Merge master into staging-next

.version

@@ -1 +1 @@
-20.03
+20.09

doc/builders/packages/index.xml

@@ -18,6 +18,7 @@
  <xi:include href="opengl.xml" />
  <xi:include href="shell-helpers.xml" />
  <xi:include href="steam.xml" />
+ <xi:include href="urxvt.xml" />
  <xi:include href="weechat.xml" />
  <xi:include href="xorg.xml" />
 </chapter>

doc/builders/packages/urxvt.xml

@@ -0,0 +1,101 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="sec-urxvt">
+ <title>Urxvt</title>
+
+ <para>
+  Urxvt, also known as rxvt-unicode, is a highly customizable terminal emulator.
+ </para>
+
+ <section xml:id="sec-urxvt-conf">
+
+  <title>Configuring urxvt</title>
+
+  <para>
+   In <literal>nixpkgs</literal>, urxvt is provided by the package
+   <literal>rxvt-unicode</literal>. It can be configured to include your choice
+   of plugins, reducing its closure size from the default configuration which
+   includes all available plugins. To make use of this functionality, use an
+   overlay or directly install an expression that overrides its configuration,
+   such as
+   <programlisting>rxvt-unicode.override { configure = { availablePlugins, ... }: {
+    plugins = with availablePlugins; [ perls resize-font vtwheel ];
+  }
+}</programlisting>
+   If the <literal>configure</literal> function returns an attrset without the
+   <literal>plugins</literal> attribute, <literal>availablePlugins</literal>
+   will be used automatically.
+  </para>
+
+  <para>
+   In order to add plugins but also keep all default plugins installed, it is
+   possible to use the following method:
+   <programlisting>rxvt-unicode.override { configure = { availablePlugins, ... }: {
+     plugins = (builtins.attrValues availablePlugins) ++ [ custom-plugin ];
+   };
+}</programlisting>
+  </para>
+
+  <para>
+   To get a list of all the plugins available, open the Nix REPL and run
+   <programlisting>$ nix repl
+:l &lt;nixpkgs&gt;
+map (p: p.name) pkgs.rxvt-unicode.plugins
+   </programlisting>
+   Alternatively, if your shell is bash or zsh and have completion enabled,
+   simply type <literal>nixpkgs.rxvt-unicode.plugins.&lt;tab&gt;</literal>.
+  </para>
+
+  <para>
+    In addition to <literal>plugins</literal> the options
+    <literal>extraDeps</literal> and <literal>perlDeps</literal> can be used
+    to install extra packages.
+    <literal>extraDeps</literal> can be used, for example, to provide 
+    <literal>xsel</literal> (a clipboard manager) to the clipboard plugin,
+    without installing it globally:
+    <programlisting>rxvt-unicode.override { configure = { availablePlugins, ... }: {
+     pluginsDeps = [ xsel ];
+   }
+}</programlisting>
+
+    <literal>perlDeps</literal> is a handy way to provide Perl packages to
+    your custom plugins (in <literal>$HOME/.urxvt/ext</literal>). For example,
+    if you need <literal>AnyEvent</literal> you can do:
+    <programlisting>rxvt-unicode.override { configure = { availablePlugins, ... }: {
+     perlDeps = with perlPackages; [ AnyEvent ];
+   }
+}</programlisting>
+  </para>
+
+ </section>
+
+ <section xml:id="sec-urxvt-pkg">
+
+  <title>Packaging urxvt plugins</title>
+
+  <para>
+   Urxvt plugins resides in
+   <literal>pkgs/applications/misc/rxvt-unicode-plugins</literal>.
+   To add a new plugin create an expression in a subdirectory and add the
+   package to the set in
+   <literal>pkgs/applications/misc/rxvt-unicode-plugins/default.nix</literal>.
+  </para>
+
+  <para>
+   A plugin can be any kind of derivation, the only requirement is that it
+   should always install perl scripts in <literal>$out/lib/urxvt/perl</literal>.
+   Look for existing plugins for examples.
+  </para>
+
+  <para>
+   If the plugin is itself a perl package that needs to be imported from
+   other plugins or scripts, add the following passthrough:
+   <programlisting>passthru.perlPackages = [ "self" ];
+</programlisting>
+   This will make the urxvt wrapper pick up the dependency and set up the perl
+   path accordingly.
+  </para>
+
+ </section>
+
+</section>

doc/contributing/quick-start.xml

@@ -69,8 +69,7 @@
       <listitem>
        <para>
         JDiskReport, a Java utility: <link
-          xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/misc/jdiskreport/default.nix"><filename>pkgs/tools/misc/jdiskreport/default.nix</filename></link> (and the <link
+          xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/misc/jdiskreport/default.nix"><filename>pkgs/tools/misc/jdiskreport/default.nix</filename></link>. Nixpkgs doesn’t have a decent <varname>stdenv</varname> for Java yet so this is pretty ad-hoc.
-          xlink:href="https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/misc/jdiskreport/builder.sh">builder</link>). Nixpkgs doesn’t have a decent <varname>stdenv</varname> for Java yet so this is pretty ad-hoc.
        </para>
       </listitem>
       <listitem>

doc/stdenv/cross-compilation.xml

@@ -256,7 +256,7 @@
      </question>
      <answer>
       <para>
-<programlisting>doCheck = stdenv.hostPlatform != stdenv.buildPlatfrom;</programlisting>
+<programlisting>doCheck = stdenv.hostPlatform == stdenv.buildPlatfrom;</programlisting>
        Add it to your <function>mkDerivation</function> invocation.
       </para>
      </answer>

flake.nix

@@ -0,0 +1,50 @@
+# Experimental flake interface to Nixpkgs.
+# See https://github.com/NixOS/rfcs/pull/49 for details.
+{
+  edition = 201909;
+
+  description = "A collection of packages for the Nix package manager";
+
+  outputs = { self }:
+    let
+
+      jobs = import ./pkgs/top-level/release.nix {
+        nixpkgs = self;
+      };
+
+      lib = import ./lib;
+
+      systems = [ "x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-linux" ];
+
+      forAllSystems = f: lib.genAttrs systems (system: f system);
+
+    in
+    {
+      lib = lib // {
+        nixosSystem = { modules, ... } @ args:
+          import ./nixos/lib/eval-config.nix (args // {
+            modules = modules ++
+              [ { system.nixos.versionSuffix =
+                    ".${lib.substring 0 8 self.lastModified}.${self.shortRev or "dirty"}";
+                  system.nixos.revision = lib.mkIf (self ? rev) self.rev;
+                }
+              ];
+          });
+      };
+
+      checks.x86_64-linux.tarball = jobs.tarball;
+
+      htmlDocs = {
+        nixpkgsManual = jobs.manual;
+        nixosManual = (import ./nixos/release-small.nix {
+          nixpkgs = self;
+        }).nixos.manual.x86_64-linux;
+      };
+
+      legacyPackages = forAllSystems (system: import ./. { inherit system; });
+
+      nixosModules = {
+        notDetected = import ./nixos/modules/installer/scan/not-detected.nix;
+      };
+    };
+}

lib/tests/misc.nix

@@ -148,7 +148,7 @@ runTests {
             "${builtins.storeDir}/d945ibfx9x185xf04b890y4f9g3cbb63-python-2.7.11";
       in {
         storePath = isStorePath goodPath;
-        storePathDerivation = isStorePath (import ../.. {}).hello;
+        storePathDerivation = isStorePath (import ../.. { system = "x86_64-linux"; }).hello;
         storePathAppendix = isStorePath
           "${goodPath}/bin/python";
         nonAbsolute = isStorePath (concatStrings (tail (stringToCharacters goodPath)));

lib/tests/release.nix

@@ -2,7 +2,7 @@
 
 pkgs.runCommandNoCC "nixpkgs-lib-tests" {
   buildInputs = [ pkgs.nix (import ./check-eval.nix) ];
-  NIX_PATH="nixpkgs=${pkgs.path}";
+  NIX_PATH = "nixpkgs=${toString pkgs.path}";
 } ''
     datadir="${pkgs.nix}/share"
     export TEST_ROOT=$(pwd)/test-tmp

lib/trivial.nix

@@ -171,7 +171,7 @@ rec {
      On each release the first letter is bumped and a new animal is chosen
      starting with that new letter.
   */
-  codeName = "Markhor";
+  codeName = "Nightingale";
 
   /* Returns the current nixpkgs version suffix as string. */
   versionSuffix =

maintainers/maintainer-list.nix

@@ -357,6 +357,16 @@
     githubId = 5892756;
     name = "Alec Snyder";
   };
+  AluisioASG = {
+    name = "Aluísio Augusto Silva Gonçalves";
+    email = "aluisio@aasg.name";
+    github = "AluisioASG";
+    githubId = 1904165;
+    keys = [{
+      longkeyid = "rsa4096/0x9FAA63E097506D9D";
+      fingerprint = "7FDB 17B3 C29B 5BA6 E5A9  8BB2 9FAA 63E0 9750 6D9D";
+    }];
+  };
   alunduil = {
     email = "alunduil@gmail.com";
     github = "alunduil";

nixos/doc/manual/man-nixos-rebuild.xml

@@ -77,7 +77,14 @@
     <option>--builders</option> <replaceable>builder-spec</replaceable>
    </arg>
 
+   <sbr/>
+
+   <arg>
+    <option>--flake</option> <replaceable>flake-uri</replaceable>
+   </arg>
+
    <sbr />
+
    <arg>
     <group choice='req'>
     <arg choice='plain'>
@@ -129,14 +136,17 @@
   <title>Description</title>
 
   <para>
-   This command updates the system so that it corresponds to the configuration
+   This command updates the system so that it corresponds to the
-   specified in <filename>/etc/nixos/configuration.nix</filename>. Thus, every
+   configuration specified in
-   time you modify <filename>/etc/nixos/configuration.nix</filename> or any
+   <filename>/etc/nixos/configuration.nix</filename> or
-   NixOS module, you must run <command>nixos-rebuild</command> to make the
+   <filename>/etc/nixos/flake.nix</filename>. Thus, every time you
-   changes take effect. It builds the new system in
+   modify the configuration or any other NixOS module, you must run
-   <filename>/nix/store</filename>, runs its activation script, and stop and
+   <command>nixos-rebuild</command> to make the changes take
-   (re)starts any system services if needed. Please note that user services need
+   effect. It builds the new system in
-   to be started manually as they aren't detected by the activation script at the moment.
+   <filename>/nix/store</filename>, runs its activation script, and
+   stop and (re)starts any system services if needed. Please note that
+   user services need to be started manually as they aren't detected
+   by the activation script at the moment.
   </para>
 
   <para>
@@ -508,6 +518,24 @@
      </para>
     </listitem>
    </varlistentry>
+
+   <varlistentry>
+    <term>
+     <option>--flake</option> <replaceable>flake-uri</replaceable>[<replaceable>name</replaceable>]
+    </term>
+    <listitem>
+     <para>
+      Build the NixOS system from the specified flake. It defaults to
+      the directory containing the target of the symlink
+      <filename>/etc/nixos/flake.nix</filename>, if it exists. The
+      flake must contain an output named
+      <literal>nixosConfigurations.<replaceable>name</replaceable></literal>. If
+      <replaceable>name</replaceable> is omitted, it default to the
+      current host name.
+     </para>
+    </listitem>
+   </varlistentry>
+
   </variablelist>
 
   <para>
@@ -554,6 +582,21 @@
 
   <variablelist>
 
+   <varlistentry>
+    <term>
+     <filename>/etc/nixos/flake.nix</filename>
+    </term>
+    <listitem>
+     <para>
+      If this file exists, then <command>nixos-rebuild</command> will
+      use it as if the <option>--flake</option> option was given. This
+      file may be a symlink to a <filename>flake.nix</filename> in an
+      actual flake; thus <filename>/etc/nixos</filename> need not be a
+      flake.
+     </para>
+    </listitem>
+   </varlistentry>
+
    <varlistentry>
     <term>
      <filename>/run/current-system</filename>

nixos/doc/manual/man-nixos-version.xml

@@ -12,16 +12,22 @@
  </refnamediv>
  <refsynopsisdiv>
   <cmdsynopsis>
-   <command>nixos-version</command> 
+   <command>nixos-version</command>
    <arg>
     <option>--hash</option>
    </arg>
-    
+
    <arg>
     <option>--revision</option>
    </arg>
+
+   <arg>
+    <option>--json</option>
+   </arg>
+
   </cmdsynopsis>
  </refsynopsisdiv>
+
  <refsection>
   <title>Description</title>
   <para>
@@ -84,12 +90,16 @@
    </variablelist>
   </para>
  </refsection>
+
  <refsection>
   <title>Options</title>
+
   <para>
    This command accepts the following options:
   </para>
+
   <variablelist>
+
    <varlistentry>
     <term>
      <option>--hash</option>
@@ -107,6 +117,21 @@
      </para>
     </listitem>
    </varlistentry>
+
+   <varlistentry>
+    <term>
+     <option>--json</option>
+    </term>
+    <listitem>
+     <para>
+      Print a JSON representation of the versions of NixOS and the
+      top-level configuration flake.
+     </para>
+    </listitem>
+   </varlistentry>
+
   </variablelist>
+
  </refsection>
+
 </refentry>

nixos/doc/manual/release-notes/release-notes.xml

@@ -8,6 +8,7 @@
   This section lists the release notes for each stable version of NixOS and
   current unstable revision.
  </para>
+ <xi:include href="rl-2009.xml" />
  <xi:include href="rl-2003.xml" />
  <xi:include href="rl-1909.xml" />
  <xi:include href="rl-1903.xml" />

nixos/doc/manual/release-notes/rl-2003.xml

@@ -440,15 +440,19 @@ users.users.me =
    </listitem>
    <listitem>
     <para>
-      The <link linkend="opt-services.buildkite-agent.enable">Buildkite Agent</link>
+      The <link linkend="opt-services.buildkite-agents">Buildkite
-      module and corresponding packages have been updated to 3.x.
+      Agent</link> module and corresponding packages have been updated to
-      While doing so, the following options have been changed:
+      3.x, and to support multiple instances of the agent running at the
+      same time. This means you will have to rename
+      <literal>services.buildkite-agent</literal> to
+      <literal>services.buildkite-agents.&lt;name&gt;</literal>. Furthermore,
+      the following options have been changed:
     </para>
     <itemizedlist>
       <listitem>
        <para>
          <literal>services.buildkite-agent.meta-data</literal> has been renamed to
-         <link linkend="opt-services.buildkite-agent.tags">services.buildkite-agent.tags</link>,
+         <link linkend="opt-services.buildkite-agents">services.buildkite-agents.&lt;name&gt;.tags</link>,
          to match upstreams naming for 3.x.
          Its type has also changed - it now accepts an attrset of strings.
        </para>
@@ -464,13 +468,13 @@ users.users.me =
        <para>
          <literal>services.buildkite-agent.openssh.privateKeyPath</literal>
          has been renamed to
-         <link linkend="opt-services.buildkite-agent.privateSshKeyPath">buildkite-agent.privateSshKeyPath</link>,
+         <link linkend="opt-services.buildkite-agents">buildkite-agents.&lt;name&gt;.privateSshKeyPath</link>,
          as the whole <literal>openssh</literal> now only contained that single option.
        </para>
       </listitem>
       <listitem>
        <para>
-         <link linkend="opt-services.buildkite-agent.shell">services.buildkite-agent.shell</link>
+         <link linkend="opt-services.buildkite-agents">services.buildkite-agents.&lt;name&gt;.shell</link>
          has been introduced, allowing to specify a custom shell to be used.
        </para>
       </listitem>
@@ -675,8 +679,9 @@ auth required pam_succeed_if.so uid >= 1000 quiet
      Certificates will be regenerated anew on the next renewal date. The credentials for simp-le are
      preserved and thus it is possible to roll back to previous versions without breaking certificate
      generation.
+    </para>
    </listitem>
-    <listitem>
+   <listitem>
     <para>
     It is now possible to unlock LUKS-Encrypted file systems using a FIDO2 token
     via <option>boot.initrd.luks.fido2Support</option>.

nixos/doc/manual/release-notes/rl-2009.xml

@@ -0,0 +1,80 @@
+<section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-20.09">
+ <title>Release 20.09 (“Nightingale”, 2020.09/??)</title>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-20.09-highlights">
+  <title>Highlights</title>
+
+  <para>
+   In addition to numerous new and upgraded packages, this release has the
+   following highlights:
+  </para>
+
+  <itemizedlist>
+   <listitem>
+    <para>
+     Support is planned until the end of October 2020, handing over to 20.09.
+    </para>
+   </listitem>
+  </itemizedlist>
+ </section>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-20.09-new-services">
+  <title>New Services</title>
+
+  <para>
+   The following new services were added since the last release:
+  </para>
+
+  <itemizedlist>
+   <listitem>
+    <para />
+   </listitem>
+  </itemizedlist>
+
+ </section>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-20.09-incompatibilities">
+  <title>Backward Incompatibilities</title>
+
+  <para>
+   When upgrading from a previous release, please be aware of the following
+   incompatible changes:
+  </para>
+
+  <itemizedlist>
+   <listitem>
+    <para />
+   </listitem>
+  </itemizedlist>
+ </section>
+
+ <section xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="sec-release-20.09-notable-changes">
+  <title>Other Notable Changes</title>
+
+  <itemizedlist>
+   <listitem>
+    <para />
+   </listitem>
+  </itemizedlist>
+ </section>
+</section>

nixos/modules/config/xdg/portal.nix

@@ -42,6 +42,10 @@ with lib;
     let
       cfg = config.xdg.portal;
       packages = [ pkgs.xdg-desktop-portal ] ++ cfg.extraPortals;
+      joinedPortals = pkgs.symlinkJoin {
+        name = "xdg-portals";
+        paths = cfg.extraPortals;
+      };
 
     in mkIf cfg.enable {
 
@@ -56,7 +60,7 @@ with lib;
 
       environment.variables = {
         GTK_USE_PORTAL = mkIf cfg.gtkUsePortal "1";
-        XDG_DESKTOP_PORTAL_PATH = map (p: "${p}/share/xdg-desktop-portal/portals") cfg.extraPortals;
+        XDG_DESKTOP_PORTAL_DIR = "${joinedPortals}/share/xdg-desktop-portal/portals";
       };
     };
 }

nixos/modules/installer/tools/nixos-rebuild.sh

@@ -3,6 +3,9 @@
 if [ -x "@shell@" ]; then export SHELL="@shell@"; fi;
 
 set -e
+set -o pipefail
+
+export PATH=@path@:$PATH
 
 showSyntax() {
     exec man nixos-rebuild
@@ -13,6 +16,7 @@ showSyntax() {
 # Parse the command line.
 origArgs=("$@")
 extraBuildFlags=()
+lockFlags=()
 action=
 buildNix=1
 fast=
@@ -58,7 +62,7 @@ while [ "$#" -gt 0 ]; do
         j="$1"; shift 1
         extraBuildFlags+=("$i" "$j")
         ;;
-      --show-trace|--keep-failed|-K|--keep-going|-k|--verbose|-v|-vv|-vvv|-vvvv|-vvvvv|--fallback|--repair|--no-build-output|-Q|-j*)
+      --show-trace|--keep-failed|-K|--keep-going|-k|--verbose|-v|-vv|-vvv|-vvvv|-vvvvv|--fallback|--repair|--no-build-output|-Q|-j*|-L|--refresh|--no-net)
         extraBuildFlags+=("$i")
         ;;
       --option)
@@ -93,6 +97,22 @@ while [ "$#" -gt 0 ]; do
       --use-remote-sudo)
         maybeSudo=(sudo --)
         ;;
+      --flake)
+        flake="$1"
+        shift 1
+        ;;
+      --recreate-lock-file|--no-update-lock-file|--no-write-lock-file|--no-registries|--commit-lock-file)
+        lockFlags+=("$i")
+        ;;
+      --update-input)
+        j="$1"; shift 1
+        lockFlags+=("$i" "$j")
+        ;;
+      --override-input)
+        j="$1"; shift 1
+        k="$1"; shift 1
+        lockFlags+=("$i" "$j" "$k")
+        ;;
       *)
         echo "$0: unknown option \`$i'"
         exit 1
@@ -202,7 +222,7 @@ fi
 
 
 # If ‘--upgrade’ is given, run ‘nix-channel --update nixos’.
-if [ -n "$upgrade" -a -z "$_NIXOS_REBUILD_REEXEC" ]; then
+if [[ -n $upgrade && -z $_NIXOS_REBUILD_REEXEC && -z $flake ]]; then
     nix-channel --update nixos
 
     # If there are other channels that contain a file called
@@ -225,8 +245,15 @@ if [ -z "$_NIXOS_REBUILD_REEXEC" ]; then
     export PATH=@nix@/bin:$PATH
 fi
 
+# Use /etc/nixos/flake.nix if it exists. It can be a symlink to the
+# actual flake.
+if [[ -z $flake && -e /etc/nixos/flake.nix ]]; then
+    flake="$(dirname "$(readlink -f /etc/nixos/flake.nix)")"
+fi
+
 # Re-execute nixos-rebuild from the Nixpkgs tree.
-if [ -z "$_NIXOS_REBUILD_REEXEC" -a -n "$canRun" -a -z "$fast" ]; then
+# FIXME: get nixos-rebuild from $flake.
+if [[ -z $_NIXOS_REBUILD_REEXEC && -n $canRun && -z $fast && -z $flake ]]; then
     if p=$(nix-build --no-out-link --expr 'with import <nixpkgs/nixos> {}; config.system.build.nixos-rebuild' "${extraBuildFlags[@]}"); then
         export _NIXOS_REBUILD_REEXEC=1
         exec $p/bin/nixos-rebuild "${origArgs[@]}"
@@ -234,10 +261,37 @@ if [ -z "$_NIXOS_REBUILD_REEXEC" -a -n "$canRun" -a -z "$fast" ]; then
     fi
 fi
 
+# For convenience, use the hostname as the default configuration to
+# build from the flake.
+if [[ -n $flake ]]; then
+    if [[ $flake =~ ^(.*)\#([^\#\"]*)$ ]]; then
+       flake="${BASH_REMATCH[1]}"
+       flakeAttr="${BASH_REMATCH[2]}"
+    fi
+    if [[ -z $flakeAttr ]]; then
+        read -r hostname < /proc/sys/kernel/hostname
+        if [[ -z $hostname ]]; then
+            hostname=default
+        fi
+        flakeAttr="nixosConfigurations.\"$hostname\""
+    else
+        flakeAttr="nixosConfigurations.\"$flakeAttr\""
+    fi
+fi
+
+# Resolve the flake.
+if [[ -n $flake ]]; then
+    flake=$(nix flake info --json "${extraBuildFlags[@]}" "${lockFlags[@]}" -- "$flake" | jq -r .url)
+fi
+
 # Find configuration.nix and open editor instead of building.
 if [ "$action" = edit ]; then
-    NIXOS_CONFIG=${NIXOS_CONFIG:-$(nix-instantiate --find-file nixos-config)}
+    if [[ -z $flake ]]; then
-    exec "${EDITOR:-nano}" "$NIXOS_CONFIG"
+        NIXOS_CONFIG=${NIXOS_CONFIG:-$(nix-instantiate --find-file nixos-config)}
+        exec "${EDITOR:-nano}" "$NIXOS_CONFIG"
+    else
+        exec nix edit "${lockFlags[@]}" -- "$flake#$flakeAttr"
+    fi
     exit 1
 fi
 
@@ -296,7 +350,7 @@ prebuiltNix() {
 
 remotePATH=
 
-if [ -n "$buildNix" ]; then
+if [[ -n $buildNix && -z $flake ]]; then
     echo "building Nix..." >&2
     nixDrv=
     if ! nixDrv="$(nix-instantiate '<nixpkgs/nixos>' --add-root $tmpDir/nix.drv --indirect -A config.nix.package.out "${extraBuildFlags[@]}")"; then
@@ -337,7 +391,7 @@ fi
 
 # Update the version suffix if we're building from Git (so that
 # nixos-version shows something useful).
-if [ -n "$canRun" ]; then
+if [[ -n $canRun && -z $flake ]]; then
     if nixpkgs=$(nix-instantiate --find-file nixpkgs "${extraBuildFlags[@]}"); then
         suffix=$($SHELL $nixpkgs/nixos/modules/installer/tools/get-version-suffix "${extraBuildFlags[@]}" || true)
         if [ -n "$suffix" ]; then
@@ -358,15 +412,37 @@ fi
 if [ -z "$rollback" ]; then
     echo "building the system configuration..." >&2
     if [ "$action" = switch -o "$action" = boot ]; then
-        pathToConfig="$(nixBuild '<nixpkgs/nixos>' --no-out-link -A system "${extraBuildFlags[@]}")"
+        if [[ -z $flake ]]; then
+            pathToConfig="$(nixBuild '<nixpkgs/nixos>' --no-out-link -A system "${extraBuildFlags[@]}")"
+        else
+            outLink=$tmpDir/result
+            nix build "$flake#$flakeAttr.config.system.build.toplevel" \
+              "${extraBuildFlags[@]}" "${lockFlags[@]}" --out-link $outLink
+            pathToConfig="$(readlink -f $outLink)"
+        fi
         copyToTarget "$pathToConfig"
         targetHostCmd nix-env -p "$profile" --set "$pathToConfig"
     elif [ "$action" = test -o "$action" = build -o "$action" = dry-build -o "$action" = dry-activate ]; then
-        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}")"
+        if [[ -z $flake ]]; then
+            pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A system -k "${extraBuildFlags[@]}")"
+        else
+            nix build "$flake#$flakeAttr.config.system.build.toplevel" "${extraBuildFlags[@]}" "${lockFlags[@]}"
+            pathToConfig="$(readlink -f ./result)"
+        fi
     elif [ "$action" = build-vm ]; then
-        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}")"
+        if [[ -z $flake ]]; then
+            pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vm -k "${extraBuildFlags[@]}")"
+        else
+            echo "$0: 'build-vm' is not supported with '--flake'" >&2
+            exit 1
+        fi
     elif [ "$action" = build-vm-with-bootloader ]; then
-        pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}")"
+        if [[ -z $flake ]]; then
+            pathToConfig="$(nixBuild '<nixpkgs/nixos>' -A vmWithBootLoader -k "${extraBuildFlags[@]}")"
+        else
+            echo "$0: 'build-vm-with-bootloader' is not supported with '--flake'" >&2
+            exit 1
+        fi
     else
         showSyntax
     fi

nixos/modules/installer/tools/nixos-version.sh

@@ -6,8 +6,17 @@ case "$1" in
     exit 1
     ;;
   --hash|--revision)
+    if ! [[ @revision@ =~ ^[0-9a-f]+$ ]]; then
+      echo "$0: Nixpkgs commit hash is unknown"
+      exit 1
+    fi
     echo "@revision@"
     ;;
+  --json)
+    cat <<EOF
+@json@
+EOF
+    ;;
   *)
     echo "@version@ (@codeName@)"
     ;;

nixos/modules/installer/tools/tools.nix

@@ -31,6 +31,7 @@ let
       nix = config.nix.package.out;
       nix_x86_64_linux = fallback.x86_64-linux;
       nix_i686_linux = fallback.i686-linux;
+      path = makeBinPath [ pkgs.jq ];
     };
 
   nixos-generate-config = makeProg {
@@ -47,6 +48,14 @@ let
     name = "nixos-version";
     src = ./nixos-version.sh;
     inherit (config.system.nixos) version codeName revision;
+    inherit (config.system) configurationRevision;
+    json = builtins.toJSON ({
+      nixosVersion = config.system.nixos.version;
+    } // optionalAttrs (config.system.nixos.revision != null) {
+      nixpkgsRevision = config.system.nixos.revision;
+    } // optionalAttrs (config.system.configurationRevision != null) {
+      configurationRevision = config.system.configurationRevision;
+    });
   };
 
   nixos-enter = makeProg {

nixos/modules/misc/version.nix

@@ -42,8 +42,8 @@ in
 
     nixos.revision = mkOption {
       internal = true;
-      type = types.str;
+      type = types.nullOr types.str;
-      default = trivial.revisionWithDefault "master";
+      default = trivial.revisionWithDefault null;
       description = "The Git revision from which this NixOS configuration was built.";
     };
 
@@ -84,6 +84,12 @@ in
       description = "Default NixOS channel to which the root user is subscribed.";
     };
 
+    configurationRevision = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "The Git revision of the top-level flake from which this configuration was built.";
+    };
+
   };
 
   config = {

nixos/modules/module-list.nix

@@ -253,7 +253,7 @@
   ./services/computing/slurm/slurm.nix
   ./services/continuous-integration/buildbot/master.nix
   ./services/continuous-integration/buildbot/worker.nix
-  ./services/continuous-integration/buildkite-agent.nix
+  ./services/continuous-integration/buildkite-agents.nix
   ./services/continuous-integration/hail.nix
   ./services/continuous-integration/hydra/default.nix
   ./services/continuous-integration/gitlab-runner.nix

nixos/modules/services/continuous-integration/buildkite-agents.nix

@@ -3,7 +3,7 @@
 with lib;
 
 let
-  cfg = config.services.buildkite-agent;
+  cfg = config.services.buildkite-agents;
 
   mkHookOption = { name, description, example ? null }: {
     inherit name;
@@ -15,7 +15,7 @@ let
   };
   mkHookOptions = hooks: listToAttrs (map mkHookOption hooks);
 
-  hooksDir = let
+  hooksDir = cfg: let
     mkHookEntry = name: value: ''
       cat > $out/${name} <<'EOF'
       #! ${pkgs.runtimeShell}
@@ -29,12 +29,13 @@ let
     ${concatStringsSep "\n" (mapAttrsToList mkHookEntry (filterAttrs (n: v: v != null) cfg.hooks))}
   '';
 
-in
+  buildkiteOptions = { name ? "", config, ... }: {
-
+    options = {
-{
+      enable = mkOption {
-  options = {
+        default = true;
-    services.buildkite-agent = {
+        type = types.bool;
-      enable = mkEnableOption "buildkite-agent";
+        description = "Whether to enable this buildkite agent";
+      };
 
       package = mkOption {
         default = pkgs.buildkite-agent;
@@ -44,7 +45,7 @@ in
       };
 
       dataDir = mkOption {
-        default = "/var/lib/buildkite-agent";
+        default = "/var/lib/buildkite-agent-${name}";
         description = "The workdir for the agent";
         type = types.str;
       };
@@ -68,9 +69,9 @@ in
 
       name = mkOption {
         type = types.str;
-        default = "%hostname-%n";
+        default = "%hostname-${name}-%n";
         description = ''
-          The name of the agent.
+          The name of the agent as seen in the buildkite dashboard.
         '';
       };
 
@@ -166,11 +167,11 @@ in
 
       hooksPath = mkOption {
         type = types.path;
-        default = hooksDir;
+        default = hooksDir config;
-        defaultText = "generated from services.buildkite-agent.hooks";
+        defaultText = "generated from services.buildkite-agents.<name>.hooks";
         description = ''
           Path to the directory storing the hooks.
-          Consider using <option>services.buildkite-agent.hooks.&lt;name&gt;</option>
+          Consider using <option>services.buildkite-agents.&lt;name&gt;.hooks.&lt;name&gt;</option>
           instead.
         '';
       };
@@ -184,24 +185,38 @@ in
       };
     };
   };
+  enabledAgents = lib.filterAttrs (n: v: v.enable) cfg;
+  mapAgents = function: lib.mkMerge (lib.mapAttrsToList function enabledAgents);
+in
+{
+  options.services.buildkite-agents = mkOption {
+    type = types.attrsOf (types.submodule buildkiteOptions);
+    default = {};
+    description = ''
+      Attribute set of buildkite agents.
+      The attribute key is combined with the hostname and a unique integer to
+      create the final agent name. This can be overridden by setting the `name`
+      attribute.
+    '';
+  };
 
-  config = mkIf config.services.buildkite-agent.enable {
+  config.users.users = mapAgents (name: cfg: {
-    users.users.buildkite-agent = {
+    "buildkite-agent-${name}" = {
-      name = "buildkite-agent";
+      name = "buildkite-agent-${name}";
       home = cfg.dataDir;
       createHome = true;
       description = "Buildkite agent user";
       extraGroups = [ "keys" ];
       isSystemUser = true;
     };
+  });
 
-    environment.systemPackages = [ cfg.package ];
+  config.systemd.services = mapAgents (name: cfg: {
-
+    "buildkite-agent-${name}" =
-    systemd.services.buildkite-agent =
       { description = "Buildkite Agent";
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
-        path = cfg.runtimePackages ++ [ pkgs.coreutils ];
+        path = cfg.runtimePackages ++ [ cfg.package pkgs.coreutils ];
         environment = config.networking.proxy.envVars // {
           HOME = cfg.dataDir;
           NIX_REMOTE = "daemon";
@@ -230,8 +245,8 @@ in
           '';
 
         serviceConfig =
-          { ExecStart = "${cfg.package}/bin/buildkite-agent start --config /var/lib/buildkite-agent/buildkite-agent.cfg";
+          { ExecStart = "${cfg.package}/bin/buildkite-agent start --config ${cfg.dataDir}/buildkite-agent.cfg";
-            User = "buildkite-agent";
+            User = "buildkite-agent-${name}";
             RestartSec = 5;
             Restart = "on-failure";
             TimeoutSec = 10;
@@ -240,22 +255,18 @@ in
             KillMode = "mixed";
           };
       };
+  });
 
-    assertions = [
+  config.assertions = mapAgents (name: cfg: [
       { assertion = cfg.hooksPath == hooksDir || all (v: v == null) (attrValues cfg.hooks);
         message = ''
-          Options `services.buildkite-agent.hooksPath' and
+          Options `services.buildkite-agents.${name}.hooksPath' and
-          `services.buildkite-agent.hooks.<name>' are mutually exclusive.
+          `services.buildkite-agents.${name}.hooks.<name>' are mutually exclusive.
         '';
       }
-    ];
+  ]);
-  };
+
   imports = [
-    (mkRenamedOptionModule [ "services" "buildkite-agent" "token" ]                    [ "services" "buildkite-agent" "tokenPath" ])
+    (mkRemovedOptionModule [ "services" "buildkite-agent"] "services.buildkite-agent has been upgraded from version 2 to version 3 and moved to an attribute set at services.buildkite-agents. Please consult the 20.03 release notes for more information.")
-    (mkRenamedOptionModule [ "services" "buildkite-agent" "openssh" "privateKey" ]     [ "services" "buildkite-agent" "privateSshKeyPath" ])
-    (mkRenamedOptionModule [ "services" "buildkite-agent" "openssh" "privateKeyPath" ] [ "services" "buildkite-agent" "privateSshKeyPath" ])
-    (mkRemovedOptionModule [ "services" "buildkite-agent" "openssh" "publicKey" ]      "SSH public keys aren't necessary to clone private repos.")
-    (mkRemovedOptionModule [ "services" "buildkite-agent" "openssh" "publicKeyPath" ]  "SSH public keys aren't necessary to clone private repos.")
-    (mkRenamedOptionModule [ "services" "buildkite-agent" "meta-data"]                 [ "services" "buildkite-agent" "tags" ])
   ];
 }

nixos/modules/services/monitoring/heapster.nix

@@ -49,7 +49,7 @@ in {
       };
     };
 
-    users.users.heapsterrs = {
+    users.users.heapster = {
       uid = config.ids.uids.heapster;
       description = "Heapster user";
     };

nixos/modules/services/monitoring/statsd.nix

@@ -125,7 +125,7 @@ in
       message = "Only builtin backends (graphite, console, repeater) or backends enumerated in `pkgs.nodePackages` are allowed!";
     }) cfg.backends;
 
-    users.use.statsdrs = {
+    users.users.statsd = {
       uid = config.ids.uids.statsd;
       description = "Statsd daemon user";
     };

nixos/modules/services/networking/supybot.nix

@@ -45,7 +45,7 @@ in
 
     environment.systemPackages = [ pkgs.pythonPackages.limnoria ];
 
-    users.users.supybotrs = {
+    users.users.supybot = {
       uid = config.ids.uids.supybot;
       group = "supybot";
       description = "Supybot IRC bot user";

nixos/modules/services/x11/desktop-managers/plasma5.nix

@@ -8,6 +8,125 @@ let
   cfg = xcfg.desktopManager.plasma5;
 
   inherit (pkgs) kdeApplications plasma5 libsForQt5 qt5;
+  inherit (pkgs) writeText;
+
+  pulseaudio = config.hardware.pulseaudio;
+  pactl = "${getBin pulseaudio.package}/bin/pactl";
+  startplasma-x11 = "${getBin plasma5.plasma-workspace}/bin/startplasma-x11";
+  sed = "${getBin pkgs.gnused}/bin/sed";
+
+  gtkrc2 = writeText "gtkrc-2.0" ''
+    # Default GTK+ 2 config for NixOS Plasma 5
+    include "/run/current-system/sw/share/themes/Breeze/gtk-2.0/gtkrc"
+    style "user-font"
+    {
+      font_name="Sans Serif Regular"
+    }
+    widget_class "*" style "user-font"
+    gtk-font-name="Sans Serif Regular 10"
+    gtk-theme-name="Breeze"
+    gtk-icon-theme-name="breeze"
+    gtk-fallback-icon-theme="hicolor"
+    gtk-cursor-theme-name="breeze_cursors"
+    gtk-toolbar-style=GTK_TOOLBAR_ICONS
+    gtk-menu-images=1
+    gtk-button-images=1
+  '';
+
+  gtk3_settings = writeText "settings.ini" ''
+    [Settings]
+    gtk-font-name=Sans Serif Regular 10
+    gtk-theme-name=Breeze
+    gtk-icon-theme-name=breeze
+    gtk-fallback-icon-theme=hicolor
+    gtk-cursor-theme-name=breeze_cursors
+    gtk-toolbar-style=GTK_TOOLBAR_ICONS
+    gtk-menu-images=1
+    gtk-button-images=1
+  '';
+
+  kcminputrc = writeText "kcminputrc" ''
+    [Mouse]
+    cursorTheme=breeze_cursors
+    cursorSize=0
+  '';
+
+  activationScript = ''
+    # The KDE icon cache is supposed to update itself automatically, but it uses
+    # the timestamp on the icon theme directory as a trigger. This doesn't work
+    # on NixOS because the timestamp never changes. As a workaround, delete the
+    # icon cache at login and session activation.
+    # See also: http://lists-archives.org/kde-devel/26175-what-when-will-icon-cache-refresh.html
+    rm -fv $HOME/.cache/icon-cache.kcache
+
+    # xdg-desktop-settings generates this empty file but
+    # it makes kbuildsyscoca5 fail silently. To fix this
+    # remove that menu if it exists.
+    rm -fv ''${XDG_CONFIG_HOME:?}/menus/applications-merged/xdg-desktop-menu-dummy.menu
+
+    # Qt writes a weird ‘libraryPath’ line to
+    # ~/.config/Trolltech.conf that causes the KDE plugin
+    # paths of previous KDE invocations to be searched.
+    # Obviously using mismatching KDE libraries is potentially
+    # disastrous, so here we nuke references to the Nix store
+    # in Trolltech.conf.  A better solution would be to stop
+    # Qt from doing this wackiness in the first place.
+    trolltech_conf="''${XDG_CONFIG_HOME:?}/Trolltech.conf"
+    if [ -e "$trolltech_conf" ]; then
+        ${sed} -i "$trolltech_conf" -e '/nix\\store\|nix\/store/ d'
+    fi
+
+    # Remove the kbuildsyscoca5 cache. It will be regenerated
+    # immediately after. This is necessary for kbuildsyscoca5 to
+    # recognize that software that has been removed.
+    rm -fv $HOME/.cache/ksycoca*
+
+    ${pkgs.libsForQt5.kservice}/bin/kbuildsycoca5
+  '';
+
+  startplasma =
+    ''
+      export XDG_CONFIG_HOME="''${XDG_CONFIG_HOME:-$HOME/.config}"
+      mkdir -p "''${XDG_CONFIG_HOME:?}"
+
+    ''
+    + optionalString pulseaudio.enable ''
+      # Load PulseAudio module for routing support.
+      # See also: http://colin.guthr.ie/2009/10/so-how-does-the-kde-pulseaudio-support-work-anyway/
+        ${pactl} load-module module-device-manager "do_routing=1"
+
+    ''
+    + ''
+      ${activationScript}
+
+      # Create default configurations if Plasma has never been started.
+      kdeglobals="''${XDG_CONFIG_HOME:?}/kdeglobals"
+      if ! [ -f "$kdeglobals" ]
+      then
+          kcminputrc="''${XDG_CONFIG_HOME:?}/kcminputrc"
+          if ! [ -f "$kcminputrc" ]
+          then
+              cat ${kcminputrc} >"$kcminputrc"
+          fi
+
+          gtkrc2="$HOME/.gtkrc-2.0"
+          if ! [ -f "$gtkrc2" ]
+          then
+              cat ${gtkrc2} >"$gtkrc2"
+          fi
+
+          gtk3_settings="''${XDG_CONFIG_HOME:?}/gtk-3.0/settings.ini"
+          if ! [ -f "$gtk3_settings" ]
+          then
+              mkdir -p "$(dirname "$gtk3_settings")"
+              cat ${gtk3_settings} >"$gtk3_settings"
+          fi
+      fi
+
+    ''
+    + ''
+      exec "${startplasma-x11}"
+    '';
 
 in
 
@@ -41,27 +160,7 @@ in
       services.xserver.desktopManager.session = singleton {
         name = "plasma5";
         bgSupport = true;
-        start = ''
+        start = startplasma;
-          # Load PulseAudio module for routing support.
-          # See http://colin.guthr.ie/2009/10/so-how-does-the-kde-pulseaudio-support-work-anyway/
-          ${optionalString config.hardware.pulseaudio.enable ''
-            ${getBin config.hardware.pulseaudio.package}/bin/pactl load-module module-device-manager "do_routing=1"
-          ''}
-
-          if [ -f "$HOME/.config/kdeglobals" ]
-          then
-              # Remove extraneous font style names.
-              # See also: https://phabricator.kde.org/D9070
-              ${getBin pkgs.gnused}/bin/sed -i "$HOME/.config/kdeglobals" \
-                  -e '/^fixed=/ s/,Regular$//' \
-                  -e '/^font=/ s/,Regular$//' \
-                  -e '/^menuFont=/ s/,Regular$//' \
-                  -e '/^smallestReadableFont=/ s/,Regular$//' \
-                  -e '/^toolBarFont=/ s/,Regular$//'
-          fi
-
-          exec "${getBin plasma5.plasma-workspace}/bin/startplasma-x11"
-        '';
       };
 
       security.wrappers = {
@@ -227,29 +326,7 @@ in
       xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-kde ];
 
       # Update the start menu for each user that is currently logged in
-      system.userActivationScripts.plasmaSetup = ''
+      system.userActivationScripts.plasmaSetup = activationScript;
-        # The KDE icon cache is supposed to update itself
-        # automatically, but it uses the timestamp on the icon
-        # theme directory as a trigger.  Since in Nix the
-        # timestamp is always the same, this doesn't work.  So as
-        # a workaround, nuke the icon cache on login.  This isn't
-        # perfect, since it may require logging out after
-        # installing new applications to update the cache.
-        # See http://lists-archives.org/kde-devel/26175-what-when-will-icon-cache-refresh.html
-        rm -fv $HOME/.cache/icon-cache.kcache
-
-        # xdg-desktop-settings generates this empty file but
-        # it makes kbuildsyscoca5 fail silently. To fix this
-        # remove that menu if it exists.
-        rm -fv $HOME/.config/menus/applications-merged/xdg-desktop-menu-dummy.menu
-
-        # Remove the kbuildsyscoca5 cache. It will be regenerated
-        # immediately after. This is necessary for kbuildsyscoca5 to
-        # recognize that software that has been removed.
-        rm -fv $HOME/.cache/ksycoca*
-
-        ${pkgs.libsForQt5.kservice}/bin/kbuildsycoca5
-      '';
     })
   ];
 

nixos/tests/all-tests.nix

@@ -32,7 +32,7 @@ in
   bees = handleTest ./bees.nix {};
   bind = handleTest ./bind.nix {};
   bittorrent = handleTest ./bittorrent.nix {};
-  buildkite-agent = handleTest ./buildkite-agent.nix {};
+  buildkite-agents = handleTest ./buildkite-agents.nix {};
   boot = handleTestOn ["x86_64-linux"] ./boot.nix {}; # syslinux is unsupported on aarch64
   boot-stage1 = handleTest ./boot-stage1.nix {};
   borgbackup = handleTest ./borgbackup.nix {};

nixos/tests/buildkite-agents.nix

@@ -6,18 +6,13 @@ import ./make-test-python.nix ({ pkgs, ... }:
     maintainers = [ flokli ];
   };
 
-  nodes = {
+  machine = { pkgs, ... }: {
-    node1 = { pkgs, ... }: {
+    services.buildkite-agents = {
-      services.buildkite-agent = {
+      one = {
-        enable = true;
         privateSshKeyPath = (import ./ssh-keys.nix pkgs).snakeOilPrivateKey;
         tokenPath = (pkgs.writeText "my-token" "5678");
       };
-    };
+      two = {
-    # don't configure ssh key, run as a separate user
-    node2 = { pkgs, ...}: {
-      services.buildkite-agent = {
-        enable = true;
         tokenPath = (pkgs.writeText "my-token" "1234");
       };
     };
@@ -28,9 +23,9 @@ import ./make-test-python.nix ({ pkgs, ... }:
     # we can't wait on the unit to start up, as we obviously can't connect to buildkite,
     # but we can look whether files are set up correctly
 
-    node1.wait_for_file("/var/lib/buildkite-agent/buildkite-agent.cfg")
+    machine.wait_for_file("/var/lib/buildkite-agent-one/buildkite-agent.cfg")
-    node1.wait_for_file("/var/lib/buildkite-agent/.ssh/id_rsa")
+    machine.wait_for_file("/var/lib/buildkite-agent-one/.ssh/id_rsa")
 
-    node2.wait_for_file("/var/lib/buildkite-agent/buildkite-agent.cfg")
+    machine.wait_for_file("/var/lib/buildkite-agent-two/buildkite-agent.cfg")
   '';
 })

nixos/tests/installed-tests/default.nix

@@ -90,7 +90,9 @@ in
   graphene = callInstalledTest ./graphene.nix {};
   ibus = callInstalledTest ./ibus.nix {};
   libgdata = callInstalledTest ./libgdata.nix {};
+  glib-testing = callInstalledTest ./glib-testing.nix {};
   libxmlb = callInstalledTest ./libxmlb.nix {};
+  malcontent = callInstalledTest ./malcontent.nix {};
   ostree = callInstalledTest ./ostree.nix {};
   xdg-desktop-portal = callInstalledTest ./xdg-desktop-portal.nix {};
 }

nixos/tests/installed-tests/glib-testing.nix

@@ -0,0 +1,5 @@
+{ pkgs, makeInstalledTest, ... }:
+
+makeInstalledTest {
+  tested = pkgs.glib-testing;
+}

nixos/tests/installed-tests/malcontent.nix

@@ -0,0 +1,5 @@
+{ pkgs, makeInstalledTest, ... }:
+
+makeInstalledTest {
+  tested = pkgs.malcontent;
+}

nixos/tests/installed-tests/xdg-desktop-portal.nix

@@ -2,4 +2,8 @@
 
 makeInstalledTest {
   tested = pkgs.xdg-desktop-portal;
+
+  # Ton of breakage.
+  # https://github.com/flatpak/xdg-desktop-portal/pull/428
+  meta.broken = true;
 }

pkgs/applications/audio/elisa/default.nix

@@ -7,13 +7,13 @@
 
 mkDerivation rec {
   pname = "elisa";
-  version = "19.12.0";
+  version = "19.12.2";
 
   src = fetchFromGitHub {
     owner  = "KDE";
     repo   = "elisa";
     rev    = "v${version}";
-    sha256 = "1939xwhy1s502pai63vz56hnnsl3qsb6arhrlg5bw6bwsv88blac";
+    sha256 = "0g6zj4ix97aa529w43v1z3n73b8l5di6gscs40hyx4sl1sb7fdh6";
   };
 
   buildInputs = [ vlc ];

pkgs/applications/audio/faust/faust2.nix

@@ -3,25 +3,30 @@
 , fetchFromGitHub
 , makeWrapper
 , pkgconfig
+, cmake
 , llvm
 , emscripten
 , openssl
 , libsndfile
 , libmicrohttpd
+, gnutls
+, libtasn1
+, p11-kit
 , vim
+, which
 }:
 
 with stdenv.lib.strings;
 
 let
 
-  version = "2.5.23";
+  version = "2.20.2";
 
   src = fetchFromGitHub {
     owner = "grame-cncm";
     repo = "faust";
     rev = version;
-    sha256 = "1pci8ac6sqrm3mb3yikmmr3iy35g3nj4iihazif1amqkbdz719rc";
+    sha256 = "08hv8gyj6c83128z3si92r1ka5ckf9sdpn5jdnlhrqyzja4mrxsy";
     fetchSubmodules = true;
   };
 
@@ -40,8 +45,8 @@ let
 
     inherit src;
 
-    nativeBuildInputs = [ makeWrapper pkgconfig vim ];
+    nativeBuildInputs = [ makeWrapper pkgconfig cmake vim which ];
-    buildInputs = [ llvm emscripten openssl libsndfile libmicrohttpd ];
+    buildInputs = [ llvm emscripten openssl libsndfile libmicrohttpd gnutls libtasn1 p11-kit ];
 
 
     passthru = {
@@ -50,39 +55,13 @@ let
 
 
     preConfigure = ''
-      makeFlags="$makeFlags prefix=$out LLVM_CONFIG='${llvm}/bin/llvm-config' world"
+      cd build
-
-      # The faust makefiles use 'system ?= $(shell uname -s)' but nix
-      # defines 'system' env var, so undefine that so faust detects the
-      # correct system.
-      unset system
-      # sed -e "232s/LLVM_STATIC_LIBS/LLVMLIBS/" -i compiler/Makefile.unix
-
-      # The makefile sets LLVM_<version> depending on the current llvm
-      # version, but the detection code is quite brittle.
-      #
-      # Failing to properly detect the llvm version means that the macro
-      # LLVM_VERSION ends up being the raw output of `llvm-config --version`, while
-      # the code assumes that it's set to a symbol like `LLVM_35`.  Two problems result:
-      # * <command-line>:0:1: error: macro names must be identifiers.; and
-      # * a bunch of undefined reference errors due to conditional definitions relying on
-      #   LLVM_XY being defined.
-      #
-      # For now, fix this by 1) pinning the llvm version; 2) manually setting LLVM_VERSION
-      # to something the makefile will recognize.
-      sed '52iLLVM_VERSION=${stdenv.lib.getVersion llvm}' -i compiler/Makefile.unix
     '';
 
-    postPatch = ''
+    cmakeFlags = ''
-      # fix build with llvm 5.0.2 by adding it to the list of known versions
+      -C ../backends/all.cmake -C  ../targets/all.cmake ..
-      # TODO: check if still needed on next update
-      substituteInPlace compiler/Makefile.unix \
-        --replace "5.0.0 5.0.1" "5.0.0 5.0.1 5.0.2"
     '';
 
-    # Remove most faust2appl scripts since they won't run properly
-    # without additional paths setup. See faust.wrap,
-    # faust.wrapWithBuildEnv.
     postInstall = ''
       # syntax error when eval'd directly
       pattern="faust2!(*@(atomsnippets|graph|graphviewer|md|plot|sig|sigviewer|svg))"
@@ -90,10 +69,6 @@ let
     '';
 
     postFixup = ''
-      # Set faustpath explicitly.
-      substituteInPlace "$out"/bin/faustpath \
-        --replace "/usr/local /usr /opt /opt/local" "$out"
-
       # The 'faustoptflags' is 'source'd into other faust scripts and
       # not used as an executable, so patch 'uname' usage directly
       # rather than use makeWrapper.
@@ -160,8 +135,6 @@ let
         # 'faustoptflags' to absolute paths.
         for script in "$out"/bin/*; do
           substituteInPlace "$script" \
-            --replace ". faustpath" ". '${faust}/bin/faustpath'" \
-            --replace ". faustoptflags" ". '${faust}/bin/faustoptflags'" \
             --replace " error " "echo"
         done
       '';
@@ -200,19 +173,22 @@ let
 
       propagatedBuildInputs = [ faust ] ++ propagatedBuildInputs;
 
+      libPath = stdenv.lib.makeLibraryPath propagatedBuildInputs;
 
       postFixup = ''
 
         # export parts of the build environment
         for script in "$out"/bin/*; do
           wrapProgram "$script" \
+            --set FAUSTLDDIR "${faust}/lib" \
             --set FAUSTLIB "${faust}/share/faust" \
-            --set FAUST_LIB_PATH "${faust}/share/faust" \
             --set FAUSTINC "${faust}/include/faust" \
+            --set FAUSTARCH "${faust}/share/faust" \
             --prefix PATH : "$PATH" \
             --prefix PKG_CONFIG_PATH : "$PKG_CONFIG_PATH" \
             --set NIX_CFLAGS_COMPILE "$NIX_CFLAGS_COMPILE" \
-            --set NIX_LDFLAGS "$NIX_LDFLAGS"
+            --set NIX_LDFLAGS "$NIX_LDFLAGS -lpthread" \
+            --prefix LIBRARY_PATH $libPath
         done
       '';
     });

pkgs/applications/audio/faust/faust2jack.nix

@@ -1,6 +1,7 @@
 { faust
 , gtk2
 , jack2Full
+, alsaLib
 , opencv
 , libsndfile
 }:
@@ -18,6 +19,7 @@ faust.wrapWithBuildEnv {
   propagatedBuildInputs = [
     gtk2
     jack2Full
+    alsaLib
     opencv
     libsndfile
   ];

pkgs/applications/audio/faust/faust2jackrust.nix

@@ -0,0 +1,18 @@
+{ stdenv
+, faust
+, libjack2
+, cargo
+, binutils
+, gcc
+, gnumake
+, openssl
+, pkgconfig
+
+}:
+
+faust.wrapWithBuildEnv {
+
+  baseName = "faust2jackrust";
+
+  propagatedBuildInputs = [ libjack2 cargo binutils gcc gnumake openssl pkgconfig ];
+}

pkgs/applications/audio/google-play-music-desktop-player/default.nix

@@ -1,14 +1,15 @@
-{ stdenv, alsaLib, atk, cairo, cups, dbus, dpkg, expat, fontconfig, freetype
+{ stdenv, alsaLib, atk, at-spi2-atk, cairo, cups, dbus, dpkg, expat, fontconfig, freetype
 , fetchurl, GConf, gdk-pixbuf, glib, gtk2, gtk3, libpulseaudio, makeWrapper, nspr
 , nss, pango, udev, xorg
 }:
 
 let
-  version = "4.6.1";
+  version = "4.7.1";
 
   deps = [
     alsaLib
     atk
+    at-spi2-atk
     cairo
     cups
     dbus
@@ -48,7 +49,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/MarshallOfSound/Google-Play-Music-Desktop-Player-UNOFFICIAL-/releases/download/v${version}/google-play-music-desktop-player_${version}_amd64.deb";
-    sha256 = "0dyn2fxhcri9d9nmcprszs6yg79gsr09bjfzzb1p10yjmi77cj2g";
+    sha256 = "1ljm9c5sv6wa7pa483yq03wq9j1h1jdh8363z5m2imz407yzgm5r";
   };
 
   dontBuild = true;

pkgs/applications/audio/r128gain/default.nix

@@ -0,0 +1,25 @@
+{ lib, python3Packages, ffmpeg }:
+
+python3Packages.buildPythonApplication rec {
+  pname = "r128gain";
+  version = "0.9.3";
+
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "0dx2grryp0lj58bawx1zcq9a6b4ijz9r5qrg8h6nvm92kqlya26i";
+  };
+
+  propagatedBuildInputs = [ ffmpeg ]
+    ++ (with python3Packages; [ crcmod mutagen tqdm ])
+    ;
+
+  doCheck = false; # downloads media files for testing
+
+  meta = with lib; {
+    description = "Fast audio loudness scanner & tagger (ReplayGain v2 / R128)";
+    homepage = "https://github.com/desbma/r128gain";
+    license = licenses.lgpl2Plus;
+    maintainers = [ maintainers.AluisioASG ];
+    platforms = platforms.all;
+  };
+}

pkgs/applications/audio/redoflacs/default.nix

@@ -1,39 +1,49 @@
-{ stdenv, fetchFromGitHub, makeWrapper
+{ stdenv
-, flac, sox }:
+, lib
+, fetchFromGitHub
+, makeWrapper
+, installShellFiles
+, flac
+, sox
+, withAucdtect ? false
+, aucdtect ? null
+}:
 
 stdenv.mkDerivation rec {
   pname = "redoflacs";
-  version = "0.30.20150202";
+  version = "0.30.20190903";
 
   src = fetchFromGitHub {
-    owner  = "sirjaren";
+    owner = "sirjaren";
-    repo   = "redoflacs";
+    repo = "redoflacs";
-    rev    = "86c6f5becca0909dcb2a0cb9ed747a575d7a4735";
+    rev = "4ca544cbc075d0865884906208cb2b8bc318cf9e";
-    sha256 = "1gzlmh4vnf2fl0x8ig2n1f76082ngldsv85i27dv15y2m1kffw2j";
+    sha256 = "19lcl09d4ngz2zzwd8dnnxx41ddvznhar6ggrlf1xvkr5gd7lafp";
   };
 
   dontBuild = true;
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ installShellFiles makeWrapper ];
 
   installPhase = ''
     runHook preInstall
 
     install -Dm755 -t $out/bin redoflacs
     install -Dm644 -t $out/share/doc/redoflacs LICENSE *.md
+    installManPage redoflacs.1
 
     runHook postInstall
   '';
 
   postFixup = ''
     wrapProgram $out/bin/redoflacs \
-      --prefix PATH : ${stdenv.lib.makeBinPath [ flac sox ]}
+      --prefix PATH : ${stdenv.lib.makeBinPath ([ flac sox ] ++ lib.optional withAucdtect aucdtect)}
   '';
 
-  meta = with stdenv.lib; {
+  meta = with lib; {
     description = "Parallel BASH commandline FLAC compressor, verifier, organizer, analyzer, and retagger";
-    homepage    = src.meta.homepage;
+    homepage = src.meta.homepage;
-    license     = licenses.gpl2;
+    license = licenses.gpl2;
-    platforms   = platforms.all;
+    maintainers = with maintainers; [ peterhoeg ];
+    platforms = platforms.all;
   };
 }

pkgs/applications/audio/snd/default.nix

@@ -4,11 +4,11 @@
 }:
 
 stdenv.mkDerivation rec {
-  name = "snd-19.9";
+  name = "snd-20.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/snd/${name}.tar.gz";
-    sha256 = "13s8fahpsjygjdrcwmprcrz23ny3klaj2rh2xzdv3bfs69gxvhys";
+    sha256 = "195j0mkxvkb0znwhc0pjp4r0r8j4i12i27nxbkq27wg9rck6likc";
   };
 
   nativeBuildInputs = [ pkgconfig ];

pkgs/applications/blockchains/exodus/default.nix

@@ -1,29 +1,30 @@
 { stdenv, lib, fetchurl, unzip, glib, systemd, nss, nspr, gtk3-x11, gnome2,
 atk, cairo, gdk-pixbuf, xorg, xorg_sys_opengl, utillinux, alsaLib, dbus, at-spi2-atk,
-cups, vivaldi-ffmpeg-codecs, libpulseaudio }:
+cups, vivaldi-ffmpeg-codecs, libpulseaudio, at-spi2-core }:
 
 stdenv.mkDerivation rec {
   pname = "exodus";
-  version = "19.5.24";
+  version = "20.1.30";
 
   src = fetchurl {
-    url = "https://exodusbin.azureedge.net/releases/${pname}-linux-x64-${version}.zip";
+    url = "https://downloads.exodus.io/releases/${pname}-linux-x64-${version}.zip";
-    sha256 = "1yx296i525qmpqh8f2vax7igffg826nr8cyq1l0if35374bdsqdw";
+    sha256 = "0jns5zqjm0gqn18ypghbgk6gb713mh7p44ax1r8y4vcwijlp5nql";
   };
 
   sourceRoot = ".";
   unpackCmd = ''
-			${unzip}/bin/unzip "$src" -x "Exodus*/lib*so"
+      ${unzip}/bin/unzip "$src" -x "Exodus*/lib*so"
   '';
 
   installPhase = ''
-		mkdir -p $out/bin $out/share/applications
+    mkdir -p $out/bin $out/share/applications
-		cd Exodus-linux-x64
+    cd Exodus-linux-x64
-		cp -r . $out
+    cp -r . $out
-		ln -s $out/Exodus $out/bin/Exodus
+    ln -s $out/Exodus $out/bin/Exodus
-		ln -s $out/exodus.desktop $out/share/applications
+    ln -s $out/bin/Exodus $out/bin/exodus
-		substituteInPlace $out/share/applications/exodus.desktop \
+    ln -s $out/exodus.desktop $out/share/applications
-				  --replace 'Exec=bash -c "cd `dirname %k` && ./Exodus"' "Exec=Exodus"
+    substituteInPlace $out/share/applications/exodus.desktop \
+          --replace 'Exec=bash -c "cd `dirname %k` && ./Exodus"' "Exec=Exodus"
   '';
 
   dontPatchELF = true;
@@ -31,35 +32,36 @@ stdenv.mkDerivation rec {
 
   preFixup = let
     libPath = lib.makeLibraryPath [
-			glib
+      glib
-			nss
+      nss
-			nspr
+      nspr
-			gtk3-x11
+      gtk3-x11
-			gnome2.pango
+      gnome2.pango
-			atk
+      atk
-			cairo
+      cairo
-			gdk-pixbuf
+      gdk-pixbuf
-			xorg.libX11
+      xorg.libX11
-			xorg.libxcb
+      xorg.libxcb
-			xorg.libXcomposite
+      xorg.libXcomposite
-			xorg.libXcursor
+      xorg.libXcursor
-			xorg.libXdamage
+      xorg.libXdamage
-			xorg.libXext
+      xorg.libXext
-			xorg.libXfixes
+      xorg.libXfixes
-			xorg.libXi
+      xorg.libXi
-			xorg.libXrender
+      xorg.libXrender
-			xorg.libXtst
+      xorg.libXtst
-			xorg_sys_opengl
+      xorg_sys_opengl
-			utillinux
+      utillinux
-			xorg.libXrandr
+      xorg.libXrandr
-			xorg.libXScrnSaver
+      xorg.libXScrnSaver
-			alsaLib
+      alsaLib
-			dbus.lib
+      dbus.lib
-			at-spi2-atk
+      at-spi2-atk
-			cups.lib
+      at-spi2-core
-			libpulseaudio
+      cups.lib
-			systemd
+      libpulseaudio
-			vivaldi-ffmpeg-codecs
+      systemd
+      vivaldi-ffmpeg-codecs
     ];
   in ''
     patchelf \

pkgs/applications/editors/manuskript/default.nix

@@ -2,7 +2,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "manuskript";
-  version = "0.10.0";
+  version = "0.11.0";
 
   format = "other";
 
@@ -10,7 +10,7 @@ python3Packages.buildPythonApplication rec {
     repo = pname;
     owner = "olivierkes";
     rev = version;
-    sha256 = "0q413vym7hzjpyg3krj5y63hwpncdifjkyswqmr76zg5yqnklnh3";
+    sha256 = "1l6l9k6k69yv8xqpll0zv9cwdqqg4zvxy90l6sx5nv2yywh5crla";
   };
 
   nativeBuildInputs = [ wrapQtAppsHook ];

pkgs/applications/editors/vscode/vscodium.nix

@@ -11,8 +11,8 @@ let
   archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0n4wcg072a0b76jjv08cig2kygkmakvwav5vvl0h6ww9sbdcwl1x";
+    x86_64-linux = "0f6ic24w6s9wfirzk5rvysn96gj1naj6b81al9743mllaf32ad5q";
-    x86_64-darwin = "0xvyh9qypsyzw02vpmnfa0hdszj8ylvf78yjbmg86m4xml0sbj9r";
+    x86_64-darwin = "0fgyhb2wxkvrc90zzw5w2k3ggwbinmax286gbff3sjlrzbs5sj64";
   }.${system};
 
   sourceRoot = {
@@ -25,7 +25,7 @@ in
     # The update script doesn't correctly change the hash for darwin, so please:
     # nixpkgs-update: no auto update
 
-    version = "1.41.1";
+    version = "1.42.0";
     pname = "vscodium";
 
     executableName = "codium";

pkgs/applications/gis/saga/default.nix

@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation {
   pname = "saga";
-  version = "7.3.0";
+  version = "7.5.0";
 
   # See https://groups.google.com/forum/#!topic/nix-devel/h_vSzEJAPXs
   # for why the have additional buildInputs on darwin
@@ -18,8 +18,8 @@ stdenv.mkDerivation {
   CXXFLAGS = stdenv.lib.optionalString stdenv.cc.isClang "-std=c++11 -Wno-narrowing";
 
   src = fetchurl {
-    url = "https://sourceforge.net/projects/saga-gis/files/SAGA%20-%207/SAGA%20-%207.3.0/saga-7.3.0.tar.gz";
+    url = "https://sourceforge.net/projects/saga-gis/files/SAGA%20-%207/SAGA%20-%207.5.0/saga-7.5.0.tar.gz";
-    sha256 = "1g7v6vx7b8mfhbbg03pdk4kyks20maqbcdbasnxazhs8pl2zih7k";
+    sha256 = "0s5195802xwlkb2w4i4vd9ys95d7fnzn5cnnixh1csaqc2x1qp6r";
   };
 
   meta = with stdenv.lib; {

pkgs/applications/graphics/c3d/default.nix

@@ -1,17 +1,17 @@
-{ stdenv, fetchgit, cmake, itk, Cocoa }:
+{ stdenv, fetchgit, cmake, itk4, Cocoa }:
 
 stdenv.mkDerivation {
   pname   = "c3d";
-  version = "2018-10-04";
+  version = "unstable-2019-10-22";
 
   src = fetchgit {
-    url = "https://git.code.sf.net/p/c3d/git";
+    url    = "https://github.com/pyushkevich/c3d";
-    rev = "351929a582b2ef68fb9902df0b11d38f44a0ccd0";
+    rev    = "c04e2b84568654665c64d8843378c8bbd58ba9b0";
-    sha256 = "0mpv4yl6hdnxgvnwrmd182h64n3ppp30ldzm0jz6jglk0nvpzq9w";
+    sha256 = "0lzldxvshl9q362mg76byc7s5zc9qx7mxf2wgyij5vysx8mihx3q";
   };
 
   nativeBuildInputs = [ cmake ];
-  buildInputs = [ itk ]
+  buildInputs = [ itk4 ]
     ++ stdenv.lib.optional stdenv.isDarwin Cocoa;
 
   meta = with stdenv.lib; {
@@ -20,6 +20,5 @@ stdenv.mkDerivation {
     maintainers = with maintainers; [ bcdarwin ];
     platforms = platforms.unix;
     license = licenses.gpl2;
-    broken = true;
   };
 }

pkgs/applications/graphics/drawpile/default.nix

@@ -60,11 +60,11 @@ let
 
 in mkDerivation rec {
   pname = "drawpile";
-  version = "2.1.15";
+  version = "2.1.16";
 
   src = fetchurl {
     url = "https://drawpile.net/files/src/drawpile-${version}.tar.gz";
-    sha256 = "0w6bdg1rnnjzjg8xzqv3a9qhw41q41sjvp6f8m0sqxjfax05lqin";
+    sha256 = "1mz64c1a5x906j2jqq7i16l1q1d97wgm2y0ybmmcyqzg09x9wyaw";
   };
 
   nativeBuildInputs = [

pkgs/applications/graphics/sane/config.nix

@@ -6,7 +6,7 @@ with stdenv.lib;
 let installSanePath = path: ''
       if [ -e "${path}/lib/sane" ]; then
         find "${path}/lib/sane" -maxdepth 1 -not -type d | while read backend; do
-          ln -s "$backend" "$out/lib/sane/$(basename "$backend")"
+          symlink "$backend" "$out/lib/sane/$(basename "$backend")"
         done
       fi
 
@@ -16,14 +16,14 @@ let installSanePath = path: ''
           if [ "$name" = "dll.conf" ] || [ "$name" = "saned.conf" ] || [ "$name" = "net.conf" ]; then
             cat "$conf" >> "$out/etc/sane.d/$name"
           else
-            ln -s "$conf" "$out/etc/sane.d/$name"
+            symlink "$conf" "$out/etc/sane.d/$name"
           fi
         done
       fi
 
       if [ -e "${path}/etc/sane.d/dll.d" ]; then
         find "${path}/etc/sane.d/dll.d" -maxdepth 1 -not -type d | while read conf; do
-          ln -s "$conf" "$out/etc/sane.d/dll.d/$(basename $conf)"
+          symlink "$conf" "$out/etc/sane.d/dll.d/$(basename $conf)"
         done
       fi
     '';
@@ -33,6 +33,14 @@ stdenv.mkDerivation {
   phases = "installPhase";
 
   installPhase = ''
+    function symlink () {
+      local target=$1 linkname=$2
+      if [ -e "$linkname" ]; then
+        echo "warning: conflict for $linkname. Overriding $(readlink $linkname) with $target."
+      fi
+      ln -sfn "$target" "$linkname"
+    }
+
     mkdir -p $out/etc/sane.d $out/etc/sane.d/dll.d $out/lib/sane
   '' + concatMapStrings installSanePath paths;
 }

pkgs/applications/misc/far2l/default.nix

@@ -1,10 +1,17 @@
 { stdenv, fetchFromGitHub, fetchpatch, makeWrapper, cmake, pkgconfig, wxGTK30, glib, pcre, m4, bash,
   xdg_utils, gvfs, zip, unzip, gzip, bzip2, gnutar, p7zip, xz, imagemagick, darwin }:
 
-with stdenv.lib;
+let
+  newer-colorer-schemes = fetchFromGitHub {
+    owner = "colorer";
+    repo = "Colorer-schemes";
+    rev = "7c831f5e94a90530ace8b2bb9916210e3a2fcda6"; # 2019-11-28 (far2l has older Colorer-schemes)
+    sha256 = "18vaahdz5i7xdf00c9h9kjjswm4jszywm8zkhva4c4ivr4qqnv2c";
+  };
+in
 stdenv.mkDerivation rec {
-  build = "unstable-2018-07-19.git${builtins.substring 0 7 src.rev}";
+  pname = "far2l";
-  name = "far2l-2.1.${build}";
+  version = "2019-12-14.git${builtins.substring 0 7 src.rev}";
 
   src = fetchFromGitHub {
     owner = "elfmz";
@@ -16,16 +23,16 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkgconfig m4 makeWrapper imagemagick ];
 
   buildInputs = [ wxGTK30 glib pcre ]
-    ++ optional stdenv.isDarwin darwin.apple_sdk.frameworks.Cocoa;
+    ++ stdenv.lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Cocoa;
 
-  postPatch = optionalString stdenv.isLinux ''
+  postPatch = stdenv.lib.optionalString stdenv.isLinux ''
     substituteInPlace far2l/bootstrap/trash.sh \
       --replace 'gvfs-trash'  '${gvfs}/bin/gvfs-trash'
-  '' + optionalString stdenv.isDarwin ''
+  '' + stdenv.lib.optionalString stdenv.isDarwin ''
     substituteInPlace far2l/CMakeLists.txt \
       --replace "-framework System" -lSystem
   '' + ''
-    echo 'echo ${build}' > far2l/bootstrap/scripts/vbuild.sh
+    echo 'echo ${version}' > far2l/bootstrap/scripts/vbuild.sh
     substituteInPlace far2l/bootstrap/open.sh              \
       --replace 'xdg-open'    '${xdg_utils}/bin/xdg-open'
     substituteInPlace far2l/vtcompletor.cpp                \
@@ -42,14 +49,9 @@ stdenv.mkDerivation rec {
       --replace '"bzip2 '     '"${bzip2}/bin/bzip2 '       \
       --replace '"tar '       '"${gnutar}/bin/tar '
 
-    ( cd colorer/configs/base
+    cp ${newer-colorer-schemes}/hrc/hrc/base/nix.hrc     colorer/configs/base/hrc/base/
-      patch -p2 <  ${ fetchpatch {
+    cp ${newer-colorer-schemes}/hrc/hrc/base/cpp.hrc     colorer/configs/base/hrc/base/
-                        name   = "nix-language-highlighting.patch";
+    cp ${newer-colorer-schemes}/hrc/hrc/inet/jscript.hrc colorer/configs/base/hrc/base/
-                        url    = https://github.com/colorer/Colorer-schemes/commit/64bd06de0a63224b431cd8fc42cd9fa84b8ba7c0.patch;
-                        sha256 = "1mrj1wyxmk7sll9j1jzw6miwi0sfavf654klms24wngnh6hadsch";
-                      }
-                    }
-    )
   '';
 
   installPhase = ''
@@ -59,7 +61,8 @@ stdenv.mkDerivation rec {
     ln -s -r --force $out/bin/far2l $out/share/far2l/far2l_askpass
     ln -s -r --force $out/bin/far2l $out/share/far2l/far2l_sudoapp
 
-    sed "s,/usr/bin/,$out/bin/," ../far2l/DE/far2l.desktop > $out/share/applications/far2l.desktop
+    cp ../far2l/DE/far2l.desktop $out/share/applications/far2l.desktop
+    substituteInPlace $out/share/applications/far2l.desktop --replace \''${CMAKE_INSTALL_PREFIX} "$out"
 
     cp ../far2l/DE/icons/hicolor/1024x1024/apps/far2l.svg $out/share/icons/hicolor/scalable/apps/
     convert -size 128x128 ../far2l/DE/icons/far2l.svg $out/share/icons/far2l.png
@@ -75,7 +78,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = {
+  meta = with stdenv.lib; {
     description = "An orthodox file manager";
     homepage = https://github.com/elfmz/far2l;
     license = licenses.gpl2;

pkgs/applications/misc/jgmenu/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jgmenu";
-  version = "4.0";
+  version = "4.0.2";
 
   src = fetchFromGitHub {
     owner = "johanmalm";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1s9291y38k4adc2wqj7plfhj431nf36zs262jm6mmb2fs910ncgv";
+    sha256 = "086p91l1igx5mv2i6fwbgx5p72war9aavc7v3m7sd0c0xvb334br";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/kanboard/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "kanboard";
-  version = "1.2.12";
+  version = "1.2.13";
 
   src = fetchFromGitHub {
     owner = "kanboard";
     repo = "kanboard";
     rev = "v${version}";
-    sha256 = "1m1drgbyk1m6mf69xqlz9gqcj650n9m4y2fdj7d2yv20q8r31489";
+    sha256 = "0mm5sx323v1rwykd1dhvk4d3ipgvgvi3wvhrlavbja3lgay3mdwk";
   };
 
   dontBuild = true;
@@ -22,6 +22,6 @@ stdenv.mkDerivation rec {
     description = "Kanban project management software";
     homepage = https://kanboard.net;
     license = licenses.mit;
-    maintainers = with maintainers; [ fpletz ];
+    maintainers = with maintainers; [ fpletz lheckemann ];
   };
 }

pkgs/applications/misc/lsd2dsl/default.nix

@@ -1,26 +1,29 @@
-{ mkDerivation, lib, fetchFromGitHub, cmake
+{ stdenv, mkDerivation, lib, fetchFromGitHub, cmake
-, boost, libvorbis, libsndfile, minizip, gtest }:
+, boost, libvorbis, libsndfile, minizip, gtest, qtwebkit }:
 
 mkDerivation rec {
   pname = "lsd2dsl";
-  version = "0.4.1";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "nongeneric";
     repo = pname;
     rev = "v${version}";
-    sha256 = "15xjp5xxvl0qc4zp553n7djrbvdp63sfjw406idgxqinfmkqkqdr";
+    sha256 = "100qd9i0x6r0nkw1ic2p0xjr16jlhinxkn1x7i98s4xmw4wyb8n8";
   };
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ boost libvorbis libsndfile minizip gtest ];
+  buildInputs = [ boost libvorbis libsndfile minizip gtest qtwebkit ];
 
-  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result";
+  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=missing-braces";
 
   installPhase = ''
-    install -Dm755 lsd2dsl $out/bin/lsd2dsl
+    install -Dm755 console/lsd2dsl $out/bin/lsd2dsl
-    install -m755 qtgui/lsd2dsl-qtgui $out/bin/lsd2dsl-qtgui
+    install -m755 gui/lsd2dsl-qtgui $out/bin/lsd2dsl-qtgui
+  '' + lib.optionalString stdenv.isDarwin ''
+    wrapQtApp $out/bin/lsd2dsl
+    wrapQtApp $out/bin/lsd2dsl-qtgui
   '';
 
   meta = with lib; {
@@ -31,6 +34,6 @@ mkDerivation rec {
     '';
     license = licenses.mit;
     maintainers = with maintainers; [ sikmir ];
-    platforms = with platforms; linux;
+    platforms = with platforms; linux ++ darwin;
   };
 }

pkgs/applications/misc/rxvt-unicode-plugins/default.nix

@@ -0,0 +1,22 @@
+{ callPackage }:
+
+{
+  autocomplete-all-the-things = callPackage ./urxvt-autocomplete-all-the-things { };
+
+  bidi = callPackage ./urxvt-bidi { };
+
+  font-size = callPackage ./urxvt-font-size { };
+
+  perl = callPackage ./urxvt-perl { };
+
+  perls = callPackage ./urxvt-perls { };
+
+  resize-font = callPackage ./urxvt-resize-font { };
+
+  tabbedex = callPackage ./urxvt-tabbedex { };
+
+  theme-switch = callPackage ./urxvt-theme-switch { };
+
+  vtwheel = callPackage ./urxvt-vtwheel { };
+
+}

pkgs/applications/misc/rxvt-unicode-plugins/urxvt-bidi/default.nix

@@ -16,6 +16,8 @@ perlPackages.buildPerlPackage rec {
     install -Dm555 misc/bidi "$out/lib/urxvt/perl/bidi"
   '';
 
+  passthru.perlPackages = [ "self" ];
+
   meta = with lib; {
     description = "Text::Bidi Perl package using fribidi, providing a urxvt plugin";
     homepage = "https://github.com/mkamensky/Text-Bidi";

pkgs/applications/misc/rxvt-unicode-plugins/urxvt-resize-font/default.nix

@@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation {
+  pname = "urxvt-resize-font";
+  version = "2019-10-05";
+  dontPatchShebangs = true;
+
+  src = fetchFromGitHub {
+    owner = "simmel";
+    repo = "urxvt-resize-font";
+    rev = "e966a5d77264e9263bfc8a51e160fad24055776b";
+    sha256 = "18ab3bsfdkzzh1n9fpi2al5bksvv2b7fjmvxpx6fzqcy4bc64vkh";
+  };
+
+  installPhase = ''
+    mkdir -p $out/lib/urxvt/perl
+    cp resize-font $out/lib/urxvt/perl
+  '';
+
+  meta = with stdenv.lib; {
+    description = "URxvt Perl extension for resizing the font";
+    homepage = "https://github.com/simmel/urxvt-resize-font";
+    license = licenses.mit;
+    maintainers = with maintainers; [ rnhmjoj ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/misc/rxvt-unicode/default.nix

@@ -0,0 +1,88 @@
+{ stdenv, fetchurl, makeDesktopItem
+, libX11, libXt, libXft, libXrender
+, ncurses, fontconfig, freetype
+, pkgconfig, gdk-pixbuf, perl
+, perlSupport      ? true
+, gdkPixbufSupport ? true
+, unicode3Support  ? true
+}:
+
+let
+  pname = "rxvt-unicode";
+  version = "9.22";
+  description = "A clone of the well-known terminal emulator rxvt";
+
+  desktopItem = makeDesktopItem {
+    name = pname;
+    exec = "urxvt";
+    icon = "utilities-terminal";
+    comment = description;
+    desktopName = "URxvt";
+    genericName = pname;
+    categories = "System;TerminalEmulator;";
+  };
+in
+
+with stdenv.lib;
+
+stdenv.mkDerivation {
+  name = "${pname}-unwrapped-${version}";
+  inherit pname version;
+
+  src = fetchurl {
+    url = "http://dist.schmorp.de/rxvt-unicode/Attic/rxvt-unicode-${version}.tar.bz2";
+    sha256 = "1pddjn5ynblwfrdmskylrsxb9vfnk3w4jdnq2l8xn2pspkljhip9";
+  };
+
+  buildInputs =
+    [ libX11 libXt libXft ncurses  # required to build the terminfo file
+      fontconfig freetype pkgconfig libXrender
+    ] ++ optional perlSupport perl
+      ++ optional gdkPixbufSupport gdk-pixbuf;
+
+  outputs = [ "out" "terminfo" ];
+
+  patches = [
+    ./patches/9.06-font-width.patch
+    ./patches/256-color-resources.patch
+  ] ++ optional stdenv.isDarwin ./patches/makefile-phony.patch;
+
+
+  configureFlags = [
+    "--with-terminfo=$terminfo/share/terminfo"
+    "--enable-256-color"
+    (enableFeature perlSupport "perl")
+    (enableFeature unicode3Support "unicode3")
+  ];
+
+  LDFLAGS = [ "-lfontconfig" "-lXrender" "-lpthread" ];
+  CFLAGS = [ "-I${freetype.dev}/include/freetype2" ];
+
+  preConfigure =
+    ''
+      # without this the terminfo won't be compiled by tic, see man tic
+      mkdir -p $terminfo/share/terminfo
+      export TERMINFO=$terminfo/share/terminfo
+    ''
+    + stdenv.lib.optionalString perlSupport ''
+      # make urxvt find its perl file lib/perl5/site_perl
+      # is added to PERL5LIB automatically
+      mkdir -p $out/$(dirname ${perl.libPrefix})
+      ln -s $out/lib/urxvt $out/${perl.libPrefix}
+    '';
+
+  postInstall = ''
+    mkdir -p $out/nix-support
+    echo "$terminfo" >> $out/nix-support/propagated-user-env-packages
+    cp -r ${desktopItem}/share/applications/ $out/share/
+  '';
+
+  meta = {
+    inherit description;
+    homepage = "http://software.schmorp.de/pkg/rxvt-unicode.html";
+    downloadPage = "http://dist.schmorp.de/rxvt-unicode/Attic/";
+    maintainers = with maintainers; [ rnhmjoj ];
+    platforms = platforms.unix;
+    license = licenses.gpl3;
+  };
+}

pkgs/applications/misc/rxvt-unicode/wrapper.nix

@@ -0,0 +1,58 @@
+{ callPackage
+, symlinkJoin
+, makeWrapper
+, lib
+, rxvt-unicode-unwrapped
+, rxvt-unicode-plugins
+, perlPackages
+, configure ? { availablePlugins, ... }:
+  { plugins = builtins.attrValues availablePlugins;
+    extraDeps = [ ];
+    perlDeps = [ ];
+  }
+}:
+
+let
+  availablePlugins = rxvt-unicode-plugins;
+
+  # Transform the string "self" to the plugin itself.
+  # It's needed for plugins like bidi who depends on the perl
+  # package they provide themself.
+  mkPerlDeps = p:
+    let deps = p.perlPackages or [ ];
+    in map (x: if x == "self" then p else x) deps;
+
+  # The wrapper is called with a `configure` function
+  # that takes the urxvt plugins as input and produce
+  # the configuration of the wrapper: list of plugins,
+  # extra dependencies and perl dependencies.
+  # This provides simple way to customize urxvt using
+  # the `.override` mechanism.
+  wrapper = { configure, ... }:
+    let 
+      config = configure { inherit availablePlugins; };
+      plugins = config.plugins or (builtins.attrValues availablePlugins);
+      extraDeps = config.extraDeps or [ ];
+      perlDeps = (config.perlDeps or [ ]) ++ lib.concatMap mkPerlDeps plugins;
+    in
+      symlinkJoin {
+        name = "rxvt-unicode-${rxvt-unicode-unwrapped.version}";
+
+        paths = [ rxvt-unicode-unwrapped ] ++ plugins ++ extraDeps;
+
+        buildInputs = [ makeWrapper ];
+
+        postBuild = ''
+          wrapProgram $out/bin/urxvt \
+            --prefix PERL5LIB : "${perlPackages.makePerlPath perlDeps}" \
+            --suffix-each URXVT_PERL_LIB ':' "$out/lib/urxvt/perl"
+          wrapProgram $out/bin/urxvtd \
+            --prefix PERL5LIB : "${perlPackages.makePerlPath perlDeps}" \
+            --suffix-each URXVT_PERL_LIB ':' "$out/lib/urxvt/perl"
+        '';
+
+        passthru.plugins = plugins;
+      };
+
+in
+  lib.makeOverridable wrapper { inherit configure; }

pkgs/applications/misc/rxvt_unicode/default.nix

@@ -1,72 +0,0 @@
-{ stdenv, fetchurl, makeDesktopItem, perlSupport ? true, libX11, libXt, libXft,
-  ncurses, perl, fontconfig, freetype, pkgconfig, libXrender,
-  gdkPixbufSupport ? true, gdk-pixbuf, unicode3Support ? true }:
-
-let
-  pname = "rxvt-unicode";
-  version = "9.22";
-  description = "A clone of the well-known terminal emulator rxvt";
-
-  desktopItem = makeDesktopItem {
-    name = pname;
-    exec = "urxvt";
-    icon = "utilities-terminal";
-    comment = description;
-    desktopName = "URxvt";
-    genericName = pname;
-    categories = "System;TerminalEmulator;";
-  };
-in
-
-stdenv.mkDerivation ({
-
-  name = "${pname}${if perlSupport then "-with-perl" else ""}${if unicode3Support then "-with-unicode3" else ""}-${version}";
-
-  src = fetchurl {
-    url = "http://dist.schmorp.de/rxvt-unicode/Attic/rxvt-unicode-${version}.tar.bz2";
-    sha256 = "1pddjn5ynblwfrdmskylrsxb9vfnk3w4jdnq2l8xn2pspkljhip9";
-  };
-
-  buildInputs =
-    [ libX11 libXt libXft ncurses /* required to build the terminfo file */
-      fontconfig freetype pkgconfig libXrender ]
-    ++ stdenv.lib.optional perlSupport perl
-    ++ stdenv.lib.optional gdkPixbufSupport gdk-pixbuf;
-
-  outputs = [ "out" "terminfo" ];
-
-  patches = [
-    ./rxvt-unicode-9.06-font-width.patch
-    ./rxvt-unicode-256-color-resources.patch
-  ]
-  ++ stdenv.lib.optional stdenv.isDarwin ./rxvt-unicode-makefile-phony.patch;
-
-  preConfigure =
-    ''
-      mkdir -p $terminfo/share/terminfo
-      configureFlags="--with-terminfo=$terminfo/share/terminfo --enable-256-color ${if perlSupport then "--enable-perl" else "--disable-perl"} ${if unicode3Support then "--enable-unicode3" else "--disable-unicode3"}";
-      export TERMINFO=$terminfo/share/terminfo # without this the terminfo won't be compiled by tic, see man tic
-      NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${freetype.dev}/include/freetype2"
-      NIX_LDFLAGS="$NIX_LDFLAGS -lfontconfig -lXrender -lpthread "
-    ''
-    # make urxvt find its perl file lib/perl5/site_perl is added to PERL5LIB automatically
-    + stdenv.lib.optionalString perlSupport ''
-      mkdir -p $out/$(dirname ${perl.libPrefix})
-      ln -s $out/lib/urxvt $out/${perl.libPrefix}
-    '';
-
-  postInstall = ''
-    mkdir -p $out/nix-support
-    echo "$terminfo" >> $out/nix-support/propagated-user-env-packages
-    cp -r ${desktopItem}/share/applications/ $out/share/
-  '';
-
-  meta = with stdenv.lib; {
-    inherit description;
-    homepage = http://software.schmorp.de/pkg/rxvt-unicode.html;
-    downloadPage = "http://dist.schmorp.de/rxvt-unicode/Attic/";
-    maintainers = with maintainers; [ rnhmjoj ];
-    platforms = platforms.unix;
-    license = licenses.gpl3;
-  };
-})

pkgs/applications/misc/rxvt_unicode/wrapper.nix

@@ -1,23 +0,0 @@
-{ symlinkJoin, rxvt_unicode, makeWrapper, plugins, perlPackages, perlDeps ? []}:
-
-let
-  rxvt_name = builtins.parseDrvName rxvt_unicode.name;
-
-in symlinkJoin {
-  name = "${rxvt_name.name}-with-plugins-${rxvt_name.version}";
-
-  paths = [ rxvt_unicode ] ++ plugins;
-
-  buildInputs = [ makeWrapper ];
-
-  postBuild = ''
-    wrapProgram $out/bin/urxvt \
-      --prefix PERL5LIB : "${perlPackages.makePerlPath perlDeps}" \
-      --suffix-each URXVT_PERL_LIB ':' "$out/lib/urxvt/perl"
-    wrapProgram $out/bin/urxvtd \
-      --prefix PERL5LIB : "${perlPackages.makePerlPath perlDeps}" \
-      --suffix-each URXVT_PERL_LIB ':' "$out/lib/urxvt/perl"
-  '';
-
-  passthru.plugins = plugins;
-}

pkgs/applications/misc/tippecanoe/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tippecanoe";
-  version = "1.34.3";
+  version = "1.35.0";
 
   src = fetchFromGitHub {
     owner = "mapbox";
     repo = pname;
     rev = version;
-    sha256 = "08pkxzwp4w5phrk9b0vszxnx8yymp50v0bcw96pz8qwk48z4xm0i";
+    sha256 = "0v5ycc3gsqnl9pps3m45yrnb1gvw5pk6jdyr0q6516b4ac6x67m5";
   };
 
   buildInputs = [ sqlite zlib ];
@@ -21,9 +21,9 @@ stdenv.mkDerivation rec {
 
   meta = with stdenv.lib; {
     description = "Build vector tilesets from large collections of GeoJSON features";
-    homepage = https://github.com/mapbox/tippecanoe;
+    homepage = "https://github.com/mapbox/tippecanoe";
     license = licenses.bsd2;
     maintainers = with maintainers; [ sikmir ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = with platforms; linux ++ darwin;
   };
 }

pkgs/applications/networking/cloudflared/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2019.12.0";
+  version = "2020.2.0";
 
   src = fetchFromGitHub {
     owner  = "cloudflare";
     repo   = "cloudflared";
     rev    = version;
-    sha256 = "0cc78bysp7z76h4ddiwbsrygz4m4r71f8xylg99pc5qyg8p3my4p";
+    sha256 = "1fzndqkmfpx15fllxqxbh7n4m13ydlp50dvkdh8n384j09ndmx4r";
   };
 
   modSha256 = "1y5vh8g967rrm9b9hjlr70bs2rm09cpik673brgk3nzqxka10w7p";
@@ -17,7 +17,7 @@ buildGoModule rec {
 
   meta = with stdenv.lib; {
     description = "CloudFlare Argo Tunnel daemon (and DNS-over-HTTPS client)";
-    homepage    = https://www.cloudflare.com/products/argo-tunnel;
+    homepage    = "https://www.cloudflare.com/products/argo-tunnel";
     license     = licenses.unfree;
     platforms   = platforms.unix;
     maintainers = [ maintainers.thoughtpolice maintainers.enorris ];

pkgs/applications/networking/cluster/mesos/fetch-mesos-deps.sh

@@ -4,7 +4,7 @@ header "fetching Apache Mesos maven repo"
 function fetchArtifact {
   repoPath="$1"
   echo "Fetching $repoPath"
-  url="http://repo.maven.apache.org/maven2/$repoPath"
+  url="https://repo.maven.apache.org/maven2/$repoPath"
   mkdir -p $(dirname $out/$repoPath)
   curl --fail --location --insecure --retry 3 --max-redirs 20 "$url" --output "$out/$repoPath"
 }

pkgs/applications/networking/hpmyroom/default.nix

@@ -4,11 +4,11 @@
 }:
 mkDerivation rec {
   pname = "hpmyroom";
-  version = "11.1.0.0508";
+  version = "12.0.0.0220";
 
   src = fetchurl {
     url = "https://www.myroom.hpe.com/downloadfiles/${pname}-${version}.x86_64.rpm";
-    sha256 = "1j7mzvf349yxb42m8syh73gpvil01hy1a2wrr0rdzb2ijfnkxyaa";
+    sha256 = "0gajj2s6l7jj8520agrv2dyisg7hhacbwzqlsp9a0xdxr0v71jhr";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/instant-messengers/dino/default.nix

@@ -2,7 +2,7 @@
 , vala, cmake, ninja, wrapGAppsHook, pkgconfig, gettext
 , gobject-introspection, gnome3, glib, gdk-pixbuf, gtk3, glib-networking
 , xorg, libXdmcp, libxkbcommon
-, libnotify, libsoup, libgee, utillinux, libselinux, libsepol, libpsl, brotli
+, libnotify, libsoup, libgee
 , librsvg, libsignal-protocol-c
 , libgcrypt
 , epoxy
@@ -52,18 +52,12 @@ stdenv.mkDerivation rec {
     pcre
     xorg.libxcb
     xorg.libpthreadstubs
-    xorg.libXtst
     libXdmcp
     libxkbcommon
     epoxy
     at-spi2-core
     dbus
     icu
-    utillinux
-    libselinux
-    libsepol
-    libpsl
-    brotli
     libsignal-protocol-c
     librsvg
   ];

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -23,7 +23,7 @@ let
       else "");
 in stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "1.30.1"; # Please backport all updates to the stable channel.
+  version = "1.31.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -33,7 +33,7 @@ in stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "08l51f1fq9jlnqb4j38lxdfwfbqfzb85zrim57wlgcj8azp2ash6";
+    sha256 = "19vsv7jv30xvfgq1nr3091b6x4agymy9afpy9r9mxzgn0xfb0ap9";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/instant-messengers/twinkle/default.nix

@@ -47,10 +47,16 @@ mkDerivation rec {
   ];
 
   patches = [
-    (fetchurl { # https://github.com/LubosD/twinkle/pull/152 patch for bcg729 1.0.2+
+    # patch for bcg729 1.0.2+
+    (fetchurl { # https://github.com/LubosD/twinkle/pull/152
       url = "https://github.com/LubosD/twinkle/compare/05082ae12051821b1d969e6672d9e4e5afe1bc07...7a6c533cda387652b5b4cb2a867be1a18585890c.patch";
       sha256 = "39fc6cef3e88cfca8db44612b2d082fb618027b0f99509138d3c0d2777a494c2";
     })
+    # patch manual link to not link to old url, which now points to NSFW page
+    (fetchurl { # https://github.com/LubosD/twinkle/commit/05082ae12051821b1d969e6672d9e4e5afe1bc07
+      url = "https://github.com/LubosD/twinkle/commit/05082ae12051821b1d969e6672d9e4e5afe1bc07.diff";
+      sha256 = "1iamragr9wp2vczsnp6n261fpr1ai2nc2abp0228jlar9zafksw0";
+    })
   ];
 
   nativeBuildInputs = [

pkgs/applications/networking/irc/weechat/scripts/weechat-matrix/default.nix

@@ -1,20 +1,34 @@
-{ buildPythonPackage, stdenv, python, fetchFromGitHub,
+{ buildPythonPackage
-  pyopenssl, webcolors, future, atomicwrites,
+, stdenv
-  attrs, Logbook, pygments, cachetools, matrix-nio }:
+, python
+, fetchFromGitHub
+, pyopenssl
+, webcolors
+, future
+, atomicwrites
+, attrs
+, Logbook
+, pygments
+, matrix-nio
+, aiohttp
+, requests
+}:
 
 let
-  matrixUploadPython = python.withPackages (ps: with ps; [
+  scriptPython = python.withPackages (ps: with ps; [
-    magic
+    aiohttp
+    requests
+    python_magic
   ]);
 in buildPythonPackage {
   pname = "weechat-matrix";
-  version = "unstable-2019-11-10";
+  version = "unstable-2020-01-21";
 
   src = fetchFromGitHub {
     owner = "poljar";
     repo = "weechat-matrix";
-    rev = "69ad2a9c03d516c212d3d0700dbb2bfe654f6365";
+    rev = "46640df3e0bfb058e97d8abe723bb88fdf4e5177";
-    sha256 = "1mfbkag5np2lgv6f31nyfnvavyh67jrrx6gxhzb8m99dd43lgs8c";
+    sha256 = "1j3l43j741csfxsp1nsc74y6wj2wm86c45iraf167g6p0sdzcq8z";
   };
 
   propagatedBuildInputs = [
@@ -25,8 +39,9 @@ in buildPythonPackage {
     attrs
     Logbook
     pygments
-    cachetools
     matrix-nio
+    aiohttp
+    requests
   ];
 
   passthru.scripts = [ "matrix.py" ];
@@ -38,10 +53,18 @@ in buildPythonPackage {
     mkdir -p $out/share $out/bin
     cp $src/main.py $out/share/matrix.py
 
-    cp $src/contrib/matrix_upload $out/bin/
+    cp \
+      $src/contrib/matrix_upload \
+      $src/contrib/matrix_decrypt \
+      $src/contrib/matrix_sso_helper \
+      $out/bin/
     substituteInPlace $out/bin/matrix_upload \
-      --replace '/usr/bin/env -S python3 -u' '${matrixUploadPython}/bin/python -u' 
+      --replace '/usr/bin/env -S python3' '${scriptPython}/bin/python'
-  
+    substituteInPlace $out/bin/matrix_sso_helper \
+      --replace '/usr/bin/env -S python3' '${scriptPython}/bin/python'
+    substituteInPlace $out/bin/matrix_decrypt \
+      --replace '/usr/bin/env python3' '${scriptPython}/bin/python'
+   
     mkdir -p $out/${python.sitePackages}
     cp -r $src/matrix $out/${python.sitePackages}/matrix
   '';
@@ -53,6 +76,6 @@ in buildPythonPackage {
     homepage = "https://github.com/poljar/weechat-matrix";
     license = licenses.isc;
     platforms = platforms.linux;
-    maintainers = [ maintainers.tilpner ];
+    maintainers = with maintainers; [ tilpner emily ];
   };
 }

pkgs/applications/office/trilium/default.nix

@@ -19,7 +19,7 @@ let
     maintainers = with maintainers; [ emmanuelrosa dtzWill kampka ];
   };
 
-  version = "0.38.2";
+  version = "0.39.4";
 
 in {
   
@@ -30,7 +30,7 @@ in {
 
     src = fetchurl {
       url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-      sha256 = "10f5zfqcfcjynw04d5xzrfmkbqpk85i4mq7njhkibx2f1m0br2qa";
+      sha256 = "18wrnm13k0gg6aljpf6k7c5zia81zzkqc0sa1pgz0yzczydsfaa9";
     };
   
     # Fetch from source repo, no longer included in release.
@@ -78,7 +78,7 @@ in {
 
     src = fetchurl {
       url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-      sha256 = "1df0cx9gpzk0086lgha0qm1g03l8f4rz7y2xzgpzng5rrxjkgz61";
+      sha256 = "06svdp25031p665pvlxdz10malvhxpczzrg90hpr1zymm6v8van3";
     };
 
     nativeBuildInputs = [

pkgs/applications/science/biology/last/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1045";
+  version = "1047";
 
   src = fetchurl {
     url = "http://last.cbrc.jp/last-${version}.zip";
-    sha256 = "0x2wrm52ca935n3yc486m8yy59ap34w1x9h3csjca3jab5agnjkc";
+    sha256 = "06fj4qfw3dd35y3pky3dnr40v1alf43wjx373rbx1vr3hbgzvgf8";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/applications/science/biology/minc-tools/default.nix

@@ -1,21 +1,28 @@
-{ stdenv, fetchFromGitHub, cmake, makeWrapper, flex, bison, perlPackages, libminc, libjpeg, zlib }:
+{ stdenv, fetchFromGitHub, cmake, makeWrapper, flex, bison, perl, TextFormat,
+  libminc, libjpeg, nifticlib, zlib }:
 
 stdenv.mkDerivation rec {
-  pname = "minc-tools";
+  pname   = "minc-tools";
-  name  = "${pname}-2017-09-11";
+  version = "unstable-2019-12-04";
 
   src = fetchFromGitHub {
     owner  = "BIC-MNI";
     repo   = pname;
-    rev    = "5b7c40425cd4f67a018055cb85c0157ee50a3056";
+    rev    = "d4dddfdb4e4fa0cea389b8fdce51cfc076565d94";
-    sha256 = "0zkcs05svp1gj5h0cdgc0k20c7lrk8m7wg3ks3xc5mkaiannj8g7";
+    sha256 = "1wwdss59qq4hz1jp35qylfswzzv0d37if23al0srnxkkgc5f8zng";
   };
 
+  patches = [ ./fix-netcdf-header.patch ];
+
   nativeBuildInputs = [ cmake flex bison makeWrapper ];
   buildInputs = [ libminc libjpeg zlib ];
-  propagatedBuildInputs = with perlPackages; [ perl TextFormat ];
+  propagatedBuildInputs = [ perl TextFormat ];
 
-  cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/" ];
+  cmakeFlags = [ "-DLIBMINC_DIR=${libminc}/lib/"
+                 "-DZNZ_INCLUDE_DIR=${nifticlib}/include/"
+                 "-DZNZ_LIBRARY=${nifticlib}/lib/libznz.a"
+                 "-DNIFTI_INCLUDE_DIR=${nifticlib}/include/nifti/"
+                 "-DNIFTI_LIBRARY=${nifticlib}/lib/libniftiio.a" ];
 
   postFixup = ''
     for prog in minccomplete minchistory mincpik; do

pkgs/applications/science/biology/minc-tools/fix-netcdf-header.patch

@@ -0,0 +1,12 @@
+diff --git a/progs/mincdump/mincdump.h b/progs/mincdump/mincdump.h
+index 14c95cd..117ab26 100644
+--- a/progs/mincdump/mincdump.h
++++ b/progs/mincdump/mincdump.h
+@@ -3,6 +3,7 @@
+  *   See netcdf/COPYRIGHT file for copying and redistribution conditions.
+  *   $Header: /private-cvsroot/minc/progs/mincdump/mincdump.h,v 1.1 2004-04-27 15:35:15 bert Exp $
+  *********************************************************************/
++#include <netcdf_meta.h>
+ 
+ 
+ /* error checking macro */

pkgs/applications/science/chemistry/marvin/default.nix

@@ -4,12 +4,12 @@ with stdenv.lib;
 
 stdenv.mkDerivation rec {
   pname = "marvin";
-  version = "20.3.0";
+  version = "20.4.0";
 
   src = fetchurl {
     name = "marvin-${version}.deb";
     url = "http://dl.chemaxon.com/marvin/${version}/marvin_linux_${versions.majorMinor version}.deb";
-    sha256 = "1y2vh1n80mrrbxqbhxfag8h4lisarbw8h3labmh3ajrfan7bmhql";
+    sha256 = "12kygxq24in7hbp7shkx1baqig8rwmzvv0d3kc3ld9sj9hb0a2n1";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper ];
@@ -45,4 +45,4 @@ stdenv.mkDerivation rec {
     license = licenses.unfree;
     platforms = platforms.linux;
   };
-}
+}

pkgs/applications/science/electronics/kicad/default.nix

@@ -35,8 +35,8 @@ let
   python = python3;
   wxPython = python3Packages.wxPython_4_0;
 
-  kicad-libraries = callPackages ./libraries.nix versionConfig.libVersion;
+  libraries = callPackages ./libraries.nix versionConfig.libVersion;
-  kicad-base = callPackage ./base.nix {
+  base = callPackage ./base.nix {
     pname = baseName;
     inherit versions stable baseName;
     inherit wxGTK python wxPython;
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
   inherit pname;
   version = versions.${baseName}.kicadVersion.version;
 
-  src = kicad-base;
+  src = base;
   dontUnpack = true;
   dontConfigure = true;
   dontBuild = true;
@@ -61,10 +61,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = optionals (scriptingSupport)
     [ pythonPackages.wrapPython ];
 
-  # wrapGAppsHook added the equivalent to ${kicad-base}/share
+  # wrapGAppsHook added the equivalent to ${base}/share
   # though i noticed no difference without it
   makeWrapperArgs = [
-    "--prefix XDG_DATA_DIRS : ${kicad-base}/share"
+    "--prefix XDG_DATA_DIRS : ${base}/share"
     "--prefix XDG_DATA_DIRS : ${hicolor-icon-theme}/share"
     "--prefix XDG_DATA_DIRS : ${gnome3.defaultIconTheme}/share"
     "--prefix XDG_DATA_DIRS : ${wxGTK.gtk}/share/gsettings-schemas/${wxGTK.gtk.name}"
@@ -73,13 +73,13 @@ stdenv.mkDerivation rec {
     "--prefix XDG_DATA_DIRS : ${cups}/share"
     "--prefix GIO_EXTRA_MODULES : ${gnome3.dconf}/lib/gio/modules"
 
-    "--set KISYSMOD ${kicad-libraries.footprints}/share/kicad/modules"
+    "--set KISYSMOD ${libraries.footprints}/share/kicad/modules"
-    "--set KICAD_SYMBOL_DIR ${kicad-libraries.symbols}/share/kicad/library"
+    "--set KICAD_SYMBOL_DIR ${libraries.symbols}/share/kicad/library"
-    "--set KICAD_TEMPLATE_DIR ${kicad-libraries.templates}/share/kicad/template"
+    "--set KICAD_TEMPLATE_DIR ${libraries.templates}/share/kicad/template"
-    "--prefix KICAD_TEMPLATE_DIR : ${kicad-libraries.symbols}/share/kicad/template"
+    "--prefix KICAD_TEMPLATE_DIR : ${libraries.symbols}/share/kicad/template"
-    "--prefix KICAD_TEMPLATE_DIR : ${kicad-libraries.footprints}/share/kicad/template"
+    "--prefix KICAD_TEMPLATE_DIR : ${libraries.footprints}/share/kicad/template"
   ]
-  ++ optionals (with3d) [ "--set KISYS3DMOD ${kicad-libraries.packages3d}/share/kicad/modules/packages3d" ]
+  ++ optionals (with3d) [ "--set KISYS3DMOD ${libraries.packages3d}/share/kicad/modules/packages3d" ]
   ++ optionals (ngspiceSupport) [ "--prefix LD_LIBRARY_PATH : ${libngspice}/lib" ]
 
   # infinisil's workaround for #39493
@@ -88,30 +88,30 @@ stdenv.mkDerivation rec {
 
   # dunno why i have to add $makeWrapperArgs manually...
   # $out and $program_PYTHONPATH don't exist when makeWrapperArgs gets set?
-  # not sure if anything has to be done with the other stuff in kicad-base/bin
+  # not sure if anything has to be done with the other stuff in base/bin
   # dxf2idf, idf2vrml, idfcyl, idfrect, kicad2step, kicad-ogltest
   installPhase =
-    optionalString (scriptingSupport) '' buildPythonPath "${kicad-base} $pythonPath"
+    optionalString (scriptingSupport) '' buildPythonPath "${base} $pythonPath"
     '' +
-    '' makeWrapper ${kicad-base}/bin/kicad $out/bin/kicad $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/kicad $out/bin/kicad $makeWrapperArgs ''
     + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
     '' +
-    '' makeWrapper ${kicad-base}/bin/pcbnew $out/bin/pcbnew $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/pcbnew $out/bin/pcbnew $makeWrapperArgs ''
     + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
     '' +
-    '' makeWrapper ${kicad-base}/bin/eeschema $out/bin/eeschema $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/eeschema $out/bin/eeschema $makeWrapperArgs ''
     + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
     '' +
-    '' makeWrapper ${kicad-base}/bin/gerbview $out/bin/gerbview $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/gerbview $out/bin/gerbview $makeWrapperArgs ''
     + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
     '' +
-    '' makeWrapper ${kicad-base}/bin/pcb_calculator $out/bin/pcb_calculator $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/pcb_calculator $out/bin/pcb_calculator $makeWrapperArgs ''
     + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
     '' +
-    '' makeWrapper ${kicad-base}/bin/pl_editor $out/bin/pl_editor $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/pl_editor $out/bin/pl_editor $makeWrapperArgs ''
     + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
     '' +
-    '' makeWrapper ${kicad-base}/bin/bitmap2component $out/bin/bitmap2component $makeWrapperArgs ''
+    '' makeWrapper ${base}/bin/bitmap2component $out/bin/bitmap2component $makeWrapperArgs ''
     + optionalString (scriptingSupport) '' --set PYTHONPATH "$program_PYTHONPATH"
     ''
   ;

pkgs/applications/science/electronics/kicad/update.sh

@@ -5,13 +5,12 @@
 # this should contain the versions' revs and hashes
 # the stable revs are stored only for ease of skipping
 
-# if you get something like "tar: no space left on device"
+# by default nix-prefetch-url uses XDG_RUNTIME_DIR as tmp
-# you may need a bigger tmpfs, this can be set as such
+# which is /run/user/1000, which defaults to 10% of your RAM
-# services.logind.extraConfig = "RuntimeDirectorySize=8G";
+# unless you have over 64GB of ram that'll be insufficient
-# this is most likely only needed for the packages3d
+# resulting in "tar: no space left on device" for packages3d
-# this can be checked without that config by manual TOFU
+# hence:
-# copy the generated items from ,versions.nix to versions.nix
+export TMPDIR=/tmp
-# then nix-build and see what it actually gets
 
 # if something goes unrepairably wrong, run 'update.sh all clean'
 
@@ -19,7 +18,8 @@
 # support parallel instances for each pname
 #   currently risks reusing old data
 # no getting around manually checking if the build product works...
-# if there is, default to commiting
+# if there is, default to commiting?
+#   won't work when running in parallel?
 # remove items left in /nix/store?
 
 # get the latest tag that isn't an RC or *.99

pkgs/applications/science/electronics/kicad/versions.nix

@@ -27,25 +27,25 @@
   };
   "kicad-unstable" = {
     kicadVersion = {
-      version =			"2020-01-08";
+      version =			"2020-02-10";
       src = {
-        rev =			"ca34ade00c554157f106fde97af5f08a202808ef";
+        rev =			"1190e60dd426d246661e478db3287f266ec6cda2";
-        sha256 =		"0xx5qkc5pi3qdrdikgq3902ws8zilv2476fb4bbgh95d9wpgr35v";
+        sha256 =		"0cgfad07j69cks97llj4hf3kga0d5qf728s89xwxrzcwm06k62bi";
       };
     };
     libVersion = {
-      version =			"2020-01-08";
+      version =			"2020-02-10";
       libSources = {
-        i18n.rev =		"e7439fd76f27cfc26e269c4e6c4d56245345c28b";
+        i18n.rev =		"26786c4ca804bad7eb072f1ef381f00b5a2ff3ee";
-        i18n.sha256 =		"1nqm1kx5b4f7s0f9q8bg4rdhqnp0128yp6bgnrkia1kwmfnf5gmy";
+        i18n.sha256 =		"0iqr1xfw4s677afjy9bn5y41z4isp327f9y90wypkxiwwq3dfkfl";
-        symbols.rev =		"ad58768b88d564fd188c6667841adec436da53f2";
+        symbols.rev =		"35b7da2d211d7cc036b37ad7f5e40ef03faa1bc7";
-        symbols.sha256 =	"1rdplf04bff0hmgjwr81fbcr9nkqi21n0n88nzs5fdp73mqiywcy";
+        symbols.sha256 =	"0wbfw1swbfvfp47cn48pxpqlygjs3xh568ydrrs51v3w102x8y64";
         templates.rev =		"0c0490897f803ab8b7c3dad438b7eb1f80e0417c";
         templates.sha256 =	"0cs3bm3zb5ngw5ldn0lzw5bvqm4kvcidyrn76438alffwiz2b15g";
-        footprints.rev =	"973867de7f33f202e9fd1b3455bd1f7e7fe4a074";
+        footprints.rev =	"9357b6f09312966c57fec9f66a516941d79c3038";
-        footprints.sha256 =	"0yvidpnqbfxjdwaiscl5bdchsg0l4d769vp456dc8h0f3802mibi";
+        footprints.sha256 =	"0cgah1q0h012ffwfl220k7qb6hgbs0i91spq2j4v3lgpfr4g638d";
-        packages3d.rev =	"c2b92a411adc93ddeeed74b36b542e1057f81a2a";
+        packages3d.rev =	"de368eb739abe41dfc3163e0e370477e857f9cc1";
-        packages3d.sha256 =	"05znc6y2lc31iafspg308cxdda94zg6c7mwslmys76npih1pb8qc";
+        packages3d.sha256 =	"0b3p5v8g24h6l7q3sbqz7ns0gnrf9l89glj86m5ybhizvls9vrrs";
       };
     };
   };

pkgs/applications/science/math/clp/default.nix

@@ -1,11 +1,11 @@
 { stdenv, fetchurl, zlib }:
 
 stdenv.mkDerivation rec {
-  version = "1.17.3";
+  version = "1.17.5";
   pname = "clp";
   src = fetchurl {
     url = "https://www.coin-or.org/download/source/Clp/Clp-${version}.tgz";
-    sha256 = "0ws515f73vq2p4nzyq0fbnm4zp9a7mjg54szdzvkql5dj51gafx1";
+    sha256 = "0y5wg4lfffy5vh8gc20v68pmmv241ndi2jgm9pgvk39b00bzkaa9";
   };
 
   propagatedBuildInputs = [ zlib ];

pkgs/applications/version-management/git-repo/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "1.13.9.4";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    sha256 = "0kkb3s472zvmz5xign25rgv7amdzhjb1wvchqxaf80g4913rw583";
+    sha256 = "077fsg2mh47c7qvqwpivkw474rpnw5xs36j23rxj2k5m700bz3hq";
   };
 
   patches = [ ./import-ssl-module.patch ];

pkgs/applications/video/catt/default.nix

@@ -8,11 +8,11 @@
 
 buildPythonApplication rec {
   pname = "catt";
-  version = "0.10.2";
+  version = "0.10.3";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0n6aa2vvbq0z3vcg4cylhpqxch783cxvxk234647knklgg9vdf1r";
+    sha256 = "08rjimcy9n7nvh4dz9693gjmkq6kaq5pq1nmjjsdrb7vb89yl53i";
   };
 
   propagatedBuildInputs = [

pkgs/applications/virtualization/cri-o/default.nix

@@ -1,9 +1,9 @@
 { flavor ? ""
-, ldflags ? ""
 , stdenv
 , btrfs-progs
 , buildGoPackage
 , fetchFromGitHub
+, git
 , glibc
 , gpgme
 , libapparmor
@@ -13,13 +13,14 @@
 , libselinux
 , lvm2
 , pkgconfig
+, which
 }:
 
 let
   buildTags = "apparmor seccomp selinux containers_image_ostree_stub";
 in buildGoPackage rec {
   project = "cri-o";
-  version = "1.16.1";
+  version = "1.17.0";
   name = "${project}-${version}${flavor}";
 
   goPackagePath = "github.com/${project}/${project}";
@@ -28,11 +29,11 @@ in buildGoPackage rec {
     owner = "cri-o";
     repo = "cri-o";
     rev = "v${version}";
-    sha256 = "0w690zhc55gdqzc31jc34nrzwd253pfb3rq23z51q22nqwmlsh9p";
+    sha256 = "0xjmylf0ww23qqcg7kw008px6608r4qq6q57pfqis0661kp6f24j";
   };
 
   outputs = [ "bin" "out" ];
-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ git pkgconfig which ];
   buildInputs = [ btrfs-progs gpgme libapparmor libassuan libgpgerror
                  libseccomp libselinux lvm2 ]
                 ++ stdenv.lib.optionals (glibc != null) [ glibc glibc.static ];
@@ -40,27 +41,15 @@ in buildGoPackage rec {
   buildPhase = ''
     pushd go/src/${goPackagePath}
 
-    # Build pause
+    make BUILDTAGS='${buildTags}' \
-    make -C pause
+      bin/crio \
-
+      bin/crio-status \
-    # Build the crio binaries
+      bin/pinns
-    function build() {
-      go build \
-        -tags "${buildTags}" \
-        -o bin/"$1" \
-        -buildmode=pie \
-        -ldflags '-s -w ${ldflags}' \
-        ${goPackagePath}/cmd/"$1"
-    }
-    build crio
-    build crio-status
   '';
   installPhase = ''
     install -Dm755 bin/crio $bin/bin/crio${flavor}
     install -Dm755 bin/crio-status $bin/bin/crio-status${flavor}
-
+    install -Dm755 bin/pinns $bin/bin/pinns${flavor}
-    mkdir -p $bin/libexec/crio
-    install -Dm755 bin/pause $bin/libexec/crio/pause${flavor}
   '';
 
   meta = with stdenv.lib; {

pkgs/applications/virtualization/qemu/default.nix

@@ -84,6 +84,37 @@ stdenv.mkDerivation rec {
       stripLen = 1;
       extraPrefix = "slirp/";
     })
+    # patches listed at: https://nvd.nist.gov/vuln/detail/CVE-2020-7039
+    (fetchpatch {
+      name = "CVE-2020-7039-1.patch";
+      url = "https://git.qemu.org/?p=libslirp.git;a=patch;h=2655fffed7a9e765bcb4701dd876e9dab975f289";
+      sha256 = "1jh0k3lg3553c2x1kq1kl3967jabhba5gm584wjpmr5mjqk3lnz1";
+      stripLen = 1;
+      extraPrefix = "slirp/";
+      excludes = ["slirp/CHANGELOG.md"];
+    })
+    (fetchpatch {
+      name = "CVE-2020-7039-2.patch";
+      url = "https://git.qemu.org/?p=libslirp.git;a=patch;h=82ebe9c370a0e2970fb5695aa19aa5214a6a1c80";
+      sha256 = "08ccxcmrhzknnzd1a1q2brszv3a7h02n26r73kpli10b0hn12r2l";
+      stripLen = 1;
+      extraPrefix = "slirp/";
+    })
+    (fetchpatch {
+      name = "CVE-2020-7039-3.patch";
+      url = "https://git.qemu.org/?p=libslirp.git;a=patch;h=ce131029d6d4a405cb7d3ac6716d03e58fb4a5d9";
+      sha256 = "18ypj9an2jmsmdn58853rbz42r10587h7cz5fdws2x4635778ibd";
+      stripLen = 1;
+      extraPrefix = "slirp/";
+    })
+    # patches listed at: https://nvd.nist.gov/vuln/detail/CVE-2020-7211
+    (fetchpatch {
+      name = "CVE-2020-7211.patch";
+      url = "https://git.qemu.org/?p=libslirp.git;a=patch;h=14ec36e107a8c9af7d0a80c3571fe39b291ff1d4";
+      sha256 = "1lc8zabqs580iqrsr5k7zwgkx6qjmja7apwfbc36lkvnrxwfzmrc";
+      stripLen = 1;
+      extraPrefix = "slirp/";
+    })
   ] ++ optional nixosTestRunner ./force-uid0-on-9p.patch
     ++ optionals stdenv.hostPlatform.isMusl [
     (fetchpatch {

pkgs/data/fonts/recursive/default.nix

@@ -2,25 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "recursive";
-  version = "1.022";
+  version = "1.030";
 
-  srcs = [
+  src = fetchzip {
-    (fetchzip {
+    url = "https://github.com/arrowtype/recursive/releases/download/${version}/recursive-beta_1_030--statics.zip";
-      name = "${pname}";
+    sha256 = "1clds4ljiqdf0zc3b7nlna1w7kc23pc9gxdd5vwbgmz9xfvkam0f";
-      url = "https://github.com/arrowtype/recursive/releases/download/v${version}/recursive-beta_1_022.zip";
+    stripRoot = false;
-      sha256 = "09nr1fli7ksv8z4yb25c4xidwsqq50av18qrybsy4kqy5c22957v";
+  };
-      stripRoot = false;
-    })
-
-    (fetchzip {
-      name = "${pname}-static";
-      url = "https://github.com/arrowtype/recursive/releases/download/v${version}/recursive-static_fonts-b020.zip";
-      sha256 = "1wlj113gjm26ra9y2r2b3syis2wx0mjq2m8i8xpwscp1kflma1r6";
-      stripRoot = false;
-    })
-  ];
-
-  sourceRoot = ".";
 
   installPhase = ''
     mkdir -p $out/share/fonts/{opentype,truetype,woff2}

pkgs/data/icons/flat-remix-icon-theme/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec  {
   pname = "flat-remix-icon-theme";
-  version = "20191018";
+  version = "20191122";
 
   src = fetchFromGitHub  {
     owner = "daniruiz";
     repo = "flat-remix";
     rev = version;
-    sha256 = "13ibxvrvri04lb5phm49b6d553jh0aigm57z5i0nsins405gixn9";
+    sha256 = "1rv35r52l7xxjpajwli0md07k3xl7xplbw919vjmsb1hhrzavzzg";
   };
 
   nativeBuildInputs = [ gtk3 ];

pkgs/desktops/cinnamon/cinnamon-desktop/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-desktop";
-  version = "4.4.0";
+  version = "4.4.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "17hb8gkb9pfj56ckva5g4x83yvmdv7hvpidxjsdf79dw6pabr5rg";
+    sha256 = "10db5rai8cbbzphvcwarr3hm1bd9rxchlc0hcghg7qnmvv52fq03";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/beam-modules/default.nix

@@ -66,8 +66,9 @@ let
         # Remove old versions of elixir, when the supports fades out:
         # https://hexdocs.pm/elixir/compatibility-and-deprecations.html
 
-        lfe = lfe_1_2;
+        lfe = lfe_1_3;
         lfe_1_2 = lib.callLFE ../interpreters/lfe/1.2.nix { inherit erlang buildRebar3 buildHex; };
+        lfe_1_3 = lib.callLFE ../interpreters/lfe/1.3.nix { inherit erlang buildRebar3 buildHex; };
 
         # Non hex packages. Examples how to build Rebar/Mix packages with and
         # without helper functions buildRebar3 and buildMix.

pkgs/development/compilers/bs-platform/build-bs-platform.nix

@@ -30,9 +30,8 @@ stdenv.mkDerivation {
     cp ${custom-ninja}/bin/ninja vendor/ninja/snapshot/ninja.linux
   '';
 
-  configurePhase = ''
+  # avoid building the development version, will break aarch64 build
-    node scripts/ninja.js config
+  dontConfigure = true;
-  '';
 
   buildPhase = ''
     # This is an unfortunate name, but it's actually how to build a release

pkgs/development/compilers/bs-platform/default.nix

@@ -21,8 +21,5 @@ in
     license = licenses.lgpl3;
     maintainers = with maintainers; [ turbomack gamb anmonteiro ];
     platforms = platforms.all;
-    # Currently there is an issue with aarch build in hydra
-    # https://github.com/BuckleScript/bucklescript/issues/4091
-    badPlatforms = platforms.aarch64;
   };
 })

pkgs/development/compilers/ispc/default.nix

@@ -1,4 +1,4 @@
-{stdenv, fetchFromGitHub, which, m4, python, bison, flex, llvmPackages,
+{stdenv, fetchFromGitHub, cmake, which, m4, python, bison, flex, llvmPackages,
 testedTargets ? ["sse2"] # the default test target is sse4, but that is not supported by all Hydra agents
 }:
 
@@ -17,11 +17,9 @@ stdenv.mkDerivation rec {
     sha256 = "1x07n2gaff3v32yvddrb659mx5gg12bnbsqbyfimp396wn04w60b";
   };
 
-  # there are missing dependencies in the Makefile, causing sporadic build failures
-  enableParallelBuilding = false;
-
   doCheck = stdenv.isLinux;
 
+  nativeBuildInputs = [ cmake ];
   buildInputs = with llvmPackages; [
     which
     m4
@@ -32,7 +30,7 @@ stdenv.mkDerivation rec {
     llvmPackages.clang-unwrapped # we need to link against libclang, so we need the unwrapped
   ];
 
-  postPatch = "sed -i -e 's,/bin/,,g' -e 's/-lcurses/-lncurses/g' Makefile";
+  postPatch = "sed -i -e 's/curses/ncurses/g' CMakeLists.txt";
 
   # TODO: this correctly catches errors early, but also some things that are just weird and don't seem to be real
   # errors
@@ -40,27 +38,23 @@ stdenv.mkDerivation rec {
   #  makeFlagsArray=( SHELL="${bash}/bin/bash -o pipefail" )
   #'';
 
-  installPhase = ''
-    mkdir -p $out/bin
-    cp ispc $out/bin
-  '';
-
   checkPhase = ''
-    export ISPC_HOME=$PWD
+    export ISPC_HOME=$PWD/bin
     for target in $testedTargets
     do
       echo "Testing target $target"
       echo "================================"
       echo
-      PATH=${llvmPackages.clang}/bin:$PATH python run_tests.py -t $target --non-interactive --verbose --file=test_output.log
+      (cd ../
-      fgrep -q "No new fails"  test_output.log || exit 1
+       PATH=${llvmPackages.clang}/bin:$PATH python run_tests.py -t $target --non-interactive --verbose --file=test_output.log
+       fgrep -q "No new fails"  test_output.log || exit 1)
     done
   '';
 
-  makeFlags = [
+  cmakeFlags = [
-    "CXX=${stdenv.cc}/bin/clang++"
+    "-DCLANG_EXECUTABLE=${llvmPackages.clang}/bin/clang"
-    "CLANG=${stdenv.cc}/bin/clang"
+    "-DISPC_INCLUDE_EXAMPLES=OFF"
-    "CLANG_INCLUDE=${llvmPackages.clang-unwrapped}/include"
+    "-DISPC_INCLUDE_UTILS=OFF"
     ];
 
   meta = with stdenv.lib; {

pkgs/development/compilers/reason/default.nix

@@ -1,24 +1,23 @@
 { stdenv, makeWrapper, fetchFromGitHub, ocaml, findlib, dune
-, menhir, merlin-extend, ppx_tools_versioned, utop, cppo
+, fix, menhir, merlin-extend, ppx_tools_versioned, utop, cppo
-, ocaml_lwt
 }:
 
 stdenv.mkDerivation rec {
   name = "ocaml${ocaml.version}-reason-${version}";
-  version = "3.5.1";
+  version = "3.5.4";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "reason";
-    rev = "aea245a43eb44034d2fccac7028b640a437af239";
+    rev = "e3287476e5c3f0cbcd9dc7ab18d290f81f4afa0c";
-    sha256 = "0ff7rjxbsg9zkq6sxlm9bkx7yk8x2cvras7z8436msczgd1wmmyf";
+    sha256 = "02p5d1x6lr7jp9mvgvsas3nnq3a97chxp5q6rl07n5qm61d5b4dl";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
   propagatedBuildInputs = [ menhir merlin-extend ppx_tools_versioned ];
 
-  buildInputs = [ ocaml findlib dune cppo utop menhir ];
+  buildInputs = [ ocaml findlib dune cppo fix utop menhir ];
 
   buildFlags = [ "build" ]; # do not "make tests" before reason lib is installed
 
@@ -27,8 +26,8 @@ stdenv.mkDerivation rec {
   postInstall = ''
     wrapProgram $out/bin/rtop \
       --prefix PATH : "${utop}/bin" \
-      --prefix CAML_LD_LIBRARY_PATH : "${ocaml_lwt}/lib/ocaml/${ocaml.version}/site-lib" \
+      --prefix CAML_LD_LIBRARY_PATH : "$CAML_LD_LIBRARY_PATH" \
-      --prefix OCAMLPATH : "$out/lib/ocaml/${ocaml.version}/site-lib"
+      --prefix OCAMLPATH : "$OCAMLPATH:$OCAMLFIND_DESTDIR"
   '';
 
   meta = with stdenv.lib; {

pkgs/development/compilers/sdcc/default.nix

@@ -10,11 +10,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "sdcc";
-  version = "3.9.0";
+  version = "4.0.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/sdcc/sdcc-src-${version}.tar.bz2";
-    sha256 = "0dn0cy6whcrvbfh9x467jdi8dmzjrvixz2bz63pgxwzpz9rsxv4l";
+    sha256 = "042fxw5mnsfhpc0z9lxfsw88kdkm32pwrxacp88kj2n2dy0814a8";
   };
 
   buildInputs = [ autoconf bison boost flex gputils texinfo zlib ];

pkgs/development/interpreters/elixir/1.10.nix

@@ -3,7 +3,7 @@
 # How to obtain `sha256`:
 # nix-prefetch-url --unpack https://github.com/elixir-lang/elixir/archive/v${version}.tar.gz
 mkDerivation {
-  version = "1.10.0";
+  version = "1.10.1";
-  sha256 = "1fz22c2jqqm2jvzxar11bh1djg3kqdn5rbxdddlz0cv6mfz7hvgv";
+  sha256 = "07iccn90yp11ms58mwkwd9ixd9vma0025l9zm6l7y0jjzrj3vycy";
   minimumOTPVersion = "21";
 }

pkgs/development/interpreters/elixir/generic-builder.nix

@@ -73,6 +73,6 @@ in
 
       license = licenses.epl10;
       platforms = platforms.unix;
-      maintainers = with maintainers; [ the-kenny havvy couchemar ankhers ];
+      maintainers = with maintainers; [ the-kenny havvy couchemar ankhers filalex77 ];
     };
   })