Merge branch 'staging-next' into staging

2024-09-21 12:38:41 +03:00 · 2020-07-15 09:29:01 +02:00 · 2020-07-15 09:29:01 +02:00 · 821dba740e
commit 821dba740e
parent ac94f1ab7e 5788f7173e
261 changed files with 6973 additions and 5008 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3024,6 +3024,16 @@
    githubId = 615606;
    name = "Glenn Searby";
  };
+  glittershark = {
+    name = "Griffin Smith";
+    email = "root@gws.fyi";
+    github = "glittershark";
+    githubId = 1481027;
+    keys = [{
+      longkeyid = "rsa2048/0x44EF5B5E861C09A7";
+      fingerprint = "0F11 A989 879E 8BBB FDC1  E236 44EF 5B5E 861C 09A7";
+    }];
+  };
  gloaming = {
    email = "ch9871@gmail.com";
    github = "gloaming";
@ -3959,6 +3969,12 @@
    githubId = 4611077;
    name = "Raymond Gauthier";
  };
+  jschievink = {
+    email = "jonasschievink@gmail.com";
+    github = "jonas-schievink";
+    githubId = 1786438;
+    name = "Jonas Schievink";
+  };
  jtcoolen = {
    email = "jtcoolen@pm.me";
    name = "Julien Coolen";
@ -5640,6 +5656,12 @@
    githubId = 5047140;
    name = "Victor Collod";
  };
+  mupdt = {
+    email = "nix@pdtpartners.com";
+    github = "mupdt";
+    githubId = 25388474;
+    name = "Matej Urbas";
+  };
  mvnetbiz = {
    email = "mvnetbiz@gmail.com";
    github = "mvnetbiz";
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -124,6 +124,12 @@ systemd.services.mysql.serviceConfig.ReadWritePaths = [ "/var/data" ];
     <varname>services.postfix.sslCACert</varname> was replaced by <varname>services.postfix.tlsTrustedAuthorities</varname> which now defaults to system certifcate authorities.
    </para>
   </listitem>
+   <listitem>
+    <para>
+      Subordinate GID and UID mappings are now set up automatically for all normal users.
+      This will make container tools like Podman work as non-root users out of the box.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/config/update-users-groups.pl
+++ b/nixos/modules/config/update-users-groups.pl
@ -281,3 +281,58 @@ foreach my $u (values %usersOut) {
 }

 updateFile("/etc/shadow", \@shadowNew, 0600);
+
+# Rewrite /etc/subuid & /etc/subgid to include default container mappings
+
+my $subUidMapFile = "/var/lib/nixos/auto-subuid-map";
+my $subUidMap = -e $subUidMapFile ? decode_json(read_file($subUidMapFile)) : {};
+
+my (%subUidsUsed, %subUidsPrevUsed);
+
+$subUidsPrevUsed{$_} = 1 foreach values %{$subUidMap};
+
+sub allocSubUid {
+    my ($name, @rest) = @_;
+
+    # TODO: No upper bounds?
+    my ($min, $max, $up) = (100000, 100000 * 100, 1);
+    my $prevId = $subUidMap->{$name};
+    if (defined $prevId && !defined $subUidsUsed{$prevId}) {
+        $subUidsUsed{$prevId} = 1;
+        return $prevId;
+    }
+
+    my $id = allocId(\%subUidsUsed, \%subUidsPrevUsed, $min, $max, $up, sub { my ($uid) = @_; getpwuid($uid) });
+    my $offset = $id - 100000;
+    my $count = $offset * 65536;
+    my $subordinate = 100000 + $count;
+    return $subordinate;
+}
+
+my @subGids;
+my @subUids;
+foreach my $u (values %usersOut) {
+    my $name = $u->{name};
+
+    foreach my $range (@{$u->{subUidRanges}}) {
+        my $value = join(":", ($name, $range->{startUid}, $range->{count}));
+        push @subUids, $value;
+    }
+
+    foreach my $range (@{$u->{subGidRanges}}) {
+        my $value = join(":", ($name, $range->{startGid}, $range->{count}));
+        push @subGids, $value;
+    }
+
+    if($u->{isNormalUser}) {
+        my $subordinate = allocSubUid($name);
+        $subUidMap->{$name} = $subordinate;
+        my $value = join(":", ($name, $subordinate, 65536));
+        push @subUids, $value;
+        push @subGids, $value;
+    }
+}
+
+updateFile("/etc/subuid", join("\n", @subUids) . "\n");
+updateFile("/etc/subgid", join("\n", @subGids) . "\n");
+updateFile($subUidMapFile, encode_json($subUidMap) . "\n");
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@ -375,18 +375,6 @@ let
    };
  };

-  mkSubuidEntry = user: concatStrings (
-    map (range: "${user.name}:${toString range.startUid}:${toString range.count}\n")
-      user.subUidRanges);
-
-  subuidFile = concatStrings (map mkSubuidEntry (attrValues cfg.users));
-
-  mkSubgidEntry = user: concatStrings (
-    map (range: "${user.name}:${toString range.startGid}:${toString range.count}\n")
-        user.subGidRanges);
-
-  subgidFile = concatStrings (map mkSubgidEntry (attrValues cfg.users));
-
  idsAreUnique = set: idAttr: !(fold (name: args@{ dup, acc }:
    let
      id = builtins.toString (builtins.getAttr idAttr (builtins.getAttr name set));
@ -406,6 +394,7 @@ let
      { inherit (u)
          name uid group description home createHome isSystemUser
          password passwordFile hashedPassword
+          isNormalUser subUidRanges subGidRanges
          initialPassword initialHashedPassword;
        shell = utils.toShellPath u.shell;
      }) cfg.users;
@ -430,9 +419,9 @@ in {
    (mkChangedOptionModule
      [ "security" "initialRootPassword" ]
      [ "users" "users" "root" "initialHashedPassword" ]
-      (cfg: if cfg.security.initialHashedPassword == "!"
+      (cfg: if cfg.security.initialRootPassword == "!"
            then null
-            else cfg.security.initialHashedPassword))
+            else cfg.security.initialRootPassword))
  ];

  ###### interface
@ -567,16 +556,7 @@ in {
    # Install all the user shells
    environment.systemPackages = systemShells;

-    environment.etc = {
-      subuid = {
-        text = subuidFile;
-        mode = "0644";
-      };
-      subgid = {
-        text = subgidFile;
-        mode = "0644";
-      };
-    } // (mapAttrs' (name: { packages, ... }: {
+    environment.etc = (mapAttrs' (name: { packages, ... }: {
      name = "profiles/per-user/${name}";
      value.source = pkgs.buildEnv {
        name = "user-environment";
--- a/nixos/modules/services/audio/spotifyd.nix
+++ b/nixos/modules/services/audio/spotifyd.nix
@ -16,7 +16,7 @@ in
        type = types.lines;
        description = ''
          Configuration for Spotifyd. For syntax and directives, see
-          https://github.com/Spotifyd/spotifyd#Configuration.
+          <link xlink:href="https://github.com/Spotifyd/spotifyd#Configuration"/>.
        '';
      };
    };
--- a/nixos/modules/services/backup/restic.nix
+++ b/nixos/modules/services/backup/restic.nix
@ -31,6 +31,59 @@ in
          '';
        };

+        rcloneOptions = mkOption {
+          type = with types; nullOr (attrsOf (oneOf [ str bool ]));
+          default = null;
+          description = ''
+            Options to pass to rclone to control its behavior.
+            See <link xlink:href="https://rclone.org/docs/#options"/> for
+            available options. When specifying option names, strip the
+            leading <literal>--</literal>. To set a flag such as
+            <literal>--drive-use-trash</literal>, which does not take a value,
+            set the value to the Boolean <literal>true</literal>.
+          '';
+          example = {
+            bwlimit = "10M";
+            drive-use-trash = "true";
+          };
+        };
+
+        rcloneConfig = mkOption {
+          type = with types; nullOr (attrsOf (oneOf [ str bool ]));
+          default = null;
+          description = ''
+            Configuration for the rclone remote being used for backup.
+            See the remote's specific options under rclone's docs at
+            <link xlink:href="https://rclone.org/docs/"/>. When specifying
+            option names, use the "config" name specified in the docs. 
+            For example, to set <literal>--b2-hard-delete</literal> for a B2
+            remote, use <literal>hard_delete = true</literal> in the
+            attribute set.
+            Warning: Secrets set in here will be world-readable in the Nix
+            store! Consider using the <literal>rcloneConfigFile</literal>
+            option instead to specify secret values separately. Note that
+            options set here will override those set in the config file.
+          '';
+          example = {
+            type = "b2";
+            account = "xxx";
+            key = "xxx";
+            hard_delete = true;
+          };
+        };
+
+        rcloneConfigFile = mkOption {
+          type = with types; nullOr path;
+          default = null;
+          description = ''
+            Path to the file containing rclone configuration. This file
+            must contain configuration for the remote specified in this backup
+            set and also must be readable by root. Options set in
+            <literal>rcloneConfig</literal> will override those set in this
+            file.
+          '';
+        };
+
        repository = mkOption {
          type = types.str;
          description = ''
@ -170,11 +223,22 @@ in
            ( resticCmd + " forget --prune " + (concatStringsSep " " backup.pruneOpts) )
            ( resticCmd + " check" )
          ];
+          # Helper functions for rclone remotes
+          rcloneRemoteName = builtins.elemAt (splitString ":" backup.repository) 1;
+          rcloneAttrToOpt = v: "RCLONE_" + toUpper (builtins.replaceStrings [ "-" ] [ "_" ] v);
+          rcloneAttrToConf = v: "RCLONE_CONFIG_" + toUpper (rcloneRemoteName + "_" + v);
+          toRcloneVal = v: if lib.isBool v then lib.boolToString v else v;
        in nameValuePair "restic-backups-${name}" ({
          environment = {
            RESTIC_PASSWORD_FILE = backup.passwordFile;
            RESTIC_REPOSITORY = backup.repository;
-          };
+          } // optionalAttrs (backup.rcloneOptions != null) (mapAttrs' (name: value:
+            nameValuePair (rcloneAttrToOpt name) (toRcloneVal value)
+          ) backup.rcloneOptions) // optionalAttrs (backup.rcloneConfigFile != null) {
+            RCLONE_CONFIG = backup.rcloneConfigFile;
+          } // optionalAttrs (backup.rcloneConfig != null) (mapAttrs' (name: value:
+            nameValuePair (rcloneAttrToConf name) (toRcloneVal value)
+          ) backup.rcloneConfig);
          path = [ pkgs.openssh ];
          restartIfChanged = false;
          serviceConfig = {
--- a/nixos/modules/services/continuous-integration/buildbot/worker.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/worker.nix
@ -29,7 +29,7 @@ let

    with open('${cfg.workerPassFile}', 'r', encoding='utf-8') as passwd_file:
        passwd = passwd_file.read().strip('\r\n')
-    keepalive = 600
+    keepalive = ${toString cfg.keepalive}
    umask = None
    maxdelay = 300
    numcpus = None
@ -116,6 +116,15 @@ in {
        description = "Specifies the Buildbot Worker connection string.";
      };

+      keepalive = mkOption {
+        default = 600;
+        type = types.int;
+        description = "
+          This is a number that indicates how frequently keepalive messages should be sent
+          from the worker to the buildmaster, expressed in seconds.
+        ";
+      };
+
      package = mkOption {
        type = types.package;
        default = pkgs.python3Packages.buildbot-worker;
--- a/nixos/modules/services/development/jupyter/default.nix
+++ b/nixos/modules/services/development/jupyter/default.nix
@ -6,10 +6,7 @@ let

  cfg = config.services.jupyter;

-  # NOTE: We don't use top-level jupyter because we don't
-  # want to pass in JUPYTER_PATH but use .environment instead,
-  # saving a rebuild.
-  package = pkgs.python3.pkgs.notebook;
+  package = cfg.package;

  kernels = (pkgs.jupyter-kernel.create  {
    definitions = if cfg.kernels != null
@ -37,6 +34,27 @@ in {
      '';
    };

+    package = mkOption {
+      type = types.package;
+      # NOTE: We don't use top-level jupyter because we don't
+      # want to pass in JUPYTER_PATH but use .environment instead,
+      # saving a rebuild.
+      default = pkgs.python3.pkgs.notebook;
+      description = ''
+        Jupyter package to use.
+      '';
+    };
+
+    command = mkOption {
+      type = types.str;
+      default = "jupyter-notebook";
+      example = "jupyter-lab";
+      description = ''
+        Which command the service runs. Note that not all jupyter packages
+        have all commands, e.g. jupyter-lab isn't present in the default package.
+       '';
+    };
+
    port = mkOption {
      type = types.int;
      default = 8888;
@ -157,7 +175,7 @@ in {

        serviceConfig = {
          Restart = "always";
-          ExecStart = ''${package}/bin/jupyter-notebook \
+          ExecStart = ''${package}/bin/${cfg.command} \
            --no-browser \
            --ip=${cfg.ip} \
            --port=${toString cfg.port} --port-retries 0 \
--- a/nixos/modules/services/misc/gitolite.nix
+++ b/nixos/modules/services/misc/gitolite.nix
@ -27,7 +27,10 @@ in
        type = types.str;
        default = "/var/lib/gitolite";
        description = ''
-          Gitolite home directory (used to store all the repositories).
+          The gitolite home directory used to store all repositories. If left as the default value
+          this directory will automatically be created before the gitolite server starts, otherwise
+          the sysadmin is responsible for ensuring the directory exists with appropriate ownership
+          and permissions.
        '';
      };

@ -149,14 +152,6 @@ in
    };
    users.groups.${cfg.group}.gid = config.ids.gids.gitolite;

-    systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' 0750 ${cfg.user} ${cfg.group} - -"
-      "d '${cfg.dataDir}'/.gitolite - ${cfg.user} ${cfg.group} - -"
-      "d '${cfg.dataDir}'/.gitolite/logs - ${cfg.user} ${cfg.group} - -"
-
-      "Z ${cfg.dataDir} 0750 ${cfg.user} ${cfg.group} - -"
-    ];
-
    systemd.services.gitolite-init = {
      description = "Gitolite initialization";
      wantedBy    = [ "multi-user.target" ];
@ -167,13 +162,19 @@ in
        GITOLITE_RC_DEFAULT = "${rcDir}/gitolite.rc.default";
      };

-      serviceConfig = {
-        Type = "oneshot";
-        User = cfg.user;
-        Group = cfg.group;
-        WorkingDirectory = "~";
-        RemainAfterExit = true;
-      };
+      serviceConfig = mkMerge [
+        (mkIf (cfg.dataDir == "/var/lib/gitolite") {
+          StateDirectory = "gitolite gitolite/.gitolite gitolite/.gitolite/logs";
+          StateDirectoryMode = "0750";
+        })
+        {
+          Type = "oneshot";
+          User = cfg.user;
+          Group = cfg.group;
+          WorkingDirectory = "~";
+          RemainAfterExit = true;
+        }
+      ];

      path = [ pkgs.gitolite pkgs.git pkgs.perl pkgs.bash pkgs.diffutils config.programs.ssh.package ];
      script =
--- a/nixos/modules/services/networking/unifi.nix
+++ b/nixos/modules/services/networking/unifi.nix
@ -162,6 +162,8 @@ in
      unitConfig.RequiresMountsFor = stateDir;
      # This a HACK to fix missing dependencies of dynamic libs extracted from jars
      environment.LD_LIBRARY_PATH = with pkgs.stdenv; "${cc.cc.lib}/lib";
+      # Make sure package upgrades trigger a service restart
+      restartTriggers = [ cfg.unifiPackage cfg.mongodbPackage ];

      serviceConfig = {
        Type = "simple";
--- a/nixos/modules/system/boot/loader/grub/install-grub.pl
+++ b/nixos/modules/system/boot/loader/grub/install-grub.pl
@ -652,7 +652,7 @@ my @deviceTargets = getList('devices');
 my $prevGrubState = readGrubState();
 my @prevDeviceTargets = split/,/, $prevGrubState->devices;
 my @extraGrubInstallArgs = getList('extraGrubInstallArgs');
-my @prevExtraGrubInstallArgs = $prevGrubState->extraGrubInstallArgs;
+my @prevExtraGrubInstallArgs = @{$prevGrubState->extraGrubInstallArgs};

 my $devicesDiffer = scalar (List::Compare->new( '-u', '-a', \@deviceTargets, \@prevDeviceTargets)->get_symmetric_difference());
 my $extraGrubInstallArgsDiffer = scalar (List::Compare->new( '-u', '-a', \@extraGrubInstallArgs, \@prevExtraGrubInstallArgs)->get_symmetric_difference());
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@ -473,8 +473,6 @@ in
        [ "aes" "aes_generic" "blowfish" "twofish"
          "serpent" "cbc" "xts" "lrw" "sha1" "sha256" "sha512"
          "af_alg" "algif_skcipher"
-
-          (if pkgs.stdenv.hostPlatform.system == "x86_64-linux" then "aes_x86_64" else "aes_i586")
        ];
      description = ''
        A list of cryptographic kernel modules needed to decrypt the root device(s).
--- a/nixos/modules/system/boot/networkd.nix
+++ b/nixos/modules/system/boot/networkd.nix
@ -302,7 +302,7 @@ let

  checkDhcpV6 = checkUnitConfig "DHCPv6" [
    (assertOnlyFields [
-      "UseDns" "UseNTP" "RapidCommit" "ForceDHCPv6PDOtherInformation"
+      "UseDNS" "UseNTP" "RapidCommit" "ForceDHCPv6PDOtherInformation"
      "PrefixDelegationHint"
    ])
    (assertValueOneOf "UseDNS" boolValues)
--- a/nixos/modules/system/boot/stage-2-init.sh
+++ b/nixos/modules/system/boot/stage-2-init.sh
@ -169,4 +169,4 @@ exec {logOutFd}>&- {logErrFd}>&-
 echo "starting systemd..."
 PATH=/run/current-system/systemd/lib/systemd:@fsPackagesPath@ \
    LOCALE_ARCHIVE=/run/current-system/sw/lib/locale/locale-archive \
-    exec systemd
+    exec @systemdExecutable@
--- a/nixos/modules/system/boot/stage-2.nix
+++ b/nixos/modules/system/boot/stage-2.nix
@ -10,6 +10,7 @@ let
    src = ./stage-2-init.sh;
    shellDebug = "${pkgs.bashInteractive}/bin/bash";
    shell = "${pkgs.bash}/bin/bash";
+    inherit (config.boot) systemdExecutable;
    isExecutable = true;
    inherit (config.nix) readOnlyStore;
    inherit useHostResolvConf;
@ -72,6 +73,15 @@ in
        '';
      };

+      systemdExecutable = mkOption {
+        default = "systemd";
+        type = types.str;
+        description = ''
+          The program to execute to start systemd. Typically
+          <literal>systemd</literal>, which will find systemd in the
+          PATH.
+        '';
+      };
    };

  };
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -818,6 +818,49 @@ in
      '';
    };

+    systemd.watchdog.device = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/dev/watchdog";
+      description = ''
+        The path to a hardware watchdog device which will be managed by systemd.
+        If not specified, systemd will default to /dev/watchdog.
+      '';
+    };
+
+    systemd.watchdog.runtimeTime = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "30s";
+      description = ''
+        The amount of time which can elapse before a watchdog hardware device
+        will automatically reboot the system. Valid time units include "ms",
+        "s", "min", "h", "d", and "w".
+      '';
+    };
+
+    systemd.watchdog.rebootTime = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "10m";
+      description = ''
+        The amount of time which can elapse after a reboot has been triggered
+        before a watchdog hardware device will automatically reboot the system.
+        Valid time units include "ms", "s", "min", "h", "d", and "w".
+      '';
+    };
+
+    systemd.watchdog.kexecTime = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "10m";
+      description = ''
+        The amount of time which can elapse when kexec is being executed before
+        a watchdog hardware device will automatically reboot the system. This
+        option should only be enabled if reloadTime is also enabled. Valid
+        time units include "ms", "s", "min", "h", "d", and "w".
+      '';
+    };
  };


@ -889,6 +932,19 @@ in
          DefaultIPAccounting=yes
        ''}
        DefaultLimitCORE=infinity
+        ${optionalString (config.systemd.watchdog.device != null) ''
+          WatchdogDevice=${config.systemd.watchdog.device}
+        ''}
+        ${optionalString (config.systemd.watchdog.runtimeTime != null) ''
+          RuntimeWatchdogSec=${config.systemd.watchdog.runtimeTime}
+        ''}
+        ${optionalString (config.systemd.watchdog.rebootTime != null) ''
+          RebootWatchdogSec=${config.systemd.watchdog.rebootTime}
+        ''}
+        ${optionalString (config.systemd.watchdog.kexecTime != null) ''
+          KExecWatchdogSec=${config.systemd.watchdog.kexecTime}
+        ''}
+
        ${config.systemd.extraConfig}
      '';

--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@ -23,6 +23,15 @@ in
    maintainers = [] ++ lib.teams.podman.members;
  };

+
+  imports = [
+    (
+      lib.mkRemovedOptionModule
+      [ "virtualisation" "containers" "users" ]
+      "All users with `isNormaUser = true` set now get appropriate subuid/subgid mappings."
+    )
+  ];
+
  options.virtualisation.containers = {

    enable =
@ -99,15 +108,6 @@ in
      '';
    };

-    users = mkOption {
-      default = [];
-      type = types.listOf types.str;
-      description = ''
-        List of users to set up subuid/subgid mappings for.
-        This is a requirement for running rootless containers.
-      '';
-    };
-
  };

  config = lib.mkIf cfg.enable {
@ -122,26 +122,6 @@ in
      registries = lib.mapAttrs (n: v: { registries = v; }) cfg.registries;
    };

-    users.extraUsers = builtins.listToAttrs (
-      (
-        builtins.foldl' (
-          acc: user: {
-            values = acc.values ++ [
-              {
-                name = user;
-                value = {
-                  subUidRanges = [ { startUid = acc.offset; count = 65536; } ];
-                  subGidRanges = [ { startGid = acc.offset; count = 65536; } ];
-                };
-              }
-            ];
-            offset = acc.offset + 65536;
-          }
-        )
-        { values = []; offset = 100000; } (lib.unique cfg.users)
-      ).values
-    );
-
    environment.etc."containers/policy.json".source =
      if cfg.policy != {} then pkgs.writeText "policy.json" (builtins.toJSON cfg.policy)
      else copyFile "${pkgs.skopeo.src}/default-policy.json";
--- a/nixos/tests/ceph-multi-node.nix
+++ b/nixos/tests/ceph-multi-node.nix
@ -183,15 +183,15 @@ let
    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")

    monA.succeed(
-        "ceph osd pool create multi-node-test 128 128",
+        "ceph osd pool create multi-node-test 32 32",
        "ceph osd pool ls | grep 'multi-node-test'",
        "ceph osd pool rename multi-node-test multi-node-other-test",
        "ceph osd pool ls | grep 'multi-node-other-test'",
    )
-    monA.wait_until_succeeds("ceph -s | grep '1 pools, 128 pgs'")
+    monA.wait_until_succeeds("ceph -s | grep '2 pools, 33 pgs'")
    monA.succeed("ceph osd pool set multi-node-other-test size 2")
    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-    monA.wait_until_succeeds("ceph -s | grep '128 active+clean'")
+    monA.wait_until_succeeds("ceph -s | grep '33 active+clean'")
    monA.fail(
        "ceph osd pool ls | grep 'multi-node-test'",
        "ceph osd pool delete multi-node-other-test multi-node-other-test --yes-i-really-really-mean-it",
--- a/nixos/tests/ceph-single-node.nix
+++ b/nixos/tests/ceph-single-node.nix
@ -143,12 +143,12 @@ let
    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")

    monA.succeed(
-        "ceph osd pool create single-node-test 128 128",
+        "ceph osd pool create single-node-test 32 32",
        "ceph osd pool ls | grep 'single-node-test'",
        "ceph osd pool rename single-node-test single-node-other-test",
        "ceph osd pool ls | grep 'single-node-other-test'",
    )
-    monA.wait_until_succeeds("ceph -s | grep '1 pools, 128 pgs'")
+    monA.wait_until_succeeds("ceph -s | grep '2 pools, 33 pgs'")
    monA.succeed(
        "ceph osd getcrushmap -o crush",
        "crushtool -d crush -o decrushed",
@ -158,7 +158,7 @@ let
        "ceph osd pool set single-node-other-test size 2",
    )
    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
-    monA.wait_until_succeeds("ceph -s | grep '128 active+clean'")
+    monA.wait_until_succeeds("ceph -s | grep '33 active+clean'")
    monA.fail(
        "ceph osd pool ls | grep 'multi-node-test'",
        "ceph osd pool delete single-node-other-test single-node-other-test --yes-i-really-really-mean-it",
--- a/nixos/tests/gnome3-xorg.nix
+++ b/nixos/tests/gnome3-xorg.nix
@ -14,6 +14,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {

      services.xserver.displayManager = {
        gdm.enable = true;
+        gdm.debug = true;
        autoLogin = {
          enable = true;
          user = user.name;
@ -21,6 +22,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
      };

      services.xserver.desktopManager.gnome3.enable = true;
+      services.xserver.desktopManager.gnome3.debug = true;
      services.xserver.displayManager.defaultSession = "gnome-xorg";

      virtualisation.memorySize = 1024;
--- a/nixos/tests/gnome3.nix
+++ b/nixos/tests/gnome3.nix
@ -13,6 +13,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {

      services.xserver.displayManager = {
        gdm.enable = true;
+        gdm.debug = true;
        autoLogin = {
          enable = true;
          user = "alice";
@ -20,6 +21,7 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : {
      };

      services.xserver.desktopManager.gnome3.enable = true;
+      services.xserver.desktopManager.gnome3.debug = true;

      virtualisation.memorySize = 1024;
    };
--- a/nixos/tests/podman.nix
+++ b/nixos/tests/podman.nix
@ -12,9 +12,6 @@ import ./make-test-python.nix (
        { pkgs, ... }:
        {
          virtualisation.podman.enable = true;
-          virtualisation.containers.users = [
-            "alice"
-          ];

          users.users.alice = {
            isNormalUser = true;
--- a/nixos/tests/restic.nix
+++ b/nixos/tests/restic.nix
@ -4,33 +4,50 @@ import ./make-test-python.nix (
    let
      password = "some_password";
      repository = "/tmp/restic-backup";
-      passwordFile = pkgs.writeText "password" "correcthorsebatterystaple";
+      rcloneRepository = "rclone:local:/tmp/restic-rclone-backup";
+
+      passwordFile = "${pkgs.writeText "password" "correcthorsebatterystaple"}";
+      initialize = true;
+      paths = [ "/opt" ];
+      pruneOpts = [
+        "--keep-daily 2"
+        "--keep-weekly 1"
+        "--keep-monthly 1"
+        "--keep-yearly 99"
+      ];
    in
      {
        name = "restic";

        meta = with pkgs.stdenv.lib.maintainers; {
-          maintainers = [ bbigras ];
+          maintainers = [ bbigras i077 ];
        };

        nodes = {
          server =
-            { ... }:
+            { pkgs, ... }:
              {
                services.restic.backups = {
                  remotebackup = {
-                    inherit repository;
-                    passwordFile = "${passwordFile}";
-                    initialize = true;
-                    paths = [ "/opt" ];
-                    pruneOpts = [
-                      "--keep-daily 2"
-                      "--keep-weekly 1"
-                      "--keep-monthly 1"
-                      "--keep-yearly 99"
-                    ];
+                    inherit repository passwordFile initialize paths pruneOpts;
+                  };
+                  rclonebackup = {
+                    repository = rcloneRepository;
+                    rcloneConfig = {
+                      type = "local";
+                      one_file_system = true;
+                    };
+
+                    # This gets overridden by rcloneConfig.type
+                    rcloneConfigFile = pkgs.writeText "rclone.conf" ''
+                      [local]
+                      type=ftp
+                    '';
+                    inherit passwordFile initialize paths pruneOpts;
                  };
                };
+
+                environment.sessionVariables.RCLONE_CONFIG_LOCAL_TYPE = "local";
              };
        };

@ -38,25 +55,35 @@ import ./make-test-python.nix (
          server.start()
          server.wait_for_unit("dbus.socket")
          server.fail(
-              "${pkgs.restic}/bin/restic -r ${repository} -p ${passwordFile} snapshots"
+              "${pkgs.restic}/bin/restic -r ${repository} -p ${passwordFile} snapshots",
+              "${pkgs.restic}/bin/restic -r ${rcloneRepository} -p ${passwordFile} snapshots",
          )
          server.succeed(
              "mkdir -p /opt",
              "touch /opt/some_file",
+              "mkdir -p /tmp/restic-rclone-backup",
              "timedatectl set-time '2016-12-13 13:45'",
              "systemctl start restic-backups-remotebackup.service",
+              "systemctl start restic-backups-rclonebackup.service",
              '${pkgs.restic}/bin/restic -r ${repository} -p ${passwordFile} snapshots -c | grep -e "^1 snapshot"',
+              '${pkgs.restic}/bin/restic -r ${rcloneRepository} -p ${passwordFile} snapshots -c | grep -e "^1 snapshot"',
              "timedatectl set-time '2017-12-13 13:45'",
              "systemctl start restic-backups-remotebackup.service",
+              "systemctl start restic-backups-rclonebackup.service",
              "timedatectl set-time '2018-12-13 13:45'",
              "systemctl start restic-backups-remotebackup.service",
+              "systemctl start restic-backups-rclonebackup.service",
              "timedatectl set-time '2018-12-14 13:45'",
              "systemctl start restic-backups-remotebackup.service",
+              "systemctl start restic-backups-rclonebackup.service",
              "timedatectl set-time '2018-12-15 13:45'",
              "systemctl start restic-backups-remotebackup.service",
+              "systemctl start restic-backups-rclonebackup.service",
              "timedatectl set-time '2018-12-16 13:45'",
              "systemctl start restic-backups-remotebackup.service",
+              "systemctl start restic-backups-rclonebackup.service",
              '${pkgs.restic}/bin/restic -r ${repository} -p ${passwordFile} snapshots -c | grep -e "^4 snapshot"',
+              '${pkgs.restic}/bin/restic -r ${rcloneRepository} -p ${passwordFile} snapshots -c | grep -e "^4 snapshot"',
          )
        '';
      }
--- a/nixos/tests/systemd.nix
+++ b/nixos/tests/systemd.nix
@ -50,6 +50,13 @@ import ./make-test-python.nix ({ pkgs, ... }: {
        fi
      '';
    };
+
+    systemd.watchdog = {
+      device = "/dev/watchdog";
+      runtimeTime = "30s";
+      rebootTime = "10min";
+      kexecTime = "5min";
+    };
  };

  testScript = ''
@ -122,5 +129,20 @@ import ./make-test-python.nix ({ pkgs, ... }: {
        retcode, output = machine.execute("systemctl status testservice1.service")
        assert retcode in [0, 3]  # https://bugs.freedesktop.org/show_bug.cgi?id=77507
        assert "CPU:" in output
+
+    # Test systemd is configured to manage a watchdog
+    with subtest("systemd manages hardware watchdog"):
+        machine.wait_for_unit("multi-user.target")
+
+        # It seems that the device's path doesn't appear in 'systemctl show' so
+        # check it separately.
+        assert "WatchdogDevice=/dev/watchdog" in machine.succeed(
+            "cat /etc/systemd/system.conf"
+        )
+
+        output = machine.succeed("systemctl show | grep Watchdog")
+        assert "RuntimeWatchdogUSec=30s" in output
+        assert "RebootWatchdogUSec=10m" in output
+        assert "KExecWatchdogUSec=5m" in output
  '';
 })
--- a/pkgs/applications/audio/gnome-podcasts/default.nix
+++ b/pkgs/applications/audio/gnome-podcasts/default.nix
@ -20,7 +20,7 @@
 }:

 rustPlatform.buildRustPackage rec {
-  version = "0.4.7";
+  version = "0.4.8";
  pname = "gnome-podcasts";

  src = fetchFromGitLab {
@ -28,10 +28,10 @@ rustPlatform.buildRustPackage rec {
    owner = "World";
    repo = "podcasts";
    rev = version;
-    sha256 = "0vy5i77bv8c22ldhrnr4z6kx22zqnb1lg3s7y8673bqjgd7dppi0";
+    sha256 = "0y2332zjq7vf1v38wzwz98fs19vpzy9kl7y0xbdzqr303l59hjb1";
  };

-  cargoSha256 = "1dlbdxsf9p2jzrsclm43k95y8m3zcd41qd9ajg1ii3fpnahi58kd";
+  cargoSha256 = "1jbii9k4bkrivdk1ffr6556q1sgk9j4jbzwnn8vbxmksyl1x328q";

  nativeBuildInputs = [
    meson
--- a/pkgs/applications/audio/mellowplayer/default.nix
+++ b/pkgs/applications/audio/mellowplayer/default.nix
@ -0,0 +1,70 @@
+{ cmake
+, fetchFromGitLab
+, lib
+, libnotify
+, mkDerivation
+, pkgconfig
+, qtbase
+, qtdeclarative
+, qtgraphicaleffects
+, qtquickcontrols2
+, qttools
+, qtwebengine
+}:
+
+mkDerivation rec {
+  pname = "MellowPlayer";
+  version = "3.6.4";
+
+  src = fetchFromGitLab {
+    owner = "ColinDuquesnoy";
+    repo = "MellowPlayer";
+    rev = version;
+    sha256 = "1ss7s3kal4vzhz7ld0yy2kvp1rk2w3i6fya0z3xd7nff9p31gqvw";
+  };
+
+  nativeBuildInputs = [ cmake pkgconfig ];
+
+  buildInputs = [
+    libnotify
+    qtbase
+    qtdeclarative
+    qtgraphicaleffects
+    qtquickcontrols2
+    qttools
+    qtwebengine
+  ];
+
+  doCheck = true;
+
+  cmakeFlags = [ "-DBUILD_TESTS=ON" ];
+
+  preCheck = ''
+    # Running the tests requires a location at the home directory for logging.
+    export HOME="$NIX_BUILD_TOP/home"
+    mkdir -p "$HOME/.local/share/MellowPlayer.Tests/MellowPlayer.Tests/Logs"
+
+    # Without this, the tests fail because they cannot create the QT Window
+    export QT_QPA_PLATFORM=offscreen
+  ''
+  # TODO: The tests are failing because it can't locate QT plugins. Is there a better way to do this?
+  + (builtins.concatStringsSep "\n" (lib.lists.flatten (builtins.map
+      (pkg: [
+        (lib.optionalString (pkg ? qtPluginPrefix) ''
+          export QT_PLUGIN_PATH="${pkg}/${pkg.qtPluginPrefix}"''${QT_PLUGIN_PATH:+':'}$QT_PLUGIN_PATH
+        '')
+
+        (lib.optionalString (pkg ? qtQmlPrefix) ''
+          export QML2_IMPORT_PATH="${pkg}/${pkg.qtQmlPrefix}"''${QML2_IMPORT_PATH:+':'}$QML2_IMPORT_PATH
+        '')
+      ]) buildInputs)));
+
+  meta = with lib; {
+    inherit (qtbase.meta) platforms;
+
+    description = "Cloud music integration for your desktop.";
+    homepage = "https://gitlab.com/ColinDuquesnoy/MellowPlayer";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ kalbasit ];
+  };
+}
--- a/pkgs/applications/audio/mixxx/default.nix
+++ b/pkgs/applications/audio/mixxx/default.nix
@ -19,13 +19,13 @@ let
 in
 mkDerivation rec {
  pname = "mixxx";
-  version = "2.2.3";
+  version = "2.2.4";

  src = fetchFromGitHub {
    owner = "mixxxdj";
    repo = "mixxx";
    rev = "release-${version}";
-    sha256 = "1h7q25fv62c5m74d4cn1m6mpanmqpbl2wqbch4qvn488jb2jw1dv";
+    sha256 = "1dj9li8av9b2kbm76jvvbdmihy1pyrw0s4xd7dd524wfhwr1llxr";
  };

  nativeBuildInputs = [ scons.py2 ];
--- a/pkgs/applications/blockchains/go-ethereum.nix
+++ b/pkgs/applications/blockchains/go-ethereum.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "go-ethereum";
-  version = "1.9.15";
+  version = "1.9.16";

  src = fetchFromGitHub {
    owner = "ethereum";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1c69rfnx9130b87pw9lnaxyrbzwfhqb2dxyl7qyiscq85hqs16f9";
+    sha256 = "0vycnyz6v39cfrck70h3dbn7jkkh67q0fli240ksw2cp4pqwpwcn";
  };

  usb = fetchFromGitHub {
@ -18,7 +18,7 @@ buildGoModule rec {
    sha256 = "0asd5fz2rhzkjmd8wjgmla5qmqyz4jaa6qf0n2ycia16jsck6wc2";
  };

-  vendorSha256 = "1pjgcx6sydfipsx8s0kl7n6r3lk61klsfrkd7cg4l934k590q2n7";
+  vendorSha256 = "0w2214fllw93xbrlxayhl014aqbjsc8zz7mpik7w5b26m60hn5kr";

  overrideModAttrs = (_: {
      postBuild = ''
--- a/pkgs/applications/blockchains/lnd.nix
+++ b/pkgs/applications/blockchains/lnd.nix
@ -1,20 +1,34 @@
-{ buildGoModule, fetchFromGitHub, lib }:
+{ buildGoModule, fetchFromGitHub, lib
+, tags ? [ "autopilotrpc" "signrpc" "walletrpc" "chainrpc" "invoicesrpc" "watchtowerrpc" ]
+}:

 buildGoModule rec {
  pname = "lnd";
-  version = "0.10.0-beta";
+  version = "0.10.3-beta";

  src = fetchFromGitHub {
    owner = "lightningnetwork";
    repo = "lnd";
    rev = "v${version}";
-    sha256 = "1amciz924s2h6qhy7w34jpv1jc25p5ayfxzvjph6hhx0bccrm88w";
+    sha256 = "129vi8z2sk4hagk7axa675nba6sbj9km88zlq8a1g8di7v2k9z6a";
  };

-  vendorSha256 = "1iyghg11cxvbzi0gl40fvv8pl3d3k52j179w3x5m1f09r5ji223y";
+  vendorSha256 = "0a4bk2qry0isnrvl0adwikqn6imxwzlaq5j3nglb5rmwwq2cdz0r";

  subPackages = ["cmd/lncli" "cmd/lnd"];

+  preBuild = let
+    buildVars = {
+      RawTags = lib.concatStringsSep "," tags;
+      GoVersion = "$(go version | egrep -o 'go[0-9]+[.][^ ]*')";
+    };
+    buildVarsFlags = lib.concatStringsSep " " (lib.mapAttrsToList (k: v: "-X github.com/lightningnetwork/lnd/build.${k}=${v}") buildVars);
+  in
+  lib.optionalString (tags != []) ''
+    buildFlagsArray+=("-tags=${lib.concatStringsSep " " tags}")
+    buildFlagsArray+=("-ldflags=${buildVarsFlags}")
+  '';
+
  meta = with lib; {
    description = "Lightning Network Daemon";
    homepage = "https://github.com/lightningnetwork/lnd";
--- a/pkgs/applications/blockchains/monero/default.nix
+++ b/pkgs/applications/blockchains/monero/default.nix
@ -10,13 +10,13 @@ assert stdenv.isDarwin -> IOKit != null;

 stdenv.mkDerivation rec {
  pname = "monero";
-  version = "0.16.0.0";
+  version = "0.16.0.1";

  src = fetchFromGitHub {
    owner = "monero-project";
    repo = "monero";
    rev = "v${version}";
-    sha256 = "0x74h5z0nxxxip97ibc854pqmrgd8r4d6w62m424f66i8gbzfskh";
+    sha256 = "0n2cviqm8radpynx70fc0819k1xknjc58cvb4whlc49ilyvh8ky6";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/blockchains/wownero.nix
+++ b/pkgs/applications/blockchains/wownero.nix
@ -1,26 +1,26 @@
-{ stdenv, fetchFromGitHub, cmake, boost, miniupnpc_2, openssl, unbound
+{ stdenv, fetchgit, cmake, boost, miniupnpc_2, openssl, unbound
 , readline, libsodium, rapidjson, fetchurl
 }:

 with stdenv.lib;

 let
-  randomwowVersion = "1.1.6";
+  randomwowVersion = "1.1.7";
  randomwow = fetchurl {
    url = "https://github.com/wownero/RandomWOW/archive/${randomwowVersion}.tar.gz";
-    sha256 = "1c55y2dwrayh6k1avpchs89gq1mvy5c305h92jm2k48kzhw6a792";
+    sha256 = "1xp76zf01hnhnk6rjvqjav9n9pnvxzxlzqa5rc574d1c2qczfy3q";
  };
 in

 stdenv.mkDerivation rec {
  pname = "wownero";
-  version = "0.8.0.0";
+  version = "0.8.0.1";

-  src = fetchFromGitHub {
-    owner = "wownero";
-    repo = "wownero";
-    rev    = "v${version}";
-    sha256 = "14nggivilgzaqhjd4ng3g2p884yp2hc322hpcpwjdnz2zfc3qq6c";
+  src = fetchgit {
+    url = "https://git.wownero.com/wownero/wownero.git";
+    rev = "v${version}";
+    sha256 = "15443xv6q1nw4627ajk6k4ghhahvh82lb4gyb8nvq753p2v838g3";
+    fetchSubmodules = false;
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -294,12 +294,12 @@ in

  goland = buildGoland rec {
    name = "goland-${version}";
-    version = "2020.1.3"; /* updated by script */
+    version = "2020.1.4"; /* updated by script */
    description = "Up and Coming Go IDE";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0pqwj4gc23gf10xqciwndimb4ml7djmx8m5rh52c07m77y4aniyn"; /* updated by script */
+      sha256 = "1wgcc1faqn0y9brxikh53s6ly7zvpdmpg7m5gvp5437isbllisbl"; /* updated by script */
    };
    wmClass = "jetbrains-goland";
    update-channel = "GoLand RELEASE";
@ -307,12 +307,12 @@ in

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "07gfqyp6blbf7v8p106ngpq7c5p0llcjahi205yg2jgzkhshn7ld"; /* updated by script */
+      sha256 = "1aycsy2pg8nw5il8p2r6bhim9y47g5rfga63f0p435mpjmzpll0s"; /* updated by script */
    };
    wmClass = "jetbrains-idea-ce";
    update-channel = "IntelliJ IDEA RELEASE";
@ -320,12 +320,12 @@ in

  idea-ultimate = buildIdea rec {
    name = "idea-ultimate-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
-      sha256 = "13qj8n5daz0z0pjizyfsvbbr1gxp5479ar3a68ygi0vrpmbdbssd"; /* updated by script */
+      sha256 = "188wkqcv67kizq4w6v4vg9jpr3qfgbg9x5jc77s4ki4nafkbfxas"; /* updated by script */
    };
    wmClass = "jetbrains-idea";
    update-channel = "IntelliJ IDEA RELEASE";
@ -333,12 +333,12 @@ in

  mps = buildMps rec {
    name = "mps-${version}";
-    version = "2019.2";
+    version = "2020.1.2"; /* updated by script */
    description = "Create your own domain-specific language";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
-      url = "https://download.jetbrains.com/mps/2019.2/MPS-${version}.tar.gz";
-      sha256 = "0rph3bibj74ddbyrn0az1npn4san4g1alci8nlq4gaqdlcz6zx22";
+      url = "https://download.jetbrains.com/mps/2020.1/MPS-${version}.tar.gz";
+      sha256 = "0ygk31l44bxcv64h6lnqxssmx5prcb5b5xdm3qxmrv7xz1qv59c1"; /* updated by script */
    };
    wmClass = "jetbrains-mps";
    update-channel = "MPS RELEASE";
@ -346,12 +346,12 @@ in

  phpstorm = buildPhpStorm rec {
    name = "phpstorm-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
    description = "Professional IDE for Web and PHP developers";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "00c8vlp125j56v9g9d4rc5g4dhgvl1bhi6qrzvpaf6x77jbq4fv4"; /* updated by script */
+      sha256 = "0cw2rx68rl6mrnizpb69ahz4hrh8blry70cv4rjnkw19d4x877m8"; /* updated by script */
    };
    wmClass = "jetbrains-phpstorm";
    update-channel = "PhpStorm RELEASE";
@ -359,12 +359,12 @@ in

  pycharm-community = buildPycharm rec {
    name = "pycharm-community-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
    description = "PyCharm Community Edition";
    license = stdenv.lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1s04b9w7sydix1sjqzmby63nwcvzs6iw28wz7441kxgryl9qg0qw"; /* updated by script */
+      sha256 = "1290k17nihiih8ipxfqax1xlx320h1vkwbcc5hc50psvpsfgiall"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm-ce";
    update-channel = "PyCharm RELEASE";
@ -372,12 +372,12 @@ in

  pycharm-professional = buildPycharm rec {
    name = "pycharm-professional-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
    description = "PyCharm Professional Edition";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1ysj00qbn5ik6i5953b9mln4g456fmn3phdln9m5jmcb0126y235"; /* updated by script */
+      sha256 = "1ag8jrfs38f0q11pyil4pvddi8lv46b0jxd3mcbmidn3p1z29f9x"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm";
    update-channel = "PyCharm RELEASE";
@ -385,12 +385,12 @@ in

  rider = buildRider rec {
    name = "rider-${version}";
-    version = "2020.1.3"; /* updated by script */
+    version = "2020.1.4"; /* updated by script */
    description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/rider/JetBrains.Rider-${version}.tar.gz";
-      sha256 = "1zzkd3b5j3q6jqrvibxz33a4fcm7pgqfx91bqjs615v3499ncng7"; /* updated by script */
+      sha256 = "0vicgwgsbllfw6fz4l82x4vbka3agf541576ix9akyvsskwbaxj9"; /* updated by script */
    };
    wmClass = "jetbrains-rider";
    update-channel = "Rider RELEASE";
@ -398,12 +398,12 @@ in

  ruby-mine = buildRubyMine rec {
    name = "ruby-mine-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
    description = "The Most Intelligent Ruby and Rails IDE";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "1ycwml7fyhjajjfy1fhggmx0mcdcjidkxll7357rv2z51r0yhc9h"; /* updated by script */
+      sha256 = "1z6z2c31aq29hzi1cifc77zz9vnw48h2jvw4w61lvgskcnzrw9vn"; /* updated by script */
    };
    wmClass = "jetbrains-rubymine";
    update-channel = "RubyMine RELEASE";
@ -411,12 +411,12 @@ in

  webstorm = buildWebStorm rec {
    name = "webstorm-${version}";
-    version = "2020.1.2"; /* updated by script */
+    version = "2020.1.3"; /* updated by script */
    description = "Professional IDE for Web and JavaScript development";
    license = stdenv.lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "1szgiccimfk99z9x1k99lgic6ix81fdahf1k3a88rddl8hhncjwv"; /* updated by script */
+      sha256 = "19zqac77fkw1czf86s39ggnd24r9ljr80gj422ch4fdkz4qy832q"; /* updated by script */
    };
    wmClass = "jetbrains-webstorm";
    update-channel = "WebStorm RELEASE";
--- a/pkgs/applications/graphics/darktable/default.nix
+++ b/pkgs/applications/graphics/darktable/default.nix
@ -34,6 +34,8 @@ stdenv.mkDerivation rec {
    "-DUSE_KWALLET=OFF"
  ];

+  # Doc has high risk of collisions
+  postInstall = "rm -r $out/share/doc";

  # darktable changed its rpath handling in commit
  # 83c70b876af6484506901e6b381304ae0d073d3c and as a result the
--- a/pkgs/applications/graphics/gscan2pdf/default.nix
+++ b/pkgs/applications/graphics/gscan2pdf/default.nix
@ -10,11 +10,11 @@ with stdenv.lib;

 perlPackages.buildPerlPackage rec {
  pname = "gscan2pdf";
-  version = "2.8.0";
+  version = "2.8.1";

  src = fetchurl {
    url = "mirror://sourceforge/gscan2pdf/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0rqx41hkppil3lp1dhkxwlhv0kwp8w8fkgzlapryq1yd9pgkx6lw";
+    sha256 = "00g2vw7lz3yb4nq358x8d3r4mf3hkrq2vw1g9lli27zdp5p6jja1";
  };

  nativeBuildInputs = [ wrapGAppsHook ];
--- a/pkgs/applications/kde/akonadi/0001-akonadi-paths.patch
+++ b/pkgs/applications/kde/akonadi/0001-akonadi-paths.patch
@ -1,27 +1,42 @@
-Index: akonadi-19.08.0/src/akonadicontrol/agentmanager.cpp
-===================================================================
--- akonadi-19.08.0.orig/src/akonadicontrol/agentmanager.cpp
-+++ akonadi-19.08.0/src/akonadicontrol/agentmanager.cpp
-@@ -78,12 +78,12 @@ AgentManager::AgentManager(bool verbose,
-     mStorageController = new Akonadi::ProcessControl;
-     mStorageController->setShutdownTimeout(15 * 1000);   // the server needs more time for shutdown if we are using an internal mysqld
-     connect(mStorageController, &Akonadi::ProcessControl::unableToStart, this, &AgentManager::serverFailure);
-    mStorageController->start(QStringLiteral("akonadiserver"), serviceArgs, Akonadi::ProcessControl::RestartOnCrash);
-+    mStorageController->start(QLatin1String(NIX_OUT "/bin/akonadiserver"), serviceArgs, Akonadi::ProcessControl::RestartOnCrash);
+From 90969b9b36400d47b1afe761fb8468c1acb8a04a Mon Sep 17 00:00:00 2001
+From: Thomas Tuegel <ttuegel@mailbox.org>
+Date: Mon, 13 Jul 2020 11:41:19 -0500
+Subject: [PATCH 1/3] akonadi paths

-     if (mAgentServerEnabled) {
-         mAgentServer = new Akonadi::ProcessControl;
-         connect(mAgentServer, &Akonadi::ProcessControl::unableToStart, this, &AgentManager::agentServerFailure);
-        mAgentServer->start(QStringLiteral("akonadi_agent_server"), serviceArgs, Akonadi::ProcessControl::RestartOnCrash);
-+        mAgentServer->start(QLatin1String(NIX_OUT "/bin/akonadi_agent_server"), serviceArgs, Akonadi::ProcessControl::RestartOnCrash);
+---
+ src/akonadicontrol/agentmanager.cpp         |  4 ++--
+ src/akonadicontrol/agentprocessinstance.cpp |  2 +-
+ src/server/storage/dbconfigmysql.cpp        | 26 ++++-----------------
+ src/server/storage/dbconfigpostgresql.cpp   | 19 +++------------
+ 4 files changed, 11 insertions(+), 40 deletions(-)
+
+diff --git a/src/akonadicontrol/agentmanager.cpp b/src/akonadicontrol/agentmanager.cpp
+index 23b4a1f..c13b658 100644
+--- a/src/akonadicontrol/agentmanager.cpp
+++ b/src/akonadicontrol/agentmanager.cpp
+@@ -61,7 +61,7 @@ public:
+                 []() {
+                     QCoreApplication::instance()->exit(255);
+                 });
+-        start(QStringLiteral("akonadiserver"), args, RestartOnCrash);
+        start(QLatin1String(NIX_OUT "/bin/akonadiserver"), args, RestartOnCrash);
     }
- }
 
-Index: akonadi-19.08.0/src/akonadicontrol/agentprocessinstance.cpp
-===================================================================
--- akonadi-19.08.0.orig/src/akonadicontrol/agentprocessinstance.cpp
-+++ akonadi-19.08.0/src/akonadicontrol/agentprocessinstance.cpp
-@@ -62,7 +62,7 @@ bool AgentProcessInstance::start(const A
+     ~StorageProcessControl() override
+@@ -84,7 +84,7 @@ public:
+                 []() {
+                     qCCritical(AKONADICONTROL_LOG) << "Failed to start AgentServer!";
+                 });
+-        start(QStringLiteral("akonadi_agent_server"), args, RestartOnCrash);
+        start(QLatin1String(NIX_OUT "/bin/akonadi_agent_server"), args, RestartOnCrash);
+     }
+ 
+     ~AgentServerProcessControl() override
+diff --git a/src/akonadicontrol/agentprocessinstance.cpp b/src/akonadicontrol/agentprocessinstance.cpp
+index 4e58f7e..e8bb532 100644
+--- a/src/akonadicontrol/agentprocessinstance.cpp
+++ b/src/akonadicontrol/agentprocessinstance.cpp
+@@ -62,7 +62,7 @@ bool AgentProcessInstance::start(const AgentType &agentInfo)
     } else {
         Q_ASSERT(agentInfo.launchMethod == AgentType::Launcher);
         const QStringList arguments = QStringList() << executable << identifier();
@ -30,11 +45,11 @@ Index: akonadi-19.08.0/src/akonadicontrol/agentprocessinstance.cpp
         mController->start(agentLauncherExec, arguments);
     }
     return true;
-Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
-===================================================================
--- akonadi-19.08.0.orig/src/server/storage/dbconfigmysql.cpp
-+++ akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
-@@ -83,7 +83,6 @@ bool DbConfigMysql::init(QSettings &sett
+diff --git a/src/server/storage/dbconfigmysql.cpp b/src/server/storage/dbconfigmysql.cpp
+index cac40f5..527649b 100644
+--- a/src/server/storage/dbconfigmysql.cpp
+++ b/src/server/storage/dbconfigmysql.cpp
+@@ -83,7 +83,6 @@ bool DbConfigMysql::init(QSettings &settings)
     // determine default settings depending on the driver
     QString defaultHostName;
     QString defaultOptions;
@ -42,7 +57,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
     QString defaultCleanShutdownCommand;
 
 #ifndef Q_OS_WIN
-@@ -92,16 +91,7 @@ bool DbConfigMysql::init(QSettings &sett
+@@ -92,16 +91,7 @@ bool DbConfigMysql::init(QSettings &settings)
 #endif
 
     const bool defaultInternalServer = true;
@ -60,7 +75,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
     if (!mysqladminPath.isEmpty()) {
 #ifndef Q_OS_WIN
         defaultCleanShutdownCommand = QStringLiteral("%1 --defaults-file=%2/mysql.conf --socket=%3/%4 shutdown")
-@@ -111,10 +101,10 @@ bool DbConfigMysql::init(QSettings &sett
+@@ -111,10 +101,10 @@ bool DbConfigMysql::init(QSettings &settings)
 #endif
     }
 
@ -73,7 +88,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
     qCDebug(AKONADISERVER_LOG) << "Found mysqlcheck: " << mMysqlCheckPath;
 
     mInternalServer = settings.value(QStringLiteral("QMYSQL/StartServer"), defaultInternalServer).toBool();
-@@ -131,7 +121,7 @@ bool DbConfigMysql::init(QSettings &sett
+@@ -131,7 +121,7 @@ bool DbConfigMysql::init(QSettings &settings)
     mUserName = settings.value(QStringLiteral("User")).toString();
     mPassword = settings.value(QStringLiteral("Password")).toString();
     mConnectionOptions = settings.value(QStringLiteral("Options"), defaultOptions).toString();
@ -82,7 +97,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
     mCleanServerShutdownCommand = settings.value(QStringLiteral("CleanServerShutdownCommand"), defaultCleanShutdownCommand).toString();
     settings.endGroup();
 
-@@ -141,9 +131,6 @@ bool DbConfigMysql::init(QSettings &sett
+@@ -141,9 +131,6 @@ bool DbConfigMysql::init(QSettings &settings)
         // intentionally not namespaced as we are the only one in this db instance when using internal mode
         mDatabaseName = QStringLiteral("akonadi");
     }
@ -92,7 +107,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
 
     qCDebug(AKONADISERVER_LOG) << "Using mysqld:" << mMysqldPath;
 
-@@ -152,9 +139,6 @@ bool DbConfigMysql::init(QSettings &sett
+@@ -152,9 +139,6 @@ bool DbConfigMysql::init(QSettings &settings)
     settings.setValue(QStringLiteral("Name"), mDatabaseName);
     settings.setValue(QStringLiteral("Host"), mHostName);
     settings.setValue(QStringLiteral("Options"), mConnectionOptions);
@ -102,7 +117,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
     settings.setValue(QStringLiteral("StartServer"), mInternalServer);
     settings.endGroup();
     settings.sync();
-@@ -209,7 +193,7 @@ bool DbConfigMysql::startInternalServer(
+@@ -209,7 +193,7 @@ bool DbConfigMysql::startInternalServer()
 #endif
 
     // generate config file
@ -111,11 +126,11 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
     const QString localConfig  = StandardDirs::locateResourceFile("config", QStringLiteral("mysql-local.conf"));
     const QString actualConfig = StandardDirs::saveDir("data") + QLatin1String("/mysql.conf");
     if (globalConfig.isEmpty()) {
-Index: akonadi-19.08.0/src/server/storage/dbconfigpostgresql.cpp
-===================================================================
--- akonadi-19.08.0.orig/src/server/storage/dbconfigpostgresql.cpp
-+++ akonadi-19.08.0/src/server/storage/dbconfigpostgresql.cpp
-@@ -140,9 +140,7 @@ bool DbConfigPostgresql::init(QSettings
+diff --git a/src/server/storage/dbconfigpostgresql.cpp b/src/server/storage/dbconfigpostgresql.cpp
+index 09cdbd5..1c8996b 100644
+--- a/src/server/storage/dbconfigpostgresql.cpp
+++ b/src/server/storage/dbconfigpostgresql.cpp
+@@ -141,9 +141,7 @@ bool DbConfigPostgresql::init(QSettings &settings)
     // determine default settings depending on the driver
     QString defaultHostName;
     QString defaultOptions;
@ -125,7 +140,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigpostgresql.cpp
     QString defaultPgData;
 
 #ifndef Q_WS_WIN // We assume that PostgreSQL is running as service on Windows
-@@ -153,12 +151,8 @@ bool DbConfigPostgresql::init(QSettings
+@@ -154,12 +152,8 @@ bool DbConfigPostgresql::init(QSettings &settings)
 
     mInternalServer = settings.value(QStringLiteral("QPSQL/StartServer"), defaultInternalServer).toBool();
     if (mInternalServer) {
@ -139,7 +154,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigpostgresql.cpp
         defaultPgData = StandardDirs::saveDir("data", QStringLiteral("db_data"));
     }
 
-@@ -177,20 +171,14 @@ bool DbConfigPostgresql::init(QSettings
+@@ -178,20 +172,14 @@ bool DbConfigPostgresql::init(QSettings &settings)
     mUserName = settings.value(QStringLiteral("User")).toString();
     mPassword = settings.value(QStringLiteral("Password")).toString();
     mConnectionOptions = settings.value(QStringLiteral("Options"), defaultOptions).toString();
@ -162,7 +177,7 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigpostgresql.cpp
     qCDebug(AKONADISERVER_LOG) << "Found pg_upgrade:" << mPgUpgradePath;
     mPgData = settings.value(QStringLiteral("PgData"), defaultPgData).toString();
     if (mPgData.isEmpty()) {
-@@ -206,7 +194,6 @@ bool DbConfigPostgresql::init(QSettings
+@@ -207,7 +195,6 @@ bool DbConfigPostgresql::init(QSettings &settings)
         settings.setValue(QStringLiteral("Port"), mHostPort);
     }
     settings.setValue(QStringLiteral("Options"), mConnectionOptions);
@ -170,3 +185,6 @@ Index: akonadi-19.08.0/src/server/storage/dbconfigpostgresql.cpp
     settings.setValue(QStringLiteral("InitDbPath"), mInitDbPath);
     settings.setValue(QStringLiteral("StartServer"), mInternalServer);
     settings.endGroup();
+-- 
+2.25.4
+
--- a/pkgs/applications/kde/akonadi/0002-akonadi-timestamps.patch
+++ b/pkgs/applications/kde/akonadi/0002-akonadi-timestamps.patch
@ -0,0 +1,26 @@
+From b8c6a2a017321649db8fec553a644b8da2300514 Mon Sep 17 00:00:00 2001
+From: Thomas Tuegel <ttuegel@mailbox.org>
+Date: Mon, 13 Jul 2020 11:41:35 -0500
+Subject: [PATCH 2/3] akonadi timestamps
+
+---
+ src/server/storage/dbconfigmysql.cpp | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/src/server/storage/dbconfigmysql.cpp b/src/server/storage/dbconfigmysql.cpp
+index 527649b..08c3dd4 100644
+--- a/src/server/storage/dbconfigmysql.cpp
+++ b/src/server/storage/dbconfigmysql.cpp
+@@ -235,8 +235,7 @@ bool DbConfigMysql::startInternalServer()
+     bool confUpdate = false;
+     QFile actualFile(actualConfig);
+     // update conf only if either global (or local) is newer than actual
+-    if ((QFileInfo(globalConfig).lastModified() > QFileInfo(actualFile).lastModified()) ||
+-            (QFileInfo(localConfig).lastModified()  > QFileInfo(actualFile).lastModified())) {
+    if (true) {
+         QFile globalFile(globalConfig);
+         QFile localFile(localConfig);
+         if (globalFile.open(QFile::ReadOnly) && actualFile.open(QFile::WriteOnly)) {
+-- 
+2.25.4
+
--- a/pkgs/applications/kde/akonadi/0001-Revert-Make-Akonadi-installation-properly-relocatabl.patch
+++ b/pkgs/applications/kde/akonadi/0001-Revert-Make-Akonadi-installation-properly-relocatabl.patch
@ -1,19 +1,18 @@
-From bc018b4bc816a3b51deb9739bedbf8a2268d0684 Mon Sep 17 00:00:00 2001
-From: gnidorah <gnidorah@users.noreply.github.com>
-Date: Fri, 22 Dec 2017 17:36:03 +0300
-Subject: [PATCH] Revert "Make Akonadi installation properly relocatable"
+From 7afe018382cf68b477b35f87b666424d62d19ef4 Mon Sep 17 00:00:00 2001
+From: Thomas Tuegel <ttuegel@mailbox.org>
+Date: Mon, 13 Jul 2020 11:41:55 -0500
+Subject: [PATCH 3/3] akonadi revert make relocatable

-This reverts commit b2bb55f13f2ac783f89cc414de8c39f62fa2096a.
 ---
 CMakeLists.txt            | 3 ---
 KF5AkonadiConfig.cmake.in | 6 +++---
 2 files changed, 3 insertions(+), 6 deletions(-)

-Index: akonadi-19.08.0/CMakeLists.txt
-===================================================================
--- akonadi-19.08.0.orig/CMakeLists.txt
-+++ akonadi-19.08.0/CMakeLists.txt
-@@ -306,9 +306,6 @@ configure_package_config_file(
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index d927471..83a74c0 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -330,9 +330,6 @@ configure_package_config_file(
     "${CMAKE_CURRENT_SOURCE_DIR}/KF5AkonadiConfig.cmake.in"
     "${CMAKE_CURRENT_BINARY_DIR}/KF5AkonadiConfig.cmake"
     INSTALL_DESTINATION ${CMAKECONFIG_INSTALL_DIR}
@ -23,11 +22,11 @@ Index: akonadi-19.08.0/CMakeLists.txt
 )
 
 install(FILES
-Index: akonadi-19.08.0/KF5AkonadiConfig.cmake.in
-===================================================================
--- akonadi-19.08.0.orig/KF5AkonadiConfig.cmake.in
-+++ akonadi-19.08.0/KF5AkonadiConfig.cmake.in
-@@ -26,8 +26,8 @@ if(BUILD_TESTING)
+diff --git a/KF5AkonadiConfig.cmake.in b/KF5AkonadiConfig.cmake.in
+index 421e1df..e3abf27 100644
+--- a/KF5AkonadiConfig.cmake.in
+++ b/KF5AkonadiConfig.cmake.in
+@@ -24,8 +24,8 @@ if(BUILD_TESTING)
     find_dependency(Qt5Test "@QT_REQUIRED_VERSION@")
 endif()
 
@ -38,7 +37,7 @@ Index: akonadi-19.08.0/KF5AkonadiConfig.cmake.in
 
 find_dependency(Boost "@Boost_MINIMUM_VERSION@")
 
-@@ -35,7 +35,7 @@ include(${CMAKE_CURRENT_LIST_DIR}/KF5Ako
+@@ -33,7 +33,7 @@ include(${CMAKE_CURRENT_LIST_DIR}/KF5AkonadiTargets.cmake)
 include(${CMAKE_CURRENT_LIST_DIR}/KF5AkonadiMacros.cmake)
 
 # The directory where akonadi-xml.xsd and kcfg2dbus.xsl are installed
@ -47,3 +46,6 @@ Index: akonadi-19.08.0/KF5AkonadiConfig.cmake.in
 
 ####################################################################################
 # CMAKE_AUTOMOC
+-- 
+2.25.4
+
--- a/pkgs/applications/kde/akonadi/akonadi-timestamps.patch
+++ b/pkgs/applications/kde/akonadi/akonadi-timestamps.patch
@ -1,14 +0,0 @@
-Index: akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
-===================================================================
--- akonadi-19.08.0.orig/src/server/storage/dbconfigmysql.cpp
-+++ akonadi-19.08.0/src/server/storage/dbconfigmysql.cpp
-@@ -235,8 +235,7 @@ bool DbConfigMysql::startInternalServer(
-     bool confUpdate = false;
-     QFile actualFile(actualConfig);
-     // update conf only if either global (or local) is newer than actual
-    if ((QFileInfo(globalConfig).lastModified() > QFileInfo(actualFile).lastModified()) ||
-            (QFileInfo(localConfig).lastModified()  > QFileInfo(actualFile).lastModified())) {
-+    if (true) {
-         QFile globalFile(globalConfig);
-         QFile localFile(localConfig);
-         if (globalFile.open(QFile::ReadOnly) && actualFile.open(QFile::WriteOnly)) {
--- a/pkgs/applications/kde/akonadi/default.nix
+++ b/pkgs/applications/kde/akonadi/default.nix
@ -11,7 +11,11 @@ mkDerivation {
    license = [ lib.licenses.lgpl21 ];
    maintainers = kdepimTeam;
  };
-  patches = copyPathsToStore (lib.readPathsFromFile ./. ./series);
+  patches = [
+    ./0001-akonadi-paths.patch
+    ./0002-akonadi-timestamps.patch
+    ./0003-akonadi-revert-make-relocatable.patch
+  ];
  nativeBuildInputs = [ extra-cmake-modules shared-mime-info ];
  buildInputs = [
    kcompletion kconfigwidgets kcrash kdbusaddons kdesignerplugin ki18n
--- a/pkgs/applications/kde/akonadi/series
+++ b/pkgs/applications/kde/akonadi/series
@ -1,3 +0,0 @@
-akonadi-paths.patch
-akonadi-timestamps.patch
-0001-Revert-Make-Akonadi-installation-properly-relocatabl.patch
--- a/pkgs/applications/kde/bovo.nix
+++ b/pkgs/applications/kde/bovo.nix
@ -0,0 +1,28 @@
+{ mkDerivation, lib
+, libkdegames, extra-cmake-modules
+, kdeclarative, knewstuff
+}:
+
+mkDerivation {
+  name = "bovo";
+  meta = with lib; {
+    homepage = "https://kde.org/applications/en/games/org.kde.bovo";
+    description = "Five in a row application";
+    longDescription = ''
+      Bovo is a Gomoku (from Japanese 五目並べ - lit. "five points") like game for two players,
+      where the opponents alternate in placing their respective pictogram on the game board.
+      (Also known as: Connect Five, Five in a row, X and O, Naughts and Crosses)
+    '';
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    kdeclarative
+    knewstuff
+    libkdegames
+  ];
+}
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@ -74,6 +74,7 @@ let
      akregator = callPackage ./akregator.nix {};
      ark = callPackage ./ark {};
      baloo-widgets = callPackage ./baloo-widgets.nix {};
+      bovo = callPackage ./bovo.nix {};
      calendarsupport = callPackage ./calendarsupport.nix {};
      dolphin = callPackage ./dolphin.nix {};
      dolphin-plugins = callPackage ./dolphin-plugins.nix {};
@ -174,6 +175,7 @@ let
      messagelib = callPackage ./messagelib.nix {};
      minuet = callPackage ./minuet.nix {};
      okular = callPackage ./okular.nix {};
+      picmi = callPackage ./picmi.nix {};
      pimcommon = callPackage ./pimcommon.nix {};
      pim-data-exporter = callPackage ./pim-data-exporter.nix {};
      pim-sieve-editor = callPackage ./pim-sieve-editor.nix {};
--- a/pkgs/applications/kde/fetch.sh
+++ b/pkgs/applications/kde/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( http://download.kde.org/stable/release-service/19.12.3/src )
+WGET_ARGS=(http://download.kde.org/stable/release-service/20.04.1/src)
--- a/pkgs/applications/kde/kdegraphics-thumbnailers.nix
+++ b/pkgs/applications/kde/kdegraphics-thumbnailers.nix
@ -9,14 +9,6 @@ mkDerivation {
    license = [ lib.licenses.lgpl21 ];
    maintainers = [ lib.maintainers.ttuegel ];
  };
-  patches = [
-    # Fix a bug with thumbnail.so processes hanging:
-    # https://bugs.kde.org/show_bug.cgi?id=404652
-    (fetchpatch {
-      url = "https://github.com/KDE/kdegraphics-thumbnailers/commit/3e2ea6e924d0e2a2cdd9bb435b06965117d6d34c.patch";
-      sha256 = "0fq85zhymmrq8vl0y6vgh87qf4c6fhcq704p4kpkaq7y0isxj4h1";
-    })
-  ];
  nativeBuildInputs = [ extra-cmake-modules ];
  buildInputs = [ karchive kio libkexiv2 libkdcraw ];
 }
--- a/pkgs/applications/kde/kdenlive.nix
+++ b/pkgs/applications/kde/kdenlive.nix
@ -25,7 +25,7 @@
 , frei0r
 , phonon-backend-gstreamer
 , qtdeclarative
-, qtquickcontrols
+, qtquickcontrols2
 , qtscript
 , qtwebkit
 , rttr
@ -60,7 +60,7 @@ mkDerivation {
    mlt
    phonon-backend-gstreamer
    qtdeclarative
-    qtquickcontrols
+    qtquickcontrols2
    qtscript
    qtwebkit
    shared-mime-info
--- a/pkgs/applications/kde/kio-extras.nix
+++ b/pkgs/applications/kde/kio-extras.nix
@ -1,9 +1,9 @@
 {
  mkDerivation, lib, extra-cmake-modules, kdoctools, shared-mime-info,
  exiv2, kactivities, karchive, kbookmarks, kconfig, kconfigwidgets,
-  kcoreaddons, kdbusaddons, kguiaddons, kdnssd, kiconthemes, ki18n, kio, khtml,
-  kdelibs4support, kpty, syntax-highlighting, libmtp, libssh, openexr, ilmbase,
-  openslp, phonon, qtsvg, samba, solid, gperf
+  kcoreaddons, kdbusaddons, kdsoap, kguiaddons, kdnssd, kiconthemes, ki18n, kio,
+  khtml, kdelibs4support, kpty, syntax-highlighting, libmtp, libssh, openexr,
+  ilmbase, openslp, phonon, qtsvg, samba, solid, gperf
 }:

 mkDerivation {
@ -15,9 +15,9 @@ mkDerivation {
  nativeBuildInputs = [ extra-cmake-modules kdoctools shared-mime-info ];
  buildInputs = [
    exiv2 kactivities karchive kbookmarks kconfig kconfigwidgets kcoreaddons
-    kdbusaddons kguiaddons kdnssd kiconthemes ki18n kio khtml kdelibs4support
-    kpty syntax-highlighting libmtp libssh openexr openslp phonon qtsvg samba
-    solid gperf
+    kdbusaddons kdsoap kguiaddons kdnssd kiconthemes ki18n kio khtml
+    kdelibs4support kpty syntax-highlighting libmtp libssh openexr openslp
+    phonon qtsvg samba solid gperf
  ];
  CXXFLAGS = [ "-I${ilmbase.dev}/include/OpenEXR" ];
 }
--- a/pkgs/applications/kde/kmail.nix
+++ b/pkgs/applications/kde/kmail.nix
@ -7,7 +7,7 @@
  kmail-account-wizard, kmailtransport, knotifications, knotifyconfig,
  kontactinterface, kparts, kpty, kservice, ktextwidgets, ktnef, kwallet,
  kwidgetsaddons, kwindowsystem, kxmlgui, libgravatar, libksieve, mailcommon,
-  messagelib, pim-sieve-editor, qtscript, qtwebengine, akonadi
+  messagelib, pim-sieve-editor, qtscript, qtwebengine, akonadi, kdepim-addons
 }:

 mkDerivation {
@ -24,6 +24,7 @@ mkDerivation {
    knotifications knotifyconfig kontactinterface kparts kpty kservice
    ktextwidgets ktnef kwidgetsaddons kwindowsystem kxmlgui libgravatar
    libksieve mailcommon messagelib pim-sieve-editor qtscript qtwebengine
+    kdepim-addons
  ];
  propagatedUserEnvPkgs = [ kdepim-runtime kwallet akonadi ];
  patches = [ ./kmail.patch ];
--- a/pkgs/applications/kde/messagelib.nix
+++ b/pkgs/applications/kde/messagelib.nix
@ -5,7 +5,7 @@
  grantleetheme, karchive, kcodecs, kconfig, kconfigwidgets, kcontacts,
  kdepim-apps-libs, kiconthemes, kidentitymanagement, kio, kjobwidgets, kldap,
  kmailtransport, kmbox, kmime, kwindowsystem, libgravatar, libkdepim, libkleo,
-  pimcommon, qtwebengine, qtwebkit, syntax-highlighting
+  pimcommon, qca-qt5, qtwebengine, qtwebkit, syntax-highlighting
 }:

 mkDerivation {
@ -18,7 +18,7 @@ mkDerivation {
  buildInputs = [
    akonadi-notes akonadi-search gpgme grantlee grantleetheme karchive kcodecs
    kconfig kconfigwidgets kdepim-apps-libs kiconthemes kio kjobwidgets kldap
-    kmailtransport kmbox kmime kwindowsystem libgravatar libkdepim qtwebkit
+    kmailtransport kmbox kmime kwindowsystem libgravatar libkdepim qca-qt5 qtwebkit
    syntax-highlighting
  ];
  propagatedBuildInputs = [
--- a/pkgs/applications/kde/picmi.nix
+++ b/pkgs/applications/kde/picmi.nix
@ -0,0 +1,25 @@
+{ mkDerivation, lib
+, libkdegames, extra-cmake-modules
+, kdeclarative, knewstuff
+}:
+
+mkDerivation {
+  name = "picmi";
+  meta = with lib; {
+    description = "Nonogram game";
+    longDescription = ''The goal is to reveal the hidden pattern in the board by coloring or
+      leaving blank the cells in a grid according to numbers given at the side of the grid.
+      '';
+    maintainers = with maintainers; [ freezeboy ];
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+  };
+  nativeBuildInputs = [
+    extra-cmake-modules
+  ];
+  buildInputs = [
+    kdeclarative
+    knewstuff
+    libkdegames
+  ];
+}
--- a/pkgs/applications/kde/spectacle.nix
+++ b/pkgs/applications/kde/spectacle.nix
@ -17,8 +17,8 @@ mkDerivation {
    knewstuff kwayland
  ];
  postPatch = ''
-    substituteInPlace desktop/org.kde.spectacle.desktop \
-      --replace "Exec=qdbus" "Exec=${lib.getBin qttools}/bin/qdbus"
+    substituteInPlace desktop/org.kde.spectacle.desktop.cmake \
+      --replace "Exec=@QtBinariesDir@/qdbus" "Exec=${lib.getBin qttools}/bin/qdbus"
  '';
  propagatedUserEnvPkgs = [ kipi-plugins libkipi ];
 }
--- a/pkgs/applications/kde/srcs.nix
+++ b/pkgs/applications/kde/srcs.nix
--- a/pkgs/applications/misc/birdtray/default.nix
+++ b/pkgs/applications/misc/birdtray/default.nix
@ -7,6 +7,7 @@
  , qtbase
  , qttools
  , qtx11extras
+  , qttranslations
 }:

 mkDerivation rec {
@ -20,11 +21,21 @@ mkDerivation rec {
    sha256 = "15l8drdmamq1dpqpj0h9ajj2r5vcs23cx421drvhfgs6bqlzd1hl";
  };

+  patches = [
+    # See https://github.com/NixOS/nixpkgs/issues/86054
+    ./fix-qttranslations-path.diff
+  ];
+
  nativeBuildInputs = [ cmake pkgconfig ];
  buildInputs = [
    qtbase qttools qtx11extras
  ];

+  postPatch = ''
+    substituteInPlace src/birdtrayapp.cpp \
+      --subst-var-by qttranslations ${qttranslations}
+  '';
+
  meta = with lib; {
    description = "Mail system tray notification icon for Thunderbird";
    homepage = "https://github.com/gyunaev/birdtray";
--- a/pkgs/applications/misc/birdtray/fix-qttranslations-path.diff
+++ b/pkgs/applications/misc/birdtray/fix-qttranslations-path.diff
@ -0,0 +1,13 @@
+diff --git a/src/birdtrayapp.cpp b/src/birdtrayapp.cpp
+index 847b4d3..3a3709a 100644
+--- a/src/birdtrayapp.cpp
+++ b/src/birdtrayapp.cpp
+@@ -130,7 +130,7 @@ bool BirdtrayApp::loadTranslations() {
+             [](QString path) { return path.append("/translations"); });
+     QLocale locale = QLocale::system();
+     bool success = loadTranslation(
+-            qtTranslator, locale, "qt", {QLibraryInfo::location(QLibraryInfo::TranslationsPath)});
+            qtTranslator, locale, "qt", {QLatin1String("@qttranslations@/translations")});
+     success &= loadTranslation(dynamicTranslator, locale, "dynamic", locations);
+     success &= loadTranslation(mainTranslator, locale, "main", locations);
+     return success;
--- a/pkgs/applications/misc/font-manager/default.nix
+++ b/pkgs/applications/misc/font-manager/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "font-manager";
-  version = "0.7.7";
+  version = "0.7.8";

  src = fetchFromGitHub {
    owner = "FontManager";
    repo = "master";
    rev = version;
-    sha256 = "1bzqvspplp1zj0n0869jqbc60wgbjhf0vdrn5bj8dfawxynh8s5f";
+    sha256 = "0s1l30y55l45rrqd9lygvp2gzrqw25rmjgnnja6s5rzs79gc668c";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/lyx/default.nix
+++ b/pkgs/applications/misc/lyx/default.nix
@ -3,12 +3,12 @@
 }:

 mkDerivation rec {
-  version = "2.3.5.1";
+  version = "2.3.5.2";
  pname = "lyx";

  src = fetchurl {
    url = "ftp://ftp.lyx.org/pub/lyx/stable/2.3.x/${pname}-${version}.tar.xz";
-    sha256 = "0mv32s26igm0pd8vs7d2mk1240dpr83y0a2wyh3xz6b67ph0w157";
+    sha256 = "1pwdh0ljd7lm5a83vsqmp4695irhig07wxa90jc23ng5gap589na";
  };

  # LaTeX is used from $PATH, as people often want to have it with extra pkgs
--- a/pkgs/applications/misc/masterpdfeditor/default.nix
+++ b/pkgs/applications/misc/masterpdfeditor/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "masterpdfeditor";
-  version = "5.4.38";
+  version = "5.6.09";

  src = fetchurl {
    url = "https://code-industry.net/public/master-pdf-editor-${version}-qt5.amd64.tar.gz";
-    sha256 = "0fidy8gd4mqvyfgmrwdiz8z53dyzihqqhgfrffj0z0idm2zi4mcq";
+    sha256 = "0v9j6fwr0xl03kr77vf4wdb06zlplmn4mr3jyzxhvs8a77scmfzb";
  };

  nativeBuildInputs = [ autoPatchelfHook wrapQtAppsHook ];
--- a/pkgs/applications/misc/nnn/default.nix
+++ b/pkgs/applications/misc/nnn/default.nix
@ -4,13 +4,13 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "nnn";
-  version = "3.2";
+  version = "3.3";

  src = fetchFromGitHub {
    owner = "jarun";
    repo = pname;
    rev = "v${version}";
-    sha256 = "13p3379c26l57121ymx0kw7afh51zv614p57di311d2a41jaz5cw";
+    sha256 = "1dxa5blpdf0s03znhnr23zzpsz8yzqpnwknycz42h1w9g9s9jz1v";
  };

  configFile = optionalString (conf != null) (builtins.toFile "nnn.h" conf);
--- a/pkgs/applications/misc/tipp10/default.nix
+++ b/pkgs/applications/misc/tipp10/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "tipp10";
-  version = "3.1.0";
+  version = "3.2.0";

  src = fetchFromGitLab {
-    owner = "a_a";
+    owner = "tipp10";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1mksga1zyqz1y2s524nkw86irg36zpjwz7ff87n2ygrlysczvnx1";
+    sha256 = "0fav5jlw6lw78iqrj7a65b8vd50hhyyaqyzmfrvyxirpsqhjk1v7";
  };

  nativeBuildInputs = [ cmake qttools ];
--- a/pkgs/applications/misc/urlscan/default.nix
+++ b/pkgs/applications/misc/urlscan/default.nix
@ -2,13 +2,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "urlscan";
-  version = "0.9.4";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "firecat53";
    repo = pname;
    rev = version;
-    sha256 = "11wkwjqsq848ks6m2jqsb8h0xnz75fb60bm0c4jkxys9wzy4chg5";
+    sha256 = "16g7dzvjcfhaz52wbmcapamy55l7vfhgizqy3m8dv9gkmy8vap89";
  };

  propagatedBuildInputs = [ python3Packages.urwid ];
--- a/pkgs/applications/misc/wofi/default.nix
+++ b/pkgs/applications/misc/wofi/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchhg, fetchpatch, pkg-config, meson, ninja, wayland, gtk3, wrapGAppsHook }:
+{ stdenv, lib, fetchhg, fetchpatch, pkg-config, meson, ninja, wayland, gtk3, wrapGAppsHook, installShellFiles }:

 stdenv.mkDerivation rec {
  pname = "wofi";
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
    sha256 = "086j5wshawjbwdmmmldivfagc2rr7g5a2gk11l0snqqslm294xsn";
  };

-  nativeBuildInputs = [ pkg-config meson ninja wrapGAppsHook ];
+  nativeBuildInputs = [ pkg-config meson ninja wrapGAppsHook installShellFiles ];
  buildInputs = [ wayland gtk3 ];

  # Fixes icon bug on NixOS.
@ -23,6 +23,10 @@ stdenv.mkDerivation rec {
    })
  ];

+  postInstall = ''
+    installManPage man/wofi*
+  '';
+
  meta = with lib; {
    description = "A launcher/menu program for wlroots based wayland compositors such as sway";
    homepage = "https://hg.sr.ht/~scoopta/wofi";
--- a/pkgs/applications/misc/wtf/default.nix
+++ b/pkgs/applications/misc/wtf/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "wtf";
-  version = "0.30.0";
+  version = "0.31.0";

  src = fetchFromGitHub {
    owner = "wtfutil";
    repo = pname;
    rev = "v${version}";
-    sha256 = "11vy39zygk1gxb1nc1zmxlgs6fn7yq68090fwm2jar0lsxx8a83i";
+    sha256 = "07ngk83p753w9qxm8bvw6n5vk0zldn14yv08d900sxny8cg2h0rb";
   };

-  vendorSha256 = "0qfb352gmsmy5glrsjwc3w57di5k2kjdsyfqn4xf7p4v12yg88va";
+  vendorSha256 = "09iy148pnbdrzjj2j50lbd8s9mkv7vggrx77mj88p1gnqclz3lip";

  buildFlagsArray = [ "-ldflags=-s -w -X main.version=${version}" ];

--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/default.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/default.nix
@ -47,6 +47,7 @@
 , gnupg
 , ffmpeg_3
 , runtimeShell
+, mesa # firefox wants gbm for drm+dmabuf
 , systemLocale ? config.i18n.defaultLocale or "en-US"
 }:

@ -84,7 +85,7 @@ in
 stdenv.mkDerivation {
  inherit name;

-  src = fetchurl { inherit (source) url sha512; };
+  src = fetchurl { inherit (source) url sha256; };

  phases = [ "unpackPhase" "patchPhase" "installPhase" "fixupPhase" ];

@ -106,6 +107,7 @@ stdenv.mkDerivation {
      gtk2
      gtk3
      kerberos
+      mesa
      libX11
      libXScrnSaver
      libXcomposite
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/update.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/update.nix
@ -47,12 +47,13 @@ in writeScript "update-${name}" ''
           grep -e "${if isBeta then "b" else ""}\([[:digit:]]\|[[:digit:]][[:digit:]]\)$" | ${if isBeta then "" else "grep -v \"b\" |"} \
           tail -1`

-  curl --silent -o $HOME/shasums "$url$version/SHA512SUMS"
-  curl --silent -o $HOME/shasums.asc "$url$version/SHA512SUMS.asc"
+  curl --silent -o $HOME/shasums "$url$version/SHA256SUMS"
+  curl --silent -o $HOME/shasums.asc "$url$version/SHA256SUMS.asc"
  gpgv --keyring=$GNUPGHOME/pubring.kbx $HOME/shasums.asc $HOME/shasums

-  # this is a list of sha512 and tarballs for both arches
-  shasums=`cat $HOME/shasums`
+  # this is a list of sha256 and tarballs for both arches
+  # Upstream files contains python repr strings like b'somehash', hence the sed dance
+  shasums=`cat $HOME/shasums | sed -E s/"b'([a-f0-9]{64})'?(.*)"/'\1\2'/`

  cat > $tmpfile <<EOF
  {
@ -74,7 +75,7 @@ in writeScript "update-${name}" ''
      { url = "$url$version/`echo $line | cut -d":" -f3`";
        locale = "`echo $line | cut -d":" -f3 | sed "s/$arch\///" | sed "s/\/.*//"`";
        arch = "$arch";
-        sha512 = "`echo $line | cut -d":" -f1`";
+        sha256 = "`echo $line | cut -d":" -f1`";
      }
  EOF
    done
--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -54,23 +54,4 @@ rec {
      versionKey = "ffversion";
    };
  };
-} // lib.optionalAttrs (config.allowAliases or true) {
-  #### ALIASES
-  #### remove after 20.03 branchoff
-
-  firefox-esr-52 = throw ''
-    firefoxPackages.firefox-esr-52 was removed as it's an unsupported ESR with
-    open security issues. If you need it because you need to run some plugins
-    not having been ported to WebExtensions API, import it from an older
-    nixpkgs checkout still containing it.
-  '';
-  firefox-esr-60 = throw "firefoxPackages.firefox-esr-60 was removed as it's an unsupported ESR with open security issues.";
-
-  icecat = throw "firefoxPackages.icecat was removed as even its latest upstream version is based on an unsupported ESR release with open security issues.";
-  icecat-52 = throw "firefoxPackages.icecat was removed as even its latest upstream version is based on an unsupported ESR release with open security issues.";
-
-  tor-browser-7-5 = throw "firefoxPackages.tor-browser-7-5 was removed because it was out of date and inadequately maintained. Please use tor-browser-bundle-bin instead. See #77452.";
-  tor-browser-8-5 = throw "firefoxPackages.tor-browser-8-5 was removed because it was out of date and inadequately maintained. Please use tor-browser-bundle-bin instead. See #77452.";
-  tor-browser = throw "firefoxPackages.tor-browser was removed because it was out of date and inadequately maintained. Please use tor-browser-bundle-bin instead. See #77452.";
-
 }
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@ -10,6 +10,7 @@
 , udev
 , kerberos
 , libva
+, mesa # firefox wants gbm for drm+dmabuf
 }:

 ## configurability of the wrapper itself
@ -26,11 +27,12 @@ let
    , nameSuffix ? ""
    , icon ? browserName
    , extraNativeMessagingHosts ? []
-    , gdkWayland ? false
+    , forceWayland ? false
+    , useGlvnd ? true
    , cfg ? config.${browserName} or {}
    }:

-    assert gdkWayland -> (browser ? gtk3); # Can only use the wayland backend if gtk3 is being used
+    assert forceWayland -> (browser ? gtk3); # Can only use the wayland backend if gtk3 is being used

    let
      enableAdobeFlash = cfg.enableAdobeFlash or false;
@ -65,10 +67,10 @@ let
          ++ lib.optional (cfg.enableFXCastBridge or false) fx_cast_bridge
          ++ extraNativeMessagingHosts
        );
-      libs =   lib.optionals stdenv.isLinux [ udev libva ]
+      libs =   lib.optionals stdenv.isLinux [ udev libva mesa ]
            ++ lib.optional ffmpegSupport ffmpeg
            ++ lib.optional gssSupport kerberos
-            ++ lib.optional gdkWayland libglvnd
+            ++ lib.optional useGlvnd libglvnd
            ++ lib.optionals (cfg.enableQuakeLive or false)
            (with xorg; [ stdenv.cc libX11 libXxf86dga libXxf86vm libXext libXt alsaLib zlib ])
            ++ lib.optional (enableAdobeFlash && (cfg.enableAdobeFlashDRM or false)) hal-flash
@ -83,7 +85,7 @@ let
        exec = "${browserName}${nameSuffix} %U";
        inherit icon;
        comment = "";
-        desktopName = "${desktopName}${nameSuffix}${lib.optionalString gdkWayland " (Wayland)"}";
+        desktopName = "${desktopName}${nameSuffix}${lib.optionalString forceWayland " (Wayland)"}";
        genericName = "Web Browser";
        categories = "Network;WebBrowser;";
        mimeType = stdenv.lib.concatStringsSep ";" [
@ -124,8 +126,8 @@ let
            --set SNAP_NAME "firefox" \
            --set MOZ_LEGACY_PROFILES 1 \
            --set MOZ_ALLOW_DOWNGRADE 1 \
-            ${lib.optionalString gdkWayland ''
-              --set GDK_BACKEND "wayland" \
+            ${lib.optionalString forceWayland ''
+              --set MOZ_ENABLE_WAYLAND "1" \
            ''}${lib.optionalString (browser ? gtk3)
                ''--prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
                  --suffix XDG_DATA_DIRS : '${gnome3.adwaita-icon-theme}/share'
--- a/pkgs/applications/networking/cluster/docker-machine/hyperkit.nix
+++ b/pkgs/applications/networking/cluster/docker-machine/hyperkit.nix
@ -1,12 +1,12 @@
 { lib, buildGoModule, minikube }:

 buildGoModule rec {
-  inherit (minikube) version src nativeBuildInputs buildInputs vendorSha256 commit;
+  inherit (minikube) version src nativeBuildInputs buildInputs vendorSha256;

  pname = "docker-machine-hyperkit";

  buildPhase = ''
-    make docker-machine-driver-hyperkit COMMIT=${commit}
+    make docker-machine-driver-hyperkit COMMIT=${src.rev}
  '';

  installPhase = ''
--- a/pkgs/applications/networking/cluster/docker-machine/kvm2.nix
+++ b/pkgs/applications/networking/cluster/docker-machine/kvm2.nix
@ -1,7 +1,7 @@
 { lib, buildGoModule, minikube }:

 buildGoModule rec {
-  inherit (minikube) version src nativeBuildInputs buildInputs vendorSha256 commit;
+  inherit (minikube) version src nativeBuildInputs buildInputs vendorSha256;

  pname = "docker-machine-kvm2";

@ -10,7 +10,7 @@ buildGoModule rec {
  '';

  buildPhase = ''
-    make docker-machine-driver-kvm2 COMMIT=${commit}
+    make docker-machine-driver-kvm2 COMMIT=${src.rev}
  '';

  installPhase = ''
--- a/pkgs/applications/networking/cluster/fluxctl/default.nix
+++ b/pkgs/applications/networking/cluster/fluxctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "fluxctl";
-  version = "1.19.0";
+  version = "1.20.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = "flux";
    rev = version;
-    sha256 = "1w6ndp0nrpps6pkxnq38hikbnzwahi6j9gn8l0bxd0qkf7cjc5w0";
+    sha256 = "0bfib5pg2cbip6fw45slb0h3a7qpikxsfpclzr86bcnjq60pshl1";
  };

-  vendorSha256 = "0w5l1lkzx4frllflkbilj8qqwf54wkz7hin7q8xn1vflkv3lxcnp";
+  vendorSha256 = "0a5sv11pb2i6r0ffwaiqdhc0m7gz679yfmqw6ix9imk4ybhf4jp9";

  subPackages = [ "cmd/fluxctl" ];

--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@ -11,18 +11,15 @@

 buildGoModule rec {
  pname = "minikube";
-  version = "1.11.0";
+  version = "1.12.0";

-  # for -ldflags
-  commit = "57e2f55f47effe9ce396cea42a1e0eb4f611ebbd";
-
-  vendorSha256 = "1l9dxn7yy21x4b3cg6l5a08wx2ng8qf531ilg8yf1rznwfwjajrv";
+  vendorSha256 = "0wcm7kw5z7d0ch59nyx5xlv5ci7jrwnzspmsh1yb76318cx2aghi";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "minikube";
    rev = "v${version}";
-    sha256 = "0y761svwyrpc4ywdd4vr9hxkg6593wg4wwqzn8n86g0zcz6qg11d";
+    sha256 = "0bvdyfx5vjcgnkqd23rpbbhxf1zigpzxlqpay2sb6dpldsj0nhdk";
  };

  nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];
@ -30,7 +27,7 @@ buildGoModule rec {
  buildInputs = if stdenv.isDarwin then [ vmnet ] else if stdenv.isLinux then [ libvirt ] else null;

  buildPhase = ''
-    make COMMIT=${commit}
+    make COMMIT=${src.rev}
  '';

  installPhase = ''
@ -40,7 +37,7 @@ buildGoModule rec {
    export MINIKUBE_WANTUPDATENOTIFICATION=false
    export MINIKUBE_WANTKUBECTLDOWNLOADMSG=false

-    for shell in bash zsh; do
+    for shell in bash zsh fish; do
      $out/bin/minikube completion $shell > minikube.$shell
      installShellCompletion minikube.$shell
    done
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@ -144,6 +144,7 @@ let
    elasticsearch = callPackage ./elasticsearch {};
    libvirt = callPackage ./libvirt {};
    lxd = callPackage ./lxd {};
+    shell = callPackage ./shell {};
    vpsadmin = callPackage ./vpsadmin {};
  };
 in
--- a/pkgs/applications/networking/cluster/terraform-providers/shell/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/shell/default.nix
@ -0,0 +1,28 @@
+{ stdenv, fetchFromGitHub, buildGoModule }:
+buildGoModule rec {
+  pname = "terraform-provider-shell";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "scottwinkler";
+    repo   = pname;
+    rev    = "v${version}";
+    sha256 = "0jxb30vw93ibnwz8nfqapac7p9r2famzvsf2h4nfbmhkm6mpan4l";
+  };
+
+  vendorSha256 = "1p2ja6cw3dl7mx41svri6frjpgb9pxsrl7sq0rk1d3sviw0f88sg";
+
+  subPackages = [ "." ];
+
+  # Terraform allows checking the provider versions, but this breaks
+  # if the versions are not provided via file paths.
+  postInstall = "mv $out/bin/${pname}{,_v${version}}";
+
+  meta = with stdenv.lib; {
+    inherit (src.meta) homepage;
+    description = "Terraform provider for executing shell commands and saving output to state file";
+    changelog = "https://github.com/scottwinkler/terraform-provider-shell/releases/tag/v${version}";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ mupdt ];
+  };
+}
--- a/pkgs/applications/networking/gns3/default.nix
+++ b/pkgs/applications/networking/gns3/default.nix
@ -1,7 +1,7 @@
 { callPackage }:

 let
-  stableVersion = "2.2.8";
+  stableVersion = "2.2.11";
  previewVersion = stableVersion;
  addVersion = args:
    let version = if args.stable then stableVersion else previewVersion;
@ -15,18 +15,19 @@ let
          src = oldAttrs.src.override {
            inherit version sha256;
          };
-          doCheck = oldAttrs.doCheck && (attrname != "psutil");
        });
      };
    commonOverrides = [
-      (mkOverride "psutil" "5.6.6"
-        "1rs6z8bfy6bqzw88s4i5zllrx3i18hnkv4akvmw7bifngcgjh8dd")
+      (mkOverride "psutil" "5.7.0"
+        "03jykdi3dgf1cdal9bv4fq9zjvzj9l9bs99gi5ar81sdl5nc2pk8")
+      (mkOverride "jsonschema" "3.2.0"
+        "0ykr61yiiizgvm3bzipa3l73rvj49wmrybbfwhvpgk3pscl5pa68")
    ];
  };
  mkGui = args: callPackage (import ./gui.nix (addVersion args // extraArgs)) { };
  mkServer = args: callPackage (import ./server.nix (addVersion args // extraArgs)) { };
-  guiSrcHash = "1qgzad9hdbvkdalzdnlg5gnlzn2f9qlpd1aj8djmi6w1mmdkf9q7";
-  serverSrcHash = "1kg38dh0xk4yvi7hz0d5dq9k0wany0sfd185l0zxs3nz78zd23an";
+  guiSrcHash = "1carwhp49l9zx2p6i3in03x6rjzn0x6ls2svwazd643rmrl4y7gn";
+  serverSrcHash = "0acbxay1pwq62yq9q67hid44byyi6rb6smz5wa8br3vka7z31iqf";
 in {
  guiStable = mkGui {
    stable = true;
--- a/pkgs/applications/networking/gns3/gui.nix
+++ b/pkgs/applications/networking/gns3/gui.nix
@ -4,8 +4,6 @@

 let
  defaultOverrides = commonOverrides ++ [
-    (mkOverride "jsonschema" "3.2.0"
-      "0ykr61yiiizgvm3bzipa3l73rvj49wmrybbfwhvpgk3pscl5pa68")
  ];

  python = python3.override {
@ -23,7 +21,7 @@ in python.pkgs.buildPythonPackage rec {
  };

  propagatedBuildInputs = with python.pkgs; [
-    raven psutil jsonschema # tox for check
+    sentry-sdk psutil jsonschema # tox for check
    # Runtime dependencies
    sip (pyqt5.override { withWebSockets = true; }) distro setuptools
    pkgs.qt5Full
--- a/pkgs/applications/networking/gns3/server.nix
+++ b/pkgs/applications/networking/gns3/server.nix
@ -4,10 +4,19 @@

 let
  defaultOverrides = commonOverrides ++ [
-    (mkOverride "jsonschema" "3.2.0"
-      "0ykr61yiiizgvm3bzipa3l73rvj49wmrybbfwhvpgk3pscl5pa68")
-    (mkOverride "aiofiles" "0.4.0"
-      "1vmvq9qja3wahv8m1adkyk00zm7j0x64pk3f2ry051ja66xa07h2")
+    (mkOverride "aiofiles" "0.5.0"
+      "98e6bcfd1b50f97db4980e182ddd509b7cc35909e903a8fe50d8849e02d815af")
+    (self: super: {
+      py-cpuinfo = super.py-cpuinfo.overridePythonAttrs (oldAttrs: rec {
+        version = "6.0.0";
+        src = fetchFromGitHub {
+           owner = "workhorsy";
+           repo = "py-cpuinfo";
+           rev = "v${version}";
+           sha256 = "0595gjkd7gzmn9cfpgjw3ia2sl1y8mmw7ajyscibjx59m5mqcki5";
+        };
+      });
+    })
  ];

  python = python3.override {
@ -31,7 +40,7 @@ in python.pkgs.buildPythonPackage {

  propagatedBuildInputs = with python.pkgs; [
    aiohttp-cors yarl aiohttp multidict setuptools
-    jinja2 psutil zipstream raven jsonschema distro async_generator aiofiles
+    jinja2 psutil zipstream sentry-sdk jsonschema distro async_generator aiofiles
    prompt_toolkit py-cpuinfo
  ];

--- a/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
+++ b/pkgs/applications/networking/instant-messengers/riot/riot-web.nix
@ -12,11 +12,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "riot-web";
-  version = "1.6.7";
+  version = "1.6.8";

  src = fetchurl {
    url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "14g5rbvcw6p0q50slbf0c7s39i54ggv2cjc5iv93yvfrwn3z0f8p";
+    sha256 = "09jazixxaq9fcw3qld73hpknw7pcjg3b94hhgipl3zyn6dvqk3xv";
  };

  installPhase = ''
--- a/pkgs/applications/networking/ipfs-migrator/default.nix
+++ b/pkgs/applications/networking/ipfs-migrator/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "ipfs-migrator";
-  version = "1.5.1";
+  version = "1.6.3";

  src = fetchFromGitHub {
    owner = "ipfs";
    repo = "fs-repo-migrations";
    rev = "v${version}";
-    sha256 = "18pjxkxfbsbbj4hs4xyzfmmz991h31785ldx41dll6wa9zx4lsnm";
+    sha256 = "13ah5jk8n3wznvag6dda1ssgpqsdr9pdgvqm9gcsb7zzls89j9x5";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/mailreaders/mutt/default.nix
+++ b/pkgs/applications/networking/mailreaders/mutt/default.nix
@ -27,11 +27,11 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "mutt";
-  version = "1.14.5";
+  version = "1.14.6";

  src = fetchurl {
    url = "http://ftp.mutt.org/pub/mutt/${pname}-${version}.tar.gz";
-    sha256 = "0p1xiqzmkqlzy5yi4l0dh0lacdq300zdj48zk0fir8j1pp512sri";
+    sha256 = "0i0q6vwhnb1grimsrpmz8maw255rh9k0laijzxkry6xqa80jm5s7";
  };

  patches = optional smimeSupport (fetchpatch {
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@ -128,14 +128,14 @@ let
  } source;

  source = rec {
-    version = "1.3.1";
+    version = "1.3.2";

    # Needs submodules
    src = fetchFromGitHub {
      owner = "mumble-voip";
      repo = "mumble";
      rev = version;
-      sha256 = "1xsla9g7xbq6xniwcsjik5hbjh0xahv44qh4z9hjn7p70b8vgnwc";
+      sha256 = "1ljn7h7dr9iyhvq7rdh0prl7hzn9d2hhnxv0ni6dha6f7d9qbfy6";
      fetchSubmodules = true;
    };
  };
--- a/pkgs/applications/networking/p2p/stig/default.nix
+++ b/pkgs/applications/networking/p2p/stig/default.nix
@ -7,13 +7,13 @@ python3Packages.buildPythonApplication rec {
  pname = "stig";
  # This project has a different concept for pre release / alpha,
  # Read the project's README for details: https://github.com/rndusr/stig#stig
-  version = "0.11.0a";
+  version = "0.11.2a0";

  src = fetchFromGitHub {
    owner = "rndusr";
    repo = "stig";
    rev = "v${version}";
-    sha256 = "192v8f80jfly12bqzsslpxlvm72kdqm3jl40x1az5czpg4ab3lb7";
+    sha256 = "05dn6mr86ly65gdqarl16a2jk1bwiw5xa6r4kyag3s6lqsv66iw8";
  };

  # urwidtrees 1.0.3 is requested by the developer because 1.0.2 (which is packaged
--- a/pkgs/applications/networking/p2p/transmission/default.nix
+++ b/pkgs/applications/networking/p2p/transmission/default.nix
@ -57,6 +57,9 @@ in stdenv.mkDerivation {
  ++ lib.optionals enableQt [ qt5.wrapQtAppsHook ]
  ;

+  # Doc has high risk of collisions
+  postInstall = "rm -r $out/share/doc";
+
  buildInputs = [
    openssl
    curl
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -3,17 +3,17 @@
 let
  common = { stname, target, postInstall ? "" }:
    buildGoModule rec {
-      version = "1.6.1";
+      version = "1.7.0";
      name = "${stname}-${version}";

      src = fetchFromGitHub {
        owner  = "syncthing";
        repo   = "syncthing";
        rev    = "v${version}";
-        sha256 = "1lhbx1mh2hdjjwks3s17i8y9vbl3fnapc1czaf42pp7nf8245q3j";
+        sha256 = "0jz1xfbs5ql9z7zdldyxc6wr0y5b0pf3vg8vzva5ml9aiqjcs9fg";
      };

-      vendorSha256 = "12g63a6jsshzqjgww792xmvybhfbkjx5aza4xnyljjsp453iky7k";
+      vendorSha256 = "1gmdv0g0gymq6khrwvplw6yfp146kg5ar8vqdp5dlp0myxfzi22b";

      patches = [
        ./add-stcli-target.patch
--- a/pkgs/applications/science/electronics/gtkwave/default.nix
+++ b/pkgs/applications/science/electronics/gtkwave/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "gtkwave";
-  version = "3.3.104";
+  version = "3.3.105";

  src = fetchurl {
    url    = "mirror://sourceforge/gtkwave/${pname}-gtk3-${version}.tar.gz";
-    sha256 = "1qvldbnlp3wkqr5ff93f6pdvv9yzij7lxfhpqlizakz08l1xb391";
+    sha256 = "1vifgyhwqhpipnzmsivncawqjqihcm5kyg3yyygmd0lmgljy9rs4";
  };

  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@ -9,11 +9,11 @@
 }:

 stdenv.mkDerivation {
-  name = "gromacs-2020.2";
+  name = "gromacs-2020.3";

  src = fetchurl {
-    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-2020.2.tar.gz";
-    sha256 = "1wyjgcdl30wy4hy6jvi9lkq53bqs9fgfq6fri52dhnb3c76y8rbl";
+    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-2020.3.tar.gz";
+    sha256 = "1acjrhcfzpqy2dncblhj97602jbg9gdha4q1bgji9nrj25lq6cch";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/science/robotics/qgroundcontrol/default.nix
+++ b/pkgs/applications/science/robotics/qgroundcontrol/default.nix
@ -1,4 +1,4 @@
-{ lib, mkDerivation, fetchgit, SDL2
+{ lib, mkDerivation, fetchFromGitHub, SDL2
 , qtbase, qtcharts, qtlocation, qtserialport, qtsvg, qtquickcontrols2
 , qtgraphicaleffects, qtspeech, qtx11extras, qmake, qttools
 , gst_all_1, wayland, pkgconfig
@ -6,7 +6,7 @@

 mkDerivation rec {
  pname = "qgroundcontrol";
-  version = "4.0.8";
+  version = "4.0.9";

  qtInputs = [
    qtbase qtcharts qtlocation qtserialport qtsvg qtquickcontrols2
@ -58,10 +58,11 @@ mkDerivation rec {
  '';

  # TODO: package mavlink so we can build from a normal source tarball
-  src = fetchgit {
-    url = "https://github.com/mavlink/qgroundcontrol.git";
+  src = fetchFromGitHub {
+    owner = "mavlink";
+    repo = pname;
    rev = "v${version}";
-    sha256 = "0jr9jpjqdwizsvh9zm0fdp8k2r4536m40dxrn30fbr3ba8vnzkgq";
+    sha256 = "0fwibgb9wmxk2zili5vsibi2q6pk1gna21870y5abx4scbvhgq68";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/version-management/gerrit/default.nix
+++ b/pkgs/applications/version-management/gerrit/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "gerrit";
-  version = "3.1.5";
+  version = "3.2.2";

  src = fetchurl {
    url = "https://gerrit-releases.storage.googleapis.com/gerrit-${version}.war";
-    sha256 = "0gyh6a0p8gcrfnkm0sdjvzg6is9iirxjyffgza6k4v9rz6pjx8i8";
+    sha256 = "08i6rb8hawj44gg57mbhwjjmfn7mc45racl8gjsyrcyb8jm6zj1s";
  };

  buildCommand = ''
@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
    homepage = "https://www.gerritcodereview.com/index.md";
    license = licenses.asl20;
    description = "A web based code review and repository management for the git version control system";
-    maintainers = with maintainers; [ jammerful zimbatm ];
+    maintainers = with maintainers; [ flokli jammerful zimbatm ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/version-management/git-and-tools/delta/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/delta/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "delta";
-  version = "0.2.0";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "dandavison";
    repo = pname;
    rev = version;
-    sha256 = "15c7rsmiinnpxh12520jz3wr0j86vgzjq1ss5pf30fa7lcgicb32";
+    sha256 = "0y3gkan5v0d6637yf5p5a9dklyv5zngw7a8pyqzj4ixys72ixg20";
  };

-  cargoSha256 = "0lzz32qh80s4dxr0d4pg0qagkn549lr4vbqknl2l0cmlq1bvvq6g";
+  cargoSha256 = "15sh2lsc16nf9w7sp3avy77f4vyj0rdsm6m1bn60y8gmv2r16v6i";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@ -8,11 +8,11 @@ with stdenv.lib;

 buildGoPackage rec {
  pname = "gitea";
-  version = "1.12.1";
+  version = "1.12.2";

  src = fetchurl {
    url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "0n92msf5pbgb5q6pa2p0nj9lnzs4y0qis62c5mp4hp8rc1j22wlb";
+    sha256 = "12zzb1c4cl07ccxaravkmia8vdyw5ffxrlx9v95ampvv6a0swpb9";
  };

  unpackPhase = ''
--- a/pkgs/applications/video/webtorrent_desktop/default.nix
+++ b/pkgs/applications/video/webtorrent_desktop/default.nix
@ -1,14 +1,16 @@
 {
-  alsaLib, atk, cairo, cups, dbus, dpkg, expat, fetchurl, fontconfig, freetype,
-  gdk-pixbuf, glib, gnome2, libX11, libXScrnSaver, libXcomposite, libXcursor,
+  alsaLib, atk, cairo, cups, dbus, dpkg, expat, fetchurl, fetchzip, fontconfig, freetype,
+  gdk-pixbuf, glib, gnome3, libX11, libXScrnSaver, libXcomposite, libXcursor,
  libXdamage, libXext, libXfixes, libXi, libXrandr, libXrender, libXtst,
-  libxcb, nspr, nss, stdenv, udev
+  libxcb, nspr, nss, stdenv, udev, libuuid, pango, at-spi2-atk, at-spi2-core
 }:

  let
    rpath = stdenv.lib.makeLibraryPath ([
    alsaLib
    atk
+    at-spi2-core
+    at-spi2-atk
    cairo
    cups
    dbus
@ -17,9 +19,9 @@
    freetype
    gdk-pixbuf
    glib
-    gnome2.GConf
-    gnome2.gtk
-    gnome2.pango
+    gnome3.gtk
+    pango
+    libuuid
    libX11
    libXScrnSaver
    libXcomposite
@ -39,29 +41,33 @@
    ]);
  in stdenv.mkDerivation rec {
    pname = "webtorrent-desktop";
-    version = "0.20.0";
+    version = "0.21.0";

    src =
      if stdenv.hostPlatform.system == "x86_64-linux" then
-        fetchurl {
-          url = "https://github.com/webtorrent/webtorrent-desktop/releases/download/v0.20.0/webtorrent-desktop_${version}-1_amd64.deb";
-          sha256 = "1kkrnbimiip5pn2nwpln35bbdda9gc3cgrjwphq4fqasbjf2781k";
+        fetchzip {
+          url = "https://github.com/webtorrent/webtorrent-desktop/releases/download/v${version}/WebTorrent-v${version}-linux.zip";
+          sha256 = "13gd8isq2l10kibsc1bsc15dbgpnwa7nw4cwcamycgx6pfz9a852";
        }
        else
          throw "Webtorrent is not currently supported on ${stdenv.hostPlatform.system}";
+    desktopFile = fetchurl {
+      url = "https://raw.githubusercontent.com/webtorrent/webtorrent-desktop/v${version}/static/linux/share/applications/webtorrent-desktop.desktop";
+      sha256 = "1v16dqbxqds3cqg3xkzxsa5fyd8ssddvjhy9g3i3lz90n47916ca";
+    };
+    icon256File = fetchurl {
+      url = "https://raw.githubusercontent.com/webtorrent/webtorrent-desktop/v${version}/static/linux/share/icons/hicolor/256x256/apps/webtorrent-desktop.png";
+      sha256 = "1dapxvvp7cx52zhyaby4bxm4rll9xc7x3wk8k0il4g3mc7zzn3yk";
+    };
+    icon48File = fetchurl {
+      url = "https://raw.githubusercontent.com/webtorrent/webtorrent-desktop/v${version}/static/linux/share/icons/hicolor/48x48/apps/webtorrent-desktop.png";
+      sha256 = "00y96w9shbbrdbf6xcjlahqd08154kkrxmqraik7qshiwcqpw7p4";
+    };
    phases = [ "unpackPhase" "installPhase" ];
    nativeBuildInputs = [ dpkg ];
-    unpackPhase = "dpkg-deb -x $src .";
    installPhase = ''
-      mkdir -p $out
-      cp -R opt $out
-
-      mv ./usr/share $out/share
-      mv $out/opt/webtorrent-desktop $out/libexec
-      chmod +x $out/libexec/WebTorrent
-      rmdir $out/opt
-
-      chmod -R g-w $out
+      mkdir -p $out/share/{applications,icons/hicolor/{48x48,256x256}/apps}
+      cp -R . $out/libexec

      # Patch WebTorrent
      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
@ -71,9 +77,11 @@
      mkdir -p $out/bin
      ln -s $out/libexec/WebTorrent $out/bin/WebTorrent

-      # Fix the desktop link
-      substituteInPlace $out/share/applications/webtorrent-desktop.desktop \
-        --replace /opt/webtorrent-desktop $out/bin
+      cp $icon48File $out/share/icons/hicolor/48x48/apps/webtorrent-desktop.png
+      cp $icon256File $out/share/icons/hicolor/256x256/apps/webtorrent-desktop.png
+      ## Fix the desktop link
+      substitute $desktopFile $out/share/applications/webtorrent-desktop.desktop \
+        --replace /opt/webtorrent-desktop $out/libexec
    '';

    meta = with stdenv.lib; {
--- a/pkgs/data/fonts/jetbrains-mono/default.nix
+++ b/pkgs/data/fonts/jetbrains-mono/default.nix
@ -1,14 +1,14 @@
 { lib, fetchzip }:

 let
-  version = "1.0.6";
+  version = "2.001";
 in
-fetchzip rec {
+fetchzip {
  name = "JetBrainsMono-${version}";

-  url = "https://github.com/JetBrains/JetBrainsMono/releases/download/v${version}/JetBrainsMono-${version}.zip";
+  url = "https://github.com/JetBrains/JetBrainsMono/releases/download/v${version}/JetBrains.Mono.${version}.zip";

-  sha256 = "1198k5zw91g85h6n7rg3y7wcj1nrbby9zlr6zwlmiq0nb37n0d3g";
+  sha256 = "06rh8dssq6qzgb9rri3an2ka24j47c0i8yhgq81yyg471spc39h1";

  postFetch = ''
    mkdir -p $out/share/fonts
--- a/pkgs/data/icons/iconpack-jade/default.nix
+++ b/pkgs/data/icons/iconpack-jade/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "iconpack-jade";
-  version = "1.22";
+  version = "1.23";

  src = fetchFromGitHub {
    owner = "madmaxms";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1piypv8wdxnfiy6kgh7i3wi52m4fh4x874kh01qjmymssyirn17x";
+    sha256 = "1q29ikfssn1vmwws3dry4ssq6b44afd9sb7dwv3rdqg0frabpj1m";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/data/themes/cde-motif-theme/default.nix
+++ b/pkgs/data/themes/cde-motif-theme/default.nix
@ -1,7 +1,7 @@
 { stdenv, fetchFromGitHub, python2Packages }:

 stdenv.mkDerivation rec {
-  pname = "cde-motif-theme";
+  pname = "cdetheme";
  version = "1.3";

  src = fetchFromGitHub {
@ -29,5 +29,6 @@ stdenv.mkDerivation rec {
    license = licenses.gpl3;
    platforms = platforms.all;
    maintainers = with maintainers; [ gnidorah ];
+    hydraPlatforms = [];
  };
 }
--- a/pkgs/data/themes/yaru/default.nix
+++ b/pkgs/data/themes/yaru/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "yaru";
-  version = "20.04.7";
+  version = "20.10.1";

  src = fetchFromGitHub {
    owner = "ubuntu";
    repo = "yaru";
    rev = version;
-    sha256 = "05fpr928kgyly7ac3zf6hfw9wqgc7fjn6980ih54iqc2qffcglsk";
+    sha256 = "08zws1qwvfr126fgdkqxxmpsqgfk02s31n90555bd5d66cfgdh72";
  };

  nativeBuildInputs = [ meson sassc pkg-config glib ninja python3 ];
--- a/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-initial-setup/default.nix
@ -36,11 +36,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-initial-setup";
-  version = "3.36.3";
+  version = "3.36.4";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "11f2yj8q844gks3jkfbi4ap448snz1wjflqbq4y2kk12r3w37afq";
+    sha256 = "17szzz2a5wpi7kwjnhimiwf8vg0bfliyk3k0adgv1pw2mcfpxp5s";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome-3/extensions/dash-to-panel/default.nix
+++ b/pkgs/desktops/gnome-3/extensions/dash-to-panel/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-shell-dash-to-panel";
-  version = "31";
+  version = "38";

  src = fetchFromGitHub {
    owner = "home-sweet-gnome";
    repo = "dash-to-panel";
    rev = "v${version}";
-    sha256 = "0vh36mdncjvfp1jbinifznj5dw3ahsswwm3m9sjw5gydsbx6vh83";
+    sha256 = "1kvybb49l1vf0fvh8d0c6xkwnry8m330scamf5x40y63d4i213j1";
  };

  buildInputs = [
--- a/pkgs/desktops/gnome-3/games/gnome-taquin/default.nix
+++ b/pkgs/desktops/gnome-3/games/gnome-taquin/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-taquin";
-  version = "3.36.3";
+  version = "3.36.4";

  src = fetchurl {
    url = "mirror://gnome/sources/gnome-taquin/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "149bv8q2a44i9msyshhh57nxwf5a43hankbndbvjqvq95yqlnhv4";
+    sha256 = "0awfssqpswsyla4gn80ifj53biwq34hcadxlknnlm7jpz0z38cp0";
  };

  passthru = {
--- a/pkgs/desktops/gnome-3/games/tali/default.nix
+++ b/pkgs/desktops/gnome-3/games/tali/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "tali";
-  version = "3.36.1";
+  version = "3.36.4";

  src = fetchurl {
    url = "mirror://gnome/sources/tali/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "1klnxk49rr1m2lr4zj1wvfl0iaxzdh2k8ngrcmfmcq39vlxnn94y";
+    sha256 = "12h6783m4634zzprlk31j0dmvgzrfjklhl0z49fdwcziw5bszr3c";
  };

  passthru = {
--- a/pkgs/development/arduino/platformio/chrootenv.nix
+++ b/pkgs/development/arduino/platformio/chrootenv.nix
@ -1,4 +1,4 @@
-{ lib, buildFHSUserEnv }:
+{ lib, buildFHSUserEnv, fetchFromGitHub }:

 let
  pio-pkgs = pkgs:
@ -19,6 +19,14 @@ let
      platformio
    ]);

+  src = fetchFromGitHub {
+    owner = "platformio";
+    repo = "platformio-core";
+    rev = "v4.3.4";
+    sha256 = "0vf2j79319ypr4yrdmx84853igkb188sjfvlxgw06rlsvsm3kacq";
+  };
+
+
 in buildFHSUserEnv {
  name = "platformio";

@ -34,7 +42,10 @@ in buildFHSUserEnv {
  };

  extraInstallCommands = ''
+    mkdir -p $out/lib/udev/rules.d
+
    ln -s $out/bin/platformio $out/bin/pio
+    ln -s ${src}/scripts/99-platformio-udev.rules $out/lib/udev/rules.d/99-platformio-udev.rules
  '';

  runScript = "platformio";
--- a/Show More
+++ b/Show More