XSA_223
-    XSA_224_45
-    XSA_227_45
-    XSA_230
-    XSA_231_45
-    XSA_232
-    XSA_233
-    XSA_234_45
-    XSA_235_45
-    XSA_236_45
-    XSA_237_45
-    XSA_238_45
-    XSA_239_45
-    XSA_240_45
-    XSA_241
-    XSA_242
-    XSA_243_45
-    XSA_244_45
-    XSA_245
-    XSA_246_45
-    XSA_247_45
-    XSA_248_45
-    XSA_249
-    XSA_250_45
-    XSA_251_45
-  ];
-
-  # Fix build on Glibc 2.24.
-  NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations";
-
-  postPatch = ''
-    # Avoid a glibc >= 2.25 deprecation warnings that get fatal via -Werror.
-    sed 1i'#include <sys/sysmacros.h>' \
-      -i tools/blktap2/control/tap-ctl-allocate.c \
-      -i tools/libxl/libxl_device.c
-  '';
-
-  passthru = {
-    qemu-system-i386 = if withInternalQemu
-      then "lib/xen/bin/qemu-system-i386"
-      else throw "this xen has no qemu builtin";
-  };
-
-})) ({ ocamlPackages = ocaml-ng.ocamlPackages_4_02; } // args)

pkgs/applications/virtualization/xen/packages.nix

@@ -1,62 +1,11 @@
 { callPackage
-, stdenv, overrideCC, gcc49
+, stdenv, overrideCC
 }:
 
 # TODO(@oxij) on new Xen version: generalize this to generate [vanilla slim
 # light] for each ./<version>.nix.
 
 rec {
-
-  xen_4_5-vanilla = callPackage ./4.5.nix {
-    # At the very least included seabios and etherboot need gcc49,
-    # so we have to build all of it with gcc49.
-    stdenv = overrideCC stdenv gcc49;
-
-    meta = {
-      description = "vanilla";
-      longDescription = ''
-        Vanilla version of Xen. Uses forks of Qemu and Seabios bundled
-        with Xen. This gives vanilla experince, but wastes space and
-        build time: typical NixOS setup that runs lots of VMs will
-        build three different versions of Qemu when using this (two
-        forks and upstream).
-      '';
-    };
-  };
-
-  xen_4_5-slim = xen_4_5-vanilla.override {
-    withInternalQemu = false;
-    withInternalTraditionalQemu = true;
-    withInternalSeabios = false;
-    withSeabios = true;
-
-    meta = {
-      description = "slim";
-      longDescription = ''
-        Slimmed-down version of Xen that reuses nixpkgs packages as
-        much as possible. Different parts may get out of sync, but
-        this builds faster and uses less space than vanilla. Use with
-        `qemu_xen` from nixpkgs.
-      '';
-    };
-  };
-
-  xen_4_5-light = xen_4_5-vanilla.override {
-    withInternalQemu = false;
-    withInternalTraditionalQemu = false;
-    withInternalSeabios = false;
-    withSeabios = true;
-
-    meta = {
-      description = "light";
-      longDescription = ''
-        Slimmed-down version of Xen without `qemu-traditional` (you
-        don't need it if you don't know what it is). Use with
-        `qemu_xen-light` from nixpkgs.
-      '';
-    };
-  };
-
   xen_4_8-vanilla = callPackage ./4.8.nix {
     meta = {
       description = "vanilla";

pkgs/applications/window-managers/afterstep/default.nix

@@ -3,6 +3,7 @@
 , fltk, gtk
 , libX11, libXext, libICE
 , dbus
+, fetchpatch
 }:
 
 stdenv.mkDerivation rec {
@@ -16,6 +17,13 @@ stdenv.mkDerivation rec {
     sha256 = "1j7vkx1ig4kzwffdxnkqv3kld9qi3sam4w2nhq18waqjsi8xl5gz";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian/afterstep/raw/master/debian/patches/44-Fix-build-with-gcc-5.patch";
+      sha256 = "1vipy2lzzd2gqrsqk85pwgcdhargy815fxlbn57hsm45zglc3lj4";
+    })
+  ];
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [ libjpeg libtiff libpng freetype fltk gtk libX11 libXext libICE dbus dbus ];
 

pkgs/build-support/docker/default.nix

@@ -315,7 +315,7 @@ rec {
     runCommand "${name}-granular-docker-layers" {
       inherit maxLayers;
       paths = referencesByPopularity overallClosure;
-      nativeBuildInputs = [ jshon rsync tarsum ];
+      nativeBuildInputs = [ jshon rsync tarsum moreutils ];
       enableParallelBuilding = true;
     }
     ''
@@ -335,7 +335,8 @@ rec {
         cat $paths ${lib.concatMapStringsSep " " (path: "| grep -v ${path}") (closures ++ [ overallClosure ])}
       }
 
-      paths | head -n $((maxLayers - 1)) | cat -n | xargs -P$NIX_BUILD_CORES -n2 ${storePathToLayer}
+      # We need to sponge to avoid grep broken pipe error when maxLayers == 1
+      paths | sponge | head -n $((maxLayers - 1)) | cat -n | xargs -r -P$NIX_BUILD_CORES -n2 ${storePathToLayer}
       if [ $(paths | wc -l) -ge $maxLayers ]; then
         paths | tail -n+$maxLayers | xargs ${storePathToLayer} $maxLayers
       fi
@@ -544,6 +545,9 @@ rec {
     # believe the actual maximum is 128.
     maxLayers ? 100
   }:
+    assert
+      (lib.assertMsg (maxLayers > 1)
+      "the maxLayers argument of dockerTools.buildLayeredImage function must be greather than 1 (current value: ${toString maxLayers})");
     let
       baseName = baseNameOf name;
       contentsEnv = symlinkJoin {

pkgs/build-support/docker/examples.nix

@@ -238,4 +238,12 @@ rec {
     config.Cmd = [ "${pkgs.hello}/bin/hello" ];
   };
 
+  # 15. Create a layered image with only 2 layers
+  two-layered-image = pkgs.dockerTools.buildLayeredImage {
+    name = "two-layered-image";
+    tag = "latest";
+    config.Cmd = [ "${pkgs.hello}/bin/hello" ];
+    contents = [ pkgs.bash pkgs.hello ];
+    maxLayers = 2;
+  };
 }

pkgs/build-support/rust/build-rust-crate/configure-crate.nix

@@ -137,16 +137,7 @@ in ''
      CRATENAME=$(echo ${crateName} | sed -e "s/\(.*\)-sys$/\U\1/")
      grep -P "^cargo:(?!(rustc-|warning=|rerun-if-changed=|rerun-if-env-changed))" target/build/${crateName}.opt \
        | sed -e "s/cargo:\([^=]*\)=\(.*\)/export DEP_$(echo $CRATENAME)_\U\1\E=\2/" > target/env
-
      set -e
-     if [[ -n "$(ls target/build/${crateName}.out)" ]]; then
-
-        if [[ -e "${libPath}" ]]; then
-           cp -r target/build/${crateName}.out/* $(dirname ${libPath}) #*/
-        else
-           cp -r target/build/${crateName}.out/* src #*/
-        fi
-     fi
   fi
   runHook postConfigure
 ''

pkgs/build-support/rust/build-rust-crate/default.nix

@@ -23,7 +23,7 @@ let
             lib.strings.replaceStrings ["-"] ["_"] crateRenames.${dep.crateName}
           else
             extern;
-        in (if lib.any (x: x == "lib") dep.crateType then
+        in (if lib.any (x: x == "lib" || x == "rlib") dep.crateType then
            " --extern ${name}=${dep.lib}/lib/lib${extern}-${dep.metadata}.rlib"
          else
            " --extern ${name}=${dep.lib}/lib/lib${extern}-${dep.metadata}${stdenv.hostPlatform.extensions.sharedLibrary}")

pkgs/build-support/rust/build-rust-crate/test/default.nix

@@ -1,17 +1,17 @@
 { lib, buildRustCrate, runCommand, writeTextFile, symlinkJoin, callPackage, releaseTools }:
 let
   mkCrate = args: let
-      p = {
+    p = {
-        crateName = "nixtestcrate";
+      crateName = "nixtestcrate";
-        version = "0.1.0";
+      version = "0.1.0";
-        authors = [ "Test <test@example.com>" ];
+      authors = [ "Test <test@example.com>" ];
-      } // args;
+    } // args;
-    in buildRustCrate p;
+  in buildRustCrate p;
 
-    mkFile = destination: text: writeTextFile {
+  mkFile = destination: text: writeTextFile {
-      name = "src";
+    name = "src";
-      destination = "/${destination}";
+    destination = "/${destination}";
-      inherit text;
+    inherit text;
   };
 
   mkBin = name: mkFile name ''
@@ -185,7 +185,41 @@ let
           "test tests_bar ... ok"
         ];
       };
-
+      linkAgainstRlibCrate = {
+        crateName = "foo";
+        src = mkFile  "src/main.rs" ''
+          extern crate somerlib;
+          fn main() {}
+        '';
+        dependencies = [
+          (mkCrate {
+            crateName = "somerlib";
+            type = [ "rlib" ];
+            src = mkLib "src/lib.rs";
+          })
+        ];
+      };
+      # Regression test for https://github.com/NixOS/nixpkgs/issues/74071
+      # Whenevever a build.rs file is generating files those should not be overlayed onto the actual source dir
+      buildRsOutDirOverlay = {
+        src = symlinkJoin {
+          name = "buildrs-out-dir-overlay";
+          paths = [
+            (mkLib "src/lib.rs")
+            (mkFile "build.rs" ''
+              use std::env;
+              use std::ffi::OsString;
+              use std::fs;
+              use std::path::Path;
+              fn main() {
+                let out_dir = env::var_os("OUT_DIR").expect("OUT_DIR not set");
+                let out_file = Path::new(&out_dir).join("lib.rs");
+                fs::write(out_file, "invalid rust code!").expect("failed to write lib.rs");
+              }
+            '')
+          ];
+        };
+      };
     };
     brotliCrates = (callPackage ./brotli-crates.nix {});
   in lib.mapAttrs (key: value: mkTest (value // lib.optionalAttrs (!value?crateName) { crateName = key; })) cases // {

pkgs/data/icons/qogir-icon-theme/default.nix

@@ -2,17 +2,19 @@
 
 stdenv.mkDerivation rec {
   pname = "qogir-icon-theme";
-  version = "2019-09-15";
+  version = "2020-01-29";
 
   src = fetchFromGitHub {
     owner = "vinceliuice";
     repo = pname;
-    rev = "4e1b6c693615bc2c7c7a11df6f4b90f2e6fb67db";
+    rev = version;
-    sha256 = "1vp1wp4fgmy5af8z8nb3m6wgmb6wbwlvx5smf9dxfcn254hdg8g0";
+    sha256 = "0g6qiry4gzkr48xn4qi8sdna0hi3982sywskz9adkzqcznir542h";
   };
 
   nativeBuildInputs = [ gtk3 ];
 
+  dontDropIconThemeCache = true;
+
   installPhase = ''
     patchShebangs install.sh
     mkdir -p $out/share/icons
@@ -21,7 +23,7 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "A colorful design icon theme for linux desktops";
-    homepage = https://github.com/vinceliuice/Qogir-icon-theme;
+    homepage = "https://github.com/vinceliuice/Qogir-icon-theme";
     license = with licenses; [ gpl3 ];
     platforms = platforms.linux;
     maintainers = with maintainers; [ romildo ];

pkgs/data/misc/spdx-license-list-data/default.nix

@@ -0,0 +1,25 @@
+{ stdenv, lib, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "spdx-license-list-data";
+  version = "3.7";
+
+  src = fetchFromGitHub {
+    owner = "spdx";
+    repo = "license-list-data";
+    rev = "v${version}";
+    sha256 = "1zll1d4apqh762iplzcm90v3yp3b36whc3vqx1vlmjgdrfss9jhn";
+  };
+
+  phases = [ "unpackPhase" "installPhase" ];
+
+  installPhase = ''
+    install -vDt $out/json json/licenses.json
+  '';
+
+  meta = {
+    description = "Various data formats for the SPDX License List";
+    homepage = "https://github.com/spdx/license-list-data";
+    license = lib.licenses.cc0;
+  };
+}

pkgs/desktops/cinnamon/cinnamon-control-center/default.nix

@@ -0,0 +1,124 @@
+{ stdenv
+, fetchFromGitHub
+, pkgconfig
+, autoreconfHook
+, glib
+, gettext
+, cinnamon-desktop
+, intltool
+, libxslt
+, gtk3
+, libnotify
+, gnome-menus
+, libxml2
+, systemd
+, upower
+, cinnamon-settings-daemon
+, colord
+, polkit
+, ibus
+, libpulseaudio
+, isocodes
+, kerberos
+, libxkbfile
+, cinnamon-menus
+, dbus-glib
+, libgnomekbd
+, libxklavier
+, networkmanager
+, libwacom
+, gnome3
+, libtool
+, wrapGAppsHook
+, tzdata
+, glibc
+, networkmanagerapplet
+, modemmanager
+, xorg
+, gdk-pixbuf
+, cups
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cinnamon-control-center";
+  version = "4.4.0";
+
+  src = fetchFromGitHub {
+    owner = "linuxmint";
+    repo = pname;
+    rev = version;
+    sha256 = "1rxm5n2prh182rxvjs7psxgjddikrjr8492j22060gmyvq55n7kc";
+  };
+
+  configureFlags = [ "--enable-systemd" ];
+
+  buildInputs = [
+    gtk3
+    glib
+    cinnamon-desktop
+    libnotify
+    cinnamon-menus
+    libxml2
+    dbus-glib
+    systemd
+    polkit
+    libgnomekbd
+    libxklavier
+    colord
+    cinnamon-settings-daemon
+    libwacom
+    gnome3.gnome-online-accounts
+    tzdata
+    networkmanager
+    networkmanagerapplet
+    modemmanager
+    xorg.libXxf86misc
+    xorg.libxkbfile
+    gdk-pixbuf
+    cups
+  ];
+
+  /* ./panels/datetime/test-timezone.c:4:#define TZ_DIR "/usr/share/zoneinfo/"
+  ./panels/datetime/tz.h:32:#  define TZ_DATA_FILE "/usr/share/zoneinfo/zone.tab"
+  ./panels/datetime/tz.h:34:#  define TZ_DATA_FILE "/usr/share/lib/zoneinfo/tab/zone_sun.tab" */
+
+  postPatch = ''
+    patchShebangs ./autogen.sh
+    sed 's|TZ_DIR "/usr/share/zoneinfo/"|TZ_DIR "${tzdata}/share/zoneinfo/"|g' -i ./panels/datetime/test-timezone.c
+    sed 's|TZ_DATA_FILE "/usr/share/zoneinfo/zone.tab"|TZ_DATA_FILE "${tzdata}/share/zoneinfo/zone.tab"|g' -i ./panels/datetime/tz.h
+    sed 's|"/usr/share/i18n/locales/"|"${glibc}/share/i18n/locales/"|g' -i panels/datetime/test-endianess.c
+  '';
+
+  autoreconfPhase = ''
+    NOCONFIGURE=1 bash ./autogen.sh
+  '';
+
+  # it needs to have access to that file, otherwise we can't run tests after build
+
+  preBuild = ''
+    mkdir -p $out/share/cinnamon-control-center/
+    ln -s $PWD/panels/datetime $out/share/cinnamon-control-center/
+  '';
+
+  preInstall = ''
+    rm -rfv $out
+  '';
+
+  nativeBuildInputs = [
+    pkgconfig
+    autoreconfHook
+    wrapGAppsHook
+    gettext
+    intltool
+    libxslt
+    libtool
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/linuxmint/cinnamon-control-center";
+    description = "A collection of configuration plugins used in cinnamon-settings";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = [ maintainers.mkg20001 ];
+  };
+}

pkgs/desktops/cinnamon/default.nix

@@ -1,6 +1,7 @@
 { pkgs, lib }:
 
 lib.makeScope pkgs.newScope (self: with self; {
+  cinnamon-control-center = callPackage ./cinnamon-control-center { };
   cinnamon-desktop = callPackage ./cinnamon-desktop { };
   cinnamon-menus = callPackage ./cinnamon-menus { };
   cinnamon-translations = callPackage ./cinnamon-translations { };

pkgs/development/arduino/platformio/core.nix

@@ -1,8 +1,9 @@
-{ stdenv, lib, buildPythonApplication, fetchFromGitHub
+{ stdenv, lib, buildPythonApplication, fetchFromGitHub, fetchpatch
-, bottle, click, colorama
+, bottle, click, colorama, semantic-version
 , lockfile, pyserial, requests
-, pytest, semantic-version, tox, tabulate
+, tabulate, pyelftools, marshmallow
-, git
+, pytest, tox, jsondiff
+, git, spdx-license-list-data
 }:
 
 let
@@ -39,6 +40,7 @@ let
     "test_pkgmanifest.py::test_packages"
   ]) ++ (map (e: "--ignore=tests/${e}") [
     "commands/test_boards.py"
+    "commands/test_check.py"
     "commands/test_platform.py"
     "commands/test_update.py"
     "test_maintenance.py"
@@ -47,25 +49,25 @@ let
 
 in buildPythonApplication rec {
   pname = "platformio";
-  version = "4.0.3";
+  version = "4.1.0";
 
   # pypi tarballs don't contain tests - https://github.com/platformio/platformio-core/issues/1964
   src = fetchFromGitHub {
     owner = "platformio";
     repo = "platformio-core";
     rev = "v${version}";
-    sha256 = "1naaa53cc7n7zyqggqjvvgkcq8cyzngdf904y9ag0x1vvb70f8j9";
+    sha256 = "10v9jw1zjfqr3wl6kills3cfp0ky7xbm1gc3z0n57wrqbc6cmz95";
   };
 
   propagatedBuildInputs =  [
     bottle click colorama git lockfile
     pyserial requests semantic-version
-    tabulate
+    tabulate pyelftools marshmallow
   ];
 
   HOME = "/tmp";
 
-  checkInputs = [ pytest tox ];
+  checkInputs = [ pytest tox jsondiff ];
 
   checkPhase = ''
     runHook preCheck
@@ -75,7 +77,20 @@ in buildPythonApplication rec {
     runHook postCheck
   '';
 
-  patches = [ ./fix-searchpath.patch ];
+  patches = [
+    ./fix-searchpath.patch
+    (fetchpatch {
+      url = "https://github.com/platformio/platformio-core/commit/442a7e357636522e844d95375c246644b21a7802.patch";
+      sha256 = "0a3kj3k02237gr2yk30gpwc6vm04dsd1wxldj4dsbzs4a9yyi70m";
+      excludes = ["HISTORY.rst"];
+    })
+    ./use-local-spdx-license-list.patch
+  ];
+
+  postPatch = ''
+    substitute platformio/package/manifest/schema.py platformio/package/manifest/schema.py \
+      --subst-var-by SPDX_LICENSE_LIST_DATA '${spdx-license-list-data}'
+  '';
 
   meta = with stdenv.lib; {
     broken = stdenv.isAarch64;

pkgs/development/arduino/platformio/fix-searchpath.patch

@@ -1,11 +1,13 @@
---- ./platformio/proc.py-old	2017-09-29 01:20:08.174548250 +0200
+diff --git a/platformio/proc.py b/platformio/proc.py
-+++ ./platformio/proc.py	2017-09-29 01:19:48.410485308 +0200
+index 80e50201..15cee5a5 100644
-@@ -164,7 +164,7 @@
+--- a/platformio/proc.py
-                 isdir(join(p, "click")) or isdir(join(p, "platformio")))
++++ b/platformio/proc.py
+@@ -167,7 +167,7 @@ def copy_pythonpath_to_osenv():
+             conditions.append(isdir(join(p, "click")) or isdir(join(p, "platformio")))
          if all(conditions):
              _PYTHONPATH.append(p)
--    os.environ['PYTHONPATH'] = os.pathsep.join(_PYTHONPATH)
+-    os.environ["PYTHONPATH"] = os.pathsep.join(_PYTHONPATH)
-+    os.environ['PYTHONPATH'] = os.pathsep.join(sys.path)
++    os.environ["PYTHONPATH"] = os.pathsep.join(sys.path)
  
  
- def get_serialports(filter_hwid=False):
+ def where_is_program(program, envpath=None):

pkgs/development/arduino/platformio/use-local-spdx-license-list.patch

@@ -0,0 +1,16 @@
+diff --git a/platformio/package/manifest/schema.py b/platformio/package/manifest/schema.py
+index f1d68e08..9b7b1da8 100644
+--- a/platformio/package/manifest/schema.py
++++ b/platformio/package/manifest/schema.py
+@@ -174,9 +174,5 @@ class ManifestSchema(Schema):
+     @staticmethod
+     @memoized(expire="1h")
+     def load_spdx_licenses():
+-        r = requests.get(
+-            "https://raw.githubusercontent.com/spdx/license-list-data"
+-            "/v3.7/json/licenses.json"
+-        )
+-        r.raise_for_status()
+-        return r.json()
++        import json
++        return json.load(open("@SPDX_LICENSE_LIST_DATA@/json/licenses.json"))

pkgs/development/beam-modules/default.nix

@@ -36,7 +36,12 @@ let
         buildMix = callPackage ./build-mix.nix {};
 
         # BEAM-based languages.
-        elixir = elixir_1_9;
+        elixir = elixir_1_10;
+
+        elixir_1_10 = lib.callElixir ../interpreters/elixir/1.10.nix {
+          inherit rebar erlang;
+          debugInfo = true;
+        };
 
         elixir_1_9 = lib.callElixir ../interpreters/elixir/1.9.nix {
           inherit rebar erlang;
@@ -58,13 +63,8 @@ let
           debugInfo = true;
         };
 
-        elixir_1_5 = lib.callElixir ../interpreters/elixir/1.5.nix {
-          inherit rebar erlang;
-          debugInfo = true;
-        };
-
         # Remove old versions of elixir, when the supports fades out:
-        #   https://hexdocs.pm/elixir/compatibility-and-deprecations.html
+        # https://hexdocs.pm/elixir/compatibility-and-deprecations.html
 
         lfe = lfe_1_2;
         lfe_1_2 = lib.callLFE ../interpreters/lfe/1.2.nix { inherit erlang buildRebar3 buildHex; };

pkgs/development/compilers/crystal/default.nix

@@ -58,16 +58,17 @@ let
 
     outputs = [ "out" "lib" "bin" ];
 
-    # we are almost able to run the full test suite now
     postPatch = ''
       substituteInPlace src/crystal/system/unix/time.cr \
         --replace /usr/share/zoneinfo ${tzdata}/share/zoneinfo
 
       ln -s spec/compiler spec/std
 
+      mkdir /tmp/crystal
       substituteInPlace spec/std/file_spec.cr \
         --replace '/bin/ls' '${coreutils}/bin/ls' \
-        --replace '/usr/share' '/tmp/test'
+        --replace '/usr/share' '/tmp/crystal' \
+        --replace '/usr' '/tmp'
 
       substituteInPlace spec/std/process_spec.cr \
         --replace '/bin/cat' '${coreutils}/bin/cat' \
@@ -76,8 +77,23 @@ let
         --replace '"env"' '"${coreutils}/bin/env"' \
         --replace '"/usr"' '"/tmp"'
 
+      substituteInPlace spec/std/socket/tcp_server_spec.cr \
+        --replace '{% if flag?(:gnu) %}"listen: "{% else %}"bind: "{% end %}' '"bind: "'
+
       substituteInPlace spec/std/system_spec.cr \
         --replace '`hostname`' '`${nettools}/bin/hostname`'
+
+      # See https://github.com/crystal-lang/crystal/pull/8640
+      substituteInPlace spec/std/http/cookie_spec.cr \
+        --replace '01 Jan 2020' '01 Jan #{Time.utc.year + 2}'
+
+      # See https://github.com/crystal-lang/crystal/issues/8629
+      substituteInPlace spec/std/socket/udp_socket_spec.cr \
+        --replace 'it "joins and transmits to multicast groups"' 'pending "joins and transmits to multicast groups"'
+
+      # See https://github.com/crystal-lang/crystal/pull/8699
+      substituteInPlace spec/std/xml/xml_spec.cr \
+        --replace 'it "handles errors"' 'pending "handles errors"'
     '';
 
     buildInputs = commonBuildInputs extraBuildInputs;
@@ -189,6 +205,24 @@ in rec {
     };
   };
 
+  binaryCrystal_0_30 = genericBinary {
+    version = "0.30.1";
+    sha256s = {
+      x86_64-linux  = "1k2mb74jh3ns3m7y73j4wpf571sayn73zbn6d7q81d09r280zrma";
+      i686-linux    = "0vsq1ayf922spydp2g2mmimc797jmm7nl5nljhfppcclrwygdyk2";
+      x86_64-darwin = "1p3s4lwdgykb7h7aysjhrs7vm0zhinzw5d7rfv6jsyin4j8yxhzz";
+    };
+  };
+
+  binaryCrystal_0_31 = genericBinary {
+    version = "0.31.1";
+    sha256s = {
+      x86_64-linux  = "0r8salf572xrnr4m6ll9q5hz6jj8q7ff1rljlhmqb1r26a8mi2ih";
+      i686-linux    = "0hridnis5vvrswflx0q67xfg5hryhz6ivlwrb9n4pryj5d1gwjrr";
+      x86_64-darwin = "1dgxgv0s3swkc5cwawzgpbc6bcd2nx4hjxc7iw2h907y1vgmbipz";
+    };
+  };
+
   crystal_0_25 = generic {
     version = "0.25.1";
     sha256  = "15xmbkalsdk9qpc6wfpkly3sifgw6a4ai5jzlv78dh3jp7glmgyl";
@@ -228,18 +262,16 @@ in rec {
     version = "0.31.1";
     sha256  = "1dswxa32w16gnc6yjym12xj7ibg0g6zk3ngvl76lwdjqb1h6lwz8";
     doCheck = false; # 5 checks are failing now
-    binary = crystal_0_30;
+    binary = binaryCrystal_0_30;
   };
 
   crystal_0_32 = generic {
-    version = "255bfc5fa925b95b72e34b26ad997fb2b3f83059";
+    version = "0.32.1";
-    sha256  = "1dgk36cj5lwhs1c4zp0s1c9hjk0h3vljq6zwhlnzkl1xs7cgzim1";
+    sha256  = "120ndi3nhh2r52hjvhwfb49cdggr1bzdq6b8xg7irzavhjinfza6";
-    doCheck = false; # 5 checks are failing now
+    binary = binaryCrystal_0_31;
-    binary = crystal_0_31;
-    extraBuildInputs = [ readline ];
   };
 
-  crystal = crystal_0_31;
+  crystal = crystal_0_32;
 
   crystal2nix = callPackage ./crystal2nix.nix {};
 }

pkgs/development/compilers/cudatoolkit/default.nix

@@ -2,8 +2,6 @@
 , callPackage
 , fetchurl
 , gcc48
-, gcc49
-, gcc5
 , gcc6
 , gcc7
 }:
@@ -29,14 +27,14 @@ in rec {
     version = "7.0.28";
     url = "http://developer.download.nvidia.com/compute/cuda/7_0/Prod/local_installers/cuda_7.0.28_linux.run";
     sha256 = "1km5hpiimx11jcazg0h3mjzk220klwahs2vfqhjavpds5ff2wafi";
-    gcc = gcc49;
+    gcc = gcc6;
   };
 
   cudatoolkit_7_5 = common {
     version = "7.5.18";
     url = "http://developer.download.nvidia.com/compute/cuda/7.5/Prod/local_installers/cuda_7.5.18_linux.run";
     sha256 = "1v2ylzp34ijyhcxyh5p6i0cwawwbbdhni2l5l4qm21s1cx9ish88";
-    gcc = gcc49;
+    gcc = gcc6;
   };
 
   cudatoolkit_8 = common {
@@ -49,7 +47,7 @@ in rec {
         sha256 = "1iaz5rrsnsb1p99qiqvxn6j3ksc7ry8xlr397kqcjzxqbljbqn9d";
       })
     ];
-    gcc = gcc5;
+    gcc = gcc6;
   };
 
   cudatoolkit_9_0 = common {

pkgs/development/compilers/gcc/4.9/default.nix

@@ -61,7 +61,13 @@ let majorVersion = "4";
     inherit (stdenv) buildPlatform hostPlatform targetPlatform;
 
     patches =
-      [ ../use-source-date-epoch.patch ../parallel-bconfig.patch ./parallel-strsignal.patch ]
+      [ ../use-source-date-epoch.patch ../parallel-bconfig.patch ./parallel-strsignal.patch
+        (fetchpatch {
+          name = "avoid-ustat-glibc-2.28.patch";
+          url = "https://gitweb.gentoo.org/proj/gcc-patches.git/plain/4.9.4/gentoo/100_all_avoid-ustat-glibc-2.28.patch?id=55fcb515620a8f7d3bb77eba938aa0fcf0d67c96";
+          sha256 = "0b32sb4psv5lq0ij9fwhi1b4pjbwdjnv24nqprsk14dsc6xmi1g0";
+        })
+      ]
       ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
       ++ optional noSysDirs ../no-sys-dirs.patch
       ++ optional langFortran ../gfortran-driving.patch

pkgs/development/compilers/gcc/5/default.nix

@@ -1,328 +0,0 @@
-{ stdenv, targetPackages, fetchurl, fetchpatch, noSysDirs
-, langC ? true, langCC ? true, langFortran ? false
-, langObjC ? stdenv.targetPlatform.isDarwin
-, langObjCpp ? stdenv.targetPlatform.isDarwin
-, langJava ? false
-, langGo ? false
-, profiledCompiler ? false
-, staticCompiler ? false
-, enableShared ? true
-, enableLTO ? true
-, texinfo ? null
-, perl ? null # optional, for texi2pod (then pod2man); required for Java
-, gmp, mpfr, libmpc, gettext, which
-, libelf                      # optional, for link-time optimizations (LTO)
-, isl ? null # optional, for the Graphite optimization framework.
-, zlib ? null, boehmgc ? null
-, zip ? null, unzip ? null, pkgconfig ? null
-, gtk2 ? null, libart_lgpl ? null
-, libX11 ? null, libXt ? null, libSM ? null, libICE ? null, libXtst ? null
-, libXrender ? null, xorgproto ? null
-, libXrandr ? null, libXi ? null
-, x11Support ? langJava
-, enableMultilib ? false
-, enablePlugin ? stdenv.hostPlatform == stdenv.buildPlatform # Whether to support user-supplied plug-ins
-, name ? "gcc"
-, libcCross ? null
-, threadsCross ? null # for MinGW
-, crossStageStatic ? false
-, # Strip kills static libs of other archs (hence no cross)
-  stripped ? stdenv.hostPlatform == stdenv.buildPlatform
-          && stdenv.targetPlatform == stdenv.hostPlatform
-, gnused ? null
-, cloog # unused; just for compat with gcc4, as we override the parameter on some places
-, buildPackages
-}:
-
-assert langJava     -> zip != null && unzip != null
-                       && zlib != null && boehmgc != null
-                       && perl != null;  # for `--enable-java-home'
-
-# LTO needs libelf and zlib.
-assert libelf != null -> zlib != null;
-
-# Make sure we get GNU sed.
-assert stdenv.hostPlatform.isDarwin -> gnused != null;
-
-# The go frontend is written in c++
-assert langGo -> langCC;
-
-# threadsCross is just for MinGW
-assert threadsCross != null -> stdenv.targetPlatform.isWindows;
-
-with stdenv.lib;
-with builtins;
-
-let majorVersion = "5";
-    version = "${majorVersion}.5.0";
-
-    inherit (stdenv) buildPlatform hostPlatform targetPlatform;
-
-    patches =
-      [ ../use-source-date-epoch.patch ]
-      ++ optional (targetPlatform != hostPlatform) ../libstdc++-target.patch
-      ++ optional noSysDirs ../no-sys-dirs.patch
-      ++ optional langFortran ../gfortran-driving.patch
-      ++ optional (targetPlatform.libc == "musl") ../libgomp-dont-force-initial-exec.patch
-      ++ optional stdenv.hostPlatform.isMusl (fetchpatch {
-        url = https://raw.githubusercontent.com/richfelker/musl-cross-make/e84b1bd1fc12a3def33111ca6df522cd6e5ec361/patches/gcc-5.3.0/0001-musl.diff;
-        sha256 = "0pppbf8myi2kjhm3z3479ihn1cm60kycfv60gj8yy1bs0pl1qcfm";
-      })
-      ++ optional (!crossStageStatic && targetPlatform.isMinGW) (fetchpatch {
-        url = "https://raw.githubusercontent.com/lhmouse/MINGW-packages/${import ../common/mfcgthreads-patches-repo.nix}/mingw-w64-gcc-git/9000-gcc-${majorVersion}-branch-Added-mcf-thread-model-support-from-mcfgthread.patch";
-        sha256 = "074bl5n27d1ksa31pvzj4vd8xd46r118k0w94gdv3s1vydg7mah0";
-      });
-
-    javaEcj = fetchurl {
-      # The `$(top_srcdir)/ecj.jar' file is automatically picked up at
-      # `configure' time.
-
-      # XXX: Eventually we might want to take it from upstream.
-      url = "ftp://sourceware.org/pub/java/ecj-4.3.jar";
-      sha256 = "0jz7hvc0s6iydmhgh5h2m15yza7p2rlss2vkif30vm9y77m97qcx";
-    };
-
-    # Antlr (optional) allows the Java `gjdoc' tool to be built.  We want a
-    # binary distribution here to allow the whole chain to be bootstrapped.
-    javaAntlr = fetchurl {
-      url = https://www.antlr.org/download/antlr-4.4-complete.jar;
-      sha256 = "02lda2imivsvsis8rnzmbrbp8rh1kb8vmq4i67pqhkwz7lf8y6dz";
-    };
-
-    xlibs = [
-      libX11 libXt libSM libICE libXtst libXrender libXrandr libXi
-      xorgproto
-    ];
-
-    javaAwtGtk = langJava && x11Support;
-
-    /* Cross-gcc settings (build == host != target) */
-    crossMingw = targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt";
-    stageNameAddon = if crossStageStatic then "stage-static" else "stage-final";
-    crossNameAddon = optionalString (targetPlatform != hostPlatform) "${targetPlatform.config}-${stageNameAddon}-";
-
-in
-
-# We need all these X libraries when building AWT with GTK.
-assert x11Support -> (filter (x: x == null) ([ gtk2 libart_lgpl ] ++ xlibs)) == [];
-
-stdenv.mkDerivation ({
-  pname = "${crossNameAddon}${name}${if stripped then "" else "-debug"}";
-  inherit version;
-
-  builder = ../builder.sh;
-
-  src = fetchurl {
-    url = "mirror://gnu/gcc/gcc-${version}/gcc-${version}.tar.xz";
-    sha256 = "11zd1hgzkli3b2v70qsm2hyqppngd4616qc96lmm9zl2kl9yl32k";
-  };
-
-  inherit patches;
-
-  outputs = [ "out" "lib" "man" "info" ];
-  setOutputFlags = false;
-  NIX_NO_SELF_RPATH = true;
-
-  libc_dev = stdenv.cc.libc_dev;
-
-  hardeningDisable = [ "format" "pie" ];
-
-  # This should kill all the stdinc frameworks that gcc and friends like to
-  # insert into default search paths.
-  prePatch = stdenv.lib.optionalString hostPlatform.isDarwin ''
-    substituteInPlace gcc/config/darwin-c.c \
-      --replace 'if (stdinc)' 'if (0)'
-
-    substituteInPlace libgcc/config/t-slibgcc-darwin \
-      --replace "-install_name @shlib_slibdir@/\$(SHLIB_INSTALL_NAME)" "-install_name $lib/lib/\$(SHLIB_INSTALL_NAME)"
-
-    substituteInPlace libgfortran/configure \
-      --replace "-install_name \\\$rpath/\\\$soname" "-install_name $lib/lib/\\\$soname"
-  '';
-
-  postPatch =
-    if targetPlatform != hostPlatform || stdenv.cc.libc != null then
-      # On NixOS, use the right path to the dynamic linker instead of
-      # `/lib/ld*.so'.
-      let
-        libc = if libcCross != null then libcCross else stdenv.cc.libc;
-      in
-        (
-        '' echo "fixing the \`GLIBC_DYNAMIC_LINKER', \`UCLIBC_DYNAMIC_LINKER', and \`MUSL_DYNAMIC_LINKER' macros..."
-           for header in "gcc/config/"*-gnu.h "gcc/config/"*"/"*.h
-           do
-             grep -q _DYNAMIC_LINKER "$header" || continue
-             echo "  fixing \`$header'..."
-             sed -i "$header" \
-                 -e 's|define[[:blank:]]*\([UCG]\+\)LIBC_DYNAMIC_LINKER\([0-9]*\)[[:blank:]]"\([^\"]\+\)"$|define \1LIBC_DYNAMIC_LINKER\2 "${libc.out}\3"|g' \
-                 -e 's|define[[:blank:]]*MUSL_DYNAMIC_LINKER\([0-9]*\)[[:blank:]]"\([^\"]\+\)"$|define MUSL_DYNAMIC_LINKER\1 "${libc.out}\2"|g'
-           done
-        ''
-        + stdenv.lib.optionalString (targetPlatform.libc == "musl")
-        ''
-            sed -i gcc/config/linux.h -e '1i#undef LOCAL_INCLUDE_DIR'
-        ''
-        )
-    else null;
-
-  inherit noSysDirs staticCompiler langJava crossStageStatic
-    libcCross crossMingw;
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-  nativeBuildInputs = [ texinfo which gettext ]
-    ++ (optional (perl != null) perl)
-    ++ (optional javaAwtGtk pkgconfig);
-
-  # For building runtime libs
-  depsBuildTarget =
-    if hostPlatform == buildPlatform then [
-      targetPackages.stdenv.cc.bintools # newly-built gcc will be used
-    ] else assert targetPlatform == hostPlatform; [ # build != host == target
-      stdenv.cc
-    ];
-
-  buildInputs = [
-    gmp mpfr libmpc libelf
-    targetPackages.stdenv.cc.bintools # For linking code at run-time
-  ] ++ (optional (isl != null) isl)
-    ++ (optional (zlib != null) zlib)
-    ++ (optionals langJava [ boehmgc zip unzip ])
-    ++ (optionals javaAwtGtk ([ gtk2 libart_lgpl ] ++ xlibs))
-
-    # The builder relies on GNU sed (for instance, Darwin's `sed' fails with
-    # "-i may not be used with stdin"), and `stdenvNative' doesn't provide it.
-    ++ (optional hostPlatform.isDarwin gnused)
-    ;
-
-  depsTargetTarget = optional (!crossStageStatic && threadsCross != null) threadsCross;
-
-  NIX_LDFLAGS = stdenv.lib.optionalString  hostPlatform.isSunOS "-lm -ldl";
-
-  preConfigure = import ../common/pre-configure.nix {
-    inherit (stdenv) lib;
-    inherit version hostPlatform langJava langGo;
-  };
-
-  dontDisableStatic = true;
-
-  # TODO(@Ericson2314): Always pass "--target" and always prefix.
-  configurePlatforms = [ "build" "host" ] ++ stdenv.lib.optional (targetPlatform != hostPlatform) "target";
-
-  configureFlags = import ../common/configure-flags.nix {
-    inherit
-      stdenv
-      targetPackages
-      crossStageStatic libcCross
-      version
-
-      gmp mpfr libmpc libelf isl
-
-      enableLTO
-      enableMultilib
-      enablePlugin
-      enableShared
-
-      langC
-      langCC
-      langFortran
-      langJava javaAwtGtk javaAntlr javaEcj
-      langGo
-      langObjC
-      langObjCpp
-      ;
-  };
-
-  targetConfig = if targetPlatform != hostPlatform then targetPlatform.config else null;
-
-  buildFlags = optional
-    (targetPlatform == hostPlatform && hostPlatform == buildPlatform)
-    (if profiledCompiler then "profiledbootstrap" else "bootstrap");
-
-  dontStrip = !stripped;
-
-  doCheck = false; # requires a lot of tools, causes a dependency cycle for stdenv
-
-  installTargets = optional stripped "install-strip";
-
-  # https://gcc.gnu.org/install/specific.html#x86-64-x-solaris210
-  ${if hostPlatform.system == "x86_64-solaris" then "CC" else null} = "gcc -m64";
-
-  # Setting $CPATH and $LIBRARY_PATH to make sure both `gcc' and `xgcc' find the
-  # library headers and binaries, regarless of the language being compiled.
-  #
-  # Note: When building the Java AWT GTK peer, the build system doesn't honor
-  # `--with-gmp' et al., e.g., when building
-  # `libjava/classpath/native/jni/java-math/gnu_java_math_GMP.c', so we just add
-  # them to $CPATH and $LIBRARY_PATH in this case.
-  #
-  # Likewise, the LTO code doesn't find zlib.
-  #
-  # Cross-compiling, we need gcc not to read ./specs in order to build the g++
-  # compiler (after the specs for the cross-gcc are created). Having
-  # LIBRARY_PATH= makes gcc read the specs from ., and the build breaks.
-
-  CPATH = optionals (targetPlatform == hostPlatform) (makeSearchPathOutput "dev" "include" ([]
-    ++ optional (zlib != null) zlib
-    ++ optional langJava boehmgc
-    ++ optionals javaAwtGtk xlibs
-    ++ optionals javaAwtGtk [ gmp mpfr ]
-  ));
-
-  LIBRARY_PATH = optionals (targetPlatform == hostPlatform) (makeLibraryPath ([]
-    ++ optional (zlib != null) zlib
-    ++ optional langJava boehmgc
-    ++ optionals javaAwtGtk xlibs
-    ++ optionals javaAwtGtk [ gmp mpfr ]
-  ));
-
-  inherit
-    (import ../common/extra-target-flags.nix {
-      inherit stdenv crossStageStatic libcCross threadsCross;
-    })
-    EXTRA_TARGET_FLAGS
-    EXTRA_TARGET_LDFLAGS
-    ;
-
-  passthru = {
-    inherit langC langCC langObjC langObjCpp langFortran langGo version;
-    isGNU = true;
-  };
-
-  enableParallelBuilding = true;
-  inherit enableMultilib;
-
-  inherit (stdenv) is64bit;
-
-  meta = {
-    homepage = https://gcc.gnu.org/;
-    license = stdenv.lib.licenses.gpl3Plus;  # runtime support libraries are typically LGPLv3+
-    description = "GNU Compiler Collection, version ${version}"
-      + (if stripped then "" else " (with debugging info)");
-
-    longDescription = ''
-      The GNU Compiler Collection includes compiler front ends for C, C++,
-      Objective-C, Fortran, OpenMP for C/C++/Fortran, Java, and Ada, as well
-      as libraries for these languages (libstdc++, libgcj, libgomp,...).
-
-      GCC development is a part of the GNU Project, aiming to improve the
-      compiler used in the GNU system including the GNU/Linux variant.
-    '';
-
-    maintainers = with stdenv.lib.maintainers; [ peti ];
-
-    platforms =
-      stdenv.lib.platforms.linux ++
-      stdenv.lib.platforms.freebsd ++
-      stdenv.lib.platforms.illumos ++
-      stdenv.lib.platforms.darwin;
-    badPlatforms = [ "x86_64-darwin" ];
-  };
-}
-
-// optionalAttrs (targetPlatform != hostPlatform && targetPlatform.libc == "msvcrt" && crossStageStatic) {
-  makeFlags = [ "all-gcc" "all-target-libgcc" ];
-  installTargets = "install-gcc install-target-libgcc";
-}
-
-// optionalAttrs (enableMultilib) { dontMoveLib64 = true; }
-)

pkgs/development/compilers/llvm/7/clang/HIP-use-PATH-7.patch

@@ -0,0 +1,68 @@
+From 8412cba68835f8f4cc527d02194b181faa5944d4 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Holger=20W=C3=BCnsche?= <holger.o.wuensche@t-online.de>
+Date: Tue, 21 Jan 2020 19:46:09 +0100
+Subject: [PATCH] [HIP] use GetProgramPath for executable discovery
+
+This change replaces the manual building of executable paths
+using llvm::sys::path::append with GetProgramPath.
+This enables adding other paths in case executables reside
+in different directories and makes the code easier to read.
+
+Differential Revision: https://reviews.llvm.org/D72903
+---
+ clang/lib/Driver/ToolChains/HIP.cpp | 18 ++++++------------
+ 1 file changed, 6 insertions(+), 12 deletions(-)
+
+diff --git a/lib/Driver/ToolChains/HIP.cpp b/lib/Driver/ToolChains/HIP.cpp
+index 03acf45a9b3..75fd3226c75 100644
+--- a/lib/Driver/ToolChains/HIP.cpp
++++ b/lib/Driver/ToolChains/HIP.cpp
+@@ -98,9 +98,8 @@ const char *AMDGCN::Linker::constructLLVMLinkCommand(
+   const char *OutputFileName =
+       C.addTempFile(C.getArgs().MakeArgString(TmpName));
+   CmdArgs.push_back(OutputFileName);
+-  SmallString<128> ExecPath(C.getDriver().Dir);
+-  llvm::sys::path::append(ExecPath, "llvm-link");
+-  const char *Exec = Args.MakeArgString(ExecPath);
++  const char *Exec =
++      Args.MakeArgString(getToolChain().GetProgramPath("llvm-link"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Exec, CmdArgs, Inputs));
+   return OutputFileName;
+ }
+@@ -141,9 +140,8 @@ const char *AMDGCN::Linker::constructOptCommand(
+   const char *OutputFileName =
+       C.addTempFile(C.getArgs().MakeArgString(TmpFileName));
+   OptArgs.push_back(OutputFileName);
+-  SmallString<128> OptPath(C.getDriver().Dir);
+-  llvm::sys::path::append(OptPath, "opt");
+-  const char *OptExec = Args.MakeArgString(OptPath);
++  const char *OptExec =
++      Args.MakeArgString(getToolChain().GetProgramPath("opt"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, OptExec, OptArgs, Inputs));
+   return OutputFileName;
+ }
+@@ -161,9 +159,7 @@ const char *AMDGCN::Linker::constructLlcCommand(
+   const char *LlcOutputFile =
+       C.addTempFile(C.getArgs().MakeArgString(LlcOutputFileName));
+   LlcArgs.push_back(LlcOutputFile);
+-  SmallString<128> LlcPath(C.getDriver().Dir);
+-  llvm::sys::path::append(LlcPath, "llc");
+-  const char *Llc = Args.MakeArgString(LlcPath);
++  const char *Llc = Args.MakeArgString(getToolChain().GetProgramPath("llc"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Llc, LlcArgs, Inputs));
+   return LlcOutputFile;
+ }
+@@ -178,9 +174,7 @@ void AMDGCN::Linker::constructLldCommand(Compilation &C, const JobAction &JA,
+   ArgStringList LldArgs{"-flavor",    "gnu", "--no-undefined",
+                         "-shared",    "-o",  Output.getFilename(),
+                         InputFileName};
+-  SmallString<128> LldPath(C.getDriver().Dir);
+-  llvm::sys::path::append(LldPath, "lld");
+-  const char *Lld = Args.MakeArgString(LldPath);
++  const char *Lld = Args.MakeArgString(getToolChain().GetProgramPath("lld"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Lld, LldArgs, Inputs));
+ }
+ 
+-- 
+2.23.1
+

pkgs/development/compilers/llvm/7/clang/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3
+{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3, lld
 , fixDarwinDylibNames
 , enableManpages ? false
 , enablePolly ? false # TODO: get this info from llvm (passthru?)
@@ -22,7 +22,7 @@ let
     nativeBuildInputs = [ cmake python3 ]
       ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
-    buildInputs = [ libxml2 llvm ]
+    buildInputs = [ libxml2 llvm lld ]
       ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
     cmakeFlags = [
@@ -38,7 +38,11 @@ let
       "-DLINK_POLLY_INTO_TOOLS=ON"
     ];
 
-    patches = [ ./purity.patch ];
+    patches = [
+      ./purity.patch
+      # make clang -xhip use $PATH to find executables
+      ./HIP-use-PATH-7.patch
+    ];
 
     postPatch = ''
       sed -i -e 's/DriverArgs.hasArg(options::OPT_nostdlibinc)/true/' \

pkgs/development/compilers/llvm/7/default.nix

@@ -32,6 +32,7 @@ let
     llvm-polly = callPackage ./llvm.nix { enablePolly = true; };
 
     clang-unwrapped = callPackage ./clang {
+      inherit (tools) lld;
       inherit clang-tools-extra_src;
     };
     clang-polly-unwrapped = callPackage ./clang {

pkgs/development/compilers/llvm/8/clang/HIP-use-PATH-8.patch

@@ -0,0 +1,80 @@
+From d9f1b7d7571b252e0ba2359ae6cfa93a9903c0e7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Holger=20W=C3=BCnsche?= <holger.o.wuensche@t-online.de>
+Date: Tue, 21 Jan 2020 19:49:44 +0100
+Subject: [PATCH] [HIP] use GetProgramPath for executable discovery
+
+This change replaces the manual building of executable paths
+using llvm::sys::path::append with GetProgramPath.
+This enables adding other paths in case executables reside
+in different directories and makes the code easier to read.
+
+Differential Revision: https://reviews.llvm.org/D72903
+---
+ clang/lib/Driver/ToolChains/HIP.cpp | 23 ++++++++---------------
+ 1 file changed, 8 insertions(+), 15 deletions(-)
+
+diff --git a/lib/Driver/ToolChains/HIP.cpp b/lang/lib/Driver/ToolChains/HIP.cpp
+index 868765cf88e..31f2d68ec6c 100644
+--- a/lib/Driver/ToolChains/HIP.cpp
++++ b/lib/Driver/ToolChains/HIP.cpp
+@@ -104,9 +104,8 @@ const char *AMDGCN::Linker::constructLLVMLinkCommand(
+   const char *OutputFileName =
+       C.addTempFile(C.getArgs().MakeArgString(TmpName));
+   CmdArgs.push_back(OutputFileName);
+-  SmallString<128> ExecPath(C.getDriver().Dir);
+-  llvm::sys::path::append(ExecPath, "llvm-link");
+-  const char *Exec = Args.MakeArgString(ExecPath);
++  const char *Exec =
++      Args.MakeArgString(getToolChain().GetProgramPath("llvm-link"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Exec, CmdArgs, Inputs));
+   return OutputFileName;
+ }
+@@ -147,9 +146,8 @@ const char *AMDGCN::Linker::constructOptCommand(
+   const char *OutputFileName =
+       C.addTempFile(C.getArgs().MakeArgString(TmpFileName));
+   OptArgs.push_back(OutputFileName);
+-  SmallString<128> OptPath(C.getDriver().Dir);
+-  llvm::sys::path::append(OptPath, "opt");
+-  const char *OptExec = Args.MakeArgString(OptPath);
++  const char *OptExec =
++      Args.MakeArgString(getToolChain().GetProgramPath("opt"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, OptExec, OptArgs, Inputs));
+   return OutputFileName;
+ }
+@@ -167,9 +165,7 @@ const char *AMDGCN::Linker::constructLlcCommand(
+   const char *LlcOutputFile =
+       C.addTempFile(C.getArgs().MakeArgString(LlcOutputFileName));
+   LlcArgs.push_back(LlcOutputFile);
+-  SmallString<128> LlcPath(C.getDriver().Dir);
+-  llvm::sys::path::append(LlcPath, "llc");
+-  const char *Llc = Args.MakeArgString(LlcPath);
++  const char *Llc = Args.MakeArgString(getToolChain().GetProgramPath("llc"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Llc, LlcArgs, Inputs));
+   return LlcOutputFile;
+ }
+@@ -184,9 +180,7 @@ void AMDGCN::Linker::constructLldCommand(Compilation &C, const JobAction &JA,
+   ArgStringList LldArgs{"-flavor",    "gnu", "--no-undefined",
+                         "-shared",    "-o",  Output.getFilename(),
+                         InputFileName};
+-  SmallString<128> LldPath(C.getDriver().Dir);
+-  llvm::sys::path::append(LldPath, "lld");
+-  const char *Lld = Args.MakeArgString(LldPath);
++  const char *Lld = Args.MakeArgString(getToolChain().GetProgramPath("lld"));
+   C.addCommand(llvm::make_unique<Command>(JA, *this, Lld, LldArgs, Inputs));
+ }
+ 
+@@ -218,9 +212,8 @@ void AMDGCN::constructHIPFatbinCommand(Compilation &C, const JobAction &JA,
+       Args.MakeArgString(std::string("-outputs=").append(OutputFileName));
+   BundlerArgs.push_back(BundlerOutputArg);
+ 
+-  SmallString<128> BundlerPath(C.getDriver().Dir);
+-  llvm::sys::path::append(BundlerPath, "clang-offload-bundler");
+-  const char *Bundler = Args.MakeArgString(BundlerPath);
++  const char *Bundler = Args.MakeArgString(
++          T.getToolChain().GetProgramPath("clang-offload-bundler"));
+   C.addCommand(llvm::make_unique<Command>(JA, T, Bundler, BundlerArgs, Inputs));
+ }
+ 
+-- 
+2.23.1
+

pkgs/development/compilers/llvm/8/clang/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3
+{ stdenv, fetch, cmake, libxml2, llvm, version, clang-tools-extra_src, python3, lld
 , fixDarwinDylibNames
 , enableManpages ? false
 , enablePolly ? false # TODO: get this info from llvm (passthru?)
@@ -22,7 +22,7 @@ let
     nativeBuildInputs = [ cmake python3 ]
       ++ stdenv.lib.optional enableManpages python3.pkgs.sphinx;
 
-    buildInputs = [ libxml2 llvm ]
+    buildInputs = [ libxml2 llvm lld ]
       ++ stdenv.lib.optional stdenv.isDarwin fixDarwinDylibNames;
 
     cmakeFlags = [
@@ -50,6 +50,8 @@ let
       ./unwindlib.patch
       # https://reviews.llvm.org/D51899
       ./compiler-rt-baremetal.patch
+      # make clang -xhip use $PATH to find executables
+      ./HIP-use-PATH-8.patch
     ];
 
     postPatch = ''