Merge master into staging-next

2024-12-26 04:43:09 +03:00 · 2019-12-05 09:14:08 +01:00 · 2019-12-05 09:14:08 +01:00 · 51ef7c3e49
commit 51ef7c3e49
parent 30fae2883e 1451a52a38
237 changed files with 2458 additions and 1153 deletions
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@ -6,9 +6,8 @@ under the terms of [COPYING](../COPYING), which is an MIT-like license.
 ## Opening issues

 * Make sure you have a [GitHub account](https://github.com/signup/free)
-* [Submit an issue](https://github.com/NixOS/nixpkgs/issues) - assuming one does not already exist.
-  * Clearly describe the issue including steps to reproduce when it is a bug.
-  * Include information what version of nixpkgs and Nix are you using (nixos-version or git revision).
+* Make sure there is no open issue on the topic
+* [Submit a new issue](https://github.com/NixOS/nixpkgs/issues/new/choose) by choosing the kind of topic and fill out the template

 ## Submitting changes

--- a/doc/builders/trivial-builders.xml
+++ b/doc/builders/trivial-builders.xml
@ -7,7 +7,7 @@
  Nixpkgs provides a couple of functions that help with building derivations. The most important one, <function>stdenv.mkDerivation</function>, has already been documented above. The following functions wrap <function>stdenv.mkDerivation</function>, making it easier to use in certain cases.
 </para>
 <variablelist>
-  <varlistentry>
+  <varlistentry xml:id="trivial-builder-runCommand">
   <term>
    <literal>runCommand</literal>
   </term>
@ -40,7 +40,7 @@
 </programlisting>
   </listitem>
  </varlistentry>
-  <varlistentry>
+  <varlistentry xml:id="trivial-builder-runCommandCC">
   <term>
    <literal>runCommandCC</literal>
   </term>
@ -50,7 +50,20 @@
    </para>
   </listitem>
  </varlistentry>
-  <varlistentry>
+  <varlistentry xml:id="trivial-builder-runCommandLocal">
+   <term>
+    <literal>runCommandLocal</literal>
+   </term>
+   <listitem>
+    <para>
+     Variant of <literal>runCommand</literal> that forces the derivation to be built locally, it is not substituted. This is intended for very cheap commands (&lt;1s execution time). It saves on the network roundrip and can speed up a build.
+    </para>
+    <note><para>
+      This sets <link xlink:href="https://nixos.org/nix/manual/#adv-attr-allowSubstitutes"><literal>allowSubstitutes</literal> to <literal>false</literal></link>, so only use <literal>runCommandLocal</literal> if you are certain the user will always have a builder for the <literal>system</literal> of the derivation. This should be true for most trivial use cases (e.g. just copying some files to a different location or adding symlinks), because there the <literal>system</literal> is usually the same as <literal>builtins.currentSystem</literal>.
+    </para></note>
+   </listitem>
+  </varlistentry>
+  <varlistentry xml:id="trivial-builder-writeText">
   <term>
    <literal>writeTextFile</literal>, <literal>writeText</literal>, <literal>writeTextDir</literal>, <literal>writeScript</literal>, <literal>writeScriptBin</literal>
   </term>
@ -63,7 +76,7 @@
    </para>
   </listitem>
  </varlistentry>
-  <varlistentry>
+  <varlistentry xml:id="trivial-builder-symlinkJoin">
   <term>
    <literal>symlinkJoin</literal>
   </term>
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3225,6 +3225,12 @@
    githubId = 2195834;
    name = "Jaakko Luttinen";
  };
+  jm2dev = {
+    email = "jomarcar@gmail.com";
+    github = "jm2dev";
+    githubId = 474643;
+    name = "José Miguel Martínez Carrasco";
+  };
  jmagnusj = {
    email = "jmagnusj@gmail.com";
    github = "magnusjonsson";
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@ -77,6 +77,12 @@
    be set if the hostname of the node should be non default.
    </para>
   </listitem>
+   <listitem>
+    <para>
+    UPower's configuration is now managed by NixOS and can be customized
+    via <option>services.upower</option>.
+    </para>
+   </listitem>
  </itemizedlist>

 </section>
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@ -312,8 +312,13 @@ class Machine:
        self.monitor.send(message)
        return self.wait_for_monitor_prompt()

-    def wait_for_unit(self, unit: str, user: Optional[str] = None) -> bool:
-        while True:
+    def wait_for_unit(self, unit: str, user: Optional[str] = None) -> None:
+        """Wait for a systemd unit to get into "active" state.
+        Throws exceptions on "failed" and "inactive" states as well as
+        after timing out.
+        """
+
+        def check_active(_: Any) -> bool:
            info = self.get_unit_info(unit, user)
            state = info["ActiveState"]
            if state == "failed":
@ -329,8 +334,10 @@ class Machine:
                                'unit "{}" is inactive and there ' "are no pending jobs"
                            ).format(unit)
                        )
-            if state == "active":
-                return True
+
+            return state == "active"
+
+        retry(check_active)

    def get_unit_info(self, unit: str, user: Optional[str] = None) -> Dict[str, str]:
        status, lines = self.systemctl('--no-pager show "{}"'.format(unit), user)
@ -421,18 +428,34 @@ class Machine:
                    )

    def wait_until_succeeds(self, command: str) -> str:
+        """Wait until a command returns success and return its output.
+        Throws an exception on timeout.
+        """
+        output = ""
+
+        def check_success(_: Any) -> bool:
+            nonlocal output
+            status, output = self.execute(command)
+            return status == 0
+
        with self.nested("waiting for success: {}".format(command)):
-            while True:
-                status, output = self.execute(command)
-                if status == 0:
-                    return output
+            retry(check_success)
+            return output

    def wait_until_fails(self, command: str) -> str:
+        """Wait until a command returns failure.
+        Throws an exception on timeout.
+        """
+        output = ""
+
+        def check_failure(_: Any) -> bool:
+            nonlocal output
+            status, output = self.execute(command)
+            return status != 0
+
        with self.nested("waiting for failure: {}".format(command)):
-            while True:
-                status, output = self.execute(command)
-                if status != 0:
-                    return output
+            retry(check_failure)
+            return output

    def wait_for_shutdown(self) -> None:
        if not self.booted:
@ -453,25 +476,38 @@ class Machine:
        )
        return output

-    def wait_until_tty_matches(self, tty: str, regexp: str) -> bool:
+    def wait_until_tty_matches(self, tty: str, regexp: str) -> None:
+        """Wait until the visible output on the chosen TTY matches regular
+        expression. Throws an exception on timeout.
+        """
        matcher = re.compile(regexp)
+
+        def tty_matches(last: bool) -> bool:
+            text = self.get_tty_text(tty)
+            if last:
+                self.log(
+                    f"Last chance to match /{regexp}/ on TTY{tty}, "
+                    f"which currently contains: {text}"
+                )
+            return len(matcher.findall(text)) > 0
+
        with self.nested("waiting for {} to appear on tty {}".format(regexp, tty)):
-            while True:
-                text = self.get_tty_text(tty)
-                if len(matcher.findall(text)) > 0:
-                    return True
+            retry(tty_matches)

    def send_chars(self, chars: List[str]) -> None:
        with self.nested("sending keys ‘{}‘".format(chars)):
            for char in chars:
                self.send_key(char)

-    def wait_for_file(self, filename: str) -> bool:
+    def wait_for_file(self, filename: str) -> None:
+        """Waits until the file exists in machine's file system."""
+
+        def check_file(_: Any) -> bool:
+            status, _ = self.execute("test -e {}".format(filename))
+            return status == 0
+
        with self.nested("waiting for file ‘{}‘".format(filename)):
-            while True:
-                status, _ = self.execute("test -e {}".format(filename))
-                if status == 0:
-                    return True
+            retry(check_file)

    def wait_for_open_port(self, port: int) -> None:
        def port_is_open(_: Any) -> bool:
@ -494,8 +530,8 @@ class Machine:
    def stop_job(self, jobname: str, user: Optional[str] = None) -> Tuple[int, str]:
        return self.systemctl("stop {}".format(jobname), user)

-    def wait_for_job(self, jobname: str) -> bool:
-        return self.wait_for_unit(jobname)
+    def wait_for_job(self, jobname: str) -> None:
+        self.wait_for_unit(jobname)

    def connect(self) -> None:
        if self.connected:
@ -700,18 +736,20 @@ class Machine:
        """Wait until it is possible to connect to the X server.  Note that
        testing the existence of /tmp/.X11-unix/X0 is insufficient.
        """
+
+        def check_x(_: Any) -> bool:
+            cmd = (
+                "journalctl -b SYSLOG_IDENTIFIER=systemd | "
+                + 'grep "Reached target Current graphical"'
+            )
+            status, _ = self.execute(cmd)
+            if status != 0:
+                return False
+            status, _ = self.execute("[ -e /tmp/.X11-unix/X0 ]")
+            return status == 0
+
        with self.nested("waiting for the X11 server"):
-            while True:
-                cmd = (
-                    "journalctl -b SYSLOG_IDENTIFIER=systemd | "
-                    + 'grep "Reached target Current graphical"'
-                )
-                status, _ = self.execute(cmd)
-                if status != 0:
-                    continue
-                status, _ = self.execute("[ -e /tmp/.X11-unix/X0 ]")
-                if status == 0:
-                    return
+            retry(check_x)

    def get_window_names(self) -> List[str]:
        return self.succeed(
--- a/nixos/modules/services/hardware/upower.nix
+++ b/nixos/modules/services/hardware/upower.nix
@ -37,6 +37,172 @@ in
        '';
      };

+      enableWattsUpPro = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Enable the Watts Up Pro device.
+
+          The Watts Up Pro contains a generic FTDI USB device without a specific
+          vendor and product ID. When we probe for WUP devices, we can cause
+          the user to get a perplexing "Device or resource busy" error when
+          attempting to use their non-WUP device.
+
+          The generic FTDI device is known to also be used on:
+
+          <itemizedlist>
+            <listitem><para>Sparkfun FT232 breakout board</para></listitem>
+            <listitem><para>Parallax Propeller</para></listitem>
+          </itemizedlist>
+        '';
+      };
+
+      noPollBatteries = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Don't poll the kernel for battery level changes.
+
+          Some hardware will send us battery level changes through
+          events, rather than us having to poll for it. This option
+          allows disabling polling for hardware that sends out events.
+        '';
+      };
+
+      ignoreLid = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Do we ignore the lid state
+
+          Some laptops are broken. The lid state is either inverted, or stuck
+          on or off. We can't do much to fix these problems, but this is a way
+          for users to make the laptop panel vanish, a state that might be used
+          by a couple of user-space daemons. On Linux systems, see also
+          logind.conf(5).
+        '';
+      };
+
+      usePercentageForPolicy = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Policy for warnings and action based on battery levels
+
+          Whether battery percentage based policy should be used. The default
+          is to use the percentage, which
+          should work around broken firmwares. It is also more reliable than
+          the time left (frantically saving all your files is going to use more
+          battery than letting it rest for example).
+        '';
+      };
+
+      percentageLow = mkOption {
+        type = types.ints.unsigned;
+        default = 10;
+        description = ''
+          When <literal>usePercentageForPolicy</literal> is
+          <literal>true</literal>, the levels at which UPower will consider the
+          battery low.
+
+          This will also be used for batteries which don't have time information
+          such as that of peripherals.
+
+          If any value (of <literal>percentageLow</literal>,
+          <literal>percentageCritical</literal> and
+          <literal>percentageAction</literal>) is invalid, or not in descending
+          order, the defaults will be used.
+        '';
+      };
+
+      percentageCritical = mkOption {
+        type = types.ints.unsigned;
+        default = 3;
+        description = ''
+          When <literal>usePercentageForPolicy</literal> is
+          <literal>true</literal>, the levels at which UPower will consider the
+          battery critical.
+
+          This will also be used for batteries which don't have time information
+          such as that of peripherals.
+
+          If any value (of <literal>percentageLow</literal>,
+          <literal>percentageCritical</literal> and
+          <literal>percentageAction</literal>) is invalid, or not in descending
+          order, the defaults will be used.
+        '';
+      };
+
+      percentageAction = mkOption {
+        type = types.ints.unsigned;
+        default = 2;
+        description = ''
+          When <literal>usePercentageForPolicy</literal> is
+          <literal>true</literal>, the levels at which UPower will take action
+          for the critical battery level.
+
+          This will also be used for batteries which don't have time information
+          such as that of peripherals.
+
+          If any value (of <literal>percentageLow</literal>,
+          <literal>percentageCritical</literal> and
+          <literal>percentageAction</literal>) is invalid, or not in descending
+          order, the defaults will be used.
+        '';
+      };
+
+      timeLow = mkOption {
+        type = types.ints.unsigned;
+        default = 1200;
+        description = ''
+          When <literal>usePercentageForPolicy</literal> is
+          <literal>false</literal>, the time remaining at which UPower will
+          consider the battery low.
+
+          If any value (of <literal>timeLow</literal>,
+          <literal>timeCritical</literal> and <literal>timeAction</literal>) is
+          invalid, or not in descending order, the defaults will be used.
+        '';
+      };
+
+      timeCritical = mkOption {
+        type = types.ints.unsigned;
+        default = 300;
+        description = ''
+          When <literal>usePercentageForPolicy</literal> is
+          <literal>false</literal>, the time remaining at which UPower will
+          consider the battery critical.
+
+          If any value (of <literal>timeLow</literal>,
+          <literal>timeCritical</literal> and <literal>timeAction</literal>) is
+          invalid, or not in descending order, the defaults will be used.
+        '';
+      };
+
+      timeAction = mkOption {
+        type = types.ints.unsigned;
+        default = 120;
+        description = ''
+          When <literal>usePercentageForPolicy</literal> is
+          <literal>false</literal>, the time remaining at which UPower will
+          take action for the critical battery level.
+
+          If any value (of <literal>timeLow</literal>,
+          <literal>timeCritical</literal> and <literal>timeAction</literal>) is
+          invalid, or not in descending order, the defaults will be used.
+        '';
+      };
+
+      criticalPowerAction = mkOption {
+        type = types.enum [ "PowerOff" "Hibernate" "HybridSleep" ];
+        default = "HybridSleep";
+        description = ''
+          The action to take when <literal>timeAction</literal> or
+          <literal>percentageAction</literal> has been reached for the batteries
+          (UPS or laptop batteries) supplying the computer
+        '';
+      };
+
    };

  };
@ -54,6 +220,21 @@ in

    systemd.packages = [ cfg.package ];

+    environment.etc."UPower/UPower.conf".text = generators.toINI {} {
+      UPower = {
+        EnableWattsUpPro = cfg.enableWattsUpPro;
+        NoPollBatteries = cfg.noPollBatteries;
+        IgnoreLid = cfg.ignoreLid;
+        UsePercentageForPolicy = cfg.usePercentageForPolicy;
+        PercentageLow = cfg.percentageLow;
+        PercentageCritical = cfg.percentageCritical;
+        PercentageAction = cfg.percentageAction;
+        TimeLow = cfg.timeLow;
+        TimeCritical = cfg.timeCritical;
+        TimeAction = cfg.timeAction;
+        CriticalPowerAction = cfg.criticalPowerAction;
+      };
+    };
  };

 }
--- a/nixos/modules/services/networking/dnschain.nix
+++ b/nixos/modules/services/networking/dnschain.nix
@ -180,4 +180,6 @@ in

  };

+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
 }
--- a/nixos/modules/services/networking/dnscrypt-wrapper.nix
+++ b/nixos/modules/services/networking/dnscrypt-wrapper.nix
@ -197,4 +197,7 @@ in {
    };

  };
+
+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
 }
--- a/nixos/modules/services/networking/fakeroute.nix
+++ b/nixos/modules/services/networking/fakeroute.nix
@ -60,4 +60,6 @@ in

  };

+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
 }
--- a/nixos/modules/services/networking/monero.nix
+++ b/nixos/modules/services/networking/monero.nix
@ -224,15 +224,17 @@ in
      };
    };

-   assertions = singleton {
-     assertion = cfg.mining.enable -> cfg.mining.address != "";
-     message   = ''
+    assertions = singleton {
+      assertion = cfg.mining.enable -> cfg.mining.address != "";
+      message   = ''
       You need a Monero address to receive mining rewards:
       specify one using option monero.mining.address.
-    '';
-   };
+      '';
+    };

  };

+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
 }

--- a/nixos/modules/services/networking/namecoind.nix
+++ b/nixos/modules/services/networking/namecoind.nix
@ -201,4 +201,6 @@ in

  };

+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
 }
--- a/nixos/modules/services/networking/pdns-recursor.nix
+++ b/nixos/modules/services/networking/pdns-recursor.nix
@ -219,4 +219,6 @@ in {
     "To change extra Recursor settings use services.pdns-recursor.settings instead.")
  ];

+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
 }
--- a/nixos/modules/services/networking/privoxy.nix
+++ b/nixos/modules/services/networking/privoxy.nix
@ -109,4 +109,6 @@ in

  };

+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
 }
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@ -75,4 +75,6 @@ in

  };

+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
 }
--- a/nixos/modules/services/torrent/magnetico.nix
+++ b/nixos/modules/services/torrent/magnetico.nix
@ -213,4 +213,6 @@ in {

  };

+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
 }
--- a/nixos/modules/services/web-apps/wordpress.nix
+++ b/nixos/modules/services/web-apps/wordpress.nix
@ -127,7 +127,7 @@ let
            <note><para>These themes need to be packaged before use, see example.</para></note>
          '';
          example = ''
-            # For shits and giggles, let's package the responsive theme
+            # Let's package the responsive theme
            responsiveTheme = pkgs.stdenv.mkDerivation {
              name = "responsive-theme";
              # Download the theme from the wordpress site
--- a/nixos/modules/services/web-servers/nginx/vhost-options.nix
+++ b/nixos/modules/services/web-servers/nginx/vhost-options.nix
@ -207,6 +207,7 @@ with lib;
      default = null;
      description = ''
        Basic Auth password file for a vhost.
+        Can be created via: <command>htpasswd -c &lt;filename&gt; &lt;username&gt;</command>
      '';
    };

--- a/nixos/modules/services/x11/compton.nix
+++ b/nixos/modules/services/x11/compton.nix
@ -284,4 +284,6 @@ in {
    environment.systemPackages = [ pkgs.compton ];
  };

+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
 }
--- a/nixos/modules/services/x11/unclutter.nix
+++ b/nixos/modules/services/x11/unclutter.nix
@ -71,4 +71,7 @@ in {
      serviceConfig.Restart = "always";
    };
  };
+
+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
 }
--- a/nixos/modules/services/x11/urxvtd.nix
+++ b/nixos/modules/services/x11/urxvtd.nix
@ -45,4 +45,6 @@ in {
    environment.variables.RXVT_SOCKET = "/run/user/$(id -u)/urxvtd-socket";
  };

+  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
 }
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -12,6 +12,7 @@ let
  cfgSnapFlags = cfgSnapshots.flags;
  cfgScrub = config.services.zfs.autoScrub;
  cfgTrim = config.services.zfs.trim;
+  cfgZED = config.services.zfs.zed;

  inInitrd = any (fs: fs == "zfs") config.boot.initrd.supportedFilesystems;
  inSystem = any (fs: fs == "zfs") config.boot.supportedFilesystems;
@ -87,6 +88,17 @@ let
    }
  '';

+  zedConf = generators.toKeyValue {
+    mkKeyValue = generators.mkKeyValueDefault {
+      mkValueString = v:
+        if isInt           v then toString v
+        else if isString   v then "\"${v}\""
+        else if true  ==   v then "1"
+        else if false ==   v then "0"
+        else if isList     v then "\"" + (concatStringsSep " " v) + "\""
+        else err "this value is" (toString v);
+    } "=";
+  } cfgZED.settings;
 in

 {
@ -312,6 +324,32 @@ in
        '';
      };
    };
+
+    services.zfs.zed.settings = mkOption {
+      type = with types; attrsOf (oneOf [ str int bool (listOf str) ]);
+      example = literalExample ''
+        {
+          ZED_DEBUG_LOG = "/tmp/zed.debug.log";
+
+          ZED_EMAIL_ADDR = [ "root" ];
+          ZED_EMAIL_PROG = "mail";
+          ZED_EMAIL_OPTS = "-s '@SUBJECT@' @ADDRESS@";
+
+          ZED_NOTIFY_INTERVAL_SECS = 3600;
+          ZED_NOTIFY_VERBOSE = false;
+
+          ZED_USE_ENCLOSURE_LEDS = true;
+          ZED_SCRUB_AFTER_RESILVER = false;
+        }
+      '';
+      description = ''
+        ZFS Event Daemon /etc/zfs/zed.d/zed.rc content
+
+        See
+        <citerefentry><refentrytitle>zed</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+        for details on ZED and the scripts in /etc/zfs/zed.d to find the possible variables
+      '';
+    };
  };

  ###### implementation
@ -389,8 +427,32 @@ in
        zfsSupport = true;
      };

-      environment.etc."zfs/zed.d".source = "${packages.zfsUser}/etc/zfs/zed.d/";
-      environment.etc."zfs/zpool.d".source = "${packages.zfsUser}/etc/zfs/zpool.d/";
+      services.zfs.zed.settings = {
+        ZED_EMAIL_PROG = mkDefault "${pkgs.mailutils}/bin/mail";
+      };
+
+      environment.etc = genAttrs
+        (map
+          (file: "zfs/zed.d/${file}")
+          [
+            "all-syslog.sh"
+            "pool_import-led.sh"
+            "resilver_finish-start-scrub.sh"
+            "statechange-led.sh"
+            "vdev_attach-led.sh"
+            "zed-functions.sh"
+            "data-notify.sh"
+            "resilver_finish-notify.sh"
+            "scrub_finish-notify.sh"
+            "statechange-notify.sh"
+            "vdev_clear-led.sh"
+          ]
+        )
+        (file: { source = "${packages.zfsUser}/etc/${file}"; })
+      // {
+        "zfs/zed.d/zed.rc".text = zedConf;
+        "zfs/zpool.d".source = "${packages.zfsUser}/etc/zfs/zpool.d/";
+      };

      system.fsPackages = [ packages.zfsUser ]; # XXX: needed? zfs doesn't have (need) a fsck
      environment.systemPackages = [ packages.zfsUser ]
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -103,6 +103,7 @@ in
  grafana = handleTest ./grafana.nix {};
  graphite = handleTest ./graphite.nix {};
  graylog = handleTest ./graylog.nix {};
+  gvisor = handleTest ./gvisor.nix {};
  hadoop.hdfs = handleTestOn [ "x86_64-linux" ] ./hadoop/hdfs.nix {};
  hadoop.yarn = handleTestOn [ "x86_64-linux" ] ./hadoop/yarn.nix {};
  handbrake = handleTestOn ["x86_64-linux"] ./handbrake.nix {};
--- a/nixos/tests/gocd-agent.nix
+++ b/nixos/tests/gocd-agent.nix
@ -9,14 +9,18 @@ let
  header = "Accept: application/vnd.go.cd.v2+json";
 in

-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "gocd-agent";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ grahamc swarren83 ];
+
+    # gocd agent needs to register with the autoregister key created on first server startup,
+    # but NixOS module doesn't seem to allow to pass during runtime currently
+    broken = true;
  };

  nodes = {
-    gocd_agent =
+    agent =
      { ... }:
      {
        virtualisation.memorySize = 2046;
@ -30,11 +34,15 @@ import ./make-test.nix ({ pkgs, ...} : {
  };

  testScript = ''
-    startAll;
-    $gocd_agent->waitForUnit("gocd-server");
-    $gocd_agent->waitForOpenPort("8153");
-    $gocd_agent->waitForUnit("gocd-agent");
-    $gocd_agent->waitUntilSucceeds("curl ${serverUrl} -H '${header}' | ${pkgs.jq}/bin/jq -e ._embedded.agents[0].uuid");
-    $gocd_agent->succeed("curl ${serverUrl} -H '${header}' | ${pkgs.jq}/bin/jq -e ._embedded.agents[0].agent_state | grep -q Idle");
+    start_all()
+    agent.wait_for_unit("gocd-server")
+    agent.wait_for_open_port("8153")
+    agent.wait_for_unit("gocd-agent")
+    agent.wait_until_succeeds(
+        "curl ${serverUrl} -H '${header}' | ${pkgs.jq}/bin/jq -e ._embedded.agents[0].uuid"
+    )
+    agent.succeed(
+        "curl ${serverUrl} -H '${header}' | ${pkgs.jq}/bin/jq -e ._embedded.agents[0].agent_state | grep -q Idle"
+    )
  '';
 })
--- a/nixos/tests/gocd-server.nix
+++ b/nixos/tests/gocd-server.nix
@ -2,7 +2,7 @@
 #   1. GoCD server starts
 #   2. GoCD server responds

-import ./make-test.nix ({ pkgs, ...} :
+import ./make-test-python.nix ({ pkgs, ...} :

 {
  name = "gocd-server";
@ -10,19 +10,19 @@ import ./make-test.nix ({ pkgs, ...} :
    maintainers = [ swarren83 ];
  };

-nodes = {
-  gocd_server =
-    { ... }:
-    {
-      virtualisation.memorySize = 2046;
-      services.gocd-server.enable = true;
-    };
-};
+  nodes = {
+    server =
+      { ... }:
+      {
+        virtualisation.memorySize = 2046;
+        services.gocd-server.enable = true;
+      };
+  };

  testScript = ''
-    $gocd_server->start;
-    $gocd_server->waitForUnit("gocd-server");
-    $gocd_server->waitForOpenPort("8153");
-    $gocd_server->waitUntilSucceeds("curl -s -f localhost:8153/go");
+    server.start()
+    server.wait_for_unit("gocd-server")
+    server.wait_for_open_port(8153)
+    server.wait_until_succeeds("curl -s -f localhost:8153/go")
  '';
 })
--- a/nixos/tests/gvisor.nix
+++ b/nixos/tests/gvisor.nix
@ -0,0 +1,49 @@
+# This test runs a container through gvisor and checks if simple container starts
+
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "gvisor";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ andrew-d ];
+  };
+
+  nodes = {
+    gvisor =
+      { pkgs, ... }:
+        {
+          virtualisation.docker = {
+            enable = true;
+            extraOptions = "--add-runtime runsc=${pkgs.gvisor}/bin/runsc";
+          };
+
+          networking = {
+            dhcpcd.enable = false;
+            defaultGateway = "192.168.1.1";
+            interfaces.eth1.ipv4.addresses = pkgs.lib.mkOverride 0 [
+              { address = "192.168.1.2"; prefixLength = 24; }
+            ];
+          };
+        };
+    };
+
+  testScript = ''
+    start_all()
+
+    gvisor.wait_for_unit("network.target")
+    gvisor.wait_for_unit("sockets.target")
+
+    # Start by verifying that gvisor itself works
+    output = gvisor.succeed(
+        "${pkgs.gvisor}/bin/runsc -alsologtostderr do ${pkgs.coreutils}/bin/echo hello world"
+    )
+    assert output.strip() == "hello world"
+
+    # Also test the Docker runtime
+    gvisor.succeed("tar cv --files-from /dev/null | docker import - scratchimg")
+    gvisor.succeed(
+        "docker run -d --name=sleeping --runtime=runsc -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+    )
+    gvisor.succeed("docker ps | grep sleeping")
+    gvisor.succeed("docker stop sleeping")
+  '';
+})
+
--- a/nixos/tests/i3wm.nix
+++ b/nixos/tests/i3wm.nix
@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, ...} : {
+import ./make-test-python.nix ({ pkgs, ...} : {
  name = "i3wm";
  meta = with pkgs.stdenv.lib.maintainers; {
    maintainers = [ aszlig ];
@ -12,24 +12,35 @@ import ./make-test.nix ({ pkgs, ...} : {
  };

  testScript = { ... }: ''
-    $machine->waitForX;
-    $machine->waitForFile("/home/alice/.Xauthority");
-    $machine->succeed("xauth merge ~alice/.Xauthority");
-    $machine->waitForWindow(qr/first configuration/);
-    $machine->sleep(2);
-    $machine->screenshot("started");
-    $machine->sendKeys("ret");
-    $machine->sleep(2);
-    $machine->sendKeys("alt");
-    $machine->sleep(2);
-    $machine->screenshot("configured");
-    $machine->sendKeys("ret");
-    # make sure the config file is created before we continue
-    $machine->waitForFile("/home/alice/.config/i3/config");
-    $machine->sleep(2);
-    $machine->sendKeys("alt-ret");
-    $machine->waitForWindow(qr/alice.*machine/);
-    $machine->sleep(2);
-    $machine->screenshot("terminal");
+    with subtest("ensure x starts"):
+        machine.wait_for_x()
+        machine.wait_for_file("/home/alice/.Xauthority")
+        machine.succeed("xauth merge ~alice/.Xauthority")
+
+    with subtest("ensure we get first configuration window"):
+        machine.wait_for_window(r".*?first configuration.*?")
+        machine.sleep(2)
+        machine.screenshot("started")
+
+    with subtest("ensure we generate and save a config"):
+        # press return to indicate we want to gen a new config
+        machine.send_key("\n")
+        machine.sleep(2)
+        machine.screenshot("preconfig")
+        # press alt then return to indicate we want to use alt as our Mod key
+        machine.send_key("alt")
+        machine.send_key("\n")
+        machine.sleep(2)
+        # make sure the config file is created before we continue
+        machine.wait_for_file("/home/alice/.config/i3/config")
+        machine.screenshot("postconfig")
+        machine.sleep(2)
+
+    with subtest("ensure we can open a new terminal"):
+        machine.send_key("alt-ret")
+        machine.sleep(2)
+        machine.wait_for_window(r"alice.*?machine")
+        machine.sleep(2)
+        machine.screenshot("terminal")
  '';
 })
--- a/nixos/tests/ldap.nix
+++ b/nixos/tests/ldap.nix
@ -1,4 +1,4 @@
-import ./make-test.nix ({ pkgs, lib, ...} :
+import ./make-test-python.nix ({ pkgs, lib, ...} :

 let
  unlines = lib.concatStringsSep "\n";
@ -288,108 +288,118 @@ in

    client1 = mkClient true; # use nss_pam_ldapd
    client2 = mkClient false; # use nss_ldap and pam_ldap
-
  };

  testScript = ''
-    $server->start;
-    $server->waitForUnit("default.target");
+    def expect_script(*commands):
+        script = ";".join(commands)
+        return f"${pkgs.expect}/bin/expect -c '{script}'"

-    subtest "slapd", sub {
-      subtest "auth as database admin with SASL and check a POSIX account", sub {
-        $server->succeed(join ' ', 'test',
-         '"$(ldapsearch -LLL -H ldapi:// -Y EXTERNAL',
-             '-b \'uid=${ldapUser},ou=accounts,ou=posix,${dbSuffix}\' ',
-             '-s base uidNumber |',
-           'sed -ne \'s/^uidNumber: \\(.*\\)/\\1/p\' ',
-         ')" -eq ${toString ldapUserId}');
-      };
-      subtest "auth as database admin with password and check a POSIX account", sub {
-        $server->succeed(join ' ', 'test',
-         '"$(ldapsearch -LLL -H ldap://server',
-             '-D \'cn=admin,${dbSuffix}\' -w \'${dbAdminPwd}\' ',
-             '-b \'uid=${ldapUser},ou=accounts,ou=posix,${dbSuffix}\' ',
-             '-s base uidNumber |',
-           'sed -ne \'s/^uidNumber: \\(.*\\)/\\1/p\' ',
-         ')" -eq ${toString ldapUserId}');
-      };
-    };

-    $client1->start;
-    $client1->waitForUnit("default.target");
+    server.start()
+    server.wait_for_unit("default.target")

-    subtest "password", sub {
-      subtest "su with password to a POSIX account", sub {
-        $client1->succeed("${pkgs.expect}/bin/expect -c '" . join ';',
-          'spawn su "${ldapUser}"',
-          'expect "Password:"',
-          'send "${ldapUserPwd}\n"',
-          'expect "*"',
-          'send "whoami\n"',
-          'expect -ex "${ldapUser}" {exit}',
-          'exit 1' . "'");
-      };
-      subtest "change password of a POSIX account as root", sub {
-        $client1->succeed("chpasswd <<<'${ldapUser}:new-password'");
-        $client1->succeed("${pkgs.expect}/bin/expect -c '" . join ';',
-          'spawn su "${ldapUser}"',
-          'expect "Password:"',
-          'send "new-password\n"',
-          'expect "*"',
-          'send "whoami\n"',
-          'expect -ex "${ldapUser}" {exit}',
-          'exit 1' . "'");
-        $client1->succeed('chpasswd <<<\'${ldapUser}:${ldapUserPwd}\' ');
-      };
-      subtest "change password of a POSIX account from itself", sub {
-        $client1->succeed('chpasswd <<<\'${ldapUser}:${ldapUserPwd}\' ');
-        $client1->succeed("${pkgs.expect}/bin/expect -c '" . join ';',
-          'spawn su --login ${ldapUser} -c passwd',
-          'expect "Password: "',
-          'send "${ldapUserPwd}\n"',
-          'expect "(current) UNIX password: "',
-          'send "${ldapUserPwd}\n"',
-          'expect "New password: "',
-          'send "new-password\n"',
-          'expect "Retype new password: "',
-          'send "new-password\n"',
-          'expect "passwd: password updated successfully" {exit}',
-          'exit 1' . "'");
-        $client1->succeed("${pkgs.expect}/bin/expect -c '" . join ';',
-          'spawn su "${ldapUser}"',
-          'expect "Password:"',
-          'send "${ldapUserPwd}\n"',
-          'expect "su: Authentication failure" {exit}',
-          'exit 1' . "'");
-        $client1->succeed("${pkgs.expect}/bin/expect -c '" . join ';',
-          'spawn su "${ldapUser}"',
-          'expect "Password:"',
-          'send "new-password\n"',
-          'expect "*"',
-          'send "whoami\n"',
-          'expect -ex "${ldapUser}" {exit}',
-          'exit 1' . "'");
-        $client1->succeed('chpasswd <<<\'${ldapUser}:${ldapUserPwd}\' ');
-      };
-    };
+    with subtest("slapd: auth as database admin with SASL and check a POSIX account"):
+        server.succeed(
+            'test "$(ldapsearch -LLL -H ldapi:// -Y EXTERNAL '
+            + "-b 'uid=${ldapUser},ou=accounts,ou=posix,${dbSuffix}' "
+            + "-s base uidNumber | "
+            + "sed -ne 's/^uidNumber: \\(.*\\)/\\1/p')\" -eq ${toString ldapUserId}"
+        )

-    $client2->start;
-    $client2->waitForUnit("default.target");
+    with subtest("slapd: auth as database admin with password and check a POSIX account"):
+        server.succeed(
+            "test \"$(ldapsearch -LLL -H ldap://server -D 'cn=admin,${dbSuffix}' "
+            + "-w '${dbAdminPwd}' -b 'uid=${ldapUser},ou=accounts,ou=posix,${dbSuffix}' "
+            + "-s base uidNumber | "
+            + "sed -ne 's/^uidNumber: \\(.*\\)/\\1/p')\" -eq ${toString ldapUserId}"
+        )

-    subtest "NSS", sub {
-        $client1->succeed("test \"\$(id -u '${ldapUser}')\" -eq ${toString ldapUserId}");
-        $client1->succeed("test \"\$(id -u -n '${ldapUser}')\" = '${ldapUser}'");
-        $client1->succeed("test \"\$(id -g '${ldapUser}')\" -eq ${toString ldapGroupId}");
-        $client1->succeed("test \"\$(id -g -n '${ldapUser}')\" = '${ldapGroup}'");
-        $client2->succeed("test \"\$(id -u '${ldapUser}')\" -eq ${toString ldapUserId}");
-        $client2->succeed("test \"\$(id -u -n '${ldapUser}')\" = '${ldapUser}'");
-        $client2->succeed("test \"\$(id -g '${ldapUser}')\" -eq ${toString ldapGroupId}");
-        $client2->succeed("test \"\$(id -g -n '${ldapUser}')\" = '${ldapGroup}'");
-    };
+    client1.start()
+    client1.wait_for_unit("default.target")

-    subtest "PAM", sub {
-        $client1->succeed("echo ${ldapUserPwd} | su -l '${ldapUser}' -c true");
-        $client2->succeed("echo ${ldapUserPwd} | su -l '${ldapUser}' -c true");
-    };
+    with subtest("password: su with password to a POSIX account"):
+        client1.succeed(
+            expect_script(
+                'spawn su "${ldapUser}"',
+                'expect "Password:"',
+                'send "${ldapUserPwd}\n"',
+                'expect "*"',
+                'send "whoami\n"',
+                'expect -ex "${ldapUser}" {exit}',
+                "exit 1",
+            )
+        )
+
+    with subtest("password: change password of a POSIX account as root"):
+        client1.succeed(
+            "chpasswd <<<'${ldapUser}:new-password'",
+            expect_script(
+                'spawn su "${ldapUser}"',
+                'expect "Password:"',
+                'send "new-password\n"',
+                'expect "*"',
+                'send "whoami\n"',
+                'expect -ex "${ldapUser}" {exit}',
+                "exit 1",
+            ),
+            "chpasswd <<<'${ldapUser}:${ldapUserPwd}'",
+        )
+
+    with subtest("password: change password of a POSIX account from itself"):
+        client1.succeed(
+            "chpasswd <<<'${ldapUser}:${ldapUserPwd}' ",
+            expect_script(
+                "spawn su --login ${ldapUser} -c passwd",
+                'expect "Password: "',
+                'send "${ldapUserPwd}\n"',
+                'expect "(current) UNIX password: "',
+                'send "${ldapUserPwd}\n"',
+                'expect "New password: "',
+                'send "new-password\n"',
+                'expect "Retype new password: "',
+                'send "new-password\n"',
+                'expect "passwd: password updated successfully" {exit}',
+                "exit 1",
+            ),
+            expect_script(
+                'spawn su "${ldapUser}"',
+                'expect "Password:"',
+                'send "${ldapUserPwd}\n"',
+                'expect "su: Authentication failure" {exit}',
+                "exit 1",
+            ),
+            expect_script(
+                'spawn su "${ldapUser}"',
+                'expect "Password:"',
+                'send "new-password\n"',
+                'expect "*"',
+                'send "whoami\n"',
+                'expect -ex "${ldapUser}" {exit}',
+                "exit 1",
+            ),
+            "chpasswd <<<'${ldapUser}:${ldapUserPwd}'",
+        )
+
+    client2.start()
+    client2.wait_for_unit("default.target")
+
+    with subtest("NSS"):
+        client1.succeed(
+            "test \"$(id -u    '${ldapUser}')\" -eq ${toString ldapUserId}",
+            "test \"$(id -u -n '${ldapUser}')\" =  '${ldapUser}'",
+            "test \"$(id -g    '${ldapUser}')\" -eq ${toString ldapGroupId}",
+            "test \"$(id -g -n '${ldapUser}')\" =  '${ldapGroup}'",
+            "test \"$(id -u    '${ldapUser}')\" -eq ${toString ldapUserId}",
+            "test \"$(id -u -n '${ldapUser}')\" =  '${ldapUser}'",
+            "test \"$(id -g    '${ldapUser}')\" -eq ${toString ldapGroupId}",
+            "test \"$(id -g -n '${ldapUser}')\" =  '${ldapGroup}'",
+        )
+
+    with subtest("PAM"):
+        client1.succeed(
+            "echo ${ldapUserPwd} | su -l '${ldapUser}' -c true",
+            "echo ${ldapUserPwd} | su -l '${ldapUser}' -c true",
+        )
  '';
 })
--- a/nixos/tests/moinmoin.nix
+++ b/nixos/tests/moinmoin.nix
@ -1,6 +1,6 @@
-import ./make-test.nix ({ pkgs, lib, ... }: {
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
  name = "moinmoin";
-  meta.maintainers = [ ]; # waiting for https://github.com/NixOS/nixpkgs/pull/65397
+  meta.maintainers = with lib.maintainers; [ mmilata ];

  machine =
    { ... }:
@ -13,12 +13,16 @@ import ./make-test.nix ({ pkgs, lib, ... }: {
    };

  testScript = ''
-    startAll;
+    start_all()

-    $machine->waitForUnit('moin-ExampleWiki.service');
-    $machine->waitForUnit('nginx.service');
-    $machine->waitForFile('/run/moin/ExampleWiki/gunicorn.sock');
-    $machine->succeed('curl -L http://localhost/') =~ /If you have just installed/ or die;
-    $machine->succeed('moin-ExampleWiki account create --name=admin --email=admin@example.com --password=foo 2>&1') =~ /status success/ or die;
+    machine.wait_for_unit("moin-ExampleWiki.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_file("/run/moin/ExampleWiki/gunicorn.sock")
+
+    assert "If you have just installed" in machine.succeed("curl -L http://localhost/")
+
+    assert "status success" in machine.succeed(
+        "moin-ExampleWiki account create --name=admin --email=admin@example.com --password=foo 2>&1"
+    )
  '';
 })
--- a/nixos/tests/openldap.nix
+++ b/nixos/tests/openldap.nix
@ -1,4 +1,4 @@
-import ./make-test.nix {
+import ./make-test-python.nix {
  name = "openldap";

  machine = { pkgs, ... }: {
@ -24,8 +24,10 @@ import ./make-test.nix {
  };

  testScript = ''
-    $machine->waitForUnit('openldap.service');
-    $machine->succeed('systemctl status openldap.service');
-    $machine->succeed('ldapsearch -LLL -D "cn=root,dc=example" -w notapassword -b "dc=example"');
+    machine.wait_for_unit("openldap.service")
+    machine.succeed(
+        "systemctl status openldap.service",
+        'ldapsearch -LLL -D "cn=root,dc=example" -w notapassword -b "dc=example"',
+    )
  '';
 }
--- a/nixos/tests/pam-oath-login.nix
+++ b/nixos/tests/pam-oath-login.nix
@ -1,4 +1,4 @@
-import ./make-test.nix ({ ... }:
+import ./make-test-python.nix ({ ... }:

 let
  oathSnakeoilSecret = "cdd4083ef8ff1fa9178c6d46bfb1a3";
@ -55,70 +55,54 @@ in
      };
    };

-  testScript =
-    ''
-      $machine->waitForUnit('multi-user.target');
-      $machine->waitUntilSucceeds("pgrep -f 'agetty.*tty1'");
-      $machine->screenshot("postboot");
+  testScript = ''
+    def switch_to_tty(tty_number):
+        machine.fail(f"pgrep -f 'agetty.*tty{tty_number}'")
+        machine.send_key(f"alt-f{tty_number}")
+        machine.wait_until_succeeds(f"[ $(fgconsole) = {tty_number} ]")
+        machine.wait_for_unit(f"getty@tty{tty_number}.service")
+        machine.wait_until_succeeds(f"pgrep -f 'agetty.*tty{tty_number}'")


-      subtest "Invalid password", sub {
-        $machine->fail("pgrep -f 'agetty.*tty2'");
-        $machine->sendKeys("alt-f2");
-        $machine->waitUntilSucceeds("[ \$(fgconsole) = 2 ]");
-        $machine->waitForUnit('getty@tty2.service');
-        $machine->waitUntilSucceeds("pgrep -f 'agetty.*tty2'");
+    def enter_user_alice(tty_number):
+        machine.wait_until_tty_matches(tty_number, "login: ")
+        machine.send_chars("alice\n")
+        machine.wait_until_tty_matches(tty_number, "login: alice")
+        machine.wait_until_succeeds("pgrep login")
+        machine.wait_until_tty_matches(tty_number, "One-time password")

-        $machine->waitUntilTTYMatches(2, "login: ");
-        $machine->sendChars("alice\n");
-        $machine->waitUntilTTYMatches(2, "login: alice");
-        $machine->waitUntilSucceeds("pgrep login");

-        $machine->waitUntilTTYMatches(2, "One-time password");
-        $machine->sendChars("${oathSnakeOilPassword1}\n");
-        $machine->waitUntilTTYMatches(2, "Password: ");
-        $machine->sendChars("blorg\n");
-        $machine->waitUntilTTYMatches(2, "Login incorrect");
-      };
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
+    machine.screenshot("postboot")

-      subtest "Invalid oath token", sub {
-        $machine->fail("pgrep -f 'agetty.*tty3'");
-        $machine->sendKeys("alt-f3");
-        $machine->waitUntilSucceeds("[ \$(fgconsole) = 3 ]");
-        $machine->waitForUnit('getty@tty3.service');
-        $machine->waitUntilSucceeds("pgrep -f 'agetty.*tty3'");
+    with subtest("Invalid password"):
+        switch_to_tty(2)
+        enter_user_alice(2)

-        $machine->waitUntilTTYMatches(3, "login: ");
-        $machine->sendChars("alice\n");
-        $machine->waitUntilTTYMatches(3, "login: alice");
-        $machine->waitUntilSucceeds("pgrep login");
-        $machine->waitUntilTTYMatches(3, "One-time password");
-        $machine->sendChars("000000\n");
-        $machine->waitUntilTTYMatches(3, "Login incorrect");
-        $machine->waitUntilTTYMatches(3, "login:");
-      };
+        machine.send_chars("${oathSnakeOilPassword1}\n")
+        machine.wait_until_tty_matches(2, "Password: ")
+        machine.send_chars("blorg\n")
+        machine.wait_until_tty_matches(2, "Login incorrect")

-      subtest "Happy path (both passwords are mandatory to get us in)", sub {
-        $machine->fail("pgrep -f 'agetty.*tty4'");
-        $machine->sendKeys("alt-f4");
-        $machine->waitUntilSucceeds("[ \$(fgconsole) = 4 ]");
-        $machine->waitForUnit('getty@tty4.service');
-        $machine->waitUntilSucceeds("pgrep -f 'agetty.*tty4'");
+    with subtest("Invalid oath token"):
+        switch_to_tty(3)
+        enter_user_alice(3)

-        $machine->waitUntilTTYMatches(4, "login: ");
-        $machine->sendChars("alice\n");
-        $machine->waitUntilTTYMatches(4, "login: alice");
-        $machine->waitUntilSucceeds("pgrep login");
-        $machine->waitUntilTTYMatches(4, "One-time password");
-        $machine->sendChars("${oathSnakeOilPassword2}\n");
-        $machine->waitUntilTTYMatches(4, "Password: ");
-        $machine->sendChars("${alicePassword}\n");
+        machine.send_chars("000000\n")
+        machine.wait_until_tty_matches(3, "Login incorrect")
+        machine.wait_until_tty_matches(3, "login:")

-        $machine->waitUntilSucceeds("pgrep -u alice bash");
-        $machine->sendChars("touch  done4\n");
-        $machine->waitForFile("/home/alice/done4");
-      };
+    with subtest("Happy path: Both passwords are mandatory to get us in"):
+        switch_to_tty(4)
+        enter_user_alice(4)

+        machine.send_chars("${oathSnakeOilPassword2}\n")
+        machine.wait_until_tty_matches(4, "Password: ")
+        machine.send_chars("${alicePassword}\n")
+
+        machine.wait_until_succeeds("pgrep -u alice bash")
+        machine.send_chars("touch  done4\n")
+        machine.wait_for_file("/home/alice/done4")
    '';
-
 })
--- a/nixos/tests/tiddlywiki.nix
+++ b/nixos/tests/tiddlywiki.nix
@ -1,4 +1,4 @@
-import ./make-test.nix ({ ... }: {
+import ./make-test-python.nix ({ ... }: {
  name = "tiddlywiki";
  nodes = {
    default = {
@ -20,48 +20,50 @@ import ./make-test.nix ({ ... }: {
    };
  };

-  testScript = ''
-    startAll;
+  testScript =
+    ''
+      start_all()

-    subtest "by default works without configuration", sub {
-      $default->waitForUnit("tiddlywiki.service");
-    };
+      with subtest("by default works without configuration"):
+          default.wait_for_unit("tiddlywiki.service")

-    subtest "by default available on port 8080 without auth", sub {
-      $default->waitForUnit("tiddlywiki.service");
-      $default->waitForOpenPort(8080);
-      $default->succeed("curl --fail 127.0.0.1:8080");
-    };
+      with subtest("by default available on port 8080 without auth"):
+          default.wait_for_unit("tiddlywiki.service")
+          default.wait_for_open_port(8080)
+          # we output to /dev/null here to avoid a python UTF-8 decode error
+          # but the check will still fail if the service doesn't respond
+          default.succeed("curl --fail -o /dev/null 127.0.0.1:8080")

-    subtest "by default creates empty wiki", sub {
-      $default->succeed("test -f /var/lib/tiddlywiki/tiddlywiki.info");
-    };
+      with subtest("by default creates empty wiki"):
+          default.succeed("test -f /var/lib/tiddlywiki/tiddlywiki.info")

-    subtest "configured on port 3000 with basic auth", sub {
-      $configured->waitForUnit("tiddlywiki.service");
-      $configured->waitForOpenPort(3000);
-      $configured->fail("curl --fail 127.0.0.1:3000");
-      $configured->succeed("curl --fail 127.0.0.1:3000 --user somelogin:somesecret");
-    };
+      with subtest("configured on port 3000 with basic auth"):
+          configured.wait_for_unit("tiddlywiki.service")
+          configured.wait_for_open_port(3000)
+          configured.fail("curl --fail -o /dev/null 127.0.0.1:3000")
+          configured.succeed(
+              "curl --fail -o /dev/null 127.0.0.1:3000 --user somelogin:somesecret"
+          )
+      
+      with subtest("restart preserves changes"):
+          # given running wiki
+          default.wait_for_unit("tiddlywiki.service")
+          # with some changes
+          default.succeed(
+              'curl --fail --request PUT --header \'X-Requested-With:TiddlyWiki\' \
+              --data \'{ "title": "title", "text": "content" }\' \
+              --url 127.0.0.1:8080/recipes/default/tiddlers/somepage '
+          )
+          default.succeed("sleep 2")

-    subtest "configured with different wikifolder", sub {
-      $configured->succeed("test -f /var/lib/tiddlywiki/tiddlywiki.info");
-    };
+          # when wiki is cycled
+          default.systemctl("restart tiddlywiki.service")
+          default.wait_for_unit("tiddlywiki.service")
+          default.wait_for_open_port(8080)

-    subtest "restart preserves changes", sub {
-      # given running wiki
-      $default->waitForUnit("tiddlywiki.service");
-      # with some changes
-      $default->succeed("curl --fail --request PUT --header 'X-Requested-With:TiddlyWiki' --data '{ \"title\": \"title\", \"text\": \"content\" }' --url 127.0.0.1:8080/recipes/default/tiddlers/somepage ");
-      $default->succeed("sleep 2"); # server syncs to filesystem on timer
-
-      # when wiki is cycled
-      $default->systemctl("restart tiddlywiki.service");
-      $default->waitForUnit("tiddlywiki.service");
-      $default->waitForOpenPort(8080);
-
-      # the change is preserved
-      $default->succeed("curl --fail 127.0.0.1:8080/recipes/default/tiddlers/somepage");
-    };
-  '';
+          # the change is preserved
+          default.succeed(
+              "curl --fail -o /dev/null 127.0.0.1:8080/recipes/default/tiddlers/somepage"
+          )
+    '';
 })
--- a/pkgs/applications/audio/cantata/default.nix
+++ b/pkgs/applications/audio/cantata/default.nix
@ -80,7 +80,7 @@ in mkDerivation {
    homepage    = https://github.com/cdrummond/cantata;
    description = "A graphical client for MPD";
    license     = licenses.gpl3;
-    maintainers = with maintainers; [ fuuzetsu peterhoeg ];
+    maintainers = with maintainers; [ peterhoeg ];
    # Technically Cantata can run on Windows so if someone wants to
    # bother figuring that one out, be my guest.
    platforms   = platforms.linux;
--- a/pkgs/applications/audio/easytag/default.nix
+++ b/pkgs/applications/audio/easytag/default.nix
@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {
    description = "View and edit tags for various audio files";
    homepage = https://wiki.gnome.org/Apps/EasyTAG;
    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ fuuzetsu ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/audio/opus-tools/default.nix
+++ b/pkgs/applications/audio/opus-tools/default.nix
@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
    description = "Tools to work with opus encoded audio streams";
    homepage = http://www.opus-codec.org/;
    license = stdenv.lib.licenses.bsd2;
-    maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
+    maintainers = with stdenv.lib.maintainers; [ ];
    platforms = with stdenv.lib.platforms; unix;
  };
 }
--- a/pkgs/applications/audio/opusfile/default.nix
+++ b/pkgs/applications/audio/opusfile/default.nix
@ -18,6 +18,6 @@ stdenv.mkDerivation rec {
    homepage = http://www.opus-codec.org/;
    license = licenses.bsd3;
    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ fuuzetsu ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/audio/snd/default.nix
+++ b/pkgs/applications/audio/snd/default.nix
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    homepage = http://ccrma.stanford.edu/software/snd;
    platforms = stdenv.lib.platforms.linux;
    license = stdenv.lib.licenses.free;
-    maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
+    maintainers = with stdenv.lib.maintainers; [ ];
  };


--- a/pkgs/applications/blockchains/bitcoin-abc.nix
+++ b/pkgs/applications/blockchains/bitcoin-abc.nix
@ -1,19 +1,19 @@
-{ stdenv, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db53, boost
+{ stdenv, mkDerivation, fetchFromGitHub, pkgconfig, autoreconfHook, openssl, db53, boost
 , zlib, miniupnpc, qtbase ? null , qttools ? null, utillinux, protobuf, qrencode, libevent
 , withGui }:

 with stdenv.lib;

-stdenv.mkDerivation rec {
+mkDerivation rec {

  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-abc-" + version;
-  version = "0.20.6";
+  version = "0.20.7";

  src = fetchFromGitHub {
    owner = "bitcoin-ABC";
    repo = "bitcoin-abc";
    rev = "v${version}";
-    sha256 = "1a65pykdjkiic67fcs8cg2qrvzzrqifa93r1bzza3gdyfdvgv3ww";
+    sha256 = "1d17ry9906zmwj2n3mh77b6rqmdg0dgm7b7ybh8d7q2ml0196ilj";
  };

  patches = [ ./fix-bitcoin-qt-build.patch ];
--- a/pkgs/applications/blockchains/bitcoin.nix
+++ b/pkgs/applications/blockchains/bitcoin.nix
@ -1,24 +1,24 @@
 { stdenv, fetchurl, pkgconfig, autoreconfHook, openssl, db48, boost, zeromq, rapidcheck
-, zlib, miniupnpc, qtbase ? null, qttools ? null, wrapQtAppsHook ? null, utillinux, protobuf, python3, qrencode, libevent
+, zlib, miniupnpc, qtbase ? null, qttools ? null, wrapQtAppsHook ? null, utillinux, python3, qrencode, libevent
 , withGui }:

 with stdenv.lib;
 stdenv.mkDerivation rec{
-  name = "bitcoin" + (toString (optional (!withGui) "d")) + "-" + version;
-  version = "0.18.1";
+  pname = if withGui then "bitcoin" else "bitcoind";
+  version = "0.19.0.1";

  src = fetchurl {
    urls = [ "https://bitcoincore.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
             "https://bitcoin.org/bin/bitcoin-core-${version}/bitcoin-${version}.tar.gz"
           ];
-    sha256 = "5c7d93f15579e37aa2d1dc79e8f5ac675f59045fceddf604ae0f1550eb03bf96";
+    sha256 = "7ac9f972249a0a16ed01352ca2a199a5448fe87a4ea74923404a40b4086de284";
  };

  nativeBuildInputs =
    [ pkgconfig autoreconfHook ]
    ++ optional withGui wrapQtAppsHook;
  buildInputs = [ openssl db48 boost zlib zeromq
-                  miniupnpc protobuf libevent]
+                  miniupnpc libevent]
                  ++ optionals stdenv.isLinux [ utillinux ]
                  ++ optionals withGui [ qtbase qttools qrencode ];

--- a/pkgs/applications/editors/emacs-modes/elpa-packages.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-packages.nix
@ -40,6 +40,9 @@ self: let
      cl-lib = null; # builtin
      tle = null; # builtin
      advice = null; # builtin
+      seq = if lib.versionAtLeast self.emacs.version "27"
+            then null
+            else super.seq;
    };

    elpaPackages = super // overrides;
--- a/pkgs/applications/editors/flpsed/default.nix
+++ b/pkgs/applications/editors/flpsed/default.nix
@ -22,6 +22,6 @@ stdenv.mkDerivation rec {
    homepage = http://flpsed.org/flpsed.html;
    license = licenses.gpl3;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ fuuzetsu ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/editors/kdevelop5/kdev-php.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-php.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "kdev-php";
-  version = "5.4.4";
+  version = "5.4.5";

  src = fetchurl {
    url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "1q80vh2b4bmpa3sh94b6jsa5ymqr6hcn76mr2lyw30h2ppy5hm5l";
+    sha256 = "12j0l2k6ii9ajp90lil3apk0xsz56cb549ighabik73a1w3c6ib6";
  };

  nativeBuildInputs = [ cmake extra-cmake-modules ];
--- a/pkgs/applications/editors/kdevelop5/kdev-python.nix
+++ b/pkgs/applications/editors/kdevelop5/kdev-python.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "kdev-python";
-  version = "5.4.4";
+  version = "5.4.5";

  src = fetchurl {
    url = "https://github.com/KDE/${pname}/archive/v${version}.tar.gz";
-    sha256 = "04ig8vmn85z15mlngha4ybynjlmv9g9dn48y58wqrkif2ssliq7m";
+    sha256 = "1iq4lxbl8gq4qvydyz34ild4izw21cp22adlz9dc054v0wis331j";
  };

  cmakeFlags = [
--- a/pkgs/applications/editors/kdevelop5/kdevelop.nix
+++ b/pkgs/applications/editors/kdevelop5/kdevelop.nix
@ -10,11 +10,11 @@

 mkDerivation rec {
  pname = "kdevelop";
-  version = "5.4.4";
+  version = "5.4.5";

  src = fetchurl {
    url = "mirror://kde/stable/${pname}/${version}/src/${pname}-${version}.tar.xz";
-    sha256 = "1cangz3ghz39sxxggp2p7kqy2ncgs0r3i19c341b5xbkcxw2y20h";
+    sha256 = "08vhbg9ql0402bw3y3xw1kdxhig9sv3ss8g0h4477vy3z17m1h4j";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/editors/yi/wrapper.nix
+++ b/pkgs/applications/editors/yi/wrapper.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation {
    description = "Allows Yi to find libraries and the compiler easily";
    # This wrapper and wrapper only is under PD
    license = licenses.publicDomain;
-    maintainers = with maintainers; [ fuuzetsu ];
+    maintainers = with maintainers; [ ];
  };

 }
--- a/pkgs/applications/graphics/akira/default.nix
+++ b/pkgs/applications/graphics/akira/default.nix
@ -0,0 +1,76 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, appstream-glib
+, desktop-file-utils
+, meson
+, ninja
+, pantheon
+, pkgconfig
+, python3
+, vala
+, vala-lint
+, wrapGAppsHook
+, cairo
+, glib
+, goocanvas2
+, gtk3
+, gtksourceview3
+, json-glib
+, libarchive
+, libgee
+, libxml2 }:
+
+stdenv.mkDerivation rec {
+  pname = "akira";
+  version = "2019-10-12";
+
+  src = fetchFromGitHub {
+    owner = "akiraux";
+    repo = "Akira";
+    rev = "cab952dee4591b6bde34d670c1f853f5a3ff6b19";
+    sha256 = "1fp3a79hkh6xwwqqdrx4zqq2zhsm236c6fhhl5f2nmi108yxz04q";
+  };
+
+  nativeBuildInputs = [
+    appstream-glib
+    desktop-file-utils
+    meson
+    ninja
+    pkgconfig
+    python3
+    vala
+    vala-lint
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    cairo
+    glib
+    goocanvas2
+    pantheon.granite
+    gtk3
+    gtksourceview3
+    json-glib
+    libarchive
+    libgee
+    libxml2
+  ];
+
+  mesonFlags = [ "-Dprofile=default" ];
+
+  patches = [ ./fix-build-with-vala-0-44-or-later.patch ];
+
+  postPatch = ''
+    chmod +x build-aux/meson/post_install.py
+    patchShebangs build-aux/meson/post_install.py
+  '';
+
+  meta = with lib; {
+    description = "Native Linux Design application built in Vala and GTK";
+    homepage = "https://github.com/akiraux/Akira";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ filalex77 ] ++ pantheon.maintainers;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/graphics/akira/fix-build-with-vala-0-44-or-later.patch
+++ b/pkgs/applications/graphics/akira/fix-build-with-vala-0-44-or-later.patch
@ -0,0 +1,88 @@
+From bcda8fd53f6f232db0b6411269ba108af551629f Mon Sep 17 00:00:00 2001
+From: Alberto Fanjul <albertofanjul@gmail.com>
+Date: Tue, 9 Apr 2019 09:45:36 +0200
+Subject: [PATCH] Build on vala >= 0.44.2
+
+---
+ src/FileFormat/JsonObject.vala        |  2 +-
+ src/FileFormat/JsonObjectArray.vala   |  2 +-
+ src/FileFormat/ZipArchiveHandler.vala | 18 +++++++++++++++++-
+ 3 files changed, 19 insertions(+), 3 deletions(-)
+
+diff --git a/src/FileFormat/JsonObject.vala b/src/FileFormat/JsonObject.vala
+index 7bfe46f..805fbad 100644
+--- a/src/FileFormat/JsonObject.vala
+++ b/src/FileFormat/JsonObject.vala
+@@ -31,7 +31,7 @@ public abstract class Akira.FileFormat.JsonObject : GLib.Object {
+ 
+     private ObjectClass obj_class;
+ 
+-    public JsonObject.from_object (Json.Object object) {
+    protected JsonObject.from_object (Json.Object object) {
+         Object (object: object);
+     }
+ 
+diff --git a/src/FileFormat/JsonObjectArray.vala b/src/FileFormat/JsonObjectArray.vala
+index 4f6e573..d0a7dad 100644
+--- a/src/FileFormat/JsonObjectArray.vala
+++ b/src/FileFormat/JsonObjectArray.vala
+@@ -31,7 +31,7 @@ public abstract class Akira.FileFormat.JsonObjectArray : Object {
+      *
+      * Your JsonObject implementation should have it's own list of items
+      */
+-    public JsonObjectArray (Json.Object object, string property_name) {
+    protected JsonObjectArray (Json.Object object, string property_name) {
+         Object (object: object, property_name: property_name);
+     }
+ 
+diff --git a/src/FileFormat/ZipArchiveHandler.vala b/src/FileFormat/ZipArchiveHandler.vala
+index ca60dd0..5d65aa2 100644
+--- a/src/FileFormat/ZipArchiveHandler.vala
+++ b/src/FileFormat/ZipArchiveHandler.vala
+@@ -262,11 +262,17 @@ public class Akira.FileFormat.ZipArchiveHandler : GLib.Object {
+                 continue;
+             }
+ 
+            Posix.off_t offset;
+#if VALA_0_42
+            uint8[] buffer;
+            while (archive.read_data_block (out buffer, out offset) == Archive.Result.OK) {
+                if (extractor.write_data_block (buffer, offset) != Archive.Result.OK) {
+#else
+             void* buffer = null;
+             size_t buffer_length;
+-            Posix.off_t offset;
+             while (archive.read_data_block (out buffer, out buffer_length, out offset) == Archive.Result.OK) {
+                 if (extractor.write_data_block (buffer, buffer_length, offset) != Archive.Result.OK) {
+#endif
+                     break;
+                 }
+             }
+@@ -316,9 +322,15 @@ public class Akira.FileFormat.ZipArchiveHandler : GLib.Object {
+                     // Add an entry to the archive
+                     Archive.Entry entry = new Archive.Entry ();
+                     entry.set_pathname (initial_folder.get_relative_path (current_file));
+#if VALA_0_42
+                    entry.set_size ((Archive.int64_t) file_info.get_size ());
+                    entry.set_filetype (Archive.FileType.IFREG);
+                    entry.set_perm (Archive.FileType.IFREG);
+#else
+                     entry.set_size (file_info.get_size ());
+                     entry.set_filetype ((uint) Posix.S_IFREG);
+                     entry.set_perm (0644);
+#endif
+ 
+                     if (archive.write_header (entry) != Archive.Result.OK) {
+                         critical ("Error writing '%s': %s (%d)", current_file.get_path (), archive.error_string (), archive.errno ());
+@@ -333,7 +345,11 @@ public class Akira.FileFormat.ZipArchiveHandler : GLib.Object {
+                             break;
+                         }
+ 
+#if VALA_0_42
+                        archive.write_data (buffer[0:bytes_read]);
+#else
+                         archive.write_data (buffer, bytes_read);
+#endif
+                     }
+                 }
+             }
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "drawio";
-  version = "12.2.2";
+  version = "12.3.2";

  src = fetchurl {
    url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/draw.io-x86_64-${version}.rpm";
-    sha256 = "04h11gdy78py9zrs3v6y0hhhc2n1h4s0ymbvf6qn4vv4r3r9vbaw";
+    sha256 = "1hh4616dbq0fqldlph7vyl8vkibwc3xpcv9r1m2v949kn84yi2j3";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@ -157,6 +157,8 @@ in stdenv.mkDerivation rec {
    "--without-webkit" # old version is required
    "--with-bug-report-url=https://github.com/NixOS/nixpkgs/issues/new"
    "--with-icc-directory=/run/current-system/sw/share/color/icc"
+    # fix libdir in pc files (${exec_prefix} needs to be passed verbatim)
+    "--libdir=\${exec_prefix}/lib"
  ];

  # on Darwin,
--- a/pkgs/applications/graphics/mcomix/default.nix
+++ b/pkgs/applications/graphics/mcomix/default.nix
@ -27,7 +27,7 @@ python27Packages.buildPythonApplication rec {
      '';
      homepage = http://mcomix.sourceforge.net/;
      license = stdenv.lib.licenses.gpl2;
-      maintainers = with stdenv.lib.maintainers; [ fuuzetsu AndersonTorres ];
+      maintainers = with stdenv.lib.maintainers; [ AndersonTorres ];
    };
 }
 # TODO:
--- a/pkgs/applications/graphics/sxiv/default.nix
+++ b/pkgs/applications/graphics/sxiv/default.nix
@ -33,6 +33,6 @@ stdenv.mkDerivation rec {
    homepage = https://github.com/muennich/sxiv;
    license = stdenv.lib.licenses.gpl2Plus;
    platforms = stdenv.lib.platforms.linux;
-    maintainers = with maintainers; [ jfrankenau fuuzetsu ];
+    maintainers = with maintainers; [ jfrankenau ];
  };
 }
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@ -1,14 +1,14 @@
-{ lib, fetchurl, python3Packages, qtbase, wrapQtAppsHook }:
+{ lib, fetchFromGitHub, python3Packages, qtbase, wrapQtAppsHook }:

 python3Packages.buildPythonApplication rec {
  pname = "electron-cash";
-  version = "4.0.10";
+  version = "4.0.11";

-  src = fetchurl {
-    url = "https://electroncash.org/downloads/${version}/win-linux/Electron-Cash-${version}.tar.gz";
-    # Verified using official SHA-1 and signature from
-    # https://github.com/fyookball/keys-n-hashes
-    sha256 = "48270e12956a2f4ef4d2b0cb60611e47f136b734a3741dab176542a32ae59ee5";
+  src = fetchFromGitHub {
+    owner = "Electron-Cash";
+    repo = "Electron-Cash";
+    rev = version;
+    sha256 = "1k4zbaj0g8bgk1l5vrb835a8bqfay2707bcb4ql2vx4igcwpb680";
  };

  propagatedBuildInputs = with python3Packages; [
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,18 +2,18 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.60.0";
+  version = "0.60.1";

  goPackagePath = "github.com/gohugoio/hugo";

  src = fetchFromGitHub {
-    owner  = "gohugoio";
-    repo   = pname;
-    rev    = "v${version}";
-    sha256 = "0g8rq79xp7c9p31xc0anfjyz7xp8n7qzv3vmvg2nmzl7nayg88aa";
+    owner = "gohugoio";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0l8n87y5zrs09s693rqvqwz0233wlr4jwib7r36ilss1qgm7x6n5";
  };

-  modSha256 = "12h1ik1hgs4lkmk699wpa34rnycnm03qyr2vp1y5lywz1h93by20";
+  modSha256 = "1an4plbx06fzz2iqzgs08r6vsjpkl5lbqck5jqmv6fv7b7psf7iw";

  buildFlags = "-tags extended";

@ -21,8 +21,8 @@ buildGoModule rec {

  meta = with stdenv.lib; {
    description = "A fast and modern static website engine.";
-    homepage = https://gohugo.io;
+    homepage = "https://gohugo.io";
    license = licenses.asl20;
-    maintainers = with maintainers; [ schneefux ];
+    maintainers = with maintainers; [ schneefux filalex77 ];
  };
 }
--- a/pkgs/applications/misc/nnn/default.nix
+++ b/pkgs/applications/misc/nnn/default.nix
@ -4,13 +4,13 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "nnn";
-  version = "2.7";
+  version = "2.8.1";

  src = fetchFromGitHub {
    owner = "jarun";
    repo = pname;
    rev = "v${version}";
-    sha256 = "19kiikjblkq3bx2j6h3f2d467p2v582albqr7nbrm9c1yg4qx38z";
+    sha256 = "0h7j0wcpwwd2fibggr1nwkqpvhv2i1qnk54c4x6hixx31yidy2l0";
  };

  configFile = optionalString (conf!=null) (builtins.toFile "nnn.h" conf);
--- a/pkgs/applications/misc/vifm/default.nix
+++ b/pkgs/applications/misc/vifm/default.nix
@ -1,11 +1,15 @@
-{ stdenv, fetchurl
+{ stdenv, fetchurl, makeWrapper
 , pkgconfig
 , ncurses, libX11
 , utillinux, file, which, groff
+
+  # adds support for handling removable media (vifm-media). Linux only!
+, mediaSupport ? false, python3 ? null, udisks2 ? null, lib ? null 
 }:

-stdenv.mkDerivation rec {
-  pname = "vifm";
+let isFullPackage = mediaSupport;
+in stdenv.mkDerivation rec {
+  pname = if isFullPackage then "vifm-full" else "vifm";
  version = "0.10.1";

  src = fetchurl {
@ -13,13 +17,24 @@ stdenv.mkDerivation rec {
    sha256 = "0fyhxh7ndjn8fyjhj14ymkr3pjcs3k1xbs43g7xvvq85vdb6y04r";
  };

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ pkgconfig makeWrapper ];
  buildInputs = [ ncurses libX11 utillinux file which groff ];

+  postFixup = let
+    path = lib.makeBinPath 
+      [ udisks2 
+        (python3.withPackages (p: [p.dbus-python]))
+      ];
+
+    wrapVifmMedia = "wrapProgram $out/share/vifm/vifm-media --prefix PATH : ${path}";
+  in ''
+    ${if mediaSupport then wrapVifmMedia else ""}
+  '';
+
  meta = with stdenv.lib; {
-    description = "A vi-like file manager";
+    description = ''A vi-like file manager${if isFullPackage then "; Includes support for optional features" else ""}'';
    maintainers = with maintainers; [ raskin ];
-    platforms = platforms.unix;
+    platforms = if mediaSupport then platforms.linux else platforms.unix;
    license = licenses.gpl2;
    downloadPage = "https://vifm.info/downloads.shtml";
    homepage = https://vifm.info/;
--- a/pkgs/applications/misc/workrave/default.nix
+++ b/pkgs/applications/misc/workrave/default.nix
@ -9,8 +9,7 @@ stdenv.mkDerivation rec {
  pname = "workrave";
  version = "1.10.31";

-  src = let
-  in fetchFromGitHub {
+  src = fetchFromGitHub {
    sha256 = "0v2mx2idaxlsyv5w66b7pknlill9j9i2gqcs3vq54gak7ix9fj1p";
    rev = with stdenv.lib;
      "v" + concatStringsSep "_" (splitVersion version);
--- a/pkgs/applications/misc/xdgmenumaker/default.nix
+++ b/pkgs/applications/misc/xdgmenumaker/default.nix
@ -1,33 +1,43 @@
-{ stdenv, fetchFromGitHub, txt2tags, python2Packages }:
+{ stdenv, fetchFromGitHub, txt2tags, python3Packages, glib, gobject-introspection, wrapGAppsHook }:

-stdenv.mkDerivation rec {
+python3Packages.buildPythonApplication rec {
  pname = "xdgmenumaker";
  version = "1.5";

  src = fetchFromGitHub {
    owner = "gapan";
-    repo = "xdgmenumaker";
+    repo = pname;
    rev = version;
    sha256 = "1vrsp5c1ah7p4dpwd6aqvinpwzd8crdimvyyr3lbm3c6cwpyjmif";
  };

+  format = "other";
+
+  strictDeps = false;
+
  nativeBuildInputs = [
+    gobject-introspection
    txt2tags
-    python2Packages.wrapPython
+    wrapGAppsHook
  ];

-  pythonPath = [
-    python2Packages.pyxdg
-    python2Packages.pygtk
+  buildInputs = [
+    glib
+  ];
+
+  pythonPath = with python3Packages; [
+    pyxdg
+    pygobject3
+  ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ];
+
+  installFlags = [
+    "DESTDIR="
  ];

-  installPhase = ''
-    make install PREFIX=$out DESTDIR=
-    wrapProgram "$out/bin/xdgmenumaker" \
-      --prefix XDG_DATA_DIRS : "$out/share"
-    wrapPythonPrograms
-  '';
-  
  meta = with stdenv.lib; {
    description = "Command line tool that generates XDG menus for several window managers";
    homepage = https://github.com/gapan/xdgmenumaker;
--- a/pkgs/applications/networking/cluster/kubeval/default.nix
+++ b/pkgs/applications/networking/cluster/kubeval/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, buildGoPackage, makeWrapper }:
+{ stdenv, lib, fetchFromGitHub, buildGoModule, makeWrapper }:

 let

@ -7,10 +7,10 @@ let
  schema = stdenv.mkDerivation {
    name = "kubeval-schema";
    src = fetchFromGitHub {
-      owner = "garethr";
+      owner = "instrumenta";
      repo = "kubernetes-json-schema";
-      rev = "c7672fd48e1421f0060dd54b6620baa2ab7224ba";
-      sha256 = "0picr3wvjx4qv158jy4f60pl225rm4mh0l97pf8nqi9h9x4x888p";
+      rev = "6a498a60dc68c5f6a1cc248f94b5cd1e7241d699";
+      sha256 = "1y9m2ma3n4h7sf2lg788vjw6pkfyi0fa7gzc870faqv326n6x2jr";
    };

    installPhase = ''
@ -21,26 +21,26 @@ let

 in

-buildGoPackage rec {
+buildGoModule rec {
  pname = "kubeval";
-  version = "0.7.3";
+  version = "0.14.0";

-  goPackagePath = "github.com/garethr/kubeval";
  src = fetchFromGitHub {
-    owner = "garethr";
+    owner = "instrumenta";
    repo = "kubeval";
-    rev = version;
-    sha256 = "042v4mc5p80vmk56wp6aw89yiibjnfqn79c0zcd6y179br4gpfnb";
+    rev = "${version}";
+    sha256 = "0kpwk7bv36m3i8vavm1pqc8l611c6l9qbagcc64v6r85qig4w5xv";
  };
-  goDeps = ./deps.nix;

  buildInputs = [ makeWrapper ];

-  postFixup = "wrapProgram $bin/bin/kubeval --set KUBEVAL_SCHEMA_LOCATION file:///${schema}";
+  modSha256 = "0y9x44y3bchi8xg0a6jmp2rmi8dybkl6qlywb6nj1viab1s8dd4y";
+
+  postFixup = "wrapProgram $out/bin/kubeval --set KUBEVAL_SCHEMA_LOCATION file:///${schema}/kubernetes-json-schema/master";

  meta = with lib; {
    description = "Validate your Kubernetes configuration files";
-    homepage = https://github.com/garethr/kubeval;
+    homepage = https://github.com/instrumenta/kubeval;
    license = licenses.asl20;
    maintainers = with maintainers; [ nicknovitski ];
    platforms = platforms.all;
--- a/pkgs/applications/networking/cluster/kubeval/deps.nix
+++ b/pkgs/applications/networking/cluster/kubeval/deps.nix
@ -1,174 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/fatih/color";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fatih/color";
-      rev = "5b77d2a35fb0ede96d138fc9a99f5c9b6aef11b4";
-      sha256 = "0v8msvg38r8d1iiq2i5r4xyfx0invhc941kjrsg5gzwvagv55inv";
-    };
-  }
-  {
-    goPackagePath = "github.com/fsnotify/fsnotify";
-    fetch = {
-      type = "git";
-      url = "https://github.com/fsnotify/fsnotify";
-      rev = "c2828203cd70a50dcccfb2761f8b1f8ceef9a8e9";
-      sha256 = "07va9crci0ijlivbb7q57d2rz9h27zgn2fsm60spjsqpdbvyrx4g";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/go-multierror";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/go-multierror";
-      rev = "b7773ae218740a7be65057fc60b366a49b538a44";
-      sha256 = "09904bk7ac6qs9dgiv23rziq9h3makb9qg4jvxr71rlydsd7psfd";
-    };
-  }
-  {
-    goPackagePath = "github.com/hashicorp/hcl";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/hcl";
-      rev = "ef8a98b0bbce4a65b5aa4c368430a80ddc533168";
-      sha256 = "1qalfsc31fra7hcw2lc3s20aj7al62fq3j5fn5kga3mg99b82nyr";
-    };
-  }
-  {
-    goPackagePath = "github.com/magiconair/properties";
-    fetch = {
-      type = "git";
-      url = "https://github.com/magiconair/properties";
-      rev = "c2353362d570a7bfa228149c62842019201cfb71";
-      sha256 = "1a10362wv8a8qwb818wygn2z48lgzch940hvpv81hv8gc747ajxn";
-    };
-  }
-  {
-    goPackagePath = "github.com/mitchellh/mapstructure";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mitchellh/mapstructure";
-      rev = "bb74f1db0675b241733089d5a1faa5dd8b0ef57b";
-      sha256 = "1aqk9qr46bwgdc5j7n7als61xvssvyjf4qzfsvhacl4izpygqnw7";
-    };
-  }
-  {
-    goPackagePath = "github.com/pelletier/go-toml";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pelletier/go-toml";
-      rev = "66540cf1fcd2c3aee6f6787dfa32a6ae9a870f12";
-      sha256 = "1n8na0yg90gm0rpifmzrby5r385vvd62cdam3ls7ssy02bjvfw15";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/afero";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/afero";
-      rev = "787d034dfe70e44075ccc060d346146ef53270ad";
-      sha256 = "0138rjiacl71h7kvhzinviwvy6qa2m6rflpv9lgqv15hnjvhwvg1";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/cast";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/cast";
-      rev = "8965335b8c7107321228e3e3702cab9832751bac";
-      sha256 = "177bk7lq40jbgv9p9r80aydpaccfk8ja3a7jjhfwiwk9r1pa4rr2";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/cobra";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/cobra";
-      rev = "1e58aa3361fd650121dceeedc399e7189c05674a";
-      sha256 = "1d6dy60dw7i2mcab10yp99wi5w28jzhzzf16w4ys6bna7ymndiin";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/jwalterweatherman";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/jwalterweatherman";
-      rev = "7c0cea34c8ece3fbeb2b27ab9b59511d360fb394";
-      sha256 = "132p84i20b9s5r6fs597lsa6648vd415ch7c0d018vm8smzqpd0h";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/pflag";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/pflag";
-      rev = "3ebe029320b2676d667ae88da602a5f854788a8a";
-      sha256 = "11yxs0wqy70wj106fkz8r923yg4ncnc2mbw33v48zmlg4a1rasgp";
-    };
-  }
-  {
-    goPackagePath = "github.com/spf13/viper";
-    fetch = {
-      type = "git";
-      url = "https://github.com/spf13/viper";
-      rev = "b5e8006cbee93ec955a89ab31e0e3ce3204f3736";
-      sha256 = "0y3r6ysi5vn0yq5c7pbl62yg2i64fkv54xgj2jf1hn3v6zzyimis";
-    };
-  }
-  {
-    goPackagePath = "github.com/xeipuuv/gojsonpointer";
-    fetch = {
-      type = "git";
-      url = "https://github.com/xeipuuv/gojsonpointer";
-      rev = "4e3ac2762d5f479393488629ee9370b50873b3a6";
-      sha256 = "13y6iq2nzf9z4ls66bfgnnamj2m3438absmbpqry64bpwjfbsi9q";
-    };
-  }
-  {
-    goPackagePath = "github.com/xeipuuv/gojsonreference";
-    fetch = {
-      type = "git";
-      url = "https://github.com/xeipuuv/gojsonreference";
-      rev = "bd5ef7bd5415a7ac448318e64f11a24cd21e594b";
-      sha256 = "1xby79padc7bmyb8rfbad8wfnfdzpnh51b1n8c0kibch0kwc1db5";
-    };
-  }
-  {
-    goPackagePath = "github.com/xeipuuv/gojsonschema";
-    fetch = {
-      type = "git";
-      url = "https://github.com/xeipuuv/gojsonschema";
-      rev = "9ff6d6c47f3f5de55acc6f464d6e3719b02818ae";
-      sha256 = "0rpkya4lnpv9g33bs0z3vd5dlnadkyq1lg7114nbd73vm878s6sw";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/sys";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/sys";
-      rev = "2d6f6f883a06fc0d5f4b14a81e4c28705ea64c15";
-      sha256 = "1a6x6n1fk5k013w5r4b0bxws1d2fh0s69mbzpi1vkyfpcxabwjhj";
-    };
-  }
-  {
-    goPackagePath = "golang.org/x/text";
-    fetch = {
-      type = "git";
-      url = "https://go.googlesource.com/text";
-      rev = "5c1cf69b5978e5a34c5f9ba09a83e56acc4b7877";
-      sha256 = "03br8p1sb1ffr02l8hyrgcyib7ms0z06wy3v4r1dj2l6q4ghwzfs";
-    };
-  }
-  {
-    goPackagePath = "gopkg.in/yaml.v2";
-    fetch = {
-      type = "git";
-      url = "https://gopkg.in/yaml.v2";
-      rev = "5420a8b6744d3b0345ab293f6fcba19c978f1183";
-      sha256 = "0dwjrs2lp2gdlscs7bsrmyc5yf6mm4fvgw71bzr9mv2qrd2q73s1";
-    };
-  }
-]
--- a/pkgs/applications/networking/cluster/terraform-providers/data.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/data.nix
@ -12,9 +12,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-alicloud";
-      rev     = "v1.60.0";
-      version = "1.60.0";
-      sha256  = "14k96ccjrjiqfrdrj9kd090ms1p15z71qv60gm05bhffviyplmgw";
+      rev     = "v1.63.0";
+      version = "1.63.0";
+      sha256  = "0353zsga4ic7rsgnk243v202l4hpy0xlzp95fnbmrz7p5wy2k8js";
    };
  archive =
    {
@ -44,25 +44,25 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-aws";
-      rev     = "v2.34.0";
-      version = "2.34.0";
-      sha256  = "1kmy6hn1d3padfnix17ibmrm1339q4li0740dlfgjlxjv179bv34";
+      rev     = "v2.41.0";
+      version = "2.41.0";
+      sha256  = "0i9bh78ihmxj7hjbqzkkj7k6lvr3xdakf8qv0bfckcinwpzwzbxa";
    };
  azuread =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-azuread";
-      rev     = "v0.6.0";
-      version = "0.6.0";
-      sha256  = "1s3k2plka1lzfij4vhr30vc549zysa6v8j5mphra7fjxy236v40j";
+      rev     = "v0.7.0";
+      version = "0.7.0";
+      sha256  = "1a7w31dvjz5498445ia4m5gd1js3k7ghz6qqfq51f2n86iafs0xq";
    };
  azurerm =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-azurerm";
-      rev     = "v1.36.1";
-      version = "1.36.1";
-      sha256  = "1mnbmbfsnc859j6ahcph80z0v1jl82dnbjqmqg2q0kiappz2g2lm";
+      rev     = "v1.37.0";
+      version = "1.37.0";
+      sha256  = "0n0582v8g3np8glyxnpnayps014jxclzrglcxf35wszfz9mspryg";
    };
  azurestack =
    {
@ -76,9 +76,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-bigip";
-      rev     = "v1.0.0";
-      version = "1.0.0";
-      sha256  = "0dz5dfv3glx7898a9bi9vi3g0ghyi96pc45brrj41and5835jvdc";
+      rev     = "v1.1.0";
+      version = "1.1.0";
+      sha256  = "15fmxr1c39xx6ix38nigf8izrqzlmjjr6hvlkf7yhb5z7485nvsg";
    };
  bitbucket =
    {
@ -108,9 +108,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-circonus";
-      rev     = "v0.2.0";
-      version = "0.2.0";
-      sha256  = "1vcia3p31cgdwjs06k4244bk7ib2qp1f2lhc7hmyhdfi1c8jym45";
+      rev     = "v0.4.0";
+      version = "0.4.0";
+      sha256  = "0iz7v7gfjgbca47vjnvcv9159kgladkad7cmjw2hpncrn2jjinwg";
    };
  clc =
    {
@ -124,17 +124,17 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-cloudflare";
-      rev     = "v2.0.1";
-      version = "2.0.1";
-      sha256  = "18cxyxgv6x5s1xsd5l460hnl1xdvrvkwb36lhvk3dgziaw2xxr81";
+      rev     = "v2.1.0";
+      version = "2.1.0";
+      sha256  = "1ll06p4fz88mr4a51rqgvxykivx9xina6507mflyxaic59xlkdz4";
    };
  cloudscale =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-cloudscale";
-      rev     = "v2.0.0";
-      version = "2.0.0";
-      sha256  = "145hj4pbi5zrkgamicy3m1n3380fpd2ndd6ym7mwd65d95g39vwb";
+      rev     = "v2.1.0";
+      version = "2.1.0";
+      sha256  = "12vxzhpsivvq343mqkmnwklvnv6dc9h2ah0ixla9svdwjp91xfcd";
    };
  cloudstack =
    {
@ -172,9 +172,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-digitalocean";
-      rev     = "v1.10.0";
-      version = "1.10.0";
-      sha256  = "1c53g32mk41lvq4ikfj04m89nhzrdk8d6h35aq3z07yyqp6ap2a0";
+      rev     = "v1.11.0";
+      version = "1.11.0";
+      sha256  = "0s8z0zsfibclx0431fcqbi9yqkhwj4w0rz780z1dwv50xpgnmzql";
    };
  dme =
    {
@ -204,9 +204,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-docker";
-      rev     = "v2.5.0";
-      version = "2.5.0";
-      sha256  = "1nril7qy1nm1dq19vg6mm0zc0sgkjrm1s39n7p9gxf4s4j78ig1n";
+      rev     = "v2.6.0";
+      version = "2.6.0";
+      sha256  = "12qq7m75yxfczik78klqaimrzhp70m2vk5q0h3v8b2dwvvynj0dg";
    };
  dyn =
    {
@ -252,25 +252,25 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-gitlab";
-      rev     = "v2.3.0";
-      version = "2.3.0";
-      sha256  = "012pbgfdmwyq8y8ddrhyf14jc6s7v24f1w3mrpi6mp4glqc5yfqx";
+      rev     = "v2.4.0";
+      version = "2.4.0";
+      sha256  = "0409n8miva205wkx968ggzmz0y121s99iybsjlkx0gja20x68yxx";
    };
  google =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-google";
-      rev     = "v2.19.0";
-      version = "2.19.0";
-      sha256  = "00pqkysic3x8iygcxb232dwbpmy5ldf7fdfi6ldiv3g6gbvlcaf7";
+      rev     = "v2.20.0";
+      version = "2.20.0";
+      sha256  = "1b19hql244lv74gxdwgqh9955d3zkwj7riaq6kj5ylbj44spcpjy";
    };
  google-beta =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-google-beta";
-      rev     = "v2.19.0";
-      version = "2.19.0";
-      sha256  = "03im9h7r2vyx4y9qnc3l0hsvcqy7rai5dlkmj1za3npm98vpx2d7";
+      rev     = "v2.20.0";
+      version = "2.20.0";
+      sha256  = "0zkhyn17kji6yyl5582g5vhqj3rcbin73ym6vn6f0m7sf5yaplky";
    };
  grafana =
    {
@ -284,17 +284,17 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-hcloud";
-      rev     = "v1.14.0";
-      version = "1.14.0";
-      sha256  = "13zxrjx4im25g7m45z95d3py85nzs2k8r9grilxshr6x95bxk2f0";
+      rev     = "v1.15.0";
+      version = "1.15.0";
+      sha256  = "0l554mf6s248j0453b4r5pafshcvhn2smk4pp23y9kq5g1xd0xmd";
    };
  hedvig =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-hedvig";
-      rev     = "v1.0.4";
-      version = "1.0.4";
-      sha256  = "0y6brzznxp8khdfbnpmnbjqf140411z0pvnp88p8mj2kmbk7kkjd";
+      rev     = "v1.0.5";
+      version = "1.0.5";
+      sha256  = "0dic4kqjwi3s8pss1pmgixnr7xi503gl5i7pcx66fam5y5ar92v5";
    };
  helm =
    {
@ -324,9 +324,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-huaweicloud";
-      rev     = "v1.9.0";
-      version = "1.9.0";
-      sha256  = "06blhsbv5pxlb1m07qanrq5qmbai33dlk89ghzscrqwnvv1nnszr";
+      rev     = "v1.10.0";
+      version = "1.10.0";
+      sha256  = "0aa83y0bzfldijd4jbmhqppc13jdqaax83p75kffwaxw1rmxrana";
    };
  icinga2 =
    {
@ -340,9 +340,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-ignition";
-      rev     = "v1.1.0";
-      version = "1.1.0";
-      sha256  = "0vpjbb70wnlrvw7z2zc92fbisgjk49ivdmv10ahyqlgvc23js5va";
+      rev     = "v1.2.0";
+      version = "1.2.0";
+      sha256  = "0dg5xak02rv7h9z07kjqxf55al188ligzq3m6711rlh62zam2cjc";
    };
  influxdb =
    {
@ -356,9 +356,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-kubernetes";
-      rev     = "v1.9.0";
-      version = "1.9.0";
-      sha256  = "1ai8w853k4pgr43g9dwdsimw0g0c6vg6vg2f20d9ch7bx8ii4nhf";
+      rev     = "v1.10.0";
+      version = "1.10.0";
+      sha256  = "04hd9n9jm72fi81cmdz0yf374fg52r8yinsxy0ag29rd3r2l1k81";
    };
  librato =
    {
@ -372,9 +372,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-linode";
-      rev     = "v1.8.0";
-      version = "1.8.0";
-      sha256  = "1jgh2ij58a5mr6ns604cfpvfvr19qr0q51j57gvchz53iv683m9q";
+      rev     = "v1.9.1";
+      version = "1.9.1";
+      sha256  = "10f7nij91fhgf1808r6rv3l13nz7p37mcln5p3nfvhsxskss3vxn";
    };
  local =
    {
@ -412,9 +412,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-mysql";
-      rev     = "v1.8.0";
-      version = "1.8.0";
-      sha256  = "1llcg2mp6jbj386liinly62pgy934v0c2g5z976n0xwfdiybyhwx";
+      rev     = "v1.9.0";
+      version = "1.9.0";
+      sha256  = "14gxxki3jhncv3s2x828ns2vgmf2xxzigdyp9b54mbkw5rnv1k2g";
    };
  netlify =
    {
@ -428,9 +428,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-newrelic";
-      rev     = "v1.5.2";
-      version = "1.5.2";
-      sha256  = "1q2vlpzxz04xhmf2wi5pc501454qwzh59kdhfhs8yjg1d1489jng";
+      rev     = "v1.8.0";
+      version = "1.8.0";
+      sha256  = "16fdif6hshdb1aswv22k590rcr3f6b3a9gmg8vc4lbyi6l2dfabd";
    };
  nomad =
    {
@ -444,17 +444,17 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-ns1";
-      rev     = "v1.6.0";
-      version = "1.6.0";
-      sha256  = "1v075wc48pq9kp9rp4kanlfshnxgan9h914nqalq90xgzyl2gf3v";
+      rev     = "v1.6.1";
+      version = "1.6.1";
+      sha256  = "0zyn165h42p640k1q85x3n8fw1fs9j72z9lnfa8pas89jy2fmi8b";
    };
  nsxt =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-nsxt";
-      rev     = "v1.1.1";
-      version = "1.1.1";
-      sha256  = "19bbycify25bshpyq65qjxnl72b6wmwwwdb7hxl94hhbgx2c9z29";
+      rev     = "v1.1.2";
+      version = "1.1.2";
+      sha256  = "1hnxivad7371j363sp3460mfzl5alb3dhxsbp0qwfl5mzvriwrbl";
    };
  null =
    {
@ -476,9 +476,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-oci";
-      rev     = "v3.50.0-rc1";
-      version = "3.50.0-rc1";
-      sha256  = "0nzz62zyx5xf2qlvjcbsqnafdhmq194yhyipcab1n2ckji8zb03z";
+      rev     = "v3.54.0-rc1";
+      version = "3.54.0-rc1";
+      sha256  = "14mfkjjpq4sfw0j4w1mnh37x9kwn76rs1y6cjqq9zb8fnhva6gax";
    };
  oneandone =
    {
@ -508,17 +508,17 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-opentelekomcloud";
-      rev     = "v1.13.1";
-      version = "1.13.1";
-      sha256  = "1mxbfskxf9zwm55r3s6fhk634pnyk0sx5pgwk3kmw4sgjv88i1ny";
+      rev     = "v1.14.0";
+      version = "1.14.0";
+      sha256  = "1mjb6br8iy76q417lmg04xnv4hkgi2fgdn3qnr3nvlwnnccp230k";
    };
  opsgenie =
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-opsgenie";
-      rev     = "v0.2.4";
-      version = "0.2.4";
-      sha256  = "1kgvbx39v6f3hszwrqjsaq3wvwzkxf4gwwfix2m6bprfr5q5vn0d";
+      rev     = "v0.2.5";
+      version = "0.2.5";
+      sha256  = "0brjqnlnxqss285n2g1z006bibbdh5v47g75l5kyhyhhchavccma";
    };
  oraclepaas =
    {
@ -540,9 +540,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-packet";
-      rev     = "v2.6.1";
-      version = "2.6.1";
-      sha256  = "198lkw5b4xfyf82yzym66fna7j0wl3hzvkdr9b9q7f0nffx47xri";
+      rev     = "v2.7.1";
+      version = "2.7.1";
+      sha256  = "1hmja9c8ab66yr814psz1zsa4y0nbmd5rcnp3qxdgizp45yrvz3i";
    };
  pagerduty =
    {
@ -556,9 +556,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-panos";
-      rev     = "v1.6.0";
-      version = "1.6.0";
-      sha256  = "0qszdyrj84c8i195y45cnanzmkn8ypi1gi5a03pf3gsf2fdcj9gq";
+      rev     = "v1.6.1";
+      version = "1.6.1";
+      sha256  = "06hwi426x7ipmn4dbg5dyv9z84sxaa8q1jlcd2l264n9s2y3xhiq";
    };
  postgresql =
    {
@ -700,9 +700,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-tencentcloud";
-      rev     = "v1.22.0";
-      version = "1.22.0";
-      sha256  = "0lamj77n9b5m80201wim0zcjgdcbihcaq27z49himh2qi5j8lxiz";
+      rev     = "v1.25.2";
+      version = "1.25.2";
+      sha256  = "1pf4l9rvkarl4vhf51np4kdqcgs4jhsr5gw7vs6rn8gv97lb40kw";
    };
  terraform =
    {
@ -756,9 +756,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-vault";
-      rev     = "v2.5.0";
-      version = "2.5.0";
-      sha256  = "0h3q2zifjgm05kvdans88dl8wx9hr21c1s64fmfs4an07gkg8947";
+      rev     = "v2.6.0";
+      version = "2.6.0";
+      sha256  = "0sw1swy2j9n3ji48sxmj093zzlq7sdmp8ixmz488ps3m4jjyfk6k";
    };
  vcd =
    {
@ -780,9 +780,9 @@
    {
      owner   = "terraform-providers";
      repo    = "terraform-provider-yandex";
-      rev     = "v0.23.0";
-      version = "0.23.0";
-      sha256  = "0vv8lp834q8i7fam2s8pvs7slfwlf8m4g080i9cij5z2lgipja32";
+      rev     = "v0.24.0";
+      version = "0.24.0";
+      sha256  = "0a9isivn3ni0d1id8ww97xbcwrxc0c4pn1m1q21cipqs6mwksq9m";
    };
  segment =
    {
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -14,11 +14,11 @@ assert pulseaudioSupport -> libpulseaudio != null;
 let
  inherit (stdenv.lib) concatStringsSep makeBinPath optional;

-  version = "3.0.317369.1110";
+  version = "3.5.330166.1202";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://zoom.us/client/${version}/zoom_x86_64.tar.xz";
-      sha256 = "0r4wp9qb1739xwr24kglc4sj8qaxwr4nh5p1igi3x6f1f8gczia7";
+      sha256 = "1fjirl4hmxvy4kp3b0n97mn8sz355ik10297qx6hcr0fhn2v0nig";
    };
  };

--- a/pkgs/applications/networking/mailreaders/imapfilter.nix
+++ b/pkgs/applications/networking/mailreaders/imapfilter.nix
@ -19,6 +19,6 @@ stdenv.mkDerivation rec {
    description = "Mail filtering utility";
    license = stdenv.lib.licenses.mit;
    platforms = stdenv.lib.platforms.unix;
-    maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
+    maintainers = with stdenv.lib.maintainers; [ ];
  };
 }
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/default.nix
@ -185,7 +185,7 @@ stdenv.mkDerivation {
      free = false;
      url = http://www.mozilla.org/en-US/foundation/trademarks/policy/;
    };
-    maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
+    maintainers = with stdenv.lib.maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pam, python3, libxslt, perl, ArchiveZip, gettext
+{ stdenv, fetchurl, fetchpatch, pam, python3, libxslt, perl, ArchiveZip, gettext
 , IOCompress, zlib, libjpeg, expat, freetype, libwpd
 , libxml2, db, curl, fontconfig, libsndfile, neon
 , bison, flex, zip, unzip, gtk3, gtk2, libmspack, getopt, file, cairo, which
@ -73,6 +73,19 @@ in stdenv.mkDerivation rec {

  patches = [
    ./xdg-open-brief.patch
+
+    # Poppler-0.82 compatibility
+    # https://gerrit.libreoffice.org/81545
+    (fetchpatch {
+      url = "https://github.com/LibreOffice/core/commit/2eadd46ab81058087af95bdfc1fea28fcdb65998.patch";
+      sha256 = "1mpipdfxvixjziizbhfbpybpzlg1ijw7s0yqjpmq5d7pf3pvkm4n";
+    })
+    # Poppler-0.83 compatibility
+    # https://gerrit.libreoffice.org/84384
+    (fetchpatch {
+      url = "https://github.com/LibreOffice/core/commit/9065cd8d9a19864f6b618f2dc10daf577badd9ee.patch";
+      sha256 = "0nd0gck8ra3ffw936a7ri0s6a0ii5cyglnhip2prcjh5yf7vw2i2";
+    })
  ];

  tarballPath = "external/tarballs";
--- a/pkgs/applications/office/libreoffice/still.nix
+++ b/pkgs/applications/office/libreoffice/still.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pam, python3, libxslt, perl, ArchiveZip, gettext
+{ stdenv, fetchurl, fetchpatch, pam, python3, libxslt, perl, ArchiveZip, gettext
 , IOCompress, zlib, libjpeg, expat, freetype, libwpd
 , libxml2, db, curl, fontconfig, libsndfile, neon
 , bison, flex, zip, unzip, gtk3, gtk2, libmspack, getopt, file, cairo, which
@ -73,6 +73,19 @@ in stdenv.mkDerivation rec {

  patches = [
    ./xdg-open-brief.patch
+
+    # Poppler-0.82 compatibility
+    # https://gerrit.libreoffice.org/81545
+    (fetchpatch {
+      url = "https://github.com/LibreOffice/core/commit/2eadd46ab81058087af95bdfc1fea28fcdb65998.patch";
+      sha256 = "1mpipdfxvixjziizbhfbpybpzlg1ijw7s0yqjpmq5d7pf3pvkm4n";
+    })
+    # Poppler-0.83 compatibility
+    # https://gerrit.libreoffice.org/84384
+    (fetchpatch {
+      url = "https://github.com/LibreOffice/core/commit/9065cd8d9a19864f6b618f2dc10daf577badd9ee.patch";
+      sha256 = "0nd0gck8ra3ffw936a7ri0s6a0ii5cyglnhip2prcjh5yf7vw2i2";
+    })
  ];

  tarballPath = "external/tarballs";
--- a/pkgs/applications/office/scribus/unstable.nix
+++ b/pkgs/applications/office/scribus/unstable.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, mkDerivation, pkgconfig, cmake, qtbase, cairo, pixman,
+{ stdenv, fetchurl, fetchpatch, mkDerivation, pkgconfig, cmake, qtbase, cairo, pixman,
 boost, cups, fontconfig, freetype, hunspell, libjpeg, libtiff, libxml2, lcms2,
 podofo, poppler, poppler_data, python2, qtimageformats, qttools, harfbuzzFull }:

@ -14,6 +14,19 @@ mkDerivation rec {
    sha256 = "eQiyGmzoQyafWM7fX495GJMlfmIBzOX73ccNrKL+P3E=";
  };

+  patches = [
+    # fix build with Poppler 0.82
+    (fetchpatch {
+      url = "https://github.com/scribusproject/scribus/commit/6db15ec1af791377b28981601f8c296006de3c6f.patch";
+      sha256 = "1y6g3avmsmiyaj8xry1syaz8sfznsavh6l2rp13pj2bwsxfcf939";
+    })
+    # fix build with Poppler 0.83
+    (fetchpatch {
+      url = "https://github.com/scribusproject/scribus/commit/b51c2bab4d57d685f96d427d6816bdd4ecfb4674.patch";
+      sha256 = "031yy9ylzksczfnpcc4glfccz025sn47zg6fqqzjnqqrc16bgdlx";
+    })
+  ];
+
  enableParallelBuilding = true;

  nativeBuildInputs = [ pkgconfig cmake  ];
--- a/pkgs/applications/science/astronomy/gildas/default.nix
+++ b/pkgs/applications/science/astronomy/gildas/default.nix
@ -7,8 +7,8 @@ let
 in

 stdenv.mkDerivation rec {
-  srcVersion = "oct19a";
-  version = "20191001_a";
+  srcVersion = "dec19a";
+  version = "20191201_a";
  pname = "gildas";

  src = fetchurl {
@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    # source code of the previous release to a different directory
    urls = [ "http://www.iram.fr/~gildas/dist/gildas-src-${srcVersion}.tar.xz"
      "http://www.iram.fr/~gildas/dist/archive/gildas/gildas-src-${srcVersion}.tar.xz" ];
-    sha256 = "0h6g16ra7v8x15j21z5hnb3midwm0asc7bjm9gs5v5sw66vn3wc1";
+    sha256 = "0kwq5gzgzx5hkbabwvbrw2958pqz4m2s501k5cbllgxh4sqp86b1";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/science/logic/symbiyosys/default.nix
+++ b/pkgs/applications/science/logic/symbiyosys/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, yosys, bash, python3 }:
+{ stdenv, fetchFromGitHub, yosys, bash, python3, yices }:

 stdenv.mkDerivation {
  pname = "symbiyosys";
@ -13,6 +13,8 @@ stdenv.mkDerivation {

  buildInputs = [ python3 yosys ];

+  propagatedBuildInputs = [ yices ];
+
  buildPhase = "true";
  installPhase = ''
    mkdir -p $out/bin $out/share/yosys/python3
--- a/pkgs/applications/science/math/sage/sage-tests.nix
+++ b/pkgs/applications/science/math/sage/sage-tests.nix
@ -56,6 +56,6 @@ stdenv.mkDerivation {
    export GLIBC_TUNABLES=glibc.malloc.arena_max=4

    echo "Running sage tests with arguments ${timeSpecifier} ${patienceSpecifier} ${testArgs}"
-    "sage" -t --nthreads "$NIX_BUILD_CORES" --optional=sage ${timeSpecifier} ${patienceSpecifier} ${testArgs}
+    "sage" -t --timeout=0 --nthreads "$NIX_BUILD_CORES" --optional=sage ${timeSpecifier} ${patienceSpecifier} ${testArgs}
  '';
 }
--- a/pkgs/applications/science/misc/vite/default.nix
+++ b/pkgs/applications/science/misc/vite/default.nix
@ -38,7 +38,7 @@ stdenv.mkDerivation {

    homepage = http://vite.gforge.inria.fr/;
    license = stdenv.lib.licenses.cecill20;
-    maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
+    maintainers = with stdenv.lib.maintainers; [ ];
    platforms = stdenv.lib.platforms.linux;
  };
 }
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,9 +1,9 @@
 {
-  "version": "12.5.2",
-  "repo_hash": "18mviak37rkpj92m0hzh79rjbfsk8p91r5zzjp7y3y4qjnsf2a8p",
+  "version": "12.5.3",
+  "repo_hash": "1q76yhg4ygs9w5hb8hbv1908d5pfqzr8idmjp06pa4dw5qqqkv97",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v12.5.2-ee",
+  "rev": "v12.5.3-ee",
  "passthru": {
    "GITALY_SERVER_VERSION": "1.72.1",
    "GITLAB_PAGES_VERSION": "1.12.0",
--- a/pkgs/applications/version-management/gitlab/gitaly/deps.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/deps.nix
@ -306,6 +306,15 @@
      sha256 = "0jb2834rw5sykfr937fxi8hxi2zy80sj2bdn9b3jb4b26ksqng30";
    };
  }
+  {
+    goPackagePath = "github.com/golang/lint";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/lint";
+      rev = "06c8688daad7";
+      sha256 = "0xi94dwvz50a66bq1hp9fyqkym5mcpdxdb1hrfvicldgjf37lc47";
+    };
+  }
  {
    goPackagePath = "github.com/golang/mock";
    fetch = {
@ -540,6 +549,15 @@
      sha256 = "1zcq480ig7wbg4378qcfxznp2gzqmk7x6rbxizflvg9v2f376vrw";
    };
  }
+  {
+    goPackagePath = "github.com/kisielk/gotool";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kisielk/gotool";
+      rev = "v1.0.0";
+      sha256 = "14af2pa0ssyp8bp2mvdw184s5wcysk6akil3wzxmr05wwy951iwn";
+    };
+  }
  {
    goPackagePath = "github.com/klauspost/compress";
    fetch = {
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix
@ -162,6 +162,15 @@
      sha256 = "0jb2834rw5sykfr937fxi8hxi2zy80sj2bdn9b3jb4b26ksqng30";
    };
  }
+  {
+    goPackagePath = "github.com/golang/lint";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/lint";
+      rev = "06c8688daad7";
+      sha256 = "0xi94dwvz50a66bq1hp9fyqkym5mcpdxdb1hrfvicldgjf37lc47";
+    };
+  }
  {
    goPackagePath = "github.com/golang/mock";
    fetch = {
@ -252,6 +261,15 @@
      sha256 = "1zcq480ig7wbg4378qcfxznp2gzqmk7x6rbxizflvg9v2f376vrw";
    };
  }
+  {
+    goPackagePath = "github.com/kisielk/gotool";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kisielk/gotool";
+      rev = "v1.0.0";
+      sha256 = "14af2pa0ssyp8bp2mvdw184s5wcysk6akil3wzxmr05wwy951iwn";
+    };
+  }
  {
    goPackagePath = "github.com/konsorten/go-windows-terminal-sequences";
    fetch = {
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
    description = "Cross-platform tools for Matroska";
    homepage    = http://www.bunkus.org/videotools/mkvtoolnix/;
    license     = licenses.gpl2;
-    maintainers = with maintainers; [ codyopel fuuzetsu rnhmjoj ];
+    maintainers = with maintainers; [ codyopel rnhmjoj ];
    platforms   = platforms.linux
      ++ optionals (!withGUI) platforms.darwin;
  };
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -235,7 +235,7 @@ in stdenv.mkDerivation rec {
    description = "A media player that supports many video formats (MPlayer and mplayer2 fork)";
    homepage = https://mpv.io;
    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ AndersonTorres fuuzetsu fpletz globin ivan ];
+    maintainers = with maintainers; [ AndersonTorres fpletz globin ivan ];
    platforms = platforms.darwin ++ platforms.linux;

    longDescription = ''
--- a/pkgs/applications/virtualization/gvisor/containerd-shim.nix
+++ b/pkgs/applications/virtualization/gvisor/containerd-shim.nix
@ -0,0 +1,36 @@
+{ lib, fetchFromGitHub, buildGoModule, go-bindata }:
+
+buildGoModule rec {
+  name = "gvisor-containerd-shim-${version}";
+  version = "2019-10-09";
+
+  src = fetchFromGitHub {
+    owner  = "google";
+    repo   = "gvisor-containerd-shim";
+    rev    = "f299b553afdd8455a0057862004061ea12e660f5";
+    sha256 = "077bhrmjrpcxv1z020yxhx2c4asn66j21gxlpa6hz0av3lfck9lm";
+  };
+
+  modSha256 = "1jdhgbrn59ahnabwnig99i21f6kimmqx9f3dg10ffwfs3dx0gzlg";
+
+  buildPhase = ''
+    make
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    make test
+  '';
+
+  installPhase = ''
+    make install DESTDIR="$out"
+  '';
+
+  meta = with lib; {
+    description = "containerd shim for gVisor";
+    homepage    = https://github.com/google/gvisor-containerd-shim;
+    license     = licenses.asl20;
+    maintainers = with maintainers; [ andrew-d ];
+    platforms   = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/virtualization/gvisor/default.nix
+++ b/pkgs/applications/virtualization/gvisor/default.nix
@ -0,0 +1,101 @@
+{ stdenv
+, buildBazelPackage
+, fetchFromGitHub
+, cacert
+, git
+, glibcLocales
+, go
+, iproute
+, iptables
+, makeWrapper
+, procps
+, python3
+}:
+
+let
+  preBuild = ''
+    patchShebangs .
+
+    # Tell rules_go to use the Go binary found in the PATH
+    sed -E -i \
+      -e 's|go_version\s*=\s*"[^"]+",|go_version = "host",|g' \
+      WORKSPACE
+
+    # The gazelle Go tooling needs CA certs
+    export SSL_CERT_FILE="${cacert}/etc/ssl/certs/ca-bundle.crt"
+
+    # If we don't reset our GOPATH, the rules_go stdlib builder tries to
+    # install something into it. Ideally that wouldn't happen, but for now we
+    # can also get around it by unsetting GOPATH entirely, since rules_go
+    # doesn't need it.
+    export GOPATH=
+  '';
+
+in buildBazelPackage rec {
+  name = "gvisor-${version}";
+  version = "2019-11-14";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo  = "gvisor";
+    rev   = "release-20191114.0";
+    sha256 = "0kyixjjlws9iz2r2srgpdd4rrq94vpxkmh2rmmzxd9mcqy2i9bg1";
+  };
+
+  nativeBuildInputs = [ git glibcLocales go makeWrapper python3 ];
+
+  bazelTarget = "//runsc:runsc";
+
+  # gvisor uses the Starlark implementation of rules_cc, not the built-in one,
+  # so we shouldn't delete it from our dependencies.
+  removeRulesCC = false;
+
+  fetchAttrs = {
+    inherit preBuild;
+
+    preInstall = ''
+      # Remove the go_sdk (it's just a copy of the go derivation) and all
+      # references to it from the marker files. Bazel does not need to download
+      # this sdk because we have patched the WORKSPACE file to point to the one
+      # currently present in PATH. Without removing the go_sdk from the marker
+      # file, the hash of it will change anytime the Go derivation changes and
+      # that would lead to impurities in the marker files which would result in
+      # a different sha256 for the fetch phase.
+      rm -rf $bazelOut/external/{go_sdk,\@go_sdk.marker}
+
+      # Remove the gazelle tools, they contain go binaries that are built
+      # non-deterministically. As long as the gazelle version matches the tools
+      # should be equivalent.
+      rm -rf $bazelOut/external/{bazel_gazelle_go_repository_tools,\@bazel_gazelle_go_repository_tools.marker}
+
+      # Remove the gazelle repository cache
+      chmod -R +w $bazelOut/external/bazel_gazelle_go_repository_cache
+      rm -rf $bazelOut/external/{bazel_gazelle_go_repository_cache,\@bazel_gazelle_go_repository_cache.marker}
+
+      # Remove log file(s)
+      rm -f "$bazelOut"/java.log "$bazelOut"/java.log.*
+    '';
+
+    sha256 = "122qk6iv8hd7g2a84y9aqqhij4r0m47vpxzbqhhh6k5livc73qd6";
+  };
+
+  buildAttrs = {
+    inherit preBuild;
+
+    installPhase = ''
+      install -Dm755 bazel-bin/runsc/*_pure_stripped/runsc $out/bin/runsc
+
+      # Needed for the 'runsc do' subcomand
+      wrapProgram $out/bin/runsc \
+        --prefix PATH : ${stdenv.lib.makeBinPath [ iproute iptables procps ]}
+    '';
+  };
+
+  meta = with stdenv.lib; {
+    description = "Container Runtime Sandbox";
+    homepage = https://github.com/google/gvisor;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ andrew-d ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/build-support/agda/default.nix
+++ b/pkgs/build-support/agda/default.nix
@ -1,6 +1,4 @@
 # Builder for Agda packages. Mostly inspired by the cabal builder.
-#
-# Contact: stdenv.lib.maintainers.fuuzetsu

 { stdenv, Agda, glibcLocales
 , writeShellScriptBin
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@ -2,11 +2,16 @@

 let

-  runCommand' = stdenv: name: env: buildCommand:
+  runCommand' = runLocal: stdenv: name: env: buildCommand:
    stdenv.mkDerivation ({
      inherit name buildCommand;
      passAsFile = [ "buildCommand" ];
-    } // env);
+    }
+    // (lib.optionalAttrs runLocal {
+          preferLocalBuild = true;
+          allowSubstitutes = false;
+       })
+    // env);

 in

@ -21,11 +26,27 @@ rec {
  * runCommand "name" {envVariable = true;} ''echo hello > $out''
  * runCommandNoCC "name" {envVariable = true;} ''echo hello > $out'' # equivalent to prior
  * runCommandCC "name" {} ''gcc -o myfile myfile.c; cp myfile $out'';
+  *
+  * The `*Local` variants force a derivation to be built locally,
+  * it is not substituted.
+  *
+  * This is intended for very cheap commands (<1s execution time).
+  * It saves on the network roundrip and can speed up a build.
+  *
+  * It is the same as adding the special fields
+  * `preferLocalBuild = true;`
+  * `allowSubstitutes = false;`
+  * to a derivation’s attributes.
  */
  runCommand = runCommandNoCC;
-  runCommandNoCC = runCommand' stdenvNoCC;
-  runCommandCC = runCommand' stdenv;
+  runCommandLocal = runCommandNoCCLocal;

+  runCommandNoCC = runCommand' false stdenvNoCC;
+  runCommandNoCCLocal = runCommand' true stdenvNoCC;
+
+  runCommandCC = runCommand' false stdenv;
+  # `runCommandCCLocal` left out on purpose.
+  # We shouldn’t force the user to have a cc in scope.

  /* Writes a text file to the nix store.
   * The contents of text is added to the file in the store.
--- a/pkgs/build-support/vm/windows/default.nix
+++ b/pkgs/build-support/vm/windows/default.nix
@ -20,8 +20,7 @@ let
  '';

 in {
-  runInWindowsVM = drv: let
-  in pkgs.lib.overrideDerivation drv (attrs: let
+  runInWindowsVM = drv: pkgs.lib.overrideDerivation drv (attrs: let
    bootstrap = bootstrapper attrs.windowsImage;
  in {
    requiredSystemFeatures = [ "kvm" ];
--- a/pkgs/data/fonts/cantarell-fonts/default.nix
+++ b/pkgs/data/fonts/cantarell-fonts/default.nix
@ -33,6 +33,6 @@ in stdenv.mkDerivation rec {
    description = "Default typeface used in the user interface of GNOME since version 3.0";
    platforms = stdenv.lib.platforms.all;
    license = stdenv.lib.licenses.ofl;
-    maintainers = with stdenv.lib.maintainers; [ fuuzetsu ];
+    maintainers = with stdenv.lib.maintainers; [ ];
  };
 }
--- a/pkgs/desktops/deepin/dbus-factory/default.nix
+++ b/pkgs/desktops/deepin/dbus-factory/default.nix
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    sed -i -e 's:/share/gocode:/share/go:' Makefile
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Generates static DBus bindings for Golang and QML at build-time";
--- a/pkgs/desktops/deepin/dde-api/default.nix
+++ b/pkgs/desktops/deepin/dde-api/default.nix
@ -113,7 +113,7 @@ buildGoPackage rec {
    searchHardCodedPaths $out  # debugging
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Go-lang bindings for dde-daemon";
--- a/pkgs/desktops/deepin/dde-calendar/default.nix
+++ b/pkgs/desktops/deepin/dde-calendar/default.nix
@ -37,7 +37,7 @@ mkDerivation rec {
      -e "s,/usr/bin/deepin-desktop-ts-convert,deepin-desktop-ts-convert,"
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Calendar for Deepin Desktop Environment";
--- a/pkgs/desktops/deepin/dde-control-center/default.nix
+++ b/pkgs/desktops/deepin/dde-control-center/default.nix
@ -99,7 +99,7 @@ mkDerivation rec {
    searchHardCodedPaths $out
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Control panel of Deepin Desktop Environment";
--- a/pkgs/desktops/deepin/dde-daemon/default.nix
+++ b/pkgs/desktops/deepin/dde-daemon/default.nix
@ -121,7 +121,7 @@ buildGoPackage rec {
    searchHardCodedPaths $out  # debugging
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Daemon for handling Deepin Desktop Environment session settings";
--- a/pkgs/desktops/deepin/dde-dock/default.nix
+++ b/pkgs/desktops/deepin/dde-dock/default.nix
@ -68,7 +68,7 @@ unwrapped = mkDerivation rec {
    searchHardCodedPaths $out
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Dock for Deepin Desktop Environment";
--- a/pkgs/desktops/deepin/dde-file-manager/default.nix
+++ b/pkgs/desktops/deepin/dde-file-manager/default.nix
@ -240,7 +240,7 @@ mkDerivation rec {
    searchHardCodedPaths $out
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "File manager and desktop module for Deepin Desktop Environment";
--- a/pkgs/desktops/deepin/dde-launcher/default.nix
+++ b/pkgs/desktops/deepin/dde-launcher/default.nix
@ -63,7 +63,7 @@ mkDerivation rec {
    searchHardCodedPaths $out
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Deepin Desktop Environment launcher module";
--- a/pkgs/desktops/deepin/dde-network-utils/default.nix
+++ b/pkgs/desktops/deepin/dde-network-utils/default.nix
@ -41,7 +41,7 @@ mkDerivation rec {
    searchHardCodedPaths $out  # for debugging
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Deepin network utils";
--- a/pkgs/desktops/deepin/dde-polkit-agent/default.nix
+++ b/pkgs/desktops/deepin/dde-polkit-agent/default.nix
@ -38,7 +38,7 @@ mkDerivation rec {
    searchHardCodedPaths $out
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "PolicyKit agent for Deepin Desktop Environment";
--- a/pkgs/desktops/deepin/dde-qt-dbus-factory/default.nix
+++ b/pkgs/desktops/deepin/dde-qt-dbus-factory/default.nix
@ -26,7 +26,7 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Qt DBus interface library for Deepin software";
--- a/pkgs/desktops/deepin/dde-session-ui/default.nix
+++ b/pkgs/desktops/deepin/dde-session-ui/default.nix
@ -113,7 +113,7 @@ mkDerivation rec {
    searchHardCodedPaths $out  # debugging
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Deepin desktop-environment - Session UI module";
--- a/pkgs/desktops/deepin/deepin-anything/default.nix
+++ b/pkgs/desktops/deepin/deepin-anything/default.nix
@ -51,7 +51,7 @@ mkDerivation rec {
    searchHardCodedPaths $modsrc  # for debugging
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Deepin file search tool";
--- a/pkgs/desktops/deepin/deepin-calculator/default.nix
+++ b/pkgs/desktops/deepin/deepin-calculator/default.nix
@ -36,7 +36,7 @@ mkDerivation rec {
    searchHardCodedPaths $out  # debugging
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Easy to use calculator for Deepin Desktop Environment";
--- a/pkgs/desktops/deepin/deepin-desktop-base/default.nix
+++ b/pkgs/desktops/deepin/deepin-desktop-base/default.nix
@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
    ln -s ../lib/deepin/desktop-version $out/etc/deepin-version
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Base assets and definitions for Deepin Desktop Environment";
--- a/pkgs/desktops/deepin/deepin-desktop-schemas/default.nix
+++ b/pkgs/desktops/deepin/deepin-desktop-schemas/default.nix
@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
    searchHardCodedPaths $out
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "GSettings deepin desktop-wide schemas";
--- a/pkgs/desktops/deepin/deepin-gettext-tools/default.nix
+++ b/pkgs/desktops/deepin/deepin-gettext-tools/default.nix
@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
    wrapProgram $out/bin/deepin-desktop-ts-convert --set PERL5LIB $PERL5LIB
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Deepin Internationalization utilities";
--- a/pkgs/desktops/deepin/deepin-gtk-theme/default.nix
+++ b/pkgs/desktops/deepin/deepin-gtk-theme/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {

  makeFlags = [ "PREFIX=${placeholder "out"}" ];

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Deepin GTK Theme";
--- a/pkgs/desktops/deepin/deepin-icon-theme/default.nix
+++ b/pkgs/desktops/deepin/deepin-icon-theme/default.nix
@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
    cp -a ./Sea ./usr/share/icons/hicolor "$out"/share/icons/
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Icons for the Deepin Desktop Environment";
--- a/pkgs/desktops/deepin/deepin-image-viewer/default.nix
+++ b/pkgs/desktops/deepin/deepin-image-viewer/default.nix
@ -41,7 +41,7 @@ mkDerivation rec {
      -e "s,\$\$\[QT_INSTALL_PLUGINS\],$out/$qtPluginPrefix,"
  '';

-  passthru.updateScript = deepin.updateScript { inherit ;name = "${pname}-${version}"; };
+  passthru.updateScript = deepin.updateScript { name = "${pname}-${version}"; };

  meta = with stdenv.lib; {
    description = "Image Viewer for Deepin Desktop Environment";
--- a/Show More
+++ b/Show More